diff --git a/.github/ISSUE_TEMPLATE/release-qa.md b/.github/ISSUE_TEMPLATE/release-qa.md
index 19bf5104eec4..5d77f255fc94 100644
--- a/.github/ISSUE_TEMPLATE/release-qa.md
+++ b/.github/ISSUE_TEMPLATE/release-qa.md
@@ -118,6 +118,15 @@ Smoke tests are limited to core functionality and serve as a pre-release final r
 7. Verify scripts display correctly in Activity feed.
 </td><td>pass/fail</td></tr>
 
+<tr><td>Software</td><td>Verify software library and install / download</td><td>
+
+1. Verify software library upload/download/delete.
+2. From Host details (Windows and macOS) run an install that should PASS, verify.
+3. From My Device (Windows and macOS) software tab should have self-service items available, verify.
+4. Verify UI loading state and statuses for installing software.
+6. Verify software installs display correctly in Activity feed.
+</td><td>pass/fail</td></tr>
+
 <tr><td>OS settings</td><td>Verify OS settings functionality</td><td>
 
 1. Verify able to configure Disk encryption.
diff --git a/.github/ISSUE_TEMPLATE/story.md b/.github/ISSUE_TEMPLATE/story.md
index cac409d4e394..3f01ffd97920 100644
--- a/.github/ISSUE_TEMPLATE/story.md
+++ b/.github/ISSUE_TEMPLATE/story.md
@@ -32,16 +32,17 @@ What else should contributors [keep in mind](https://fleetdm.com/handbook/compan
 ## Changes
 
 ### Product
+- [ ] Reference documentation changes: TODO <!-- Specify references documentation changes at fleetdm.com/docs -->
 - [ ] UI changes: TODO <!-- Insert the link to the relevant Figma cover page. Remove this checkbox if there are no changes to the user interface. -->
-- [ ] CLI usage changes: TODO <!-- Insert the link to the relevant Figma cover page. Remove this checkbox if there are no changes to the CLI. -->
+- [ ] CLI (fleetctl) usage changes: TODO <!-- Insert the link to the relevant Figma cover page. Remove this checkbox if there are no changes to the CLI. -->
+- [ ] YAML changes: TODO <!-- Specify changes as a draft PR to the YAML files doc page and request the API DRI for review (codeowner reviews are not automatically requested for drafts). Remove this checkbox if there are no changes necessary. -->
 - [ ] REST API changes: TODO <!-- Specify changes as a draft PR to the REST API doc page and request the API DRI for review (codeowner reviews are not automatically requested for drafts). Remove this checkbox if there are no changes necessary. Move this item to the engineering list below if engineering will design the API changes. -->
 - [ ] Fleet's agent (fleetd) changes: TODO <!-- Specify changes to fleetd. If the change requires a new Fleet (server) version, consider specifying to only enable this change in new Fleet versions. Remove this checkbox if there are no changes necessary. -->
 - [ ] Permissions changes: TODO <!-- Specify changes as a draft PR to the Manage access doc page. If doc changes aren't necessary, explicitly mention no changes to the doc page. Remove this checkbox if there are no permissions changes. -->
 - [ ] Changes to paid features or tiers: TODO  <!-- Specify "Fleet Free" or "Fleet Premium".  If only certain parts of the user story involve paid features, specify which parts.  Implementation of paid features should live in the `ee/` directory. -->
 
 ### Engineering
-- [ ] Reference documentation changes: TODO <!-- Specify references documentation changes at fleetdm.com/docs -->
-- [ ] Usage documentation changes: TODO <!-- Specify usage documentation changes at fleetdm.com/docs/using-fleet -->
+- [ ] Feature guide changes: TODO <!-- Specify if a new feature guide is required at fleetdm.com/guides, or if a previous guide should be updated to reflect feature changes. -->
 - [ ] Database schema migrations: TODO <!-- Specify what changes to the database schema are required. (This will be used to change migration scripts accordingly.) Remove this checkbox if there are no changes necessary. -->
 - [ ] Load testing: TODO  <!-- List any required scalability testing to be conducted.  Remove this checkbox if there is no scalability testing required. -->
 
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index d2cc7966af7f..cf6e9c46e2d8 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -5,16 +5,18 @@ If some of the following don't apply, delete the relevant line.
 <!-- Note that API documentation changes are now addressed by the product design team. -->
 
 - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`.
-  See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information.
+  See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information.
 - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements)
 - [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features.
 - [ ] Added/updated tests
+- [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes
 - [ ] If database migrations are included, checked table schema to confirm autoupdate
 - For database migrations:
   - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration.
   - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects.
   - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`).
 - [ ] Manual QA for all new/changed functionality
-  - For Orbit and Fleet Desktop changes:
-    - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux.
-    - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).
+- For Orbit and Fleet Desktop changes:
+   - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`).
+   - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux.
+   - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).
diff --git a/.github/workflows/build-and-push-fleetctl-docker.yml b/.github/workflows/build-and-check-fleetctl-docker-and-deps.yml
similarity index 51%
rename from .github/workflows/build-and-push-fleetctl-docker.yml
rename to .github/workflows/build-and-check-fleetctl-docker-and-deps.yml
index 8ae3c7069e2d..ff20260409ac 100644
--- a/.github/workflows/build-and-push-fleetctl-docker.yml
+++ b/.github/workflows/build-and-check-fleetctl-docker-and-deps.yml
@@ -1,13 +1,14 @@
-name: Build and push fleetdm/fleetctl Docker image
+name: Build fleetctl docker dependencies and check vulnerabilities
 
-# Manually trigger this workflow for now
 on:
   workflow_dispatch:
     inputs:
       image_tag:
-        description: 'Docker image tag'
+        description: "Docker image tag"
         required: true
         type: string
+  schedule:
+    - cron: "0 6 * * *"
 
 # This allows a subsequently queued workflow run to interrupt previous runs
 concurrency:
@@ -23,7 +24,7 @@ permissions:
   contents: read
 
 jobs:
-  docker-push:
+  build-and-check:
     runs-on: ubuntu-latest
     environment: Docker Hub
     permissions:
@@ -46,25 +47,46 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
 
       - name: Install Go Dependencies
         run: make deps-go
 
+      - name: Build fleetdm/wix
+        run: make wix-docker
+
+      - name: Build fleetdm/bomutils
+        run: make bomutils-docker
+
       - name: Build fleetdm/fleetctl
         run: make fleetctl-docker
 
-      - name: Push to Docker
-        run: |
-          docker tag fleetdm/fleetctl fleetdm/fleetctl:${{ inputs.image_tag }}
-          docker push fleetdm/fleetctl:${{ inputs.image_tag }}
+      - name: Run Trivy vulnerability scanner on fleetdm/wix
+        uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8
+        with:
+          image-ref: "fleetdm/wix"
+          format: "table"
+          exit-code: "1"
+          ignore-unfixed: true
+          vuln-type: "os,library"
+          severity: "CRITICAL"
+
+      - name: Run Trivy vulnerability scanner on fleetdm/bomutils
+        uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8
+        with:
+          image-ref: "fleetdm/bomutils"
+          format: "table"
+          exit-code: "1"
+          ignore-unfixed: true
+          vuln-type: "os,library"
+          severity: "CRITICAL"
 
-      - name: Push To quay.io
-        id: push-to-quay
-        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2.7.1
+      - name: Run Trivy vulnerability scanner on fleetdm/fleetctl
+        uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8
         with:
-          image: fleetdm/fleetctl
-          tags: ${{ inputs.image_tag }}
-          registry: quay.io/
-          username: fleetdm+fleetreleaser
-          password: ${{ secrets.QUAY_REGISTRY_PASSWORD }}
+          image-ref: "fleetdm/fleetctl"
+          format: "table"
+          exit-code: "1"
+          ignore-unfixed: true
+          vuln-type: "os,library"
+          severity: "CRITICAL"
diff --git a/.github/workflows/build-binaries.yaml b/.github/workflows/build-binaries.yaml
index ed18437c74a5..278f958b2842 100644
--- a/.github/workflows/build-binaries.yaml
+++ b/.github/workflows/build-binaries.yaml
@@ -29,10 +29,13 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Checkout Code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
 
       # Set the Node.js version
       - name: Set up Node.js ${{ vars.NODE_VERSION }}
@@ -40,9 +43,6 @@ jobs:
         with:
           node-version: ${{ vars.NODE_VERSION }}
 
-      - name: Checkout Code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
-
       - name: JS Dependency Cache
         id: js-cache
         uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v2
diff --git a/.github/workflows/build-orbit.yaml b/.github/workflows/build-orbit.yaml
index 09f296aece9e..002d2657f6ed 100644
--- a/.github/workflows/build-orbit.yaml
+++ b/.github/workflows/build-orbit.yaml
@@ -59,7 +59,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
 
       - name: Build, codesign and notarize orbit
         run: go run ./orbit/tools/build/build.go 
diff --git a/.github/workflows/check-automated-doc.yml b/.github/workflows/check-automated-doc.yml
index c654e7ae4fdc..d289c55318de 100644
--- a/.github/workflows/check-automated-doc.yml
+++ b/.github/workflows/check-automated-doc.yml
@@ -36,15 +36,16 @@ jobs:
         with:
           egress-policy: audit
 
-      - name: Install Go
-        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
-        with:
-          go-version: ${{ vars.GO_VERSION }}
       - name: Checkout Code
         uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
         with:
           fetch-depth: 0
 
+      - name: Install Go
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version-file: 'go.mod'
+
       - name: Verify golang generated documentation is up-to-date
         run: |
           make generate-doc
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 246c6418a170..c69888f874db 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -56,7 +56,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
-        go-version: ${{ vars.GO_VERSION }}
+        go-version-file: 'go.mod'
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/deploy-bulk-operations-dashboard.yml b/.github/workflows/deploy-bulk-operations-dashboard.yml
new file mode 100644
index 000000000000..090e409fac3d
--- /dev/null
+++ b/.github/workflows/deploy-bulk-operations-dashboard.yml
@@ -0,0 +1,89 @@
+name: Deploy app to bulk operations dashboard pipeline on Heroku.
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'ee/bulk-operations-dashboard/**'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    permissions:
+      contents: write  # for Git to git push
+    if: ${{ github.repository == 'fleetdm/fleet' }}
+
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [14.x]
+
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
+    # Configure our access credentials for the Heroku CLI
+    - uses: akhileshns/heroku-deploy@79ef2ae4ff9b897010907016b268fd0f88561820 # v3.6.8
+      with:
+        heroku_api_key: ${{secrets.HEROKU_API_TOKEN_FOR_BOT_USER}}
+        heroku_app_name: "" # this has to be blank or it doesn't work
+        heroku_email: ${{secrets.HEROKU_EMAIL_FOR_BOT_USER}}
+        justlogin: true
+    - run: heroku auth:whoami
+
+    # Set the Node.js version
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+      with:
+        node-version: ${{ matrix.node-version }}
+
+    # Now start building!
+    # > …but first, get a little crazy for a sec and delete the top-level package.json file
+    # > i.e. the one used by the Fleet server.  This is because require() in node will go
+    # > hunting in ancestral directories for missing dependencies, and since some of the
+    # > bundled transpiler tasks sniff for package availability using require(), this trips
+    # > up when it encounters another Node universe in the parent directory.
+    - run: rm -rf package.json package-lock.json node_modules/
+    # > Turns out there's a similar issue with how eslint plugins are looked up, so we
+    # > delete the top level .eslintrc file too.
+    - run: rm -f .eslintrc.js
+    # > And, as a change to the top-level fleetdm/fleet .gitignore on May 2, 2022 revealed,
+    # > we also need to delete the top level .gitignore file too, so that its rules don't
+    # > interfere with the committing and force-pushing we're doing as part of our deploy
+    # > script here.  For more info, see: https://github.com/fleetdm/fleet/pull/5549
+    - run: rm -f .gitignore
+
+    # Get dependencies (including dev deps)
+    - run: cd ee/bulk-operations-dashboard/ && npm install
+
+    # Run sanity checks
+    - run: cd ee/bulk-operations-dashboard/ && npm test
+
+    # Compile assets
+    - run: cd ee/bulk-operations-dashboard/ && npm run build-for-prod
+
+    # Commit newly-built assets locally so we can push them to Heroku below.
+    # (This commit will never be pushed to GitHub- only to Heroku.)
+    # > The local config flags make this work in GitHub's environment.
+    - run: git add ee/bulk-operations-dashboard/.www
+    - run: git -c "user.name=GitHub" -c "user.email=github@example.com" commit -am 'AUTOMATED COMMIT - Deployed the latest, including modified HTML layouts and .sailsrc file that reference minified assets.'
+
+    # Configure the Heroku app we'll be deploying to
+    - run: heroku git:remote -a bulk-operations-dashboard
+    - run: git remote -v
+
+    # Deploy to Heroku (by pushing)
+    # > Since a shallow clone was grabbed, we have to "unshallow" it before forcepushing.
+    - run: echo "Unshallowing local repository…"
+    - run: git fetch --prune --unshallow
+    - run: echo "Deploying branch '${GITHUB_REF##*/}' to Heroku…"
+    - run: git push heroku +${GITHUB_REF##*/}:master
+    - name: 🌐 The dashboard has been deployed
+      run: echo '' && echo '--' && echo 'OK, done.  It should be live momentarily.' && echo '(if you get impatient, check the Heroku dashboard for status)'
diff --git a/.github/workflows/deploy-fleet-website.yml b/.github/workflows/deploy-fleet-website.yml
index 9fc044e13b3f..371a0014f075 100644
--- a/.github/workflows/deploy-fleet-website.yml
+++ b/.github/workflows/deploy-fleet-website.yml
@@ -64,7 +64,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
-        go-version: ${{ vars.GO_VERSION }}
+        go-version-file: 'go.mod'
 
     # Download top-level dependencies and build Storybook in the website's assets/ folder
     - run: npm install --legacy-peer-deps && npm run build-storybook -- -o ./website/assets/storybook --loglevel verbose
diff --git a/.github/workflows/dogfood-deploy.yml b/.github/workflows/dogfood-deploy.yml
index 39f6983824eb..f17768eec7c5 100644
--- a/.github/workflows/dogfood-deploy.yml
+++ b/.github/workflows/dogfood-deploy.yml
@@ -51,14 +51,17 @@ jobs:
       - id: fail-on-main
         run: "false"
         if: ${{ github.ref == 'main' }}
+
       - uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
         with:
           role-to-assume: ${{env.AWS_IAM_ROLE}}
           aws-region: ${{ env.AWS_REGION }}
+
       - name: Set up Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
+
       - uses: hashicorp/setup-terraform@633666f66e0061ca3b725c73b2ec20cd13a8fdd1 # v2.0.3
         with:
           terraform_version: 1.6.3
@@ -77,6 +80,26 @@ jobs:
         id: plan
         run: terraform plan -no-color
         continue-on-error: true
+      - name: Slack Notification
+        if: success()
+        uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
+        with:
+          payload: |
+            {
+              "text": "${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head.html_url }}",
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "🚀 🛠️ Dogfood deploy in progress\nhttps://github.com/fleetdm/fleet/actions/runs/${{  github.run_id }}"
+                  }
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
         # first we'll scale everything down and create the new task definitions
       - name: Terraform Apply
         id: apply
diff --git a/.github/workflows/dogfood-gitops.yml b/.github/workflows/dogfood-gitops.yml
index 68fc00cee17d..487cdac1ad11 100644
--- a/.github/workflows/dogfood-gitops.yml
+++ b/.github/workflows/dogfood-gitops.yml
@@ -69,6 +69,7 @@ jobs:
           DOGFOOD_GLOBAL_ENROLL_SECRET: ${{ secrets.DOGFOOD_GLOBAL_ENROLL_SECRET }}
           DOGFOOD_SSO_ISSUER_URI: ${{ secrets.DOGFOOD_SSO_ISSUER_URI }}
           DOGFOOD_SSO_METADATA: ${{ secrets.DOGFOOD_SSO_METADATA }}
+          DOGFOOD_MDM_SSO_METADATA_URL: ${{ secrets.DOGFOOD_MDM_SSO_METADATA_URL }}
           DOGFOOD_FAILING_POLICIES_WEBHOOK_URL: ${{ secrets.DOGFOOD_FAILING_POLICIES_WEBHOOK_URL }}
           DOGFOOD_VULNERABILITIES_WEBHOOK_URL: ${{ secrets.DOGFOOD_VULNERABILITIES_WEBHOOK_URL }}
           DOGFOOD_WORKSTATIONS_ENROLL_SECRET: ${{ secrets.DOGFOOD_WORKSTATIONS_ENROLL_SECRET }}
@@ -78,5 +79,6 @@ jobs:
           DOGFOOD_SERVERS_CANARY_ENROLL_SECRET: ${{ secrets.DOGFOOD_SERVERS_CANARY_ENROLL_SECRET }}
           DOGFOOD_EXPLORE_DATA_ENROLL_SECRET: ${{ secrets.DOGFOOD_EXPLORE_DATA_ENROLL_SECRET }}
           DOGFOOD_CALENDAR_API_KEY: ${{ secrets.DOGFOOD_CALENDAR_API_KEY }}
-          DOGFOOD_VIRTUAL_MACHINES_ENROLL_SECRET: ${{ secrets.DOGFOOD_VIRTUAL_MACHINES_ENROLL_SECRET }}
-          DOGFOOD_IPHONES_ENROLL_SECRET: ${{ secrets.DOGFOOD_IPHONES_ENROLL_SECRET }}
+          DOGFOOD_COMPLIANCE_EXCLUSIONS_ENROLL_SECRET: ${{ secrets.DOGFOOD_COMPLIANCE_EXCLUSIONS_ENROLL_SECRET }}
+          DOGFOOD_COMPANY_OWNED_IPHONES_ENROLL_SECRET: ${{ secrets.DOGFOOD_COMPANY_OWNED_IPHONES_ENROLL_SECRET }}
+          DOGFOOD_COMPANY_OWNED_IPADS_ENROLL_SECRET: ${{ secrets.DOGFOOD_COMPANY_OWNED_IPADS_ENROLL_SECRET }}
\ No newline at end of file
diff --git a/.github/workflows/fleet-and-orbit.yml b/.github/workflows/fleet-and-orbit.yml
index 6c222b3774fd..f4dfb2780eb7 100644
--- a/.github/workflows/fleet-and-orbit.yml
+++ b/.github/workflows/fleet-and-orbit.yml
@@ -62,8 +62,7 @@ jobs:
     timeout-minutes: 60
     strategy:
       matrix:
-        go-version: ["${{ vars.GO_VERSION }}"]
-        mysql: ["mysql:5.7"]
+        mysql: ["mysql:8.0.36"]
     runs-on: ubuntu-latest
     needs: gen
     steps:
@@ -72,10 +71,13 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Checkout Code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ matrix.go-version }}
+          go-version-file: 'go.mod'
 
       # Set the Node.js version
       - name: Set up Node.js ${{ vars.NODE_VERSION }}
@@ -83,9 +85,6 @@ jobs:
         with:
           node-version: ${{ vars.NODE_VERSION }}
 
-      - name: Checkout Code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
-
       - name: Start tunnel
         env:
           CERT_PEM: ${{ secrets.CLOUDFLARE_TUNNEL_FLEETUEM_CERT_B64 }}
@@ -111,7 +110,7 @@ jobs:
           done
 
       - name: Start Infra Dependencies
-        run: FLEET_MYSQL_IMAGE=${{ matrix.mysql }} docker-compose up -d mysql redis &
+        run: FLEET_MYSQL_IMAGE=${{ matrix.mysql }} docker compose up -d mysql redis &
 
       - name: Install JS Dependencies
         run: make deps-js
@@ -175,9 +174,6 @@ jobs:
   # This job also makes sure the Fleet server is up and running.
   set-enroll-secret:
     timeout-minutes: 60
-    strategy:
-      matrix:
-        go-version: ["${{ vars.GO_VERSION }}"]
     runs-on: ubuntu-latest
     needs: gen
     steps:
@@ -186,13 +182,13 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Checkout Code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ matrix.go-version }}
-
-      - name: Checkout Code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+          go-version-file: 'go.mod'
 
       - name: Build Fleetctl
         run: make fleetctl
@@ -218,9 +214,6 @@ jobs:
   # Here we generate the Fleet Desktop and osqueryd targets for
   # macOS which can only be generated from a macOS host.
   build-macos-targets:
-    strategy:
-      matrix:
-        go-version: ["${{ vars.GO_VERSION }}"]
     # Set macOS version to '12' (current equivalent to macos-latest) for
     # building the binary. This ensures compatibility with macOS version 13 and
     # later, avoiding runtime errors on systems using macOS 13 or newer.
@@ -234,13 +227,13 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Checkout Code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ matrix.go-version }}
-
-      - name: Checkout Code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+          go-version-file: 'go.mod'
 
       - name: Build desktop.app.tar.gz and osqueryd.app.tar.gz
         run: |
@@ -269,9 +262,6 @@ jobs:
   # installed, and installing it is time consuming and unreliable.
   run-tuf-and-gen-pkgs:
     timeout-minutes: 60
-    strategy:
-      matrix:
-        go-version: ["${{ vars.GO_VERSION }}"]
     runs-on: ubuntu-latest
     needs: [gen, build-macos-targets]
     steps:
@@ -280,13 +270,13 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Checkout Code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ matrix.go-version }}
-
-      - name: Checkout Code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+          go-version-file: 'go.mod'
 
       - name: Download macos pre-built apps
         id: download
@@ -296,7 +286,7 @@ jobs:
 
       - name: Build Repository and run TUF server
         env:
-          SYSTEMS: "macos windows linux"
+          SYSTEMS: "macos windows linux linux-arm64"
           PKG_FLEET_URL: ${{ needs.gen.outputs.address }}
           PKG_TUF_URL: http://localhost:8081
           DEB_FLEET_URL: ${{ needs.gen.outputs.address }}
diff --git a/.github/workflows/fleetctl-preview-latest.yml b/.github/workflows/fleetctl-preview-latest.yml
index dda4e0f73c2d..630cfd1dc325 100644
--- a/.github/workflows/fleetctl-preview-latest.yml
+++ b/.github/workflows/fleetctl-preview-latest.yml
@@ -53,7 +53,6 @@ jobs:
         #   - Unattended installation of Docker on macOS fails. (see
         #   https://github.com/docker/for-mac/issues/6450)
         os: [ubuntu-latest]
-        go-version: ['${{ vars.GO_VERSION }}']
     runs-on: ${{ matrix.os }}
     steps:
 
@@ -62,13 +61,13 @@ jobs:
       with:
         egress-policy: audit
 
+    - name: Checkout Code
+      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
     - name: Install Go
       uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
-        go-version: ${{ matrix.go-version }}
-
-    - name: Checkout Code
-      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        go-version-file: 'go.mod'
 
     - name: Build Fleetctl
       run: make fleetctl
diff --git a/.github/workflows/fleetd-tuf.yml b/.github/workflows/fleetd-tuf.yml
index ebeca889daa1..7641589f102b 100644
--- a/.github/workflows/fleetd-tuf.yml
+++ b/.github/workflows/fleetd-tuf.yml
@@ -30,16 +30,16 @@ jobs:
       with:
         egress-policy: audit
 
-    - name: Install Go
-      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
-      with:
-        go-version: ${{ vars.GO_VERSION }}
-
     - name: Checkout Code
       uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
       with:
         fetch-depth: 0
 
+    - name: Install Go
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+      with:
+        go-version-file: 'go.mod'
+
     - name: Update orbit/TUF.md
       run: |
         make fleetd-tuf
diff --git a/.github/workflows/generate-desktop-targets.yml b/.github/workflows/generate-desktop-targets.yml
index 9dff22841a75..d7324c9bf0ba 100644
--- a/.github/workflows/generate-desktop-targets.yml
+++ b/.github/workflows/generate-desktop-targets.yml
@@ -24,7 +24,7 @@ defaults:
     shell: bash
 
 env:
-  FLEET_DESKTOP_VERSION: 1.27.0
+  FLEET_DESKTOP_VERSION: 1.32.0
 
 permissions:
   contents: read
@@ -45,13 +45,13 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Checkout
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
-
-      - name: Checkout
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+          go-version-file: 'go.mod'
 
       - name: Import signing keys
         env:
@@ -98,13 +98,13 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Checkout
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
-
-      - name: Checkout
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+          go-version-file: 'go.mod'
 
       - name: Generate fleet-desktop.exe
         run: |
@@ -139,21 +139,49 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Checkout
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
+
+      - name: Generate desktop.tar.gz
+        run: |
+          FLEET_DESKTOP_VERSION=$FLEET_DESKTOP_VERSION \
+          make desktop-linux
+
+      - name: Upload desktop.tar.gz
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
+        with:
+          name: desktop.tar.gz
+          path: desktop.tar.gz
+
+  desktop-linux-arm64:
+    runs-on: ubuntu-latest
+    steps:
+
+      - name: Harden Runner
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
 
+      - name: Install Go
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version-file: 'go.mod'
+
       - name: Generate desktop.tar.gz
         run: |
           FLEET_DESKTOP_VERSION=$FLEET_DESKTOP_VERSION \
-          make desktop-linux
+          make desktop-linux-arm64
 
       - name: Upload desktop.tar.gz
         uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
         with:
-          name: desktop.tar.gz
+          name: desktop-arm64.tar.gz
           path: desktop.tar.gz
diff --git a/.github/workflows/generate-osqueryd-targets.yml b/.github/workflows/generate-osqueryd-targets.yml
index f7f377d17d86..b27e074b6a49 100644
--- a/.github/workflows/generate-osqueryd-targets.yml
+++ b/.github/workflows/generate-osqueryd-targets.yml
@@ -24,7 +24,7 @@ defaults:
     shell: bash
 
 env:
-  OSQUERY_VERSION: 5.12.2
+  OSQUERY_VERSION: 5.13.1
 
 permissions:
   contents: read
@@ -76,6 +76,35 @@ jobs:
           name: osqueryd
           path: opt/osquery/bin/osqueryd
 
+  generate-linux-arm64:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
+      - name: Install file
+        run: |
+          sudo apt-get install -y file
+
+      - name: Download and extract osqueryd for linux-arm64
+        run: |
+          curl -L https://github.com/osquery/osquery/releases/download/${{ env.OSQUERY_VERSION }}/osquery_${{ env.OSQUERY_VERSION }}-1.linux_arm64.deb --output osquery.deb
+          ar x osquery.deb
+          tar xf data.tar.gz
+          chmod +x ./opt/osquery/bin/osqueryd
+          file ./opt/osquery/bin/osqueryd | grep aarch64
+
+      - name: Upload osqueryd for linux-arm64
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+        with:
+          name: osqueryd-arm64
+          path: opt/osquery/bin/osqueryd
+
   generate-windows:
     runs-on: windows-latest
     steps:
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index df6b9792b73d..3d3e95ed2c8c 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -38,7 +38,6 @@ jobs:
       matrix:
         # See #9943, we just need to add windows-latest here once all issues are fixed.
         os: [ubuntu-latest, macos-latest]
-        go-version: ['${{ vars.GO_VERSION }}']
     runs-on: ${{ matrix.os }}
     steps:
       - name: Harden Runner
@@ -52,7 +51,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ matrix.go-version }}
+          go-version-file: 'go.mod'
 
       - name: Install dependencies (Linux)
         if: matrix.os == 'ubuntu-latest'
diff --git a/.github/workflows/goreleaser-fleet.yaml b/.github/workflows/goreleaser-fleet.yaml
index 8de0089b62d7..6ba9aff8f08f 100644
--- a/.github/workflows/goreleaser-fleet.yaml
+++ b/.github/workflows/goreleaser-fleet.yaml
@@ -20,7 +20,7 @@ permissions:
 
 jobs:
   goreleaser:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-20.04-4-cores
     environment: Docker Hub
     permissions:
       contents: write
@@ -44,7 +44,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
 
       # Set the Node.js version
       - name: Set up Node.js ${{ vars.NODE_VERSION }}
diff --git a/.github/workflows/goreleaser-orbit.yaml b/.github/workflows/goreleaser-orbit.yaml
index 1ce2386dd907..54e16752b335 100644
--- a/.github/workflows/goreleaser-orbit.yaml
+++ b/.github/workflows/goreleaser-orbit.yaml
@@ -2,8 +2,8 @@ name: GoReleaser Orbit
 
 on:
   push:
-   tags:
-     - 'orbit-*' # For testing, use a pre-release tag like 'orbit-1.24.0-1'
+    tags:
+      - "orbit-*" # For testing, use a pre-release tag like 'orbit-1.24.0-1'
 
 # This allows a subsequently queued workflow run to interrupt previous runs
 concurrency:
@@ -56,7 +56,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
 
       - name: Run GoReleaser
         run: go run github.com/goreleaser/goreleaser@56c9d09a1b925e2549631c6d180b0a1c2ebfac82 release --debug --rm-dist --skip-publish -f orbit/goreleaser-macos.yml # v1.20.0
@@ -95,7 +95,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
 
       - name: Run GoReleaser
         run: go run github.com/goreleaser/goreleaser@56c9d09a1b925e2549631c6d180b0a1c2ebfac82 release --debug --rm-dist --skip-publish -f orbit/goreleaser-linux.yml # v1.20.0
@@ -106,6 +106,39 @@ jobs:
           name: orbit-linux
           path: dist/orbit_linux_amd64_v1/orbit
 
+  goreleaser-linux-arm64:
+    runs-on: ubuntu-20.04
+    permissions:
+      contents: read
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
+      # Note that goreleaser does not like the orbit- prefixed flag unless you use the closed-source
+      # paid version. We pay for goreleaser, but using the closed source build would weaken our
+      # supply-chain integrity goals, so we hack around it by replacing the tag.
+      - name: Replace tag
+        run: git tag $(echo ${{ github.ref_name }} | sed -e 's/orbit-//g') && git tag -d ${{ github.ref_name }}
+
+      - name: Set up Go
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version-file: 'go.mod'
+
+      - name: Run GoReleaser
+        run: go run github.com/goreleaser/goreleaser@56c9d09a1b925e2549631c6d180b0a1c2ebfac82 release --debug --rm-dist --skip-publish -f orbit/goreleaser-linux-arm64.yml # v1.20.0
+
+      - name: Upload
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
+        with:
+          name: orbit-linux-arm64
+          path: dist/orbit_linux_arm64/orbit
+
   goreleaser-windows:
     runs-on: windows-2022
     permissions:
@@ -128,7 +161,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
 
       - name: Run GoReleaser
         run: go run github.com/goreleaser/goreleaser@56c9d09a1b925e2549631c6d180b0a1c2ebfac82 release --debug --rm-dist --skip-publish -f orbit/goreleaser-windows.yml # v1.20.0
diff --git a/.github/workflows/goreleaser-snapshot-fleet.yaml b/.github/workflows/goreleaser-snapshot-fleet.yaml
index c204e9ff6918..927cf31be1da 100644
--- a/.github/workflows/goreleaser-snapshot-fleet.yaml
+++ b/.github/workflows/goreleaser-snapshot-fleet.yaml
@@ -4,7 +4,7 @@ on:
   push:
     branches:
       - "main"
-      - "prepare-*"
+      - "minor-*"
       - "patch-*"
     paths-ignore:
       - "handbook/**"
@@ -57,7 +57,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
 
       # Set the Node.js version
       - name: Set up Node.js ${{ vars.NODE_VERSION }}
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 015a464b4b84..98c9cd3a5973 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -264,13 +264,13 @@ jobs:
         npm install -g fleetctl
         fleetctl config set --address ${{ needs.gen.outputs.address }} --token ${{ needs.login.outputs.token }}
 
+    - name: Checkout Code
+      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
     - name: Install Go
       uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
-        go-version: ${{ vars.GO_VERSION }}
-
-    - name: Checkout Code
-      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        go-version-file: 'go.mod'
 
     - name: Build Fleetctl
       run: make fleetctl
diff --git a/.github/workflows/push-osquery-perf-to-ecr.yml b/.github/workflows/push-osquery-perf-to-ecr.yml
deleted file mode 100644
index 0760d03900ad..000000000000
--- a/.github/workflows/push-osquery-perf-to-ecr.yml
+++ /dev/null
@@ -1,64 +0,0 @@
-name: Build docker image and publish to ECR
-
-on:
-  workflow_dispatch:
-    inputs:
-      enroll_secret:
-        description: 'Enroll Secret'
-        required: true
-      url:
-        description: 'Fleet server URL'
-        required: true
-      host_count:
-        description: 'Amount of hosts to emulate'
-        required: true
-        default: 20
-      tag:
-        description: 'docker image tag'
-        required: true
-        default: latest
-
-# This allows a subsequently queued workflow run to interrupt previous runs
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
-  cancel-in-progress: true
-
-defaults:
-  run:
-    # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
-    shell: bash
-
-permissions:
-  contents: read
-
-jobs:
-  build-docker:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout Code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@05b148adc31e091bafbaf404f745055d4d3bc9d2 # v1
-        with:
-          aws-access-key-id: ${{ secrets.LOADTEST_AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.LOADTEST_AWS_SECRET_ACCESS_KEY }}
-          aws-region: us-east-2
-
-      - name: Login to Amazon ECR
-        id: login-ecr
-        uses: aws-actions/amazon-ecr-login@2f9f10ea3fa2eed41ac443fee8bfbd059af2d0a4 # v1
-
-      - name: Build, tag, and push image to Amazon ECR
-        env:
-          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
-          ECR_REPOSITORY: osquery-perf
-          IMAGE_TAG: ${{ github.event.inputs.tag }}
-        run: |
-          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG --build-arg ENROLL_SECRET=${{ github.event.inputs.enroll_secret }} --build-arg HOST_COUNT=${{ github.event.inputs.host_count }} --build-arg SERVER_URL=${{ github.event.inputs.url }} -f Dockerfile.osquery-perf .
-          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
diff --git a/.github/workflows/release-fleetctl-docker-deps.yaml b/.github/workflows/release-fleetctl-docker-deps.yaml
new file mode 100644
index 000000000000..c751655d9353
--- /dev/null
+++ b/.github/workflows/release-fleetctl-docker-deps.yaml
@@ -0,0 +1,84 @@
+# Builds and releases to production the fleetdm/bomutils:latest and fleetdm/wix:latest
+# docker images, which are the docker image dependencies of the fleetctl command.
+#
+# This is separate from Fleet releases because we only release
+# fleetdm/bomutils and fleetdm/wix only if we add new dependencies
+# or for security updates.
+name: Release fleetctl docker dependencies
+
+on:
+  push:
+    tags:
+      - "fleetctl-docker-deps-*"
+
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
+    shell: bash
+
+permissions:
+  contents: read
+
+jobs:
+  push_latest:
+    runs-on: ubuntu-latest
+    environment: Docker Hub
+    permissions:
+      contents: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout Code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
+      - name: Install Go
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version-file: 'go.mod'
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
+
+      - name: Build fleetdm/wix
+        run: make wix-docker
+
+      - name: Build fleetdm/bomutils
+        run: make bomutils-docker
+
+      #
+      # After fleetdm/wix and fleetdm/bomutils are built,
+      # let's smoke test pkg/msi generation before pushing.
+      #
+
+      - name: Install Go Dependencies
+        run: make deps-go
+
+      - name: Build fleetctl
+        run: make fleetctl
+
+      - name: Build MSI
+        run: ./build/fleetctl package --type msi --enroll-secret=foo --fleet-url=https://localhost:8080
+
+      - name: Build PKG
+        run: ./build/fleetctl package --type pkg --enroll-secret=foo --fleet-url=https://localhost:8080
+
+      #
+      # Now push to production
+      #
+
+      - name: Push fleetdm/bomutils to docker hub
+        run: docker push fleetdm/bomutils:latest
+
+      - name: Push fleetdm/wix to docker hub
+        run: docker push fleetdm/wix:latest
diff --git a/.github/workflows/release-fleetd-base.yml b/.github/workflows/release-fleetd-base.yml
index d7b02cfcf7fa..99099019641c 100644
--- a/.github/workflows/release-fleetd-base.yml
+++ b/.github/workflows/release-fleetd-base.yml
@@ -51,16 +51,16 @@ jobs:
         with:
           egress-policy: audit
 
-      - name: Install Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
-        with:
-          go-version: ${{ vars.GO_VERSION }}
-
       - name: Checkout Code
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
 
+      - name: Install Go
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        with:
+          go-version-file: 'go.mod'
+
       - name: Check for fleetd component updates
         id: check-for-fleetd-component-updates
         run: |
diff --git a/.github/workflows/test-bulk-operations-dashboard-changes.yml b/.github/workflows/test-bulk-operations-dashboard-changes.yml
new file mode 100644
index 000000000000..cfbb26205d87
--- /dev/null
+++ b/.github/workflows/test-bulk-operations-dashboard-changes.yml
@@ -0,0 +1,60 @@
+name: Test bulk operations dashboard changes
+
+on:
+  pull_request:
+    paths:
+      - 'ee/bulk-operations-dashboard/**'
+      - '.github/workflows/test-bulk-operations-dashboard-changes.yml'
+
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [16.x]
+
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
+    # Set the Node.js version
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+      with:
+        node-version: ${{ matrix.node-version }}
+
+
+    # Now start building!
+    # > …but first, get a little crazy for a sec and delete the top-level package.json file
+    # > i.e. the one used by the Fleet server.  This is because require() in node will go
+    # > hunting in ancestral directories for missing dependencies, and since some of the
+    # > bundled transpiler tasks sniff for package availability using require(), this trips
+    # > up when it encounters another Node universe in the parent directory.
+    - run: rm -rf package.json package-lock.json node_modules/
+    # > Turns out there's a similar issue with how eslint plugins are looked up, so we
+    # > delete the top level .eslintrc file too.
+    - run: rm -f .eslintrc.js
+
+    # Get dependencies (including dev deps)
+    - run: cd ee/bulk-operations-dashboard/ && npm install
+
+    # Run sanity checks
+    - run: cd ee/bulk-operations-dashboard/ && npm test
+
+    # Compile assets
+    - run: cd ee/bulk-operations-dashboard/ && npm run build-for-prod
diff --git a/.github/workflows/test-db-changes.yml b/.github/workflows/test-db-changes.yml
index 301645008ece..2bd89ab82b1e 100644
--- a/.github/workflows/test-db-changes.yml
+++ b/.github/workflows/test-db-changes.yml
@@ -10,7 +10,7 @@ on:
     paths:
       - '**.go'
       - 'server/datastore/mysql/schema.sql'
-      - '.github/workflows/test-schema-changes.yml'
+      - '.github/workflows/test-db-changes.yml'
   workflow_dispatch: # Manual
 
 # This allows a subsequently queued workflow run to interrupt previous runs
@@ -35,18 +35,28 @@ jobs:
       with:
         egress-policy: audit
 
-    - name: Install Go
-      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
-      with:
-        go-version: ${{ vars.GO_VERSION }}
     - name: Checkout Code
       uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
       with:
         fetch-depth: 0
 
+    - name: Install Go
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+      with:
+        go-version-file: 'go.mod'
+
     - name: Start Infra Dependencies
       # Use & to background this
-      run: docker-compose up -d mysql_test &
+      run: docker compose up -d mysql_test &
+
+    - name: Wait for mysql
+      run: |
+        echo "waiting for mysql..."
+        until docker compose exec -T mysql_test sh -c "mysql -uroot -p\"\${MYSQL_ROOT_PASSWORD}\" -e \"SELECT 1=1\" fleet" &> /dev/null; do
+            echo "."
+            sleep 1
+        done
+        echo "mysql is ready"
 
     - name: Verify test schema changes
       run: |
diff --git a/.github/workflows/test-fleetd-chrome.yml b/.github/workflows/test-fleetd-chrome.yml
index 47ba496ebbb7..8cbb0125f9b8 100644
--- a/.github/workflows/test-fleetd-chrome.yml
+++ b/.github/workflows/test-fleetd-chrome.yml
@@ -66,7 +66,8 @@ jobs:
           npm test
 
       - name: Upload to Codecov
-        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
+        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
         with:
+          token: ${{ secrets.CODECOV_TOKEN }}
           directory: ./ee/fleetd-chrome/coverage
           flags: fleetd-chrome
diff --git a/.github/workflows/test-go.yaml b/.github/workflows/test-go.yaml
index c288cf8c9b4b..b5f2b8fe943c 100644
--- a/.github/workflows/test-go.yaml
+++ b/.github/workflows/test-go.yaml
@@ -44,8 +44,8 @@ jobs:
       matrix:
         suite: ["integration", "core"]
         os: [ubuntu-latest]
-        go-version: ['${{ vars.GO_VERSION }}']
-        mysql: ["mysql:5.7.21", "mysql:8.0.28"]
+        mysql: ["mysql:8.0.36", "mysql:8.4.2"]
+    continue-on-error: ${{ matrix.suite == 'integration' }} # Since integration tests have a higher chance of failing, often for unrelated reasons, we don't want to fail the whole job if they fail
     runs-on: ${{ matrix.os }}
 
     env:
@@ -58,18 +58,18 @@ jobs:
       with:
         egress-policy: audit
 
-    - name: Install Go
-      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
-      with:
-        go-version: ${{ matrix.go-version }}
-
     - name: Checkout Code
       uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
 
+    - name: Install Go
+      uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
+      with:
+        go-version-file: 'go.mod'
+
     # Pre-starting dependencies here means they are ready to go when we need them.
     - name: Start Infra Dependencies
       # Use & to background this
-      run: FLEET_MYSQL_IMAGE=${{ matrix.mysql }} docker-compose -f docker-compose.yml -f docker-compose-redis-cluster.yml up -d mysql_test mysql_replica_test redis redis-cluster-1 redis-cluster-2 redis-cluster-3 redis-cluster-4 redis-cluster-5 redis-cluster-6 redis-cluster-setup minio saml_idp mailhog mailpit smtp4dev_test &
+      run: FLEET_MYSQL_IMAGE=${{ matrix.mysql }} docker compose -f docker-compose.yml -f docker-compose-redis-cluster.yml up -d mysql_test mysql_replica_test redis redis-cluster-1 redis-cluster-2 redis-cluster-3 redis-cluster-4 redis-cluster-5 redis-cluster-6 redis-cluster-setup minio saml_idp mailhog mailpit smtp4dev_test &
 
     - name: Add TLS certificate for SMTP Tests
       run: |
@@ -97,13 +97,13 @@ jobs:
     - name: Wait for mysql
       run: |
         echo "waiting for mysql..."
-        until docker-compose exec -T mysql_test sh -c "mysql -uroot -p\"\${MYSQL_ROOT_PASSWORD}\" -e \"SELECT 1=1\" fleet" &> /dev/null; do
+        until docker compose exec -T mysql_test sh -c "mysql -uroot -p\"\${MYSQL_ROOT_PASSWORD}\" -e \"SELECT 1=1\" fleet" &> /dev/null; do
             echo "."
             sleep 1
         done
         echo "mysql is ready"
         echo "waiting for mysql replica..."
-        until docker-compose exec -T mysql_replica_test sh -c "mysql -uroot -p\"\${MYSQL_ROOT_PASSWORD}\" -e \"SELECT 1=1\" fleet" &> /dev/null; do
+        until docker compose exec -T mysql_replica_test sh -c "mysql -uroot -p\"\${MYSQL_ROOT_PASSWORD}\" -e \"SELECT 1=1\" fleet" &> /dev/null; do
             echo "."
             sleep 1
         done
@@ -118,7 +118,6 @@ jobs:
         else
           RUN_TESTS_ARG=''
         fi
-
         GO_TEST_EXTRA_FLAGS="-v -race=$RACE_ENABLED -timeout=$GO_TEST_TIMEOUT $RUN_TESTS_ARG" \
           TEST_LOCK_FILE_PATH=$(pwd)/lock \
           NETWORK_TEST=1 \
@@ -131,13 +130,17 @@ jobs:
           NETWORK_TEST_GITHUB_TOKEN=${{ secrets.FLEET_RELEASE_GITHUB_PAT }} \
           make test-go 2>&1 | tee /tmp/gotest.log
 
-    # note: it's fine to upload multiple reports (one per matrix combination)
-    # for the same run, see https://docs.codecov.com/docs/merging-reports
-    - name: Upload to Codecov
-      uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70
+    - name: Create mysql identifier without colon
+      if: always()
+      run: |
+        echo "MATRIX_MYSQL_ID=$(echo ${{ matrix.mysql }} | tr -d ':')" >> $GITHUB_ENV
+
+    - name: Save coverage
+      uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
       with:
-        files: coverage.txt
-        flags: backend
+        name: ${{ matrix.suite }}-${{ env.MATRIX_MYSQL_ID }}-coverage
+        path: ./coverage.txt
+        if-no-files-found: error
 
     - name: Generate summary of errors
       if: failure()
@@ -155,10 +158,6 @@ jobs:
         fi
         GO_FAIL_SUMMARY=$GO_FAIL_SUMMARY envsubst < .github/workflows/config/slack_payload_template.json > ./payload.json
 
-    # TODO: figure out a sane way to combine outputs from different matrix jobs
-    # into a single slack notification, instead of sending one per job. This
-    # problem already existed but now it's accentuated because we're running 4
-    # jobs.
     - name: Slack Notification
       if: github.event.schedule == '0 4 * * *' && failure()
       uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
@@ -173,15 +172,32 @@ jobs:
 
     - name: Upload test log
       if: always()
-      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+      uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
       with:
-        name: test-log
+        name: ${{ matrix.suite }}-${{ env.MATRIX_MYSQL_ID }}-test-log
         path: /tmp/gotest.log
         if-no-files-found: error
 
     - name: Upload summary test log
       if: always()
-      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+      uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a  # v4.3.6
       with:
-        name: summary-test-log
+        name: ${{ matrix.suite }}-${{ env.MATRIX_MYSQL_ID }}-summary-test-log
         path: /tmp/summary.txt
+
+  # We upload all backend coverage in one step so that we're less like to end up in a situation with a partial coverage report.
+  upload-coverage:
+    needs: [test-go]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - name: Download artifacts
+        uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
+        with:
+          pattern: '*-coverage'
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          flags: backend
diff --git a/.github/workflows/test-js.yml b/.github/workflows/test-js.yml
index 9d635237370c..15b4fd05cee5 100644
--- a/.github/workflows/test-js.yml
+++ b/.github/workflows/test-js.yml
@@ -69,8 +69,9 @@ jobs:
           yarn test:ci
 
       - name: Upload to Codecov
-        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70
+        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
         with:
+          token: ${{ secrets.CODECOV_TOKEN }}
           flags: frontend
 
   lint-js:
diff --git a/.github/workflows/test-native-tooling-packaging.yml b/.github/workflows/test-native-tooling-packaging.yml
index db242cee0c4b..ff0dc4abadf6 100644
--- a/.github/workflows/test-native-tooling-packaging.yml
+++ b/.github/workflows/test-native-tooling-packaging.yml
@@ -1,4 +1,4 @@
-# This workflow tests packaging of Fleet-osquery with the
+# This workflow tests generation of fleetd packages with the
 # `fleetdm/fleetctl` Docker image.
 name: Test native tooling packaging
 
@@ -41,7 +41,6 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        go-version: ['${{ vars.GO_VERSION }}']
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -50,17 +49,23 @@ jobs:
       with:
         egress-policy: audit
 
+    - name: Checkout Code
+      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
     - name: Install Go
       uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
-        go-version: ${{ matrix.go-version }}
-
-    - name: Checkout Code
-      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        go-version-file: 'go.mod'
 
     - name: Install Go Dependencies
       run: make deps-go
 
+    - name: Build fleetdm/wix
+      run: make wix-docker
+
+    - name: Build fleetdm/bomutils
+      run: make bomutils-docker
+
     - name: Build fleetdm/fleetctl
       run: make fleetctl-docker
 
diff --git a/.github/workflows/test-packaging.yml b/.github/workflows/test-packaging.yml
index 7190314cb9ef..dbe5a96244ea 100644
--- a/.github/workflows/test-packaging.yml
+++ b/.github/workflows/test-packaging.yml
@@ -47,7 +47,6 @@ jobs:
         # `macos-latest` uses arm64 by default now, so please be careful when
         # updating this version.
         os: [ubuntu-latest, macos-13]
-        go-version: ['${{ vars.GO_VERSION }}']
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -61,25 +60,35 @@ jobs:
       # Run in background while other steps complete to speed up the workflow
       run: docker pull fleetdm/wix:latest &
 
+    - name: Pull fleetdm/bomutils
+      # Run in background while other steps complete to speed up the workflow
+      run: docker pull fleetdm/bomutils:latest &
+
     - name: Run Colima
       if: startsWith(matrix.os, 'macos')
-      timeout-minutes: 10
+      timeout-minutes: 15
       # notes:
       # - docker to install the docker CLI and interact with the Colima
       #   container runtime
       # - colima is pre-installed in macos-12 runners, but not in macos-13 or
       #   macos-14 runners
       run: |
-        brew install docker colima
+        brew install docker
+        # The runners come with an old version of python@3.12 that fails to upgrade
+        # when python gets pulled in as a dep through the chain
+        # colima -> lima -> qemu -> glibc -> python@3.12
+        # Force upgrade it for now, remove once the problem is fixed
+        brew install --overwrite python@3.12
+        brew install colima
         colima start --mount $TMPDIR:w
 
+    - name: Checkout Code
+      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
     - name: Install Go
       uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
-        go-version: ${{ matrix.go-version }}
-
-    - name: Checkout Code
-      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        go-version-file: 'go.mod'
 
     - name: Install wine and wix
       if: startsWith(matrix.os, 'macos')
diff --git a/.github/workflows/test-yml-specs.yml b/.github/workflows/test-yml-specs.yml
index 75e46d6af046..fe8f3ecace97 100644
--- a/.github/workflows/test-yml-specs.yml
+++ b/.github/workflows/test-yml-specs.yml
@@ -33,7 +33,6 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
-        go-version: ['${{ vars.GO_VERSION }}']
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -42,13 +41,13 @@ jobs:
       with:
         egress-policy: audit
 
+    - name: Checkout Code
+      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
     - name: Install Go
       uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
-        go-version: ${{ matrix.go-version }}
-
-    - name: Checkout Code
-      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        go-version-file: 'go.mod'
 
     - name: Run apply spec tests
       run: |
diff --git a/.vscode/launch.json b/.vscode/launch.json
index 3e3ac95d6acf..885f407fb8e5 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -61,6 +61,21 @@
                 "--dev_license"
             ]
         },
+        {
+            "name": "Fleet vuln_processing (licensed)",
+            "type": "go",
+            "request": "launch",
+            "mode": "auto",
+            "buildFlags": "-tags='full,fts5'",
+            "cwd": "${workspaceFolder}",
+            "program": "${workspaceFolder}/cmd/fleet",
+            "args": [
+                "vuln_processing",
+                "--dev",
+                "--logging_debug",
+                "--dev_license",
+            ]
+        },
         {
             "name": "Attach to a running Fleet server",
             "type": "go",
diff --git a/16538-preserve-manage-query-automations-modal-state b/16538-preserve-manage-query-automations-modal-state
deleted file mode 100644
index d8ea5ca981cc..000000000000
--- a/16538-preserve-manage-query-automations-modal-state
+++ /dev/null
@@ -1,2 +0,0 @@
-- Fix a bug where the manage query automations modal would lose its state when the user clicks
-  "Preview data"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 997118f913b2..24d768a609dc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,20 +1,206 @@
+## Fleet 4.55.2 (Sep 05, 2024)
+
+### Bug fixes
+
+* Removed validation of APNS certificate from server startup. This was no longer necessary because we now allow for APNS certificates to be renewed in the UI.
+* Fixed logic to properly catch and log APNs errors.
+
+## Fleet 4.55.1 (Aug 14, 2024)
+
+### Bug fixes
+
+* Added a disabled overlay to the Other Workflows modal on the policy page.
+* Updated text for "Turn on MDM" banners in UI.
+* Fixed a bug when a cached prepared statement got deleted in the MySQL server itself without Fleet knowing.
+* Continued with an empty CVE description when the NVD CVE feed didn't include description entries (instead of panicking).
+* Scheduled maintenance events are now scheduled over calendar events marked "Free" (not busy) in Google Calendar.
+* Fixed a bug where the wrong API path was used to download a software installer.
+* Improved fleetctl gitops error message when trying to change team name to a team that already exists.
+* Updated ABM (Apple Business Manager) host tooltip copy on the manage host page to clarify when host vitals will be available to view.
+* Added index to query_results DB table to speed up finding the last query timestamp for a given query and host.
+* Displayed the label names in case-insensitive alphabetical order in the fleet UI.
+
+## Fleet 4.55.0 (Aug 8, 2024)
+
+**NOTE:** Beginning with v4.55.0, Fleet no longer supports MySQL 5.7 because it has reached [end of life](https://mattermost.com/blog/mysql-5-7-reached-eol-upgrade-to-mysql-8-x-today/#:~:text=In%20October%202023%2C%20MySQL%205.7,to%20upgrade%20to%20MySQL%208.). The minimum version supported is MySQL 8.0.36.
+
+### Endpoint Operations
+
+- Added support for generating `fleetd` packages for Linux ARM64.
+- Added new `fleetctl package` --arch flag.
+- Updated `fleetctl package` command to remove the `--version` flag. The version of the package can be controlled by `--orbit-channel` flag.
+- Updated maintenance window descriptions to update regularly to match the failing policy description/resolution.
+- Updated maintenance windows using Google Calendar so that calendar events are now recreated within 30 seconds if deleted or moved to the past.
+  - Fleet server watches for potential changes for up to 1 week after original event time. If event is moved forward more than 1 week, then after 1 week Fleet server will check for event changes once every 30 minutes.
+  - **NOTE:** These near real-time updates may add additional load to the Google Calendar API, so it is recommended to use API usage alerts or other monitoring methods.
+
+### Device Management
+
+- Integrated [Escrow Buddy](https://github.com/macadmins/escrow-buddy) to add enforcement of FileVault during the MacOS Setup Assistant process for hosts that are 
+enrolled into teams (or no team) with disk encryption turned on. Thank you [homebysix](https://github.com/homebysix) and team!
+- Updated `fleetd` to use [Escrow Buddy](https://github.com/macadmins/escrow-buddy) to rotate FileVault keys. Removed or modified internal API endpoints documented in the API for contributors.
+- Added OS updates support to iOS/iPadOS devices.
+- Added iOS and iPadOS device details refetch triggered with the existing `POST /api/latest/fleet/hosts/:id/refetch` endpoint.
+- Added iOS and iPadOS user-installed apps to Fleet.
+- Added iOS and iPadOS apps to be installed using Apple's VPP (Volume Purchase Program) to Fleet.
+- Added support for VPP to GitOps.
+- Added the `POST /mdm/apple/vpp_token`, `DELETE /mdm/apple/vpp_token` and `GET /vpp` endpoints and related functionality.
+- Added new `GET /software/app_store_apps` and `POST /software/app_store_apps` endpoints and associated functionality.
+- Added the associated VPP apps to the `GET /software/titles` and `GET /software/titles/:id` endpoints.
+- Added the associated VPP apps to the `GET /hosts/:id/software` and `GET /device/:token/software` endpoints.
+- Added support to delete a VPP app from a team in `DELETE /software/titles/:software_title_id/available_for_install`.
+- Added `exclude_software` query parameter to "Get host by identifier" API.
+- Added ability to add/remove/disable apps with VPP in the Fleet UI.
+- Added a warning banner to the UI if the uploaded VPP token is about to expire/has expired.
+- Added UI updates for VPP feature on host software and my device pages.
+- Added global activity support for VPP-related activities.
+- Added UI features for managing VPP apps for iPadOS and iOS hosts.
+- Updated profile activities to include iOS and iPadOS.
+- Updated Fleet UI to show OS version compliance on host details page.
+- Added support for "No teams" on all software pages including adding software installers.
+- Added DB migration to support VPP software features.
+- Added DB migration to migrate older team configurations to the new version that includes both installers and App Store apps.
+- Linux lock/unlock scripts now make use of pam_nologin to keep AD users locked out.
+- Installed software list now includes Linux .deb packages that are 'on hold'.
+- Added a special-case to properly name the Notion .exe Windows installer the same as how it will be reported by osquery post-install.
+- Increased threshold to renew Apple SCEP certificates for MDM enrollments to 180 days.
+
+### Vulnerability Management
+
+- Fixed CVEs identified as 'Rejected' in NVD not matching against software.
+- Fixed false negative vulnerabilities with IntelliJ IDEA CE and PyCharm CE installed via Homebrew.
+
+### Bug fixes and improvements
+
+- Dropped support for MySQL 5.7 and raised minimum required to MySQL 8.0.36.
+- Updated software pre-install to use new GitOps format for query.
+- Updated UI tooltips for pending OS settings.
+- Added a migration to migrate older team configurations to the new version that includes both installers and App Store apps.
+- Fixed a styling issue in the controls > OS settings > disk encryption table.
+- Fixed a bug in `fleetctl preview` that was causing it to fail if Docker was installed without support for the deprecated `docker-compose` CLI.
+- Fixed an issue where the app-wide warning banners were not showing on the initial page load.
+- Fixed a bug where the hosts page would sometimes allow excess pagination.
+- Fixed a bug where software install results could not be retrieved for deleted hosts in the activity feed.
+- Fixed path that was incorrect for the download software installer package endpoint `GET /software/titles/:software_title_id/package`.
+- Fixed a bug that set `last_enrolled_at` during orbit re-enrollment, which caused osquery enroll failures when `FLEET_OSQUERY_ENROLL_COOLDOWN` is set.
+- Fixed the "Available for install" filter in the host's software page so that installers that were requested to be installed on the host (regardless of installation status) also show up in the list.
+- Fixed a styling issue in the Controls > OS Settings > disk encryption table.
+- Fixed a bug where Fleet google calendar events generated by Fleet <= 4.53.0 were not correctly processed by 4.54.0.
+- Fixed a bug in `fleetctl preview` that was causing it to fail if Docker was installed without support for the deprecated `docker-compose` CLI.
+- Fixed a bug where software install results could not be retrieved for deleted hosts in the activity feed.
+- Fixed a bug where a software installer (a package or a VPP app) that has been installed on a host still shows up as "Available for install" and can still be requested to be installed after the host is transferred to a different team without that installer (or after the installer is deleted).
+- Fixed the "Available for install" filter in the host's software page so that installers that were requested to be installed on the host (regardless of installation status) also show up in the list.
+
+## Fleet 4.54.1 (Jul 24, 2024)
+
+### Bug fixes
+
+- Fixed a startup bug by performing an early restart of orbit if an agent options setting has changed.
+- Implemented a small refactor of orbit subsystems.
+- Removed the `--version` flag from the `fleetctl package` command. The version of the package can now be controlled by the `--orbit-channel` flag.
+- Fixed a bug that set `last_enrolled_at` during orbit re-enrollment, which caused osquery enroll failures when `FLEET_OSQUERY_ENROLL_COOLDOWN` is set .
+- In `fleetctl package` command, removed the `--version` flag. The version of the package can be controlled by `--orbit-channel` flag.
+- Fixed a bug where Fleet google calendar events generated by Fleet <= 4.53.0 were not correctly processed by 4.54.0.
+- Re-enabled cached logins after windows Unlock.
+
+## Fleet 4.54.0 (Jul 17, 2024)
+
+### Endpoint Operations
+
+- Updated `fleetctl gitops` to be used to rename teams.
+  - **NOTE:** `fleetctl gitops` needs to have previously run with this Fleet/fleetctl version or later.
+  - The team name is changed if the YAML config is applied from the same filename as before.
+- Updated `fleetctl query --hosts` to work with hostnames, host UUIDs, and/or hardware serial numbers.
+- Added a host's upcoming scheduled maintenance window, if any, on the host details page of the UI and in host responses from the API.
+- Added support to `fleetctl debug connection` to test TLS connection with the embedded certs.pem in
+  the fleetctl executable.
+- Added host's display name to calendar event descriptions.
+- Added .yml and .yaml file type validation and error message to `fleetctl apply`.
+- Added a tooltip to truncated text and not to untruncated values.
+
+### Device Management (MDM)
+
+- Added iOS/iPadOS builtin manual labels. 
+  - **NOTE:** Before migrating to this version, make sure to delete any labels with name "iOS" or "iPadOS".
+- Added aggregation of iOS/iPadOS OS versions.
+- Added change to custom profiles for iOS/iPadOS to go from 'pending' straight to 'verified' (skip 'verifying').
+- Added support for renewing SCEP certificates with custom enrollment profiles.
+- Added automatic install of `fleetd` when a host turns on MDM now uses the latest released `fleetd` version.
+- Added support for `END_USER_EMAIL` and `FLEET_DESKTOP` parameters to Windows MSI install package.
+- Added API changes to support the `labels_include_all` and `labels_exclude_any` fields (and accept the deprecated `labels` field as an alias for `labels_include_all`).
+- Added `fleetctl gitops` and `fleetctl apply` support for `labels_include_all` and `labels_exclude_any` to configure a custom setting.
+- Added UI for uploading custom profiles with a target of hosts that include all/exclude any selected labels.
+- Added the database migrations to create the new `exclude` column for labels associated with MDM profiles (and declarations).
+- Updated host script timeouts to be configurable via agent options using `script_execution_timeout`. 
+- `fleetctl` now uses a polling mechanism when running `run-script` to accommodate longer script timeout values.
+- Updated the profile reconciliation logic to handle the new "exclude any" labels.
+- Updated so that the `fleetd` cleanup script for macOS that will return completed when run from Fleet.
+- Updated so that the `fleetd` uninstall script will return completed when run from Fleet.
+- Updated script run permissions -- only admins and maintainers can run arbitrary or saved scripts (not observer or observer+).
+- Updated `fleetctl get mdm_commands` to return 20 rows and support `--host` `--type` filters to improve response time.
+- Updated the instructions for manual MDM enrollment on the "My device" page to be clearer and align with Apple updates.
+- Updated UI to allow device users to reinstall self-service software.
+- Updated API to not return a 500 status code if a host sends a command response with an invalid command uuid.
+- Increased the timeout of the upload software installer endpoint to 4 minutes.
+- Disabled credential caching and reboot on Windows lock.
+
+### Vulnerability Management
+
+- Added "Vulnerable" filter to the host details software table.
+- Fixed Microsoft Office June 2024 false negative vulnerabilities and added custom vulnerability matching.
+- Fixed issue where some Windows applications were getting matched against Windows OS vulnerabilities.
+
+### Bug fixes and improvements
+
+- Updated Go version to go1.22.4.
+- Updated to render only one banner on the my device page based on priority order.
+- Updated software updated timestamp tooltip.
+- Removed DB error message from the UI when showing a error response.
+- Updated fleetctl get queries/labels/hosts descriptions.
+- Reinstated ability to sort policies by passing count.
+- Improved the accuracy of the heuristic used to deterimine if a host is connected to Fleet via MDM by using osquery data for hosts that didn't send a Checkout message.
+- Improved the matching of `pkg` installer files to existing software.
+- Improved extraction of application name from `pkg` installers.
+- Clarified various help and error texts around host identifiers.
+- Hid CTA on inherited queries/policies from team level users.
+- Hid query delete checkboxes from team observers.
+- Hid "Self-service" in Fleet Desktop and My device page if there is no self-service software available.
+- Hid the host detail page's "Run script" action from Global and Team Observer/+s.
+- Aligned the "View all hosts" links in the Software titles and versions tables.
+- Fixed counts for hosts with with low disk space in summary page.
+- Fixed allowing Observer and Observer+ roles to download software installers.
+- Fixed crash in `fleetd` installer on Windows if there are registry keys with special characters on the system.
+- Fixed `fleetctl debug connection` to support server TLS certificates with intermediates.
+- Fixed macOS declarations being stuck in "to be removed" state indefinitely.
+- Fixed link to `fleetd` uninstall instructions in "Delete device" modal.
+- Fixed exporting CSVs with fields that contain commas to render properly.
+- Fixed issue where the Fleet UI could not be used to renew the ABM token after the ABM user who created the token was deleted.
+- Fixed styling issues with the target inputs loading spinner on the run live query/policy page.
+- Fixed an issue where special characters in HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall breaks the "installer_utils.ps1 -uninstallOrbit" step in the Windows MSI installer.
+- Fixed a bug causing "No Team" OS versions to display the wrong number.
+- Fixed various UI capitalizations.
+- Fixed UI issue where "Script is already running" tooltip incorrectly displayed when the script is not running.
+- Fixed the script details modal's error message on script timeout to reflect the newly dynamic script timeout limit, if hit.
+- Fixed a discrepancy in the spacing between DataSet labels and values on Firefox relative to other browsers.
+- Fixed bug that set `Added to Fleet` to `Never` after macOS hosts re-enrolled to Fleet via MDM. 
+
 ## Fleet 4.53.1 (Jul 01, 2024)
 
 ### Bug fixes
 
-* Updated fleetctl get queries/labels/hosts descriptions.
-* Fixed exporting CSVs with fields that contain commas to render properly.
-* Fixed link to fleetd uninstall instructions in "Delete device" modal.
-* Rendered only one banner on the my device page based on priority order.
-* Hidden query delete checkboxes from team observers.
-* Fixed issue where the Fleet UI could not be used to renew the ABM token after the ABM user who created the token was deleted.
-* Fixed an issue where special characters in HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall broke the "installer_utils.ps1 -uninstallOrbit" step in the Windows MSI installer.
-* Fixed counts for hosts with low disk space in summary page.
-* Fleet UI fixes: Hide CTA on inherited queries/policies from team level users.
-* Updated software updated timestamp tooltip.
-* Fixed issue where some Windows applications were getting matched against Windows OS vulnerabilities.
-* Fixed crash in `fleetd` installer on Windows if there are registry keys with special characters on the system.
-* Fixed UI capitalizations.
+- Updated fleetctl get queries/labels/hosts descriptions.
+- Fixed exporting CSVs with fields that contain commas to render properly.
+- Fixed link to fleetd uninstall instructions in "Delete device" modal.
+- Rendered only one banner on the my device page based on priority order.
+- Hidden query delete checkboxes from team observers.
+- Fixed issue where the Fleet UI could not be used to renew the ABM token after the ABM user who created the token was deleted.
+- Fixed an issue where special characters in HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall broke the "installer_utils.ps1 -uninstallOrbit" step in the Windows MSI installer.
+- Fixed counts for hosts with low disk space in summary page.
+- Fleet UI fixes: Hide CTA on inherited queries/policies from team level users.
+- Updated software updated timestamp tooltip.
+- Fixed issue where some Windows applications were getting matched against Windows OS vulnerabilities.
+- Fixed crash in `fleetd` installer on Windows if there are registry keys with special characters on the system.
+- Fixed UI capitalizations.
 
 ## Fleet 4.53.0 (Jun 25, 2024)
 
diff --git a/CODEOWNERS b/CODEOWNERS
index 524ca884048f..fae91d00d013 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -39,19 +39,9 @@
 go.sum @fleetdm/go
 go.mod @fleetdm/go
 /cmd/ @fleetdm/go
-/orbit/ @lucasmrod @getvictor @roperzh @gillespi314
 /server/ @fleetdm/go
-/server/service/handler.go @lucasmrod @getvictor @roperzh @gillespi314
-/server/mdm/ @roperzh @gillespi314
-/server/worker/ @lucasmrod @getvictor @roperzh @gillespi314
-/server/vulnerabilities/ @lucasmrod @mostlikelee
-/server/cron/ @getvictor @lucasmrod
-/ee/fleetd-chrome @lucasmrod @getvictor
-/ee/vulnerability-dashboard @eashaw
-/ee/cis @sharon-fdm @lucasmrod
-/ee/server/calender @lucasmrod @getvictor
-/ee/server/service @roperzh @gillespi314 @lucasmrod @getvictor
-/scripts/mdm @roperzh @gillespi314
+/ee/server/ @fleetdm/go
+/orbit/ @lucasmrod @roperzh @lukeheath @georgekarrv @sharon-fdm
 
 ##############################################################################################
 # 🚀 React files and other files related to the core product frontend.
@@ -66,9 +56,9 @@ go.mod @fleetdm/go
 # FUTURE: Look for a way to not have this notify every single person in this "github team".
 ##############################################################################################
 
-/infrastructure/ @rfairburn @ksatter @lukeheath @edwardsb @pacamaster @georgekarrv
-/charts/ @rfairburn @ksatter @lukeheath @edwardsb @pacamaster @georgekarrv
-/terraform/ @rfairburn @ksatter @lukeheath @edwardsb @pacamaster @georgekarrv
+/infrastructure/ @rfairburn @ksatter @lukeheath @edwardsb @georgekarrv
+/charts/ @rfairburn @ksatter @lukeheath @edwardsb @georgekarrv
+/terraform/ @rfairburn @ksatter @lukeheath @edwardsb @georgekarrv
 /it-and-security/ @noahtalerman @lukeheath @spokanemac @getvictor
 
 ##############################################################################################
@@ -77,8 +67,8 @@ go.mod @fleetdm/go
 # (see website/config/custom.js for DRIs of other paths not listed here)
 ##############################################################################################
 /docs                                           @rachaelshaw
-/docs/Using-Fleet/REST-API.md                   @rachaelshaw # « REST API reference documentation
-/docs/Contributing/API-for-contributors.md      @rachaelshaw @lukeheath # « Advanced / contributors-only API reference documentation
+/docs/REST\ API/rest-api.md                     @rachaelshaw # « REST API reference documentation
+/docs/Contributing/API-for-contributors.md      @lukeheath # « Advanced / contributors-only API reference documentation
 /schema                                         @eashaw # « Data tables (osquery/fleetd schema) documentation
 /docs/Deploy/_kubernetes/ @dherder # « Kubernetes best practice
 ##############################################################################################
@@ -137,43 +127,7 @@ go.mod @fleetdm/go
 ##############################################################################################
 # 🚀 GitHub workflows
 ##############################################################################################
-/.github/workflows/README.md @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/goreleaser-fleet.yaml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/update-certs.yml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/codeql-analysis.yml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/codeql.yml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/scorecards-analysis.yml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/integration.yml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/fleetctl-preview.yml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/fleetctl-preview-latest.yml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/goreleaser-orbit.yaml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/trivy-scan.yml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/goreleaser-snapshot-fleet.yaml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/build-and-push-fleetctl-docker.yml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/fleetd-tuf.yml @lucasmrod @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/generate-desktop-targets.yml @lucasmrod @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/test-yml-specs.yml @lucasmrod @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/build-binaries.yaml @lucasmrod @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/fleet-and-orbit.yml @lucasmrod @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/build-orbit.yaml @lucasmrod @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/generate-osqueryd-targets.yml @lucasmrod @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/test-packaging.yml @lucasmrod @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/release-helm.yaml @rfairburn @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/pr-helm.yaml @rfairburn @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/tfvalidate.yml @rfairburn @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/dogfood-deploy.yml @rfairburn @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/test-db-changes.yml @roperzh @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/test-go.yaml @roperzh @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/golangci-lint.yml @roperzh @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/test-native-tooling-packaging.yml @roperzh @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/check-tuf-timestamps.yml @roperzh @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/test-puppet.yml @roperzh @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/generate-nudge-targets.yml @roperzh @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/test-js.yml @ghernandez345 @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/dogfood-gitops.yml @getvictor @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/test-fleetd-chrome.yml @getvictor @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/release-fleetd-chrome.yml @getvictor @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/release-fleetd-chrome-beta.yml @getvictor @lukeheath @georgekarrv @sharon-fdm
+/.github/workflows/ @lukeheath @georgekarrv @sharon-fdm
 
 # ℹ️ But wait, there's more!
 # See the comments up top to learn where else DRIs and maintainers are configured.
diff --git a/Dockerfile-desktop-linux b/Dockerfile-desktop-linux
index b0ff52c050fd..c17d3894d06e 100644
--- a/Dockerfile-desktop-linux
+++ b/Dockerfile-desktop-linux
@@ -1,4 +1,4 @@
-FROM --platform=linux/amd64 golang:1.22.4-bullseye@sha256:067c5c7fe6d79f900c5ebe8351166356d6e3bbfcc6f807030e89b9a929252273
+FROM --platform=linux/amd64 golang:1.23.1-bullseye@sha256:45b43371f21ec51276118e6806a22cbb0bca087ddd54c491fdc7149be01035d5
 LABEL maintainer="Fleet Developers"
 
 RUN mkdir -p /usr/src/fleet
diff --git a/Dockerfile.osquery-perf b/Dockerfile.osquery-perf
deleted file mode 100644
index 89331d931221..000000000000
--- a/Dockerfile.osquery-perf
+++ /dev/null
@@ -1,16 +0,0 @@
-FROM golang:1.22.4-alpine3.20@sha256:ace6cc3fe58d0c7b12303c57afe6d6724851152df55e08057b43990b927ad5e8 
-
-ARG ENROLL_SECRET
-ARG HOST_COUNT
-ARG SERVER_URL
-
-ENV ENROLL_SECRET ${ENROLL_SECRET}
-ENV HOST_COUNT ${HOST_COUNT}
-ENV SERVER_URL ${SERVER_URL}
-
-COPY ./cmd/osquery-perf/agent.go ./go.mod ./go.sum ./cmd/osquery-perf/mac10.14.6.tmpl /osquery-perf/
-WORKDIR /osquery-perf/
-RUN go mod download
-RUN go build -o osquery-perf
-
-CMD ./osquery-perf -enroll_secret $ENROLL_SECRET -host_count $HOST_COUNT -server_url $SERVER_URL
diff --git a/Makefile b/Makefile
index d90f615c9ac1..46115cf47903 100644
--- a/Makefile
+++ b/Makefile
@@ -221,6 +221,12 @@ docker-push-release: docker-build-release
 fleetctl-docker: xp-fleetctl
 	docker build -t fleetdm/fleetctl --platform=linux/amd64 -f tools/fleetctl-docker/Dockerfile .
 
+bomutils-docker:
+	cd tools/bomutils-docker && docker build -t fleetdm/bomutils --platform=linux/amd64 -f Dockerfile .
+
+wix-docker:
+	cd tools/wix-docker && docker build -t fleetdm/wix --platform=linux/amd64 -f Dockerfile .
+
 .pre-binary-bundle:
 	rm -rf build/binary-bundle
 	mkdir -p build/binary-bundle/linux
@@ -249,13 +255,15 @@ fleetd-tables-windows:
 	GOOS=windows GOARCH=amd64 go build -o fleetd_tables_windows.exe ./orbit/cmd/fleetd_tables
 fleetd-tables-linux:
 	GOOS=linux GOARCH=amd64 go build -o fleetd_tables_linux.ext ./orbit/cmd/fleetd_tables
+fleetd-tables-linux-arm64:
+	GOOS=linux GOARCH=arm64 go build -o fleetd_tables_linux_arm64.ext ./orbit/cmd/fleetd_tables
 fleetd-tables-darwin:
 	GOOS=darwin GOARCH=amd64 go build -o fleetd_tables_darwin.ext ./orbit/cmd/fleetd_tables
 fleetd-tables-darwin_arm:
 	GOOS=darwin GOARCH=arm64 CGO_ENABLED=1 go build -o fleetd_tables_darwin_arm.ext ./orbit/cmd/fleetd_tables
 fleetd-tables-darwin-universal: fleetd-tables-darwin fleetd-tables-darwin_arm
 	lipo -create fleetd_tables_darwin.ext fleetd_tables_darwin_arm.ext -output fleetd_tables_darwin_universal.ext
-fleetd-tables-all: fleetd-tables-windows fleetd-tables-linux fleetd-tables-darwin-universal
+fleetd-tables-all: fleetd-tables-windows fleetd-tables-linux fleetd-tables-darwin-universal fleetd-tables-linux-arm64
 fleetd-tables-clean:
 	rm -f fleetd_tables_windows.exe fleetd_tables_linux.ext fleetd_tables_darwin.ext fleetd_tables_darwin_arm.ext fleetd_tables_darwin_universal.ext
 
@@ -279,7 +287,7 @@ binary-arch: .pre-binary-arch .pre-binary-bundle .pre-fleet
 
 # Drop, create, and migrate the e2e test database
 e2e-reset-db:
-	docker-compose exec -T mysql_test bash -c 'echo "drop database if exists e2e; create database e2e;" | MYSQL_PWD=toor mysql -uroot'
+	docker compose exec -T mysql_test bash -c 'echo "drop database if exists e2e; create database e2e;" | MYSQL_PWD=toor mysql -uroot'
 	./build/fleet prepare db --mysql_address=localhost:3307  --mysql_username=root --mysql_password=toor --mysql_database=e2e
 
 e2e-setup:
@@ -310,7 +318,7 @@ e2e-serve-premium: e2e-reset-db
 # Usage:
 # make e2e-set-desktop-token host_id=1 token=foo
 e2e-set-desktop-token:
-	docker-compose exec -T mysql_test bash -c 'echo "INSERT INTO e2e.host_device_auth (host_id, token) VALUES ($(host_id), \"$(token)\") ON DUPLICATE KEY UPDATE token=VALUES(token)" | MYSQL_PWD=toor mysql -uroot'
+	docker compose exec -T mysql_test bash -c 'echo "INSERT INTO e2e.host_device_auth (host_id, token) VALUES ($(host_id), \"$(token)\") ON DUPLICATE KEY UPDATE token=VALUES(token)" | MYSQL_PWD=toor mysql -uroot'
 
 changelog:
 	sh -c "find changes -type f | grep -v .keep | xargs -I {} sh -c 'grep \"\S\" {}; echo' > new-CHANGELOG.md"
@@ -345,7 +353,7 @@ fleetd-tuf:
 
 # Reset the development DB
 db-reset:
-	docker-compose exec -T mysql bash -c 'echo "drop database if exists fleet; create database fleet;" | MYSQL_PWD=toor mysql -uroot'
+	docker compose exec -T mysql bash -c 'echo "drop database if exists fleet; create database fleet;" | MYSQL_PWD=toor mysql -uroot'
 	./build/fleet prepare db --dev
 
 # Back up the development DB to file
@@ -422,6 +430,14 @@ endif
 	tar czf $(out-path)/swiftDialog.app.tar.gz -C $(TMP_DIR)/swiftDialog_pkg_payload_expanded/Library/Application\ Support/Dialog/ Dialog.app
 	rm -rf $(TMP_DIR)
 
+# Generate escrowBuddy.pkg bundle from the Escrow Buddy repo.
+#
+# Usage:
+# make escrow-buddy-pkg version=1.0.0 out-path=.
+escrow-buddy-pkg:
+	curl -L https://github.com/macadmins/escrow-buddy/releases/download/v$(version)/Escrow.Buddy-$(version).pkg --output $(out-path)/escrowBuddy.pkg
+
+
 # Build and generate desktop.app.tar.gz bundle.
 #
 # Usage:
@@ -465,6 +481,21 @@ desktop-linux:
 		tar czf desktop.tar.gz fleet-desktop && \
 		rm -r fleet-desktop"
 
+# Build desktop executable for Linux ARM.
+#
+# Usage:
+# FLEET_DESKTOP_VERSION=0.0.1 make desktop-linux-arm64
+#
+# Output: desktop.tar.gz
+desktop-linux-arm64:
+	docker build -f Dockerfile-desktop-linux -t desktop-linux-builder .
+	docker run --rm -v $(shell pwd):/output desktop-linux-builder /bin/bash -c "\
+		mkdir /output/fleet-desktop && \
+		GOARCH=arm64 go build -o /output/fleet-desktop/fleet-desktop -ldflags "-X=main.version=$(FLEET_DESKTOP_VERSION)" /usr/src/fleet/orbit/cmd/desktop && \
+		cd /output && \
+		tar czf desktop.tar.gz fleet-desktop && \
+		rm -r fleet-desktop"
+
 # Build orbit executable for Windows.
 # This generates orbit executable for Windows that includes versioninfo binary properties
 # These properties can be displayed when right-click on the binary in Windows Explorer.
diff --git a/README.md b/README.md
index 7e8651a618ef..3c23f067c3b9 100644
--- a/README.md
+++ b/README.md
@@ -43,8 +43,6 @@ Fleet has no ambition to replace all of your other tools.  (Though it might repl
 
 Fleet plays well with Munki, Chef, Puppet, and Ansible, as well as with security tools like Crowdstrike and SentinelOne.  For example, you can use the free version of Fleet to quickly report on what hosts are _actually_ running your EDR agent.
 
-While most folks prefer to use one or the other, Fleet can also coexist peacefully with Rapid7 and other agent-based vulnerability scanners.  This can be useful during migrations.
-
 #### Free as in free
 The free version of Fleet will [always be free](https://fleetdm.com/pricing).  Fleet is [independently backed](https://linkedin.com/company/fleetdm) and actively maintained with the help of many amazing [contributors](https://github.com/fleetdm/fleet/graphs/contributors).
 
diff --git a/docs/Using Fleet/Automations.md b/articles/automations.md
similarity index 92%
rename from docs/Using Fleet/Automations.md
rename to articles/automations.md
index e124fc779ea3..478b870556ac 100644
--- a/docs/Using Fleet/Automations.md	
+++ b/articles/automations.md
@@ -40,6 +40,9 @@ Host status automations send a webhook request if a configured percentage of hos
 
 Fleet sends these webhook requests once per day by default.
 
-<meta name="pageOrderInSection" value="1509">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-07-03">
+<meta name="articleTitle" value="Automations">
 <meta name="description" value="Configure Fleet automations to trigger webhooks or create tickets in Jira and Zendesk for vulnerability, policy, and host status events.">
-<meta name="navSection" value="Device management">
diff --git a/articles/certificates-in-fleetd.md b/articles/certificates-in-fleetd.md
index fe149d8ff815..e7ef4a9eef0b 100644
--- a/articles/certificates-in-fleetd.md
+++ b/articles/certificates-in-fleetd.md
@@ -57,6 +57,6 @@ fleetctl debug connection \
 <meta name="authorFullName" value="Lucas Manuel Rodriguez">
 <meta name="authorGitHubUsername" value="lucasmrod">
 <meta name="category" value="guides">
-<meta name="publishedOn" value="2024-08-09">
+<meta name="publishedOn" value="2024-07-09">
 <meta name="articleImageUrl" value="../website/assets/images/articles/apple-developer-certificates-on-linux-for-configuration-profile-signing-1600x900@2x.png">
-<meta name="description" value="TLS certificates in fleetd">
\ No newline at end of file
+<meta name="description" value="TLS certificates in fleetd">
diff --git a/docs/Using Fleet/enroll-chromebooks.md b/articles/chrome-os.md
similarity index 85%
rename from docs/Using Fleet/enroll-chromebooks.md
rename to articles/chrome-os.md
index 2c1684cc5f10..d74dfb89c10a 100644
--- a/docs/Using Fleet/enroll-chromebooks.md	
+++ b/articles/chrome-os.md
@@ -1,8 +1,6 @@
 # ChromeOS
 For visibility on ChromeOS hosts, Fleet provides the fleetd Chrome extension which provides similar functionality as osquery on other operating systems.
 
-## Adding ChromeOS hosts to Fleet
-
 To learn how to add ChromeOS hosts to Fleet, visit [here](https://fleetdm.com/docs/using-fleet/adding-hosts#enroll-chromebooks).
 
 > The fleetd Chrome browser extension is supported on ChromeOS operating systems that are managed using [Google Admin](https://admin.google.com). It is not intended for non-ChromeOS hosts with the Chrome browser installed.
@@ -23,6 +21,10 @@ By default, the hostname for a Chromebook host will be blank. The hostname can b
 
 ## Debugging ChromeOS
 To learn how to debug the Fleetd Chrome extension, visit [here](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Testing-and-local-development.md#fleetd-chrome-extension).
-<meta name="title" value="Enroll Chromebooks">
-<meta name="pageOrderInSection" value="2000">
-<meta name="navSection" value="Dig deeper">
+
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="zhumo">
+<meta name="authorFullName" value="Mo Zhu">
+<meta name="publishedOn" value="2023-11-21">
+<meta name="articleTitle" value="ChromeOS">
+<meta name="description" value="Learn about ChromeOS and Fleet.">
diff --git a/docs/Using Fleet/CIS-Benchmarks.md b/articles/cis-benchmarks.md
similarity index 91%
rename from docs/Using Fleet/CIS-Benchmarks.md
rename to articles/cis-benchmarks.md
index 9942eb0e3c20..905d62efbadb 100644
--- a/docs/Using Fleet/CIS-Benchmarks.md	
+++ b/articles/cis-benchmarks.md
@@ -11,7 +11,7 @@ Fleet has implemented native support for CIS Benchmarks for the following platfo
 - Windows 10 Enterprise
 - Windows 11 Enterprise
 
-[Where possible](#limitations), each CIS Benchmark is implemented with a [policy query](./REST-API.md#policies) in Fleet. 
+[Where possible](#limitations), each CIS Benchmark is implemented with a [policy query](https://fleetdm.com/docs/rest-api/rest-api#policies) in Fleet. 
 
 These benchmarks are intended to gauge your organization's security posture, rather than the current state of a given host. A host may fail a CIS Benchmark policy despite having the correct settings enabled if there is no configuration profile or Group Policy Object (GPO) in place to enforce the setting. For example, this is the query for  **CIS - Ensure FileVault Is Enabled (MDM Required)**:
 
@@ -95,7 +95,7 @@ Following are the requirements to use the CIS Benchmarks in Fleet:
 
 - Devices must be running [`fleetd`](https://fleetdm.com/docs/using-fleet/orbit), Fleet's lightweight agent.
 - Some CIS Benchmarks explicitly involve verifying MDM-based controls, so devices must be enrolled to an MDM solution.
-- On macOS, the orbit component of fleetd must have "Full Disk Access", see [Grant Full Disk Access to Osquery on macOS](./Adding-hosts.md#grant-full-disk-access-to-osquery-on-macos).
+- On macOS, the orbit component of fleetd must have "Full Disk Access", see [Grant Full Disk Access to Osquery on macOS](https://fleetdm.com/guides/enroll-hosts#grant-full-disk-access-to-osquery-on-macos).
 
 ## Limitations
 
@@ -111,7 +111,9 @@ In August 2023, we completed scale testing on 10k Windows hosts and 70k macOS ho
 
 Detailed results are [here](https://docs.google.com/document/d/1OSpyzMkHjVhG_-EIBkLu7X3hj_XfVASGl3IXIYChpck/edit?usp=sharing).
 
-<meta name="pageOrderInSection" value="1700">
-<meta name="title" value="CIS Benchmarks">
-<meta name="description" value="Read about how Fleet's implementation of CIS Benchmarks offers consensus-based cybersecurity guidance, covering macOS 13.0 Ventura & Windows Enterprise.">
-<meta name="navSection" value="Security compliance">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="lucasmrod">
+<meta name="authorFullName" value="Lucas Rodriguez">
+<meta name="publishedOn" value="2024-04-02">
+<meta name="articleTitle" value="CIS Benchmarks">
+<meta name="description" value="Read about how Fleet's implementation of CIS Benchmarks offers consensus-based cybersecurity guidance.">
diff --git a/articles/config-less-fleetd-agent-deployment.md b/articles/config-less-fleetd-agent-deployment.md
index 6b4258d75146..eb37159fdcf5 100644
--- a/articles/config-less-fleetd-agent-deployment.md
+++ b/articles/config-less-fleetd-agent-deployment.md
@@ -72,6 +72,14 @@ fleetctl package --type=pkg --use-system-configuration --fleet-desktop
 msiexec /i fleetd-base.msi FLEET_URL="<target_url>" FLEET_SECRET="<secret_to_use>"
 ```
 
+Also, you can optionally pass `ENABLE_SCRIPTS`, `END_USER_EMAIL`, and `FLEET_DESKTOP` to the installer.
+
+For example, this command would install fleetd with script execution enabled, custom human-device mapping set, and Fleet Desktop enabled:
+
+```xml
+msiexec /i fleetd-base.msi ENABLE_SCRIPTS=true END_USER_EMAIL="user@example.com" FLEET_DESKTOP=true FLEET_URL="<target_url>" FLEET_SECRET="<secret_to_use>"
+```
+
 These steps are a flexible alternative to deploying Fleet's agent across macOS and Windows platforms. This method, focused on separating the configuration from the `fleetd` package, empowers you with more control and simplifies the management of your device enrollments.
 
 This approach complements the original packaging method, allowing you to choose the best fit for your organization’s needs. Whether you prioritize streamlined package generation or prefer granular control over configuration distribution, these methods foster an open, flexible environment for deploying Fleet.
diff --git a/docs/Using Fleet/MDM-custom-OS-settings.md b/articles/custom-os-settings.md
similarity index 84%
rename from docs/Using Fleet/MDM-custom-OS-settings.md
rename to articles/custom-os-settings.md
index 5d2b740b0145..aadafc1f844f 100644
--- a/docs/Using Fleet/MDM-custom-OS-settings.md	
+++ b/articles/custom-os-settings.md
@@ -1,6 +1,6 @@
 # Custom OS settings
 
-In Fleet you can enforce OS settings on your macOS and Windows hosts using configuration profiles.
+In Fleet you can enforce OS settings like security restrictions, screen lock, Wi-Fi etc., on your your macOS, iOS, iPadOS, and Windows hosts using configuration or device profiles.
 
 ## Enforce OS settings
 
@@ -36,7 +36,9 @@ In the top box, with "Verified," "Verifying," "Pending," and "Failed" statuses,
 
 In the list of hosts, click on an individual host and click the **OS settings** item to see the status for a specific setting.
 
-<meta name="pageOrderInSection" value="1505">
-<meta name="title" value="Custom OS settings">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-07-27">
+<meta name="articleTitle" value="Custom OS settings">
 <meta name="description" value="Learn how to enforce custom settings on macOS and Window hosts using Fleet's configuration profiles.">
-<meta name="navSection" value="Device management">
diff --git a/articles/debunk-the-cross-platform-myth.md b/articles/debunk-the-cross-platform-myth.md
new file mode 100644
index 000000000000..80d81c919c98
--- /dev/null
+++ b/articles/debunk-the-cross-platform-myth.md
@@ -0,0 +1,59 @@
+# Debunk the cross-platform myth
+
+Conventional wisdom holds that cross-platform device management is a nightmare. It’s no surprise—most solutions out there are cobbled together with bolted-on features that never quite mesh. If you’ve tried managing a mixed fleet of macOS, Windows, and Linux devices, you might have some scars to show for it. But here’s the thing: it doesn’t have to be that way. Fleet is built differently, and it’s time to debunk the myth that cross-platform management has to suck.
+
+## Cross-platform pain points
+
+The skepticism around cross-platform device management is real, and for good reason. Many IT teams have been burned by solutions that promise seamless management across different operating systems but deliver only frustration and complexity. Solutions that often leave a trail of disappointed admins in their wake, often forcing you to manage the tools more than the devices. Fleet flips that script by letting you interact directly with each operating system’s native features. Whether Apple’s macOS, Microsoft’s Windows, or various Linux distributions, Fleet provides a consistent management experience without forcing you to “talk Windows” to your Macs or vice versa.
+
+
+## Managing every OS like it’s your favorite
+
+Fleet introduces familiar concepts like custom attributes and dynamic grouping but adapts them to work with the nuances of each operating system. This means you can manage your macOS, Windows, and Linux devices without juggling multiple management platforms or dealing with convoluted workarounds. Everything is streamlined in one open-source platform, giving you direct access to the data and events from each OS.
+
+By working directly with native operating system features, Fleet ensures you don’t lose low-level control or compromise on capabilities. Instead of managing multiple MDM solutions, you can focus on managing your devices—regardless of OS.
+
+For example:
+
+* **Operating systems**: You can enforce OS updates with Declarative Device Management (DDM), Nudge, and Windows Update from one console.
+* **Automated enrollment**: Drop-ship devices to your end users with Apple Business Manager or Autopilot and let them set up their own accounts. No IT help is needed.
+* **Config management**: Manage settings with configuration profiles for Apple and device profiles for Windows. Use a canary team to test changes before they go live.
+* **App management**: Automatically keep applications and plugins secure and up-to-date. Install the software end users need or let them install it themselves via self-service.
+* **Scripts and events**: Easily manage and version control your custom script library. Execute shell and PowerShell scripts when computers drift from the baseline.
+* **Keep up with Apple**: Fleet's team and community stay current on the latest features and releases from all supported platform vendors, not just Apple.
+
+## Switching platforms is disruptive
+
+It’s understandable to be cautious about adopting a new management solution, especially if you’re concerned about the time and effort involved in switching. However, Fleet is designed with ease of transition in mind. Our platform integrates seamlessly with your existing tools and workflows, minimizing disruption. Plus, with our comprehensive documentation and responsive community support, you’ll have everything you need to get up and running quickly. Fleet’s flexible deployment options let you start small and scale at your pace, ensuring a smooth, controlled migration.
+
+![Migrate to Fleet dialog](../website/assets/images/articles/debunk-the-cross-platform-myth-600x521@2x.png "Migrate to Fleet dialog")
+
+## One platform, many possibilities
+
+Fleet isn’t just about making cross-platform management tolerable—it’s about making it genuinely effective. With Fleet, you can enforce OS updates, automate device enrollment, manage configurations, and keep applications secure, all from one place. You can also deploy Fleet yourself at any time; it’s 100% source-available, meaning you can look at the source code for how any part of it works.
+
+And because Fleet is open-source, it’s designed with flexibility and transparency in mind. You can tailor it to fit your organization’s needs, whether you’re managing a few hundred devices or tens of thousands.
+
+<blockquote purpose="quote">
+
+Mad props to how easy making a deploy pkg of the agent was. I wish everyone made stuff that easy.
+
+</blockquote>
+
+_Wes Whetstone, Staff CPE at Stripe_
+
+
+## The takeaway
+
+Cross-platform management doesn’t have to be the headache it’s been in the past. Fleet is here to simplify how you manage your devices, no matter what mix of operating systems you’re dealing with. It’s time to let go of the myth that managing different platforms means managing different tools. With Fleet, you can have everything you need in one place—without the anxiety.
+
+Ready to get started?
+
+Visit our [start page](https://fleetdm.com/start) to begin your journey.
+
+<meta name="category" value="announcements">
+<meta name="authorFullName" value="Mike McNeil">
+<meta name="authorGitHubUsername" value="mikermcneil">
+<meta name="publishedOn" value="2024-08-27">
+<meta name="articleTitle" value="Debunk the cross-platform myth">
+<meta name="description" value="Debunk the cross-platform myth with MDM">
diff --git a/articles/deploy-fleet-on-aws-ecs.md b/articles/deploy-fleet-on-aws-ecs.md
index ac9428865b93..38b802fb9b36 100644
--- a/articles/deploy-fleet-on-aws-ecs.md
+++ b/articles/deploy-fleet-on-aws-ecs.md
@@ -1,6 +1,6 @@
 # Deploy Fleet on AWS ECS
 
-> **This article was archived on May 16, 2024,** and may be outdated. Check out [Deploy Fleet](https://fleetdm.com/docs/deploy/deploy-fleet) for our recommended deployment method.
+> **This article was archived on May 16, 2024.** Check out [Deploy Fleet](https://fleetdm.com/docs/deploy/deploy-fleet) for the most up to date deployment method.
 
 ![Deploy Fleet on AWS ECS](../website/assets/images/articles/deploy-fleet-on-aws-ecs-800x450@2x.png)
 
diff --git a/articles/deploy-fleet-on-aws-with-terraform.md b/articles/deploy-fleet-on-aws-with-terraform.md
index 6853032a50ae..38f8de9b955a 100644
--- a/articles/deploy-fleet-on-aws-with-terraform.md
+++ b/articles/deploy-fleet-on-aws-with-terraform.md
@@ -1,6 +1,6 @@
 # Deploy Fleet on AWS with Terraform
 
-> **This article was archived on May 16, 2024,** and may be outdated. Check out [Deploy Fleet](https://fleetdm.com/docs/deploy/deploy-fleet) for our recommended deployment method.
+> **This article was archived on May 16, 2024.** Check out [Deploy Fleet](https://fleetdm.com/docs/deploy/deploy-fleet) for the most up to date deployment method.
 
 ![Deploy Fleet on AWS ECS](../website/assets/images/articles/deploy-fleet-on-aws-with-terraform-800x450@2x.png)
 
diff --git a/articles/deploy-fleet-on-centos.md b/articles/deploy-fleet-on-centos.md
index b832e0f4f14a..f9439d577374 100644
--- a/articles/deploy-fleet-on-centos.md
+++ b/articles/deploy-fleet-on-centos.md
@@ -1,6 +1,6 @@
 # Deploy Fleet on CentOS
 
-> **This article was archived on May 16, 2024,** and may be outdated. Check out [Deploy Fleet](https://fleetdm.com/docs/deploy/deploy-fleet) for our recommended deployment method.
+> **This article was archived on May 16, 2024.** Check out [Deploy Fleet](https://fleetdm.com/docs/deploy/deploy-fleet) for the most up to date deployment method.
 
 ![Deploy Fleet on CentOS](../website/assets/images/articles/deploy-fleet-on-centos-800x450@2x.png)
 
diff --git a/articles/deploy-fleet-on-cloudgov.md b/articles/deploy-fleet-on-cloudgov.md
index 5e5e2b164455..18f0c238a854 100644
--- a/articles/deploy-fleet-on-cloudgov.md
+++ b/articles/deploy-fleet-on-cloudgov.md
@@ -1,7 +1,5 @@
 # Deploy Fleet on Cloud.gov (Cloud Foundry)
 
-> **This article was archived on May 16, 2024,** and may be outdated. Check out [Deploy Fleet](https://fleetdm.com/docs/deploy/deploy-fleet) for our recommended deployment method.
-
 ![Deploy Fleet on Cloud.gov](../website/assets/images/articles/deploy-fleet-on-cloudgov-800x450@2x.png)
 
 Cloud.gov is a [FEDRAMP moderate Platform-as-a-Service
diff --git a/articles/deploy-fleet-on-hetzner-cloud.md b/articles/deploy-fleet-on-hetzner-cloud.md
index 82dac9495c50..ec6c7da9a9aa 100644
--- a/articles/deploy-fleet-on-hetzner-cloud.md
+++ b/articles/deploy-fleet-on-hetzner-cloud.md
@@ -1,6 +1,6 @@
 # Deploy Fleet on Hetzner Cloud
 
-> **This article was archived on May 16, 2024,** and may be outdated. Check out [Deploy Fleet](https://fleetdm.com/docs/deploy/deploy-fleet) for our recommended deployment method.
+> **This article was archived on May 16, 2024.** Check out [Deploy Fleet](https://fleetdm.com/docs/deploy/deploy-fleet) for the most up to date deployment method.
 
 ![Deploy Fleet on Hetzner Cloud](../website/assets/images/articles/deploy-fleet-on-hetzner-cloud-800x450@2x.png)
 
@@ -69,14 +69,14 @@ echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docke
 apt update
 apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
 
-docker pull mysql@sha256:16e159331007eccc069822f7b731272043ed572a79a196a05ffa2ea127caaf67 # mysql:5.7.38 as of 2022/05/19
+docker pull mysql@sha256:134e2d1c7c517d05e5328a77aa5a165a314dc4c4116503e7e089494f4e398ab1 # mysql:8.0.36 as of 2024/07/04
 
 ######################
 # MySQL (dockerized) #
 ######################
 
-# mysql:5.7.38 as of 2022/05/19
-docker pull mysql@sha256:16e159331007eccc069822f7b731272043ed572a79a196a05ffa2ea127caaf67
+# mysql:8.0.36 as of 2024/07/04
+docker pull mysql@sha256:134e2d1c7c517d05e5328a77aa5a165a314dc4c4116503e7e089494f4e398ab1
 
 # Create the Fleet MySQL data folder
 mkdir -p /etc/fleet
@@ -102,14 +102,14 @@ Restart=always
 
 ExecStartPre=-/usr/bin/docker exec %n stop
 ExecStartPre=-/usr/bin/docker rm %n
-ExecStartPre=-/usr/bin/docker pull mysql@sha256:16e159331007eccc069822f7b731272043ed572a79a196a05ffa2ea127caaf67
+ExecStartPre=-/usr/bin/docker pull mysql@sha256:134e2d1c7c517d05e5328a77aa5a165a314dc4c4116503e7e089494f4e398ab1
 
 ExecStart=/usr/bin/docker run --rm \
     --name %n \
     -p 127.0.0.1:3306:3306 \
     -v /etc/fleet/mysql:/var/lib/mysql \
     --env-file /etc/fleet/mysql.env \
-    mysql@sha256:16e159331007eccc069822f7b731272043ed572a79a196a05ffa2ea127caaf67
+    mysql@sha256:134e2d1c7c517d05e5328a77aa5a165a314dc4c4116503e7e089494f4e398ab1
 
 ExecStop=/usr/bin/docker stop %n
 
@@ -435,7 +435,7 @@ To run MySQL, we’ll have to do the following:
 We can pull the [official MySQL docker image](https://hub.docker.com/_/mysql) like so:
 
 ```sh
-$ docker pull mysql@sha256:16e159331007eccc069822f7b731272043ed572a79a196a05ffa2ea127caaf67 # mysql:5.7.38 as of 2022/05/19
+$ docker pull mysql@sha256:134e2d1c7c517d05e5328a77aa5a165a314dc4c4116503e7e089494f4e398ab1 # mysql:8.0.36 as of 2024/07/04
 ```
 
 ### Create & enable a systemd unit for MySQL
@@ -472,14 +472,14 @@ Restart=always
 
 ExecStartPre=-/usr/bin/docker exec %n stop
 ExecStartPre=-/usr/bin/docker rm %n
-ExecStartPre=-/usr/bin/docker pull mysql@sha256:16e159331007eccc069822f7b731272043ed572a79a196a05ffa2ea127caaf67
+ExecStartPre=-/usr/bin/docker pull mysql@sha256:134e2d1c7c517d05e5328a77aa5a165a314dc4c4116503e7e089494f4e398ab1
 
 ExecStart=/usr/bin/docker run --rm \
     --name %n \
     -p 127.0.0.1:3306:3306 \
     -v /etc/fleet/mysql:/var/lib/mysql \
     --env-file /etc/fleet/mysql.env \
-    mysql@sha256:16e159331007eccc069822f7b731272043ed572a79a196a05ffa2ea127caaf67
+    mysql@sha256:134e2d1c7c517d05e5328a77aa5a165a314dc4c4116503e7e089494f4e398ab1
 
 ExecStop=/usr/bin/docker stop %n
 
@@ -712,4 +712,4 @@ Now that you’re ready to use Fleet and have a host installed. Here's some next
 <meta name="publishedOn" value="2022-06-27">
 <meta name="category" value="guides">
 <meta name="articleImageUrl" value="../website/assets/images/articles/deploy-fleet-on-hetzner-cloud-800x450@2x.png">
-<meta name="description" value="Learn how to deploy Fleet on Hetzner Cloud using cloud-init and Docker.">
\ No newline at end of file
+<meta name="description" value="Learn how to deploy Fleet on Hetzner Cloud using cloud-init and Docker.">
diff --git a/articles/deploy-fleet-on-kubernetes.md b/articles/deploy-fleet-on-kubernetes.md
index ea85bbb07d2e..5e5144efc526 100644
--- a/articles/deploy-fleet-on-kubernetes.md
+++ b/articles/deploy-fleet-on-kubernetes.md
@@ -1,6 +1,6 @@
 # Deploy Fleet on Kubernetes
 
-> **This article was archived on May 16, 2024,** and may be outdated. Check out [Deploy Fleet](https://fleetdm.com/docs/deploy/deploy-fleet) for our recommended deployment method.
+> **This article was archived on May 16, 2024.** Check out [Deploy Fleet](https://fleetdm.com/docs/deploy/deploy-fleet) for the most up to date deployment method.
 
 ![Deploy Fleet on Kubernetes](../website/assets/images/articles/deploy-fleet-on-kubernetes-800x450@2x.png)
 
diff --git a/articles/deploy-fleet-on-render.md b/articles/deploy-fleet-on-render.md
index 1ec25ae1ed71..703d872cf6f2 100644
--- a/articles/deploy-fleet-on-render.md
+++ b/articles/deploy-fleet-on-render.md
@@ -1,6 +1,6 @@
 # Deploy Fleet on Render
 
-> **This article was archived on May 16, 2024,** and may be outdated. Check out [Deploy Fleet](https://fleetdm.com/docs/deploy/deploy-fleet) for our recommended deployment method.
+> **This article was archived on May 16, 2024.** Check out [Deploy Fleet](https://fleetdm.com/docs/deploy/deploy-fleet) for the most up to date deployment method.
 
 ![Deploy Fleet on Render](../website/assets/images/articles/deploy-fleet-on-render-800x450@2x.png)
 
@@ -31,7 +31,9 @@ The Fleet server and user interface are packaged into a Docker image and hosted
 
 ## Setup Fleet and enroll hosts
 
-The first time you access your Fleet instance you will be prompted with a setup page where you can enter your name, email, and password. Run through those steps to reach the Fleet dashboard. 
+The first time you access your Fleet instance, you will be prompted with a setup page where you can enter your name, email, and password. Run through those steps to reach the Fleet dashboard.
+
+> Set a strong and unique password instead of the default password during the setup process. 
 
 You’ll find the enroll-secret after clicking “Add hosts”. This is a special secret the host will need to register to your Fleet instance. Once you have the enroll-secret you can use `fleetctl` to generate Fleet's agent (fleetd), which makes installing and updating osquery super simple.
 
@@ -86,4 +88,4 @@ That’s it! We have successfully deployed and configured a Fleet instance! Rend
 <meta name="publishedOn" value="2021-11-21">
 <meta name="category" value="guides">
 <meta name="articleImageUrl" value="../website/assets/images/articles/deploy-fleet-on-render-800x450@2x.png">
-<meta name="description" value="Learn how to deploy Fleet on Render.">
\ No newline at end of file
+<meta name="description" value="Learn how to deploy Fleet on Render.">
diff --git a/articles/deploy-security-agents.md b/articles/deploy-security-agents.md
new file mode 100644
index 000000000000..20d6cd28abec
--- /dev/null
+++ b/articles/deploy-security-agents.md
@@ -0,0 +1,97 @@
+# Deploy security agents
+
+![Deploy security agents](../website/assets/images/articles/deploy-security-agents-1600x900@2x.png)
+
+Fleet [v4.50.0](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.50.0) introduced the ability to upload and deploy security agents to your hosts. Beyond a [bootstrap package](https://fleetdm.com/docs/using-fleet/mdm-macos-setup-experience#bootstrap-package) at enrollment, deploying security agents allows you to specify and verify device configuration using a pre-enrollment osquery query and customization of the install and post-install scripts, allowing for key and license deployment and configuration.  This guide will walk you through the steps to upload, configure, and install a security agent to hosts in your fleet.
+
+## Prerequisites
+
+* Fleet [v4.50.0](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.50.0).
+* `fleetd` 1.25.0 deployed via MDM or built with the `--scripts-enabled` flag.
+* An S3 bucket [configured](https://fleetdm.com/docs/configuration/fleet-server-configuration#s-3-software-installers-bucket) to store the installers.
+* Increase any load balancer timeouts to at least 5 minutes for the following endpoints:
+    * [Add software](https://fleetdm.com/docs/rest-api/rest-api#add-software).
+    * [Batch-apply software](https://fleetdm.com/docs/rest-api/rest-api#add-software).
+
+## Step-by-step instructions
+
+### Access security agent installers
+
+To access and manage security agents in Fleet:
+
+* **Navigate to the Software page**: Click on the "Software" tab in the main navigation menu.
+* **Select a team**: Click on the dropdown at the top left of the page.
+* **Find your software**: using the filters on the top of the table, you can choose between:
+    * “Available for install” filters software that can be installed on your hosts.
+    * “Self-service” filters software that end users can install from Fleet Desktop.
+* **Select security agent installer**: Click on a software package to view details and access additional actions for the agent installer.
+
+### Add a security agent to a team
+
+* **Navigate to the Software page**: Click on the "Software" tab in the main navigation menu.
+* **Select a team**: Select a team or the "No team" team to add a security agent.
+
+> Security agents cannot be added to "All teams"
+
+* Click the “Add Software” button in the top right corner, and a modal will appear.
+* Choose a file to upload. `.pkg`, `.msi`, `.exe`, or `.deb` files are supported.
+* After selecting a file, a default install script will be pre-filled. If the security agent requires a custom installation process, this script can be edited.
+* To allow users to install the software from Fleet Desktop, check the “Self-service” checkbox.
+* To customize the conditions, click on “Advanced options”:
+    * **Pre-install condition**: A pre-install condition is a valid osquery SQL statement that will be evaluated on the host before installing the software. If provided, the installation will proceed only if the query returns any value.
+    * **Post-install script** A post-install script will run after the installation is complete, allowing you to configure the security agent right after installation. If this script returns a non-zero exit code, the installation will fail, and `fleetd` will attempt to uninstall the software.
+
+### Install a security agent on a host
+
+After an installer is added to a team, it can be installed on hosts via the UI.
+
+* **Navigate to the Hosts page**: Click on the "Hosts" tab in the main navigation menu.
+* **Navigate to the Host details page**: Click the host you want to install the security agent.
+* **Navigate to the Host software tab**: In the host details, search for the tab named “Software”
+* **Find your security agent**: Use the search bar and filters to search for your security agent.
+* **Install the security agent on the host**: In the leftmost row of the table, click on “Actions” > “Install.”
+* **Track installation status**: by either
+    * Checking the “Install status” in the host software table.
+    * Navigate to the “Details” tab on the host details page and check the activity log.
+
+### Edit a security agent
+
+Security agent installers can’t be edited via the UI. To modify an installer, remove it from the UI and add a new one.
+
+### Remove a security agent from a team
+
+* **Navigate to the Software page**: Click on the "Software" tab in the main navigation menu.
+* **Select a team**: Select a team or the "No team" team to add a security agent.
+* **Find your software**: using the filters on the top of the table, you can choose between:
+    * “Available for install” filters software can be installed on your hosts.
+    * “Self-service” filters software that users can install from Fleet Desktop.
+* **Select security agent installer**: Click on a software package to view details.
+* **Remove security agent installer**: From the Actions menu, select "Delete." Click the "Delete" button on the modal.
+
+> Removing a security agent from a team will not uninstall the agent from the existing host(s).
+
+### Manage security agents with the REST API
+
+Fleet also provides a REST API for managing software programmatically. The API allows you to add, update, retrieve, list, and delete software. Detailed documentation on Fleet's [REST API is available](https://fleetdm.com/docs/rest-api/rest-api#software).
+
+### Manage security agents with GitOps
+
+Installers for security agents can be managed via `fleetctl` using [GitOps](https://fleetdm.com/docs/using-fleet/gitops).
+
+Please refer to the documentation specific to [managing software with GitOps](https://fleetdm.com/docs/using-fleet/gitops#software). For a real-world example, [see how we manage software at Fleet](https://github.com/fleetdm/fleet/tree/main/it-and-security/teams).
+
+
+## Conclusion
+
+Deploying security agents with Fleet is straightforward and ensures your hosts are protected with the latest security measures. This guide has shown you how to access, add, and install security agents, as well as manage them using the REST API and `fleetctl`. Following these steps can effectively equip your fleet with the necessary security tools.
+
+See Fleet's [documentation](https://fleetdm.com/docs/using-fleet) and additional [guides](https://fleetdm.com/guides) for more details on advanced setups, software features, and vulnerability detection.
+
+
+<meta name="articleTitle" value="Deploy security agents">
+<meta name="authorFullName" value="Roberto Dip">
+<meta name="authorGitHubUsername" value="roperzh">
+<meta name="category" value="guides">
+<meta name="publishedOn" value="2024-08-05">
+<meta name="articleImageUrl" value="../website/assets/images/articles/deploy-security-agents-1600x900@2x.png">
+<meta name="description" value="This guide will walk you through adding software to Fleet.">
diff --git a/articles/discovering-chrome-ai-using-fleet.md b/articles/discovering-chrome-ai-using-fleet.md
new file mode 100644
index 000000000000..72b73627d608
--- /dev/null
+++ b/articles/discovering-chrome-ai-using-fleet.md
@@ -0,0 +1,67 @@
+# Discovering Chrome AI using Fleet
+
+![Discovering Chrome AI using Fleet](../website/assets/images/articles/discovering-chrome-ai-using-fleet-1600x900@2x.jpg)
+
+# Discovering AI in Chrome with Fleet
+
+Staying ahead of technological innovations is crucial for individuals and organizations. Google Chrome, one of the most widely used web browsers, continually evolves to incorporate new features, including artificial intelligence (AI). This article will guide you through detecting if AI capabilities have been enabled in Chrome using Fleet.
+
+## Introduction to Chrome AI innovations
+
+Google Chrome has integrated AI to enhance user experience by providing intelligent suggestions, improving search results, and offering in-browser assistance. Visit the [Chrome AI Innovations page](https://www.google.com/chrome/ai-innovations/) for more infomration.
+
+## Using Fleet to detect AI features in Chrome
+
+Fleet, a comprehensive device management and security tool, allows you to monitor various aspects of your devices, including software configurations and enabled features. Using Fleet, you can detect whether AI features are enabled in Chrome by querying device settings, specifically in the Chrome "Preferences" JSON file.
+
+### Step 1: Understanding Chrome's preferences JSON file
+
+Chrome stores user settings and configurations in a JSON file at the following path:
+
+```
+/Users/<user>/Library/Application Support/Google/Chrome/Default/Preferences
+```
+
+### Step 2: Identifying AI-related settings
+
+AI-related features are stored in the `optimization_guide` section of the preferences. The `tab_organization_setting_state` field will tell you if AI-based tab management features are enabled:
+
+`> jq` is a lightweight and powerful command-line tool for parsing, filtering, and manipulating JSON data. It allows you to extract specific information from JSON files efficiently. In this case, we use `jq` to locate and read the value of the `tab_organization_setting_state` key within Chrome's preference file which will help us understand how to craft our Fleet query for reporting the state of this setting.
+
+- If enabled, the setting will return `1`.
+
+![Chrome settings UI with Chrome AI enabled](../website/assets/images/articles/discovering-chrome-ai-using-fleet-1-1472x370@2x.png)
+
+```
+% jq '.optimization_guide.tab_organization_setting_state'  /Users/<user>/Library/Application\ Support/Google/Chrome/Default/Preferences                                      
+1
+```
+
+- If disabled, the setting will return `2`.
+
+![Chrome settings UI with Chrome AI disabled](../website/assets/images/articles/discovering-chrome-ai-using-fleet-2-1474x276@2x.png)
+
+```
+% jq '.optimization_guide.tab_organization_setting_state'  /Users/<user>/Library/Application\ Support/Google/Chrome/Default/Preferences                                      
+2
+```
+
+### Step 3: Query the JSON file with Fleet
+
+To query the JSON file and detect AI features using Fleet, you can use the following SQL query:
+
+```
+SELECT fullkey,path FROM parse_json WHERE path LIKE '/Users/%/Library/Application Support/Google/Chrome/Default/Preferences' AND fullkey='optimization_guide/tab_organization_setting_state';
+```
+
+### Conclusion
+
+Following this guide, you've learned to detect whether AI features are enabled in Google Chrome using Fleet. Fleet's powerful querying abilities allow you to monitor these features across multiple devices, ensuring your organization's preferences and practices align.
+
+<meta name="articleTitle" value="Discovering Chrome AI using Fleet">
+<meta name="authorFullName" value="Brock Walters">
+<meta name="authorGitHubUsername" value="nonpunctual">
+<meta name="category" value="guides">
+<meta name="publishedOn" value="2024-09-06">
+<meta name="articleImageUrl" value="../website/assets/images/articles/discovering-chrome-ai-using-fleet-1600x900@2x.jpg">
+<meta name="description" value="Use Fleet to detect and monitor settings enabled in Google Chrome by querying Chrome's preferences JSON file.">
diff --git a/docs/Using Fleet/downgrading-fleet.md b/articles/downgrade-fleet.md
similarity index 87%
rename from docs/Using Fleet/downgrading-fleet.md
rename to articles/downgrade-fleet.md
index 34f8fd04ff9a..0874e27c6603 100644
--- a/docs/Using Fleet/downgrading-fleet.md	
+++ b/articles/downgrade-fleet.md
@@ -1,4 +1,4 @@
-# Downgrading from Fleet Premium
+# Downgrade from Fleet Premium
 
 Follow these steps to downgrade your Fleet instance from Fleet Premium.
 
@@ -34,8 +34,9 @@ Follow these steps to downgrade your Fleet instance from Fleet Premium.
 1. Remove your license key from your Fleet configuration. Documentation on where the license key is located in your configuration is [here](https://fleetdm.com/docs/deploying/configuration#license).
 2. Restart your Fleet server.
 
-
-
-<meta name="title" value="Downgrading Fleet">
-<meta name="navSection" value="Dig deeper">
-<meta name="pageOrderInSection" value="2000">
\ No newline at end of file
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="eashaw">
+<meta name="authorFullName" value="Eric Shaw">
+<meta name="publishedOn" value="2024-01-09">
+<meta name="articleTitle" value="Downgrade from Fleet Premium">
+<meta name="description" value="Learn how to downgrade from Fleet Premium.">
\ No newline at end of file
diff --git a/docs/Using Fleet/MDM-disk-encryption.md b/articles/enforce-disk-encryption.md
similarity index 76%
rename from docs/Using Fleet/MDM-disk-encryption.md
rename to articles/enforce-disk-encryption.md
index 8d8278763f5b..8dd2b6419ff5 100644
--- a/docs/Using Fleet/MDM-disk-encryption.md	
+++ b/articles/enforce-disk-encryption.md
@@ -1,4 +1,4 @@
-# Disk encryption
+# Enforce disk encryption
 
 _Available in Fleet Premium_
 
@@ -8,7 +8,9 @@ In Fleet, you can enforce disk encryption for your macOS and Windows hosts.
 
 When disk encryption is enforced, hosts’ disk encryption keys will be stored in Fleet.
 
-For Windows hosts, disk encryption is enforced on the C: volume (default system/OS drive).
+For macOS hosts that automatically enroll, disk encryption is enforced during Setup Assistant.
+
+For Windows, disk encryption is enforced on the C: volume (default system/OS drive).
 
 ## Enforce disk encryption
 
@@ -54,15 +56,13 @@ How to view the disk encryption key:
 
 ## Migrate macOS hosts
 
-When migrating macOS hosts another MDM solution, in order to complete the process of encrypting the hard drive and escrowing the key in Fleet, your end users must take action. 
-
-If the host already had disk encryption turned on, the user will need to input their password. 
-
-If the host did not already have disk encryption turned on, the user will need to log out or restart their computer.
+When migrating macOS hosts from another MDM solution, in order to complete the process of encrypting the hard drive and escrowing the key in Fleet, your end users must log out or restart their device.
 
-Share [these guided instructions](./MDM-migration-guide.md#how-to-turn-on-disk-encryption) with your end users.
+Share [these guided instructions](https://fleetdm.com/guides/mdm-migration#how-to-turn-on-disk-encryption) with your end users.
 
-<meta name="pageOrderInSection" value="1504">
-<meta name="title" value="Disk encryption">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-08-14">
+<meta name="articleTitle" value="Enforce disk encryption">
 <meta name="description" value="Learn how to enforce disk encryption on macOS and Windows hosts and manage encryption keys with Fleet Premium.">
-<meta name="navSection" value="Device management">
diff --git a/docs/Using Fleet/MDM-OS-updates.md b/articles/enforce-os-updates.md
similarity index 65%
rename from docs/Using Fleet/MDM-OS-updates.md
rename to articles/enforce-os-updates.md
index 6986593c764e..3db4862a8768 100644
--- a/docs/Using Fleet/MDM-OS-updates.md	
+++ b/articles/enforce-os-updates.md
@@ -1,18 +1,14 @@
-# OS updates
+# Enforce OS updates
 
 _Available in Fleet Premium_
 
-In Fleet you can enforce OS updates on your macOS and Windows hosts remotely.
-
-## Enforce OS updates
-
-You can enforce OS updates using the Fleet UI, Fleet API, or [Fleet's GitOps workflow](https://github.com/fleetdm/fleet-gitops).
+In Fleet you can enforce OS updates on your macOS, Windows, iOS, and iPadOS hosts remotely using the Fleet UI, Fleet API, or [Fleet's GitOps workflow](https://github.com/fleetdm/fleet-gitops).
 
 Fleet UI:
 
 1. Head to the **Controls** > **OS updates** tab.
 
-2. To enforce OS updates for macOS, select **macOS** and set a **Minimum version** and **Deadline**.
+2. To enforce OS updates for macOS, iOS, or iPadOS, select the platform and set a **Minimum version** and **Deadline**.
 
 3. For Windows, select **Windows** and set a **Deadline** and **Grace period**.
 
@@ -26,6 +22,10 @@ When a minimum version is enforced, the end users see a native macOS notificatio
 
 If the host was turned off when the deadline passed, the update will be scheduled an hour after it’s turned on.
 
+For macOS devices that use Automated Device Enrollment (ADE), if the device is below the specified
+minimum version, it will be required to update to the very latest OS version during ADE before
+device setup and enrollment can proceed.
+
 ### macOS (below version 14.0)
 
 End users are encouraged to update macOS (via [Nudge](https://github.com/macadmins/nudge)).
@@ -38,6 +38,11 @@ End users are encouraged to update macOS (via [Nudge](https://github.com/macadmi
 | End user can defer                   | ✅                      | ✅                      | ❌                    |
 | Nudge window is dismissible          | ✅                      | ✅                      | ❌                    |
 
+### iOS and iPadOS (version 17.0 and above)
+
+For iOS and iPadOS devices that use Automated Device Enrollment (ADE), if the device is below the specified
+minimum version, it will be required to update to the very latest OS version during ADE before device setup and enrollment can proceed.
+
 ### Windows
 
 End users are encouraged to update Windows via the native Windows dialog.
@@ -50,7 +55,13 @@ If an end user was on vacation when the deadline passed, the end user is given a
 
 Fleet enforces OS updates for quality and feature updates. Read more about the types of Windows OS updates in the Microsoft documentation [here](https://learn.microsoft.com/en-us/windows/deployment/update/get-started-updates-channels-tools#types-of-updates).
 
-<meta name="pageOrderInSection" value="1503">
-<meta name="title" value="OS updates">
-<meta name="description" value="Learn how to manage OS updates on macOS and Windows devices.">
-<meta name="navSection" value="Device management">
+### iOS and iPadOS
+
+When a minimum version is enforced, end users will see a notification in their Notification Center after the deadline. They can’t use their iPhone or iPad until the OS update is installed.
+
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-08-10">
+<meta name="articleTitle" value="Enforce OS updates">
+<meta name="description" value="Learn how to manage OS updates on macOS, Windows, iOS, and iPadOS devices.">
diff --git a/articles/enhancing-k-12-cybersecurity-with-fcc-funds-and-fleet.md b/articles/enhancing-k-12-cybersecurity-with-fcc-funds-and-fleet.md
new file mode 100644
index 000000000000..92a32aa05bab
--- /dev/null
+++ b/articles/enhancing-k-12-cybersecurity-with-fcc-funds-and-fleet.md
@@ -0,0 +1,48 @@
+# Enhancing K-12 cybersecurity with FCC funds and Fleet
+
+![Enhancing K-12 cybersecurity with FCC funds and Fleet](../website/assets/images/articles/enhancing-k-12-cybersecurity-with-fcc-funds-and-fleet-1600x900@2x.png)
+
+The digital landscape in K-12 education is evolving rapidly, and with this transformation comes the critical need to safeguard school networks and data. The new [Federal Communications Commission (FCC) schools and libraries cybersecurity pilot program](https://www.fcc.gov/cybersecurity-pilot-program) offers a significant opportunity for schools to enhance their cybersecurity infrastructure. One of the most effective ways to utilize these funds is by investing in Fleet, an open-source endpoint visibility platform designed to improve endpoint protection, identity protection and authentication, and monitoring, detection, and response.
+
+
+## A real threat
+
+Did you know that [K-12 schools are now the top target for ransomware attacks](https://www.forbes.com/sites/frederickhess/2023/09/20/the-top-target-for-ransomware-its-now-k-12-schools/)? This startling reality is impacting educational institutions nationwide. Imagine a typical school day disrupted by a malicious cyber attack, compromising sensitive student and staff data. This is not just a hypothetical scenario; it’s happening more frequently than ever before. 
+
+For instance, in a recent incident covered by [NPR](https://www.npr.org/2024/03/11/1236995412/cybersecurity-hackers-schools-ransomware), a school district in Toledo, Ohio, was paralyzed by a ransomware attack that locked teachers out of their computers and halted online classes for over a week. This real-world example underscores the urgency of bolstering cybersecurity measures. That's why the FCC's new cybersecurity pilot program couldn't have arrived sooner.
+
+
+## Endpoint protection
+
+Endpoint protection is paramount in a school environment where numerous devices connect to the network daily. Fleet provides comprehensive endpoint security by ensuring all devices are accounted for and secure. Schools can deploy Fleet to monitor laptops, desktops, and mobile devices used by students, teachers, and administrative staff. This visibility allows security teams to detect and mitigate threats in real time, preventing potential breaches. Software vulnerabilities are captured and prioritized for remediation using multiple popular scoring mechanisms. Fleet’s MDM (Mobile Device Management) features can remediate the highest-risk vulnerabilities. FCC funds can cover the costs of deploying and maintaining Fleet, ensuring that all endpoints are continuously monitored and protected against malicious activities.
+
+
+## Identity protection and authentication
+
+Identity protection and authentication are crucial in preventing unauthorized access to sensitive information. Fleet integrates seamlessly with existing identity management systems to enhance security measures. By using Fleet, schools can implement zero trust architectures leveraging Fleet’s device health capabilities leverage osquery. This integration ensures that only devices with approved security postures can access the school’s network and resources. With financial support from the FCC program, schools can invest in the necessary infrastructure to support these advanced authentication methods, thereby significantly reducing the risk of unauthorized access.
+
+
+## Monitoring, detection, and response
+
+Effective cybersecurity is about prevention and the ability to monitor, detect, and respond to incidents swiftly. Fleet excels in providing real-time monitoring and detection capabilities. It enables security teams to set up alerts for suspicious activities and promptly investigate potential threats. This proactive approach is essential for minimizing the impact of security incidents. The FCC funds can be allocated to train staff to use Fleet’s features effectively and establish a robust detection platform and incident response plan. This ensures that schools are not only protected but are also prepared to handle cybersecurity incidents efficiently.
+
+
+## Applying
+
+Eligible schools, libraries, and consortia should follow a two-part application process to apply for the FCC Schools and Libraries Cybersecurity Pilot Program, which will be opened by the FCC this Fall, 2024. First, applicants submit general information and details about the proposed cybersecurity project. Second, selected participants provide more detailed cybersecurity information. The FCC will announce selected participants via a public notice, who will then proceed with competitive bidding and reimbursement requests. For detailed instructions, visit the [FCC Cybersecurity Pilot Program page](https://www.fcc.gov/cybersecurity-pilot-program).
+
+
+## Conclusion
+
+The FCC Schools and Libraries Cybersecurity Pilot Program is a game-changer for K-12 schools looking to bolster their cybersecurity defenses. By investing in Fleet, schools can achieve comprehensive endpoint protection, enhance identity protection and authentication, and improve their monitoring, detection, and response capabilities. This strategic use of funds will ensure that schools can provide a safe and secure digital learning environment for all students and staff, safeguarding their data and maintaining the integrity of their educational programs.
+
+
+ 
+
+
+<meta name="category" value="announcements">
+<meta name="authorFullName" value="Alex Mitchell">
+<meta name="authorGitHubUsername" value="alexmitchelliii">
+<meta name="publishedOn" value="2024-07-25">
+<meta name="articleTitle" value="Enhancing K-12 cybersecurity with FCC funds and Fleet">
+<meta name="articleImageUrl" value="../website/assets/images/articles/enhancing-k-12-cybersecurity-with-fcc-funds-and-fleet-1600x900@2x.png">
diff --git a/docs/Using Fleet/enroll-hosts.md b/articles/enroll-hosts.md
similarity index 95%
rename from docs/Using Fleet/enroll-hosts.md
rename to articles/enroll-hosts.md
index 952383ec57f0..0635855596ab 100644
--- a/docs/Using Fleet/enroll-hosts.md	
+++ b/articles/enroll-hosts.md
@@ -1,7 +1,5 @@
 # Enroll hosts
 
-## Introduction
-
 Fleet gathers information from an [osquery](https://github.com/osquery/osquery) agent installed on each of your hosts. The recommended way to install osquery is using fleetd.
 
 You can enroll macOS, Windows or Linux hosts via the [CLI](#cli) or [UI](#ui). To learn how to enroll Chromebooks, see [Enroll Chromebooks](#enroll-chromebooks).
@@ -12,11 +10,11 @@ Fleet supports the [latest version of osquery](https://github.com/osquery/osquer
 
 ## CLI
 
-> You must have `fleetctl` installed. [Learn how to install `fleetctl`](https://fleetdm.com/fleetctl-preview).
+> You must have `fleetctl` installed. [Learn how to install `fleetctl`](https://fleetdm.com/docs/using-fleet/fleetctl-cli#installing-fleetctl).
 
-The `fleetctl package` command is used to generate Fleet's agent (fleetd).
+The `fleetctl package` command is used to generate Fleet's agent (fleetd) install package..
 
-The `--type` flag is used to specify the fleetd installer type:
+The `--type` flag is used to specify the fleetd installer type. Note that Windows can only generate an MSI package:
 - macOS: .pkg
 - Windows: .msi
 - Linux: .deb or .rpm
@@ -39,7 +37,7 @@ To generate Fleet's agent (fleetd) in Fleet UI:
 
 1. Go to the **Hosts** page, and select **Add hosts**.
 2. Select the tab for your desired platform (e.g. macOS).
-3. A CLI command with all necessary flags will be generated. Copy and run the command with [fleetctl](https://fleetdm.com/docs/using-fleet/fleetctl-cli) installed.
+3. A CLI command with all necessary flags to generate an install package will be generated. Copy and run the command with [fleetctl](https://fleetdm.com/docs/using-fleet/fleetctl-cli) installed.
 
 ### Enroll host to a specific team
 
@@ -54,7 +52,7 @@ You can use your software management tool of choice to distribute Fleet's agent
 
 ### Fleet Desktop
 
-[Fleet Desktop](./Fleet-desktop.md) is a menu bar icon available on macOS, Windows, and Linux that gives your end users visibility into the security posture of their machine.
+[Fleet Desktop](https://fleetdm.com/guides/fleet-desktop) is a menu bar icon available on macOS, Windows, and Linux that gives your end users visibility into the security posture of their machine.
 
 You can include Fleet Desktop in Fleet's agent (fleetd) by including `--fleet-desktop` in the `fleetctl package` command.
 
@@ -379,6 +377,9 @@ but can result in a large volume of error logs. In fleetd v1.15.1, we added an e
 Applying the environmental variable `"FLEETD_SILENCE_ENROLL_ERROR"=1` on a host will silence fleetd enrollment errors if a `--fleet-url` is not present.
 This variable is read at launch and will require a restart of the Orbit service if it is not set before installing `fleetd` v1.15.1.
 
-<meta name="pageOrderInSection" value="500">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-08-08">
+<meta name="articleTitle" value="Enroll hosts">
 <meta name="description" value="Learn how to enroll hosts to Fleet.">
-<meta name="navSection" value="The basics">
diff --git a/articles/filtering-software-by-vulnerability.md b/articles/filtering-software-by-vulnerability.md
new file mode 100644
index 000000000000..8c8326bbc690
--- /dev/null
+++ b/articles/filtering-software-by-vulnerability.md
@@ -0,0 +1,44 @@
+# Filtering software by vulnerability in Fleet
+
+![Filtering software by vulnerability in Fleet](../website/assets/images/articles/discovering-geacon-using-fleet-1600x900@2x.jpg)
+
+## Introduction
+
+Fleet has introduced a powerful new feature that allows you to filter software by its associated vulnerabilities, helping you prioritize patches more effectively. Whether you're managing hundreds or thousands of software titles, this feature makes it easier to identify and address the most critical vulnerabilities in your environment.
+
+This filtering capability is particularly useful in environments where patch management is critical to your security posture. By filtering software based on vulnerability severity and known exploits, you can first ensure that the most critical issues are addressed, enhancing your overall security strategy.
+
+## Prerequisites
+
+* Fleet version 4.56 or later
+* Premium users have access to advanced filters by severity level and known exploited vulnerabilities
+
+### Filtering Software by Vulnerability
+
+1. **Navigate to the Software page**: In your Fleet dashboard, go to the **Software** tab. This will display a list of all the software detected in your environment.
+
+2. **Add filters**: Click on the **Add Filters** button. This will open options for filtering the software list based on specific criteria.
+
+3. **Choose severity level**: From the dropdown menu, select the **Severity level** of vulnerabilities you're interested in. This allows you to focus on software with the highest severity of vulnerabilities, such as "Critical" or "High."
+
+4. **Toggle "Has known exploit"**: You can refine your filter by toggling the **Has known exploit** option. This will filter the software list to show only those with vulnerabilities that have known exploits, enabling you to prioritize these for patching.
+
+5. **Review filtered results**: Once you've applied your filters, the software list will update to show only the software that meets your criteria. This filtered view will help you prioritize which software needs immediate attention in your patching strategy.
+
+### Using the REST API to filter software for vulnerabilities
+
+Fleet provides a REST API to filter software for vulnerabilities, allowing you to integrate this functionality into your automated workflows. Learn more about Fleet's [REST API](https://fleetdm.com/docs/rest-api/rest-api#vulnerabilities).
+
+## Conclusion
+
+The new software filtering feature in Fleet makes it easier than ever to manage vulnerabilities in your software environment. You can better protect your organization from potential threats by prioritizing patches based on severity and known exploits. Explore the API capabilities to integrate this feature into your broader security workflows.
+
+For more tips and detailed guides, don’t forget to check out the Fleet [documentation](https://fleetdm.com/docs/get-started/why-fleet).
+
+<meta name="articleTitle" value="Filtering software by vulnerability in Fleet">
+<meta name="authorFullName" value="Tim Lee">
+<meta name="authorGitHubUsername" value="mostlikelee">
+<meta name="category" value="guides">
+<meta name="publishedOn" value="2024-08-30">
+<meta name="articleImageUrl" value="../website/assets/images/articles/discovering-geacon-using-fleet-1600x900@2x.jpg">
+<meta name="description" value="Filter software by vulnerability in Fleet to prioritize critical patches and enhance your organization's security posture.">
diff --git a/articles/fleet-4.54.0.md b/articles/fleet-4.54.0.md
new file mode 100644
index 000000000000..798090428f69
--- /dev/null
+++ b/articles/fleet-4.54.0.md
@@ -0,0 +1,129 @@
+# Fleet 4.54.0 | Target hosts via label exclusion, arm64 support, script execution time.
+
+![Fleet 4.54.0](../website/assets/images/articles/fleet-4.54.0-1600x900@2x.png)
+
+Fleet 4.54.0 is live. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.54.0) or continue reading to get the highlights.
+For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs.
+
+## Highlights
+
+* Target hosts via label exclusion
+* Remote script execution time
+
+### Target hosts via label exclusion
+
+Fleet has enhanced its targeting capabilities by adding support for excluding specific labels when managing and deploying configuration profiles to hosts. This feature allows administrators to precisely control which devices are affected by particular settings or policies by excluding hosts that match specified labels. For instance, if an organization has a group of conference room computers that should not receive a particular configuration, administrators can now easily exclude these devices by applying the relevant label exclusions. This added granularity ensures more accurate and tailored management of devices, reducing the risk of unintended changes and enhancing overall operational efficiency. By allowing the exclusion of any label when targeting hosts, Fleet demonstrates its commitment to providing flexible, user-centric solutions that cater to the nuanced needs of modern IT environments.
+
+### Remote script execution time
+
+Fleet has increased the timeout limit for remote script execution, significantly enhancing its capabilities for deploying software updates and managing complex workflows. This extension allows administrators to run longer, more intricate scripts without interruption, facilitating tasks such as deploying software updates through tools like Homebrew, Installomator, and Chocolatey. Additionally, this update supports extensive log gathering operations and workflows that involve moving data in either direction, making it ideal for comprehensive maintenance and configuration activities. By extending the timeout limit, Fleet ensures that IT teams can execute more demanding tasks efficiently, improving overall operational effectiveness and flexibility. This enhancement reflects Fleet's commitment to providing robust and adaptable solutions that meet the evolving needs of modern IT environments.
+
+## Changes
+
+### Endpoint Operations
+
+- Updated `fleetctl gitops` to be used to rename teams.
+  - **NOTE:** `fleetctl gitops` needs to have previously run with this Fleet/fleetctl version or later.
+  - The team name is changed if the YAML config is applied from the same filename as before.
+- Updated `fleetctl query --hosts` to work with hostnames, host UUIDs, and/or hardware serial numbers.
+- Added a host's upcoming scheduled maintenance window, if any, on the host details page of the UI and in host responses from the API.
+- Added support to `fleetctl debug connection` to test TLS connection with the embedded certs.pem in
+  the fleetctl executable.
+- Added host's display name to calendar event descriptions.
+- Added .yml and .yaml file type validation and error message to `fleetctl apply`.
+- Added a tooltip to truncated text and not to untruncated values.
+
+### Device Management (MDM)
+
+- Added iOS/iPadOS builtin manual labels. 
+  - **NOTE:** Before migrating to this version, make sure to delete any labels with name "iOS" or "iPadOS".
+- Added aggregation of iOS/iPadOS OS versions.
+- Added change to custom profiles for iOS/iPadOS to go from 'pending' straight to 'verified' (skip 'verifying').
+- Added support for renewing SCEP certificates with custom enrollment profiles.
+- Added automatic install of `fleetd` when a host turns on MDM now uses the latest released `fleetd` version.
+- Added support for `END_USER_EMAIL` and `FLEET_DESKTOP` parameters to Windows MSI install package.
+- Added API changes to support the `labels_include_all` and `labels_exclude_any` fields (and accept the deprecated `labels` field as an alias for `labels_include_all`).
+- Added `fleetctl gitops` and `fleetctl apply` support for `labels_include_all` and `labels_exclude_any` to configure a custom setting.
+- Added UI for uploading custom profiles with a target of hosts that include all/exclude any selected labels.
+- Added the database migrations to create the new `exclude` column for labels associated with MDM profiles (and declarations).
+- Updated host script timeouts to be configurable via agent options using `script_execution_timeout`. 
+- `fleetctl` now uses a polling mechanism when running `run-script` to accommodate longer script timeout values.
+- Updated the profile reconciliation logic to handle the new "exclude any" labels.
+- Updated so that the `fleetd` cleanup script for macOS that will return completed when run from Fleet.
+- Updated so that the `fleetd` uninstall script will return completed when run from Fleet.
+- Updated script run permissions -- only admins and maintainers can run arbitrary or saved scripts (not observer or observer+).
+- Updated `fleetctl get mdm_commands` to return 20 rows and support `--host` `--type` filters to improve response time.
+- Updated the instructions for manual MDM enrollment on the "My device" page to be clearer and align with Apple updates.
+- Updated UI to allow device users to reinstall self-service software.
+- Updated API to not return a 500 status code if a host sends a command response with an invalid command uuid.
+- Increased the timeout of the upload software installer endpoint to 4 minutes.
+- Disabled credential caching and reboot on Windows lock.
+
+### Vulnerability Management
+
+- Added "Vulnerable" filter to the host details software table.
+- Fixed Microsoft Office June 2024 false negative vulnerabilities and added custom vulnerability matching.
+- Fixed issue where some Windows applications were getting matched against Windows OS vulnerabilities.
+
+### Bug fixes and improvements
+
+- Updated Go version to go1.22.4.
+- Updated to render only one banner on the my device page based on priority order.
+- Updated software updated timestamp tooltip.
+- Removed DB error message from the UI when showing a error response.
+- Updated fleetctl get queries/labels/hosts descriptions.
+- Reinstated ability to sort policies by passing count.
+- Improved the accuracy of the heuristic used to deterimine if a host is connected to Fleet via MDM by using osquery data for hosts that didn't send a Checkout message.
+- Improved the matching of `pkg` installer files to existing software.
+- Improved extraction of application name from `pkg` installers.
+- Clarified various help and error texts around host identifiers.
+- Hid CTA on inherited queries/policies from team level users.
+- Hid query delete checkboxes from team observers.
+- Hid "Self-service" in Fleet Desktop and My device page if there is no self-service software available.
+- Hid the host detail page's "Run script" action from Global and Team Observer/+s.
+- Aligned the "View all hosts" links in the Software titles and versions tables.
+- Fixed counts for hosts with with low disk space in summary page.
+- Fixed allowing Observer and Observer+ roles to download software installers.
+- Fixed crash in `fleetd` installer on Windows if there are registry keys with special characters on the system.
+- Fixed `fleetctl debug connection` to support server TLS certificates with intermediates.
+- Fixed macOS declarations being stuck in "to be removed" state indefinitely.
+- Fixed link to `fleetd` uninstall instructions in "Delete device" modal.
+- Fixed exporting CSVs with fields that contain commas to render properly.
+- Fixed issue where the Fleet UI could not be used to renew the ABM token after the ABM user who created the token was deleted.
+- Fixed styling issues with the target inputs loading spinner on the run live query/policy page.
+- Fixed an issue where special characters in HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall breaks the "installer_utils.ps1 -uninstallOrbit" step in the Windows MSI installer.
+- Fixed a bug causing "No Team" OS versions to display the wrong number.
+- Fixed various UI capitalizations.
+- Fixed UI issue where "Script is already running" tooltip incorrectly displayed when the script is not running.
+- Fixed the script details modal's error message on script timeout to reflect the newly dynamic script timeout limit, if hit.
+- Fixed a discrepancy in the spacing between DataSet labels and values on Firefox relative to other browsers.
+- Fixed bug that set `Added to Fleet` to `Never` after macOS hosts re-enrolled to Fleet via MDM. 
+
+## Fleet 4.53.1 (Jul 01, 2024)
+
+### Bug fixes
+
+* Updated fleetctl get queries/labels/hosts descriptions.
+* Fixed exporting CSVs with fields that contain commas to render properly.
+* Fixed link to fleetd uninstall instructions in "Delete device" modal.
+* Rendered only one banner on the my device page based on priority order.
+* Hidden query delete checkboxes from team observers.
+* Fixed issue where the Fleet UI could not be used to renew the ABM token after the ABM user who created the token was deleted.
+* Fixed an issue where special characters in HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall broke the "installer_utils.ps1 -uninstallOrbit" step in the Windows MSI installer.
+* Fixed counts for hosts with low disk space in summary page.
+* Fleet UI fixes: Hide CTA on inherited queries/policies from team level users.
+* Updated software updated timestamp tooltip.
+* Fixed issue where some Windows applications were getting matched against Windows OS vulnerabilities.
+* Fixed crash in `fleetd` installer on Windows if there are registry keys with special characters on the system.
+* Fixed UI capitalizations.
+
+## Ready to upgrade?
+
+Visit our [Upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs for instructions on updating to Fleet 4.54.0.
+
+<meta name="category" value="releases">
+<meta name="authorFullName" value="JD Strong">
+<meta name="authorGitHubUsername" value="spokanemac">
+<meta name="publishedOn" value="2024-07-17">
+<meta name="articleTitle" value="Fleet 4.54.0 | Target hosts via label exclusion, script execution time.">
+<meta name="articleImageUrl" value="../website/assets/images/articles/fleet-4.54.0-1600x900@2x.png">
diff --git a/articles/fleet-4.55.0.md b/articles/fleet-4.55.0.md
new file mode 100644
index 000000000000..24e4a416a535
--- /dev/null
+++ b/articles/fleet-4.55.0.md
@@ -0,0 +1,132 @@
+# Fleet 4.55.0 | MySQL 8, arm64 support, FileVault improvements, VPP support.
+
+![Fleet 4.55.0](../website/assets/images/articles/fleet-4.55.0-1600x900@2x.png)
+
+Fleet 4.55.0 is live. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.55.0) or continue reading to get the highlights.
+For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs.
+
+## Highlights
+
+* MySQL 8 support, MySQL 5.7 sunsets
+* FileVault key rotation with Escrow Buddy
+* FileVault enforcement at enrollment
+* Arm64 support
+* VPP app support for macOS
+* "No team" software support
+
+### MySQL 8 support, MySQL 5.7 sunsets
+
+Fleet has updated its database compatibility by adding support for MySQL 8, while simultaneously dropping support for MySQL 5.7. This change aligns Fleet with the latest advancements in database technology, offering enhanced performance, security, and features available in MySQL 8. Organizations using Fleet are encouraged to upgrade their database systems to MySQL 8 to take full advantage of these improvements. By focusing on the latest supported versions, Fleet ensures that its platform remains robust, secure, and well-equipped to handle the demands of modern IT environments while phasing out older versions that may not provide the same level of performance or security.
+
+### FileVault key rotation with Escrow Buddy
+
+Fleet now includes support for FileVault key rotation using [Escrow Buddy](https://github.com/macadmins/escrow-buddy), a tool developed by the Netflix Client Systems Engineering team for the MacAdmins community to securely manage and rotate FileVault recovery keys on macOS devices. This feature allows IT administrators to automate the process of rotating FileVault keys, ensuring that encrypted macOS hosts remain secure while maintaining access control. By integrating with Escrow Buddy, Fleet enables seamless key management, reducing the administrative burden of manually rotating keys and enhancing the overall security posture of macOS environments. This update reflects Fleet's commitment to providing robust security tools that integrate with trusted community resources, ensuring organizations can efficiently manage device encryption and recovery processes.
+
+### FileVault enforcement at enrollment
+
+Fleet now supports enforcing FileVault encryption during the enrollment process for macOS devices, ensuring that all newly enrolled Macs are automatically encrypted. This feature enhances security by mandating that FileVault is enabled as part of the initial device setup, reducing the risk of unencrypted data on managed endpoints. By integrating FileVault enforcement into the enrollment workflow, Fleet helps organizations maintain a consistent security posture across their macOS fleet, ensuring compliance with internal policies and regulatory requirements. This update underscores Fleet's commitment to providing comprehensive security management tools that protect sensitive data and simplify the administration of macOS devices.
+
+### Arm64 support
+
+Fleet now includes support for Linux hosts running on the arm64 architecture. This update enables organizations to integrate a broader range of devices into their Fleet management system, ensuring comprehensive oversight and control across diverse hardware environments. By supporting arm64 Linux hosts, Fleet caters to the growing use of ARM-based systems in various sectors, allowing IT administrators to manage these devices with the same level of detail and efficiency as traditional x86-based hosts. This aligns with Fleet's commitment to providing versatile and inclusive device management solutions, empowering users to maintain a unified and efficient IT infrastructure.
+
+### VPP app support for macOS
+
+Fleet now supports installing Volume Purchase Program (VPP) apps from the Apple App Store on macOS devices. This feature enables IT administrators to deploy and manage apps purchased through Apple's VPP directly to macOS hosts, streamlining the process of distributing essential software across the organization. By integrating VPP app installations into Fleet, organizations can ensure that licensed applications are efficiently deployed to the appropriate devices, improving software management and compliance. This update enhances Fleet's capabilities in managing macOS environments, offering a more seamless and centralized approach to app distribution for enterprise and educational settings.
+
+### "No team" software support
+
+Fleet now supports adding software to the "No team" team, providing greater flexibility in managing software across an organization's devices. This feature allows administrators to deploy and manage software that applies universally without being restricted to specific teams. By adding software to the "No team" team, IT teams can ensure that essential tools and applications are available across all devices, regardless of their team assignment. This update simplifies the management of widely used software and enhances the ability to maintain consistency and compliance across the entire fleet. It reflects Fleet's commitment to offering versatile solutions that cater to diverse organizational needs and streamline device management processes.
+
+## Changes
+
+**NOTE:** Beginning with v4.55.0, Fleet no longer supports MySQL 5.7 because it has reached [end of life](https://mattermost.com/blog/mysql-5-7-reached-eol-upgrade-to-mysql-8-x-today/#:~:text=In%20October%202023%2C%20MySQL%205.7,to%20upgrade%20to%20MySQL%208.). The minimum version supported is MySQL 8.0.
+
+### Endpoint Operations
+
+- Added support for generating `fleetd` packages for Linux ARM64.
+- Added new `fleetctl package` --arch flag.
+- Updated `fleetctl package` command to remove the `--version` flag. The version of the package can be controlled by `--orbit-channel` flag.
+- Updated maintenance window descriptions to update regularly to match the failing policy description/resolution.
+- Updated maintenance windows using Google Calendar so that calendar events are now recreated within 30 seconds if deleted or moved to the past.
+  - Fleet server watches for potential changes for up to 1 week after original event time. If event is moved forward more than 1 week, then after 1 week Fleet server will check for event changes once every 30 minutes.
+  - **NOTE:** These near real-time updates may add additional load to the Google Calendar API, so it is recommended to use API usage alerts or other monitoring methods.
+
+### Device Management
+
+- Integrated [Escrow Buddy](https://github.com/macadmins/escrow-buddy) to add enforcement of FileVault during the MacOS Setup Assistant process for hosts that are 
+enrolled into teams (or no team) with disk encryption turned on. Thank you homebysix and team!
+- Added OS updates support to iOS/iPadOS devices.
+- Added iOS and iPadOS device details refetch triggered with the existing `POST /api/latest/fleet/hosts/:id/refetch` endpoint.
+- Added iOS and iPadOS user-installed apps to Fleet.
+- Added iOS and iPadOS apps to be installed using Apple's VPP (Volume Purchase Program) to Fleet.
+- Added support for VPP to GitOps.
+- Added the `POST /mdm/apple/vpp_token`, `DELETE /mdm/apple/vpp_token` and `GET /vpp` endpoints and related functionality.
+- Added new `GET /software/app_store_apps` and `POST /software/app_store_apps` endpoints and associated functionality.
+- Added the associated VPP apps to the `GET /software/titles` and `GET /software/titles/:id` endpoints.
+- Added the associated VPP apps to the `GET /hosts/:id/software` and `GET /device/:token/software` endpoints.
+- Added support to delete a VPP app from a team in `DELETE /software/titles/:software_title_id/available_for_install`.
+- Added `exclude_software` query parameter to "Get host by identifier" API.
+- Added ability to add/remove/disable apps with VPP in the Fleet UI.
+- Added a warning banner to the UI if the uploaded VPP token is about to expire/has expired.
+- Added UI updates for VPP feature on host software and my device pages.
+- Added global activity support for VPP-related activities.
+- Added UI features for managing VPP apps for iPadOS and iOS hosts.
+- Updated profile activities to include iOS and iPadOS.
+- Updated Fleet UI to show OS version compliance on host details page.
+- Added support for "No teams" on all software pages including adding software installers.
+- Added DB migration to support VPP software features.
+- Added DB migration to migrate older team configurations to the new version that includes both installers and App Store apps.
+- Linux lock/unlock scripts now make use of pam_nologin to keep AD users locked out.
+- Installed software list now includes Linux .deb packages that are 'on hold'.
+- Added a special-case to properly name the Notion .exe Windows installer the same as how it will be reported by osquery post-install.
+- Increased threshold to renew Apple SCEP certificates for MDM enrollments to 180 days.
+
+### Vulnerability Management
+
+- Fixed CVEs identified as 'Rejected' in NVD not matching against software.
+- Fixed false negative vulnerabilities with IntelliJ IDEA CE and PyCharm CE installed via Homebrew.
+
+### Bug fixes and improvements
+
+- Dropped support for MySQL 5.7 and raised minimum required to MySQL 8.0.36.
+- Updated software pre-install to use new GitOps format for query.
+- Updated UI tooltips for pending OS settings.
+- Added a migration to migrate older team configurations to the new version that includes both installers and App Store apps.
+- Fixed a styling issue in the controls > OS settings > disk encryption table.
+- Fixed a bug in `fleetctl preview` that was causing it to fail if Docker was installed without support for the deprecated `docker-compose` CLI.
+- Fixed an issue where the app-wide warning banners were not showing on the initial page load.
+- Fixed a bug where the hosts page would sometimes allow excess pagination.
+- Fixed a bug where software install results could not be retrieved for deleted hosts in the activity feed.
+- Fixed path that was incorrect for the download software installer package endpoint `GET /software/titles/:software_title_id/package`.
+- Fixed a bug that set `last_enrolled_at` during orbit re-enrollment, which caused osquery enroll failures when `FLEET_OSQUERY_ENROLL_COOLDOWN` is set.
+- Fixed the "Available for install" filter in the host's software page so that installers that were requested to be installed on the host (regardless of installation status) also show up in the list.
+- Fixed a bug where Fleet google calendar events generated by Fleet <= 4.53.0 were not correctly processed by 4.54.0.
+- Fixed a bug in `fleetctl preview` that was causing it to fail if Docker was installed without support for the deprecated `docker-compose` CLI.
+- Fixed a bug where software install results could not be retrieved for deleted hosts in the activity feed.
+- Fixed a bug where a software installer (a package or a VPP app) that has been installed on a host still shows up as "Available for install" and can still be requested to be installed after the host is transferred to a different team without that installer (or after the installer is deleted).
+- Fixed the "Available for install" filter in the host's software page so that installers that were requested to be installed on the host (regardless of installation status) also show up in the list.
+
+## Fleet 4.54.1 (Jul 24, 2024)
+
+### Bug fixes
+- Fixed a startup bug by performing an early restart of orbit if an agent options setting has changed.
+- Implemented a small refactor of orbit subsystems.
+- Removed the `--version` flag from the `fleetctl package` command. The version of the package can now be controlled by the `--orbit-channel` flag.
+- Fixed a bug that set `last_enrolled_at` during orbit re-enrollment, which caused osquery enroll failures when `FLEET_OSQUERY_ENROLL_COOLDOWN` is set .
+- In `fleetctl package` command, removed the `--version` flag. The version of the package can be controlled by `--orbit-channel` flag.
+- Fixed a bug where Fleet google calendar events generated by Fleet <= 4.53.0 were not correctly processed by 4.54.0.
+- Re-enabled cached logins after windows Unlock.
+
+
+
+## Ready to upgrade?
+
+Visit our [Upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs for instructions on updating to Fleet 4.55.0.
+
+<meta name="category" value="releases">
+<meta name="authorFullName" value="JD Strong">
+<meta name="authorGitHubUsername" value="spokanemac">
+<meta name="publishedOn" value="2024-08-09">
+<meta name="articleTitle" value="Fleet 4.55.0 | MySQL 8, arm64 support, FileVault improvements, VPP support.">
+<meta name="articleImageUrl" value="../website/assets/images/articles/fleet-4.55.0-1600x900@2x.png">
diff --git a/articles/fleet-4.56.0.md b/articles/fleet-4.56.0.md
new file mode 100644
index 000000000000..158d78746851
--- /dev/null
+++ b/articles/fleet-4.56.0.md
@@ -0,0 +1,153 @@
+# Fleet 4.56.0 | Enhanced MDM migration, Exact CVE Search, and Self-Service VPP Apps.
+
+![Fleet 4.56.0](../website/assets/images/articles/fleet-4.56.0-1600x900@2x.png)
+
+Fleet 4.56.0 is live. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.56.0) or continue reading to get the highlights.
+For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs.
+
+## Highlights
+* Improved end-user MDM migration
+* Enforce minimum OS version for MDM enrollment
+* Exact match CVE search
+* Software vulnerabilities severity filter
+* Self-service VPP apps
+* Multiple ABM and VPP support
+
+
+### Improved end-user MDM migration
+
+Fleet has improved the end-user MDM migration workflow on macOS by enabling the migration of hosts manually enrolled in a third-party MDM over to Fleet MDM using the Fleet Desktop application. Previously, this capability was limited to hosts enrolled through Apple's Automated Device Enrollment (ADE), but with this update, manually enrolled hosts can now be seamlessly migrated to Fleet MDM. This feature is specifically available for macOS Sonoma devices (macOS 14 or greater). It makes the migration process more flexible and accessible for organizations looking to centralize their MDM management under Fleet. This enhancement simplifies the transition to Fleet MDM for a broader range of macOS devices, ensuring that all hosts can be managed consistently and securely.
+
+
+### Enforce minimum OS version for MDM enrollment
+
+Fleet now enforces a minimum operating system (OS) requirement for macOS devices before they can be enrolled into Fleet's MDM. This feature ensures that only devices running a specified minimum macOS version can be enrolled, helping organizations maintain a consistent security and compliance baseline across their fleet. By setting a minimum OS requirement, Fleet prevents older, potentially less secure macOS versions from being managed under its MDM, thereby reducing vulnerabilities and ensuring all enrolled devices meet the organization's standards. This update enhances Fleet's ability to enforce security policies from the outset, ensuring that all devices in the fleet are up-to-date and capable of supporting the latest security and management features.
+
+
+### Exact match CVE search
+
+Fleet has enhanced its CVE (Common Vulnerabilities and Exposures) search functionality by introducing exact match searching, allowing users to quickly and accurately find specific vulnerabilities across their fleet. This improvement ensures that security teams can pinpoint the exact CVE they are investigating without sifting through irrelevant results, streamlining the vulnerability management process. Additionally, Fleet provides better context in cases where no results are found, helping users understand why a particular CVE might not be present in their environment. This update improves the overall user experience in vulnerability management, making it easier to maintain security and compliance across all managed devices.
+
+
+### Software vulnerabilities severity filter
+
+Fleet has introduced improved filtering capabilities for vulnerable software, allowing users to filter vulnerabilities by severity level. This enhancement enables security teams to prioritize their response efforts by focusing on the most critical vulnerabilities, ensuring that the highest-risk issues are promptly addressed. By providing a straightforward and efficient way to filter vulnerable software based on severity, Fleet helps organizations streamline their vulnerability management processes, reducing the risk of security incidents. This update aligns with Fleet's commitment to providing powerful tools that enhance the efficiency and effectiveness of security operations across all managed devices.
+
+
+### Self-Service Apple App Store apps
+
+Fleet enables organizations to assign and install Apple App Store apps purchased through the Volume Purchase Program (VPP) directly via Self-Service using Fleet Desktop. This new feature allows IT administrators to make VPP-purchased apps available to end users seamlessly and flexibly. By integrating VPP app distribution into the Fleet Desktop Self-Service portal, organizations can streamline the deployment of essential software across their macOS devices, ensuring that users have easy access to the tools they need while maintaining control over software distribution. This update enhances the overall user experience and operational efficiency, empowering end users to install approved applications with minimal IT intervention.
+
+
+### Multiple Apple Business Manager and VPP support
+
+Fleet now enables administrators to add and manage multiple Apple Business Manager (ABM) and Volume Purchase Program (VPP) tokens within a single Fleet instance. This feature is designed for both Managed Service Providers (MSPs) and large enterprises, allowing them to create separate automatic enrollment and App Store app workflows for different clients or divisions, each with their own ABM and VPP tokens. Whether you’re managing devices for multiple customers or supporting large organizations with distinct divisions, this update simplifies the process of handling macOS, iOS, and iPadOS devices. With support for multiple ABM and VPP connections, Fleet streamlines software and device management across varied environments, providing a scalable solution for both MSPs and enterprises looking to centralize control while maintaining flexibility for different user groups.
+
+
+## Changes
+
+**NOTE:** Beginning with Fleet v4.55.0, Fleet no longer supports MySQL 5.7 because it has reached [end of life](https://mattermost.com/blog/mysql-5-7-reached-eol-upgrade-to-mysql-8-x-today/#:~:text=In%20October%202023%2C%20MySQL%205.7,to%20upgrade%20to%20MySQL%208.). The minimum version supported is MySQL 8.0.
+
+## Fleet 4.56.0 (Sep 7, 2024)
+
+### Endpoint operations
+
+- Added index to `query_results` DB table to speed up finding last query timestamp for a given query and host.
+- Added a link in the UI to the error message when a CSR can't be downloaded due to missing private key.
+- Added a disabled overlay to the Other Workflows modal on the policy page.
+- Improved performance of live queries to accommodate for higher volumes when utilizing zero-trust workflows.
+- Improved `fleetctl` gitops error message when trying to change team name to a team that already exists.
+
+### Device management
+
+- Added server support for multiple VPP tokens.
+- Added new endpoints and updated existing endpoints for managing multiple Apple Business Manager tokens.
+- Added support for S3 to store MDM bootstrap packages (uses the same bucket configuration as for software installers).
+- Added support to UI for self service VPP software.
+- Added backend and gitops support for self service VPP.
+- Added ability for MDM migrations if the host is manually enrolled to a 3rd party MDM.
+- Added an offline screen to the macOS MDM migration flow.
+- Added new ABM page to Fleet UI.
+- Added new VPP page to the fleet UI
+- Added support to track the Apple Business Manager "terms expired" API error per token, as well as a global flag that gets set as soon as one token has its terms expired.
+- Updated the instructions on "My device" for MDM migrations on pre-Sonoma macOS hosts.
+- Updated to allow multiple teams to be assigned to the same VPP Token.
+- Updated process so that deleting installed software or VPP app now makes it available for re-installation.
+- Updated to enforce minimum OS version settings during Apple Automated Device Enrollment (ADE).
+- Updated ABM ingestion so that deleted iOS/iPadOS host will continue to report to Fleet as long as host is in Apple Business Manager (ABM).
+- Updated so that refetching an offline iOS/iPadOS host will not add new MDM commands to the queue if previous refetch has not completed yet.
+- Updated UI so that downloading a software installer package now shows the browser's built-in progress bar.
+- Updated relevant documentation to include references to multiple ABM and VPP tokens.
+- Consolidated Automatic Enrollment and VPP settings under the MDM settings integration page.
+- Cleared apps associated with a VPP token if it's moved off of a team.
+
+### Vulnerability management
+
+- Added ALAS bulletins as vulnerability source for Amazon Linux (instead of OVAL for Amazon Linux 2, and adds support for Amazon Linux 1, 2022, and 2023).
+- Added matching rules for July and August Microsoft 365 security updates (https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates).
+- Added the following filters to `/software/titles` and `/software/versions` API endpoints: `exploit: bool`, `min_cvss_score: float`, `max_cvss_score: float`.
+- Updated software titles/versions tables to allow for filtering by vulnerabilities including severity and known exploit.
+- Updated to use empty CVE description when the NVD CVE feed doesn't include description entries (instead of panicking).
+- Updated matching software that is not installed by Fleet so that it shows up as 'Available for install' on host details page.
+- Updated base images of `fleetdm/fleetctl`, `fleetdm/bomutils` and `fleetdm/wix` to fix critical vulnerabilities found by Trivy.
+- Updated vulnerability scanning to use `macos` SW target for CPEs of homebrew packages.
+- Updated vulnerability scanning to not ignore software with non-ASCII en dash and em dash characters.
+- Updated `GET /api/v1/fleet/vulnerabilities/{cve}` endpoint to add validation of CVE format, and a 204 response. The 204 response indicates that the vulnerability is known to Fleet but not present on any hosts.
+- Updated the UI to add new empty states for searching vulnerabilities: invalid CVE format searched, a known CVE serached but not present on hosts, not a known CVE searched, exploited vulnerability empty state, operating systems empty state, new icons.
+
+### Bug fixes and improvements
+
+- Added support for MySQL 8.4.2 LTS.
+- Updated Go to go1.22.6.
+- Updated Fleet server to now accept arguments via stdin. This is useful for passing secrets that you don't want to expose as env vars, in the command line, or in the config file.
+- Updated text for "Turn on MDM" banners in UI.
+- Updated ABM host tooltip copy on the manage host page to clarify when host vitals will be available to view.
+- Updated copy on auotmatic enrollment modal on my device page.
+- Updated host details activities tooltip and empty state copy to reflect recently added capabilities.
+- Updated Fleet Free so users see a Premium feature message when clicking to add software.
+- Updated usage reporting to report statistics on new AI features, maintenance window, and `fleetd`.
+- Fixed bug where configuration profile was still showing the old label name after the name was updated.
+- Fixed a bug when a cached prepared statement gets deleted in the MySQL server itself without Fleet knowing.
+- Fixed a bug where the wrong API path was used to download a software installer.
+- Fixed the failing_host_count so it is never 0. This count is normally updated once an hour during cleanups_then_aggregation cron job.
+- Fixed CVE-2024-4030 in Vulncheck feed incorrectly targeting non-Windows hosts.
+- Fixed a bug where the "Self-service" filter for the list of software and the list of host's software did not take App Store apps into account.
+- Fixed a bug where the "My device" page in Fleet Desktop did not show the self-service software tab when App Store apps were available as self-install.
+- Fixed a bug where a software installer (a package or a VPP app) that has been installed on a host still shows up as "Available for install" and can still be requested to be installed after the host is transferred to a different team without that installer (or after the installer is deleted).
+- Fixed the "Available for install" filter in the host's software page so that installers that were requested to be installed on the host (regardless of installation status) also show up in the list.
+- Fixed UI popup messages bleeding off viewport in some cases.
+- Fixed an issue with the scheduling of cron jobs at startup if the job has never run, which caused it to be delayed.
+- Fixed UI to display the label names in case-insensitive alphabetical order.
+
+## Fleet 4.55.2 (Sep 05, 2024)
+
+### Bug fixes
+
+* Removed validation of APNS certificate from server startup. This was no longer necessary because we now allow for APNS certificates to be renewed in the UI.
+* Fixed logic to properly catch and log APNs errors.
+
+## Fleet 4.55.1 (Aug 14, 2024)
+
+### Bug fixes
+
+* Added a disabled overlay to the Other Workflows modal on the policy page.
+* Updated text for "Turn on MDM" banners in UI.
+* Fixed a bug when a cached prepared statement got deleted in the MySQL server itself without Fleet knowing.
+* Continued with an empty CVE description when the NVD CVE feed didn't include description entries (instead of panicking).
+* Scheduled maintenance events are now scheduled over calendar events marked "Free" (not busy) in Google Calendar.
+* Fixed a bug where the wrong API path was used to download a software installer.
+* Improved fleetctl gitops error message when trying to change team name to a team that already exists.
+* Updated ABM (Apple Business Manager) host tooltip copy on the manage host page to clarify when host vitals will be available to view.
+* Added index to query_results DB table to speed up finding the last query timestamp for a given query and host.
+* Displayed the label names in case-insensitive alphabetical order in the fleet UI.
+
+## Ready to upgrade?
+
+Visit our [Upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs for instructions on updating to Fleet 4.56.0.
+
+<meta name="category" value="releases">
+<meta name="authorFullName" value="JD Strong">
+<meta name="authorGitHubUsername" value="spokanemac">
+<meta name="publishedOn" value="2024-09-07">
+<meta name="articleTitle" value="Fleet 4.56.0 | Enhanced MDM migration, Exact CVE Search, and Self-Service VPP Apps.">
+<meta name="articleImageUrl" value="../website/assets/images/articles/fleet-4.56.0-1600x900@2x.png">
diff --git a/docs/Using Fleet/Fleet-desktop.md b/articles/fleet-desktop.md
similarity index 84%
rename from docs/Using Fleet/Fleet-desktop.md
rename to articles/fleet-desktop.md
index b4696943db96..c0b1b0e5744b 100644
--- a/docs/Using Fleet/Fleet-desktop.md	
+++ b/articles/fleet-desktop.md
@@ -1,12 +1,7 @@
 # Fleet Desktop
-- [Installing Fleet Desktop](#installing-fleet-desktop)
-- [Upgrading Fleet Desktop](#upgrading-fleet-desktop)
-- [Custom Transparency Link](#custom-transparency-link)
-- [Securing Fleet Desktop](#securing-fleet-desktop)
 
-Fleet Desktop is a menu bar icon available on macOS, Windows, and Linux.
+Fleet Desktop is a menu bar icon available on macOS, Windows, and Linux that gives your end users visibility into the security posture of their machine. This unlocks two key benefits:
 
-At its core, Fleet Desktop gives your end users visibility into the security posture of their machine. This unlocks two key benefits:
 * Self-remediation: end users can see which policies they are failing and resolution steps, reducing the need for IT and security teams to intervene
 * Scope transparency: end users can see what the Fleet agent can do on their machines, eliminating ambiguity between end users and their IT and security teams
 
@@ -16,10 +11,10 @@ At its core, Fleet Desktop gives your end users visibility into the security pos
    <iframe src="https://www.youtube.com/embed/cI2vDG3PbVo" allowfullscreen></iframe>
 </div>
 
-## Installing Fleet Desktop
+## Install Fleet Desktop
 For information on how to install Fleet Desktop, visit: [Adding Hosts](https://fleetdm.com/docs/using-fleet/adding-hosts#fleet-desktop).
 
-## Upgrading Fleet Desktop
+## Upgrade Fleet Desktop
 Once installed, Fleet Desktop will be automatically updated via Fleetd. To learn more, visit: [Self-managed agent updates](https://fleetdm.com/docs/deploying/fleetctl-agent-updates#self-managed-agent-updates).
 
 ## Custom transparency link
@@ -32,7 +27,7 @@ On the settings page, go to "Organization Settings" and select "Fleet Desktop."
 
 For information on how to set the custom transparency link via a YAML configuration file, see the [configuration files](https://fleetdm.com/docs/configuration/fleet-server-configuration#fleet-desktop-settings) documentation.
 
-## Securing Fleet Desktop
+## Secure Fleet Desktop
 
 Requests sent by Fleet Desktop and the web page that opens when clicking on the "My Device" tray item use a [Random (Version 4) UUID](https://www.rfc-editor.org/rfc/rfc4122.html#section-4.4) token to uniquely identify each host.
 
@@ -57,7 +52,9 @@ As a consequence, Fleet Desktop will issue a new token if the current token is:
 
 This change is imperceptible to users, as clicking on the "My device" tray item always uses a valid token. If a user visits an address with an expired token, they will get a message instructing them to click on the tray item again.
 
-<meta name="title" value="Fleet Desktop">
-<meta name="pageOrderInSection" value="450">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="zhumo">
+<meta name="authorFullName" value="Mo Zhu">
+<meta name="publishedOn" value="2024-04-19">
+<meta name="articleTitle" value="Fleet Desktop">
 <meta name="description" value="Learn about Fleet Desktop's features for self-remediation and transparency.">
-<meta name="navSection" value="The basics">
diff --git a/articles/fleet-in-your-calendar-introducing-maintenance-windows.md b/articles/fleet-in-your-calendar-introducing-maintenance-windows.md
index 5f23f9bbcec6..79ef934847e0 100644
--- a/articles/fleet-in-your-calendar-introducing-maintenance-windows.md
+++ b/articles/fleet-in-your-calendar-introducing-maintenance-windows.md
@@ -1,5 +1,7 @@
 # Fleet in your calendar: introducing maintenance windows 
 
+> Unlike other Fleet features which take advantage of declarative device management (DDM), the approach described in this article still uses traditional MDM commands.  (More to come.)
+
 ![Fleet in your calendar: introducing maintenance windows](../website/assets/images/articles/fleet-in-your-calendar-introducing-maintenance-windows-cover-900x450@2x.png)
 
 Fleet is excited to announce the release of "maintenance windows", a new feature in Fleet v4.48 that helps make sure OS updates occur during times that disrupt your users the least. Now, just like any good colleague, when Fleet needs some of your time, it puts it on your calendar. This approach avoids interrupting your key activities or important meetings, whether in the office, on the road, or working remotely.
@@ -19,7 +21,7 @@ Fleet provides AI-generated explanations directly in the calendar events, detail
 ## _Maintenance windows_ include:
 
 * **Personalized scheduling:** Updates are timed based on individual calendar events, so interventions happen when they are least intrusive.
-* **Automatic rescheduling:** If a scheduled update becomes impractical—due to changes in your calendar, for example—Fleet automatically finds a new appropriate time.
+* **Rescheduling flexibility:** If a scheduled update becomes impractical for any reason, users have the option to manually move the maintenance window to a more suitable time. We suggest rescheduling within one week to ensure timely updates.
 * **Enhanced compliance:** With auto-scheduled maintenance windows, compliance with security protocols is maintained effortlessly, ensuring all devices are up to date without manual intervention.
 
 _Maintenance windows_ is a direct response to common challenges faced in workplace productivity, particularly unplanned disruptions from essential updates. Fleet aims to support smoother, more efficient work environments by incorporating user feedback and addressing these long-standing issues.
diff --git a/docs/Using Fleet/Usage-statistics.md b/articles/fleet-usage-statistics.md
similarity index 84%
rename from docs/Using Fleet/Usage-statistics.md
rename to articles/fleet-usage-statistics.md
index 16e5339e6dac..1db24222dee1 100644
--- a/docs/Using Fleet/Usage-statistics.md	
+++ b/articles/fleet-usage-statistics.md
@@ -1,7 +1,9 @@
-# Usage statistics
+# Fleet usage statistics
 
 Fleet Device Management Inc. periodically collects information about your instance.
 
+> To disable usage statistics, [see here](#disable-usage-statistics).
+
 ## What is included in usage statistics in Fleet?
 
 Below is the JSON payload that is sent to Fleet Device Management Inc:
@@ -28,6 +30,17 @@ Below is the JSON payload that is sent to Fleet Device Management Inc:
   "numWeeklyActiveUsers": 999,
   "numWeeklyPolicyViolationDaysActual": 999,
   "numWeeklyPolicyViolationDaysPossible": 999,
+  "numSoftwareVersions": 999,
+  "numHostSoftwares": 999,
+  "numSoftwareTitles": 999,
+  "numHostSoftwareInstalledPaths": 999,
+  "numSoftwareCPEs": 999,
+  "numSoftwareCVEs": 999,
+  "numHostsNotResponding": 9,
+  "aiFeaturesDisabled": true,
+  "maintenanceWindowsEnabled": true,
+  "maintenanceWindowsConfigured": true,
+  "numHostsFleetDesktopEnabled": 999,
   "hostsEnrolledByOperatingSystem": {
     "darwin": [
       {
@@ -95,8 +108,7 @@ Below is the JSON payload that is sent to Fleet Device Management Inc:
       ]
     },
     ...
-  ],
-  "numHostsNotResponding": 9
+  ]
 }
 ```
 
@@ -128,6 +140,9 @@ To disable usage statistics:
 
 3. Uncheck the "Enable usage statistics" checkbox and then select "Update settings."
 
-<meta name="pageOrderInSection" value="1100">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-08-13">
+<meta name="articleTitle" value="Fleet usage statistics">
 <meta name="description" value="Learn about Fleet's usage statistics and what information is collected.">
-<meta name="navSection" value="Dig deeper">
diff --git a/docs/Using Fleet/fleetctl-CLI.md b/articles/fleetctl.md
similarity index 92%
rename from docs/Using Fleet/fleetctl-CLI.md
rename to articles/fleetctl.md
index 32b4c6724c63..caa234f845a8 100644
--- a/docs/Using Fleet/fleetctl-CLI.md	
+++ b/articles/fleetctl.md
@@ -1,6 +1,6 @@
-# fleetctl CLI
+# fleetctl
 
-fleetctl (pronounced "Fleet control") is a CLI tool for managing Fleet from the command line. fleetctl enables a GitOps workflow with Fleet.
+fleetctl (pronounced "Fleet control") is a command line interface (CLI) tool for managing Fleet from the command line. fleetctl enables a GitOps workflow with Fleet.
 
 fleetctl also provides a quick way to work with all the data exposed by Fleet without having to use the Fleet UI or work directly with the Fleet API.
 
@@ -32,6 +32,8 @@ npm install -g fleetctl@latest
 
 Much of the functionality available in the Fleet UI is also available in `fleetctl`. You can run queries, add and remove users, generate Fleet's agent (fleetd) to add new hosts, get information about existing hosts, and more!
 
+> Note: Unless a logging infrastructure is configured on your Fleet server, osquery-related logs will be stored locally on each device. Read more [here](https://fleetdm.com/guides/log-destinations)
+
 To see the available commands you can run:
 
 ```sh
@@ -197,6 +199,9 @@ This will generate a `tar.gz` file with:
 - A file containing a set of all the errors that happened in the server during the interval of time defined by the [logging_error_retention_period](https://fleetdm.com/docs/deploying/configuration#logging-error-retention-period) configuration.
 - Files containing database-specific information.
 
-<meta name="pageOrderInSection" value="300">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-07-04">
+<meta name="articleTitle" value="fleetctl">
 <meta name="description" value="Read about fleetctl, a CLI tool for managing Fleet and osquery configurations, running queries, generating Fleet's agent (fleetd) and more.">
-<meta name="navSection" value="The basics">
diff --git a/docs/Using Fleet/update-agents.md b/articles/fleetd-updates.md
similarity index 95%
rename from docs/Using Fleet/update-agents.md
rename to articles/fleetd-updates.md
index 93b61c0052c6..d5693eba93e1 100644
--- a/docs/Using Fleet/update-agents.md	
+++ b/articles/fleetd-updates.md
@@ -1,7 +1,6 @@
-# Self-managed agent updates 
+# Fleetd updates 
 
-The fleetd agent will periodically check the public Fleet update repository and update Orbit, Fleet Desktop, and/or osquery 
-if it detects a later version.
+The fleetd agent will periodically check the public Fleet update repository and update Orbit, Fleet Desktop, and/or osquery if it detects a later version.
 
 To override this behavior, users can set a channel for each component or disable updates altogether. Visit [Adding Hosts](https://fleetdm.com/docs/using-fleet/adding-hosts#fleet-desktop) to learn more.
 Alternatively, users with a Fleet Premium subscription can self-manage an update server.
@@ -160,6 +159,9 @@ fleetctl updates rotate targets
 
 After the key(s) have been rotated, publish the repository in the same fashion as any other update.
 
-<meta name="pageOrderInSection" value="400">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-04-30">
+<meta name="articleTitle" value="Fleetd updates">
 <meta name="description" value="Information on how to manage and secure Fleet agent updates.">
-<meta name="navSection" value="Dig deeper">
diff --git a/articles/install-vpp-apps-on-macos-using-fleet.md b/articles/install-vpp-apps-on-macos-using-fleet.md
new file mode 100644
index 000000000000..387aa00348a5
--- /dev/null
+++ b/articles/install-vpp-apps-on-macos-using-fleet.md
@@ -0,0 +1,114 @@
+# Install App Store apps (VPP) on macOS, iOS, and iPadOS using Fleet
+
+![Install VPP apps on macOS using Fleet](../website/assets/images/articles/install-vpp-apps-on-macos-using-fleet-1600x900@2x.png)
+
+
+Fleet Premium supports the ability to add Apple App Store applications to your software library using the Volume Purchasing Program (VPP) and then install those apps on macOS, iOS, or iPadOS hosts. This guide will walk you through using this feature to add apps from your Apple Business Manager account to Fleet and install those apps on your hosts.
+
+The Volume Purchasing Program is an Apple initiative that allows organizations to purchase and distribute apps and books in bulk. This program is particularly beneficial for organizations that need to deploy multiple apps to many devices. Key benefits of VPP include:
+* **Bulk purchasing**: Purchase multiple licenses for an app in one transaction, often with volume discounts.
+* **Centralized management**: Manage and distribute purchased apps from a central location.
+* **Licensing flexibility**: Reassign app licenses as needed, ensuring efficient use of resources.
+* **Streamlined deployment**: Use Fleet to automate the installation and configuration of purchased apps on enrolled devices.
+* **Self-Service (macOS only)**: Allow users to assign licenses to their own devices as needed.
+
+By integrating VPP with Fleet, organizations can seamlessly add apps to their software library and deploy them across macOS, iOS, and iPadOS hosts, ensuring that all devices have the necessary applications installed efficiently and effectively.
+
+## Prerequisites
+* **MDM features**: to use the VPP integration, you must first enable MDM features in Fleet. See the [MDM setup guide](https://fleetdm.com/docs/using-fleet/mdm-setup) for instructions on enabling MDM features.
+* **Teams**: Apps can only be added to a specific Team. You can manage teams by selecting your avatar in the top navigation and then **Settings > Teams**. (Note: Apps can also be added to the 'No Team' team, which contains hosts not assigned to any other team.) You can control which team uses which VPP token by assigning teams to the VPP token. Each token may have multiple teams assigned to it, but each team may be assigned to only 1 token.
+
+> As of Fleet 4.55.0, there is a [known issue](https://github.com/fleetdm/fleet/issues/20686) that uninstalled or deleted VPP apps will continue to show a status of `installed`.
+
+## Accessing the VPP configuration
+
+1. **Navigate to the MDM integration settings page**: Click your avatar on the far right of the main navigation menu, and then **Settings > Integrations > "Mobile device management (MDM)"**
+
+2. **Add your VPP token**: Scroll to the "Volume Purchasing Program (VPP)" section. Click "Add VPP", and then click "Add VPP" again on the following page. Follow the directions on the modal to get your VPP token from Apple Business Manager, and then click the "Upload" button at the bottom to upload it to Fleet.
+
+3. **Edit the team assignment for the new token**: Find the token in the table of VPP tokens. Click the "Actions" dropdown, and then click "Edit teams". Use the picker to select which team(s) this VPP token should be assigned to.
+
+## Purchasing apps
+
+To add apps to Fleet, you must first purchase them through Apple Business Manager, even if they are free. This ensures that all apps are appropriately licensed and available for distribution via the Volume Purchasing Program (VPP). For detailed instructions on selecting and buying content, please refer to Apple’s documentation on [purchasing apps through Apple Business Manager](https://support.apple.com/guide/apple-business-manager/select-and-buy-content-axmc21817890/web).
+
+## Add an app to Fleet
+
+1. **Navigate to the Software page**: Click on the "Software" tab in the main navigation menu.
+
+2. **Select your team**: Click on the "All teams" dropdown in the top left of the page and select your desired team.
+
+3. **Open the "Add software" modal**: Click on the "Add software" button in the top right of the page.
+
+4. **View your available apps**: Click on the "App Store (VPP)" tab in the "Add software" modal. The modal will list the apps that you have purchased through VPP but still need to add to Fleet.
+
+5. **Add an app**: Select an app from the list. You may optionally check the "Self-Service" box at the bottom left of the modal if you wish for the software to be available for user-initiated installs. Finally, click the "Add software" button in the bottom right of the modal. The app should appear in the software list for the selected team.
+
+## Remove an app from Fleet
+
+1. **Navigate to the Software page**: Click "Software" in the main navigation menu.
+
+2. **Find the app you want to remove**: Search for the app using the search bar in the top right corner of the table.
+
+3. **Access the app's details page**: Click on the app's name in the table.
+
+4. **Remove the app**: Click on the "Actions" dropdown on the right side of the page. Click "Delete," then click "Delete" on the confirmation modal. Deleting an app will not uninstall the app from the hosts on which it was previously installed.
+
+## Installing apps on macOS, iOS, and iPadOS hosts
+
+1. **Add the host to the relevant team.**
+
+2. **Go to the host's detail page**: Click the "Hosts" tab in the main navigation menu. Filter the hosts by the team, and click the host's name to see its details page.
+
+3. **Find the app**: Click the "Software" tab on the host details page. Search for the software you added in the software table's search bar. Instead of searching, you can also filter software by clicking the **All software** dropdown and selecting **Available for install.**
+
+4. **Install the app**: Click the "Actions" dropdown on the far right of the app's entry in the
+   table. Click "Install" to trigger an install. This action will send an MDM command to the host
+   instructing it to install the app. If the host is offline, the upcoming install will show up in
+   the **Details** -> **Activity** -> **Upcoming** tab of this page. After the app is installed and
+   the host details are refetched, the app will show up as **Installed** in the **Software** tab.
+
+## Installing apps on macOS using self-service
+
+1. **Open Fleet from the host**: On the host that will be installing an application through self-service, click on the Fleet Desktop tray icon, then click **My Device**. This will open the browser to the device's page on Fleet.
+
+2. **Navigate to the self-service tab**: Click on the **Self-Service** tab under the device's details.
+
+3. **Locate the app and click install**: Scroll through the list of software to find the app you would like to install, then click the **Install** button underneath it.
+
+## Renewing an expired or expiring VPP token
+
+When one of your uploaded VPP tokens has expired or is within 30 days of expiring, you will see a warning
+banner at the top of page reminding you to renew your token. You can do this with the following steps:
+
+1. **Navigate to the MDM integration settings page**: Click your avatar on the far right of the main navigation menu, and then **Settings > Integrations > "Mobile device management (MDM)"** Scroll to the "Volume Purchasing Program (VPP)" section, and click "Edit".
+
+2. **Renew the token**: Find the VPP token that you want to renew in the table. Token status is indicated in the "Renew date" column: tokens less than 30 days from expiring will have a yellow indicator, and expired tokens will have a red indicator. Click the "Actions" dropdown for the token and then click "Renew". Follow the instructions in the modal to download a new token from Apple Business Manager and then upload the new token to Fleet.
+
+## Deleting a VPP token
+
+To remove VPP tokens from Fleet:
+
+1. **Navigate to the MDM integration settings page**: Click your avatar on the far right of the main navigation menu, and then **Settings > Integrations > "Mobile device management (MDM)"** Scroll to the "Volume Purchasing Program (VPP)" section, and click "Edit". 
+
+2. **Delete the token**: Find the VPP token that you want to delete in the table. Click the "Actions" dropdown for that token, and then click "Delete". Click "Delete" in the confirmation modal to finish deleting the token.
+
+## Managing apps with GitOps
+
+To manage App Store apps using Fleet's best practice GitOps, check out the `software` key in the GitOps reference documentation [here](https://fleetdm.com/docs/using-fleet/gitops#software).
+
+## REST API
+
+Fleet also provides a REST API for managing apps programmatically. You can add, install, and delete apps via this API and manage your organization’s VPP tokens. Learn more about Fleet's [REST API](https://fleetdm.com/docs/rest-api/rest-api).
+
+## Conclusion
+
+This feature extends Fleet's capabilities for managing macOS, iOS, and iPadOS hosts. Whether you manage your hosts' software via uploaded installers or via the App Store VPP integration, Fleet provides you with the tools you need to manage your hosts effectively.
+
+<meta name="articleTitle" value="Install VPP apps on macOS using Fleet">
+<meta name="authorFullName" value="Jahziel Villasana-Espinoza">
+<meta name="authorGitHubUsername" value="jahzielv">
+<meta name="category" value="guides">
+<meta name="publishedOn" value="2024-08-12">
+<meta name="articleImageUrl" value="../website/assets/images/articles/install-vpp-apps-on-macos-using-fleet-1600x900@2x.png">
+<meta name="description" value="This guide will walk you through installing VPP apps on macOS, iOS, and iPadOS using Fleet.">
diff --git a/docs/Using Fleet/Log-destinations.md b/articles/log-destinations.md
similarity index 92%
rename from docs/Using Fleet/Log-destinations.md
rename to articles/log-destinations.md
index fb153f258930..ddec0c9b0c61 100644
--- a/docs/Using Fleet/Log-destinations.md	
+++ b/articles/log-destinations.md
@@ -1,19 +1,5 @@
 # Log destinations
 
-- [Log destinations](#log-destinations)
-  - [Amazon Kinesis Data Firehose](#amazon-kinesis-data-firehose)
-  - [Snowflake](#snowflake)
-  - [Splunk](#splunk)
-  - [Amazon Kinesis Data Streams](#amazon-kinesis-data-streams)
-  - [AWS Lambda](#aws-lambda)
-  - [Google Cloud Pub/Sub](#google-cloud-pubsub)
-  - [Apache Kafka](#apache-kafka)
-  - [Stdout](#stdout)
-  - [Filesystem](#filesystem)
-  - [Sending logs outside of Fleet](#sending-logs-outside-of-fleet)
-
-This document provides a list of the supported log destinations in Fleet.
-
 Log destinations can be used in Fleet to log:
 - Osquery [status logs](https://osquery.readthedocs.io/en/stable/deployment/logging/#status-logs).
 
@@ -23,11 +9,27 @@ Log destinations can be used in Fleet to log:
 
 
 To configure each log destination, you must set the correct logging configuration options in Fleet.
+
 Check out the reference documentation for:
   - [Osquery status logging configuration options](https://fleetdm.com/docs/deploying/configuration#osquery-status-log-plugin).
   - [Osquery result logging configuration options](https://fleetdm.com/docs/deploying/configuration#osquery-result-log-plugin).
   - [Activity audit logging configuration options](https://fleetdm.com/docs/deploying/configuration#activity_audit_log_plugin).
 
+This guide provides a list of the supported log destinations in Fleet.
+
+### In this guide:
+
+- [Amazon Kinesis Data Firehose](#amazon-kinesis-data-firehose)
+- [Snowflake](#snowflake)
+- [Splunk](#splunk)
+- [Amazon Kinesis Data Streams](#amazon-kinesis-data-streams)
+- [AWS Lambda](#aws-lambda)
+- [Google Cloud Pub/Sub](#google-cloud-pubsub)
+- [Apache Kafka](#apache-kafka)
+- [Stdout](#stdout)
+- [Filesystem](#filesystem)
+- [Sending logs outside of Fleet](#sending-logs-outside-of-fleet)
+
 ## Amazon Kinesis Data Firehose
 
 Logs are written to [Amazon Kinesis Data Firehose (Firehose)](https://aws.amazon.com/kinesis/data-firehose/).
@@ -145,6 +147,9 @@ See the [osquery logging documentation](https://osquery.readthedocs.io/en/stable
 
 If `--logger_plugin=tls` is used with osquery clients, the following configuration can be applied on the Fleet server for handling the incoming logs.
 
-<meta name="pageOrderInSection" value="600">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="rachaelshaw">
+<meta name="authorFullName" value="Rachael Shaw">
+<meta name="publishedOn" value="2023-11-02">
+<meta name="articleTitle" value="Log destinations">
 <meta name="description" value="Learn about supported log destinations in Fleet, including Amazon Kinesis, AWS Lambda Snowflake, Splunk, and more.">
-<meta name="navSection" value="Security compliance">
diff --git a/articles/macos-mdm-setup.md b/articles/macos-mdm-setup.md
new file mode 100644
index 000000000000..bc91ee6a7206
--- /dev/null
+++ b/articles/macos-mdm-setup.md
@@ -0,0 +1,65 @@
+# macOS MDM setup
+
+To turn on macOS, iOS, and iPadOS MDM features, follow the instructions on this page to connect Fleet to Apple Push Notification service (APNs).
+
+To use automatic enrollment (aka zero-touch) features on macOS, iOS, and iPadOS, follow instructions to connect Fleet with Apple Business Manager (ABM).
+
+To turn on Windows MDM features, head to this [Windows MDM setup article](https://fleetdm.com/guides/windows-mdm-setup).
+
+## Apple Push Notification service (APNs)
+
+Apple uses APNs to authenticate and manage interactions between Fleet and hosts.
+
+To connect Fleet to APNs or renew APNs, head to the **Settings > Integrations > Mobile device management (MDM)** page.
+
+> Apple requires that APNs certificates are renewed annually. 
+> - If your certificate expires, you will have to turn MDM off and back on for all macOS hosts.
+> - Be sure to use the same Apple ID from year-to-year. If you don't, you will have to turn MDM off and back on for all macOS hosts.
+
+## Apple Business Manager (ABM)
+
+> Available in Fleet Premium
+
+To connect Fleet to ABM, you have to add an ABM token to Fleet. To add an ABM token: 
+
+1. Navigate to the **Settings > Integrations > Mobile device management (MDM)** page.
+2. Under "Automatic enrollment", click "Add ABM", and then click "Add ABM" again on the next page. Follow the instructions in the modal and upload an ABM token to Fleet.
+
+When one of your uploaded ABM tokens has expired or is within 30 days of expiring, you will see a warning
+banner at the top of page reminding you to renew your token.
+
+To renew an ABM token:
+
+1. Navigate to the **Settings > Integrations > Mobile device management (MDM)** page.
+2. Under "Automatic enrollment", click "Edit", and then find the token that you want to renew. Token status is indicated in the "Renew date" column: tokens less than 30 days from expiring will have a yellow indicator, and expired tokens will have a red indicator. Click the "Actions" dropdown for the token and then click "Renew". Follow the instructions in the modal to download a new token from Apple Business Manager and then upload the new token to Fleet.
+
+After connecting Fleet to ABM, set Fleet to be the MDM for all Macs: 
+
+1. Log in to [Apple Business Manager](https://business.apple.com)
+2. Click your profile icon in the bottom left
+3. Click **Preferences**
+4. Click **MDM Server Assignment** and click **Edit** next to **Default Server Assignment**.
+5. Switch **Mac**, **iPhone**, and **iPad** to Fleet.
+
+macOS, iOS, and iPadOS hosts listed in ABM and associated to a Fleet instance with MDM enabled will sync to Fleet and appear in the Hosts view with the **MDM status** label set to "Pending".
+
+Hosts that automatically enroll will be assigned to a default team. You can configure the default team for macOS, iOS, and iPadOS hosts by:
+
+1. Navigating to the **Settings > Integrations > Mobile device management (MDM)** page and clicking "Edit" under "Automatic enrollment".
+2. Click on the "Actions" dropdown for the ABM token you want to update, and then click "Edit teams".
+3. Use the dropdowns in the modal to select the default team for each type of host, and click "Save" to save your selections.
+
+If no default team is set for a host platform (macOS, iOS, or iPadOS), then newly enrolled hosts of that platform will be placed in "No team". 
+
+> A host can be transferred to a new (not default) team before it enrolls. In the Fleet UI, you can do this under **Settings** > **Teams**.
+
+### Simple Certificate Enrollment Protocol (SCEP)
+
+Fleet uses SCEP certificates (1 year expiry) to authenticate the requests hosts make to Fleet. Fleet renews each host's SCEP certificates automatically every 180 days.
+
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="zhumo">
+<meta name="authorFullName" value="Mo Zhu">
+<meta name="publishedOn" value="2024-07-02">
+<meta name="articleTitle" value="macOS MDM setup">
+<meta name="description" value="Learn how to turn on MDM features in Fleet.">
diff --git a/docs/Using Fleet/MDM-macOS-setup-experience.md b/articles/macos-setup-experience.md
similarity index 91%
rename from docs/Using Fleet/MDM-macOS-setup-experience.md
rename to articles/macos-setup-experience.md
index 31dac0a131c6..6d7f9cc2ef9a 100644
--- a/docs/Using Fleet/MDM-macOS-setup-experience.md	
+++ b/articles/macos-setup-experience.md
@@ -2,7 +2,7 @@
 
 _Available in Fleet Premium_
 
-In Fleet, you can customize the out-of-the-box macOS setup experience for your end users:
+In Fleet, you can customize the out-of-the-box macOS Setup Assistant with Remote Management and Automated Device Enrollment (ADE) for end users:
 
 * Require end users to authenticate with your identity provider (IdP) and agree to an end user license agreement (EULA) before they can use their new Mac.
 
@@ -12,7 +12,7 @@ In Fleet, you can customize the out-of-the-box macOS setup experience for your e
 
 In addition to the customization above, Fleet automatically installs the fleetd agent during out-of-the-box macOS setup. This agent is responsible for reporting host vitals to Fleet and presenting Fleet Desktop to the end user.
 
-macOS setup features require connecting Fleet to Apple Business Manager (ABM). Learn how [here](./mdm-setup.md#apple-business-manager-abm).
+macOS setup features require connecting Fleet to Apple Business Manager (ABM). Learn how [here](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm).
 
 ## End user authentication and EULA
 
@@ -20,7 +20,7 @@ Using Fleet, you can require end users to authenticate with your identity provid
 
 ### End user authentication
 
-To require end user authentication, first [configure single sign-on (SSO)](../Deploy/single-sign-on-sso.md). Next, enable end user authentication by heading to to **Controls > Setup experience End user authentication** or use [Fleet's GitOps workflow](https://github.com/fleetdm/fleet-gitops).
+To require end user authentication, first [configure single sign-on (SSO)](https://fleetdm.com/docs/deploy/single-sign-on-sso). Next, enable end user authentication by heading to to **Controls > Setup experience End user authentication** or use [Fleet's GitOps workflow](https://github.com/fleetdm/fleet-gitops).
 
 If you've already configured SSO in Fleet, create a new SAML app in your IdP. In your new app, use `https://<your_fleet_url>/api/v1/fleet/mdm/sso/callback` for the SSO URL.
 
@@ -155,13 +155,15 @@ Testing requires a test Mac that is present in your Apple Business Manager (ABM)
 
 2. In Fleet, navigate to the Hosts page and find your Mac. Make sure that the host's **MDM status** is set to "Pending."
 
-  > New Macs purchased through Apple Business Manager appear in Fleet with MDM status set to "Pending." Learn more about these hosts [here](./mdm-setup.md#pending-hosts).
+  > New Macs purchased through Apple Business Manager appear in Fleet with MDM status set to "Pending." Learn more about these hosts [here](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm).
 
 3. Transfer this host to the "Workstations (canary)" team by selecting the checkbox to the left of the host and selecting **Transfer** at the top of the table. In the modal, choose the Workstations (canary) team and select **Transfer**.
 
 4. Boot up your test Mac and complete the custom out-of-the-box setup experience.
 
-<meta name="pageOrderInSection" value="1506">
-<meta name="title" value="macOS setup experience">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-07-03">
+<meta name="articleTitle" value="macOS setup experience">
 <meta name="description" value="Customize your macOS setup experience with Fleet Premium by managing user authentication, Setup Assistant panes, and installing bootstrap packages.">
-<meta name="navSection" value="Device management">
diff --git a/articles/managing-labels-in-fleet.md b/articles/managing-labels-in-fleet.md
new file mode 100644
index 000000000000..53e757e1e6df
--- /dev/null
+++ b/articles/managing-labels-in-fleet.md
@@ -0,0 +1,83 @@
+# Managing labels in Fleet
+
+![Managing labels in Fleet](../website/assets/images/articles/managing-labels-in-fleet-1600x900@2x.png)
+
+
+Labels in Fleet provide a powerful way to scope profiles to specific hosts. This guide will walk you through managing labels using the Fleet web UI. Labels can be created dynamically using queries or manually by selecting specific hosts. Dynamic labels are applied to hosts that match the query criteria, while manual labels are assigned to hosts you select.
+
+
+### Accessing labels
+
+To access and manage labels in Fleet:
+
+1. **Navigate to the Hosts page**: Click on the "Hosts" tab in the main navigation menu.
+
+2. **Filter by labels**: In the "Filter by…" drop-down menu, you will see options for "Platforms" (e.g., macOS, Windows, Linux) and "Labels." 
+
+You can add a new label, filter existing labels by name, or select a label from the list. Selecting a label filters the view only to show hosts with that label.
+
+
+### Adding a label
+
+To add a new label:
+
+
+
+1. **Navigate to the Hosts page**: Click on the "Hosts" tab in the main navigation menu.
+2. **Access labels**: Click the "Filter by…" drop-down.
+3. **Select "Add Label +"**: This option allows you to create a new label.
+4. **Choose label Type**: You will be prompted to choose between a "Dynamic" or "Manual" label.
+    1. **Dynamic**: Enter a name and description, then build your query and select the platforms to which this label applies.
+    2. **Manual**: Enter a name and description, then select the hosts to which you want to apply this label.
+5. **Save the label**: Click the "Save" button to create your label.
+
+
+### Editing a label
+
+To edit an existing label:
+
+
+
+1. **Locate the label**: Find the label you want to edit in the list.
+2. **Click the pencil icon**: A pencil icon will appear next to the label. Clicking this icon allows you to edit the label.
+3. **Edit details**: For manually applied labels, you can change the name, description, and selected hosts. For dynamically applied labels, you can view the query.
+4. **Update restrictions**: To change the query or platforms a dynamic label targets, you must delete the existing label and create a new one. Once set, label queries and platforms are immutable.
+
+
+### Using the REST API for Labels
+
+Fleet also provides a REST API to manage labels programmatically. The API allows you to add, update, retrieve, list, and delete labels. Find detailed documentation on Fleet's [REST API here](https://fleetdm.com/docs/rest-api/rest-api#labels).
+
+
+### Managing labels with `fleetctl`
+
+Fleet's command line tool, `fleetctl` will also allow you to list and manage labels. While managing labels with `fleetctl` is beyond the scope of this guide, you can list all labels using the following command:
+
+```bash
+
+fleetctl get labels
+
+```
+
+> Learn more about [`fleetctl` CLI](https://fleetdm.com/docs/using-fleet/fleetctl-cli).
+
+
+#### Additional Information
+
+
+
+* **Targeting extensions with labels**: Labels can also target extensions to specific hosts. You can find more details on this functionality [here](https://fleetdm.com/docs/configuration/agent-configuration#targeting-extensions-with-labels).
+
+
+### Conclusion
+
+Using labels in Fleet enhances your ability to effectively manage and scope profiles to specific hosts. Whether you prefer to manage labels through the web UI or programmatically via the REST API, Fleet provides the flexibility and control you need. For more information on using Fleet, please refer to the [Fleet documentation](https://fleetdm.com/docs) and [guides](https://fleetdm.com/guides).
+
+
+<meta name="articleTitle" value="Managing labels in Fleet">
+<meta name="authorFullName" value="JD Strong">
+<meta name="authorGitHubUsername" value="spokanemac">
+<meta name="category" value="guides">
+<meta name="publishedOn" value="2024-07-18">
+<meta name="articleImageUrl" value="../website/assets/images/articles/managing-labels-in-fleet-1600x900@2x.png">
+<meta name="description" value="This guide will walk you through managing labels using the Fleet web UI.">
diff --git a/docs/Using Fleet/MDM-commands.md b/articles/mdm-commands.md
similarity index 70%
rename from docs/Using Fleet/MDM-commands.md
rename to articles/mdm-commands.md
index c541c7799dac..b1e5918c5eca 100644
--- a/docs/Using Fleet/MDM-commands.md	
+++ b/articles/mdm-commands.md
@@ -1,4 +1,4 @@
-# Commands
+# MDM commands
 
 In Fleet you can run MDM commands to take action on your macOS, iOS, iPadOS, and Windows hosts, like restarting the host, remotely.
 
@@ -83,19 +83,11 @@ You can view a list of the 1,000 latest commands:
 1. Run `fleetctl get mdm-commands`
 2. View the list of latest commands, most recent first, along with the timestamp, targeted hostname, command type, execution status and command ID.
 
-The command ID can be used to view command results as documented in [step 4 of the previous section](#step-4-view-the-commands-results). 
+The command ID can be used to view command results as documented in [step 4 of the previous section](#step-4-view-the-commands-results).
 
-The possible statuses for macOS, iOS, and iPadOS hosts are the following:
-
-* Pending: the command has yet to run on the host. The host will run the command the next time it comes online.
-* NotNow: the host responded with "NotNow" status via the MDM protocol: the host received the command, but couldn’t execute it. The host will try to run the command the next time it comes online.
-* Acknowledged: the host responded with "Acknowledged" status via the MDM protocol: the host processed the command successfully.
-* Error: the host responded with "Error" status via the MDM protocol: an error occurred. Run the `fleetctl get mdm-command-results --id=<insert-command-id` to view the error.
-* CommandFormatError: the host responded with "CommandFormatError" status via the MDM protocol: a protocol error occurred, which can result from a malformed command. Run the `fleetctl get mdm-command-results --id=<insert-command-id` to view the error.
-
-The possible statuses for Windows hosts are documented in Microsoft's documentation [here](https://learn.microsoft.com/en-us/windows/client-management/oma-dm-protocol-support#syncml-response-status-codes).
-
-<meta name="pageOrderInSection" value="1507">
-<meta name="title" value="Commands">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-06-12">
+<meta name="articleTitle" value="MDM commands">
 <meta name="description" value="Learn how to run custom MDM commands on hosts using Fleet.">
-<meta name="navSection" value="Device management">
diff --git a/docs/Using Fleet/MDM-migration-guide.md b/articles/mdm-migration.md
similarity index 85%
rename from docs/Using Fleet/MDM-migration-guide.md
rename to articles/mdm-migration.md
index 68e55a7c8138..5eb9e8473d63 100644
--- a/docs/Using Fleet/MDM-migration-guide.md	
+++ b/articles/mdm-migration.md
@@ -1,15 +1,19 @@
-# Migration guide
+# MDM migration
 
-This section provides instructions for migrating your hosts away from your old MDM solution to Fleet.
+This guide provides instructions for migrating devices from your current MDM solution to Fleet.
+
+> For seamless MDM migration, [view this guide](https://fleetdm.com/guides/seamless-mdm-migration).
 
 ## Requirements
 
-1. A [deployed Fleet instance](../Deploying/Introduction.md)
-2. [Fleet connected to Apple](./mdm-setup.md)
+
+- A [deployed Fleet instance](https://fleetdm.com/docs/deploy/deploy-fleet)
+- Fleet is connected to Apple Push Notification service (APNs) and Apple Business Manager (ABM). [See macOS MDM setup](https://fleetdm.com/guides/macos-mdm-setup)
+
 
 ## Migrate manually enrolled hosts
 
-1. [Enroll](./Adding-hosts.md) your hosts to Fleet with [Fleetd and Fleet Desktop](https://fleetdm.com/docs/using-fleet/adding-hosts#including-fleet-desktop) 
+1. [Enroll](https://fleetdm.com/guides/enroll-hosts) your hosts to Fleet with [Fleetd and Fleet Desktop](https://fleetdm.com/guides/enroll-hosts#fleet-desktop) 
 2. Ensure your end users have access to an admin account on their Mac. End users won't be able to migrate on their own if they have a standard account.
 3. In your old MDM solution, unenroll the hosts to be migrated. MacOS does not allow multiple MDMs to be installed at once.
 4. Send [these guided instructions](#how-to-turn-on-mdm) to your end users to complete the final few steps via Fleet Desktop.
@@ -46,8 +50,8 @@ To migrate automatically enrolled hosts, we will do the following steps:
 
 ### Step 1: prepare to migrate hosts
 
-1. Connect Fleet to Apple Business Manager (ABM). Learn how [here](./mdm-setup.md#apple-business-manager-abm).
-2. [Enroll](./Adding-hosts.md) your hosts to Fleet with [Fleetd and Fleet Desktop](https://fleetdm.com/docs/using-fleet/adding-hosts#including-fleet-desktop) 
+1. Connect Fleet to Apple Business Manager (ABM). Learn how [here](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm).
+2. [Enroll](https://fleetdm.com/guides/enroll-hosts) your hosts to Fleet with [Fleetd and Fleet Desktop](https://fleetdm.com/guides/enroll-hosts#fleet-desktop) 
 3. Ensure your end users have access to an admin account on their Mac. End users won't be able to migrate on their own if they have a standard account.
 4. Migrate your hosts to Fleet in ABM:
     1. In ABM, unassign the existing hosts' MDM server from the old MDM solution: In ABM, select **Devices** and then select **All Devices**. Then, select **Edit** next to **Edit MDM Server**, select **Unassign from the current MDM**, and select **Continue**.
@@ -176,21 +180,19 @@ Then, scroll down to the **Mobile device management (MDM)** section.
 
 _Available in Fleet Premium_
 
-When migrating from a previous MDM, end users need to take action to escrow FileVault keys to Fleet. The **My device** page in Fleet Desktop will present users with instructions to reset their key. 
+When migrating from a previous MDM, end users need to restart or logout of their device to escrow FileVault keys to Fleet. The **My device** page in Fleet Desktop will present users with instructions to reset their key. 
 
-To start, enforce FileVault (disk encryption) and escrow in Fleet. Learn how [here](./MDM-disk-encryption.md). 
+To start, enforce FileVault (disk encryption) and escrow in Fleet. Learn how [here](https://fleetdm.com/guides/enforce-disk-encryption). 
 
 After turning on disk encryption in Fleet, share [these guided instructions](#how-to-turn-on-disk-encryption) with your end users.
 
-If your old MDM solution did not enforce disk encryption, the end user will need to restart or log out of the host.
-
-If your old MDM solution did enforce disk encryption, the end user will need to reset their disk encryption key by following the prompt on the My device page and inputting their password. 
-
-## Activation Lock Bypass codes
+## Activation Lock
 
 In Fleet, the [Activation Lock](https://support.apple.com/en-us/HT208987) feature is disabled by default for automatically enrolled (DEP) hosts.
 
-If a host under the old MDM solution has Activation Lock enabled, we recommend asking the end user to follow these instructions to disable Activation Lock before migrating this host to Fleet: https://support.apple.com/en-us/HT208987.
+In 2024, Apple added the ability to manage activation lock in Apple Business Manager (ABM). For devices that are owned by the business and available in ABM, you can [turn off activation lock remotely](https://support.apple.com/en-ca/guide/apple-business-manager/axm812df1dd8/web).
+
+If a device is not available in ABM and has Activation Lock enabled, we recommend asking the end user to follow these instructions to disable Activation Lock before migrating the device to Fleet: https://support.apple.com/en-us/HT208987.
 
 This is because if the Activation Lock is enabled, you will need the Activation Lock bypass code to successfully wipe and reuse the Mac.
 
@@ -208,7 +210,9 @@ However, Activation Lock bypass codes can only be retrieved from the Mac up to 3
 
 <img width="1399" alt="My device page - turn on disk encryption" src="https://user-images.githubusercontent.com/5359586/229950451-cfcd2314-a993-48db-aecf-11aac576d297.png">
 
-<meta name="pageOrderInSection" value="1502">
-<meta name="title" value="Migration guide">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="zhumo">
+<meta name="authorFullName" value="Mo Zhu">
+<meta name="publishedOn" value="2024-08-14">
+<meta name="articleTitle" value="MDM migration">
 <meta name="description" value="Instructions for migrating hosts away from an old MDM solution to Fleet.">
-<meta name="navSection" value="Device management">
diff --git a/articles/osquery-evented-tables-overview.md b/articles/osquery-evented-tables-overview.md
index 883f0bc8ab0c..f1316a85f1a5 100644
--- a/articles/osquery-evented-tables-overview.md
+++ b/articles/osquery-evented-tables-overview.md
@@ -121,7 +121,7 @@ On macOS, there are two utilities that enable osquery process auditing: [OpenBSM
 To use the `es_process_events` tables, use the flag `--disable_endpointsecurity=false`. See the [EndpointSecurity instructions](https://osquery.readthedocs.io/en/latest/deployment/process-auditing/#auditing-processes-with-endpointsecurity) for more information. To use `process_events` and `socket_events` with OpenBSM, see the [OpenBSM instructions](https://osquery.readthedocs.io/en/latest/deployment/process-auditing/#auditing-processes-with-openbsm). 
 
 #### Windows
-Currently, osquery does not support process auditing for Windows. To learn more about process auditing on Windows, visit [Microsoft's security auditing overview](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/security-auditing-overview). Fleet is tracking work to build process auditing for Windows in osquery. [Stay up to date on GitHub](https://github.com/fleetdm/fleet/issues/7732).
+Fleet supports auditing process events on Windows via the `process_etw_events` table. To learn more about process auditing on Windows, visit [Microsoft's security auditing overview](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/security-auditing-overview). Fleet is tracking work to add file auditing for Windows in osquery. [Stay up to date on GitHub](https://github.com/fleetdm/fleet/issues/20946).
 
 ### YARA scanning
 [YARA](https://virustotal.github.io/yara/) is a malware research and detection tool available on Linux and macOS that allows users to create descriptions of malware families based on patterns of text or binary code. Each potential piece of malware is matched against a YARA rule and triggers if the specified conditions are met. 
diff --git a/docs/Using Fleet/Osquery-process.md b/articles/osquery-watchdog.md
similarity index 90%
rename from docs/Using Fleet/Osquery-process.md
rename to articles/osquery-watchdog.md
index 68efcd81da8f..5fb0bd980bfb 100644
--- a/docs/Using Fleet/Osquery-process.md	
+++ b/articles/osquery-watchdog.md
@@ -1,4 +1,4 @@
-# Osquery children processes
+# Osquery watchdog
 
 Osquery will run a watcher process to keep track of any child process and any managed extensions. What follows is a description of what happens during the watcher REPL and under what circumstances the child process and/or managed extensions are terminated.
 
@@ -25,6 +25,9 @@ If the managed extension is `Non-existent` (either because it was `Non-existent`
 
 Lastly, we check the state of the watcher process itself. If it is deemed unhealthy because of resource contention, then the osquery process is shut down.
 
-<meta name="pageOrderInSection" value="700">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="juan-fdz-hawa">
+<meta name="authorFullName" value="Juan Fernandes">
+<meta name="publishedOn" value="2023-07-28">
+<meta name="articleTitle" value="Osquery watchdog">
 <meta name="description" value="Learn about how osquery process manages child processes and managed extensions in Fleet.">
-<meta name="navSection" value="Osquery management">
\ No newline at end of file
diff --git a/docs/Using Fleet/Puppet-module.md b/articles/puppet-module.md
similarity index 96%
rename from docs/Using Fleet/Puppet-module.md
rename to articles/puppet-module.md
index 30db545834e7..bf6a442bc14e 100644
--- a/docs/Using Fleet/Puppet-module.md	
+++ b/articles/puppet-module.md
@@ -151,7 +151,9 @@ if $err != '' {
 
 The above example includes the XML payload for the `EnableRemoteDesktop` MDM command. Learn more about creating the payload for other custom commands [here](./MDM-commands.md).
 
-<meta name="pageOrderInSection" value="1510">
-<meta name="title" value="Puppet module">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-05-24">
+<meta name="articleTitle" value="Puppet module">
 <meta name="description" value="Learn how to use Fleet's Puppet module to automatically assign custom configuration profiles on your macOS hosts.">
-<meta name="navSection" value="Device management">
diff --git a/docs/Using Fleet/Fleet-UI.md b/articles/queries.md
similarity index 73%
rename from docs/Using Fleet/Fleet-UI.md
rename to articles/queries.md
index 3ccd10d5e42e..0379bca00434 100644
--- a/docs/Using Fleet/Fleet-UI.md	
+++ b/articles/queries.md
@@ -1,18 +1,24 @@
-# Fleet UI
-- [Creating a query](#create-a-query)
-- [Running a query](#run-a-query)
-- [Scheduling a query](#schedule-a-query)
-- [Update agent options](#update-agent-options)
+# Queries
+
+Queries in Fleet allow you to ask questions to help you manage, monitor, and identify threats on your devices. This guide will walk you through how to create, schedule, and run a query.
+
+> Note: Unless a logging infrastructure is configured on your Fleet server, osquery-related logs will be stored locally on each device. Read more [here](https://fleetdm.com/guides/log-destinations)
+
+> New users may find it helpful to start with Fleet's policies. You can find policies and queries from the community in Fleet's [query library](https://fleetdm.com/queries). To learn more about policies, see [What are Fleet policies?](https://fleetdm.com/securing/what-are-fleet-policies) and [Understanding the intricacies of Fleet policies](https://fleetdm.com/guides/understanding-the-intricacies-of-fleet-policies).
+
+### In this guide:
+
+- [Create a query](#create-a-query)
+- [Run a query](#run-a-query)
+- [Schedule a query](#schedule-a-query)
 
 <div purpose="embedded-content">
    <iframe src="https://www.youtube.com/embed/1VNvg3_drow" allowfullscreen></iframe>
 </div>
 
-## Create a query
 
-Queries in Fleet allow you to ask a multitude of questions to help you manage, monitor, and identify threats on your devices. 
 
-If you're unsure of what to ask, head to Fleet's [query library](https://fleetdm.com/queries). There you'll find common queries that have been tested by members of our community.
+## Create a query
 
 How to create a query:
 
@@ -63,16 +69,10 @@ By default, queries that run on a schedule will only target platforms compatible
 
 > Note: When viewing a specific [team](https://fleetdm.com/docs/using-fleet/segment-hosts) in Fleet Premium, only queries that belong to the selected team will be listed. When configuring query automations for all hosts, only global queries will be listed.
 
-## Update agent options
-
-<!-- Heading is kept so that the link from the Fleet UI still works -->
-<span id="configuring-agent-options" name="configuring-agent-options"></span>
-
-> This content was relocated on 31st August 2023. 
-
-See "[Agent configuration](https://fleetdm.com/docs/configuration/agent-configuration)" to learn how to simultaneously update agent options from the Fleet UI or fleetctl command line tool.
 
-<meta name="title" value="Fleet UI">
-<meta name="pageOrderInSection" value="200">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-08-09">
+<meta name="articleTitle" value="Queries">
 <meta name="description" value="Learn how to create, run, and schedule queries, as well as update agent options in the Fleet user interface.">
-<meta name="navSection" value="The basics">
diff --git a/docs/Using Fleet/manage-access.md b/articles/role-based-access.md
similarity index 96%
rename from docs/Using Fleet/manage-access.md
rename to articles/role-based-access.md
index 5f9457988fde..95fc712c5252 100644
--- a/docs/Using Fleet/manage-access.md	
+++ b/articles/role-based-access.md
@@ -1,4 +1,4 @@
-# Manage access
+# Role-based access
 
 Users have different abilities depending on the access level they have.
 
@@ -83,7 +83,7 @@ GitOps is an API-only and write-only role that can be used on CI/CD pipelines.
 | View Apple business manager (BM) information                                                                                               |          |            |            | ✅    |         |
 | Generate Apple mobile device management (MDM) certificate signing request (CSR)                                                            |          |            |            | ✅    |         |
 | View disk encryption key for macOS and Windows hosts                                                                                       | ✅       | ✅         | ✅         | ✅    |         |
-| Edit OS updates for macOS and Windows hosts                                                                                                |          |            | ✅         | ✅    | ✅      |
+| Edit OS updates for macOS, Windows, iOS, and iPadOS hosts                                                                                                |          |            | ✅         | ✅    | ✅      |
 | Create, edit, resend and delete configuration profiles for macOS and Windows hosts                                                                  |          |            | ✅         | ✅    | ✅      |
 | Execute MDM commands on macOS and Windows hosts\**                                                                                         |          |            | ✅         | ✅    |         |
 | View results of MDM commands executed on macOS and Windows hosts\**                                                                        | ✅       | ✅         | ✅         | ✅    |         |
@@ -92,10 +92,9 @@ GitOps is an API-only and write-only role that can be used on CI/CD pipelines.
 | View all [MDM settings](https://fleetdm.com/docs/using-fleet/mdm-macos-settings)                                                           |          |            |            | ✅    | ✅      |
 | Edit setup experience (end user authentication, bootstrap package, Setup Assistant)\*                                                                                         |          |            | ✅             | ✅    | ✅          |
 | Edit end user license agreement (EULA)\*                                                                                         |          |            |              | ✅    |         |
-| Run arbitrary scripts on hosts                                                                                                             |          |            | ✅         | ✅    |         |
-| View saved scripts                                                                                                                         | ✅       | ✅         | ✅         | ✅    |         |
-| Edit/upload saved scripts                                                                                                                  |          |            | ✅         | ✅    | ✅      |
-| Run saved scripts on hosts                                                                                                                 | ✅       | ✅         | ✅         | ✅    |         |
+| Run scripts on hosts                                                                                                                       |          |            | ✅         | ✅    |         |
+| View saved scripts\*                                                                                                                       | ✅       | ✅         | ✅         | ✅    |         |
+| Edit/upload saved scripts\*                                                                                                                |          |            | ✅         | ✅    | ✅      |
 | Lock, unlock, and wipe hosts\*                                                                                                             |          |            | ✅         | ✅    |         |
 
 \* Applies only to Fleet Premium
@@ -155,7 +154,7 @@ Users with access to multiple teams can be assigned different roles for each tea
 | Edit agent options                                    |               |                |                 | ✅         | ✅          |
 | Initiate [file carving](https://fleetdm.com/docs/using-fleet/rest-api#file-carving)                                              |               |                | ✅              | ✅         |             |
 | View disk encryption key for macOS hosts                                                                                         | ✅            | ✅             | ✅              | ✅         |             |
-| Edit OS updates for macOS and Windows hosts                                                                                                |          |            | ✅         | ✅    | ✅      |
+| Edit OS updates for macOS, Windows, iOS, and iPadOS hosts                                                                                                |          |            | ✅         | ✅    | ✅      |
 | Create, edit, resend and delete configuration profiles for macOS and Windows hosts                                                        |               |                | ✅              | ✅         | ✅          |
 | Execute MDM commands on macOS and Windows hosts*                                                                                 |               |                | ✅              | ✅         |             |
 | View results of MDM commands executed on macOS and Windows hosts*                                                                | ✅            | ✅             | ✅              | ✅         |             |
@@ -165,10 +164,9 @@ Users with access to multiple teams can be assigned different roles for each tea
 | View metadata of MDM macOS bootstrap packages                                                                                    |               |                | ✅              | ✅         |             |
 | Edit/upload MDM macOS bootstrap packages                                                                                         |               |                | ✅              | ✅         | ✅          |
 | Enable/disable MDM macOS setup end user authentication                                                                           |               |                | ✅              | ✅         | ✅          |
-| Run arbitrary scripts on hosts                                                                                                   |               |                | ✅              | ✅         |             |
+| Run scripts on hosts                                                                                                             |               |                | ✅              | ✅         |             |
 | View saved scripts                                                                                                               | ✅            | ✅             | ✅              | ✅         |             |
 | Edit/upload saved scripts                                                                                                        |               |                | ✅              | ✅         |             |
-| Run saved scripts on hosts                                                                                                       | ✅            | ✅             | ✅              | ✅         |             |
 | View script details by host                                                                                                      | ✅            | ✅             | ✅              | ✅         |             |
 | Lock, unlock, and wipe hosts                                                                                                     |               |                | ✅              | ✅         |             |
 
@@ -177,6 +175,9 @@ Users with access to multiple teams can be assigned different roles for each tea
 
 \** Team-level users only see global query results for hosts on teams where they have access.
 
-<meta name="pageOrderInSection" value="900">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-08-10">
+<meta name="articleTitle" value="Role-based access">
 <meta name="description" value="Learn about the different roles and permissions in Fleet.">
-<meta name="navSection" value="The basics">
diff --git a/docs/Using Fleet/Scripts.md b/articles/scripts.md
similarity index 88%
rename from docs/Using Fleet/Scripts.md
rename to articles/scripts.md
index 7adb2c057d68..754fdf4da9d7 100644
--- a/docs/Using Fleet/Scripts.md	
+++ b/articles/scripts.md
@@ -19,7 +19,7 @@ If you don't use MDM features, to enable scripts, we'll deploy a fleetd agent wi
 
 2. Deploy fleetd to your hosts. If your hosts already have fleetd installed, you can deploy the new fleetd on-top of the old installation.
 
-Learn more about generating a fleetd agent and deploying it [here](./enroll-hosts.md).
+Learn more about generating a fleetd agent and deploying it [here](https://fleetdm.com/guides/enroll-hosts).
 
 ## Execute a script
 
@@ -45,7 +45,9 @@ fleetctl CLI:
 fleetctl run-script --script-path=/path/to/script --host=hostname
 ```
 
-<meta name="pageOrderInSection" value="1508">
-<meta name="title" value="Scripts">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-06-04">
+<meta name="articleTitle" value="Scripts">
 <meta name="description" value="Learn how to execute a custom script on macOS, Windows, and Linux hosts in Fleet.">
-<meta name="navSection" value="Device management">
diff --git a/articles/seamless-mdm-migration.md b/articles/seamless-mdm-migration.md
new file mode 100644
index 000000000000..9abf3c516c4f
--- /dev/null
+++ b/articles/seamless-mdm-migration.md
@@ -0,0 +1,133 @@
+# Seamless MDM migrations to Fleet
+
+![Seamless MDM migrations to Fleet](../website/assets/images/articles/seamless-mdm-migration-1600x900@2x.png)
+
+Migrating macOS devices between Mobile Device Management (MDM) solutions is often fraught with challenges, including potential gaps in device management, user disruption, and compliance issues. Traditional MDM migrations typically require end-user interaction and leave devices unmanaged for a period, leading to problems like Wi-Fi disconnections due to certificate profile removal and incomplete migrations. These challenges can force organizations to stay with outdated MDM solutions that no longer meet their needs. But there’s a better way.
+
+Seamless MDM migrations are now possible, allowing organizations to transition their macOS devices to Fleet without any downtime or end-user involvement. By leveraging Fleet, you can ensure that your devices remain fully managed and compliant throughout the migration process. This means no more gaps in management, no user disruptions, and a smoother path to a more modern and effective MDM solution.
+
+This guide will walk you through the entire process of migrating your MDM deployment to Fleet. You’ll start by understanding the specific requirements for a seamless migration, followed by configuring Fleet with the necessary certificates and database records. The guide will then take you through the process of installing Fleet’s agent (`fleetd`) on your devices, updating DNS records to redirect devices to the Fleet server, and finally, decommissioning your old MDM server.
+
+Throughout the guide, you’ll find practical advice and best practices to ensure a smooth transition with minimal risk. By the end, you’ll be equipped with the knowledge and tools to execute a seamless MDM migration to Fleet, ensuring that your organization’s devices are securely managed without the typical headaches associated with a traditional MDM switch.
+
+## Requirements
+
+Note: Deployments that do not meet these seamless migration requirements can still migrate with the [standard MDM migration process](https://fleetdm.com/docs/using-fleet/mdm-migration-guide).
+
+* Customer controls the DNS used in the MDM server enrollment (eg. devices are enrolled to `*.customerowneddomain.com`, not `*.mdmvendor.com`).
+* Customer has access to the Apple Push Notification Service (APNS) certificate/key and SCEP certificate/key, or access to the MDM server database to extract these values.
+
+These requirements are easily met in self-hosted open-source MDM solutions and may be met with commercial solutions when the customer is self-hosting or otherwise controls the DNS.
+
+Seamless migration may still be possible with control of DNS along with a copy of the original Certificate Signing Request (CSR) for the APNS certificate. If you are in this situation, please reach out to the Fleet team.
+
+### Why?
+
+Apple allows changing most values in profiles delivered by MDM, but the `ServerURL`, `CheckinURL`, and `PushTopic` cannot be changed without re-enrollment (and user actions). Control of DNS and the certificates allows the MDM to be swapped out without changing these.
+
+## High-level process
+
+1. Configure Fleet with the APNS & SCEP certificates/keys, path redirects, and SCEP renewal.
+2. Import database records letting Fleet know about the devices to be migrated.
+3. Configure controls (profiles, updates, etc.) in Fleet.
+4. Install `fleetd` on the devices (through the existing MDM).
+5. Update DNS records to point devices to the Fleet server.
+6. Decommission the old server.
+
+It is recommended to follow the entire process on a staging/test MDM instance and devices, then repeat for the production instance and devices.
+
+[![Before migration](https://mermaid.ink/img/pako:eNpVUctuwjAQ_BVrT62URIaEvFRxqNKeSivBrZiDiTeJpdhGxqFQBN9eA23VXvY1o9lZ7RFqIxBKCMOQaSddjyV5xMZYJEq2ljtpNNNXtOnNR91x68jLnOntsPbwpiOK128LUuFO1sg0IUqoupeo3XJWzcitXDGNWjD9i5EwJHMzOBRkfSDV64I8rO2U3HlChHuuNj1GtVH3YTg1vfBTpm95-bSXWyd1Sy7qC7Q7tKu_wufzmTQ9orsY9mn5fIk_TAhAoVVcCn_z8WKXgetQIYPSlwIbPvSOAdMnT-WDM4uDrqF0dsAAho3gDivJ_eUKyob3Wz_dcP1uzL8eyiPsoRzTOBrHySim2SQtaBbAAco4S6NxTmmeZcUoLiZJfArg8ypAo5SOKC3iNM-LNMmTJAAU0hk7u32pNrqRrXdmzdB23xtPX3Gkloc?type=png)](https://mermaid.live/edit#pako:eNpVUctuwjAQ_BVrT62URIaEvFRxqNKeSivBrZiDiTeJpdhGxqFQBN9eA23VXvY1o9lZ7RFqIxBKCMOQaSddjyV5xMZYJEq2ljtpNNNXtOnNR91x68jLnOntsPbwpiOK128LUuFO1sg0IUqoupeo3XJWzcitXDGNWjD9i5EwJHMzOBRkfSDV64I8rO2U3HlChHuuNj1GtVH3YTg1vfBTpm95-bSXWyd1Sy7qC7Q7tKu_wufzmTQ9orsY9mn5fIk_TAhAoVVcCn_z8WKXgetQIYPSlwIbPvSOAdMnT-WDM4uDrqF0dsAAho3gDivJ_eUKyob3Wz_dcP1uzL8eyiPsoRzTOBrHySim2SQtaBbAAco4S6NxTmmeZcUoLiZJfArg8ypAo5SOKC3iNM-LNMmTJAAU0hk7u32pNrqRrXdmzdB23xtPX3Gkloc)
+
+[![After migration](https://mermaid.ink/img/pako:eNpVUcFuwjAM_ZXIu2xSW7XQdaWakCYxTmOT4DayQ0jcNqJJUEgZDMG3L6Vs2g5JbL9n-9k5AjcCoYAwDKl20jVYkKfSoSVKVpY5aTTVF7BszCevmXXkZU71tl15eFMTxfjbgkxwJzlSTYgSijcStVvOJjPSmx9UoxZUm0Z4ePm8l1sndUU6xgLtDq1n_CaS8_lMeurfaBiSuWkdCrI6kMnrgjyu7JjcekKEe6Y2DUbcqLswHJcNousE-2c57e6fLhCAQquYFH7kYyeXgqtRIYXCm42sakch6AHB7Hrmt9NhJWu2eI2vGF9X1rR-okvWzXQ6pUD1yVdnrTOLg-ZQONtiAO1GMIcTyfyyFBR9Gdgw_W7MPx-KI-yhSPI8GgzTJE2T-GGU5UkABygGeRz5k8SDJL8fpGmcnQL4ulSIo8zH49Ewy_NRluZpGgAK6Yyd9R_LjS5l5aV5xVV9bXn6BriRpdY?type=png)](https://mermaid.live/edit#pako:eNpVUcFuwjAM_ZXIu2xSW7XQdaWakCYxTmOT4DayQ0jcNqJJUEgZDMG3L6Vs2g5JbL9n-9k5AjcCoYAwDKl20jVYkKfSoSVKVpY5aTTVF7BszCevmXXkZU71tl15eFMTxfjbgkxwJzlSTYgSijcStVvOJjPSmx9UoxZUm0Z4ePm8l1sndUU6xgLtDq1n_CaS8_lMeurfaBiSuWkdCrI6kMnrgjyu7JjcekKEe6Y2DUbcqLswHJcNousE-2c57e6fLhCAQquYFH7kYyeXgqtRIYXCm42sakch6AHB7Hrmt9NhJWu2eI2vGF9X1rR-okvWzXQ6pUD1yVdnrTOLg-ZQONtiAO1GMIcTyfyyFBR9Gdgw_W7MPx-KI-yhSPI8GgzTJE2T-GGU5UkABygGeRz5k8SDJL8fpGmcnQL4ulSIo8zH49Ewy_NRluZpGgAK6Yyd9R_LjS5l5aV5xVV9bXn6BriRpdY)
+
+### 1. Configure Fleet
+
+The Fleet server must be configured with the APNS & SCEP certificates/keys copied from the existing server. This is done via manual modification of the Fleet database and configurations. The Fleet team will perform this configuration on Fleet Cloud instances and can advise how to do it on self-hosted Fleet instances.
+
+In most cases, the paths (portion of the URL after the domain name) used in the enrollment profile `ServerURL`, `CheckInURL` and SCEP URL will differ from those used by Fleet. The Fleet Server load balancer must be configured to redirect the MDM client via HTTP 3xx redirects.
+
+[Apple's documentation](https://developer.apple.com/documentation/devicemanagement/implementing_device_management/sending_mdm_commands_to_a_device?language=objc) states:
+
+> MDM follows HTTP 3xx redirections without user interaction. However, it doesn’t save the URL given by HTTP 301 (Moved Permanently) redirections. Each transaction begins at the URL the MDM payload specifies.
+
+Therefore, redirects must remain as long as migrated devices are enrolled.
+
+For a typical MicroMDM to Fleet migration, the following redirects are used:
+
+| From (MicroMDM path) | To (Fleet path) |
+| -------------------- | --------------- |
+| /mdm/checkin         | /mdm/apple/mdm  |
+| /mdm/connect         | /mdm/apple/mdm  |
+| /scep                | /mdm/apple/scep |
+
+SCEP certificate renewals need special handling for migrated devices. This is configured (by, or with guidance from the Fleet team) in the server using the [`FLEET_SILENT_MIGRATION_ENROLLMENT_PROFILE` environment variable](https://github.com/fleetdm/fleet/pull/20063). When configured, migrated devices receive an enrollment profile with matching keys when SCEP renewal comes due (migrated devices reject the typical profile Fleet sends because it includes the new server URL).
+
+### 2. Import database records
+
+The Fleet server is made aware of the devices that will be migrated by inserting records into the database. The Fleet team will perform this operation in Fleet Cloud and can advise for self-hosted instances.
+
+For MicroMDM, a [migration script](https://github.com/fleetdm/fleet/pull/18151) has been made that will generate the necessary SQL statements from the MicroMDM database.
+
+For other MDM solutions, please work with the Fleet team to generate the appropriate records.
+
+### 3. Configure controls
+
+Next, configure the controls that will be applied to migrated devices. Use the Teams features in Fleet Premium to apply different configurations to different devices.
+
+In particular,
+
+* [Configuration profiles](https://fleetdm.com/docs/using-fleet/mdm-custom-os-settings#custom-os-settings)
+* [OS updates](https://fleetdm.com/docs/using-fleet/mdm-os-updates)
+* [Disk encryption](https://fleetdm.com/docs/using-fleet/mdm-disk-encryption)
+
+When the device checks in after migration, Fleet will send the full set of configuration profiles configured for that device's team. Any profiles with identifiers matching existing profiles on the device will be updated in place.
+
+Fleet will not send commands to remove profiles that have not been configured in Fleet. Either remove these profiles before migration in the existing MDM before migration or use `fleetctl` or the Fleet API to send an MDM command to remove any undesired profiles.
+
+OS update configurations will apply automatically after the device is migrated.
+
+As of Fleet 4.55, disk encryption keys will automatically be re-escrowed after migration the next time the user logs into their device.
+
+### 4. Install `fleetd`
+
+Install `fleetd` on the devices to migrate. Devices with `fleetd` installed will begin to show up in the Fleet UI (with profiles in a "Pending" state).
+
+Generate `.pkg` packages following the [standard enrollment documentation](https://fleetdm.com/docs/using-fleet/enroll-hosts). Install the package using the existing MDM or any other management tool.
+
+Devices are automatically assigned to Teams in Fleet based on the package they are provided, so be sure to distribute packages that assign devices to teams with the relevant configurations.
+
+### 5. Update DNS
+
+Devices are now communicating with the Fleet server via the `fleetd` agent. They have not yet migrated MDM servers.
+
+Ensure the Fleet server load balancer can terminate HTTPS using the existing server hostname. This typically involves issuing a certificate [with AWS ACM](https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-request-public.html). In Fleet Cloud, the Fleet team will ask the customer team to update a DNS record for verification so that AWS can issue the certificate.
+
+Now the customer updates DNS to point the existing domain to the Fleet server load balancer. This typically involves setting a `CNAME` record with the hostname of the load balancer (eg. `mdm.example.com -> fleet-cloud-alb-1723349272.us-east-2.elb.amazonaws.com`).
+
+Devices will begin checking in with the Fleet server and receiving new configurations.
+
+### 6. Decommission the old server
+
+At this point, the migration is complete. The old server can be decommissioned.
+
+Keep a database backup of the old server on hand in case it is ever needed for reference or recovery.
+
+## Gradual migration
+
+In the process described, when we update DNS all of the devices are migrated immediately. To minimize risk, it is often desired to gradually migrate devices.
+
+Fleet has created a [migration proxy](https://github.com/fleetdm/fleet/tree/main/tools/mdm/migration/mdmproxy) that can be used to gradually migrate specific devices and/or a percentage of devices. This allows a staged migration with progressively more devices migrated.
+
+## Conclusion
+
+Seamless MDM migrations on macOS are not just possible but are a significant step forward in maintaining a secure and compliant environment without disrupting end users. By following this guide, you can transition from your existing MDM solution to Fleet smoothly, keeping your devices managed and secure throughout the process. If you encounter any challenges, the Fleet team is ready to assist you, ensuring your migration is successful.
+
+For organizations ready to take control of their MDM strategy, this seamless migration process is an opportunity to upgrade to a modern, flexible, and secure management solution. We encourage you to reach out for support or further explore the robust features Fleet offers to enhance your device management capabilities.
+
+<meta name="category" value="guides">
+<meta name="authorFullName" value="Zach Wasserman">
+<meta name="authorGitHubUsername" value="zwass">
+<meta name="publishedOn" value="2024-08-08">
+<meta name="articleTitle" value="Seamless MDM migrations to Fleet">
+<meta name="articleImageUrl" value="../website/assets/images/articles/seamless-mdm-migration-1600x900@2x.png">
+<meta name="description" value="This guide provides a process for seamlessly migrating macOS devices from an existing MDM solution to Fleet.">
diff --git a/articles/software-self-service.md b/articles/software-self-service.md
new file mode 100644
index 000000000000..f82a27f8c867
--- /dev/null
+++ b/articles/software-self-service.md
@@ -0,0 +1,80 @@
+# Software self-service
+
+![Software self-service](../website/assets/images/articles/software-self-service-1600x900@2x.png)
+
+Fleet’s self-service software feature empowers end users by allowing them to independently install approved software packages from a curated list through the Fleet Desktop “My device” page. This not only reduces the administrative burden on IT teams but also enhances user productivity and satisfaction. In this guide, we will walk you through the process of uploading, editing, and managing self-service software packages in Fleet, enabling seamless software distribution and management.
+
+## Prerequisites
+
+* Fleet Premium is required for software self-service.
+
+> Software packages can be added to a specific team or to the "No team" category. The "No team" category is the default assignment for hosts that are not part of any specific team.
+
+## Step-by-Step Instructions
+
+### Adding a self-service software package
+
+1. **Navigate to the Software page**: Click “Software” in the main navigation menu.
+2. **Select a team**: Click the dropdown in the upper left corner of the page and click on the team to which you want to add the software package.
+3. **Open the “Add software” modal**: Click the “Add software” button in the upper right corner of the page.
+4. **Select a software package to upload**: Click “Choose file” in the “Add software” modal and select a software package from your computer.
+5. **Advanced options**: If desired, click “Advanced options” to add a pre-install condition or post-install script to your software package.
+    * **Pre-install condition**: This is an osquery query that results in true. For example, you might require a specific software title to exist before installing additional extensions.
+    * **Post-install script**: This might be used to apply a license key, perform configuration tasks, or execute cleanup tasks after the software installation.
+6. **Make the software package self-service**: Check the “Self-service” checkbox to mark the software package as self-service.
+7. **Finish the upload**: Click the “Add software” button to finish the upload process.
+
+### Editing a self-service software package
+
+1. **Navigate to the software details page for the software package**: Click “Software” in the main navigation menu.
+2. **Select a team**: Click the dropdown in the upper left corner of the page and click on the team to which you added the software package.
+3. **Filter by self-service**: To make it easier to find your software package, click on the dropdown to the left of the search bar and select “Self-service”. This will filter the results in the table to only show self-service software packages. If you still don’t see your software package, you can page through the results or search for your software package’s name in the search bar.
+4. **Open the details page**: Click on the software package’s name. 
+5. **Open the actions dropdown**: Click on the “Actions” dropdown on the far right of the page. From here, you can download the software package, delete the software package, or click “Advanced options” to see the options you configured when adding the software package. 
+
+### Downloading a self-service software package
+
+1. **Navigate to the software details page for the software package**: Click “Software” in the main navigation menu.
+2. **Select a team**: Click the dropdown in the upper left corner of the page and click on the team to which you added the software package.
+3. **Filter by self-service**: Click on the dropdown to the left of the search bar and select “Self-service” and page through the results or search for your software package’s name in the search bar.
+4. **Download the software package**:
+* **Option 1**: Click on the down-arrow next to the software package name in the list of self-service software packages to start an immediate download.
+* **Option 2**: Click on the software package’s name to open the details page. Click on the “Actions” dropdown on the far right of the page, and then click on “Download” to download the software package to your computer.
+
+### Deleting a self-service software package
+
+1. **Navigate to the software details page for the software package**: Click “Software” in the main navigation menu.
+2. **Select a team**: Click the dropdown in the upper left corner of the page and click on the team to which you added the software package.
+3. **Filter by self-service**: Click on the dropdown to the left of the search bar and select “Self-service” and page through the results or search for your software package’s name in the search bar.
+4. **Open the details page**: Click on the software package’s name.
+5. **Open the actions dropdown**: Click on the “Actions” dropdown on the far right of the page.
+6. **Delete the software package**: Click on “Delete” to remove the software package from Fleet. Confirm the deletion if prompted.
+
+### Installing self-service software packages
+
+To install the self-service software package on the host:
+
+1. **Navigate to the “Self-service” tab**: Click on the Fleet Desktop icon in the OS menu bar. Click “Self-service”. This will point your default web browser to the list of self-service software packages in the “My device” page.
+2. **Install the self-service software package**: Click the “Install” button for the software package you want to install.
+
+### Using the REST API for self-service software packages
+
+Fleet provides a REST API for managing software packages, including self-service software packages.  Learn more about Fleet's [REST API](https://fleetdm.com/docs/rest-api/rest-api#software).
+
+### Managing self-service software packages with GitOps
+
+To manage self-service software packages using Fleet's best practice GitOps, check out the `software` key in the [GitOps reference documentation](https://fleetdm.com/docs/using-fleet/gitops#software).
+
+> Note: with GitOps enabled, software packages uploaded using the web UI will not persist.
+
+## Conclusion
+
+Fleet’s self-service software feature not only simplifies software management for IT administrators but also empowers end users by giving them access to necessary software on demand. This feature ensures that your hosts remain secure while improving overall user experience. For further information and advanced management techniques, refer to Fleet's [REST API](https://fleetdm.com/docs/rest-api/rest-api#software) and [GitOps](https://fleetdm.com/docs/using-fleet/gitops#software) documentation. 
+
+<meta name="articleTitle" value="Software self-service">
+<meta name="authorFullName" value="Jahziel Villasana-Espinoza">
+<meta name="authorGitHubUsername" value="jahzielv">
+<meta name="category" value="guides">
+<meta name="publishedOn" value="2024-08-06">
+<meta name="articleImageUrl" value="../website/assets/images/articles/software-self-service-1600x900@2x.png">
+<meta name="description" value="This guide will walk you through adding apps to Fleet for user self-service.">
diff --git a/docs/01-Using-Fleet/standard-query-library/README.md b/articles/standard-query-library.md
similarity index 87%
rename from docs/01-Using-Fleet/standard-query-library/README.md
rename to articles/standard-query-library.md
index fc3f3bfdc11c..7bbdd52bf218 100644
--- a/docs/01-Using-Fleet/standard-query-library/README.md
+++ b/articles/standard-query-library.md
@@ -47,4 +47,9 @@ Listed below are great resources that contain additional queries.
 - Osquery (https://github.com/osquery/osquery/tree/master/packs)
 - Palantir osquery configuration (https://github.com/palantir/osquery-configuration/tree/master/Fleet)
 
-<meta name="navSection" value="The basics">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-04-04">
+<meta name="articleTitle" value="Standard query library">
+<meta name="description" value="Learn how to use and contribute to Fleet's standard query library.">
diff --git a/docs/Using Fleet/segment-hosts.md b/articles/teams.md
similarity index 51%
rename from docs/Using Fleet/segment-hosts.md
rename to articles/teams.md
index 1047ee4dbbe7..ea688bc08b0c 100644
--- a/docs/Using Fleet/segment-hosts.md	
+++ b/articles/teams.md
@@ -1,8 +1,8 @@
-# Segment hosts
+# Teams
 
 _Available in Fleet Premium_
 
-In Fleet, you can group hosts together in a "team" in Fleet. This way, you can apply queries, policies, scripts, and more that are tailored to the hosts' risk/compliance needs.
+In Fleet, you can group hosts together in a "team" in Fleet. This way, you can apply queries, policies, scripts, and more that are tailored to a host's risk/compliance needs.
 
 A host can only belong to one team. 
 
@@ -13,12 +13,14 @@ You can manage teams by selecting your avatar in the top navigation and then **S
 ## Best practice
 
 Fleet's best practice teams: 
-- `Workstations`: End user's production work computers (macOS, Windows, and Linux)
-- `Workstations (canary)`: IT team's test work computers. Sometimes, for demos or testing, includes end user's work computers. Used for [dogfooding](https://en.wikipedia.org/wiki/Eating_your_own_dog_food) a new workflow or feature that may or may not be rolled out to the "Workstations" team.
-- `Servers`: Security team's production servers.
-- `Servers (canary)`: Security team's test servers.
+- `💻 Workstations`: End users' production work computers (macOS, Windows, and Linux)
+- `💻🐣 Workstations (canary)`: IT team's test work computers. Sometimes, for demos or testing, includes end user's work computers. Used for [dogfooding](https://en.wikipedia.org/wiki/Eating_your_own_dog_food) a new workflow or feature that may or may not be rolled out to the "Workstations" team.
+- `☁️ Servers`: Security team's production servers.
+- `☁️🐣 Servers (canary)`: Security team's test servers.
 - `Compliance exclusions`: All contributors' test work computers or virtual machines (VMs). Used for validating workflows for Fleet customers or reproducing bugs in the Fleet product.
-- `iPhones`: All contributors' test iOS hosts. Used to dogfood Fleet's iOS features (coming soon).
+- `📱🏢 Company-owned iPhones`: iPhones purchased by the organization that enroll to Fleet automatically via Apple Business Manager. For example, iPhones used by iOS Engineers.
+- `🔳🏢 Company-owned iPads`: iPads purchased by the organization that enroll to Fleet automatically via Apple Business Manager. For example, conference-room iPads.
+<!--- - `📱👔 BYOD iPhones`: End users' personal iPhones that have access to company resources. For example, Slack and Gmail. contributors' test iOS hosts. (BYOD iPhone features are coming soon) -->
 
 If some of your hosts don't fall under the above teams, what are these hosts for? The answer determines the the hosts' risk/compliance needs, and thus their security basline, and thus their "team" in Fleet. If the hosts' have a different compliance needs, and thus different security baseline, then it's time to create a new team in Fleet.
 
@@ -28,10 +30,13 @@ You can add hosts to a new team in Fleet by either enrolling the host with a tea
 
 ## Advanced
 
-You can automatically enroll hosts to a specific team in Fleet by installing a fleetd with a team enroll secret. Learn more [here](./enroll-hosts.md#enroll-host-to-a-specific-team).
+You can automatically enroll hosts to a specific team in Fleet by installing a fleetd with a team enroll secret. Learn more [here](https://fleetdm.com/guides/enroll-hosts#enroll-host-to-a-specific-team).
 
 Changing the host's enroll secret after enrollment will not cause the host to be transferred to a different team.
 
-<meta name="pageOrderInSection" value="1000">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-07-11">
+<meta name="articleTitle" value="Teams">
 <meta name="description" value="Learn how to group hosts in Fleet to apply specific queries, policies, and agent options using teams.">
-<meta name="navSection" value="The basics">
diff --git a/docs/Using Fleet/Vulnerability-Processing.md b/articles/vulnerability-processing.md
similarity index 51%
rename from docs/Using Fleet/Vulnerability-Processing.md
rename to articles/vulnerability-processing.md
index 2217919782f6..610bd51347dc 100644
--- a/docs/Using Fleet/Vulnerability-Processing.md	
+++ b/articles/vulnerability-processing.md
@@ -1,7 +1,5 @@
 # Vulnerability processing
 
-## Introduction
-
 Vulnerability processing in Fleet detects vulnerabilities (CVEs) for the software installed on your hosts. 
 
 To see what software is covered, check out the [Coverage section](#coverage).
@@ -16,16 +14,27 @@ To see what software is covered, check out the [Coverage section](#coverage).
 
 Fleet detects vulnerabilities for these software types:
 
-| Type                | macOS                                      | Windows                                          | Linux            |
-| ------------------- | ------------------------------------------ | ------------------------------------------------ | ---------------- |
-| Apps                | ✅                                         | ✅                                               | ❌               |
-| Browser plugins     | Chrome extensions, Firefox extensions      | Chrome extensions, Firefox extensions            | ❌               |
-| Packages            | Python, Homebrew  | Python, Atom, Chocolatey | Packages defined in the [OVAL definitions](https://github.com/fleetdm/nvd/blob/master/oval_sources.json), except for vulnerabilities involving configuration files. Supported distributions: <ul><li>Ubuntu</li><li>RHEL based distros (Red Hat, CentOS, Fedora, and Amazon Linux)</li></ul> |
-| IDE extensions      | VS Code extensions | VS Code extensions | VS Code extensions |
+| Type                | macOS                                      | Windows                                          | Linux                                                                                                                                                                                                                                                                                                                                                  |
+| ------------------- | ------------------------------------------ | ------------------------------------------------ |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Apps                | ✅                                         | ✅                                               | ❌                                                                                                                                                                                                                                                                                                                                                      |
+| Browser plugins     | Chrome extensions, Firefox extensions      | Chrome extensions, Firefox extensions            | ❌                                                                                                                                                                                                                                                                                                                                                      |
+| Packages            | Python, Homebrew  | Python, Atom, Chocolatey | <p>For Ubuntu, Debian, RHEL (including CentOS), and Fedora: packages defined in the [OVAL definitions](https://github.com/fleetdm/nvd/blob/master/oval_sources.json), except for vulnerabilities involving configuration files.</p><p>For Amazon Linux, packages maintained by Amazon by checking [ALAS advisories](https://alas.aws.amazon.com/).</p> |
+| IDE extensions      | VS Code extensions | VS Code extensions | VS Code extensions                                                                                                                                                                                                                                                                                                                                     |
 
 As of right now, only app names with all ASCII characters are supported. Apps with names featuring non-ASCII characters, such as Cyrillic, will not generate matches.
 
-### Advanced configuration
+For Ubuntu Linux, kernel vulnerabilities with known variants (ie. `-generic`) are detected using OVAL. Custom kernels (unknown variants) are detected using NVD.
+
+## Sources
+
+Fleet combines multiple sources to get accurate and up-to-date CVE information:
+- [National Vulnerability Database](https://nvd.nist.gov/developers/vulnerabilities) CVE feeds
+- [VulnCheck](https://vulncheck.com/) CVE feeds
+- [Mac Office release notes](https://learn.microsoft.com/en-us/officeupdates/release-notes-office-for-mac) for Office for Mac
+- [Microsoft MSRC Security Bulletins](https://msrc.microsoft.com/update-guide) for Windows OS vulnerabilities
+- [OVAL definitions](https://github.com/fleetdm/nvd/blob/master/oval_sources.json) for Linux software
+
+## Advanced configuration
 
 Fleet runs vulnerability downloading and processing via internal scheduled cron job. This internal mechanism is very useful
 for frictionless deployments and is well suited for most use cases. However, in larger deployments,
@@ -61,6 +70,9 @@ command.
 fleet vuln_processing
 ```
 
-<meta name="pageOrderInSection" value="1300">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-07-12">
+<meta name="articleTitle" value="Vulnerability processing">
 <meta name="description" value="Find out how Fleet detects vulnerabilities and what software it covers.">
-<meta name="navSection" value="Vuln management">
diff --git a/articles/windows-mdm-setup.md b/articles/windows-mdm-setup.md
index 1fb36f3bf6a8..87188e11ee11 100644
--- a/articles/windows-mdm-setup.md
+++ b/articles/windows-mdm-setup.md
@@ -10,7 +10,7 @@ To use automatic enrollment (aka zero-touch) features on Windows, follow instruc
 
 ### Step 1: Generate your certificate and key
 
-Fleet uses a certificate and key pair to authenticate and manage interactions between Fleet and Windows host.
+Fleet uses a certificate and key pair to authenticate and manage interactions between the Fleet server and a Windows host.
 
 How to generate a certificate and key:
 
diff --git a/assets/images/iPadOS-install-profile.png b/assets/images/iPadOS-install-profile.png
new file mode 100644
index 000000000000..c398038517f7
Binary files /dev/null and b/assets/images/iPadOS-install-profile.png differ
diff --git a/assets/images/iPadOS-profile-downloaded.png b/assets/images/iPadOS-profile-downloaded.png
new file mode 100644
index 000000000000..f21b12615f70
Binary files /dev/null and b/assets/images/iPadOS-profile-downloaded.png differ
diff --git a/assets/images/ios-install-profile.png b/assets/images/ios-install-profile.png
new file mode 100644
index 000000000000..8266c55201eb
Binary files /dev/null and b/assets/images/ios-install-profile.png differ
diff --git a/assets/images/ios-profile-downloaded.png b/assets/images/ios-profile-downloaded.png
new file mode 100644
index 000000000000..7941a6581557
Binary files /dev/null and b/assets/images/ios-profile-downloaded.png differ
diff --git a/assets/images/ios-updates-preview.png b/assets/images/ios-updates-preview.png
new file mode 100644
index 000000000000..c5873b8621bb
Binary files /dev/null and b/assets/images/ios-updates-preview.png differ
diff --git a/assets/images/ipados-updates-preview.png b/assets/images/ipados-updates-preview.png
new file mode 100644
index 000000000000..8a08399807c5
Binary files /dev/null and b/assets/images/ipados-updates-preview.png differ
diff --git a/changes/13157-fv-escrow b/changes/13157-fv-escrow
new file mode 100644
index 000000000000..e6804a05ec4b
--- /dev/null
+++ b/changes/13157-fv-escrow
@@ -0,0 +1 @@
+* `fleetd` now uses Escrow Buddy to rotate FileVault keys. Internal API endpoints documented in the API for contributors have been modified and/or removed.
diff --git a/changes/16866-ade-force-filevault b/changes/16866-ade-force-filevault
new file mode 100644
index 000000000000..4486357bf558
--- /dev/null
+++ b/changes/16866-ade-force-filevault
@@ -0,0 +1,2 @@
+- Adds enforcement of FileVault during the MacOS Setup Assistant process for hosts that are enrolled
+into teams (or no team) with disk encryption turned on.
\ No newline at end of file
diff --git a/changes/17249-mysql-8 b/changes/17249-mysql-8
new file mode 100644
index 000000000000..b3948968cf08
--- /dev/null
+++ b/changes/17249-mysql-8
@@ -0,0 +1,2 @@
+* Drop support for MySQL 5.7
+* Minimum requirements raised to MySQL 8.0
diff --git a/changes/17379-live-query-caching b/changes/17379-live-query-caching
new file mode 100644
index 000000000000..949252299593
--- /dev/null
+++ b/changes/17379-live-query-caching
@@ -0,0 +1 @@
+- Increased performance of live queries to accommodate for higher volumes when utilizing zero-trust workflows
\ No newline at end of file
diff --git a/changes/18239-delete-secret-copy b/changes/18239-delete-secret-copy
deleted file mode 100644
index de416369ae91..000000000000
--- a/changes/18239-delete-secret-copy
+++ /dev/null
@@ -1 +0,0 @@
-* Update UI's delete secret link
\ No newline at end of file
diff --git a/changes/1845-linux-arm64 b/changes/1845-linux-arm64
new file mode 100644
index 000000000000..6ebb53ff6380
--- /dev/null
+++ b/changes/1845-linux-arm64
@@ -0,0 +1,2 @@
+* Added support for generating fleetd packages for Linux ARM64
+* fleetctl: New `fleetctl package` --arch flag
diff --git a/changes/18471-gitops-rename-team b/changes/18471-gitops-rename-team
deleted file mode 100644
index 4699cabbfd76..000000000000
--- a/changes/18471-gitops-rename-team
+++ /dev/null
@@ -1,3 +0,0 @@
-- `fleetctl gitops` can now be used to rename teams -- simply change the team name in the YAML file
-  - The team name is changed if the YAML config is applied from the same filename as before
-  - `fleetctl gitops` needs to have previously run with this Fleet/fleetctl version or later
diff --git a/changes/18554-store-and-show-next-host-maintenance-window b/changes/18554-store-and-show-next-host-maintenance-window
deleted file mode 100644
index 7dea3c952b4b..000000000000
--- a/changes/18554-store-and-show-next-host-maintenance-window
+++ /dev/null
@@ -1,2 +0,0 @@
-- Show a host's upcoming scheduled maintenance window, if any, on the host details page of the UI
-  and in host responses from the API.
diff --git a/changes/18815-hide-cta-from-team-roles b/changes/18815-hide-cta-from-team-roles
deleted file mode 100644
index 5b2d9b8ffbd1..000000000000
--- a/changes/18815-hide-cta-from-team-roles
+++ /dev/null
@@ -1 +0,0 @@
-* Fleet UI fixes: Hide CTA on inherited queries/policies from team level users
\ No newline at end of file
diff --git a/changes/18849-config-profiles-exclude-labels b/changes/18849-config-profiles-exclude-labels
deleted file mode 100644
index 4c1d41ecfbf4..000000000000
--- a/changes/18849-config-profiles-exclude-labels
+++ /dev/null
@@ -1,5 +0,0 @@
-* Added the database migrations to create the new `exclude` column for labels associated with MDM profiles (and declarations).
-* Added the API changes to support the `labels_include_all` and `labels_exclude_any` fields (and accept the deprecated `labels` field as an alias for `labels_include_all`).
-* Added `fleetctl gitops` and `fleetctl apply` support for `labels_include_all` and `labels_exclude_any` to configure a custom setting.
-* Updated the profile reconciliation logic to handle the new "exclude any" labels.
-* Fix bug where macOS declarations were stuck in "to be removed" state indefinitely.
diff --git a/changes/18897-shoe-zeroes b/changes/18897-shoe-zeroes
new file mode 100644
index 000000000000..7faddd522dd6
--- /dev/null
+++ b/changes/18897-shoe-zeroes
@@ -0,0 +1 @@
+Added "0 items" description on empty software tables for UI consistency
diff --git a/changes/18913-ignore-rejected-cves b/changes/18913-ignore-rejected-cves
new file mode 100644
index 000000000000..1fabe60f9ffb
--- /dev/null
+++ b/changes/18913-ignore-rejected-cves
@@ -0,0 +1 @@
+CVEs identified as 'Rejected' in NVD will no longer match against software
\ No newline at end of file
diff --git a/changes/19031-maintenance-windows-every-week b/changes/19031-maintenance-windows-every-week
deleted file mode 100644
index c23d6dd53afc..000000000000
--- a/changes/19031-maintenance-windows-every-week
+++ /dev/null
@@ -1 +0,0 @@
-- Maintenance window now scheduled weekly on Tuesdays (previously monthly on the third Tuesday of the month)
diff --git a/changes/19037-support-s3-store-for-bootstrap-packages b/changes/19037-support-s3-store-for-bootstrap-packages
new file mode 100644
index 000000000000..400cc30b3cb3
--- /dev/null
+++ b/changes/19037-support-s3-store-for-bootstrap-packages
@@ -0,0 +1 @@
+* Added support for S3 to store MDM bootstrap packages (uses the same bucket configuration as for software installers).
diff --git a/changes/19055-hide-run-script b/changes/19055-hide-run-script
deleted file mode 100644
index b45a211ea244..000000000000
--- a/changes/19055-hide-run-script
+++ /dev/null
@@ -1 +0,0 @@
-* Hide the host detail page's "Run script" action from Global and Team Observer/+s.
diff --git a/changes/19055-scripts-run-permissions b/changes/19055-scripts-run-permissions
deleted file mode 100644
index 8c5581d89340..000000000000
--- a/changes/19055-scripts-run-permissions
+++ /dev/null
@@ -1 +0,0 @@
-- Updated script run permissions -- only admins and maintainers can run arbitrary or saved scripts (not observer or observer+)
diff --git a/changes/19099-sw-vuln-filters b/changes/19099-sw-vuln-filters
new file mode 100644
index 000000000000..06ef4ac4d2d8
--- /dev/null
+++ b/changes/19099-sw-vuln-filters
@@ -0,0 +1,2 @@
+- adds the following filters to `/software/titles` and `/software/versions` API endpoints: `exploit: bool`, `min_cvss_score: float`, `max_cvss_score: float`
+- Software titles/versions tables allow for filtering by vulnerabilities including severity and known exploit
diff --git a/changes/19127-update-logic-and-copy-around-host-identifiers b/changes/19127-update-logic-and-copy-around-host-identifiers
deleted file mode 100644
index f482ac0fd298..000000000000
--- a/changes/19127-update-logic-and-copy-around-host-identifiers
+++ /dev/null
@@ -1,2 +0,0 @@
-- Update `fleetctl query --hosts` to work with hostnames, host UUIDs, and/or hardware serial numbers.
-- Clarify various help and error texts around host identifiers.
diff --git a/changes/19143-mdm-cmd-filters b/changes/19143-mdm-cmd-filters
deleted file mode 100644
index c17539c7381e..000000000000
--- a/changes/19143-mdm-cmd-filters
+++ /dev/null
@@ -1 +0,0 @@
-- `fleetctl get mdm_commands` now returns 20 rows and supports `--host` `--type` filters to improve response time
\ No newline at end of file
diff --git a/changes/19144-improve-extraction b/changes/19144-improve-extraction
deleted file mode 100644
index cc55af72e65a..000000000000
--- a/changes/19144-improve-extraction
+++ /dev/null
@@ -1 +0,0 @@
-* Improve extraction of application name from `pkg` installers
diff --git a/changes/19144-pkg-matching b/changes/19144-pkg-matching
deleted file mode 100644
index 815f2239fc64..000000000000
--- a/changes/19144-pkg-matching
+++ /dev/null
@@ -1 +0,0 @@
-* Improved the matching of `pkg` installer files to existing software
diff --git a/changes/19176-fleetd-base-mdm b/changes/19176-fleetd-base-mdm
deleted file mode 100644
index c0fbdc929a8b..000000000000
--- a/changes/19176-fleetd-base-mdm
+++ /dev/null
@@ -1 +0,0 @@
-* Automatic install of `fleetd` when a host turns on MDM now uses the latest released `fleetd` version.
diff --git a/changes/19219-fleetd-base-email-desktop b/changes/19219-fleetd-base-email-desktop
deleted file mode 100644
index 85c840ea3939..000000000000
--- a/changes/19219-fleetd-base-email-desktop
+++ /dev/null
@@ -1 +0,0 @@
-- Added support for END_USER_EMAIL and FLEET_DESKTOP parameters to Windows MSI install package
diff --git a/changes/19280-maintenance-window-descriptions b/changes/19280-maintenance-window-descriptions
new file mode 100644
index 000000000000..90848dcffe67
--- /dev/null
+++ b/changes/19280-maintenance-window-descriptions
@@ -0,0 +1 @@
+Maintenance window descriptions are now updated regularly to match the failing policy description/resolution.
diff --git a/changes/19281-add-host-name-to-event-descriptions b/changes/19281-add-host-name-to-event-descriptions
deleted file mode 100644
index 9a8b449fc416..000000000000
--- a/changes/19281-add-host-name-to-event-descriptions
+++ /dev/null
@@ -1 +0,0 @@
-* Add host's display name to calendar event descriptions
diff --git a/changes/19352-calendar-real-time b/changes/19352-calendar-real-time
index dc72e9889922..d96cf1fa1177 100644
--- a/changes/19352-calendar-real-time
+++ b/changes/19352-calendar-real-time
@@ -1 +1,3 @@
 - In maintenance windows using Google Calendar, calendar event is now recreated within 30 seconds if deleted or moved to the past.
+  - Fleet server watches for potential changes for up to 1 week after original event time. If event is moved forward more than 1 week, then after 1 week Fleet server will check for event changes once every 30 minutes.
+  - These near real-time updates may add additional load to the Google Calendar API, so it is recommended to use API usage alerts or other monitoring methods.
diff --git a/changes/19447-ios-ipados-software b/changes/19447-ios-ipados-software
new file mode 100644
index 000000000000..26acad51315e
--- /dev/null
+++ b/changes/19447-ios-ipados-software
@@ -0,0 +1,3 @@
+- iOS and iPadOS device details refetch can now be triggered with the existing `POST /api/latest/fleet/hosts/:id/refetch` endpoint.
+- iOS and iPadOS user-installed apps can be viewed in Fleet
+- iOS and iPadOS apps can be installed using Apple's VPP (Volume Purchase Program)
diff --git a/changes/19550-software-no-teams b/changes/19550-software-no-teams
new file mode 100644
index 000000000000..933665cd22c0
--- /dev/null
+++ b/changes/19550-software-no-teams
@@ -0,0 +1 @@
+- adds support for No teams on all software pages including adding software installers
\ No newline at end of file
diff --git a/changes/19551-policy-software-automations b/changes/19551-policy-software-automations
new file mode 100644
index 000000000000..4b88cb4c1fba
--- /dev/null
+++ b/changes/19551-policy-software-automations
@@ -0,0 +1 @@
+* Implement features allowing automatic installation of software on hosts that fail policies.
diff --git a/changes/19557-empty-hover-styles b/changes/19557-empty-hover-styles
deleted file mode 100644
index 20c046c0c7d6..000000000000
--- a/changes/19557-empty-hover-styles
+++ /dev/null
@@ -1 +0,0 @@
-* Update empty state styles in 4 places, clean up
diff --git a/changes/19561-browser-progress-bar b/changes/19561-browser-progress-bar
new file mode 100644
index 000000000000..cfd16443d918
--- /dev/null
+++ b/changes/19561-browser-progress-bar
@@ -0,0 +1 @@
+- In Fleet GUI, downloading a software installer package now shows the browser's built-in progress bar.
diff --git a/changes/19562-python-vuln b/changes/19562-python-vuln
new file mode 100644
index 000000000000..928551bbce0e
--- /dev/null
+++ b/changes/19562-python-vuln
@@ -0,0 +1 @@
+- Fixed CVE-2024-4030 in Vulncheck feed incorrectly targeting non-Windows hosts
\ No newline at end of file
diff --git a/changes/19577-fleetctl-get-desc b/changes/19577-fleetctl-get-desc
deleted file mode 100644
index dc7d737527e8..000000000000
--- a/changes/19577-fleetctl-get-desc
+++ /dev/null
@@ -1 +0,0 @@
-- Updated fleetctl get queries/labels/hosts descriptions.
diff --git a/changes/19586-capitalization-bug b/changes/19586-capitalization-bug
deleted file mode 100644
index 8bd3b20fd2d9..000000000000
--- a/changes/19586-capitalization-bug
+++ /dev/null
@@ -1 +0,0 @@
-* Fix UI capitalizations
\ No newline at end of file
diff --git a/changes/19645-cleanup_macos b/changes/19645-cleanup_macos
deleted file mode 100644
index 106deab08fe0..000000000000
--- a/changes/19645-cleanup_macos
+++ /dev/null
@@ -1 +0,0 @@
-* Fleetd cleanup script for macOS will return completed if run from fleet
diff --git a/changes/19645-uninstall-script-fleetd b/changes/19645-uninstall-script-fleetd
deleted file mode 100644
index b68905ba194e..000000000000
--- a/changes/19645-uninstall-script-fleetd
+++ /dev/null
@@ -1 +0,0 @@
-* Provided fleetd uninstall script will return when run through fleet
diff --git a/changes/19646-ui-profiles-pending-tooltip b/changes/19646-ui-profiles-pending-tooltip
new file mode 100644
index 000000000000..824ba143c903
--- /dev/null
+++ b/changes/19646-ui-profiles-pending-tooltip
@@ -0,0 +1 @@
+- Updated UI tooltips for pending OS settings.
diff --git a/changes/19651-hide-self-service b/changes/19651-hide-self-service
deleted file mode 100644
index e5318d211414..000000000000
--- a/changes/19651-hide-self-service
+++ /dev/null
@@ -1 +0,0 @@
-- Hide "Self-service" in Fleet Desktop and My device page if there is no self-service software available
diff --git a/changes/19674-dep-min-os-version b/changes/19674-dep-min-os-version
new file mode 100644
index 000000000000..b9adefe9ec57
--- /dev/null
+++ b/changes/19674-dep-min-os-version
@@ -0,0 +1 @@
+- Updated MDM features to enforce minimum OS version settings during Apple Automated Device Enrollment (ADE).
diff --git a/changes/19683-csv-comma-bug b/changes/19683-csv-comma-bug
deleted file mode 100644
index d5b3f72667ff..000000000000
--- a/changes/19683-csv-comma-bug
+++ /dev/null
@@ -1 +0,0 @@
-- Fix exporting CSVs with fields that contain commas to render properly
diff --git a/changes/19684-renew-scep-180 b/changes/19684-renew-scep-180
new file mode 100644
index 000000000000..131c08ff5111
--- /dev/null
+++ b/changes/19684-renew-scep-180
@@ -0,0 +1 @@
+* Increase threshold to renew Apple SCEP certificates for MDM enrollments to 180 days.
diff --git a/changes/19693-additional-stats b/changes/19693-additional-stats
new file mode 100644
index 000000000000..5978543420d6
--- /dev/null
+++ b/changes/19693-additional-stats
@@ -0,0 +1 @@
+- Added additional statistics items for AI features, maintenance window, and Fleet Desktop
diff --git a/changes/19694-vul-page-bugs b/changes/19694-vul-page-bugs
deleted file mode 100644
index 433891d9537c..000000000000
--- a/changes/19694-vul-page-bugs
+++ /dev/null
@@ -1 +0,0 @@
-* Fix 3 UI bugs on the Software page
diff --git a/changes/19760-software-update-tooltip b/changes/19760-software-update-tooltip
deleted file mode 100644
index 75c0ae8f4644..000000000000
--- a/changes/19760-software-update-tooltip
+++ /dev/null
@@ -1 +0,0 @@
-* Update software updated timestamp tooltip
\ No newline at end of file
diff --git a/changes/19800-renew-scep-migration b/changes/19800-renew-scep-migration
deleted file mode 100644
index 5ab73deffbfe..000000000000
--- a/changes/19800-renew-scep-migration
+++ /dev/null
@@ -1 +0,0 @@
-* Added support for renewing SCEP certificates with custom enrollment profiles.
diff --git a/changes/19808-prof b/changes/19808-prof
new file mode 100644
index 000000000000..71d19f8c4bc3
--- /dev/null
+++ b/changes/19808-prof
@@ -0,0 +1 @@
+* Fixed bugs on enrollment profiles when the organization name contains invalid XML characters.
diff --git a/changes/19828-hide-query-delete-checkboxes-from-observers b/changes/19828-hide-query-delete-checkboxes-from-observers
deleted file mode 100644
index f4c268d27b9c..000000000000
--- a/changes/19828-hide-query-delete-checkboxes-from-observers
+++ /dev/null
@@ -1 +0,0 @@
-- Hide query delete checkboxes from team observers
diff --git a/changes/19844-update-go b/changes/19844-update-go
deleted file mode 100644
index 7de847f94418..000000000000
--- a/changes/19844-update-go
+++ /dev/null
@@ -1 +0,0 @@
-* Updated Go version to go1.22.4
diff --git a/changes/19853-homebrew-intellij b/changes/19853-homebrew-intellij
new file mode 100644
index 000000000000..713d4ae1423d
--- /dev/null
+++ b/changes/19853-homebrew-intellij
@@ -0,0 +1 @@
+Fixed false negative vulnerabilities with IntelliJ IDEA CE and PyCharm CE installed via Homebrew.
diff --git a/changes/19857-known_vulnerability b/changes/19857-known_vulnerability
new file mode 100644
index 000000000000..b9c95991b3fc
--- /dev/null
+++ b/changes/19857-known_vulnerability
@@ -0,0 +1,2 @@
+For GET /api/v1/fleet/vulnerabilities/{cve} endpoint, added validation of CVE format, and added a 204 response. The 204 response indicates that the vulnerability is known to Fleet but not present on any hosts.
+For the UI, add new empty states for searching vulnerabilities: invalid CVE format searched, a known CVE serached but not present on hosts, not a known CVE searched, exploited vulnerability empty state, operating systems empty state, new icons
diff --git a/changes/19864-vpp-token-crud b/changes/19864-vpp-token-crud
new file mode 100644
index 000000000000..ee4a92e80f25
--- /dev/null
+++ b/changes/19864-vpp-token-crud
@@ -0,0 +1,2 @@
+- Adds the functionality for the `POST /mdm/apple/vpp_token`, `DELETE /mdm/apple/vpp_token` and 
+`GET /vpp` endpoints.
\ No newline at end of file
diff --git a/changes/19865-db-schema b/changes/19865-db-schema
new file mode 100644
index 000000000000..ede5f90ed005
--- /dev/null
+++ b/changes/19865-db-schema
@@ -0,0 +1 @@
+- Adds DB updates to support the VPP software feature.
\ No newline at end of file
diff --git a/changes/19867-get-avail-apps b/changes/19867-get-avail-apps
new file mode 100644
index 000000000000..4ace068f95b1
--- /dev/null
+++ b/changes/19867-get-avail-apps
@@ -0,0 +1 @@
+- Adds functionality for the `GET /software/app_store_apps` and `POST /software/app_store_apps` endpoints.
\ No newline at end of file
diff --git a/changes/19868-vpp-install-command b/changes/19868-vpp-install-command
new file mode 100644
index 000000000000..337b5d501004
--- /dev/null
+++ b/changes/19868-vpp-install-command
@@ -0,0 +1 @@
+- Adds functionality for installing App Store apps to the VPP feature.
\ No newline at end of file
diff --git a/changes/19870-vpp-activities-backend b/changes/19870-vpp-activities-backend
new file mode 100644
index 000000000000..115f92e1fd77
--- /dev/null
+++ b/changes/19870-vpp-activities-backend
@@ -0,0 +1 @@
+- Adds global activity support for VPP related activities.
\ No newline at end of file
diff --git a/changes/19871-gitops-vpp-config b/changes/19871-gitops-vpp-config
new file mode 100644
index 000000000000..e9a02e0fa7d2
--- /dev/null
+++ b/changes/19871-gitops-vpp-config
@@ -0,0 +1 @@
+* Add support for VPP to gitops config
diff --git a/changes/19880-include-vpp-apps-in-software-titles-endpoints b/changes/19880-include-vpp-apps-in-software-titles-endpoints
new file mode 100644
index 000000000000..9503cdef99fc
--- /dev/null
+++ b/changes/19880-include-vpp-apps-in-software-titles-endpoints
@@ -0,0 +1,2 @@
+* Added the associated VPP apps to the `GET /software/titles` and `GET /software/titles/:id` endpoints.
+* Added the associated VPP apps to the `GET /hosts/:id/software` and `GET /device/:token/software` endpoints.
diff --git a/changes/19882-ssvpp-backend b/changes/19882-ssvpp-backend
new file mode 100644
index 000000000000..64baa422e854
--- /dev/null
+++ b/changes/19882-ssvpp-backend
@@ -0,0 +1 @@
+- Add backend and gitops support for self service VPP
diff --git a/changes/19883-add-support-for-ui-self-service-vpp b/changes/19883-add-support-for-ui-self-service-vpp
new file mode 100644
index 000000000000..fd5f9fe3c249
--- /dev/null
+++ b/changes/19883-add-support-for-ui-self-service-vpp
@@ -0,0 +1 @@
+- add support to UI for self service VPP software
diff --git a/changes/19910-fix-low_disk_space-counts b/changes/19910-fix-low_disk_space-counts
deleted file mode 100644
index 249945b546c0..000000000000
--- a/changes/19910-fix-low_disk_space-counts
+++ /dev/null
@@ -1 +0,0 @@
-* Fixed counts for hosts with with low disk space in summary page.
diff --git a/changes/19937-fix-anchor-link b/changes/19937-fix-anchor-link
deleted file mode 100644
index 16ef161142e7..000000000000
--- a/changes/19937-fix-anchor-link
+++ /dev/null
@@ -1 +0,0 @@
-* Fix link to fleetd uninstall instructions in "Delete device" modal
diff --git a/changes/19950-changes b/changes/19950-changes
deleted file mode 100644
index 842018494e09..000000000000
--- a/changes/19950-changes
+++ /dev/null
@@ -1 +0,0 @@
-* Fixed crash in `fleetd` installer on Windows if there are registry keys with special characters on the system.
diff --git a/changes/19963-ios-ipados-as-platforms b/changes/19963-ios-ipados-as-platforms
deleted file mode 100644
index a06c8c321a85..000000000000
--- a/changes/19963-ios-ipados-as-platforms
+++ /dev/null
@@ -1,3 +0,0 @@
-- Added iOS/iPadOS builtin manual labels. IMPORTANT: Before migrating to this version, make sure to delete any labels with name "iOS" or "iPadOS".
-- Added aggregation of iOS/iPadOS OS versions.
-- Added change to custom profiles for iOS/iPadOS to go from 'pending' straight to 'verified' (skip 'verifying').
diff --git a/changes/20010-win-false-positives b/changes/20010-win-false-positives
deleted file mode 100644
index de0650b3d674..000000000000
--- a/changes/20010-win-false-positives
+++ /dev/null
@@ -1 +0,0 @@
-- fixed issue where some Windows applications were getting matched against Windows OS vulnerabilities
\ No newline at end of file
diff --git a/changes/20020-mdm-instructions b/changes/20020-mdm-instructions
deleted file mode 100644
index 1efad7712259..000000000000
--- a/changes/20020-mdm-instructions
+++ /dev/null
@@ -1,2 +0,0 @@
-- Updates the instructions for manual MDM enrollment on the "My device" page to be clearer and align
-  with Apple updates.
\ No newline at end of file
diff --git a/changes/20042-remove-package-version b/changes/20042-remove-package-version
new file mode 100644
index 000000000000..a4a580141767
--- /dev/null
+++ b/changes/20042-remove-package-version
@@ -0,0 +1 @@
+In `fleetctl package` command, removed the `--version` flag. The version of the package can be controlled by `--orbit-channel` flag.
diff --git a/changes/20050-vuln-software b/changes/20050-vuln-software
deleted file mode 100644
index d6f9fcf54dee..000000000000
--- a/changes/20050-vuln-software
+++ /dev/null
@@ -1 +0,0 @@
-- Adds back the "Vulnerable" filter for the host details software table
\ No newline at end of file
diff --git a/changes/20056-sort-policy-bug b/changes/20056-sort-policy-bug
deleted file mode 100644
index 232756fbc3e5..000000000000
--- a/changes/20056-sort-policy-bug
+++ /dev/null
@@ -1 +0,0 @@
-* UI: Reinstate ability to sort policies by passing count
\ No newline at end of file
diff --git a/changes/20057-connected-tweaks b/changes/20057-connected-tweaks
deleted file mode 100644
index 85d435862445..000000000000
--- a/changes/20057-connected-tweaks
+++ /dev/null
@@ -1 +0,0 @@
-* Improved the accuracy of the heuristic used to deterimine if a host is connected to Fleet via MDM by using osquery data for hosts that didn't send a Checkout message.
diff --git a/changes/20075-fleetctl-apply-validation b/changes/20075-fleetctl-apply-validation
deleted file mode 100644
index 02831f8b5492..000000000000
--- a/changes/20075-fleetctl-apply-validation
+++ /dev/null
@@ -1 +0,0 @@
-- Add .yml and .yaml file type validation and error message to fleetctl apply
diff --git a/changes/20077-align-view-all-hosts-link-sw-page b/changes/20077-align-view-all-hosts-link-sw-page
deleted file mode 100644
index 5dfd1bd2e651..000000000000
--- a/changes/20077-align-view-all-hosts-link-sw-page
+++ /dev/null
@@ -1 +0,0 @@
-- Align the "View all hosts" links in the Software titles and versions tables.
diff --git a/changes/20080-lock-disable-credential-caching b/changes/20080-lock-disable-credential-caching
deleted file mode 100644
index 0a8fbbe46e43..000000000000
--- a/changes/20080-lock-disable-credential-caching
+++ /dev/null
@@ -1 +0,0 @@
-- Disable credential caching and reboot on Windows lock
diff --git a/changes/20100-os-version-compliance b/changes/20100-os-version-compliance
new file mode 100644
index 000000000000..f14334f97f47
--- /dev/null
+++ b/changes/20100-os-version-compliance
@@ -0,0 +1 @@
+- Fleet UI: Show OS version compliance on Host Details page
diff --git a/changes/20143-targets-input-spinner b/changes/20143-targets-input-spinner
deleted file mode 100644
index da5e679348e3..000000000000
--- a/changes/20143-targets-input-spinner
+++ /dev/null
@@ -1 +0,0 @@
-- Fix styling issues with the target inputs loading spinner on the run live query/policy page.
diff --git a/changes/20194-sort-label-names-in-ui b/changes/20194-sort-label-names-in-ui
new file mode 100644
index 000000000000..2f27f77f0b5c
--- /dev/null
+++ b/changes/20194-sort-label-names-in-ui
@@ -0,0 +1 @@
+- display the label names case-insensitive alphabetical order in the fleet UI
diff --git a/changes/20271-deleted-host-software-installs b/changes/20271-deleted-host-software-installs
new file mode 100644
index 000000000000..674b8a823f4b
--- /dev/null
+++ b/changes/20271-deleted-host-software-installs
@@ -0,0 +1 @@
+- Fig bug where software install results could not be retrieved for deleted hosts in the activity feed
diff --git a/changes/20278-vpp-batch-api b/changes/20278-vpp-batch-api
new file mode 100644
index 000000000000..e5cbbf7eca12
--- /dev/null
+++ b/changes/20278-vpp-batch-api
@@ -0,0 +1 @@
+- GitOps supports VPP app associations
diff --git a/changes/20310-update-my-device-copy b/changes/20310-update-my-device-copy
new file mode 100644
index 000000000000..9a91f6432ac4
--- /dev/null
+++ b/changes/20310-update-my-device-copy
@@ -0,0 +1 @@
+- update copy on for automica enrollment modal on my device page.
diff --git a/changes/20311-migrations b/changes/20311-migrations
new file mode 100644
index 000000000000..4cf8dffe0e5f
--- /dev/null
+++ b/changes/20311-migrations
@@ -0,0 +1,3 @@
+- Adds ability for MDM migrations if the host is manually enrolled to a 3rd party MDM.
+- Adds an offline screen to the macOS MDM migration flow.
+- Updates the instructions on "My device" for MDM migrations on pre-Sonoma macOS hosts.
\ No newline at end of file
diff --git a/changes/20370-linux-nologin b/changes/20370-linux-nologin
new file mode 100644
index 000000000000..236418c9636c
--- /dev/null
+++ b/changes/20370-linux-nologin
@@ -0,0 +1 @@
+- Linux lock/unlock scripts now make use of pam_nologin to keep AD users locked out
diff --git a/changes/20395-DE-table-style-fix b/changes/20395-DE-table-style-fix
new file mode 100644
index 000000000000..8907c36986bb
--- /dev/null
+++ b/changes/20395-DE-table-style-fix
@@ -0,0 +1 @@
+* Fix a styling issue in the Controls > OS Settings > disk encryption table
\ No newline at end of file
diff --git a/changes/20397-do-not-set-last_enrolled_at-when-enrolling-orbit b/changes/20397-do-not-set-last_enrolled_at-when-enrolling-orbit
new file mode 100644
index 000000000000..c8f305c4d1a6
--- /dev/null
+++ b/changes/20397-do-not-set-last_enrolled_at-when-enrolling-orbit
@@ -0,0 +1 @@
+* Fixed a bug that set `last_enrolled_at` during orbit re-enrollment, which caused osquery enroll failures when `FLEET_OSQUERY_ENROLL_COOLDOWN` is set .
diff --git a/changes/20409-add-matching-rules-july-and-august-365 b/changes/20409-add-matching-rules-july-and-august-365
new file mode 100644
index 000000000000..7acdea889db8
--- /dev/null
+++ b/changes/20409-add-matching-rules-july-and-august-365
@@ -0,0 +1 @@
+* Added matching rules for July and August Microsoft 365 security updates (https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates).
diff --git a/changes/20440-Notion-exe-installer-name b/changes/20440-Notion-exe-installer-name
new file mode 100644
index 000000000000..bc3996cc5dc5
--- /dev/null
+++ b/changes/20440-Notion-exe-installer-name
@@ -0,0 +1 @@
+* Added a special-case to properly name the Notion .exe Windows installer the same as how it will be reported by osquery post-install.
diff --git a/changes/20463-cpe-fixes b/changes/20463-cpe-fixes
new file mode 100644
index 000000000000..d3c9453f37de
--- /dev/null
+++ b/changes/20463-cpe-fixes
@@ -0,0 +1,2 @@
+- During vulnerability scanning, use 'macos' SW target for CPEs of homebrew packages
+- During vulnerability scanning, don't ignore software with non-ASCII en dash and em dash characters
diff --git a/changes/20467-vpp-ipadios-ui b/changes/20467-vpp-ipadios-ui
new file mode 100644
index 000000000000..2cc84e31cdf0
--- /dev/null
+++ b/changes/20467-vpp-ipadios-ui
@@ -0,0 +1 @@
+* Add UI features for managing Apple VPP apps for iPadOS and iOS hosts
\ No newline at end of file
diff --git a/changes/20469-backend-ios-ipados-os-updates b/changes/20469-backend-ios-ipados-os-updates
new file mode 100644
index 000000000000..075cca487621
--- /dev/null
+++ b/changes/20469-backend-ios-ipados-os-updates
@@ -0,0 +1 @@
+* Adding OS updates support to iOS/iPadOS devices.
diff --git a/changes/20515-delete-vpp-app b/changes/20515-delete-vpp-app
new file mode 100644
index 000000000000..49599edf94b2
--- /dev/null
+++ b/changes/20515-delete-vpp-app
@@ -0,0 +1,2 @@
+* Added support to delete a VPP app from a team in `DELETE /software/titles/:software_title_id/available_for_install`.
+* Fixed path that was incorrect for the download software installer package endpoint `GET /software/titles/:software_title_id/package`.
diff --git a/changes/20531-download-CSR-clickable-error b/changes/20531-download-CSR-clickable-error
new file mode 100644
index 000000000000..aeaf1ad18c62
--- /dev/null
+++ b/changes/20531-download-CSR-clickable-error
@@ -0,0 +1,3 @@
+* When a CSR can't be downloaded due to missing private key, make the link clickable in the error
+  message that is flashed.
+  
\ No newline at end of file
diff --git a/changes/20535-sw-table-loading b/changes/20535-sw-table-loading
new file mode 100644
index 000000000000..d144ce782cce
--- /dev/null
+++ b/changes/20535-sw-table-loading
@@ -0,0 +1 @@
+* Improve loading state for DataTables when no data is present yet
\ No newline at end of file
diff --git a/changes/20571-update-fleetctl-docker-debian-slim b/changes/20571-update-fleetctl-docker-debian-slim
new file mode 100644
index 000000000000..9f04c02a055b
--- /dev/null
+++ b/changes/20571-update-fleetctl-docker-debian-slim
@@ -0,0 +1 @@
+* Update base images of `fleetdm/fleetctl`, `fleetdm/bomutils` and `fleetdm/wix` to fix CRITICAL vulnerabilities found by trivy.
diff --git a/changes/20575-fix-profile-activities-to-include-ios-ipados b/changes/20575-fix-profile-activities-to-include-ios-ipados
new file mode 100644
index 000000000000..bf089bf48948
--- /dev/null
+++ b/changes/20575-fix-profile-activities-to-include-ios-ipados
@@ -0,0 +1 @@
+- Update profile activities to include iOS and iPadOS
diff --git a/changes/20599-policy-webhook b/changes/20599-policy-webhook
new file mode 100644
index 000000000000..3255a6444eb5
--- /dev/null
+++ b/changes/20599-policy-webhook
@@ -0,0 +1 @@
+- In policy webhook, made sure the failing_host_count is never 0. This count is normally updated once an hour during cleanups_then_aggregation cron job.
diff --git a/changes/20604-hosts-page-pagination b/changes/20604-hosts-page-pagination
new file mode 100644
index 000000000000..c1f68d5f94a4
--- /dev/null
+++ b/changes/20604-hosts-page-pagination
@@ -0,0 +1 @@
+* Fix a bug where hosts page would sometimes allow excess pagination
\ No newline at end of file
diff --git a/changes/20618-nil-tz-not-handled b/changes/20618-nil-tz-not-handled
new file mode 100644
index 000000000000..cbb5d0bd9961
--- /dev/null
+++ b/changes/20618-nil-tz-not-handled
@@ -0,0 +1,2 @@
+* Fix a bug where Fleet google calendar events generated by Fleet <= 4.53.0 were not correctly
+  processed by 4.54.0
\ No newline at end of file
diff --git a/changes/20730-hide-available-for-install-wrong-team b/changes/20730-hide-available-for-install-wrong-team
new file mode 100644
index 000000000000..270fa8e61468
--- /dev/null
+++ b/changes/20730-hide-available-for-install-wrong-team
@@ -0,0 +1 @@
+* Fix a bug where a software installer (a package or a VPP app) that has been installed on a host still shows up as "Available for install" and can still be requested to be installed after the host is transferred to a different team without that installer (or after the installer is deleted).
diff --git a/changes/20747-gitops-software-query b/changes/20747-gitops-software-query
new file mode 100644
index 000000000000..100efc17f3f1
--- /dev/null
+++ b/changes/20747-gitops-software-query
@@ -0,0 +1 @@
+- Use new gitops format for software pre install query
diff --git a/changes/20751-detect-held-linux-packages-as-installed b/changes/20751-detect-held-linux-packages-as-installed
new file mode 100644
index 000000000000..6aa524ce80cd
--- /dev/null
+++ b/changes/20751-detect-held-linux-packages-as-installed
@@ -0,0 +1 @@
+Linux .deb packages 'on hold' are now included in the installed software list.
diff --git a/changes/20757-profiles-batch-activity b/changes/20757-profiles-batch-activity
new file mode 100644
index 000000000000..6b110b87c768
--- /dev/null
+++ b/changes/20757-profiles-batch-activity
@@ -0,0 +1 @@
+API endpoint `/api/v1/fleet/mdm/profiles/batch` will now not log an activity for profile types that did not change in the database (Apple configuration profiles, Windows configuration profiles, or Apple declarations).
diff --git a/changes/20781-cached-statements b/changes/20781-cached-statements
new file mode 100644
index 000000000000..58ae7c8c0d76
--- /dev/null
+++ b/changes/20781-cached-statements
@@ -0,0 +1 @@
+* Fixed a bug when a cached prepared statement gets deleted in the MySQL server itself without Fleet knowing. 
diff --git a/changes/20828-better-appid-error b/changes/20828-better-appid-error
new file mode 100644
index 000000000000..540c8fcbfa28
--- /dev/null
+++ b/changes/20828-better-appid-error
@@ -0,0 +1 @@
+- Improve clarity of gitops VPP app ID type errors
diff --git a/changes/20846-vuln-virtual-box b/changes/20846-vuln-virtual-box
new file mode 100644
index 000000000000..225dd0be2274
--- /dev/null
+++ b/changes/20846-vuln-virtual-box
@@ -0,0 +1 @@
+- resolved an issue where virtual box for macOS wasn't matching against the vm_virtualbox NVD product name
\ No newline at end of file
diff --git a/changes/20868-turn-off-mdm b/changes/20868-turn-off-mdm
new file mode 100644
index 000000000000..bfcd35d3150b
--- /dev/null
+++ b/changes/20868-turn-off-mdm
@@ -0,0 +1 @@
+- Improves the UX of turning off MDM on an offline host (endpoint doesn't error anymore)
\ No newline at end of file
diff --git a/changes/20882-ui-update-turn-on-mdm-banner b/changes/20882-ui-update-turn-on-mdm-banner
new file mode 100644
index 000000000000..eca36625ce6e
--- /dev/null
+++ b/changes/20882-ui-update-turn-on-mdm-banner
@@ -0,0 +1 @@
+- Updated text for "Turn on MDM" banners in UI.
\ No newline at end of file
diff --git a/changes/20895-policy-software-install-gitops b/changes/20895-policy-software-install-gitops
new file mode 100644
index 000000000000..774f6a4bfe35
--- /dev/null
+++ b/changes/20895-policy-software-install-gitops
@@ -0,0 +1 @@
+* Added support for configuring policy installers via GitOps.
diff --git a/changes/20897-add-software-premium-message b/changes/20897-add-software-premium-message
new file mode 100644
index 000000000000..82ab23030deb
--- /dev/null
+++ b/changes/20897-add-software-premium-message
@@ -0,0 +1 @@
+- Fleet Free users see a Premium feature message when clicking to add Add software
diff --git a/changes/20900-abm-invalid-ui b/changes/20900-abm-invalid-ui
deleted file mode 100644
index ab64aa6f19b0..000000000000
--- a/changes/20900-abm-invalid-ui
+++ /dev/null
@@ -1,2 +0,0 @@
-- Fixed issue where the Fleet UI could not be used to renew the ABM token after the ABM user who created
-  the token was deleted.
diff --git a/changes/20933-disable-overlay-other-workflows-modal b/changes/20933-disable-overlay-other-workflows-modal
new file mode 100644
index 000000000000..e0386552c5cc
--- /dev/null
+++ b/changes/20933-disable-overlay-other-workflows-modal
@@ -0,0 +1 @@
+- add a disabled overlay to the Other Workflows modal on the policy page.
diff --git a/changes/20934-amazon-linux b/changes/20934-amazon-linux
new file mode 100644
index 000000000000..4b174b29ed34
--- /dev/null
+++ b/changes/20934-amazon-linux
@@ -0,0 +1 @@
+Use ALAS bulletins as vulnerability source for Amazon Linux (instead of OVAL for Amazon Linux 2, and adds support for Amazon Linux 1, 2022, and 2023)
diff --git a/changes/20948-fix-flash-bleeding-off-viewport b/changes/20948-fix-flash-bleeding-off-viewport
new file mode 100644
index 000000000000..12a6241da25b
--- /dev/null
+++ b/changes/20948-fix-flash-bleeding-off-viewport
@@ -0,0 +1 @@
+- UI Fix: Flash message no longer bleeds off viewport
diff --git a/changes/20955-host-activity-feed-copy-updates b/changes/20955-host-activity-feed-copy-updates
new file mode 100644
index 000000000000..acfb44dfb01b
--- /dev/null
+++ b/changes/20955-host-activity-feed-copy-updates
@@ -0,0 +1,2 @@
+* Update Host details activities tooltip and empty state copy to reflect recently added
+capabilities.
diff --git a/changes/21006-fleetctl-preview b/changes/21006-fleetctl-preview
new file mode 100644
index 000000000000..9fe2fd3286d8
--- /dev/null
+++ b/changes/21006-fleetctl-preview
@@ -0,0 +1 @@
+* Fixed a bug in `fleetctl preview` that was causing it to fail if Docker was installed without support for the deprecated `docker-compose` CLI
diff --git a/changes/21038-pass-fleet-args-via-stdin b/changes/21038-pass-fleet-args-via-stdin
new file mode 100644
index 000000000000..3112a06649c2
--- /dev/null
+++ b/changes/21038-pass-fleet-args-via-stdin
@@ -0,0 +1 @@
+Fleet server now accepts arguments via stdin. This is useful for passing secrets that you don't want to expose as env vars, in the command line, or in the config file.
diff --git a/changes/21065-update-host-tooltip-copy b/changes/21065-update-host-tooltip-copy
new file mode 100644
index 000000000000..18470a4db730
--- /dev/null
+++ b/changes/21065-update-host-tooltip-copy
@@ -0,0 +1,2 @@
+- update ABM (Apple business manageer) host tooltip copy on the manage host page to clarify when
+  host vitals will be available to view.
diff --git a/changes/21073-deleting-ios-host b/changes/21073-deleting-ios-host
new file mode 100644
index 000000000000..220687fdc9c2
--- /dev/null
+++ b/changes/21073-deleting-ios-host
@@ -0,0 +1,2 @@
+- Deleted iOS/iPadOS host will continue to report to Fleet as long as host is in Apple Business Manager (ABM).
+- Refetching an offline iOS/iPadOS host will not add new MDM commands to the queue if previous refetch has not completed yet.
diff --git a/changes/21082-fix-available-for-install-filter-for-host-software b/changes/21082-fix-available-for-install-filter-for-host-software
new file mode 100644
index 000000000000..9c1b850570d6
--- /dev/null
+++ b/changes/21082-fix-available-for-install-filter-for-host-software
@@ -0,0 +1 @@
+* Fixed the "Available for install" filter in the host's software page so that installers that were requested to be installed on the host (regardless of installation status) also show up in the list.
diff --git a/changes/21104-gitops-team-conflict b/changes/21104-gitops-team-conflict
new file mode 100644
index 000000000000..6749b1b15a2b
--- /dev/null
+++ b/changes/21104-gitops-team-conflict
@@ -0,0 +1 @@
+Improved fleetctl gitops error message when trying to change team name to a team that already exists.
diff --git a/changes/21163-config-profile-label b/changes/21163-config-profile-label
new file mode 100644
index 000000000000..fe23787fbaf5
--- /dev/null
+++ b/changes/21163-config-profile-label
@@ -0,0 +1 @@
+- Fixed bug where configuration profile was still showing the old label name after the name was updated.
diff --git a/changes/21177-abm-crud b/changes/21177-abm-crud
new file mode 100644
index 000000000000..3da1b68e12a2
--- /dev/null
+++ b/changes/21177-abm-crud
@@ -0,0 +1 @@
+- Adds new endpoints and updates existing endpoints for managing multiple Apple Business Manager tokens.
\ No newline at end of file
diff --git a/changes/21178-mabm-vpp-crud b/changes/21178-mabm-vpp-crud
new file mode 100644
index 000000000000..44cd6aee80bf
--- /dev/null
+++ b/changes/21178-mabm-vpp-crud
@@ -0,0 +1 @@
+- Add backend support for multiple VPP tokens
diff --git a/changes/21184-consolidate-all-mdm-settings-under-mdm-section b/changes/21184-consolidate-all-mdm-settings-under-mdm-section
new file mode 100644
index 000000000000..5f0739e727fc
--- /dev/null
+++ b/changes/21184-consolidate-all-mdm-settings-under-mdm-section
@@ -0,0 +1 @@
+- consolidates Automatic Enrollment and VPP settings under the MDM settings integration page.
diff --git a/changes/21185-mabm-guide-updates b/changes/21185-mabm-guide-updates
new file mode 100644
index 000000000000..da209e16ddde
--- /dev/null
+++ b/changes/21185-mabm-guide-updates
@@ -0,0 +1 @@
+- Updated relevant documentation to include references to multiple ABM and VPP tokens.
\ No newline at end of file
diff --git a/changes/21186-new-abm-ui-page b/changes/21186-new-abm-ui-page
new file mode 100644
index 000000000000..c3353457ba8b
--- /dev/null
+++ b/changes/21186-new-abm-ui-page
@@ -0,0 +1 @@
+- add new Apple business manager page to fleet UI
diff --git a/changes/21187-new-vpp-page b/changes/21187-new-vpp-page
new file mode 100644
index 000000000000..2c011411cf0c
--- /dev/null
+++ b/changes/21187-new-vpp-page
@@ -0,0 +1 @@
+- add new vpp page to the fleet UI
diff --git a/changes/21198-update-go b/changes/21198-update-go
new file mode 100644
index 000000000000..bb2eac1add70
--- /dev/null
+++ b/changes/21198-update-go
@@ -0,0 +1 @@
+* Updated go to go1.22.6
diff --git a/changes/21242-nvd-input-validation b/changes/21242-nvd-input-validation
new file mode 100644
index 000000000000..cab3a2e77dec
--- /dev/null
+++ b/changes/21242-nvd-input-validation
@@ -0,0 +1 @@
+Continue with an empty CVE description when the NVD CVE feed doesn't include description entries (instead of panicking)
diff --git a/changes/21251-bugfix-download-software-installer b/changes/21251-bugfix-download-software-installer
new file mode 100644
index 000000000000..fe56429b39d1
--- /dev/null
+++ b/changes/21251-bugfix-download-software-installer
@@ -0,0 +1 @@
+* Fixed a bug where the wrong API path was used to download a software installer.
diff --git a/changes/21264-fix-reserved-team-names b/changes/21264-fix-reserved-team-names
new file mode 100644
index 000000000000..6363b8186977
--- /dev/null
+++ b/changes/21264-fix-reserved-team-names
@@ -0,0 +1,2 @@
+- Prevents teams with the name "All teams" or "No team" from being created (these are reserved team
+  names in Fleet).
\ No newline at end of file
diff --git a/changes/21268-calendar-free b/changes/21268-calendar-free
new file mode 100644
index 000000000000..f51a103ecf8c
--- /dev/null
+++ b/changes/21268-calendar-free
@@ -0,0 +1 @@
+Scheduled maintenance events will now be scheduled over calendar events marked "Free" (not busy) in Google Calendar.
diff --git a/changes/21270-mysql-8.4.2 b/changes/21270-mysql-8.4.2
new file mode 100644
index 000000000000..8d6844f0a23e
--- /dev/null
+++ b/changes/21270-mysql-8.4.2
@@ -0,0 +1 @@
+Added support for MySQL 8.4.2 LTS
diff --git a/changes/21273-handle-abm-terms-expired-flags b/changes/21273-handle-abm-terms-expired-flags
new file mode 100644
index 000000000000..04c8415877e5
--- /dev/null
+++ b/changes/21273-handle-abm-terms-expired-flags
@@ -0,0 +1 @@
+* Added support to track the Apple Business Manager "terms expired" API error per token, as well as a global flag that gets set as soon as one token has its terms expired.
diff --git a/changes/21296-query-results-index b/changes/21296-query-results-index
new file mode 100644
index 000000000000..a317b4747c16
--- /dev/null
+++ b/changes/21296-query-results-index
@@ -0,0 +1 @@
+Added index to query_results DB table to speed up finding last query timestamp for a given query and host.
diff --git a/changes/21315-vpp-premium-license b/changes/21315-vpp-premium-license
new file mode 100644
index 000000000000..2fd081703e47
--- /dev/null
+++ b/changes/21315-vpp-premium-license
@@ -0,0 +1 @@
+- Verify user has premium license before uploading VPP tokens
diff --git a/changes/21404-minio-false-positive b/changes/21404-minio-false-positive
new file mode 100644
index 000000000000..57b4245e45d2
--- /dev/null
+++ b/changes/21404-minio-false-positive
@@ -0,0 +1 @@
+- resolved issue where minio was reporting false positive vulnerabilities due to a mismatch in version strings 
\ No newline at end of file
diff --git a/changes/21412-remove-node-key-from-server-logs b/changes/21412-remove-node-key-from-server-logs
new file mode 100644
index 000000000000..c6555bd5bc99
--- /dev/null
+++ b/changes/21412-remove-node-key-from-server-logs
@@ -0,0 +1 @@
+* Removed invalid node keys from server logs.
diff --git a/changes/21423-fix-self-service-vppapps-filter b/changes/21423-fix-self-service-vppapps-filter
new file mode 100644
index 000000000000..d839a5fe23bb
--- /dev/null
+++ b/changes/21423-fix-self-service-vppapps-filter
@@ -0,0 +1,2 @@
+* Fixed a bug where the "Self-service" filter for the list of software and the list of host's software did not take App Store apps into account.
+* Fixed a bug where the "My device" page in Fleet Desktop did not show the self-service software tab when App Store apps were available as self-install.
diff --git a/changes/21427-deleting-software b/changes/21427-deleting-software
new file mode 100644
index 000000000000..aac5bffd6941
--- /dev/null
+++ b/changes/21427-deleting-software
@@ -0,0 +1,2 @@
+- Deleting installed software or VPP app now makes it available for re-installation.
+- Matching software that is not installed by Fleet now shows up as 'Available for install' on host details page.
diff --git a/changes/21428-policy-automatic-install-software b/changes/21428-policy-automatic-install-software
new file mode 100644
index 000000000000..e61dc2a9eadc
--- /dev/null
+++ b/changes/21428-policy-automatic-install-software
@@ -0,0 +1 @@
+* Added automatic installation of software packages using policy automations.
diff --git a/changes/21428-prevent-install-when-already-pending b/changes/21428-prevent-install-when-already-pending
new file mode 100644
index 000000000000..d01006d6f91d
--- /dev/null
+++ b/changes/21428-prevent-install-when-already-pending
@@ -0,0 +1 @@
+* Added validation to `POST /api/_version_/fleet/hosts/{host_id}/software/install/{software_title_id}` to prevent installing on a host that already has a pending installation for that software title.
diff --git a/changes/21439-multiple-teams-vpp-token b/changes/21439-multiple-teams-vpp-token
new file mode 100644
index 000000000000..5ec49a656001
--- /dev/null
+++ b/changes/21439-multiple-teams-vpp-token
@@ -0,0 +1 @@
+- Allow multiple teams to be assigned to the same VPP Token
diff --git a/changes/21557-ota-profile-endpoint b/changes/21557-ota-profile-endpoint
new file mode 100644
index 000000000000..4acf2bbcf5e9
--- /dev/null
+++ b/changes/21557-ota-profile-endpoint
@@ -0,0 +1 @@
+- Adds an endpoint for getting an OTA MDM profile for enrolling iOS and iPadOS hosts.
\ No newline at end of file
diff --git a/changes/21559-add-end-user-enrolment-page b/changes/21559-add-end-user-enrolment-page
new file mode 100644
index 000000000000..427f1c5beb06
--- /dev/null
+++ b/changes/21559-add-end-user-enrolment-page
@@ -0,0 +1 @@
+- add feature for end users to enroll their device into fleet mdm
diff --git a/changes/21683-apns-cert-validation-on-start b/changes/21683-apns-cert-validation-on-start
new file mode 100644
index 000000000000..9f1714359931
--- /dev/null
+++ b/changes/21683-apns-cert-validation-on-start
@@ -0,0 +1,2 @@
+- Removed validation of APNS certificate from server startup. This was no longer necessary because
+  we now allow for APNS certificates to be renewed in the UI.
diff --git a/changes/21757-fix-scheduling-cron-jobs-at-startup b/changes/21757-fix-scheduling-cron-jobs-at-startup
new file mode 100644
index 000000000000..b54ae2c84f53
--- /dev/null
+++ b/changes/21757-fix-scheduling-cron-jobs-at-startup
@@ -0,0 +1 @@
+* Fixed an issue with the scheduling of cron jobs at startup if the job has never run, which caused it to be delayed.
diff --git a/changes/21804-vpp-clear-apps-on-move b/changes/21804-vpp-clear-apps-on-move
new file mode 100644
index 000000000000..3823274aaa12
--- /dev/null
+++ b/changes/21804-vpp-clear-apps-on-move
@@ -0,0 +1 @@
+- Clear apps associated with a VPP token if it's moved off of a team
diff --git a/changes/6085-fleetctl-debug-connection b/changes/6085-fleetctl-debug-connection
deleted file mode 100644
index 240987d39a88..000000000000
--- a/changes/6085-fleetctl-debug-connection
+++ /dev/null
@@ -1,2 +0,0 @@
-* Fixed `fleetctl debug connection` to support server TLS certificates with intermediates.
-* Added support to `fleetctl debug connection` to test TLS connection with the embedded certs.pem in the fleetctl executable (default root CA used to generate fleetd packages). This can help find issues during package generation instead of during package installation.
diff --git a/changes/6979-observer-software b/changes/6979-observer-software
deleted file mode 100644
index 005d4a8eaf13..000000000000
--- a/changes/6979-observer-software
+++ /dev/null
@@ -1 +0,0 @@
-- Bug fix: do not allow Observer and Observer+ roles to download software installers.
\ No newline at end of file
diff --git a/changes/7014-custom-vulnerability-matching b/changes/7014-custom-vulnerability-matching
deleted file mode 100644
index 969e7357a304..000000000000
--- a/changes/7014-custom-vulnerability-matching
+++ /dev/null
@@ -1 +0,0 @@
-- addresses Microsoft Office June 2024 false negative vulnerabilities and adds custom vulnerability matching
\ No newline at end of file
diff --git a/changes/7476-fix-ui-overflow-os-settings-table b/changes/7476-fix-ui-overflow-os-settings-table
new file mode 100644
index 000000000000..6c95925de8f5
--- /dev/null
+++ b/changes/7476-fix-ui-overflow-os-settings-table
@@ -0,0 +1 @@
+- fixes UI overflow issues with OS settings table data
diff --git a/changes/api-get-host-by-identifier-exclude-software b/changes/api-get-host-by-identifier-exclude-software
new file mode 100644
index 000000000000..aa2aa5404af8
--- /dev/null
+++ b/changes/api-get-host-by-identifier-exclude-software
@@ -0,0 +1 @@
+- add exclude_software query paramter to "Get host by identifier" API
\ No newline at end of file
diff --git a/changes/apns-errors b/changes/apns-errors
new file mode 100644
index 000000000000..6de48617a1c1
--- /dev/null
+++ b/changes/apns-errors
@@ -0,0 +1 @@
+* Fixed logic to properly catch and log APNs errors.
diff --git a/changes/fix-software-array-migration b/changes/fix-software-array-migration
new file mode 100644
index 000000000000..27536ccc1ecd
--- /dev/null
+++ b/changes/fix-software-array-migration
@@ -0,0 +1,2 @@
+- Adds a migration to migrate older team configurations to the new version that includes both
+  installers and App Store apps.
\ No newline at end of file
diff --git a/changes/issue-18848-include-all-exclude-any-custom-profile b/changes/issue-18848-include-all-exclude-any-custom-profile
deleted file mode 100644
index ef065303f371..000000000000
--- a/changes/issue-18848-include-all-exclude-any-custom-profile
+++ /dev/null
@@ -1,2 +0,0 @@
-- add UI for uploading custom profiles with a target of hosts that include all/exclude
-  any selected labels
diff --git a/changes/issue-19691-add-vpp-token-expiry-banner b/changes/issue-19691-add-vpp-token-expiry-banner
new file mode 100644
index 000000000000..d4f14c98c63b
--- /dev/null
+++ b/changes/issue-19691-add-vpp-token-expiry-banner
@@ -0,0 +1 @@
+- add a warning banner to the UI if the uploaded VPP token is about to expire/has expired.
diff --git a/changes/issue-19731-dont-show-db-error-message b/changes/issue-19731-dont-show-db-error-message
deleted file mode 100644
index d04018535124..000000000000
--- a/changes/issue-19731-dont-show-db-error-message
+++ /dev/null
@@ -1 +0,0 @@
-- remove DB error message from the UI when showing a error response.
diff --git a/changes/issue-19866-add-remove-disable-vpp-in-ui b/changes/issue-19866-add-remove-disable-vpp-in-ui
new file mode 100644
index 000000000000..09000dbff2e0
--- /dev/null
+++ b/changes/issue-19866-add-remove-disable-vpp-in-ui
@@ -0,0 +1 @@
+- add ability to add/remove/disable vpp in the fleet UI.
diff --git a/changes/issue-19869-vpp-ui-on-software-pages b/changes/issue-19869-vpp-ui-on-software-pages
new file mode 100644
index 000000000000..74f71d41c923
--- /dev/null
+++ b/changes/issue-19869-vpp-ui-on-software-pages
@@ -0,0 +1 @@
+- add UI to support the apple vpp feature on the software pages.
diff --git a/changes/issue-19951-render-banners-on-my-device-page-in-priority-order b/changes/issue-19951-render-banners-on-my-device-page-in-priority-order
deleted file mode 100644
index 965c2902abc3..000000000000
--- a/changes/issue-19951-render-banners-on-my-device-page-in-priority-order
+++ /dev/null
@@ -1 +0,0 @@
-- render only one banner on the my device page based on priority order.
diff --git a/changes/issue-20612-ui-updates-host-software-device-user-pages-for-vpp b/changes/issue-20612-ui-updates-host-software-device-user-pages-for-vpp
new file mode 100644
index 000000000000..01e6073b2d91
--- /dev/null
+++ b/changes/issue-20612-ui-updates-host-software-device-user-pages-for-vpp
@@ -0,0 +1 @@
+- add UI updates for VPP feature on host software and my device pages.
diff --git a/changes/issue-20784-fix-app-wide-banner-showing b/changes/issue-20784-fix-app-wide-banner-showing
new file mode 100644
index 000000000000..9720e4b20bec
--- /dev/null
+++ b/changes/issue-20784-fix-app-wide-banner-showing
@@ -0,0 +1 @@
+- fix an issue where the app-wide warning banners were not showing on the initial page load
diff --git a/changes/update-go1.23.1 b/changes/update-go1.23.1
new file mode 100644
index 000000000000..22a59cdc400b
--- /dev/null
+++ b/changes/update-go1.23.1
@@ -0,0 +1 @@
+* Updated Go to go1.23.1
diff --git a/changes/update-installutils-to-allow-for-special-characters-in-registry b/changes/update-installutils-to-allow-for-special-characters-in-registry
deleted file mode 100644
index f3bab1ae9a4e..000000000000
--- a/changes/update-installutils-to-allow-for-special-characters-in-registry
+++ /dev/null
@@ -1 +0,0 @@
-- Fixes an issue where special characters in HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall breaks the "installer_utils.ps1 -uninstallOrbit" step in the Windows MSI installer
\ No newline at end of file
diff --git a/charts/fleet/Chart.yaml b/charts/fleet/Chart.yaml
index 88af956ae514..6921cfc2f0e4 100644
--- a/charts/fleet/Chart.yaml
+++ b/charts/fleet/Chart.yaml
@@ -8,7 +8,7 @@ version: v6.2.0
 home: https://github.com/fleetdm/fleet
 sources:
   - https://github.com/fleetdm/fleet.git
-appVersion: v4.53.1
+appVersion: v4.54.1
 dependencies:
   - name: mysql
     condition: mysql.enabled
diff --git a/charts/fleet/templates/_helpers.tpl b/charts/fleet/templates/_helpers.tpl
index f6c41ef3fb7f..fd0cfffbf93f 100644
--- a/charts/fleet/templates/_helpers.tpl
+++ b/charts/fleet/templates/_helpers.tpl
@@ -23,6 +23,11 @@ If release name contains chart name it will be used as a full name.
 {{- end }}
 {{- end }}
 
+{{- define "fleet.servicename" -}}
+{{- $fullName := include "fleet.fullname" . -}}
+{{- printf "%s-service" $fullName }}
+{{- end }}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}
diff --git a/charts/fleet/templates/ingress.yaml b/charts/fleet/templates/ingress.yaml
index 0a7326d99512..1a3e758a290a 100644
--- a/charts/fleet/templates/ingress.yaml
+++ b/charts/fleet/templates/ingress.yaml
@@ -1,5 +1,6 @@
 {{- if .Values.ingress.enabled -}}
 {{- $fullName := include "fleet.fullname" . -}}
+{{- $serviceName := include "fleet.servicename" . -}}
 {{- $svcPort := ternary .Values.fleet.listenPort .Values.fleet.servicePort (eq .Values.fleet.servicePort nil) -}}
 {{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
   {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
@@ -49,11 +50,11 @@ spec:
             backend:
               {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
               service:
-                name: {{ $fullName }}
+                name: {{ $serviceName }}
                 port:
                   number: {{ $svcPort }}
               {{- else }}
-              serviceName: {{ $fullName }}
+              serviceName: {{ $serviceName }}
               servicePort: {{ $svcPort }}
               {{- end }}
           {{- end }}
diff --git a/charts/fleet/templates/job-migration.yaml b/charts/fleet/templates/job-migration.yaml
index 8226e3d29ab2..135dac9a6328 100644
--- a/charts/fleet/templates/job-migration.yaml
+++ b/charts/fleet/templates/job-migration.yaml
@@ -18,6 +18,7 @@ metadata:
     "helm.sh/hook-delete-policy": hook-succeeded
     {{- end }}
 spec:
+  ttlSecondsAfterFinished: 100
   template:
     metadata:
 {{- with .Values.podAnnotations }}
diff --git a/charts/fleet/templates/service.yaml b/charts/fleet/templates/service.yaml
index 1a22e48fc0d0..fa1c13a94d9a 100644
--- a/charts/fleet/templates/service.yaml
+++ b/charts/fleet/templates/service.yaml
@@ -1,3 +1,4 @@
+{{- $serviceName := include "fleet.servicename" . -}}
 apiVersion: v1
 kind: Service
 metadata:
@@ -6,7 +7,7 @@ metadata:
     chart: fleet
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
-  name: fleet
+  name: {{ $serviceName }}
   namespace: {{ .Release.Namespace }}
 spec:
   {{- if .Values.gke.ingress.useGKEIngress }}
diff --git a/charts/fleet/values.yaml b/charts/fleet/values.yaml
index 4b7aa1dbb136..7c6376f6cc69 100644
--- a/charts/fleet/values.yaml
+++ b/charts/fleet/values.yaml
@@ -3,7 +3,7 @@
 hostName: fleet.localhost
 replicas: 3 # The number of Fleet instances to deploy
 imageRepository: fleetdm/fleet
-imageTag: v4.53.1 # Version of Fleet to deploy
+imageTag: v4.54.1 # Version of Fleet to deploy
 podAnnotations: {} # Additional annotations to add to the Fleet pod
 serviceAccountAnnotations: {} # Additional annotations to add to the Fleet service account
 resources:
@@ -212,7 +212,7 @@ environments:
   # The following environment variable is required if you are using
   # Fleet's macOS MDM features.  In a production environment, it is recommended that
   # you store this private key in a secret and use envsFrom to reference the secret below.
-  # To more information: https://fleetdm.com/docs/using-fleet/fleet-server-configuration#server-private-key
+  # For more information, check out the docs: https://fleetdm.com/docs/configuration/fleet-server-configuration#server-private-key
   FLEET_SERVER_PRIVATE_KEY: ""
 
 ## Section: Environment Variables from Secrets/CMs
diff --git a/cmd/fleet/cron.go b/cmd/fleet/cron.go
index 9b731db37941..96e7f7998f6f 100644
--- a/cmd/fleet/cron.go
+++ b/cmd/fleet/cron.go
@@ -28,6 +28,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/service/externalsvc"
 	"github.com/fleetdm/fleet/v4/server/service/schedule"
 	"github.com/fleetdm/fleet/v4/server/vulnerabilities/customcve"
+	"github.com/fleetdm/fleet/v4/server/vulnerabilities/goval_dictionary"
 	"github.com/fleetdm/fleet/v4/server/vulnerabilities/macoffice"
 	"github.com/fleetdm/fleet/v4/server/vulnerabilities/msrc"
 	"github.com/fleetdm/fleet/v4/server/vulnerabilities/nvd"
@@ -37,7 +38,6 @@ import (
 	"github.com/fleetdm/fleet/v4/server/worker"
 	kitlog "github.com/go-kit/log"
 	"github.com/go-kit/log/level"
-	"github.com/google/uuid"
 	"github.com/hashicorp/go-multierror"
 )
 
@@ -159,6 +159,7 @@ func scanVulnerabilities(
 
 	nvdVulns := checkNVDVulnerabilities(ctx, ds, logger, vulnPath, config, vulnAutomationEnabled != "")
 	ovalVulns := checkOvalVulnerabilities(ctx, ds, logger, vulnPath, config, vulnAutomationEnabled != "")
+	govalDictVulns := checkGovalDictionaryVulnerabilities(ctx, ds, logger, vulnPath, config, vulnAutomationEnabled != "")
 	macOfficeVulns := checkMacOfficeVulnerabilities(ctx, ds, logger, vulnPath, config, vulnAutomationEnabled != "")
 	customVulns := checkCustomVulnerabilities(ctx, ds, logger, config, vulnAutomationEnabled != "")
 
@@ -173,6 +174,7 @@ func scanVulnerabilities(
 	vulns = append(vulns, nvdVulns...)
 	vulns = append(vulns, ovalVulns...)
 	vulns = append(vulns, macOfficeVulns...)
+	vulns = append(vulns, govalDictVulns...)
 	vulns = append(vulns, customVulns...)
 
 	meta, err := ds.ListCVEs(ctx, config.RecentVulnerabilityMaxAge)
@@ -345,6 +347,11 @@ func checkOvalVulnerabilities(
 	for _, version := range versions.OSVersions {
 		start := time.Now()
 		r, err := oval.Analyze(ctx, ds, version, vulnPath, collectVulns)
+		if err != nil && errors.Is(err, oval.ErrUnsupportedPlatform) {
+			level.Debug(logger).Log("msg", "oval-analysis-unsupported", "platform", version.Name)
+			continue
+		}
+
 		elapsed := time.Since(start)
 		level.Debug(logger).Log(
 			"msg", "oval-analysis-done",
@@ -360,6 +367,57 @@ func checkOvalVulnerabilities(
 	return results
 }
 
+func checkGovalDictionaryVulnerabilities(
+	ctx context.Context,
+	ds fleet.Datastore,
+	logger kitlog.Logger,
+	vulnPath string,
+	config *config.VulnerabilitiesConfig,
+	collectVulns bool,
+) []fleet.SoftwareVulnerability {
+	var results []fleet.SoftwareVulnerability
+
+	// Get Platforms
+	versions, err := ds.OSVersions(ctx, nil, nil, nil, nil)
+	if err != nil {
+		errHandler(ctx, logger, "listing platforms for goval_dictionary pulls", err)
+		return nil
+	}
+
+	if !config.DisableDataSync {
+		// Sync on disk goval_dictionary sqlite with current OS Versions.
+		downloaded, err := goval_dictionary.Refresh(versions, vulnPath, logger)
+		if err != nil {
+			errHandler(ctx, logger, "updating goval_dictionary databases", err)
+		}
+		for _, d := range downloaded {
+			level.Debug(logger).Log("goval_dictionary-sync-downloaded", d)
+		}
+	}
+
+	// Analyze all supported os versions using the synced goval_dictionary definitions.
+	for _, version := range versions.OSVersions {
+		start := time.Now()
+		r, err := goval_dictionary.Analyze(ctx, ds, version, vulnPath, collectVulns, logger)
+		if err != nil && errors.Is(err, goval_dictionary.ErrUnsupportedPlatform) {
+			level.Debug(logger).Log("msg", "goval_dictionary-analysis-unsupported", "platform", version.Name)
+			continue
+		}
+		elapsed := time.Since(start)
+		level.Debug(logger).Log(
+			"msg", "goval_dictionary-analysis-done",
+			"platform", version.Name,
+			"elapsed", elapsed,
+			"found new", len(r))
+		results = append(results, r...)
+		if err != nil {
+			errHandler(ctx, logger, "analyzing goval_dictionary definitions", err)
+		}
+	}
+
+	return results
+}
+
 func checkNVDVulnerabilities(
 	ctx context.Context,
 	ds fleet.Datastore,
@@ -625,7 +683,11 @@ func newWorkerIntegrationsSchedule(
 		Log:       logger,
 		Commander: commander,
 	}
-	w.Register(jira, zendesk, macosSetupAsst, appleMDM)
+	dbMigrate := &worker.DBMigration{
+		Datastore: ds,
+		Log:       logger,
+	}
+	w.Register(jira, zendesk, macosSetupAsst, appleMDM, dbMigrate)
 
 	// Read app config a first time before starting, to clear up any failer client
 	// configuration if we're not on a fleet-owned server. Technically, the ServerURL
@@ -735,6 +797,7 @@ func newCleanupsAndAggregationSchedule(
 	config *config.FleetConfig,
 	commander *apple_mdm.MDMAppleCommander,
 	softwareInstallStore fleet.SoftwareInstallerStore,
+	bootstrapPackageStore fleet.MDMBootstrapPackageStore,
 ) (*schedule.Schedule, error) {
 	const (
 		name            = string(fleet.CronCleanupsThenAggregation)
@@ -882,7 +945,19 @@ func newCleanupsAndAggregationSchedule(
 			return ds.CleanupActivitiesAndAssociatedData(ctx, maxCount, appConfig.ActivityExpirySettings.ActivityExpiryWindow)
 		}),
 		schedule.WithJob("cleanup_unused_software_installers", func(ctx context.Context) error {
-			return ds.CleanupUnusedSoftwareInstallers(ctx, softwareInstallStore)
+			// remove only those unused created more than a minute ago to avoid a
+			// race where we delete those created after the mysql query to get those
+			// in use.
+			return ds.CleanupUnusedSoftwareInstallers(ctx, softwareInstallStore, time.Now().Add(-time.Minute))
+		}),
+		schedule.WithJob("cleanup_unused_bootstrap_packages", func(ctx context.Context) error {
+			// remove only those unused created more than a minute ago to avoid a
+			// race where we delete those created after the mysql query to get those
+			// in use.
+			return ds.CleanupUnusedBootstrapPackages(ctx, bootstrapPackageStore, time.Now().Add(-time.Minute))
+		}),
+		schedule.WithJob("cleanup_host_mdm_commands", func(ctx context.Context) error {
+			return ds.CleanupHostMDMCommands(ctx)
 		}),
 	)
 
@@ -1050,29 +1125,57 @@ func newAppleMDMDEPProfileAssigner(
 ) (*schedule.Schedule, error) {
 	const name = string(fleet.CronAppleMDMDEPProfileAssigner)
 	logger = kitlog.With(logger, "cron", name, "component", "nanodep-syncer")
-	var fleetSyncer *apple_mdm.DEPService
 	s := schedule.New(
 		ctx, name, instanceID, periodicity, ds, ds,
 		schedule.WithLogger(logger),
-		schedule.WithJob("dep_syncer", func(ctx context.Context) error {
-			appCfg, err := ds.AppConfig(ctx)
-			if err != nil {
-				return ctxerr.Wrap(ctx, err, "retrieving app config")
-			}
+		schedule.WithJob("dep_syncer", appleMDMDEPSyncerJob(ds, depStorage, logger)),
+	)
 
-			if !appCfg.MDM.AppleBMEnabledAndConfigured {
-				return nil
-			}
+	return s, nil
+}
+
+func appleMDMDEPSyncerJob(
+	ds fleet.Datastore,
+	depStorage *mysql.NanoDEPStorage,
+	logger kitlog.Logger,
+) func(context.Context) error {
+	var fleetSyncer *apple_mdm.DEPService
+	return func(ctx context.Context) error {
+		appCfg, err := ds.AppConfig(ctx)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "retrieving app config")
+		}
+
+		if !appCfg.MDM.AppleBMEnabledAndConfigured {
+			return nil
+		}
 
-			if fleetSyncer == nil {
-				fleetSyncer = apple_mdm.NewDEPService(ds, depStorage, logger)
+		// As part of the DB migration of the single ABM token to the multi-ABM
+		// token world (where the token was migrated from mdm_config_assets to
+		// abm_tokens), we need to complete migration of the existing token as
+		// during the DB migration we didn't have the organization name, apple id
+		// and renewal date.
+		incompleteToken, err := ds.GetABMTokenByOrgName(ctx, "")
+		if err != nil && !fleet.IsNotFound(err) {
+			return ctxerr.Wrap(ctx, err, "retrieving migrated ABM token")
+		}
+		if incompleteToken != nil {
+			logger.Log("msg", "migrated ABM token found, updating its metadata")
+			if err := apple_mdm.SetABMTokenMetadata(ctx, incompleteToken, depStorage, ds, logger); err != nil {
+				return ctxerr.Wrap(ctx, err, "updating migrated ABM token metadata")
+			}
+			if err := ds.SaveABMToken(ctx, incompleteToken); err != nil {
+				return ctxerr.Wrap(ctx, err, "saving updated migrated ABM token")
 			}
+			logger.Log("msg", "completed migration of existing ABM token")
+		}
 
-			return fleetSyncer.RunAssigner(ctx)
-		}),
-	)
+		if fleetSyncer == nil {
+			fleetSyncer = apple_mdm.NewDEPService(ds, depStorage, logger)
+		}
 
-	return s, nil
+		return fleetSyncer.RunAssigner(ctx)
+	}
 }
 
 func newMDMProfileManager(
@@ -1108,6 +1211,47 @@ func newMDMProfileManager(
 	return s, nil
 }
 
+func newMDMAPNsPusher(
+	ctx context.Context,
+	instanceID string,
+	ds fleet.Datastore,
+	commander *apple_mdm.MDMAppleCommander,
+	logger kitlog.Logger,
+) (*schedule.Schedule, error) {
+
+	const name = string(fleet.CronAppleMDMAPNsPusher)
+
+	var interval = 1 * time.Minute
+	if intervalEnv := os.Getenv("FLEET_DEV_CUSTOM_APNS_PUSHER_INTERVAL"); intervalEnv != "" {
+		var err error
+		interval, err = time.ParseDuration(intervalEnv)
+		if err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "invalid duration provided in env var FLEET_DEV_CUSTOM_APNS_PUSHER_INTERVAL")
+		}
+
+	}
+
+	logger = kitlog.With(logger, "cron", name)
+	s := schedule.New(
+		ctx, name, instanceID, interval, ds, ds,
+		schedule.WithLogger(logger),
+		schedule.WithJob("apns_push_to_pending_hosts", func(ctx context.Context) error {
+			appCfg, err := ds.AppConfig(ctx)
+			if err != nil {
+				return ctxerr.Wrap(ctx, err, "retrieving app config")
+			}
+
+			if !appCfg.MDM.EnabledAndConfigured {
+				return nil
+			}
+
+			return service.SendPushesToPendingDevices(ctx, ds, commander, logger)
+		}),
+	)
+
+	return s, nil
+}
+
 func cleanupCronStatsOnShutdown(ctx context.Context, ds fleet.Datastore, logger kitlog.Logger, instanceID string) {
 	if err := ds.UpdateAllCronStatsForInstance(ctx, instanceID, fleet.CronStatsStatusPending, fleet.CronStatsStatusCanceled); err != nil {
 		logger.Log("err", "cancel pending cron stats for instance", "details", err)
@@ -1244,51 +1388,7 @@ func newIPhoneIPadRefetcher(
 		ctx, name, instanceID, periodicity, ds, ds,
 		schedule.WithLogger(logger),
 		schedule.WithJob("cron_iphone_ipad_refetcher", func(ctx context.Context) error {
-			appCfg, err := ds.AppConfig(ctx)
-			if err != nil {
-				return ctxerr.Wrap(ctx, err, "fetching app config")
-			}
-
-			if !appCfg.MDM.EnabledAndConfigured {
-				level.Debug(logger).Log("msg", "apple mdm is not configured, skipping run")
-				return nil
-			}
-
-			start := time.Now()
-			uuids, err := ds.ListIOSAndIPadOSToRefetch(ctx, 1*time.Hour)
-			if err != nil {
-				return ctxerr.Wrap(ctx, err, "list ios and ipad devices to refetch")
-			}
-			if len(uuids) == 0 {
-				return nil
-			}
-			logger.Log("msg", "sending commands to refetch", "count", len(uuids), "lookup-duration", time.Since(start))
-			commandUUID := fleet.RefetchCommandUUIDPrefix + uuid.NewString()
-			if err := commander.EnqueueCommand(ctx, uuids, fmt.Sprintf(`<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-    <key>Command</key>
-    <dict>
-        <key>Queries</key>
-        <array>
-            <string>DeviceName</string>
-            <string>DeviceCapacity</string>
-            <string>AvailableDeviceCapacity</string>
-            <string>OSVersion</string>
-            <string>WiFiMAC</string>
-            <string>ProductName</string>
-        </array>
-        <key>RequestType</key>
-        <string>DeviceInformation</string>
-    </dict>
-    <key>CommandUUID</key>
-    <string>%s</string>
-</dict>
-</plist>`, commandUUID)); err != nil {
-				return ctxerr.Wrap(ctx, err, "send DeviceInformation commands to ios and ipados devices")
-			}
-			return nil
+			return apple_mdm.IOSiPadOSRefetch(ctx, ds, commander, logger)
 		}),
 	)
 
diff --git a/cmd/fleet/cron_test.go b/cmd/fleet/cron_test.go
index dd31dd2bec3c..789b38c40565 100644
--- a/cmd/fleet/cron_test.go
+++ b/cmd/fleet/cron_test.go
@@ -2,13 +2,24 @@ package main
 
 import (
 	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
 	"testing"
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
+	"github.com/fleetdm/fleet/v4/server/fleet"
 	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
+	nanodep_client "github.com/fleetdm/fleet/v4/server/mdm/nanodep/client"
+	"github.com/fleetdm/fleet/v4/server/mdm/nanodep/godep"
 	"github.com/fleetdm/fleet/v4/server/mock"
 	mdmmock "github.com/fleetdm/fleet/v4/server/mock/mdm"
+	"github.com/fleetdm/fleet/v4/server/test"
+	"github.com/go-kit/log"
 	kitlog "github.com/go-kit/log"
 )
 
@@ -23,3 +34,93 @@ func TestNewMDMProfileManagerWithoutConfig(t *testing.T) {
 	require.NotNil(t, sch)
 	require.NoError(t, err)
 }
+
+func TestMigrateABMTokenDuringDEPCronJob(t *testing.T) {
+	ctx := context.Background()
+	ds := mysql.CreateMySQLDS(t)
+
+	depStorage, err := ds.NewMDMAppleDEPStorage()
+	require.NoError(t, err)
+	// to avoid issues with syncer, use that constant as org name for now
+	const tokenOrgName = "fleet"
+
+	// insert an ABM token as if it had been migrated by the DB migration script
+	tok := mysql.SetTestABMAssets(t, ds, "")
+	// tok, err := ds.InsertABMToken(ctx, &fleet.ABMToken{EncryptedToken: abmToken, RenewAt: time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC)})
+	// require.NoError(t, err)
+	require.Empty(t, tok.OrganizationName)
+
+	// start a server that will mock the Apple DEP API
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		encoder := json.NewEncoder(w)
+		switch r.URL.Path {
+		case "/session":
+			_, _ = w.Write([]byte(`{"auth_session_token": "session123"}`))
+		case "/account":
+			_, _ = w.Write([]byte(fmt.Sprintf(`{"admin_id": "admin123", "org_name": "%s"}`, tokenOrgName)))
+		case "/profile":
+			err := encoder.Encode(godep.ProfileResponse{ProfileUUID: "profile123"})
+			require.NoError(t, err)
+		case "/server/devices":
+			err := encoder.Encode(godep.DeviceResponse{Devices: nil})
+			require.NoError(t, err)
+		case "/devices/sync":
+			err := encoder.Encode(godep.DeviceResponse{Devices: nil})
+			require.NoError(t, err)
+		default:
+			t.Errorf("unexpected request to %s", r.URL.Path)
+		}
+	}))
+	t.Cleanup(srv.Close)
+
+	err = depStorage.StoreConfig(ctx, tokenOrgName, &nanodep_client.Config{BaseURL: srv.URL})
+	require.NoError(t, err)
+	err = depStorage.StoreConfig(ctx, apple_mdm.UnsavedABMTokenOrgName, &nanodep_client.Config{BaseURL: srv.URL})
+	require.NoError(t, err)
+
+	logger := log.NewNopLogger()
+	syncFn := appleMDMDEPSyncerJob(ds, depStorage, logger)
+	err = syncFn(ctx)
+	require.NoError(t, err)
+
+	// token has been updated with its org name/apple id
+	tok, err = ds.GetABMTokenByOrgName(ctx, tokenOrgName)
+	require.NoError(t, err)
+	require.Equal(t, tokenOrgName, tok.OrganizationName)
+	require.Equal(t, "admin123", tok.AppleID)
+	require.Nil(t, tok.MacOSDefaultTeamID)
+	require.Nil(t, tok.IOSDefaultTeamID)
+	require.Nil(t, tok.IPadOSDefaultTeamID)
+
+	// empty-name token does not exist anymore
+	_, err = ds.GetABMTokenByOrgName(ctx, "")
+	require.Error(t, err)
+	var nfe fleet.NotFoundError
+	require.ErrorAs(t, err, &nfe)
+
+	// the default profile was created
+	defProf, err := ds.GetMDMAppleEnrollmentProfileByType(ctx, fleet.MDMAppleEnrollmentTypeAutomatic)
+	require.NoError(t, err)
+	require.NotNil(t, defProf)
+	require.NotEmpty(t, defProf.Token)
+
+	// no profile UUID was assigned for no-team (because there are no hosts right now)
+	_, _, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, nil, "")
+	require.Error(t, err)
+	require.ErrorAs(t, err, &nfe)
+
+	// no teams, so no team-specific custom setup assistants
+	teams, err := ds.ListTeams(ctx, fleet.TeamFilter{User: test.UserAdmin}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Empty(t, teams)
+
+	// no no-team custom setup assistant
+	_, err = ds.GetMDMAppleSetupAssistant(ctx, nil)
+	require.ErrorIs(t, err, sql.ErrNoRows)
+
+	// no host got created
+	hosts, err := ds.ListHosts(ctx, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{})
+	require.NoError(t, err)
+	require.Empty(t, hosts)
+}
diff --git a/cmd/fleet/main.go b/cmd/fleet/main.go
index eff64d3562da..b39cbc2ee942 100644
--- a/cmd/fleet/main.go
+++ b/cmd/fleet/main.go
@@ -2,11 +2,14 @@ package main
 
 import (
 	"fmt"
+	"io"
 	"math/rand"
 	"os"
 	"time"
 
+	"github.com/briandowns/spinner"
 	"github.com/fleetdm/fleet/v4/server/config"
+	"github.com/fleetdm/fleet/v4/server/shellquote"
 	kitlog "github.com/go-kit/log"
 	"github.com/go-kit/log/level"
 	_ "github.com/go-sql-driver/mysql"
@@ -29,6 +32,35 @@ func main() {
 	rootCmd.AddCommand(createConfigDumpCmd(configManager))
 	rootCmd.AddCommand(createVersionCmd(configManager))
 
+	// See if the program is being piped data on stdin.
+	fi, err := os.Stdin.Stat()
+	if err != nil {
+		initFatal(err, "getting stdin stats")
+	}
+	if fi.Mode()&os.ModeNamedPipe != 0 {
+		_, _ = fmt.Fprintln(os.Stderr, "Reading additional arguments from stdin...")
+		// See charsets at https://godoc.org/github.com/briandowns/spinner#pkg-variables
+		s := spinner.New(spinner.CharSets[24], 200*time.Millisecond)
+		s.Writer = os.Stderr
+		s.Start()
+
+		data, err := io.ReadAll(os.Stdin)
+		if err != nil {
+			initFatal(err, "reading from stdin")
+		}
+
+		// Split the string into arguments like a shell would.
+		extraArgs, err := shellquote.Split(string(data))
+		if err != nil {
+			initFatal(err, "splitting arguments from stdin")
+		}
+
+		// Add the new args to the existing args
+		os.Args = append(os.Args, extraArgs...)
+
+		s.Stop()
+	}
+
 	if err := rootCmd.Execute(); err != nil {
 		initFatal(err, "running root command")
 	}
diff --git a/cmd/fleet/serve.go b/cmd/fleet/serve.go
index d645f419b871..c8773ba765cd 100644
--- a/cmd/fleet/serve.go
+++ b/cmd/fleet/serve.go
@@ -22,7 +22,6 @@ import (
 	"github.com/e-dard/netbug"
 	"github.com/fleetdm/fleet/v4/ee/server/licensing"
 	eeservice "github.com/fleetdm/fleet/v4/ee/server/service"
-	"github.com/fleetdm/fleet/v4/pkg/certificate"
 	"github.com/fleetdm/fleet/v4/pkg/scripts"
 	"github.com/fleetdm/fleet/v4/server"
 	configpkg "github.com/fleetdm/fleet/v4/server/config"
@@ -50,6 +49,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/pubsub"
 	"github.com/fleetdm/fleet/v4/server/service"
 	"github.com/fleetdm/fleet/v4/server/service/async"
+	"github.com/fleetdm/fleet/v4/server/service/redis_lock"
 	"github.com/fleetdm/fleet/v4/server/service/redis_policy_set"
 	"github.com/fleetdm/fleet/v4/server/sso"
 	"github.com/fleetdm/fleet/v4/server/version"
@@ -74,7 +74,10 @@ import (
 
 var allowedURLPrefixRegexp = regexp.MustCompile("^(?:/[a-zA-Z0-9_.~-]+)+$")
 
-const softwareInstallerUploadTimeout = 2 * time.Minute
+const (
+	softwareInstallerUploadTimeout = 4 * time.Minute
+	liveQueryMemCacheDuration      = 1 * time.Second
+)
 
 type initializer interface {
 	// Initialize is used to populate a datastore with
@@ -124,6 +127,10 @@ the way that the Fleet server works.
 
 			logger := initLogger(config)
 
+			if dev {
+				createTestBucketForInstallers(&config, logger)
+			}
+
 			// Init tracing
 			if config.Logging.TracingEnabled {
 				ctx := context.Background()
@@ -345,7 +352,7 @@ the way that the Fleet server works.
 			resultStore := pubsub.NewRedisQueryResults(redisPool, config.Redis.DuplicateResults,
 				log.With(logger, "component", "query-results"),
 			)
-			liveQueryStore := live_query.NewRedisLiveQuery(redisPool)
+			liveQueryStore := live_query.NewRedisLiveQuery(redisPool, logger, liveQueryMemCacheDuration)
 			ssoSessionStore := sso.NewSessionStore(redisPool)
 
 			// Set common configuration for all logging.
@@ -504,7 +511,7 @@ the way that the Fleet server works.
 					initFatal(errors.New("inserting APNs and SCEP assets"), "missing required private key. Learn how to configure the private key here: https://fleetdm.com/learn-more-about/fleet-server-private-key")
 				}
 
-				apnsCert, apnsCertPEM, apnsKeyPEM, err := config.MDM.AppleAPNs()
+				_, apnsCertPEM, apnsKeyPEM, err := config.MDM.AppleAPNs()
 				if err != nil {
 					initFatal(err, "validate Apple APNs certificate and key")
 				}
@@ -514,18 +521,6 @@ the way that the Fleet server works.
 					initFatal(err, "validate Apple SCEP certificate and key")
 				}
 
-				const (
-					apnsConnectionTimeout = 10 * time.Second
-					apnsConnectionURL     = "https://api.sandbox.push.apple.com"
-				)
-
-				// check that the Apple APNs certificate is valid to connect to the API
-				ctx, cancel := context.WithTimeout(context.Background(), apnsConnectionTimeout)
-				if err := certificate.ValidateClientAuthTLSConnection(ctx, apnsCert, apnsConnectionURL); err != nil {
-					initFatal(err, "validate authentication with Apple APNs certificate")
-				}
-				cancel()
-
 				err = ds.InsertMDMConfigAssets(context.Background(), []fleet.MDMConfigAsset{
 					{Name: fleet.MDMAssetAPNSCert, Value: apnsCertPEM},
 					{Name: fleet.MDMAssetAPNSKey, Value: apnsKeyPEM},
@@ -563,7 +558,6 @@ the way that the Fleet server works.
 				err = ds.InsertMDMConfigAssets(context.Background(), []fleet.MDMConfigAsset{
 					{Name: fleet.MDMAssetABMKey, Value: appleBM.KeyPEM},
 					{Name: fleet.MDMAssetABMCert, Value: appleBM.CertPEM},
-					{Name: fleet.MDMAssetABMToken, Value: appleBM.EncryptedToken},
 				})
 				if err != nil {
 					// duplicate key errors mean that we already
@@ -575,6 +569,20 @@ the way that the Fleet server works.
 					}
 
 					level.Warn(logger).Log("msg", "Your server already has stored ABM certificates and token. Fleet will ignore any certificates provided via environment variables when this happens.")
+				} else {
+					// insert the ABM token without any metdata,
+					// it'll be picked by the
+					// apple_mdm_dep_profile_assigner cron and
+					// backfilled
+					tok := &fleet.ABMToken{
+						EncryptedToken: appleBM.EncryptedToken,
+						// 2000-01-01 is our "zero value" for time
+						RenewAt: time.Date(2000, time.January, 1, 0, 0, 0, 0, time.UTC),
+					}
+					_, err = ds.InsertABMToken(context.Background(), tok)
+					if err != nil {
+						initFatal(err, "save ABM token")
+					}
 				}
 			}
 
@@ -607,14 +615,29 @@ the way that the Fleet server works.
 					initFatal(err, "validating MDM assets from database")
 				}
 
-				appCfg.MDM.AppleBMEnabledAndConfigured, err = checkMDMAssets([]fleet.MDMAssetName{
+				var appleBMCerts bool
+				appleBMCerts, err = checkMDMAssets([]fleet.MDMAssetName{
 					fleet.MDMAssetABMCert,
 					fleet.MDMAssetABMKey,
-					fleet.MDMAssetABMToken,
 				})
 				if err != nil {
 					initFatal(err, "validating MDM ABM assets from database")
 				}
+				if appleBMCerts {
+					// the ABM certs are there, check if a token exists and if so, apple
+					// BM is enabled and configured.
+					count, err := ds.GetABMTokenCount(context.Background())
+					if err != nil {
+						initFatal(err, "validating MDM ABM token from database")
+					}
+					appCfg.MDM.AppleBMEnabledAndConfigured = count > 0
+				}
+			}
+			if appCfg.MDM.EnabledAndConfigured {
+				level.Info(logger).Log("msg", "Apple MDM enabled")
+			}
+			if appCfg.MDM.AppleBMEnabledAndConfigured {
+				level.Info(logger).Log("msg", "Apple Business Manager enabled")
 			}
 
 			// register the Microsoft MDM services
@@ -691,6 +714,8 @@ the way that the Fleet server works.
 			}
 
 			var softwareInstallStore fleet.SoftwareInstallerStore
+			var bootstrapPackageStore fleet.MDMBootstrapPackageStore
+			var distributedLock fleet.Lock
 			if license.IsPremium() {
 				profileMatcher := apple_mdm.NewProfileMatcher(redisPool)
 				if config.S3.SoftwareInstallersBucket != "" {
@@ -703,6 +728,13 @@ the way that the Fleet server works.
 					}
 					softwareInstallStore = store
 					level.Info(logger).Log("msg", "using S3 software installer store", "bucket", config.S3.SoftwareInstallersBucket)
+
+					bstore, err := s3.NewBootstrapPackageStore(config.S3)
+					if err != nil {
+						initFatal(err, "initializing S3 bootstrap package store")
+					}
+					bootstrapPackageStore = bstore
+					level.Info(logger).Log("msg", "using S3 bootstrap package store", "bucket", config.S3.SoftwareInstallersBucket)
 				} else {
 					installerDir := os.TempDir()
 					if dir := os.Getenv("FLEET_SOFTWARE_INSTALLER_STORE_DIR"); dir != "" {
@@ -718,6 +750,7 @@ the way that the Fleet server works.
 					}
 				}
 
+				distributedLock = redis_lock.NewLock(redisPool)
 				svc, err = eeservice.NewService(
 					svc,
 					ds,
@@ -730,6 +763,8 @@ the way that the Fleet server works.
 					ssoSessionStore,
 					profileMatcher,
 					softwareInstallStore,
+					bootstrapPackageStore,
+					distributedLock,
 				)
 				if err != nil {
 					initFatal(err, "initial Fleet Premium service")
@@ -783,7 +818,7 @@ the way that the Fleet server works.
 				func() (fleet.CronSchedule, error) {
 					commander := apple_mdm.NewMDMAppleCommander(mdmStorage, mdmPushService)
 					return newCleanupsAndAggregationSchedule(
-						ctx, instanceID, ds, logger, redisWrapperDS, &config, commander, softwareInstallStore,
+						ctx, instanceID, ds, logger, redisWrapperDS, &config, commander, softwareInstallStore, bootstrapPackageStore,
 					)
 				},
 			); err != nil {
@@ -845,6 +880,18 @@ the way that the Fleet server works.
 				initFatal(err, "failed to register mdm_apple_profile_manager schedule")
 			}
 
+			if err := cronSchedules.StartCronSchedule(func() (fleet.CronSchedule, error) {
+				return newMDMAPNsPusher(
+					ctx,
+					instanceID,
+					ds,
+					apple_mdm.NewMDMAppleCommander(mdmStorage, mdmPushService),
+					logger,
+				)
+			}); err != nil {
+				initFatal(err, "failed to register APNs pusher schedule")
+			}
+
 			if license.IsPremium() {
 				if err := cronSchedules.StartCronSchedule(func() (fleet.CronSchedule, error) {
 					commander := apple_mdm.NewMDMAppleCommander(mdmStorage, mdmPushService)
@@ -870,7 +917,7 @@ the way that the Fleet server works.
 						} else {
 							config.Calendar.Periodicity = 5 * time.Minute
 						}
-						return cron.NewCalendarSchedule(ctx, instanceID, ds, config.Calendar, logger)
+						return cron.NewCalendarSchedule(ctx, instanceID, ds, distributedLock, config.Calendar, logger)
 					},
 				); err != nil {
 					initFatal(err, "failed to register calendar schedule")
@@ -920,7 +967,7 @@ the way that the Fleet server works.
 				KeyPrefix: "ratelimit::",
 			}
 
-			var apiHandler, frontendHandler http.Handler
+			var apiHandler, frontendHandler, endUserEnrollOTAHandler http.Handler
 			{
 				frontendHandler = service.PrometheusMetricsHandler(
 					"get_frontend",
@@ -938,8 +985,10 @@ the way that the Fleet server works.
 				if setupRequired {
 					apiHandler = service.WithSetup(svc, logger, apiHandler)
 					frontendHandler = service.RedirectLoginToSetup(svc, logger, frontendHandler, config.Server.URLPrefix)
+					endUserEnrollOTAHandler = service.RedirectLoginToSetup(svc, logger, frontendHandler, config.Server.URLPrefix)
 				} else {
 					frontendHandler = service.RedirectSetupToLogin(svc, logger, frontendHandler, config.Server.URLPrefix)
+					endUserEnrollOTAHandler = service.ServeEndUserEnrollOTA(config.Server.URLPrefix, logger)
 				}
 
 			}
@@ -1055,22 +1104,26 @@ the way that the Fleet server works.
 					// when uploading a software installer, the file might be large so
 					// the read timeout (to read the full request body) must be extended.
 					rc := http.NewResponseController(rw)
-					// the frontend times out waiting for the upload after 2 minutes, so
+					// the frontend times out waiting for the upload after 4 minutes,
 					// use that same timeout:
 					// https://www.figma.com/design/oQl2oQUG0iRkUy0YOxc307/%2314921-Deploy-security-agents-to-macOS%2C-Windows%2C-and-Linux-hosts?node-id=773-18032&t=QjEU6tc73tddNSqn-0
 					if err := rc.SetReadDeadline(time.Now().Add(softwareInstallerUploadTimeout)); err != nil {
 						level.Error(logger).Log("msg", "http middleware failed to override endpoint read timeout", "err", err)
 					}
-					// the write timeout should be extended as well to give the server time to
-					// write a response body with the right error, otherwise the connection is
-					// terminated abruptly.
-					if err := rc.SetWriteDeadline(time.Now().Add(softwareInstallerUploadTimeout + 30*time.Second)); err != nil {
+					// the write timeout should be extended to give the server time to
+					// store the installer to S3 (or the configured storage location) and
+					// write a response body, otherwise the connection is terminated
+					// abruptly. Give it twice the read timeout, so that if it takes
+					// 3m59s to upload an installer, we don't fail because of a lack of
+					// time to store to S3.
+					if err := rc.SetWriteDeadline(time.Now().Add(2 * softwareInstallerUploadTimeout)); err != nil {
 						level.Error(logger).Log("msg", "http middleware failed to override endpoint write timeout", "err", err)
 					}
 					req.Body = http.MaxBytesReader(rw, req.Body, service.MaxSoftwareInstallerSize)
 				}
 				apiHandler.ServeHTTP(rw, req)
 			})
+			rootMux.Handle("/enroll", endUserEnrollOTAHandler)
 			rootMux.Handle("/", frontendHandler)
 
 			debugHandler := &debugMux{
@@ -1355,3 +1408,18 @@ var _ push.Pusher = nopPusher{}
 func (n nopPusher) Push(context.Context, []string) (map[string]*push.Response, error) {
 	return nil, nil
 }
+
+func createTestBucketForInstallers(config *configpkg.FleetConfig, logger log.Logger) {
+	store, err := s3.NewSoftwareInstallerStore(config.S3)
+	if err != nil {
+		initFatal(err, "initializing S3 software installer store")
+	}
+	if err := store.CreateTestBucket(config.S3.SoftwareInstallersBucket); err != nil {
+		// Don't panic, allow devs to run Fleet without minio/S3 dependency.
+		level.Info(logger).Log(
+			"err", err,
+			"msg", "failed to create test bucket",
+			"name", config.S3.SoftwareInstallersBucket,
+		)
+	}
+}
diff --git a/cmd/fleet/serve_test.go b/cmd/fleet/serve_test.go
index 41e7d3885ad4..675f1242aa76 100644
--- a/cmd/fleet/serve_test.go
+++ b/cmd/fleet/serve_test.go
@@ -116,6 +116,10 @@ func TestMaybeSendStatistics(t *testing.T) {
 			HostsEnrolledByOsqueryVersion: []fleet.HostsCountByOsqueryVersion{},
 			StoredErrors:                  []byte(`[]`),
 			Organization:                  "Fleet",
+			AIFeaturesDisabled:            true,
+			MaintenanceWindowsEnabled:     true,
+			MaintenanceWindowsConfigured:  true,
+			NumHostsFleetDesktopEnabled:   1984,
 		}, true, nil
 	}
 	recorded := false
@@ -134,7 +138,7 @@ func TestMaybeSendStatistics(t *testing.T) {
 	require.NoError(t, err)
 	assert.True(t, recorded)
 	require.True(t, cleanedup)
-	assert.Equal(t, `{"anonymousIdentifier":"ident","fleetVersion":"1.2.3","licenseTier":"premium","organization":"Fleet","numHostsEnrolled":999,"numUsers":99,"numSoftwareVersions":100,"numHostSoftwares":101,"numSoftwareTitles":102,"numHostSoftwareInstalledPaths":103,"numSoftwareCPEs":104,"numSoftwareCVEs":105,"numTeams":9,"numPolicies":0,"numLabels":3,"softwareInventoryEnabled":true,"vulnDetectionEnabled":true,"systemUsersEnabled":true,"hostsStatusWebHookEnabled":true,"mdmMacOsEnabled":false,"hostExpiryEnabled":false,"mdmWindowsEnabled":false,"liveQueryDisabled":false,"numWeeklyActiveUsers":111,"numWeeklyPolicyViolationDaysActual":0,"numWeeklyPolicyViolationDaysPossible":0,"hostsEnrolledByOperatingSystem":{"linux":[{"version":"1.2.3","numEnrolled":22}]},"hostsEnrolledByOrbitVersion":[],"hostsEnrolledByOsqueryVersion":[],"storedErrors":[],"numHostsNotResponding":0}`, requestBody)
+	assert.Equal(t, `{"anonymousIdentifier":"ident","fleetVersion":"1.2.3","licenseTier":"premium","organization":"Fleet","numHostsEnrolled":999,"numUsers":99,"numSoftwareVersions":100,"numHostSoftwares":101,"numSoftwareTitles":102,"numHostSoftwareInstalledPaths":103,"numSoftwareCPEs":104,"numSoftwareCVEs":105,"numTeams":9,"numPolicies":0,"numLabels":3,"softwareInventoryEnabled":true,"vulnDetectionEnabled":true,"systemUsersEnabled":true,"hostsStatusWebHookEnabled":true,"mdmMacOsEnabled":false,"hostExpiryEnabled":false,"mdmWindowsEnabled":false,"liveQueryDisabled":false,"numWeeklyActiveUsers":111,"numWeeklyPolicyViolationDaysActual":0,"numWeeklyPolicyViolationDaysPossible":0,"hostsEnrolledByOperatingSystem":{"linux":[{"version":"1.2.3","numEnrolled":22}]},"hostsEnrolledByOrbitVersion":[],"hostsEnrolledByOsqueryVersion":[],"storedErrors":[],"numHostsNotResponding":0,"aiFeaturesDisabled":true,"maintenanceWindowsEnabled":true,"maintenanceWindowsConfigured":true,"numHostsFleetDesktopEnabled":1984}`, requestBody)
 }
 
 func TestMaybeSendStatisticsSkipsSendingIfNotNeeded(t *testing.T) {
@@ -294,6 +298,7 @@ func TestAutomationsSchedule(t *testing.T) {
 }
 
 func TestCronVulnerabilitiesCreatesDatabasesPath(t *testing.T) {
+	t.Parallel()
 	ctx, cancelFunc := context.WithCancel(context.Background())
 	defer cancelFunc()
 
diff --git a/cmd/fleetctl/apply.go b/cmd/fleetctl/apply.go
index 751c74709f18..b201f5dc9474 100644
--- a/cmd/fleetctl/apply.go
+++ b/cmd/fleetctl/apply.go
@@ -90,7 +90,7 @@ func applyCommand() *cli.Command {
 				opts.TeamForPolicies = policiesTeamName
 			}
 			baseDir := filepath.Dir(flFilename)
-			_, err = fleetClient.ApplyGroup(c.Context, specs, baseDir, logf, opts)
+			_, _, err = fleetClient.ApplyGroup(c.Context, specs, baseDir, logf, nil, opts)
 			if err != nil {
 				return err
 			}
diff --git a/cmd/fleetctl/apply_test.go b/cmd/fleetctl/apply_test.go
index 5798e26aa87c..1010e8ad1eeb 100644
--- a/cmd/fleetctl/apply_test.go
+++ b/cmd/fleetctl/apply_test.go
@@ -167,12 +167,15 @@ func TestApplyTeamSpecs(t *testing.T) {
 		return nil
 	}
 
-	ds.BatchSetMDMProfilesFunc = func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration) error {
-		return nil
+	ds.BatchSetMDMProfilesFunc = func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile,
+		winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	ds.NewActivityFunc = func(
@@ -182,8 +185,17 @@ func TestApplyTeamSpecs(t *testing.T) {
 	}
 
 	ds.LabelIDsByNameFunc = func(ctx context.Context, labels []string) (map[string]uint, error) {
-		require.ElementsMatch(t, labels, []string{fleet.BuiltinLabelMacOS14Plus})
-		return map[string]uint{fleet.BuiltinLabelMacOS14Plus: 1}, nil
+		require.Len(t, labels, 1)
+		switch labels[0] {
+		case fleet.BuiltinLabelMacOS14Plus:
+			return map[string]uint{fleet.BuiltinLabelMacOS14Plus: 1}, nil
+		case fleet.BuiltinLabelIOS:
+			return map[string]uint{fleet.BuiltinLabelIOS: 2}, nil
+		case fleet.BuiltinLabelIPadOS:
+			return map[string]uint{fleet.BuiltinLabelIPadOS: 3}, nil
+		default:
+			return nil, &notFoundError{}
+		}
 	}
 
 	ds.SetOrUpdateMDMAppleDeclarationFunc = func(ctx context.Context, declaration *fleet.MDMAppleDeclaration) (*fleet.MDMAppleDeclaration, error) {
@@ -222,7 +234,7 @@ spec:
 
 	newAgentOpts := json.RawMessage(`{"config":{"views":{"foo":"bar"}}}`)
 	newMDMSettings := fleet.TeamMDM{
-		MacOSUpdates: fleet.MacOSUpdates{
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("12.3.1"),
 			Deadline:       optjson.SetString("2011-03-01"),
 		},
@@ -258,7 +270,7 @@ spec:
 `)
 	require.Equal(t, "[+] applied 1 teams\n", runAppForTest(t, []string{"apply", "-f", filename}))
 	newMDMSettings = fleet.TeamMDM{
-		MacOSUpdates: fleet.MacOSUpdates{
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("12.3.1"),
 			Deadline:       optjson.SetString("2011-03-01"),
 		},
@@ -286,7 +298,7 @@ spec:
 `, mobileCfgPath))
 
 	newMDMSettings = fleet.TeamMDM{
-		MacOSUpdates: fleet.MacOSUpdates{
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("12.3.1"),
 			Deadline:       optjson.SetString("2011-03-01"),
 		},
@@ -325,15 +337,29 @@ spec:
       macos_updates:
         minimum_version: 10.10.10
         deadline: 1992-03-01
+      ios_updates:
+        minimum_version: 11.11.11
+        deadline: 1993-04-02
+      ipados_updates:
+        minimum_version: 12.12.12
+        deadline: 1994-05-03
     secrets:
       - secret: BBB
 `)
 
 	newMDMSettings = fleet.TeamMDM{
-		MacOSUpdates: fleet.MacOSUpdates{
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("10.10.10"),
 			Deadline:       optjson.SetString("1992-03-01"),
 		},
+		IOSUpdates: fleet.AppleOSUpdateSettings{
+			MinimumVersion: optjson.SetString("11.11.11"),
+			Deadline:       optjson.SetString("1993-04-02"),
+		},
+		IPadOSUpdates: fleet.AppleOSUpdateSettings{
+			MinimumVersion: optjson.SetString("12.12.12"),
+			Deadline:       optjson.SetString("1994-05-03"),
+		},
 		WindowsUpdates: fleet.WindowsUpdates{
 			DeadlineDays:    optjson.SetInt(5),
 			GracePeriodDays: optjson.SetInt(1),
@@ -398,6 +424,12 @@ spec:
       macos_updates:
         minimum_version:
         deadline:
+      ios_updates:
+        minimum_version:
+        deadline:
+      ipados_updates:
+        minimum_version:
+        deadline:
       windows_updates:
         deadline_days:
         grace_period_days:
@@ -406,7 +438,15 @@ spec:
 `)
 
 	newMDMSettings = fleet.TeamMDM{
-		MacOSUpdates: fleet.MacOSUpdates{
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
+			MinimumVersion: optjson.String{Set: true},
+			Deadline:       optjson.String{Set: true},
+		},
+		IOSUpdates: fleet.AppleOSUpdateSettings{
+			MinimumVersion: optjson.String{Set: true},
+			Deadline:       optjson.String{Set: true},
+		},
+		IPadOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.String{Set: true},
 			Deadline:       optjson.String{Set: true},
 		},
@@ -549,6 +589,10 @@ func TestApplyAppConfig(t *testing.T) {
 		return userRoleSpecList, nil
 	}
 
+	ds.SaveABMTokenFunc = func(ctx context.Context, tok *fleet.ABMToken) error {
+		return nil
+	}
+
 	ds.NewActivityFunc = func(
 		ctx context.Context, user *fleet.User, activity fleet.ActivityDetails, details []byte, createdAt time.Time,
 	) error {
@@ -586,8 +630,9 @@ func TestApplyAppConfig(t *testing.T) {
 		return nil
 	}
 
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	ds.LabelIDsByNameFunc = func(ctx context.Context, labels []string) (map[string]uint, error) {
@@ -603,6 +648,12 @@ func TestApplyAppConfig(t *testing.T) {
 	ds.DeleteMDMAppleDeclarationByNameFunc = func(ctx context.Context, teamID *uint, name string) error {
 		return nil
 	}
+	ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+		return []*fleet.ABMToken{{OrganizationName: "Fleet Device Management Inc."}}, nil
+	}
+	ds.TeamsSummaryFunc = func(ctx context.Context) ([]*fleet.TeamSummary, error) {
+		return []*fleet.TeamSummary{{Name: "team1", ID: 1}}, nil
+	}
 
 	name := writeTmpYml(t, `---
 apiVersion: v1
@@ -622,9 +673,9 @@ spec:
 `)
 
 	newMDMSettings := fleet.MDM{
-		AppleBMDefaultTeam:  "team1",
-		AppleBMTermsExpired: false,
-		MacOSUpdates: fleet.MacOSUpdates{
+		DeprecatedAppleBMDefaultTeam: "team1",
+		AppleBMTermsExpired:          false,
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("12.1.1"),
 			Deadline:       optjson.SetString("2011-02-01"),
 		},
@@ -677,9 +728,9 @@ spec:
 `)
 
 	newMDMSettings = fleet.MDM{
-		AppleBMDefaultTeam:  "team1",
-		AppleBMTermsExpired: false,
-		MacOSUpdates: fleet.MacOSUpdates{
+		DeprecatedAppleBMDefaultTeam: "team1",
+		AppleBMTermsExpired:          false,
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("12.1.1"),
 			Deadline:       optjson.SetString("2011-02-01"),
 		},
@@ -1203,11 +1254,14 @@ func TestApplyAsGitOps(t *testing.T) {
 		teamEnrollSecrets = secrets
 		return nil
 	}
-	ds.BatchSetMDMProfilesFunc = func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration) error {
-		return nil
+	ds.BatchSetMDMProfilesFunc = func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile,
+		winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.GetMDMAppleSetupAssistantFunc = func(ctx context.Context, teamID *uint) (*fleet.MDMAppleSetupAssistant, error) {
 		return nil, &notFoundError{}
@@ -1221,7 +1275,7 @@ func TestApplyAsGitOps(t *testing.T) {
 	ds.GetMDMAppleBootstrapPackageMetaFunc = func(ctx context.Context, teamID uint) (*fleet.MDMAppleBootstrapPackage, error) {
 		return nil, &notFoundError{}
 	}
-	ds.InsertMDMAppleBootstrapPackageFunc = func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage) error {
+	ds.InsertMDMAppleBootstrapPackageFunc = func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage, pkgStore fleet.MDMBootstrapPackageStore) error {
 		return nil
 	}
 	ds.SetOrUpdateMDMWindowsConfigProfileFunc = func(ctx context.Context, cp fleet.MDMWindowsConfigProfile) error {
@@ -1315,7 +1369,7 @@ spec:
 			MacOSSetupAssistant:         optjson.SetString(emptySetupAsst),
 			EnableReleaseDeviceManually: optjson.SetBool(false),
 		},
-		MacOSUpdates: fleet.MacOSUpdates{
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("10.10.10"),
 			Deadline:       optjson.SetString("2020-02-02"),
 		},
@@ -1358,7 +1412,7 @@ spec:
 			BootstrapPackage:            optjson.SetString(bootstrapURL),
 			EnableReleaseDeviceManually: optjson.SetBool(false),
 		},
-		MacOSUpdates: fleet.MacOSUpdates{
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("10.10.10"),
 			Deadline:       optjson.SetString("2020-02-02"),
 		},
@@ -1409,7 +1463,7 @@ spec:
 		MacOSSettings: fleet.MacOSSettings{
 			CustomSettings: []fleet.MDMProfileSpec{{Path: mobileConfigPath}},
 		},
-		MacOSUpdates: fleet.MacOSUpdates{
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("10.10.10"),
 			Deadline:       optjson.SetString("1992-03-01"),
 		},
@@ -1451,7 +1505,7 @@ spec:
 		MacOSSettings: fleet.MacOSSettings{
 			CustomSettings: []fleet.MDMProfileSpec{{Path: mobileConfigPath}},
 		},
-		MacOSUpdates: fleet.MacOSUpdates{
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("10.10.10"),
 			Deadline:       optjson.SetString("1992-03-01"),
 		},
@@ -1488,7 +1542,7 @@ spec:
 		MacOSSettings: fleet.MacOSSettings{
 			CustomSettings: []fleet.MDMProfileSpec{{Path: mobileConfigPath}},
 		},
-		MacOSUpdates: fleet.MacOSUpdates{
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("10.10.10"),
 			Deadline:       optjson.SetString("1992-03-01"),
 		},
@@ -1964,7 +2018,7 @@ func TestApplyMacosSetup(t *testing.T) {
 			}
 			return nil, &notFoundError{}
 		}
-		ds.InsertMDMAppleBootstrapPackageFunc = func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage) error {
+		ds.InsertMDMAppleBootstrapPackageFunc = func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage, pkgStore fleet.MDMBootstrapPackageStore) error {
 			return nil
 		}
 		ds.DeleteMDMAppleBootstrapPackageFunc = func(ctx context.Context, teamID uint) error {
@@ -2350,7 +2404,7 @@ spec:
 			t.Run(c.pkgName, func(t *testing.T) {
 				srv, pkgLen := serveMDMBootstrapPackage(t, filepath.Join("../../server/service/testdata/bootstrap-packages", c.pkgName), c.pkgName)
 				ds := setupServer(t, true)
-				ds.InsertMDMAppleBootstrapPackageFunc = func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage) error {
+				ds.InsertMDMAppleBootstrapPackageFunc = func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage, pkgStore fleet.MDMBootstrapPackageStore) error {
 					require.Equal(t, len(bp.Bytes), pkgLen)
 					return nil
 				}
@@ -2409,7 +2463,7 @@ spec:
 		defer srv.Close()
 
 		ds := setupServer(t, true)
-		ds.InsertMDMAppleBootstrapPackageFunc = func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage) error {
+		ds.InsertMDMAppleBootstrapPackageFunc = func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage, pkgStore fleet.MDMBootstrapPackageStore) error {
 			mockStore.Lock()
 			defer mockStore.Unlock()
 			require.Equal(t, pkgName, bp.Name)
@@ -2562,6 +2616,7 @@ spec:
 }
 
 func TestApplySpecs(t *testing.T) {
+	t.Parallel()
 	// create a macos setup json file (content not important)
 	macSetupFile := writeTmpJSON(t, map[string]any{})
 
diff --git a/cmd/fleetctl/get_test.go b/cmd/fleetctl/get_test.go
index 009fbbeb9685..fc9dbe03fbca 100644
--- a/cmd/fleetctl/get_test.go
+++ b/cmd/fleetctl/get_test.go
@@ -166,10 +166,18 @@ func TestGetTeams(t *testing.T) {
 								HostExpiryWindow:  15,
 							},
 							MDM: fleet.TeamMDM{
-								MacOSUpdates: fleet.MacOSUpdates{
+								MacOSUpdates: fleet.AppleOSUpdateSettings{
 									MinimumVersion: optjson.SetString("12.3.1"),
 									Deadline:       optjson.SetString("2021-12-14"),
 								},
+								IOSUpdates: fleet.AppleOSUpdateSettings{
+									MinimumVersion: optjson.SetString("17.5"),
+									Deadline:       optjson.SetString("2022-11-15"),
+								},
+								IPadOSUpdates: fleet.AppleOSUpdateSettings{
+									MinimumVersion: optjson.SetString("18.0"),
+									Deadline:       optjson.SetString("2023-01-01"),
+								},
 								WindowsUpdates: fleet.WindowsUpdates{
 									DeadlineDays:    optjson.SetInt(7),
 									GracePeriodDays: optjson.SetInt(3),
@@ -684,10 +692,10 @@ func TestGetSoftwareTitles(t *testing.T) {
 apiVersion: "1"
 kind: software_title
 spec:
-- hosts_count: 2
+- app_store_app: null
+  hosts_count: 2
   id: 0
   name: foo
-  self_service: false
   software_package: null
   source: chrome_extensions
   versions:
@@ -705,10 +713,10 @@ spec:
     vulnerabilities:
     - cve-123-456-003
   versions_count: 3
-- hosts_count: 0
+- app_store_app: null
+  hosts_count: 0
   id: 0
   name: bar
-  self_service: false
   software_package: null
   source: deb_packages
   versions:
@@ -753,8 +761,8 @@ spec:
           ]
         }
       ],
-      "self_service": false,
-	  "software_package": null
+      "software_package": null,
+      "app_store_app": null
     },
     {
       "id": 0,
@@ -766,11 +774,11 @@ spec:
         {
           "id": 0,
           "version": "0.0.3",
-		  "vulnerabilities": null
+      "vulnerabilities": null
         }
       ],
-      "self_service": false,
-	  "software_package": null
+      "software_package": null,
+      "app_store_app": null
     }
   ]
 }
@@ -2052,8 +2060,13 @@ func TestGetAppleBM(t *testing.T) {
 		assert.Contains(t, err.Error(), expected)
 	})
 
-	t.Run("premium license", func(t *testing.T) {
-		runServerWithMockedDS(t, &service.TestServerOpts{License: &fleet.LicenseInfo{Tier: fleet.TierPremium}, DEPStorage: depStorage})
+	t.Run("premium license, single token", func(t *testing.T) {
+		_, ds := runServerWithMockedDS(t, &service.TestServerOpts{License: &fleet.LicenseInfo{Tier: fleet.TierPremium}, DEPStorage: depStorage})
+		ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+			return []*fleet.ABMToken{
+				{ID: 1},
+			}, nil
+		}
 
 		out := runAppForTest(t, []string{"get", "mdm_apple_bm"})
 		assert.Contains(t, out, "Apple ID:")
@@ -2062,6 +2075,29 @@ func TestGetAppleBM(t *testing.T) {
 		assert.Contains(t, out, "Renew date:")
 		assert.Contains(t, out, "Default team:")
 	})
+
+	t.Run("premium license, no token", func(t *testing.T) {
+		_, ds := runServerWithMockedDS(t, &service.TestServerOpts{License: &fleet.LicenseInfo{Tier: fleet.TierPremium}, DEPStorage: depStorage})
+		ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+			return nil, nil
+		}
+
+		out := runAppForTest(t, []string{"get", "mdm_apple_bm"})
+		assert.Contains(t, out, "No Apple Business Manager server token found.")
+	})
+
+	t.Run("premium license, multiple tokens", func(t *testing.T) {
+		_, ds := runServerWithMockedDS(t, &service.TestServerOpts{License: &fleet.LicenseInfo{Tier: fleet.TierPremium}, DEPStorage: depStorage})
+		ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+			return []*fleet.ABMToken{
+				{ID: 1},
+				{ID: 2},
+			}, nil
+		}
+
+		_, err := runAppNoChecks([]string{"get", "mdm_apple_bm"})
+		assert.ErrorContains(t, err, "This API endpoint has been deprecated. Please use the new GET /abm_tokens API endpoint")
+	})
 }
 
 func TestGetCarves(t *testing.T) {
@@ -2225,7 +2261,7 @@ func TestGetTeamsYAMLAndApply(t *testing.T) {
 				AdditionalQueries: &additionalQueries,
 			},
 			MDM: fleet.TeamMDM{
-				MacOSUpdates: fleet.MacOSUpdates{
+				MacOSUpdates: fleet.AppleOSUpdateSettings{
 					MinimumVersion: optjson.SetString("12.3.1"),
 					Deadline:       optjson.SetString("2021-12-14"),
 				},
@@ -2261,11 +2297,14 @@ func TestGetTeamsYAMLAndApply(t *testing.T) {
 		}
 		return nil, fmt.Errorf("team not found: %s", name)
 	}
-	ds.BatchSetMDMProfilesFunc = func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration) error {
-		return nil
+	ds.BatchSetMDMProfilesFunc = func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile,
+		winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.BatchSetScriptsFunc = func(ctx context.Context, tmID *uint, scripts []*fleet.Script) error {
 		return nil
@@ -2281,8 +2320,8 @@ func TestGetTeamsYAMLAndApply(t *testing.T) {
 		declaration.DeclarationUUID = uuid.NewString()
 		return declaration, nil
 	}
-	ds.BatchSetSoftwareInstallersFunc = func(ctx context.Context, tmID *uint, installers []*fleet.UploadSoftwareInstallerPayload) error {
-		return nil
+	ds.BatchSetSoftwareInstallersFunc = func(ctx context.Context, tmID *uint, installers []*fleet.UploadSoftwareInstallerPayload) ([]fleet.SoftwareInstaller, error) {
+		return nil, nil
 	}
 
 	actualYaml := runAppForTest(t, []string{"get", "teams", "--yaml"})
diff --git a/cmd/fleetctl/gitops.go b/cmd/fleetctl/gitops.go
index c56016eca323..b593ebf9299b 100644
--- a/cmd/fleetctl/gitops.go
+++ b/cmd/fleetctl/gitops.go
@@ -78,11 +78,13 @@ func gitopsCommand() *cli.Command {
 				return errors.New("no license struct found in app config")
 			}
 
-			var appleBMDefaultTeam string
-			var appleBMDefaultTeamFound bool
+			var originalABMConfig []any
+			var originalVPPConfig []any
 			var teamNames []string
 			var firstFileMustBeGlobal *bool
 			var teamDryRunAssumptions *fleet.TeamSpecsDryRunAssumptions
+			var abmTeams, vppTeams []string
+			var hasMissingABMTeam, hasMissingVPPTeam, usesLegacyABMConfig bool
 			if totalFilenames > 1 {
 				firstFileMustBeGlobal = ptr.Bool(true)
 			}
@@ -90,7 +92,7 @@ func gitopsCommand() *cli.Command {
 			secrets := make(map[string]struct{})
 			for _, flFilename := range flFilenames.Value() {
 				baseDir := filepath.Dir(flFilename)
-				config, err := spec.GitOpsFromFile(flFilename, baseDir)
+				config, err := spec.GitOpsFromFile(flFilename, baseDir, appConfig)
 				if err != nil {
 					return err
 				}
@@ -106,12 +108,57 @@ func gitopsCommand() *cli.Command {
 					}
 					firstFileMustBeGlobal = ptr.Bool(false)
 				}
+
+				// Special handling for tokens is required because they link to teams (by
+				// name.) Because teams can be created/deleted during the same gitops run, we
+				// grab some information to help us determine allowed/restricted actions and
+				// when to perform the associations.
 				if isGlobalConfig && totalFilenames > 1 {
-					// Check if Apple BM default team already exists
-					appleBMDefaultTeam, appleBMDefaultTeamFound, err = checkAppleBMDefaultTeam(config, fleetClient)
+					abmTeams, hasMissingABMTeam, usesLegacyABMConfig, err = checkABMTeamAssignments(config, fleetClient)
+					if err != nil {
+						return err
+					}
+
+					vppTeams, hasMissingVPPTeam, err = checkVPPTeamAssignments(config, fleetClient)
 					if err != nil {
 						return err
 					}
+
+					// if one of the teams assigned to an ABM token doesn't exist yet, we need to
+					// submit the configs without the ABM default team set. We'll set those
+					// separately later when the teams are already created.
+					if hasMissingABMTeam {
+						if mdm, ok := config.OrgSettings["mdm"]; ok {
+							if mdmMap, ok := mdm.(map[string]any); ok {
+								if appleBM, ok := mdmMap["apple_business_manager"]; ok {
+									if bmSettings, ok := appleBM.([]any); ok {
+										originalABMConfig = bmSettings
+									}
+								}
+
+								// If team is not found, we need to remove the AppleBMDefaultTeam from
+								// the global config, and then apply it after teams are processed
+								mdmMap["apple_business_manager"] = nil
+								mdmMap["apple_bm_default_team"] = ""
+							}
+						}
+					}
+
+					if hasMissingVPPTeam {
+						if mdm, ok := config.OrgSettings["mdm"]; ok {
+							if mdmMap, ok := mdm.(map[string]any); ok {
+								if vpp, ok := mdmMap["volume_purchasing_program"]; ok {
+									if vppSettings, ok := vpp.([]any); ok {
+										originalVPPConfig = vppSettings
+									}
+								}
+
+								// If team is not found, we need to remove the VPP config from
+								// the global config, and then apply it after teams are processed
+								mdmMap["volume_purchasing_program"] = nil
+							}
+						}
+					}
 				}
 				logf := func(format string, a ...interface{}) {
 					_, _ = fmt.Fprintf(c.App.Writer, format, a...)
@@ -135,10 +182,15 @@ func gitopsCommand() *cli.Command {
 					teamDryRunAssumptions = assumptions
 				}
 			}
-			if appleBMDefaultTeam != "" && !appleBMDefaultTeamFound {
-				// If the Apple BM default team did not exist earlier, check again and apply it if needed
-				err = applyAppleBMDefaultTeamIfNeeded(c, teamNames, appleBMDefaultTeam, flDryRun, fleetClient)
-				if err != nil {
+
+			// if there were assignments to tokens, and some of the teams were missing at that time, submit a separate patch request to set them now.
+			if len(abmTeams) > 0 && hasMissingABMTeam {
+				if err = applyABMTokenAssignmentIfNeeded(c, teamNames, abmTeams, originalABMConfig, usesLegacyABMConfig, flDryRun, fleetClient); err != nil {
+					return err
+				}
+			}
+			if len(vppTeams) > 0 && hasMissingVPPTeam {
+				if err = applyVPPTokenAssignmentIfNeeded(c, teamNames, vppTeams, originalVPPConfig, flDryRun, fleetClient); err != nil {
 					return err
 				}
 			}
@@ -149,8 +201,14 @@ func gitopsCommand() *cli.Command {
 				}
 				for _, team := range teams {
 					if !slices.Contains(teamNames, team.Name) {
-						if appleBMDefaultTeam == team.Name {
-							return fmt.Errorf("apple_bm_default_team %s cannot be deleted", appleBMDefaultTeam)
+						if slices.Contains(abmTeams, team.Name) {
+							if usesLegacyABMConfig {
+								return fmt.Errorf("apple_bm_default_team %s cannot be deleted", team.Name)
+							}
+							return fmt.Errorf("apple_business_manager team %s cannot be deleted", team.Name)
+						}
+						if slices.Contains(vppTeams, team.Name) {
+							return fmt.Errorf("volume_purchasing_program team %s cannot be deleted", team.Name)
 						}
 						if flDryRun {
 							_, _ = fmt.Fprintf(c.App.Writer, "[!] would delete team %s\n", team.Name)
@@ -174,54 +232,194 @@ func gitopsCommand() *cli.Command {
 	}
 }
 
-func checkAppleBMDefaultTeam(config *spec.GitOps, fleetClient *service.Client) (
-	appleBMDefaultTeam string, appleBMDefaultTeamFound bool, err error,
+// checkABMTeamAssignments validates the spec, and finds if:
+//
+// 1. The user is using the legacy apple_bm_default_team config.
+// 2. All teams assigned to ABM tokens already exist.
+// 3. Performs validations according to the spec for both the new and the
+// deprecated key used for this setting.
+func checkABMTeamAssignments(config *spec.GitOps, fleetClient *service.Client) (
+	abmTeams []string, missingTeam bool, usesLegacyConfig bool, err error,
 ) {
 	if mdm, ok := config.OrgSettings["mdm"]; ok {
-		if mdmMap, ok := mdm.(map[string]interface{}); ok {
-			if appleBMDT, ok := mdmMap["apple_bm_default_team"]; ok {
-				if appleBMDefaultTeam, ok = appleBMDT.(string); ok {
-					teams, err := fleetClient.ListTeams("")
-					if err != nil {
-						return "", false, err
-					}
-					// Normalize AppleBMDefaultTeam for Unicode support
+		if mdmMap, ok := mdm.(map[string]any); ok {
+			appleBMDT, hasLegacyConfig := mdmMap["apple_bm_default_team"]
+			appleBM, hasNewConfig := mdmMap["apple_business_manager"]
+
+			if hasLegacyConfig && hasNewConfig {
+				return nil, false, false, errors.New(fleet.AppleABMDefaultTeamDeprecatedMessage)
+			}
+
+			if !hasLegacyConfig && !hasNewConfig {
+				return nil, false, false, nil
+			}
+
+			teams, err := fleetClient.ListTeams("")
+			if err != nil {
+				return nil, false, false, err
+			}
+			teamNames := map[string]struct{}{}
+			for _, tm := range teams {
+				teamNames[tm.Name] = struct{}{}
+			}
+
+			if hasLegacyConfig {
+				if appleBMDefaultTeam, ok := appleBMDT.(string); ok {
+					// normalize for Unicode support
 					appleBMDefaultTeam = norm.NFC.String(appleBMDefaultTeam)
-					for _, team := range teams {
-						if team.Name == appleBMDefaultTeam {
-							appleBMDefaultTeamFound = true
-							break
+					abmTeams = append(abmTeams, appleBMDefaultTeam)
+					usesLegacyConfig = true
+					if _, ok = teamNames[appleBMDefaultTeam]; !ok {
+						missingTeam = true
+					}
+				}
+			}
+
+			if hasNewConfig {
+				if settingMap, ok := appleBM.([]any); ok {
+					for _, item := range settingMap {
+						if cfg, ok := item.(map[string]any); ok {
+							for _, teamConfigKey := range []string{"macos_team", "ios_team", "ipados_team"} {
+								if team, ok := cfg[teamConfigKey].(string); ok && team != "" {
+									// normalize for Unicode support
+									team = norm.NFC.String(team)
+									abmTeams = append(abmTeams, team)
+									if _, ok := teamNames[team]; !ok {
+										missingTeam = true
+									}
+								}
+							}
 						}
 					}
-					if !appleBMDefaultTeamFound {
-						// If team is not found, we need to remove the AppleBMDefaultTeam from the global config, and then apply it after teams are processed
-						mdmMap["apple_bm_default_team"] = ""
+				}
+			}
+		}
+	}
+
+	return abmTeams, missingTeam, usesLegacyConfig, nil
+}
+
+func applyABMTokenAssignmentIfNeeded(
+	ctx *cli.Context,
+	teamNames []string,
+	abmTeamNames []string,
+	originalMDMConfig []any,
+	usesLegacyConfig bool,
+	flDryRun bool,
+	fleetClient *service.Client,
+) error {
+	if usesLegacyConfig && len(abmTeamNames) > 1 {
+		return errors.New(fleet.AppleABMDefaultTeamDeprecatedMessage)
+	}
+
+	if usesLegacyConfig && len(abmTeamNames) == 0 {
+		return errors.New("using legacy config without any ABM teams defined")
+	}
+
+	var appConfigUpdate map[string]map[string]any
+	if usesLegacyConfig {
+		appleBMDefaultTeam := abmTeamNames[0]
+		if !slices.Contains(teamNames, appleBMDefaultTeam) {
+			return fmt.Errorf("apple_bm_default_team %s not found in team configs", appleBMDefaultTeam)
+		}
+		appConfigUpdate = map[string]map[string]any{
+			"mdm": {
+				"apple_bm_default_team": appleBMDefaultTeam,
+			},
+		}
+	} else {
+		for _, abmTeam := range abmTeamNames {
+			if !slices.Contains(teamNames, abmTeam) {
+				return fmt.Errorf("apple_business_manager team %s not found in team configs", abmTeam)
+			}
+		}
+
+		appConfigUpdate = map[string]map[string]any{
+			"mdm": {
+				"apple_business_manager": originalMDMConfig,
+			},
+		}
+	}
+
+	if flDryRun {
+		_, _ = fmt.Fprint(ctx.App.Writer, "[!] would apply ABM teams\n")
+		return nil
+	}
+	_, _ = fmt.Fprintf(ctx.App.Writer, "[+] applying ABM teams\n")
+	if err := fleetClient.ApplyAppConfig(appConfigUpdate, fleet.ApplySpecOptions{}); err != nil {
+		return fmt.Errorf("applying fleet config: %w", err)
+	}
+	return nil
+}
+
+func checkVPPTeamAssignments(config *spec.GitOps, fleetClient *service.Client) (
+	vppTeams []string, missingTeam bool, err error,
+) {
+	if mdm, ok := config.OrgSettings["mdm"]; ok {
+		if mdmMap, ok := mdm.(map[string]any); ok {
+			teams, err := fleetClient.ListTeams("")
+			if err != nil {
+				return nil, false, err
+			}
+			teamNames := map[string]struct{}{}
+			for _, tm := range teams {
+				teamNames[tm.Name] = struct{}{}
+			}
+
+			if vpp, ok := mdmMap["volume_purchasing_program"]; ok {
+				if vppInterfaces, ok := vpp.([]any); ok {
+					for _, item := range vppInterfaces {
+						if itemMap, ok := item.(map[string]any); ok {
+							if teams, ok := itemMap["teams"].([]any); ok {
+								for _, team := range teams {
+									if teamStr, ok := team.(string); ok {
+										// normalize for Unicode support
+										normalizedTeam := norm.NFC.String(teamStr)
+										vppTeams = append(vppTeams, normalizedTeam)
+										if _, ok := teamNames[normalizedTeam]; !ok {
+											missingTeam = true
+										}
+									}
+								}
+							}
+						}
 					}
 				}
 			}
 		}
 	}
-	return appleBMDefaultTeam, appleBMDefaultTeamFound, nil
+
+	return vppTeams, missingTeam, nil
 }
 
-func applyAppleBMDefaultTeamIfNeeded(
-	ctx *cli.Context, teamNames []string, appleBMDefaultTeam string, flDryRun bool, fleetClient *service.Client,
+func applyVPPTokenAssignmentIfNeeded(
+	ctx *cli.Context,
+	teamNames []string,
+	vppTeamNames []string,
+	originalVPPConfig []any,
+	flDryRun bool,
+	fleetClient *service.Client,
 ) error {
-	if !slices.Contains(teamNames, appleBMDefaultTeam) {
-		return fmt.Errorf("apple_bm_default_team %s not found in team configs", appleBMDefaultTeam)
+	var appConfigUpdate map[string]map[string]any
+	for _, vppTeam := range vppTeamNames {
+		if !fleet.IsReservedTeamName(vppTeam) && !slices.Contains(teamNames, vppTeam) {
+			return fmt.Errorf("volume_purchasing_program team %s not found in team configs", vppTeam)
+		}
 	}
-	appConfigUpdate := map[string]map[string]interface{}{
+
+	appConfigUpdate = map[string]map[string]any{
 		"mdm": {
-			"apple_bm_default_team": appleBMDefaultTeam,
+			"volume_purchasing_program": originalVPPConfig,
 		},
 	}
+
 	if flDryRun {
-		_, _ = fmt.Fprintf(ctx.App.Writer, "[!] would apply apple_bm_default_team %s\n", appleBMDefaultTeam)
-	} else {
-		_, _ = fmt.Fprintf(ctx.App.Writer, "[+] applying apple_bm_default_team %s\n", appleBMDefaultTeam)
-		if err := fleetClient.ApplyAppConfig(appConfigUpdate, fleet.ApplySpecOptions{}); err != nil {
-			return fmt.Errorf("applying fleet config: %w", err)
-		}
+		_, _ = fmt.Fprint(ctx.App.Writer, "[!] would apply volume_purchasing_program teams\n")
+		return nil
+	}
+	_, _ = fmt.Fprintf(ctx.App.Writer, "[+] applying volume_purchasing_program teams\n")
+	if err := fleetClient.ApplyAppConfig(appConfigUpdate, fleet.ApplySpecOptions{}); err != nil {
+		return fmt.Errorf("applying fleet config for volume_purchasing_program teams: %w", err)
 	}
 	return nil
 }
diff --git a/cmd/fleetctl/gitops_enterprise_integration_test.go b/cmd/fleetctl/gitops_enterprise_integration_test.go
index ab3f8bf83561..235d89dca82a 100644
--- a/cmd/fleetctl/gitops_enterprise_integration_test.go
+++ b/cmd/fleetctl/gitops_enterprise_integration_test.go
@@ -23,7 +23,7 @@ import (
 	"github.com/stretchr/testify/suite"
 )
 
-func TestEnterpriseIntegrationsGitops(t *testing.T) {
+func TestIntegrationsEnterpriseGitops(t *testing.T) {
 	testingSuite := new(enterpriseIntegrationGitopsTestSuite)
 	testingSuite.suite = &testingSuite.Suite
 	suite.Run(t, testingSuite)
@@ -176,6 +176,7 @@ contexts:
 		fmt.Sprintf(
 			`
 controls:
+software:
 queries:
 policies:
 agent_options:
@@ -186,6 +187,9 @@ team_settings:
 		),
 	)
 	require.NoError(t, err)
+
+	test.CreateInsertGlobalVPPToken(t, s.ds)
+
 	// Apply the team to be deleted
 	_ = runAppForTest(t, []string{"gitops", "--config", fleetctlConfig.Name(), "-f", deletedTeamFile.Name()})
 
@@ -230,5 +234,4 @@ team_settings:
 	for _, fileName := range teamFileNames {
 		_ = runAppForTest(t, []string{"gitops", "--config", fleetctlConfig.Name(), "-f", fileName})
 	}
-
 }
diff --git a/cmd/fleetctl/gitops_test.go b/cmd/fleetctl/gitops_test.go
index d59af1bd5a7e..58fb94b1c62a 100644
--- a/cmd/fleetctl/gitops_test.go
+++ b/cmd/fleetctl/gitops_test.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
@@ -16,11 +17,13 @@ import (
 	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
+	"github.com/fleetdm/fleet/v4/server/mdm/apple/vpp"
 	"github.com/fleetdm/fleet/v4/server/mdm/nanodep/tokenpki"
 	"github.com/fleetdm/fleet/v4/server/mock"
 	mdmmock "github.com/fleetdm/fleet/v4/server/mock/mdm"
 	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/fleetdm/fleet/v4/server/service"
+	"github.com/fleetdm/fleet/v4/server/test"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -32,13 +35,13 @@ const (
 	orgName        = "GitOps Test"
 )
 
-func TestFilenameValidation(t *testing.T) {
+func TestGitOpsFilenameValidation(t *testing.T) {
 	filename := strings.Repeat("a", filenameMaxLength+1)
 	_, err := runAppNoChecks([]string{"gitops", "-f", filename})
 	assert.ErrorContains(t, err, "file name must be less than")
 }
 
-func TestBasicGlobalGitOps(t *testing.T) {
+func TestGitOpsBasicGlobalFree(t *testing.T) {
 	// Cannot run t.Parallel() because it sets environment variables
 
 	_, ds := runServerWithMockedDS(t)
@@ -46,13 +49,13 @@ func TestBasicGlobalGitOps(t *testing.T) {
 	ds.BatchSetMDMProfilesFunc = func(
 		ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile,
 		macDecls []*fleet.MDMAppleDeclaration,
-	) error {
-		return nil
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.BulkSetPendingMDMHostProfilesFunc = func(
 		ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string,
-	) error {
-		return nil
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.BatchSetScriptsFunc = func(ctx context.Context, tmID *uint, scripts []*fleet.Script) error { return nil }
 	ds.NewActivityFunc = func(
@@ -150,7 +153,111 @@ org_settings:
 	assert.Empty(t, enrolledSecrets)
 }
 
-func TestBasicTeamGitOps(t *testing.T) {
+func TestGitOpsBasicGlobalPremium(t *testing.T) {
+	// Cannot run t.Parallel() because it sets environment variables
+
+	license := &fleet.LicenseInfo{Tier: fleet.TierPremium, Expiration: time.Now().Add(24 * time.Hour)}
+	_, ds := runServerWithMockedDS(
+		t, &service.TestServerOpts{
+			License: license,
+		},
+	)
+
+	ds.BatchSetMDMProfilesFunc = func(
+		ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile,
+		macDecls []*fleet.MDMAppleDeclaration,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
+	}
+	ds.BulkSetPendingMDMHostProfilesFunc = func(
+		ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
+	}
+	ds.BatchSetScriptsFunc = func(ctx context.Context, tmID *uint, scripts []*fleet.Script) error { return nil }
+	ds.NewActivityFunc = func(
+		ctx context.Context, user *fleet.User, activity fleet.ActivityDetails, details []byte, createdAt time.Time,
+	) error {
+		return nil
+	}
+	ds.ListGlobalPoliciesFunc = func(ctx context.Context, opts fleet.ListOptions) ([]*fleet.Policy, error) { return nil, nil }
+	ds.ListQueriesFunc = func(ctx context.Context, opts fleet.ListQueryOptions) ([]*fleet.Query, error) { return nil, nil }
+
+	// Mock appConfig
+	savedAppConfig := &fleet.AppConfig{}
+	ds.AppConfigFunc = func(ctx context.Context) (*fleet.AppConfig, error) {
+		return &fleet.AppConfig{}, nil
+	}
+	ds.SaveAppConfigFunc = func(ctx context.Context, config *fleet.AppConfig) error {
+		savedAppConfig = config
+		return nil
+	}
+	var enrolledSecrets []*fleet.EnrollSecret
+	ds.ApplyEnrollSecretsFunc = func(ctx context.Context, teamID *uint, secrets []*fleet.EnrollSecret) error {
+		enrolledSecrets = secrets
+		return nil
+	}
+	ds.LabelIDsByNameFunc = func(ctx context.Context, labels []string) (map[string]uint, error) {
+		return map[string]uint{labels[0]: 1}, nil
+	}
+	ds.SetOrUpdateMDMAppleDeclarationFunc = func(ctx context.Context, declaration *fleet.MDMAppleDeclaration) (*fleet.MDMAppleDeclaration, error) {
+		return &fleet.MDMAppleDeclaration{}, nil
+	}
+	ds.NewJobFunc = func(ctx context.Context, job *fleet.Job) (*fleet.Job, error) {
+		return &fleet.Job{}, nil
+	}
+	ds.BatchSetSoftwareInstallersFunc = func(ctx context.Context, teamID *uint, installers []*fleet.UploadSoftwareInstallerPayload) ([]fleet.SoftwareInstaller, error) {
+		return nil, nil
+	}
+
+	tmpFile, err := os.CreateTemp(t.TempDir(), "*.yml")
+	require.NoError(t, err)
+
+	const (
+		fleetServerURL = "https://fleet.example.com"
+		orgName        = "GitOps Premium Test"
+	)
+	t.Setenv("FLEET_SERVER_URL", fleetServerURL)
+
+	_, err = tmpFile.WriteString(
+		`
+controls:
+  ios_updates:
+    deadline: "2022-02-02"
+    minimum_version: "17.6"
+  ipados_updates:
+    deadline: "2023-03-03"
+    minimum_version: "18.0"
+queries:
+policies:
+agent_options:
+org_settings:
+  server_settings:
+    server_url: $FLEET_SERVER_URL
+  org_info:
+    contact_url: https://example.com/contact
+    org_logo_url: ""
+    org_logo_url_light_background: ""
+    org_name: ${ORG_NAME}
+  secrets:
+software:
+`,
+	)
+	require.NoError(t, err)
+
+	// Dry run
+	t.Setenv("ORG_NAME", orgName)
+	_ = runAppForTest(t, []string{"gitops", "-f", tmpFile.Name(), "--dry-run"})
+	assert.Equal(t, fleet.AppConfig{}, *savedAppConfig, "AppConfig should be empty")
+
+	// Real run
+	_ = runAppForTest(t, []string{"gitops", "-f", tmpFile.Name()})
+	assert.Equal(t, orgName, savedAppConfig.OrgInfo.OrgName)
+	assert.Equal(t, fleetServerURL, savedAppConfig.ServerSettings.ServerURL)
+	assert.Empty(t, enrolledSecrets)
+}
+
+func TestGitOpsBasicTeam(t *testing.T) {
 	// Cannot run t.Parallel() because it sets environment variables
 	license := &fleet.LicenseInfo{Tier: fleet.TierPremium, Expiration: time.Now().Add(24 * time.Hour)}
 	_, ds := runServerWithMockedDS(
@@ -161,16 +268,22 @@ func TestBasicTeamGitOps(t *testing.T) {
 
 	const secret = "TestSecret"
 
+	ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppTeam) error {
+		return nil
+	}
+	ds.BatchInsertVPPAppsFunc = func(ctx context.Context, apps []*fleet.VPPApp) error {
+		return nil
+	}
 	ds.BatchSetScriptsFunc = func(ctx context.Context, tmID *uint, scripts []*fleet.Script) error { return nil }
 	ds.BatchSetMDMProfilesFunc = func(
 		ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration,
-	) error {
-		return nil
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.BulkSetPendingMDMHostProfilesFunc = func(
 		ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string,
-	) error {
-		return nil
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.NewActivityFunc = func(
 		ctx context.Context, user *fleet.User, activity fleet.ActivityDetails, details []byte, createdAt time.Time,
@@ -222,20 +335,37 @@ func TestBasicTeamGitOps(t *testing.T) {
 		return team, nil
 	}
 	ds.LabelIDsByNameFunc = func(ctx context.Context, labels []string) (map[string]uint, error) {
-		require.ElementsMatch(t, labels, []string{fleet.BuiltinLabelMacOS14Plus})
-		return map[string]uint{fleet.BuiltinLabelMacOS14Plus: 1}, nil
+		require.Len(t, labels, 1)
+		switch labels[0] {
+		case fleet.BuiltinLabelMacOS14Plus:
+			return map[string]uint{fleet.BuiltinLabelMacOS14Plus: 1}, nil
+		case fleet.BuiltinLabelIOS:
+			return map[string]uint{fleet.BuiltinLabelIOS: 2}, nil
+		case fleet.BuiltinLabelIPadOS:
+			return map[string]uint{fleet.BuiltinLabelIPadOS: 3}, nil
+		default:
+			return nil, &notFoundError{}
+		}
 	}
 	ds.DeleteMDMAppleDeclarationByNameFunc = func(ctx context.Context, teamID *uint, name string) error {
 		return nil
 	}
-	ds.BatchSetSoftwareInstallersFunc = func(ctx context.Context, teamID *uint, installers []*fleet.UploadSoftwareInstallerPayload) error {
-		return nil
+	ds.BatchSetSoftwareInstallersFunc = func(ctx context.Context, teamID *uint, installers []*fleet.UploadSoftwareInstallerPayload) ([]fleet.SoftwareInstaller, error) {
+		return nil, nil
 	}
-
 	ds.ApplyEnrollSecretsFunc = func(ctx context.Context, teamID *uint, secrets []*fleet.EnrollSecret) error {
 		enrolledTeamSecrets = secrets
 		return nil
 	}
+	ds.SetOrUpdateMDMAppleDeclarationFunc = func(ctx context.Context, declaration *fleet.MDMAppleDeclaration) (*fleet.MDMAppleDeclaration, error) {
+		return &fleet.MDMAppleDeclaration{}, nil
+	}
+	ds.NewJobFunc = func(ctx context.Context, job *fleet.Job) (*fleet.Job, error) {
+		return &fleet.Job{}, nil
+	}
+	ds.ListSoftwareTitlesFunc = func(ctx context.Context, opt fleet.SoftwareTitleListOptions, tmFilter fleet.TeamFilter) ([]fleet.SoftwareTitleListResult, int, *fleet.PaginationMetadata, error) {
+		return nil, 0, nil, nil
+	}
 
 	tmpFile, err := os.CreateTemp(t.TempDir(), "*.yml")
 	require.NoError(t, err)
@@ -245,12 +375,19 @@ func TestBasicTeamGitOps(t *testing.T) {
 	_, err = tmpFile.WriteString(
 		`
 controls:
+  ios_updates:
+    deadline: "2024-10-10"
+    minimum_version: "18.0"
+  ipados_updates:
+    deadline: "2025-11-11"
+    minimum_version: "17.6"
 queries:
 policies:
 agent_options:
 name: ${TEST_TEAM_NAME}
 team_settings:
   secrets: ${TEST_SECRET}
+software:
 `,
 	)
 	require.NoError(t, err)
@@ -261,6 +398,27 @@ team_settings:
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "'name' is required")
 
+	// reserved team name; should error in both dry run and real
+	t.Setenv("TEST_TEAM_NAME", "no TEam")
+	_, err = runAppNoChecks([]string{"gitops", "-f", tmpFile.Name(), "--dry-run"})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), `"No team" is a reserved team name`)
+
+	t.Setenv("TEST_TEAM_NAME", "no TEam")
+	_, err = runAppNoChecks([]string{"gitops", "-f", tmpFile.Name()})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), `"No team" is a reserved team name`)
+
+	t.Setenv("TEST_TEAM_NAME", "All teams")
+	_, err = runAppNoChecks([]string{"gitops", "-f", tmpFile.Name(), "--dry-run"})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), `"All teams" is a reserved team name`)
+
+	t.Setenv("TEST_TEAM_NAME", "All TEAMS")
+	_, err = runAppNoChecks([]string{"gitops", "-f", tmpFile.Name()})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), `"All teams" is a reserved team name`)
+
 	// Dry run
 	t.Setenv("TEST_TEAM_NAME", teamName)
 	_ = runAppForTest(t, []string{"gitops", "-f", tmpFile.Name(), "--dry-run"})
@@ -283,7 +441,7 @@ team_settings:
 	assert.Equal(t, secret, enrolledTeamSecrets[0].Secret)
 }
 
-func TestFullGlobalGitOps(t *testing.T) {
+func TestGitOpsFullGlobal(t *testing.T) {
 	// Cannot run t.Parallel() because it sets environment variables
 	// mdm test configuration must be set so that activating windows MDM works.
 	testCert, testKey, err := apple_mdm.NewSCEPCACertKey()
@@ -316,13 +474,14 @@ func TestFullGlobalGitOps(t *testing.T) {
 	var appliedWinProfiles []*fleet.MDMWindowsConfigProfile
 	ds.BatchSetMDMProfilesFunc = func(
 		ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration,
-	) error {
+	) (updates fleet.MDMProfilesUpdates, err error) {
 		appliedMacProfiles = macProfiles
 		appliedWinProfiles = winProfiles
-		return nil
+		return fleet.MDMProfilesUpdates{}, nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.NewJobFunc = func(ctx context.Context, job *fleet.Job) (*fleet.Job, error) {
 		return job, nil
@@ -407,16 +566,10 @@ func TestFullGlobalGitOps(t *testing.T) {
 	)
 	t.Setenv("FLEET_SERVER_URL", fleetServerURL)
 	t.Setenv("ORG_NAME", orgName)
-	t.Setenv("APPLE_BM_DEFAULT_TEAM", teamName)
+	t.Setenv("SOFTWARE_INSTALLER_URL", fleetServerURL)
 	file := "./testdata/gitops/global_config_no_paths.yml"
 
-	// Dry run should fail because Apple BM Default Team does not exist and premium license is not set
-	_, err = runAppNoChecks([]string{"gitops", "-f", file, "--dry-run"})
-	require.Error(t, err)
-	assert.True(t, strings.Contains(err.Error(), "missing or invalid license"))
-
 	// Dry run
-	t.Setenv("APPLE_BM_DEFAULT_TEAM", "")
 	_ = runAppForTest(t, []string{"gitops", "-f", file, "--dry-run"})
 	assert.Equal(t, fleet.AppConfig{}, *savedAppConfig, "AppConfig should be empty")
 	assert.Len(t, enrolledSecrets, 0)
@@ -449,7 +602,7 @@ func TestFullGlobalGitOps(t *testing.T) {
 	assert.Equal(t, "https://activities_webhook_url", savedAppConfig.WebhookSettings.ActivitiesWebhook.DestinationURL)
 }
 
-func TestFullTeamGitOps(t *testing.T) {
+func TestGitOpsFullTeam(t *testing.T) {
 	// Cannot run t.Parallel() because it sets environment variables
 	license := &fleet.LicenseInfo{Tier: fleet.TierPremium, Expiration: time.Now().Add(24 * time.Hour)}
 
@@ -497,13 +650,14 @@ func TestFullTeamGitOps(t *testing.T) {
 	var appliedWinProfiles []*fleet.MDMWindowsConfigProfile
 	ds.BatchSetMDMProfilesFunc = func(
 		ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration,
-	) error {
+	) (updates fleet.MDMProfilesUpdates, err error) {
 		appliedMacProfiles = macProfiles
 		appliedWinProfiles = winProfiles
-		return nil
+		return fleet.MDMProfilesUpdates{}, nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.NewJobFunc = func(ctx context.Context, job *fleet.Job) (*fleet.Job, error) {
 		return job, nil
@@ -529,6 +683,9 @@ func TestFullTeamGitOps(t *testing.T) {
 	// Team
 	var savedTeam *fleet.Team
 	ds.TeamByNameFunc = func(ctx context.Context, name string) (*fleet.Team, error) {
+		if name == "Conflict" {
+			return &fleet.Team{}, nil
+		}
 		if savedTeam != nil && savedTeam.Name == name {
 			return savedTeam, nil
 		}
@@ -624,14 +781,22 @@ func TestFullTeamGitOps(t *testing.T) {
 		appliedQueries = queries
 		return nil
 	}
-	ds.BatchSetSoftwareInstallersFunc = func(ctx context.Context, teamID *uint, installers []*fleet.UploadSoftwareInstallerPayload) error {
+	ds.BatchSetSoftwareInstallersFunc = func(ctx context.Context, teamID *uint, installers []*fleet.UploadSoftwareInstallerPayload) ([]fleet.SoftwareInstaller, error) {
+		return nil, nil
+	}
+	ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppTeam) error {
+		return nil
+	}
+	ds.BatchInsertVPPAppsFunc = func(ctx context.Context, apps []*fleet.VPPApp) error {
 		return nil
 	}
-
 	ds.ApplyEnrollSecretsFunc = func(ctx context.Context, teamID *uint, secrets []*fleet.EnrollSecret) error {
 		enrolledSecrets = secrets
 		return nil
 	}
+	ds.ListSoftwareTitlesFunc = func(ctx context.Context, opt fleet.SoftwareTitleListOptions, tmFilter fleet.TeamFilter) ([]fleet.SoftwareTitleListResult, int, *fleet.PaginationMetadata, error) {
+		return nil, 0, nil, nil
+	}
 
 	startSoftwareInstallerServer(t)
 
@@ -684,7 +849,15 @@ func TestFullTeamGitOps(t *testing.T) {
 	assert.Equal(t, newTeamName, savedTeam.Name)
 	assert.Equal(t, baseFilename, *savedTeam.Filename)
 
+	// Try to change team name again, but this time the new name conflicts with an existing team
+	t.Setenv("TEST_TEAM_NAME", "Conflict")
+	_, err = runAppNoChecks([]string{"gitops", "-f", file, "--dry-run"})
+	assert.ErrorContains(t, err, "team name already exists")
+	_, err = runAppNoChecks([]string{"gitops", "-f", file})
+	assert.ErrorContains(t, err, "team name already exists")
+
 	// Now clear the settings
+	t.Setenv("TEST_TEAM_NAME", newTeamName)
 	tmpFile, err := os.CreateTemp(t.TempDir(), "*.yml")
 	require.NoError(t, err)
 	secret := "TestSecret"
@@ -699,6 +872,7 @@ agent_options:
 name: ${TEST_TEAM_NAME}
 team_settings:
   secrets: [{"secret":"${TEST_SECRET}"}]
+software:
 `,
 	)
 	require.NoError(t, err)
@@ -726,10 +900,9 @@ team_settings:
 	assert.Empty(t, savedTeam.Config.MDM.MacOSSetup.BootstrapPackage.Value)
 	assert.False(t, savedTeam.Config.MDM.EnableDiskEncryption)
 	assert.Equal(t, filepath.Base(tmpFile.Name()), *savedTeam.Filename)
-
 }
 
-func TestBasicGlobalAndTeamGitOps(t *testing.T) {
+func TestGitOpsBasicGlobalAndTeam(t *testing.T) {
 	// Cannot run t.Parallel() because it sets environment variables
 	license := &fleet.LicenseInfo{Tier: fleet.TierPremium, Expiration: time.Now().Add(24 * time.Hour)}
 	_, ds := runServerWithMockedDS(
@@ -748,6 +921,13 @@ func TestBasicGlobalAndTeamGitOps(t *testing.T) {
 		return nil
 	}
 
+	ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppTeam) error {
+		return nil
+	}
+	ds.BatchInsertVPPAppsFunc = func(ctx context.Context, apps []*fleet.VPPApp) error {
+		return nil
+	}
+
 	const (
 		fleetServerURL = "https://fleet.example.com"
 		orgName        = "GitOps Test"
@@ -776,10 +956,10 @@ func TestBasicGlobalAndTeamGitOps(t *testing.T) {
 	ds.BatchSetMDMProfilesFunc = func(
 		ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile,
 		macDecls []*fleet.MDMAppleDeclaration,
-	) error {
+	) (updates fleet.MDMProfilesUpdates, err error) {
 		assert.Empty(t, macProfiles)
 		assert.Empty(t, winProfiles)
-		return nil
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.BatchSetScriptsFunc = func(ctx context.Context, tmID *uint, scripts []*fleet.Script) error {
 		assert.Empty(t, scripts)
@@ -787,9 +967,9 @@ func TestBasicGlobalAndTeamGitOps(t *testing.T) {
 	}
 	ds.BulkSetPendingMDMHostProfilesFunc = func(
 		ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string,
-	) error {
+	) (updates fleet.MDMProfilesUpdates, err error) {
 		assert.Empty(t, profileUUIDs)
-		return nil
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.DeleteMDMAppleDeclarationByNameFunc = func(ctx context.Context, teamID *uint, name string) error {
 		return nil
@@ -845,8 +1025,11 @@ func TestBasicGlobalAndTeamGitOps(t *testing.T) {
 		savedTeam = team
 		return team, nil
 	}
-	ds.BatchSetSoftwareInstallersFunc = func(ctx context.Context, teamID *uint, installers []*fleet.UploadSoftwareInstallerPayload) error {
-		return nil
+	ds.BatchSetSoftwareInstallersFunc = func(ctx context.Context, teamID *uint, installers []*fleet.UploadSoftwareInstallerPayload) ([]fleet.SoftwareInstaller, error) {
+		return nil, nil
+	}
+	ds.ListSoftwareTitlesFunc = func(ctx context.Context, opt fleet.SoftwareTitleListOptions, tmFilter fleet.TeamFilter) ([]fleet.SoftwareTitleListResult, int, *fleet.PaginationMetadata, error) {
+		return nil, 0, nil, nil
 	}
 
 	globalFile, err := os.CreateTemp(t.TempDir(), "*.yml")
@@ -870,6 +1053,7 @@ org_settings:
     org_logo_url_light_background: ""
     org_name: ${ORG_NAME}
   secrets: [{"secret":"globalSecret"}]
+software:
 `,
 	)
 	require.NoError(t, err)
@@ -889,6 +1073,7 @@ agent_options:
 name: ${TEST_TEAM_NAME}
 team_settings:
   secrets: [{"secret":"${TEST_SECRET}"}]
+software:
 `,
 	)
 	require.NoError(t, err)
@@ -904,6 +1089,7 @@ agent_options:
 name: ${TEST_TEAM_NAME}
 team_settings:
   secrets: [{"secret":"${TEST_SECRET}"},{"secret":"globalSecret"}]
+software:
 `,
 	)
 	require.NoError(t, err)
@@ -978,10 +1164,10 @@ team_settings:
 	assert.True(t, ds.DeleteTeamFuncInvoked)
 }
 
-func TestFullGlobalAndTeamGitOps(t *testing.T) {
+func TestGitOpsFullGlobalAndTeam(t *testing.T) {
 	// Cannot run t.Parallel() because it sets environment variables
 	// mdm test configuration must be set so that activating windows MDM works.
-	ds, savedAppConfigPtr, savedTeamPtr := setupFullGitOpsPremiumServer(t)
+	ds, savedAppConfigPtr, savedTeams := setupFullGitOpsPremiumServer(t)
 	startSoftwareInstallerServer(t)
 
 	var enrolledSecrets []*fleet.EnrollSecret
@@ -1009,9 +1195,9 @@ func TestFullGlobalAndTeamGitOps(t *testing.T) {
 	}
 	ds.NewTeamFunc = func(ctx context.Context, team *fleet.Team) (*fleet.Team, error) {
 		team.ID = 1
-		*savedTeamPtr = team
 		enrolledTeamSecrets = team.Secrets
-		return *savedTeamPtr, nil
+		savedTeams[team.Name] = &team
+		return team, nil
 	}
 
 	apnsCert, apnsKey, err := mysql.GenerateTestCertBytes()
@@ -1030,14 +1216,16 @@ func TestFullGlobalAndTeamGitOps(t *testing.T) {
 		}, nil
 	}
 
+	ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppTeam) error {
+		return nil
+	}
+	ds.BatchInsertVPPAppsFunc = func(ctx context.Context, apps []*fleet.VPPApp) error {
+		return nil
+	}
+
 	globalFile := "./testdata/gitops/global_config_no_paths.yml"
 	teamFile := "./testdata/gitops/team_config_no_paths.yml"
 
-	// Dry run on global file should fail because Apple BM Default Team does not exist (and has not been provided)
-	_, err = runAppNoChecks([]string{"gitops", "-f", globalFile, "--dry-run"})
-	require.Error(t, err)
-	assert.True(t, strings.Contains(err.Error(), "team name not found"))
-
 	// Dry run
 	_ = runAppForTest(t, []string{"gitops", "-f", globalFile, "-f", teamFile, "--dry-run", "--delete-other-teams"})
 	assert.False(t, ds.SaveAppConfigFuncInvoked)
@@ -1051,12 +1239,12 @@ func TestFullGlobalAndTeamGitOps(t *testing.T) {
 	assert.Equal(t, orgName, (*savedAppConfigPtr).OrgInfo.OrgName)
 	assert.Equal(t, fleetServerURL, (*savedAppConfigPtr).ServerSettings.ServerURL)
 	assert.Len(t, enrolledSecrets, 2)
-	require.NotNil(t, *savedTeamPtr)
-	assert.Equal(t, teamName, (*savedTeamPtr).Name)
+	require.NotNil(t, *savedTeams[teamName])
+	assert.Equal(t, teamName, (*savedTeams[teamName]).Name)
 	require.Len(t, enrolledTeamSecrets, 2)
 }
 
-func TestTeamSofwareInstallersGitOps(t *testing.T) {
+func TestGitOpsTeamSofwareInstallers(t *testing.T) {
 	startSoftwareInstallerServer(t)
 
 	cases := []struct {
@@ -1067,12 +1255,14 @@ func TestTeamSofwareInstallersGitOps(t *testing.T) {
 		{"testdata/gitops/team_software_installer_unsupported.yml", "The file should be .pkg, .msi, .exe or .deb."},
 		{"testdata/gitops/team_software_installer_too_large.yml", "The maximum file size is 500 MB"},
 		{"testdata/gitops/team_software_installer_valid.yml", ""},
+		{"testdata/gitops/team_software_installer_valid_apply.yml", ""},
 		{"testdata/gitops/team_software_installer_pre_condition_multiple_queries.yml", "should have only one query."},
+		{"testdata/gitops/team_software_installer_pre_condition_multiple_queries_apply.yml", "should have only one query."},
 		{"testdata/gitops/team_software_installer_pre_condition_not_found.yml", "no such file or directory"},
 		{"testdata/gitops/team_software_installer_install_not_found.yml", "no such file or directory"},
 		{"testdata/gitops/team_software_installer_post_install_not_found.yml", "no such file or directory"},
 		{"testdata/gitops/team_software_installer_no_url.yml", "software URL is required"},
-		{"testdata/gitops/team_software_installer_invalid_self_service_value.yml", "cannot unmarshal string into Go struct field TeamSpecSoftware.self_service of type bool"},
+		{"testdata/gitops/team_software_installer_invalid_self_service_value.yml", "\"packages.self_service\" must be a bool, found string"},
 	}
 	for _, c := range cases {
 		t.Run(filepath.Base(c.file), func(t *testing.T) {
@@ -1088,7 +1278,150 @@ func TestTeamSofwareInstallersGitOps(t *testing.T) {
 	}
 }
 
-func TestCustomSettingsGitOps(t *testing.T) {
+func TestGitOpsTeamSoftwareInstallersQueryEnv(t *testing.T) {
+	startSoftwareInstallerServer(t)
+	ds, _, _ := setupFullGitOpsPremiumServer(t)
+
+	t.Setenv("QUERY_VAR", "IT_WORKS")
+
+	ds.BatchSetSoftwareInstallersFunc = func(ctx context.Context, tmID *uint, installers []*fleet.UploadSoftwareInstallerPayload) ([]fleet.SoftwareInstaller, error) {
+		if installers[0].PreInstallQuery != "select IT_WORKS" {
+			return nil, fmt.Errorf("Missing env var, got %s", installers[0].PreInstallQuery)
+		}
+		return nil, nil
+	}
+
+	_, err := runAppNoChecks([]string{"gitops", "-f", "testdata/gitops/team_software_installer_valid_env_query.yml"})
+	require.NoError(t, err)
+}
+
+func TestGitOpsNoTeamSoftwareInstallers(t *testing.T) {
+	startSoftwareInstallerServer(t)
+
+	cases := []struct {
+		file    string
+		wantErr string
+	}{
+		{"testdata/gitops/no_team_software_installer_not_found.yml", "Please make sure that URLs are publicy accessible to the internet."},
+		{"testdata/gitops/no_team_software_installer_unsupported.yml", "The file should be .pkg, .msi, .exe or .deb."},
+		{"testdata/gitops/no_team_software_installer_too_large.yml", "The maximum file size is 500 MB"},
+		{"testdata/gitops/no_team_software_installer_valid.yml", ""},
+		{"testdata/gitops/no_team_software_installer_pre_condition_multiple_queries.yml", "should have only one query."},
+		{"testdata/gitops/no_team_software_installer_pre_condition_not_found.yml", "no such file or directory"},
+		{"testdata/gitops/no_team_software_installer_install_not_found.yml", "no such file or directory"},
+		{"testdata/gitops/no_team_software_installer_post_install_not_found.yml", "no such file or directory"},
+		{"testdata/gitops/no_team_software_installer_no_url.yml", "software URL is required"},
+		{"testdata/gitops/no_team_software_installer_invalid_self_service_value.yml", "\"packages.self_service\" must be a bool, found string"},
+	}
+	for _, c := range cases {
+		t.Run(filepath.Base(c.file), func(t *testing.T) {
+			setupFullGitOpsPremiumServer(t)
+
+			t.Setenv("APPLE_BM_DEFAULT_TEAM", "")
+			_, err := runAppNoChecks([]string{"gitops", "-f", c.file})
+			if c.wantErr == "" {
+				require.NoError(t, err)
+			} else {
+				require.ErrorContains(t, err, c.wantErr)
+			}
+		})
+	}
+}
+
+func TestGitOpsTeamVPPApps(t *testing.T) {
+	config := &appleVPPConfigSrvConf{
+		Assets: []vpp.Asset{
+			{
+				AdamID:         "1",
+				PricingParam:   "STDQ",
+				AvailableCount: 12,
+			},
+			{
+				AdamID:         "2",
+				PricingParam:   "STDQ",
+				AvailableCount: 3,
+			},
+		},
+		SerialNumbers: []string{"123", "456"},
+	}
+
+	startVPPApplyServer(t, config)
+
+	appleITunesSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// a map of apps we can respond with
+		db := map[string]string{
+			// macos app
+			"1": `{"bundleId": "a-1", "artworkUrl512": "https://example.com/images/1", "version": "1.0.0", "trackName": "App 1", "TrackID": 1}`,
+			// macos, ios, ipados app
+			"2": `{"bundleId": "b-2", "artworkUrl512": "https://example.com/images/2", "version": "2.0.0", "trackName": "App 2", "TrackID": 2,
+				"supportedDevices": ["MacDesktop-MacDesktop", "iPhone5s-iPhone5s", "iPadAir-iPadAir"] }`,
+			// ipados app
+			"3": `{"bundleId": "c-3", "artworkUrl512": "https://example.com/images/3", "version": "3.0.0", "trackName": "App 3", "TrackID": 3,
+				"supportedDevices": ["iPadAir-iPadAir"] }`,
+		}
+
+		adamIDString := r.URL.Query().Get("id")
+		adamIDs := strings.Split(adamIDString, ",")
+
+		var objs []string
+		for _, a := range adamIDs {
+			objs = append(objs, db[a])
+		}
+
+		_, _ = w.Write([]byte(fmt.Sprintf(`{"results": [%s]}`, strings.Join(objs, ","))))
+	}))
+	t.Setenv("FLEET_DEV_ITUNES_URL", appleITunesSrv.URL)
+
+	cases := []struct {
+		file            string
+		wantErr         string
+		tokenExpiration time.Time
+	}{
+		{"testdata/gitops/team_vpp_valid_app.yml", "", time.Now().Add(24 * time.Hour)},
+		{"testdata/gitops/team_vpp_valid_app_self_service.yml", "", time.Now().Add(24 * time.Hour)},
+		{"testdata/gitops/team_vpp_valid_empty.yml", "", time.Now().Add(24 * time.Hour)},
+		{"testdata/gitops/team_vpp_valid_empty.yml", "", time.Now().Add(-24 * time.Hour)},
+		{"testdata/gitops/team_vpp_valid_app.yml", "VPP token expired", time.Now().Add(-24 * time.Hour)},
+		{"testdata/gitops/team_vpp_invalid_app.yml", "app not available on vpp account", time.Now().Add(24 * time.Hour)},
+		{"testdata/gitops/team_vpp_incorrect_type.yml", "\"app_store_apps.app_store_id\" must be a string, found number", time.Now().Add(24 * time.Hour)},
+		{"testdata/gitops/team_vpp_empty_adamid.yml", "software app store id required", time.Now().Add(24 * time.Hour)},
+	}
+
+	for _, c := range cases {
+		t.Run(filepath.Base(c.file), func(t *testing.T) {
+			ds, _, _ := setupFullGitOpsPremiumServer(t)
+			token, err := test.CreateVPPTokenEncoded(c.tokenExpiration, "fleet", "ca")
+			require.NoError(t, err)
+
+			ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppTeam) error {
+				return nil
+			}
+			ds.BatchInsertVPPAppsFunc = func(ctx context.Context, apps []*fleet.VPPApp) error {
+				return nil
+			}
+
+			ds.GetVPPTokenByTeamIDFunc = func(ctx context.Context, teamID *uint) (*fleet.VPPTokenDB, error) {
+				return &fleet.VPPTokenDB{
+					ID:        1,
+					OrgName:   "Fleet",
+					Location:  "Earth",
+					RenewDate: c.tokenExpiration,
+					Token:     string(token),
+					Teams:     nil,
+				}, nil
+			}
+
+			_, err = runAppNoChecks([]string{"gitops", "-f", c.file})
+			if c.wantErr == "" {
+				require.NoError(t, err)
+			} else {
+				require.ErrorContains(t, err, c.wantErr)
+			}
+		})
+	}
+}
+
+func TestGitOpsCustomSettings(t *testing.T) {
 	cases := []struct {
 		file    string
 		wantErr string
@@ -1124,6 +1457,12 @@ func TestCustomSettingsGitOps(t *testing.T) {
 				}
 				return ret, nil
 			}
+			ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppTeam) error {
+				return nil
+			}
+			ds.BatchInsertVPPAppsFunc = func(ctx context.Context, apps []*fleet.VPPApp) error {
+				return nil
+			}
 
 			_, err := runAppNoChecks([]string{"gitops", "-f", c.file})
 			if c.wantErr == "" {
@@ -1169,7 +1508,141 @@ func startSoftwareInstallerServer(t *testing.T) {
 	t.Setenv("SOFTWARE_INSTALLER_URL", srv.URL)
 }
 
-func setupFullGitOpsPremiumServer(t *testing.T) (*mock.Store, **fleet.AppConfig, **fleet.Team) {
+type appleVPPConfigSrvConf struct {
+	Assets        []vpp.Asset
+	SerialNumbers []string
+}
+
+func startVPPApplyServer(t *testing.T, config *appleVPPConfigSrvConf) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.Contains(r.URL.Path, "associate") {
+			var associations vpp.AssociateAssetsRequest
+
+			decoder := json.NewDecoder(r.Body)
+			if err := decoder.Decode(&associations); err != nil {
+				http.Error(w, "invalid request", http.StatusBadRequest)
+				return
+			}
+
+			if len(associations.Assets) == 0 {
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(http.StatusBadRequest)
+				res := vpp.ErrorResponse{
+					ErrorNumber:  9718,
+					ErrorMessage: "This request doesn't contain an asset, which is a required argument. Change the request to provide an asset.",
+				}
+				if err := json.NewEncoder(w).Encode(res); err != nil {
+					panic(err)
+				}
+				return
+			}
+
+			if len(associations.SerialNumbers) == 0 {
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(http.StatusBadRequest)
+				res := vpp.ErrorResponse{
+					ErrorNumber:  9719,
+					ErrorMessage: "Either clientUserIds or serialNumbers are required arguments. Change the request to provide assignable users and devices.",
+				}
+				if err := json.NewEncoder(w).Encode(res); err != nil {
+					panic(err)
+				}
+				return
+			}
+
+			var badAssets []vpp.Asset
+			for _, reqAsset := range associations.Assets {
+				var found bool
+				for _, goodAsset := range config.Assets {
+					if reqAsset == goodAsset {
+						found = true
+					}
+				}
+				if !found {
+					badAssets = append(badAssets, reqAsset)
+				}
+			}
+
+			var badSerials []string
+			for _, reqSerial := range associations.SerialNumbers {
+				var found bool
+				for _, goodSerial := range config.SerialNumbers {
+					if reqSerial == goodSerial {
+						found = true
+					}
+				}
+				if !found {
+					badSerials = append(badSerials, reqSerial)
+				}
+			}
+
+			if len(badAssets) != 0 || len(badSerials) != 0 {
+				errMsg := "error associating assets."
+				if len(badAssets) > 0 {
+					var badAdamIds []string
+					for _, asset := range badAssets {
+						badAdamIds = append(badAdamIds, asset.AdamID)
+					}
+					errMsg += fmt.Sprintf(" assets don't exist on account: %s.", strings.Join(badAdamIds, ", "))
+				}
+				if len(badSerials) > 0 {
+					errMsg += fmt.Sprintf(" bad serials: %s.", strings.Join(badSerials, ", "))
+				}
+				res := vpp.ErrorResponse{
+					ErrorInfo: vpp.ResponseErrorInfo{
+						Assets:        badAssets,
+						ClientUserIds: []string{"something"},
+						SerialNumbers: badSerials,
+					},
+					// Not sure what error should be returned on each
+					// error type
+					ErrorNumber:  1,
+					ErrorMessage: errMsg,
+				}
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(http.StatusBadRequest)
+				if err := json.NewEncoder(w).Encode(res); err != nil {
+					panic(err)
+				}
+			}
+			return
+		}
+
+		if strings.Contains(r.URL.Path, "assets") {
+			// Then we're responding to GetAssets
+			w.Header().Set("Content-Type", "application/json")
+			encoder := json.NewEncoder(w)
+			err := encoder.Encode(map[string][]vpp.Asset{"assets": config.Assets})
+			if err != nil {
+				panic(err)
+			}
+			return
+		}
+
+		resp := []byte(`{"locationName": "Fleet Location One"}`)
+		if strings.Contains(r.URL.RawQuery, "invalidToken") {
+			// This replicates the response sent back from Apple's VPP endpoints when an invalid
+			// token is passed. For more details see:
+			// https://developer.apple.com/documentation/devicemanagement/app_and_book_management/app_and_book_management_legacy/interpreting_error_codes
+			// https://developer.apple.com/documentation/devicemanagement/client_config
+			// https://developer.apple.com/documentation/devicemanagement/errorresponse
+			// Note that the Apple server returns 200 in this case.
+			resp = []byte(`{"errorNumber": 9622,"errorMessage": "Invalid authentication token"}`)
+		}
+
+		if strings.Contains(r.URL.RawQuery, "serverError") {
+			resp = []byte(`{"errorNumber": 9603,"errorMessage": "Internal server error"}`)
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+
+		_, _ = w.Write(resp)
+	}))
+
+	t.Setenv("FLEET_DEV_VPP_URL", srv.URL)
+	t.Cleanup(srv.Close)
+}
+
+func setupFullGitOpsPremiumServer(t *testing.T) (*mock.Store, **fleet.AppConfig, map[string]**fleet.Team) {
 	testCert, testKey, err := apple_mdm.NewSCEPCACertKey()
 	require.NoError(t, err)
 	testCertPEM := tokenpki.PEMCertificate(testCert.Raw)
@@ -1203,8 +1676,14 @@ func setupFullGitOpsPremiumServer(t *testing.T) (*mock.Store, **fleet.AppConfig,
 		savedAppConfig = &appConfigCopy
 		return nil
 	}
+	ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppTeam) error {
+		return nil
+	}
+	ds.BatchInsertVPPAppsFunc = func(ctx context.Context, apps []*fleet.VPPApp) error {
+		return nil
+	}
 
-	var savedTeam *fleet.Team
+	savedTeams := map[string]**fleet.Team{}
 
 	ds.ApplyEnrollSecretsFunc = func(ctx context.Context, teamID *uint, secrets []*fleet.EnrollSecret) error {
 		return nil
@@ -1220,14 +1699,14 @@ func setupFullGitOpsPremiumServer(t *testing.T) (*mock.Store, **fleet.AppConfig,
 	ds.BatchSetMDMProfilesFunc = func(
 		ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile,
 		macDecls []*fleet.MDMAppleDeclaration,
-	) error {
-		return nil
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.BatchSetScriptsFunc = func(ctx context.Context, tmID *uint, scripts []*fleet.Script) error { return nil }
 	ds.BulkSetPendingMDMHostProfilesFunc = func(
 		ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string,
-	) error {
-		return nil
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.DeleteMDMAppleDeclarationByNameFunc = func(ctx context.Context, teamID *uint, name string) error {
 		return nil
@@ -1246,8 +1725,12 @@ func setupFullGitOpsPremiumServer(t *testing.T) (*mock.Store, **fleet.AppConfig,
 		return nil, nil, nil
 	}
 	ds.ListTeamsFunc = func(ctx context.Context, filter fleet.TeamFilter, opt fleet.ListOptions) ([]*fleet.Team, error) {
-		if savedTeam != nil {
-			return []*fleet.Team{savedTeam}, nil
+		if savedTeams != nil {
+			var result []*fleet.Team
+			for _, t := range savedTeams {
+				result = append(result, *t)
+			}
+			return result, nil
 		}
 		return nil, nil
 	}
@@ -1265,33 +1748,39 @@ func setupFullGitOpsPremiumServer(t *testing.T) (*mock.Store, **fleet.AppConfig,
 		return job, nil
 	}
 	ds.NewTeamFunc = func(ctx context.Context, team *fleet.Team) (*fleet.Team, error) {
-		team.ID = 1
-		savedTeam = team
-		return savedTeam, nil
+		team.ID = uint(len(savedTeams) + 1)
+		savedTeams[team.Name] = &team
+		return team, nil
 	}
 	ds.QueryByNameFunc = func(ctx context.Context, teamID *uint, name string) (*fleet.Query, error) {
 		return nil, &notFoundError{}
 	}
 	ds.TeamFunc = func(ctx context.Context, tid uint) (*fleet.Team, error) {
-		if savedTeam != nil && tid == savedTeam.ID {
-			return savedTeam, nil
+		for _, tm := range savedTeams {
+			if (*tm).ID == tid {
+				return *tm, nil
+			}
 		}
 		return nil, &notFoundError{}
 	}
 	ds.TeamByNameFunc = func(ctx context.Context, name string) (*fleet.Team, error) {
-		if savedTeam != nil && name == teamName {
-			return savedTeam, nil
+		for _, tm := range savedTeams {
+			if (*tm).Name == name {
+				return *tm, nil
+			}
 		}
 		return nil, &notFoundError{}
 	}
 	ds.TeamByFilenameFunc = func(ctx context.Context, filename string) (*fleet.Team, error) {
-		if savedTeam != nil && *savedTeam.Filename == filename {
-			return savedTeam, nil
+		for _, tm := range savedTeams {
+			if *(*tm).Filename == filename {
+				return *tm, nil
+			}
 		}
 		return nil, &notFoundError{}
 	}
 	ds.SaveTeamFunc = func(ctx context.Context, team *fleet.Team) (*fleet.Team, error) {
-		savedTeam = team
+		savedTeams[team.Name] = &team
 		return team, nil
 	}
 	ds.SetOrUpdateMDMAppleDeclarationFunc = func(ctx context.Context, declaration *fleet.MDMAppleDeclaration) (
@@ -1300,8 +1789,30 @@ func setupFullGitOpsPremiumServer(t *testing.T) (*mock.Store, **fleet.AppConfig,
 		declaration.DeclarationUUID = uuid.NewString()
 		return declaration, nil
 	}
-	ds.BatchSetSoftwareInstallersFunc = func(ctx context.Context, teamID *uint, installers []*fleet.UploadSoftwareInstallerPayload) error {
-		return nil
+	ds.BatchSetSoftwareInstallersFunc = func(ctx context.Context, teamID *uint, installers []*fleet.UploadSoftwareInstallerPayload) ([]fleet.SoftwareInstaller, error) {
+		return nil, nil
+	}
+
+	ds.InsertVPPTokenFunc = func(ctx context.Context, tok *fleet.VPPTokenData) (*fleet.VPPTokenDB, error) {
+		return &fleet.VPPTokenDB{}, nil
+	}
+	ds.GetVPPTokenFunc = func(ctx context.Context, tokenID uint) (*fleet.VPPTokenDB, error) {
+		return &fleet.VPPTokenDB{}, err
+	}
+	ds.GetVPPTokenByTeamIDFunc = func(ctx context.Context, teamID *uint) (*fleet.VPPTokenDB, error) {
+		return &fleet.VPPTokenDB{}, nil
+	}
+	ds.ListVPPTokensFunc = func(ctx context.Context) ([]*fleet.VPPTokenDB, error) {
+		return nil, nil
+	}
+	ds.UpdateVPPTokenTeamsFunc = func(ctx context.Context, id uint, teams []uint) (*fleet.VPPTokenDB, error) {
+		return &fleet.VPPTokenDB{}, nil
+	}
+	ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+		return []*fleet.ABMToken{{OrganizationName: "Fleet Device Management Inc."}}, nil
+	}
+	ds.ListSoftwareTitlesFunc = func(ctx context.Context, opt fleet.SoftwareTitleListOptions, tmFilter fleet.TeamFilter) ([]fleet.SoftwareTitleListResult, int, *fleet.PaginationMetadata, error) {
+		return nil, 0, nil, nil
 	}
 
 	t.Setenv("FLEET_SERVER_URL", fleetServerURL)
@@ -1309,5 +1820,682 @@ func setupFullGitOpsPremiumServer(t *testing.T) (*mock.Store, **fleet.AppConfig,
 	t.Setenv("TEST_TEAM_NAME", teamName)
 	t.Setenv("APPLE_BM_DEFAULT_TEAM", teamName)
 
-	return ds, &savedAppConfig, &savedTeam
+	return ds, &savedAppConfig, savedTeams
+}
+
+func TestGitOpsABM(t *testing.T) {
+	global := func(mdm string) string {
+		return fmt.Sprintf(`
+controls:
+queries:
+policies:
+agent_options:
+software:
+org_settings:
+  server_settings:
+    server_url: "https://foo.example.com"
+  org_info:
+    org_name: GitOps Test
+  secrets:
+    - secret: "global"
+  mdm:
+    %s
+ `, mdm)
+	}
+
+	team := func(name string) string {
+		return fmt.Sprintf(`
+name: %s
+team_settings:
+  secrets:
+    - secret: "%s-secret"
+agent_options:
+controls:
+policies:
+queries:
+software:
+`, name, name)
+	}
+
+	workstations := team("💻 Workstations")
+	iosTeam := team("📱🏢 Company-owned iPhones")
+	ipadTeam := team("🔳🏢 Company-owned iPads")
+
+	cases := []struct {
+		name             string
+		cfgs             []string
+		dryRunAssertion  func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error)
+		realRunAssertion func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error)
+		tokens           []*fleet.ABMToken
+	}{
+		{
+			name: "backwards compat",
+			cfgs: []string{
+				global("apple_bm_default_team: 💻 Workstations"),
+				workstations,
+			},
+			tokens: []*fleet.ABMToken{{OrganizationName: "Fleet Device Management Inc."}},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
+				assert.Equal(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam, "💻 Workstations")
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		//	{
+		//		name: "deprecated config with two tokens in the db fails",
+		//		cfgs: []string{
+		//			global("apple_bm_default_team: 💻 Workstations"),
+		//			workstations,
+		//		},
+		//		tokens: []*fleet.ABMToken{{OrganizationName: "Fleet Device Management Inc."}, {OrganizationName: "Second Token LLC"}},
+		//		dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+		//			require.ErrorContains(t, err, "mdm.apple_bm_default_team has been deprecated")
+		//			assert.Empty(t, appCfg.MDM.AppleBussinessManager.Value)
+		//			assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+		//			assert.NotContains(t, out, "[!] gitops dry run succeeded")
+		//		},
+		//		realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+		//			require.ErrorContains(t, err, "mdm.apple_bm_default_team has been deprecated")
+		//			assert.Empty(t, appCfg.MDM.AppleBussinessManager.Value)
+		//			assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+		//			assert.NotContains(t, out, "[!] gitops dry run succeeded")
+		//		},
+		//	},
+		{
+			name: "new key all valid",
+			cfgs: []string{
+				global(`
+                                  apple_business_manager:
+                                    - organization_name: Fleet Device Management Inc.
+                                      macos_team: "💻 Workstations"
+                                      ios_team: "📱🏢 Company-owned iPhones"
+                                      ipados_team: "🔳🏢 Company-owned iPads"`),
+				workstations,
+				iosTeam,
+				ipadTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.ElementsMatch(
+					t,
+					appCfg.MDM.AppleBusinessManager.Value,
+					[]fleet.MDMAppleABMAssignmentInfo{
+						{
+							OrganizationName: "Fleet Device Management Inc.",
+							MacOSTeam:        "💻 Workstations",
+							IOSTeam:          "📱🏢 Company-owned iPhones",
+							IpadOSTeam:       "🔳🏢 Company-owned iPads",
+						},
+					},
+				)
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "new key multiple elements",
+			cfgs: []string{
+				global(`
+                                  apple_business_manager:
+                                    - organization_name: Foo Inc.
+                                      macos_team: "💻 Workstations"
+                                      ios_team: "📱🏢 Company-owned iPhones"
+                                      ipados_team: "🔳🏢 Company-owned iPads"
+                                    - organization_name: Fleet Device Management Inc.
+                                      macos_team: "💻 Workstations"
+                                      ios_team: "📱🏢 Company-owned iPhones"
+                                      ipados_team: "🔳🏢 Company-owned iPads"`),
+				workstations,
+				iosTeam,
+				ipadTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.ElementsMatch(
+					t,
+					appCfg.MDM.AppleBusinessManager.Value,
+					[]fleet.MDMAppleABMAssignmentInfo{
+						{
+							OrganizationName: "Fleet Device Management Inc.",
+							MacOSTeam:        "💻 Workstations",
+							IOSTeam:          "📱🏢 Company-owned iPhones",
+							IpadOSTeam:       "🔳🏢 Company-owned iPads",
+						},
+						{
+							OrganizationName: "Foo Inc.",
+							MacOSTeam:        "💻 Workstations",
+							IOSTeam:          "📱🏢 Company-owned iPhones",
+							IpadOSTeam:       "🔳🏢 Company-owned iPads",
+						},
+					},
+				)
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "both keys errors",
+			cfgs: []string{
+				global(`
+                                  apple_bm_default_team: "💻 Workstations"
+                                  apple_business_manager:
+                                    - organization_name: Fleet Device Management Inc.
+                                      macos_team: "💻 Workstations"
+                                      ios_team: "📱🏢 Company-owned iPhones"
+                                      ipados_team: "🔳🏢 Company-owned iPads"`),
+				workstations,
+				iosTeam,
+				ipadTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				t.Log(out)
+				require.ErrorContains(t, err, "mdm.apple_bm_default_team has been deprecated")
+				assert.NotContains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				require.ErrorContains(t, err, "mdm.apple_bm_default_team has been deprecated")
+				assert.NotContains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "using an undefined team errors",
+			cfgs: []string{
+				global(`
+                                  apple_business_manager:
+                                    - organization_name: Fleet Device Management Inc.
+                                      macos_team: "💻 Workstations"
+                                      ios_team: "📱🏢 Company-owned iPhones"
+                                      ipados_team: "🔳🏢 Company-owned iPads"`),
+				workstations,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.ErrorContains(t, err, "apple_business_manager team 📱🏢 Company-owned iPhones not found in team configs")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.ErrorContains(t, err, "apple_business_manager team 📱🏢 Company-owned iPhones not found in team configs")
+			},
+		},
+		{
+			name: "no team is supported",
+			cfgs: []string{
+				global(`
+                                  apple_business_manager:
+                                    - organization_name: Fleet Device Management Inc.
+                                      macos_team: "No team"
+                                      ios_team: "No team"
+                                      ipados_team: "No team"`),
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.ElementsMatch(
+					t,
+					appCfg.MDM.AppleBusinessManager.Value,
+					[]fleet.MDMAppleABMAssignmentInfo{
+						{
+							OrganizationName: "Fleet Device Management Inc.",
+							MacOSTeam:        "No team",
+							IOSTeam:          "No team",
+							IpadOSTeam:       "No team",
+						},
+					},
+				)
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "not provided teams defaults to no team",
+			cfgs: []string{
+				global(`
+                                  apple_business_manager:
+                                    - organization_name: Fleet Device Management Inc.
+                                      macos_team: "No team"
+                                      ios_team: ""`),
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.ElementsMatch(
+					t,
+					appCfg.MDM.AppleBusinessManager.Value,
+					[]fleet.MDMAppleABMAssignmentInfo{
+						{
+							OrganizationName: "Fleet Device Management Inc.",
+							MacOSTeam:        "No team",
+							IOSTeam:          "",
+							IpadOSTeam:       "",
+						},
+					},
+				)
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "non existent org name fails",
+			cfgs: []string{
+				global(`
+                                  apple_business_manager:
+                                    - organization_name: Does not exist
+                                      macos_team: "No team"`),
+			},
+			tokens: []*fleet.ABMToken{{OrganizationName: "Fleet Device Management Inc."}},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.ErrorContains(t, err, "token with organization name Does not exist doesn't exist")
+				assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.NotContains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.ErrorContains(t, err, "token with organization name Does not exist doesn't exist")
+				assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.NotContains(t, out, "[!] gitops dry run succeeded")
+			},
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			ds, savedAppConfigPtr, savedTeams := setupFullGitOpsPremiumServer(t)
+
+			ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+				if len(tt.tokens) > 0 {
+					return tt.tokens, nil
+				}
+				return []*fleet.ABMToken{{OrganizationName: "Fleet Device Management Inc."}, {OrganizationName: "Foo Inc."}}, nil
+			}
+
+			ds.TeamsSummaryFunc = func(ctx context.Context) ([]*fleet.TeamSummary, error) {
+				var res []*fleet.TeamSummary
+				for _, tm := range savedTeams {
+					res = append(res, &fleet.TeamSummary{Name: (*tm).Name, ID: (*tm).ID})
+				}
+				return res, nil
+			}
+
+			ds.SaveABMTokenFunc = func(ctx context.Context, tok *fleet.ABMToken) error {
+				return nil
+			}
+
+			args := []string{"gitops"}
+			for _, cfg := range tt.cfgs {
+				if cfg != "" {
+					tmpFile, err := os.CreateTemp(t.TempDir(), "*.yml")
+					require.NoError(t, err)
+					_, err = tmpFile.WriteString(cfg)
+					require.NoError(t, err)
+					args = append(args, "-f", tmpFile.Name())
+				}
+			}
+
+			// Dry run
+			out, err := runAppNoChecks(append(args, "--dry-run"))
+			tt.dryRunAssertion(t, *savedAppConfigPtr, ds, out.String(), err)
+			if t.Failed() {
+				t.FailNow()
+			}
+
+			// Real run
+			out, err = runAppNoChecks(args)
+			tt.realRunAssertion(t, *savedAppConfigPtr, ds, out.String(), err)
+
+			// Second real run, now that all the teams are saved
+			out, err = runAppNoChecks(args)
+			tt.realRunAssertion(t, *savedAppConfigPtr, ds, out.String(), err)
+		})
+	}
+}
+
+func TestGitOpsVPP(t *testing.T) {
+	global := func(mdm string) string {
+		return fmt.Sprintf(`
+controls:
+queries:
+policies:
+agent_options:
+software:
+org_settings:
+  server_settings:
+    server_url: "https://foo.example.com"
+  org_info:
+    org_name: GitOps Test
+  secrets:
+    - secret: "global"
+  mdm:
+    %s
+ `, mdm)
+	}
+
+	team := func(name string) string {
+		return fmt.Sprintf(`
+name: %s
+team_settings:
+  secrets:
+    - secret: "%s-secret"
+agent_options:
+controls:
+policies:
+queries:
+software:
+`, name, name)
+	}
+
+	workstations := team("💻 Workstations")
+	iosTeam := team("📱🏢 Company-owned iPhones")
+	ipadTeam := team("🔳🏢 Company-owned iPads")
+
+	cases := []struct {
+		name             string
+		cfgs             []string
+		dryRunAssertion  func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error)
+		realRunAssertion func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error)
+	}{
+		{
+			name: "new key all valid",
+			cfgs: []string{
+				global(`
+                                  volume_purchasing_program:
+                                    - location: Fleet Device Management Inc.
+                                      teams:
+                                        - "💻 Workstations"
+                                        - "📱🏢 Company-owned iPhones"
+                                        - "🔳🏢 Company-owned iPads"`),
+				workstations,
+				iosTeam,
+				ipadTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.VolumePurchasingProgram.Value)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.ElementsMatch(
+					t,
+					appCfg.MDM.VolumePurchasingProgram.Value,
+					[]fleet.MDMAppleVolumePurchasingProgramInfo{
+						{
+							Location: "Fleet Device Management Inc.",
+							Teams: []string{
+								"💻 Workstations",
+								"📱🏢 Company-owned iPhones",
+								"🔳🏢 Company-owned iPads",
+							},
+						},
+					},
+				)
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "new key multiple elements",
+			cfgs: []string{
+				global(`
+                                  volume_purchasing_program:
+                                    - location: Acme Inc.
+                                      teams:
+                                        - "💻 Workstations"
+                                    - location: Fleet Device Management Inc.
+                                      teams:
+                                        - "📱🏢 Company-owned iPhones"
+                                        - "🔳🏢 Company-owned iPads"`),
+				workstations,
+				iosTeam,
+				ipadTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.VolumePurchasingProgram.Value)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.ElementsMatch(
+					t,
+					appCfg.MDM.VolumePurchasingProgram.Value,
+					[]fleet.MDMAppleVolumePurchasingProgramInfo{
+						{
+							Location: "Acme Inc.",
+							Teams: []string{
+								"💻 Workstations",
+							},
+						},
+						{
+							Location: "Fleet Device Management Inc.",
+							Teams: []string{
+								"📱🏢 Company-owned iPhones",
+								"🔳🏢 Company-owned iPads",
+							},
+						},
+					},
+				)
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "using an undefined team errors",
+			cfgs: []string{
+				global(`
+                                  volume_purchasing_program:
+                                    - location: Fleet Device Management Inc.
+                                      teams:
+                                        - "💻 Workstations"
+                                        - "📱🏢 Company-owned iPhones"
+                                        - "🔳🏢 Company-owned iPads"`),
+				workstations,
+				ipadTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.ErrorContains(t, err, "volume_purchasing_program team 📱🏢 Company-owned iPhones not found in team configs")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.ErrorContains(t, err, "volume_purchasing_program team 📱🏢 Company-owned iPhones not found in team configs")
+			},
+		},
+		{
+			name: "no team is supported",
+			cfgs: []string{
+				global(`
+                                  volume_purchasing_program:
+                                    - location: Fleet Device Management Inc.
+                                      teams:
+                                        - "💻 Workstations"
+                                        - "📱🏢 Company-owned iPhones"
+                                        - "No team"`),
+				workstations,
+				iosTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.VolumePurchasingProgram.Value)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.ElementsMatch(
+					t,
+					appCfg.MDM.VolumePurchasingProgram.Value,
+					[]fleet.MDMAppleVolumePurchasingProgramInfo{
+						{
+							Location: "Fleet Device Management Inc.",
+							Teams: []string{
+								"💻 Workstations",
+								"📱🏢 Company-owned iPhones",
+								"No team",
+							},
+						},
+					},
+				)
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "all teams is supported",
+			cfgs: []string{
+				global(`
+                        volume_purchasing_program:
+                          - location: Fleet Device Management Inc.
+                            teams:
+                              - "All teams"`),
+				workstations,
+				iosTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.VolumePurchasingProgram.Value)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.ElementsMatch(
+					t,
+					appCfg.MDM.VolumePurchasingProgram.Value,
+					[]fleet.MDMAppleVolumePurchasingProgramInfo{
+						{
+							Location: "Fleet Device Management Inc.",
+							Teams: []string{
+								"All teams",
+							},
+						},
+					},
+				)
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "not provided teams defaults to no team",
+			cfgs: []string{
+				global(`
+                                  volume_purchasing_program:
+                                    - location: Fleet Device Management Inc.
+                                      teams:`),
+				workstations,
+				ipadTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.VolumePurchasingProgram.Value)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.ElementsMatch(
+					t,
+					appCfg.MDM.VolumePurchasingProgram.Value,
+					[]fleet.MDMAppleVolumePurchasingProgramInfo{
+						{
+							Location: "Fleet Device Management Inc.",
+							Teams:    nil,
+						},
+					},
+				)
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "non existent location fails",
+			cfgs: []string{
+				global(`
+                                  volume_purchasing_program:
+                                    - location: Does not exist
+                                      teams:`),
+				workstations,
+				ipadTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.ErrorContains(t, err, "token with location Does not exist doesn't exist")
+				assert.Empty(t, appCfg.MDM.VolumePurchasingProgram.Value)
+				assert.NotContains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.ErrorContains(t, err, "token with location Does not exist doesn't exist")
+				assert.Empty(t, appCfg.MDM.VolumePurchasingProgram.Value)
+				assert.NotContains(t, out, "[!] gitops dry run succeeded")
+			},
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			ds, savedAppConfigPtr, savedTeams := setupFullGitOpsPremiumServer(t)
+
+			ds.ListVPPTokensFunc = func(ctx context.Context) ([]*fleet.VPPTokenDB, error) {
+				return []*fleet.VPPTokenDB{{Location: "Fleet Device Management Inc."}, {Location: "Acme Inc."}}, nil
+			}
+
+			ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+				return []*fleet.ABMToken{{OrganizationName: "Fleet Device Management Inc."}, {OrganizationName: "Foo Inc."}}, nil
+			}
+
+			ds.TeamsSummaryFunc = func(ctx context.Context) ([]*fleet.TeamSummary, error) {
+				var res []*fleet.TeamSummary
+				for _, tm := range savedTeams {
+					res = append(res, &fleet.TeamSummary{Name: (*tm).Name, ID: (*tm).ID})
+				}
+				return res, nil
+			}
+
+			ds.SaveABMTokenFunc = func(ctx context.Context, tok *fleet.ABMToken) error {
+				return nil
+			}
+
+			args := []string{"gitops"}
+			for _, cfg := range tt.cfgs {
+				if cfg != "" {
+					tmpFile, err := os.CreateTemp(t.TempDir(), "*.yml")
+					require.NoError(t, err)
+					_, err = tmpFile.WriteString(cfg)
+					require.NoError(t, err)
+					args = append(args, "-f", tmpFile.Name())
+				}
+			}
+
+			// Dry run
+			out, err := runAppNoChecks(append(args, "--dry-run"))
+			tt.dryRunAssertion(t, *savedAppConfigPtr, ds, out.String(), err)
+			if t.Failed() {
+				t.FailNow()
+			}
+
+			// Real run
+			out, err = runAppNoChecks(args)
+			tt.realRunAssertion(t, *savedAppConfigPtr, ds, out.String(), err)
+
+			// Second real run, now that all the teams are saved
+			out, err = runAppNoChecks(args)
+			tt.realRunAssertion(t, *savedAppConfigPtr, ds, out.String(), err)
+		})
+	}
 }
diff --git a/cmd/fleetctl/hosts_test.go b/cmd/fleetctl/hosts_test.go
index a24fc79cbe3a..6220d6d75c25 100644
--- a/cmd/fleetctl/hosts_test.go
+++ b/cmd/fleetctl/hosts_test.go
@@ -43,8 +43,9 @@ func TestHostsTransferByHosts(t *testing.T) {
 		return nil
 	}
 
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	ds.ListMDMAppleDEPSerialsInHostIDsFunc = func(ctx context.Context, hostIDs []uint) ([]string, error) {
@@ -114,8 +115,9 @@ func TestHostsTransferByLabel(t *testing.T) {
 		return nil
 	}
 
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	ds.ListMDMAppleDEPSerialsInHostIDsFunc = func(ctx context.Context, hostIDs []uint) ([]string, error) {
@@ -184,8 +186,9 @@ func TestHostsTransferByStatus(t *testing.T) {
 		return nil
 	}
 
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	ds.ListMDMAppleDEPSerialsInHostIDsFunc = func(ctx context.Context, hostIDs []uint) ([]string, error) {
@@ -243,8 +246,9 @@ func TestHostsTransferByStatusAndSearchQuery(t *testing.T) {
 		return nil
 	}
 
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	ds.ListMDMAppleDEPSerialsInHostIDsFunc = func(ctx context.Context, hostIDs []uint) ([]string, error) {
diff --git a/cmd/fleetctl/package.go b/cmd/fleetctl/package.go
index bec5ea3b7d82..1cf3978c72c7 100644
--- a/cmd/fleetctl/package.go
+++ b/cmd/fleetctl/package.go
@@ -38,6 +38,12 @@ func packageCommand() *cli.Command {
 				Usage:    "Type of package to build",
 				Required: true,
 			},
+			&cli.StringFlag{
+				Name:        "arch",
+				Usage:       "Target CPU Architecture for the installer package (Only supported with '--type' deb or rpm)",
+				Destination: &opt.Architecture,
+				Value:       "amd64",
+			},
 			&cli.StringFlag{
 				Name:        "enroll-secret",
 				Usage:       "Enroll secret for authenticating to Fleet server",
@@ -74,11 +80,6 @@ func packageCommand() *cli.Command {
 				Value:       "com.fleetdm.orbit",
 				Destination: &opt.Identifier,
 			},
-			&cli.StringFlag{
-				Name:        "version",
-				Usage:       "Version for package product",
-				Destination: &opt.Version,
-			},
 			&cli.BoolFlag{
 				Name:        "insecure",
 				Usage:       "Disable TLS certificate verification",
@@ -336,6 +337,20 @@ func packageCommand() *cli.Command {
 				return errors.New("--use-system-configuration is only available for pkg installers")
 			}
 
+			linuxPackage := false
+			switch c.String("type") {
+			case "deb", "rpm":
+				linuxPackage = true
+			}
+
+			if opt.Architecture != packaging.ArchAmd64 && !linuxPackage {
+				return fmt.Errorf("can't use '--arch' with '--type %s'", c.String("type"))
+			}
+
+			if opt.Architecture != packaging.ArchAmd64 && opt.Architecture != packaging.ArchArm64 {
+				return errors.New("arch must be one of ('amd64', 'arm64')")
+			}
+
 			var buildFunc func(packaging.Options) (string, error)
 			switch c.String("type") {
 			case "pkg":
diff --git a/cmd/fleetctl/preview.go b/cmd/fleetctl/preview.go
index a48734871cff..ef06f3c8cc88 100644
--- a/cmd/fleetctl/preview.go
+++ b/cmd/fleetctl/preview.go
@@ -74,7 +74,7 @@ func (d dockerCompose) Command(arg ...string) *exec.Cmd {
 
 func newDockerCompose() (dockerCompose, error) {
 	// first, check if `docker compose` is available
-	if err := exec.Command("docker compose").Run(); err == nil {
+	if err := exec.Command("docker", "compose").Run(); err == nil {
 		return dockerCompose{dockerComposeV2}, nil
 	}
 
@@ -387,7 +387,7 @@ Use the stop and reset subcommands to manage the server and dependencies once st
 			}
 			// this only applies standard queries, the base directory is not used,
 			// so pass in the current working directory.
-			_, err = client.ApplyGroup(c.Context, specs, ".", logf, fleet.ApplyClientSpecOptions{})
+			_, _, err = client.ApplyGroup(c.Context, specs, ".", logf, nil, fleet.ApplyClientSpecOptions{})
 			if err != nil {
 				return err
 			}
diff --git a/cmd/fleetctl/preview_test.go b/cmd/fleetctl/preview_test.go
index 76c68eb19010..c3a75a73e1b0 100644
--- a/cmd/fleetctl/preview_test.go
+++ b/cmd/fleetctl/preview_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestPreview(t *testing.T) {
+func TestIntegrationsPreview(t *testing.T) {
 	nettest.Run(t)
 
 	t.Setenv("FLEET_SERVER_ADDRESS", "https://localhost:8412")
@@ -74,6 +74,7 @@ func gitRootPath(t *testing.T) string {
 }
 
 func TestDockerCompose(t *testing.T) {
+	t.Parallel()
 	t.Run("returns the right command according to the version", func(t *testing.T) {
 		v1 := dockerCompose{dockerComposeV1}
 		cmd1 := v1.Command("up")
diff --git a/cmd/fleetctl/query_test.go b/cmd/fleetctl/query_test.go
index 5a9ca51b9f01..2ee7f8b7c182 100644
--- a/cmd/fleetctl/query_test.go
+++ b/cmd/fleetctl/query_test.go
@@ -49,7 +49,10 @@ func TestSavedLiveQuery(t *testing.T) {
 	}
 
 	ds.HostIDsByIdentifierFunc = func(ctx context.Context, filter fleet.TeamFilter, hostIdentifiers []string) ([]uint, error) {
-		return []uint{1234}, nil
+		if len(hostIdentifiers) == 1 && hostIdentifiers[0] == "1234" {
+			return []uint{1234}, nil
+		}
+		return nil, nil
 	}
 	ds.LabelIDsByNameFunc = func(ctx context.Context, labels []string) (map[string]uint, error) {
 		return nil, nil
@@ -70,7 +73,11 @@ func TestSavedLiveQuery(t *testing.T) {
 	ds.NewDistributedQueryCampaignTargetFunc = func(ctx context.Context, target *fleet.DistributedQueryCampaignTarget) (*fleet.DistributedQueryCampaignTarget, error) {
 		return target, nil
 	}
+	noHostsTargeted := false
 	ds.HostIDsInTargetsFunc = func(ctx context.Context, filter fleet.TeamFilter, targets fleet.HostTargets) ([]uint, error) {
+		if noHostsTargeted {
+			return nil, nil
+		}
 		return []uint{1}, nil
 	}
 	ds.CountHostsInTargetsFunc = func(ctx context.Context, filter fleet.TeamFilter, targets fleet.HostTargets, now time.Time) (fleet.TargetMetrics, error) {
@@ -176,6 +183,12 @@ func TestSavedLiveQuery(t *testing.T) {
 		)
 	case <-c: // All good
 	}
+
+	// Test targeting no hosts (e.g. host does exist)
+	noHostsTargeted = true
+	_, err = runAppNoChecks([]string{"query", "--hosts", "foobar", "--query-name", queryName})
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "No hosts targeted")
 }
 
 func TestAdHocLiveQuery(t *testing.T) {
diff --git a/cmd/fleetctl/scripts.go b/cmd/fleetctl/scripts.go
index e1b65f3f264d..81758455f70c 100644
--- a/cmd/fleetctl/scripts.go
+++ b/cmd/fleetctl/scripts.go
@@ -8,8 +8,10 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"time"
 	"unicode/utf8"
 
+	"github.com/briandowns/spinner"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/service"
 	"github.com/urfave/cli/v2"
@@ -27,7 +29,7 @@ func runScriptCommand() *cli.Command {
 	return &cli.Command{
 		Name:      "run-script",
 		Aliases:   []string{"run_script"},
-		Usage:     `Run a live script on one host and get results back (5 minute timeout).`,
+		Usage:     `Run a script on one host and get results back.`,
 		UsageText: `fleetctl run-script [options]`,
 		Flags: []cli.Flag{
 			&cli.StringFlag{
@@ -159,11 +161,15 @@ func runScriptCommand() *cli.Command {
 				return nil
 			}
 
+			s := spinner.New(spinner.CharSets[24], 200*time.Millisecond)
 			if !quiet {
-				fmt.Println("\nScript is running. Please wait for it to finish...")
+				fmt.Println()
+				s.Suffix = " Script is running or will run when the host comes online..."
+				s.Start()
 			}
 
 			res, err := client.RunHostScriptSync(h.ID, b, name, c.Uint("team"))
+			s.Stop()
 			if err != nil {
 				if strings.Contains(err.Error(), `Only one of 'script_contents' or 'team_id' is allowed`) {
 					return errors.New("Only one of '--script-path' or '--team' is allowed.")
diff --git a/cmd/fleetctl/scripts_test.go b/cmd/fleetctl/scripts_test.go
index abb57585840b..e65a183a2e6a 100644
--- a/cmd/fleetctl/scripts_test.go
+++ b/cmd/fleetctl/scripts_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/fleetdm/fleet/v4/pkg/scripts"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/fleetdm/fleet/v4/server/service"
@@ -21,6 +22,7 @@ func TestRunScriptCommand(t *testing.T) {
 			License: &fleet.LicenseInfo{
 				Tier: fleet.TierPremium,
 			},
+			NoCacheDatastore: true,
 		},
 		&service.TestServerOpts{
 			HTTPServerConfig: &http.Server{WriteTimeout: 90 * time.Second}, // nolint:gosec
@@ -42,6 +44,9 @@ func TestRunScriptCommand(t *testing.T) {
 	ds.ListHostBatteriesFunc = func(ctx context.Context, hid uint) ([]*fleet.HostBattery, error) {
 		return nil, nil
 	}
+	ds.HostLiteFunc = func(ctx context.Context, hid uint) (*fleet.Host, error) {
+		return &fleet.Host{}, nil
+	}
 	ds.ListUpcomingHostMaintenanceWindowsFunc = func(ctx context.Context, hid uint) ([]*fleet.HostMaintenanceWindow, error) {
 		return nil, nil
 	}
@@ -93,12 +98,6 @@ hello world
 	}
 
 	cases := []testCase{
-		{
-			name:          "host offline",
-			scriptPath:    generateValidPath,
-			expectErrMsg:  fleet.RunScriptHostOfflineErrMsg,
-			expectOffline: true,
-		},
 		{
 			name:           "host not found",
 			scriptPath:     generateValidPath,
@@ -220,12 +219,6 @@ hello world
 			scriptPath:   func() string { return writeTmpScriptContents(t, "\xff\xfa", ".sh") },
 			expectErrMsg: `Wrong data format. Only plain text allowed.`,
 		},
-		{
-			name:          "script already running",
-			scriptPath:    generateValidPath,
-			expectErrMsg:  fleet.RunScriptAlreadyRunningErrMsg,
-			expectPending: true,
-		},
 		{
 			name:       "script successful",
 			scriptPath: generateValidPath,
@@ -270,10 +263,10 @@ Output:
 			scriptResult: &fleet.HostScriptResult{
 				ExitCode: ptr.Int64(-1),
 				Output:   "Oh no!",
-				Message:  fleet.RunScriptScriptTimeoutErrMsg,
+				Message:  fleet.HostScriptTimeoutMessage(ptr.Int(int(scripts.MaxHostExecutionTime.Seconds()))),
 			},
 			expectOutput: `
-Error: Timeout. Fleet stopped the script after 5 minutes to protect host performance.
+Error: Timeout. Fleet stopped the script after 300 seconds to protect host performance.
 
 Output before timeout:
 
@@ -367,6 +360,7 @@ Fleet records the last 10,000 characters to prevent downtime.
 				Hostname:       "host1",
 				HostID:         req.HostID,
 				ScriptContents: req.ScriptContents,
+				ExecutionID:    "123",
 			}, nil
 		}
 		if c.name == "disabled scripts globally" {
diff --git a/cmd/fleetctl/testdata/expectedGetConfigAppConfigJson.json b/cmd/fleetctl/testdata/expectedGetConfigAppConfigJson.json
index c6624c71109f..ece537e7b95f 100644
--- a/cmd/fleetctl/testdata/expectedGetConfigAppConfigJson.json
+++ b/cmd/fleetctl/testdata/expectedGetConfigAppConfigJson.json
@@ -96,13 +96,22 @@
 			"apple_bm_terms_expired": false,
 			"apple_bm_enabled_and_configured": false,
 			"enabled_and_configured": false,
-			"apple_bm_default_team": "",
+			"apple_business_manager": null,
+			"volume_purchasing_program": null,
 			"windows_enabled_and_configured": false,
 			"enable_disk_encryption": false,
 			"macos_updates": {
 				"minimum_version": null,
 				"deadline": null
 			},
+			"ios_updates": {
+				"minimum_version": null,
+				"deadline": null
+			},
+			"ipados_updates": {
+				"minimum_version": null,
+				"deadline": null
+			},
 			"windows_updates": {
 				"deadline_days": 7,
 				"grace_period_days": 3
diff --git a/cmd/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml b/cmd/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml
index 92254b6052d7..5f19ffcb8ac0 100644
--- a/cmd/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml
+++ b/cmd/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml
@@ -21,7 +21,8 @@ spec:
     apple_bm_terms_expired: false
     apple_bm_enabled_and_configured: false
     enabled_and_configured: false
-    apple_bm_default_team: ""
+    apple_business_manager: null
+    volume_purchasing_program: null
     windows_enabled_and_configured: false
     enable_disk_encryption: false
     macos_migration:
@@ -31,6 +32,12 @@ spec:
     macos_updates:
       minimum_version: null
       deadline: null
+    ios_updates:
+      minimum_version: null
+      deadline: null
+    ipados_updates:
+      minimum_version: null
+      deadline: null
     windows_updates:
       deadline_days: 7
       grace_period_days: 3
diff --git a/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json b/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json
index 18d980b320bf..9fa625b676af 100644
--- a/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json
+++ b/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json
@@ -46,7 +46,8 @@
 			"enable_software_inventory": false
 		},
 		"mdm": {
-			"apple_bm_default_team": "",
+			"apple_business_manager": null,
+			"volume_purchasing_program": null,
 			"apple_bm_terms_expired": false,
 			"apple_bm_enabled_and_configured": false,
 			"enabled_and_configured": false,
@@ -56,6 +57,14 @@
 				"minimum_version": null,
 				"deadline": null
 			},
+			"ios_updates": {
+				"minimum_version": null,
+				"deadline": null
+			},
+			"ipados_updates": {
+				"minimum_version": null,
+				"deadline": null
+			},
 			"windows_updates": {
 				"deadline_days": 7,
 				"grace_period_days": 3
diff --git a/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml b/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml
index 3138a7d349fc..b28ab395b3e9 100644
--- a/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml
+++ b/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml
@@ -18,7 +18,8 @@ spec:
     jira: null
     zendesk: null
   mdm:
-    apple_bm_default_team: ""
+    apple_business_manager: null
+    volume_purchasing_program: null
     apple_bm_enabled_and_configured: false
     apple_bm_terms_expired: false
     enabled_and_configured: false
@@ -31,6 +32,12 @@ spec:
     macos_updates:
       minimum_version: null
       deadline: null
+    ios_updates:
+      minimum_version: null
+      deadline: null
+    ipados_updates:
+      minimum_version: null
+      deadline: null
     windows_updates:
       deadline_days: 7
       grace_period_days: 3
diff --git a/cmd/fleetctl/testdata/expectedGetTeamsJson.json b/cmd/fleetctl/testdata/expectedGetTeamsJson.json
index 1af52bee61b6..de6669ac1259 100644
--- a/cmd/fleetctl/testdata/expectedGetTeamsJson.json
+++ b/cmd/fleetctl/testdata/expectedGetTeamsJson.json
@@ -35,6 +35,14 @@
 					"minimum_version": null,
 					"deadline": null
 				},
+				"ios_updates": {
+					"minimum_version": null,
+					"deadline": null
+				},
+				"ipados_updates": {
+					"minimum_version": null,
+					"deadline": null
+				},
 				"windows_updates": {
 					"deadline_days": null,
 					"grace_period_days": null
@@ -53,7 +61,6 @@
 				}
 			},
 			"scripts": null,
-			"software": null,
 			"user_count": 99,
 			"host_count": 42
 		}
@@ -111,6 +118,14 @@
 					"minimum_version": "12.3.1",
 					"deadline": "2021-12-14"
 				},
+				"ios_updates": {
+					"minimum_version": "17.5",
+					"deadline": "2022-11-15"
+				},
+				"ipados_updates": {
+					"minimum_version": "18.0",
+					"deadline": "2023-01-01"
+				},
 				"windows_updates": {
 					"deadline_days": 7,
 					"grace_period_days": 3
@@ -129,7 +144,6 @@
 				}
 			},
 			"scripts": null,
-			"software": null,
 			"user_count": 87,
 			"host_count": 43
 		}
diff --git a/cmd/fleetctl/testdata/expectedGetTeamsYaml.yml b/cmd/fleetctl/testdata/expectedGetTeamsYaml.yml
index f10577a3af6f..422456f5b54e 100644
--- a/cmd/fleetctl/testdata/expectedGetTeamsYaml.yml
+++ b/cmd/fleetctl/testdata/expectedGetTeamsYaml.yml
@@ -16,6 +16,12 @@ spec:
       macos_updates:
         minimum_version: null
         deadline: null
+      ios_updates:
+        minimum_version: null
+        deadline: null
+      ipados_updates:
+        minimum_version: null
+        deadline: null
       windows_updates:
         deadline_days: null
         grace_period_days: null
@@ -30,7 +36,6 @@ spec:
         macos_setup_assistant:
     scripts: null
     secrets: null
-    software: null
     webhook_settings:
       host_status_webhook: null
     name: team1
@@ -61,6 +66,12 @@ spec:
       macos_updates:
         minimum_version: "12.3.1"
         deadline: "2021-12-14"
+      ios_updates:
+        minimum_version: "17.5"
+        deadline: "2022-11-15"
+      macos_updates:
+        minimum_version: "18.0"
+        deadline: "2023-01-01"
       windows_updates:
         deadline_days: 7
         grace_period_days: 3
@@ -74,7 +85,6 @@ spec:
         enable_release_device_manually: false
         macos_setup_assistant:
     scripts: null
-    software: null
     webhook_settings:
       host_status_webhook: null
     name: team2
diff --git a/cmd/fleetctl/testdata/gitops/global_config_no_paths.yml b/cmd/fleetctl/testdata/gitops/global_config_no_paths.yml
index 76936e3ad5af..894841a9338e 100644
--- a/cmd/fleetctl/testdata/gitops/global_config_no_paths.yml
+++ b/cmd/fleetctl/testdata/gitops/global_config_no_paths.yml
@@ -146,7 +146,6 @@ org_settings:
                         "private_key": "google_calendar_private_key",
       }
   mdm:
-    apple_bm_default_team: $APPLE_BM_DEFAULT_TEAM
     end_user_authentication:
       entity_id: ""
       idp_name: ""
@@ -187,3 +186,4 @@ org_settings:
   secrets: # These secrets are used to enroll hosts to the "All teams" team
     - secret: SampleSecret123
     - secret: ABC
+software:
diff --git a/cmd/fleetctl/testdata/gitops/global_macos_custom_settings_valid_deprecated.yml b/cmd/fleetctl/testdata/gitops/global_macos_custom_settings_valid_deprecated.yml
index 177c1c80cff9..b09844258516 100644
--- a/cmd/fleetctl/testdata/gitops/global_macos_custom_settings_valid_deprecated.yml
+++ b/cmd/fleetctl/testdata/gitops/global_macos_custom_settings_valid_deprecated.yml
@@ -91,3 +91,4 @@ org_settings:
     databases_path: ""
   secrets:
     - secret: ABC
+software:
\ No newline at end of file
diff --git a/cmd/fleetctl/testdata/gitops/global_macos_windows_custom_settings_valid.yml b/cmd/fleetctl/testdata/gitops/global_macos_windows_custom_settings_valid.yml
index da75847cd59c..e6231bf03098 100644
--- a/cmd/fleetctl/testdata/gitops/global_macos_windows_custom_settings_valid.yml
+++ b/cmd/fleetctl/testdata/gitops/global_macos_windows_custom_settings_valid.yml
@@ -97,3 +97,4 @@ org_settings:
     databases_path: ""
   secrets: 
     - secret: ABC
+software:
diff --git a/cmd/fleetctl/testdata/gitops/global_windows_custom_settings_invalid_label_mix.yml b/cmd/fleetctl/testdata/gitops/global_windows_custom_settings_invalid_label_mix.yml
index 9d2ac6e69f62..1a100de6f365 100644
--- a/cmd/fleetctl/testdata/gitops/global_windows_custom_settings_invalid_label_mix.yml
+++ b/cmd/fleetctl/testdata/gitops/global_windows_custom_settings_invalid_label_mix.yml
@@ -93,3 +93,4 @@ org_settings:
     databases_path: ""
   secrets:
     - secret: ABC
+software:
\ No newline at end of file
diff --git a/cmd/fleetctl/testdata/gitops/global_windows_custom_settings_unknown_label.yml b/cmd/fleetctl/testdata/gitops/global_windows_custom_settings_unknown_label.yml
index ba1d06f7849e..5208ba724863 100644
--- a/cmd/fleetctl/testdata/gitops/global_windows_custom_settings_unknown_label.yml
+++ b/cmd/fleetctl/testdata/gitops/global_windows_custom_settings_unknown_label.yml
@@ -91,3 +91,4 @@ org_settings:
     databases_path: ""
   secrets:
     - secret: ABC
+software:
\ No newline at end of file
diff --git a/cmd/fleetctl/testdata/gitops/lib/query_multiple.yml b/cmd/fleetctl/testdata/gitops/lib/query_multiple.yml
index c3109b5f71f1..f14ea9ea0e0c 100644
--- a/cmd/fleetctl/testdata/gitops/lib/query_multiple.yml
+++ b/cmd/fleetctl/testdata/gitops/lib/query_multiple.yml
@@ -1,11 +1,4 @@
-apiVersion: v1
-kind: query
-spec:
-  name: query_ruby
+- name: query_ruby
   query: select 1
----
-apiVersion: v1
-kind: query
-spec:
-  name: query_ruby2
+- name: query_ruby2
   query: select 2
diff --git a/cmd/fleetctl/testdata/gitops/lib/query_multiple_apply.yml b/cmd/fleetctl/testdata/gitops/lib/query_multiple_apply.yml
new file mode 100644
index 000000000000..c3109b5f71f1
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/lib/query_multiple_apply.yml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: query
+spec:
+  name: query_ruby
+  query: select 1
+---
+apiVersion: v1
+kind: query
+spec:
+  name: query_ruby2
+  query: select 2
diff --git a/cmd/fleetctl/testdata/gitops/lib/query_ruby.yml b/cmd/fleetctl/testdata/gitops/lib/query_ruby.yml
index 28714447bf35..bb61c6b32a62 100644
--- a/cmd/fleetctl/testdata/gitops/lib/query_ruby.yml
+++ b/cmd/fleetctl/testdata/gitops/lib/query_ruby.yml
@@ -1,5 +1,2 @@
-apiVersion: v1
-kind: query
-spec:
-  name: query_ruby
+- name: query_ruby
   query: select 1
diff --git a/cmd/fleetctl/testdata/gitops/lib/query_ruby_apply.yml b/cmd/fleetctl/testdata/gitops/lib/query_ruby_apply.yml
new file mode 100644
index 000000000000..28714447bf35
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/lib/query_ruby_apply.yml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: query
+spec:
+  name: query_ruby
+  query: select 1
diff --git a/cmd/fleetctl/testdata/gitops/lib/query_ruby_env.yml b/cmd/fleetctl/testdata/gitops/lib/query_ruby_env.yml
new file mode 100644
index 000000000000..c9b15ff2291f
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/lib/query_ruby_env.yml
@@ -0,0 +1,2 @@
+- name: query_ruby
+  query: select ${QUERY_VAR}
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_install_not_found.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_install_not_found.yml
new file mode 100644
index 000000000000..d3bcada54e82
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_install_not_found.yml
@@ -0,0 +1,19 @@
+# Test config
+controls:
+queries:
+policies:
+agent_options:
+org_settings:
+  server_settings:
+    server_url: $FLEET_SERVER_URL
+  org_info:
+    contact_url: https://example.com/contact
+    org_logo_url: ""
+    org_logo_url_light_background: ""
+    org_name: ${ORG_NAME}
+  secrets: [{"secret":"globalSecret"}]
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/notfound.sh
\ No newline at end of file
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_invalid_self_service_value.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_invalid_self_service_value.yml
new file mode 100644
index 000000000000..acee06d683a7
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_invalid_self_service_value.yml
@@ -0,0 +1,18 @@
+# Test config
+controls:
+queries:
+policies:
+agent_options:
+org_settings:
+  server_settings:
+    server_url: $FLEET_SERVER_URL
+  org_info:
+    contact_url: https://example.com/contact
+    org_logo_url: ""
+    org_logo_url_light_background: ""
+    org_name: ${ORG_NAME}
+  secrets: [{"secret":"globalSecret"}]
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/invalidtype.txt
+      self_service: "not a boolean"
\ No newline at end of file
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_no_url.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_no_url.yml
new file mode 100644
index 000000000000..6d83a9daed50
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_no_url.yml
@@ -0,0 +1,22 @@
+# Test config
+controls:
+queries:
+policies:
+agent_options:
+org_settings:
+  server_settings:
+    server_url: $FLEET_SERVER_URL
+  org_info:
+    contact_url: https://example.com/contact
+    org_logo_url: ""
+    org_logo_url_light_background: ""
+    org_name: ${ORG_NAME}
+  secrets: [{"secret":"globalSecret"}]
+software:
+  packages:
+    - install_script:
+        path: lib/install_ruby.sh
+      pre_install_query:
+        path: lib/query_ruby.yml
+      post_install_script:
+        path: lib/post_install_ruby.sh
\ No newline at end of file
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_not_found.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_not_found.yml
new file mode 100644
index 000000000000..cd7332f91e56
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_not_found.yml
@@ -0,0 +1,17 @@
+# Test config
+controls:
+queries:
+policies:
+agent_options:
+org_settings:
+  server_settings:
+    server_url: $FLEET_SERVER_URL
+  org_info:
+    contact_url: https://example.com/contact
+    org_logo_url: ""
+    org_logo_url_light_background: ""
+    org_name: ${ORG_NAME}
+  secrets: [{"secret":"globalSecret"}]
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/notfound.deb
\ No newline at end of file
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_post_install_not_found.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_post_install_not_found.yml
new file mode 100644
index 000000000000..ac0a436360ca
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_post_install_not_found.yml
@@ -0,0 +1,21 @@
+# Test config
+controls:
+queries:
+policies:
+agent_options:
+org_settings:
+  server_settings:
+    server_url: $FLEET_SERVER_URL
+  org_info:
+    contact_url: https://example.com/contact
+    org_logo_url: ""
+    org_logo_url_light_background: ""
+    org_name: ${ORG_NAME}
+  secrets: [{"secret":"globalSecret"}]
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/install_ruby.sh
+      post_install_script:
+        path: lib/notfound.sh
\ No newline at end of file
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_pre_condition_multiple_queries.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_pre_condition_multiple_queries.yml
new file mode 100644
index 000000000000..a2b5419c056a
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_pre_condition_multiple_queries.yml
@@ -0,0 +1,23 @@
+# Test config
+controls:
+queries:
+policies:
+agent_options:
+org_settings:
+  server_settings:
+    server_url: $FLEET_SERVER_URL
+  org_info:
+    contact_url: https://example.com/contact
+    org_logo_url: ""
+    org_logo_url_light_background: ""
+    org_name: ${ORG_NAME}
+  secrets: [{"secret":"globalSecret"}]
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/install_ruby.sh
+      pre_install_query:
+        path: lib/query_multiple.yml
+      post_install_script:
+        path: lib/post_install_ruby.sh
\ No newline at end of file
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_pre_condition_not_found.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_pre_condition_not_found.yml
new file mode 100644
index 000000000000..bafde42691b5
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_pre_condition_not_found.yml
@@ -0,0 +1,21 @@
+# Test config
+controls:
+queries:
+policies:
+agent_options:
+org_settings:
+  server_settings:
+    server_url: $FLEET_SERVER_URL
+  org_info:
+    contact_url: https://example.com/contact
+    org_logo_url: ""
+    org_logo_url_light_background: ""
+    org_name: ${ORG_NAME}
+  secrets: [{"secret":"globalSecret"}]
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/install_ruby.sh
+      pre_install_query:
+        path: lib/notfound.yml
\ No newline at end of file
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_too_large.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_too_large.yml
new file mode 100644
index 000000000000..db4ffd32113a
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_too_large.yml
@@ -0,0 +1,17 @@
+# Test config
+controls:
+queries:
+policies:
+agent_options:
+org_settings:
+  server_settings:
+    server_url: $FLEET_SERVER_URL
+  org_info:
+    contact_url: https://example.com/contact
+    org_logo_url: ""
+    org_logo_url_light_background: ""
+    org_name: ${ORG_NAME}
+  secrets: [{"secret":"globalSecret"}]
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/toolarge.deb
\ No newline at end of file
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_unsupported.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_unsupported.yml
new file mode 100644
index 000000000000..2bc609b931d7
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_unsupported.yml
@@ -0,0 +1,17 @@
+# Test config
+controls:
+queries:
+policies:
+agent_options:
+org_settings:
+  server_settings:
+    server_url: $FLEET_SERVER_URL
+  org_info:
+    contact_url: https://example.com/contact
+    org_logo_url: ""
+    org_logo_url_light_background: ""
+    org_name: ${ORG_NAME}
+  secrets: [{"secret":"globalSecret"}]
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/invalidtype.txt
\ No newline at end of file
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_valid.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_valid.yml
new file mode 100644
index 000000000000..e0fcaa490ec0
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_valid.yml
@@ -0,0 +1,25 @@
+# Test config
+controls:
+queries:
+policies:
+agent_options:
+org_settings:
+  server_settings:
+    server_url: $FLEET_SERVER_URL
+  org_info:
+    contact_url: https://example.com/contact
+    org_logo_url: ""
+    org_logo_url_light_background: ""
+    org_name: ${ORG_NAME}
+  secrets: [{"secret":"globalSecret"}]
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/install_ruby.sh
+      pre_install_query:
+        path: lib/query_ruby.yml
+      post_install_script:
+        path: lib/post_install_ruby.sh
+    - url: ${SOFTWARE_INSTALLER_URL}/other.deb
+      self_service: true
\ No newline at end of file
diff --git a/cmd/fleetctl/testdata/gitops/team_config_no_paths.yml b/cmd/fleetctl/testdata/gitops/team_config_no_paths.yml
index ee81d27fc4aa..785ba5d21564 100644
--- a/cmd/fleetctl/testdata/gitops/team_config_no_paths.yml
+++ b/cmd/fleetctl/testdata/gitops/team_config_no_paths.yml
@@ -116,12 +116,13 @@ policies:
     resolution: There is no resolution for this policy.
     query: SELECT 1 FROM osquery_info WHERE start_time < 0;
 software:
-  - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
-    install_script:
-      path: lib/install_ruby.sh
-    pre_install_query:
-      path: lib/query_ruby.yml
-    post_install_script:
-      path: lib/post_install_ruby.sh
-  - url: ${SOFTWARE_INSTALLER_URL}/other.deb
-    self_service: true
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/install_ruby.sh
+      pre_install_query:
+        path: lib/query_ruby.yml
+      post_install_script:
+        path: lib/post_install_ruby.sh
+    - url: ${SOFTWARE_INSTALLER_URL}/other.deb
+      self_service: true
diff --git a/cmd/fleetctl/testdata/gitops/team_software_installer_install_not_found.yml b/cmd/fleetctl/testdata/gitops/team_software_installer_install_not_found.yml
index c3837b3a0e5c..8c25d098a142 100644
--- a/cmd/fleetctl/testdata/gitops/team_software_installer_install_not_found.yml
+++ b/cmd/fleetctl/testdata/gitops/team_software_installer_install_not_found.yml
@@ -13,6 +13,7 @@ controls:
 policies:
 queries:
 software:
-  - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
-    install_script:
-      path: lib/notfound.sh
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/notfound.sh
diff --git a/cmd/fleetctl/testdata/gitops/team_software_installer_invalid_self_service_value.yml b/cmd/fleetctl/testdata/gitops/team_software_installer_invalid_self_service_value.yml
index b27a98270316..fe50a971d0f8 100644
--- a/cmd/fleetctl/testdata/gitops/team_software_installer_invalid_self_service_value.yml
+++ b/cmd/fleetctl/testdata/gitops/team_software_installer_invalid_self_service_value.yml
@@ -13,5 +13,6 @@ controls:
 policies:
 queries:
 software:
-  - url: ${SOFTWARE_INSTALLER_URL}/invalidtype.txt
-    self_service: "not a boolean"
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/invalidtype.txt
+      self_service: "not a boolean"
diff --git a/cmd/fleetctl/testdata/gitops/team_software_installer_no_url.yml b/cmd/fleetctl/testdata/gitops/team_software_installer_no_url.yml
index 43bfa4babf31..dfdce818797b 100644
--- a/cmd/fleetctl/testdata/gitops/team_software_installer_no_url.yml
+++ b/cmd/fleetctl/testdata/gitops/team_software_installer_no_url.yml
@@ -13,9 +13,10 @@ controls:
 policies:
 queries:
 software:
-  - install_script:
-      path: lib/install_ruby.sh
-    pre_install_query:
-      path: lib/query_ruby.yml
-    post_install_script:
-      path: lib/post_install_ruby.sh
+  packages:
+    - install_script:
+        path: lib/install_ruby.sh
+      pre_install_query:
+        path: lib/query_ruby.yml
+      post_install_script:
+        path: lib/post_install_ruby.sh
diff --git a/cmd/fleetctl/testdata/gitops/team_software_installer_not_found.yml b/cmd/fleetctl/testdata/gitops/team_software_installer_not_found.yml
index ca657a5736f9..ff30037bd532 100644
--- a/cmd/fleetctl/testdata/gitops/team_software_installer_not_found.yml
+++ b/cmd/fleetctl/testdata/gitops/team_software_installer_not_found.yml
@@ -13,4 +13,5 @@ controls:
 policies:
 queries:
 software:
-  - url: ${SOFTWARE_INSTALLER_URL}/notfound.deb
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/notfound.deb
diff --git a/cmd/fleetctl/testdata/gitops/team_software_installer_post_install_not_found.yml b/cmd/fleetctl/testdata/gitops/team_software_installer_post_install_not_found.yml
index 4cc9fbcef78c..cdd20768bf17 100644
--- a/cmd/fleetctl/testdata/gitops/team_software_installer_post_install_not_found.yml
+++ b/cmd/fleetctl/testdata/gitops/team_software_installer_post_install_not_found.yml
@@ -13,8 +13,9 @@ controls:
 policies:
 queries:
 software:
-  - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
-    install_script:
-      path: lib/install_ruby.sh
-    post_install_script:
-      path: lib/notfound.sh
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/install_ruby.sh
+      post_install_script:
+        path: lib/notfound.sh
diff --git a/cmd/fleetctl/testdata/gitops/team_software_installer_pre_condition_multiple_queries.yml b/cmd/fleetctl/testdata/gitops/team_software_installer_pre_condition_multiple_queries.yml
index 4b26e63e4eff..a9e96544a22b 100644
--- a/cmd/fleetctl/testdata/gitops/team_software_installer_pre_condition_multiple_queries.yml
+++ b/cmd/fleetctl/testdata/gitops/team_software_installer_pre_condition_multiple_queries.yml
@@ -13,10 +13,11 @@ controls:
 policies:
 queries:
 software:
-  - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
-    install_script:
-      path: lib/install_ruby.sh
-    pre_install_query:
-      path: lib/query_multiple.yml
-    post_install_script:
-      path: lib/post_install_ruby.sh
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/install_ruby.sh
+      pre_install_query:
+        path: lib/query_multiple.yml
+      post_install_script:
+        path: lib/post_install_ruby.sh
diff --git a/cmd/fleetctl/testdata/gitops/team_software_installer_pre_condition_multiple_queries_apply.yml b/cmd/fleetctl/testdata/gitops/team_software_installer_pre_condition_multiple_queries_apply.yml
new file mode 100644
index 000000000000..7c88f9963deb
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/team_software_installer_pre_condition_multiple_queries_apply.yml
@@ -0,0 +1,23 @@
+name: "${TEST_TEAM_NAME}"
+team_settings:
+  secrets:
+    - secret: "ABC"
+  features:
+    enable_host_users: true
+    enable_software_inventory: true
+  host_expiry_settings:
+    host_expiry_enabled: true
+    host_expiry_window: 30
+agent_options:
+controls:
+policies:
+queries:
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/install_ruby.sh
+      pre_install_query:
+        path: lib/query_multiple_apply.yml
+      post_install_script:
+        path: lib/post_install_ruby.sh
diff --git a/cmd/fleetctl/testdata/gitops/team_software_installer_pre_condition_not_found.yml b/cmd/fleetctl/testdata/gitops/team_software_installer_pre_condition_not_found.yml
index 681590d04d19..162a9aecb998 100644
--- a/cmd/fleetctl/testdata/gitops/team_software_installer_pre_condition_not_found.yml
+++ b/cmd/fleetctl/testdata/gitops/team_software_installer_pre_condition_not_found.yml
@@ -13,8 +13,9 @@ controls:
 policies:
 queries:
 software:
-  - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
-    install_script:
-      path: lib/install_ruby.sh
-    pre_install_query:
-      path: lib/notfound.yml
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/install_ruby.sh
+      pre_install_query:
+        path: lib/notfound.yml
diff --git a/cmd/fleetctl/testdata/gitops/team_software_installer_too_large.yml b/cmd/fleetctl/testdata/gitops/team_software_installer_too_large.yml
index 15d16e9e9a9e..6592a5521247 100644
--- a/cmd/fleetctl/testdata/gitops/team_software_installer_too_large.yml
+++ b/cmd/fleetctl/testdata/gitops/team_software_installer_too_large.yml
@@ -13,4 +13,5 @@ controls:
 policies:
 queries:
 software:
-  - url: ${SOFTWARE_INSTALLER_URL}/toolarge.deb
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/toolarge.deb
diff --git a/cmd/fleetctl/testdata/gitops/team_software_installer_unsupported.yml b/cmd/fleetctl/testdata/gitops/team_software_installer_unsupported.yml
index 3f58009a03ae..b722970cf8be 100644
--- a/cmd/fleetctl/testdata/gitops/team_software_installer_unsupported.yml
+++ b/cmd/fleetctl/testdata/gitops/team_software_installer_unsupported.yml
@@ -13,4 +13,5 @@ controls:
 policies:
 queries:
 software:
-  - url: ${SOFTWARE_INSTALLER_URL}/invalidtype.txt
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/invalidtype.txt
diff --git a/cmd/fleetctl/testdata/gitops/team_software_installer_valid.yml b/cmd/fleetctl/testdata/gitops/team_software_installer_valid.yml
index ceeb1a74151a..e8941122495f 100644
--- a/cmd/fleetctl/testdata/gitops/team_software_installer_valid.yml
+++ b/cmd/fleetctl/testdata/gitops/team_software_installer_valid.yml
@@ -13,12 +13,13 @@ controls:
 policies:
 queries:
 software:
-  - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
-    install_script:
-      path: lib/install_ruby.sh
-    pre_install_query:
-      path: lib/query_ruby.yml
-    post_install_script:
-      path: lib/post_install_ruby.sh
-  - url: ${SOFTWARE_INSTALLER_URL}/other.deb
-    self_service: true
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/install_ruby.sh
+      pre_install_query:
+        path: lib/query_ruby.yml
+      post_install_script:
+        path: lib/post_install_ruby.sh
+    - url: ${SOFTWARE_INSTALLER_URL}/other.deb
+      self_service: true
diff --git a/cmd/fleetctl/testdata/gitops/team_software_installer_valid_apply.yml b/cmd/fleetctl/testdata/gitops/team_software_installer_valid_apply.yml
new file mode 100644
index 000000000000..9fd14c4922cd
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/team_software_installer_valid_apply.yml
@@ -0,0 +1,25 @@
+name: "${TEST_TEAM_NAME}"
+team_settings:
+  secrets:
+    - secret: "ABC"
+  features:
+    enable_host_users: true
+    enable_software_inventory: true
+  host_expiry_settings:
+    host_expiry_enabled: true
+    host_expiry_window: 30
+agent_options:
+controls:
+policies:
+queries:
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/install_ruby.sh
+      pre_install_query:
+        path: lib/query_ruby_apply.yml
+      post_install_script:
+        path: lib/post_install_ruby.sh
+    - url: ${SOFTWARE_INSTALLER_URL}/other.deb
+      self_service: true
diff --git a/cmd/fleetctl/testdata/gitops/team_software_installer_valid_env_query.yml b/cmd/fleetctl/testdata/gitops/team_software_installer_valid_env_query.yml
new file mode 100644
index 000000000000..1c60d3f46964
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/team_software_installer_valid_env_query.yml
@@ -0,0 +1,25 @@
+name: "${TEST_TEAM_NAME}"
+team_settings:
+  secrets:
+    - secret: "ABC"
+  features:
+    enable_host_users: true
+    enable_software_inventory: true
+  host_expiry_settings:
+    host_expiry_enabled: true
+    host_expiry_window: 30
+agent_options:
+controls:
+policies:
+queries:
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/install_ruby.sh
+      pre_install_query:
+        path: lib/query_ruby_env.yml
+      post_install_script:
+        path: lib/post_install_ruby.sh
+    - url: ${SOFTWARE_INSTALLER_URL}/other.deb
+      self_service: true
diff --git a/it-and-security/teams/virtual-machines.yml b/cmd/fleetctl/testdata/gitops/team_vpp_empty_adamid.yml
similarity index 50%
rename from it-and-security/teams/virtual-machines.yml
rename to cmd/fleetctl/testdata/gitops/team_vpp_empty_adamid.yml
index cef82d618e32..675618c60907 100644
--- a/it-and-security/teams/virtual-machines.yml
+++ b/cmd/fleetctl/testdata/gitops/team_vpp_empty_adamid.yml
@@ -1,15 +1,17 @@
-name: "Virtual machines"
+name: "${TEST_TEAM_NAME}"
 team_settings:
+  secrets:
+    - secret: "ABC"
   features:
     enable_host_users: true
     enable_software_inventory: true
   host_expiry_settings:
-    host_expiry_enabled: false
-    host_expiry_window: 0
-  secrets:
-    - secret: $DOGFOOD_VIRTUAL_MACHINES_ENROLL_SECRET
+    host_expiry_enabled: true
+    host_expiry_window: 30
 agent_options:
-  path: ../lib/agent-options.yml
 controls:
 policies:
 queries:
+software:
+  app_store_apps:
+    - app_store_id:
diff --git a/cmd/fleetctl/testdata/gitops/team_vpp_incorrect_type.yml b/cmd/fleetctl/testdata/gitops/team_vpp_incorrect_type.yml
new file mode 100644
index 000000000000..74e7b178063a
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/team_vpp_incorrect_type.yml
@@ -0,0 +1,17 @@
+name: "${TEST_TEAM_NAME}"
+team_settings:
+  secrets:
+    - secret: "ABC"
+  features:
+    enable_host_users: true
+    enable_software_inventory: true
+  host_expiry_settings:
+    host_expiry_enabled: true
+    host_expiry_window: 30
+agent_options:
+controls:
+policies:
+queries:
+software:
+  app_store_apps:
+    - app_store_id: 1
diff --git a/cmd/fleetctl/testdata/gitops/team_vpp_invalid_app.yml b/cmd/fleetctl/testdata/gitops/team_vpp_invalid_app.yml
new file mode 100644
index 000000000000..f0822f443b06
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/team_vpp_invalid_app.yml
@@ -0,0 +1,17 @@
+name: "${TEST_TEAM_NAME}"
+team_settings:
+  secrets:
+    - secret: "ABC"
+  features:
+    enable_host_users: true
+    enable_software_inventory: true
+  host_expiry_settings:
+    host_expiry_enabled: true
+    host_expiry_window: 30
+agent_options:
+controls:
+policies:
+queries:
+software:
+  app_store_apps:
+    - app_store_id: "999999999"
diff --git a/cmd/fleetctl/testdata/gitops/team_vpp_valid_app.yml b/cmd/fleetctl/testdata/gitops/team_vpp_valid_app.yml
new file mode 100644
index 000000000000..8d588fb12784
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/team_vpp_valid_app.yml
@@ -0,0 +1,17 @@
+name: "${TEST_TEAM_NAME}"
+team_settings:
+  secrets:
+    - secret: "ABC"
+  features:
+    enable_host_users: true
+    enable_software_inventory: true
+  host_expiry_settings:
+    host_expiry_enabled: true
+    host_expiry_window: 30
+agent_options:
+controls:
+policies:
+queries:
+software:
+  app_store_apps:
+    - app_store_id: "1"
diff --git a/cmd/fleetctl/testdata/gitops/team_vpp_valid_app_self_service.yml b/cmd/fleetctl/testdata/gitops/team_vpp_valid_app_self_service.yml
new file mode 100644
index 000000000000..a2daad396efd
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/team_vpp_valid_app_self_service.yml
@@ -0,0 +1,18 @@
+name: "${TEST_TEAM_NAME}"
+team_settings:
+  secrets:
+    - secret: "ABC"
+  features:
+    enable_host_users: true
+    enable_software_inventory: true
+  host_expiry_settings:
+    host_expiry_enabled: true
+    host_expiry_window: 30
+agent_options:
+controls:
+policies:
+queries:
+software:
+  app_store_apps:
+    - app_store_id: "1"
+      self_service: true
diff --git a/cmd/fleetctl/testdata/gitops/team_vpp_valid_empty.yml b/cmd/fleetctl/testdata/gitops/team_vpp_valid_empty.yml
new file mode 100644
index 000000000000..1c98065d599e
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/team_vpp_valid_empty.yml
@@ -0,0 +1,16 @@
+name: "${TEST_TEAM_NAME}"
+team_settings:
+  secrets:
+    - secret: "ABC"
+  features:
+    enable_host_users: true
+    enable_software_inventory: true
+  host_expiry_settings:
+    host_expiry_enabled: true
+    host_expiry_window: 30
+agent_options:
+controls:
+policies:
+queries:
+software:
+  app_store_apps:
diff --git a/cmd/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml b/cmd/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml
index 67bb96e8c339..02adaad3acfc 100644
--- a/cmd/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml
+++ b/cmd/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml
@@ -18,7 +18,8 @@ spec:
     jira: null
     zendesk: null
   mdm:
-    apple_bm_default_team: ""
+    apple_business_manager:
+    volume_purchasing_program:
     apple_bm_enabled_and_configured: false
     apple_bm_terms_expired: false
     enabled_and_configured: true
@@ -40,6 +41,12 @@ spec:
     macos_updates:
       deadline: null
       minimum_version: null
+    ios_updates:
+      deadline: null
+      minimum_version: null
+    ipados_updates:
+      deadline: null
+      minimum_version: null
     windows_updates:
       deadline_days: null
       grace_period_days: null
diff --git a/cmd/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml b/cmd/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml
index d73894e4a1b5..2dd2f93adf1f 100644
--- a/cmd/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml
+++ b/cmd/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml
@@ -18,7 +18,8 @@ spec:
     jira: null
     zendesk: null
   mdm:
-    apple_bm_default_team: ""
+    apple_business_manager:
+    volume_purchasing_program:
     apple_bm_enabled_and_configured: false
     apple_bm_terms_expired: false
     enabled_and_configured: true
@@ -40,6 +41,12 @@ spec:
     macos_updates:
       deadline: null
       minimum_version: null
+    ios_updates:
+      deadline: null
+      minimum_version: null
+    ipados_updates:
+      deadline: null
+      minimum_version: null
     windows_updates:
       deadline_days: null
       grace_period_days: null
diff --git a/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.yml b/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.yml
index b5a4c03e5cb9..f0aa275b56b3 100644
--- a/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.yml
+++ b/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.yml
@@ -25,12 +25,17 @@ spec:
       macos_updates:
         deadline: null
         minimum_version: null
+      ios_updates:
+        deadline: null
+        minimum_version: null
+      ipados_updates:
+        deadline: null
+        minimum_version: null
       windows_updates:
         deadline_days: null
         grace_period_days: null
     scripts: null
     secrets: null
-    software: null
     webhook_settings:
       host_status_webhook: null
     name: tm1
@@ -60,12 +65,17 @@ spec:
       macos_updates:
         deadline: null
         minimum_version: null
+      ios_updates:
+        deadline: null
+        minimum_version: null
+      ipados_updates:
+        deadline: null
+        minimum_version: null
       windows_updates:
         deadline_days: null
         grace_period_days: null
     scripts: null
     secrets: null
-    software: null
     webhook_settings:
       host_status_webhook: null
     name: tm2
diff --git a/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Set.yml b/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Set.yml
index a0d15fddd7a7..1d2b07674017 100644
--- a/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Set.yml
+++ b/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Set.yml
@@ -25,12 +25,17 @@ spec:
       macos_updates:
         deadline: null
         minimum_version: null
+      ios_updates:
+        deadline: null
+        minimum_version: null
+      ipados_updates:
+        deadline: null
+        minimum_version: null
       windows_updates:
         deadline_days: null
         grace_period_days: null
     scripts: null
     secrets: null
-    software: null
     webhook_settings:
       host_status_webhook: null
     name: tm1
@@ -60,12 +65,17 @@ spec:
       macos_updates:
         deadline: null
         minimum_version: null
+      ios_updates:
+        deadline: null
+        minimum_version: null
+      ipados_updates:
+        deadline: null
+        minimum_version: null
       windows_updates:
         deadline_days: null
         grace_period_days: null
     scripts: null
     secrets: null
-    software: null
     webhook_settings:
       host_status_webhook: null
     name: tm2
diff --git a/cmd/fleetctl/testdata/macosSetupExpectedTeam1Empty.yml b/cmd/fleetctl/testdata/macosSetupExpectedTeam1Empty.yml
index 8a6762468c41..885d25482758 100644
--- a/cmd/fleetctl/testdata/macosSetupExpectedTeam1Empty.yml
+++ b/cmd/fleetctl/testdata/macosSetupExpectedTeam1Empty.yml
@@ -23,6 +23,12 @@ spec:
       macos_updates:
         deadline: null
         minimum_version: null
+      ios_updates:
+        deadline: null
+        minimum_version: null
+      ipados_updates:
+        deadline: null
+        minimum_version: null
       windows_updates:
         deadline_days: null
         grace_period_days: null
@@ -30,8 +36,6 @@ spec:
         custom_settings: null
     scripts: null
     secrets: null
-    software: null
     webhook_settings:
       host_status_webhook: null
     name: tm1
-
diff --git a/cmd/fleetctl/testdata/macosSetupExpectedTeam1Set.yml b/cmd/fleetctl/testdata/macosSetupExpectedTeam1Set.yml
index 2aac4b1481d6..76c45b10b2f2 100644
--- a/cmd/fleetctl/testdata/macosSetupExpectedTeam1Set.yml
+++ b/cmd/fleetctl/testdata/macosSetupExpectedTeam1Set.yml
@@ -24,12 +24,17 @@ spec:
       macos_updates:
         deadline: null
         minimum_version: null
+      ios_updates:
+        deadline: null
+        minimum_version: null
+      ipados_updates:
+        deadline: null
+        minimum_version: null
       windows_updates:
         deadline_days: null
         grace_period_days: null
     scripts: null
     secrets: null
-    software: null
     webhook_settings:
       host_status_webhook: null
     name: tm1
diff --git a/cmd/fleetctl/testing_utils.go b/cmd/fleetctl/testing_utils.go
index 7a278ebc3c6b..918a12b94e27 100644
--- a/cmd/fleetctl/testing_utils.go
+++ b/cmd/fleetctl/testing_utils.go
@@ -127,24 +127,24 @@ func runServerWithMockedDS(t *testing.T, opts ...*service.TestServerOpts) (*http
 	require.NoError(t, err)
 	ds.GetAllMDMConfigAssetsHashesFunc = func(ctx context.Context, assetNames []fleet.MDMAssetName) (map[fleet.MDMAssetName]string, error) {
 		return map[fleet.MDMAssetName]string{
-			fleet.MDMAssetABMCert:  "abmcert",
-			fleet.MDMAssetABMKey:   "abmkey",
-			fleet.MDMAssetABMToken: "abmtoken",
-			fleet.MDMAssetAPNSCert: "apnscert",
-			fleet.MDMAssetAPNSKey:  "apnskey",
-			fleet.MDMAssetCACert:   "scepcert",
-			fleet.MDMAssetCAKey:    "scepkey",
+			fleet.MDMAssetABMCert:            "abmcert",
+			fleet.MDMAssetABMKey:             "abmkey",
+			fleet.MDMAssetABMTokenDeprecated: "abmtoken",
+			fleet.MDMAssetAPNSCert:           "apnscert",
+			fleet.MDMAssetAPNSKey:            "apnskey",
+			fleet.MDMAssetCACert:             "scepcert",
+			fleet.MDMAssetCAKey:              "scepkey",
 		}, nil
 	}
 	ds.GetAllMDMConfigAssetsByNameFunc = func(ctx context.Context, assetNames []fleet.MDMAssetName) (map[fleet.MDMAssetName]fleet.MDMConfigAsset, error) {
 		return map[fleet.MDMAssetName]fleet.MDMConfigAsset{
-			fleet.MDMAssetABMCert:  {Name: fleet.MDMAssetABMCert, Value: certPEM},
-			fleet.MDMAssetABMKey:   {Name: fleet.MDMAssetABMKey, Value: keyPEM},
-			fleet.MDMAssetABMToken: {Name: fleet.MDMAssetABMToken, Value: tokenBytes},
-			fleet.MDMAssetAPNSCert: {Name: fleet.MDMAssetAPNSCert, Value: apnsCert},
-			fleet.MDMAssetAPNSKey:  {Name: fleet.MDMAssetAPNSKey, Value: apnsKey},
-			fleet.MDMAssetCACert:   {Name: fleet.MDMAssetCACert, Value: certPEM},
-			fleet.MDMAssetCAKey:    {Name: fleet.MDMAssetCAKey, Value: keyPEM},
+			fleet.MDMAssetABMCert:            {Name: fleet.MDMAssetABMCert, Value: certPEM},
+			fleet.MDMAssetABMKey:             {Name: fleet.MDMAssetABMKey, Value: keyPEM},
+			fleet.MDMAssetABMTokenDeprecated: {Name: fleet.MDMAssetABMTokenDeprecated, Value: tokenBytes},
+			fleet.MDMAssetAPNSCert:           {Name: fleet.MDMAssetAPNSCert, Value: apnsCert},
+			fleet.MDMAssetAPNSKey:            {Name: fleet.MDMAssetAPNSKey, Value: apnsKey},
+			fleet.MDMAssetCACert:             {Name: fleet.MDMAssetCACert, Value: certPEM},
+			fleet.MDMAssetCAKey:              {Name: fleet.MDMAssetCAKey, Value: keyPEM},
 		}, nil
 	}
 
diff --git a/cmd/fleetctl/vulnerability_data_stream_test.go b/cmd/fleetctl/vulnerability_data_stream_test.go
index 0e61949eea11..d1316a3251d1 100644
--- a/cmd/fleetctl/vulnerability_data_stream_test.go
+++ b/cmd/fleetctl/vulnerability_data_stream_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestVulnerabilityDataStream(t *testing.T) {
+func TestIntegrationsVulnerabilityDataStream(t *testing.T) {
 	nettest.Run(t)
 
 	runAppCheckErr(t, []string{"vulnerability-data-stream"}, "No directory provided")
diff --git a/cmd/osquery-perf/README.md b/cmd/osquery-perf/README.md
index 5ec687f8fd5e..eb179dd13c74 100644
--- a/cmd/osquery-perf/README.md
+++ b/cmd/osquery-perf/README.md
@@ -95,3 +95,27 @@ Run the following command in the shell before running the Fleet server _and_ bef
 ``` sh
 ulimit -n 64000
 ```
+
+## Running with MDM
+
+Set up MDM on your server. To extract the SCEP challenge, you can use the [MDM asset extractor](https://github.com/fleetdm/fleet/tree/main/tools/mdm/assets).
+
+For your server, disable Apple push notifications since we will be using devices with fake UUIDs:
+
+```
+export FLEET_DEV_MDM_APPLE_DISABLE_PUSH=1
+```
+
+Example of running the agent with MDM. Note that `enroll_secret` is not needed for iPhone/iPad devices:
+
+```
+go run agent.go --os_templates ipad_13.18,iphone_14.6 --host_count 10 --mdm_scep_challenge 0d53306e-6d7a-9d14-a372-f9e53f9d62db
+```
+
+## Installing software
+
+The agent can install software for "macos", "ubuntu", and "windows" OSs when running with orbit agent. The following options control the installation behavior:
+
+- `--software_installer_pre_install_fail_prob`: default 0.05, `select 1` always passes and `select 0` always fails
+- `--software_installer_install_fail_prob`: default 0.05, `exit 0` always passes and `exit 1` always fails
+- `--software_installer_post_install_fail_prob`: default 0.05, `exit 0` always passes and `exit 1` always fails
diff --git a/cmd/osquery-perf/agent.go b/cmd/osquery-perf/agent.go
index 46f6e691832f..10e8ee21b0a8 100644
--- a/cmd/osquery-perf/agent.go
+++ b/cmd/osquery-perf/agent.go
@@ -25,6 +25,8 @@ import (
 	"text/template"
 	"time"
 
+	"github.com/fleetdm/fleet/v4/cmd/osquery-perf/installer_cache"
+	"github.com/fleetdm/fleet/v4/pkg/file"
 	"github.com/fleetdm/fleet/v4/pkg/mdm/mdmtest"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
@@ -54,6 +56,8 @@ var (
 	vsCodeExtensionsVulnerableSoftware []fleet.Software
 	windowsSoftware                    []map[string]string
 	ubuntuSoftware                     []map[string]string
+
+	installerMetadataCache installer_cache.Metadata
 )
 
 func loadMacOSVulnerableSoftware() {
@@ -424,6 +428,27 @@ func (n *nodeKeyManager) Add(nodekey string) {
 	}
 }
 
+type mdmAgent struct {
+	agentIndex         int
+	MDMCheckInInterval time.Duration
+	model              string
+	serverAddress      string
+	softwareCount      softwareEntityCount
+	stats              *Stats
+	strings            map[string]string
+}
+
+// stats, model, *serverURL, *mdmSCEPChallenge, *mdmCheckInInterval
+
+func (a *mdmAgent) CachedString(key string) string {
+	if val, ok := a.strings[key]; ok {
+		return val
+	}
+	val := randomString(12)
+	a.strings[key] = val
+	return val
+}
+
 type agent struct {
 	agentIndex                    int
 	softwareCount                 softwareEntityCount
@@ -469,6 +494,11 @@ type agent struct {
 	softwareQueryFailureProb         float64
 	softwareVSCodeExtensionsFailProb float64
 
+	softwareInstaller softwareInstaller
+
+	// Software installed on the host via Fleet. Key is the software name + version + bundle identifier.
+	installedSoftware sync.Map
+
 	//
 	// The following are exported to be used by the templates.
 	//
@@ -476,6 +506,7 @@ type agent struct {
 	EnrollSecret          string
 	UUID                  string
 	SerialNumber          string
+	defaultSerialProb     float64
 	ConfigInterval        time.Duration
 	LogInterval           time.Duration
 	QueryInterval         time.Duration
@@ -493,6 +524,13 @@ type agent struct {
 	bufferedResults map[resultLog]int
 }
 
+func (a *agent) GetSerialNumber() string {
+	if rand.Float64() <= a.defaultSerialProb {
+		return "-1"
+	}
+	return a.SerialNumber
+}
+
 type entityCount struct {
 	common int
 	unique int
@@ -515,6 +553,12 @@ type softwareExtraEntityCount struct {
 	uniqueSoftwareUninstallCount int
 	uniqueSoftwareUninstallProb  float64
 }
+type softwareInstaller struct {
+	preInstallFailureProb  float64
+	installFailureProb     float64
+	postInstallFailureProb float64
+	mu                     *sync.Mutex
+}
 
 func newAgent(
 	agentIndex int,
@@ -523,6 +567,7 @@ func newAgent(
 	configInterval, logInterval, queryInterval, mdmCheckInInterval time.Duration,
 	softwareQueryFailureProb float64,
 	softwareVSCodeExtensionsQueryFailureProb float64,
+	softwareInstaller softwareInstaller,
 	softwareCount softwareEntityCount,
 	softwareVSCodeExtensionsCount softwareExtraEntityCount,
 	userCount entityCount,
@@ -530,6 +575,7 @@ func newAgent(
 	orbitProb float64,
 	munkiIssueProb float64, munkiIssueCount int,
 	emptySerialProb float64,
+	defaultSerialProb float64,
 	mdmProb float64,
 	mdmSCEPChallenge string,
 	liveQueryFailProb float64,
@@ -608,9 +654,11 @@ func newAgent(
 		MDMCheckInInterval:            mdmCheckInInterval,
 		UUID:                          hostUUID,
 		SerialNumber:                  serialNumber,
+		defaultSerialProb:             defaultSerialProb,
 
 		softwareQueryFailureProb:         softwareQueryFailureProb,
 		softwareVSCodeExtensionsFailProb: softwareVSCodeExtensionsQueryFailureProb,
+		softwareInstaller:                softwareInstaller,
 
 		macMDMClient: macMDMClient,
 		winMDMClient: winMDMClient,
@@ -936,6 +984,11 @@ func (a *agent) runOrbitLoop() {
 				// that will simulate executing them.
 				go a.execScripts(cfg.Notifications.PendingScriptExecutionIDs, orbitClient)
 			}
+			if len(cfg.Notifications.PendingSoftwareInstallerIDs) > 0 {
+				// there are pending software installations on this host, start a
+				// goroutine that will download the software
+				go a.installSoftware(cfg.Notifications.PendingSoftwareInstallerIDs, orbitClient)
+			}
 			if cfg.Notifications.NeedsProgrammaticWindowsMDMEnrollment &&
 				!a.mdmEnrolled() &&
 				a.winMDMClient != nil &&
@@ -1211,6 +1264,130 @@ func (a *agent) execScripts(execIDs []string, orbitClient *service.OrbitClient)
 	}
 }
 
+func (a *agent) installSoftware(installerIDs []string, orbitClient *service.OrbitClient) {
+	// Only allow one software install to happen at a time.
+	if a.softwareInstaller.mu.TryLock() {
+		defer a.softwareInstaller.mu.Unlock()
+		for _, installerID := range installerIDs {
+			a.installSoftwareItem(installerID, orbitClient)
+		}
+	}
+}
+
+func (a *agent) installSoftwareItem(installerID string, orbitClient *service.OrbitClient) {
+	payload := &fleet.HostSoftwareInstallResultPayload{}
+	payload.InstallUUID = installerID
+	installer, err := orbitClient.GetInstallerDetails(installerID)
+	if err != nil {
+		log.Println("get installer details:", err)
+		return
+	}
+	failed := false
+	if installer.PreInstallCondition != "" {
+		time.Sleep(time.Duration(rand.Intn(1000)) * time.Millisecond)
+		if installer.PreInstallCondition == "select 1" {
+			// Always pass
+			payload.PreInstallConditionOutput = ptr.String("1")
+		} else if installer.PreInstallCondition == "select 0" ||
+			a.softwareInstaller.preInstallFailureProb > 0.0 && rand.Float64() <= a.softwareInstaller.preInstallFailureProb {
+			// Fail
+			payload.PreInstallConditionOutput = ptr.String("")
+			failed = true
+		} else {
+			payload.PreInstallConditionOutput = ptr.String("1")
+		}
+	}
+
+	var meta *file.InstallerMetadata
+	if !failed {
+		var cacheMiss bool
+		// Download the file if needed to get its metadata
+		meta, cacheMiss, err = installerMetadataCache.Get(installer.InstallerID, orbitClient)
+		if err != nil {
+			return
+		}
+
+		if !cacheMiss {
+			// If we didn't download and analyze the file, we do a download and don't save the result
+			err = orbitClient.DownloadAndDiscardSoftwareInstaller(installer.InstallerID)
+			if err != nil {
+				log.Println("download and discard software installer:", err)
+				return
+			}
+		}
+
+		time.Sleep(time.Duration(rand.Intn(30)) * time.Second)
+		if installer.InstallScript == "exit 0" {
+			// Always pass
+			payload.InstallScriptExitCode = ptr.Int(0)
+			payload.InstallScriptOutput = ptr.String("Installed on osquery-perf (always pass)")
+		} else if installer.InstallScript == "exit 1" {
+			payload.InstallScriptExitCode = ptr.Int(1)
+			payload.InstallScriptOutput = ptr.String("Installed on osquery-perf (always fail)")
+			failed = true
+		} else if a.softwareInstaller.installFailureProb > 0.0 && rand.Float64() <= a.softwareInstaller.installFailureProb {
+			payload.InstallScriptExitCode = ptr.Int(1)
+			payload.InstallScriptOutput = ptr.String("Installed on osquery-perf (fail)")
+			failed = true
+		} else {
+			payload.InstallScriptExitCode = ptr.Int(0)
+			payload.InstallScriptOutput = ptr.String("Installed on osquery-perf (pass)")
+		}
+	}
+	if !failed {
+		if meta.Name == "" {
+			log.Printf("WARNING: installer metadata is missing a name for installer:%d\n", installer.InstallerID)
+		} else {
+			key := meta.Name + "+" + meta.Version + "+" + meta.BundleIdentifier
+			if _, ok := a.installedSoftware.Load(key); !ok {
+				source := ""
+				switch a.os {
+				case "macos":
+					source = "apps"
+				case "windows":
+					source = "programs"
+				case "ubuntu":
+					source = "deb_packages"
+				default:
+					log.Printf("unknown OS to software installer: %s", a.os)
+					return
+				}
+				a.installedSoftware.Store(key, map[string]string{
+					"name":              meta.Name,
+					"version":           meta.Version,
+					"bundle_identifier": meta.BundleIdentifier,
+					"source":            source,
+					"installed_path":    os.DevNull,
+				})
+			}
+		}
+
+		if installer.PostInstallScript != "" {
+			time.Sleep(time.Duration(rand.Intn(1000)) * time.Millisecond)
+			if installer.PostInstallScript == "exit 0" {
+				// Always pass
+				payload.PostInstallScriptExitCode = ptr.Int(0)
+				payload.PostInstallScriptOutput = ptr.String("PostInstall on osquery-perf (always pass)")
+			} else if installer.PostInstallScript == "exit 1" {
+				payload.PostInstallScriptExitCode = ptr.Int(1)
+				payload.PostInstallScriptOutput = ptr.String("PostInstall on osquery-perf (always fail)")
+			} else if a.softwareInstaller.postInstallFailureProb > 0.0 && rand.Float64() <= a.softwareInstaller.postInstallFailureProb {
+				payload.PostInstallScriptExitCode = ptr.Int(1)
+				payload.PostInstallScriptOutput = ptr.String("PostInstall on osquery-perf (fail)")
+			} else {
+				payload.PostInstallScriptExitCode = ptr.Int(0)
+				payload.PostInstallScriptOutput = ptr.String("PostInstall on osquery-perf (pass)")
+			}
+		}
+	}
+
+	err = orbitClient.SaveInstallerResult(payload)
+	if err != nil {
+		log.Println("save installer result:", err)
+		return
+	}
+}
+
 func (a *agent) waitingDo(fn func() *http.Request) *http.Response {
 	response, err := http.DefaultClient.Do(fn())
 	for err != nil || response.StatusCode != http.StatusOK {
@@ -1494,12 +1671,63 @@ func (a *agent) softwareMacOS() []map[string]string {
 	}
 	software := append(commonSoftware, uniqueSoftware...)
 	software = append(software, randomVulnerableSoftware...)
+	a.installedSoftware.Range(func(key, value interface{}) bool {
+		software = append(software, value.(map[string]string))
+		return true
+	})
 	rand.Shuffle(len(software), func(i, j int) {
 		software[i], software[j] = software[j], software[i]
 	})
 	return software
 }
 
+func (a *mdmAgent) softwareIOSandIPadOS(source string) []fleet.Software {
+	commonSoftware := make([]map[string]string, a.softwareCount.common)
+	for i := 0; i < len(commonSoftware); i++ {
+		commonSoftware[i] = map[string]string{
+			"name":              fmt.Sprintf("Common_%d", i),
+			"version":           "0.0.1",
+			"bundle_identifier": fmt.Sprintf("com.fleetdm.osquery-perf.common_%d", i),
+			"source":            source,
+		}
+	}
+	if a.softwareCount.commonSoftwareUninstallProb > 0.0 && rand.Float64() <= a.softwareCount.commonSoftwareUninstallProb {
+		rand.Shuffle(len(commonSoftware), func(i, j int) {
+			commonSoftware[i], commonSoftware[j] = commonSoftware[j], commonSoftware[i]
+		})
+		commonSoftware = commonSoftware[:a.softwareCount.common-a.softwareCount.commonSoftwareUninstallCount]
+	}
+	uniqueSoftware := make([]map[string]string, a.softwareCount.unique)
+	for i := 0; i < len(uniqueSoftware); i++ {
+		uniqueSoftware[i] = map[string]string{
+			"name":              fmt.Sprintf("Unique_%s_%d", a.CachedString("hostname"), i),
+			"version":           "1.1.1",
+			"bundle_identifier": fmt.Sprintf("com.fleetdm.osquery-perf.unique_%s_%d", a.CachedString("hostname"), i),
+			"source":            source,
+		}
+	}
+	if a.softwareCount.uniqueSoftwareUninstallProb > 0.0 && rand.Float64() <= a.softwareCount.uniqueSoftwareUninstallProb {
+		rand.Shuffle(len(uniqueSoftware), func(i, j int) {
+			uniqueSoftware[i], uniqueSoftware[j] = uniqueSoftware[j], uniqueSoftware[i]
+		})
+		uniqueSoftware = uniqueSoftware[:a.softwareCount.unique-a.softwareCount.uniqueSoftwareUninstallCount]
+	}
+	software := append(commonSoftware, uniqueSoftware...)
+	rand.Shuffle(len(software), func(i, j int) {
+		software[i], software[j] = software[j], software[i]
+	})
+	fleetSoftware := make([]fleet.Software, len(software))
+	for i, s := range software {
+		fleetSoftware[i] = fleet.Software{
+			Name:             s["name"],
+			Version:          s["version"],
+			BundleIdentifier: s["bundle_identifier"],
+			Source:           s["source"],
+		}
+	}
+	return fleetSoftware
+}
+
 func (a *agent) softwareVSCodeExtensions() []map[string]string {
 	commonVSCodeExtensionsSoftware := make([]map[string]string, a.softwareVSCodeExtensionsCount.common)
 	for i := 0; i < len(commonVSCodeExtensionsSoftware); i++ {
@@ -1945,6 +2173,10 @@ func (a *agent) processQuery(name, query string) (
 		}
 		if ss == fleet.StatusOK {
 			results = windowsSoftware
+			a.installedSoftware.Range(func(key, value interface{}) bool {
+				results = append(results, value.(map[string]string))
+				return true
+			})
 		}
 		return true, results, &ss, nil, nil
 	case name == hostDetailQueryPrefix+"software_linux":
@@ -1956,6 +2188,10 @@ func (a *agent) processQuery(name, query string) (
 			switch a.os {
 			case "ubuntu":
 				results = ubuntuSoftware
+				a.installedSoftware.Range(func(key, value interface{}) bool {
+					results = append(results, value.(map[string]string))
+					return true
+				})
 			}
 		}
 		return true, results, &ss, nil, nil
@@ -2150,48 +2386,57 @@ func (a *agent) submitLogs(results []resultLog) error {
 	return nil
 }
 
-func runAppleIDeviceMDMLoop(i int, stats *Stats, model string, serverURL string, mdmSCEPChallenge string, mdmCheckInInterval time.Duration) {
+func (a *mdmAgent) runAppleIDeviceMDMLoop(mdmSCEPChallenge string) {
 	udid := mdmtest.RandUDID()
 
 	mdmClient := mdmtest.NewTestMDMClientAppleDirect(mdmtest.AppleEnrollInfo{
 		SCEPChallenge: mdmSCEPChallenge,
-		SCEPURL:       serverURL + apple_mdm.SCEPPath,
-		MDMURL:        serverURL + apple_mdm.MDMPath,
-	}, model)
+		SCEPURL:       a.serverAddress + apple_mdm.SCEPPath,
+		MDMURL:        a.serverAddress + apple_mdm.MDMPath,
+	}, a.model)
 	mdmClient.UUID = udid
 	mdmClient.SerialNumber = mdmtest.RandSerialNumber()
-	deviceName := fmt.Sprintf("%s-%d", model, i)
-	productName := model
+	deviceName := fmt.Sprintf("%s-%d", a.model, a.agentIndex)
+	productName := a.model
+	softwareSource := "ios_apps"
+	if strings.HasPrefix(a.model, "iPad") {
+		softwareSource = "ipados_apps"
+	}
 
 	if err := mdmClient.Enroll(); err != nil {
-		log.Printf("%s MDM enroll failed: %s", model, err)
-		stats.IncrementMDMErrors()
+		log.Printf("%s MDM enroll failed: %s", a.model, err)
+		a.stats.IncrementMDMErrors()
 		return
 	}
 
-	stats.IncrementMDMEnrollments()
+	a.stats.IncrementMDMEnrollments()
 
-	mdmCheckInTicker := time.Tick(mdmCheckInInterval)
+	mdmCheckInTicker := time.Tick(a.MDMCheckInInterval)
 
 	for range mdmCheckInTicker {
 		mdmCommandPayload, err := mdmClient.Idle()
 		if err != nil {
-			log.Printf("MDM Idle request failed: %s: %s", model, err)
-			stats.IncrementMDMErrors()
+			log.Printf("MDM Idle request failed: %s: %s", a.model, err)
+			a.stats.IncrementMDMErrors()
 			continue
 		}
-		stats.IncrementMDMSessions()
+		a.stats.IncrementMDMSessions()
 
 		for mdmCommandPayload != nil {
-			stats.IncrementMDMCommandsReceived()
-			if mdmCommandPayload.Command.RequestType == "DeviceInformation" {
-				mdmCommandPayload, err = mdmClient.AcknowledgeDeviceInformation(udid, mdmCommandPayload.CommandUUID, deviceName, productName)
-			} else {
+			a.stats.IncrementMDMCommandsReceived()
+			switch mdmCommandPayload.Command.RequestType {
+			case "DeviceInformation":
+				mdmCommandPayload, err = mdmClient.AcknowledgeDeviceInformation(udid, mdmCommandPayload.CommandUUID, deviceName,
+					productName)
+			case "InstalledApplicationList":
+				software := a.softwareIOSandIPadOS(softwareSource)
+				mdmCommandPayload, err = mdmClient.AcknowledgeInstalledApplicationList(udid, mdmCommandPayload.CommandUUID, software)
+			default:
 				mdmCommandPayload, err = mdmClient.Acknowledge(mdmCommandPayload.CommandUUID)
 			}
 			if err != nil {
-				log.Printf("MDM Acknowledge request failed: %s: %s", model, err)
-				stats.IncrementMDMErrors()
+				log.Printf("MDM Acknowledge request failed: %s: %s", a.model, err)
+				a.stats.IncrementMDMErrors()
 				break
 			}
 		}
@@ -2264,7 +2509,7 @@ func main() {
 		// osquery-perf will send log requests with results only if there are scheduled queries configured AND it's their time to run.
 		logInterval         = flag.Duration("logger_tls_period", 10*time.Second, "Interval for scheduled queries log requests")
 		queryInterval       = flag.Duration("query_interval", 10*time.Second, "Interval for distributed query requests")
-		mdmCheckInInterval  = flag.Duration("mdm_check_in_interval", 10*time.Second, "Interval for performing MDM check-ins (applies to both macOS and Windows)")
+		mdmCheckInInterval  = flag.Duration("mdm_check_in_interval", 1*time.Minute, "Interval for performing MDM check-ins (applies to both macOS and Windows)")
 		onlyAlreadyEnrolled = flag.Bool("only_already_enrolled", false, "Only start agents that are already enrolled")
 		nodeKeyFile         = flag.String("node_key_file", "", "File with node keys to use")
 
@@ -2274,6 +2519,13 @@ func main() {
 		softwareQueryFailureProb                 = flag.Float64("software_query_fail_prob", 0.5, "Probability of the software query failing")
 		softwareVSCodeExtensionsQueryFailureProb = flag.Float64("software_vscode_extensions_query_fail_prob", 0.0, "Probability of the software vscode_extensions query failing")
 
+		softwareInstallerPreInstallFailureProb = flag.Float64("software_installer_pre_install_fail_prob", 0.05,
+			"Probability of the pre-install query failing")
+		softwareInstallerInstallFailureProb = flag.Float64("software_installer_install_fail_prob", 0.05,
+			"Probability of the install script failing")
+		softwareInstallerPostInstallFailureProb = flag.Float64("software_installer_post_install_fail_prob", 0.05,
+			"Probability of the post-install script failing")
+
 		commonSoftwareCount                          = flag.Int("common_software_count", 10, "Number of common installed applications reported to fleet")
 		commonVSCodeExtensionsSoftwareCount          = flag.Int("common_vscode_extensions_software_count", 5, "Number of common vscode_extensions installed applications reported to fleet")
 		commonSoftwareUninstallCount                 = flag.Int("common_software_uninstall_count", 1, "Number of common software to uninstall")
@@ -2299,8 +2551,10 @@ func main() {
 		munkiIssueCount             = flag.Int("munki_issue_count", 10, "Number of munki issues reported by hosts identified to have munki issues")
 		// E.g. when running with `-host_count=10`, you can set host count for each template the following way:
 		// `-os_templates=windows_11.tmpl:3,macos_14.1.2.tmpl:4,ubuntu_22.04.tmpl:3`
-		osTemplates     = flag.String("os_templates", "macos_14.1.2", fmt.Sprintf("Comma-separated list of host OS templates to use and optionally their host count separated by ':' (any of %v, with or without the .tmpl extension)", allowedTemplateNames))
-		emptySerialProb = flag.Float64("empty_serial_prob", 0.1, "Probability of a host having no serial number [0, 1]")
+		osTemplates       = flag.String("os_templates", "macos_14.1.2", fmt.Sprintf("Comma-separated list of host OS templates to use and optionally their host count separated by ':' (any of %v, with or without the .tmpl extension)", allowedTemplateNames))
+		emptySerialProb   = flag.Float64("empty_serial_prob", 0.1, "Probability of a host having no serial number [0, 1]")
+		defaultSerialProb = flag.Float64("default_serial_prob", 0.05,
+			"Probability of osquery returning a default (-1) serial number. See: #19789")
 
 		mdmProb          = flag.Float64("mdm_prob", 0.0, "Probability of a host enrolling via Fleet MDM (applies for macOS and Windows hosts, implies orbit enrollment on Windows) [0, 1]")
 		mdmSCEPChallenge = flag.String("mdm_scep_challenge", "", "SCEP challenge to use when running macOS MDM enroll")
@@ -2404,7 +2658,26 @@ func main() {
 			if tmpl.Name() == "ipad_13.18.tmpl" {
 				model = "iPad 13,18"
 			}
-			go runAppleIDeviceMDMLoop(i, stats, model, *serverURL, *mdmSCEPChallenge, *mdmCheckInInterval)
+			mobileDevice := mdmAgent{
+				agentIndex:         i + 1,
+				MDMCheckInInterval: *mdmCheckInInterval,
+				model:              model,
+				serverAddress:      *serverURL,
+				softwareCount: softwareEntityCount{
+					entityCount: entityCount{
+						common: *commonSoftwareCount,
+						unique: *uniqueSoftwareCount,
+					},
+					vulnerable:                   *vulnerableSoftwareCount,
+					commonSoftwareUninstallCount: *commonSoftwareUninstallCount,
+					commonSoftwareUninstallProb:  *commonSoftwareUninstallProb,
+					uniqueSoftwareUninstallCount: *uniqueSoftwareUninstallCount,
+					uniqueSoftwareUninstallProb:  *uniqueSoftwareUninstallProb,
+				},
+				stats:   stats,
+				strings: make(map[string]string),
+			}
+			go mobileDevice.runAppleIDeviceMDMLoop(*mdmSCEPChallenge)
 			time.Sleep(sleepTime)
 			continue
 		}
@@ -2419,6 +2692,12 @@ func main() {
 			*mdmCheckInInterval,
 			*softwareQueryFailureProb,
 			*softwareVSCodeExtensionsQueryFailureProb,
+			softwareInstaller{
+				preInstallFailureProb:  *softwareInstallerPreInstallFailureProb,
+				installFailureProb:     *softwareInstallerInstallFailureProb,
+				postInstallFailureProb: *softwareInstallerPostInstallFailureProb,
+				mu:                     new(sync.Mutex),
+			},
 			softwareEntityCount{
 				entityCount: entityCount{
 					common: *commonSoftwareCount,
@@ -2451,6 +2730,7 @@ func main() {
 			*munkiIssueProb,
 			*munkiIssueCount,
 			*emptySerialProb,
+			*defaultSerialProb,
 			*mdmProb,
 			*mdmSCEPChallenge,
 			*liveQueryFailProb,
diff --git a/cmd/osquery-perf/installer_cache/installer-cache.go b/cmd/osquery-perf/installer_cache/installer-cache.go
new file mode 100644
index 000000000000..57994de5f670
--- /dev/null
+++ b/cmd/osquery-perf/installer_cache/installer-cache.go
@@ -0,0 +1,66 @@
+package installer_cache
+
+import (
+	"log"
+	"os"
+	"sync"
+
+	"github.com/fleetdm/fleet/v4/pkg/file"
+	"github.com/fleetdm/fleet/v4/server/service"
+)
+
+// Metadata holds the metadata for software installers.
+// To extract the metadata, we must download the file. Once the file has been downloaded once and analyzed,
+// the other agents can use the cache to get the appropriate metadata.
+type Metadata struct {
+	mu    sync.Mutex
+	cache map[uint]*file.InstallerMetadata
+}
+
+func (c *Metadata) Get(key uint, orbitClient *service.OrbitClient) (meta *file.InstallerMetadata,
+	cacheMiss bool, err error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.cache == nil {
+		c.cache = make(map[uint]*file.InstallerMetadata, 1)
+	}
+
+	meta, ok := c.cache[key]
+	if !ok {
+		var err error
+		meta, err = populateMetadata(orbitClient, key)
+		if err != nil {
+			return nil, false, err
+		}
+		c.cache[key] = meta
+		cacheMiss = true
+	}
+	return meta, cacheMiss, nil
+}
+
+func populateMetadata(orbitClient *service.OrbitClient, installerID uint) (*file.InstallerMetadata, error) {
+	tmpDir, err := os.MkdirTemp("", "")
+	if err != nil {
+		log.Println("create temp dir:", err)
+		return nil, err
+	}
+	defer os.RemoveAll(tmpDir)
+	path, err := orbitClient.DownloadSoftwareInstaller(installerID, tmpDir)
+	if err != nil {
+		log.Println("download software installer:", err)
+		return nil, err
+	}
+	// Figure out what we're actually installing here and add it to software inventory
+	f, err := os.Open(path)
+	if err != nil {
+		log.Println("open installer:", err)
+		return nil, err
+	}
+	defer f.Close()
+	item, err := file.ExtractInstallerMetadata(f)
+	if err != nil {
+		log.Println("extract installer metadata:", err)
+		return nil, err
+	}
+	return item, nil
+}
diff --git a/cmd/osquery-perf/macos_13.6.2.tmpl b/cmd/osquery-perf/macos_13.6.2.tmpl
index 8f59d00e9e85..83ee06cc5f88 100644
--- a/cmd/osquery-perf/macos_13.6.2.tmpl
+++ b/cmd/osquery-perf/macos_13.6.2.tmpl
@@ -173,6 +173,10 @@
 {{- end }}
 {{- end }}
 
+{{ define "fleet_detail_query_mdm_config_profiles_darwin" -}}
+[]
+{{- end }}
+
 {{/* all hosts */}}
 {{ define "fleet_label_query_6" -}}
 [
diff --git a/cmd/osquery-perf/macos_14.1.2.tmpl b/cmd/osquery-perf/macos_14.1.2.tmpl
index 8aa29e1c4ac3..4c768d34c1b1 100644
--- a/cmd/osquery-perf/macos_14.1.2.tmpl
+++ b/cmd/osquery-perf/macos_14.1.2.tmpl
@@ -174,6 +174,10 @@
 {{- end }}
 {{- end }}
 
+{{ define "fleet_detail_query_mdm_config_profiles_darwin" -}}
+[]
+{{- end }}
+
 {{/* all hosts */}}
 {{ define "fleet_label_query_6" -}}
 [
diff --git a/cmd/osquery-perf/windows_11.tmpl b/cmd/osquery-perf/windows_11.tmpl
index 11c9125b68bd..fcf738cd1cc2 100644
--- a/cmd/osquery-perf/windows_11.tmpl
+++ b/cmd/osquery-perf/windows_11.tmpl
@@ -44,7 +44,7 @@
           "cpu_subtype": "-1",
           "cpu_type": "x86_64",
           "hardware_model": "Surface Laptop 2",
-          "hardware_serial": "{{ .SerialNumber }}",
+          "hardware_serial": "{{ .GetSerialNumber }}",
           "hardware_vendor": "Microsoft Corporation",
           "hardware_version": "-1",
           "hostname": "{{ .CachedString "hostname" }}",
@@ -150,7 +150,7 @@
     "cpu_subtype": "-1",
     "cpu_type": "x86_64",
     "hardware_model": "Surface Laptop 2",
-    "hardware_serial": "{{ .SerialNumber }}",
+    "hardware_serial": "{{ .GetSerialNumber }}",
     "hardware_vendor": "Microsoft Corporation",
     "hardware_version": "-1",
     "local_hostname": "{{ .CachedString "hostname" }}",
diff --git a/cmd/osquery-perf/windows_11_22H2_2861.tmpl b/cmd/osquery-perf/windows_11_22H2_2861.tmpl
index 0450623681da..b9344795f46b 100644
--- a/cmd/osquery-perf/windows_11_22H2_2861.tmpl
+++ b/cmd/osquery-perf/windows_11_22H2_2861.tmpl
@@ -44,7 +44,7 @@
           "cpu_subtype": "-1",
           "cpu_type": "x86_64",
           "hardware_model": "Surface Laptop 2",
-          "hardware_serial": "{{ .SerialNumber }}",
+          "hardware_serial": "{{ .GetSerialNumber }}",
           "hardware_vendor": "Microsoft Corporation",
           "hardware_version": "-1",
           "hostname": "{{ .CachedString "hostname" }}",
@@ -150,7 +150,7 @@
     "cpu_subtype": "-1",
     "cpu_type": "x86_64",
     "hardware_model": "Surface Laptop 2",
-    "hardware_serial": "{{ .SerialNumber }}",
+    "hardware_serial": "{{ .GetSerialNumber }}",
     "hardware_vendor": "Microsoft Corporation",
     "hardware_version": "-1",
     "local_hostname": "{{ .CachedString "hostname" }}",
diff --git a/cmd/osquery-perf/windows_11_22H2_3007.tmpl b/cmd/osquery-perf/windows_11_22H2_3007.tmpl
index 135b3dcb4004..f4ac6b1670fc 100644
--- a/cmd/osquery-perf/windows_11_22H2_3007.tmpl
+++ b/cmd/osquery-perf/windows_11_22H2_3007.tmpl
@@ -44,7 +44,7 @@
           "cpu_subtype": "-1",
           "cpu_type": "x86_64",
           "hardware_model": "Surface Laptop 2",
-          "hardware_serial": "{{ .SerialNumber }}",
+          "hardware_serial": "{{ .GetSerialNumber }}",
           "hardware_vendor": "Microsoft Corporation",
           "hardware_version": "-1",
           "hostname": "{{ .CachedString "hostname" }}",
@@ -150,7 +150,7 @@
     "cpu_subtype": "-1",
     "cpu_type": "x86_64",
     "hardware_model": "Surface Laptop 2",
-    "hardware_serial": "{{ .SerialNumber }}",
+    "hardware_serial": "{{ .GetSerialNumber }}",
     "hardware_vendor": "Microsoft Corporation",
     "hardware_version": "-1",
     "local_hostname": "{{ .CachedString "hostname" }}",
diff --git a/codecov.yml b/codecov.yml
index d0a398457d20..f91f1aae408e 100644
--- a/codecov.yml
+++ b/codecov.yml
@@ -22,3 +22,6 @@ flag_management:
     - name: frontend
       paths:
         - frontend/
+
+ignore:
+  - "server/mock"
diff --git a/docker-compose.yml b/docker-compose.yml
index 5b8b7b48eccb..6a393010e035 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -5,7 +5,7 @@ services:
   # officially supported).
   # To run in macOS M1, set FLEET_MYSQL_IMAGE=arm64v8/mysql:oracle FLEET_MYSQL_PLATFORM=linux/arm64/v8
   mysql:
-    image: ${FLEET_MYSQL_IMAGE:-mysql:5.7.21}
+    image: ${FLEET_MYSQL_IMAGE:-mysql:8.0.36}
     platform: ${FLEET_MYSQL_PLATFORM:-linux/x86_64}
     volumes:
       - mysql-persistent-volume:/tmp
@@ -30,7 +30,7 @@ services:
       - "3306:3306"
 
   mysql_test:
-    image: ${FLEET_MYSQL_IMAGE:-mysql:5.7.21}
+    image: ${FLEET_MYSQL_IMAGE:-mysql:8.0.36}
     platform: ${FLEET_MYSQL_PLATFORM:-linux/x86_64}
     # innodb-file-per-table=OFF gives ~20% speedup for test runs.
     command: [
@@ -56,7 +56,7 @@ services:
       - /tmpfs
 
   mysql_replica_test:
-    image: ${FLEET_MYSQL_IMAGE:-mysql:5.7.21}
+    image: ${FLEET_MYSQL_IMAGE:-mysql:8.0.36}
     platform: ${FLEET_MYSQL_PLATFORM:-linux/x86_64}
     # innodb-file-per-table=OFF gives ~20% speedup for test runs.
     command: [
@@ -167,12 +167,6 @@ services:
     volumes:
       - data-minio:/data
 
-  toxiproxy:
-    image: shopify/toxiproxy
-    ports:
-      - "22220:22220"
-      - "8474:8474"
-
 volumes:
   mysql-persistent-volume:
   data-minio:
diff --git a/docs/Configuration/agent-configuration.md b/docs/Configuration/agent-configuration.md
index 0c6f851b04a0..525caadcd5c2 100644
--- a/docs/Configuration/agent-configuration.md
+++ b/docs/Configuration/agent-configuration.md
@@ -128,14 +128,11 @@ Just like the other `agent_options` above, remove the dashed lines (`--`) for Fl
 Here is an example of using the `command_line_flags` key:
 
 ```yaml
-apiVersion: v1
-kind: config
-spec:
-  agent_options:
-    command_line_flags: # requires Fleet's agent (fleetd)
-      verbose: true
-      disable_watchdog: false
-      logger_path: /path/to/logger
+agent_options:
+  command_line_flags: # requires Fleet's agent (fleetd)
+    verbose: true
+    disable_watchdog: false
+    logger_path: /path/to/logger
 ```
 
 Note that the `command_line_flags` key does not support the `overrides` key, which is documented below.
@@ -182,20 +179,17 @@ The `extensions` key inside of `agent_options` allows you to remotely manage and
 
 This is best illustrated with an example. Here is an example of using the `extensions` key:
 ```yaml
-apiVersion: v1
-kind: config
-spec:
-  agent_options:
-    extensions: # requires Fleet's agent (fleetd)
-      hello_world_macos:
-        channel: 'stable'
-        platform: 'macos'
-      hello_world_linux:
-        channel: 'stable'
-        platform: 'linux'
-      hello_world_windows:
-        channel: 'stable'
-        platform: 'windows'
+agent_options:
+  extensions: # requires Fleet's agent (fleetd)
+    hello_world_macos:
+      channel: 'stable'
+      platform: 'macos'
+    hello_world_linux:
+      channel: 'stable'
+      platform: 'linux'
+    hello_world_windows:
+      channel: 'stable'
+      platform: 'windows'
 ```
 
 In the above example, we are configuring our `hello_world` extensions for all the supported operating systems. We do this by creating `hello_world_{macos|linux|windows}` subkeys under `extensions`, and then specifying the `channel` and `platform` keys for each extension entry.
@@ -248,25 +242,22 @@ The label names in the list:
 
 Example:
 ```yaml
-apiVersion: v1
-kind: config
-spec:
-  agent_options:
-    extensions: # requires Fleet's agent (fleetd)
-      hello_world_macos:
-        channel: 'stable'
-        platform: 'macos'
-        labels:
-          - Zoom installed
-      hello_world_linux:
-        channel: 'stable'
-        platform: 'linux'
-        labels:
-          - Ubuntu Linux
-          - Zoom installed
-      hello_world_windows:
-        channel: 'stable'
-        platform: 'windows'
+agent_options:
+  extensions: # requires Fleet's agent (fleetd)
+    hello_world_macos:
+      channel: 'stable'
+      platform: 'macos'
+      labels:
+        - Zoom installed
+    hello_world_linux:
+      channel: 'stable'
+      platform: 'linux'
+      labels:
+        - Ubuntu Linux
+        - Zoom installed
+    hello_world_windows:
+      channel: 'stable'
+      platform: 'windows'
 ```
 In the above example:
 - the `hello_world_macos` extension is deployed to macOS hosts that are members of the 'Zoom installed' label.
@@ -276,28 +267,22 @@ In the above example:
 
 _Available in Fleet Premium v4.43.0 and fleetd v1.20.0_
 
-Users can configure fleetd component TUF auto-update channels from Fleet's agent options. The components that can be configured are `orbit`, `osqueryd` and `desktop` (Fleet Desktop). When one of these components is omitted in `update_channels` then `stable` is assumed as the value for such component.
+Users can configure fleetd component TUF auto-update channels from Fleet's agent options. The components that can be configured are `orbit`, `osqueryd` and `desktop` (Fleet Desktop). When one of these components is omitted in `update_channels` then `stable` is assumed as the value for such component. Available options for update channels can be viewed [here](https://fleetdm.com/docs/using-fleet/enroll-hosts#specifying-update-channels).
 
 Examples:
 ```yaml
-apiVersion: v1
-kind: config
-spec:
-  agent_options:
-    update_channels: # requires Fleet's agent (fleetd)
-      orbit: stable
-      osqueryd: '5.10.2'
-      desktop: edge
+agent_options:
+  update_channels: # requires Fleet's agent (fleetd)
+    orbit: stable
+    osqueryd: '5.10.2'
+    desktop: edge
 ```
 ```yaml
-apiVersion: v1
-kind: config
-spec:
-  agent_options:
-    update_channels: # requires Fleet's agent (fleetd)
-      orbit: edge
-      osqueryd: '5.10.2'
-      # in this configuration `desktop` is assumed to be "stable"
+agent_options:
+  update_channels: # requires Fleet's agent (fleetd)
+    orbit: edge
+    osqueryd: '5.10.2'
+    # in this configuration `desktop` is assumed to be "stable"
 ```
 
 - If a configured channel doesn't exist in the TUF repository, then fleetd will log errors on the hosts and will not auto-update the component/s until the channel is changed to a valid value in Fleet's `update_channels` configuration or until the user pushes the component to the channel (which effectively creates the channel).
@@ -331,7 +316,6 @@ agent_options:
       options: ~
       decorators: ~
       yara: ~
-    overrides: ~
 
 ```
 
@@ -351,7 +335,6 @@ agent_options:
         distributed_tls_max_attempts: 3
         logger_tls_endpoint: /api/osquery/log
         logger_tls_period: 10
-      decorators: ~
 ```
 ### Decorators
 
@@ -380,27 +363,21 @@ You can use Fleet to configure the `yara` and `yara_events` osquery tables. Fore
 The following is an example Fleet configuration file with YARA configuration. The values are taken from an example config supplied in the above link to the osquery documentation.
 
 ```yaml
----
-apiVersion: v1
-kind: config
-spec:
-  agent_options:
-    config:
-      # ...
-      yara:
-        file_paths:
-          system_binaries:
-          - sig_group_1
-          tmp:
-          - sig_group_1
-          - sig_group_2
-        signatures:
-          sig_group_1:
-          - /Users/wxs/sigs/foo.sig
-          - /Users/wxs/sigs/bar.sig
-          sig_group_2:
-          - /Users/wxs/sigs/baz.sig
-    overrides: {}
+agent_options:
+  config:
+    yara:
+      file_paths:
+        system_binaries:
+        - sig_group_1
+        tmp:
+        - sig_group_1
+        - sig_group_2
+      signatures:
+        sig_group_1:
+        - /Users/wxs/sigs/foo.sig
+        - /Users/wxs/sigs/bar.sig
+        sig_group_2:
+        - /Users/wxs/sigs/baz.sig
 ```
 
 ## Overrides
@@ -413,11 +390,6 @@ In the example file below, all Darwin and Ubuntu hosts will **only** receive the
 
 ```yaml
 agent_options:
-  config:
-    options:
-      distributed_interval: 3
-      distributed_tls_max_attempts: 3
-      logger_tls_period: 10
   overrides:
     # Note configs in overrides take precedence over the default config defined
     # under the config key above. Hosts receive overrides based on the platform
@@ -441,6 +413,20 @@ agent_options:
           etc:
             - /etc/%%
 ```
+
+## Script execution timeout
+
+The `script_execution_timeout` allows you to change the default script execution timeout.
+
+- Optional setting (integer)
+- Default value: 300
+- Maximum value: 3600
+- Config file format:
+  ```yaml
+  agent_options:
+    script_execution_timeout: 600
+  ```
+
 ## Auto table construction
 
 You can use Fleet to query local SQLite databases as tables. For more information on creating ATC configuration from a SQLite database, check out the [Automatic Table Construction section](https://osquery.readthedocs.io/en/stable/deployment/configuration/#automatic-table-construction) of the osquery documentation.
@@ -448,28 +434,25 @@ You can use Fleet to query local SQLite databases as tables. For more informatio
 If you already know what your ATC configuration needs to look like, you can add it to an options config file:
 
 ```yaml
-apiVersion: v1
-kind: config
-spec:
-  agent_options:
-    config:
-      options:
-        # ...
-    overrides:
-      platforms:
-        darwin:
-          auto_table_construction:
-            tcc_system_entries:
-              # This query and columns are restricted for compatability.  Open TCC.db with sqlite on
-              # your endpoints to expand this out.
-              query: "SELECT service, client, last_modified FROM access"
-              # Note that TCC.db requires fleetd to have full-disk access, ensure that endpoints have 
-              # this enabled.
-              path: "/Library/Application Support/com.apple.TCC/TCC.db"
-              columns:
-                - "service"
-                - "client"
-                - "last_modified"
+agent_options:
+  config:
+    options:
+      # ...
+  overrides:
+    platforms:
+      darwin:
+        auto_table_construction:
+          tcc_system_entries:
+            # This query and columns are restricted for compatability.  Open TCC.db with sqlite on
+            # your endpoints to expand this out.
+            query: "SELECT service, client, last_modified FROM access"
+            # Note that TCC.db requires fleetd to have full-disk access, ensure that endpoints have 
+            # this enabled.
+            path: "/Library/Application Support/com.apple.TCC/TCC.db"
+            columns:
+              - "service"
+              - "client"
+              - "last_modified"
 ```
 
 If you're editing this directly from the UI consider copying and pasting the following at the end of your agent configuration block:
diff --git a/docs/Configuration/fleet-server-configuration.md b/docs/Configuration/fleet-server-configuration.md
index 1b5556356f75..145f887ebd38 100644
--- a/docs/Configuration/fleet-server-configuration.md
+++ b/docs/Configuration/fleet-server-configuration.md
@@ -4,6 +4,8 @@ Fleet server configuration options update the internals of the Fleet server (MyS
 
 Only self-managed users and customers can modify this configuration. If you're a managed-cloud customer, please reach out to Fleet about modifying the configuration.
 
+## Configuration options
+
 You can specify configuration options in the following formats:
 
 1. YAML file
@@ -12,58 +14,6 @@ You can specify configuration options in the following formats:
 
 All duration-based settings accept valid time units of `s`, `m`, `h`.
 
-## YAML file
-
-```sh
-echo '
-
-mysql:
-  address: 127.0.0.1:3306
-  database: fleet
-  username: root
-  password: toor
-redis:
-  address: 127.0.0.1:6379
-server:
-  cert: /tmp/server.cert
-  key: /tmp/server.key
-logging:
-  json: true
-' > /tmp/fleet.yml
-fleet serve --config /tmp/fleet.yml
-```
-
-## Environment variables
-
-```sh
-FLEET_MYSQL_ADDRESS=127.0.0.1:3306 \
-FLEET_MYSQL_DATABASE=fleet \
-FLEET_MYSQL_USERNAME=root \
-FLEET_MYSQL_PASSWORD=toor \
-FLEET_REDIS_ADDRESS=127.0.0.1:6379 \
-FLEET_SERVER_CERT=/tmp/server.cert \
-FLEET_SERVER_KEY=/tmp/server.key \
-FLEET_LOGGING_JSON=true \
-/usr/bin/fleet serve
-```
-
-## Command-line flags
-
-```sh
-/usr/bin/fleet serve \
---mysql_address=127.0.0.1:3306 \
---mysql_database=fleet \
---mysql_username=root \
---mysql_password=toor \
---redis_address=127.0.0.1:6379 \
---server_cert=/tmp/server.cert \
---server_key=/tmp/server.key \
---logging_json
-```
-
-
-## Configuration options
-
 #### MySQL
 
 This section describes the configuration options for the primary. Suppose you also want to set up a read replica. In that case the options are the same, except that the YAML section is `mysql_read_replica`, and the flags have the `mysql_read_replica_` prefix instead of `mysql_` (the corresponding environment variables follow the same transformation). Note that there is no default value for `mysql_read_replica_address`, it must be set explicitly for Fleet to use a read replica, and it is recommended in that case to set a non-zero value for `mysql_read_replica_conn_max_lifetime` as in some environments, the replica's address may dynamically change to point
@@ -236,7 +186,7 @@ The maximum amount of time, in seconds, a connection may be reused.
 
 ##### mysql_sql_mode
 
-Sets the connection `sql_mode`. See [MySQL Reference](https://dev.mysql.com/doc/refman/5.7/en/sql-mode.html) for more details.
+Sets the connection `sql_mode`. See [MySQL Reference](https://dev.mysql.com/doc/refman/8.0/en/sql-mode.html) for more details.
 This setting should not usually be used.
 
 - Default value: `""`
@@ -1444,7 +1394,7 @@ AWS secret access key to use for Firehose authentication.
   firehose:
     secret_access_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
   ```
-Optional unique identifier that can be used by the principal assuming the role to assert its identity.
+
 ##### firehose_sts_assume_role_arn
 
 This flag only has effect if one of the following is true:
@@ -2247,7 +2197,7 @@ The IAM identity used in this context must be allowed to perform the following a
 AWS secret access key to use for S3 authentication.
 
 - Default value: none
-- Environment variable: `FLEET_S3_SECRET_ACCESS_KEY`
+- Environment variable: `FLEET_S3_SOFTWARE_INSTALLERS_SECRET_ACCESS_KEY`
 - Config file format:
   ```yaml
   s3:
@@ -2891,7 +2841,7 @@ packaging:
     region: us-east-1
 ```
 
-## Mobile device management (MDM)
+#### Mobile device management (MDM)
 
 > The [`server_private_key` configuration option](#server_private_key) is required for macOS MDM features.
 
@@ -2962,11 +2912,6 @@ The content of the Windows WSTEP identity key. An RSA private key, PEM-encoded.
       -----END RSA PRIVATE KEY-----
   ```
 
-
-## Managing osquery configurations
-
-We recommend that you use an infrastructure configuration management tool to manage these osquery configurations consistently across your environment. If you're unsure about what configuration management tools your organization uses, contact your company's system administrators. If you are evaluating new solutions for this problem, the founders of Fleet have successfully managed configurations in large production environments using [Chef](https://www.chef.io/chef/) and [Puppet](https://puppet.com/).
-
 <h2 id="running-with-systemd">Running with systemd</h2>
 
 This content was moved to [Systemd](http://fleetdm.com/docs/deploy/system-d) on Sept 6th, 2023.
diff --git a/docs/Using Fleet/GitOps.md b/docs/Configuration/yaml-files.md
similarity index 80%
rename from docs/Using Fleet/GitOps.md
rename to docs/Configuration/yaml-files.md
index 96d336871488..be73c1ff29e5 100644
--- a/docs/Using Fleet/GitOps.md	
+++ b/docs/Configuration/yaml-files.md
@@ -1,4 +1,4 @@
-# GitOps
+# YAML files
 
 Use Fleet's best practice GitOps workflow to manage your computers as code.
 
@@ -20,19 +20,21 @@ The following files are responsible for running the GitHub action. Most users do
 The following are the required keys in the `default.yml` and any `teams/team-name.yml` files:
 
 ```yaml
-name: # Only teams/team-name.yml
+name: # Only teams/team-name.yml. To edit a team's name, change `name` but don't change the filename.
 policies:
 queries:
 agent_options:
 controls:
+software:
 org_settings: # Only default.yml
 team_settings: # Only teams/team-name.yml
 ```
 
 - [policies](#policies)
 - [queries](#queries)
-- [agent_options](#agent_options)
+- [agent_options](#agent-options)
 - [controls](#controls)
+- [software](#software)
 - [org_settings and team_settings](#org-settings-and-team-settings)
 
 ### policies
@@ -196,9 +198,11 @@ config:
 
 `default.yml` or `teams/team-name.yml`
 
+> We want `-` for policies and queries because it’s an array. Agent Options we do not use `-` for `path`.
+
 ```yaml
 queries:
-  - path: ../lib/agent-options.yml
+  path: ../lib/agent-options.yml
 # path is relative to default.yml or teams/team-name.yml
 ```
 
@@ -227,12 +231,16 @@ controls:
     deadline_days: 5
     grace_period_days: 2
   macos_settings:
-    - path: ../lib/macos-profile1.mobileconfig
-      labels:
-        - Label name 1
-    - path: ../lib/macos-profile2.json
+    custom_settings:
+      - path: ../lib/macos-profile1.mobileconfig
+        labels_exclude_any:
+          - Label 1
+      - path: ../lib/macos-profile2.json
+        labels_include_all:
+          - Label 2
   windows_settings:
-    - path: ../lib/windows-profile.xml
+    custom_settings
+      - path: ../lib/windows-profile.xml
   macos_setup: # Available in Fleet Premium
     bootstrap_package: https://example.org/bootstrap_package.pkg
     enable_end_user_authentication: true
@@ -261,24 +269,65 @@ controls:
 
 Fleet supports adding [GitHub environment variables](https://docs.github.com/en/actions/learn-github-actions/variables#defining-environment-variables-for-a-single-workflow) in your configuration profiles. Use `$ENV_VARIABLE` format.
 
-Use `labels` to only apply (scope) profiles to hosts that have all those labels.
+Use `labels_include_all` to only apply (scope) profiles to hosts that have all those labels or `labels_exclude_any` to apply profiles to hosts that don't have any of those labels.
 
 #### macos_setup
 
-The `macos_setup` section lets you control the [end user migration workflow](https://fleetdm.com/docs/using-fleet/mdm-migration-guide#end-user-workflow) for macOS hosts that automatically enrolled to your old MDM solution.
+The `macos_setup` section lets you control the out-of-the-box macOS [setup experience](https://fleetdm.com/guides/macos-setup-experience) for hosts that use Automated Device Enrollment (ADE).
 
 - `bootstrap_package` is the URL to a bootstap package. Fleet will download the bootstrap package (default: `""`).
 - `enable_end_user_authentication` specifies whether or not to require end user authentication when the user first sets up their macOS host. 
-- `macos_setup_assistant` is a path to a custom automatic enrollment (DEP) profile (.json).
+- `macos_setup_assistant` is a path to a custom automatic enrollment (ADE) profile (.json).
 
 #### macos_migration
 
+The `macos_migration` section lets you control the [end user migration workflow](https://fleetdm.com/docs/using-fleet/mdm-migration-guide#end-user-workflow) for macOS hosts that enrolled to your old MDM solution.
+
 - `enable` specifies whether or not to enable end user migration workflow (default: `false`)
 - `mode` specifies whether the end user initiates migration (`voluntary`) or they're nudged every 15-20 minutes to migrate (`forced`) (default: `""`).
 - `webhook_url` is the URL that Fleet sends a webhook to when the end user selects **Start**. Receive this webhook using your automation tool (ex. Tines) to unenroll your end users from your old MDM solution.
 
 Can only be configure for all teams (`default.yml`).
 
+### software
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+The `software` section allows you to configure packages and Apple App Store apps that you want to install on your hosts.
+
+- `packages` is a list of software packages (.pkg, .msi, .exe, or .deb) and software specific options.
+- `app_store_apps` is a list of Apple App Store apps.
+
+##### Example
+
+```yaml
+software:
+  packages:
+   - url: https://github.com/organinzation/repository/package-1.pkg
+     install_script:
+       path: /lib/crowdstrike-install.sh 
+      pre_install_query: 
+        path: /lib/check-crowdstrike-configuration-profile.queries.yml
+      post_install_script:
+        path: /lib/crowdstrike-post-install.sh 
+      self_service: true
+    - url: https://github.com/organinzation/repository/package-2.msi
+  app_store_apps:
+   - app_store_id: '1091189122'
+```
+
+#### packages
+
+- `url` specifies the URL at which the software is located. Fleet will download the software and upload it to S3 (default: `""`).
+- `install_script.path` specifies the command Fleet will run on hosts to install software. The [default script](https://github.com/fleetdm/fleet/tree/main/pkg/file/scripts) is dependent on the software type (i.e. .pkg).
+- `pre_install_query.path` is the osquery query Fleet runs before installing the software. Software will be installed only if the [query returns results](https://fleetdm.com/tables/account_policy_data) (default: `""`).
+- `post_install_script.path` is the script Fleet will run on hosts after intalling software (default: `""`).
+- `self_service` specifies whether or not end users can install from **Fleet Desktop > Self-service**.
+
+#### app_store_apps
+
+- `app_store_id` is the ID of the Apple App Store app. You can find this at the end of the app's App Store URL. For example, "Bear - Markdown Notes" URL is "https://apps.apple.com/us/app/bear-markdown-notes/id1016366447" and the `app_store_id` is `1016366447`.
+
 ### org_settings and team_settings
 
 #### features
@@ -366,6 +415,7 @@ org_settings:
 - `enable_analytics` specifies whether or not to enable Fleet's [usage statistics](https://fleetdm.com/docs/using-fleet/usage-statistics) (default: `true`).
 - `live_query_disabled` disables the ability to run live queries (ad hoc queries executed via the UI or fleetctl) (default: `false`).
 - `query_reports_disabled` disables query reports and deletes existing repors (default: `false`).
+- `query_report_cap` sets the maximum number of results to store per query report before the report is clipped. If increasing this cap, we recommend enabling reports for one query at time and monitoring your infrastructure. (Default: `1000`)
 - `scripts_disabled` blocks access to run scripts. Scripts may still be added in the UI and CLI (defaul: `false`).
 - `server_url` is the base URL of the Fleet instance (default: provided during Fleet setup)
 
@@ -537,7 +587,19 @@ org_settings:
 
 Can only be configured for all teams (`org_settings`).
 
-<meta name="title" value="GitOps">
+##### end_user_authentication
+
+The `end_user_authentication` section lets you define the identity provider (IdP) settings used for end user authentication during Automated Device Enrollment (ADE). Learn more about end user authentication in Fleet [here](https://fleetdm.com/guides/macos-setup-experience#end-user-authentication-and-eula).
+
+Once the IdP settings are configured, you can use the [`controls.macos_setup.enable_end_user_authentication`](#macos_setup) key to control the end user experience during ADE.
+
+- `idp_name` is the human-friendly name for the identity provider that will provide single sign-on authentication (default: `""`).
+- `entity_id` is the entity ID: a Uniform Resource Identifier (URI) that you use to identify Fleet when configuring the identity provider. It must exactly match the Entity ID field used in identity provider configuration (default: `""`).
+- `metadata` is the metadata (in XML format) provided by the identity provider. (default: `""`)
+- `metadata_url` is the URL that references the identity provider metadata. Only one of  `metadata` or `metadata_url` is required (default: `""`).
+
+Can only be configured for all teams (`org_settings`).
+
+<meta name="title" value="YAML files">
 <meta name="description" value="Reference documentation for Fleet's GitOps workflow. See examples and configuration options.">
 <meta name="pageOrderInSection" value="1500">
-<meta name="navSection" value="The basics">
diff --git a/docs/Contributing/API-for-contributors.md b/docs/Contributing/API-for-contributors.md
index 6357b4a4d4c5..916a55a17790 100644
--- a/docs/Contributing/API-for-contributors.md
+++ b/docs/Contributing/API-for-contributors.md
@@ -11,9 +11,9 @@
 - [Scripts](#scripts)
 - [Software](#software)
 
-This document includes the internal Fleet API routes that are helpful when developing or contributing to Fleet.
+> These endpoints are used by the Fleet UI, Fleet Desktop, and `fleetctl` clients and frequently change to reflect current functionality.
 
-These endpoints are used by the Fleet UI, Fleet Desktop, and `fleetctl` clients and will frequently change to reflect current functionality.
+This document includes the internal Fleet API routes that are helpful when developing or contributing to Fleet.
 
 If you are interested in gathering information from Fleet in a production environment, please see the [public Fleet REST API documentation](https://fleetdm.com/docs/using-fleet/rest-api).
 
@@ -540,6 +540,9 @@ The MDM endpoints exist to support the related command-line interface sub-comman
 - [Preassign profiles to devices](#preassign-profiles-to-devices)
 - [Match preassigned profiles](#match-preassigned-profiles)
 - [Get FileVault statistics](#get-filevault-statistics)
+- [Upload VPP content token](#upload-vpp-content-token)
+- [Disable VPP](#disable-vpp)
+
 
 ### Generate Apple Business Manager public key (ADE)
 
@@ -693,7 +696,7 @@ Content-Type: application/octet-stream
 | team_id   | number | query | _Available in Fleet Premium_ The team ID to apply the custom settings to. Only one of `team_name`/`team_id` can be provided.          |
 | team_name | string | query | _Available in Fleet Premium_ The name of the team to apply the custom settings to. Only one of `team_name`/`team_id` can be provided. |
 | dry_run   | bool   | query | Validate the provided profiles and return any validation errors, but do not apply the changes.                                    |
-| profiles  | json   | body  | An array of objects, consisting of a `profile` base64-encoded .mobileconfig or JSON for macOS and XML (Windows) file, `labels` array of strings (label names), and `name` display name (for Windows configuration profiles and macOS declaration profiles).                                        |
+| profiles  | json   | body  | An array of objects, consisting of a `profile` base64-encoded .mobileconfig or JSON for macOS and XML (Windows) file, `labels_include_all` or `labels_exclude_any` array of strings (label names), and `name` display name (for Windows configuration profiles and macOS declaration profiles).                                        |
 
 
 If no team (id or name) is provided, the profiles are applied for all hosts (for _Fleet Free_) or for hosts that are not assigned to any team (for _Fleet Premium_). After the call, the provided list of `profiles` will be the active profiles for that team (or no team) - that is, any existing profile that is not part of that list will be removed, and an existing profile with the same payload identifier (macOS) as a new profile will be edited. If the list of provided `profiles` is empty, all profiles are removed for that team (or no team).
@@ -868,6 +871,55 @@ This endpoint uses the profiles stored by the [Preassign profiles to devices](#p
 
 `Status: 204`
 
+### Upload VPP content token
+
+`POST /api/v1/fleet/mdm/apple/vpp_token`
+
+#### Parameters
+
+| Name | Type | In | Description |
+| ---- | ---- | -- | ----------- |
+| token | file | form | *Required* The file containing the content token (.vpptoken) from Apple Business Manager |
+
+#### Example
+
+`POST /api/v1/fleet/mdm/apple/vpp_token`
+
+##### Request header
+
+```http
+Content-Length: 850
+Content-Type: multipart/form-data; boundary=------------------------f02md47480und42y
+```
+
+##### Request body
+
+```http
+--------------------------f02md47480und42y
+Content-Disposition: form-data; name="token"; filename="sToken_for_Acme.vpptoken"
+Content-Type: application/octet-stream
+<TOKEN_DATA>
+--------------------------f02md47480und42y
+```
+
+##### Default response
+
+`Status: 200`
+
+
+### Disable VPP
+
+`DELETE /api/v1/fleet/mdm/apple/vpp_token`
+
+#### Example
+
+`DELETE /api/v1/fleet/mdm/apple/vpp_token`
+
+##### Default response
+
+`Status: 204`
+
+
 ## Get or apply configuration files
 
 These API routes are used by the `fleetctl` CLI tool. Users can manage Fleet with `fleetctl` and [configuration files in YAML syntax](https://fleetdm.com/docs/using-fleet/configuration-files/).
@@ -1377,11 +1429,13 @@ If the `name` is not already associated with an existing team, this API route cr
 | mdm.macos_updates.minimum_version         | string | body  | The required minimum operating system version.                                                                                                                                                                                      |
 | mdm.macos_updates.deadline                | string | body  | The required installation date for Nudge to enforce the operating system version.                                                                                                                                                   |
 | mdm.macos_settings                        | object | body  | The macOS-specific MDM settings.                                                                                                                                                                                                    |
-| mdm.macos_settings.custom_settings        | list   | body  | The list of objects consists of a `path` to .mobileconfig or JSON file and `labels` list of label names.                                                                                                                                                         |
+| mdm.macos_settings.custom_settings        | list   | body  | The list of objects consists of a `path` to .mobileconfig or JSON file and `labels_include_all` or `labels_exclude_any` list of label names.                                                                                                                                                         |
 | mdm.windows_settings                        | object | body  | The Windows-specific MDM settings.                                                                                                                                                                                                    |
-| mdm.windows_settings.custom_settings        | list   | body  | The list of objects consists of a `path` to XML files and `labels` list of label names.                                                                                                                                                         |
+| mdm.windows_settings.custom_settings        | list   | body  | The list of objects consists of a `path` to XML files and `labels_include_all` or `labels_exclude_any` list of label names.                                                                                                                                                         |
 | scripts                                   | list   | body  | A list of script files to add to this team so they can be executed at a later time.                                                                                                                                                 |
-| software                                   | list   | body  | An array of software objects. Each object consists of:`url`- URL to the software package (PKG, MSI, EXE or DEB),`install_script` - command that Fleet runs to install software, `pre_install_query` - condition query that determines if the install will proceed, `post_install_script` - script that runs after software install, and `self_service` boolean.   |
+| software                                   | object   | body  | The team's software that will be available for install.  |
+| software.packages                          | list   | body  | An array of objects. Each object consists of:`url`- URL to the software package (PKG, MSI, EXE or DEB),`install_script` - command that Fleet runs to install software, `pre_install_query` - condition query that determines if the install will proceed, `post_install_script` - script that runs after software install, and `self_service` boolean.   |
+| software.app_store_apps                   | list   | body  | An array objects. Each object consists of `app_store_id` - ID of the App Store app formatted as a string (in quotes) rather than a number. |
 | mdm.macos_settings.enable_disk_encryption | bool   | body  | Whether disk encryption should be enabled for hosts that belong to this team.                                                                                                                                                       |
 | force                                     | bool   | query | Force apply the spec even if there are (ignorable) validation errors. Those are unknown keys and agent options-related validations.                                                                                                 |
 | dry_run                                   | bool   | query | Validate the provided JSON for unknown keys and invalid value types and return any validation errors, but do not apply the changes.                                                                                                 |
@@ -1440,32 +1494,43 @@ If the `name` is not already associated with an existing team, this API route cr
           "deadline": "2023-12-01"
         },
         "macos_settings": {
-          "custom_settings": {
-            "path": "path/to/profile1.mobileconfig"
-            "labels": ["Label 1", "Label 2"]
-          },
-          {
-            "path": "path/to/profile2.json"
-            "labels": ["Label 3", "Label 4"]
-          },
+          "custom_settings": [
+            {
+              "path": "path/to/profile1.mobileconfig"
+              "labels_include_all": ["Label 1", "Label 2"]
+            },
+            {
+              "path": "path/to/profile2.json"
+              "labels_exclude_any": ["Label 3", "Label 4"]
+            },
+          ],
           "enable_disk_encryption": true
         },
         "windows_settings": {
-          "custom_settings": {
-            "path": "path/to/profile3.xml"
-            "labels": ["Label 1", "Label 2"]
-          },
+          "custom_settings": [
+            {
+              "path": "path/to/profile3.xml"
+              "labels_include_all": ["Label 1", "Label 2"]
+            }
+          ]
         }
       },
       "scripts": ["path/to/script.sh"],
-      "software": [
-        {
-          "url": "https://cdn.zoom.us/prod/5.16.10.26186/x64/ZoomInstallerFull.msi",
-          "pre_install_query": "SELECT 1 FROM macos_profiles WHERE uuid='c9f4f0d5-8426-4eb8-b61b-27c543c9d3db';",
-          "post_install_script": "sudo /Applications/Falcon.app/Contents/Resources/falconctl license 0123456789ABCDEFGHIJKLMNOPQRSTUV-WX",
-          "self_service": true
-        }
-      ]
+      "software": { 
+        "packages": [
+          {
+            "url": "https://cdn.zoom.us/prod/5.16.10.26186/x64/ZoomInstallerFull.msi",
+            "pre_install_query": "SELECT 1 FROM macos_profiles WHERE uuid='c9f4f0d5-8426-4eb8-b61b-27c543c9d3db';",
+            "post_install_script": "sudo /Applications/Falcon.app/Contents/Resources/falconctl license 0123456789ABCDEFGHIJKLMNOPQRSTUV-WX",
+            "self_service": true,
+          }
+        ],
+        "app_store_apps": [
+          {
+            "app_store_id": "12464567",
+          }
+        ]
+      }  
     }
   ]
 }
@@ -2477,6 +2542,7 @@ Gets all information required by Fleet Desktop, this includes things like the nu
 ```json
 {
   "failing_policies_count": 3,
+  "self_service": true,
   "notifications": {
     "needs_mdm_migration": true,
     "renew_enrollment_profile": false,
@@ -2536,35 +2602,58 @@ Lists the software installed on the current device.
     {
       "id": 121,
       "name": "Google Chrome.app",
+      "software_package": {
+        "name": "GoogleChrome.pkg"
+        "version": "125.12.2"
+        "self_service": true,
+     	"last_install": {
+          "install_uuid": "8bbb8ac2-b254-4387-8cba-4d8a0407368b",
+      	  "installed_at": "2024-05-15T15:23:57Z"
+        },
+      },
+      "app_store_app": null,
       "source": "apps",
       "status": "failed",
-      "last_install": {
-        "install_uuid": "8bbb8ac2-b254-4387-8cba-4d8a0407368b",
-        "installed_at": "2024-05-15T15:23:57Z"
-      },
       "installed_versions": [
-        { 
+        {
           "version": "121.0",
           "last_opened_at": "2024-04-01T23:03:07Z",
           "vulnerabilities": ["CVE-2023-1234","CVE-2023-4321","CVE-2023-7654"],
           "installed_paths": ["/Applications/Google Chrome.app"]
         }
-      ]
+      ],
+       "software_package": {
+        "name": "google-chrome-124-0-6367-207.pkg",
+        "version": "121.0",
+        "self_service": true,
+        "icon_url": null,
+        "last_install": null
+      },
+      "app_store_app": null
     },
     {
       "id": 143,
       "name": "Firefox.app",
+      "software_package": null,
+      "app_store_app": null,
       "source": "apps",
       "status": null,
-      "last_install": null,
       "installed_versions": [
-        { 
+        {
           "version": "125.6",
           "last_opened_at": "2024-04-01T23:03:07Z",
           "vulnerabilities": ["CVE-2023-1234","CVE-2023-4321","CVE-2023-7654"],
           "installed_paths": ["/Applications/Firefox.app"]
         }
-      ]
+      ],
+      "software_package": null,
+      "app_store_app": {
+        "app_store_id": "12345",
+        "version": "125.6",
+        "self_service": false,
+        "icon_url": "https://example.com/logo-light.jpg",
+        "last_install": null
+      },
     }
   ],
   "meta": {
@@ -2751,27 +2840,6 @@ Signals the Fleet server to send a webbook request with the device UUID and seri
 
 ---
 
-#### Trigger FileVault key escrow
-
-Sends a signal to Fleet Desktop to initiate a FileVault key escrow. This is useful for setting the escrow key initially as well as in scenarios where a token rotation is required. **Requires Fleet Premium license**
-
-`POST /api/v1/fleet/device/{token}/rotate_encryption_key`
-
-##### Parameters
-
-| Name  | Type   | In   | Description                        |
-| ----- | ------ | ---- | ---------------------------------- |
-| token | string | path | The device's authentication token. |
-
-##### Example
-
-`POST /api/v1/fleet/device/abcdef012456789/rotate_encryption_key`
-
-##### Default response
-
-`Status: 204`
-
-
 ### Report an agent error
 
 Notifies the server about an agent error, resulting in two outcomes:
@@ -2934,7 +3002,7 @@ If the Fleet instance is provided required parameters to complete setup.
 
 ## Scripts
 
-### Batch-apply scripts 
+### Batch-apply scripts
 
 _Available in Fleet Premium_
 
@@ -2963,7 +3031,7 @@ If both `team_id` and `team_name` parameters are included, this endpoint will re
 
 ## Software
 
-### Batch-apply software 
+### Batch-apply software
 
 _Available in Fleet Premium._
 
@@ -2973,10 +3041,12 @@ _Available in Fleet Premium._
 
 | Name      | Type   | In    | Description                                                                                                                                                           |
 | --------- | ------ | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| team_id   | number | query | The ID of the team to add the software package to. Only one team identifier (`team_id` or `team_name`) can be included in the request, omit this parameter if using `team_name`. |
-| team_name | string | query | The name of the team to add the software package to. Only one team identifier (`team_id` or `team_name`) can be included in the request, omit this parameter if using `team_id`. |
+| team_id   | number | query | The ID of the team to add the software package to. Only one team identifier (`team_id` or `team_name`) can be included in the request, omit this parameter if using `team_name`. Ommitting these parameters will add software to 'No Team'. |
+| team_name | string | query | The name of the team to add the software package to. Only one team identifier (`team_id` or `team_name`) can be included in the request, omit this parameter if using `team_id`. Ommitting these parameters will add software to 'No Team'. |
 | dry_run   | bool   | query | If `true`, will validate the provided software packages and return any validation errors, but will not apply the changes.                                                                         |
-| software  | list   | body  | An array of software objects. Each object consists of:`url`- URL to the software package (PKG, MSI, EXE or DEB),`install_script` - command that Fleet runs to install software, `pre_install_query` - condition query that determines if the install will proceed, and `post_install_script` - script that runs after software install.   |
+| software  | object   | body  | The team's software that will be available for install.  |
+| software.packages   | list   | body  | An array of objects. Each object consists of:`url`- URL to the software package (PKG, MSI, EXE or DEB),`install_script` - command that Fleet runs to install software, `pre_install_query` - condition query that determines if the install will proceed, and `post_install_script` - script that runs after software install.   |
+| software.app_store_apps | list   | body  | An array objects. Each object consists of `app_store_id` - ID of the App Store app. |
 
 If both `team_id` and `team_name` parameters are included, this endpoint will respond with an error. If no `team_name` or `team_id` is provided, the scripts will be applied for **all hosts**.
 
@@ -2987,3 +3057,102 @@ If both `team_id` and `team_name` parameters are included, this endpoint will re
 ##### Default response
 
 `Status: 204`
+
+ ### Run live script
+
+Run a live script and get results back (5 minute timeout). Live scripts only runs on the host if it has no other scripts running.
+
+`POST /api/v1/fleet/scripts/run/sync`
+
+#### Parameters
+
+| Name            | Type    | In   | Description                                      |
+| ----            | ------- | ---- | --------------------------------------------     |
+| host_id         | integer | body | **Required**. The host ID to run the script on.  |
+| script_id       | integer | body | The ID of the existing saved script to run. Only one of either `script_id`, `script_name` or `script_contents` can be included in the request; omit this parameter if using `script_contents` or `script_name`.  |
+| script_contents | string  | body | The contents of the script to run. Only one of either `script_contents`, `script_id` or `script_name` can be included in the request; omit this parameter if using `script_id` or `script_name`. |
+| script_name       | string | body | The name of the existing saved script to run. Only one of either `script_name`, `script_id` or `script_contents` can be included in the request; omit this parameter if using `script_contents` or `script_id`.  |
+| team_id       | integer | body | ID of the team the saved script referenced by `script_name` belongs to. Default: `0` (hosts assigned to "No team") |
+
+
+> Note that if both `script_id` and `script_contents` are included in the request, this endpoint will respond with an error.
+
+#### Example
+
+`POST /api/v1/fleet/scripts/run/sync`
+
+##### Default response
+
+`Status: 200`
+
+```json
+{
+  "host_id": 1227,
+  "execution_id": "e797d6c6-3aae-11ee-be56-0242ac120002",
+  "script_contents": "echo 'hello'",
+  "output": "hello",
+  "message": "",
+  "runtime": 1,
+  "host_timeout": false,
+  "exit_code": 0
+}
+```
+
+### Get token to download package
+
+_Available in Fleet Premium._
+
+`POST /api/v1/fleet/software/titles/:software_title_id/package/token?alt=media`
+
+The returned token is a one-time use token that expires after 10 minutes.
+
+#### Parameters
+
+| Name              | Type    | In    | Description                                                      |
+|-------------------|---------|-------|------------------------------------------------------------------|
+| software_title_id | integer | path  | **Required**. The ID of the software title for software package. |
+| team_id           | integer | query | **Required**. The team ID containing the software package.       |
+| alt               | integer | query | **Required**. Must be specified and set to "media".              |
+
+#### Example
+
+`POST /api/v1/fleet/software/titles/123/package/token?alt=media&team_id=2`
+
+##### Default response
+
+`Status: 200`
+
+```json
+{
+  "token": "e905e33e-07fe-4f82-889c-4848ed7eecb7"
+}
+```
+
+### Download package using a token
+
+_Available in Fleet Premium._
+
+`GET /api/v1/fleet/software/titles/:software_title_id/package/token/:token?alt=media`
+
+#### Parameters
+
+| Name              | Type    | In   | Description                                                              |
+|-------------------|---------|------|--------------------------------------------------------------------------|
+| software_title_id | integer | path | **Required**. The ID of the software title to download software package. |
+| token             | string  | path | **Required**. The token to download the software package.                |
+
+#### Example
+
+`GET /api/v1/fleet/software/titles/123/package/token/e905e33e-07fe-4f82-889c-4848ed7eecb7`
+
+##### Default response
+
+`Status: 200`
+
+```http
+Status: 200
+Content-Type: application/octet-stream
+Content-Disposition: attachment
+Content-Length: <length>
+Body: <blob>
+```
diff --git a/docs/Using Fleet/Audit-logs.md b/docs/Contributing/Audit-logs.md
similarity index 87%
rename from docs/Using Fleet/Audit-logs.md
rename to docs/Contributing/Audit-logs.md
index ab16e6970d60..b2fe63528bf8 100644
--- a/docs/Using Fleet/Audit-logs.md	
+++ b/docs/Contributing/Audit-logs.md
@@ -582,6 +582,48 @@ This activity contains the following fields:
 }
 ```
 
+## edited_ios_min_version
+
+Generated when the minimum required iOS version or deadline is modified.
+
+This activity contains the following fields:
+- "team_id": The ID of the team that the minimum iOS version applies to, `null` if it applies to devices that are not in a team.
+- "team_name": The name of the team that the minimum iOS version applies to, `null` if it applies to devices that are not in a team.
+- "minimum_version": The minimum iOS version required, empty if the requirement was removed.
+- "deadline": The deadline by which the minimum version requirement must be applied, empty if the requirement was removed.
+
+#### Example
+
+```json
+{
+  "team_id": 3,
+  "team_name": "iPhones",
+  "minimum_version": "17.5.1",
+  "deadline": "2023-06-01"
+}
+```
+
+## edited_ipados_min_version
+
+Generated when the minimum required iPadOS version or deadline is modified.
+
+This activity contains the following fields:
+- "team_id": The ID of the team that the minimum iPadOS version applies to, `null` if it applies to devices that are not in a team.
+- "team_name": The name of the team that the minimum iPadOS version applies to, `null` if it applies to devices that are not in a team.
+- "minimum_version": The minimum iPadOS version required, empty if the requirement was removed.
+- "deadline": The deadline by which the minimum version requirement must be applied, empty if the requirement was removed.
+
+#### Example
+
+```json
+{
+  "team_id": 3,
+  "team_name": "iPads",
+  "minimum_version": "17.5.1",
+  "deadline": "2023-06-01"
+}
+```
+
 ## edited_windows_updates
 
 Generated when the Windows OS updates deadline or grace period is modified.
@@ -1158,7 +1200,7 @@ Generated when a software installer is deleted from Fleet.
 This activity contains the following fields:
 - "software_title": Name of the software.
 - "software_package": Filename of the installer.
-- "team_name": Name of the team to which this software was added. `null if it was added to no team.
+- "team_name": Name of the team to which this software was added. `null` if it was added to no team.
 - "team_id": The ID of the team to which this software was added. `null` if it was added to no team.
 - "self_service": Whether the software was available for installation by the end user.
 
@@ -1174,6 +1216,109 @@ This activity contains the following fields:
 }
 ```
 
+## enabled_vpp
+
+Generated when VPP features are enabled in Fleet.
+
+This activity contains the following fields:
+- "location": Location associated with the VPP content token for the enabled VPP features.
+
+#### Example
+
+```json
+{
+  "location": "Acme Inc."
+}
+```
+
+## disabled_vpp
+
+Generated when VPP features are disabled in Fleet.
+
+This activity contains the following fields:
+- "location": Location associated with the VPP content token for the disabled VPP features.
+
+#### Example
+
+```json
+{
+  "location": "Acme Inc."
+}
+```
+
+## added_app_store_app
+
+Generated when an App Store app is added to Fleet.
+
+This activity contains the following fields:
+- "software_title": Name of the App Store app.
+- "app_store_id": ID of the app on the Apple App Store.
+- "platform": Platform of the app (`darwin`, `ios`, or `ipados`).
+- "self_service": App installation can be initiated by device owner.
+- "team_name": Name of the team to which this App Store app was added, or `null` if it was added to no team.
+- "team_id": ID of the team to which this App Store app was added, or `null`if it was added to no team.
+
+#### Example
+
+```json
+{
+  "software_title": "Logic Pro",
+  "app_store_id": "1234567",
+  "platform": "darwin",
+  "self_service": false,
+  "team_name": "Workstations",
+  "team_id": 1
+}
+```
+
+## deleted_app_store_app
+
+Generated when an App Store app is deleted from Fleet.
+
+This activity contains the following fields:
+- "software_title": Name of the App Store app.
+- "app_store_id": ID of the app on the Apple App Store.
+- "platform": Platform of the app (`darwin`, `ios`, or `ipados`).
+- "team_name": Name of the team from which this App Store app was deleted, or `null` if it was deleted from no team.
+- "team_id": ID of the team from which this App Store app was deleted, or `null`if it was deleted from no team.
+
+#### Example
+
+```json
+{
+  "software_title": "Logic Pro",
+  "app_store_id": "1234567",
+  "platform": "darwin",
+  "team_name": "Workstations",
+  "team_id": 1
+}
+```
+
+## installed_app_store_app
+
+Generated when an App Store app is installed on a device.
+
+This activity contains the following fields:
+- host_id: ID of the host on which the app was installed.
+- self_service: App installation was initiated by device owner.
+- host_display_name: Display name of the host.
+- software_title: Name of the App Store app.
+- app_store_id: ID of the app on the Apple App Store.
+- command_uuid: UUID of the MDM command used to install the app.
+
+#### Example
+
+```json
+{
+  "host_id": 42,
+  "self_service": true,
+  "host_display_name": "Anna's MacBook Pro",
+  "software_title": "Logic Pro",
+  "app_store_id": "1234567",
+  "command_uuid": "98765432-1234-1234-1234-1234567890ab"
+}
+```
+
 
 <meta name="title" value="Audit logs">
 <meta name="pageOrderInSection" value="1400">
diff --git a/docs/Contributing/File-carving.md b/docs/Contributing/File-carving.md
index 57b743f2071f..b283f11f4c8d 100644
--- a/docs/Contributing/File-carving.md
+++ b/docs/Contributing/File-carving.md
@@ -23,8 +23,7 @@ The default flagfile provided in the "Add new host" dialog also includes this co
 The `carver_block_size` flag should be configured in osquery.
 
 For the (default) MySQL Backend, the configured value must be less than the value of
-`max_allowed_packet` in the MySQL connection, allowing for some overhead. The default for [MySQL 5.7](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_max_allowed_packet)
-is 4MB and for [MySQL 8](https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_max_allowed_packet) it is 64MB.
+`max_allowed_packet` in the MySQL connection, allowing for some overhead. The default for [MySQL 8](https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_max_allowed_packet) it is 64MB.
 
 For the S3/Minio backend, this value must be set to at least 5MiB (`5242880`) due to the
 [constraints of S3's multipart
@@ -78,7 +77,7 @@ The same is not true if S3 is used as the storage backend. In that scenario, it
 
 ### Alternative carving backends
 
-#### Minio
+#### MinIO
 
 Configure the following:
 - `FLEET_S3_ENDPOINT_URL=minio_host:port`
@@ -88,6 +87,11 @@ Configure the following:
 - `FLEET_S3_FORCE_S3_PATH_STYLE=true`
 - `FLEET_S3_REGION=minio` or any non-empty string otherwise Fleet will attempt to derive the region.
 
+If you're testing file carving locally with the docker-compose environment, the `--dev` flag on Fleet server will
+automatically point carves to the local MinIO container and write to the `carves-dev` bucket without needing to set
+additional configuration. Note that this bucket is *not* created automatically when bringing MinIO up; you'll need to
+log in via `http://localhost:9001` with credentials `minio` / `minio123!` to create the bucket.
+
 ### Troubleshooting
 
 #### Check carve status in osquery
diff --git a/docs/Contributing/Simulate-slow-network.md b/docs/Contributing/Simulate-slow-network.md
index 3b342a0f3af4..6fa02d6f8384 100644
--- a/docs/Contributing/Simulate-slow-network.md
+++ b/docs/Contributing/Simulate-slow-network.md
@@ -7,6 +7,17 @@ The guide assumes you'll build and run the Fleet server locally with the `make f
 
 (Has been tested on macOS only.)
 
+## 0. Edit docker-compose.yml
+
+Add the following service to the main `docker-compose.yml`:
+```yml
+  toxiproxy:
+    image: shopify/toxiproxy
+    ports:
+      - "22220:22220"
+      - "8474:8474"
+```
+
 ## 1. Start services
 
 ```sh
@@ -44,4 +55,4 @@ curl -s -XPOST -d '{"type" : "latency", "attributes" : {"latency" : 1000, "jitte
 ```
 
 <meta name="pageOrderInSection" value="1400">
-<meta name="description" value="A guide for simulating slow connections from a local Fleet server to a Redis or MySQL database">
\ No newline at end of file
+<meta name="description" value="A guide for simulating slow connections from a local Fleet server to a Redis or MySQL database">
diff --git a/docs/Contributing/Testing-and-local-development.md b/docs/Contributing/Testing-and-local-development.md
index a3445e3ccdff..45c5a93fe0e8 100644
--- a/docs/Contributing/Testing-and-local-development.md
+++ b/docs/Contributing/Testing-and-local-development.md
@@ -81,6 +81,14 @@ REDIS_TEST=1 MYSQL_TEST=1 make test
 
 The integration tests in the `server/service` package can generate a lot of logs mixed with the test results output. To make it easier to identify a failing test in this package, you can set the `FLEET_INTEGRATION_TESTS_DISABLE_LOG=1` environment variable so that logging is disabled.
 
+The MDM integration tests are run with a random selection of software installer storage backends (local filesystem or S3/minio), and similar for the bootstrap packages storage (DB or S3/minio). You can force usage of the S3 backend by setting `FLEET_INTEGRATION_TESTS_SOFTWARE_INSTALLER_STORE=s3`. Note that `MINIO_STORAGE_TEST=1` must also be set for the S3 backend to be used.
+
+When the S3 backend is used, this line will be printed in the tests' output (as this could be relevant to understand and debug the test failure):
+
+```
+    integration_mdm_test.go:196: >>> using S3/minio software installer store
+```
+
 Note that on a Linux system, the Redis tests will include running in cluster mode, so the docker Redis Cluster setup must be running. This implies starting the docker dependencies as follows:
 
 ```sh
@@ -481,7 +489,9 @@ FLEET_SERVER_SANDBOX_ENABLED=1 FLEET_PACKAGING_GLOBAL_ENROLL_SECRET=xyz  ./build
 Be sure to replace the `FLEET_PACKAGING_GLOBAL_ENROLL_SECRET` value above with the global enroll
 secret from the `fleetctl package` command used to build the installers.
 
-MinIO also offers a web interface at http://localhost:9001. Credentials are `minio` / `minio123!`.
+MinIO also offers a web interface at http://localhost:9001. Credentials are `minio` / `minio123!`. When starting the
+Fleet server up with `--dev` the server will look for installers in the `software-installers-dev` MinIO bucket. You can
+create this bucket via the MinIO web UI (it is *not* created by default when setting up the docker-compose environment).
 
 ## Telemetry
 
diff --git a/docs/Using Fleet/Understanding-host-vitals.md b/docs/Contributing/Understanding-host-vitals.md
similarity index 99%
rename from docs/Using Fleet/Understanding-host-vitals.md
rename to docs/Contributing/Understanding-host-vitals.md
index 77b9e68ca954..3cdabf2fde06 100644
--- a/docs/Using Fleet/Understanding-host-vitals.md	
+++ b/docs/Contributing/Understanding-host-vitals.md
@@ -504,7 +504,7 @@ SELECT
   '' AS arch,
   '' AS installed_path
 FROM deb_packages
-WHERE status = 'install ok installed'
+WHERE status LIKE '% ok installed'
 UNION
 SELECT
   package AS name,
diff --git a/docs/Contributing/Vulnerability-processing.md b/docs/Contributing/Vulnerability-processing.md
index 5c111316fa2c..7a159bc000b2 100644
--- a/docs/Contributing/Vulnerability-processing.md
+++ b/docs/Contributing/Vulnerability-processing.md
@@ -11,7 +11,7 @@ For Fleet Premium users, each CVE includes its Common Vulnerability Scoring Syst
 Fleet's strategy for detecting vulnerabilities (CVEs) varies according to the host's platform and
 the software in question.
 
-### Windows/MacOS hosts using the NVD dataset
+### macOS, Windows, and Linux hosts using NVD
 
 First, Fleet retrieves the installed software for each host using osquery queries. Then, Fleet
 translates each installed software into [Common Platform Enumeration (CPE)](https://en.wikipedia.org/wiki/Common_Platform_Enumeration) names.
@@ -35,7 +35,7 @@ be able write a query to retrieve all CVEs).
 - Fleet combines two sources to get accurate and up-to-date CVE information:
   - [National Vulnerability Database](https://nvd.nist.gov/developers/vulnerabilities)'s CVE feeds.
   - [VulnCheck](https://vulncheck.com/)
-- To reduce the load and complexity of processing these datasets, Fleet uses two Github repositories (https://github.com/fleetdm/nvd and https://github.com/fleetdm/vulndb) that fetch, pre-process and expose the resulting dataset as Github releases.
+- To reduce the load and complexity of processing these datasets, Fleet uses two Github repositories (https://github.com/fleetdm/nvd and https://github.com/fleetdm/vulnerabilities) that fetch, pre-process and expose the resulting dataset as Github releases.
 - The Fleet servers then download these Github releases and run vulnerability processing using the downloaded datasets and the software information fetched from hosts.
 
 ```mermaid
@@ -78,19 +78,47 @@ information and what vulnerabilities were patched with the release, we then exam
 macOS apps and if an Office app is found we compare its version with the release notes metadata
 and report back any vulnerabilities to which the software is susceptible.
 
-### Linux hosts
+### Linux hosts (via OVAL)
 
 First, we determine what Linux distributions are part of your fleet (keep in mind that there will
-be a small delay between the time a new Linux hosts is added and the time the host is 'detected'). We then
-use
-that information to determine what OVAL definitions need to be downloaded and parsed - you can find
-a list of all the OVAL definitions we use
-[here](https://github.com/fleetdm/nvd/blob/master/oval_sources.json). OVAL definitions will be
+be a small delay between the time a new Linux host is added and the time the host is "detected"). We then
+use that information to determine what OVAL definitions need to be downloaded and parsed - you can find
+a list of all the OVAL definitions we use [here](https://github.com/fleetdm/nvd/blob/master/oval_sources.json). OVAL definitions will be
 refreshed on a daily basis.
 
+*NOTE:* Amazon Linux 2 is included in the OVAL mapping but vulnerabilities are no longer pulled via that file
+as of 4.56.0 due to false positives (Amazon backports fixes and releases updates independent of RHEL).
+
 Finally, we look at the software inventory of each host and execute the assertions contained in the
 corresponding OVAL file - any match is reported using the same channels as with Windows/Mac OS vulnerabilities
 
+#### Ubuntu kernel vulnerabilities
+
+For Ubuntu Linux, kernel vulnerabilities are detected against any installed kernel, even if it is not the actively running kernel.  
+
+Vulnerabilities are matched against software matching `linux-image.*` 
+(ie.`linux-image-5.4.0-163-generic`).
+
+The Canonical OVAL feed is opinionated on the linux
+variant (ie. `-generic`) when matching against vulnerabilities, so when Fleet detects a kernel variant not
+available in the OVAL feed, it uses the NVD feed to look for vulnerabilities matching the following
+CPE pattern:
+`cpe:2.3:o:linux:linux_kernel:*;*:*:*:*:*:*:*:*`
+
+### Amazon Linux hosts (via goval-dictionary)
+
+Amazon Linux uses [ALAS](https://alas.aws.amazon.com/) rather than OVAL files to provide vulnerability info. The
+[goval-dictionary](https://github.com/vulsio/goval-dictionary) tool supports fetching those bulletins into database
+formats including sqlite. The database contains mappings of CVEs to package releases where that CVE was fixed. We run
+this tool for each Amazon Linux version as part of the release process in https://github.com/fleetdm/vulnerabilities.
+
+As part of the (default hourly) vulnerabilities check run, we download the sqlite files for relevant OS versions (keep in
+mind that there will be a small delay between the time a new Linux host is added and the time the host is "detected"),
+then for each host check if each package on that host is mentioned in the database. For each package found, we report
+a vulnerability when the installed version of the package is older than the version where the vulnerability was fixed.
+
+ALAS does *not* use CPE lookups.
+
 ## Performance
 
 ### Windows/Mac OS
@@ -114,9 +142,9 @@ For example, when running a development instance of Fleet on an Apple Macbook Pr
 The CPU and memory usages are in burst once every hour (or the configured periodicity) on the
 instance that does the processing. RAM spikes are expected to not exceed the 2GBs.
 
-### Linux
+### Linux (OVAL)
 
-As with Windows/Mac OS, vulnerability detection for Linux is performed in a single Fleet instance. The
+As with Windows/Mac OS, vulnerability detection for Linux is performed on a single Fleet server. The
 files downloaded will vary depending on what distributions are on your fleet. The list of all the
 OVAL files we use can be found [here](https://github.com/fleetdm/nvd/blob/master/oval_sources.json).
 
@@ -138,6 +166,19 @@ The performance will be a function of three variables:
 That said, the performance characteristic should be linear (if scanning 200 hosts take
 ~20 seconds, then scanning 2000 hosts should take ~200 seconds).
 
+### Linux (goval-dictionary)
+
+As with OVAL, vulnerability detection for Linux via goval-dictionary is performed on a single Fleet server.
+Fleet will download one xz'd sqlite file per supported (see oval_platform.go -> IsGovalDictionarySupported) OS/version
+combination every time vulnerability scanning is run. OS version identifiers are constructed the same way
+as for OVAL, so Amazon Linux 2 becomes `amzn_02` and Amazon Linux 2023 becomes `amzn_2023`. sqlite databases are
+preprocessed as part of our vulnerabilities feed build, so are used as-is after download/extraction; the largest
+database is currently for Amazon Linux 2, at ~10 MiB. Filename format on disk is
+`fleet_goval_dictionary_platform.sqlite3`, corresponding to `platform.sqlite3` in the `vulnerabilities` repo releases.
+
+Like OVAL, execution time currently scales with the size of the database, the number of hosts to scan, and the number
+of packages installed. Scanning 2000 hosts will take about 10x longer than scanning 200 hosts.
+
 ## Detection pipeline
 
 There are several steps that go into the vulnerability detection process. In this section we'll dive into what they are and how it works.
@@ -171,7 +212,7 @@ The whole pipeline exists to compensate for these differences, and it can be div
       process2-->interval
   ```
 
-  ### Windows/Mac OS
+### Windows/Mac OS
 
   ```mermaid
   graph TD;
@@ -181,7 +222,7 @@ The whole pipeline exists to compensate for these differences, and it can be div
     cveDownload-->cveMap[CVE detection]
   ```
 
-  ### Linux
+### Linux (OVAL)
 
   ```mermaid
   graph TD;
@@ -193,6 +234,14 @@ The whole pipeline exists to compensate for these differences, and it can be div
     parse --> execute
   ```
 
+### Linux (goval-dictionary)
+
+  ```mermaid
+  graph TD;
+    process[Process Linux hosts] --> download(Download vulnerability databases from Fleet)
+    download --> execute(Match vulnerabilities to software older than fixed versions)
+  ```
+
 ### Ingesting software lists from hosts
 
 The ingestion of software varies per platform. We run a `UNION` of several queries in each:
diff --git a/docs/Contributing/fleetctl-apply.md b/docs/Contributing/fleetctl-apply.md
index 801e48c1cba3..dac4b256302c 100644
--- a/docs/Contributing/fleetctl-apply.md
+++ b/docs/Contributing/fleetctl-apply.md
@@ -2,7 +2,7 @@
 
 The `fleectl apply` command and YAML interface is used for one-off imports and backwards compatibility GitOps.
 
-To use Fleet's best practice GitOps, check out the GitOps docs [here](https://fleetdm.com/using-fleet/gitops).
+To use Fleet's best practice GitOps, check out the GitOps docs [here](https://fleetdm.com/docs/using-fleet/gitops).
 
 ## Queries
 
@@ -239,19 +239,12 @@ spec:
       macos_settings:
         custom_settings:
           - path: '/path/to/profile1.mobileconfig'
-            labels:
-              - Label name 1
           - path: '/path/to/profile2.mobileconfig'
           - path: '/path/to/profile3.mobileconfig'
-            labels:
-              - Label name 2
-              - Label name 3
         enable_disk_encryption: true
       windows_settings:
         custom_settings:
           - path: '/path/to/profile4.xml'
-            labels:
-              - Label name 4
           - path: '/path/to/profile5.xml'
     scripts:
         - path/to/script1.sh
@@ -345,7 +338,8 @@ List of saved scripts that can be run on hosts that are part of the team.
 
 - Default value: none
 - Config file format:
-  ```yaml
+
+```yaml
 apiVersion: v1
 kind: team
 spec:
@@ -354,7 +348,7 @@ spec:
     scripts:
       - path/to/script1.sh
       - path/to/script2.sh
-  ```
+```
 
 ## Organization settings
 
@@ -463,19 +457,12 @@ spec:
     macos_settings:
       custom_settings:
         - path: '/path/to/profile1.mobileconfig'
-          labels:
-            - Label name 1
         - path: '/path/to/profile2.mobileconfig'
         - path: '/path/to/profile3.mobileconfig'
-          labels:
-            - Label name 2
-            - Label name 3
       enable_disk_encryption: true
     windows_settings:
       custom_settings:
         - path: '/path/to/profile4.xml'
-          labels:
-            - Label name 4
         - path: '/path/to/profile5.xml'
 ```
 
diff --git a/docs/Deploy/Reference-Architectures.md b/docs/Deploy/Reference-Architectures.md
index 5241ea3b277b..285eb54d7a95 100644
--- a/docs/Deploy/Reference-Architectures.md
+++ b/docs/Deploy/Reference-Architectures.md
@@ -2,10 +2,10 @@
 
 ## The Fleet binary
 
-The Fleet application contains two single static binaries which provide web based administration, REST API, and CLI interface to Fleet.
+The Fleet application contains two single static binaries which provide web based administration, a REST API, and a [CLI interface](https://fleetdm.com/guides/fleetctl).
 
 The `fleet` binary contains:
-- The Fleet TLS web server (no external webserver is required but it supports a proxy if desired)
+- The [Fleet TLS web server](https://fleetdm.com/docs/configuration/fleet-server-configuration) (no external webserver is required but it supports a proxy if desired)
 - The Fleet web interface
 - The Fleet application management [REST API](https://fleetdm.com/docs/using-fleet/rest-api)
 - The Fleet osquery API endpoints
@@ -24,15 +24,15 @@ Fleet currently has three infrastructure dependencies: MySQL, Redis, and a TLS c
 ### MySQL
 
 Fleet uses MySQL extensively as its main database. Many cloud providers (such as [AWS](https://aws.amazon.com/rds/mysql/) and [GCP](https://cloud.google.com/sql/)) host reliable MySQL services which you may consider for this purpose. A well-supported MySQL [Docker image](https://hub.docker.com/_/mysql/) also exists if you would rather run MySQL in a container. 
-For more information on how to configure the `fleet` binary to use the correct MySQL instance, see the [Configuration](https://fleetdm.com/docs/deploying/configuration) document.
+For more information on how to configure the `fleet` binary to use the correct MySQL instance, see the [MySQL configuration](https://fleetdm.com/docs/configuration/fleet-server-configuration#mysql) documentation.
 
-Fleet requires at least MySQL version 5.7, and is tested using the InnoDB storage engine. 
+Fleet requires at least MySQL version 8.0, and is tested using the InnoDB storage engine. 
 
 There are many "drop-in replacements" for MySQL available. If you'd like to experiment with some bleeding-edge technology and use Fleet with one of these alternative database servers, we think that's awesome! Please be aware they are not officially supported and that it is very important to set up a dev environment to thoroughly test new releases. 
 
 ### Redis
 
-Fleet uses Redis to ingest and queue the results of distributed queries, cache data, etc. Many cloud providers (such as [AWS](https://aws.amazon.com/elasticache/) and [GCP](https://console.cloud.google.com/launcher/details/click-to-deploy-images/redis)) host reliable Redis services which you may consider for this purpose. A well supported Redis [Docker image](https://hub.docker.com/_/redis/) also exists if you would rather run Redis in a container. For more information on how to configure the `fleet` binary to use the correct Redis instance, see the [Configuration](https://fleetdm.com/docs/deploying/configuration) document.
+Fleet uses Redis to ingest and queue the results of distributed queries, cache data, etc. Many cloud providers (such as [AWS](https://aws.amazon.com/elasticache/) and [GCP](https://console.cloud.google.com/launcher/details/click-to-deploy-images/redis)) host reliable Redis services which you may consider for this purpose. A well supported Redis [Docker image](https://hub.docker.com/_/redis/) also exists if you would rather run Redis in a container. For more information on how to configure the `fleet` binary to use the correct Redis instance, see the [Redis configuration](https://fleetdm.com/docs/configuration/fleet-server-configuration#redis) documentation.
 
 ## Systemd
 
@@ -150,7 +150,7 @@ In some cases adding a read replica can increase database performance for specif
 
 #### Traffic load balancing
 Load balancing enables distributing request traffic over many instances of the backend application. Using AWS Application
-Load Balancer can also [offload SSL termination](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html), freeing Fleet to spend the majority of it's allocated compute dedicated 
+Load Balancer can also [offload SSL termination](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html), freeing Fleet to spend the majority of its allocated compute dedicated 
 to its core functionality. More details about ALB can be found [here](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html).
 
 _**Note if using [terraform reference architecture](https://github.com/fleetdm/fleet/tree/main/infrastructure/dogfood/terraform/aws#terraform) all configurations can dynamically scale based on load(cpu/memory) and all configurations
@@ -167,10 +167,11 @@ assume On-Demand pricing (savings are available through Reserved Instances). Cal
 | --------------- | ------------- | --- |
 | 1 Fargate task  | 512 CPU Units | 4GB |
 
-| Dependencies | Version                 | Instance type | Nodes |
-| ------------ | ----------------------- | ------------- | ----- |
-| Redis        | 6                       | t4g.small     | 3     |
-| MySQL        | 8.0.mysql_aurora.3.04.2 | db.t4g.medium | 2     |
+| Dependencies | Version                 | Instance type   | Nodes |
+| ------------ | ----------------------- | --------------- | ----- |
+| Redis        | 6                       | cache.t4g.small | 3     |
+| MySQL        | 8.0.mysql_aurora.3.04.2 | db.t4g.medium   | 2     |
+
 
 ###### [Up to 25000 hosts](https://calculator.aws/#/estimate?id=d735758715f059118dbce8dc42f3ff2410adc621)
 
@@ -178,10 +179,10 @@ assume On-Demand pricing (savings are available through Reserved Instances). Cal
 | --------------- | -------------- | --- |
 | 10 Fargate task | 1024 CPU Units | 4GB |
 
-| Dependencies | Version                 | Instance type | Nodes |
-| ------------ | ----------------------- | ------------- | ----- |
-| Redis        | 6                       | m6g.large     | 3     |
-| MySQL        | 8.0.mysql_aurora.3.04.2 | db.r6g.large  | 2     |
+| Dependencies | Version                 | Instance type   | Nodes |
+| ------------ | ----------------------- | --------------- | ----- |
+| Redis        | 6                       | cache.m6g.large | 3     |
+| MySQL        | 8.0.mysql_aurora.3.04.2 | db.r6g.large    | 2     |
 
 
 ###### [Up to 150000 hosts](https://calculator.aws/#/estimate?id=689fea65efff361ee070b15044a01224b8d26621)
@@ -190,10 +191,11 @@ assume On-Demand pricing (savings are available through Reserved Instances). Cal
 | --------------- | -------------- | --- |
 | 20 Fargate task | 1024 CPU Units | 4GB |
 
-| Dependencies | Version                 | Instance type  | Nodes |
-| ------------ | ----------------------- | -------------- | ----- |
-| Redis        | 6                       | m6g.large      | 3     |
-| MySQL        | 8.0.mysql_aurora.3.04.2 | db.r6g.4xlarge | 2     |
+| Dependencies | Version                 | Instance type   | Nodes |
+| ------------ | ----------------------- | --------------- | ----- |
+| Redis        | 6                       | cache.m6g.large | 3     |
+| MySQL        | 8.0.mysql_aurora.3.04.2 | db.r6g.4xlarge  | 2     |
+
 
 ###### [Up to 300000 hosts](https://calculator.aws/#/estimate?id=19b667fde567df0d64d9fae632d4885d7fdc726a)
 
@@ -203,7 +205,7 @@ assume On-Demand pricing (savings are available through Reserved Instances). Cal
 
 | Dependencies | Version                 | Instance type   | Nodes |
 | ------------ | ----------------------- | --------------- | ----- |
-| Redis        | 6                       | m6g.large       | 3     |
+| Redis        | 6                       | cache.m6g.large | 3     |
 | MySQL        | 8.0.mysql_aurora.3.04.2 | db.r6g.16xlarge | 2     |
 
 AWS reference architecture can be found [here](https://github.com/fleetdm/fleet/tree/main/terraform/example). This configuration includes:
@@ -277,7 +279,7 @@ The following permissions are the minimum required to apply AWS terraform resour
 GCP reference architecture can be found in [the Fleet repository](https://github.com/fleetdm/fleet/tree/main/infrastructure/dogfood/terraform/gcp). This configuration includes:
 
 - Cloud Run (Fleet backend)
-- Cloud SQL MySQL 5.7 (Fleet database)
+- Cloud SQL MySQL 8.0 (Fleet database)
 - Memorystore Redis (Fleet cache & live query orchestrator)
 
 GCP support for add/install software and file carve features is coming soon. Get [commmunity support](https://chat.osquery.io/c/fleet).
diff --git a/docs/Deploy/deploy-fleet.md b/docs/Deploy/deploy-fleet.md
index c0e80f4b2e88..ee5299bfc378 100644
--- a/docs/Deploy/deploy-fleet.md
+++ b/docs/Deploy/deploy-fleet.md
@@ -43,7 +43,7 @@ Render is a cloud hosting service that makes it easy to get up and running fast,
     </a>
 </div>
 
-1. Click "Deploy to Render" to open the Fleet Blueprint on Render. You will be prompted to create or log in to your Render account with associated payment information.
+1. Click "Deploy to Render" to open the Fleet Blueprint on Render. Ensure that the Redis instance is manually set to the same region as your other resources. You will be prompted to create or log in to your Render account with associated payment information.
 
 2. Give the Blueprint a unique name like `yourcompany-fleet`.
 
diff --git a/docs/Get started/FAQ.md b/docs/Get started/FAQ.md
index b6e04cd9699f..f06d7c550230 100644
--- a/docs/Get started/FAQ.md	
+++ b/docs/Get started/FAQ.md	
@@ -10,11 +10,11 @@ Fleet is simple enough to [spin up for yourself](https://fleetdm.com/docs/deploy
 
 ## What is the easiest way to deploy Fleet?
 
-Fleet provides a standard [Terraform module](https://fleetdm.com/docs/deploy/deploy-on-aws-with-terraform) that deploys Fleet with best practices, along with [cloud cost calculators and reference architectures](https://fleetdm.com/docs/deploy/reference-architectures#cloud-providers) used by some of Fleet’s largest customers with tens and hundreds of thousands of hosts.  Fleet Premium customers can also opt for managed hosting provided by Fleet.  You can also deploy Fleet anywhere you want.
+Take a look at [Deploying Fleet](https://fleetdm.com/docs/deploy/deploy-fleet) for guides on Render or deploy for scale with AWS Terraform. You can also deploy Fleet anywhere you want.
 
-You can enroll servers and laptops using a simple installer or automatically deliver Fleet's agent (fleetd) using your existing tools, such as Chef, Terraform, Munki/autopkg, Ansible, Puppet, Jamf, Intune, etc.
+You can enroll servers and laptops using a simple installer or automatically deliver Fleet's agent (fleetd) using your existing tools, such as Chef, Terraform, Munki/autopkg, Ansible, Puppet, Jamf, Intune, etc. As of [Fleet v4.53.0](https://fleetdm.com/releases/fleet-4.53.0), when Fleet's MDM is enabled for MacOS, fleetd is installed as part of the bootstrap.
 
-By default, Fleet keeps fleetd up to date automatically.  For self-managed instances, Fleet provides a [migration runner](https://fleetdm.com/docs/deploy/upgrading-fleet#upgrading-fleet).
+By default, Fleet keeps fleetd up to date automatically.  For self-managed instances, Fleet provides a [Simple upgrade process](https://fleetdm.com/docs/deploy/upgrading-fleet#upgrading-fleet).
 
 ## What options do I have for access control?  What about auditing admin activity?
 
@@ -45,6 +45,60 @@ When you collect data with Fleet, the [performance impact](https://fleetdm.com/r
 
 You can test changes on a small subset of hosts first, then roll them out to the rest of your organization.
 
+## What browsers does Fleet supported?
+
+Fleet supports the latest, stable releases of all major browsers and platforms.
+
+We test each browser on Windows whenever possible, because our engineering team primarily uses macOS.
+
+**Note:** This information also applies to [fleetdm.com](https://www.fleetdm.com).
+
+### Desktop
+
+- Chrome
+- Firefox
+- Edge
+- Safari (macOS only)
+
+### Mobile
+
+- Mobile Safari on iOS
+- Mobile Chrome on Android
+
+### Note
+> - Mobile web is not yet supported in the Fleet product.
+> - The Fleet user interface [may not be fully supported](https://github.com/fleetdm/fleet/issues/969) in Google Chrome when the browser is running on ChromeOS.
+
+## What host operating systems does Fleet support?
+
+Fleet supports the following operating system versions on hosts. 
+
+| OS      | Supported version(s)                    |
+| :------ | :-------------------------------------  |
+| macOS   | 13+ (Ventura)                           |
+| Windows | Pro and Enterprise 10+, Server 2012+    |
+| Linux   | CentOS 7.1+,  Ubuntu 20.04+, Fedora 38+ |
+| ChromeOS | 112.0.5615.134+                        |
+
+While Fleet may still function partially or fully with OS versions older than those above, Fleet does not actively test against unsupported versions and does not pursue bugs on them. 
+
+## Some notes on compatibility
+
+### Tables
+Not all osquery tables are available for every OS. Please check out the [osquery schema](https://fleetdm.com/tables) for detailed information. 
+
+If a table is not available for your host, Fleet will generally handle things behind the scenes for you.
+
+### Linux
+
+Fleet Desktop is supported on Ubuntu and Fedora. 
+
+Fedora requires a [gnome extension](https://extensions.gnome.org/extension/615/appindicator-support/) and Google Chrome for Fleet Desktop.
+
+On Ubuntu, Fleet Desktop currently supports Xorg as X11 server, Wayland is currently not supported. Ubuntu 24.04 comes with Wayland enabled by default. To use X11 instead of Wayland you can set `WaylandEnable=false` in `/etc/gdm3/custom.conf` and reboot.
+
+The `fleetctl package` command is not supported on DISA-STIG distribution.
+
 ## Is Fleet MIT licensed?
 
 Different portions of the Fleet software are licensed differently, as noted in the [LICENSE](https://github.com/fleetdm/fleet/blob/main/LICENSE) file. The majority of Fleet is MIT licensed. Paid features require a license key.
@@ -71,7 +125,7 @@ Different portions of the Fleet software are licensed differently, as noted in t
 
 ## How do I contact Fleet for support?
 
-A lot of questions can be answered [in the documentation](https://fleetdm.com/docs).
+A lot of questions can be answered [in the documentation](https://fleetdm.com/docs) or [guides](https://fleetdm.com/guides).
 
 To get help from the community, visit https://fleetdm.com/support.
 
@@ -124,6 +178,8 @@ Run `sudo apt remove fleet-osquery -y`
 Run `sudo rpm -e fleet-osquery-X.Y.Z.x86_64`
 
 <!--
+Mike T: In 2023 we made the decision to comment out the following questions because the FAQs had become a dumping ground for miscellaneous content that wasn't quite reference docs and wasn't quite committed learning docs (suitable for articles). We chose to hide the content rather than remove, or spend time trying to figure out better places in the docs, with the assumption that if it's important enough content, someone will circle back at some point to prioritize a better home.
+
 ## Using Fleet
 
 ### How can I switch to Fleet from Kolide Fleet?
@@ -592,7 +648,7 @@ This could be caused by a mismatched connection limit between the Fleet server a
 
 ### Why am I receiving a database connection error when attempting to "prepare" the database?
 
-First, check if you have a version of MySQL installed that is at least 5.7. Then, make sure that you currently have a MySQL server running.
+First, check if you have a version of MySQL installed that is at least 8.0. Then, make sure that you currently have a MySQL server running.
 
 The next step is to make sure the credentials for the database match what is expected. Test your ability to connect to the database with `mysql -u<username> -h<hostname_or_ip> -P<port> -D<database_name> -p`.
 
@@ -612,7 +668,7 @@ Yes! Please sign up for the [Fleet Cloud Beta](https://kqphpqst851.typeform.com/
 
 ### What MySQL versions are supported?
 
-Fleet is tested with MySQL 5.7.21 and 8.0.28. Newer versions of MySQL 5.7 and MySQL 8 typically work well. AWS Aurora requires at least version 2.10.0. Please avoid using MariaDB or other MySQL variants that are not officially supported. Compatibility issues have been identified with MySQL variants, and these may not be addressed in future Fleet releases.
+Fleet is tested with MySQL 8.0.36. Newer versions of MySQL 8 typically work well. AWS Aurora requires at least version 3.07.0. Please avoid using MariaDB or other MySQL variants that are not officially supported. Compatibility issues have been identified with MySQL variants, and these may not be addressed in future Fleet releases.
 
 ### What are the MySQL user requirements?
 
@@ -675,7 +731,7 @@ If you would like to use Fleet's MDM features, the following endpoints need to b
 
 ### What is the minimum version of MySQL required by Fleet?
 
-Fleet requires at least MySQL version 5.7.
+Fleet requires at least MySQL version 8.0.
 
 ### How do I migrate from Fleet Free to Fleet Premium?
 
diff --git a/docs/Get started/tutorials-and-guides.md b/docs/Get started/tutorials-and-guides.md
index 0b1584f6a389..f83de79f27db 100644
--- a/docs/Get started/tutorials-and-guides.md	
+++ b/docs/Get started/tutorials-and-guides.md	
@@ -1,71 +1,29 @@
 # Tutorials and guides
 
-A collection of guides to help you get up and running with Fleet.
-
-## Deployment guides
-
-- [Deploy Fleet on Render](http://fleetdm.com/deploy/deploying-fleet-on-render)
-
-- [Deploy Fleet on AWS](http://fleetdm.com/deploy/deploying-fleet-on-aws-with-terraform)
-
-- [Deploy Fleet on Hetzner Cloud](http://fleetdm.com/deploy/deploy-fleet-on-hetzner-cloud)
-
-- [Deploy Fleet on AWS ECS](https://fleetdm.com/docs/deploy/deploy-fleet-on-aws-ecs)
-
-- [Deploy Fleet on CentOS](https://fleetdm.com/docs/deploy/deploy-fleet-on-centos)
-
-- [Deploy Fleet on Cloud.gov](https://fleetdm.com/docs/deploy/cloudgov)
-
-- [Deploy Fleet on Kubernetes](https://fleetdm.com/docs/deploy/deploy-fleet-on-kubernetes)
-
-## How-to guides
-
-- [Querying process_file_events on CentOS 7](https://fleetdm.com/guides/querying-process-file-events-table-on-centos-7)
-
-- [Using GitHub Actions to apply configuration profiles with Fleet](https://fleetdm.com/guides/using-github-actions-to-apply-configuration-profiles-with-fleet)
-
-- [Building an effective dashboard with Fleet's REST API, Flask, and Plotly: A step-by-step guide](https://fleetdm.com/guides/building-an-effective-dashboard-with-fleet-rest-api-flask-and-plotly)
-
-- [Discovering Geacon using Fleet](https://fleetdm.com/guides/discovering-geacon-using-fleet)
-
-- [Using Fleet and Okta Workflows to generate a daily OS report](https://fleetdm.com/guides/using-fleet-and-okta-workflows-to-generate-a-daily-os-report)
-
-- [Using Fleet and Tines together](https://fleetdm.com/guides/using-fleet-and-tines-together)
-
-- [How to use Fleet for zero trust attestation](https://fleetdm.com/guides/zero-trust-attestation-with-fleet)
-
-- [How to use osquery evented tables](https://fleetdm.com/guides/osquery-evented-tables-overview)
-
-- [Enrolling a DigitalOcean Droplet on a Fleet instance](https://fleetdm.com/guides/enrolling-a-digital-ocean-droplet-on-a-fleet-instance)
-
-- [Osquery: a tool to easily ask questions about operating systems](https://fleetdm.com/guides/osquery-a-tool-to-easily-ask-questions-about-operating-systems)
-
-- [How to install osquery and enroll Linux devices into Fleet](https://fleetdm.com/guides/how-to-install-osquery-and-enroll-linux-devices-into-fleet)
-
-- [How to install osquery and enroll Windows devices into Fleet](https://fleetdm.com/guides/how-to-install-osquery-and-enroll-windows-devices-into-fleet)
-
-- [Delivering data to Snowflake from Fleet and osquery.](https://fleetdm.com/guides/delivering-data-to-snowflake-from-fleet-and-osquery)
-
-- [How to install osquery and enroll macOS devices into Fleet](https://fleetdm.com/guides/how-to-install-osquery-and-enroll-macos-devices-into-fleet)
-
-- [How to uninstall osquery](https://fleetdm.com/guides/how-to-uninstall-osquery)
-
-- [Converting unix timestamps with osquery](https://fleetdm.com/guides/converting-unix-timestamps-with-osquery)
-
-- [Correlate network connections with community ID in osquery.](https://fleetdm.com/guides/correlate-network-connections-with-community-id-in-osquery)
-
-- [Using Elasticsearch and Kibana to visualize osquery performance](https://fleetdm.com/guides/using-elasticsearch-and-kibana-to-visualize-osquery-performance)
-
-- [Fleet quick tips — identify systems where the ProcDump EULA has been accepted](https://fleetdm.com/guides/fleet-quick-tips-querying-procdump-eula-has-been-accepted)
-
-- [Locate device assets in the event of an emergency.](https://fleetdm.com/guides/locate-assets-with-osquery)
-
-- [Osquery: Consider joining against the users table](https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table)
-
-- [Import and export queries in Fleet](https://fleetdm.com/guides/import-and-export-queries-in-fleet)
-
-- [Generate process trees with osquery](https://fleetdm.com/guides/generate-process-trees-with-osquery)
-
+A collection of guides to help you with Fleet.
+
+- [How to install osquery and enroll macOS devices into Fleet](https://fleetdm.com/guides/how-to-install-osquery-and-enroll-macos-devices-into-fleet)  
+- [How to install osquery and enroll Linux devices into Fleet](https://fleetdm.com/guides/how-to-install-osquery-and-enroll-linux-devices-into-fleet)  
+- [How to install osquery and enroll Windows devices into Fleet](https://fleetdm.com/guides/how-to-install-osquery-and-enroll-windows-devices-into-fleet)  
+- [Sysadmin diaries: restoring fleetd](https://fleetdm.com/guides/sysadmin-diaries-restoring-fleetd)  
+- [How to uninstall osquery](https://fleetdm.com/guides/how-to-uninstall-osquery)  
+- [Sysadmin diaries: device enrollment](https://fleetdm.com/guides/sysadmin-diaries-device-enrollment)  
+- [Sysadmin diaries: passcode profiles](https://fleetdm.com/guides/sysadmin-diaries-passcode-profiles)  
+- [Sysadmin diaries: lost device](https://fleetdm.com/guides/sysadmin-diaries-lost-device)  
+- [Windows MDM setup](https://fleetdm.com/guides/windows-mdm-setup)  
+- [Using GitHub Actions to apply configuration profiles with Fleet](https://fleetdm.com/guides/using-github-actions-to-apply-configuration-profiles-with-fleet)  
+- [Managing labels in Fleet](https://fleetdm.com/guides/managing-labels-in-fleet)  
+- [What are Fleet policies?](https://fleetdm.com/securing/what-are-fleet-policies)  
+- [Understanding the intricacies of Fleet policies](https://fleetdm.com/guides/understanding-the-intricacies-of-fleet-policies)  
+- [Sysadmin diaries: exporting policies](https://fleetdm.com/guides/sysadmin-diaries-exporting-policies)  
+- [Locate device assets in the event of an emergency](https://fleetdm.com/guides/locate-assets-with-osquery)  
+- [Osquery: Consider joining against the users table](https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table)  
+- [Using Fleet and Okta Workflows to generate a daily OS report](https://fleetdm.com/guides/using-fleet-and-okta-workflows-to-generate-a-daily-os-report)  
+- [How to configure logging destinations](https://fleetdm.com/guides/how-to-configure-logging-destinations)  
+- [Import and export queries in Fleet](https://fleetdm.com/guides/import-and-export-queries-in-fleet)  
+- [Certificates in fleetd](https://fleetdm.com/guides/certificates-in-fleetd)
+
+<a style="text-decoration: none;" href="https://fleetdm.com/guides"><animated-arrow-button>See all guides</animated-arrow-button></a>
 
 <meta name="description" value="Links to deployment tutorials and guides for using Fleet.">
 <meta name="pageOrderInSection" value="300">
diff --git a/docs/README.md b/docs/README.md
index 681d2624a7ff..fbd4aa311816 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -4,10 +4,10 @@ Welcome to the documentation for Fleet, the lightweight management platform for
 
 > You can also read the Fleet docs over at https://fleetdm.com/docs.
 
-### [Using Fleet](./Using-Fleet/README.md)
+### [Using Fleet](./Using%20Fleet/README.md)
 Resources for using the Fleet UI, fleetctl CLI, and Fleet REST API.
 
-### [Deploying](./Deploying/README.md)
+### [Deploying](./Deploy/README.md)
 Resources for installing Fleet's infrastructure dependencies, configuring Fleet, deploying osquery to hosts, and viewing example deployment scenarios.
 
 ### [Contributing](./Contributing/README.md)
diff --git a/docs/REST API/rest-api.md b/docs/REST API/rest-api.md
index f0aa46f2c95d..da63c0ccb5e6 100644
--- a/docs/REST API/rest-api.md	
+++ b/docs/REST API/rest-api.md	
@@ -887,6 +887,14 @@ None.
       "minimum_version": "12.3.1",
       "deadline": "2022-01-01"
     },
+    "ios_updates": {
+      "minimum_version": "17.0.1",
+      "deadline": "2024-08-01"
+    },
+    "ipados_updates": {
+      "minimum_version": "17.0.1",
+      "deadline": "2024-08-01"
+    },
     "windows_updates": {
       "deadline_days": 5,
       "grace_period_days": 1
@@ -1068,23 +1076,23 @@ Modifies the Fleet's configuration with the supplied information.
 
 #### Parameters
 
-| Name                              | Type    | In    | Description   |
-| ---------------------             | ------- | ----  | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| org_info          | object  | body  | See [org_info](#org-info). |
-| server_settings         | object  | body    | See [server_settings](#server-settings). |
-| smtp_settings         | object  | body    | See [smtp_settings](#smtp-settings). |
-| sso_settings         | object  | body    | See [sso_settings](#sso-settings). |
-| host_expiry_settings         | object  | body    | See [host_expiry_settings](#host-expiry-settings). |
-| activity_expiry_settings         | object  | body    | See [activity_expiry_settings](#activity-expiry-settings). |
-| agent_options                     | objects | body  | The agent_options spec that is applied to all hosts. In Fleet 4.0.0 the `api/v1/fleet/spec/osquery_options` endpoints were removed.                                                    |
-| fleet_desktop         | object  | body    | See [fleet_desktop](#fleet-desktop). |
-| webhook_settings      | object  | body    | See [webhook_settings](#webhook-settings). |
-| integrations                      | object  | body  | Includes `jira`, `zendesk`, and `google_calendar` arrays. See [integrations](#integrations) for details. |
-| mdm      | object  | body    | See [mdm](#mdm). |
-| features          | object  | body    | See [features](#features). |
-| scripts                           | list    | body  | A list of script files to add so they can be executed at a later time.                                                                                                                                                 |
-| force                             | boolean | query | Whether to force-apply the agent options even if there are validation errors.                                                                                                 |
-| dry_run                           | boolean | query | Whether to validate the configuration and return any validation errors **without** applying changes.                                                                         |
+| Name                     | Type    | In    | Description   |
+| -----------------------  | ------- | ----  | ------------------------------------------------------------------------------------------------------------------------------------ |
+| org_info                 | object  | body  | See [org_info](#org-info).                                                                                                           |
+| server_settings          | object  | body  | See [server_settings](#server-settings).                                                                                             |
+| smtp_settings            | object  | body  | See [smtp_settings](#smtp-settings).                                                                                                 |
+| sso_settings             | object  | body  | See [sso_settings](#sso-settings).                                                                                                   |
+| host_expiry_settings     | object  | body  | See [host_expiry_settings](#host-expiry-settings).                                                                                   |
+| activity_expiry_settings | object  | body  | See [activity_expiry_settings](#activity-expiry-settings).                                                                           |
+| agent_options            | objects | body  | The agent_options spec that is applied to all hosts. In Fleet 4.0.0 the `api/v1/fleet/spec/osquery_options` endpoints were removed.  |
+| fleet_desktop            | object  | body  | See [fleet_desktop](#fleet-desktop).                                                                                                 |
+| webhook_settings         | object  | body  | See [webhook_settings](#webhook-settings).                                                                                           |
+| integrations             | object  | body  | Includes `jira`, `zendesk`, and `google_calendar` arrays. See [integrations](#integrations) for details.                             |
+| mdm                      | object  | body  | See [mdm](#mdm).                                                                                                                     |
+| features                 | object  | body  | See [features](#features).                                                                                                           |
+| scripts                  | array   | body  | A list of script files to add so they can be executed at a later time.                                                               |
+| force                    | boolean | query | Whether to force-apply the agent options even if there are validation errors.                                                        |
+| dry_run                  | boolean | query | Whether to validate the configuration and return any validation errors **without** applying changes.                                 |
 
 
 #### Example
@@ -1113,7 +1121,7 @@ Modifies the Fleet's configuration with the supplied information.
   },
   "server_settings": {
     "server_url": "https://localhost:8080",
-    "enable_analytics": true, 
+    "enable_analytics": true,
     "live_query_disabled": false,
     "query_reports_disabled": false,
     "ai_features_disabled": false
@@ -1172,6 +1180,14 @@ Modifies the Fleet's configuration with the supplied information.
       "minimum_version": "12.3.1",
       "deadline": "2022-01-01"
     },
+    "ios_updates": {
+      "minimum_version": "17.0.1",
+      "deadline": "2024-08-01"
+    },
+    "ipados_updates": {
+      "minimum_version": "17.0.1",
+      "deadline": "2024-08-01"
+    },
     "windows_updates": {
       "deadline_days": 5,
       "grace_period_days": 1
@@ -1180,11 +1196,11 @@ Modifies the Fleet's configuration with the supplied information.
       "custom_settings": [
         {
           "path": "path/to/profile1.mobileconfig",
-          "labels": ["Label 1", "Label 2"]
+          "labels_exclude_any": ["Label 1", "Label 2"]
         },
         {
           "path": "path/to/profile2.json",
-          "labels": ["Label 3", "Label 4"]
+          "labels_include_all": ["Label 3", "Label 4"]
         },
       ]
     },
@@ -1192,9 +1208,9 @@ Modifies the Fleet's configuration with the supplied information.
       "custom_settings": [
         {
           "path": "path/to/profile3.xml",
-          "labels": ["Label 1", "Label 2"]
+          "labels_exclude_any": ["Label 1", "Label 2"]
         }
-      ]     
+      ]
     },
     "end_user_authentication": {
       "entity_id": "",
@@ -1310,11 +1326,11 @@ Modifies the Fleet's configuration with the supplied information.
 #### org_info
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| org_name                          | string  | The organization name.                                                                                                                                     |
-| org_logo_url                      | string  | The URL for the organization logo.                                                                                                                         |
-| org_logo_url_light_background     | string  | The URL for the organization logo displayed in Fleet on top of light backgrounds.                                                                          |
-| contact_url                       | string  | A URL that can be used by end users to contact the organization.                                                                                          |
+| ---------------------             | ------- | ----------------------------------------------------------------------------------- |
+| org_name                          | string  | The organization name.                                                              |
+| org_logo_url                      | string  | The URL for the organization logo.                                                  |
+| org_logo_url_light_background     | string  | The URL for the organization logo displayed in Fleet on top of light backgrounds.   |
+| contact_url                       | string  | A URL that can be used by end users to contact the organization.                    |
 
 <br/>
 
@@ -1334,12 +1350,13 @@ Modifies the Fleet's configuration with the supplied information.
 #### server_settings
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| server_url                        | string  | The Fleet server URL.                                                       |
-| enable_analytics                  | boolean | Whether to send anonymous usage statistics. Always enabled for Fleet Premium customers.                                                                             |
-| live_query_disabled               | boolean | Whether the live query capabilities are disabled.                                                                                                                   |
-| query_reports_disabled            | boolean | Whether query report capabilities are disabled.                                                                                                                   |
-| ai_features_disabled              | boolean | Whether AI features are disabled. |
+| ---------------------             | ------- | ------------------------------------------------------------------------------------------- |
+| server_url                        | string  | The Fleet server URL.                                                                       |
+| enable_analytics                  | boolean | Whether to send anonymous usage statistics. Always enabled for Fleet Premium customers.     |
+| live_query_disabled               | boolean | Whether the live query capabilities are disabled.                                           |
+| query_reports_disabled            | boolean | Whether query report capabilities are disabled.                                             |
+| ai_features_disabled              | boolean | Whether AI features are disabled.                                                           |
+| query_report_cap                  | integer | The maximum number of results to store per query report before the report is clipped. If increasing this cap, we recommend enabling reports for one query at time and monitoring your infrastructure. (Default: `1000`) |
 
 <br/>
 
@@ -1360,7 +1377,7 @@ Modifies the Fleet's configuration with the supplied information.
 #### smtp_settings
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| ---------------------             | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | enable_smtp                       | boolean | Whether SMTP is enabled for the Fleet app.                                                                                                                            |
 | sender_address                    | string  | The sender email address for the Fleet app. An invitation email is an example of the emails that may use this sender address                                          |
 | server                            | string  | The SMTP server for the Fleet app.                                                                                                                                    |
@@ -1400,13 +1417,13 @@ Modifies the Fleet's configuration with the supplied information.
 #### sso_settings
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| ---------------------             | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | enable_sso                        | boolean | Whether or not SSO is enabled for the Fleet application. If this value is true, you must also include most of the SSO settings parameters below.                       |
-| entity_id                         | string  | The required entity ID is a URI that you use to identify Fleet when configuring the identity provider.                                                                 |
+| entity_id                         | string  | The required entity ID is a URI that you use to identify Fleet when configuring the identity provider. Must be 5 or more characters.                                   |
 | issuer_uri                        | string  | The URI you provide here must exactly match the Entity ID field used in the identity provider configuration.                                                           |
 | idp_image_url                     | string  | An optional link to an image such as a logo for the identity provider.                                                                                                 |
-| metadata_url                      | string  | A URL that references the identity provider metadata. If available from the identity provider, this is the preferred means of providing metadata.                      |
-| metadata                            | string  |  Metadata provided by the identity provider. Either `metadata` or a `metadata_url` must be provided. |
+| metadata_url                      | string  | A URL that references the identity provider metadata. If available from the identity provider, this is the preferred means of providing metadata. Must be either https or http |
+| metadata                          | string  |  Metadata provided by the identity provider. Either `metadata` or a `metadata_url` must be provided.                                                                   |
 | enable_sso_idp_login              | boolean | Determines whether Identity Provider (IdP) initiated login for Single sign-on (SSO) is enabled for the Fleet application.                                              |
 | enable_jit_provisioning           | boolean | _Available in Fleet Premium._ When enabled, allows [just-in-time user provisioning](https://fleetdm.com/docs/deploy/single-sign-on-sso#just-in-time-jit-user-provisioning). |
 
@@ -1433,9 +1450,9 @@ Modifies the Fleet's configuration with the supplied information.
 #### host_expiry_settings
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | host_expiry_enabled               | boolean | When enabled, allows automatic cleanup of hosts that have not communicated with Fleet in some number of days.                                                  |
-| host_expiry_window                | integer | If a host has not communicated with Fleet in the specified number of days, it will be removed.                                                                 |
+| host_expiry_window                | integer | If a host has not communicated with Fleet in the specified number of days, it will be removed. Must be greater than 0 if host_expiry_enabled is set to true.   |
 
 <br/>
 
@@ -1453,9 +1470,9 @@ Modifies the Fleet's configuration with the supplied information.
 #### activity_expiry_settings
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| activity_expiry_enabled           | boolean | When enabled, allows automatic cleanup of activities (and associated live query data) older than the specified number of days.                                                          |
-| activity_expiry_window            | integer | The number of days to retain activity records, if activity expiry is enabled.   |
+| ---------------------             | ------- | --------------------------------------------------------------------------------------------------------------------------------- |
+| activity_expiry_enabled           | boolean | When enabled, allows automatic cleanup of activities (and associated live query data) older than the specified number of days.    |
+| activity_expiry_window            | integer | The number of days to retain activity records, if activity expiry is enabled.                                                     |
 
 <br/>
 
@@ -1475,8 +1492,8 @@ Modifies the Fleet's configuration with the supplied information.
 _Available in Fleet Premium._
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| transparency_url                  | string  | The URL used to display transparency information to users of Fleet Desktop.                                                      |
+| ---------------------             | ------- | -------------------------------------------------------------------------------- |
+| transparency_url                  | string  | The URL used to display transparency information to users of Fleet Desktop.      |
 
 <br/>
 
@@ -1499,12 +1516,12 @@ _Available in Fleet Premium._
 + [`webhook_settings.activities_webhook`](#webhook-settings-activities-webhook)
 -->
 
-| Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| host_status_webhook             | list  | See [`webhook_settings.host_status_webhook`](#webhook-settings-host-status-webhook). |
-| failing_policies_webhook             | list  | See [`webhook_settings.failing_policies_webhook`](#webhook-settings-failing-policies-webhook). |
-| vulnerabilities_webhook             | list  | See [`webhook_settings.vulnerabilities_webhook`](#webhook-settings-vulnerabilities-webhook). |
-| activities_webhook             | list  | See [`webhook_settings.activities_webhook`](#webhook-settings-activities-webhook). |
+| Name                              | Type  | Description   |
+| ---------------------             | ----- | ---------------------------------------------------------------------------------------------- |
+| host_status_webhook               | array | See [`webhook_settings.host_status_webhook`](#webhook-settings-host-status-webhook).           |
+| failing_policies_webhook          | array | See [`webhook_settings.failing_policies_webhook`](#webhook-settings-failing-policies-webhook). |
+| vulnerabilities_webhook           | array | See [`webhook_settings.vulnerabilities_webhook`](#webhook-settings-vulnerabilities-webhook).   |
+| activities_webhook                | array | See [`webhook_settings.activities_webhook`](#webhook-settings-activities-webhook).             |
 
 <br/>
 
@@ -1513,11 +1530,11 @@ _Available in Fleet Premium._
 `webhook_settings.host_status_webhook` is an object with the following structure:
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| enable_host_status_webhook        | boolean | Whether or not the host status webhook is enabled.                                                                 |
-| destination_url                   | string  | The URL to deliver the webhook request to.                                                     |
-| host_percentage                   | integer | The minimum percentage of hosts that must fail to check in to Fleet in order to trigger the webhook request.                                                              |
-| days_count                        | integer | The minimum number of days that the configured `host_percentage` must fail to check in to Fleet in order to trigger the webhook request.                                |
+| ---------------------             | ------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| enable_host_status_webhook        | boolean | Whether or not the host status webhook is enabled.                                                                                          |
+| destination_url                   | string  | The URL to deliver the webhook request to.                                                                                                  |
+| host_percentage                   | integer | The minimum percentage of hosts that must fail to check in to Fleet in order to trigger the webhook request.                                |
+| days_count                        | integer | The minimum number of days that the configured `host_percentage` must fail to check in to Fleet in order to trigger the webhook request.    |
 
 <br/>
 
@@ -1526,9 +1543,9 @@ _Available in Fleet Premium._
 `webhook_settings.failing_policies_webhook` is an object with the following structure:
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| enable_failing_policies_webhook   | boolean | Whether or not the failing policies webhook is enabled. |
-| destination_url                   | string  | The URL to deliver the webhook requests to.                                                     |
+| ---------------------             | ------- | ------------------------------------------------------------------------------------------------------------------- |
+| enable_failing_policies_webhook   | boolean | Whether or not the failing policies webhook is enabled.                                                             |
+| destination_url                   | string  | The URL to deliver the webhook requests to.                                                                         |
 | policy_ids                        | array   | List of policy IDs to enable failing policies webhook.                                                              |
 | host_batch_size                   | integer | Maximum number of hosts to batch on failing policy webhook requests. The default, 0, means no batching (all hosts failing a policy are sent on one request). |
 
@@ -1539,9 +1556,9 @@ _Available in Fleet Premium._
 `webhook_settings.vulnerabilities_webhook` is an object with the following structure:
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| enable_vulnerabilities_webhook    | boolean | Whether or not the vulnerabilities webhook is enabled. |
-| destination_url                   | string  | The URL to deliver the webhook requests to.                                                     |
+| ---------------------             | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| enable_vulnerabilities_webhook    | boolean | Whether or not the vulnerabilities webhook is enabled.                                                                                                  |
+| destination_url                   | string  | The URL to deliver the webhook requests to.                                                                                                             |
 | host_batch_size                   | integer | Maximum number of hosts to batch on vulnerabilities webhook requests. The default, 0, means no batching (all vulnerable hosts are sent on one request). |
 
 <br/>
@@ -1551,9 +1568,9 @@ _Available in Fleet Premium._
 `webhook_settings.activities_webhook` is an object with the following structure:
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| enable_activities_webhook         | boolean | Whether or not the activity feed webhook is enabled. |
-| destination_url                   | string  | The URL to deliver the webhook requests to.                                                     |
+| ---------------------             | ------- | --------------------------------------------------------- |
+| enable_activities_webhook         | boolean | Whether or not the activity feed webhook is enabled.      |
+| destination_url                   | string  | The URL to deliver the webhook requests to.               |
 
 <br/>
 
@@ -1595,11 +1612,11 @@ _Available in Fleet Premium._
 + [`integrations.google_calendar`](#integrations-google-calendar)
 -->
 
-| Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| jira             | list  | See [`integrations.jira`](#integrations-jira). |
-| zendesk             | list  | See [`integrations.zendesk`](#integrations-zendesk). |
-| google_calendar             | list  | See [`integrations.google_calendar`](#integrations-google-calendar). |
+| Name                  | Type  | Description   |
+| --------------------- | ----- | -------------------------------------------------------------------- |
+| jira                  | array | See [`integrations.jira`](#integrations-jira).                       |
+| zendesk               | array | See [`integrations.zendesk`](#integrations-zendesk).                 |
+| google_calendar       | array | See [`integrations.google_calendar`](#integrations-google-calendar). |
 
 
 > Note that when making changes to the `integrations` object, all integrations must be provided (not just the one being modified). This is because the endpoint will consider missing integrations as deleted.
@@ -1641,8 +1658,8 @@ _Available in Fleet Premium._
 `integrations.google_calendar` is an array of objects with the following structure:
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| domain                            | string  | The domain for the Google Workspace service account to be used for this calendar integration. |
+| ---------------------             | ------- | --------------------------------------------------------------------------------------------------------------------- |
+| domain                            | string  | The domain for the Google Workspace service account to be used for this calendar integration.                         |
 | api_key_json                      | object  | The private key JSON downloaded when generating the service account API key to be used for this calendar integration. |
 
 <br/>
@@ -1679,8 +1696,11 @@ _Available in Fleet Premium._
 | ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | apple_bm_default_team             | string  | _Available in Fleet Premium._ The default team to use with Apple Business Manager. |
 | windows_enabled_and_configured    | boolean | Enables Windows MDM support. |
-| enable_disk_encryption            | boolean | _Available in Fleet Premium._ Hosts that belong to no team and are enrolled into Fleet's MDM will have disk encryption enabled if set to true. |
+| enable_disk_encryption            | boolean | _Available in Fleet Premium._ Hosts that belong to no team will have disk encryption enabled if set to true. |
 | macos_updates         | object  | See [`mdm.macos_updates`](#mdm-macos-updates). |
+| ios_updates         | object  | See [`mdm.ios_updates`](#mdm-ios-updates). |
+| ipados_updates         | object  | See [`mdm.ipados_updates`](#mdm-ipados-updates). |
+| windows_updates         | object  | See [`mdm.window_updates`](#mdm-windows-updates). |
 | macos_migration         | object  | See [`mdm.macos_migration`](#mdm-macos-migration). |
 | macos_setup         | object  | See [`mdm.macos_setup`](#mdm-macos-setup). |
 | macos_settings         | object  | See [`mdm.macos_settings`](#mdm-macos-settings). |
@@ -1696,7 +1716,33 @@ _Available in Fleet Premium._
 
 | Name                              | Type    | Description   |
 | ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| minimum_version                   | string  | Hosts that belong to no team and are enrolled into Fleet's MDM will be nudged until their macOS is at or above this version. |
+| minimum_version                   | string  | Hosts that belong to no team will be nudged until their macOS is at or above this version. |
+| deadline                          | string  | Hosts that belong to no team won't be able to dismiss the Nudge window once this deadline is past. |
+
+<br/>
+
+##### mdm.ios_updates
+
+_Available in Fleet Premium._
+
+`mdm.ios_updates` is an object with the following structure:
+
+| Name                              | Type    | Description   |
+| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| minimum_version                   | string  | Hosts that belong to no team and are enrolled into Fleet's MDM will be nudged until their iOS is at or above this version. |
+| deadline                          | string  | Hosts that belong to no team and are enrolled into Fleet's MDM won't be able to dismiss the Nudge window once this deadline is past. |
+
+<br/>
+
+##### mdm.ipados_updates
+
+_Available in Fleet Premium._
+
+`mdm.ipados_updates` is an object with the following structure:
+
+| Name                              | Type    | Description   |
+| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| minimum_version                   | string  | Hosts that belong to no team and are enrolled into Fleet's MDM will be nudged until their iPadOS is at or above this version. |
 | deadline                          | string  | Hosts that belong to no team and are enrolled into Fleet's MDM won't be able to dismiss the Nudge window once this deadline is past. |
 
 <br/>
@@ -1709,8 +1755,8 @@ _Available in Fleet Premium._
 
 | Name                              | Type    | Description   |
 | ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| deadline_days                     | integer | Hosts that belong to no team and are enrolled into Fleet's MDM will have this number of days before updates are installed on Windows. |
-| grace_period_days                 | integer | Hosts that belong to no team and are enrolled into Fleet's MDM will have this number of days before Windows restarts to install updates. |
+| deadline_days                     | integer | Hosts that belong to no team will have this number of days before updates are installed on Windows. |
+| grace_period_days                 | integer | Hosts that belong to no team will have this number of days before Windows restarts to install updates. |
 
 <br/>
 
@@ -1746,7 +1792,7 @@ _Available in Fleet Premium._
 
 | Name                              | Type    | Description   |
 | ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| custom_settings                   | list    | macOS hosts that belong to no team, and are members of specified labels will have custom profiles applied. |
+| custom_settings                   | array   | macOS hosts that belong to no team will have custom profiles applied. |
 
 <br/>
 
@@ -1756,7 +1802,7 @@ _Available in Fleet Premium._
 
 | Name                              | Type    | Description   |
 | ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| custom_settings                   | list    | Windows hosts that belong to no team, and are members of specified labels will have custom profiles applied. |
+| custom_settings                   | array   | Windows hosts that belong to no team will have custom profiles applied. |
 
 <br/>
 
@@ -2053,7 +2099,7 @@ Delete all of a team's existing enroll secrets
 | email       | string  | body | **Required.** The email of the invited user. This email will receive the invitation link.                                                             |
 | name        | string  | body | **Required.** The name of the invited user.                                                                                                           |
 | sso_enabled | boolean | body | **Required.** Whether or not SSO will be enabled for the invited user.                                                                                |
-| teams       | list    | body | _Available in Fleet Premium_. A list of the teams the user is a member of. Each item includes the team's ID and the user's role in the specified team. |
+| teams       | array   | body | _Available in Fleet Premium_. A list of the teams the user is a member of. Each item includes the team's ID and the user's role in the specified team. |
 
 #### Example
 
@@ -2253,7 +2299,7 @@ Verify the specified invite.
 | email       | string  | body | The email of the invited user. Updates on the email won't resend the invitation.                                                             |
 | name        | string  | body | The name of the invited user.                                                                                                           |
 | sso_enabled | boolean | body | Whether or not SSO will be enabled for the invited user.                                                                                |
-| teams       | list    | body | _Available in Fleet Premium_. A list of the teams the user is a member of. Each item includes the team's ID and the user's role in the specified team. |
+| teams       | array   | body | _Available in Fleet Premium_. A list of the teams the user is a member of. Each item includes the team's ID and the user's role in the specified team. |
 
 #### Example
 
@@ -2377,7 +2423,6 @@ None.
 - [Get host OS version](#get-host-os-version)
 - [Get host's scripts](#get-hosts-scripts)
 - [Get host's software](#get-hosts-software)
-- [Install software](#install-software)
 - [Get hosts report in CSV](#get-hosts-report-in-csv)
 - [Get host's disk encryption key](#get-hosts-disk-encryption-key)
 - [Lock host](#lock-host)
@@ -2444,6 +2489,7 @@ the `software` table.
 | mdm_id                  | integer | query | The ID of the _mobile device management_ (MDM) solution to filter hosts by (that is, filter hosts that use a specific MDM provider and URL).                                                                                                                                                                                                |
 | mdm_name                | string  | query | The name of the _mobile device management_ (MDM) solution to filter hosts by (that is, filter hosts that use a specific MDM provider).                                                                                                                                                                                                |
 | mdm_enrollment_status   | string  | query | The _mobile device management_ (MDM) enrollment status to filter hosts by. Valid options are 'manual', 'automatic', 'enrolled', 'pending', or 'unenrolled'.                                                                                                                                                                                                             |
+| connected_to_fleet   | boolean  | query | Filter hosts that are talking to this Fleet server for MDM features. In rare cases, hosts can be enrolled to one Fleet server but talk to a different Fleet server for MDM features. In this case, the value would be `false`. Always `false` for Linux hosts.                                                                                                                           |
 | macos_settings          | string  | query | Filters the hosts by the status of the _mobile device management_ (MDM) profiles applied to hosts. Valid options are 'verified', 'verifying', 'pending', or 'failed'. **Note: If this filter is used in Fleet Premium without a team ID filter, the results include only hosts that are not assigned to any team.**                                                                                                                                                                                                             |
 | munki_issue_id          | integer | query | The ID of the _munki issue_ (a Munki-reported error or warning message) to filter hosts by (that is, filter hosts that are affected by that corresponding error or warning message).                                                                                                                                                        |
 | low_disk_space          | integer | query | _Available in Fleet Premium_. Filters the hosts to only include hosts with less GB of disk space available than this value. Must be a number between 1-100.                                                                                                                                                                                  |
@@ -2790,6 +2836,18 @@ Returns the count of all hosts organized by status. `online_count` includes all
       "name": "All Linux",
       "description": "All Linux distributions",
       "label_type": "builtin"
+    },
+    {
+      "id": 13,
+      "name": "iOS",
+      "description": "All iOS hosts",
+      "label_type": "builtin"
+    },
+    {
+      "id": 14,
+      "name": "iPadOS",
+      "description": "All iPadOS hosts",
+      "label_type": "builtin"
     }
   ],
   "platforms": [
@@ -2801,6 +2859,14 @@ Returns the count of all hosts organized by status. `online_count` includes all
       "platform": "darwin",
       "hosts_count": 1234
     },
+    {
+      "platform": "ios",
+      "hosts_count": 1234
+    },
+    {
+      "platform": "ipados",
+      "hosts_count": 1234
+    },
     {
       "platform": "rhel",
       "hosts_count": 1234
@@ -3029,11 +3095,16 @@ Returns the information of the specified host.
         "coordinates": [40.6799, -74.0028]
       }
     },
+    "maintenance_window": {
+      "starts_at": "2024-06-18T13:27:18−04:00",
+      "timezone": "America/New_York"
+    },
     "mdm": {
-      "encryption_key_available": false,
-      "enrollment_status": null,
-      "name": "",
-      "server_url": null,
+      "encryption_key_available": true,
+      "enrollment_status": "On (manual)",
+      "name": "Fleet",
+      "connected_to_fleet": true,
+      "server_url": "https://acme.com/mdm/apple/mdm",
       "device_status": "unlocked",
       "pending_action": "",
       "macos_settings": {
@@ -3077,18 +3148,18 @@ Returns the information of the specified host.
 
 ### Get host by identifier
 
-Returns the information of the host specified using the `uuid`, `hardware_serial`, `osquery_host_id`, `hostname`, or
-`node_key` as an identifier.
+Returns the information of the host specified using the `hostname`, `uuid`, or `hardware_serial` as an identifier.
 
-If `hostname` is specified when there is more than one host with the same hostname, the endpoint returns the first matching host. In Fleet, hostnames are fully qualified domain names (FQDNs).
+If `hostname` is specified when there is more than one host with the same hostname, the endpoint returns the first matching host. In Fleet, hostnames are fully qualified domain names (FQDNs). `hostname` (e.g. johns-macbook-air.local) is not the same as `display_name` (e.g. John's MacBook Air).
 
 `GET /api/v1/fleet/hosts/identifier/:identifier`
 
 #### Parameters
 
-| Name       | Type              | In   | Description                                                                   |
-| ---------- | ----------------- | ---- | ----------------------------------------------------------------------------- |
-| identifier | integer or string | path | **Required**. The host's `hardware_serial`, `uuid`, `osquery_host_id`, `hostname`, or `node_key` |
+| Name       | Type              | In   | Description                                                        |
+| ---------- | ----------------- | ---- | ------------------------------------------------------------------ |
+| identifier | string | path | **Required**. The host's `hostname`, `uuid`, or `hardware_serial`. |
+| exclude_software | boolean | query | If `true`, the response will not include a list of installed software for the host. |
 
 #### Example
 
@@ -3449,10 +3520,11 @@ This is the API route used by the **My device** page in Fleet desktop to display
       }
     ],
     "mdm": {
-      "encryption_key_available": false,
-      "enrollment_status": null,
-      "name": "",
-      "server_url": null,
+      "encryption_key_available": true,
+      "enrollment_status": "On (manual)",
+      "name": "Fleet",
+      "connected_to_fleet": true,
+      "server_url": "https://acme.com/mdm/apple/mdm",
       "macos_settings": {
         "disk_encryption": null,
         "action_required": null
@@ -3479,6 +3551,7 @@ This is the API route used by the **My device** page in Fleet desktop to display
       ]
     }
   },
+  "self_service": true,
   "org_logo_url": "https://example.com/logo.jpg",
   "license": {
     "tier": "free",
@@ -3626,7 +3699,7 @@ _Available in Fleet Premium_
 
 | Name    | Type    | In   | Description                                                                                                                                                                                                                                                                                                                        |
 | ------- | ------- | ---- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| ids     | list    | body | A list of the host IDs you'd like to delete. If `ids` is specified, `filters` cannot be specified.                                                                                                                                                                                                                                                           |
+| ids     | array   | body | A list of the host IDs you'd like to delete. If `ids` is specified, `filters` cannot be specified.                                                                                                                                                                                                                                                           |
 | filters | object  | body | Contains any of the following four properties: `query` for search query keywords. Searchable fields include `hostname`, `hardware_serial`, `uuid`, and `ipv4`. `status` to indicate the status of the hosts to return. Can either be `new`, `online`, `offline`, `mia` or `missing`. `label_id` to indicate the selected label. `team_id` to indicate the selected team. If `filters` is specified, `id` cannot be specified. `label_id` and `status` cannot be used at the same time. |
 
 Either ids or filters are required.
@@ -4081,139 +4154,6 @@ Resends a configuration profile for the specified host.
 
 `Status: 202`
 
-
-### List host OS versions
-
-Retrieves the aggregated host OS versions information.
-
-`GET /api/v1/fleet/os_versions`
-
-#### Parameters
-
-| Name                | Type     | In    | Description                                                                                                                          |
-| ---      | ---      | ---   | ---                                                                                                                                  |
-| team_id             | integer | query | _Available in Fleet Premium_. Filters response data to the specified team.  |
-| platform            | string   | query | Filters the hosts to the specified platform |
-| os_name     | string | query | The name of the operating system to filter hosts by. `os_version` must also be specified with `os_name`                                                 |
-| os_version    | string | query | The version of the operating system to filter hosts by. `os_name` must also be specified with `os_version`                                                 |
-| page                    | integer | query | Page number of the results to fetch.                                                                                                                                       |
-| per_page                | integer | query | Results per page.                                                                                                                                                          |
-| order_key               | string  | query | What to order results by. Allowed fields are: `hosts_count`. Default is `hosts_count` (descending).      |
-| order_direction | string | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`. |
-
-
-##### Default response
-
-`Status: 200`
-
-```json
-{
-  "count": 1
-  "counts_updated_at": "2023-12-06T22:17:30Z",
-  "os_versions": [
-    {
-      "os_version_id": 123,
-      "hosts_count": 21,
-      "name": "Microsoft Windows 11 Pro 23H2 10.0.22621.1234",
-      "name_only": "Microsoft Windows 11 Pro 23H2",
-      "version": "10.0.22621.1234",
-      "platform": "windows",
-      "generated_cpes": [],
-      "vulnerabilities": [
-        {
-          "cve": "CVE-2022-30190",
-          "details_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-30190",
-          "cvss_score": 7.8,// Available in Fleet Premium
-          "epss_probability": 0.9729,// Available in Fleet Premium
-          "cisa_known_exploit": false,// Available in Fleet Premium
-          "cve_published": "2022-06-01T00:15:00Z",// Available in Fleet Premium
-          "cve_description": "Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability.",// Available in Fleet Premium
-          "resolved_in_version": ""// Available in Fleet Premium
-        }
-      ]
-    }
-  ],
-  "meta": {
-    "has_next_results": false,
-    "has_previous_results": false
-  }
-}
-```
-
-OS vulnerability data is currently available for Windows and macOS. For other platforms, `vulnerabilities` will be an empty array:
-
-```json
-{
-  "hosts_count": 1,
-  "name": "CentOS Linux 7.9.2009",
-  "name_only": "CentOS",
-  "version": "7.9.2009",
-  "platform": "rhel",
-  "generated_cpes": [],
-  "vulnerabilities": []
-}
-```
-
-### Get host OS version
-
-Retrieves information about the specified OS version.
-
-`GET /api/v1/fleet/os_versions/:id`
-
-#### Parameters
-
-| Name | Type | In | Description |
-| ---- | ---- | -- | ----------- |
-| id   | integer | path | **Required.** The OS version's ID. |
-
-##### Default response
-
-`Status: 200`
-
-```json
-{
-  "counts_updated_at": "2023-12-06T22:17:30Z",
-  "os_version": {
-    "id": 123,
-    "hosts_count": 21,
-    "name": "Microsoft Windows 11 Pro 23H2 10.0.22621.1234",
-    "name_only": "Microsoft Windows 11 Pro 23H2",
-    "version": "10.0.22621.1234",
-    "platform": "windows",
-    "generated_cpes": [],
-    "vulnerabilities": [
-      {
-        "cve": "CVE-2022-30190",
-        "details_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-30190",
-        "created_at": "2024-07-01T00:15:00Z",
-        "cvss_score": 7.8,// Available in Fleet Premium
-        "epss_probability": 0.9729,// Available in Fleet Premium
-        "cisa_known_exploit": false,// Available in Fleet Premium
-        "cve_published": "2022-06-01T00:15:00Z",// Available in Fleet Premium
-        "cve_description": "Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability.",// Available in Fleet Premium
-        "resolved_in_version": ""// Available in Fleet Premium
-      }
-    ]
-  }
-}
-```
-
-OS vulnerability data is currently available for Windows and macOS. For other platforms, `vulnerabilities` will be an empty array:
-
-```json
-{
-  "id": 321,
-  "hosts_count": 1,
-  "name": "CentOS Linux 7.9.2009",
-  "name_only": "CentOS",
-  "version": "7.9.2009",
-  "platform": "rhel",
-  "generated_cpes": [],
-  "vulnerabilities": []
-}
-```
-
-
 ### Get host's scripts
 
 `GET /api/v1/fleet/hosts/:id/scripts`
@@ -4235,45 +4175,46 @@ OS vulnerability data is currently available for Windows and macOS. For other pl
 `Status: 200`
 
 ```json
-  "scripts": [
-    {
-      "script_id": 3,
-      "name": "remove-zoom-artifacts.sh",
-      "last_execution": {
-        "execution_id": "e797d6c6-3aae-11ee-be56-0242ac120002",
-        "executed_at": "2021-12-15T15:23:57Z",
-        "status": "error"
-      }
-    },
-    {
-      "script_id": 5,
-      "name": "set-timezone.sh",
-      "last_execution": {
-        "id": "e797d6c6-3aae-11ee-be56-0242ac120002",
-        "executed_at": "2021-12-15T15:23:57Z",
-        "status": "pending"
-      }
-    },
-    {
-      "script_id": 8,
-      "name": "uninstall-zoom.sh",
-      "last_execution": {
-        "id": "e797d6c6-3aae-11ee-be56-0242ac120002",
-        "executed_at": "2021-12-15T15:23:57Z",
-        "status": "ran"
-      }
+"scripts": [
+  {
+    "script_id": 3,
+    "name": "remove-zoom-artifacts.sh",
+    "last_execution": {
+      "execution_id": "e797d6c6-3aae-11ee-be56-0242ac120002",
+      "executed_at": "2021-12-15T15:23:57Z",
+      "status": "error"
+    }
+  },
+  {
+    "script_id": 5,
+    "name": "set-timezone.sh",
+    "last_execution": {
+      "id": "e797d6c6-3aae-11ee-be56-0242ac120002",
+      "executed_at": "2021-12-15T15:23:57Z",
+      "status": "pending"
+    }
+  },
+  {
+    "script_id": 8,
+    "name": "uninstall-zoom.sh",
+    "last_execution": {
+      "id": "e797d6c6-3aae-11ee-be56-0242ac120002",
+      "executed_at": "2021-12-15T15:23:57Z",
+      "status": "ran"
     }
-  ],
-  "meta": {
-    "has_next_results": false,
-    "has_previous_results": false
   }
+],
+"meta": {
+  "has_next_results": false,
+  "has_previous_results": false
 }
 
 ```
 
 ### Get host's software
 
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
 `GET /api/v1/fleet/hosts/:id/software`
 
 #### Parameters
@@ -4282,6 +4223,7 @@ OS vulnerability data is currently available for Windows and macOS. For other pl
 | ---- | ------- | ---- | ---------------------------- |
 | id   | integer | path | **Required**. The host's ID. |
 | query   | string | query | Search query keywords. Searchable fields include `name`. |
+| available_for_install | boolean | query | If `true` or `1`, only list software that is available for install (added by the user). Default is `false`.  
 | page | integer | query | Page number of the results to fetch.|
 | per_page | integer | query | Results per page.|
 
@@ -4300,16 +4242,20 @@ OS vulnerability data is currently available for Windows and macOS. For other pl
     {
       "id": 121,
       "name": "Google Chrome.app",
-      "package_available_for_install": "GoogleChrome.pkg",
-      "self_service": true,
+      "software_package": {
+        "name": "GoogleChrome.pkg",
+        "version": "125.12.0.3",
+        "self_service": true,
+        "last_install": {
+          "install_uuid": "8bbb8ac2-b254-4387-8cba-4d8a0407368b",
+          "installed_at": "2024-05-15T15:23:57Z"
+        },
+      },
+      "app_store_app": null
       "source": "apps",
       "status": "failed",
-      "last_install": {
-        "install_uuid": "8bbb8ac2-b254-4387-8cba-4d8a0407368b",
-        "installed_at": "2024-05-15T15:23:57Z"
-      },
       "installed_versions": [
-        { 
+        {
           "version": "121.0",
           "last_opened_at": "2024-04-01T23:03:07Z",
           "vulnerabilities": ["CVE-2023-1234","CVE-2023-4321","CVE-2023-7654"],
@@ -4320,32 +4266,36 @@ OS vulnerability data is currently available for Windows and macOS. For other pl
     {
       "id": 134,
       "name": "Falcon.app",
-      "package_available_for_install": "FalconSensor-6.44.pkg",
-      "self_service": false,
+      "software_package": {
+        "name": "FalconSensor-6.44.pkg"
+        "self_service": false,
+        "last_install": null
+      },
+      "app_store_app": null    
       "source": "",
       "status": null,
-      "last_install": null,
       "installed_versions": [],
     },
     {
       "id": 147,
-      "name": "Firefox.app",
+      "name": "Logic Pro",
+      "software_package": null
+      "app_store_app": {
+        "app_store_id": "1091189122"
+        "version": "2.04",
+        "last_install": {
+          "command_uuid": "0aa14ae5-58fe-491a-ac9a-e4ee2b3aac40",
+          "installed_at": "2024-05-15T15:23:57Z"
+        },
+      },
       "source": "apps",
-      "bundle_identifier": "org.mozilla.firefox",
-      "status": null,
-      "last_install": null,
+      "status": "installed",
       "installed_versions": [
         {
           "version": "118.0",
           "last_opened_at": "2024-04-01T23:03:07Z",
           "vulnerabilities": ["CVE-2023-1234"],
-          "installed_paths": ["/Applications/Firefox.app"]
-        },
-        { 
-          "version": "119.0",
-          "last_opened_at": "2024-04-01T23:03:07Z",
-          "vulnerabilities": ["CVE-2023-4321","CVE-2023-7654"],
-          "installed_paths": ["/Downloads/Firefox.app"]
+          "installed_paths": ["/Applications/Logic Pro.app"]
         }
       ]
     },
@@ -4357,29 +4307,6 @@ OS vulnerability data is currently available for Windows and macOS. For other pl
 }
 ```
 
-### Install software
-
-_Available in Fleet Premium._
-
-Install software on a macOS, Windows, or Linux (Ubuntu) host. Software title must have `software_package` added to be installed.
-
-`POST /api/v1/fleet/hosts/:id/software/install/:software_title_id`
-
-#### Parameters
-
-| Name              | Type       | In   | Description                                      |
-| ---------         | ---------- | ---- | --------------------------------------------     |
-| id                | integer    | path | **Required**. The host's ID.                     |
-| software_title_id | integer    | path | **Required**. The software title's ID.           |
-
-#### Example
-
-`POST /api/v1/fleet/hosts/123/software/install/3435`
-
-##### Default response
-
-`Status: 202`
-
 ### Get hosts report in CSV
 
 Returns the list of hosts corresponding to the search criteria in CSV format, ready for download when
@@ -4396,8 +4323,8 @@ requested by a web browser.
 | order_key               | string  | query | What to order results by. Can be any column in the hosts table.                                                                                                                                                                                                                                                                             |
 | order_direction         | string  | query | **Requires `order_key`**. The direction of the order given the order key. Options include 'asc' and 'desc'. Default is 'asc'.                                                                                                                                                                                                               |
 | status                  | string  | query | Indicates the status of the hosts to return. Can either be 'new', 'online', 'offline', 'mia' or 'missing'.                                                                                                                                                                                                                                  |
-| query                   | string  | query | Search query keywords. Searchable fields include `hostname`, `hardware_serial`, `uuid`, `ipv4` and the hosts' email addresses (only searched if the query looks like an email address, i.e. contains an `@`, no space, etc.).                                                                                                                |
-| team_id                 | integer | query | _Available in Fleet Premium_. Filters the hosts to only include hosts in the specified team.                                                                                                                                                                                                                                                 |
+| query                   | string  | query | Search query keywords. Searchable fields include `hostname`, `hardware_serial`, `uuid`, `ipv4` and the hosts' email addresses (only searched if the query looks like an email address, i.e. contains an `@`, no space, etc.).                                                                                                               |
+| team_id                 | integer | query | _Available in Fleet Premium_. Filters the hosts to only include hosts in the specified team.                                                                                                                                                                                                                                                |
 | policy_id               | integer | query | The ID of the policy to filter hosts by.                                                                                                                                                                                                                                                                                                    |
 | policy_response         | string  | query | **Requires `policy_id`**. Valid options are 'passing' or 'failing'. **Note: If `policy_id` is specified _without_ including `policy_response`, this will also return hosts where the policy is not configured to run or failed to run.** |
 | software_version_id     | integer | query | The ID of the software version to filter hosts by.                                                                                                            |
@@ -4407,11 +4334,11 @@ requested by a web browser.
 | os_version              | string  | query | The version of the operating system to filter hosts by. `os_name` must also be specified with `os_version`                                                                                                                                                                                                                                  |
 | vulnerability           | string  | query | The cve to filter hosts by (including "cve-" prefix, case-insensitive).                                                                                                                                                                                                                                                                     |
 | mdm_id                  | integer | query | The ID of the _mobile device management_ (MDM) solution to filter hosts by (that is, filter hosts that use a specific MDM provider and URL).                                                                                                                                                                                                |
-| mdm_name                | string  | query | The name of the _mobile device management_ (MDM) solution to filter hosts by (that is, filter hosts that use a specific MDM provider).                                                                                                                                                                                                |
-| mdm_enrollment_status   | string  | query | The _mobile device management_ (MDM) enrollment status to filter hosts by. Valid options are 'manual', 'automatic', 'enrolled', 'pending', or 'unenrolled'.                                                                                                                                                                                                             |
+| mdm_name                | string  | query | The name of the _mobile device management_ (MDM) solution to filter hosts by (that is, filter hosts that use a specific MDM provider).                                                                                                                                                                                                      |
+| mdm_enrollment_status   | string  | query | The _mobile device management_ (MDM) enrollment status to filter hosts by. Valid options are 'manual', 'automatic', 'enrolled', 'pending', or 'unenrolled'.                                                                                                                                                                                 |
 | macos_settings          | string  | query | Filters the hosts by the status of the _mobile device management_ (MDM) profiles applied to hosts. Valid options are 'verified', 'verifying', 'pending', or 'failed'. **Note: If this filter is used in Fleet Premium without a team ID filter, the results include only hosts that are not assigned to any team.**                                                                                                                                                                                                             |
 | munki_issue_id          | integer | query | The ID of the _munki issue_ (a Munki-reported error or warning message) to filter hosts by (that is, filter hosts that are affected by that corresponding error or warning message).                                                                                                                                                        |
-| low_disk_space          | integer | query | _Available in Fleet Premium_. Filters the hosts to only include hosts with less GB of disk space available than this value. Must be a number between 1-100.                                                                                                                                                                                  |
+| low_disk_space          | integer | query | _Available in Fleet Premium_. Filters the hosts to only include hosts with less GB of disk space available than this value. Must be a number between 1-100.                                                                                                                                                                                 |
 | label_id                | integer | query | A valid label ID. Can only be used in combination with `order_key`, `order_direction`, `status`, `query` and `team_id`.                                                                                                                                                                                                                     |
 | bootstrap_package       | string | query | _Available in Fleet Premium_. Filters the hosts by the status of the MDM bootstrap package on the host. Valid options are 'installed', 'pending', or 'failed'. **Note: If this filter is used in Fleet Premium without a team ID filter, the results include only hosts that are not assigned to any team.** |
 | disable_failing_policies | boolean | query | If `true`, hosts will return failing policies as 0 (returned as the `issues` column) regardless of whether there are any that failed for the host. This is meant to be used when increased performance is needed in exchange for the extra information.      |
@@ -4583,9 +4510,9 @@ To unlock a Windows or Linux host, the host must have [scripts enabled](https://
 
 ### Wipe host
 
-Sends a command to wipe the specified macOS, Windows, or Linux host. The host is wiped once it comes online.
+Sends a command to wipe the specified macOS, iOS, iPadOS, Windows, or Linux host. The host is wiped once it comes online.
 
-To wipe a macOS or Windows host, the host must have MDM turned on. To lock a Linux host, the host must have [scripts enabled](https://fleetdm.com/docs/using-fleet/scripts).
+To wipe a macOS, iOS, iPadOS, or Windows host, the host must have MDM turned on. To lock a Linux host, the host must have [scripts enabled](https://fleetdm.com/docs/using-fleet/scripts).
 
 `POST /api/v1/fleet/hosts/:id/wipe`
 
@@ -4689,7 +4616,7 @@ To wipe a macOS or Windows host, the host must have MDM turned on. To lock a Lin
 
 ```json
 {
-  "count": 2,
+  "count": 3,
   "activities": [
     {
       "created_at": "2023-07-27T14:35:08Z",
@@ -4733,15 +4660,15 @@ To wipe a macOS or Windows host, the host must have MDM turned on. To lock a Lin
 
 ### Add labels to host
 
-Adds manual labels to a host. 
+Adds manual labels to a host.
 
 `POST /api/v1/fleet/hosts/:id/labels`
 
 #### Parameters
 
-| Name | Type    | In   | Description                  |
-| ---- | ------- | ---- | ---------------------------- |
-| labels   | list | body | The list of label names to add to the host. |
+| Name   | Type    | In   | Description                  |
+| ------ | ------- | ---- | ---------------------------- |
+| labels | array   | body | The list of label names to add to the host. |
 
 
 #### Example
@@ -4768,9 +4695,9 @@ Removes manual labels from a host.
 
 #### Parameters
 
-| Name | Type    | In   | Description                  |
-| ---- | ------- | ---- | ---------------------------- |
-| labels   | list | body | The list of label names to delete from the host. |
+| Name   | Type    | In   | Description                  |
+| ------ | ------- | ---- | ---------------------------- |
+| labels | array   | body | The list of label names to delete from the host. |
 
 
 #### Example
@@ -4802,8 +4729,8 @@ The live query will stop if the targeted host is offline, or if the query times
 
 | Name      | Type  | In   | Description                                                                                                                                                        |
 |-----------|-------|------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| id       | integer  | path | **Required**. The target host ID. |
-| query            | string   | body | **Required**. The query SQL. |
+| id        | integer  | path | **Required**. The target host ID. |
+| query     | string   | body | **Required**. The query SQL. |
 
 
 #### Example
@@ -5365,8 +5292,8 @@ Add a configuration profile to enforce custom settings on macOS and Windows host
 | ------------------------- | -------- | ---- | ------------------------------------------------------------------------------------------------------------- |
 | profile                   | file     | form | **Required.** The .mobileconfig and JSON for macOS or XML for Windows file containing the profile. |
 | team_id                   | string   | form | _Available in Fleet Premium_. The team ID for the profile. If specified, the profile is applied to only hosts that are assigned to the specified team. If not specified, the profile is applied to only to hosts that are not assigned to any team. |
-| labels                    | array     | form | _Available in Fleet Premium_. An array of labels to filter hosts in a team (or no team) that should get a profile. |
-
+| labels_include_all        | array     | form | _Available in Fleet Premium_. Profile will only be applied to hosts that have all of these labels. Only one of either `labels_include_all` or `labels_exclude_any` can be included in the request. |
+| labels_exclude_any | array | form | _Available in Fleet Premium_. Profile will be applied to hosts that don’t have any of these labels. Only one of either `labels_include_all` or `labels_exclude_any` can be included in the request. |
 
 #### Example
 
@@ -5391,11 +5318,11 @@ Content-Disposition: form-data; name="team_id"
 
 1
 --------------------------f02md47480und42y
-Content-Disposition: form-data; name="labels"
+Content-Disposition: form-data; name="labels_include_all"
 
 Label name 1
 --------------------------f02md47480und42y
-Content-Disposition: form-data; name="labels"
+Content-Disposition: form-data; name="labels_include_all"
 
 Label name 2
 --------------------------f02md47480und42y
@@ -5481,9 +5408,10 @@ List all configuration profiles for macOS and Windows hosts enrolled to Fleet's
       "created_at": "2023-03-31T00:00:00Z",
       "updated_at": "2023-03-31T00:00:00Z",
       "checksum": "dGVzdAo=",
-      "labels": [
+      "labels_exclude_any": [
        {
-        "name": "Label name 1"
+        "name": "Label name 1",
+        "id": 1
        }
       ]
     },
@@ -5495,14 +5423,15 @@ List all configuration profiles for macOS and Windows hosts enrolled to Fleet's
       "created_at": "2023-04-31T00:00:00Z",
       "updated_at": "2023-04-31T00:00:00Z",
       "checksum": "aCLemVr)",
-      "labels": [
-       {
-         "name": "Label name 1",
-         "broken": true
-       },
-       {
-         "name": "Label name 2"
-       }
+      "labels_include_all": [
+        {
+          "name": "Label name 2",
+          "broken": true,
+        },
+        {
+          "name": "Label name 3",
+          "id": 3
+        }
       ]
     }
   ],
@@ -5546,13 +5475,15 @@ If one or more assigned labels are deleted the profile is considered broken (`br
   "created_at": "2023-03-31T00:00:00Z",
   "updated_at": "2023-03-31T00:00:00Z",
   "checksum": "dGVzdAo=",
-  "labels": [
+  "labels_include_all": [
     {
       "name": "Label name 1",
+      "id": 1
       "broken": true
     },
     {
       "name": "Label name 2",
+      "id": 2
     }
   ]
 }
@@ -6186,12 +6117,12 @@ Body: <blob>
 
 ## Commands
 
-- [Run custom MDM command](#run-custom-mdm-command)
-- [Get custom MDM command results](#get-custom-mdm-command-results)
-- [List custom MDM commands](#list-custom-mdm-commands)
+- [Run MDM command](#run-mdm-command)
+- [Get MDM command results](#get-mdm-command-results)
+- [List MDM commands](#list-mdm-commands)
 
 
-### Run custom MDM command
+### Run MDM command
 
 > `POST /api/v1/fleet/mdm/apple/enqueue` API endpoint is deprecated as of Fleet 4.40. It is maintained for backward compatibility. Please use the new API endpoint below. See old API endpoint docs [here](https://github.com/fleetdm/fleet/blob/fleet-v4.39.0/docs/REST%20API/rest-api.md#run-custom-mdm-command).
 
@@ -6224,12 +6155,22 @@ Note that the `EraseDevice` and `DeviceLock` commands are _available in Fleet Pr
 ```
 
 
-### Get custom MDM command results
+### Get MDM command results
 
 > `GET /api/v1/fleet/mdm/apple/commandresults` API endpoint is deprecated as of Fleet 4.40. It is maintained for backward compatibility. Please use the new API endpoint below. See old API endpoint docs [here](https://github.com/fleetdm/fleet/blob/fleet-v4.39.0/docs/REST%20API/rest-api.md#get-custom-mdm-command-results).
 
 This endpoint returns the results for a specific custom MDM command.
 
+In the reponse, the possible `status` values for macOS, iOS, and iPadOS hosts are the following:
+
+* Pending: the command has yet to run on the host. The host will run the command the next time it comes online.
+* NotNow: the host responded with "NotNow" status via the MDM protocol: the host received the command, but couldn’t execute it. The host will try to run the command the next time it comes online.
+* Acknowledged: the host responded with "Acknowledged" status via the MDM protocol: the host processed the command successfully.
+* Error: the host responded with "Error" status via the MDM protocol: an error occurred. Run the `fleetctl get mdm-command-results --id=<insert-command-id` to view the error.
+* CommandFormatError: the host responded with "CommandFormatError" status via the MDM protocol: a protocol error occurred, which can result from a malformed command. Run the `fleetctl get mdm-command-results --id=<insert-command-id` to view the error.
+
+The possible `status` values for Windows hosts are documented in Microsoft's documentation [here](https://learn.microsoft.com/en-us/windows/client-management/oma-dm-protocol-support#syncml-response-status-codes).
+
 `GET /api/v1/fleet/commands/results`
 
 #### Parameters
@@ -6265,8 +6206,7 @@ This endpoint returns the results for a specific custom MDM command.
 
 > Note: If the server has not yet received a result for a command, it will return an empty object (`{}`).
 
-
-### List custom MDM commands
+### List MDM commands
 
 > `GET /api/v1/fleet/mdm/apple/commands` API endpoint is deprecated as of Fleet 4.40. It is maintained for backward compatibility. Please use the new API endpoint below. See old API endpoint docs [here](https://github.com/fleetdm/fleet/blob/fleet-v4.39.0/docs/REST%20API/rest-api.md#list-custom-mdm-commands).
 
@@ -6282,6 +6222,8 @@ This endpoint returns the list of custom MDM commands that have been executed.
 | per_page                  | integer | query | Results per page.                                                         |
 | order_key                 | string  | query | What to order results by. Can be any field listed in the `results` array example below. |
 | order_direction           | string  | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`. |
+| host_identifier           | string  | query | The host's `hostname`, `uuid`, or `hardware_serial`. |
+| request_type              | string  | query | The request type to filter commands by. |
 
 #### Example
 
@@ -6320,6 +6262,7 @@ This endpoint returns the list of custom MDM commands that have been executed.
 
 - [Get Apple Push Notification service (APNs)](#get-apple-push-notification-service-apns)
 - [Get Apple Business Manager (ABM)](#get-apple-business-manager-abm)
+- [Get Volume Purchasing Program (VPP)](#get-volume-purchasing-program-vpp)
 
 ### Get Apple Push Notification service (APNs)
 
@@ -6374,6 +6317,30 @@ None.
 }
 ```
 
+Get Volume Purchasing Program (VPP)
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+_Available in Fleet Premium_
+
+`GET /api/v1/fleet/vpp`
+
+#### Example
+
+`GET /api/v1/fleet/vpp`
+
+##### Default response
+
+`Status: 200`
+
+```json
+{
+  "org_name": "Acme Inc.",
+  "renew_date": "2023-11-29T00:00:00Z",
+  "location": "Acme Inc. Main Address"
+}
+```
+
 ---
 
 ## Policies
@@ -6594,7 +6561,7 @@ For example, a policy might ask “Is Gatekeeper enabled on macOS devices?“ Th
 
 | Name     | Type    | In   | Description                                       |
 | -------- | ------- | ---- | ------------------------------------------------- |
-| ids      | list    | body | **Required.** The IDs of the policies to delete.  |
+| ids      | array   | body | **Required.** The IDs of the policies to delete.  |
 
 #### Example
 
@@ -6688,8 +6655,8 @@ Triggers [automations](https://fleetdm.com/docs/using-fleet/automations#policy-a
 
 | Name        | Type     | In   | Description                                              |
 | ----------  | -------- | ---- | -------------------------------------------------------- |
-| policy_ids  | list     | body | Filters to only run policy automations for the specified policies. |
-| team_ids    | list     | body | _Available in Fleet Premium_. Filters to only run policy automations for hosts in the specified teams. |
+| policy_ids  | array    | body | Filters to only run policy automations for the specified policies. |
+| team_ids    | array    | body | _Available in Fleet Premium_. Filters to only run policy automations for hosts in the specified teams. |
 
 
 #### Example
@@ -7029,7 +6996,7 @@ Either `query` or `query_id` must be provided.
 | Name     | Type    | In   | Description                                       |
 | -------- | ------- | ---- | ------------------------------------------------- |
 | team_id  | integer | path  | **Required.** Defines what team ID to operate on                |
-| ids      | list    | body | **Required.** The IDs of the policies to delete.  |
+| ids      | array   | body | **Required.** The IDs of the policies to delete.  |
 
 #### Example
 
@@ -7325,6 +7292,7 @@ Returns the query report specified by ID.
 ```json
 {
   "query_id": 31,
+  "report_clipped": false,
   "results": [
     {
       "host_id": 1,
@@ -7465,14 +7433,14 @@ Creates a global query or team query.
 | name                            | string  | body | **Required**. The name of the query.                                                                                                                   |
 | query                           | string  | body | **Required**. The query in SQL syntax.                                                                                                                 |
 | description                     | string  | body | The query's description.                                                                                                                               |
-| observer_can_run                | bool    | body | Whether or not users with the `observer` role can run the query. In Fleet 4.0.0, 3 user roles were introduced (`admin`, `maintainer`, and `observer`). This field is only relevant for the `observer` role. The `observer_plus` role can run any query and is not limited by this flag (`observer_plus` role was added in Fleet 4.30.0). |
+| observer_can_run                | boolean | body | Whether or not users with the `observer` role can run the query. In Fleet 4.0.0, 3 user roles were introduced (`admin`, `maintainer`, and `observer`). This field is only relevant for the `observer` role. The `observer_plus` role can run any query and is not limited by this flag (`observer_plus` role was added in Fleet 4.30.0). |
 | team_id                         | integer | body | _Available in Fleet Premium_. The parent team to which the new query should be added. If omitted, the query will be global.                                           |
-| interval                       | integer | body | The amount of time, in seconds, the query waits before running. Can be set to `0` to never run. Default: 0.       |
+| interval                        | integer | body | The amount of time, in seconds, the query waits before running. Can be set to `0` to never run. Default: 0.       |
 | platform                        | string  | body | The OS platforms where this query will run (other platforms ignored). Comma-separated string. If omitted, runs on all compatible platforms.                        |
 | min_osquery_version             | string  | body | The minimum required osqueryd version installed on a host. If omitted, all osqueryd versions are acceptable.                                                                          |
 | automations_enabled             | boolean | body | Whether to send data to the configured log destination according to the query's `interval`. |
-| logging             | string  | body | The type of log output for this query. Valid values: `"snapshot"`(default), `"differential"`, or `"differential_ignore_removals"`.                        |
-| discard_data        | bool    | body | Whether to skip saving the latest query results for each host. Default: `false`. |
+| logging                         | string  | body | The type of log output for this query. Valid values: `"snapshot"`(default), `"differential"`, or `"differential_ignore_removals"`.                        |
+| discard_data                    | boolean | body | Whether to skip saving the latest query results for each host. Default: `false`. |
 
 
 #### Example
@@ -7539,13 +7507,13 @@ Modifies the query specified by ID.
 | name                        | string  | body | The name of the query.                                                                                                                                 |
 | query                       | string  | body | The query in SQL syntax.                                                                                                                               |
 | description                 | string  | body | The query's description.                                                                                                                               |
-| observer_can_run            | bool    | body | Whether or not users with the `observer` role can run the query. In Fleet 4.0.0, 3 user roles were introduced (`admin`, `maintainer`, and `observer`). This field is only relevant for the `observer` role. The `observer_plus` role can run any query and is not limited by this flag (`observer_plus` role was added in Fleet 4.30.0). |
+| observer_can_run            | boolean | body | Whether or not users with the `observer` role can run the query. In Fleet 4.0.0, 3 user roles were introduced (`admin`, `maintainer`, and `observer`). This field is only relevant for the `observer` role. The `observer_plus` role can run any query and is not limited by this flag (`observer_plus` role was added in Fleet 4.30.0). |
 | interval                   | integer | body | The amount of time, in seconds, the query waits before running. Can be set to `0` to never run. Default: 0.       |
 | platform                    | string  | body | The OS platforms where this query will run (other platforms ignored). Comma-separated string. If set to "", runs on all compatible platforms.                    |
 | min_osquery_version             | string  | body | The minimum required osqueryd version installed on a host. If omitted, all osqueryd versions are acceptable.                                                                          |
 | automations_enabled             | boolean | body | Whether to send data to the configured log destination according to the query's `interval`. |
 | logging             | string  | body | The type of log output for this query. Valid values: `"snapshot"`(default), `"differential"`, or `"differential_ignore_removals"`.                        |
-| discard_data        | bool    | body | Whether to skip saving the latest query results for each host. |
+| discard_data        | boolean  | body | Whether to skip saving the latest query results for each host. |
 
 > Note that any of the following conditions will cause the existing query report to be deleted:
 > - Updating the `query` (SQL) field
@@ -7649,9 +7617,9 @@ Deletes the queries specified by ID. Returns the count of queries successfully d
 
 #### Parameters
 
-| Name | Type | In   | Description                           |
-| ---- | ---- | ---- | ------------------------------------- |
-| ids  | list | body | **Required.** The IDs of the queries. |
+| Name | Type  | In   | Description                           |
+| ---- | ----- | ---- | ------------------------------------- |
+| ids  | array | body | **Required.** The IDs of the queries. |
 
 #### Example
 
@@ -8209,7 +8177,6 @@ This allows you to easily configure scheduled queries that will impact a whole t
 
 - [Run script](#run-script)
 - [Get script result](#get-script-result)
-- [Run live script](#run-live-script)
 - [Add script](#add-script)
 - [Delete script](#delete-script)
 - [List scripts](#list-scripts)
@@ -8285,46 +8252,6 @@ Gets the result of a script that was executed.
 
 > Note: `exit_code` can be `null` if Fleet hasn't heard back from the host yet.
 
-### Run live script
-
-Run a live script and get results back (5 minute timeout). Live scripts only runs on the host if it has no other scripts running.
-
-`POST /api/v1/fleet/scripts/run/sync`
-
-#### Parameters
-
-| Name            | Type    | In   | Description                                      |
-| ----            | ------- | ---- | --------------------------------------------     |
-| host_id         | integer | body | **Required**. The host id to run the script on.  |
-| script_id       | integer | body | The ID of the existing saved script to run. Only one of either `script_id`, `script_name` or `script_contents` can be included in the request; omit this parameter if using `script_contents` or `script_name`.  |
-| script_contents | string  | body | The contents of the script to run. Only one of either `script_contents`, `script_id` or `script_name` can be included in the request; omit this parameter if using `script_id` or `script_name`. |
-| script_name       | string | body | The name of the existing saved script to run. Only one of either `script_name`, `script_id` or `script_contents` can be included in the request; omit this parameter if using `script_contents` or `script_id`.  |
-| team_id       | integer | body | ID of the team the saved script referenced by `script_name` belongs to. Default: `0` (hosts assigned to "No team") |
-
-
-> Note that if both `script_id` and `script_contents` are included in the request, this endpoint will respond with an error.
-
-#### Example
-
-`POST /api/v1/fleet/scripts/run/sync`
-
-##### Default response
-
-`Status: 200`
-
-```json
-{
-  "host_id": 1227,
-  "execution_id": "e797d6c6-3aae-11ee-be56-0242ac120002",
-  "script_contents": "echo 'hello'",
-  "output": "hello",
-  "message": "",
-  "runtime": 1,
-  "host_timeout": false,
-  "exit_code": 0
-}
-```
-
 ### Add script
 
 Uploads a script, making it available to run on hosts assigned to the specified team (or no team).
@@ -8549,165 +8476,19 @@ Deletes the session specified by ID. When the user associated with the session n
 
 ## Software
 
-- [Add software](#add-software)
-- [Download software](#download-software)
-- [Delete software](#delete-software)
-- [Get installation result](#get-installation-result)
 - [List software](#list-software)
 - [List software versions](#list-software-versions)
+- [List operating systems](#list-operating-systems)
 - [Get software](#get-software)
 - [Get software version](#get-software-version)
-
-### Add software
-
-_Available in Fleet Premium._
-
-Add a software package to install on macOS, Windows, and Linux (Ubuntu) hosts.
-
-
-`POST /api/v1/fleet/software/package`
-
-#### Parameters
-
-| Name            | Type    | In   | Description                                      |
-| ----            | ------- | ---- | --------------------------------------------     |
-| software        | file    | form | **Required**. Installer package file. Supported packages are PKG, MSI, EXE, and DEB.   |
-| team_id         | integer | form | **Required**. The team ID. Adds a software package to the specified team. |
-| install_script  | string | form | Command that Fleet runs to install software. If not specified Fleet runs [default install command](https://github.com/fleetdm/fleet/tree/f71a1f183cc6736205510580c8366153ea083a8d/pkg/file/scripts) for each package type. |
-| pre_install_query  | string | form | Query that is pre-install condition. If the query doesn't return any result, Fleet won't proceed to install. |
-| post_install_script | string | form | The contents of the script to run after install. If the specified script fails (exit code non-zero) software install will be marked as failed and rolled back. |
-| self_service | boolean | form | Self-service software is optional and can be installed by the end user. |
-
-#### Example
-
-`POST /api/v1/fleet/software/package`
-
-##### Request header
-
-```http
-Content-Length: 8500
-Content-Type: multipart/form-data; boundary=------------------------d8c247122f594ba0
-```
-
-##### Request body
-
-```http
---------------------------d8c247122f594ba0
-Content-Disposition: form-data; name="team_id"
-1
---------------------------d8c247122f594ba0
-Content-Disposition: form-data; name="self_service"
-true
---------------------------d8c247122f594ba0
-Content-Disposition: form-data; name="install_script"
-sudo installer -pkg /temp/FalconSensor-6.44.pkg -target /
---------------------------d8c247122f594ba0
-Content-Disposition: form-data; name="pre_install_query"
-SELECT 1 FROM macos_profiles WHERE uuid='c9f4f0d5-8426-4eb8-b61b-27c543c9d3db';
---------------------------d8c247122f594ba0
-Content-Disposition: form-data; name="post_install_script"
-sudo /Applications/Falcon.app/Contents/Resources/falconctl license 0123456789ABCDEFGHIJKLMNOPQRSTUV-WX
---------------------------d8c247122f594ba0
-Content-Disposition: form-data; name="software"; filename="FalconSensor-6.44.pkg"
-Content-Type: application/octet-stream
-<BINARY_DATA>
---------------------------d8c247122f594ba0
-```
-
-##### Default response
-
-`Status: 200`
-
-
-### Download software
-
-_Available in Fleet Premium._
-
-Download a software package.
-
-`GET /api/v1/fleet/software/titles/:software_title_id/package/?alt=media`
-
-#### Parameters
-
-| Name            | Type    | In   | Description                                      |
-| ----            | ------- | ---- | --------------------------------------------     |
-| software_title_id   | integer | path | **Required**. The ID of the software title to download software package.|
-| team_id | integer | query | **Required**. The team ID. Downloads a software package added to the specified team. |
-| alt             | integer | query | **Required**. If specified and set to "media", downloads the specified software package. |
-
-#### Example
-
-`GET /api/v1/fleet/software/titles/123/package?alt=media?team_id=2`
-
-##### Default response
-
-`Status: 200`
-
-```http
-Status: 200
-Content-Type: application/octet-stream
-Content-Disposition: attachment
-Content-Length: <length>
-Body: <blob>
-```
-
-### Delete software
-
-_Available in Fleet Premium._
-
-Delete a software package.
-
-`DELETE /api/v1/fleet/software/titles/:software_title_id/package`
-
-#### Parameters
-
-| Name            | Type    | In   | Description                                      |
-| ----            | ------- | ---- | --------------------------------------------     |
-| software_title_id  | integer | path | **Required**. The ID of the software title for the software package to delete. |
-| team_id | integer | query | **Required**. The team ID. Deletes a software package added to the specified team. |
-
-#### Example
-
-`DELETE /api/v1/fleet/software/titles/24/package?team_id=2`
-
-##### Default response
-
-`Status: 204`
-
-### Get installation results
-
-_Available in Fleet Premium._
-
-`GET /api/v1/fleet/software/install/results/:install_uuid`
-
-Get the results of a software installation.
-
-| Name            | Type    | In   | Description                                      |
-| ----            | ------- | ---- | --------------------------------------------     |
-| install_uuid | string | path | **Required**. The software installation UUID.|
-
-#### Example
-
-`GET /api/v1/fleet/software/install/results/b15ce221-e22e-4c6a-afe7-5b3400a017da`
-
-##### Default response
-
-`Status: 200`
-
-```json
- {
-   "install_uuid": "b15ce221-e22e-4c6a-afe7-5b3400a017da",
-   "software_title": "Falcon.app",
-   "software_title_id": 8353,
-   "software_package": "FalconSensor-6.44.pkg",
-   "host_id": 123,
-   "host_display_name": "Marko's MacBook Pro",
-   "status": "failed",
-   "output": "Installing software...\nError: The operation can’t be completed because the item “Falcon” is in use.",
-   "pre_install_query_output": "Query returned result\nSuccess",
-   "post_install_script_output": "Running script...\nExit code: 1 (Failed)\nRolling back software install...\nSuccess"
- }
-```
+- [Get operating system version](#get-operating-system-version)
+- [Add package](#add-package)
+- [List App Store apps](#list-app-store-apps)
+- [Add App Store app](#add-app-store-app)
+- [Install package or App Store app](#install-package-or-app-store-app)
+- [Get package install result](#get-package-install-result)
+- [Download package](#download-package)
+- [Delete package or App Store app](#delete-package-or-app-store-app)
 
 ### List software
 
@@ -8715,6 +8496,8 @@ Get a list of all software.
 
 `GET /api/v1/fleet/software/titles`
 
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
 #### Parameters
 
 | Name                    | Type    | In    | Description                                                                                                                                                                |
@@ -8724,10 +8507,10 @@ Get a list of all software.
 | order_key               | string  | query | What to order results by. Allowed fields are `name` and `hosts_count`. Default is `hosts_count` (descending).                                                              |
 | order_direction         | string  | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`.                                              |
 | query                   | string  | query | Search query keywords. Searchable fields include `title` and `cve`.                                                                                                        |
-| team_id                 | integer | query | _Available in Fleet Premium_. Filters the software to only include the software installed on the hosts that are assigned to the specified team.                            |
-| vulnerable              | bool    | query | If true or 1, only list software that has detected vulnerabilities. Default is `false`.                                                                                    |
-| available_for_install   | bool    | query | If `true` or `1`, only list software that is available for install (added by the user). Default is `false`.                                                                |
-| self_service    | bool    | query | If `true` or `1`, only lists self-service software. Default is `false`.  |
+| team_id                 | integer | query | _Available in Fleet Premium_. Filters the software to only include the software installed on the hosts that are assigned to the specified team. Use `0` to filter by hosts assigned to "No team".                            |
+| vulnerable              | boolean | query | If true or 1, only list software that has detected vulnerabilities. Default is `false`.                                                                                    |
+| available_for_install   | boolean | query | If `true` or `1`, only list software that is available for install (added by the user). Default is `false`.                                                                |
+| self_service            | boolean | query | If `true` or `1`, only lists self-service software. Default is `false`.  |
 
 #### Example
 
@@ -8745,20 +8528,24 @@ Get a list of all software.
     {
       "id": 12,
       "name": "Firefox.app",
-      "software_package": "FirefoxInstall.pkg",
-      "self_service": true,
+      "software_package": {
+        "name": "FirefoxInsall.pkg",
+        "version": "125.6",
+        "self_service": true
+      },
+      "app_store_app": null,
       "versions_count": 3,
       "source": "apps",
       "browser": "",
       "hosts_count": 48,
-      "versions": [ 
+      "versions": [
         {
           "id": 123,
           "version": "1.12",
           "vulnerabilities": ["CVE-2023-1234","CVE-2023-4321","CVE-2023-7654"]
-        }, 
+        },
         {
-          "id": 124, 
+          "id": 124,
           "version": "3.4",
           "vulnerabilities": ["CVE-2023-1234","CVE-2023-4321","CVE-2023-7654"]
         },
@@ -8767,13 +8554,13 @@ Get a list of all software.
           "version": "1.13",
           "vulnerabilities": ["CVE-2023-1234","CVE-2023-4321","CVE-2023-7654"]
         }
-      ]  
+      ]
     },
     {
       "id": 22,
       "name": "Google Chrome.app",
       "software_package": null,
-      "self_service": false,
+      "app_store_app": null,
       "versions_count": 5,
       "source": "apps",
       "browser": "",
@@ -8805,7 +8592,7 @@ Get a list of all software.
       "id": 32,
       "name": "1Password – Password Manager",
       "software_package": null,
-      "self_service": false,
+      "app_store_app": null,
       "versions_count": 1,
       "source": "chrome_extensions",
       "browser": "chrome",
@@ -8841,8 +8628,8 @@ Get a list of all software versions.
 | order_key               | string  | query | What to order results by. Allowed fields are `name`, `hosts_count`, `cve_published`, `cvss_score`, `epss_probability` and `cisa_known_exploit`. Default is `hosts_count` (descending).      |
 | order_direction         | string  | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`.                                              |
 | query                   | string  | query | Search query keywords. Searchable fields include `name`, `version`, and `cve`.                                                                                             |
-| team_id                 | integer | query | _Available in Fleet Premium_. Filters the software to only include the software installed on the hosts that are assigned to the specified team.                             |
-| vulnerable              | bool    | query | If true or 1, only list software that has detected vulnerabilities. Default is `false`.                                                                                    |
+| team_id                 | integer | query | _Available in Fleet Premium_. Filters the software to only include the software installed on the hosts that are assigned to the specified team. Use `0` to filter by hosts assigned to "No team".                             |
+| vulnerable              | boolean    | query | If true or 1, only list software that has detected vulnerabilities. Default is `false`.                                                                                    |
 
 #### Example
 
@@ -8900,22 +8687,25 @@ Get a list of all software versions.
 }
 ```
 
-### Get software
+### List operating systems
 
-Returns information about the specified software. By default, `versions` are sorted in descending order by the `hosts_count` field.
+Returns a list of all operating systems.
 
-`GET /api/v1/fleet/software/titles/:id`
+`GET /api/v1/fleet/os_versions`
 
 #### Parameters
 
-| Name | Type | In | Description |
-| ---- | ---- | -- | ----------- |
-| id   | integer | path | **Required.** The software title's ID. |
-| team_id             | integer | query | _Available in Fleet Premium_. Filters response data to the specified team.  |
-
-#### Example
+| Name                | Type     | In    | Description                                                                                                                          |
+| ---      | ---      | ---   | ---                                                                                                                                  |
+| team_id             | integer | query | _Available in Fleet Premium_. Filters response data to the specified team. Use `0` to filter by hosts assigned to "No team".  |
+| platform            | string   | query | Filters the hosts to the specified platform |
+| os_name     | string | query | The name of the operating system to filter hosts by. `os_version` must also be specified with `os_name`                                                 |
+| os_version    | string | query | The version of the operating system to filter hosts by. `os_name` must also be specified with `os_version`                                                 |
+| page                    | integer | query | Page number of the results to fetch.                                                                                                                                       |
+| per_page                | integer | query | Results per page.                                                                                                                                                          |
+| order_key               | string  | query | What to order results by. Allowed fields are: `hosts_count`. Default is `hosts_count` (descending).      |
+| order_direction | string | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`. |
 
-`GET /api/v1/fleet/software/titles/12`
 
 ##### Default response
 
@@ -8923,29 +8713,102 @@ Returns information about the specified software. By default, `versions` are sor
 
 ```json
 {
-  "software_title": {
-    "id": 12,
-    "name": "Firefox.app",
-    "software_package": {
-      "name": "FalconSensor-6.44.pkg",
-      "version": "6.44",
-      "installer_id": 23,
-      "team_id": 3,
-      "uploaded_at": "2024-04-01T14:22:58Z",
-      "install_script": "sudo installer -pkg /temp/FalconSensor-6.44.pkg -target /",
-      "pre_install_query": "SELECT 1 FROM macos_profiles WHERE uuid='c9f4f0d5-8426-4eb8-b61b-27c543c9d3db';",
-      "post_install_script": "sudo /Applications/Falcon.app/Contents/Resources/falconctl license 0123456789ABCDEFGHIJKLMNOPQRSTUV-WX",
-      "self_service": true,
-      "status": {
-        "installed": 3,
-        "pending": 1,
-        "failed": 2,
-      }
-    },
-    "source": "apps",
-    "browser": "",
+  "count": 1
+  "counts_updated_at": "2023-12-06T22:17:30Z",
+  "os_versions": [
+    {
+      "os_version_id": 123,
+      "hosts_count": 21,
+      "name": "Microsoft Windows 11 Pro 23H2 10.0.22621.1234",
+      "name_only": "Microsoft Windows 11 Pro 23H2",
+      "version": "10.0.22621.1234",
+      "platform": "windows",
+      "generated_cpes": [],
+      "vulnerabilities": [
+        {
+          "cve": "CVE-2022-30190",
+          "details_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-30190",
+          "cvss_score": 7.8,// Available in Fleet Premium
+          "epss_probability": 0.9729,// Available in Fleet Premium
+          "cisa_known_exploit": false,// Available in Fleet Premium
+          "cve_published": "2022-06-01T00:15:00Z",// Available in Fleet Premium
+          "cve_description": "Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability.",// Available in Fleet Premium
+          "resolved_in_version": ""// Available in Fleet Premium
+        }
+      ]
+    }
+  ],
+  "meta": {
+    "has_next_results": false,
+    "has_previous_results": false
+  }
+}
+```
+
+OS vulnerability data is currently available for Windows and macOS. For other platforms, `vulnerabilities` will be an empty array:
+
+```json
+{
+  "hosts_count": 1,
+  "name": "CentOS Linux 7.9.2009",
+  "name_only": "CentOS",
+  "version": "7.9.2009",
+  "platform": "rhel",
+  "generated_cpes": [],
+  "vulnerabilities": []
+}
+```
+
+### Get software
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+Returns information about the specified software. By default, `versions` are sorted in descending order by the `hosts_count` field.
+
+`GET /api/v1/fleet/software/titles/:id`
+
+#### Parameters
+
+| Name | Type | In | Description |
+| ---- | ---- | -- | ----------- |
+| id   | integer | path | **Required.** The software title's ID. |
+| team_id             | integer | query | _Available in Fleet Premium_. Filters response data to the specified team. Use `0` to filter by hosts assigned to "No team".  |
+
+#### Example
+
+`GET /api/v1/fleet/software/titles/12`
+
+##### Default response
+
+`Status: 200`
+
+```json
+{
+  "software_title": {
+    "id": 12,
+    "name": "Firefox.app",
+    "bundle_identifier": "org.mozilla.firefox",
+    "software_package": {
+      "name": "FalconSensor-6.44.pkg",
+      "version": "6.44",
+      "installer_id": 23,
+      "team_id": 3,
+      "uploaded_at": "2024-04-01T14:22:58Z",
+      "install_script": "sudo installer -pkg /temp/FalconSensor-6.44.pkg -target /",
+      "pre_install_query": "SELECT 1 FROM macos_profiles WHERE uuid='c9f4f0d5-8426-4eb8-b61b-27c543c9d3db';",
+      "post_install_script": "sudo /Applications/Falcon.app/Contents/Resources/falconctl license 0123456789ABCDEFGHIJKLMNOPQRSTUV-WX",
+      "self_service": true,
+      "status": {
+        "installed": 3,
+        "pending": 1,
+        "failed": 2,
+      }
+    },
+    "app_store_app": null,
+    "source": "apps",
+    "browser": "",
     "hosts_count": 48,
-    "versions": [ 
+    "versions": [
       {
         "id": 123,
         "version": "117.0",
@@ -8964,7 +8827,48 @@ Returns information about the specified software. By default, `versions` are sor
         "vulnerabilities": ["CVE-2023-7654"],
         "hosts_count": 4
       }
-    ]  
+    ]
+  }
+}
+```
+
+#### Example (App Store app)
+
+`GET /api/v1/fleet/software/titles/15`
+
+##### Default response
+
+`Status: 200`
+
+```json
+{
+  "software_title": {
+    "id": 15,
+    "name": "Logic Pro",
+    "bundle_identifier": "com.apple.logic10",
+    "software_package": null,
+    "app_store_app": {
+      "name": "Logic Pro",
+      "app_store_id": "1091189122",
+      "latest_version": "2.04",
+      "icon_url": "https://is1-ssl.mzstatic.com/image/thumb/Purple211/v4/f1/65/1e/a4844ccd-486d-455f-bb31-67336fe46b14/AppIcon-1x_U007emarketing-0-7-0-85-220-0.png/512x512bb.jpg",
+      "status": {
+        "installed": 3,
+        "pending": 1,
+        "failed": 2,
+      }
+    },
+    "source": "apps",
+    "browser": "",
+    "hosts_count": 48,
+    "versions": [
+      {
+        "id": 123,
+        "version": "2.04",
+        "vulnerabilities": [],
+        "hosts_count": 24
+      }
+    ]
   }
 }
 ```
@@ -8980,7 +8884,7 @@ Returns information about the specified software version.
 | Name | Type | In | Description |
 | ---- | ---- | -- | ----------- |
 | id   | integer | path | **Required.** The software version's ID. |
-| team_id             | integer | query | _Available in Fleet Premium_. Filters response data to the specified team.  |
+| team_id             | integer | query | _Available in Fleet Premium_. Filters response data to the specified team. Use `0` to filter by hosts assigned to "No team".  |
 
 #### Example
 
@@ -9026,8 +8930,338 @@ Returns information about the specified software version.
 }
 ```
 
-## Vulnerabilities
+### Get operating system version
+
+Retrieves information about the specified operating system (OS) version.
+
+`GET /api/v1/fleet/os_versions/:id`
+
+#### Parameters
+
+| Name | Type | In | Description |
+| ---- | ---- | -- | ----------- |
+| id   | integer | path | **Required.** The OS version's ID. |
+| team_id             | integer | query | _Available in Fleet Premium_. Filters response data to the specified team. Use `0` to filter by hosts assigned to "No team".  |
+
+##### Default response
+
+`Status: 200`
+
+```json
+{
+  "counts_updated_at": "2023-12-06T22:17:30Z",
+  "os_version": {
+    "id": 123,
+    "hosts_count": 21,
+    "name": "Microsoft Windows 11 Pro 23H2 10.0.22621.1234",
+    "name_only": "Microsoft Windows 11 Pro 23H2",
+    "version": "10.0.22621.1234",
+    "platform": "windows",
+    "generated_cpes": [],
+    "vulnerabilities": [
+      {
+        "cve": "CVE-2022-30190",
+        "details_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-30190",
+        "created_at": "2024-07-01T00:15:00Z",
+        "cvss_score": 7.8,// Available in Fleet Premium
+        "epss_probability": 0.9729,// Available in Fleet Premium
+        "cisa_known_exploit": false,// Available in Fleet Premium
+        "cve_published": "2022-06-01T00:15:00Z",// Available in Fleet Premium
+        "cve_description": "Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability.",// Available in Fleet Premium
+        "resolved_in_version": ""// Available in Fleet Premium
+      }
+    ]
+  }
+}
+```
+
+OS vulnerability data is currently available for Windows and macOS. For other platforms, `vulnerabilities` will be an empty array:
+
+```json
+{
+  "id": 321,
+  "hosts_count": 1,
+  "name": "CentOS Linux 7.9.2009",
+  "name_only": "CentOS",
+  "version": "7.9.2009",
+  "platform": "rhel",
+  "generated_cpes": [],
+  "vulnerabilities": []
+}
+```
+
+### Add package
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+_Available in Fleet Premium._
+
+Add a package (.pkg, .msi, .exe, .deb) to install on macOS, Windows, or Linux (Ubuntu) hosts.
+
+
+`POST /api/v1/fleet/software/package`
+
+#### Parameters
+
+| Name            | Type    | In   | Description                                      |
+| ----            | ------- | ---- | --------------------------------------------     |
+| software        | file    | form | **Required**. Installer package file. Supported packages are PKG, MSI, EXE, and DEB.   |
+| team_id         | integer | form | **Required**. The team ID. Adds a software package to the specified team. |
+| install_script  | string | form | Command that Fleet runs to install software. If not specified Fleet runs [default install command](https://github.com/fleetdm/fleet/tree/f71a1f183cc6736205510580c8366153ea083a8d/pkg/file/scripts) for each package type. |
+| pre_install_query  | string | form | Query that is pre-install condition. If the query doesn't return any result, Fleet won't proceed to install. |
+| post_install_script | string | form | The contents of the script to run after install. If the specified script fails (exit code non-zero) software install will be marked as failed and rolled back. |
+| self_service | boolean | form | Self-service software is optional and can be installed by the end user. |
+
+#### Example
+
+`POST /api/v1/fleet/software/package`
 
+##### Request header
+
+```http
+Content-Length: 8500
+Content-Type: multipart/form-data; boundary=------------------------d8c247122f594ba0
+```
+
+##### Request body
+
+```http
+--------------------------d8c247122f594ba0
+Content-Disposition: form-data; name="team_id"
+1
+--------------------------d8c247122f594ba0
+Content-Disposition: form-data; name="self_service"
+true
+--------------------------d8c247122f594ba0
+Content-Disposition: form-data; name="install_script"
+sudo installer -pkg /temp/FalconSensor-6.44.pkg -target /
+--------------------------d8c247122f594ba0
+Content-Disposition: form-data; name="pre_install_query"
+SELECT 1 FROM macos_profiles WHERE uuid='c9f4f0d5-8426-4eb8-b61b-27c543c9d3db';
+--------------------------d8c247122f594ba0
+Content-Disposition: form-data; name="post_install_script"
+sudo /Applications/Falcon.app/Contents/Resources/falconctl license 0123456789ABCDEFGHIJKLMNOPQRSTUV-WX
+--------------------------d8c247122f594ba0
+Content-Disposition: form-data; name="software"; filename="FalconSensor-6.44.pkg"
+Content-Type: application/octet-stream
+<BINARY_DATA>
+--------------------------d8c247122f594ba0
+```
+
+##### Default response
+
+`Status: 200`
+
+### List App Store apps
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+Returns the list of Apple App Store (VPP) that can be added to the specified team. If an app is already added to the team, it's excluded from the list.
+
+`GET /api/v1/fleet/software/app_store_apps`
+
+#### Parameters
+
+| Name    | Type | In | Description |
+| ------- | ---- | -- | ----------- |
+| team_id | integer | query | **Required**. The team ID. |
+
+#### Example
+
+`GET /api/v1/fleet/software/app_store_apps/?team_id=3`
+
+##### Default response
+
+`Status: 200`
+
+```json
+{
+  "app_store_apps": [
+    {
+      "name": "Xcode",
+      "icon_url": "https://is1-ssl.mzstatic.com/image/thumb/Purple211/v4/f1/65/1e/a4844ccd-486d-455f-bb31-67336fe46b14/AppIcon-1x_U007emarketing-0-7-0-85-220-0.png/512x512bb.jpg",
+      "latest_version": "15.4",
+      "app_store_id": "497799835",
+      "platform": "darwin"
+    },
+    {
+      "name": "Logic Pro",
+      "icon_url": "https://is1-ssl.mzstatic.com/image/thumb/Purple211/v4/f1/65/1e/a4844ccd-486d-455f-bb31-67336fe46b14/AppIcon-1x_U007emarketing-0-7-0-85-220-0.png/512x512bb.jpg",
+      "latest_version": "2.04",
+      "app_store_id": "634148309",
+      "platform": "ios"
+    },
+    {
+      "name": "Logic Pro",
+      "icon_url": "https://is1-ssl.mzstatic.com/image/thumb/Purple211/v4/f1/65/1e/a4844ccd-486d-455f-bb31-67336fe46b14/AppIcon-1x_U007emarketing-0-7-0-85-220-0.png/512x512bb.jpg",
+      "latest_version": "2.04",
+      "app_store_id": "634148309",
+      "platform": "ipados"
+    },
+  ]
+}
+```
+
+### Add App Store app
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+_Available in Fleet Premium._
+
+Add App Store (VPP) app purchased in Apple Business Manager.
+
+`POST /api/v1/fleet/software/app_store_apps`
+
+#### Parameters
+
+| Name | Type | In | Description |
+| ---- | ---- | -- | ----------- |
+| app_store_id   | string | body | **Required.** The ID of App Store app. |
+| team_id       | integer | body | **Required**. The team ID. Adds VPP software to the specified team.  |
+| platform | string | body | The platform of the app (`darwin`, `ios`, or `ipados`). Default is `darwin`. |
+
+#### Example
+
+`POST /api/v1/fleet/software/app_store_apps?team_id=3`
+
+##### Request body
+
+```json
+{
+  "app_store_id": "497799835",
+  "team_id": 2,
+  "platform": "ipados"
+}
+```
+
+##### Default response
+
+`Status: 200`
+
+### Download package
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+_Available in Fleet Premium._
+
+`GET /api/v1/fleet/software/titles/:software_title_id/package?alt=media`
+
+#### Parameters
+
+| Name            | Type    | In   | Description                                      |
+| ----            | ------- | ---- | --------------------------------------------     |
+| software_title_id   | integer | path | **Required**. The ID of the software title to download software package.|
+| team_id | integer | query | **Required**. The team ID. Downloads a software package added to the specified team. |
+| alt             | integer | query | **Required**. If specified and set to "media", downloads the specified software package. |
+
+#### Example
+
+`GET /api/v1/fleet/software/titles/123/package?alt=media?team_id=2`
+
+##### Default response
+
+`Status: 200`
+
+```http
+Status: 200
+Content-Type: application/octet-stream
+Content-Disposition: attachment
+Content-Length: <length>
+Body: <blob>
+```
+
+### Install package or App Store app
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+_Available in Fleet Premium._
+
+Install software (package or App Store app) on a macOS, iOS, iPadOS, Windows, or Linux (Ubuntu) host. Software title must have a `software_package` or `app_store_app` added to be installed.
+
+> Note: Fleet's agent (fleetd) only installs software it has been asked to install, but technically has access to all installer executables.
+
+`POST /api/v1/fleet/hosts/:id/software/install/:software_title_id`
+
+#### Parameters
+
+| Name              | Type       | In   | Description                                      |
+| ---------         | ---------- | ---- | --------------------------------------------     |
+| id                | integer    | path | **Required**. The host's ID.                     |
+| software_title_id | integer    | path | **Required**. The software title's ID.           |
+
+#### Example
+
+`POST /api/v1/fleet/hosts/123/software/install/3435`
+
+##### Default response
+
+`Status: 202`
+
+### Get package install result
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+_Available in Fleet Premium._
+
+`GET /api/v1/fleet/software/install/results/:install_uuid`
+
+Get the results of a software package install. 
+
+To get the results of an App Store app install, use the [List MDM commands](#list-mdm-commands) and [Get MDM command results](#get-mdm-command-results) API enpoints. Fleet uses an MDM command to install App Store apps.
+
+| Name            | Type    | In   | Description                                      |
+| ----            | ------- | ---- | --------------------------------------------     |
+| install_uuid | string | path | **Required**. The software installation UUID.|
+
+#### Example
+
+`GET /api/v1/fleet/software/install/results/b15ce221-e22e-4c6a-afe7-5b3400a017da`
+
+##### Default response
+
+`Status: 200`
+
+```json
+ {
+   "install_uuid": "b15ce221-e22e-4c6a-afe7-5b3400a017da",
+   "software_title": "Falcon.app",
+   "software_title_id": 8353,
+   "software_package": "FalconSensor-6.44.pkg",
+   "host_id": 123,
+   "host_display_name": "Marko's MacBook Pro",
+   "status": "failed",
+   "output": "Installing software...\nError: The operation can’t be completed because the item “Falcon” is in use.",
+   "pre_install_query_output": "Query returned result\nSuccess",
+   "post_install_script_output": "Running script...\nExit code: 1 (Failed)\nRolling back software install...\nSuccess"
+ }
+```
+
+### Delete package or App Store app
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+_Available in Fleet Premium._
+
+Deletes software that's available for install (package or App Store app).
+
+`DELETE /api/v1/fleet/software/titles/:software_title_id/available_for_install`
+
+#### Parameters
+
+| Name            | Type    | In   | Description                                      |
+| ----            | ------- | ---- | --------------------------------------------     |
+| software_title_id              | integer | path | **Required**. The ID of the software title to delete software available for install. |
+| team_id | integer | query | **Required**. The team ID. Deletes a software package added to the specified team. |
+
+#### Example
+
+`DELETE /api/v1/fleet/software/titles/24/available_for_install?team_id=2`
+
+##### Default response
+
+`Status: 204`
+
+## Vulnerabilities
 
 - [List vulnerabilities](#list-vulnerabilities)
 - [Get vulnerability](#get-vulnerability)
@@ -9042,7 +9276,7 @@ Retrieves a list of all CVEs affecting software and/or OS versions.
 
 | Name                | Type     | In    | Description                                                                                                                          |
 | ---      | ---      | ---   | ---                                                                                                                                  |
-| team_id             | integer | query | _Available in Fleet Premium_. Filters only include vulnerabilities affecting the specified team.  |
+| team_id             | integer | query | _Available in Fleet Premium_. Filters only include vulnerabilities affecting the specified team. Use `0` to filter by hosts assigned to "No team".  |
 | page                    | integer | query | Page number of the results to fetch.                                                                                                                                       |
 | per_page                | integer | query | Results per page.                                                                                                                                                          |
 | order_key               | string  | query | What to order results by. Allowed fields are: `cve`, `cvss_score`, `epss_probability`, `cve_published`, `created_at`, and `host_count`. Default is `created_at` (descending).      |
@@ -9091,7 +9325,7 @@ Retrieve details about a vulnerability and its affected software and OS versions
 | Name     | Type     | In    | Description                                                                                     |
 | ---      | ---      | ---   | ---                                                                                             |
 | cve      | string  | path | The cve to get information about (including "cve-" prefix, case-insensitive).                       |
-| team_id             | integer | query | _Available in Fleet Premium_. Filters response data to the specified team.  |
+| team_id             | integer | query | _Available in Fleet Premium_. Filters response data to the specified team. Use `0` to filter by hosts assigned to "No team".  |
 
 `GET /api/v1/fleet/vulnerabilities/:cve`
 
@@ -9122,7 +9356,7 @@ Retrieve details about a vulnerability and its affected software and OS versions
       "name": "macOS 14.1.2",
       "name_only": "macOS",
       "version": "14.1.2",
-      "platform": "darwin",
+
       "resolved_in_version": "14.2",
       "generated_cpes": [
         "cpe:2.3:o:apple:macos:*:*:*:*:*:14.2:*:*",
@@ -9604,8 +9838,8 @@ _Available in Fleet Premium_
 | ------------------------------------------------------- | ------- | ---- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | id                                                      | integer | path | **Required.** The desired team's ID.                                                                                                                                                                      |
 | name                                                    | string  | body | The team's name.                                                                                                                                                                                          |
-| host_ids                                                | list    | body | A list of hosts that belong to the team.                                                                                                                                                                  |
-| user_ids                                                | list    | body | A list of users on the team.                                                                                                                                                             |
+| host_ids                                                | array    | body | A list of hosts that belong to the team.                                                                                                                                                                  |
+| user_ids                                                | array    | body | A list of users on the team.                                                                                                                                                             |
 | webhook_settings                                        | object  | body | Webhook settings contains for the team.                                                                                                                                                                   |
 | &nbsp;&nbsp;failing_policies_webhook                    | object  | body | Failing policies webhook settings.                                                                                                                                                                        |
 | &nbsp;&nbsp;&nbsp;&nbsp;enable_failing_policies_webhook | boolean | body | Whether or not the failing policies webhook is enabled.                                                                                                                                                   |
@@ -9630,14 +9864,20 @@ _Available in Fleet Premium_
 | &nbsp;&nbsp;macos_updates                               | object  | body | macOS updates settings.                                                                                                                                                                                   |
 | &nbsp;&nbsp;&nbsp;&nbsp;minimum_version                 | string  | body | Hosts that belong to this team and are enrolled into Fleet's MDM will be nudged until their macOS is at or above this version.                                                                            |
 | &nbsp;&nbsp;&nbsp;&nbsp;deadline                        | string  | body | Hosts that belong to this team and are enrolled into Fleet's MDM won't be able to dismiss the Nudge window once this deadline is past.                                                                    |
+| &nbsp;&nbsp;ios_updates                               | object  | body | iOS updates settings.                                                                                                                                                                                   |
+| &nbsp;&nbsp;&nbsp;&nbsp;minimum_version                 | string  | body | Hosts that belong to this team and are enrolled into Fleet's MDM will be nudged until their iOS is at or above this version.                                                                            |
+| &nbsp;&nbsp;&nbsp;&nbsp;deadline                        | string  | body | Hosts that belong to this team and are enrolled into Fleet's MDM won't be able to dismiss the Nudge window once this deadline is past.                                                                    |
+| &nbsp;&nbsp;ipados_updates                               | object  | body | iPadOS updates settings.                                                                                                                                                                                   |
+| &nbsp;&nbsp;&nbsp;&nbsp;minimum_version                 | string  | body | Hosts that belong to this team and are enrolled into Fleet's MDM will be nudged until their iPadOS is at or above this version.                                                                            |
+| &nbsp;&nbsp;&nbsp;&nbsp;deadline                        | string  | body | Hosts that belong to this team and are enrolled into Fleet's MDM won't be able to dismiss the Nudge window once this deadline is past.                                                                    |
 | &nbsp;&nbsp;windows_updates                             | object  | body | Windows updates settings.                                                                                                                                                                                   |
 | &nbsp;&nbsp;&nbsp;&nbsp;deadline_days                   | integer | body | Hosts that belong to this team and are enrolled into Fleet's MDM will have this number of days before updates are installed on Windows.                                                                   |
 | &nbsp;&nbsp;&nbsp;&nbsp;grace_period_days               | integer | body | Hosts that belong to this team and are enrolled into Fleet's MDM will have this number of days before Windows restarts to install updates.                                                                    |
 | &nbsp;&nbsp;macos_settings                              | object  | body | macOS-specific settings.                                                                                                                                                                                  |
-| &nbsp;&nbsp;&nbsp;&nbsp;custom_settings                 | list    | body | The list of objects where each object includes .mobileconfig or JSON file (configuration profile) and label name to apply to macOS hosts that belong to this team and are members of the specified label.                                                                                                                                        |
+| &nbsp;&nbsp;&nbsp;&nbsp;custom_settings                 | array    | body | The list of objects where each object includes .mobileconfig or JSON file (configuration profile) and label name to apply to macOS hosts that belong to this team and are members of the specified label.                                                                                                                                        |
 | &nbsp;&nbsp;&nbsp;&nbsp;enable_disk_encryption          | boolean | body | Hosts that belong to this team and are enrolled into Fleet's MDM will have disk encryption enabled if set to true.                                                                                        |
 | &nbsp;&nbsp;windows_settings                            | object  | body | Windows-specific settings.                                                                                                                                                                                |
-| &nbsp;&nbsp;&nbsp;&nbsp;custom_settings                 | list    | body | The list of objects where each object includes XML file (configuration profile) and label name to apply to Windows hosts that belong to this team and are members of the specified label.                                                                                                                               |
+| &nbsp;&nbsp;&nbsp;&nbsp;custom_settings                 | array    | body | The list of objects where each object includes XML file (configuration profile) and label name to apply to Windows hosts that belong to this team and are members of the specified label.                                                                                                                               |
 | &nbsp;&nbsp;macos_setup                                 | object  | body | Setup for automatic MDM enrollment of macOS hosts.                                                                                                                                                      |
 | &nbsp;&nbsp;&nbsp;&nbsp;enable_end_user_authentication  | boolean | body | If set to true, end user authentication will be required during automatic MDM enrollment of new macOS hosts. Settings for your IdP provider must also be [configured](https://fleetdm.com/docs/using-fleet/mdm-macos-setup-experience#end-user-authentication-and-eula).                                                                                      |
 | integrations                                            | object  | body | Integration settings for this team.                                                                                                                                                                   |
@@ -9857,8 +10097,8 @@ _Available in Fleet Premium_
 | Name                             | Type    | In    | Description                                                                                                                                                  |
 | ---                              | ---     | ---   | ---                                                                                                                                                          |
 | id                               | integer | path  | **Required.** The desired team's ID.                                                                                                                         |
-| force                            | bool    | query | Force apply the options even if there are validation errors.                                                                                                 |
-| dry_run                          | bool    | query | Validate the options and return any validation errors, but do not apply the changes.                                                                         |
+| force                            | boolean | query | Force apply the options even if there are validation errors.                                                                                                 |
+| dry_run                          | boolean | query | Validate the options and return any validation errors, but do not apply the changes.                                                                         |
 | _JSON data_                      | object  | body  | The JSON to use as agent options for this team. See [Agent options](https://fleetdm.com/docs/using-fleet/configuration-files#agent-options) for details.                              |
 
 #### Example
@@ -9969,9 +10209,9 @@ Transforms a host name into a host id. For example, the Fleet UI use this endpoi
 
 #### Parameters
 
-| Name | Type  | In   | Description                              |
-| ---- | ----- | ---- | ---------------------------------------- |
-| list | array | body | **Required** list of items to translate. |
+| Name  | Type  | In   | Description                              |
+| ----- | ----- | ---- | ---------------------------------------- |
+| array | array | body | **Required** list of items to translate. |
 
 #### Example
 
diff --git a/docs/Using Fleet/Learn-how-to-use-Fleet.md b/docs/Using Fleet/Learn-how-to-use-Fleet.md
deleted file mode 100644
index fceea3f7db93..000000000000
--- a/docs/Using Fleet/Learn-how-to-use-Fleet.md	
+++ /dev/null
@@ -1,58 +0,0 @@
-# Learn how to use Fleet
-
-- [How to add your device to Fleet](#how-to-add-your-device-to-fleet)
-- [How to ask questions about your device](#how-to-ask-questions-about-your-device)
-
-### Overview
-
-In this guide, we'll cover the following concepts:
-- How to add your device to Fleet
-- How to ask questions about your device
-
-### How to add your device to Fleet
-
-Once you log into Fleet, you are presented with the **Home** page.
-
-To add your device: 
-
-1. Select **Add hosts**. In Fleet, devices are referred to as "hosts."
-2. Select your device's platform.
-3. Select **Download** to download Fleet's agent (fleetd). The download may take several seconds.
-4. Open fleetd and follow the installation steps.
-
-> It may take several seconds for Fleet osquery to send your device's data to Fleet.
-
-In the background, Fleet ran several checks to assess the security hygiene of your device.
-
-> In Fleet, these checks are referred to as "policies."
-
-### How to ask questions about your device
-
-With Fleet, you can ask a multitude of questions to help you manage, monitor, and identify threats on your devices, but if you are just starting out, and unsure of what to ask, Fleet comes baked in with a [query library](https://fleetdm.com/queries) of common questions.
-
-So, let's start by asking the following question about your device:
-
-* What operating system is installed on my device and what is its version?
-
-This question can easily be answered by running this simple query: "Get operating system information." 
-
-To run this query on your device:
-
-1. Select **Queries** in the top navigation.
-2. Select **Create new query** (or browse your organization's queries for "operating system information" in the search bar).
-3. Type the query you would like to run, `SELECT * FROM os_version;`.
-4. Select **Run query**, then select **All hosts** (your device may be the only host added to Fleet), and finally select **Run** to execute the query.
-
-The query may take several seconds to complete, because Fleet has to wait for the Fleet's agent (fleetd) to respond with results. Only online hosts will respond with results to a live query.
-
-> Fleet's query response time is inherently variable because of osquery's heartbeat response time. This helps prevent performance issues on hosts.
-
-When the query has finished, you should see several columns in the "Results" table:
-
-- The "name" column answers: "What operating system is installed on my device?" 
-
-- The "version" column answers: "What version of the installed operating system is on my device?"
-
-<meta name="pageOrderInSection" value="100">
-<meta name="description" value="Get started with using Fleet by learning how to enroll your device into a Fleet instance and run queries to ask questions about it.">
-<meta name="navSection" value="hidden">
\ No newline at end of file
diff --git a/docs/Using Fleet/MDM-setup.md b/docs/Using Fleet/MDM-setup.md
deleted file mode 100644
index c56ddeb5d665..000000000000
--- a/docs/Using Fleet/MDM-setup.md	
+++ /dev/null
@@ -1,42 +0,0 @@
-# Setup
-
-To turn on macOS, iOS, and iPadOS MDM features, follow the instructions on this page to connect Fleet to Apple Push Notification service (APNs).
-
-To use automatic enrollment (aka zero-touch) features on macOS, iOS, and iPadOS, follow instructions to connect Fleet with Apple Business Manager (ABM).
-
-To turn on Windows MDM features, head to this [Windows MDM setup article](https://fleetdm.com/guides/windows-mdm-setup). 
-
-## Apple Push Notification service (APNs)
-
-Apple uses APNs to authenticate and manage interactions between Fleet and hosts.
-
-To connect Fleet to APNs or renew APNs, head to the **Settings > Integrations > Mobile device management (MDM)** page.
-
-> Apple requires that APNs certificates are renewed annually. 
-> - If your certificate expires, you will have to turn MDM off and back on for all macOS hosts.
-> - Be sure to use the same Apple ID from year-to-year. If you don't, you will have to turn MDM off and back on for all macOS hosts.
-
-## Apple Business Manager (ABM)
-
-> Available in Fleet Premium
-
-To connect Fleet to ABM or renew ABM, head to the **Settings > Integrations > Automatic enrollment > Apple Business Manager** page.
-
-After connecting Fleet to ABM, set Fleet to be the MDM for all Macs: 
-
-1. Log in to [Apple Business Manager](https://business.apple.com)
-2. Click your profile icon in the bottom left
-3. Click **Preferences**
-4. Click **MDM Server Assignment** and click **Edit** next to **Default Server Assignment**.
-5. Switch **Mac**, **iPhone**, and **iPad** to Fleet.
-
-New or wiped macOS, iOS, and iPadOS hosts that are in ABM, before they've been set up, appear in Fleet with **MDM status** set to "Pending".
-
-All macOS hosts that automatically enroll will be assigned to the default team. If no default team is set, then the host will be placed in "No team". 
-
-> A host can be transferred to a new (not default) team before it enrolls. In the Fleet UI, you can do this under **Settings** > **Teams**.
-
-<meta name="pageOrderInSection" value="1500">
-<meta name="title" value="Setup">
-<meta name="description" value="Learn how to turn on MDM features in Fleet.">
-<meta name="navSection" value="Device management">
diff --git a/docs/Using Fleet/Supported-browsers.md b/docs/Using Fleet/Supported-browsers.md
deleted file mode 100644
index 0ed5a0dc0e8b..000000000000
--- a/docs/Using Fleet/Supported-browsers.md	
+++ /dev/null
@@ -1,28 +0,0 @@
-
-# Supported browsers
-
-Fleet supports the latest, stable releases of all major browsers and platforms.
-
-We test each browser on Windows whenever possible, because our engineering team primarily uses macOS.
-
-**Note:** This information also applies to [fleetdm.com](https://www.fleetdm.com).
-
-### Desktop
-
-- Chrome
-- Firefox
-- Edge
-- Safari (macOS only)
-
-### Mobile
-
-- Mobile Safari on iOS
-- Mobile Chrome on Android
-
-### Note
-> - Mobile web is not yet supported in the Fleet product.
-> - The Fleet user interface [may not be fully supported](https://github.com/fleetdm/fleet/issues/969) in Google Chrome when the browser is running on ChromeOS
-
-<meta name="pageOrderInSection" value="1200">
-<meta name="description" value="Learn what browser versions are compatible with Fleet.">
-<meta name="navSection" value="The basics">
diff --git a/docs/Using Fleet/Supported-host-operating-systems.md b/docs/Using Fleet/Supported-host-operating-systems.md
deleted file mode 100644
index c7adedff8916..000000000000
--- a/docs/Using Fleet/Supported-host-operating-systems.md	
+++ /dev/null
@@ -1,37 +0,0 @@
-# Supported host operating systems
-
-Fleet supports the following operating system versions on hosts. 
-
-| OS      | Supported version(s)                    |
-| :------ | :-------------------------------------  |
-| macOS   | 13+ (Ventura)                           |
-| Windows | Pro and Enterprise 10+, Server 2012+    |
-| Linux   | CentOS 7.1+,  Ubuntu 20.04+, Fedora 38+ |
-| ChromeOS | 112.0.5615.134+                        |
-
-While Fleet may still function partially or fully with OS versions older than those above, Fleet does not actively test against unsupported versions and does not pursue bugs on them. 
-
-## Some notes on compatibility
-
-### Tables
-Not all osquery tables are available for every OS. Please check out the [osquery schema](https://fleetdm.com/tables) for detailed information. 
-
-If a table is not available for your host, Fleet will generally handle things behind the scenes for you. 
-
-### M1 Macs
-Fleet's agent (fleetd) generated for MacOS by `fleetctl package` does not include native support for M1 Macs. Some values returned may reflect the information returned by Rosetta rather than the system. For example, a CPU will show up as `i486`. 
-
-### Linux
-
-> Ubuntu Linux:
-> Fleet Desktop currently supports Xorg as X11 server, Wayland is currently not supported.
-> Ubuntu 24.04 comes with Wayland enabled by default. To use X11 instead of Wayland you can set
-> `WaylandEnable=false` in `/etc/gdm3/custom.conf` and reboot.
-
-> Fedora, CentOS 8 and 9 require a [gnome extension](https://extensions.gnome.org/extension/615/appindicator-support/) and Google Chrome set to the default browser for Fleet Desktop.
-
-> The `fleetctl package` command is not supported on DISA-STIG distribution.
-
-<meta name="pageOrderInSection" value="1200">
-<meta name="description" value="This page contains information about operating systems that are compatible with Fleet's agent (fleetd).">
-<meta name="navSection" value="The basics">
diff --git a/docs/files/2024-06-14-fleet-penetration-test.pdf b/docs/files/2024-06-14-fleet-penetration-test.pdf
new file mode 100644
index 000000000000..1be4c4654146
Binary files /dev/null and b/docs/files/2024-06-14-fleet-penetration-test.pdf differ
diff --git a/ee/bulk-operations-dashboard/.editorconfig b/ee/bulk-operations-dashboard/.editorconfig
new file mode 100644
index 000000000000..6d7fa7039c28
--- /dev/null
+++ b/ee/bulk-operations-dashboard/.editorconfig
@@ -0,0 +1,31 @@
+################################################
+#   ╔═╗╔╦╗╦╔╦╗╔═╗╦═╗┌─┐┌─┐┌┐┌┌─┐┬┌─┐
+#   ║╣  ║║║ ║ ║ ║╠╦╝│  │ ││││├┤ ││ ┬
+#  o╚═╝═╩╝╩ ╩ ╚═╝╩╚═└─┘└─┘┘└┘└  ┴└─┘
+#
+# > Formatting conventions for your Sails app.
+#
+# This file (`.editorconfig`) exists to help
+# maintain consistent formatting throughout the
+# files in your Sails app.
+#
+# For the sake of convention, the Sails team's
+# preferred settings are included here out of the
+# box.  You can also change this file to fit your
+# team's preferences (for example, if all of the
+# developers on your team have a strong preference
+# for tabs over spaces),
+#
+# To review what each of these options mean, see:
+# http://editorconfig.org/
+#
+################################################
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
diff --git a/ee/bulk-operations-dashboard/.eslintignore b/ee/bulk-operations-dashboard/.eslintignore
new file mode 100644
index 000000000000..f190c2ae4fe6
--- /dev/null
+++ b/ee/bulk-operations-dashboard/.eslintignore
@@ -0,0 +1,3 @@
+assets/dependencies/**/*.js
+views/**/*.ejs
+
diff --git a/ee/bulk-operations-dashboard/.eslintrc b/ee/bulk-operations-dashboard/.eslintrc
new file mode 100644
index 000000000000..37e02b37243e
--- /dev/null
+++ b/ee/bulk-operations-dashboard/.eslintrc
@@ -0,0 +1,92 @@
+{
+  //   ╔═╗╔═╗╦  ╦╔╗╔╔╦╗┬─┐┌─┐
+  //   ║╣ ╚═╗║  ║║║║ ║ ├┬┘│
+  //  o╚═╝╚═╝╩═╝╩╝╚╝ ╩ ┴└─└─┘
+  // A set of basic code conventions designed to encourage quality and consistency
+  // across your Sails app's code base.  These rules are checked against
+  // automatically any time you run `npm test`.
+  // 
+  // > An additional eslintrc override file is included in the `assets/` folder
+  // > right out of the box.  This is specifically to allow for variations in acceptable
+  // > global variables between front-end JavaScript code designed to run in the browser
+  // > vs. backend code designed to run in a Node.js/Sails process.
+  //
+  // > Note: If you're using mocha, you'll want to add an extra override file to your
+  // > `test/` folder so that eslint will tolerate mocha-specific globals like `before`
+  // > and `describe`.
+  // Designed for ESLint v4.
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // For more information about any of the rules below, check out the relevant
+  // reference page on eslint.org.  For example, to get details on "no-sequences",
+  // you would visit `http://eslint.org/docs/rules/no-sequences`.  If you're unsure
+  // or could use some advice, come by https://sailsjs.com/support.
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+  "env": {
+    "node": true
+  },
+
+  "parserOptions": {
+    "ecmaVersion": 2018
+  },
+
+  "globals": {
+    // If "no-undef" is enabled below, be sure to list all global variables that
+    // are used in this app's backend code (including the globalIds of models):
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    "Promise": true,
+    "sails": true,
+    "_": true,
+
+    // Models:
+    "User": true,
+    "UndeployedProfile": true,
+    "UndeployedScript": true
+    
+    // …and any others.
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  },
+
+  "rules": {
+    "block-scoped-var":             ["error"],
+    "callback-return":              ["error", ["done", "proceed", "next", "onwards", "callback", "cb"]],
+    "camelcase":                    ["warn", {"properties":"always"}],
+    "comma-style":                  ["warn", "last"],
+    "curly":                        ["warn"],
+    "eqeqeq":                       ["error", "always"],
+    "eol-last":                     ["warn"],
+    "handle-callback-err":          ["error"],
+    "indent":                       ["warn", 2, {
+      "SwitchCase": 1,
+      "MemberExpression": "off",
+      "FunctionDeclaration": {"body":1, "parameters":"off"},
+      "FunctionExpression": {"body":1, "parameters":"off"},
+      "CallExpression": {"arguments":"off"},
+      "ArrayExpression": 1,
+      "ObjectExpression": 1,
+      "ignoredNodes": ["ConditionalExpression"]
+    }],
+    "linebreak-style":              ["error", "unix"],
+    "no-dupe-keys":                 ["error"],
+    "no-duplicate-case":            ["error"],
+    "no-extra-semi":                ["warn"],
+    "no-labels":                    ["error"],
+    "no-mixed-spaces-and-tabs":     [2, "smart-tabs"],
+    "no-redeclare":                 ["warn"],
+    "no-return-assign":             ["error", "always"],
+    "no-sequences":                 ["error"],
+    "no-trailing-spaces":           ["warn"],
+    "no-undef":                     ["error"],
+    "no-unexpected-multiline":      ["warn"],
+    "no-unreachable":               ["warn"],
+    "no-unused-vars":               ["warn", {"caughtErrors":"all", "caughtErrorsIgnorePattern": "^unused($|[A-Z].*$)", "argsIgnorePattern": "^unused($|[A-Z].*$)", "varsIgnorePattern": "^unused($|[A-Z].*$)" }],
+    "no-use-before-define":         ["error", {"functions":false}],
+    "one-var":                      ["warn", "never"],
+    "prefer-arrow-callback":        ["warn", {"allowNamedFunctions":true}],
+    "quotes":                       ["warn", "single", {"avoidEscape":false, "allowTemplateLiterals":true}],
+    "semi":                         ["warn", "always"],
+    "semi-spacing":                 ["warn", {"before":false, "after":true}],
+    "semi-style":                   ["warn", "last"]
+  }
+
+}
diff --git a/ee/bulk-operations-dashboard/.gitignore b/ee/bulk-operations-dashboard/.gitignore
new file mode 100644
index 000000000000..a1ddb80e79e8
--- /dev/null
+++ b/ee/bulk-operations-dashboard/.gitignore
@@ -0,0 +1,134 @@
+################################################
+#   ┌─┐┬┌┬┐╦╔═╗╔╗╔╔═╗╦═╗╔═╗
+#   │ ┬│ │ ║║ ╦║║║║ ║╠╦╝║╣
+#  o└─┘┴ ┴ ╩╚═╝╝╚╝╚═╝╩╚═╚═╝
+#
+# > Files to exclude from your app's repo.
+#
+# This file (`.gitignore`) is only relevant if
+# you are using git.
+#
+# It exists to signify to git that certain files
+# and/or directories should be ignored for the
+# purposes of version control.
+#
+# This keeps tmp files and sensitive credentials
+# from being uploaded to  your repository.  And
+# it allows you to configure your app for your
+# machine without accidentally committing settings
+# which will smash the local settings of other
+# developers on your team.
+#
+# Some reasonable defaults are included below,
+# but, of course, you should modify/extend/prune
+# to fit your needs!
+#
+################################################
+
+
+################################################
+# Local Configuration
+#
+# Explicitly ignore files which contain:
+#
+# 1. Sensitive information you'd rather not push to
+#    your git repository.
+#    e.g., your personal API keys or passwords.
+#
+# 2. Developer-specific configuration
+#    Basically, anything that would be annoying
+#    to have to change every time you do a
+#    `git pull` on your laptop.
+#    e.g. your local development database, or
+#    the S3 bucket you're using for file uploads
+#    during development.
+#
+################################################
+
+config/local.js
+
+
+################################################
+# Dependencies
+#
+#
+# When releasing a production app, you _could_
+# hypothetically include your node_modules folder
+# in your git repo, but during development, it
+# is always best to exclude it, since different
+# developers may be working on different kernels,
+# where dependencies would need to be recompiled
+# anyway.
+#
+# Most of the time, the node_modules folder can
+# be excluded from your code repository, even
+# in production, thanks to features like the
+# package-lock.json file / NPM shrinkwrap.
+#
+# But no matter what, since this is a Sails app,
+# you should always push up the package-lock.json
+# or shrinkwrap file to your repository, to avoid
+# accidentally pulling in upgraded dependencies
+# and breaking your code.
+#
+# That said, if you are having trouble with
+# dependencies, (particularly when using
+# `npm link`) this can be pretty discouraging.
+# But rather than just adding the lockfile to
+# your .gitignore, try this first:
+# ```
+#     rm -rf node_modules
+#     rm package-lock.json
+#     npm install
+# ```
+#
+# [?] For more tips/advice, come by and say hi
+#     over at https://sailsjs.com/support
+#
+################################################
+
+node_modules
+
+
+################################################
+#
+# > Do you use bower?
+# > re: the bower_components dir, see this:
+# > http://addyosmani.com/blog/checking-in-front-end-dependencies/
+# > (credit Addy Osmani, @addyosmani)
+#
+################################################
+
+
+################################################
+# Temporary files generated by Sails/Waterline.
+################################################
+
+.tmp
+
+
+################################################
+# Miscellaneous
+#
+# Common files generated by text editors,
+# operating systems, file systems, dbs, etc.
+################################################
+
+*~
+*#
+.DS_STORE
+.netbeans
+nbproject
+.idea
+*.iml
+.vscode
+.node_history
+dump.rdb
+
+npm-debug.log
+lib-cov
+*.seed
+*.log
+*.out
+*.pid
+
diff --git a/ee/bulk-operations-dashboard/.htmlhintrc b/ee/bulk-operations-dashboard/.htmlhintrc
new file mode 100644
index 000000000000..c9b2ee72b6df
--- /dev/null
+++ b/ee/bulk-operations-dashboard/.htmlhintrc
@@ -0,0 +1,27 @@
+{
+  "alt-require": true,
+  "attr-lowercase": ["viewBox"],
+  "attr-no-duplication": true,
+  "attr-unsafe-chars": true,
+  "attr-value-double-quotes": true,
+  "attr-value-not-empty": false,
+  "csslint": false,
+  "doctype-first": false,
+  "doctype-html5": true,
+  "head-script-disabled": false,
+  "href-abs-or-rel": false,
+  "id-class-ad-disabled": true,
+  "id-class-value": false,
+  "id-unique": true,
+  "inline-script-disabled": true,
+  "inline-style-disabled": false,
+  "jshint": false,
+  "space-tab-mixed-disabled": "space",
+  "spec-char-escape": false,
+  "src-not-empty": true,
+  "style-disabled": false,
+  "tag-pair": true,
+  "tag-self-close": false,
+  "tagname-lowercase": true,
+  "title-require": false
+}
diff --git a/ee/bulk-operations-dashboard/.lesshintrc b/ee/bulk-operations-dashboard/.lesshintrc
new file mode 100644
index 000000000000..6dcb60f2787f
--- /dev/null
+++ b/ee/bulk-operations-dashboard/.lesshintrc
@@ -0,0 +1,46 @@
+{
+  //   ╦  ╔═╗╔═╗╔═╗╦ ╦╦╔╗╔╔╦╗┬─┐┌─┐
+  //   ║  ║╣ ╚═╗╚═╗╠═╣║║║║ ║ ├┬┘│
+  //  o╩═╝╚═╝╚═╝╚═╝╩ ╩╩╝╚╝ ╩ ┴└─└─┘
+  // Configuration designed for the lesshint linter.  Describes a loose set of LESS
+  // conventions that help avoid typos, unexpected failed builds, and hard-to-debug
+  // selector and CSS rule issues.
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // For more information about any of the rules below, check out the reference page
+  // of all rules at https://github.com/lesshint/lesshint/blob/v6.3.6/lib/linters/README.md
+  // If you're unsure or could use some advice, come by https://sailsjs.com/support.
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  "singleLinePerSelector": false,
+  "singleLinePerProperty": false,
+  "zeroUnit": false,
+  "idSelector": false,
+  "propertyOrdering": false,
+  "spaceAroundBang": false,
+  "fileExtensions": [".less", ".css"],
+  "excludedFiles": ["vendor.less"],
+  "importPath": false,
+  "borderZero": false,
+  "hexLength": false,
+  "hexNotation": false,
+  "newlineAfterBlock": false,
+  "spaceBeforeBrace": {
+    "style": "one_space"
+  },
+  "spaceAfterPropertyName": false,
+  "spaceAfterPropertyColon": {
+    "enabled": true,
+    "style": "one_space"
+  },
+  "maxCharPerLine": false,
+  "emptyRule": false,
+  "importantRule": true,
+  "qualifyingElement": false
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // ^^ This last one is only disabled because the lesshint parser seems to have
+  // a hard time distinguishing between things like `div.bar` and `&.bar`.
+  // In this case, the ampersand has a distinct meaning, and it does not refer
+  // to an element.  (It's referring to the case where that class is matched at
+  // the parent level, rather than talking about a descendant.)
+  // https://github.com/lesshint/lesshint/blob/v6.3.6/lib/linters/README.md#qualifyingelement
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+}
diff --git a/ee/bulk-operations-dashboard/.npmrc b/ee/bulk-operations-dashboard/.npmrc
new file mode 100644
index 000000000000..43601ce8db37
--- /dev/null
+++ b/ee/bulk-operations-dashboard/.npmrc
@@ -0,0 +1,11 @@
+######################
+#   ╔╗╔╔═╗╔╦╗┬─┐┌─┐  #
+#   ║║║╠═╝║║║├┬┘│    #
+#  o╝╚╝╩  ╩ ╩┴└─└─┘  #
+######################
+
+# Hide NPM log output unless it is related to an error of some kind:
+loglevel=error
+
+# Make "npm audit" an opt-in thing for subsequent installs within this app:
+audit=false
diff --git a/ee/bulk-operations-dashboard/.sailsrc b/ee/bulk-operations-dashboard/.sailsrc
new file mode 100644
index 000000000000..782d995af6ba
--- /dev/null
+++ b/ee/bulk-operations-dashboard/.sailsrc
@@ -0,0 +1,12 @@
+{
+  "hooks": {
+    "sockets": false
+  },
+  "generators": {
+    "modules": {}
+  },
+  "_generatedWith": {
+    "sails": "1.5.11",
+    "sails-generate": "2.0.11"
+  }
+}
diff --git a/ee/bulk-operations-dashboard/Dockerfile b/ee/bulk-operations-dashboard/Dockerfile
new file mode 100644
index 000000000000..c68b6f335a8e
--- /dev/null
+++ b/ee/bulk-operations-dashboard/Dockerfile
@@ -0,0 +1,26 @@
+# Use the official Node.js 14 image as a base
+FROM node:20@sha256:e06aae17c40c7a6b5296ca6f942a02e6737ae61bbbf3e2158624bb0f887991b5
+
+# Set the working directory in the container
+WORKDIR /usr/src/app
+
+# Copy the package.json
+COPY package.json ./
+
+# Install vulnerability dashboard dependencies
+RUN npm install
+
+# Copy the vulnerability dashboard into the container
+COPY . .
+
+# Copy the entrypoint script into the container
+COPY entrypoint.sh /usr/src/app/entrypoint.sh
+
+# Make sure the entrypoint script is executable
+RUN chmod +x /usr/src/app/entrypoint.sh
+
+# Expose the port the vulnerability dashboard runs on
+EXPOSE 1337
+
+# Set the entrypoint script as the entry point
+ENTRYPOINT ["/usr/src/app/entrypoint.sh"]
diff --git a/ee/bulk-operations-dashboard/Gruntfile.js b/ee/bulk-operations-dashboard/Gruntfile.js
new file mode 100644
index 000000000000..e3b284733824
--- /dev/null
+++ b/ee/bulk-operations-dashboard/Gruntfile.js
@@ -0,0 +1,23 @@
+/**
+ * Gruntfile
+ *
+ * This Node script is executed when you run `grunt`-- and also when
+ * you run `sails lift` (provided the grunt hook is installed and
+ * hasn't been disabled).
+ *
+ * WARNING:
+ * Unless you know what you're doing, you shouldn't change this file.
+ * Check out the `tasks/` directory instead.
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/Gruntfile.js
+ */
+module.exports = function(grunt) {
+
+  var loadGruntTasks = require('sails-hook-grunt/accessible/load-grunt-tasks');
+
+  // Load Grunt task configurations (from `tasks/config/`) and Grunt
+  // task registrations (from `tasks/register/`).
+  loadGruntTasks(__dirname, grunt);
+
+};
diff --git a/ee/bulk-operations-dashboard/README.md b/ee/bulk-operations-dashboard/README.md
new file mode 100644
index 000000000000..678396b623f3
--- /dev/null
+++ b/ee/bulk-operations-dashboard/README.md
@@ -0,0 +1,49 @@
+# Bulk operations dashboard
+
+
+A dashboard to easily manage profiles and scripts across multiple teams on a Fleet instance.
+
+
+## Dependencies
+
+- A datastore, this app was built using Postgres, but you can use a database of your choice.
+
+- A Redis database - For session storage.
+
+
+## Configuration
+
+This app has two required custom configuration values:
+
+- `sails.config.custom.fleetBaseUrl`: The full URL of your Fleet instance. (e.g., https://fleet.example.com)
+
+- `sails.config.custom.fleetApiToken`: An API token for an API-only user on your Fleet instance.
+
+
+
+## Running the bulk operations dashboard with Docker.
+
+To run a local bulk operations dashboard with docker, you can follow these instructions.
+
+1. Clone this repo
+2. Update the following ENV variables `ee/bulk-operations-dashboard/docker-compose.yml` file:
+
+  1. `sails_custom__fleetBaseUrl`: The full URL of your Fleet instance. (e.g., https://fleet.example.com)
+
+  2. `sails_custom__fleetApiToken`: An API token for an API-only user on your Fleet instance.
+
+  >You can read about how to create an API-only user and get it's token [here](https://fleetdm.com/docs/using-fleet/fleetctl-cli#create-api-only-user)
+
+3. Open the `ee/bulk-operations-dashboard/` folder in your terminal.
+
+4. Run `docker compose up --build` to build the bulk operations dashboard's Docker image.
+
+  > The first time the bulk operations dashboard starts it will Initalize the database aby running the `config/bootstrap.js` script before the server starts.
+
+5. Once the container is done building, the bulk operations dashboard will be available at http://localhost:1337
+
+  > You can login with the default admin login:
+  >
+  >- Email address: `admin@example.com`
+  >
+  >- Password: `abc123`
diff --git a/ee/bulk-operations-dashboard/api/controllers/account/logout.js b/ee/bulk-operations-dashboard/api/controllers/account/logout.js
new file mode 100644
index 000000000000..61e50d8c1995
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/account/logout.js
@@ -0,0 +1,55 @@
+module.exports = {
+
+
+  friendlyName: 'Logout',
+
+
+  description: 'Log out of this app.',
+
+
+  extendedDescription:
+`This action deletes the \`req.session.userId\` key from the session of the requesting user agent.
+Actual garbage collection of session data depends on this app's session store, and
+potentially also on the [TTL configuration](https://sailsjs.com/docs/reference/configuration/sails-config-session)
+you provided for it.
+
+Note that this action does not check to see whether or not the requesting user was
+actually logged in.  (If they weren't, then this action is just a no-op.)`,
+
+
+  exits: {
+
+    success: {
+      description: 'The requesting user agent has been successfully logged out.'
+    },
+
+    redirect: {
+      description: 'The requesting user agent looks to be a web browser.',
+      extendedDescription: 'After logging out from a web browser, the user is redirected away.',
+      responseType: 'redirect'
+    }
+
+  },
+
+
+  fn: async function () {
+
+    // Clear the `userId` property from this session.
+    delete this.req.session.userId;
+
+    // Broadcast a message that we can display in other open tabs.
+    if (sails.hooks.sockets) {
+      await sails.helpers.broadcastSessionChange(this.req);
+    }
+
+    // Then finish up, sending an appropriate response.
+    // > Under the covers, this persists the now-logged-out session back
+    // > to the underlying session store.
+    if (!this.req.wantsJSON) {
+      throw {redirect: '/login'};
+    }
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/account/update-billing-card.js b/ee/bulk-operations-dashboard/api/controllers/account/update-billing-card.js
new file mode 100644
index 000000000000..7cbeac5bab10
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/account/update-billing-card.js
@@ -0,0 +1,79 @@
+module.exports = {
+
+
+  friendlyName: 'Update billing card',
+
+
+  description: 'Update the credit card for the logged-in user.',
+
+
+  inputs: {
+
+    stripeToken: {
+      type: 'string',
+      example: 'tok_199k3qEXw14QdSnRwmsK99MH',
+      description: 'The single-use Stripe Checkout token identifier representing the user\'s payment source (i.e. credit card.)',
+      extendedDescription: 'Omit this (or use "") to remove this user\'s payment source.',
+      whereToGet: {
+        description: 'This Stripe.js token is provided to the front-end (client-side) code after completing a Stripe Checkout or Stripe Elements flow.'
+      }
+    },
+
+    billingCardLast4: {
+      type: 'string',
+      example: '4242',
+      description: 'Omit if removing card info.',
+      whereToGet: { description: 'Credit card info is provided by Stripe after completing the checkout flow.' }
+    },
+
+    billingCardBrand: {
+      type: 'string',
+      example: 'visa',
+      description: 'Omit if removing card info.',
+      whereToGet: { description: 'Credit card info is provided by Stripe after completing the checkout flow.' }
+    },
+
+    billingCardExpMonth: {
+      type: 'string',
+      example: '08',
+      description: 'Omit if removing card info.',
+      whereToGet: { description: 'Credit card info is provided by Stripe after completing the checkout flow.' }
+    },
+
+    billingCardExpYear: {
+      type: 'string',
+      example: '2023',
+      description: 'Omit if removing card info.',
+      whereToGet: { description: 'Credit card info is provided by Stripe after completing the checkout flow.' }
+    },
+
+  },
+
+
+  fn: async function ({stripeToken, billingCardLast4, billingCardBrand, billingCardExpMonth, billingCardExpYear}) {
+
+    // Add, update, or remove the default payment source for the logged-in user's
+    // customer entry in Stripe.
+    var stripeCustomerId = await sails.helpers.stripe.saveBillingInfo.with({
+      stripeCustomerId: this.req.me.stripeCustomerId,
+      token: stripeToken || '',
+    }).timeout(5000).retry();
+
+    // Update (or clear) the card info we have stored for this user in our database.
+    // > Remember, never store complete card numbers-- only the last 4 digits + expiration!
+    // > Storing (or even receiving) complete, unencrypted card numbers would require PCI
+    // > compliance in the U.S.
+    await User.updateOne({ id: this.req.me.id })
+    .set({
+      stripeCustomerId,
+      hasBillingCard: stripeToken ? true : false,
+      billingCardBrand: stripeToken ? billingCardBrand : '',
+      billingCardLast4: stripeToken ? billingCardLast4 : '',
+      billingCardExpMonth: stripeToken ? billingCardExpMonth : '',
+      billingCardExpYear: stripeToken ? billingCardExpYear : ''
+    });
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/account/update-password.js b/ee/bulk-operations-dashboard/api/controllers/account/update-password.js
new file mode 100644
index 000000000000..00a53a38d676
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/account/update-password.js
@@ -0,0 +1,35 @@
+module.exports = {
+
+
+  friendlyName: 'Update password',
+
+
+  description: 'Update the password for the logged-in user.',
+
+
+  inputs: {
+
+    password: {
+      description: 'The new, unencrypted password.',
+      example: 'abc123v2',
+      required: true
+    }
+
+  },
+
+
+  fn: async function ({password}) {
+
+    // Hash the new password.
+    var hashed = await sails.helpers.passwords.hashPassword(password);
+
+    // Update the record for the logged-in user.
+    await User.updateOne({ id: this.req.me.id })
+    .set({
+      password: hashed
+    });
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/account/update-profile.js b/ee/bulk-operations-dashboard/api/controllers/account/update-profile.js
new file mode 100644
index 000000000000..afc5fd1b5477
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/account/update-profile.js
@@ -0,0 +1,160 @@
+module.exports = {
+
+
+  friendlyName: 'Update profile',
+
+
+  description: 'Update the profile for the logged-in user.',
+
+
+  inputs: {
+
+    fullName: {
+      type: 'string'
+    },
+
+    emailAddress: {
+      type: 'string'
+    },
+
+  },
+
+
+  exits: {
+
+    emailAlreadyInUse: {
+      statusCode: 409,
+      description: 'The provided email address is already in use.',
+    },
+
+  },
+
+
+  fn: async function ({fullName, emailAddress}) {
+
+    var newEmailAddress = emailAddress;
+    if (newEmailAddress !== undefined) {
+      newEmailAddress = newEmailAddress.toLowerCase();
+    }
+
+    // Determine if this request wants to change the current user's email address,
+    // revert her pending email address change, modify her pending email address
+    // change, or if the email address won't be affected at all.
+    var desiredEmailEffect;// ('change-immediately', 'begin-change', 'cancel-pending-change', 'modify-pending-change', or '')
+    if (
+      newEmailAddress === undefined ||
+      (this.req.me.emailStatus !== 'change-requested' && newEmailAddress === this.req.me.emailAddress) ||
+      (this.req.me.emailStatus === 'change-requested' && newEmailAddress === this.req.me.emailChangeCandidate)
+    ) {
+      desiredEmailEffect = '';
+    } else if (this.req.me.emailStatus === 'change-requested' && newEmailAddress === this.req.me.emailAddress) {
+      desiredEmailEffect = 'cancel-pending-change';
+    } else if (this.req.me.emailStatus === 'change-requested' && newEmailAddress !== this.req.me.emailAddress) {
+      desiredEmailEffect = 'modify-pending-change';
+    } else if (!sails.config.custom.verifyEmailAddresses || this.req.me.emailStatus === 'unconfirmed') {
+      desiredEmailEffect = 'change-immediately';
+    } else {
+      desiredEmailEffect = 'begin-change';
+    }
+
+
+    // If the email address is changing, make sure it is not already being used.
+    if (_.contains(['begin-change', 'change-immediately', 'modify-pending-change'], desiredEmailEffect)) {
+      let conflictingUser = await User.findOne({
+        or: [
+          { emailAddress: newEmailAddress },
+          { emailChangeCandidate: newEmailAddress }
+        ]
+      });
+      if (conflictingUser) {
+        throw 'emailAlreadyInUse';
+      }
+    }
+
+
+    // Start building the values to set in the db.
+    // (We always set the fullName if provided.)
+    var valuesToSet = {
+      fullName,
+    };
+
+    switch (desiredEmailEffect) {
+
+      // Change now
+      case 'change-immediately':
+        _.extend(valuesToSet, {
+          emailAddress: newEmailAddress,
+          emailChangeCandidate: '',
+          emailProofToken: '',
+          emailProofTokenExpiresAt: 0,
+          emailStatus: this.req.me.emailStatus === 'unconfirmed' ? 'unconfirmed' : 'confirmed'
+        });
+        break;
+
+      // Begin new email change, or modify a pending email change
+      case 'begin-change':
+      case 'modify-pending-change':
+        _.extend(valuesToSet, {
+          emailChangeCandidate: newEmailAddress,
+          emailProofToken: await sails.helpers.strings.random('url-friendly'),
+          emailProofTokenExpiresAt: Date.now() + sails.config.custom.emailProofTokenTTL,
+          emailStatus: 'change-requested'
+        });
+        break;
+
+      // Cancel pending email change
+      case 'cancel-pending-change':
+        _.extend(valuesToSet, {
+          emailChangeCandidate: '',
+          emailProofToken: '',
+          emailProofTokenExpiresAt: 0,
+          emailStatus: 'confirmed'
+        });
+        break;
+
+      // Otherwise, do nothing re: email
+    }
+
+    // Save to the db
+    await User.updateOne({id: this.req.me.id })
+    .set(valuesToSet);
+
+    // If this is an immediate change, and billing features are enabled,
+    // then also update the billing email for this user's linked customer entry
+    // in the Stripe API to make sure they receive email receipts.
+    // > Note: If there was not already a Stripe customer entry for this user,
+    // > then one will be set up implicitly, so we'll need to persist it to our
+    // > database.  (This could happen if Stripe credentials were not configured
+    // > at the time this user was originally created.)
+    if(desiredEmailEffect === 'change-immediately' && sails.config.custom.enableBillingFeatures) {
+      let didNotAlreadyHaveCustomerId = (! this.req.me.stripeCustomerId);
+      let stripeCustomerId = await sails.helpers.stripe.saveBillingInfo.with({
+        stripeCustomerId: this.req.me.stripeCustomerId,
+        emailAddress: newEmailAddress
+      }).timeout(5000).retry();
+      if (didNotAlreadyHaveCustomerId){
+        await User.updateOne({ id: this.req.me.id })
+        .set({
+          stripeCustomerId
+        });
+      }
+    }
+
+    // If an email address change was requested, and re-confirmation is required,
+    // send the "confirm account" email.
+    if (desiredEmailEffect === 'begin-change' || desiredEmailEffect === 'modify-pending-change') {
+      await sails.helpers.sendTemplateEmail.with({
+        to: newEmailAddress,
+        subject: 'Your account has been updated',
+        template: 'email-verify-new-email',
+        templateData: {
+          fullName: fullName||this.req.me.fullName,
+          token: valuesToSet.emailProofToken
+        }
+      });
+    }
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/account/view-account-overview.js b/ee/bulk-operations-dashboard/api/controllers/account/view-account-overview.js
new file mode 100644
index 000000000000..f5841f99813d
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/account/view-account-overview.js
@@ -0,0 +1,30 @@
+module.exports = {
+
+
+  friendlyName: 'View account overview',
+
+
+  description: 'Display "Account Overview" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/account/account-overview',
+    }
+
+  },
+
+
+  fn: async function () {
+
+    // If billing features are enabled, include our configured Stripe.js
+    // public key in the view locals.  Otherwise, leave it as undefined.
+    return {
+      stripePublishableKey: sails.config.custom.enableBillingFeatures? sails.config.custom.stripePublishableKey : undefined,
+    };
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/account/view-edit-password.js b/ee/bulk-operations-dashboard/api/controllers/account/view-edit-password.js
new file mode 100644
index 000000000000..208a1d6a3fbc
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/account/view-edit-password.js
@@ -0,0 +1,26 @@
+module.exports = {
+
+
+  friendlyName: 'View edit password',
+
+
+  description: 'Display "Edit password" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/account/edit-password'
+    }
+
+  },
+
+
+  fn: async function () {
+
+    return {};
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/account/view-edit-profile.js b/ee/bulk-operations-dashboard/api/controllers/account/view-edit-profile.js
new file mode 100644
index 000000000000..baea0f7c206d
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/account/view-edit-profile.js
@@ -0,0 +1,26 @@
+module.exports = {
+
+
+  friendlyName: 'View edit profile',
+
+
+  description: 'Display "Edit profile" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/account/edit-profile',
+    }
+
+  },
+
+
+  fn: async function () {
+
+    return {};
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/confirm-email.js b/ee/bulk-operations-dashboard/api/controllers/entrance/confirm-email.js
new file mode 100644
index 000000000000..01afe04cd968
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/confirm-email.js
@@ -0,0 +1,160 @@
+module.exports = {
+
+
+  friendlyName: 'Confirm email',
+
+
+  description:
+`Confirm a new user's email address, or an existing user's request for an email address change,
+then redirect to either a special landing page (for newly-signed up users), or the account page
+(for existing users who just changed their email address).`,
+
+
+  inputs: {
+
+    token: {
+      description: 'The confirmation token from the email.',
+      example: '4-32fad81jdaf$329'
+    }
+
+  },
+
+
+  exits: {
+
+    success: {
+      description: 'Email address confirmed and requesting user logged in.'
+    },
+
+    redirect: {
+      description: 'Email address confirmed and requesting user logged in.  Since this looks like a browser, redirecting...',
+      responseType: 'redirect'
+    },
+
+    invalidOrExpiredToken: {
+      responseType: 'expired',
+      description: 'The provided token is expired, invalid, or already used up.',
+    },
+
+    emailAddressNoLongerAvailable: {
+      statusCode: 409,
+      viewTemplatePath: '500',
+      description: 'The email address is no longer available.',
+      extendedDescription: 'This is an edge case that is not always anticipated by websites and APIs.  Since it is pretty rare, the 500 server error page is used as a simple catch-all.  If this becomes important in the future, this could easily be expanded into a custom error page or resolution flow.  But for context: this behavior of showing the 500 server error page mimics how popular apps like Slack behave under the same circumstances.',
+    }
+
+  },
+
+
+  fn: async function ({token}) {
+
+    // If no token was provided, this is automatically invalid.
+    if (!token) {
+      throw 'invalidOrExpiredToken';
+    }
+
+    // Get the user with the matching email token.
+    var user = await User.findOne({ emailProofToken: token });
+
+    // If no such user exists, or their token is expired, bail.
+    if (!user || user.emailProofTokenExpiresAt <= Date.now()) {
+      throw 'invalidOrExpiredToken';
+    }
+
+    if (user.emailStatus === 'unconfirmed') {
+      //  ┌─┐┌─┐┌┐┌┌─┐┬┬─┐┌┬┐┬┌┐┌┌─┐  ╔═╗╦╦═╗╔═╗╔╦╗ ╔╦╗╦╔╦╗╔═╗  ╦ ╦╔═╗╔═╗╦═╗  ┌─┐┌┬┐┌─┐┬┬
+      //  │  │ ││││├┤ │├┬┘││││││││ ┬  ╠╣ ║╠╦╝╚═╗ ║───║ ║║║║║╣   ║ ║╚═╗║╣ ╠╦╝  ├┤ │││├─┤││
+      //  └─┘└─┘┘└┘└  ┴┴└─┴ ┴┴┘└┘└─┘  ╚  ╩╩╚═╚═╝ ╩   ╩ ╩╩ ╩╚═╝  ╚═╝╚═╝╚═╝╩╚═  └─┘┴ ┴┴ ┴┴┴─┘
+      // If this is a new user confirming their email for the first time,
+      // then just update the state of their user record in the database,
+      // store their user id in the session (just in case they aren't logged
+      // in already), and then redirect them to the "email confirmed" page.
+      await User.updateOne({ id: user.id }).set({
+        emailStatus: 'confirmed',
+        emailProofToken: '',
+        emailProofTokenExpiresAt: 0
+      });
+      this.req.session.userId = user.id;
+
+      // In case there was an existing session, broadcast a message that we can
+      // display in other open tabs.
+      if (sails.hooks.sockets) {
+        await sails.helpers.broadcastSessionChange(this.req);
+      }
+
+      if (this.req.wantsJSON) {
+        return;
+      } else {
+        throw { redirect: '/email/confirmed' };
+      }
+
+    } else if (user.emailStatus === 'change-requested') {
+      //  ┌─┐┌─┐┌┐┌┌─┐┬┬─┐┌┬┐┬┌┐┌┌─┐  ╔═╗╦ ╦╔═╗╔╗╔╔═╗╔═╗╔╦╗  ┌─┐┌┬┐┌─┐┬┬
+      //  │  │ ││││├┤ │├┬┘││││││││ ┬  ║  ╠═╣╠═╣║║║║ ╦║╣  ║║  ├┤ │││├─┤││
+      //  └─┘└─┘┘└┘└  ┴┴└─┴ ┴┴┘└┘└─┘  ╚═╝╩ ╩╩ ╩╝╚╝╚═╝╚═╝═╩╝  └─┘┴ ┴┴ ┴┴┴─┘
+      if (!user.emailChangeCandidate){
+        throw new Error(`Consistency violation: Could not update Stripe customer because this user record's emailChangeCandidate ("${user.emailChangeCandidate}") is missing.  (This should never happen.)`);
+      }
+
+      // Last line of defense: since email change candidates are not protected
+      // by a uniqueness constraint in the database, it's important that we make
+      // sure no one else managed to grab this email in the mean time since we
+      // last checked its availability. (This is a relatively rare edge case--
+      // see exit description.)
+      if (await User.count({ emailAddress: user.emailChangeCandidate }) > 0) {
+        throw 'emailAddressNoLongerAvailable';
+      }
+
+      // If billing features are enabled, also update the billing email for this
+      // user's linked customer entry in the Stripe API to make sure they receive
+      // email receipts.
+      // > Note: If there was not already a Stripe customer entry for this user,
+      // > then one will be set up implicitly, so we'll need to persist it to our
+      // > database.  (This could happen if Stripe credentials were not configured
+      // > at the time this user was originally created.)
+      if(sails.config.custom.enableBillingFeatures) {
+        let didNotAlreadyHaveCustomerId = (! user.stripeCustomerId);
+        let stripeCustomerId = await sails.helpers.stripe.saveBillingInfo.with({
+          stripeCustomerId: user.stripeCustomerId,
+          emailAddress: user.emailChangeCandidate
+        }).timeout(5000).retry();
+        if (didNotAlreadyHaveCustomerId){
+          await User.updateOne({ id: user.id }).set({
+            stripeCustomerId
+          });
+        }
+      }
+
+      // Finally update the user in the database, store their id in the session
+      // (just in case they aren't logged in already), then redirect them to
+      // their "my account" page so they can see their updated email address.
+      await User.updateOne({ id: user.id })
+      .set({
+        emailStatus: 'confirmed',
+        emailProofToken: '',
+        emailProofTokenExpiresAt: 0,
+        emailAddress: user.emailChangeCandidate,
+        emailChangeCandidate: '',
+      });
+      this.req.session.userId = user.id;
+
+      // In case there was an existing session, broadcast a message that we can
+      // display in other open tabs.
+      if (sails.hooks.sockets) {
+        await sails.helpers.broadcastSessionChange(this.req);
+      }
+
+      if (this.req.wantsJSON) {
+        return;
+      } else {
+        throw { redirect: '/account' };
+      }
+
+    } else {
+      throw new Error(`Consistency violation: User ${user.id} has an email proof token, but somehow also has an emailStatus of "${user.emailStatus}"!  (This should never happen.)`);
+    }
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/login.js b/ee/bulk-operations-dashboard/api/controllers/entrance/login.js
new file mode 100644
index 000000000000..a95aabf84c79
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/login.js
@@ -0,0 +1,119 @@
+module.exports = {
+
+
+  friendlyName: 'Login',
+
+
+  description: 'Log in using the provided email and password combination.',
+
+
+  extendedDescription:
+`This action attempts to look up the user record in the database with the
+specified email address.  Then, if such a user exists, it uses
+bcrypt to compare the hashed password from the database with the provided
+password attempt.`,
+
+
+  inputs: {
+
+    emailAddress: {
+      description: 'The email to try in this attempt, e.g. "irl@example.com".',
+      type: 'string',
+      required: true
+    },
+
+    password: {
+      description: 'The unencrypted password to try in this attempt, e.g. "passwordlol".',
+      type: 'string',
+      required: true
+    },
+
+    rememberMe: {
+      description: 'Whether to extend the lifetime of the user\'s session.',
+      extendedDescription:
+`Note that this is NOT SUPPORTED when using virtual requests (e.g. sending
+requests over WebSockets instead of HTTP).`,
+      type: 'boolean'
+    }
+
+  },
+
+
+  exits: {
+
+    success: {
+      description: 'The requesting user agent has been successfully logged in.',
+      extendedDescription:
+`Under the covers, this stores the id of the logged-in user in the session
+as the \`userId\` key.  The next time this user agent sends a request, assuming
+it includes a cookie (like a web browser), Sails will automatically make this
+user id available as req.session.userId in the corresponding action.  (Also note
+that, thanks to the included "custom" hook, when a relevant request is received
+from a logged-in user, that user's entire record from the database will be fetched
+and exposed as \`req.me\`.)`
+    },
+
+    badCombo: {
+      description: `The provided email and password combination does not
+      match any user in the database.`,
+      responseType: 'unauthorized'
+      // ^This uses the custom `unauthorized` response located in `api/responses/unauthorized.js`.
+      // To customize the generic "unauthorized" response across this entire app, change that file
+      // (see api/responses/unauthorized).
+      //
+      // To customize the response for _only this_ action, replace `responseType` with
+      // something else.  For example, you might set `statusCode: 498` and change the
+      // implementation below accordingly (see http://sailsjs.com/docs/concepts/controllers).
+    }
+
+  },
+
+
+  fn: async function ({emailAddress, password, rememberMe}) {
+
+    // Look up by the email address.
+    // (note that we lowercase it to ensure the lookup is always case-insensitive,
+    // regardless of which database we're using)
+    var userRecord = await User.findOne({
+      emailAddress: emailAddress.toLowerCase(),
+    });
+
+    // If there was no matching user, respond thru the "badCombo" exit.
+    if(!userRecord) {
+      throw 'badCombo';
+    }
+
+    // If the password doesn't match, then also exit thru "badCombo".
+    await sails.helpers.passwords.checkPassword(password, userRecord.password)
+    .intercept('incorrect', 'badCombo');
+
+    // If "Remember Me" was enabled, then keep the session alive for
+    // a longer amount of time.  (This causes an updated "Set Cookie"
+    // response header to be sent as the result of this request -- thus
+    // we must be dealing with a traditional HTTP request in order for
+    // this to work.)
+    if (rememberMe) {
+      if (this.req.isSocket) {
+        sails.log.warn(
+          'Received `rememberMe: true` from a virtual request, but it was ignored\n'+
+          'because a browser\'s session cookie cannot be reset over sockets.\n'+
+          'Please use a traditional HTTP request instead.'
+        );
+      } else {
+        this.req.session.cookie.maxAge = sails.config.custom.rememberMeCookieMaxAge;
+      }
+    }//fi
+
+    // Modify the active session instance.
+    // (This will be persisted when the response is sent.)
+    this.req.session.userId = userRecord.id;
+
+    // In case there was an existing session (e.g. if we allow users to go to the login page
+    // when they're already logged in), broadcast a message that we can display in other open tabs.
+    if (sails.hooks.sockets) {
+      await sails.helpers.broadcastSessionChange(this.req);
+    }
+
+  }
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/send-password-recovery-email.js b/ee/bulk-operations-dashboard/api/controllers/entrance/send-password-recovery-email.js
new file mode 100644
index 000000000000..21d8f0efa287
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/send-password-recovery-email.js
@@ -0,0 +1,66 @@
+module.exports = {
+
+
+  friendlyName: 'Send password recovery email',
+
+
+  description: 'Send a password recovery notification to the user with the specified email address.',
+
+
+  inputs: {
+
+    emailAddress: {
+      description: 'The email address of the alleged user who wants to recover their password.',
+      example: 'rydahl@example.com',
+      type: 'string',
+      required: true
+    }
+
+  },
+
+
+  exits: {
+
+    success: {
+      description: 'The email address might have matched a user in the database.  (If so, a recovery email was sent.)'
+    },
+
+  },
+
+
+  fn: async function ({emailAddress}) {
+
+    // Find the record for this user.
+    // (Even if no such user exists, pretend it worked to discourage sniffing.)
+    var userRecord = await User.findOne({ emailAddress });
+    if (!userRecord) {
+      return;
+    }//•
+
+    // Come up with a pseudorandom, probabilistically-unique token for use
+    // in our password recovery email.
+    var token = await sails.helpers.strings.random('url-friendly');
+
+    // Store the token on the user record
+    // (This allows us to look up the user when the link from the email is clicked.)
+    await User.updateOne({ id: userRecord.id })
+    .set({
+      passwordResetToken: token,
+      passwordResetTokenExpiresAt: Date.now() + sails.config.custom.passwordResetTokenTTL,
+    });
+
+    // Send recovery email
+    await sails.helpers.sendTemplateEmail.with({
+      to: emailAddress,
+      subject: 'Password reset instructions',
+      template: 'email-reset-password',
+      templateData: {
+        fullName: userRecord.fullName,
+        token: token
+      }
+    });
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/signup.js b/ee/bulk-operations-dashboard/api/controllers/entrance/signup.js
new file mode 100644
index 000000000000..e1fd133c593a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/signup.js
@@ -0,0 +1,127 @@
+module.exports = {
+
+
+  friendlyName: 'Signup',
+
+
+  description: 'Sign up for a new user account.',
+
+
+  extendedDescription:
+`This creates a new user record in the database, signs in the requesting user agent
+by modifying its [session](https://sailsjs.com/documentation/concepts/sessions), and
+(if emailing with Mailgun is enabled) sends an account verification email.
+
+If a verification email is sent, the new user's account is put in an "unconfirmed" state
+until they confirm they are using a legitimate email address (by clicking the link in
+the account verification message.)`,
+
+
+  inputs: {
+
+    emailAddress: {
+      required: true,
+      type: 'string',
+      isEmail: true,
+      description: 'The email address for the new account, e.g. m@example.com.',
+      extendedDescription: 'Must be a valid email address.',
+    },
+
+    password: {
+      required: true,
+      type: 'string',
+      maxLength: 200,
+      example: 'passwordlol',
+      description: 'The unencrypted password to use for the new account.'
+    },
+
+    fullName:  {
+      required: true,
+      type: 'string',
+      example: 'Frida Kahlo de Rivera',
+      description: 'The user\'s full name.',
+    }
+
+  },
+
+
+  exits: {
+
+    success: {
+      description: 'New user account was created successfully.'
+    },
+
+    invalid: {
+      responseType: 'badRequest',
+      description: 'The provided fullName, password and/or email address are invalid.',
+      extendedDescription: 'If this request was sent from a graphical user interface, the request '+
+      'parameters should have been validated/coerced _before_ they were sent.'
+    },
+
+    emailAlreadyInUse: {
+      statusCode: 409,
+      description: 'The provided email address is already in use.',
+    },
+
+  },
+
+
+  fn: async function ({emailAddress, password, fullName}) {
+
+    var newEmailAddress = emailAddress.toLowerCase();
+
+    // Build up data for the new user record and save it to the database.
+    // (Also use `fetch` to retrieve the new ID so that we can use it below.)
+    var newUserRecord = await User.create(_.extend({
+      fullName,
+      emailAddress: newEmailAddress,
+      password: await sails.helpers.passwords.hashPassword(password),
+      tosAcceptedByIp: this.req.ip
+    }, sails.config.custom.verifyEmailAddresses? {
+      emailProofToken: await sails.helpers.strings.random('url-friendly'),
+      emailProofTokenExpiresAt: Date.now() + sails.config.custom.emailProofTokenTTL,
+      emailStatus: 'unconfirmed'
+    }:{}))
+    .intercept('E_UNIQUE', 'emailAlreadyInUse')
+    .intercept({name: 'UsageError'}, 'invalid')
+    .fetch();
+
+    // If billing feaures are enabled, save a new customer entry in the Stripe API.
+    // Then persist the Stripe customer id in the database.
+    if (sails.config.custom.enableBillingFeatures) {
+      let stripeCustomerId = await sails.helpers.stripe.saveBillingInfo.with({
+        emailAddress: newEmailAddress
+      }).timeout(5000).retry();
+      await User.updateOne({id: newUserRecord.id})
+      .set({
+        stripeCustomerId
+      });
+    }
+
+    // Store the user's new id in their session.
+    this.req.session.userId = newUserRecord.id;
+
+    // In case there was an existing session (e.g. if we allow users to go to the signup page
+    // when they're already logged in), broadcast a message that we can display in other open tabs.
+    if (sails.hooks.sockets) {
+      await sails.helpers.broadcastSessionChange(this.req);
+    }
+
+    if (sails.config.custom.verifyEmailAddresses) {
+      // Send "confirm account" email
+      await sails.helpers.sendTemplateEmail.with({
+        to: newEmailAddress,
+        subject: 'Please confirm your account',
+        template: 'email-verify-account',
+        templateData: {
+          fullName,
+          token: newUserRecord.emailProofToken
+        }
+      });
+    } else {
+      sails.log.info('Skipping new account email verification... (since `verifyEmailAddresses` is disabled)');
+    }
+
+  }
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/update-password-and-login.js b/ee/bulk-operations-dashboard/api/controllers/entrance/update-password-and-login.js
new file mode 100644
index 000000000000..51a75b8746d6
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/update-password-and-login.js
@@ -0,0 +1,80 @@
+module.exports = {
+
+
+  friendlyName: 'Update password and login',
+
+
+  description: 'Finish the password recovery flow by setting the new password and '+
+  'logging in the requesting user, based on the authenticity of their token.',
+
+
+  inputs: {
+
+    password: {
+      description: 'The new, unencrypted password.',
+      example: 'abc123v2',
+      required: true
+    },
+
+    token: {
+      description: 'The password token that was generated by the `sendPasswordRecoveryEmail` endpoint.',
+      example: 'gwa8gs8hgw9h2g9hg29hgwh9asdgh9q34$$$$$asdgasdggds',
+      required: true
+    }
+
+  },
+
+
+  exits: {
+
+    success: {
+      description: 'Password successfully updated, and requesting user agent is now logged in.'
+    },
+
+    invalidToken: {
+      description: 'The provided password token is invalid, expired, or has already been used.',
+      responseType: 'expired'
+    }
+
+  },
+
+
+  fn: async function ({password, token}) {
+
+    if(!token) {
+      throw 'invalidToken';
+    }
+
+    // Look up the user with this reset token.
+    var userRecord = await User.findOne({ passwordResetToken: token });
+
+    // If no such user exists, or their token is expired, bail.
+    if (!userRecord || userRecord.passwordResetTokenExpiresAt <= Date.now()) {
+      throw 'invalidToken';
+    }
+
+    // Hash the new password.
+    var hashed = await sails.helpers.passwords.hashPassword(password);
+
+    // Store the user's new password and clear their reset token so it can't be used again.
+    await User.updateOne({ id: userRecord.id })
+    .set({
+      password: hashed,
+      passwordResetToken: '',
+      passwordResetTokenExpiresAt: 0
+    });
+
+    // Log the user in.
+    // (This will be persisted when the response is sent.)
+    this.req.session.userId = userRecord.id;
+
+    // In case there was an existing session, broadcast a message that we can
+    // display in other open tabs.
+    if (sails.hooks.sockets) {
+      await sails.helpers.broadcastSessionChange(this.req);
+    }
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/view-confirmed-email.js b/ee/bulk-operations-dashboard/api/controllers/entrance/view-confirmed-email.js
new file mode 100644
index 000000000000..0602f10e9936
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/view-confirmed-email.js
@@ -0,0 +1,27 @@
+module.exports = {
+
+
+  friendlyName: 'View confirmed email',
+
+
+  description: 'Display "Confirmed email" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/entrance/confirmed-email'
+    }
+
+  },
+
+
+  fn: async function () {
+
+    // Respond with view.
+    return {};
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/view-forgot-password.js b/ee/bulk-operations-dashboard/api/controllers/entrance/view-forgot-password.js
new file mode 100644
index 000000000000..e6b5404c9f3d
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/view-forgot-password.js
@@ -0,0 +1,36 @@
+module.exports = {
+
+
+  friendlyName: 'View forgot password',
+
+
+  description: 'Display "Forgot password" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/entrance/forgot-password',
+    },
+
+    redirect: {
+      description: 'The requesting user is already logged in.',
+      extendedDescription: 'Logged-in users should change their password in "Account settings."',
+      responseType: 'redirect',
+    }
+
+  },
+
+
+  fn: async function () {
+
+    if (this.req.me) {
+      throw {redirect: '/'};
+    }
+
+    return {};
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/view-login.js b/ee/bulk-operations-dashboard/api/controllers/entrance/view-login.js
new file mode 100644
index 000000000000..1d1c590b53bc
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/view-login.js
@@ -0,0 +1,35 @@
+module.exports = {
+
+
+  friendlyName: 'View login',
+
+
+  description: 'Display "Login" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/entrance/login',
+    },
+
+    redirect: {
+      description: 'The requesting user is already logged in.',
+      responseType: 'redirect'
+    }
+
+  },
+
+
+  fn: async function () {
+
+    if (this.req.me) {
+      throw {redirect: '/'};
+    }
+
+    return {};
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/view-new-password.js b/ee/bulk-operations-dashboard/api/controllers/entrance/view-new-password.js
new file mode 100644
index 000000000000..4532fa5feff0
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/view-new-password.js
@@ -0,0 +1,57 @@
+module.exports = {
+
+
+  friendlyName: 'View new password',
+
+
+  description: 'Display "New password" page.',
+
+
+  inputs: {
+
+    token: {
+      description: 'The password reset token from the email.',
+      example: '4-32fad81jdaf$329'
+    }
+
+  },
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/entrance/new-password'
+    },
+
+    invalidOrExpiredToken: {
+      responseType: 'expired',
+      description: 'The provided token is expired, invalid, or has already been used.',
+    }
+
+  },
+
+
+  fn: async function ({token}) {
+
+    // If password reset token is missing, display an error page explaining that the link is bad.
+    if (!token) {
+      sails.log.warn('Attempting to view new password (recovery) page, but no reset password token included in request!  Displaying error page...');
+      throw 'invalidOrExpiredToken';
+    }//•
+
+    // Look up the user with this reset token.
+    var userRecord = await User.findOne({ passwordResetToken: token });
+    // If no such user exists, or their token is expired, display an error page explaining that the link is bad.
+    if (!userRecord || userRecord.passwordResetTokenExpiresAt <= Date.now()) {
+      throw 'invalidOrExpiredToken';
+    }
+
+    // Grab token and include it in view locals
+    return {
+      token,
+    };
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/view-signup.js b/ee/bulk-operations-dashboard/api/controllers/entrance/view-signup.js
new file mode 100644
index 000000000000..be43753770d4
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/view-signup.js
@@ -0,0 +1,35 @@
+module.exports = {
+
+
+  friendlyName: 'View signup',
+
+
+  description: 'Display "Signup" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/entrance/signup',
+    },
+
+    redirect: {
+      description: 'The requesting user is already logged in.',
+      responseType: 'redirect'
+    }
+
+  },
+
+
+  fn: async function () {
+
+    if (this.req.me) {
+      throw {redirect: '/'};
+    }
+
+    return {};
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/get-profiles.js b/ee/bulk-operations-dashboard/api/controllers/get-profiles.js
new file mode 100644
index 000000000000..7326fea9aef3
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/get-profiles.js
@@ -0,0 +1,113 @@
+module.exports = {
+
+
+  friendlyName: 'Get profiles',
+
+
+  description: 'Builds and returns an array of deployed configuration profiles on the Fleet instance and undeployed profiles stored in the dashboard\'s datastore.',
+
+  exits: {
+    success: {
+      outputType: [{}],
+    }
+  },
+
+
+  fn: async function () {
+    // Get all teams on the Fleet instance.
+    let teamsResponseData = await sails.helpers.http.get.with({
+      url: '/api/v1/fleet/teams',
+      baseUrl: sails.config.custom.fleetBaseUrl,
+      headers: {
+        Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+      }
+    })
+    .timeout(120000)
+    .retry(['requestFailed', {name: 'TimeoutError'}]);
+
+    let allTeams = teamsResponseData.teams;
+
+    let teams = [];
+    for(let team of allTeams) {
+      teams.push({
+        fleetApid: team.id,
+        teamName: team.name,
+      });
+    }
+    // Add the "team" for hosts with no team
+    teams.push({
+      fleetApid: 0,
+      teamName: 'No team',
+    });
+
+
+    let allProfiles = [];
+    let teamApids = _.pluck(allTeams, 'id');
+    // Get all of the configuration profiles on the Fleet instance.
+    for(let teamApid of teamApids){
+      let configurationProfilesResponseData = await sails.helpers.http.get.with({
+        url: `/api/v1/fleet/configuration_profiles?team_id=${teamApid}`,
+        baseUrl: sails.config.custom.fleetBaseUrl,
+        headers: {
+          Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+        }
+      })
+      .timeout(120000)
+      .retry(['requestFailed', {name: 'TimeoutError'}]);
+      let profilesForThisTeam = configurationProfilesResponseData.profiles;
+      allProfiles = allProfiles.concat(profilesForThisTeam);
+    }
+
+    // Add the configurations profiles that are assigned to the "no team" team.
+    let noTeamConfigurationProfilesResponseData = await sails.helpers.http.get.with({
+      url: '/api/v1/fleet/configuration_profiles',
+      baseUrl: sails.config.custom.fleetBaseUrl,
+      headers: {
+        Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+      }
+    })
+    .timeout(120000)
+    .retry(['requestFailed', {name: 'TimeoutError'}]);
+    let profilesForThisTeam = noTeamConfigurationProfilesResponseData.profiles;
+    allProfiles = allProfiles.concat(profilesForThisTeam);
+
+    // console.log(allProfiles);
+
+    let profilesOnThisFleetInstance = [];
+    // Group configuration profiles by their identifier.
+    let allProfilesByIdentifier = _.groupBy(allProfiles, 'identifier');
+    for(let profileIdentifier in allProfilesByIdentifier) {
+      // Iterate through the arrays of profiles with the same unique identifier.
+      let teamsForThisProfile = [];
+      // Add the profile's UUID and information about the team this profile is assigned to the teams array for profiles.
+      for(let profile of allProfilesByIdentifier[profileIdentifier]){
+        let informationAboutThisProfile = {
+          uuid: profile.profile_uuid,
+          fleetApid: profile.team_id,
+          teamName: _.find(teams, {fleetApid: profile.team_id}).teamName,
+        };
+        teamsForThisProfile.push(informationAboutThisProfile);
+      }
+      let profile = allProfilesByIdentifier[profileIdentifier][0];// Grab the first profile returned in the api repsonse to build our profile configuration.
+      let profileInformation = {
+        name: profile.name,
+        identifier: profileIdentifier,
+        platform: profile.platform,
+        createdAt: new Date(profile.created_at).getTime(),
+        teams: teamsForThisProfile
+      };
+      profilesOnThisFleetInstance.push(profileInformation);
+    }
+    // Get the undeployed profiles from the app's database.
+    let undeployedProfiles = await UndeployedProfile.find();
+    profilesOnThisFleetInstance = _.union(profilesOnThisFleetInstance, undeployedProfiles);
+
+    // Sort profiles by their name.
+    profilesOnThisFleetInstance = _.sortByOrder(profilesOnThisFleetInstance, 'name', 'asc');
+
+    return profilesOnThisFleetInstance;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/get-scripts.js b/ee/bulk-operations-dashboard/api/controllers/get-scripts.js
new file mode 100644
index 000000000000..1900b9b700dd
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/get-scripts.js
@@ -0,0 +1,120 @@
+module.exports = {
+
+
+  friendlyName: 'Get scripts',
+
+
+  description: 'Builds and returns an array of deployed scripts on the Fleet instance and undeployed scripts stored in the dashboard\'s datastore',
+
+
+  exits: {
+    success: {
+      outputType: [{}],
+    }
+  },
+
+
+  fn: async function () {
+    // Get all teams on the Fleet instance.
+    let teamsResponseData = await sails.helpers.http.get.with({
+      url: '/api/v1/fleet/teams',
+      baseUrl: sails.config.custom.fleetBaseUrl,
+      headers: {
+        Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+      }
+    })
+    .timeout(120000)
+    .retry(['requestFailed', {name: 'TimeoutError'}]);
+
+    let allTeams = teamsResponseData.teams;
+
+    let teamApids = _.pluck(allTeams, 'id');
+    let teams = [];
+    for(let team of allTeams) {
+      teams.push({
+        fleetApid: team.id,
+        teamName: team.name,
+      });
+    }
+    // Add the "team" for hosts with no team
+    teams.push({
+      fleetApid: 0,
+      teamName: 'No team',
+    });
+
+
+    let allScripts = [];
+    // Get all of the scripts on a Fleet instance.
+    for(let teamApid of teamApids){
+      let scriptsResponseData = await sails.helpers.http.get.with({
+        url: `/api/v1/fleet/scripts?team_id=${teamApid}`,
+        baseUrl: sails.config.custom.fleetBaseUrl,
+        headers: {
+          Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+        }
+      })
+      .timeout(120000)
+      .retry(['requestFailed', {name: 'TimeoutError'}]);
+      let scriptsForThisTeam = scriptsResponseData.scripts;
+      if(scriptsForThisTeam !== null) {
+        allScripts = allScripts.concat(scriptsForThisTeam);
+      }
+    }
+
+    // Grab all of the configuration scripts on the Fleet instance.
+    let noTeamConfigurationScriptsResponseData = await sails.helpers.http.get.with({
+      url: '/api/v1/fleet/scripts',
+      baseUrl: sails.config.custom.fleetBaseUrl,
+      headers: {
+        Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+      }
+    })
+    .timeout(120000)
+    .retry(['requestFailed', {name: 'TimeoutError'}]);
+    let scriptsForThisTeam = noTeamConfigurationScriptsResponseData.scripts;
+
+    if(scriptsForThisTeam !== null){
+      allScripts = allScripts.concat(scriptsForThisTeam);
+    }
+
+    // If there are no scripts on the Fleet instance, return an empty array and the teams information.
+    if(allScripts === [ null ]){
+      return {scripts: [], teams};
+    }
+    let scriptsOnThisFleetInstance = [];
+
+    let allScriptsByIdentifier = _.groupBy(allScripts, 'name');
+    for(let scriptIdentifier in allScriptsByIdentifier) {
+      if(scriptIdentifier === null){
+        continue;
+      }
+      let teamsForThisProfile = [];
+      for(let script of allScriptsByIdentifier[scriptIdentifier]){
+        let informationAboutThisScript = {
+          scriptFleetApid: script.id,
+          fleetApid: script.team_id ? script.team_id : 0,
+          teamName: script.team_id ? _.find(teams, {fleetApid: script.team_id}).teamName : 'No team',
+        };
+        teamsForThisProfile.push(informationAboutThisScript);
+      }
+      let script = allScriptsByIdentifier[scriptIdentifier][0];// Grab the first script returned in the api repsonse to build our script configuration.
+      let scriptInformation = {
+        name: script.name,
+        identifier: scriptIdentifier,
+        platform: _.endsWith(script.name, 'sh') ? 'macOS & Linux' : 'Windows',
+        createdAt: new Date(script.created_at).getTime(),
+        teams: teamsForThisProfile
+      };
+      scriptsOnThisFleetInstance.push(scriptInformation);
+    }
+    // Get the undeployed scripts from the app's database.
+    let undeployedScripts = await UndeployedScript.find();
+    scriptsOnThisFleetInstance = _.union(scriptsOnThisFleetInstance, undeployedScripts);
+    // Sort scripts by their name.
+    scriptsOnThisFleetInstance = _.sortByOrder(scriptsOnThisFleetInstance, 'name', 'asc');
+    return scriptsOnThisFleetInstance;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/legal/view-privacy.js b/ee/bulk-operations-dashboard/api/controllers/legal/view-privacy.js
new file mode 100644
index 000000000000..6960be873f16
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/legal/view-privacy.js
@@ -0,0 +1,27 @@
+module.exports = {
+
+
+  friendlyName: 'View privacy',
+
+
+  description: 'Display "Privacy policy" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/legal/privacy'
+    }
+
+  },
+
+
+  fn: async function () {
+
+    // All done.
+    return;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/legal/view-terms.js b/ee/bulk-operations-dashboard/api/controllers/legal/view-terms.js
new file mode 100644
index 000000000000..643f04408afd
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/legal/view-terms.js
@@ -0,0 +1,27 @@
+module.exports = {
+
+
+  friendlyName: 'View terms',
+
+
+  description: 'Display "Legal terms" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/legal/terms'
+    }
+
+  },
+
+
+  fn: async function () {
+
+    // All done.
+    return;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/profiles/delete-profile.js b/ee/bulk-operations-dashboard/api/controllers/profiles/delete-profile.js
new file mode 100644
index 000000000000..3a974058695a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/profiles/delete-profile.js
@@ -0,0 +1,46 @@
+module.exports = {
+
+
+  friendlyName: 'Delete profile',
+
+
+  description: '',
+
+
+  inputs: {
+    profile: {
+      type: {},
+      description: 'The configuration profile that will be deleted.',
+      required: true,
+    }
+  },
+
+
+  exits: {
+
+  },
+
+
+  fn: async function ({profile}) {
+    // If the provided profile does not have a teams array and has an ID, it is an undeployed profile that will be deleted.
+    if(profile.id && !profile.teams){
+      await UndeployedProfile.destroy({id: profile.id});
+    } else {// Otherwise, this is a deployed profile, and we'll use information from the teams array to remove the profile.
+      for(let team of profile.teams){
+        await sails.helpers.http.sendHttpRequest.with({
+          method: 'DELETE',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: `/api/v1/fleet/configuration_profiles/${team.uuid}`,
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          }
+        });
+      }
+    }
+    // All done.
+    return;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/profiles/download-profile.js b/ee/bulk-operations-dashboard/api/controllers/profiles/download-profile.js
new file mode 100644
index 000000000000..ebbf569d52e7
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/profiles/download-profile.js
@@ -0,0 +1,78 @@
+module.exports = {
+
+
+  friendlyName: 'Download profile',
+
+
+  description: 'Download profile file (returning a stream).',
+
+
+  inputs: {
+    id: {
+      type: 'number',
+      description: 'The database ID of the undeployed profile to download.'
+    },
+    uuid: {
+      type: 'string',
+      description: 'The uuid of a profile on a team.'
+    },
+  },
+
+
+  exits: {
+    success: {
+      outputFriendlyName: 'File',
+      outputDescription: 'The streaming bytes of the file.',
+      outputType: 'ref'
+    },
+
+    notFound: {
+      description: 'No profile exists with the specified ID or UUID.',
+      responseType: 'notFound'
+    },
+  },
+
+
+  fn: async function ({id, uuid}) {
+    if(!uuid && !id){
+      return this.res.badRequest();
+    }
+    let datePrefix = new Date().toISOString();
+    datePrefix = datePrefix.split('T')[0] +'_';
+    let profileContents;
+    let filename;
+    let download;
+    if(id){
+      let profileToDownload = await UndeployedProfile.findOne({id: id});
+
+      filename = datePrefix + profileToDownload.name + profileToDownload.profileType;
+      profileContents = profileToDownload.profileContents;
+      if(profileToDownload.profileType === '.mobileconfig'){
+        this.res.type('application/x-apple-aspen-config');
+      } else {
+        this.res.type('application/octet-stream');
+      }
+      download = profileContents;
+    } else {
+      let profileDownloadResponse = await sails.helpers.http.sendHttpRequest.with({
+        method: 'GET',
+        url: `${sails.config.custom.fleetBaseUrl}/api/v1/fleet/configuration_profiles/${uuid}?alt=media`,
+        headers: {
+          Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+        }
+      });
+      let contentDispositionHeader = profileDownloadResponse.headers['content-disposition'];
+      let filenameMatch = contentDispositionHeader.replace(/^attachment;filename="(.+?)"$/, '$1');
+      filename = filenameMatch;
+      let contentType = profileDownloadResponse.headers['content-type'];
+      download = profileDownloadResponse.body;
+      this.res.type(contentType);
+    }
+    this.res.attachment(filename);
+    // All done.
+    return download;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/profiles/edit-profile.js b/ee/bulk-operations-dashboard/api/controllers/profiles/edit-profile.js
new file mode 100644
index 000000000000..bede01b44f79
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/profiles/edit-profile.js
@@ -0,0 +1,204 @@
+module.exports = {
+
+
+  friendlyName: 'Edit profile',
+
+
+  description: 'Edits the teams a profile is assigned to and/or replaces the file on the Fleet instance if the new file\'s profile identifier matches',
+
+  files: ['newProfile'],
+
+  inputs: {
+    profile: {
+      type: {},
+      description: 'The configuration profile that is being editted',
+      required: true,
+    },
+    newTeamIds: {
+      type: ['string'],
+      description: 'An array of teams that this profile will be deployed on or Undefined if the profile is being removed from a team.'
+    },
+    newProfile: {
+      type: 'ref',
+      description: 'A file that will be replacing the profile.'
+    },
+  },
+
+
+  exits: {
+    payloadIdentifierDoesNotMatch: {
+      statusCode: 409,
+      description: 'The new profiles bundle indentifer does not match the existing profile',
+    }
+  },
+
+
+
+  fn: async function ({profile, newTeamIds, newProfile}) {
+    if(newProfile.isNoop){
+      newProfile.noMoreFiles();
+      newProfile = undefined;
+    }
+    //  ╔═╗╔═╗╔╦╗  ╔═╗╦═╗╔═╗╔═╗╦╦  ╔═╗
+    //  ║ ╦║╣  ║   ╠═╝╠╦╝║ ║╠╣ ║║  ║╣
+    //  ╚═╝╚═╝ ╩   ╩  ╩╚═╚═╝╚  ╩╩═╝╚═╝
+    let profileContents; // The raw text contents of a profile file.
+    let filename;
+    let extension;
+    // If there is not a new profile, and the profile is deployed (has teams array === deployed), download the profile to be able to add it to other teams.
+    if(!newProfile && profile.teams){
+      // console.log('Existing deployed profile!');
+      let profileUuid = profile.teams[0].uuid;
+      let profileDownloadResponse = await sails.helpers.http.sendHttpRequest.with({
+        method: 'GET',
+        url: `${sails.config.custom.fleetBaseUrl}/api/v1/fleet/configuration_profiles/${profileUuid}?alt=media`,
+        headers: {
+          Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+        }
+      });
+      let contentDispositionHeader = profileDownloadResponse.headers['content-disposition'];
+      let filenameMatch = contentDispositionHeader.match(/filename="(.+?)"/);
+      filename = filenameMatch[1];
+      extension = '.'+filename.split('.').pop();
+      profileContents = profileDownloadResponse.body;
+    } else if(newProfile) {// Otherwise, if there is a new profile file uploaded, check that the payload identifier maches the existing profile on the Fleet instance.
+      // console.log('Replacing an existing(/undeployed) profile!');
+      let file = await sails.reservoir(newProfile);
+      profileContents = file[0].contentBytes;
+      let profileFileName = file[0].name;
+      filename = profileFileName.replace(/^\d{4}-\d{2}-\d{2}_/, '').replace(/\.[^/.]+$/, '');
+      extension = '.'+profileFileName.split('.').pop();
+      let profilePlatform = 'darwin';
+      if(_.endsWith(profileFileName, '.xml')) {
+        profilePlatform = 'windows';
+      }
+      if(newTeamIds && profile.teams && profilePlatform === 'darwin'){
+        let existingProfileInfo = await sails.helpers.http.get.with({
+          url: `${sails.config.custom.fleetBaseUrl}/api/v1/fleet/configuration_profiles/${profile.teams[0].uuid}?alt=media`,
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+          }
+        });
+        let newProfileBundleIdentifier = profileContents.match(/<key>PayloadIdentifier<\/key>\s*<string>(.*?)<\/string>/)[1];
+        let existingProfileBundleIdentifier = existingProfileInfo.match(/<key>PayloadIdentifier<\/key>\s*<string>(.*?)<\/string>/)[1];
+        // Note: We're using the _.startsWith method to check that the identifier is the same. The identifiers returned by the Fleet instance are
+        if(existingProfileBundleIdentifier !== newProfileBundleIdentifier){
+          throw 'payloadIdentifierDoesNotMatch';
+        }
+      }
+    } else if (!newProfile && !profile.teams){// Undeployed profiles are stored in the app's database.
+      // console.log('editing an undeployed profile!');
+      profileContents = profile.profileContents;
+      filename = profile.name;
+      extension = profile.profileType;
+    }
+    //  ╔═╗╔═╗╔═╗╦╔═╗╔╗╔  ╔═╗╦═╗╔═╗╔═╗╦╦  ╔═╗
+    //  ╠═╣╚═╗╚═╗║║ ╦║║║  ╠═╝╠╦╝║ ║╠╣ ║║  ║╣
+    //  ╩ ╩╚═╝╚═╝╩╚═╝╝╚╝  ╩  ╩╚═╚═╝╚  ╩╩═╝╚═╝
+    if(!newProfile){
+      // If we're changing the teams for an existing profile, we'll remove this profile from any team not included in the newTeamIds array.
+      let currentProfileTeamIds = _.pluck(profile.teams, 'fleetApid');
+      let addedTeams = _.difference(newTeamIds, currentProfileTeamIds);
+      let removedTeams = _.difference(currentProfileTeamIds, newTeamIds);
+      let removedTeamsInfo = _.filter(profile.teams, (team)=>{
+        return removedTeams.includes(team.fleetApid);
+      });
+      for(let team of removedTeamsInfo){
+        // console.log(`removing ${profile.name} from team id ${team.teamName}`);
+        await sails.helpers.http.sendHttpRequest.with({
+          method: 'DELETE',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: `/api/v1/fleet/configuration_profiles/${team.uuid}`,
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          }
+        });
+      }
+      for(let teamApid of addedTeams){
+        // console.log(`Adding ${profile.name} to team id ${teamApid}`);
+        await sails.helpers.http.sendHttpRequest.with({
+          method: 'POST',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: `/api/v1/fleet/configuration_profiles?team_id=${teamApid}`,
+          enctype: 'multipart/form-data',
+          body: {
+            team_id: teamApid,// eslint-disable-line camelcase
+            profile: {
+              options: {
+                filename: filename + extension,
+                contentType: 'application/octet-stream'
+              },
+              value: profileContents,
+            }
+          },
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          },
+        });
+      }// After every added team
+    } else {
+      if(profile.teams) {
+        // If there is a new profile uploaded, we will need to delete the old profiles, and add the new profile.
+        for(let team of profile.teams) {
+          // console.log(`removing ${profile.name} from team id ${team.teamName}`);
+          await sails.helpers.http.sendHttpRequest.with({
+            method: 'DELETE',
+            baseUrl: sails.config.custom.fleetBaseUrl,
+            url: `/api/v1/fleet/configuration_profiles/${team.uuid}`,
+            headers: {
+              Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+            }
+          });
+        }
+      }
+      for(let teamApid of newTeamIds){
+        // console.log(`Adding ${profile.name} to team id ${teamApid}`);
+        await sails.helpers.http.sendHttpRequest.with({
+          method: 'POST',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: `/api/v1/fleet/configuration_profiles?team_id=${teamApid}`,
+          enctype: 'multipart/form-data',
+          body: {
+            team_id: teamApid,// eslint-disable-line camelcase
+            profile: {
+              options: {
+                filename: filename + extension,
+                contentType: 'application/octet-stream'
+              },
+              value: profileContents,
+            }
+          },
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          },
+        });
+      }// After every added team
+
+    }
+    // If this profile has an ID, then it is a database record, and we will delete it if it has been deployed to a team.
+    if(profile.id && newTeamIds.length > 0){
+      // console.log('Undeployed profile has been deployed. deleting DB record!');
+      await UndeployedProfile.destroy({id: profile.id});
+    } else if(!profile.id && newTeamIds.length === 0){
+      // If this is not a database record of a profile, and the profile is being undeployed from all teams, we'll create a databse record for it.
+      // console.log('Creating database record for a (now) undeployed profile!');
+      await UndeployedProfile.create({
+        name: profile.name,
+        platform: extension === '.xml' ? 'windows' : 'darwin',
+        profileContents,
+        profileType: extension,
+      });
+    } else if(profile.id && newProfile){
+      // If there is a new profile that is replacing a database record, update the profileContents in the database.
+      // console.log('Updating existing undeployed profile!');
+      await UndeployedProfile.updateOne({id: profile.id}).set({
+        profileContents,
+      });
+    }
+    // All done.
+    return;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/profiles/upload-profile.js b/ee/bulk-operations-dashboard/api/controllers/profiles/upload-profile.js
new file mode 100644
index 000000000000..19c847bf62d5
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/profiles/upload-profile.js
@@ -0,0 +1,120 @@
+module.exports = {
+
+
+  friendlyName: 'Upload profile',
+
+
+  description: '',
+
+  files: ['newProfile'],
+
+  inputs: {
+    newProfile: {
+      type: 'ref',
+      description: 'An Upstream with an incoming file upload.',
+      required: true,
+    },
+    teams: {
+      type: ['string'],
+      description: 'An array of team IDs that this profile will be added to'
+    }
+  },
+
+
+  exits: {
+    success: {
+      outputDescription: 'The new profile has been uploaded',
+      outputType: {},
+    },
+
+    noFileAttached: {
+      description: 'No file was attached.',
+      responseType: 'badRequest'
+    },
+
+    tooBig: {
+      description: 'The file is too big.',
+      responseType: 'badRequest'
+    },
+
+  },
+
+
+  fn: async function ({newProfile, teams}) {
+    let util = require('util');
+    let profile = await sails.reservoir(newProfile)
+    .intercept('E_EXCEEDS_UPLOAD_LIMIT', 'tooBig')
+    .intercept((err)=>new Error('The configuration profile upload failed. '+util.inspect(err)));
+    if(!profile) {
+      throw 'noFileAttached';
+    }
+    let profileContents = profile[0].contentBytes;
+    let profileFileName = profile[0].name;
+    let datelessExtensionlessFilename = profileFileName.replace(/^\d{4}-\d{2}-\d{2}_/, '').replace(/\.[^/.]+$/, '');
+    let extension = '.'+profileFileName.split('.').pop();
+    let profilePlatform = 'darwin';
+    if(_.endsWith(profileFileName, '.xml')) {
+      profilePlatform = 'windows';
+    }
+
+    let profileToReturn;
+    let newProfileInfo = {
+      name: datelessExtensionlessFilename,
+      platform: profilePlatform,
+      profileType: extension,
+      createdAt: Date.now(),
+    };
+    if(!teams) {
+      newProfileInfo.profileContents = profileContents;
+      profileToReturn = await UndeployedProfile.create(newProfileInfo).fetch();
+    } else {
+      let newTeams = [];
+      for(let teamApid of teams){
+        let newProfileResponse = await sails.helpers.http.sendHttpRequest.with({
+          method: 'POST',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: `/api/v1/fleet/configuration_profiles?team_id=${teamApid}`,
+          enctype: 'multipart/form-data',
+          body: {
+            team_id: teamApid,// eslint-disable-line camelcase
+            profile: {
+              options: {
+                filename: profileFileName,
+                contentType: 'application/octet-stream'
+              },
+              value: profileContents,
+            }
+          },
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          },
+        });
+        let parsedJsonResponse = JSON.parse(newProfileResponse.body);
+        let uuidForThisProfile = parsedJsonResponse.profile_uuid;
+        // send a request to the Fleet instance to get the bundleId of the new profile.
+        await sails.helpers.http.get.with({
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: `/api/v1/fleet/configuration_profiles/${uuidForThisProfile}`,
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          }
+        });
+        newTeams.push({
+          fleetApid: teamApid,
+          uuid: JSON.parse(newProfileResponse.body).profile_uuid
+        });
+      }
+      newProfileInfo.teams = newTeams;
+      profileToReturn = newProfileInfo;
+    }
+
+
+
+
+    // All done.
+    return profileToReturn;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/profiles/view-profiles.js b/ee/bulk-operations-dashboard/api/controllers/profiles/view-profiles.js
new file mode 100644
index 000000000000..9ebe8079322f
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/profiles/view-profiles.js
@@ -0,0 +1,114 @@
+module.exports = {
+
+
+  friendlyName: 'View profiles',
+
+
+  description: 'Display "Profiles" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/profiles'
+    }
+
+  },
+
+
+  fn: async function () {
+
+    // Get all teams on the Fleet instance.
+    let teamsResponseData = await sails.helpers.http.get.with({
+      url: '/api/v1/fleet/teams',
+      baseUrl: sails.config.custom.fleetBaseUrl,
+      headers: {
+        Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+      }
+    })
+    .timeout(120000)
+    .retry(['requestFailed', {name: 'TimeoutError'}]);
+
+    let allTeams = teamsResponseData.teams;
+
+    let teams = [];
+    for(let team of allTeams) {
+      teams.push({
+        fleetApid: team.id,
+        teamName: team.name,
+      });
+    }
+    // Add the "team" for hosts with no team
+    teams.push({
+      fleetApid: 0,
+      teamName: 'No team',
+    });
+
+
+    let allProfiles = [];
+    let teamApids = _.pluck(allTeams, 'id');
+    // Get all of the configuration profiles on the Fleet instance.
+    for(let teamApid of teamApids){
+      let configurationProfilesResponseData = await sails.helpers.http.get.with({
+        url: `/api/v1/fleet/configuration_profiles?team_id=${teamApid}`,
+        baseUrl: sails.config.custom.fleetBaseUrl,
+        headers: {
+          Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+        }
+      })
+      .timeout(120000)
+      .retry(['requestFailed', {name: 'TimeoutError'}]);
+      let profilesForThisTeam = configurationProfilesResponseData.profiles;
+      allProfiles = allProfiles.concat(profilesForThisTeam);
+    }
+    // Add the configurations profiles that are assigned to the "no team" team.
+    let noTeamConfigurationProfilesResponseData = await sails.helpers.http.get.with({
+      url: '/api/v1/fleet/configuration_profiles',
+      baseUrl: sails.config.custom.fleetBaseUrl,
+      headers: {
+        Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+      }
+    })
+    .timeout(120000)
+    .retry(['requestFailed', {name: 'TimeoutError'}]);
+    let profilesForThisTeam = noTeamConfigurationProfilesResponseData.profiles;
+    allProfiles = allProfiles.concat(profilesForThisTeam);
+    let profilesInformation = [];
+    // Group configuration profiles by their identifier.
+    let allProfilesByIdentifier = _.groupBy(allProfiles, 'identifier');
+    for(let profileIdentifier in allProfilesByIdentifier) {
+      // Iterate through the arrays of profiles with the same unique identifier.
+      let teamsForThisProfile = [];
+      // Add the profile's UUID and information about the team this profile is assigned to the teams array for profiles.
+      for(let profile of allProfilesByIdentifier[profileIdentifier]) {
+        let informationAboutThisProfile = {
+          uuid: profile.profile_uuid,
+          fleetApid: profile.team_id,
+          teamName: _.find(teams, {fleetApid: profile.team_id}).teamName,
+        };
+        teamsForThisProfile.push(informationAboutThisProfile);
+      }
+      let profile = allProfilesByIdentifier[profileIdentifier][0];// Grab the first profile returned in the api repsonse to build our profile configuration.
+      let profileInformation = {
+        name: profile.name,
+        identifier: profileIdentifier,
+        platform: profile.platform,
+        createdAt: new Date(profile.created_at).getTime(),
+        teams: teamsForThisProfile
+      };
+      profilesInformation.push(profileInformation);
+    }
+    // Get the undeployed profiles from the app's database.
+    let undeployedProfiles = await UndeployedProfile.find();
+    profilesInformation = _.union(profilesInformation, undeployedProfiles);
+
+    // Sort profiles by their name.
+    profilesInformation = _.sortByOrder(profilesInformation, 'name', 'asc');
+
+    // Respond with view.
+    return {profiles: profilesInformation, teams};
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/scripts/delete-script.js b/ee/bulk-operations-dashboard/api/controllers/scripts/delete-script.js
new file mode 100644
index 000000000000..f7c38c1664c1
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/scripts/delete-script.js
@@ -0,0 +1,46 @@
+module.exports = {
+
+
+  friendlyName: 'Delete script',
+
+
+  description: '',
+
+
+  inputs: {
+    script: {
+      type: {},
+      description: 'The script that will be deleted.',
+      required: true,
+    }
+  },
+
+
+  exits: {
+
+  },
+
+
+  fn: async function ({script}) {
+    // If the provided script does not have a teams array and has an ID, it is an undeployed script that will be deleted.
+    if(script.id && !script.teams){
+      await UndeployedScript.destroy({id: script.id});
+    } else {
+      for(let teamScript of script.teams){
+        await sails.helpers.http.sendHttpRequest.with({
+          method: 'DELETE',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: `/api/v1/fleet/scripts/${teamScript.scriptFleetApid}`,
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          }
+        });
+      }
+    }
+    // All done.
+    return;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/scripts/download-script.js b/ee/bulk-operations-dashboard/api/controllers/scripts/download-script.js
new file mode 100644
index 000000000000..4c9b7bc809b8
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/scripts/download-script.js
@@ -0,0 +1,76 @@
+module.exports = {
+
+
+  friendlyName: 'Download script',
+
+
+  description: 'Download script file (returning a stream).',
+
+
+  inputs: {
+    fleetApid: {
+      type: 'number',
+      description: 'The Fleet API ID of the script to download.',
+    },
+    id: {
+      type: 'number',
+      description: 'The database ID of the undeployed script to download'
+    }
+  },
+
+
+  exits: {
+    success: {
+      outputFriendlyName: 'File',
+      outputDescription: 'The streaming bytes of the file.',
+      outputType: 'ref'
+    },
+
+    notFound: {
+      description: 'No script exists with the specified ID or UUID.',
+      responseType: 'notFound'
+    },
+  },
+
+
+  fn: async function ({fleetApid, id}) {
+    if(!fleetApid && !id){
+      return this.res.badRequest();
+    }
+    let filename;
+    let download;
+    if(id){
+      let datePrefix = new Date().toISOString();
+      datePrefix = datePrefix.split('T')[0] +'_';
+      let scriptToDownload = await UndeployedScript.findOne({id: id});
+      filename = datePrefix + scriptToDownload.name;
+      let scriptContents = scriptToDownload.scriptContents;
+      if(scriptToDownload.scriptType === '.sh'){
+        this.res.type('application/x-apple-aspen-config');
+      } else {
+        this.res.type('application/octet-stream');
+      }
+      download = scriptContents;
+    } else {
+      let scriptDownloadResponse = await sails.helpers.http.sendHttpRequest.with({
+        method: 'GET',
+        url: `${sails.config.custom.fleetBaseUrl}/api/v1/fleet/scripts/${fleetApid}?alt=media`,
+        headers: {
+          Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+        }
+      });
+      let contentDispositionHeader = scriptDownloadResponse.headers['content-disposition'];
+      let filenameMatch = contentDispositionHeader.replace(/^attachment;filename="(.+?)"$/, '$1');
+      filename = filenameMatch;
+      let contentType = scriptDownloadResponse.headers['content-type'];
+      download = scriptDownloadResponse.body;
+      this.res.type(contentType);
+    }
+    this.res.attachment(filename);
+    // All done.
+    return download;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/scripts/edit-script.js b/ee/bulk-operations-dashboard/api/controllers/scripts/edit-script.js
new file mode 100644
index 000000000000..ec8d30f182e9
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/scripts/edit-script.js
@@ -0,0 +1,197 @@
+module.exports = {
+
+
+  friendlyName: 'Edit script',
+
+
+  description: '',
+
+  files: ['newScript'],
+
+  inputs: {
+    script: {
+      type: {},
+      description: 'The script that is being editted',
+      required: true,
+    },
+    newTeamIds: {
+      type: ['ref'],
+      description: 'An array of teams that this script will be added to.'
+    },
+    newScript: {
+      type: 'ref',
+      description: 'A file that will be replacing the script.'
+    },
+  },
+
+
+  exits: {
+    scriptNameDoesNotMatch: {
+      description: 'The provided replacement script\'s filename does not match the name of the script on the Fleet instance.',
+      statusCode: 400,
+    },
+  },
+
+
+  fn: async function ({script, newTeamIds, newScript}) {
+    if(newScript.isNoop){
+      newScript.noMoreFiles();
+      newScript = undefined;
+    }
+    let scriptContents; // The raw text contents of a script file.
+    let filename;
+    let extension;
+    // If there is not a new script, and the script is deployed (has teams array === deployed), download the script to be able to add it to other teams.
+    if(!newScript && script.teams){
+      let scriptFleetApid = script.teams[0].scriptFleetApid;
+      let scriptDownloadResponse = await sails.helpers.http.sendHttpRequest.with({
+        method: 'GET',
+        url: `${sails.config.custom.fleetBaseUrl}/api/v1/fleet/scripts/${scriptFleetApid}?alt=media`,
+        headers: {
+          Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+        }
+      });
+      let contentDispositionHeader = scriptDownloadResponse.headers['content-disposition'];
+      let filenameMatch = contentDispositionHeader.match(/filename="(.+?)"/);
+      filename = filenameMatch[1];
+      extension = '.'+filename.split('.').pop();
+      filename = filename.replace(/^\d{4}-\d{2}-\d{2}[_|\s]?/, '');
+      scriptContents = scriptDownloadResponse.body;
+    } else if(newScript) {
+      let file = await sails.reservoir(newScript);
+      scriptContents = file[0].contentBytes;
+      let scriptFilename = file[0].name;
+      filename = scriptFilename.replace(/^\d{4}-\d{2}-\d{2}[_|\s]?/, '').replace(/\.[^/.]+$/, '');
+      extension = '.'+scriptFilename.split('.').pop();
+      if(script.name !== filename+extension){
+        throw 'scriptNameDoesNotMatch';
+      }
+    } else if (!newScript && !script.teams){// Undeployed profiles are stored in the app's database.
+      // console.log('editing an undeployed profile!');
+      scriptContents = script.scriptContents;
+      filename = script.name;
+      extension = script.scriptType;
+    }
+
+    if(!newScript){
+      let currentScriptTeamIds = _.pluck(script.teams, 'fleetApid');
+      let addedTeams = _.difference(newTeamIds, currentScriptTeamIds);
+      let removedTeams = _.difference(currentScriptTeamIds, newTeamIds);
+      let removedTeamsInfo = _.filter(script.teams, (team)=>{
+        return removedTeams.includes(team.fleetApid);
+      });
+      for(let script of removedTeamsInfo){
+        await sails.helpers.http.sendHttpRequest.with({
+          method: 'DELETE',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: `/api/v1/fleet/scripts/${script.scriptFleetApid}`,
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          }
+        });
+      }
+      for(let teamApid of addedTeams){
+        // Build a request body for the team.
+        let requestBodyForThisTeam = {
+          script: {
+            options: {
+              filename: filename,
+              contentType: 'application/octet-stream'
+            },
+            value: scriptContents,
+          }
+        };
+        let addScriptUrl;
+        // If the script is being added to the "no team" team, then we need to include the team ID of the no team team in the request URL
+        if(Number(teamApid) === 0){
+          addScriptUrl = `/api/v1/fleet/scripts?team_id=${teamApid}`;
+        } else {
+          // Otherwise, the team_id needs to be included in the request's formData.
+          addScriptUrl = `/api/v1/fleet/scripts`;
+          requestBodyForThisTeam.team_id = Number(teamApid);// eslint-disable-line camelcase
+        }
+        await sails.helpers.http.sendHttpRequest.with({
+          method: 'POST',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: addScriptUrl,
+          enctype: 'multipart/form-data',
+          body: requestBodyForThisTeam,
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          },
+        });
+      }
+    } else {
+      if(script.teams) {
+        for(let scriptId of script.teams){
+          await sails.helpers.http.sendHttpRequest.with({
+            method: 'DELETE',
+            baseUrl: sails.config.custom.fleetBaseUrl,
+            url: `/api/v1/fleet/scripts/${scriptId.scriptFleetApid}`,
+            headers: {
+              Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+            }
+          });
+        }
+      }
+      for(let teamApid of newTeamIds){
+        // Build a request body for the team.
+        let requestBodyForThisTeam = {
+          script: {
+            options: {
+              filename: filename,
+              contentType: 'application/octet-stream'
+            },
+            value: scriptContents,
+          }
+        };
+        let addScriptUrl;
+        // If the script is being added to the "no team" team, then we need to include the team ID of the no team team in the request URL
+        if(Number(teamApid) === 0){
+          addScriptUrl = `/api/v1/fleet/scripts?team_id=${teamApid}`;
+        } else {
+          // Otherwise, the team_id needs to be included in the request's formData.
+          addScriptUrl = `/api/v1/fleet/scripts`;
+          requestBodyForThisTeam.team_id = Number(teamApid);// eslint-disable-line camelcase
+        }
+        await sails.helpers.http.sendHttpRequest.with({
+          method: 'POST',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: addScriptUrl,
+          enctype: 'multipart/form-data',
+          body: requestBodyForThisTeam,
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          },
+        });
+      }
+    }
+
+    // If this profile has an ID, then it is a database record, and we will delete it if it has been deployed to a team.
+    if(script.id && newTeamIds.length > 0){
+      // console.log('Undeployed script has been deployed. deleting DB record!');
+      await UndeployedScript.destroy({id: script.id});
+    } else if(!script.id && newTeamIds.length === 0){
+      // If this is not a database record of a script, and the script is being undeployed from all teams, we'll create a databse record for it.
+      // console.log('Creating database record for a (now) undeployed script!');
+      await UndeployedScript.create({
+        name: script.name,
+        platform: extension === '.ps1' ? 'Windows' : 'macOS & Linux',
+        scriptContents,
+        scriptType: extension,
+      });
+    } else if(script.id && newScript){
+      // If there is a new script that is replacing a database record, update the scriptContents in the database.
+      // console.log('Updating existing undeployed script!');
+      await UndeployedScript.updateOne({id: script.id}).set({
+        scriptContents,
+      });
+    }
+
+    // All done.
+    return;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/scripts/upload-script.js b/ee/bulk-operations-dashboard/api/controllers/scripts/upload-script.js
new file mode 100644
index 000000000000..55265f2fa23a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/scripts/upload-script.js
@@ -0,0 +1,118 @@
+module.exports = {
+
+
+  friendlyName: 'Upload script',
+
+
+  description: 'Uploads a script to the connected Fleet instance',
+
+  files: ['newScript'],
+
+  inputs: {
+
+    newScript: {
+      type: 'ref',
+      description: 'An Upstream with an incoming file upload.',
+      required: true,
+    },
+
+    teams: {
+      type: ['string'],
+      description: 'An array of team IDs that this profile will be added to'
+    }
+  },
+
+
+  exits: {
+    success: {
+      outputDescription: 'The new script has been uploaded',
+      outputType: {},
+    },
+
+    scriptWithThisNameAlreadyExists: {
+      description: 'A script with this name already exists on the Fleet Instance',
+      statusCode: 409,
+    },
+
+    noFileAttached: {
+      description: 'No file was attached.',
+      responseType: 'badRequest'
+    },
+
+    tooBig: {
+      description: 'The file is too big.',
+      responseType: 'badRequest'
+    },
+  },
+
+
+  fn: async function ({newScript, teams}) {
+
+    let util = require('util');
+    let script = await sails.reservoir(newScript)
+    .intercept('E_EXCEEDS_UPLOAD_LIMIT', 'tooBig')
+    .intercept((err)=>new Error('The script upload failed. '+util.inspect(err)));
+    if(!script) {
+      throw 'noFileAttached';
+    }
+    // Get the file contents and filename.
+    let scriptContents = script[0].contentBytes;
+    let scriptFilename = script[0].name;
+    // Strip out any automatically added date prefixes from uploaded scripts.
+    let datelessExtensionlessFilename = scriptFilename.replace(/^\d{4}-\d{2}-\d{2}\s/, '').replace(/\.[^/.]+$/, '');
+    let extension = '.'+scriptFilename.split('.').pop();
+    // Build a dictonary of information about this script to return to the scripts page.
+    let newScriptInfo = {
+      name: datelessExtensionlessFilename,
+      platform: _.endsWith(scriptFilename, '.ps1') ? 'Windows' : 'macOS & Linux',
+      scriptType: extension,
+      createdAt: Date.now()
+    };
+    if(!teams) {
+      newScriptInfo.scriptContents = scriptContents;
+      await UndeployedScript.create(newScriptInfo).fetch();
+    } else {
+      // Send a request to add the script for every team ID in the array of teams.
+      for(let teamApid of teams){
+        // Build a request body for the team.
+        let requestBodyForThisTeam = {
+          script: {
+            options: {
+              filename: datelessExtensionlessFilename + extension,
+              contentType: 'application/octet-stream'
+            },
+            value: scriptContents,
+          }
+        };
+        let addScriptUrl;
+        // If the script is being added to the "no team" team, then we need to include the team ID of the no team team in the request URL
+        if(Number(teamApid) === 0){
+          addScriptUrl = `/api/v1/fleet/scripts?team_id=${teamApid}`;
+        } else {
+          // Otherwise, the team_id needs to be included in the request's formData.
+          addScriptUrl = `/api/v1/fleet/scripts`;
+          requestBodyForThisTeam.team_id = Number(teamApid);// eslint-disable-line camelcase
+        }
+        // Send a PSOT request to add the script.
+        await sails.helpers.http.sendHttpRequest.with({
+          method: 'POST',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url:addScriptUrl,
+          enctype: 'multipart/form-data',
+          body: requestBodyForThisTeam,
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          },
+        })
+        .intercept({raw: {statusCode: 409}}, ()=>{
+          return 'scriptWithThisNameAlreadyExists';
+        });
+      }
+    }
+    // All done.
+    return newScriptInfo;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/scripts/view-scripts.js b/ee/bulk-operations-dashboard/api/controllers/scripts/view-scripts.js
new file mode 100644
index 000000000000..02fabebdd243
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/scripts/view-scripts.js
@@ -0,0 +1,124 @@
+module.exports = {
+
+
+  friendlyName: 'View scripts',
+
+
+  description: 'Display "Scripts" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/scripts'
+    }
+
+  },
+
+
+  fn: async function () {
+    let teamsResponseData = await sails.helpers.http.get.with({
+      url: '/api/v1/fleet/teams',
+      baseUrl: sails.config.custom.fleetBaseUrl,
+      headers: {
+        Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+      }
+    })
+    .timeout(120000)
+    .retry(['requestFailed', {name: 'TimeoutError'}]);
+
+    let allTeams = teamsResponseData.teams;
+
+    let teamApids = _.pluck(allTeams, 'id');
+    let teams = [];
+    for(let team of allTeams) {
+      teams.push({
+        fleetApid: team.id,
+        teamName: team.name,
+      });
+    }
+    // Add the "team" for hosts with no team
+    teams.push({
+      fleetApid: 0,
+      teamName: 'No team',
+    });
+
+    let allScripts = [];
+
+    for(let teamApid of teamApids){
+      let scriptsResponseData = await sails.helpers.http.get.with({
+        url: `/api/v1/fleet/scripts?team_id=${teamApid}`,
+        baseUrl: sails.config.custom.fleetBaseUrl,
+        headers: {
+          Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+        }
+      })
+      .timeout(120000)
+      .retry(['requestFailed', {name: 'TimeoutError'}]);
+      let scriptsForThisTeam = scriptsResponseData.scripts;
+      if(scriptsForThisTeam !== null) {
+        allScripts = allScripts.concat(scriptsForThisTeam);
+      }
+    }
+
+    // Grab all of the configuration scripts on the Fleet instance.
+    let noTeamConfigurationScriptsResponseData = await sails.helpers.http.get.with({
+      url: '/api/v1/fleet/scripts',
+      baseUrl: sails.config.custom.fleetBaseUrl,
+      headers: {
+        Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+      }
+    })
+    .timeout(120000)
+    .retry(['requestFailed', {name: 'TimeoutError'}]);
+    let scriptsForThisTeam = noTeamConfigurationScriptsResponseData.scripts;
+
+    if(scriptsForThisTeam !== null){
+      allScripts = allScripts.concat(scriptsForThisTeam);
+    }
+
+    if(allScripts === [ null ]){
+      return {scripts: [], teams};
+    }
+    let scriptsOnThisFleetInstance = [];
+
+    let allScriptsByIdentifier = _.groupBy(allScripts, 'name');
+    for(let scriptIdentifier in allScriptsByIdentifier) {
+      if(scriptIdentifier === null){
+        continue;
+      }
+      let teamsForThisProfile = [];
+      // console.log(teamsForThisProfile);
+      // let platforms = _.uniq(_.pluck(allScriptsByIdentifier[scriptIdentifier], 'platform'));
+      for(let script of allScriptsByIdentifier[scriptIdentifier]){
+        let informationAboutThisScript = {
+          scriptFleetApid: script.id,
+          fleetApid: script.team_id ? script.team_id : 0,
+          teamName: script.team_id ? _.find(teams, {fleetApid: script.team_id}).teamName : 'No team',
+        };
+        teamsForThisProfile.push(informationAboutThisScript);
+      }
+      let script = allScriptsByIdentifier[scriptIdentifier][0];// Grab the first script returned in the api repsonse to build our script configuration.
+      let scriptInformation = {
+        name: script.name,
+        identifier: scriptIdentifier,
+        platform: _.endsWith(script.name, 'sh') ? 'macOS & Linux' : 'Windows',
+        createdAt: new Date(script.created_at).getTime(),
+        teams: teamsForThisProfile
+      };
+      scriptsOnThisFleetInstance.push(scriptInformation);
+    }
+    // Get the undeployed scripts from the app's database.
+    let undeployedScripts = await UndeployedScript.find();
+    scriptsOnThisFleetInstance = _.union(scriptsOnThisFleetInstance, undeployedScripts);
+
+    // Sort the scripts by name.
+    scriptsOnThisFleetInstance = _.sortByOrder(scriptsOnThisFleetInstance, 'name', 'asc');
+    // Respond with view.
+    return {scripts: scriptsOnThisFleetInstance, teams};
+
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/helpers/broadcast-session-change.js b/ee/bulk-operations-dashboard/api/helpers/broadcast-session-change.js
new file mode 100644
index 000000000000..f4aa836b3cf1
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/helpers/broadcast-session-change.js
@@ -0,0 +1,45 @@
+module.exports = {
+
+
+  friendlyName: 'Broadcast session change',
+
+
+  description: 'Broadcast a socket notification indicating a change in login status.',
+
+
+  inputs: {
+
+    req: {
+      type: 'ref',
+      required: true,
+    },
+
+  },
+
+
+  exits: {
+
+    success: {
+      description: 'All done.',
+    },
+
+  },
+
+
+  fn: async function ({ req }) {
+
+    // If there's no sessionID, we don't need to broadcase a message about the old session.
+    if(!req.sessionID) {
+      return;
+    }
+
+    let roomName = `session${_.deburr(req.sessionID)}`;
+    let messageText = `You have signed out or signed into a different session in another tab or window. Reload the page to refresh your session.`;
+    sails.sockets.broadcast(roomName, 'session', { notificationText: messageText }, req);
+
+
+  }
+
+
+};
+
diff --git a/ee/bulk-operations-dashboard/api/helpers/redact-user.js b/ee/bulk-operations-dashboard/api/helpers/redact-user.js
new file mode 100644
index 000000000000..28d9a7c44f72
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/helpers/redact-user.js
@@ -0,0 +1,33 @@
+module.exports = {
+
+
+  friendlyName: 'Redact user',
+
+
+  description: 'Destructively remove properties from the provided User record to prepare it for publication.',
+
+
+  sync: true,
+
+
+  inputs: {
+
+    user: {
+      type: 'ref',
+      readOnly: false
+    }
+
+  },
+
+
+  fn: function ({ user }) {
+    for (let [attrName, attrDef] of Object.entries(User.attributes)) {
+      if (attrDef.protect) {
+        delete user[attrName];
+      }//fi
+    }//∞
+  }
+
+
+};
+
diff --git a/ee/bulk-operations-dashboard/api/helpers/send-template-email.js b/ee/bulk-operations-dashboard/api/helpers/send-template-email.js
new file mode 100644
index 000000000000..f03b44746281
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/helpers/send-template-email.js
@@ -0,0 +1,282 @@
+module.exports = {
+
+
+  friendlyName: 'Send template email',
+
+
+  description: 'Send an email using a template.',
+
+
+  extendedDescription: 'To ease testing and development, if the provided "to" email address ends in "@example.com", '+
+    'then the email message will be written to the terminal instead of actually being sent.'+
+    '(Thanks [@simonratner](https://github.com/simonratner)!)',
+
+
+  inputs: {
+
+
+    template: {
+      description: 'The relative path to an EJS template within our `views/emails/` folder -- WITHOUT the file extension.',
+      extendedDescription: 'Use strings like "foo" or "foo/bar", but NEVER "foo/bar.ejs" or "/foo/bar".  For example, '+
+        '"internal/email-contact-form" would send an email using the "views/emails/internal/email-contact-form.ejs" template.',
+      example: 'email-reset-password',
+      type: 'string',
+      required: true
+    },
+
+    templateData: {
+      description: 'A dictionary of data which will be accessible in the EJS template.',
+      extendedDescription: 'Each key will be a local variable accessible in the template.  For instance, if you supply '+
+        'a dictionary with a \`friends\` key, and \`friends\` is an array like \`[{name:"Chandra"}, {name:"Mary"}]\`),'+
+        'then you will be able to access \`friends\` from the template:\n'+
+        '\`\`\`\n'+
+        '<ul>\n'+
+         '<% for (friend of friends){ %><li><%= friend.name %></li><% }); %>\n'+
+        '</ul>\n'+
+        '\`\`\`'+
+        '\n'+
+        'This is EJS, so use \`<%= %>\` to inject the HTML-escaped content of a variable, \`<%= %>\` to skip HTML-escaping '+
+        'and inject the data as-is, or \`<% %>\` to execute some JavaScript code such as an \`if\` statement or \`for\` loop.',
+      type: {},
+      defaultsTo: {}
+    },
+
+    to: {
+      description: 'The email address of the primary recipient.',
+      extendedDescription: 'If this is any address ending in "@example.com", then don\'t actually deliver the message. '+
+        'Instead, just log it to the console.',
+      example: 'nola.thacker@example.com',
+      required: true,
+      isEmail: true,
+    },
+
+    toName: {
+      description: 'Name of the primary recipient as displayed in their inbox.',
+      example: 'Nola Thacker',
+    },
+
+    subject: {
+      description: 'The subject of the email.',
+      example: 'Hello there.',
+      defaultsTo: ''
+    },
+
+    from: {
+      description: 'An override for the default "from" email that\'s been configured.',
+      example: 'anne.martin@example.com',
+      isEmail: true,
+    },
+
+    fromName: {
+      description: 'An override for the default "from" name.',
+      example: 'Anne Martin',
+    },
+
+    layout: {
+      description: 'Set to `false` to disable layouts altogether, or provide the path (relative '+
+        'from `views/layouts/`) to an override email layout.',
+      defaultsTo: 'layout-email',
+      custom: (layout)=>layout===false || _.isString(layout)
+    },
+
+    ensureAck: {
+      description: 'Whether to wait for acknowledgement (to hear back) that the email was successfully sent (or at least queued for sending) before returning.',
+      extendedDescription: 'Otherwise by default, this returns immediately and delivers the request to deliver this email in the background.',
+      type: 'boolean',
+      defaultsTo: false
+    },
+
+    bcc: {
+      description: 'The email addresses of recipients secretly copied on the email.',
+      example: ['jahnna.n.malcolm@example.com'],
+    },
+
+    attachments: {
+      description: 'Attachments to include in the email, with the file content encoded as base64.',
+      whereToGet: {
+        description: 'If you have `sails-hook-uploads` installed, you can use `sails.reservoir` to get an attachment into the expected format.',
+      },
+      example: [
+        {
+          contentBytes: 'iVBORw0KGgoAA…',
+          name: 'sails.png',
+          type: 'image/png',
+        }
+      ],
+      defaultsTo: [],
+    },
+
+  },
+
+
+  exits: {
+
+    success: {
+      outputFriendlyName: 'Email delivery report',
+      outputDescription: 'A dictionary of information about what went down.',
+      outputType: {
+        loggedInsteadOfSending: 'boolean'
+      }
+    }
+
+  },
+
+
+  fn: async function({template, templateData, to, toName, subject, from, fromName, layout, ensureAck, bcc, attachments}) {
+
+    var path = require('path');
+    var url = require('url');
+    var util = require('util');
+
+
+    if (!_.startsWith(path.basename(template), 'email-')) {
+      sails.log.warn(
+        'The "template" that was passed in to `sendTemplateEmail()` does not begin with '+
+        '"email-" -- but by convention, all email template files in `views/emails/` should '+
+        'be namespaced in this way.  (This makes it easier to look up email templates by '+
+        'filename; e.g. when using CMD/CTRL+P in Sublime Text.)\n'+
+        'Continuing regardless...'
+      );
+    }
+
+    if (_.startsWith(template, 'views/') || _.startsWith(template, 'emails/')) {
+      throw new Error(
+        'The "template" that was passed in to `sendTemplateEmail()` was prefixed with\n'+
+        '`emails/` or `views/` -- but that part is supposed to be omitted.  Instead, please\n'+
+        'just specify the path to the desired email template relative from `views/emails/`.\n'+
+        'For example:\n'+
+        '  template: \'email-reset-password\'\n'+
+        'Or:\n'+
+        '  template: \'admin/email-contact-form\'\n'+
+        ' [?] If you\'re unsure or need advice, see https://sailsjs.com/support'
+      );
+    }//•
+
+    // Determine appropriate email layout and template to use.
+    var emailTemplatePath = path.join('emails/', template);
+    var emailTemplateLayout;
+    if (layout) {
+      emailTemplateLayout = path.relative(path.dirname(emailTemplatePath), path.resolve('layouts/', layout));
+    } else {
+      emailTemplateLayout = false;
+    }
+
+    // Compile HTML template.
+    // > Note that we set the layout, provide access to core `url` package (for
+    // > building links and image srcs, etc.), and also provide access to core
+    // > `util` package (for dumping debug data in internal emails).
+    var htmlEmailContents = await sails.renderView(
+      emailTemplatePath,
+      _.extend({layout: emailTemplateLayout, url, util }, templateData)
+    )
+    .intercept((err)=>{
+      err.message =
+      'Could not compile view template.\n'+
+      '(Usually, this means the provided data is invalid, or missing a piece.)\n'+
+      'Details:\n'+
+      err.message;
+      return err;
+    });
+
+    // Sometimes only log info to the console about the email that WOULD have been sent.
+    // Specifically, if the "To" email address is anything "@example.com".
+    //
+    // > This is used below when determining whether to actually send the email,
+    // > for convenience during development, but also for safety.  (For example,
+    // > a special-cased version of "user@example.com" is used by Trend Micro Mars
+    // > scanner to "check apks for malware".)
+    var isToAddressConsideredFake = Boolean(to.match(/@example\.com$/i));
+
+    // If that's the case, or if we're in the "test" environment, then log
+    // the email instead of sending it:
+    var dontActuallySend = (
+      sails.config.environment === 'test' || isToAddressConsideredFake
+    );
+    if (dontActuallySend) {
+      sails.log(
+        'Skipped sending email, either because the "To" email address ended in "@example.com"\n'+
+        'or because the current \`sails.config.environment\` is set to "test".\n'+
+        '\n'+
+        'But anyway, here is what WOULD have been sent:\n'+
+        '-=-=-=-=-=-=-=-=-=-=-=-=-= Email log =-=-=-=-=-=-=-=-=-=-=-=-=-\n'+
+        'To: '+to+'\n'+
+        'Subject: '+subject+'\n'+
+        '\n'+
+        'Body:\n'+
+        htmlEmailContents+'\n'+
+        '-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-'
+      );
+    } else {
+      // Otherwise, we'll check that all required Mailgun credentials are set up
+      // and, if so, continue to actually send the email.
+
+      if (!sails.config.custom.sendgridSecret) {
+        throw new Error(
+          'Cannot deliver email to "'+to+'" because:\n'+
+          (()=>{
+            let problems = [];
+            if (!sails.config.custom.sendgridSecret) {
+              problems.push(' • Sendgrid secret is missing from this app\'s configuration (`sails.config.custom.sendgridSecret`)');
+            }
+            return problems.join('\n');
+          })()+
+          '\n'+
+          'To resolve these configuration issues, add the missing config variables to\n'+
+          '\`config/custom.js\`-- or in staging/production, set them up as system\n'+
+          'environment vars.  (If you don\'t have a Sendgrid secret, you can\n'+
+          'sign up for free at https://sendgrid.com to receive credentials.)\n'+
+          '\n'+
+          '> Note that, for convenience during development, there is another alternative:\n'+
+          '> In lieu of setting up real Sendgrid credentials, you can "fake" email\n'+
+          '> delivery by using any email address that ends in "@example.com".  This will\n'+
+          '> write automated emails to your logs rather than actually sending them.\n'+
+          '> (To simulate clicking on a link from an email, just copy and paste the link\n'+
+          '> from the terminal output into your browser.)\n'+
+          '\n'+
+          '[?] If you\'re unsure, visit https://sailsjs.com/support'
+        );
+      }
+
+      var subjectLinePrefix = sails.config.environment === 'production' ? '' : sails.config.environment === 'staging' ? '[FROM STAGING] ' : '[FROM LOCALHOST] ';
+      var messageData = {
+        htmlMessage: htmlEmailContents,
+        to: to,
+        toName: toName,
+        bcc: bcc,
+        subject: subjectLinePrefix+subject,
+        from: from,
+        fromName: fromName,
+        attachments
+      };
+
+      var deferred = sails.helpers.sendgrid.sendHtmlEmail.with(messageData);
+      if (ensureAck) {
+        await deferred;
+      } else {
+        // FUTURE: take advantage of .background() here instead (when available)
+        deferred.exec((err)=>{
+          if (err) {
+            sails.log.error(
+              'Background instruction failed:  Could not deliver email:\n'+
+              util.inspect({template, templateData, to, toName, subject, from, fromName, layout, ensureAck, bcc, attachments},{depth:null})+'\n',
+              'Error details:\n'+
+              util.inspect(err)
+            );
+          } else {
+            sails.log.info(
+              'Background instruction complete:  Email sent via email delivery service (or at least queued):\n'+
+              util.inspect({to, toName, subject, from, fromName, bcc},{depth:null})
+            );
+          }
+        });//_∏_
+      }//fi
+    }//fi
+
+    // All done!
+    return {
+      loggedInsteadOfSending: dontActuallySend,
+    };
+
+  }
+
+};
diff --git a/ee/bulk-operations-dashboard/api/hooks/custom/index.js b/ee/bulk-operations-dashboard/api/hooks/custom/index.js
new file mode 100644
index 000000000000..be391d7097fe
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/hooks/custom/index.js
@@ -0,0 +1,275 @@
+/**
+ * @description :: The conventional "custom" hook.  Extends this app with custom server-start-time and request-time logic.
+ * @docs        :: https://sailsjs.com/docs/concepts/extending-sails/hooks
+ */
+
+module.exports = function defineCustomHook(sails) {
+
+  return {
+
+    /**
+     * Runs when a Sails app loads/lifts.
+     */
+    initialize: async function () {
+
+      sails.log.info('Initializing project hook... (`api/hooks/custom/`)');
+
+      // Check Stripe/Sendgrid configuration (for billing and emails).
+      var IMPORTANT_STRIPE_CONFIG = ['stripeSecret', 'stripePublishableKey'];
+      var IMPORTANT_SENDGRID_CONFIG = ['sendgridSecret', 'internalEmailAddress'];
+      var isMissingStripeConfig = _.difference(IMPORTANT_STRIPE_CONFIG, Object.keys(sails.config.custom)).length > 0;
+      var isMissingSendgridConfig = _.difference(IMPORTANT_SENDGRID_CONFIG, Object.keys(sails.config.custom)).length > 0;
+
+      if (isMissingStripeConfig || isMissingSendgridConfig) {
+
+        let missingFeatureText = isMissingStripeConfig && isMissingSendgridConfig ? 'billing and email' : isMissingStripeConfig ? 'billing' : 'email';
+        let suffix = '';
+        if (_.contains(['silly'], sails.config.log.level)) {
+          suffix =
+`
+> Tip: To exclude sensitive credentials from source control, use:
+> • config/local.js (for local development)
+> • environment variables (for production)
+>
+> If you want to check them in to source control, use:
+> • config/custom.js  (for development)
+> • config/env/staging.js  (for staging)
+> • config/env/production.js  (for production)
+>
+> (See https://sailsjs.com/docs/concepts/configuration for help configuring Sails.)
+`;
+        }
+
+        let problems = [];
+        if (sails.config.custom.stripeSecret === undefined) {
+          problems.push('No `sails.config.custom.stripeSecret` was configured.');
+        }
+        if (sails.config.custom.stripePublishableKey === undefined) {
+          problems.push('No `sails.config.custom.stripePublishableKey` was configured.');
+        }
+        if (sails.config.custom.sendgridSecret === undefined) {
+          problems.push('No `sails.config.custom.sendgridSecret` was configured.');
+        }
+        if (sails.config.custom.internalEmailAddress === undefined) {
+          problems.push('No `sails.config.custom.internalEmailAddress` was configured.');
+        }
+
+
+        if (sails.config.custom.fleetBaseUrl === undefined) {
+          throw new Error('Missing config vairable! Please set sails.config.custom.fleetBaseUrl to be the URL of your Fleet instance.');
+        }
+        if (sails.config.custom.fleetApiToken === undefined) {
+          throw new Error('Missing config vairable! Please set sails.config.custom.fleetApiToken to be a token for your Fleet instance.');
+        }
+
+
+        if (_.endsWith(sails.config.custom.fleetBaseUrl, '/')) {
+          sails.config.custom.fleetBaseUrl = _.trimRight(sails.config.custom.fleetBaseUrl, '/');
+          sails.log.warn('Warning: The provided sails.config.custom.fleetBaseUrl has a trailing slash. To make sure all auto-generated URLs work as expected, this trailing slash has been removed for you.');
+        }
+        if (!_.startsWith(sails.config.custom.fleetBaseUrl, 'https://')) {
+          sails.log.warn('Warning: The provided sails.config.custom.fleetBaseUrl is missing a protocol (https://). To make sure all auto-generated URLs work as expected, the protocol has been added to the fleetBaseUrl.');
+          sails.config.custom.fleetBaseUrl = 'https://'+sails.config.custom.fleetBaseUrl;
+        }
+
+        sails.log.verbose(
+`Some optional settings have not been configured yet:
+---------------------------------------------------------------------
+${problems.join('\n')}
+
+Until this is addressed, this app's ${missingFeatureText} features
+will be disabled and/or hidden in the UI.
+
+ [?] If you're unsure or need advice, come by https://sailsjs.com/support
+---------------------------------------------------------------------${suffix}`);
+      }//fi
+
+      // Set an additional config keys based on whether Stripe config is available.
+      // This will determine whether or not to enable various billing features.
+      sails.config.custom.enableBillingFeatures = !isMissingStripeConfig;
+
+      // After "sails-hook-organics" finishes initializing, configure Stripe
+      // and Sendgrid packs with any available credentials.
+      sails.after('hook:organics:loaded', ()=>{
+
+        sails.helpers.stripe.configure({
+          secret: sails.config.custom.stripeSecret
+        });
+
+        sails.helpers.sendgrid.configure({
+          secret: sails.config.custom.sendgridSecret,
+          from: sails.config.custom.fromEmailAddress,
+          fromName: sails.config.custom.fromName,
+        });
+
+      });//_∏_
+
+      // ... Any other app-specific setup code that needs to run on lift,
+      // even in production, goes here ...
+
+    },
+
+
+    routes: {
+
+      /**
+       * Runs before every matching route.
+       *
+       * @param {Ref} req
+       * @param {Ref} res
+       * @param {Function} next
+       */
+      before: {
+        '/*': {
+          skipAssets: true,
+          fn: async function(req, res, next){
+
+            var url = require('url');
+
+            // First, if this is a GET request (and thus potentially a view),
+            // attach a couple of guaranteed locals.
+            if (req.method === 'GET') {
+
+              // The  `_environment` local lets us do a little workaround to make Vue.js
+              // run in "production mode" without unnecessarily involving complexities
+              // with webpack et al.)
+              if (res.locals._environment !== undefined) {
+                throw new Error('Cannot attach Sails environment as the view local `_environment`, because this view local already exists!  (Is it being attached somewhere else?)');
+              }
+              res.locals._environment = sails.config.environment;
+
+              // The `me` local is set explicitly to `undefined` here just to avoid having to
+              // do `typeof me !== 'undefined'` checks in our views/layouts/partials.
+              // > Note that, depending on the request, this may or may not be set to the
+              // > logged-in user record further below.
+              if (res.locals.me !== undefined) {
+                throw new Error('Cannot attach view local `me`, because this view local already exists!  (Is it being attached somewhere else?)');
+              }
+              res.locals.me = undefined;
+            }//fi
+
+            // Next, if we're running in our actual "production" or "staging" Sails
+            // environment, check if this is a GET request via some other host,
+            // for example a subdomain like `webhooks.` or `click.`.  If so, we'll
+            // automatically go ahead and redirect to the corresponding path under
+            // our base URL, which is environment-specific.
+            // > Note that we DO NOT redirect virtual socket requests and we DO NOT
+            // > redirect non-GET requests (because it can confuse some 3rd party
+            // > platforms that send webhook requests.)  We also DO NOT redirect
+            // > requests in other environments to allow for flexibility during
+            // > development (e.g. so you can preview an app running locally on
+            // > your laptop using a local IP address or a tool like ngrok, in
+            // > case you want to run it on a real, physical mobile/IoT device)
+            var configuredBaseHostname;
+            try {
+              configuredBaseHostname = url.parse(sails.config.custom.baseUrl).host;
+            } catch (unusedErr) { /*…*/}
+            if ((sails.config.environment === 'staging' || sails.config.environment === 'production') && !req.isSocket && req.method === 'GET' && req.hostname !== configuredBaseHostname) {
+              sails.log.info('Redirecting GET request from `'+req.hostname+'` to configured expected host (`'+configuredBaseHostname+'`)...');
+              return res.redirect(sails.config.custom.baseUrl+req.url);
+            }//•
+
+            // Prevent the browser from caching logged-in users' pages.
+            // (including w/ the Chrome back button)
+            // > • https://mixmax.com/blog/chrome-back-button-cache-no-store
+            // > • https://madhatted.com/2013/6/16/you-do-not-understand-browser-history
+            //
+            // This also prevents an issue where webpages may be cached by browsers, and thus
+            // reference an old bundle file (e.g. dist/production.min.js or dist/production.min.css),
+            // which might have a different hash encoded in its filename.  This way, by preventing caching
+            // of the webpage itself, the HTML is always fresh, and thus always trying to load the latest,
+            // correct bundle files.
+            res.setHeader('Cache-Control', 'no-cache, no-store');
+
+            // No session? Proceed as usual.
+            // (e.g. request for a static asset)
+            if (!req.session) { return next(); }
+
+            // Not logged in? Proceed as usual.
+            if (!req.session.userId) { return next(); }
+
+            // Otherwise, look up the logged-in user.
+            var loggedInUser = await User.findOne({
+              id: req.session.userId
+            });
+
+            // If the logged-in user has gone missing, log a warning,
+            // wipe the user id from the requesting user agent's session,
+            // and then send the "unauthorized" response.
+            if (!loggedInUser) {
+              sails.log.warn('Somehow, the user record for the logged-in user (`'+req.session.userId+'`) has gone missing....');
+              delete req.session.userId;
+              return res.unauthorized();
+            }
+
+            // Add additional information for convenience when building top-level navigation.
+            // (i.e. whether to display "Dashboard", "My Account", etc.)
+            if (!loggedInUser.password || loggedInUser.emailStatus === 'unconfirmed') {
+              loggedInUser.dontDisplayAccountLinkInNav = true;
+            }
+
+            // Expose the user record as an extra property on the request object (`req.me`).
+            // > Note that we make sure `req.me` doesn't already exist first.
+            if (req.me !== undefined) {
+              throw new Error('Cannot attach logged-in user as `req.me` because this property already exists!  (Is it being attached somewhere else?)');
+            }
+            req.me = loggedInUser;
+
+            // If our "lastSeenAt" attribute for this user is at least a few seconds old, then set it
+            // to the current timestamp.
+            //
+            // (Note: As an optimization, this is run behind the scenes to avoid adding needless latency.)
+            var MS_TO_BUFFER = 60*1000;
+            var now = Date.now();
+            if (loggedInUser.lastSeenAt < now - MS_TO_BUFFER) {
+              User.updateOne({id: loggedInUser.id})
+              .set({ lastSeenAt: now })
+              .exec((err)=>{
+                if (err) {
+                  sails.log.error('Background task failed: Could not update user (`'+loggedInUser.id+'`) with a new `lastSeenAt` timestamp.  Error details: '+err.stack);
+                  return;
+                }//•
+                sails.log.verbose('Updated the `lastSeenAt` timestamp for user `'+loggedInUser.id+'`.');
+                // Nothing else to do here.
+              });//_∏_  (Meanwhile...)
+            }//fi
+
+
+            // If this is a GET request, then also expose an extra view local (`<%= me %>`).
+            // > Note that we make sure a local named `me` doesn't already exist first.
+            // > Also note that we strip off any properties that correspond with protected attributes.
+            if (req.method === 'GET') {
+              if (res.locals.me !== undefined) {
+                throw new Error('Cannot attach logged-in user as the view local `me`, because this view local already exists!  (Is it being attached somewhere else?)');
+              }
+
+              // Exclude any fields corresponding with attributes that have `protect: true`.
+              var sanitizedUser = _.extend({}, loggedInUser);
+              sails.helpers.redactUser(sanitizedUser);
+
+              // If there is still a "password" in sanitized user data, then delete it just to be safe.
+              // (But also log a warning so this isn't hopelessly confusing.)
+              if (sanitizedUser.password) {
+                sails.log.warn('The logged in user record has a `password` property, but it was still there after pruning off all properties that match `protect: true` attributes in the User model.  So, just to be safe, removing the `password` property anyway...');
+                delete sanitizedUser.password;
+              }//fi
+
+              res.locals.me = sanitizedUser;
+
+              // Include information on the locals as to whether billing features
+              // are enabled for this app, and whether email verification is required.
+              res.locals.isBillingEnabled = sails.config.custom.enableBillingFeatures;
+              res.locals.isEmailVerificationRequired = sails.config.custom.verifyEmailAddresses;
+
+            }//fi
+
+            return next();
+          }
+        }
+      }
+    }
+
+
+  };
+
+};
diff --git a/ee/bulk-operations-dashboard/api/models/UndeployedProfile.js b/ee/bulk-operations-dashboard/api/models/UndeployedProfile.js
new file mode 100644
index 000000000000..2d13a1993fd1
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/models/UndeployedProfile.js
@@ -0,0 +1,61 @@
+/**
+ * UndeployedProfile.js
+ *
+ * @description :: A model definition represents a database table/collection.
+ * @docs        :: https://sailsjs.com/docs/concepts/models-and-orm/models
+ */
+
+module.exports = {
+
+  attributes: {
+
+    //  ╔═╗╦═╗╦╔╦╗╦╔╦╗╦╦  ╦╔═╗╔═╗
+    //  ╠═╝╠╦╝║║║║║ ║ ║╚╗╔╝║╣ ╚═╗
+    //  ╩  ╩╚═╩╩ ╩╩ ╩ ╩ ╚╝ ╚═╝╚═╝
+    name: {
+      type: 'string',
+      required: true,
+      description: 'The name of the configuration profile on the Fleet instance.',
+    },
+
+    platform: {
+      type: 'string',
+      description: 'The type of operating system this profile is for.',
+      required: true,
+      isIn: [
+        'darwin',
+        'windows'
+      ]
+    },
+
+    profileType: {
+      type: 'string',
+      description: 'The file extension of the configuration profile.',
+      required: true,
+      isIn: [
+        '.mobileconfig',
+        '.xml',
+        '.json',
+      ],
+    },
+
+    profileContents: {
+      type: 'string',
+      required: true,
+      description: 'The contents of the configuration profile.',
+    },
+
+
+    //  ╔═╗╔╦╗╔╗ ╔═╗╔╦╗╔═╗
+    //  ║╣ ║║║╠╩╗║╣  ║║╚═╗
+    //  ╚═╝╩ ╩╚═╝╚═╝═╩╝╚═╝
+
+
+    //  ╔═╗╔═╗╔═╗╔═╗╔═╗╦╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+    //  ╠═╣╚═╗╚═╗║ ║║  ║╠═╣ ║ ║║ ║║║║╚═╗
+    //  ╩ ╩╚═╝╚═╝╚═╝╚═╝╩╩ ╩ ╩ ╩╚═╝╝╚╝╚═╝
+
+  },
+
+};
+
diff --git a/ee/bulk-operations-dashboard/api/models/UndeployedScript.js b/ee/bulk-operations-dashboard/api/models/UndeployedScript.js
new file mode 100644
index 000000000000..2ce07c215856
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/models/UndeployedScript.js
@@ -0,0 +1,60 @@
+/**
+ * UndeployedScript.js
+ *
+ * @description :: A model definition represents a database table/collection.
+ * @docs        :: https://sailsjs.com/docs/concepts/models-and-orm/models
+ */
+
+module.exports = {
+
+  attributes: {
+
+    //  ╔═╗╦═╗╦╔╦╗╦╔╦╗╦╦  ╦╔═╗╔═╗
+    //  ╠═╝╠╦╝║║║║║ ║ ║╚╗╔╝║╣ ╚═╗
+    //  ╩  ╩╚═╩╩ ╩╩ ╩ ╩ ╚╝ ╚═╝╚═╝
+    name: {
+      type: 'string',
+      required: true,
+      description: 'The name of the script on the Fleet instance.',
+    },
+
+    platform: {
+      type: 'string',
+      description: 'The type of operating system this script is for.',
+      required: true,
+      isIn: [
+        'macOS & Linux',
+        'Windows'
+      ],
+    },
+
+    scriptType: {
+      type: 'string',
+      description: 'The file extension of the script.',
+      required: true,
+      isIn: [
+        '.sh',
+        '.ps1',
+      ],
+    },
+
+    scriptContents: {
+      type: 'string',
+      required: true,
+      description: 'The contents of the script stored as a string.',
+    },
+
+
+    //  ╔═╗╔╦╗╔╗ ╔═╗╔╦╗╔═╗
+    //  ║╣ ║║║╠╩╗║╣  ║║╚═╗
+    //  ╚═╝╩ ╩╚═╝╚═╝═╩╝╚═╝
+
+
+    //  ╔═╗╔═╗╔═╗╔═╗╔═╗╦╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+    //  ╠═╣╚═╗╚═╗║ ║║  ║╠═╣ ║ ║║ ║║║║╚═╗
+    //  ╩ ╩╚═╝╚═╝╚═╝╚═╝╩╩ ╩ ╩ ╩╚═╝╝╚╝╚═╝
+
+  },
+
+};
+
diff --git a/ee/bulk-operations-dashboard/api/models/User.js b/ee/bulk-operations-dashboard/api/models/User.js
new file mode 100644
index 000000000000..983627db7aaf
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/models/User.js
@@ -0,0 +1,171 @@
+/**
+ * User.js
+ *
+ * A user who can log in to this application.
+ */
+
+module.exports = {
+
+  attributes: {
+
+    //  ╔═╗╦═╗╦╔╦╗╦╔╦╗╦╦  ╦╔═╗╔═╗
+    //  ╠═╝╠╦╝║║║║║ ║ ║╚╗╔╝║╣ ╚═╗
+    //  ╩  ╩╚═╩╩ ╩╩ ╩ ╩ ╚╝ ╚═╝╚═╝
+
+    emailAddress: {
+      type: 'string',
+      required: true,
+      unique: true,
+      isEmail: true,
+      maxLength: 200,
+      example: 'mary.sue@example.com'
+    },
+
+    emailStatus: {
+      type: 'string',
+      isIn: ['unconfirmed', 'change-requested', 'confirmed'],
+      defaultsTo: 'confirmed',
+      description: 'The confirmation status of the user\'s email address.',
+      extendedDescription:
+`Users might be created as "unconfirmed" (e.g. normal signup) or as "confirmed" (e.g. hard-coded
+admin users).  When the email verification feature is enabled, new users created via the
+signup form have \`emailStatus: 'unconfirmed'\` until they click the link in the confirmation email.
+Similarly, when an existing user changes their email address, they switch to the "change-requested"
+email status until they click the link in the confirmation email.`
+    },
+
+    emailChangeCandidate: {
+      type: 'string',
+      isEmail: true,
+      description: 'A still-unconfirmed email address that this user wants to change to (if relevant).'
+    },
+
+    password: {
+      type: 'string',
+      required: true,
+      description: 'Securely hashed representation of the user\'s login password.',
+      protect: true,
+      example: '2$28a8eabna301089103-13948134nad'
+    },
+
+    fullName: {
+      type: 'string',
+      required: true,
+      description: 'Full representation of the user\'s name.',
+      maxLength: 120,
+      example: 'Mary Sue van der McHenst'
+    },
+
+    isSuperAdmin: {
+      type: 'boolean',
+      description: 'Whether this user is a "super admin" with extra permissions, etc.',
+      extendedDescription:
+`Super admins might have extra permissions, see a different default home page when they log in,
+or even have a completely different feature set from normal users.  In this app, the \`isSuperAdmin\`
+flag is just here as a simple way to represent two different kinds of users.  Usually, it's a good idea
+to keep the data model as simple as possible, only adding attributes when you actually need them for
+features being built right now.
+
+For example, a "super admin" user for a small to medium-sized e-commerce website might be able to
+change prices, deactivate seasonal categories, add new offerings, and view live orders as they come in.
+On the other hand, for an e-commerce website like Walmart.com that has undergone years of development
+by a large team, those administrative features might be split across a few different roles.
+
+So, while this \`isSuperAdmin\` demarcation might not be the right approach forever, it's a good place to start.`
+    },
+
+    passwordResetToken: {
+      type: 'string',
+      description: 'A unique token used to verify the user\'s identity when recovering a password.  Expires after 1 use, or after a set amount of time has elapsed.'
+    },
+
+    passwordResetTokenExpiresAt: {
+      type: 'number',
+      description: 'A JS timestamp (epoch ms) representing the moment when this user\'s `passwordResetToken` will expire (or 0 if the user currently has no such token).',
+      example: 1502844074211
+    },
+
+    emailProofToken: {
+      type: 'string',
+      description: 'A pseudorandom, probabilistically-unique token for use in our account verification emails.'
+    },
+
+    emailProofTokenExpiresAt: {
+      type: 'number',
+      description: 'A JS timestamp (epoch ms) representing the moment when this user\'s `emailProofToken` will expire (or 0 if the user currently has no such token).',
+      example: 1502844074211
+    },
+
+    stripeCustomerId: {
+      type: 'string',
+      protect: true,
+      description: 'The id of the customer entry in Stripe associated with this user (or empty string if this user is not linked to a Stripe customer -- e.g. if billing features are not enabled).',
+      extendedDescription:
+`Just because this value is set doesn't necessarily mean that this user has a billing card.
+It just means they have a customer entry in Stripe, which might or might not have a billing card.`
+    },
+
+    hasBillingCard: {
+      type: 'boolean',
+      description: 'Whether this user has a default billing card hooked up as their payment method.',
+      extendedDescription:
+`More specifically, this indcates whether this user record's linked customer entry in Stripe has
+a default payment source (i.e. credit card).  Note that a user have a \`stripeCustomerId\`
+without necessarily having a billing card.`
+    },
+
+    billingCardBrand: {
+      type: 'string',
+      example: 'Visa',
+      description: 'The brand of this user\'s default billing card (or empty string if no billing card is set up).',
+      extendedDescription: 'To ensure PCI compliance, this data comes from Stripe, where it reflects the user\'s default payment source.'
+    },
+
+    billingCardLast4: {
+      type: 'string',
+      example: '4242',
+      description: 'The last four digits of the card number for this user\'s default billing card (or empty string if no billing card is set up).',
+      extendedDescription: 'To ensure PCI compliance, this data comes from Stripe, where it reflects the user\'s default payment source.'
+    },
+
+    billingCardExpMonth: {
+      type: 'string',
+      example: '08',
+      description: 'The two-digit expiration month from this user\'s default billing card, formatted as MM (or empty string if no billing card is set up).',
+      extendedDescription: 'To ensure PCI compliance, this data comes from Stripe, where it reflects the user\'s default payment source.'
+    },
+
+    billingCardExpYear: {
+      type: 'string',
+      example: '2023',
+      description: 'The four-digit expiration year from this user\'s default billing card, formatted as YYYY (or empty string if no credit card is set up).',
+      extendedDescription: 'To ensure PCI compliance, this data comes from Stripe, where it reflects the user\'s default payment source.'
+    },
+
+    tosAcceptedByIp: {
+      type: 'string',
+      description: 'The IP (ipv4) address of the request that accepted the terms of service.',
+      extendedDescription: 'Useful for certain types of businesses and regulatory requirements (KYC, etc.)',
+      moreInfoUrl: 'https://en.wikipedia.org/wiki/Know_your_customer'
+    },
+
+    lastSeenAt: {
+      type: 'number',
+      description: 'A JS timestamp (epoch ms) representing the moment at which this user most recently interacted with the backend while logged in (or 0 if they have not interacted with the backend at all yet).',
+      example: 1502844074211
+    },
+
+    //  ╔═╗╔╦╗╔╗ ╔═╗╔╦╗╔═╗
+    //  ║╣ ║║║╠╩╗║╣  ║║╚═╗
+    //  ╚═╝╩ ╩╚═╝╚═╝═╩╝╚═╝
+    // n/a
+
+    //  ╔═╗╔═╗╔═╗╔═╗╔═╗╦╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+    //  ╠═╣╚═╗╚═╗║ ║║  ║╠═╣ ║ ║║ ║║║║╚═╗
+    //  ╩ ╩╚═╝╚═╝╚═╝╚═╝╩╩ ╩ ╩ ╩╚═╝╝╚╝╚═╝
+    // n/a
+
+  },
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/policies/is-logged-in.js b/ee/bulk-operations-dashboard/api/policies/is-logged-in.js
new file mode 100644
index 000000000000..0c03b1a689c1
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/policies/is-logged-in.js
@@ -0,0 +1,26 @@
+/**
+ * is-logged-in
+ *
+ * A simple policy that allows any request from an authenticated user.
+ *
+ * For more about how to use policies, see:
+ *   https://sailsjs.com/config/policies
+ *   https://sailsjs.com/docs/concepts/policies
+ *   https://sailsjs.com/docs/concepts/policies/access-control-and-permissions
+ */
+module.exports = async function (req, res, proceed) {
+
+  // If `req.me` is set, then we know that this request originated
+  // from a logged-in user.  So we can safely proceed to the next policy--
+  // or, if this is the last policy, the relevant action.
+  // > For more about where `req.me` comes from, check out this app's
+  // > custom hook (`api/hooks/custom/index.js`).
+  if (req.me) {
+    return proceed();
+  }
+
+  //--•
+  // Otherwise, this request did not come from a logged-in user.
+  return res.unauthorized();
+
+};
diff --git a/ee/bulk-operations-dashboard/api/policies/is-super-admin.js b/ee/bulk-operations-dashboard/api/policies/is-super-admin.js
new file mode 100644
index 000000000000..09c473aa9d88
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/policies/is-super-admin.js
@@ -0,0 +1,28 @@
+/**
+ * is-super-admin
+ *
+ * A simple policy that blocks requests from non-super-admins.
+ *
+ * For more about how to use policies, see:
+ *   https://sailsjs.com/config/policies
+ *   https://sailsjs.com/docs/concepts/policies
+ *   https://sailsjs.com/docs/concepts/policies/access-control-and-permissions
+ */
+module.exports = async function (req, res, proceed) {
+
+  // First, check whether the request comes from a logged-in user.
+  // > For more about where `req.me` comes from, check out this app's
+  // > custom hook (`api/hooks/custom/index.js`).
+  if (!req.me) {
+    return res.unauthorized();
+  }//•
+
+  // Then check that this user is a "super admin".
+  if (!req.me.isSuperAdmin) {
+    return res.forbidden();
+  }//•
+
+  // IWMIH, we've got ourselves a "super admin".
+  return proceed();
+
+};
diff --git a/ee/bulk-operations-dashboard/api/responses/expired.js b/ee/bulk-operations-dashboard/api/responses/expired.js
new file mode 100644
index 000000000000..c71239adbf17
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/responses/expired.js
@@ -0,0 +1,37 @@
+/**
+ * expired.js
+ *
+ * A custom response that content-negotiates the current request to either:
+ *  • serve an HTML error page about the specified token being invalid or expired
+ *  • or send back 498 (Token Expired/Invalid) with no response body.
+ *
+ * Example usage:
+ * ```
+ *     return res.expired();
+ * ```
+ *
+ * Or with actions2:
+ * ```
+ *     exits: {
+ *       badToken: {
+ *         description: 'Provided token was expired, invalid, or already used up.',
+ *         responseType: 'expired'
+ *       }
+ *     }
+ * ```
+ */
+module.exports = function expired() {
+
+  var req = this.req;
+  var res = this.res;
+
+  sails.log.verbose('Ran custom response: res.expired()');
+
+  if (req.wantsJSON) {
+    return res.status(498).send('Token Expired/Invalid');
+  }
+  else {
+    return res.status(498).view('498');
+  }
+
+};
diff --git a/ee/bulk-operations-dashboard/api/responses/unauthorized.js b/ee/bulk-operations-dashboard/api/responses/unauthorized.js
new file mode 100644
index 000000000000..650cb992f21a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/responses/unauthorized.js
@@ -0,0 +1,43 @@
+/**
+ * unauthorized.js
+ *
+ * A custom response that content-negotiates the current request to either:
+ *  • log out the current user and redirect them to the login page
+ *  • or send back 401 (Unauthorized) with no response body.
+ *
+ * Example usage:
+ * ```
+ *     return res.unauthorized();
+ * ```
+ *
+ * Or with actions2:
+ * ```
+ *     exits: {
+ *       badCombo: {
+ *         description: 'That email address and password combination is not recognized.',
+ *         responseType: 'unauthorized'
+ *       }
+ *     }
+ * ```
+ */
+module.exports = function unauthorized() {
+
+  var req = this.req;
+  var res = this.res;
+
+  sails.log.verbose('Ran custom response: res.unauthorized()');
+
+  if (req.wantsJSON) {
+    return res.sendStatus(401);
+  }
+  // Or log them out (if necessary) and then redirect to the login page.
+  else {
+
+    if (req.session.userId) {
+      delete req.session.userId;
+    }
+
+    return res.redirect('/login');
+  }
+
+};
diff --git a/ee/bulk-operations-dashboard/app.js b/ee/bulk-operations-dashboard/app.js
new file mode 100644
index 000000000000..f2c5f4eba84a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/app.js
@@ -0,0 +1,54 @@
+/**
+ * app.js
+ *
+ * Use `app.js` to run your app without `sails lift`.
+ * To start the server, run: `node app.js`.
+ *
+ * This is handy in situations where the sails CLI is not relevant or useful,
+ * such as when you deploy to a server, or a PaaS like Heroku.
+ *
+ * For example:
+ *   => `node app.js`
+ *   => `npm start`
+ *   => `forever start app.js`
+ *   => `node debug app.js`
+ *
+ * The same command-line arguments and env vars are supported, e.g.:
+ * `NODE_ENV=production node app.js --port=80 --verbose`
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/app.js
+ */
+
+
+// Ensure we're in the project directory, so cwd-relative paths work as expected
+// no matter where we actually lift from.
+// > Note: This is not required in order to lift, but it is a convenient default.
+process.chdir(__dirname);
+
+
+
+// Attempt to import `sails` dependency, as well as `rc` (for loading `.sailsrc` files).
+var sails;
+var rc;
+try {
+  sails = require('sails');
+  rc = require('sails/accessible/rc');
+} catch (err) {
+  console.error('Encountered an error when attempting to require(\'sails\'):');
+  console.error(err.stack);
+  console.error('--');
+  console.error('To run an app using `node app.js`, you need to have Sails installed');
+  console.error('locally (`./node_modules/sails`).  To do that, just make sure you\'re');
+  console.error('in the same directory as your app and run `npm install`.');
+  console.error();
+  console.error('If Sails is installed globally (i.e. `npm install -g sails`) you can');
+  console.error('also run this app with `sails lift`.  Running with `sails lift` will');
+  console.error('not run this file (`app.js`), but it will do exactly the same thing.');
+  console.error('(It even uses your app directory\'s local Sails install, if possible.)');
+  return;
+}//-•
+
+
+// Start server
+sails.lift(rc('sails'));
diff --git a/ee/bulk-operations-dashboard/assets/.eslintrc b/ee/bulk-operations-dashboard/assets/.eslintrc
new file mode 100644
index 000000000000..28cf2eb15153
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/.eslintrc
@@ -0,0 +1,63 @@
+{
+  //   ╔═╗╔═╗╦  ╦╔╗╔╔╦╗┬─┐┌─┐  ┌─┐┬  ┬┌─┐┬─┐┬─┐┬┌┬┐┌─┐
+  //   ║╣ ╚═╗║  ║║║║ ║ ├┬┘│    │ │└┐┌┘├┤ ├┬┘├┬┘│ ││├┤
+  //  o╚═╝╚═╝╩═╝╩╝╚╝ ╩ ┴└─└─┘  └─┘ └┘ └─┘┴└─┴└─┴─┴┘└─┘
+  //  ┌─  ┌─┐┌─┐┬─┐  ┌┐ ┬─┐┌─┐┬ ┬┌─┐┌─┐┬─┐   ┬┌─┐  ┌─┐┌─┐┌─┐┌─┐┌┬┐┌─┐  ─┐
+  //  │   ├┤ │ │├┬┘  ├┴┐├┬┘│ ││││└─┐├┤ ├┬┘   │└─┐  ├─┤└─┐└─┐├┤  │ └─┐   │
+  //  └─  └  └─┘┴└─  └─┘┴└─└─┘└┴┘└─┘└─┘┴└─  └┘└─┘  ┴ ┴└─┘└─┘└─┘ ┴ └─┘  ─┘
+  // > An .eslintrc configuration override for use in the `assets/` directory.
+  //
+  // This extends the top-level .eslintrc file, primarily to change the set of
+  // supported globals, as well as any other relevant settings.  (Since JavaScript
+  // code in the `assets/` folder is intended for the browser habitat, a different
+  // set of globals is supported.  For example, instead of Node.js/Sails globals
+  // like `sails` and `process`, you have access to browser globals like `window`.)
+  //
+  // (See .eslintrc in the root directory of this Sails app for more context.)
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+  "extends": [
+    "../.eslintrc"
+  ],
+
+  "env": {
+    "browser": true,
+    "node": false
+  },
+
+  "parserOptions": {
+    "ecmaVersion": 8
+    //^ If you are not using a transpiler like Babel, change this to `5`.
+  },
+
+  "globals": {
+
+    // Allow any window globals you're relying on here; e.g.
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    "SAILS_LOCALS": true,
+    "io": true,
+    "Cloud": true,
+    "parasails": true,
+    "$": true,
+    "_": true,
+    "bowser": true,
+    "StripeCheckout": true,
+    "Stripe": true,
+    "Vue": true,
+    "VueRouter": true,
+    "moment": true,
+    // "google": true,
+    // ...etc.
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+    // Make sure backend globals aren't indadvertently tolerated in our client-side JS:
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    "sails": false,
+    "User": false,
+    "UndeployedProfile": false,
+    "UndeployedScript": false
+    // ...and any other backend globals (e.g. `"Organization": false`)
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  }
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/bootstrap-4/bootstrap-4.bundle.js b/ee/bulk-operations-dashboard/assets/dependencies/bootstrap-4/bootstrap-4.bundle.js
new file mode 100644
index 000000000000..e8b832da6bdf
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/bootstrap-4/bootstrap-4.bundle.js
@@ -0,0 +1,6461 @@
+/*!
+  * Bootstrap v4.1.3 (https://getbootstrap.com/)
+  * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors)
+  * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+  */
+(function (global, factory) {
+  typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('jquery')) :
+  typeof define === 'function' && define.amd ? define(['exports', 'jquery'], factory) :
+  (factory((global.bootstrap = {}),global.jQuery));
+}(this, (function (exports,$) { 'use strict';
+
+  $ = $ && $.hasOwnProperty('default') ? $['default'] : $;
+
+  function _defineProperties(target, props) {
+    for (var i = 0; i < props.length; i++) {
+      var descriptor = props[i];
+      descriptor.enumerable = descriptor.enumerable || false;
+      descriptor.configurable = true;
+      if ("value" in descriptor) descriptor.writable = true;
+      Object.defineProperty(target, descriptor.key, descriptor);
+    }
+  }
+
+  function _createClass(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties(Constructor.prototype, protoProps);
+    if (staticProps) _defineProperties(Constructor, staticProps);
+    return Constructor;
+  }
+
+  function _defineProperty(obj, key, value) {
+    if (key in obj) {
+      Object.defineProperty(obj, key, {
+        value: value,
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+    } else {
+      obj[key] = value;
+    }
+
+    return obj;
+  }
+
+  function _objectSpread(target) {
+    for (var i = 1; i < arguments.length; i++) {
+      var source = arguments[i] != null ? arguments[i] : {};
+      var ownKeys = Object.keys(source);
+
+      if (typeof Object.getOwnPropertySymbols === 'function') {
+        ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function (sym) {
+          return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+        }));
+      }
+
+      ownKeys.forEach(function (key) {
+        _defineProperty(target, key, source[key]);
+      });
+    }
+
+    return target;
+  }
+
+  function _inheritsLoose(subClass, superClass) {
+    subClass.prototype = Object.create(superClass.prototype);
+    subClass.prototype.constructor = subClass;
+    subClass.__proto__ = superClass;
+  }
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): util.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Util = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Private TransitionEnd Helpers
+     * ------------------------------------------------------------------------
+     */
+    var TRANSITION_END = 'transitionend';
+    var MAX_UID = 1000000;
+    var MILLISECONDS_MULTIPLIER = 1000; // Shoutout AngusCroll (https://goo.gl/pxwQGp)
+
+    function toType(obj) {
+      return {}.toString.call(obj).match(/\s([a-z]+)/i)[1].toLowerCase();
+    }
+
+    function getSpecialTransitionEndEvent() {
+      return {
+        bindType: TRANSITION_END,
+        delegateType: TRANSITION_END,
+        handle: function handle(event) {
+          if ($$$1(event.target).is(this)) {
+            return event.handleObj.handler.apply(this, arguments); // eslint-disable-line prefer-rest-params
+          }
+
+          return undefined; // eslint-disable-line no-undefined
+        }
+      };
+    }
+
+    function transitionEndEmulator(duration) {
+      var _this = this;
+
+      var called = false;
+      $$$1(this).one(Util.TRANSITION_END, function () {
+        called = true;
+      });
+      setTimeout(function () {
+        if (!called) {
+          Util.triggerTransitionEnd(_this);
+        }
+      }, duration);
+      return this;
+    }
+
+    function setTransitionEndSupport() {
+      $$$1.fn.emulateTransitionEnd = transitionEndEmulator;
+      $$$1.event.special[Util.TRANSITION_END] = getSpecialTransitionEndEvent();
+    }
+    /**
+     * --------------------------------------------------------------------------
+     * Public Util Api
+     * --------------------------------------------------------------------------
+     */
+
+
+    var Util = {
+      TRANSITION_END: 'bsTransitionEnd',
+      getUID: function getUID(prefix) {
+        do {
+          // eslint-disable-next-line no-bitwise
+          prefix += ~~(Math.random() * MAX_UID); // "~~" acts like a faster Math.floor() here
+        } while (document.getElementById(prefix));
+
+        return prefix;
+      },
+      getSelectorFromElement: function getSelectorFromElement(element) {
+        var selector = element.getAttribute('data-target');
+
+        if (!selector || selector === '#') {
+          selector = element.getAttribute('href') || '';
+        }
+
+        try {
+          return document.querySelector(selector) ? selector : null;
+        } catch (err) {
+          return null;
+        }
+      },
+      getTransitionDurationFromElement: function getTransitionDurationFromElement(element) {
+        if (!element) {
+          return 0;
+        } // Get transition-duration of the element
+
+
+        var transitionDuration = $$$1(element).css('transition-duration');
+        var floatTransitionDuration = parseFloat(transitionDuration); // Return 0 if element or transition duration is not found
+
+        if (!floatTransitionDuration) {
+          return 0;
+        } // If multiple durations are defined, take the first
+
+
+        transitionDuration = transitionDuration.split(',')[0];
+        return parseFloat(transitionDuration) * MILLISECONDS_MULTIPLIER;
+      },
+      reflow: function reflow(element) {
+        return element.offsetHeight;
+      },
+      triggerTransitionEnd: function triggerTransitionEnd(element) {
+        $$$1(element).trigger(TRANSITION_END);
+      },
+      // TODO: Remove in v5
+      supportsTransitionEnd: function supportsTransitionEnd() {
+        return Boolean(TRANSITION_END);
+      },
+      isElement: function isElement(obj) {
+        return (obj[0] || obj).nodeType;
+      },
+      typeCheckConfig: function typeCheckConfig(componentName, config, configTypes) {
+        for (var property in configTypes) {
+          if (Object.prototype.hasOwnProperty.call(configTypes, property)) {
+            var expectedTypes = configTypes[property];
+            var value = config[property];
+            var valueType = value && Util.isElement(value) ? 'element' : toType(value);
+
+            if (!new RegExp(expectedTypes).test(valueType)) {
+              throw new Error(componentName.toUpperCase() + ": " + ("Option \"" + property + "\" provided type \"" + valueType + "\" ") + ("but expected type \"" + expectedTypes + "\"."));
+            }
+          }
+        }
+      }
+    };
+    setTransitionEndSupport();
+    return Util;
+  }($);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): alert.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Alert = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'alert';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.alert';
+    var EVENT_KEY = "." + DATA_KEY;
+    var DATA_API_KEY = '.data-api';
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var Selector = {
+      DISMISS: '[data-dismiss="alert"]'
+    };
+    var Event = {
+      CLOSE: "close" + EVENT_KEY,
+      CLOSED: "closed" + EVENT_KEY,
+      CLICK_DATA_API: "click" + EVENT_KEY + DATA_API_KEY
+    };
+    var ClassName = {
+      ALERT: 'alert',
+      FADE: 'fade',
+      SHOW: 'show'
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var Alert =
+    /*#__PURE__*/
+    function () {
+      function Alert(element) {
+        this._element = element;
+      } // Getters
+
+
+      var _proto = Alert.prototype;
+
+      // Public
+      _proto.close = function close(element) {
+        var rootElement = this._element;
+
+        if (element) {
+          rootElement = this._getRootElement(element);
+        }
+
+        var customEvent = this._triggerCloseEvent(rootElement);
+
+        if (customEvent.isDefaultPrevented()) {
+          return;
+        }
+
+        this._removeElement(rootElement);
+      };
+
+      _proto.dispose = function dispose() {
+        $$$1.removeData(this._element, DATA_KEY);
+        this._element = null;
+      }; // Private
+
+
+      _proto._getRootElement = function _getRootElement(element) {
+        var selector = Util.getSelectorFromElement(element);
+        var parent = false;
+
+        if (selector) {
+          parent = document.querySelector(selector);
+        }
+
+        if (!parent) {
+          parent = $$$1(element).closest("." + ClassName.ALERT)[0];
+        }
+
+        return parent;
+      };
+
+      _proto._triggerCloseEvent = function _triggerCloseEvent(element) {
+        var closeEvent = $$$1.Event(Event.CLOSE);
+        $$$1(element).trigger(closeEvent);
+        return closeEvent;
+      };
+
+      _proto._removeElement = function _removeElement(element) {
+        var _this = this;
+
+        $$$1(element).removeClass(ClassName.SHOW);
+
+        if (!$$$1(element).hasClass(ClassName.FADE)) {
+          this._destroyElement(element);
+
+          return;
+        }
+
+        var transitionDuration = Util.getTransitionDurationFromElement(element);
+        $$$1(element).one(Util.TRANSITION_END, function (event) {
+          return _this._destroyElement(element, event);
+        }).emulateTransitionEnd(transitionDuration);
+      };
+
+      _proto._destroyElement = function _destroyElement(element) {
+        $$$1(element).detach().trigger(Event.CLOSED).remove();
+      }; // Static
+
+
+      Alert._jQueryInterface = function _jQueryInterface(config) {
+        return this.each(function () {
+          var $element = $$$1(this);
+          var data = $element.data(DATA_KEY);
+
+          if (!data) {
+            data = new Alert(this);
+            $element.data(DATA_KEY, data);
+          }
+
+          if (config === 'close') {
+            data[config](this);
+          }
+        });
+      };
+
+      Alert._handleDismiss = function _handleDismiss(alertInstance) {
+        return function (event) {
+          if (event) {
+            event.preventDefault();
+          }
+
+          alertInstance.close(this);
+        };
+      };
+
+      _createClass(Alert, null, [{
+        key: "VERSION",
+        get: function get() {
+          return VERSION;
+        }
+      }]);
+
+      return Alert;
+    }();
+    /**
+     * ------------------------------------------------------------------------
+     * Data Api implementation
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1(document).on(Event.CLICK_DATA_API, Selector.DISMISS, Alert._handleDismiss(new Alert()));
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+    $$$1.fn[NAME] = Alert._jQueryInterface;
+    $$$1.fn[NAME].Constructor = Alert;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return Alert._jQueryInterface;
+    };
+
+    return Alert;
+  }($);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): button.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Button = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'button';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.button';
+    var EVENT_KEY = "." + DATA_KEY;
+    var DATA_API_KEY = '.data-api';
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var ClassName = {
+      ACTIVE: 'active',
+      BUTTON: 'btn',
+      FOCUS: 'focus'
+    };
+    var Selector = {
+      DATA_TOGGLE_CARROT: '[data-toggle^="button"]',
+      DATA_TOGGLE: '[data-toggle="buttons"]',
+      INPUT: 'input',
+      ACTIVE: '.active',
+      BUTTON: '.btn'
+    };
+    var Event = {
+      CLICK_DATA_API: "click" + EVENT_KEY + DATA_API_KEY,
+      FOCUS_BLUR_DATA_API: "focus" + EVENT_KEY + DATA_API_KEY + " " + ("blur" + EVENT_KEY + DATA_API_KEY)
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var Button =
+    /*#__PURE__*/
+    function () {
+      function Button(element) {
+        this._element = element;
+      } // Getters
+
+
+      var _proto = Button.prototype;
+
+      // Public
+      _proto.toggle = function toggle() {
+        var triggerChangeEvent = true;
+        var addAriaPressed = true;
+        var rootElement = $$$1(this._element).closest(Selector.DATA_TOGGLE)[0];
+
+        if (rootElement) {
+          var input = this._element.querySelector(Selector.INPUT);
+
+          if (input) {
+            if (input.type === 'radio') {
+              if (input.checked && this._element.classList.contains(ClassName.ACTIVE)) {
+                triggerChangeEvent = false;
+              } else {
+                var activeElement = rootElement.querySelector(Selector.ACTIVE);
+
+                if (activeElement) {
+                  $$$1(activeElement).removeClass(ClassName.ACTIVE);
+                }
+              }
+            }
+
+            if (triggerChangeEvent) {
+              if (input.hasAttribute('disabled') || rootElement.hasAttribute('disabled') || input.classList.contains('disabled') || rootElement.classList.contains('disabled')) {
+                return;
+              }
+
+              input.checked = !this._element.classList.contains(ClassName.ACTIVE);
+              $$$1(input).trigger('change');
+            }
+
+            input.focus();
+            addAriaPressed = false;
+          }
+        }
+
+        if (addAriaPressed) {
+          this._element.setAttribute('aria-pressed', !this._element.classList.contains(ClassName.ACTIVE));
+        }
+
+        if (triggerChangeEvent) {
+          $$$1(this._element).toggleClass(ClassName.ACTIVE);
+        }
+      };
+
+      _proto.dispose = function dispose() {
+        $$$1.removeData(this._element, DATA_KEY);
+        this._element = null;
+      }; // Static
+
+
+      Button._jQueryInterface = function _jQueryInterface(config) {
+        return this.each(function () {
+          var data = $$$1(this).data(DATA_KEY);
+
+          if (!data) {
+            data = new Button(this);
+            $$$1(this).data(DATA_KEY, data);
+          }
+
+          if (config === 'toggle') {
+            data[config]();
+          }
+        });
+      };
+
+      _createClass(Button, null, [{
+        key: "VERSION",
+        get: function get() {
+          return VERSION;
+        }
+      }]);
+
+      return Button;
+    }();
+    /**
+     * ------------------------------------------------------------------------
+     * Data Api implementation
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1(document).on(Event.CLICK_DATA_API, Selector.DATA_TOGGLE_CARROT, function (event) {
+      event.preventDefault();
+      var button = event.target;
+
+      if (!$$$1(button).hasClass(ClassName.BUTTON)) {
+        button = $$$1(button).closest(Selector.BUTTON);
+      }
+
+      Button._jQueryInterface.call($$$1(button), 'toggle');
+    }).on(Event.FOCUS_BLUR_DATA_API, Selector.DATA_TOGGLE_CARROT, function (event) {
+      var button = $$$1(event.target).closest(Selector.BUTTON)[0];
+      $$$1(button).toggleClass(ClassName.FOCUS, /^focus(in)?$/.test(event.type));
+    });
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+    $$$1.fn[NAME] = Button._jQueryInterface;
+    $$$1.fn[NAME].Constructor = Button;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return Button._jQueryInterface;
+    };
+
+    return Button;
+  }($);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): carousel.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Carousel = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'carousel';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.carousel';
+    var EVENT_KEY = "." + DATA_KEY;
+    var DATA_API_KEY = '.data-api';
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var ARROW_LEFT_KEYCODE = 37; // KeyboardEvent.which value for left arrow key
+
+    var ARROW_RIGHT_KEYCODE = 39; // KeyboardEvent.which value for right arrow key
+
+    var TOUCHEVENT_COMPAT_WAIT = 500; // Time for mouse compat events to fire after touch
+
+    var Default = {
+      interval: 5000,
+      keyboard: true,
+      slide: false,
+      pause: 'hover',
+      wrap: true
+    };
+    var DefaultType = {
+      interval: '(number|boolean)',
+      keyboard: 'boolean',
+      slide: '(boolean|string)',
+      pause: '(string|boolean)',
+      wrap: 'boolean'
+    };
+    var Direction = {
+      NEXT: 'next',
+      PREV: 'prev',
+      LEFT: 'left',
+      RIGHT: 'right'
+    };
+    var Event = {
+      SLIDE: "slide" + EVENT_KEY,
+      SLID: "slid" + EVENT_KEY,
+      KEYDOWN: "keydown" + EVENT_KEY,
+      MOUSEENTER: "mouseenter" + EVENT_KEY,
+      MOUSELEAVE: "mouseleave" + EVENT_KEY,
+      TOUCHEND: "touchend" + EVENT_KEY,
+      LOAD_DATA_API: "load" + EVENT_KEY + DATA_API_KEY,
+      CLICK_DATA_API: "click" + EVENT_KEY + DATA_API_KEY
+    };
+    var ClassName = {
+      CAROUSEL: 'carousel',
+      ACTIVE: 'active',
+      SLIDE: 'slide',
+      RIGHT: 'carousel-item-right',
+      LEFT: 'carousel-item-left',
+      NEXT: 'carousel-item-next',
+      PREV: 'carousel-item-prev',
+      ITEM: 'carousel-item'
+    };
+    var Selector = {
+      ACTIVE: '.active',
+      ACTIVE_ITEM: '.active.carousel-item',
+      ITEM: '.carousel-item',
+      NEXT_PREV: '.carousel-item-next, .carousel-item-prev',
+      INDICATORS: '.carousel-indicators',
+      DATA_SLIDE: '[data-slide], [data-slide-to]',
+      DATA_RIDE: '[data-ride="carousel"]'
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var Carousel =
+    /*#__PURE__*/
+    function () {
+      function Carousel(element, config) {
+        this._items = null;
+        this._interval = null;
+        this._activeElement = null;
+        this._isPaused = false;
+        this._isSliding = false;
+        this.touchTimeout = null;
+        this._config = this._getConfig(config);
+        this._element = $$$1(element)[0];
+        this._indicatorsElement = this._element.querySelector(Selector.INDICATORS);
+
+        this._addEventListeners();
+      } // Getters
+
+
+      var _proto = Carousel.prototype;
+
+      // Public
+      _proto.next = function next() {
+        if (!this._isSliding) {
+          this._slide(Direction.NEXT);
+        }
+      };
+
+      _proto.nextWhenVisible = function nextWhenVisible() {
+        // Don't call next when the page isn't visible
+        // or the carousel or its parent isn't visible
+        if (!document.hidden && $$$1(this._element).is(':visible') && $$$1(this._element).css('visibility') !== 'hidden') {
+          this.next();
+        }
+      };
+
+      _proto.prev = function prev() {
+        if (!this._isSliding) {
+          this._slide(Direction.PREV);
+        }
+      };
+
+      _proto.pause = function pause(event) {
+        if (!event) {
+          this._isPaused = true;
+        }
+
+        if (this._element.querySelector(Selector.NEXT_PREV)) {
+          Util.triggerTransitionEnd(this._element);
+          this.cycle(true);
+        }
+
+        clearInterval(this._interval);
+        this._interval = null;
+      };
+
+      _proto.cycle = function cycle(event) {
+        if (!event) {
+          this._isPaused = false;
+        }
+
+        if (this._interval) {
+          clearInterval(this._interval);
+          this._interval = null;
+        }
+
+        if (this._config.interval && !this._isPaused) {
+          this._interval = setInterval((document.visibilityState ? this.nextWhenVisible : this.next).bind(this), this._config.interval);
+        }
+      };
+
+      _proto.to = function to(index) {
+        var _this = this;
+
+        this._activeElement = this._element.querySelector(Selector.ACTIVE_ITEM);
+
+        var activeIndex = this._getItemIndex(this._activeElement);
+
+        if (index > this._items.length - 1 || index < 0) {
+          return;
+        }
+
+        if (this._isSliding) {
+          $$$1(this._element).one(Event.SLID, function () {
+            return _this.to(index);
+          });
+          return;
+        }
+
+        if (activeIndex === index) {
+          this.pause();
+          this.cycle();
+          return;
+        }
+
+        var direction = index > activeIndex ? Direction.NEXT : Direction.PREV;
+
+        this._slide(direction, this._items[index]);
+      };
+
+      _proto.dispose = function dispose() {
+        $$$1(this._element).off(EVENT_KEY);
+        $$$1.removeData(this._element, DATA_KEY);
+        this._items = null;
+        this._config = null;
+        this._element = null;
+        this._interval = null;
+        this._isPaused = null;
+        this._isSliding = null;
+        this._activeElement = null;
+        this._indicatorsElement = null;
+      }; // Private
+
+
+      _proto._getConfig = function _getConfig(config) {
+        config = _objectSpread({}, Default, config);
+        Util.typeCheckConfig(NAME, config, DefaultType);
+        return config;
+      };
+
+      _proto._addEventListeners = function _addEventListeners() {
+        var _this2 = this;
+
+        if (this._config.keyboard) {
+          $$$1(this._element).on(Event.KEYDOWN, function (event) {
+            return _this2._keydown(event);
+          });
+        }
+
+        if (this._config.pause === 'hover') {
+          $$$1(this._element).on(Event.MOUSEENTER, function (event) {
+            return _this2.pause(event);
+          }).on(Event.MOUSELEAVE, function (event) {
+            return _this2.cycle(event);
+          });
+
+          if ('ontouchstart' in document.documentElement) {
+            // If it's a touch-enabled device, mouseenter/leave are fired as
+            // part of the mouse compatibility events on first tap - the carousel
+            // would stop cycling until user tapped out of it;
+            // here, we listen for touchend, explicitly pause the carousel
+            // (as if it's the second time we tap on it, mouseenter compat event
+            // is NOT fired) and after a timeout (to allow for mouse compatibility
+            // events to fire) we explicitly restart cycling
+            $$$1(this._element).on(Event.TOUCHEND, function () {
+              _this2.pause();
+
+              if (_this2.touchTimeout) {
+                clearTimeout(_this2.touchTimeout);
+              }
+
+              _this2.touchTimeout = setTimeout(function (event) {
+                return _this2.cycle(event);
+              }, TOUCHEVENT_COMPAT_WAIT + _this2._config.interval);
+            });
+          }
+        }
+      };
+
+      _proto._keydown = function _keydown(event) {
+        if (/input|textarea/i.test(event.target.tagName)) {
+          return;
+        }
+
+        switch (event.which) {
+          case ARROW_LEFT_KEYCODE:
+            event.preventDefault();
+            this.prev();
+            break;
+
+          case ARROW_RIGHT_KEYCODE:
+            event.preventDefault();
+            this.next();
+            break;
+
+          default:
+        }
+      };
+
+      _proto._getItemIndex = function _getItemIndex(element) {
+        this._items = element && element.parentNode ? [].slice.call(element.parentNode.querySelectorAll(Selector.ITEM)) : [];
+        return this._items.indexOf(element);
+      };
+
+      _proto._getItemByDirection = function _getItemByDirection(direction, activeElement) {
+        var isNextDirection = direction === Direction.NEXT;
+        var isPrevDirection = direction === Direction.PREV;
+
+        var activeIndex = this._getItemIndex(activeElement);
+
+        var lastItemIndex = this._items.length - 1;
+        var isGoingToWrap = isPrevDirection && activeIndex === 0 || isNextDirection && activeIndex === lastItemIndex;
+
+        if (isGoingToWrap && !this._config.wrap) {
+          return activeElement;
+        }
+
+        var delta = direction === Direction.PREV ? -1 : 1;
+        var itemIndex = (activeIndex + delta) % this._items.length;
+        return itemIndex === -1 ? this._items[this._items.length - 1] : this._items[itemIndex];
+      };
+
+      _proto._triggerSlideEvent = function _triggerSlideEvent(relatedTarget, eventDirectionName) {
+        var targetIndex = this._getItemIndex(relatedTarget);
+
+        var fromIndex = this._getItemIndex(this._element.querySelector(Selector.ACTIVE_ITEM));
+
+        var slideEvent = $$$1.Event(Event.SLIDE, {
+          relatedTarget: relatedTarget,
+          direction: eventDirectionName,
+          from: fromIndex,
+          to: targetIndex
+        });
+        $$$1(this._element).trigger(slideEvent);
+        return slideEvent;
+      };
+
+      _proto._setActiveIndicatorElement = function _setActiveIndicatorElement(element) {
+        if (this._indicatorsElement) {
+          var indicators = [].slice.call(this._indicatorsElement.querySelectorAll(Selector.ACTIVE));
+          $$$1(indicators).removeClass(ClassName.ACTIVE);
+
+          var nextIndicator = this._indicatorsElement.children[this._getItemIndex(element)];
+
+          if (nextIndicator) {
+            $$$1(nextIndicator).addClass(ClassName.ACTIVE);
+          }
+        }
+      };
+
+      _proto._slide = function _slide(direction, element) {
+        var _this3 = this;
+
+        var activeElement = this._element.querySelector(Selector.ACTIVE_ITEM);
+
+        var activeElementIndex = this._getItemIndex(activeElement);
+
+        var nextElement = element || activeElement && this._getItemByDirection(direction, activeElement);
+
+        var nextElementIndex = this._getItemIndex(nextElement);
+
+        var isCycling = Boolean(this._interval);
+        var directionalClassName;
+        var orderClassName;
+        var eventDirectionName;
+
+        if (direction === Direction.NEXT) {
+          directionalClassName = ClassName.LEFT;
+          orderClassName = ClassName.NEXT;
+          eventDirectionName = Direction.LEFT;
+        } else {
+          directionalClassName = ClassName.RIGHT;
+          orderClassName = ClassName.PREV;
+          eventDirectionName = Direction.RIGHT;
+        }
+
+        if (nextElement && $$$1(nextElement).hasClass(ClassName.ACTIVE)) {
+          this._isSliding = false;
+          return;
+        }
+
+        var slideEvent = this._triggerSlideEvent(nextElement, eventDirectionName);
+
+        if (slideEvent.isDefaultPrevented()) {
+          return;
+        }
+
+        if (!activeElement || !nextElement) {
+          // Some weirdness is happening, so we bail
+          return;
+        }
+
+        this._isSliding = true;
+
+        if (isCycling) {
+          this.pause();
+        }
+
+        this._setActiveIndicatorElement(nextElement);
+
+        var slidEvent = $$$1.Event(Event.SLID, {
+          relatedTarget: nextElement,
+          direction: eventDirectionName,
+          from: activeElementIndex,
+          to: nextElementIndex
+        });
+
+        if ($$$1(this._element).hasClass(ClassName.SLIDE)) {
+          $$$1(nextElement).addClass(orderClassName);
+          Util.reflow(nextElement);
+          $$$1(activeElement).addClass(directionalClassName);
+          $$$1(nextElement).addClass(directionalClassName);
+          var transitionDuration = Util.getTransitionDurationFromElement(activeElement);
+          $$$1(activeElement).one(Util.TRANSITION_END, function () {
+            $$$1(nextElement).removeClass(directionalClassName + " " + orderClassName).addClass(ClassName.ACTIVE);
+            $$$1(activeElement).removeClass(ClassName.ACTIVE + " " + orderClassName + " " + directionalClassName);
+            _this3._isSliding = false;
+            setTimeout(function () {
+              return $$$1(_this3._element).trigger(slidEvent);
+            }, 0);
+          }).emulateTransitionEnd(transitionDuration);
+        } else {
+          $$$1(activeElement).removeClass(ClassName.ACTIVE);
+          $$$1(nextElement).addClass(ClassName.ACTIVE);
+          this._isSliding = false;
+          $$$1(this._element).trigger(slidEvent);
+        }
+
+        if (isCycling) {
+          this.cycle();
+        }
+      }; // Static
+
+
+      Carousel._jQueryInterface = function _jQueryInterface(config) {
+        return this.each(function () {
+          var data = $$$1(this).data(DATA_KEY);
+
+          var _config = _objectSpread({}, Default, $$$1(this).data());
+
+          if (typeof config === 'object') {
+            _config = _objectSpread({}, _config, config);
+          }
+
+          var action = typeof config === 'string' ? config : _config.slide;
+
+          if (!data) {
+            data = new Carousel(this, _config);
+            $$$1(this).data(DATA_KEY, data);
+          }
+
+          if (typeof config === 'number') {
+            data.to(config);
+          } else if (typeof action === 'string') {
+            if (typeof data[action] === 'undefined') {
+              throw new TypeError("No method named \"" + action + "\"");
+            }
+
+            data[action]();
+          } else if (_config.interval) {
+            data.pause();
+            data.cycle();
+          }
+        });
+      };
+
+      Carousel._dataApiClickHandler = function _dataApiClickHandler(event) {
+        var selector = Util.getSelectorFromElement(this);
+
+        if (!selector) {
+          return;
+        }
+
+        var target = $$$1(selector)[0];
+
+        if (!target || !$$$1(target).hasClass(ClassName.CAROUSEL)) {
+          return;
+        }
+
+        var config = _objectSpread({}, $$$1(target).data(), $$$1(this).data());
+
+        var slideIndex = this.getAttribute('data-slide-to');
+
+        if (slideIndex) {
+          config.interval = false;
+        }
+
+        Carousel._jQueryInterface.call($$$1(target), config);
+
+        if (slideIndex) {
+          $$$1(target).data(DATA_KEY).to(slideIndex);
+        }
+
+        event.preventDefault();
+      };
+
+      _createClass(Carousel, null, [{
+        key: "VERSION",
+        get: function get() {
+          return VERSION;
+        }
+      }, {
+        key: "Default",
+        get: function get() {
+          return Default;
+        }
+      }]);
+
+      return Carousel;
+    }();
+    /**
+     * ------------------------------------------------------------------------
+     * Data Api implementation
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1(document).on(Event.CLICK_DATA_API, Selector.DATA_SLIDE, Carousel._dataApiClickHandler);
+    $$$1(window).on(Event.LOAD_DATA_API, function () {
+      var carousels = [].slice.call(document.querySelectorAll(Selector.DATA_RIDE));
+
+      for (var i = 0, len = carousels.length; i < len; i++) {
+        var $carousel = $$$1(carousels[i]);
+
+        Carousel._jQueryInterface.call($carousel, $carousel.data());
+      }
+    });
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+    $$$1.fn[NAME] = Carousel._jQueryInterface;
+    $$$1.fn[NAME].Constructor = Carousel;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return Carousel._jQueryInterface;
+    };
+
+    return Carousel;
+  }($);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): collapse.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Collapse = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'collapse';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.collapse';
+    var EVENT_KEY = "." + DATA_KEY;
+    var DATA_API_KEY = '.data-api';
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var Default = {
+      toggle: true,
+      parent: ''
+    };
+    var DefaultType = {
+      toggle: 'boolean',
+      parent: '(string|element)'
+    };
+    var Event = {
+      SHOW: "show" + EVENT_KEY,
+      SHOWN: "shown" + EVENT_KEY,
+      HIDE: "hide" + EVENT_KEY,
+      HIDDEN: "hidden" + EVENT_KEY,
+      CLICK_DATA_API: "click" + EVENT_KEY + DATA_API_KEY
+    };
+    var ClassName = {
+      SHOW: 'show',
+      COLLAPSE: 'collapse',
+      COLLAPSING: 'collapsing',
+      COLLAPSED: 'collapsed'
+    };
+    var Dimension = {
+      WIDTH: 'width',
+      HEIGHT: 'height'
+    };
+    var Selector = {
+      ACTIVES: '.show, .collapsing',
+      DATA_TOGGLE: '[data-toggle="collapse"]'
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var Collapse =
+    /*#__PURE__*/
+    function () {
+      function Collapse(element, config) {
+        this._isTransitioning = false;
+        this._element = element;
+        this._config = this._getConfig(config);
+        this._triggerArray = $$$1.makeArray(document.querySelectorAll("[data-toggle=\"collapse\"][href=\"#" + element.id + "\"]," + ("[data-toggle=\"collapse\"][data-target=\"#" + element.id + "\"]")));
+        var toggleList = [].slice.call(document.querySelectorAll(Selector.DATA_TOGGLE));
+
+        for (var i = 0, len = toggleList.length; i < len; i++) {
+          var elem = toggleList[i];
+          var selector = Util.getSelectorFromElement(elem);
+          var filterElement = [].slice.call(document.querySelectorAll(selector)).filter(function (foundElem) {
+            return foundElem === element;
+          });
+
+          if (selector !== null && filterElement.length > 0) {
+            this._selector = selector;
+
+            this._triggerArray.push(elem);
+          }
+        }
+
+        this._parent = this._config.parent ? this._getParent() : null;
+
+        if (!this._config.parent) {
+          this._addAriaAndCollapsedClass(this._element, this._triggerArray);
+        }
+
+        if (this._config.toggle) {
+          this.toggle();
+        }
+      } // Getters
+
+
+      var _proto = Collapse.prototype;
+
+      // Public
+      _proto.toggle = function toggle() {
+        if ($$$1(this._element).hasClass(ClassName.SHOW)) {
+          this.hide();
+        } else {
+          this.show();
+        }
+      };
+
+      _proto.show = function show() {
+        var _this = this;
+
+        if (this._isTransitioning || $$$1(this._element).hasClass(ClassName.SHOW)) {
+          return;
+        }
+
+        var actives;
+        var activesData;
+
+        if (this._parent) {
+          actives = [].slice.call(this._parent.querySelectorAll(Selector.ACTIVES)).filter(function (elem) {
+            return elem.getAttribute('data-parent') === _this._config.parent;
+          });
+
+          if (actives.length === 0) {
+            actives = null;
+          }
+        }
+
+        if (actives) {
+          activesData = $$$1(actives).not(this._selector).data(DATA_KEY);
+
+          if (activesData && activesData._isTransitioning) {
+            return;
+          }
+        }
+
+        var startEvent = $$$1.Event(Event.SHOW);
+        $$$1(this._element).trigger(startEvent);
+
+        if (startEvent.isDefaultPrevented()) {
+          return;
+        }
+
+        if (actives) {
+          Collapse._jQueryInterface.call($$$1(actives).not(this._selector), 'hide');
+
+          if (!activesData) {
+            $$$1(actives).data(DATA_KEY, null);
+          }
+        }
+
+        var dimension = this._getDimension();
+
+        $$$1(this._element).removeClass(ClassName.COLLAPSE).addClass(ClassName.COLLAPSING);
+        this._element.style[dimension] = 0;
+
+        if (this._triggerArray.length) {
+          $$$1(this._triggerArray).removeClass(ClassName.COLLAPSED).attr('aria-expanded', true);
+        }
+
+        this.setTransitioning(true);
+
+        var complete = function complete() {
+          $$$1(_this._element).removeClass(ClassName.COLLAPSING).addClass(ClassName.COLLAPSE).addClass(ClassName.SHOW);
+          _this._element.style[dimension] = '';
+
+          _this.setTransitioning(false);
+
+          $$$1(_this._element).trigger(Event.SHOWN);
+        };
+
+        var capitalizedDimension = dimension[0].toUpperCase() + dimension.slice(1);
+        var scrollSize = "scroll" + capitalizedDimension;
+        var transitionDuration = Util.getTransitionDurationFromElement(this._element);
+        $$$1(this._element).one(Util.TRANSITION_END, complete).emulateTransitionEnd(transitionDuration);
+        this._element.style[dimension] = this._element[scrollSize] + "px";
+      };
+
+      _proto.hide = function hide() {
+        var _this2 = this;
+
+        if (this._isTransitioning || !$$$1(this._element).hasClass(ClassName.SHOW)) {
+          return;
+        }
+
+        var startEvent = $$$1.Event(Event.HIDE);
+        $$$1(this._element).trigger(startEvent);
+
+        if (startEvent.isDefaultPrevented()) {
+          return;
+        }
+
+        var dimension = this._getDimension();
+
+        this._element.style[dimension] = this._element.getBoundingClientRect()[dimension] + "px";
+        Util.reflow(this._element);
+        $$$1(this._element).addClass(ClassName.COLLAPSING).removeClass(ClassName.COLLAPSE).removeClass(ClassName.SHOW);
+        var triggerArrayLength = this._triggerArray.length;
+
+        if (triggerArrayLength > 0) {
+          for (var i = 0; i < triggerArrayLength; i++) {
+            var trigger = this._triggerArray[i];
+            var selector = Util.getSelectorFromElement(trigger);
+
+            if (selector !== null) {
+              var $elem = $$$1([].slice.call(document.querySelectorAll(selector)));
+
+              if (!$elem.hasClass(ClassName.SHOW)) {
+                $$$1(trigger).addClass(ClassName.COLLAPSED).attr('aria-expanded', false);
+              }
+            }
+          }
+        }
+
+        this.setTransitioning(true);
+
+        var complete = function complete() {
+          _this2.setTransitioning(false);
+
+          $$$1(_this2._element).removeClass(ClassName.COLLAPSING).addClass(ClassName.COLLAPSE).trigger(Event.HIDDEN);
+        };
+
+        this._element.style[dimension] = '';
+        var transitionDuration = Util.getTransitionDurationFromElement(this._element);
+        $$$1(this._element).one(Util.TRANSITION_END, complete).emulateTransitionEnd(transitionDuration);
+      };
+
+      _proto.setTransitioning = function setTransitioning(isTransitioning) {
+        this._isTransitioning = isTransitioning;
+      };
+
+      _proto.dispose = function dispose() {
+        $$$1.removeData(this._element, DATA_KEY);
+        this._config = null;
+        this._parent = null;
+        this._element = null;
+        this._triggerArray = null;
+        this._isTransitioning = null;
+      }; // Private
+
+
+      _proto._getConfig = function _getConfig(config) {
+        config = _objectSpread({}, Default, config);
+        config.toggle = Boolean(config.toggle); // Coerce string values
+
+        Util.typeCheckConfig(NAME, config, DefaultType);
+        return config;
+      };
+
+      _proto._getDimension = function _getDimension() {
+        var hasWidth = $$$1(this._element).hasClass(Dimension.WIDTH);
+        return hasWidth ? Dimension.WIDTH : Dimension.HEIGHT;
+      };
+
+      _proto._getParent = function _getParent() {
+        var _this3 = this;
+
+        var parent = null;
+
+        if (Util.isElement(this._config.parent)) {
+          parent = this._config.parent; // It's a jQuery object
+
+          if (typeof this._config.parent.jquery !== 'undefined') {
+            parent = this._config.parent[0];
+          }
+        } else {
+          parent = document.querySelector(this._config.parent);
+        }
+
+        var selector = "[data-toggle=\"collapse\"][data-parent=\"" + this._config.parent + "\"]";
+        var children = [].slice.call(parent.querySelectorAll(selector));
+        $$$1(children).each(function (i, element) {
+          _this3._addAriaAndCollapsedClass(Collapse._getTargetFromElement(element), [element]);
+        });
+        return parent;
+      };
+
+      _proto._addAriaAndCollapsedClass = function _addAriaAndCollapsedClass(element, triggerArray) {
+        if (element) {
+          var isOpen = $$$1(element).hasClass(ClassName.SHOW);
+
+          if (triggerArray.length) {
+            $$$1(triggerArray).toggleClass(ClassName.COLLAPSED, !isOpen).attr('aria-expanded', isOpen);
+          }
+        }
+      }; // Static
+
+
+      Collapse._getTargetFromElement = function _getTargetFromElement(element) {
+        var selector = Util.getSelectorFromElement(element);
+        return selector ? document.querySelector(selector) : null;
+      };
+
+      Collapse._jQueryInterface = function _jQueryInterface(config) {
+        return this.each(function () {
+          var $this = $$$1(this);
+          var data = $this.data(DATA_KEY);
+
+          var _config = _objectSpread({}, Default, $this.data(), typeof config === 'object' && config ? config : {});
+
+          if (!data && _config.toggle && /show|hide/.test(config)) {
+            _config.toggle = false;
+          }
+
+          if (!data) {
+            data = new Collapse(this, _config);
+            $this.data(DATA_KEY, data);
+          }
+
+          if (typeof config === 'string') {
+            if (typeof data[config] === 'undefined') {
+              throw new TypeError("No method named \"" + config + "\"");
+            }
+
+            data[config]();
+          }
+        });
+      };
+
+      _createClass(Collapse, null, [{
+        key: "VERSION",
+        get: function get() {
+          return VERSION;
+        }
+      }, {
+        key: "Default",
+        get: function get() {
+          return Default;
+        }
+      }]);
+
+      return Collapse;
+    }();
+    /**
+     * ------------------------------------------------------------------------
+     * Data Api implementation
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1(document).on(Event.CLICK_DATA_API, Selector.DATA_TOGGLE, function (event) {
+      // preventDefault only for <a> elements (which change the URL) not inside the collapsible element
+      if (event.currentTarget.tagName === 'A') {
+        event.preventDefault();
+      }
+
+      var $trigger = $$$1(this);
+      var selector = Util.getSelectorFromElement(this);
+      var selectors = [].slice.call(document.querySelectorAll(selector));
+      $$$1(selectors).each(function () {
+        var $target = $$$1(this);
+        var data = $target.data(DATA_KEY);
+        var config = data ? 'toggle' : $trigger.data();
+
+        Collapse._jQueryInterface.call($target, config);
+      });
+    });
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+    $$$1.fn[NAME] = Collapse._jQueryInterface;
+    $$$1.fn[NAME].Constructor = Collapse;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return Collapse._jQueryInterface;
+    };
+
+    return Collapse;
+  }($);
+
+  /**!
+   * @fileOverview Kickass library to create and place poppers near their reference elements.
+   * @version 1.14.3
+   * @license
+   * Copyright (c) 2016 Federico Zivolo and contributors
+   *
+   * Permission is hereby granted, free of charge, to any person obtaining a copy
+   * of this software and associated documentation files (the "Software"), to deal
+   * in the Software without restriction, including without limitation the rights
+   * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+   * copies of the Software, and to permit persons to whom the Software is
+   * furnished to do so, subject to the following conditions:
+   *
+   * The above copyright notice and this permission notice shall be included in all
+   * copies or substantial portions of the Software.
+   *
+   * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+   * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+   * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+   * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+   * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+   * SOFTWARE.
+   */
+  var isBrowser = typeof window !== 'undefined' && typeof document !== 'undefined';
+
+  var longerTimeoutBrowsers = ['Edge', 'Trident', 'Firefox'];
+  var timeoutDuration = 0;
+  for (var i = 0; i < longerTimeoutBrowsers.length; i += 1) {
+    if (isBrowser && navigator.userAgent.indexOf(longerTimeoutBrowsers[i]) >= 0) {
+      timeoutDuration = 1;
+      break;
+    }
+  }
+
+  function microtaskDebounce(fn) {
+    var called = false;
+    return function () {
+      if (called) {
+        return;
+      }
+      called = true;
+      window.Promise.resolve().then(function () {
+        called = false;
+        fn();
+      });
+    };
+  }
+
+  function taskDebounce(fn) {
+    var scheduled = false;
+    return function () {
+      if (!scheduled) {
+        scheduled = true;
+        setTimeout(function () {
+          scheduled = false;
+          fn();
+        }, timeoutDuration);
+      }
+    };
+  }
+
+  var supportsMicroTasks = isBrowser && window.Promise;
+
+  /**
+  * Create a debounced version of a method, that's asynchronously deferred
+  * but called in the minimum time possible.
+  *
+  * @method
+  * @memberof Popper.Utils
+  * @argument {Function} fn
+  * @returns {Function}
+  */
+  var debounce = supportsMicroTasks ? microtaskDebounce : taskDebounce;
+
+  /**
+   * Check if the given variable is a function
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Any} functionToCheck - variable to check
+   * @returns {Boolean} answer to: is a function?
+   */
+  function isFunction(functionToCheck) {
+    var getType = {};
+    return functionToCheck && getType.toString.call(functionToCheck) === '[object Function]';
+  }
+
+  /**
+   * Get CSS computed property of the given element
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Eement} element
+   * @argument {String} property
+   */
+  function getStyleComputedProperty(element, property) {
+    if (element.nodeType !== 1) {
+      return [];
+    }
+    // NOTE: 1 DOM access here
+    var css = getComputedStyle(element, null);
+    return property ? css[property] : css;
+  }
+
+  /**
+   * Returns the parentNode or the host of the element
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element
+   * @returns {Element} parent
+   */
+  function getParentNode(element) {
+    if (element.nodeName === 'HTML') {
+      return element;
+    }
+    return element.parentNode || element.host;
+  }
+
+  /**
+   * Returns the scrolling parent of the given element
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element
+   * @returns {Element} scroll parent
+   */
+  function getScrollParent(element) {
+    // Return body, `getScroll` will take care to get the correct `scrollTop` from it
+    if (!element) {
+      return document.body;
+    }
+
+    switch (element.nodeName) {
+      case 'HTML':
+      case 'BODY':
+        return element.ownerDocument.body;
+      case '#document':
+        return element.body;
+    }
+
+    // Firefox want us to check `-x` and `-y` variations as well
+
+    var _getStyleComputedProp = getStyleComputedProperty(element),
+        overflow = _getStyleComputedProp.overflow,
+        overflowX = _getStyleComputedProp.overflowX,
+        overflowY = _getStyleComputedProp.overflowY;
+
+    if (/(auto|scroll|overlay)/.test(overflow + overflowY + overflowX)) {
+      return element;
+    }
+
+    return getScrollParent(getParentNode(element));
+  }
+
+  var isIE11 = isBrowser && !!(window.MSInputMethodContext && document.documentMode);
+  var isIE10 = isBrowser && /MSIE 10/.test(navigator.userAgent);
+
+  /**
+   * Determines if the browser is Internet Explorer
+   * @method
+   * @memberof Popper.Utils
+   * @param {Number} version to check
+   * @returns {Boolean} isIE
+   */
+  function isIE(version) {
+    if (version === 11) {
+      return isIE11;
+    }
+    if (version === 10) {
+      return isIE10;
+    }
+    return isIE11 || isIE10;
+  }
+
+  /**
+   * Returns the offset parent of the given element
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element
+   * @returns {Element} offset parent
+   */
+  function getOffsetParent(element) {
+    if (!element) {
+      return document.documentElement;
+    }
+
+    var noOffsetParent = isIE(10) ? document.body : null;
+
+    // NOTE: 1 DOM access here
+    var offsetParent = element.offsetParent;
+    // Skip hidden elements which don't have an offsetParent
+    while (offsetParent === noOffsetParent && element.nextElementSibling) {
+      offsetParent = (element = element.nextElementSibling).offsetParent;
+    }
+
+    var nodeName = offsetParent && offsetParent.nodeName;
+
+    if (!nodeName || nodeName === 'BODY' || nodeName === 'HTML') {
+      return element ? element.ownerDocument.documentElement : document.documentElement;
+    }
+
+    // .offsetParent will return the closest TD or TABLE in case
+    // no offsetParent is present, I hate this job...
+    if (['TD', 'TABLE'].indexOf(offsetParent.nodeName) !== -1 && getStyleComputedProperty(offsetParent, 'position') === 'static') {
+      return getOffsetParent(offsetParent);
+    }
+
+    return offsetParent;
+  }
+
+  function isOffsetContainer(element) {
+    var nodeName = element.nodeName;
+
+    if (nodeName === 'BODY') {
+      return false;
+    }
+    return nodeName === 'HTML' || getOffsetParent(element.firstElementChild) === element;
+  }
+
+  /**
+   * Finds the root node (document, shadowDOM root) of the given element
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} node
+   * @returns {Element} root node
+   */
+  function getRoot(node) {
+    if (node.parentNode !== null) {
+      return getRoot(node.parentNode);
+    }
+
+    return node;
+  }
+
+  /**
+   * Finds the offset parent common to the two provided nodes
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element1
+   * @argument {Element} element2
+   * @returns {Element} common offset parent
+   */
+  function findCommonOffsetParent(element1, element2) {
+    // This check is needed to avoid errors in case one of the elements isn't defined for any reason
+    if (!element1 || !element1.nodeType || !element2 || !element2.nodeType) {
+      return document.documentElement;
+    }
+
+    // Here we make sure to give as "start" the element that comes first in the DOM
+    var order = element1.compareDocumentPosition(element2) & Node.DOCUMENT_POSITION_FOLLOWING;
+    var start = order ? element1 : element2;
+    var end = order ? element2 : element1;
+
+    // Get common ancestor container
+    var range = document.createRange();
+    range.setStart(start, 0);
+    range.setEnd(end, 0);
+    var commonAncestorContainer = range.commonAncestorContainer;
+
+    // Both nodes are inside #document
+
+    if (element1 !== commonAncestorContainer && element2 !== commonAncestorContainer || start.contains(end)) {
+      if (isOffsetContainer(commonAncestorContainer)) {
+        return commonAncestorContainer;
+      }
+
+      return getOffsetParent(commonAncestorContainer);
+    }
+
+    // one of the nodes is inside shadowDOM, find which one
+    var element1root = getRoot(element1);
+    if (element1root.host) {
+      return findCommonOffsetParent(element1root.host, element2);
+    } else {
+      return findCommonOffsetParent(element1, getRoot(element2).host);
+    }
+  }
+
+  /**
+   * Gets the scroll value of the given element in the given side (top and left)
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element
+   * @argument {String} side `top` or `left`
+   * @returns {number} amount of scrolled pixels
+   */
+  function getScroll(element) {
+    var side = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 'top';
+
+    var upperSide = side === 'top' ? 'scrollTop' : 'scrollLeft';
+    var nodeName = element.nodeName;
+
+    if (nodeName === 'BODY' || nodeName === 'HTML') {
+      var html = element.ownerDocument.documentElement;
+      var scrollingElement = element.ownerDocument.scrollingElement || html;
+      return scrollingElement[upperSide];
+    }
+
+    return element[upperSide];
+  }
+
+  /*
+   * Sum or subtract the element scroll values (left and top) from a given rect object
+   * @method
+   * @memberof Popper.Utils
+   * @param {Object} rect - Rect object you want to change
+   * @param {HTMLElement} element - The element from the function reads the scroll values
+   * @param {Boolean} subtract - set to true if you want to subtract the scroll values
+   * @return {Object} rect - The modifier rect object
+   */
+  function includeScroll(rect, element) {
+    var subtract = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : false;
+
+    var scrollTop = getScroll(element, 'top');
+    var scrollLeft = getScroll(element, 'left');
+    var modifier = subtract ? -1 : 1;
+    rect.top += scrollTop * modifier;
+    rect.bottom += scrollTop * modifier;
+    rect.left += scrollLeft * modifier;
+    rect.right += scrollLeft * modifier;
+    return rect;
+  }
+
+  /*
+   * Helper to detect borders of a given element
+   * @method
+   * @memberof Popper.Utils
+   * @param {CSSStyleDeclaration} styles
+   * Result of `getStyleComputedProperty` on the given element
+   * @param {String} axis - `x` or `y`
+   * @return {number} borders - The borders size of the given axis
+   */
+
+  function getBordersSize(styles, axis) {
+    var sideA = axis === 'x' ? 'Left' : 'Top';
+    var sideB = sideA === 'Left' ? 'Right' : 'Bottom';
+
+    return parseFloat(styles['border' + sideA + 'Width'], 10) + parseFloat(styles['border' + sideB + 'Width'], 10);
+  }
+
+  function getSize(axis, body, html, computedStyle) {
+    return Math.max(body['offset' + axis], body['scroll' + axis], html['client' + axis], html['offset' + axis], html['scroll' + axis], isIE(10) ? html['offset' + axis] + computedStyle['margin' + (axis === 'Height' ? 'Top' : 'Left')] + computedStyle['margin' + (axis === 'Height' ? 'Bottom' : 'Right')] : 0);
+  }
+
+  function getWindowSizes() {
+    var body = document.body;
+    var html = document.documentElement;
+    var computedStyle = isIE(10) && getComputedStyle(html);
+
+    return {
+      height: getSize('Height', body, html, computedStyle),
+      width: getSize('Width', body, html, computedStyle)
+    };
+  }
+
+  var classCallCheck = function (instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+      throw new TypeError("Cannot call a class as a function");
+    }
+  };
+
+  var createClass = function () {
+    function defineProperties(target, props) {
+      for (var i = 0; i < props.length; i++) {
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+      }
+    }
+
+    return function (Constructor, protoProps, staticProps) {
+      if (protoProps) defineProperties(Constructor.prototype, protoProps);
+      if (staticProps) defineProperties(Constructor, staticProps);
+      return Constructor;
+    };
+  }();
+
+
+
+
+
+  var defineProperty = function (obj, key, value) {
+    if (key in obj) {
+      Object.defineProperty(obj, key, {
+        value: value,
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+    } else {
+      obj[key] = value;
+    }
+
+    return obj;
+  };
+
+  var _extends = Object.assign || function (target) {
+    for (var i = 1; i < arguments.length; i++) {
+      var source = arguments[i];
+
+      for (var key in source) {
+        if (Object.prototype.hasOwnProperty.call(source, key)) {
+          target[key] = source[key];
+        }
+      }
+    }
+
+    return target;
+  };
+
+  /**
+   * Given element offsets, generate an output similar to getBoundingClientRect
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Object} offsets
+   * @returns {Object} ClientRect like output
+   */
+  function getClientRect(offsets) {
+    return _extends({}, offsets, {
+      right: offsets.left + offsets.width,
+      bottom: offsets.top + offsets.height
+    });
+  }
+
+  /**
+   * Get bounding client rect of given element
+   * @method
+   * @memberof Popper.Utils
+   * @param {HTMLElement} element
+   * @return {Object} client rect
+   */
+  function getBoundingClientRect(element) {
+    var rect = {};
+
+    // IE10 10 FIX: Please, don't ask, the element isn't
+    // considered in DOM in some circumstances...
+    // This isn't reproducible in IE10 compatibility mode of IE11
+    try {
+      if (isIE(10)) {
+        rect = element.getBoundingClientRect();
+        var scrollTop = getScroll(element, 'top');
+        var scrollLeft = getScroll(element, 'left');
+        rect.top += scrollTop;
+        rect.left += scrollLeft;
+        rect.bottom += scrollTop;
+        rect.right += scrollLeft;
+      } else {
+        rect = element.getBoundingClientRect();
+      }
+    } catch (e) {}
+
+    var result = {
+      left: rect.left,
+      top: rect.top,
+      width: rect.right - rect.left,
+      height: rect.bottom - rect.top
+    };
+
+    // subtract scrollbar size from sizes
+    var sizes = element.nodeName === 'HTML' ? getWindowSizes() : {};
+    var width = sizes.width || element.clientWidth || result.right - result.left;
+    var height = sizes.height || element.clientHeight || result.bottom - result.top;
+
+    var horizScrollbar = element.offsetWidth - width;
+    var vertScrollbar = element.offsetHeight - height;
+
+    // if an hypothetical scrollbar is detected, we must be sure it's not a `border`
+    // we make this check conditional for performance reasons
+    if (horizScrollbar || vertScrollbar) {
+      var styles = getStyleComputedProperty(element);
+      horizScrollbar -= getBordersSize(styles, 'x');
+      vertScrollbar -= getBordersSize(styles, 'y');
+
+      result.width -= horizScrollbar;
+      result.height -= vertScrollbar;
+    }
+
+    return getClientRect(result);
+  }
+
+  function getOffsetRectRelativeToArbitraryNode(children, parent) {
+    var fixedPosition = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : false;
+
+    var isIE10 = isIE(10);
+    var isHTML = parent.nodeName === 'HTML';
+    var childrenRect = getBoundingClientRect(children);
+    var parentRect = getBoundingClientRect(parent);
+    var scrollParent = getScrollParent(children);
+
+    var styles = getStyleComputedProperty(parent);
+    var borderTopWidth = parseFloat(styles.borderTopWidth, 10);
+    var borderLeftWidth = parseFloat(styles.borderLeftWidth, 10);
+
+    // In cases where the parent is fixed, we must ignore negative scroll in offset calc
+    if (fixedPosition && parent.nodeName === 'HTML') {
+      parentRect.top = Math.max(parentRect.top, 0);
+      parentRect.left = Math.max(parentRect.left, 0);
+    }
+    var offsets = getClientRect({
+      top: childrenRect.top - parentRect.top - borderTopWidth,
+      left: childrenRect.left - parentRect.left - borderLeftWidth,
+      width: childrenRect.width,
+      height: childrenRect.height
+    });
+    offsets.marginTop = 0;
+    offsets.marginLeft = 0;
+
+    // Subtract margins of documentElement in case it's being used as parent
+    // we do this only on HTML because it's the only element that behaves
+    // differently when margins are applied to it. The margins are included in
+    // the box of the documentElement, in the other cases not.
+    if (!isIE10 && isHTML) {
+      var marginTop = parseFloat(styles.marginTop, 10);
+      var marginLeft = parseFloat(styles.marginLeft, 10);
+
+      offsets.top -= borderTopWidth - marginTop;
+      offsets.bottom -= borderTopWidth - marginTop;
+      offsets.left -= borderLeftWidth - marginLeft;
+      offsets.right -= borderLeftWidth - marginLeft;
+
+      // Attach marginTop and marginLeft because in some circumstances we may need them
+      offsets.marginTop = marginTop;
+      offsets.marginLeft = marginLeft;
+    }
+
+    if (isIE10 && !fixedPosition ? parent.contains(scrollParent) : parent === scrollParent && scrollParent.nodeName !== 'BODY') {
+      offsets = includeScroll(offsets, parent);
+    }
+
+    return offsets;
+  }
+
+  function getViewportOffsetRectRelativeToArtbitraryNode(element) {
+    var excludeScroll = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : false;
+
+    var html = element.ownerDocument.documentElement;
+    var relativeOffset = getOffsetRectRelativeToArbitraryNode(element, html);
+    var width = Math.max(html.clientWidth, window.innerWidth || 0);
+    var height = Math.max(html.clientHeight, window.innerHeight || 0);
+
+    var scrollTop = !excludeScroll ? getScroll(html) : 0;
+    var scrollLeft = !excludeScroll ? getScroll(html, 'left') : 0;
+
+    var offset = {
+      top: scrollTop - relativeOffset.top + relativeOffset.marginTop,
+      left: scrollLeft - relativeOffset.left + relativeOffset.marginLeft,
+      width: width,
+      height: height
+    };
+
+    return getClientRect(offset);
+  }
+
+  /**
+   * Check if the given element is fixed or is inside a fixed parent
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element
+   * @argument {Element} customContainer
+   * @returns {Boolean} answer to "isFixed?"
+   */
+  function isFixed(element) {
+    var nodeName = element.nodeName;
+    if (nodeName === 'BODY' || nodeName === 'HTML') {
+      return false;
+    }
+    if (getStyleComputedProperty(element, 'position') === 'fixed') {
+      return true;
+    }
+    return isFixed(getParentNode(element));
+  }
+
+  /**
+   * Finds the first parent of an element that has a transformed property defined
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element
+   * @returns {Element} first transformed parent or documentElement
+   */
+
+  function getFixedPositionOffsetParent(element) {
+    // This check is needed to avoid errors in case one of the elements isn't defined for any reason
+    if (!element || !element.parentElement || isIE()) {
+      return document.documentElement;
+    }
+    var el = element.parentElement;
+    while (el && getStyleComputedProperty(el, 'transform') === 'none') {
+      el = el.parentElement;
+    }
+    return el || document.documentElement;
+  }
+
+  /**
+   * Computed the boundaries limits and return them
+   * @method
+   * @memberof Popper.Utils
+   * @param {HTMLElement} popper
+   * @param {HTMLElement} reference
+   * @param {number} padding
+   * @param {HTMLElement} boundariesElement - Element used to define the boundaries
+   * @param {Boolean} fixedPosition - Is in fixed position mode
+   * @returns {Object} Coordinates of the boundaries
+   */
+  function getBoundaries(popper, reference, padding, boundariesElement) {
+    var fixedPosition = arguments.length > 4 && arguments[4] !== undefined ? arguments[4] : false;
+
+    // NOTE: 1 DOM access here
+
+    var boundaries = { top: 0, left: 0 };
+    var offsetParent = fixedPosition ? getFixedPositionOffsetParent(popper) : findCommonOffsetParent(popper, reference);
+
+    // Handle viewport case
+    if (boundariesElement === 'viewport') {
+      boundaries = getViewportOffsetRectRelativeToArtbitraryNode(offsetParent, fixedPosition);
+    } else {
+      // Handle other cases based on DOM element used as boundaries
+      var boundariesNode = void 0;
+      if (boundariesElement === 'scrollParent') {
+        boundariesNode = getScrollParent(getParentNode(reference));
+        if (boundariesNode.nodeName === 'BODY') {
+          boundariesNode = popper.ownerDocument.documentElement;
+        }
+      } else if (boundariesElement === 'window') {
+        boundariesNode = popper.ownerDocument.documentElement;
+      } else {
+        boundariesNode = boundariesElement;
+      }
+
+      var offsets = getOffsetRectRelativeToArbitraryNode(boundariesNode, offsetParent, fixedPosition);
+
+      // In case of HTML, we need a different computation
+      if (boundariesNode.nodeName === 'HTML' && !isFixed(offsetParent)) {
+        var _getWindowSizes = getWindowSizes(),
+            height = _getWindowSizes.height,
+            width = _getWindowSizes.width;
+
+        boundaries.top += offsets.top - offsets.marginTop;
+        boundaries.bottom = height + offsets.top;
+        boundaries.left += offsets.left - offsets.marginLeft;
+        boundaries.right = width + offsets.left;
+      } else {
+        // for all the other DOM elements, this one is good
+        boundaries = offsets;
+      }
+    }
+
+    // Add paddings
+    boundaries.left += padding;
+    boundaries.top += padding;
+    boundaries.right -= padding;
+    boundaries.bottom -= padding;
+
+    return boundaries;
+  }
+
+  function getArea(_ref) {
+    var width = _ref.width,
+        height = _ref.height;
+
+    return width * height;
+  }
+
+  /**
+   * Utility used to transform the `auto` placement to the placement with more
+   * available space.
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Object} data - The data object generated by update method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The data object, properly modified
+   */
+  function computeAutoPlacement(placement, refRect, popper, reference, boundariesElement) {
+    var padding = arguments.length > 5 && arguments[5] !== undefined ? arguments[5] : 0;
+
+    if (placement.indexOf('auto') === -1) {
+      return placement;
+    }
+
+    var boundaries = getBoundaries(popper, reference, padding, boundariesElement);
+
+    var rects = {
+      top: {
+        width: boundaries.width,
+        height: refRect.top - boundaries.top
+      },
+      right: {
+        width: boundaries.right - refRect.right,
+        height: boundaries.height
+      },
+      bottom: {
+        width: boundaries.width,
+        height: boundaries.bottom - refRect.bottom
+      },
+      left: {
+        width: refRect.left - boundaries.left,
+        height: boundaries.height
+      }
+    };
+
+    var sortedAreas = Object.keys(rects).map(function (key) {
+      return _extends({
+        key: key
+      }, rects[key], {
+        area: getArea(rects[key])
+      });
+    }).sort(function (a, b) {
+      return b.area - a.area;
+    });
+
+    var filteredAreas = sortedAreas.filter(function (_ref2) {
+      var width = _ref2.width,
+          height = _ref2.height;
+      return width >= popper.clientWidth && height >= popper.clientHeight;
+    });
+
+    var computedPlacement = filteredAreas.length > 0 ? filteredAreas[0].key : sortedAreas[0].key;
+
+    var variation = placement.split('-')[1];
+
+    return computedPlacement + (variation ? '-' + variation : '');
+  }
+
+  /**
+   * Get offsets to the reference element
+   * @method
+   * @memberof Popper.Utils
+   * @param {Object} state
+   * @param {Element} popper - the popper element
+   * @param {Element} reference - the reference element (the popper will be relative to this)
+   * @param {Element} fixedPosition - is in fixed position mode
+   * @returns {Object} An object containing the offsets which will be applied to the popper
+   */
+  function getReferenceOffsets(state, popper, reference) {
+    var fixedPosition = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : null;
+
+    var commonOffsetParent = fixedPosition ? getFixedPositionOffsetParent(popper) : findCommonOffsetParent(popper, reference);
+    return getOffsetRectRelativeToArbitraryNode(reference, commonOffsetParent, fixedPosition);
+  }
+
+  /**
+   * Get the outer sizes of the given element (offset size + margins)
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element
+   * @returns {Object} object containing width and height properties
+   */
+  function getOuterSizes(element) {
+    var styles = getComputedStyle(element);
+    var x = parseFloat(styles.marginTop) + parseFloat(styles.marginBottom);
+    var y = parseFloat(styles.marginLeft) + parseFloat(styles.marginRight);
+    var result = {
+      width: element.offsetWidth + y,
+      height: element.offsetHeight + x
+    };
+    return result;
+  }
+
+  /**
+   * Get the opposite placement of the given one
+   * @method
+   * @memberof Popper.Utils
+   * @argument {String} placement
+   * @returns {String} flipped placement
+   */
+  function getOppositePlacement(placement) {
+    var hash = { left: 'right', right: 'left', bottom: 'top', top: 'bottom' };
+    return placement.replace(/left|right|bottom|top/g, function (matched) {
+      return hash[matched];
+    });
+  }
+
+  /**
+   * Get offsets to the popper
+   * @method
+   * @memberof Popper.Utils
+   * @param {Object} position - CSS position the Popper will get applied
+   * @param {HTMLElement} popper - the popper element
+   * @param {Object} referenceOffsets - the reference offsets (the popper will be relative to this)
+   * @param {String} placement - one of the valid placement options
+   * @returns {Object} popperOffsets - An object containing the offsets which will be applied to the popper
+   */
+  function getPopperOffsets(popper, referenceOffsets, placement) {
+    placement = placement.split('-')[0];
+
+    // Get popper node sizes
+    var popperRect = getOuterSizes(popper);
+
+    // Add position, width and height to our offsets object
+    var popperOffsets = {
+      width: popperRect.width,
+      height: popperRect.height
+    };
+
+    // depending by the popper placement we have to compute its offsets slightly differently
+    var isHoriz = ['right', 'left'].indexOf(placement) !== -1;
+    var mainSide = isHoriz ? 'top' : 'left';
+    var secondarySide = isHoriz ? 'left' : 'top';
+    var measurement = isHoriz ? 'height' : 'width';
+    var secondaryMeasurement = !isHoriz ? 'height' : 'width';
+
+    popperOffsets[mainSide] = referenceOffsets[mainSide] + referenceOffsets[measurement] / 2 - popperRect[measurement] / 2;
+    if (placement === secondarySide) {
+      popperOffsets[secondarySide] = referenceOffsets[secondarySide] - popperRect[secondaryMeasurement];
+    } else {
+      popperOffsets[secondarySide] = referenceOffsets[getOppositePlacement(secondarySide)];
+    }
+
+    return popperOffsets;
+  }
+
+  /**
+   * Mimics the `find` method of Array
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Array} arr
+   * @argument prop
+   * @argument value
+   * @returns index or -1
+   */
+  function find(arr, check) {
+    // use native find if supported
+    if (Array.prototype.find) {
+      return arr.find(check);
+    }
+
+    // use `filter` to obtain the same behavior of `find`
+    return arr.filter(check)[0];
+  }
+
+  /**
+   * Return the index of the matching object
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Array} arr
+   * @argument prop
+   * @argument value
+   * @returns index or -1
+   */
+  function findIndex(arr, prop, value) {
+    // use native findIndex if supported
+    if (Array.prototype.findIndex) {
+      return arr.findIndex(function (cur) {
+        return cur[prop] === value;
+      });
+    }
+
+    // use `find` + `indexOf` if `findIndex` isn't supported
+    var match = find(arr, function (obj) {
+      return obj[prop] === value;
+    });
+    return arr.indexOf(match);
+  }
+
+  /**
+   * Loop trough the list of modifiers and run them in order,
+   * each of them will then edit the data object.
+   * @method
+   * @memberof Popper.Utils
+   * @param {dataObject} data
+   * @param {Array} modifiers
+   * @param {String} ends - Optional modifier name used as stopper
+   * @returns {dataObject}
+   */
+  function runModifiers(modifiers, data, ends) {
+    var modifiersToRun = ends === undefined ? modifiers : modifiers.slice(0, findIndex(modifiers, 'name', ends));
+
+    modifiersToRun.forEach(function (modifier) {
+      if (modifier['function']) {
+        // eslint-disable-line dot-notation
+        console.warn('`modifier.function` is deprecated, use `modifier.fn`!');
+      }
+      var fn = modifier['function'] || modifier.fn; // eslint-disable-line dot-notation
+      if (modifier.enabled && isFunction(fn)) {
+        // Add properties to offsets to make them a complete clientRect object
+        // we do this before each modifier to make sure the previous one doesn't
+        // mess with these values
+        data.offsets.popper = getClientRect(data.offsets.popper);
+        data.offsets.reference = getClientRect(data.offsets.reference);
+
+        data = fn(data, modifier);
+      }
+    });
+
+    return data;
+  }
+
+  /**
+   * Updates the position of the popper, computing the new offsets and applying
+   * the new style.<br />
+   * Prefer `scheduleUpdate` over `update` because of performance reasons.
+   * @method
+   * @memberof Popper
+   */
+  function update() {
+    // if popper is destroyed, don't perform any further update
+    if (this.state.isDestroyed) {
+      return;
+    }
+
+    var data = {
+      instance: this,
+      styles: {},
+      arrowStyles: {},
+      attributes: {},
+      flipped: false,
+      offsets: {}
+    };
+
+    // compute reference element offsets
+    data.offsets.reference = getReferenceOffsets(this.state, this.popper, this.reference, this.options.positionFixed);
+
+    // compute auto placement, store placement inside the data object,
+    // modifiers will be able to edit `placement` if needed
+    // and refer to originalPlacement to know the original value
+    data.placement = computeAutoPlacement(this.options.placement, data.offsets.reference, this.popper, this.reference, this.options.modifiers.flip.boundariesElement, this.options.modifiers.flip.padding);
+
+    // store the computed placement inside `originalPlacement`
+    data.originalPlacement = data.placement;
+
+    data.positionFixed = this.options.positionFixed;
+
+    // compute the popper offsets
+    data.offsets.popper = getPopperOffsets(this.popper, data.offsets.reference, data.placement);
+
+    data.offsets.popper.position = this.options.positionFixed ? 'fixed' : 'absolute';
+
+    // run the modifiers
+    data = runModifiers(this.modifiers, data);
+
+    // the first `update` will call `onCreate` callback
+    // the other ones will call `onUpdate` callback
+    if (!this.state.isCreated) {
+      this.state.isCreated = true;
+      this.options.onCreate(data);
+    } else {
+      this.options.onUpdate(data);
+    }
+  }
+
+  /**
+   * Helper used to know if the given modifier is enabled.
+   * @method
+   * @memberof Popper.Utils
+   * @returns {Boolean}
+   */
+  function isModifierEnabled(modifiers, modifierName) {
+    return modifiers.some(function (_ref) {
+      var name = _ref.name,
+          enabled = _ref.enabled;
+      return enabled && name === modifierName;
+    });
+  }
+
+  /**
+   * Get the prefixed supported property name
+   * @method
+   * @memberof Popper.Utils
+   * @argument {String} property (camelCase)
+   * @returns {String} prefixed property (camelCase or PascalCase, depending on the vendor prefix)
+   */
+  function getSupportedPropertyName(property) {
+    var prefixes = [false, 'ms', 'Webkit', 'Moz', 'O'];
+    var upperProp = property.charAt(0).toUpperCase() + property.slice(1);
+
+    for (var i = 0; i < prefixes.length; i++) {
+      var prefix = prefixes[i];
+      var toCheck = prefix ? '' + prefix + upperProp : property;
+      if (typeof document.body.style[toCheck] !== 'undefined') {
+        return toCheck;
+      }
+    }
+    return null;
+  }
+
+  /**
+   * Destroy the popper
+   * @method
+   * @memberof Popper
+   */
+  function destroy() {
+    this.state.isDestroyed = true;
+
+    // touch DOM only if `applyStyle` modifier is enabled
+    if (isModifierEnabled(this.modifiers, 'applyStyle')) {
+      this.popper.removeAttribute('x-placement');
+      this.popper.style.position = '';
+      this.popper.style.top = '';
+      this.popper.style.left = '';
+      this.popper.style.right = '';
+      this.popper.style.bottom = '';
+      this.popper.style.willChange = '';
+      this.popper.style[getSupportedPropertyName('transform')] = '';
+    }
+
+    this.disableEventListeners();
+
+    // remove the popper if user explicity asked for the deletion on destroy
+    // do not use `remove` because IE11 doesn't support it
+    if (this.options.removeOnDestroy) {
+      this.popper.parentNode.removeChild(this.popper);
+    }
+    return this;
+  }
+
+  /**
+   * Get the window associated with the element
+   * @argument {Element} element
+   * @returns {Window}
+   */
+  function getWindow(element) {
+    var ownerDocument = element.ownerDocument;
+    return ownerDocument ? ownerDocument.defaultView : window;
+  }
+
+  function attachToScrollParents(scrollParent, event, callback, scrollParents) {
+    var isBody = scrollParent.nodeName === 'BODY';
+    var target = isBody ? scrollParent.ownerDocument.defaultView : scrollParent;
+    target.addEventListener(event, callback, { passive: true });
+
+    if (!isBody) {
+      attachToScrollParents(getScrollParent(target.parentNode), event, callback, scrollParents);
+    }
+    scrollParents.push(target);
+  }
+
+  /**
+   * Setup needed event listeners used to update the popper position
+   * @method
+   * @memberof Popper.Utils
+   * @private
+   */
+  function setupEventListeners(reference, options, state, updateBound) {
+    // Resize event listener on window
+    state.updateBound = updateBound;
+    getWindow(reference).addEventListener('resize', state.updateBound, { passive: true });
+
+    // Scroll event listener on scroll parents
+    var scrollElement = getScrollParent(reference);
+    attachToScrollParents(scrollElement, 'scroll', state.updateBound, state.scrollParents);
+    state.scrollElement = scrollElement;
+    state.eventsEnabled = true;
+
+    return state;
+  }
+
+  /**
+   * It will add resize/scroll events and start recalculating
+   * position of the popper element when they are triggered.
+   * @method
+   * @memberof Popper
+   */
+  function enableEventListeners() {
+    if (!this.state.eventsEnabled) {
+      this.state = setupEventListeners(this.reference, this.options, this.state, this.scheduleUpdate);
+    }
+  }
+
+  /**
+   * Remove event listeners used to update the popper position
+   * @method
+   * @memberof Popper.Utils
+   * @private
+   */
+  function removeEventListeners(reference, state) {
+    // Remove resize event listener on window
+    getWindow(reference).removeEventListener('resize', state.updateBound);
+
+    // Remove scroll event listener on scroll parents
+    state.scrollParents.forEach(function (target) {
+      target.removeEventListener('scroll', state.updateBound);
+    });
+
+    // Reset state
+    state.updateBound = null;
+    state.scrollParents = [];
+    state.scrollElement = null;
+    state.eventsEnabled = false;
+    return state;
+  }
+
+  /**
+   * It will remove resize/scroll events and won't recalculate popper position
+   * when they are triggered. It also won't trigger onUpdate callback anymore,
+   * unless you call `update` method manually.
+   * @method
+   * @memberof Popper
+   */
+  function disableEventListeners() {
+    if (this.state.eventsEnabled) {
+      cancelAnimationFrame(this.scheduleUpdate);
+      this.state = removeEventListeners(this.reference, this.state);
+    }
+  }
+
+  /**
+   * Tells if a given input is a number
+   * @method
+   * @memberof Popper.Utils
+   * @param {*} input to check
+   * @return {Boolean}
+   */
+  function isNumeric(n) {
+    return n !== '' && !isNaN(parseFloat(n)) && isFinite(n);
+  }
+
+  /**
+   * Set the style to the given popper
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element - Element to apply the style to
+   * @argument {Object} styles
+   * Object with a list of properties and values which will be applied to the element
+   */
+  function setStyles(element, styles) {
+    Object.keys(styles).forEach(function (prop) {
+      var unit = '';
+      // add unit if the value is numeric and is one of the following
+      if (['width', 'height', 'top', 'right', 'bottom', 'left'].indexOf(prop) !== -1 && isNumeric(styles[prop])) {
+        unit = 'px';
+      }
+      element.style[prop] = styles[prop] + unit;
+    });
+  }
+
+  /**
+   * Set the attributes to the given popper
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element - Element to apply the attributes to
+   * @argument {Object} styles
+   * Object with a list of properties and values which will be applied to the element
+   */
+  function setAttributes(element, attributes) {
+    Object.keys(attributes).forEach(function (prop) {
+      var value = attributes[prop];
+      if (value !== false) {
+        element.setAttribute(prop, attributes[prop]);
+      } else {
+        element.removeAttribute(prop);
+      }
+    });
+  }
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by `update` method
+   * @argument {Object} data.styles - List of style properties - values to apply to popper element
+   * @argument {Object} data.attributes - List of attribute properties - values to apply to popper element
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The same data object
+   */
+  function applyStyle(data) {
+    // any property present in `data.styles` will be applied to the popper,
+    // in this way we can make the 3rd party modifiers add custom styles to it
+    // Be aware, modifiers could override the properties defined in the previous
+    // lines of this modifier!
+    setStyles(data.instance.popper, data.styles);
+
+    // any property present in `data.attributes` will be applied to the popper,
+    // they will be set as HTML attributes of the element
+    setAttributes(data.instance.popper, data.attributes);
+
+    // if arrowElement is defined and arrowStyles has some properties
+    if (data.arrowElement && Object.keys(data.arrowStyles).length) {
+      setStyles(data.arrowElement, data.arrowStyles);
+    }
+
+    return data;
+  }
+
+  /**
+   * Set the x-placement attribute before everything else because it could be used
+   * to add margins to the popper margins needs to be calculated to get the
+   * correct popper offsets.
+   * @method
+   * @memberof Popper.modifiers
+   * @param {HTMLElement} reference - The reference element used to position the popper
+   * @param {HTMLElement} popper - The HTML element used as popper
+   * @param {Object} options - Popper.js options
+   */
+  function applyStyleOnLoad(reference, popper, options, modifierOptions, state) {
+    // compute reference element offsets
+    var referenceOffsets = getReferenceOffsets(state, popper, reference, options.positionFixed);
+
+    // compute auto placement, store placement inside the data object,
+    // modifiers will be able to edit `placement` if needed
+    // and refer to originalPlacement to know the original value
+    var placement = computeAutoPlacement(options.placement, referenceOffsets, popper, reference, options.modifiers.flip.boundariesElement, options.modifiers.flip.padding);
+
+    popper.setAttribute('x-placement', placement);
+
+    // Apply `position` to popper before anything else because
+    // without the position applied we can't guarantee correct computations
+    setStyles(popper, { position: options.positionFixed ? 'fixed' : 'absolute' });
+
+    return options;
+  }
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by `update` method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The data object, properly modified
+   */
+  function computeStyle(data, options) {
+    var x = options.x,
+        y = options.y;
+    var popper = data.offsets.popper;
+
+    // Remove this legacy support in Popper.js v2
+
+    var legacyGpuAccelerationOption = find(data.instance.modifiers, function (modifier) {
+      return modifier.name === 'applyStyle';
+    }).gpuAcceleration;
+    if (legacyGpuAccelerationOption !== undefined) {
+      console.warn('WARNING: `gpuAcceleration` option moved to `computeStyle` modifier and will not be supported in future versions of Popper.js!');
+    }
+    var gpuAcceleration = legacyGpuAccelerationOption !== undefined ? legacyGpuAccelerationOption : options.gpuAcceleration;
+
+    var offsetParent = getOffsetParent(data.instance.popper);
+    var offsetParentRect = getBoundingClientRect(offsetParent);
+
+    // Styles
+    var styles = {
+      position: popper.position
+    };
+
+    // Avoid blurry text by using full pixel integers.
+    // For pixel-perfect positioning, top/bottom prefers rounded
+    // values, while left/right prefers floored values.
+    var offsets = {
+      left: Math.floor(popper.left),
+      top: Math.round(popper.top),
+      bottom: Math.round(popper.bottom),
+      right: Math.floor(popper.right)
+    };
+
+    var sideA = x === 'bottom' ? 'top' : 'bottom';
+    var sideB = y === 'right' ? 'left' : 'right';
+
+    // if gpuAcceleration is set to `true` and transform is supported,
+    //  we use `translate3d` to apply the position to the popper we
+    // automatically use the supported prefixed version if needed
+    var prefixedProperty = getSupportedPropertyName('transform');
+
+    // now, let's make a step back and look at this code closely (wtf?)
+    // If the content of the popper grows once it's been positioned, it
+    // may happen that the popper gets misplaced because of the new content
+    // overflowing its reference element
+    // To avoid this problem, we provide two options (x and y), which allow
+    // the consumer to define the offset origin.
+    // If we position a popper on top of a reference element, we can set
+    // `x` to `top` to make the popper grow towards its top instead of
+    // its bottom.
+    var left = void 0,
+        top = void 0;
+    if (sideA === 'bottom') {
+      top = -offsetParentRect.height + offsets.bottom;
+    } else {
+      top = offsets.top;
+    }
+    if (sideB === 'right') {
+      left = -offsetParentRect.width + offsets.right;
+    } else {
+      left = offsets.left;
+    }
+    if (gpuAcceleration && prefixedProperty) {
+      styles[prefixedProperty] = 'translate3d(' + left + 'px, ' + top + 'px, 0)';
+      styles[sideA] = 0;
+      styles[sideB] = 0;
+      styles.willChange = 'transform';
+    } else {
+      // othwerise, we use the standard `top`, `left`, `bottom` and `right` properties
+      var invertTop = sideA === 'bottom' ? -1 : 1;
+      var invertLeft = sideB === 'right' ? -1 : 1;
+      styles[sideA] = top * invertTop;
+      styles[sideB] = left * invertLeft;
+      styles.willChange = sideA + ', ' + sideB;
+    }
+
+    // Attributes
+    var attributes = {
+      'x-placement': data.placement
+    };
+
+    // Update `data` attributes, styles and arrowStyles
+    data.attributes = _extends({}, attributes, data.attributes);
+    data.styles = _extends({}, styles, data.styles);
+    data.arrowStyles = _extends({}, data.offsets.arrow, data.arrowStyles);
+
+    return data;
+  }
+
+  /**
+   * Helper used to know if the given modifier depends from another one.<br />
+   * It checks if the needed modifier is listed and enabled.
+   * @method
+   * @memberof Popper.Utils
+   * @param {Array} modifiers - list of modifiers
+   * @param {String} requestingName - name of requesting modifier
+   * @param {String} requestedName - name of requested modifier
+   * @returns {Boolean}
+   */
+  function isModifierRequired(modifiers, requestingName, requestedName) {
+    var requesting = find(modifiers, function (_ref) {
+      var name = _ref.name;
+      return name === requestingName;
+    });
+
+    var isRequired = !!requesting && modifiers.some(function (modifier) {
+      return modifier.name === requestedName && modifier.enabled && modifier.order < requesting.order;
+    });
+
+    if (!isRequired) {
+      var _requesting = '`' + requestingName + '`';
+      var requested = '`' + requestedName + '`';
+      console.warn(requested + ' modifier is required by ' + _requesting + ' modifier in order to work, be sure to include it before ' + _requesting + '!');
+    }
+    return isRequired;
+  }
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by update method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The data object, properly modified
+   */
+  function arrow(data, options) {
+    var _data$offsets$arrow;
+
+    // arrow depends on keepTogether in order to work
+    if (!isModifierRequired(data.instance.modifiers, 'arrow', 'keepTogether')) {
+      return data;
+    }
+
+    var arrowElement = options.element;
+
+    // if arrowElement is a string, suppose it's a CSS selector
+    if (typeof arrowElement === 'string') {
+      arrowElement = data.instance.popper.querySelector(arrowElement);
+
+      // if arrowElement is not found, don't run the modifier
+      if (!arrowElement) {
+        return data;
+      }
+    } else {
+      // if the arrowElement isn't a query selector we must check that the
+      // provided DOM node is child of its popper node
+      if (!data.instance.popper.contains(arrowElement)) {
+        console.warn('WARNING: `arrow.element` must be child of its popper element!');
+        return data;
+      }
+    }
+
+    var placement = data.placement.split('-')[0];
+    var _data$offsets = data.offsets,
+        popper = _data$offsets.popper,
+        reference = _data$offsets.reference;
+
+    var isVertical = ['left', 'right'].indexOf(placement) !== -1;
+
+    var len = isVertical ? 'height' : 'width';
+    var sideCapitalized = isVertical ? 'Top' : 'Left';
+    var side = sideCapitalized.toLowerCase();
+    var altSide = isVertical ? 'left' : 'top';
+    var opSide = isVertical ? 'bottom' : 'right';
+    var arrowElementSize = getOuterSizes(arrowElement)[len];
+
+    //
+    // extends keepTogether behavior making sure the popper and its
+    // reference have enough pixels in conjuction
+    //
+
+    // top/left side
+    if (reference[opSide] - arrowElementSize < popper[side]) {
+      data.offsets.popper[side] -= popper[side] - (reference[opSide] - arrowElementSize);
+    }
+    // bottom/right side
+    if (reference[side] + arrowElementSize > popper[opSide]) {
+      data.offsets.popper[side] += reference[side] + arrowElementSize - popper[opSide];
+    }
+    data.offsets.popper = getClientRect(data.offsets.popper);
+
+    // compute center of the popper
+    var center = reference[side] + reference[len] / 2 - arrowElementSize / 2;
+
+    // Compute the sideValue using the updated popper offsets
+    // take popper margin in account because we don't have this info available
+    var css = getStyleComputedProperty(data.instance.popper);
+    var popperMarginSide = parseFloat(css['margin' + sideCapitalized], 10);
+    var popperBorderSide = parseFloat(css['border' + sideCapitalized + 'Width'], 10);
+    var sideValue = center - data.offsets.popper[side] - popperMarginSide - popperBorderSide;
+
+    // prevent arrowElement from being placed not contiguously to its popper
+    sideValue = Math.max(Math.min(popper[len] - arrowElementSize, sideValue), 0);
+
+    data.arrowElement = arrowElement;
+    data.offsets.arrow = (_data$offsets$arrow = {}, defineProperty(_data$offsets$arrow, side, Math.round(sideValue)), defineProperty(_data$offsets$arrow, altSide, ''), _data$offsets$arrow);
+
+    return data;
+  }
+
+  /**
+   * Get the opposite placement variation of the given one
+   * @method
+   * @memberof Popper.Utils
+   * @argument {String} placement variation
+   * @returns {String} flipped placement variation
+   */
+  function getOppositeVariation(variation) {
+    if (variation === 'end') {
+      return 'start';
+    } else if (variation === 'start') {
+      return 'end';
+    }
+    return variation;
+  }
+
+  /**
+   * List of accepted placements to use as values of the `placement` option.<br />
+   * Valid placements are:
+   * - `auto`
+   * - `top`
+   * - `right`
+   * - `bottom`
+   * - `left`
+   *
+   * Each placement can have a variation from this list:
+   * - `-start`
+   * - `-end`
+   *
+   * Variations are interpreted easily if you think of them as the left to right
+   * written languages. Horizontally (`top` and `bottom`), `start` is left and `end`
+   * is right.<br />
+   * Vertically (`left` and `right`), `start` is top and `end` is bottom.
+   *
+   * Some valid examples are:
+   * - `top-end` (on top of reference, right aligned)
+   * - `right-start` (on right of reference, top aligned)
+   * - `bottom` (on bottom, centered)
+   * - `auto-right` (on the side with more space available, alignment depends by placement)
+   *
+   * @static
+   * @type {Array}
+   * @enum {String}
+   * @readonly
+   * @method placements
+   * @memberof Popper
+   */
+  var placements = ['auto-start', 'auto', 'auto-end', 'top-start', 'top', 'top-end', 'right-start', 'right', 'right-end', 'bottom-end', 'bottom', 'bottom-start', 'left-end', 'left', 'left-start'];
+
+  // Get rid of `auto` `auto-start` and `auto-end`
+  var validPlacements = placements.slice(3);
+
+  /**
+   * Given an initial placement, returns all the subsequent placements
+   * clockwise (or counter-clockwise).
+   *
+   * @method
+   * @memberof Popper.Utils
+   * @argument {String} placement - A valid placement (it accepts variations)
+   * @argument {Boolean} counter - Set to true to walk the placements counterclockwise
+   * @returns {Array} placements including their variations
+   */
+  function clockwise(placement) {
+    var counter = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : false;
+
+    var index = validPlacements.indexOf(placement);
+    var arr = validPlacements.slice(index + 1).concat(validPlacements.slice(0, index));
+    return counter ? arr.reverse() : arr;
+  }
+
+  var BEHAVIORS = {
+    FLIP: 'flip',
+    CLOCKWISE: 'clockwise',
+    COUNTERCLOCKWISE: 'counterclockwise'
+  };
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by update method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The data object, properly modified
+   */
+  function flip(data, options) {
+    // if `inner` modifier is enabled, we can't use the `flip` modifier
+    if (isModifierEnabled(data.instance.modifiers, 'inner')) {
+      return data;
+    }
+
+    if (data.flipped && data.placement === data.originalPlacement) {
+      // seems like flip is trying to loop, probably there's not enough space on any of the flippable sides
+      return data;
+    }
+
+    var boundaries = getBoundaries(data.instance.popper, data.instance.reference, options.padding, options.boundariesElement, data.positionFixed);
+
+    var placement = data.placement.split('-')[0];
+    var placementOpposite = getOppositePlacement(placement);
+    var variation = data.placement.split('-')[1] || '';
+
+    var flipOrder = [];
+
+    switch (options.behavior) {
+      case BEHAVIORS.FLIP:
+        flipOrder = [placement, placementOpposite];
+        break;
+      case BEHAVIORS.CLOCKWISE:
+        flipOrder = clockwise(placement);
+        break;
+      case BEHAVIORS.COUNTERCLOCKWISE:
+        flipOrder = clockwise(placement, true);
+        break;
+      default:
+        flipOrder = options.behavior;
+    }
+
+    flipOrder.forEach(function (step, index) {
+      if (placement !== step || flipOrder.length === index + 1) {
+        return data;
+      }
+
+      placement = data.placement.split('-')[0];
+      placementOpposite = getOppositePlacement(placement);
+
+      var popperOffsets = data.offsets.popper;
+      var refOffsets = data.offsets.reference;
+
+      // using floor because the reference offsets may contain decimals we are not going to consider here
+      var floor = Math.floor;
+      var overlapsRef = placement === 'left' && floor(popperOffsets.right) > floor(refOffsets.left) || placement === 'right' && floor(popperOffsets.left) < floor(refOffsets.right) || placement === 'top' && floor(popperOffsets.bottom) > floor(refOffsets.top) || placement === 'bottom' && floor(popperOffsets.top) < floor(refOffsets.bottom);
+
+      var overflowsLeft = floor(popperOffsets.left) < floor(boundaries.left);
+      var overflowsRight = floor(popperOffsets.right) > floor(boundaries.right);
+      var overflowsTop = floor(popperOffsets.top) < floor(boundaries.top);
+      var overflowsBottom = floor(popperOffsets.bottom) > floor(boundaries.bottom);
+
+      var overflowsBoundaries = placement === 'left' && overflowsLeft || placement === 'right' && overflowsRight || placement === 'top' && overflowsTop || placement === 'bottom' && overflowsBottom;
+
+      // flip the variation if required
+      var isVertical = ['top', 'bottom'].indexOf(placement) !== -1;
+      var flippedVariation = !!options.flipVariations && (isVertical && variation === 'start' && overflowsLeft || isVertical && variation === 'end' && overflowsRight || !isVertical && variation === 'start' && overflowsTop || !isVertical && variation === 'end' && overflowsBottom);
+
+      if (overlapsRef || overflowsBoundaries || flippedVariation) {
+        // this boolean to detect any flip loop
+        data.flipped = true;
+
+        if (overlapsRef || overflowsBoundaries) {
+          placement = flipOrder[index + 1];
+        }
+
+        if (flippedVariation) {
+          variation = getOppositeVariation(variation);
+        }
+
+        data.placement = placement + (variation ? '-' + variation : '');
+
+        // this object contains `position`, we want to preserve it along with
+        // any additional property we may add in the future
+        data.offsets.popper = _extends({}, data.offsets.popper, getPopperOffsets(data.instance.popper, data.offsets.reference, data.placement));
+
+        data = runModifiers(data.instance.modifiers, data, 'flip');
+      }
+    });
+    return data;
+  }
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by update method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The data object, properly modified
+   */
+  function keepTogether(data) {
+    var _data$offsets = data.offsets,
+        popper = _data$offsets.popper,
+        reference = _data$offsets.reference;
+
+    var placement = data.placement.split('-')[0];
+    var floor = Math.floor;
+    var isVertical = ['top', 'bottom'].indexOf(placement) !== -1;
+    var side = isVertical ? 'right' : 'bottom';
+    var opSide = isVertical ? 'left' : 'top';
+    var measurement = isVertical ? 'width' : 'height';
+
+    if (popper[side] < floor(reference[opSide])) {
+      data.offsets.popper[opSide] = floor(reference[opSide]) - popper[measurement];
+    }
+    if (popper[opSide] > floor(reference[side])) {
+      data.offsets.popper[opSide] = floor(reference[side]);
+    }
+
+    return data;
+  }
+
+  /**
+   * Converts a string containing value + unit into a px value number
+   * @function
+   * @memberof {modifiers~offset}
+   * @private
+   * @argument {String} str - Value + unit string
+   * @argument {String} measurement - `height` or `width`
+   * @argument {Object} popperOffsets
+   * @argument {Object} referenceOffsets
+   * @returns {Number|String}
+   * Value in pixels, or original string if no values were extracted
+   */
+  function toValue(str, measurement, popperOffsets, referenceOffsets) {
+    // separate value from unit
+    var split = str.match(/((?:\-|\+)?\d*\.?\d*)(.*)/);
+    var value = +split[1];
+    var unit = split[2];
+
+    // If it's not a number it's an operator, I guess
+    if (!value) {
+      return str;
+    }
+
+    if (unit.indexOf('%') === 0) {
+      var element = void 0;
+      switch (unit) {
+        case '%p':
+          element = popperOffsets;
+          break;
+        case '%':
+        case '%r':
+        default:
+          element = referenceOffsets;
+      }
+
+      var rect = getClientRect(element);
+      return rect[measurement] / 100 * value;
+    } else if (unit === 'vh' || unit === 'vw') {
+      // if is a vh or vw, we calculate the size based on the viewport
+      var size = void 0;
+      if (unit === 'vh') {
+        size = Math.max(document.documentElement.clientHeight, window.innerHeight || 0);
+      } else {
+        size = Math.max(document.documentElement.clientWidth, window.innerWidth || 0);
+      }
+      return size / 100 * value;
+    } else {
+      // if is an explicit pixel unit, we get rid of the unit and keep the value
+      // if is an implicit unit, it's px, and we return just the value
+      return value;
+    }
+  }
+
+  /**
+   * Parse an `offset` string to extrapolate `x` and `y` numeric offsets.
+   * @function
+   * @memberof {modifiers~offset}
+   * @private
+   * @argument {String} offset
+   * @argument {Object} popperOffsets
+   * @argument {Object} referenceOffsets
+   * @argument {String} basePlacement
+   * @returns {Array} a two cells array with x and y offsets in numbers
+   */
+  function parseOffset(offset, popperOffsets, referenceOffsets, basePlacement) {
+    var offsets = [0, 0];
+
+    // Use height if placement is left or right and index is 0 otherwise use width
+    // in this way the first offset will use an axis and the second one
+    // will use the other one
+    var useHeight = ['right', 'left'].indexOf(basePlacement) !== -1;
+
+    // Split the offset string to obtain a list of values and operands
+    // The regex addresses values with the plus or minus sign in front (+10, -20, etc)
+    var fragments = offset.split(/(\+|\-)/).map(function (frag) {
+      return frag.trim();
+    });
+
+    // Detect if the offset string contains a pair of values or a single one
+    // they could be separated by comma or space
+    var divider = fragments.indexOf(find(fragments, function (frag) {
+      return frag.search(/,|\s/) !== -1;
+    }));
+
+    if (fragments[divider] && fragments[divider].indexOf(',') === -1) {
+      console.warn('Offsets separated by white space(s) are deprecated, use a comma (,) instead.');
+    }
+
+    // If divider is found, we divide the list of values and operands to divide
+    // them by ofset X and Y.
+    var splitRegex = /\s*,\s*|\s+/;
+    var ops = divider !== -1 ? [fragments.slice(0, divider).concat([fragments[divider].split(splitRegex)[0]]), [fragments[divider].split(splitRegex)[1]].concat(fragments.slice(divider + 1))] : [fragments];
+
+    // Convert the values with units to absolute pixels to allow our computations
+    ops = ops.map(function (op, index) {
+      // Most of the units rely on the orientation of the popper
+      var measurement = (index === 1 ? !useHeight : useHeight) ? 'height' : 'width';
+      var mergeWithPrevious = false;
+      return op
+      // This aggregates any `+` or `-` sign that aren't considered operators
+      // e.g.: 10 + +5 => [10, +, +5]
+      .reduce(function (a, b) {
+        if (a[a.length - 1] === '' && ['+', '-'].indexOf(b) !== -1) {
+          a[a.length - 1] = b;
+          mergeWithPrevious = true;
+          return a;
+        } else if (mergeWithPrevious) {
+          a[a.length - 1] += b;
+          mergeWithPrevious = false;
+          return a;
+        } else {
+          return a.concat(b);
+        }
+      }, [])
+      // Here we convert the string values into number values (in px)
+      .map(function (str) {
+        return toValue(str, measurement, popperOffsets, referenceOffsets);
+      });
+    });
+
+    // Loop trough the offsets arrays and execute the operations
+    ops.forEach(function (op, index) {
+      op.forEach(function (frag, index2) {
+        if (isNumeric(frag)) {
+          offsets[index] += frag * (op[index2 - 1] === '-' ? -1 : 1);
+        }
+      });
+    });
+    return offsets;
+  }
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by update method
+   * @argument {Object} options - Modifiers configuration and options
+   * @argument {Number|String} options.offset=0
+   * The offset value as described in the modifier description
+   * @returns {Object} The data object, properly modified
+   */
+  function offset(data, _ref) {
+    var offset = _ref.offset;
+    var placement = data.placement,
+        _data$offsets = data.offsets,
+        popper = _data$offsets.popper,
+        reference = _data$offsets.reference;
+
+    var basePlacement = placement.split('-')[0];
+
+    var offsets = void 0;
+    if (isNumeric(+offset)) {
+      offsets = [+offset, 0];
+    } else {
+      offsets = parseOffset(offset, popper, reference, basePlacement);
+    }
+
+    if (basePlacement === 'left') {
+      popper.top += offsets[0];
+      popper.left -= offsets[1];
+    } else if (basePlacement === 'right') {
+      popper.top += offsets[0];
+      popper.left += offsets[1];
+    } else if (basePlacement === 'top') {
+      popper.left += offsets[0];
+      popper.top -= offsets[1];
+    } else if (basePlacement === 'bottom') {
+      popper.left += offsets[0];
+      popper.top += offsets[1];
+    }
+
+    data.popper = popper;
+    return data;
+  }
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by `update` method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The data object, properly modified
+   */
+  function preventOverflow(data, options) {
+    var boundariesElement = options.boundariesElement || getOffsetParent(data.instance.popper);
+
+    // If offsetParent is the reference element, we really want to
+    // go one step up and use the next offsetParent as reference to
+    // avoid to make this modifier completely useless and look like broken
+    if (data.instance.reference === boundariesElement) {
+      boundariesElement = getOffsetParent(boundariesElement);
+    }
+
+    // NOTE: DOM access here
+    // resets the popper's position so that the document size can be calculated excluding
+    // the size of the popper element itself
+    var transformProp = getSupportedPropertyName('transform');
+    var popperStyles = data.instance.popper.style; // assignment to help minification
+    var top = popperStyles.top,
+        left = popperStyles.left,
+        transform = popperStyles[transformProp];
+
+    popperStyles.top = '';
+    popperStyles.left = '';
+    popperStyles[transformProp] = '';
+
+    var boundaries = getBoundaries(data.instance.popper, data.instance.reference, options.padding, boundariesElement, data.positionFixed);
+
+    // NOTE: DOM access here
+    // restores the original style properties after the offsets have been computed
+    popperStyles.top = top;
+    popperStyles.left = left;
+    popperStyles[transformProp] = transform;
+
+    options.boundaries = boundaries;
+
+    var order = options.priority;
+    var popper = data.offsets.popper;
+
+    var check = {
+      primary: function primary(placement) {
+        var value = popper[placement];
+        if (popper[placement] < boundaries[placement] && !options.escapeWithReference) {
+          value = Math.max(popper[placement], boundaries[placement]);
+        }
+        return defineProperty({}, placement, value);
+      },
+      secondary: function secondary(placement) {
+        var mainSide = placement === 'right' ? 'left' : 'top';
+        var value = popper[mainSide];
+        if (popper[placement] > boundaries[placement] && !options.escapeWithReference) {
+          value = Math.min(popper[mainSide], boundaries[placement] - (placement === 'right' ? popper.width : popper.height));
+        }
+        return defineProperty({}, mainSide, value);
+      }
+    };
+
+    order.forEach(function (placement) {
+      var side = ['left', 'top'].indexOf(placement) !== -1 ? 'primary' : 'secondary';
+      popper = _extends({}, popper, check[side](placement));
+    });
+
+    data.offsets.popper = popper;
+
+    return data;
+  }
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by `update` method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The data object, properly modified
+   */
+  function shift(data) {
+    var placement = data.placement;
+    var basePlacement = placement.split('-')[0];
+    var shiftvariation = placement.split('-')[1];
+
+    // if shift shiftvariation is specified, run the modifier
+    if (shiftvariation) {
+      var _data$offsets = data.offsets,
+          reference = _data$offsets.reference,
+          popper = _data$offsets.popper;
+
+      var isVertical = ['bottom', 'top'].indexOf(basePlacement) !== -1;
+      var side = isVertical ? 'left' : 'top';
+      var measurement = isVertical ? 'width' : 'height';
+
+      var shiftOffsets = {
+        start: defineProperty({}, side, reference[side]),
+        end: defineProperty({}, side, reference[side] + reference[measurement] - popper[measurement])
+      };
+
+      data.offsets.popper = _extends({}, popper, shiftOffsets[shiftvariation]);
+    }
+
+    return data;
+  }
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by update method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The data object, properly modified
+   */
+  function hide(data) {
+    if (!isModifierRequired(data.instance.modifiers, 'hide', 'preventOverflow')) {
+      return data;
+    }
+
+    var refRect = data.offsets.reference;
+    var bound = find(data.instance.modifiers, function (modifier) {
+      return modifier.name === 'preventOverflow';
+    }).boundaries;
+
+    if (refRect.bottom < bound.top || refRect.left > bound.right || refRect.top > bound.bottom || refRect.right < bound.left) {
+      // Avoid unnecessary DOM access if visibility hasn't changed
+      if (data.hide === true) {
+        return data;
+      }
+
+      data.hide = true;
+      data.attributes['x-out-of-boundaries'] = '';
+    } else {
+      // Avoid unnecessary DOM access if visibility hasn't changed
+      if (data.hide === false) {
+        return data;
+      }
+
+      data.hide = false;
+      data.attributes['x-out-of-boundaries'] = false;
+    }
+
+    return data;
+  }
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by `update` method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The data object, properly modified
+   */
+  function inner(data) {
+    var placement = data.placement;
+    var basePlacement = placement.split('-')[0];
+    var _data$offsets = data.offsets,
+        popper = _data$offsets.popper,
+        reference = _data$offsets.reference;
+
+    var isHoriz = ['left', 'right'].indexOf(basePlacement) !== -1;
+
+    var subtractLength = ['top', 'left'].indexOf(basePlacement) === -1;
+
+    popper[isHoriz ? 'left' : 'top'] = reference[basePlacement] - (subtractLength ? popper[isHoriz ? 'width' : 'height'] : 0);
+
+    data.placement = getOppositePlacement(placement);
+    data.offsets.popper = getClientRect(popper);
+
+    return data;
+  }
+
+  /**
+   * Modifier function, each modifier can have a function of this type assigned
+   * to its `fn` property.<br />
+   * These functions will be called on each update, this means that you must
+   * make sure they are performant enough to avoid performance bottlenecks.
+   *
+   * @function ModifierFn
+   * @argument {dataObject} data - The data object generated by `update` method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {dataObject} The data object, properly modified
+   */
+
+  /**
+   * Modifiers are plugins used to alter the behavior of your poppers.<br />
+   * Popper.js uses a set of 9 modifiers to provide all the basic functionalities
+   * needed by the library.
+   *
+   * Usually you don't want to override the `order`, `fn` and `onLoad` props.
+   * All the other properties are configurations that could be tweaked.
+   * @namespace modifiers
+   */
+  var modifiers = {
+    /**
+     * Modifier used to shift the popper on the start or end of its reference
+     * element.<br />
+     * It will read the variation of the `placement` property.<br />
+     * It can be one either `-end` or `-start`.
+     * @memberof modifiers
+     * @inner
+     */
+    shift: {
+      /** @prop {number} order=100 - Index used to define the order of execution */
+      order: 100,
+      /** @prop {Boolean} enabled=true - Whether the modifier is enabled or not */
+      enabled: true,
+      /** @prop {ModifierFn} */
+      fn: shift
+    },
+
+    /**
+     * The `offset` modifier can shift your popper on both its axis.
+     *
+     * It accepts the following units:
+     * - `px` or unitless, interpreted as pixels
+     * - `%` or `%r`, percentage relative to the length of the reference element
+     * - `%p`, percentage relative to the length of the popper element
+     * - `vw`, CSS viewport width unit
+     * - `vh`, CSS viewport height unit
+     *
+     * For length is intended the main axis relative to the placement of the popper.<br />
+     * This means that if the placement is `top` or `bottom`, the length will be the
+     * `width`. In case of `left` or `right`, it will be the height.
+     *
+     * You can provide a single value (as `Number` or `String`), or a pair of values
+     * as `String` divided by a comma or one (or more) white spaces.<br />
+     * The latter is a deprecated method because it leads to confusion and will be
+     * removed in v2.<br />
+     * Additionally, it accepts additions and subtractions between different units.
+     * Note that multiplications and divisions aren't supported.
+     *
+     * Valid examples are:
+     * ```
+     * 10
+     * '10%'
+     * '10, 10'
+     * '10%, 10'
+     * '10 + 10%'
+     * '10 - 5vh + 3%'
+     * '-10px + 5vh, 5px - 6%'
+     * ```
+     * > **NB**: If you desire to apply offsets to your poppers in a way that may make them overlap
+     * > with their reference element, unfortunately, you will have to disable the `flip` modifier.
+     * > More on this [reading this issue](https://github.com/FezVrasta/popper.js/issues/373)
+     *
+     * @memberof modifiers
+     * @inner
+     */
+    offset: {
+      /** @prop {number} order=200 - Index used to define the order of execution */
+      order: 200,
+      /** @prop {Boolean} enabled=true - Whether the modifier is enabled or not */
+      enabled: true,
+      /** @prop {ModifierFn} */
+      fn: offset,
+      /** @prop {Number|String} offset=0
+       * The offset value as described in the modifier description
+       */
+      offset: 0
+    },
+
+    /**
+     * Modifier used to prevent the popper from being positioned outside the boundary.
+     *
+     * An scenario exists where the reference itself is not within the boundaries.<br />
+     * We can say it has "escaped the boundaries" — or just "escaped".<br />
+     * In this case we need to decide whether the popper should either:
+     *
+     * - detach from the reference and remain "trapped" in the boundaries, or
+     * - if it should ignore the boundary and "escape with its reference"
+     *
+     * When `escapeWithReference` is set to`true` and reference is completely
+     * outside its boundaries, the popper will overflow (or completely leave)
+     * the boundaries in order to remain attached to the edge of the reference.
+     *
+     * @memberof modifiers
+     * @inner
+     */
+    preventOverflow: {
+      /** @prop {number} order=300 - Index used to define the order of execution */
+      order: 300,
+      /** @prop {Boolean} enabled=true - Whether the modifier is enabled or not */
+      enabled: true,
+      /** @prop {ModifierFn} */
+      fn: preventOverflow,
+      /**
+       * @prop {Array} [priority=['left','right','top','bottom']]
+       * Popper will try to prevent overflow following these priorities by default,
+       * then, it could overflow on the left and on top of the `boundariesElement`
+       */
+      priority: ['left', 'right', 'top', 'bottom'],
+      /**
+       * @prop {number} padding=5
+       * Amount of pixel used to define a minimum distance between the boundaries
+       * and the popper this makes sure the popper has always a little padding
+       * between the edges of its container
+       */
+      padding: 5,
+      /**
+       * @prop {String|HTMLElement} boundariesElement='scrollParent'
+       * Boundaries used by the modifier, can be `scrollParent`, `window`,
+       * `viewport` or any DOM element.
+       */
+      boundariesElement: 'scrollParent'
+    },
+
+    /**
+     * Modifier used to make sure the reference and its popper stay near eachothers
+     * without leaving any gap between the two. Expecially useful when the arrow is
+     * enabled and you want to assure it to point to its reference element.
+     * It cares only about the first axis, you can still have poppers with margin
+     * between the popper and its reference element.
+     * @memberof modifiers
+     * @inner
+     */
+    keepTogether: {
+      /** @prop {number} order=400 - Index used to define the order of execution */
+      order: 400,
+      /** @prop {Boolean} enabled=true - Whether the modifier is enabled or not */
+      enabled: true,
+      /** @prop {ModifierFn} */
+      fn: keepTogether
+    },
+
+    /**
+     * This modifier is used to move the `arrowElement` of the popper to make
+     * sure it is positioned between the reference element and its popper element.
+     * It will read the outer size of the `arrowElement` node to detect how many
+     * pixels of conjuction are needed.
+     *
+     * It has no effect if no `arrowElement` is provided.
+     * @memberof modifiers
+     * @inner
+     */
+    arrow: {
+      /** @prop {number} order=500 - Index used to define the order of execution */
+      order: 500,
+      /** @prop {Boolean} enabled=true - Whether the modifier is enabled or not */
+      enabled: true,
+      /** @prop {ModifierFn} */
+      fn: arrow,
+      /** @prop {String|HTMLElement} element='[x-arrow]' - Selector or node used as arrow */
+      element: '[x-arrow]'
+    },
+
+    /**
+     * Modifier used to flip the popper's placement when it starts to overlap its
+     * reference element.
+     *
+     * Requires the `preventOverflow` modifier before it in order to work.
+     *
+     * **NOTE:** this modifier will interrupt the current update cycle and will
+     * restart it if it detects the need to flip the placement.
+     * @memberof modifiers
+     * @inner
+     */
+    flip: {
+      /** @prop {number} order=600 - Index used to define the order of execution */
+      order: 600,
+      /** @prop {Boolean} enabled=true - Whether the modifier is enabled or not */
+      enabled: true,
+      /** @prop {ModifierFn} */
+      fn: flip,
+      /**
+       * @prop {String|Array} behavior='flip'
+       * The behavior used to change the popper's placement. It can be one of
+       * `flip`, `clockwise`, `counterclockwise` or an array with a list of valid
+       * placements (with optional variations).
+       */
+      behavior: 'flip',
+      /**
+       * @prop {number} padding=5
+       * The popper will flip if it hits the edges of the `boundariesElement`
+       */
+      padding: 5,
+      /**
+       * @prop {String|HTMLElement} boundariesElement='viewport'
+       * The element which will define the boundaries of the popper position,
+       * the popper will never be placed outside of the defined boundaries
+       * (except if keepTogether is enabled)
+       */
+      boundariesElement: 'viewport'
+    },
+
+    /**
+     * Modifier used to make the popper flow toward the inner of the reference element.
+     * By default, when this modifier is disabled, the popper will be placed outside
+     * the reference element.
+     * @memberof modifiers
+     * @inner
+     */
+    inner: {
+      /** @prop {number} order=700 - Index used to define the order of execution */
+      order: 700,
+      /** @prop {Boolean} enabled=false - Whether the modifier is enabled or not */
+      enabled: false,
+      /** @prop {ModifierFn} */
+      fn: inner
+    },
+
+    /**
+     * Modifier used to hide the popper when its reference element is outside of the
+     * popper boundaries. It will set a `x-out-of-boundaries` attribute which can
+     * be used to hide with a CSS selector the popper when its reference is
+     * out of boundaries.
+     *
+     * Requires the `preventOverflow` modifier before it in order to work.
+     * @memberof modifiers
+     * @inner
+     */
+    hide: {
+      /** @prop {number} order=800 - Index used to define the order of execution */
+      order: 800,
+      /** @prop {Boolean} enabled=true - Whether the modifier is enabled or not */
+      enabled: true,
+      /** @prop {ModifierFn} */
+      fn: hide
+    },
+
+    /**
+     * Computes the style that will be applied to the popper element to gets
+     * properly positioned.
+     *
+     * Note that this modifier will not touch the DOM, it just prepares the styles
+     * so that `applyStyle` modifier can apply it. This separation is useful
+     * in case you need to replace `applyStyle` with a custom implementation.
+     *
+     * This modifier has `850` as `order` value to maintain backward compatibility
+     * with previous versions of Popper.js. Expect the modifiers ordering method
+     * to change in future major versions of the library.
+     *
+     * @memberof modifiers
+     * @inner
+     */
+    computeStyle: {
+      /** @prop {number} order=850 - Index used to define the order of execution */
+      order: 850,
+      /** @prop {Boolean} enabled=true - Whether the modifier is enabled or not */
+      enabled: true,
+      /** @prop {ModifierFn} */
+      fn: computeStyle,
+      /**
+       * @prop {Boolean} gpuAcceleration=true
+       * If true, it uses the CSS 3d transformation to position the popper.
+       * Otherwise, it will use the `top` and `left` properties.
+       */
+      gpuAcceleration: true,
+      /**
+       * @prop {string} [x='bottom']
+       * Where to anchor the X axis (`bottom` or `top`). AKA X offset origin.
+       * Change this if your popper should grow in a direction different from `bottom`
+       */
+      x: 'bottom',
+      /**
+       * @prop {string} [x='left']
+       * Where to anchor the Y axis (`left` or `right`). AKA Y offset origin.
+       * Change this if your popper should grow in a direction different from `right`
+       */
+      y: 'right'
+    },
+
+    /**
+     * Applies the computed styles to the popper element.
+     *
+     * All the DOM manipulations are limited to this modifier. This is useful in case
+     * you want to integrate Popper.js inside a framework or view library and you
+     * want to delegate all the DOM manipulations to it.
+     *
+     * Note that if you disable this modifier, you must make sure the popper element
+     * has its position set to `absolute` before Popper.js can do its work!
+     *
+     * Just disable this modifier and define you own to achieve the desired effect.
+     *
+     * @memberof modifiers
+     * @inner
+     */
+    applyStyle: {
+      /** @prop {number} order=900 - Index used to define the order of execution */
+      order: 900,
+      /** @prop {Boolean} enabled=true - Whether the modifier is enabled or not */
+      enabled: true,
+      /** @prop {ModifierFn} */
+      fn: applyStyle,
+      /** @prop {Function} */
+      onLoad: applyStyleOnLoad,
+      /**
+       * @deprecated since version 1.10.0, the property moved to `computeStyle` modifier
+       * @prop {Boolean} gpuAcceleration=true
+       * If true, it uses the CSS 3d transformation to position the popper.
+       * Otherwise, it will use the `top` and `left` properties.
+       */
+      gpuAcceleration: undefined
+    }
+  };
+
+  /**
+   * The `dataObject` is an object containing all the informations used by Popper.js
+   * this object get passed to modifiers and to the `onCreate` and `onUpdate` callbacks.
+   * @name dataObject
+   * @property {Object} data.instance The Popper.js instance
+   * @property {String} data.placement Placement applied to popper
+   * @property {String} data.originalPlacement Placement originally defined on init
+   * @property {Boolean} data.flipped True if popper has been flipped by flip modifier
+   * @property {Boolean} data.hide True if the reference element is out of boundaries, useful to know when to hide the popper.
+   * @property {HTMLElement} data.arrowElement Node used as arrow by arrow modifier
+   * @property {Object} data.styles Any CSS property defined here will be applied to the popper, it expects the JavaScript nomenclature (eg. `marginBottom`)
+   * @property {Object} data.arrowStyles Any CSS property defined here will be applied to the popper arrow, it expects the JavaScript nomenclature (eg. `marginBottom`)
+   * @property {Object} data.boundaries Offsets of the popper boundaries
+   * @property {Object} data.offsets The measurements of popper, reference and arrow elements.
+   * @property {Object} data.offsets.popper `top`, `left`, `width`, `height` values
+   * @property {Object} data.offsets.reference `top`, `left`, `width`, `height` values
+   * @property {Object} data.offsets.arrow] `top` and `left` offsets, only one of them will be different from 0
+   */
+
+  /**
+   * Default options provided to Popper.js constructor.<br />
+   * These can be overriden using the `options` argument of Popper.js.<br />
+   * To override an option, simply pass as 3rd argument an object with the same
+   * structure of this object, example:
+   * ```
+   * new Popper(ref, pop, {
+   *   modifiers: {
+   *     preventOverflow: { enabled: false }
+   *   }
+   * })
+   * ```
+   * @type {Object}
+   * @static
+   * @memberof Popper
+   */
+  var Defaults = {
+    /**
+     * Popper's placement
+     * @prop {Popper.placements} placement='bottom'
+     */
+    placement: 'bottom',
+
+    /**
+     * Set this to true if you want popper to position it self in 'fixed' mode
+     * @prop {Boolean} positionFixed=false
+     */
+    positionFixed: false,
+
+    /**
+     * Whether events (resize, scroll) are initially enabled
+     * @prop {Boolean} eventsEnabled=true
+     */
+    eventsEnabled: true,
+
+    /**
+     * Set to true if you want to automatically remove the popper when
+     * you call the `destroy` method.
+     * @prop {Boolean} removeOnDestroy=false
+     */
+    removeOnDestroy: false,
+
+    /**
+     * Callback called when the popper is created.<br />
+     * By default, is set to no-op.<br />
+     * Access Popper.js instance with `data.instance`.
+     * @prop {onCreate}
+     */
+    onCreate: function onCreate() {},
+
+    /**
+     * Callback called when the popper is updated, this callback is not called
+     * on the initialization/creation of the popper, but only on subsequent
+     * updates.<br />
+     * By default, is set to no-op.<br />
+     * Access Popper.js instance with `data.instance`.
+     * @prop {onUpdate}
+     */
+    onUpdate: function onUpdate() {},
+
+    /**
+     * List of modifiers used to modify the offsets before they are applied to the popper.
+     * They provide most of the functionalities of Popper.js
+     * @prop {modifiers}
+     */
+    modifiers: modifiers
+  };
+
+  /**
+   * @callback onCreate
+   * @param {dataObject} data
+   */
+
+  /**
+   * @callback onUpdate
+   * @param {dataObject} data
+   */
+
+  // Utils
+  // Methods
+  var Popper = function () {
+    /**
+     * Create a new Popper.js instance
+     * @class Popper
+     * @param {HTMLElement|referenceObject} reference - The reference element used to position the popper
+     * @param {HTMLElement} popper - The HTML element used as popper.
+     * @param {Object} options - Your custom options to override the ones defined in [Defaults](#defaults)
+     * @return {Object} instance - The generated Popper.js instance
+     */
+    function Popper(reference, popper) {
+      var _this = this;
+
+      var options = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
+      classCallCheck(this, Popper);
+
+      this.scheduleUpdate = function () {
+        return requestAnimationFrame(_this.update);
+      };
+
+      // make update() debounced, so that it only runs at most once-per-tick
+      this.update = debounce(this.update.bind(this));
+
+      // with {} we create a new object with the options inside it
+      this.options = _extends({}, Popper.Defaults, options);
+
+      // init state
+      this.state = {
+        isDestroyed: false,
+        isCreated: false,
+        scrollParents: []
+      };
+
+      // get reference and popper elements (allow jQuery wrappers)
+      this.reference = reference && reference.jquery ? reference[0] : reference;
+      this.popper = popper && popper.jquery ? popper[0] : popper;
+
+      // Deep merge modifiers options
+      this.options.modifiers = {};
+      Object.keys(_extends({}, Popper.Defaults.modifiers, options.modifiers)).forEach(function (name) {
+        _this.options.modifiers[name] = _extends({}, Popper.Defaults.modifiers[name] || {}, options.modifiers ? options.modifiers[name] : {});
+      });
+
+      // Refactoring modifiers' list (Object => Array)
+      this.modifiers = Object.keys(this.options.modifiers).map(function (name) {
+        return _extends({
+          name: name
+        }, _this.options.modifiers[name]);
+      })
+      // sort the modifiers by order
+      .sort(function (a, b) {
+        return a.order - b.order;
+      });
+
+      // modifiers have the ability to execute arbitrary code when Popper.js get inited
+      // such code is executed in the same order of its modifier
+      // they could add new properties to their options configuration
+      // BE AWARE: don't add options to `options.modifiers.name` but to `modifierOptions`!
+      this.modifiers.forEach(function (modifierOptions) {
+        if (modifierOptions.enabled && isFunction(modifierOptions.onLoad)) {
+          modifierOptions.onLoad(_this.reference, _this.popper, _this.options, modifierOptions, _this.state);
+        }
+      });
+
+      // fire the first update to position the popper in the right place
+      this.update();
+
+      var eventsEnabled = this.options.eventsEnabled;
+      if (eventsEnabled) {
+        // setup event listeners, they will take care of update the position in specific situations
+        this.enableEventListeners();
+      }
+
+      this.state.eventsEnabled = eventsEnabled;
+    }
+
+    // We can't use class properties because they don't get listed in the
+    // class prototype and break stuff like Sinon stubs
+
+
+    createClass(Popper, [{
+      key: 'update',
+      value: function update$$1() {
+        return update.call(this);
+      }
+    }, {
+      key: 'destroy',
+      value: function destroy$$1() {
+        return destroy.call(this);
+      }
+    }, {
+      key: 'enableEventListeners',
+      value: function enableEventListeners$$1() {
+        return enableEventListeners.call(this);
+      }
+    }, {
+      key: 'disableEventListeners',
+      value: function disableEventListeners$$1() {
+        return disableEventListeners.call(this);
+      }
+
+      /**
+       * Schedule an update, it will run on the next UI update available
+       * @method scheduleUpdate
+       * @memberof Popper
+       */
+
+
+      /**
+       * Collection of utilities useful when writing custom modifiers.
+       * Starting from version 1.7, this method is available only if you
+       * include `popper-utils.js` before `popper.js`.
+       *
+       * **DEPRECATION**: This way to access PopperUtils is deprecated
+       * and will be removed in v2! Use the PopperUtils module directly instead.
+       * Due to the high instability of the methods contained in Utils, we can't
+       * guarantee them to follow semver. Use them at your own risk!
+       * @static
+       * @private
+       * @type {Object}
+       * @deprecated since version 1.8
+       * @member Utils
+       * @memberof Popper
+       */
+
+    }]);
+    return Popper;
+  }();
+
+  /**
+   * The `referenceObject` is an object that provides an interface compatible with Popper.js
+   * and lets you use it as replacement of a real DOM node.<br />
+   * You can use this method to position a popper relatively to a set of coordinates
+   * in case you don't have a DOM node to use as reference.
+   *
+   * ```
+   * new Popper(referenceObject, popperNode);
+   * ```
+   *
+   * NB: This feature isn't supported in Internet Explorer 10
+   * @name referenceObject
+   * @property {Function} data.getBoundingClientRect
+   * A function that returns a set of coordinates compatible with the native `getBoundingClientRect` method.
+   * @property {number} data.clientWidth
+   * An ES6 getter that will return the width of the virtual reference element.
+   * @property {number} data.clientHeight
+   * An ES6 getter that will return the height of the virtual reference element.
+   */
+
+
+  Popper.Utils = (typeof window !== 'undefined' ? window : global).PopperUtils;
+  Popper.placements = placements;
+  Popper.Defaults = Defaults;
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): dropdown.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Dropdown = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'dropdown';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.dropdown';
+    var EVENT_KEY = "." + DATA_KEY;
+    var DATA_API_KEY = '.data-api';
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var ESCAPE_KEYCODE = 27; // KeyboardEvent.which value for Escape (Esc) key
+
+    var SPACE_KEYCODE = 32; // KeyboardEvent.which value for space key
+
+    var TAB_KEYCODE = 9; // KeyboardEvent.which value for tab key
+
+    var ARROW_UP_KEYCODE = 38; // KeyboardEvent.which value for up arrow key
+
+    var ARROW_DOWN_KEYCODE = 40; // KeyboardEvent.which value for down arrow key
+
+    var RIGHT_MOUSE_BUTTON_WHICH = 3; // MouseEvent.which value for the right button (assuming a right-handed mouse)
+
+    var REGEXP_KEYDOWN = new RegExp(ARROW_UP_KEYCODE + "|" + ARROW_DOWN_KEYCODE + "|" + ESCAPE_KEYCODE);
+    var Event = {
+      HIDE: "hide" + EVENT_KEY,
+      HIDDEN: "hidden" + EVENT_KEY,
+      SHOW: "show" + EVENT_KEY,
+      SHOWN: "shown" + EVENT_KEY,
+      CLICK: "click" + EVENT_KEY,
+      CLICK_DATA_API: "click" + EVENT_KEY + DATA_API_KEY,
+      KEYDOWN_DATA_API: "keydown" + EVENT_KEY + DATA_API_KEY,
+      KEYUP_DATA_API: "keyup" + EVENT_KEY + DATA_API_KEY
+    };
+    var ClassName = {
+      DISABLED: 'disabled',
+      SHOW: 'show',
+      DROPUP: 'dropup',
+      DROPRIGHT: 'dropright',
+      DROPLEFT: 'dropleft',
+      MENURIGHT: 'dropdown-menu-right',
+      MENULEFT: 'dropdown-menu-left',
+      POSITION_STATIC: 'position-static'
+    };
+    var Selector = {
+      DATA_TOGGLE: '[data-toggle="dropdown"]',
+      FORM_CHILD: '.dropdown form',
+      MENU: '.dropdown-menu',
+      NAVBAR_NAV: '.navbar-nav',
+      VISIBLE_ITEMS: '.dropdown-menu .dropdown-item:not(.disabled):not(:disabled)'
+    };
+    var AttachmentMap = {
+      TOP: 'top-start',
+      TOPEND: 'top-end',
+      BOTTOM: 'bottom-start',
+      BOTTOMEND: 'bottom-end',
+      RIGHT: 'right-start',
+      RIGHTEND: 'right-end',
+      LEFT: 'left-start',
+      LEFTEND: 'left-end'
+    };
+    var Default = {
+      offset: 0,
+      flip: true,
+      boundary: 'scrollParent',
+      reference: 'toggle',
+      display: 'dynamic'
+    };
+    var DefaultType = {
+      offset: '(number|string|function)',
+      flip: 'boolean',
+      boundary: '(string|element)',
+      reference: '(string|element)',
+      display: 'string'
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var Dropdown =
+    /*#__PURE__*/
+    function () {
+      function Dropdown(element, config) {
+        this._element = element;
+        this._popper = null;
+        this._config = this._getConfig(config);
+        this._menu = this._getMenuElement();
+        this._inNavbar = this._detectNavbar();
+
+        this._addEventListeners();
+      } // Getters
+
+
+      var _proto = Dropdown.prototype;
+
+      // Public
+      _proto.toggle = function toggle() {
+        if (this._element.disabled || $$$1(this._element).hasClass(ClassName.DISABLED)) {
+          return;
+        }
+
+        var parent = Dropdown._getParentFromElement(this._element);
+
+        var isActive = $$$1(this._menu).hasClass(ClassName.SHOW);
+
+        Dropdown._clearMenus();
+
+        if (isActive) {
+          return;
+        }
+
+        var relatedTarget = {
+          relatedTarget: this._element
+        };
+        var showEvent = $$$1.Event(Event.SHOW, relatedTarget);
+        $$$1(parent).trigger(showEvent);
+
+        if (showEvent.isDefaultPrevented()) {
+          return;
+        } // Disable totally Popper.js for Dropdown in Navbar
+
+
+        if (!this._inNavbar) {
+          /**
+           * Check for Popper dependency
+           * Popper - https://popper.js.org
+           */
+          if (typeof Popper === 'undefined') {
+            throw new TypeError('Bootstrap dropdown require Popper.js (https://popper.js.org)');
+          }
+
+          var referenceElement = this._element;
+
+          if (this._config.reference === 'parent') {
+            referenceElement = parent;
+          } else if (Util.isElement(this._config.reference)) {
+            referenceElement = this._config.reference; // Check if it's jQuery element
+
+            if (typeof this._config.reference.jquery !== 'undefined') {
+              referenceElement = this._config.reference[0];
+            }
+          } // If boundary is not `scrollParent`, then set position to `static`
+          // to allow the menu to "escape" the scroll parent's boundaries
+          // https://github.com/twbs/bootstrap/issues/24251
+
+
+          if (this._config.boundary !== 'scrollParent') {
+            $$$1(parent).addClass(ClassName.POSITION_STATIC);
+          }
+
+          this._popper = new Popper(referenceElement, this._menu, this._getPopperConfig());
+        } // If this is a touch-enabled device we add extra
+        // empty mouseover listeners to the body's immediate children;
+        // only needed because of broken event delegation on iOS
+        // https://www.quirksmode.org/blog/archives/2014/02/mouse_event_bub.html
+
+
+        if ('ontouchstart' in document.documentElement && $$$1(parent).closest(Selector.NAVBAR_NAV).length === 0) {
+          $$$1(document.body).children().on('mouseover', null, $$$1.noop);
+        }
+
+        this._element.focus();
+
+        this._element.setAttribute('aria-expanded', true);
+
+        $$$1(this._menu).toggleClass(ClassName.SHOW);
+        $$$1(parent).toggleClass(ClassName.SHOW).trigger($$$1.Event(Event.SHOWN, relatedTarget));
+      };
+
+      _proto.dispose = function dispose() {
+        $$$1.removeData(this._element, DATA_KEY);
+        $$$1(this._element).off(EVENT_KEY);
+        this._element = null;
+        this._menu = null;
+
+        if (this._popper !== null) {
+          this._popper.destroy();
+
+          this._popper = null;
+        }
+      };
+
+      _proto.update = function update() {
+        this._inNavbar = this._detectNavbar();
+
+        if (this._popper !== null) {
+          this._popper.scheduleUpdate();
+        }
+      }; // Private
+
+
+      _proto._addEventListeners = function _addEventListeners() {
+        var _this = this;
+
+        $$$1(this._element).on(Event.CLICK, function (event) {
+          event.preventDefault();
+          event.stopPropagation();
+
+          _this.toggle();
+        });
+      };
+
+      _proto._getConfig = function _getConfig(config) {
+        config = _objectSpread({}, this.constructor.Default, $$$1(this._element).data(), config);
+        Util.typeCheckConfig(NAME, config, this.constructor.DefaultType);
+        return config;
+      };
+
+      _proto._getMenuElement = function _getMenuElement() {
+        if (!this._menu) {
+          var parent = Dropdown._getParentFromElement(this._element);
+
+          if (parent) {
+            this._menu = parent.querySelector(Selector.MENU);
+          }
+        }
+
+        return this._menu;
+      };
+
+      _proto._getPlacement = function _getPlacement() {
+        var $parentDropdown = $$$1(this._element.parentNode);
+        var placement = AttachmentMap.BOTTOM; // Handle dropup
+
+        if ($parentDropdown.hasClass(ClassName.DROPUP)) {
+          placement = AttachmentMap.TOP;
+
+          if ($$$1(this._menu).hasClass(ClassName.MENURIGHT)) {
+            placement = AttachmentMap.TOPEND;
+          }
+        } else if ($parentDropdown.hasClass(ClassName.DROPRIGHT)) {
+          placement = AttachmentMap.RIGHT;
+        } else if ($parentDropdown.hasClass(ClassName.DROPLEFT)) {
+          placement = AttachmentMap.LEFT;
+        } else if ($$$1(this._menu).hasClass(ClassName.MENURIGHT)) {
+          placement = AttachmentMap.BOTTOMEND;
+        }
+
+        return placement;
+      };
+
+      _proto._detectNavbar = function _detectNavbar() {
+        return $$$1(this._element).closest('.navbar').length > 0;
+      };
+
+      _proto._getPopperConfig = function _getPopperConfig() {
+        var _this2 = this;
+
+        var offsetConf = {};
+
+        if (typeof this._config.offset === 'function') {
+          offsetConf.fn = function (data) {
+            data.offsets = _objectSpread({}, data.offsets, _this2._config.offset(data.offsets) || {});
+            return data;
+          };
+        } else {
+          offsetConf.offset = this._config.offset;
+        }
+
+        var popperConfig = {
+          placement: this._getPlacement(),
+          modifiers: {
+            offset: offsetConf,
+            flip: {
+              enabled: this._config.flip
+            },
+            preventOverflow: {
+              boundariesElement: this._config.boundary
+            }
+          } // Disable Popper.js if we have a static display
+
+        };
+
+        if (this._config.display === 'static') {
+          popperConfig.modifiers.applyStyle = {
+            enabled: false
+          };
+        }
+
+        return popperConfig;
+      }; // Static
+
+
+      Dropdown._jQueryInterface = function _jQueryInterface(config) {
+        return this.each(function () {
+          var data = $$$1(this).data(DATA_KEY);
+
+          var _config = typeof config === 'object' ? config : null;
+
+          if (!data) {
+            data = new Dropdown(this, _config);
+            $$$1(this).data(DATA_KEY, data);
+          }
+
+          if (typeof config === 'string') {
+            if (typeof data[config] === 'undefined') {
+              throw new TypeError("No method named \"" + config + "\"");
+            }
+
+            data[config]();
+          }
+        });
+      };
+
+      Dropdown._clearMenus = function _clearMenus(event) {
+        if (event && (event.which === RIGHT_MOUSE_BUTTON_WHICH || event.type === 'keyup' && event.which !== TAB_KEYCODE)) {
+          return;
+        }
+
+        var toggles = [].slice.call(document.querySelectorAll(Selector.DATA_TOGGLE));
+
+        for (var i = 0, len = toggles.length; i < len; i++) {
+          var parent = Dropdown._getParentFromElement(toggles[i]);
+
+          var context = $$$1(toggles[i]).data(DATA_KEY);
+          var relatedTarget = {
+            relatedTarget: toggles[i]
+          };
+
+          if (event && event.type === 'click') {
+            relatedTarget.clickEvent = event;
+          }
+
+          if (!context) {
+            continue;
+          }
+
+          var dropdownMenu = context._menu;
+
+          if (!$$$1(parent).hasClass(ClassName.SHOW)) {
+            continue;
+          }
+
+          if (event && (event.type === 'click' && /input|textarea/i.test(event.target.tagName) || event.type === 'keyup' && event.which === TAB_KEYCODE) && $$$1.contains(parent, event.target)) {
+            continue;
+          }
+
+          var hideEvent = $$$1.Event(Event.HIDE, relatedTarget);
+          $$$1(parent).trigger(hideEvent);
+
+          if (hideEvent.isDefaultPrevented()) {
+            continue;
+          } // If this is a touch-enabled device we remove the extra
+          // empty mouseover listeners we added for iOS support
+
+
+          if ('ontouchstart' in document.documentElement) {
+            $$$1(document.body).children().off('mouseover', null, $$$1.noop);
+          }
+
+          toggles[i].setAttribute('aria-expanded', 'false');
+          $$$1(dropdownMenu).removeClass(ClassName.SHOW);
+          $$$1(parent).removeClass(ClassName.SHOW).trigger($$$1.Event(Event.HIDDEN, relatedTarget));
+        }
+      };
+
+      Dropdown._getParentFromElement = function _getParentFromElement(element) {
+        var parent;
+        var selector = Util.getSelectorFromElement(element);
+
+        if (selector) {
+          parent = document.querySelector(selector);
+        }
+
+        return parent || element.parentNode;
+      }; // eslint-disable-next-line complexity
+
+
+      Dropdown._dataApiKeydownHandler = function _dataApiKeydownHandler(event) {
+        // If not input/textarea:
+        //  - And not a key in REGEXP_KEYDOWN => not a dropdown command
+        // If input/textarea:
+        //  - If space key => not a dropdown command
+        //  - If key is other than escape
+        //    - If key is not up or down => not a dropdown command
+        //    - If trigger inside the menu => not a dropdown command
+        if (/input|textarea/i.test(event.target.tagName) ? event.which === SPACE_KEYCODE || event.which !== ESCAPE_KEYCODE && (event.which !== ARROW_DOWN_KEYCODE && event.which !== ARROW_UP_KEYCODE || $$$1(event.target).closest(Selector.MENU).length) : !REGEXP_KEYDOWN.test(event.which)) {
+          return;
+        }
+
+        event.preventDefault();
+        event.stopPropagation();
+
+        if (this.disabled || $$$1(this).hasClass(ClassName.DISABLED)) {
+          return;
+        }
+
+        var parent = Dropdown._getParentFromElement(this);
+
+        var isActive = $$$1(parent).hasClass(ClassName.SHOW);
+
+        if (!isActive && (event.which !== ESCAPE_KEYCODE || event.which !== SPACE_KEYCODE) || isActive && (event.which === ESCAPE_KEYCODE || event.which === SPACE_KEYCODE)) {
+          if (event.which === ESCAPE_KEYCODE) {
+            var toggle = parent.querySelector(Selector.DATA_TOGGLE);
+            $$$1(toggle).trigger('focus');
+          }
+
+          $$$1(this).trigger('click');
+          return;
+        }
+
+        var items = [].slice.call(parent.querySelectorAll(Selector.VISIBLE_ITEMS));
+
+        if (items.length === 0) {
+          return;
+        }
+
+        var index = items.indexOf(event.target);
+
+        if (event.which === ARROW_UP_KEYCODE && index > 0) {
+          // Up
+          index--;
+        }
+
+        if (event.which === ARROW_DOWN_KEYCODE && index < items.length - 1) {
+          // Down
+          index++;
+        }
+
+        if (index < 0) {
+          index = 0;
+        }
+
+        items[index].focus();
+      };
+
+      _createClass(Dropdown, null, [{
+        key: "VERSION",
+        get: function get() {
+          return VERSION;
+        }
+      }, {
+        key: "Default",
+        get: function get() {
+          return Default;
+        }
+      }, {
+        key: "DefaultType",
+        get: function get() {
+          return DefaultType;
+        }
+      }]);
+
+      return Dropdown;
+    }();
+    /**
+     * ------------------------------------------------------------------------
+     * Data Api implementation
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1(document).on(Event.KEYDOWN_DATA_API, Selector.DATA_TOGGLE, Dropdown._dataApiKeydownHandler).on(Event.KEYDOWN_DATA_API, Selector.MENU, Dropdown._dataApiKeydownHandler).on(Event.CLICK_DATA_API + " " + Event.KEYUP_DATA_API, Dropdown._clearMenus).on(Event.CLICK_DATA_API, Selector.DATA_TOGGLE, function (event) {
+      event.preventDefault();
+      event.stopPropagation();
+
+      Dropdown._jQueryInterface.call($$$1(this), 'toggle');
+    }).on(Event.CLICK_DATA_API, Selector.FORM_CHILD, function (e) {
+      e.stopPropagation();
+    });
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+    $$$1.fn[NAME] = Dropdown._jQueryInterface;
+    $$$1.fn[NAME].Constructor = Dropdown;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return Dropdown._jQueryInterface;
+    };
+
+    return Dropdown;
+  }($, Popper);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): modal.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Modal = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'modal';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.modal';
+    var EVENT_KEY = "." + DATA_KEY;
+    var DATA_API_KEY = '.data-api';
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var ESCAPE_KEYCODE = 27; // KeyboardEvent.which value for Escape (Esc) key
+
+    var Default = {
+      backdrop: true,
+      keyboard: true,
+      focus: true,
+      show: true
+    };
+    var DefaultType = {
+      backdrop: '(boolean|string)',
+      keyboard: 'boolean',
+      focus: 'boolean',
+      show: 'boolean'
+    };
+    var Event = {
+      HIDE: "hide" + EVENT_KEY,
+      HIDDEN: "hidden" + EVENT_KEY,
+      SHOW: "show" + EVENT_KEY,
+      SHOWN: "shown" + EVENT_KEY,
+      FOCUSIN: "focusin" + EVENT_KEY,
+      RESIZE: "resize" + EVENT_KEY,
+      CLICK_DISMISS: "click.dismiss" + EVENT_KEY,
+      KEYDOWN_DISMISS: "keydown.dismiss" + EVENT_KEY,
+      MOUSEUP_DISMISS: "mouseup.dismiss" + EVENT_KEY,
+      MOUSEDOWN_DISMISS: "mousedown.dismiss" + EVENT_KEY,
+      CLICK_DATA_API: "click" + EVENT_KEY + DATA_API_KEY
+    };
+    var ClassName = {
+      SCROLLBAR_MEASURER: 'modal-scrollbar-measure',
+      BACKDROP: 'modal-backdrop',
+      OPEN: 'modal-open',
+      FADE: 'fade',
+      SHOW: 'show'
+    };
+    var Selector = {
+      DIALOG: '.modal-dialog',
+      DATA_TOGGLE: '[data-toggle="modal"]',
+      DATA_DISMISS: '[data-dismiss="modal"]',
+      FIXED_CONTENT: '.fixed-top, .fixed-bottom, .is-fixed, .sticky-top',
+      STICKY_CONTENT: '.sticky-top'
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var Modal =
+    /*#__PURE__*/
+    function () {
+      function Modal(element, config) {
+        this._config = this._getConfig(config);
+        this._element = element;
+        this._dialog = element.querySelector(Selector.DIALOG);
+        this._backdrop = null;
+        this._isShown = false;
+        this._isBodyOverflowing = false;
+        this._ignoreBackdropClick = false;
+        this._scrollbarWidth = 0;
+      } // Getters
+
+
+      var _proto = Modal.prototype;
+
+      // Public
+      _proto.toggle = function toggle(relatedTarget) {
+        return this._isShown ? this.hide() : this.show(relatedTarget);
+      };
+
+      _proto.show = function show(relatedTarget) {
+        var _this = this;
+
+        if (this._isTransitioning || this._isShown) {
+          return;
+        }
+
+        if ($$$1(this._element).hasClass(ClassName.FADE)) {
+          this._isTransitioning = true;
+        }
+
+        var showEvent = $$$1.Event(Event.SHOW, {
+          relatedTarget: relatedTarget
+        });
+        $$$1(this._element).trigger(showEvent);
+
+        if (this._isShown || showEvent.isDefaultPrevented()) {
+          return;
+        }
+
+        this._isShown = true;
+
+        this._checkScrollbar();
+
+        this._setScrollbar();
+
+        this._adjustDialog();
+
+        $$$1(document.body).addClass(ClassName.OPEN);
+
+        this._setEscapeEvent();
+
+        this._setResizeEvent();
+
+        $$$1(this._element).on(Event.CLICK_DISMISS, Selector.DATA_DISMISS, function (event) {
+          return _this.hide(event);
+        });
+        $$$1(this._dialog).on(Event.MOUSEDOWN_DISMISS, function () {
+          $$$1(_this._element).one(Event.MOUSEUP_DISMISS, function (event) {
+            if ($$$1(event.target).is(_this._element)) {
+              _this._ignoreBackdropClick = true;
+            }
+          });
+        });
+
+        this._showBackdrop(function () {
+          return _this._showElement(relatedTarget);
+        });
+      };
+
+      _proto.hide = function hide(event) {
+        var _this2 = this;
+
+        if (event) {
+          event.preventDefault();
+        }
+
+        if (this._isTransitioning || !this._isShown) {
+          return;
+        }
+
+        var hideEvent = $$$1.Event(Event.HIDE);
+        $$$1(this._element).trigger(hideEvent);
+
+        if (!this._isShown || hideEvent.isDefaultPrevented()) {
+          return;
+        }
+
+        this._isShown = false;
+        var transition = $$$1(this._element).hasClass(ClassName.FADE);
+
+        if (transition) {
+          this._isTransitioning = true;
+        }
+
+        this._setEscapeEvent();
+
+        this._setResizeEvent();
+
+        $$$1(document).off(Event.FOCUSIN);
+        $$$1(this._element).removeClass(ClassName.SHOW);
+        $$$1(this._element).off(Event.CLICK_DISMISS);
+        $$$1(this._dialog).off(Event.MOUSEDOWN_DISMISS);
+
+        if (transition) {
+          var transitionDuration = Util.getTransitionDurationFromElement(this._element);
+          $$$1(this._element).one(Util.TRANSITION_END, function (event) {
+            return _this2._hideModal(event);
+          }).emulateTransitionEnd(transitionDuration);
+        } else {
+          this._hideModal();
+        }
+      };
+
+      _proto.dispose = function dispose() {
+        $$$1.removeData(this._element, DATA_KEY);
+        $$$1(window, document, this._element, this._backdrop).off(EVENT_KEY);
+        this._config = null;
+        this._element = null;
+        this._dialog = null;
+        this._backdrop = null;
+        this._isShown = null;
+        this._isBodyOverflowing = null;
+        this._ignoreBackdropClick = null;
+        this._scrollbarWidth = null;
+      };
+
+      _proto.handleUpdate = function handleUpdate() {
+        this._adjustDialog();
+      }; // Private
+
+
+      _proto._getConfig = function _getConfig(config) {
+        config = _objectSpread({}, Default, config);
+        Util.typeCheckConfig(NAME, config, DefaultType);
+        return config;
+      };
+
+      _proto._showElement = function _showElement(relatedTarget) {
+        var _this3 = this;
+
+        var transition = $$$1(this._element).hasClass(ClassName.FADE);
+
+        if (!this._element.parentNode || this._element.parentNode.nodeType !== Node.ELEMENT_NODE) {
+          // Don't move modal's DOM position
+          document.body.appendChild(this._element);
+        }
+
+        this._element.style.display = 'block';
+
+        this._element.removeAttribute('aria-hidden');
+
+        this._element.scrollTop = 0;
+
+        if (transition) {
+          Util.reflow(this._element);
+        }
+
+        $$$1(this._element).addClass(ClassName.SHOW);
+
+        if (this._config.focus) {
+          this._enforceFocus();
+        }
+
+        var shownEvent = $$$1.Event(Event.SHOWN, {
+          relatedTarget: relatedTarget
+        });
+
+        var transitionComplete = function transitionComplete() {
+          if (_this3._config.focus) {
+            _this3._element.focus();
+          }
+
+          _this3._isTransitioning = false;
+          $$$1(_this3._element).trigger(shownEvent);
+        };
+
+        if (transition) {
+          var transitionDuration = Util.getTransitionDurationFromElement(this._element);
+          $$$1(this._dialog).one(Util.TRANSITION_END, transitionComplete).emulateTransitionEnd(transitionDuration);
+        } else {
+          transitionComplete();
+        }
+      };
+
+      _proto._enforceFocus = function _enforceFocus() {
+        var _this4 = this;
+
+        $$$1(document).off(Event.FOCUSIN) // Guard against infinite focus loop
+        .on(Event.FOCUSIN, function (event) {
+          if (document !== event.target && _this4._element !== event.target && $$$1(_this4._element).has(event.target).length === 0) {
+            _this4._element.focus();
+          }
+        });
+      };
+
+      _proto._setEscapeEvent = function _setEscapeEvent() {
+        var _this5 = this;
+
+        if (this._isShown && this._config.keyboard) {
+          $$$1(this._element).on(Event.KEYDOWN_DISMISS, function (event) {
+            if (event.which === ESCAPE_KEYCODE) {
+              event.preventDefault();
+
+              _this5.hide();
+            }
+          });
+        } else if (!this._isShown) {
+          $$$1(this._element).off(Event.KEYDOWN_DISMISS);
+        }
+      };
+
+      _proto._setResizeEvent = function _setResizeEvent() {
+        var _this6 = this;
+
+        if (this._isShown) {
+          $$$1(window).on(Event.RESIZE, function (event) {
+            return _this6.handleUpdate(event);
+          });
+        } else {
+          $$$1(window).off(Event.RESIZE);
+        }
+      };
+
+      _proto._hideModal = function _hideModal() {
+        var _this7 = this;
+
+        this._element.style.display = 'none';
+
+        this._element.setAttribute('aria-hidden', true);
+
+        this._isTransitioning = false;
+
+        this._showBackdrop(function () {
+          $$$1(document.body).removeClass(ClassName.OPEN);
+
+          _this7._resetAdjustments();
+
+          _this7._resetScrollbar();
+
+          $$$1(_this7._element).trigger(Event.HIDDEN);
+        });
+      };
+
+      _proto._removeBackdrop = function _removeBackdrop() {
+        if (this._backdrop) {
+          $$$1(this._backdrop).remove();
+          this._backdrop = null;
+        }
+      };
+
+      _proto._showBackdrop = function _showBackdrop(callback) {
+        var _this8 = this;
+
+        var animate = $$$1(this._element).hasClass(ClassName.FADE) ? ClassName.FADE : '';
+
+        if (this._isShown && this._config.backdrop) {
+          this._backdrop = document.createElement('div');
+          this._backdrop.className = ClassName.BACKDROP;
+
+          if (animate) {
+            this._backdrop.classList.add(animate);
+          }
+
+          $$$1(this._backdrop).appendTo(document.body);
+          $$$1(this._element).on(Event.CLICK_DISMISS, function (event) {
+            if (_this8._ignoreBackdropClick) {
+              _this8._ignoreBackdropClick = false;
+              return;
+            }
+
+            if (event.target !== event.currentTarget) {
+              return;
+            }
+
+            if (_this8._config.backdrop === 'static') {
+              _this8._element.focus();
+            } else {
+              _this8.hide();
+            }
+          });
+
+          if (animate) {
+            Util.reflow(this._backdrop);
+          }
+
+          $$$1(this._backdrop).addClass(ClassName.SHOW);
+
+          if (!callback) {
+            return;
+          }
+
+          if (!animate) {
+            callback();
+            return;
+          }
+
+          var backdropTransitionDuration = Util.getTransitionDurationFromElement(this._backdrop);
+          $$$1(this._backdrop).one(Util.TRANSITION_END, callback).emulateTransitionEnd(backdropTransitionDuration);
+        } else if (!this._isShown && this._backdrop) {
+          $$$1(this._backdrop).removeClass(ClassName.SHOW);
+
+          var callbackRemove = function callbackRemove() {
+            _this8._removeBackdrop();
+
+            if (callback) {
+              callback();
+            }
+          };
+
+          if ($$$1(this._element).hasClass(ClassName.FADE)) {
+            var _backdropTransitionDuration = Util.getTransitionDurationFromElement(this._backdrop);
+
+            $$$1(this._backdrop).one(Util.TRANSITION_END, callbackRemove).emulateTransitionEnd(_backdropTransitionDuration);
+          } else {
+            callbackRemove();
+          }
+        } else if (callback) {
+          callback();
+        }
+      }; // ----------------------------------------------------------------------
+      // the following methods are used to handle overflowing modals
+      // todo (fat): these should probably be refactored out of modal.js
+      // ----------------------------------------------------------------------
+
+
+      _proto._adjustDialog = function _adjustDialog() {
+        var isModalOverflowing = this._element.scrollHeight > document.documentElement.clientHeight;
+
+        if (!this._isBodyOverflowing && isModalOverflowing) {
+          this._element.style.paddingLeft = this._scrollbarWidth + "px";
+        }
+
+        if (this._isBodyOverflowing && !isModalOverflowing) {
+          this._element.style.paddingRight = this._scrollbarWidth + "px";
+        }
+      };
+
+      _proto._resetAdjustments = function _resetAdjustments() {
+        this._element.style.paddingLeft = '';
+        this._element.style.paddingRight = '';
+      };
+
+      _proto._checkScrollbar = function _checkScrollbar() {
+        var rect = document.body.getBoundingClientRect();
+        this._isBodyOverflowing = rect.left + rect.right < window.innerWidth;
+        this._scrollbarWidth = this._getScrollbarWidth();
+      };
+
+      _proto._setScrollbar = function _setScrollbar() {
+        var _this9 = this;
+
+        if (this._isBodyOverflowing) {
+          // Note: DOMNode.style.paddingRight returns the actual value or '' if not set
+          //   while $(DOMNode).css('padding-right') returns the calculated value or 0 if not set
+          var fixedContent = [].slice.call(document.querySelectorAll(Selector.FIXED_CONTENT));
+          var stickyContent = [].slice.call(document.querySelectorAll(Selector.STICKY_CONTENT)); // Adjust fixed content padding
+
+          $$$1(fixedContent).each(function (index, element) {
+            var actualPadding = element.style.paddingRight;
+            var calculatedPadding = $$$1(element).css('padding-right');
+            $$$1(element).data('padding-right', actualPadding).css('padding-right', parseFloat(calculatedPadding) + _this9._scrollbarWidth + "px");
+          }); // Adjust sticky content margin
+
+          $$$1(stickyContent).each(function (index, element) {
+            var actualMargin = element.style.marginRight;
+            var calculatedMargin = $$$1(element).css('margin-right');
+            $$$1(element).data('margin-right', actualMargin).css('margin-right', parseFloat(calculatedMargin) - _this9._scrollbarWidth + "px");
+          }); // Adjust body padding
+
+          var actualPadding = document.body.style.paddingRight;
+          var calculatedPadding = $$$1(document.body).css('padding-right');
+          $$$1(document.body).data('padding-right', actualPadding).css('padding-right', parseFloat(calculatedPadding) + this._scrollbarWidth + "px");
+        }
+      };
+
+      _proto._resetScrollbar = function _resetScrollbar() {
+        // Restore fixed content padding
+        var fixedContent = [].slice.call(document.querySelectorAll(Selector.FIXED_CONTENT));
+        $$$1(fixedContent).each(function (index, element) {
+          var padding = $$$1(element).data('padding-right');
+          $$$1(element).removeData('padding-right');
+          element.style.paddingRight = padding ? padding : '';
+        }); // Restore sticky content
+
+        var elements = [].slice.call(document.querySelectorAll("" + Selector.STICKY_CONTENT));
+        $$$1(elements).each(function (index, element) {
+          var margin = $$$1(element).data('margin-right');
+
+          if (typeof margin !== 'undefined') {
+            $$$1(element).css('margin-right', margin).removeData('margin-right');
+          }
+        }); // Restore body padding
+
+        var padding = $$$1(document.body).data('padding-right');
+        $$$1(document.body).removeData('padding-right');
+        document.body.style.paddingRight = padding ? padding : '';
+      };
+
+      _proto._getScrollbarWidth = function _getScrollbarWidth() {
+        // thx d.walsh
+        var scrollDiv = document.createElement('div');
+        scrollDiv.className = ClassName.SCROLLBAR_MEASURER;
+        document.body.appendChild(scrollDiv);
+        var scrollbarWidth = scrollDiv.getBoundingClientRect().width - scrollDiv.clientWidth;
+        document.body.removeChild(scrollDiv);
+        return scrollbarWidth;
+      }; // Static
+
+
+      Modal._jQueryInterface = function _jQueryInterface(config, relatedTarget) {
+        return this.each(function () {
+          var data = $$$1(this).data(DATA_KEY);
+
+          var _config = _objectSpread({}, Default, $$$1(this).data(), typeof config === 'object' && config ? config : {});
+
+          if (!data) {
+            data = new Modal(this, _config);
+            $$$1(this).data(DATA_KEY, data);
+          }
+
+          if (typeof config === 'string') {
+            if (typeof data[config] === 'undefined') {
+              throw new TypeError("No method named \"" + config + "\"");
+            }
+
+            data[config](relatedTarget);
+          } else if (_config.show) {
+            data.show(relatedTarget);
+          }
+        });
+      };
+
+      _createClass(Modal, null, [{
+        key: "VERSION",
+        get: function get() {
+          return VERSION;
+        }
+      }, {
+        key: "Default",
+        get: function get() {
+          return Default;
+        }
+      }]);
+
+      return Modal;
+    }();
+    /**
+     * ------------------------------------------------------------------------
+     * Data Api implementation
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1(document).on(Event.CLICK_DATA_API, Selector.DATA_TOGGLE, function (event) {
+      var _this10 = this;
+
+      var target;
+      var selector = Util.getSelectorFromElement(this);
+
+      if (selector) {
+        target = document.querySelector(selector);
+      }
+
+      var config = $$$1(target).data(DATA_KEY) ? 'toggle' : _objectSpread({}, $$$1(target).data(), $$$1(this).data());
+
+      if (this.tagName === 'A' || this.tagName === 'AREA') {
+        event.preventDefault();
+      }
+
+      var $target = $$$1(target).one(Event.SHOW, function (showEvent) {
+        if (showEvent.isDefaultPrevented()) {
+          // Only register focus restorer if modal will actually get shown
+          return;
+        }
+
+        $target.one(Event.HIDDEN, function () {
+          if ($$$1(_this10).is(':visible')) {
+            _this10.focus();
+          }
+        });
+      });
+
+      Modal._jQueryInterface.call($$$1(target), config, this);
+    });
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+    $$$1.fn[NAME] = Modal._jQueryInterface;
+    $$$1.fn[NAME].Constructor = Modal;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return Modal._jQueryInterface;
+    };
+
+    return Modal;
+  }($);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): tooltip.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Tooltip = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'tooltip';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.tooltip';
+    var EVENT_KEY = "." + DATA_KEY;
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var CLASS_PREFIX = 'bs-tooltip';
+    var BSCLS_PREFIX_REGEX = new RegExp("(^|\\s)" + CLASS_PREFIX + "\\S+", 'g');
+    var DefaultType = {
+      animation: 'boolean',
+      template: 'string',
+      title: '(string|element|function)',
+      trigger: 'string',
+      delay: '(number|object)',
+      html: 'boolean',
+      selector: '(string|boolean)',
+      placement: '(string|function)',
+      offset: '(number|string)',
+      container: '(string|element|boolean)',
+      fallbackPlacement: '(string|array)',
+      boundary: '(string|element)'
+    };
+    var AttachmentMap = {
+      AUTO: 'auto',
+      TOP: 'top',
+      RIGHT: 'right',
+      BOTTOM: 'bottom',
+      LEFT: 'left'
+    };
+    var Default = {
+      animation: true,
+      template: '<div class="tooltip" role="tooltip">' + '<div class="arrow"></div>' + '<div class="tooltip-inner"></div></div>',
+      trigger: 'hover focus',
+      title: '',
+      delay: 0,
+      html: false,
+      selector: false,
+      placement: 'top',
+      offset: 0,
+      container: false,
+      fallbackPlacement: 'flip',
+      boundary: 'scrollParent'
+    };
+    var HoverState = {
+      SHOW: 'show',
+      OUT: 'out'
+    };
+    var Event = {
+      HIDE: "hide" + EVENT_KEY,
+      HIDDEN: "hidden" + EVENT_KEY,
+      SHOW: "show" + EVENT_KEY,
+      SHOWN: "shown" + EVENT_KEY,
+      INSERTED: "inserted" + EVENT_KEY,
+      CLICK: "click" + EVENT_KEY,
+      FOCUSIN: "focusin" + EVENT_KEY,
+      FOCUSOUT: "focusout" + EVENT_KEY,
+      MOUSEENTER: "mouseenter" + EVENT_KEY,
+      MOUSELEAVE: "mouseleave" + EVENT_KEY
+    };
+    var ClassName = {
+      FADE: 'fade',
+      SHOW: 'show'
+    };
+    var Selector = {
+      TOOLTIP: '.tooltip',
+      TOOLTIP_INNER: '.tooltip-inner',
+      ARROW: '.arrow'
+    };
+    var Trigger = {
+      HOVER: 'hover',
+      FOCUS: 'focus',
+      CLICK: 'click',
+      MANUAL: 'manual'
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var Tooltip =
+    /*#__PURE__*/
+    function () {
+      function Tooltip(element, config) {
+        /**
+         * Check for Popper dependency
+         * Popper - https://popper.js.org
+         */
+        if (typeof Popper === 'undefined') {
+          throw new TypeError('Bootstrap tooltips require Popper.js (https://popper.js.org)');
+        } // private
+
+
+        this._isEnabled = true;
+        this._timeout = 0;
+        this._hoverState = '';
+        this._activeTrigger = {};
+        this._popper = null; // Protected
+
+        this.element = element;
+        this.config = this._getConfig(config);
+        this.tip = null;
+
+        this._setListeners();
+      } // Getters
+
+
+      var _proto = Tooltip.prototype;
+
+      // Public
+      _proto.enable = function enable() {
+        this._isEnabled = true;
+      };
+
+      _proto.disable = function disable() {
+        this._isEnabled = false;
+      };
+
+      _proto.toggleEnabled = function toggleEnabled() {
+        this._isEnabled = !this._isEnabled;
+      };
+
+      _proto.toggle = function toggle(event) {
+        if (!this._isEnabled) {
+          return;
+        }
+
+        if (event) {
+          var dataKey = this.constructor.DATA_KEY;
+          var context = $$$1(event.currentTarget).data(dataKey);
+
+          if (!context) {
+            context = new this.constructor(event.currentTarget, this._getDelegateConfig());
+            $$$1(event.currentTarget).data(dataKey, context);
+          }
+
+          context._activeTrigger.click = !context._activeTrigger.click;
+
+          if (context._isWithActiveTrigger()) {
+            context._enter(null, context);
+          } else {
+            context._leave(null, context);
+          }
+        } else {
+          if ($$$1(this.getTipElement()).hasClass(ClassName.SHOW)) {
+            this._leave(null, this);
+
+            return;
+          }
+
+          this._enter(null, this);
+        }
+      };
+
+      _proto.dispose = function dispose() {
+        clearTimeout(this._timeout);
+        $$$1.removeData(this.element, this.constructor.DATA_KEY);
+        $$$1(this.element).off(this.constructor.EVENT_KEY);
+        $$$1(this.element).closest('.modal').off('hide.bs.modal');
+
+        if (this.tip) {
+          $$$1(this.tip).remove();
+        }
+
+        this._isEnabled = null;
+        this._timeout = null;
+        this._hoverState = null;
+        this._activeTrigger = null;
+
+        if (this._popper !== null) {
+          this._popper.destroy();
+        }
+
+        this._popper = null;
+        this.element = null;
+        this.config = null;
+        this.tip = null;
+      };
+
+      _proto.show = function show() {
+        var _this = this;
+
+        if ($$$1(this.element).css('display') === 'none') {
+          throw new Error('Please use show on visible elements');
+        }
+
+        var showEvent = $$$1.Event(this.constructor.Event.SHOW);
+
+        if (this.isWithContent() && this._isEnabled) {
+          $$$1(this.element).trigger(showEvent);
+          var isInTheDom = $$$1.contains(this.element.ownerDocument.documentElement, this.element);
+
+          if (showEvent.isDefaultPrevented() || !isInTheDom) {
+            return;
+          }
+
+          var tip = this.getTipElement();
+          var tipId = Util.getUID(this.constructor.NAME);
+          tip.setAttribute('id', tipId);
+          this.element.setAttribute('aria-describedby', tipId);
+          this.setContent();
+
+          if (this.config.animation) {
+            $$$1(tip).addClass(ClassName.FADE);
+          }
+
+          var placement = typeof this.config.placement === 'function' ? this.config.placement.call(this, tip, this.element) : this.config.placement;
+
+          var attachment = this._getAttachment(placement);
+
+          this.addAttachmentClass(attachment);
+          var container = this.config.container === false ? document.body : $$$1(document).find(this.config.container);
+          $$$1(tip).data(this.constructor.DATA_KEY, this);
+
+          if (!$$$1.contains(this.element.ownerDocument.documentElement, this.tip)) {
+            $$$1(tip).appendTo(container);
+          }
+
+          $$$1(this.element).trigger(this.constructor.Event.INSERTED);
+          this._popper = new Popper(this.element, tip, {
+            placement: attachment,
+            modifiers: {
+              offset: {
+                offset: this.config.offset
+              },
+              flip: {
+                behavior: this.config.fallbackPlacement
+              },
+              arrow: {
+                element: Selector.ARROW
+              },
+              preventOverflow: {
+                boundariesElement: this.config.boundary
+              }
+            },
+            onCreate: function onCreate(data) {
+              if (data.originalPlacement !== data.placement) {
+                _this._handlePopperPlacementChange(data);
+              }
+            },
+            onUpdate: function onUpdate(data) {
+              _this._handlePopperPlacementChange(data);
+            }
+          });
+          $$$1(tip).addClass(ClassName.SHOW); // If this is a touch-enabled device we add extra
+          // empty mouseover listeners to the body's immediate children;
+          // only needed because of broken event delegation on iOS
+          // https://www.quirksmode.org/blog/archives/2014/02/mouse_event_bub.html
+
+          if ('ontouchstart' in document.documentElement) {
+            $$$1(document.body).children().on('mouseover', null, $$$1.noop);
+          }
+
+          var complete = function complete() {
+            if (_this.config.animation) {
+              _this._fixTransition();
+            }
+
+            var prevHoverState = _this._hoverState;
+            _this._hoverState = null;
+            $$$1(_this.element).trigger(_this.constructor.Event.SHOWN);
+
+            if (prevHoverState === HoverState.OUT) {
+              _this._leave(null, _this);
+            }
+          };
+
+          if ($$$1(this.tip).hasClass(ClassName.FADE)) {
+            var transitionDuration = Util.getTransitionDurationFromElement(this.tip);
+            $$$1(this.tip).one(Util.TRANSITION_END, complete).emulateTransitionEnd(transitionDuration);
+          } else {
+            complete();
+          }
+        }
+      };
+
+      _proto.hide = function hide(callback) {
+        var _this2 = this;
+
+        var tip = this.getTipElement();
+        var hideEvent = $$$1.Event(this.constructor.Event.HIDE);
+
+        var complete = function complete() {
+          if (_this2._hoverState !== HoverState.SHOW && tip.parentNode) {
+            tip.parentNode.removeChild(tip);
+          }
+
+          _this2._cleanTipClass();
+
+          _this2.element.removeAttribute('aria-describedby');
+
+          $$$1(_this2.element).trigger(_this2.constructor.Event.HIDDEN);
+
+          if (_this2._popper !== null) {
+            _this2._popper.destroy();
+          }
+
+          if (callback) {
+            callback();
+          }
+        };
+
+        $$$1(this.element).trigger(hideEvent);
+
+        if (hideEvent.isDefaultPrevented()) {
+          return;
+        }
+
+        $$$1(tip).removeClass(ClassName.SHOW); // If this is a touch-enabled device we remove the extra
+        // empty mouseover listeners we added for iOS support
+
+        if ('ontouchstart' in document.documentElement) {
+          $$$1(document.body).children().off('mouseover', null, $$$1.noop);
+        }
+
+        this._activeTrigger[Trigger.CLICK] = false;
+        this._activeTrigger[Trigger.FOCUS] = false;
+        this._activeTrigger[Trigger.HOVER] = false;
+
+        if ($$$1(this.tip).hasClass(ClassName.FADE)) {
+          var transitionDuration = Util.getTransitionDurationFromElement(tip);
+          $$$1(tip).one(Util.TRANSITION_END, complete).emulateTransitionEnd(transitionDuration);
+        } else {
+          complete();
+        }
+
+        this._hoverState = '';
+      };
+
+      _proto.update = function update() {
+        if (this._popper !== null) {
+          this._popper.scheduleUpdate();
+        }
+      }; // Protected
+
+
+      _proto.isWithContent = function isWithContent() {
+        return Boolean(this.getTitle());
+      };
+
+      _proto.addAttachmentClass = function addAttachmentClass(attachment) {
+        $$$1(this.getTipElement()).addClass(CLASS_PREFIX + "-" + attachment);
+      };
+
+      _proto.getTipElement = function getTipElement() {
+        this.tip = this.tip || $$$1(this.config.template)[0];
+        return this.tip;
+      };
+
+      _proto.setContent = function setContent() {
+        var tip = this.getTipElement();
+        this.setElementContent($$$1(tip.querySelectorAll(Selector.TOOLTIP_INNER)), this.getTitle());
+        $$$1(tip).removeClass(ClassName.FADE + " " + ClassName.SHOW);
+      };
+
+      _proto.setElementContent = function setElementContent($element, content) {
+        var html = this.config.html;
+
+        if (typeof content === 'object' && (content.nodeType || content.jquery)) {
+          // Content is a DOM node or a jQuery
+          if (html) {
+            if (!$$$1(content).parent().is($element)) {
+              $element.empty().append(content);
+            }
+          } else {
+            $element.text($$$1(content).text());
+          }
+        } else {
+          $element[html ? 'html' : 'text'](content);
+        }
+      };
+
+      _proto.getTitle = function getTitle() {
+        var title = this.element.getAttribute('data-original-title');
+
+        if (!title) {
+          title = typeof this.config.title === 'function' ? this.config.title.call(this.element) : this.config.title;
+        }
+
+        return title;
+      }; // Private
+
+
+      _proto._getAttachment = function _getAttachment(placement) {
+        return AttachmentMap[placement.toUpperCase()];
+      };
+
+      _proto._setListeners = function _setListeners() {
+        var _this3 = this;
+
+        var triggers = this.config.trigger.split(' ');
+        triggers.forEach(function (trigger) {
+          if (trigger === 'click') {
+            $$$1(_this3.element).on(_this3.constructor.Event.CLICK, _this3.config.selector, function (event) {
+              return _this3.toggle(event);
+            });
+          } else if (trigger !== Trigger.MANUAL) {
+            var eventIn = trigger === Trigger.HOVER ? _this3.constructor.Event.MOUSEENTER : _this3.constructor.Event.FOCUSIN;
+            var eventOut = trigger === Trigger.HOVER ? _this3.constructor.Event.MOUSELEAVE : _this3.constructor.Event.FOCUSOUT;
+            $$$1(_this3.element).on(eventIn, _this3.config.selector, function (event) {
+              return _this3._enter(event);
+            }).on(eventOut, _this3.config.selector, function (event) {
+              return _this3._leave(event);
+            });
+          }
+
+          $$$1(_this3.element).closest('.modal').on('hide.bs.modal', function () {
+            return _this3.hide();
+          });
+        });
+
+        if (this.config.selector) {
+          this.config = _objectSpread({}, this.config, {
+            trigger: 'manual',
+            selector: ''
+          });
+        } else {
+          this._fixTitle();
+        }
+      };
+
+      _proto._fixTitle = function _fixTitle() {
+        var titleType = typeof this.element.getAttribute('data-original-title');
+
+        if (this.element.getAttribute('title') || titleType !== 'string') {
+          this.element.setAttribute('data-original-title', this.element.getAttribute('title') || '');
+          this.element.setAttribute('title', '');
+        }
+      };
+
+      _proto._enter = function _enter(event, context) {
+        var dataKey = this.constructor.DATA_KEY;
+        context = context || $$$1(event.currentTarget).data(dataKey);
+
+        if (!context) {
+          context = new this.constructor(event.currentTarget, this._getDelegateConfig());
+          $$$1(event.currentTarget).data(dataKey, context);
+        }
+
+        if (event) {
+          context._activeTrigger[event.type === 'focusin' ? Trigger.FOCUS : Trigger.HOVER] = true;
+        }
+
+        if ($$$1(context.getTipElement()).hasClass(ClassName.SHOW) || context._hoverState === HoverState.SHOW) {
+          context._hoverState = HoverState.SHOW;
+          return;
+        }
+
+        clearTimeout(context._timeout);
+        context._hoverState = HoverState.SHOW;
+
+        if (!context.config.delay || !context.config.delay.show) {
+          context.show();
+          return;
+        }
+
+        context._timeout = setTimeout(function () {
+          if (context._hoverState === HoverState.SHOW) {
+            context.show();
+          }
+        }, context.config.delay.show);
+      };
+
+      _proto._leave = function _leave(event, context) {
+        var dataKey = this.constructor.DATA_KEY;
+        context = context || $$$1(event.currentTarget).data(dataKey);
+
+        if (!context) {
+          context = new this.constructor(event.currentTarget, this._getDelegateConfig());
+          $$$1(event.currentTarget).data(dataKey, context);
+        }
+
+        if (event) {
+          context._activeTrigger[event.type === 'focusout' ? Trigger.FOCUS : Trigger.HOVER] = false;
+        }
+
+        if (context._isWithActiveTrigger()) {
+          return;
+        }
+
+        clearTimeout(context._timeout);
+        context._hoverState = HoverState.OUT;
+
+        if (!context.config.delay || !context.config.delay.hide) {
+          context.hide();
+          return;
+        }
+
+        context._timeout = setTimeout(function () {
+          if (context._hoverState === HoverState.OUT) {
+            context.hide();
+          }
+        }, context.config.delay.hide);
+      };
+
+      _proto._isWithActiveTrigger = function _isWithActiveTrigger() {
+        for (var trigger in this._activeTrigger) {
+          if (this._activeTrigger[trigger]) {
+            return true;
+          }
+        }
+
+        return false;
+      };
+
+      _proto._getConfig = function _getConfig(config) {
+        config = _objectSpread({}, this.constructor.Default, $$$1(this.element).data(), typeof config === 'object' && config ? config : {});
+
+        if (typeof config.delay === 'number') {
+          config.delay = {
+            show: config.delay,
+            hide: config.delay
+          };
+        }
+
+        if (typeof config.title === 'number') {
+          config.title = config.title.toString();
+        }
+
+        if (typeof config.content === 'number') {
+          config.content = config.content.toString();
+        }
+
+        Util.typeCheckConfig(NAME, config, this.constructor.DefaultType);
+        return config;
+      };
+
+      _proto._getDelegateConfig = function _getDelegateConfig() {
+        var config = {};
+
+        if (this.config) {
+          for (var key in this.config) {
+            if (this.constructor.Default[key] !== this.config[key]) {
+              config[key] = this.config[key];
+            }
+          }
+        }
+
+        return config;
+      };
+
+      _proto._cleanTipClass = function _cleanTipClass() {
+        var $tip = $$$1(this.getTipElement());
+        var tabClass = $tip.attr('class').match(BSCLS_PREFIX_REGEX);
+
+        if (tabClass !== null && tabClass.length) {
+          $tip.removeClass(tabClass.join(''));
+        }
+      };
+
+      _proto._handlePopperPlacementChange = function _handlePopperPlacementChange(popperData) {
+        var popperInstance = popperData.instance;
+        this.tip = popperInstance.popper;
+
+        this._cleanTipClass();
+
+        this.addAttachmentClass(this._getAttachment(popperData.placement));
+      };
+
+      _proto._fixTransition = function _fixTransition() {
+        var tip = this.getTipElement();
+        var initConfigAnimation = this.config.animation;
+
+        if (tip.getAttribute('x-placement') !== null) {
+          return;
+        }
+
+        $$$1(tip).removeClass(ClassName.FADE);
+        this.config.animation = false;
+        this.hide();
+        this.show();
+        this.config.animation = initConfigAnimation;
+      }; // Static
+
+
+      Tooltip._jQueryInterface = function _jQueryInterface(config) {
+        return this.each(function () {
+          var data = $$$1(this).data(DATA_KEY);
+
+          var _config = typeof config === 'object' && config;
+
+          if (!data && /dispose|hide/.test(config)) {
+            return;
+          }
+
+          if (!data) {
+            data = new Tooltip(this, _config);
+            $$$1(this).data(DATA_KEY, data);
+          }
+
+          if (typeof config === 'string') {
+            if (typeof data[config] === 'undefined') {
+              throw new TypeError("No method named \"" + config + "\"");
+            }
+
+            data[config]();
+          }
+        });
+      };
+
+      _createClass(Tooltip, null, [{
+        key: "VERSION",
+        get: function get() {
+          return VERSION;
+        }
+      }, {
+        key: "Default",
+        get: function get() {
+          return Default;
+        }
+      }, {
+        key: "NAME",
+        get: function get() {
+          return NAME;
+        }
+      }, {
+        key: "DATA_KEY",
+        get: function get() {
+          return DATA_KEY;
+        }
+      }, {
+        key: "Event",
+        get: function get() {
+          return Event;
+        }
+      }, {
+        key: "EVENT_KEY",
+        get: function get() {
+          return EVENT_KEY;
+        }
+      }, {
+        key: "DefaultType",
+        get: function get() {
+          return DefaultType;
+        }
+      }]);
+
+      return Tooltip;
+    }();
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1.fn[NAME] = Tooltip._jQueryInterface;
+    $$$1.fn[NAME].Constructor = Tooltip;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return Tooltip._jQueryInterface;
+    };
+
+    return Tooltip;
+  }($, Popper);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): popover.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Popover = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'popover';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.popover';
+    var EVENT_KEY = "." + DATA_KEY;
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var CLASS_PREFIX = 'bs-popover';
+    var BSCLS_PREFIX_REGEX = new RegExp("(^|\\s)" + CLASS_PREFIX + "\\S+", 'g');
+
+    var Default = _objectSpread({}, Tooltip.Default, {
+      placement: 'right',
+      trigger: 'click',
+      content: '',
+      template: '<div class="popover" role="tooltip">' + '<div class="arrow"></div>' + '<h3 class="popover-header"></h3>' + '<div class="popover-body"></div></div>'
+    });
+
+    var DefaultType = _objectSpread({}, Tooltip.DefaultType, {
+      content: '(string|element|function)'
+    });
+
+    var ClassName = {
+      FADE: 'fade',
+      SHOW: 'show'
+    };
+    var Selector = {
+      TITLE: '.popover-header',
+      CONTENT: '.popover-body'
+    };
+    var Event = {
+      HIDE: "hide" + EVENT_KEY,
+      HIDDEN: "hidden" + EVENT_KEY,
+      SHOW: "show" + EVENT_KEY,
+      SHOWN: "shown" + EVENT_KEY,
+      INSERTED: "inserted" + EVENT_KEY,
+      CLICK: "click" + EVENT_KEY,
+      FOCUSIN: "focusin" + EVENT_KEY,
+      FOCUSOUT: "focusout" + EVENT_KEY,
+      MOUSEENTER: "mouseenter" + EVENT_KEY,
+      MOUSELEAVE: "mouseleave" + EVENT_KEY
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var Popover =
+    /*#__PURE__*/
+    function (_Tooltip) {
+      _inheritsLoose(Popover, _Tooltip);
+
+      function Popover() {
+        return _Tooltip.apply(this, arguments) || this;
+      }
+
+      var _proto = Popover.prototype;
+
+      // Overrides
+      _proto.isWithContent = function isWithContent() {
+        return this.getTitle() || this._getContent();
+      };
+
+      _proto.addAttachmentClass = function addAttachmentClass(attachment) {
+        $$$1(this.getTipElement()).addClass(CLASS_PREFIX + "-" + attachment);
+      };
+
+      _proto.getTipElement = function getTipElement() {
+        this.tip = this.tip || $$$1(this.config.template)[0];
+        return this.tip;
+      };
+
+      _proto.setContent = function setContent() {
+        var $tip = $$$1(this.getTipElement()); // We use append for html objects to maintain js events
+
+        this.setElementContent($tip.find(Selector.TITLE), this.getTitle());
+
+        var content = this._getContent();
+
+        if (typeof content === 'function') {
+          content = content.call(this.element);
+        }
+
+        this.setElementContent($tip.find(Selector.CONTENT), content);
+        $tip.removeClass(ClassName.FADE + " " + ClassName.SHOW);
+      }; // Private
+
+
+      _proto._getContent = function _getContent() {
+        return this.element.getAttribute('data-content') || this.config.content;
+      };
+
+      _proto._cleanTipClass = function _cleanTipClass() {
+        var $tip = $$$1(this.getTipElement());
+        var tabClass = $tip.attr('class').match(BSCLS_PREFIX_REGEX);
+
+        if (tabClass !== null && tabClass.length > 0) {
+          $tip.removeClass(tabClass.join(''));
+        }
+      }; // Static
+
+
+      Popover._jQueryInterface = function _jQueryInterface(config) {
+        return this.each(function () {
+          var data = $$$1(this).data(DATA_KEY);
+
+          var _config = typeof config === 'object' ? config : null;
+
+          if (!data && /destroy|hide/.test(config)) {
+            return;
+          }
+
+          if (!data) {
+            data = new Popover(this, _config);
+            $$$1(this).data(DATA_KEY, data);
+          }
+
+          if (typeof config === 'string') {
+            if (typeof data[config] === 'undefined') {
+              throw new TypeError("No method named \"" + config + "\"");
+            }
+
+            data[config]();
+          }
+        });
+      };
+
+      _createClass(Popover, null, [{
+        key: "VERSION",
+        // Getters
+        get: function get() {
+          return VERSION;
+        }
+      }, {
+        key: "Default",
+        get: function get() {
+          return Default;
+        }
+      }, {
+        key: "NAME",
+        get: function get() {
+          return NAME;
+        }
+      }, {
+        key: "DATA_KEY",
+        get: function get() {
+          return DATA_KEY;
+        }
+      }, {
+        key: "Event",
+        get: function get() {
+          return Event;
+        }
+      }, {
+        key: "EVENT_KEY",
+        get: function get() {
+          return EVENT_KEY;
+        }
+      }, {
+        key: "DefaultType",
+        get: function get() {
+          return DefaultType;
+        }
+      }]);
+
+      return Popover;
+    }(Tooltip);
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1.fn[NAME] = Popover._jQueryInterface;
+    $$$1.fn[NAME].Constructor = Popover;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return Popover._jQueryInterface;
+    };
+
+    return Popover;
+  }($);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): scrollspy.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var ScrollSpy = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'scrollspy';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.scrollspy';
+    var EVENT_KEY = "." + DATA_KEY;
+    var DATA_API_KEY = '.data-api';
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var Default = {
+      offset: 10,
+      method: 'auto',
+      target: ''
+    };
+    var DefaultType = {
+      offset: 'number',
+      method: 'string',
+      target: '(string|element)'
+    };
+    var Event = {
+      ACTIVATE: "activate" + EVENT_KEY,
+      SCROLL: "scroll" + EVENT_KEY,
+      LOAD_DATA_API: "load" + EVENT_KEY + DATA_API_KEY
+    };
+    var ClassName = {
+      DROPDOWN_ITEM: 'dropdown-item',
+      DROPDOWN_MENU: 'dropdown-menu',
+      ACTIVE: 'active'
+    };
+    var Selector = {
+      DATA_SPY: '[data-spy="scroll"]',
+      ACTIVE: '.active',
+      NAV_LIST_GROUP: '.nav, .list-group',
+      NAV_LINKS: '.nav-link',
+      NAV_ITEMS: '.nav-item',
+      LIST_ITEMS: '.list-group-item',
+      DROPDOWN: '.dropdown',
+      DROPDOWN_ITEMS: '.dropdown-item',
+      DROPDOWN_TOGGLE: '.dropdown-toggle'
+    };
+    var OffsetMethod = {
+      OFFSET: 'offset',
+      POSITION: 'position'
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var ScrollSpy =
+    /*#__PURE__*/
+    function () {
+      function ScrollSpy(element, config) {
+        var _this = this;
+
+        this._element = element;
+        this._scrollElement = element.tagName === 'BODY' ? window : element;
+        this._config = this._getConfig(config);
+        this._selector = this._config.target + " " + Selector.NAV_LINKS + "," + (this._config.target + " " + Selector.LIST_ITEMS + ",") + (this._config.target + " " + Selector.DROPDOWN_ITEMS);
+        this._offsets = [];
+        this._targets = [];
+        this._activeTarget = null;
+        this._scrollHeight = 0;
+        $$$1(this._scrollElement).on(Event.SCROLL, function (event) {
+          return _this._process(event);
+        });
+        this.refresh();
+
+        this._process();
+      } // Getters
+
+
+      var _proto = ScrollSpy.prototype;
+
+      // Public
+      _proto.refresh = function refresh() {
+        var _this2 = this;
+
+        var autoMethod = this._scrollElement === this._scrollElement.window ? OffsetMethod.OFFSET : OffsetMethod.POSITION;
+        var offsetMethod = this._config.method === 'auto' ? autoMethod : this._config.method;
+        var offsetBase = offsetMethod === OffsetMethod.POSITION ? this._getScrollTop() : 0;
+        this._offsets = [];
+        this._targets = [];
+        this._scrollHeight = this._getScrollHeight();
+        var targets = [].slice.call(document.querySelectorAll(this._selector));
+        targets.map(function (element) {
+          var target;
+          var targetSelector = Util.getSelectorFromElement(element);
+
+          if (targetSelector) {
+            target = document.querySelector(targetSelector);
+          }
+
+          if (target) {
+            var targetBCR = target.getBoundingClientRect();
+
+            if (targetBCR.width || targetBCR.height) {
+              // TODO (fat): remove sketch reliance on jQuery position/offset
+              return [$$$1(target)[offsetMethod]().top + offsetBase, targetSelector];
+            }
+          }
+
+          return null;
+        }).filter(function (item) {
+          return item;
+        }).sort(function (a, b) {
+          return a[0] - b[0];
+        }).forEach(function (item) {
+          _this2._offsets.push(item[0]);
+
+          _this2._targets.push(item[1]);
+        });
+      };
+
+      _proto.dispose = function dispose() {
+        $$$1.removeData(this._element, DATA_KEY);
+        $$$1(this._scrollElement).off(EVENT_KEY);
+        this._element = null;
+        this._scrollElement = null;
+        this._config = null;
+        this._selector = null;
+        this._offsets = null;
+        this._targets = null;
+        this._activeTarget = null;
+        this._scrollHeight = null;
+      }; // Private
+
+
+      _proto._getConfig = function _getConfig(config) {
+        config = _objectSpread({}, Default, typeof config === 'object' && config ? config : {});
+
+        if (typeof config.target !== 'string') {
+          var id = $$$1(config.target).attr('id');
+
+          if (!id) {
+            id = Util.getUID(NAME);
+            $$$1(config.target).attr('id', id);
+          }
+
+          config.target = "#" + id;
+        }
+
+        Util.typeCheckConfig(NAME, config, DefaultType);
+        return config;
+      };
+
+      _proto._getScrollTop = function _getScrollTop() {
+        return this._scrollElement === window ? this._scrollElement.pageYOffset : this._scrollElement.scrollTop;
+      };
+
+      _proto._getScrollHeight = function _getScrollHeight() {
+        return this._scrollElement.scrollHeight || Math.max(document.body.scrollHeight, document.documentElement.scrollHeight);
+      };
+
+      _proto._getOffsetHeight = function _getOffsetHeight() {
+        return this._scrollElement === window ? window.innerHeight : this._scrollElement.getBoundingClientRect().height;
+      };
+
+      _proto._process = function _process() {
+        var scrollTop = this._getScrollTop() + this._config.offset;
+
+        var scrollHeight = this._getScrollHeight();
+
+        var maxScroll = this._config.offset + scrollHeight - this._getOffsetHeight();
+
+        if (this._scrollHeight !== scrollHeight) {
+          this.refresh();
+        }
+
+        if (scrollTop >= maxScroll) {
+          var target = this._targets[this._targets.length - 1];
+
+          if (this._activeTarget !== target) {
+            this._activate(target);
+          }
+
+          return;
+        }
+
+        if (this._activeTarget && scrollTop < this._offsets[0] && this._offsets[0] > 0) {
+          this._activeTarget = null;
+
+          this._clear();
+
+          return;
+        }
+
+        var offsetLength = this._offsets.length;
+
+        for (var i = offsetLength; i--;) {
+          var isActiveTarget = this._activeTarget !== this._targets[i] && scrollTop >= this._offsets[i] && (typeof this._offsets[i + 1] === 'undefined' || scrollTop < this._offsets[i + 1]);
+
+          if (isActiveTarget) {
+            this._activate(this._targets[i]);
+          }
+        }
+      };
+
+      _proto._activate = function _activate(target) {
+        this._activeTarget = target;
+
+        this._clear();
+
+        var queries = this._selector.split(','); // eslint-disable-next-line arrow-body-style
+
+
+        queries = queries.map(function (selector) {
+          return selector + "[data-target=\"" + target + "\"]," + (selector + "[href=\"" + target + "\"]");
+        });
+        var $link = $$$1([].slice.call(document.querySelectorAll(queries.join(','))));
+
+        if ($link.hasClass(ClassName.DROPDOWN_ITEM)) {
+          $link.closest(Selector.DROPDOWN).find(Selector.DROPDOWN_TOGGLE).addClass(ClassName.ACTIVE);
+          $link.addClass(ClassName.ACTIVE);
+        } else {
+          // Set triggered link as active
+          $link.addClass(ClassName.ACTIVE); // Set triggered links parents as active
+          // With both <ul> and <nav> markup a parent is the previous sibling of any nav ancestor
+
+          $link.parents(Selector.NAV_LIST_GROUP).prev(Selector.NAV_LINKS + ", " + Selector.LIST_ITEMS).addClass(ClassName.ACTIVE); // Handle special case when .nav-link is inside .nav-item
+
+          $link.parents(Selector.NAV_LIST_GROUP).prev(Selector.NAV_ITEMS).children(Selector.NAV_LINKS).addClass(ClassName.ACTIVE);
+        }
+
+        $$$1(this._scrollElement).trigger(Event.ACTIVATE, {
+          relatedTarget: target
+        });
+      };
+
+      _proto._clear = function _clear() {
+        var nodes = [].slice.call(document.querySelectorAll(this._selector));
+        $$$1(nodes).filter(Selector.ACTIVE).removeClass(ClassName.ACTIVE);
+      }; // Static
+
+
+      ScrollSpy._jQueryInterface = function _jQueryInterface(config) {
+        return this.each(function () {
+          var data = $$$1(this).data(DATA_KEY);
+
+          var _config = typeof config === 'object' && config;
+
+          if (!data) {
+            data = new ScrollSpy(this, _config);
+            $$$1(this).data(DATA_KEY, data);
+          }
+
+          if (typeof config === 'string') {
+            if (typeof data[config] === 'undefined') {
+              throw new TypeError("No method named \"" + config + "\"");
+            }
+
+            data[config]();
+          }
+        });
+      };
+
+      _createClass(ScrollSpy, null, [{
+        key: "VERSION",
+        get: function get() {
+          return VERSION;
+        }
+      }, {
+        key: "Default",
+        get: function get() {
+          return Default;
+        }
+      }]);
+
+      return ScrollSpy;
+    }();
+    /**
+     * ------------------------------------------------------------------------
+     * Data Api implementation
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1(window).on(Event.LOAD_DATA_API, function () {
+      var scrollSpys = [].slice.call(document.querySelectorAll(Selector.DATA_SPY));
+      var scrollSpysLength = scrollSpys.length;
+
+      for (var i = scrollSpysLength; i--;) {
+        var $spy = $$$1(scrollSpys[i]);
+
+        ScrollSpy._jQueryInterface.call($spy, $spy.data());
+      }
+    });
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+    $$$1.fn[NAME] = ScrollSpy._jQueryInterface;
+    $$$1.fn[NAME].Constructor = ScrollSpy;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return ScrollSpy._jQueryInterface;
+    };
+
+    return ScrollSpy;
+  }($);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): tab.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Tab = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'tab';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.tab';
+    var EVENT_KEY = "." + DATA_KEY;
+    var DATA_API_KEY = '.data-api';
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var Event = {
+      HIDE: "hide" + EVENT_KEY,
+      HIDDEN: "hidden" + EVENT_KEY,
+      SHOW: "show" + EVENT_KEY,
+      SHOWN: "shown" + EVENT_KEY,
+      CLICK_DATA_API: "click" + EVENT_KEY + DATA_API_KEY
+    };
+    var ClassName = {
+      DROPDOWN_MENU: 'dropdown-menu',
+      ACTIVE: 'active',
+      DISABLED: 'disabled',
+      FADE: 'fade',
+      SHOW: 'show'
+    };
+    var Selector = {
+      DROPDOWN: '.dropdown',
+      NAV_LIST_GROUP: '.nav, .list-group',
+      ACTIVE: '.active',
+      ACTIVE_UL: '> li > .active',
+      DATA_TOGGLE: '[data-toggle="tab"], [data-toggle="pill"], [data-toggle="list"]',
+      DROPDOWN_TOGGLE: '.dropdown-toggle',
+      DROPDOWN_ACTIVE_CHILD: '> .dropdown-menu .active'
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var Tab =
+    /*#__PURE__*/
+    function () {
+      function Tab(element) {
+        this._element = element;
+      } // Getters
+
+
+      var _proto = Tab.prototype;
+
+      // Public
+      _proto.show = function show() {
+        var _this = this;
+
+        if (this._element.parentNode && this._element.parentNode.nodeType === Node.ELEMENT_NODE && $$$1(this._element).hasClass(ClassName.ACTIVE) || $$$1(this._element).hasClass(ClassName.DISABLED)) {
+          return;
+        }
+
+        var target;
+        var previous;
+        var listElement = $$$1(this._element).closest(Selector.NAV_LIST_GROUP)[0];
+        var selector = Util.getSelectorFromElement(this._element);
+
+        if (listElement) {
+          var itemSelector = listElement.nodeName === 'UL' ? Selector.ACTIVE_UL : Selector.ACTIVE;
+          previous = $$$1.makeArray($$$1(listElement).find(itemSelector));
+          previous = previous[previous.length - 1];
+        }
+
+        var hideEvent = $$$1.Event(Event.HIDE, {
+          relatedTarget: this._element
+        });
+        var showEvent = $$$1.Event(Event.SHOW, {
+          relatedTarget: previous
+        });
+
+        if (previous) {
+          $$$1(previous).trigger(hideEvent);
+        }
+
+        $$$1(this._element).trigger(showEvent);
+
+        if (showEvent.isDefaultPrevented() || hideEvent.isDefaultPrevented()) {
+          return;
+        }
+
+        if (selector) {
+          target = document.querySelector(selector);
+        }
+
+        this._activate(this._element, listElement);
+
+        var complete = function complete() {
+          var hiddenEvent = $$$1.Event(Event.HIDDEN, {
+            relatedTarget: _this._element
+          });
+          var shownEvent = $$$1.Event(Event.SHOWN, {
+            relatedTarget: previous
+          });
+          $$$1(previous).trigger(hiddenEvent);
+          $$$1(_this._element).trigger(shownEvent);
+        };
+
+        if (target) {
+          this._activate(target, target.parentNode, complete);
+        } else {
+          complete();
+        }
+      };
+
+      _proto.dispose = function dispose() {
+        $$$1.removeData(this._element, DATA_KEY);
+        this._element = null;
+      }; // Private
+
+
+      _proto._activate = function _activate(element, container, callback) {
+        var _this2 = this;
+
+        var activeElements;
+
+        if (container.nodeName === 'UL') {
+          activeElements = $$$1(container).find(Selector.ACTIVE_UL);
+        } else {
+          activeElements = $$$1(container).children(Selector.ACTIVE);
+        }
+
+        var active = activeElements[0];
+        var isTransitioning = callback && active && $$$1(active).hasClass(ClassName.FADE);
+
+        var complete = function complete() {
+          return _this2._transitionComplete(element, active, callback);
+        };
+
+        if (active && isTransitioning) {
+          var transitionDuration = Util.getTransitionDurationFromElement(active);
+          $$$1(active).one(Util.TRANSITION_END, complete).emulateTransitionEnd(transitionDuration);
+        } else {
+          complete();
+        }
+      };
+
+      _proto._transitionComplete = function _transitionComplete(element, active, callback) {
+        if (active) {
+          $$$1(active).removeClass(ClassName.SHOW + " " + ClassName.ACTIVE);
+          var dropdownChild = $$$1(active.parentNode).find(Selector.DROPDOWN_ACTIVE_CHILD)[0];
+
+          if (dropdownChild) {
+            $$$1(dropdownChild).removeClass(ClassName.ACTIVE);
+          }
+
+          if (active.getAttribute('role') === 'tab') {
+            active.setAttribute('aria-selected', false);
+          }
+        }
+
+        $$$1(element).addClass(ClassName.ACTIVE);
+
+        if (element.getAttribute('role') === 'tab') {
+          element.setAttribute('aria-selected', true);
+        }
+
+        Util.reflow(element);
+        $$$1(element).addClass(ClassName.SHOW);
+
+        if (element.parentNode && $$$1(element.parentNode).hasClass(ClassName.DROPDOWN_MENU)) {
+          var dropdownElement = $$$1(element).closest(Selector.DROPDOWN)[0];
+
+          if (dropdownElement) {
+            var dropdownToggleList = [].slice.call(dropdownElement.querySelectorAll(Selector.DROPDOWN_TOGGLE));
+            $$$1(dropdownToggleList).addClass(ClassName.ACTIVE);
+          }
+
+          element.setAttribute('aria-expanded', true);
+        }
+
+        if (callback) {
+          callback();
+        }
+      }; // Static
+
+
+      Tab._jQueryInterface = function _jQueryInterface(config) {
+        return this.each(function () {
+          var $this = $$$1(this);
+          var data = $this.data(DATA_KEY);
+
+          if (!data) {
+            data = new Tab(this);
+            $this.data(DATA_KEY, data);
+          }
+
+          if (typeof config === 'string') {
+            if (typeof data[config] === 'undefined') {
+              throw new TypeError("No method named \"" + config + "\"");
+            }
+
+            data[config]();
+          }
+        });
+      };
+
+      _createClass(Tab, null, [{
+        key: "VERSION",
+        get: function get() {
+          return VERSION;
+        }
+      }]);
+
+      return Tab;
+    }();
+    /**
+     * ------------------------------------------------------------------------
+     * Data Api implementation
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1(document).on(Event.CLICK_DATA_API, Selector.DATA_TOGGLE, function (event) {
+      event.preventDefault();
+
+      Tab._jQueryInterface.call($$$1(this), 'show');
+    });
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+    $$$1.fn[NAME] = Tab._jQueryInterface;
+    $$$1.fn[NAME].Constructor = Tab;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return Tab._jQueryInterface;
+    };
+
+    return Tab;
+  }($);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): index.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  (function ($$$1) {
+    if (typeof $$$1 === 'undefined') {
+      throw new TypeError('Bootstrap\'s JavaScript requires jQuery. jQuery must be included before Bootstrap\'s JavaScript.');
+    }
+
+    var version = $$$1.fn.jquery.split(' ')[0].split('.');
+    var minMajor = 1;
+    var ltMajor = 2;
+    var minMinor = 9;
+    var minPatch = 1;
+    var maxMajor = 4;
+
+    if (version[0] < ltMajor && version[1] < minMinor || version[0] === minMajor && version[1] === minMinor && version[2] < minPatch || version[0] >= maxMajor) {
+      throw new Error('Bootstrap\'s JavaScript requires at least jQuery v1.9.1 but less than v4.0.0');
+    }
+  })($);
+
+  exports.Util = Util;
+  exports.Alert = Alert;
+  exports.Button = Button;
+  exports.Carousel = Carousel;
+  exports.Collapse = Collapse;
+  exports.Dropdown = Dropdown;
+  exports.Modal = Modal;
+  exports.Popover = Popover;
+  exports.Scrollspy = ScrollSpy;
+  exports.Tab = Tab;
+  exports.Tooltip = Tooltip;
+
+  Object.defineProperty(exports, '__esModule', { value: true });
+
+})));
+//# sourceMappingURL=bootstrap.bundle.js.map
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/bootstrap-4/bootstrap-4.css b/ee/bulk-operations-dashboard/assets/dependencies/bootstrap-4/bootstrap-4.css
new file mode 100644
index 000000000000..943532db554c
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/bootstrap-4/bootstrap-4.css
@@ -0,0 +1,9030 @@
+/*!
+ * Bootstrap v4.1.3 (https://getbootstrap.com/)
+ * Copyright 2011-2018 The Bootstrap Authors
+ * Copyright 2011-2018 Twitter, Inc.
+ * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+ */
+:root {
+  --blue: #007bff;
+  --indigo: #6610f2;
+  --purple: #6f42c1;
+  --pink: #e83e8c;
+  --red: #dc3545;
+  --orange: #fd7e14;
+  --yellow: #ffc107;
+  --green: #28a745;
+  --teal: #20c997;
+  --cyan: #17a2b8;
+  --white: #fff;
+  --gray: #6c757d;
+  --gray-dark: #343a40;
+  --primary: #007bff;
+  --secondary: #6c757d;
+  --success: #28a745;
+  --info: #17a2b8;
+  --warning: #ffc107;
+  --danger: #dc3545;
+  --light: #f8f9fa;
+  --dark: #343a40;
+  --breakpoint-xs: 0;
+  --breakpoint-sm: 576px;
+  --breakpoint-md: 768px;
+  --breakpoint-lg: 992px;
+  --breakpoint-xl: 1200px;
+  --font-family-sans-serif: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
+  --font-family-monospace: SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
+}
+
+*,
+*::before,
+*::after {
+  box-sizing: border-box;
+}
+
+html {
+  font-family: sans-serif;
+  line-height: 1.15;
+  -webkit-text-size-adjust: 100%;
+  -ms-text-size-adjust: 100%;
+  -ms-overflow-style: scrollbar;
+  -webkit-tap-highlight-color: rgba(0, 0, 0, 0);
+}
+
+@-ms-viewport {
+  width: device-width;
+}
+
+article, aside, figcaption, figure, footer, header, hgroup, main, nav, section {
+  display: block;
+}
+
+body {
+  margin: 0;
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
+  font-size: 1rem;
+  font-weight: 400;
+  line-height: 1.5;
+  color: #212529;
+  text-align: left;
+  background-color: #fff;
+}
+
+[tabindex="-1"]:focus {
+  outline: 0 !important;
+}
+
+hr {
+  box-sizing: content-box;
+  height: 0;
+  overflow: visible;
+}
+
+h1, h2, h3, h4, h5, h6 {
+  margin-top: 0;
+  margin-bottom: 0.5rem;
+}
+
+p {
+  margin-top: 0;
+  margin-bottom: 1rem;
+}
+
+abbr[title],
+abbr[data-original-title] {
+  text-decoration: underline;
+  -webkit-text-decoration: underline dotted;
+  text-decoration: underline dotted;
+  cursor: help;
+  border-bottom: 0;
+}
+
+address {
+  margin-bottom: 1rem;
+  font-style: normal;
+  line-height: inherit;
+}
+
+ol,
+ul,
+dl {
+  margin-top: 0;
+  margin-bottom: 1rem;
+}
+
+ol ol,
+ul ul,
+ol ul,
+ul ol {
+  margin-bottom: 0;
+}
+
+dt {
+  font-weight: 700;
+}
+
+dd {
+  margin-bottom: .5rem;
+  margin-left: 0;
+}
+
+blockquote {
+  margin: 0 0 1rem;
+}
+
+dfn {
+  font-style: italic;
+}
+
+b,
+strong {
+  font-weight: bolder;
+}
+
+small {
+  font-size: 80%;
+}
+
+sub,
+sup {
+  position: relative;
+  font-size: 75%;
+  line-height: 0;
+  vertical-align: baseline;
+}
+
+sub {
+  bottom: -.25em;
+}
+
+sup {
+  top: -.5em;
+}
+
+a {
+  color: #007bff;
+  text-decoration: none;
+  background-color: transparent;
+  -webkit-text-decoration-skip: objects;
+}
+
+a:hover {
+  color: #0056b3;
+  text-decoration: underline;
+}
+
+a:not([href]):not([tabindex]) {
+  color: inherit;
+  text-decoration: none;
+}
+
+a:not([href]):not([tabindex]):hover, a:not([href]):not([tabindex]):focus {
+  color: inherit;
+  text-decoration: none;
+}
+
+a:not([href]):not([tabindex]):focus {
+  outline: 0;
+}
+
+pre,
+code,
+kbd,
+samp {
+  font-family: SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
+  font-size: 1em;
+}
+
+pre {
+  margin-top: 0;
+  margin-bottom: 1rem;
+  overflow: auto;
+  -ms-overflow-style: scrollbar;
+}
+
+figure {
+  margin: 0 0 1rem;
+}
+
+img {
+  vertical-align: middle;
+  border-style: none;
+}
+
+svg {
+  overflow: hidden;
+  vertical-align: middle;
+}
+
+table {
+  border-collapse: collapse;
+}
+
+caption {
+  padding-top: 0.75rem;
+  padding-bottom: 0.75rem;
+  color: #6c757d;
+  text-align: left;
+  caption-side: bottom;
+}
+
+th {
+  text-align: inherit;
+}
+
+label {
+  display: inline-block;
+  margin-bottom: 0.5rem;
+}
+
+button {
+  border-radius: 0;
+}
+
+button:focus {
+  outline: 1px dotted;
+  outline: 5px auto -webkit-focus-ring-color;
+}
+
+input,
+button,
+select,
+optgroup,
+textarea {
+  margin: 0;
+  font-family: inherit;
+  font-size: inherit;
+  line-height: inherit;
+}
+
+button,
+input {
+  overflow: visible;
+}
+
+button,
+select {
+  text-transform: none;
+}
+
+button,
+html [type="button"],
+[type="reset"],
+[type="submit"] {
+  -webkit-appearance: button;
+}
+
+button::-moz-focus-inner,
+[type="button"]::-moz-focus-inner,
+[type="reset"]::-moz-focus-inner,
+[type="submit"]::-moz-focus-inner {
+  padding: 0;
+  border-style: none;
+}
+
+input[type="radio"],
+input[type="checkbox"] {
+  box-sizing: border-box;
+  padding: 0;
+}
+
+input[type="date"],
+input[type="time"],
+input[type="datetime-local"],
+input[type="month"] {
+  -webkit-appearance: listbox;
+}
+
+textarea {
+  overflow: auto;
+  resize: vertical;
+}
+
+fieldset {
+  min-width: 0;
+  padding: 0;
+  margin: 0;
+  border: 0;
+}
+
+legend {
+  display: block;
+  width: 100%;
+  max-width: 100%;
+  padding: 0;
+  margin-bottom: .5rem;
+  font-size: 1.5rem;
+  line-height: inherit;
+  color: inherit;
+  white-space: normal;
+}
+
+progress {
+  vertical-align: baseline;
+}
+
+[type="number"]::-webkit-inner-spin-button,
+[type="number"]::-webkit-outer-spin-button {
+  height: auto;
+}
+
+[type="search"] {
+  outline-offset: -2px;
+  -webkit-appearance: none;
+}
+
+[type="search"]::-webkit-search-cancel-button,
+[type="search"]::-webkit-search-decoration {
+  -webkit-appearance: none;
+}
+
+::-webkit-file-upload-button {
+  font: inherit;
+  -webkit-appearance: button;
+}
+
+output {
+  display: inline-block;
+}
+
+summary {
+  display: list-item;
+  cursor: pointer;
+}
+
+template {
+  display: none;
+}
+
+[hidden] {
+  display: none !important;
+}
+
+h1, h2, h3, h4, h5, h6,
+.h1, .h2, .h3, .h4, .h5, .h6 {
+  margin-bottom: 0.5rem;
+  font-family: inherit;
+  font-weight: 500;
+  line-height: 1.2;
+  color: inherit;
+}
+
+h1, .h1 {
+  font-size: 2.5rem;
+}
+
+h2, .h2 {
+  font-size: 2rem;
+}
+
+h3, .h3 {
+  font-size: 1.75rem;
+}
+
+h4, .h4 {
+  font-size: 1.5rem;
+}
+
+h5, .h5 {
+  font-size: 1.25rem;
+}
+
+h6, .h6 {
+  font-size: 1rem;
+}
+
+.lead {
+  font-size: 1.25rem;
+  font-weight: 300;
+}
+
+.display-1 {
+  font-size: 6rem;
+  font-weight: 300;
+  line-height: 1.2;
+}
+
+.display-2 {
+  font-size: 5.5rem;
+  font-weight: 300;
+  line-height: 1.2;
+}
+
+.display-3 {
+  font-size: 4.5rem;
+  font-weight: 300;
+  line-height: 1.2;
+}
+
+.display-4 {
+  font-size: 3.5rem;
+  font-weight: 300;
+  line-height: 1.2;
+}
+
+hr {
+  margin-top: 1rem;
+  margin-bottom: 1rem;
+  border: 0;
+  border-top: 1px solid rgba(0, 0, 0, 0.1);
+}
+
+small,
+.small {
+  font-size: 80%;
+  font-weight: 400;
+}
+
+mark,
+.mark {
+  padding: 0.2em;
+  background-color: #fcf8e3;
+}
+
+.list-unstyled {
+  padding-left: 0;
+  list-style: none;
+}
+
+.list-inline {
+  padding-left: 0;
+  list-style: none;
+}
+
+.list-inline-item {
+  display: inline-block;
+}
+
+.list-inline-item:not(:last-child) {
+  margin-right: 0.5rem;
+}
+
+.initialism {
+  font-size: 90%;
+  text-transform: uppercase;
+}
+
+.blockquote {
+  margin-bottom: 1rem;
+  font-size: 1.25rem;
+}
+
+.blockquote-footer {
+  display: block;
+  font-size: 80%;
+  color: #6c757d;
+}
+
+.blockquote-footer::before {
+  content: "\2014 \00A0";
+}
+
+.img-fluid {
+  max-width: 100%;
+  height: auto;
+}
+
+.img-thumbnail {
+  padding: 0.25rem;
+  background-color: #fff;
+  border: 1px solid #dee2e6;
+  border-radius: 0.25rem;
+  max-width: 100%;
+  height: auto;
+}
+
+.figure {
+  display: inline-block;
+}
+
+.figure-img {
+  margin-bottom: 0.5rem;
+  line-height: 1;
+}
+
+.figure-caption {
+  font-size: 90%;
+  color: #6c757d;
+}
+
+code {
+  font-size: 87.5%;
+  color: #e83e8c;
+  word-break: break-word;
+}
+
+a > code {
+  color: inherit;
+}
+
+kbd {
+  padding: 0.2rem 0.4rem;
+  font-size: 87.5%;
+  color: #fff;
+  background-color: #212529;
+  border-radius: 0.2rem;
+}
+
+kbd kbd {
+  padding: 0;
+  font-size: 100%;
+  font-weight: 700;
+}
+
+pre {
+  display: block;
+  font-size: 87.5%;
+  color: #212529;
+}
+
+pre code {
+  font-size: inherit;
+  color: inherit;
+  word-break: normal;
+}
+
+.pre-scrollable {
+  max-height: 340px;
+  overflow-y: scroll;
+}
+
+.container {
+  width: 100%;
+  padding-right: 15px;
+  padding-left: 15px;
+  margin-right: auto;
+  margin-left: auto;
+}
+
+@media (min-width: 576px) {
+  .container {
+    max-width: 540px;
+  }
+}
+
+@media (min-width: 768px) {
+  .container {
+    max-width: 720px;
+  }
+}
+
+@media (min-width: 992px) {
+  .container {
+    max-width: 960px;
+  }
+}
+
+@media (min-width: 1200px) {
+  .container {
+    max-width: 1140px;
+  }
+}
+
+.container-fluid {
+  width: 100%;
+  padding-right: 15px;
+  padding-left: 15px;
+  margin-right: auto;
+  margin-left: auto;
+}
+
+.row {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-wrap: wrap;
+  flex-wrap: wrap;
+  margin-right: -15px;
+  margin-left: -15px;
+}
+
+.no-gutters {
+  margin-right: 0;
+  margin-left: 0;
+}
+
+.no-gutters > .col,
+.no-gutters > [class*="col-"] {
+  padding-right: 0;
+  padding-left: 0;
+}
+
+.col-1, .col-2, .col-3, .col-4, .col-5, .col-6, .col-7, .col-8, .col-9, .col-10, .col-11, .col-12, .col,
+.col-auto, .col-sm-1, .col-sm-2, .col-sm-3, .col-sm-4, .col-sm-5, .col-sm-6, .col-sm-7, .col-sm-8, .col-sm-9, .col-sm-10, .col-sm-11, .col-sm-12, .col-sm,
+.col-sm-auto, .col-md-1, .col-md-2, .col-md-3, .col-md-4, .col-md-5, .col-md-6, .col-md-7, .col-md-8, .col-md-9, .col-md-10, .col-md-11, .col-md-12, .col-md,
+.col-md-auto, .col-lg-1, .col-lg-2, .col-lg-3, .col-lg-4, .col-lg-5, .col-lg-6, .col-lg-7, .col-lg-8, .col-lg-9, .col-lg-10, .col-lg-11, .col-lg-12, .col-lg,
+.col-lg-auto, .col-xl-1, .col-xl-2, .col-xl-3, .col-xl-4, .col-xl-5, .col-xl-6, .col-xl-7, .col-xl-8, .col-xl-9, .col-xl-10, .col-xl-11, .col-xl-12, .col-xl,
+.col-xl-auto {
+  position: relative;
+  width: 100%;
+  min-height: 1px;
+  padding-right: 15px;
+  padding-left: 15px;
+}
+
+.col {
+  -ms-flex-preferred-size: 0;
+  flex-basis: 0;
+  -ms-flex-positive: 1;
+  flex-grow: 1;
+  max-width: 100%;
+}
+
+.col-auto {
+  -ms-flex: 0 0 auto;
+  flex: 0 0 auto;
+  width: auto;
+  max-width: none;
+}
+
+.col-1 {
+  -ms-flex: 0 0 8.333333%;
+  flex: 0 0 8.333333%;
+  max-width: 8.333333%;
+}
+
+.col-2 {
+  -ms-flex: 0 0 16.666667%;
+  flex: 0 0 16.666667%;
+  max-width: 16.666667%;
+}
+
+.col-3 {
+  -ms-flex: 0 0 25%;
+  flex: 0 0 25%;
+  max-width: 25%;
+}
+
+.col-4 {
+  -ms-flex: 0 0 33.333333%;
+  flex: 0 0 33.333333%;
+  max-width: 33.333333%;
+}
+
+.col-5 {
+  -ms-flex: 0 0 41.666667%;
+  flex: 0 0 41.666667%;
+  max-width: 41.666667%;
+}
+
+.col-6 {
+  -ms-flex: 0 0 50%;
+  flex: 0 0 50%;
+  max-width: 50%;
+}
+
+.col-7 {
+  -ms-flex: 0 0 58.333333%;
+  flex: 0 0 58.333333%;
+  max-width: 58.333333%;
+}
+
+.col-8 {
+  -ms-flex: 0 0 66.666667%;
+  flex: 0 0 66.666667%;
+  max-width: 66.666667%;
+}
+
+.col-9 {
+  -ms-flex: 0 0 75%;
+  flex: 0 0 75%;
+  max-width: 75%;
+}
+
+.col-10 {
+  -ms-flex: 0 0 83.333333%;
+  flex: 0 0 83.333333%;
+  max-width: 83.333333%;
+}
+
+.col-11 {
+  -ms-flex: 0 0 91.666667%;
+  flex: 0 0 91.666667%;
+  max-width: 91.666667%;
+}
+
+.col-12 {
+  -ms-flex: 0 0 100%;
+  flex: 0 0 100%;
+  max-width: 100%;
+}
+
+.order-first {
+  -ms-flex-order: -1;
+  order: -1;
+}
+
+.order-last {
+  -ms-flex-order: 13;
+  order: 13;
+}
+
+.order-0 {
+  -ms-flex-order: 0;
+  order: 0;
+}
+
+.order-1 {
+  -ms-flex-order: 1;
+  order: 1;
+}
+
+.order-2 {
+  -ms-flex-order: 2;
+  order: 2;
+}
+
+.order-3 {
+  -ms-flex-order: 3;
+  order: 3;
+}
+
+.order-4 {
+  -ms-flex-order: 4;
+  order: 4;
+}
+
+.order-5 {
+  -ms-flex-order: 5;
+  order: 5;
+}
+
+.order-6 {
+  -ms-flex-order: 6;
+  order: 6;
+}
+
+.order-7 {
+  -ms-flex-order: 7;
+  order: 7;
+}
+
+.order-8 {
+  -ms-flex-order: 8;
+  order: 8;
+}
+
+.order-9 {
+  -ms-flex-order: 9;
+  order: 9;
+}
+
+.order-10 {
+  -ms-flex-order: 10;
+  order: 10;
+}
+
+.order-11 {
+  -ms-flex-order: 11;
+  order: 11;
+}
+
+.order-12 {
+  -ms-flex-order: 12;
+  order: 12;
+}
+
+.offset-1 {
+  margin-left: 8.333333%;
+}
+
+.offset-2 {
+  margin-left: 16.666667%;
+}
+
+.offset-3 {
+  margin-left: 25%;
+}
+
+.offset-4 {
+  margin-left: 33.333333%;
+}
+
+.offset-5 {
+  margin-left: 41.666667%;
+}
+
+.offset-6 {
+  margin-left: 50%;
+}
+
+.offset-7 {
+  margin-left: 58.333333%;
+}
+
+.offset-8 {
+  margin-left: 66.666667%;
+}
+
+.offset-9 {
+  margin-left: 75%;
+}
+
+.offset-10 {
+  margin-left: 83.333333%;
+}
+
+.offset-11 {
+  margin-left: 91.666667%;
+}
+
+@media (min-width: 576px) {
+  .col-sm {
+    -ms-flex-preferred-size: 0;
+    flex-basis: 0;
+    -ms-flex-positive: 1;
+    flex-grow: 1;
+    max-width: 100%;
+  }
+  .col-sm-auto {
+    -ms-flex: 0 0 auto;
+    flex: 0 0 auto;
+    width: auto;
+    max-width: none;
+  }
+  .col-sm-1 {
+    -ms-flex: 0 0 8.333333%;
+    flex: 0 0 8.333333%;
+    max-width: 8.333333%;
+  }
+  .col-sm-2 {
+    -ms-flex: 0 0 16.666667%;
+    flex: 0 0 16.666667%;
+    max-width: 16.666667%;
+  }
+  .col-sm-3 {
+    -ms-flex: 0 0 25%;
+    flex: 0 0 25%;
+    max-width: 25%;
+  }
+  .col-sm-4 {
+    -ms-flex: 0 0 33.333333%;
+    flex: 0 0 33.333333%;
+    max-width: 33.333333%;
+  }
+  .col-sm-5 {
+    -ms-flex: 0 0 41.666667%;
+    flex: 0 0 41.666667%;
+    max-width: 41.666667%;
+  }
+  .col-sm-6 {
+    -ms-flex: 0 0 50%;
+    flex: 0 0 50%;
+    max-width: 50%;
+  }
+  .col-sm-7 {
+    -ms-flex: 0 0 58.333333%;
+    flex: 0 0 58.333333%;
+    max-width: 58.333333%;
+  }
+  .col-sm-8 {
+    -ms-flex: 0 0 66.666667%;
+    flex: 0 0 66.666667%;
+    max-width: 66.666667%;
+  }
+  .col-sm-9 {
+    -ms-flex: 0 0 75%;
+    flex: 0 0 75%;
+    max-width: 75%;
+  }
+  .col-sm-10 {
+    -ms-flex: 0 0 83.333333%;
+    flex: 0 0 83.333333%;
+    max-width: 83.333333%;
+  }
+  .col-sm-11 {
+    -ms-flex: 0 0 91.666667%;
+    flex: 0 0 91.666667%;
+    max-width: 91.666667%;
+  }
+  .col-sm-12 {
+    -ms-flex: 0 0 100%;
+    flex: 0 0 100%;
+    max-width: 100%;
+  }
+  .order-sm-first {
+    -ms-flex-order: -1;
+    order: -1;
+  }
+  .order-sm-last {
+    -ms-flex-order: 13;
+    order: 13;
+  }
+  .order-sm-0 {
+    -ms-flex-order: 0;
+    order: 0;
+  }
+  .order-sm-1 {
+    -ms-flex-order: 1;
+    order: 1;
+  }
+  .order-sm-2 {
+    -ms-flex-order: 2;
+    order: 2;
+  }
+  .order-sm-3 {
+    -ms-flex-order: 3;
+    order: 3;
+  }
+  .order-sm-4 {
+    -ms-flex-order: 4;
+    order: 4;
+  }
+  .order-sm-5 {
+    -ms-flex-order: 5;
+    order: 5;
+  }
+  .order-sm-6 {
+    -ms-flex-order: 6;
+    order: 6;
+  }
+  .order-sm-7 {
+    -ms-flex-order: 7;
+    order: 7;
+  }
+  .order-sm-8 {
+    -ms-flex-order: 8;
+    order: 8;
+  }
+  .order-sm-9 {
+    -ms-flex-order: 9;
+    order: 9;
+  }
+  .order-sm-10 {
+    -ms-flex-order: 10;
+    order: 10;
+  }
+  .order-sm-11 {
+    -ms-flex-order: 11;
+    order: 11;
+  }
+  .order-sm-12 {
+    -ms-flex-order: 12;
+    order: 12;
+  }
+  .offset-sm-0 {
+    margin-left: 0;
+  }
+  .offset-sm-1 {
+    margin-left: 8.333333%;
+  }
+  .offset-sm-2 {
+    margin-left: 16.666667%;
+  }
+  .offset-sm-3 {
+    margin-left: 25%;
+  }
+  .offset-sm-4 {
+    margin-left: 33.333333%;
+  }
+  .offset-sm-5 {
+    margin-left: 41.666667%;
+  }
+  .offset-sm-6 {
+    margin-left: 50%;
+  }
+  .offset-sm-7 {
+    margin-left: 58.333333%;
+  }
+  .offset-sm-8 {
+    margin-left: 66.666667%;
+  }
+  .offset-sm-9 {
+    margin-left: 75%;
+  }
+  .offset-sm-10 {
+    margin-left: 83.333333%;
+  }
+  .offset-sm-11 {
+    margin-left: 91.666667%;
+  }
+}
+
+@media (min-width: 768px) {
+  .col-md {
+    -ms-flex-preferred-size: 0;
+    flex-basis: 0;
+    -ms-flex-positive: 1;
+    flex-grow: 1;
+    max-width: 100%;
+  }
+  .col-md-auto {
+    -ms-flex: 0 0 auto;
+    flex: 0 0 auto;
+    width: auto;
+    max-width: none;
+  }
+  .col-md-1 {
+    -ms-flex: 0 0 8.333333%;
+    flex: 0 0 8.333333%;
+    max-width: 8.333333%;
+  }
+  .col-md-2 {
+    -ms-flex: 0 0 16.666667%;
+    flex: 0 0 16.666667%;
+    max-width: 16.666667%;
+  }
+  .col-md-3 {
+    -ms-flex: 0 0 25%;
+    flex: 0 0 25%;
+    max-width: 25%;
+  }
+  .col-md-4 {
+    -ms-flex: 0 0 33.333333%;
+    flex: 0 0 33.333333%;
+    max-width: 33.333333%;
+  }
+  .col-md-5 {
+    -ms-flex: 0 0 41.666667%;
+    flex: 0 0 41.666667%;
+    max-width: 41.666667%;
+  }
+  .col-md-6 {
+    -ms-flex: 0 0 50%;
+    flex: 0 0 50%;
+    max-width: 50%;
+  }
+  .col-md-7 {
+    -ms-flex: 0 0 58.333333%;
+    flex: 0 0 58.333333%;
+    max-width: 58.333333%;
+  }
+  .col-md-8 {
+    -ms-flex: 0 0 66.666667%;
+    flex: 0 0 66.666667%;
+    max-width: 66.666667%;
+  }
+  .col-md-9 {
+    -ms-flex: 0 0 75%;
+    flex: 0 0 75%;
+    max-width: 75%;
+  }
+  .col-md-10 {
+    -ms-flex: 0 0 83.333333%;
+    flex: 0 0 83.333333%;
+    max-width: 83.333333%;
+  }
+  .col-md-11 {
+    -ms-flex: 0 0 91.666667%;
+    flex: 0 0 91.666667%;
+    max-width: 91.666667%;
+  }
+  .col-md-12 {
+    -ms-flex: 0 0 100%;
+    flex: 0 0 100%;
+    max-width: 100%;
+  }
+  .order-md-first {
+    -ms-flex-order: -1;
+    order: -1;
+  }
+  .order-md-last {
+    -ms-flex-order: 13;
+    order: 13;
+  }
+  .order-md-0 {
+    -ms-flex-order: 0;
+    order: 0;
+  }
+  .order-md-1 {
+    -ms-flex-order: 1;
+    order: 1;
+  }
+  .order-md-2 {
+    -ms-flex-order: 2;
+    order: 2;
+  }
+  .order-md-3 {
+    -ms-flex-order: 3;
+    order: 3;
+  }
+  .order-md-4 {
+    -ms-flex-order: 4;
+    order: 4;
+  }
+  .order-md-5 {
+    -ms-flex-order: 5;
+    order: 5;
+  }
+  .order-md-6 {
+    -ms-flex-order: 6;
+    order: 6;
+  }
+  .order-md-7 {
+    -ms-flex-order: 7;
+    order: 7;
+  }
+  .order-md-8 {
+    -ms-flex-order: 8;
+    order: 8;
+  }
+  .order-md-9 {
+    -ms-flex-order: 9;
+    order: 9;
+  }
+  .order-md-10 {
+    -ms-flex-order: 10;
+    order: 10;
+  }
+  .order-md-11 {
+    -ms-flex-order: 11;
+    order: 11;
+  }
+  .order-md-12 {
+    -ms-flex-order: 12;
+    order: 12;
+  }
+  .offset-md-0 {
+    margin-left: 0;
+  }
+  .offset-md-1 {
+    margin-left: 8.333333%;
+  }
+  .offset-md-2 {
+    margin-left: 16.666667%;
+  }
+  .offset-md-3 {
+    margin-left: 25%;
+  }
+  .offset-md-4 {
+    margin-left: 33.333333%;
+  }
+  .offset-md-5 {
+    margin-left: 41.666667%;
+  }
+  .offset-md-6 {
+    margin-left: 50%;
+  }
+  .offset-md-7 {
+    margin-left: 58.333333%;
+  }
+  .offset-md-8 {
+    margin-left: 66.666667%;
+  }
+  .offset-md-9 {
+    margin-left: 75%;
+  }
+  .offset-md-10 {
+    margin-left: 83.333333%;
+  }
+  .offset-md-11 {
+    margin-left: 91.666667%;
+  }
+}
+
+@media (min-width: 992px) {
+  .col-lg {
+    -ms-flex-preferred-size: 0;
+    flex-basis: 0;
+    -ms-flex-positive: 1;
+    flex-grow: 1;
+    max-width: 100%;
+  }
+  .col-lg-auto {
+    -ms-flex: 0 0 auto;
+    flex: 0 0 auto;
+    width: auto;
+    max-width: none;
+  }
+  .col-lg-1 {
+    -ms-flex: 0 0 8.333333%;
+    flex: 0 0 8.333333%;
+    max-width: 8.333333%;
+  }
+  .col-lg-2 {
+    -ms-flex: 0 0 16.666667%;
+    flex: 0 0 16.666667%;
+    max-width: 16.666667%;
+  }
+  .col-lg-3 {
+    -ms-flex: 0 0 25%;
+    flex: 0 0 25%;
+    max-width: 25%;
+  }
+  .col-lg-4 {
+    -ms-flex: 0 0 33.333333%;
+    flex: 0 0 33.333333%;
+    max-width: 33.333333%;
+  }
+  .col-lg-5 {
+    -ms-flex: 0 0 41.666667%;
+    flex: 0 0 41.666667%;
+    max-width: 41.666667%;
+  }
+  .col-lg-6 {
+    -ms-flex: 0 0 50%;
+    flex: 0 0 50%;
+    max-width: 50%;
+  }
+  .col-lg-7 {
+    -ms-flex: 0 0 58.333333%;
+    flex: 0 0 58.333333%;
+    max-width: 58.333333%;
+  }
+  .col-lg-8 {
+    -ms-flex: 0 0 66.666667%;
+    flex: 0 0 66.666667%;
+    max-width: 66.666667%;
+  }
+  .col-lg-9 {
+    -ms-flex: 0 0 75%;
+    flex: 0 0 75%;
+    max-width: 75%;
+  }
+  .col-lg-10 {
+    -ms-flex: 0 0 83.333333%;
+    flex: 0 0 83.333333%;
+    max-width: 83.333333%;
+  }
+  .col-lg-11 {
+    -ms-flex: 0 0 91.666667%;
+    flex: 0 0 91.666667%;
+    max-width: 91.666667%;
+  }
+  .col-lg-12 {
+    -ms-flex: 0 0 100%;
+    flex: 0 0 100%;
+    max-width: 100%;
+  }
+  .order-lg-first {
+    -ms-flex-order: -1;
+    order: -1;
+  }
+  .order-lg-last {
+    -ms-flex-order: 13;
+    order: 13;
+  }
+  .order-lg-0 {
+    -ms-flex-order: 0;
+    order: 0;
+  }
+  .order-lg-1 {
+    -ms-flex-order: 1;
+    order: 1;
+  }
+  .order-lg-2 {
+    -ms-flex-order: 2;
+    order: 2;
+  }
+  .order-lg-3 {
+    -ms-flex-order: 3;
+    order: 3;
+  }
+  .order-lg-4 {
+    -ms-flex-order: 4;
+    order: 4;
+  }
+  .order-lg-5 {
+    -ms-flex-order: 5;
+    order: 5;
+  }
+  .order-lg-6 {
+    -ms-flex-order: 6;
+    order: 6;
+  }
+  .order-lg-7 {
+    -ms-flex-order: 7;
+    order: 7;
+  }
+  .order-lg-8 {
+    -ms-flex-order: 8;
+    order: 8;
+  }
+  .order-lg-9 {
+    -ms-flex-order: 9;
+    order: 9;
+  }
+  .order-lg-10 {
+    -ms-flex-order: 10;
+    order: 10;
+  }
+  .order-lg-11 {
+    -ms-flex-order: 11;
+    order: 11;
+  }
+  .order-lg-12 {
+    -ms-flex-order: 12;
+    order: 12;
+  }
+  .offset-lg-0 {
+    margin-left: 0;
+  }
+  .offset-lg-1 {
+    margin-left: 8.333333%;
+  }
+  .offset-lg-2 {
+    margin-left: 16.666667%;
+  }
+  .offset-lg-3 {
+    margin-left: 25%;
+  }
+  .offset-lg-4 {
+    margin-left: 33.333333%;
+  }
+  .offset-lg-5 {
+    margin-left: 41.666667%;
+  }
+  .offset-lg-6 {
+    margin-left: 50%;
+  }
+  .offset-lg-7 {
+    margin-left: 58.333333%;
+  }
+  .offset-lg-8 {
+    margin-left: 66.666667%;
+  }
+  .offset-lg-9 {
+    margin-left: 75%;
+  }
+  .offset-lg-10 {
+    margin-left: 83.333333%;
+  }
+  .offset-lg-11 {
+    margin-left: 91.666667%;
+  }
+}
+
+@media (min-width: 1200px) {
+  .col-xl {
+    -ms-flex-preferred-size: 0;
+    flex-basis: 0;
+    -ms-flex-positive: 1;
+    flex-grow: 1;
+    max-width: 100%;
+  }
+  .col-xl-auto {
+    -ms-flex: 0 0 auto;
+    flex: 0 0 auto;
+    width: auto;
+    max-width: none;
+  }
+  .col-xl-1 {
+    -ms-flex: 0 0 8.333333%;
+    flex: 0 0 8.333333%;
+    max-width: 8.333333%;
+  }
+  .col-xl-2 {
+    -ms-flex: 0 0 16.666667%;
+    flex: 0 0 16.666667%;
+    max-width: 16.666667%;
+  }
+  .col-xl-3 {
+    -ms-flex: 0 0 25%;
+    flex: 0 0 25%;
+    max-width: 25%;
+  }
+  .col-xl-4 {
+    -ms-flex: 0 0 33.333333%;
+    flex: 0 0 33.333333%;
+    max-width: 33.333333%;
+  }
+  .col-xl-5 {
+    -ms-flex: 0 0 41.666667%;
+    flex: 0 0 41.666667%;
+    max-width: 41.666667%;
+  }
+  .col-xl-6 {
+    -ms-flex: 0 0 50%;
+    flex: 0 0 50%;
+    max-width: 50%;
+  }
+  .col-xl-7 {
+    -ms-flex: 0 0 58.333333%;
+    flex: 0 0 58.333333%;
+    max-width: 58.333333%;
+  }
+  .col-xl-8 {
+    -ms-flex: 0 0 66.666667%;
+    flex: 0 0 66.666667%;
+    max-width: 66.666667%;
+  }
+  .col-xl-9 {
+    -ms-flex: 0 0 75%;
+    flex: 0 0 75%;
+    max-width: 75%;
+  }
+  .col-xl-10 {
+    -ms-flex: 0 0 83.333333%;
+    flex: 0 0 83.333333%;
+    max-width: 83.333333%;
+  }
+  .col-xl-11 {
+    -ms-flex: 0 0 91.666667%;
+    flex: 0 0 91.666667%;
+    max-width: 91.666667%;
+  }
+  .col-xl-12 {
+    -ms-flex: 0 0 100%;
+    flex: 0 0 100%;
+    max-width: 100%;
+  }
+  .order-xl-first {
+    -ms-flex-order: -1;
+    order: -1;
+  }
+  .order-xl-last {
+    -ms-flex-order: 13;
+    order: 13;
+  }
+  .order-xl-0 {
+    -ms-flex-order: 0;
+    order: 0;
+  }
+  .order-xl-1 {
+    -ms-flex-order: 1;
+    order: 1;
+  }
+  .order-xl-2 {
+    -ms-flex-order: 2;
+    order: 2;
+  }
+  .order-xl-3 {
+    -ms-flex-order: 3;
+    order: 3;
+  }
+  .order-xl-4 {
+    -ms-flex-order: 4;
+    order: 4;
+  }
+  .order-xl-5 {
+    -ms-flex-order: 5;
+    order: 5;
+  }
+  .order-xl-6 {
+    -ms-flex-order: 6;
+    order: 6;
+  }
+  .order-xl-7 {
+    -ms-flex-order: 7;
+    order: 7;
+  }
+  .order-xl-8 {
+    -ms-flex-order: 8;
+    order: 8;
+  }
+  .order-xl-9 {
+    -ms-flex-order: 9;
+    order: 9;
+  }
+  .order-xl-10 {
+    -ms-flex-order: 10;
+    order: 10;
+  }
+  .order-xl-11 {
+    -ms-flex-order: 11;
+    order: 11;
+  }
+  .order-xl-12 {
+    -ms-flex-order: 12;
+    order: 12;
+  }
+  .offset-xl-0 {
+    margin-left: 0;
+  }
+  .offset-xl-1 {
+    margin-left: 8.333333%;
+  }
+  .offset-xl-2 {
+    margin-left: 16.666667%;
+  }
+  .offset-xl-3 {
+    margin-left: 25%;
+  }
+  .offset-xl-4 {
+    margin-left: 33.333333%;
+  }
+  .offset-xl-5 {
+    margin-left: 41.666667%;
+  }
+  .offset-xl-6 {
+    margin-left: 50%;
+  }
+  .offset-xl-7 {
+    margin-left: 58.333333%;
+  }
+  .offset-xl-8 {
+    margin-left: 66.666667%;
+  }
+  .offset-xl-9 {
+    margin-left: 75%;
+  }
+  .offset-xl-10 {
+    margin-left: 83.333333%;
+  }
+  .offset-xl-11 {
+    margin-left: 91.666667%;
+  }
+}
+
+.table {
+  width: 100%;
+  margin-bottom: 1rem;
+  background-color: transparent;
+}
+
+.table th,
+.table td {
+  padding: 0.75rem;
+  vertical-align: top;
+  border-top: 1px solid #dee2e6;
+}
+
+.table thead th {
+  vertical-align: bottom;
+  border-bottom: 2px solid #dee2e6;
+}
+
+.table tbody + tbody {
+  border-top: 2px solid #dee2e6;
+}
+
+.table .table {
+  background-color: #fff;
+}
+
+.table-sm th,
+.table-sm td {
+  padding: 0.3rem;
+}
+
+.table-bordered {
+  border: 1px solid #dee2e6;
+}
+
+.table-bordered th,
+.table-bordered td {
+  border: 1px solid #dee2e6;
+}
+
+.table-bordered thead th,
+.table-bordered thead td {
+  border-bottom-width: 2px;
+}
+
+.table-borderless th,
+.table-borderless td,
+.table-borderless thead th,
+.table-borderless tbody + tbody {
+  border: 0;
+}
+
+.table-striped tbody tr:nth-of-type(odd) {
+  background-color: rgba(0, 0, 0, 0.05);
+}
+
+.table-hover tbody tr:hover {
+  background-color: rgba(0, 0, 0, 0.075);
+}
+
+.table-primary,
+.table-primary > th,
+.table-primary > td {
+  background-color: #b8daff;
+}
+
+.table-hover .table-primary:hover {
+  background-color: #9fcdff;
+}
+
+.table-hover .table-primary:hover > td,
+.table-hover .table-primary:hover > th {
+  background-color: #9fcdff;
+}
+
+.table-secondary,
+.table-secondary > th,
+.table-secondary > td {
+  background-color: #d6d8db;
+}
+
+.table-hover .table-secondary:hover {
+  background-color: #c8cbcf;
+}
+
+.table-hover .table-secondary:hover > td,
+.table-hover .table-secondary:hover > th {
+  background-color: #c8cbcf;
+}
+
+.table-success,
+.table-success > th,
+.table-success > td {
+  background-color: #c3e6cb;
+}
+
+.table-hover .table-success:hover {
+  background-color: #b1dfbb;
+}
+
+.table-hover .table-success:hover > td,
+.table-hover .table-success:hover > th {
+  background-color: #b1dfbb;
+}
+
+.table-info,
+.table-info > th,
+.table-info > td {
+  background-color: #bee5eb;
+}
+
+.table-hover .table-info:hover {
+  background-color: #abdde5;
+}
+
+.table-hover .table-info:hover > td,
+.table-hover .table-info:hover > th {
+  background-color: #abdde5;
+}
+
+.table-warning,
+.table-warning > th,
+.table-warning > td {
+  background-color: #ffeeba;
+}
+
+.table-hover .table-warning:hover {
+  background-color: #ffe8a1;
+}
+
+.table-hover .table-warning:hover > td,
+.table-hover .table-warning:hover > th {
+  background-color: #ffe8a1;
+}
+
+.table-danger,
+.table-danger > th,
+.table-danger > td {
+  background-color: #f5c6cb;
+}
+
+.table-hover .table-danger:hover {
+  background-color: #f1b0b7;
+}
+
+.table-hover .table-danger:hover > td,
+.table-hover .table-danger:hover > th {
+  background-color: #f1b0b7;
+}
+
+.table-light,
+.table-light > th,
+.table-light > td {
+  background-color: #fdfdfe;
+}
+
+.table-hover .table-light:hover {
+  background-color: #ececf6;
+}
+
+.table-hover .table-light:hover > td,
+.table-hover .table-light:hover > th {
+  background-color: #ececf6;
+}
+
+.table-dark,
+.table-dark > th,
+.table-dark > td {
+  background-color: #c6c8ca;
+}
+
+.table-hover .table-dark:hover {
+  background-color: #b9bbbe;
+}
+
+.table-hover .table-dark:hover > td,
+.table-hover .table-dark:hover > th {
+  background-color: #b9bbbe;
+}
+
+.table-active,
+.table-active > th,
+.table-active > td {
+  background-color: rgba(0, 0, 0, 0.075);
+}
+
+.table-hover .table-active:hover {
+  background-color: rgba(0, 0, 0, 0.075);
+}
+
+.table-hover .table-active:hover > td,
+.table-hover .table-active:hover > th {
+  background-color: rgba(0, 0, 0, 0.075);
+}
+
+.table .thead-dark th {
+  color: #fff;
+  background-color: #212529;
+  border-color: #32383e;
+}
+
+.table .thead-light th {
+  color: #495057;
+  background-color: #e9ecef;
+  border-color: #dee2e6;
+}
+
+.table-dark {
+  color: #fff;
+  background-color: #212529;
+}
+
+.table-dark th,
+.table-dark td,
+.table-dark thead th {
+  border-color: #32383e;
+}
+
+.table-dark.table-bordered {
+  border: 0;
+}
+
+.table-dark.table-striped tbody tr:nth-of-type(odd) {
+  background-color: rgba(255, 255, 255, 0.05);
+}
+
+.table-dark.table-hover tbody tr:hover {
+  background-color: rgba(255, 255, 255, 0.075);
+}
+
+@media (max-width: 575.98px) {
+  .table-responsive-sm {
+    display: block;
+    width: 100%;
+    overflow-x: auto;
+    -webkit-overflow-scrolling: touch;
+    -ms-overflow-style: -ms-autohiding-scrollbar;
+  }
+  .table-responsive-sm > .table-bordered {
+    border: 0;
+  }
+}
+
+@media (max-width: 767.98px) {
+  .table-responsive-md {
+    display: block;
+    width: 100%;
+    overflow-x: auto;
+    -webkit-overflow-scrolling: touch;
+    -ms-overflow-style: -ms-autohiding-scrollbar;
+  }
+  .table-responsive-md > .table-bordered {
+    border: 0;
+  }
+}
+
+@media (max-width: 991.98px) {
+  .table-responsive-lg {
+    display: block;
+    width: 100%;
+    overflow-x: auto;
+    -webkit-overflow-scrolling: touch;
+    -ms-overflow-style: -ms-autohiding-scrollbar;
+  }
+  .table-responsive-lg > .table-bordered {
+    border: 0;
+  }
+}
+
+@media (max-width: 1199.98px) {
+  .table-responsive-xl {
+    display: block;
+    width: 100%;
+    overflow-x: auto;
+    -webkit-overflow-scrolling: touch;
+    -ms-overflow-style: -ms-autohiding-scrollbar;
+  }
+  .table-responsive-xl > .table-bordered {
+    border: 0;
+  }
+}
+
+.table-responsive {
+  display: block;
+  width: 100%;
+  overflow-x: auto;
+  -webkit-overflow-scrolling: touch;
+  -ms-overflow-style: -ms-autohiding-scrollbar;
+}
+
+.table-responsive > .table-bordered {
+  border: 0;
+}
+
+.form-control {
+  display: block;
+  width: 100%;
+  height: calc(2.25rem + 2px);
+  padding: 0.375rem 0.75rem;
+  font-size: 1rem;
+  line-height: 1.5;
+  color: #495057;
+  background-color: #fff;
+  background-clip: padding-box;
+  border: 1px solid #ced4da;
+  border-radius: 0.25rem;
+  transition: border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .form-control {
+    transition: none;
+  }
+}
+
+.form-control::-ms-expand {
+  background-color: transparent;
+  border: 0;
+}
+
+.form-control:focus {
+  color: #495057;
+  background-color: #fff;
+  border-color: #80bdff;
+  outline: 0;
+  box-shadow: 0 0 0 0.2rem rgba(0, 123, 255, 0.25);
+}
+
+.form-control::-webkit-input-placeholder {
+  color: #6c757d;
+  opacity: 1;
+}
+
+.form-control::-moz-placeholder {
+  color: #6c757d;
+  opacity: 1;
+}
+
+.form-control:-ms-input-placeholder {
+  color: #6c757d;
+  opacity: 1;
+}
+
+.form-control::-ms-input-placeholder {
+  color: #6c757d;
+  opacity: 1;
+}
+
+.form-control::placeholder {
+  color: #6c757d;
+  opacity: 1;
+}
+
+.form-control:disabled, .form-control[readonly] {
+  background-color: #e9ecef;
+  opacity: 1;
+}
+
+select.form-control:focus::-ms-value {
+  color: #495057;
+  background-color: #fff;
+}
+
+.form-control-file,
+.form-control-range {
+  display: block;
+  width: 100%;
+}
+
+.col-form-label {
+  padding-top: calc(0.375rem + 1px);
+  padding-bottom: calc(0.375rem + 1px);
+  margin-bottom: 0;
+  font-size: inherit;
+  line-height: 1.5;
+}
+
+.col-form-label-lg {
+  padding-top: calc(0.5rem + 1px);
+  padding-bottom: calc(0.5rem + 1px);
+  font-size: 1.25rem;
+  line-height: 1.5;
+}
+
+.col-form-label-sm {
+  padding-top: calc(0.25rem + 1px);
+  padding-bottom: calc(0.25rem + 1px);
+  font-size: 0.875rem;
+  line-height: 1.5;
+}
+
+.form-control-plaintext {
+  display: block;
+  width: 100%;
+  padding-top: 0.375rem;
+  padding-bottom: 0.375rem;
+  margin-bottom: 0;
+  line-height: 1.5;
+  color: #212529;
+  background-color: transparent;
+  border: solid transparent;
+  border-width: 1px 0;
+}
+
+.form-control-plaintext.form-control-sm, .form-control-plaintext.form-control-lg {
+  padding-right: 0;
+  padding-left: 0;
+}
+
+.form-control-sm {
+  height: calc(1.8125rem + 2px);
+  padding: 0.25rem 0.5rem;
+  font-size: 0.875rem;
+  line-height: 1.5;
+  border-radius: 0.2rem;
+}
+
+.form-control-lg {
+  height: calc(2.875rem + 2px);
+  padding: 0.5rem 1rem;
+  font-size: 1.25rem;
+  line-height: 1.5;
+  border-radius: 0.3rem;
+}
+
+select.form-control[size], select.form-control[multiple] {
+  height: auto;
+}
+
+textarea.form-control {
+  height: auto;
+}
+
+.form-group {
+  margin-bottom: 1rem;
+}
+
+.form-text {
+  display: block;
+  margin-top: 0.25rem;
+}
+
+.form-row {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-wrap: wrap;
+  flex-wrap: wrap;
+  margin-right: -5px;
+  margin-left: -5px;
+}
+
+.form-row > .col,
+.form-row > [class*="col-"] {
+  padding-right: 5px;
+  padding-left: 5px;
+}
+
+.form-check {
+  position: relative;
+  display: block;
+  padding-left: 1.25rem;
+}
+
+.form-check-input {
+  position: absolute;
+  margin-top: 0.3rem;
+  margin-left: -1.25rem;
+}
+
+.form-check-input:disabled ~ .form-check-label {
+  color: #6c757d;
+}
+
+.form-check-label {
+  margin-bottom: 0;
+}
+
+.form-check-inline {
+  display: -ms-inline-flexbox;
+  display: inline-flex;
+  -ms-flex-align: center;
+  align-items: center;
+  padding-left: 0;
+  margin-right: 0.75rem;
+}
+
+.form-check-inline .form-check-input {
+  position: static;
+  margin-top: 0;
+  margin-right: 0.3125rem;
+  margin-left: 0;
+}
+
+.valid-feedback {
+  display: none;
+  width: 100%;
+  margin-top: 0.25rem;
+  font-size: 80%;
+  color: #28a745;
+}
+
+.valid-tooltip {
+  position: absolute;
+  top: 100%;
+  z-index: 5;
+  display: none;
+  max-width: 100%;
+  padding: 0.25rem 0.5rem;
+  margin-top: .1rem;
+  font-size: 0.875rem;
+  line-height: 1.5;
+  color: #fff;
+  background-color: rgba(40, 167, 69, 0.9);
+  border-radius: 0.25rem;
+}
+
+.was-validated .form-control:valid, .form-control.is-valid, .was-validated
+.custom-select:valid,
+.custom-select.is-valid {
+  border-color: #28a745;
+}
+
+.was-validated .form-control:valid:focus, .form-control.is-valid:focus, .was-validated
+.custom-select:valid:focus,
+.custom-select.is-valid:focus {
+  border-color: #28a745;
+  box-shadow: 0 0 0 0.2rem rgba(40, 167, 69, 0.25);
+}
+
+.was-validated .form-control:valid ~ .valid-feedback,
+.was-validated .form-control:valid ~ .valid-tooltip, .form-control.is-valid ~ .valid-feedback,
+.form-control.is-valid ~ .valid-tooltip, .was-validated
+.custom-select:valid ~ .valid-feedback,
+.was-validated
+.custom-select:valid ~ .valid-tooltip,
+.custom-select.is-valid ~ .valid-feedback,
+.custom-select.is-valid ~ .valid-tooltip {
+  display: block;
+}
+
+.was-validated .form-control-file:valid ~ .valid-feedback,
+.was-validated .form-control-file:valid ~ .valid-tooltip, .form-control-file.is-valid ~ .valid-feedback,
+.form-control-file.is-valid ~ .valid-tooltip {
+  display: block;
+}
+
+.was-validated .form-check-input:valid ~ .form-check-label, .form-check-input.is-valid ~ .form-check-label {
+  color: #28a745;
+}
+
+.was-validated .form-check-input:valid ~ .valid-feedback,
+.was-validated .form-check-input:valid ~ .valid-tooltip, .form-check-input.is-valid ~ .valid-feedback,
+.form-check-input.is-valid ~ .valid-tooltip {
+  display: block;
+}
+
+.was-validated .custom-control-input:valid ~ .custom-control-label, .custom-control-input.is-valid ~ .custom-control-label {
+  color: #28a745;
+}
+
+.was-validated .custom-control-input:valid ~ .custom-control-label::before, .custom-control-input.is-valid ~ .custom-control-label::before {
+  background-color: #71dd8a;
+}
+
+.was-validated .custom-control-input:valid ~ .valid-feedback,
+.was-validated .custom-control-input:valid ~ .valid-tooltip, .custom-control-input.is-valid ~ .valid-feedback,
+.custom-control-input.is-valid ~ .valid-tooltip {
+  display: block;
+}
+
+.was-validated .custom-control-input:valid:checked ~ .custom-control-label::before, .custom-control-input.is-valid:checked ~ .custom-control-label::before {
+  background-color: #34ce57;
+}
+
+.was-validated .custom-control-input:valid:focus ~ .custom-control-label::before, .custom-control-input.is-valid:focus ~ .custom-control-label::before {
+  box-shadow: 0 0 0 1px #fff, 0 0 0 0.2rem rgba(40, 167, 69, 0.25);
+}
+
+.was-validated .custom-file-input:valid ~ .custom-file-label, .custom-file-input.is-valid ~ .custom-file-label {
+  border-color: #28a745;
+}
+
+.was-validated .custom-file-input:valid ~ .custom-file-label::after, .custom-file-input.is-valid ~ .custom-file-label::after {
+  border-color: inherit;
+}
+
+.was-validated .custom-file-input:valid ~ .valid-feedback,
+.was-validated .custom-file-input:valid ~ .valid-tooltip, .custom-file-input.is-valid ~ .valid-feedback,
+.custom-file-input.is-valid ~ .valid-tooltip {
+  display: block;
+}
+
+.was-validated .custom-file-input:valid:focus ~ .custom-file-label, .custom-file-input.is-valid:focus ~ .custom-file-label {
+  box-shadow: 0 0 0 0.2rem rgba(40, 167, 69, 0.25);
+}
+
+.invalid-feedback {
+  display: none;
+  width: 100%;
+  margin-top: 0.25rem;
+  font-size: 80%;
+  color: #dc3545;
+}
+
+.invalid-tooltip {
+  position: absolute;
+  top: 100%;
+  z-index: 5;
+  display: none;
+  max-width: 100%;
+  padding: 0.25rem 0.5rem;
+  margin-top: .1rem;
+  font-size: 0.875rem;
+  line-height: 1.5;
+  color: #fff;
+  background-color: rgba(220, 53, 69, 0.9);
+  border-radius: 0.25rem;
+}
+
+.was-validated .form-control:invalid, .form-control.is-invalid, .was-validated
+.custom-select:invalid,
+.custom-select.is-invalid {
+  border-color: #dc3545;
+}
+
+.was-validated .form-control:invalid:focus, .form-control.is-invalid:focus, .was-validated
+.custom-select:invalid:focus,
+.custom-select.is-invalid:focus {
+  border-color: #dc3545;
+  box-shadow: 0 0 0 0.2rem rgba(220, 53, 69, 0.25);
+}
+
+.was-validated .form-control:invalid ~ .invalid-feedback,
+.was-validated .form-control:invalid ~ .invalid-tooltip, .form-control.is-invalid ~ .invalid-feedback,
+.form-control.is-invalid ~ .invalid-tooltip, .was-validated
+.custom-select:invalid ~ .invalid-feedback,
+.was-validated
+.custom-select:invalid ~ .invalid-tooltip,
+.custom-select.is-invalid ~ .invalid-feedback,
+.custom-select.is-invalid ~ .invalid-tooltip {
+  display: block;
+}
+
+.was-validated .form-control-file:invalid ~ .invalid-feedback,
+.was-validated .form-control-file:invalid ~ .invalid-tooltip, .form-control-file.is-invalid ~ .invalid-feedback,
+.form-control-file.is-invalid ~ .invalid-tooltip {
+  display: block;
+}
+
+.was-validated .form-check-input:invalid ~ .form-check-label, .form-check-input.is-invalid ~ .form-check-label {
+  color: #dc3545;
+}
+
+.was-validated .form-check-input:invalid ~ .invalid-feedback,
+.was-validated .form-check-input:invalid ~ .invalid-tooltip, .form-check-input.is-invalid ~ .invalid-feedback,
+.form-check-input.is-invalid ~ .invalid-tooltip {
+  display: block;
+}
+
+.was-validated .custom-control-input:invalid ~ .custom-control-label, .custom-control-input.is-invalid ~ .custom-control-label {
+  color: #dc3545;
+}
+
+.was-validated .custom-control-input:invalid ~ .custom-control-label::before, .custom-control-input.is-invalid ~ .custom-control-label::before {
+  background-color: #efa2a9;
+}
+
+.was-validated .custom-control-input:invalid ~ .invalid-feedback,
+.was-validated .custom-control-input:invalid ~ .invalid-tooltip, .custom-control-input.is-invalid ~ .invalid-feedback,
+.custom-control-input.is-invalid ~ .invalid-tooltip {
+  display: block;
+}
+
+.was-validated .custom-control-input:invalid:checked ~ .custom-control-label::before, .custom-control-input.is-invalid:checked ~ .custom-control-label::before {
+  background-color: #e4606d;
+}
+
+.was-validated .custom-control-input:invalid:focus ~ .custom-control-label::before, .custom-control-input.is-invalid:focus ~ .custom-control-label::before {
+  box-shadow: 0 0 0 1px #fff, 0 0 0 0.2rem rgba(220, 53, 69, 0.25);
+}
+
+.was-validated .custom-file-input:invalid ~ .custom-file-label, .custom-file-input.is-invalid ~ .custom-file-label {
+  border-color: #dc3545;
+}
+
+.was-validated .custom-file-input:invalid ~ .custom-file-label::after, .custom-file-input.is-invalid ~ .custom-file-label::after {
+  border-color: inherit;
+}
+
+.was-validated .custom-file-input:invalid ~ .invalid-feedback,
+.was-validated .custom-file-input:invalid ~ .invalid-tooltip, .custom-file-input.is-invalid ~ .invalid-feedback,
+.custom-file-input.is-invalid ~ .invalid-tooltip {
+  display: block;
+}
+
+.was-validated .custom-file-input:invalid:focus ~ .custom-file-label, .custom-file-input.is-invalid:focus ~ .custom-file-label {
+  box-shadow: 0 0 0 0.2rem rgba(220, 53, 69, 0.25);
+}
+
+.form-inline {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-flow: row wrap;
+  flex-flow: row wrap;
+  -ms-flex-align: center;
+  align-items: center;
+}
+
+.form-inline .form-check {
+  width: 100%;
+}
+
+@media (min-width: 576px) {
+  .form-inline label {
+    display: -ms-flexbox;
+    display: flex;
+    -ms-flex-align: center;
+    align-items: center;
+    -ms-flex-pack: center;
+    justify-content: center;
+    margin-bottom: 0;
+  }
+  .form-inline .form-group {
+    display: -ms-flexbox;
+    display: flex;
+    -ms-flex: 0 0 auto;
+    flex: 0 0 auto;
+    -ms-flex-flow: row wrap;
+    flex-flow: row wrap;
+    -ms-flex-align: center;
+    align-items: center;
+    margin-bottom: 0;
+  }
+  .form-inline .form-control {
+    display: inline-block;
+    width: auto;
+    vertical-align: middle;
+  }
+  .form-inline .form-control-plaintext {
+    display: inline-block;
+  }
+  .form-inline .input-group,
+  .form-inline .custom-select {
+    width: auto;
+  }
+  .form-inline .form-check {
+    display: -ms-flexbox;
+    display: flex;
+    -ms-flex-align: center;
+    align-items: center;
+    -ms-flex-pack: center;
+    justify-content: center;
+    width: auto;
+    padding-left: 0;
+  }
+  .form-inline .form-check-input {
+    position: relative;
+    margin-top: 0;
+    margin-right: 0.25rem;
+    margin-left: 0;
+  }
+  .form-inline .custom-control {
+    -ms-flex-align: center;
+    align-items: center;
+    -ms-flex-pack: center;
+    justify-content: center;
+  }
+  .form-inline .custom-control-label {
+    margin-bottom: 0;
+  }
+}
+
+.btn {
+  display: inline-block;
+  font-weight: 400;
+  text-align: center;
+  white-space: nowrap;
+  vertical-align: middle;
+  -webkit-user-select: none;
+  -moz-user-select: none;
+  -ms-user-select: none;
+  user-select: none;
+  border: 1px solid transparent;
+  padding: 0.375rem 0.75rem;
+  font-size: 1rem;
+  line-height: 1.5;
+  border-radius: 0.25rem;
+  transition: color 0.15s ease-in-out, background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .btn {
+    transition: none;
+  }
+}
+
+.btn:hover, .btn:focus {
+  text-decoration: none;
+}
+
+.btn:focus, .btn.focus {
+  outline: 0;
+  box-shadow: 0 0 0 0.2rem rgba(0, 123, 255, 0.25);
+}
+
+.btn.disabled, .btn:disabled {
+  opacity: 0.65;
+}
+
+.btn:not(:disabled):not(.disabled) {
+  cursor: pointer;
+}
+
+a.btn.disabled,
+fieldset:disabled a.btn {
+  pointer-events: none;
+}
+
+.btn-primary {
+  color: #fff;
+  background-color: #007bff;
+  border-color: #007bff;
+}
+
+.btn-primary:hover {
+  color: #fff;
+  background-color: #0069d9;
+  border-color: #0062cc;
+}
+
+.btn-primary:focus, .btn-primary.focus {
+  box-shadow: 0 0 0 0.2rem rgba(0, 123, 255, 0.5);
+}
+
+.btn-primary.disabled, .btn-primary:disabled {
+  color: #fff;
+  background-color: #007bff;
+  border-color: #007bff;
+}
+
+.btn-primary:not(:disabled):not(.disabled):active, .btn-primary:not(:disabled):not(.disabled).active,
+.show > .btn-primary.dropdown-toggle {
+  color: #fff;
+  background-color: #0062cc;
+  border-color: #005cbf;
+}
+
+.btn-primary:not(:disabled):not(.disabled):active:focus, .btn-primary:not(:disabled):not(.disabled).active:focus,
+.show > .btn-primary.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(0, 123, 255, 0.5);
+}
+
+.btn-secondary {
+  color: #fff;
+  background-color: #6c757d;
+  border-color: #6c757d;
+}
+
+.btn-secondary:hover {
+  color: #fff;
+  background-color: #5a6268;
+  border-color: #545b62;
+}
+
+.btn-secondary:focus, .btn-secondary.focus {
+  box-shadow: 0 0 0 0.2rem rgba(108, 117, 125, 0.5);
+}
+
+.btn-secondary.disabled, .btn-secondary:disabled {
+  color: #fff;
+  background-color: #6c757d;
+  border-color: #6c757d;
+}
+
+.btn-secondary:not(:disabled):not(.disabled):active, .btn-secondary:not(:disabled):not(.disabled).active,
+.show > .btn-secondary.dropdown-toggle {
+  color: #fff;
+  background-color: #545b62;
+  border-color: #4e555b;
+}
+
+.btn-secondary:not(:disabled):not(.disabled):active:focus, .btn-secondary:not(:disabled):not(.disabled).active:focus,
+.show > .btn-secondary.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(108, 117, 125, 0.5);
+}
+
+.btn-success {
+  color: #fff;
+  background-color: #28a745;
+  border-color: #28a745;
+}
+
+.btn-success:hover {
+  color: #fff;
+  background-color: #218838;
+  border-color: #1e7e34;
+}
+
+.btn-success:focus, .btn-success.focus {
+  box-shadow: 0 0 0 0.2rem rgba(40, 167, 69, 0.5);
+}
+
+.btn-success.disabled, .btn-success:disabled {
+  color: #fff;
+  background-color: #28a745;
+  border-color: #28a745;
+}
+
+.btn-success:not(:disabled):not(.disabled):active, .btn-success:not(:disabled):not(.disabled).active,
+.show > .btn-success.dropdown-toggle {
+  color: #fff;
+  background-color: #1e7e34;
+  border-color: #1c7430;
+}
+
+.btn-success:not(:disabled):not(.disabled):active:focus, .btn-success:not(:disabled):not(.disabled).active:focus,
+.show > .btn-success.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(40, 167, 69, 0.5);
+}
+
+.btn-info {
+  color: #fff;
+  background-color: #17a2b8;
+  border-color: #17a2b8;
+}
+
+.btn-info:hover {
+  color: #fff;
+  background-color: #138496;
+  border-color: #117a8b;
+}
+
+.btn-info:focus, .btn-info.focus {
+  box-shadow: 0 0 0 0.2rem rgba(23, 162, 184, 0.5);
+}
+
+.btn-info.disabled, .btn-info:disabled {
+  color: #fff;
+  background-color: #17a2b8;
+  border-color: #17a2b8;
+}
+
+.btn-info:not(:disabled):not(.disabled):active, .btn-info:not(:disabled):not(.disabled).active,
+.show > .btn-info.dropdown-toggle {
+  color: #fff;
+  background-color: #117a8b;
+  border-color: #10707f;
+}
+
+.btn-info:not(:disabled):not(.disabled):active:focus, .btn-info:not(:disabled):not(.disabled).active:focus,
+.show > .btn-info.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(23, 162, 184, 0.5);
+}
+
+.btn-warning {
+  color: #212529;
+  background-color: #ffc107;
+  border-color: #ffc107;
+}
+
+.btn-warning:hover {
+  color: #212529;
+  background-color: #e0a800;
+  border-color: #d39e00;
+}
+
+.btn-warning:focus, .btn-warning.focus {
+  box-shadow: 0 0 0 0.2rem rgba(255, 193, 7, 0.5);
+}
+
+.btn-warning.disabled, .btn-warning:disabled {
+  color: #212529;
+  background-color: #ffc107;
+  border-color: #ffc107;
+}
+
+.btn-warning:not(:disabled):not(.disabled):active, .btn-warning:not(:disabled):not(.disabled).active,
+.show > .btn-warning.dropdown-toggle {
+  color: #212529;
+  background-color: #d39e00;
+  border-color: #c69500;
+}
+
+.btn-warning:not(:disabled):not(.disabled):active:focus, .btn-warning:not(:disabled):not(.disabled).active:focus,
+.show > .btn-warning.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(255, 193, 7, 0.5);
+}
+
+.btn-danger {
+  color: #fff;
+  background-color: #dc3545;
+  border-color: #dc3545;
+}
+
+.btn-danger:hover {
+  color: #fff;
+  background-color: #c82333;
+  border-color: #bd2130;
+}
+
+.btn-danger:focus, .btn-danger.focus {
+  box-shadow: 0 0 0 0.2rem rgba(220, 53, 69, 0.5);
+}
+
+.btn-danger.disabled, .btn-danger:disabled {
+  color: #fff;
+  background-color: #dc3545;
+  border-color: #dc3545;
+}
+
+.btn-danger:not(:disabled):not(.disabled):active, .btn-danger:not(:disabled):not(.disabled).active,
+.show > .btn-danger.dropdown-toggle {
+  color: #fff;
+  background-color: #bd2130;
+  border-color: #b21f2d;
+}
+
+.btn-danger:not(:disabled):not(.disabled):active:focus, .btn-danger:not(:disabled):not(.disabled).active:focus,
+.show > .btn-danger.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(220, 53, 69, 0.5);
+}
+
+.btn-light {
+  color: #212529;
+  background-color: #f8f9fa;
+  border-color: #f8f9fa;
+}
+
+.btn-light:hover {
+  color: #212529;
+  background-color: #e2e6ea;
+  border-color: #dae0e5;
+}
+
+.btn-light:focus, .btn-light.focus {
+  box-shadow: 0 0 0 0.2rem rgba(248, 249, 250, 0.5);
+}
+
+.btn-light.disabled, .btn-light:disabled {
+  color: #212529;
+  background-color: #f8f9fa;
+  border-color: #f8f9fa;
+}
+
+.btn-light:not(:disabled):not(.disabled):active, .btn-light:not(:disabled):not(.disabled).active,
+.show > .btn-light.dropdown-toggle {
+  color: #212529;
+  background-color: #dae0e5;
+  border-color: #d3d9df;
+}
+
+.btn-light:not(:disabled):not(.disabled):active:focus, .btn-light:not(:disabled):not(.disabled).active:focus,
+.show > .btn-light.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(248, 249, 250, 0.5);
+}
+
+.btn-dark {
+  color: #fff;
+  background-color: #343a40;
+  border-color: #343a40;
+}
+
+.btn-dark:hover {
+  color: #fff;
+  background-color: #23272b;
+  border-color: #1d2124;
+}
+
+.btn-dark:focus, .btn-dark.focus {
+  box-shadow: 0 0 0 0.2rem rgba(52, 58, 64, 0.5);
+}
+
+.btn-dark.disabled, .btn-dark:disabled {
+  color: #fff;
+  background-color: #343a40;
+  border-color: #343a40;
+}
+
+.btn-dark:not(:disabled):not(.disabled):active, .btn-dark:not(:disabled):not(.disabled).active,
+.show > .btn-dark.dropdown-toggle {
+  color: #fff;
+  background-color: #1d2124;
+  border-color: #171a1d;
+}
+
+.btn-dark:not(:disabled):not(.disabled):active:focus, .btn-dark:not(:disabled):not(.disabled).active:focus,
+.show > .btn-dark.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(52, 58, 64, 0.5);
+}
+
+.btn-outline-primary {
+  color: #007bff;
+  background-color: transparent;
+  background-image: none;
+  border-color: #007bff;
+}
+
+.btn-outline-primary:hover {
+  color: #fff;
+  background-color: #007bff;
+  border-color: #007bff;
+}
+
+.btn-outline-primary:focus, .btn-outline-primary.focus {
+  box-shadow: 0 0 0 0.2rem rgba(0, 123, 255, 0.5);
+}
+
+.btn-outline-primary.disabled, .btn-outline-primary:disabled {
+  color: #007bff;
+  background-color: transparent;
+}
+
+.btn-outline-primary:not(:disabled):not(.disabled):active, .btn-outline-primary:not(:disabled):not(.disabled).active,
+.show > .btn-outline-primary.dropdown-toggle {
+  color: #fff;
+  background-color: #007bff;
+  border-color: #007bff;
+}
+
+.btn-outline-primary:not(:disabled):not(.disabled):active:focus, .btn-outline-primary:not(:disabled):not(.disabled).active:focus,
+.show > .btn-outline-primary.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(0, 123, 255, 0.5);
+}
+
+.btn-outline-secondary {
+  color: #6c757d;
+  background-color: transparent;
+  background-image: none;
+  border-color: #6c757d;
+}
+
+.btn-outline-secondary:hover {
+  color: #fff;
+  background-color: #6c757d;
+  border-color: #6c757d;
+}
+
+.btn-outline-secondary:focus, .btn-outline-secondary.focus {
+  box-shadow: 0 0 0 0.2rem rgba(108, 117, 125, 0.5);
+}
+
+.btn-outline-secondary.disabled, .btn-outline-secondary:disabled {
+  color: #6c757d;
+  background-color: transparent;
+}
+
+.btn-outline-secondary:not(:disabled):not(.disabled):active, .btn-outline-secondary:not(:disabled):not(.disabled).active,
+.show > .btn-outline-secondary.dropdown-toggle {
+  color: #fff;
+  background-color: #6c757d;
+  border-color: #6c757d;
+}
+
+.btn-outline-secondary:not(:disabled):not(.disabled):active:focus, .btn-outline-secondary:not(:disabled):not(.disabled).active:focus,
+.show > .btn-outline-secondary.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(108, 117, 125, 0.5);
+}
+
+.btn-outline-success {
+  color: #28a745;
+  background-color: transparent;
+  background-image: none;
+  border-color: #28a745;
+}
+
+.btn-outline-success:hover {
+  color: #fff;
+  background-color: #28a745;
+  border-color: #28a745;
+}
+
+.btn-outline-success:focus, .btn-outline-success.focus {
+  box-shadow: 0 0 0 0.2rem rgba(40, 167, 69, 0.5);
+}
+
+.btn-outline-success.disabled, .btn-outline-success:disabled {
+  color: #28a745;
+  background-color: transparent;
+}
+
+.btn-outline-success:not(:disabled):not(.disabled):active, .btn-outline-success:not(:disabled):not(.disabled).active,
+.show > .btn-outline-success.dropdown-toggle {
+  color: #fff;
+  background-color: #28a745;
+  border-color: #28a745;
+}
+
+.btn-outline-success:not(:disabled):not(.disabled):active:focus, .btn-outline-success:not(:disabled):not(.disabled).active:focus,
+.show > .btn-outline-success.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(40, 167, 69, 0.5);
+}
+
+.btn-outline-info {
+  color: #17a2b8;
+  background-color: transparent;
+  background-image: none;
+  border-color: #17a2b8;
+}
+
+.btn-outline-info:hover {
+  color: #fff;
+  background-color: #17a2b8;
+  border-color: #17a2b8;
+}
+
+.btn-outline-info:focus, .btn-outline-info.focus {
+  box-shadow: 0 0 0 0.2rem rgba(23, 162, 184, 0.5);
+}
+
+.btn-outline-info.disabled, .btn-outline-info:disabled {
+  color: #17a2b8;
+  background-color: transparent;
+}
+
+.btn-outline-info:not(:disabled):not(.disabled):active, .btn-outline-info:not(:disabled):not(.disabled).active,
+.show > .btn-outline-info.dropdown-toggle {
+  color: #fff;
+  background-color: #17a2b8;
+  border-color: #17a2b8;
+}
+
+.btn-outline-info:not(:disabled):not(.disabled):active:focus, .btn-outline-info:not(:disabled):not(.disabled).active:focus,
+.show > .btn-outline-info.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(23, 162, 184, 0.5);
+}
+
+.btn-outline-warning {
+  color: #ffc107;
+  background-color: transparent;
+  background-image: none;
+  border-color: #ffc107;
+}
+
+.btn-outline-warning:hover {
+  color: #212529;
+  background-color: #ffc107;
+  border-color: #ffc107;
+}
+
+.btn-outline-warning:focus, .btn-outline-warning.focus {
+  box-shadow: 0 0 0 0.2rem rgba(255, 193, 7, 0.5);
+}
+
+.btn-outline-warning.disabled, .btn-outline-warning:disabled {
+  color: #ffc107;
+  background-color: transparent;
+}
+
+.btn-outline-warning:not(:disabled):not(.disabled):active, .btn-outline-warning:not(:disabled):not(.disabled).active,
+.show > .btn-outline-warning.dropdown-toggle {
+  color: #212529;
+  background-color: #ffc107;
+  border-color: #ffc107;
+}
+
+.btn-outline-warning:not(:disabled):not(.disabled):active:focus, .btn-outline-warning:not(:disabled):not(.disabled).active:focus,
+.show > .btn-outline-warning.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(255, 193, 7, 0.5);
+}
+
+.btn-outline-danger {
+  color: #dc3545;
+  background-color: transparent;
+  background-image: none;
+  border-color: #dc3545;
+}
+
+.btn-outline-danger:hover {
+  color: #fff;
+  background-color: #dc3545;
+  border-color: #dc3545;
+}
+
+.btn-outline-danger:focus, .btn-outline-danger.focus {
+  box-shadow: 0 0 0 0.2rem rgba(220, 53, 69, 0.5);
+}
+
+.btn-outline-danger.disabled, .btn-outline-danger:disabled {
+  color: #dc3545;
+  background-color: transparent;
+}
+
+.btn-outline-danger:not(:disabled):not(.disabled):active, .btn-outline-danger:not(:disabled):not(.disabled).active,
+.show > .btn-outline-danger.dropdown-toggle {
+  color: #fff;
+  background-color: #dc3545;
+  border-color: #dc3545;
+}
+
+.btn-outline-danger:not(:disabled):not(.disabled):active:focus, .btn-outline-danger:not(:disabled):not(.disabled).active:focus,
+.show > .btn-outline-danger.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(220, 53, 69, 0.5);
+}
+
+.btn-outline-light {
+  color: #f8f9fa;
+  background-color: transparent;
+  background-image: none;
+  border-color: #f8f9fa;
+}
+
+.btn-outline-light:hover {
+  color: #212529;
+  background-color: #f8f9fa;
+  border-color: #f8f9fa;
+}
+
+.btn-outline-light:focus, .btn-outline-light.focus {
+  box-shadow: 0 0 0 0.2rem rgba(248, 249, 250, 0.5);
+}
+
+.btn-outline-light.disabled, .btn-outline-light:disabled {
+  color: #f8f9fa;
+  background-color: transparent;
+}
+
+.btn-outline-light:not(:disabled):not(.disabled):active, .btn-outline-light:not(:disabled):not(.disabled).active,
+.show > .btn-outline-light.dropdown-toggle {
+  color: #212529;
+  background-color: #f8f9fa;
+  border-color: #f8f9fa;
+}
+
+.btn-outline-light:not(:disabled):not(.disabled):active:focus, .btn-outline-light:not(:disabled):not(.disabled).active:focus,
+.show > .btn-outline-light.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(248, 249, 250, 0.5);
+}
+
+.btn-outline-dark {
+  color: #343a40;
+  background-color: transparent;
+  background-image: none;
+  border-color: #343a40;
+}
+
+.btn-outline-dark:hover {
+  color: #fff;
+  background-color: #343a40;
+  border-color: #343a40;
+}
+
+.btn-outline-dark:focus, .btn-outline-dark.focus {
+  box-shadow: 0 0 0 0.2rem rgba(52, 58, 64, 0.5);
+}
+
+.btn-outline-dark.disabled, .btn-outline-dark:disabled {
+  color: #343a40;
+  background-color: transparent;
+}
+
+.btn-outline-dark:not(:disabled):not(.disabled):active, .btn-outline-dark:not(:disabled):not(.disabled).active,
+.show > .btn-outline-dark.dropdown-toggle {
+  color: #fff;
+  background-color: #343a40;
+  border-color: #343a40;
+}
+
+.btn-outline-dark:not(:disabled):not(.disabled):active:focus, .btn-outline-dark:not(:disabled):not(.disabled).active:focus,
+.show > .btn-outline-dark.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(52, 58, 64, 0.5);
+}
+
+.btn-link {
+  font-weight: 400;
+  color: #007bff;
+  background-color: transparent;
+}
+
+.btn-link:hover {
+  color: #0056b3;
+  text-decoration: underline;
+  background-color: transparent;
+  border-color: transparent;
+}
+
+.btn-link:focus, .btn-link.focus {
+  text-decoration: underline;
+  border-color: transparent;
+  box-shadow: none;
+}
+
+.btn-link:disabled, .btn-link.disabled {
+  color: #6c757d;
+  pointer-events: none;
+}
+
+.btn-lg, .btn-group-lg > .btn {
+  padding: 0.5rem 1rem;
+  font-size: 1.25rem;
+  line-height: 1.5;
+  border-radius: 0.3rem;
+}
+
+.btn-sm, .btn-group-sm > .btn {
+  padding: 0.25rem 0.5rem;
+  font-size: 0.875rem;
+  line-height: 1.5;
+  border-radius: 0.2rem;
+}
+
+.btn-block {
+  display: block;
+  width: 100%;
+}
+
+.btn-block + .btn-block {
+  margin-top: 0.5rem;
+}
+
+input[type="submit"].btn-block,
+input[type="reset"].btn-block,
+input[type="button"].btn-block {
+  width: 100%;
+}
+
+.fade {
+  transition: opacity 0.15s linear;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .fade {
+    transition: none;
+  }
+}
+
+.fade:not(.show) {
+  opacity: 0;
+}
+
+.collapse:not(.show) {
+  display: none;
+}
+
+.collapsing {
+  position: relative;
+  height: 0;
+  overflow: hidden;
+  transition: height 0.35s ease;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .collapsing {
+    transition: none;
+  }
+}
+
+.dropup,
+.dropright,
+.dropdown,
+.dropleft {
+  position: relative;
+}
+
+.dropdown-toggle::after {
+  display: inline-block;
+  width: 0;
+  height: 0;
+  margin-left: 0.255em;
+  vertical-align: 0.255em;
+  content: "";
+  border-top: 0.3em solid;
+  border-right: 0.3em solid transparent;
+  border-bottom: 0;
+  border-left: 0.3em solid transparent;
+}
+
+.dropdown-toggle:empty::after {
+  margin-left: 0;
+}
+
+.dropdown-menu {
+  position: absolute;
+  top: 100%;
+  left: 0;
+  z-index: 1000;
+  display: none;
+  float: left;
+  min-width: 10rem;
+  padding: 0.5rem 0;
+  margin: 0.125rem 0 0;
+  font-size: 1rem;
+  color: #212529;
+  text-align: left;
+  list-style: none;
+  background-color: #fff;
+  background-clip: padding-box;
+  border: 1px solid rgba(0, 0, 0, 0.15);
+  border-radius: 0.25rem;
+}
+
+.dropdown-menu-right {
+  right: 0;
+  left: auto;
+}
+
+.dropup .dropdown-menu {
+  top: auto;
+  bottom: 100%;
+  margin-top: 0;
+  margin-bottom: 0.125rem;
+}
+
+.dropup .dropdown-toggle::after {
+  display: inline-block;
+  width: 0;
+  height: 0;
+  margin-left: 0.255em;
+  vertical-align: 0.255em;
+  content: "";
+  border-top: 0;
+  border-right: 0.3em solid transparent;
+  border-bottom: 0.3em solid;
+  border-left: 0.3em solid transparent;
+}
+
+.dropup .dropdown-toggle:empty::after {
+  margin-left: 0;
+}
+
+.dropright .dropdown-menu {
+  top: 0;
+  right: auto;
+  left: 100%;
+  margin-top: 0;
+  margin-left: 0.125rem;
+}
+
+.dropright .dropdown-toggle::after {
+  display: inline-block;
+  width: 0;
+  height: 0;
+  margin-left: 0.255em;
+  vertical-align: 0.255em;
+  content: "";
+  border-top: 0.3em solid transparent;
+  border-right: 0;
+  border-bottom: 0.3em solid transparent;
+  border-left: 0.3em solid;
+}
+
+.dropright .dropdown-toggle:empty::after {
+  margin-left: 0;
+}
+
+.dropright .dropdown-toggle::after {
+  vertical-align: 0;
+}
+
+.dropleft .dropdown-menu {
+  top: 0;
+  right: 100%;
+  left: auto;
+  margin-top: 0;
+  margin-right: 0.125rem;
+}
+
+.dropleft .dropdown-toggle::after {
+  display: inline-block;
+  width: 0;
+  height: 0;
+  margin-left: 0.255em;
+  vertical-align: 0.255em;
+  content: "";
+}
+
+.dropleft .dropdown-toggle::after {
+  display: none;
+}
+
+.dropleft .dropdown-toggle::before {
+  display: inline-block;
+  width: 0;
+  height: 0;
+  margin-right: 0.255em;
+  vertical-align: 0.255em;
+  content: "";
+  border-top: 0.3em solid transparent;
+  border-right: 0.3em solid;
+  border-bottom: 0.3em solid transparent;
+}
+
+.dropleft .dropdown-toggle:empty::after {
+  margin-left: 0;
+}
+
+.dropleft .dropdown-toggle::before {
+  vertical-align: 0;
+}
+
+.dropdown-menu[x-placement^="top"], .dropdown-menu[x-placement^="right"], .dropdown-menu[x-placement^="bottom"], .dropdown-menu[x-placement^="left"] {
+  right: auto;
+  bottom: auto;
+}
+
+.dropdown-divider {
+  height: 0;
+  margin: 0.5rem 0;
+  overflow: hidden;
+  border-top: 1px solid #e9ecef;
+}
+
+.dropdown-item {
+  display: block;
+  width: 100%;
+  padding: 0.25rem 1.5rem;
+  clear: both;
+  font-weight: 400;
+  color: #212529;
+  text-align: inherit;
+  white-space: nowrap;
+  background-color: transparent;
+  border: 0;
+}
+
+.dropdown-item:hover, .dropdown-item:focus {
+  color: #16181b;
+  text-decoration: none;
+  background-color: #f8f9fa;
+}
+
+.dropdown-item.active, .dropdown-item:active {
+  color: #fff;
+  text-decoration: none;
+  background-color: #007bff;
+}
+
+.dropdown-item.disabled, .dropdown-item:disabled {
+  color: #6c757d;
+  background-color: transparent;
+}
+
+.dropdown-menu.show {
+  display: block;
+}
+
+.dropdown-header {
+  display: block;
+  padding: 0.5rem 1.5rem;
+  margin-bottom: 0;
+  font-size: 0.875rem;
+  color: #6c757d;
+  white-space: nowrap;
+}
+
+.dropdown-item-text {
+  display: block;
+  padding: 0.25rem 1.5rem;
+  color: #212529;
+}
+
+.btn-group,
+.btn-group-vertical {
+  position: relative;
+  display: -ms-inline-flexbox;
+  display: inline-flex;
+  vertical-align: middle;
+}
+
+.btn-group > .btn,
+.btn-group-vertical > .btn {
+  position: relative;
+  -ms-flex: 0 1 auto;
+  flex: 0 1 auto;
+}
+
+.btn-group > .btn:hover,
+.btn-group-vertical > .btn:hover {
+  z-index: 1;
+}
+
+.btn-group > .btn:focus, .btn-group > .btn:active, .btn-group > .btn.active,
+.btn-group-vertical > .btn:focus,
+.btn-group-vertical > .btn:active,
+.btn-group-vertical > .btn.active {
+  z-index: 1;
+}
+
+.btn-group .btn + .btn,
+.btn-group .btn + .btn-group,
+.btn-group .btn-group + .btn,
+.btn-group .btn-group + .btn-group,
+.btn-group-vertical .btn + .btn,
+.btn-group-vertical .btn + .btn-group,
+.btn-group-vertical .btn-group + .btn,
+.btn-group-vertical .btn-group + .btn-group {
+  margin-left: -1px;
+}
+
+.btn-toolbar {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-wrap: wrap;
+  flex-wrap: wrap;
+  -ms-flex-pack: start;
+  justify-content: flex-start;
+}
+
+.btn-toolbar .input-group {
+  width: auto;
+}
+
+.btn-group > .btn:first-child {
+  margin-left: 0;
+}
+
+.btn-group > .btn:not(:last-child):not(.dropdown-toggle),
+.btn-group > .btn-group:not(:last-child) > .btn {
+  border-top-right-radius: 0;
+  border-bottom-right-radius: 0;
+}
+
+.btn-group > .btn:not(:first-child),
+.btn-group > .btn-group:not(:first-child) > .btn {
+  border-top-left-radius: 0;
+  border-bottom-left-radius: 0;
+}
+
+.dropdown-toggle-split {
+  padding-right: 0.5625rem;
+  padding-left: 0.5625rem;
+}
+
+.dropdown-toggle-split::after,
+.dropup .dropdown-toggle-split::after,
+.dropright .dropdown-toggle-split::after {
+  margin-left: 0;
+}
+
+.dropleft .dropdown-toggle-split::before {
+  margin-right: 0;
+}
+
+.btn-sm + .dropdown-toggle-split, .btn-group-sm > .btn + .dropdown-toggle-split {
+  padding-right: 0.375rem;
+  padding-left: 0.375rem;
+}
+
+.btn-lg + .dropdown-toggle-split, .btn-group-lg > .btn + .dropdown-toggle-split {
+  padding-right: 0.75rem;
+  padding-left: 0.75rem;
+}
+
+.btn-group-vertical {
+  -ms-flex-direction: column;
+  flex-direction: column;
+  -ms-flex-align: start;
+  align-items: flex-start;
+  -ms-flex-pack: center;
+  justify-content: center;
+}
+
+.btn-group-vertical .btn,
+.btn-group-vertical .btn-group {
+  width: 100%;
+}
+
+.btn-group-vertical > .btn + .btn,
+.btn-group-vertical > .btn + .btn-group,
+.btn-group-vertical > .btn-group + .btn,
+.btn-group-vertical > .btn-group + .btn-group {
+  margin-top: -1px;
+  margin-left: 0;
+}
+
+.btn-group-vertical > .btn:not(:last-child):not(.dropdown-toggle),
+.btn-group-vertical > .btn-group:not(:last-child) > .btn {
+  border-bottom-right-radius: 0;
+  border-bottom-left-radius: 0;
+}
+
+.btn-group-vertical > .btn:not(:first-child),
+.btn-group-vertical > .btn-group:not(:first-child) > .btn {
+  border-top-left-radius: 0;
+  border-top-right-radius: 0;
+}
+
+.btn-group-toggle > .btn,
+.btn-group-toggle > .btn-group > .btn {
+  margin-bottom: 0;
+}
+
+.btn-group-toggle > .btn input[type="radio"],
+.btn-group-toggle > .btn input[type="checkbox"],
+.btn-group-toggle > .btn-group > .btn input[type="radio"],
+.btn-group-toggle > .btn-group > .btn input[type="checkbox"] {
+  position: absolute;
+  clip: rect(0, 0, 0, 0);
+  pointer-events: none;
+}
+
+.input-group {
+  position: relative;
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-wrap: wrap;
+  flex-wrap: wrap;
+  -ms-flex-align: stretch;
+  align-items: stretch;
+  width: 100%;
+}
+
+.input-group > .form-control,
+.input-group > .custom-select,
+.input-group > .custom-file {
+  position: relative;
+  -ms-flex: 1 1 auto;
+  flex: 1 1 auto;
+  width: 1%;
+  margin-bottom: 0;
+}
+
+.input-group > .form-control + .form-control,
+.input-group > .form-control + .custom-select,
+.input-group > .form-control + .custom-file,
+.input-group > .custom-select + .form-control,
+.input-group > .custom-select + .custom-select,
+.input-group > .custom-select + .custom-file,
+.input-group > .custom-file + .form-control,
+.input-group > .custom-file + .custom-select,
+.input-group > .custom-file + .custom-file {
+  margin-left: -1px;
+}
+
+.input-group > .form-control:focus,
+.input-group > .custom-select:focus,
+.input-group > .custom-file .custom-file-input:focus ~ .custom-file-label {
+  z-index: 3;
+}
+
+.input-group > .custom-file .custom-file-input:focus {
+  z-index: 4;
+}
+
+.input-group > .form-control:not(:last-child),
+.input-group > .custom-select:not(:last-child) {
+  border-top-right-radius: 0;
+  border-bottom-right-radius: 0;
+}
+
+.input-group > .form-control:not(:first-child),
+.input-group > .custom-select:not(:first-child) {
+  border-top-left-radius: 0;
+  border-bottom-left-radius: 0;
+}
+
+.input-group > .custom-file {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-align: center;
+  align-items: center;
+}
+
+.input-group > .custom-file:not(:last-child) .custom-file-label,
+.input-group > .custom-file:not(:last-child) .custom-file-label::after {
+  border-top-right-radius: 0;
+  border-bottom-right-radius: 0;
+}
+
+.input-group > .custom-file:not(:first-child) .custom-file-label {
+  border-top-left-radius: 0;
+  border-bottom-left-radius: 0;
+}
+
+.input-group-prepend,
+.input-group-append {
+  display: -ms-flexbox;
+  display: flex;
+}
+
+.input-group-prepend .btn,
+.input-group-append .btn {
+  position: relative;
+  z-index: 2;
+}
+
+.input-group-prepend .btn + .btn,
+.input-group-prepend .btn + .input-group-text,
+.input-group-prepend .input-group-text + .input-group-text,
+.input-group-prepend .input-group-text + .btn,
+.input-group-append .btn + .btn,
+.input-group-append .btn + .input-group-text,
+.input-group-append .input-group-text + .input-group-text,
+.input-group-append .input-group-text + .btn {
+  margin-left: -1px;
+}
+
+.input-group-prepend {
+  margin-right: -1px;
+}
+
+.input-group-append {
+  margin-left: -1px;
+}
+
+.input-group-text {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-align: center;
+  align-items: center;
+  padding: 0.375rem 0.75rem;
+  margin-bottom: 0;
+  font-size: 1rem;
+  font-weight: 400;
+  line-height: 1.5;
+  color: #495057;
+  text-align: center;
+  white-space: nowrap;
+  background-color: #e9ecef;
+  border: 1px solid #ced4da;
+  border-radius: 0.25rem;
+}
+
+.input-group-text input[type="radio"],
+.input-group-text input[type="checkbox"] {
+  margin-top: 0;
+}
+
+.input-group-lg > .form-control,
+.input-group-lg > .input-group-prepend > .input-group-text,
+.input-group-lg > .input-group-append > .input-group-text,
+.input-group-lg > .input-group-prepend > .btn,
+.input-group-lg > .input-group-append > .btn {
+  height: calc(2.875rem + 2px);
+  padding: 0.5rem 1rem;
+  font-size: 1.25rem;
+  line-height: 1.5;
+  border-radius: 0.3rem;
+}
+
+.input-group-sm > .form-control,
+.input-group-sm > .input-group-prepend > .input-group-text,
+.input-group-sm > .input-group-append > .input-group-text,
+.input-group-sm > .input-group-prepend > .btn,
+.input-group-sm > .input-group-append > .btn {
+  height: calc(1.8125rem + 2px);
+  padding: 0.25rem 0.5rem;
+  font-size: 0.875rem;
+  line-height: 1.5;
+  border-radius: 0.2rem;
+}
+
+.input-group > .input-group-prepend > .btn,
+.input-group > .input-group-prepend > .input-group-text,
+.input-group > .input-group-append:not(:last-child) > .btn,
+.input-group > .input-group-append:not(:last-child) > .input-group-text,
+.input-group > .input-group-append:last-child > .btn:not(:last-child):not(.dropdown-toggle),
+.input-group > .input-group-append:last-child > .input-group-text:not(:last-child) {
+  border-top-right-radius: 0;
+  border-bottom-right-radius: 0;
+}
+
+.input-group > .input-group-append > .btn,
+.input-group > .input-group-append > .input-group-text,
+.input-group > .input-group-prepend:not(:first-child) > .btn,
+.input-group > .input-group-prepend:not(:first-child) > .input-group-text,
+.input-group > .input-group-prepend:first-child > .btn:not(:first-child),
+.input-group > .input-group-prepend:first-child > .input-group-text:not(:first-child) {
+  border-top-left-radius: 0;
+  border-bottom-left-radius: 0;
+}
+
+.custom-control {
+  position: relative;
+  display: block;
+  min-height: 1.5rem;
+  padding-left: 1.5rem;
+}
+
+.custom-control-inline {
+  display: -ms-inline-flexbox;
+  display: inline-flex;
+  margin-right: 1rem;
+}
+
+.custom-control-input {
+  position: absolute;
+  z-index: -1;
+  opacity: 0;
+}
+
+.custom-control-input:checked ~ .custom-control-label::before {
+  color: #fff;
+  background-color: #007bff;
+}
+
+.custom-control-input:focus ~ .custom-control-label::before {
+  box-shadow: 0 0 0 1px #fff, 0 0 0 0.2rem rgba(0, 123, 255, 0.25);
+}
+
+.custom-control-input:active ~ .custom-control-label::before {
+  color: #fff;
+  background-color: #b3d7ff;
+}
+
+.custom-control-input:disabled ~ .custom-control-label {
+  color: #6c757d;
+}
+
+.custom-control-input:disabled ~ .custom-control-label::before {
+  background-color: #e9ecef;
+}
+
+.custom-control-label {
+  position: relative;
+  margin-bottom: 0;
+}
+
+.custom-control-label::before {
+  position: absolute;
+  top: 0.25rem;
+  left: -1.5rem;
+  display: block;
+  width: 1rem;
+  height: 1rem;
+  pointer-events: none;
+  content: "";
+  -webkit-user-select: none;
+  -moz-user-select: none;
+  -ms-user-select: none;
+  user-select: none;
+  background-color: #dee2e6;
+}
+
+.custom-control-label::after {
+  position: absolute;
+  top: 0.25rem;
+  left: -1.5rem;
+  display: block;
+  width: 1rem;
+  height: 1rem;
+  content: "";
+  background-repeat: no-repeat;
+  background-position: center center;
+  background-size: 50% 50%;
+}
+
+.custom-checkbox .custom-control-label::before {
+  border-radius: 0.25rem;
+}
+
+.custom-checkbox .custom-control-input:checked ~ .custom-control-label::before {
+  background-color: #007bff;
+}
+
+.custom-checkbox .custom-control-input:checked ~ .custom-control-label::after {
+  background-image: url("data:image/svg+xml;charset=utf8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 8 8'%3E%3Cpath fill='%23fff' d='M6.564.75l-3.59 3.612-1.538-1.55L0 4.26 2.974 7.25 8 2.193z'/%3E%3C/svg%3E");
+}
+
+.custom-checkbox .custom-control-input:indeterminate ~ .custom-control-label::before {
+  background-color: #007bff;
+}
+
+.custom-checkbox .custom-control-input:indeterminate ~ .custom-control-label::after {
+  background-image: url("data:image/svg+xml;charset=utf8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 4 4'%3E%3Cpath stroke='%23fff' d='M0 2h4'/%3E%3C/svg%3E");
+}
+
+.custom-checkbox .custom-control-input:disabled:checked ~ .custom-control-label::before {
+  background-color: rgba(0, 123, 255, 0.5);
+}
+
+.custom-checkbox .custom-control-input:disabled:indeterminate ~ .custom-control-label::before {
+  background-color: rgba(0, 123, 255, 0.5);
+}
+
+.custom-radio .custom-control-label::before {
+  border-radius: 50%;
+}
+
+.custom-radio .custom-control-input:checked ~ .custom-control-label::before {
+  background-color: #007bff;
+}
+
+.custom-radio .custom-control-input:checked ~ .custom-control-label::after {
+  background-image: url("data:image/svg+xml;charset=utf8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='-4 -4 8 8'%3E%3Ccircle r='3' fill='%23fff'/%3E%3C/svg%3E");
+}
+
+.custom-radio .custom-control-input:disabled:checked ~ .custom-control-label::before {
+  background-color: rgba(0, 123, 255, 0.5);
+}
+
+.custom-select {
+  display: inline-block;
+  width: 100%;
+  height: calc(2.25rem + 2px);
+  padding: 0.375rem 1.75rem 0.375rem 0.75rem;
+  line-height: 1.5;
+  color: #495057;
+  vertical-align: middle;
+  background: #fff url("data:image/svg+xml;charset=utf8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 4 5'%3E%3Cpath fill='%23343a40' d='M2 0L0 2h4zm0 5L0 3h4z'/%3E%3C/svg%3E") no-repeat right 0.75rem center;
+  background-size: 8px 10px;
+  border: 1px solid #ced4da;
+  border-radius: 0.25rem;
+  -webkit-appearance: none;
+  -moz-appearance: none;
+  appearance: none;
+}
+
+.custom-select:focus {
+  border-color: #80bdff;
+  outline: 0;
+  box-shadow: 0 0 0 0.2rem rgba(128, 189, 255, 0.5);
+}
+
+.custom-select:focus::-ms-value {
+  color: #495057;
+  background-color: #fff;
+}
+
+.custom-select[multiple], .custom-select[size]:not([size="1"]) {
+  height: auto;
+  padding-right: 0.75rem;
+  background-image: none;
+}
+
+.custom-select:disabled {
+  color: #6c757d;
+  background-color: #e9ecef;
+}
+
+.custom-select::-ms-expand {
+  opacity: 0;
+}
+
+.custom-select-sm {
+  height: calc(1.8125rem + 2px);
+  padding-top: 0.375rem;
+  padding-bottom: 0.375rem;
+  font-size: 75%;
+}
+
+.custom-select-lg {
+  height: calc(2.875rem + 2px);
+  padding-top: 0.375rem;
+  padding-bottom: 0.375rem;
+  font-size: 125%;
+}
+
+.custom-file {
+  position: relative;
+  display: inline-block;
+  width: 100%;
+  height: calc(2.25rem + 2px);
+  margin-bottom: 0;
+}
+
+.custom-file-input {
+  position: relative;
+  z-index: 2;
+  width: 100%;
+  height: calc(2.25rem + 2px);
+  margin: 0;
+  opacity: 0;
+}
+
+.custom-file-input:focus ~ .custom-file-label {
+  border-color: #80bdff;
+  box-shadow: 0 0 0 0.2rem rgba(0, 123, 255, 0.25);
+}
+
+.custom-file-input:focus ~ .custom-file-label::after {
+  border-color: #80bdff;
+}
+
+.custom-file-input:disabled ~ .custom-file-label {
+  background-color: #e9ecef;
+}
+
+.custom-file-input:lang(en) ~ .custom-file-label::after {
+  content: "Browse";
+}
+
+.custom-file-label {
+  position: absolute;
+  top: 0;
+  right: 0;
+  left: 0;
+  z-index: 1;
+  height: calc(2.25rem + 2px);
+  padding: 0.375rem 0.75rem;
+  line-height: 1.5;
+  color: #495057;
+  background-color: #fff;
+  border: 1px solid #ced4da;
+  border-radius: 0.25rem;
+}
+
+.custom-file-label::after {
+  position: absolute;
+  top: 0;
+  right: 0;
+  bottom: 0;
+  z-index: 3;
+  display: block;
+  height: 2.25rem;
+  padding: 0.375rem 0.75rem;
+  line-height: 1.5;
+  color: #495057;
+  content: "Browse";
+  background-color: #e9ecef;
+  border-left: 1px solid #ced4da;
+  border-radius: 0 0.25rem 0.25rem 0;
+}
+
+.custom-range {
+  width: 100%;
+  padding-left: 0;
+  background-color: transparent;
+  -webkit-appearance: none;
+  -moz-appearance: none;
+  appearance: none;
+}
+
+.custom-range:focus {
+  outline: none;
+}
+
+.custom-range:focus::-webkit-slider-thumb {
+  box-shadow: 0 0 0 1px #fff, 0 0 0 0.2rem rgba(0, 123, 255, 0.25);
+}
+
+.custom-range:focus::-moz-range-thumb {
+  box-shadow: 0 0 0 1px #fff, 0 0 0 0.2rem rgba(0, 123, 255, 0.25);
+}
+
+.custom-range:focus::-ms-thumb {
+  box-shadow: 0 0 0 1px #fff, 0 0 0 0.2rem rgba(0, 123, 255, 0.25);
+}
+
+.custom-range::-moz-focus-outer {
+  border: 0;
+}
+
+.custom-range::-webkit-slider-thumb {
+  width: 1rem;
+  height: 1rem;
+  margin-top: -0.25rem;
+  background-color: #007bff;
+  border: 0;
+  border-radius: 1rem;
+  transition: background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;
+  -webkit-appearance: none;
+  appearance: none;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .custom-range::-webkit-slider-thumb {
+    transition: none;
+  }
+}
+
+.custom-range::-webkit-slider-thumb:active {
+  background-color: #b3d7ff;
+}
+
+.custom-range::-webkit-slider-runnable-track {
+  width: 100%;
+  height: 0.5rem;
+  color: transparent;
+  cursor: pointer;
+  background-color: #dee2e6;
+  border-color: transparent;
+  border-radius: 1rem;
+}
+
+.custom-range::-moz-range-thumb {
+  width: 1rem;
+  height: 1rem;
+  background-color: #007bff;
+  border: 0;
+  border-radius: 1rem;
+  transition: background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;
+  -moz-appearance: none;
+  appearance: none;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .custom-range::-moz-range-thumb {
+    transition: none;
+  }
+}
+
+.custom-range::-moz-range-thumb:active {
+  background-color: #b3d7ff;
+}
+
+.custom-range::-moz-range-track {
+  width: 100%;
+  height: 0.5rem;
+  color: transparent;
+  cursor: pointer;
+  background-color: #dee2e6;
+  border-color: transparent;
+  border-radius: 1rem;
+}
+
+.custom-range::-ms-thumb {
+  width: 1rem;
+  height: 1rem;
+  margin-top: 0;
+  margin-right: 0.2rem;
+  margin-left: 0.2rem;
+  background-color: #007bff;
+  border: 0;
+  border-radius: 1rem;
+  transition: background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;
+  appearance: none;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .custom-range::-ms-thumb {
+    transition: none;
+  }
+}
+
+.custom-range::-ms-thumb:active {
+  background-color: #b3d7ff;
+}
+
+.custom-range::-ms-track {
+  width: 100%;
+  height: 0.5rem;
+  color: transparent;
+  cursor: pointer;
+  background-color: transparent;
+  border-color: transparent;
+  border-width: 0.5rem;
+}
+
+.custom-range::-ms-fill-lower {
+  background-color: #dee2e6;
+  border-radius: 1rem;
+}
+
+.custom-range::-ms-fill-upper {
+  margin-right: 15px;
+  background-color: #dee2e6;
+  border-radius: 1rem;
+}
+
+.custom-control-label::before,
+.custom-file-label,
+.custom-select {
+  transition: background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .custom-control-label::before,
+  .custom-file-label,
+  .custom-select {
+    transition: none;
+  }
+}
+
+.nav {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-wrap: wrap;
+  flex-wrap: wrap;
+  padding-left: 0;
+  margin-bottom: 0;
+  list-style: none;
+}
+
+.nav-link {
+  display: block;
+  padding: 0.5rem 1rem;
+}
+
+.nav-link:hover, .nav-link:focus {
+  text-decoration: none;
+}
+
+.nav-link.disabled {
+  color: #6c757d;
+}
+
+.nav-tabs {
+  border-bottom: 1px solid #dee2e6;
+}
+
+.nav-tabs .nav-item {
+  margin-bottom: -1px;
+}
+
+.nav-tabs .nav-link {
+  border: 1px solid transparent;
+  border-top-left-radius: 0.25rem;
+  border-top-right-radius: 0.25rem;
+}
+
+.nav-tabs .nav-link:hover, .nav-tabs .nav-link:focus {
+  border-color: #e9ecef #e9ecef #dee2e6;
+}
+
+.nav-tabs .nav-link.disabled {
+  color: #6c757d;
+  background-color: transparent;
+  border-color: transparent;
+}
+
+.nav-tabs .nav-link.active,
+.nav-tabs .nav-item.show .nav-link {
+  color: #495057;
+  background-color: #fff;
+  border-color: #dee2e6 #dee2e6 #fff;
+}
+
+.nav-tabs .dropdown-menu {
+  margin-top: -1px;
+  border-top-left-radius: 0;
+  border-top-right-radius: 0;
+}
+
+.nav-pills .nav-link {
+  border-radius: 0.25rem;
+}
+
+.nav-pills .nav-link.active,
+.nav-pills .show > .nav-link {
+  color: #fff;
+  background-color: #007bff;
+}
+
+.nav-fill .nav-item {
+  -ms-flex: 1 1 auto;
+  flex: 1 1 auto;
+  text-align: center;
+}
+
+.nav-justified .nav-item {
+  -ms-flex-preferred-size: 0;
+  flex-basis: 0;
+  -ms-flex-positive: 1;
+  flex-grow: 1;
+  text-align: center;
+}
+
+.tab-content > .tab-pane {
+  display: none;
+}
+
+.tab-content > .active {
+  display: block;
+}
+
+.navbar {
+  position: relative;
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-wrap: wrap;
+  flex-wrap: wrap;
+  -ms-flex-align: center;
+  align-items: center;
+  -ms-flex-pack: justify;
+  justify-content: space-between;
+  padding: 0.5rem 1rem;
+}
+
+.navbar > .container,
+.navbar > .container-fluid {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-wrap: wrap;
+  flex-wrap: wrap;
+  -ms-flex-align: center;
+  align-items: center;
+  -ms-flex-pack: justify;
+  justify-content: space-between;
+}
+
+.navbar-brand {
+  display: inline-block;
+  padding-top: 0.3125rem;
+  padding-bottom: 0.3125rem;
+  margin-right: 1rem;
+  font-size: 1.25rem;
+  line-height: inherit;
+  white-space: nowrap;
+}
+
+.navbar-brand:hover, .navbar-brand:focus {
+  text-decoration: none;
+}
+
+.navbar-nav {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-direction: column;
+  flex-direction: column;
+  padding-left: 0;
+  margin-bottom: 0;
+  list-style: none;
+}
+
+.navbar-nav .nav-link {
+  padding-right: 0;
+  padding-left: 0;
+}
+
+.navbar-nav .dropdown-menu {
+  position: static;
+  float: none;
+}
+
+.navbar-text {
+  display: inline-block;
+  padding-top: 0.5rem;
+  padding-bottom: 0.5rem;
+}
+
+.navbar-collapse {
+  -ms-flex-preferred-size: 100%;
+  flex-basis: 100%;
+  -ms-flex-positive: 1;
+  flex-grow: 1;
+  -ms-flex-align: center;
+  align-items: center;
+}
+
+.navbar-toggler {
+  padding: 0.25rem 0.75rem;
+  font-size: 1.25rem;
+  line-height: 1;
+  background-color: transparent;
+  border: 1px solid transparent;
+  border-radius: 0.25rem;
+}
+
+.navbar-toggler:hover, .navbar-toggler:focus {
+  text-decoration: none;
+}
+
+.navbar-toggler:not(:disabled):not(.disabled) {
+  cursor: pointer;
+}
+
+.navbar-toggler-icon {
+  display: inline-block;
+  width: 1.5em;
+  height: 1.5em;
+  vertical-align: middle;
+  content: "";
+  background: no-repeat center center;
+  background-size: 100% 100%;
+}
+
+@media (max-width: 575.98px) {
+  .navbar-expand-sm > .container,
+  .navbar-expand-sm > .container-fluid {
+    padding-right: 0;
+    padding-left: 0;
+  }
+}
+
+@media (min-width: 576px) {
+  .navbar-expand-sm {
+    -ms-flex-flow: row nowrap;
+    flex-flow: row nowrap;
+    -ms-flex-pack: start;
+    justify-content: flex-start;
+  }
+  .navbar-expand-sm .navbar-nav {
+    -ms-flex-direction: row;
+    flex-direction: row;
+  }
+  .navbar-expand-sm .navbar-nav .dropdown-menu {
+    position: absolute;
+  }
+  .navbar-expand-sm .navbar-nav .nav-link {
+    padding-right: 0.5rem;
+    padding-left: 0.5rem;
+  }
+  .navbar-expand-sm > .container,
+  .navbar-expand-sm > .container-fluid {
+    -ms-flex-wrap: nowrap;
+    flex-wrap: nowrap;
+  }
+  .navbar-expand-sm .navbar-collapse {
+    display: -ms-flexbox !important;
+    display: flex !important;
+    -ms-flex-preferred-size: auto;
+    flex-basis: auto;
+  }
+  .navbar-expand-sm .navbar-toggler {
+    display: none;
+  }
+}
+
+@media (max-width: 767.98px) {
+  .navbar-expand-md > .container,
+  .navbar-expand-md > .container-fluid {
+    padding-right: 0;
+    padding-left: 0;
+  }
+}
+
+@media (min-width: 768px) {
+  .navbar-expand-md {
+    -ms-flex-flow: row nowrap;
+    flex-flow: row nowrap;
+    -ms-flex-pack: start;
+    justify-content: flex-start;
+  }
+  .navbar-expand-md .navbar-nav {
+    -ms-flex-direction: row;
+    flex-direction: row;
+  }
+  .navbar-expand-md .navbar-nav .dropdown-menu {
+    position: absolute;
+  }
+  .navbar-expand-md .navbar-nav .nav-link {
+    padding-right: 0.5rem;
+    padding-left: 0.5rem;
+  }
+  .navbar-expand-md > .container,
+  .navbar-expand-md > .container-fluid {
+    -ms-flex-wrap: nowrap;
+    flex-wrap: nowrap;
+  }
+  .navbar-expand-md .navbar-collapse {
+    display: -ms-flexbox !important;
+    display: flex !important;
+    -ms-flex-preferred-size: auto;
+    flex-basis: auto;
+  }
+  .navbar-expand-md .navbar-toggler {
+    display: none;
+  }
+}
+
+@media (max-width: 991.98px) {
+  .navbar-expand-lg > .container,
+  .navbar-expand-lg > .container-fluid {
+    padding-right: 0;
+    padding-left: 0;
+  }
+}
+
+@media (min-width: 992px) {
+  .navbar-expand-lg {
+    -ms-flex-flow: row nowrap;
+    flex-flow: row nowrap;
+    -ms-flex-pack: start;
+    justify-content: flex-start;
+  }
+  .navbar-expand-lg .navbar-nav {
+    -ms-flex-direction: row;
+    flex-direction: row;
+  }
+  .navbar-expand-lg .navbar-nav .dropdown-menu {
+    position: absolute;
+  }
+  .navbar-expand-lg .navbar-nav .nav-link {
+    padding-right: 0.5rem;
+    padding-left: 0.5rem;
+  }
+  .navbar-expand-lg > .container,
+  .navbar-expand-lg > .container-fluid {
+    -ms-flex-wrap: nowrap;
+    flex-wrap: nowrap;
+  }
+  .navbar-expand-lg .navbar-collapse {
+    display: -ms-flexbox !important;
+    display: flex !important;
+    -ms-flex-preferred-size: auto;
+    flex-basis: auto;
+  }
+  .navbar-expand-lg .navbar-toggler {
+    display: none;
+  }
+}
+
+@media (max-width: 1199.98px) {
+  .navbar-expand-xl > .container,
+  .navbar-expand-xl > .container-fluid {
+    padding-right: 0;
+    padding-left: 0;
+  }
+}
+
+@media (min-width: 1200px) {
+  .navbar-expand-xl {
+    -ms-flex-flow: row nowrap;
+    flex-flow: row nowrap;
+    -ms-flex-pack: start;
+    justify-content: flex-start;
+  }
+  .navbar-expand-xl .navbar-nav {
+    -ms-flex-direction: row;
+    flex-direction: row;
+  }
+  .navbar-expand-xl .navbar-nav .dropdown-menu {
+    position: absolute;
+  }
+  .navbar-expand-xl .navbar-nav .nav-link {
+    padding-right: 0.5rem;
+    padding-left: 0.5rem;
+  }
+  .navbar-expand-xl > .container,
+  .navbar-expand-xl > .container-fluid {
+    -ms-flex-wrap: nowrap;
+    flex-wrap: nowrap;
+  }
+  .navbar-expand-xl .navbar-collapse {
+    display: -ms-flexbox !important;
+    display: flex !important;
+    -ms-flex-preferred-size: auto;
+    flex-basis: auto;
+  }
+  .navbar-expand-xl .navbar-toggler {
+    display: none;
+  }
+}
+
+.navbar-expand {
+  -ms-flex-flow: row nowrap;
+  flex-flow: row nowrap;
+  -ms-flex-pack: start;
+  justify-content: flex-start;
+}
+
+.navbar-expand > .container,
+.navbar-expand > .container-fluid {
+  padding-right: 0;
+  padding-left: 0;
+}
+
+.navbar-expand .navbar-nav {
+  -ms-flex-direction: row;
+  flex-direction: row;
+}
+
+.navbar-expand .navbar-nav .dropdown-menu {
+  position: absolute;
+}
+
+.navbar-expand .navbar-nav .nav-link {
+  padding-right: 0.5rem;
+  padding-left: 0.5rem;
+}
+
+.navbar-expand > .container,
+.navbar-expand > .container-fluid {
+  -ms-flex-wrap: nowrap;
+  flex-wrap: nowrap;
+}
+
+.navbar-expand .navbar-collapse {
+  display: -ms-flexbox !important;
+  display: flex !important;
+  -ms-flex-preferred-size: auto;
+  flex-basis: auto;
+}
+
+.navbar-expand .navbar-toggler {
+  display: none;
+}
+
+.navbar-light .navbar-brand {
+  color: rgba(0, 0, 0, 0.9);
+}
+
+.navbar-light .navbar-brand:hover, .navbar-light .navbar-brand:focus {
+  color: rgba(0, 0, 0, 0.9);
+}
+
+.navbar-light .navbar-nav .nav-link {
+  color: rgba(0, 0, 0, 0.5);
+}
+
+.navbar-light .navbar-nav .nav-link:hover, .navbar-light .navbar-nav .nav-link:focus {
+  color: rgba(0, 0, 0, 0.7);
+}
+
+.navbar-light .navbar-nav .nav-link.disabled {
+  color: rgba(0, 0, 0, 0.3);
+}
+
+.navbar-light .navbar-nav .show > .nav-link,
+.navbar-light .navbar-nav .active > .nav-link,
+.navbar-light .navbar-nav .nav-link.show,
+.navbar-light .navbar-nav .nav-link.active {
+  color: rgba(0, 0, 0, 0.9);
+}
+
+.navbar-light .navbar-toggler {
+  color: rgba(0, 0, 0, 0.5);
+  border-color: rgba(0, 0, 0, 0.1);
+}
+
+.navbar-light .navbar-toggler-icon {
+  background-image: url("data:image/svg+xml;charset=utf8,%3Csvg viewBox='0 0 30 30' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath stroke='rgba(0, 0, 0, 0.5)' stroke-width='2' stroke-linecap='round' stroke-miterlimit='10' d='M4 7h22M4 15h22M4 23h22'/%3E%3C/svg%3E");
+}
+
+.navbar-light .navbar-text {
+  color: rgba(0, 0, 0, 0.5);
+}
+
+.navbar-light .navbar-text a {
+  color: rgba(0, 0, 0, 0.9);
+}
+
+.navbar-light .navbar-text a:hover, .navbar-light .navbar-text a:focus {
+  color: rgba(0, 0, 0, 0.9);
+}
+
+.navbar-dark .navbar-brand {
+  color: #fff;
+}
+
+.navbar-dark .navbar-brand:hover, .navbar-dark .navbar-brand:focus {
+  color: #fff;
+}
+
+.navbar-dark .navbar-nav .nav-link {
+  color: rgba(255, 255, 255, 0.5);
+}
+
+.navbar-dark .navbar-nav .nav-link:hover, .navbar-dark .navbar-nav .nav-link:focus {
+  color: rgba(255, 255, 255, 0.75);
+}
+
+.navbar-dark .navbar-nav .nav-link.disabled {
+  color: rgba(255, 255, 255, 0.25);
+}
+
+.navbar-dark .navbar-nav .show > .nav-link,
+.navbar-dark .navbar-nav .active > .nav-link,
+.navbar-dark .navbar-nav .nav-link.show,
+.navbar-dark .navbar-nav .nav-link.active {
+  color: #fff;
+}
+
+.navbar-dark .navbar-toggler {
+  color: rgba(255, 255, 255, 0.5);
+  border-color: rgba(255, 255, 255, 0.1);
+}
+
+.navbar-dark .navbar-toggler-icon {
+  background-image: url("data:image/svg+xml;charset=utf8,%3Csvg viewBox='0 0 30 30' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath stroke='rgba(255, 255, 255, 0.5)' stroke-width='2' stroke-linecap='round' stroke-miterlimit='10' d='M4 7h22M4 15h22M4 23h22'/%3E%3C/svg%3E");
+}
+
+.navbar-dark .navbar-text {
+  color: rgba(255, 255, 255, 0.5);
+}
+
+.navbar-dark .navbar-text a {
+  color: #fff;
+}
+
+.navbar-dark .navbar-text a:hover, .navbar-dark .navbar-text a:focus {
+  color: #fff;
+}
+
+.card {
+  position: relative;
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-direction: column;
+  flex-direction: column;
+  min-width: 0;
+  word-wrap: break-word;
+  background-color: #fff;
+  background-clip: border-box;
+  border: 1px solid rgba(0, 0, 0, 0.125);
+  border-radius: 0.25rem;
+}
+
+.card > hr {
+  margin-right: 0;
+  margin-left: 0;
+}
+
+.card > .list-group:first-child .list-group-item:first-child {
+  border-top-left-radius: 0.25rem;
+  border-top-right-radius: 0.25rem;
+}
+
+.card > .list-group:last-child .list-group-item:last-child {
+  border-bottom-right-radius: 0.25rem;
+  border-bottom-left-radius: 0.25rem;
+}
+
+.card-body {
+  -ms-flex: 1 1 auto;
+  flex: 1 1 auto;
+  padding: 1.25rem;
+}
+
+.card-title {
+  margin-bottom: 0.75rem;
+}
+
+.card-subtitle {
+  margin-top: -0.375rem;
+  margin-bottom: 0;
+}
+
+.card-text:last-child {
+  margin-bottom: 0;
+}
+
+.card-link:hover {
+  text-decoration: none;
+}
+
+.card-link + .card-link {
+  margin-left: 1.25rem;
+}
+
+.card-header {
+  padding: 0.75rem 1.25rem;
+  margin-bottom: 0;
+  background-color: rgba(0, 0, 0, 0.03);
+  border-bottom: 1px solid rgba(0, 0, 0, 0.125);
+}
+
+.card-header:first-child {
+  border-radius: calc(0.25rem - 1px) calc(0.25rem - 1px) 0 0;
+}
+
+.card-header + .list-group .list-group-item:first-child {
+  border-top: 0;
+}
+
+.card-footer {
+  padding: 0.75rem 1.25rem;
+  background-color: rgba(0, 0, 0, 0.03);
+  border-top: 1px solid rgba(0, 0, 0, 0.125);
+}
+
+.card-footer:last-child {
+  border-radius: 0 0 calc(0.25rem - 1px) calc(0.25rem - 1px);
+}
+
+.card-header-tabs {
+  margin-right: -0.625rem;
+  margin-bottom: -0.75rem;
+  margin-left: -0.625rem;
+  border-bottom: 0;
+}
+
+.card-header-pills {
+  margin-right: -0.625rem;
+  margin-left: -0.625rem;
+}
+
+.card-img-overlay {
+  position: absolute;
+  top: 0;
+  right: 0;
+  bottom: 0;
+  left: 0;
+  padding: 1.25rem;
+}
+
+.card-img {
+  width: 100%;
+  border-radius: calc(0.25rem - 1px);
+}
+
+.card-img-top {
+  width: 100%;
+  border-top-left-radius: calc(0.25rem - 1px);
+  border-top-right-radius: calc(0.25rem - 1px);
+}
+
+.card-img-bottom {
+  width: 100%;
+  border-bottom-right-radius: calc(0.25rem - 1px);
+  border-bottom-left-radius: calc(0.25rem - 1px);
+}
+
+.card-deck {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-direction: column;
+  flex-direction: column;
+}
+
+.card-deck .card {
+  margin-bottom: 15px;
+}
+
+@media (min-width: 576px) {
+  .card-deck {
+    -ms-flex-flow: row wrap;
+    flex-flow: row wrap;
+    margin-right: -15px;
+    margin-left: -15px;
+  }
+  .card-deck .card {
+    display: -ms-flexbox;
+    display: flex;
+    -ms-flex: 1 0 0%;
+    flex: 1 0 0%;
+    -ms-flex-direction: column;
+    flex-direction: column;
+    margin-right: 15px;
+    margin-bottom: 0;
+    margin-left: 15px;
+  }
+}
+
+.card-group {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-direction: column;
+  flex-direction: column;
+}
+
+.card-group > .card {
+  margin-bottom: 15px;
+}
+
+@media (min-width: 576px) {
+  .card-group {
+    -ms-flex-flow: row wrap;
+    flex-flow: row wrap;
+  }
+  .card-group > .card {
+    -ms-flex: 1 0 0%;
+    flex: 1 0 0%;
+    margin-bottom: 0;
+  }
+  .card-group > .card + .card {
+    margin-left: 0;
+    border-left: 0;
+  }
+  .card-group > .card:first-child {
+    border-top-right-radius: 0;
+    border-bottom-right-radius: 0;
+  }
+  .card-group > .card:first-child .card-img-top,
+  .card-group > .card:first-child .card-header {
+    border-top-right-radius: 0;
+  }
+  .card-group > .card:first-child .card-img-bottom,
+  .card-group > .card:first-child .card-footer {
+    border-bottom-right-radius: 0;
+  }
+  .card-group > .card:last-child {
+    border-top-left-radius: 0;
+    border-bottom-left-radius: 0;
+  }
+  .card-group > .card:last-child .card-img-top,
+  .card-group > .card:last-child .card-header {
+    border-top-left-radius: 0;
+  }
+  .card-group > .card:last-child .card-img-bottom,
+  .card-group > .card:last-child .card-footer {
+    border-bottom-left-radius: 0;
+  }
+  .card-group > .card:only-child {
+    border-radius: 0.25rem;
+  }
+  .card-group > .card:only-child .card-img-top,
+  .card-group > .card:only-child .card-header {
+    border-top-left-radius: 0.25rem;
+    border-top-right-radius: 0.25rem;
+  }
+  .card-group > .card:only-child .card-img-bottom,
+  .card-group > .card:only-child .card-footer {
+    border-bottom-right-radius: 0.25rem;
+    border-bottom-left-radius: 0.25rem;
+  }
+  .card-group > .card:not(:first-child):not(:last-child):not(:only-child) {
+    border-radius: 0;
+  }
+  .card-group > .card:not(:first-child):not(:last-child):not(:only-child) .card-img-top,
+  .card-group > .card:not(:first-child):not(:last-child):not(:only-child) .card-img-bottom,
+  .card-group > .card:not(:first-child):not(:last-child):not(:only-child) .card-header,
+  .card-group > .card:not(:first-child):not(:last-child):not(:only-child) .card-footer {
+    border-radius: 0;
+  }
+}
+
+.card-columns .card {
+  margin-bottom: 0.75rem;
+}
+
+@media (min-width: 576px) {
+  .card-columns {
+    -webkit-column-count: 3;
+    -moz-column-count: 3;
+    column-count: 3;
+    -webkit-column-gap: 1.25rem;
+    -moz-column-gap: 1.25rem;
+    column-gap: 1.25rem;
+    orphans: 1;
+    widows: 1;
+  }
+  .card-columns .card {
+    display: inline-block;
+    width: 100%;
+  }
+}
+
+.accordion .card:not(:first-of-type):not(:last-of-type) {
+  border-bottom: 0;
+  border-radius: 0;
+}
+
+.accordion .card:not(:first-of-type) .card-header:first-child {
+  border-radius: 0;
+}
+
+.accordion .card:first-of-type {
+  border-bottom: 0;
+  border-bottom-right-radius: 0;
+  border-bottom-left-radius: 0;
+}
+
+.accordion .card:last-of-type {
+  border-top-left-radius: 0;
+  border-top-right-radius: 0;
+}
+
+.breadcrumb {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-wrap: wrap;
+  flex-wrap: wrap;
+  padding: 0.75rem 1rem;
+  margin-bottom: 1rem;
+  list-style: none;
+  background-color: #e9ecef;
+  border-radius: 0.25rem;
+}
+
+.breadcrumb-item + .breadcrumb-item {
+  padding-left: 0.5rem;
+}
+
+.breadcrumb-item + .breadcrumb-item::before {
+  display: inline-block;
+  padding-right: 0.5rem;
+  color: #6c757d;
+  content: "/";
+}
+
+.breadcrumb-item + .breadcrumb-item:hover::before {
+  text-decoration: underline;
+}
+
+.breadcrumb-item + .breadcrumb-item:hover::before {
+  text-decoration: none;
+}
+
+.breadcrumb-item.active {
+  color: #6c757d;
+}
+
+.pagination {
+  display: -ms-flexbox;
+  display: flex;
+  padding-left: 0;
+  list-style: none;
+  border-radius: 0.25rem;
+}
+
+.page-link {
+  position: relative;
+  display: block;
+  padding: 0.5rem 0.75rem;
+  margin-left: -1px;
+  line-height: 1.25;
+  color: #007bff;
+  background-color: #fff;
+  border: 1px solid #dee2e6;
+}
+
+.page-link:hover {
+  z-index: 2;
+  color: #0056b3;
+  text-decoration: none;
+  background-color: #e9ecef;
+  border-color: #dee2e6;
+}
+
+.page-link:focus {
+  z-index: 2;
+  outline: 0;
+  box-shadow: 0 0 0 0.2rem rgba(0, 123, 255, 0.25);
+}
+
+.page-link:not(:disabled):not(.disabled) {
+  cursor: pointer;
+}
+
+.page-item:first-child .page-link {
+  margin-left: 0;
+  border-top-left-radius: 0.25rem;
+  border-bottom-left-radius: 0.25rem;
+}
+
+.page-item:last-child .page-link {
+  border-top-right-radius: 0.25rem;
+  border-bottom-right-radius: 0.25rem;
+}
+
+.page-item.active .page-link {
+  z-index: 1;
+  color: #fff;
+  background-color: #007bff;
+  border-color: #007bff;
+}
+
+.page-item.disabled .page-link {
+  color: #6c757d;
+  pointer-events: none;
+  cursor: auto;
+  background-color: #fff;
+  border-color: #dee2e6;
+}
+
+.pagination-lg .page-link {
+  padding: 0.75rem 1.5rem;
+  font-size: 1.25rem;
+  line-height: 1.5;
+}
+
+.pagination-lg .page-item:first-child .page-link {
+  border-top-left-radius: 0.3rem;
+  border-bottom-left-radius: 0.3rem;
+}
+
+.pagination-lg .page-item:last-child .page-link {
+  border-top-right-radius: 0.3rem;
+  border-bottom-right-radius: 0.3rem;
+}
+
+.pagination-sm .page-link {
+  padding: 0.25rem 0.5rem;
+  font-size: 0.875rem;
+  line-height: 1.5;
+}
+
+.pagination-sm .page-item:first-child .page-link {
+  border-top-left-radius: 0.2rem;
+  border-bottom-left-radius: 0.2rem;
+}
+
+.pagination-sm .page-item:last-child .page-link {
+  border-top-right-radius: 0.2rem;
+  border-bottom-right-radius: 0.2rem;
+}
+
+.badge {
+  display: inline-block;
+  padding: 0.25em 0.4em;
+  font-size: 75%;
+  font-weight: 700;
+  line-height: 1;
+  text-align: center;
+  white-space: nowrap;
+  vertical-align: baseline;
+  border-radius: 0.25rem;
+}
+
+.badge:empty {
+  display: none;
+}
+
+.btn .badge {
+  position: relative;
+  top: -1px;
+}
+
+.badge-pill {
+  padding-right: 0.6em;
+  padding-left: 0.6em;
+  border-radius: 10rem;
+}
+
+.badge-primary {
+  color: #fff;
+  background-color: #007bff;
+}
+
+.badge-primary[href]:hover, .badge-primary[href]:focus {
+  color: #fff;
+  text-decoration: none;
+  background-color: #0062cc;
+}
+
+.badge-secondary {
+  color: #fff;
+  background-color: #6c757d;
+}
+
+.badge-secondary[href]:hover, .badge-secondary[href]:focus {
+  color: #fff;
+  text-decoration: none;
+  background-color: #545b62;
+}
+
+.badge-success {
+  color: #fff;
+  background-color: #28a745;
+}
+
+.badge-success[href]:hover, .badge-success[href]:focus {
+  color: #fff;
+  text-decoration: none;
+  background-color: #1e7e34;
+}
+
+.badge-info {
+  color: #fff;
+  background-color: #17a2b8;
+}
+
+.badge-info[href]:hover, .badge-info[href]:focus {
+  color: #fff;
+  text-decoration: none;
+  background-color: #117a8b;
+}
+
+.badge-warning {
+  color: #212529;
+  background-color: #ffc107;
+}
+
+.badge-warning[href]:hover, .badge-warning[href]:focus {
+  color: #212529;
+  text-decoration: none;
+  background-color: #d39e00;
+}
+
+.badge-danger {
+  color: #fff;
+  background-color: #dc3545;
+}
+
+.badge-danger[href]:hover, .badge-danger[href]:focus {
+  color: #fff;
+  text-decoration: none;
+  background-color: #bd2130;
+}
+
+.badge-light {
+  color: #212529;
+  background-color: #f8f9fa;
+}
+
+.badge-light[href]:hover, .badge-light[href]:focus {
+  color: #212529;
+  text-decoration: none;
+  background-color: #dae0e5;
+}
+
+.badge-dark {
+  color: #fff;
+  background-color: #343a40;
+}
+
+.badge-dark[href]:hover, .badge-dark[href]:focus {
+  color: #fff;
+  text-decoration: none;
+  background-color: #1d2124;
+}
+
+.jumbotron {
+  padding: 2rem 1rem;
+  margin-bottom: 2rem;
+  background-color: #e9ecef;
+  border-radius: 0.3rem;
+}
+
+@media (min-width: 576px) {
+  .jumbotron {
+    padding: 4rem 2rem;
+  }
+}
+
+.jumbotron-fluid {
+  padding-right: 0;
+  padding-left: 0;
+  border-radius: 0;
+}
+
+.alert {
+  position: relative;
+  padding: 0.75rem 1.25rem;
+  margin-bottom: 1rem;
+  border: 1px solid transparent;
+  border-radius: 0.25rem;
+}
+
+.alert-heading {
+  color: inherit;
+}
+
+.alert-link {
+  font-weight: 700;
+}
+
+.alert-dismissible {
+  padding-right: 4rem;
+}
+
+.alert-dismissible .close {
+  position: absolute;
+  top: 0;
+  right: 0;
+  padding: 0.75rem 1.25rem;
+  color: inherit;
+}
+
+.alert-primary {
+  color: #004085;
+  background-color: #cce5ff;
+  border-color: #b8daff;
+}
+
+.alert-primary hr {
+  border-top-color: #9fcdff;
+}
+
+.alert-primary .alert-link {
+  color: #002752;
+}
+
+.alert-secondary {
+  color: #383d41;
+  background-color: #e2e3e5;
+  border-color: #d6d8db;
+}
+
+.alert-secondary hr {
+  border-top-color: #c8cbcf;
+}
+
+.alert-secondary .alert-link {
+  color: #202326;
+}
+
+.alert-success {
+  color: #155724;
+  background-color: #d4edda;
+  border-color: #c3e6cb;
+}
+
+.alert-success hr {
+  border-top-color: #b1dfbb;
+}
+
+.alert-success .alert-link {
+  color: #0b2e13;
+}
+
+.alert-info {
+  color: #0c5460;
+  background-color: #d1ecf1;
+  border-color: #bee5eb;
+}
+
+.alert-info hr {
+  border-top-color: #abdde5;
+}
+
+.alert-info .alert-link {
+  color: #062c33;
+}
+
+.alert-warning {
+  color: #856404;
+  background-color: #fff3cd;
+  border-color: #ffeeba;
+}
+
+.alert-warning hr {
+  border-top-color: #ffe8a1;
+}
+
+.alert-warning .alert-link {
+  color: #533f03;
+}
+
+.alert-danger {
+  color: #721c24;
+  background-color: #f8d7da;
+  border-color: #f5c6cb;
+}
+
+.alert-danger hr {
+  border-top-color: #f1b0b7;
+}
+
+.alert-danger .alert-link {
+  color: #491217;
+}
+
+.alert-light {
+  color: #818182;
+  background-color: #fefefe;
+  border-color: #fdfdfe;
+}
+
+.alert-light hr {
+  border-top-color: #ececf6;
+}
+
+.alert-light .alert-link {
+  color: #686868;
+}
+
+.alert-dark {
+  color: #1b1e21;
+  background-color: #d6d8d9;
+  border-color: #c6c8ca;
+}
+
+.alert-dark hr {
+  border-top-color: #b9bbbe;
+}
+
+.alert-dark .alert-link {
+  color: #040505;
+}
+
+@-webkit-keyframes progress-bar-stripes {
+  from {
+    background-position: 1rem 0;
+  }
+  to {
+    background-position: 0 0;
+  }
+}
+
+@keyframes progress-bar-stripes {
+  from {
+    background-position: 1rem 0;
+  }
+  to {
+    background-position: 0 0;
+  }
+}
+
+.progress {
+  display: -ms-flexbox;
+  display: flex;
+  height: 1rem;
+  overflow: hidden;
+  font-size: 0.75rem;
+  background-color: #e9ecef;
+  border-radius: 0.25rem;
+}
+
+.progress-bar {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-direction: column;
+  flex-direction: column;
+  -ms-flex-pack: center;
+  justify-content: center;
+  color: #fff;
+  text-align: center;
+  white-space: nowrap;
+  background-color: #007bff;
+  transition: width 0.6s ease;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .progress-bar {
+    transition: none;
+  }
+}
+
+.progress-bar-striped {
+  background-image: linear-gradient(45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);
+  background-size: 1rem 1rem;
+}
+
+.progress-bar-animated {
+  -webkit-animation: progress-bar-stripes 1s linear infinite;
+  animation: progress-bar-stripes 1s linear infinite;
+}
+
+.media {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-align: start;
+  align-items: flex-start;
+}
+
+.media-body {
+  -ms-flex: 1;
+  flex: 1;
+}
+
+.list-group {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-direction: column;
+  flex-direction: column;
+  padding-left: 0;
+  margin-bottom: 0;
+}
+
+.list-group-item-action {
+  width: 100%;
+  color: #495057;
+  text-align: inherit;
+}
+
+.list-group-item-action:hover, .list-group-item-action:focus {
+  color: #495057;
+  text-decoration: none;
+  background-color: #f8f9fa;
+}
+
+.list-group-item-action:active {
+  color: #212529;
+  background-color: #e9ecef;
+}
+
+.list-group-item {
+  position: relative;
+  display: block;
+  padding: 0.75rem 1.25rem;
+  margin-bottom: -1px;
+  background-color: #fff;
+  border: 1px solid rgba(0, 0, 0, 0.125);
+}
+
+.list-group-item:first-child {
+  border-top-left-radius: 0.25rem;
+  border-top-right-radius: 0.25rem;
+}
+
+.list-group-item:last-child {
+  margin-bottom: 0;
+  border-bottom-right-radius: 0.25rem;
+  border-bottom-left-radius: 0.25rem;
+}
+
+.list-group-item:hover, .list-group-item:focus {
+  z-index: 1;
+  text-decoration: none;
+}
+
+.list-group-item.disabled, .list-group-item:disabled {
+  color: #6c757d;
+  background-color: #fff;
+}
+
+.list-group-item.active {
+  z-index: 2;
+  color: #fff;
+  background-color: #007bff;
+  border-color: #007bff;
+}
+
+.list-group-flush .list-group-item {
+  border-right: 0;
+  border-left: 0;
+  border-radius: 0;
+}
+
+.list-group-flush:first-child .list-group-item:first-child {
+  border-top: 0;
+}
+
+.list-group-flush:last-child .list-group-item:last-child {
+  border-bottom: 0;
+}
+
+.list-group-item-primary {
+  color: #004085;
+  background-color: #b8daff;
+}
+
+.list-group-item-primary.list-group-item-action:hover, .list-group-item-primary.list-group-item-action:focus {
+  color: #004085;
+  background-color: #9fcdff;
+}
+
+.list-group-item-primary.list-group-item-action.active {
+  color: #fff;
+  background-color: #004085;
+  border-color: #004085;
+}
+
+.list-group-item-secondary {
+  color: #383d41;
+  background-color: #d6d8db;
+}
+
+.list-group-item-secondary.list-group-item-action:hover, .list-group-item-secondary.list-group-item-action:focus {
+  color: #383d41;
+  background-color: #c8cbcf;
+}
+
+.list-group-item-secondary.list-group-item-action.active {
+  color: #fff;
+  background-color: #383d41;
+  border-color: #383d41;
+}
+
+.list-group-item-success {
+  color: #155724;
+  background-color: #c3e6cb;
+}
+
+.list-group-item-success.list-group-item-action:hover, .list-group-item-success.list-group-item-action:focus {
+  color: #155724;
+  background-color: #b1dfbb;
+}
+
+.list-group-item-success.list-group-item-action.active {
+  color: #fff;
+  background-color: #155724;
+  border-color: #155724;
+}
+
+.list-group-item-info {
+  color: #0c5460;
+  background-color: #bee5eb;
+}
+
+.list-group-item-info.list-group-item-action:hover, .list-group-item-info.list-group-item-action:focus {
+  color: #0c5460;
+  background-color: #abdde5;
+}
+
+.list-group-item-info.list-group-item-action.active {
+  color: #fff;
+  background-color: #0c5460;
+  border-color: #0c5460;
+}
+
+.list-group-item-warning {
+  color: #856404;
+  background-color: #ffeeba;
+}
+
+.list-group-item-warning.list-group-item-action:hover, .list-group-item-warning.list-group-item-action:focus {
+  color: #856404;
+  background-color: #ffe8a1;
+}
+
+.list-group-item-warning.list-group-item-action.active {
+  color: #fff;
+  background-color: #856404;
+  border-color: #856404;
+}
+
+.list-group-item-danger {
+  color: #721c24;
+  background-color: #f5c6cb;
+}
+
+.list-group-item-danger.list-group-item-action:hover, .list-group-item-danger.list-group-item-action:focus {
+  color: #721c24;
+  background-color: #f1b0b7;
+}
+
+.list-group-item-danger.list-group-item-action.active {
+  color: #fff;
+  background-color: #721c24;
+  border-color: #721c24;
+}
+
+.list-group-item-light {
+  color: #818182;
+  background-color: #fdfdfe;
+}
+
+.list-group-item-light.list-group-item-action:hover, .list-group-item-light.list-group-item-action:focus {
+  color: #818182;
+  background-color: #ececf6;
+}
+
+.list-group-item-light.list-group-item-action.active {
+  color: #fff;
+  background-color: #818182;
+  border-color: #818182;
+}
+
+.list-group-item-dark {
+  color: #1b1e21;
+  background-color: #c6c8ca;
+}
+
+.list-group-item-dark.list-group-item-action:hover, .list-group-item-dark.list-group-item-action:focus {
+  color: #1b1e21;
+  background-color: #b9bbbe;
+}
+
+.list-group-item-dark.list-group-item-action.active {
+  color: #fff;
+  background-color: #1b1e21;
+  border-color: #1b1e21;
+}
+
+.close {
+  float: right;
+  font-size: 1.5rem;
+  font-weight: 700;
+  line-height: 1;
+  color: #000;
+  text-shadow: 0 1px 0 #fff;
+  opacity: .5;
+}
+
+.close:not(:disabled):not(.disabled) {
+  cursor: pointer;
+}
+
+.close:not(:disabled):not(.disabled):hover, .close:not(:disabled):not(.disabled):focus {
+  color: #000;
+  text-decoration: none;
+  opacity: .75;
+}
+
+button.close {
+  padding: 0;
+  background-color: transparent;
+  border: 0;
+  -webkit-appearance: none;
+}
+
+.modal-open {
+  overflow: hidden;
+}
+
+.modal-open .modal {
+  overflow-x: hidden;
+  overflow-y: auto;
+}
+
+.modal {
+  position: fixed;
+  top: 0;
+  right: 0;
+  bottom: 0;
+  left: 0;
+  z-index: 1050;
+  display: none;
+  overflow: hidden;
+  outline: 0;
+}
+
+.modal-dialog {
+  position: relative;
+  width: auto;
+  margin: 0.5rem;
+  pointer-events: none;
+}
+
+.modal.fade .modal-dialog {
+  transition: -webkit-transform 0.3s ease-out;
+  transition: transform 0.3s ease-out;
+  transition: transform 0.3s ease-out, -webkit-transform 0.3s ease-out;
+  -webkit-transform: translate(0, -25%);
+  transform: translate(0, -25%);
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .modal.fade .modal-dialog {
+    transition: none;
+  }
+}
+
+.modal.show .modal-dialog {
+  -webkit-transform: translate(0, 0);
+  transform: translate(0, 0);
+}
+
+.modal-dialog-centered {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-align: center;
+  align-items: center;
+  min-height: calc(100% - (0.5rem * 2));
+}
+
+.modal-dialog-centered::before {
+  display: block;
+  height: calc(100vh - (0.5rem * 2));
+  content: "";
+}
+
+.modal-content {
+  position: relative;
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-direction: column;
+  flex-direction: column;
+  width: 100%;
+  pointer-events: auto;
+  background-color: #fff;
+  background-clip: padding-box;
+  border: 1px solid rgba(0, 0, 0, 0.2);
+  border-radius: 0.3rem;
+  outline: 0;
+}
+
+.modal-backdrop {
+  position: fixed;
+  top: 0;
+  right: 0;
+  bottom: 0;
+  left: 0;
+  z-index: 1040;
+  background-color: #000;
+}
+
+.modal-backdrop.fade {
+  opacity: 0;
+}
+
+.modal-backdrop.show {
+  opacity: 0.5;
+}
+
+.modal-header {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-align: start;
+  align-items: flex-start;
+  -ms-flex-pack: justify;
+  justify-content: space-between;
+  padding: 1rem;
+  border-bottom: 1px solid #e9ecef;
+  border-top-left-radius: 0.3rem;
+  border-top-right-radius: 0.3rem;
+}
+
+.modal-header .close {
+  padding: 1rem;
+  margin: -1rem -1rem -1rem auto;
+}
+
+.modal-title {
+  margin-bottom: 0;
+  line-height: 1.5;
+}
+
+.modal-body {
+  position: relative;
+  -ms-flex: 1 1 auto;
+  flex: 1 1 auto;
+  padding: 1rem;
+}
+
+.modal-footer {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-align: center;
+  align-items: center;
+  -ms-flex-pack: end;
+  justify-content: flex-end;
+  padding: 1rem;
+  border-top: 1px solid #e9ecef;
+}
+
+.modal-footer > :not(:first-child) {
+  margin-left: .25rem;
+}
+
+.modal-footer > :not(:last-child) {
+  margin-right: .25rem;
+}
+
+.modal-scrollbar-measure {
+  position: absolute;
+  top: -9999px;
+  width: 50px;
+  height: 50px;
+  overflow: scroll;
+}
+
+@media (min-width: 576px) {
+  .modal-dialog {
+    max-width: 500px;
+    margin: 1.75rem auto;
+  }
+  .modal-dialog-centered {
+    min-height: calc(100% - (1.75rem * 2));
+  }
+  .modal-dialog-centered::before {
+    height: calc(100vh - (1.75rem * 2));
+  }
+  .modal-sm {
+    max-width: 300px;
+  }
+}
+
+@media (min-width: 992px) {
+  .modal-lg {
+    max-width: 800px;
+  }
+}
+
+.tooltip {
+  position: absolute;
+  z-index: 1070;
+  display: block;
+  margin: 0;
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
+  font-style: normal;
+  font-weight: 400;
+  line-height: 1.5;
+  text-align: left;
+  text-align: start;
+  text-decoration: none;
+  text-shadow: none;
+  text-transform: none;
+  letter-spacing: normal;
+  word-break: normal;
+  word-spacing: normal;
+  white-space: normal;
+  line-break: auto;
+  font-size: 0.875rem;
+  word-wrap: break-word;
+  opacity: 0;
+}
+
+.tooltip.show {
+  opacity: 0.9;
+}
+
+.tooltip .arrow {
+  position: absolute;
+  display: block;
+  width: 0.8rem;
+  height: 0.4rem;
+}
+
+.tooltip .arrow::before {
+  position: absolute;
+  content: "";
+  border-color: transparent;
+  border-style: solid;
+}
+
+.bs-tooltip-top, .bs-tooltip-auto[x-placement^="top"] {
+  padding: 0.4rem 0;
+}
+
+.bs-tooltip-top .arrow, .bs-tooltip-auto[x-placement^="top"] .arrow {
+  bottom: 0;
+}
+
+.bs-tooltip-top .arrow::before, .bs-tooltip-auto[x-placement^="top"] .arrow::before {
+  top: 0;
+  border-width: 0.4rem 0.4rem 0;
+  border-top-color: #000;
+}
+
+.bs-tooltip-right, .bs-tooltip-auto[x-placement^="right"] {
+  padding: 0 0.4rem;
+}
+
+.bs-tooltip-right .arrow, .bs-tooltip-auto[x-placement^="right"] .arrow {
+  left: 0;
+  width: 0.4rem;
+  height: 0.8rem;
+}
+
+.bs-tooltip-right .arrow::before, .bs-tooltip-auto[x-placement^="right"] .arrow::before {
+  right: 0;
+  border-width: 0.4rem 0.4rem 0.4rem 0;
+  border-right-color: #000;
+}
+
+.bs-tooltip-bottom, .bs-tooltip-auto[x-placement^="bottom"] {
+  padding: 0.4rem 0;
+}
+
+.bs-tooltip-bottom .arrow, .bs-tooltip-auto[x-placement^="bottom"] .arrow {
+  top: 0;
+}
+
+.bs-tooltip-bottom .arrow::before, .bs-tooltip-auto[x-placement^="bottom"] .arrow::before {
+  bottom: 0;
+  border-width: 0 0.4rem 0.4rem;
+  border-bottom-color: #000;
+}
+
+.bs-tooltip-left, .bs-tooltip-auto[x-placement^="left"] {
+  padding: 0 0.4rem;
+}
+
+.bs-tooltip-left .arrow, .bs-tooltip-auto[x-placement^="left"] .arrow {
+  right: 0;
+  width: 0.4rem;
+  height: 0.8rem;
+}
+
+.bs-tooltip-left .arrow::before, .bs-tooltip-auto[x-placement^="left"] .arrow::before {
+  left: 0;
+  border-width: 0.4rem 0 0.4rem 0.4rem;
+  border-left-color: #000;
+}
+
+.tooltip-inner {
+  max-width: 200px;
+  padding: 0.25rem 0.5rem;
+  color: #fff;
+  text-align: center;
+  background-color: #000;
+  border-radius: 0.25rem;
+}
+
+.popover {
+  position: absolute;
+  top: 0;
+  left: 0;
+  z-index: 1060;
+  display: block;
+  max-width: 276px;
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
+  font-style: normal;
+  font-weight: 400;
+  line-height: 1.5;
+  text-align: left;
+  text-align: start;
+  text-decoration: none;
+  text-shadow: none;
+  text-transform: none;
+  letter-spacing: normal;
+  word-break: normal;
+  word-spacing: normal;
+  white-space: normal;
+  line-break: auto;
+  font-size: 0.875rem;
+  word-wrap: break-word;
+  background-color: #fff;
+  background-clip: padding-box;
+  border: 1px solid rgba(0, 0, 0, 0.2);
+  border-radius: 0.3rem;
+}
+
+.popover .arrow {
+  position: absolute;
+  display: block;
+  width: 1rem;
+  height: 0.5rem;
+  margin: 0 0.3rem;
+}
+
+.popover .arrow::before, .popover .arrow::after {
+  position: absolute;
+  display: block;
+  content: "";
+  border-color: transparent;
+  border-style: solid;
+}
+
+.bs-popover-top, .bs-popover-auto[x-placement^="top"] {
+  margin-bottom: 0.5rem;
+}
+
+.bs-popover-top .arrow, .bs-popover-auto[x-placement^="top"] .arrow {
+  bottom: calc((0.5rem + 1px) * -1);
+}
+
+.bs-popover-top .arrow::before, .bs-popover-auto[x-placement^="top"] .arrow::before,
+.bs-popover-top .arrow::after,
+.bs-popover-auto[x-placement^="top"] .arrow::after {
+  border-width: 0.5rem 0.5rem 0;
+}
+
+.bs-popover-top .arrow::before, .bs-popover-auto[x-placement^="top"] .arrow::before {
+  bottom: 0;
+  border-top-color: rgba(0, 0, 0, 0.25);
+}
+
+
+.bs-popover-top .arrow::after,
+.bs-popover-auto[x-placement^="top"] .arrow::after {
+  bottom: 1px;
+  border-top-color: #fff;
+}
+
+.bs-popover-right, .bs-popover-auto[x-placement^="right"] {
+  margin-left: 0.5rem;
+}
+
+.bs-popover-right .arrow, .bs-popover-auto[x-placement^="right"] .arrow {
+  left: calc((0.5rem + 1px) * -1);
+  width: 0.5rem;
+  height: 1rem;
+  margin: 0.3rem 0;
+}
+
+.bs-popover-right .arrow::before, .bs-popover-auto[x-placement^="right"] .arrow::before,
+.bs-popover-right .arrow::after,
+.bs-popover-auto[x-placement^="right"] .arrow::after {
+  border-width: 0.5rem 0.5rem 0.5rem 0;
+}
+
+.bs-popover-right .arrow::before, .bs-popover-auto[x-placement^="right"] .arrow::before {
+  left: 0;
+  border-right-color: rgba(0, 0, 0, 0.25);
+}
+
+
+.bs-popover-right .arrow::after,
+.bs-popover-auto[x-placement^="right"] .arrow::after {
+  left: 1px;
+  border-right-color: #fff;
+}
+
+.bs-popover-bottom, .bs-popover-auto[x-placement^="bottom"] {
+  margin-top: 0.5rem;
+}
+
+.bs-popover-bottom .arrow, .bs-popover-auto[x-placement^="bottom"] .arrow {
+  top: calc((0.5rem + 1px) * -1);
+}
+
+.bs-popover-bottom .arrow::before, .bs-popover-auto[x-placement^="bottom"] .arrow::before,
+.bs-popover-bottom .arrow::after,
+.bs-popover-auto[x-placement^="bottom"] .arrow::after {
+  border-width: 0 0.5rem 0.5rem 0.5rem;
+}
+
+.bs-popover-bottom .arrow::before, .bs-popover-auto[x-placement^="bottom"] .arrow::before {
+  top: 0;
+  border-bottom-color: rgba(0, 0, 0, 0.25);
+}
+
+
+.bs-popover-bottom .arrow::after,
+.bs-popover-auto[x-placement^="bottom"] .arrow::after {
+  top: 1px;
+  border-bottom-color: #fff;
+}
+
+.bs-popover-bottom .popover-header::before, .bs-popover-auto[x-placement^="bottom"] .popover-header::before {
+  position: absolute;
+  top: 0;
+  left: 50%;
+  display: block;
+  width: 1rem;
+  margin-left: -0.5rem;
+  content: "";
+  border-bottom: 1px solid #f7f7f7;
+}
+
+.bs-popover-left, .bs-popover-auto[x-placement^="left"] {
+  margin-right: 0.5rem;
+}
+
+.bs-popover-left .arrow, .bs-popover-auto[x-placement^="left"] .arrow {
+  right: calc((0.5rem + 1px) * -1);
+  width: 0.5rem;
+  height: 1rem;
+  margin: 0.3rem 0;
+}
+
+.bs-popover-left .arrow::before, .bs-popover-auto[x-placement^="left"] .arrow::before,
+.bs-popover-left .arrow::after,
+.bs-popover-auto[x-placement^="left"] .arrow::after {
+  border-width: 0.5rem 0 0.5rem 0.5rem;
+}
+
+.bs-popover-left .arrow::before, .bs-popover-auto[x-placement^="left"] .arrow::before {
+  right: 0;
+  border-left-color: rgba(0, 0, 0, 0.25);
+}
+
+
+.bs-popover-left .arrow::after,
+.bs-popover-auto[x-placement^="left"] .arrow::after {
+  right: 1px;
+  border-left-color: #fff;
+}
+
+.popover-header {
+  padding: 0.5rem 0.75rem;
+  margin-bottom: 0;
+  font-size: 1rem;
+  color: inherit;
+  background-color: #f7f7f7;
+  border-bottom: 1px solid #ebebeb;
+  border-top-left-radius: calc(0.3rem - 1px);
+  border-top-right-radius: calc(0.3rem - 1px);
+}
+
+.popover-header:empty {
+  display: none;
+}
+
+.popover-body {
+  padding: 0.5rem 0.75rem;
+  color: #212529;
+}
+
+.carousel {
+  position: relative;
+}
+
+.carousel-inner {
+  position: relative;
+  width: 100%;
+  overflow: hidden;
+}
+
+.carousel-item {
+  position: relative;
+  display: none;
+  -ms-flex-align: center;
+  align-items: center;
+  width: 100%;
+  -webkit-backface-visibility: hidden;
+  backface-visibility: hidden;
+  -webkit-perspective: 1000px;
+  perspective: 1000px;
+}
+
+.carousel-item.active,
+.carousel-item-next,
+.carousel-item-prev {
+  display: block;
+  transition: -webkit-transform 0.6s ease;
+  transition: transform 0.6s ease;
+  transition: transform 0.6s ease, -webkit-transform 0.6s ease;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .carousel-item.active,
+  .carousel-item-next,
+  .carousel-item-prev {
+    transition: none;
+  }
+}
+
+.carousel-item-next,
+.carousel-item-prev {
+  position: absolute;
+  top: 0;
+}
+
+.carousel-item-next.carousel-item-left,
+.carousel-item-prev.carousel-item-right {
+  -webkit-transform: translateX(0);
+  transform: translateX(0);
+}
+
+@supports ((-webkit-transform-style: preserve-3d) or (transform-style: preserve-3d)) {
+  .carousel-item-next.carousel-item-left,
+  .carousel-item-prev.carousel-item-right {
+    -webkit-transform: translate3d(0, 0, 0);
+    transform: translate3d(0, 0, 0);
+  }
+}
+
+.carousel-item-next,
+.active.carousel-item-right {
+  -webkit-transform: translateX(100%);
+  transform: translateX(100%);
+}
+
+@supports ((-webkit-transform-style: preserve-3d) or (transform-style: preserve-3d)) {
+  .carousel-item-next,
+  .active.carousel-item-right {
+    -webkit-transform: translate3d(100%, 0, 0);
+    transform: translate3d(100%, 0, 0);
+  }
+}
+
+.carousel-item-prev,
+.active.carousel-item-left {
+  -webkit-transform: translateX(-100%);
+  transform: translateX(-100%);
+}
+
+@supports ((-webkit-transform-style: preserve-3d) or (transform-style: preserve-3d)) {
+  .carousel-item-prev,
+  .active.carousel-item-left {
+    -webkit-transform: translate3d(-100%, 0, 0);
+    transform: translate3d(-100%, 0, 0);
+  }
+}
+
+.carousel-fade .carousel-item {
+  opacity: 0;
+  transition-duration: .6s;
+  transition-property: opacity;
+}
+
+.carousel-fade .carousel-item.active,
+.carousel-fade .carousel-item-next.carousel-item-left,
+.carousel-fade .carousel-item-prev.carousel-item-right {
+  opacity: 1;
+}
+
+.carousel-fade .active.carousel-item-left,
+.carousel-fade .active.carousel-item-right {
+  opacity: 0;
+}
+
+.carousel-fade .carousel-item-next,
+.carousel-fade .carousel-item-prev,
+.carousel-fade .carousel-item.active,
+.carousel-fade .active.carousel-item-left,
+.carousel-fade .active.carousel-item-prev {
+  -webkit-transform: translateX(0);
+  transform: translateX(0);
+}
+
+@supports ((-webkit-transform-style: preserve-3d) or (transform-style: preserve-3d)) {
+  .carousel-fade .carousel-item-next,
+  .carousel-fade .carousel-item-prev,
+  .carousel-fade .carousel-item.active,
+  .carousel-fade .active.carousel-item-left,
+  .carousel-fade .active.carousel-item-prev {
+    -webkit-transform: translate3d(0, 0, 0);
+    transform: translate3d(0, 0, 0);
+  }
+}
+
+.carousel-control-prev,
+.carousel-control-next {
+  position: absolute;
+  top: 0;
+  bottom: 0;
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-align: center;
+  align-items: center;
+  -ms-flex-pack: center;
+  justify-content: center;
+  width: 15%;
+  color: #fff;
+  text-align: center;
+  opacity: 0.5;
+}
+
+.carousel-control-prev:hover, .carousel-control-prev:focus,
+.carousel-control-next:hover,
+.carousel-control-next:focus {
+  color: #fff;
+  text-decoration: none;
+  outline: 0;
+  opacity: .9;
+}
+
+.carousel-control-prev {
+  left: 0;
+}
+
+.carousel-control-next {
+  right: 0;
+}
+
+.carousel-control-prev-icon,
+.carousel-control-next-icon {
+  display: inline-block;
+  width: 20px;
+  height: 20px;
+  background: transparent no-repeat center center;
+  background-size: 100% 100%;
+}
+
+.carousel-control-prev-icon {
+  background-image: url("data:image/svg+xml;charset=utf8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%23fff' viewBox='0 0 8 8'%3E%3Cpath d='M5.25 0l-4 4 4 4 1.5-1.5-2.5-2.5 2.5-2.5-1.5-1.5z'/%3E%3C/svg%3E");
+}
+
+.carousel-control-next-icon {
+  background-image: url("data:image/svg+xml;charset=utf8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%23fff' viewBox='0 0 8 8'%3E%3Cpath d='M2.75 0l-1.5 1.5 2.5 2.5-2.5 2.5 1.5 1.5 4-4-4-4z'/%3E%3C/svg%3E");
+}
+
+.carousel-indicators {
+  position: absolute;
+  right: 0;
+  bottom: 10px;
+  left: 0;
+  z-index: 15;
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-pack: center;
+  justify-content: center;
+  padding-left: 0;
+  margin-right: 15%;
+  margin-left: 15%;
+  list-style: none;
+}
+
+.carousel-indicators li {
+  position: relative;
+  -ms-flex: 0 1 auto;
+  flex: 0 1 auto;
+  width: 30px;
+  height: 3px;
+  margin-right: 3px;
+  margin-left: 3px;
+  text-indent: -999px;
+  cursor: pointer;
+  background-color: rgba(255, 255, 255, 0.5);
+}
+
+.carousel-indicators li::before {
+  position: absolute;
+  top: -10px;
+  left: 0;
+  display: inline-block;
+  width: 100%;
+  height: 10px;
+  content: "";
+}
+
+.carousel-indicators li::after {
+  position: absolute;
+  bottom: -10px;
+  left: 0;
+  display: inline-block;
+  width: 100%;
+  height: 10px;
+  content: "";
+}
+
+.carousel-indicators .active {
+  background-color: #fff;
+}
+
+.carousel-caption {
+  position: absolute;
+  right: 15%;
+  bottom: 20px;
+  left: 15%;
+  z-index: 10;
+  padding-top: 20px;
+  padding-bottom: 20px;
+  color: #fff;
+  text-align: center;
+}
+
+.align-baseline {
+  vertical-align: baseline !important;
+}
+
+.align-top {
+  vertical-align: top !important;
+}
+
+.align-middle {
+  vertical-align: middle !important;
+}
+
+.align-bottom {
+  vertical-align: bottom !important;
+}
+
+.align-text-bottom {
+  vertical-align: text-bottom !important;
+}
+
+.align-text-top {
+  vertical-align: text-top !important;
+}
+
+.bg-primary {
+  background-color: #007bff !important;
+}
+
+a.bg-primary:hover, a.bg-primary:focus,
+button.bg-primary:hover,
+button.bg-primary:focus {
+  background-color: #0062cc !important;
+}
+
+.bg-secondary {
+  background-color: #6c757d !important;
+}
+
+a.bg-secondary:hover, a.bg-secondary:focus,
+button.bg-secondary:hover,
+button.bg-secondary:focus {
+  background-color: #545b62 !important;
+}
+
+.bg-success {
+  background-color: #28a745 !important;
+}
+
+a.bg-success:hover, a.bg-success:focus,
+button.bg-success:hover,
+button.bg-success:focus {
+  background-color: #1e7e34 !important;
+}
+
+.bg-info {
+  background-color: #17a2b8 !important;
+}
+
+a.bg-info:hover, a.bg-info:focus,
+button.bg-info:hover,
+button.bg-info:focus {
+  background-color: #117a8b !important;
+}
+
+.bg-warning {
+  background-color: #ffc107 !important;
+}
+
+a.bg-warning:hover, a.bg-warning:focus,
+button.bg-warning:hover,
+button.bg-warning:focus {
+  background-color: #d39e00 !important;
+}
+
+.bg-danger {
+  background-color: #dc3545 !important;
+}
+
+a.bg-danger:hover, a.bg-danger:focus,
+button.bg-danger:hover,
+button.bg-danger:focus {
+  background-color: #bd2130 !important;
+}
+
+.bg-light {
+  background-color: #f8f9fa !important;
+}
+
+a.bg-light:hover, a.bg-light:focus,
+button.bg-light:hover,
+button.bg-light:focus {
+  background-color: #dae0e5 !important;
+}
+
+.bg-dark {
+  background-color: #343a40 !important;
+}
+
+a.bg-dark:hover, a.bg-dark:focus,
+button.bg-dark:hover,
+button.bg-dark:focus {
+  background-color: #1d2124 !important;
+}
+
+.bg-white {
+  background-color: #fff !important;
+}
+
+.bg-transparent {
+  background-color: transparent !important;
+}
+
+.border {
+  border: 1px solid #dee2e6 !important;
+}
+
+.border-top {
+  border-top: 1px solid #dee2e6 !important;
+}
+
+.border-right {
+  border-right: 1px solid #dee2e6 !important;
+}
+
+.border-bottom {
+  border-bottom: 1px solid #dee2e6 !important;
+}
+
+.border-left {
+  border-left: 1px solid #dee2e6 !important;
+}
+
+.border-0 {
+  border: 0 !important;
+}
+
+.border-top-0 {
+  border-top: 0 !important;
+}
+
+.border-right-0 {
+  border-right: 0 !important;
+}
+
+.border-bottom-0 {
+  border-bottom: 0 !important;
+}
+
+.border-left-0 {
+  border-left: 0 !important;
+}
+
+.border-primary {
+  border-color: #007bff !important;
+}
+
+.border-secondary {
+  border-color: #6c757d !important;
+}
+
+.border-success {
+  border-color: #28a745 !important;
+}
+
+.border-info {
+  border-color: #17a2b8 !important;
+}
+
+.border-warning {
+  border-color: #ffc107 !important;
+}
+
+.border-danger {
+  border-color: #dc3545 !important;
+}
+
+.border-light {
+  border-color: #f8f9fa !important;
+}
+
+.border-dark {
+  border-color: #343a40 !important;
+}
+
+.border-white {
+  border-color: #fff !important;
+}
+
+.rounded {
+  border-radius: 0.25rem !important;
+}
+
+.rounded-top {
+  border-top-left-radius: 0.25rem !important;
+  border-top-right-radius: 0.25rem !important;
+}
+
+.rounded-right {
+  border-top-right-radius: 0.25rem !important;
+  border-bottom-right-radius: 0.25rem !important;
+}
+
+.rounded-bottom {
+  border-bottom-right-radius: 0.25rem !important;
+  border-bottom-left-radius: 0.25rem !important;
+}
+
+.rounded-left {
+  border-top-left-radius: 0.25rem !important;
+  border-bottom-left-radius: 0.25rem !important;
+}
+
+.rounded-circle {
+  border-radius: 50% !important;
+}
+
+.rounded-0 {
+  border-radius: 0 !important;
+}
+
+.clearfix::after {
+  display: block;
+  clear: both;
+  content: "";
+}
+
+.d-none {
+  display: none !important;
+}
+
+.d-inline {
+  display: inline !important;
+}
+
+.d-inline-block {
+  display: inline-block !important;
+}
+
+.d-block {
+  display: block !important;
+}
+
+.d-table {
+  display: table !important;
+}
+
+.d-table-row {
+  display: table-row !important;
+}
+
+.d-table-cell {
+  display: table-cell !important;
+}
+
+.d-flex {
+  display: -ms-flexbox !important;
+  display: flex !important;
+}
+
+.d-inline-flex {
+  display: -ms-inline-flexbox !important;
+  display: inline-flex !important;
+}
+
+@media (min-width: 576px) {
+  .d-sm-none {
+    display: none !important;
+  }
+  .d-sm-inline {
+    display: inline !important;
+  }
+  .d-sm-inline-block {
+    display: inline-block !important;
+  }
+  .d-sm-block {
+    display: block !important;
+  }
+  .d-sm-table {
+    display: table !important;
+  }
+  .d-sm-table-row {
+    display: table-row !important;
+  }
+  .d-sm-table-cell {
+    display: table-cell !important;
+  }
+  .d-sm-flex {
+    display: -ms-flexbox !important;
+    display: flex !important;
+  }
+  .d-sm-inline-flex {
+    display: -ms-inline-flexbox !important;
+    display: inline-flex !important;
+  }
+}
+
+@media (min-width: 768px) {
+  .d-md-none {
+    display: none !important;
+  }
+  .d-md-inline {
+    display: inline !important;
+  }
+  .d-md-inline-block {
+    display: inline-block !important;
+  }
+  .d-md-block {
+    display: block !important;
+  }
+  .d-md-table {
+    display: table !important;
+  }
+  .d-md-table-row {
+    display: table-row !important;
+  }
+  .d-md-table-cell {
+    display: table-cell !important;
+  }
+  .d-md-flex {
+    display: -ms-flexbox !important;
+    display: flex !important;
+  }
+  .d-md-inline-flex {
+    display: -ms-inline-flexbox !important;
+    display: inline-flex !important;
+  }
+}
+
+@media (min-width: 992px) {
+  .d-lg-none {
+    display: none !important;
+  }
+  .d-lg-inline {
+    display: inline !important;
+  }
+  .d-lg-inline-block {
+    display: inline-block !important;
+  }
+  .d-lg-block {
+    display: block !important;
+  }
+  .d-lg-table {
+    display: table !important;
+  }
+  .d-lg-table-row {
+    display: table-row !important;
+  }
+  .d-lg-table-cell {
+    display: table-cell !important;
+  }
+  .d-lg-flex {
+    display: -ms-flexbox !important;
+    display: flex !important;
+  }
+  .d-lg-inline-flex {
+    display: -ms-inline-flexbox !important;
+    display: inline-flex !important;
+  }
+}
+
+@media (min-width: 1200px) {
+  .d-xl-none {
+    display: none !important;
+  }
+  .d-xl-inline {
+    display: inline !important;
+  }
+  .d-xl-inline-block {
+    display: inline-block !important;
+  }
+  .d-xl-block {
+    display: block !important;
+  }
+  .d-xl-table {
+    display: table !important;
+  }
+  .d-xl-table-row {
+    display: table-row !important;
+  }
+  .d-xl-table-cell {
+    display: table-cell !important;
+  }
+  .d-xl-flex {
+    display: -ms-flexbox !important;
+    display: flex !important;
+  }
+  .d-xl-inline-flex {
+    display: -ms-inline-flexbox !important;
+    display: inline-flex !important;
+  }
+}
+
+@media print {
+  .d-print-none {
+    display: none !important;
+  }
+  .d-print-inline {
+    display: inline !important;
+  }
+  .d-print-inline-block {
+    display: inline-block !important;
+  }
+  .d-print-block {
+    display: block !important;
+  }
+  .d-print-table {
+    display: table !important;
+  }
+  .d-print-table-row {
+    display: table-row !important;
+  }
+  .d-print-table-cell {
+    display: table-cell !important;
+  }
+  .d-print-flex {
+    display: -ms-flexbox !important;
+    display: flex !important;
+  }
+  .d-print-inline-flex {
+    display: -ms-inline-flexbox !important;
+    display: inline-flex !important;
+  }
+}
+
+.embed-responsive {
+  position: relative;
+  display: block;
+  width: 100%;
+  padding: 0;
+  overflow: hidden;
+}
+
+.embed-responsive::before {
+  display: block;
+  content: "";
+}
+
+.embed-responsive .embed-responsive-item,
+.embed-responsive iframe,
+.embed-responsive embed,
+.embed-responsive object,
+.embed-responsive video {
+  position: absolute;
+  top: 0;
+  bottom: 0;
+  left: 0;
+  width: 100%;
+  height: 100%;
+  border: 0;
+}
+
+.embed-responsive-21by9::before {
+  padding-top: 42.857143%;
+}
+
+.embed-responsive-16by9::before {
+  padding-top: 56.25%;
+}
+
+.embed-responsive-4by3::before {
+  padding-top: 75%;
+}
+
+.embed-responsive-1by1::before {
+  padding-top: 100%;
+}
+
+.flex-row {
+  -ms-flex-direction: row !important;
+  flex-direction: row !important;
+}
+
+.flex-column {
+  -ms-flex-direction: column !important;
+  flex-direction: column !important;
+}
+
+.flex-row-reverse {
+  -ms-flex-direction: row-reverse !important;
+  flex-direction: row-reverse !important;
+}
+
+.flex-column-reverse {
+  -ms-flex-direction: column-reverse !important;
+  flex-direction: column-reverse !important;
+}
+
+.flex-wrap {
+  -ms-flex-wrap: wrap !important;
+  flex-wrap: wrap !important;
+}
+
+.flex-nowrap {
+  -ms-flex-wrap: nowrap !important;
+  flex-wrap: nowrap !important;
+}
+
+.flex-wrap-reverse {
+  -ms-flex-wrap: wrap-reverse !important;
+  flex-wrap: wrap-reverse !important;
+}
+
+.flex-fill {
+  -ms-flex: 1 1 auto !important;
+  flex: 1 1 auto !important;
+}
+
+.flex-grow-0 {
+  -ms-flex-positive: 0 !important;
+  flex-grow: 0 !important;
+}
+
+.flex-grow-1 {
+  -ms-flex-positive: 1 !important;
+  flex-grow: 1 !important;
+}
+
+.flex-shrink-0 {
+  -ms-flex-negative: 0 !important;
+  flex-shrink: 0 !important;
+}
+
+.flex-shrink-1 {
+  -ms-flex-negative: 1 !important;
+  flex-shrink: 1 !important;
+}
+
+.justify-content-start {
+  -ms-flex-pack: start !important;
+  justify-content: flex-start !important;
+}
+
+.justify-content-end {
+  -ms-flex-pack: end !important;
+  justify-content: flex-end !important;
+}
+
+.justify-content-center {
+  -ms-flex-pack: center !important;
+  justify-content: center !important;
+}
+
+.justify-content-between {
+  -ms-flex-pack: justify !important;
+  justify-content: space-between !important;
+}
+
+.justify-content-around {
+  -ms-flex-pack: distribute !important;
+  justify-content: space-around !important;
+}
+
+.align-items-start {
+  -ms-flex-align: start !important;
+  align-items: flex-start !important;
+}
+
+.align-items-end {
+  -ms-flex-align: end !important;
+  align-items: flex-end !important;
+}
+
+.align-items-center {
+  -ms-flex-align: center !important;
+  align-items: center !important;
+}
+
+.align-items-baseline {
+  -ms-flex-align: baseline !important;
+  align-items: baseline !important;
+}
+
+.align-items-stretch {
+  -ms-flex-align: stretch !important;
+  align-items: stretch !important;
+}
+
+.align-content-start {
+  -ms-flex-line-pack: start !important;
+  align-content: flex-start !important;
+}
+
+.align-content-end {
+  -ms-flex-line-pack: end !important;
+  align-content: flex-end !important;
+}
+
+.align-content-center {
+  -ms-flex-line-pack: center !important;
+  align-content: center !important;
+}
+
+.align-content-between {
+  -ms-flex-line-pack: justify !important;
+  align-content: space-between !important;
+}
+
+.align-content-around {
+  -ms-flex-line-pack: distribute !important;
+  align-content: space-around !important;
+}
+
+.align-content-stretch {
+  -ms-flex-line-pack: stretch !important;
+  align-content: stretch !important;
+}
+
+.align-self-auto {
+  -ms-flex-item-align: auto !important;
+  align-self: auto !important;
+}
+
+.align-self-start {
+  -ms-flex-item-align: start !important;
+  align-self: flex-start !important;
+}
+
+.align-self-end {
+  -ms-flex-item-align: end !important;
+  align-self: flex-end !important;
+}
+
+.align-self-center {
+  -ms-flex-item-align: center !important;
+  align-self: center !important;
+}
+
+.align-self-baseline {
+  -ms-flex-item-align: baseline !important;
+  align-self: baseline !important;
+}
+
+.align-self-stretch {
+  -ms-flex-item-align: stretch !important;
+  align-self: stretch !important;
+}
+
+@media (min-width: 576px) {
+  .flex-sm-row {
+    -ms-flex-direction: row !important;
+    flex-direction: row !important;
+  }
+  .flex-sm-column {
+    -ms-flex-direction: column !important;
+    flex-direction: column !important;
+  }
+  .flex-sm-row-reverse {
+    -ms-flex-direction: row-reverse !important;
+    flex-direction: row-reverse !important;
+  }
+  .flex-sm-column-reverse {
+    -ms-flex-direction: column-reverse !important;
+    flex-direction: column-reverse !important;
+  }
+  .flex-sm-wrap {
+    -ms-flex-wrap: wrap !important;
+    flex-wrap: wrap !important;
+  }
+  .flex-sm-nowrap {
+    -ms-flex-wrap: nowrap !important;
+    flex-wrap: nowrap !important;
+  }
+  .flex-sm-wrap-reverse {
+    -ms-flex-wrap: wrap-reverse !important;
+    flex-wrap: wrap-reverse !important;
+  }
+  .flex-sm-fill {
+    -ms-flex: 1 1 auto !important;
+    flex: 1 1 auto !important;
+  }
+  .flex-sm-grow-0 {
+    -ms-flex-positive: 0 !important;
+    flex-grow: 0 !important;
+  }
+  .flex-sm-grow-1 {
+    -ms-flex-positive: 1 !important;
+    flex-grow: 1 !important;
+  }
+  .flex-sm-shrink-0 {
+    -ms-flex-negative: 0 !important;
+    flex-shrink: 0 !important;
+  }
+  .flex-sm-shrink-1 {
+    -ms-flex-negative: 1 !important;
+    flex-shrink: 1 !important;
+  }
+  .justify-content-sm-start {
+    -ms-flex-pack: start !important;
+    justify-content: flex-start !important;
+  }
+  .justify-content-sm-end {
+    -ms-flex-pack: end !important;
+    justify-content: flex-end !important;
+  }
+  .justify-content-sm-center {
+    -ms-flex-pack: center !important;
+    justify-content: center !important;
+  }
+  .justify-content-sm-between {
+    -ms-flex-pack: justify !important;
+    justify-content: space-between !important;
+  }
+  .justify-content-sm-around {
+    -ms-flex-pack: distribute !important;
+    justify-content: space-around !important;
+  }
+  .align-items-sm-start {
+    -ms-flex-align: start !important;
+    align-items: flex-start !important;
+  }
+  .align-items-sm-end {
+    -ms-flex-align: end !important;
+    align-items: flex-end !important;
+  }
+  .align-items-sm-center {
+    -ms-flex-align: center !important;
+    align-items: center !important;
+  }
+  .align-items-sm-baseline {
+    -ms-flex-align: baseline !important;
+    align-items: baseline !important;
+  }
+  .align-items-sm-stretch {
+    -ms-flex-align: stretch !important;
+    align-items: stretch !important;
+  }
+  .align-content-sm-start {
+    -ms-flex-line-pack: start !important;
+    align-content: flex-start !important;
+  }
+  .align-content-sm-end {
+    -ms-flex-line-pack: end !important;
+    align-content: flex-end !important;
+  }
+  .align-content-sm-center {
+    -ms-flex-line-pack: center !important;
+    align-content: center !important;
+  }
+  .align-content-sm-between {
+    -ms-flex-line-pack: justify !important;
+    align-content: space-between !important;
+  }
+  .align-content-sm-around {
+    -ms-flex-line-pack: distribute !important;
+    align-content: space-around !important;
+  }
+  .align-content-sm-stretch {
+    -ms-flex-line-pack: stretch !important;
+    align-content: stretch !important;
+  }
+  .align-self-sm-auto {
+    -ms-flex-item-align: auto !important;
+    align-self: auto !important;
+  }
+  .align-self-sm-start {
+    -ms-flex-item-align: start !important;
+    align-self: flex-start !important;
+  }
+  .align-self-sm-end {
+    -ms-flex-item-align: end !important;
+    align-self: flex-end !important;
+  }
+  .align-self-sm-center {
+    -ms-flex-item-align: center !important;
+    align-self: center !important;
+  }
+  .align-self-sm-baseline {
+    -ms-flex-item-align: baseline !important;
+    align-self: baseline !important;
+  }
+  .align-self-sm-stretch {
+    -ms-flex-item-align: stretch !important;
+    align-self: stretch !important;
+  }
+}
+
+@media (min-width: 768px) {
+  .flex-md-row {
+    -ms-flex-direction: row !important;
+    flex-direction: row !important;
+  }
+  .flex-md-column {
+    -ms-flex-direction: column !important;
+    flex-direction: column !important;
+  }
+  .flex-md-row-reverse {
+    -ms-flex-direction: row-reverse !important;
+    flex-direction: row-reverse !important;
+  }
+  .flex-md-column-reverse {
+    -ms-flex-direction: column-reverse !important;
+    flex-direction: column-reverse !important;
+  }
+  .flex-md-wrap {
+    -ms-flex-wrap: wrap !important;
+    flex-wrap: wrap !important;
+  }
+  .flex-md-nowrap {
+    -ms-flex-wrap: nowrap !important;
+    flex-wrap: nowrap !important;
+  }
+  .flex-md-wrap-reverse {
+    -ms-flex-wrap: wrap-reverse !important;
+    flex-wrap: wrap-reverse !important;
+  }
+  .flex-md-fill {
+    -ms-flex: 1 1 auto !important;
+    flex: 1 1 auto !important;
+  }
+  .flex-md-grow-0 {
+    -ms-flex-positive: 0 !important;
+    flex-grow: 0 !important;
+  }
+  .flex-md-grow-1 {
+    -ms-flex-positive: 1 !important;
+    flex-grow: 1 !important;
+  }
+  .flex-md-shrink-0 {
+    -ms-flex-negative: 0 !important;
+    flex-shrink: 0 !important;
+  }
+  .flex-md-shrink-1 {
+    -ms-flex-negative: 1 !important;
+    flex-shrink: 1 !important;
+  }
+  .justify-content-md-start {
+    -ms-flex-pack: start !important;
+    justify-content: flex-start !important;
+  }
+  .justify-content-md-end {
+    -ms-flex-pack: end !important;
+    justify-content: flex-end !important;
+  }
+  .justify-content-md-center {
+    -ms-flex-pack: center !important;
+    justify-content: center !important;
+  }
+  .justify-content-md-between {
+    -ms-flex-pack: justify !important;
+    justify-content: space-between !important;
+  }
+  .justify-content-md-around {
+    -ms-flex-pack: distribute !important;
+    justify-content: space-around !important;
+  }
+  .align-items-md-start {
+    -ms-flex-align: start !important;
+    align-items: flex-start !important;
+  }
+  .align-items-md-end {
+    -ms-flex-align: end !important;
+    align-items: flex-end !important;
+  }
+  .align-items-md-center {
+    -ms-flex-align: center !important;
+    align-items: center !important;
+  }
+  .align-items-md-baseline {
+    -ms-flex-align: baseline !important;
+    align-items: baseline !important;
+  }
+  .align-items-md-stretch {
+    -ms-flex-align: stretch !important;
+    align-items: stretch !important;
+  }
+  .align-content-md-start {
+    -ms-flex-line-pack: start !important;
+    align-content: flex-start !important;
+  }
+  .align-content-md-end {
+    -ms-flex-line-pack: end !important;
+    align-content: flex-end !important;
+  }
+  .align-content-md-center {
+    -ms-flex-line-pack: center !important;
+    align-content: center !important;
+  }
+  .align-content-md-between {
+    -ms-flex-line-pack: justify !important;
+    align-content: space-between !important;
+  }
+  .align-content-md-around {
+    -ms-flex-line-pack: distribute !important;
+    align-content: space-around !important;
+  }
+  .align-content-md-stretch {
+    -ms-flex-line-pack: stretch !important;
+    align-content: stretch !important;
+  }
+  .align-self-md-auto {
+    -ms-flex-item-align: auto !important;
+    align-self: auto !important;
+  }
+  .align-self-md-start {
+    -ms-flex-item-align: start !important;
+    align-self: flex-start !important;
+  }
+  .align-self-md-end {
+    -ms-flex-item-align: end !important;
+    align-self: flex-end !important;
+  }
+  .align-self-md-center {
+    -ms-flex-item-align: center !important;
+    align-self: center !important;
+  }
+  .align-self-md-baseline {
+    -ms-flex-item-align: baseline !important;
+    align-self: baseline !important;
+  }
+  .align-self-md-stretch {
+    -ms-flex-item-align: stretch !important;
+    align-self: stretch !important;
+  }
+}
+
+@media (min-width: 992px) {
+  .flex-lg-row {
+    -ms-flex-direction: row !important;
+    flex-direction: row !important;
+  }
+  .flex-lg-column {
+    -ms-flex-direction: column !important;
+    flex-direction: column !important;
+  }
+  .flex-lg-row-reverse {
+    -ms-flex-direction: row-reverse !important;
+    flex-direction: row-reverse !important;
+  }
+  .flex-lg-column-reverse {
+    -ms-flex-direction: column-reverse !important;
+    flex-direction: column-reverse !important;
+  }
+  .flex-lg-wrap {
+    -ms-flex-wrap: wrap !important;
+    flex-wrap: wrap !important;
+  }
+  .flex-lg-nowrap {
+    -ms-flex-wrap: nowrap !important;
+    flex-wrap: nowrap !important;
+  }
+  .flex-lg-wrap-reverse {
+    -ms-flex-wrap: wrap-reverse !important;
+    flex-wrap: wrap-reverse !important;
+  }
+  .flex-lg-fill {
+    -ms-flex: 1 1 auto !important;
+    flex: 1 1 auto !important;
+  }
+  .flex-lg-grow-0 {
+    -ms-flex-positive: 0 !important;
+    flex-grow: 0 !important;
+  }
+  .flex-lg-grow-1 {
+    -ms-flex-positive: 1 !important;
+    flex-grow: 1 !important;
+  }
+  .flex-lg-shrink-0 {
+    -ms-flex-negative: 0 !important;
+    flex-shrink: 0 !important;
+  }
+  .flex-lg-shrink-1 {
+    -ms-flex-negative: 1 !important;
+    flex-shrink: 1 !important;
+  }
+  .justify-content-lg-start {
+    -ms-flex-pack: start !important;
+    justify-content: flex-start !important;
+  }
+  .justify-content-lg-end {
+    -ms-flex-pack: end !important;
+    justify-content: flex-end !important;
+  }
+  .justify-content-lg-center {
+    -ms-flex-pack: center !important;
+    justify-content: center !important;
+  }
+  .justify-content-lg-between {
+    -ms-flex-pack: justify !important;
+    justify-content: space-between !important;
+  }
+  .justify-content-lg-around {
+    -ms-flex-pack: distribute !important;
+    justify-content: space-around !important;
+  }
+  .align-items-lg-start {
+    -ms-flex-align: start !important;
+    align-items: flex-start !important;
+  }
+  .align-items-lg-end {
+    -ms-flex-align: end !important;
+    align-items: flex-end !important;
+  }
+  .align-items-lg-center {
+    -ms-flex-align: center !important;
+    align-items: center !important;
+  }
+  .align-items-lg-baseline {
+    -ms-flex-align: baseline !important;
+    align-items: baseline !important;
+  }
+  .align-items-lg-stretch {
+    -ms-flex-align: stretch !important;
+    align-items: stretch !important;
+  }
+  .align-content-lg-start {
+    -ms-flex-line-pack: start !important;
+    align-content: flex-start !important;
+  }
+  .align-content-lg-end {
+    -ms-flex-line-pack: end !important;
+    align-content: flex-end !important;
+  }
+  .align-content-lg-center {
+    -ms-flex-line-pack: center !important;
+    align-content: center !important;
+  }
+  .align-content-lg-between {
+    -ms-flex-line-pack: justify !important;
+    align-content: space-between !important;
+  }
+  .align-content-lg-around {
+    -ms-flex-line-pack: distribute !important;
+    align-content: space-around !important;
+  }
+  .align-content-lg-stretch {
+    -ms-flex-line-pack: stretch !important;
+    align-content: stretch !important;
+  }
+  .align-self-lg-auto {
+    -ms-flex-item-align: auto !important;
+    align-self: auto !important;
+  }
+  .align-self-lg-start {
+    -ms-flex-item-align: start !important;
+    align-self: flex-start !important;
+  }
+  .align-self-lg-end {
+    -ms-flex-item-align: end !important;
+    align-self: flex-end !important;
+  }
+  .align-self-lg-center {
+    -ms-flex-item-align: center !important;
+    align-self: center !important;
+  }
+  .align-self-lg-baseline {
+    -ms-flex-item-align: baseline !important;
+    align-self: baseline !important;
+  }
+  .align-self-lg-stretch {
+    -ms-flex-item-align: stretch !important;
+    align-self: stretch !important;
+  }
+}
+
+@media (min-width: 1200px) {
+  .flex-xl-row {
+    -ms-flex-direction: row !important;
+    flex-direction: row !important;
+  }
+  .flex-xl-column {
+    -ms-flex-direction: column !important;
+    flex-direction: column !important;
+  }
+  .flex-xl-row-reverse {
+    -ms-flex-direction: row-reverse !important;
+    flex-direction: row-reverse !important;
+  }
+  .flex-xl-column-reverse {
+    -ms-flex-direction: column-reverse !important;
+    flex-direction: column-reverse !important;
+  }
+  .flex-xl-wrap {
+    -ms-flex-wrap: wrap !important;
+    flex-wrap: wrap !important;
+  }
+  .flex-xl-nowrap {
+    -ms-flex-wrap: nowrap !important;
+    flex-wrap: nowrap !important;
+  }
+  .flex-xl-wrap-reverse {
+    -ms-flex-wrap: wrap-reverse !important;
+    flex-wrap: wrap-reverse !important;
+  }
+  .flex-xl-fill {
+    -ms-flex: 1 1 auto !important;
+    flex: 1 1 auto !important;
+  }
+  .flex-xl-grow-0 {
+    -ms-flex-positive: 0 !important;
+    flex-grow: 0 !important;
+  }
+  .flex-xl-grow-1 {
+    -ms-flex-positive: 1 !important;
+    flex-grow: 1 !important;
+  }
+  .flex-xl-shrink-0 {
+    -ms-flex-negative: 0 !important;
+    flex-shrink: 0 !important;
+  }
+  .flex-xl-shrink-1 {
+    -ms-flex-negative: 1 !important;
+    flex-shrink: 1 !important;
+  }
+  .justify-content-xl-start {
+    -ms-flex-pack: start !important;
+    justify-content: flex-start !important;
+  }
+  .justify-content-xl-end {
+    -ms-flex-pack: end !important;
+    justify-content: flex-end !important;
+  }
+  .justify-content-xl-center {
+    -ms-flex-pack: center !important;
+    justify-content: center !important;
+  }
+  .justify-content-xl-between {
+    -ms-flex-pack: justify !important;
+    justify-content: space-between !important;
+  }
+  .justify-content-xl-around {
+    -ms-flex-pack: distribute !important;
+    justify-content: space-around !important;
+  }
+  .align-items-xl-start {
+    -ms-flex-align: start !important;
+    align-items: flex-start !important;
+  }
+  .align-items-xl-end {
+    -ms-flex-align: end !important;
+    align-items: flex-end !important;
+  }
+  .align-items-xl-center {
+    -ms-flex-align: center !important;
+    align-items: center !important;
+  }
+  .align-items-xl-baseline {
+    -ms-flex-align: baseline !important;
+    align-items: baseline !important;
+  }
+  .align-items-xl-stretch {
+    -ms-flex-align: stretch !important;
+    align-items: stretch !important;
+  }
+  .align-content-xl-start {
+    -ms-flex-line-pack: start !important;
+    align-content: flex-start !important;
+  }
+  .align-content-xl-end {
+    -ms-flex-line-pack: end !important;
+    align-content: flex-end !important;
+  }
+  .align-content-xl-center {
+    -ms-flex-line-pack: center !important;
+    align-content: center !important;
+  }
+  .align-content-xl-between {
+    -ms-flex-line-pack: justify !important;
+    align-content: space-between !important;
+  }
+  .align-content-xl-around {
+    -ms-flex-line-pack: distribute !important;
+    align-content: space-around !important;
+  }
+  .align-content-xl-stretch {
+    -ms-flex-line-pack: stretch !important;
+    align-content: stretch !important;
+  }
+  .align-self-xl-auto {
+    -ms-flex-item-align: auto !important;
+    align-self: auto !important;
+  }
+  .align-self-xl-start {
+    -ms-flex-item-align: start !important;
+    align-self: flex-start !important;
+  }
+  .align-self-xl-end {
+    -ms-flex-item-align: end !important;
+    align-self: flex-end !important;
+  }
+  .align-self-xl-center {
+    -ms-flex-item-align: center !important;
+    align-self: center !important;
+  }
+  .align-self-xl-baseline {
+    -ms-flex-item-align: baseline !important;
+    align-self: baseline !important;
+  }
+  .align-self-xl-stretch {
+    -ms-flex-item-align: stretch !important;
+    align-self: stretch !important;
+  }
+}
+
+.float-left {
+  float: left !important;
+}
+
+.float-right {
+  float: right !important;
+}
+
+.float-none {
+  float: none !important;
+}
+
+@media (min-width: 576px) {
+  .float-sm-left {
+    float: left !important;
+  }
+  .float-sm-right {
+    float: right !important;
+  }
+  .float-sm-none {
+    float: none !important;
+  }
+}
+
+@media (min-width: 768px) {
+  .float-md-left {
+    float: left !important;
+  }
+  .float-md-right {
+    float: right !important;
+  }
+  .float-md-none {
+    float: none !important;
+  }
+}
+
+@media (min-width: 992px) {
+  .float-lg-left {
+    float: left !important;
+  }
+  .float-lg-right {
+    float: right !important;
+  }
+  .float-lg-none {
+    float: none !important;
+  }
+}
+
+@media (min-width: 1200px) {
+  .float-xl-left {
+    float: left !important;
+  }
+  .float-xl-right {
+    float: right !important;
+  }
+  .float-xl-none {
+    float: none !important;
+  }
+}
+
+.position-static {
+  position: static !important;
+}
+
+.position-relative {
+  position: relative !important;
+}
+
+.position-absolute {
+  position: absolute !important;
+}
+
+.position-fixed {
+  position: fixed !important;
+}
+
+.position-sticky {
+  position: -webkit-sticky !important;
+  position: sticky !important;
+}
+
+.fixed-top {
+  position: fixed;
+  top: 0;
+  right: 0;
+  left: 0;
+  z-index: 1030;
+}
+
+.fixed-bottom {
+  position: fixed;
+  right: 0;
+  bottom: 0;
+  left: 0;
+  z-index: 1030;
+}
+
+@supports ((position: -webkit-sticky) or (position: sticky)) {
+  .sticky-top {
+    position: -webkit-sticky;
+    position: sticky;
+    top: 0;
+    z-index: 1020;
+  }
+}
+
+.sr-only {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  padding: 0;
+  overflow: hidden;
+  clip: rect(0, 0, 0, 0);
+  white-space: nowrap;
+  border: 0;
+}
+
+.sr-only-focusable:active, .sr-only-focusable:focus {
+  position: static;
+  width: auto;
+  height: auto;
+  overflow: visible;
+  clip: auto;
+  white-space: normal;
+}
+
+.shadow-sm {
+  box-shadow: 0 0.125rem 0.25rem rgba(0, 0, 0, 0.075) !important;
+}
+
+.shadow {
+  box-shadow: 0 0.5rem 1rem rgba(0, 0, 0, 0.15) !important;
+}
+
+.shadow-lg {
+  box-shadow: 0 1rem 3rem rgba(0, 0, 0, 0.175) !important;
+}
+
+.shadow-none {
+  box-shadow: none !important;
+}
+
+.w-25 {
+  width: 25% !important;
+}
+
+.w-50 {
+  width: 50% !important;
+}
+
+.w-75 {
+  width: 75% !important;
+}
+
+.w-100 {
+  width: 100% !important;
+}
+
+.w-auto {
+  width: auto !important;
+}
+
+.h-25 {
+  height: 25% !important;
+}
+
+.h-50 {
+  height: 50% !important;
+}
+
+.h-75 {
+  height: 75% !important;
+}
+
+.h-100 {
+  height: 100% !important;
+}
+
+.h-auto {
+  height: auto !important;
+}
+
+.mw-100 {
+  max-width: 100% !important;
+}
+
+.mh-100 {
+  max-height: 100% !important;
+}
+
+.m-0 {
+  margin: 0 !important;
+}
+
+.mt-0,
+.my-0 {
+  margin-top: 0 !important;
+}
+
+.mr-0,
+.mx-0 {
+  margin-right: 0 !important;
+}
+
+.mb-0,
+.my-0 {
+  margin-bottom: 0 !important;
+}
+
+.ml-0,
+.mx-0 {
+  margin-left: 0 !important;
+}
+
+.m-1 {
+  margin: 0.25rem !important;
+}
+
+.mt-1,
+.my-1 {
+  margin-top: 0.25rem !important;
+}
+
+.mr-1,
+.mx-1 {
+  margin-right: 0.25rem !important;
+}
+
+.mb-1,
+.my-1 {
+  margin-bottom: 0.25rem !important;
+}
+
+.ml-1,
+.mx-1 {
+  margin-left: 0.25rem !important;
+}
+
+.m-2 {
+  margin: 0.5rem !important;
+}
+
+.mt-2,
+.my-2 {
+  margin-top: 0.5rem !important;
+}
+
+.mr-2,
+.mx-2 {
+  margin-right: 0.5rem !important;
+}
+
+.mb-2,
+.my-2 {
+  margin-bottom: 0.5rem !important;
+}
+
+.ml-2,
+.mx-2 {
+  margin-left: 0.5rem !important;
+}
+
+.m-3 {
+  margin: 1rem !important;
+}
+
+.mt-3,
+.my-3 {
+  margin-top: 1rem !important;
+}
+
+.mr-3,
+.mx-3 {
+  margin-right: 1rem !important;
+}
+
+.mb-3,
+.my-3 {
+  margin-bottom: 1rem !important;
+}
+
+.ml-3,
+.mx-3 {
+  margin-left: 1rem !important;
+}
+
+.m-4 {
+  margin: 1.5rem !important;
+}
+
+.mt-4,
+.my-4 {
+  margin-top: 1.5rem !important;
+}
+
+.mr-4,
+.mx-4 {
+  margin-right: 1.5rem !important;
+}
+
+.mb-4,
+.my-4 {
+  margin-bottom: 1.5rem !important;
+}
+
+.ml-4,
+.mx-4 {
+  margin-left: 1.5rem !important;
+}
+
+.m-5 {
+  margin: 3rem !important;
+}
+
+.mt-5,
+.my-5 {
+  margin-top: 3rem !important;
+}
+
+.mr-5,
+.mx-5 {
+  margin-right: 3rem !important;
+}
+
+.mb-5,
+.my-5 {
+  margin-bottom: 3rem !important;
+}
+
+.ml-5,
+.mx-5 {
+  margin-left: 3rem !important;
+}
+
+.p-0 {
+  padding: 0 !important;
+}
+
+.pt-0,
+.py-0 {
+  padding-top: 0 !important;
+}
+
+.pr-0,
+.px-0 {
+  padding-right: 0 !important;
+}
+
+.pb-0,
+.py-0 {
+  padding-bottom: 0 !important;
+}
+
+.pl-0,
+.px-0 {
+  padding-left: 0 !important;
+}
+
+.p-1 {
+  padding: 0.25rem !important;
+}
+
+.pt-1,
+.py-1 {
+  padding-top: 0.25rem !important;
+}
+
+.pr-1,
+.px-1 {
+  padding-right: 0.25rem !important;
+}
+
+.pb-1,
+.py-1 {
+  padding-bottom: 0.25rem !important;
+}
+
+.pl-1,
+.px-1 {
+  padding-left: 0.25rem !important;
+}
+
+.p-2 {
+  padding: 0.5rem !important;
+}
+
+.pt-2,
+.py-2 {
+  padding-top: 0.5rem !important;
+}
+
+.pr-2,
+.px-2 {
+  padding-right: 0.5rem !important;
+}
+
+.pb-2,
+.py-2 {
+  padding-bottom: 0.5rem !important;
+}
+
+.pl-2,
+.px-2 {
+  padding-left: 0.5rem !important;
+}
+
+.p-3 {
+  padding: 1rem !important;
+}
+
+.pt-3,
+.py-3 {
+  padding-top: 1rem !important;
+}
+
+.pr-3,
+.px-3 {
+  padding-right: 1rem !important;
+}
+
+.pb-3,
+.py-3 {
+  padding-bottom: 1rem !important;
+}
+
+.pl-3,
+.px-3 {
+  padding-left: 1rem !important;
+}
+
+.p-4 {
+  padding: 1.5rem !important;
+}
+
+.pt-4,
+.py-4 {
+  padding-top: 1.5rem !important;
+}
+
+.pr-4,
+.px-4 {
+  padding-right: 1.5rem !important;
+}
+
+.pb-4,
+.py-4 {
+  padding-bottom: 1.5rem !important;
+}
+
+.pl-4,
+.px-4 {
+  padding-left: 1.5rem !important;
+}
+
+.p-5 {
+  padding: 3rem !important;
+}
+
+.pt-5,
+.py-5 {
+  padding-top: 3rem !important;
+}
+
+.pr-5,
+.px-5 {
+  padding-right: 3rem !important;
+}
+
+.pb-5,
+.py-5 {
+  padding-bottom: 3rem !important;
+}
+
+.pl-5,
+.px-5 {
+  padding-left: 3rem !important;
+}
+
+.m-auto {
+  margin: auto !important;
+}
+
+.mt-auto,
+.my-auto {
+  margin-top: auto !important;
+}
+
+.mr-auto,
+.mx-auto {
+  margin-right: auto !important;
+}
+
+.mb-auto,
+.my-auto {
+  margin-bottom: auto !important;
+}
+
+.ml-auto,
+.mx-auto {
+  margin-left: auto !important;
+}
+
+@media (min-width: 576px) {
+  .m-sm-0 {
+    margin: 0 !important;
+  }
+  .mt-sm-0,
+  .my-sm-0 {
+    margin-top: 0 !important;
+  }
+  .mr-sm-0,
+  .mx-sm-0 {
+    margin-right: 0 !important;
+  }
+  .mb-sm-0,
+  .my-sm-0 {
+    margin-bottom: 0 !important;
+  }
+  .ml-sm-0,
+  .mx-sm-0 {
+    margin-left: 0 !important;
+  }
+  .m-sm-1 {
+    margin: 0.25rem !important;
+  }
+  .mt-sm-1,
+  .my-sm-1 {
+    margin-top: 0.25rem !important;
+  }
+  .mr-sm-1,
+  .mx-sm-1 {
+    margin-right: 0.25rem !important;
+  }
+  .mb-sm-1,
+  .my-sm-1 {
+    margin-bottom: 0.25rem !important;
+  }
+  .ml-sm-1,
+  .mx-sm-1 {
+    margin-left: 0.25rem !important;
+  }
+  .m-sm-2 {
+    margin: 0.5rem !important;
+  }
+  .mt-sm-2,
+  .my-sm-2 {
+    margin-top: 0.5rem !important;
+  }
+  .mr-sm-2,
+  .mx-sm-2 {
+    margin-right: 0.5rem !important;
+  }
+  .mb-sm-2,
+  .my-sm-2 {
+    margin-bottom: 0.5rem !important;
+  }
+  .ml-sm-2,
+  .mx-sm-2 {
+    margin-left: 0.5rem !important;
+  }
+  .m-sm-3 {
+    margin: 1rem !important;
+  }
+  .mt-sm-3,
+  .my-sm-3 {
+    margin-top: 1rem !important;
+  }
+  .mr-sm-3,
+  .mx-sm-3 {
+    margin-right: 1rem !important;
+  }
+  .mb-sm-3,
+  .my-sm-3 {
+    margin-bottom: 1rem !important;
+  }
+  .ml-sm-3,
+  .mx-sm-3 {
+    margin-left: 1rem !important;
+  }
+  .m-sm-4 {
+    margin: 1.5rem !important;
+  }
+  .mt-sm-4,
+  .my-sm-4 {
+    margin-top: 1.5rem !important;
+  }
+  .mr-sm-4,
+  .mx-sm-4 {
+    margin-right: 1.5rem !important;
+  }
+  .mb-sm-4,
+  .my-sm-4 {
+    margin-bottom: 1.5rem !important;
+  }
+  .ml-sm-4,
+  .mx-sm-4 {
+    margin-left: 1.5rem !important;
+  }
+  .m-sm-5 {
+    margin: 3rem !important;
+  }
+  .mt-sm-5,
+  .my-sm-5 {
+    margin-top: 3rem !important;
+  }
+  .mr-sm-5,
+  .mx-sm-5 {
+    margin-right: 3rem !important;
+  }
+  .mb-sm-5,
+  .my-sm-5 {
+    margin-bottom: 3rem !important;
+  }
+  .ml-sm-5,
+  .mx-sm-5 {
+    margin-left: 3rem !important;
+  }
+  .p-sm-0 {
+    padding: 0 !important;
+  }
+  .pt-sm-0,
+  .py-sm-0 {
+    padding-top: 0 !important;
+  }
+  .pr-sm-0,
+  .px-sm-0 {
+    padding-right: 0 !important;
+  }
+  .pb-sm-0,
+  .py-sm-0 {
+    padding-bottom: 0 !important;
+  }
+  .pl-sm-0,
+  .px-sm-0 {
+    padding-left: 0 !important;
+  }
+  .p-sm-1 {
+    padding: 0.25rem !important;
+  }
+  .pt-sm-1,
+  .py-sm-1 {
+    padding-top: 0.25rem !important;
+  }
+  .pr-sm-1,
+  .px-sm-1 {
+    padding-right: 0.25rem !important;
+  }
+  .pb-sm-1,
+  .py-sm-1 {
+    padding-bottom: 0.25rem !important;
+  }
+  .pl-sm-1,
+  .px-sm-1 {
+    padding-left: 0.25rem !important;
+  }
+  .p-sm-2 {
+    padding: 0.5rem !important;
+  }
+  .pt-sm-2,
+  .py-sm-2 {
+    padding-top: 0.5rem !important;
+  }
+  .pr-sm-2,
+  .px-sm-2 {
+    padding-right: 0.5rem !important;
+  }
+  .pb-sm-2,
+  .py-sm-2 {
+    padding-bottom: 0.5rem !important;
+  }
+  .pl-sm-2,
+  .px-sm-2 {
+    padding-left: 0.5rem !important;
+  }
+  .p-sm-3 {
+    padding: 1rem !important;
+  }
+  .pt-sm-3,
+  .py-sm-3 {
+    padding-top: 1rem !important;
+  }
+  .pr-sm-3,
+  .px-sm-3 {
+    padding-right: 1rem !important;
+  }
+  .pb-sm-3,
+  .py-sm-3 {
+    padding-bottom: 1rem !important;
+  }
+  .pl-sm-3,
+  .px-sm-3 {
+    padding-left: 1rem !important;
+  }
+  .p-sm-4 {
+    padding: 1.5rem !important;
+  }
+  .pt-sm-4,
+  .py-sm-4 {
+    padding-top: 1.5rem !important;
+  }
+  .pr-sm-4,
+  .px-sm-4 {
+    padding-right: 1.5rem !important;
+  }
+  .pb-sm-4,
+  .py-sm-4 {
+    padding-bottom: 1.5rem !important;
+  }
+  .pl-sm-4,
+  .px-sm-4 {
+    padding-left: 1.5rem !important;
+  }
+  .p-sm-5 {
+    padding: 3rem !important;
+  }
+  .pt-sm-5,
+  .py-sm-5 {
+    padding-top: 3rem !important;
+  }
+  .pr-sm-5,
+  .px-sm-5 {
+    padding-right: 3rem !important;
+  }
+  .pb-sm-5,
+  .py-sm-5 {
+    padding-bottom: 3rem !important;
+  }
+  .pl-sm-5,
+  .px-sm-5 {
+    padding-left: 3rem !important;
+  }
+  .m-sm-auto {
+    margin: auto !important;
+  }
+  .mt-sm-auto,
+  .my-sm-auto {
+    margin-top: auto !important;
+  }
+  .mr-sm-auto,
+  .mx-sm-auto {
+    margin-right: auto !important;
+  }
+  .mb-sm-auto,
+  .my-sm-auto {
+    margin-bottom: auto !important;
+  }
+  .ml-sm-auto,
+  .mx-sm-auto {
+    margin-left: auto !important;
+  }
+}
+
+@media (min-width: 768px) {
+  .m-md-0 {
+    margin: 0 !important;
+  }
+  .mt-md-0,
+  .my-md-0 {
+    margin-top: 0 !important;
+  }
+  .mr-md-0,
+  .mx-md-0 {
+    margin-right: 0 !important;
+  }
+  .mb-md-0,
+  .my-md-0 {
+    margin-bottom: 0 !important;
+  }
+  .ml-md-0,
+  .mx-md-0 {
+    margin-left: 0 !important;
+  }
+  .m-md-1 {
+    margin: 0.25rem !important;
+  }
+  .mt-md-1,
+  .my-md-1 {
+    margin-top: 0.25rem !important;
+  }
+  .mr-md-1,
+  .mx-md-1 {
+    margin-right: 0.25rem !important;
+  }
+  .mb-md-1,
+  .my-md-1 {
+    margin-bottom: 0.25rem !important;
+  }
+  .ml-md-1,
+  .mx-md-1 {
+    margin-left: 0.25rem !important;
+  }
+  .m-md-2 {
+    margin: 0.5rem !important;
+  }
+  .mt-md-2,
+  .my-md-2 {
+    margin-top: 0.5rem !important;
+  }
+  .mr-md-2,
+  .mx-md-2 {
+    margin-right: 0.5rem !important;
+  }
+  .mb-md-2,
+  .my-md-2 {
+    margin-bottom: 0.5rem !important;
+  }
+  .ml-md-2,
+  .mx-md-2 {
+    margin-left: 0.5rem !important;
+  }
+  .m-md-3 {
+    margin: 1rem !important;
+  }
+  .mt-md-3,
+  .my-md-3 {
+    margin-top: 1rem !important;
+  }
+  .mr-md-3,
+  .mx-md-3 {
+    margin-right: 1rem !important;
+  }
+  .mb-md-3,
+  .my-md-3 {
+    margin-bottom: 1rem !important;
+  }
+  .ml-md-3,
+  .mx-md-3 {
+    margin-left: 1rem !important;
+  }
+  .m-md-4 {
+    margin: 1.5rem !important;
+  }
+  .mt-md-4,
+  .my-md-4 {
+    margin-top: 1.5rem !important;
+  }
+  .mr-md-4,
+  .mx-md-4 {
+    margin-right: 1.5rem !important;
+  }
+  .mb-md-4,
+  .my-md-4 {
+    margin-bottom: 1.5rem !important;
+  }
+  .ml-md-4,
+  .mx-md-4 {
+    margin-left: 1.5rem !important;
+  }
+  .m-md-5 {
+    margin: 3rem !important;
+  }
+  .mt-md-5,
+  .my-md-5 {
+    margin-top: 3rem !important;
+  }
+  .mr-md-5,
+  .mx-md-5 {
+    margin-right: 3rem !important;
+  }
+  .mb-md-5,
+  .my-md-5 {
+    margin-bottom: 3rem !important;
+  }
+  .ml-md-5,
+  .mx-md-5 {
+    margin-left: 3rem !important;
+  }
+  .p-md-0 {
+    padding: 0 !important;
+  }
+  .pt-md-0,
+  .py-md-0 {
+    padding-top: 0 !important;
+  }
+  .pr-md-0,
+  .px-md-0 {
+    padding-right: 0 !important;
+  }
+  .pb-md-0,
+  .py-md-0 {
+    padding-bottom: 0 !important;
+  }
+  .pl-md-0,
+  .px-md-0 {
+    padding-left: 0 !important;
+  }
+  .p-md-1 {
+    padding: 0.25rem !important;
+  }
+  .pt-md-1,
+  .py-md-1 {
+    padding-top: 0.25rem !important;
+  }
+  .pr-md-1,
+  .px-md-1 {
+    padding-right: 0.25rem !important;
+  }
+  .pb-md-1,
+  .py-md-1 {
+    padding-bottom: 0.25rem !important;
+  }
+  .pl-md-1,
+  .px-md-1 {
+    padding-left: 0.25rem !important;
+  }
+  .p-md-2 {
+    padding: 0.5rem !important;
+  }
+  .pt-md-2,
+  .py-md-2 {
+    padding-top: 0.5rem !important;
+  }
+  .pr-md-2,
+  .px-md-2 {
+    padding-right: 0.5rem !important;
+  }
+  .pb-md-2,
+  .py-md-2 {
+    padding-bottom: 0.5rem !important;
+  }
+  .pl-md-2,
+  .px-md-2 {
+    padding-left: 0.5rem !important;
+  }
+  .p-md-3 {
+    padding: 1rem !important;
+  }
+  .pt-md-3,
+  .py-md-3 {
+    padding-top: 1rem !important;
+  }
+  .pr-md-3,
+  .px-md-3 {
+    padding-right: 1rem !important;
+  }
+  .pb-md-3,
+  .py-md-3 {
+    padding-bottom: 1rem !important;
+  }
+  .pl-md-3,
+  .px-md-3 {
+    padding-left: 1rem !important;
+  }
+  .p-md-4 {
+    padding: 1.5rem !important;
+  }
+  .pt-md-4,
+  .py-md-4 {
+    padding-top: 1.5rem !important;
+  }
+  .pr-md-4,
+  .px-md-4 {
+    padding-right: 1.5rem !important;
+  }
+  .pb-md-4,
+  .py-md-4 {
+    padding-bottom: 1.5rem !important;
+  }
+  .pl-md-4,
+  .px-md-4 {
+    padding-left: 1.5rem !important;
+  }
+  .p-md-5 {
+    padding: 3rem !important;
+  }
+  .pt-md-5,
+  .py-md-5 {
+    padding-top: 3rem !important;
+  }
+  .pr-md-5,
+  .px-md-5 {
+    padding-right: 3rem !important;
+  }
+  .pb-md-5,
+  .py-md-5 {
+    padding-bottom: 3rem !important;
+  }
+  .pl-md-5,
+  .px-md-5 {
+    padding-left: 3rem !important;
+  }
+  .m-md-auto {
+    margin: auto !important;
+  }
+  .mt-md-auto,
+  .my-md-auto {
+    margin-top: auto !important;
+  }
+  .mr-md-auto,
+  .mx-md-auto {
+    margin-right: auto !important;
+  }
+  .mb-md-auto,
+  .my-md-auto {
+    margin-bottom: auto !important;
+  }
+  .ml-md-auto,
+  .mx-md-auto {
+    margin-left: auto !important;
+  }
+}
+
+@media (min-width: 992px) {
+  .m-lg-0 {
+    margin: 0 !important;
+  }
+  .mt-lg-0,
+  .my-lg-0 {
+    margin-top: 0 !important;
+  }
+  .mr-lg-0,
+  .mx-lg-0 {
+    margin-right: 0 !important;
+  }
+  .mb-lg-0,
+  .my-lg-0 {
+    margin-bottom: 0 !important;
+  }
+  .ml-lg-0,
+  .mx-lg-0 {
+    margin-left: 0 !important;
+  }
+  .m-lg-1 {
+    margin: 0.25rem !important;
+  }
+  .mt-lg-1,
+  .my-lg-1 {
+    margin-top: 0.25rem !important;
+  }
+  .mr-lg-1,
+  .mx-lg-1 {
+    margin-right: 0.25rem !important;
+  }
+  .mb-lg-1,
+  .my-lg-1 {
+    margin-bottom: 0.25rem !important;
+  }
+  .ml-lg-1,
+  .mx-lg-1 {
+    margin-left: 0.25rem !important;
+  }
+  .m-lg-2 {
+    margin: 0.5rem !important;
+  }
+  .mt-lg-2,
+  .my-lg-2 {
+    margin-top: 0.5rem !important;
+  }
+  .mr-lg-2,
+  .mx-lg-2 {
+    margin-right: 0.5rem !important;
+  }
+  .mb-lg-2,
+  .my-lg-2 {
+    margin-bottom: 0.5rem !important;
+  }
+  .ml-lg-2,
+  .mx-lg-2 {
+    margin-left: 0.5rem !important;
+  }
+  .m-lg-3 {
+    margin: 1rem !important;
+  }
+  .mt-lg-3,
+  .my-lg-3 {
+    margin-top: 1rem !important;
+  }
+  .mr-lg-3,
+  .mx-lg-3 {
+    margin-right: 1rem !important;
+  }
+  .mb-lg-3,
+  .my-lg-3 {
+    margin-bottom: 1rem !important;
+  }
+  .ml-lg-3,
+  .mx-lg-3 {
+    margin-left: 1rem !important;
+  }
+  .m-lg-4 {
+    margin: 1.5rem !important;
+  }
+  .mt-lg-4,
+  .my-lg-4 {
+    margin-top: 1.5rem !important;
+  }
+  .mr-lg-4,
+  .mx-lg-4 {
+    margin-right: 1.5rem !important;
+  }
+  .mb-lg-4,
+  .my-lg-4 {
+    margin-bottom: 1.5rem !important;
+  }
+  .ml-lg-4,
+  .mx-lg-4 {
+    margin-left: 1.5rem !important;
+  }
+  .m-lg-5 {
+    margin: 3rem !important;
+  }
+  .mt-lg-5,
+  .my-lg-5 {
+    margin-top: 3rem !important;
+  }
+  .mr-lg-5,
+  .mx-lg-5 {
+    margin-right: 3rem !important;
+  }
+  .mb-lg-5,
+  .my-lg-5 {
+    margin-bottom: 3rem !important;
+  }
+  .ml-lg-5,
+  .mx-lg-5 {
+    margin-left: 3rem !important;
+  }
+  .p-lg-0 {
+    padding: 0 !important;
+  }
+  .pt-lg-0,
+  .py-lg-0 {
+    padding-top: 0 !important;
+  }
+  .pr-lg-0,
+  .px-lg-0 {
+    padding-right: 0 !important;
+  }
+  .pb-lg-0,
+  .py-lg-0 {
+    padding-bottom: 0 !important;
+  }
+  .pl-lg-0,
+  .px-lg-0 {
+    padding-left: 0 !important;
+  }
+  .p-lg-1 {
+    padding: 0.25rem !important;
+  }
+  .pt-lg-1,
+  .py-lg-1 {
+    padding-top: 0.25rem !important;
+  }
+  .pr-lg-1,
+  .px-lg-1 {
+    padding-right: 0.25rem !important;
+  }
+  .pb-lg-1,
+  .py-lg-1 {
+    padding-bottom: 0.25rem !important;
+  }
+  .pl-lg-1,
+  .px-lg-1 {
+    padding-left: 0.25rem !important;
+  }
+  .p-lg-2 {
+    padding: 0.5rem !important;
+  }
+  .pt-lg-2,
+  .py-lg-2 {
+    padding-top: 0.5rem !important;
+  }
+  .pr-lg-2,
+  .px-lg-2 {
+    padding-right: 0.5rem !important;
+  }
+  .pb-lg-2,
+  .py-lg-2 {
+    padding-bottom: 0.5rem !important;
+  }
+  .pl-lg-2,
+  .px-lg-2 {
+    padding-left: 0.5rem !important;
+  }
+  .p-lg-3 {
+    padding: 1rem !important;
+  }
+  .pt-lg-3,
+  .py-lg-3 {
+    padding-top: 1rem !important;
+  }
+  .pr-lg-3,
+  .px-lg-3 {
+    padding-right: 1rem !important;
+  }
+  .pb-lg-3,
+  .py-lg-3 {
+    padding-bottom: 1rem !important;
+  }
+  .pl-lg-3,
+  .px-lg-3 {
+    padding-left: 1rem !important;
+  }
+  .p-lg-4 {
+    padding: 1.5rem !important;
+  }
+  .pt-lg-4,
+  .py-lg-4 {
+    padding-top: 1.5rem !important;
+  }
+  .pr-lg-4,
+  .px-lg-4 {
+    padding-right: 1.5rem !important;
+  }
+  .pb-lg-4,
+  .py-lg-4 {
+    padding-bottom: 1.5rem !important;
+  }
+  .pl-lg-4,
+  .px-lg-4 {
+    padding-left: 1.5rem !important;
+  }
+  .p-lg-5 {
+    padding: 3rem !important;
+  }
+  .pt-lg-5,
+  .py-lg-5 {
+    padding-top: 3rem !important;
+  }
+  .pr-lg-5,
+  .px-lg-5 {
+    padding-right: 3rem !important;
+  }
+  .pb-lg-5,
+  .py-lg-5 {
+    padding-bottom: 3rem !important;
+  }
+  .pl-lg-5,
+  .px-lg-5 {
+    padding-left: 3rem !important;
+  }
+  .m-lg-auto {
+    margin: auto !important;
+  }
+  .mt-lg-auto,
+  .my-lg-auto {
+    margin-top: auto !important;
+  }
+  .mr-lg-auto,
+  .mx-lg-auto {
+    margin-right: auto !important;
+  }
+  .mb-lg-auto,
+  .my-lg-auto {
+    margin-bottom: auto !important;
+  }
+  .ml-lg-auto,
+  .mx-lg-auto {
+    margin-left: auto !important;
+  }
+}
+
+@media (min-width: 1200px) {
+  .m-xl-0 {
+    margin: 0 !important;
+  }
+  .mt-xl-0,
+  .my-xl-0 {
+    margin-top: 0 !important;
+  }
+  .mr-xl-0,
+  .mx-xl-0 {
+    margin-right: 0 !important;
+  }
+  .mb-xl-0,
+  .my-xl-0 {
+    margin-bottom: 0 !important;
+  }
+  .ml-xl-0,
+  .mx-xl-0 {
+    margin-left: 0 !important;
+  }
+  .m-xl-1 {
+    margin: 0.25rem !important;
+  }
+  .mt-xl-1,
+  .my-xl-1 {
+    margin-top: 0.25rem !important;
+  }
+  .mr-xl-1,
+  .mx-xl-1 {
+    margin-right: 0.25rem !important;
+  }
+  .mb-xl-1,
+  .my-xl-1 {
+    margin-bottom: 0.25rem !important;
+  }
+  .ml-xl-1,
+  .mx-xl-1 {
+    margin-left: 0.25rem !important;
+  }
+  .m-xl-2 {
+    margin: 0.5rem !important;
+  }
+  .mt-xl-2,
+  .my-xl-2 {
+    margin-top: 0.5rem !important;
+  }
+  .mr-xl-2,
+  .mx-xl-2 {
+    margin-right: 0.5rem !important;
+  }
+  .mb-xl-2,
+  .my-xl-2 {
+    margin-bottom: 0.5rem !important;
+  }
+  .ml-xl-2,
+  .mx-xl-2 {
+    margin-left: 0.5rem !important;
+  }
+  .m-xl-3 {
+    margin: 1rem !important;
+  }
+  .mt-xl-3,
+  .my-xl-3 {
+    margin-top: 1rem !important;
+  }
+  .mr-xl-3,
+  .mx-xl-3 {
+    margin-right: 1rem !important;
+  }
+  .mb-xl-3,
+  .my-xl-3 {
+    margin-bottom: 1rem !important;
+  }
+  .ml-xl-3,
+  .mx-xl-3 {
+    margin-left: 1rem !important;
+  }
+  .m-xl-4 {
+    margin: 1.5rem !important;
+  }
+  .mt-xl-4,
+  .my-xl-4 {
+    margin-top: 1.5rem !important;
+  }
+  .mr-xl-4,
+  .mx-xl-4 {
+    margin-right: 1.5rem !important;
+  }
+  .mb-xl-4,
+  .my-xl-4 {
+    margin-bottom: 1.5rem !important;
+  }
+  .ml-xl-4,
+  .mx-xl-4 {
+    margin-left: 1.5rem !important;
+  }
+  .m-xl-5 {
+    margin: 3rem !important;
+  }
+  .mt-xl-5,
+  .my-xl-5 {
+    margin-top: 3rem !important;
+  }
+  .mr-xl-5,
+  .mx-xl-5 {
+    margin-right: 3rem !important;
+  }
+  .mb-xl-5,
+  .my-xl-5 {
+    margin-bottom: 3rem !important;
+  }
+  .ml-xl-5,
+  .mx-xl-5 {
+    margin-left: 3rem !important;
+  }
+  .p-xl-0 {
+    padding: 0 !important;
+  }
+  .pt-xl-0,
+  .py-xl-0 {
+    padding-top: 0 !important;
+  }
+  .pr-xl-0,
+  .px-xl-0 {
+    padding-right: 0 !important;
+  }
+  .pb-xl-0,
+  .py-xl-0 {
+    padding-bottom: 0 !important;
+  }
+  .pl-xl-0,
+  .px-xl-0 {
+    padding-left: 0 !important;
+  }
+  .p-xl-1 {
+    padding: 0.25rem !important;
+  }
+  .pt-xl-1,
+  .py-xl-1 {
+    padding-top: 0.25rem !important;
+  }
+  .pr-xl-1,
+  .px-xl-1 {
+    padding-right: 0.25rem !important;
+  }
+  .pb-xl-1,
+  .py-xl-1 {
+    padding-bottom: 0.25rem !important;
+  }
+  .pl-xl-1,
+  .px-xl-1 {
+    padding-left: 0.25rem !important;
+  }
+  .p-xl-2 {
+    padding: 0.5rem !important;
+  }
+  .pt-xl-2,
+  .py-xl-2 {
+    padding-top: 0.5rem !important;
+  }
+  .pr-xl-2,
+  .px-xl-2 {
+    padding-right: 0.5rem !important;
+  }
+  .pb-xl-2,
+  .py-xl-2 {
+    padding-bottom: 0.5rem !important;
+  }
+  .pl-xl-2,
+  .px-xl-2 {
+    padding-left: 0.5rem !important;
+  }
+  .p-xl-3 {
+    padding: 1rem !important;
+  }
+  .pt-xl-3,
+  .py-xl-3 {
+    padding-top: 1rem !important;
+  }
+  .pr-xl-3,
+  .px-xl-3 {
+    padding-right: 1rem !important;
+  }
+  .pb-xl-3,
+  .py-xl-3 {
+    padding-bottom: 1rem !important;
+  }
+  .pl-xl-3,
+  .px-xl-3 {
+    padding-left: 1rem !important;
+  }
+  .p-xl-4 {
+    padding: 1.5rem !important;
+  }
+  .pt-xl-4,
+  .py-xl-4 {
+    padding-top: 1.5rem !important;
+  }
+  .pr-xl-4,
+  .px-xl-4 {
+    padding-right: 1.5rem !important;
+  }
+  .pb-xl-4,
+  .py-xl-4 {
+    padding-bottom: 1.5rem !important;
+  }
+  .pl-xl-4,
+  .px-xl-4 {
+    padding-left: 1.5rem !important;
+  }
+  .p-xl-5 {
+    padding: 3rem !important;
+  }
+  .pt-xl-5,
+  .py-xl-5 {
+    padding-top: 3rem !important;
+  }
+  .pr-xl-5,
+  .px-xl-5 {
+    padding-right: 3rem !important;
+  }
+  .pb-xl-5,
+  .py-xl-5 {
+    padding-bottom: 3rem !important;
+  }
+  .pl-xl-5,
+  .px-xl-5 {
+    padding-left: 3rem !important;
+  }
+  .m-xl-auto {
+    margin: auto !important;
+  }
+  .mt-xl-auto,
+  .my-xl-auto {
+    margin-top: auto !important;
+  }
+  .mr-xl-auto,
+  .mx-xl-auto {
+    margin-right: auto !important;
+  }
+  .mb-xl-auto,
+  .my-xl-auto {
+    margin-bottom: auto !important;
+  }
+  .ml-xl-auto,
+  .mx-xl-auto {
+    margin-left: auto !important;
+  }
+}
+
+.text-monospace {
+  font-family: SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
+}
+
+.text-justify {
+  text-align: justify !important;
+}
+
+.text-nowrap {
+  white-space: nowrap !important;
+}
+
+.text-truncate {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.text-left {
+  text-align: left !important;
+}
+
+.text-right {
+  text-align: right !important;
+}
+
+.text-center {
+  text-align: center !important;
+}
+
+@media (min-width: 576px) {
+  .text-sm-left {
+    text-align: left !important;
+  }
+  .text-sm-right {
+    text-align: right !important;
+  }
+  .text-sm-center {
+    text-align: center !important;
+  }
+}
+
+@media (min-width: 768px) {
+  .text-md-left {
+    text-align: left !important;
+  }
+  .text-md-right {
+    text-align: right !important;
+  }
+  .text-md-center {
+    text-align: center !important;
+  }
+}
+
+@media (min-width: 992px) {
+  .text-lg-left {
+    text-align: left !important;
+  }
+  .text-lg-right {
+    text-align: right !important;
+  }
+  .text-lg-center {
+    text-align: center !important;
+  }
+}
+
+@media (min-width: 1200px) {
+  .text-xl-left {
+    text-align: left !important;
+  }
+  .text-xl-right {
+    text-align: right !important;
+  }
+  .text-xl-center {
+    text-align: center !important;
+  }
+}
+
+.text-lowercase {
+  text-transform: lowercase !important;
+}
+
+.text-uppercase {
+  text-transform: uppercase !important;
+}
+
+.text-capitalize {
+  text-transform: capitalize !important;
+}
+
+.font-weight-light {
+  font-weight: 300 !important;
+}
+
+.font-weight-normal {
+  font-weight: 400 !important;
+}
+
+.font-weight-bold {
+  font-weight: 700 !important;
+}
+
+.font-italic {
+  font-style: italic !important;
+}
+
+.text-white {
+  color: #fff !important;
+}
+
+.text-primary {
+  color: #007bff !important;
+}
+
+a.text-primary:hover, a.text-primary:focus {
+  color: #0062cc !important;
+}
+
+.text-secondary {
+  color: #6c757d !important;
+}
+
+a.text-secondary:hover, a.text-secondary:focus {
+  color: #545b62 !important;
+}
+
+.text-success {
+  color: #28a745 !important;
+}
+
+a.text-success:hover, a.text-success:focus {
+  color: #1e7e34 !important;
+}
+
+.text-info {
+  color: #17a2b8 !important;
+}
+
+a.text-info:hover, a.text-info:focus {
+  color: #117a8b !important;
+}
+
+.text-warning {
+  color: #ffc107 !important;
+}
+
+a.text-warning:hover, a.text-warning:focus {
+  color: #d39e00 !important;
+}
+
+.text-danger {
+  color: #dc3545 !important;
+}
+
+a.text-danger:hover, a.text-danger:focus {
+  color: #bd2130 !important;
+}
+
+.text-light {
+  color: #f8f9fa !important;
+}
+
+a.text-light:hover, a.text-light:focus {
+  color: #dae0e5 !important;
+}
+
+.text-dark {
+  color: #343a40 !important;
+}
+
+a.text-dark:hover, a.text-dark:focus {
+  color: #1d2124 !important;
+}
+
+.text-body {
+  color: #212529 !important;
+}
+
+.text-muted {
+  color: #6c757d !important;
+}
+
+.text-black-50 {
+  color: rgba(0, 0, 0, 0.5) !important;
+}
+
+.text-white-50 {
+  color: rgba(255, 255, 255, 0.5) !important;
+}
+
+.text-hide {
+  font: 0/0 a;
+  color: transparent;
+  text-shadow: none;
+  background-color: transparent;
+  border: 0;
+}
+
+.visible {
+  visibility: visible !important;
+}
+
+.invisible {
+  visibility: hidden !important;
+}
+
+@media print {
+  *,
+  *::before,
+  *::after {
+    text-shadow: none !important;
+    box-shadow: none !important;
+  }
+  a:not(.btn) {
+    text-decoration: underline;
+  }
+  abbr[title]::after {
+    content: " (" attr(title) ")";
+  }
+  pre {
+    white-space: pre-wrap !important;
+  }
+  pre,
+  blockquote {
+    border: 1px solid #adb5bd;
+    page-break-inside: avoid;
+  }
+  thead {
+    display: table-header-group;
+  }
+  tr,
+  img {
+    page-break-inside: avoid;
+  }
+  p,
+  h2,
+  h3 {
+    orphans: 3;
+    widows: 3;
+  }
+  h2,
+  h3 {
+    page-break-after: avoid;
+  }
+  @page {
+    size: a3;
+  }
+  body {
+    min-width: 992px !important;
+  }
+  .container {
+    min-width: 992px !important;
+  }
+  .navbar {
+    display: none;
+  }
+  .badge {
+    border: 1px solid #000;
+  }
+  .table {
+    border-collapse: collapse !important;
+  }
+  .table td,
+  .table th {
+    background-color: #fff !important;
+  }
+  .table-bordered th,
+  .table-bordered td {
+    border: 1px solid #dee2e6 !important;
+  }
+  .table-dark {
+    color: inherit;
+  }
+  .table-dark th,
+  .table-dark td,
+  .table-dark thead th,
+  .table-dark tbody + tbody {
+    border-color: #dee2e6;
+  }
+  .table .thead-dark th {
+    color: inherit;
+    border-color: #dee2e6;
+  }
+}
+/*# sourceMappingURL=bootstrap.css.map */
\ No newline at end of file
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/cloud.js b/ee/bulk-operations-dashboard/assets/dependencies/cloud.js
new file mode 100644
index 000000000000..2f0e10c4c6e5
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/cloud.js
@@ -0,0 +1,1987 @@
+/**
+ * cloud.js
+ * (high-level AJAX library)
+ *
+ * > This is now part of `parasails`.  It was branched from the old "Cloud SDK"
+ * > library at its v1.0.1 -- but from that point on, its versioning has been
+ * > tied to the version of parasails it's bundled in.  (All future development
+ * > of Cloud SDK will be as part of parasails.)
+ *
+ * Copyright (c) 2014-present, Mike McNeil
+ * MIT License
+ *
+ * - https://twitter.com/mikermcneil
+ * - https://sailsjs.com/about
+ * - https://sailsjs.com/support
+ * - https://www.npmjs.com/package/parasails
+ *
+ * ---------------------------------------------------------------------------------------------
+ * ## Basic Usage
+ *
+ * Step 1:
+ *
+ * ```
+ * Cloud.setup({  doSomething: 'POST /api/v1/somethings/:id/do'  });
+ * ```
+ * ^^Note that this can also be compiled automatically from your Sails app's routes using a script.
+ *
+ * Step 2:
+ *
+ * ```
+ * var result = await Cloud.doSomething(8);
+ * ```
+ *
+ * Or:
+ * ```
+ * var result = await Cloud.doSomething.with({id: 8, foo: ['bar', 'baz']});
+ * ```
+ * ---------------------------------------------------------------------------------------------
+ */
+(function(factory, exposeUMD){
+  exposeUMD(this, factory);
+})(function (_, io, $, SAILS_LOCALS, location, File, FileList, FormData){
+
+  //  ██████╗ ██████╗ ██╗██╗   ██╗ █████╗ ████████╗███████╗
+  //  ██╔══██╗██╔══██╗██║██║   ██║██╔══██╗╚══██╔══╝██╔════╝
+  //  ██████╔╝██████╔╝██║██║   ██║███████║   ██║   █████╗
+  //  ██╔═══╝ ██╔══██╗██║╚██╗ ██╔╝██╔══██║   ██║   ██╔══╝
+  //  ██║     ██║  ██║██║ ╚████╔╝ ██║  ██║   ██║   ███████╗
+  //  ╚═╝     ╚═╝  ╚═╝╚═╝  ╚═══╝  ╚═╝  ╚═╝   ╚═╝   ╚══════╝
+  //
+  //  ██╗   ██╗████████╗██╗██╗     ███████╗
+  //  ██║   ██║╚══██╔══╝██║██║     ██╔════╝
+  //  ██║   ██║   ██║   ██║██║     ███████╗
+  //  ██║   ██║   ██║   ██║██║     ╚════██║
+  //  ╚██████╔╝   ██║   ██║███████╗███████║
+  //   ╚═════╝    ╚═╝   ╚═╝╚══════╝╚══════╝
+  // Module utilities (private)
+
+
+  /**
+   * @param  {Ref} that
+   *
+   * @throws {Error} If that is not a File instance, a FileList instance, an
+   *                 array of File instances, a special File wrapper, or an
+   *                 array of special File wrappers.  (Note that, if an array is
+   *                 provided, this function will only return true if the array
+   *                 consists of ≥1 item.)
+   */
+  function _representsOneOrMoreFiles(that) {
+    // FUTURE: add support for Blobs
+    return (
+      _.isObject(that) &&
+      (
+        (File? that instanceof File : false)||
+        (FileList? that instanceof FileList : false)||
+        (_.isArray(that) && that.length > 0 && _.all(that, function(item) { return File? _.isObject(item) && item instanceof File : false; }))||
+        (File? _.isObject(that) && _.isObject(that.file) && that.file instanceof File : false)||
+        (_.isArray(that) && that.length > 0 && _.all(that, function(item) { return File? _.isObject(item) && _.isObject(item.file) && item.file instanceof File : false; }))
+      )
+    );
+  }//ƒ
+
+
+  /**
+   * @param  {String} negotiationRule
+   *
+   * @throws {Error} If rule is invalid or absent
+   */
+  function _verifyErrorNegotiationRule(negotiationRule) {
+
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    // FUTURE: add support for parley/flaverr/bluebird/lodash-style dictionary negotiation rules
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+    if (_.isNumber(negotiationRule) && Math.floor(negotiationRule) === negotiationRule) {
+      if (negotiationRule > 599 || negotiationRule < 0) {
+        throw new Error('Invalid error negotiation rule: `'+negotiationRule+'`.  If a status code is provided, it must be between zero and 599.');
+      }
+    }
+    else if (_.isString(negotiationRule) && negotiationRule) {
+      // Ok, we'll assume it's fine
+    }
+    else {
+      var suffix = '';
+      if (negotiationRule === undefined || _.isFunction(negotiationRule)) {
+        suffix = '  Looking to tolerate or intercept **EVERY** error?  This usually isn\'t a good idea, because, just like some try/catch usage patterns, it could mean swallowing errors unexpectedly, which can make debugging a nightmare.';
+      }
+      throw new Error('Invalid error negotiation rule: `'+negotiationRule+'`.  Please pass in a valid intercept rule string.  An intercept rule is either (A) the name of an exit or (B) a whole number representing the status code like `404` or `200`.'+suffix);
+    }
+
+  }
+
+
+
+
+
+  //  ███████╗██╗  ██╗██████╗  ██████╗ ██████╗ ████████╗███████╗
+  //  ██╔════╝╚██╗██╔╝██╔══██╗██╔═══██╗██╔══██╗╚══██╔══╝██╔════╝
+  //  █████╗   ╚███╔╝ ██████╔╝██║   ██║██████╔╝   ██║   ███████╗
+  //  ██╔══╝   ██╔██╗ ██╔═══╝ ██║   ██║██╔══██╗   ██║   ╚════██║
+  //  ███████╗██╔╝ ██╗██║     ╚██████╔╝██║  ██║   ██║   ███████║
+  //  ╚══════╝╚═╝  ╚═╝╚═╝      ╚═════╝ ╚═╝  ╚═╝   ╚═╝   ╚══════╝
+  // Module exports:
+
+  /**
+   * Cloud (SDK)
+   *
+   * After setup, this dictionary will have a method for each declared endpoint.
+   * Each key will be a function which sends an HTTP or socket request to a
+   * particular endpoint.
+   *
+   * ### Setup
+   *
+   * ```
+   * Cloud.setup({
+   *   apiBaseUrl: 'https://example.com',
+   *   usageOpts: {
+   *     arginStyle: 'serial'
+   *   },
+   *   methods: {
+   *     doSomething: 'PUT /api/v1/projects/:id',
+   *     // ...
+   *   }
+   * });
+   * ```
+   *
+   * > Note that you should avoid having an endpoint method named "setup", for obvious reasons.
+   * > (Technically, it should work anyway though.  But yeah, no reason to tempt the fates.)
+   *
+   * ### Basic Usage
+   *
+   * ```
+   * var user = await Cloud.findOneUser(3);
+   * ```
+   *
+   * ```
+   * var user = await Cloud.findOneUser.with({ id: 3 });
+   * ```
+   *
+   * ```
+   * Cloud.doSomething.with({
+   *   someParam: ['things', 3235, null, true, false, {}, []]
+   *   someOtherParam: 2523,
+   *   etc: 'more things'
+   * }).exec(function (err, responseBody, responseObjLikeJqXHR) {
+   *   if (err) {
+   *     // ...
+   *     return;
+   *   }
+   *
+   *   // ...
+   * });
+   * ```
+   *
+   * ### Negotiating Errors
+   * ```
+   * Cloud.signup.with({...})
+   * .switch({
+   *   error: function (err) { ... },
+   *   usernameAlreadyInUse: function (recommendedAlternativeUsernames) { ... },
+   *   emailAddressAlreadyInUse: function () { ... },
+   *   success: function () { ... }
+   * });
+   * ```
+   *
+   * ### Using WebSockets
+   * ```
+   * Cloud.doSomething.with({...})
+   * .protocol('jQuery')
+   * .exec(...);
+   * ```
+   *
+   * ```
+   * Cloud.doSomething.with({...})
+   * .protocol('io.socket')
+   * .exec(...);
+   * ```
+   *
+   * ##### Providing a particular jQuery or SailsSocket instance
+   *
+   * ```
+   * Cloud.doSomething.with({...})
+   * .protocol(io.socket)
+   * .exec(...);
+   * ```
+   *
+   * ```
+   * Cloud.doSomething.with({...})
+   * .protocol($)
+   * .exec(...);
+   * ```
+   *
+   * ### Using Custom Headers
+   * ```
+   * Cloud.doSomething.with({...})
+   * .headers({
+   *   'X-Auth': 'whatever'
+   * })
+   * .exec(...);
+   * ```
+   *
+   * ### CSRF Protection
+   *
+   * It `SAILS_LOCALS._csrf` is defined, then it will be sent
+   * as the "x-csrf-token" header for all Cloud.* requests, automatically.
+   *
+   */
+
+  var Cloud = {};
+
+
+  // FUTURE:  Cloud.getUrlFor()
+  // (similar to https://sailsjs.com/documentation/reference/application/sails-get-url-for)
+  // (but would def need to provide a way of providing values for URL pattern variables like `:id`)
+
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // FUTURE: finish this when time allows   (might be better to have it work by attaching dedicated
+  // nav methods rather than a generic nav method though)
+  // ```
+  // // A mapping of names of view actions to URL
+  // // > provided to `.setup()`, for use in .navigate()
+  // var _navigableUrlsByViewActionName;
+  //
+  //
+  // /**
+  //  * Cloud.navigate()
+  //  *
+  //  * Call this function to navigate to a different web page.
+  //  * (Be sure and call it *before* trying to use any of the endpoint methods!)
+  //  *
+  //  * @param  {String} destination
+  //  *         A URL or the name of a view action.
+  //  */
+  // Cloud.navigate = function(destination) {
+
+  //   var doesBeginWithSlash = _.isString(destination) && destination.match(/^\//);
+  //   var doesBeginWithHttp = _.isString(destination) && destination.match(/^http/);
+  //   var isProbablyTheNameOfAViewAction = _.isString(destination) && destination.match(/^view/);
+  //   if (!_.isString(destination) || !(doesBeginWithSlash || doesBeginWithHttp || isProbablyTheNameOfAViewAction)) {
+  //     throw new Error('Bad usage: Cloud.navigate() should be called with a URL or the name of a view action.');
+  //   }
+
+  //   if (!_navigableUrlsByViewActionName) {
+  //     throw new Error('Cannot navigate to a view action because Cloud.setup() has not been called yet-- please do that first (or if that\'s not possible, just navigate directly to the URL)');
+  //   }
+
+  // };
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+
+  /**
+   * Cloud.setup()
+   *
+   * Call this function once, when the page loads.
+   * (Be sure and call it *before* trying to use any of the endpoint methods!)
+   *
+   * @param  {Dictionary} options
+   *         @required {Dictionary} methods
+   *         @optional {Dictionary} links
+   *         @optional {Dictionary} apiBaseUrl
+   */
+  Cloud.setup = function(options) {
+
+    options = options || {};
+
+    if (!_.isObject(options.methods) || _.isArray(options.methods) || _.isFunction(options.methods)) {
+      throw new Error('Cannot .setup() Cloud SDK: `methods` must be provided as a dictionary of addresses and definitions.');
+    }//•
+
+    // Determine the proper API base URL
+    if (!options.apiBaseUrl) {
+      if (location) {
+        options.apiBaseUrl = location.protocol+'//'+location.hostname+(location.port ? ':'+location.port: '');
+      }
+      else {
+        throw new Error('Cannot .setup() Cloud SDK: Since a location cannot be determined, `apiBaseUrl` must be provided as a string (e.g. "https://example.com").');
+      }
+    }//fi
+
+    // Apply the base URL for the benefit of WebSockets (if relevant):
+    if (io) {
+      io.sails.url = options.apiBaseUrl;
+    }//fi
+
+    // The name of the default protocol.
+    var DEFAULT_PROTOCOL_NAME = 'jQuery';
+
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    // FUTURE: finish this when time allows   (would be better to have it work by attaching dedicated
+    // nav methods rather than a generic nav method though)
+    // ```
+    // // Save a reference to the mapping of navigable URLs by view action name (if provided).
+    // _navigableUrlsByViewActionName = options.links || {};
+    // ```
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+    if (options.methods.on) {
+      throw new Error('Cannot .setup() Cloud SDK: `.on()` is reserved.  It cannot be used as the name for a method.');
+    }
+    if (options.methods.off) {
+      throw new Error('Cannot .setup() Cloud SDK: `.off()` is reserved.  It cannot be used as the name for a method.');
+    }
+
+    // Interpret methods
+    var methods = _.reduce(options.methods, function(memo, appLevelSdkEndpointDef, methodName) {
+
+      if (methodName === 'setup') {
+        console.warn('"setup" is a confusing name for a cloud action (it conflicts with a built-in feature of this SDK itself).  Would "initialize()" work instead?  (Continuing this time...)');
+      }
+
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+      // FUTURE: finish this when time allows   (would be better to have it work by attaching dedicated
+      // nav methods rather than a generic nav method though)
+      // ```
+      // if (methodName === 'navigate') {
+      //   console.warn('"navigate" is a confusing name for a cloud action (it conflicts with a built-in feature of this SDK itself).  Would "travel()" work instead?  (Continuing this time...)');
+      // }
+      // ```
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+      // Validate the endpoint definition.
+      ////////////////////////////////////////////////////////////////////////////////////////////////
+      var _verbToCheck;
+      var _urlToCheck;
+      if (typeof appLevelSdkEndpointDef === 'function') {
+        // We can't really check functions, so we just let it through.
+      }
+      else {
+        if (appLevelSdkEndpointDef && typeof appLevelSdkEndpointDef === 'object') {
+          // Must have `verb` and `url` properties.
+          _verbToCheck = appLevelSdkEndpointDef.verb;
+          _urlToCheck = appLevelSdkEndpointDef.url;
+        }
+        else if (typeof appLevelSdkEndpointDef === 'string') {
+          // Must be able to parse `verb` and `url`.
+          _verbToCheck = appLevelSdkEndpointDef.replace(/^\s*([^\/\s]+)\s*\/.*$/, '$1');
+          _urlToCheck = appLevelSdkEndpointDef.replace(/^\s*[^\/\s]+\s*\/(.*)$/, '/$1');
+        }
+        else {
+          throw new Error('CloudSDK endpoint (`'+methodName+'`) is invalid:  Endpoints should be defined as either (1) a string like "GET /foo", (2) a dictionary containing a `verb` and a `url`, or (3) a function that returns a dictionary like that.');
+        }
+
+        // --•
+
+        // `verb` must be valid.
+        if (typeof _verbToCheck !== 'string' || _verbToCheck === '') {
+          throw new Error('CloudSDK endpoint (`'+methodName+'`) is invalid:  An endpoint\'s `verb` should be defined as a non-empty string.');
+        }
+
+        // `url` must be valid.
+        if (typeof _urlToCheck !== 'string' || _urlToCheck === '') {
+          throw new Error('CloudSDK endpoint (`'+methodName+'`) is invalid:  An endpoint\'s `url` should be defined as a non-empty string.');
+        }
+      }
+
+
+      // Build the actual method that will be called at runtime:
+      ////////////////////////////////////////////////////////////////////////
+      var _helpCallCloudMethod = function (argins) {
+
+        //+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++//
+        // There are 3 ways to define an SDK wrapper for a cloud endpoint.
+        //+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++//
+        var requestInfo = {
+          // • the HTTP verb (aka HTTP "method" -- we're just using "verb" for clarity)
+          verb: undefined,
+          // • the path part of the URL
+          url: undefined,
+          // • a dictionary of request data
+          //   (depending on the circumstances, these params will be encoded directly
+          //   into either the url path, the querystring, or the request body)
+          params: undefined,
+          // • a dictionary of custom request headers
+          headers: undefined,
+          // • the protocol name (e.g. "jQuery" or "io.socket")
+          protocolName: undefined,
+          // • the protocol instance (e.g. actual reference to `$` or `io.socket`)
+          protocolInstance: undefined,
+          // • an array of conditional lifecycle instructions from userland .intercept() / .tolerate() calls, if any are configured
+          lifecycleInstructions: [],
+        };
+
+
+
+        //  ██████╗ ██╗   ██╗██╗██╗     ██████╗     ██████╗ ███████╗███████╗███████╗██████╗ ██████╗ ███████╗██████╗
+        //  ██╔══██╗██║   ██║██║██║     ██╔══██╗    ██╔══██╗██╔════╝██╔════╝██╔════╝██╔══██╗██╔══██╗██╔════╝██╔══██╗
+        //  ██████╔╝██║   ██║██║██║     ██║  ██║    ██║  ██║█████╗  █████╗  █████╗  ██████╔╝██████╔╝█████╗  ██║  ██║
+        //  ██╔══██╗██║   ██║██║██║     ██║  ██║    ██║  ██║██╔══╝  ██╔══╝  ██╔══╝  ██╔══██╗██╔══██╗██╔══╝  ██║  ██║
+        //  ██████╔╝╚██████╔╝██║███████╗██████╔╝    ██████╔╝███████╗██║     ███████╗██║  ██║██║  ██║███████╗██████╔╝
+        //  ╚═════╝  ╚═════╝ ╚═╝╚══════╝╚═════╝     ╚═════╝ ╚══════╝╚═╝     ╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝╚═════╝
+        //
+        //   ██████╗ ██████╗      ██╗███████╗ ██████╗████████╗
+        //  ██╔═══██╗██╔══██╗     ██║██╔════╝██╔════╝╚══██╔══╝
+        //  ██║   ██║██████╔╝     ██║█████╗  ██║        ██║
+        //  ██║   ██║██╔══██╗██   ██║██╔══╝  ██║        ██║
+        //  ╚██████╔╝██████╔╝╚█████╔╝███████╗╚██████╗   ██║
+        //   ╚═════╝ ╚═════╝  ╚════╝ ╚══════╝ ╚═════╝   ╚═╝
+        //
+
+        // Used for avoiding accidentally creating multiple promises when
+        // using .then() or .catch().
+        var _promise;
+
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // FUTURE: add support for omens so we get better stack traces, particularly
+        // when running this in a Node.js environment.
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+        // Return a dictionary of functions (to allow for "deferred object" usage.)
+        var deferred = {
+
+          // Allow request headers to be configured.
+          /////////////////////////////////////////////////////////////////////////////
+          headers: function (_customRequestHeaders){
+            if (!_.isObject(_customRequestHeaders)) {
+              throw new Error('Invalid request headers: Must be specified as a dictionary, where each key has a string value.');
+            }
+            requestInfo.headers = _.extend(requestInfo.headers||{}, _customRequestHeaders);
+
+            return deferred;
+          },
+
+          // Allow the protocol to be configured on a per-request basis.
+          /////////////////////////////////////////////////////////////////////////////
+          protocol: function (_protocolNameOrInstance){
+            if (typeof _protocolNameOrInstance === 'string') {
+              switch (_protocolNameOrInstance) {
+                case 'jQuery':
+                  requestInfo.protocolName = 'jQuery';
+                  if ($ === undefined) {
+                    throw new Error('Could not access jQuery: `$` is undefined.');
+                  }
+                  else {
+                    requestInfo.protocolInstance = $;
+                  }
+                  break;
+
+                case 'io.socket':
+                  requestInfo.protocolName = 'io.socket';
+                  if (typeof io === 'undefined') {
+                    throw new Error('Could not access `io.socket`: `io` is undefined.');
+                  }
+                  else if (typeof io !== 'function') {
+                    throw new Error('Could not access `io.socket`: `io` is invalid:' + io);
+                  }
+                  else if (typeof io.socket === 'undefined') {
+                    throw new Error('Could not access `io.socket`: `io` does not have a `socket` property.  Make sure `sails.io.js` is being injected in a <script> tag!');
+                  }
+                  else {
+                    requestInfo.protocolInstance = io.socket;
+                  }
+                  break;
+
+                default:
+                  throw new Error('Unrecognized protocol: `'+_protocolNameOrInstance+'`. Use "jQuery" or "io.socket".');
+              }
+            }
+            else if (_.isObject(_protocolNameOrInstance) || _.isFunction(_protocolNameOrInstance)) {
+              if (_protocolNameOrInstance.name === 'jQuery') {
+                requestInfo.protocolName = 'jQuery';
+                requestInfo.protocolInstance = _protocolNameOrInstance;
+              }
+              else if (_protocolNameOrInstance.constructor.name === 'SailsSocket') {
+                requestInfo.protocolName = 'io.socket';
+                requestInfo.protocolInstance = _protocolNameOrInstance;
+              }
+              else if (_protocolNameOrInstance.toString() === '[Package: machinepack-http]' || _protocolNameOrInstance.toString() === '[Package: sails.helpers.http]') {
+                requestInfo.protocolName = 'machinepack-http';
+                requestInfo.protocolInstance = _protocolNameOrInstance;
+              }
+              // FUTURE: maybe native browser "fetch"?
+              // FUTURE: maybe native Node "http"?
+              else {
+                throw new Error('Unrecognized instance provided to `.protocol()`: `'+_protocolNameOrInstance+'`');
+              }
+            }
+            else {
+              throw new Error('Unrecognized protocol: `'+_protocolNameOrInstance+'`. Use "jQuery" or "io.socket".');
+            }
+
+            return deferred;
+
+          },//</ implementation of `.protocol()`>
+
+
+          // Allow intercepting the response before resolution/rejection occurs.
+          // (This is basically an "after receiving response" lifecycle callback.)
+          /////////////////////////////////////////////////////////////////////////////
+          intercept: function (negotiationRule, handler) {
+
+            _verifyErrorNegotiationRule(negotiationRule);
+
+            if (!_.isFunction(handler)) {
+              throw new Error('Invalid 2nd argument to `.intercept()`.  Expecting a handler function.');
+            }
+
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            // FUTURE: Add a best-effort check to make sure there is no pre-existing rule
+            // that matches this one (i.e. already previously registered using .tolerate()
+            // or .intercept())
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            requestInfo.lifecycleInstructions.push({
+              type: 'intercept',
+              rule: negotiationRule,
+              handler: handler
+            });
+
+            return deferred;
+
+          },
+
+          // Allow explicitly tolerating certain kinds of responses before resolution/rejection occurs.
+          // (This causes control flow convergence by using `.intercept()` + throwing a special value)
+          /////////////////////////////////////////////////////////////////////////////
+          tolerate: function (_negotiationRuleMaybe, _handlerMaybe) {
+
+            var handler;
+            var negotiationRule;
+            if (_handlerMaybe === undefined && _.isFunction(_negotiationRuleMaybe)) {
+              handler = _negotiationRuleMaybe;
+            }
+            else {
+              negotiationRule = _negotiationRuleMaybe;
+              handler = _handlerMaybe;
+            }
+
+            if (negotiationRule !== undefined) {
+              _verifyErrorNegotiationRule(negotiationRule);
+            }
+
+            if (handler !== undefined && !_.isFunction(handler)) {
+              throw new Error('Invalid 2nd argument. to `.tolerate()`.  Expecting a handler function.');
+            }
+
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            // FUTURE: Add a best-effort check to make sure there is no pre-existing rule
+            // that matches this one (i.e. already previously registered using .tolerate()
+            // or .intercept())
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            requestInfo.lifecycleInstructions.push({
+              type: 'tolerate',
+              rule: negotiationRule,
+              handler: handler?
+                handler
+                :
+                function(){ return; }
+            });
+
+            return deferred;
+
+          },
+
+          // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+          // Looking for the EarlyReturnSignal stuff?
+          //
+          // See https://stackoverflow.com/a/43402123/486547 and specifically also
+          // https://stackoverflow.com/questions/29499582/how-to-properly-break-out-of-a-promise-chain#comment80446341_43402123
+          // (there may be a way to do this more elegantly without requiring the calling
+          // code environment to be aware of our special Errors-- but it's not worth it
+          // as-is.  Too much black magic!)
+          //
+          // > More notes & background leading up to this:
+          // > https://gist.github.com/mikermcneil/c1bc2d57f5bedae810295e5ed8c5f935
+          // >
+          // > (Also check out the commit history of the original `caviar` repo.)
+          // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+          then: function (){
+            // console.log('in implementation of `then()`...');
+            var promise = deferred.toPromise();
+            // console.log('obj:',promise);
+            return promise.then.apply(promise, arguments);
+          },
+
+          // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+          // FUTURE: use parley for all this instead, if we can find a way to keep it
+          // from being too enormous when browserified
+          // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+          toPromise: function (){
+            if (typeof Promise === 'undefined') { throw new Error('Cannot use this approach: `Promise` constructor not available in current environment.'); }
+
+            if (_promise) {
+              // console.log('using catched promise...');
+              return _promise;
+            }
+            // console.log('instantiating new promise!');
+
+            _promise = new Promise(function(resolve, reject){// eslint-disable-line no-undef
+              try {
+                deferred.exec(function(err, resultMaybe) {
+                  if (err){
+                    // console.log('calling reject..');
+                    return reject(err);
+                  }
+                  // console.log('calling resolve..');
+                  return resolve(resultMaybe);
+                });//_∏_
+              } catch (err) {
+                // console.log('EXEC THREW ERROR!',err);
+                // console.log('CALLED REJECT IN NATIVE CATCH BLOCK!');
+                reject(err);
+              }
+            });//_∏_
+
+            return _promise;
+          },
+
+
+          // Allow the AJAX request to actually be sent.
+          /////////////////////////////////////////////////////////////////////////////
+          exec: function (exitCallbacks){
+
+            if (exitCallbacks) {
+              if (!_.isObject(exitCallbacks) && !_.isFunction(exitCallbacks)) {
+                throw new Error('If specified, the argument passed to `.exec()` must be a dictionary containing a `success` and `error` callback.  Alternatively, you can use a Node.js-style callback.');
+              }
+              else if (_.isObject(exitCallbacks) && exitCallbacks.success && !_.isFunction(exitCallbacks.success)) {
+                throw new Error('If specified, `success` callback must be a function.');
+              }
+              else if (_.isObject(exitCallbacks) && exitCallbacks.error && !_.isFunction(exitCallbacks.error)) {
+                throw new Error('If specified, `error` callback must be a function.');
+              }
+            }
+
+            // Just in case, build an error instance beforehand.
+            // (This ensures it has a good stack trace.)
+            var errorInstance = new Error('Endpoint (`'+methodName+'`) responded with an error (or the request failed).');
+
+            // Give the error a special `name` property to ease negotiation
+            // (vs. other unrelated things like typos in argins)
+            errorInstance.name = 'CloudError';
+
+            // If present, use CSRF token from `SAILS_LOCALS` as the `x-csrf-token`
+            // request header for all non-GET requests.
+            // (Unless of course there's another x-csrf-token header already specified.)
+            if (_.isObject(SAILS_LOCALS) && typeof SAILS_LOCALS._csrf !== 'undefined') {
+              if (_.isUndefined(requestInfo.headers)) {
+                requestInfo.headers = {};
+              }// >-
+              if (!requestInfo.headers['x-csrf-token']) {
+                requestInfo.headers['x-csrf-token'] = SAILS_LOCALS._csrf;
+              }
+            }//fi
+
+            // Finally, use the appropriate protocol to actually send the request and
+            // send back the response to the code that called this `Cloud.*()` method.
+            (function _makeAjaxCallWithAppropriateProtocol(proceed){
+
+              // First, tease apart text params and file params.
+              var textParamsByFieldName = requestInfo.params;
+
+              // Check for file uploads.
+              //
+              // If `FormData` constructor is available, check to see if any
+              // of the param values are File/FileList instances, or arrays of
+              // File instances, or special File wrappers, or arrays of special
+              // File wrappers. If they are, then remove them from a shallow
+              // clone of the params dictionary, and set them up separately.
+              // (The files will be attached to the request _after_ the text
+              // parameters.)
+              var uploadsByFieldName = {};
+              if (FormData && textParamsByFieldName) {
+                textParamsByFieldName = _.extend({}, textParamsByFieldName);
+                _.each(textParamsByFieldName, function(value, fieldName){
+                  if (_representsOneOrMoreFiles(value)) {
+                    uploadsByFieldName[fieldName] = value;
+                    delete textParamsByFieldName[fieldName];
+                  }
+                });//∞
+              }//fi
+
+              // Don't allow file uploads for GET requests,
+              // or if the FormData constructor is somehow missing.
+              if (_.keys(uploadsByFieldName).length > 0) {
+                if (requestInfo.verb.match(/get/i)) {
+                  throw new Error(
+                    'Detected File or FileList instance(s) provided for parameter(s):  '+
+                    _.keys(uploadsByFieldName)+'\n'+
+                    'But this is a nullipotent ('+requestInfo.verb.toUpperCase()+') '+
+                    'request, which does not support file uploads.'
+                  );
+                }//•
+                if (!FormData) {
+                  throw new Error(
+                    'Detected File or FileList instance(s) provided for parameter(s):  '+
+                    _.keys(uploadsByFieldName)+'\n'+
+                    'But the native FormData constructor does not exist!'
+                  );
+                }
+              }//fi
+
+              switch (requestInfo.protocolName) {
+
+                //  ▄▄███▄▄·    █████╗      ██╗ █████╗ ██╗  ██╗ ██╗██╗
+                //  ██╔════╝   ██╔══██╗     ██║██╔══██╗╚██╗██╔╝██╔╝╚██╗
+                //  ███████╗   ███████║     ██║███████║ ╚███╔╝ ██║  ██║
+                //  ╚════██║   ██╔══██║██   ██║██╔══██║ ██╔██╗ ██║  ██║
+                //  ███████║██╗██║  ██║╚█████╔╝██║  ██║██╔╝ ██╗╚██╗██╔╝
+                //  ╚═▀▀▀══╝╚═╝╚═╝  ╚═╝ ╚════╝ ╚═╝  ╚═╝╚═╝  ╚═╝ ╚═╝╚═╝
+                case 'jQuery': return (function _doAjaxWithJQuery(){
+
+                  var thisJQuery = requestInfo.protocolInstance;
+
+                  // Build options for $.ajax().
+                  var ajaxOpts = {
+                    url: requestInfo.url,
+                    method: requestInfo.verb
+                  };
+                  // If GET request, encode params in querystring.
+                  if (requestInfo.verb.match(/get/i)) {
+                    ajaxOpts.data = textParamsByFieldName;
+                  }
+                  // Else if there are files, attach them properly,
+                  // alongside the other stuff in the form -- either
+                  // in the body or as querystring parameters, depending
+                  // on what kind of data they are.
+                  //
+                  // > Note that we include text params **FIRST**,
+                  // > in order to support order-aware body parsers
+                  // > that rely on pessimistic upstream awareness,
+                  // > optimizing uploads and preventing DDoS attacks.
+                  // >
+                  // > Also note that we skip text params and file fields w/
+                  // > `undefined` values for consistency w/ Sails conventions.
+                  //
+                  // > Finally, one last thing to consider:
+                  // > If a value is NOT something that needs special encoding
+                  // > to accurately capture its meaning and data type (e.g. if
+                  // > it is a string), then we simply attach it to the body as
+                  // > form data.  But otherwise, we have to do something fancy
+                  // > to get it to be losslessly encoded for use in backend code.
+                  else if (_.keys(uploadsByFieldName).length > 0){
+                    ajaxOpts.processData = false;
+                    ajaxOpts.contentType = false;
+                    ajaxOpts.data = new FormData();
+                    _.each(textParamsByFieldName, function(value, fieldName){
+                      if (value === undefined) { return; }//•
+                      if (_.isString(value)) {
+                        ajaxOpts.data.append(fieldName, value);
+                      } else {
+                        // Use the "X-JSON-MPU-Params" header to signal to the
+                        // server that this text param is encoded as stringified
+                        // JSON, even though the request's content type would
+                        // suggest otherwise (because it's multipart/form-data
+                        // in order to handle file uploads).
+                        //
+                        // > This is "the new way" of solving this problem.
+                        // > For more info about "the old way" of "solving" this
+                        // > that didn't really work for everything (i.e. doing
+                        // > a recursive dive over the value and attempting to
+                        // > losslessly encode it in the URL query string), see:
+                        // > https://github.com/mikermcneil/parasails/commit/28732b1ed55eb4697de4bf4c559f0319cf773041
+                        requestInfo.headers = requestInfo.headers||{};
+                        if (requestInfo.headers['X-JSON-MPU-Params']) {
+                          requestInfo.headers['X-JSON-MPU-Params'] += ','+fieldName;
+                        } else {
+                          requestInfo.headers['X-JSON-MPU-Params'] = fieldName;
+                        }
+
+                        // FUTURE: do a deep-crawl to sanitize prior to stringification (as alluded to below) -- i.e. to strip undefined array items, etc
+                        var stringifiedValue;
+                        try {
+                          stringifiedValue = JSON.stringify(value);
+                        } catch (unusedErr) {
+                          var errMsgPrefix = 'Could not encode value provided for '+fieldName+' because the value is (or contains) ';
+                          var errMsgSuffix = '.  In a request that contains one or more file uploads, any additional text parameter values need to be encoded in such a way that they can be losslessly parsed by the Sails framework.\n [?] Unsure?  Reach out at https://sailsjs.com/support';
+                          throw new Error(errMsgPrefix+'data that cannot be stringified as JSON (usually, this means it contains circular references-- i.e. its properties or array items are actually references to itself, or each other)'+errMsgSuffix);
+                        }
+                        ajaxOpts.data.append(fieldName, stringifiedValue);
+                      }
+                    });//∞
+
+                    _.each(uploadsByFieldName, function(fileOrFileList, fieldName){
+                      if (fileOrFileList === undefined) { return; }
+                      if (!_representsOneOrMoreFiles(fileOrFileList)) {
+                        throw new Error('Cannot upload as "'+fieldName+'" because the provided value is not a File instance, an array of File instances, a dictionary like `{file: someFileInstance, name: \'filename-override.png\'}`, or an array of such wrapper dictionaries.  Instead, got: '+fileOrFileList+'\n\nNote that this can sometimes occur due to problems with code minification (e.g. uglify configuration).');
+                      }
+                      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+                      // FUTURE: throw usage error if wrapper (i.e. with `.file`) has a `.name`, override,
+                      // but it isn't a valid string  (i.e. truthy, decent chars, & not too long)
+                      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+                      if (_.isArray(fileOrFileList) || (_.isObject(fileOrFileList) && _.isObject(fileOrFileList.constructor) && fileOrFileList.constructor.name === 'FileList')) {
+                        for (var i = 0; i < fileOrFileList.length; i++) {
+                          if (fileOrFileList[i] instanceof File) {
+                            ajaxOpts.data.append(fieldName, fileOrFileList[i], fileOrFileList[i].name);
+                          } else {
+                            ajaxOpts.data.append(fieldName, fileOrFileList[i].file, fileOrFileList[i].name||fileOrFileList[i].file.name);
+                          }
+                        }//∞
+                      }
+                      else {
+                        if (fileOrFileList instanceof File) {
+                          ajaxOpts.data.append(fieldName, fileOrFileList, fileOrFileList.name);
+                        } else {
+                          ajaxOpts.data.append(fieldName, fileOrFileList.file, fileOrFileList.name||fileOrFileList.file.name);
+                        }
+                      }
+                    });//∞
+                  }
+                  // Otherwise, attach params as a JSON-encoded request body.
+                  else {
+                    // If any of our text params are arrays, then before stringifying,
+                    // make a shallow clone and strip out any `undefined` values
+                    // that exist as items at the top level of the array.  (This
+                    // prevents them from automatically being changed into `null`
+                    // by JSON.stringify().)
+                    // > (This behavior is a breaking change that was introduced
+                    // > in parasails@0.9.0)
+                    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+                    // > FUTURE: Instead, do a deep crawl and mimic the behavior of RTTC:
+                    // > https://github.com/node-machine/rttc/blob/8a84191dc786e872a6c28b24566539573b2a2c4d/lib/helpers/rebuild-recursive.js#L77-L90
+                    // > ^^That'll take care of several other common edge cases that
+                    // > are handled in a kinda strange way by JSON.stringify(),
+                    // > including `NaN`, etc.
+                    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+                    var sanitizedTPBFN = _.mapValues(textParamsByFieldName, function(value) {
+                      var sanitizedValue;
+                      if (_.isArray(value)) {
+                        sanitizedValue = _.clone(value);
+                        _.remove(sanitizedValue, function(item){
+                          return item === undefined;
+                        });//∞
+                      } else {
+                        sanitizedValue = value;
+                      }
+                      return sanitizedValue;
+                    });
+                    ajaxOpts.data = JSON.stringify(sanitizedTPBFN);
+                    ajaxOpts.processData = false;
+                    ajaxOpts.contentType = 'application/json; charset=UTF-8';
+                  }
+
+                  // Attach headers so they'll be included in our $.ajax() call.
+                  if (requestInfo.headers !== undefined) {
+                    ajaxOpts.headers = requestInfo.headers;
+                  }
+
+                  // Dealing with jqXHR:
+                  //
+                  // To get status code:
+                  // console.log(jqXHR.statusCode);
+                  //
+                  // To get header(s):
+                  // console.log(jqXHR.getResponseHeader('foo'));
+                  // - or -
+                  // console.log(jqXHR.getAllResponseHeaders());
+                  // ^^^ but this one gives it to you as a string.
+                  // ^^
+                  // WARNING: if using a cross-domain request w/ CORS, this (^^^^^)
+                  // header grabbing may not work properly on some versions of firefox.  More details:
+                  // http://stackoverflow.com/questions/5614735/jqxhr-getallresponseheaders-wont-return-all-headers
+
+                  thisJQuery.ajax(_.extend(ajaxOpts, {
+                    error: function (jqXHR) {
+
+                      return proceed(undefined, {
+                        body: jqXHR.responseJSON === undefined ? jqXHR.responseText : jqXHR.responseJSON,
+                        statusCode: jqXHR.status,
+                        headers: _.reduce(jqXHR.getAllResponseHeaders().split(/\n/), function (memo, pair) {
+                          var splitPair = pair.split(/:/);
+                          var headerName = splitPair[0];
+                          if (headerName === '') { return memo; }
+
+                          // Note that we trim leading AND trailing whitespace.
+                          var headerVal = splitPair.slice(1).join('').replace(/^\s*/, '').replace(/\s*$/, '');
+                          memo[headerName] = headerVal;
+                          // Also add an alias using the all-lowercased version of the header name
+                          // (if it's different)
+                          var allLowercaseHeaderName = headerName.toLowerCase();
+                          if (allLowercaseHeaderName !== headerName) {
+                            memo[allLowercaseHeaderName] = headerVal;
+                          }
+                          return memo;
+                        }, {})
+                      });
+                    },
+                    success: function (unused0, unused1, jqXHR) {
+                      return proceed(undefined, {
+                        body: jqXHR.responseJSON === undefined ? jqXHR.responseText : jqXHR.responseJSON,
+                        statusCode: jqXHR.status,
+                        headers: _.reduce(jqXHR.getAllResponseHeaders().split(/\n/), function (memo, pair) {
+                          var splitPair = pair.split(/:/);
+                          var headerName = splitPair[0];
+                          if (headerName === '') { return memo; }
+
+                          // Note that we trim leading AND trailing whitespace.
+                          var headerVal = splitPair.slice(1).join('').replace(/^\s*/, '').replace(/\s*$/, '');
+                          memo[headerName] = headerVal;
+                          // Also add an alias using the all-lowercased version of the header name
+                          // (if it's different)
+                          var allLowercaseHeaderName = headerName.toLowerCase();
+                          if (allLowercaseHeaderName !== headerName) {
+                            memo[allLowercaseHeaderName] = headerVal;
+                          }
+                          return memo;
+                        }, {})
+                      });
+                    }
+                  }));//</ thisJQuery.ajax + _.extend() >
+                })();//</self-calling function :: _doAjaxWithJQuery>
+
+
+                //  ██╗ ██████╗    ███████╗ ██████╗  ██████╗██╗  ██╗███████╗████████╗       ██╗██╗
+                //  ██║██╔═══██╗   ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██╔════╝╚══██╔══╝▄ ██╗▄██╔╝╚██╗
+                //  ██║██║   ██║   ███████╗██║   ██║██║     █████╔╝ █████╗     ██║    ████╗██║  ██║
+                //  ██║██║   ██║   ╚════██║██║   ██║██║     ██╔═██╗ ██╔══╝     ██║   ▀╚██╔▀██║  ██║
+                //  ██║╚██████╔╝██╗███████║╚██████╔╝╚██████╗██║  ██╗███████╗   ██║██╗  ╚═╝ ╚██╗██╔╝
+                //  ╚═╝ ╚═════╝ ╚═╝╚══════╝ ╚═════╝  ╚═════╝╚═╝  ╚═╝╚══════╝   ╚═╝╚═╝       ╚═╝╚═╝
+                //
+                case 'io.socket': return (function _doAjaxWithSocket(){
+
+                  var socket = requestInfo.protocolInstance;
+
+                  // Check to be sure that none of the parameter values are
+                  // attempted file uploads.
+                  if (File && requestInfo.params) {
+                    _.each(requestInfo.params, function(value, fieldName){
+                      if (_representsOneOrMoreFiles(value)) {
+                        throw new Error('Detected File-like data provided for the "'+fieldName+'" parameter -- but file uploads are not currently supported using WebSockets / Socket.io.  Please call this method using a different request protocol (e.g. `protocol: \'jQuery\'`)');
+                      }
+                    });
+                  }//fi
+
+                  // Determine if the socket has been disconnected, or if it
+                  // has NEVER BEEN connected and is not CURRENTLY TRYING to
+                  // connect.
+                  var disconnectedOrWasNeverConnectedAndUnlikelyToTry =
+                    // =>
+                    // If the socket is connected, cool, no problem.
+                    !socket.isConnected() &&
+                    // =>
+                    // If the socket is at least _attempting_ to connect, we'll go ahead
+                    // and let it try to do it's thing (i.e. queue and replay)
+                    !socket.isConnecting() &&
+                    // =>
+                    // If the socket hasn't even had the _chance_ to begin connecting
+                    // (because the one-tick auto-connect timer hasn't fired yet),
+                    // then we'll give it that chance.
+                    !socket.mightBeAboutToAutoConnect();
+
+
+                  // If none of the above were true, then emulate a normal
+                  // offline AJAX response from jQuery.
+                  if (disconnectedOrWasNeverConnectedAndUnlikelyToTry) {
+                    return proceed(undefined, {
+                      body: null,
+                      statusCode: 0,
+                      headers: {}
+                    });
+                  }
+                  // Otherwise the socket is either connected, in the process of connecting,
+                  // or in an indeterminate state where it has _never_ connected but _might_
+                  // still connect (see above for details).
+                  //
+                  // In any of these cases, thanks largely to queuing, it is safe to continue
+                  // onwards, and to send the request!
+                  socket.request({
+                    method: requestInfo.verb,
+                    url: requestInfo.url,
+                    data: requestInfo.params,
+                    headers: requestInfo.headers
+                  }, function (unused, jwres) {
+                    return proceed(undefined, {
+                      body: jwres.body,
+                      statusCode: jwres.statusCode,
+                      headers: jwres.headers
+                    });
+                  });//</ socket.request() >
+                })();//</self-calling function :: _doAjaxWithSocket>
+
+
+                //  ███╗   ███╗██████╗       ██╗  ██╗████████╗████████╗██████╗
+                //  ████╗ ████║██╔══██╗      ██║  ██║╚══██╔══╝╚══██╔══╝██╔══██╗
+                //  ██╔████╔██║██████╔╝█████╗███████║   ██║      ██║   ██████╔╝
+                //  ██║╚██╔╝██║██╔═══╝ ╚════╝██╔══██║   ██║      ██║   ██╔═══╝
+                //  ██║ ╚═╝ ██║██║           ██║  ██║   ██║      ██║   ██║
+                //  ╚═╝     ╚═╝╚═╝           ╚═╝  ╚═╝   ╚═╝      ╚═╝   ╚═╝
+                case 'machinepack-http': return (function _doAjaxWithMpHttp(){
+
+                  // If there are request parameters, check to be sure
+                  // that none of the parameter values are File instances.
+                  if (requestInfo.params) {
+                    _.each(requestInfo.params, function(value, fieldName){
+                      if (_representsOneOrMoreFiles(value)) {
+                        throw new Error('Detected File-like data provided for the "'+fieldName+'" parameter -- but file uploads are not currently supported in Cloud SDK when using "machinepack-http".  Please call this method using a different request protocol.');
+                      }
+                    });//∞
+                  }//fi
+
+                  var mpHttpOpts = {
+                    url: requestInfo.url,
+                    method: requestInfo.verb
+                  };
+                  // If GET request, encode params in querystring.
+                  if (requestInfo.verb.match(/get/i)) {
+                    mpHttpOpts.qs = textParamsByFieldName;
+                  }
+                  // Otherwise, attach params as the request body.
+                  // (it will be JSON-encoded automatically by default)
+                  else {
+                    mpHttpOpts.body = textParamsByFieldName;
+                  }
+
+                  if (typeof requestInfo.headers !== 'undefined') {
+                    mpHttpOpts.headers = requestInfo.headers;
+                  }
+
+                  requestInfo.protocolInstance.sendHttpRequest.with(mpHttpOpts)
+                  .switch({
+                    error: function (err) {
+                      return proceed(err);
+                    },
+                    requestFailed: function(err) {
+                      return proceed(undefined, {
+                        body: err.message,
+                        statusCode: 0,
+                        headers: {}
+                      });
+                    },
+                    non200Response: function(serverResponse) {
+                      return proceed(undefined, serverResponse);
+                    },
+                    success: function (serverResponse){
+
+                      // If there is no response body (i.e. `body` is `""`),
+                      // then we'll interpret that as `null` and return that as
+                      // our response data.
+                      if (serverResponse.body === '') {
+                        serverResponse.body = null;
+                      }
+
+                      // --•
+                      // Otherwise, attempt to parse the response body as JSON.
+                      try {
+                        serverResponse.body = JSON.parse(serverResponse.body);
+                      } catch (err) {//eslint-disable-line no-unused-vars
+                        // If the raw response body string cannot be parsed as JSON,
+                        // then interpret it as a string by leaving the raw body as-is.
+                      }
+
+                      return proceed(undefined, serverResponse);
+                    }
+                  });//_∏_
+                })();//</self-calling function :: _doAjaxWithMpHttp>
+
+                default:
+                  throw new Error('Consistency violation: Unexpected protocol name received (`'+requestInfo.protocolName+'`)-- but it should have already been checked!');
+
+              }//</switch(protocol)>
+            })(function afterwards(err, responseInfo){
+              if (err) {
+                throw new Error('Consistency violation: Unexpected error in CloudSDK. Details: '+err.stack);
+              }
+
+
+              // Note that the response info dictionary is intended to be
+              // a transport-agnostic way of representing a server response.
+              // (similar to jQuery AJAX response objects / jqXHR / jwRes):
+
+              // --------------------------------------------------------------------
+              // AVAILABLE AT THIS POINT:
+              // • responseInfo.statusCode
+              // • responseInfo.body
+              // • responseInfo.headers
+              // --------------------------------------------------------------------
+              // ATTACHED BELOW:
+              // • responseInfo.data        << for compatibility
+              // • responseInfo.exit        << either `success`, `error`, or the code name of some other exit.
+              // • responseInfo.code        << (alias for "exit")
+              // --------------------------------------------------------------------
+
+              // To get exit info:
+              // console.log(responseInfo.headers['X-Exit']);
+              // console.log(responseInfo.headers['X-Exit-FriendlyName']);
+              // console.log(responseInfo.headers['X-Exit-Description']);
+              // console.log(responseInfo.headers['X-Exit-Extended-Description']);
+              // console.log(responseInfo.headers['X-Exit-Output-Friendly-Name']);
+              // console.log(responseInfo.headers['X-Exit-Output-Description']);
+
+
+
+              // COMPATIBILITY:
+              // Stick `data` property on responseInfo so it feels familiar
+              // e.g. like `res.data` in angular 1
+              // (This is mainly for backwards compatibility, and can probably
+              // be removed at some point.)
+              if (!_.isUndefined(responseInfo.body)) {
+                responseInfo.data = responseInfo.body;
+              }
+
+              // Determine the appropriate callback to call.
+              //
+              // We also stick on `exit` property for convenience
+              // by sniffing the X-Exit header.  We default to `error`
+              // or `success`, depending on whether an Error instance
+              // was passed through as the `error` property.
+              var xExitResponseHeaderValue = responseInfo.headers['x-exit'] || responseInfo.headers['X-Exit'];
+              // ^This "either-or-ing" is likely necessary because of different jQuery versions.
+
+              if (xExitResponseHeaderValue === '_offline') {
+                console.warn('Unconventional exit detected:  `_offline` is a reserved exit name for use on the front-end, and should not be used willy nilly.  Instead, please come up with a different exit name for this scenario.');
+              }//fi
+
+
+              // If the user's computer is offline or the server is down, etc...
+              // > If `statusCode` is 0, then the user is probably offline.
+              // > Or maybe our server is down omg.
+              // > Or it could be that a cross-origin request was blocked.
+              if (responseInfo.statusCode === 0) {
+                responseInfo.exit = '_offline';
+                // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+                // FUTURE: Instead of "_offline", support more granular/accurate
+                // built-in exits like:
+                // • '_failedCrossOriginRequest'
+                // • '_serverDown'
+                // • '_clientOffline'
+                //
+                // ^^In the future, if we want to get really fancy,
+                // we could try sending a ping to another CORS-enabled
+                // endpoint to see whether it's us or them.  Not sure
+                // how we'd figure out if it's a failed cross-origin
+                // request though...
+                // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+              }
+              // If the server responded with a specific error...
+              else if (xExitResponseHeaderValue){
+                responseInfo.exit = xExitResponseHeaderValue;
+              }
+              // If the server responded with some other misc. error...
+              else if (responseInfo.statusCode < 200 || responseInfo.statusCode >= 300) {
+                responseInfo.exit = 'error';
+              }
+              // Otherwise, we'll consider it a success!
+              else {
+                responseInfo.exit = 'success';
+              }
+
+              // Set up `code` as alias for `exit`, for consistency.
+              responseInfo.code = responseInfo.exit;
+
+
+
+              // Now before proceeding further, check lifecycleInstructions for a match (if there are any configured).
+              // > NOTE: We only ever run one of these handlers for any given response!
+              var matchingLifecycleInstruction = _.find(requestInfo.lifecycleInstructions, function(lifecycleInstruction) {
+
+                if (lifecycleInstruction.rule === undefined) {
+                  if (responseInfo.exit === 'success' || (responseInfo.statusCode >= 200 && responseInfo.statusCode < 300)) {
+                    return false;
+                  }
+                  else {
+                    return true;
+                  }
+                }
+                else if (responseInfo.statusCode === lifecycleInstruction.rule) {
+                  return true;
+                }
+                else if (responseInfo.exit === lifecycleInstruction.rule) {
+                  return true;
+                }
+                // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+                // FUTURE: add support for bluebird style dictionary rules
+                // (see flaverr.taste at https://npmjs.com/package/flaverr)
+                // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+              });//∞
+
+
+              // If there was a match, then run this intercept/toleration's handler function.
+              (function _runInterceptOrTolerationMaybe(proceed){
+
+                if (!matchingLifecycleInstruction) {
+                  return proceed();
+                }//•
+
+                var resultFromHandler;
+
+                if (matchingLifecycleInstruction.handler.constructor.name === 'AsyncFunction') {
+                  return proceed(new Error('`async` functions are not *yet* fully supported in intercept/tolerate'));
+                  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+                  // FUTURE: add support for this, beginning with something like the
+                  // following incomplete implementation:
+                  //
+                  // ```
+                  // var interceptPromise;
+                  // try {
+                  //   interceptPromise = matchingLifecycleInstruction.handler();
+                  // } catch (err) {
+                  //   if (err === false) { return proceed(undefined, true); }//« special case (`throw false`)
+                  //   else { return proceed(err); }
+                  // }
+                  //
+                  // interceptPromise.then(function(_resultFromHandler){
+                  //   resultFromHandler = _resultFromHandler;
+                  //   proceed(undefined, resultFromHandler);
+                  // });
+                  // interceptPromise.catch(function(err) {
+                  //   /* eslint-disable callback-return */
+                  //   if (err === false) { proceed(undefined, true); }//« special case (`throw false`)
+                  //   else { proceed(err); }
+                  //   /* eslint-enable callback-return */
+                  // });
+                  // ```
+                  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+                }
+                else {
+                  try {
+                    // FUTURE: do this addition of properties earlier:
+                    errorInstance.exit = responseInfo.exit;
+                    errorInstance.code = responseInfo.exit;
+                    errorInstance.responseInfo = responseInfo;
+
+                    resultFromHandler = matchingLifecycleInstruction.handler(errorInstance);
+                  } catch (err) {
+                    if (err === false) { return proceed(undefined, true); }//« special case (`throw false`)
+                    else { return proceed(err); }
+                  }
+
+                  return proceed(undefined, resultFromHandler);
+                }
+
+              })(function(err, resultFromInterceptOrTolerate) {
+
+                if (err) {
+                  throw new Error('The provided custom intercept/tolerate logic threw an unexpected, uncaught error: '+err.stack);
+                  // FUTURE: better error handling for this case ^^
+                }//•
+
+
+                if (matchingLifecycleInstruction) {
+                  if (responseInfo.exit === 'success' || (responseInfo.statusCode >= 200 && responseInfo.statusCode < 300)) {
+                    throw new Error('Unexpected intercept/tolerate logic matched a 2xx/success response, but these methods should only be used for exceptions!');
+                    // FUTURE: better error handling for this case ^^
+                  }
+                }
+
+                // If a matching `.tolerate()` was encountered, then consider this successful no matter what.
+                var tolerateAsIfSuccess = (matchingLifecycleInstruction && matchingLifecycleInstruction.type === 'tolerate');
+
+
+                // If a matching `.intercept()` was encountered, then consider whatever the intercept handler
+                // returned to be our new Error.
+                if (matchingLifecycleInstruction && matchingLifecycleInstruction.type === 'intercept') {
+                  if (!_.isError(resultFromInterceptOrTolerate)) {
+                    throw new Error('Unexpected value returned from .intercept() handler.  Expected an Error instance but instead, got: '+resultFromInterceptOrTolerate);
+                    // FUTURE: better error handling for this case ^^
+                  }
+                  errorInstance = resultFromInterceptOrTolerate;
+                }
+
+
+                // If no custom error callback was specified, but we don't know
+                // how to handle an error below, then we'll simply throw a fatal
+                // error (this can be caught by `window.onerror` et. al. in order
+                // to trigger a fatal error message, e.g. using a devoted user
+                // interface component as a global error bus.)
+                //
+                // This string is used as a prefix for the various error messages
+                // that can occur this way throughout the code below.
+                var UNHANDLED_ERR_PREFIX_MSG =
+                (
+                  (responseInfo.statusCode===0)?
+                  'Unable to send request... are the client and server both online?'
+                  :'Received unhandled '+responseInfo.statusCode+' error from server.'
+                )+'  '+
+                '(See `responseInfo` property of this error for details).  '+
+                'Note that you can negotiate any error using its `exit` or `responseInfo.statusCode` properties.\n'+
+                '--\n';
+
+                //  ┌─┐┌─┐┌┐┌┌─┐┬─┐┬┌─┐   ┌─┐─┐ ┬┌─┐┌─┐  ┌─┐┌─┐┬  ┬  ┌┐ ┌─┐┌─┐┬┌─  ┌─┐┬ ┬┌┐┌┌─┐┌┬┐┬┌─┐┌┐┌
+                //  │ ┬├┤ │││├┤ ├┬┘││     ├┤ ┌┴┬┘├┤ │    │  ├─┤│  │  ├┴┐├─┤│  ├┴┐  ├┤ │ │││││   │ ││ ││││
+                //  └─┘└─┘┘└┘└─┘┴└─┴└─┘  o└─┘┴ └─└─┘└─┘  └─┘┴ ┴┴─┘┴─┘└─┘┴ ┴└─┘┴ ┴  └  └─┘┘└┘└─┘ ┴ ┴└─┘┘└┘
+                // If a generic callback was provided...
+                if (_.isFunction(exitCallbacks)) {
+                  if (tolerateAsIfSuccess) {
+                    return exitCallbacks(undefined, resultFromInterceptOrTolerate, responseInfo);
+                  }
+                  else if (responseInfo.exit === 'success' || (responseInfo.statusCode >= 200 && responseInfo.statusCode < 300)) {
+                    return exitCallbacks(undefined, responseInfo.body, responseInfo);
+                  }
+                  else {
+                    errorInstance.stack += '\n'+
+                    '\n'+
+                    'Error Summary:\n'+
+                    '(see `.responseInfo` for more details)\n'+
+                    '·-------------·----------------------------------------·\n'+
+                    '|    Protocol | '+(requestInfo.protocolName==='jQuery'?'http(s)://   (jQuery)':requestInfo.protocolName==='io.socket'?'ws(s)://   (io.socket)':requestInfo.protocolName)+'\n'+
+                    '|     Address | '+requestInfo.verb.toUpperCase()+' '+requestInfo.url+'\n'+
+                    '|        Exit | '+responseInfo.exit+'\n'+
+                    '| Status Code | '+responseInfo.statusCode+'\n'+
+                    '·-------------·----------------------------------------·';
+                    if (responseInfo.body !== undefined) {
+                      errorInstance.stack += '\n\nResponse Body:\n'+responseInfo.body;
+                    }
+                    errorInstance.responseInfo = responseInfo;
+                    errorInstance.exit = responseInfo.exit;
+                    errorInstance.code = responseInfo.exit;
+                    return exitCallbacks(errorInstance, responseInfo.body!==undefined?responseInfo.body:errorInstance, responseInfo);
+                  }
+                }//‡
+                //  ┌─┐┬ ┬┬┌┬┐┌─┐┬ ┬┌┐ ┌─┐┌─┐┬┌─  ┌┬┐┬┌─┐┌┬┐┬┌─┐┌┐┌┌─┐┬─┐┬ ┬
+                //  └─┐││││ │ │  ├─┤├┴┐├─┤│  ├┴┐   ││││   │ ││ ││││├─┤├┬┘└┬┘
+                //  └─┘└┴┘┴ ┴ └─┘┴ ┴└─┘┴ ┴└─┘┴ ┴  ─┴┘┴└─┘ ┴ ┴└─┘┘└┘┴ ┴┴└─ ┴
+                // If a dictionary of callbacks was provided...
+                else if (_.isObject(exitCallbacks)) {
+
+                  // If this isn't the error exit, and a callback exists for it...
+                  if (responseInfo.exit !== 'error' && exitCallbacks[responseInfo.exit]) {
+
+                    // If there's a response body, pass it to the callback.
+                    if (responseInfo.body !== undefined) {
+                      return exitCallbacks[responseInfo.exit](tolerateAsIfSuccess ? resultFromInterceptOrTolerate : responseInfo.body, responseInfo);
+                    }
+                    // Otherwise, there's no response body.
+                    // So if this is a "success" response, or any 2xx response,
+                    // then don't pass a first arg to the callback.
+                    else if (tolerateAsIfSuccess || responseInfo.exit === 'success' || (responseInfo.statusCode >= 200 && responseInfo.statusCode < 300)) {
+                      return exitCallbacks['success'](tolerateAsIfSuccess ? resultFromInterceptOrTolerate : undefined, responseInfo);
+                    }
+                    // Otherwise, pass an error instance as the first arg of the callback.
+                    else {
+                      errorInstance.stack += '\n'+
+                      '\n'+
+                      'Error Summary:\n'+
+                      '(see `.responseInfo` for more details)\n'+
+                      '·-------------·----------------------------------------·\n'+
+                      '|    Protocol | '+(requestInfo.protocolName==='jQuery'?'http(s)://   (jQuery)':requestInfo.protocolName==='io.socket'?'ws(s)://   (io.socket)':requestInfo.protocolName)+'\n'+
+                      '|     Address | '+requestInfo.verb.toUpperCase()+' '+requestInfo.url+'\n'+
+                      '|        Exit | '+responseInfo.exit+'\n'+
+                      '| Status Code | '+responseInfo.statusCode+'\n'+
+                      '·-------------·----------------------------------------·';
+                      if (responseInfo.body !== undefined) {
+                        errorInstance.stack += '\n\nResponse Body:\n'+responseInfo.body;
+                      }
+                      errorInstance.responseInfo = responseInfo;
+                      errorInstance.exit = responseInfo.exit;
+                      errorInstance.code = responseInfo.exit;
+                      return exitCallbacks[responseInfo.exit](errorInstance, responseInfo);
+                    }
+                  }
+                  // Otherwise, if this is a "success" response, or any 2xx response, then...
+                  else if (tolerateAsIfSuccess || responseInfo.exit === 'success' || (responseInfo.statusCode >= 200 && responseInfo.statusCode < 300)) {
+                    if (exitCallbacks['success']) {
+                      // Either forward to the "success" callback (if there is one)
+                      return exitCallbacks['success'](tolerateAsIfSuccess ? resultFromInterceptOrTolerate : responseInfo.body, responseInfo);
+                    }
+                    else {
+                      // or otherwise do nothing.
+                    }
+                  }
+                  // Otherwise call the error callback.
+                  else if (exitCallbacks['error']) {
+                    errorInstance.stack += '\n'+
+                    '\n'+
+                    'Error Summary:\n'+
+                    '(see `.responseInfo` for more details)\n'+
+                    '·-------------·----------------------------------------·\n'+
+                    '|    Protocol | '+(requestInfo.protocolName==='jQuery'?'http(s)://   (jQuery)':requestInfo.protocolName==='io.socket'?'ws(s)://   (io.socket)':requestInfo.protocolName)+'\n'+
+                    '|     Address | '+requestInfo.verb.toUpperCase()+' '+requestInfo.url+'\n'+
+                    '|        Exit | '+responseInfo.exit+'\n'+
+                    '| Status Code | '+responseInfo.statusCode+'\n'+
+                    '·-------------·----------------------------------------·';
+                    if (responseInfo.body !== undefined) {
+                      errorInstance.stack += '\n\nResponse Body:\n'+responseInfo.body;
+                    }
+                    errorInstance.responseInfo = responseInfo;
+                    errorInstance.exit = responseInfo.exit;
+                    errorInstance.code = responseInfo.code;
+                    return exitCallbacks['error'](errorInstance, responseInfo);
+                  }
+                  // Or if there isn't an error callback, just throw.
+                  else {
+                    errorInstance.stack += '\n'+
+                    '\n'+
+                    'Error Summary:\n'+
+                    '(see `.responseInfo` for more details)\n'+
+                    '·-------------·----------------------------------------·\n'+
+                    '|    Protocol | '+(requestInfo.protocolName==='jQuery'?'http(s)://   (jQuery)':requestInfo.protocolName==='io.socket'?'ws(s)://   (io.socket)':requestInfo.protocolName)+'\n'+
+                    '|     Address | '+requestInfo.verb.toUpperCase()+' '+requestInfo.url+'\n'+
+                    '|        Exit | '+responseInfo.exit+'\n'+
+                    '| Status Code | '+responseInfo.statusCode+'\n'+
+                    '·-------------·----------------------------------------·';
+                    if (responseInfo.body !== undefined) {
+                      errorInstance.stack += '\n\nResponse Body:\n'+responseInfo.body;
+                    }
+                    errorInstance.stack = UNHANDLED_ERR_PREFIX_MSG + errorInstance.stack;
+                    errorInstance.responseInfo = responseInfo;
+                    throw errorInstance;
+                  }
+                }//‡
+                //  ┌┐┌┌─┐  ┌─┐┌─┐┬  ┬  ┌┐ ┌─┐┌─┐┬┌─  ┌─┐┌─┐  ┌─┐┌┐┌┬ ┬  ┬┌─┬┌┐┌┌┬┐
+                //  ││││ │  │  ├─┤│  │  ├┴┐├─┤│  ├┴┐  │ │├┤   ├─┤│││└┬┘  ├┴┐││││ ││
+                //  ┘└┘└─┘  └─┘┴ ┴┴─┘┴─┘└─┘┴ ┴└─┘┴ ┴  └─┘└    ┴ ┴┘└┘ ┴   ┴ ┴┴┘└┘─┴┘
+                // If _no callbacks of any kind_ were provided...
+                else if (_.isUndefined(exitCallbacks)) {
+
+                  // If this was successful, then do nothing.
+                  if (tolerateAsIfSuccess || responseInfo.exit === 'success' || (responseInfo.statusCode >= 200 && responseInfo.statusCode < 300)) {
+                    return;
+                  }
+                  // Otherwise, throw.
+                  else {
+                    errorInstance.stack += '\n'+
+                    '\n'+
+                    'Error Summary:\n'+
+                    '(see `.responseInfo` for more details)\n'+
+                    '·-------------·----------------------------------------·\n'+
+                    '|    Protocol | '+(requestInfo.protocolName==='jQuery'?'http(s)://   (jQuery)':requestInfo.protocolName==='io.socket'?'ws(s)://   (io.socket)':requestInfo.protocolName)+'\n'+
+                    '|     Address | '+requestInfo.verb.toUpperCase()+' '+requestInfo.url+'\n'+
+                    '|        Exit | '+responseInfo.exit+'\n'+
+                    '| Status Code | '+responseInfo.statusCode+'\n'+
+                    '·-------------·----------------------------------------·';
+                    if (responseInfo.body !== undefined) {
+                      errorInstance.stack += '\n\nResponse Body:\n'+responseInfo.body;
+                    }
+                    errorInstance.stack = UNHANDLED_ERR_PREFIX_MSG + errorInstance.stack;
+                    errorInstance.responseInfo = responseInfo;
+                    throw errorInstance;
+                  }
+                }//‡
+                else {
+                  throw new Error('Invalid usage of Cloud.*() method.  Provide either a dictionary of callbacks, a single callback function, or NOTHING to `.exec()`.');
+                }
+
+              });//_∏_  </cb from † _runInterceptOrTolerationMaybe()>
+
+            });//_∏_  </cb from † _makeAjaxCallWithAppropriateProtocol()>
+
+            // --
+            // > Note that we don't return anything at all here.
+            // > (That's to ensure userland code doesn't attempt any further chaining or `await`ing.)
+
+          },//</definition of `.exec()` >
+
+          switch: function (){
+            deferred.exec.apply(deferred, arguments);
+            // --
+            // > Note that we don't return anything at all here.
+            // > (That's to ensure userland code doesn't attempt any further chaining or `await`ing.)
+          },
+
+          // FUTURE: use parley for this instead, if available
+          log: function (){
+
+            console.log('Running with `.log()`...');
+
+            this.exec(function(err, result) {
+              if (err) {
+                console.error();
+                console.error('- - - - - - - - - - - - - - - - - - - - - - - -');
+                console.error('An error occurred:');
+                console.error();
+                console.error(err);
+                console.error('- - - - - - - - - - - - - - - - - - - - - - - -');
+                console.error();
+                return;
+              }//-•
+
+              console.log();
+              if (_.isUndefined(result)) {
+                console.log('- - - - - - - - - - - - - - - - - - - - - - - -');
+                console.log('Finished successfully.');
+                console.log();
+                console.log('(There was no result.)');
+                console.log('- - - - - - - - - - - - - - - - - - - - - - - -');
+              }
+              else {
+                console.log('- - - - - - - - - - - - - - - - - - - - - - - -');
+                console.log('Finished successfully.');
+                console.log();
+                console.log('Result:');
+                console.log();
+                console.log(result);
+                console.log('- - - - - - - - - - - - - - - - - - - - - - - -');
+              }
+              console.log();
+
+            });//_∏_
+
+            // --
+            // > Note that we don't return anything at all here.
+            // > (That's to ensure userland code doesn't attempt any further chaining or `await`ing.)
+          }
+
+        };// </define deferred object>
+
+
+
+        //  ███╗   ███╗███████╗██████╗  ██████╗ ███████╗    ██████╗ ███████╗███████╗ █████╗ ██╗   ██╗██╗  ████████╗███████╗
+        //  ████╗ ████║██╔════╝██╔══██╗██╔════╝ ██╔════╝    ██╔══██╗██╔════╝██╔════╝██╔══██╗██║   ██║██║  ╚══██╔══╝██╔════╝
+        //  ██╔████╔██║█████╗  ██████╔╝██║  ███╗█████╗      ██║  ██║█████╗  █████╗  ███████║██║   ██║██║     ██║   ███████╗
+        //  ██║╚██╔╝██║██╔══╝  ██╔══██╗██║   ██║██╔══╝      ██║  ██║██╔══╝  ██╔══╝  ██╔══██║██║   ██║██║     ██║   ╚════██║
+        //  ██║ ╚═╝ ██║███████╗██║  ██║╚██████╔╝███████╗    ██████╔╝███████╗██║     ██║  ██║╚██████╔╝███████╗██║   ███████║
+        //  ╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝ ╚═════╝ ╚══════╝    ╚═════╝ ╚══════╝╚═╝     ╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚═╝   ╚══════╝
+        //
+        //  ███████╗██████╗  ██████╗ ███╗   ███╗    ███████╗███╗   ██╗██████╗ ██████╗  ██████╗ ██╗███╗   ██╗████████╗
+        //  ██╔════╝██╔══██╗██╔═══██╗████╗ ████║    ██╔════╝████╗  ██║██╔══██╗██╔══██╗██╔═══██╗██║████╗  ██║╚══██╔══╝
+        //  █████╗  ██████╔╝██║   ██║██╔████╔██║    █████╗  ██╔██╗ ██║██║  ██║██████╔╝██║   ██║██║██╔██╗ ██║   ██║
+        //  ██╔══╝  ██╔══██╗██║   ██║██║╚██╔╝██║    ██╔══╝  ██║╚██╗██║██║  ██║██╔═══╝ ██║   ██║██║██║╚██╗██║   ██║
+        //  ██║     ██║  ██║╚██████╔╝██║ ╚═╝ ██║    ███████╗██║ ╚████║██████╔╝██║     ╚██████╔╝██║██║ ╚████║   ██║
+        //  ╚═╝     ╚═╝  ╚═╝ ╚═════╝ ╚═╝     ╚═╝    ╚══════╝╚═╝  ╚═══╝╚═════╝ ╚═╝      ╚═════╝ ╚═╝╚═╝  ╚═══╝   ╚═╝
+        //
+        //  ██████╗ ███████╗███████╗██╗███╗   ██╗██╗████████╗██╗ ██████╗ ███╗   ██╗
+        //  ██╔══██╗██╔════╝██╔════╝██║████╗  ██║██║╚══██╔══╝██║██╔═══██╗████╗  ██║
+        //  ██║  ██║█████╗  █████╗  ██║██╔██╗ ██║██║   ██║   ██║██║   ██║██╔██╗ ██║
+        //  ██║  ██║██╔══╝  ██╔══╝  ██║██║╚██╗██║██║   ██║   ██║██║   ██║██║╚██╗██║
+        //  ██████╔╝███████╗██║     ██║██║ ╚████║██║   ██║   ██║╚██████╔╝██║ ╚████║
+        //  ╚═════╝ ╚══════╝╚═╝     ╚═╝╚═╝  ╚═══╝╚═╝   ╚═╝   ╚═╝ ╚═════╝ ╚═╝  ╚═══╝
+        //
+        // Now set up the endpoint definition.
+        //////////////////////////////////////////////////////////////////////
+
+
+        // If a function was supplied, call it and use the dictionary
+        // it returns as our request info.
+        //////////////////////////////////////////////////////////////////////
+        // e.g. function (argins){
+        //   return {
+        //     verb: 'post',
+        //     url: '/foo/bar',
+        //     params: {
+        //       whatever: 'you want' + ' in here maybe using '+argins.whatever
+        //     },
+        //     headers: {}
+        //   }
+        // }
+        if (typeof appLevelSdkEndpointDef === 'function') {
+          var returnedFromEndpointDefFn = appLevelSdkEndpointDef.apply(this, argins);
+          if (typeof returnedFromEndpointDefFn !== 'object') {
+            throw new Error('Consistency violation: Function for CloudSDK endpoint (`'+methodName+'`) returned an invalid result.  The return value of the specified function is not a dictionary!  If a function is supplied for an endpoint definition, it must return a dictionary containing a `verb` and a `url`.  The returned dictionary may also contain dynamic, per-request header & parameter values.');
+          }
+
+          if (!_.isUndefined(returnedFromEndpointDefFn.headers)) {
+            deferred = deferred.headers(returnedFromEndpointDefFn.headers);
+          }
+          else if (options.headers) {
+            deferred = deferred.headers(options.headers);
+          }
+
+          if (!_.isUndefined(returnedFromEndpointDefFn.protocol)) {
+            deferred = deferred.protocol(returnedFromEndpointDefFn.protocol);
+          }
+          else if (options.protocol) {
+            deferred.protocol(options.protocol);
+          }
+          else { deferred.protocol(DEFAULT_PROTOCOL_NAME); }
+
+          requestInfo.verb = returnedFromEndpointDefFn.verb;
+          requestInfo.url = returnedFromEndpointDefFn.url;
+          requestInfo.params = argins;
+        }
+
+        // If a dictionary was supplied, use that as our request info.
+        //////////////////////////////////////////////////////////////////////
+        // e.g. {
+        //   verb: 'post',
+        //   url: '/foo/bar',
+        //   protocol: 'io.socket',//optional, defaults to 'jQuery'
+        //   headers: {'x-auth': 'foo'},//optional, defaults to undefined
+        // }
+        else if (appLevelSdkEndpointDef && typeof appLevelSdkEndpointDef === 'object') {
+          if (!_.isUndefined(appLevelSdkEndpointDef.headers)) {
+            deferred.headers(appLevelSdkEndpointDef.headers);
+          }
+          else if (options.headers) {
+            deferred = deferred.headers(options.headers);
+          }
+
+          if (!_.isUndefined(appLevelSdkEndpointDef.protocol)) {
+            deferred.protocol(appLevelSdkEndpointDef.protocol);
+          }
+          else if (options.protocol) {
+            deferred.protocol(options.protocol);
+          }
+          else { deferred.protocol(DEFAULT_PROTOCOL_NAME); }
+
+          requestInfo.verb = appLevelSdkEndpointDef.verb;
+          requestInfo.url = appLevelSdkEndpointDef.url;
+          requestInfo.params = argins;
+        }
+
+        // If a string was supplied, expand and use that as our request info.
+        //////////////////////////////////////////////////////////////////////
+        // e.g. "POST /api/v1/lawnmowers/foo/inputs/bar"
+        else if (typeof appLevelSdkEndpointDef === 'string') {
+
+          if (options.headers) {
+            deferred = deferred.headers(options.headers);
+          }
+
+          // Set up default protocol.
+          if (options.protocol) {
+            deferred.protocol(options.protocol);
+          }
+          else { deferred.protocol(DEFAULT_PROTOCOL_NAME); }
+
+          // And then fold in the other pieces of request info.
+          requestInfo.verb = appLevelSdkEndpointDef.replace(/^\s*([^\/\s]+)\s*\/.*$/, '$1');
+          requestInfo.url = appLevelSdkEndpointDef.replace(/^\s*[^\/\s]+\s*\/(.*)$/, '/$1');
+          requestInfo.params = argins;
+        }
+
+        else {
+          throw new Error('Consistency violation: Something happened to CloudSDK endpoint (`'+methodName+'`).  This was not noticed initially when building up CloudSDK endpoints, but this endpoint is now invalid.  Endpoints should be defined as either (1) a string like "GET /foo", (2) a dictionary containing a `verb` and a `url`, or (3) a function that returns a dictionary like that.');
+        }
+
+
+        // Now template in URL pattern vars from the runtime request args.
+        /////////////////////////////////////////////////////////////////////////////
+
+        // Find keys in `params` which are route parameters
+        // (e.g. referenced by the endpoint URL)
+        // > Note that we're not actually interested in the return value
+        // > from this first `.replace()` here.
+        var routeParameters = {};
+        requestInfo.url.replace(/(\:[^\/\:\.\?]+\??)/g, function ($all, $1){
+          var routeParamName = $1.replace(/^\:/, '').replace(/\??$/, '');
+
+          // Optional:
+          if ($1.match(/\?$/)) {
+            if (requestInfo.params && requestInfo.params[routeParamName]) {
+              routeParameters[routeParamName] = requestInfo.params[routeParamName];
+            }
+          }
+          // Mandatory:
+          else {
+            if (!requestInfo.params || requestInfo.params[routeParamName] === undefined) {
+              throw new Error('Missing required param: `'+routeParamName+'`');
+            }
+            routeParameters[routeParamName] = requestInfo.params[routeParamName];
+          }
+        });//∞
+
+        // Then create a shallow copy of `requestInfo.params` without the route path
+        // parameters in it, and reattach that as `requestInfo.params`.
+        // (This prevents accidentally smashing argins and causing unintended
+        // consequences in userland code.)
+        requestInfo.params = _.omit(requestInfo.params, _.keys(routeParameters));
+
+        // Now stick the route parameters into the destination url
+        requestInfo.url = requestInfo.url.replace(/(\:[^\/\:\.\?]+\??)/g, function ($all, $1){
+          var routeParamName = $1.replace(/^\:/, '').replace(/\??$/, '');
+          if (routeParameters[routeParamName] === undefined) { return ''; }
+          return routeParameters[routeParamName];
+        });
+
+
+        // Prepend the API base URL to `requestInfo.url`.
+        /////////////////////////////////////////////////////////////////////////////
+        requestInfo.url = options.apiBaseUrl + requestInfo.url;
+
+
+        // Ensure verb exists, and then lower-case it.
+        /////////////////////////////////////////////////////////////////////////////
+        if (!requestInfo.verb) { throw new Error('CloudSDK endpoint (`'+methodName+'`) is invalid: No HTTP verb specified.  Please specify an HTTP verb (e.g. `GET`, `POST`, etc.)'); }
+        requestInfo.verb = (requestInfo.verb || 'get').toLowerCase();
+
+
+        // Attach the `requestInfo` as a property on the Deferred object itself, for easier integration
+        // with 3rd-party tools (e.g. autocomplete)
+        deferred.requestInfo = requestInfo;
+
+        // Return the deferred object.
+        return deferred;
+
+      };//ƒ  </ _helpCallCloudMethod >
+
+      // Primary definition of this Cloud.* method()
+      memo[methodName] = function () {
+
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // FUTURE: If no `args` configured, then check route params (url pattern
+        // variables).  If there are any, attempt to use their names... maybe?
+        // Could actually be MORE confusing though-- needs to be played with.
+        //
+        // UPDATE: OK probably best not to do this actually.
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        if (!appLevelSdkEndpointDef.args && arguments.length > 0) {
+          throw new Error(
+            'Cannot call this Cloud.*() method with serial usage because Cloud SDK is not aware of the appropriate parameter names!  Please pass in named parameter values using .with({…}) instead--or if you\'re the implementor of the corresponding Sails action, change it on the backend and regenerate the SDK so that this method is configured with an `args` array.\n'+
+            ' [?] If you\'re unsure, visit https://sailsjs.com/support for help.'
+          );
+        }
+
+        // Parse arguments into argins
+        var argins = _.reduce(arguments, function(argins, argin, i){
+
+          if (!(appLevelSdkEndpointDef.args[i])) {
+            throw new Error('Invalid usage with serial arguments: Received unexpected '+(i===0?'first':i===1?'second':i===2?'third':(i+1)+'th')+' argument.');
+          }
+
+          // Reject special notation.
+          // > Remember, if we made it to this point, we know it's valid b/c it's already been checked.
+          if (appLevelSdkEndpointDef.args[i] === '{*}') {
+            if (argin !== undefined && (!_.isObject(argin) || _.isArray(argin) || _.isFunction(argin))) {
+              throw new Error('Invalid usage with serial arguments: If provided, expected '+(i===0?'first':i===1?'second':i===2?'third':(i+1)+'th')+' argument to be a dictionary (plain JavaScript object, like `{}`).  But instead, got: '+argin+'');
+            } else if (argin !== undefined && _.intersection(_.keys(argins), _.keys(argin)).length > 0) {
+              throw new Error('Invalid usage with serial arguments: If provided, expected '+(i===0?'first':i===1?'second':i===2?'third':(i+1)+'th')+' argument to have keys which DO NOT overlap with other already-configured argins!  But in reality, it contained conflicting keys: '+_.intersection(_.keys(argins), _.keys(argin))+'');
+            }
+            _.extend(argins, argin);
+          } else {
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            // Note: For design considerations & historical context, see:
+            // • https://github.com/node-machine/machine/commit/fa3829fa637a267793be4a7fb573e008581c4656
+            // • https://github.com/node-machine/spec/pull/2/files#diff-eba3c42d87dad8fb42b4080df85facec
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            // FUTURE: Support declaring variadic usage
+            // https://github.com/node-machine/spec/pull/2/files#diff-eba3c42d87dad8fb42b4080df85facecR58
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            // FUTURE: Support declaring spread arguments
+            // https://github.com/node-machine/spec/pull/2/files#diff-eba3c42d87dad8fb42b4080df85facecR66
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            // Otherwise interpret this as the code name of an input
+            argins[appLevelSdkEndpointDef.args[i]] = argin;
+          }
+
+          return argins;
+
+        }, {});//= (∞)
+
+        return _helpCallCloudMethod(argins);
+
+      };//ƒ
+
+      // Escape hatch that always allows using named parameters.
+      memo[methodName].with = function (argins) {
+        return _helpCallCloudMethod(argins);
+      };//ƒ
+
+      return memo;
+    }, {});//</ _.reduce() :: each defined endpoint method >
+
+    // Remove the `.setup()` method, now that it's been called.
+    delete Cloud.setup;
+
+    // Now attach the configured endpoint methods
+    _.extend(Cloud, methods);
+
+    /**
+     * Cloud.on()
+     *
+     * Listen for a particular kind of socket events, and trigger a function
+     * any time one of them is received.
+     *
+     * > This is almost identical to `io.socket.on()`, except that:
+     * > •     Cloud.on()  supports passing in a dictionary in lieu of
+     * >       a function for its second argument.  If provided, this dictionary
+     * >       will be used as a mini-router based around the conventional "verb"
+     * >       property in relevant incoming socket messages.  In addition, if the
+     * >       special, reserved "*" key is registered as a catchall function,
+     * >       it will be used to handle any messages w/ a verb that doesn't match
+     * >       any of the other verbs, or that are missing a "verb" altogether
+     * >       (i.e. to allow for custom error handling-- otherwise, a built-in error
+     * >       is thrown.)  If a socket message arrives with `verb: '*'`, while
+     * >       kinda weird, it is still routed as expected.
+     *
+     * @param  {String} socketEventName
+     * @param  {Function|Dictionary} handleSocketMsg
+     *
+     * @returns {Function}  (the actual handler function that was bound, for potential use later with `Cloud.off()`)
+     */
+    Cloud.on = function(socketEventName, handleSocketMsg) {
+      if (!socketEventName || !_.isString(socketEventName)) { throw new Error('Invalid usage for `Cloud.on()`: Must pass in a valid first argument (a string; the name of the socket event to listen for -- i.e. the variety of incoming WebSocket messages to receive and handle).'); }
+      if (!handleSocketMsg) { throw new Error('Invalid usage for `Cloud.on()`: Must pass in a second argument (the function to run every time this WebSocket event is received).'); }
+
+      if (!io || !io.socket) { throw new Error('Could not bind a cloud event listener with `Cloud.on()`: WebSocket support is not currently available (`io.socket` is not available).  Make sure `sails.io.js` is being injected in a <script> tag!'); }
+
+      var actualHandler;
+      if (_.isObject(handleSocketMsg) && !_.isArray(handleSocketMsg) && !_.isFunction(handleSocketMsg)) {
+        // Further negotiate based on "verb", if configured to do so.
+        actualHandler = function(msg) {
+          var handlerToRun;
+          if (_.contains(_.keys(handleSocketMsg), msg.verb)) {
+            handlerToRun = handleSocketMsg[msg.verb];
+          } else if (handleSocketMsg['*']) {
+            handlerToRun = handleSocketMsg['*'];
+          } else {
+            throw new Error('Unhandled "'+socketEventName+'" cloud event:  Received an incoming WebSocket message with an unrecognized "verb" property: "'+msg.verb+'".  If this was deliberate, register another key in the call to `Cloud.on(\''+socketEventName+'\', {…, '+msg.verb+': (msg)=>{…} })` to recognize this new sub-category of cloud event and handle it accordingly.  Otherwise, if you\'d like to silently ignore messages with other "verb"s (or no "verb" at all), then pass a function in to Cloud.on(), instead of a dictionary -- or register a "*" key as a catchall, and make its function a no-op.');
+          }
+
+          try {
+            handlerToRun(msg);
+          } catch (err) {
+            if (!_.isObject(err)) { throw err; }
+            err.message = 'An uncaught error was thrown while handling an incoming WebSocket message (a "'+socketEventName+'" cloud event).  '+ err.message;
+            throw err;
+          }
+        };//ƒ
+
+      } else if (_.isFunction(handleSocketMsg)) {
+        // Otherwise, just run the handler function.
+        actualHandler = handleSocketMsg;
+      } else {
+        throw new Error('Invalid usage for `Cloud.on()`: Second argument must either be a function (the function to run every time this socket event is received) or a dictionary of functions that will be negotiated and routed to based on the incoming message\'s conventional "verb" property (e.g. `{ "bankWireReceived": (msg)=>{…}, "destroyed": (msg)=>{…}, "*": (msg)=>{…} }`.');
+      }
+
+      io.socket.on(socketEventName, actualHandler);//œ
+
+      return actualHandler;
+    };//</ .on() >
+
+    /**
+     * Cloud.off()
+     *
+     * Stop listening to ANY AND ALL WEBSOCKET MESSAGES of a particular kind; or
+     * to WebSocket messages from a specific handler function.
+     *
+     * > This is almost identical to `io.socket.off()`, except that it ALWAYS
+     * > applies to all future socket messages that arrive under the given event
+     * > name.
+     *
+     * @param  {String} socketEventName
+     * @param  {Function?} specificHandler
+     */
+    Cloud.off = function(socketEventName, specificHandler) {
+      if (!socketEventName || !_.isString(socketEventName)) { throw new Error('Invalid usage for `Cloud.off()`: Must pass in a first argument (a string; the name of the socket event to stop listening for -- i.e. the variety of incoming WebSocket messages to reject and ignore).'); }
+      if (specificHandler !== undefined && !_.isFunction(specificHandler)) { throw new Error('Invalid usage for `Cloud.off()`: If a second argument is provided, it should be a function  (the specific handler you want to stop running every time a matching WebSocket message is received).'); }
+
+      if (!io || !io.socket) { throw new Error('Could not stop listening to cloud events with `Cloud.off()`: WebSocket support is not currently available (`io.socket` is not available).  Make sure `sails.io.js` is being injected in a <script> tag!'); }
+
+      io.socket.off(socketEventName, specificHandler);
+    };//</ .off() >
+
+  };//ƒ   </ .setup() >
+
+  return Cloud;
+
+}, function(global, factory) {
+  var _;
+  var io;
+  var $;
+  var SAILS_LOCALS;
+  var location;
+  var File;
+  var FileList;
+  var FormData;
+
+  // First, handle optional deps that are gleaned from the global state:
+  // > Note: Instead of throwing, we ignore invalid globals.
+  // > (Remember the bug w/ the File global that happened in Socket.io
+  // > back in ~2015!)
+  // =====================================================================
+  if (global.location !== undefined) {
+    if (global.location && typeof global.location === 'object' && (global.location.constructor.name === 'Location' || global.location.constructor.toString() === '[object Location]' || (_.isObject(global.location) && global.location.href))) {
+      location = global.location;
+    }
+  }//fi
+  if (global.File !== undefined) {
+    if (global.File && typeof global.File === 'function' && global.File.name === 'File') {
+      File = global.File;
+    }
+  }//fi
+  if (global.FileList !== undefined) {
+    if (global.FileList && typeof global.FileList === 'function' && global.FileList.name === 'FileList') {
+      FileList = global.FileList;
+    }
+  }//fi
+  if (global.FormData !== undefined) {
+    if (global.FormData && typeof global.FormData === 'function' && global.FormData.name === 'FormData') {
+      FormData = global.FormData;
+    }
+  }//fi
+
+  // Then, load the rest of the deps:
+  // =====================================================================
+
+  //˙°˚°·.
+  //‡CJS  ˚°˚°·˛
+  if (typeof exports === 'object' && typeof module !== 'undefined') {
+    var _require = require;// eslint-disable-line no-undef
+    var _module = module;// eslint-disable-line no-undef
+    // required deps:
+    if (typeof _ === 'undefined') {
+      try {
+        _ = _require('@sailshq/lodash');
+      } catch (e) { if (e.code === 'MODULE_NOT_FOUND') {/* ok */} else { throw e; } }
+    }//fi
+    if (typeof _ === 'undefined') {
+      try {
+        _ = _require('lodash');
+      } catch (e) { if (e.code === 'MODULE_NOT_FOUND') {/* ok */} else { throw e; } }
+    }//fi
+
+    // optional deps:
+    try { $ = _require('jquery'); } catch (e) { if (e.code === 'MODULE_NOT_FOUND') {/* ok */} else { throw e; } }
+    try {
+
+      io = _require('socket.io-client');
+      var sailsIO = _require('sails.io.js');
+
+      // Instantiate the library (and start auto-connecting)
+      io = sailsIO(io);
+
+      // Disable logging
+      io.sails.environment = 'production';
+
+      // Note that, if there is no location global, then after one tick,
+      // if `io.sails.url` has still not been set, weird errors will emerge.
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+      // FUTURE: figure out a way to provide a better err msg about this--
+      // i.e. specifically the case where `.setup()` isn't called within one tick.
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    } catch (err) {
+      if (err.code === 'MODULE_NOT_FOUND') {
+        // that's ok-- just make sure and unwind any vars that might have
+        // gotten partially set up, since we attempted to require more than
+        // one thing above (and e.g. the second `require()` might have failed)
+        io = undefined;
+      } else {
+        throw err;
+      }
+    }
+
+    SAILS_LOCALS = undefined;
+
+    // export:
+    _module.exports = factory(_, io, $, SAILS_LOCALS, location, File, FileList, FormData);
+  }
+  //˙°˚°·
+  //‡AMD ˚¸
+  else if(typeof define === 'function' && define.amd) {// eslint-disable-line no-undef
+    throw new Error('Global `define()` function detected, but built-in AMD support in `cloud.js` is not currently recommended.  To resolve this, modify `cloud.js`.');
+    // var _define = define;// eslint-disable-line no-undef
+    // _define(['_', 'sails.io.js', '$', 'SAILS_LOCALS', 'location', 'file', …, …], factory);
+  }
+  //˙°˚˙°·
+  //‡NUDE ˚°·˛
+  else {
+    // required deps:
+    if (!global._) { throw new Error('`_` global does not exist on the page yet. (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure the Lodash library is getting brought in before `cloud`.)'); }
+    _ = global._;
+    // optional deps:
+    if (global.io !== undefined) {
+      if (typeof global.io !== 'function') {
+        throw new Error('Could not access `io.socket`: The `io` global is invalid at the moment:' + global.io + '\n(If you\'re using Sails, please check dependency loading order in pipeline.js and make sure the sails.io.js library is getting brought in before `cloud`.)');
+      }
+      else if (typeof global.io.socket === 'undefined') {
+        throw new Error('Could not access `io.socket`: `io` does not have a `socket` property.  Make sure `sails.io.js` is being injected in a <script> tag!');
+      }
+      else {
+        io = global.io;
+      }
+    }//fi
+    if (global.$ !== undefined) {
+      if (typeof global.$ !== 'function') {
+        throw new Error('The `$` global is not valid at the moment:' + global.$ + '\n(If you\'re using Sails, please check dependency loading order in pipeline.js and make sure the jQuery library is getting brought in before `cloud`.)');
+      }
+      else {
+        $ = global.$;
+      }
+    }//fi
+    if (global.SAILS_LOCALS !== undefined) {
+      if (!_.isObject(global.SAILS_LOCALS)) {
+        throw new Error('The `SAILS_LOCALS` global is not valid at the moment:' + global.SAILS_LOCALS + '\n(Please check and make sure you are using `<%- exposeLocalsToBrowser() %>` in your server-side view *before* the rest of your scripts.)');
+      }
+      else {
+        SAILS_LOCALS = global.SAILS_LOCALS;
+      }
+    }//fi
+
+    // export:
+    if (global.Cloud) { throw new Error('Cannot expose global variable: Conflicting global (`cloud`) already exists!'); }
+    global.Cloud = factory(_, io, $, SAILS_LOCALS, location, File, FileList, FormData);
+  }
+});//…)
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/fontawesome.css b/ee/bulk-operations-dashboard/assets/dependencies/fontawesome.css
new file mode 100644
index 000000000000..76b0daa04b69
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/fontawesome.css
@@ -0,0 +1,2337 @@
+/*!
+ *  Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
+ *  License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
+ */
+/* FONT PATH
+ * -------------------------- */
+@font-face {
+  font-family: 'FontAwesome';
+  src: url('/fonts/fontawesome-webfont.eot?v=4.7.0');
+  src: url('/fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'), url('/fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'), url('/fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'), url('/fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'), url('/fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');
+  font-weight: normal;
+  font-style: normal;
+}
+.fa {
+  display: inline-block;
+  font: normal normal normal 14px/1 FontAwesome;
+  font-size: inherit;
+  text-rendering: auto;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+/* makes the font 33% larger relative to the icon container */
+.fa-lg {
+  font-size: 1.33333333em;
+  line-height: 0.75em;
+  vertical-align: -15%;
+}
+.fa-2x {
+  font-size: 2em;
+}
+.fa-3x {
+  font-size: 3em;
+}
+.fa-4x {
+  font-size: 4em;
+}
+.fa-5x {
+  font-size: 5em;
+}
+.fa-fw {
+  width: 1.28571429em;
+  text-align: center;
+}
+.fa-ul {
+  padding-left: 0;
+  margin-left: 2.14285714em;
+  list-style-type: none;
+}
+.fa-ul > li {
+  position: relative;
+}
+.fa-li {
+  position: absolute;
+  left: -2.14285714em;
+  width: 2.14285714em;
+  top: 0.14285714em;
+  text-align: center;
+}
+.fa-li.fa-lg {
+  left: -1.85714286em;
+}
+.fa-border {
+  padding: .2em .25em .15em;
+  border: solid 0.08em #eeeeee;
+  border-radius: .1em;
+}
+.fa-pull-left {
+  float: left;
+}
+.fa-pull-right {
+  float: right;
+}
+.fa.fa-pull-left {
+  margin-right: .3em;
+}
+.fa.fa-pull-right {
+  margin-left: .3em;
+}
+/* Deprecated as of 4.4.0 */
+.pull-right {
+  float: right;
+}
+.pull-left {
+  float: left;
+}
+.fa.pull-left {
+  margin-right: .3em;
+}
+.fa.pull-right {
+  margin-left: .3em;
+}
+.fa-spin {
+  -webkit-animation: fa-spin 2s infinite linear;
+  animation: fa-spin 2s infinite linear;
+}
+.fa-pulse {
+  -webkit-animation: fa-spin 1s infinite steps(8);
+  animation: fa-spin 1s infinite steps(8);
+}
+@-webkit-keyframes fa-spin {
+  0% {
+    -webkit-transform: rotate(0deg);
+    transform: rotate(0deg);
+  }
+  100% {
+    -webkit-transform: rotate(359deg);
+    transform: rotate(359deg);
+  }
+}
+@keyframes fa-spin {
+  0% {
+    -webkit-transform: rotate(0deg);
+    transform: rotate(0deg);
+  }
+  100% {
+    -webkit-transform: rotate(359deg);
+    transform: rotate(359deg);
+  }
+}
+.fa-rotate-90 {
+  -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=1)";
+  -webkit-transform: rotate(90deg);
+  -ms-transform: rotate(90deg);
+  transform: rotate(90deg);
+}
+.fa-rotate-180 {
+  -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=2)";
+  -webkit-transform: rotate(180deg);
+  -ms-transform: rotate(180deg);
+  transform: rotate(180deg);
+}
+.fa-rotate-270 {
+  -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=3)";
+  -webkit-transform: rotate(270deg);
+  -ms-transform: rotate(270deg);
+  transform: rotate(270deg);
+}
+.fa-flip-horizontal {
+  -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=0, mirror=1)";
+  -webkit-transform: scale(-1, 1);
+  -ms-transform: scale(-1, 1);
+  transform: scale(-1, 1);
+}
+.fa-flip-vertical {
+  -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=2, mirror=1)";
+  -webkit-transform: scale(1, -1);
+  -ms-transform: scale(1, -1);
+  transform: scale(1, -1);
+}
+:root .fa-rotate-90,
+:root .fa-rotate-180,
+:root .fa-rotate-270,
+:root .fa-flip-horizontal,
+:root .fa-flip-vertical {
+  filter: none;
+}
+.fa-stack {
+  position: relative;
+  display: inline-block;
+  width: 2em;
+  height: 2em;
+  line-height: 2em;
+  vertical-align: middle;
+}
+.fa-stack-1x,
+.fa-stack-2x {
+  position: absolute;
+  left: 0;
+  width: 100%;
+  text-align: center;
+}
+.fa-stack-1x {
+  line-height: inherit;
+}
+.fa-stack-2x {
+  font-size: 2em;
+}
+.fa-inverse {
+  color: #ffffff;
+}
+/* Font Awesome uses the Unicode Private Use Area (PUA) to ensure screen
+   readers do not read off random characters that represent icons */
+.fa-glass:before {
+  content: "\f000";
+}
+.fa-music:before {
+  content: "\f001";
+}
+.fa-search:before {
+  content: "\f002";
+}
+.fa-envelope-o:before {
+  content: "\f003";
+}
+.fa-heart:before {
+  content: "\f004";
+}
+.fa-star:before {
+  content: "\f005";
+}
+.fa-star-o:before {
+  content: "\f006";
+}
+.fa-user:before {
+  content: "\f007";
+}
+.fa-film:before {
+  content: "\f008";
+}
+.fa-th-large:before {
+  content: "\f009";
+}
+.fa-th:before {
+  content: "\f00a";
+}
+.fa-th-list:before {
+  content: "\f00b";
+}
+.fa-check:before {
+  content: "\f00c";
+}
+.fa-remove:before,
+.fa-close:before,
+.fa-times:before {
+  content: "\f00d";
+}
+.fa-search-plus:before {
+  content: "\f00e";
+}
+.fa-search-minus:before {
+  content: "\f010";
+}
+.fa-power-off:before {
+  content: "\f011";
+}
+.fa-signal:before {
+  content: "\f012";
+}
+.fa-gear:before,
+.fa-cog:before {
+  content: "\f013";
+}
+.fa-trash-o:before {
+  content: "\f014";
+}
+.fa-home:before {
+  content: "\f015";
+}
+.fa-file-o:before {
+  content: "\f016";
+}
+.fa-clock-o:before {
+  content: "\f017";
+}
+.fa-road:before {
+  content: "\f018";
+}
+.fa-download:before {
+  content: "\f019";
+}
+.fa-arrow-circle-o-down:before {
+  content: "\f01a";
+}
+.fa-arrow-circle-o-up:before {
+  content: "\f01b";
+}
+.fa-inbox:before {
+  content: "\f01c";
+}
+.fa-play-circle-o:before {
+  content: "\f01d";
+}
+.fa-rotate-right:before,
+.fa-repeat:before {
+  content: "\f01e";
+}
+.fa-refresh:before {
+  content: "\f021";
+}
+.fa-list-alt:before {
+  content: "\f022";
+}
+.fa-lock:before {
+  content: "\f023";
+}
+.fa-flag:before {
+  content: "\f024";
+}
+.fa-headphones:before {
+  content: "\f025";
+}
+.fa-volume-off:before {
+  content: "\f026";
+}
+.fa-volume-down:before {
+  content: "\f027";
+}
+.fa-volume-up:before {
+  content: "\f028";
+}
+.fa-qrcode:before {
+  content: "\f029";
+}
+.fa-barcode:before {
+  content: "\f02a";
+}
+.fa-tag:before {
+  content: "\f02b";
+}
+.fa-tags:before {
+  content: "\f02c";
+}
+.fa-book:before {
+  content: "\f02d";
+}
+.fa-bookmark:before {
+  content: "\f02e";
+}
+.fa-print:before {
+  content: "\f02f";
+}
+.fa-camera:before {
+  content: "\f030";
+}
+.fa-font:before {
+  content: "\f031";
+}
+.fa-bold:before {
+  content: "\f032";
+}
+.fa-italic:before {
+  content: "\f033";
+}
+.fa-text-height:before {
+  content: "\f034";
+}
+.fa-text-width:before {
+  content: "\f035";
+}
+.fa-align-left:before {
+  content: "\f036";
+}
+.fa-align-center:before {
+  content: "\f037";
+}
+.fa-align-right:before {
+  content: "\f038";
+}
+.fa-align-justify:before {
+  content: "\f039";
+}
+.fa-list:before {
+  content: "\f03a";
+}
+.fa-dedent:before,
+.fa-outdent:before {
+  content: "\f03b";
+}
+.fa-indent:before {
+  content: "\f03c";
+}
+.fa-video-camera:before {
+  content: "\f03d";
+}
+.fa-photo:before,
+.fa-image:before,
+.fa-picture-o:before {
+  content: "\f03e";
+}
+.fa-pencil:before {
+  content: "\f040";
+}
+.fa-map-marker:before {
+  content: "\f041";
+}
+.fa-adjust:before {
+  content: "\f042";
+}
+.fa-tint:before {
+  content: "\f043";
+}
+.fa-edit:before,
+.fa-pencil-square-o:before {
+  content: "\f044";
+}
+.fa-share-square-o:before {
+  content: "\f045";
+}
+.fa-check-square-o:before {
+  content: "\f046";
+}
+.fa-arrows:before {
+  content: "\f047";
+}
+.fa-step-backward:before {
+  content: "\f048";
+}
+.fa-fast-backward:before {
+  content: "\f049";
+}
+.fa-backward:before {
+  content: "\f04a";
+}
+.fa-play:before {
+  content: "\f04b";
+}
+.fa-pause:before {
+  content: "\f04c";
+}
+.fa-stop:before {
+  content: "\f04d";
+}
+.fa-forward:before {
+  content: "\f04e";
+}
+.fa-fast-forward:before {
+  content: "\f050";
+}
+.fa-step-forward:before {
+  content: "\f051";
+}
+.fa-eject:before {
+  content: "\f052";
+}
+.fa-chevron-left:before {
+  content: "\f053";
+}
+.fa-chevron-right:before {
+  content: "\f054";
+}
+.fa-plus-circle:before {
+  content: "\f055";
+}
+.fa-minus-circle:before {
+  content: "\f056";
+}
+.fa-times-circle:before {
+  content: "\f057";
+}
+.fa-check-circle:before {
+  content: "\f058";
+}
+.fa-question-circle:before {
+  content: "\f059";
+}
+.fa-info-circle:before {
+  content: "\f05a";
+}
+.fa-crosshairs:before {
+  content: "\f05b";
+}
+.fa-times-circle-o:before {
+  content: "\f05c";
+}
+.fa-check-circle-o:before {
+  content: "\f05d";
+}
+.fa-ban:before {
+  content: "\f05e";
+}
+.fa-arrow-left:before {
+  content: "\f060";
+}
+.fa-arrow-right:before {
+  content: "\f061";
+}
+.fa-arrow-up:before {
+  content: "\f062";
+}
+.fa-arrow-down:before {
+  content: "\f063";
+}
+.fa-mail-forward:before,
+.fa-share:before {
+  content: "\f064";
+}
+.fa-expand:before {
+  content: "\f065";
+}
+.fa-compress:before {
+  content: "\f066";
+}
+.fa-plus:before {
+  content: "\f067";
+}
+.fa-minus:before {
+  content: "\f068";
+}
+.fa-asterisk:before {
+  content: "\f069";
+}
+.fa-exclamation-circle:before {
+  content: "\f06a";
+}
+.fa-gift:before {
+  content: "\f06b";
+}
+.fa-leaf:before {
+  content: "\f06c";
+}
+.fa-fire:before {
+  content: "\f06d";
+}
+.fa-eye:before {
+  content: "\f06e";
+}
+.fa-eye-slash:before {
+  content: "\f070";
+}
+.fa-warning:before,
+.fa-exclamation-triangle:before {
+  content: "\f071";
+}
+.fa-plane:before {
+  content: "\f072";
+}
+.fa-calendar:before {
+  content: "\f073";
+}
+.fa-random:before {
+  content: "\f074";
+}
+.fa-comment:before {
+  content: "\f075";
+}
+.fa-magnet:before {
+  content: "\f076";
+}
+.fa-chevron-up:before {
+  content: "\f077";
+}
+.fa-chevron-down:before {
+  content: "\f078";
+}
+.fa-retweet:before {
+  content: "\f079";
+}
+.fa-shopping-cart:before {
+  content: "\f07a";
+}
+.fa-folder:before {
+  content: "\f07b";
+}
+.fa-folder-open:before {
+  content: "\f07c";
+}
+.fa-arrows-v:before {
+  content: "\f07d";
+}
+.fa-arrows-h:before {
+  content: "\f07e";
+}
+.fa-bar-chart-o:before,
+.fa-bar-chart:before {
+  content: "\f080";
+}
+.fa-twitter-square:before {
+  content: "\f081";
+}
+.fa-facebook-square:before {
+  content: "\f082";
+}
+.fa-camera-retro:before {
+  content: "\f083";
+}
+.fa-key:before {
+  content: "\f084";
+}
+.fa-gears:before,
+.fa-cogs:before {
+  content: "\f085";
+}
+.fa-comments:before {
+  content: "\f086";
+}
+.fa-thumbs-o-up:before {
+  content: "\f087";
+}
+.fa-thumbs-o-down:before {
+  content: "\f088";
+}
+.fa-star-half:before {
+  content: "\f089";
+}
+.fa-heart-o:before {
+  content: "\f08a";
+}
+.fa-sign-out:before {
+  content: "\f08b";
+}
+.fa-linkedin-square:before {
+  content: "\f08c";
+}
+.fa-thumb-tack:before {
+  content: "\f08d";
+}
+.fa-external-link:before {
+  content: "\f08e";
+}
+.fa-sign-in:before {
+  content: "\f090";
+}
+.fa-trophy:before {
+  content: "\f091";
+}
+.fa-github-square:before {
+  content: "\f092";
+}
+.fa-upload:before {
+  content: "\f093";
+}
+.fa-lemon-o:before {
+  content: "\f094";
+}
+.fa-phone:before {
+  content: "\f095";
+}
+.fa-square-o:before {
+  content: "\f096";
+}
+.fa-bookmark-o:before {
+  content: "\f097";
+}
+.fa-phone-square:before {
+  content: "\f098";
+}
+.fa-twitter:before {
+  content: "\f099";
+}
+.fa-facebook-f:before,
+.fa-facebook:before {
+  content: "\f09a";
+}
+.fa-github:before {
+  content: "\f09b";
+}
+.fa-unlock:before {
+  content: "\f09c";
+}
+.fa-credit-card:before {
+  content: "\f09d";
+}
+.fa-feed:before,
+.fa-rss:before {
+  content: "\f09e";
+}
+.fa-hdd-o:before {
+  content: "\f0a0";
+}
+.fa-bullhorn:before {
+  content: "\f0a1";
+}
+.fa-bell:before {
+  content: "\f0f3";
+}
+.fa-certificate:before {
+  content: "\f0a3";
+}
+.fa-hand-o-right:before {
+  content: "\f0a4";
+}
+.fa-hand-o-left:before {
+  content: "\f0a5";
+}
+.fa-hand-o-up:before {
+  content: "\f0a6";
+}
+.fa-hand-o-down:before {
+  content: "\f0a7";
+}
+.fa-arrow-circle-left:before {
+  content: "\f0a8";
+}
+.fa-arrow-circle-right:before {
+  content: "\f0a9";
+}
+.fa-arrow-circle-up:before {
+  content: "\f0aa";
+}
+.fa-arrow-circle-down:before {
+  content: "\f0ab";
+}
+.fa-globe:before {
+  content: "\f0ac";
+}
+.fa-wrench:before {
+  content: "\f0ad";
+}
+.fa-tasks:before {
+  content: "\f0ae";
+}
+.fa-filter:before {
+  content: "\f0b0";
+}
+.fa-briefcase:before {
+  content: "\f0b1";
+}
+.fa-arrows-alt:before {
+  content: "\f0b2";
+}
+.fa-group:before,
+.fa-users:before {
+  content: "\f0c0";
+}
+.fa-chain:before,
+.fa-link:before {
+  content: "\f0c1";
+}
+.fa-cloud:before {
+  content: "\f0c2";
+}
+.fa-flask:before {
+  content: "\f0c3";
+}
+.fa-cut:before,
+.fa-scissors:before {
+  content: "\f0c4";
+}
+.fa-copy:before,
+.fa-files-o:before {
+  content: "\f0c5";
+}
+.fa-paperclip:before {
+  content: "\f0c6";
+}
+.fa-save:before,
+.fa-floppy-o:before {
+  content: "\f0c7";
+}
+.fa-square:before {
+  content: "\f0c8";
+}
+.fa-navicon:before,
+.fa-reorder:before,
+.fa-bars:before {
+  content: "\f0c9";
+}
+.fa-list-ul:before {
+  content: "\f0ca";
+}
+.fa-list-ol:before {
+  content: "\f0cb";
+}
+.fa-strikethrough:before {
+  content: "\f0cc";
+}
+.fa-underline:before {
+  content: "\f0cd";
+}
+.fa-table:before {
+  content: "\f0ce";
+}
+.fa-magic:before {
+  content: "\f0d0";
+}
+.fa-truck:before {
+  content: "\f0d1";
+}
+.fa-pinterest:before {
+  content: "\f0d2";
+}
+.fa-pinterest-square:before {
+  content: "\f0d3";
+}
+.fa-google-plus-square:before {
+  content: "\f0d4";
+}
+.fa-google-plus:before {
+  content: "\f0d5";
+}
+.fa-money:before {
+  content: "\f0d6";
+}
+.fa-caret-down:before {
+  content: "\f0d7";
+}
+.fa-caret-up:before {
+  content: "\f0d8";
+}
+.fa-caret-left:before {
+  content: "\f0d9";
+}
+.fa-caret-right:before {
+  content: "\f0da";
+}
+.fa-columns:before {
+  content: "\f0db";
+}
+.fa-unsorted:before,
+.fa-sort:before {
+  content: "\f0dc";
+}
+.fa-sort-down:before,
+.fa-sort-desc:before {
+  content: "\f0dd";
+}
+.fa-sort-up:before,
+.fa-sort-asc:before {
+  content: "\f0de";
+}
+.fa-envelope:before {
+  content: "\f0e0";
+}
+.fa-linkedin:before {
+  content: "\f0e1";
+}
+.fa-rotate-left:before,
+.fa-undo:before {
+  content: "\f0e2";
+}
+.fa-legal:before,
+.fa-gavel:before {
+  content: "\f0e3";
+}
+.fa-dashboard:before,
+.fa-tachometer:before {
+  content: "\f0e4";
+}
+.fa-comment-o:before {
+  content: "\f0e5";
+}
+.fa-comments-o:before {
+  content: "\f0e6";
+}
+.fa-flash:before,
+.fa-bolt:before {
+  content: "\f0e7";
+}
+.fa-sitemap:before {
+  content: "\f0e8";
+}
+.fa-umbrella:before {
+  content: "\f0e9";
+}
+.fa-paste:before,
+.fa-clipboard:before {
+  content: "\f0ea";
+}
+.fa-lightbulb-o:before {
+  content: "\f0eb";
+}
+.fa-exchange:before {
+  content: "\f0ec";
+}
+.fa-cloud-download:before {
+  content: "\f0ed";
+}
+.fa-cloud-upload:before {
+  content: "\f0ee";
+}
+.fa-user-md:before {
+  content: "\f0f0";
+}
+.fa-stethoscope:before {
+  content: "\f0f1";
+}
+.fa-suitcase:before {
+  content: "\f0f2";
+}
+.fa-bell-o:before {
+  content: "\f0a2";
+}
+.fa-coffee:before {
+  content: "\f0f4";
+}
+.fa-cutlery:before {
+  content: "\f0f5";
+}
+.fa-file-text-o:before {
+  content: "\f0f6";
+}
+.fa-building-o:before {
+  content: "\f0f7";
+}
+.fa-hospital-o:before {
+  content: "\f0f8";
+}
+.fa-ambulance:before {
+  content: "\f0f9";
+}
+.fa-medkit:before {
+  content: "\f0fa";
+}
+.fa-fighter-jet:before {
+  content: "\f0fb";
+}
+.fa-beer:before {
+  content: "\f0fc";
+}
+.fa-h-square:before {
+  content: "\f0fd";
+}
+.fa-plus-square:before {
+  content: "\f0fe";
+}
+.fa-angle-double-left:before {
+  content: "\f100";
+}
+.fa-angle-double-right:before {
+  content: "\f101";
+}
+.fa-angle-double-up:before {
+  content: "\f102";
+}
+.fa-angle-double-down:before {
+  content: "\f103";
+}
+.fa-angle-left:before {
+  content: "\f104";
+}
+.fa-angle-right:before {
+  content: "\f105";
+}
+.fa-angle-up:before {
+  content: "\f106";
+}
+.fa-angle-down:before {
+  content: "\f107";
+}
+.fa-desktop:before {
+  content: "\f108";
+}
+.fa-laptop:before {
+  content: "\f109";
+}
+.fa-tablet:before {
+  content: "\f10a";
+}
+.fa-mobile-phone:before,
+.fa-mobile:before {
+  content: "\f10b";
+}
+.fa-circle-o:before {
+  content: "\f10c";
+}
+.fa-quote-left:before {
+  content: "\f10d";
+}
+.fa-quote-right:before {
+  content: "\f10e";
+}
+.fa-spinner:before {
+  content: "\f110";
+}
+.fa-circle:before {
+  content: "\f111";
+}
+.fa-mail-reply:before,
+.fa-reply:before {
+  content: "\f112";
+}
+.fa-github-alt:before {
+  content: "\f113";
+}
+.fa-folder-o:before {
+  content: "\f114";
+}
+.fa-folder-open-o:before {
+  content: "\f115";
+}
+.fa-smile-o:before {
+  content: "\f118";
+}
+.fa-frown-o:before {
+  content: "\f119";
+}
+.fa-meh-o:before {
+  content: "\f11a";
+}
+.fa-gamepad:before {
+  content: "\f11b";
+}
+.fa-keyboard-o:before {
+  content: "\f11c";
+}
+.fa-flag-o:before {
+  content: "\f11d";
+}
+.fa-flag-checkered:before {
+  content: "\f11e";
+}
+.fa-terminal:before {
+  content: "\f120";
+}
+.fa-code:before {
+  content: "\f121";
+}
+.fa-mail-reply-all:before,
+.fa-reply-all:before {
+  content: "\f122";
+}
+.fa-star-half-empty:before,
+.fa-star-half-full:before,
+.fa-star-half-o:before {
+  content: "\f123";
+}
+.fa-location-arrow:before {
+  content: "\f124";
+}
+.fa-crop:before {
+  content: "\f125";
+}
+.fa-code-fork:before {
+  content: "\f126";
+}
+.fa-unlink:before,
+.fa-chain-broken:before {
+  content: "\f127";
+}
+.fa-question:before {
+  content: "\f128";
+}
+.fa-info:before {
+  content: "\f129";
+}
+.fa-exclamation:before {
+  content: "\f12a";
+}
+.fa-superscript:before {
+  content: "\f12b";
+}
+.fa-subscript:before {
+  content: "\f12c";
+}
+.fa-eraser:before {
+  content: "\f12d";
+}
+.fa-puzzle-piece:before {
+  content: "\f12e";
+}
+.fa-microphone:before {
+  content: "\f130";
+}
+.fa-microphone-slash:before {
+  content: "\f131";
+}
+.fa-shield:before {
+  content: "\f132";
+}
+.fa-calendar-o:before {
+  content: "\f133";
+}
+.fa-fire-extinguisher:before {
+  content: "\f134";
+}
+.fa-rocket:before {
+  content: "\f135";
+}
+.fa-maxcdn:before {
+  content: "\f136";
+}
+.fa-chevron-circle-left:before {
+  content: "\f137";
+}
+.fa-chevron-circle-right:before {
+  content: "\f138";
+}
+.fa-chevron-circle-up:before {
+  content: "\f139";
+}
+.fa-chevron-circle-down:before {
+  content: "\f13a";
+}
+.fa-html5:before {
+  content: "\f13b";
+}
+.fa-css3:before {
+  content: "\f13c";
+}
+.fa-anchor:before {
+  content: "\f13d";
+}
+.fa-unlock-alt:before {
+  content: "\f13e";
+}
+.fa-bullseye:before {
+  content: "\f140";
+}
+.fa-ellipsis-h:before {
+  content: "\f141";
+}
+.fa-ellipsis-v:before {
+  content: "\f142";
+}
+.fa-rss-square:before {
+  content: "\f143";
+}
+.fa-play-circle:before {
+  content: "\f144";
+}
+.fa-ticket:before {
+  content: "\f145";
+}
+.fa-minus-square:before {
+  content: "\f146";
+}
+.fa-minus-square-o:before {
+  content: "\f147";
+}
+.fa-level-up:before {
+  content: "\f148";
+}
+.fa-level-down:before {
+  content: "\f149";
+}
+.fa-check-square:before {
+  content: "\f14a";
+}
+.fa-pencil-square:before {
+  content: "\f14b";
+}
+.fa-external-link-square:before {
+  content: "\f14c";
+}
+.fa-share-square:before {
+  content: "\f14d";
+}
+.fa-compass:before {
+  content: "\f14e";
+}
+.fa-toggle-down:before,
+.fa-caret-square-o-down:before {
+  content: "\f150";
+}
+.fa-toggle-up:before,
+.fa-caret-square-o-up:before {
+  content: "\f151";
+}
+.fa-toggle-right:before,
+.fa-caret-square-o-right:before {
+  content: "\f152";
+}
+.fa-euro:before,
+.fa-eur:before {
+  content: "\f153";
+}
+.fa-gbp:before {
+  content: "\f154";
+}
+.fa-dollar:before,
+.fa-usd:before {
+  content: "\f155";
+}
+.fa-rupee:before,
+.fa-inr:before {
+  content: "\f156";
+}
+.fa-cny:before,
+.fa-rmb:before,
+.fa-yen:before,
+.fa-jpy:before {
+  content: "\f157";
+}
+.fa-ruble:before,
+.fa-rouble:before,
+.fa-rub:before {
+  content: "\f158";
+}
+.fa-won:before,
+.fa-krw:before {
+  content: "\f159";
+}
+.fa-bitcoin:before,
+.fa-btc:before {
+  content: "\f15a";
+}
+.fa-file:before {
+  content: "\f15b";
+}
+.fa-file-text:before {
+  content: "\f15c";
+}
+.fa-sort-alpha-asc:before {
+  content: "\f15d";
+}
+.fa-sort-alpha-desc:before {
+  content: "\f15e";
+}
+.fa-sort-amount-asc:before {
+  content: "\f160";
+}
+.fa-sort-amount-desc:before {
+  content: "\f161";
+}
+.fa-sort-numeric-asc:before {
+  content: "\f162";
+}
+.fa-sort-numeric-desc:before {
+  content: "\f163";
+}
+.fa-thumbs-up:before {
+  content: "\f164";
+}
+.fa-thumbs-down:before {
+  content: "\f165";
+}
+.fa-youtube-square:before {
+  content: "\f166";
+}
+.fa-youtube:before {
+  content: "\f167";
+}
+.fa-xing:before {
+  content: "\f168";
+}
+.fa-xing-square:before {
+  content: "\f169";
+}
+.fa-youtube-play:before {
+  content: "\f16a";
+}
+.fa-dropbox:before {
+  content: "\f16b";
+}
+.fa-stack-overflow:before {
+  content: "\f16c";
+}
+.fa-instagram:before {
+  content: "\f16d";
+}
+.fa-flickr:before {
+  content: "\f16e";
+}
+.fa-adn:before {
+  content: "\f170";
+}
+.fa-bitbucket:before {
+  content: "\f171";
+}
+.fa-bitbucket-square:before {
+  content: "\f172";
+}
+.fa-tumblr:before {
+  content: "\f173";
+}
+.fa-tumblr-square:before {
+  content: "\f174";
+}
+.fa-long-arrow-down:before {
+  content: "\f175";
+}
+.fa-long-arrow-up:before {
+  content: "\f176";
+}
+.fa-long-arrow-left:before {
+  content: "\f177";
+}
+.fa-long-arrow-right:before {
+  content: "\f178";
+}
+.fa-apple:before {
+  content: "\f179";
+}
+.fa-windows:before {
+  content: "\f17a";
+}
+.fa-android:before {
+  content: "\f17b";
+}
+.fa-linux:before {
+  content: "\f17c";
+}
+.fa-dribbble:before {
+  content: "\f17d";
+}
+.fa-skype:before {
+  content: "\f17e";
+}
+.fa-foursquare:before {
+  content: "\f180";
+}
+.fa-trello:before {
+  content: "\f181";
+}
+.fa-female:before {
+  content: "\f182";
+}
+.fa-male:before {
+  content: "\f183";
+}
+.fa-gittip:before,
+.fa-gratipay:before {
+  content: "\f184";
+}
+.fa-sun-o:before {
+  content: "\f185";
+}
+.fa-moon-o:before {
+  content: "\f186";
+}
+.fa-archive:before {
+  content: "\f187";
+}
+.fa-bug:before {
+  content: "\f188";
+}
+.fa-vk:before {
+  content: "\f189";
+}
+.fa-weibo:before {
+  content: "\f18a";
+}
+.fa-renren:before {
+  content: "\f18b";
+}
+.fa-pagelines:before {
+  content: "\f18c";
+}
+.fa-stack-exchange:before {
+  content: "\f18d";
+}
+.fa-arrow-circle-o-right:before {
+  content: "\f18e";
+}
+.fa-arrow-circle-o-left:before {
+  content: "\f190";
+}
+.fa-toggle-left:before,
+.fa-caret-square-o-left:before {
+  content: "\f191";
+}
+.fa-dot-circle-o:before {
+  content: "\f192";
+}
+.fa-wheelchair:before {
+  content: "\f193";
+}
+.fa-vimeo-square:before {
+  content: "\f194";
+}
+.fa-turkish-lira:before,
+.fa-try:before {
+  content: "\f195";
+}
+.fa-plus-square-o:before {
+  content: "\f196";
+}
+.fa-space-shuttle:before {
+  content: "\f197";
+}
+.fa-slack:before {
+  content: "\f198";
+}
+.fa-envelope-square:before {
+  content: "\f199";
+}
+.fa-wordpress:before {
+  content: "\f19a";
+}
+.fa-openid:before {
+  content: "\f19b";
+}
+.fa-institution:before,
+.fa-bank:before,
+.fa-university:before {
+  content: "\f19c";
+}
+.fa-mortar-board:before,
+.fa-graduation-cap:before {
+  content: "\f19d";
+}
+.fa-yahoo:before {
+  content: "\f19e";
+}
+.fa-google:before {
+  content: "\f1a0";
+}
+.fa-reddit:before {
+  content: "\f1a1";
+}
+.fa-reddit-square:before {
+  content: "\f1a2";
+}
+.fa-stumbleupon-circle:before {
+  content: "\f1a3";
+}
+.fa-stumbleupon:before {
+  content: "\f1a4";
+}
+.fa-delicious:before {
+  content: "\f1a5";
+}
+.fa-digg:before {
+  content: "\f1a6";
+}
+.fa-pied-piper-pp:before {
+  content: "\f1a7";
+}
+.fa-pied-piper-alt:before {
+  content: "\f1a8";
+}
+.fa-drupal:before {
+  content: "\f1a9";
+}
+.fa-joomla:before {
+  content: "\f1aa";
+}
+.fa-language:before {
+  content: "\f1ab";
+}
+.fa-fax:before {
+  content: "\f1ac";
+}
+.fa-building:before {
+  content: "\f1ad";
+}
+.fa-child:before {
+  content: "\f1ae";
+}
+.fa-paw:before {
+  content: "\f1b0";
+}
+.fa-spoon:before {
+  content: "\f1b1";
+}
+.fa-cube:before {
+  content: "\f1b2";
+}
+.fa-cubes:before {
+  content: "\f1b3";
+}
+.fa-behance:before {
+  content: "\f1b4";
+}
+.fa-behance-square:before {
+  content: "\f1b5";
+}
+.fa-steam:before {
+  content: "\f1b6";
+}
+.fa-steam-square:before {
+  content: "\f1b7";
+}
+.fa-recycle:before {
+  content: "\f1b8";
+}
+.fa-automobile:before,
+.fa-car:before {
+  content: "\f1b9";
+}
+.fa-cab:before,
+.fa-taxi:before {
+  content: "\f1ba";
+}
+.fa-tree:before {
+  content: "\f1bb";
+}
+.fa-spotify:before {
+  content: "\f1bc";
+}
+.fa-deviantart:before {
+  content: "\f1bd";
+}
+.fa-soundcloud:before {
+  content: "\f1be";
+}
+.fa-database:before {
+  content: "\f1c0";
+}
+.fa-file-pdf-o:before {
+  content: "\f1c1";
+}
+.fa-file-word-o:before {
+  content: "\f1c2";
+}
+.fa-file-excel-o:before {
+  content: "\f1c3";
+}
+.fa-file-powerpoint-o:before {
+  content: "\f1c4";
+}
+.fa-file-photo-o:before,
+.fa-file-picture-o:before,
+.fa-file-image-o:before {
+  content: "\f1c5";
+}
+.fa-file-zip-o:before,
+.fa-file-archive-o:before {
+  content: "\f1c6";
+}
+.fa-file-sound-o:before,
+.fa-file-audio-o:before {
+  content: "\f1c7";
+}
+.fa-file-movie-o:before,
+.fa-file-video-o:before {
+  content: "\f1c8";
+}
+.fa-file-code-o:before {
+  content: "\f1c9";
+}
+.fa-vine:before {
+  content: "\f1ca";
+}
+.fa-codepen:before {
+  content: "\f1cb";
+}
+.fa-jsfiddle:before {
+  content: "\f1cc";
+}
+.fa-life-bouy:before,
+.fa-life-buoy:before,
+.fa-life-saver:before,
+.fa-support:before,
+.fa-life-ring:before {
+  content: "\f1cd";
+}
+.fa-circle-o-notch:before {
+  content: "\f1ce";
+}
+.fa-ra:before,
+.fa-resistance:before,
+.fa-rebel:before {
+  content: "\f1d0";
+}
+.fa-ge:before,
+.fa-empire:before {
+  content: "\f1d1";
+}
+.fa-git-square:before {
+  content: "\f1d2";
+}
+.fa-git:before {
+  content: "\f1d3";
+}
+.fa-y-combinator-square:before,
+.fa-yc-square:before,
+.fa-hacker-news:before {
+  content: "\f1d4";
+}
+.fa-tencent-weibo:before {
+  content: "\f1d5";
+}
+.fa-qq:before {
+  content: "\f1d6";
+}
+.fa-wechat:before,
+.fa-weixin:before {
+  content: "\f1d7";
+}
+.fa-send:before,
+.fa-paper-plane:before {
+  content: "\f1d8";
+}
+.fa-send-o:before,
+.fa-paper-plane-o:before {
+  content: "\f1d9";
+}
+.fa-history:before {
+  content: "\f1da";
+}
+.fa-circle-thin:before {
+  content: "\f1db";
+}
+.fa-header:before {
+  content: "\f1dc";
+}
+.fa-paragraph:before {
+  content: "\f1dd";
+}
+.fa-sliders:before {
+  content: "\f1de";
+}
+.fa-share-alt:before {
+  content: "\f1e0";
+}
+.fa-share-alt-square:before {
+  content: "\f1e1";
+}
+.fa-bomb:before {
+  content: "\f1e2";
+}
+.fa-soccer-ball-o:before,
+.fa-futbol-o:before {
+  content: "\f1e3";
+}
+.fa-tty:before {
+  content: "\f1e4";
+}
+.fa-binoculars:before {
+  content: "\f1e5";
+}
+.fa-plug:before {
+  content: "\f1e6";
+}
+.fa-slideshare:before {
+  content: "\f1e7";
+}
+.fa-twitch:before {
+  content: "\f1e8";
+}
+.fa-yelp:before {
+  content: "\f1e9";
+}
+.fa-newspaper-o:before {
+  content: "\f1ea";
+}
+.fa-wifi:before {
+  content: "\f1eb";
+}
+.fa-calculator:before {
+  content: "\f1ec";
+}
+.fa-paypal:before {
+  content: "\f1ed";
+}
+.fa-google-wallet:before {
+  content: "\f1ee";
+}
+.fa-cc-visa:before {
+  content: "\f1f0";
+}
+.fa-cc-mastercard:before {
+  content: "\f1f1";
+}
+.fa-cc-discover:before {
+  content: "\f1f2";
+}
+.fa-cc-amex:before {
+  content: "\f1f3";
+}
+.fa-cc-paypal:before {
+  content: "\f1f4";
+}
+.fa-cc-stripe:before {
+  content: "\f1f5";
+}
+.fa-bell-slash:before {
+  content: "\f1f6";
+}
+.fa-bell-slash-o:before {
+  content: "\f1f7";
+}
+.fa-trash:before {
+  content: "\f1f8";
+}
+.fa-copyright:before {
+  content: "\f1f9";
+}
+.fa-at:before {
+  content: "\f1fa";
+}
+.fa-eyedropper:before {
+  content: "\f1fb";
+}
+.fa-paint-brush:before {
+  content: "\f1fc";
+}
+.fa-birthday-cake:before {
+  content: "\f1fd";
+}
+.fa-area-chart:before {
+  content: "\f1fe";
+}
+.fa-pie-chart:before {
+  content: "\f200";
+}
+.fa-line-chart:before {
+  content: "\f201";
+}
+.fa-lastfm:before {
+  content: "\f202";
+}
+.fa-lastfm-square:before {
+  content: "\f203";
+}
+.fa-toggle-off:before {
+  content: "\f204";
+}
+.fa-toggle-on:before {
+  content: "\f205";
+}
+.fa-bicycle:before {
+  content: "\f206";
+}
+.fa-bus:before {
+  content: "\f207";
+}
+.fa-ioxhost:before {
+  content: "\f208";
+}
+.fa-angellist:before {
+  content: "\f209";
+}
+.fa-cc:before {
+  content: "\f20a";
+}
+.fa-shekel:before,
+.fa-sheqel:before,
+.fa-ils:before {
+  content: "\f20b";
+}
+.fa-meanpath:before {
+  content: "\f20c";
+}
+.fa-buysellads:before {
+  content: "\f20d";
+}
+.fa-connectdevelop:before {
+  content: "\f20e";
+}
+.fa-dashcube:before {
+  content: "\f210";
+}
+.fa-forumbee:before {
+  content: "\f211";
+}
+.fa-leanpub:before {
+  content: "\f212";
+}
+.fa-sellsy:before {
+  content: "\f213";
+}
+.fa-shirtsinbulk:before {
+  content: "\f214";
+}
+.fa-simplybuilt:before {
+  content: "\f215";
+}
+.fa-skyatlas:before {
+  content: "\f216";
+}
+.fa-cart-plus:before {
+  content: "\f217";
+}
+.fa-cart-arrow-down:before {
+  content: "\f218";
+}
+.fa-diamond:before {
+  content: "\f219";
+}
+.fa-ship:before {
+  content: "\f21a";
+}
+.fa-user-secret:before {
+  content: "\f21b";
+}
+.fa-motorcycle:before {
+  content: "\f21c";
+}
+.fa-street-view:before {
+  content: "\f21d";
+}
+.fa-heartbeat:before {
+  content: "\f21e";
+}
+.fa-venus:before {
+  content: "\f221";
+}
+.fa-mars:before {
+  content: "\f222";
+}
+.fa-mercury:before {
+  content: "\f223";
+}
+.fa-intersex:before,
+.fa-transgender:before {
+  content: "\f224";
+}
+.fa-transgender-alt:before {
+  content: "\f225";
+}
+.fa-venus-double:before {
+  content: "\f226";
+}
+.fa-mars-double:before {
+  content: "\f227";
+}
+.fa-venus-mars:before {
+  content: "\f228";
+}
+.fa-mars-stroke:before {
+  content: "\f229";
+}
+.fa-mars-stroke-v:before {
+  content: "\f22a";
+}
+.fa-mars-stroke-h:before {
+  content: "\f22b";
+}
+.fa-neuter:before {
+  content: "\f22c";
+}
+.fa-genderless:before {
+  content: "\f22d";
+}
+.fa-facebook-official:before {
+  content: "\f230";
+}
+.fa-pinterest-p:before {
+  content: "\f231";
+}
+.fa-whatsapp:before {
+  content: "\f232";
+}
+.fa-server:before {
+  content: "\f233";
+}
+.fa-user-plus:before {
+  content: "\f234";
+}
+.fa-user-times:before {
+  content: "\f235";
+}
+.fa-hotel:before,
+.fa-bed:before {
+  content: "\f236";
+}
+.fa-viacoin:before {
+  content: "\f237";
+}
+.fa-train:before {
+  content: "\f238";
+}
+.fa-subway:before {
+  content: "\f239";
+}
+.fa-medium:before {
+  content: "\f23a";
+}
+.fa-yc:before,
+.fa-y-combinator:before {
+  content: "\f23b";
+}
+.fa-optin-monster:before {
+  content: "\f23c";
+}
+.fa-opencart:before {
+  content: "\f23d";
+}
+.fa-expeditedssl:before {
+  content: "\f23e";
+}
+.fa-battery-4:before,
+.fa-battery:before,
+.fa-battery-full:before {
+  content: "\f240";
+}
+.fa-battery-3:before,
+.fa-battery-three-quarters:before {
+  content: "\f241";
+}
+.fa-battery-2:before,
+.fa-battery-half:before {
+  content: "\f242";
+}
+.fa-battery-1:before,
+.fa-battery-quarter:before {
+  content: "\f243";
+}
+.fa-battery-0:before,
+.fa-battery-empty:before {
+  content: "\f244";
+}
+.fa-mouse-pointer:before {
+  content: "\f245";
+}
+.fa-i-cursor:before {
+  content: "\f246";
+}
+.fa-object-group:before {
+  content: "\f247";
+}
+.fa-object-ungroup:before {
+  content: "\f248";
+}
+.fa-sticky-note:before {
+  content: "\f249";
+}
+.fa-sticky-note-o:before {
+  content: "\f24a";
+}
+.fa-cc-jcb:before {
+  content: "\f24b";
+}
+.fa-cc-diners-club:before {
+  content: "\f24c";
+}
+.fa-clone:before {
+  content: "\f24d";
+}
+.fa-balance-scale:before {
+  content: "\f24e";
+}
+.fa-hourglass-o:before {
+  content: "\f250";
+}
+.fa-hourglass-1:before,
+.fa-hourglass-start:before {
+  content: "\f251";
+}
+.fa-hourglass-2:before,
+.fa-hourglass-half:before {
+  content: "\f252";
+}
+.fa-hourglass-3:before,
+.fa-hourglass-end:before {
+  content: "\f253";
+}
+.fa-hourglass:before {
+  content: "\f254";
+}
+.fa-hand-grab-o:before,
+.fa-hand-rock-o:before {
+  content: "\f255";
+}
+.fa-hand-stop-o:before,
+.fa-hand-paper-o:before {
+  content: "\f256";
+}
+.fa-hand-scissors-o:before {
+  content: "\f257";
+}
+.fa-hand-lizard-o:before {
+  content: "\f258";
+}
+.fa-hand-spock-o:before {
+  content: "\f259";
+}
+.fa-hand-pointer-o:before {
+  content: "\f25a";
+}
+.fa-hand-peace-o:before {
+  content: "\f25b";
+}
+.fa-trademark:before {
+  content: "\f25c";
+}
+.fa-registered:before {
+  content: "\f25d";
+}
+.fa-creative-commons:before {
+  content: "\f25e";
+}
+.fa-gg:before {
+  content: "\f260";
+}
+.fa-gg-circle:before {
+  content: "\f261";
+}
+.fa-tripadvisor:before {
+  content: "\f262";
+}
+.fa-odnoklassniki:before {
+  content: "\f263";
+}
+.fa-odnoklassniki-square:before {
+  content: "\f264";
+}
+.fa-get-pocket:before {
+  content: "\f265";
+}
+.fa-wikipedia-w:before {
+  content: "\f266";
+}
+.fa-safari:before {
+  content: "\f267";
+}
+.fa-chrome:before {
+  content: "\f268";
+}
+.fa-firefox:before {
+  content: "\f269";
+}
+.fa-opera:before {
+  content: "\f26a";
+}
+.fa-internet-explorer:before {
+  content: "\f26b";
+}
+.fa-tv:before,
+.fa-television:before {
+  content: "\f26c";
+}
+.fa-contao:before {
+  content: "\f26d";
+}
+.fa-500px:before {
+  content: "\f26e";
+}
+.fa-amazon:before {
+  content: "\f270";
+}
+.fa-calendar-plus-o:before {
+  content: "\f271";
+}
+.fa-calendar-minus-o:before {
+  content: "\f272";
+}
+.fa-calendar-times-o:before {
+  content: "\f273";
+}
+.fa-calendar-check-o:before {
+  content: "\f274";
+}
+.fa-industry:before {
+  content: "\f275";
+}
+.fa-map-pin:before {
+  content: "\f276";
+}
+.fa-map-signs:before {
+  content: "\f277";
+}
+.fa-map-o:before {
+  content: "\f278";
+}
+.fa-map:before {
+  content: "\f279";
+}
+.fa-commenting:before {
+  content: "\f27a";
+}
+.fa-commenting-o:before {
+  content: "\f27b";
+}
+.fa-houzz:before {
+  content: "\f27c";
+}
+.fa-vimeo:before {
+  content: "\f27d";
+}
+.fa-black-tie:before {
+  content: "\f27e";
+}
+.fa-fonticons:before {
+  content: "\f280";
+}
+.fa-reddit-alien:before {
+  content: "\f281";
+}
+.fa-edge:before {
+  content: "\f282";
+}
+.fa-credit-card-alt:before {
+  content: "\f283";
+}
+.fa-codiepie:before {
+  content: "\f284";
+}
+.fa-modx:before {
+  content: "\f285";
+}
+.fa-fort-awesome:before {
+  content: "\f286";
+}
+.fa-usb:before {
+  content: "\f287";
+}
+.fa-product-hunt:before {
+  content: "\f288";
+}
+.fa-mixcloud:before {
+  content: "\f289";
+}
+.fa-scribd:before {
+  content: "\f28a";
+}
+.fa-pause-circle:before {
+  content: "\f28b";
+}
+.fa-pause-circle-o:before {
+  content: "\f28c";
+}
+.fa-stop-circle:before {
+  content: "\f28d";
+}
+.fa-stop-circle-o:before {
+  content: "\f28e";
+}
+.fa-shopping-bag:before {
+  content: "\f290";
+}
+.fa-shopping-basket:before {
+  content: "\f291";
+}
+.fa-hashtag:before {
+  content: "\f292";
+}
+.fa-bluetooth:before {
+  content: "\f293";
+}
+.fa-bluetooth-b:before {
+  content: "\f294";
+}
+.fa-percent:before {
+  content: "\f295";
+}
+.fa-gitlab:before {
+  content: "\f296";
+}
+.fa-wpbeginner:before {
+  content: "\f297";
+}
+.fa-wpforms:before {
+  content: "\f298";
+}
+.fa-envira:before {
+  content: "\f299";
+}
+.fa-universal-access:before {
+  content: "\f29a";
+}
+.fa-wheelchair-alt:before {
+  content: "\f29b";
+}
+.fa-question-circle-o:before {
+  content: "\f29c";
+}
+.fa-blind:before {
+  content: "\f29d";
+}
+.fa-audio-description:before {
+  content: "\f29e";
+}
+.fa-volume-control-phone:before {
+  content: "\f2a0";
+}
+.fa-braille:before {
+  content: "\f2a1";
+}
+.fa-assistive-listening-systems:before {
+  content: "\f2a2";
+}
+.fa-asl-interpreting:before,
+.fa-american-sign-language-interpreting:before {
+  content: "\f2a3";
+}
+.fa-deafness:before,
+.fa-hard-of-hearing:before,
+.fa-deaf:before {
+  content: "\f2a4";
+}
+.fa-glide:before {
+  content: "\f2a5";
+}
+.fa-glide-g:before {
+  content: "\f2a6";
+}
+.fa-signing:before,
+.fa-sign-language:before {
+  content: "\f2a7";
+}
+.fa-low-vision:before {
+  content: "\f2a8";
+}
+.fa-viadeo:before {
+  content: "\f2a9";
+}
+.fa-viadeo-square:before {
+  content: "\f2aa";
+}
+.fa-snapchat:before {
+  content: "\f2ab";
+}
+.fa-snapchat-ghost:before {
+  content: "\f2ac";
+}
+.fa-snapchat-square:before {
+  content: "\f2ad";
+}
+.fa-pied-piper:before {
+  content: "\f2ae";
+}
+.fa-first-order:before {
+  content: "\f2b0";
+}
+.fa-yoast:before {
+  content: "\f2b1";
+}
+.fa-themeisle:before {
+  content: "\f2b2";
+}
+.fa-google-plus-circle:before,
+.fa-google-plus-official:before {
+  content: "\f2b3";
+}
+.fa-fa:before,
+.fa-font-awesome:before {
+  content: "\f2b4";
+}
+.fa-handshake-o:before {
+  content: "\f2b5";
+}
+.fa-envelope-open:before {
+  content: "\f2b6";
+}
+.fa-envelope-open-o:before {
+  content: "\f2b7";
+}
+.fa-linode:before {
+  content: "\f2b8";
+}
+.fa-address-book:before {
+  content: "\f2b9";
+}
+.fa-address-book-o:before {
+  content: "\f2ba";
+}
+.fa-vcard:before,
+.fa-address-card:before {
+  content: "\f2bb";
+}
+.fa-vcard-o:before,
+.fa-address-card-o:before {
+  content: "\f2bc";
+}
+.fa-user-circle:before {
+  content: "\f2bd";
+}
+.fa-user-circle-o:before {
+  content: "\f2be";
+}
+.fa-user-o:before {
+  content: "\f2c0";
+}
+.fa-id-badge:before {
+  content: "\f2c1";
+}
+.fa-drivers-license:before,
+.fa-id-card:before {
+  content: "\f2c2";
+}
+.fa-drivers-license-o:before,
+.fa-id-card-o:before {
+  content: "\f2c3";
+}
+.fa-quora:before {
+  content: "\f2c4";
+}
+.fa-free-code-camp:before {
+  content: "\f2c5";
+}
+.fa-telegram:before {
+  content: "\f2c6";
+}
+.fa-thermometer-4:before,
+.fa-thermometer:before,
+.fa-thermometer-full:before {
+  content: "\f2c7";
+}
+.fa-thermometer-3:before,
+.fa-thermometer-three-quarters:before {
+  content: "\f2c8";
+}
+.fa-thermometer-2:before,
+.fa-thermometer-half:before {
+  content: "\f2c9";
+}
+.fa-thermometer-1:before,
+.fa-thermometer-quarter:before {
+  content: "\f2ca";
+}
+.fa-thermometer-0:before,
+.fa-thermometer-empty:before {
+  content: "\f2cb";
+}
+.fa-shower:before {
+  content: "\f2cc";
+}
+.fa-bathtub:before,
+.fa-s15:before,
+.fa-bath:before {
+  content: "\f2cd";
+}
+.fa-podcast:before {
+  content: "\f2ce";
+}
+.fa-window-maximize:before {
+  content: "\f2d0";
+}
+.fa-window-minimize:before {
+  content: "\f2d1";
+}
+.fa-window-restore:before {
+  content: "\f2d2";
+}
+.fa-times-rectangle:before,
+.fa-window-close:before {
+  content: "\f2d3";
+}
+.fa-times-rectangle-o:before,
+.fa-window-close-o:before {
+  content: "\f2d4";
+}
+.fa-bandcamp:before {
+  content: "\f2d5";
+}
+.fa-grav:before {
+  content: "\f2d6";
+}
+.fa-etsy:before {
+  content: "\f2d7";
+}
+.fa-imdb:before {
+  content: "\f2d8";
+}
+.fa-ravelry:before {
+  content: "\f2d9";
+}
+.fa-eercast:before {
+  content: "\f2da";
+}
+.fa-microchip:before {
+  content: "\f2db";
+}
+.fa-snowflake-o:before {
+  content: "\f2dc";
+}
+.fa-superpowers:before {
+  content: "\f2dd";
+}
+.fa-wpexplorer:before {
+  content: "\f2de";
+}
+.fa-meetup:before {
+  content: "\f2e0";
+}
+.sr-only {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  padding: 0;
+  margin: -1px;
+  overflow: hidden;
+  clip: rect(0, 0, 0, 0);
+  border: 0;
+}
+.sr-only-focusable:active,
+.sr-only-focusable:focus {
+  position: static;
+  width: auto;
+  height: auto;
+  margin: 0;
+  overflow: visible;
+  clip: auto;
+}
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/jquery.min.js b/ee/bulk-operations-dashboard/assets/dependencies/jquery.min.js
new file mode 100644
index 000000000000..644d35e274fd
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/jquery.min.js
@@ -0,0 +1,4 @@
+/*! jQuery v3.2.1 | (c) JS Foundation and other contributors | jquery.org/license */
+!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b||d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.2.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var b=r.merge(this.constructor(),a);return b.prevObject=this,b},each:function(a){return r.each(this,a)},map:function(a){return this.pushStack(r.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return this.pushStack(f.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(a){var b=this.length,c=+a+(a<0?b:0);return this.pushStack(c>=0&&c<b?[this[c]]:[])},end:function(){return this.prevObject||this.constructor()},push:h,sort:c.sort,splice:c.splice},r.extend=r.fn.extend=function(){var a,b,c,d,e,f,g=arguments[0]||{},h=1,i=arguments.length,j=!1;for("boolean"==typeof g&&(j=g,g=arguments[h]||{},h++),"object"==typeof g||r.isFunction(g)||(g={}),h===i&&(g=this,h--);h<i;h++)if(null!=(a=arguments[h]))for(b in a)c=g[b],d=a[b],g!==d&&(j&&d&&(r.isPlainObject(d)||(e=Array.isArray(d)))?(e?(e=!1,f=c&&Array.isArray(c)?c:[]):f=c&&r.isPlainObject(c)?c:{},g[b]=r.extend(j,f,d)):void 0!==d&&(g[b]=d));return g},r.extend({expando:"jQuery"+(q+Math.random()).replace(/\D/g,""),isReady:!0,error:function(a){throw new Error(a)},noop:function(){},isFunction:function(a){return"function"===r.type(a)},isWindow:function(a){return null!=a&&a===a.window},isNumeric:function(a){var b=r.type(a);return("number"===b||"string"===b)&&!isNaN(a-parseFloat(a))},isPlainObject:function(a){var b,c;return!(!a||"[object Object]"!==k.call(a))&&(!(b=e(a))||(c=l.call(b,"constructor")&&b.constructor,"function"==typeof c&&m.call(c)===n))},isEmptyObject:function(a){var b;for(b in a)return!1;return!0},type:function(a){return null==a?a+"":"object"==typeof a||"function"==typeof a?j[k.call(a)]||"object":typeof a},globalEval:function(a){p(a)},camelCase:function(a){return a.replace(t,"ms-").replace(u,v)},each:function(a,b){var c,d=0;if(w(a)){for(c=a.length;d<c;d++)if(b.call(a[d],d,a[d])===!1)break}else for(d in a)if(b.call(a[d],d,a[d])===!1)break;return a},trim:function(a){return null==a?"":(a+"").replace(s,"")},makeArray:function(a,b){var c=b||[];return null!=a&&(w(Object(a))?r.merge(c,"string"==typeof a?[a]:a):h.call(c,a)),c},inArray:function(a,b,c){return null==b?-1:i.call(b,a,c)},merge:function(a,b){for(var c=+b.length,d=0,e=a.length;d<c;d++)a[e++]=b[d];return a.length=e,a},grep:function(a,b,c){for(var d,e=[],f=0,g=a.length,h=!c;f<g;f++)d=!b(a[f],f),d!==h&&e.push(a[f]);return e},map:function(a,b,c){var d,e,f=0,h=[];if(w(a))for(d=a.length;f<d;f++)e=b(a[f],f,c),null!=e&&h.push(e);else for(f in a)e=b(a[f],f,c),null!=e&&h.push(e);return g.apply([],h)},guid:1,proxy:function(a,b){var c,d,e;if("string"==typeof b&&(c=a[b],b=a,a=c),r.isFunction(a))return d=f.call(arguments,2),e=function(){return a.apply(b||this,d.concat(f.call(arguments)))},e.guid=a.guid=a.guid||r.guid++,e},now:Date.now,support:o}),"function"==typeof Symbol&&(r.fn[Symbol.iterator]=c[Symbol.iterator]),r.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(a,b){j["[object "+b+"]"]=b.toLowerCase()});function w(a){var b=!!a&&"length"in a&&a.length,c=r.type(a);return"function"!==c&&!r.isWindow(a)&&("array"===c||0===b||"number"==typeof b&&b>0&&b-1 in a)}var x=function(a){var b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u="sizzle"+1*new Date,v=a.document,w=0,x=0,y=ha(),z=ha(),A=ha(),B=function(a,b){return a===b&&(l=!0),0},C={}.hasOwnProperty,D=[],E=D.pop,F=D.push,G=D.push,H=D.slice,I=function(a,b){for(var c=0,d=a.length;c<d;c++)if(a[c]===b)return c;return-1},J="checked|selected|async|autofocus|autoplay|controls|defer|disabled|hidden|ismap|loop|multiple|open|readonly|required|scoped",K="[\\x20\\t\\r\\n\\f]",L="(?:\\\\.|[\\w-]|[^\0-\\xa0])+",M="\\["+K+"*("+L+")(?:"+K+"*([*^$|!~]?=)"+K+"*(?:'((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\"|("+L+"))|)"+K+"*\\]",N=":("+L+")(?:\\((('((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\")|((?:\\\\.|[^\\\\()[\\]]|"+M+")*)|.*)\\)|)",O=new RegExp(K+"+","g"),P=new RegExp("^"+K+"+|((?:^|[^\\\\])(?:\\\\.)*)"+K+"+$","g"),Q=new RegExp("^"+K+"*,"+K+"*"),R=new RegExp("^"+K+"*([>+~]|"+K+")"+K+"*"),S=new RegExp("="+K+"*([^\\]'\"]*?)"+K+"*\\]","g"),T=new RegExp(N),U=new RegExp("^"+L+"$"),V={ID:new RegExp("^#("+L+")"),CLASS:new RegExp("^\\.("+L+")"),TAG:new RegExp("^("+L+"|[*])"),ATTR:new RegExp("^"+M),PSEUDO:new RegExp("^"+N),CHILD:new RegExp("^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\("+K+"*(even|odd|(([+-]|)(\\d*)n|)"+K+"*(?:([+-]|)"+K+"*(\\d+)|))"+K+"*\\)|)","i"),bool:new RegExp("^(?:"+J+")$","i"),needsContext:new RegExp("^"+K+"*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\("+K+"*((?:-\\d)?\\d*)"+K+"*\\)|)(?=[^-]|$)","i")},W=/^(?:input|select|textarea|button)$/i,X=/^h\d$/i,Y=/^[^{]+\{\s*\[native \w/,Z=/^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/,$=/[+~]/,_=new RegExp("\\\\([\\da-f]{1,6}"+K+"?|("+K+")|.)","ig"),aa=function(a,b,c){var d="0x"+b-65536;return d!==d||c?b:d<0?String.fromCharCode(d+65536):String.fromCharCode(d>>10|55296,1023&d|56320)},ba=/([\0-\x1f\x7f]|^-?\d)|^-$|[^\0-\x1f\x7f-\uFFFF\w-]/g,ca=function(a,b){return b?"\0"===a?"\ufffd":a.slice(0,-1)+"\\"+a.charCodeAt(a.length-1).toString(16)+" ":"\\"+a},da=function(){m()},ea=ta(function(a){return a.disabled===!0&&("form"in a||"label"in a)},{dir:"parentNode",next:"legend"});try{G.apply(D=H.call(v.childNodes),v.childNodes),D[v.childNodes.length].nodeType}catch(fa){G={apply:D.length?function(a,b){F.apply(a,H.call(b))}:function(a,b){var c=a.length,d=0;while(a[c++]=b[d++]);a.length=c-1}}}function ga(a,b,d,e){var f,h,j,k,l,o,r,s=b&&b.ownerDocument,w=b?b.nodeType:9;if(d=d||[],"string"!=typeof a||!a||1!==w&&9!==w&&11!==w)return d;if(!e&&((b?b.ownerDocument||b:v)!==n&&m(b),b=b||n,p)){if(11!==w&&(l=Z.exec(a)))if(f=l[1]){if(9===w){if(!(j=b.getElementById(f)))return d;if(j.id===f)return d.push(j),d}else if(s&&(j=s.getElementById(f))&&t(b,j)&&j.id===f)return d.push(j),d}else{if(l[2])return G.apply(d,b.getElementsByTagName(a)),d;if((f=l[3])&&c.getElementsByClassName&&b.getElementsByClassName)return G.apply(d,b.getElementsByClassName(f)),d}if(c.qsa&&!A[a+" "]&&(!q||!q.test(a))){if(1!==w)s=b,r=a;else if("object"!==b.nodeName.toLowerCase()){(k=b.getAttribute("id"))?k=k.replace(ba,ca):b.setAttribute("id",k=u),o=g(a),h=o.length;while(h--)o[h]="#"+k+" "+sa(o[h]);r=o.join(","),s=$.test(a)&&qa(b.parentNode)||b}if(r)try{return G.apply(d,s.querySelectorAll(r)),d}catch(x){}finally{k===u&&b.removeAttribute("id")}}}return i(a.replace(P,"$1"),b,d,e)}function ha(){var a=[];function b(c,e){return a.push(c+" ")>d.cacheLength&&delete b[a.shift()],b[c+" "]=e}return b}function ia(a){return a[u]=!0,a}function ja(a){var b=n.createElement("fieldset");try{return!!a(b)}catch(c){return!1}finally{b.parentNode&&b.parentNode.removeChild(b),b=null}}function ka(a,b){var c=a.split("|"),e=c.length;while(e--)d.attrHandle[c[e]]=b}function la(a,b){var c=b&&a,d=c&&1===a.nodeType&&1===b.nodeType&&a.sourceIndex-b.sourceIndex;if(d)return d;if(c)while(c=c.nextSibling)if(c===b)return-1;return a?1:-1}function ma(a){return function(b){var c=b.nodeName.toLowerCase();return"input"===c&&b.type===a}}function na(a){return function(b){var c=b.nodeName.toLowerCase();return("input"===c||"button"===c)&&b.type===a}}function oa(a){return function(b){return"form"in b?b.parentNode&&b.disabled===!1?"label"in b?"label"in b.parentNode?b.parentNode.disabled===a:b.disabled===a:b.isDisabled===a||b.isDisabled!==!a&&ea(b)===a:b.disabled===a:"label"in b&&b.disabled===a}}function pa(a){return ia(function(b){return b=+b,ia(function(c,d){var e,f=a([],c.length,b),g=f.length;while(g--)c[e=f[g]]&&(c[e]=!(d[e]=c[e]))})})}function qa(a){return a&&"undefined"!=typeof a.getElementsByTagName&&a}c=ga.support={},f=ga.isXML=function(a){var b=a&&(a.ownerDocument||a).documentElement;return!!b&&"HTML"!==b.nodeName},m=ga.setDocument=function(a){var b,e,g=a?a.ownerDocument||a:v;return g!==n&&9===g.nodeType&&g.documentElement?(n=g,o=n.documentElement,p=!f(n),v!==n&&(e=n.defaultView)&&e.top!==e&&(e.addEventListener?e.addEventListener("unload",da,!1):e.attachEvent&&e.attachEvent("onunload",da)),c.attributes=ja(function(a){return a.className="i",!a.getAttribute("className")}),c.getElementsByTagName=ja(function(a){return a.appendChild(n.createComment("")),!a.getElementsByTagName("*").length}),c.getElementsByClassName=Y.test(n.getElementsByClassName),c.getById=ja(function(a){return o.appendChild(a).id=u,!n.getElementsByName||!n.getElementsByName(u).length}),c.getById?(d.filter.ID=function(a){var b=a.replace(_,aa);return function(a){return a.getAttribute("id")===b}},d.find.ID=function(a,b){if("undefined"!=typeof b.getElementById&&p){var c=b.getElementById(a);return c?[c]:[]}}):(d.filter.ID=function(a){var b=a.replace(_,aa);return function(a){var c="undefined"!=typeof a.getAttributeNode&&a.getAttributeNode("id");return c&&c.value===b}},d.find.ID=function(a,b){if("undefined"!=typeof b.getElementById&&p){var c,d,e,f=b.getElementById(a);if(f){if(c=f.getAttributeNode("id"),c&&c.value===a)return[f];e=b.getElementsByName(a),d=0;while(f=e[d++])if(c=f.getAttributeNode("id"),c&&c.value===a)return[f]}return[]}}),d.find.TAG=c.getElementsByTagName?function(a,b){return"undefined"!=typeof b.getElementsByTagName?b.getElementsByTagName(a):c.qsa?b.querySelectorAll(a):void 0}:function(a,b){var c,d=[],e=0,f=b.getElementsByTagName(a);if("*"===a){while(c=f[e++])1===c.nodeType&&d.push(c);return d}return f},d.find.CLASS=c.getElementsByClassName&&function(a,b){if("undefined"!=typeof b.getElementsByClassName&&p)return b.getElementsByClassName(a)},r=[],q=[],(c.qsa=Y.test(n.querySelectorAll))&&(ja(function(a){o.appendChild(a).innerHTML="<a id='"+u+"'></a><select id='"+u+"-\r\\' msallowcapture=''><option selected=''></option></select>",a.querySelectorAll("[msallowcapture^='']").length&&q.push("[*^$]="+K+"*(?:''|\"\")"),a.querySelectorAll("[selected]").length||q.push("\\["+K+"*(?:value|"+J+")"),a.querySelectorAll("[id~="+u+"-]").length||q.push("~="),a.querySelectorAll(":checked").length||q.push(":checked"),a.querySelectorAll("a#"+u+"+*").length||q.push(".#.+[+~]")}),ja(function(a){a.innerHTML="<a href='' disabled='disabled'></a><select disabled='disabled'><option/></select>";var b=n.createElement("input");b.setAttribute("type","hidden"),a.appendChild(b).setAttribute("name","D"),a.querySelectorAll("[name=d]").length&&q.push("name"+K+"*[*^$|!~]?="),2!==a.querySelectorAll(":enabled").length&&q.push(":enabled",":disabled"),o.appendChild(a).disabled=!0,2!==a.querySelectorAll(":disabled").length&&q.push(":enabled",":disabled"),a.querySelectorAll("*,:x"),q.push(",.*:")})),(c.matchesSelector=Y.test(s=o.matches||o.webkitMatchesSelector||o.mozMatchesSelector||o.oMatchesSelector||o.msMatchesSelector))&&ja(function(a){c.disconnectedMatch=s.call(a,"*"),s.call(a,"[s!='']:x"),r.push("!=",N)}),q=q.length&&new RegExp(q.join("|")),r=r.length&&new RegExp(r.join("|")),b=Y.test(o.compareDocumentPosition),t=b||Y.test(o.contains)?function(a,b){var c=9===a.nodeType?a.documentElement:a,d=b&&b.parentNode;return a===d||!(!d||1!==d.nodeType||!(c.contains?c.contains(d):a.compareDocumentPosition&&16&a.compareDocumentPosition(d)))}:function(a,b){if(b)while(b=b.parentNode)if(b===a)return!0;return!1},B=b?function(a,b){if(a===b)return l=!0,0;var d=!a.compareDocumentPosition-!b.compareDocumentPosition;return d?d:(d=(a.ownerDocument||a)===(b.ownerDocument||b)?a.compareDocumentPosition(b):1,1&d||!c.sortDetached&&b.compareDocumentPosition(a)===d?a===n||a.ownerDocument===v&&t(v,a)?-1:b===n||b.ownerDocument===v&&t(v,b)?1:k?I(k,a)-I(k,b):0:4&d?-1:1)}:function(a,b){if(a===b)return l=!0,0;var c,d=0,e=a.parentNode,f=b.parentNode,g=[a],h=[b];if(!e||!f)return a===n?-1:b===n?1:e?-1:f?1:k?I(k,a)-I(k,b):0;if(e===f)return la(a,b);c=a;while(c=c.parentNode)g.unshift(c);c=b;while(c=c.parentNode)h.unshift(c);while(g[d]===h[d])d++;return d?la(g[d],h[d]):g[d]===v?-1:h[d]===v?1:0},n):n},ga.matches=function(a,b){return ga(a,null,null,b)},ga.matchesSelector=function(a,b){if((a.ownerDocument||a)!==n&&m(a),b=b.replace(S,"='$1']"),c.matchesSelector&&p&&!A[b+" "]&&(!r||!r.test(b))&&(!q||!q.test(b)))try{var d=s.call(a,b);if(d||c.disconnectedMatch||a.document&&11!==a.document.nodeType)return d}catch(e){}return ga(b,n,null,[a]).length>0},ga.contains=function(a,b){return(a.ownerDocument||a)!==n&&m(a),t(a,b)},ga.attr=function(a,b){(a.ownerDocument||a)!==n&&m(a);var e=d.attrHandle[b.toLowerCase()],f=e&&C.call(d.attrHandle,b.toLowerCase())?e(a,b,!p):void 0;return void 0!==f?f:c.attributes||!p?a.getAttribute(b):(f=a.getAttributeNode(b))&&f.specified?f.value:null},ga.escape=function(a){return(a+"").replace(ba,ca)},ga.error=function(a){throw new Error("Syntax error, unrecognized expression: "+a)},ga.uniqueSort=function(a){var b,d=[],e=0,f=0;if(l=!c.detectDuplicates,k=!c.sortStable&&a.slice(0),a.sort(B),l){while(b=a[f++])b===a[f]&&(e=d.push(f));while(e--)a.splice(d[e],1)}return k=null,a},e=ga.getText=function(a){var b,c="",d=0,f=a.nodeType;if(f){if(1===f||9===f||11===f){if("string"==typeof a.textContent)return a.textContent;for(a=a.firstChild;a;a=a.nextSibling)c+=e(a)}else if(3===f||4===f)return a.nodeValue}else while(b=a[d++])c+=e(b);return c},d=ga.selectors={cacheLength:50,createPseudo:ia,match:V,attrHandle:{},find:{},relative:{">":{dir:"parentNode",first:!0}," ":{dir:"parentNode"},"+":{dir:"previousSibling",first:!0},"~":{dir:"previousSibling"}},preFilter:{ATTR:function(a){return a[1]=a[1].replace(_,aa),a[3]=(a[3]||a[4]||a[5]||"").replace(_,aa),"~="===a[2]&&(a[3]=" "+a[3]+" "),a.slice(0,4)},CHILD:function(a){return a[1]=a[1].toLowerCase(),"nth"===a[1].slice(0,3)?(a[3]||ga.error(a[0]),a[4]=+(a[4]?a[5]+(a[6]||1):2*("even"===a[3]||"odd"===a[3])),a[5]=+(a[7]+a[8]||"odd"===a[3])):a[3]&&ga.error(a[0]),a},PSEUDO:function(a){var b,c=!a[6]&&a[2];return V.CHILD.test(a[0])?null:(a[3]?a[2]=a[4]||a[5]||"":c&&T.test(c)&&(b=g(c,!0))&&(b=c.indexOf(")",c.length-b)-c.length)&&(a[0]=a[0].slice(0,b),a[2]=c.slice(0,b)),a.slice(0,3))}},filter:{TAG:function(a){var b=a.replace(_,aa).toLowerCase();return"*"===a?function(){return!0}:function(a){return a.nodeName&&a.nodeName.toLowerCase()===b}},CLASS:function(a){var b=y[a+" "];return b||(b=new RegExp("(^|"+K+")"+a+"("+K+"|$)"))&&y(a,function(a){return b.test("string"==typeof a.className&&a.className||"undefined"!=typeof a.getAttribute&&a.getAttribute("class")||"")})},ATTR:function(a,b,c){return function(d){var e=ga.attr(d,a);return null==e?"!="===b:!b||(e+="","="===b?e===c:"!="===b?e!==c:"^="===b?c&&0===e.indexOf(c):"*="===b?c&&e.indexOf(c)>-1:"$="===b?c&&e.slice(-c.length)===c:"~="===b?(" "+e.replace(O," ")+" ").indexOf(c)>-1:"|="===b&&(e===c||e.slice(0,c.length+1)===c+"-"))}},CHILD:function(a,b,c,d,e){var f="nth"!==a.slice(0,3),g="last"!==a.slice(-4),h="of-type"===b;return 1===d&&0===e?function(a){return!!a.parentNode}:function(b,c,i){var j,k,l,m,n,o,p=f!==g?"nextSibling":"previousSibling",q=b.parentNode,r=h&&b.nodeName.toLowerCase(),s=!i&&!h,t=!1;if(q){if(f){while(p){m=b;while(m=m[p])if(h?m.nodeName.toLowerCase()===r:1===m.nodeType)return!1;o=p="only"===a&&!o&&"nextSibling"}return!0}if(o=[g?q.firstChild:q.lastChild],g&&s){m=q,l=m[u]||(m[u]={}),k=l[m.uniqueID]||(l[m.uniqueID]={}),j=k[a]||[],n=j[0]===w&&j[1],t=n&&j[2],m=n&&q.childNodes[n];while(m=++n&&m&&m[p]||(t=n=0)||o.pop())if(1===m.nodeType&&++t&&m===b){k[a]=[w,n,t];break}}else if(s&&(m=b,l=m[u]||(m[u]={}),k=l[m.uniqueID]||(l[m.uniqueID]={}),j=k[a]||[],n=j[0]===w&&j[1],t=n),t===!1)while(m=++n&&m&&m[p]||(t=n=0)||o.pop())if((h?m.nodeName.toLowerCase()===r:1===m.nodeType)&&++t&&(s&&(l=m[u]||(m[u]={}),k=l[m.uniqueID]||(l[m.uniqueID]={}),k[a]=[w,t]),m===b))break;return t-=e,t===d||t%d===0&&t/d>=0}}},PSEUDO:function(a,b){var c,e=d.pseudos[a]||d.setFilters[a.toLowerCase()]||ga.error("unsupported pseudo: "+a);return e[u]?e(b):e.length>1?(c=[a,a,"",b],d.setFilters.hasOwnProperty(a.toLowerCase())?ia(function(a,c){var d,f=e(a,b),g=f.length;while(g--)d=I(a,f[g]),a[d]=!(c[d]=f[g])}):function(a){return e(a,0,c)}):e}},pseudos:{not:ia(function(a){var b=[],c=[],d=h(a.replace(P,"$1"));return d[u]?ia(function(a,b,c,e){var f,g=d(a,null,e,[]),h=a.length;while(h--)(f=g[h])&&(a[h]=!(b[h]=f))}):function(a,e,f){return b[0]=a,d(b,null,f,c),b[0]=null,!c.pop()}}),has:ia(function(a){return function(b){return ga(a,b).length>0}}),contains:ia(function(a){return a=a.replace(_,aa),function(b){return(b.textContent||b.innerText||e(b)).indexOf(a)>-1}}),lang:ia(function(a){return U.test(a||"")||ga.error("unsupported lang: "+a),a=a.replace(_,aa).toLowerCase(),function(b){var c;do if(c=p?b.lang:b.getAttribute("xml:lang")||b.getAttribute("lang"))return c=c.toLowerCase(),c===a||0===c.indexOf(a+"-");while((b=b.parentNode)&&1===b.nodeType);return!1}}),target:function(b){var c=a.location&&a.location.hash;return c&&c.slice(1)===b.id},root:function(a){return a===o},focus:function(a){return a===n.activeElement&&(!n.hasFocus||n.hasFocus())&&!!(a.type||a.href||~a.tabIndex)},enabled:oa(!1),disabled:oa(!0),checked:function(a){var b=a.nodeName.toLowerCase();return"input"===b&&!!a.checked||"option"===b&&!!a.selected},selected:function(a){return a.parentNode&&a.parentNode.selectedIndex,a.selected===!0},empty:function(a){for(a=a.firstChild;a;a=a.nextSibling)if(a.nodeType<6)return!1;return!0},parent:function(a){return!d.pseudos.empty(a)},header:function(a){return X.test(a.nodeName)},input:function(a){return W.test(a.nodeName)},button:function(a){var b=a.nodeName.toLowerCase();return"input"===b&&"button"===a.type||"button"===b},text:function(a){var b;return"input"===a.nodeName.toLowerCase()&&"text"===a.type&&(null==(b=a.getAttribute("type"))||"text"===b.toLowerCase())},first:pa(function(){return[0]}),last:pa(function(a,b){return[b-1]}),eq:pa(function(a,b,c){return[c<0?c+b:c]}),even:pa(function(a,b){for(var c=0;c<b;c+=2)a.push(c);return a}),odd:pa(function(a,b){for(var c=1;c<b;c+=2)a.push(c);return a}),lt:pa(function(a,b,c){for(var d=c<0?c+b:c;--d>=0;)a.push(d);return a}),gt:pa(function(a,b,c){for(var d=c<0?c+b:c;++d<b;)a.push(d);return a})}},d.pseudos.nth=d.pseudos.eq;for(b in{radio:!0,checkbox:!0,file:!0,password:!0,image:!0})d.pseudos[b]=ma(b);for(b in{submit:!0,reset:!0})d.pseudos[b]=na(b);function ra(){}ra.prototype=d.filters=d.pseudos,d.setFilters=new ra,g=ga.tokenize=function(a,b){var c,e,f,g,h,i,j,k=z[a+" "];if(k)return b?0:k.slice(0);h=a,i=[],j=d.preFilter;while(h){c&&!(e=Q.exec(h))||(e&&(h=h.slice(e[0].length)||h),i.push(f=[])),c=!1,(e=R.exec(h))&&(c=e.shift(),f.push({value:c,type:e[0].replace(P," ")}),h=h.slice(c.length));for(g in d.filter)!(e=V[g].exec(h))||j[g]&&!(e=j[g](e))||(c=e.shift(),f.push({value:c,type:g,matches:e}),h=h.slice(c.length));if(!c)break}return b?h.length:h?ga.error(a):z(a,i).slice(0)};function sa(a){for(var b=0,c=a.length,d="";b<c;b++)d+=a[b].value;return d}function ta(a,b,c){var d=b.dir,e=b.next,f=e||d,g=c&&"parentNode"===f,h=x++;return b.first?function(b,c,e){while(b=b[d])if(1===b.nodeType||g)return a(b,c,e);return!1}:function(b,c,i){var j,k,l,m=[w,h];if(i){while(b=b[d])if((1===b.nodeType||g)&&a(b,c,i))return!0}else while(b=b[d])if(1===b.nodeType||g)if(l=b[u]||(b[u]={}),k=l[b.uniqueID]||(l[b.uniqueID]={}),e&&e===b.nodeName.toLowerCase())b=b[d]||b;else{if((j=k[f])&&j[0]===w&&j[1]===h)return m[2]=j[2];if(k[f]=m,m[2]=a(b,c,i))return!0}return!1}}function ua(a){return a.length>1?function(b,c,d){var e=a.length;while(e--)if(!a[e](b,c,d))return!1;return!0}:a[0]}function va(a,b,c){for(var d=0,e=b.length;d<e;d++)ga(a,b[d],c);return c}function wa(a,b,c,d,e){for(var f,g=[],h=0,i=a.length,j=null!=b;h<i;h++)(f=a[h])&&(c&&!c(f,d,e)||(g.push(f),j&&b.push(h)));return g}function xa(a,b,c,d,e,f){return d&&!d[u]&&(d=xa(d)),e&&!e[u]&&(e=xa(e,f)),ia(function(f,g,h,i){var j,k,l,m=[],n=[],o=g.length,p=f||va(b||"*",h.nodeType?[h]:h,[]),q=!a||!f&&b?p:wa(p,m,a,h,i),r=c?e||(f?a:o||d)?[]:g:q;if(c&&c(q,r,h,i),d){j=wa(r,n),d(j,[],h,i),k=j.length;while(k--)(l=j[k])&&(r[n[k]]=!(q[n[k]]=l))}if(f){if(e||a){if(e){j=[],k=r.length;while(k--)(l=r[k])&&j.push(q[k]=l);e(null,r=[],j,i)}k=r.length;while(k--)(l=r[k])&&(j=e?I(f,l):m[k])>-1&&(f[j]=!(g[j]=l))}}else r=wa(r===g?r.splice(o,r.length):r),e?e(null,g,r,i):G.apply(g,r)})}function ya(a){for(var b,c,e,f=a.length,g=d.relative[a[0].type],h=g||d.relative[" "],i=g?1:0,k=ta(function(a){return a===b},h,!0),l=ta(function(a){return I(b,a)>-1},h,!0),m=[function(a,c,d){var e=!g&&(d||c!==j)||((b=c).nodeType?k(a,c,d):l(a,c,d));return b=null,e}];i<f;i++)if(c=d.relative[a[i].type])m=[ta(ua(m),c)];else{if(c=d.filter[a[i].type].apply(null,a[i].matches),c[u]){for(e=++i;e<f;e++)if(d.relative[a[e].type])break;return xa(i>1&&ua(m),i>1&&sa(a.slice(0,i-1).concat({value:" "===a[i-2].type?"*":""})).replace(P,"$1"),c,i<e&&ya(a.slice(i,e)),e<f&&ya(a=a.slice(e)),e<f&&sa(a))}m.push(c)}return ua(m)}function za(a,b){var c=b.length>0,e=a.length>0,f=function(f,g,h,i,k){var l,o,q,r=0,s="0",t=f&&[],u=[],v=j,x=f||e&&d.find.TAG("*",k),y=w+=null==v?1:Math.random()||.1,z=x.length;for(k&&(j=g===n||g||k);s!==z&&null!=(l=x[s]);s++){if(e&&l){o=0,g||l.ownerDocument===n||(m(l),h=!p);while(q=a[o++])if(q(l,g||n,h)){i.push(l);break}k&&(w=y)}c&&((l=!q&&l)&&r--,f&&t.push(l))}if(r+=s,c&&s!==r){o=0;while(q=b[o++])q(t,u,g,h);if(f){if(r>0)while(s--)t[s]||u[s]||(u[s]=E.call(i));u=wa(u)}G.apply(i,u),k&&!f&&u.length>0&&r+b.length>1&&ga.uniqueSort(i)}return k&&(w=y,j=v),t};return c?ia(f):f}return h=ga.compile=function(a,b){var c,d=[],e=[],f=A[a+" "];if(!f){b||(b=g(a)),c=b.length;while(c--)f=ya(b[c]),f[u]?d.push(f):e.push(f);f=A(a,za(e,d)),f.selector=a}return f},i=ga.select=function(a,b,c,e){var f,i,j,k,l,m="function"==typeof a&&a,n=!e&&g(a=m.selector||a);if(c=c||[],1===n.length){if(i=n[0]=n[0].slice(0),i.length>2&&"ID"===(j=i[0]).type&&9===b.nodeType&&p&&d.relative[i[1].type]){if(b=(d.find.ID(j.matches[0].replace(_,aa),b)||[])[0],!b)return c;m&&(b=b.parentNode),a=a.slice(i.shift().value.length)}f=V.needsContext.test(a)?0:i.length;while(f--){if(j=i[f],d.relative[k=j.type])break;if((l=d.find[k])&&(e=l(j.matches[0].replace(_,aa),$.test(i[0].type)&&qa(b.parentNode)||b))){if(i.splice(f,1),a=e.length&&sa(i),!a)return G.apply(c,e),c;break}}}return(m||h(a,n))(e,b,!p,c,!b||$.test(a)&&qa(b.parentNode)||b),c},c.sortStable=u.split("").sort(B).join("")===u,c.detectDuplicates=!!l,m(),c.sortDetached=ja(function(a){return 1&a.compareDocumentPosition(n.createElement("fieldset"))}),ja(function(a){return a.innerHTML="<a href='#'></a>","#"===a.firstChild.getAttribute("href")})||ka("type|href|height|width",function(a,b,c){if(!c)return a.getAttribute(b,"type"===b.toLowerCase()?1:2)}),c.attributes&&ja(function(a){return a.innerHTML="<input/>",a.firstChild.setAttribute("value",""),""===a.firstChild.getAttribute("value")})||ka("value",function(a,b,c){if(!c&&"input"===a.nodeName.toLowerCase())return a.defaultValue}),ja(function(a){return null==a.getAttribute("disabled")})||ka(J,function(a,b,c){var d;if(!c)return a[b]===!0?b.toLowerCase():(d=a.getAttributeNode(b))&&d.specified?d.value:null}),ga}(a);r.find=x,r.expr=x.selectors,r.expr[":"]=r.expr.pseudos,r.uniqueSort=r.unique=x.uniqueSort,r.text=x.getText,r.isXMLDoc=x.isXML,r.contains=x.contains,r.escapeSelector=x.escape;var y=function(a,b,c){var d=[],e=void 0!==c;while((a=a[b])&&9!==a.nodeType)if(1===a.nodeType){if(e&&r(a).is(c))break;d.push(a)}return d},z=function(a,b){for(var c=[];a;a=a.nextSibling)1===a.nodeType&&a!==b&&c.push(a);return c},A=r.expr.match.needsContext;function B(a,b){return a.nodeName&&a.nodeName.toLowerCase()===b.toLowerCase()}var C=/^<([a-z][^\/\0>:\x20\t\r\n\f]*)[\x20\t\r\n\f]*\/?>(?:<\/\1>|)$/i,D=/^.[^:#\[\.,]*$/;function E(a,b,c){return r.isFunction(b)?r.grep(a,function(a,d){return!!b.call(a,d,a)!==c}):b.nodeType?r.grep(a,function(a){return a===b!==c}):"string"!=typeof b?r.grep(a,function(a){return i.call(b,a)>-1!==c}):D.test(b)?r.filter(b,a,c):(b=r.filter(b,a),r.grep(a,function(a){return i.call(b,a)>-1!==c&&1===a.nodeType}))}r.filter=function(a,b,c){var d=b[0];return c&&(a=":not("+a+")"),1===b.length&&1===d.nodeType?r.find.matchesSelector(d,a)?[d]:[]:r.find.matches(a,r.grep(b,function(a){return 1===a.nodeType}))},r.fn.extend({find:function(a){var b,c,d=this.length,e=this;if("string"!=typeof a)return this.pushStack(r(a).filter(function(){for(b=0;b<d;b++)if(r.contains(e[b],this))return!0}));for(c=this.pushStack([]),b=0;b<d;b++)r.find(a,e[b],c);return d>1?r.uniqueSort(c):c},filter:function(a){return this.pushStack(E(this,a||[],!1))},not:function(a){return this.pushStack(E(this,a||[],!0))},is:function(a){return!!E(this,"string"==typeof a&&A.test(a)?r(a):a||[],!1).length}});var F,G=/^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]+))$/,H=r.fn.init=function(a,b,c){var e,f;if(!a)return this;if(c=c||F,"string"==typeof a){if(e="<"===a[0]&&">"===a[a.length-1]&&a.length>=3?[null,a,null]:G.exec(a),!e||!e[1]&&b)return!b||b.jquery?(b||c).find(a):this.constructor(b).find(a);if(e[1]){if(b=b instanceof r?b[0]:b,r.merge(this,r.parseHTML(e[1],b&&b.nodeType?b.ownerDocument||b:d,!0)),C.test(e[1])&&r.isPlainObject(b))for(e in b)r.isFunction(this[e])?this[e](b[e]):this.attr(e,b[e]);return this}return f=d.getElementById(e[2]),f&&(this[0]=f,this.length=1),this}return a.nodeType?(this[0]=a,this.length=1,this):r.isFunction(a)?void 0!==c.ready?c.ready(a):a(r):r.makeArray(a,this)};H.prototype=r.fn,F=r(d);var I=/^(?:parents|prev(?:Until|All))/,J={children:!0,contents:!0,next:!0,prev:!0};r.fn.extend({has:function(a){var b=r(a,this),c=b.length;return this.filter(function(){for(var a=0;a<c;a++)if(r.contains(this,b[a]))return!0})},closest:function(a,b){var c,d=0,e=this.length,f=[],g="string"!=typeof a&&r(a);if(!A.test(a))for(;d<e;d++)for(c=this[d];c&&c!==b;c=c.parentNode)if(c.nodeType<11&&(g?g.index(c)>-1:1===c.nodeType&&r.find.matchesSelector(c,a))){f.push(c);break}return this.pushStack(f.length>1?r.uniqueSort(f):f)},index:function(a){return a?"string"==typeof a?i.call(r(a),this[0]):i.call(this,a.jquery?a[0]:a):this[0]&&this[0].parentNode?this.first().prevAll().length:-1},add:function(a,b){return this.pushStack(r.uniqueSort(r.merge(this.get(),r(a,b))))},addBack:function(a){return this.add(null==a?this.prevObject:this.prevObject.filter(a))}});function K(a,b){while((a=a[b])&&1!==a.nodeType);return a}r.each({parent:function(a){var b=a.parentNode;return b&&11!==b.nodeType?b:null},parents:function(a){return y(a,"parentNode")},parentsUntil:function(a,b,c){return y(a,"parentNode",c)},next:function(a){return K(a,"nextSibling")},prev:function(a){return K(a,"previousSibling")},nextAll:function(a){return y(a,"nextSibling")},prevAll:function(a){return y(a,"previousSibling")},nextUntil:function(a,b,c){return y(a,"nextSibling",c)},prevUntil:function(a,b,c){return y(a,"previousSibling",c)},siblings:function(a){return z((a.parentNode||{}).firstChild,a)},children:function(a){return z(a.firstChild)},contents:function(a){return B(a,"iframe")?a.contentDocument:(B(a,"template")&&(a=a.content||a),r.merge([],a.childNodes))}},function(a,b){r.fn[a]=function(c,d){var e=r.map(this,b,c);return"Until"!==a.slice(-5)&&(d=c),d&&"string"==typeof d&&(e=r.filter(d,e)),this.length>1&&(J[a]||r.uniqueSort(e),I.test(a)&&e.reverse()),this.pushStack(e)}});var L=/[^\x20\t\r\n\f]+/g;function M(a){var b={};return r.each(a.match(L)||[],function(a,c){b[c]=!0}),b}r.Callbacks=function(a){a="string"==typeof a?M(a):r.extend({},a);var b,c,d,e,f=[],g=[],h=-1,i=function(){for(e=e||a.once,d=b=!0;g.length;h=-1){c=g.shift();while(++h<f.length)f[h].apply(c[0],c[1])===!1&&a.stopOnFalse&&(h=f.length,c=!1)}a.memory||(c=!1),b=!1,e&&(f=c?[]:"")},j={add:function(){return f&&(c&&!b&&(h=f.length-1,g.push(c)),function d(b){r.each(b,function(b,c){r.isFunction(c)?a.unique&&j.has(c)||f.push(c):c&&c.length&&"string"!==r.type(c)&&d(c)})}(arguments),c&&!b&&i()),this},remove:function(){return r.each(arguments,function(a,b){var c;while((c=r.inArray(b,f,c))>-1)f.splice(c,1),c<=h&&h--}),this},has:function(a){return a?r.inArray(a,f)>-1:f.length>0},empty:function(){return f&&(f=[]),this},disable:function(){return e=g=[],f=c="",this},disabled:function(){return!f},lock:function(){return e=g=[],c||b||(f=c=""),this},locked:function(){return!!e},fireWith:function(a,c){return e||(c=c||[],c=[a,c.slice?c.slice():c],g.push(c),b||i()),this},fire:function(){return j.fireWith(this,arguments),this},fired:function(){return!!d}};return j};function N(a){return a}function O(a){throw a}function P(a,b,c,d){var e;try{a&&r.isFunction(e=a.promise)?e.call(a).done(b).fail(c):a&&r.isFunction(e=a.then)?e.call(a,b,c):b.apply(void 0,[a].slice(d))}catch(a){c.apply(void 0,[a])}}r.extend({Deferred:function(b){var c=[["notify","progress",r.Callbacks("memory"),r.Callbacks("memory"),2],["resolve","done",r.Callbacks("once memory"),r.Callbacks("once memory"),0,"resolved"],["reject","fail",r.Callbacks("once memory"),r.Callbacks("once memory"),1,"rejected"]],d="pending",e={state:function(){return d},always:function(){return f.done(arguments).fail(arguments),this},"catch":function(a){return e.then(null,a)},pipe:function(){var a=arguments;return r.Deferred(function(b){r.each(c,function(c,d){var e=r.isFunction(a[d[4]])&&a[d[4]];f[d[1]](function(){var a=e&&e.apply(this,arguments);a&&r.isFunction(a.promise)?a.promise().progress(b.notify).done(b.resolve).fail(b.reject):b[d[0]+"With"](this,e?[a]:arguments)})}),a=null}).promise()},then:function(b,d,e){var f=0;function g(b,c,d,e){return function(){var h=this,i=arguments,j=function(){var a,j;if(!(b<f)){if(a=d.apply(h,i),a===c.promise())throw new TypeError("Thenable self-resolution");j=a&&("object"==typeof a||"function"==typeof a)&&a.then,r.isFunction(j)?e?j.call(a,g(f,c,N,e),g(f,c,O,e)):(f++,j.call(a,g(f,c,N,e),g(f,c,O,e),g(f,c,N,c.notifyWith))):(d!==N&&(h=void 0,i=[a]),(e||c.resolveWith)(h,i))}},k=e?j:function(){try{j()}catch(a){r.Deferred.exceptionHook&&r.Deferred.exceptionHook(a,k.stackTrace),b+1>=f&&(d!==O&&(h=void 0,i=[a]),c.rejectWith(h,i))}};b?k():(r.Deferred.getStackHook&&(k.stackTrace=r.Deferred.getStackHook()),a.setTimeout(k))}}return r.Deferred(function(a){c[0][3].add(g(0,a,r.isFunction(e)?e:N,a.notifyWith)),c[1][3].add(g(0,a,r.isFunction(b)?b:N)),c[2][3].add(g(0,a,r.isFunction(d)?d:O))}).promise()},promise:function(a){return null!=a?r.extend(a,e):e}},f={};return r.each(c,function(a,b){var g=b[2],h=b[5];e[b[1]]=g.add,h&&g.add(function(){d=h},c[3-a][2].disable,c[0][2].lock),g.add(b[3].fire),f[b[0]]=function(){return f[b[0]+"With"](this===f?void 0:this,arguments),this},f[b[0]+"With"]=g.fireWith}),e.promise(f),b&&b.call(f,f),f},when:function(a){var b=arguments.length,c=b,d=Array(c),e=f.call(arguments),g=r.Deferred(),h=function(a){return function(c){d[a]=this,e[a]=arguments.length>1?f.call(arguments):c,--b||g.resolveWith(d,e)}};if(b<=1&&(P(a,g.done(h(c)).resolve,g.reject,!b),"pending"===g.state()||r.isFunction(e[c]&&e[c].then)))return g.then();while(c--)P(e[c],h(c),g.reject);return g.promise()}});var Q=/^(Eval|Internal|Range|Reference|Syntax|Type|URI)Error$/;r.Deferred.exceptionHook=function(b,c){a.console&&a.console.warn&&b&&Q.test(b.name)&&a.console.warn("jQuery.Deferred exception: "+b.message,b.stack,c)},r.readyException=function(b){a.setTimeout(function(){throw b})};var R=r.Deferred();r.fn.ready=function(a){return R.then(a)["catch"](function(a){r.readyException(a)}),this},r.extend({isReady:!1,readyWait:1,ready:function(a){(a===!0?--r.readyWait:r.isReady)||(r.isReady=!0,a!==!0&&--r.readyWait>0||R.resolveWith(d,[r]))}}),r.ready.then=R.then;function S(){d.removeEventListener("DOMContentLoaded",S),
+a.removeEventListener("load",S),r.ready()}"complete"===d.readyState||"loading"!==d.readyState&&!d.documentElement.doScroll?a.setTimeout(r.ready):(d.addEventListener("DOMContentLoaded",S),a.addEventListener("load",S));var T=function(a,b,c,d,e,f,g){var h=0,i=a.length,j=null==c;if("object"===r.type(c)){e=!0;for(h in c)T(a,b,h,c[h],!0,f,g)}else if(void 0!==d&&(e=!0,r.isFunction(d)||(g=!0),j&&(g?(b.call(a,d),b=null):(j=b,b=function(a,b,c){return j.call(r(a),c)})),b))for(;h<i;h++)b(a[h],c,g?d:d.call(a[h],h,b(a[h],c)));return e?a:j?b.call(a):i?b(a[0],c):f},U=function(a){return 1===a.nodeType||9===a.nodeType||!+a.nodeType};function V(){this.expando=r.expando+V.uid++}V.uid=1,V.prototype={cache:function(a){var b=a[this.expando];return b||(b={},U(a)&&(a.nodeType?a[this.expando]=b:Object.defineProperty(a,this.expando,{value:b,configurable:!0}))),b},set:function(a,b,c){var d,e=this.cache(a);if("string"==typeof b)e[r.camelCase(b)]=c;else for(d in b)e[r.camelCase(d)]=b[d];return e},get:function(a,b){return void 0===b?this.cache(a):a[this.expando]&&a[this.expando][r.camelCase(b)]},access:function(a,b,c){return void 0===b||b&&"string"==typeof b&&void 0===c?this.get(a,b):(this.set(a,b,c),void 0!==c?c:b)},remove:function(a,b){var c,d=a[this.expando];if(void 0!==d){if(void 0!==b){Array.isArray(b)?b=b.map(r.camelCase):(b=r.camelCase(b),b=b in d?[b]:b.match(L)||[]),c=b.length;while(c--)delete d[b[c]]}(void 0===b||r.isEmptyObject(d))&&(a.nodeType?a[this.expando]=void 0:delete a[this.expando])}},hasData:function(a){var b=a[this.expando];return void 0!==b&&!r.isEmptyObject(b)}};var W=new V,X=new V,Y=/^(?:\{[\w\W]*\}|\[[\w\W]*\])$/,Z=/[A-Z]/g;function $(a){return"true"===a||"false"!==a&&("null"===a?null:a===+a+""?+a:Y.test(a)?JSON.parse(a):a)}function _(a,b,c){var d;if(void 0===c&&1===a.nodeType)if(d="data-"+b.replace(Z,"-$&").toLowerCase(),c=a.getAttribute(d),"string"==typeof c){try{c=$(c)}catch(e){}X.set(a,b,c)}else c=void 0;return c}r.extend({hasData:function(a){return X.hasData(a)||W.hasData(a)},data:function(a,b,c){return X.access(a,b,c)},removeData:function(a,b){X.remove(a,b)},_data:function(a,b,c){return W.access(a,b,c)},_removeData:function(a,b){W.remove(a,b)}}),r.fn.extend({data:function(a,b){var c,d,e,f=this[0],g=f&&f.attributes;if(void 0===a){if(this.length&&(e=X.get(f),1===f.nodeType&&!W.get(f,"hasDataAttrs"))){c=g.length;while(c--)g[c]&&(d=g[c].name,0===d.indexOf("data-")&&(d=r.camelCase(d.slice(5)),_(f,d,e[d])));W.set(f,"hasDataAttrs",!0)}return e}return"object"==typeof a?this.each(function(){X.set(this,a)}):T(this,function(b){var c;if(f&&void 0===b){if(c=X.get(f,a),void 0!==c)return c;if(c=_(f,a),void 0!==c)return c}else this.each(function(){X.set(this,a,b)})},null,b,arguments.length>1,null,!0)},removeData:function(a){return this.each(function(){X.remove(this,a)})}}),r.extend({queue:function(a,b,c){var d;if(a)return b=(b||"fx")+"queue",d=W.get(a,b),c&&(!d||Array.isArray(c)?d=W.access(a,b,r.makeArray(c)):d.push(c)),d||[]},dequeue:function(a,b){b=b||"fx";var c=r.queue(a,b),d=c.length,e=c.shift(),f=r._queueHooks(a,b),g=function(){r.dequeue(a,b)};"inprogress"===e&&(e=c.shift(),d--),e&&("fx"===b&&c.unshift("inprogress"),delete f.stop,e.call(a,g,f)),!d&&f&&f.empty.fire()},_queueHooks:function(a,b){var c=b+"queueHooks";return W.get(a,c)||W.access(a,c,{empty:r.Callbacks("once memory").add(function(){W.remove(a,[b+"queue",c])})})}}),r.fn.extend({queue:function(a,b){var c=2;return"string"!=typeof a&&(b=a,a="fx",c--),arguments.length<c?r.queue(this[0],a):void 0===b?this:this.each(function(){var c=r.queue(this,a,b);r._queueHooks(this,a),"fx"===a&&"inprogress"!==c[0]&&r.dequeue(this,a)})},dequeue:function(a){return this.each(function(){r.dequeue(this,a)})},clearQueue:function(a){return this.queue(a||"fx",[])},promise:function(a,b){var c,d=1,e=r.Deferred(),f=this,g=this.length,h=function(){--d||e.resolveWith(f,[f])};"string"!=typeof a&&(b=a,a=void 0),a=a||"fx";while(g--)c=W.get(f[g],a+"queueHooks"),c&&c.empty&&(d++,c.empty.add(h));return h(),e.promise(b)}});var aa=/[+-]?(?:\d*\.|)\d+(?:[eE][+-]?\d+|)/.source,ba=new RegExp("^(?:([+-])=|)("+aa+")([a-z%]*)$","i"),ca=["Top","Right","Bottom","Left"],da=function(a,b){return a=b||a,"none"===a.style.display||""===a.style.display&&r.contains(a.ownerDocument,a)&&"none"===r.css(a,"display")},ea=function(a,b,c,d){var e,f,g={};for(f in b)g[f]=a.style[f],a.style[f]=b[f];e=c.apply(a,d||[]);for(f in b)a.style[f]=g[f];return e};function fa(a,b,c,d){var e,f=1,g=20,h=d?function(){return d.cur()}:function(){return r.css(a,b,"")},i=h(),j=c&&c[3]||(r.cssNumber[b]?"":"px"),k=(r.cssNumber[b]||"px"!==j&&+i)&&ba.exec(r.css(a,b));if(k&&k[3]!==j){j=j||k[3],c=c||[],k=+i||1;do f=f||".5",k/=f,r.style(a,b,k+j);while(f!==(f=h()/i)&&1!==f&&--g)}return c&&(k=+k||+i||0,e=c[1]?k+(c[1]+1)*c[2]:+c[2],d&&(d.unit=j,d.start=k,d.end=e)),e}var ga={};function ha(a){var b,c=a.ownerDocument,d=a.nodeName,e=ga[d];return e?e:(b=c.body.appendChild(c.createElement(d)),e=r.css(b,"display"),b.parentNode.removeChild(b),"none"===e&&(e="block"),ga[d]=e,e)}function ia(a,b){for(var c,d,e=[],f=0,g=a.length;f<g;f++)d=a[f],d.style&&(c=d.style.display,b?("none"===c&&(e[f]=W.get(d,"display")||null,e[f]||(d.style.display="")),""===d.style.display&&da(d)&&(e[f]=ha(d))):"none"!==c&&(e[f]="none",W.set(d,"display",c)));for(f=0;f<g;f++)null!=e[f]&&(a[f].style.display=e[f]);return a}r.fn.extend({show:function(){return ia(this,!0)},hide:function(){return ia(this)},toggle:function(a){return"boolean"==typeof a?a?this.show():this.hide():this.each(function(){da(this)?r(this).show():r(this).hide()})}});var ja=/^(?:checkbox|radio)$/i,ka=/<([a-z][^\/\0>\x20\t\r\n\f]+)/i,la=/^$|\/(?:java|ecma)script/i,ma={option:[1,"<select multiple='multiple'>","</select>"],thead:[1,"<table>","</table>"],col:[2,"<table><colgroup>","</colgroup></table>"],tr:[2,"<table><tbody>","</tbody></table>"],td:[3,"<table><tbody><tr>","</tr></tbody></table>"],_default:[0,"",""]};ma.optgroup=ma.option,ma.tbody=ma.tfoot=ma.colgroup=ma.caption=ma.thead,ma.th=ma.td;function na(a,b){var c;return c="undefined"!=typeof a.getElementsByTagName?a.getElementsByTagName(b||"*"):"undefined"!=typeof a.querySelectorAll?a.querySelectorAll(b||"*"):[],void 0===b||b&&B(a,b)?r.merge([a],c):c}function oa(a,b){for(var c=0,d=a.length;c<d;c++)W.set(a[c],"globalEval",!b||W.get(b[c],"globalEval"))}var pa=/<|&#?\w+;/;function qa(a,b,c,d,e){for(var f,g,h,i,j,k,l=b.createDocumentFragment(),m=[],n=0,o=a.length;n<o;n++)if(f=a[n],f||0===f)if("object"===r.type(f))r.merge(m,f.nodeType?[f]:f);else if(pa.test(f)){g=g||l.appendChild(b.createElement("div")),h=(ka.exec(f)||["",""])[1].toLowerCase(),i=ma[h]||ma._default,g.innerHTML=i[1]+r.htmlPrefilter(f)+i[2],k=i[0];while(k--)g=g.lastChild;r.merge(m,g.childNodes),g=l.firstChild,g.textContent=""}else m.push(b.createTextNode(f));l.textContent="",n=0;while(f=m[n++])if(d&&r.inArray(f,d)>-1)e&&e.push(f);else if(j=r.contains(f.ownerDocument,f),g=na(l.appendChild(f),"script"),j&&oa(g),c){k=0;while(f=g[k++])la.test(f.type||"")&&c.push(f)}return l}!function(){var a=d.createDocumentFragment(),b=a.appendChild(d.createElement("div")),c=d.createElement("input");c.setAttribute("type","radio"),c.setAttribute("checked","checked"),c.setAttribute("name","t"),b.appendChild(c),o.checkClone=b.cloneNode(!0).cloneNode(!0).lastChild.checked,b.innerHTML="<textarea>x</textarea>",o.noCloneChecked=!!b.cloneNode(!0).lastChild.defaultValue}();var ra=d.documentElement,sa=/^key/,ta=/^(?:mouse|pointer|contextmenu|drag|drop)|click/,ua=/^([^.]*)(?:\.(.+)|)/;function va(){return!0}function wa(){return!1}function xa(){try{return d.activeElement}catch(a){}}function ya(a,b,c,d,e,f){var g,h;if("object"==typeof b){"string"!=typeof c&&(d=d||c,c=void 0);for(h in b)ya(a,h,c,d,b[h],f);return a}if(null==d&&null==e?(e=c,d=c=void 0):null==e&&("string"==typeof c?(e=d,d=void 0):(e=d,d=c,c=void 0)),e===!1)e=wa;else if(!e)return a;return 1===f&&(g=e,e=function(a){return r().off(a),g.apply(this,arguments)},e.guid=g.guid||(g.guid=r.guid++)),a.each(function(){r.event.add(this,b,e,d,c)})}r.event={global:{},add:function(a,b,c,d,e){var f,g,h,i,j,k,l,m,n,o,p,q=W.get(a);if(q){c.handler&&(f=c,c=f.handler,e=f.selector),e&&r.find.matchesSelector(ra,e),c.guid||(c.guid=r.guid++),(i=q.events)||(i=q.events={}),(g=q.handle)||(g=q.handle=function(b){return"undefined"!=typeof r&&r.event.triggered!==b.type?r.event.dispatch.apply(a,arguments):void 0}),b=(b||"").match(L)||[""],j=b.length;while(j--)h=ua.exec(b[j])||[],n=p=h[1],o=(h[2]||"").split(".").sort(),n&&(l=r.event.special[n]||{},n=(e?l.delegateType:l.bindType)||n,l=r.event.special[n]||{},k=r.extend({type:n,origType:p,data:d,handler:c,guid:c.guid,selector:e,needsContext:e&&r.expr.match.needsContext.test(e),namespace:o.join(".")},f),(m=i[n])||(m=i[n]=[],m.delegateCount=0,l.setup&&l.setup.call(a,d,o,g)!==!1||a.addEventListener&&a.addEventListener(n,g)),l.add&&(l.add.call(a,k),k.handler.guid||(k.handler.guid=c.guid)),e?m.splice(m.delegateCount++,0,k):m.push(k),r.event.global[n]=!0)}},remove:function(a,b,c,d,e){var f,g,h,i,j,k,l,m,n,o,p,q=W.hasData(a)&&W.get(a);if(q&&(i=q.events)){b=(b||"").match(L)||[""],j=b.length;while(j--)if(h=ua.exec(b[j])||[],n=p=h[1],o=(h[2]||"").split(".").sort(),n){l=r.event.special[n]||{},n=(d?l.delegateType:l.bindType)||n,m=i[n]||[],h=h[2]&&new RegExp("(^|\\.)"+o.join("\\.(?:.*\\.|)")+"(\\.|$)"),g=f=m.length;while(f--)k=m[f],!e&&p!==k.origType||c&&c.guid!==k.guid||h&&!h.test(k.namespace)||d&&d!==k.selector&&("**"!==d||!k.selector)||(m.splice(f,1),k.selector&&m.delegateCount--,l.remove&&l.remove.call(a,k));g&&!m.length&&(l.teardown&&l.teardown.call(a,o,q.handle)!==!1||r.removeEvent(a,n,q.handle),delete i[n])}else for(n in i)r.event.remove(a,n+b[j],c,d,!0);r.isEmptyObject(i)&&W.remove(a,"handle events")}},dispatch:function(a){var b=r.event.fix(a),c,d,e,f,g,h,i=new Array(arguments.length),j=(W.get(this,"events")||{})[b.type]||[],k=r.event.special[b.type]||{};for(i[0]=b,c=1;c<arguments.length;c++)i[c]=arguments[c];if(b.delegateTarget=this,!k.preDispatch||k.preDispatch.call(this,b)!==!1){h=r.event.handlers.call(this,b,j),c=0;while((f=h[c++])&&!b.isPropagationStopped()){b.currentTarget=f.elem,d=0;while((g=f.handlers[d++])&&!b.isImmediatePropagationStopped())b.rnamespace&&!b.rnamespace.test(g.namespace)||(b.handleObj=g,b.data=g.data,e=((r.event.special[g.origType]||{}).handle||g.handler).apply(f.elem,i),void 0!==e&&(b.result=e)===!1&&(b.preventDefault(),b.stopPropagation()))}return k.postDispatch&&k.postDispatch.call(this,b),b.result}},handlers:function(a,b){var c,d,e,f,g,h=[],i=b.delegateCount,j=a.target;if(i&&j.nodeType&&!("click"===a.type&&a.button>=1))for(;j!==this;j=j.parentNode||this)if(1===j.nodeType&&("click"!==a.type||j.disabled!==!0)){for(f=[],g={},c=0;c<i;c++)d=b[c],e=d.selector+" ",void 0===g[e]&&(g[e]=d.needsContext?r(e,this).index(j)>-1:r.find(e,this,null,[j]).length),g[e]&&f.push(d);f.length&&h.push({elem:j,handlers:f})}return j=this,i<b.length&&h.push({elem:j,handlers:b.slice(i)}),h},addProp:function(a,b){Object.defineProperty(r.Event.prototype,a,{enumerable:!0,configurable:!0,get:r.isFunction(b)?function(){if(this.originalEvent)return b(this.originalEvent)}:function(){if(this.originalEvent)return this.originalEvent[a]},set:function(b){Object.defineProperty(this,a,{enumerable:!0,configurable:!0,writable:!0,value:b})}})},fix:function(a){return a[r.expando]?a:new r.Event(a)},special:{load:{noBubble:!0},focus:{trigger:function(){if(this!==xa()&&this.focus)return this.focus(),!1},delegateType:"focusin"},blur:{trigger:function(){if(this===xa()&&this.blur)return this.blur(),!1},delegateType:"focusout"},click:{trigger:function(){if("checkbox"===this.type&&this.click&&B(this,"input"))return this.click(),!1},_default:function(a){return B(a.target,"a")}},beforeunload:{postDispatch:function(a){void 0!==a.result&&a.originalEvent&&(a.originalEvent.returnValue=a.result)}}}},r.removeEvent=function(a,b,c){a.removeEventListener&&a.removeEventListener(b,c)},r.Event=function(a,b){return this instanceof r.Event?(a&&a.type?(this.originalEvent=a,this.type=a.type,this.isDefaultPrevented=a.defaultPrevented||void 0===a.defaultPrevented&&a.returnValue===!1?va:wa,this.target=a.target&&3===a.target.nodeType?a.target.parentNode:a.target,this.currentTarget=a.currentTarget,this.relatedTarget=a.relatedTarget):this.type=a,b&&r.extend(this,b),this.timeStamp=a&&a.timeStamp||r.now(),void(this[r.expando]=!0)):new r.Event(a,b)},r.Event.prototype={constructor:r.Event,isDefaultPrevented:wa,isPropagationStopped:wa,isImmediatePropagationStopped:wa,isSimulated:!1,preventDefault:function(){var a=this.originalEvent;this.isDefaultPrevented=va,a&&!this.isSimulated&&a.preventDefault()},stopPropagation:function(){var a=this.originalEvent;this.isPropagationStopped=va,a&&!this.isSimulated&&a.stopPropagation()},stopImmediatePropagation:function(){var a=this.originalEvent;this.isImmediatePropagationStopped=va,a&&!this.isSimulated&&a.stopImmediatePropagation(),this.stopPropagation()}},r.each({altKey:!0,bubbles:!0,cancelable:!0,changedTouches:!0,ctrlKey:!0,detail:!0,eventPhase:!0,metaKey:!0,pageX:!0,pageY:!0,shiftKey:!0,view:!0,"char":!0,charCode:!0,key:!0,keyCode:!0,button:!0,buttons:!0,clientX:!0,clientY:!0,offsetX:!0,offsetY:!0,pointerId:!0,pointerType:!0,screenX:!0,screenY:!0,targetTouches:!0,toElement:!0,touches:!0,which:function(a){var b=a.button;return null==a.which&&sa.test(a.type)?null!=a.charCode?a.charCode:a.keyCode:!a.which&&void 0!==b&&ta.test(a.type)?1&b?1:2&b?3:4&b?2:0:a.which}},r.event.addProp),r.each({mouseenter:"mouseover",mouseleave:"mouseout",pointerenter:"pointerover",pointerleave:"pointerout"},function(a,b){r.event.special[a]={delegateType:b,bindType:b,handle:function(a){var c,d=this,e=a.relatedTarget,f=a.handleObj;return e&&(e===d||r.contains(d,e))||(a.type=f.origType,c=f.handler.apply(this,arguments),a.type=b),c}}}),r.fn.extend({on:function(a,b,c,d){return ya(this,a,b,c,d)},one:function(a,b,c,d){return ya(this,a,b,c,d,1)},off:function(a,b,c){var d,e;if(a&&a.preventDefault&&a.handleObj)return d=a.handleObj,r(a.delegateTarget).off(d.namespace?d.origType+"."+d.namespace:d.origType,d.selector,d.handler),this;if("object"==typeof a){for(e in a)this.off(e,b,a[e]);return this}return b!==!1&&"function"!=typeof b||(c=b,b=void 0),c===!1&&(c=wa),this.each(function(){r.event.remove(this,a,c,b)})}});var za=/<(?!area|br|col|embed|hr|img|input|link|meta|param)(([a-z][^\/\0>\x20\t\r\n\f]*)[^>]*)\/>/gi,Aa=/<script|<style|<link/i,Ba=/checked\s*(?:[^=]|=\s*.checked.)/i,Ca=/^true\/(.*)/,Da=/^\s*<!(?:\[CDATA\[|--)|(?:\]\]|--)>\s*$/g;function Ea(a,b){return B(a,"table")&&B(11!==b.nodeType?b:b.firstChild,"tr")?r(">tbody",a)[0]||a:a}function Fa(a){return a.type=(null!==a.getAttribute("type"))+"/"+a.type,a}function Ga(a){var b=Ca.exec(a.type);return b?a.type=b[1]:a.removeAttribute("type"),a}function Ha(a,b){var c,d,e,f,g,h,i,j;if(1===b.nodeType){if(W.hasData(a)&&(f=W.access(a),g=W.set(b,f),j=f.events)){delete g.handle,g.events={};for(e in j)for(c=0,d=j[e].length;c<d;c++)r.event.add(b,e,j[e][c])}X.hasData(a)&&(h=X.access(a),i=r.extend({},h),X.set(b,i))}}function Ia(a,b){var c=b.nodeName.toLowerCase();"input"===c&&ja.test(a.type)?b.checked=a.checked:"input"!==c&&"textarea"!==c||(b.defaultValue=a.defaultValue)}function Ja(a,b,c,d){b=g.apply([],b);var e,f,h,i,j,k,l=0,m=a.length,n=m-1,q=b[0],s=r.isFunction(q);if(s||m>1&&"string"==typeof q&&!o.checkClone&&Ba.test(q))return a.each(function(e){var f=a.eq(e);s&&(b[0]=q.call(this,e,f.html())),Ja(f,b,c,d)});if(m&&(e=qa(b,a[0].ownerDocument,!1,a,d),f=e.firstChild,1===e.childNodes.length&&(e=f),f||d)){for(h=r.map(na(e,"script"),Fa),i=h.length;l<m;l++)j=e,l!==n&&(j=r.clone(j,!0,!0),i&&r.merge(h,na(j,"script"))),c.call(a[l],j,l);if(i)for(k=h[h.length-1].ownerDocument,r.map(h,Ga),l=0;l<i;l++)j=h[l],la.test(j.type||"")&&!W.access(j,"globalEval")&&r.contains(k,j)&&(j.src?r._evalUrl&&r._evalUrl(j.src):p(j.textContent.replace(Da,""),k))}return a}function Ka(a,b,c){for(var d,e=b?r.filter(b,a):a,f=0;null!=(d=e[f]);f++)c||1!==d.nodeType||r.cleanData(na(d)),d.parentNode&&(c&&r.contains(d.ownerDocument,d)&&oa(na(d,"script")),d.parentNode.removeChild(d));return a}r.extend({htmlPrefilter:function(a){return a.replace(za,"<$1></$2>")},clone:function(a,b,c){var d,e,f,g,h=a.cloneNode(!0),i=r.contains(a.ownerDocument,a);if(!(o.noCloneChecked||1!==a.nodeType&&11!==a.nodeType||r.isXMLDoc(a)))for(g=na(h),f=na(a),d=0,e=f.length;d<e;d++)Ia(f[d],g[d]);if(b)if(c)for(f=f||na(a),g=g||na(h),d=0,e=f.length;d<e;d++)Ha(f[d],g[d]);else Ha(a,h);return g=na(h,"script"),g.length>0&&oa(g,!i&&na(a,"script")),h},cleanData:function(a){for(var b,c,d,e=r.event.special,f=0;void 0!==(c=a[f]);f++)if(U(c)){if(b=c[W.expando]){if(b.events)for(d in b.events)e[d]?r.event.remove(c,d):r.removeEvent(c,d,b.handle);c[W.expando]=void 0}c[X.expando]&&(c[X.expando]=void 0)}}}),r.fn.extend({detach:function(a){return Ka(this,a,!0)},remove:function(a){return Ka(this,a)},text:function(a){return T(this,function(a){return void 0===a?r.text(this):this.empty().each(function(){1!==this.nodeType&&11!==this.nodeType&&9!==this.nodeType||(this.textContent=a)})},null,a,arguments.length)},append:function(){return Ja(this,arguments,function(a){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var b=Ea(this,a);b.appendChild(a)}})},prepend:function(){return Ja(this,arguments,function(a){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var b=Ea(this,a);b.insertBefore(a,b.firstChild)}})},before:function(){return Ja(this,arguments,function(a){this.parentNode&&this.parentNode.insertBefore(a,this)})},after:function(){return Ja(this,arguments,function(a){this.parentNode&&this.parentNode.insertBefore(a,this.nextSibling)})},empty:function(){for(var a,b=0;null!=(a=this[b]);b++)1===a.nodeType&&(r.cleanData(na(a,!1)),a.textContent="");return this},clone:function(a,b){return a=null!=a&&a,b=null==b?a:b,this.map(function(){return r.clone(this,a,b)})},html:function(a){return T(this,function(a){var b=this[0]||{},c=0,d=this.length;if(void 0===a&&1===b.nodeType)return b.innerHTML;if("string"==typeof a&&!Aa.test(a)&&!ma[(ka.exec(a)||["",""])[1].toLowerCase()]){a=r.htmlPrefilter(a);try{for(;c<d;c++)b=this[c]||{},1===b.nodeType&&(r.cleanData(na(b,!1)),b.innerHTML=a);b=0}catch(e){}}b&&this.empty().append(a)},null,a,arguments.length)},replaceWith:function(){var a=[];return Ja(this,arguments,function(b){var c=this.parentNode;r.inArray(this,a)<0&&(r.cleanData(na(this)),c&&c.replaceChild(b,this))},a)}}),r.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(a,b){r.fn[a]=function(a){for(var c,d=[],e=r(a),f=e.length-1,g=0;g<=f;g++)c=g===f?this:this.clone(!0),r(e[g])[b](c),h.apply(d,c.get());return this.pushStack(d)}});var La=/^margin/,Ma=new RegExp("^("+aa+")(?!px)[a-z%]+$","i"),Na=function(b){var c=b.ownerDocument.defaultView;return c&&c.opener||(c=a),c.getComputedStyle(b)};!function(){function b(){if(i){i.style.cssText="box-sizing:border-box;position:relative;display:block;margin:auto;border:1px;padding:1px;top:1%;width:50%",i.innerHTML="",ra.appendChild(h);var b=a.getComputedStyle(i);c="1%"!==b.top,g="2px"===b.marginLeft,e="4px"===b.width,i.style.marginRight="50%",f="4px"===b.marginRight,ra.removeChild(h),i=null}}var c,e,f,g,h=d.createElement("div"),i=d.createElement("div");i.style&&(i.style.backgroundClip="content-box",i.cloneNode(!0).style.backgroundClip="",o.clearCloneStyle="content-box"===i.style.backgroundClip,h.style.cssText="border:0;width:8px;height:0;top:0;left:-9999px;padding:0;margin-top:1px;position:absolute",h.appendChild(i),r.extend(o,{pixelPosition:function(){return b(),c},boxSizingReliable:function(){return b(),e},pixelMarginRight:function(){return b(),f},reliableMarginLeft:function(){return b(),g}}))}();function Oa(a,b,c){var d,e,f,g,h=a.style;return c=c||Na(a),c&&(g=c.getPropertyValue(b)||c[b],""!==g||r.contains(a.ownerDocument,a)||(g=r.style(a,b)),!o.pixelMarginRight()&&Ma.test(g)&&La.test(b)&&(d=h.width,e=h.minWidth,f=h.maxWidth,h.minWidth=h.maxWidth=h.width=g,g=c.width,h.width=d,h.minWidth=e,h.maxWidth=f)),void 0!==g?g+"":g}function Pa(a,b){return{get:function(){return a()?void delete this.get:(this.get=b).apply(this,arguments)}}}var Qa=/^(none|table(?!-c[ea]).+)/,Ra=/^--/,Sa={position:"absolute",visibility:"hidden",display:"block"},Ta={letterSpacing:"0",fontWeight:"400"},Ua=["Webkit","Moz","ms"],Va=d.createElement("div").style;function Wa(a){if(a in Va)return a;var b=a[0].toUpperCase()+a.slice(1),c=Ua.length;while(c--)if(a=Ua[c]+b,a in Va)return a}function Xa(a){var b=r.cssProps[a];return b||(b=r.cssProps[a]=Wa(a)||a),b}function Ya(a,b,c){var d=ba.exec(b);return d?Math.max(0,d[2]-(c||0))+(d[3]||"px"):b}function Za(a,b,c,d,e){var f,g=0;for(f=c===(d?"border":"content")?4:"width"===b?1:0;f<4;f+=2)"margin"===c&&(g+=r.css(a,c+ca[f],!0,e)),d?("content"===c&&(g-=r.css(a,"padding"+ca[f],!0,e)),"margin"!==c&&(g-=r.css(a,"border"+ca[f]+"Width",!0,e))):(g+=r.css(a,"padding"+ca[f],!0,e),"padding"!==c&&(g+=r.css(a,"border"+ca[f]+"Width",!0,e)));return g}function $a(a,b,c){var d,e=Na(a),f=Oa(a,b,e),g="border-box"===r.css(a,"boxSizing",!1,e);return Ma.test(f)?f:(d=g&&(o.boxSizingReliable()||f===a.style[b]),"auto"===f&&(f=a["offset"+b[0].toUpperCase()+b.slice(1)]),f=parseFloat(f)||0,f+Za(a,b,c||(g?"border":"content"),d,e)+"px")}r.extend({cssHooks:{opacity:{get:function(a,b){if(b){var c=Oa(a,"opacity");return""===c?"1":c}}}},cssNumber:{animationIterationCount:!0,columnCount:!0,fillOpacity:!0,flexGrow:!0,flexShrink:!0,fontWeight:!0,lineHeight:!0,opacity:!0,order:!0,orphans:!0,widows:!0,zIndex:!0,zoom:!0},cssProps:{"float":"cssFloat"},style:function(a,b,c,d){if(a&&3!==a.nodeType&&8!==a.nodeType&&a.style){var e,f,g,h=r.camelCase(b),i=Ra.test(b),j=a.style;return i||(b=Xa(h)),g=r.cssHooks[b]||r.cssHooks[h],void 0===c?g&&"get"in g&&void 0!==(e=g.get(a,!1,d))?e:j[b]:(f=typeof c,"string"===f&&(e=ba.exec(c))&&e[1]&&(c=fa(a,b,e),f="number"),null!=c&&c===c&&("number"===f&&(c+=e&&e[3]||(r.cssNumber[h]?"":"px")),o.clearCloneStyle||""!==c||0!==b.indexOf("background")||(j[b]="inherit"),g&&"set"in g&&void 0===(c=g.set(a,c,d))||(i?j.setProperty(b,c):j[b]=c)),void 0)}},css:function(a,b,c,d){var e,f,g,h=r.camelCase(b),i=Ra.test(b);return i||(b=Xa(h)),g=r.cssHooks[b]||r.cssHooks[h],g&&"get"in g&&(e=g.get(a,!0,c)),void 0===e&&(e=Oa(a,b,d)),"normal"===e&&b in Ta&&(e=Ta[b]),""===c||c?(f=parseFloat(e),c===!0||isFinite(f)?f||0:e):e}}),r.each(["height","width"],function(a,b){r.cssHooks[b]={get:function(a,c,d){if(c)return!Qa.test(r.css(a,"display"))||a.getClientRects().length&&a.getBoundingClientRect().width?$a(a,b,d):ea(a,Sa,function(){return $a(a,b,d)})},set:function(a,c,d){var e,f=d&&Na(a),g=d&&Za(a,b,d,"border-box"===r.css(a,"boxSizing",!1,f),f);return g&&(e=ba.exec(c))&&"px"!==(e[3]||"px")&&(a.style[b]=c,c=r.css(a,b)),Ya(a,c,g)}}}),r.cssHooks.marginLeft=Pa(o.reliableMarginLeft,function(a,b){if(b)return(parseFloat(Oa(a,"marginLeft"))||a.getBoundingClientRect().left-ea(a,{marginLeft:0},function(){return a.getBoundingClientRect().left}))+"px"}),r.each({margin:"",padding:"",border:"Width"},function(a,b){r.cssHooks[a+b]={expand:function(c){for(var d=0,e={},f="string"==typeof c?c.split(" "):[c];d<4;d++)e[a+ca[d]+b]=f[d]||f[d-2]||f[0];return e}},La.test(a)||(r.cssHooks[a+b].set=Ya)}),r.fn.extend({css:function(a,b){return T(this,function(a,b,c){var d,e,f={},g=0;if(Array.isArray(b)){for(d=Na(a),e=b.length;g<e;g++)f[b[g]]=r.css(a,b[g],!1,d);return f}return void 0!==c?r.style(a,b,c):r.css(a,b)},a,b,arguments.length>1)}});function _a(a,b,c,d,e){return new _a.prototype.init(a,b,c,d,e)}r.Tween=_a,_a.prototype={constructor:_a,init:function(a,b,c,d,e,f){this.elem=a,this.prop=c,this.easing=e||r.easing._default,this.options=b,this.start=this.now=this.cur(),this.end=d,this.unit=f||(r.cssNumber[c]?"":"px")},cur:function(){var a=_a.propHooks[this.prop];return a&&a.get?a.get(this):_a.propHooks._default.get(this)},run:function(a){var b,c=_a.propHooks[this.prop];return this.options.duration?this.pos=b=r.easing[this.easing](a,this.options.duration*a,0,1,this.options.duration):this.pos=b=a,this.now=(this.end-this.start)*b+this.start,this.options.step&&this.options.step.call(this.elem,this.now,this),c&&c.set?c.set(this):_a.propHooks._default.set(this),this}},_a.prototype.init.prototype=_a.prototype,_a.propHooks={_default:{get:function(a){var b;return 1!==a.elem.nodeType||null!=a.elem[a.prop]&&null==a.elem.style[a.prop]?a.elem[a.prop]:(b=r.css(a.elem,a.prop,""),b&&"auto"!==b?b:0)},set:function(a){r.fx.step[a.prop]?r.fx.step[a.prop](a):1!==a.elem.nodeType||null==a.elem.style[r.cssProps[a.prop]]&&!r.cssHooks[a.prop]?a.elem[a.prop]=a.now:r.style(a.elem,a.prop,a.now+a.unit)}}},_a.propHooks.scrollTop=_a.propHooks.scrollLeft={set:function(a){a.elem.nodeType&&a.elem.parentNode&&(a.elem[a.prop]=a.now)}},r.easing={linear:function(a){return a},swing:function(a){return.5-Math.cos(a*Math.PI)/2},_default:"swing"},r.fx=_a.prototype.init,r.fx.step={};var ab,bb,cb=/^(?:toggle|show|hide)$/,db=/queueHooks$/;function eb(){bb&&(d.hidden===!1&&a.requestAnimationFrame?a.requestAnimationFrame(eb):a.setTimeout(eb,r.fx.interval),r.fx.tick())}function fb(){return a.setTimeout(function(){ab=void 0}),ab=r.now()}function gb(a,b){var c,d=0,e={height:a};for(b=b?1:0;d<4;d+=2-b)c=ca[d],e["margin"+c]=e["padding"+c]=a;return b&&(e.opacity=e.width=a),e}function hb(a,b,c){for(var d,e=(kb.tweeners[b]||[]).concat(kb.tweeners["*"]),f=0,g=e.length;f<g;f++)if(d=e[f].call(c,b,a))return d}function ib(a,b,c){var d,e,f,g,h,i,j,k,l="width"in b||"height"in b,m=this,n={},o=a.style,p=a.nodeType&&da(a),q=W.get(a,"fxshow");c.queue||(g=r._queueHooks(a,"fx"),null==g.unqueued&&(g.unqueued=0,h=g.empty.fire,g.empty.fire=function(){g.unqueued||h()}),g.unqueued++,m.always(function(){m.always(function(){g.unqueued--,r.queue(a,"fx").length||g.empty.fire()})}));for(d in b)if(e=b[d],cb.test(e)){if(delete b[d],f=f||"toggle"===e,e===(p?"hide":"show")){if("show"!==e||!q||void 0===q[d])continue;p=!0}n[d]=q&&q[d]||r.style(a,d)}if(i=!r.isEmptyObject(b),i||!r.isEmptyObject(n)){l&&1===a.nodeType&&(c.overflow=[o.overflow,o.overflowX,o.overflowY],j=q&&q.display,null==j&&(j=W.get(a,"display")),k=r.css(a,"display"),"none"===k&&(j?k=j:(ia([a],!0),j=a.style.display||j,k=r.css(a,"display"),ia([a]))),("inline"===k||"inline-block"===k&&null!=j)&&"none"===r.css(a,"float")&&(i||(m.done(function(){o.display=j}),null==j&&(k=o.display,j="none"===k?"":k)),o.display="inline-block")),c.overflow&&(o.overflow="hidden",m.always(function(){o.overflow=c.overflow[0],o.overflowX=c.overflow[1],o.overflowY=c.overflow[2]})),i=!1;for(d in n)i||(q?"hidden"in q&&(p=q.hidden):q=W.access(a,"fxshow",{display:j}),f&&(q.hidden=!p),p&&ia([a],!0),m.done(function(){p||ia([a]),W.remove(a,"fxshow");for(d in n)r.style(a,d,n[d])})),i=hb(p?q[d]:0,d,m),d in q||(q[d]=i.start,p&&(i.end=i.start,i.start=0))}}function jb(a,b){var c,d,e,f,g;for(c in a)if(d=r.camelCase(c),e=b[d],f=a[c],Array.isArray(f)&&(e=f[1],f=a[c]=f[0]),c!==d&&(a[d]=f,delete a[c]),g=r.cssHooks[d],g&&"expand"in g){f=g.expand(f),delete a[d];for(c in f)c in a||(a[c]=f[c],b[c]=e)}else b[d]=e}function kb(a,b,c){var d,e,f=0,g=kb.prefilters.length,h=r.Deferred().always(function(){delete i.elem}),i=function(){if(e)return!1;for(var b=ab||fb(),c=Math.max(0,j.startTime+j.duration-b),d=c/j.duration||0,f=1-d,g=0,i=j.tweens.length;g<i;g++)j.tweens[g].run(f);return h.notifyWith(a,[j,f,c]),f<1&&i?c:(i||h.notifyWith(a,[j,1,0]),h.resolveWith(a,[j]),!1)},j=h.promise({elem:a,props:r.extend({},b),opts:r.extend(!0,{specialEasing:{},easing:r.easing._default},c),originalProperties:b,originalOptions:c,startTime:ab||fb(),duration:c.duration,tweens:[],createTween:function(b,c){var d=r.Tween(a,j.opts,b,c,j.opts.specialEasing[b]||j.opts.easing);return j.tweens.push(d),d},stop:function(b){var c=0,d=b?j.tweens.length:0;if(e)return this;for(e=!0;c<d;c++)j.tweens[c].run(1);return b?(h.notifyWith(a,[j,1,0]),h.resolveWith(a,[j,b])):h.rejectWith(a,[j,b]),this}}),k=j.props;for(jb(k,j.opts.specialEasing);f<g;f++)if(d=kb.prefilters[f].call(j,a,k,j.opts))return r.isFunction(d.stop)&&(r._queueHooks(j.elem,j.opts.queue).stop=r.proxy(d.stop,d)),d;return r.map(k,hb,j),r.isFunction(j.opts.start)&&j.opts.start.call(a,j),j.progress(j.opts.progress).done(j.opts.done,j.opts.complete).fail(j.opts.fail).always(j.opts.always),r.fx.timer(r.extend(i,{elem:a,anim:j,queue:j.opts.queue})),j}r.Animation=r.extend(kb,{tweeners:{"*":[function(a,b){var c=this.createTween(a,b);return fa(c.elem,a,ba.exec(b),c),c}]},tweener:function(a,b){r.isFunction(a)?(b=a,a=["*"]):a=a.match(L);for(var c,d=0,e=a.length;d<e;d++)c=a[d],kb.tweeners[c]=kb.tweeners[c]||[],kb.tweeners[c].unshift(b)},prefilters:[ib],prefilter:function(a,b){b?kb.prefilters.unshift(a):kb.prefilters.push(a)}}),r.speed=function(a,b,c){var d=a&&"object"==typeof a?r.extend({},a):{complete:c||!c&&b||r.isFunction(a)&&a,duration:a,easing:c&&b||b&&!r.isFunction(b)&&b};return r.fx.off?d.duration=0:"number"!=typeof d.duration&&(d.duration in r.fx.speeds?d.duration=r.fx.speeds[d.duration]:d.duration=r.fx.speeds._default),null!=d.queue&&d.queue!==!0||(d.queue="fx"),d.old=d.complete,d.complete=function(){r.isFunction(d.old)&&d.old.call(this),d.queue&&r.dequeue(this,d.queue)},d},r.fn.extend({fadeTo:function(a,b,c,d){return this.filter(da).css("opacity",0).show().end().animate({opacity:b},a,c,d)},animate:function(a,b,c,d){var e=r.isEmptyObject(a),f=r.speed(b,c,d),g=function(){var b=kb(this,r.extend({},a),f);(e||W.get(this,"finish"))&&b.stop(!0)};return g.finish=g,e||f.queue===!1?this.each(g):this.queue(f.queue,g)},stop:function(a,b,c){var d=function(a){var b=a.stop;delete a.stop,b(c)};return"string"!=typeof a&&(c=b,b=a,a=void 0),b&&a!==!1&&this.queue(a||"fx",[]),this.each(function(){var b=!0,e=null!=a&&a+"queueHooks",f=r.timers,g=W.get(this);if(e)g[e]&&g[e].stop&&d(g[e]);else for(e in g)g[e]&&g[e].stop&&db.test(e)&&d(g[e]);for(e=f.length;e--;)f[e].elem!==this||null!=a&&f[e].queue!==a||(f[e].anim.stop(c),b=!1,f.splice(e,1));!b&&c||r.dequeue(this,a)})},finish:function(a){return a!==!1&&(a=a||"fx"),this.each(function(){var b,c=W.get(this),d=c[a+"queue"],e=c[a+"queueHooks"],f=r.timers,g=d?d.length:0;for(c.finish=!0,r.queue(this,a,[]),e&&e.stop&&e.stop.call(this,!0),b=f.length;b--;)f[b].elem===this&&f[b].queue===a&&(f[b].anim.stop(!0),f.splice(b,1));for(b=0;b<g;b++)d[b]&&d[b].finish&&d[b].finish.call(this);delete c.finish})}}),r.each(["toggle","show","hide"],function(a,b){var c=r.fn[b];r.fn[b]=function(a,d,e){return null==a||"boolean"==typeof a?c.apply(this,arguments):this.animate(gb(b,!0),a,d,e)}}),r.each({slideDown:gb("show"),slideUp:gb("hide"),slideToggle:gb("toggle"),fadeIn:{opacity:"show"},fadeOut:{opacity:"hide"},fadeToggle:{opacity:"toggle"}},function(a,b){r.fn[a]=function(a,c,d){return this.animate(b,a,c,d)}}),r.timers=[],r.fx.tick=function(){var a,b=0,c=r.timers;for(ab=r.now();b<c.length;b++)a=c[b],a()||c[b]!==a||c.splice(b--,1);c.length||r.fx.stop(),ab=void 0},r.fx.timer=function(a){r.timers.push(a),r.fx.start()},r.fx.interval=13,r.fx.start=function(){bb||(bb=!0,eb())},r.fx.stop=function(){bb=null},r.fx.speeds={slow:600,fast:200,_default:400},r.fn.delay=function(b,c){return b=r.fx?r.fx.speeds[b]||b:b,c=c||"fx",this.queue(c,function(c,d){var e=a.setTimeout(c,b);d.stop=function(){a.clearTimeout(e)}})},function(){var a=d.createElement("input"),b=d.createElement("select"),c=b.appendChild(d.createElement("option"));a.type="checkbox",o.checkOn=""!==a.value,o.optSelected=c.selected,a=d.createElement("input"),a.value="t",a.type="radio",o.radioValue="t"===a.value}();var lb,mb=r.expr.attrHandle;r.fn.extend({attr:function(a,b){return T(this,r.attr,a,b,arguments.length>1)},removeAttr:function(a){return this.each(function(){r.removeAttr(this,a)})}}),r.extend({attr:function(a,b,c){var d,e,f=a.nodeType;if(3!==f&&8!==f&&2!==f)return"undefined"==typeof a.getAttribute?r.prop(a,b,c):(1===f&&r.isXMLDoc(a)||(e=r.attrHooks[b.toLowerCase()]||(r.expr.match.bool.test(b)?lb:void 0)),void 0!==c?null===c?void r.removeAttr(a,b):e&&"set"in e&&void 0!==(d=e.set(a,c,b))?d:(a.setAttribute(b,c+""),c):e&&"get"in e&&null!==(d=e.get(a,b))?d:(d=r.find.attr(a,b),
+null==d?void 0:d))},attrHooks:{type:{set:function(a,b){if(!o.radioValue&&"radio"===b&&B(a,"input")){var c=a.value;return a.setAttribute("type",b),c&&(a.value=c),b}}}},removeAttr:function(a,b){var c,d=0,e=b&&b.match(L);if(e&&1===a.nodeType)while(c=e[d++])a.removeAttribute(c)}}),lb={set:function(a,b,c){return b===!1?r.removeAttr(a,c):a.setAttribute(c,c),c}},r.each(r.expr.match.bool.source.match(/\w+/g),function(a,b){var c=mb[b]||r.find.attr;mb[b]=function(a,b,d){var e,f,g=b.toLowerCase();return d||(f=mb[g],mb[g]=e,e=null!=c(a,b,d)?g:null,mb[g]=f),e}});var nb=/^(?:input|select|textarea|button)$/i,ob=/^(?:a|area)$/i;r.fn.extend({prop:function(a,b){return T(this,r.prop,a,b,arguments.length>1)},removeProp:function(a){return this.each(function(){delete this[r.propFix[a]||a]})}}),r.extend({prop:function(a,b,c){var d,e,f=a.nodeType;if(3!==f&&8!==f&&2!==f)return 1===f&&r.isXMLDoc(a)||(b=r.propFix[b]||b,e=r.propHooks[b]),void 0!==c?e&&"set"in e&&void 0!==(d=e.set(a,c,b))?d:a[b]=c:e&&"get"in e&&null!==(d=e.get(a,b))?d:a[b]},propHooks:{tabIndex:{get:function(a){var b=r.find.attr(a,"tabindex");return b?parseInt(b,10):nb.test(a.nodeName)||ob.test(a.nodeName)&&a.href?0:-1}}},propFix:{"for":"htmlFor","class":"className"}}),o.optSelected||(r.propHooks.selected={get:function(a){var b=a.parentNode;return b&&b.parentNode&&b.parentNode.selectedIndex,null},set:function(a){var b=a.parentNode;b&&(b.selectedIndex,b.parentNode&&b.parentNode.selectedIndex)}}),r.each(["tabIndex","readOnly","maxLength","cellSpacing","cellPadding","rowSpan","colSpan","useMap","frameBorder","contentEditable"],function(){r.propFix[this.toLowerCase()]=this});function pb(a){var b=a.match(L)||[];return b.join(" ")}function qb(a){return a.getAttribute&&a.getAttribute("class")||""}r.fn.extend({addClass:function(a){var b,c,d,e,f,g,h,i=0;if(r.isFunction(a))return this.each(function(b){r(this).addClass(a.call(this,b,qb(this)))});if("string"==typeof a&&a){b=a.match(L)||[];while(c=this[i++])if(e=qb(c),d=1===c.nodeType&&" "+pb(e)+" "){g=0;while(f=b[g++])d.indexOf(" "+f+" ")<0&&(d+=f+" ");h=pb(d),e!==h&&c.setAttribute("class",h)}}return this},removeClass:function(a){var b,c,d,e,f,g,h,i=0;if(r.isFunction(a))return this.each(function(b){r(this).removeClass(a.call(this,b,qb(this)))});if(!arguments.length)return this.attr("class","");if("string"==typeof a&&a){b=a.match(L)||[];while(c=this[i++])if(e=qb(c),d=1===c.nodeType&&" "+pb(e)+" "){g=0;while(f=b[g++])while(d.indexOf(" "+f+" ")>-1)d=d.replace(" "+f+" "," ");h=pb(d),e!==h&&c.setAttribute("class",h)}}return this},toggleClass:function(a,b){var c=typeof a;return"boolean"==typeof b&&"string"===c?b?this.addClass(a):this.removeClass(a):r.isFunction(a)?this.each(function(c){r(this).toggleClass(a.call(this,c,qb(this),b),b)}):this.each(function(){var b,d,e,f;if("string"===c){d=0,e=r(this),f=a.match(L)||[];while(b=f[d++])e.hasClass(b)?e.removeClass(b):e.addClass(b)}else void 0!==a&&"boolean"!==c||(b=qb(this),b&&W.set(this,"__className__",b),this.setAttribute&&this.setAttribute("class",b||a===!1?"":W.get(this,"__className__")||""))})},hasClass:function(a){var b,c,d=0;b=" "+a+" ";while(c=this[d++])if(1===c.nodeType&&(" "+pb(qb(c))+" ").indexOf(b)>-1)return!0;return!1}});var rb=/\r/g;r.fn.extend({val:function(a){var b,c,d,e=this[0];{if(arguments.length)return d=r.isFunction(a),this.each(function(c){var e;1===this.nodeType&&(e=d?a.call(this,c,r(this).val()):a,null==e?e="":"number"==typeof e?e+="":Array.isArray(e)&&(e=r.map(e,function(a){return null==a?"":a+""})),b=r.valHooks[this.type]||r.valHooks[this.nodeName.toLowerCase()],b&&"set"in b&&void 0!==b.set(this,e,"value")||(this.value=e))});if(e)return b=r.valHooks[e.type]||r.valHooks[e.nodeName.toLowerCase()],b&&"get"in b&&void 0!==(c=b.get(e,"value"))?c:(c=e.value,"string"==typeof c?c.replace(rb,""):null==c?"":c)}}}),r.extend({valHooks:{option:{get:function(a){var b=r.find.attr(a,"value");return null!=b?b:pb(r.text(a))}},select:{get:function(a){var b,c,d,e=a.options,f=a.selectedIndex,g="select-one"===a.type,h=g?null:[],i=g?f+1:e.length;for(d=f<0?i:g?f:0;d<i;d++)if(c=e[d],(c.selected||d===f)&&!c.disabled&&(!c.parentNode.disabled||!B(c.parentNode,"optgroup"))){if(b=r(c).val(),g)return b;h.push(b)}return h},set:function(a,b){var c,d,e=a.options,f=r.makeArray(b),g=e.length;while(g--)d=e[g],(d.selected=r.inArray(r.valHooks.option.get(d),f)>-1)&&(c=!0);return c||(a.selectedIndex=-1),f}}}}),r.each(["radio","checkbox"],function(){r.valHooks[this]={set:function(a,b){if(Array.isArray(b))return a.checked=r.inArray(r(a).val(),b)>-1}},o.checkOn||(r.valHooks[this].get=function(a){return null===a.getAttribute("value")?"on":a.value})});var sb=/^(?:focusinfocus|focusoutblur)$/;r.extend(r.event,{trigger:function(b,c,e,f){var g,h,i,j,k,m,n,o=[e||d],p=l.call(b,"type")?b.type:b,q=l.call(b,"namespace")?b.namespace.split("."):[];if(h=i=e=e||d,3!==e.nodeType&&8!==e.nodeType&&!sb.test(p+r.event.triggered)&&(p.indexOf(".")>-1&&(q=p.split("."),p=q.shift(),q.sort()),k=p.indexOf(":")<0&&"on"+p,b=b[r.expando]?b:new r.Event(p,"object"==typeof b&&b),b.isTrigger=f?2:3,b.namespace=q.join("."),b.rnamespace=b.namespace?new RegExp("(^|\\.)"+q.join("\\.(?:.*\\.|)")+"(\\.|$)"):null,b.result=void 0,b.target||(b.target=e),c=null==c?[b]:r.makeArray(c,[b]),n=r.event.special[p]||{},f||!n.trigger||n.trigger.apply(e,c)!==!1)){if(!f&&!n.noBubble&&!r.isWindow(e)){for(j=n.delegateType||p,sb.test(j+p)||(h=h.parentNode);h;h=h.parentNode)o.push(h),i=h;i===(e.ownerDocument||d)&&o.push(i.defaultView||i.parentWindow||a)}g=0;while((h=o[g++])&&!b.isPropagationStopped())b.type=g>1?j:n.bindType||p,m=(W.get(h,"events")||{})[b.type]&&W.get(h,"handle"),m&&m.apply(h,c),m=k&&h[k],m&&m.apply&&U(h)&&(b.result=m.apply(h,c),b.result===!1&&b.preventDefault());return b.type=p,f||b.isDefaultPrevented()||n._default&&n._default.apply(o.pop(),c)!==!1||!U(e)||k&&r.isFunction(e[p])&&!r.isWindow(e)&&(i=e[k],i&&(e[k]=null),r.event.triggered=p,e[p](),r.event.triggered=void 0,i&&(e[k]=i)),b.result}},simulate:function(a,b,c){var d=r.extend(new r.Event,c,{type:a,isSimulated:!0});r.event.trigger(d,null,b)}}),r.fn.extend({trigger:function(a,b){return this.each(function(){r.event.trigger(a,b,this)})},triggerHandler:function(a,b){var c=this[0];if(c)return r.event.trigger(a,b,c,!0)}}),r.each("blur focus focusin focusout resize scroll click dblclick mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave change select submit keydown keypress keyup contextmenu".split(" "),function(a,b){r.fn[b]=function(a,c){return arguments.length>0?this.on(b,null,a,c):this.trigger(b)}}),r.fn.extend({hover:function(a,b){return this.mouseenter(a).mouseleave(b||a)}}),o.focusin="onfocusin"in a,o.focusin||r.each({focus:"focusin",blur:"focusout"},function(a,b){var c=function(a){r.event.simulate(b,a.target,r.event.fix(a))};r.event.special[b]={setup:function(){var d=this.ownerDocument||this,e=W.access(d,b);e||d.addEventListener(a,c,!0),W.access(d,b,(e||0)+1)},teardown:function(){var d=this.ownerDocument||this,e=W.access(d,b)-1;e?W.access(d,b,e):(d.removeEventListener(a,c,!0),W.remove(d,b))}}});var tb=a.location,ub=r.now(),vb=/\?/;r.parseXML=function(b){var c;if(!b||"string"!=typeof b)return null;try{c=(new a.DOMParser).parseFromString(b,"text/xml")}catch(d){c=void 0}return c&&!c.getElementsByTagName("parsererror").length||r.error("Invalid XML: "+b),c};var wb=/\[\]$/,xb=/\r?\n/g,yb=/^(?:submit|button|image|reset|file)$/i,zb=/^(?:input|select|textarea|keygen)/i;function Ab(a,b,c,d){var e;if(Array.isArray(b))r.each(b,function(b,e){c||wb.test(a)?d(a,e):Ab(a+"["+("object"==typeof e&&null!=e?b:"")+"]",e,c,d)});else if(c||"object"!==r.type(b))d(a,b);else for(e in b)Ab(a+"["+e+"]",b[e],c,d)}r.param=function(a,b){var c,d=[],e=function(a,b){var c=r.isFunction(b)?b():b;d[d.length]=encodeURIComponent(a)+"="+encodeURIComponent(null==c?"":c)};if(Array.isArray(a)||a.jquery&&!r.isPlainObject(a))r.each(a,function(){e(this.name,this.value)});else for(c in a)Ab(c,a[c],b,e);return d.join("&")},r.fn.extend({serialize:function(){return r.param(this.serializeArray())},serializeArray:function(){return this.map(function(){var a=r.prop(this,"elements");return a?r.makeArray(a):this}).filter(function(){var a=this.type;return this.name&&!r(this).is(":disabled")&&zb.test(this.nodeName)&&!yb.test(a)&&(this.checked||!ja.test(a))}).map(function(a,b){var c=r(this).val();return null==c?null:Array.isArray(c)?r.map(c,function(a){return{name:b.name,value:a.replace(xb,"\r\n")}}):{name:b.name,value:c.replace(xb,"\r\n")}}).get()}});var Bb=/%20/g,Cb=/#.*$/,Db=/([?&])_=[^&]*/,Eb=/^(.*?):[ \t]*([^\r\n]*)$/gm,Fb=/^(?:about|app|app-storage|.+-extension|file|res|widget):$/,Gb=/^(?:GET|HEAD)$/,Hb=/^\/\//,Ib={},Jb={},Kb="*/".concat("*"),Lb=d.createElement("a");Lb.href=tb.href;function Mb(a){return function(b,c){"string"!=typeof b&&(c=b,b="*");var d,e=0,f=b.toLowerCase().match(L)||[];if(r.isFunction(c))while(d=f[e++])"+"===d[0]?(d=d.slice(1)||"*",(a[d]=a[d]||[]).unshift(c)):(a[d]=a[d]||[]).push(c)}}function Nb(a,b,c,d){var e={},f=a===Jb;function g(h){var i;return e[h]=!0,r.each(a[h]||[],function(a,h){var j=h(b,c,d);return"string"!=typeof j||f||e[j]?f?!(i=j):void 0:(b.dataTypes.unshift(j),g(j),!1)}),i}return g(b.dataTypes[0])||!e["*"]&&g("*")}function Ob(a,b){var c,d,e=r.ajaxSettings.flatOptions||{};for(c in b)void 0!==b[c]&&((e[c]?a:d||(d={}))[c]=b[c]);return d&&r.extend(!0,a,d),a}function Pb(a,b,c){var d,e,f,g,h=a.contents,i=a.dataTypes;while("*"===i[0])i.shift(),void 0===d&&(d=a.mimeType||b.getResponseHeader("Content-Type"));if(d)for(e in h)if(h[e]&&h[e].test(d)){i.unshift(e);break}if(i[0]in c)f=i[0];else{for(e in c){if(!i[0]||a.converters[e+" "+i[0]]){f=e;break}g||(g=e)}f=f||g}if(f)return f!==i[0]&&i.unshift(f),c[f]}function Qb(a,b,c,d){var e,f,g,h,i,j={},k=a.dataTypes.slice();if(k[1])for(g in a.converters)j[g.toLowerCase()]=a.converters[g];f=k.shift();while(f)if(a.responseFields[f]&&(c[a.responseFields[f]]=b),!i&&d&&a.dataFilter&&(b=a.dataFilter(b,a.dataType)),i=f,f=k.shift())if("*"===f)f=i;else if("*"!==i&&i!==f){if(g=j[i+" "+f]||j["* "+f],!g)for(e in j)if(h=e.split(" "),h[1]===f&&(g=j[i+" "+h[0]]||j["* "+h[0]])){g===!0?g=j[e]:j[e]!==!0&&(f=h[0],k.unshift(h[1]));break}if(g!==!0)if(g&&a["throws"])b=g(b);else try{b=g(b)}catch(l){return{state:"parsererror",error:g?l:"No conversion from "+i+" to "+f}}}return{state:"success",data:b}}r.extend({active:0,lastModified:{},etag:{},ajaxSettings:{url:tb.href,type:"GET",isLocal:Fb.test(tb.protocol),global:!0,processData:!0,async:!0,contentType:"application/x-www-form-urlencoded; charset=UTF-8",accepts:{"*":Kb,text:"text/plain",html:"text/html",xml:"application/xml, text/xml",json:"application/json, text/javascript"},contents:{xml:/\bxml\b/,html:/\bhtml/,json:/\bjson\b/},responseFields:{xml:"responseXML",text:"responseText",json:"responseJSON"},converters:{"* text":String,"text html":!0,"text json":JSON.parse,"text xml":r.parseXML},flatOptions:{url:!0,context:!0}},ajaxSetup:function(a,b){return b?Ob(Ob(a,r.ajaxSettings),b):Ob(r.ajaxSettings,a)},ajaxPrefilter:Mb(Ib),ajaxTransport:Mb(Jb),ajax:function(b,c){"object"==typeof b&&(c=b,b=void 0),c=c||{};var e,f,g,h,i,j,k,l,m,n,o=r.ajaxSetup({},c),p=o.context||o,q=o.context&&(p.nodeType||p.jquery)?r(p):r.event,s=r.Deferred(),t=r.Callbacks("once memory"),u=o.statusCode||{},v={},w={},x="canceled",y={readyState:0,getResponseHeader:function(a){var b;if(k){if(!h){h={};while(b=Eb.exec(g))h[b[1].toLowerCase()]=b[2]}b=h[a.toLowerCase()]}return null==b?null:b},getAllResponseHeaders:function(){return k?g:null},setRequestHeader:function(a,b){return null==k&&(a=w[a.toLowerCase()]=w[a.toLowerCase()]||a,v[a]=b),this},overrideMimeType:function(a){return null==k&&(o.mimeType=a),this},statusCode:function(a){var b;if(a)if(k)y.always(a[y.status]);else for(b in a)u[b]=[u[b],a[b]];return this},abort:function(a){var b=a||x;return e&&e.abort(b),A(0,b),this}};if(s.promise(y),o.url=((b||o.url||tb.href)+"").replace(Hb,tb.protocol+"//"),o.type=c.method||c.type||o.method||o.type,o.dataTypes=(o.dataType||"*").toLowerCase().match(L)||[""],null==o.crossDomain){j=d.createElement("a");try{j.href=o.url,j.href=j.href,o.crossDomain=Lb.protocol+"//"+Lb.host!=j.protocol+"//"+j.host}catch(z){o.crossDomain=!0}}if(o.data&&o.processData&&"string"!=typeof o.data&&(o.data=r.param(o.data,o.traditional)),Nb(Ib,o,c,y),k)return y;l=r.event&&o.global,l&&0===r.active++&&r.event.trigger("ajaxStart"),o.type=o.type.toUpperCase(),o.hasContent=!Gb.test(o.type),f=o.url.replace(Cb,""),o.hasContent?o.data&&o.processData&&0===(o.contentType||"").indexOf("application/x-www-form-urlencoded")&&(o.data=o.data.replace(Bb,"+")):(n=o.url.slice(f.length),o.data&&(f+=(vb.test(f)?"&":"?")+o.data,delete o.data),o.cache===!1&&(f=f.replace(Db,"$1"),n=(vb.test(f)?"&":"?")+"_="+ub++ +n),o.url=f+n),o.ifModified&&(r.lastModified[f]&&y.setRequestHeader("If-Modified-Since",r.lastModified[f]),r.etag[f]&&y.setRequestHeader("If-None-Match",r.etag[f])),(o.data&&o.hasContent&&o.contentType!==!1||c.contentType)&&y.setRequestHeader("Content-Type",o.contentType),y.setRequestHeader("Accept",o.dataTypes[0]&&o.accepts[o.dataTypes[0]]?o.accepts[o.dataTypes[0]]+("*"!==o.dataTypes[0]?", "+Kb+"; q=0.01":""):o.accepts["*"]);for(m in o.headers)y.setRequestHeader(m,o.headers[m]);if(o.beforeSend&&(o.beforeSend.call(p,y,o)===!1||k))return y.abort();if(x="abort",t.add(o.complete),y.done(o.success),y.fail(o.error),e=Nb(Jb,o,c,y)){if(y.readyState=1,l&&q.trigger("ajaxSend",[y,o]),k)return y;o.async&&o.timeout>0&&(i=a.setTimeout(function(){y.abort("timeout")},o.timeout));try{k=!1,e.send(v,A)}catch(z){if(k)throw z;A(-1,z)}}else A(-1,"No Transport");function A(b,c,d,h){var j,m,n,v,w,x=c;k||(k=!0,i&&a.clearTimeout(i),e=void 0,g=h||"",y.readyState=b>0?4:0,j=b>=200&&b<300||304===b,d&&(v=Pb(o,y,d)),v=Qb(o,v,y,j),j?(o.ifModified&&(w=y.getResponseHeader("Last-Modified"),w&&(r.lastModified[f]=w),w=y.getResponseHeader("etag"),w&&(r.etag[f]=w)),204===b||"HEAD"===o.type?x="nocontent":304===b?x="notmodified":(x=v.state,m=v.data,n=v.error,j=!n)):(n=x,!b&&x||(x="error",b<0&&(b=0))),y.status=b,y.statusText=(c||x)+"",j?s.resolveWith(p,[m,x,y]):s.rejectWith(p,[y,x,n]),y.statusCode(u),u=void 0,l&&q.trigger(j?"ajaxSuccess":"ajaxError",[y,o,j?m:n]),t.fireWith(p,[y,x]),l&&(q.trigger("ajaxComplete",[y,o]),--r.active||r.event.trigger("ajaxStop")))}return y},getJSON:function(a,b,c){return r.get(a,b,c,"json")},getScript:function(a,b){return r.get(a,void 0,b,"script")}}),r.each(["get","post"],function(a,b){r[b]=function(a,c,d,e){return r.isFunction(c)&&(e=e||d,d=c,c=void 0),r.ajax(r.extend({url:a,type:b,dataType:e,data:c,success:d},r.isPlainObject(a)&&a))}}),r._evalUrl=function(a){return r.ajax({url:a,type:"GET",dataType:"script",cache:!0,async:!1,global:!1,"throws":!0})},r.fn.extend({wrapAll:function(a){var b;return this[0]&&(r.isFunction(a)&&(a=a.call(this[0])),b=r(a,this[0].ownerDocument).eq(0).clone(!0),this[0].parentNode&&b.insertBefore(this[0]),b.map(function(){var a=this;while(a.firstElementChild)a=a.firstElementChild;return a}).append(this)),this},wrapInner:function(a){return r.isFunction(a)?this.each(function(b){r(this).wrapInner(a.call(this,b))}):this.each(function(){var b=r(this),c=b.contents();c.length?c.wrapAll(a):b.append(a)})},wrap:function(a){var b=r.isFunction(a);return this.each(function(c){r(this).wrapAll(b?a.call(this,c):a)})},unwrap:function(a){return this.parent(a).not("body").each(function(){r(this).replaceWith(this.childNodes)}),this}}),r.expr.pseudos.hidden=function(a){return!r.expr.pseudos.visible(a)},r.expr.pseudos.visible=function(a){return!!(a.offsetWidth||a.offsetHeight||a.getClientRects().length)},r.ajaxSettings.xhr=function(){try{return new a.XMLHttpRequest}catch(b){}};var Rb={0:200,1223:204},Sb=r.ajaxSettings.xhr();o.cors=!!Sb&&"withCredentials"in Sb,o.ajax=Sb=!!Sb,r.ajaxTransport(function(b){var c,d;if(o.cors||Sb&&!b.crossDomain)return{send:function(e,f){var g,h=b.xhr();if(h.open(b.type,b.url,b.async,b.username,b.password),b.xhrFields)for(g in b.xhrFields)h[g]=b.xhrFields[g];b.mimeType&&h.overrideMimeType&&h.overrideMimeType(b.mimeType),b.crossDomain||e["X-Requested-With"]||(e["X-Requested-With"]="XMLHttpRequest");for(g in e)h.setRequestHeader(g,e[g]);c=function(a){return function(){c&&(c=d=h.onload=h.onerror=h.onabort=h.onreadystatechange=null,"abort"===a?h.abort():"error"===a?"number"!=typeof h.status?f(0,"error"):f(h.status,h.statusText):f(Rb[h.status]||h.status,h.statusText,"text"!==(h.responseType||"text")||"string"!=typeof h.responseText?{binary:h.response}:{text:h.responseText},h.getAllResponseHeaders()))}},h.onload=c(),d=h.onerror=c("error"),void 0!==h.onabort?h.onabort=d:h.onreadystatechange=function(){4===h.readyState&&a.setTimeout(function(){c&&d()})},c=c("abort");try{h.send(b.hasContent&&b.data||null)}catch(i){if(c)throw i}},abort:function(){c&&c()}}}),r.ajaxPrefilter(function(a){a.crossDomain&&(a.contents.script=!1)}),r.ajaxSetup({accepts:{script:"text/javascript, application/javascript, application/ecmascript, application/x-ecmascript"},contents:{script:/\b(?:java|ecma)script\b/},converters:{"text script":function(a){return r.globalEval(a),a}}}),r.ajaxPrefilter("script",function(a){void 0===a.cache&&(a.cache=!1),a.crossDomain&&(a.type="GET")}),r.ajaxTransport("script",function(a){if(a.crossDomain){var b,c;return{send:function(e,f){b=r("<script>").prop({charset:a.scriptCharset,src:a.url}).on("load error",c=function(a){b.remove(),c=null,a&&f("error"===a.type?404:200,a.type)}),d.head.appendChild(b[0])},abort:function(){c&&c()}}}});var Tb=[],Ub=/(=)\?(?=&|$)|\?\?/;r.ajaxSetup({jsonp:"callback",jsonpCallback:function(){var a=Tb.pop()||r.expando+"_"+ub++;return this[a]=!0,a}}),r.ajaxPrefilter("json jsonp",function(b,c,d){var e,f,g,h=b.jsonp!==!1&&(Ub.test(b.url)?"url":"string"==typeof b.data&&0===(b.contentType||"").indexOf("application/x-www-form-urlencoded")&&Ub.test(b.data)&&"data");if(h||"jsonp"===b.dataTypes[0])return e=b.jsonpCallback=r.isFunction(b.jsonpCallback)?b.jsonpCallback():b.jsonpCallback,h?b[h]=b[h].replace(Ub,"$1"+e):b.jsonp!==!1&&(b.url+=(vb.test(b.url)?"&":"?")+b.jsonp+"="+e),b.converters["script json"]=function(){return g||r.error(e+" was not called"),g[0]},b.dataTypes[0]="json",f=a[e],a[e]=function(){g=arguments},d.always(function(){void 0===f?r(a).removeProp(e):a[e]=f,b[e]&&(b.jsonpCallback=c.jsonpCallback,Tb.push(e)),g&&r.isFunction(f)&&f(g[0]),g=f=void 0}),"script"}),o.createHTMLDocument=function(){var a=d.implementation.createHTMLDocument("").body;return a.innerHTML="<form></form><form></form>",2===a.childNodes.length}(),r.parseHTML=function(a,b,c){if("string"!=typeof a)return[];"boolean"==typeof b&&(c=b,b=!1);var e,f,g;return b||(o.createHTMLDocument?(b=d.implementation.createHTMLDocument(""),e=b.createElement("base"),e.href=d.location.href,b.head.appendChild(e)):b=d),f=C.exec(a),g=!c&&[],f?[b.createElement(f[1])]:(f=qa([a],b,g),g&&g.length&&r(g).remove(),r.merge([],f.childNodes))},r.fn.load=function(a,b,c){var d,e,f,g=this,h=a.indexOf(" ");return h>-1&&(d=pb(a.slice(h)),a=a.slice(0,h)),r.isFunction(b)?(c=b,b=void 0):b&&"object"==typeof b&&(e="POST"),g.length>0&&r.ajax({url:a,type:e||"GET",dataType:"html",data:b}).done(function(a){f=arguments,g.html(d?r("<div>").append(r.parseHTML(a)).find(d):a)}).always(c&&function(a,b){g.each(function(){c.apply(this,f||[a.responseText,b,a])})}),this},r.each(["ajaxStart","ajaxStop","ajaxComplete","ajaxError","ajaxSuccess","ajaxSend"],function(a,b){r.fn[b]=function(a){return this.on(b,a)}}),r.expr.pseudos.animated=function(a){return r.grep(r.timers,function(b){return a===b.elem}).length},r.offset={setOffset:function(a,b,c){var d,e,f,g,h,i,j,k=r.css(a,"position"),l=r(a),m={};"static"===k&&(a.style.position="relative"),h=l.offset(),f=r.css(a,"top"),i=r.css(a,"left"),j=("absolute"===k||"fixed"===k)&&(f+i).indexOf("auto")>-1,j?(d=l.position(),g=d.top,e=d.left):(g=parseFloat(f)||0,e=parseFloat(i)||0),r.isFunction(b)&&(b=b.call(a,c,r.extend({},h))),null!=b.top&&(m.top=b.top-h.top+g),null!=b.left&&(m.left=b.left-h.left+e),"using"in b?b.using.call(a,m):l.css(m)}},r.fn.extend({offset:function(a){if(arguments.length)return void 0===a?this:this.each(function(b){r.offset.setOffset(this,a,b)});var b,c,d,e,f=this[0];if(f)return f.getClientRects().length?(d=f.getBoundingClientRect(),b=f.ownerDocument,c=b.documentElement,e=b.defaultView,{top:d.top+e.pageYOffset-c.clientTop,left:d.left+e.pageXOffset-c.clientLeft}):{top:0,left:0}},position:function(){if(this[0]){var a,b,c=this[0],d={top:0,left:0};return"fixed"===r.css(c,"position")?b=c.getBoundingClientRect():(a=this.offsetParent(),b=this.offset(),B(a[0],"html")||(d=a.offset()),d={top:d.top+r.css(a[0],"borderTopWidth",!0),left:d.left+r.css(a[0],"borderLeftWidth",!0)}),{top:b.top-d.top-r.css(c,"marginTop",!0),left:b.left-d.left-r.css(c,"marginLeft",!0)}}},offsetParent:function(){return this.map(function(){var a=this.offsetParent;while(a&&"static"===r.css(a,"position"))a=a.offsetParent;return a||ra})}}),r.each({scrollLeft:"pageXOffset",scrollTop:"pageYOffset"},function(a,b){var c="pageYOffset"===b;r.fn[a]=function(d){return T(this,function(a,d,e){var f;return r.isWindow(a)?f=a:9===a.nodeType&&(f=a.defaultView),void 0===e?f?f[b]:a[d]:void(f?f.scrollTo(c?f.pageXOffset:e,c?e:f.pageYOffset):a[d]=e)},a,d,arguments.length)}}),r.each(["top","left"],function(a,b){r.cssHooks[b]=Pa(o.pixelPosition,function(a,c){if(c)return c=Oa(a,b),Ma.test(c)?r(a).position()[b]+"px":c})}),r.each({Height:"height",Width:"width"},function(a,b){r.each({padding:"inner"+a,content:b,"":"outer"+a},function(c,d){r.fn[d]=function(e,f){var g=arguments.length&&(c||"boolean"!=typeof e),h=c||(e===!0||f===!0?"margin":"border");return T(this,function(b,c,e){var f;return r.isWindow(b)?0===d.indexOf("outer")?b["inner"+a]:b.document.documentElement["client"+a]:9===b.nodeType?(f=b.documentElement,Math.max(b.body["scroll"+a],f["scroll"+a],b.body["offset"+a],f["offset"+a],f["client"+a])):void 0===e?r.css(b,c,h):r.style(b,c,e,h)},b,g?e:void 0,g)}})}),r.fn.extend({bind:function(a,b,c){return this.on(a,null,b,c)},unbind:function(a,b){return this.off(a,null,b)},delegate:function(a,b,c,d){return this.on(b,a,c,d)},undelegate:function(a,b,c){return 1===arguments.length?this.off(a,"**"):this.off(b,a||"**",c)}}),r.holdReady=function(a){a?r.readyWait++:r.ready(!0)},r.isArray=Array.isArray,r.parseJSON=JSON.parse,r.nodeName=B,"function"==typeof define&&define.amd&&define("jquery",[],function(){return r});var Vb=a.jQuery,Wb=a.$;return r.noConflict=function(b){return a.$===r&&(a.$=Wb),b&&a.jQuery===r&&(a.jQuery=Vb),r},b||(a.jQuery=a.$=r),r});
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/lodash.js b/ee/bulk-operations-dashboard/assets/dependencies/lodash.js
new file mode 100644
index 000000000000..e9c36347a05e
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/lodash.js
@@ -0,0 +1,12596 @@
+/////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+// For info about this version of lodash, see https://npmjs.com/package/@sailshq/lodash
+/////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+/////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+// Originally from https://github.com/lodash/lodash/blob/3.10.1/lodash.src.js
+/////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//
+// Patches:
+//
+// ### Wed Nov 2, 2016
+// I added a hotfix based on https://github.com/lodash/lodash/commit/95bc54a3ddc7a25f5e134f5b376a0d1d96118f49
+// in order to solve https://github.com/lodash/lodash/issues/2768.
+// -@mikermcneil
+//
+/////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+/**
+ * @license
+ * lodash 3.10.2 <https://github.com/sailshq/lodash>
+ * A fork of Lodash 3.10.1 <https://lodash.com/> with minor patches made by Mike McNeil.
+ * Copyright 2012-2015 The Dojo Foundation <http://dojofoundation.org/>
+ * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE>
+ * Copyright 2009-2015 Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors
+ * Available under MIT license <https://lodash.com/license>
+ */
+;(function() {
+
+  /** Used as a safe reference for `undefined` in pre-ES5 environments. */
+  var undefined;
+
+  /** Used as the semantic version number. */
+  var VERSION = '3.10.2';
+
+  /** Used to compose bitmasks for wrapper metadata. */
+  var BIND_FLAG = 1,
+      BIND_KEY_FLAG = 2,
+      CURRY_BOUND_FLAG = 4,
+      CURRY_FLAG = 8,
+      CURRY_RIGHT_FLAG = 16,
+      PARTIAL_FLAG = 32,
+      PARTIAL_RIGHT_FLAG = 64,
+      ARY_FLAG = 128,
+      REARG_FLAG = 256;
+
+  /** Used as default options for `_.trunc`. */
+  var DEFAULT_TRUNC_LENGTH = 30,
+      DEFAULT_TRUNC_OMISSION = '...';
+
+  /** Used to detect when a function becomes hot. */
+  var HOT_COUNT = 150,
+      HOT_SPAN = 16;
+
+  /** Used as the size to enable large array optimizations. */
+  var LARGE_ARRAY_SIZE = 200;
+
+  /** Used to indicate the type of lazy iteratees. */
+  var LAZY_FILTER_FLAG = 1,
+      LAZY_MAP_FLAG = 2;
+
+  /** Used as the `TypeError` message for "Functions" methods. */
+  var FUNC_ERROR_TEXT = 'Expected a function';
+
+  /** Used as the internal argument placeholder. */
+  var PLACEHOLDER = '__lodash_placeholder__';
+
+  /** `Object#toString` result references. */
+  var argsTag = '[object Arguments]',
+      arrayTag = '[object Array]',
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+      // Patched from https://github.com/lodash/lodash/blob/95bc54a3ddc7a25f5e134f5b376a0d1d96118f49/lodash.js#L86-L108
+      asyncTag = '[object AsyncFunction]',
+      genTag = '[object GeneratorFunction]',
+      proxyTag = '[object Proxy]',
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+      boolTag = '[object Boolean]',
+      dateTag = '[object Date]',
+      errorTag = '[object Error]',
+      funcTag = '[object Function]',
+      mapTag = '[object Map]',
+      numberTag = '[object Number]',
+      objectTag = '[object Object]',
+      regexpTag = '[object RegExp]',
+      setTag = '[object Set]',
+      stringTag = '[object String]',
+      weakMapTag = '[object WeakMap]';
+
+  var arrayBufferTag = '[object ArrayBuffer]',
+      float32Tag = '[object Float32Array]',
+      float64Tag = '[object Float64Array]',
+      int8Tag = '[object Int8Array]',
+      int16Tag = '[object Int16Array]',
+      int32Tag = '[object Int32Array]',
+      uint8Tag = '[object Uint8Array]',
+      uint8ClampedTag = '[object Uint8ClampedArray]',
+      uint16Tag = '[object Uint16Array]',
+      uint32Tag = '[object Uint32Array]';
+
+  /** Used to match empty string literals in compiled template source. */
+  var reEmptyStringLeading = /\b__p \+= '';/g,
+      reEmptyStringMiddle = /\b(__p \+=) '' \+/g,
+      reEmptyStringTrailing = /(__e\(.*?\)|\b__t\)) \+\n'';/g;
+
+  /** Used to match HTML entities and HTML characters. */
+  var reEscapedHtml = /&(?:amp|lt|gt|quot|#39|#96);/g,
+      reUnescapedHtml = /[&<>"'`]/g,
+      reHasEscapedHtml = RegExp(reEscapedHtml.source),
+      reHasUnescapedHtml = RegExp(reUnescapedHtml.source);
+
+  /** Used to match template delimiters. */
+  var reEscape = /<%-([\s\S]+?)%>/g,
+      reEvaluate = /<%([\s\S]+?)%>/g,
+      reInterpolate = /<%=([\s\S]+?)%>/g;
+
+  /** Used to match property names within property paths. */
+  var reIsDeepProp = /\.|\[(?:[^[\]]*|(["'])(?:(?!\1)[^\n\\]|\\.)*?\1)\]/,
+      reIsPlainProp = /^\w*$/,
+      rePropName = /[^.[\]]+|\[(?:(-?\d+(?:\.\d+)?)|(["'])((?:(?!\2)[^\n\\]|\\.)*?)\2)\]/g;
+
+  /**
+   * Used to match `RegExp` [syntax characters](http://ecma-international.org/ecma-262/6.0/#sec-patterns)
+   * and those outlined by [`EscapeRegExpPattern`](http://ecma-international.org/ecma-262/6.0/#sec-escaperegexppattern).
+   */
+  var reRegExpChars = /^[:!,]|[\\^$.*+?()[\]{}|\/]|(^[0-9a-fA-Fnrtuvx])|([\n\r\u2028\u2029])/g,
+      reHasRegExpChars = RegExp(reRegExpChars.source);
+
+  /** Used to match [combining diacritical marks](https://en.wikipedia.org/wiki/Combining_Diacritical_Marks). */
+  var reComboMark = /[\u0300-\u036f\ufe20-\ufe23]/g;
+
+  /** Used to match backslashes in property paths. */
+  var reEscapeChar = /\\(\\)?/g;
+
+  /** Used to match [ES template delimiters](http://ecma-international.org/ecma-262/6.0/#sec-template-literal-lexical-components). */
+  var reEsTemplate = /\$\{([^\\}]*(?:\\.[^\\}]*)*)\}/g;
+
+  /** Used to match `RegExp` flags from their coerced string values. */
+  var reFlags = /\w*$/;
+
+  /** Used to detect hexadecimal string values. */
+  var reHasHexPrefix = /^0[xX]/;
+
+  /** Used to detect host constructors (Safari > 5). */
+  var reIsHostCtor = /^\[object .+?Constructor\]$/;
+
+  /** Used to detect unsigned integer values. */
+  var reIsUint = /^\d+$/;
+
+  /** Used to match latin-1 supplementary letters (excluding mathematical operators). */
+  var reLatin1 = /[\xc0-\xd6\xd8-\xde\xdf-\xf6\xf8-\xff]/g;
+
+  /** Used to ensure capturing order of template delimiters. */
+  var reNoMatch = /($^)/;
+
+  /** Used to match unescaped characters in compiled string literals. */
+  var reUnescapedString = /['\n\r\u2028\u2029\\]/g;
+
+  /** Used to match words to create compound words. */
+  var reWords = (function() {
+    var upper = '[A-Z\\xc0-\\xd6\\xd8-\\xde]',
+        lower = '[a-z\\xdf-\\xf6\\xf8-\\xff]+';
+
+    return RegExp(upper + '+(?=' + upper + lower + ')|' + upper + '?' + lower + '|' + upper + '+|[0-9]+', 'g');
+  }());
+
+  /** Used to assign default `context` object properties. */
+  var contextProps = [
+    'Array', 'ArrayBuffer', 'Date', 'Error', 'Float32Array', 'Float64Array',
+    'Function', 'Int8Array', 'Int16Array', 'Int32Array', 'Math', 'Number',
+    'Object', 'RegExp', 'Set', 'String', '_', 'clearTimeout', 'isFinite',
+    'parseFloat', 'parseInt', 'setTimeout', 'TypeError', 'Uint8Array',
+    'Uint8ClampedArray', 'Uint16Array', 'Uint32Array', 'WeakMap'
+  ];
+
+  /** Used to fix the JScript `[[DontEnum]]` bug. */
+  var shadowProps = [
+    'constructor', 'hasOwnProperty', 'isPrototypeOf', 'propertyIsEnumerable',
+    'toLocaleString', 'toString', 'valueOf'
+  ];
+
+  /** Used to make template sourceURLs easier to identify. */
+  var templateCounter = -1;
+
+  /** Used to identify `toStringTag` values of typed arrays. */
+  var typedArrayTags = {};
+  typedArrayTags[float32Tag] = typedArrayTags[float64Tag] =
+  typedArrayTags[int8Tag] = typedArrayTags[int16Tag] =
+  typedArrayTags[int32Tag] = typedArrayTags[uint8Tag] =
+  typedArrayTags[uint8ClampedTag] = typedArrayTags[uint16Tag] =
+  typedArrayTags[uint32Tag] = true;
+  typedArrayTags[argsTag] = typedArrayTags[arrayTag] =
+  typedArrayTags[arrayBufferTag] = typedArrayTags[boolTag] =
+  typedArrayTags[dateTag] = typedArrayTags[errorTag] =
+  typedArrayTags[funcTag] = typedArrayTags[mapTag] =
+  typedArrayTags[numberTag] = typedArrayTags[objectTag] =
+  typedArrayTags[regexpTag] = typedArrayTags[setTag] =
+  typedArrayTags[stringTag] = typedArrayTags[weakMapTag] = false;
+
+  /** Used to identify `toStringTag` values supported by `_.clone`. */
+  var cloneableTags = {};
+  cloneableTags[argsTag] = cloneableTags[arrayTag] =
+  cloneableTags[arrayBufferTag] = cloneableTags[boolTag] =
+  cloneableTags[dateTag] = cloneableTags[float32Tag] =
+  cloneableTags[float64Tag] = cloneableTags[int8Tag] =
+  cloneableTags[int16Tag] = cloneableTags[int32Tag] =
+  cloneableTags[numberTag] = cloneableTags[objectTag] =
+  cloneableTags[regexpTag] = cloneableTags[stringTag] =
+  cloneableTags[uint8Tag] = cloneableTags[uint8ClampedTag] =
+  cloneableTags[uint16Tag] = cloneableTags[uint32Tag] = true;
+  cloneableTags[errorTag] = cloneableTags[funcTag] =
+  cloneableTags[mapTag] = cloneableTags[setTag] =
+  cloneableTags[weakMapTag] = false;
+
+  /** Used to map latin-1 supplementary letters to basic latin letters. */
+  var deburredLetters = {
+    '\xc0': 'A',  '\xc1': 'A', '\xc2': 'A', '\xc3': 'A', '\xc4': 'A', '\xc5': 'A',
+    '\xe0': 'a',  '\xe1': 'a', '\xe2': 'a', '\xe3': 'a', '\xe4': 'a', '\xe5': 'a',
+    '\xc7': 'C',  '\xe7': 'c',
+    '\xd0': 'D',  '\xf0': 'd',
+    '\xc8': 'E',  '\xc9': 'E', '\xca': 'E', '\xcb': 'E',
+    '\xe8': 'e',  '\xe9': 'e', '\xea': 'e', '\xeb': 'e',
+    '\xcC': 'I',  '\xcd': 'I', '\xce': 'I', '\xcf': 'I',
+    '\xeC': 'i',  '\xed': 'i', '\xee': 'i', '\xef': 'i',
+    '\xd1': 'N',  '\xf1': 'n',
+    '\xd2': 'O',  '\xd3': 'O', '\xd4': 'O', '\xd5': 'O', '\xd6': 'O', '\xd8': 'O',
+    '\xf2': 'o',  '\xf3': 'o', '\xf4': 'o', '\xf5': 'o', '\xf6': 'o', '\xf8': 'o',
+    '\xd9': 'U',  '\xda': 'U', '\xdb': 'U', '\xdc': 'U',
+    '\xf9': 'u',  '\xfa': 'u', '\xfb': 'u', '\xfc': 'u',
+    '\xdd': 'Y',  '\xfd': 'y', '\xff': 'y',
+    '\xc6': 'Ae', '\xe6': 'ae',
+    '\xde': 'Th', '\xfe': 'th',
+    '\xdf': 'ss'
+  };
+
+  /** Used to map characters to HTML entities. */
+  var htmlEscapes = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#39;',
+    '`': '&#96;'
+  };
+
+  /** Used to map HTML entities to characters. */
+  var htmlUnescapes = {
+    '&amp;': '&',
+    '&lt;': '<',
+    '&gt;': '>',
+    '&quot;': '"',
+    '&#39;': "'",
+    '&#96;': '`'
+  };
+
+  /** Used to determine if values are of the language type `Object`. */
+  var objectTypes = {
+    'function': true,
+    'object': true
+  };
+
+  /** Used to escape characters for inclusion in compiled regexes. */
+  var regexpEscapes = {
+    '0': 'x30', '1': 'x31', '2': 'x32', '3': 'x33', '4': 'x34',
+    '5': 'x35', '6': 'x36', '7': 'x37', '8': 'x38', '9': 'x39',
+    'A': 'x41', 'B': 'x42', 'C': 'x43', 'D': 'x44', 'E': 'x45', 'F': 'x46',
+    'a': 'x61', 'b': 'x62', 'c': 'x63', 'd': 'x64', 'e': 'x65', 'f': 'x66',
+    'n': 'x6e', 'r': 'x72', 't': 'x74', 'u': 'x75', 'v': 'x76', 'x': 'x78'
+  };
+
+  /** Used to escape characters for inclusion in compiled string literals. */
+  var stringEscapes = {
+    '\\': '\\',
+    "'": "'",
+    '\n': 'n',
+    '\r': 'r',
+    '\u2028': 'u2028',
+    '\u2029': 'u2029'
+  };
+
+  /** Detect free variable `exports`. */
+  var freeExports = objectTypes[typeof exports] && exports && !exports.nodeType && exports;
+
+  /** Detect free variable `module`. */
+  var freeModule = objectTypes[typeof module] && module && !module.nodeType && module;
+
+  /** Detect free variable `global` from Node.js. */
+  var freeGlobal = freeExports && freeModule && typeof global == 'object' && global && global.Object && global;
+
+  /** Detect free variable `self`. */
+  var freeSelf = objectTypes[typeof self] && self && self.Object && self;
+
+  /** Detect free variable `window`. */
+  var freeWindow = objectTypes[typeof window] && window && window.Object && window;
+
+  /** Detect the popular CommonJS extension `module.exports`. */
+  var moduleExports = freeModule && freeModule.exports === freeExports && freeExports;
+
+  /**
+   * Used as a reference to the global object.
+   *
+   * The `this` value is used if it's the global object to avoid Greasemonkey's
+   * restricted `window` object, otherwise the `window` object is used.
+   */
+  var root = freeGlobal || ((freeWindow !== (this && this.window)) && freeWindow) || freeSelf || this;
+
+  /*--------------------------------------------------------------------------*/
+
+  /**
+   * The base implementation of `compareAscending` which compares values and
+   * sorts them in ascending order without guaranteeing a stable sort.
+   *
+   * @private
+   * @param {*} value The value to compare.
+   * @param {*} other The other value to compare.
+   * @returns {number} Returns the sort order indicator for `value`.
+   */
+  function baseCompareAscending(value, other) {
+    if (value !== other) {
+      var valIsNull = value === null,
+          valIsUndef = value === undefined,
+          valIsReflexive = value === value;
+
+      var othIsNull = other === null,
+          othIsUndef = other === undefined,
+          othIsReflexive = other === other;
+
+      if ((value > other && !othIsNull) || !valIsReflexive ||
+          (valIsNull && !othIsUndef && othIsReflexive) ||
+          (valIsUndef && othIsReflexive)) {
+        return 1;
+      }
+      if ((value < other && !valIsNull) || !othIsReflexive ||
+          (othIsNull && !valIsUndef && valIsReflexive) ||
+          (othIsUndef && valIsReflexive)) {
+        return -1;
+      }
+    }
+    return 0;
+  }
+
+  /**
+   * The base implementation of `_.findIndex` and `_.findLastIndex` without
+   * support for callback shorthands and `this` binding.
+   *
+   * @private
+   * @param {Array} array The array to search.
+   * @param {Function} predicate The function invoked per iteration.
+   * @param {boolean} [fromRight] Specify iterating from right to left.
+   * @returns {number} Returns the index of the matched value, else `-1`.
+   */
+  function baseFindIndex(array, predicate, fromRight) {
+    var length = array.length,
+        index = fromRight ? length : -1;
+
+    while ((fromRight ? index-- : ++index < length)) {
+      if (predicate(array[index], index, array)) {
+        return index;
+      }
+    }
+    return -1;
+  }
+
+  /**
+   * The base implementation of `_.indexOf` without support for binary searches.
+   *
+   * @private
+   * @param {Array} array The array to search.
+   * @param {*} value The value to search for.
+   * @param {number} fromIndex The index to search from.
+   * @returns {number} Returns the index of the matched value, else `-1`.
+   */
+  function baseIndexOf(array, value, fromIndex) {
+    if (value !== value) {
+      return indexOfNaN(array, fromIndex);
+    }
+    var index = fromIndex - 1,
+        length = array.length;
+
+    while (++index < length) {
+      if (array[index] === value) {
+        return index;
+      }
+    }
+    return -1;
+  }
+
+  /**
+   * The base implementation of `_.isFunction` without support for environments
+   * with incorrect `typeof` results.
+   *
+   * @private
+   * @param {*} value The value to check.
+   * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+   */
+  function baseIsFunction(value) {
+    // Avoid a Chakra JIT bug in compatibility modes of IE 11.
+    // See https://github.com/jashkenas/underscore/issues/1621 for more details.
+    return typeof value == 'function' || false;
+  }
+
+  /**
+   * Converts `value` to a string if it's not one. An empty string is returned
+   * for `null` or `undefined` values.
+   *
+   * @private
+   * @param {*} value The value to process.
+   * @returns {string} Returns the string.
+   */
+  function baseToString(value) {
+    return value == null ? '' : (value + '');
+  }
+
+  /**
+   * Used by `_.trim` and `_.trimLeft` to get the index of the first character
+   * of `string` that is not found in `chars`.
+   *
+   * @private
+   * @param {string} string The string to inspect.
+   * @param {string} chars The characters to find.
+   * @returns {number} Returns the index of the first character not found in `chars`.
+   */
+  function charsLeftIndex(string, chars) {
+    var index = -1,
+        length = string.length;
+
+    while (++index < length && chars.indexOf(string.charAt(index)) > -1) {}
+    return index;
+  }
+
+  /**
+   * Used by `_.trim` and `_.trimRight` to get the index of the last character
+   * of `string` that is not found in `chars`.
+   *
+   * @private
+   * @param {string} string The string to inspect.
+   * @param {string} chars The characters to find.
+   * @returns {number} Returns the index of the last character not found in `chars`.
+   */
+  function charsRightIndex(string, chars) {
+    var index = string.length;
+
+    while (index-- && chars.indexOf(string.charAt(index)) > -1) {}
+    return index;
+  }
+
+  /**
+   * Used by `_.sortBy` to compare transformed elements of a collection and stable
+   * sort them in ascending order.
+   *
+   * @private
+   * @param {Object} object The object to compare.
+   * @param {Object} other The other object to compare.
+   * @returns {number} Returns the sort order indicator for `object`.
+   */
+  function compareAscending(object, other) {
+    return baseCompareAscending(object.criteria, other.criteria) || (object.index - other.index);
+  }
+
+  /**
+   * Used by `_.sortByOrder` to compare multiple properties of a value to another
+   * and stable sort them.
+   *
+   * If `orders` is unspecified, all valuess are sorted in ascending order. Otherwise,
+   * a value is sorted in ascending order if its corresponding order is "asc", and
+   * descending if "desc".
+   *
+   * @private
+   * @param {Object} object The object to compare.
+   * @param {Object} other The other object to compare.
+   * @param {boolean[]} orders The order to sort by for each property.
+   * @returns {number} Returns the sort order indicator for `object`.
+   */
+  function compareMultiple(object, other, orders) {
+    var index = -1,
+        objCriteria = object.criteria,
+        othCriteria = other.criteria,
+        length = objCriteria.length,
+        ordersLength = orders.length;
+
+    while (++index < length) {
+      var result = baseCompareAscending(objCriteria[index], othCriteria[index]);
+      if (result) {
+        if (index >= ordersLength) {
+          return result;
+        }
+        var order = orders[index];
+        return result * ((order === 'asc' || order === true) ? 1 : -1);
+      }
+    }
+    // Fixes an `Array#sort` bug in the JS engine embedded in Adobe applications
+    // that causes it, under certain circumstances, to provide the same value for
+    // `object` and `other`. See https://github.com/jashkenas/underscore/pull/1247
+    // for more details.
+    //
+    // This also ensures a stable sort in V8 and other engines.
+    // See https://code.google.com/p/v8/issues/detail?id=90 for more details.
+    return object.index - other.index;
+  }
+
+  /**
+   * Used by `_.deburr` to convert latin-1 supplementary letters to basic latin letters.
+   *
+   * @private
+   * @param {string} letter The matched letter to deburr.
+   * @returns {string} Returns the deburred letter.
+   */
+  function deburrLetter(letter) {
+    return deburredLetters[letter];
+  }
+
+  /**
+   * Used by `_.escape` to convert characters to HTML entities.
+   *
+   * @private
+   * @param {string} chr The matched character to escape.
+   * @returns {string} Returns the escaped character.
+   */
+  function escapeHtmlChar(chr) {
+    return htmlEscapes[chr];
+  }
+
+  /**
+   * Used by `_.escapeRegExp` to escape characters for inclusion in compiled regexes.
+   *
+   * @private
+   * @param {string} chr The matched character to escape.
+   * @param {string} leadingChar The capture group for a leading character.
+   * @param {string} whitespaceChar The capture group for a whitespace character.
+   * @returns {string} Returns the escaped character.
+   */
+  function escapeRegExpChar(chr, leadingChar, whitespaceChar) {
+    if (leadingChar) {
+      chr = regexpEscapes[chr];
+    } else if (whitespaceChar) {
+      chr = stringEscapes[chr];
+    }
+    return '\\' + chr;
+  }
+
+  /**
+   * Used by `_.template` to escape characters for inclusion in compiled string literals.
+   *
+   * @private
+   * @param {string} chr The matched character to escape.
+   * @returns {string} Returns the escaped character.
+   */
+  function escapeStringChar(chr) {
+    return '\\' + stringEscapes[chr];
+  }
+
+  /**
+   * Gets the index at which the first occurrence of `NaN` is found in `array`.
+   *
+   * @private
+   * @param {Array} array The array to search.
+   * @param {number} fromIndex The index to search from.
+   * @param {boolean} [fromRight] Specify iterating from right to left.
+   * @returns {number} Returns the index of the matched `NaN`, else `-1`.
+   */
+  function indexOfNaN(array, fromIndex, fromRight) {
+    var length = array.length,
+        index = fromIndex + (fromRight ? 0 : -1);
+
+    while ((fromRight ? index-- : ++index < length)) {
+      var other = array[index];
+      if (other !== other) {
+        return index;
+      }
+    }
+    return -1;
+  }
+
+  /**
+   * Checks if `value` is a host object in IE < 9.
+   *
+   * @private
+   * @param {*} value The value to check.
+   * @returns {boolean} Returns `true` if `value` is a host object, else `false`.
+   */
+  var isHostObject = (function() {
+    try {
+      Object({ 'toString': 0 } + '');
+    } catch(e) {
+      return function() { return false; };
+    }
+    return function(value) {
+      // IE < 9 presents many host objects as `Object` objects that can coerce
+      // to strings despite having improperly defined `toString` methods.
+      return typeof value.toString != 'function' && typeof (value + '') == 'string';
+    };
+  }());
+
+  /**
+   * Checks if `value` is object-like.
+   *
+   * @private
+   * @param {*} value The value to check.
+   * @returns {boolean} Returns `true` if `value` is object-like, else `false`.
+   */
+  function isObjectLike(value) {
+    return !!value && typeof value == 'object';
+  }
+
+  /**
+   * Used by `trimmedLeftIndex` and `trimmedRightIndex` to determine if a
+   * character code is whitespace.
+   *
+   * @private
+   * @param {number} charCode The character code to inspect.
+   * @returns {boolean} Returns `true` if `charCode` is whitespace, else `false`.
+   */
+  function isSpace(charCode) {
+    return ((charCode <= 160 && (charCode >= 9 && charCode <= 13) || charCode == 32 || charCode == 160) || charCode == 5760 || charCode == 6158 ||
+      (charCode >= 8192 && (charCode <= 8202 || charCode == 8232 || charCode == 8233 || charCode == 8239 || charCode == 8287 || charCode == 12288 || charCode == 65279)));
+  }
+
+  /**
+   * Replaces all `placeholder` elements in `array` with an internal placeholder
+   * and returns an array of their indexes.
+   *
+   * @private
+   * @param {Array} array The array to modify.
+   * @param {*} placeholder The placeholder to replace.
+   * @returns {Array} Returns the new array of placeholder indexes.
+   */
+  function replaceHolders(array, placeholder) {
+    var index = -1,
+        length = array.length,
+        resIndex = -1,
+        result = [];
+
+    while (++index < length) {
+      if (array[index] === placeholder) {
+        array[index] = PLACEHOLDER;
+        result[++resIndex] = index;
+      }
+    }
+    return result;
+  }
+
+  /**
+   * An implementation of `_.uniq` optimized for sorted arrays without support
+   * for callback shorthands and `this` binding.
+   *
+   * @private
+   * @param {Array} array The array to inspect.
+   * @param {Function} [iteratee] The function invoked per iteration.
+   * @returns {Array} Returns the new duplicate free array.
+   */
+  function sortedUniq(array, iteratee) {
+    var seen,
+        index = -1,
+        length = array.length,
+        resIndex = -1,
+        result = [];
+
+    while (++index < length) {
+      var value = array[index],
+          computed = iteratee ? iteratee(value, index, array) : value;
+
+      if (!index || seen !== computed) {
+        seen = computed;
+        result[++resIndex] = value;
+      }
+    }
+    return result;
+  }
+
+  /**
+   * Used by `_.trim` and `_.trimLeft` to get the index of the first non-whitespace
+   * character of `string`.
+   *
+   * @private
+   * @param {string} string The string to inspect.
+   * @returns {number} Returns the index of the first non-whitespace character.
+   */
+  function trimmedLeftIndex(string) {
+    var index = -1,
+        length = string.length;
+
+    while (++index < length && isSpace(string.charCodeAt(index))) {}
+    return index;
+  }
+
+  /**
+   * Used by `_.trim` and `_.trimRight` to get the index of the last non-whitespace
+   * character of `string`.
+   *
+   * @private
+   * @param {string} string The string to inspect.
+   * @returns {number} Returns the index of the last non-whitespace character.
+   */
+  function trimmedRightIndex(string) {
+    var index = string.length;
+
+    while (index-- && isSpace(string.charCodeAt(index))) {}
+    return index;
+  }
+
+  /**
+   * Used by `_.unescape` to convert HTML entities to characters.
+   *
+   * @private
+   * @param {string} chr The matched character to unescape.
+   * @returns {string} Returns the unescaped character.
+   */
+  function unescapeHtmlChar(chr) {
+    return htmlUnescapes[chr];
+  }
+
+  /*--------------------------------------------------------------------------*/
+
+  /**
+   * Create a new pristine `lodash` function using the given `context` object.
+   *
+   * @static
+   * @memberOf _
+   * @category Utility
+   * @param {Object} [context=root] The context object.
+   * @returns {Function} Returns a new `lodash` function.
+   * @example
+   *
+   * _.mixin({ 'foo': _.constant('foo') });
+   *
+   * var lodash = _.runInContext();
+   * lodash.mixin({ 'bar': lodash.constant('bar') });
+   *
+   * _.isFunction(_.foo);
+   * // => true
+   * _.isFunction(_.bar);
+   * // => false
+   *
+   * lodash.isFunction(lodash.foo);
+   * // => false
+   * lodash.isFunction(lodash.bar);
+   * // => true
+   *
+   * // using `context` to mock `Date#getTime` use in `_.now`
+   * var mock = _.runInContext({
+   *   'Date': function() {
+   *     return { 'getTime': getTimeMock };
+   *   }
+   * });
+   *
+   * // or creating a suped-up `defer` in Node.js
+   * var defer = _.runInContext({ 'setTimeout': setImmediate }).defer;
+   */
+  function runInContext(context) {
+    // Avoid issues with some ES3 environments that attempt to use values, named
+    // after built-in constructors like `Object`, for the creation of literals.
+    // ES5 clears this up by stating that literals must use built-in constructors.
+    // See https://es5.github.io/#x11.1.5 for more details.
+    context = context ? _.defaults(root.Object(), context, _.pick(root, contextProps)) : root;
+
+    /** Native constructor references. */
+    var Array = context.Array,
+        Date = context.Date,
+        Error = context.Error,
+        Function = context.Function,
+        Math = context.Math,
+        Number = context.Number,
+        Object = context.Object,
+        RegExp = context.RegExp,
+        String = context.String,
+        TypeError = context.TypeError;
+
+    /** Used for native method references. */
+    var arrayProto = Array.prototype,
+        errorProto = Error.prototype,
+        objectProto = Object.prototype,
+        stringProto = String.prototype;
+
+    /** Used to resolve the decompiled source of functions. */
+    var fnToString = Function.prototype.toString;
+
+    /** Used to check objects for own properties. */
+    var hasOwnProperty = objectProto.hasOwnProperty;
+
+    /** Used to generate unique IDs. */
+    var idCounter = 0;
+
+    /**
+     * Used to resolve the [`toStringTag`](http://ecma-international.org/ecma-262/6.0/#sec-object.prototype.tostring)
+     * of values.
+     */
+    var objToString = objectProto.toString;
+
+    /** Used to restore the original `_` reference in `_.noConflict`. */
+    var oldDash = root._;
+
+    /** Used to detect if a method is native. */
+    var reIsNative = RegExp('^' +
+      fnToString.call(hasOwnProperty).replace(/[\\^$.*+?()[\]{}|]/g, '\\$&')
+      .replace(/hasOwnProperty|(function).*?(?=\\\()| for .+?(?=\\\])/g, '$1.*?') + '$'
+    );
+
+    /** Native method references. */
+    var ArrayBuffer = context.ArrayBuffer,
+        clearTimeout = context.clearTimeout,
+        parseFloat = context.parseFloat,
+        pow = Math.pow,
+        propertyIsEnumerable = objectProto.propertyIsEnumerable,
+        Set = getNative(context, 'Set'),
+        setTimeout = context.setTimeout,
+        splice = arrayProto.splice,
+        Uint8Array = context.Uint8Array,
+        WeakMap = getNative(context, 'WeakMap');
+
+    /* Native method references for those with the same name as other `lodash` methods. */
+    var nativeCeil = Math.ceil,
+        nativeCreate = getNative(Object, 'create'),
+        nativeFloor = Math.floor,
+        nativeIsArray = getNative(Array, 'isArray'),
+        nativeIsFinite = context.isFinite,
+        nativeKeys = getNative(Object, 'keys'),
+        nativeMax = Math.max,
+        nativeMin = Math.min,
+        nativeNow = getNative(Date, 'now'),
+        nativeParseInt = context.parseInt,
+        nativeRandom = Math.random;
+
+    /** Used as references for `-Infinity` and `Infinity`. */
+    var NEGATIVE_INFINITY = Number.NEGATIVE_INFINITY,
+        POSITIVE_INFINITY = Number.POSITIVE_INFINITY;
+
+    /** Used as references for the maximum length and index of an array. */
+    var MAX_ARRAY_LENGTH = 4294967295,
+        MAX_ARRAY_INDEX = MAX_ARRAY_LENGTH - 1,
+        HALF_MAX_ARRAY_LENGTH = MAX_ARRAY_LENGTH >>> 1;
+
+    /**
+     * Used as the [maximum length](http://ecma-international.org/ecma-262/6.0/#sec-number.max_safe_integer)
+     * of an array-like value.
+     */
+    var MAX_SAFE_INTEGER = 9007199254740991;
+
+    /** Used to store function metadata. */
+    var metaMap = WeakMap && new WeakMap;
+
+    /** Used to lookup unminified function names. */
+    var realNames = {};
+
+    /** Used to lookup a type array constructors by `toStringTag`. */
+    var ctorByTag = {};
+    ctorByTag[float32Tag] = context.Float32Array;
+    ctorByTag[float64Tag] = context.Float64Array;
+    ctorByTag[int8Tag] = context.Int8Array;
+    ctorByTag[int16Tag] = context.Int16Array;
+    ctorByTag[int32Tag] = context.Int32Array;
+    ctorByTag[uint8Tag] = Uint8Array;
+    ctorByTag[uint8ClampedTag] = context.Uint8ClampedArray;
+    ctorByTag[uint16Tag] = context.Uint16Array;
+    ctorByTag[uint32Tag] = context.Uint32Array;
+
+    /** Used to avoid iterating over non-enumerable properties in IE < 9. */
+    var nonEnumProps = {};
+    nonEnumProps[arrayTag] = nonEnumProps[dateTag] = nonEnumProps[numberTag] = { 'constructor': true, 'toLocaleString': true, 'toString': true, 'valueOf': true };
+    nonEnumProps[boolTag] = nonEnumProps[stringTag] = { 'constructor': true, 'toString': true, 'valueOf': true };
+    nonEnumProps[errorTag] = nonEnumProps[funcTag] = nonEnumProps[regexpTag] = { 'constructor': true, 'toString': true };
+    nonEnumProps[objectTag] = { 'constructor': true };
+
+    arrayEach(shadowProps, function(key) {
+      for (var tag in nonEnumProps) {
+        if (hasOwnProperty.call(nonEnumProps, tag)) {
+          var props = nonEnumProps[tag];
+          props[key] = hasOwnProperty.call(props, key);
+        }
+      }
+    });
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Creates a `lodash` object which wraps `value` to enable implicit chaining.
+     * Methods that operate on and return arrays, collections, and functions can
+     * be chained together. Methods that retrieve a single value or may return a
+     * primitive value will automatically end the chain returning the unwrapped
+     * value. Explicit chaining may be enabled using `_.chain`. The execution of
+     * chained methods is lazy, that is, execution is deferred until `_#value`
+     * is implicitly or explicitly called.
+     *
+     * Lazy evaluation allows several methods to support shortcut fusion. Shortcut
+     * fusion is an optimization strategy which merge iteratee calls; this can help
+     * to avoid the creation of intermediate data structures and greatly reduce the
+     * number of iteratee executions.
+     *
+     * Chaining is supported in custom builds as long as the `_#value` method is
+     * directly or indirectly included in the build.
+     *
+     * In addition to lodash methods, wrappers have `Array` and `String` methods.
+     *
+     * The wrapper `Array` methods are:
+     * `concat`, `join`, `pop`, `push`, `reverse`, `shift`, `slice`, `sort`,
+     * `splice`, and `unshift`
+     *
+     * The wrapper `String` methods are:
+     * `replace` and `split`
+     *
+     * The wrapper methods that support shortcut fusion are:
+     * `compact`, `drop`, `dropRight`, `dropRightWhile`, `dropWhile`, `filter`,
+     * `first`, `initial`, `last`, `map`, `pluck`, `reject`, `rest`, `reverse`,
+     * `slice`, `take`, `takeRight`, `takeRightWhile`, `takeWhile`, `toArray`,
+     * and `where`
+     *
+     * The chainable wrapper methods are:
+     * `after`, `ary`, `assign`, `at`, `before`, `bind`, `bindAll`, `bindKey`,
+     * `callback`, `chain`, `chunk`, `commit`, `compact`, `concat`, `constant`,
+     * `countBy`, `create`, `curry`, `debounce`, `defaults`, `defaultsDeep`,
+     * `defer`, `delay`, `difference`, `drop`, `dropRight`, `dropRightWhile`,
+     * `dropWhile`, `fill`, `filter`, `flatten`, `flattenDeep`, `flow`, `flowRight`,
+     * `forEach`, `forEachRight`, `forIn`, `forInRight`, `forOwn`, `forOwnRight`,
+     * `functions`, `groupBy`, `indexBy`, `initial`, `intersection`, `invert`,
+     * `invoke`, `keys`, `keysIn`, `map`, `mapKeys`, `mapValues`, `matches`,
+     * `matchesProperty`, `memoize`, `merge`, `method`, `methodOf`, `mixin`,
+     * `modArgs`, `negate`, `omit`, `once`, `pairs`, `partial`, `partialRight`,
+     * `partition`, `pick`, `plant`, `pluck`, `property`, `propertyOf`, `pull`,
+     * `pullAt`, `push`, `range`, `rearg`, `reject`, `remove`, `rest`, `restParam`,
+     * `reverse`, `set`, `shuffle`, `slice`, `sort`, `sortBy`, `sortByAll`,
+     * `sortByOrder`, `splice`, `spread`, `take`, `takeRight`, `takeRightWhile`,
+     * `takeWhile`, `tap`, `throttle`, `thru`, `times`, `toArray`, `toPlainObject`,
+     * `transform`, `union`, `uniq`, `unshift`, `unzip`, `unzipWith`, `values`,
+     * `valuesIn`, `where`, `without`, `wrap`, `xor`, `zip`, `zipObject`, `zipWith`
+     *
+     * The wrapper methods that are **not** chainable by default are:
+     * `add`, `attempt`, `camelCase`, `capitalize`, `ceil`, `clone`, `cloneDeep`,
+     * `deburr`, `endsWith`, `escape`, `escapeRegExp`, `every`, `find`, `findIndex`,
+     * `findKey`, `findLast`, `findLastIndex`, `findLastKey`, `findWhere`, `first`,
+     * `floor`, `get`, `gt`, `gte`, `has`, `identity`, `includes`, `indexOf`,
+     * `inRange`, `isArguments`, `isArray`, `isBoolean`, `isDate`, `isElement`,
+     * `isEmpty`, `isEqual`, `isError`, `isFinite` `isFunction`, `isMatch`,
+     * `isNative`, `isNaN`, `isNull`, `isNumber`, `isObject`, `isPlainObject`,
+     * `isRegExp`, `isString`, `isUndefined`, `isTypedArray`, `join`, `kebabCase`,
+     * `last`, `lastIndexOf`, `lt`, `lte`, `max`, `min`, `noConflict`, `noop`,
+     * `now`, `pad`, `padLeft`, `padRight`, `parseInt`, `pop`, `random`, `reduce`,
+     * `reduceRight`, `repeat`, `result`, `round`, `runInContext`, `shift`, `size`,
+     * `snakeCase`, `some`, `sortedIndex`, `sortedLastIndex`, `startCase`,
+     * `startsWith`, `sum`, `template`, `trim`, `trimLeft`, `trimRight`, `trunc`,
+     * `unescape`, `uniqueId`, `value`, and `words`
+     *
+     * The wrapper method `sample` will return a wrapped value when `n` is provided,
+     * otherwise an unwrapped value is returned.
+     *
+     * @name _
+     * @constructor
+     * @category Chain
+     * @param {*} value The value to wrap in a `lodash` instance.
+     * @returns {Object} Returns the new `lodash` wrapper instance.
+     * @example
+     *
+     * var wrapped = _([1, 2, 3]);
+     *
+     * // returns an unwrapped value
+     * wrapped.reduce(function(total, n) {
+     *   return total + n;
+     * });
+     * // => 6
+     *
+     * // returns a wrapped value
+     * var squares = wrapped.map(function(n) {
+     *   return n * n;
+     * });
+     *
+     * _.isArray(squares);
+     * // => false
+     *
+     * _.isArray(squares.value());
+     * // => true
+     */
+    function lodash(value) {
+      if (isObjectLike(value) && !isArray(value) && !(value instanceof LazyWrapper)) {
+        if (value instanceof LodashWrapper) {
+          return value;
+        }
+        if (hasOwnProperty.call(value, '__chain__') && hasOwnProperty.call(value, '__wrapped__')) {
+          return wrapperClone(value);
+        }
+      }
+      return new LodashWrapper(value);
+    }
+
+    /**
+     * The function whose prototype all chaining wrappers inherit from.
+     *
+     * @private
+     */
+    function baseLodash() {
+      // No operation performed.
+    }
+
+    /**
+     * The base constructor for creating `lodash` wrapper objects.
+     *
+     * @private
+     * @param {*} value The value to wrap.
+     * @param {boolean} [chainAll] Enable chaining for all wrapper methods.
+     * @param {Array} [actions=[]] Actions to peform to resolve the unwrapped value.
+     */
+    function LodashWrapper(value, chainAll, actions) {
+      this.__wrapped__ = value;
+      this.__actions__ = actions || [];
+      this.__chain__ = !!chainAll;
+    }
+
+    /**
+     * An object environment feature flags.
+     *
+     * @static
+     * @memberOf _
+     * @type Object
+     */
+    var support = lodash.support = {};
+
+    (function(x) {
+      var Ctor = function() { this.x = x; },
+          object = { '0': x, 'length': x },
+          props = [];
+
+      Ctor.prototype = { 'valueOf': x, 'y': x };
+      for (var key in new Ctor) { props.push(key); }
+
+      /**
+       * Detect if `name` or `message` properties of `Error.prototype` are
+       * enumerable by default (IE < 9, Safari < 5.1).
+       *
+       * @memberOf _.support
+       * @type boolean
+       */
+      support.enumErrorProps = propertyIsEnumerable.call(errorProto, 'message') ||
+        propertyIsEnumerable.call(errorProto, 'name');
+
+      /**
+       * Detect if `prototype` properties are enumerable by default.
+       *
+       * Firefox < 3.6, Opera > 9.50 - Opera < 11.60, and Safari < 5.1
+       * (if the prototype or a property on the prototype has been set)
+       * incorrectly set the `[[Enumerable]]` value of a function's `prototype`
+       * property to `true`.
+       *
+       * @memberOf _.support
+       * @type boolean
+       */
+      support.enumPrototypes = propertyIsEnumerable.call(Ctor, 'prototype');
+
+      /**
+       * Detect if properties shadowing those on `Object.prototype` are non-enumerable.
+       *
+       * In IE < 9 an object's own properties, shadowing non-enumerable ones,
+       * are made non-enumerable as well (a.k.a the JScript `[[DontEnum]]` bug).
+       *
+       * @memberOf _.support
+       * @type boolean
+       */
+      support.nonEnumShadows = !/valueOf/.test(props);
+
+      /**
+       * Detect if own properties are iterated after inherited properties (IE < 9).
+       *
+       * @memberOf _.support
+       * @type boolean
+       */
+      support.ownLast = props[0] != 'x';
+
+      /**
+       * Detect if `Array#shift` and `Array#splice` augment array-like objects
+       * correctly.
+       *
+       * Firefox < 10, compatibility modes of IE 8, and IE < 9 have buggy Array
+       * `shift()` and `splice()` functions that fail to remove the last element,
+       * `value[0]`, of array-like objects even though the "length" property is
+       * set to `0`. The `shift()` method is buggy in compatibility modes of IE 8,
+       * while `splice()` is buggy regardless of mode in IE < 9.
+       *
+       * @memberOf _.support
+       * @type boolean
+       */
+      support.spliceObjects = (splice.call(object, 0, 1), !object[0]);
+
+      /**
+       * Detect lack of support for accessing string characters by index.
+       *
+       * IE < 8 can't access characters by index. IE 8 can only access characters
+       * by index on string literals, not string objects.
+       *
+       * @memberOf _.support
+       * @type boolean
+       */
+      support.unindexedChars = ('x'[0] + Object('x')[0]) != 'xx';
+    }(1, 0));
+
+    /**
+     * By default, the template delimiters used by lodash are like those in
+     * embedded Ruby (ERB). Change the following template settings to use
+     * alternative delimiters.
+     *
+     * @static
+     * @memberOf _
+     * @type Object
+     */
+    lodash.templateSettings = {
+
+      /**
+       * Used to detect `data` property values to be HTML-escaped.
+       *
+       * @memberOf _.templateSettings
+       * @type RegExp
+       */
+      'escape': reEscape,
+
+      /**
+       * Used to detect code to be evaluated.
+       *
+       * @memberOf _.templateSettings
+       * @type RegExp
+       */
+      'evaluate': reEvaluate,
+
+      /**
+       * Used to detect `data` property values to inject.
+       *
+       * @memberOf _.templateSettings
+       * @type RegExp
+       */
+      'interpolate': reInterpolate,
+
+      /**
+       * Used to reference the data object in the template text.
+       *
+       * @memberOf _.templateSettings
+       * @type string
+       */
+      'variable': '',
+
+      /**
+       * Used to import variables into the compiled template.
+       *
+       * @memberOf _.templateSettings
+       * @type Object
+       */
+      'imports': {
+
+        /**
+         * A reference to the `lodash` function.
+         *
+         * @memberOf _.templateSettings.imports
+         * @type Function
+         */
+        '_': lodash
+      }
+    };
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Creates a lazy wrapper object which wraps `value` to enable lazy evaluation.
+     *
+     * @private
+     * @param {*} value The value to wrap.
+     */
+    function LazyWrapper(value) {
+      this.__wrapped__ = value;
+      this.__actions__ = [];
+      this.__dir__ = 1;
+      this.__filtered__ = false;
+      this.__iteratees__ = [];
+      this.__takeCount__ = POSITIVE_INFINITY;
+      this.__views__ = [];
+    }
+
+    /**
+     * Creates a clone of the lazy wrapper object.
+     *
+     * @private
+     * @name clone
+     * @memberOf LazyWrapper
+     * @returns {Object} Returns the cloned `LazyWrapper` object.
+     */
+    function lazyClone() {
+      var result = new LazyWrapper(this.__wrapped__);
+      result.__actions__ = arrayCopy(this.__actions__);
+      result.__dir__ = this.__dir__;
+      result.__filtered__ = this.__filtered__;
+      result.__iteratees__ = arrayCopy(this.__iteratees__);
+      result.__takeCount__ = this.__takeCount__;
+      result.__views__ = arrayCopy(this.__views__);
+      return result;
+    }
+
+    /**
+     * Reverses the direction of lazy iteration.
+     *
+     * @private
+     * @name reverse
+     * @memberOf LazyWrapper
+     * @returns {Object} Returns the new reversed `LazyWrapper` object.
+     */
+    function lazyReverse() {
+      if (this.__filtered__) {
+        var result = new LazyWrapper(this);
+        result.__dir__ = -1;
+        result.__filtered__ = true;
+      } else {
+        result = this.clone();
+        result.__dir__ *= -1;
+      }
+      return result;
+    }
+
+    /**
+     * Extracts the unwrapped value from its lazy wrapper.
+     *
+     * @private
+     * @name value
+     * @memberOf LazyWrapper
+     * @returns {*} Returns the unwrapped value.
+     */
+    function lazyValue() {
+      var array = this.__wrapped__.value(),
+          dir = this.__dir__,
+          isArr = isArray(array),
+          isRight = dir < 0,
+          arrLength = isArr ? array.length : 0,
+          view = getView(0, arrLength, this.__views__),
+          start = view.start,
+          end = view.end,
+          length = end - start,
+          index = isRight ? end : (start - 1),
+          iteratees = this.__iteratees__,
+          iterLength = iteratees.length,
+          resIndex = 0,
+          takeCount = nativeMin(length, this.__takeCount__);
+
+      if (!isArr || arrLength < LARGE_ARRAY_SIZE || (arrLength == length && takeCount == length)) {
+        return baseWrapperValue(array, this.__actions__);
+      }
+      var result = [];
+
+      outer:
+      while (length-- && resIndex < takeCount) {
+        index += dir;
+
+        var iterIndex = -1,
+            value = array[index];
+
+        while (++iterIndex < iterLength) {
+          var data = iteratees[iterIndex],
+              iteratee = data.iteratee,
+              type = data.type,
+              computed = iteratee(value);
+
+          if (type == LAZY_MAP_FLAG) {
+            value = computed;
+          } else if (!computed) {
+            if (type == LAZY_FILTER_FLAG) {
+              continue outer;
+            } else {
+              break outer;
+            }
+          }
+        }
+        result[resIndex++] = value;
+      }
+      return result;
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Creates a cache object to store key/value pairs.
+     *
+     * @private
+     * @static
+     * @name Cache
+     * @memberOf _.memoize
+     */
+    function MapCache() {
+      this.__data__ = {};
+    }
+
+    /**
+     * Removes `key` and its value from the cache.
+     *
+     * @private
+     * @name delete
+     * @memberOf _.memoize.Cache
+     * @param {string} key The key of the value to remove.
+     * @returns {boolean} Returns `true` if the thing was removed successfully, else `false`.
+     */
+    function mapDelete(key) {
+      return this.has(key) && delete this.__data__[key];
+    }
+
+    /**
+     * Gets the cached value for `key`.
+     *
+     * @private
+     * @name get
+     * @memberOf _.memoize.Cache
+     * @param {string} key The key of the value to get.
+     * @returns {*} Returns the cached value.
+     */
+    function mapGet(key) {
+      return key == '__proto__' ? undefined : this.__data__[key];
+    }
+
+    /**
+     * Checks if a cached value for `key` exists.
+     *
+     * @private
+     * @name has
+     * @memberOf _.memoize.Cache
+     * @param {string} key The key of the thing to check.
+     * @returns {boolean} Returns `true` if an thing for `key` exists, else `false`.
+     */
+    function mapHas(key) {
+      return key != '__proto__' && hasOwnProperty.call(this.__data__, key);
+    }
+
+    /**
+     * Sets `value` to `key` of the cache.
+     *
+     * @private
+     * @name set
+     * @memberOf _.memoize.Cache
+     * @param {string} key The key of the value to cache.
+     * @param {*} value The value to cache.
+     * @returns {Object} Returns the cache object.
+     */
+    function mapSet(key, value) {
+      if (key != '__proto__') {
+        this.__data__[key] = value;
+      }
+      return this;
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     *
+     * Creates a cache object to store unique values.
+     *
+     * @private
+     * @param {Array} [values] The values to cache.
+     */
+    function SetCache(values) {
+      var length = values ? values.length : 0;
+
+      this.data = { 'hash': nativeCreate(null), 'set': new Set };
+      while (length--) {
+        this.push(values[length]);
+      }
+    }
+
+    /**
+     * Checks if `value` is in `cache` mimicking the return signature of
+     * `_.indexOf` by returning `0` if the value is found, else `-1`.
+     *
+     * @private
+     * @param {Object} cache The cache to search.
+     * @param {*} value The value to search for.
+     * @returns {number} Returns `0` if `value` is found, else `-1`.
+     */
+    function cacheIndexOf(cache, value) {
+      var data = cache.data,
+          result = (typeof value == 'string' || isObject(value)) ? data.set.has(value) : data.hash[value];
+
+      return result ? 0 : -1;
+    }
+
+    /**
+     * Adds `value` to the cache.
+     *
+     * @private
+     * @name push
+     * @memberOf SetCache
+     * @param {*} value The value to cache.
+     */
+    function cachePush(value) {
+      var data = this.data;
+      if (typeof value == 'string' || isObject(value)) {
+        data.set.add(value);
+      } else {
+        data.hash[value] = true;
+      }
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Creates a new array joining `array` with `other`.
+     *
+     * @private
+     * @param {Array} array The array to join.
+     * @param {Array} other The other array to join.
+     * @returns {Array} Returns the new concatenated array.
+     */
+    function arrayConcat(array, other) {
+      var index = -1,
+          length = array.length,
+          othIndex = -1,
+          othLength = other.length,
+          result = Array(length + othLength);
+
+      while (++index < length) {
+        result[index] = array[index];
+      }
+      while (++othIndex < othLength) {
+        result[index++] = other[othIndex];
+      }
+      return result;
+    }
+
+    /**
+     * Copies the values of `source` to `array`.
+     *
+     * @private
+     * @param {Array} source The array to copy values from.
+     * @param {Array} [array=[]] The array to copy values to.
+     * @returns {Array} Returns `array`.
+     */
+    function arrayCopy(source, array) {
+      var index = -1,
+          length = source.length;
+
+      array || (array = Array(length));
+      while (++index < length) {
+        array[index] = source[index];
+      }
+      return array;
+    }
+
+    /**
+     * A specialized version of `_.forEach` for arrays without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {Array} Returns `array`.
+     */
+    function arrayEach(array, iteratee) {
+      var index = -1,
+          length = array.length;
+
+      while (++index < length) {
+        if (iteratee(array[index], index, array) === false) {
+          break;
+        }
+      }
+      return array;
+    }
+
+    /**
+     * A specialized version of `_.forEachRight` for arrays without support for
+     * callback shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {Array} Returns `array`.
+     */
+    function arrayEachRight(array, iteratee) {
+      var length = array.length;
+
+      while (length--) {
+        if (iteratee(array[length], length, array) === false) {
+          break;
+        }
+      }
+      return array;
+    }
+
+    /**
+     * A specialized version of `_.every` for arrays without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} predicate The function invoked per iteration.
+     * @returns {boolean} Returns `true` if all elements pass the predicate check,
+     *  else `false`.
+     */
+    function arrayEvery(array, predicate) {
+      var index = -1,
+          length = array.length;
+
+      while (++index < length) {
+        if (!predicate(array[index], index, array)) {
+          return false;
+        }
+      }
+      return true;
+    }
+
+    /**
+     * A specialized version of `baseExtremum` for arrays which invokes `iteratee`
+     * with one argument: (value).
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @param {Function} comparator The function used to compare values.
+     * @param {*} exValue The initial extremum value.
+     * @returns {*} Returns the extremum value.
+     */
+    function arrayExtremum(array, iteratee, comparator, exValue) {
+      var index = -1,
+          length = array.length,
+          computed = exValue,
+          result = computed;
+
+      while (++index < length) {
+        var value = array[index],
+            current = +iteratee(value);
+
+        if (comparator(current, computed)) {
+          computed = current;
+          result = value;
+        }
+      }
+      return result;
+    }
+
+    /**
+     * A specialized version of `_.filter` for arrays without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} predicate The function invoked per iteration.
+     * @returns {Array} Returns the new filtered array.
+     */
+    function arrayFilter(array, predicate) {
+      var index = -1,
+          length = array.length,
+          resIndex = -1,
+          result = [];
+
+      while (++index < length) {
+        var value = array[index];
+        if (predicate(value, index, array)) {
+          result[++resIndex] = value;
+        }
+      }
+      return result;
+    }
+
+    /**
+     * A specialized version of `_.map` for arrays without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {Array} Returns the new mapped array.
+     */
+    function arrayMap(array, iteratee) {
+      var index = -1,
+          length = array.length,
+          result = Array(length);
+
+      while (++index < length) {
+        result[index] = iteratee(array[index], index, array);
+      }
+      return result;
+    }
+
+    /**
+     * Appends the elements of `values` to `array`.
+     *
+     * @private
+     * @param {Array} array The array to modify.
+     * @param {Array} values The values to append.
+     * @returns {Array} Returns `array`.
+     */
+    function arrayPush(array, values) {
+      var index = -1,
+          length = values.length,
+          offset = array.length;
+
+      while (++index < length) {
+        array[offset + index] = values[index];
+      }
+      return array;
+    }
+
+    /**
+     * A specialized version of `_.reduce` for arrays without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @param {*} [accumulator] The initial value.
+     * @param {boolean} [initFromArray] Specify using the first element of `array`
+     *  as the initial value.
+     * @returns {*} Returns the accumulated value.
+     */
+    function arrayReduce(array, iteratee, accumulator, initFromArray) {
+      var index = -1,
+          length = array.length;
+
+      if (initFromArray && length) {
+        accumulator = array[++index];
+      }
+      while (++index < length) {
+        accumulator = iteratee(accumulator, array[index], index, array);
+      }
+      return accumulator;
+    }
+
+    /**
+     * A specialized version of `_.reduceRight` for arrays without support for
+     * callback shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @param {*} [accumulator] The initial value.
+     * @param {boolean} [initFromArray] Specify using the last element of `array`
+     *  as the initial value.
+     * @returns {*} Returns the accumulated value.
+     */
+    function arrayReduceRight(array, iteratee, accumulator, initFromArray) {
+      var length = array.length;
+      if (initFromArray && length) {
+        accumulator = array[--length];
+      }
+      while (length--) {
+        accumulator = iteratee(accumulator, array[length], length, array);
+      }
+      return accumulator;
+    }
+
+    /**
+     * A specialized version of `_.some` for arrays without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} predicate The function invoked per iteration.
+     * @returns {boolean} Returns `true` if any element passes the predicate check,
+     *  else `false`.
+     */
+    function arraySome(array, predicate) {
+      var index = -1,
+          length = array.length;
+
+      while (++index < length) {
+        if (predicate(array[index], index, array)) {
+          return true;
+        }
+      }
+      return false;
+    }
+
+    /**
+     * A specialized version of `_.sum` for arrays without support for callback
+     * shorthands and `this` binding..
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {number} Returns the sum.
+     */
+    function arraySum(array, iteratee) {
+      var length = array.length,
+          result = 0;
+
+      while (length--) {
+        result += +iteratee(array[length]) || 0;
+      }
+      return result;
+    }
+
+    /**
+     * Used by `_.defaults` to customize its `_.assign` use.
+     *
+     * @private
+     * @param {*} objectValue The destination object property value.
+     * @param {*} sourceValue The source object property value.
+     * @returns {*} Returns the value to assign to the destination object.
+     */
+    function assignDefaults(objectValue, sourceValue) {
+      return objectValue === undefined ? sourceValue : objectValue;
+    }
+
+    /**
+     * Used by `_.template` to customize its `_.assign` use.
+     *
+     * **Note:** This function is like `assignDefaults` except that it ignores
+     * inherited property values when checking if a property is `undefined`.
+     *
+     * @private
+     * @param {*} objectValue The destination object property value.
+     * @param {*} sourceValue The source object property value.
+     * @param {string} key The key associated with the object and source values.
+     * @param {Object} object The destination object.
+     * @returns {*} Returns the value to assign to the destination object.
+     */
+    function assignOwnDefaults(objectValue, sourceValue, key, object) {
+      return (objectValue === undefined || !hasOwnProperty.call(object, key))
+        ? sourceValue
+        : objectValue;
+    }
+
+    /**
+     * A specialized version of `_.assign` for customizing assigned values without
+     * support for argument juggling, multiple sources, and `this` binding `customizer`
+     * functions.
+     *
+     * @private
+     * @param {Object} object The destination object.
+     * @param {Object} source The source object.
+     * @param {Function} customizer The function to customize assigned values.
+     * @returns {Object} Returns `object`.
+     */
+    function assignWith(object, source, customizer) {
+      var index = -1,
+          props = keys(source),
+          length = props.length;
+
+      while (++index < length) {
+        var key = props[index],
+            value = object[key],
+            result = customizer(value, source[key], key, object, source);
+
+        if ((result === result ? (result !== value) : (value === value)) ||
+            (value === undefined && !(key in object))) {
+          object[key] = result;
+        }
+      }
+      return object;
+    }
+
+    /**
+     * The base implementation of `_.assign` without support for argument juggling,
+     * multiple sources, and `customizer` functions.
+     *
+     * @private
+     * @param {Object} object The destination object.
+     * @param {Object} source The source object.
+     * @returns {Object} Returns `object`.
+     */
+    function baseAssign(object, source) {
+      return source == null
+        ? object
+        : baseCopy(source, keys(source), object);
+    }
+
+    /**
+     * The base implementation of `_.at` without support for string collections
+     * and individual key arguments.
+     *
+     * @private
+     * @param {Array|Object} collection The collection to iterate over.
+     * @param {number[]|string[]} props The property names or indexes of elements to pick.
+     * @returns {Array} Returns the new array of picked elements.
+     */
+    function baseAt(collection, props) {
+      var index = -1,
+          isNil = collection == null,
+          isArr = !isNil && isArrayLike(collection),
+          length = isArr ? collection.length : 0,
+          propsLength = props.length,
+          result = Array(propsLength);
+
+      while(++index < propsLength) {
+        var key = props[index];
+        if (isArr) {
+          result[index] = isIndex(key, length) ? collection[key] : undefined;
+        } else {
+          result[index] = isNil ? undefined : collection[key];
+        }
+      }
+      return result;
+    }
+
+    /**
+     * Copies properties of `source` to `object`.
+     *
+     * @private
+     * @param {Object} source The object to copy properties from.
+     * @param {Array} props The property names to copy.
+     * @param {Object} [object={}] The object to copy properties to.
+     * @returns {Object} Returns `object`.
+     */
+    function baseCopy(source, props, object) {
+      object || (object = {});
+
+      var index = -1,
+          length = props.length;
+
+      while (++index < length) {
+        var key = props[index];
+        object[key] = source[key];
+      }
+      return object;
+    }
+
+    /**
+     * The base implementation of `_.callback` which supports specifying the
+     * number of arguments to provide to `func`.
+     *
+     * @private
+     * @param {*} [func=_.identity] The value to convert to a callback.
+     * @param {*} [thisArg] The `this` binding of `func`.
+     * @param {number} [argCount] The number of arguments to provide to `func`.
+     * @returns {Function} Returns the callback.
+     */
+    function baseCallback(func, thisArg, argCount) {
+      var type = typeof func;
+      if (type == 'function') {
+        return thisArg === undefined
+          ? func
+          : bindCallback(func, thisArg, argCount);
+      }
+      if (func == null) {
+        return identity;
+      }
+      if (type == 'object') {
+        return baseMatches(func);
+      }
+      return thisArg === undefined
+        ? property(func)
+        : baseMatchesProperty(func, thisArg);
+    }
+
+    /**
+     * The base implementation of `_.clone` without support for argument juggling
+     * and `this` binding `customizer` functions.
+     *
+     * @private
+     * @param {*} value The value to clone.
+     * @param {boolean} [isDeep] Specify a deep clone.
+     * @param {Function} [customizer] The function to customize cloning values.
+     * @param {string} [key] The key of `value`.
+     * @param {Object} [object] The object `value` belongs to.
+     * @param {Array} [stackA=[]] Tracks traversed source objects.
+     * @param {Array} [stackB=[]] Associates clones with source counterparts.
+     * @returns {*} Returns the cloned value.
+     */
+    function baseClone(value, isDeep, customizer, key, object, stackA, stackB) {
+      var result;
+      if (customizer) {
+        result = object ? customizer(value, key, object) : customizer(value);
+      }
+      if (result !== undefined) {
+        return result;
+      }
+      if (!isObject(value)) {
+        return value;
+      }
+      var isArr = isArray(value);
+      if (isArr) {
+        result = initCloneArray(value);
+        if (!isDeep) {
+          return arrayCopy(value, result);
+        }
+      } else {
+        var tag = objToString.call(value),
+            isFunc = tag == funcTag;
+
+        if (tag == objectTag || tag == argsTag || (isFunc && !object)) {
+          if (isHostObject(value)) {
+            return object ? value : {};
+          }
+          result = initCloneObject(isFunc ? {} : value);
+          if (!isDeep) {
+            return baseAssign(result, value);
+          }
+        } else {
+          return cloneableTags[tag]
+            ? initCloneByTag(value, tag, isDeep)
+            : (object ? value : {});
+        }
+      }
+      // Check for circular references and return its corresponding clone.
+      stackA || (stackA = []);
+      stackB || (stackB = []);
+
+      var length = stackA.length;
+      while (length--) {
+        if (stackA[length] == value) {
+          return stackB[length];
+        }
+      }
+      // Add the source value to the stack of traversed objects and associate it with its clone.
+      stackA.push(value);
+      stackB.push(result);
+
+      // Recursively populate clone (susceptible to call stack limits).
+      (isArr ? arrayEach : baseForOwn)(value, function(subValue, key) {
+        result[key] = baseClone(subValue, isDeep, customizer, key, value, stackA, stackB);
+      });
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.create` without support for assigning
+     * properties to the created object.
+     *
+     * @private
+     * @param {Object} prototype The object to inherit from.
+     * @returns {Object} Returns the new object.
+     */
+    var baseCreate = (function() {
+      function object() {}
+      return function(prototype) {
+        if (isObject(prototype)) {
+          object.prototype = prototype;
+          var result = new object;
+          object.prototype = undefined;
+        }
+        return result || {};
+      };
+    }());
+
+    /**
+     * The base implementation of `_.delay` and `_.defer` which accepts an index
+     * of where to slice the arguments to provide to `func`.
+     *
+     * @private
+     * @param {Function} func The function to delay.
+     * @param {number} wait The number of milliseconds to delay invocation.
+     * @param {Object} args The arguments provide to `func`.
+     * @returns {number} Returns the timer id.
+     */
+    function baseDelay(func, wait, args) {
+      if (typeof func != 'function') {
+        throw new TypeError(FUNC_ERROR_TEXT);
+      }
+      return setTimeout(function() { func.apply(undefined, args); }, wait);
+    }
+
+    /**
+     * The base implementation of `_.difference` which accepts a single array
+     * of values to exclude.
+     *
+     * @private
+     * @param {Array} array The array to inspect.
+     * @param {Array} values The values to exclude.
+     * @returns {Array} Returns the new array of filtered values.
+     */
+    function baseDifference(array, values) {
+      var length = array ? array.length : 0,
+          result = [];
+
+      if (!length) {
+        return result;
+      }
+      var index = -1,
+          indexOf = getIndexOf(),
+          isCommon = indexOf === baseIndexOf,
+          cache = (isCommon && values.length >= LARGE_ARRAY_SIZE) ? createCache(values) : null,
+          valuesLength = values.length;
+
+      if (cache) {
+        indexOf = cacheIndexOf;
+        isCommon = false;
+        values = cache;
+      }
+      outer:
+      while (++index < length) {
+        var value = array[index];
+
+        if (isCommon && value === value) {
+          var valuesIndex = valuesLength;
+          while (valuesIndex--) {
+            if (values[valuesIndex] === value) {
+              continue outer;
+            }
+          }
+          result.push(value);
+        }
+        else if (indexOf(values, value, 0) < 0) {
+          result.push(value);
+        }
+      }
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.forEach` without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {Array|Object|string} Returns `collection`.
+     */
+    var baseEach = createBaseEach(baseForOwn);
+
+    /**
+     * The base implementation of `_.forEachRight` without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {Array|Object|string} Returns `collection`.
+     */
+    var baseEachRight = createBaseEach(baseForOwnRight, true);
+
+    /**
+     * The base implementation of `_.every` without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} predicate The function invoked per iteration.
+     * @returns {boolean} Returns `true` if all elements pass the predicate check,
+     *  else `false`
+     */
+    function baseEvery(collection, predicate) {
+      var result = true;
+      baseEach(collection, function(value, index, collection) {
+        result = !!predicate(value, index, collection);
+        return result;
+      });
+      return result;
+    }
+
+    /**
+     * Gets the extremum value of `collection` invoking `iteratee` for each value
+     * in `collection` to generate the criterion by which the value is ranked.
+     * The `iteratee` is invoked with three arguments: (value, index|key, collection).
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @param {Function} comparator The function used to compare values.
+     * @param {*} exValue The initial extremum value.
+     * @returns {*} Returns the extremum value.
+     */
+    function baseExtremum(collection, iteratee, comparator, exValue) {
+      var computed = exValue,
+          result = computed;
+
+      baseEach(collection, function(value, index, collection) {
+        var current = +iteratee(value, index, collection);
+        if (comparator(current, computed) || (current === exValue && current === result)) {
+          computed = current;
+          result = value;
+        }
+      });
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.fill` without an iteratee call guard.
+     *
+     * @private
+     * @param {Array} array The array to fill.
+     * @param {*} value The value to fill `array` with.
+     * @param {number} [start=0] The start position.
+     * @param {number} [end=array.length] The end position.
+     * @returns {Array} Returns `array`.
+     */
+    function baseFill(array, value, start, end) {
+      var length = array.length;
+
+      start = start == null ? 0 : (+start || 0);
+      if (start < 0) {
+        start = -start > length ? 0 : (length + start);
+      }
+      end = (end === undefined || end > length) ? length : (+end || 0);
+      if (end < 0) {
+        end += length;
+      }
+      length = start > end ? 0 : (end >>> 0);
+      start >>>= 0;
+
+      while (start < length) {
+        array[start++] = value;
+      }
+      return array;
+    }
+
+    /**
+     * The base implementation of `_.filter` without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} predicate The function invoked per iteration.
+     * @returns {Array} Returns the new filtered array.
+     */
+    function baseFilter(collection, predicate) {
+      var result = [];
+      baseEach(collection, function(value, index, collection) {
+        if (predicate(value, index, collection)) {
+          result.push(value);
+        }
+      });
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.find`, `_.findLast`, `_.findKey`, and `_.findLastKey`,
+     * without support for callback shorthands and `this` binding, which iterates
+     * over `collection` using the provided `eachFunc`.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to search.
+     * @param {Function} predicate The function invoked per iteration.
+     * @param {Function} eachFunc The function to iterate over `collection`.
+     * @param {boolean} [retKey] Specify returning the key of the found element
+     *  instead of the element itself.
+     * @returns {*} Returns the found element or its key, else `undefined`.
+     */
+    function baseFind(collection, predicate, eachFunc, retKey) {
+      var result;
+      eachFunc(collection, function(value, key, collection) {
+        if (predicate(value, key, collection)) {
+          result = retKey ? key : value;
+          return false;
+        }
+      });
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.flatten` with added support for restricting
+     * flattening and specifying the start index.
+     *
+     * @private
+     * @param {Array} array The array to flatten.
+     * @param {boolean} [isDeep] Specify a deep flatten.
+     * @param {boolean} [isStrict] Restrict flattening to arrays-like objects.
+     * @param {Array} [result=[]] The initial result value.
+     * @returns {Array} Returns the new flattened array.
+     */
+    function baseFlatten(array, isDeep, isStrict, result) {
+      result || (result = []);
+
+      var index = -1,
+          length = array.length;
+
+      while (++index < length) {
+        var value = array[index];
+        if (isObjectLike(value) && isArrayLike(value) &&
+            (isStrict || isArray(value) || isArguments(value))) {
+          if (isDeep) {
+            // Recursively flatten arrays (susceptible to call stack limits).
+            baseFlatten(value, isDeep, isStrict, result);
+          } else {
+            arrayPush(result, value);
+          }
+        } else if (!isStrict) {
+          result[result.length] = value;
+        }
+      }
+      return result;
+    }
+
+    /**
+     * The base implementation of `baseForIn` and `baseForOwn` which iterates
+     * over `object` properties returned by `keysFunc` invoking `iteratee` for
+     * each property. Iteratee functions may exit iteration early by explicitly
+     * returning `false`.
+     *
+     * @private
+     * @param {Object} object The object to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @param {Function} keysFunc The function to get the keys of `object`.
+     * @returns {Object} Returns `object`.
+     */
+    var baseFor = createBaseFor();
+
+    /**
+     * This function is like `baseFor` except that it iterates over properties
+     * in the opposite order.
+     *
+     * @private
+     * @param {Object} object The object to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @param {Function} keysFunc The function to get the keys of `object`.
+     * @returns {Object} Returns `object`.
+     */
+    var baseForRight = createBaseFor(true);
+
+    /**
+     * The base implementation of `_.forIn` without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Object} object The object to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {Object} Returns `object`.
+     */
+    function baseForIn(object, iteratee) {
+      return baseFor(object, iteratee, keysIn);
+    }
+
+    /**
+     * The base implementation of `_.forOwn` without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Object} object The object to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {Object} Returns `object`.
+     */
+    function baseForOwn(object, iteratee) {
+      return baseFor(object, iteratee, keys);
+    }
+
+    /**
+     * The base implementation of `_.forOwnRight` without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Object} object The object to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {Object} Returns `object`.
+     */
+    function baseForOwnRight(object, iteratee) {
+      return baseForRight(object, iteratee, keys);
+    }
+
+    /**
+     * The base implementation of `_.functions` which creates an array of
+     * `object` function property names filtered from those provided.
+     *
+     * @private
+     * @param {Object} object The object to inspect.
+     * @param {Array} props The property names to filter.
+     * @returns {Array} Returns the new array of filtered property names.
+     */
+    function baseFunctions(object, props) {
+      var index = -1,
+          length = props.length,
+          resIndex = -1,
+          result = [];
+
+      while (++index < length) {
+        var key = props[index];
+        if (isFunction(object[key])) {
+          result[++resIndex] = key;
+        }
+      }
+      return result;
+    }
+
+    /**
+     * The base implementation of `get` without support for string paths
+     * and default values.
+     *
+     * @private
+     * @param {Object} object The object to query.
+     * @param {Array} path The path of the property to get.
+     * @param {string} [pathKey] The key representation of path.
+     * @returns {*} Returns the resolved value.
+     */
+    function baseGet(object, path, pathKey) {
+      if (object == null) {
+        return;
+      }
+      object = toObject(object);
+      if (pathKey !== undefined && pathKey in object) {
+        path = [pathKey];
+      }
+      var index = 0,
+          length = path.length;
+
+      while (object != null && index < length) {
+        object = toObject(object)[path[index++]];
+      }
+      return (index && index == length) ? object : undefined;
+    }
+
+    /**
+     * The base implementation of `_.isEqual` without support for `this` binding
+     * `customizer` functions.
+     *
+     * @private
+     * @param {*} value The value to compare.
+     * @param {*} other The other value to compare.
+     * @param {Function} [customizer] The function to customize comparing values.
+     * @param {boolean} [isLoose] Specify performing partial comparisons.
+     * @param {Array} [stackA] Tracks traversed `value` objects.
+     * @param {Array} [stackB] Tracks traversed `other` objects.
+     * @returns {boolean} Returns `true` if the values are equivalent, else `false`.
+     */
+    function baseIsEqual(value, other, customizer, isLoose, stackA, stackB) {
+      if (value === other) {
+        return true;
+      }
+      if (value == null || other == null || (!isObject(value) && !isObjectLike(other))) {
+        return value !== value && other !== other;
+      }
+      return baseIsEqualDeep(value, other, baseIsEqual, customizer, isLoose, stackA, stackB);
+    }
+
+    /**
+     * A specialized version of `baseIsEqual` for arrays and objects which performs
+     * deep comparisons and tracks traversed objects enabling objects with circular
+     * references to be compared.
+     *
+     * @private
+     * @param {Object} object The object to compare.
+     * @param {Object} other The other object to compare.
+     * @param {Function} equalFunc The function to determine equivalents of values.
+     * @param {Function} [customizer] The function to customize comparing objects.
+     * @param {boolean} [isLoose] Specify performing partial comparisons.
+     * @param {Array} [stackA=[]] Tracks traversed `value` objects.
+     * @param {Array} [stackB=[]] Tracks traversed `other` objects.
+     * @returns {boolean} Returns `true` if the objects are equivalent, else `false`.
+     */
+    function baseIsEqualDeep(object, other, equalFunc, customizer, isLoose, stackA, stackB) {
+      var objIsArr = isArray(object),
+          othIsArr = isArray(other),
+          objTag = arrayTag,
+          othTag = arrayTag;
+
+      if (!objIsArr) {
+        objTag = objToString.call(object);
+        if (objTag == argsTag) {
+          objTag = objectTag;
+        } else if (objTag != objectTag) {
+          objIsArr = isTypedArray(object);
+        }
+      }
+      if (!othIsArr) {
+        othTag = objToString.call(other);
+        if (othTag == argsTag) {
+          othTag = objectTag;
+        } else if (othTag != objectTag) {
+          othIsArr = isTypedArray(other);
+        }
+      }
+      var objIsObj = objTag == objectTag && !isHostObject(object),
+          othIsObj = othTag == objectTag && !isHostObject(other),
+          isSameTag = objTag == othTag;
+
+      if (isSameTag && !(objIsArr || objIsObj)) {
+        return equalByTag(object, other, objTag);
+      }
+      if (!isLoose) {
+        var objIsWrapped = objIsObj && hasOwnProperty.call(object, '__wrapped__'),
+            othIsWrapped = othIsObj && hasOwnProperty.call(other, '__wrapped__');
+
+        if (objIsWrapped || othIsWrapped) {
+          return equalFunc(objIsWrapped ? object.value() : object, othIsWrapped ? other.value() : other, customizer, isLoose, stackA, stackB);
+        }
+      }
+      if (!isSameTag) {
+        return false;
+      }
+      // Assume cyclic values are equal.
+      // For more information on detecting circular references see https://es5.github.io/#JO.
+      stackA || (stackA = []);
+      stackB || (stackB = []);
+
+      var length = stackA.length;
+      while (length--) {
+        if (stackA[length] == object) {
+          return stackB[length] == other;
+        }
+      }
+      // Add `object` and `other` to the stack of traversed objects.
+      stackA.push(object);
+      stackB.push(other);
+
+      var result = (objIsArr ? equalArrays : equalObjects)(object, other, equalFunc, customizer, isLoose, stackA, stackB);
+
+      stackA.pop();
+      stackB.pop();
+
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.isMatch` without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Object} object The object to inspect.
+     * @param {Array} matchData The propery names, values, and compare flags to match.
+     * @param {Function} [customizer] The function to customize comparing objects.
+     * @returns {boolean} Returns `true` if `object` is a match, else `false`.
+     */
+    function baseIsMatch(object, matchData, customizer) {
+      var index = matchData.length,
+          length = index,
+          noCustomizer = !customizer;
+
+      if (object == null) {
+        return !length;
+      }
+      object = toObject(object);
+      while (index--) {
+        var data = matchData[index];
+        if ((noCustomizer && data[2])
+              ? data[1] !== object[data[0]]
+              : !(data[0] in object)
+            ) {
+          return false;
+        }
+      }
+      while (++index < length) {
+        data = matchData[index];
+        var key = data[0],
+            objValue = object[key],
+            srcValue = data[1];
+
+        if (noCustomizer && data[2]) {
+          if (objValue === undefined && !(key in object)) {
+            return false;
+          }
+        } else {
+          var result = customizer ? customizer(objValue, srcValue, key) : undefined;
+          if (!(result === undefined ? baseIsEqual(srcValue, objValue, customizer, true) : result)) {
+            return false;
+          }
+        }
+      }
+      return true;
+    }
+
+    /**
+     * The base implementation of `_.map` without support for callback shorthands
+     * and `this` binding.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {Array} Returns the new mapped array.
+     */
+    function baseMap(collection, iteratee) {
+      var index = -1,
+          result = isArrayLike(collection) ? Array(collection.length) : [];
+
+      baseEach(collection, function(value, key, collection) {
+        result[++index] = iteratee(value, key, collection);
+      });
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.matches` which does not clone `source`.
+     *
+     * @private
+     * @param {Object} source The object of property values to match.
+     * @returns {Function} Returns the new function.
+     */
+    function baseMatches(source) {
+      var matchData = getMatchData(source);
+      if (matchData.length == 1 && matchData[0][2]) {
+        var key = matchData[0][0],
+            value = matchData[0][1];
+
+        return function(object) {
+          if (object == null) {
+            return false;
+          }
+          object = toObject(object);
+          return object[key] === value && (value !== undefined || (key in object));
+        };
+      }
+      return function(object) {
+        return baseIsMatch(object, matchData);
+      };
+    }
+
+    /**
+     * The base implementation of `_.matchesProperty` which does not clone `srcValue`.
+     *
+     * @private
+     * @param {string} path The path of the property to get.
+     * @param {*} srcValue The value to compare.
+     * @returns {Function} Returns the new function.
+     */
+    function baseMatchesProperty(path, srcValue) {
+      var isArr = isArray(path),
+          isCommon = isKey(path) && isStrictComparable(srcValue),
+          pathKey = (path + '');
+
+      path = toPath(path);
+      return function(object) {
+        if (object == null) {
+          return false;
+        }
+        var key = pathKey;
+        object = toObject(object);
+        if ((isArr || !isCommon) && !(key in object)) {
+          object = path.length == 1 ? object : baseGet(object, baseSlice(path, 0, -1));
+          if (object == null) {
+            return false;
+          }
+          key = last(path);
+          object = toObject(object);
+        }
+        return object[key] === srcValue
+          ? (srcValue !== undefined || (key in object))
+          : baseIsEqual(srcValue, object[key], undefined, true);
+      };
+    }
+
+    /**
+     * The base implementation of `_.merge` without support for argument juggling,
+     * multiple sources, and `this` binding `customizer` functions.
+     *
+     * @private
+     * @param {Object} object The destination object.
+     * @param {Object} source The source object.
+     * @param {Function} [customizer] The function to customize merged values.
+     * @param {Array} [stackA=[]] Tracks traversed source objects.
+     * @param {Array} [stackB=[]] Associates values with source counterparts.
+     * @returns {Object} Returns `object`.
+     */
+    function baseMerge(object, source, customizer, stackA, stackB) {
+      if (!isObject(object)) {
+        return object;
+      }
+      var isSrcArr = isArrayLike(source) && (isArray(source) || isTypedArray(source)),
+          props = isSrcArr ? undefined : keys(source);
+
+      arrayEach(props || source, function(srcValue, key) {
+        if (props) {
+          key = srcValue;
+          srcValue = source[key];
+        }
+        if (isObjectLike(srcValue)) {
+          stackA || (stackA = []);
+          stackB || (stackB = []);
+          baseMergeDeep(object, source, key, baseMerge, customizer, stackA, stackB);
+        }
+        else {
+          var value = object[key],
+              result = customizer ? customizer(value, srcValue, key, object, source) : undefined,
+              isCommon = result === undefined;
+
+          if (isCommon) {
+            result = srcValue;
+          }
+          if ((result !== undefined || (isSrcArr && !(key in object))) &&
+              (isCommon || (result === result ? (result !== value) : (value === value)))) {
+            object[key] = result;
+          }
+        }
+      });
+      return object;
+    }
+
+    /**
+     * A specialized version of `baseMerge` for arrays and objects which performs
+     * deep merges and tracks traversed objects enabling objects with circular
+     * references to be merged.
+     *
+     * @private
+     * @param {Object} object The destination object.
+     * @param {Object} source The source object.
+     * @param {string} key The key of the value to merge.
+     * @param {Function} mergeFunc The function to merge values.
+     * @param {Function} [customizer] The function to customize merged values.
+     * @param {Array} [stackA=[]] Tracks traversed source objects.
+     * @param {Array} [stackB=[]] Associates values with source counterparts.
+     * @returns {boolean} Returns `true` if the objects are equivalent, else `false`.
+     */
+    function baseMergeDeep(object, source, key, mergeFunc, customizer, stackA, stackB) {
+      var length = stackA.length,
+          srcValue = source[key];
+
+      while (length--) {
+        if (stackA[length] == srcValue) {
+          object[key] = stackB[length];
+          return;
+        }
+      }
+      var value = object[key],
+          result = customizer ? customizer(value, srcValue, key, object, source) : undefined,
+          isCommon = result === undefined;
+
+      if (isCommon) {
+        result = srcValue;
+        if (isArrayLike(srcValue) && (isArray(srcValue) || isTypedArray(srcValue))) {
+          result = isArray(value)
+            ? value
+            : (isArrayLike(value) ? arrayCopy(value) : []);
+        }
+        else if (isPlainObject(srcValue) || isArguments(srcValue)) {
+          result = isArguments(value)
+            ? toPlainObject(value)
+            : (isPlainObject(value) ? value : {});
+        }
+        else {
+          isCommon = false;
+        }
+      }
+      // Add the source value to the stack of traversed objects and associate
+      // it with its merged value.
+      stackA.push(srcValue);
+      stackB.push(result);
+
+      if (isCommon) {
+        // Recursively merge objects and arrays (susceptible to call stack limits).
+        object[key] = mergeFunc(result, srcValue, customizer, stackA, stackB);
+      } else if (result === result ? (result !== value) : (value === value)) {
+        object[key] = result;
+      }
+    }
+
+    /**
+     * The base implementation of `_.property` without support for deep paths.
+     *
+     * @private
+     * @param {string} key The key of the property to get.
+     * @returns {Function} Returns the new function.
+     */
+    function baseProperty(key) {
+      return function(object) {
+        return object == null ? undefined : toObject(object)[key];
+      };
+    }
+
+    /**
+     * A specialized version of `baseProperty` which supports deep paths.
+     *
+     * @private
+     * @param {Array|string} path The path of the property to get.
+     * @returns {Function} Returns the new function.
+     */
+    function basePropertyDeep(path) {
+      var pathKey = (path + '');
+      path = toPath(path);
+      return function(object) {
+        return baseGet(object, path, pathKey);
+      };
+    }
+
+    /**
+     * The base implementation of `_.pullAt` without support for individual
+     * index arguments and capturing the removed elements.
+     *
+     * @private
+     * @param {Array} array The array to modify.
+     * @param {number[]} indexes The indexes of elements to remove.
+     * @returns {Array} Returns `array`.
+     */
+    function basePullAt(array, indexes) {
+      var length = array ? indexes.length : 0;
+      while (length--) {
+        var index = indexes[length];
+        if (index != previous && isIndex(index)) {
+          var previous = index;
+          splice.call(array, index, 1);
+        }
+      }
+      return array;
+    }
+
+    /**
+     * The base implementation of `_.random` without support for argument juggling
+     * and returning floating-point numbers.
+     *
+     * @private
+     * @param {number} min The minimum possible value.
+     * @param {number} max The maximum possible value.
+     * @returns {number} Returns the random number.
+     */
+    function baseRandom(min, max) {
+      return min + nativeFloor(nativeRandom() * (max - min + 1));
+    }
+
+    /**
+     * The base implementation of `_.reduce` and `_.reduceRight` without support
+     * for callback shorthands and `this` binding, which iterates over `collection`
+     * using the provided `eachFunc`.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @param {*} accumulator The initial value.
+     * @param {boolean} initFromCollection Specify using the first or last element
+     *  of `collection` as the initial value.
+     * @param {Function} eachFunc The function to iterate over `collection`.
+     * @returns {*} Returns the accumulated value.
+     */
+    function baseReduce(collection, iteratee, accumulator, initFromCollection, eachFunc) {
+      eachFunc(collection, function(value, index, collection) {
+        accumulator = initFromCollection
+          ? (initFromCollection = false, value)
+          : iteratee(accumulator, value, index, collection);
+      });
+      return accumulator;
+    }
+
+    /**
+     * The base implementation of `setData` without support for hot loop detection.
+     *
+     * @private
+     * @param {Function} func The function to associate metadata with.
+     * @param {*} data The metadata.
+     * @returns {Function} Returns `func`.
+     */
+    var baseSetData = !metaMap ? identity : function(func, data) {
+      metaMap.set(func, data);
+      return func;
+    };
+
+    /**
+     * The base implementation of `_.slice` without an iteratee call guard.
+     *
+     * @private
+     * @param {Array} array The array to slice.
+     * @param {number} [start=0] The start position.
+     * @param {number} [end=array.length] The end position.
+     * @returns {Array} Returns the slice of `array`.
+     */
+    function baseSlice(array, start, end) {
+      var index = -1,
+          length = array.length;
+
+      start = start == null ? 0 : (+start || 0);
+      if (start < 0) {
+        start = -start > length ? 0 : (length + start);
+      }
+      end = (end === undefined || end > length) ? length : (+end || 0);
+      if (end < 0) {
+        end += length;
+      }
+      length = start > end ? 0 : ((end - start) >>> 0);
+      start >>>= 0;
+
+      var result = Array(length);
+      while (++index < length) {
+        result[index] = array[index + start];
+      }
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.some` without support for callback shorthands
+     * and `this` binding.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} predicate The function invoked per iteration.
+     * @returns {boolean} Returns `true` if any element passes the predicate check,
+     *  else `false`.
+     */
+    function baseSome(collection, predicate) {
+      var result;
+
+      baseEach(collection, function(value, index, collection) {
+        result = predicate(value, index, collection);
+        return !result;
+      });
+      return !!result;
+    }
+
+    /**
+     * The base implementation of `_.sortBy` which uses `comparer` to define
+     * the sort order of `array` and replaces criteria objects with their
+     * corresponding values.
+     *
+     * @private
+     * @param {Array} array The array to sort.
+     * @param {Function} comparer The function to define sort order.
+     * @returns {Array} Returns `array`.
+     */
+    function baseSortBy(array, comparer) {
+      var length = array.length;
+
+      array.sort(comparer);
+      while (length--) {
+        array[length] = array[length].value;
+      }
+      return array;
+    }
+
+    /**
+     * The base implementation of `_.sortByOrder` without param guards.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function[]|Object[]|string[]} iteratees The iteratees to sort by.
+     * @param {boolean[]} orders The sort orders of `iteratees`.
+     * @returns {Array} Returns the new sorted array.
+     */
+    function baseSortByOrder(collection, iteratees, orders) {
+      var callback = getCallback(),
+          index = -1;
+
+      iteratees = arrayMap(iteratees, function(iteratee) { return callback(iteratee); });
+
+      var result = baseMap(collection, function(value) {
+        var criteria = arrayMap(iteratees, function(iteratee) { return iteratee(value); });
+        return { 'criteria': criteria, 'index': ++index, 'value': value };
+      });
+
+      return baseSortBy(result, function(object, other) {
+        return compareMultiple(object, other, orders);
+      });
+    }
+
+    /**
+     * The base implementation of `_.sum` without support for callback shorthands
+     * and `this` binding.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {number} Returns the sum.
+     */
+    function baseSum(collection, iteratee) {
+      var result = 0;
+      baseEach(collection, function(value, index, collection) {
+        result += +iteratee(value, index, collection) || 0;
+      });
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.uniq` without support for callback shorthands
+     * and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to inspect.
+     * @param {Function} [iteratee] The function invoked per iteration.
+     * @returns {Array} Returns the new duplicate free array.
+     */
+    function baseUniq(array, iteratee) {
+      var index = -1,
+          indexOf = getIndexOf(),
+          length = array.length,
+          isCommon = indexOf === baseIndexOf,
+          isLarge = isCommon && length >= LARGE_ARRAY_SIZE,
+          seen = isLarge ? createCache() : null,
+          result = [];
+
+      if (seen) {
+        indexOf = cacheIndexOf;
+        isCommon = false;
+      } else {
+        isLarge = false;
+        seen = iteratee ? [] : result;
+      }
+      outer:
+      while (++index < length) {
+        var value = array[index],
+            computed = iteratee ? iteratee(value, index, array) : value;
+
+        if (isCommon && value === value) {
+          var seenIndex = seen.length;
+          while (seenIndex--) {
+            if (seen[seenIndex] === computed) {
+              continue outer;
+            }
+          }
+          if (iteratee) {
+            seen.push(computed);
+          }
+          result.push(value);
+        }
+        else if (indexOf(seen, computed, 0) < 0) {
+          if (iteratee || isLarge) {
+            seen.push(computed);
+          }
+          result.push(value);
+        }
+      }
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.values` and `_.valuesIn` which creates an
+     * array of `object` property values corresponding to the property names
+     * of `props`.
+     *
+     * @private
+     * @param {Object} object The object to query.
+     * @param {Array} props The property names to get values for.
+     * @returns {Object} Returns the array of property values.
+     */
+    function baseValues(object, props) {
+      var index = -1,
+          length = props.length,
+          result = Array(length);
+
+      while (++index < length) {
+        result[index] = object[props[index]];
+      }
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.dropRightWhile`, `_.dropWhile`, `_.takeRightWhile`,
+     * and `_.takeWhile` without support for callback shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to query.
+     * @param {Function} predicate The function invoked per iteration.
+     * @param {boolean} [isDrop] Specify dropping elements instead of taking them.
+     * @param {boolean} [fromRight] Specify iterating from right to left.
+     * @returns {Array} Returns the slice of `array`.
+     */
+    function baseWhile(array, predicate, isDrop, fromRight) {
+      var length = array.length,
+          index = fromRight ? length : -1;
+
+      while ((fromRight ? index-- : ++index < length) && predicate(array[index], index, array)) {}
+      return isDrop
+        ? baseSlice(array, (fromRight ? 0 : index), (fromRight ? index + 1 : length))
+        : baseSlice(array, (fromRight ? index + 1 : 0), (fromRight ? length : index));
+    }
+
+    /**
+     * The base implementation of `wrapperValue` which returns the result of
+     * performing a sequence of actions on the unwrapped `value`, where each
+     * successive action is supplied the return value of the previous.
+     *
+     * @private
+     * @param {*} value The unwrapped value.
+     * @param {Array} actions Actions to peform to resolve the unwrapped value.
+     * @returns {*} Returns the resolved value.
+     */
+    function baseWrapperValue(value, actions) {
+      var result = value;
+      if (result instanceof LazyWrapper) {
+        result = result.value();
+      }
+      var index = -1,
+          length = actions.length;
+
+      while (++index < length) {
+        var action = actions[index];
+        result = action.func.apply(action.thisArg, arrayPush([result], action.args));
+      }
+      return result;
+    }
+
+    /**
+     * Performs a binary search of `array` to determine the index at which `value`
+     * should be inserted into `array` in order to maintain its sort order.
+     *
+     * @private
+     * @param {Array} array The sorted array to inspect.
+     * @param {*} value The value to evaluate.
+     * @param {boolean} [retHighest] Specify returning the highest qualified index.
+     * @returns {number} Returns the index at which `value` should be inserted
+     *  into `array`.
+     */
+    function binaryIndex(array, value, retHighest) {
+      var low = 0,
+          high = array ? array.length : low;
+
+      if (typeof value == 'number' && value === value && high <= HALF_MAX_ARRAY_LENGTH) {
+        while (low < high) {
+          var mid = (low + high) >>> 1,
+              computed = array[mid];
+
+          if ((retHighest ? (computed <= value) : (computed < value)) && computed !== null) {
+            low = mid + 1;
+          } else {
+            high = mid;
+          }
+        }
+        return high;
+      }
+      return binaryIndexBy(array, value, identity, retHighest);
+    }
+
+    /**
+     * This function is like `binaryIndex` except that it invokes `iteratee` for
+     * `value` and each element of `array` to compute their sort ranking. The
+     * iteratee is invoked with one argument; (value).
+     *
+     * @private
+     * @param {Array} array The sorted array to inspect.
+     * @param {*} value The value to evaluate.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @param {boolean} [retHighest] Specify returning the highest qualified index.
+     * @returns {number} Returns the index at which `value` should be inserted
+     *  into `array`.
+     */
+    function binaryIndexBy(array, value, iteratee, retHighest) {
+      value = iteratee(value);
+
+      var low = 0,
+          high = array ? array.length : 0,
+          valIsNaN = value !== value,
+          valIsNull = value === null,
+          valIsUndef = value === undefined;
+
+      while (low < high) {
+        var mid = nativeFloor((low + high) / 2),
+            computed = iteratee(array[mid]),
+            isDef = computed !== undefined,
+            isReflexive = computed === computed;
+
+        if (valIsNaN) {
+          var setLow = isReflexive || retHighest;
+        } else if (valIsNull) {
+          setLow = isReflexive && isDef && (retHighest || computed != null);
+        } else if (valIsUndef) {
+          setLow = isReflexive && (retHighest || isDef);
+        } else if (computed == null) {
+          setLow = false;
+        } else {
+          setLow = retHighest ? (computed <= value) : (computed < value);
+        }
+        if (setLow) {
+          low = mid + 1;
+        } else {
+          high = mid;
+        }
+      }
+      return nativeMin(high, MAX_ARRAY_INDEX);
+    }
+
+    /**
+     * A specialized version of `baseCallback` which only supports `this` binding
+     * and specifying the number of arguments to provide to `func`.
+     *
+     * @private
+     * @param {Function} func The function to bind.
+     * @param {*} thisArg The `this` binding of `func`.
+     * @param {number} [argCount] The number of arguments to provide to `func`.
+     * @returns {Function} Returns the callback.
+     */
+    function bindCallback(func, thisArg, argCount) {
+      if (typeof func != 'function') {
+        return identity;
+      }
+      if (thisArg === undefined) {
+        return func;
+      }
+      switch (argCount) {
+        case 1: return function(value) {
+          return func.call(thisArg, value);
+        };
+        case 3: return function(value, index, collection) {
+          return func.call(thisArg, value, index, collection);
+        };
+        case 4: return function(accumulator, value, index, collection) {
+          return func.call(thisArg, accumulator, value, index, collection);
+        };
+        case 5: return function(value, other, key, object, source) {
+          return func.call(thisArg, value, other, key, object, source);
+        };
+      }
+      return function() {
+        return func.apply(thisArg, arguments);
+      };
+    }
+
+    /**
+     * Creates a clone of the given array buffer.
+     *
+     * @private
+     * @param {ArrayBuffer} buffer The array buffer to clone.
+     * @returns {ArrayBuffer} Returns the cloned array buffer.
+     */
+    function bufferClone(buffer) {
+      var result = new ArrayBuffer(buffer.byteLength),
+          view = new Uint8Array(result);
+
+      view.set(new Uint8Array(buffer));
+      return result;
+    }
+
+    /**
+     * Creates an array that is the composition of partially applied arguments,
+     * placeholders, and provided arguments into a single array of arguments.
+     *
+     * @private
+     * @param {Array|Object} args The provided arguments.
+     * @param {Array} partials The arguments to prepend to those provided.
+     * @param {Array} holders The `partials` placeholder indexes.
+     * @returns {Array} Returns the new array of composed arguments.
+     */
+    function composeArgs(args, partials, holders) {
+      var holdersLength = holders.length,
+          argsIndex = -1,
+          argsLength = nativeMax(args.length - holdersLength, 0),
+          leftIndex = -1,
+          leftLength = partials.length,
+          result = Array(leftLength + argsLength);
+
+      while (++leftIndex < leftLength) {
+        result[leftIndex] = partials[leftIndex];
+      }
+      while (++argsIndex < holdersLength) {
+        result[holders[argsIndex]] = args[argsIndex];
+      }
+      while (argsLength--) {
+        result[leftIndex++] = args[argsIndex++];
+      }
+      return result;
+    }
+
+    /**
+     * This function is like `composeArgs` except that the arguments composition
+     * is tailored for `_.partialRight`.
+     *
+     * @private
+     * @param {Array|Object} args The provided arguments.
+     * @param {Array} partials The arguments to append to those provided.
+     * @param {Array} holders The `partials` placeholder indexes.
+     * @returns {Array} Returns the new array of composed arguments.
+     */
+    function composeArgsRight(args, partials, holders) {
+      var holdersIndex = -1,
+          holdersLength = holders.length,
+          argsIndex = -1,
+          argsLength = nativeMax(args.length - holdersLength, 0),
+          rightIndex = -1,
+          rightLength = partials.length,
+          result = Array(argsLength + rightLength);
+
+      while (++argsIndex < argsLength) {
+        result[argsIndex] = args[argsIndex];
+      }
+      var offset = argsIndex;
+      while (++rightIndex < rightLength) {
+        result[offset + rightIndex] = partials[rightIndex];
+      }
+      while (++holdersIndex < holdersLength) {
+        result[offset + holders[holdersIndex]] = args[argsIndex++];
+      }
+      return result;
+    }
+
+    /**
+     * Creates a `_.countBy`, `_.groupBy`, `_.indexBy`, or `_.partition` function.
+     *
+     * @private
+     * @param {Function} setter The function to set keys and values of the accumulator object.
+     * @param {Function} [initializer] The function to initialize the accumulator object.
+     * @returns {Function} Returns the new aggregator function.
+     */
+    function createAggregator(setter, initializer) {
+      return function(collection, iteratee, thisArg) {
+        var result = initializer ? initializer() : {};
+        iteratee = getCallback(iteratee, thisArg, 3);
+
+        if (isArray(collection)) {
+          var index = -1,
+              length = collection.length;
+
+          while (++index < length) {
+            var value = collection[index];
+            setter(result, value, iteratee(value, index, collection), collection);
+          }
+        } else {
+          baseEach(collection, function(value, key, collection) {
+            setter(result, value, iteratee(value, key, collection), collection);
+          });
+        }
+        return result;
+      };
+    }
+
+    /**
+     * Creates a `_.assign`, `_.defaults`, or `_.merge` function.
+     *
+     * @private
+     * @param {Function} assigner The function to assign values.
+     * @returns {Function} Returns the new assigner function.
+     */
+    function createAssigner(assigner) {
+      return restParam(function(object, sources) {
+        var index = -1,
+            length = object == null ? 0 : sources.length,
+            customizer = length > 2 ? sources[length - 2] : undefined,
+            guard = length > 2 ? sources[2] : undefined,
+            thisArg = length > 1 ? sources[length - 1] : undefined;
+
+        if (typeof customizer == 'function') {
+          customizer = bindCallback(customizer, thisArg, 5);
+          length -= 2;
+        } else {
+          customizer = typeof thisArg == 'function' ? thisArg : undefined;
+          length -= (customizer ? 1 : 0);
+        }
+        if (guard && isIterateeCall(sources[0], sources[1], guard)) {
+          customizer = length < 3 ? undefined : customizer;
+          length = 1;
+        }
+        while (++index < length) {
+          var source = sources[index];
+          if (source) {
+            assigner(object, source, customizer);
+          }
+        }
+        return object;
+      });
+    }
+
+    /**
+     * Creates a `baseEach` or `baseEachRight` function.
+     *
+     * @private
+     * @param {Function} eachFunc The function to iterate over a collection.
+     * @param {boolean} [fromRight] Specify iterating from right to left.
+     * @returns {Function} Returns the new base function.
+     */
+    function createBaseEach(eachFunc, fromRight) {
+      return function(collection, iteratee) {
+        var length = collection ? getLength(collection) : 0;
+        if (!isLength(length)) {
+          return eachFunc(collection, iteratee);
+        }
+        var index = fromRight ? length : -1,
+            iterable = toObject(collection);
+
+        while ((fromRight ? index-- : ++index < length)) {
+          if (iteratee(iterable[index], index, iterable) === false) {
+            break;
+          }
+        }
+        return collection;
+      };
+    }
+
+    /**
+     * Creates a base function for `_.forIn` or `_.forInRight`.
+     *
+     * @private
+     * @param {boolean} [fromRight] Specify iterating from right to left.
+     * @returns {Function} Returns the new base function.
+     */
+    function createBaseFor(fromRight) {
+      return function(object, iteratee, keysFunc) {
+        var iterable = toObject(object),
+            props = keysFunc(object),
+            length = props.length,
+            index = fromRight ? length : -1;
+
+        while ((fromRight ? index-- : ++index < length)) {
+          var key = props[index];
+          if (iteratee(iterable[key], key, iterable) === false) {
+            break;
+          }
+        }
+        return object;
+      };
+    }
+
+    /**
+     * Creates a function that wraps `func` and invokes it with the `this`
+     * binding of `thisArg`.
+     *
+     * @private
+     * @param {Function} func The function to bind.
+     * @param {*} [thisArg] The `this` binding of `func`.
+     * @returns {Function} Returns the new bound function.
+     */
+    function createBindWrapper(func, thisArg) {
+      var Ctor = createCtorWrapper(func);
+
+      function wrapper() {
+        var fn = (this && this !== root && this instanceof wrapper) ? Ctor : func;
+        return fn.apply(thisArg, arguments);
+      }
+      return wrapper;
+    }
+
+    /**
+     * Creates a `Set` cache object to optimize linear searches of large arrays.
+     *
+     * @private
+     * @param {Array} [values] The values to cache.
+     * @returns {null|Object} Returns the new cache object if `Set` is supported, else `null`.
+     */
+    function createCache(values) {
+      return (nativeCreate && Set) ? new SetCache(values) : null;
+    }
+
+    /**
+     * Creates a function that produces compound words out of the words in a
+     * given string.
+     *
+     * @private
+     * @param {Function} callback The function to combine each word.
+     * @returns {Function} Returns the new compounder function.
+     */
+    function createCompounder(callback) {
+      return function(string) {
+        var index = -1,
+            array = words(deburr(string)),
+            length = array.length,
+            result = '';
+
+        while (++index < length) {
+          result = callback(result, array[index], index);
+        }
+        return result;
+      };
+    }
+
+    /**
+     * Creates a function that produces an instance of `Ctor` regardless of
+     * whether it was invoked as part of a `new` expression or by `call` or `apply`.
+     *
+     * @private
+     * @param {Function} Ctor The constructor to wrap.
+     * @returns {Function} Returns the new wrapped function.
+     */
+    function createCtorWrapper(Ctor) {
+      return function() {
+        // Use a `switch` statement to work with class constructors.
+        // See http://ecma-international.org/ecma-262/6.0/#sec-ecmascript-function-objects-call-thisargument-argumentslist
+        // for more details.
+        var args = arguments;
+        switch (args.length) {
+          case 0: return new Ctor;
+          case 1: return new Ctor(args[0]);
+          case 2: return new Ctor(args[0], args[1]);
+          case 3: return new Ctor(args[0], args[1], args[2]);
+          case 4: return new Ctor(args[0], args[1], args[2], args[3]);
+          case 5: return new Ctor(args[0], args[1], args[2], args[3], args[4]);
+          case 6: return new Ctor(args[0], args[1], args[2], args[3], args[4], args[5]);
+          case 7: return new Ctor(args[0], args[1], args[2], args[3], args[4], args[5], args[6]);
+        }
+        var thisBinding = baseCreate(Ctor.prototype),
+            result = Ctor.apply(thisBinding, args);
+
+        // Mimic the constructor's `return` behavior.
+        // See https://es5.github.io/#x13.2.2 for more details.
+        return isObject(result) ? result : thisBinding;
+      };
+    }
+
+    /**
+     * Creates a `_.curry` or `_.curryRight` function.
+     *
+     * @private
+     * @param {boolean} flag The curry bit flag.
+     * @returns {Function} Returns the new curry function.
+     */
+    function createCurry(flag) {
+      function curryFunc(func, arity, guard) {
+        if (guard && isIterateeCall(func, arity, guard)) {
+          arity = undefined;
+        }
+        var result = createWrapper(func, flag, undefined, undefined, undefined, undefined, undefined, arity);
+        result.placeholder = curryFunc.placeholder;
+        return result;
+      }
+      return curryFunc;
+    }
+
+    /**
+     * Creates a `_.defaults` or `_.defaultsDeep` function.
+     *
+     * @private
+     * @param {Function} assigner The function to assign values.
+     * @param {Function} customizer The function to customize assigned values.
+     * @returns {Function} Returns the new defaults function.
+     */
+    function createDefaults(assigner, customizer) {
+      return restParam(function(args) {
+        var object = args[0];
+        if (object == null) {
+          return object;
+        }
+        args.push(customizer);
+        return assigner.apply(undefined, args);
+      });
+    }
+
+    /**
+     * Creates a `_.max` or `_.min` function.
+     *
+     * @private
+     * @param {Function} comparator The function used to compare values.
+     * @param {*} exValue The initial extremum value.
+     * @returns {Function} Returns the new extremum function.
+     */
+    function createExtremum(comparator, exValue) {
+      return function(collection, iteratee, thisArg) {
+        if (thisArg && isIterateeCall(collection, iteratee, thisArg)) {
+          iteratee = undefined;
+        }
+        iteratee = getCallback(iteratee, thisArg, 3);
+        if (iteratee.length == 1) {
+          collection = isArray(collection) ? collection : toIterable(collection);
+          var result = arrayExtremum(collection, iteratee, comparator, exValue);
+          if (!(collection.length && result === exValue)) {
+            return result;
+          }
+        }
+        return baseExtremum(collection, iteratee, comparator, exValue);
+      };
+    }
+
+    /**
+     * Creates a `_.find` or `_.findLast` function.
+     *
+     * @private
+     * @param {Function} eachFunc The function to iterate over a collection.
+     * @param {boolean} [fromRight] Specify iterating from right to left.
+     * @returns {Function} Returns the new find function.
+     */
+    function createFind(eachFunc, fromRight) {
+      return function(collection, predicate, thisArg) {
+        predicate = getCallback(predicate, thisArg, 3);
+        if (isArray(collection)) {
+          var index = baseFindIndex(collection, predicate, fromRight);
+          return index > -1 ? collection[index] : undefined;
+        }
+        return baseFind(collection, predicate, eachFunc);
+      };
+    }
+
+    /**
+     * Creates a `_.findIndex` or `_.findLastIndex` function.
+     *
+     * @private
+     * @param {boolean} [fromRight] Specify iterating from right to left.
+     * @returns {Function} Returns the new find function.
+     */
+    function createFindIndex(fromRight) {
+      return function(array, predicate, thisArg) {
+        if (!(array && array.length)) {
+          return -1;
+        }
+        predicate = getCallback(predicate, thisArg, 3);
+        return baseFindIndex(array, predicate, fromRight);
+      };
+    }
+
+    /**
+     * Creates a `_.findKey` or `_.findLastKey` function.
+     *
+     * @private
+     * @param {Function} objectFunc The function to iterate over an object.
+     * @returns {Function} Returns the new find function.
+     */
+    function createFindKey(objectFunc) {
+      return function(object, predicate, thisArg) {
+        predicate = getCallback(predicate, thisArg, 3);
+        return baseFind(object, predicate, objectFunc, true);
+      };
+    }
+
+    /**
+     * Creates a `_.flow` or `_.flowRight` function.
+     *
+     * @private
+     * @param {boolean} [fromRight] Specify iterating from right to left.
+     * @returns {Function} Returns the new flow function.
+     */
+    function createFlow(fromRight) {
+      return function() {
+        var wrapper,
+            length = arguments.length,
+            index = fromRight ? length : -1,
+            leftIndex = 0,
+            funcs = Array(length);
+
+        while ((fromRight ? index-- : ++index < length)) {
+          var func = funcs[leftIndex++] = arguments[index];
+          if (typeof func != 'function') {
+            throw new TypeError(FUNC_ERROR_TEXT);
+          }
+          if (!wrapper && LodashWrapper.prototype.thru && getFuncName(func) == 'wrapper') {
+            wrapper = new LodashWrapper([], true);
+          }
+        }
+        index = wrapper ? -1 : length;
+        while (++index < length) {
+          func = funcs[index];
+
+          var funcName = getFuncName(func),
+              data = funcName == 'wrapper' ? getData(func) : undefined;
+
+          if (data && isLaziable(data[0]) && data[1] == (ARY_FLAG | CURRY_FLAG | PARTIAL_FLAG | REARG_FLAG) && !data[4].length && data[9] == 1) {
+            wrapper = wrapper[getFuncName(data[0])].apply(wrapper, data[3]);
+          } else {
+            wrapper = (func.length == 1 && isLaziable(func)) ? wrapper[funcName]() : wrapper.thru(func);
+          }
+        }
+        return function() {
+          var args = arguments,
+              value = args[0];
+
+          if (wrapper && args.length == 1 && isArray(value) && value.length >= LARGE_ARRAY_SIZE) {
+            return wrapper.plant(value).value();
+          }
+          var index = 0,
+              result = length ? funcs[index].apply(this, args) : value;
+
+          while (++index < length) {
+            result = funcs[index].call(this, result);
+          }
+          return result;
+        };
+      };
+    }
+
+    /**
+     * Creates a function for `_.forEach` or `_.forEachRight`.
+     *
+     * @private
+     * @param {Function} arrayFunc The function to iterate over an array.
+     * @param {Function} eachFunc The function to iterate over a collection.
+     * @returns {Function} Returns the new each function.
+     */
+    function createForEach(arrayFunc, eachFunc) {
+      return function(collection, iteratee, thisArg) {
+        return (typeof iteratee == 'function' && thisArg === undefined && isArray(collection))
+          ? arrayFunc(collection, iteratee)
+          : eachFunc(collection, bindCallback(iteratee, thisArg, 3));
+      };
+    }
+
+    /**
+     * Creates a function for `_.forIn` or `_.forInRight`.
+     *
+     * @private
+     * @param {Function} objectFunc The function to iterate over an object.
+     * @returns {Function} Returns the new each function.
+     */
+    function createForIn(objectFunc) {
+      return function(object, iteratee, thisArg) {
+        if (typeof iteratee != 'function' || thisArg !== undefined) {
+          iteratee = bindCallback(iteratee, thisArg, 3);
+        }
+        return objectFunc(object, iteratee, keysIn);
+      };
+    }
+
+    /**
+     * Creates a function for `_.forOwn` or `_.forOwnRight`.
+     *
+     * @private
+     * @param {Function} objectFunc The function to iterate over an object.
+     * @returns {Function} Returns the new each function.
+     */
+    function createForOwn(objectFunc) {
+      return function(object, iteratee, thisArg) {
+        if (typeof iteratee != 'function' || thisArg !== undefined) {
+          iteratee = bindCallback(iteratee, thisArg, 3);
+        }
+        return objectFunc(object, iteratee);
+      };
+    }
+
+    /**
+     * Creates a function for `_.mapKeys` or `_.mapValues`.
+     *
+     * @private
+     * @param {boolean} [isMapKeys] Specify mapping keys instead of values.
+     * @returns {Function} Returns the new map function.
+     */
+    function createObjectMapper(isMapKeys) {
+      return function(object, iteratee, thisArg) {
+        var result = {};
+        iteratee = getCallback(iteratee, thisArg, 3);
+
+        baseForOwn(object, function(value, key, object) {
+          var mapped = iteratee(value, key, object);
+          key = isMapKeys ? mapped : key;
+          value = isMapKeys ? value : mapped;
+          result[key] = value;
+        });
+        return result;
+      };
+    }
+
+    /**
+     * Creates a function for `_.padLeft` or `_.padRight`.
+     *
+     * @private
+     * @param {boolean} [fromRight] Specify padding from the right.
+     * @returns {Function} Returns the new pad function.
+     */
+    function createPadDir(fromRight) {
+      return function(string, length, chars) {
+        string = baseToString(string);
+        return (fromRight ? string : '') + createPadding(string, length, chars) + (fromRight ? '' : string);
+      };
+    }
+
+    /**
+     * Creates a `_.partial` or `_.partialRight` function.
+     *
+     * @private
+     * @param {boolean} flag The partial bit flag.
+     * @returns {Function} Returns the new partial function.
+     */
+    function createPartial(flag) {
+      var partialFunc = restParam(function(func, partials) {
+        var holders = replaceHolders(partials, partialFunc.placeholder);
+        return createWrapper(func, flag, undefined, partials, holders);
+      });
+      return partialFunc;
+    }
+
+    /**
+     * Creates a function for `_.reduce` or `_.reduceRight`.
+     *
+     * @private
+     * @param {Function} arrayFunc The function to iterate over an array.
+     * @param {Function} eachFunc The function to iterate over a collection.
+     * @returns {Function} Returns the new each function.
+     */
+    function createReduce(arrayFunc, eachFunc) {
+      return function(collection, iteratee, accumulator, thisArg) {
+        var initFromArray = arguments.length < 3;
+        return (typeof iteratee == 'function' && thisArg === undefined && isArray(collection))
+          ? arrayFunc(collection, iteratee, accumulator, initFromArray)
+          : baseReduce(collection, getCallback(iteratee, thisArg, 4), accumulator, initFromArray, eachFunc);
+      };
+    }
+
+    /**
+     * Creates a function that wraps `func` and invokes it with optional `this`
+     * binding of, partial application, and currying.
+     *
+     * @private
+     * @param {Function|string} func The function or method name to reference.
+     * @param {number} bitmask The bitmask of flags. See `createWrapper` for more details.
+     * @param {*} [thisArg] The `this` binding of `func`.
+     * @param {Array} [partials] The arguments to prepend to those provided to the new function.
+     * @param {Array} [holders] The `partials` placeholder indexes.
+     * @param {Array} [partialsRight] The arguments to append to those provided to the new function.
+     * @param {Array} [holdersRight] The `partialsRight` placeholder indexes.
+     * @param {Array} [argPos] The argument positions of the new function.
+     * @param {number} [ary] The arity cap of `func`.
+     * @param {number} [arity] The arity of `func`.
+     * @returns {Function} Returns the new wrapped function.
+     */
+    function createHybridWrapper(func, bitmask, thisArg, partials, holders, partialsRight, holdersRight, argPos, ary, arity) {
+      var isAry = bitmask & ARY_FLAG,
+          isBind = bitmask & BIND_FLAG,
+          isBindKey = bitmask & BIND_KEY_FLAG,
+          isCurry = bitmask & CURRY_FLAG,
+          isCurryBound = bitmask & CURRY_BOUND_FLAG,
+          isCurryRight = bitmask & CURRY_RIGHT_FLAG,
+          Ctor = isBindKey ? undefined : createCtorWrapper(func);
+
+      function wrapper() {
+        // Avoid `arguments` object use disqualifying optimizations by
+        // converting it to an array before providing it to other functions.
+        var length = arguments.length,
+            index = length,
+            args = Array(length);
+
+        while (index--) {
+          args[index] = arguments[index];
+        }
+        if (partials) {
+          args = composeArgs(args, partials, holders);
+        }
+        if (partialsRight) {
+          args = composeArgsRight(args, partialsRight, holdersRight);
+        }
+        if (isCurry || isCurryRight) {
+          var placeholder = wrapper.placeholder,
+              argsHolders = replaceHolders(args, placeholder);
+
+          length -= argsHolders.length;
+          if (length < arity) {
+            var newArgPos = argPos ? arrayCopy(argPos) : undefined,
+                newArity = nativeMax(arity - length, 0),
+                newsHolders = isCurry ? argsHolders : undefined,
+                newHoldersRight = isCurry ? undefined : argsHolders,
+                newPartials = isCurry ? args : undefined,
+                newPartialsRight = isCurry ? undefined : args;
+
+            bitmask |= (isCurry ? PARTIAL_FLAG : PARTIAL_RIGHT_FLAG);
+            bitmask &= ~(isCurry ? PARTIAL_RIGHT_FLAG : PARTIAL_FLAG);
+
+            if (!isCurryBound) {
+              bitmask &= ~(BIND_FLAG | BIND_KEY_FLAG);
+            }
+            var newData = [func, bitmask, thisArg, newPartials, newsHolders, newPartialsRight, newHoldersRight, newArgPos, ary, newArity],
+                result = createHybridWrapper.apply(undefined, newData);
+
+            if (isLaziable(func)) {
+              setData(result, newData);
+            }
+            result.placeholder = placeholder;
+            return result;
+          }
+        }
+        var thisBinding = isBind ? thisArg : this,
+            fn = isBindKey ? thisBinding[func] : func;
+
+        if (argPos) {
+          args = reorder(args, argPos);
+        }
+        if (isAry && ary < args.length) {
+          args.length = ary;
+        }
+        if (this && this !== root && this instanceof wrapper) {
+          fn = Ctor || createCtorWrapper(func);
+        }
+        return fn.apply(thisBinding, args);
+      }
+      return wrapper;
+    }
+
+    /**
+     * Creates the padding required for `string` based on the given `length`.
+     * The `chars` string is truncated if the number of characters exceeds `length`.
+     *
+     * @private
+     * @param {string} string The string to create padding for.
+     * @param {number} [length=0] The padding length.
+     * @param {string} [chars=' '] The string used as padding.
+     * @returns {string} Returns the pad for `string`.
+     */
+    function createPadding(string, length, chars) {
+      var strLength = string.length;
+      length = +length;
+
+      if (strLength >= length || !nativeIsFinite(length)) {
+        return '';
+      }
+      var padLength = length - strLength;
+      chars = chars == null ? ' ' : (chars + '');
+      return repeat(chars, nativeCeil(padLength / chars.length)).slice(0, padLength);
+    }
+
+    /**
+     * Creates a function that wraps `func` and invokes it with the optional `this`
+     * binding of `thisArg` and the `partials` prepended to those provided to
+     * the wrapper.
+     *
+     * @private
+     * @param {Function} func The function to partially apply arguments to.
+     * @param {number} bitmask The bitmask of flags. See `createWrapper` for more details.
+     * @param {*} thisArg The `this` binding of `func`.
+     * @param {Array} partials The arguments to prepend to those provided to the new function.
+     * @returns {Function} Returns the new bound function.
+     */
+    function createPartialWrapper(func, bitmask, thisArg, partials) {
+      var isBind = bitmask & BIND_FLAG,
+          Ctor = createCtorWrapper(func);
+
+      function wrapper() {
+        // Avoid `arguments` object use disqualifying optimizations by
+        // converting it to an array before providing it `func`.
+        var argsIndex = -1,
+            argsLength = arguments.length,
+            leftIndex = -1,
+            leftLength = partials.length,
+            args = Array(leftLength + argsLength);
+
+        while (++leftIndex < leftLength) {
+          args[leftIndex] = partials[leftIndex];
+        }
+        while (argsLength--) {
+          args[leftIndex++] = arguments[++argsIndex];
+        }
+        var fn = (this && this !== root && this instanceof wrapper) ? Ctor : func;
+        return fn.apply(isBind ? thisArg : this, args);
+      }
+      return wrapper;
+    }
+
+    /**
+     * Creates a `_.ceil`, `_.floor`, or `_.round` function.
+     *
+     * @private
+     * @param {string} methodName The name of the `Math` method to use when rounding.
+     * @returns {Function} Returns the new round function.
+     */
+    function createRound(methodName) {
+      var func = Math[methodName];
+      return function(number, precision) {
+        precision = precision === undefined ? 0 : (+precision || 0);
+        if (precision) {
+          precision = pow(10, precision);
+          return func(number * precision) / precision;
+        }
+        return func(number);
+      };
+    }
+
+    /**
+     * Creates a `_.sortedIndex` or `_.sortedLastIndex` function.
+     *
+     * @private
+     * @param {boolean} [retHighest] Specify returning the highest qualified index.
+     * @returns {Function} Returns the new index function.
+     */
+    function createSortedIndex(retHighest) {
+      return function(array, value, iteratee, thisArg) {
+        var callback = getCallback(iteratee);
+        return (iteratee == null && callback === baseCallback)
+          ? binaryIndex(array, value, retHighest)
+          : binaryIndexBy(array, value, callback(iteratee, thisArg, 1), retHighest);
+      };
+    }
+
+    /**
+     * Creates a function that either curries or invokes `func` with optional
+     * `this` binding and partially applied arguments.
+     *
+     * @private
+     * @param {Function|string} func The function or method name to reference.
+     * @param {number} bitmask The bitmask of flags.
+     *  The bitmask may be composed of the following flags:
+     *     1 - `_.bind`
+     *     2 - `_.bindKey`
+     *     4 - `_.curry` or `_.curryRight` of a bound function
+     *     8 - `_.curry`
+     *    16 - `_.curryRight`
+     *    32 - `_.partial`
+     *    64 - `_.partialRight`
+     *   128 - `_.rearg`
+     *   256 - `_.ary`
+     * @param {*} [thisArg] The `this` binding of `func`.
+     * @param {Array} [partials] The arguments to be partially applied.
+     * @param {Array} [holders] The `partials` placeholder indexes.
+     * @param {Array} [argPos] The argument positions of the new function.
+     * @param {number} [ary] The arity cap of `func`.
+     * @param {number} [arity] The arity of `func`.
+     * @returns {Function} Returns the new wrapped function.
+     */
+    function createWrapper(func, bitmask, thisArg, partials, holders, argPos, ary, arity) {
+      var isBindKey = bitmask & BIND_KEY_FLAG;
+      if (!isBindKey && typeof func != 'function') {
+        throw new TypeError(FUNC_ERROR_TEXT);
+      }
+      var length = partials ? partials.length : 0;
+      if (!length) {
+        bitmask &= ~(PARTIAL_FLAG | PARTIAL_RIGHT_FLAG);
+        partials = holders = undefined;
+      }
+      length -= (holders ? holders.length : 0);
+      if (bitmask & PARTIAL_RIGHT_FLAG) {
+        var partialsRight = partials,
+            holdersRight = holders;
+
+        partials = holders = undefined;
+      }
+      var data = isBindKey ? undefined : getData(func),
+          newData = [func, bitmask, thisArg, partials, holders, partialsRight, holdersRight, argPos, ary, arity];
+
+      if (data) {
+        mergeData(newData, data);
+        bitmask = newData[1];
+        arity = newData[9];
+      }
+      newData[9] = arity == null
+        ? (isBindKey ? 0 : func.length)
+        : (nativeMax(arity - length, 0) || 0);
+
+      if (bitmask == BIND_FLAG) {
+        var result = createBindWrapper(newData[0], newData[2]);
+      } else if ((bitmask == PARTIAL_FLAG || bitmask == (BIND_FLAG | PARTIAL_FLAG)) && !newData[4].length) {
+        result = createPartialWrapper.apply(undefined, newData);
+      } else {
+        result = createHybridWrapper.apply(undefined, newData);
+      }
+      var setter = data ? baseSetData : setData;
+      return setter(result, newData);
+    }
+
+    /**
+     * A specialized version of `baseIsEqualDeep` for arrays with support for
+     * partial deep comparisons.
+     *
+     * @private
+     * @param {Array} array The array to compare.
+     * @param {Array} other The other array to compare.
+     * @param {Function} equalFunc The function to determine equivalents of values.
+     * @param {Function} [customizer] The function to customize comparing arrays.
+     * @param {boolean} [isLoose] Specify performing partial comparisons.
+     * @param {Array} [stackA] Tracks traversed `value` objects.
+     * @param {Array} [stackB] Tracks traversed `other` objects.
+     * @returns {boolean} Returns `true` if the arrays are equivalent, else `false`.
+     */
+    function equalArrays(array, other, equalFunc, customizer, isLoose, stackA, stackB) {
+      var index = -1,
+          arrLength = array.length,
+          othLength = other.length;
+
+      if (arrLength != othLength && !(isLoose && othLength > arrLength)) {
+        return false;
+      }
+      // Ignore non-index properties.
+      while (++index < arrLength) {
+        var arrValue = array[index],
+            othValue = other[index],
+            result = customizer ? customizer(isLoose ? othValue : arrValue, isLoose ? arrValue : othValue, index) : undefined;
+
+        if (result !== undefined) {
+          if (result) {
+            continue;
+          }
+          return false;
+        }
+        // Recursively compare arrays (susceptible to call stack limits).
+        if (isLoose) {
+          if (!arraySome(other, function(othValue) {
+                return arrValue === othValue || equalFunc(arrValue, othValue, customizer, isLoose, stackA, stackB);
+              })) {
+            return false;
+          }
+        } else if (!(arrValue === othValue || equalFunc(arrValue, othValue, customizer, isLoose, stackA, stackB))) {
+          return false;
+        }
+      }
+      return true;
+    }
+
+    /**
+     * A specialized version of `baseIsEqualDeep` for comparing objects of
+     * the same `toStringTag`.
+     *
+     * **Note:** This function only supports comparing values with tags of
+     * `Boolean`, `Date`, `Error`, `Number`, `RegExp`, or `String`.
+     *
+     * @private
+     * @param {Object} object The object to compare.
+     * @param {Object} other The other object to compare.
+     * @param {string} tag The `toStringTag` of the objects to compare.
+     * @returns {boolean} Returns `true` if the objects are equivalent, else `false`.
+     */
+    function equalByTag(object, other, tag) {
+      switch (tag) {
+        case boolTag:
+        case dateTag:
+          // Coerce dates and booleans to numbers, dates to milliseconds and booleans
+          // to `1` or `0` treating invalid dates coerced to `NaN` as not equal.
+          return +object == +other;
+
+        case errorTag:
+          return object.name == other.name && object.message == other.message;
+
+        case numberTag:
+          // Treat `NaN` vs. `NaN` as equal.
+          return (object != +object)
+            ? other != +other
+            : object == +other;
+
+        case regexpTag:
+        case stringTag:
+          // Coerce regexes to strings and treat strings primitives and string
+          // objects as equal. See https://es5.github.io/#x15.10.6.4 for more details.
+          return object == (other + '');
+      }
+      return false;
+    }
+
+    /**
+     * A specialized version of `baseIsEqualDeep` for objects with support for
+     * partial deep comparisons.
+     *
+     * @private
+     * @param {Object} object The object to compare.
+     * @param {Object} other The other object to compare.
+     * @param {Function} equalFunc The function to determine equivalents of values.
+     * @param {Function} [customizer] The function to customize comparing values.
+     * @param {boolean} [isLoose] Specify performing partial comparisons.
+     * @param {Array} [stackA] Tracks traversed `value` objects.
+     * @param {Array} [stackB] Tracks traversed `other` objects.
+     * @returns {boolean} Returns `true` if the objects are equivalent, else `false`.
+     */
+    function equalObjects(object, other, equalFunc, customizer, isLoose, stackA, stackB) {
+      var objProps = keys(object),
+          objLength = objProps.length,
+          othProps = keys(other),
+          othLength = othProps.length;
+
+      if (objLength != othLength && !isLoose) {
+        return false;
+      }
+      var index = objLength;
+      while (index--) {
+        var key = objProps[index];
+        if (!(isLoose ? key in other : hasOwnProperty.call(other, key))) {
+          return false;
+        }
+      }
+      var skipCtor = isLoose;
+      while (++index < objLength) {
+        key = objProps[index];
+        var objValue = object[key],
+            othValue = other[key],
+            result = customizer ? customizer(isLoose ? othValue : objValue, isLoose? objValue : othValue, key) : undefined;
+
+        // Recursively compare objects (susceptible to call stack limits).
+        if (!(result === undefined ? equalFunc(objValue, othValue, customizer, isLoose, stackA, stackB) : result)) {
+          return false;
+        }
+        skipCtor || (skipCtor = key == 'constructor');
+      }
+      if (!skipCtor) {
+        var objCtor = object.constructor,
+            othCtor = other.constructor;
+
+        // Non `Object` object instances with different constructors are not equal.
+        if (objCtor != othCtor &&
+            ('constructor' in object && 'constructor' in other) &&
+            !(typeof objCtor == 'function' && objCtor instanceof objCtor &&
+              typeof othCtor == 'function' && othCtor instanceof othCtor)) {
+          return false;
+        }
+      }
+      return true;
+    }
+
+    /**
+     * Gets the appropriate "callback" function. If the `_.callback` method is
+     * customized this function returns the custom method, otherwise it returns
+     * the `baseCallback` function. If arguments are provided the chosen function
+     * is invoked with them and its result is returned.
+     *
+     * @private
+     * @returns {Function} Returns the chosen function or its result.
+     */
+    function getCallback(func, thisArg, argCount) {
+      var result = lodash.callback || callback;
+      result = result === callback ? baseCallback : result;
+      return argCount ? result(func, thisArg, argCount) : result;
+    }
+
+    /**
+     * Gets metadata for `func`.
+     *
+     * @private
+     * @param {Function} func The function to query.
+     * @returns {*} Returns the metadata for `func`.
+     */
+    var getData = !metaMap ? noop : function(func) {
+      return metaMap.get(func);
+    };
+
+    /**
+     * Gets the name of `func`.
+     *
+     * @private
+     * @param {Function} func The function to query.
+     * @returns {string} Returns the function name.
+     */
+    function getFuncName(func) {
+      var result = (func.name + ''),
+          array = realNames[result],
+          length = array ? array.length : 0;
+
+      while (length--) {
+        var data = array[length],
+            otherFunc = data.func;
+        if (otherFunc == null || otherFunc == func) {
+          return data.name;
+        }
+      }
+      return result;
+    }
+
+    /**
+     * Gets the appropriate "indexOf" function. If the `_.indexOf` method is
+     * customized this function returns the custom method, otherwise it returns
+     * the `baseIndexOf` function. If arguments are provided the chosen function
+     * is invoked with them and its result is returned.
+     *
+     * @private
+     * @returns {Function|number} Returns the chosen function or its result.
+     */
+    function getIndexOf(collection, target, fromIndex) {
+      var result = lodash.indexOf || indexOf;
+      result = result === indexOf ? baseIndexOf : result;
+      return collection ? result(collection, target, fromIndex) : result;
+    }
+
+    /**
+     * Gets the "length" property value of `object`.
+     *
+     * **Note:** This function is used to avoid a [JIT bug](https://bugs.webkit.org/show_bug.cgi?id=142792)
+     * that affects Safari on at least iOS 8.1-8.3 ARM64.
+     *
+     * @private
+     * @param {Object} object The object to query.
+     * @returns {*} Returns the "length" value.
+     */
+    var getLength = baseProperty('length');
+
+    /**
+     * Gets the propery names, values, and compare flags of `object`.
+     *
+     * @private
+     * @param {Object} object The object to query.
+     * @returns {Array} Returns the match data of `object`.
+     */
+    function getMatchData(object) {
+      var result = pairs(object),
+          length = result.length;
+
+      while (length--) {
+        result[length][2] = isStrictComparable(result[length][1]);
+      }
+      return result;
+    }
+
+    /**
+     * Gets the native function at `key` of `object`.
+     *
+     * @private
+     * @param {Object} object The object to query.
+     * @param {string} key The key of the method to get.
+     * @returns {*} Returns the function if it's native, else `undefined`.
+     */
+    function getNative(object, key) {
+      var value = object == null ? undefined : object[key];
+      return isNative(value) ? value : undefined;
+    }
+
+    /**
+     * Gets the view, applying any `transforms` to the `start` and `end` positions.
+     *
+     * @private
+     * @param {number} start The start of the view.
+     * @param {number} end The end of the view.
+     * @param {Array} transforms The transformations to apply to the view.
+     * @returns {Object} Returns an object containing the `start` and `end`
+     *  positions of the view.
+     */
+    function getView(start, end, transforms) {
+      var index = -1,
+          length = transforms.length;
+
+      while (++index < length) {
+        var data = transforms[index],
+            size = data.size;
+
+        switch (data.type) {
+          case 'drop':      start += size; break;
+          case 'dropRight': end -= size; break;
+          case 'take':      end = nativeMin(end, start + size); break;
+          case 'takeRight': start = nativeMax(start, end - size); break;
+        }
+      }
+      return { 'start': start, 'end': end };
+    }
+
+    /**
+     * Initializes an array clone.
+     *
+     * @private
+     * @param {Array} array The array to clone.
+     * @returns {Array} Returns the initialized clone.
+     */
+    function initCloneArray(array) {
+      var length = array.length,
+          result = new array.constructor(length);
+
+      // Add array properties assigned by `RegExp#exec`.
+      if (length && typeof array[0] == 'string' && hasOwnProperty.call(array, 'index')) {
+        result.index = array.index;
+        result.input = array.input;
+      }
+      return result;
+    }
+
+    /**
+     * Initializes an object clone.
+     *
+     * @private
+     * @param {Object} object The object to clone.
+     * @returns {Object} Returns the initialized clone.
+     */
+    function initCloneObject(object) {
+      var Ctor = object.constructor;
+      if (!(typeof Ctor == 'function' && Ctor instanceof Ctor)) {
+        Ctor = Object;
+      }
+      return new Ctor;
+    }
+
+    /**
+     * Initializes an object clone based on its `toStringTag`.
+     *
+     * **Note:** This function only supports cloning values with tags of
+     * `Boolean`, `Date`, `Error`, `Number`, `RegExp`, or `String`.
+     *
+     * @private
+     * @param {Object} object The object to clone.
+     * @param {string} tag The `toStringTag` of the object to clone.
+     * @param {boolean} [isDeep] Specify a deep clone.
+     * @returns {Object} Returns the initialized clone.
+     */
+    function initCloneByTag(object, tag, isDeep) {
+      var Ctor = object.constructor;
+      switch (tag) {
+        case arrayBufferTag:
+          return bufferClone(object);
+
+        case boolTag:
+        case dateTag:
+          return new Ctor(+object);
+
+        case float32Tag: case float64Tag:
+        case int8Tag: case int16Tag: case int32Tag:
+        case uint8Tag: case uint8ClampedTag: case uint16Tag: case uint32Tag:
+          // Safari 5 mobile incorrectly has `Object` as the constructor of typed arrays.
+          if (Ctor instanceof Ctor) {
+            Ctor = ctorByTag[tag];
+          }
+          var buffer = object.buffer;
+          return new Ctor(isDeep ? bufferClone(buffer) : buffer, object.byteOffset, object.length);
+
+        case numberTag:
+        case stringTag:
+          return new Ctor(object);
+
+        case regexpTag:
+          var result = new Ctor(object.source, reFlags.exec(object));
+          result.lastIndex = object.lastIndex;
+      }
+      return result;
+    }
+
+    /**
+     * Invokes the method at `path` on `object`.
+     *
+     * @private
+     * @param {Object} object The object to query.
+     * @param {Array|string} path The path of the method to invoke.
+     * @param {Array} args The arguments to invoke the method with.
+     * @returns {*} Returns the result of the invoked method.
+     */
+    function invokePath(object, path, args) {
+      if (object != null && !isKey(path, object)) {
+        path = toPath(path);
+        object = path.length == 1 ? object : baseGet(object, baseSlice(path, 0, -1));
+        path = last(path);
+      }
+      var func = object == null ? object : object[path];
+      return func == null ? undefined : func.apply(object, args);
+    }
+
+    /**
+     * Checks if `value` is array-like.
+     *
+     * @private
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is array-like, else `false`.
+     */
+    function isArrayLike(value) {
+      return value != null && isLength(getLength(value));
+    }
+
+    /**
+     * Checks if `value` is a valid array-like index.
+     *
+     * @private
+     * @param {*} value The value to check.
+     * @param {number} [length=MAX_SAFE_INTEGER] The upper bounds of a valid index.
+     * @returns {boolean} Returns `true` if `value` is a valid index, else `false`.
+     */
+    function isIndex(value, length) {
+      value = (typeof value == 'number' || reIsUint.test(value)) ? +value : -1;
+      length = length == null ? MAX_SAFE_INTEGER : length;
+      return value > -1 && value % 1 == 0 && value < length;
+    }
+
+    /**
+     * Checks if the provided arguments are from an iteratee call.
+     *
+     * @private
+     * @param {*} value The potential iteratee value argument.
+     * @param {*} index The potential iteratee index or key argument.
+     * @param {*} object The potential iteratee object argument.
+     * @returns {boolean} Returns `true` if the arguments are from an iteratee call, else `false`.
+     */
+    function isIterateeCall(value, index, object) {
+      if (!isObject(object)) {
+        return false;
+      }
+      var type = typeof index;
+      if (type == 'number'
+          ? (isArrayLike(object) && isIndex(index, object.length))
+          : (type == 'string' && index in object)) {
+        var other = object[index];
+        return value === value ? (value === other) : (other !== other);
+      }
+      return false;
+    }
+
+    /**
+     * Checks if `value` is a property name and not a property path.
+     *
+     * @private
+     * @param {*} value The value to check.
+     * @param {Object} [object] The object to query keys on.
+     * @returns {boolean} Returns `true` if `value` is a property name, else `false`.
+     */
+    function isKey(value, object) {
+      var type = typeof value;
+      if ((type == 'string' && reIsPlainProp.test(value)) || type == 'number') {
+        return true;
+      }
+      if (isArray(value)) {
+        return false;
+      }
+      var result = !reIsDeepProp.test(value);
+      return result || (object != null && value in toObject(object));
+    }
+
+    /**
+     * Checks if `func` has a lazy counterpart.
+     *
+     * @private
+     * @param {Function} func The function to check.
+     * @returns {boolean} Returns `true` if `func` has a lazy counterpart, else `false`.
+     */
+    function isLaziable(func) {
+      var funcName = getFuncName(func),
+          other = lodash[funcName];
+
+      if (typeof other != 'function' || !(funcName in LazyWrapper.prototype)) {
+        return false;
+      }
+      if (func === other) {
+        return true;
+      }
+      var data = getData(other);
+      return !!data && func === data[0];
+    }
+
+    /**
+     * Checks if `value` is a valid array-like length.
+     *
+     * **Note:** This function is based on [`ToLength`](http://ecma-international.org/ecma-262/6.0/#sec-tolength).
+     *
+     * @private
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is a valid length, else `false`.
+     */
+    function isLength(value) {
+      return typeof value == 'number' && value > -1 && value % 1 == 0 && value <= MAX_SAFE_INTEGER;
+    }
+
+    /**
+     * Checks if `value` is suitable for strict equality comparisons, i.e. `===`.
+     *
+     * @private
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` if suitable for strict
+     *  equality comparisons, else `false`.
+     */
+    function isStrictComparable(value) {
+      return value === value && !isObject(value);
+    }
+
+    /**
+     * Merges the function metadata of `source` into `data`.
+     *
+     * Merging metadata reduces the number of wrappers required to invoke a function.
+     * This is possible because methods like `_.bind`, `_.curry`, and `_.partial`
+     * may be applied regardless of execution order. Methods like `_.ary` and `_.rearg`
+     * augment function arguments, making the order in which they are executed important,
+     * preventing the merging of metadata. However, we make an exception for a safe
+     * common case where curried functions have `_.ary` and or `_.rearg` applied.
+     *
+     * @private
+     * @param {Array} data The destination metadata.
+     * @param {Array} source The source metadata.
+     * @returns {Array} Returns `data`.
+     */
+    function mergeData(data, source) {
+      var bitmask = data[1],
+          srcBitmask = source[1],
+          newBitmask = bitmask | srcBitmask,
+          isCommon = newBitmask < ARY_FLAG;
+
+      var isCombo =
+        (srcBitmask == ARY_FLAG && bitmask == CURRY_FLAG) ||
+        (srcBitmask == ARY_FLAG && bitmask == REARG_FLAG && data[7].length <= source[8]) ||
+        (srcBitmask == (ARY_FLAG | REARG_FLAG) && bitmask == CURRY_FLAG);
+
+      // Exit early if metadata can't be merged.
+      if (!(isCommon || isCombo)) {
+        return data;
+      }
+      // Use source `thisArg` if available.
+      if (srcBitmask & BIND_FLAG) {
+        data[2] = source[2];
+        // Set when currying a bound function.
+        newBitmask |= (bitmask & BIND_FLAG) ? 0 : CURRY_BOUND_FLAG;
+      }
+      // Compose partial arguments.
+      var value = source[3];
+      if (value) {
+        var partials = data[3];
+        data[3] = partials ? composeArgs(partials, value, source[4]) : arrayCopy(value);
+        data[4] = partials ? replaceHolders(data[3], PLACEHOLDER) : arrayCopy(source[4]);
+      }
+      // Compose partial right arguments.
+      value = source[5];
+      if (value) {
+        partials = data[5];
+        data[5] = partials ? composeArgsRight(partials, value, source[6]) : arrayCopy(value);
+        data[6] = partials ? replaceHolders(data[5], PLACEHOLDER) : arrayCopy(source[6]);
+      }
+      // Use source `argPos` if available.
+      value = source[7];
+      if (value) {
+        data[7] = arrayCopy(value);
+      }
+      // Use source `ary` if it's smaller.
+      if (srcBitmask & ARY_FLAG) {
+        data[8] = data[8] == null ? source[8] : nativeMin(data[8], source[8]);
+      }
+      // Use source `arity` if one is not provided.
+      if (data[9] == null) {
+        data[9] = source[9];
+      }
+      // Use source `func` and merge bitmasks.
+      data[0] = source[0];
+      data[1] = newBitmask;
+
+      return data;
+    }
+
+    /**
+     * Used by `_.defaultsDeep` to customize its `_.merge` use.
+     *
+     * @private
+     * @param {*} objectValue The destination object property value.
+     * @param {*} sourceValue The source object property value.
+     * @returns {*} Returns the value to assign to the destination object.
+     */
+    function mergeDefaults(objectValue, sourceValue) {
+      return objectValue === undefined ? sourceValue : merge(objectValue, sourceValue, mergeDefaults);
+    }
+
+    /**
+     * A specialized version of `_.pick` which picks `object` properties specified
+     * by `props`.
+     *
+     * @private
+     * @param {Object} object The source object.
+     * @param {string[]} props The property names to pick.
+     * @returns {Object} Returns the new object.
+     */
+    function pickByArray(object, props) {
+      object = toObject(object);
+
+      var index = -1,
+          length = props.length,
+          result = {};
+
+      while (++index < length) {
+        var key = props[index];
+        if (key in object) {
+          result[key] = object[key];
+        }
+      }
+      return result;
+    }
+
+    /**
+     * A specialized version of `_.pick` which picks `object` properties `predicate`
+     * returns truthy for.
+     *
+     * @private
+     * @param {Object} object The source object.
+     * @param {Function} predicate The function invoked per iteration.
+     * @returns {Object} Returns the new object.
+     */
+    function pickByCallback(object, predicate) {
+      var result = {};
+      baseForIn(object, function(value, key, object) {
+        if (predicate(value, key, object)) {
+          result[key] = value;
+        }
+      });
+      return result;
+    }
+
+    /**
+     * Reorder `array` according to the specified indexes where the element at
+     * the first index is assigned as the first element, the element at
+     * the second index is assigned as the second element, and so on.
+     *
+     * @private
+     * @param {Array} array The array to reorder.
+     * @param {Array} indexes The arranged array indexes.
+     * @returns {Array} Returns `array`.
+     */
+    function reorder(array, indexes) {
+      var arrLength = array.length,
+          length = nativeMin(indexes.length, arrLength),
+          oldArray = arrayCopy(array);
+
+      while (length--) {
+        var index = indexes[length];
+        array[length] = isIndex(index, arrLength) ? oldArray[index] : undefined;
+      }
+      return array;
+    }
+
+    /**
+     * Sets metadata for `func`.
+     *
+     * **Note:** If this function becomes hot, i.e. is invoked a lot in a short
+     * period of time, it will trip its breaker and transition to an identity function
+     * to avoid garbage collection pauses in V8. See [V8 issue 2070](https://code.google.com/p/v8/issues/detail?id=2070)
+     * for more details.
+     *
+     * @private
+     * @param {Function} func The function to associate metadata with.
+     * @param {*} data The metadata.
+     * @returns {Function} Returns `func`.
+     */
+    var setData = (function() {
+      var count = 0,
+          lastCalled = 0;
+
+      return function(key, value) {
+        var stamp = now(),
+            remaining = HOT_SPAN - (stamp - lastCalled);
+
+        lastCalled = stamp;
+        if (remaining > 0) {
+          if (++count >= HOT_COUNT) {
+            return key;
+          }
+        } else {
+          count = 0;
+        }
+        return baseSetData(key, value);
+      };
+    }());
+
+    /**
+     * A fallback implementation of `Object.keys` which creates an array of the
+     * own enumerable property names of `object`.
+     *
+     * @private
+     * @param {Object} object The object to query.
+     * @returns {Array} Returns the array of property names.
+     */
+    function shimKeys(object) {
+      var props = keysIn(object),
+          propsLength = props.length,
+          length = propsLength && object.length;
+
+      var allowIndexes = !!length && isLength(length) &&
+        (isArray(object) || isArguments(object) || isString(object));
+
+      var index = -1,
+          result = [];
+
+      while (++index < propsLength) {
+        var key = props[index];
+        if ((allowIndexes && isIndex(key, length)) || hasOwnProperty.call(object, key)) {
+          result.push(key);
+        }
+      }
+      return result;
+    }
+
+    /**
+     * Converts `value` to an array-like object if it's not one.
+     *
+     * @private
+     * @param {*} value The value to process.
+     * @returns {Array|Object} Returns the array-like object.
+     */
+    function toIterable(value) {
+      if (value == null) {
+        return [];
+      }
+      if (!isArrayLike(value)) {
+        return values(value);
+      }
+      if (lodash.support.unindexedChars && isString(value)) {
+        return value.split('');
+      }
+      return isObject(value) ? value : Object(value);
+    }
+
+    /**
+     * Converts `value` to an object if it's not one.
+     *
+     * @private
+     * @param {*} value The value to process.
+     * @returns {Object} Returns the object.
+     */
+    function toObject(value) {
+      if (lodash.support.unindexedChars && isString(value)) {
+        var index = -1,
+            length = value.length,
+            result = Object(value);
+
+        while (++index < length) {
+          result[index] = value.charAt(index);
+        }
+        return result;
+      }
+      return isObject(value) ? value : Object(value);
+    }
+
+    /**
+     * Converts `value` to property path array if it's not one.
+     *
+     * @private
+     * @param {*} value The value to process.
+     * @returns {Array} Returns the property path array.
+     */
+    function toPath(value) {
+      if (isArray(value)) {
+        return value;
+      }
+      var result = [];
+      baseToString(value).replace(rePropName, function(match, number, quote, string) {
+        result.push(quote ? string.replace(reEscapeChar, '$1') : (number || match));
+      });
+      return result;
+    }
+
+    /**
+     * Creates a clone of `wrapper`.
+     *
+     * @private
+     * @param {Object} wrapper The wrapper to clone.
+     * @returns {Object} Returns the cloned wrapper.
+     */
+    function wrapperClone(wrapper) {
+      return wrapper instanceof LazyWrapper
+        ? wrapper.clone()
+        : new LodashWrapper(wrapper.__wrapped__, wrapper.__chain__, arrayCopy(wrapper.__actions__));
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Creates an array of elements split into groups the length of `size`.
+     * If `collection` can't be split evenly, the final chunk will be the remaining
+     * elements.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to process.
+     * @param {number} [size=1] The length of each chunk.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Array} Returns the new array containing chunks.
+     * @example
+     *
+     * _.chunk(['a', 'b', 'c', 'd'], 2);
+     * // => [['a', 'b'], ['c', 'd']]
+     *
+     * _.chunk(['a', 'b', 'c', 'd'], 3);
+     * // => [['a', 'b', 'c'], ['d']]
+     */
+    function chunk(array, size, guard) {
+      if (guard ? isIterateeCall(array, size, guard) : size == null) {
+        size = 1;
+      } else {
+        size = nativeMax(nativeFloor(size) || 1, 1);
+      }
+      var index = 0,
+          length = array ? array.length : 0,
+          resIndex = -1,
+          result = Array(nativeCeil(length / size));
+
+      while (index < length) {
+        result[++resIndex] = baseSlice(array, index, (index += size));
+      }
+      return result;
+    }
+
+    /**
+     * Creates an array with all falsey values removed. The values `false`, `null`,
+     * `0`, `""`, `undefined`, and `NaN` are falsey.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to compact.
+     * @returns {Array} Returns the new array of filtered values.
+     * @example
+     *
+     * _.compact([0, 1, false, 2, '', 3]);
+     * // => [1, 2, 3]
+     */
+    function compact(array) {
+      var index = -1,
+          length = array ? array.length : 0,
+          resIndex = -1,
+          result = [];
+
+      while (++index < length) {
+        var value = array[index];
+        if (value) {
+          result[++resIndex] = value;
+        }
+      }
+      return result;
+    }
+
+    /**
+     * Creates an array of unique `array` values not included in the other
+     * provided arrays using [`SameValueZero`](http://ecma-international.org/ecma-262/6.0/#sec-samevaluezero)
+     * for equality comparisons.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to inspect.
+     * @param {...Array} [values] The arrays of values to exclude.
+     * @returns {Array} Returns the new array of filtered values.
+     * @example
+     *
+     * _.difference([1, 2, 3], [4, 2]);
+     * // => [1, 3]
+     */
+    var difference = restParam(function(array, values) {
+      return (isObjectLike(array) && isArrayLike(array))
+        ? baseDifference(array, baseFlatten(values, false, true))
+        : [];
+    });
+
+    /**
+     * Creates a slice of `array` with `n` elements dropped from the beginning.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @param {number} [n=1] The number of elements to drop.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.drop([1, 2, 3]);
+     * // => [2, 3]
+     *
+     * _.drop([1, 2, 3], 2);
+     * // => [3]
+     *
+     * _.drop([1, 2, 3], 5);
+     * // => []
+     *
+     * _.drop([1, 2, 3], 0);
+     * // => [1, 2, 3]
+     */
+    function drop(array, n, guard) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return [];
+      }
+      if (guard ? isIterateeCall(array, n, guard) : n == null) {
+        n = 1;
+      }
+      return baseSlice(array, n < 0 ? 0 : n);
+    }
+
+    /**
+     * Creates a slice of `array` with `n` elements dropped from the end.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @param {number} [n=1] The number of elements to drop.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.dropRight([1, 2, 3]);
+     * // => [1, 2]
+     *
+     * _.dropRight([1, 2, 3], 2);
+     * // => [1]
+     *
+     * _.dropRight([1, 2, 3], 5);
+     * // => []
+     *
+     * _.dropRight([1, 2, 3], 0);
+     * // => [1, 2, 3]
+     */
+    function dropRight(array, n, guard) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return [];
+      }
+      if (guard ? isIterateeCall(array, n, guard) : n == null) {
+        n = 1;
+      }
+      n = length - (+n || 0);
+      return baseSlice(array, 0, n < 0 ? 0 : n);
+    }
+
+    /**
+     * Creates a slice of `array` excluding elements dropped from the end.
+     * Elements are dropped until `predicate` returns falsey. The predicate is
+     * bound to `thisArg` and invoked with three arguments: (value, index, array).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that match the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.dropRightWhile([1, 2, 3], function(n) {
+     *   return n > 1;
+     * });
+     * // => [1]
+     *
+     * var users = [
+     *   { 'user': 'barney',  'active': true },
+     *   { 'user': 'fred',    'active': false },
+     *   { 'user': 'pebbles', 'active': false }
+     * ];
+     *
+     * // using the `_.matches` callback shorthand
+     * _.pluck(_.dropRightWhile(users, { 'user': 'pebbles', 'active': false }), 'user');
+     * // => ['barney', 'fred']
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.pluck(_.dropRightWhile(users, 'active', false), 'user');
+     * // => ['barney']
+     *
+     * // using the `_.property` callback shorthand
+     * _.pluck(_.dropRightWhile(users, 'active'), 'user');
+     * // => ['barney', 'fred', 'pebbles']
+     */
+    function dropRightWhile(array, predicate, thisArg) {
+      return (array && array.length)
+        ? baseWhile(array, getCallback(predicate, thisArg, 3), true, true)
+        : [];
+    }
+
+    /**
+     * Creates a slice of `array` excluding elements dropped from the beginning.
+     * Elements are dropped until `predicate` returns falsey. The predicate is
+     * bound to `thisArg` and invoked with three arguments: (value, index, array).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.dropWhile([1, 2, 3], function(n) {
+     *   return n < 3;
+     * });
+     * // => [3]
+     *
+     * var users = [
+     *   { 'user': 'barney',  'active': false },
+     *   { 'user': 'fred',    'active': false },
+     *   { 'user': 'pebbles', 'active': true }
+     * ];
+     *
+     * // using the `_.matches` callback shorthand
+     * _.pluck(_.dropWhile(users, { 'user': 'barney', 'active': false }), 'user');
+     * // => ['fred', 'pebbles']
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.pluck(_.dropWhile(users, 'active', false), 'user');
+     * // => ['pebbles']
+     *
+     * // using the `_.property` callback shorthand
+     * _.pluck(_.dropWhile(users, 'active'), 'user');
+     * // => ['barney', 'fred', 'pebbles']
+     */
+    function dropWhile(array, predicate, thisArg) {
+      return (array && array.length)
+        ? baseWhile(array, getCallback(predicate, thisArg, 3), true)
+        : [];
+    }
+
+    /**
+     * Fills elements of `array` with `value` from `start` up to, but not
+     * including, `end`.
+     *
+     * **Note:** This method mutates `array`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to fill.
+     * @param {*} value The value to fill `array` with.
+     * @param {number} [start=0] The start position.
+     * @param {number} [end=array.length] The end position.
+     * @returns {Array} Returns `array`.
+     * @example
+     *
+     * var array = [1, 2, 3];
+     *
+     * _.fill(array, 'a');
+     * console.log(array);
+     * // => ['a', 'a', 'a']
+     *
+     * _.fill(Array(3), 2);
+     * // => [2, 2, 2]
+     *
+     * _.fill([4, 6, 8], '*', 1, 2);
+     * // => [4, '*', 8]
+     */
+    function fill(array, value, start, end) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return [];
+      }
+      if (start && typeof start != 'number' && isIterateeCall(array, value, start)) {
+        start = 0;
+        end = length;
+      }
+      return baseFill(array, value, start, end);
+    }
+
+    /**
+     * This method is like `_.find` except that it returns the index of the first
+     * element `predicate` returns truthy for instead of the element itself.
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to search.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {number} Returns the index of the found element, else `-1`.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney',  'active': false },
+     *   { 'user': 'fred',    'active': false },
+     *   { 'user': 'pebbles', 'active': true }
+     * ];
+     *
+     * _.findIndex(users, function(chr) {
+     *   return chr.user == 'barney';
+     * });
+     * // => 0
+     *
+     * // using the `_.matches` callback shorthand
+     * _.findIndex(users, { 'user': 'fred', 'active': false });
+     * // => 1
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.findIndex(users, 'active', false);
+     * // => 0
+     *
+     * // using the `_.property` callback shorthand
+     * _.findIndex(users, 'active');
+     * // => 2
+     */
+    var findIndex = createFindIndex();
+
+    /**
+     * This method is like `_.findIndex` except that it iterates over elements
+     * of `collection` from right to left.
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to search.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {number} Returns the index of the found element, else `-1`.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney',  'active': true },
+     *   { 'user': 'fred',    'active': false },
+     *   { 'user': 'pebbles', 'active': false }
+     * ];
+     *
+     * _.findLastIndex(users, function(chr) {
+     *   return chr.user == 'pebbles';
+     * });
+     * // => 2
+     *
+     * // using the `_.matches` callback shorthand
+     * _.findLastIndex(users, { 'user': 'barney', 'active': true });
+     * // => 0
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.findLastIndex(users, 'active', false);
+     * // => 2
+     *
+     * // using the `_.property` callback shorthand
+     * _.findLastIndex(users, 'active');
+     * // => 0
+     */
+    var findLastIndex = createFindIndex(true);
+
+    /**
+     * Gets the first element of `array`.
+     *
+     * @static
+     * @memberOf _
+     * @alias head
+     * @category Array
+     * @param {Array} array The array to query.
+     * @returns {*} Returns the first element of `array`.
+     * @example
+     *
+     * _.first([1, 2, 3]);
+     * // => 1
+     *
+     * _.first([]);
+     * // => undefined
+     */
+    function first(array) {
+      return array ? array[0] : undefined;
+    }
+
+    /**
+     * Flattens a nested array. If `isDeep` is `true` the array is recursively
+     * flattened, otherwise it's only flattened a single level.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to flatten.
+     * @param {boolean} [isDeep] Specify a deep flatten.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Array} Returns the new flattened array.
+     * @example
+     *
+     * _.flatten([1, [2, 3, [4]]]);
+     * // => [1, 2, 3, [4]]
+     *
+     * // using `isDeep`
+     * _.flatten([1, [2, 3, [4]]], true);
+     * // => [1, 2, 3, 4]
+     */
+    function flatten(array, isDeep, guard) {
+      var length = array ? array.length : 0;
+      if (guard && isIterateeCall(array, isDeep, guard)) {
+        isDeep = false;
+      }
+      return length ? baseFlatten(array, isDeep) : [];
+    }
+
+    /**
+     * Recursively flattens a nested array.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to recursively flatten.
+     * @returns {Array} Returns the new flattened array.
+     * @example
+     *
+     * _.flattenDeep([1, [2, 3, [4]]]);
+     * // => [1, 2, 3, 4]
+     */
+    function flattenDeep(array) {
+      var length = array ? array.length : 0;
+      return length ? baseFlatten(array, true) : [];
+    }
+
+    /**
+     * Gets the index at which the first occurrence of `value` is found in `array`
+     * using [`SameValueZero`](http://ecma-international.org/ecma-262/6.0/#sec-samevaluezero)
+     * for equality comparisons. If `fromIndex` is negative, it's used as the offset
+     * from the end of `array`. If `array` is sorted providing `true` for `fromIndex`
+     * performs a faster binary search.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to search.
+     * @param {*} value The value to search for.
+     * @param {boolean|number} [fromIndex=0] The index to search from or `true`
+     *  to perform a binary search on a sorted array.
+     * @returns {number} Returns the index of the matched value, else `-1`.
+     * @example
+     *
+     * _.indexOf([1, 2, 1, 2], 2);
+     * // => 1
+     *
+     * // using `fromIndex`
+     * _.indexOf([1, 2, 1, 2], 2, 2);
+     * // => 3
+     *
+     * // performing a binary search
+     * _.indexOf([1, 1, 2, 2], 2, true);
+     * // => 2
+     */
+    function indexOf(array, value, fromIndex) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return -1;
+      }
+      if (typeof fromIndex == 'number') {
+        fromIndex = fromIndex < 0 ? nativeMax(length + fromIndex, 0) : fromIndex;
+      } else if (fromIndex) {
+        var index = binaryIndex(array, value);
+        if (index < length &&
+            (value === value ? (value === array[index]) : (array[index] !== array[index]))) {
+          return index;
+        }
+        return -1;
+      }
+      return baseIndexOf(array, value, fromIndex || 0);
+    }
+
+    /**
+     * Gets all but the last element of `array`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.initial([1, 2, 3]);
+     * // => [1, 2]
+     */
+    function initial(array) {
+      return dropRight(array, 1);
+    }
+
+    /**
+     * Creates an array of unique values that are included in all of the provided
+     * arrays using [`SameValueZero`](http://ecma-international.org/ecma-262/6.0/#sec-samevaluezero)
+     * for equality comparisons.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {...Array} [arrays] The arrays to inspect.
+     * @returns {Array} Returns the new array of shared values.
+     * @example
+     * _.intersection([1, 2], [4, 2], [2, 1]);
+     * // => [2]
+     */
+    var intersection = restParam(function(arrays) {
+      var othLength = arrays.length,
+          othIndex = othLength,
+          caches = Array(length),
+          indexOf = getIndexOf(),
+          isCommon = indexOf === baseIndexOf,
+          result = [];
+
+      while (othIndex--) {
+        var value = arrays[othIndex] = isArrayLike(value = arrays[othIndex]) ? value : [];
+        caches[othIndex] = (isCommon && value.length >= 120) ? createCache(othIndex && value) : null;
+      }
+      var array = arrays[0],
+          index = -1,
+          length = array ? array.length : 0,
+          seen = caches[0];
+
+      outer:
+      while (++index < length) {
+        value = array[index];
+        if ((seen ? cacheIndexOf(seen, value) : indexOf(result, value, 0)) < 0) {
+          var othIndex = othLength;
+          while (--othIndex) {
+            var cache = caches[othIndex];
+            if ((cache ? cacheIndexOf(cache, value) : indexOf(arrays[othIndex], value, 0)) < 0) {
+              continue outer;
+            }
+          }
+          if (seen) {
+            seen.push(value);
+          }
+          result.push(value);
+        }
+      }
+      return result;
+    });
+
+    /**
+     * Gets the last element of `array`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @returns {*} Returns the last element of `array`.
+     * @example
+     *
+     * _.last([1, 2, 3]);
+     * // => 3
+     */
+    function last(array) {
+      var length = array ? array.length : 0;
+      return length ? array[length - 1] : undefined;
+    }
+
+    /**
+     * This method is like `_.indexOf` except that it iterates over elements of
+     * `array` from right to left.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to search.
+     * @param {*} value The value to search for.
+     * @param {boolean|number} [fromIndex=array.length-1] The index to search from
+     *  or `true` to perform a binary search on a sorted array.
+     * @returns {number} Returns the index of the matched value, else `-1`.
+     * @example
+     *
+     * _.lastIndexOf([1, 2, 1, 2], 2);
+     * // => 3
+     *
+     * // using `fromIndex`
+     * _.lastIndexOf([1, 2, 1, 2], 2, 2);
+     * // => 1
+     *
+     * // performing a binary search
+     * _.lastIndexOf([1, 1, 2, 2], 2, true);
+     * // => 3
+     */
+    function lastIndexOf(array, value, fromIndex) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return -1;
+      }
+      var index = length;
+      if (typeof fromIndex == 'number') {
+        index = (fromIndex < 0 ? nativeMax(length + fromIndex, 0) : nativeMin(fromIndex || 0, length - 1)) + 1;
+      } else if (fromIndex) {
+        index = binaryIndex(array, value, true) - 1;
+        var other = array[index];
+        if (value === value ? (value === other) : (other !== other)) {
+          return index;
+        }
+        return -1;
+      }
+      if (value !== value) {
+        return indexOfNaN(array, index, true);
+      }
+      while (index--) {
+        if (array[index] === value) {
+          return index;
+        }
+      }
+      return -1;
+    }
+
+    /**
+     * Removes all provided values from `array` using
+     * [`SameValueZero`](http://ecma-international.org/ecma-262/6.0/#sec-samevaluezero)
+     * for equality comparisons.
+     *
+     * **Note:** Unlike `_.without`, this method mutates `array`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to modify.
+     * @param {...*} [values] The values to remove.
+     * @returns {Array} Returns `array`.
+     * @example
+     *
+     * var array = [1, 2, 3, 1, 2, 3];
+     *
+     * _.pull(array, 2, 3);
+     * console.log(array);
+     * // => [1, 1]
+     */
+    function pull() {
+      var args = arguments,
+          array = args[0];
+
+      if (!(array && array.length)) {
+        return array;
+      }
+      var index = 0,
+          indexOf = getIndexOf(),
+          length = args.length;
+
+      while (++index < length) {
+        var fromIndex = 0,
+            value = args[index];
+
+        while ((fromIndex = indexOf(array, value, fromIndex)) > -1) {
+          splice.call(array, fromIndex, 1);
+        }
+      }
+      return array;
+    }
+
+    /**
+     * Removes elements from `array` corresponding to the given indexes and returns
+     * an array of the removed elements. Indexes may be specified as an array of
+     * indexes or as individual arguments.
+     *
+     * **Note:** Unlike `_.at`, this method mutates `array`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to modify.
+     * @param {...(number|number[])} [indexes] The indexes of elements to remove,
+     *  specified as individual indexes or arrays of indexes.
+     * @returns {Array} Returns the new array of removed elements.
+     * @example
+     *
+     * var array = [5, 10, 15, 20];
+     * var evens = _.pullAt(array, 1, 3);
+     *
+     * console.log(array);
+     * // => [5, 15]
+     *
+     * console.log(evens);
+     * // => [10, 20]
+     */
+    var pullAt = restParam(function(array, indexes) {
+      indexes = baseFlatten(indexes);
+
+      var result = baseAt(array, indexes);
+      basePullAt(array, indexes.sort(baseCompareAscending));
+      return result;
+    });
+
+    /**
+     * Removes all elements from `array` that `predicate` returns truthy for
+     * and returns an array of the removed elements. The predicate is bound to
+     * `thisArg` and invoked with three arguments: (value, index, array).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * **Note:** Unlike `_.filter`, this method mutates `array`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to modify.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Array} Returns the new array of removed elements.
+     * @example
+     *
+     * var array = [1, 2, 3, 4];
+     * var evens = _.remove(array, function(n) {
+     *   return n % 2 == 0;
+     * });
+     *
+     * console.log(array);
+     * // => [1, 3]
+     *
+     * console.log(evens);
+     * // => [2, 4]
+     */
+    function remove(array, predicate, thisArg) {
+      var result = [];
+      if (!(array && array.length)) {
+        return result;
+      }
+      var index = -1,
+          indexes = [],
+          length = array.length;
+
+      predicate = getCallback(predicate, thisArg, 3);
+      while (++index < length) {
+        var value = array[index];
+        if (predicate(value, index, array)) {
+          result.push(value);
+          indexes.push(index);
+        }
+      }
+      basePullAt(array, indexes);
+      return result;
+    }
+
+    /**
+     * Gets all but the first element of `array`.
+     *
+     * @static
+     * @memberOf _
+     * @alias tail
+     * @category Array
+     * @param {Array} array The array to query.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.rest([1, 2, 3]);
+     * // => [2, 3]
+     */
+    function rest(array) {
+      return drop(array, 1);
+    }
+
+    /**
+     * Creates a slice of `array` from `start` up to, but not including, `end`.
+     *
+     * **Note:** This method is used instead of `Array#slice` to support node
+     * lists in IE < 9 and to ensure dense arrays are returned.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to slice.
+     * @param {number} [start=0] The start position.
+     * @param {number} [end=array.length] The end position.
+     * @returns {Array} Returns the slice of `array`.
+     */
+    function slice(array, start, end) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return [];
+      }
+      if (end && typeof end != 'number' && isIterateeCall(array, start, end)) {
+        start = 0;
+        end = length;
+      }
+      return baseSlice(array, start, end);
+    }
+
+    /**
+     * Uses a binary search to determine the lowest index at which `value` should
+     * be inserted into `array` in order to maintain its sort order. If an iteratee
+     * function is provided it's invoked for `value` and each element of `array`
+     * to compute their sort ranking. The iteratee is bound to `thisArg` and
+     * invoked with one argument; (value).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The sorted array to inspect.
+     * @param {*} value The value to evaluate.
+     * @param {Function|Object|string} [iteratee=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {number} Returns the index at which `value` should be inserted
+     *  into `array`.
+     * @example
+     *
+     * _.sortedIndex([30, 50], 40);
+     * // => 1
+     *
+     * _.sortedIndex([4, 4, 5, 5], 5);
+     * // => 2
+     *
+     * var dict = { 'data': { 'thirty': 30, 'forty': 40, 'fifty': 50 } };
+     *
+     * // using an iteratee function
+     * _.sortedIndex(['thirty', 'fifty'], 'forty', function(word) {
+     *   return this.data[word];
+     * }, dict);
+     * // => 1
+     *
+     * // using the `_.property` callback shorthand
+     * _.sortedIndex([{ 'x': 30 }, { 'x': 50 }], { 'x': 40 }, 'x');
+     * // => 1
+     */
+    var sortedIndex = createSortedIndex();
+
+    /**
+     * This method is like `_.sortedIndex` except that it returns the highest
+     * index at which `value` should be inserted into `array` in order to
+     * maintain its sort order.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The sorted array to inspect.
+     * @param {*} value The value to evaluate.
+     * @param {Function|Object|string} [iteratee=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {number} Returns the index at which `value` should be inserted
+     *  into `array`.
+     * @example
+     *
+     * _.sortedLastIndex([4, 4, 5, 5], 5);
+     * // => 4
+     */
+    var sortedLastIndex = createSortedIndex(true);
+
+    /**
+     * Creates a slice of `array` with `n` elements taken from the beginning.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @param {number} [n=1] The number of elements to take.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.take([1, 2, 3]);
+     * // => [1]
+     *
+     * _.take([1, 2, 3], 2);
+     * // => [1, 2]
+     *
+     * _.take([1, 2, 3], 5);
+     * // => [1, 2, 3]
+     *
+     * _.take([1, 2, 3], 0);
+     * // => []
+     */
+    function take(array, n, guard) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return [];
+      }
+      if (guard ? isIterateeCall(array, n, guard) : n == null) {
+        n = 1;
+      }
+      return baseSlice(array, 0, n < 0 ? 0 : n);
+    }
+
+    /**
+     * Creates a slice of `array` with `n` elements taken from the end.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @param {number} [n=1] The number of elements to take.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.takeRight([1, 2, 3]);
+     * // => [3]
+     *
+     * _.takeRight([1, 2, 3], 2);
+     * // => [2, 3]
+     *
+     * _.takeRight([1, 2, 3], 5);
+     * // => [1, 2, 3]
+     *
+     * _.takeRight([1, 2, 3], 0);
+     * // => []
+     */
+    function takeRight(array, n, guard) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return [];
+      }
+      if (guard ? isIterateeCall(array, n, guard) : n == null) {
+        n = 1;
+      }
+      n = length - (+n || 0);
+      return baseSlice(array, n < 0 ? 0 : n);
+    }
+
+    /**
+     * Creates a slice of `array` with elements taken from the end. Elements are
+     * taken until `predicate` returns falsey. The predicate is bound to `thisArg`
+     * and invoked with three arguments: (value, index, array).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.takeRightWhile([1, 2, 3], function(n) {
+     *   return n > 1;
+     * });
+     * // => [2, 3]
+     *
+     * var users = [
+     *   { 'user': 'barney',  'active': true },
+     *   { 'user': 'fred',    'active': false },
+     *   { 'user': 'pebbles', 'active': false }
+     * ];
+     *
+     * // using the `_.matches` callback shorthand
+     * _.pluck(_.takeRightWhile(users, { 'user': 'pebbles', 'active': false }), 'user');
+     * // => ['pebbles']
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.pluck(_.takeRightWhile(users, 'active', false), 'user');
+     * // => ['fred', 'pebbles']
+     *
+     * // using the `_.property` callback shorthand
+     * _.pluck(_.takeRightWhile(users, 'active'), 'user');
+     * // => []
+     */
+    function takeRightWhile(array, predicate, thisArg) {
+      return (array && array.length)
+        ? baseWhile(array, getCallback(predicate, thisArg, 3), false, true)
+        : [];
+    }
+
+    /**
+     * Creates a slice of `array` with elements taken from the beginning. Elements
+     * are taken until `predicate` returns falsey. The predicate is bound to
+     * `thisArg` and invoked with three arguments: (value, index, array).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.takeWhile([1, 2, 3], function(n) {
+     *   return n < 3;
+     * });
+     * // => [1, 2]
+     *
+     * var users = [
+     *   { 'user': 'barney',  'active': false },
+     *   { 'user': 'fred',    'active': false},
+     *   { 'user': 'pebbles', 'active': true }
+     * ];
+     *
+     * // using the `_.matches` callback shorthand
+     * _.pluck(_.takeWhile(users, { 'user': 'barney', 'active': false }), 'user');
+     * // => ['barney']
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.pluck(_.takeWhile(users, 'active', false), 'user');
+     * // => ['barney', 'fred']
+     *
+     * // using the `_.property` callback shorthand
+     * _.pluck(_.takeWhile(users, 'active'), 'user');
+     * // => []
+     */
+    function takeWhile(array, predicate, thisArg) {
+      return (array && array.length)
+        ? baseWhile(array, getCallback(predicate, thisArg, 3))
+        : [];
+    }
+
+    /**
+     * Creates an array of unique values, in order, from all of the provided arrays
+     * using [`SameValueZero`](http://ecma-international.org/ecma-262/6.0/#sec-samevaluezero)
+     * for equality comparisons.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {...Array} [arrays] The arrays to inspect.
+     * @returns {Array} Returns the new array of combined values.
+     * @example
+     *
+     * _.union([1, 2], [4, 2], [2, 1]);
+     * // => [1, 2, 4]
+     */
+    var union = restParam(function(arrays) {
+      return baseUniq(baseFlatten(arrays, false, true));
+    });
+
+    /**
+     * Creates a duplicate-free version of an array, using
+     * [`SameValueZero`](http://ecma-international.org/ecma-262/6.0/#sec-samevaluezero)
+     * for equality comparisons, in which only the first occurence of each element
+     * is kept. Providing `true` for `isSorted` performs a faster search algorithm
+     * for sorted arrays. If an iteratee function is provided it's invoked for
+     * each element in the array to generate the criterion by which uniqueness
+     * is computed. The `iteratee` is bound to `thisArg` and invoked with three
+     * arguments: (value, index, array).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @alias unique
+     * @category Array
+     * @param {Array} array The array to inspect.
+     * @param {boolean} [isSorted] Specify the array is sorted.
+     * @param {Function|Object|string} [iteratee] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Array} Returns the new duplicate-value-free array.
+     * @example
+     *
+     * _.uniq([2, 1, 2]);
+     * // => [2, 1]
+     *
+     * // using `isSorted`
+     * _.uniq([1, 1, 2], true);
+     * // => [1, 2]
+     *
+     * // using an iteratee function
+     * _.uniq([1, 2.5, 1.5, 2], function(n) {
+     *   return this.floor(n);
+     * }, Math);
+     * // => [1, 2.5]
+     *
+     * // using the `_.property` callback shorthand
+     * _.uniq([{ 'x': 1 }, { 'x': 2 }, { 'x': 1 }], 'x');
+     * // => [{ 'x': 1 }, { 'x': 2 }]
+     */
+    function uniq(array, isSorted, iteratee, thisArg) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return [];
+      }
+      if (isSorted != null && typeof isSorted != 'boolean') {
+        thisArg = iteratee;
+        iteratee = isIterateeCall(array, isSorted, thisArg) ? undefined : isSorted;
+        isSorted = false;
+      }
+      var callback = getCallback();
+      if (!(iteratee == null && callback === baseCallback)) {
+        iteratee = callback(iteratee, thisArg, 3);
+      }
+      return (isSorted && getIndexOf() === baseIndexOf)
+        ? sortedUniq(array, iteratee)
+        : baseUniq(array, iteratee);
+    }
+
+    /**
+     * This method is like `_.zip` except that it accepts an array of grouped
+     * elements and creates an array regrouping the elements to their pre-zip
+     * configuration.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array of grouped elements to process.
+     * @returns {Array} Returns the new array of regrouped elements.
+     * @example
+     *
+     * var zipped = _.zip(['fred', 'barney'], [30, 40], [true, false]);
+     * // => [['fred', 30, true], ['barney', 40, false]]
+     *
+     * _.unzip(zipped);
+     * // => [['fred', 'barney'], [30, 40], [true, false]]
+     */
+    function unzip(array) {
+      if (!(array && array.length)) {
+        return [];
+      }
+      var index = -1,
+          length = 0;
+
+      array = arrayFilter(array, function(group) {
+        if (isArrayLike(group)) {
+          length = nativeMax(group.length, length);
+          return true;
+        }
+      });
+      var result = Array(length);
+      while (++index < length) {
+        result[index] = arrayMap(array, baseProperty(index));
+      }
+      return result;
+    }
+
+    /**
+     * This method is like `_.unzip` except that it accepts an iteratee to specify
+     * how regrouped values should be combined. The `iteratee` is bound to `thisArg`
+     * and invoked with four arguments: (accumulator, value, index, group).
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array of grouped elements to process.
+     * @param {Function} [iteratee] The function to combine regrouped values.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Array} Returns the new array of regrouped elements.
+     * @example
+     *
+     * var zipped = _.zip([1, 2], [10, 20], [100, 200]);
+     * // => [[1, 10, 100], [2, 20, 200]]
+     *
+     * _.unzipWith(zipped, _.add);
+     * // => [3, 30, 300]
+     */
+    function unzipWith(array, iteratee, thisArg) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return [];
+      }
+      var result = unzip(array);
+      if (iteratee == null) {
+        return result;
+      }
+      iteratee = bindCallback(iteratee, thisArg, 4);
+      return arrayMap(result, function(group) {
+        return arrayReduce(group, iteratee, undefined, true);
+      });
+    }
+
+    /**
+     * Creates an array excluding all provided values using
+     * [`SameValueZero`](http://ecma-international.org/ecma-262/6.0/#sec-samevaluezero)
+     * for equality comparisons.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to filter.
+     * @param {...*} [values] The values to exclude.
+     * @returns {Array} Returns the new array of filtered values.
+     * @example
+     *
+     * _.without([1, 2, 1, 3], 1, 2);
+     * // => [3]
+     */
+    var without = restParam(function(array, values) {
+      return isArrayLike(array)
+        ? baseDifference(array, values)
+        : [];
+    });
+
+    /**
+     * Creates an array of unique values that is the [symmetric difference](https://en.wikipedia.org/wiki/Symmetric_difference)
+     * of the provided arrays.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {...Array} [arrays] The arrays to inspect.
+     * @returns {Array} Returns the new array of values.
+     * @example
+     *
+     * _.xor([1, 2], [4, 2]);
+     * // => [1, 4]
+     */
+    function xor() {
+      var index = -1,
+          length = arguments.length;
+
+      while (++index < length) {
+        var array = arguments[index];
+        if (isArrayLike(array)) {
+          var result = result
+            ? arrayPush(baseDifference(result, array), baseDifference(array, result))
+            : array;
+        }
+      }
+      return result ? baseUniq(result) : [];
+    }
+
+    /**
+     * Creates an array of grouped elements, the first of which contains the first
+     * elements of the given arrays, the second of which contains the second elements
+     * of the given arrays, and so on.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {...Array} [arrays] The arrays to process.
+     * @returns {Array} Returns the new array of grouped elements.
+     * @example
+     *
+     * _.zip(['fred', 'barney'], [30, 40], [true, false]);
+     * // => [['fred', 30, true], ['barney', 40, false]]
+     */
+    var zip = restParam(unzip);
+
+    /**
+     * The inverse of `_.pairs`; this method returns an object composed from arrays
+     * of property names and values. Provide either a single two dimensional array,
+     * e.g. `[[key1, value1], [key2, value2]]` or two arrays, one of property names
+     * and one of corresponding values.
+     *
+     * @static
+     * @memberOf _
+     * @alias object
+     * @category Array
+     * @param {Array} props The property names.
+     * @param {Array} [values=[]] The property values.
+     * @returns {Object} Returns the new object.
+     * @example
+     *
+     * _.zipObject([['fred', 30], ['barney', 40]]);
+     * // => { 'fred': 30, 'barney': 40 }
+     *
+     * _.zipObject(['fred', 'barney'], [30, 40]);
+     * // => { 'fred': 30, 'barney': 40 }
+     */
+    function zipObject(props, values) {
+      var index = -1,
+          length = props ? props.length : 0,
+          result = {};
+
+      if (length && !values && !isArray(props[0])) {
+        values = [];
+      }
+      while (++index < length) {
+        var key = props[index];
+        if (values) {
+          result[key] = values[index];
+        } else if (key) {
+          result[key[0]] = key[1];
+        }
+      }
+      return result;
+    }
+
+    /**
+     * This method is like `_.zip` except that it accepts an iteratee to specify
+     * how grouped values should be combined. The `iteratee` is bound to `thisArg`
+     * and invoked with four arguments: (accumulator, value, index, group).
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {...Array} [arrays] The arrays to process.
+     * @param {Function} [iteratee] The function to combine grouped values.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Array} Returns the new array of grouped elements.
+     * @example
+     *
+     * _.zipWith([1, 2], [10, 20], [100, 200], _.add);
+     * // => [111, 222]
+     */
+    var zipWith = restParam(function(arrays) {
+      var length = arrays.length,
+          iteratee = length > 2 ? arrays[length - 2] : undefined,
+          thisArg = length > 1 ? arrays[length - 1] : undefined;
+
+      if (length > 2 && typeof iteratee == 'function') {
+        length -= 2;
+      } else {
+        iteratee = (length > 1 && typeof thisArg == 'function') ? (--length, thisArg) : undefined;
+        thisArg = undefined;
+      }
+      arrays.length = length;
+      return unzipWith(arrays, iteratee, thisArg);
+    });
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Creates a `lodash` object that wraps `value` with explicit method
+     * chaining enabled.
+     *
+     * @static
+     * @memberOf _
+     * @category Chain
+     * @param {*} value The value to wrap.
+     * @returns {Object} Returns the new `lodash` wrapper instance.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney',  'age': 36 },
+     *   { 'user': 'fred',    'age': 40 },
+     *   { 'user': 'pebbles', 'age': 1 }
+     * ];
+     *
+     * var youngest = _.chain(users)
+     *   .sortBy('age')
+     *   .map(function(chr) {
+     *     return chr.user + ' is ' + chr.age;
+     *   })
+     *   .first()
+     *   .value();
+     * // => 'pebbles is 1'
+     */
+    function chain(value) {
+      var result = lodash(value);
+      result.__chain__ = true;
+      return result;
+    }
+
+    /**
+     * This method invokes `interceptor` and returns `value`. The interceptor is
+     * bound to `thisArg` and invoked with one argument; (value). The purpose of
+     * this method is to "tap into" a method chain in order to perform operations
+     * on intermediate results within the chain.
+     *
+     * @static
+     * @memberOf _
+     * @category Chain
+     * @param {*} value The value to provide to `interceptor`.
+     * @param {Function} interceptor The function to invoke.
+     * @param {*} [thisArg] The `this` binding of `interceptor`.
+     * @returns {*} Returns `value`.
+     * @example
+     *
+     * _([1, 2, 3])
+     *  .tap(function(array) {
+     *    array.pop();
+     *  })
+     *  .reverse()
+     *  .value();
+     * // => [2, 1]
+     */
+    function tap(value, interceptor, thisArg) {
+      interceptor.call(thisArg, value);
+      return value;
+    }
+
+    /**
+     * This method is like `_.tap` except that it returns the result of `interceptor`.
+     *
+     * @static
+     * @memberOf _
+     * @category Chain
+     * @param {*} value The value to provide to `interceptor`.
+     * @param {Function} interceptor The function to invoke.
+     * @param {*} [thisArg] The `this` binding of `interceptor`.
+     * @returns {*} Returns the result of `interceptor`.
+     * @example
+     *
+     * _('  abc  ')
+     *  .chain()
+     *  .trim()
+     *  .thru(function(value) {
+     *    return [value];
+     *  })
+     *  .value();
+     * // => ['abc']
+     */
+    function thru(value, interceptor, thisArg) {
+      return interceptor.call(thisArg, value);
+    }
+
+    /**
+     * Enables explicit method chaining on the wrapper object.
+     *
+     * @name chain
+     * @memberOf _
+     * @category Chain
+     * @returns {Object} Returns the new `lodash` wrapper instance.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36 },
+     *   { 'user': 'fred',   'age': 40 }
+     * ];
+     *
+     * // without explicit chaining
+     * _(users).first();
+     * // => { 'user': 'barney', 'age': 36 }
+     *
+     * // with explicit chaining
+     * _(users).chain()
+     *   .first()
+     *   .pick('user')
+     *   .value();
+     * // => { 'user': 'barney' }
+     */
+    function wrapperChain() {
+      return chain(this);
+    }
+
+    /**
+     * Executes the chained sequence and returns the wrapped result.
+     *
+     * @name commit
+     * @memberOf _
+     * @category Chain
+     * @returns {Object} Returns the new `lodash` wrapper instance.
+     * @example
+     *
+     * var array = [1, 2];
+     * var wrapped = _(array).push(3);
+     *
+     * console.log(array);
+     * // => [1, 2]
+     *
+     * wrapped = wrapped.commit();
+     * console.log(array);
+     * // => [1, 2, 3]
+     *
+     * wrapped.last();
+     * // => 3
+     *
+     * console.log(array);
+     * // => [1, 2, 3]
+     */
+    function wrapperCommit() {
+      return new LodashWrapper(this.value(), this.__chain__);
+    }
+
+    /**
+     * Creates a new array joining a wrapped array with any additional arrays
+     * and/or values.
+     *
+     * @name concat
+     * @memberOf _
+     * @category Chain
+     * @param {...*} [values] The values to concatenate.
+     * @returns {Array} Returns the new concatenated array.
+     * @example
+     *
+     * var array = [1];
+     * var wrapped = _(array).concat(2, [3], [[4]]);
+     *
+     * console.log(wrapped.value());
+     * // => [1, 2, 3, [4]]
+     *
+     * console.log(array);
+     * // => [1]
+     */
+    var wrapperConcat = restParam(function(values) {
+      values = baseFlatten(values);
+      return this.thru(function(array) {
+        return arrayConcat(isArray(array) ? array : [toObject(array)], values);
+      });
+    });
+
+    /**
+     * Creates a clone of the chained sequence planting `value` as the wrapped value.
+     *
+     * @name plant
+     * @memberOf _
+     * @category Chain
+     * @returns {Object} Returns the new `lodash` wrapper instance.
+     * @example
+     *
+     * var array = [1, 2];
+     * var wrapped = _(array).map(function(value) {
+     *   return Math.pow(value, 2);
+     * });
+     *
+     * var other = [3, 4];
+     * var otherWrapped = wrapped.plant(other);
+     *
+     * otherWrapped.value();
+     * // => [9, 16]
+     *
+     * wrapped.value();
+     * // => [1, 4]
+     */
+    function wrapperPlant(value) {
+      var result,
+          parent = this;
+
+      while (parent instanceof baseLodash) {
+        var clone = wrapperClone(parent);
+        if (result) {
+          previous.__wrapped__ = clone;
+        } else {
+          result = clone;
+        }
+        var previous = clone;
+        parent = parent.__wrapped__;
+      }
+      previous.__wrapped__ = value;
+      return result;
+    }
+
+    /**
+     * Reverses the wrapped array so the first element becomes the last, the
+     * second element becomes the second to last, and so on.
+     *
+     * **Note:** This method mutates the wrapped array.
+     *
+     * @name reverse
+     * @memberOf _
+     * @category Chain
+     * @returns {Object} Returns the new reversed `lodash` wrapper instance.
+     * @example
+     *
+     * var array = [1, 2, 3];
+     *
+     * _(array).reverse().value()
+     * // => [3, 2, 1]
+     *
+     * console.log(array);
+     * // => [3, 2, 1]
+     */
+    function wrapperReverse() {
+      var value = this.__wrapped__;
+
+      var interceptor = function(value) {
+        return value.reverse();
+      };
+      if (value instanceof LazyWrapper) {
+        var wrapped = value;
+        if (this.__actions__.length) {
+          wrapped = new LazyWrapper(this);
+        }
+        wrapped = wrapped.reverse();
+        wrapped.__actions__.push({ 'func': thru, 'args': [interceptor], 'thisArg': undefined });
+        return new LodashWrapper(wrapped, this.__chain__);
+      }
+      return this.thru(interceptor);
+    }
+
+    /**
+     * Produces the result of coercing the unwrapped value to a string.
+     *
+     * @name toString
+     * @memberOf _
+     * @category Chain
+     * @returns {string} Returns the coerced string value.
+     * @example
+     *
+     * _([1, 2, 3]).toString();
+     * // => '1,2,3'
+     */
+    function wrapperToString() {
+      return (this.value() + '');
+    }
+
+    /**
+     * Executes the chained sequence to extract the unwrapped value.
+     *
+     * @name value
+     * @memberOf _
+     * @alias run, toJSON, valueOf
+     * @category Chain
+     * @returns {*} Returns the resolved unwrapped value.
+     * @example
+     *
+     * _([1, 2, 3]).value();
+     * // => [1, 2, 3]
+     */
+    function wrapperValue() {
+      return baseWrapperValue(this.__wrapped__, this.__actions__);
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Creates an array of elements corresponding to the given keys, or indexes,
+     * of `collection`. Keys may be specified as individual arguments or as arrays
+     * of keys.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {...(number|number[]|string|string[])} [props] The property names
+     *  or indexes of elements to pick, specified individually or in arrays.
+     * @returns {Array} Returns the new array of picked elements.
+     * @example
+     *
+     * _.at(['a', 'b', 'c'], [0, 2]);
+     * // => ['a', 'c']
+     *
+     * _.at(['barney', 'fred', 'pebbles'], 0, 2);
+     * // => ['barney', 'pebbles']
+     */
+    var at = restParam(function(collection, props) {
+      if (isArrayLike(collection)) {
+        collection = toIterable(collection);
+      }
+      return baseAt(collection, baseFlatten(props));
+    });
+
+    /**
+     * Creates an object composed of keys generated from the results of running
+     * each element of `collection` through `iteratee`. The corresponding value
+     * of each key is the number of times the key was returned by `iteratee`.
+     * The `iteratee` is bound to `thisArg` and invoked with three arguments:
+     * (value, index|key, collection).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [iteratee=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Object} Returns the composed aggregate object.
+     * @example
+     *
+     * _.countBy([4.3, 6.1, 6.4], function(n) {
+     *   return Math.floor(n);
+     * });
+     * // => { '4': 1, '6': 2 }
+     *
+     * _.countBy([4.3, 6.1, 6.4], function(n) {
+     *   return this.floor(n);
+     * }, Math);
+     * // => { '4': 1, '6': 2 }
+     *
+     * _.countBy(['one', 'two', 'three'], 'length');
+     * // => { '3': 2, '5': 1 }
+     */
+    var countBy = createAggregator(function(result, value, key) {
+      hasOwnProperty.call(result, key) ? ++result[key] : (result[key] = 1);
+    });
+
+    /**
+     * Checks if `predicate` returns truthy for **all** elements of `collection`.
+     * The predicate is bound to `thisArg` and invoked with three arguments:
+     * (value, index|key, collection).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @alias all
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {boolean} Returns `true` if all elements pass the predicate check,
+     *  else `false`.
+     * @example
+     *
+     * _.every([true, 1, null, 'yes'], Boolean);
+     * // => false
+     *
+     * var users = [
+     *   { 'user': 'barney', 'active': false },
+     *   { 'user': 'fred',   'active': false }
+     * ];
+     *
+     * // using the `_.matches` callback shorthand
+     * _.every(users, { 'user': 'barney', 'active': false });
+     * // => false
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.every(users, 'active', false);
+     * // => true
+     *
+     * // using the `_.property` callback shorthand
+     * _.every(users, 'active');
+     * // => false
+     */
+    function every(collection, predicate, thisArg) {
+      var func = isArray(collection) ? arrayEvery : baseEvery;
+      if (thisArg && isIterateeCall(collection, predicate, thisArg)) {
+        predicate = undefined;
+      }
+      if (typeof predicate != 'function' || thisArg !== undefined) {
+        predicate = getCallback(predicate, thisArg, 3);
+      }
+      return func(collection, predicate);
+    }
+
+    /**
+     * Iterates over elements of `collection`, returning an array of all elements
+     * `predicate` returns truthy for. The predicate is bound to `thisArg` and
+     * invoked with three arguments: (value, index|key, collection).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @alias select
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Array} Returns the new filtered array.
+     * @example
+     *
+     * _.filter([4, 5, 6], function(n) {
+     *   return n % 2 == 0;
+     * });
+     * // => [4, 6]
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36, 'active': true },
+     *   { 'user': 'fred',   'age': 40, 'active': false }
+     * ];
+     *
+     * // using the `_.matches` callback shorthand
+     * _.pluck(_.filter(users, { 'age': 36, 'active': true }), 'user');
+     * // => ['barney']
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.pluck(_.filter(users, 'active', false), 'user');
+     * // => ['fred']
+     *
+     * // using the `_.property` callback shorthand
+     * _.pluck(_.filter(users, 'active'), 'user');
+     * // => ['barney']
+     */
+    function filter(collection, predicate, thisArg) {
+      var func = isArray(collection) ? arrayFilter : baseFilter;
+      predicate = getCallback(predicate, thisArg, 3);
+      return func(collection, predicate);
+    }
+
+    /**
+     * Iterates over elements of `collection`, returning the first element
+     * `predicate` returns truthy for. The predicate is bound to `thisArg` and
+     * invoked with three arguments: (value, index|key, collection).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @alias detect
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to search.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {*} Returns the matched element, else `undefined`.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney',  'age': 36, 'active': true },
+     *   { 'user': 'fred',    'age': 40, 'active': false },
+     *   { 'user': 'pebbles', 'age': 1,  'active': true }
+     * ];
+     *
+     * _.result(_.find(users, function(chr) {
+     *   return chr.age < 40;
+     * }), 'user');
+     * // => 'barney'
+     *
+     * // using the `_.matches` callback shorthand
+     * _.result(_.find(users, { 'age': 1, 'active': true }), 'user');
+     * // => 'pebbles'
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.result(_.find(users, 'active', false), 'user');
+     * // => 'fred'
+     *
+     * // using the `_.property` callback shorthand
+     * _.result(_.find(users, 'active'), 'user');
+     * // => 'barney'
+     */
+    var find = createFind(baseEach);
+
+    /**
+     * This method is like `_.find` except that it iterates over elements of
+     * `collection` from right to left.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to search.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {*} Returns the matched element, else `undefined`.
+     * @example
+     *
+     * _.findLast([1, 2, 3, 4], function(n) {
+     *   return n % 2 == 1;
+     * });
+     * // => 3
+     */
+    var findLast = createFind(baseEachRight, true);
+
+    /**
+     * Performs a deep comparison between each element in `collection` and the
+     * source object, returning the first element that has equivalent property
+     * values.
+     *
+     * **Note:** This method supports comparing arrays, booleans, `Date` objects,
+     * numbers, `Object` objects, regexes, and strings. Objects are compared by
+     * their own, not inherited, enumerable properties. For comparing a single
+     * own or inherited property value see `_.matchesProperty`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to search.
+     * @param {Object} source The object of property values to match.
+     * @returns {*} Returns the matched element, else `undefined`.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36, 'active': true },
+     *   { 'user': 'fred',   'age': 40, 'active': false }
+     * ];
+     *
+     * _.result(_.findWhere(users, { 'age': 36, 'active': true }), 'user');
+     * // => 'barney'
+     *
+     * _.result(_.findWhere(users, { 'age': 40, 'active': false }), 'user');
+     * // => 'fred'
+     */
+    function findWhere(collection, source) {
+      return find(collection, baseMatches(source));
+    }
+
+    /**
+     * Iterates over elements of `collection` invoking `iteratee` for each element.
+     * The `iteratee` is bound to `thisArg` and invoked with three arguments:
+     * (value, index|key, collection). Iteratee functions may exit iteration early
+     * by explicitly returning `false`.
+     *
+     * **Note:** As with other "Collections" methods, objects with a "length" property
+     * are iterated like arrays. To avoid this behavior `_.forIn` or `_.forOwn`
+     * may be used for object iteration.
+     *
+     * @static
+     * @memberOf _
+     * @alias each
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Array|Object|string} Returns `collection`.
+     * @example
+     *
+     * _([1, 2]).forEach(function(n) {
+     *   console.log(n);
+     * }).value();
+     * // => logs each value from left to right and returns the array
+     *
+     * _.forEach({ 'a': 1, 'b': 2 }, function(n, key) {
+     *   console.log(n, key);
+     * });
+     * // => logs each value-key pair and returns the object (iteration order is not guaranteed)
+     */
+    var forEach = createForEach(arrayEach, baseEach);
+
+    /**
+     * This method is like `_.forEach` except that it iterates over elements of
+     * `collection` from right to left.
+     *
+     * @static
+     * @memberOf _
+     * @alias eachRight
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Array|Object|string} Returns `collection`.
+     * @example
+     *
+     * _([1, 2]).forEachRight(function(n) {
+     *   console.log(n);
+     * }).value();
+     * // => logs each value from right to left and returns the array
+     */
+    var forEachRight = createForEach(arrayEachRight, baseEachRight);
+
+    /**
+     * Creates an object composed of keys generated from the results of running
+     * each element of `collection` through `iteratee`. The corresponding value
+     * of each key is an array of the elements responsible for generating the key.
+     * The `iteratee` is bound to `thisArg` and invoked with three arguments:
+     * (value, index|key, collection).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [iteratee=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Object} Returns the composed aggregate object.
+     * @example
+     *
+     * _.groupBy([4.2, 6.1, 6.4], function(n) {
+     *   return Math.floor(n);
+     * });
+     * // => { '4': [4.2], '6': [6.1, 6.4] }
+     *
+     * _.groupBy([4.2, 6.1, 6.4], function(n) {
+     *   return this.floor(n);
+     * }, Math);
+     * // => { '4': [4.2], '6': [6.1, 6.4] }
+     *
+     * // using the `_.property` callback shorthand
+     * _.groupBy(['one', 'two', 'three'], 'length');
+     * // => { '3': ['one', 'two'], '5': ['three'] }
+     */
+    var groupBy = createAggregator(function(result, value, key) {
+      if (hasOwnProperty.call(result, key)) {
+        result[key].push(value);
+      } else {
+        result[key] = [value];
+      }
+    });
+
+    /**
+     * Checks if `target` is in `collection` using
+     * [`SameValueZero`](http://ecma-international.org/ecma-262/6.0/#sec-samevaluezero)
+     * for equality comparisons. If `fromIndex` is negative, it's used as the offset
+     * from the end of `collection`.
+     *
+     * @static
+     * @memberOf _
+     * @alias contains, include
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to search.
+     * @param {*} target The value to search for.
+     * @param {number} [fromIndex=0] The index to search from.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.reduce`.
+     * @returns {boolean} Returns `true` if a matching element is found, else `false`.
+     * @example
+     *
+     * _.includes([1, 2, 3], 1);
+     * // => true
+     *
+     * _.includes([1, 2, 3], 1, 2);
+     * // => false
+     *
+     * _.includes({ 'user': 'fred', 'age': 40 }, 'fred');
+     * // => true
+     *
+     * _.includes('pebbles', 'eb');
+     * // => true
+     */
+    function includes(collection, target, fromIndex, guard) {
+      var length = collection ? getLength(collection) : 0;
+      if (!isLength(length)) {
+        collection = values(collection);
+        length = collection.length;
+      }
+      if (typeof fromIndex != 'number' || (guard && isIterateeCall(target, fromIndex, guard))) {
+        fromIndex = 0;
+      } else {
+        fromIndex = fromIndex < 0 ? nativeMax(length + fromIndex, 0) : (fromIndex || 0);
+      }
+      return (typeof collection == 'string' || !isArray(collection) && isString(collection))
+        ? (fromIndex <= length && collection.indexOf(target, fromIndex) > -1)
+        : (!!length && getIndexOf(collection, target, fromIndex) > -1);
+    }
+
+    /**
+     * Creates an object composed of keys generated from the results of running
+     * each element of `collection` through `iteratee`. The corresponding value
+     * of each key is the last element responsible for generating the key. The
+     * iteratee function is bound to `thisArg` and invoked with three arguments:
+     * (value, index|key, collection).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [iteratee=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Object} Returns the composed aggregate object.
+     * @example
+     *
+     * var keyData = [
+     *   { 'dir': 'left', 'code': 97 },
+     *   { 'dir': 'right', 'code': 100 }
+     * ];
+     *
+     * _.indexBy(keyData, 'dir');
+     * // => { 'left': { 'dir': 'left', 'code': 97 }, 'right': { 'dir': 'right', 'code': 100 } }
+     *
+     * _.indexBy(keyData, function(object) {
+     *   return String.fromCharCode(object.code);
+     * });
+     * // => { 'a': { 'dir': 'left', 'code': 97 }, 'd': { 'dir': 'right', 'code': 100 } }
+     *
+     * _.indexBy(keyData, function(object) {
+     *   return this.fromCharCode(object.code);
+     * }, String);
+     * // => { 'a': { 'dir': 'left', 'code': 97 }, 'd': { 'dir': 'right', 'code': 100 } }
+     */
+    var indexBy = createAggregator(function(result, value, key) {
+      result[key] = value;
+    });
+
+    /**
+     * Invokes the method at `path` of each element in `collection`, returning
+     * an array of the results of each invoked method. Any additional arguments
+     * are provided to each invoked method. If `methodName` is a function it's
+     * invoked for, and `this` bound to, each element in `collection`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Array|Function|string} path The path of the method to invoke or
+     *  the function invoked per iteration.
+     * @param {...*} [args] The arguments to invoke the method with.
+     * @returns {Array} Returns the array of results.
+     * @example
+     *
+     * _.invoke([[5, 1, 7], [3, 2, 1]], 'sort');
+     * // => [[1, 5, 7], [1, 2, 3]]
+     *
+     * _.invoke([123, 456], String.prototype.split, '');
+     * // => [['1', '2', '3'], ['4', '5', '6']]
+     */
+    var invoke = restParam(function(collection, path, args) {
+      var index = -1,
+          isFunc = typeof path == 'function',
+          isProp = isKey(path),
+          result = isArrayLike(collection) ? Array(collection.length) : [];
+
+      baseEach(collection, function(value) {
+        var func = isFunc ? path : ((isProp && value != null) ? value[path] : undefined);
+        result[++index] = func ? func.apply(value, args) : invokePath(value, path, args);
+      });
+      return result;
+    });
+
+    /**
+     * Creates an array of values by running each element in `collection` through
+     * `iteratee`. The `iteratee` is bound to `thisArg` and invoked with three
+     * arguments: (value, index|key, collection).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * Many lodash methods are guarded to work as iteratees for methods like
+     * `_.every`, `_.filter`, `_.map`, `_.mapValues`, `_.reject`, and `_.some`.
+     *
+     * The guarded methods are:
+     * `ary`, `callback`, `chunk`, `clone`, `create`, `curry`, `curryRight`,
+     * `drop`, `dropRight`, `every`, `fill`, `flatten`, `invert`, `max`, `min`,
+     * `parseInt`, `slice`, `sortBy`, `take`, `takeRight`, `template`, `trim`,
+     * `trimLeft`, `trimRight`, `trunc`, `random`, `range`, `sample`, `some`,
+     * `sum`, `uniq`, and `words`
+     *
+     * @static
+     * @memberOf _
+     * @alias collect
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [iteratee=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Array} Returns the new mapped array.
+     * @example
+     *
+     * function timesThree(n) {
+     *   return n * 3;
+     * }
+     *
+     * _.map([1, 2], timesThree);
+     * // => [3, 6]
+     *
+     * _.map({ 'a': 1, 'b': 2 }, timesThree);
+     * // => [3, 6] (iteration order is not guaranteed)
+     *
+     * var users = [
+     *   { 'user': 'barney' },
+     *   { 'user': 'fred' }
+     * ];
+     *
+     * // using the `_.property` callback shorthand
+     * _.map(users, 'user');
+     * // => ['barney', 'fred']
+     */
+    function map(collection, iteratee, thisArg) {
+      var func = isArray(collection) ? arrayMap : baseMap;
+      iteratee = getCallback(iteratee, thisArg, 3);
+      return func(collection, iteratee);
+    }
+
+    /**
+     * Creates an array of elements split into two groups, the first of which
+     * contains elements `predicate` returns truthy for, while the second of which
+     * contains elements `predicate` returns falsey for. The predicate is bound
+     * to `thisArg` and invoked with three arguments: (value, index|key, collection).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Array} Returns the array of grouped elements.
+     * @example
+     *
+     * _.partition([1, 2, 3], function(n) {
+     *   return n % 2;
+     * });
+     * // => [[1, 3], [2]]
+     *
+     * _.partition([1.2, 2.3, 3.4], function(n) {
+     *   return this.floor(n) % 2;
+     * }, Math);
+     * // => [[1.2, 3.4], [2.3]]
+     *
+     * var users = [
+     *   { 'user': 'barney',  'age': 36, 'active': false },
+     *   { 'user': 'fred',    'age': 40, 'active': true },
+     *   { 'user': 'pebbles', 'age': 1,  'active': false }
+     * ];
+     *
+     * var mapper = function(array) {
+     *   return _.pluck(array, 'user');
+     * };
+     *
+     * // using the `_.matches` callback shorthand
+     * _.map(_.partition(users, { 'age': 1, 'active': false }), mapper);
+     * // => [['pebbles'], ['barney', 'fred']]
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.map(_.partition(users, 'active', false), mapper);
+     * // => [['barney', 'pebbles'], ['fred']]
+     *
+     * // using the `_.property` callback shorthand
+     * _.map(_.partition(users, 'active'), mapper);
+     * // => [['fred'], ['barney', 'pebbles']]
+     */
+    var partition = createAggregator(function(result, value, key) {
+      result[key ? 0 : 1].push(value);
+    }, function() { return [[], []]; });
+
+    /**
+     * Gets the property value of `path` from all elements in `collection`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Array|string} path The path of the property to pluck.
+     * @returns {Array} Returns the property values.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36 },
+     *   { 'user': 'fred',   'age': 40 }
+     * ];
+     *
+     * _.pluck(users, 'user');
+     * // => ['barney', 'fred']
+     *
+     * var userIndex = _.indexBy(users, 'user');
+     * _.pluck(userIndex, 'age');
+     * // => [36, 40] (iteration order is not guaranteed)
+     */
+    function pluck(collection, path) {
+      return map(collection, property(path));
+    }
+
+    /**
+     * Reduces `collection` to a value which is the accumulated result of running
+     * each element in `collection` through `iteratee`, where each successive
+     * invocation is supplied the return value of the previous. If `accumulator`
+     * is not provided the first element of `collection` is used as the initial
+     * value. The `iteratee` is bound to `thisArg` and invoked with four arguments:
+     * (accumulator, value, index|key, collection).
+     *
+     * Many lodash methods are guarded to work as iteratees for methods like
+     * `_.reduce`, `_.reduceRight`, and `_.transform`.
+     *
+     * The guarded methods are:
+     * `assign`, `defaults`, `defaultsDeep`, `includes`, `merge`, `sortByAll`,
+     * and `sortByOrder`
+     *
+     * @static
+     * @memberOf _
+     * @alias foldl, inject
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [accumulator] The initial value.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {*} Returns the accumulated value.
+     * @example
+     *
+     * _.reduce([1, 2], function(total, n) {
+     *   return total + n;
+     * });
+     * // => 3
+     *
+     * _.reduce({ 'a': 1, 'b': 2 }, function(result, n, key) {
+     *   result[key] = n * 3;
+     *   return result;
+     * }, {});
+     * // => { 'a': 3, 'b': 6 } (iteration order is not guaranteed)
+     */
+    var reduce = createReduce(arrayReduce, baseEach);
+
+    /**
+     * This method is like `_.reduce` except that it iterates over elements of
+     * `collection` from right to left.
+     *
+     * @static
+     * @memberOf _
+     * @alias foldr
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [accumulator] The initial value.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {*} Returns the accumulated value.
+     * @example
+     *
+     * var array = [[0, 1], [2, 3], [4, 5]];
+     *
+     * _.reduceRight(array, function(flattened, other) {
+     *   return flattened.concat(other);
+     * }, []);
+     * // => [4, 5, 2, 3, 0, 1]
+     */
+    var reduceRight = createReduce(arrayReduceRight, baseEachRight);
+
+    /**
+     * The opposite of `_.filter`; this method returns the elements of `collection`
+     * that `predicate` does **not** return truthy for.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Array} Returns the new filtered array.
+     * @example
+     *
+     * _.reject([1, 2, 3, 4], function(n) {
+     *   return n % 2 == 0;
+     * });
+     * // => [1, 3]
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36, 'active': false },
+     *   { 'user': 'fred',   'age': 40, 'active': true }
+     * ];
+     *
+     * // using the `_.matches` callback shorthand
+     * _.pluck(_.reject(users, { 'age': 40, 'active': true }), 'user');
+     * // => ['barney']
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.pluck(_.reject(users, 'active', false), 'user');
+     * // => ['fred']
+     *
+     * // using the `_.property` callback shorthand
+     * _.pluck(_.reject(users, 'active'), 'user');
+     * // => ['barney']
+     */
+    function reject(collection, predicate, thisArg) {
+      var func = isArray(collection) ? arrayFilter : baseFilter;
+      predicate = getCallback(predicate, thisArg, 3);
+      return func(collection, function(value, index, collection) {
+        return !predicate(value, index, collection);
+      });
+    }
+
+    /**
+     * Gets a random element or `n` random elements from a collection.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to sample.
+     * @param {number} [n] The number of elements to sample.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {*} Returns the random sample(s).
+     * @example
+     *
+     * _.sample([1, 2, 3, 4]);
+     * // => 2
+     *
+     * _.sample([1, 2, 3, 4], 2);
+     * // => [3, 1]
+     */
+    function sample(collection, n, guard) {
+      if (guard ? isIterateeCall(collection, n, guard) : n == null) {
+        collection = toIterable(collection);
+        var length = collection.length;
+        return length > 0 ? collection[baseRandom(0, length - 1)] : undefined;
+      }
+      var index = -1,
+          result = toArray(collection),
+          length = result.length,
+          lastIndex = length - 1;
+
+      n = nativeMin(n < 0 ? 0 : (+n || 0), length);
+      while (++index < n) {
+        var rand = baseRandom(index, lastIndex),
+            value = result[rand];
+
+        result[rand] = result[index];
+        result[index] = value;
+      }
+      result.length = n;
+      return result;
+    }
+
+    /**
+     * Creates an array of shuffled values, using a version of the
+     * [Fisher-Yates shuffle](https://en.wikipedia.org/wiki/Fisher-Yates_shuffle).
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to shuffle.
+     * @returns {Array} Returns the new shuffled array.
+     * @example
+     *
+     * _.shuffle([1, 2, 3, 4]);
+     * // => [4, 1, 3, 2]
+     */
+    function shuffle(collection) {
+      return sample(collection, POSITIVE_INFINITY);
+    }
+
+    /**
+     * Gets the size of `collection` by returning its length for array-like
+     * values or the number of own enumerable properties for objects.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to inspect.
+     * @returns {number} Returns the size of `collection`.
+     * @example
+     *
+     * _.size([1, 2, 3]);
+     * // => 3
+     *
+     * _.size({ 'a': 1, 'b': 2 });
+     * // => 2
+     *
+     * _.size('pebbles');
+     * // => 7
+     */
+    function size(collection) {
+      var length = collection ? getLength(collection) : 0;
+      return isLength(length) ? length : keys(collection).length;
+    }
+
+    /**
+     * Checks if `predicate` returns truthy for **any** element of `collection`.
+     * The function returns as soon as it finds a passing value and does not iterate
+     * over the entire collection. The predicate is bound to `thisArg` and invoked
+     * with three arguments: (value, index|key, collection).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @alias any
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {boolean} Returns `true` if any element passes the predicate check,
+     *  else `false`.
+     * @example
+     *
+     * _.some([null, 0, 'yes', false], Boolean);
+     * // => true
+     *
+     * var users = [
+     *   { 'user': 'barney', 'active': true },
+     *   { 'user': 'fred',   'active': false }
+     * ];
+     *
+     * // using the `_.matches` callback shorthand
+     * _.some(users, { 'user': 'barney', 'active': false });
+     * // => false
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.some(users, 'active', false);
+     * // => true
+     *
+     * // using the `_.property` callback shorthand
+     * _.some(users, 'active');
+     * // => true
+     */
+    function some(collection, predicate, thisArg) {
+      var func = isArray(collection) ? arraySome : baseSome;
+      if (thisArg && isIterateeCall(collection, predicate, thisArg)) {
+        predicate = undefined;
+      }
+      if (typeof predicate != 'function' || thisArg !== undefined) {
+        predicate = getCallback(predicate, thisArg, 3);
+      }
+      return func(collection, predicate);
+    }
+
+    /**
+     * Creates an array of elements, sorted in ascending order by the results of
+     * running each element in a collection through `iteratee`. This method performs
+     * a stable sort, that is, it preserves the original sort order of equal elements.
+     * The `iteratee` is bound to `thisArg` and invoked with three arguments:
+     * (value, index|key, collection).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [iteratee=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Array} Returns the new sorted array.
+     * @example
+     *
+     * _.sortBy([1, 2, 3], function(n) {
+     *   return Math.sin(n);
+     * });
+     * // => [3, 1, 2]
+     *
+     * _.sortBy([1, 2, 3], function(n) {
+     *   return this.sin(n);
+     * }, Math);
+     * // => [3, 1, 2]
+     *
+     * var users = [
+     *   { 'user': 'fred' },
+     *   { 'user': 'pebbles' },
+     *   { 'user': 'barney' }
+     * ];
+     *
+     * // using the `_.property` callback shorthand
+     * _.pluck(_.sortBy(users, 'user'), 'user');
+     * // => ['barney', 'fred', 'pebbles']
+     */
+    function sortBy(collection, iteratee, thisArg) {
+      if (collection == null) {
+        return [];
+      }
+      if (thisArg && isIterateeCall(collection, iteratee, thisArg)) {
+        iteratee = undefined;
+      }
+      var index = -1;
+      iteratee = getCallback(iteratee, thisArg, 3);
+
+      var result = baseMap(collection, function(value, key, collection) {
+        return { 'criteria': iteratee(value, key, collection), 'index': ++index, 'value': value };
+      });
+      return baseSortBy(result, compareAscending);
+    }
+
+    /**
+     * This method is like `_.sortBy` except that it can sort by multiple iteratees
+     * or property names.
+     *
+     * If a property name is provided for an iteratee the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If an object is provided for an iteratee the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {...(Function|Function[]|Object|Object[]|string|string[])} iteratees
+     *  The iteratees to sort by, specified as individual values or arrays of values.
+     * @returns {Array} Returns the new sorted array.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'fred',   'age': 48 },
+     *   { 'user': 'barney', 'age': 36 },
+     *   { 'user': 'fred',   'age': 42 },
+     *   { 'user': 'barney', 'age': 34 }
+     * ];
+     *
+     * _.map(_.sortByAll(users, ['user', 'age']), _.values);
+     * // => [['barney', 34], ['barney', 36], ['fred', 42], ['fred', 48]]
+     *
+     * _.map(_.sortByAll(users, 'user', function(chr) {
+     *   return Math.floor(chr.age / 10);
+     * }), _.values);
+     * // => [['barney', 36], ['barney', 34], ['fred', 48], ['fred', 42]]
+     */
+    var sortByAll = restParam(function(collection, iteratees) {
+      if (collection == null) {
+        return [];
+      }
+      var guard = iteratees[2];
+      if (guard && isIterateeCall(iteratees[0], iteratees[1], guard)) {
+        iteratees.length = 1;
+      }
+      return baseSortByOrder(collection, baseFlatten(iteratees), []);
+    });
+
+    /**
+     * This method is like `_.sortByAll` except that it allows specifying the
+     * sort orders of the iteratees to sort by. If `orders` is unspecified, all
+     * values are sorted in ascending order. Otherwise, a value is sorted in
+     * ascending order if its corresponding order is "asc", and descending if "desc".
+     *
+     * If a property name is provided for an iteratee the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If an object is provided for an iteratee the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function[]|Object[]|string[]} iteratees The iteratees to sort by.
+     * @param {boolean[]} [orders] The sort orders of `iteratees`.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.reduce`.
+     * @returns {Array} Returns the new sorted array.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'fred',   'age': 48 },
+     *   { 'user': 'barney', 'age': 34 },
+     *   { 'user': 'fred',   'age': 42 },
+     *   { 'user': 'barney', 'age': 36 }
+     * ];
+     *
+     * // sort by `user` in ascending order and by `age` in descending order
+     * _.map(_.sortByOrder(users, ['user', 'age'], ['asc', 'desc']), _.values);
+     * // => [['barney', 36], ['barney', 34], ['fred', 48], ['fred', 42]]
+     */
+    function sortByOrder(collection, iteratees, orders, guard) {
+      if (collection == null) {
+        return [];
+      }
+      if (guard && isIterateeCall(iteratees, orders, guard)) {
+        orders = undefined;
+      }
+      if (!isArray(iteratees)) {
+        iteratees = iteratees == null ? [] : [iteratees];
+      }
+      if (!isArray(orders)) {
+        orders = orders == null ? [] : [orders];
+      }
+      return baseSortByOrder(collection, iteratees, orders);
+    }
+
+    /**
+     * Performs a deep comparison between each element in `collection` and the
+     * source object, returning an array of all elements that have equivalent
+     * property values.
+     *
+     * **Note:** This method supports comparing arrays, booleans, `Date` objects,
+     * numbers, `Object` objects, regexes, and strings. Objects are compared by
+     * their own, not inherited, enumerable properties. For comparing a single
+     * own or inherited property value see `_.matchesProperty`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to search.
+     * @param {Object} source The object of property values to match.
+     * @returns {Array} Returns the new filtered array.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36, 'active': false, 'pets': ['hoppy'] },
+     *   { 'user': 'fred',   'age': 40, 'active': true, 'pets': ['baby puss', 'dino'] }
+     * ];
+     *
+     * _.pluck(_.where(users, { 'age': 36, 'active': false }), 'user');
+     * // => ['barney']
+     *
+     * _.pluck(_.where(users, { 'pets': ['dino'] }), 'user');
+     * // => ['fred']
+     */
+    function where(collection, source) {
+      return filter(collection, baseMatches(source));
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Gets the number of milliseconds that have elapsed since the Unix epoch
+     * (1 January 1970 00:00:00 UTC).
+     *
+     * @static
+     * @memberOf _
+     * @category Date
+     * @example
+     *
+     * _.defer(function(stamp) {
+     *   console.log(_.now() - stamp);
+     * }, _.now());
+     * // => logs the number of milliseconds it took for the deferred function to be invoked
+     */
+    var now = nativeNow || function() {
+      return new Date().getTime();
+    };
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * The opposite of `_.before`; this method creates a function that invokes
+     * `func` once it's called `n` or more times.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {number} n The number of calls before `func` is invoked.
+     * @param {Function} func The function to restrict.
+     * @returns {Function} Returns the new restricted function.
+     * @example
+     *
+     * var saves = ['profile', 'settings'];
+     *
+     * var done = _.after(saves.length, function() {
+     *   console.log('done saving!');
+     * });
+     *
+     * _.forEach(saves, function(type) {
+     *   asyncSave({ 'type': type, 'complete': done });
+     * });
+     * // => logs 'done saving!' after the two async saves have completed
+     */
+    function after(n, func) {
+      if (typeof func != 'function') {
+        if (typeof n == 'function') {
+          var temp = n;
+          n = func;
+          func = temp;
+        } else {
+          throw new TypeError(FUNC_ERROR_TEXT);
+        }
+      }
+      n = nativeIsFinite(n = +n) ? n : 0;
+      return function() {
+        if (--n < 1) {
+          return func.apply(this, arguments);
+        }
+      };
+    }
+
+    /**
+     * Creates a function that accepts up to `n` arguments ignoring any
+     * additional arguments.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to cap arguments for.
+     * @param {number} [n=func.length] The arity cap.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * _.map(['6', '8', '10'], _.ary(parseInt, 1));
+     * // => [6, 8, 10]
+     */
+    function ary(func, n, guard) {
+      if (guard && isIterateeCall(func, n, guard)) {
+        n = undefined;
+      }
+      n = (func && n == null) ? func.length : nativeMax(+n || 0, 0);
+      return createWrapper(func, ARY_FLAG, undefined, undefined, undefined, undefined, n);
+    }
+
+    /**
+     * Creates a function that invokes `func`, with the `this` binding and arguments
+     * of the created function, while it's called less than `n` times. Subsequent
+     * calls to the created function return the result of the last `func` invocation.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {number} n The number of calls at which `func` is no longer invoked.
+     * @param {Function} func The function to restrict.
+     * @returns {Function} Returns the new restricted function.
+     * @example
+     *
+     * jQuery('#add').on('click', _.before(5, addContactToList));
+     * // => allows adding up to 4 contacts to the list
+     */
+    function before(n, func) {
+      var result;
+      if (typeof func != 'function') {
+        if (typeof n == 'function') {
+          var temp = n;
+          n = func;
+          func = temp;
+        } else {
+          throw new TypeError(FUNC_ERROR_TEXT);
+        }
+      }
+      return function() {
+        if (--n > 0) {
+          result = func.apply(this, arguments);
+        }
+        if (n <= 1) {
+          func = undefined;
+        }
+        return result;
+      };
+    }
+
+    /**
+     * Creates a function that invokes `func` with the `this` binding of `thisArg`
+     * and prepends any additional `_.bind` arguments to those provided to the
+     * bound function.
+     *
+     * The `_.bind.placeholder` value, which defaults to `_` in monolithic builds,
+     * may be used as a placeholder for partially applied arguments.
+     *
+     * **Note:** Unlike native `Function#bind` this method does not set the "length"
+     * property of bound functions.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to bind.
+     * @param {*} thisArg The `this` binding of `func`.
+     * @param {...*} [partials] The arguments to be partially applied.
+     * @returns {Function} Returns the new bound function.
+     * @example
+     *
+     * var greet = function(greeting, punctuation) {
+     *   return greeting + ' ' + this.user + punctuation;
+     * };
+     *
+     * var object = { 'user': 'fred' };
+     *
+     * var bound = _.bind(greet, object, 'hi');
+     * bound('!');
+     * // => 'hi fred!'
+     *
+     * // using placeholders
+     * var bound = _.bind(greet, object, _, '!');
+     * bound('hi');
+     * // => 'hi fred!'
+     */
+    var bind = restParam(function(func, thisArg, partials) {
+      var bitmask = BIND_FLAG;
+      if (partials.length) {
+        var holders = replaceHolders(partials, bind.placeholder);
+        bitmask |= PARTIAL_FLAG;
+      }
+      return createWrapper(func, bitmask, thisArg, partials, holders);
+    });
+
+    /**
+     * Binds methods of an object to the object itself, overwriting the existing
+     * method. Method names may be specified as individual arguments or as arrays
+     * of method names. If no method names are provided all enumerable function
+     * properties, own and inherited, of `object` are bound.
+     *
+     * **Note:** This method does not set the "length" property of bound functions.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Object} object The object to bind and assign the bound methods to.
+     * @param {...(string|string[])} [methodNames] The object method names to bind,
+     *  specified as individual method names or arrays of method names.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * var view = {
+     *   'label': 'docs',
+     *   'onClick': function() {
+     *     console.log('clicked ' + this.label);
+     *   }
+     * };
+     *
+     * _.bindAll(view);
+     * jQuery('#docs').on('click', view.onClick);
+     * // => logs 'clicked docs' when the element is clicked
+     */
+    var bindAll = restParam(function(object, methodNames) {
+      methodNames = methodNames.length ? baseFlatten(methodNames) : functions(object);
+
+      var index = -1,
+          length = methodNames.length;
+
+      while (++index < length) {
+        var key = methodNames[index];
+        object[key] = createWrapper(object[key], BIND_FLAG, object);
+      }
+      return object;
+    });
+
+    /**
+     * Creates a function that invokes the method at `object[key]` and prepends
+     * any additional `_.bindKey` arguments to those provided to the bound function.
+     *
+     * This method differs from `_.bind` by allowing bound functions to reference
+     * methods that may be redefined or don't yet exist.
+     * See [Peter Michaux's article](http://peter.michaux.ca/articles/lazy-function-definition-pattern)
+     * for more details.
+     *
+     * The `_.bindKey.placeholder` value, which defaults to `_` in monolithic
+     * builds, may be used as a placeholder for partially applied arguments.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Object} object The object the method belongs to.
+     * @param {string} key The key of the method.
+     * @param {...*} [partials] The arguments to be partially applied.
+     * @returns {Function} Returns the new bound function.
+     * @example
+     *
+     * var object = {
+     *   'user': 'fred',
+     *   'greet': function(greeting, punctuation) {
+     *     return greeting + ' ' + this.user + punctuation;
+     *   }
+     * };
+     *
+     * var bound = _.bindKey(object, 'greet', 'hi');
+     * bound('!');
+     * // => 'hi fred!'
+     *
+     * object.greet = function(greeting, punctuation) {
+     *   return greeting + 'ya ' + this.user + punctuation;
+     * };
+     *
+     * bound('!');
+     * // => 'hiya fred!'
+     *
+     * // using placeholders
+     * var bound = _.bindKey(object, 'greet', _, '!');
+     * bound('hi');
+     * // => 'hiya fred!'
+     */
+    var bindKey = restParam(function(object, key, partials) {
+      var bitmask = BIND_FLAG | BIND_KEY_FLAG;
+      if (partials.length) {
+        var holders = replaceHolders(partials, bindKey.placeholder);
+        bitmask |= PARTIAL_FLAG;
+      }
+      return createWrapper(key, bitmask, object, partials, holders);
+    });
+
+    /**
+     * Creates a function that accepts one or more arguments of `func` that when
+     * called either invokes `func` returning its result, if all `func` arguments
+     * have been provided, or returns a function that accepts one or more of the
+     * remaining `func` arguments, and so on. The arity of `func` may be specified
+     * if `func.length` is not sufficient.
+     *
+     * The `_.curry.placeholder` value, which defaults to `_` in monolithic builds,
+     * may be used as a placeholder for provided arguments.
+     *
+     * **Note:** This method does not set the "length" property of curried functions.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to curry.
+     * @param {number} [arity=func.length] The arity of `func`.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Function} Returns the new curried function.
+     * @example
+     *
+     * var abc = function(a, b, c) {
+     *   return [a, b, c];
+     * };
+     *
+     * var curried = _.curry(abc);
+     *
+     * curried(1)(2)(3);
+     * // => [1, 2, 3]
+     *
+     * curried(1, 2)(3);
+     * // => [1, 2, 3]
+     *
+     * curried(1, 2, 3);
+     * // => [1, 2, 3]
+     *
+     * // using placeholders
+     * curried(1)(_, 3)(2);
+     * // => [1, 2, 3]
+     */
+    var curry = createCurry(CURRY_FLAG);
+
+    /**
+     * This method is like `_.curry` except that arguments are applied to `func`
+     * in the manner of `_.partialRight` instead of `_.partial`.
+     *
+     * The `_.curryRight.placeholder` value, which defaults to `_` in monolithic
+     * builds, may be used as a placeholder for provided arguments.
+     *
+     * **Note:** This method does not set the "length" property of curried functions.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to curry.
+     * @param {number} [arity=func.length] The arity of `func`.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Function} Returns the new curried function.
+     * @example
+     *
+     * var abc = function(a, b, c) {
+     *   return [a, b, c];
+     * };
+     *
+     * var curried = _.curryRight(abc);
+     *
+     * curried(3)(2)(1);
+     * // => [1, 2, 3]
+     *
+     * curried(2, 3)(1);
+     * // => [1, 2, 3]
+     *
+     * curried(1, 2, 3);
+     * // => [1, 2, 3]
+     *
+     * // using placeholders
+     * curried(3)(1, _)(2);
+     * // => [1, 2, 3]
+     */
+    var curryRight = createCurry(CURRY_RIGHT_FLAG);
+
+    /**
+     * Creates a debounced function that delays invoking `func` until after `wait`
+     * milliseconds have elapsed since the last time the debounced function was
+     * invoked. The debounced function comes with a `cancel` method to cancel
+     * delayed invocations. Provide an options object to indicate that `func`
+     * should be invoked on the leading and/or trailing edge of the `wait` timeout.
+     * Subsequent calls to the debounced function return the result of the last
+     * `func` invocation.
+     *
+     * **Note:** If `leading` and `trailing` options are `true`, `func` is invoked
+     * on the trailing edge of the timeout only if the the debounced function is
+     * invoked more than once during the `wait` timeout.
+     *
+     * See [David Corbacho's article](http://drupalmotion.com/article/debounce-and-throttle-visual-explanation)
+     * for details over the differences between `_.debounce` and `_.throttle`.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to debounce.
+     * @param {number} [wait=0] The number of milliseconds to delay.
+     * @param {Object} [options] The options object.
+     * @param {boolean} [options.leading=false] Specify invoking on the leading
+     *  edge of the timeout.
+     * @param {number} [options.maxWait] The maximum time `func` is allowed to be
+     *  delayed before it's invoked.
+     * @param {boolean} [options.trailing=true] Specify invoking on the trailing
+     *  edge of the timeout.
+     * @returns {Function} Returns the new debounced function.
+     * @example
+     *
+     * // avoid costly calculations while the window size is in flux
+     * jQuery(window).on('resize', _.debounce(calculateLayout, 150));
+     *
+     * // invoke `sendMail` when the click event is fired, debouncing subsequent calls
+     * jQuery('#postbox').on('click', _.debounce(sendMail, 300, {
+     *   'leading': true,
+     *   'trailing': false
+     * }));
+     *
+     * // ensure `batchLog` is invoked once after 1 second of debounced calls
+     * var source = new EventSource('/stream');
+     * jQuery(source).on('message', _.debounce(batchLog, 250, {
+     *   'maxWait': 1000
+     * }));
+     *
+     * // cancel a debounced call
+     * var upcomingChanges = _.debounce(batchLog, 1000);
+     * Object.observe(models.todo, upcomingChanges);
+     *
+     * Object.observe(models, function(changes) {
+     *   if (_.find(changes, { 'user': 'todo', 'type': 'delete'})) {
+     *     upcomingChanges.cancel();
+     *   }
+     * }, ['delete']);
+     *
+     * // ...at some point `models.todo` is changed
+     * models.todo.completed = true;
+     *
+     * // ...before 1 second has passed `models.todo` is deleted
+     * // which cancels the debounced `upcomingChanges` call
+     * delete models.todo;
+     */
+    function debounce(func, wait, options) {
+      var args,
+          maxTimeoutId,
+          result,
+          stamp,
+          thisArg,
+          timeoutId,
+          trailingCall,
+          lastCalled = 0,
+          maxWait = false,
+          trailing = true;
+
+      if (typeof func != 'function') {
+        throw new TypeError(FUNC_ERROR_TEXT);
+      }
+      wait = wait < 0 ? 0 : (+wait || 0);
+      if (options === true) {
+        var leading = true;
+        trailing = false;
+      } else if (isObject(options)) {
+        leading = !!options.leading;
+        maxWait = 'maxWait' in options && nativeMax(+options.maxWait || 0, wait);
+        trailing = 'trailing' in options ? !!options.trailing : trailing;
+      }
+
+      function cancel() {
+        if (timeoutId) {
+          clearTimeout(timeoutId);
+        }
+        if (maxTimeoutId) {
+          clearTimeout(maxTimeoutId);
+        }
+        lastCalled = 0;
+        maxTimeoutId = timeoutId = trailingCall = undefined;
+      }
+
+      function complete(isCalled, id) {
+        if (id) {
+          clearTimeout(id);
+        }
+        maxTimeoutId = timeoutId = trailingCall = undefined;
+        if (isCalled) {
+          lastCalled = now();
+          result = func.apply(thisArg, args);
+          if (!timeoutId && !maxTimeoutId) {
+            args = thisArg = undefined;
+          }
+        }
+      }
+
+      function delayed() {
+        var remaining = wait - (now() - stamp);
+        if (remaining <= 0 || remaining > wait) {
+          complete(trailingCall, maxTimeoutId);
+        } else {
+          timeoutId = setTimeout(delayed, remaining);
+        }
+      }
+
+      function maxDelayed() {
+        complete(trailing, timeoutId);
+      }
+
+      function debounced() {
+        args = arguments;
+        stamp = now();
+        thisArg = this;
+        trailingCall = trailing && (timeoutId || !leading);
+
+        if (maxWait === false) {
+          var leadingCall = leading && !timeoutId;
+        } else {
+          if (!maxTimeoutId && !leading) {
+            lastCalled = stamp;
+          }
+          var remaining = maxWait - (stamp - lastCalled),
+              isCalled = remaining <= 0 || remaining > maxWait;
+
+          if (isCalled) {
+            if (maxTimeoutId) {
+              maxTimeoutId = clearTimeout(maxTimeoutId);
+            }
+            lastCalled = stamp;
+            result = func.apply(thisArg, args);
+          }
+          else if (!maxTimeoutId) {
+            maxTimeoutId = setTimeout(maxDelayed, remaining);
+          }
+        }
+        if (isCalled && timeoutId) {
+          timeoutId = clearTimeout(timeoutId);
+        }
+        else if (!timeoutId && wait !== maxWait) {
+          timeoutId = setTimeout(delayed, wait);
+        }
+        if (leadingCall) {
+          isCalled = true;
+          result = func.apply(thisArg, args);
+        }
+        if (isCalled && !timeoutId && !maxTimeoutId) {
+          args = thisArg = undefined;
+        }
+        return result;
+      }
+      debounced.cancel = cancel;
+      return debounced;
+    }
+
+    /**
+     * Defers invoking the `func` until the current call stack has cleared. Any
+     * additional arguments are provided to `func` when it's invoked.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to defer.
+     * @param {...*} [args] The arguments to invoke the function with.
+     * @returns {number} Returns the timer id.
+     * @example
+     *
+     * _.defer(function(text) {
+     *   console.log(text);
+     * }, 'deferred');
+     * // logs 'deferred' after one or more milliseconds
+     */
+    var defer = restParam(function(func, args) {
+      return baseDelay(func, 1, args);
+    });
+
+    /**
+     * Invokes `func` after `wait` milliseconds. Any additional arguments are
+     * provided to `func` when it's invoked.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to delay.
+     * @param {number} wait The number of milliseconds to delay invocation.
+     * @param {...*} [args] The arguments to invoke the function with.
+     * @returns {number} Returns the timer id.
+     * @example
+     *
+     * _.delay(function(text) {
+     *   console.log(text);
+     * }, 1000, 'later');
+     * // => logs 'later' after one second
+     */
+    var delay = restParam(function(func, wait, args) {
+      return baseDelay(func, wait, args);
+    });
+
+    /**
+     * Creates a function that returns the result of invoking the provided
+     * functions with the `this` binding of the created function, where each
+     * successive invocation is supplied the return value of the previous.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {...Function} [funcs] Functions to invoke.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * function square(n) {
+     *   return n * n;
+     * }
+     *
+     * var addSquare = _.flow(_.add, square);
+     * addSquare(1, 2);
+     * // => 9
+     */
+    var flow = createFlow();
+
+    /**
+     * This method is like `_.flow` except that it creates a function that
+     * invokes the provided functions from right to left.
+     *
+     * @static
+     * @memberOf _
+     * @alias backflow, compose
+     * @category Function
+     * @param {...Function} [funcs] Functions to invoke.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * function square(n) {
+     *   return n * n;
+     * }
+     *
+     * var addSquare = _.flowRight(square, _.add);
+     * addSquare(1, 2);
+     * // => 9
+     */
+    var flowRight = createFlow(true);
+
+    /**
+     * Creates a function that memoizes the result of `func`. If `resolver` is
+     * provided it determines the cache key for storing the result based on the
+     * arguments provided to the memoized function. By default, the first argument
+     * provided to the memoized function is coerced to a string and used as the
+     * cache key. The `func` is invoked with the `this` binding of the memoized
+     * function.
+     *
+     * **Note:** The cache is exposed as the `cache` property on the memoized
+     * function. Its creation may be customized by replacing the `_.memoize.Cache`
+     * constructor with one whose instances implement the [`Map`](http://ecma-international.org/ecma-262/6.0/#sec-properties-of-the-map-prototype-object)
+     * method interface of `get`, `has`, and `set`.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to have its output memoized.
+     * @param {Function} [resolver] The function to resolve the cache key.
+     * @returns {Function} Returns the new memoizing function.
+     * @example
+     *
+     * var upperCase = _.memoize(function(string) {
+     *   return string.toUpperCase();
+     * });
+     *
+     * upperCase('fred');
+     * // => 'FRED'
+     *
+     * // modifying the result cache
+     * upperCase.cache.set('fred', 'BARNEY');
+     * upperCase('fred');
+     * // => 'BARNEY'
+     *
+     * // replacing `_.memoize.Cache`
+     * var object = { 'user': 'fred' };
+     * var other = { 'user': 'barney' };
+     * var identity = _.memoize(_.identity);
+     *
+     * identity(object);
+     * // => { 'user': 'fred' }
+     * identity(other);
+     * // => { 'user': 'fred' }
+     *
+     * _.memoize.Cache = WeakMap;
+     * var identity = _.memoize(_.identity);
+     *
+     * identity(object);
+     * // => { 'user': 'fred' }
+     * identity(other);
+     * // => { 'user': 'barney' }
+     */
+    function memoize(func, resolver) {
+      if (typeof func != 'function' || (resolver && typeof resolver != 'function')) {
+        throw new TypeError(FUNC_ERROR_TEXT);
+      }
+      var memoized = function() {
+        var args = arguments,
+            key = resolver ? resolver.apply(this, args) : args[0],
+            cache = memoized.cache;
+
+        if (cache.has(key)) {
+          return cache.get(key);
+        }
+        var result = func.apply(this, args);
+        memoized.cache = cache.set(key, result);
+        return result;
+      };
+      memoized.cache = new memoize.Cache;
+      return memoized;
+    }
+
+    /**
+     * Creates a function that runs each argument through a corresponding
+     * transform function.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to wrap.
+     * @param {...(Function|Function[])} [transforms] The functions to transform
+     * arguments, specified as individual functions or arrays of functions.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * function doubled(n) {
+     *   return n * 2;
+     * }
+     *
+     * function square(n) {
+     *   return n * n;
+     * }
+     *
+     * var modded = _.modArgs(function(x, y) {
+     *   return [x, y];
+     * }, square, doubled);
+     *
+     * modded(1, 2);
+     * // => [1, 4]
+     *
+     * modded(5, 10);
+     * // => [25, 20]
+     */
+    var modArgs = restParam(function(func, transforms) {
+      transforms = baseFlatten(transforms);
+      if (typeof func != 'function' || !arrayEvery(transforms, baseIsFunction)) {
+        throw new TypeError(FUNC_ERROR_TEXT);
+      }
+      var length = transforms.length;
+      return restParam(function(args) {
+        var index = nativeMin(args.length, length);
+        while (index--) {
+          args[index] = transforms[index](args[index]);
+        }
+        return func.apply(this, args);
+      });
+    });
+
+    /**
+     * Creates a function that negates the result of the predicate `func`. The
+     * `func` predicate is invoked with the `this` binding and arguments of the
+     * created function.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} predicate The predicate to negate.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * function isEven(n) {
+     *   return n % 2 == 0;
+     * }
+     *
+     * _.filter([1, 2, 3, 4, 5, 6], _.negate(isEven));
+     * // => [1, 3, 5]
+     */
+    function negate(predicate) {
+      if (typeof predicate != 'function') {
+        throw new TypeError(FUNC_ERROR_TEXT);
+      }
+      return function() {
+        return !predicate.apply(this, arguments);
+      };
+    }
+
+    /**
+     * Creates a function that is restricted to invoking `func` once. Repeat calls
+     * to the function return the value of the first call. The `func` is invoked
+     * with the `this` binding and arguments of the created function.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to restrict.
+     * @returns {Function} Returns the new restricted function.
+     * @example
+     *
+     * var initialize = _.once(createApplication);
+     * initialize();
+     * initialize();
+     * // `initialize` invokes `createApplication` once
+     */
+    function once(func) {
+      return before(2, func);
+    }
+
+    /**
+     * Creates a function that invokes `func` with `partial` arguments prepended
+     * to those provided to the new function. This method is like `_.bind` except
+     * it does **not** alter the `this` binding.
+     *
+     * The `_.partial.placeholder` value, which defaults to `_` in monolithic
+     * builds, may be used as a placeholder for partially applied arguments.
+     *
+     * **Note:** This method does not set the "length" property of partially
+     * applied functions.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to partially apply arguments to.
+     * @param {...*} [partials] The arguments to be partially applied.
+     * @returns {Function} Returns the new partially applied function.
+     * @example
+     *
+     * var greet = function(greeting, name) {
+     *   return greeting + ' ' + name;
+     * };
+     *
+     * var sayHelloTo = _.partial(greet, 'hello');
+     * sayHelloTo('fred');
+     * // => 'hello fred'
+     *
+     * // using placeholders
+     * var greetFred = _.partial(greet, _, 'fred');
+     * greetFred('hi');
+     * // => 'hi fred'
+     */
+    var partial = createPartial(PARTIAL_FLAG);
+
+    /**
+     * This method is like `_.partial` except that partially applied arguments
+     * are appended to those provided to the new function.
+     *
+     * The `_.partialRight.placeholder` value, which defaults to `_` in monolithic
+     * builds, may be used as a placeholder for partially applied arguments.
+     *
+     * **Note:** This method does not set the "length" property of partially
+     * applied functions.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to partially apply arguments to.
+     * @param {...*} [partials] The arguments to be partially applied.
+     * @returns {Function} Returns the new partially applied function.
+     * @example
+     *
+     * var greet = function(greeting, name) {
+     *   return greeting + ' ' + name;
+     * };
+     *
+     * var greetFred = _.partialRight(greet, 'fred');
+     * greetFred('hi');
+     * // => 'hi fred'
+     *
+     * // using placeholders
+     * var sayHelloTo = _.partialRight(greet, 'hello', _);
+     * sayHelloTo('fred');
+     * // => 'hello fred'
+     */
+    var partialRight = createPartial(PARTIAL_RIGHT_FLAG);
+
+    /**
+     * Creates a function that invokes `func` with arguments arranged according
+     * to the specified indexes where the argument value at the first index is
+     * provided as the first argument, the argument value at the second index is
+     * provided as the second argument, and so on.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to rearrange arguments for.
+     * @param {...(number|number[])} indexes The arranged argument indexes,
+     *  specified as individual indexes or arrays of indexes.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var rearged = _.rearg(function(a, b, c) {
+     *   return [a, b, c];
+     * }, 2, 0, 1);
+     *
+     * rearged('b', 'c', 'a')
+     * // => ['a', 'b', 'c']
+     *
+     * var map = _.rearg(_.map, [1, 0]);
+     * map(function(n) {
+     *   return n * 3;
+     * }, [1, 2, 3]);
+     * // => [3, 6, 9]
+     */
+    var rearg = restParam(function(func, indexes) {
+      return createWrapper(func, REARG_FLAG, undefined, undefined, undefined, baseFlatten(indexes));
+    });
+
+    /**
+     * Creates a function that invokes `func` with the `this` binding of the
+     * created function and arguments from `start` and beyond provided as an array.
+     *
+     * **Note:** This method is based on the [rest parameter](https://developer.mozilla.org/Web/JavaScript/Reference/Functions/rest_parameters).
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to apply a rest parameter to.
+     * @param {number} [start=func.length-1] The start position of the rest parameter.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var say = _.restParam(function(what, names) {
+     *   return what + ' ' + _.initial(names).join(', ') +
+     *     (_.size(names) > 1 ? ', & ' : '') + _.last(names);
+     * });
+     *
+     * say('hello', 'fred', 'barney', 'pebbles');
+     * // => 'hello fred, barney, & pebbles'
+     */
+    function restParam(func, start) {
+      if (typeof func != 'function') {
+        throw new TypeError(FUNC_ERROR_TEXT);
+      }
+      start = nativeMax(start === undefined ? (func.length - 1) : (+start || 0), 0);
+      return function() {
+        var args = arguments,
+            index = -1,
+            length = nativeMax(args.length - start, 0),
+            rest = Array(length);
+
+        while (++index < length) {
+          rest[index] = args[start + index];
+        }
+        switch (start) {
+          case 0: return func.call(this, rest);
+          case 1: return func.call(this, args[0], rest);
+          case 2: return func.call(this, args[0], args[1], rest);
+        }
+        var otherArgs = Array(start + 1);
+        index = -1;
+        while (++index < start) {
+          otherArgs[index] = args[index];
+        }
+        otherArgs[start] = rest;
+        return func.apply(this, otherArgs);
+      };
+    }
+
+    /**
+     * Creates a function that invokes `func` with the `this` binding of the created
+     * function and an array of arguments much like [`Function#apply`](https://es5.github.io/#x15.3.4.3).
+     *
+     * **Note:** This method is based on the [spread operator](https://developer.mozilla.org/Web/JavaScript/Reference/Operators/Spread_operator).
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to spread arguments over.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var say = _.spread(function(who, what) {
+     *   return who + ' says ' + what;
+     * });
+     *
+     * say(['fred', 'hello']);
+     * // => 'fred says hello'
+     *
+     * // with a Promise
+     * var numbers = Promise.all([
+     *   Promise.resolve(40),
+     *   Promise.resolve(36)
+     * ]);
+     *
+     * numbers.then(_.spread(function(x, y) {
+     *   return x + y;
+     * }));
+     * // => a Promise of 76
+     */
+    function spread(func) {
+      if (typeof func != 'function') {
+        throw new TypeError(FUNC_ERROR_TEXT);
+      }
+      return function(array) {
+        return func.apply(this, array);
+      };
+    }
+
+    /**
+     * Creates a throttled function that only invokes `func` at most once per
+     * every `wait` milliseconds. The throttled function comes with a `cancel`
+     * method to cancel delayed invocations. Provide an options object to indicate
+     * that `func` should be invoked on the leading and/or trailing edge of the
+     * `wait` timeout. Subsequent calls to the throttled function return the
+     * result of the last `func` call.
+     *
+     * **Note:** If `leading` and `trailing` options are `true`, `func` is invoked
+     * on the trailing edge of the timeout only if the the throttled function is
+     * invoked more than once during the `wait` timeout.
+     *
+     * See [David Corbacho's article](http://drupalmotion.com/article/debounce-and-throttle-visual-explanation)
+     * for details over the differences between `_.throttle` and `_.debounce`.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to throttle.
+     * @param {number} [wait=0] The number of milliseconds to throttle invocations to.
+     * @param {Object} [options] The options object.
+     * @param {boolean} [options.leading=true] Specify invoking on the leading
+     *  edge of the timeout.
+     * @param {boolean} [options.trailing=true] Specify invoking on the trailing
+     *  edge of the timeout.
+     * @returns {Function} Returns the new throttled function.
+     * @example
+     *
+     * // avoid excessively updating the position while scrolling
+     * jQuery(window).on('scroll', _.throttle(updatePosition, 100));
+     *
+     * // invoke `renewToken` when the click event is fired, but not more than once every 5 minutes
+     * jQuery('.interactive').on('click', _.throttle(renewToken, 300000, {
+     *   'trailing': false
+     * }));
+     *
+     * // cancel a trailing throttled call
+     * jQuery(window).on('popstate', throttled.cancel);
+     */
+    function throttle(func, wait, options) {
+      var leading = true,
+          trailing = true;
+
+      if (typeof func != 'function') {
+        throw new TypeError(FUNC_ERROR_TEXT);
+      }
+      if (options === false) {
+        leading = false;
+      } else if (isObject(options)) {
+        leading = 'leading' in options ? !!options.leading : leading;
+        trailing = 'trailing' in options ? !!options.trailing : trailing;
+      }
+      return debounce(func, wait, { 'leading': leading, 'maxWait': +wait, 'trailing': trailing });
+    }
+
+    /**
+     * Creates a function that provides `value` to the wrapper function as its
+     * first argument. Any additional arguments provided to the function are
+     * appended to those provided to the wrapper function. The wrapper is invoked
+     * with the `this` binding of the created function.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {*} value The value to wrap.
+     * @param {Function} wrapper The wrapper function.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var p = _.wrap(_.escape, function(func, text) {
+     *   return '<p>' + func(text) + '</p>';
+     * });
+     *
+     * p('fred, barney, & pebbles');
+     * // => '<p>fred, barney, &amp; pebbles</p>'
+     */
+    function wrap(value, wrapper) {
+      wrapper = wrapper == null ? identity : wrapper;
+      return createWrapper(wrapper, PARTIAL_FLAG, undefined, [value], []);
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Creates a clone of `value`. If `isDeep` is `true` nested objects are cloned,
+     * otherwise they are assigned by reference. If `customizer` is provided it's
+     * invoked to produce the cloned values. If `customizer` returns `undefined`
+     * cloning is handled by the method instead. The `customizer` is bound to
+     * `thisArg` and invoked with up to three argument; (value [, index|key, object]).
+     *
+     * **Note:** This method is loosely based on the
+     * [structured clone algorithm](http://www.w3.org/TR/html5/infrastructure.html#internal-structured-cloning-algorithm).
+     * The enumerable properties of `arguments` objects and objects created by
+     * constructors other than `Object` are cloned to plain `Object` objects. An
+     * empty object is returned for uncloneable values such as functions, DOM nodes,
+     * Maps, Sets, and WeakMaps.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to clone.
+     * @param {boolean} [isDeep] Specify a deep clone.
+     * @param {Function} [customizer] The function to customize cloning values.
+     * @param {*} [thisArg] The `this` binding of `customizer`.
+     * @returns {*} Returns the cloned value.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney' },
+     *   { 'user': 'fred' }
+     * ];
+     *
+     * var shallow = _.clone(users);
+     * shallow[0] === users[0];
+     * // => true
+     *
+     * var deep = _.clone(users, true);
+     * deep[0] === users[0];
+     * // => false
+     *
+     * // using a customizer callback
+     * var el = _.clone(document.body, function(value) {
+     *   if (_.isElement(value)) {
+     *     return value.cloneNode(false);
+     *   }
+     * });
+     *
+     * el === document.body
+     * // => false
+     * el.nodeName
+     * // => BODY
+     * el.childNodes.length;
+     * // => 0
+     */
+    function clone(value, isDeep, customizer, thisArg) {
+      if (isDeep && typeof isDeep != 'boolean' && isIterateeCall(value, isDeep, customizer)) {
+        isDeep = false;
+      }
+      else if (typeof isDeep == 'function') {
+        thisArg = customizer;
+        customizer = isDeep;
+        isDeep = false;
+      }
+      return typeof customizer == 'function'
+        ? baseClone(value, isDeep, bindCallback(customizer, thisArg, 3))
+        : baseClone(value, isDeep);
+    }
+
+    /**
+     * Creates a deep clone of `value`. If `customizer` is provided it's invoked
+     * to produce the cloned values. If `customizer` returns `undefined` cloning
+     * is handled by the method instead. The `customizer` is bound to `thisArg`
+     * and invoked with up to three argument; (value [, index|key, object]).
+     *
+     * **Note:** This method is loosely based on the
+     * [structured clone algorithm](http://www.w3.org/TR/html5/infrastructure.html#internal-structured-cloning-algorithm).
+     * The enumerable properties of `arguments` objects and objects created by
+     * constructors other than `Object` are cloned to plain `Object` objects. An
+     * empty object is returned for uncloneable values such as functions, DOM nodes,
+     * Maps, Sets, and WeakMaps.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to deep clone.
+     * @param {Function} [customizer] The function to customize cloning values.
+     * @param {*} [thisArg] The `this` binding of `customizer`.
+     * @returns {*} Returns the deep cloned value.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney' },
+     *   { 'user': 'fred' }
+     * ];
+     *
+     * var deep = _.cloneDeep(users);
+     * deep[0] === users[0];
+     * // => false
+     *
+     * // using a customizer callback
+     * var el = _.cloneDeep(document.body, function(value) {
+     *   if (_.isElement(value)) {
+     *     return value.cloneNode(true);
+     *   }
+     * });
+     *
+     * el === document.body
+     * // => false
+     * el.nodeName
+     * // => BODY
+     * el.childNodes.length;
+     * // => 20
+     */
+    function cloneDeep(value, customizer, thisArg) {
+      return typeof customizer == 'function'
+        ? baseClone(value, true, bindCallback(customizer, thisArg, 3))
+        : baseClone(value, true);
+    }
+
+    /**
+     * Checks if `value` is greater than `other`.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to compare.
+     * @param {*} other The other value to compare.
+     * @returns {boolean} Returns `true` if `value` is greater than `other`, else `false`.
+     * @example
+     *
+     * _.gt(3, 1);
+     * // => true
+     *
+     * _.gt(3, 3);
+     * // => false
+     *
+     * _.gt(1, 3);
+     * // => false
+     */
+    function gt(value, other) {
+      return value > other;
+    }
+
+    /**
+     * Checks if `value` is greater than or equal to `other`.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to compare.
+     * @param {*} other The other value to compare.
+     * @returns {boolean} Returns `true` if `value` is greater than or equal to `other`, else `false`.
+     * @example
+     *
+     * _.gte(3, 1);
+     * // => true
+     *
+     * _.gte(3, 3);
+     * // => true
+     *
+     * _.gte(1, 3);
+     * // => false
+     */
+    function gte(value, other) {
+      return value >= other;
+    }
+
+    /**
+     * Checks if `value` is classified as an `arguments` object.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+     * @example
+     *
+     * _.isArguments(function() { return arguments; }());
+     * // => true
+     *
+     * _.isArguments([1, 2, 3]);
+     * // => false
+     */
+    function isArguments(value) {
+      return isObjectLike(value) && isArrayLike(value) &&
+        hasOwnProperty.call(value, 'callee') && !propertyIsEnumerable.call(value, 'callee');
+    }
+
+    /**
+     * Checks if `value` is classified as an `Array` object.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+     * @example
+     *
+     * _.isArray([1, 2, 3]);
+     * // => true
+     *
+     * _.isArray(function() { return arguments; }());
+     * // => false
+     */
+    var isArray = nativeIsArray || function(value) {
+      return isObjectLike(value) && isLength(value.length) && objToString.call(value) == arrayTag;
+    };
+
+    /**
+     * Checks if `value` is classified as a boolean primitive or object.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+     * @example
+     *
+     * _.isBoolean(false);
+     * // => true
+     *
+     * _.isBoolean(null);
+     * // => false
+     */
+    function isBoolean(value) {
+      return value === true || value === false || (isObjectLike(value) && objToString.call(value) == boolTag);
+    }
+
+    /**
+     * Checks if `value` is classified as a `Date` object.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+     * @example
+     *
+     * _.isDate(new Date);
+     * // => true
+     *
+     * _.isDate('Mon April 23 2012');
+     * // => false
+     */
+    function isDate(value) {
+      return isObjectLike(value) && objToString.call(value) == dateTag;
+    }
+
+    /**
+     * Checks if `value` is a DOM element.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is a DOM element, else `false`.
+     * @example
+     *
+     * _.isElement(document.body);
+     * // => true
+     *
+     * _.isElement('<body>');
+     * // => false
+     */
+    function isElement(value) {
+      return !!value && value.nodeType === 1 && isObjectLike(value) && !isPlainObject(value);
+    }
+
+    /**
+     * Checks if `value` is empty. A value is considered empty unless it's an
+     * `arguments` object, array, string, or jQuery-like collection with a length
+     * greater than `0` or an object with own enumerable properties.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {Array|Object|string} value The value to inspect.
+     * @returns {boolean} Returns `true` if `value` is empty, else `false`.
+     * @example
+     *
+     * _.isEmpty(null);
+     * // => true
+     *
+     * _.isEmpty(true);
+     * // => true
+     *
+     * _.isEmpty(1);
+     * // => true
+     *
+     * _.isEmpty([1, 2, 3]);
+     * // => false
+     *
+     * _.isEmpty({ 'a': 1 });
+     * // => false
+     */
+    function isEmpty(value) {
+      if (value == null) {
+        return true;
+      }
+      if (isArrayLike(value) && (isArray(value) || isString(value) || isArguments(value) ||
+          (isObjectLike(value) && isFunction(value.splice)))) {
+        return !value.length;
+      }
+      return !keys(value).length;
+    }
+
+    /**
+     * Performs a deep comparison between two values to determine if they are
+     * equivalent. If `customizer` is provided it's invoked to compare values.
+     * If `customizer` returns `undefined` comparisons are handled by the method
+     * instead. The `customizer` is bound to `thisArg` and invoked with up to
+     * three arguments: (value, other [, index|key]).
+     *
+     * **Note:** This method supports comparing arrays, booleans, `Date` objects,
+     * numbers, `Object` objects, regexes, and strings. Objects are compared by
+     * their own, not inherited, enumerable properties. Functions and DOM nodes
+     * are **not** supported. Provide a customizer function to extend support
+     * for comparing other values.
+     *
+     * @static
+     * @memberOf _
+     * @alias eq
+     * @category Lang
+     * @param {*} value The value to compare.
+     * @param {*} other The other value to compare.
+     * @param {Function} [customizer] The function to customize value comparisons.
+     * @param {*} [thisArg] The `this` binding of `customizer`.
+     * @returns {boolean} Returns `true` if the values are equivalent, else `false`.
+     * @example
+     *
+     * var object = { 'user': 'fred' };
+     * var other = { 'user': 'fred' };
+     *
+     * object == other;
+     * // => false
+     *
+     * _.isEqual(object, other);
+     * // => true
+     *
+     * // using a customizer callback
+     * var array = ['hello', 'goodbye'];
+     * var other = ['hi', 'goodbye'];
+     *
+     * _.isEqual(array, other, function(value, other) {
+     *   if (_.every([value, other], RegExp.prototype.test, /^h(?:i|ello)$/)) {
+     *     return true;
+     *   }
+     * });
+     * // => true
+     */
+    function isEqual(value, other, customizer, thisArg) {
+      customizer = typeof customizer == 'function' ? bindCallback(customizer, thisArg, 3) : undefined;
+      var result = customizer ? customizer(value, other) : undefined;
+      return  result === undefined ? baseIsEqual(value, other, customizer) : !!result;
+    }
+
+    /**
+     * Checks if `value` is an `Error`, `EvalError`, `RangeError`, `ReferenceError`,
+     * `SyntaxError`, `TypeError`, or `URIError` object.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is an error object, else `false`.
+     * @example
+     *
+     * _.isError(new Error);
+     * // => true
+     *
+     * _.isError(Error);
+     * // => false
+     */
+    function isError(value) {
+      return isObjectLike(value) && typeof value.message == 'string' && objToString.call(value) == errorTag;
+    }
+
+    /**
+     * Checks if `value` is a finite primitive number.
+     *
+     * **Note:** This method is based on [`Number.isFinite`](http://ecma-international.org/ecma-262/6.0/#sec-number.isfinite).
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is a finite number, else `false`.
+     * @example
+     *
+     * _.isFinite(10);
+     * // => true
+     *
+     * _.isFinite('10');
+     * // => false
+     *
+     * _.isFinite(true);
+     * // => false
+     *
+     * _.isFinite(Object(10));
+     * // => false
+     *
+     * _.isFinite(Infinity);
+     * // => false
+     */
+    function isFinite(value) {
+      return typeof value == 'number' && nativeIsFinite(value);
+    }
+
+    /**
+     * Checks if `value` is classified as a `Function` object.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+     * @example
+     *
+     * _.isFunction(_);
+     * // => true
+     *
+     * _.isFunction(/abc/);
+     * // => false
+     */
+    function isFunction(value) {
+      if (!isObject(value)) {
+        return false;
+      }//--•
+
+      // The use of `Object#toString` avoids issues with the `typeof` operator
+      // in older versions of Chrome and Safari which return 'function' for regexes
+      // and Safari 8 which returns 'object' for typed array constructors.
+      var tag = objToString.call(value);
+
+      // Return true if this looks like a function, an "async function", a "generator", or a "proxy".
+      return tag == funcTag || tag == genTag || tag == asyncTag || tag == proxyTag;
+
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+      // ^^^^
+      // PATCHED FROM https://github.com/lodash/lodash/commit/95bc54a3ddc7a25f5e134f5b376a0d1d96118f49
+      // Note that, in Lodash 4, this looks like:
+      // ```
+      // return tag == funcTag || tag == genTag || tag == asyncTag || tag == proxyTag;
+      // ```
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    }
+
+    /**
+     * Checks if `value` is the [language type](https://es5.github.io/#x8) of `Object`.
+     * (e.g. arrays, functions, objects, regexes, `new Number(0)`, and `new String('')`)
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is an object, else `false`.
+     * @example
+     *
+     * _.isObject({});
+     * // => true
+     *
+     * _.isObject([1, 2, 3]);
+     * // => true
+     *
+     * _.isObject(1);
+     * // => false
+     */
+    function isObject(value) {
+      // Avoid a V8 JIT bug in Chrome 19-20.
+      // See https://code.google.com/p/v8/issues/detail?id=2291 for more details.
+      var type = typeof value;
+      return !!value && (type == 'object' || type == 'function');
+    }
+
+    /**
+     * Performs a deep comparison between `object` and `source` to determine if
+     * `object` contains equivalent property values. If `customizer` is provided
+     * it's invoked to compare values. If `customizer` returns `undefined`
+     * comparisons are handled by the method instead. The `customizer` is bound
+     * to `thisArg` and invoked with three arguments: (value, other, index|key).
+     *
+     * **Note:** This method supports comparing properties of arrays, booleans,
+     * `Date` objects, numbers, `Object` objects, regexes, and strings. Functions
+     * and DOM nodes are **not** supported. Provide a customizer function to extend
+     * support for comparing other values.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {Object} object The object to inspect.
+     * @param {Object} source The object of property values to match.
+     * @param {Function} [customizer] The function to customize value comparisons.
+     * @param {*} [thisArg] The `this` binding of `customizer`.
+     * @returns {boolean} Returns `true` if `object` is a match, else `false`.
+     * @example
+     *
+     * var object = { 'user': 'fred', 'age': 40 };
+     *
+     * _.isMatch(object, { 'age': 40 });
+     * // => true
+     *
+     * _.isMatch(object, { 'age': 36 });
+     * // => false
+     *
+     * // using a customizer callback
+     * var object = { 'greeting': 'hello' };
+     * var source = { 'greeting': 'hi' };
+     *
+     * _.isMatch(object, source, function(value, other) {
+     *   return _.every([value, other], RegExp.prototype.test, /^h(?:i|ello)$/) || undefined;
+     * });
+     * // => true
+     */
+    function isMatch(object, source, customizer, thisArg) {
+      customizer = typeof customizer == 'function' ? bindCallback(customizer, thisArg, 3) : undefined;
+      return baseIsMatch(object, getMatchData(source), customizer);
+    }
+
+    /**
+     * Checks if `value` is `NaN`.
+     *
+     * **Note:** This method is not the same as [`isNaN`](https://es5.github.io/#x15.1.2.4)
+     * which returns `true` for `undefined` and other non-numeric values.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is `NaN`, else `false`.
+     * @example
+     *
+     * _.isNaN(NaN);
+     * // => true
+     *
+     * _.isNaN(new Number(NaN));
+     * // => true
+     *
+     * isNaN(undefined);
+     * // => true
+     *
+     * _.isNaN(undefined);
+     * // => false
+     */
+    function isNaN(value) {
+      // An `NaN` primitive is the only value that is not equal to itself.
+      // Perform the `toStringTag` check first to avoid errors with some host objects in IE.
+      return isNumber(value) && value != +value;
+    }
+
+    /**
+     * Checks if `value` is a native function.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is a native function, else `false`.
+     * @example
+     *
+     * _.isNative(Array.prototype.push);
+     * // => true
+     *
+     * _.isNative(_);
+     * // => false
+     */
+    function isNative(value) {
+      if (value == null) {
+        return false;
+      }
+      if (isFunction(value)) {
+        return reIsNative.test(fnToString.call(value));
+      }
+      return isObjectLike(value) && (isHostObject(value) ? reIsNative : reIsHostCtor).test(value);
+    }
+
+    /**
+     * Checks if `value` is `null`.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is `null`, else `false`.
+     * @example
+     *
+     * _.isNull(null);
+     * // => true
+     *
+     * _.isNull(void 0);
+     * // => false
+     */
+    function isNull(value) {
+      return value === null;
+    }
+
+    /**
+     * Checks if `value` is classified as a `Number` primitive or object.
+     *
+     * **Note:** To exclude `Infinity`, `-Infinity`, and `NaN`, which are classified
+     * as numbers, use the `_.isFinite` method.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+     * @example
+     *
+     * _.isNumber(8.4);
+     * // => true
+     *
+     * _.isNumber(NaN);
+     * // => true
+     *
+     * _.isNumber('8.4');
+     * // => false
+     */
+    function isNumber(value) {
+      return typeof value == 'number' || (isObjectLike(value) && objToString.call(value) == numberTag);
+    }
+
+    /**
+     * Checks if `value` is a plain object, that is, an object created by the
+     * `Object` constructor or one with a `[[Prototype]]` of `null`.
+     *
+     * **Note:** This method assumes objects created by the `Object` constructor
+     * have no inherited enumerable properties.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is a plain object, else `false`.
+     * @example
+     *
+     * function Foo() {
+     *   this.a = 1;
+     * }
+     *
+     * _.isPlainObject(new Foo);
+     * // => false
+     *
+     * _.isPlainObject([1, 2, 3]);
+     * // => false
+     *
+     * _.isPlainObject({ 'x': 0, 'y': 0 });
+     * // => true
+     *
+     * _.isPlainObject(Object.create(null));
+     * // => true
+     */
+    function isPlainObject(value) {
+      var Ctor;
+
+      // Exit early for non `Object` objects.
+      if (!(isObjectLike(value) && objToString.call(value) == objectTag && !isHostObject(value) && !isArguments(value)) ||
+          (!hasOwnProperty.call(value, 'constructor') && (Ctor = value.constructor, typeof Ctor == 'function' && !(Ctor instanceof Ctor)))) {
+        return false;
+      }
+      // IE < 9 iterates inherited properties before own properties. If the first
+      // iterated property is an object's own property then there are no inherited
+      // enumerable properties.
+      var result;
+      if (lodash.support.ownLast) {
+        baseForIn(value, function(subValue, key, object) {
+          result = hasOwnProperty.call(object, key);
+          return false;
+        });
+        return result !== false;
+      }
+      // In most environments an object's own properties are iterated before
+      // its inherited properties. If the last iterated property is an object's
+      // own property then there are no inherited enumerable properties.
+      baseForIn(value, function(subValue, key) {
+        result = key;
+      });
+      return result === undefined || hasOwnProperty.call(value, result);
+    }
+
+    /**
+     * Checks if `value` is classified as a `RegExp` object.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+     * @example
+     *
+     * _.isRegExp(/abc/);
+     * // => true
+     *
+     * _.isRegExp('/abc/');
+     * // => false
+     */
+    function isRegExp(value) {
+      return isObject(value) && objToString.call(value) == regexpTag;
+    }
+
+    /**
+     * Checks if `value` is classified as a `String` primitive or object.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+     * @example
+     *
+     * _.isString('abc');
+     * // => true
+     *
+     * _.isString(1);
+     * // => false
+     */
+    function isString(value) {
+      return typeof value == 'string' || (isObjectLike(value) && objToString.call(value) == stringTag);
+    }
+
+    /**
+     * Checks if `value` is classified as a typed array.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+     * @example
+     *
+     * _.isTypedArray(new Uint8Array);
+     * // => true
+     *
+     * _.isTypedArray([]);
+     * // => false
+     */
+    function isTypedArray(value) {
+      return isObjectLike(value) && isLength(value.length) && !!typedArrayTags[objToString.call(value)];
+    }
+
+    /**
+     * Checks if `value` is `undefined`.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is `undefined`, else `false`.
+     * @example
+     *
+     * _.isUndefined(void 0);
+     * // => true
+     *
+     * _.isUndefined(null);
+     * // => false
+     */
+    function isUndefined(value) {
+      return value === undefined;
+    }
+
+    /**
+     * Checks if `value` is less than `other`.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to compare.
+     * @param {*} other The other value to compare.
+     * @returns {boolean} Returns `true` if `value` is less than `other`, else `false`.
+     * @example
+     *
+     * _.lt(1, 3);
+     * // => true
+     *
+     * _.lt(3, 3);
+     * // => false
+     *
+     * _.lt(3, 1);
+     * // => false
+     */
+    function lt(value, other) {
+      return value < other;
+    }
+
+    /**
+     * Checks if `value` is less than or equal to `other`.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to compare.
+     * @param {*} other The other value to compare.
+     * @returns {boolean} Returns `true` if `value` is less than or equal to `other`, else `false`.
+     * @example
+     *
+     * _.lte(1, 3);
+     * // => true
+     *
+     * _.lte(3, 3);
+     * // => true
+     *
+     * _.lte(3, 1);
+     * // => false
+     */
+    function lte(value, other) {
+      return value <= other;
+    }
+
+    /**
+     * Converts `value` to an array.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to convert.
+     * @returns {Array} Returns the converted array.
+     * @example
+     *
+     * (function() {
+     *   return _.toArray(arguments).slice(1);
+     * }(1, 2, 3));
+     * // => [2, 3]
+     */
+    function toArray(value) {
+      var length = value ? getLength(value) : 0;
+      if (!isLength(length)) {
+        return values(value);
+      }
+      if (!length) {
+        return [];
+      }
+      return (lodash.support.unindexedChars && isString(value))
+        ? value.split('')
+        : arrayCopy(value);
+    }
+
+    /**
+     * Converts `value` to a plain object flattening inherited enumerable
+     * properties of `value` to own properties of the plain object.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to convert.
+     * @returns {Object} Returns the converted plain object.
+     * @example
+     *
+     * function Foo() {
+     *   this.b = 2;
+     * }
+     *
+     * Foo.prototype.c = 3;
+     *
+     * _.assign({ 'a': 1 }, new Foo);
+     * // => { 'a': 1, 'b': 2 }
+     *
+     * _.assign({ 'a': 1 }, _.toPlainObject(new Foo));
+     * // => { 'a': 1, 'b': 2, 'c': 3 }
+     */
+    function toPlainObject(value) {
+      return baseCopy(value, keysIn(value));
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Recursively merges own enumerable properties of the source object(s), that
+     * don't resolve to `undefined` into the destination object. Subsequent sources
+     * overwrite property assignments of previous sources. If `customizer` is
+     * provided it's invoked to produce the merged values of the destination and
+     * source properties. If `customizer` returns `undefined` merging is handled
+     * by the method instead. The `customizer` is bound to `thisArg` and invoked
+     * with five arguments: (objectValue, sourceValue, key, object, source).
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The destination object.
+     * @param {...Object} [sources] The source objects.
+     * @param {Function} [customizer] The function to customize assigned values.
+     * @param {*} [thisArg] The `this` binding of `customizer`.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * var users = {
+     *   'data': [{ 'user': 'barney' }, { 'user': 'fred' }]
+     * };
+     *
+     * var ages = {
+     *   'data': [{ 'age': 36 }, { 'age': 40 }]
+     * };
+     *
+     * _.merge(users, ages);
+     * // => { 'data': [{ 'user': 'barney', 'age': 36 }, { 'user': 'fred', 'age': 40 }] }
+     *
+     * // using a customizer callback
+     * var object = {
+     *   'fruits': ['apple'],
+     *   'vegetables': ['beet']
+     * };
+     *
+     * var other = {
+     *   'fruits': ['banana'],
+     *   'vegetables': ['carrot']
+     * };
+     *
+     * _.merge(object, other, function(a, b) {
+     *   if (_.isArray(a)) {
+     *     return a.concat(b);
+     *   }
+     * });
+     * // => { 'fruits': ['apple', 'banana'], 'vegetables': ['beet', 'carrot'] }
+     */
+    var merge = createAssigner(baseMerge);
+
+    /**
+     * Assigns own enumerable properties of source object(s) to the destination
+     * object. Subsequent sources overwrite property assignments of previous sources.
+     * If `customizer` is provided it's invoked to produce the assigned values.
+     * The `customizer` is bound to `thisArg` and invoked with five arguments:
+     * (objectValue, sourceValue, key, object, source).
+     *
+     * **Note:** This method mutates `object` and is based on
+     * [`Object.assign`](http://ecma-international.org/ecma-262/6.0/#sec-object.assign).
+     *
+     * @static
+     * @memberOf _
+     * @alias extend
+     * @category Object
+     * @param {Object} object The destination object.
+     * @param {...Object} [sources] The source objects.
+     * @param {Function} [customizer] The function to customize assigned values.
+     * @param {*} [thisArg] The `this` binding of `customizer`.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * _.assign({ 'user': 'barney' }, { 'age': 40 }, { 'user': 'fred' });
+     * // => { 'user': 'fred', 'age': 40 }
+     *
+     * // using a customizer callback
+     * var defaults = _.partialRight(_.assign, function(value, other) {
+     *   return _.isUndefined(value) ? other : value;
+     * });
+     *
+     * defaults({ 'user': 'barney' }, { 'age': 36 }, { 'user': 'fred' });
+     * // => { 'user': 'barney', 'age': 36 }
+     */
+    var assign = createAssigner(function(object, source, customizer) {
+      return customizer
+        ? assignWith(object, source, customizer)
+        : baseAssign(object, source);
+    });
+
+    /**
+     * Creates an object that inherits from the given `prototype` object. If a
+     * `properties` object is provided its own enumerable properties are assigned
+     * to the created object.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} prototype The object to inherit from.
+     * @param {Object} [properties] The properties to assign to the object.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Object} Returns the new object.
+     * @example
+     *
+     * function Shape() {
+     *   this.x = 0;
+     *   this.y = 0;
+     * }
+     *
+     * function Circle() {
+     *   Shape.call(this);
+     * }
+     *
+     * Circle.prototype = _.create(Shape.prototype, {
+     *   'constructor': Circle
+     * });
+     *
+     * var circle = new Circle;
+     * circle instanceof Circle;
+     * // => true
+     *
+     * circle instanceof Shape;
+     * // => true
+     */
+    function create(prototype, properties, guard) {
+      var result = baseCreate(prototype);
+      if (guard && isIterateeCall(prototype, properties, guard)) {
+        properties = undefined;
+      }
+      return properties ? baseAssign(result, properties) : result;
+    }
+
+    /**
+     * Assigns own enumerable properties of source object(s) to the destination
+     * object for all destination properties that resolve to `undefined`. Once a
+     * property is set, additional values of the same property are ignored.
+     *
+     * **Note:** This method mutates `object`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The destination object.
+     * @param {...Object} [sources] The source objects.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * _.defaults({ 'user': 'barney' }, { 'age': 36 }, { 'user': 'fred' });
+     * // => { 'user': 'barney', 'age': 36 }
+     */
+    var defaults = createDefaults(assign, assignDefaults);
+
+    /**
+     * This method is like `_.defaults` except that it recursively assigns
+     * default properties.
+     *
+     * **Note:** This method mutates `object`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The destination object.
+     * @param {...Object} [sources] The source objects.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * _.defaultsDeep({ 'user': { 'name': 'barney' } }, { 'user': { 'name': 'fred', 'age': 36 } });
+     * // => { 'user': { 'name': 'barney', 'age': 36 } }
+     *
+     */
+    var defaultsDeep = createDefaults(merge, mergeDefaults);
+
+    /**
+     * This method is like `_.find` except that it returns the key of the first
+     * element `predicate` returns truthy for instead of the element itself.
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to search.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {string|undefined} Returns the key of the matched element, else `undefined`.
+     * @example
+     *
+     * var users = {
+     *   'barney':  { 'age': 36, 'active': true },
+     *   'fred':    { 'age': 40, 'active': false },
+     *   'pebbles': { 'age': 1,  'active': true }
+     * };
+     *
+     * _.findKey(users, function(chr) {
+     *   return chr.age < 40;
+     * });
+     * // => 'barney' (iteration order is not guaranteed)
+     *
+     * // using the `_.matches` callback shorthand
+     * _.findKey(users, { 'age': 1, 'active': true });
+     * // => 'pebbles'
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.findKey(users, 'active', false);
+     * // => 'fred'
+     *
+     * // using the `_.property` callback shorthand
+     * _.findKey(users, 'active');
+     * // => 'barney'
+     */
+    var findKey = createFindKey(baseForOwn);
+
+    /**
+     * This method is like `_.findKey` except that it iterates over elements of
+     * a collection in the opposite order.
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to search.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {string|undefined} Returns the key of the matched element, else `undefined`.
+     * @example
+     *
+     * var users = {
+     *   'barney':  { 'age': 36, 'active': true },
+     *   'fred':    { 'age': 40, 'active': false },
+     *   'pebbles': { 'age': 1,  'active': true }
+     * };
+     *
+     * _.findLastKey(users, function(chr) {
+     *   return chr.age < 40;
+     * });
+     * // => returns `pebbles` assuming `_.findKey` returns `barney`
+     *
+     * // using the `_.matches` callback shorthand
+     * _.findLastKey(users, { 'age': 36, 'active': true });
+     * // => 'barney'
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.findLastKey(users, 'active', false);
+     * // => 'fred'
+     *
+     * // using the `_.property` callback shorthand
+     * _.findLastKey(users, 'active');
+     * // => 'pebbles'
+     */
+    var findLastKey = createFindKey(baseForOwnRight);
+
+    /**
+     * Iterates over own and inherited enumerable properties of an object invoking
+     * `iteratee` for each property. The `iteratee` is bound to `thisArg` and invoked
+     * with three arguments: (value, key, object). Iteratee functions may exit
+     * iteration early by explicitly returning `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to iterate over.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * function Foo() {
+     *   this.a = 1;
+     *   this.b = 2;
+     * }
+     *
+     * Foo.prototype.c = 3;
+     *
+     * _.forIn(new Foo, function(value, key) {
+     *   console.log(key);
+     * });
+     * // => logs 'a', 'b', and 'c' (iteration order is not guaranteed)
+     */
+    var forIn = createForIn(baseFor);
+
+    /**
+     * This method is like `_.forIn` except that it iterates over properties of
+     * `object` in the opposite order.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to iterate over.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * function Foo() {
+     *   this.a = 1;
+     *   this.b = 2;
+     * }
+     *
+     * Foo.prototype.c = 3;
+     *
+     * _.forInRight(new Foo, function(value, key) {
+     *   console.log(key);
+     * });
+     * // => logs 'c', 'b', and 'a' assuming `_.forIn ` logs 'a', 'b', and 'c'
+     */
+    var forInRight = createForIn(baseForRight);
+
+    /**
+     * Iterates over own enumerable properties of an object invoking `iteratee`
+     * for each property. The `iteratee` is bound to `thisArg` and invoked with
+     * three arguments: (value, key, object). Iteratee functions may exit iteration
+     * early by explicitly returning `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to iterate over.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * function Foo() {
+     *   this.a = 1;
+     *   this.b = 2;
+     * }
+     *
+     * Foo.prototype.c = 3;
+     *
+     * _.forOwn(new Foo, function(value, key) {
+     *   console.log(key);
+     * });
+     * // => logs 'a' and 'b' (iteration order is not guaranteed)
+     */
+    var forOwn = createForOwn(baseForOwn);
+
+    /**
+     * This method is like `_.forOwn` except that it iterates over properties of
+     * `object` in the opposite order.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to iterate over.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * function Foo() {
+     *   this.a = 1;
+     *   this.b = 2;
+     * }
+     *
+     * Foo.prototype.c = 3;
+     *
+     * _.forOwnRight(new Foo, function(value, key) {
+     *   console.log(key);
+     * });
+     * // => logs 'b' and 'a' assuming `_.forOwn` logs 'a' and 'b'
+     */
+    var forOwnRight = createForOwn(baseForOwnRight);
+
+    /**
+     * Creates an array of function property names from all enumerable properties,
+     * own and inherited, of `object`.
+     *
+     * @static
+     * @memberOf _
+     * @alias methods
+     * @category Object
+     * @param {Object} object The object to inspect.
+     * @returns {Array} Returns the new array of property names.
+     * @example
+     *
+     * _.functions(_);
+     * // => ['after', 'ary', 'assign', ...]
+     */
+    function functions(object) {
+      return baseFunctions(object, keysIn(object));
+    }
+
+    /**
+     * Gets the property value at `path` of `object`. If the resolved value is
+     * `undefined` the `defaultValue` is used in its place.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to query.
+     * @param {Array|string} path The path of the property to get.
+     * @param {*} [defaultValue] The value returned if the resolved value is `undefined`.
+     * @returns {*} Returns the resolved value.
+     * @example
+     *
+     * var object = { 'a': [{ 'b': { 'c': 3 } }] };
+     *
+     * _.get(object, 'a[0].b.c');
+     * // => 3
+     *
+     * _.get(object, ['a', '0', 'b', 'c']);
+     * // => 3
+     *
+     * _.get(object, 'a.b.c', 'default');
+     * // => 'default'
+     */
+    function get(object, path, defaultValue) {
+      var result = object == null ? undefined : baseGet(object, toPath(path), (path + ''));
+      return result === undefined ? defaultValue : result;
+    }
+
+    /**
+     * Checks if `path` is a direct property.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to query.
+     * @param {Array|string} path The path to check.
+     * @returns {boolean} Returns `true` if `path` is a direct property, else `false`.
+     * @example
+     *
+     * var object = { 'a': { 'b': { 'c': 3 } } };
+     *
+     * _.has(object, 'a');
+     * // => true
+     *
+     * _.has(object, 'a.b.c');
+     * // => true
+     *
+     * _.has(object, ['a', 'b', 'c']);
+     * // => true
+     */
+    function has(object, path) {
+      if (object == null) {
+        return false;
+      }
+      var result = hasOwnProperty.call(object, path);
+      if (!result && !isKey(path)) {
+        path = toPath(path);
+        object = path.length == 1 ? object : baseGet(object, baseSlice(path, 0, -1));
+        if (object == null) {
+          return false;
+        }
+        path = last(path);
+        result = hasOwnProperty.call(object, path);
+      }
+      return result || (isLength(object.length) && isIndex(path, object.length) &&
+        (isArray(object) || isArguments(object) || isString(object)));
+    }
+
+    /**
+     * Creates an object composed of the inverted keys and values of `object`.
+     * If `object` contains duplicate values, subsequent values overwrite property
+     * assignments of previous values unless `multiValue` is `true`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to invert.
+     * @param {boolean} [multiValue] Allow multiple values per key.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Object} Returns the new inverted object.
+     * @example
+     *
+     * var object = { 'a': 1, 'b': 2, 'c': 1 };
+     *
+     * _.invert(object);
+     * // => { '1': 'c', '2': 'b' }
+     *
+     * // with `multiValue`
+     * _.invert(object, true);
+     * // => { '1': ['a', 'c'], '2': ['b'] }
+     */
+    function invert(object, multiValue, guard) {
+      if (guard && isIterateeCall(object, multiValue, guard)) {
+        multiValue = undefined;
+      }
+      var index = -1,
+          props = keys(object),
+          length = props.length,
+          result = {};
+
+      while (++index < length) {
+        var key = props[index],
+            value = object[key];
+
+        if (multiValue) {
+          if (hasOwnProperty.call(result, value)) {
+            result[value].push(key);
+          } else {
+            result[value] = [key];
+          }
+        }
+        else {
+          result[value] = key;
+        }
+      }
+      return result;
+    }
+
+    /**
+     * Creates an array of the own enumerable property names of `object`.
+     *
+     * **Note:** Non-object values are coerced to objects. See the
+     * [ES spec](http://ecma-international.org/ecma-262/6.0/#sec-object.keys)
+     * for more details.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to query.
+     * @returns {Array} Returns the array of property names.
+     * @example
+     *
+     * function Foo() {
+     *   this.a = 1;
+     *   this.b = 2;
+     * }
+     *
+     * Foo.prototype.c = 3;
+     *
+     * _.keys(new Foo);
+     * // => ['a', 'b'] (iteration order is not guaranteed)
+     *
+     * _.keys('hi');
+     * // => ['0', '1']
+     */
+    var keys = !nativeKeys ? shimKeys : function(object) {
+      var Ctor = object == null ? undefined : object.constructor;
+      if ((typeof Ctor == 'function' && Ctor.prototype === object) ||
+          (typeof object == 'function' ? lodash.support.enumPrototypes : isArrayLike(object))) {
+        return shimKeys(object);
+      }
+      return isObject(object) ? nativeKeys(object) : [];
+    };
+
+    /**
+     * Creates an array of the own and inherited enumerable property names of `object`.
+     *
+     * **Note:** Non-object values are coerced to objects.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to query.
+     * @returns {Array} Returns the array of property names.
+     * @example
+     *
+     * function Foo() {
+     *   this.a = 1;
+     *   this.b = 2;
+     * }
+     *
+     * Foo.prototype.c = 3;
+     *
+     * _.keysIn(new Foo);
+     * // => ['a', 'b', 'c'] (iteration order is not guaranteed)
+     */
+    function keysIn(object) {
+      if (object == null) {
+        return [];
+      }
+      if (!isObject(object)) {
+        object = Object(object);
+      }
+      var length = object.length,
+          support = lodash.support;
+
+      length = (length && isLength(length) &&
+        (isArray(object) || isArguments(object) || isString(object)) && length) || 0;
+
+      var Ctor = object.constructor,
+          index = -1,
+          proto = (isFunction(Ctor) && Ctor.prototype) || objectProto,
+          isProto = proto === object,
+          result = Array(length),
+          skipIndexes = length > 0,
+          skipErrorProps = support.enumErrorProps && (object === errorProto || object instanceof Error),
+          skipProto = support.enumPrototypes && isFunction(object);
+
+      while (++index < length) {
+        result[index] = (index + '');
+      }
+      // lodash skips the `constructor` property when it infers it's iterating
+      // over a `prototype` object because IE < 9 can't set the `[[Enumerable]]`
+      // attribute of an existing property and the `constructor` property of a
+      // prototype defaults to non-enumerable.
+      for (var key in object) {
+        if (!(skipProto && key == 'prototype') &&
+            !(skipErrorProps && (key == 'message' || key == 'name')) &&
+            !(skipIndexes && isIndex(key, length)) &&
+            !(key == 'constructor' && (isProto || !hasOwnProperty.call(object, key)))) {
+          result.push(key);
+        }
+      }
+      if (support.nonEnumShadows && object !== objectProto) {
+        var tag = object === stringProto ? stringTag : (object === errorProto ? errorTag : objToString.call(object)),
+            nonEnums = nonEnumProps[tag] || nonEnumProps[objectTag];
+
+        if (tag == objectTag) {
+          proto = objectProto;
+        }
+        length = shadowProps.length;
+        while (length--) {
+          key = shadowProps[length];
+          var nonEnum = nonEnums[key];
+          if (!(isProto && nonEnum) &&
+              (nonEnum ? hasOwnProperty.call(object, key) : object[key] !== proto[key])) {
+            result.push(key);
+          }
+        }
+      }
+      return result;
+    }
+
+    /**
+     * The opposite of `_.mapValues`; this method creates an object with the
+     * same values as `object` and keys generated by running each own enumerable
+     * property of `object` through `iteratee`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to iterate over.
+     * @param {Function|Object|string} [iteratee=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Object} Returns the new mapped object.
+     * @example
+     *
+     * _.mapKeys({ 'a': 1, 'b': 2 }, function(value, key) {
+     *   return key + value;
+     * });
+     * // => { 'a1': 1, 'b2': 2 }
+     */
+    var mapKeys = createObjectMapper(true);
+
+    /**
+     * Creates an object with the same keys as `object` and values generated by
+     * running each own enumerable property of `object` through `iteratee`. The
+     * iteratee function is bound to `thisArg` and invoked with three arguments:
+     * (value, key, object).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to iterate over.
+     * @param {Function|Object|string} [iteratee=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Object} Returns the new mapped object.
+     * @example
+     *
+     * _.mapValues({ 'a': 1, 'b': 2 }, function(n) {
+     *   return n * 3;
+     * });
+     * // => { 'a': 3, 'b': 6 }
+     *
+     * var users = {
+     *   'fred':    { 'user': 'fred',    'age': 40 },
+     *   'pebbles': { 'user': 'pebbles', 'age': 1 }
+     * };
+     *
+     * // using the `_.property` callback shorthand
+     * _.mapValues(users, 'age');
+     * // => { 'fred': 40, 'pebbles': 1 } (iteration order is not guaranteed)
+     */
+    var mapValues = createObjectMapper();
+
+    /**
+     * The opposite of `_.pick`; this method creates an object composed of the
+     * own and inherited enumerable properties of `object` that are not omitted.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The source object.
+     * @param {Function|...(string|string[])} [predicate] The function invoked per
+     *  iteration or property names to omit, specified as individual property
+     *  names or arrays of property names.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Object} Returns the new object.
+     * @example
+     *
+     * var object = { 'user': 'fred', 'age': 40 };
+     *
+     * _.omit(object, 'age');
+     * // => { 'user': 'fred' }
+     *
+     * _.omit(object, _.isNumber);
+     * // => { 'user': 'fred' }
+     */
+    var omit = restParam(function(object, props) {
+      if (object == null) {
+        return {};
+      }
+      if (typeof props[0] != 'function') {
+        var props = arrayMap(baseFlatten(props), String);
+        return pickByArray(object, baseDifference(keysIn(object), props));
+      }
+      var predicate = bindCallback(props[0], props[1], 3);
+      return pickByCallback(object, function(value, key, object) {
+        return !predicate(value, key, object);
+      });
+    });
+
+    /**
+     * Creates a two dimensional array of the key-value pairs for `object`,
+     * e.g. `[[key1, value1], [key2, value2]]`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to query.
+     * @returns {Array} Returns the new array of key-value pairs.
+     * @example
+     *
+     * _.pairs({ 'barney': 36, 'fred': 40 });
+     * // => [['barney', 36], ['fred', 40]] (iteration order is not guaranteed)
+     */
+    function pairs(object) {
+      object = toObject(object);
+
+      var index = -1,
+          props = keys(object),
+          length = props.length,
+          result = Array(length);
+
+      while (++index < length) {
+        var key = props[index];
+        result[index] = [key, object[key]];
+      }
+      return result;
+    }
+
+    /**
+     * Creates an object composed of the picked `object` properties. Property
+     * names may be specified as individual arguments or as arrays of property
+     * names. If `predicate` is provided it's invoked for each property of `object`
+     * picking the properties `predicate` returns truthy for. The predicate is
+     * bound to `thisArg` and invoked with three arguments: (value, key, object).
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The source object.
+     * @param {Function|...(string|string[])} [predicate] The function invoked per
+     *  iteration or property names to pick, specified as individual property
+     *  names or arrays of property names.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Object} Returns the new object.
+     * @example
+     *
+     * var object = { 'user': 'fred', 'age': 40 };
+     *
+     * _.pick(object, 'user');
+     * // => { 'user': 'fred' }
+     *
+     * _.pick(object, _.isString);
+     * // => { 'user': 'fred' }
+     */
+    var pick = restParam(function(object, props) {
+      if (object == null) {
+        return {};
+      }
+      return typeof props[0] == 'function'
+        ? pickByCallback(object, bindCallback(props[0], props[1], 3))
+        : pickByArray(object, baseFlatten(props));
+    });
+
+    /**
+     * This method is like `_.get` except that if the resolved value is a function
+     * it's invoked with the `this` binding of its parent object and its result
+     * is returned.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to query.
+     * @param {Array|string} path The path of the property to resolve.
+     * @param {*} [defaultValue] The value returned if the resolved value is `undefined`.
+     * @returns {*} Returns the resolved value.
+     * @example
+     *
+     * var object = { 'a': [{ 'b': { 'c1': 3, 'c2': _.constant(4) } }] };
+     *
+     * _.result(object, 'a[0].b.c1');
+     * // => 3
+     *
+     * _.result(object, 'a[0].b.c2');
+     * // => 4
+     *
+     * _.result(object, 'a.b.c', 'default');
+     * // => 'default'
+     *
+     * _.result(object, 'a.b.c', _.constant('default'));
+     * // => 'default'
+     */
+    function result(object, path, defaultValue) {
+      var result = object == null ? undefined : toObject(object)[path];
+      if (result === undefined) {
+        if (object != null && !isKey(path, object)) {
+          path = toPath(path);
+          object = path.length == 1 ? object : baseGet(object, baseSlice(path, 0, -1));
+          result = object == null ? undefined : toObject(object)[last(path)];
+        }
+        result = result === undefined ? defaultValue : result;
+      }
+      return isFunction(result) ? result.call(object) : result;
+    }
+
+    /**
+     * Sets the property value of `path` on `object`. If a portion of `path`
+     * does not exist it's created.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to augment.
+     * @param {Array|string} path The path of the property to set.
+     * @param {*} value The value to set.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * var object = { 'a': [{ 'b': { 'c': 3 } }] };
+     *
+     * _.set(object, 'a[0].b.c', 4);
+     * console.log(object.a[0].b.c);
+     * // => 4
+     *
+     * _.set(object, 'x[0].y.z', 5);
+     * console.log(object.x[0].y.z);
+     * // => 5
+     */
+    function set(object, path, value) {
+      if (object == null) {
+        return object;
+      }
+      var pathKey = (path + '');
+      path = (object[pathKey] != null || isKey(path, object)) ? [pathKey] : toPath(path);
+
+      var index = -1,
+          length = path.length,
+          lastIndex = length - 1,
+          nested = object;
+
+      while (nested != null && ++index < length) {
+        var key = path[index];
+        if (isObject(nested)) {
+          if (index == lastIndex) {
+            nested[key] = value;
+          } else if (nested[key] == null) {
+            nested[key] = isIndex(path[index + 1]) ? [] : {};
+          }
+        }
+        nested = nested[key];
+      }
+      return object;
+    }
+
+    /**
+     * An alternative to `_.reduce`; this method transforms `object` to a new
+     * `accumulator` object which is the result of running each of its own enumerable
+     * properties through `iteratee`, with each invocation potentially mutating
+     * the `accumulator` object. The `iteratee` is bound to `thisArg` and invoked
+     * with four arguments: (accumulator, value, key, object). Iteratee functions
+     * may exit iteration early by explicitly returning `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Array|Object} object The object to iterate over.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [accumulator] The custom accumulator value.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {*} Returns the accumulated value.
+     * @example
+     *
+     * _.transform([2, 3, 4], function(result, n) {
+     *   result.push(n *= n);
+     *   return n % 2 == 0;
+     * });
+     * // => [4, 9]
+     *
+     * _.transform({ 'a': 1, 'b': 2 }, function(result, n, key) {
+     *   result[key] = n * 3;
+     * });
+     * // => { 'a': 3, 'b': 6 }
+     */
+    function transform(object, iteratee, accumulator, thisArg) {
+      var isArr = isArray(object) || isTypedArray(object);
+      iteratee = getCallback(iteratee, thisArg, 4);
+
+      if (accumulator == null) {
+        if (isArr || isObject(object)) {
+          var Ctor = object.constructor;
+          if (isArr) {
+            accumulator = isArray(object) ? new Ctor : [];
+          } else {
+            accumulator = baseCreate(isFunction(Ctor) ? Ctor.prototype : undefined);
+          }
+        } else {
+          accumulator = {};
+        }
+      }
+      (isArr ? arrayEach : baseForOwn)(object, function(value, index, object) {
+        return iteratee(accumulator, value, index, object);
+      });
+      return accumulator;
+    }
+
+    /**
+     * Creates an array of the own enumerable property values of `object`.
+     *
+     * **Note:** Non-object values are coerced to objects.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to query.
+     * @returns {Array} Returns the array of property values.
+     * @example
+     *
+     * function Foo() {
+     *   this.a = 1;
+     *   this.b = 2;
+     * }
+     *
+     * Foo.prototype.c = 3;
+     *
+     * _.values(new Foo);
+     * // => [1, 2] (iteration order is not guaranteed)
+     *
+     * _.values('hi');
+     * // => ['h', 'i']
+     */
+    function values(object) {
+      return baseValues(object, keys(object));
+    }
+
+    /**
+     * Creates an array of the own and inherited enumerable property values
+     * of `object`.
+     *
+     * **Note:** Non-object values are coerced to objects.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to query.
+     * @returns {Array} Returns the array of property values.
+     * @example
+     *
+     * function Foo() {
+     *   this.a = 1;
+     *   this.b = 2;
+     * }
+     *
+     * Foo.prototype.c = 3;
+     *
+     * _.valuesIn(new Foo);
+     * // => [1, 2, 3] (iteration order is not guaranteed)
+     */
+    function valuesIn(object) {
+      return baseValues(object, keysIn(object));
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Checks if `n` is between `start` and up to but not including, `end`. If
+     * `end` is not specified it's set to `start` with `start` then set to `0`.
+     *
+     * @static
+     * @memberOf _
+     * @category Number
+     * @param {number} n The number to check.
+     * @param {number} [start=0] The start of the range.
+     * @param {number} end The end of the range.
+     * @returns {boolean} Returns `true` if `n` is in the range, else `false`.
+     * @example
+     *
+     * _.inRange(3, 2, 4);
+     * // => true
+     *
+     * _.inRange(4, 8);
+     * // => true
+     *
+     * _.inRange(4, 2);
+     * // => false
+     *
+     * _.inRange(2, 2);
+     * // => false
+     *
+     * _.inRange(1.2, 2);
+     * // => true
+     *
+     * _.inRange(5.2, 4);
+     * // => false
+     */
+    function inRange(value, start, end) {
+      start = +start || 0;
+      if (end === undefined) {
+        end = start;
+        start = 0;
+      } else {
+        end = +end || 0;
+      }
+      return value >= nativeMin(start, end) && value < nativeMax(start, end);
+    }
+
+    /**
+     * Produces a random number between `min` and `max` (inclusive). If only one
+     * argument is provided a number between `0` and the given number is returned.
+     * If `floating` is `true`, or either `min` or `max` are floats, a floating-point
+     * number is returned instead of an integer.
+     *
+     * @static
+     * @memberOf _
+     * @category Number
+     * @param {number} [min=0] The minimum possible value.
+     * @param {number} [max=1] The maximum possible value.
+     * @param {boolean} [floating] Specify returning a floating-point number.
+     * @returns {number} Returns the random number.
+     * @example
+     *
+     * _.random(0, 5);
+     * // => an integer between 0 and 5
+     *
+     * _.random(5);
+     * // => also an integer between 0 and 5
+     *
+     * _.random(5, true);
+     * // => a floating-point number between 0 and 5
+     *
+     * _.random(1.2, 5.2);
+     * // => a floating-point number between 1.2 and 5.2
+     */
+    function random(min, max, floating) {
+      if (floating && isIterateeCall(min, max, floating)) {
+        max = floating = undefined;
+      }
+      var noMin = min == null,
+          noMax = max == null;
+
+      if (floating == null) {
+        if (noMax && typeof min == 'boolean') {
+          floating = min;
+          min = 1;
+        }
+        else if (typeof max == 'boolean') {
+          floating = max;
+          noMax = true;
+        }
+      }
+      if (noMin && noMax) {
+        max = 1;
+        noMax = false;
+      }
+      min = +min || 0;
+      if (noMax) {
+        max = min;
+        min = 0;
+      } else {
+        max = +max || 0;
+      }
+      if (floating || min % 1 || max % 1) {
+        var rand = nativeRandom();
+        return nativeMin(min + (rand * (max - min + parseFloat('1e-' + ((rand + '').length - 1)))), max);
+      }
+      return baseRandom(min, max);
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Converts `string` to [camel case](https://en.wikipedia.org/wiki/CamelCase).
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to convert.
+     * @returns {string} Returns the camel cased string.
+     * @example
+     *
+     * _.camelCase('Foo Bar');
+     * // => 'fooBar'
+     *
+     * _.camelCase('--foo-bar');
+     * // => 'fooBar'
+     *
+     * _.camelCase('__foo_bar__');
+     * // => 'fooBar'
+     */
+    var camelCase = createCompounder(function(result, word, index) {
+      word = word.toLowerCase();
+      return result + (index ? (word.charAt(0).toUpperCase() + word.slice(1)) : word);
+    });
+
+    /**
+     * Capitalizes the first character of `string`.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to capitalize.
+     * @returns {string} Returns the capitalized string.
+     * @example
+     *
+     * _.capitalize('fred');
+     * // => 'Fred'
+     */
+    function capitalize(string) {
+      string = baseToString(string);
+      return string && (string.charAt(0).toUpperCase() + string.slice(1));
+    }
+
+    /**
+     * Deburrs `string` by converting [latin-1 supplementary letters](https://en.wikipedia.org/wiki/Latin-1_Supplement_(Unicode_block)#Character_table)
+     * to basic latin letters and removing [combining diacritical marks](https://en.wikipedia.org/wiki/Combining_Diacritical_Marks).
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to deburr.
+     * @returns {string} Returns the deburred string.
+     * @example
+     *
+     * _.deburr('déjà vu');
+     * // => 'deja vu'
+     */
+    function deburr(string) {
+      string = baseToString(string);
+      return string && string.replace(reLatin1, deburrLetter).replace(reComboMark, '');
+    }
+
+    /**
+     * Checks if `string` ends with the given target string.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to search.
+     * @param {string} [target] The string to search for.
+     * @param {number} [position=string.length] The position to search from.
+     * @returns {boolean} Returns `true` if `string` ends with `target`, else `false`.
+     * @example
+     *
+     * _.endsWith('abc', 'c');
+     * // => true
+     *
+     * _.endsWith('abc', 'b');
+     * // => false
+     *
+     * _.endsWith('abc', 'b', 2);
+     * // => true
+     */
+    function endsWith(string, target, position) {
+      string = baseToString(string);
+      target = (target + '');
+
+      var length = string.length;
+      position = position === undefined
+        ? length
+        : nativeMin(position < 0 ? 0 : (+position || 0), length);
+
+      position -= target.length;
+      return position >= 0 && string.indexOf(target, position) == position;
+    }
+
+    /**
+     * Converts the characters "&", "<", ">", '"', "'", and "\`", in `string` to
+     * their corresponding HTML entities.
+     *
+     * **Note:** No other characters are escaped. To escape additional characters
+     * use a third-party library like [_he_](https://mths.be/he).
+     *
+     * Though the ">" character is escaped for symmetry, characters like
+     * ">" and "/" don't need escaping in HTML and have no special meaning
+     * unless they're part of a tag or unquoted attribute value.
+     * See [Mathias Bynens's article](https://mathiasbynens.be/notes/ambiguous-ampersands)
+     * (under "semi-related fun fact") for more details.
+     *
+     * Backticks are escaped because in Internet Explorer < 9, they can break out
+     * of attribute values or HTML comments. See [#59](https://html5sec.org/#59),
+     * [#102](https://html5sec.org/#102), [#108](https://html5sec.org/#108), and
+     * [#133](https://html5sec.org/#133) of the [HTML5 Security Cheatsheet](https://html5sec.org/)
+     * for more details.
+     *
+     * When working with HTML you should always [quote attribute values](http://wonko.com/post/html-escaping)
+     * to reduce XSS vectors.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to escape.
+     * @returns {string} Returns the escaped string.
+     * @example
+     *
+     * _.escape('fred, barney, & pebbles');
+     * // => 'fred, barney, &amp; pebbles'
+     */
+    function escape(string) {
+      // Reset `lastIndex` because in IE < 9 `String#replace` does not.
+      string = baseToString(string);
+      return (string && reHasUnescapedHtml.test(string))
+        ? string.replace(reUnescapedHtml, escapeHtmlChar)
+        : string;
+    }
+
+    /**
+     * Escapes the `RegExp` special characters "\", "/", "^", "$", ".", "|", "?",
+     * "*", "+", "(", ")", "[", "]", "{" and "}" in `string`.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to escape.
+     * @returns {string} Returns the escaped string.
+     * @example
+     *
+     * _.escapeRegExp('[lodash](https://lodash.com/)');
+     * // => '\[lodash\]\(https:\/\/lodash\.com\/\)'
+     */
+    function escapeRegExp(string) {
+      string = baseToString(string);
+      return (string && reHasRegExpChars.test(string))
+        ? string.replace(reRegExpChars, escapeRegExpChar)
+        : (string || '(?:)');
+    }
+
+    /**
+     * Converts `string` to [kebab case](https://en.wikipedia.org/wiki/Letter_case#Special_case_styles).
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to convert.
+     * @returns {string} Returns the kebab cased string.
+     * @example
+     *
+     * _.kebabCase('Foo Bar');
+     * // => 'foo-bar'
+     *
+     * _.kebabCase('fooBar');
+     * // => 'foo-bar'
+     *
+     * _.kebabCase('__foo_bar__');
+     * // => 'foo-bar'
+     */
+    var kebabCase = createCompounder(function(result, word, index) {
+      return result + (index ? '-' : '') + word.toLowerCase();
+    });
+
+    /**
+     * Pads `string` on the left and right sides if it's shorter than `length`.
+     * Padding characters are truncated if they can't be evenly divided by `length`.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to pad.
+     * @param {number} [length=0] The padding length.
+     * @param {string} [chars=' '] The string used as padding.
+     * @returns {string} Returns the padded string.
+     * @example
+     *
+     * _.pad('abc', 8);
+     * // => '  abc   '
+     *
+     * _.pad('abc', 8, '_-');
+     * // => '_-abc_-_'
+     *
+     * _.pad('abc', 3);
+     * // => 'abc'
+     */
+    function pad(string, length, chars) {
+      string = baseToString(string);
+      length = +length;
+
+      var strLength = string.length;
+      if (strLength >= length || !nativeIsFinite(length)) {
+        return string;
+      }
+      var mid = (length - strLength) / 2,
+          leftLength = nativeFloor(mid),
+          rightLength = nativeCeil(mid);
+
+      chars = createPadding('', rightLength, chars);
+      return chars.slice(0, leftLength) + string + chars;
+    }
+
+    /**
+     * Pads `string` on the left side if it's shorter than `length`. Padding
+     * characters are truncated if they exceed `length`.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to pad.
+     * @param {number} [length=0] The padding length.
+     * @param {string} [chars=' '] The string used as padding.
+     * @returns {string} Returns the padded string.
+     * @example
+     *
+     * _.padLeft('abc', 6);
+     * // => '   abc'
+     *
+     * _.padLeft('abc', 6, '_-');
+     * // => '_-_abc'
+     *
+     * _.padLeft('abc', 3);
+     * // => 'abc'
+     */
+    var padLeft = createPadDir();
+
+    /**
+     * Pads `string` on the right side if it's shorter than `length`. Padding
+     * characters are truncated if they exceed `length`.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to pad.
+     * @param {number} [length=0] The padding length.
+     * @param {string} [chars=' '] The string used as padding.
+     * @returns {string} Returns the padded string.
+     * @example
+     *
+     * _.padRight('abc', 6);
+     * // => 'abc   '
+     *
+     * _.padRight('abc', 6, '_-');
+     * // => 'abc_-_'
+     *
+     * _.padRight('abc', 3);
+     * // => 'abc'
+     */
+    var padRight = createPadDir(true);
+
+    /**
+     * Converts `string` to an integer of the specified radix. If `radix` is
+     * `undefined` or `0`, a `radix` of `10` is used unless `value` is a hexadecimal,
+     * in which case a `radix` of `16` is used.
+     *
+     * **Note:** This method aligns with the [ES5 implementation](https://es5.github.io/#E)
+     * of `parseInt`.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} string The string to convert.
+     * @param {number} [radix] The radix to interpret `value` by.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {number} Returns the converted integer.
+     * @example
+     *
+     * _.parseInt('08');
+     * // => 8
+     *
+     * _.map(['6', '08', '10'], _.parseInt);
+     * // => [6, 8, 10]
+     */
+    function parseInt(string, radix, guard) {
+      // Firefox < 21 and Opera < 15 follow ES3 for `parseInt`.
+      // Chrome fails to trim leading <BOM> whitespace characters.
+      // See https://code.google.com/p/v8/issues/detail?id=3109 for more details.
+      if (guard ? isIterateeCall(string, radix, guard) : radix == null) {
+        radix = 0;
+      } else if (radix) {
+        radix = +radix;
+      }
+      string = trim(string);
+      return nativeParseInt(string, radix || (reHasHexPrefix.test(string) ? 16 : 10));
+    }
+
+    /**
+     * Repeats the given string `n` times.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to repeat.
+     * @param {number} [n=0] The number of times to repeat the string.
+     * @returns {string} Returns the repeated string.
+     * @example
+     *
+     * _.repeat('*', 3);
+     * // => '***'
+     *
+     * _.repeat('abc', 2);
+     * // => 'abcabc'
+     *
+     * _.repeat('abc', 0);
+     * // => ''
+     */
+    function repeat(string, n) {
+      var result = '';
+      string = baseToString(string);
+      n = +n;
+      if (n < 1 || !string || !nativeIsFinite(n)) {
+        return result;
+      }
+      // Leverage the exponentiation by squaring algorithm for a faster repeat.
+      // See https://en.wikipedia.org/wiki/Exponentiation_by_squaring for more details.
+      do {
+        if (n % 2) {
+          result += string;
+        }
+        n = nativeFloor(n / 2);
+        string += string;
+      } while (n);
+
+      return result;
+    }
+
+    /**
+     * Converts `string` to [snake case](https://en.wikipedia.org/wiki/Snake_case).
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to convert.
+     * @returns {string} Returns the snake cased string.
+     * @example
+     *
+     * _.snakeCase('Foo Bar');
+     * // => 'foo_bar'
+     *
+     * _.snakeCase('fooBar');
+     * // => 'foo_bar'
+     *
+     * _.snakeCase('--foo-bar');
+     * // => 'foo_bar'
+     */
+    var snakeCase = createCompounder(function(result, word, index) {
+      return result + (index ? '_' : '') + word.toLowerCase();
+    });
+
+    /**
+     * Converts `string` to [start case](https://en.wikipedia.org/wiki/Letter_case#Stylistic_or_specialised_usage).
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to convert.
+     * @returns {string} Returns the start cased string.
+     * @example
+     *
+     * _.startCase('--foo-bar');
+     * // => 'Foo Bar'
+     *
+     * _.startCase('fooBar');
+     * // => 'Foo Bar'
+     *
+     * _.startCase('__foo_bar__');
+     * // => 'Foo Bar'
+     */
+    var startCase = createCompounder(function(result, word, index) {
+      return result + (index ? ' ' : '') + (word.charAt(0).toUpperCase() + word.slice(1));
+    });
+
+    /**
+     * Checks if `string` starts with the given target string.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to search.
+     * @param {string} [target] The string to search for.
+     * @param {number} [position=0] The position to search from.
+     * @returns {boolean} Returns `true` if `string` starts with `target`, else `false`.
+     * @example
+     *
+     * _.startsWith('abc', 'a');
+     * // => true
+     *
+     * _.startsWith('abc', 'b');
+     * // => false
+     *
+     * _.startsWith('abc', 'b', 1);
+     * // => true
+     */
+    function startsWith(string, target, position) {
+      string = baseToString(string);
+      position = position == null
+        ? 0
+        : nativeMin(position < 0 ? 0 : (+position || 0), string.length);
+
+      return string.lastIndexOf(target, position) == position;
+    }
+
+    /**
+     * Creates a compiled template function that can interpolate data properties
+     * in "interpolate" delimiters, HTML-escape interpolated data properties in
+     * "escape" delimiters, and execute JavaScript in "evaluate" delimiters. Data
+     * properties may be accessed as free variables in the template. If a setting
+     * object is provided it takes precedence over `_.templateSettings` values.
+     *
+     * **Note:** In the development build `_.template` utilizes
+     * [sourceURLs](http://www.html5rocks.com/en/tutorials/developertools/sourcemaps/#toc-sourceurl)
+     * for easier debugging.
+     *
+     * For more information on precompiling templates see
+     * [lodash's custom builds documentation](https://lodash.com/custom-builds).
+     *
+     * For more information on Chrome extension sandboxes see
+     * [Chrome's extensions documentation](https://developer.chrome.com/extensions/sandboxingEval).
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The template string.
+     * @param {Object} [options] The options object.
+     * @param {RegExp} [options.escape] The HTML "escape" delimiter.
+     * @param {RegExp} [options.evaluate] The "evaluate" delimiter.
+     * @param {Object} [options.imports] An object to import into the template as free variables.
+     * @param {RegExp} [options.interpolate] The "interpolate" delimiter.
+     * @param {string} [options.sourceURL] The sourceURL of the template's compiled source.
+     * @param {string} [options.variable] The data object variable name.
+     * @param- {Object} [otherOptions] Enables the legacy `options` param signature.
+     * @returns {Function} Returns the compiled template function.
+     * @example
+     *
+     * // using the "interpolate" delimiter to create a compiled template
+     * var compiled = _.template('hello <%= user %>!');
+     * compiled({ 'user': 'fred' });
+     * // => 'hello fred!'
+     *
+     * // using the HTML "escape" delimiter to escape data property values
+     * var compiled = _.template('<b><%- value %></b>');
+     * compiled({ 'value': '<script>' });
+     * // => '<b>&lt;script&gt;</b>'
+     *
+     * // using the "evaluate" delimiter to execute JavaScript and generate HTML
+     * var compiled = _.template('<% _.forEach(users, function(user) { %><li><%- user %></li><% }); %>');
+     * compiled({ 'users': ['fred', 'barney'] });
+     * // => '<li>fred</li><li>barney</li>'
+     *
+     * // using the internal `print` function in "evaluate" delimiters
+     * var compiled = _.template('<% print("hello " + user); %>!');
+     * compiled({ 'user': 'barney' });
+     * // => 'hello barney!'
+     *
+     * // using the ES delimiter as an alternative to the default "interpolate" delimiter
+     * var compiled = _.template('hello ${ user }!');
+     * compiled({ 'user': 'pebbles' });
+     * // => 'hello pebbles!'
+     *
+     * // using custom template delimiters
+     * _.templateSettings.interpolate = /{{([\s\S]+?)}}/g;
+     * var compiled = _.template('hello {{ user }}!');
+     * compiled({ 'user': 'mustache' });
+     * // => 'hello mustache!'
+     *
+     * // using backslashes to treat delimiters as plain text
+     * var compiled = _.template('<%= "\\<%- value %\\>" %>');
+     * compiled({ 'value': 'ignored' });
+     * // => '<%- value %>'
+     *
+     * // using the `imports` option to import `jQuery` as `jq`
+     * var text = '<% jq.each(users, function(user) { %><li><%- user %></li><% }); %>';
+     * var compiled = _.template(text, { 'imports': { 'jq': jQuery } });
+     * compiled({ 'users': ['fred', 'barney'] });
+     * // => '<li>fred</li><li>barney</li>'
+     *
+     * // using the `sourceURL` option to specify a custom sourceURL for the template
+     * var compiled = _.template('hello <%= user %>!', { 'sourceURL': '/basic/greeting.jst' });
+     * compiled(data);
+     * // => find the source of "greeting.jst" under the Sources tab or Resources panel of the web inspector
+     *
+     * // using the `variable` option to ensure a with-statement isn't used in the compiled template
+     * var compiled = _.template('hi <%= data.user %>!', { 'variable': 'data' });
+     * compiled.source;
+     * // => function(data) {
+     * //   var __t, __p = '';
+     * //   __p += 'hi ' + ((__t = ( data.user )) == null ? '' : __t) + '!';
+     * //   return __p;
+     * // }
+     *
+     * // using the `source` property to inline compiled templates for meaningful
+     * // line numbers in error messages and a stack trace
+     * fs.writeFileSync(path.join(cwd, 'jst.js'), '\
+     *   var JST = {\
+     *     "main": ' + _.template(mainText).source + '\
+     *   };\
+     * ');
+     */
+    function template(string, options, otherOptions) {
+      // Based on John Resig's `tmpl` implementation (http://ejohn.org/blog/javascript-micro-templating/)
+      // and Laura Doktorova's doT.js (https://github.com/olado/doT).
+      var settings = lodash.templateSettings;
+
+      if (otherOptions && isIterateeCall(string, options, otherOptions)) {
+        options = otherOptions = undefined;
+      }
+      string = baseToString(string);
+      options = assignWith(baseAssign({}, otherOptions || options), settings, assignOwnDefaults);
+
+      var imports = assignWith(baseAssign({}, options.imports), settings.imports, assignOwnDefaults),
+          importsKeys = keys(imports),
+          importsValues = baseValues(imports, importsKeys);
+
+      var isEscaping,
+          isEvaluating,
+          index = 0,
+          interpolate = options.interpolate || reNoMatch,
+          source = "__p += '";
+
+      // Compile the regexp to match each delimiter.
+      var reDelimiters = RegExp(
+        (options.escape || reNoMatch).source + '|' +
+        interpolate.source + '|' +
+        (interpolate === reInterpolate ? reEsTemplate : reNoMatch).source + '|' +
+        (options.evaluate || reNoMatch).source + '|$'
+      , 'g');
+
+      // Use a sourceURL for easier debugging.
+      var sourceURL = '//# sourceURL=' +
+        ('sourceURL' in options
+          ? options.sourceURL
+          : ('lodash.templateSources[' + (++templateCounter) + ']')
+        ) + '\n';
+
+      string.replace(reDelimiters, function(match, escapeValue, interpolateValue, esTemplateValue, evaluateValue, offset) {
+        interpolateValue || (interpolateValue = esTemplateValue);
+
+        // Escape characters that can't be included in string literals.
+        source += string.slice(index, offset).replace(reUnescapedString, escapeStringChar);
+
+        // Replace delimiters with snippets.
+        if (escapeValue) {
+          isEscaping = true;
+          source += "' +\n__e(" + escapeValue + ") +\n'";
+        }
+        if (evaluateValue) {
+          isEvaluating = true;
+          source += "';\n" + evaluateValue + ";\n__p += '";
+        }
+        if (interpolateValue) {
+          source += "' +\n((__t = (" + interpolateValue + ")) == null ? '' : __t) +\n'";
+        }
+        index = offset + match.length;
+
+        // The JS engine embedded in Adobe products requires returning the `match`
+        // string in order to produce the correct `offset` value.
+        return match;
+      });
+
+      source += "';\n";
+
+      // If `variable` is not specified wrap a with-statement around the generated
+      // code to add the data object to the top of the scope chain.
+      var variable = options.variable;
+      if (!variable) {
+        source = 'with (obj) {\n' + source + '\n}\n';
+      }
+      // Cleanup code by stripping empty strings.
+      source = (isEvaluating ? source.replace(reEmptyStringLeading, '') : source)
+        .replace(reEmptyStringMiddle, '$1')
+        .replace(reEmptyStringTrailing, '$1;');
+
+      // Frame code as the function body.
+      source = 'function(' + (variable || 'obj') + ') {\n' +
+        (variable
+          ? ''
+          : 'obj || (obj = {});\n'
+        ) +
+        "var __t, __p = ''" +
+        (isEscaping
+           ? ', __e = _.escape'
+           : ''
+        ) +
+        (isEvaluating
+          ? ', __j = Array.prototype.join;\n' +
+            "function print() { __p += __j.call(arguments, '') }\n"
+          : ';\n'
+        ) +
+        source +
+        'return __p\n}';
+
+      var result = attempt(function() {
+        return Function(importsKeys, sourceURL + 'return ' + source).apply(undefined, importsValues);
+      });
+
+      // Provide the compiled function's source by its `toString` method or
+      // the `source` property as a convenience for inlining compiled templates.
+      result.source = source;
+      if (isError(result)) {
+        throw result;
+      }
+      return result;
+    }
+
+    /**
+     * Removes leading and trailing whitespace or specified characters from `string`.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to trim.
+     * @param {string} [chars=whitespace] The characters to trim.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {string} Returns the trimmed string.
+     * @example
+     *
+     * _.trim('  abc  ');
+     * // => 'abc'
+     *
+     * _.trim('-_-abc-_-', '_-');
+     * // => 'abc'
+     *
+     * _.map(['  foo  ', '  bar  '], _.trim);
+     * // => ['foo', 'bar']
+     */
+    function trim(string, chars, guard) {
+      var value = string;
+      string = baseToString(string);
+      if (!string) {
+        return string;
+      }
+      if (guard ? isIterateeCall(value, chars, guard) : chars == null) {
+        return string.slice(trimmedLeftIndex(string), trimmedRightIndex(string) + 1);
+      }
+      chars = (chars + '');
+      return string.slice(charsLeftIndex(string, chars), charsRightIndex(string, chars) + 1);
+    }
+
+    /**
+     * Removes leading whitespace or specified characters from `string`.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to trim.
+     * @param {string} [chars=whitespace] The characters to trim.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {string} Returns the trimmed string.
+     * @example
+     *
+     * _.trimLeft('  abc  ');
+     * // => 'abc  '
+     *
+     * _.trimLeft('-_-abc-_-', '_-');
+     * // => 'abc-_-'
+     */
+    function trimLeft(string, chars, guard) {
+      var value = string;
+      string = baseToString(string);
+      if (!string) {
+        return string;
+      }
+      if (guard ? isIterateeCall(value, chars, guard) : chars == null) {
+        return string.slice(trimmedLeftIndex(string));
+      }
+      return string.slice(charsLeftIndex(string, (chars + '')));
+    }
+
+    /**
+     * Removes trailing whitespace or specified characters from `string`.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to trim.
+     * @param {string} [chars=whitespace] The characters to trim.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {string} Returns the trimmed string.
+     * @example
+     *
+     * _.trimRight('  abc  ');
+     * // => '  abc'
+     *
+     * _.trimRight('-_-abc-_-', '_-');
+     * // => '-_-abc'
+     */
+    function trimRight(string, chars, guard) {
+      var value = string;
+      string = baseToString(string);
+      if (!string) {
+        return string;
+      }
+      if (guard ? isIterateeCall(value, chars, guard) : chars == null) {
+        return string.slice(0, trimmedRightIndex(string) + 1);
+      }
+      return string.slice(0, charsRightIndex(string, (chars + '')) + 1);
+    }
+
+    /**
+     * Truncates `string` if it's longer than the given maximum string length.
+     * The last characters of the truncated string are replaced with the omission
+     * string which defaults to "...".
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to truncate.
+     * @param {Object|number} [options] The options object or maximum string length.
+     * @param {number} [options.length=30] The maximum string length.
+     * @param {string} [options.omission='...'] The string to indicate text is omitted.
+     * @param {RegExp|string} [options.separator] The separator pattern to truncate to.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {string} Returns the truncated string.
+     * @example
+     *
+     * _.trunc('hi-diddly-ho there, neighborino');
+     * // => 'hi-diddly-ho there, neighbo...'
+     *
+     * _.trunc('hi-diddly-ho there, neighborino', 24);
+     * // => 'hi-diddly-ho there, n...'
+     *
+     * _.trunc('hi-diddly-ho there, neighborino', {
+     *   'length': 24,
+     *   'separator': ' '
+     * });
+     * // => 'hi-diddly-ho there,...'
+     *
+     * _.trunc('hi-diddly-ho there, neighborino', {
+     *   'length': 24,
+     *   'separator': /,? +/
+     * });
+     * // => 'hi-diddly-ho there...'
+     *
+     * _.trunc('hi-diddly-ho there, neighborino', {
+     *   'omission': ' [...]'
+     * });
+     * // => 'hi-diddly-ho there, neig [...]'
+     */
+    function trunc(string, options, guard) {
+      if (guard && isIterateeCall(string, options, guard)) {
+        options = undefined;
+      }
+      var length = DEFAULT_TRUNC_LENGTH,
+          omission = DEFAULT_TRUNC_OMISSION;
+
+      if (options != null) {
+        if (isObject(options)) {
+          var separator = 'separator' in options ? options.separator : separator;
+          length = 'length' in options ? (+options.length || 0) : length;
+          omission = 'omission' in options ? baseToString(options.omission) : omission;
+        } else {
+          length = +options || 0;
+        }
+      }
+      string = baseToString(string);
+      if (length >= string.length) {
+        return string;
+      }
+      var end = length - omission.length;
+      if (end < 1) {
+        return omission;
+      }
+      var result = string.slice(0, end);
+      if (separator == null) {
+        return result + omission;
+      }
+      if (isRegExp(separator)) {
+        if (string.slice(end).search(separator)) {
+          var match,
+              newEnd,
+              substring = string.slice(0, end);
+
+          if (!separator.global) {
+            separator = RegExp(separator.source, (reFlags.exec(separator) || '') + 'g');
+          }
+          separator.lastIndex = 0;
+          while ((match = separator.exec(substring))) {
+            newEnd = match.index;
+          }
+          result = result.slice(0, newEnd == null ? end : newEnd);
+        }
+      } else if (string.indexOf(separator, end) != end) {
+        var index = result.lastIndexOf(separator);
+        if (index > -1) {
+          result = result.slice(0, index);
+        }
+      }
+      return result + omission;
+    }
+
+    /**
+     * The inverse of `_.escape`; this method converts the HTML entities
+     * `&amp;`, `&lt;`, `&gt;`, `&quot;`, `&#39;`, and `&#96;` in `string` to their
+     * corresponding characters.
+     *
+     * **Note:** No other HTML entities are unescaped. To unescape additional HTML
+     * entities use a third-party library like [_he_](https://mths.be/he).
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to unescape.
+     * @returns {string} Returns the unescaped string.
+     * @example
+     *
+     * _.unescape('fred, barney, &amp; pebbles');
+     * // => 'fred, barney, & pebbles'
+     */
+    function unescape(string) {
+      string = baseToString(string);
+      return (string && reHasEscapedHtml.test(string))
+        ? string.replace(reEscapedHtml, unescapeHtmlChar)
+        : string;
+    }
+
+    /**
+     * Splits `string` into an array of its words.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to inspect.
+     * @param {RegExp|string} [pattern] The pattern to match words.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Array} Returns the words of `string`.
+     * @example
+     *
+     * _.words('fred, barney, & pebbles');
+     * // => ['fred', 'barney', 'pebbles']
+     *
+     * _.words('fred, barney, & pebbles', /[^, ]+/g);
+     * // => ['fred', 'barney', '&', 'pebbles']
+     */
+    function words(string, pattern, guard) {
+      if (guard && isIterateeCall(string, pattern, guard)) {
+        pattern = undefined;
+      }
+      string = baseToString(string);
+      return string.match(pattern || reWords) || [];
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Attempts to invoke `func`, returning either the result or the caught error
+     * object. Any additional arguments are provided to `func` when it's invoked.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {Function} func The function to attempt.
+     * @returns {*} Returns the `func` result or error object.
+     * @example
+     *
+     * // avoid throwing errors for invalid selectors
+     * var elements = _.attempt(function(selector) {
+     *   return document.querySelectorAll(selector);
+     * }, '>_>');
+     *
+     * if (_.isError(elements)) {
+     *   elements = [];
+     * }
+     */
+    var attempt = restParam(function(func, args) {
+      try {
+        return func.apply(undefined, args);
+      } catch(e) {
+        return isError(e) ? e : new Error(e);
+      }
+    });
+
+    /**
+     * Creates a function that invokes `func` with the `this` binding of `thisArg`
+     * and arguments of the created function. If `func` is a property name the
+     * created callback returns the property value for a given element. If `func`
+     * is an object the created callback returns `true` for elements that contain
+     * the equivalent object properties, otherwise it returns `false`.
+     *
+     * @static
+     * @memberOf _
+     * @alias iteratee
+     * @category Utility
+     * @param {*} [func=_.identity] The value to convert to a callback.
+     * @param {*} [thisArg] The `this` binding of `func`.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Function} Returns the callback.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36 },
+     *   { 'user': 'fred',   'age': 40 }
+     * ];
+     *
+     * // wrap to create custom callback shorthands
+     * _.callback = _.wrap(_.callback, function(callback, func, thisArg) {
+     *   var match = /^(.+?)__([gl]t)(.+)$/.exec(func);
+     *   if (!match) {
+     *     return callback(func, thisArg);
+     *   }
+     *   return function(object) {
+     *     return match[2] == 'gt'
+     *       ? object[match[1]] > match[3]
+     *       : object[match[1]] < match[3];
+     *   };
+     * });
+     *
+     * _.filter(users, 'age__gt36');
+     * // => [{ 'user': 'fred', 'age': 40 }]
+     */
+    function callback(func, thisArg, guard) {
+      if (guard && isIterateeCall(func, thisArg, guard)) {
+        thisArg = undefined;
+      }
+      return isObjectLike(func)
+        ? matches(func)
+        : baseCallback(func, thisArg);
+    }
+
+    /**
+     * Creates a function that returns `value`.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {*} value The value to return from the new function.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var object = { 'user': 'fred' };
+     * var getter = _.constant(object);
+     *
+     * getter() === object;
+     * // => true
+     */
+    function constant(value) {
+      return function() {
+        return value;
+      };
+    }
+
+    /**
+     * This method returns the first argument provided to it.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {*} value Any value.
+     * @returns {*} Returns `value`.
+     * @example
+     *
+     * var object = { 'user': 'fred' };
+     *
+     * _.identity(object) === object;
+     * // => true
+     */
+    function identity(value) {
+      return value;
+    }
+
+    /**
+     * Creates a function that performs a deep comparison between a given object
+     * and `source`, returning `true` if the given object has equivalent property
+     * values, else `false`.
+     *
+     * **Note:** This method supports comparing arrays, booleans, `Date` objects,
+     * numbers, `Object` objects, regexes, and strings. Objects are compared by
+     * their own, not inherited, enumerable properties. For comparing a single
+     * own or inherited property value see `_.matchesProperty`.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {Object} source The object of property values to match.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36, 'active': true },
+     *   { 'user': 'fred',   'age': 40, 'active': false }
+     * ];
+     *
+     * _.filter(users, _.matches({ 'age': 40, 'active': false }));
+     * // => [{ 'user': 'fred', 'age': 40, 'active': false }]
+     */
+    function matches(source) {
+      return baseMatches(baseClone(source, true));
+    }
+
+    /**
+     * Creates a function that compares the property value of `path` on a given
+     * object to `value`.
+     *
+     * **Note:** This method supports comparing arrays, booleans, `Date` objects,
+     * numbers, `Object` objects, regexes, and strings. Objects are compared by
+     * their own, not inherited, enumerable properties.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {Array|string} path The path of the property to get.
+     * @param {*} srcValue The value to match.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney' },
+     *   { 'user': 'fred' }
+     * ];
+     *
+     * _.find(users, _.matchesProperty('user', 'fred'));
+     * // => { 'user': 'fred' }
+     */
+    function matchesProperty(path, srcValue) {
+      return baseMatchesProperty(path, baseClone(srcValue, true));
+    }
+
+    /**
+     * Creates a function that invokes the method at `path` on a given object.
+     * Any additional arguments are provided to the invoked method.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {Array|string} path The path of the method to invoke.
+     * @param {...*} [args] The arguments to invoke the method with.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var objects = [
+     *   { 'a': { 'b': { 'c': _.constant(2) } } },
+     *   { 'a': { 'b': { 'c': _.constant(1) } } }
+     * ];
+     *
+     * _.map(objects, _.method('a.b.c'));
+     * // => [2, 1]
+     *
+     * _.invoke(_.sortBy(objects, _.method(['a', 'b', 'c'])), 'a.b.c');
+     * // => [1, 2]
+     */
+    var method = restParam(function(path, args) {
+      return function(object) {
+        return invokePath(object, path, args);
+      };
+    });
+
+    /**
+     * The opposite of `_.method`; this method creates a function that invokes
+     * the method at a given path on `object`. Any additional arguments are
+     * provided to the invoked method.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {Object} object The object to query.
+     * @param {...*} [args] The arguments to invoke the method with.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var array = _.times(3, _.constant),
+     *     object = { 'a': array, 'b': array, 'c': array };
+     *
+     * _.map(['a[2]', 'c[0]'], _.methodOf(object));
+     * // => [2, 0]
+     *
+     * _.map([['a', '2'], ['c', '0']], _.methodOf(object));
+     * // => [2, 0]
+     */
+    var methodOf = restParam(function(object, args) {
+      return function(path) {
+        return invokePath(object, path, args);
+      };
+    });
+
+    /**
+     * Adds all own enumerable function properties of a source object to the
+     * destination object. If `object` is a function then methods are added to
+     * its prototype as well.
+     *
+     * **Note:** Use `_.runInContext` to create a pristine `lodash` function to
+     * avoid conflicts caused by modifying the original.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {Function|Object} [object=lodash] The destination object.
+     * @param {Object} source The object of functions to add.
+     * @param {Object} [options] The options object.
+     * @param {boolean} [options.chain=true] Specify whether the functions added
+     *  are chainable.
+     * @returns {Function|Object} Returns `object`.
+     * @example
+     *
+     * function vowels(string) {
+     *   return _.filter(string, function(v) {
+     *     return /[aeiou]/i.test(v);
+     *   });
+     * }
+     *
+     * _.mixin({ 'vowels': vowels });
+     * _.vowels('fred');
+     * // => ['e']
+     *
+     * _('fred').vowels().value();
+     * // => ['e']
+     *
+     * _.mixin({ 'vowels': vowels }, { 'chain': false });
+     * _('fred').vowels();
+     * // => ['e']
+     */
+    function mixin(object, source, options) {
+      if (options == null) {
+        var isObj = isObject(source),
+            props = isObj ? keys(source) : undefined,
+            methodNames = (props && props.length) ? baseFunctions(source, props) : undefined;
+
+        if (!(methodNames ? methodNames.length : isObj)) {
+          methodNames = false;
+          options = source;
+          source = object;
+          object = this;
+        }
+      }
+      if (!methodNames) {
+        methodNames = baseFunctions(source, keys(source));
+      }
+      var chain = true,
+          index = -1,
+          isFunc = isFunction(object),
+          length = methodNames.length;
+
+      if (options === false) {
+        chain = false;
+      } else if (isObject(options) && 'chain' in options) {
+        chain = options.chain;
+      }
+      while (++index < length) {
+        var methodName = methodNames[index],
+            func = source[methodName];
+
+        object[methodName] = func;
+        if (isFunc) {
+          object.prototype[methodName] = (function(func) {
+            return function() {
+              var chainAll = this.__chain__;
+              if (chain || chainAll) {
+                var result = object(this.__wrapped__),
+                    actions = result.__actions__ = arrayCopy(this.__actions__);
+
+                actions.push({ 'func': func, 'args': arguments, 'thisArg': object });
+                result.__chain__ = chainAll;
+                return result;
+              }
+              return func.apply(object, arrayPush([this.value()], arguments));
+            };
+          }(func));
+        }
+      }
+      return object;
+    }
+
+    /**
+     * Reverts the `_` variable to its previous value and returns a reference to
+     * the `lodash` function.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @returns {Function} Returns the `lodash` function.
+     * @example
+     *
+     * var lodash = _.noConflict();
+     */
+    function noConflict() {
+      root._ = oldDash;
+      return this;
+    }
+
+    /**
+     * A no-operation function that returns `undefined` regardless of the
+     * arguments it receives.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @example
+     *
+     * var object = { 'user': 'fred' };
+     *
+     * _.noop(object) === undefined;
+     * // => true
+     */
+    function noop() {
+      // No operation performed.
+    }
+
+    /**
+     * Creates a function that returns the property value at `path` on a
+     * given object.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {Array|string} path The path of the property to get.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var objects = [
+     *   { 'a': { 'b': { 'c': 2 } } },
+     *   { 'a': { 'b': { 'c': 1 } } }
+     * ];
+     *
+     * _.map(objects, _.property('a.b.c'));
+     * // => [2, 1]
+     *
+     * _.pluck(_.sortBy(objects, _.property(['a', 'b', 'c'])), 'a.b.c');
+     * // => [1, 2]
+     */
+    function property(path) {
+      return isKey(path) ? baseProperty(path) : basePropertyDeep(path);
+    }
+
+    /**
+     * The opposite of `_.property`; this method creates a function that returns
+     * the property value at a given path on `object`.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {Object} object The object to query.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var array = [0, 1, 2],
+     *     object = { 'a': array, 'b': array, 'c': array };
+     *
+     * _.map(['a[2]', 'c[0]'], _.propertyOf(object));
+     * // => [2, 0]
+     *
+     * _.map([['a', '2'], ['c', '0']], _.propertyOf(object));
+     * // => [2, 0]
+     */
+    function propertyOf(object) {
+      return function(path) {
+        return baseGet(object, toPath(path), (path + ''));
+      };
+    }
+
+    /**
+     * Creates an array of numbers (positive and/or negative) progressing from
+     * `start` up to, but not including, `end`. If `end` is not specified it's
+     * set to `start` with `start` then set to `0`. If `end` is less than `start`
+     * a zero-length range is created unless a negative `step` is specified.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {number} [start=0] The start of the range.
+     * @param {number} end The end of the range.
+     * @param {number} [step=1] The value to increment or decrement by.
+     * @returns {Array} Returns the new array of numbers.
+     * @example
+     *
+     * _.range(4);
+     * // => [0, 1, 2, 3]
+     *
+     * _.range(1, 5);
+     * // => [1, 2, 3, 4]
+     *
+     * _.range(0, 20, 5);
+     * // => [0, 5, 10, 15]
+     *
+     * _.range(0, -4, -1);
+     * // => [0, -1, -2, -3]
+     *
+     * _.range(1, 4, 0);
+     * // => [1, 1, 1]
+     *
+     * _.range(0);
+     * // => []
+     */
+    function range(start, end, step) {
+      if (step && isIterateeCall(start, end, step)) {
+        end = step = undefined;
+      }
+      start = +start || 0;
+      step = step == null ? 1 : (+step || 0);
+
+      if (end == null) {
+        end = start;
+        start = 0;
+      } else {
+        end = +end || 0;
+      }
+      // Use `Array(length)` so engines like Chakra and V8 avoid slower modes.
+      // See https://youtu.be/XAqIpGU8ZZk#t=17m25s for more details.
+      var index = -1,
+          length = nativeMax(nativeCeil((end - start) / (step || 1)), 0),
+          result = Array(length);
+
+      while (++index < length) {
+        result[index] = start;
+        start += step;
+      }
+      return result;
+    }
+
+    /**
+     * Invokes the iteratee function `n` times, returning an array of the results
+     * of each invocation. The `iteratee` is bound to `thisArg` and invoked with
+     * one argument; (index).
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {number} n The number of times to invoke `iteratee`.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Array} Returns the array of results.
+     * @example
+     *
+     * var diceRolls = _.times(3, _.partial(_.random, 1, 6, false));
+     * // => [3, 6, 4]
+     *
+     * _.times(3, function(n) {
+     *   mage.castSpell(n);
+     * });
+     * // => invokes `mage.castSpell(n)` three times with `n` of `0`, `1`, and `2`
+     *
+     * _.times(3, function(n) {
+     *   this.cast(n);
+     * }, mage);
+     * // => also invokes `mage.castSpell(n)` three times
+     */
+    function times(n, iteratee, thisArg) {
+      n = nativeFloor(n);
+
+      // Exit early to avoid a JSC JIT bug in Safari 8
+      // where `Array(0)` is treated as `Array(1)`.
+      if (n < 1 || !nativeIsFinite(n)) {
+        return [];
+      }
+      var index = -1,
+          result = Array(nativeMin(n, MAX_ARRAY_LENGTH));
+
+      iteratee = bindCallback(iteratee, thisArg, 1);
+      while (++index < n) {
+        if (index < MAX_ARRAY_LENGTH) {
+          result[index] = iteratee(index);
+        } else {
+          iteratee(index);
+        }
+      }
+      return result;
+    }
+
+    /**
+     * Generates a unique ID. If `prefix` is provided the ID is appended to it.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {string} [prefix] The value to prefix the ID with.
+     * @returns {string} Returns the unique ID.
+     * @example
+     *
+     * _.uniqueId('contact_');
+     * // => 'contact_104'
+     *
+     * _.uniqueId();
+     * // => '105'
+     */
+    function uniqueId(prefix) {
+      var id = ++idCounter;
+      return baseToString(prefix) + id;
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Adds two numbers.
+     *
+     * @static
+     * @memberOf _
+     * @category Math
+     * @param {number} augend The first number to add.
+     * @param {number} addend The second number to add.
+     * @returns {number} Returns the sum.
+     * @example
+     *
+     * _.add(6, 4);
+     * // => 10
+     */
+    function add(augend, addend) {
+      return (+augend || 0) + (+addend || 0);
+    }
+
+    /**
+     * Calculates `n` rounded up to `precision`.
+     *
+     * @static
+     * @memberOf _
+     * @category Math
+     * @param {number} n The number to round up.
+     * @param {number} [precision=0] The precision to round up to.
+     * @returns {number} Returns the rounded up number.
+     * @example
+     *
+     * _.ceil(4.006);
+     * // => 5
+     *
+     * _.ceil(6.004, 2);
+     * // => 6.01
+     *
+     * _.ceil(6040, -2);
+     * // => 6100
+     */
+    var ceil = createRound('ceil');
+
+    /**
+     * Calculates `n` rounded down to `precision`.
+     *
+     * @static
+     * @memberOf _
+     * @category Math
+     * @param {number} n The number to round down.
+     * @param {number} [precision=0] The precision to round down to.
+     * @returns {number} Returns the rounded down number.
+     * @example
+     *
+     * _.floor(4.006);
+     * // => 4
+     *
+     * _.floor(0.046, 2);
+     * // => 0.04
+     *
+     * _.floor(4060, -2);
+     * // => 4000
+     */
+    var floor = createRound('floor');
+
+    /**
+     * Gets the maximum value of `collection`. If `collection` is empty or falsey
+     * `-Infinity` is returned. If an iteratee function is provided it's invoked
+     * for each value in `collection` to generate the criterion by which the value
+     * is ranked. The `iteratee` is bound to `thisArg` and invoked with three
+     * arguments: (value, index, collection).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Math
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [iteratee] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {*} Returns the maximum value.
+     * @example
+     *
+     * _.max([4, 2, 8, 6]);
+     * // => 8
+     *
+     * _.max([]);
+     * // => -Infinity
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36 },
+     *   { 'user': 'fred',   'age': 40 }
+     * ];
+     *
+     * _.max(users, function(chr) {
+     *   return chr.age;
+     * });
+     * // => { 'user': 'fred', 'age': 40 }
+     *
+     * // using the `_.property` callback shorthand
+     * _.max(users, 'age');
+     * // => { 'user': 'fred', 'age': 40 }
+     */
+    var max = createExtremum(gt, NEGATIVE_INFINITY);
+
+    /**
+     * Gets the minimum value of `collection`. If `collection` is empty or falsey
+     * `Infinity` is returned. If an iteratee function is provided it's invoked
+     * for each value in `collection` to generate the criterion by which the value
+     * is ranked. The `iteratee` is bound to `thisArg` and invoked with three
+     * arguments: (value, index, collection).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Math
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [iteratee] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {*} Returns the minimum value.
+     * @example
+     *
+     * _.min([4, 2, 8, 6]);
+     * // => 2
+     *
+     * _.min([]);
+     * // => Infinity
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36 },
+     *   { 'user': 'fred',   'age': 40 }
+     * ];
+     *
+     * _.min(users, function(chr) {
+     *   return chr.age;
+     * });
+     * // => { 'user': 'barney', 'age': 36 }
+     *
+     * // using the `_.property` callback shorthand
+     * _.min(users, 'age');
+     * // => { 'user': 'barney', 'age': 36 }
+     */
+    var min = createExtremum(lt, POSITIVE_INFINITY);
+
+    /**
+     * Calculates `n` rounded to `precision`.
+     *
+     * @static
+     * @memberOf _
+     * @category Math
+     * @param {number} n The number to round.
+     * @param {number} [precision=0] The precision to round to.
+     * @returns {number} Returns the rounded number.
+     * @example
+     *
+     * _.round(4.006);
+     * // => 4
+     *
+     * _.round(4.006, 2);
+     * // => 4.01
+     *
+     * _.round(4060, -2);
+     * // => 4100
+     */
+    var round = createRound('round');
+
+    /**
+     * Gets the sum of the values in `collection`.
+     *
+     * @static
+     * @memberOf _
+     * @category Math
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [iteratee] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {number} Returns the sum.
+     * @example
+     *
+     * _.sum([4, 6]);
+     * // => 10
+     *
+     * _.sum({ 'a': 4, 'b': 6 });
+     * // => 10
+     *
+     * var objects = [
+     *   { 'n': 4 },
+     *   { 'n': 6 }
+     * ];
+     *
+     * _.sum(objects, function(object) {
+     *   return object.n;
+     * });
+     * // => 10
+     *
+     * // using the `_.property` callback shorthand
+     * _.sum(objects, 'n');
+     * // => 10
+     */
+    function sum(collection, iteratee, thisArg) {
+      if (thisArg && isIterateeCall(collection, iteratee, thisArg)) {
+        iteratee = undefined;
+      }
+      iteratee = getCallback(iteratee, thisArg, 3);
+      return iteratee.length == 1
+        ? arraySum(isArray(collection) ? collection : toIterable(collection), iteratee)
+        : baseSum(collection, iteratee);
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    // Ensure wrappers are instances of `baseLodash`.
+    lodash.prototype = baseLodash.prototype;
+
+    LodashWrapper.prototype = baseCreate(baseLodash.prototype);
+    LodashWrapper.prototype.constructor = LodashWrapper;
+
+    LazyWrapper.prototype = baseCreate(baseLodash.prototype);
+    LazyWrapper.prototype.constructor = LazyWrapper;
+
+    // Add functions to the `Map` cache.
+    MapCache.prototype['delete'] = mapDelete;
+    MapCache.prototype.get = mapGet;
+    MapCache.prototype.has = mapHas;
+    MapCache.prototype.set = mapSet;
+
+    // Add functions to the `Set` cache.
+    SetCache.prototype.push = cachePush;
+
+    // Assign cache to `_.memoize`.
+    memoize.Cache = MapCache;
+
+    // Add functions that return wrapped values when chaining.
+    lodash.after = after;
+    lodash.ary = ary;
+    lodash.assign = assign;
+    lodash.at = at;
+    lodash.before = before;
+    lodash.bind = bind;
+    lodash.bindAll = bindAll;
+    lodash.bindKey = bindKey;
+    lodash.callback = callback;
+    lodash.chain = chain;
+    lodash.chunk = chunk;
+    lodash.compact = compact;
+    lodash.constant = constant;
+    lodash.countBy = countBy;
+    lodash.create = create;
+    lodash.curry = curry;
+    lodash.curryRight = curryRight;
+    lodash.debounce = debounce;
+    lodash.defaults = defaults;
+    lodash.defaultsDeep = defaultsDeep;
+    lodash.defer = defer;
+    lodash.delay = delay;
+    lodash.difference = difference;
+    lodash.drop = drop;
+    lodash.dropRight = dropRight;
+    lodash.dropRightWhile = dropRightWhile;
+    lodash.dropWhile = dropWhile;
+    lodash.fill = fill;
+    lodash.filter = filter;
+    lodash.flatten = flatten;
+    lodash.flattenDeep = flattenDeep;
+    lodash.flow = flow;
+    lodash.flowRight = flowRight;
+    lodash.forEach = forEach;
+    lodash.forEachRight = forEachRight;
+    lodash.forIn = forIn;
+    lodash.forInRight = forInRight;
+    lodash.forOwn = forOwn;
+    lodash.forOwnRight = forOwnRight;
+    lodash.functions = functions;
+    lodash.groupBy = groupBy;
+    lodash.indexBy = indexBy;
+    lodash.initial = initial;
+    lodash.intersection = intersection;
+    lodash.invert = invert;
+    lodash.invoke = invoke;
+    lodash.keys = keys;
+    lodash.keysIn = keysIn;
+    lodash.map = map;
+    lodash.mapKeys = mapKeys;
+    lodash.mapValues = mapValues;
+    lodash.matches = matches;
+    lodash.matchesProperty = matchesProperty;
+    lodash.memoize = memoize;
+    lodash.merge = merge;
+    lodash.method = method;
+    lodash.methodOf = methodOf;
+    lodash.mixin = mixin;
+    lodash.modArgs = modArgs;
+    lodash.negate = negate;
+    lodash.omit = omit;
+    lodash.once = once;
+    lodash.pairs = pairs;
+    lodash.partial = partial;
+    lodash.partialRight = partialRight;
+    lodash.partition = partition;
+    lodash.pick = pick;
+    lodash.pluck = pluck;
+    lodash.property = property;
+    lodash.propertyOf = propertyOf;
+    lodash.pull = pull;
+    lodash.pullAt = pullAt;
+    lodash.range = range;
+    lodash.rearg = rearg;
+    lodash.reject = reject;
+    lodash.remove = remove;
+    lodash.rest = rest;
+    lodash.restParam = restParam;
+    lodash.set = set;
+    lodash.shuffle = shuffle;
+    lodash.slice = slice;
+    lodash.sortBy = sortBy;
+    lodash.sortByAll = sortByAll;
+    lodash.sortByOrder = sortByOrder;
+    lodash.spread = spread;
+    lodash.take = take;
+    lodash.takeRight = takeRight;
+    lodash.takeRightWhile = takeRightWhile;
+    lodash.takeWhile = takeWhile;
+    lodash.tap = tap;
+    lodash.throttle = throttle;
+    lodash.thru = thru;
+    lodash.times = times;
+    lodash.toArray = toArray;
+    lodash.toPlainObject = toPlainObject;
+    lodash.transform = transform;
+    lodash.union = union;
+    lodash.uniq = uniq;
+    lodash.unzip = unzip;
+    lodash.unzipWith = unzipWith;
+    lodash.values = values;
+    lodash.valuesIn = valuesIn;
+    lodash.where = where;
+    lodash.without = without;
+    lodash.wrap = wrap;
+    lodash.xor = xor;
+    lodash.zip = zip;
+    lodash.zipObject = zipObject;
+    lodash.zipWith = zipWith;
+
+    // Add aliases.
+    lodash.backflow = flowRight;
+    lodash.collect = map;
+    lodash.compose = flowRight;
+    lodash.each = forEach;
+    lodash.eachRight = forEachRight;
+    lodash.extend = assign;
+    lodash.iteratee = callback;
+    lodash.methods = functions;
+    lodash.object = zipObject;
+    lodash.select = filter;
+    lodash.tail = rest;
+    lodash.unique = uniq;
+
+    // Add functions to `lodash.prototype`.
+    mixin(lodash, lodash);
+
+    /*------------------------------------------------------------------------*/
+
+    // Add functions that return unwrapped values when chaining.
+    lodash.add = add;
+    lodash.attempt = attempt;
+    lodash.camelCase = camelCase;
+    lodash.capitalize = capitalize;
+    lodash.ceil = ceil;
+    lodash.clone = clone;
+    lodash.cloneDeep = cloneDeep;
+    lodash.deburr = deburr;
+    lodash.endsWith = endsWith;
+    lodash.escape = escape;
+    lodash.escapeRegExp = escapeRegExp;
+    lodash.every = every;
+    lodash.find = find;
+    lodash.findIndex = findIndex;
+    lodash.findKey = findKey;
+    lodash.findLast = findLast;
+    lodash.findLastIndex = findLastIndex;
+    lodash.findLastKey = findLastKey;
+    lodash.findWhere = findWhere;
+    lodash.first = first;
+    lodash.floor = floor;
+    lodash.get = get;
+    lodash.gt = gt;
+    lodash.gte = gte;
+    lodash.has = has;
+    lodash.identity = identity;
+    lodash.includes = includes;
+    lodash.indexOf = indexOf;
+    lodash.inRange = inRange;
+    lodash.isArguments = isArguments;
+    lodash.isArray = isArray;
+    lodash.isBoolean = isBoolean;
+    lodash.isDate = isDate;
+    lodash.isElement = isElement;
+    lodash.isEmpty = isEmpty;
+    lodash.isEqual = isEqual;
+    lodash.isError = isError;
+    lodash.isFinite = isFinite;
+    lodash.isFunction = isFunction;
+    lodash.isMatch = isMatch;
+    lodash.isNaN = isNaN;
+    lodash.isNative = isNative;
+    lodash.isNull = isNull;
+    lodash.isNumber = isNumber;
+    lodash.isObject = isObject;
+    lodash.isPlainObject = isPlainObject;
+    lodash.isRegExp = isRegExp;
+    lodash.isString = isString;
+    lodash.isTypedArray = isTypedArray;
+    lodash.isUndefined = isUndefined;
+    lodash.kebabCase = kebabCase;
+    lodash.last = last;
+    lodash.lastIndexOf = lastIndexOf;
+    lodash.lt = lt;
+    lodash.lte = lte;
+    lodash.max = max;
+    lodash.min = min;
+    lodash.noConflict = noConflict;
+    lodash.noop = noop;
+    lodash.now = now;
+    lodash.pad = pad;
+    lodash.padLeft = padLeft;
+    lodash.padRight = padRight;
+    lodash.parseInt = parseInt;
+    lodash.random = random;
+    lodash.reduce = reduce;
+    lodash.reduceRight = reduceRight;
+    lodash.repeat = repeat;
+    lodash.result = result;
+    lodash.round = round;
+    lodash.runInContext = runInContext;
+    lodash.size = size;
+    lodash.snakeCase = snakeCase;
+    lodash.some = some;
+    lodash.sortedIndex = sortedIndex;
+    lodash.sortedLastIndex = sortedLastIndex;
+    lodash.startCase = startCase;
+    lodash.startsWith = startsWith;
+    lodash.sum = sum;
+    lodash.template = template;
+    lodash.trim = trim;
+    lodash.trimLeft = trimLeft;
+    lodash.trimRight = trimRight;
+    lodash.trunc = trunc;
+    lodash.unescape = unescape;
+    lodash.uniqueId = uniqueId;
+    lodash.words = words;
+
+    // Add aliases.
+    lodash.all = every;
+    lodash.any = some;
+    lodash.contains = includes;
+    lodash.eq = isEqual;
+    lodash.detect = find;
+    lodash.foldl = reduce;
+    lodash.foldr = reduceRight;
+    lodash.head = first;
+    lodash.include = includes;
+    lodash.inject = reduce;
+
+    mixin(lodash, (function() {
+      var source = {};
+      baseForOwn(lodash, function(func, methodName) {
+        if (!lodash.prototype[methodName]) {
+          source[methodName] = func;
+        }
+      });
+      return source;
+    }()), false);
+
+    /*------------------------------------------------------------------------*/
+
+    // Add functions capable of returning wrapped and unwrapped values when chaining.
+    lodash.sample = sample;
+
+    lodash.prototype.sample = function(n) {
+      if (!this.__chain__ && n == null) {
+        return sample(this.value());
+      }
+      return this.thru(function(value) {
+        return sample(value, n);
+      });
+    };
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * The semantic version number.
+     *
+     * @static
+     * @memberOf _
+     * @type string
+     */
+    lodash.VERSION = VERSION;
+
+    // Assign default placeholders.
+    arrayEach(['bind', 'bindKey', 'curry', 'curryRight', 'partial', 'partialRight'], function(methodName) {
+      lodash[methodName].placeholder = lodash;
+    });
+
+    // Add `LazyWrapper` methods for `_.drop` and `_.take` variants.
+    arrayEach(['drop', 'take'], function(methodName, index) {
+      LazyWrapper.prototype[methodName] = function(n) {
+        var filtered = this.__filtered__;
+        if (filtered && !index) {
+          return new LazyWrapper(this);
+        }
+        n = n == null ? 1 : nativeMax(nativeFloor(n) || 0, 0);
+
+        var result = this.clone();
+        if (filtered) {
+          result.__takeCount__ = nativeMin(result.__takeCount__, n);
+        } else {
+          result.__views__.push({ 'size': n, 'type': methodName + (result.__dir__ < 0 ? 'Right' : '') });
+        }
+        return result;
+      };
+
+      LazyWrapper.prototype[methodName + 'Right'] = function(n) {
+        return this.reverse()[methodName](n).reverse();
+      };
+    });
+
+    // Add `LazyWrapper` methods that accept an `iteratee` value.
+    arrayEach(['filter', 'map', 'takeWhile'], function(methodName, index) {
+      var type = index + 1,
+          isFilter = type != LAZY_MAP_FLAG;
+
+      LazyWrapper.prototype[methodName] = function(iteratee, thisArg) {
+        var result = this.clone();
+        result.__iteratees__.push({ 'iteratee': getCallback(iteratee, thisArg, 1), 'type': type });
+        result.__filtered__ = result.__filtered__ || isFilter;
+        return result;
+      };
+    });
+
+    // Add `LazyWrapper` methods for `_.first` and `_.last`.
+    arrayEach(['first', 'last'], function(methodName, index) {
+      var takeName = 'take' + (index ? 'Right' : '');
+
+      LazyWrapper.prototype[methodName] = function() {
+        return this[takeName](1).value()[0];
+      };
+    });
+
+    // Add `LazyWrapper` methods for `_.initial` and `_.rest`.
+    arrayEach(['initial', 'rest'], function(methodName, index) {
+      var dropName = 'drop' + (index ? '' : 'Right');
+
+      LazyWrapper.prototype[methodName] = function() {
+        return this.__filtered__ ? new LazyWrapper(this) : this[dropName](1);
+      };
+    });
+
+    // Add `LazyWrapper` methods for `_.pluck` and `_.where`.
+    arrayEach(['pluck', 'where'], function(methodName, index) {
+      var operationName = index ? 'filter' : 'map',
+          createCallback = index ? baseMatches : property;
+
+      LazyWrapper.prototype[methodName] = function(value) {
+        return this[operationName](createCallback(value));
+      };
+    });
+
+    LazyWrapper.prototype.compact = function() {
+      return this.filter(identity);
+    };
+
+    LazyWrapper.prototype.reject = function(predicate, thisArg) {
+      predicate = getCallback(predicate, thisArg, 1);
+      return this.filter(function(value) {
+        return !predicate(value);
+      });
+    };
+
+    LazyWrapper.prototype.slice = function(start, end) {
+      start = start == null ? 0 : (+start || 0);
+
+      var result = this;
+      if (result.__filtered__ && (start > 0 || end < 0)) {
+        return new LazyWrapper(result);
+      }
+      if (start < 0) {
+        result = result.takeRight(-start);
+      } else if (start) {
+        result = result.drop(start);
+      }
+      if (end !== undefined) {
+        end = (+end || 0);
+        result = end < 0 ? result.dropRight(-end) : result.take(end - start);
+      }
+      return result;
+    };
+
+    LazyWrapper.prototype.takeRightWhile = function(predicate, thisArg) {
+      return this.reverse().takeWhile(predicate, thisArg).reverse();
+    };
+
+    LazyWrapper.prototype.toArray = function() {
+      return this.take(POSITIVE_INFINITY);
+    };
+
+    // Add `LazyWrapper` methods to `lodash.prototype`.
+    baseForOwn(LazyWrapper.prototype, function(func, methodName) {
+      var checkIteratee = /^(?:filter|map|reject)|While$/.test(methodName),
+          retUnwrapped = /^(?:first|last)$/.test(methodName),
+          lodashFunc = lodash[retUnwrapped ? ('take' + (methodName == 'last' ? 'Right' : '')) : methodName];
+
+      if (!lodashFunc) {
+        return;
+      }
+      lodash.prototype[methodName] = function() {
+        var args = retUnwrapped ? [1] : arguments,
+            chainAll = this.__chain__,
+            value = this.__wrapped__,
+            isHybrid = !!this.__actions__.length,
+            isLazy = value instanceof LazyWrapper,
+            iteratee = args[0],
+            useLazy = isLazy || isArray(value);
+
+        if (useLazy && checkIteratee && typeof iteratee == 'function' && iteratee.length != 1) {
+          // Avoid lazy use if the iteratee has a "length" value other than `1`.
+          isLazy = useLazy = false;
+        }
+        var interceptor = function(value) {
+          return (retUnwrapped && chainAll)
+            ? lodashFunc(value, 1)[0]
+            : lodashFunc.apply(undefined, arrayPush([value], args));
+        };
+
+        var action = { 'func': thru, 'args': [interceptor], 'thisArg': undefined },
+            onlyLazy = isLazy && !isHybrid;
+
+        if (retUnwrapped && !chainAll) {
+          if (onlyLazy) {
+            value = value.clone();
+            value.__actions__.push(action);
+            return func.call(value);
+          }
+          return lodashFunc.call(undefined, this.value())[0];
+        }
+        if (!retUnwrapped && useLazy) {
+          value = onlyLazy ? value : new LazyWrapper(this);
+          var result = func.apply(value, args);
+          result.__actions__.push(action);
+          return new LodashWrapper(result, chainAll);
+        }
+        return this.thru(interceptor);
+      };
+    });
+
+    // Add `Array` and `String` methods to `lodash.prototype`.
+    arrayEach(['join', 'pop', 'push', 'replace', 'shift', 'sort', 'splice', 'split', 'unshift'], function(methodName) {
+      var protoFunc = (/^(?:replace|split)$/.test(methodName) ? stringProto : arrayProto)[methodName],
+          chainName = /^(?:push|sort|unshift)$/.test(methodName) ? 'tap' : 'thru',
+          fixObjects = !support.spliceObjects && /^(?:pop|shift|splice)$/.test(methodName),
+          retUnwrapped = /^(?:join|pop|replace|shift)$/.test(methodName);
+
+      // Avoid array-like object bugs with `Array#shift` and `Array#splice` in
+      // IE < 9, Firefox < 10, and RingoJS.
+      var func = !fixObjects ? protoFunc : function() {
+        var result = protoFunc.apply(this, arguments);
+        if (this.length === 0) {
+          delete this[0];
+        }
+        return result;
+      };
+
+      lodash.prototype[methodName] = function() {
+        var args = arguments;
+        if (retUnwrapped && !this.__chain__) {
+          return func.apply(this.value(), args);
+        }
+        return this[chainName](function(value) {
+          return func.apply(value, args);
+        });
+      };
+    });
+
+    // Map minified function names to their real names.
+    baseForOwn(LazyWrapper.prototype, function(func, methodName) {
+      var lodashFunc = lodash[methodName];
+      if (lodashFunc) {
+        var key = (lodashFunc.name + ''),
+            names = realNames[key] || (realNames[key] = []);
+
+        names.push({ 'name': methodName, 'func': lodashFunc });
+      }
+    });
+
+    realNames[createHybridWrapper(undefined, BIND_KEY_FLAG).name] = [{ 'name': 'wrapper', 'func': undefined }];
+
+    // Add functions to the lazy wrapper.
+    LazyWrapper.prototype.clone = lazyClone;
+    LazyWrapper.prototype.reverse = lazyReverse;
+    LazyWrapper.prototype.value = lazyValue;
+
+    // Add chaining functions to the `lodash` wrapper.
+    lodash.prototype.chain = wrapperChain;
+    lodash.prototype.commit = wrapperCommit;
+    lodash.prototype.concat = wrapperConcat;
+    lodash.prototype.plant = wrapperPlant;
+    lodash.prototype.reverse = wrapperReverse;
+    lodash.prototype.toString = wrapperToString;
+    lodash.prototype.run = lodash.prototype.toJSON = lodash.prototype.valueOf = lodash.prototype.value = wrapperValue;
+
+    // Add function aliases to the `lodash` wrapper.
+    lodash.prototype.collect = lodash.prototype.map;
+    lodash.prototype.head = lodash.prototype.first;
+    lodash.prototype.select = lodash.prototype.filter;
+    lodash.prototype.tail = lodash.prototype.rest;
+
+    return lodash;
+  }
+
+  /*--------------------------------------------------------------------------*/
+
+  // Export lodash.
+  var _ = runInContext();
+
+  // Some AMD build optimizers like r.js check for condition patterns like the following:
+  if (typeof define == 'function' && typeof define.amd == 'object' && define.amd) {
+    // Expose lodash to the global object when an AMD loader is present to avoid
+    // errors in cases where lodash is loaded by a script tag and not intended
+    // as an AMD module. See http://requirejs.org/docs/errors.html#mismatch for
+    // more details.
+    root._ = _;
+
+    // Define as an anonymous module so, through path mapping, it can be
+    // referenced as the "underscore" module.
+    define(function() {
+      return _;
+    });
+  }
+  // Check for `exports` after `define` in case a build optimizer adds an `exports` object.
+  else if (freeExports && freeModule) {
+    // Export for Node.js or RingoJS.
+    if (moduleExports) {
+      (freeModule.exports = _)._ = _;
+    }
+    // Export for Rhino with CommonJS support.
+    else {
+      freeExports._ = _;
+    }
+  }
+  else {
+    // Export for a browser or Rhino.
+    root._ = _;
+  }
+}.call(this));
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/moment.js b/ee/bulk-operations-dashboard/assets/dependencies/moment.js
new file mode 100644
index 000000000000..9428c66bb9fa
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/moment.js
@@ -0,0 +1,4535 @@
+//! moment.js
+//! version : 2.20.1
+//! authors : Tim Wood, Iskren Chernev, Moment.js contributors
+//! license : MIT
+//! momentjs.com
+
+;(function (global, factory) {
+    typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
+    typeof define === 'function' && define.amd ? define(factory) :
+    global.moment = factory()
+}(this, (function () { 'use strict';
+
+var hookCallback;
+
+function hooks () {
+    return hookCallback.apply(null, arguments);
+}
+
+// This is done to register the method called with moment()
+// without creating circular dependencies.
+function setHookCallback (callback) {
+    hookCallback = callback;
+}
+
+function isArray(input) {
+    return input instanceof Array || Object.prototype.toString.call(input) === '[object Array]';
+}
+
+function isObject(input) {
+    // IE8 will treat undefined and null as object if it wasn't for
+    // input != null
+    return input != null && Object.prototype.toString.call(input) === '[object Object]';
+}
+
+function isObjectEmpty(obj) {
+    if (Object.getOwnPropertyNames) {
+        return (Object.getOwnPropertyNames(obj).length === 0);
+    } else {
+        var k;
+        for (k in obj) {
+            if (obj.hasOwnProperty(k)) {
+                return false;
+            }
+        }
+        return true;
+    }
+}
+
+function isUndefined(input) {
+    return input === void 0;
+}
+
+function isNumber(input) {
+    return typeof input === 'number' || Object.prototype.toString.call(input) === '[object Number]';
+}
+
+function isDate(input) {
+    return input instanceof Date || Object.prototype.toString.call(input) === '[object Date]';
+}
+
+function map(arr, fn) {
+    var res = [], i;
+    for (i = 0; i < arr.length; ++i) {
+        res.push(fn(arr[i], i));
+    }
+    return res;
+}
+
+function hasOwnProp(a, b) {
+    return Object.prototype.hasOwnProperty.call(a, b);
+}
+
+function extend(a, b) {
+    for (var i in b) {
+        if (hasOwnProp(b, i)) {
+            a[i] = b[i];
+        }
+    }
+
+    if (hasOwnProp(b, 'toString')) {
+        a.toString = b.toString;
+    }
+
+    if (hasOwnProp(b, 'valueOf')) {
+        a.valueOf = b.valueOf;
+    }
+
+    return a;
+}
+
+function createUTC (input, format, locale, strict) {
+    return createLocalOrUTC(input, format, locale, strict, true).utc();
+}
+
+function defaultParsingFlags() {
+    // We need to deep clone this object.
+    return {
+        empty           : false,
+        unusedTokens    : [],
+        unusedInput     : [],
+        overflow        : -2,
+        charsLeftOver   : 0,
+        nullInput       : false,
+        invalidMonth    : null,
+        invalidFormat   : false,
+        userInvalidated : false,
+        iso             : false,
+        parsedDateParts : [],
+        meridiem        : null,
+        rfc2822         : false,
+        weekdayMismatch : false
+    };
+}
+
+function getParsingFlags(m) {
+    if (m._pf == null) {
+        m._pf = defaultParsingFlags();
+    }
+    return m._pf;
+}
+
+var some;
+if (Array.prototype.some) {
+    some = Array.prototype.some;
+} else {
+    some = function (fun) {
+        var t = Object(this);
+        var len = t.length >>> 0;
+
+        for (var i = 0; i < len; i++) {
+            if (i in t && fun.call(this, t[i], i, t)) {
+                return true;
+            }
+        }
+
+        return false;
+    };
+}
+
+function isValid(m) {
+    if (m._isValid == null) {
+        var flags = getParsingFlags(m);
+        var parsedParts = some.call(flags.parsedDateParts, function (i) {
+            return i != null;
+        });
+        var isNowValid = !isNaN(m._d.getTime()) &&
+            flags.overflow < 0 &&
+            !flags.empty &&
+            !flags.invalidMonth &&
+            !flags.invalidWeekday &&
+            !flags.weekdayMismatch &&
+            !flags.nullInput &&
+            !flags.invalidFormat &&
+            !flags.userInvalidated &&
+            (!flags.meridiem || (flags.meridiem && parsedParts));
+
+        if (m._strict) {
+            isNowValid = isNowValid &&
+                flags.charsLeftOver === 0 &&
+                flags.unusedTokens.length === 0 &&
+                flags.bigHour === undefined;
+        }
+
+        if (Object.isFrozen == null || !Object.isFrozen(m)) {
+            m._isValid = isNowValid;
+        }
+        else {
+            return isNowValid;
+        }
+    }
+    return m._isValid;
+}
+
+function createInvalid (flags) {
+    var m = createUTC(NaN);
+    if (flags != null) {
+        extend(getParsingFlags(m), flags);
+    }
+    else {
+        getParsingFlags(m).userInvalidated = true;
+    }
+
+    return m;
+}
+
+// Plugins that add properties should also add the key here (null value),
+// so we can properly clone ourselves.
+var momentProperties = hooks.momentProperties = [];
+
+function copyConfig(to, from) {
+    var i, prop, val;
+
+    if (!isUndefined(from._isAMomentObject)) {
+        to._isAMomentObject = from._isAMomentObject;
+    }
+    if (!isUndefined(from._i)) {
+        to._i = from._i;
+    }
+    if (!isUndefined(from._f)) {
+        to._f = from._f;
+    }
+    if (!isUndefined(from._l)) {
+        to._l = from._l;
+    }
+    if (!isUndefined(from._strict)) {
+        to._strict = from._strict;
+    }
+    if (!isUndefined(from._tzm)) {
+        to._tzm = from._tzm;
+    }
+    if (!isUndefined(from._isUTC)) {
+        to._isUTC = from._isUTC;
+    }
+    if (!isUndefined(from._offset)) {
+        to._offset = from._offset;
+    }
+    if (!isUndefined(from._pf)) {
+        to._pf = getParsingFlags(from);
+    }
+    if (!isUndefined(from._locale)) {
+        to._locale = from._locale;
+    }
+
+    if (momentProperties.length > 0) {
+        for (i = 0; i < momentProperties.length; i++) {
+            prop = momentProperties[i];
+            val = from[prop];
+            if (!isUndefined(val)) {
+                to[prop] = val;
+            }
+        }
+    }
+
+    return to;
+}
+
+var updateInProgress = false;
+
+// Moment prototype object
+function Moment(config) {
+    copyConfig(this, config);
+    this._d = new Date(config._d != null ? config._d.getTime() : NaN);
+    if (!this.isValid()) {
+        this._d = new Date(NaN);
+    }
+    // Prevent infinite loop in case updateOffset creates new moment
+    // objects.
+    if (updateInProgress === false) {
+        updateInProgress = true;
+        hooks.updateOffset(this);
+        updateInProgress = false;
+    }
+}
+
+function isMoment (obj) {
+    return obj instanceof Moment || (obj != null && obj._isAMomentObject != null);
+}
+
+function absFloor (number) {
+    if (number < 0) {
+        // -0 -> 0
+        return Math.ceil(number) || 0;
+    } else {
+        return Math.floor(number);
+    }
+}
+
+function toInt(argumentForCoercion) {
+    var coercedNumber = +argumentForCoercion,
+        value = 0;
+
+    if (coercedNumber !== 0 && isFinite(coercedNumber)) {
+        value = absFloor(coercedNumber);
+    }
+
+    return value;
+}
+
+// compare two arrays, return the number of differences
+function compareArrays(array1, array2, dontConvert) {
+    var len = Math.min(array1.length, array2.length),
+        lengthDiff = Math.abs(array1.length - array2.length),
+        diffs = 0,
+        i;
+    for (i = 0; i < len; i++) {
+        if ((dontConvert && array1[i] !== array2[i]) ||
+            (!dontConvert && toInt(array1[i]) !== toInt(array2[i]))) {
+            diffs++;
+        }
+    }
+    return diffs + lengthDiff;
+}
+
+function warn(msg) {
+    if (hooks.suppressDeprecationWarnings === false &&
+            (typeof console !==  'undefined') && console.warn) {
+        console.warn('Deprecation warning: ' + msg);
+    }
+}
+
+function deprecate(msg, fn) {
+    var firstTime = true;
+
+    return extend(function () {
+        if (hooks.deprecationHandler != null) {
+            hooks.deprecationHandler(null, msg);
+        }
+        if (firstTime) {
+            var args = [];
+            var arg;
+            for (var i = 0; i < arguments.length; i++) {
+                arg = '';
+                if (typeof arguments[i] === 'object') {
+                    arg += '\n[' + i + '] ';
+                    for (var key in arguments[0]) {
+                        arg += key + ': ' + arguments[0][key] + ', ';
+                    }
+                    arg = arg.slice(0, -2); // Remove trailing comma and space
+                } else {
+                    arg = arguments[i];
+                }
+                args.push(arg);
+            }
+            warn(msg + '\nArguments: ' + Array.prototype.slice.call(args).join('') + '\n' + (new Error()).stack);
+            firstTime = false;
+        }
+        return fn.apply(this, arguments);
+    }, fn);
+}
+
+var deprecations = {};
+
+function deprecateSimple(name, msg) {
+    if (hooks.deprecationHandler != null) {
+        hooks.deprecationHandler(name, msg);
+    }
+    if (!deprecations[name]) {
+        warn(msg);
+        deprecations[name] = true;
+    }
+}
+
+hooks.suppressDeprecationWarnings = false;
+hooks.deprecationHandler = null;
+
+function isFunction(input) {
+    return input instanceof Function || Object.prototype.toString.call(input) === '[object Function]';
+}
+
+function set (config) {
+    var prop, i;
+    for (i in config) {
+        prop = config[i];
+        if (isFunction(prop)) {
+            this[i] = prop;
+        } else {
+            this['_' + i] = prop;
+        }
+    }
+    this._config = config;
+    // Lenient ordinal parsing accepts just a number in addition to
+    // number + (possibly) stuff coming from _dayOfMonthOrdinalParse.
+    // TODO: Remove "ordinalParse" fallback in next major release.
+    this._dayOfMonthOrdinalParseLenient = new RegExp(
+        (this._dayOfMonthOrdinalParse.source || this._ordinalParse.source) +
+            '|' + (/\d{1,2}/).source);
+}
+
+function mergeConfigs(parentConfig, childConfig) {
+    var res = extend({}, parentConfig), prop;
+    for (prop in childConfig) {
+        if (hasOwnProp(childConfig, prop)) {
+            if (isObject(parentConfig[prop]) && isObject(childConfig[prop])) {
+                res[prop] = {};
+                extend(res[prop], parentConfig[prop]);
+                extend(res[prop], childConfig[prop]);
+            } else if (childConfig[prop] != null) {
+                res[prop] = childConfig[prop];
+            } else {
+                delete res[prop];
+            }
+        }
+    }
+    for (prop in parentConfig) {
+        if (hasOwnProp(parentConfig, prop) &&
+                !hasOwnProp(childConfig, prop) &&
+                isObject(parentConfig[prop])) {
+            // make sure changes to properties don't modify parent config
+            res[prop] = extend({}, res[prop]);
+        }
+    }
+    return res;
+}
+
+function Locale(config) {
+    if (config != null) {
+        this.set(config);
+    }
+}
+
+var keys;
+
+if (Object.keys) {
+    keys = Object.keys;
+} else {
+    keys = function (obj) {
+        var i, res = [];
+        for (i in obj) {
+            if (hasOwnProp(obj, i)) {
+                res.push(i);
+            }
+        }
+        return res;
+    };
+}
+
+var defaultCalendar = {
+    sameDay : '[Today at] LT',
+    nextDay : '[Tomorrow at] LT',
+    nextWeek : 'dddd [at] LT',
+    lastDay : '[Yesterday at] LT',
+    lastWeek : '[Last] dddd [at] LT',
+    sameElse : 'L'
+};
+
+function calendar (key, mom, now) {
+    var output = this._calendar[key] || this._calendar['sameElse'];
+    return isFunction(output) ? output.call(mom, now) : output;
+}
+
+var defaultLongDateFormat = {
+    LTS  : 'h:mm:ss A',
+    LT   : 'h:mm A',
+    L    : 'MM/DD/YYYY',
+    LL   : 'MMMM D, YYYY',
+    LLL  : 'MMMM D, YYYY h:mm A',
+    LLLL : 'dddd, MMMM D, YYYY h:mm A'
+};
+
+function longDateFormat (key) {
+    var format = this._longDateFormat[key],
+        formatUpper = this._longDateFormat[key.toUpperCase()];
+
+    if (format || !formatUpper) {
+        return format;
+    }
+
+    this._longDateFormat[key] = formatUpper.replace(/MMMM|MM|DD|dddd/g, function (val) {
+        return val.slice(1);
+    });
+
+    return this._longDateFormat[key];
+}
+
+var defaultInvalidDate = 'Invalid date';
+
+function invalidDate () {
+    return this._invalidDate;
+}
+
+var defaultOrdinal = '%d';
+var defaultDayOfMonthOrdinalParse = /\d{1,2}/;
+
+function ordinal (number) {
+    return this._ordinal.replace('%d', number);
+}
+
+var defaultRelativeTime = {
+    future : 'in %s',
+    past   : '%s ago',
+    s  : 'a few seconds',
+    ss : '%d seconds',
+    m  : 'a minute',
+    mm : '%d minutes',
+    h  : 'an hour',
+    hh : '%d hours',
+    d  : 'a day',
+    dd : '%d days',
+    M  : 'a month',
+    MM : '%d months',
+    y  : 'a year',
+    yy : '%d years'
+};
+
+function relativeTime (number, withoutSuffix, string, isFuture) {
+    var output = this._relativeTime[string];
+    return (isFunction(output)) ?
+        output(number, withoutSuffix, string, isFuture) :
+        output.replace(/%d/i, number);
+}
+
+function pastFuture (diff, output) {
+    var format = this._relativeTime[diff > 0 ? 'future' : 'past'];
+    return isFunction(format) ? format(output) : format.replace(/%s/i, output);
+}
+
+var aliases = {};
+
+function addUnitAlias (unit, shorthand) {
+    var lowerCase = unit.toLowerCase();
+    aliases[lowerCase] = aliases[lowerCase + 's'] = aliases[shorthand] = unit;
+}
+
+function normalizeUnits(units) {
+    return typeof units === 'string' ? aliases[units] || aliases[units.toLowerCase()] : undefined;
+}
+
+function normalizeObjectUnits(inputObject) {
+    var normalizedInput = {},
+        normalizedProp,
+        prop;
+
+    for (prop in inputObject) {
+        if (hasOwnProp(inputObject, prop)) {
+            normalizedProp = normalizeUnits(prop);
+            if (normalizedProp) {
+                normalizedInput[normalizedProp] = inputObject[prop];
+            }
+        }
+    }
+
+    return normalizedInput;
+}
+
+var priorities = {};
+
+function addUnitPriority(unit, priority) {
+    priorities[unit] = priority;
+}
+
+function getPrioritizedUnits(unitsObj) {
+    var units = [];
+    for (var u in unitsObj) {
+        units.push({unit: u, priority: priorities[u]});
+    }
+    units.sort(function (a, b) {
+        return a.priority - b.priority;
+    });
+    return units;
+}
+
+function zeroFill(number, targetLength, forceSign) {
+    var absNumber = '' + Math.abs(number),
+        zerosToFill = targetLength - absNumber.length,
+        sign = number >= 0;
+    return (sign ? (forceSign ? '+' : '') : '-') +
+        Math.pow(10, Math.max(0, zerosToFill)).toString().substr(1) + absNumber;
+}
+
+var formattingTokens = /(\[[^\[]*\])|(\\)?([Hh]mm(ss)?|Mo|MM?M?M?|Do|DDDo|DD?D?D?|ddd?d?|do?|w[o|w]?|W[o|W]?|Qo?|YYYYYY|YYYYY|YYYY|YY|gg(ggg?)?|GG(GGG?)?|e|E|a|A|hh?|HH?|kk?|mm?|ss?|S{1,9}|x|X|zz?|ZZ?|.)/g;
+
+var localFormattingTokens = /(\[[^\[]*\])|(\\)?(LTS|LT|LL?L?L?|l{1,4})/g;
+
+var formatFunctions = {};
+
+var formatTokenFunctions = {};
+
+// token:    'M'
+// padded:   ['MM', 2]
+// ordinal:  'Mo'
+// callback: function () { this.month() + 1 }
+function addFormatToken (token, padded, ordinal, callback) {
+    var func = callback;
+    if (typeof callback === 'string') {
+        func = function () {
+            return this[callback]();
+        };
+    }
+    if (token) {
+        formatTokenFunctions[token] = func;
+    }
+    if (padded) {
+        formatTokenFunctions[padded[0]] = function () {
+            return zeroFill(func.apply(this, arguments), padded[1], padded[2]);
+        };
+    }
+    if (ordinal) {
+        formatTokenFunctions[ordinal] = function () {
+            return this.localeData().ordinal(func.apply(this, arguments), token);
+        };
+    }
+}
+
+function removeFormattingTokens(input) {
+    if (input.match(/\[[\s\S]/)) {
+        return input.replace(/^\[|\]$/g, '');
+    }
+    return input.replace(/\\/g, '');
+}
+
+function makeFormatFunction(format) {
+    var array = format.match(formattingTokens), i, length;
+
+    for (i = 0, length = array.length; i < length; i++) {
+        if (formatTokenFunctions[array[i]]) {
+            array[i] = formatTokenFunctions[array[i]];
+        } else {
+            array[i] = removeFormattingTokens(array[i]);
+        }
+    }
+
+    return function (mom) {
+        var output = '', i;
+        for (i = 0; i < length; i++) {
+            output += isFunction(array[i]) ? array[i].call(mom, format) : array[i];
+        }
+        return output;
+    };
+}
+
+// format date using native date object
+function formatMoment(m, format) {
+    if (!m.isValid()) {
+        return m.localeData().invalidDate();
+    }
+
+    format = expandFormat(format, m.localeData());
+    formatFunctions[format] = formatFunctions[format] || makeFormatFunction(format);
+
+    return formatFunctions[format](m);
+}
+
+function expandFormat(format, locale) {
+    var i = 5;
+
+    function replaceLongDateFormatTokens(input) {
+        return locale.longDateFormat(input) || input;
+    }
+
+    localFormattingTokens.lastIndex = 0;
+    while (i >= 0 && localFormattingTokens.test(format)) {
+        format = format.replace(localFormattingTokens, replaceLongDateFormatTokens);
+        localFormattingTokens.lastIndex = 0;
+        i -= 1;
+    }
+
+    return format;
+}
+
+var match1         = /\d/;            //       0 - 9
+var match2         = /\d\d/;          //      00 - 99
+var match3         = /\d{3}/;         //     000 - 999
+var match4         = /\d{4}/;         //    0000 - 9999
+var match6         = /[+-]?\d{6}/;    // -999999 - 999999
+var match1to2      = /\d\d?/;         //       0 - 99
+var match3to4      = /\d\d\d\d?/;     //     999 - 9999
+var match5to6      = /\d\d\d\d\d\d?/; //   99999 - 999999
+var match1to3      = /\d{1,3}/;       //       0 - 999
+var match1to4      = /\d{1,4}/;       //       0 - 9999
+var match1to6      = /[+-]?\d{1,6}/;  // -999999 - 999999
+
+var matchUnsigned  = /\d+/;           //       0 - inf
+var matchSigned    = /[+-]?\d+/;      //    -inf - inf
+
+var matchOffset    = /Z|[+-]\d\d:?\d\d/gi; // +00:00 -00:00 +0000 -0000 or Z
+var matchShortOffset = /Z|[+-]\d\d(?::?\d\d)?/gi; // +00 -00 +00:00 -00:00 +0000 -0000 or Z
+
+var matchTimestamp = /[+-]?\d+(\.\d{1,3})?/; // 123456789 123456789.123
+
+// any word (or two) characters or numbers including two/three word month in arabic.
+// includes scottish gaelic two word and hyphenated months
+var matchWord = /[0-9]{0,256}['a-z\u00A0-\u05FF\u0700-\uD7FF\uF900-\uFDCF\uFDF0-\uFF07\uFF10-\uFFEF]{1,256}|[\u0600-\u06FF\/]{1,256}(\s*?[\u0600-\u06FF]{1,256}){1,2}/i;
+
+
+var regexes = {};
+
+function addRegexToken (token, regex, strictRegex) {
+    regexes[token] = isFunction(regex) ? regex : function (isStrict, localeData) {
+        return (isStrict && strictRegex) ? strictRegex : regex;
+    };
+}
+
+function getParseRegexForToken (token, config) {
+    if (!hasOwnProp(regexes, token)) {
+        return new RegExp(unescapeFormat(token));
+    }
+
+    return regexes[token](config._strict, config._locale);
+}
+
+// Code from http://stackoverflow.com/questions/3561493/is-there-a-regexp-escape-function-in-javascript
+function unescapeFormat(s) {
+    return regexEscape(s.replace('\\', '').replace(/\\(\[)|\\(\])|\[([^\]\[]*)\]|\\(.)/g, function (matched, p1, p2, p3, p4) {
+        return p1 || p2 || p3 || p4;
+    }));
+}
+
+function regexEscape(s) {
+    return s.replace(/[-\/\\^$*+?.()|[\]{}]/g, '\\$&');
+}
+
+var tokens = {};
+
+function addParseToken (token, callback) {
+    var i, func = callback;
+    if (typeof token === 'string') {
+        token = [token];
+    }
+    if (isNumber(callback)) {
+        func = function (input, array) {
+            array[callback] = toInt(input);
+        };
+    }
+    for (i = 0; i < token.length; i++) {
+        tokens[token[i]] = func;
+    }
+}
+
+function addWeekParseToken (token, callback) {
+    addParseToken(token, function (input, array, config, token) {
+        config._w = config._w || {};
+        callback(input, config._w, config, token);
+    });
+}
+
+function addTimeToArrayFromToken(token, input, config) {
+    if (input != null && hasOwnProp(tokens, token)) {
+        tokens[token](input, config._a, config, token);
+    }
+}
+
+var YEAR = 0;
+var MONTH = 1;
+var DATE = 2;
+var HOUR = 3;
+var MINUTE = 4;
+var SECOND = 5;
+var MILLISECOND = 6;
+var WEEK = 7;
+var WEEKDAY = 8;
+
+// FORMATTING
+
+addFormatToken('Y', 0, 0, function () {
+    var y = this.year();
+    return y <= 9999 ? '' + y : '+' + y;
+});
+
+addFormatToken(0, ['YY', 2], 0, function () {
+    return this.year() % 100;
+});
+
+addFormatToken(0, ['YYYY',   4],       0, 'year');
+addFormatToken(0, ['YYYYY',  5],       0, 'year');
+addFormatToken(0, ['YYYYYY', 6, true], 0, 'year');
+
+// ALIASES
+
+addUnitAlias('year', 'y');
+
+// PRIORITIES
+
+addUnitPriority('year', 1);
+
+// PARSING
+
+addRegexToken('Y',      matchSigned);
+addRegexToken('YY',     match1to2, match2);
+addRegexToken('YYYY',   match1to4, match4);
+addRegexToken('YYYYY',  match1to6, match6);
+addRegexToken('YYYYYY', match1to6, match6);
+
+addParseToken(['YYYYY', 'YYYYYY'], YEAR);
+addParseToken('YYYY', function (input, array) {
+    array[YEAR] = input.length === 2 ? hooks.parseTwoDigitYear(input) : toInt(input);
+});
+addParseToken('YY', function (input, array) {
+    array[YEAR] = hooks.parseTwoDigitYear(input);
+});
+addParseToken('Y', function (input, array) {
+    array[YEAR] = parseInt(input, 10);
+});
+
+// HELPERS
+
+function daysInYear(year) {
+    return isLeapYear(year) ? 366 : 365;
+}
+
+function isLeapYear(year) {
+    return (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0;
+}
+
+// HOOKS
+
+hooks.parseTwoDigitYear = function (input) {
+    return toInt(input) + (toInt(input) > 68 ? 1900 : 2000);
+};
+
+// MOMENTS
+
+var getSetYear = makeGetSet('FullYear', true);
+
+function getIsLeapYear () {
+    return isLeapYear(this.year());
+}
+
+function makeGetSet (unit, keepTime) {
+    return function (value) {
+        if (value != null) {
+            set$1(this, unit, value);
+            hooks.updateOffset(this, keepTime);
+            return this;
+        } else {
+            return get(this, unit);
+        }
+    };
+}
+
+function get (mom, unit) {
+    return mom.isValid() ?
+        mom._d['get' + (mom._isUTC ? 'UTC' : '') + unit]() : NaN;
+}
+
+function set$1 (mom, unit, value) {
+    if (mom.isValid() && !isNaN(value)) {
+        if (unit === 'FullYear' && isLeapYear(mom.year()) && mom.month() === 1 && mom.date() === 29) {
+            mom._d['set' + (mom._isUTC ? 'UTC' : '') + unit](value, mom.month(), daysInMonth(value, mom.month()));
+        }
+        else {
+            mom._d['set' + (mom._isUTC ? 'UTC' : '') + unit](value);
+        }
+    }
+}
+
+// MOMENTS
+
+function stringGet (units) {
+    units = normalizeUnits(units);
+    if (isFunction(this[units])) {
+        return this[units]();
+    }
+    return this;
+}
+
+
+function stringSet (units, value) {
+    if (typeof units === 'object') {
+        units = normalizeObjectUnits(units);
+        var prioritized = getPrioritizedUnits(units);
+        for (var i = 0; i < prioritized.length; i++) {
+            this[prioritized[i].unit](units[prioritized[i].unit]);
+        }
+    } else {
+        units = normalizeUnits(units);
+        if (isFunction(this[units])) {
+            return this[units](value);
+        }
+    }
+    return this;
+}
+
+function mod(n, x) {
+    return ((n % x) + x) % x;
+}
+
+var indexOf;
+
+if (Array.prototype.indexOf) {
+    indexOf = Array.prototype.indexOf;
+} else {
+    indexOf = function (o) {
+        // I know
+        var i;
+        for (i = 0; i < this.length; ++i) {
+            if (this[i] === o) {
+                return i;
+            }
+        }
+        return -1;
+    };
+}
+
+function daysInMonth(year, month) {
+    if (isNaN(year) || isNaN(month)) {
+        return NaN;
+    }
+    var modMonth = mod(month, 12);
+    year += (month - modMonth) / 12;
+    return modMonth === 1 ? (isLeapYear(year) ? 29 : 28) : (31 - modMonth % 7 % 2);
+}
+
+// FORMATTING
+
+addFormatToken('M', ['MM', 2], 'Mo', function () {
+    return this.month() + 1;
+});
+
+addFormatToken('MMM', 0, 0, function (format) {
+    return this.localeData().monthsShort(this, format);
+});
+
+addFormatToken('MMMM', 0, 0, function (format) {
+    return this.localeData().months(this, format);
+});
+
+// ALIASES
+
+addUnitAlias('month', 'M');
+
+// PRIORITY
+
+addUnitPriority('month', 8);
+
+// PARSING
+
+addRegexToken('M',    match1to2);
+addRegexToken('MM',   match1to2, match2);
+addRegexToken('MMM',  function (isStrict, locale) {
+    return locale.monthsShortRegex(isStrict);
+});
+addRegexToken('MMMM', function (isStrict, locale) {
+    return locale.monthsRegex(isStrict);
+});
+
+addParseToken(['M', 'MM'], function (input, array) {
+    array[MONTH] = toInt(input) - 1;
+});
+
+addParseToken(['MMM', 'MMMM'], function (input, array, config, token) {
+    var month = config._locale.monthsParse(input, token, config._strict);
+    // if we didn't find a month name, mark the date as invalid.
+    if (month != null) {
+        array[MONTH] = month;
+    } else {
+        getParsingFlags(config).invalidMonth = input;
+    }
+});
+
+// LOCALES
+
+var MONTHS_IN_FORMAT = /D[oD]?(\[[^\[\]]*\]|\s)+MMMM?/;
+var defaultLocaleMonths = 'January_February_March_April_May_June_July_August_September_October_November_December'.split('_');
+function localeMonths (m, format) {
+    if (!m) {
+        return isArray(this._months) ? this._months :
+            this._months['standalone'];
+    }
+    return isArray(this._months) ? this._months[m.month()] :
+        this._months[(this._months.isFormat || MONTHS_IN_FORMAT).test(format) ? 'format' : 'standalone'][m.month()];
+}
+
+var defaultLocaleMonthsShort = 'Jan_Feb_Mar_Apr_May_Jun_Jul_Aug_Sep_Oct_Nov_Dec'.split('_');
+function localeMonthsShort (m, format) {
+    if (!m) {
+        return isArray(this._monthsShort) ? this._monthsShort :
+            this._monthsShort['standalone'];
+    }
+    return isArray(this._monthsShort) ? this._monthsShort[m.month()] :
+        this._monthsShort[MONTHS_IN_FORMAT.test(format) ? 'format' : 'standalone'][m.month()];
+}
+
+function handleStrictParse(monthName, format, strict) {
+    var i, ii, mom, llc = monthName.toLocaleLowerCase();
+    if (!this._monthsParse) {
+        // this is not used
+        this._monthsParse = [];
+        this._longMonthsParse = [];
+        this._shortMonthsParse = [];
+        for (i = 0; i < 12; ++i) {
+            mom = createUTC([2000, i]);
+            this._shortMonthsParse[i] = this.monthsShort(mom, '').toLocaleLowerCase();
+            this._longMonthsParse[i] = this.months(mom, '').toLocaleLowerCase();
+        }
+    }
+
+    if (strict) {
+        if (format === 'MMM') {
+            ii = indexOf.call(this._shortMonthsParse, llc);
+            return ii !== -1 ? ii : null;
+        } else {
+            ii = indexOf.call(this._longMonthsParse, llc);
+            return ii !== -1 ? ii : null;
+        }
+    } else {
+        if (format === 'MMM') {
+            ii = indexOf.call(this._shortMonthsParse, llc);
+            if (ii !== -1) {
+                return ii;
+            }
+            ii = indexOf.call(this._longMonthsParse, llc);
+            return ii !== -1 ? ii : null;
+        } else {
+            ii = indexOf.call(this._longMonthsParse, llc);
+            if (ii !== -1) {
+                return ii;
+            }
+            ii = indexOf.call(this._shortMonthsParse, llc);
+            return ii !== -1 ? ii : null;
+        }
+    }
+}
+
+function localeMonthsParse (monthName, format, strict) {
+    var i, mom, regex;
+
+    if (this._monthsParseExact) {
+        return handleStrictParse.call(this, monthName, format, strict);
+    }
+
+    if (!this._monthsParse) {
+        this._monthsParse = [];
+        this._longMonthsParse = [];
+        this._shortMonthsParse = [];
+    }
+
+    // TODO: add sorting
+    // Sorting makes sure if one month (or abbr) is a prefix of another
+    // see sorting in computeMonthsParse
+    for (i = 0; i < 12; i++) {
+        // make the regex if we don't have it already
+        mom = createUTC([2000, i]);
+        if (strict && !this._longMonthsParse[i]) {
+            this._longMonthsParse[i] = new RegExp('^' + this.months(mom, '').replace('.', '') + '$', 'i');
+            this._shortMonthsParse[i] = new RegExp('^' + this.monthsShort(mom, '').replace('.', '') + '$', 'i');
+        }
+        if (!strict && !this._monthsParse[i]) {
+            regex = '^' + this.months(mom, '') + '|^' + this.monthsShort(mom, '');
+            this._monthsParse[i] = new RegExp(regex.replace('.', ''), 'i');
+        }
+        // test the regex
+        if (strict && format === 'MMMM' && this._longMonthsParse[i].test(monthName)) {
+            return i;
+        } else if (strict && format === 'MMM' && this._shortMonthsParse[i].test(monthName)) {
+            return i;
+        } else if (!strict && this._monthsParse[i].test(monthName)) {
+            return i;
+        }
+    }
+}
+
+// MOMENTS
+
+function setMonth (mom, value) {
+    var dayOfMonth;
+
+    if (!mom.isValid()) {
+        // No op
+        return mom;
+    }
+
+    if (typeof value === 'string') {
+        if (/^\d+$/.test(value)) {
+            value = toInt(value);
+        } else {
+            value = mom.localeData().monthsParse(value);
+            // TODO: Another silent failure?
+            if (!isNumber(value)) {
+                return mom;
+            }
+        }
+    }
+
+    dayOfMonth = Math.min(mom.date(), daysInMonth(mom.year(), value));
+    mom._d['set' + (mom._isUTC ? 'UTC' : '') + 'Month'](value, dayOfMonth);
+    return mom;
+}
+
+function getSetMonth (value) {
+    if (value != null) {
+        setMonth(this, value);
+        hooks.updateOffset(this, true);
+        return this;
+    } else {
+        return get(this, 'Month');
+    }
+}
+
+function getDaysInMonth () {
+    return daysInMonth(this.year(), this.month());
+}
+
+var defaultMonthsShortRegex = matchWord;
+function monthsShortRegex (isStrict) {
+    if (this._monthsParseExact) {
+        if (!hasOwnProp(this, '_monthsRegex')) {
+            computeMonthsParse.call(this);
+        }
+        if (isStrict) {
+            return this._monthsShortStrictRegex;
+        } else {
+            return this._monthsShortRegex;
+        }
+    } else {
+        if (!hasOwnProp(this, '_monthsShortRegex')) {
+            this._monthsShortRegex = defaultMonthsShortRegex;
+        }
+        return this._monthsShortStrictRegex && isStrict ?
+            this._monthsShortStrictRegex : this._monthsShortRegex;
+    }
+}
+
+var defaultMonthsRegex = matchWord;
+function monthsRegex (isStrict) {
+    if (this._monthsParseExact) {
+        if (!hasOwnProp(this, '_monthsRegex')) {
+            computeMonthsParse.call(this);
+        }
+        if (isStrict) {
+            return this._monthsStrictRegex;
+        } else {
+            return this._monthsRegex;
+        }
+    } else {
+        if (!hasOwnProp(this, '_monthsRegex')) {
+            this._monthsRegex = defaultMonthsRegex;
+        }
+        return this._monthsStrictRegex && isStrict ?
+            this._monthsStrictRegex : this._monthsRegex;
+    }
+}
+
+function computeMonthsParse () {
+    function cmpLenRev(a, b) {
+        return b.length - a.length;
+    }
+
+    var shortPieces = [], longPieces = [], mixedPieces = [],
+        i, mom;
+    for (i = 0; i < 12; i++) {
+        // make the regex if we don't have it already
+        mom = createUTC([2000, i]);
+        shortPieces.push(this.monthsShort(mom, ''));
+        longPieces.push(this.months(mom, ''));
+        mixedPieces.push(this.months(mom, ''));
+        mixedPieces.push(this.monthsShort(mom, ''));
+    }
+    // Sorting makes sure if one month (or abbr) is a prefix of another it
+    // will match the longer piece.
+    shortPieces.sort(cmpLenRev);
+    longPieces.sort(cmpLenRev);
+    mixedPieces.sort(cmpLenRev);
+    for (i = 0; i < 12; i++) {
+        shortPieces[i] = regexEscape(shortPieces[i]);
+        longPieces[i] = regexEscape(longPieces[i]);
+    }
+    for (i = 0; i < 24; i++) {
+        mixedPieces[i] = regexEscape(mixedPieces[i]);
+    }
+
+    this._monthsRegex = new RegExp('^(' + mixedPieces.join('|') + ')', 'i');
+    this._monthsShortRegex = this._monthsRegex;
+    this._monthsStrictRegex = new RegExp('^(' + longPieces.join('|') + ')', 'i');
+    this._monthsShortStrictRegex = new RegExp('^(' + shortPieces.join('|') + ')', 'i');
+}
+
+function createDate (y, m, d, h, M, s, ms) {
+    // can't just apply() to create a date:
+    // https://stackoverflow.com/q/181348
+    var date = new Date(y, m, d, h, M, s, ms);
+
+    // the date constructor remaps years 0-99 to 1900-1999
+    if (y < 100 && y >= 0 && isFinite(date.getFullYear())) {
+        date.setFullYear(y);
+    }
+    return date;
+}
+
+function createUTCDate (y) {
+    var date = new Date(Date.UTC.apply(null, arguments));
+
+    // the Date.UTC function remaps years 0-99 to 1900-1999
+    if (y < 100 && y >= 0 && isFinite(date.getUTCFullYear())) {
+        date.setUTCFullYear(y);
+    }
+    return date;
+}
+
+// start-of-first-week - start-of-year
+function firstWeekOffset(year, dow, doy) {
+    var // first-week day -- which january is always in the first week (4 for iso, 1 for other)
+        fwd = 7 + dow - doy,
+        // first-week day local weekday -- which local weekday is fwd
+        fwdlw = (7 + createUTCDate(year, 0, fwd).getUTCDay() - dow) % 7;
+
+    return -fwdlw + fwd - 1;
+}
+
+// https://en.wikipedia.org/wiki/ISO_week_date#Calculating_a_date_given_the_year.2C_week_number_and_weekday
+function dayOfYearFromWeeks(year, week, weekday, dow, doy) {
+    var localWeekday = (7 + weekday - dow) % 7,
+        weekOffset = firstWeekOffset(year, dow, doy),
+        dayOfYear = 1 + 7 * (week - 1) + localWeekday + weekOffset,
+        resYear, resDayOfYear;
+
+    if (dayOfYear <= 0) {
+        resYear = year - 1;
+        resDayOfYear = daysInYear(resYear) + dayOfYear;
+    } else if (dayOfYear > daysInYear(year)) {
+        resYear = year + 1;
+        resDayOfYear = dayOfYear - daysInYear(year);
+    } else {
+        resYear = year;
+        resDayOfYear = dayOfYear;
+    }
+
+    return {
+        year: resYear,
+        dayOfYear: resDayOfYear
+    };
+}
+
+function weekOfYear(mom, dow, doy) {
+    var weekOffset = firstWeekOffset(mom.year(), dow, doy),
+        week = Math.floor((mom.dayOfYear() - weekOffset - 1) / 7) + 1,
+        resWeek, resYear;
+
+    if (week < 1) {
+        resYear = mom.year() - 1;
+        resWeek = week + weeksInYear(resYear, dow, doy);
+    } else if (week > weeksInYear(mom.year(), dow, doy)) {
+        resWeek = week - weeksInYear(mom.year(), dow, doy);
+        resYear = mom.year() + 1;
+    } else {
+        resYear = mom.year();
+        resWeek = week;
+    }
+
+    return {
+        week: resWeek,
+        year: resYear
+    };
+}
+
+function weeksInYear(year, dow, doy) {
+    var weekOffset = firstWeekOffset(year, dow, doy),
+        weekOffsetNext = firstWeekOffset(year + 1, dow, doy);
+    return (daysInYear(year) - weekOffset + weekOffsetNext) / 7;
+}
+
+// FORMATTING
+
+addFormatToken('w', ['ww', 2], 'wo', 'week');
+addFormatToken('W', ['WW', 2], 'Wo', 'isoWeek');
+
+// ALIASES
+
+addUnitAlias('week', 'w');
+addUnitAlias('isoWeek', 'W');
+
+// PRIORITIES
+
+addUnitPriority('week', 5);
+addUnitPriority('isoWeek', 5);
+
+// PARSING
+
+addRegexToken('w',  match1to2);
+addRegexToken('ww', match1to2, match2);
+addRegexToken('W',  match1to2);
+addRegexToken('WW', match1to2, match2);
+
+addWeekParseToken(['w', 'ww', 'W', 'WW'], function (input, week, config, token) {
+    week[token.substr(0, 1)] = toInt(input);
+});
+
+// HELPERS
+
+// LOCALES
+
+function localeWeek (mom) {
+    return weekOfYear(mom, this._week.dow, this._week.doy).week;
+}
+
+var defaultLocaleWeek = {
+    dow : 0, // Sunday is the first day of the week.
+    doy : 6  // The week that contains Jan 1st is the first week of the year.
+};
+
+function localeFirstDayOfWeek () {
+    return this._week.dow;
+}
+
+function localeFirstDayOfYear () {
+    return this._week.doy;
+}
+
+// MOMENTS
+
+function getSetWeek (input) {
+    var week = this.localeData().week(this);
+    return input == null ? week : this.add((input - week) * 7, 'd');
+}
+
+function getSetISOWeek (input) {
+    var week = weekOfYear(this, 1, 4).week;
+    return input == null ? week : this.add((input - week) * 7, 'd');
+}
+
+// FORMATTING
+
+addFormatToken('d', 0, 'do', 'day');
+
+addFormatToken('dd', 0, 0, function (format) {
+    return this.localeData().weekdaysMin(this, format);
+});
+
+addFormatToken('ddd', 0, 0, function (format) {
+    return this.localeData().weekdaysShort(this, format);
+});
+
+addFormatToken('dddd', 0, 0, function (format) {
+    return this.localeData().weekdays(this, format);
+});
+
+addFormatToken('e', 0, 0, 'weekday');
+addFormatToken('E', 0, 0, 'isoWeekday');
+
+// ALIASES
+
+addUnitAlias('day', 'd');
+addUnitAlias('weekday', 'e');
+addUnitAlias('isoWeekday', 'E');
+
+// PRIORITY
+addUnitPriority('day', 11);
+addUnitPriority('weekday', 11);
+addUnitPriority('isoWeekday', 11);
+
+// PARSING
+
+addRegexToken('d',    match1to2);
+addRegexToken('e',    match1to2);
+addRegexToken('E',    match1to2);
+addRegexToken('dd',   function (isStrict, locale) {
+    return locale.weekdaysMinRegex(isStrict);
+});
+addRegexToken('ddd',   function (isStrict, locale) {
+    return locale.weekdaysShortRegex(isStrict);
+});
+addRegexToken('dddd',   function (isStrict, locale) {
+    return locale.weekdaysRegex(isStrict);
+});
+
+addWeekParseToken(['dd', 'ddd', 'dddd'], function (input, week, config, token) {
+    var weekday = config._locale.weekdaysParse(input, token, config._strict);
+    // if we didn't get a weekday name, mark the date as invalid
+    if (weekday != null) {
+        week.d = weekday;
+    } else {
+        getParsingFlags(config).invalidWeekday = input;
+    }
+});
+
+addWeekParseToken(['d', 'e', 'E'], function (input, week, config, token) {
+    week[token] = toInt(input);
+});
+
+// HELPERS
+
+function parseWeekday(input, locale) {
+    if (typeof input !== 'string') {
+        return input;
+    }
+
+    if (!isNaN(input)) {
+        return parseInt(input, 10);
+    }
+
+    input = locale.weekdaysParse(input);
+    if (typeof input === 'number') {
+        return input;
+    }
+
+    return null;
+}
+
+function parseIsoWeekday(input, locale) {
+    if (typeof input === 'string') {
+        return locale.weekdaysParse(input) % 7 || 7;
+    }
+    return isNaN(input) ? null : input;
+}
+
+// LOCALES
+
+var defaultLocaleWeekdays = 'Sunday_Monday_Tuesday_Wednesday_Thursday_Friday_Saturday'.split('_');
+function localeWeekdays (m, format) {
+    if (!m) {
+        return isArray(this._weekdays) ? this._weekdays :
+            this._weekdays['standalone'];
+    }
+    return isArray(this._weekdays) ? this._weekdays[m.day()] :
+        this._weekdays[this._weekdays.isFormat.test(format) ? 'format' : 'standalone'][m.day()];
+}
+
+var defaultLocaleWeekdaysShort = 'Sun_Mon_Tue_Wed_Thu_Fri_Sat'.split('_');
+function localeWeekdaysShort (m) {
+    return (m) ? this._weekdaysShort[m.day()] : this._weekdaysShort;
+}
+
+var defaultLocaleWeekdaysMin = 'Su_Mo_Tu_We_Th_Fr_Sa'.split('_');
+function localeWeekdaysMin (m) {
+    return (m) ? this._weekdaysMin[m.day()] : this._weekdaysMin;
+}
+
+function handleStrictParse$1(weekdayName, format, strict) {
+    var i, ii, mom, llc = weekdayName.toLocaleLowerCase();
+    if (!this._weekdaysParse) {
+        this._weekdaysParse = [];
+        this._shortWeekdaysParse = [];
+        this._minWeekdaysParse = [];
+
+        for (i = 0; i < 7; ++i) {
+            mom = createUTC([2000, 1]).day(i);
+            this._minWeekdaysParse[i] = this.weekdaysMin(mom, '').toLocaleLowerCase();
+            this._shortWeekdaysParse[i] = this.weekdaysShort(mom, '').toLocaleLowerCase();
+            this._weekdaysParse[i] = this.weekdays(mom, '').toLocaleLowerCase();
+        }
+    }
+
+    if (strict) {
+        if (format === 'dddd') {
+            ii = indexOf.call(this._weekdaysParse, llc);
+            return ii !== -1 ? ii : null;
+        } else if (format === 'ddd') {
+            ii = indexOf.call(this._shortWeekdaysParse, llc);
+            return ii !== -1 ? ii : null;
+        } else {
+            ii = indexOf.call(this._minWeekdaysParse, llc);
+            return ii !== -1 ? ii : null;
+        }
+    } else {
+        if (format === 'dddd') {
+            ii = indexOf.call(this._weekdaysParse, llc);
+            if (ii !== -1) {
+                return ii;
+            }
+            ii = indexOf.call(this._shortWeekdaysParse, llc);
+            if (ii !== -1) {
+                return ii;
+            }
+            ii = indexOf.call(this._minWeekdaysParse, llc);
+            return ii !== -1 ? ii : null;
+        } else if (format === 'ddd') {
+            ii = indexOf.call(this._shortWeekdaysParse, llc);
+            if (ii !== -1) {
+                return ii;
+            }
+            ii = indexOf.call(this._weekdaysParse, llc);
+            if (ii !== -1) {
+                return ii;
+            }
+            ii = indexOf.call(this._minWeekdaysParse, llc);
+            return ii !== -1 ? ii : null;
+        } else {
+            ii = indexOf.call(this._minWeekdaysParse, llc);
+            if (ii !== -1) {
+                return ii;
+            }
+            ii = indexOf.call(this._weekdaysParse, llc);
+            if (ii !== -1) {
+                return ii;
+            }
+            ii = indexOf.call(this._shortWeekdaysParse, llc);
+            return ii !== -1 ? ii : null;
+        }
+    }
+}
+
+function localeWeekdaysParse (weekdayName, format, strict) {
+    var i, mom, regex;
+
+    if (this._weekdaysParseExact) {
+        return handleStrictParse$1.call(this, weekdayName, format, strict);
+    }
+
+    if (!this._weekdaysParse) {
+        this._weekdaysParse = [];
+        this._minWeekdaysParse = [];
+        this._shortWeekdaysParse = [];
+        this._fullWeekdaysParse = [];
+    }
+
+    for (i = 0; i < 7; i++) {
+        // make the regex if we don't have it already
+
+        mom = createUTC([2000, 1]).day(i);
+        if (strict && !this._fullWeekdaysParse[i]) {
+            this._fullWeekdaysParse[i] = new RegExp('^' + this.weekdays(mom, '').replace('.', '\.?') + '$', 'i');
+            this._shortWeekdaysParse[i] = new RegExp('^' + this.weekdaysShort(mom, '').replace('.', '\.?') + '$', 'i');
+            this._minWeekdaysParse[i] = new RegExp('^' + this.weekdaysMin(mom, '').replace('.', '\.?') + '$', 'i');
+        }
+        if (!this._weekdaysParse[i]) {
+            regex = '^' + this.weekdays(mom, '') + '|^' + this.weekdaysShort(mom, '') + '|^' + this.weekdaysMin(mom, '');
+            this._weekdaysParse[i] = new RegExp(regex.replace('.', ''), 'i');
+        }
+        // test the regex
+        if (strict && format === 'dddd' && this._fullWeekdaysParse[i].test(weekdayName)) {
+            return i;
+        } else if (strict && format === 'ddd' && this._shortWeekdaysParse[i].test(weekdayName)) {
+            return i;
+        } else if (strict && format === 'dd' && this._minWeekdaysParse[i].test(weekdayName)) {
+            return i;
+        } else if (!strict && this._weekdaysParse[i].test(weekdayName)) {
+            return i;
+        }
+    }
+}
+
+// MOMENTS
+
+function getSetDayOfWeek (input) {
+    if (!this.isValid()) {
+        return input != null ? this : NaN;
+    }
+    var day = this._isUTC ? this._d.getUTCDay() : this._d.getDay();
+    if (input != null) {
+        input = parseWeekday(input, this.localeData());
+        return this.add(input - day, 'd');
+    } else {
+        return day;
+    }
+}
+
+function getSetLocaleDayOfWeek (input) {
+    if (!this.isValid()) {
+        return input != null ? this : NaN;
+    }
+    var weekday = (this.day() + 7 - this.localeData()._week.dow) % 7;
+    return input == null ? weekday : this.add(input - weekday, 'd');
+}
+
+function getSetISODayOfWeek (input) {
+    if (!this.isValid()) {
+        return input != null ? this : NaN;
+    }
+
+    // behaves the same as moment#day except
+    // as a getter, returns 7 instead of 0 (1-7 range instead of 0-6)
+    // as a setter, sunday should belong to the previous week.
+
+    if (input != null) {
+        var weekday = parseIsoWeekday(input, this.localeData());
+        return this.day(this.day() % 7 ? weekday : weekday - 7);
+    } else {
+        return this.day() || 7;
+    }
+}
+
+var defaultWeekdaysRegex = matchWord;
+function weekdaysRegex (isStrict) {
+    if (this._weekdaysParseExact) {
+        if (!hasOwnProp(this, '_weekdaysRegex')) {
+            computeWeekdaysParse.call(this);
+        }
+        if (isStrict) {
+            return this._weekdaysStrictRegex;
+        } else {
+            return this._weekdaysRegex;
+        }
+    } else {
+        if (!hasOwnProp(this, '_weekdaysRegex')) {
+            this._weekdaysRegex = defaultWeekdaysRegex;
+        }
+        return this._weekdaysStrictRegex && isStrict ?
+            this._weekdaysStrictRegex : this._weekdaysRegex;
+    }
+}
+
+var defaultWeekdaysShortRegex = matchWord;
+function weekdaysShortRegex (isStrict) {
+    if (this._weekdaysParseExact) {
+        if (!hasOwnProp(this, '_weekdaysRegex')) {
+            computeWeekdaysParse.call(this);
+        }
+        if (isStrict) {
+            return this._weekdaysShortStrictRegex;
+        } else {
+            return this._weekdaysShortRegex;
+        }
+    } else {
+        if (!hasOwnProp(this, '_weekdaysShortRegex')) {
+            this._weekdaysShortRegex = defaultWeekdaysShortRegex;
+        }
+        return this._weekdaysShortStrictRegex && isStrict ?
+            this._weekdaysShortStrictRegex : this._weekdaysShortRegex;
+    }
+}
+
+var defaultWeekdaysMinRegex = matchWord;
+function weekdaysMinRegex (isStrict) {
+    if (this._weekdaysParseExact) {
+        if (!hasOwnProp(this, '_weekdaysRegex')) {
+            computeWeekdaysParse.call(this);
+        }
+        if (isStrict) {
+            return this._weekdaysMinStrictRegex;
+        } else {
+            return this._weekdaysMinRegex;
+        }
+    } else {
+        if (!hasOwnProp(this, '_weekdaysMinRegex')) {
+            this._weekdaysMinRegex = defaultWeekdaysMinRegex;
+        }
+        return this._weekdaysMinStrictRegex && isStrict ?
+            this._weekdaysMinStrictRegex : this._weekdaysMinRegex;
+    }
+}
+
+
+function computeWeekdaysParse () {
+    function cmpLenRev(a, b) {
+        return b.length - a.length;
+    }
+
+    var minPieces = [], shortPieces = [], longPieces = [], mixedPieces = [],
+        i, mom, minp, shortp, longp;
+    for (i = 0; i < 7; i++) {
+        // make the regex if we don't have it already
+        mom = createUTC([2000, 1]).day(i);
+        minp = this.weekdaysMin(mom, '');
+        shortp = this.weekdaysShort(mom, '');
+        longp = this.weekdays(mom, '');
+        minPieces.push(minp);
+        shortPieces.push(shortp);
+        longPieces.push(longp);
+        mixedPieces.push(minp);
+        mixedPieces.push(shortp);
+        mixedPieces.push(longp);
+    }
+    // Sorting makes sure if one weekday (or abbr) is a prefix of another it
+    // will match the longer piece.
+    minPieces.sort(cmpLenRev);
+    shortPieces.sort(cmpLenRev);
+    longPieces.sort(cmpLenRev);
+    mixedPieces.sort(cmpLenRev);
+    for (i = 0; i < 7; i++) {
+        shortPieces[i] = regexEscape(shortPieces[i]);
+        longPieces[i] = regexEscape(longPieces[i]);
+        mixedPieces[i] = regexEscape(mixedPieces[i]);
+    }
+
+    this._weekdaysRegex = new RegExp('^(' + mixedPieces.join('|') + ')', 'i');
+    this._weekdaysShortRegex = this._weekdaysRegex;
+    this._weekdaysMinRegex = this._weekdaysRegex;
+
+    this._weekdaysStrictRegex = new RegExp('^(' + longPieces.join('|') + ')', 'i');
+    this._weekdaysShortStrictRegex = new RegExp('^(' + shortPieces.join('|') + ')', 'i');
+    this._weekdaysMinStrictRegex = new RegExp('^(' + minPieces.join('|') + ')', 'i');
+}
+
+// FORMATTING
+
+function hFormat() {
+    return this.hours() % 12 || 12;
+}
+
+function kFormat() {
+    return this.hours() || 24;
+}
+
+addFormatToken('H', ['HH', 2], 0, 'hour');
+addFormatToken('h', ['hh', 2], 0, hFormat);
+addFormatToken('k', ['kk', 2], 0, kFormat);
+
+addFormatToken('hmm', 0, 0, function () {
+    return '' + hFormat.apply(this) + zeroFill(this.minutes(), 2);
+});
+
+addFormatToken('hmmss', 0, 0, function () {
+    return '' + hFormat.apply(this) + zeroFill(this.minutes(), 2) +
+        zeroFill(this.seconds(), 2);
+});
+
+addFormatToken('Hmm', 0, 0, function () {
+    return '' + this.hours() + zeroFill(this.minutes(), 2);
+});
+
+addFormatToken('Hmmss', 0, 0, function () {
+    return '' + this.hours() + zeroFill(this.minutes(), 2) +
+        zeroFill(this.seconds(), 2);
+});
+
+function meridiem (token, lowercase) {
+    addFormatToken(token, 0, 0, function () {
+        return this.localeData().meridiem(this.hours(), this.minutes(), lowercase);
+    });
+}
+
+meridiem('a', true);
+meridiem('A', false);
+
+// ALIASES
+
+addUnitAlias('hour', 'h');
+
+// PRIORITY
+addUnitPriority('hour', 13);
+
+// PARSING
+
+function matchMeridiem (isStrict, locale) {
+    return locale._meridiemParse;
+}
+
+addRegexToken('a',  matchMeridiem);
+addRegexToken('A',  matchMeridiem);
+addRegexToken('H',  match1to2);
+addRegexToken('h',  match1to2);
+addRegexToken('k',  match1to2);
+addRegexToken('HH', match1to2, match2);
+addRegexToken('hh', match1to2, match2);
+addRegexToken('kk', match1to2, match2);
+
+addRegexToken('hmm', match3to4);
+addRegexToken('hmmss', match5to6);
+addRegexToken('Hmm', match3to4);
+addRegexToken('Hmmss', match5to6);
+
+addParseToken(['H', 'HH'], HOUR);
+addParseToken(['k', 'kk'], function (input, array, config) {
+    var kInput = toInt(input);
+    array[HOUR] = kInput === 24 ? 0 : kInput;
+});
+addParseToken(['a', 'A'], function (input, array, config) {
+    config._isPm = config._locale.isPM(input);
+    config._meridiem = input;
+});
+addParseToken(['h', 'hh'], function (input, array, config) {
+    array[HOUR] = toInt(input);
+    getParsingFlags(config).bigHour = true;
+});
+addParseToken('hmm', function (input, array, config) {
+    var pos = input.length - 2;
+    array[HOUR] = toInt(input.substr(0, pos));
+    array[MINUTE] = toInt(input.substr(pos));
+    getParsingFlags(config).bigHour = true;
+});
+addParseToken('hmmss', function (input, array, config) {
+    var pos1 = input.length - 4;
+    var pos2 = input.length - 2;
+    array[HOUR] = toInt(input.substr(0, pos1));
+    array[MINUTE] = toInt(input.substr(pos1, 2));
+    array[SECOND] = toInt(input.substr(pos2));
+    getParsingFlags(config).bigHour = true;
+});
+addParseToken('Hmm', function (input, array, config) {
+    var pos = input.length - 2;
+    array[HOUR] = toInt(input.substr(0, pos));
+    array[MINUTE] = toInt(input.substr(pos));
+});
+addParseToken('Hmmss', function (input, array, config) {
+    var pos1 = input.length - 4;
+    var pos2 = input.length - 2;
+    array[HOUR] = toInt(input.substr(0, pos1));
+    array[MINUTE] = toInt(input.substr(pos1, 2));
+    array[SECOND] = toInt(input.substr(pos2));
+});
+
+// LOCALES
+
+function localeIsPM (input) {
+    // IE8 Quirks Mode & IE7 Standards Mode do not allow accessing strings like arrays
+    // Using charAt should be more compatible.
+    return ((input + '').toLowerCase().charAt(0) === 'p');
+}
+
+var defaultLocaleMeridiemParse = /[ap]\.?m?\.?/i;
+function localeMeridiem (hours, minutes, isLower) {
+    if (hours > 11) {
+        return isLower ? 'pm' : 'PM';
+    } else {
+        return isLower ? 'am' : 'AM';
+    }
+}
+
+
+// MOMENTS
+
+// Setting the hour should keep the time, because the user explicitly
+// specified which hour he wants. So trying to maintain the same hour (in
+// a new timezone) makes sense. Adding/subtracting hours does not follow
+// this rule.
+var getSetHour = makeGetSet('Hours', true);
+
+// months
+// week
+// weekdays
+// meridiem
+var baseConfig = {
+    calendar: defaultCalendar,
+    longDateFormat: defaultLongDateFormat,
+    invalidDate: defaultInvalidDate,
+    ordinal: defaultOrdinal,
+    dayOfMonthOrdinalParse: defaultDayOfMonthOrdinalParse,
+    relativeTime: defaultRelativeTime,
+
+    months: defaultLocaleMonths,
+    monthsShort: defaultLocaleMonthsShort,
+
+    week: defaultLocaleWeek,
+
+    weekdays: defaultLocaleWeekdays,
+    weekdaysMin: defaultLocaleWeekdaysMin,
+    weekdaysShort: defaultLocaleWeekdaysShort,
+
+    meridiemParse: defaultLocaleMeridiemParse
+};
+
+// internal storage for locale config files
+var locales = {};
+var localeFamilies = {};
+var globalLocale;
+
+function normalizeLocale(key) {
+    return key ? key.toLowerCase().replace('_', '-') : key;
+}
+
+// pick the locale from the array
+// try ['en-au', 'en-gb'] as 'en-au', 'en-gb', 'en', as in move through the list trying each
+// substring from most specific to least, but move to the next array item if it's a more specific variant than the current root
+function chooseLocale(names) {
+    var i = 0, j, next, locale, split;
+
+    while (i < names.length) {
+        split = normalizeLocale(names[i]).split('-');
+        j = split.length;
+        next = normalizeLocale(names[i + 1]);
+        next = next ? next.split('-') : null;
+        while (j > 0) {
+            locale = loadLocale(split.slice(0, j).join('-'));
+            if (locale) {
+                return locale;
+            }
+            if (next && next.length >= j && compareArrays(split, next, true) >= j - 1) {
+                //the next array item is better than a shallower substring of this one
+                break;
+            }
+            j--;
+        }
+        i++;
+    }
+    return null;
+}
+
+function loadLocale(name) {
+    var oldLocale = null;
+    // TODO: Find a better way to register and load all the locales in Node
+    if (!locales[name] && (typeof module !== 'undefined') &&
+            module && module.exports) {
+        try {
+            oldLocale = globalLocale._abbr;
+            var aliasedRequire = require;
+            aliasedRequire('./locale/' + name);
+            getSetGlobalLocale(oldLocale);
+        } catch (e) {}
+    }
+    return locales[name];
+}
+
+// This function will load locale and then set the global locale.  If
+// no arguments are passed in, it will simply return the current global
+// locale key.
+function getSetGlobalLocale (key, values) {
+    var data;
+    if (key) {
+        if (isUndefined(values)) {
+            data = getLocale(key);
+        }
+        else {
+            data = defineLocale(key, values);
+        }
+
+        if (data) {
+            // moment.duration._locale = moment._locale = data;
+            globalLocale = data;
+        }
+    }
+
+    return globalLocale._abbr;
+}
+
+function defineLocale (name, config) {
+    if (config !== null) {
+        var parentConfig = baseConfig;
+        config.abbr = name;
+        if (locales[name] != null) {
+            deprecateSimple('defineLocaleOverride',
+                    'use moment.updateLocale(localeName, config) to change ' +
+                    'an existing locale. moment.defineLocale(localeName, ' +
+                    'config) should only be used for creating a new locale ' +
+                    'See http://momentjs.com/guides/#/warnings/define-locale/ for more info.');
+            parentConfig = locales[name]._config;
+        } else if (config.parentLocale != null) {
+            if (locales[config.parentLocale] != null) {
+                parentConfig = locales[config.parentLocale]._config;
+            } else {
+                if (!localeFamilies[config.parentLocale]) {
+                    localeFamilies[config.parentLocale] = [];
+                }
+                localeFamilies[config.parentLocale].push({
+                    name: name,
+                    config: config
+                });
+                return null;
+            }
+        }
+        locales[name] = new Locale(mergeConfigs(parentConfig, config));
+
+        if (localeFamilies[name]) {
+            localeFamilies[name].forEach(function (x) {
+                defineLocale(x.name, x.config);
+            });
+        }
+
+        // backwards compat for now: also set the locale
+        // make sure we set the locale AFTER all child locales have been
+        // created, so we won't end up with the child locale set.
+        getSetGlobalLocale(name);
+
+
+        return locales[name];
+    } else {
+        // useful for testing
+        delete locales[name];
+        return null;
+    }
+}
+
+function updateLocale(name, config) {
+    if (config != null) {
+        var locale, tmpLocale, parentConfig = baseConfig;
+        // MERGE
+        tmpLocale = loadLocale(name);
+        if (tmpLocale != null) {
+            parentConfig = tmpLocale._config;
+        }
+        config = mergeConfigs(parentConfig, config);
+        locale = new Locale(config);
+        locale.parentLocale = locales[name];
+        locales[name] = locale;
+
+        // backwards compat for now: also set the locale
+        getSetGlobalLocale(name);
+    } else {
+        // pass null for config to unupdate, useful for tests
+        if (locales[name] != null) {
+            if (locales[name].parentLocale != null) {
+                locales[name] = locales[name].parentLocale;
+            } else if (locales[name] != null) {
+                delete locales[name];
+            }
+        }
+    }
+    return locales[name];
+}
+
+// returns locale data
+function getLocale (key) {
+    var locale;
+
+    if (key && key._locale && key._locale._abbr) {
+        key = key._locale._abbr;
+    }
+
+    if (!key) {
+        return globalLocale;
+    }
+
+    if (!isArray(key)) {
+        //short-circuit everything else
+        locale = loadLocale(key);
+        if (locale) {
+            return locale;
+        }
+        key = [key];
+    }
+
+    return chooseLocale(key);
+}
+
+function listLocales() {
+    return keys(locales);
+}
+
+function checkOverflow (m) {
+    var overflow;
+    var a = m._a;
+
+    if (a && getParsingFlags(m).overflow === -2) {
+        overflow =
+            a[MONTH]       < 0 || a[MONTH]       > 11  ? MONTH :
+            a[DATE]        < 1 || a[DATE]        > daysInMonth(a[YEAR], a[MONTH]) ? DATE :
+            a[HOUR]        < 0 || a[HOUR]        > 24 || (a[HOUR] === 24 && (a[MINUTE] !== 0 || a[SECOND] !== 0 || a[MILLISECOND] !== 0)) ? HOUR :
+            a[MINUTE]      < 0 || a[MINUTE]      > 59  ? MINUTE :
+            a[SECOND]      < 0 || a[SECOND]      > 59  ? SECOND :
+            a[MILLISECOND] < 0 || a[MILLISECOND] > 999 ? MILLISECOND :
+            -1;
+
+        if (getParsingFlags(m)._overflowDayOfYear && (overflow < YEAR || overflow > DATE)) {
+            overflow = DATE;
+        }
+        if (getParsingFlags(m)._overflowWeeks && overflow === -1) {
+            overflow = WEEK;
+        }
+        if (getParsingFlags(m)._overflowWeekday && overflow === -1) {
+            overflow = WEEKDAY;
+        }
+
+        getParsingFlags(m).overflow = overflow;
+    }
+
+    return m;
+}
+
+// Pick the first defined of two or three arguments.
+function defaults(a, b, c) {
+    if (a != null) {
+        return a;
+    }
+    if (b != null) {
+        return b;
+    }
+    return c;
+}
+
+function currentDateArray(config) {
+    // hooks is actually the exported moment object
+    var nowValue = new Date(hooks.now());
+    if (config._useUTC) {
+        return [nowValue.getUTCFullYear(), nowValue.getUTCMonth(), nowValue.getUTCDate()];
+    }
+    return [nowValue.getFullYear(), nowValue.getMonth(), nowValue.getDate()];
+}
+
+// convert an array to a date.
+// the array should mirror the parameters below
+// note: all values past the year are optional and will default to the lowest possible value.
+// [year, month, day , hour, minute, second, millisecond]
+function configFromArray (config) {
+    var i, date, input = [], currentDate, expectedWeekday, yearToUse;
+
+    if (config._d) {
+        return;
+    }
+
+    currentDate = currentDateArray(config);
+
+    //compute day of the year from weeks and weekdays
+    if (config._w && config._a[DATE] == null && config._a[MONTH] == null) {
+        dayOfYearFromWeekInfo(config);
+    }
+
+    //if the day of the year is set, figure out what it is
+    if (config._dayOfYear != null) {
+        yearToUse = defaults(config._a[YEAR], currentDate[YEAR]);
+
+        if (config._dayOfYear > daysInYear(yearToUse) || config._dayOfYear === 0) {
+            getParsingFlags(config)._overflowDayOfYear = true;
+        }
+
+        date = createUTCDate(yearToUse, 0, config._dayOfYear);
+        config._a[MONTH] = date.getUTCMonth();
+        config._a[DATE] = date.getUTCDate();
+    }
+
+    // Default to current date.
+    // * if no year, month, day of month are given, default to today
+    // * if day of month is given, default month and year
+    // * if month is given, default only year
+    // * if year is given, don't default anything
+    for (i = 0; i < 3 && config._a[i] == null; ++i) {
+        config._a[i] = input[i] = currentDate[i];
+    }
+
+    // Zero out whatever was not defaulted, including time
+    for (; i < 7; i++) {
+        config._a[i] = input[i] = (config._a[i] == null) ? (i === 2 ? 1 : 0) : config._a[i];
+    }
+
+    // Check for 24:00:00.000
+    if (config._a[HOUR] === 24 &&
+            config._a[MINUTE] === 0 &&
+            config._a[SECOND] === 0 &&
+            config._a[MILLISECOND] === 0) {
+        config._nextDay = true;
+        config._a[HOUR] = 0;
+    }
+
+    config._d = (config._useUTC ? createUTCDate : createDate).apply(null, input);
+    expectedWeekday = config._useUTC ? config._d.getUTCDay() : config._d.getDay();
+
+    // Apply timezone offset from input. The actual utcOffset can be changed
+    // with parseZone.
+    if (config._tzm != null) {
+        config._d.setUTCMinutes(config._d.getUTCMinutes() - config._tzm);
+    }
+
+    if (config._nextDay) {
+        config._a[HOUR] = 24;
+    }
+
+    // check for mismatching day of week
+    if (config._w && typeof config._w.d !== 'undefined' && config._w.d !== expectedWeekday) {
+        getParsingFlags(config).weekdayMismatch = true;
+    }
+}
+
+function dayOfYearFromWeekInfo(config) {
+    var w, weekYear, week, weekday, dow, doy, temp, weekdayOverflow;
+
+    w = config._w;
+    if (w.GG != null || w.W != null || w.E != null) {
+        dow = 1;
+        doy = 4;
+
+        // TODO: We need to take the current isoWeekYear, but that depends on
+        // how we interpret now (local, utc, fixed offset). So create
+        // a now version of current config (take local/utc/offset flags, and
+        // create now).
+        weekYear = defaults(w.GG, config._a[YEAR], weekOfYear(createLocal(), 1, 4).year);
+        week = defaults(w.W, 1);
+        weekday = defaults(w.E, 1);
+        if (weekday < 1 || weekday > 7) {
+            weekdayOverflow = true;
+        }
+    } else {
+        dow = config._locale._week.dow;
+        doy = config._locale._week.doy;
+
+        var curWeek = weekOfYear(createLocal(), dow, doy);
+
+        weekYear = defaults(w.gg, config._a[YEAR], curWeek.year);
+
+        // Default to current week.
+        week = defaults(w.w, curWeek.week);
+
+        if (w.d != null) {
+            // weekday -- low day numbers are considered next week
+            weekday = w.d;
+            if (weekday < 0 || weekday > 6) {
+                weekdayOverflow = true;
+            }
+        } else if (w.e != null) {
+            // local weekday -- counting starts from begining of week
+            weekday = w.e + dow;
+            if (w.e < 0 || w.e > 6) {
+                weekdayOverflow = true;
+            }
+        } else {
+            // default to begining of week
+            weekday = dow;
+        }
+    }
+    if (week < 1 || week > weeksInYear(weekYear, dow, doy)) {
+        getParsingFlags(config)._overflowWeeks = true;
+    } else if (weekdayOverflow != null) {
+        getParsingFlags(config)._overflowWeekday = true;
+    } else {
+        temp = dayOfYearFromWeeks(weekYear, week, weekday, dow, doy);
+        config._a[YEAR] = temp.year;
+        config._dayOfYear = temp.dayOfYear;
+    }
+}
+
+// iso 8601 regex
+// 0000-00-00 0000-W00 or 0000-W00-0 + T + 00 or 00:00 or 00:00:00 or 00:00:00.000 + +00:00 or +0000 or +00)
+var extendedIsoRegex = /^\s*((?:[+-]\d{6}|\d{4})-(?:\d\d-\d\d|W\d\d-\d|W\d\d|\d\d\d|\d\d))(?:(T| )(\d\d(?::\d\d(?::\d\d(?:[.,]\d+)?)?)?)([\+\-]\d\d(?::?\d\d)?|\s*Z)?)?$/;
+var basicIsoRegex = /^\s*((?:[+-]\d{6}|\d{4})(?:\d\d\d\d|W\d\d\d|W\d\d|\d\d\d|\d\d))(?:(T| )(\d\d(?:\d\d(?:\d\d(?:[.,]\d+)?)?)?)([\+\-]\d\d(?::?\d\d)?|\s*Z)?)?$/;
+
+var tzRegex = /Z|[+-]\d\d(?::?\d\d)?/;
+
+var isoDates = [
+    ['YYYYYY-MM-DD', /[+-]\d{6}-\d\d-\d\d/],
+    ['YYYY-MM-DD', /\d{4}-\d\d-\d\d/],
+    ['GGGG-[W]WW-E', /\d{4}-W\d\d-\d/],
+    ['GGGG-[W]WW', /\d{4}-W\d\d/, false],
+    ['YYYY-DDD', /\d{4}-\d{3}/],
+    ['YYYY-MM', /\d{4}-\d\d/, false],
+    ['YYYYYYMMDD', /[+-]\d{10}/],
+    ['YYYYMMDD', /\d{8}/],
+    // YYYYMM is NOT allowed by the standard
+    ['GGGG[W]WWE', /\d{4}W\d{3}/],
+    ['GGGG[W]WW', /\d{4}W\d{2}/, false],
+    ['YYYYDDD', /\d{7}/]
+];
+
+// iso time formats and regexes
+var isoTimes = [
+    ['HH:mm:ss.SSSS', /\d\d:\d\d:\d\d\.\d+/],
+    ['HH:mm:ss,SSSS', /\d\d:\d\d:\d\d,\d+/],
+    ['HH:mm:ss', /\d\d:\d\d:\d\d/],
+    ['HH:mm', /\d\d:\d\d/],
+    ['HHmmss.SSSS', /\d\d\d\d\d\d\.\d+/],
+    ['HHmmss,SSSS', /\d\d\d\d\d\d,\d+/],
+    ['HHmmss', /\d\d\d\d\d\d/],
+    ['HHmm', /\d\d\d\d/],
+    ['HH', /\d\d/]
+];
+
+var aspNetJsonRegex = /^\/?Date\((\-?\d+)/i;
+
+// date from iso format
+function configFromISO(config) {
+    var i, l,
+        string = config._i,
+        match = extendedIsoRegex.exec(string) || basicIsoRegex.exec(string),
+        allowTime, dateFormat, timeFormat, tzFormat;
+
+    if (match) {
+        getParsingFlags(config).iso = true;
+
+        for (i = 0, l = isoDates.length; i < l; i++) {
+            if (isoDates[i][1].exec(match[1])) {
+                dateFormat = isoDates[i][0];
+                allowTime = isoDates[i][2] !== false;
+                break;
+            }
+        }
+        if (dateFormat == null) {
+            config._isValid = false;
+            return;
+        }
+        if (match[3]) {
+            for (i = 0, l = isoTimes.length; i < l; i++) {
+                if (isoTimes[i][1].exec(match[3])) {
+                    // match[2] should be 'T' or space
+                    timeFormat = (match[2] || ' ') + isoTimes[i][0];
+                    break;
+                }
+            }
+            if (timeFormat == null) {
+                config._isValid = false;
+                return;
+            }
+        }
+        if (!allowTime && timeFormat != null) {
+            config._isValid = false;
+            return;
+        }
+        if (match[4]) {
+            if (tzRegex.exec(match[4])) {
+                tzFormat = 'Z';
+            } else {
+                config._isValid = false;
+                return;
+            }
+        }
+        config._f = dateFormat + (timeFormat || '') + (tzFormat || '');
+        configFromStringAndFormat(config);
+    } else {
+        config._isValid = false;
+    }
+}
+
+// RFC 2822 regex: For details see https://tools.ietf.org/html/rfc2822#section-3.3
+var rfc2822 = /^(?:(Mon|Tue|Wed|Thu|Fri|Sat|Sun),?\s)?(\d{1,2})\s(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s(\d{2,4})\s(\d\d):(\d\d)(?::(\d\d))?\s(?:(UT|GMT|[ECMP][SD]T)|([Zz])|([+-]\d{4}))$/;
+
+function extractFromRFC2822Strings(yearStr, monthStr, dayStr, hourStr, minuteStr, secondStr) {
+    var result = [
+        untruncateYear(yearStr),
+        defaultLocaleMonthsShort.indexOf(monthStr),
+        parseInt(dayStr, 10),
+        parseInt(hourStr, 10),
+        parseInt(minuteStr, 10)
+    ];
+
+    if (secondStr) {
+        result.push(parseInt(secondStr, 10));
+    }
+
+    return result;
+}
+
+function untruncateYear(yearStr) {
+    var year = parseInt(yearStr, 10);
+    if (year <= 49) {
+        return 2000 + year;
+    } else if (year <= 999) {
+        return 1900 + year;
+    }
+    return year;
+}
+
+function preprocessRFC2822(s) {
+    // Remove comments and folding whitespace and replace multiple-spaces with a single space
+    return s.replace(/\([^)]*\)|[\n\t]/g, ' ').replace(/(\s\s+)/g, ' ').trim();
+}
+
+function checkWeekday(weekdayStr, parsedInput, config) {
+    if (weekdayStr) {
+        // TODO: Replace the vanilla JS Date object with an indepentent day-of-week check.
+        var weekdayProvided = defaultLocaleWeekdaysShort.indexOf(weekdayStr),
+            weekdayActual = new Date(parsedInput[0], parsedInput[1], parsedInput[2]).getDay();
+        if (weekdayProvided !== weekdayActual) {
+            getParsingFlags(config).weekdayMismatch = true;
+            config._isValid = false;
+            return false;
+        }
+    }
+    return true;
+}
+
+var obsOffsets = {
+    UT: 0,
+    GMT: 0,
+    EDT: -4 * 60,
+    EST: -5 * 60,
+    CDT: -5 * 60,
+    CST: -6 * 60,
+    MDT: -6 * 60,
+    MST: -7 * 60,
+    PDT: -7 * 60,
+    PST: -8 * 60
+};
+
+function calculateOffset(obsOffset, militaryOffset, numOffset) {
+    if (obsOffset) {
+        return obsOffsets[obsOffset];
+    } else if (militaryOffset) {
+        // the only allowed military tz is Z
+        return 0;
+    } else {
+        var hm = parseInt(numOffset, 10);
+        var m = hm % 100, h = (hm - m) / 100;
+        return h * 60 + m;
+    }
+}
+
+// date and time from ref 2822 format
+function configFromRFC2822(config) {
+    var match = rfc2822.exec(preprocessRFC2822(config._i));
+    if (match) {
+        var parsedArray = extractFromRFC2822Strings(match[4], match[3], match[2], match[5], match[6], match[7]);
+        if (!checkWeekday(match[1], parsedArray, config)) {
+            return;
+        }
+
+        config._a = parsedArray;
+        config._tzm = calculateOffset(match[8], match[9], match[10]);
+
+        config._d = createUTCDate.apply(null, config._a);
+        config._d.setUTCMinutes(config._d.getUTCMinutes() - config._tzm);
+
+        getParsingFlags(config).rfc2822 = true;
+    } else {
+        config._isValid = false;
+    }
+}
+
+// date from iso format or fallback
+function configFromString(config) {
+    var matched = aspNetJsonRegex.exec(config._i);
+
+    if (matched !== null) {
+        config._d = new Date(+matched[1]);
+        return;
+    }
+
+    configFromISO(config);
+    if (config._isValid === false) {
+        delete config._isValid;
+    } else {
+        return;
+    }
+
+    configFromRFC2822(config);
+    if (config._isValid === false) {
+        delete config._isValid;
+    } else {
+        return;
+    }
+
+    // Final attempt, use Input Fallback
+    hooks.createFromInputFallback(config);
+}
+
+hooks.createFromInputFallback = deprecate(
+    'value provided is not in a recognized RFC2822 or ISO format. moment construction falls back to js Date(), ' +
+    'which is not reliable across all browsers and versions. Non RFC2822/ISO date formats are ' +
+    'discouraged and will be removed in an upcoming major release. Please refer to ' +
+    'http://momentjs.com/guides/#/warnings/js-date/ for more info.',
+    function (config) {
+        config._d = new Date(config._i + (config._useUTC ? ' UTC' : ''));
+    }
+);
+
+// constant that refers to the ISO standard
+hooks.ISO_8601 = function () {};
+
+// constant that refers to the RFC 2822 form
+hooks.RFC_2822 = function () {};
+
+// date from string and format string
+function configFromStringAndFormat(config) {
+    // TODO: Move this to another part of the creation flow to prevent circular deps
+    if (config._f === hooks.ISO_8601) {
+        configFromISO(config);
+        return;
+    }
+    if (config._f === hooks.RFC_2822) {
+        configFromRFC2822(config);
+        return;
+    }
+    config._a = [];
+    getParsingFlags(config).empty = true;
+
+    // This array is used to make a Date, either with `new Date` or `Date.UTC`
+    var string = '' + config._i,
+        i, parsedInput, tokens, token, skipped,
+        stringLength = string.length,
+        totalParsedInputLength = 0;
+
+    tokens = expandFormat(config._f, config._locale).match(formattingTokens) || [];
+
+    for (i = 0; i < tokens.length; i++) {
+        token = tokens[i];
+        parsedInput = (string.match(getParseRegexForToken(token, config)) || [])[0];
+        // console.log('token', token, 'parsedInput', parsedInput,
+        //         'regex', getParseRegexForToken(token, config));
+        if (parsedInput) {
+            skipped = string.substr(0, string.indexOf(parsedInput));
+            if (skipped.length > 0) {
+                getParsingFlags(config).unusedInput.push(skipped);
+            }
+            string = string.slice(string.indexOf(parsedInput) + parsedInput.length);
+            totalParsedInputLength += parsedInput.length;
+        }
+        // don't parse if it's not a known token
+        if (formatTokenFunctions[token]) {
+            if (parsedInput) {
+                getParsingFlags(config).empty = false;
+            }
+            else {
+                getParsingFlags(config).unusedTokens.push(token);
+            }
+            addTimeToArrayFromToken(token, parsedInput, config);
+        }
+        else if (config._strict && !parsedInput) {
+            getParsingFlags(config).unusedTokens.push(token);
+        }
+    }
+
+    // add remaining unparsed input length to the string
+    getParsingFlags(config).charsLeftOver = stringLength - totalParsedInputLength;
+    if (string.length > 0) {
+        getParsingFlags(config).unusedInput.push(string);
+    }
+
+    // clear _12h flag if hour is <= 12
+    if (config._a[HOUR] <= 12 &&
+        getParsingFlags(config).bigHour === true &&
+        config._a[HOUR] > 0) {
+        getParsingFlags(config).bigHour = undefined;
+    }
+
+    getParsingFlags(config).parsedDateParts = config._a.slice(0);
+    getParsingFlags(config).meridiem = config._meridiem;
+    // handle meridiem
+    config._a[HOUR] = meridiemFixWrap(config._locale, config._a[HOUR], config._meridiem);
+
+    configFromArray(config);
+    checkOverflow(config);
+}
+
+
+function meridiemFixWrap (locale, hour, meridiem) {
+    var isPm;
+
+    if (meridiem == null) {
+        // nothing to do
+        return hour;
+    }
+    if (locale.meridiemHour != null) {
+        return locale.meridiemHour(hour, meridiem);
+    } else if (locale.isPM != null) {
+        // Fallback
+        isPm = locale.isPM(meridiem);
+        if (isPm && hour < 12) {
+            hour += 12;
+        }
+        if (!isPm && hour === 12) {
+            hour = 0;
+        }
+        return hour;
+    } else {
+        // this is not supposed to happen
+        return hour;
+    }
+}
+
+// date from string and array of format strings
+function configFromStringAndArray(config) {
+    var tempConfig,
+        bestMoment,
+
+        scoreToBeat,
+        i,
+        currentScore;
+
+    if (config._f.length === 0) {
+        getParsingFlags(config).invalidFormat = true;
+        config._d = new Date(NaN);
+        return;
+    }
+
+    for (i = 0; i < config._f.length; i++) {
+        currentScore = 0;
+        tempConfig = copyConfig({}, config);
+        if (config._useUTC != null) {
+            tempConfig._useUTC = config._useUTC;
+        }
+        tempConfig._f = config._f[i];
+        configFromStringAndFormat(tempConfig);
+
+        if (!isValid(tempConfig)) {
+            continue;
+        }
+
+        // if there is any input that was not parsed add a penalty for that format
+        currentScore += getParsingFlags(tempConfig).charsLeftOver;
+
+        //or tokens
+        currentScore += getParsingFlags(tempConfig).unusedTokens.length * 10;
+
+        getParsingFlags(tempConfig).score = currentScore;
+
+        if (scoreToBeat == null || currentScore < scoreToBeat) {
+            scoreToBeat = currentScore;
+            bestMoment = tempConfig;
+        }
+    }
+
+    extend(config, bestMoment || tempConfig);
+}
+
+function configFromObject(config) {
+    if (config._d) {
+        return;
+    }
+
+    var i = normalizeObjectUnits(config._i);
+    config._a = map([i.year, i.month, i.day || i.date, i.hour, i.minute, i.second, i.millisecond], function (obj) {
+        return obj && parseInt(obj, 10);
+    });
+
+    configFromArray(config);
+}
+
+function createFromConfig (config) {
+    var res = new Moment(checkOverflow(prepareConfig(config)));
+    if (res._nextDay) {
+        // Adding is smart enough around DST
+        res.add(1, 'd');
+        res._nextDay = undefined;
+    }
+
+    return res;
+}
+
+function prepareConfig (config) {
+    var input = config._i,
+        format = config._f;
+
+    config._locale = config._locale || getLocale(config._l);
+
+    if (input === null || (format === undefined && input === '')) {
+        return createInvalid({nullInput: true});
+    }
+
+    if (typeof input === 'string') {
+        config._i = input = config._locale.preparse(input);
+    }
+
+    if (isMoment(input)) {
+        return new Moment(checkOverflow(input));
+    } else if (isDate(input)) {
+        config._d = input;
+    } else if (isArray(format)) {
+        configFromStringAndArray(config);
+    } else if (format) {
+        configFromStringAndFormat(config);
+    }  else {
+        configFromInput(config);
+    }
+
+    if (!isValid(config)) {
+        config._d = null;
+    }
+
+    return config;
+}
+
+function configFromInput(config) {
+    var input = config._i;
+    if (isUndefined(input)) {
+        config._d = new Date(hooks.now());
+    } else if (isDate(input)) {
+        config._d = new Date(input.valueOf());
+    } else if (typeof input === 'string') {
+        configFromString(config);
+    } else if (isArray(input)) {
+        config._a = map(input.slice(0), function (obj) {
+            return parseInt(obj, 10);
+        });
+        configFromArray(config);
+    } else if (isObject(input)) {
+        configFromObject(config);
+    } else if (isNumber(input)) {
+        // from milliseconds
+        config._d = new Date(input);
+    } else {
+        hooks.createFromInputFallback(config);
+    }
+}
+
+function createLocalOrUTC (input, format, locale, strict, isUTC) {
+    var c = {};
+
+    if (locale === true || locale === false) {
+        strict = locale;
+        locale = undefined;
+    }
+
+    if ((isObject(input) && isObjectEmpty(input)) ||
+            (isArray(input) && input.length === 0)) {
+        input = undefined;
+    }
+    // object construction must be done this way.
+    // https://github.com/moment/moment/issues/1423
+    c._isAMomentObject = true;
+    c._useUTC = c._isUTC = isUTC;
+    c._l = locale;
+    c._i = input;
+    c._f = format;
+    c._strict = strict;
+
+    return createFromConfig(c);
+}
+
+function createLocal (input, format, locale, strict) {
+    return createLocalOrUTC(input, format, locale, strict, false);
+}
+
+var prototypeMin = deprecate(
+    'moment().min is deprecated, use moment.max instead. http://momentjs.com/guides/#/warnings/min-max/',
+    function () {
+        var other = createLocal.apply(null, arguments);
+        if (this.isValid() && other.isValid()) {
+            return other < this ? this : other;
+        } else {
+            return createInvalid();
+        }
+    }
+);
+
+var prototypeMax = deprecate(
+    'moment().max is deprecated, use moment.min instead. http://momentjs.com/guides/#/warnings/min-max/',
+    function () {
+        var other = createLocal.apply(null, arguments);
+        if (this.isValid() && other.isValid()) {
+            return other > this ? this : other;
+        } else {
+            return createInvalid();
+        }
+    }
+);
+
+// Pick a moment m from moments so that m[fn](other) is true for all
+// other. This relies on the function fn to be transitive.
+//
+// moments should either be an array of moment objects or an array, whose
+// first element is an array of moment objects.
+function pickBy(fn, moments) {
+    var res, i;
+    if (moments.length === 1 && isArray(moments[0])) {
+        moments = moments[0];
+    }
+    if (!moments.length) {
+        return createLocal();
+    }
+    res = moments[0];
+    for (i = 1; i < moments.length; ++i) {
+        if (!moments[i].isValid() || moments[i][fn](res)) {
+            res = moments[i];
+        }
+    }
+    return res;
+}
+
+// TODO: Use [].sort instead?
+function min () {
+    var args = [].slice.call(arguments, 0);
+
+    return pickBy('isBefore', args);
+}
+
+function max () {
+    var args = [].slice.call(arguments, 0);
+
+    return pickBy('isAfter', args);
+}
+
+var now = function () {
+    return Date.now ? Date.now() : +(new Date());
+};
+
+var ordering = ['year', 'quarter', 'month', 'week', 'day', 'hour', 'minute', 'second', 'millisecond'];
+
+function isDurationValid(m) {
+    for (var key in m) {
+        if (!(indexOf.call(ordering, key) !== -1 && (m[key] == null || !isNaN(m[key])))) {
+            return false;
+        }
+    }
+
+    var unitHasDecimal = false;
+    for (var i = 0; i < ordering.length; ++i) {
+        if (m[ordering[i]]) {
+            if (unitHasDecimal) {
+                return false; // only allow non-integers for smallest unit
+            }
+            if (parseFloat(m[ordering[i]]) !== toInt(m[ordering[i]])) {
+                unitHasDecimal = true;
+            }
+        }
+    }
+
+    return true;
+}
+
+function isValid$1() {
+    return this._isValid;
+}
+
+function createInvalid$1() {
+    return createDuration(NaN);
+}
+
+function Duration (duration) {
+    var normalizedInput = normalizeObjectUnits(duration),
+        years = normalizedInput.year || 0,
+        quarters = normalizedInput.quarter || 0,
+        months = normalizedInput.month || 0,
+        weeks = normalizedInput.week || 0,
+        days = normalizedInput.day || 0,
+        hours = normalizedInput.hour || 0,
+        minutes = normalizedInput.minute || 0,
+        seconds = normalizedInput.second || 0,
+        milliseconds = normalizedInput.millisecond || 0;
+
+    this._isValid = isDurationValid(normalizedInput);
+
+    // representation for dateAddRemove
+    this._milliseconds = +milliseconds +
+        seconds * 1e3 + // 1000
+        minutes * 6e4 + // 1000 * 60
+        hours * 1000 * 60 * 60; //using 1000 * 60 * 60 instead of 36e5 to avoid floating point rounding errors https://github.com/moment/moment/issues/2978
+    // Because of dateAddRemove treats 24 hours as different from a
+    // day when working around DST, we need to store them separately
+    this._days = +days +
+        weeks * 7;
+    // It is impossible to translate months into days without knowing
+    // which months you are are talking about, so we have to store
+    // it separately.
+    this._months = +months +
+        quarters * 3 +
+        years * 12;
+
+    this._data = {};
+
+    this._locale = getLocale();
+
+    this._bubble();
+}
+
+function isDuration (obj) {
+    return obj instanceof Duration;
+}
+
+function absRound (number) {
+    if (number < 0) {
+        return Math.round(-1 * number) * -1;
+    } else {
+        return Math.round(number);
+    }
+}
+
+// FORMATTING
+
+function offset (token, separator) {
+    addFormatToken(token, 0, 0, function () {
+        var offset = this.utcOffset();
+        var sign = '+';
+        if (offset < 0) {
+            offset = -offset;
+            sign = '-';
+        }
+        return sign + zeroFill(~~(offset / 60), 2) + separator + zeroFill(~~(offset) % 60, 2);
+    });
+}
+
+offset('Z', ':');
+offset('ZZ', '');
+
+// PARSING
+
+addRegexToken('Z',  matchShortOffset);
+addRegexToken('ZZ', matchShortOffset);
+addParseToken(['Z', 'ZZ'], function (input, array, config) {
+    config._useUTC = true;
+    config._tzm = offsetFromString(matchShortOffset, input);
+});
+
+// HELPERS
+
+// timezone chunker
+// '+10:00' > ['10',  '00']
+// '-1530'  > ['-15', '30']
+var chunkOffset = /([\+\-]|\d\d)/gi;
+
+function offsetFromString(matcher, string) {
+    var matches = (string || '').match(matcher);
+
+    if (matches === null) {
+        return null;
+    }
+
+    var chunk   = matches[matches.length - 1] || [];
+    var parts   = (chunk + '').match(chunkOffset) || ['-', 0, 0];
+    var minutes = +(parts[1] * 60) + toInt(parts[2]);
+
+    return minutes === 0 ?
+      0 :
+      parts[0] === '+' ? minutes : -minutes;
+}
+
+// Return a moment from input, that is local/utc/zone equivalent to model.
+function cloneWithOffset(input, model) {
+    var res, diff;
+    if (model._isUTC) {
+        res = model.clone();
+        diff = (isMoment(input) || isDate(input) ? input.valueOf() : createLocal(input).valueOf()) - res.valueOf();
+        // Use low-level api, because this fn is low-level api.
+        res._d.setTime(res._d.valueOf() + diff);
+        hooks.updateOffset(res, false);
+        return res;
+    } else {
+        return createLocal(input).local();
+    }
+}
+
+function getDateOffset (m) {
+    // On Firefox.24 Date#getTimezoneOffset returns a floating point.
+    // https://github.com/moment/moment/pull/1871
+    return -Math.round(m._d.getTimezoneOffset() / 15) * 15;
+}
+
+// HOOKS
+
+// This function will be called whenever a moment is mutated.
+// It is intended to keep the offset in sync with the timezone.
+hooks.updateOffset = function () {};
+
+// MOMENTS
+
+// keepLocalTime = true means only change the timezone, without
+// affecting the local hour. So 5:31:26 +0300 --[utcOffset(2, true)]-->
+// 5:31:26 +0200 It is possible that 5:31:26 doesn't exist with offset
+// +0200, so we adjust the time as needed, to be valid.
+//
+// Keeping the time actually adds/subtracts (one hour)
+// from the actual represented time. That is why we call updateOffset
+// a second time. In case it wants us to change the offset again
+// _changeInProgress == true case, then we have to adjust, because
+// there is no such time in the given timezone.
+function getSetOffset (input, keepLocalTime, keepMinutes) {
+    var offset = this._offset || 0,
+        localAdjust;
+    if (!this.isValid()) {
+        return input != null ? this : NaN;
+    }
+    if (input != null) {
+        if (typeof input === 'string') {
+            input = offsetFromString(matchShortOffset, input);
+            if (input === null) {
+                return this;
+            }
+        } else if (Math.abs(input) < 16 && !keepMinutes) {
+            input = input * 60;
+        }
+        if (!this._isUTC && keepLocalTime) {
+            localAdjust = getDateOffset(this);
+        }
+        this._offset = input;
+        this._isUTC = true;
+        if (localAdjust != null) {
+            this.add(localAdjust, 'm');
+        }
+        if (offset !== input) {
+            if (!keepLocalTime || this._changeInProgress) {
+                addSubtract(this, createDuration(input - offset, 'm'), 1, false);
+            } else if (!this._changeInProgress) {
+                this._changeInProgress = true;
+                hooks.updateOffset(this, true);
+                this._changeInProgress = null;
+            }
+        }
+        return this;
+    } else {
+        return this._isUTC ? offset : getDateOffset(this);
+    }
+}
+
+function getSetZone (input, keepLocalTime) {
+    if (input != null) {
+        if (typeof input !== 'string') {
+            input = -input;
+        }
+
+        this.utcOffset(input, keepLocalTime);
+
+        return this;
+    } else {
+        return -this.utcOffset();
+    }
+}
+
+function setOffsetToUTC (keepLocalTime) {
+    return this.utcOffset(0, keepLocalTime);
+}
+
+function setOffsetToLocal (keepLocalTime) {
+    if (this._isUTC) {
+        this.utcOffset(0, keepLocalTime);
+        this._isUTC = false;
+
+        if (keepLocalTime) {
+            this.subtract(getDateOffset(this), 'm');
+        }
+    }
+    return this;
+}
+
+function setOffsetToParsedOffset () {
+    if (this._tzm != null) {
+        this.utcOffset(this._tzm, false, true);
+    } else if (typeof this._i === 'string') {
+        var tZone = offsetFromString(matchOffset, this._i);
+        if (tZone != null) {
+            this.utcOffset(tZone);
+        }
+        else {
+            this.utcOffset(0, true);
+        }
+    }
+    return this;
+}
+
+function hasAlignedHourOffset (input) {
+    if (!this.isValid()) {
+        return false;
+    }
+    input = input ? createLocal(input).utcOffset() : 0;
+
+    return (this.utcOffset() - input) % 60 === 0;
+}
+
+function isDaylightSavingTime () {
+    return (
+        this.utcOffset() > this.clone().month(0).utcOffset() ||
+        this.utcOffset() > this.clone().month(5).utcOffset()
+    );
+}
+
+function isDaylightSavingTimeShifted () {
+    if (!isUndefined(this._isDSTShifted)) {
+        return this._isDSTShifted;
+    }
+
+    var c = {};
+
+    copyConfig(c, this);
+    c = prepareConfig(c);
+
+    if (c._a) {
+        var other = c._isUTC ? createUTC(c._a) : createLocal(c._a);
+        this._isDSTShifted = this.isValid() &&
+            compareArrays(c._a, other.toArray()) > 0;
+    } else {
+        this._isDSTShifted = false;
+    }
+
+    return this._isDSTShifted;
+}
+
+function isLocal () {
+    return this.isValid() ? !this._isUTC : false;
+}
+
+function isUtcOffset () {
+    return this.isValid() ? this._isUTC : false;
+}
+
+function isUtc () {
+    return this.isValid() ? this._isUTC && this._offset === 0 : false;
+}
+
+// ASP.NET json date format regex
+var aspNetRegex = /^(\-|\+)?(?:(\d*)[. ])?(\d+)\:(\d+)(?:\:(\d+)(\.\d*)?)?$/;
+
+// from http://docs.closure-library.googlecode.com/git/closure_goog_date_date.js.source.html
+// somewhat more in line with 4.4.3.2 2004 spec, but allows decimal anywhere
+// and further modified to allow for strings containing both week and day
+var isoRegex = /^(-|\+)?P(?:([-+]?[0-9,.]*)Y)?(?:([-+]?[0-9,.]*)M)?(?:([-+]?[0-9,.]*)W)?(?:([-+]?[0-9,.]*)D)?(?:T(?:([-+]?[0-9,.]*)H)?(?:([-+]?[0-9,.]*)M)?(?:([-+]?[0-9,.]*)S)?)?$/;
+
+function createDuration (input, key) {
+    var duration = input,
+        // matching against regexp is expensive, do it on demand
+        match = null,
+        sign,
+        ret,
+        diffRes;
+
+    if (isDuration(input)) {
+        duration = {
+            ms : input._milliseconds,
+            d  : input._days,
+            M  : input._months
+        };
+    } else if (isNumber(input)) {
+        duration = {};
+        if (key) {
+            duration[key] = input;
+        } else {
+            duration.milliseconds = input;
+        }
+    } else if (!!(match = aspNetRegex.exec(input))) {
+        sign = (match[1] === '-') ? -1 : 1;
+        duration = {
+            y  : 0,
+            d  : toInt(match[DATE])                         * sign,
+            h  : toInt(match[HOUR])                         * sign,
+            m  : toInt(match[MINUTE])                       * sign,
+            s  : toInt(match[SECOND])                       * sign,
+            ms : toInt(absRound(match[MILLISECOND] * 1000)) * sign // the millisecond decimal point is included in the match
+        };
+    } else if (!!(match = isoRegex.exec(input))) {
+        sign = (match[1] === '-') ? -1 : (match[1] === '+') ? 1 : 1;
+        duration = {
+            y : parseIso(match[2], sign),
+            M : parseIso(match[3], sign),
+            w : parseIso(match[4], sign),
+            d : parseIso(match[5], sign),
+            h : parseIso(match[6], sign),
+            m : parseIso(match[7], sign),
+            s : parseIso(match[8], sign)
+        };
+    } else if (duration == null) {// checks for null or undefined
+        duration = {};
+    } else if (typeof duration === 'object' && ('from' in duration || 'to' in duration)) {
+        diffRes = momentsDifference(createLocal(duration.from), createLocal(duration.to));
+
+        duration = {};
+        duration.ms = diffRes.milliseconds;
+        duration.M = diffRes.months;
+    }
+
+    ret = new Duration(duration);
+
+    if (isDuration(input) && hasOwnProp(input, '_locale')) {
+        ret._locale = input._locale;
+    }
+
+    return ret;
+}
+
+createDuration.fn = Duration.prototype;
+createDuration.invalid = createInvalid$1;
+
+function parseIso (inp, sign) {
+    // We'd normally use ~~inp for this, but unfortunately it also
+    // converts floats to ints.
+    // inp may be undefined, so careful calling replace on it.
+    var res = inp && parseFloat(inp.replace(',', '.'));
+    // apply sign while we're at it
+    return (isNaN(res) ? 0 : res) * sign;
+}
+
+function positiveMomentsDifference(base, other) {
+    var res = {milliseconds: 0, months: 0};
+
+    res.months = other.month() - base.month() +
+        (other.year() - base.year()) * 12;
+    if (base.clone().add(res.months, 'M').isAfter(other)) {
+        --res.months;
+    }
+
+    res.milliseconds = +other - +(base.clone().add(res.months, 'M'));
+
+    return res;
+}
+
+function momentsDifference(base, other) {
+    var res;
+    if (!(base.isValid() && other.isValid())) {
+        return {milliseconds: 0, months: 0};
+    }
+
+    other = cloneWithOffset(other, base);
+    if (base.isBefore(other)) {
+        res = positiveMomentsDifference(base, other);
+    } else {
+        res = positiveMomentsDifference(other, base);
+        res.milliseconds = -res.milliseconds;
+        res.months = -res.months;
+    }
+
+    return res;
+}
+
+// TODO: remove 'name' arg after deprecation is removed
+function createAdder(direction, name) {
+    return function (val, period) {
+        var dur, tmp;
+        //invert the arguments, but complain about it
+        if (period !== null && !isNaN(+period)) {
+            deprecateSimple(name, 'moment().' + name  + '(period, number) is deprecated. Please use moment().' + name + '(number, period). ' +
+            'See http://momentjs.com/guides/#/warnings/add-inverted-param/ for more info.');
+            tmp = val; val = period; period = tmp;
+        }
+
+        val = typeof val === 'string' ? +val : val;
+        dur = createDuration(val, period);
+        addSubtract(this, dur, direction);
+        return this;
+    };
+}
+
+function addSubtract (mom, duration, isAdding, updateOffset) {
+    var milliseconds = duration._milliseconds,
+        days = absRound(duration._days),
+        months = absRound(duration._months);
+
+    if (!mom.isValid()) {
+        // No op
+        return;
+    }
+
+    updateOffset = updateOffset == null ? true : updateOffset;
+
+    if (months) {
+        setMonth(mom, get(mom, 'Month') + months * isAdding);
+    }
+    if (days) {
+        set$1(mom, 'Date', get(mom, 'Date') + days * isAdding);
+    }
+    if (milliseconds) {
+        mom._d.setTime(mom._d.valueOf() + milliseconds * isAdding);
+    }
+    if (updateOffset) {
+        hooks.updateOffset(mom, days || months);
+    }
+}
+
+var add      = createAdder(1, 'add');
+var subtract = createAdder(-1, 'subtract');
+
+function getCalendarFormat(myMoment, now) {
+    var diff = myMoment.diff(now, 'days', true);
+    return diff < -6 ? 'sameElse' :
+            diff < -1 ? 'lastWeek' :
+            diff < 0 ? 'lastDay' :
+            diff < 1 ? 'sameDay' :
+            diff < 2 ? 'nextDay' :
+            diff < 7 ? 'nextWeek' : 'sameElse';
+}
+
+function calendar$1 (time, formats) {
+    // We want to compare the start of today, vs this.
+    // Getting start-of-today depends on whether we're local/utc/offset or not.
+    var now = time || createLocal(),
+        sod = cloneWithOffset(now, this).startOf('day'),
+        format = hooks.calendarFormat(this, sod) || 'sameElse';
+
+    var output = formats && (isFunction(formats[format]) ? formats[format].call(this, now) : formats[format]);
+
+    return this.format(output || this.localeData().calendar(format, this, createLocal(now)));
+}
+
+function clone () {
+    return new Moment(this);
+}
+
+function isAfter (input, units) {
+    var localInput = isMoment(input) ? input : createLocal(input);
+    if (!(this.isValid() && localInput.isValid())) {
+        return false;
+    }
+    units = normalizeUnits(!isUndefined(units) ? units : 'millisecond');
+    if (units === 'millisecond') {
+        return this.valueOf() > localInput.valueOf();
+    } else {
+        return localInput.valueOf() < this.clone().startOf(units).valueOf();
+    }
+}
+
+function isBefore (input, units) {
+    var localInput = isMoment(input) ? input : createLocal(input);
+    if (!(this.isValid() && localInput.isValid())) {
+        return false;
+    }
+    units = normalizeUnits(!isUndefined(units) ? units : 'millisecond');
+    if (units === 'millisecond') {
+        return this.valueOf() < localInput.valueOf();
+    } else {
+        return this.clone().endOf(units).valueOf() < localInput.valueOf();
+    }
+}
+
+function isBetween (from, to, units, inclusivity) {
+    inclusivity = inclusivity || '()';
+    return (inclusivity[0] === '(' ? this.isAfter(from, units) : !this.isBefore(from, units)) &&
+        (inclusivity[1] === ')' ? this.isBefore(to, units) : !this.isAfter(to, units));
+}
+
+function isSame (input, units) {
+    var localInput = isMoment(input) ? input : createLocal(input),
+        inputMs;
+    if (!(this.isValid() && localInput.isValid())) {
+        return false;
+    }
+    units = normalizeUnits(units || 'millisecond');
+    if (units === 'millisecond') {
+        return this.valueOf() === localInput.valueOf();
+    } else {
+        inputMs = localInput.valueOf();
+        return this.clone().startOf(units).valueOf() <= inputMs && inputMs <= this.clone().endOf(units).valueOf();
+    }
+}
+
+function isSameOrAfter (input, units) {
+    return this.isSame(input, units) || this.isAfter(input,units);
+}
+
+function isSameOrBefore (input, units) {
+    return this.isSame(input, units) || this.isBefore(input,units);
+}
+
+function diff (input, units, asFloat) {
+    var that,
+        zoneDelta,
+        delta, output;
+
+    if (!this.isValid()) {
+        return NaN;
+    }
+
+    that = cloneWithOffset(input, this);
+
+    if (!that.isValid()) {
+        return NaN;
+    }
+
+    zoneDelta = (that.utcOffset() - this.utcOffset()) * 6e4;
+
+    units = normalizeUnits(units);
+
+    switch (units) {
+        case 'year': output = monthDiff(this, that) / 12; break;
+        case 'month': output = monthDiff(this, that); break;
+        case 'quarter': output = monthDiff(this, that) / 3; break;
+        case 'second': output = (this - that) / 1e3; break; // 1000
+        case 'minute': output = (this - that) / 6e4; break; // 1000 * 60
+        case 'hour': output = (this - that) / 36e5; break; // 1000 * 60 * 60
+        case 'day': output = (this - that - zoneDelta) / 864e5; break; // 1000 * 60 * 60 * 24, negate dst
+        case 'week': output = (this - that - zoneDelta) / 6048e5; break; // 1000 * 60 * 60 * 24 * 7, negate dst
+        default: output = this - that;
+    }
+
+    return asFloat ? output : absFloor(output);
+}
+
+function monthDiff (a, b) {
+    // difference in months
+    var wholeMonthDiff = ((b.year() - a.year()) * 12) + (b.month() - a.month()),
+        // b is in (anchor - 1 month, anchor + 1 month)
+        anchor = a.clone().add(wholeMonthDiff, 'months'),
+        anchor2, adjust;
+
+    if (b - anchor < 0) {
+        anchor2 = a.clone().add(wholeMonthDiff - 1, 'months');
+        // linear across the month
+        adjust = (b - anchor) / (anchor - anchor2);
+    } else {
+        anchor2 = a.clone().add(wholeMonthDiff + 1, 'months');
+        // linear across the month
+        adjust = (b - anchor) / (anchor2 - anchor);
+    }
+
+    //check for negative zero, return zero if negative zero
+    return -(wholeMonthDiff + adjust) || 0;
+}
+
+hooks.defaultFormat = 'YYYY-MM-DDTHH:mm:ssZ';
+hooks.defaultFormatUtc = 'YYYY-MM-DDTHH:mm:ss[Z]';
+
+function toString () {
+    return this.clone().locale('en').format('ddd MMM DD YYYY HH:mm:ss [GMT]ZZ');
+}
+
+function toISOString(keepOffset) {
+    if (!this.isValid()) {
+        return null;
+    }
+    var utc = keepOffset !== true;
+    var m = utc ? this.clone().utc() : this;
+    if (m.year() < 0 || m.year() > 9999) {
+        return formatMoment(m, utc ? 'YYYYYY-MM-DD[T]HH:mm:ss.SSS[Z]' : 'YYYYYY-MM-DD[T]HH:mm:ss.SSSZ');
+    }
+    if (isFunction(Date.prototype.toISOString)) {
+        // native implementation is ~50x faster, use it when we can
+        if (utc) {
+            return this.toDate().toISOString();
+        } else {
+            return new Date(this._d.valueOf()).toISOString().replace('Z', formatMoment(m, 'Z'));
+        }
+    }
+    return formatMoment(m, utc ? 'YYYY-MM-DD[T]HH:mm:ss.SSS[Z]' : 'YYYY-MM-DD[T]HH:mm:ss.SSSZ');
+}
+
+/**
+ * Return a human readable representation of a moment that can
+ * also be evaluated to get a new moment which is the same
+ *
+ * @link https://nodejs.org/dist/latest/docs/api/util.html#util_custom_inspect_function_on_objects
+ */
+function inspect () {
+    if (!this.isValid()) {
+        return 'moment.invalid(/* ' + this._i + ' */)';
+    }
+    var func = 'moment';
+    var zone = '';
+    if (!this.isLocal()) {
+        func = this.utcOffset() === 0 ? 'moment.utc' : 'moment.parseZone';
+        zone = 'Z';
+    }
+    var prefix = '[' + func + '("]';
+    var year = (0 <= this.year() && this.year() <= 9999) ? 'YYYY' : 'YYYYYY';
+    var datetime = '-MM-DD[T]HH:mm:ss.SSS';
+    var suffix = zone + '[")]';
+
+    return this.format(prefix + year + datetime + suffix);
+}
+
+function format (inputString) {
+    if (!inputString) {
+        inputString = this.isUtc() ? hooks.defaultFormatUtc : hooks.defaultFormat;
+    }
+    var output = formatMoment(this, inputString);
+    return this.localeData().postformat(output);
+}
+
+function from (time, withoutSuffix) {
+    if (this.isValid() &&
+            ((isMoment(time) && time.isValid()) ||
+             createLocal(time).isValid())) {
+        return createDuration({to: this, from: time}).locale(this.locale()).humanize(!withoutSuffix);
+    } else {
+        return this.localeData().invalidDate();
+    }
+}
+
+function fromNow (withoutSuffix) {
+    return this.from(createLocal(), withoutSuffix);
+}
+
+function to (time, withoutSuffix) {
+    if (this.isValid() &&
+            ((isMoment(time) && time.isValid()) ||
+             createLocal(time).isValid())) {
+        return createDuration({from: this, to: time}).locale(this.locale()).humanize(!withoutSuffix);
+    } else {
+        return this.localeData().invalidDate();
+    }
+}
+
+function toNow (withoutSuffix) {
+    return this.to(createLocal(), withoutSuffix);
+}
+
+// If passed a locale key, it will set the locale for this
+// instance.  Otherwise, it will return the locale configuration
+// variables for this instance.
+function locale (key) {
+    var newLocaleData;
+
+    if (key === undefined) {
+        return this._locale._abbr;
+    } else {
+        newLocaleData = getLocale(key);
+        if (newLocaleData != null) {
+            this._locale = newLocaleData;
+        }
+        return this;
+    }
+}
+
+var lang = deprecate(
+    'moment().lang() is deprecated. Instead, use moment().localeData() to get the language configuration. Use moment().locale() to change languages.',
+    function (key) {
+        if (key === undefined) {
+            return this.localeData();
+        } else {
+            return this.locale(key);
+        }
+    }
+);
+
+function localeData () {
+    return this._locale;
+}
+
+function startOf (units) {
+    units = normalizeUnits(units);
+    // the following switch intentionally omits break keywords
+    // to utilize falling through the cases.
+    switch (units) {
+        case 'year':
+            this.month(0);
+            /* falls through */
+        case 'quarter':
+        case 'month':
+            this.date(1);
+            /* falls through */
+        case 'week':
+        case 'isoWeek':
+        case 'day':
+        case 'date':
+            this.hours(0);
+            /* falls through */
+        case 'hour':
+            this.minutes(0);
+            /* falls through */
+        case 'minute':
+            this.seconds(0);
+            /* falls through */
+        case 'second':
+            this.milliseconds(0);
+    }
+
+    // weeks are a special case
+    if (units === 'week') {
+        this.weekday(0);
+    }
+    if (units === 'isoWeek') {
+        this.isoWeekday(1);
+    }
+
+    // quarters are also special
+    if (units === 'quarter') {
+        this.month(Math.floor(this.month() / 3) * 3);
+    }
+
+    return this;
+}
+
+function endOf (units) {
+    units = normalizeUnits(units);
+    if (units === undefined || units === 'millisecond') {
+        return this;
+    }
+
+    // 'date' is an alias for 'day', so it should be considered as such.
+    if (units === 'date') {
+        units = 'day';
+    }
+
+    return this.startOf(units).add(1, (units === 'isoWeek' ? 'week' : units)).subtract(1, 'ms');
+}
+
+function valueOf () {
+    return this._d.valueOf() - ((this._offset || 0) * 60000);
+}
+
+function unix () {
+    return Math.floor(this.valueOf() / 1000);
+}
+
+function toDate () {
+    return new Date(this.valueOf());
+}
+
+function toArray () {
+    var m = this;
+    return [m.year(), m.month(), m.date(), m.hour(), m.minute(), m.second(), m.millisecond()];
+}
+
+function toObject () {
+    var m = this;
+    return {
+        years: m.year(),
+        months: m.month(),
+        date: m.date(),
+        hours: m.hours(),
+        minutes: m.minutes(),
+        seconds: m.seconds(),
+        milliseconds: m.milliseconds()
+    };
+}
+
+function toJSON () {
+    // new Date(NaN).toJSON() === null
+    return this.isValid() ? this.toISOString() : null;
+}
+
+function isValid$2 () {
+    return isValid(this);
+}
+
+function parsingFlags () {
+    return extend({}, getParsingFlags(this));
+}
+
+function invalidAt () {
+    return getParsingFlags(this).overflow;
+}
+
+function creationData() {
+    return {
+        input: this._i,
+        format: this._f,
+        locale: this._locale,
+        isUTC: this._isUTC,
+        strict: this._strict
+    };
+}
+
+// FORMATTING
+
+addFormatToken(0, ['gg', 2], 0, function () {
+    return this.weekYear() % 100;
+});
+
+addFormatToken(0, ['GG', 2], 0, function () {
+    return this.isoWeekYear() % 100;
+});
+
+function addWeekYearFormatToken (token, getter) {
+    addFormatToken(0, [token, token.length], 0, getter);
+}
+
+addWeekYearFormatToken('gggg',     'weekYear');
+addWeekYearFormatToken('ggggg',    'weekYear');
+addWeekYearFormatToken('GGGG',  'isoWeekYear');
+addWeekYearFormatToken('GGGGG', 'isoWeekYear');
+
+// ALIASES
+
+addUnitAlias('weekYear', 'gg');
+addUnitAlias('isoWeekYear', 'GG');
+
+// PRIORITY
+
+addUnitPriority('weekYear', 1);
+addUnitPriority('isoWeekYear', 1);
+
+
+// PARSING
+
+addRegexToken('G',      matchSigned);
+addRegexToken('g',      matchSigned);
+addRegexToken('GG',     match1to2, match2);
+addRegexToken('gg',     match1to2, match2);
+addRegexToken('GGGG',   match1to4, match4);
+addRegexToken('gggg',   match1to4, match4);
+addRegexToken('GGGGG',  match1to6, match6);
+addRegexToken('ggggg',  match1to6, match6);
+
+addWeekParseToken(['gggg', 'ggggg', 'GGGG', 'GGGGG'], function (input, week, config, token) {
+    week[token.substr(0, 2)] = toInt(input);
+});
+
+addWeekParseToken(['gg', 'GG'], function (input, week, config, token) {
+    week[token] = hooks.parseTwoDigitYear(input);
+});
+
+// MOMENTS
+
+function getSetWeekYear (input) {
+    return getSetWeekYearHelper.call(this,
+            input,
+            this.week(),
+            this.weekday(),
+            this.localeData()._week.dow,
+            this.localeData()._week.doy);
+}
+
+function getSetISOWeekYear (input) {
+    return getSetWeekYearHelper.call(this,
+            input, this.isoWeek(), this.isoWeekday(), 1, 4);
+}
+
+function getISOWeeksInYear () {
+    return weeksInYear(this.year(), 1, 4);
+}
+
+function getWeeksInYear () {
+    var weekInfo = this.localeData()._week;
+    return weeksInYear(this.year(), weekInfo.dow, weekInfo.doy);
+}
+
+function getSetWeekYearHelper(input, week, weekday, dow, doy) {
+    var weeksTarget;
+    if (input == null) {
+        return weekOfYear(this, dow, doy).year;
+    } else {
+        weeksTarget = weeksInYear(input, dow, doy);
+        if (week > weeksTarget) {
+            week = weeksTarget;
+        }
+        return setWeekAll.call(this, input, week, weekday, dow, doy);
+    }
+}
+
+function setWeekAll(weekYear, week, weekday, dow, doy) {
+    var dayOfYearData = dayOfYearFromWeeks(weekYear, week, weekday, dow, doy),
+        date = createUTCDate(dayOfYearData.year, 0, dayOfYearData.dayOfYear);
+
+    this.year(date.getUTCFullYear());
+    this.month(date.getUTCMonth());
+    this.date(date.getUTCDate());
+    return this;
+}
+
+// FORMATTING
+
+addFormatToken('Q', 0, 'Qo', 'quarter');
+
+// ALIASES
+
+addUnitAlias('quarter', 'Q');
+
+// PRIORITY
+
+addUnitPriority('quarter', 7);
+
+// PARSING
+
+addRegexToken('Q', match1);
+addParseToken('Q', function (input, array) {
+    array[MONTH] = (toInt(input) - 1) * 3;
+});
+
+// MOMENTS
+
+function getSetQuarter (input) {
+    return input == null ? Math.ceil((this.month() + 1) / 3) : this.month((input - 1) * 3 + this.month() % 3);
+}
+
+// FORMATTING
+
+addFormatToken('D', ['DD', 2], 'Do', 'date');
+
+// ALIASES
+
+addUnitAlias('date', 'D');
+
+// PRIOROITY
+addUnitPriority('date', 9);
+
+// PARSING
+
+addRegexToken('D',  match1to2);
+addRegexToken('DD', match1to2, match2);
+addRegexToken('Do', function (isStrict, locale) {
+    // TODO: Remove "ordinalParse" fallback in next major release.
+    return isStrict ?
+      (locale._dayOfMonthOrdinalParse || locale._ordinalParse) :
+      locale._dayOfMonthOrdinalParseLenient;
+});
+
+addParseToken(['D', 'DD'], DATE);
+addParseToken('Do', function (input, array) {
+    array[DATE] = toInt(input.match(match1to2)[0]);
+});
+
+// MOMENTS
+
+var getSetDayOfMonth = makeGetSet('Date', true);
+
+// FORMATTING
+
+addFormatToken('DDD', ['DDDD', 3], 'DDDo', 'dayOfYear');
+
+// ALIASES
+
+addUnitAlias('dayOfYear', 'DDD');
+
+// PRIORITY
+addUnitPriority('dayOfYear', 4);
+
+// PARSING
+
+addRegexToken('DDD',  match1to3);
+addRegexToken('DDDD', match3);
+addParseToken(['DDD', 'DDDD'], function (input, array, config) {
+    config._dayOfYear = toInt(input);
+});
+
+// HELPERS
+
+// MOMENTS
+
+function getSetDayOfYear (input) {
+    var dayOfYear = Math.round((this.clone().startOf('day') - this.clone().startOf('year')) / 864e5) + 1;
+    return input == null ? dayOfYear : this.add((input - dayOfYear), 'd');
+}
+
+// FORMATTING
+
+addFormatToken('m', ['mm', 2], 0, 'minute');
+
+// ALIASES
+
+addUnitAlias('minute', 'm');
+
+// PRIORITY
+
+addUnitPriority('minute', 14);
+
+// PARSING
+
+addRegexToken('m',  match1to2);
+addRegexToken('mm', match1to2, match2);
+addParseToken(['m', 'mm'], MINUTE);
+
+// MOMENTS
+
+var getSetMinute = makeGetSet('Minutes', false);
+
+// FORMATTING
+
+addFormatToken('s', ['ss', 2], 0, 'second');
+
+// ALIASES
+
+addUnitAlias('second', 's');
+
+// PRIORITY
+
+addUnitPriority('second', 15);
+
+// PARSING
+
+addRegexToken('s',  match1to2);
+addRegexToken('ss', match1to2, match2);
+addParseToken(['s', 'ss'], SECOND);
+
+// MOMENTS
+
+var getSetSecond = makeGetSet('Seconds', false);
+
+// FORMATTING
+
+addFormatToken('S', 0, 0, function () {
+    return ~~(this.millisecond() / 100);
+});
+
+addFormatToken(0, ['SS', 2], 0, function () {
+    return ~~(this.millisecond() / 10);
+});
+
+addFormatToken(0, ['SSS', 3], 0, 'millisecond');
+addFormatToken(0, ['SSSS', 4], 0, function () {
+    return this.millisecond() * 10;
+});
+addFormatToken(0, ['SSSSS', 5], 0, function () {
+    return this.millisecond() * 100;
+});
+addFormatToken(0, ['SSSSSS', 6], 0, function () {
+    return this.millisecond() * 1000;
+});
+addFormatToken(0, ['SSSSSSS', 7], 0, function () {
+    return this.millisecond() * 10000;
+});
+addFormatToken(0, ['SSSSSSSS', 8], 0, function () {
+    return this.millisecond() * 100000;
+});
+addFormatToken(0, ['SSSSSSSSS', 9], 0, function () {
+    return this.millisecond() * 1000000;
+});
+
+
+// ALIASES
+
+addUnitAlias('millisecond', 'ms');
+
+// PRIORITY
+
+addUnitPriority('millisecond', 16);
+
+// PARSING
+
+addRegexToken('S',    match1to3, match1);
+addRegexToken('SS',   match1to3, match2);
+addRegexToken('SSS',  match1to3, match3);
+
+var token;
+for (token = 'SSSS'; token.length <= 9; token += 'S') {
+    addRegexToken(token, matchUnsigned);
+}
+
+function parseMs(input, array) {
+    array[MILLISECOND] = toInt(('0.' + input) * 1000);
+}
+
+for (token = 'S'; token.length <= 9; token += 'S') {
+    addParseToken(token, parseMs);
+}
+// MOMENTS
+
+var getSetMillisecond = makeGetSet('Milliseconds', false);
+
+// FORMATTING
+
+addFormatToken('z',  0, 0, 'zoneAbbr');
+addFormatToken('zz', 0, 0, 'zoneName');
+
+// MOMENTS
+
+function getZoneAbbr () {
+    return this._isUTC ? 'UTC' : '';
+}
+
+function getZoneName () {
+    return this._isUTC ? 'Coordinated Universal Time' : '';
+}
+
+var proto = Moment.prototype;
+
+proto.add               = add;
+proto.calendar          = calendar$1;
+proto.clone             = clone;
+proto.diff              = diff;
+proto.endOf             = endOf;
+proto.format            = format;
+proto.from              = from;
+proto.fromNow           = fromNow;
+proto.to                = to;
+proto.toNow             = toNow;
+proto.get               = stringGet;
+proto.invalidAt         = invalidAt;
+proto.isAfter           = isAfter;
+proto.isBefore          = isBefore;
+proto.isBetween         = isBetween;
+proto.isSame            = isSame;
+proto.isSameOrAfter     = isSameOrAfter;
+proto.isSameOrBefore    = isSameOrBefore;
+proto.isValid           = isValid$2;
+proto.lang              = lang;
+proto.locale            = locale;
+proto.localeData        = localeData;
+proto.max               = prototypeMax;
+proto.min               = prototypeMin;
+proto.parsingFlags      = parsingFlags;
+proto.set               = stringSet;
+proto.startOf           = startOf;
+proto.subtract          = subtract;
+proto.toArray           = toArray;
+proto.toObject          = toObject;
+proto.toDate            = toDate;
+proto.toISOString       = toISOString;
+proto.inspect           = inspect;
+proto.toJSON            = toJSON;
+proto.toString          = toString;
+proto.unix              = unix;
+proto.valueOf           = valueOf;
+proto.creationData      = creationData;
+
+// Year
+proto.year       = getSetYear;
+proto.isLeapYear = getIsLeapYear;
+
+// Week Year
+proto.weekYear    = getSetWeekYear;
+proto.isoWeekYear = getSetISOWeekYear;
+
+// Quarter
+proto.quarter = proto.quarters = getSetQuarter;
+
+// Month
+proto.month       = getSetMonth;
+proto.daysInMonth = getDaysInMonth;
+
+// Week
+proto.week           = proto.weeks        = getSetWeek;
+proto.isoWeek        = proto.isoWeeks     = getSetISOWeek;
+proto.weeksInYear    = getWeeksInYear;
+proto.isoWeeksInYear = getISOWeeksInYear;
+
+// Day
+proto.date       = getSetDayOfMonth;
+proto.day        = proto.days             = getSetDayOfWeek;
+proto.weekday    = getSetLocaleDayOfWeek;
+proto.isoWeekday = getSetISODayOfWeek;
+proto.dayOfYear  = getSetDayOfYear;
+
+// Hour
+proto.hour = proto.hours = getSetHour;
+
+// Minute
+proto.minute = proto.minutes = getSetMinute;
+
+// Second
+proto.second = proto.seconds = getSetSecond;
+
+// Millisecond
+proto.millisecond = proto.milliseconds = getSetMillisecond;
+
+// Offset
+proto.utcOffset            = getSetOffset;
+proto.utc                  = setOffsetToUTC;
+proto.local                = setOffsetToLocal;
+proto.parseZone            = setOffsetToParsedOffset;
+proto.hasAlignedHourOffset = hasAlignedHourOffset;
+proto.isDST                = isDaylightSavingTime;
+proto.isLocal              = isLocal;
+proto.isUtcOffset          = isUtcOffset;
+proto.isUtc                = isUtc;
+proto.isUTC                = isUtc;
+
+// Timezone
+proto.zoneAbbr = getZoneAbbr;
+proto.zoneName = getZoneName;
+
+// Deprecations
+proto.dates  = deprecate('dates accessor is deprecated. Use date instead.', getSetDayOfMonth);
+proto.months = deprecate('months accessor is deprecated. Use month instead', getSetMonth);
+proto.years  = deprecate('years accessor is deprecated. Use year instead', getSetYear);
+proto.zone   = deprecate('moment().zone is deprecated, use moment().utcOffset instead. http://momentjs.com/guides/#/warnings/zone/', getSetZone);
+proto.isDSTShifted = deprecate('isDSTShifted is deprecated. See http://momentjs.com/guides/#/warnings/dst-shifted/ for more information', isDaylightSavingTimeShifted);
+
+function createUnix (input) {
+    return createLocal(input * 1000);
+}
+
+function createInZone () {
+    return createLocal.apply(null, arguments).parseZone();
+}
+
+function preParsePostFormat (string) {
+    return string;
+}
+
+var proto$1 = Locale.prototype;
+
+proto$1.calendar        = calendar;
+proto$1.longDateFormat  = longDateFormat;
+proto$1.invalidDate     = invalidDate;
+proto$1.ordinal         = ordinal;
+proto$1.preparse        = preParsePostFormat;
+proto$1.postformat      = preParsePostFormat;
+proto$1.relativeTime    = relativeTime;
+proto$1.pastFuture      = pastFuture;
+proto$1.set             = set;
+
+// Month
+proto$1.months            =        localeMonths;
+proto$1.monthsShort       =        localeMonthsShort;
+proto$1.monthsParse       =        localeMonthsParse;
+proto$1.monthsRegex       = monthsRegex;
+proto$1.monthsShortRegex  = monthsShortRegex;
+
+// Week
+proto$1.week = localeWeek;
+proto$1.firstDayOfYear = localeFirstDayOfYear;
+proto$1.firstDayOfWeek = localeFirstDayOfWeek;
+
+// Day of Week
+proto$1.weekdays       =        localeWeekdays;
+proto$1.weekdaysMin    =        localeWeekdaysMin;
+proto$1.weekdaysShort  =        localeWeekdaysShort;
+proto$1.weekdaysParse  =        localeWeekdaysParse;
+
+proto$1.weekdaysRegex       =        weekdaysRegex;
+proto$1.weekdaysShortRegex  =        weekdaysShortRegex;
+proto$1.weekdaysMinRegex    =        weekdaysMinRegex;
+
+// Hours
+proto$1.isPM = localeIsPM;
+proto$1.meridiem = localeMeridiem;
+
+function get$1 (format, index, field, setter) {
+    var locale = getLocale();
+    var utc = createUTC().set(setter, index);
+    return locale[field](utc, format);
+}
+
+function listMonthsImpl (format, index, field) {
+    if (isNumber(format)) {
+        index = format;
+        format = undefined;
+    }
+
+    format = format || '';
+
+    if (index != null) {
+        return get$1(format, index, field, 'month');
+    }
+
+    var i;
+    var out = [];
+    for (i = 0; i < 12; i++) {
+        out[i] = get$1(format, i, field, 'month');
+    }
+    return out;
+}
+
+// ()
+// (5)
+// (fmt, 5)
+// (fmt)
+// (true)
+// (true, 5)
+// (true, fmt, 5)
+// (true, fmt)
+function listWeekdaysImpl (localeSorted, format, index, field) {
+    if (typeof localeSorted === 'boolean') {
+        if (isNumber(format)) {
+            index = format;
+            format = undefined;
+        }
+
+        format = format || '';
+    } else {
+        format = localeSorted;
+        index = format;
+        localeSorted = false;
+
+        if (isNumber(format)) {
+            index = format;
+            format = undefined;
+        }
+
+        format = format || '';
+    }
+
+    var locale = getLocale(),
+        shift = localeSorted ? locale._week.dow : 0;
+
+    if (index != null) {
+        return get$1(format, (index + shift) % 7, field, 'day');
+    }
+
+    var i;
+    var out = [];
+    for (i = 0; i < 7; i++) {
+        out[i] = get$1(format, (i + shift) % 7, field, 'day');
+    }
+    return out;
+}
+
+function listMonths (format, index) {
+    return listMonthsImpl(format, index, 'months');
+}
+
+function listMonthsShort (format, index) {
+    return listMonthsImpl(format, index, 'monthsShort');
+}
+
+function listWeekdays (localeSorted, format, index) {
+    return listWeekdaysImpl(localeSorted, format, index, 'weekdays');
+}
+
+function listWeekdaysShort (localeSorted, format, index) {
+    return listWeekdaysImpl(localeSorted, format, index, 'weekdaysShort');
+}
+
+function listWeekdaysMin (localeSorted, format, index) {
+    return listWeekdaysImpl(localeSorted, format, index, 'weekdaysMin');
+}
+
+getSetGlobalLocale('en', {
+    dayOfMonthOrdinalParse: /\d{1,2}(th|st|nd|rd)/,
+    ordinal : function (number) {
+        var b = number % 10,
+            output = (toInt(number % 100 / 10) === 1) ? 'th' :
+            (b === 1) ? 'st' :
+            (b === 2) ? 'nd' :
+            (b === 3) ? 'rd' : 'th';
+        return number + output;
+    }
+});
+
+// Side effect imports
+hooks.lang = deprecate('moment.lang is deprecated. Use moment.locale instead.', getSetGlobalLocale);
+hooks.langData = deprecate('moment.langData is deprecated. Use moment.localeData instead.', getLocale);
+
+var mathAbs = Math.abs;
+
+function abs () {
+    var data           = this._data;
+
+    this._milliseconds = mathAbs(this._milliseconds);
+    this._days         = mathAbs(this._days);
+    this._months       = mathAbs(this._months);
+
+    data.milliseconds  = mathAbs(data.milliseconds);
+    data.seconds       = mathAbs(data.seconds);
+    data.minutes       = mathAbs(data.minutes);
+    data.hours         = mathAbs(data.hours);
+    data.months        = mathAbs(data.months);
+    data.years         = mathAbs(data.years);
+
+    return this;
+}
+
+function addSubtract$1 (duration, input, value, direction) {
+    var other = createDuration(input, value);
+
+    duration._milliseconds += direction * other._milliseconds;
+    duration._days         += direction * other._days;
+    duration._months       += direction * other._months;
+
+    return duration._bubble();
+}
+
+// supports only 2.0-style add(1, 's') or add(duration)
+function add$1 (input, value) {
+    return addSubtract$1(this, input, value, 1);
+}
+
+// supports only 2.0-style subtract(1, 's') or subtract(duration)
+function subtract$1 (input, value) {
+    return addSubtract$1(this, input, value, -1);
+}
+
+function absCeil (number) {
+    if (number < 0) {
+        return Math.floor(number);
+    } else {
+        return Math.ceil(number);
+    }
+}
+
+function bubble () {
+    var milliseconds = this._milliseconds;
+    var days         = this._days;
+    var months       = this._months;
+    var data         = this._data;
+    var seconds, minutes, hours, years, monthsFromDays;
+
+    // if we have a mix of positive and negative values, bubble down first
+    // check: https://github.com/moment/moment/issues/2166
+    if (!((milliseconds >= 0 && days >= 0 && months >= 0) ||
+            (milliseconds <= 0 && days <= 0 && months <= 0))) {
+        milliseconds += absCeil(monthsToDays(months) + days) * 864e5;
+        days = 0;
+        months = 0;
+    }
+
+    // The following code bubbles up values, see the tests for
+    // examples of what that means.
+    data.milliseconds = milliseconds % 1000;
+
+    seconds           = absFloor(milliseconds / 1000);
+    data.seconds      = seconds % 60;
+
+    minutes           = absFloor(seconds / 60);
+    data.minutes      = minutes % 60;
+
+    hours             = absFloor(minutes / 60);
+    data.hours        = hours % 24;
+
+    days += absFloor(hours / 24);
+
+    // convert days to months
+    monthsFromDays = absFloor(daysToMonths(days));
+    months += monthsFromDays;
+    days -= absCeil(monthsToDays(monthsFromDays));
+
+    // 12 months -> 1 year
+    years = absFloor(months / 12);
+    months %= 12;
+
+    data.days   = days;
+    data.months = months;
+    data.years  = years;
+
+    return this;
+}
+
+function daysToMonths (days) {
+    // 400 years have 146097 days (taking into account leap year rules)
+    // 400 years have 12 months === 4800
+    return days * 4800 / 146097;
+}
+
+function monthsToDays (months) {
+    // the reverse of daysToMonths
+    return months * 146097 / 4800;
+}
+
+function as (units) {
+    if (!this.isValid()) {
+        return NaN;
+    }
+    var days;
+    var months;
+    var milliseconds = this._milliseconds;
+
+    units = normalizeUnits(units);
+
+    if (units === 'month' || units === 'year') {
+        days   = this._days   + milliseconds / 864e5;
+        months = this._months + daysToMonths(days);
+        return units === 'month' ? months : months / 12;
+    } else {
+        // handle milliseconds separately because of floating point math errors (issue #1867)
+        days = this._days + Math.round(monthsToDays(this._months));
+        switch (units) {
+            case 'week'   : return days / 7     + milliseconds / 6048e5;
+            case 'day'    : return days         + milliseconds / 864e5;
+            case 'hour'   : return days * 24    + milliseconds / 36e5;
+            case 'minute' : return days * 1440  + milliseconds / 6e4;
+            case 'second' : return days * 86400 + milliseconds / 1000;
+            // Math.floor prevents floating point math errors here
+            case 'millisecond': return Math.floor(days * 864e5) + milliseconds;
+            default: throw new Error('Unknown unit ' + units);
+        }
+    }
+}
+
+// TODO: Use this.as('ms')?
+function valueOf$1 () {
+    if (!this.isValid()) {
+        return NaN;
+    }
+    return (
+        this._milliseconds +
+        this._days * 864e5 +
+        (this._months % 12) * 2592e6 +
+        toInt(this._months / 12) * 31536e6
+    );
+}
+
+function makeAs (alias) {
+    return function () {
+        return this.as(alias);
+    };
+}
+
+var asMilliseconds = makeAs('ms');
+var asSeconds      = makeAs('s');
+var asMinutes      = makeAs('m');
+var asHours        = makeAs('h');
+var asDays         = makeAs('d');
+var asWeeks        = makeAs('w');
+var asMonths       = makeAs('M');
+var asYears        = makeAs('y');
+
+function clone$1 () {
+    return createDuration(this);
+}
+
+function get$2 (units) {
+    units = normalizeUnits(units);
+    return this.isValid() ? this[units + 's']() : NaN;
+}
+
+function makeGetter(name) {
+    return function () {
+        return this.isValid() ? this._data[name] : NaN;
+    };
+}
+
+var milliseconds = makeGetter('milliseconds');
+var seconds      = makeGetter('seconds');
+var minutes      = makeGetter('minutes');
+var hours        = makeGetter('hours');
+var days         = makeGetter('days');
+var months       = makeGetter('months');
+var years        = makeGetter('years');
+
+function weeks () {
+    return absFloor(this.days() / 7);
+}
+
+var round = Math.round;
+var thresholds = {
+    ss: 44,         // a few seconds to seconds
+    s : 45,         // seconds to minute
+    m : 45,         // minutes to hour
+    h : 22,         // hours to day
+    d : 26,         // days to month
+    M : 11          // months to year
+};
+
+// helper function for moment.fn.from, moment.fn.fromNow, and moment.duration.fn.humanize
+function substituteTimeAgo(string, number, withoutSuffix, isFuture, locale) {
+    return locale.relativeTime(number || 1, !!withoutSuffix, string, isFuture);
+}
+
+function relativeTime$1 (posNegDuration, withoutSuffix, locale) {
+    var duration = createDuration(posNegDuration).abs();
+    var seconds  = round(duration.as('s'));
+    var minutes  = round(duration.as('m'));
+    var hours    = round(duration.as('h'));
+    var days     = round(duration.as('d'));
+    var months   = round(duration.as('M'));
+    var years    = round(duration.as('y'));
+
+    var a = seconds <= thresholds.ss && ['s', seconds]  ||
+            seconds < thresholds.s   && ['ss', seconds] ||
+            minutes <= 1             && ['m']           ||
+            minutes < thresholds.m   && ['mm', minutes] ||
+            hours   <= 1             && ['h']           ||
+            hours   < thresholds.h   && ['hh', hours]   ||
+            days    <= 1             && ['d']           ||
+            days    < thresholds.d   && ['dd', days]    ||
+            months  <= 1             && ['M']           ||
+            months  < thresholds.M   && ['MM', months]  ||
+            years   <= 1             && ['y']           || ['yy', years];
+
+    a[2] = withoutSuffix;
+    a[3] = +posNegDuration > 0;
+    a[4] = locale;
+    return substituteTimeAgo.apply(null, a);
+}
+
+// This function allows you to set the rounding function for relative time strings
+function getSetRelativeTimeRounding (roundingFunction) {
+    if (roundingFunction === undefined) {
+        return round;
+    }
+    if (typeof(roundingFunction) === 'function') {
+        round = roundingFunction;
+        return true;
+    }
+    return false;
+}
+
+// This function allows you to set a threshold for relative time strings
+function getSetRelativeTimeThreshold (threshold, limit) {
+    if (thresholds[threshold] === undefined) {
+        return false;
+    }
+    if (limit === undefined) {
+        return thresholds[threshold];
+    }
+    thresholds[threshold] = limit;
+    if (threshold === 's') {
+        thresholds.ss = limit - 1;
+    }
+    return true;
+}
+
+function humanize (withSuffix) {
+    if (!this.isValid()) {
+        return this.localeData().invalidDate();
+    }
+
+    var locale = this.localeData();
+    var output = relativeTime$1(this, !withSuffix, locale);
+
+    if (withSuffix) {
+        output = locale.pastFuture(+this, output);
+    }
+
+    return locale.postformat(output);
+}
+
+var abs$1 = Math.abs;
+
+function sign(x) {
+    return ((x > 0) - (x < 0)) || +x;
+}
+
+function toISOString$1() {
+    // for ISO strings we do not use the normal bubbling rules:
+    //  * milliseconds bubble up until they become hours
+    //  * days do not bubble at all
+    //  * months bubble up until they become years
+    // This is because there is no context-free conversion between hours and days
+    // (think of clock changes)
+    // and also not between days and months (28-31 days per month)
+    if (!this.isValid()) {
+        return this.localeData().invalidDate();
+    }
+
+    var seconds = abs$1(this._milliseconds) / 1000;
+    var days         = abs$1(this._days);
+    var months       = abs$1(this._months);
+    var minutes, hours, years;
+
+    // 3600 seconds -> 60 minutes -> 1 hour
+    minutes           = absFloor(seconds / 60);
+    hours             = absFloor(minutes / 60);
+    seconds %= 60;
+    minutes %= 60;
+
+    // 12 months -> 1 year
+    years  = absFloor(months / 12);
+    months %= 12;
+
+
+    // inspired by https://github.com/dordille/moment-isoduration/blob/master/moment.isoduration.js
+    var Y = years;
+    var M = months;
+    var D = days;
+    var h = hours;
+    var m = minutes;
+    var s = seconds ? seconds.toFixed(3).replace(/\.?0+$/, '') : '';
+    var total = this.asSeconds();
+
+    if (!total) {
+        // this is the same as C#'s (Noda) and python (isodate)...
+        // but not other JS (goog.date)
+        return 'P0D';
+    }
+
+    var totalSign = total < 0 ? '-' : '';
+    var ymSign = sign(this._months) !== sign(total) ? '-' : '';
+    var daysSign = sign(this._days) !== sign(total) ? '-' : '';
+    var hmsSign = sign(this._milliseconds) !== sign(total) ? '-' : '';
+
+    return totalSign + 'P' +
+        (Y ? ymSign + Y + 'Y' : '') +
+        (M ? ymSign + M + 'M' : '') +
+        (D ? daysSign + D + 'D' : '') +
+        ((h || m || s) ? 'T' : '') +
+        (h ? hmsSign + h + 'H' : '') +
+        (m ? hmsSign + m + 'M' : '') +
+        (s ? hmsSign + s + 'S' : '');
+}
+
+var proto$2 = Duration.prototype;
+
+proto$2.isValid        = isValid$1;
+proto$2.abs            = abs;
+proto$2.add            = add$1;
+proto$2.subtract       = subtract$1;
+proto$2.as             = as;
+proto$2.asMilliseconds = asMilliseconds;
+proto$2.asSeconds      = asSeconds;
+proto$2.asMinutes      = asMinutes;
+proto$2.asHours        = asHours;
+proto$2.asDays         = asDays;
+proto$2.asWeeks        = asWeeks;
+proto$2.asMonths       = asMonths;
+proto$2.asYears        = asYears;
+proto$2.valueOf        = valueOf$1;
+proto$2._bubble        = bubble;
+proto$2.clone          = clone$1;
+proto$2.get            = get$2;
+proto$2.milliseconds   = milliseconds;
+proto$2.seconds        = seconds;
+proto$2.minutes        = minutes;
+proto$2.hours          = hours;
+proto$2.days           = days;
+proto$2.weeks          = weeks;
+proto$2.months         = months;
+proto$2.years          = years;
+proto$2.humanize       = humanize;
+proto$2.toISOString    = toISOString$1;
+proto$2.toString       = toISOString$1;
+proto$2.toJSON         = toISOString$1;
+proto$2.locale         = locale;
+proto$2.localeData     = localeData;
+
+// Deprecations
+proto$2.toIsoString = deprecate('toIsoString() is deprecated. Please use toISOString() instead (notice the capitals)', toISOString$1);
+proto$2.lang = lang;
+
+// Side effect imports
+
+// FORMATTING
+
+addFormatToken('X', 0, 0, 'unix');
+addFormatToken('x', 0, 0, 'valueOf');
+
+// PARSING
+
+addRegexToken('x', matchSigned);
+addRegexToken('X', matchTimestamp);
+addParseToken('X', function (input, array, config) {
+    config._d = new Date(parseFloat(input, 10) * 1000);
+});
+addParseToken('x', function (input, array, config) {
+    config._d = new Date(toInt(input));
+});
+
+// Side effect imports
+
+
+hooks.version = '2.20.1';
+
+setHookCallback(createLocal);
+
+hooks.fn                    = proto;
+hooks.min                   = min;
+hooks.max                   = max;
+hooks.now                   = now;
+hooks.utc                   = createUTC;
+hooks.unix                  = createUnix;
+hooks.months                = listMonths;
+hooks.isDate                = isDate;
+hooks.locale                = getSetGlobalLocale;
+hooks.invalid               = createInvalid;
+hooks.duration              = createDuration;
+hooks.isMoment              = isMoment;
+hooks.weekdays              = listWeekdays;
+hooks.parseZone             = createInZone;
+hooks.localeData            = getLocale;
+hooks.isDuration            = isDuration;
+hooks.monthsShort           = listMonthsShort;
+hooks.weekdaysMin           = listWeekdaysMin;
+hooks.defineLocale          = defineLocale;
+hooks.updateLocale          = updateLocale;
+hooks.locales               = listLocales;
+hooks.weekdaysShort         = listWeekdaysShort;
+hooks.normalizeUnits        = normalizeUnits;
+hooks.relativeTimeRounding  = getSetRelativeTimeRounding;
+hooks.relativeTimeThreshold = getSetRelativeTimeThreshold;
+hooks.calendarFormat        = getCalendarFormat;
+hooks.prototype             = proto;
+
+// currently HTML5 input type only supports 24-hour formats
+hooks.HTML5_FMT = {
+    DATETIME_LOCAL: 'YYYY-MM-DDTHH:mm',             // <input type="datetime-local" />
+    DATETIME_LOCAL_SECONDS: 'YYYY-MM-DDTHH:mm:ss',  // <input type="datetime-local" step="1" />
+    DATETIME_LOCAL_MS: 'YYYY-MM-DDTHH:mm:ss.SSS',   // <input type="datetime-local" step="0.001" />
+    DATE: 'YYYY-MM-DD',                             // <input type="date" />
+    TIME: 'HH:mm',                                  // <input type="time" />
+    TIME_SECONDS: 'HH:mm:ss',                       // <input type="time" step="1" />
+    TIME_MS: 'HH:mm:ss.SSS',                        // <input type="time" step="0.001" />
+    WEEK: 'YYYY-[W]WW',                             // <input type="week" />
+    MONTH: 'YYYY-MM'                                // <input type="month" />
+};
+
+return hooks;
+
+})));
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/parasails.js b/ee/bulk-operations-dashboard/assets/dependencies/parasails.js
new file mode 100644
index 000000000000..be2d801bdbc3
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/parasails.js
@@ -0,0 +1,1221 @@
+/**
+ * parasails.js
+ * (lightweight structures for apps with more than one page)
+ *
+ * v0.9.3
+ *
+ * Copyright 2014-present, Mike McNeil (@mikermcneil)
+ * MIT License
+ *
+ * - https://sailsjs.com/about
+ * - https://sailsjs.com/support
+ * - https://www.npmjs.com/package/parasails
+ *
+ * > Parasails is a tiny (but opinionated) and pipeline-agnostic wrapper
+ * > around Vue.js and Lodash, with optional participation from jQuery, bowser,
+ * > and VueRouter.
+ */
+(function(factory, exposeUMD){
+  exposeUMD(this, factory);
+})(function (Vue, _, VueRouter, $, bowser){
+
+  //  ██████╗ ██████╗ ██╗██╗   ██╗ █████╗ ████████╗███████╗
+  //  ██╔══██╗██╔══██╗██║██║   ██║██╔══██╗╚══██╔══╝██╔════╝
+  //  ██████╔╝██████╔╝██║██║   ██║███████║   ██║   █████╗
+  //  ██╔═══╝ ██╔══██╗██║╚██╗ ██╔╝██╔══██║   ██║   ██╔══╝
+  //  ██║     ██║  ██║██║ ╚████╔╝ ██║  ██║   ██║   ███████╗
+  //  ╚═╝     ╚═╝  ╚═╝╚═╝  ╚═══╝  ╚═╝  ╚═╝   ╚═╝   ╚══════╝
+  //
+  //  ███████╗████████╗ █████╗ ████████╗███████╗
+  //  ██╔════╝╚══██╔══╝██╔══██╗╚══██╔══╝██╔════╝
+  //  ███████╗   ██║   ███████║   ██║   █████╗
+  //  ╚════██║   ██║   ██╔══██║   ██║   ██╔══╝
+  //  ███████║   ██║   ██║  ██║   ██║   ███████╗
+  //  ╚══════╝   ╚═╝   ╚═╝  ╚═╝   ╚═╝   ╚══════╝
+  //
+
+  /**
+   * Module state
+   */
+
+  // Keep track of whether or not a page script has already been loaded in the DOM.
+  var didAlreadyLoadPageScript;
+
+  // The variable we'll be exporting.
+  var parasails;
+
+
+  //  ██████╗ ██████╗ ██╗██╗   ██╗ █████╗ ████████╗███████╗
+  //  ██╔══██╗██╔══██╗██║██║   ██║██╔══██╗╚══██╔══╝██╔════╝
+  //  ██████╔╝██████╔╝██║██║   ██║███████║   ██║   █████╗
+  //  ██╔═══╝ ██╔══██╗██║╚██╗ ██╔╝██╔══██║   ██║   ██╔══╝
+  //  ██║     ██║  ██║██║ ╚████╔╝ ██║  ██║   ██║   ███████╗
+  //  ╚═╝     ╚═╝  ╚═╝╚═╝  ╚═══╝  ╚═╝  ╚═╝   ╚═╝   ╚══════╝
+  //
+  //  ██╗   ██╗████████╗██╗██╗     ███████╗
+  //  ██║   ██║╚══██╔══╝██║██║     ██╔════╝
+  //  ██║   ██║   ██║   ██║██║     ███████╗
+  //  ██║   ██║   ██║   ██║██║     ╚════██║
+  //  ╚██████╔╝   ██║   ██║███████╗███████║
+  //   ╚═════╝    ╚═╝   ╚═╝╚══════╝╚══════╝
+  //
+
+  /**
+   * Module utilities (private)
+   */
+
+  function _ensureGlobalCache(){
+    parasails._cache = parasails._cache || {};
+  }
+
+  function _exportOnGlobalCache(moduleName, moduleDefinition){
+    _ensureGlobalCache();
+    if (parasails._cache[moduleName]) { throw new Error('Something else (e.g. a utility or constant) has already been registered under that name (`'+moduleName+'`)'); }
+    parasails._cache[moduleName] = moduleDefinition;
+  }
+
+  function _exposeBonusMethods(def, currentModuleEntityNoun){
+    if (!currentModuleEntityNoun) { throw new Error('Consistency violation: Bad internal usage. '); }
+    if (def.methods && def.methods.$get) { throw new Error('This '+currentModuleEntityNoun+' contains `methods` with a `$get` key, but you\'re not allowed to override that'); }
+    if (def.methods && def.methods.$find) { throw new Error('This '+currentModuleEntityNoun+' contains `methods` with a `$find` key, but you\'re not allowed to override that'); }
+    if (def.methods && def.methods.$focus) { throw new Error('This '+currentModuleEntityNoun+' contains `methods` with a `$focus` key, but you\'re not allowed to override that'); }
+    if (def.methods && def.methods.forceRender) { throw new Error('This '+currentModuleEntityNoun+' contains `methods` with a `forceRender` key, but you\'re not allowed to override that'); }
+    if (def.methods && def.methods.$forceRender) { throw new Error('This '+currentModuleEntityNoun+' contains `methods` with a `$forceRender` key, but that\'s too confusing to let stand (did you mean "forceRender"?  Besides, that method cannot be overridden anyway)'); }
+    def.methods = def.methods || {};
+
+    // Attach misc. methods:
+    def.methods.forceRender = function (){
+      this.$forceUpdate();
+      var promise = this.$nextTick();
+      return promise;
+    };//ƒ
+
+
+    // Attach jQuery-powered methods:
+    if ($) {
+      def.methods.$get = function (){
+        var $rootEl = $(this.$el);
+        if ($rootEl.length !== 1) { throw new Error('Cannot use .$get() - something is wrong with this '+currentModuleEntityNoun+'\'s top-level DOM element.  (It probably has not mounted yet!)'); }
+        return $rootEl;
+      };
+      def.methods.$find = function (subSelector){
+        if (!subSelector) { throw new Error('Cannot use .$find() because no sub-selector was provided.\nExample usage:\n    var $emailFields = this.$find(\'[name="emailAddress"]\');'); }
+        var $rootEl = $(this.$el);
+        if ($rootEl.length !== 1) { throw new Error('Cannot use .$find() - something is wrong with this '+currentModuleEntityNoun+'\'s top-level DOM element.  (It probably has not mounted yet!)'); }
+        return $rootEl.find(subSelector);
+      };
+      def.methods.$focus = function (subSelector){
+        if (!subSelector) { throw new Error('Cannot use .$focus() because no sub-selector was provided.\nExample usage:\n    this.$focus(\'[name="emailAddress"]\');'); }
+        var $rootEl = $(this.$el);
+        if ($rootEl.length !== 1) { throw new Error('Cannot use .$focus() - something is wrong with this '+currentModuleEntityNoun+'\'s top-level DOM element.  (It probably has not mounted yet!)'); }
+        var $fieldToAutoFocus = $rootEl.find(subSelector);
+        if ($fieldToAutoFocus.length === 0) { throw new Error('Could not autofocus-- no such element exists within this '+currentModuleEntityNoun+'.'); }
+        // FUTURE: ^^ if that happens, try calling await this.forceRender() and then try again one more time before giving up
+        if ($fieldToAutoFocus.length > 1) { throw new Error('Could not autofocus `'+subSelector+'`-- too many elements matched!'); }
+        $fieldToAutoFocus.focus();
+      };
+    }
+    else {
+      def.methods.$get = function (){ throw new Error('Cannot use .$get() method because, at the time when this '+currentModuleEntityNoun+' was registered, jQuery (`$`) did not exist on the page yet.  (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure jQuery is getting brought in before `parasails`.)'); };
+      def.methods.$find = function (){ throw new Error('Cannot use .$find() method because, at the time when this '+currentModuleEntityNoun+' was registered, jQuery (`$`) did not exist on the page yet.  (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure jQuery is getting brought in before `parasails`.)'); };
+      def.methods.$focus = function (){ throw new Error('Cannot use .$focus() method because, at the time when this '+currentModuleEntityNoun+' was registered, jQuery (`$`) did not exist on the page yet.  (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure jQuery is getting brought in before `parasails`.)'); };
+    }
+  }
+
+  function _wrapMethodsAndVerifyNoArrowFunctions(def, currentModuleEntityNoun){
+    if (!currentModuleEntityNoun) { throw new Error('Consistency violation: Bad internal usage. '); }
+
+    // Preliminary sanity check:
+    // Make sure top-level def doesn't have anything sketchy like "beforeMounted"
+    // or "beforeDestroyed", because those definitely aren't real things.
+    var RECOMMENDATIONS_BY_UNRECOGNIZED_KEY = {
+      beforeMounted: 'beforeMount',
+      beforeMounting: 'beforeMount',
+      beforeDestroyed: 'beforeDestroy',
+      beforeDestroying: 'beforeDestroy',
+      events: 'methods',
+      functions: 'methods',
+      state: 'data',
+      virtualPageRegExp: 'virtualPagesRegExp',
+      virtualPageRegEx: 'virtualPagesRegExp',
+      virtualPagesRegEx: 'virtualPagesRegExp',
+      virtualPage: 'virtualPages',
+      html5History: 'html5HistoryMode',
+      historyMode: 'html5HistoryMode',
+    };
+    // > Note that this determination of whether to show a more precise
+    // > "Did you mean?" error message is a case-_insensitive_ check.
+    var lowercasedRecommendationsByKey = _.reduce(RECOMMENDATIONS_BY_UNRECOGNIZED_KEY, function(memo, correctAlias, incorrectKey){
+      memo[incorrectKey.toLowerCase()] = correctAlias;
+      return memo;
+    }, {});
+    _.each(def, function (x, propertyName) {
+      if (x !== undefined) {
+        if (_.contains(_.keys(RECOMMENDATIONS_BY_UNRECOGNIZED_KEY), propertyName) || _.contains(_.keys(lowercasedRecommendationsByKey), propertyName.toLowerCase())) {
+          throw new Error('Detected unrecognized and potentially confusing key "'+propertyName+'" on the top level of '+currentModuleEntityNoun+' definition.  Did you mean "'+lowercasedRecommendationsByKey[propertyName.toLowerCase()]+'"?');
+        }
+      }
+    });//∞
+
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    // FUTURE: Maybe verify that neither beforeMount nor beforeDestroy are
+    // `async function`s.  (These must be synchronous!  And it's easy to forget.)
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+    // In fact, in some cases, we'll go so far as to fail if we see any other
+    // unrecognized top-level keys too:
+    // > This is particularly useful for catching loose top-level properties
+    // > that were intended to be within `data` or `methods`, etc.)
+    if (currentModuleEntityNoun === 'page script' || currentModuleEntityNoun === 'component') {
+      // FUTURE: don't allow page script only things on components
+
+      var LEGAL_TOP_LVL_KEYS = [
+        // Everyday page script stuff:
+        'beforeMount',
+        'mounted',
+        'data',
+        'methods',
+
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // FUTURE: Add `this.listen()` and `this.ignore()` -- see:
+        // https://github.com/mikermcneil/parasails/commit/5b948a1a8a0945b19ccea6da3e7354255d3dc0b6
+        // (and also 83c439dc1f3a0375e67066fffe9151581cbab639)
+        //
+        // Or better yet, just use a declarative approach instead and let
+        // binding/unbinding happen behind the scenes.  e.g.:
+        // ```
+        // cloudEvents: {
+        //   pet: (msg)=>{…},
+        //   user: (msg)=>{…},
+        //   organization: {
+        //     destroyed: (msg)=>{…},
+        //     updated: (msg)=>{…},
+        //     bankWireReceived: (msg)=>{…},
+        //     error: (msg)=>{…}
+        //   },
+        //   circus: {
+        //     admissionPaymentReceived: (msg)=>{…}
+        //   }
+        // }
+        // ```
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+        // Extra component stuff:
+        'props',
+        'template',
+        'beforeDestroy',
+
+        // Client-side router stuff:
+        'router',
+        'virtualPages',
+        'html5HistoryMode',
+        'beforeNavigate',
+        'afterNavigate',
+        'virtualPagesRegExp',
+
+        // Misc. & relatively more uncommon Vue.js stuff
+        'watch',
+        'computed',
+        'propsData',
+        'components',
+        'filters',
+        'directives',
+        'el',
+        'render',
+        'renderError',
+        'comments',
+        'inheritAttrs',
+        'model',
+        'functional',
+        'delimiters',
+        'name',
+        'beforeCreate',
+        'created',
+        'beforeUpdate',
+        'updated',
+        'activated',
+        'deactivated',
+        'destroyed',
+        'errorCaptured',
+        'parent',
+        'mixins',
+        'extends',
+        'provide',
+        'inject'
+      ];
+      // FUTURE: change this to a case-insensitive check to do a better job helping
+      // out a user who is trying to use e.g. "beforemount", without a capital "M"
+      _.each(_.difference(_.keys(def), LEGAL_TOP_LVL_KEYS), function (propertyName) {
+        if (def[propertyName] !== undefined) {
+          throw new Error('Detected unrecognized key "'+propertyName+'" on the top level of '+currentModuleEntityNoun+' definition.  Did you perhaps intend for `'+propertyName+'` to be included as a nested key within `data` or `methods`?  Please check on that and try again.  If you\'re unsure, or you\'re deliberately attempting to use a Vue.js feature that relies on having a top-level property named `'+propertyName+'`, then please remove this check from the parasails.js library in your project, or drop by https://sailsjs.com/support for assistance.');
+        }
+      });//∞
+    }//fi
+
+    // Mix in overridable default filters
+    def.filters = def.filters || {};
+    if (!def.filters.currency) {
+      // FUTURE: mix in our go-to currency filter
+    }//fi
+    if (!def.filters.round) {
+      /**
+       * Usage:
+       * - `{{someValue | round}}`
+       * - `{{someValue | round(1)}}`
+       * - `{{someValue | round(2)}}`
+       * - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+       * @param  {Ref} value
+       * @param  {Number} accuracy
+       * @param  {Boolean} chopTrailingZeros
+       * @return {String}
+       * - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+       * > The following is a modified version of:
+       * > vue-round-filter@1.1.2
+       * > c. 2016, Damian Martyniak (ISC License)
+       * > https://github.com/rascada/vue-round-filter/blob/6529a384758b67ed54884b77e03dd73cc3dda215/index.js
+       * > Originally updated for explicitness, to ensure Vue ≥2.x compatibility,
+       * > and to change default usage to always preserve decimal accuracy.  It
+       * > could likely wind up with additional updates over time.
+       * > All edits are MIT licensed. Copyright (c) Mike McNeil, 2018-present
+       */
+      def.filters.round = function (value, accuracy, chopTrailingZeros) {
+        if (typeof value !== 'number') {
+          return ('' + value);
+        }//•
+        var result = value.toFixed(accuracy);
+        if (chopTrailingZeros) {
+          // (don't keep decimal accuracy, just chop off those trailing zeros)
+          return ('' + (+result));
+        } else {
+          // (keep decimal accuracy)
+          return ('' + result);
+        }
+      };//ƒ
+    }//fi
+
+    // Wrap and verify methods:
+    def.methods = def.methods || {};
+    _.each(_.keys(def.methods), function (methodName) {
+      if (!_.isFunction(def.methods[methodName])) {
+        throw new Error('Unexpected definition for Vue method `'+methodName+'`.  Expecting a function, but got "'+def.methods[methodName]+'"');
+      }
+
+      var isArrowFunction;
+      try {
+        var asString = def.methods[methodName].toString();
+        isArrowFunction = asString.match(/^\s*\(\s*/) || asString.match(/^\s*async\s*\(\s*/);
+      } catch (err) {
+        console.warn('Consistency violation: Encountered unexpected error when attempting to verify that Vue method `'+methodName+'` is not an arrow function.  (What browser is this?!)  Anyway, error details:', err);
+      }
+
+      if (isArrowFunction) {
+        throw new Error('Unexpected definition for Vue method `'+methodName+'`.  Vue methods cannot be specified as arrow functions, because then you wouldn\'t have access to `this` (i.e. the Vue vm instance).  Please use a function like `function(){…}` or `async function(){…}` instead.');
+      }
+
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+      // FUTURE:
+      // Inject a wrapper function in order to provide more advanced / cleaner error handling.
+      // (especially for AsyncFunctions)
+      // ```
+      // var _originalMethod = def.methods[methodName];
+      // def.methods[methodName] = function(){
+      //
+      //   var rawResult;
+      //   var originalCtx = this;
+      //   (function(proceed){
+      //     if (_originalMethod.constructor.name === 'AsyncFunction') {
+      //       rawResult = _originalMethod.apply(originalCtx, arguments);
+      //       // The result of an AsyncFunction is always a promise:
+      //       rawResult.catch(function(err) {
+      //         proceed(err);
+      //       });//_∏_
+      //       rawResult.then(function(actualResult){
+      //         return proceed(undefined, actualResult);
+      //       });
+      //     }
+      //     else {
+      //       try {
+      //         rawResult = _originalMethod.apply(originalCtx, arguments);
+      //       } catch (err) { return proceed(err); }
+      //       return proceed(undefined, rawResult);
+      //     }
+      //   })(function(err, actualResult){//eslint-disable-line no-unused-vars
+      //     if (err) {
+      //       // FUTURE: perform more advanced error handling here
+      //       throw err;
+      //     }
+      //
+      //     // Otherwise do nothing.
+      //
+      //   });//_∏_  (†)
+      //
+      //   // For compatibility, return the raw result.
+      //   return rawResult;
+      //
+      // };//ƒ
+      // ```
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+
+    });//∞
+  }
+
+
+  //   ██████╗ ██╗      ██████╗ ██████╗  █████╗ ██╗         ███████╗██╗   ██╗███████╗███╗   ██╗████████╗███████╗
+  //  ██╔════╝ ██║     ██╔═══██╗██╔══██╗██╔══██╗██║         ██╔════╝██║   ██║██╔════╝████╗  ██║╚══██╔══╝██╔════╝
+  //  ██║  ███╗██║     ██║   ██║██████╔╝███████║██║         █████╗  ██║   ██║█████╗  ██╔██╗ ██║   ██║   ███████╗
+  //  ██║   ██║██║     ██║   ██║██╔══██╗██╔══██║██║         ██╔══╝  ╚██╗ ██╔╝██╔══╝  ██║╚██╗██║   ██║   ╚════██║
+  //  ╚██████╔╝███████╗╚██████╔╝██████╔╝██║  ██║███████╗    ███████╗ ╚████╔╝ ███████╗██║ ╚████║   ██║   ███████║
+  //   ╚═════╝ ╚══════╝ ╚═════╝ ╚═════╝ ╚═╝  ╚═╝╚══════╝    ╚══════╝  ╚═══╝  ╚══════╝╚═╝  ╚═══╝   ╚═╝   ╚══════╝
+  //
+
+  ///////////////////////////////////////////////////////////////////////////////////////////
+  // Capture uncaught errors (and trigger a fatal error if appropriate)
+  //
+  // A global error handler, "catcher of the uncaught", first of its name, and
+  // bane to bugs.  This (normally-invisible) gutter lurks at the bottom of the
+  // screen, but then springs to life if any uncaught errors are detected.
+  //
+  // > Out of the box, this behavior is deactivated any time Sails is running in
+  // > in the "production" environment (`sails.config.environment !== 'production')
+  // > (e.g. your local development machine, your staging server).  In order to do
+  // > this, it checks `SAILS_LOCALS._environment`, a special variable set by the
+  // > boilerplate "custom" hook (included in all Sails apps using the "Web App"
+  // > template).  Note that this behavior is also disabled if `window.SAILS_LOCALS`
+  // > is not set (e.g. any pages where "exposeLocalsToBrowser" is not in use).
+  // > Finally, this behavior is also disabled if jQuery is not available.
+  //
+  // ---------------------------------------------------------------------------------------
+  // In the off change your app is using a tool like Bugsnag/Sentry/Rollbars in
+  // environments OTHER THAN PRODUCTION, and you'd like to disable this behavior,
+  // the following section of code can simply be removed.
+  // ---------------------------------------------------------------------------------------
+  ///////////////////////////////////////////////////////////////////////////////////////////
+  if ($ && typeof window !== 'undefined' && window.SAILS_LOCALS && window.SAILS_LOCALS._environment !== 'production') {
+
+    var _displayErrorOverlay = function(errorSummary){
+
+      if ($('#parasails-error-handler').length === 0) {
+        // Very first error:
+        $('<div id="parasails-error-handler">'+
+          '<div role="error-handler-content">'+
+            '<h1>Whoops</h1>'+
+            '<p>'+
+              '<span role="summary">An unexpected client-side error occurred.</span><br/>'+
+              '<pre>'+_.escape(_.trunc(errorSummary, {length: 350}))+'</pre>'+
+              '<span>Please check your browser\'s JavaScript console for further details.</span><br/>'+
+              '<small>This message will not be displayed in production.  '+
+              'If you\'re unsure, <a href="https://sailsjs.com/support">ask for help</a>.</small><br/>'+
+              '<small>'+_.escape(new Date())+'</small>'+
+            '</p>'+
+          '</div>'+
+        '</div>')
+        .css({
+          position: 'fixed',
+          bottom: '0',
+          height: '100%',
+          width: '100%',
+          'z-index': '9000',
+          display: 'table',
+          'background': 'radial-gradient(circle, rgba(0,0,0,0.98) 0%, rgba(35,8,8,0.87) 80%, rgba(20,5,5,0.85) 100%)',
+          // (Thanks cssgradient.io!)
+        })
+        .appendTo('body');
+
+        $('#parasails-error-handler [role="error-handler-content"]').css({
+          display: 'table-cell',
+          'vertical-align': 'middle',
+          'text-align': 'center'
+        });
+
+        $('#parasails-error-handler [role="error-handler-content"] *').css({
+          'font-family': '\'Consolas\', \'Courier\', \'courier\', serif',
+          color: 'white'
+        });
+
+        $('#parasails-error-handler [role="error-handler-content"] small').css({
+          color: '#cccccc'
+        });
+
+        $('#parasails-error-handler [role="error-handler-content"] pre').css({
+          color: '#ff5555',
+          display: 'block',
+          'background': '#112f1f',
+          'white-space': 'pre-wrap',
+          'padding': '10px',
+          'margin-left': 'auto',
+          'margin-right': 'auto',
+          'max-width': '500px',
+          'min-width': '280px',
+          'font-size': '11px'
+        });
+
+        $('#parasails-error-handler [role="error-handler-content"] a').css({
+          'text-decoration': 'underline',
+          color: '#cccccc'
+        });
+
+      } else {
+        // Subsequent errors:
+        $('#parasails-error-handler [role="summary"]')
+        .text('Multiple unexpected client-side errors occurred.');
+      }
+
+      // Returning `true` would suppress the actual uncaught error from
+      // showing up in the JavaScript console. But we don't want to play
+      // with fire for now.  Just getting access to this is enough.
+      // We allow the error to continue to be uncaught.
+      return false;
+    };//ƒ
+
+    // Bind top-level error handler on the window.
+    //
+    // This NEVER prevents the error from continuing to be uncaught- it's just here
+    // to ensure that if any JS errors occur, we notice them immediately, even if we
+    // don't have Chrome dev tools open.
+    //
+    // For more info about `window.onerror`, see:
+    // https://developer.mozilla.org/en-US/docs/Web/API/GlobalEventHandlers/onerror
+    var originalWindowOnError = window.onerror;
+    window.onerror = function(message, scriptSrc, lineNo, charNo, err) {
+      _displayErrorOverlay(err&&err.message? err.message : message);
+      if (_.isFunction(originalWindowOnError)) {
+        return originalWindowOnError(message, scriptSrc, lineNo, charNo, err);
+      }
+    };//œ   </ on uncaught error >
+
+    // Bind top-level uncaught promise rejection handler.
+    // > https://developer.mozilla.org/en-US/docs/Web/Events/unhandledrejection
+    // (Only works in desktop Chrome as of Oct 2018, but over time, this will
+    // hopefully get better.  In the mean time, doesn't hurt anything, and it's
+    // only for development anyway.)
+    window.addEventListener('unhandledrejection', function (event) {
+      _displayErrorOverlay(event&&event.reason? event.reason : event);
+    });//œ  </ on unhandled promise rejection >
+
+    // Configure Vue to share its beforeMount errors (and others) with us.
+    // > https://vuejs.org/v2/api/#errorHandler
+    Vue.config.errorHandler = function (err, unusedVm, errorSourceDisplayName) {
+      if (err && err.message) {
+        if (errorSourceDisplayName === 'render function') {
+          err.message = 'In the HTML template (during render): '+err.message;
+        } else {
+          err.message = 'In '+errorSourceDisplayName+': '+err.message;
+        }
+      } else {
+        var _originalNotActuallyErr = err;
+        err = new Error(_originalNotActuallyErr);
+        err.raw = _originalNotActuallyErr;
+      }
+      console.error(err);
+      _displayErrorOverlay(err);
+    };//ƒ
+
+    // Also those Vue warnings -- but we'll treat them like errors because
+    // we're serious about code quality.  (Plus, early detection of bugs
+    // and typos saves so much time down the road!)
+    // > `trace` is the component hierarchy trace
+    Vue.config.warnHandler = function (msg, unusedVm, unusedTrace) {
+      throw new Error(
+        msg + '\n\n'+
+        'Expand this error and check out the stack trace for more info.'
+      );
+    };//ƒ
+
+  }//fi
+
+  //  ███████╗██╗  ██╗██████╗  ██████╗ ██████╗ ████████╗███████╗
+  //  ██╔════╝╚██╗██╔╝██╔══██╗██╔═══██╗██╔══██╗╚══██╔══╝██╔════╝
+  //  █████╗   ╚███╔╝ ██████╔╝██║   ██║██████╔╝   ██║   ███████╗
+  //  ██╔══╝   ██╔██╗ ██╔═══╝ ██║   ██║██╔══██╗   ██║   ╚════██║
+  //  ███████╗██╔╝ ██╗██║     ╚██████╔╝██║  ██║   ██║   ███████║
+  //  ╚══════╝╚═╝  ╚═╝╚═╝      ╚═════╝ ╚═╝  ╚═╝   ╚═╝   ╚══════╝
+  //
+
+  /**
+   * Module exports
+   */
+
+  parasails = {};
+
+
+  /**
+   * parasails.util
+   *
+   * Direct references to all registered utility methods from userland.
+   *
+   * @type {Dictionary}
+   */
+
+  parasails.util = {};
+
+
+  /**
+   * registerUtility()
+   *
+   * Build a callable utility function, then attach it to the global namespace
+   * so that it can be accessed later via `.require()`.
+   *
+   * @param {String} utilityName
+   * @param {Function} def
+   */
+
+  parasails.registerUtility = function(utilityName, def){
+
+    // Usage
+    if (!utilityName) { throw new Error('1st argument (utility name) is required'); }
+    if (!def) { throw new Error('2nd argument (utility function definition) is required'); }
+    if (!_.isFunction(def)) { throw new Error('2nd argument (utility function definition) should be a function'); }
+
+    // Build callable utility
+    var callableUtility = def;
+    callableUtility.name = utilityName;
+
+    // Attach to global cache
+    _exportOnGlobalCache(utilityName, callableUtility);
+
+    // Also expose on `parasails.util`
+    parasails.util[utilityName] = callableUtility;
+
+  };
+
+
+  /**
+   * registerConstant()
+   *
+   * Attach a constant to the global namespace so that it can be accessed
+   * later via `.require()`.
+   *
+   * @param {String} constantName
+   * @param {Ref} value
+   */
+
+  parasails.registerConstant = function(constantName, value){
+
+    // Usage
+    if (!constantName) { throw new Error('1st argument (constant name) is required'); }
+    if (value === undefined) { throw new Error('2nd argument (the constant value) is required'); }
+
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    // FUTURE: deep-freeze constant, if supported
+    // (https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze)
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+    // Attach to global cache
+    _exportOnGlobalCache(constantName, value);
+
+  };
+
+
+
+  /**
+   * registerComponent()
+   *
+   * Define a Vue component.
+   *
+   * @param {String} componentName   [In camelCase]
+   * @param {Dictionary} def
+   *
+   * @returns {Ref}  [new vue component for this page]
+   */
+
+  parasails.registerComponent = function(componentName, def){
+
+    // Expose extra methods on component def, if jQuery is available.
+    _exposeBonusMethods(def, 'component');
+
+    // Make sure none of the specified Vue methods are defined with any naughty arrow functions.
+    _wrapMethodsAndVerifyNoArrowFunctions(def, 'component');
+
+    // Wrap the `mounted` LC in order to decorate the top-level element with
+    // a sniffable marker that can be unambiguously styled via a global selector
+    // in the corresponding stylesheet for the component.
+    var customMountedLC;
+    if (def.mounted) {
+      customMountedLC = def.mounted;
+    }//fi
+    def.mounted = function(){
+
+      // Attach `parasails-component="…"` DOM attribute to allow for painless
+      // selecting from an optional, corresponding per-component stylesheet.
+      this.$el.setAttribute('parasails-component', _.kebabCase(componentName));
+
+      // Then call the original, custom "mounted" function, if there was one.
+      if (customMountedLC) {
+        customMountedLC.apply(this, []);
+      }
+    };//ƒ
+
+    // Attach `goto` method, for convenience.
+    if (def.methods && def.methods.goto) { throw new Error('Component definition contains `methods` with a `goto` key-- but you\'re not allowed to override that'); }
+    if (def.methods && def.methods.gotoAndReplaceHistory) { throw new Error('Component definition contains `methods` with a `gotoAndReplaceHistory` key-- but you\'re not allowed to override that'); }
+    def.methods = def.methods || {};
+    def.methods.goto = function (rootRelativeUrl){
+      // If the Bowser browser detection library is installed
+      // (https://github.com/lancedikson/bowser/releases), check whether
+      // we're in Edge or IE, in which case we'll add some special handling
+      // for an edge case in `onbeforeunload` behavior.
+      var isIEOrEdgeBrowser = bowser && (bowser.name === 'Internet Explorer' || bowser.name === 'Microsoft Edge');
+      if(!isIEOrEdgeBrowser) {
+        window.location = rootRelativeUrl;
+      } else {
+        try {
+          // IE/Edge prefers "window.location.href"
+          window.location.href = rootRelativeUrl;
+        } catch(unusedErr) {
+          // More helpful error message for unavoidable error during onbeforeunload edge case in IE/Edge
+          throw new Error('`goto` failed in Edge or IE! If navigation was cancelled in `beforeunload`, you can probably ignore this message (see https://stackoverflow.com/questions/1509643/unknown-exception-when-cancelling-page-unload-with-location-href/1510074#1510074).');
+        }
+      }
+    };
+    def.methods.gotoAndReplaceHistory = function (rootRelativeUrl){
+      window.location.replace(rootRelativeUrl);
+    };
+
+    // Finally, register as a global Vue component.
+    Vue.component(componentName, def);
+
+  };
+
+
+  /**
+   * require()
+   *
+   * Require a utility function or constant from the global namespace.
+   *
+   * @param {String} moduleName
+   * @returns {Ref}  [e.g. the callable utility function, or the value of the constant]
+   * @throws {Error} if no such module has been registered
+   */
+
+  parasails.require = function(moduleName) {
+
+    // Usage
+    if (!moduleName) { throw new Error('1st argument (module name -- i.e. the name of a utility or constant) is required'); }
+
+    // Fetch from global cache
+    _ensureGlobalCache();
+    if (parasails._cache[moduleName] === undefined) {
+      var err = new Error('No utility or constant is registered under that name (`'+moduleName+'`)');
+      err.name = 'RequireError';
+      err.code = 'MODULE_NOT_FOUND';
+      throw err;
+    }
+    return parasails._cache[moduleName];
+
+  };
+
+
+  /**
+   * registerPage()
+   *
+   * Define a page script, if applicable for the current contents of the DOM.
+   *
+   * @param {String} pageName
+   * @param {Dictionary} def
+   *
+   * @returns {Ref}  [new vue app thing for this page]
+   */
+
+  parasails.registerPage = function(pageName, def){
+
+    // Usage
+    if (!pageName) { throw new Error('1st argument (page name) is required'); }
+    if (!def) { throw new Error('2nd argument (page script definition) is required'); }
+
+    // Don't look for a matching DOM element (by "id") within anything that has `parasails-has-no-page-script`
+    // FUTURE: Move this check a bit further below, probably without defining the variable, and just add another avast (aka early return)
+    var isWithinIgnoredElements;
+    if ($) {
+      // Note that, luckily, this works even without waiting for the DOM to be ready according to jQuery.  (i.e. $(()=>{ … }))
+      isWithinIgnoredElements = (
+        $('#'+pageName).parents().filter('[parasails-has-no-page-script]')
+      ).length >= 1;
+    } else {
+      // For simplicity, this check is skipped if jQuery is not available.
+      // FUTURE: Implement with vanilla JS here
+      isWithinIgnoredElements = false;
+    }
+
+    // Only actually build+load this page script if it is relevant for the current contents of the DOM.
+    if (!window.document.getElementById(pageName) || isWithinIgnoredElements) { return; }
+
+    // Spinlock
+    if (didAlreadyLoadPageScript) { throw new Error('Cannot load page script (`'+pageName+') because a page script has already been loaded on this page.'); }
+    didAlreadyLoadPageScript = true;
+
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    // FUTURE: Maybe set `parasails._mountedPage = pageName;` and use that in the `goto` method of components to still
+    // do the check for a virtualPageRegExp and allow it to conditionaly do a "soft" client-side navigation to avoid page
+    // reload. (Remember: There's only ever one registered page script mounted in the DOM when you're using parasails.)
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+    // Automatically set `el`
+    if (def.el) { throw new Error('Page script definition contains `el`, but you\'re not allowed to override that'); }
+    def.el = '#'+pageName;
+
+    // Expose extra methods, if jQuery is available.
+    _exposeBonusMethods(def, 'page script');
+
+    // Make sure none of the specified Vue methods are defined with any naughty arrow functions.
+    _wrapMethodsAndVerifyNoArrowFunctions(def, 'page script');
+
+    // If bowser and jQuery are both around, sniff the user agent and determine
+    // some additional information about the user agent device accessing the DOM.
+    var bowserSniffClasses = '';
+    var SNIFFER_CSS_CLASS_PREFIX = 'detected-';
+    if (bowser && $) {
+
+      if (bowser.tablet||bowser.mobile) {
+        bowserSniffClasses += ' '+SNIFFER_CSS_CLASS_PREFIX+'mobile';
+        // ^^Note: "detected-mobile" means ANY mobile OS/device (handset or tablet)
+        //  [?] https://github.com/lancedikson/bowser/tree/6bbdaf99f0b36cf3a7b8a14feb0aa60d86d7e0dd#device-flags
+        if (bowser.ios) {
+          bowserSniffClasses += ' '+SNIFFER_CSS_CLASS_PREFIX+'ios';
+        } else if (bowser.android) {
+          bowserSniffClasses += ' '+SNIFFER_CSS_CLASS_PREFIX+'android';
+        } else if (bowser.windowsphone) {
+          bowserSniffClasses += ' '+SNIFFER_CSS_CLASS_PREFIX+'windowsphone';
+        }
+
+        if (bowser.tablet) {
+          bowserSniffClasses += ' '+SNIFFER_CSS_CLASS_PREFIX+'tablet';
+        } else if (bowser.mobile) {
+          bowserSniffClasses += ' '+SNIFFER_CSS_CLASS_PREFIX+'handset';
+        }
+      }
+      else {
+        // Otherwise we're not on a mobile OS/browser/device.
+        // But we can at least get a bit more intell on what's up:
+        if (bowser.mac) {
+          bowserSniffClasses += ' '+SNIFFER_CSS_CLASS_PREFIX+'mac';
+        } else if (bowser.windows) {
+          bowserSniffClasses += ' '+SNIFFER_CSS_CLASS_PREFIX+'windows';
+        } else if (bowser.linux) {
+          bowserSniffClasses += ' '+SNIFFER_CSS_CLASS_PREFIX+'linux';
+        }
+      }
+    }//fi
+
+    // If we have jQuery available, then as soon as the DOM is ready, and if
+    // appropriate based on browser device sniffing, attach special classes to
+    // the <body> element.
+    if ($ && bowserSniffClasses) {
+      $(function(){
+        $('body').addClass(bowserSniffClasses);
+      });//_∏_
+    }//fi
+
+    // Wrap the `mounted` LC:
+    var customMountedLC;
+    if (def.mounted) {
+      customMountedLC = def.mounted;
+    }//fi
+    def.mounted = function(){
+
+      // Similar to above, attach special classes to the page script's top-level
+      // DOM element, now that it has been mounted (again, only if appropriate
+      // based on browser device sniffing, and only if jQuery is available.)
+      if ($ && bowserSniffClasses) {
+        this.$get().addClass(bowserSniffClasses);
+      }//fi
+
+      // Then call the original, custom "mounted" function, if there was one.
+      if (customMountedLC) {
+        customMountedLC.apply(this, []);
+        // ^FUTURE: consider whether it's worth dealing with the possibility
+        // of uncaught promise rejections here (b/c it might be an `async function`!)
+      }
+    };//ƒ
+
+    // Now, for convenience, automatically add built-in defaults to our `data`:
+    if (def.data && def.data.pageName) { throw new Error('Page script definition contains `data` with a `pageName` key, but you\'re not allowed to override that'); }
+    def.data = _.extend({
+      pageName: pageName,
+      _: _,
+    }, def.data||{});
+    if (bowser && !def.data.hasOwnProperty('bowser')) {
+      def.data.bowser = bowser;
+    }
+
+    // And, as of Parasails ≥0.9, automatically merge in the contents of SAILS_LOCALS, if present.
+    // > (this is so that you don't have to include boilerplate code inside beforeMount of page scripts
+    // > to merge in data from the server)
+    if (typeof window !== 'undefined' && _.isObject(window.SAILS_LOCALS) && !_.isArray(window.SAILS_LOCALS) && !_.isFunction(window.SAILS_LOCALS)) {
+      _.extend(def.data, window.SAILS_LOCALS);
+    }
+
+    // Attach `goto` method, for convenience.
+    if (def.methods && def.methods.goto) { throw new Error('Page script definition contains `methods` with a `goto` key-- but you\'re not allowed to override that'); }
+    if (def.methods && def.methods.gotoAndReplaceHistory) { throw new Error('Page script definition contains `methods` with a `gotoAndReplaceHistory` key-- but you\'re not allowed to override that'); }
+    def.methods = def.methods || {};
+    if (VueRouter) {
+      var _virtualPagesRegExp = def.virtualPagesRegExp;
+
+      // The following inline function definition exists purely to avoid
+      // duplication of code in `goto` and `gotoAndReplaceHistory` below:
+      var _goto = function($router, rootRelativeUrlOrOpts, replaceHistory) {
+        // FUTURE: add support for using '../' without reloading the page
+        // (even though it doesn't technicaly match the regexp)
+        if (!_virtualPagesRegExp || (_.isString(rootRelativeUrlOrOpts) && !rootRelativeUrlOrOpts.match(_virtualPagesRegExp))) {
+          if (replaceHistory) {
+            window.location.replace(rootRelativeUrlOrOpts);
+          } else {
+            window.location = rootRelativeUrlOrOpts;
+          }
+        } else {
+          if (replaceHistory) {
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            // FUTURE: also look into something like this for cleaner handling
+            // of back/forward navigation for things like permalinked modals:
+            // • https://stackoverflow.com/a/29227026/486547
+            //
+            // gotoAndReplaceHistory() works great for handling client-side
+            // redirects within an afterNavigate function, but it doesn't work
+            // great for removing stuff from the history stack.  Because that's
+            // impossible, tbh.  So to truly solve that, you need a much more
+            // opinionated solution (see above link & treeline2 for examples).
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            return $router.replace(rootRelativeUrlOrOpts);
+          } else {
+            return $router.push(rootRelativeUrlOrOpts);
+          }
+        }
+      };//ƒ
+      def.methods.goto = function (rootRelativeUrlOrOpts){
+        return _goto(this.$router, rootRelativeUrlOrOpts);
+      };//ƒ
+      def.methods.gotoAndReplaceHistory = function (rootRelativeUrlOrOpts){
+        return _goto(this.$router, rootRelativeUrlOrOpts, true);
+      };//ƒ
+    }
+    else {
+      def.methods.goto = function (){ throw new Error('Cannot use .goto() method because, at the time when this page script was registered, VueRouter did not exist on the page yet. (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure VueRouter is getting brought in before `parasails`.)'); };
+      def.methods.gotoAndReplaceHistory = function (){ throw new Error('Cannot use .gotoAndReplaceHistory() method because, at the time when this page script was registered, VueRouter did not exist on the page yet. (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure VueRouter is getting brought in before `parasails`.)'); };
+    }
+
+    // If virtualPages-related stuff was specified, check usage and tolerate shorthand.
+    if (def.virtualPages === undefined) {
+      if (def.virtualPagesRegExp) {
+        def.virtualPages = true;
+      }
+    } else if (_.isObject(def.virtualPages) && !_.isArray(def.virtualPages) && !_.isFunction(def.virtualPages)) {
+      throw new Error('This usage of `virtualPages` (as a dictionary) is no longer supported.  Instead, please use `virtualPages: true`.  [?] https://sailsjs.com/support');
+      // (^^ old implementation removed in https://github.com/mikermcneil/parasails/commit/20af5992097de788b58ae2cb517675f235798879)
+    } else if (!_.isBoolean(def.virtualPages)) {
+      throw new Error('Cannot use `virtualPages` because the specified value doesn\'t match any recognized meaning.  Please specify either `true` (for the default handling) or a dictionary of client-side routing rules.');
+    }//fi
+    if (def.virtualPages && def.router) { throw new Error('Cannot specify both `virtualPages` AND an actual Vue `router`!  Use one or the other.'); }
+    if (def.router && !VueRouter) { throw new Error('Cannot use `router`, because that depends on the Vue Router.  But `VueRouter` does not exist on the page yet.  (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure the VueRouter plugin is getting brought in before `parasails`.)'); }
+    if (!def.virtualPages && def.html5HistoryMode !== undefined) { throw new Error('Cannot specify `html5HistoryMode` without also specifying `virtualPages`!'); }
+    if (!def.virtualPages && def.beforeEach !== undefined) { throw new Error('Cannot specify `beforeEach` without also specifying `virtualPages`!'); }
+    if ((def.beforeNavigate || def.afterNavigate) && def.virtualPages !== true) { throw new Error('Cannot specify `beforeNavigate` or `afterNavigate` unless you set `virtualPages: true`!'); }
+
+    // If `virtualPages: true` was specified, then use reasonable defaults:
+    //
+    // > Note: This assumes that, somewhere within the parent page's template, there is:
+    // > ```
+    // > <router-view></router-view>
+    // > ```
+    if (def.virtualPages === true) {
+      if (!VueRouter) { throw new Error('Cannot use `virtualPages`, because it depends on the Vue Router.  But `VueRouter` does not exist on the page yet.  (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure the VueRouter plugin is getting brought in before `parasails`.)'); }
+      if (def.beforeEach !== undefined) { throw new Error('Cannot specify `virtualPages: true` AND `beforeEach` at the same time!'); }
+      if (!def.virtualPagesRegExp && def.html5HistoryMode === 'history') { throw new Error('If `html5HistoryMode: \'history\'` is specified, then virtualPagesRegExp must also be specified!'); }
+      if (def.virtualPagesRegExp && !_.isRegExp(def.virtualPagesRegExp)) { throw new Error('Invalid `virtualPagesRegExp`: If specified, this must be a regular expression -- e.g. `/^\/manage\/access\/?([^\/]+)?/`'); }
+      if (def.html5HistoryMode === undefined) {
+        if (def.virtualPagesRegExp) {
+          def.html5HistoryMode = 'history';
+        } else {
+          def.html5HistoryMode = 'hash';
+        }
+      } else if (def.html5HistoryMode !== 'history' && def.html5HistoryMode !== 'hash') { throw new Error('Invalid `html5HistoryMode`: If specified, this must be either "history" or "hash".'); }
+
+      // Check for <router-view> element
+      // (to provide a better error msg if it was omitted)
+      var customBeforeMountLC;
+      if (def.beforeMount) {
+        customBeforeMountLC = def.beforeMount;
+      }//fi
+      def.beforeMount = function(){
+
+        // Inject additional code to check for <router-view> element:
+        // console.log('this.$find(\'router-view\').length', this.$find('router-view').length);
+        if (this.$find('router-view').length === 0) {
+          throw new Error(
+            'Cannot mount this page with `virtualPages: true` because no '+
+            '<router-view> element exists in this page\'s HTML.\n'+
+            'Please be sure the HTML includes:\n'+
+            '\n'+
+            '```\n'+
+            '<router-view></router-view>\n'+
+            '```\n'
+          );
+        }//•
+
+        // Then call the original, custom "beforeMount" function, if there was one.
+        if (customBeforeMountLC) {
+          customBeforeMountLC.apply(this, []);
+        }
+      };//ƒ
+
+      if (def.methods._handleVirtualNavigation) {
+        throw new Error('Could not use `virtualPages: true`, because a conflicting `_handleVirtualNavigation` method is defined.  Please remove it, or do something else.');
+      }
+
+      // Set up local variables to refer to things in `def`, since it will be changing below.
+      var pathMatchingRegExp;
+      if (def.html5HistoryMode === 'history') {
+        pathMatchingRegExp = def.virtualPagesRegExp;
+      } else {
+        pathMatchingRegExp = /.*/;
+      }
+
+      var beforeNavigate = def.beforeNavigate;
+      var afterNavigate = def.afterNavigate;
+
+      // Now modify the definition's methods and remove all relevant top-level props understood
+      // by parasails (but not by Vue.js) to avoid creating any weird additional dependence on
+      // parasails features beyond the expected usage.
+      def.methods = _.extend(def.methods||{}, {
+        _handleVirtualNavigation: function(virtualPageSlug){
+
+          if (beforeNavigate) {
+            var resultFromBeforeNavigate = beforeNavigate.apply(this, [ virtualPageSlug ]);
+            if (resultFromBeforeNavigate === false) {
+              return false;
+            }//•
+          }
+
+          this.virtualPageSlug = virtualPageSlug;
+
+          // console.log('navigate!  Got:', arguments);
+          // console.log('Navigated. (Set `this.virtualPageSlug=\''+virtualPageSlug+'\'`)');
+
+          if (afterNavigate) {
+            afterNavigate.apply(this, [ virtualPageSlug ]);
+          }
+
+        }
+      });
+
+      // Automatically attach `virtualPageSlug` to `data`, for convenience.
+      if (def.data && def.data.virtualPageSlug !== undefined && !_.isString(def.data.virtualPageSlug)) {
+        throw new Error('Page script definition contains `data` with a `virtualPageSlug` key, but you\'re not allowed to set that yourself unless you use a string.  (And this is set to a non-string value: '+def.data.virtualPageSlug+')');
+      } else if (def.data && def.data.virtualPageSlug === undefined) {
+        def.data = _.extend({
+          virtualPageSlug: undefined
+        }, def.data||{});
+      }//fi
+
+      // Now we'll replace `virtualPages` in our def with the thing that VueRouter actually expects:
+      def = _.extend({
+        router: new VueRouter({
+          mode: def.html5HistoryMode,
+          routes: [
+            {
+              path: '*',
+              component: (function(){
+                var vueComponentDef = {
+                  render: function(){},
+                  beforeRouteUpdate: function (to,from,next){
+                    // this.$emit('navigate', to.path); <<old way
+                    var path = to.path;
+                    var matches = path.match(pathMatchingRegExp);
+                    if (!matches) {
+                      var err =new Error('Could not match current URL path (`'+path+'`) as a virtual page.  Please check the `virtualPagesRegExp` -- e.g. `/^\/foo\/bar\/?([^\/]+)?/`');
+                      err.code = 'E_DID_NOT_MATCH_REGEXP';
+                      throw err;
+                    }//•
+
+                    // console.log('this.$parent', this.$parent);
+                    this.$parent._handleVirtualNavigation(matches[1]||'');
+                    // this.$emit('navigate', {
+                    //   rawPath: path,
+                    //   virtualPageSlug: matches[1]||''
+                    // });
+                    return next();
+                  },
+                  mounted: function(){
+                    // this.$emit('navigate', this.$route.path); <<old way
+                    var path = this.$route.path;
+                    var matches = path.match(pathMatchingRegExp);
+                    if (!matches) {
+                      var err =new Error('Could not match current URL path (`'+path+'`) as a virtual page.  Please check the `virtualPagesRegExp` -- e.g. `/^\/foo\/bar\/?([^\/]+)?/`');
+                      err.code = 'E_DID_NOT_MATCH_REGEXP';
+                      throw err;
+                    }//•
+
+                    this.$parent._handleVirtualNavigation(matches[1]||'');
+                    // this.$emit('navigate', {
+                    //   rawPath: path,
+                    //   virtualPageSlug: matches[1]||''
+                    // });
+                  }
+                };
+                // Expose extra methods on virtual page script, if jQuery is available.
+                _exposeBonusMethods(vueComponentDef, 'virtual page');
+
+                // Make sure none of the specified Vue methods are defined with any naughty arrow functions.
+                _wrapMethodsAndVerifyNoArrowFunctions(vueComponentDef, 'virtual page');
+
+                return vueComponentDef;
+              })()
+            }
+          ],
+        })
+      }, _.omit(def, ['virtualPages', 'virtualPagesRegExp', 'html5HistoryMode', 'beforeNavigate', 'afterNavigate']));
+    }//fi  </ def has `virtualPages` enabled >
+
+    // Construct Vue instance for this page script.
+    var vm = new Vue(def);
+
+    return vm;
+
+  };//ƒ
+
+
+
+  /**
+   * parasails.util.isMobile()
+   *
+   * Detect whether this is being accessed from a mobile browser/OS, which might
+   * be a handset device (iPhone, etc.) OR a tablet device (iPad, etc.)
+   *
+   * > This relies on `bowser.mobile||bowser.tablet`.
+   *
+   * @returns {Boolean}
+   */
+  parasails.util.isMobile = function(){
+
+    // If `bowser` is not available, throw an error.
+    if(!bowser) {
+      throw new Error('Cannot detect mobile-ness, because `bowser` global does not exist on the page yet. '+
+        '(If you\'re using Sails, please check dependency loading order in pipeline.js and make sure '+
+        'the Bowser library is getting brought in before `parasails`. If you have not included Bowser '+
+        'in your project, you can find it at https://github.com/lancedikson/bowser/releases)');
+    }
+
+    return (!!bowser.mobile) || (!!bowser.tablet);
+
+  };//ƒ
+  // An extra alias, for convenience:
+  parasails.isMobile = parasails.util.isMobile;
+
+
+  /**
+   * parasails.util.isValidEmailAddress()
+   *
+   * Determine whether the given value is a valid email address.
+   *
+   * > This code is taken directly from validator.js / anchor.
+   * > It is implemented as a built-in, organic utility that may be overwritten
+   * > in userland if desired.
+   *
+   * @param {String} value
+   *
+   * @returns {Boolean}
+   */
+
+  parasails.util.isValidEmailAddress = function(value){
+    if (!value || typeof value !== 'string') { return false; }
+    /* eslint-disable */
+    return (function(){function _isByteLength(str,min,max){var len=encodeURI(str).split(/%..|./).length-1;return len>=min&&(typeof max==='undefined'||len<=max)}
+    var emailUserUtf8Part=/^[a-z\d!#\$%&'\*\+\-\/=\?\^_`{\|}~\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]+$/i;var quotedEmailUserUtf8=/^([\s\x01-\x08\x0b\x0c\x0e-\x1f\x7f\x21\x23-\x5b\x5d-\x7e\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]|(\\[\x01-\x09\x0b\x0c\x0d-\x7f\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]))*$/i;function _isFQDN(str){var options={require_tld:!0,allow_underscores:!1,allow_trailing_dot:!1};if(options.allow_trailing_dot&&str[str.length-1]==='.'){str=str.substring(0,str.length-1)}
+    var parts=str.split('.');if(options.require_tld){var tld=parts.pop();if(!parts.length||!/^([a-z\u00a1-\uffff]{2,}|xn[a-z0-9-]{2,})$/i.test(tld)){return!1}}
+    for(var part,i=0;i<parts.length;i++){part=parts[i];if(options.allow_underscores){if(part.indexOf('__')>=0){return!1}
+    part=part.replace(/_/g,'')}
+    if(!/^[a-z\u00a1-\uffff0-9-]+$/i.test(part)){return!1}
+    if(/[\uff01-\uff5e]/.test(part)){return!1}
+    if(part[0]==='-'||part[part.length-1]==='-'||part.indexOf('---')>=0){return!1}}
+    return!0};return function(str){var parts=str.split('@'),domain=parts.pop(),user=parts.join('@');var lower_domain=domain.toLowerCase();if(lower_domain==='gmail.com'||lower_domain==='googlemail.com'){user=user.replace(/\./g,'').toLowerCase()}
+    if(!_isByteLength(user,0,64)||!_isByteLength(domain,0,256)){return!1}
+    if(!_isFQDN(domain)){return!1}
+    if(user[0]==='"'){user=user.slice(1,user.length-1);return quotedEmailUserUtf8.test(user)}
+    var pattern=emailUserUtf8Part;var user_parts=user.split('.');for(var i=0;i<user_parts.length;i++){if(!pattern.test(user_parts[i])){return!1}}
+    return!0}})()(value);
+    /* eslint-enable */
+  };//ƒ
+
+
+  /**
+   * parasails.utils
+   *
+   * A permanent alias for `parasails.util`.
+   *
+   * (Everyone gets these mixed up.)
+   *
+   * @type {:Dictionary}
+   */
+
+  parasails.utils = parasails.util;
+
+
+
+  return parasails;
+
+}, function (global, factory) {
+  var Vue;
+  var _;
+  var VueRouter;
+  var $;
+  var bowser;
+
+  //˙°˚°·.
+  //‡CJS  ˚°˚°·˛
+  if (typeof exports === 'object' && typeof module !== 'undefined') {
+    var _require = require;// eslint-disable-line no-undef
+    var _module = module;// eslint-disable-line no-undef
+    // required deps:
+    Vue = _require('vue');
+    _ = _require('lodash');
+    // optional deps:
+    try { VueRouter = _require('vue-router'); } catch (e) { if (e.code === 'MODULE_NOT_FOUND') {/* ok */} else { throw e; } }
+    try { $ = _require('jquery'); } catch (e) { if (e.code === 'MODULE_NOT_FOUND') {/* ok */} else { throw e; } }
+    try { bowser = _require('bowser'); } catch (e) { if (e.code === 'MODULE_NOT_FOUND') {/* ok */} else { throw e; } }
+    // export:
+    _module.exports = factory(Vue, _, VueRouter, $, bowser);
+  }
+  //˙°˚°·
+  //‡AMD ˚¸
+  else if(typeof define === 'function' && define.amd) {// eslint-disable-line no-undef
+    // Register as an anonymous module.
+    define([], function () {// eslint-disable-line no-undef
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+      // FUTURE: maybe use optional dep. loading here instead?
+      // e.g.  `function('vue', 'lodash', 'vue-router', 'jquery')`
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+      // required deps:
+      if (!global.Vue) { throw new Error('`Vue` global does not exist on the page yet. (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure the Vue.js library is getting brought in before `parasails`.)'); }
+      Vue = global.Vue;
+      if (!global._) { throw new Error('`_` global does not exist on the page yet. (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure the Lodash library is getting brought in before `parasails`.)'); }
+      _ = global._;
+      // optional deps:
+      VueRouter = global.VueRouter || undefined;
+      $ = global.$ || global.jQuery || undefined;
+      bowser = global.bowser || undefined;
+
+      // So... there's not really a huge point to supporting AMD here--
+      // except that if you're using it in your project, it makes this
+      // module fit nicely with the others you're using.  And if you
+      // really hate globals, I guess there's that.
+      // ¯\_(ツ)_/¯
+      return factory(Vue, _, VueRouter, $, bowser);
+    });//ƒ
+  }
+  //˙°˚˙°·
+  //‡NUDE ˚°·˛
+  else {
+    // required deps:
+    if (!global.Vue) { throw new Error('`Vue` global does not exist on the page yet. (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure the Vue.js library is getting brought in before `parasails`.)'); }
+    Vue = global.Vue;
+    if (!global._) { throw new Error('`_` global does not exist on the page yet. (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure the Lodash library is getting brought in before `parasails`.)'); }
+    _ = global._;
+    // optional deps:
+    VueRouter = global.VueRouter || undefined;
+    $ = global.$ || global.jQuery || undefined;
+    bowser = global.bowser || undefined;
+    // export:
+    if (global.parasails) { throw new Error('Conflicting global (`parasails`) already exists!'); }
+    global.parasails = factory(Vue, _, VueRouter, $, bowser);
+  }
+});//…)
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/sails.io.js b/ee/bulk-operations-dashboard/assets/dependencies/sails.io.js
new file mode 100644
index 000000000000..6c134c22149f
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/sails.io.js
@@ -0,0 +1,1739 @@
+/* eslint-disable */
+
+/**
+ * To use sails.io.js in an AMD environment (e.g. with require.js),
+ * replace this file with the sails.io.js file from the root of:
+ * https://github.com/balderdashy/sails.io.js
+ * and download a standalone copy of socket.io-client from:
+ * https://github.com/socketio/socket.io-client
+ * then follow the instructions at:
+ * https://github.com/balderdashy/sails.io.js#requirejsamd-usage
+ */
+
+// socket.io-client version 2.0.3
+// https://github.com/socketio/socket.io-client
+
+!function(a,b){"object"==typeof exports&&"object"==typeof module?module.exports=b():"function"==typeof define&&define.amd?define([],b):"object"==typeof exports?exports.io=b():a.io=b()}(this,function(){return function(a){function b(d){if(c[d])return c[d].exports;var e=c[d]={exports:{},id:d,loaded:!1};return a[d].call(e.exports,e,e.exports,b),e.loaded=!0,e.exports}var c={};return b.m=a,b.c=c,b.p="",b(0)}([function(a,b,c){"use strict";function d(a,b){"object"===("undefined"==typeof a?"undefined":e(a))&&(b=a,a=void 0),b=b||{};var c,d=f(a),g=d.source,k=d.id,l=d.path,m=j[k]&&l in j[k].nsps,n=b.forceNew||b["force new connection"]||!1===b.multiplex||m;return n?(i("ignoring socket cache for %s",g),c=h(g,b)):(j[k]||(i("new io instance for %s",g),j[k]=h(g,b)),c=j[k]),d.query&&!b.query&&(b.query=d.query),c.socket(d.path,b)}var e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(a){return typeof a}:function(a){return a&&"function"==typeof Symbol&&a.constructor===Symbol&&a!==Symbol.prototype?"symbol":typeof a},f=c(1),g=c(7),h=c(13),i=c(3)("socket.io-client");a.exports=b=d;var j=b.managers={};b.protocol=g.protocol,b.connect=d,b.Manager=c(13),b.Socket=c(39)},function(a,b,c){(function(b){"use strict";function d(a,c){var d=a;c=c||b.location,null==a&&(a=c.protocol+"//"+c.host),"string"==typeof a&&("/"===a.charAt(0)&&(a="/"===a.charAt(1)?c.protocol+a:c.host+a),/^(https?|wss?):\/\//.test(a)||(f("protocol-less url %s",a),a="undefined"!=typeof c?c.protocol+"//"+a:"https://"+a),f("parse %s",a),d=e(a)),d.port||(/^(http|ws)$/.test(d.protocol)?d.port="80":/^(http|ws)s$/.test(d.protocol)&&(d.port="443")),d.path=d.path||"/";var g=d.host.indexOf(":")!==-1,h=g?"["+d.host+"]":d.host;return d.id=d.protocol+"://"+h+":"+d.port,d.href=d.protocol+"://"+h+(c&&c.port===d.port?"":":"+d.port),d}var e=c(2),f=c(3)("socket.io-client:url");a.exports=d}).call(b,function(){return this}())},function(a,b){var c=/^(?:(?![^:@]+:[^:@\/]*@)(http|https|ws|wss):\/\/)?((?:(([^:@]*)(?::([^:@]*))?)?@)?((?:[a-f0-9]{0,4}:){2,7}[a-f0-9]{0,4}|[^:\/?#]*)(?::(\d*))?)(((\/(?:[^?#](?![^?#\/]*\.[^?#\/.]+(?:[?#]|$)))*\/?)?([^?#\/]*))(?:\?([^#]*))?(?:#(.*))?)/,d=["source","protocol","authority","userInfo","user","password","host","port","relative","path","directory","file","query","anchor"];a.exports=function(a){var b=a,e=a.indexOf("["),f=a.indexOf("]");e!=-1&&f!=-1&&(a=a.substring(0,e)+a.substring(e,f).replace(/:/g,";")+a.substring(f,a.length));for(var g=c.exec(a||""),h={},i=14;i--;)h[d[i]]=g[i]||"";return e!=-1&&f!=-1&&(h.source=b,h.host=h.host.substring(1,h.host.length-1).replace(/;/g,":"),h.authority=h.authority.replace("[","").replace("]","").replace(/;/g,":"),h.ipv6uri=!0),h}},function(a,b,c){(function(d){function e(){return!("undefined"==typeof window||!window.process||"renderer"!==window.process.type)||"undefined"!=typeof document&&document.documentElement&&document.documentElement.style&&document.documentElement.style.WebkitAppearance||"undefined"!=typeof window&&window.console&&(window.console.firebug||window.console.exception&&window.console.table)||"undefined"!=typeof navigator&&navigator.userAgent&&navigator.userAgent.toLowerCase().match(/firefox\/(\d+)/)&&parseInt(RegExp.$1,10)>=31||"undefined"!=typeof navigator&&navigator.userAgent&&navigator.userAgent.toLowerCase().match(/applewebkit\/(\d+)/)}function f(a){var c=this.useColors;if(a[0]=(c?"%c":"")+this.namespace+(c?" %c":" ")+a[0]+(c?"%c ":" ")+"+"+b.humanize(this.diff),c){var d="color: "+this.color;a.splice(1,0,d,"color: inherit");var e=0,f=0;a[0].replace(/%[a-zA-Z%]/g,function(a){"%%"!==a&&(e++,"%c"===a&&(f=e))}),a.splice(f,0,d)}}function g(){return"object"==typeof console&&console.log&&Function.prototype.apply.call(console.log,console,arguments)}function h(a){try{null==a?b.storage.removeItem("debug"):b.storage.debug=a}catch(c){}}function i(){var a;try{a=b.storage.debug}catch(c){}return!a&&"undefined"!=typeof d&&"env"in d&&(a=d.env.DEBUG),a}function j(){try{return window.localStorage}catch(a){}}b=a.exports=c(5),b.log=g,b.formatArgs=f,b.save=h,b.load=i,b.useColors=e,b.storage="undefined"!=typeof chrome&&"undefined"!=typeof chrome.storage?chrome.storage.local:j(),b.colors=["lightseagreen","forestgreen","goldenrod","dodgerblue","darkorchid","crimson"],b.formatters.j=function(a){try{return JSON.stringify(a)}catch(b){return"[UnexpectedJSONParseError]: "+b.message}},b.enable(i())}).call(b,c(4))},function(a,b){function c(){throw new Error("setTimeout has not been defined")}function d(){throw new Error("clearTimeout has not been defined")}function e(a){if(k===setTimeout)return setTimeout(a,0);if((k===c||!k)&&setTimeout)return k=setTimeout,setTimeout(a,0);try{return k(a,0)}catch(b){try{return k.call(null,a,0)}catch(b){return k.call(this,a,0)}}}function f(a){if(l===clearTimeout)return clearTimeout(a);if((l===d||!l)&&clearTimeout)return l=clearTimeout,clearTimeout(a);try{return l(a)}catch(b){try{return l.call(null,a)}catch(b){return l.call(this,a)}}}function g(){p&&n&&(p=!1,n.length?o=n.concat(o):q=-1,o.length&&h())}function h(){if(!p){var a=e(g);p=!0;for(var b=o.length;b;){for(n=o,o=[];++q<b;)n&&n[q].run();q=-1,b=o.length}n=null,p=!1,f(a)}}function i(a,b){this.fun=a,this.array=b}function j(){}var k,l,m=a.exports={};!function(){try{k="function"==typeof setTimeout?setTimeout:c}catch(a){k=c}try{l="function"==typeof clearTimeout?clearTimeout:d}catch(a){l=d}}();var n,o=[],p=!1,q=-1;m.nextTick=function(a){var b=new Array(arguments.length-1);if(arguments.length>1)for(var c=1;c<arguments.length;c++)b[c-1]=arguments[c];o.push(new i(a,b)),1!==o.length||p||e(h)},i.prototype.run=function(){this.fun.apply(null,this.array)},m.title="browser",m.browser=!0,m.env={},m.argv=[],m.version="",m.versions={},m.on=j,m.addListener=j,m.once=j,m.off=j,m.removeListener=j,m.removeAllListeners=j,m.emit=j,m.prependListener=j,m.prependOnceListener=j,m.listeners=function(a){return[]},m.binding=function(a){throw new Error("process.binding is not supported")},m.cwd=function(){return"/"},m.chdir=function(a){throw new Error("process.chdir is not supported")},m.umask=function(){return 0}},function(a,b,c){function d(a){var c,d=0;for(c in a)d=(d<<5)-d+a.charCodeAt(c),d|=0;return b.colors[Math.abs(d)%b.colors.length]}function e(a){function c(){if(c.enabled){var a=c,d=+new Date,e=d-(j||d);a.diff=e,a.prev=j,a.curr=d,j=d;for(var f=new Array(arguments.length),g=0;g<f.length;g++)f[g]=arguments[g];f[0]=b.coerce(f[0]),"string"!=typeof f[0]&&f.unshift("%O");var h=0;f[0]=f[0].replace(/%([a-zA-Z%])/g,function(c,d){if("%%"===c)return c;h++;var e=b.formatters[d];if("function"==typeof e){var g=f[h];c=e.call(a,g),f.splice(h,1),h--}return c}),b.formatArgs.call(a,f);var i=c.log||b.log||console.log.bind(console);i.apply(a,f)}}return c.namespace=a,c.enabled=b.enabled(a),c.useColors=b.useColors(),c.color=d(a),"function"==typeof b.init&&b.init(c),c}function f(a){b.save(a),b.names=[],b.skips=[];for(var c=("string"==typeof a?a:"").split(/[\s,]+/),d=c.length,e=0;e<d;e++)c[e]&&(a=c[e].replace(/\*/g,".*?"),"-"===a[0]?b.skips.push(new RegExp("^"+a.substr(1)+"$")):b.names.push(new RegExp("^"+a+"$")))}function g(){b.enable("")}function h(a){var c,d;for(c=0,d=b.skips.length;c<d;c++)if(b.skips[c].test(a))return!1;for(c=0,d=b.names.length;c<d;c++)if(b.names[c].test(a))return!0;return!1}function i(a){return a instanceof Error?a.stack||a.message:a}b=a.exports=e.debug=e["default"]=e,b.coerce=i,b.disable=g,b.enable=f,b.enabled=h,b.humanize=c(6),b.names=[],b.skips=[],b.formatters={};var j},function(a,b){function c(a){if(a=String(a),!(a.length>100)){var b=/^((?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|years?|yrs?|y)?$/i.exec(a);if(b){var c=parseFloat(b[1]),d=(b[2]||"ms").toLowerCase();switch(d){case"years":case"year":case"yrs":case"yr":case"y":return c*k;case"days":case"day":case"d":return c*j;case"hours":case"hour":case"hrs":case"hr":case"h":return c*i;case"minutes":case"minute":case"mins":case"min":case"m":return c*h;case"seconds":case"second":case"secs":case"sec":case"s":return c*g;case"milliseconds":case"millisecond":case"msecs":case"msec":case"ms":return c;default:return}}}}function d(a){return a>=j?Math.round(a/j)+"d":a>=i?Math.round(a/i)+"h":a>=h?Math.round(a/h)+"m":a>=g?Math.round(a/g)+"s":a+"ms"}function e(a){return f(a,j,"day")||f(a,i,"hour")||f(a,h,"minute")||f(a,g,"second")||a+" ms"}function f(a,b,c){if(!(a<b))return a<1.5*b?Math.floor(a/b)+" "+c:Math.ceil(a/b)+" "+c+"s"}var g=1e3,h=60*g,i=60*h,j=24*i,k=365.25*j;a.exports=function(a,b){b=b||{};var f=typeof a;if("string"===f&&a.length>0)return c(a);if("number"===f&&isNaN(a)===!1)return b["long"]?e(a):d(a);throw new Error("val is not a non-empty string or a valid number. val="+JSON.stringify(a))}},function(a,b,c){function d(){}function e(a){var c=""+a.type;return b.BINARY_EVENT!==a.type&&b.BINARY_ACK!==a.type||(c+=a.attachments+"-"),a.nsp&&"/"!==a.nsp&&(c+=a.nsp+","),null!=a.id&&(c+=a.id),null!=a.data&&(c+=JSON.stringify(a.data)),l("encoded %j as %s",a,c),c}function f(a,b){function c(a){var c=o.deconstructPacket(a),d=e(c.packet),f=c.buffers;f.unshift(d),b(f)}o.removeBlobs(a,c)}function g(){this.reconstructor=null}function h(a){var c=0,d={type:Number(a.charAt(0))};if(null==b.types[d.type])return k();if(b.BINARY_EVENT===d.type||b.BINARY_ACK===d.type){for(var e="";"-"!==a.charAt(++c)&&(e+=a.charAt(c),c!=a.length););if(e!=Number(e)||"-"!==a.charAt(c))throw new Error("Illegal attachments");d.attachments=Number(e)}if("/"===a.charAt(c+1))for(d.nsp="";++c;){var f=a.charAt(c);if(","===f)break;if(d.nsp+=f,c===a.length)break}else d.nsp="/";var g=a.charAt(c+1);if(""!==g&&Number(g)==g){for(d.id="";++c;){var f=a.charAt(c);if(null==f||Number(f)!=f){--c;break}if(d.id+=a.charAt(c),c===a.length)break}d.id=Number(d.id)}return a.charAt(++c)&&(d=i(d,a.substr(c))),l("decoded %s as %j",a,d),d}function i(a,b){try{a.data=JSON.parse(b)}catch(c){return k()}return a}function j(a){this.reconPack=a,this.buffers=[]}function k(){return{type:b.ERROR,data:"parser error"}}var l=c(3)("socket.io-parser"),m=c(8),n=c(9),o=c(11),p=c(12);b.protocol=4,b.types=["CONNECT","DISCONNECT","EVENT","ACK","ERROR","BINARY_EVENT","BINARY_ACK"],b.CONNECT=0,b.DISCONNECT=1,b.EVENT=2,b.ACK=3,b.ERROR=4,b.BINARY_EVENT=5,b.BINARY_ACK=6,b.Encoder=d,b.Decoder=g,d.prototype.encode=function(a,c){if(a.type!==b.EVENT&&a.type!==b.ACK||!n(a.data)||(a.type=a.type===b.EVENT?b.BINARY_EVENT:b.BINARY_ACK),l("encoding packet %j",a),b.BINARY_EVENT===a.type||b.BINARY_ACK===a.type)f(a,c);else{var d=e(a);c([d])}},m(g.prototype),g.prototype.add=function(a){var c;if("string"==typeof a)c=h(a),b.BINARY_EVENT===c.type||b.BINARY_ACK===c.type?(this.reconstructor=new j(c),0===this.reconstructor.reconPack.attachments&&this.emit("decoded",c)):this.emit("decoded",c);else{if(!p(a)&&!a.base64)throw new Error("Unknown type: "+a);if(!this.reconstructor)throw new Error("got binary data when not reconstructing a packet");c=this.reconstructor.takeBinaryData(a),c&&(this.reconstructor=null,this.emit("decoded",c))}},g.prototype.destroy=function(){this.reconstructor&&this.reconstructor.finishedReconstruction()},j.prototype.takeBinaryData=function(a){if(this.buffers.push(a),this.buffers.length===this.reconPack.attachments){var b=o.reconstructPacket(this.reconPack,this.buffers);return this.finishedReconstruction(),b}return null},j.prototype.finishedReconstruction=function(){this.reconPack=null,this.buffers=[]}},function(a,b,c){function d(a){if(a)return e(a)}function e(a){for(var b in d.prototype)a[b]=d.prototype[b];return a}a.exports=d,d.prototype.on=d.prototype.addEventListener=function(a,b){return this._callbacks=this._callbacks||{},(this._callbacks["$"+a]=this._callbacks["$"+a]||[]).push(b),this},d.prototype.once=function(a,b){function c(){this.off(a,c),b.apply(this,arguments)}return c.fn=b,this.on(a,c),this},d.prototype.off=d.prototype.removeListener=d.prototype.removeAllListeners=d.prototype.removeEventListener=function(a,b){if(this._callbacks=this._callbacks||{},0==arguments.length)return this._callbacks={},this;var c=this._callbacks["$"+a];if(!c)return this;if(1==arguments.length)return delete this._callbacks["$"+a],this;for(var d,e=0;e<c.length;e++)if(d=c[e],d===b||d.fn===b){c.splice(e,1);break}return this},d.prototype.emit=function(a){this._callbacks=this._callbacks||{};var b=[].slice.call(arguments,1),c=this._callbacks["$"+a];if(c){c=c.slice(0);for(var d=0,e=c.length;d<e;++d)c[d].apply(this,b)}return this},d.prototype.listeners=function(a){return this._callbacks=this._callbacks||{},this._callbacks["$"+a]||[]},d.prototype.hasListeners=function(a){return!!this.listeners(a).length}},function(a,b,c){(function(b){function d(a){if(!a||"object"!=typeof a)return!1;if(e(a)){for(var c=0,f=a.length;c<f;c++)if(d(a[c]))return!0;return!1}if("function"==typeof b.Buffer&&b.Buffer.isBuffer&&b.Buffer.isBuffer(a)||"function"==typeof b.ArrayBuffer&&a instanceof ArrayBuffer||g&&a instanceof Blob||h&&a instanceof File)return!0;if(a.toJSON&&"function"==typeof a.toJSON&&1===arguments.length)return d(a.toJSON(),!0);for(var i in a)if(Object.prototype.hasOwnProperty.call(a,i)&&d(a[i]))return!0;return!1}var e=c(10),f=Object.prototype.toString,g="function"==typeof b.Blob||"[object BlobConstructor]"===f.call(b.Blob),h="function"==typeof b.File||"[object FileConstructor]"===f.call(b.File);a.exports=d}).call(b,function(){return this}())},function(a,b){var c={}.toString;a.exports=Array.isArray||function(a){return"[object Array]"==c.call(a)}},function(a,b,c){(function(a){function d(a,b){if(!a)return a;if(g(a)){var c={_placeholder:!0,num:b.length};return b.push(a),c}if(f(a)){for(var e=new Array(a.length),h=0;h<a.length;h++)e[h]=d(a[h],b);return e}if("object"==typeof a&&!(a instanceof Date)){var e={};for(var i in a)e[i]=d(a[i],b);return e}return a}function e(a,b){if(!a)return a;if(a&&a._placeholder)return b[a.num];if(f(a))for(var c=0;c<a.length;c++)a[c]=e(a[c],b);else if("object"==typeof a)for(var d in a)a[d]=e(a[d],b);return a}var f=c(10),g=c(12),h=Object.prototype.toString,i="function"==typeof a.Blob||"[object BlobConstructor]"===h.call(a.Blob),j="function"==typeof a.File||"[object FileConstructor]"===h.call(a.File);b.deconstructPacket=function(a){var b=[],c=a.data,e=a;return e.data=d(c,b),e.attachments=b.length,{packet:e,buffers:b}},b.reconstructPacket=function(a,b){return a.data=e(a.data,b),a.attachments=void 0,a},b.removeBlobs=function(a,b){function c(a,h,k){if(!a)return a;if(i&&a instanceof Blob||j&&a instanceof File){d++;var l=new FileReader;l.onload=function(){k?k[h]=this.result:e=this.result,--d||b(e)},l.readAsArrayBuffer(a)}else if(f(a))for(var m=0;m<a.length;m++)c(a[m],m,a);else if("object"==typeof a&&!g(a))for(var n in a)c(a[n],n,a)}var d=0,e=a;c(e),d||b(e)}}).call(b,function(){return this}())},function(a,b){(function(b){function c(a){return b.Buffer&&b.Buffer.isBuffer(a)||b.ArrayBuffer&&a instanceof ArrayBuffer}a.exports=c}).call(b,function(){return this}())},function(a,b,c){"use strict";function d(a,b){if(!(this instanceof d))return new d(a,b);a&&"object"===("undefined"==typeof a?"undefined":e(a))&&(b=a,a=void 0),b=b||{},b.path=b.path||"/socket.io",this.nsps={},this.subs=[],this.opts=b,this.reconnection(b.reconnection!==!1),this.reconnectionAttempts(b.reconnectionAttempts||1/0),this.reconnectionDelay(b.reconnectionDelay||1e3),this.reconnectionDelayMax(b.reconnectionDelayMax||5e3),this.randomizationFactor(b.randomizationFactor||.5),this.backoff=new n({min:this.reconnectionDelay(),max:this.reconnectionDelayMax(),jitter:this.randomizationFactor()}),this.timeout(null==b.timeout?2e4:b.timeout),this.readyState="closed",this.uri=a,this.connecting=[],this.lastPing=null,this.encoding=!1,this.packetBuffer=[];var c=b.parser||i;this.encoder=new c.Encoder,this.decoder=new c.Decoder,this.autoConnect=b.autoConnect!==!1,this.autoConnect&&this.open()}var e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(a){return typeof a}:function(a){return a&&"function"==typeof Symbol&&a.constructor===Symbol&&a!==Symbol.prototype?"symbol":typeof a},f=c(14),g=c(39),h=c(8),i=c(7),j=c(41),k=c(42),l=c(3)("socket.io-client:manager"),m=c(37),n=c(43),o=Object.prototype.hasOwnProperty;a.exports=d,d.prototype.emitAll=function(){this.emit.apply(this,arguments);for(var a in this.nsps)o.call(this.nsps,a)&&this.nsps[a].emit.apply(this.nsps[a],arguments)},d.prototype.updateSocketIds=function(){for(var a in this.nsps)o.call(this.nsps,a)&&(this.nsps[a].id=this.generateId(a))},d.prototype.generateId=function(a){return("/"===a?"":a+"#")+this.engine.id},h(d.prototype),d.prototype.reconnection=function(a){return arguments.length?(this._reconnection=!!a,this):this._reconnection},d.prototype.reconnectionAttempts=function(a){return arguments.length?(this._reconnectionAttempts=a,this):this._reconnectionAttempts},d.prototype.reconnectionDelay=function(a){return arguments.length?(this._reconnectionDelay=a,this.backoff&&this.backoff.setMin(a),this):this._reconnectionDelay},d.prototype.randomizationFactor=function(a){return arguments.length?(this._randomizationFactor=a,this.backoff&&this.backoff.setJitter(a),this):this._randomizationFactor},d.prototype.reconnectionDelayMax=function(a){return arguments.length?(this._reconnectionDelayMax=a,this.backoff&&this.backoff.setMax(a),this):this._reconnectionDelayMax},d.prototype.timeout=function(a){return arguments.length?(this._timeout=a,this):this._timeout},d.prototype.maybeReconnectOnOpen=function(){!this.reconnecting&&this._reconnection&&0===this.backoff.attempts&&this.reconnect()},d.prototype.open=d.prototype.connect=function(a,b){if(l("readyState %s",this.readyState),~this.readyState.indexOf("open"))return this;l("opening %s",this.uri),this.engine=f(this.uri,this.opts);var c=this.engine,d=this;this.readyState="opening",this.skipReconnect=!1;var e=j(c,"open",function(){d.onopen(),a&&a()}),g=j(c,"error",function(b){if(l("connect_error"),d.cleanup(),d.readyState="closed",d.emitAll("connect_error",b),a){var c=new Error("Connection error");c.data=b,a(c)}else d.maybeReconnectOnOpen()});if(!1!==this._timeout){var h=this._timeout;l("connect attempt will timeout after %d",h);var i=setTimeout(function(){l("connect attempt timed out after %d",h),e.destroy(),c.close(),c.emit("error","timeout"),d.emitAll("connect_timeout",h)},h);this.subs.push({destroy:function(){clearTimeout(i)}})}return this.subs.push(e),this.subs.push(g),this},d.prototype.onopen=function(){l("open"),this.cleanup(),this.readyState="open",this.emit("open");var a=this.engine;this.subs.push(j(a,"data",k(this,"ondata"))),this.subs.push(j(a,"ping",k(this,"onping"))),this.subs.push(j(a,"pong",k(this,"onpong"))),this.subs.push(j(a,"error",k(this,"onerror"))),this.subs.push(j(a,"close",k(this,"onclose"))),this.subs.push(j(this.decoder,"decoded",k(this,"ondecoded")))},d.prototype.onping=function(){this.lastPing=new Date,this.emitAll("ping")},d.prototype.onpong=function(){this.emitAll("pong",new Date-this.lastPing)},d.prototype.ondata=function(a){this.decoder.add(a)},d.prototype.ondecoded=function(a){this.emit("packet",a)},d.prototype.onerror=function(a){l("error",a),this.emitAll("error",a)},d.prototype.socket=function(a,b){function c(){~m(e.connecting,d)||e.connecting.push(d)}var d=this.nsps[a];if(!d){d=new g(this,a,b),this.nsps[a]=d;var e=this;d.on("connecting",c),d.on("connect",function(){d.id=e.generateId(a)}),this.autoConnect&&c()}return d},d.prototype.destroy=function(a){var b=m(this.connecting,a);~b&&this.connecting.splice(b,1),this.connecting.length||this.close()},d.prototype.packet=function(a){l("writing packet %j",a);var b=this;a.query&&0===a.type&&(a.nsp+="?"+a.query),b.encoding?b.packetBuffer.push(a):(b.encoding=!0,this.encoder.encode(a,function(c){for(var d=0;d<c.length;d++)b.engine.write(c[d],a.options);b.encoding=!1,b.processPacketQueue()}))},d.prototype.processPacketQueue=function(){if(this.packetBuffer.length>0&&!this.encoding){var a=this.packetBuffer.shift();this.packet(a)}},d.prototype.cleanup=function(){l("cleanup");for(var a=this.subs.length,b=0;b<a;b++){var c=this.subs.shift();c.destroy()}this.packetBuffer=[],this.encoding=!1,this.lastPing=null,this.decoder.destroy()},d.prototype.close=d.prototype.disconnect=function(){l("disconnect"),this.skipReconnect=!0,this.reconnecting=!1,"opening"===this.readyState&&this.cleanup(),this.backoff.reset(),this.readyState="closed",this.engine&&this.engine.close()},d.prototype.onclose=function(a){l("onclose"),this.cleanup(),this.backoff.reset(),this.readyState="closed",this.emit("close",a),this._reconnection&&!this.skipReconnect&&this.reconnect()},d.prototype.reconnect=function(){if(this.reconnecting||this.skipReconnect)return this;var a=this;if(this.backoff.attempts>=this._reconnectionAttempts)l("reconnect failed"),this.backoff.reset(),this.emitAll("reconnect_failed"),this.reconnecting=!1;else{var b=this.backoff.duration();l("will wait %dms before reconnect attempt",b),this.reconnecting=!0;var c=setTimeout(function(){a.skipReconnect||(l("attempting reconnect"),a.emitAll("reconnect_attempt",a.backoff.attempts),a.emitAll("reconnecting",a.backoff.attempts),a.skipReconnect||a.open(function(b){b?(l("reconnect attempt error"),a.reconnecting=!1,a.reconnect(),a.emitAll("reconnect_error",b.data)):(l("reconnect success"),a.onreconnect())}))},b);this.subs.push({destroy:function(){clearTimeout(c)}})}},d.prototype.onreconnect=function(){var a=this.backoff.attempts;this.reconnecting=!1,this.backoff.reset(),this.updateSocketIds(),this.emitAll("reconnect",a)}},function(a,b,c){a.exports=c(15)},function(a,b,c){a.exports=c(16),a.exports.parser=c(23)},function(a,b,c){(function(b){function d(a,c){if(!(this instanceof d))return new d(a,c);c=c||{},a&&"object"==typeof a&&(c=a,a=null),a?(a=k(a),c.hostname=a.host,c.secure="https"===a.protocol||"wss"===a.protocol,c.port=a.port,a.query&&(c.query=a.query)):c.host&&(c.hostname=k(c.host).host),this.secure=null!=c.secure?c.secure:b.location&&"https:"===location.protocol,c.hostname&&!c.port&&(c.port=this.secure?"443":"80"),this.agent=c.agent||!1,this.hostname=c.hostname||(b.location?location.hostname:"localhost"),this.port=c.port||(b.location&&location.port?location.port:this.secure?443:80),this.query=c.query||{},"string"==typeof this.query&&(this.query=m.decode(this.query)),this.upgrade=!1!==c.upgrade,this.path=(c.path||"/engine.io").replace(/\/$/,"")+"/",this.forceJSONP=!!c.forceJSONP,this.jsonp=!1!==c.jsonp,this.forceBase64=!!c.forceBase64,this.enablesXDR=!!c.enablesXDR,this.timestampParam=c.timestampParam||"t",this.timestampRequests=c.timestampRequests,this.transports=c.transports||["polling","websocket"],this.transportOptions=c.transportOptions||{},this.readyState="",this.writeBuffer=[],this.prevBufferLen=0,this.policyPort=c.policyPort||843,this.rememberUpgrade=c.rememberUpgrade||!1,this.binaryType=null,this.onlyBinaryUpgrades=c.onlyBinaryUpgrades,this.perMessageDeflate=!1!==c.perMessageDeflate&&(c.perMessageDeflate||{}),!0===this.perMessageDeflate&&(this.perMessageDeflate={}),this.perMessageDeflate&&null==this.perMessageDeflate.threshold&&(this.perMessageDeflate.threshold=1024),this.pfx=c.pfx||null,this.key=c.key||null,this.passphrase=c.passphrase||null,this.cert=c.cert||null,this.ca=c.ca||null,this.ciphers=c.ciphers||null,this.rejectUnauthorized=void 0===c.rejectUnauthorized||c.rejectUnauthorized,this.forceNode=!!c.forceNode;var e="object"==typeof b&&b;e.global===e&&(c.extraHeaders&&Object.keys(c.extraHeaders).length>0&&(this.extraHeaders=c.extraHeaders),c.localAddress&&(this.localAddress=c.localAddress)),this.id=null,this.upgrades=null,this.pingInterval=null,this.pingTimeout=null,this.pingIntervalTimer=null,this.pingTimeoutTimer=null,this.open()}function e(a){var b={};for(var c in a)a.hasOwnProperty(c)&&(b[c]=a[c]);return b}var f=c(17),g=c(8),h=c(3)("engine.io-client:socket"),i=c(37),j=c(23),k=c(2),l=c(38),m=c(31);a.exports=d,d.priorWebsocketSuccess=!1,g(d.prototype),d.protocol=j.protocol,d.Socket=d,d.Transport=c(22),d.transports=c(17),d.parser=c(23),d.prototype.createTransport=function(a){h('creating transport "%s"',a);var b=e(this.query);b.EIO=j.protocol,b.transport=a;var c=this.transportOptions[a]||{};this.id&&(b.sid=this.id);var d=new f[a]({query:b,socket:this,agent:c.agent||this.agent,hostname:c.hostname||this.hostname,port:c.port||this.port,secure:c.secure||this.secure,path:c.path||this.path,forceJSONP:c.forceJSONP||this.forceJSONP,jsonp:c.jsonp||this.jsonp,forceBase64:c.forceBase64||this.forceBase64,enablesXDR:c.enablesXDR||this.enablesXDR,timestampRequests:c.timestampRequests||this.timestampRequests,timestampParam:c.timestampParam||this.timestampParam,policyPort:c.policyPort||this.policyPort,pfx:c.pfx||this.pfx,key:c.key||this.key,passphrase:c.passphrase||this.passphrase,cert:c.cert||this.cert,ca:c.ca||this.ca,ciphers:c.ciphers||this.ciphers,rejectUnauthorized:c.rejectUnauthorized||this.rejectUnauthorized,perMessageDeflate:c.perMessageDeflate||this.perMessageDeflate,extraHeaders:c.extraHeaders||this.extraHeaders,forceNode:c.forceNode||this.forceNode,localAddress:c.localAddress||this.localAddress,requestTimeout:c.requestTimeout||this.requestTimeout,protocols:c.protocols||void 0});return d},d.prototype.open=function(){var a;if(this.rememberUpgrade&&d.priorWebsocketSuccess&&this.transports.indexOf("websocket")!==-1)a="websocket";else{if(0===this.transports.length){var b=this;return void setTimeout(function(){b.emit("error","No transports available")},0)}a=this.transports[0]}this.readyState="opening";try{a=this.createTransport(a)}catch(c){return this.transports.shift(),void this.open()}a.open(),this.setTransport(a)},d.prototype.setTransport=function(a){h("setting transport %s",a.name);var b=this;this.transport&&(h("clearing existing transport %s",this.transport.name),this.transport.removeAllListeners()),this.transport=a,a.on("drain",function(){b.onDrain()}).on("packet",function(a){b.onPacket(a)}).on("error",function(a){b.onError(a)}).on("close",function(){b.onClose("transport close")})},d.prototype.probe=function(a){function b(){if(m.onlyBinaryUpgrades){var b=!this.supportsBinary&&m.transport.supportsBinary;l=l||b}l||(h('probe transport "%s" opened',a),k.send([{type:"ping",data:"probe"}]),k.once("packet",function(b){if(!l)if("pong"===b.type&&"probe"===b.data){if(h('probe transport "%s" pong',a),m.upgrading=!0,m.emit("upgrading",k),!k)return;d.priorWebsocketSuccess="websocket"===k.name,h('pausing current transport "%s"',m.transport.name),m.transport.pause(function(){l||"closed"!==m.readyState&&(h("changing transport and sending upgrade packet"),j(),m.setTransport(k),k.send([{type:"upgrade"}]),m.emit("upgrade",k),k=null,m.upgrading=!1,m.flush())})}else{h('probe transport "%s" failed',a);var c=new Error("probe error");c.transport=k.name,m.emit("upgradeError",c)}}))}function c(){l||(l=!0,j(),k.close(),k=null)}function e(b){var d=new Error("probe error: "+b);d.transport=k.name,c(),h('probe transport "%s" failed because of error: %s',a,b),m.emit("upgradeError",d)}function f(){e("transport closed")}function g(){e("socket closed")}function i(a){k&&a.name!==k.name&&(h('"%s" works - aborting "%s"',a.name,k.name),c())}function j(){k.removeListener("open",b),k.removeListener("error",e),k.removeListener("close",f),m.removeListener("close",g),m.removeListener("upgrading",i)}h('probing transport "%s"',a);var k=this.createTransport(a,{probe:1}),l=!1,m=this;d.priorWebsocketSuccess=!1,k.once("open",b),k.once("error",e),k.once("close",f),this.once("close",g),this.once("upgrading",i),k.open()},d.prototype.onOpen=function(){if(h("socket open"),this.readyState="open",d.priorWebsocketSuccess="websocket"===this.transport.name,this.emit("open"),this.flush(),"open"===this.readyState&&this.upgrade&&this.transport.pause){h("starting upgrade probes");for(var a=0,b=this.upgrades.length;a<b;a++)this.probe(this.upgrades[a])}},d.prototype.onPacket=function(a){if("opening"===this.readyState||"open"===this.readyState||"closing"===this.readyState)switch(h('socket receive: type "%s", data "%s"',a.type,a.data),this.emit("packet",a),this.emit("heartbeat"),a.type){case"open":this.onHandshake(l(a.data));break;case"pong":this.setPing(),this.emit("pong");break;case"error":var b=new Error("server error");b.code=a.data,this.onError(b);break;case"message":this.emit("data",a.data),this.emit("message",a.data)}else h('packet received with socket readyState "%s"',this.readyState)},d.prototype.onHandshake=function(a){this.emit("handshake",a),this.id=a.sid,this.transport.query.sid=a.sid,this.upgrades=this.filterUpgrades(a.upgrades),this.pingInterval=a.pingInterval,this.pingTimeout=a.pingTimeout,this.onOpen(),"closed"!==this.readyState&&(this.setPing(),this.removeListener("heartbeat",this.onHeartbeat),this.on("heartbeat",this.onHeartbeat))},d.prototype.onHeartbeat=function(a){clearTimeout(this.pingTimeoutTimer);var b=this;b.pingTimeoutTimer=setTimeout(function(){"closed"!==b.readyState&&b.onClose("ping timeout")},a||b.pingInterval+b.pingTimeout)},d.prototype.setPing=function(){var a=this;clearTimeout(a.pingIntervalTimer),a.pingIntervalTimer=setTimeout(function(){h("writing ping packet - expecting pong within %sms",a.pingTimeout),a.ping(),a.onHeartbeat(a.pingTimeout)},a.pingInterval)},d.prototype.ping=function(){var a=this;this.sendPacket("ping",function(){a.emit("ping")})},d.prototype.onDrain=function(){this.writeBuffer.splice(0,this.prevBufferLen),this.prevBufferLen=0,0===this.writeBuffer.length?this.emit("drain"):this.flush()},d.prototype.flush=function(){"closed"!==this.readyState&&this.transport.writable&&!this.upgrading&&this.writeBuffer.length&&(h("flushing %d packets in socket",this.writeBuffer.length),this.transport.send(this.writeBuffer),this.prevBufferLen=this.writeBuffer.length,this.emit("flush"))},d.prototype.write=d.prototype.send=function(a,b,c){return this.sendPacket("message",a,b,c),this},d.prototype.sendPacket=function(a,b,c,d){if("function"==typeof b&&(d=b,b=void 0),"function"==typeof c&&(d=c,c=null),"closing"!==this.readyState&&"closed"!==this.readyState){c=c||{},c.compress=!1!==c.compress;var e={type:a,data:b,options:c};this.emit("packetCreate",e),this.writeBuffer.push(e),d&&this.once("flush",d),this.flush()}},d.prototype.close=function(){function a(){d.onClose("forced close"),h("socket closing - telling transport to close"),d.transport.close()}function b(){d.removeListener("upgrade",b),d.removeListener("upgradeError",b),a()}function c(){d.once("upgrade",b),d.once("upgradeError",b)}if("opening"===this.readyState||"open"===this.readyState){this.readyState="closing";var d=this;this.writeBuffer.length?this.once("drain",function(){this.upgrading?c():a()}):this.upgrading?c():a()}return this},d.prototype.onError=function(a){h("socket error %j",a),d.priorWebsocketSuccess=!1,this.emit("error",a),this.onClose("transport error",a)},d.prototype.onClose=function(a,b){if("opening"===this.readyState||"open"===this.readyState||"closing"===this.readyState){h('socket close with reason: "%s"',a);var c=this;clearTimeout(this.pingIntervalTimer),clearTimeout(this.pingTimeoutTimer),this.transport.removeAllListeners("close"),this.transport.close(),this.transport.removeAllListeners(),this.readyState="closed",this.id=null,this.emit("close",a,b),c.writeBuffer=[],c.prevBufferLen=0}},d.prototype.filterUpgrades=function(a){for(var b=[],c=0,d=a.length;c<d;c++)~i(this.transports,a[c])&&b.push(a[c]);return b}}).call(b,function(){return this}())},function(a,b,c){(function(a){function d(b){var c,d=!1,h=!1,i=!1!==b.jsonp;if(a.location){var j="https:"===location.protocol,k=location.port;k||(k=j?443:80),d=b.hostname!==location.hostname||k!==b.port,h=b.secure!==j}if(b.xdomain=d,b.xscheme=h,c=new e(b),"open"in c&&!b.forceJSONP)return new f(b);if(!i)throw new Error("JSONP disabled");return new g(b)}var e=c(18),f=c(20),g=c(34),h=c(35);b.polling=d,b.websocket=h}).call(b,function(){return this}())},function(a,b,c){(function(b){var d=c(19);a.exports=function(a){var c=a.xdomain,e=a.xscheme,f=a.enablesXDR;try{if("undefined"!=typeof XMLHttpRequest&&(!c||d))return new XMLHttpRequest}catch(g){}try{if("undefined"!=typeof XDomainRequest&&!e&&f)return new XDomainRequest}catch(g){}if(!c)try{
+return new(b[["Active"].concat("Object").join("X")])("Microsoft.XMLHTTP")}catch(g){}}}).call(b,function(){return this}())},function(a,b){try{a.exports="undefined"!=typeof XMLHttpRequest&&"withCredentials"in new XMLHttpRequest}catch(c){a.exports=!1}},function(a,b,c){(function(b){function d(){}function e(a){if(i.call(this,a),this.requestTimeout=a.requestTimeout,this.extraHeaders=a.extraHeaders,b.location){var c="https:"===location.protocol,d=location.port;d||(d=c?443:80),this.xd=a.hostname!==b.location.hostname||d!==a.port,this.xs=a.secure!==c}}function f(a){this.method=a.method||"GET",this.uri=a.uri,this.xd=!!a.xd,this.xs=!!a.xs,this.async=!1!==a.async,this.data=void 0!==a.data?a.data:null,this.agent=a.agent,this.isBinary=a.isBinary,this.supportsBinary=a.supportsBinary,this.enablesXDR=a.enablesXDR,this.requestTimeout=a.requestTimeout,this.pfx=a.pfx,this.key=a.key,this.passphrase=a.passphrase,this.cert=a.cert,this.ca=a.ca,this.ciphers=a.ciphers,this.rejectUnauthorized=a.rejectUnauthorized,this.extraHeaders=a.extraHeaders,this.create()}function g(){for(var a in f.requests)f.requests.hasOwnProperty(a)&&f.requests[a].abort()}var h=c(18),i=c(21),j=c(8),k=c(32),l=c(3)("engine.io-client:polling-xhr");a.exports=e,a.exports.Request=f,k(e,i),e.prototype.supportsBinary=!0,e.prototype.request=function(a){return a=a||{},a.uri=this.uri(),a.xd=this.xd,a.xs=this.xs,a.agent=this.agent||!1,a.supportsBinary=this.supportsBinary,a.enablesXDR=this.enablesXDR,a.pfx=this.pfx,a.key=this.key,a.passphrase=this.passphrase,a.cert=this.cert,a.ca=this.ca,a.ciphers=this.ciphers,a.rejectUnauthorized=this.rejectUnauthorized,a.requestTimeout=this.requestTimeout,a.extraHeaders=this.extraHeaders,new f(a)},e.prototype.doWrite=function(a,b){var c="string"!=typeof a&&void 0!==a,d=this.request({method:"POST",data:a,isBinary:c}),e=this;d.on("success",b),d.on("error",function(a){e.onError("xhr post error",a)}),this.sendXhr=d},e.prototype.doPoll=function(){l("xhr poll");var a=this.request(),b=this;a.on("data",function(a){b.onData(a)}),a.on("error",function(a){b.onError("xhr poll error",a)}),this.pollXhr=a},j(f.prototype),f.prototype.create=function(){var a={agent:this.agent,xdomain:this.xd,xscheme:this.xs,enablesXDR:this.enablesXDR};a.pfx=this.pfx,a.key=this.key,a.passphrase=this.passphrase,a.cert=this.cert,a.ca=this.ca,a.ciphers=this.ciphers,a.rejectUnauthorized=this.rejectUnauthorized;var c=this.xhr=new h(a),d=this;try{l("xhr open %s: %s",this.method,this.uri),c.open(this.method,this.uri,this.async);try{if(this.extraHeaders){c.setDisableHeaderCheck&&c.setDisableHeaderCheck(!0);for(var e in this.extraHeaders)this.extraHeaders.hasOwnProperty(e)&&c.setRequestHeader(e,this.extraHeaders[e])}}catch(g){}if("POST"===this.method)try{this.isBinary?c.setRequestHeader("Content-type","application/octet-stream"):c.setRequestHeader("Content-type","text/plain;charset=UTF-8")}catch(g){}try{c.setRequestHeader("Accept","*/*")}catch(g){}"withCredentials"in c&&(c.withCredentials=!0),this.requestTimeout&&(c.timeout=this.requestTimeout),this.hasXDR()?(c.onload=function(){d.onLoad()},c.onerror=function(){d.onError(c.responseText)}):c.onreadystatechange=function(){if(2===c.readyState){var a;try{a=c.getResponseHeader("Content-Type")}catch(b){}"application/octet-stream"===a&&(c.responseType="arraybuffer")}4===c.readyState&&(200===c.status||1223===c.status?d.onLoad():setTimeout(function(){d.onError(c.status)},0))},l("xhr data %s",this.data),c.send(this.data)}catch(g){return void setTimeout(function(){d.onError(g)},0)}b.document&&(this.index=f.requestsCount++,f.requests[this.index]=this)},f.prototype.onSuccess=function(){this.emit("success"),this.cleanup()},f.prototype.onData=function(a){this.emit("data",a),this.onSuccess()},f.prototype.onError=function(a){this.emit("error",a),this.cleanup(!0)},f.prototype.cleanup=function(a){if("undefined"!=typeof this.xhr&&null!==this.xhr){if(this.hasXDR()?this.xhr.onload=this.xhr.onerror=d:this.xhr.onreadystatechange=d,a)try{this.xhr.abort()}catch(c){}b.document&&delete f.requests[this.index],this.xhr=null}},f.prototype.onLoad=function(){var a;try{var b;try{b=this.xhr.getResponseHeader("Content-Type")}catch(c){}a="application/octet-stream"===b?this.xhr.response||this.xhr.responseText:this.xhr.responseText}catch(c){this.onError(c)}null!=a&&this.onData(a)},f.prototype.hasXDR=function(){return"undefined"!=typeof b.XDomainRequest&&!this.xs&&this.enablesXDR},f.prototype.abort=function(){this.cleanup()},f.requestsCount=0,f.requests={},b.document&&(b.attachEvent?b.attachEvent("onunload",g):b.addEventListener&&b.addEventListener("beforeunload",g,!1))}).call(b,function(){return this}())},function(a,b,c){function d(a){var b=a&&a.forceBase64;k&&!b||(this.supportsBinary=!1),e.call(this,a)}var e=c(22),f=c(31),g=c(23),h=c(32),i=c(33),j=c(3)("engine.io-client:polling");a.exports=d;var k=function(){var a=c(18),b=new a({xdomain:!1});return null!=b.responseType}();h(d,e),d.prototype.name="polling",d.prototype.doOpen=function(){this.poll()},d.prototype.pause=function(a){function b(){j("paused"),c.readyState="paused",a()}var c=this;if(this.readyState="pausing",this.polling||!this.writable){var d=0;this.polling&&(j("we are currently polling - waiting to pause"),d++,this.once("pollComplete",function(){j("pre-pause polling complete"),--d||b()})),this.writable||(j("we are currently writing - waiting to pause"),d++,this.once("drain",function(){j("pre-pause writing complete"),--d||b()}))}else b()},d.prototype.poll=function(){j("polling"),this.polling=!0,this.doPoll(),this.emit("poll")},d.prototype.onData=function(a){var b=this;j("polling got data %s",a);var c=function(a,c,d){return"opening"===b.readyState&&b.onOpen(),"close"===a.type?(b.onClose(),!1):void b.onPacket(a)};g.decodePayload(a,this.socket.binaryType,c),"closed"!==this.readyState&&(this.polling=!1,this.emit("pollComplete"),"open"===this.readyState?this.poll():j('ignoring poll - transport state "%s"',this.readyState))},d.prototype.doClose=function(){function a(){j("writing close packet"),b.write([{type:"close"}])}var b=this;"open"===this.readyState?(j("transport open - closing"),a()):(j("transport not open - deferring close"),this.once("open",a))},d.prototype.write=function(a){var b=this;this.writable=!1;var c=function(){b.writable=!0,b.emit("drain")};g.encodePayload(a,this.supportsBinary,function(a){b.doWrite(a,c)})},d.prototype.uri=function(){var a=this.query||{},b=this.secure?"https":"http",c="";!1!==this.timestampRequests&&(a[this.timestampParam]=i()),this.supportsBinary||a.sid||(a.b64=1),a=f.encode(a),this.port&&("https"===b&&443!==Number(this.port)||"http"===b&&80!==Number(this.port))&&(c=":"+this.port),a.length&&(a="?"+a);var d=this.hostname.indexOf(":")!==-1;return b+"://"+(d?"["+this.hostname+"]":this.hostname)+c+this.path+a}},function(a,b,c){function d(a){this.path=a.path,this.hostname=a.hostname,this.port=a.port,this.secure=a.secure,this.query=a.query,this.timestampParam=a.timestampParam,this.timestampRequests=a.timestampRequests,this.readyState="",this.agent=a.agent||!1,this.socket=a.socket,this.enablesXDR=a.enablesXDR,this.pfx=a.pfx,this.key=a.key,this.passphrase=a.passphrase,this.cert=a.cert,this.ca=a.ca,this.ciphers=a.ciphers,this.rejectUnauthorized=a.rejectUnauthorized,this.forceNode=a.forceNode,this.extraHeaders=a.extraHeaders,this.localAddress=a.localAddress}var e=c(23),f=c(8);a.exports=d,f(d.prototype),d.prototype.onError=function(a,b){var c=new Error(a);return c.type="TransportError",c.description=b,this.emit("error",c),this},d.prototype.open=function(){return"closed"!==this.readyState&&""!==this.readyState||(this.readyState="opening",this.doOpen()),this},d.prototype.close=function(){return"opening"!==this.readyState&&"open"!==this.readyState||(this.doClose(),this.onClose()),this},d.prototype.send=function(a){if("open"!==this.readyState)throw new Error("Transport not open");this.write(a)},d.prototype.onOpen=function(){this.readyState="open",this.writable=!0,this.emit("open")},d.prototype.onData=function(a){var b=e.decodePacket(a,this.socket.binaryType);this.onPacket(b)},d.prototype.onPacket=function(a){this.emit("packet",a)},d.prototype.onClose=function(){this.readyState="closed",this.emit("close")}},function(a,b,c){(function(a){function d(a,c){var d="b"+b.packets[a.type]+a.data.data;return c(d)}function e(a,c,d){if(!c)return b.encodeBase64Packet(a,d);var e=a.data,f=new Uint8Array(e),g=new Uint8Array(1+e.byteLength);g[0]=s[a.type];for(var h=0;h<f.length;h++)g[h+1]=f[h];return d(g.buffer)}function f(a,c,d){if(!c)return b.encodeBase64Packet(a,d);var e=new FileReader;return e.onload=function(){a.data=e.result,b.encodePacket(a,c,!0,d)},e.readAsArrayBuffer(a.data)}function g(a,c,d){if(!c)return b.encodeBase64Packet(a,d);if(r)return f(a,c,d);var e=new Uint8Array(1);e[0]=s[a.type];var g=new v([e.buffer,a.data]);return d(g)}function h(a){try{a=o.decode(a,{strict:!1})}catch(b){return!1}return a}function i(a,b,c){for(var d=new Array(a.length),e=n(a.length,c),f=function(a,c,e){b(c,function(b,c){d[a]=c,e(b,d)})},g=0;g<a.length;g++)f(g,a[g],e)}var j,k=c(24),l=c(9),m=c(25),n=c(26),o=c(27);a&&a.ArrayBuffer&&(j=c(29));var p="undefined"!=typeof navigator&&/Android/i.test(navigator.userAgent),q="undefined"!=typeof navigator&&/PhantomJS/i.test(navigator.userAgent),r=p||q;b.protocol=3;var s=b.packets={open:0,close:1,ping:2,pong:3,message:4,upgrade:5,noop:6},t=k(s),u={type:"error",data:"parser error"},v=c(30);b.encodePacket=function(b,c,f,h){"function"==typeof c&&(h=c,c=!1),"function"==typeof f&&(h=f,f=null);var i=void 0===b.data?void 0:b.data.buffer||b.data;if(a.ArrayBuffer&&i instanceof ArrayBuffer)return e(b,c,h);if(v&&i instanceof a.Blob)return g(b,c,h);if(i&&i.base64)return d(b,h);var j=s[b.type];return void 0!==b.data&&(j+=f?o.encode(String(b.data),{strict:!1}):String(b.data)),h(""+j)},b.encodeBase64Packet=function(c,d){var e="b"+b.packets[c.type];if(v&&c.data instanceof a.Blob){var f=new FileReader;return f.onload=function(){var a=f.result.split(",")[1];d(e+a)},f.readAsDataURL(c.data)}var g;try{g=String.fromCharCode.apply(null,new Uint8Array(c.data))}catch(h){for(var i=new Uint8Array(c.data),j=new Array(i.length),k=0;k<i.length;k++)j[k]=i[k];g=String.fromCharCode.apply(null,j)}return e+=a.btoa(g),d(e)},b.decodePacket=function(a,c,d){if(void 0===a)return u;if("string"==typeof a){if("b"===a.charAt(0))return b.decodeBase64Packet(a.substr(1),c);if(d&&(a=h(a),a===!1))return u;var e=a.charAt(0);return Number(e)==e&&t[e]?a.length>1?{type:t[e],data:a.substring(1)}:{type:t[e]}:u}var f=new Uint8Array(a),e=f[0],g=m(a,1);return v&&"blob"===c&&(g=new v([g])),{type:t[e],data:g}},b.decodeBase64Packet=function(a,b){var c=t[a.charAt(0)];if(!j)return{type:c,data:{base64:!0,data:a.substr(1)}};var d=j.decode(a.substr(1));return"blob"===b&&v&&(d=new v([d])),{type:c,data:d}},b.encodePayload=function(a,c,d){function e(a){return a.length+":"+a}function f(a,d){b.encodePacket(a,!!g&&c,!1,function(a){d(null,e(a))})}"function"==typeof c&&(d=c,c=null);var g=l(a);return c&&g?v&&!r?b.encodePayloadAsBlob(a,d):b.encodePayloadAsArrayBuffer(a,d):a.length?void i(a,f,function(a,b){return d(b.join(""))}):d("0:")},b.decodePayload=function(a,c,d){if("string"!=typeof a)return b.decodePayloadAsBinary(a,c,d);"function"==typeof c&&(d=c,c=null);var e;if(""===a)return d(u,0,1);for(var f,g,h="",i=0,j=a.length;i<j;i++){var k=a.charAt(i);if(":"===k){if(""===h||h!=(f=Number(h)))return d(u,0,1);if(g=a.substr(i+1,f),h!=g.length)return d(u,0,1);if(g.length){if(e=b.decodePacket(g,c,!1),u.type===e.type&&u.data===e.data)return d(u,0,1);var l=d(e,i+f,j);if(!1===l)return}i+=f,h=""}else h+=k}return""!==h?d(u,0,1):void 0},b.encodePayloadAsArrayBuffer=function(a,c){function d(a,c){b.encodePacket(a,!0,!0,function(a){return c(null,a)})}return a.length?void i(a,d,function(a,b){var d=b.reduce(function(a,b){var c;return c="string"==typeof b?b.length:b.byteLength,a+c.toString().length+c+2},0),e=new Uint8Array(d),f=0;return b.forEach(function(a){var b="string"==typeof a,c=a;if(b){for(var d=new Uint8Array(a.length),g=0;g<a.length;g++)d[g]=a.charCodeAt(g);c=d.buffer}b?e[f++]=0:e[f++]=1;for(var h=c.byteLength.toString(),g=0;g<h.length;g++)e[f++]=parseInt(h[g]);e[f++]=255;for(var d=new Uint8Array(c),g=0;g<d.length;g++)e[f++]=d[g]}),c(e.buffer)}):c(new ArrayBuffer(0))},b.encodePayloadAsBlob=function(a,c){function d(a,c){b.encodePacket(a,!0,!0,function(a){var b=new Uint8Array(1);if(b[0]=1,"string"==typeof a){for(var d=new Uint8Array(a.length),e=0;e<a.length;e++)d[e]=a.charCodeAt(e);a=d.buffer,b[0]=0}for(var f=a instanceof ArrayBuffer?a.byteLength:a.size,g=f.toString(),h=new Uint8Array(g.length+1),e=0;e<g.length;e++)h[e]=parseInt(g[e]);if(h[g.length]=255,v){var i=new v([b.buffer,h.buffer,a]);c(null,i)}})}i(a,d,function(a,b){return c(new v(b))})},b.decodePayloadAsBinary=function(a,c,d){"function"==typeof c&&(d=c,c=null);for(var e=a,f=[];e.byteLength>0;){for(var g=new Uint8Array(e),h=0===g[0],i="",j=1;255!==g[j];j++){if(i.length>310)return d(u,0,1);i+=g[j]}e=m(e,2+i.length),i=parseInt(i);var k=m(e,0,i);if(h)try{k=String.fromCharCode.apply(null,new Uint8Array(k))}catch(l){var n=new Uint8Array(k);k="";for(var j=0;j<n.length;j++)k+=String.fromCharCode(n[j])}f.push(k),e=m(e,i)}var o=f.length;f.forEach(function(a,e){d(b.decodePacket(a,c,!0),e,o)})}}).call(b,function(){return this}())},function(a,b){a.exports=Object.keys||function(a){var b=[],c=Object.prototype.hasOwnProperty;for(var d in a)c.call(a,d)&&b.push(d);return b}},function(a,b){a.exports=function(a,b,c){var d=a.byteLength;if(b=b||0,c=c||d,a.slice)return a.slice(b,c);if(b<0&&(b+=d),c<0&&(c+=d),c>d&&(c=d),b>=d||b>=c||0===d)return new ArrayBuffer(0);for(var e=new Uint8Array(a),f=new Uint8Array(c-b),g=b,h=0;g<c;g++,h++)f[h]=e[g];return f.buffer}},function(a,b){function c(a,b,c){function e(a,d){if(e.count<=0)throw new Error("after called too many times");--e.count,a?(f=!0,b(a),b=c):0!==e.count||f||b(null,d)}var f=!1;return c=c||d,e.count=a,0===a?b():e}function d(){}a.exports=c},function(a,b,c){var d;(function(a,e){!function(f){function g(a){for(var b,c,d=[],e=0,f=a.length;e<f;)b=a.charCodeAt(e++),b>=55296&&b<=56319&&e<f?(c=a.charCodeAt(e++),56320==(64512&c)?d.push(((1023&b)<<10)+(1023&c)+65536):(d.push(b),e--)):d.push(b);return d}function h(a){for(var b,c=a.length,d=-1,e="";++d<c;)b=a[d],b>65535&&(b-=65536,e+=u(b>>>10&1023|55296),b=56320|1023&b),e+=u(b);return e}function i(a,b){if(a>=55296&&a<=57343){if(b)throw Error("Lone surrogate U+"+a.toString(16).toUpperCase()+" is not a scalar value");return!1}return!0}function j(a,b){return u(a>>b&63|128)}function k(a,b){if(0==(4294967168&a))return u(a);var c="";return 0==(4294965248&a)?c=u(a>>6&31|192):0==(4294901760&a)?(i(a,b)||(a=65533),c=u(a>>12&15|224),c+=j(a,6)):0==(4292870144&a)&&(c=u(a>>18&7|240),c+=j(a,12),c+=j(a,6)),c+=u(63&a|128)}function l(a,b){b=b||{};for(var c,d=!1!==b.strict,e=g(a),f=e.length,h=-1,i="";++h<f;)c=e[h],i+=k(c,d);return i}function m(){if(t>=s)throw Error("Invalid byte index");var a=255&r[t];if(t++,128==(192&a))return 63&a;throw Error("Invalid continuation byte")}function n(a){var b,c,d,e,f;if(t>s)throw Error("Invalid byte index");if(t==s)return!1;if(b=255&r[t],t++,0==(128&b))return b;if(192==(224&b)){if(c=m(),f=(31&b)<<6|c,f>=128)return f;throw Error("Invalid continuation byte")}if(224==(240&b)){if(c=m(),d=m(),f=(15&b)<<12|c<<6|d,f>=2048)return i(f,a)?f:65533;throw Error("Invalid continuation byte")}if(240==(248&b)&&(c=m(),d=m(),e=m(),f=(7&b)<<18|c<<12|d<<6|e,f>=65536&&f<=1114111))return f;throw Error("Invalid UTF-8 detected")}function o(a,b){b=b||{};var c=!1!==b.strict;r=g(a),s=r.length,t=0;for(var d,e=[];(d=n(c))!==!1;)e.push(d);return h(e)}var p="object"==typeof b&&b,q=("object"==typeof a&&a&&a.exports==p&&a,"object"==typeof e&&e);q.global!==q&&q.window!==q||(f=q);var r,s,t,u=String.fromCharCode,v={version:"2.1.2",encode:l,decode:o};d=function(){return v}.call(b,c,b,a),!(void 0!==d&&(a.exports=d))}(this)}).call(b,c(28)(a),function(){return this}())},function(a,b){a.exports=function(a){return a.webpackPolyfill||(a.deprecate=function(){},a.paths=[],a.children=[],a.webpackPolyfill=1),a}},function(a,b){!function(){"use strict";for(var a="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",c=new Uint8Array(256),d=0;d<a.length;d++)c[a.charCodeAt(d)]=d;b.encode=function(b){var c,d=new Uint8Array(b),e=d.length,f="";for(c=0;c<e;c+=3)f+=a[d[c]>>2],f+=a[(3&d[c])<<4|d[c+1]>>4],f+=a[(15&d[c+1])<<2|d[c+2]>>6],f+=a[63&d[c+2]];return e%3===2?f=f.substring(0,f.length-1)+"=":e%3===1&&(f=f.substring(0,f.length-2)+"=="),f},b.decode=function(a){var b,d,e,f,g,h=.75*a.length,i=a.length,j=0;"="===a[a.length-1]&&(h--,"="===a[a.length-2]&&h--);var k=new ArrayBuffer(h),l=new Uint8Array(k);for(b=0;b<i;b+=4)d=c[a.charCodeAt(b)],e=c[a.charCodeAt(b+1)],f=c[a.charCodeAt(b+2)],g=c[a.charCodeAt(b+3)],l[j++]=d<<2|e>>4,l[j++]=(15&e)<<4|f>>2,l[j++]=(3&f)<<6|63&g;return k}}()},function(a,b){(function(b){function c(a){for(var b=0;b<a.length;b++){var c=a[b];if(c.buffer instanceof ArrayBuffer){var d=c.buffer;if(c.byteLength!==d.byteLength){var e=new Uint8Array(c.byteLength);e.set(new Uint8Array(d,c.byteOffset,c.byteLength)),d=e.buffer}a[b]=d}}}function d(a,b){b=b||{};var d=new f;c(a);for(var e=0;e<a.length;e++)d.append(a[e]);return b.type?d.getBlob(b.type):d.getBlob()}function e(a,b){return c(a),new Blob(a,b||{})}var f=b.BlobBuilder||b.WebKitBlobBuilder||b.MSBlobBuilder||b.MozBlobBuilder,g=function(){try{var a=new Blob(["hi"]);return 2===a.size}catch(b){return!1}}(),h=g&&function(){try{var a=new Blob([new Uint8Array([1,2])]);return 2===a.size}catch(b){return!1}}(),i=f&&f.prototype.append&&f.prototype.getBlob;a.exports=function(){return g?h?b.Blob:e:i?d:void 0}()}).call(b,function(){return this}())},function(a,b){b.encode=function(a){var b="";for(var c in a)a.hasOwnProperty(c)&&(b.length&&(b+="&"),b+=encodeURIComponent(c)+"="+encodeURIComponent(a[c]));return b},b.decode=function(a){for(var b={},c=a.split("&"),d=0,e=c.length;d<e;d++){var f=c[d].split("=");b[decodeURIComponent(f[0])]=decodeURIComponent(f[1])}return b}},function(a,b){a.exports=function(a,b){var c=function(){};c.prototype=b.prototype,a.prototype=new c,a.prototype.constructor=a}},function(a,b){"use strict";function c(a){var b="";do b=g[a%h]+b,a=Math.floor(a/h);while(a>0);return b}function d(a){var b=0;for(k=0;k<a.length;k++)b=b*h+i[a.charAt(k)];return b}function e(){var a=c(+new Date);return a!==f?(j=0,f=a):a+"."+c(j++)}for(var f,g="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_".split(""),h=64,i={},j=0,k=0;k<h;k++)i[g[k]]=k;e.encode=c,e.decode=d,a.exports=e},function(a,b,c){(function(b){function d(){}function e(a){f.call(this,a),this.query=this.query||{},h||(b.___eio||(b.___eio=[]),h=b.___eio),this.index=h.length;var c=this;h.push(function(a){c.onData(a)}),this.query.j=this.index,b.document&&b.addEventListener&&b.addEventListener("beforeunload",function(){c.script&&(c.script.onerror=d)},!1)}var f=c(21),g=c(32);a.exports=e;var h,i=/\n/g,j=/\\n/g;g(e,f),e.prototype.supportsBinary=!1,e.prototype.doClose=function(){this.script&&(this.script.parentNode.removeChild(this.script),this.script=null),this.form&&(this.form.parentNode.removeChild(this.form),this.form=null,this.iframe=null),f.prototype.doClose.call(this)},e.prototype.doPoll=function(){var a=this,b=document.createElement("script");this.script&&(this.script.parentNode.removeChild(this.script),this.script=null),b.async=!0,b.src=this.uri(),b.onerror=function(b){a.onError("jsonp poll error",b)};var c=document.getElementsByTagName("script")[0];c?c.parentNode.insertBefore(b,c):(document.head||document.body).appendChild(b),this.script=b;var d="undefined"!=typeof navigator&&/gecko/i.test(navigator.userAgent);d&&setTimeout(function(){var a=document.createElement("iframe");document.body.appendChild(a),document.body.removeChild(a)},100)},e.prototype.doWrite=function(a,b){function c(){d(),b()}function d(){if(e.iframe)try{e.form.removeChild(e.iframe)}catch(a){e.onError("jsonp polling iframe removal error",a)}try{var b='<iframe src="javascript:0" name="'+e.iframeId+'">';f=document.createElement(b)}catch(a){f=document.createElement("iframe"),f.name=e.iframeId,f.src="javascript:0"}f.id=e.iframeId,e.form.appendChild(f),e.iframe=f}var e=this;if(!this.form){var f,g=document.createElement("form"),h=document.createElement("textarea"),k=this.iframeId="eio_iframe_"+this.index;g.className="socketio",g.style.position="absolute",g.style.top="-1000px",g.style.left="-1000px",g.target=k,g.method="POST",g.setAttribute("accept-charset","utf-8"),h.name="d",g.appendChild(h),document.body.appendChild(g),this.form=g,this.area=h}this.form.action=this.uri(),d(),a=a.replace(j,"\\\n"),this.area.value=a.replace(i,"\\n");try{this.form.submit()}catch(l){}this.iframe.attachEvent?this.iframe.onreadystatechange=function(){"complete"===e.iframe.readyState&&c()}:this.iframe.onload=c}}).call(b,function(){return this}())},function(a,b,c){(function(b){function d(a){var b=a&&a.forceBase64;b&&(this.supportsBinary=!1),this.perMessageDeflate=a.perMessageDeflate,this.usingBrowserWebSocket=l&&!a.forceNode,this.protocols=a.protocols,this.usingBrowserWebSocket||(n=e),f.call(this,a)}var e,f=c(22),g=c(23),h=c(31),i=c(32),j=c(33),k=c(3)("engine.io-client:websocket"),l=b.WebSocket||b.MozWebSocket;if("undefined"==typeof window)try{e=c(36)}catch(m){}var n=l;n||"undefined"!=typeof window||(n=e),a.exports=d,i(d,f),d.prototype.name="websocket",d.prototype.supportsBinary=!0,d.prototype.doOpen=function(){if(this.check()){var a=this.uri(),b=this.protocols,c={agent:this.agent,perMessageDeflate:this.perMessageDeflate};c.pfx=this.pfx,c.key=this.key,c.passphrase=this.passphrase,c.cert=this.cert,c.ca=this.ca,c.ciphers=this.ciphers,c.rejectUnauthorized=this.rejectUnauthorized,this.extraHeaders&&(c.headers=this.extraHeaders),this.localAddress&&(c.localAddress=this.localAddress);try{this.ws=this.usingBrowserWebSocket?b?new n(a,b):new n(a):new n(a,b,c)}catch(d){return this.emit("error",d)}void 0===this.ws.binaryType&&(this.supportsBinary=!1),this.ws.supports&&this.ws.supports.binary?(this.supportsBinary=!0,this.ws.binaryType="nodebuffer"):this.ws.binaryType="arraybuffer",this.addEventListeners()}},d.prototype.addEventListeners=function(){var a=this;this.ws.onopen=function(){a.onOpen()},this.ws.onclose=function(){a.onClose()},this.ws.onmessage=function(b){a.onData(b.data)},this.ws.onerror=function(b){a.onError("websocket error",b)}},d.prototype.write=function(a){function c(){d.emit("flush"),setTimeout(function(){d.writable=!0,d.emit("drain")},0)}var d=this;this.writable=!1;for(var e=a.length,f=0,h=e;f<h;f++)!function(a){g.encodePacket(a,d.supportsBinary,function(f){if(!d.usingBrowserWebSocket){var g={};if(a.options&&(g.compress=a.options.compress),d.perMessageDeflate){var h="string"==typeof f?b.Buffer.byteLength(f):f.length;h<d.perMessageDeflate.threshold&&(g.compress=!1)}}try{d.usingBrowserWebSocket?d.ws.send(f):d.ws.send(f,g)}catch(i){k("websocket closed before onclose event")}--e||c()})}(a[f])},d.prototype.onClose=function(){f.prototype.onClose.call(this)},d.prototype.doClose=function(){"undefined"!=typeof this.ws&&this.ws.close()},d.prototype.uri=function(){var a=this.query||{},b=this.secure?"wss":"ws",c="";this.port&&("wss"===b&&443!==Number(this.port)||"ws"===b&&80!==Number(this.port))&&(c=":"+this.port),this.timestampRequests&&(a[this.timestampParam]=j()),this.supportsBinary||(a.b64=1),a=h.encode(a),a.length&&(a="?"+a);var d=this.hostname.indexOf(":")!==-1;return b+"://"+(d?"["+this.hostname+"]":this.hostname)+c+this.path+a},d.prototype.check=function(){return!(!n||"__initialize"in n&&this.name===d.prototype.name)}}).call(b,function(){return this}())},function(a,b){},function(a,b){var c=[].indexOf;a.exports=function(a,b){if(c)return a.indexOf(b);for(var d=0;d<a.length;++d)if(a[d]===b)return d;return-1}},function(a,b){(function(b){var c=/^[\],:{}\s]*$/,d=/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g,e=/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g,f=/(?:^|:|,)(?:\s*\[)+/g,g=/^\s+/,h=/\s+$/;a.exports=function(a){return"string"==typeof a&&a?(a=a.replace(g,"").replace(h,""),b.JSON&&JSON.parse?JSON.parse(a):c.test(a.replace(d,"@").replace(e,"]").replace(f,""))?new Function("return "+a)():void 0):null}}).call(b,function(){return this}())},function(a,b,c){"use strict";function d(a,b,c){this.io=a,this.nsp=b,this.json=this,this.ids=0,this.acks={},this.receiveBuffer=[],this.sendBuffer=[],this.connected=!1,this.disconnected=!0,c&&c.query&&(this.query=c.query),this.io.autoConnect&&this.open()}var e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(a){return typeof a}:function(a){return a&&"function"==typeof Symbol&&a.constructor===Symbol&&a!==Symbol.prototype?"symbol":typeof a},f=c(7),g=c(8),h=c(40),i=c(41),j=c(42),k=c(3)("socket.io-client:socket"),l=c(31);a.exports=b=d;var m={connect:1,connect_error:1,connect_timeout:1,connecting:1,disconnect:1,error:1,reconnect:1,reconnect_attempt:1,reconnect_failed:1,reconnect_error:1,reconnecting:1,ping:1,pong:1},n=g.prototype.emit;g(d.prototype),d.prototype.subEvents=function(){if(!this.subs){var a=this.io;this.subs=[i(a,"open",j(this,"onopen")),i(a,"packet",j(this,"onpacket")),i(a,"close",j(this,"onclose"))]}},d.prototype.open=d.prototype.connect=function(){return this.connected?this:(this.subEvents(),this.io.open(),"open"===this.io.readyState&&this.onopen(),this.emit("connecting"),this)},d.prototype.send=function(){var a=h(arguments);return a.unshift("message"),this.emit.apply(this,a),this},d.prototype.emit=function(a){if(m.hasOwnProperty(a))return n.apply(this,arguments),this;var b=h(arguments),c={type:f.EVENT,data:b};return c.options={},c.options.compress=!this.flags||!1!==this.flags.compress,"function"==typeof b[b.length-1]&&(k("emitting packet with ack id %d",this.ids),this.acks[this.ids]=b.pop(),c.id=this.ids++),this.connected?this.packet(c):this.sendBuffer.push(c),delete this.flags,this},d.prototype.packet=function(a){a.nsp=this.nsp,this.io.packet(a)},d.prototype.onopen=function(){if(k("transport is open - connecting"),"/"!==this.nsp)if(this.query){var a="object"===e(this.query)?l.encode(this.query):this.query;k("sending connect packet with query %s",a),this.packet({type:f.CONNECT,query:a})}else this.packet({type:f.CONNECT})},d.prototype.onclose=function(a){k("close (%s)",a),this.connected=!1,this.disconnected=!0,delete this.id,this.emit("disconnect",a)},d.prototype.onpacket=function(a){if(a.nsp===this.nsp)switch(a.type){case f.CONNECT:this.onconnect();break;case f.EVENT:this.onevent(a);break;case f.BINARY_EVENT:this.onevent(a);break;case f.ACK:this.onack(a);break;case f.BINARY_ACK:this.onack(a);break;case f.DISCONNECT:this.ondisconnect();break;case f.ERROR:this.emit("error",a.data)}},d.prototype.onevent=function(a){var b=a.data||[];k("emitting event %j",b),null!=a.id&&(k("attaching ack callback to event"),b.push(this.ack(a.id))),this.connected?n.apply(this,b):this.receiveBuffer.push(b)},d.prototype.ack=function(a){var b=this,c=!1;return function(){if(!c){c=!0;var d=h(arguments);k("sending ack %j",d),b.packet({type:f.ACK,id:a,data:d})}}},d.prototype.onack=function(a){var b=this.acks[a.id];"function"==typeof b?(k("calling ack %s with %j",a.id,a.data),b.apply(this,a.data),delete this.acks[a.id]):k("bad ack %s",a.id)},d.prototype.onconnect=function(){this.connected=!0,this.disconnected=!1,this.emit("connect"),this.emitBuffered()},d.prototype.emitBuffered=function(){var a;for(a=0;a<this.receiveBuffer.length;a++)n.apply(this,this.receiveBuffer[a]);for(this.receiveBuffer=[],a=0;a<this.sendBuffer.length;a++)this.packet(this.sendBuffer[a]);this.sendBuffer=[]},d.prototype.ondisconnect=function(){k("server disconnect (%s)",this.nsp),this.destroy(),this.onclose("io server disconnect")},d.prototype.destroy=function(){if(this.subs){for(var a=0;a<this.subs.length;a++)this.subs[a].destroy();this.subs=null}this.io.destroy(this)},d.prototype.close=d.prototype.disconnect=function(){return this.connected&&(k("performing disconnect (%s)",this.nsp),this.packet({type:f.DISCONNECT})),this.destroy(),this.connected&&this.onclose("io client disconnect"),this},d.prototype.compress=function(a){return this.flags=this.flags||{},this.flags.compress=a,this}},function(a,b){function c(a,b){var c=[];b=b||0;for(var d=b||0;d<a.length;d++)c[d-b]=a[d];return c}a.exports=c},function(a,b){"use strict";function c(a,b,c){return a.on(b,c),{destroy:function(){a.removeListener(b,c)}}}a.exports=c},function(a,b){var c=[].slice;a.exports=function(a,b){if("string"==typeof b&&(b=a[b]),"function"!=typeof b)throw new Error("bind() requires a function");var d=c.call(arguments,2);return function(){return b.apply(a,d.concat(c.call(arguments)))}}},function(a,b){function c(a){a=a||{},this.ms=a.min||100,this.max=a.max||1e4,this.factor=a.factor||2,this.jitter=a.jitter>0&&a.jitter<=1?a.jitter:0,this.attempts=0}a.exports=c,c.prototype.duration=function(){var a=this.ms*Math.pow(this.factor,this.attempts++);if(this.jitter){var b=Math.random(),c=Math.floor(b*this.jitter*a);a=0==(1&Math.floor(10*b))?a-c:a+c}return 0|Math.min(a,this.max)},c.prototype.reset=function(){this.attempts=0},c.prototype.setMin=function(a){this.ms=a},c.prototype.setMax=function(a){this.max=a},c.prototype.setJitter=function(a){this.jitter=a}}])});;
+
+//////////////////////////////////////////////////////////////////////////////////////
+ //                                                                                //
+ //  ███████╗ █████╗ ██╗██╗     ███████╗   ██╗ ██████╗         ██╗███████╗         //
+ //  ██╔════╝██╔══██╗██║██║     ██╔════╝   ██║██╔═══██╗        ██║██╔════╝         //
+ //  ███████╗███████║██║██║     ███████╗   ██║██║   ██║        ██║███████╗         //
+ //  ╚════██║██╔══██║██║██║     ╚════██║   ██║██║   ██║   ██   ██║╚════██║         //
+ //  ███████║██║  ██║██║███████╗███████║██╗██║╚██████╔╝██╗╚█████╔╝███████║         //
+ //  ╚══════╝╚═╝  ╚═╝╚═╝╚══════╝╚══════╝╚═╝╚═╝ ╚═════╝ ╚═╝ ╚════╝ ╚══════╝         //
+ //                                                                                //
+ //   ╦╔═╗╦  ╦╔═╗╔═╗╔═╗╦═╗╦╔═╗╔╦╗  ╔═╗╦  ╦╔═╗╔╗╔╔╦╗  ╔═╗╔╦╗╦╔═                     //
+ //   ║╠═╣╚╗╔╝╠═╣╚═╗║  ╠╦╝║╠═╝ ║   ║  ║  ║║╣ ║║║ ║   ╚═╗ ║║╠╩╗                     //
+ //  ╚╝╩ ╩ ╚╝ ╩ ╩╚═╝╚═╝╩╚═╩╩   ╩   ╚═╝╩═╝╩╚═╝╝╚╝ ╩   ╚═╝═╩╝╩ ╩                     //
+ //  ┌─┐┌─┐┬─┐  ┌┐┌┌─┐┌┬┐┌─┐  ┬┌─┐  ┌─┐┌┐┌┌┬┐  ┌┬┐┬ ┬┌─┐  ┌┐ ┬─┐┌─┐┬ ┬┌─┐┌─┐┬─┐    //
+ //  ├┤ │ │├┬┘  ││││ │ ││├┤   │└─┐  ├─┤│││ ││   │ ├─┤├┤   ├┴┐├┬┘│ ││││└─┐├┤ ├┬┘    //
+ //  └  └─┘┴└─  ┘└┘└─┘─┴┘└─┘o└┘└─┘  ┴ ┴┘└┘─┴┘   ┴ ┴ ┴└─┘  └─┘┴└─└─┘└┴┘└─┘└─┘┴└─    //
+ //                                                                                //
+//////////////////////////////////////////////////////////////////////////////////////
+
+/**
+ * sails.io.js
+ * v1.2.1
+ * ------------------------------------------------------------------------
+ * JavaScript Client (SDK) for communicating with Sails.
+ *
+ * Note that this script is completely optional, but it is handy if you're
+ * using WebSockets from the browser to talk to your Sails server.
+ *
+ * For tips and documentation, visit:
+ * http://sailsjs.com/documentation/reference/web-sockets/socket-client
+ * ------------------------------------------------------------------------
+ *
+ * This file allows you to send and receive socket.io messages to & from Sails
+ * by simulating a REST client interface on top of socket.io. It models its API
+ * after the $.ajax pattern from jQuery you might already be familiar with.
+ *
+ * So if you're switching from using AJAX to sockets, instead of:
+ *    `$.post( url, [data], [cb] )`
+ *
+ * You would use:
+ *    `socket.post( url, [data], [cb] )`
+ */
+
+
+(function() {
+
+
+  //   ██████╗ ██████╗ ███╗   ██╗███████╗████████╗ █████╗ ███╗   ██╗████████╗███████╗
+  //  ██╔════╝██╔═══██╗████╗  ██║██╔════╝╚══██╔══╝██╔══██╗████╗  ██║╚══██╔══╝██╔════╝
+  //  ██║     ██║   ██║██╔██╗ ██║███████╗   ██║   ███████║██╔██╗ ██║   ██║   ███████╗
+  //  ██║     ██║   ██║██║╚██╗██║╚════██║   ██║   ██╔══██║██║╚██╗██║   ██║   ╚════██║
+  //  ╚██████╗╚██████╔╝██║ ╚████║███████║   ██║   ██║  ██║██║ ╚████║   ██║   ███████║
+  //   ╚═════╝ ╚═════╝ ╚═╝  ╚═══╝╚══════╝   ╚═╝   ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚══════╝
+  //
+
+
+  /**
+   * Constant containing the names of all available options
+   * for individual sockets.
+   *
+   * @type {Array}
+   */
+  var SOCKET_OPTIONS = [
+    'useCORSRouteToGetCookie',
+    'url',
+    'multiplex',
+    'transports',
+    'query',
+    'path',
+    'headers',
+    'initialConnectionHeaders',
+    'reconnection',
+    'reconnectionAttempts',
+    'reconnectionDelay',
+    'reconnectionDelayMax',
+    'rejectUnauthorized',
+    'randomizationFactor',
+    'timeout'
+  ];
+
+
+  /**
+   * Constant containing the names of properties on `io.sails` which
+   * may be configured using HTML attributes on the script tag which
+   * loaded this file.
+   *
+   * @type {Array}
+   *
+   * (this is unused if loading from node.js)
+   */
+  var CONFIGURABLE_VIA_HTML_ATTR = [
+    'autoConnect',
+    'reconnection',
+    'environment',
+    'headers',
+    'url',
+    'transports',
+    'path'
+  ];
+
+
+
+
+  /**
+   * Constant containing the names of querystring
+   * parameters sent when connecting any SailsSocket.
+   *
+   * @type {Dictionary}
+   */
+  var CONNECTION_METADATA_PARAMS = {
+    version: '__sails_io_sdk_version',
+    platform: '__sails_io_sdk_platform',
+    language: '__sails_io_sdk_language'
+  };
+
+
+  /**
+   * Constant containing metadata about the platform, language, and
+   * current version of this SDK.
+   *
+   * @type {Dictionary}
+   */
+  var SDK_INFO = {
+    version: '1.2.1', // <-- pulled automatically from package.json, do not change!
+    language: 'javascript',
+    platform: (function (){
+      if (typeof module === 'object' && typeof module.exports !== 'undefined') {
+        return 'node';
+      }
+      else {
+        return 'browser';
+      }
+    })()
+  };
+
+  // Build `versionString` (a querystring snippet) by
+  // combining SDK_INFO and CONNECTION_METADATA_PARAMS.
+  SDK_INFO.versionString =
+    CONNECTION_METADATA_PARAMS.version + '=' + SDK_INFO.version + '&' +
+    CONNECTION_METADATA_PARAMS.platform + '=' + SDK_INFO.platform + '&' +
+    CONNECTION_METADATA_PARAMS.language + '=' + SDK_INFO.language;
+
+
+
+
+  //   █████╗ ██████╗ ███████╗ ██████╗ ██████╗ ██████╗     ██╗  ██╗████████╗███╗   ███╗██╗
+  //  ██╔══██╗██╔══██╗██╔════╝██╔═══██╗██╔══██╗██╔══██╗    ██║  ██║╚══██╔══╝████╗ ████║██║
+  //  ███████║██████╔╝███████╗██║   ██║██████╔╝██████╔╝    ███████║   ██║   ██╔████╔██║██║
+  //  ██╔══██║██╔══██╗╚════██║██║   ██║██╔══██╗██╔══██╗    ██╔══██║   ██║   ██║╚██╔╝██║██║
+  //  ██║  ██║██████╔╝███████║╚██████╔╝██║  ██║██████╔╝    ██║  ██║   ██║   ██║ ╚═╝ ██║███████╗
+  //  ╚═╝  ╚═╝╚═════╝ ╚══════╝ ╚═════╝ ╚═╝  ╚═╝╚═════╝     ╚═╝  ╚═╝   ╚═╝   ╚═╝     ╚═╝╚══════╝
+  //
+  //   █████╗ ████████╗████████╗██████╗ ██╗██████╗ ██╗   ██╗████████╗███████╗███████╗
+  //  ██╔══██╗╚══██╔══╝╚══██╔══╝██╔══██╗██║██╔══██╗██║   ██║╚══██╔══╝██╔════╝██╔════╝
+  //  ███████║   ██║      ██║   ██████╔╝██║██████╔╝██║   ██║   ██║   █████╗  ███████╗
+  //  ██╔══██║   ██║      ██║   ██╔══██╗██║██╔══██╗██║   ██║   ██║   ██╔══╝  ╚════██║
+  //  ██║  ██║   ██║      ██║   ██║  ██║██║██████╔╝╚██████╔╝   ██║   ███████╗███████║
+  //  ╚═╝  ╚═╝   ╚═╝      ╚═╝   ╚═╝  ╚═╝╚═╝╚═════╝  ╚═════╝    ╚═╝   ╚══════╝╚══════╝
+  //
+  //  ███████╗██████╗  ██████╗ ███╗   ███╗      ██╗███████╗ ██████╗██████╗ ██╗██████╗ ████████╗██╗
+  //  ██╔════╝██╔══██╗██╔═══██╗████╗ ████║     ██╔╝██╔════╝██╔════╝██╔══██╗██║██╔══██╗╚══██╔══╝╚██╗
+  //  █████╗  ██████╔╝██║   ██║██╔████╔██║    ██╔╝ ███████╗██║     ██████╔╝██║██████╔╝   ██║    ╚██╗
+  //  ██╔══╝  ██╔══██╗██║   ██║██║╚██╔╝██║    ╚██╗ ╚════██║██║     ██╔══██╗██║██╔═══╝    ██║    ██╔╝
+  //  ██║     ██║  ██║╚██████╔╝██║ ╚═╝ ██║     ╚██╗███████║╚██████╗██║  ██║██║██║        ██║   ██╔╝
+  //  ╚═╝     ╚═╝  ╚═╝ ╚═════╝ ╚═╝     ╚═╝      ╚═╝╚══════╝ ╚═════╝╚═╝  ╚═╝╚═╝╚═╝        ╚═╝   ╚═╝
+  //
+  //
+  // If available, grab the DOM element for the script tag which imported this file.
+  // (skip this if this SDK is being used outside of the DOM, i.e. in a Node process)
+  //
+  // This is used below to parse client-side sails.io.js configuration encoded as
+  // HTML attributes, as well as grabbing hold of the URL from whence the SDK was fetched.
+  var thisScriptTag = (function() {
+    if (
+      typeof window !== 'object' ||
+      typeof window.document !== 'object' ||
+      typeof window.document.getElementsByTagName !== 'function'
+    ) {
+      return null;
+    }
+
+    // Return the URL of the last script loaded (i.e. this one)
+    // (this must run before nextTick; see http://stackoverflow.com/a/2976714/486547)
+    var allScriptsCurrentlyInDOM = window.document.getElementsByTagName('script');
+    return allScriptsCurrentlyInDOM[allScriptsCurrentlyInDOM.length - 1];
+  })();
+
+
+  // Variables to contain src URL and other script tag config (for use below).
+  var urlThisScriptWasFetchedFrom = '';
+  var scriptTagConfig = {};
+
+
+  if (thisScriptTag) {
+    // Save the URL that this script was fetched from.
+    urlThisScriptWasFetchedFrom = thisScriptTag.src;
+
+    // Now parse the most common client-side configuration settings
+    // from the script tag where they may be encoded as HTML attributes.
+    //
+    // Any configuration which may be provided as an HTML attribute may
+    // also be provided prefixed with `data-`.  This is for folks who
+    // need to support browsers that have issues with nonstandard
+    // HTML attributes (or if the idea of using nonstandard HTML attributes
+    // just creeps you out)
+    //
+    // If a `data-` prefixed attr is provided, it takes precedence.
+    // (this is so that if you are already using one of these HTML
+    //  attrs for some reason, you can keep it as-is and override
+    //  it using `data-`. If you are using the `data-` prefixed version
+    //  for some other purpose... well, in that case you'll just have to
+    //  configure programmatically using `io.sails` instead.)
+    CONFIGURABLE_VIA_HTML_ATTR.forEach(function (configKey){
+
+      scriptTagConfig[configKey] = (function (){
+
+        // Support 'data-' prefixed or normal attributes.
+        // (prefixed versions take precedence if provided)
+        var htmlAttrVal = thisScriptTag.getAttribute( 'data-'+configKey );
+        if (!htmlAttrVal) {
+          htmlAttrVal = thisScriptTag.getAttribute( configKey );
+        }
+
+        // The HTML attribute value should always be a string or `null`.
+        // We'll try to parse it as JSON and use that, but worst case fall back
+        // to the default situation of it being a string.
+        if (typeof htmlAttrVal === 'string') {
+          try { return JSON.parse(htmlAttrVal); } catch (e) { return htmlAttrVal; }
+        }
+        // If `null` was returned from getAttribute(), it means that the HTML attribute
+        // was not specified, so we treat it as undefined (which will cause the property
+        // to be removed below)
+        else if (htmlAttrVal === null) {
+          return undefined;
+        }
+        // Any other contingency shouldn't be possible:
+        // - if no quotes are used in the HTML attribute, it still comes in as a string.
+        // - if no RHS is provided for the attribute, it still comes in as "" (empty string)
+        // (but we still handle this with an explicit error just in case--for debugging and support purposes)
+        else throw new Error('sails.io.js :: Unexpected/invalid script tag configuration for `'+configKey+'`: `'+htmlAttrVal+'` (a `'+typeof htmlAttrVal+'`). Should be a string.');
+      })();
+
+      if (scriptTagConfig[configKey] === undefined){
+        delete scriptTagConfig[configKey];
+      }
+    });
+
+
+
+    // Now that they've been parsed, do an extremely lean version of
+    // logical type validation/coercion of provided values.
+    //////////////////////////////////////////////////////////////////
+
+    // `autoConnect`
+    if (typeof scriptTagConfig.autoConnect !== 'undefined') {
+      if (scriptTagConfig.autoConnect === '') {
+        // Special case for empty string.  It means `true` (see above).
+        scriptTagConfig.autoConnect = true;
+      }
+      else if (typeof scriptTagConfig.autoConnect !== 'boolean') {
+        throw new Error('sails.io.js :: Unexpected/invalid configuration for `autoConnect` provided in script tag: `'+scriptTagConfig.autoConnect+'` (a `'+typeof scriptTagConfig.autoConnect+'`). Should be a boolean.');
+      }
+    }
+
+
+    // `environment`
+    if (typeof scriptTagConfig.environment !== 'undefined') {
+      if (typeof scriptTagConfig.environment !== 'string') {
+        throw new Error('sails.io.js :: Unexpected/invalid configuration for `environment` provided in script tag: `'+scriptTagConfig.environment+'` (a `'+typeof scriptTagConfig.environment+'`). Should be a string.');
+      }
+    }
+
+
+    // `headers`
+    if (typeof scriptTagConfig.headers !== 'undefined') {
+      if (typeof scriptTagConfig.headers !== 'object' || Array.isArray(scriptTagConfig.headers)) {
+        throw new Error('sails.io.js :: Unexpected/invalid configuration for `headers` provided in script tag: `'+scriptTagConfig.headers+'` (a `'+typeof scriptTagConfig.headers+'`). Should be a JSON-compatible dictionary (i.e. `{}`).  Don\'t forget those double quotes (""), even on key names!  Use single quotes (\'\') to wrap the HTML attribute value; e.g. `headers=\'{"X-Auth": "foo"}\'`');
+      }
+    }
+
+
+    // `url`
+    if (typeof scriptTagConfig.url !== 'undefined') {
+      if (typeof scriptTagConfig.url !== 'string') {
+        throw new Error('sails.io.js :: Unexpected/invalid configuration for `url` provided in script tag: `'+scriptTagConfig.url+'` (a `'+typeof scriptTagConfig.url+'`). Should be a string.');
+      }
+    }
+
+    // OTHER `io.sails` options are NOT CURRENTLY SUPPORTED VIA HTML ATTRIBUTES.
+  }
+
+
+
+
+  // Grab a reference to the global socket.io client (if one is available).
+  // This is used via closure below to determine which `io` to use when the
+  // socket.io client instance (`io`) is augmented to become the Sails client
+  // SDK instance (still `io`).
+  var _existingGlobalSocketIO = (typeof io !== 'undefined') ? io : undefined;
+
+
+
+
+  //////////////////////////////////////////////////////////////
+  /////
+  ///// NOW FOR BUNCHES OF:
+  /////  - PRIVATE FUNCTION DEFINITIONS
+  /////  - CONSTRUCTORS
+  /////  - AND METHODS
+  /////
+  //////////////////////////////////////////////////////////////
+  //
+
+
+
+  //  ███████╗ █████╗ ██╗██╗     ███████╗      ██╗ ██████╗        ██████╗██╗     ██╗███████╗███╗   ██╗████████╗
+  //  ██╔════╝██╔══██╗██║██║     ██╔════╝      ██║██╔═══██╗      ██╔════╝██║     ██║██╔════╝████╗  ██║╚══██╔══╝
+  //  ███████╗███████║██║██║     ███████╗█████╗██║██║   ██║█████╗██║     ██║     ██║█████╗  ██╔██╗ ██║   ██║
+  //  ╚════██║██╔══██║██║██║     ╚════██║╚════╝██║██║   ██║╚════╝██║     ██║     ██║██╔══╝  ██║╚██╗██║   ██║
+  //  ███████║██║  ██║██║███████╗███████║      ██║╚██████╔╝      ╚██████╗███████╗██║███████╗██║ ╚████║   ██║
+  //  ╚══════╝╚═╝  ╚═╝╚═╝╚══════╝╚══════╝      ╚═╝ ╚═════╝        ╚═════╝╚══════╝╚═╝╚══════╝╚═╝  ╚═══╝   ╚═╝
+  //
+
+  /**
+   * SailsIOClient()
+   *
+   * Augment the provided Socket.io client object (`io`) with methods for
+   * talking and listening to one or more Sails backend(s).  If no `io` was
+   * provided (i.e. in a browser setting), then attempt to use the global.
+   *
+   * This absorbs implicit `io.sails` configuration, sets a timer for
+   * automatically connecting a socket (if `io.sails.autoConnect` is enabled)
+   * and returns the augmented `io`.
+   *
+   * Note:
+   * The automatically-connected socket is exposed as `io.socket`.  If this
+   * socket attempts to bind event listeners or send requests before it is
+   * connected, it will be queued up and replayed when the connection is
+   * successfully opened.
+   *
+   * @param {SocketIO} io
+   * @returns {SailsIOClient} [also called `io`]
+   */
+
+  function SailsIOClient(_providedSocketIO) {
+
+    // First, determine which `io` we're augmenting.
+    //
+    // Prefer the passed-in `io` instance, but fall back to the
+    // global one if we've got it.
+    var io;
+    if (_providedSocketIO) {
+      io = _providedSocketIO;
+    }
+    else {
+      io = _existingGlobalSocketIO;
+    }
+    // (note that for readability, we deliberately do not short circuit or use the tertiary operator above)
+
+
+    // If a socket.io client (`io`) is not available, none of this will work.
+    if (!io) {
+      // If node:
+      if (SDK_INFO.platform === 'node') {
+        throw new Error('No socket.io client available.  When requiring `sails.io.js` from Node.js, a socket.io client (`io`) must be passed in; e.g.:\n```\nvar io = require(\'sails.io.js\')( require(\'socket.io-client\') )\n```\n(see https://github.com/balderdashy/sails.io.js/tree/master/test for more examples)');
+      }
+      // Otherwise, this is a web browser:
+      else {
+        throw new Error('The Sails socket SDK depends on the socket.io client, but the socket.io global (`io`) was not available when `sails.io.js` loaded.  Normally, the socket.io client code is bundled with sails.io.js, so something is a little off.  Please check to be sure this version of `sails.io.js` has the minified Socket.io client at the top of the file.');
+      }
+    }
+
+    // If the chosen socket.io client (`io`) has ALREADY BEEN AUGMENTED by this SDK,
+    // (i.e. if it already has a `.sails` property) then throw an error.
+    if (io.sails) {
+      // If node:
+      if (SDK_INFO.platform === 'node') {
+        throw new Error('The provided socket.io client (`io`) has already been augmented into a Sails socket SDK instance (it has `io.sails`).');
+      }
+      // Otherwise, this is a web browser:
+      else {
+        throw new Error('The socket.io client (`io`) has already been augmented into a Sails socket SDK instance.  Usually, this means you are bringing `sails.io.js` onto the page more than once.');
+      }
+    }
+
+
+    /**
+     * A little logger for this library to use internally.
+     * Basically just a wrapper around `console.log` with
+     * support for feature-detection.
+     *
+     * @api private
+     * @factory
+     */
+    function LoggerFactory(options) {
+      options = options || {
+        prefix: true
+      };
+
+      // If `console.log` is not accessible, `log` is a noop.
+      if (
+        typeof console !== 'object' ||
+        typeof console.log !== 'function' ||
+        typeof console.log.bind !== 'function'
+      ) {
+        return function noop() {};
+      }
+
+      return function log() {
+        var args = Array.prototype.slice.call(arguments);
+
+        // All logs are disabled when `io.sails.environment = 'production'`.
+        if (io.sails.environment === 'production') return;
+
+        // Add prefix to log messages (unless disabled)
+        var PREFIX = '';
+        if (options.prefix) {
+          args.unshift(PREFIX);
+        }
+
+        // Call wrapped logger
+        console.log
+          .bind(console)
+          .apply(this, args);
+      };
+    }//</LoggerFactory>
+
+    // Create a private logger instance
+    var consolog = LoggerFactory();
+    consolog.noPrefix = LoggerFactory({
+      prefix: false
+    });
+
+
+
+    /**
+     * What is the `requestQueue`?
+     *
+     * The request queue is used to simplify app-level connection logic--
+     * i.e. so you don't have to wait for the socket to be connected
+     * to start trying to  synchronize data.
+     *
+     * @api private
+     * @param  {SailsSocket}  socket
+     */
+
+    function runRequestQueue (socket) {
+      var queue = socket.requestQueue;
+
+      if (!queue) return;
+      for (var i in queue) {
+
+        // Double-check that `queue[i]` will not
+        // inadvertently discover extra properties attached to the Object
+        // and/or Array prototype by other libraries/frameworks/tools.
+        // (e.g. Ember does this. See https://github.com/balderdashy/sails.io.js/pull/5)
+        var isSafeToDereference = ({}).hasOwnProperty.call(queue, i);
+        if (isSafeToDereference) {
+          // Get the arguments that were originally made to the "request" method
+          var requestArgs = queue[i];
+          // Call the request method again in the context of the socket, with the original args
+          socket.request.apply(socket, requestArgs);
+        }
+      }
+
+      // Now empty the queue to remove it as a source of additional complexity.
+      socket.requestQueue = null;
+    }
+
+
+
+    /**
+     * Send a JSONP request.
+     *
+     * @param  {Object}   opts [optional]
+     * @param  {Function} cb
+     * @return {XMLHttpRequest}
+     */
+
+    function jsonp(opts, cb) {
+      opts = opts || {};
+
+      if (typeof window === 'undefined') {
+        // FUTURE: refactor node usage to live in here
+        return cb();
+      }
+
+      var scriptEl = document.createElement('script');
+      window._sailsIoJSConnect = function(response) {
+        // In rare circumstances our script may have been vaporised.
+        // Remove it, but only if it still exists
+        // https://github.com/balderdashy/sails.io.js/issues/92
+        if (scriptEl && scriptEl.parentNode) {
+            scriptEl.parentNode.removeChild(scriptEl);
+        }
+
+        cb(response);
+      };
+      scriptEl.src = opts.url;
+      document.getElementsByTagName('head')[0].appendChild(scriptEl);
+
+    }
+
+
+
+
+    //       ██╗███████╗ ██████╗ ███╗   ██╗      ██╗    ██╗███████╗██████╗ ███████╗ ██████╗  ██████╗██╗  ██╗███████╗████████╗
+    //       ██║██╔════╝██╔═══██╗████╗  ██║      ██║    ██║██╔════╝██╔══██╗██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██╔════╝╚══██╔══╝
+    //       ██║███████╗██║   ██║██╔██╗ ██║█████╗██║ █╗ ██║█████╗  ██████╔╝███████╗██║   ██║██║     █████╔╝ █████╗     ██║
+    //  ██   ██║╚════██║██║   ██║██║╚██╗██║╚════╝██║███╗██║██╔══╝  ██╔══██╗╚════██║██║   ██║██║     ██╔═██╗ ██╔══╝     ██║
+    //  ╚█████╔╝███████║╚██████╔╝██║ ╚████║      ╚███╔███╔╝███████╗██████╔╝███████║╚██████╔╝╚██████╗██║  ██╗███████╗   ██║
+    //   ╚════╝ ╚══════╝ ╚═════╝ ╚═╝  ╚═══╝       ╚══╝╚══╝ ╚══════╝╚═════╝ ╚══════╝ ╚═════╝  ╚═════╝╚═╝  ╚═╝╚══════╝   ╚═╝
+    //
+    //  ██████╗ ███████╗███████╗██████╗  ██████╗ ███╗   ██╗███████╗███████╗     ██╗     ██╗██╗    ██╗██████╗ ██╗
+    //  ██╔══██╗██╔════╝██╔════╝██╔══██╗██╔═══██╗████╗  ██║██╔════╝██╔════╝    ██╔╝     ██║██║    ██║██╔══██╗╚██╗
+    //  ██████╔╝█████╗  ███████╗██████╔╝██║   ██║██╔██╗ ██║███████╗█████╗      ██║      ██║██║ █╗ ██║██████╔╝ ██║
+    //  ██╔══██╗██╔══╝  ╚════██║██╔═══╝ ██║   ██║██║╚██╗██║╚════██║██╔══╝      ██║ ██   ██║██║███╗██║██╔══██╗ ██║
+    //  ██║  ██║███████╗███████║██║     ╚██████╔╝██║ ╚████║███████║███████╗    ╚██╗╚█████╔╝╚███╔███╔╝██║  ██║██╔╝
+    //  ╚═╝  ╚═╝╚══════╝╚══════╝╚═╝      ╚═════╝ ╚═╝  ╚═══╝╚══════╝╚══════╝     ╚═╝ ╚════╝  ╚══╝╚══╝ ╚═╝  ╚═╝╚═╝
+    //
+
+    /**
+     * The JWR (JSON WebSocket Response) received from a Sails server.
+     *
+     * @api public
+     * @param  {Object}  responseCtx
+     *         => :body
+     *         => :statusCode
+     *         => :headers
+     *
+     * @constructor
+     */
+
+    function JWR(responseCtx) {
+      this.body = responseCtx.body;
+      this.headers = responseCtx.headers || {};
+      this.statusCode = (typeof responseCtx.statusCode === 'undefined') ? 200 : responseCtx.statusCode;
+      // FUTURE: Replace this typeof short-circuit with an assertion (statusCode should always be set)
+
+      if (this.statusCode < 200 || this.statusCode >= 400) {
+        // Determine the appropriate error message.
+        var msg;
+        if (this.statusCode === 0) {
+          msg = 'The socket request failed.';
+        }
+        else {
+          msg = 'Server responded with a ' + this.statusCode + ' status code';
+          msg += ':\n```\n' + JSON.stringify(this.body, null, 2) + '\n```';
+          // (^^Note that we should always be able to rely on socket.io to give us
+          // non-circular data here, so we don't have to worry about wrapping the
+          // above in a try...catch)
+        }
+
+        // Now build and attach Error instance.
+        this.error = new Error(msg);
+      }
+    }
+    JWR.prototype.toString = function() {
+      return '[ResponseFromSails]' + '  -- ' +
+        'Status: ' + this.statusCode + '  -- ' +
+        'Headers: ' + this.headers + '  -- ' +
+        'Body: ' + this.body;
+    };
+    JWR.prototype.toPOJO = function() {
+      return {
+        body: this.body,
+        headers: this.headers,
+        statusCode: this.statusCode
+      };
+    };
+    JWR.prototype.pipe = function() {
+      // FUTURE: look at substack's stuff
+      return new Error('Client-side streaming support not implemented yet.');
+    };
+
+
+
+
+    //          ███████╗███╗   ███╗██╗████████╗███████╗██████╗  ██████╗ ███╗   ███╗ ██╗██╗
+    //          ██╔════╝████╗ ████║██║╚══██╔══╝██╔════╝██╔══██╗██╔═══██╗████╗ ████║██╔╝╚██╗
+    //          █████╗  ██╔████╔██║██║   ██║   █████╗  ██████╔╝██║   ██║██╔████╔██║██║  ██║
+    //          ██╔══╝  ██║╚██╔╝██║██║   ██║   ██╔══╝  ██╔══██╗██║   ██║██║╚██╔╝██║██║  ██║
+    //  ███████╗███████╗██║ ╚═╝ ██║██║   ██║   ██║     ██║  ██║╚██████╔╝██║ ╚═╝ ██║╚██╗██╔╝
+    //  ╚══════╝╚══════╝╚═╝     ╚═╝╚═╝   ╚═╝   ╚═╝     ╚═╝  ╚═╝ ╚═════╝ ╚═╝     ╚═╝ ╚═╝╚═╝
+    //
+
+    /**
+     * @api private
+     * @param  {SailsSocket} socket  [description]
+     * @param  {Object} requestCtx [description]
+     */
+
+    function _emitFrom(socket, requestCtx) {
+
+      if (!socket._raw) {
+        throw new Error('Failed to emit from socket- raw SIO socket is missing.');
+      }
+
+      // Since callback is embedded in requestCtx,
+      // retrieve it and delete the key before continuing.
+      var cb = requestCtx.cb;
+      delete requestCtx.cb;
+
+      // Name of the appropriate socket.io listener on the server
+      // ( === the request method or "verb", e.g. 'get', 'post', 'put', etc. )
+      var sailsEndpoint = requestCtx.method;
+
+      socket._raw.emit(sailsEndpoint, requestCtx, function serverResponded(responseCtx) {
+
+        // Send back (emulatedHTTPBody, jsonWebSocketResponse)
+        if (cb && !requestCtx.calledCb) {
+          cb(responseCtx.body, new JWR(responseCtx));
+          // Set flag indicating that callback was called, to avoid duplicate calls.
+          requestCtx.calledCb = true;
+          // Remove the callback from the list.
+          socket._responseCbs.splice(socket._responseCbs.indexOf(cb), 1);
+          // Remove the context from the list.
+          socket._requestCtxs.splice(socket._requestCtxs.indexOf(requestCtx), 1);
+        }
+      });
+    }
+
+
+
+
+
+
+
+    //  ███████╗ █████╗ ██╗██╗     ███████╗███████╗ ██████╗  ██████╗██╗  ██╗███████╗████████╗
+    //  ██╔════╝██╔══██╗██║██║     ██╔════╝██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██╔════╝╚══██╔══╝
+    //  ███████╗███████║██║██║     ███████╗███████╗██║   ██║██║     █████╔╝ █████╗     ██║
+    //  ╚════██║██╔══██║██║██║     ╚════██║╚════██║██║   ██║██║     ██╔═██╗ ██╔══╝     ██║
+    //  ███████║██║  ██║██║███████╗███████║███████║╚██████╔╝╚██████╗██║  ██╗███████╗   ██║
+    //  ╚══════╝╚═╝  ╚═╝╚═╝╚══════╝╚══════╝╚══════╝ ╚═════╝  ╚═════╝╚═╝  ╚═╝╚══════╝   ╚═╝
+    //
+
+    /**
+     * SailsSocket
+     *
+     * A wrapper for an underlying Socket instance that communicates directly
+     * to the Socket.io server running inside of Sails.
+     *
+     * If no `socket` option is provied, SailsSocket will function as a mock. It will queue socket
+     * requests and event handler bindings, replaying them when the raw underlying socket actually
+     * connects. This is handy when we don't necessarily have the valid configuration to know
+     * WHICH SERVER to talk to yet, etc.  It is also used by `io.socket` for your convenience.
+     *
+     * @constructor
+     * @api private
+     *
+     * ----------------------------------------------------------------------
+     * Note: This constructor should not be used directly. To obtain a `SailsSocket`
+     * instance of your very own, run:
+     * ```
+     * var mySocket = io.sails.connect();
+     * ```
+     * ----------------------------------------------------------------------
+     */
+    function SailsSocket (opts){
+      var self = this;
+      opts = opts||{};
+
+      // Initialize private properties
+      self._isConnecting = false;
+      self._mightBeAboutToAutoConnect = false;
+
+      // Set up connection options so that they can only be changed when socket is disconnected.
+      var _opts = {};
+      SOCKET_OPTIONS.forEach(function(option) {
+        // Okay to change global headers while socket is connected
+        if (option == 'headers') {return;}
+        Object.defineProperty(self, option, {
+          get: function() {
+            if (option == 'url') {
+              return _opts[option] || (self._raw && self._raw.io && self._raw.io.uri);
+            }
+            return _opts[option];
+          },
+          set: function(value) {
+            // Don't allow value to be changed while socket is connected
+            if (self.isConnected() && io.sails.strict !== false && value != _opts[option]) {
+              throw new Error('Cannot change value of `' + option + '` while socket is connected.');
+            }
+            // If socket is attempting to reconnect, stop it.
+            if (self._raw && self._raw.io && self._raw.io.reconnecting && !self._raw.io.skipReconnect) {
+              self._raw.io.skipReconnect = true;
+              consolog('Stopping reconnect; use .reconnect() to connect socket after changing options.');
+            }
+            _opts[option] = value;
+          }
+        });
+      });
+
+      // Absorb opts into SailsSocket instance
+      // See http://sailsjs.com/documentation/reference/web-sockets/socket-client/sails-socket/properties
+      // for description of options
+      SOCKET_OPTIONS.forEach(function(option) {
+        self[option] = opts[option];
+      });
+
+      // Set up "eventQueue" to hold event handlers which have not been set on the actual raw socket yet.
+      self.eventQueue = {};
+
+      // Listen for special `parseError` event sent from sockets hook on the backend
+      // if an error occurs but a valid callback was not received from the client
+      // (i.e. so the server had no other way to send back the error information)
+      self.on('sails:parseError', function (err){
+        consolog('Sails encountered an error parsing a socket message sent from this client, and did not have access to a callback function to respond with.');
+        consolog('Error details:',err);
+      });
+
+      // FUTURE:
+      // Listen for a special private message on any connected that allows the server
+      // to set the environment (giving us 100% certainty that we guessed right)
+      // However, note that the `console.log`s called before and after connection
+      // are still forced to rely on our existing heuristics (to disable, tack #production
+      // onto the URL used to fetch this file.)
+
+    }//</SailsSocket>
+
+
+    /**
+     * `SailsSocket.prototype._connect()`
+     *
+     * Begin connecting this socket to the server.
+     *
+     * @api private
+     */
+    SailsSocket.prototype._connect = function (){
+      var self = this;
+
+      self._isConnecting = true;
+
+      // Apply `io.sails` config as defaults
+      // (now that at least one tick has elapsed)
+      // See http://sailsjs.com/documentation/reference/web-sockets/socket-client/sails-socket/properties
+      // for description of options and default values
+      SOCKET_OPTIONS.forEach(function(option) {
+        if ('undefined' == typeof self[option]) {
+          self[option] = io.sails[option];
+        }
+      });
+
+      // Headers that will be sent with the initial request to /socket.io (Node.js only)
+      self.extraHeaders = self.initialConnectionHeaders || {};
+
+      // For browser usage (currently works with "polling" transport only)
+      self.transportOptions = self.transportOptions || {};
+      self.transports.forEach(function(transport) {
+        self.transportOptions[transport] = self.transportOptions[transport] || {};
+        self.transportOptions[transport].extraHeaders = self.initialConnectionHeaders || {};
+      });
+
+      // Log a warning if non-Node.js platform attempts to use `initialConnectionHeaders` for anything other than `polling`.
+      if (self.initialConnectionHeaders && SDK_INFO.platform !== 'node' && self.transports.indexOf('polling') === -1 || self.transports.length > 1) {
+        if (typeof console === 'object' && typeof console.warn === 'function') {
+          console.warn('When running in browser, `initialConnectionHeaders` option is only available for the `polling` transport.');
+        }
+      }
+
+      // Ensure URL has no trailing slash
+      self.url = self.url ? self.url.replace(/(\/)$/, '') : undefined;
+
+      // Mix the current SDK version into the query string in
+      // the connection request to the server:
+      if (typeof self.query === 'string') {
+        // (If provided as a string, trim leading question mark,
+        // just in case one was provided.)
+        self.query = self.query.replace(/^\?/, '');
+        self.query += '&' + SDK_INFO.versionString;
+      }
+      else if (self.query && typeof self.query === 'object') {
+        throw new Error('`query` setting does not currently support configuration as a dictionary (`{}`).  Instead, it must be specified as a string like `foo=89&bar=hi`');
+      }
+      else if (!self.query) {
+        self.query = SDK_INFO.versionString;
+      }
+      else {
+        throw new Error('Unexpected data type provided for `query` setting: '+self.query);
+      }
+
+      // Determine whether this is a cross-origin socket by examining the
+      // hostname and port on the `window.location` object.  If it's cross-origin,
+      // we'll attempt to get a cookie for the domain so that a Sails session can
+      // be established.
+      var isXOrigin = (function (){
+
+        // If `window` doesn't exist (i.e. being used from Node.js), then
+        // we won't bother attempting to get a cookie.  If you're using sockets
+        // from Node.js and find you need to share a session between multiple
+        // socket connections, you'll need to make an HTTP request to the /__getcookie
+        // endpoint of the Sails server (or any endpoint that returns a set-cookie header)
+        // and then use the cookie value in the `initialConnectionHeaders` option to
+        // io.sails.connect()
+        if (typeof window === 'undefined' || typeof window.location === 'undefined') {
+          return false;
+        }
+
+        // If `self.url` (aka "target") is falsy, then we don't need to worry about it.
+        if (typeof self.url !== 'string') { return false; }
+
+        // Get information about the "target" (`self.url`)
+        var targetProtocol = (function (){
+          try {
+            targetProtocol = self.url.match(/^([a-z]+:\/\/)/i)[1].toLowerCase();
+          }
+          catch (e) {}
+          targetProtocol = targetProtocol || 'http://';
+          return targetProtocol;
+        })();
+        var isTargetSSL = !!self.url.match('^https');
+        var targetPort = (function (){
+          try {
+            return self.url.match(/^[a-z]+:\/\/[^:]*:([0-9]*)/i)[1];
+          }
+          catch (e){}
+          return isTargetSSL ? '443' : '80';
+        })();
+        var targetAfterProtocol = self.url.replace(/^([a-z]+:\/\/)/i, '');
+
+
+        // If target protocol is different than the actual protocol,
+        // then we'll consider this cross-origin.
+        if (targetProtocol.replace(/[:\/]/g, '') !== window.location.protocol.replace(/[:\/]/g,'')) {
+          return true;
+        }
+
+
+        // If target hostname is different than actual hostname, we'll consider this cross-origin.
+        var hasSameHostname = targetAfterProtocol.search(window.location.hostname) === 0;
+        if (!hasSameHostname) {
+          return true;
+        }
+
+        // If no actual port is explicitly set on the `window.location` object,
+        // we'll assume either 80 or 443.
+        var isLocationSSL = window.location.protocol.match(/https/i);
+        var locationPort = (window.location.port+'') || (isLocationSSL ? '443' : '80');
+
+        // Finally, if ports don't match, we'll consider this cross-origin.
+        if (targetPort !== locationPort) {
+          return true;
+        }
+
+        // Otherwise, it's the same origin.
+        return false;
+
+      })();
+
+
+      // Prepare to start connecting the socket
+      (function selfInvoking (cb){
+
+        // If this is an attempt at a cross-origin or cross-port
+        // socket connection via a browswe, send a JSONP request
+        // first to ensure that a valid cookie is available.
+        // This can be disabled by setting `io.sails.useCORSRouteToGetCookie`
+        // to false.
+        //
+        // Otherwise, skip the stuff below.
+        //
+        if (!(self.useCORSRouteToGetCookie && isXOrigin)) {
+          return cb();
+        }
+
+        // Figure out the x-origin CORS route
+        // (Sails provides a default)
+        var xOriginCookieURL = self.url;
+        if (typeof self.useCORSRouteToGetCookie === 'string') {
+          xOriginCookieURL += self.useCORSRouteToGetCookie;
+        }
+        else {
+          xOriginCookieURL += '/__getcookie';
+        }
+
+        // Make the AJAX request (CORS)
+        jsonp({
+          url: xOriginCookieURL,
+          method: 'GET'
+        }, cb);
+
+      })(function goAheadAndActuallyConnect() {
+
+        // Now that we're ready to connect, create a raw underlying Socket
+        // using Socket.io and save it as `_raw` (this will start it connecting)
+        self._raw = io(self.url, self);
+
+        // If the low-level transport throws an error _while connecting_, then set the _isConnecting flag
+        // to false (since we're no longer connecting with any chance of success anyway).
+        // Also, in this case (and in dev mode only) log a helpful message.
+        self._raw.io.engine.transport.on('error', function(err){
+          if (!self._isConnecting) { return; }
+
+          self._isConnecting = false;
+
+          // Track this timestamp for use in reconnection messages
+          // (only relevant if reconnection is enabled.)
+          self.connectionErrorTimestamp = (new Date()).getTime();
+
+          // Development-only message:
+          consolog('====================================');
+          consolog('The socket was unable to connect.');
+          consolog('The server may be offline, or the');
+          consolog('socket may have failed authorization');
+          consolog('based on its origin or other factors.');
+          consolog('You may want to check the values of');
+          consolog('`sails.config.sockets.onlyAllowOrigins`');
+          consolog('or (more rarely) `sails.config.sockets.beforeConnect`');
+          consolog('in your app.');
+          consolog('More info: https://sailsjs.com/config/sockets');
+          consolog('For help: https://sailsjs.com/support');
+          consolog('');
+          consolog('Technical details:');
+          consolog(err);
+          consolog('====================================');
+        });
+
+        // Replay event bindings from the eager socket
+        self.replay();
+
+
+        /**
+         * 'connect' event is triggered when the socket establishes a connection
+         *  successfully.
+         */
+        self.on('connect', function socketConnected() {
+          self._isConnecting = false;
+          consolog.noPrefix(
+            '\n' +
+            '\n' +
+            // '    |>    ' + '\n' +
+            // '  \\___/  '+️
+            // '\n'+
+             '  |>    Now connected to '+(self.url ? self.url : 'Sails')+'.' + '\n' +
+            '\\___/   For help, see: http://bit.ly/2q0QDpf' + '\n' +
+             '        (using sails.io.js '+io.sails.sdk.platform+' SDK @v'+io.sails.sdk.version+')'+ '\n' +
+            '         Connected at: '+(new Date())+'\n'+
+            '\n'+
+            '\n'+
+            // '\n'+
+            ''
+            // ' ⚓︎ (development mode)'
+            // 'e.g. to send a GET request to Sails via WebSockets, run:'+ '\n' +
+            // '`io.socket.get("/foo", function serverRespondedWith (body, jwr) { console.log(body); })`'+ '\n' +
+          );
+        });
+
+        self.on('disconnect', function() {
+
+          // Get a timestamp of when the disconnect was detected.
+          self.connectionLostTimestamp = (new Date()).getTime();
+
+          // Get a shallow clone of the internal array of response callbacks, in case any of the callbacks mutate it.
+          var responseCbs = [].concat(self._responseCbs || []);
+          // Wipe the internal array of response callbacks before executing them, in case a callback happens to add
+          // a new request to the queue.
+          self._responseCbs = [];
+
+          // Do the same for the internal request context list.
+          var requestCtxs = [].concat(self._requestCtxs || []);
+          self._requestCtxs = [];
+
+          // Loop through the callbacks for all in-progress requests, and call them each with an error indicating the disconnect.
+          if (responseCbs.length) {
+            responseCbs.forEach(function(responseCb) {
+              responseCb(new Error('The socket disconnected before the request completed.'), {
+                body: null,
+                statusCode: 0,
+                headers: {}
+              });
+            });
+          }
+
+          // If there is a list of request contexts, indicate that their callbacks have been
+          // called and then wipe the list.  This prevents errors in the edge case of a response
+          // somehow coming back after the socket reconnects.
+          if (requestCtxs.length) {
+            requestCtxs.forEach(function(requestCtx) {
+              requestCtx.calledCb = true;
+            });
+          }
+
+          consolog('====================================');
+          consolog('Socket was disconnected from Sails.');
+          consolog('Usually, this is due to one of the following reasons:' + '\n' +
+            ' -> the server ' + (self.url ? self.url + ' ' : '') + 'was taken down' + '\n' +
+            ' -> your browser lost internet connectivity');
+          consolog('====================================');
+        });
+
+        self.on('reconnecting', function(numAttempts) {
+          consolog(
+            '\n'+
+            '        Socket is trying to reconnect to '+(self.url ? self.url : 'Sails')+'...\n'+
+            '_-|>_-  (attempt #' + numAttempts + ')'+'\n'+
+            '\n'
+          );
+        });
+
+        self.on('reconnect', function(transport, numAttempts) {
+          if (!self._isConnecting) {
+            self.on('connect', runRequestQueue.bind(self, self));
+          }
+
+          var msSinceLastOffline;
+          var numSecsOffline;
+          if (self.connectionLostTimestamp){
+            msSinceLastOffline = ((new Date()).getTime() - self.connectionLostTimestamp);
+            numSecsOffline = (msSinceLastOffline / 1000);
+          }
+          else if (self.connectionErrorTimestamp) {
+            msSinceLastOffline = ((new Date()).getTime() - self.connectionErrorTimestamp);
+            numSecsOffline = (msSinceLastOffline / 1000);
+          }
+          else {
+            msSinceLastOffline = '???';
+            numSecsOffline = '???';
+          }
+
+          consolog(
+            '\n'+
+             '  |>    Socket reconnected successfully after'+'\n'+
+            '\\___/   being offline at least ' + numSecsOffline + ' seconds.'+'\n'+
+            '\n'
+          );
+        });
+
+        // 'error' event is triggered if connection can not be established.
+        // (usually because of a failed authorization, which is in turn
+        // usually due to a missing or invalid cookie)
+        self.on('error', function failedToConnect(err) {
+          self._isConnecting = false;
+          ////////////////////////////////////////////////////////////////////////////////////
+          // Note:
+          // In the future, we could provide a separate event for when a socket cannot connect
+          // due to a failed `beforeConnect` (aka "authorization" if you're old school).
+          // this could probably be implemented by emitting a special event from the server.
+          ////////////////////////////////////////////////////////////////////////////////////
+
+          consolog(
+            'Failed to connect socket (possibly due to failed `beforeConnect` on server)',
+            'Error:', err
+          );
+        });
+      });
+
+    };
+
+    /**
+     * Reconnect the underlying socket.
+     *
+     * @api public
+     */
+    SailsSocket.prototype.reconnect = function (){
+      if (this._isConnecting) {
+        throw new Error('Cannot connect- socket is already connecting');
+      }
+      if (this.isConnected()) {
+        throw new Error('Cannot connect- socket is already connected');
+      }
+      return this._connect();
+    };
+
+    /**
+     * Disconnect the underlying socket.
+     *
+     * @api public
+     */
+    SailsSocket.prototype.disconnect = function (){
+      this._isConnecting = false;
+      if (!this.isConnected()) {
+        throw new Error('Cannot disconnect- socket is already disconnected');
+      }
+      return this._raw.disconnect();
+    };
+
+
+
+    /**
+     * isConnected
+     *
+     * @return {Boolean} whether the socket is connected and able to
+     *                   communicate w/ the server.
+     */
+
+    SailsSocket.prototype.isConnected = function () {
+      if (!this._raw) {
+        return false;
+      }
+
+      return !!this._raw.connected;
+    };
+
+
+    /**
+     * isConnecting
+     *
+     * @return {Boolean} whether the socket is in the process of connecting
+     *                   to the server.
+     */
+
+    SailsSocket.prototype.isConnecting = function () {
+      return this._isConnecting;
+    };
+
+    /**
+     * isConnecting
+     *
+     * @return {Boolean} flag that is `true` after a SailsSocket instance is
+     *                   initialized but before one tick of the event loop
+     *                   has passed (so that it hasn't attempted to connect
+     *                   yet, if autoConnect ends up being configured `true`)
+     */
+    SailsSocket.prototype.mightBeAboutToAutoConnect = function() {
+      return this._mightBeAboutToAutoConnect;
+    };
+
+    /**
+     * [replay description]
+     * @return {[type]} [description]
+     */
+    SailsSocket.prototype.replay = function (){
+      var self = this;
+
+      // Pass events and a reference to the request queue
+      // off to the self._raw for consumption
+      for (var evName in self.eventQueue) {
+        for (var i in self.eventQueue[evName]) {
+          self._raw.on(evName, self.eventQueue[evName][i]);
+        }
+      }
+
+      // Bind a one-time function to run the request queue
+      // when the self._raw connects.
+      if ( !self.isConnected() ) {
+        self._raw.once('connect', runRequestQueue.bind(self, self));
+      }
+      // Or run it immediately if self._raw is already connected
+      else {
+        runRequestQueue(self);
+      }
+
+      return self;
+    };
+
+
+    /**
+     * Chainable method to bind an event to the socket.
+     *
+     * @param  {String}   evName [event name]
+     * @param  {Function} fn     [event handler function]
+     * @return {SailsSocket}
+     */
+    SailsSocket.prototype.on = function (evName, fn){
+
+      // Bind the event to the raw underlying socket if possible.
+      if (this._raw) {
+        this._raw.on(evName, fn);
+        return this;
+      }
+
+      // Otherwise queue the event binding.
+      if (!this.eventQueue[evName]) {
+        this.eventQueue[evName] = [fn];
+      }
+      else {
+        this.eventQueue[evName].push(fn);
+      }
+
+      return this;
+    };
+
+    /**
+     * Chainable method to unbind an event from the socket.
+     *
+     * @param  {String}   evName [event name]
+     * @param  {Function} fn     [event handler function]
+     * @return {SailsSocket}
+     */
+    SailsSocket.prototype.off = function (evName, fn){
+
+      // Bind the event to the raw underlying socket if possible.
+      if (this._raw) {
+        this._raw.off(evName, fn);
+        return this;
+      }
+
+      // Otherwise queue the event binding.
+      if (this.eventQueue[evName] && this.eventQueue[evName].indexOf(fn) > -1) {
+        this.eventQueue[evName].splice(this.eventQueue[evName].indexOf(fn), 1);
+      }
+
+      return this;
+    };
+
+
+    /**
+     * Chainable method to unbind all events from the socket.
+     *
+     * @return {SailsSocket}
+     */
+    SailsSocket.prototype.removeAllListeners = function (){
+
+      // Bind the event to the raw underlying socket if possible.
+      if (this._raw) {
+        this._raw.removeAllListeners();
+        return this;
+      }
+
+      // Otherwise queue the event binding.
+      this.eventQueue = {};
+
+      return this;
+    };
+
+    /**
+     * Simulate a GET request to sails
+     * e.g.
+     *    `socket.get('/user/3', Stats.populate)`
+     *
+     * @api public
+     * @param {String} url    ::    destination URL
+     * @param {Object} data   ::    parameters to send with the request [optional]
+     * @param {Function} cb   ::    callback function to call when finished [optional]
+     */
+
+    SailsSocket.prototype.get = function(url, data, cb) {
+
+      // `data` is optional
+      if (typeof data === 'function') {
+        cb = data;
+        data = {};
+      }
+
+      return this.request({
+        method: 'get',
+        params: data,
+        url: url
+      }, cb);
+    };
+
+
+
+    /**
+     * Simulate a POST request to sails
+     * e.g.
+     *    `socket.post('/event', newMeeting, $spinner.hide)`
+     *
+     * @api public
+     * @param {String} url    ::    destination URL
+     * @param {Object} data   ::    parameters to send with the request [optional]
+     * @param {Function} cb   ::    callback function to call when finished [optional]
+     */
+
+    SailsSocket.prototype.post = function(url, data, cb) {
+
+      // `data` is optional
+      if (typeof data === 'function') {
+        cb = data;
+        data = {};
+      }
+
+      return this.request({
+        method: 'post',
+        data: data,
+        url: url
+      }, cb);
+    };
+
+
+
+    /**
+     * Simulate a PUT request to sails
+     * e.g.
+     *    `socket.post('/event/3', changedFields, $spinner.hide)`
+     *
+     * @api public
+     * @param {String} url    ::    destination URL
+     * @param {Object} data   ::    parameters to send with the request [optional]
+     * @param {Function} cb   ::    callback function to call when finished [optional]
+     */
+
+    SailsSocket.prototype.put = function(url, data, cb) {
+
+      // `data` is optional
+      if (typeof data === 'function') {
+        cb = data;
+        data = {};
+      }
+
+      return this.request({
+        method: 'put',
+        params: data,
+        url: url
+      }, cb);
+    };
+
+
+    /**
+     * Simulate a PATCH request to sails
+     * e.g.
+     *    `socket.patch('/event/3', changedFields, $spinner.hide)`
+     *
+     * @api public
+     * @param {String} url    ::    destination URL
+     * @param {Object} data   ::    parameters to send with the request [optional]
+     * @param {Function} cb   ::    callback function to call when finished [optional]
+     */
+
+    SailsSocket.prototype.patch = function(url, data, cb) {
+
+      // `data` is optional
+      if (typeof data === 'function') {
+        cb = data;
+        data = {};
+      }
+
+      return this.request({
+        method: 'patch',
+        params: data,
+        url: url
+      }, cb);
+    };
+
+    /**
+     * Simulate a DELETE request to sails
+     * e.g.
+     *    `socket.delete('/event', $spinner.hide)`
+     *
+     * @api public
+     * @param {String} url    ::    destination URL
+     * @param {Object} data   ::    parameters to send with the request [optional]
+     * @param {Function} cb   ::    callback function to call when finished [optional]
+     */
+
+    SailsSocket.prototype['delete'] = function(url, data, cb) {
+
+      // `data` is optional
+      if (typeof data === 'function') {
+        cb = data;
+        data = {};
+      }
+
+      return this.request({
+        method: 'delete',
+        params: data,
+        url: url
+      }, cb);
+    };
+
+
+
+    /**
+     * Simulate an HTTP request to sails
+     * e.g.
+     * ```
+     * socket.request({
+     *   url:'/user',
+     *   params: {},
+     *   method: 'POST',
+     *   headers: {}
+     * }, function (responseBody, JWR) {
+     *   // ...
+     * });
+     * ```
+     *
+     * @api public
+     * @option {String} url    ::    destination URL
+     * @option {Object} params ::    parameters to send with the request [optional]
+     * @option {Object} headers::    headers to send with the request [optional]
+     * @option {Function} cb   ::    callback function to call when finished [optional]
+     * @option {String} method ::    HTTP request method [optional]
+     */
+
+    SailsSocket.prototype.request = function(options, cb) {
+
+      var usage =
+      'Usage:\n'+
+      'socket.request( options, [fnToCallWhenComplete] )\n\n'+
+      'options.url :: e.g. "/foo/bar"'+'\n'+
+      'options.method :: e.g. "get", "post", "put", or "delete", etc.'+'\n'+
+      'options.params :: e.g. { emailAddress: "mike@example.com" }'+'\n'+
+      'options.headers :: e.g. { "x-my-custom-header": "some string" }';
+      // Old usage:
+      // var usage = 'Usage:\n socket.'+(options.method||'request')+'('+
+      //   ' destinationURL, [dataToSend], [fnToCallWhenComplete] )';
+
+
+      // Validate options and callback
+      if (typeof cb !== 'undefined' && typeof cb !== 'function') {
+        throw new Error('Invalid callback function!\n' + usage);
+      }
+      if (typeof options !== 'object' || typeof options.url !== 'string') {
+        throw new Error('Invalid or missing URL!\n' + usage);
+      }
+      if (options.method && typeof options.method !== 'string') {
+        throw new Error('Invalid `method` provided (should be a string like "post" or "put")\n' + usage);
+      }
+      if (options.headers && typeof options.headers !== 'object') {
+        throw new Error('Invalid `headers` provided (should be a dictionary with string values)\n' + usage);
+      }
+      if (options.params && typeof options.params !== 'object') {
+        throw new Error('Invalid `params` provided (should be a dictionary with JSON-serializable values)\n' + usage);
+      }
+      if (options.data && typeof options.data !== 'object') {
+        throw new Error('Invalid `data` provided (should be a dictionary with JSON-serializable values)\n' + usage);
+      }
+
+      // Accept either `params` or `data` for backwards compatibility (but not both!)
+      if (options.data && options.params) {
+        throw new Error('Cannot specify both `params` and `data`!  They are aliases of each other.\n' + usage);
+      }
+      else if (options.data) {
+        options.params = options.data;
+        delete options.data;
+      }
+
+
+      // If this socket is not connected yet, queue up this request
+      // instead of sending it.
+      // (so it can be replayed when the socket comes online.)
+      if ( ! this.isConnected() ) {
+
+        // If no queue array exists for this socket yet, create it.
+        this.requestQueue = this.requestQueue || [];
+        this.requestQueue.push([options, cb]);
+        return;
+      }
+
+      // Otherwise, our socket is connected, so continue prepping
+      // the request.
+
+      // Default headers to an empty object
+      options.headers = options.headers || {};
+
+      // Build a simulated request object
+      // (and sanitize/marshal options along the way)
+      var requestCtx = {
+
+        method: (options.method || 'get').toLowerCase(),
+
+        headers: options.headers,
+
+        data: options.params || options.data || {},
+
+        // Remove trailing slashes and spaces to make packets smaller.
+        url: options.url.replace(/^(.+)\/*\s*$/, '$1'),
+
+        cb: cb
+      };
+
+      // Get a reference to the callback list, or create a new one.
+      this._responseCbs = this._responseCbs || [];
+
+      // Get a reference to the request context list, or create a new one.
+      this._requestCtxs = this._requestCtxs || [];
+
+      // Add this callback to the list.  If the socket disconnects, we'll call
+      // each cb in the list with an error and reset the list.  Otherwise the
+      // cb will be removed from the list when the server responds.
+      // Also add the request context to the list.  It will be removed once
+      // the response comes back, or if the socket disconnects.
+      if (cb) {
+        this._responseCbs.push(cb);
+        this._requestCtxs.push(requestCtx);
+      }
+
+      // Merge global headers in, if there are any.
+      if (this.headers && 'object' === typeof this.headers) {
+        for (var header in this.headers) {
+          if (!options.headers.hasOwnProperty(header)) {
+            options.headers[header] = this.headers[header];
+          }
+        }
+      }
+
+      // Send the request.
+      _emitFrom(this, requestCtx);
+    };
+
+
+
+    /**
+     * Socket.prototype._request
+     *
+     * Simulate HTTP over Socket.io.
+     *
+     * @api private
+     * @param  {[type]}   options [description]
+     * @param  {Function} cb      [description]
+     */
+    SailsSocket.prototype._request = function(options, cb) {
+      throw new Error('`_request()` was a private API deprecated as of v0.11 of the sails.io.js client. Use `.request()` instead.');
+    };
+
+
+
+
+
+
+
+    //  ██╗ ██████╗    ███████╗ █████╗ ██╗██╗     ███████╗
+    //  ██║██╔═══██╗   ██╔════╝██╔══██╗██║██║     ██╔════╝
+    //  ██║██║   ██║   ███████╗███████║██║██║     ███████╗
+    //  ██║██║   ██║   ╚════██║██╔══██║██║██║     ╚════██║
+    //  ██║╚██████╔╝██╗███████║██║  ██║██║███████╗███████║
+    //  ╚═╝ ╚═════╝ ╚═╝╚══════╝╚═╝  ╚═╝╚═╝╚══════╝╚══════╝
+    //
+    // Set an `io.sails` object that may be used for configuration before the
+    // first socket connects (i.e. to allow auto-connect behavior to be
+    // prevented by setting `io.sails.autoConnect` in an inline script
+    // directly after the script tag which loaded this file).
+
+
+    //  ┌─┐┌─┐┌┬┐  ┬ ┬┌─┐  ╔╦╗╔═╗╔═╗╔═╗╦ ╦╦ ╔╦╗╔═╗  ┌─┐┌─┐┬─┐  ┬┌─┐ ┌─┐┌─┐┬┬  ┌─┐
+    //  └─┐├┤  │   │ │├─┘   ║║║╣ ╠╣ ╠═╣║ ║║  ║ ╚═╗  ├┤ │ │├┬┘  ││ │ └─┐├─┤││  └─┐
+    //  └─┘└─┘ ┴   └─┘┴    ═╩╝╚═╝╚  ╩ ╩╚═╝╩═╝╩ ╚═╝  └  └─┘┴└─  ┴└─┘o└─┘┴ ┴┴┴─┘└─┘
+    io.sails = {
+
+      // Whether to automatically connect a socket and save it as `io.socket`.
+      autoConnect: true,
+
+      // Whether to automatically try to reconnect after connection is lost
+      reconnection: false,
+
+      // The route (path) to hit to get a x-origin (CORS) cookie
+      // (or true to use the default: '/__getcookie')
+      useCORSRouteToGetCookie: true,
+
+      // The environment we're running in.
+      // (logs are not displayed when this is set to 'production')
+      //
+      // Defaults to "development" unless this script was fetched from a URL
+      // that ends in `*.min.js` or '#production', or if the conventional
+      // `SAILS_LOCALS` global is set with an `_environment` of "production"
+      // or "staging".  (This setting may also be manually overridden.)
+      environment: (
+        urlThisScriptWasFetchedFrom.match(/(\#production|\.min\.js)/g) ||
+        (
+          typeof window === 'object' && window &&
+          typeof window.SAILS_LOCALS === 'object' && window.SAILS_LOCALS &&
+          (window.SAILS_LOCALS._environment === 'staging' || window.SAILS_LOCALS._environment === 'production')
+        )
+      )? 'production' : 'development',
+
+      // The version of this sails.io.js client SDK
+      sdk: SDK_INFO,
+
+      // Transports to use when communicating with the server, in the order they will be tried
+      transports: ['websocket']
+    };
+
+
+
+    //  ┌─┐─┐ ┬┌┬┐┌─┐┌┐┌┌┬┐  ┬┌─┐ ┌─┐┌─┐┬┬  ┌─┐  ┌┬┐┌─┐┌─┐┌─┐┬ ┬┬ ┌┬┐┌─┐
+    //  ├┤ ┌┴┬┘ │ ├┤ │││ ││  ││ │ └─┐├─┤││  └─┐   ││├┤ ├┤ ├─┤│ ││  │ └─┐
+    //  └─┘┴ └─ ┴ └─┘┘└┘─┴┘  ┴└─┘o└─┘┴ ┴┴┴─┘└─┘  ─┴┘└─┘└  ┴ ┴└─┘┴─┘┴ └─┘
+    //  ┬ ┬┬┌┬┐┬ ┬  ┌┬┐┬ ┬┌─┐  ╦ ╦╔╦╗╔╦╗╦    ╔═╗╔╦╗╔╦╗╦═╗╦╔╗ ╦ ╦╔╦╗╔═╗╔═╗
+    //  ││││ │ ├─┤   │ ├─┤├┤   ╠═╣ ║ ║║║║    ╠═╣ ║  ║ ╠╦╝║╠╩╗║ ║ ║ ║╣ ╚═╗
+    //  └┴┘┴ ┴ ┴ ┴   ┴ ┴ ┴└─┘  ╩ ╩ ╩ ╩ ╩╩═╝  ╩ ╩ ╩  ╩ ╩╚═╩╚═╝╚═╝ ╩ ╚═╝╚═╝
+    //  ┌─┐┬─┐┌─┐┌┬┐  ┌┬┐┬ ┬┌─┐  ┌─┐┌─┐┬─┐┬┌─┐┌┬┐  ┌┬┐┌─┐┌─┐
+    //  ├┤ ├┬┘│ ││││   │ ├─┤├┤   └─┐│  ├┬┘│├─┘ │    │ ├─┤│ ┬
+    //  └  ┴└─└─┘┴ ┴   ┴ ┴ ┴└─┘  └─┘└─┘┴└─┴┴   ┴    ┴ ┴ ┴└─┘
+    //
+    // Now fold in config provided as HTML attributes on the script tag:
+    // (note that if `io.sails.*` is changed after this script, those changes
+    //  will still take precedence)
+    CONFIGURABLE_VIA_HTML_ATTR.forEach(function (configKey){
+      if (typeof scriptTagConfig[configKey] !== 'undefined') {
+        io.sails[configKey] = scriptTagConfig[configKey];
+      }
+    });
+    //////////////////////////////////////////////////////////////////////////////
+    // Note that the new HTML attribute configuration style may eventually
+    // completely replace the original approach of setting `io.sails` properties,
+    // since the new strategy is easier to reason about.  Also, it would allow us
+    // to remove the timeout below someday.
+    //////////////////////////////////////////////////////////////////////////////
+
+
+
+
+    //  ┬┌─┐ ┌─┐┌─┐┬┬  ┌─┐ ╔═╗╔═╗╔╗╔╔╗╔╔═╗╔═╗╔╦╗  /  \
+    //  ││ │ └─┐├─┤││  └─┐ ║  ║ ║║║║║║║║╣ ║   ║  /   /
+    //  ┴└─┘o└─┘┴ ┴┴┴─┘└─┘o╚═╝╚═╝╝╚╝╝╚╝╚═╝╚═╝ ╩  \  /
+
+    /**
+     * Add `io.sails.connect` function as a wrapper for the built-in `io()` aka `io.connect()`
+     * method, returning a SailsSocket. This special function respects the configured io.sails
+     * connection URL, as well as sending other identifying information (most importantly, the
+     * current version of this SDK).
+     *
+     * @param  {String} url  [optional]
+     * @param  {Object} opts [optional]
+     * @return {Socket}
+     */
+    io.sails.connect = function(url, opts) {
+
+      // Make URL optional
+      if ('object' === typeof url) {
+        opts = url;
+        url = null;
+      }
+
+      // Default opts to empty object
+      opts = opts || {};
+
+      // If explicit connection url is specified, save it to options
+      opts.url = url || opts.url || undefined;
+
+      // Instantiate and return a new SailsSocket- and try to connect immediately.
+      var socket = new SailsSocket(opts);
+      socket._connect();
+      return socket;
+    };
+
+
+
+
+
+
+    //  ██╗ ██████╗    ███████╗ ██████╗  ██████╗██╗  ██╗███████╗████████╗
+    //  ██║██╔═══██╗   ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██╔════╝╚══██╔══╝
+    //  ██║██║   ██║   ███████╗██║   ██║██║     █████╔╝ █████╗     ██║
+    //  ██║██║   ██║   ╚════██║██║   ██║██║     ██╔═██╗ ██╔══╝     ██║
+    //  ██║╚██████╔╝██╗███████║╚██████╔╝╚██████╗██║  ██╗███████╗   ██║
+    //  ╚═╝ ╚═════╝ ╚═╝╚══════╝ ╚═════╝  ╚═════╝╚═╝  ╚═╝╚══════╝   ╚═╝
+    //
+    // io.socket
+    //
+    // The eager instance of Socket which will automatically try to connect
+    // using the host that this js file was served from.
+    //
+    // This can be disabled or configured by setting properties on `io.sails.*` within the
+    // first cycle of the event loop.
+    //
+
+
+    // Build `io.socket` so it exists
+    // (note that this DOES NOT start the connection process)
+    io.socket = new SailsSocket();
+    //
+    // This socket is not connected yet, and has not even _started_ connecting.
+    //
+    // But in the mean time, this eager socket will be queue events bound by the user
+    // before the first cycle of the event loop (using `.on()`), which will later
+    // be rebound on the raw underlying socket.
+
+
+    //  ┌─┐┌─┐┌┬┐  ┌─┐┬ ┬┌┬┐┌─┐   ┌─┐┌─┐┌┐┌┌┐┌┌─┐┌─┐┌┬┐  ┌┬┐┬┌┬┐┌─┐┬─┐
+    //  └─┐├┤  │   ├─┤│ │ │ │ │───│  │ │││││││├┤ │   │    │ ││││├┤ ├┬┘
+    //  └─┘└─┘ ┴   ┴ ┴└─┘ ┴ └─┘   └─┘└─┘┘└┘┘└┘└─┘└─┘ ┴    ┴ ┴┴ ┴└─┘┴└─
+    // If configured to do so, start auto-connecting after the first cycle of the event loop
+    // has completed (to allow time for this behavior to be configured/disabled
+    // by specifying properties on `io.sails`)
+
+    // Indicate that the autoConnect timer has started.
+    io.socket._mightBeAboutToAutoConnect = true;
+
+    setTimeout(function() {
+
+      // Indicate that the autoConect timer fired.
+      io.socket._mightBeAboutToAutoConnect = false;
+
+      // If autoConnect is disabled, delete the eager socket (io.socket) and bail out.
+      if (io.sails.autoConnect === false || io.sails.autoconnect === false) {
+        delete io.socket;
+        return;
+      }
+
+      // consolog('Eagerly auto-connecting socket to Sails... (requests will be queued in the mean-time)');
+      io.socket._connect();
+
+
+    }, 0); // </setTimeout>
+
+
+    // Return the `io` object.
+    return io;
+  } //</SailsIOClient>
+
+  //
+  /////////////////////////////////////////////////////////////////////////////////
+  ///// </bunches of private function definitions, constructors, and methods>
+  /////////////////////////////////////////////////////////////////////////////////
+
+
+
+
+  //  ███████╗██╗  ██╗██████╗  ██████╗ ███████╗███████╗    ███████╗██████╗ ██╗  ██╗
+  //  ██╔════╝╚██╗██╔╝██╔══██╗██╔═══██╗██╔════╝██╔════╝    ██╔════╝██╔══██╗██║ ██╔╝
+  //  █████╗   ╚███╔╝ ██████╔╝██║   ██║███████╗█████╗      ███████╗██║  ██║█████╔╝
+  //  ██╔══╝   ██╔██╗ ██╔═══╝ ██║   ██║╚════██║██╔══╝      ╚════██║██║  ██║██╔═██╗
+  //  ███████╗██╔╝ ██╗██║     ╚██████╔╝███████║███████╗    ███████║██████╔╝██║  ██╗
+  //  ╚══════╝╚═╝  ╚═╝╚═╝      ╚═════╝ ╚══════╝╚══════╝    ╚══════╝╚═════╝ ╚═╝  ╚═╝
+  //
+
+
+  // Add CommonJS support to allow this client SDK to be used from Node.js.
+  if (SDK_INFO.platform === 'node') {
+    module.exports = SailsIOClient;
+  }
+  // Add AMD support, registering this client SDK as an anonymous module.
+  else if (typeof define === 'function' && define.amd) {
+    define([], function() {
+      return SailsIOClient;
+    });
+  }
+  else {
+    // Otherwise, try to instantiate the client using the global `io`:
+    SailsIOClient();
+
+    // Note:
+    // If you are modifying this file manually to wrap an existing socket.io client
+    // (e.g. to prevent pollution of the global namespace), you can replace the global
+    // `io` with your own `io` instance above.
+  }
+
+})();
+;
+
+/* eslint-enable */
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/vue-router.js b/ee/bulk-operations-dashboard/assets/dependencies/vue-router.js
new file mode 100644
index 000000000000..56c53972d3d2
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/vue-router.js
@@ -0,0 +1,2513 @@
+/**
+  * vue-router v2.7.0
+  * (c) 2017 Evan You
+  * @license MIT
+  */
+(function (global, factory) {
+  typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
+  typeof define === 'function' && define.amd ? define(factory) :
+  (global.VueRouter = factory());
+}(this, (function () { 'use strict';
+
+/*  */
+
+function assert (condition, message) {
+  if (!condition) {
+    throw new Error(("[vue-router] " + message))
+  }
+}
+
+function warn (condition, message) {
+  if ("development" !== 'production' && !condition) {
+    typeof console !== 'undefined' && console.warn(("[vue-router] " + message));
+  }
+}
+
+function isError (err) {
+  return Object.prototype.toString.call(err).indexOf('Error') > -1
+}
+
+var View = {
+  name: 'router-view',
+  functional: true,
+  props: {
+    name: {
+      type: String,
+      default: 'default'
+    }
+  },
+  render: function render (_, ref) {
+    var props = ref.props;
+    var children = ref.children;
+    var parent = ref.parent;
+    var data = ref.data;
+
+    data.routerView = true;
+
+    // directly use parent context's createElement() function
+    // so that components rendered by router-view can resolve named slots
+    var h = parent.$createElement;
+    var name = props.name;
+    var route = parent.$route;
+    var cache = parent._routerViewCache || (parent._routerViewCache = {});
+
+    // determine current view depth, also check to see if the tree
+    // has been toggled inactive but kept-alive.
+    var depth = 0;
+    var inactive = false;
+    while (parent && parent._routerRoot !== parent) {
+      if (parent.$vnode && parent.$vnode.data.routerView) {
+        depth++;
+      }
+      if (parent._inactive) {
+        inactive = true;
+      }
+      parent = parent.$parent;
+    }
+    data.routerViewDepth = depth;
+
+    // render previous view if the tree is inactive and kept-alive
+    if (inactive) {
+      return h(cache[name], data, children)
+    }
+
+    var matched = route.matched[depth];
+    // render empty node if no matched route
+    if (!matched) {
+      cache[name] = null;
+      return h()
+    }
+
+    var component = cache[name] = matched.components[name];
+
+    // attach instance registration hook
+    // this will be called in the instance's injected lifecycle hooks
+    data.registerRouteInstance = function (vm, val) {
+      // val could be undefined for unregistration
+      var current = matched.instances[name];
+      if (
+        (val && current !== vm) ||
+        (!val && current === vm)
+      ) {
+        matched.instances[name] = val;
+      }
+    }
+
+    // also regiseter instance in prepatch hook
+    // in case the same component instance is reused across different routes
+    ;(data.hook || (data.hook = {})).prepatch = function (_, vnode) {
+      matched.instances[name] = vnode.componentInstance;
+    };
+
+    // resolve props
+    data.props = resolveProps(route, matched.props && matched.props[name]);
+
+    return h(component, data, children)
+  }
+};
+
+function resolveProps (route, config) {
+  switch (typeof config) {
+    case 'undefined':
+      return
+    case 'object':
+      return config
+    case 'function':
+      return config(route)
+    case 'boolean':
+      return config ? route.params : undefined
+    default:
+      {
+        warn(
+          false,
+          "props in \"" + (route.path) + "\" is a " + (typeof config) + ", " +
+          "expecting an object, function or boolean."
+        );
+      }
+  }
+}
+
+/*  */
+
+var encodeReserveRE = /[!'()*]/g;
+var encodeReserveReplacer = function (c) { return '%' + c.charCodeAt(0).toString(16); };
+var commaRE = /%2C/g;
+
+// fixed encodeURIComponent which is more conformant to RFC3986:
+// - escapes [!'()*]
+// - preserve commas
+var encode = function (str) { return encodeURIComponent(str)
+  .replace(encodeReserveRE, encodeReserveReplacer)
+  .replace(commaRE, ','); };
+
+var decode = decodeURIComponent;
+
+function resolveQuery (
+  query,
+  extraQuery,
+  _parseQuery
+) {
+  if ( extraQuery === void 0 ) extraQuery = {};
+
+  var parse = _parseQuery || parseQuery;
+  var parsedQuery;
+  try {
+    parsedQuery = parse(query || '');
+  } catch (e) {
+    "development" !== 'production' && warn(false, e.message);
+    parsedQuery = {};
+  }
+  for (var key in extraQuery) {
+    var val = extraQuery[key];
+    parsedQuery[key] = Array.isArray(val) ? val.slice() : val;
+  }
+  return parsedQuery
+}
+
+function parseQuery (query) {
+  var res = {};
+
+  query = query.trim().replace(/^(\?|#|&)/, '');
+
+  if (!query) {
+    return res
+  }
+
+  query.split('&').forEach(function (param) {
+    var parts = param.replace(/\+/g, ' ').split('=');
+    var key = decode(parts.shift());
+    var val = parts.length > 0
+      ? decode(parts.join('='))
+      : null;
+
+    if (res[key] === undefined) {
+      res[key] = val;
+    } else if (Array.isArray(res[key])) {
+      res[key].push(val);
+    } else {
+      res[key] = [res[key], val];
+    }
+  });
+
+  return res
+}
+
+function stringifyQuery (obj) {
+  var res = obj ? Object.keys(obj).map(function (key) {
+    var val = obj[key];
+
+    if (val === undefined) {
+      return ''
+    }
+
+    if (val === null) {
+      return encode(key)
+    }
+
+    if (Array.isArray(val)) {
+      var result = [];
+      val.forEach(function (val2) {
+        if (val2 === undefined) {
+          return
+        }
+        if (val2 === null) {
+          result.push(encode(key));
+        } else {
+          result.push(encode(key) + '=' + encode(val2));
+        }
+      });
+      return result.join('&')
+    }
+
+    return encode(key) + '=' + encode(val)
+  }).filter(function (x) { return x.length > 0; }).join('&') : null;
+  return res ? ("?" + res) : ''
+}
+
+/*  */
+
+
+var trailingSlashRE = /\/?$/;
+
+function createRoute (
+  record,
+  location,
+  redirectedFrom,
+  router
+) {
+  var stringifyQuery$$1 = router && router.options.stringifyQuery;
+  var route = {
+    name: location.name || (record && record.name),
+    meta: (record && record.meta) || {},
+    path: location.path || '/',
+    hash: location.hash || '',
+    query: location.query || {},
+    params: location.params || {},
+    fullPath: getFullPath(location, stringifyQuery$$1),
+    matched: record ? formatMatch(record) : []
+  };
+  if (redirectedFrom) {
+    route.redirectedFrom = getFullPath(redirectedFrom, stringifyQuery$$1);
+  }
+  return Object.freeze(route)
+}
+
+// the starting route that represents the initial state
+var START = createRoute(null, {
+  path: '/'
+});
+
+function formatMatch (record) {
+  var res = [];
+  while (record) {
+    res.unshift(record);
+    record = record.parent;
+  }
+  return res
+}
+
+function getFullPath (
+  ref,
+  _stringifyQuery
+) {
+  var path = ref.path;
+  var query = ref.query; if ( query === void 0 ) query = {};
+  var hash = ref.hash; if ( hash === void 0 ) hash = '';
+
+  var stringify = _stringifyQuery || stringifyQuery;
+  return (path || '/') + stringify(query) + hash
+}
+
+function isSameRoute (a, b) {
+  if (b === START) {
+    return a === b
+  } else if (!b) {
+    return false
+  } else if (a.path && b.path) {
+    return (
+      a.path.replace(trailingSlashRE, '') === b.path.replace(trailingSlashRE, '') &&
+      a.hash === b.hash &&
+      isObjectEqual(a.query, b.query)
+    )
+  } else if (a.name && b.name) {
+    return (
+      a.name === b.name &&
+      a.hash === b.hash &&
+      isObjectEqual(a.query, b.query) &&
+      isObjectEqual(a.params, b.params)
+    )
+  } else {
+    return false
+  }
+}
+
+function isObjectEqual (a, b) {
+  if ( a === void 0 ) a = {};
+  if ( b === void 0 ) b = {};
+
+  var aKeys = Object.keys(a);
+  var bKeys = Object.keys(b);
+  if (aKeys.length !== bKeys.length) {
+    return false
+  }
+  return aKeys.every(function (key) {
+    var aVal = a[key];
+    var bVal = b[key];
+    // check nested equality
+    if (typeof aVal === 'object' && typeof bVal === 'object') {
+      return isObjectEqual(aVal, bVal)
+    }
+    return String(aVal) === String(bVal)
+  })
+}
+
+function isIncludedRoute (current, target) {
+  return (
+    current.path.replace(trailingSlashRE, '/').indexOf(
+      target.path.replace(trailingSlashRE, '/')
+    ) === 0 &&
+    (!target.hash || current.hash === target.hash) &&
+    queryIncludes(current.query, target.query)
+  )
+}
+
+function queryIncludes (current, target) {
+  for (var key in target) {
+    if (!(key in current)) {
+      return false
+    }
+  }
+  return true
+}
+
+/*  */
+
+// work around weird flow bug
+var toTypes = [String, Object];
+var eventTypes = [String, Array];
+
+var Link = {
+  name: 'router-link',
+  props: {
+    to: {
+      type: toTypes,
+      required: true
+    },
+    tag: {
+      type: String,
+      default: 'a'
+    },
+    exact: Boolean,
+    append: Boolean,
+    replace: Boolean,
+    activeClass: String,
+    exactActiveClass: String,
+    event: {
+      type: eventTypes,
+      default: 'click'
+    }
+  },
+  render: function render (h) {
+    var this$1 = this;
+
+    var router = this.$router;
+    var current = this.$route;
+    var ref = router.resolve(this.to, current, this.append);
+    var location = ref.location;
+    var route = ref.route;
+    var href = ref.href;
+
+    var classes = {};
+    var globalActiveClass = router.options.linkActiveClass;
+    var globalExactActiveClass = router.options.linkExactActiveClass;
+    // Support global empty active class
+    var activeClassFallback = globalActiveClass == null
+            ? 'router-link-active'
+            : globalActiveClass;
+    var exactActiveClassFallback = globalExactActiveClass == null
+            ? 'router-link-exact-active'
+            : globalExactActiveClass;
+    var activeClass = this.activeClass == null
+            ? activeClassFallback
+            : this.activeClass;
+    var exactActiveClass = this.exactActiveClass == null
+            ? exactActiveClassFallback
+            : this.exactActiveClass;
+    var compareTarget = location.path
+      ? createRoute(null, location, null, router)
+      : route;
+
+    classes[exactActiveClass] = isSameRoute(current, compareTarget);
+    classes[activeClass] = this.exact
+      ? classes[exactActiveClass]
+      : isIncludedRoute(current, compareTarget);
+
+    var handler = function (e) {
+      if (guardEvent(e)) {
+        if (this$1.replace) {
+          router.replace(location);
+        } else {
+          router.push(location);
+        }
+      }
+    };
+
+    var on = { click: guardEvent };
+    if (Array.isArray(this.event)) {
+      this.event.forEach(function (e) { on[e] = handler; });
+    } else {
+      on[this.event] = handler;
+    }
+
+    var data = {
+      class: classes
+    };
+
+    if (this.tag === 'a') {
+      data.on = on;
+      data.attrs = { href: href };
+    } else {
+      // find the first <a> child and apply listener and href
+      var a = findAnchor(this.$slots.default);
+      if (a) {
+        // in case the <a> is a static node
+        a.isStatic = false;
+        var extend = _Vue.util.extend;
+        var aData = a.data = extend({}, a.data);
+        aData.on = on;
+        var aAttrs = a.data.attrs = extend({}, a.data.attrs);
+        aAttrs.href = href;
+      } else {
+        // doesn't have <a> child, apply listener to self
+        data.on = on;
+      }
+    }
+
+    return h(this.tag, data, this.$slots.default)
+  }
+};
+
+function guardEvent (e) {
+  // don't redirect with control keys
+  if (e.metaKey || e.altKey || e.ctrlKey || e.shiftKey) { return }
+  // don't redirect when preventDefault called
+  if (e.defaultPrevented) { return }
+  // don't redirect on right click
+  if (e.button !== undefined && e.button !== 0) { return }
+  // don't redirect if `target="_blank"`
+  if (e.currentTarget && e.currentTarget.getAttribute) {
+    var target = e.currentTarget.getAttribute('target');
+    if (/\b_blank\b/i.test(target)) { return }
+  }
+  // this may be a Weex event which doesn't have this method
+  if (e.preventDefault) {
+    e.preventDefault();
+  }
+  return true
+}
+
+function findAnchor (children) {
+  if (children) {
+    var child;
+    for (var i = 0; i < children.length; i++) {
+      child = children[i];
+      if (child.tag === 'a') {
+        return child
+      }
+      if (child.children && (child = findAnchor(child.children))) {
+        return child
+      }
+    }
+  }
+}
+
+var _Vue;
+
+function install (Vue) {
+  if (install.installed) { return }
+  install.installed = true;
+
+  _Vue = Vue;
+
+  var isDef = function (v) { return v !== undefined; };
+
+  var registerInstance = function (vm, callVal) {
+    var i = vm.$options._parentVnode;
+    if (isDef(i) && isDef(i = i.data) && isDef(i = i.registerRouteInstance)) {
+      i(vm, callVal);
+    }
+  };
+
+  Vue.mixin({
+    beforeCreate: function beforeCreate () {
+      if (isDef(this.$options.router)) {
+        this._routerRoot = this;
+        this._router = this.$options.router;
+        this._router.init(this);
+        Vue.util.defineReactive(this, '_route', this._router.history.current);
+      } else {
+        this._routerRoot = (this.$parent && this.$parent._routerRoot) || this;
+      }
+      registerInstance(this, this);
+    },
+    destroyed: function destroyed () {
+      registerInstance(this);
+    }
+  });
+
+  Object.defineProperty(Vue.prototype, '$router', {
+    get: function get () { return this._routerRoot._router }
+  });
+
+  Object.defineProperty(Vue.prototype, '$route', {
+    get: function get () { return this._routerRoot._route }
+  });
+
+  Vue.component('router-view', View);
+  Vue.component('router-link', Link);
+
+  var strats = Vue.config.optionMergeStrategies;
+  // use the same hook merging strategy for route hooks
+  strats.beforeRouteEnter = strats.beforeRouteLeave = strats.beforeRouteUpdate = strats.created;
+}
+
+/*  */
+
+var inBrowser = typeof window !== 'undefined';
+
+/*  */
+
+function resolvePath (
+  relative,
+  base,
+  append
+) {
+  var firstChar = relative.charAt(0);
+  if (firstChar === '/') {
+    return relative
+  }
+
+  if (firstChar === '?' || firstChar === '#') {
+    return base + relative
+  }
+
+  var stack = base.split('/');
+
+  // remove trailing segment if:
+  // - not appending
+  // - appending to trailing slash (last segment is empty)
+  if (!append || !stack[stack.length - 1]) {
+    stack.pop();
+  }
+
+  // resolve relative path
+  var segments = relative.replace(/^\//, '').split('/');
+  for (var i = 0; i < segments.length; i++) {
+    var segment = segments[i];
+    if (segment === '..') {
+      stack.pop();
+    } else if (segment !== '.') {
+      stack.push(segment);
+    }
+  }
+
+  // ensure leading slash
+  if (stack[0] !== '') {
+    stack.unshift('');
+  }
+
+  return stack.join('/')
+}
+
+function parsePath (path) {
+  var hash = '';
+  var query = '';
+
+  var hashIndex = path.indexOf('#');
+  if (hashIndex >= 0) {
+    hash = path.slice(hashIndex);
+    path = path.slice(0, hashIndex);
+  }
+
+  var queryIndex = path.indexOf('?');
+  if (queryIndex >= 0) {
+    query = path.slice(queryIndex + 1);
+    path = path.slice(0, queryIndex);
+  }
+
+  return {
+    path: path,
+    query: query,
+    hash: hash
+  }
+}
+
+function cleanPath (path) {
+  return path.replace(/\/\//g, '/')
+}
+
+var index$1 = Array.isArray || function (arr) {
+  return Object.prototype.toString.call(arr) == '[object Array]';
+};
+
+/**
+ * Expose `pathToRegexp`.
+ */
+var index = pathToRegexp;
+var parse_1 = parse;
+var compile_1 = compile;
+var tokensToFunction_1 = tokensToFunction;
+var tokensToRegExp_1 = tokensToRegExp;
+
+/**
+ * The main path matching regexp utility.
+ *
+ * @type {RegExp}
+ */
+var PATH_REGEXP = new RegExp([
+  // Match escaped characters that would otherwise appear in future matches.
+  // This allows the user to escape special characters that won't transform.
+  '(\\\\.)',
+  // Match Express-style parameters and un-named parameters with a prefix
+  // and optional suffixes. Matches appear as:
+  //
+  // "/:test(\\d+)?" => ["/", "test", "\d+", undefined, "?", undefined]
+  // "/route(\\d+)"  => [undefined, undefined, undefined, "\d+", undefined, undefined]
+  // "/*"            => ["/", undefined, undefined, undefined, undefined, "*"]
+  '([\\/.])?(?:(?:\\:(\\w+)(?:\\(((?:\\\\.|[^\\\\()])+)\\))?|\\(((?:\\\\.|[^\\\\()])+)\\))([+*?])?|(\\*))'
+].join('|'), 'g');
+
+/**
+ * Parse a string for the raw tokens.
+ *
+ * @param  {string}  str
+ * @param  {Object=} options
+ * @return {!Array}
+ */
+function parse (str, options) {
+  var tokens = [];
+  var key = 0;
+  var index = 0;
+  var path = '';
+  var defaultDelimiter = options && options.delimiter || '/';
+  var res;
+
+  while ((res = PATH_REGEXP.exec(str)) != null) {
+    var m = res[0];
+    var escaped = res[1];
+    var offset = res.index;
+    path += str.slice(index, offset);
+    index = offset + m.length;
+
+    // Ignore already escaped sequences.
+    if (escaped) {
+      path += escaped[1];
+      continue
+    }
+
+    var next = str[index];
+    var prefix = res[2];
+    var name = res[3];
+    var capture = res[4];
+    var group = res[5];
+    var modifier = res[6];
+    var asterisk = res[7];
+
+    // Push the current path onto the tokens.
+    if (path) {
+      tokens.push(path);
+      path = '';
+    }
+
+    var partial = prefix != null && next != null && next !== prefix;
+    var repeat = modifier === '+' || modifier === '*';
+    var optional = modifier === '?' || modifier === '*';
+    var delimiter = res[2] || defaultDelimiter;
+    var pattern = capture || group;
+
+    tokens.push({
+      name: name || key++,
+      prefix: prefix || '',
+      delimiter: delimiter,
+      optional: optional,
+      repeat: repeat,
+      partial: partial,
+      asterisk: !!asterisk,
+      pattern: pattern ? escapeGroup(pattern) : (asterisk ? '.*' : '[^' + escapeString(delimiter) + ']+?')
+    });
+  }
+
+  // Match any characters still remaining.
+  if (index < str.length) {
+    path += str.substr(index);
+  }
+
+  // If the path exists, push it onto the end.
+  if (path) {
+    tokens.push(path);
+  }
+
+  return tokens
+}
+
+/**
+ * Compile a string to a template function for the path.
+ *
+ * @param  {string}             str
+ * @param  {Object=}            options
+ * @return {!function(Object=, Object=)}
+ */
+function compile (str, options) {
+  return tokensToFunction(parse(str, options))
+}
+
+/**
+ * Prettier encoding of URI path segments.
+ *
+ * @param  {string}
+ * @return {string}
+ */
+function encodeURIComponentPretty (str) {
+  return encodeURI(str).replace(/[\/?#]/g, function (c) {
+    return '%' + c.charCodeAt(0).toString(16).toUpperCase()
+  })
+}
+
+/**
+ * Encode the asterisk parameter. Similar to `pretty`, but allows slashes.
+ *
+ * @param  {string}
+ * @return {string}
+ */
+function encodeAsterisk (str) {
+  return encodeURI(str).replace(/[?#]/g, function (c) {
+    return '%' + c.charCodeAt(0).toString(16).toUpperCase()
+  })
+}
+
+/**
+ * Expose a method for transforming tokens into the path function.
+ */
+function tokensToFunction (tokens) {
+  // Compile all the tokens into regexps.
+  var matches = new Array(tokens.length);
+
+  // Compile all the patterns before compilation.
+  for (var i = 0; i < tokens.length; i++) {
+    if (typeof tokens[i] === 'object') {
+      matches[i] = new RegExp('^(?:' + tokens[i].pattern + ')$');
+    }
+  }
+
+  return function (obj, opts) {
+    var path = '';
+    var data = obj || {};
+    var options = opts || {};
+    var encode = options.pretty ? encodeURIComponentPretty : encodeURIComponent;
+
+    for (var i = 0; i < tokens.length; i++) {
+      var token = tokens[i];
+
+      if (typeof token === 'string') {
+        path += token;
+
+        continue
+      }
+
+      var value = data[token.name];
+      var segment;
+
+      if (value == null) {
+        if (token.optional) {
+          // Prepend partial segment prefixes.
+          if (token.partial) {
+            path += token.prefix;
+          }
+
+          continue
+        } else {
+          throw new TypeError('Expected "' + token.name + '" to be defined')
+        }
+      }
+
+      if (index$1(value)) {
+        if (!token.repeat) {
+          throw new TypeError('Expected "' + token.name + '" to not repeat, but received `' + JSON.stringify(value) + '`')
+        }
+
+        if (value.length === 0) {
+          if (token.optional) {
+            continue
+          } else {
+            throw new TypeError('Expected "' + token.name + '" to not be empty')
+          }
+        }
+
+        for (var j = 0; j < value.length; j++) {
+          segment = encode(value[j]);
+
+          if (!matches[i].test(segment)) {
+            throw new TypeError('Expected all "' + token.name + '" to match "' + token.pattern + '", but received `' + JSON.stringify(segment) + '`')
+          }
+
+          path += (j === 0 ? token.prefix : token.delimiter) + segment;
+        }
+
+        continue
+      }
+
+      segment = token.asterisk ? encodeAsterisk(value) : encode(value);
+
+      if (!matches[i].test(segment)) {
+        throw new TypeError('Expected "' + token.name + '" to match "' + token.pattern + '", but received "' + segment + '"')
+      }
+
+      path += token.prefix + segment;
+    }
+
+    return path
+  }
+}
+
+/**
+ * Escape a regular expression string.
+ *
+ * @param  {string} str
+ * @return {string}
+ */
+function escapeString (str) {
+  return str.replace(/([.+*?=^!:${}()[\]|\/\\])/g, '\\$1')
+}
+
+/**
+ * Escape the capturing group by escaping special characters and meaning.
+ *
+ * @param  {string} group
+ * @return {string}
+ */
+function escapeGroup (group) {
+  return group.replace(/([=!:$\/()])/g, '\\$1')
+}
+
+/**
+ * Attach the keys as a property of the regexp.
+ *
+ * @param  {!RegExp} re
+ * @param  {Array}   keys
+ * @return {!RegExp}
+ */
+function attachKeys (re, keys) {
+  re.keys = keys;
+  return re
+}
+
+/**
+ * Get the flags for a regexp from the options.
+ *
+ * @param  {Object} options
+ * @return {string}
+ */
+function flags (options) {
+  return options.sensitive ? '' : 'i'
+}
+
+/**
+ * Pull out keys from a regexp.
+ *
+ * @param  {!RegExp} path
+ * @param  {!Array}  keys
+ * @return {!RegExp}
+ */
+function regexpToRegexp (path, keys) {
+  // Use a negative lookahead to match only capturing groups.
+  var groups = path.source.match(/\((?!\?)/g);
+
+  if (groups) {
+    for (var i = 0; i < groups.length; i++) {
+      keys.push({
+        name: i,
+        prefix: null,
+        delimiter: null,
+        optional: false,
+        repeat: false,
+        partial: false,
+        asterisk: false,
+        pattern: null
+      });
+    }
+  }
+
+  return attachKeys(path, keys)
+}
+
+/**
+ * Transform an array into a regexp.
+ *
+ * @param  {!Array}  path
+ * @param  {Array}   keys
+ * @param  {!Object} options
+ * @return {!RegExp}
+ */
+function arrayToRegexp (path, keys, options) {
+  var parts = [];
+
+  for (var i = 0; i < path.length; i++) {
+    parts.push(pathToRegexp(path[i], keys, options).source);
+  }
+
+  var regexp = new RegExp('(?:' + parts.join('|') + ')', flags(options));
+
+  return attachKeys(regexp, keys)
+}
+
+/**
+ * Create a path regexp from string input.
+ *
+ * @param  {string}  path
+ * @param  {!Array}  keys
+ * @param  {!Object} options
+ * @return {!RegExp}
+ */
+function stringToRegexp (path, keys, options) {
+  return tokensToRegExp(parse(path, options), keys, options)
+}
+
+/**
+ * Expose a function for taking tokens and returning a RegExp.
+ *
+ * @param  {!Array}          tokens
+ * @param  {(Array|Object)=} keys
+ * @param  {Object=}         options
+ * @return {!RegExp}
+ */
+function tokensToRegExp (tokens, keys, options) {
+  if (!index$1(keys)) {
+    options = /** @type {!Object} */ (keys || options);
+    keys = [];
+  }
+
+  options = options || {};
+
+  var strict = options.strict;
+  var end = options.end !== false;
+  var route = '';
+
+  // Iterate over the tokens and create our regexp string.
+  for (var i = 0; i < tokens.length; i++) {
+    var token = tokens[i];
+
+    if (typeof token === 'string') {
+      route += escapeString(token);
+    } else {
+      var prefix = escapeString(token.prefix);
+      var capture = '(?:' + token.pattern + ')';
+
+      keys.push(token);
+
+      if (token.repeat) {
+        capture += '(?:' + prefix + capture + ')*';
+      }
+
+      if (token.optional) {
+        if (!token.partial) {
+          capture = '(?:' + prefix + '(' + capture + '))?';
+        } else {
+          capture = prefix + '(' + capture + ')?';
+        }
+      } else {
+        capture = prefix + '(' + capture + ')';
+      }
+
+      route += capture;
+    }
+  }
+
+  var delimiter = escapeString(options.delimiter || '/');
+  var endsWithDelimiter = route.slice(-delimiter.length) === delimiter;
+
+  // In non-strict mode we allow a slash at the end of match. If the path to
+  // match already ends with a slash, we remove it for consistency. The slash
+  // is valid at the end of a path match, not in the middle. This is important
+  // in non-ending mode, where "/test/" shouldn't match "/test//route".
+  if (!strict) {
+    route = (endsWithDelimiter ? route.slice(0, -delimiter.length) : route) + '(?:' + delimiter + '(?=$))?';
+  }
+
+  if (end) {
+    route += '$';
+  } else {
+    // In non-ending mode, we need the capturing groups to match as much as
+    // possible by using a positive lookahead to the end or next path segment.
+    route += strict && endsWithDelimiter ? '' : '(?=' + delimiter + '|$)';
+  }
+
+  return attachKeys(new RegExp('^' + route, flags(options)), keys)
+}
+
+/**
+ * Normalize the given path string, returning a regular expression.
+ *
+ * An empty array can be passed in for the keys, which will hold the
+ * placeholder key descriptions. For example, using `/user/:id`, `keys` will
+ * contain `[{ name: 'id', delimiter: '/', optional: false, repeat: false }]`.
+ *
+ * @param  {(string|RegExp|Array)} path
+ * @param  {(Array|Object)=}       keys
+ * @param  {Object=}               options
+ * @return {!RegExp}
+ */
+function pathToRegexp (path, keys, options) {
+  if (!index$1(keys)) {
+    options = /** @type {!Object} */ (keys || options);
+    keys = [];
+  }
+
+  options = options || {};
+
+  if (path instanceof RegExp) {
+    return regexpToRegexp(path, /** @type {!Array} */ (keys))
+  }
+
+  if (index$1(path)) {
+    return arrayToRegexp(/** @type {!Array} */ (path), /** @type {!Array} */ (keys), options)
+  }
+
+  return stringToRegexp(/** @type {string} */ (path), /** @type {!Array} */ (keys), options)
+}
+
+index.parse = parse_1;
+index.compile = compile_1;
+index.tokensToFunction = tokensToFunction_1;
+index.tokensToRegExp = tokensToRegExp_1;
+
+/*  */
+
+var regexpCompileCache = Object.create(null);
+
+function fillParams (
+  path,
+  params,
+  routeMsg
+) {
+  try {
+    var filler =
+      regexpCompileCache[path] ||
+      (regexpCompileCache[path] = index.compile(path));
+    return filler(params || {}, { pretty: true })
+  } catch (e) {
+    {
+      warn(false, ("missing param for " + routeMsg + ": " + (e.message)));
+    }
+    return ''
+  }
+}
+
+/*  */
+
+function createRouteMap (
+  routes,
+  oldPathList,
+  oldPathMap,
+  oldNameMap
+) {
+  // the path list is used to control path matching priority
+  var pathList = oldPathList || [];
+  var pathMap = oldPathMap || Object.create(null);
+  var nameMap = oldNameMap || Object.create(null);
+
+  routes.forEach(function (route) {
+    addRouteRecord(pathList, pathMap, nameMap, route);
+  });
+
+  // ensure wildcard routes are always at the end
+  for (var i = 0, l = pathList.length; i < l; i++) {
+    if (pathList[i] === '*') {
+      pathList.push(pathList.splice(i, 1)[0]);
+      l--;
+      i--;
+    }
+  }
+
+  return {
+    pathList: pathList,
+    pathMap: pathMap,
+    nameMap: nameMap
+  }
+}
+
+function addRouteRecord (
+  pathList,
+  pathMap,
+  nameMap,
+  route,
+  parent,
+  matchAs
+) {
+  var path = route.path;
+  var name = route.name;
+  {
+    assert(path != null, "\"path\" is required in a route configuration.");
+    assert(
+      typeof route.component !== 'string',
+      "route config \"component\" for path: " + (String(path || name)) + " cannot be a " +
+      "string id. Use an actual component instead."
+    );
+  }
+
+  var normalizedPath = normalizePath(path, parent);
+  var pathToRegexpOptions = route.pathToRegexpOptions || {};
+
+  if (typeof route.caseSensitive === 'boolean') {
+    pathToRegexpOptions.sensitive = route.caseSensitive;
+  }
+
+  var record = {
+    path: normalizedPath,
+    regex: compileRouteRegex(normalizedPath, pathToRegexpOptions),
+    components: route.components || { default: route.component },
+    instances: {},
+    name: name,
+    parent: parent,
+    matchAs: matchAs,
+    redirect: route.redirect,
+    beforeEnter: route.beforeEnter,
+    meta: route.meta || {},
+    props: route.props == null
+      ? {}
+      : route.components
+        ? route.props
+        : { default: route.props }
+  };
+
+  if (route.children) {
+    // Warn if route is named, does not redirect and has a default child route.
+    // If users navigate to this route by name, the default child will
+    // not be rendered (GH Issue #629)
+    {
+      if (route.name && !route.redirect && route.children.some(function (child) { return /^\/?$/.test(child.path); })) {
+        warn(
+          false,
+          "Named Route '" + (route.name) + "' has a default child route. " +
+          "When navigating to this named route (:to=\"{name: '" + (route.name) + "'\"), " +
+          "the default child route will not be rendered. Remove the name from " +
+          "this route and use the name of the default child route for named " +
+          "links instead."
+        );
+      }
+    }
+    route.children.forEach(function (child) {
+      var childMatchAs = matchAs
+        ? cleanPath((matchAs + "/" + (child.path)))
+        : undefined;
+      addRouteRecord(pathList, pathMap, nameMap, child, record, childMatchAs);
+    });
+  }
+
+  if (route.alias !== undefined) {
+    var aliases = Array.isArray(route.alias)
+      ? route.alias
+      : [route.alias];
+
+    aliases.forEach(function (alias) {
+      var aliasRoute = {
+        path: alias,
+        children: route.children
+      };
+      addRouteRecord(
+        pathList,
+        pathMap,
+        nameMap,
+        aliasRoute,
+        parent,
+        record.path || '/' // matchAs
+      );
+    });
+  }
+
+  if (!pathMap[record.path]) {
+    pathList.push(record.path);
+    pathMap[record.path] = record;
+  }
+
+  if (name) {
+    if (!nameMap[name]) {
+      nameMap[name] = record;
+    } else if ("development" !== 'production' && !matchAs) {
+      warn(
+        false,
+        "Duplicate named routes definition: " +
+        "{ name: \"" + name + "\", path: \"" + (record.path) + "\" }"
+      );
+    }
+  }
+}
+
+function compileRouteRegex (path, pathToRegexpOptions) {
+  var regex = index(path, [], pathToRegexpOptions);
+  {
+    var keys = {};
+    regex.keys.forEach(function (key) {
+      warn(!keys[key.name], ("Duplicate param keys in route with path: \"" + path + "\""));
+      keys[key.name] = true;
+    });
+  }
+  return regex
+}
+
+function normalizePath (path, parent) {
+  path = path.replace(/\/$/, '');
+  if (path[0] === '/') { return path }
+  if (parent == null) { return path }
+  return cleanPath(((parent.path) + "/" + path))
+}
+
+/*  */
+
+
+function normalizeLocation (
+  raw,
+  current,
+  append,
+  router
+) {
+  var next = typeof raw === 'string' ? { path: raw } : raw;
+  // named target
+  if (next.name || next._normalized) {
+    return next
+  }
+
+  // relative params
+  if (!next.path && next.params && current) {
+    next = assign({}, next);
+    next._normalized = true;
+    var params = assign(assign({}, current.params), next.params);
+    if (current.name) {
+      next.name = current.name;
+      next.params = params;
+    } else if (current.matched.length) {
+      var rawPath = current.matched[current.matched.length - 1].path;
+      next.path = fillParams(rawPath, params, ("path " + (current.path)));
+    } else {
+      warn(false, "relative params navigation requires a current route.");
+    }
+    return next
+  }
+
+  var parsedPath = parsePath(next.path || '');
+  var basePath = (current && current.path) || '/';
+  var path = parsedPath.path
+    ? resolvePath(parsedPath.path, basePath, append || next.append)
+    : basePath;
+
+  var query = resolveQuery(
+    parsedPath.query,
+    next.query,
+    router && router.options.parseQuery
+  );
+
+  var hash = next.hash || parsedPath.hash;
+  if (hash && hash.charAt(0) !== '#') {
+    hash = "#" + hash;
+  }
+
+  return {
+    _normalized: true,
+    path: path,
+    query: query,
+    hash: hash
+  }
+}
+
+function assign (a, b) {
+  for (var key in b) {
+    a[key] = b[key];
+  }
+  return a
+}
+
+/*  */
+
+
+function createMatcher (
+  routes,
+  router
+) {
+  var ref = createRouteMap(routes);
+  var pathList = ref.pathList;
+  var pathMap = ref.pathMap;
+  var nameMap = ref.nameMap;
+
+  function addRoutes (routes) {
+    createRouteMap(routes, pathList, pathMap, nameMap);
+  }
+
+  function match (
+    raw,
+    currentRoute,
+    redirectedFrom
+  ) {
+    var location = normalizeLocation(raw, currentRoute, false, router);
+    var name = location.name;
+
+    if (name) {
+      var record = nameMap[name];
+      {
+        warn(record, ("Route with name '" + name + "' does not exist"));
+      }
+      if (!record) { return _createRoute(null, location) }
+      var paramNames = record.regex.keys
+        .filter(function (key) { return !key.optional; })
+        .map(function (key) { return key.name; });
+
+      if (typeof location.params !== 'object') {
+        location.params = {};
+      }
+
+      if (currentRoute && typeof currentRoute.params === 'object') {
+        for (var key in currentRoute.params) {
+          if (!(key in location.params) && paramNames.indexOf(key) > -1) {
+            location.params[key] = currentRoute.params[key];
+          }
+        }
+      }
+
+      if (record) {
+        location.path = fillParams(record.path, location.params, ("named route \"" + name + "\""));
+        return _createRoute(record, location, redirectedFrom)
+      }
+    } else if (location.path) {
+      location.params = {};
+      for (var i = 0; i < pathList.length; i++) {
+        var path = pathList[i];
+        var record$1 = pathMap[path];
+        if (matchRoute(record$1.regex, location.path, location.params)) {
+          return _createRoute(record$1, location, redirectedFrom)
+        }
+      }
+    }
+    // no match
+    return _createRoute(null, location)
+  }
+
+  function redirect (
+    record,
+    location
+  ) {
+    var originalRedirect = record.redirect;
+    var redirect = typeof originalRedirect === 'function'
+        ? originalRedirect(createRoute(record, location, null, router))
+        : originalRedirect;
+
+    if (typeof redirect === 'string') {
+      redirect = { path: redirect };
+    }
+
+    if (!redirect || typeof redirect !== 'object') {
+      {
+        warn(
+          false, ("invalid redirect option: " + (JSON.stringify(redirect)))
+        );
+      }
+      return _createRoute(null, location)
+    }
+
+    var re = redirect;
+    var name = re.name;
+    var path = re.path;
+    var query = location.query;
+    var hash = location.hash;
+    var params = location.params;
+    query = re.hasOwnProperty('query') ? re.query : query;
+    hash = re.hasOwnProperty('hash') ? re.hash : hash;
+    params = re.hasOwnProperty('params') ? re.params : params;
+
+    if (name) {
+      // resolved named direct
+      var targetRecord = nameMap[name];
+      {
+        assert(targetRecord, ("redirect failed: named route \"" + name + "\" not found."));
+      }
+      return match({
+        _normalized: true,
+        name: name,
+        query: query,
+        hash: hash,
+        params: params
+      }, undefined, location)
+    } else if (path) {
+      // 1. resolve relative redirect
+      var rawPath = resolveRecordPath(path, record);
+      // 2. resolve params
+      var resolvedPath = fillParams(rawPath, params, ("redirect route with path \"" + rawPath + "\""));
+      // 3. rematch with existing query and hash
+      return match({
+        _normalized: true,
+        path: resolvedPath,
+        query: query,
+        hash: hash
+      }, undefined, location)
+    } else {
+      {
+        warn(false, ("invalid redirect option: " + (JSON.stringify(redirect))));
+      }
+      return _createRoute(null, location)
+    }
+  }
+
+  function alias (
+    record,
+    location,
+    matchAs
+  ) {
+    var aliasedPath = fillParams(matchAs, location.params, ("aliased route with path \"" + matchAs + "\""));
+    var aliasedMatch = match({
+      _normalized: true,
+      path: aliasedPath
+    });
+    if (aliasedMatch) {
+      var matched = aliasedMatch.matched;
+      var aliasedRecord = matched[matched.length - 1];
+      location.params = aliasedMatch.params;
+      return _createRoute(aliasedRecord, location)
+    }
+    return _createRoute(null, location)
+  }
+
+  function _createRoute (
+    record,
+    location,
+    redirectedFrom
+  ) {
+    if (record && record.redirect) {
+      return redirect(record, redirectedFrom || location)
+    }
+    if (record && record.matchAs) {
+      return alias(record, location, record.matchAs)
+    }
+    return createRoute(record, location, redirectedFrom, router)
+  }
+
+  return {
+    match: match,
+    addRoutes: addRoutes
+  }
+}
+
+function matchRoute (
+  regex,
+  path,
+  params
+) {
+  var m = path.match(regex);
+
+  if (!m) {
+    return false
+  } else if (!params) {
+    return true
+  }
+
+  for (var i = 1, len = m.length; i < len; ++i) {
+    var key = regex.keys[i - 1];
+    var val = typeof m[i] === 'string' ? decodeURIComponent(m[i]) : m[i];
+    if (key) {
+      params[key.name] = val;
+    }
+  }
+
+  return true
+}
+
+function resolveRecordPath (path, record) {
+  return resolvePath(path, record.parent ? record.parent.path : '/', true)
+}
+
+/*  */
+
+
+var positionStore = Object.create(null);
+
+function setupScroll () {
+  window.addEventListener('popstate', function (e) {
+    saveScrollPosition();
+    if (e.state && e.state.key) {
+      setStateKey(e.state.key);
+    }
+  });
+}
+
+function handleScroll (
+  router,
+  to,
+  from,
+  isPop
+) {
+  if (!router.app) {
+    return
+  }
+
+  var behavior = router.options.scrollBehavior;
+  if (!behavior) {
+    return
+  }
+
+  {
+    assert(typeof behavior === 'function', "scrollBehavior must be a function");
+  }
+
+  // wait until re-render finishes before scrolling
+  router.app.$nextTick(function () {
+    var position = getScrollPosition();
+    var shouldScroll = behavior(to, from, isPop ? position : null);
+    if (!shouldScroll) {
+      return
+    }
+    var isObject = typeof shouldScroll === 'object';
+    if (isObject && typeof shouldScroll.selector === 'string') {
+      var el = document.querySelector(shouldScroll.selector);
+      if (el) {
+        var offset = shouldScroll.offset && typeof shouldScroll.offset === 'object' ? shouldScroll.offset : {};
+        offset = normalizeOffset(offset);
+        position = getElementPosition(el, offset);
+      } else if (isValidPosition(shouldScroll)) {
+        position = normalizePosition(shouldScroll);
+      }
+    } else if (isObject && isValidPosition(shouldScroll)) {
+      position = normalizePosition(shouldScroll);
+    }
+
+    if (position) {
+      window.scrollTo(position.x, position.y);
+    }
+  });
+}
+
+function saveScrollPosition () {
+  var key = getStateKey();
+  if (key) {
+    positionStore[key] = {
+      x: window.pageXOffset,
+      y: window.pageYOffset
+    };
+  }
+}
+
+function getScrollPosition () {
+  var key = getStateKey();
+  if (key) {
+    return positionStore[key]
+  }
+}
+
+function getElementPosition (el, offset) {
+  var docEl = document.documentElement;
+  var docRect = docEl.getBoundingClientRect();
+  var elRect = el.getBoundingClientRect();
+  return {
+    x: elRect.left - docRect.left - offset.x,
+    y: elRect.top - docRect.top - offset.y
+  }
+}
+
+function isValidPosition (obj) {
+  return isNumber(obj.x) || isNumber(obj.y)
+}
+
+function normalizePosition (obj) {
+  return {
+    x: isNumber(obj.x) ? obj.x : window.pageXOffset,
+    y: isNumber(obj.y) ? obj.y : window.pageYOffset
+  }
+}
+
+function normalizeOffset (obj) {
+  return {
+    x: isNumber(obj.x) ? obj.x : 0,
+    y: isNumber(obj.y) ? obj.y : 0
+  }
+}
+
+function isNumber (v) {
+  return typeof v === 'number'
+}
+
+/*  */
+
+var supportsPushState = inBrowser && (function () {
+  var ua = window.navigator.userAgent;
+
+  if (
+    (ua.indexOf('Android 2.') !== -1 || ua.indexOf('Android 4.0') !== -1) &&
+    ua.indexOf('Mobile Safari') !== -1 &&
+    ua.indexOf('Chrome') === -1 &&
+    ua.indexOf('Windows Phone') === -1
+  ) {
+    return false
+  }
+
+  return window.history && 'pushState' in window.history
+})();
+
+// use User Timing api (if present) for more accurate key precision
+var Time = inBrowser && window.performance && window.performance.now
+  ? window.performance
+  : Date;
+
+var _key = genKey();
+
+function genKey () {
+  return Time.now().toFixed(3)
+}
+
+function getStateKey () {
+  return _key
+}
+
+function setStateKey (key) {
+  _key = key;
+}
+
+function pushState (url, replace) {
+  saveScrollPosition();
+  // try...catch the pushState call to get around Safari
+  // DOM Exception 18 where it limits to 100 pushState calls
+  var history = window.history;
+  try {
+    if (replace) {
+      history.replaceState({ key: _key }, '', url);
+    } else {
+      _key = genKey();
+      history.pushState({ key: _key }, '', url);
+    }
+  } catch (e) {
+    window.location[replace ? 'replace' : 'assign'](url);
+  }
+}
+
+function replaceState (url) {
+  pushState(url, true);
+}
+
+/*  */
+
+function runQueue (queue, fn, cb) {
+  var step = function (index) {
+    if (index >= queue.length) {
+      cb();
+    } else {
+      if (queue[index]) {
+        fn(queue[index], function () {
+          step(index + 1);
+        });
+      } else {
+        step(index + 1);
+      }
+    }
+  };
+  step(0);
+}
+
+/*  */
+
+function resolveAsyncComponents (matched) {
+  return function (to, from, next) {
+    var hasAsync = false;
+    var pending = 0;
+    var error = null;
+
+    flatMapComponents(matched, function (def, _, match, key) {
+      // if it's a function and doesn't have cid attached,
+      // assume it's an async component resolve function.
+      // we are not using Vue's default async resolving mechanism because
+      // we want to halt the navigation until the incoming component has been
+      // resolved.
+      if (typeof def === 'function' && def.cid === undefined) {
+        hasAsync = true;
+        pending++;
+
+        var resolve = once(function (resolvedDef) {
+          if (resolvedDef.__esModule && resolvedDef.default) {
+            resolvedDef = resolvedDef.default;
+          }
+          // save resolved on async factory in case it's used elsewhere
+          def.resolved = typeof resolvedDef === 'function'
+            ? resolvedDef
+            : _Vue.extend(resolvedDef);
+          match.components[key] = resolvedDef;
+          pending--;
+          if (pending <= 0) {
+            next();
+          }
+        });
+
+        var reject = once(function (reason) {
+          var msg = "Failed to resolve async component " + key + ": " + reason;
+          "development" !== 'production' && warn(false, msg);
+          if (!error) {
+            error = isError(reason)
+              ? reason
+              : new Error(msg);
+            next(error);
+          }
+        });
+
+        var res;
+        try {
+          res = def(resolve, reject);
+        } catch (e) {
+          reject(e);
+        }
+        if (res) {
+          if (typeof res.then === 'function') {
+            res.then(resolve, reject);
+          } else {
+            // new syntax in Vue 2.3
+            var comp = res.component;
+            if (comp && typeof comp.then === 'function') {
+              comp.then(resolve, reject);
+            }
+          }
+        }
+      }
+    });
+
+    if (!hasAsync) { next(); }
+  }
+}
+
+function flatMapComponents (
+  matched,
+  fn
+) {
+  return flatten(matched.map(function (m) {
+    return Object.keys(m.components).map(function (key) { return fn(
+      m.components[key],
+      m.instances[key],
+      m, key
+    ); })
+  }))
+}
+
+function flatten (arr) {
+  return Array.prototype.concat.apply([], arr)
+}
+
+// in Webpack 2, require.ensure now also returns a Promise
+// so the resolve/reject functions may get called an extra time
+// if the user uses an arrow function shorthand that happens to
+// return that Promise.
+function once (fn) {
+  var called = false;
+  return function () {
+    var args = [], len = arguments.length;
+    while ( len-- ) args[ len ] = arguments[ len ];
+
+    if (called) { return }
+    called = true;
+    return fn.apply(this, args)
+  }
+}
+
+/*  */
+
+var History = function History (router, base) {
+  this.router = router;
+  this.base = normalizeBase(base);
+  // start with a route object that stands for "nowhere"
+  this.current = START;
+  this.pending = null;
+  this.ready = false;
+  this.readyCbs = [];
+  this.readyErrorCbs = [];
+  this.errorCbs = [];
+};
+
+History.prototype.listen = function listen (cb) {
+  this.cb = cb;
+};
+
+History.prototype.onReady = function onReady (cb, errorCb) {
+  if (this.ready) {
+    cb();
+  } else {
+    this.readyCbs.push(cb);
+    if (errorCb) {
+      this.readyErrorCbs.push(errorCb);
+    }
+  }
+};
+
+History.prototype.onError = function onError (errorCb) {
+  this.errorCbs.push(errorCb);
+};
+
+History.prototype.transitionTo = function transitionTo (location, onComplete, onAbort) {
+    var this$1 = this;
+
+  var route = this.router.match(location, this.current);
+  this.confirmTransition(route, function () {
+    this$1.updateRoute(route);
+    onComplete && onComplete(route);
+    this$1.ensureURL();
+
+    // fire ready cbs once
+    if (!this$1.ready) {
+      this$1.ready = true;
+      this$1.readyCbs.forEach(function (cb) { cb(route); });
+    }
+  }, function (err) {
+    if (onAbort) {
+      onAbort(err);
+    }
+    if (err && !this$1.ready) {
+      this$1.ready = true;
+      this$1.readyErrorCbs.forEach(function (cb) { cb(err); });
+    }
+  });
+};
+
+History.prototype.confirmTransition = function confirmTransition (route, onComplete, onAbort) {
+    var this$1 = this;
+
+  var current = this.current;
+  var abort = function (err) {
+    if (isError(err)) {
+      if (this$1.errorCbs.length) {
+        this$1.errorCbs.forEach(function (cb) { cb(err); });
+      } else {
+        warn(false, 'uncaught error during route navigation:');
+        console.error(err);
+      }
+    }
+    onAbort && onAbort(err);
+  };
+  if (
+    isSameRoute(route, current) &&
+    // in the case the route map has been dynamically appended to
+    route.matched.length === current.matched.length
+  ) {
+    this.ensureURL();
+    return abort()
+  }
+
+  var ref = resolveQueue(this.current.matched, route.matched);
+    var updated = ref.updated;
+    var deactivated = ref.deactivated;
+    var activated = ref.activated;
+
+  var queue = [].concat(
+    // in-component leave guards
+    extractLeaveGuards(deactivated),
+    // global before hooks
+    this.router.beforeHooks,
+    // in-component update hooks
+    extractUpdateHooks(updated),
+    // in-config enter guards
+    activated.map(function (m) { return m.beforeEnter; }),
+    // async components
+    resolveAsyncComponents(activated)
+  );
+
+  this.pending = route;
+  var iterator = function (hook, next) {
+    if (this$1.pending !== route) {
+      return abort()
+    }
+    try {
+      hook(route, current, function (to) {
+        if (to === false || isError(to)) {
+          // next(false) -> abort navigation, ensure current URL
+          this$1.ensureURL(true);
+          abort(to);
+        } else if (
+          typeof to === 'string' ||
+          (typeof to === 'object' && (
+            typeof to.path === 'string' ||
+            typeof to.name === 'string'
+          ))
+        ) {
+          // next('/') or next({ path: '/' }) -> redirect
+          abort();
+          if (typeof to === 'object' && to.replace) {
+            this$1.replace(to);
+          } else {
+            this$1.push(to);
+          }
+        } else {
+          // confirm transition and pass on the value
+          next(to);
+        }
+      });
+    } catch (e) {
+      abort(e);
+    }
+  };
+
+  runQueue(queue, iterator, function () {
+    var postEnterCbs = [];
+    var isValid = function () { return this$1.current === route; };
+    // wait until async components are resolved before
+    // extracting in-component enter guards
+    var enterGuards = extractEnterGuards(activated, postEnterCbs, isValid);
+    var queue = enterGuards.concat(this$1.router.resolveHooks);
+    runQueue(queue, iterator, function () {
+      if (this$1.pending !== route) {
+        return abort()
+      }
+      this$1.pending = null;
+      onComplete(route);
+      if (this$1.router.app) {
+        this$1.router.app.$nextTick(function () {
+          postEnterCbs.forEach(function (cb) { cb(); });
+        });
+      }
+    });
+  });
+};
+
+History.prototype.updateRoute = function updateRoute (route) {
+  var prev = this.current;
+  this.current = route;
+  this.cb && this.cb(route);
+  this.router.afterHooks.forEach(function (hook) {
+    hook && hook(route, prev);
+  });
+};
+
+function normalizeBase (base) {
+  if (!base) {
+    if (inBrowser) {
+      // respect <base> tag
+      var baseEl = document.querySelector('base');
+      base = (baseEl && baseEl.getAttribute('href')) || '/';
+      // strip full URL origin
+      base = base.replace(/^https?:\/\/[^\/]+/, '');
+    } else {
+      base = '/';
+    }
+  }
+  // make sure there's the starting slash
+  if (base.charAt(0) !== '/') {
+    base = '/' + base;
+  }
+  // remove trailing slash
+  return base.replace(/\/$/, '')
+}
+
+function resolveQueue (
+  current,
+  next
+) {
+  var i;
+  var max = Math.max(current.length, next.length);
+  for (i = 0; i < max; i++) {
+    if (current[i] !== next[i]) {
+      break
+    }
+  }
+  return {
+    updated: next.slice(0, i),
+    activated: next.slice(i),
+    deactivated: current.slice(i)
+  }
+}
+
+function extractGuards (
+  records,
+  name,
+  bind,
+  reverse
+) {
+  var guards = flatMapComponents(records, function (def, instance, match, key) {
+    var guard = extractGuard(def, name);
+    if (guard) {
+      return Array.isArray(guard)
+        ? guard.map(function (guard) { return bind(guard, instance, match, key); })
+        : bind(guard, instance, match, key)
+    }
+  });
+  return flatten(reverse ? guards.reverse() : guards)
+}
+
+function extractGuard (
+  def,
+  key
+) {
+  if (typeof def !== 'function') {
+    // extend now so that global mixins are applied.
+    def = _Vue.extend(def);
+  }
+  return def.options[key]
+}
+
+function extractLeaveGuards (deactivated) {
+  return extractGuards(deactivated, 'beforeRouteLeave', bindGuard, true)
+}
+
+function extractUpdateHooks (updated) {
+  return extractGuards(updated, 'beforeRouteUpdate', bindGuard)
+}
+
+function bindGuard (guard, instance) {
+  if (instance) {
+    return function boundRouteGuard () {
+      return guard.apply(instance, arguments)
+    }
+  }
+}
+
+function extractEnterGuards (
+  activated,
+  cbs,
+  isValid
+) {
+  return extractGuards(activated, 'beforeRouteEnter', function (guard, _, match, key) {
+    return bindEnterGuard(guard, match, key, cbs, isValid)
+  })
+}
+
+function bindEnterGuard (
+  guard,
+  match,
+  key,
+  cbs,
+  isValid
+) {
+  return function routeEnterGuard (to, from, next) {
+    return guard(to, from, function (cb) {
+      next(cb);
+      if (typeof cb === 'function') {
+        cbs.push(function () {
+          // #750
+          // if a router-view is wrapped with an out-in transition,
+          // the instance may not have been registered at this time.
+          // we will need to poll for registration until current route
+          // is no longer valid.
+          poll(cb, match.instances, key, isValid);
+        });
+      }
+    })
+  }
+}
+
+function poll (
+  cb, // somehow flow cannot infer this is a function
+  instances,
+  key,
+  isValid
+) {
+  if (instances[key]) {
+    cb(instances[key]);
+  } else if (isValid()) {
+    setTimeout(function () {
+      poll(cb, instances, key, isValid);
+    }, 16);
+  }
+}
+
+/*  */
+
+
+var HTML5History = (function (History$$1) {
+  function HTML5History (router, base) {
+    var this$1 = this;
+
+    History$$1.call(this, router, base);
+
+    var expectScroll = router.options.scrollBehavior;
+
+    if (expectScroll) {
+      setupScroll();
+    }
+
+    window.addEventListener('popstate', function (e) {
+      var current = this$1.current;
+      this$1.transitionTo(getLocation(this$1.base), function (route) {
+        if (expectScroll) {
+          handleScroll(router, route, current, true);
+        }
+      });
+    });
+  }
+
+  if ( History$$1 ) HTML5History.__proto__ = History$$1;
+  HTML5History.prototype = Object.create( History$$1 && History$$1.prototype );
+  HTML5History.prototype.constructor = HTML5History;
+
+  HTML5History.prototype.go = function go (n) {
+    window.history.go(n);
+  };
+
+  HTML5History.prototype.push = function push (location, onComplete, onAbort) {
+    var this$1 = this;
+
+    var ref = this;
+    var fromRoute = ref.current;
+    this.transitionTo(location, function (route) {
+      pushState(cleanPath(this$1.base + route.fullPath));
+      handleScroll(this$1.router, route, fromRoute, false);
+      onComplete && onComplete(route);
+    }, onAbort);
+  };
+
+  HTML5History.prototype.replace = function replace (location, onComplete, onAbort) {
+    var this$1 = this;
+
+    var ref = this;
+    var fromRoute = ref.current;
+    this.transitionTo(location, function (route) {
+      replaceState(cleanPath(this$1.base + route.fullPath));
+      handleScroll(this$1.router, route, fromRoute, false);
+      onComplete && onComplete(route);
+    }, onAbort);
+  };
+
+  HTML5History.prototype.ensureURL = function ensureURL (push) {
+    if (getLocation(this.base) !== this.current.fullPath) {
+      var current = cleanPath(this.base + this.current.fullPath);
+      push ? pushState(current) : replaceState(current);
+    }
+  };
+
+  HTML5History.prototype.getCurrentLocation = function getCurrentLocation () {
+    return getLocation(this.base)
+  };
+
+  return HTML5History;
+}(History));
+
+function getLocation (base) {
+  var path = window.location.pathname;
+  if (base && path.indexOf(base) === 0) {
+    path = path.slice(base.length);
+  }
+  return (path || '/') + window.location.search + window.location.hash
+}
+
+/*  */
+
+
+var HashHistory = (function (History$$1) {
+  function HashHistory (router, base, fallback) {
+    History$$1.call(this, router, base);
+    // check history fallback deeplinking
+    if (fallback && checkFallback(this.base)) {
+      return
+    }
+    ensureSlash();
+  }
+
+  if ( History$$1 ) HashHistory.__proto__ = History$$1;
+  HashHistory.prototype = Object.create( History$$1 && History$$1.prototype );
+  HashHistory.prototype.constructor = HashHistory;
+
+  // this is delayed until the app mounts
+  // to avoid the hashchange listener being fired too early
+  HashHistory.prototype.setupListeners = function setupListeners () {
+    var this$1 = this;
+
+    window.addEventListener('hashchange', function () {
+      if (!ensureSlash()) {
+        return
+      }
+      this$1.transitionTo(getHash(), function (route) {
+        replaceHash(route.fullPath);
+      });
+    });
+  };
+
+  HashHistory.prototype.push = function push (location, onComplete, onAbort) {
+    this.transitionTo(location, function (route) {
+      pushHash(route.fullPath);
+      onComplete && onComplete(route);
+    }, onAbort);
+  };
+
+  HashHistory.prototype.replace = function replace (location, onComplete, onAbort) {
+    this.transitionTo(location, function (route) {
+      replaceHash(route.fullPath);
+      onComplete && onComplete(route);
+    }, onAbort);
+  };
+
+  HashHistory.prototype.go = function go (n) {
+    window.history.go(n);
+  };
+
+  HashHistory.prototype.ensureURL = function ensureURL (push) {
+    var current = this.current.fullPath;
+    if (getHash() !== current) {
+      push ? pushHash(current) : replaceHash(current);
+    }
+  };
+
+  HashHistory.prototype.getCurrentLocation = function getCurrentLocation () {
+    return getHash()
+  };
+
+  return HashHistory;
+}(History));
+
+function checkFallback (base) {
+  var location = getLocation(base);
+  if (!/^\/#/.test(location)) {
+    window.location.replace(
+      cleanPath(base + '/#' + location)
+    );
+    return true
+  }
+}
+
+function ensureSlash () {
+  var path = getHash();
+  if (path.charAt(0) === '/') {
+    return true
+  }
+  replaceHash('/' + path);
+  return false
+}
+
+function getHash () {
+  // We can't use window.location.hash here because it's not
+  // consistent across browsers - Firefox will pre-decode it!
+  var href = window.location.href;
+  var index = href.indexOf('#');
+  return index === -1 ? '' : href.slice(index + 1)
+}
+
+function pushHash (path) {
+  window.location.hash = path;
+}
+
+function replaceHash (path) {
+  var href = window.location.href;
+  var i = href.indexOf('#');
+  var base = i >= 0 ? href.slice(0, i) : href;
+  window.location.replace((base + "#" + path));
+}
+
+/*  */
+
+
+var AbstractHistory = (function (History$$1) {
+  function AbstractHistory (router, base) {
+    History$$1.call(this, router, base);
+    this.stack = [];
+    this.index = -1;
+  }
+
+  if ( History$$1 ) AbstractHistory.__proto__ = History$$1;
+  AbstractHistory.prototype = Object.create( History$$1 && History$$1.prototype );
+  AbstractHistory.prototype.constructor = AbstractHistory;
+
+  AbstractHistory.prototype.push = function push (location, onComplete, onAbort) {
+    var this$1 = this;
+
+    this.transitionTo(location, function (route) {
+      this$1.stack = this$1.stack.slice(0, this$1.index + 1).concat(route);
+      this$1.index++;
+      onComplete && onComplete(route);
+    }, onAbort);
+  };
+
+  AbstractHistory.prototype.replace = function replace (location, onComplete, onAbort) {
+    var this$1 = this;
+
+    this.transitionTo(location, function (route) {
+      this$1.stack = this$1.stack.slice(0, this$1.index).concat(route);
+      onComplete && onComplete(route);
+    }, onAbort);
+  };
+
+  AbstractHistory.prototype.go = function go (n) {
+    var this$1 = this;
+
+    var targetIndex = this.index + n;
+    if (targetIndex < 0 || targetIndex >= this.stack.length) {
+      return
+    }
+    var route = this.stack[targetIndex];
+    this.confirmTransition(route, function () {
+      this$1.index = targetIndex;
+      this$1.updateRoute(route);
+    });
+  };
+
+  AbstractHistory.prototype.getCurrentLocation = function getCurrentLocation () {
+    var current = this.stack[this.stack.length - 1];
+    return current ? current.fullPath : '/'
+  };
+
+  AbstractHistory.prototype.ensureURL = function ensureURL () {
+    // noop
+  };
+
+  return AbstractHistory;
+}(History));
+
+/*  */
+
+var VueRouter = function VueRouter (options) {
+  if ( options === void 0 ) options = {};
+
+  this.app = null;
+  this.apps = [];
+  this.options = options;
+  this.beforeHooks = [];
+  this.resolveHooks = [];
+  this.afterHooks = [];
+  this.matcher = createMatcher(options.routes || [], this);
+
+  var mode = options.mode || 'hash';
+  this.fallback = mode === 'history' && !supportsPushState && options.fallback !== false;
+  if (this.fallback) {
+    mode = 'hash';
+  }
+  if (!inBrowser) {
+    mode = 'abstract';
+  }
+  this.mode = mode;
+
+  switch (mode) {
+    case 'history':
+      this.history = new HTML5History(this, options.base);
+      break
+    case 'hash':
+      this.history = new HashHistory(this, options.base, this.fallback);
+      break
+    case 'abstract':
+      this.history = new AbstractHistory(this, options.base);
+      break
+    default:
+      {
+        assert(false, ("invalid mode: " + mode));
+      }
+  }
+};
+
+var prototypeAccessors = { currentRoute: {} };
+
+VueRouter.prototype.match = function match (
+  raw,
+  current,
+  redirectedFrom
+) {
+  return this.matcher.match(raw, current, redirectedFrom)
+};
+
+prototypeAccessors.currentRoute.get = function () {
+  return this.history && this.history.current
+};
+
+VueRouter.prototype.init = function init (app /* Vue component instance */) {
+    var this$1 = this;
+
+  "development" !== 'production' && assert(
+    install.installed,
+    "not installed. Make sure to call `Vue.use(VueRouter)` " +
+    "before creating root instance."
+  );
+
+  this.apps.push(app);
+
+  // main app already initialized.
+  if (this.app) {
+    return
+  }
+
+  this.app = app;
+
+  var history = this.history;
+
+  if (history instanceof HTML5History) {
+    history.transitionTo(history.getCurrentLocation());
+  } else if (history instanceof HashHistory) {
+    var setupHashListener = function () {
+      history.setupListeners();
+    };
+    history.transitionTo(
+      history.getCurrentLocation(),
+      setupHashListener,
+      setupHashListener
+    );
+  }
+
+  history.listen(function (route) {
+    this$1.apps.forEach(function (app) {
+      app._route = route;
+    });
+  });
+};
+
+VueRouter.prototype.beforeEach = function beforeEach (fn) {
+  return registerHook(this.beforeHooks, fn)
+};
+
+VueRouter.prototype.beforeResolve = function beforeResolve (fn) {
+  return registerHook(this.resolveHooks, fn)
+};
+
+VueRouter.prototype.afterEach = function afterEach (fn) {
+  return registerHook(this.afterHooks, fn)
+};
+
+VueRouter.prototype.onReady = function onReady (cb, errorCb) {
+  this.history.onReady(cb, errorCb);
+};
+
+VueRouter.prototype.onError = function onError (errorCb) {
+  this.history.onError(errorCb);
+};
+
+VueRouter.prototype.push = function push (location, onComplete, onAbort) {
+  this.history.push(location, onComplete, onAbort);
+};
+
+VueRouter.prototype.replace = function replace (location, onComplete, onAbort) {
+  this.history.replace(location, onComplete, onAbort);
+};
+
+VueRouter.prototype.go = function go (n) {
+  this.history.go(n);
+};
+
+VueRouter.prototype.back = function back () {
+  this.go(-1);
+};
+
+VueRouter.prototype.forward = function forward () {
+  this.go(1);
+};
+
+VueRouter.prototype.getMatchedComponents = function getMatchedComponents (to) {
+  var route = to
+    ? to.matched
+      ? to
+      : this.resolve(to).route
+    : this.currentRoute;
+  if (!route) {
+    return []
+  }
+  return [].concat.apply([], route.matched.map(function (m) {
+    return Object.keys(m.components).map(function (key) {
+      return m.components[key]
+    })
+  }))
+};
+
+VueRouter.prototype.resolve = function resolve (
+  to,
+  current,
+  append
+) {
+  var location = normalizeLocation(
+    to,
+    current || this.history.current,
+    append,
+    this
+  );
+  var route = this.match(location, current);
+  var fullPath = route.redirectedFrom || route.fullPath;
+  var base = this.history.base;
+  var href = createHref(base, fullPath, this.mode);
+  return {
+    location: location,
+    route: route,
+    href: href,
+    // for backwards compat
+    normalizedTo: location,
+    resolved: route
+  }
+};
+
+VueRouter.prototype.addRoutes = function addRoutes (routes) {
+  this.matcher.addRoutes(routes);
+  if (this.history.current !== START) {
+    this.history.transitionTo(this.history.getCurrentLocation());
+  }
+};
+
+Object.defineProperties( VueRouter.prototype, prototypeAccessors );
+
+function registerHook (list, fn) {
+  list.push(fn);
+  return function () {
+    var i = list.indexOf(fn);
+    if (i > -1) { list.splice(i, 1); }
+  }
+}
+
+function createHref (base, fullPath, mode) {
+  var path = mode === 'hash' ? '#' + fullPath : fullPath;
+  return base ? cleanPath(base + '/' + path) : path
+}
+
+VueRouter.install = install;
+VueRouter.version = '2.7.0';
+
+if (inBrowser && window.Vue) {
+  window.Vue.use(VueRouter);
+}
+
+return VueRouter;
+
+})));
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/vue.js b/ee/bulk-operations-dashboard/assets/dependencies/vue.js
new file mode 100644
index 000000000000..ca93c9893d4f
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/vue.js
@@ -0,0 +1,10979 @@
+/*!
+ * Vue.js v2.5.17
+ * (c) 2014-2018 Evan You
+ * Released under the MIT License.
+ *
+ * > w/ slight modifications for easier default handling of dev vs. prod logging
+ * > Modifications (c) 2018-present Mike McNeil, MIT License)
+ * > (To see modifications in isolation, run a diff versus vanilla Vue.js)
+ */
+(function (global, factory) {
+  //------------------------------------------------------------
+  //  ██╗    ██╗ █████╗ ██████╗ ███╗   ██╗██╗███╗   ██╗ ██████╗
+  //  ██║    ██║██╔══██╗██╔══██╗████╗  ██║██║████╗  ██║██╔════╝
+  //  ██║ █╗ ██║███████║██████╔╝██╔██╗ ██║██║██╔██╗ ██║██║  ███╗
+  //  ██║███╗██║██╔══██║██╔══██╗██║╚██╗██║██║██║╚██╗██║██║   ██║
+  //  ╚███╔███╔╝██║  ██║██║  ██║██║ ╚████║██║██║ ╚████║╚██████╔╝
+  //   ╚══╝╚══╝ ╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═══╝╚═╝╚═╝  ╚═══╝ ╚═════╝
+  //
+  // For convenience, this version of Vue.js has been modified
+  // to use a runtime check when determining whether it is being
+  // run in development or production mode, and thus whether or not
+  // to display the "Development Mode" console warning.
+  //
+  // To determine this, we use the `SAILS_LOCALS` global;
+  // specifically its _environment property.  If we don't have
+  // `SAILS_LOCALS` at all, we'll just assume this is running in
+  // production or staging.  This avoids logging unnecessary
+  // warnings and log messages to the browser inspector in the
+  // production environment (e.g. on the 404 page).
+  //
+  // > Read more here:
+  // > https://vuejs.org/v2/guide/installation.html#Development-vs-Production-Mode
+  //------------------------------------------------------------
+  var IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE = (
+    global &&
+    global.SAILS_LOCALS &&
+    typeof global.SAILS_LOCALS === 'object' &&
+    (global.SAILS_LOCALS._environment === 'staging' || global.SAILS_LOCALS._environment === 'production')
+  );
+  if(!global || !global.SAILS_LOCALS) {
+    IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE = true;
+  }
+  //------------------------------------------------------------
+  typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
+  typeof define === 'function' && define.amd ? define(factory) :
+  (global.Vue = factory(IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE));
+}(this, (function (IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE) { 'use strict';
+
+/*  */
+
+var emptyObject = Object.freeze({});
+
+// these helpers produces better vm code in JS engines due to their
+// explicitness and function inlining
+function isUndef (v) {
+  return v === undefined || v === null
+}
+
+function isDef (v) {
+  return v !== undefined && v !== null
+}
+
+function isTrue (v) {
+  return v === true
+}
+
+function isFalse (v) {
+  return v === false
+}
+
+/**
+ * Check if value is primitive
+ */
+function isPrimitive (value) {
+  return (
+    typeof value === 'string' ||
+    typeof value === 'number' ||
+    // $flow-disable-line
+    typeof value === 'symbol' ||
+    typeof value === 'boolean'
+  )
+}
+
+/**
+ * Quick object check - this is primarily used to tell
+ * Objects from primitive values when we know the value
+ * is a JSON-compliant type.
+ */
+function isObject (obj) {
+  return obj !== null && typeof obj === 'object'
+}
+
+/**
+ * Get the raw type string of a value e.g. [object Object]
+ */
+var _toString = Object.prototype.toString;
+
+function toRawType (value) {
+  return _toString.call(value).slice(8, -1)
+}
+
+/**
+ * Strict object type check. Only returns true
+ * for plain JavaScript objects.
+ */
+function isPlainObject (obj) {
+  return _toString.call(obj) === '[object Object]'
+}
+
+function isRegExp (v) {
+  return _toString.call(v) === '[object RegExp]'
+}
+
+/**
+ * Check if val is a valid array index.
+ */
+function isValidArrayIndex (val) {
+  var n = parseFloat(String(val));
+  return n >= 0 && Math.floor(n) === n && isFinite(val)
+}
+
+/**
+ * Convert a value to a string that is actually rendered.
+ */
+function toString (val) {
+  return val == null
+    ? ''
+    : typeof val === 'object'
+      ? JSON.stringify(val, null, 2)
+      : String(val)
+}
+
+/**
+ * Convert a input value to a number for persistence.
+ * If the conversion fails, return original string.
+ */
+function toNumber (val) {
+  var n = parseFloat(val);
+  return isNaN(n) ? val : n
+}
+
+/**
+ * Make a map and return a function for checking if a key
+ * is in that map.
+ */
+function makeMap (
+  str,
+  expectsLowerCase
+) {
+  var map = Object.create(null);
+  var list = str.split(',');
+  for (var i = 0; i < list.length; i++) {
+    map[list[i]] = true;
+  }
+  return expectsLowerCase
+    ? function (val) { return map[val.toLowerCase()]; }
+    : function (val) { return map[val]; }
+}
+
+/**
+ * Check if a tag is a built-in tag.
+ */
+var isBuiltInTag = makeMap('slot,component', true);
+
+/**
+ * Check if a attribute is a reserved attribute.
+ */
+var isReservedAttribute = makeMap('key,ref,slot,slot-scope,is');
+
+/**
+ * Remove an item from an array
+ */
+function remove (arr, item) {
+  if (arr.length) {
+    var index = arr.indexOf(item);
+    if (index > -1) {
+      return arr.splice(index, 1)
+    }
+  }
+}
+
+/**
+ * Check whether the object has the property.
+ */
+var hasOwnProperty = Object.prototype.hasOwnProperty;
+function hasOwn (obj, key) {
+  return hasOwnProperty.call(obj, key)
+}
+
+/**
+ * Create a cached version of a pure function.
+ */
+function cached (fn) {
+  var cache = Object.create(null);
+  return (function cachedFn (str) {
+    var hit = cache[str];
+    return hit || (cache[str] = fn(str))
+  })
+}
+
+/**
+ * Camelize a hyphen-delimited string.
+ */
+var camelizeRE = /-(\w)/g;
+var camelize = cached(function (str) {
+  return str.replace(camelizeRE, function (_, c) { return c ? c.toUpperCase() : ''; })
+});
+
+/**
+ * Capitalize a string.
+ */
+var capitalize = cached(function (str) {
+  return str.charAt(0).toUpperCase() + str.slice(1)
+});
+
+/**
+ * Hyphenate a camelCase string.
+ */
+var hyphenateRE = /\B([A-Z])/g;
+var hyphenate = cached(function (str) {
+  return str.replace(hyphenateRE, '-$1').toLowerCase()
+});
+
+/**
+ * Simple bind polyfill for environments that do not support it... e.g.
+ * PhantomJS 1.x. Technically we don't need this anymore since native bind is
+ * now more performant in most browsers, but removing it would be breaking for
+ * code that was able to run in PhantomJS 1.x, so this must be kept for
+ * backwards compatibility.
+ */
+
+/* istanbul ignore next */
+function polyfillBind (fn, ctx) {
+  function boundFn (a) {
+    var l = arguments.length;
+    return l
+      ? l > 1
+        ? fn.apply(ctx, arguments)
+        : fn.call(ctx, a)
+      : fn.call(ctx)
+  }
+
+  boundFn._length = fn.length;
+  return boundFn
+}
+
+function nativeBind (fn, ctx) {
+  return fn.bind(ctx)
+}
+
+var bind = Function.prototype.bind
+  ? nativeBind
+  : polyfillBind;
+
+/**
+ * Convert an Array-like object to a real Array.
+ */
+function toArray (list, start) {
+  start = start || 0;
+  var i = list.length - start;
+  var ret = new Array(i);
+  while (i--) {
+    ret[i] = list[i + start];
+  }
+  return ret
+}
+
+/**
+ * Mix properties into target object.
+ */
+function extend (to, _from) {
+  for (var key in _from) {
+    to[key] = _from[key];
+  }
+  return to
+}
+
+/**
+ * Merge an Array of Objects into a single Object.
+ */
+function toObject (arr) {
+  var res = {};
+  for (var i = 0; i < arr.length; i++) {
+    if (arr[i]) {
+      extend(res, arr[i]);
+    }
+  }
+  return res
+}
+
+/**
+ * Perform no operation.
+ * Stubbing args to make Flow happy without leaving useless transpiled code
+ * with ...rest (https://flow.org/blog/2017/05/07/Strict-Function-Call-Arity/)
+ */
+function noop (a, b, c) {}
+
+/**
+ * Always return false.
+ */
+var no = function (a, b, c) { return false; };
+
+/**
+ * Return same value
+ */
+var identity = function (_) { return _; };
+
+/**
+ * Generate a static keys string from compiler modules.
+ */
+function genStaticKeys (modules) {
+  return modules.reduce(function (keys, m) {
+    return keys.concat(m.staticKeys || [])
+  }, []).join(',')
+}
+
+/**
+ * Check if two values are loosely equal - that is,
+ * if they are plain objects, do they have the same shape?
+ */
+function looseEqual (a, b) {
+  if (a === b) { return true }
+  var isObjectA = isObject(a);
+  var isObjectB = isObject(b);
+  if (isObjectA && isObjectB) {
+    try {
+      var isArrayA = Array.isArray(a);
+      var isArrayB = Array.isArray(b);
+      if (isArrayA && isArrayB) {
+        return a.length === b.length && a.every(function (e, i) {
+          return looseEqual(e, b[i])
+        })
+      } else if (!isArrayA && !isArrayB) {
+        var keysA = Object.keys(a);
+        var keysB = Object.keys(b);
+        return keysA.length === keysB.length && keysA.every(function (key) {
+          return looseEqual(a[key], b[key])
+        })
+      } else {
+        /* istanbul ignore next */
+        return false
+      }
+    } catch (e) {
+      /* istanbul ignore next */
+      return false
+    }
+  } else if (!isObjectA && !isObjectB) {
+    return String(a) === String(b)
+  } else {
+    return false
+  }
+}
+
+function looseIndexOf (arr, val) {
+  for (var i = 0; i < arr.length; i++) {
+    if (looseEqual(arr[i], val)) { return i }
+  }
+  return -1
+}
+
+/**
+ * Ensure a function is called only once.
+ */
+function once (fn) {
+  var called = false;
+  return function () {
+    if (!called) {
+      called = true;
+      fn.apply(this, arguments);
+    }
+  }
+}
+
+var SSR_ATTR = 'data-server-rendered';
+
+var ASSET_TYPES = [
+  'component',
+  'directive',
+  'filter'
+];
+
+var LIFECYCLE_HOOKS = [
+  'beforeCreate',
+  'created',
+  'beforeMount',
+  'mounted',
+  'beforeUpdate',
+  'updated',
+  'beforeDestroy',
+  'destroyed',
+  'activated',
+  'deactivated',
+  'errorCaptured'
+];
+
+/*  */
+
+var config = ({
+  /**
+   * Option merge strategies (used in core/util/options)
+   */
+  // $flow-disable-line
+  optionMergeStrategies: Object.create(null),
+
+  /**
+   * Whether to suppress warnings.
+   */
+  silent: false,
+
+  /**
+   * Show production mode tip message on boot?
+   */
+  productionTip: !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE,
+
+  /**
+   * Whether to enable devtools
+   */
+  devtools: !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE,
+
+  /**
+   * Whether to record perf
+   */
+  performance: false,
+
+  /**
+   * Error handler for watcher errors
+   */
+  errorHandler: null,
+
+  /**
+   * Warn handler for watcher warns
+   */
+  warnHandler: null,
+
+  /**
+   * Ignore certain custom elements
+   */
+  ignoredElements: [],
+
+  /**
+   * Custom user key aliases for v-on
+   */
+  // $flow-disable-line
+  keyCodes: Object.create(null),
+
+  /**
+   * Check if a tag is reserved so that it cannot be registered as a
+   * component. This is platform-dependent and may be overwritten.
+   */
+  isReservedTag: no,
+
+  /**
+   * Check if an attribute is reserved so that it cannot be used as a component
+   * prop. This is platform-dependent and may be overwritten.
+   */
+  isReservedAttr: no,
+
+  /**
+   * Check if a tag is an unknown element.
+   * Platform-dependent.
+   */
+  isUnknownElement: no,
+
+  /**
+   * Get the namespace of an element
+   */
+  getTagNamespace: noop,
+
+  /**
+   * Parse the real tag name for the specific platform.
+   */
+  parsePlatformTagName: identity,
+
+  /**
+   * Check if an attribute must be bound using property, e.g. value
+   * Platform-dependent.
+   */
+  mustUseProp: no,
+
+  /**
+   * Exposed for legacy reasons
+   */
+  _lifecycleHooks: LIFECYCLE_HOOKS
+})
+
+/*  */
+
+/**
+ * Check if a string starts with $ or _
+ */
+function isReserved (str) {
+  var c = (str + '').charCodeAt(0);
+  return c === 0x24 || c === 0x5F
+}
+
+/**
+ * Define a property.
+ */
+function def (obj, key, val, enumerable) {
+  Object.defineProperty(obj, key, {
+    value: val,
+    enumerable: !!enumerable,
+    writable: true,
+    configurable: true
+  });
+}
+
+/**
+ * Parse simple path.
+ */
+var bailRE = /[^\w.$]/;
+function parsePath (path) {
+  if (bailRE.test(path)) {
+    return
+  }
+  var segments = path.split('.');
+  return function (obj) {
+    for (var i = 0; i < segments.length; i++) {
+      if (!obj) { return }
+      obj = obj[segments[i]];
+    }
+    return obj
+  }
+}
+
+/*  */
+
+// can we use __proto__?
+var hasProto = '__proto__' in {};
+
+// Browser environment sniffing
+var inBrowser = typeof window !== 'undefined';
+var inWeex = typeof WXEnvironment !== 'undefined' && !!WXEnvironment.platform;
+var weexPlatform = inWeex && WXEnvironment.platform.toLowerCase();
+var UA = inBrowser && window.navigator.userAgent.toLowerCase();
+var isIE = UA && /msie|trident/.test(UA);
+var isIE9 = UA && UA.indexOf('msie 9.0') > 0;
+var isEdge = UA && UA.indexOf('edge/') > 0;
+var isAndroid = (UA && UA.indexOf('android') > 0) || (weexPlatform === 'android');
+var isIOS = (UA && /iphone|ipad|ipod|ios/.test(UA)) || (weexPlatform === 'ios');
+var isChrome = UA && /chrome\/\d+/.test(UA) && !isEdge;
+
+// Firefox has a "watch" function on Object.prototype...
+var nativeWatch = ({}).watch;
+
+var supportsPassive = false;
+if (inBrowser) {
+  try {
+    var opts = {};
+    Object.defineProperty(opts, 'passive', ({
+      get: function get () {
+        /* istanbul ignore next */
+        supportsPassive = true;
+      }
+    })); // https://github.com/facebook/flow/issues/285
+    window.addEventListener('test-passive', null, opts);
+  } catch (e) {}
+}
+
+// this needs to be lazy-evaled because vue may be required before
+// vue-server-renderer can set VUE_ENV
+var _isServer;
+var isServerRendering = function () {
+  if (_isServer === undefined) {
+    /* istanbul ignore if */
+    if (!inBrowser && !inWeex && typeof global !== 'undefined') {
+      // detect presence of vue-server-renderer and avoid
+      // Webpack shimming the process
+      _isServer = global['process'].env.VUE_ENV === 'server';
+    } else {
+      _isServer = false;
+    }
+  }
+  return _isServer
+};
+
+// detect devtools
+var devtools = inBrowser && window.__VUE_DEVTOOLS_GLOBAL_HOOK__;
+
+/* istanbul ignore next */
+function isNative (Ctor) {
+  return typeof Ctor === 'function' && /native code/.test(Ctor.toString())
+}
+
+var hasSymbol =
+  typeof Symbol !== 'undefined' && isNative(Symbol) &&
+  typeof Reflect !== 'undefined' && isNative(Reflect.ownKeys);
+
+var _Set;
+/* istanbul ignore if */ // $flow-disable-line
+if (typeof Set !== 'undefined' && isNative(Set)) {
+  // use native Set when available.
+  _Set = Set;
+} else {
+  // a non-standard Set polyfill that only works with primitive keys.
+  _Set = (function () {
+    function Set () {
+      this.set = Object.create(null);
+    }
+    Set.prototype.has = function has (key) {
+      return this.set[key] === true
+    };
+    Set.prototype.add = function add (key) {
+      this.set[key] = true;
+    };
+    Set.prototype.clear = function clear () {
+      this.set = Object.create(null);
+    };
+
+    return Set;
+  }());
+}
+
+/*  */
+
+var warn = noop;
+var tip = noop;
+var generateComponentTrace = (noop); // work around flow check
+var formatComponentName = (noop);
+
+{
+  var hasConsole = typeof console !== 'undefined';
+  var classifyRE = /(?:^|[-_])(\w)/g;
+  var classify = function (str) { return str
+    .replace(classifyRE, function (c) { return c.toUpperCase(); })
+    .replace(/[-_]/g, ''); };
+
+  warn = function (msg, vm) {
+    var trace = vm ? generateComponentTrace(vm) : '';
+
+    if (config.warnHandler) {
+      config.warnHandler.call(null, msg, vm, trace);
+    } else if (hasConsole && (!config.silent)) {
+      console.error(("[Vue warn]: " + msg + trace));
+    }
+  };
+
+  tip = function (msg, vm) {
+    if (hasConsole && (!config.silent)) {
+      console.warn("[Vue tip]: " + msg + (
+        vm ? generateComponentTrace(vm) : ''
+      ));
+    }
+  };
+
+  formatComponentName = function (vm, includeFile) {
+    if (vm.$root === vm) {
+      return '<Root>'
+    }
+    var options = typeof vm === 'function' && vm.cid != null
+      ? vm.options
+      : vm._isVue
+        ? vm.$options || vm.constructor.options
+        : vm || {};
+    var name = options.name || options._componentTag;
+    var file = options.__file;
+    if (!name && file) {
+      var match = file.match(/([^/\\]+)\.vue$/);
+      name = match && match[1];
+    }
+
+    return (
+      (name ? ("<" + (classify(name)) + ">") : "<Anonymous>") +
+      (file && includeFile !== false ? (" at " + file) : '')
+    )
+  };
+
+  var repeat = function (str, n) {
+    var res = '';
+    while (n) {
+      if (n % 2 === 1) { res += str; }
+      if (n > 1) { str += str; }
+      n >>= 1;
+    }
+    return res
+  };
+
+  generateComponentTrace = function (vm) {
+    if (vm._isVue && vm.$parent) {
+      var tree = [];
+      var currentRecursiveSequence = 0;
+      while (vm) {
+        if (tree.length > 0) {
+          var last = tree[tree.length - 1];
+          if (last.constructor === vm.constructor) {
+            currentRecursiveSequence++;
+            vm = vm.$parent;
+            continue
+          } else if (currentRecursiveSequence > 0) {
+            tree[tree.length - 1] = [last, currentRecursiveSequence];
+            currentRecursiveSequence = 0;
+          }
+        }
+        tree.push(vm);
+        vm = vm.$parent;
+      }
+      return '\n\nfound in\n\n' + tree
+        .map(function (vm, i) { return ("" + (i === 0 ? '---> ' : repeat(' ', 5 + i * 2)) + (Array.isArray(vm)
+            ? ((formatComponentName(vm[0])) + "... (" + (vm[1]) + " recursive calls)")
+            : formatComponentName(vm))); })
+        .join('\n')
+    } else {
+      return ("\n\n(found in " + (formatComponentName(vm)) + ")")
+    }
+  };
+}
+
+/*  */
+
+
+var uid = 0;
+
+/**
+ * A dep is an observable that can have multiple
+ * directives subscribing to it.
+ */
+var Dep = function Dep () {
+  this.id = uid++;
+  this.subs = [];
+};
+
+Dep.prototype.addSub = function addSub (sub) {
+  this.subs.push(sub);
+};
+
+Dep.prototype.removeSub = function removeSub (sub) {
+  remove(this.subs, sub);
+};
+
+Dep.prototype.depend = function depend () {
+  if (Dep.target) {
+    Dep.target.addDep(this);
+  }
+};
+
+Dep.prototype.notify = function notify () {
+  // stabilize the subscriber list first
+  var subs = this.subs.slice();
+  for (var i = 0, l = subs.length; i < l; i++) {
+    subs[i].update();
+  }
+};
+
+// the current target watcher being evaluated.
+// this is globally unique because there could be only one
+// watcher being evaluated at any time.
+Dep.target = null;
+var targetStack = [];
+
+function pushTarget (_target) {
+  if (Dep.target) { targetStack.push(Dep.target); }
+  Dep.target = _target;
+}
+
+function popTarget () {
+  Dep.target = targetStack.pop();
+}
+
+/*  */
+
+var VNode = function VNode (
+  tag,
+  data,
+  children,
+  text,
+  elm,
+  context,
+  componentOptions,
+  asyncFactory
+) {
+  this.tag = tag;
+  this.data = data;
+  this.children = children;
+  this.text = text;
+  this.elm = elm;
+  this.ns = undefined;
+  this.context = context;
+  this.fnContext = undefined;
+  this.fnOptions = undefined;
+  this.fnScopeId = undefined;
+  this.key = data && data.key;
+  this.componentOptions = componentOptions;
+  this.componentInstance = undefined;
+  this.parent = undefined;
+  this.raw = false;
+  this.isStatic = false;
+  this.isRootInsert = true;
+  this.isComment = false;
+  this.isCloned = false;
+  this.isOnce = false;
+  this.asyncFactory = asyncFactory;
+  this.asyncMeta = undefined;
+  this.isAsyncPlaceholder = false;
+};
+
+var prototypeAccessors = { child: { configurable: true } };
+
+// DEPRECATED: alias for componentInstance for backwards compat.
+/* istanbul ignore next */
+prototypeAccessors.child.get = function () {
+  return this.componentInstance
+};
+
+Object.defineProperties( VNode.prototype, prototypeAccessors );
+
+var createEmptyVNode = function (text) {
+  if ( text === void 0 ) text = '';
+
+  var node = new VNode();
+  node.text = text;
+  node.isComment = true;
+  return node
+};
+
+function createTextVNode (val) {
+  return new VNode(undefined, undefined, undefined, String(val))
+}
+
+// optimized shallow clone
+// used for static nodes and slot nodes because they may be reused across
+// multiple renders, cloning them avoids errors when DOM manipulations rely
+// on their elm reference.
+function cloneVNode (vnode) {
+  var cloned = new VNode(
+    vnode.tag,
+    vnode.data,
+    vnode.children,
+    vnode.text,
+    vnode.elm,
+    vnode.context,
+    vnode.componentOptions,
+    vnode.asyncFactory
+  );
+  cloned.ns = vnode.ns;
+  cloned.isStatic = vnode.isStatic;
+  cloned.key = vnode.key;
+  cloned.isComment = vnode.isComment;
+  cloned.fnContext = vnode.fnContext;
+  cloned.fnOptions = vnode.fnOptions;
+  cloned.fnScopeId = vnode.fnScopeId;
+  cloned.isCloned = true;
+  return cloned
+}
+
+/*
+ * not type checking this file because flow doesn't play well with
+ * dynamically accessing methods on Array prototype
+ */
+
+var arrayProto = Array.prototype;
+var arrayMethods = Object.create(arrayProto);
+
+var methodsToPatch = [
+  'push',
+  'pop',
+  'shift',
+  'unshift',
+  'splice',
+  'sort',
+  'reverse'
+];
+
+/**
+ * Intercept mutating methods and emit events
+ */
+methodsToPatch.forEach(function (method) {
+  // cache original method
+  var original = arrayProto[method];
+  def(arrayMethods, method, function mutator () {
+    var args = [], len = arguments.length;
+    while ( len-- ) args[ len ] = arguments[ len ];
+
+    var result = original.apply(this, args);
+    var ob = this.__ob__;
+    var inserted;
+    switch (method) {
+      case 'push':
+      case 'unshift':
+        inserted = args;
+        break
+      case 'splice':
+        inserted = args.slice(2);
+        break
+    }
+    if (inserted) { ob.observeArray(inserted); }
+    // notify change
+    ob.dep.notify();
+    return result
+  });
+});
+
+/*  */
+
+var arrayKeys = Object.getOwnPropertyNames(arrayMethods);
+
+/**
+ * In some cases we may want to disable observation inside a component's
+ * update computation.
+ */
+var shouldObserve = true;
+
+function toggleObserving (value) {
+  shouldObserve = value;
+}
+
+/**
+ * Observer class that is attached to each observed
+ * object. Once attached, the observer converts the target
+ * object's property keys into getter/setters that
+ * collect dependencies and dispatch updates.
+ */
+var Observer = function Observer (value) {
+  this.value = value;
+  this.dep = new Dep();
+  this.vmCount = 0;
+  def(value, '__ob__', this);
+  if (Array.isArray(value)) {
+    var augment = hasProto
+      ? protoAugment
+      : copyAugment;
+    augment(value, arrayMethods, arrayKeys);
+    this.observeArray(value);
+  } else {
+    this.walk(value);
+  }
+};
+
+/**
+ * Walk through each property and convert them into
+ * getter/setters. This method should only be called when
+ * value type is Object.
+ */
+Observer.prototype.walk = function walk (obj) {
+  var keys = Object.keys(obj);
+  for (var i = 0; i < keys.length; i++) {
+    defineReactive(obj, keys[i]);
+  }
+};
+
+/**
+ * Observe a list of Array items.
+ */
+Observer.prototype.observeArray = function observeArray (items) {
+  for (var i = 0, l = items.length; i < l; i++) {
+    observe(items[i]);
+  }
+};
+
+// helpers
+
+/**
+ * Augment an target Object or Array by intercepting
+ * the prototype chain using __proto__
+ */
+function protoAugment (target, src, keys) {
+  /* eslint-disable no-proto */
+  target.__proto__ = src;
+  /* eslint-enable no-proto */
+}
+
+/**
+ * Augment an target Object or Array by defining
+ * hidden properties.
+ */
+/* istanbul ignore next */
+function copyAugment (target, src, keys) {
+  for (var i = 0, l = keys.length; i < l; i++) {
+    var key = keys[i];
+    def(target, key, src[key]);
+  }
+}
+
+/**
+ * Attempt to create an observer instance for a value,
+ * returns the new observer if successfully observed,
+ * or the existing observer if the value already has one.
+ */
+function observe (value, asRootData) {
+  if (!isObject(value) || value instanceof VNode) {
+    return
+  }
+  var ob;
+  if (hasOwn(value, '__ob__') && value.__ob__ instanceof Observer) {
+    ob = value.__ob__;
+  } else if (
+    shouldObserve &&
+    !isServerRendering() &&
+    (Array.isArray(value) || isPlainObject(value)) &&
+    Object.isExtensible(value) &&
+    !value._isVue
+  ) {
+    ob = new Observer(value);
+  }
+  if (asRootData && ob) {
+    ob.vmCount++;
+  }
+  return ob
+}
+
+/**
+ * Define a reactive property on an Object.
+ */
+function defineReactive (
+  obj,
+  key,
+  val,
+  customSetter,
+  shallow
+) {
+  var dep = new Dep();
+
+  var property = Object.getOwnPropertyDescriptor(obj, key);
+  if (property && property.configurable === false) {
+    return
+  }
+
+  // cater for pre-defined getter/setters
+  var getter = property && property.get;
+  if (!getter && arguments.length === 2) {
+    val = obj[key];
+  }
+  var setter = property && property.set;
+
+  var childOb = !shallow && observe(val);
+  Object.defineProperty(obj, key, {
+    enumerable: true,
+    configurable: true,
+    get: function reactiveGetter () {
+      var value = getter ? getter.call(obj) : val;
+      if (Dep.target) {
+        dep.depend();
+        if (childOb) {
+          childOb.dep.depend();
+          if (Array.isArray(value)) {
+            dependArray(value);
+          }
+        }
+      }
+      return value
+    },
+    set: function reactiveSetter (newVal) {
+      var value = getter ? getter.call(obj) : val;
+      /* eslint-disable no-self-compare */
+      if (newVal === value || (newVal !== newVal && value !== value)) {
+        return
+      }
+      /* eslint-enable no-self-compare */
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && customSetter) {
+        customSetter();
+      }
+      if (setter) {
+        setter.call(obj, newVal);
+      } else {
+        val = newVal;
+      }
+      childOb = !shallow && observe(newVal);
+      dep.notify();
+    }
+  });
+}
+
+/**
+ * Set a property on an object. Adds the new property and
+ * triggers change notification if the property doesn't
+ * already exist.
+ */
+function set (target, key, val) {
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+    (isUndef(target) || isPrimitive(target))
+  ) {
+    warn(("Cannot set reactive property on undefined, null, or primitive value: " + ((target))));
+  }
+  if (Array.isArray(target) && isValidArrayIndex(key)) {
+    target.length = Math.max(target.length, key);
+    target.splice(key, 1, val);
+    return val
+  }
+  if (key in target && !(key in Object.prototype)) {
+    target[key] = val;
+    return val
+  }
+  var ob = (target).__ob__;
+  if (target._isVue || (ob && ob.vmCount)) {
+    !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+      'Avoid adding reactive properties to a Vue instance or its root $data ' +
+      'at runtime - declare it upfront in the data option.'
+    );
+    return val
+  }
+  if (!ob) {
+    target[key] = val;
+    return val
+  }
+  defineReactive(ob.value, key, val);
+  ob.dep.notify();
+  return val
+}
+
+/**
+ * Delete a property and trigger change if necessary.
+ */
+function del (target, key) {
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+    (isUndef(target) || isPrimitive(target))
+  ) {
+    warn(("Cannot delete reactive property on undefined, null, or primitive value: " + ((target))));
+  }
+  if (Array.isArray(target) && isValidArrayIndex(key)) {
+    target.splice(key, 1);
+    return
+  }
+  var ob = (target).__ob__;
+  if (target._isVue || (ob && ob.vmCount)) {
+    !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+      'Avoid deleting properties on a Vue instance or its root $data ' +
+      '- just set it to null.'
+    );
+    return
+  }
+  if (!hasOwn(target, key)) {
+    return
+  }
+  delete target[key];
+  if (!ob) {
+    return
+  }
+  ob.dep.notify();
+}
+
+/**
+ * Collect dependencies on array elements when the array is touched, since
+ * we cannot intercept array element access like property getters.
+ */
+function dependArray (value) {
+  for (var e = (void 0), i = 0, l = value.length; i < l; i++) {
+    e = value[i];
+    e && e.__ob__ && e.__ob__.dep.depend();
+    if (Array.isArray(e)) {
+      dependArray(e);
+    }
+  }
+}
+
+/*  */
+
+/**
+ * Option overwriting strategies are functions that handle
+ * how to merge a parent option value and a child option
+ * value into the final value.
+ */
+var strats = config.optionMergeStrategies;
+
+/**
+ * Options with restrictions
+ */
+{
+  strats.el = strats.propsData = function (parent, child, vm, key) {
+    if (!vm) {
+      warn(
+        "option \"" + key + "\" can only be used during instance " +
+        'creation with the `new` keyword.'
+      );
+    }
+    return defaultStrat(parent, child)
+  };
+}
+
+/**
+ * Helper that recursively merges two data objects together.
+ */
+function mergeData (to, from) {
+  if (!from) { return to }
+  var key, toVal, fromVal;
+  var keys = Object.keys(from);
+  for (var i = 0; i < keys.length; i++) {
+    key = keys[i];
+    toVal = to[key];
+    fromVal = from[key];
+    if (!hasOwn(to, key)) {
+      set(to, key, fromVal);
+    } else if (isPlainObject(toVal) && isPlainObject(fromVal)) {
+      mergeData(toVal, fromVal);
+    }
+  }
+  return to
+}
+
+/**
+ * Data
+ */
+function mergeDataOrFn (
+  parentVal,
+  childVal,
+  vm
+) {
+  if (!vm) {
+    // in a Vue.extend merge, both should be functions
+    if (!childVal) {
+      return parentVal
+    }
+    if (!parentVal) {
+      return childVal
+    }
+    // when parentVal & childVal are both present,
+    // we need to return a function that returns the
+    // merged result of both functions... no need to
+    // check if parentVal is a function here because
+    // it has to be a function to pass previous merges.
+    return function mergedDataFn () {
+      return mergeData(
+        typeof childVal === 'function' ? childVal.call(this, this) : childVal,
+        typeof parentVal === 'function' ? parentVal.call(this, this) : parentVal
+      )
+    }
+  } else {
+    return function mergedInstanceDataFn () {
+      // instance merge
+      var instanceData = typeof childVal === 'function'
+        ? childVal.call(vm, vm)
+        : childVal;
+      var defaultData = typeof parentVal === 'function'
+        ? parentVal.call(vm, vm)
+        : parentVal;
+      if (instanceData) {
+        return mergeData(instanceData, defaultData)
+      } else {
+        return defaultData
+      }
+    }
+  }
+}
+
+strats.data = function (
+  parentVal,
+  childVal,
+  vm
+) {
+  if (!vm) {
+    if (childVal && typeof childVal !== 'function') {
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+        'The "data" option should be a function ' +
+        'that returns a per-instance value in component ' +
+        'definitions.',
+        vm
+      );
+
+      return parentVal
+    }
+    return mergeDataOrFn(parentVal, childVal)
+  }
+
+  return mergeDataOrFn(parentVal, childVal, vm)
+};
+
+/**
+ * Hooks and props are merged as arrays.
+ */
+function mergeHook (
+  parentVal,
+  childVal
+) {
+  return childVal
+    ? parentVal
+      ? parentVal.concat(childVal)
+      : Array.isArray(childVal)
+        ? childVal
+        : [childVal]
+    : parentVal
+}
+
+LIFECYCLE_HOOKS.forEach(function (hook) {
+  strats[hook] = mergeHook;
+});
+
+/**
+ * Assets
+ *
+ * When a vm is present (instance creation), we need to do
+ * a three-way merge between constructor options, instance
+ * options and parent options.
+ */
+function mergeAssets (
+  parentVal,
+  childVal,
+  vm,
+  key
+) {
+  var res = Object.create(parentVal || null);
+  if (childVal) {
+    !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && assertObjectType(key, childVal, vm);
+    return extend(res, childVal)
+  } else {
+    return res
+  }
+}
+
+ASSET_TYPES.forEach(function (type) {
+  strats[type + 's'] = mergeAssets;
+});
+
+/**
+ * Watchers.
+ *
+ * Watchers hashes should not overwrite one
+ * another, so we merge them as arrays.
+ */
+strats.watch = function (
+  parentVal,
+  childVal,
+  vm,
+  key
+) {
+  // work around Firefox's Object.prototype.watch...
+  if (parentVal === nativeWatch) { parentVal = undefined; }
+  if (childVal === nativeWatch) { childVal = undefined; }
+  /* istanbul ignore if */
+  if (!childVal) { return Object.create(parentVal || null) }
+  {
+    assertObjectType(key, childVal, vm);
+  }
+  if (!parentVal) { return childVal }
+  var ret = {};
+  extend(ret, parentVal);
+  for (var key$1 in childVal) {
+    var parent = ret[key$1];
+    var child = childVal[key$1];
+    if (parent && !Array.isArray(parent)) {
+      parent = [parent];
+    }
+    ret[key$1] = parent
+      ? parent.concat(child)
+      : Array.isArray(child) ? child : [child];
+  }
+  return ret
+};
+
+/**
+ * Other object hashes.
+ */
+strats.props =
+strats.methods =
+strats.inject =
+strats.computed = function (
+  parentVal,
+  childVal,
+  vm,
+  key
+) {
+  if (childVal && !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE) {
+    assertObjectType(key, childVal, vm);
+  }
+  if (!parentVal) { return childVal }
+  var ret = Object.create(null);
+  extend(ret, parentVal);
+  if (childVal) { extend(ret, childVal); }
+  return ret
+};
+strats.provide = mergeDataOrFn;
+
+/**
+ * Default strategy.
+ */
+var defaultStrat = function (parentVal, childVal) {
+  return childVal === undefined
+    ? parentVal
+    : childVal
+};
+
+/**
+ * Validate component names
+ */
+function checkComponents (options) {
+  for (var key in options.components) {
+    validateComponentName(key);
+  }
+}
+
+function validateComponentName (name) {
+  if (!/^[a-zA-Z][\w-]*$/.test(name)) {
+    warn(
+      'Invalid component name: "' + name + '". Component names ' +
+      'can only contain alphanumeric characters and the hyphen, ' +
+      'and must start with a letter.'
+    );
+  }
+  if (isBuiltInTag(name) || config.isReservedTag(name)) {
+    warn(
+      'Do not use built-in or reserved HTML elements as component ' +
+      'id: ' + name
+    );
+  }
+}
+
+/**
+ * Ensure all props option syntax are normalized into the
+ * Object-based format.
+ */
+function normalizeProps (options, vm) {
+  var props = options.props;
+  if (!props) { return }
+  var res = {};
+  var i, val, name;
+  if (Array.isArray(props)) {
+    i = props.length;
+    while (i--) {
+      val = props[i];
+      if (typeof val === 'string') {
+        name = camelize(val);
+        res[name] = { type: null };
+      } else {
+        warn('props must be strings when using array syntax.');
+      }
+    }
+  } else if (isPlainObject(props)) {
+    for (var key in props) {
+      val = props[key];
+      name = camelize(key);
+      res[name] = isPlainObject(val)
+        ? val
+        : { type: val };
+    }
+  } else {
+    warn(
+      "Invalid value for option \"props\": expected an Array or an Object, " +
+      "but got " + (toRawType(props)) + ".",
+      vm
+    );
+  }
+  options.props = res;
+}
+
+/**
+ * Normalize all injections into Object-based format
+ */
+function normalizeInject (options, vm) {
+  var inject = options.inject;
+  if (!inject) { return }
+  var normalized = options.inject = {};
+  if (Array.isArray(inject)) {
+    for (var i = 0; i < inject.length; i++) {
+      normalized[inject[i]] = { from: inject[i] };
+    }
+  } else if (isPlainObject(inject)) {
+    for (var key in inject) {
+      var val = inject[key];
+      normalized[key] = isPlainObject(val)
+        ? extend({ from: key }, val)
+        : { from: val };
+    }
+  } else {
+    warn(
+      "Invalid value for option \"inject\": expected an Array or an Object, " +
+      "but got " + (toRawType(inject)) + ".",
+      vm
+    );
+  }
+}
+
+/**
+ * Normalize raw function directives into object format.
+ */
+function normalizeDirectives (options) {
+  var dirs = options.directives;
+  if (dirs) {
+    for (var key in dirs) {
+      var def = dirs[key];
+      if (typeof def === 'function') {
+        dirs[key] = { bind: def, update: def };
+      }
+    }
+  }
+}
+
+function assertObjectType (name, value, vm) {
+  if (!isPlainObject(value)) {
+    warn(
+      "Invalid value for option \"" + name + "\": expected an Object, " +
+      "but got " + (toRawType(value)) + ".",
+      vm
+    );
+  }
+}
+
+/**
+ * Merge two option objects into a new one.
+ * Core utility used in both instantiation and inheritance.
+ */
+function mergeOptions (
+  parent,
+  child,
+  vm
+) {
+  {
+    checkComponents(child);
+  }
+
+  if (typeof child === 'function') {
+    child = child.options;
+  }
+
+  normalizeProps(child, vm);
+  normalizeInject(child, vm);
+  normalizeDirectives(child);
+  var extendsFrom = child.extends;
+  if (extendsFrom) {
+    parent = mergeOptions(parent, extendsFrom, vm);
+  }
+  if (child.mixins) {
+    for (var i = 0, l = child.mixins.length; i < l; i++) {
+      parent = mergeOptions(parent, child.mixins[i], vm);
+    }
+  }
+  var options = {};
+  var key;
+  for (key in parent) {
+    mergeField(key);
+  }
+  for (key in child) {
+    if (!hasOwn(parent, key)) {
+      mergeField(key);
+    }
+  }
+  function mergeField (key) {
+    var strat = strats[key] || defaultStrat;
+    options[key] = strat(parent[key], child[key], vm, key);
+  }
+  return options
+}
+
+/**
+ * Resolve an asset.
+ * This function is used because child instances need access
+ * to assets defined in its ancestor chain.
+ */
+function resolveAsset (
+  options,
+  type,
+  id,
+  warnMissing
+) {
+  /* istanbul ignore if */
+  if (typeof id !== 'string') {
+    return
+  }
+  var assets = options[type];
+  // check local registration variations first
+  if (hasOwn(assets, id)) { return assets[id] }
+  var camelizedId = camelize(id);
+  if (hasOwn(assets, camelizedId)) { return assets[camelizedId] }
+  var PascalCaseId = capitalize(camelizedId);
+  if (hasOwn(assets, PascalCaseId)) { return assets[PascalCaseId] }
+  // fallback to prototype chain
+  var res = assets[id] || assets[camelizedId] || assets[PascalCaseId];
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warnMissing && !res) {
+    warn(
+      'Failed to resolve ' + type.slice(0, -1) + ': ' + id,
+      options
+    );
+  }
+  return res
+}
+
+/*  */
+
+function validateProp (
+  key,
+  propOptions,
+  propsData,
+  vm
+) {
+  var prop = propOptions[key];
+  var absent = !hasOwn(propsData, key);
+  var value = propsData[key];
+  // boolean casting
+  var booleanIndex = getTypeIndex(Boolean, prop.type);
+  if (booleanIndex > -1) {
+    if (absent && !hasOwn(prop, 'default')) {
+      value = false;
+    } else if (value === '' || value === hyphenate(key)) {
+      // only cast empty string / same name to boolean if
+      // boolean has higher priority
+      var stringIndex = getTypeIndex(String, prop.type);
+      if (stringIndex < 0 || booleanIndex < stringIndex) {
+        value = true;
+      }
+    }
+  }
+  // check default value
+  if (value === undefined) {
+    value = getPropDefaultValue(vm, prop, key);
+    // since the default value is a fresh copy,
+    // make sure to observe it.
+    var prevShouldObserve = shouldObserve;
+    toggleObserving(true);
+    observe(value);
+    toggleObserving(prevShouldObserve);
+  }
+  {
+    assertProp(prop, key, value, vm, absent);
+  }
+  return value
+}
+
+/**
+ * Get the default value of a prop.
+ */
+function getPropDefaultValue (vm, prop, key) {
+  // no default, return undefined
+  if (!hasOwn(prop, 'default')) {
+    return undefined
+  }
+  var def = prop.default;
+  // warn against non-factory defaults for Object & Array
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && isObject(def)) {
+    warn(
+      'Invalid default value for prop "' + key + '": ' +
+      'Props with type Object/Array must use a factory function ' +
+      'to return the default value.',
+      vm
+    );
+  }
+  // the raw prop value was also undefined from previous render,
+  // return previous default value to avoid unnecessary watcher trigger
+  if (vm && vm.$options.propsData &&
+    vm.$options.propsData[key] === undefined &&
+    vm._props[key] !== undefined
+  ) {
+    return vm._props[key]
+  }
+  // call factory function for non-Function types
+  // a value is Function if its prototype is function even across different execution context
+  return typeof def === 'function' && getType(prop.type) !== 'Function'
+    ? def.call(vm)
+    : def
+}
+
+/**
+ * Assert whether a prop is valid.
+ */
+function assertProp (
+  prop,
+  name,
+  value,
+  vm,
+  absent
+) {
+  if (prop.required && absent) {
+    warn(
+      'Missing required prop: "' + name + '"',
+      vm
+    );
+    return
+  }
+  if (value == null && !prop.required) {
+    return
+  }
+  var type = prop.type;
+  var valid = !type || type === true;
+  var expectedTypes = [];
+  if (type) {
+    if (!Array.isArray(type)) {
+      type = [type];
+    }
+    for (var i = 0; i < type.length && !valid; i++) {
+      var assertedType = assertType(value, type[i]);
+      expectedTypes.push(assertedType.expectedType || '');
+      valid = assertedType.valid;
+    }
+  }
+  if (!valid) {
+    warn(
+      "Invalid prop: type check failed for prop \"" + name + "\"." +
+      " Expected " + (expectedTypes.map(capitalize).join(', ')) +
+      ", got " + (toRawType(value)) + ".",
+      vm
+    );
+    return
+  }
+  var validator = prop.validator;
+  if (validator) {
+    if (!validator(value)) {
+      warn(
+        'Invalid prop: custom validator check failed for prop "' + name + '".',
+        vm
+      );
+    }
+  }
+}
+
+var simpleCheckRE = /^(String|Number|Boolean|Function|Symbol)$/;
+
+function assertType (value, type) {
+  var valid;
+  var expectedType = getType(type);
+  if (simpleCheckRE.test(expectedType)) {
+    var t = typeof value;
+    valid = t === expectedType.toLowerCase();
+    // for primitive wrapper objects
+    if (!valid && t === 'object') {
+      valid = value instanceof type;
+    }
+  } else if (expectedType === 'Object') {
+    valid = isPlainObject(value);
+  } else if (expectedType === 'Array') {
+    valid = Array.isArray(value);
+  } else {
+    valid = value instanceof type;
+  }
+  return {
+    valid: valid,
+    expectedType: expectedType
+  }
+}
+
+/**
+ * Use function string name to check built-in types,
+ * because a simple equality check will fail when running
+ * across different vms / iframes.
+ */
+function getType (fn) {
+  var match = fn && fn.toString().match(/^\s*function (\w+)/);
+  return match ? match[1] : ''
+}
+
+function isSameType (a, b) {
+  return getType(a) === getType(b)
+}
+
+function getTypeIndex (type, expectedTypes) {
+  if (!Array.isArray(expectedTypes)) {
+    return isSameType(expectedTypes, type) ? 0 : -1
+  }
+  for (var i = 0, len = expectedTypes.length; i < len; i++) {
+    if (isSameType(expectedTypes[i], type)) {
+      return i
+    }
+  }
+  return -1
+}
+
+/*  */
+
+function handleError (err, vm, info) {
+  if (vm) {
+    var cur = vm;
+    while ((cur = cur.$parent)) {
+      var hooks = cur.$options.errorCaptured;
+      if (hooks) {
+        for (var i = 0; i < hooks.length; i++) {
+          try {
+            var capture = hooks[i].call(cur, err, vm, info) === false;
+            if (capture) { return }
+          } catch (e) {
+            globalHandleError(e, cur, 'errorCaptured hook');
+          }
+        }
+      }
+    }
+  }
+  globalHandleError(err, vm, info);
+}
+
+function globalHandleError (err, vm, info) {
+  if (config.errorHandler) {
+    try {
+      return config.errorHandler.call(null, err, vm, info)
+    } catch (e) {
+      logError(e, null, 'config.errorHandler');
+    }
+  }
+  logError(err, vm, info);
+}
+
+function logError (err, vm, info) {
+  {
+    warn(("Error in " + info + ": \"" + (err.toString()) + "\""), vm);
+  }
+  /* istanbul ignore else */
+  if ((inBrowser || inWeex) && typeof console !== 'undefined') {
+    console.error(err);
+  } else {
+    throw err
+  }
+}
+
+/*  */
+/* globals MessageChannel */
+
+var callbacks = [];
+var pending = false;
+
+function flushCallbacks () {
+  pending = false;
+  var copies = callbacks.slice(0);
+  callbacks.length = 0;
+  for (var i = 0; i < copies.length; i++) {
+    copies[i]();
+  }
+}
+
+// Here we have async deferring wrappers using both microtasks and (macro) tasks.
+// In < 2.4 we used microtasks everywhere, but there are some scenarios where
+// microtasks have too high a priority and fire in between supposedly
+// sequential events (e.g. #4521, #6690) or even between bubbling of the same
+// event (#6566). However, using (macro) tasks everywhere also has subtle problems
+// when state is changed right before repaint (e.g. #6813, out-in transitions).
+// Here we use microtask by default, but expose a way to force (macro) task when
+// needed (e.g. in event handlers attached by v-on).
+var microTimerFunc;
+var macroTimerFunc;
+var useMacroTask = false;
+
+// Determine (macro) task defer implementation.
+// Technically setImmediate should be the ideal choice, but it's only available
+// in IE. The only polyfill that consistently queues the callback after all DOM
+// events triggered in the same loop is by using MessageChannel.
+/* istanbul ignore if */
+if (typeof setImmediate !== 'undefined' && isNative(setImmediate)) {
+  macroTimerFunc = function () {
+    setImmediate(flushCallbacks);
+  };
+} else if (typeof MessageChannel !== 'undefined' && (
+  isNative(MessageChannel) ||
+  // PhantomJS
+  MessageChannel.toString() === '[object MessageChannelConstructor]'
+)) {
+  var channel = new MessageChannel();
+  var port = channel.port2;
+  channel.port1.onmessage = flushCallbacks;
+  macroTimerFunc = function () {
+    port.postMessage(1);
+  };
+} else {
+  /* istanbul ignore next */
+  macroTimerFunc = function () {
+    setTimeout(flushCallbacks, 0);
+  };
+}
+
+// Determine microtask defer implementation.
+/* istanbul ignore next, $flow-disable-line */
+if (typeof Promise !== 'undefined' && isNative(Promise)) {
+  var p = Promise.resolve();
+  microTimerFunc = function () {
+    p.then(flushCallbacks);
+    // in problematic UIWebViews, Promise.then doesn't completely break, but
+    // it can get stuck in a weird state where callbacks are pushed into the
+    // microtask queue but the queue isn't being flushed, until the browser
+    // needs to do some other work, e.g. handle a timer. Therefore we can
+    // "force" the microtask queue to be flushed by adding an empty timer.
+    if (isIOS) { setTimeout(noop); }
+  };
+} else {
+  // fallback to macro
+  microTimerFunc = macroTimerFunc;
+}
+
+/**
+ * Wrap a function so that if any code inside triggers state change,
+ * the changes are queued using a (macro) task instead of a microtask.
+ */
+function withMacroTask (fn) {
+  return fn._withTask || (fn._withTask = function () {
+    useMacroTask = true;
+    var res = fn.apply(null, arguments);
+    useMacroTask = false;
+    return res
+  })
+}
+
+function nextTick (cb, ctx) {
+  var _resolve;
+  callbacks.push(function () {
+    if (cb) {
+      try {
+        cb.call(ctx);
+      } catch (e) {
+        handleError(e, ctx, 'nextTick');
+      }
+    } else if (_resolve) {
+      _resolve(ctx);
+    }
+  });
+  if (!pending) {
+    pending = true;
+    if (useMacroTask) {
+      macroTimerFunc();
+    } else {
+      microTimerFunc();
+    }
+  }
+  // $flow-disable-line
+  if (!cb && typeof Promise !== 'undefined') {
+    return new Promise(function (resolve) {
+      _resolve = resolve;
+    })
+  }
+}
+
+/*  */
+
+var mark;
+var measure;
+
+{
+  var perf = inBrowser && window.performance;
+  /* istanbul ignore if */
+  if (
+    perf &&
+    perf.mark &&
+    perf.measure &&
+    perf.clearMarks &&
+    perf.clearMeasures
+  ) {
+    mark = function (tag) { return perf.mark(tag); };
+    measure = function (name, startTag, endTag) {
+      perf.measure(name, startTag, endTag);
+      perf.clearMarks(startTag);
+      perf.clearMarks(endTag);
+      perf.clearMeasures(name);
+    };
+  }
+}
+
+/* not type checking this file because flow doesn't play well with Proxy */
+
+var initProxy;
+
+{
+  var allowedGlobals = makeMap(
+    'Infinity,undefined,NaN,isFinite,isNaN,' +
+    'parseFloat,parseInt,decodeURI,decodeURIComponent,encodeURI,encodeURIComponent,' +
+    'Math,Number,Date,Array,Object,Boolean,String,RegExp,Map,Set,JSON,Intl,' +
+    'require' // for Webpack/Browserify
+  );
+
+  var warnNonPresent = function (target, key) {
+    warn(
+      "Property or method \"" + key + "\" is not defined on the instance but " +
+      'referenced during render. Make sure that this property is reactive, ' +
+      'either in the data option, or for class-based components, by ' +
+      'initializing the property. ' +
+      'See: https://vuejs.org/v2/guide/reactivity.html#Declaring-Reactive-Properties.',
+      target
+    );
+  };
+
+  var hasProxy =
+    typeof Proxy !== 'undefined' && isNative(Proxy);
+
+  if (hasProxy) {
+    var isBuiltInModifier = makeMap('stop,prevent,self,ctrl,shift,alt,meta,exact');
+    config.keyCodes = new Proxy(config.keyCodes, {
+      set: function set (target, key, value) {
+        if (isBuiltInModifier(key)) {
+          warn(("Avoid overwriting built-in modifier in config.keyCodes: ." + key));
+          return false
+        } else {
+          target[key] = value;
+          return true
+        }
+      }
+    });
+  }
+
+  var hasHandler = {
+    has: function has (target, key) {
+      var has = key in target;
+      var isAllowed = allowedGlobals(key) || key.charAt(0) === '_';
+      if (!has && !isAllowed) {
+        warnNonPresent(target, key);
+      }
+      return has || !isAllowed
+    }
+  };
+
+  var getHandler = {
+    get: function get (target, key) {
+      if (typeof key === 'string' && !(key in target)) {
+        warnNonPresent(target, key);
+      }
+      return target[key]
+    }
+  };
+
+  initProxy = function initProxy (vm) {
+    if (hasProxy) {
+      // determine which proxy handler to use
+      var options = vm.$options;
+      var handlers = options.render && options.render._withStripped
+        ? getHandler
+        : hasHandler;
+      vm._renderProxy = new Proxy(vm, handlers);
+    } else {
+      vm._renderProxy = vm;
+    }
+  };
+}
+
+/*  */
+
+var seenObjects = new _Set();
+
+/**
+ * Recursively traverse an object to evoke all converted
+ * getters, so that every nested property inside the object
+ * is collected as a "deep" dependency.
+ */
+function traverse (val) {
+  _traverse(val, seenObjects);
+  seenObjects.clear();
+}
+
+function _traverse (val, seen) {
+  var i, keys;
+  var isA = Array.isArray(val);
+  if ((!isA && !isObject(val)) || Object.isFrozen(val) || val instanceof VNode) {
+    return
+  }
+  if (val.__ob__) {
+    var depId = val.__ob__.dep.id;
+    if (seen.has(depId)) {
+      return
+    }
+    seen.add(depId);
+  }
+  if (isA) {
+    i = val.length;
+    while (i--) { _traverse(val[i], seen); }
+  } else {
+    keys = Object.keys(val);
+    i = keys.length;
+    while (i--) { _traverse(val[keys[i]], seen); }
+  }
+}
+
+/*  */
+
+var normalizeEvent = cached(function (name) {
+  var passive = name.charAt(0) === '&';
+  name = passive ? name.slice(1) : name;
+  var once$$1 = name.charAt(0) === '~'; // Prefixed last, checked first
+  name = once$$1 ? name.slice(1) : name;
+  var capture = name.charAt(0) === '!';
+  name = capture ? name.slice(1) : name;
+  return {
+    name: name,
+    once: once$$1,
+    capture: capture,
+    passive: passive
+  }
+});
+
+function createFnInvoker (fns) {
+  function invoker () {
+    var arguments$1 = arguments;
+
+    var fns = invoker.fns;
+    if (Array.isArray(fns)) {
+      var cloned = fns.slice();
+      for (var i = 0; i < cloned.length; i++) {
+        cloned[i].apply(null, arguments$1);
+      }
+    } else {
+      // return handler return value for single handlers
+      return fns.apply(null, arguments)
+    }
+  }
+  invoker.fns = fns;
+  return invoker
+}
+
+function updateListeners (
+  on,
+  oldOn,
+  add,
+  remove$$1,
+  vm
+) {
+  var name, def, cur, old, event;
+  for (name in on) {
+    def = cur = on[name];
+    old = oldOn[name];
+    event = normalizeEvent(name);
+    /* istanbul ignore if */
+    if (isUndef(cur)) {
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+        "Invalid handler for event \"" + (event.name) + "\": got " + String(cur),
+        vm
+      );
+    } else if (isUndef(old)) {
+      if (isUndef(cur.fns)) {
+        cur = on[name] = createFnInvoker(cur);
+      }
+      add(event.name, cur, event.once, event.capture, event.passive, event.params);
+    } else if (cur !== old) {
+      old.fns = cur;
+      on[name] = old;
+    }
+  }
+  for (name in oldOn) {
+    if (isUndef(on[name])) {
+      event = normalizeEvent(name);
+      remove$$1(event.name, oldOn[name], event.capture);
+    }
+  }
+}
+
+/*  */
+
+function mergeVNodeHook (def, hookKey, hook) {
+  if (def instanceof VNode) {
+    def = def.data.hook || (def.data.hook = {});
+  }
+  var invoker;
+  var oldHook = def[hookKey];
+
+  function wrappedHook () {
+    hook.apply(this, arguments);
+    // important: remove merged hook to ensure it's called only once
+    // and prevent memory leak
+    remove(invoker.fns, wrappedHook);
+  }
+
+  if (isUndef(oldHook)) {
+    // no existing hook
+    invoker = createFnInvoker([wrappedHook]);
+  } else {
+    /* istanbul ignore if */
+    if (isDef(oldHook.fns) && isTrue(oldHook.merged)) {
+      // already a merged invoker
+      invoker = oldHook;
+      invoker.fns.push(wrappedHook);
+    } else {
+      // existing plain hook
+      invoker = createFnInvoker([oldHook, wrappedHook]);
+    }
+  }
+
+  invoker.merged = true;
+  def[hookKey] = invoker;
+}
+
+/*  */
+
+function extractPropsFromVNodeData (
+  data,
+  Ctor,
+  tag
+) {
+  // we are only extracting raw values here.
+  // validation and default values are handled in the child
+  // component itself.
+  var propOptions = Ctor.options.props;
+  if (isUndef(propOptions)) {
+    return
+  }
+  var res = {};
+  var attrs = data.attrs;
+  var props = data.props;
+  if (isDef(attrs) || isDef(props)) {
+    for (var key in propOptions) {
+      var altKey = hyphenate(key);
+      {
+        var keyInLowerCase = key.toLowerCase();
+        if (
+          key !== keyInLowerCase &&
+          attrs && hasOwn(attrs, keyInLowerCase)
+        ) {
+          tip(
+            "Prop \"" + keyInLowerCase + "\" is passed to component " +
+            (formatComponentName(tag || Ctor)) + ", but the declared prop name is" +
+            " \"" + key + "\". " +
+            "Note that HTML attributes are case-insensitive and camelCased " +
+            "props need to use their kebab-case equivalents when using in-DOM " +
+            "templates. You should probably use \"" + altKey + "\" instead of \"" + key + "\"."
+          );
+        }
+      }
+      checkProp(res, props, key, altKey, true) ||
+      checkProp(res, attrs, key, altKey, false);
+    }
+  }
+  return res
+}
+
+function checkProp (
+  res,
+  hash,
+  key,
+  altKey,
+  preserve
+) {
+  if (isDef(hash)) {
+    if (hasOwn(hash, key)) {
+      res[key] = hash[key];
+      if (!preserve) {
+        delete hash[key];
+      }
+      return true
+    } else if (hasOwn(hash, altKey)) {
+      res[key] = hash[altKey];
+      if (!preserve) {
+        delete hash[altKey];
+      }
+      return true
+    }
+  }
+  return false
+}
+
+/*  */
+
+// The template compiler attempts to minimize the need for normalization by
+// statically analyzing the template at compile time.
+//
+// For plain HTML markup, normalization can be completely skipped because the
+// generated render function is guaranteed to return Array<VNode>. There are
+// two cases where extra normalization is needed:
+
+// 1. When the children contains components - because a functional component
+// may return an Array instead of a single root. In this case, just a simple
+// normalization is needed - if any child is an Array, we flatten the whole
+// thing with Array.prototype.concat. It is guaranteed to be only 1-level deep
+// because functional components already normalize their own children.
+function simpleNormalizeChildren (children) {
+  for (var i = 0; i < children.length; i++) {
+    if (Array.isArray(children[i])) {
+      return Array.prototype.concat.apply([], children)
+    }
+  }
+  return children
+}
+
+// 2. When the children contains constructs that always generated nested Arrays,
+// e.g. <template>, <slot>, v-for, or when the children is provided by user
+// with hand-written render functions / JSX. In such cases a full normalization
+// is needed to cater to all possible types of children values.
+function normalizeChildren (children) {
+  return isPrimitive(children)
+    ? [createTextVNode(children)]
+    : Array.isArray(children)
+      ? normalizeArrayChildren(children)
+      : undefined
+}
+
+function isTextNode (node) {
+  return isDef(node) && isDef(node.text) && isFalse(node.isComment)
+}
+
+function normalizeArrayChildren (children, nestedIndex) {
+  var res = [];
+  var i, c, lastIndex, last;
+  for (i = 0; i < children.length; i++) {
+    c = children[i];
+    if (isUndef(c) || typeof c === 'boolean') { continue }
+    lastIndex = res.length - 1;
+    last = res[lastIndex];
+    //  nested
+    if (Array.isArray(c)) {
+      if (c.length > 0) {
+        c = normalizeArrayChildren(c, ((nestedIndex || '') + "_" + i));
+        // merge adjacent text nodes
+        if (isTextNode(c[0]) && isTextNode(last)) {
+          res[lastIndex] = createTextVNode(last.text + (c[0]).text);
+          c.shift();
+        }
+        res.push.apply(res, c);
+      }
+    } else if (isPrimitive(c)) {
+      if (isTextNode(last)) {
+        // merge adjacent text nodes
+        // this is necessary for SSR hydration because text nodes are
+        // essentially merged when rendered to HTML strings
+        res[lastIndex] = createTextVNode(last.text + c);
+      } else if (c !== '') {
+        // convert primitive to vnode
+        res.push(createTextVNode(c));
+      }
+    } else {
+      if (isTextNode(c) && isTextNode(last)) {
+        // merge adjacent text nodes
+        res[lastIndex] = createTextVNode(last.text + c.text);
+      } else {
+        // default key for nested array children (likely generated by v-for)
+        if (isTrue(children._isVList) &&
+          isDef(c.tag) &&
+          isUndef(c.key) &&
+          isDef(nestedIndex)) {
+          c.key = "__vlist" + nestedIndex + "_" + i + "__";
+        }
+        res.push(c);
+      }
+    }
+  }
+  return res
+}
+
+/*  */
+
+function ensureCtor (comp, base) {
+  if (
+    comp.__esModule ||
+    (hasSymbol && comp[Symbol.toStringTag] === 'Module')
+  ) {
+    comp = comp.default;
+  }
+  return isObject(comp)
+    ? base.extend(comp)
+    : comp
+}
+
+function createAsyncPlaceholder (
+  factory,
+  data,
+  context,
+  children,
+  tag
+) {
+  var node = createEmptyVNode();
+  node.asyncFactory = factory;
+  node.asyncMeta = { data: data, context: context, children: children, tag: tag };
+  return node
+}
+
+function resolveAsyncComponent (
+  factory,
+  baseCtor,
+  context
+) {
+  if (isTrue(factory.error) && isDef(factory.errorComp)) {
+    return factory.errorComp
+  }
+
+  if (isDef(factory.resolved)) {
+    return factory.resolved
+  }
+
+  if (isTrue(factory.loading) && isDef(factory.loadingComp)) {
+    return factory.loadingComp
+  }
+
+  if (isDef(factory.contexts)) {
+    // already pending
+    factory.contexts.push(context);
+  } else {
+    var contexts = factory.contexts = [context];
+    var sync = true;
+
+    var forceRender = function () {
+      for (var i = 0, l = contexts.length; i < l; i++) {
+        contexts[i].$forceUpdate();
+      }
+    };
+
+    var resolve = once(function (res) {
+      // cache resolved
+      factory.resolved = ensureCtor(res, baseCtor);
+      // invoke callbacks only if this is not a synchronous resolve
+      // (async resolves are shimmed as synchronous during SSR)
+      if (!sync) {
+        forceRender();
+      }
+    });
+
+    var reject = once(function (reason) {
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+        "Failed to resolve async component: " + (String(factory)) +
+        (reason ? ("\nReason: " + reason) : '')
+      );
+      if (isDef(factory.errorComp)) {
+        factory.error = true;
+        forceRender();
+      }
+    });
+
+    var res = factory(resolve, reject);
+
+    if (isObject(res)) {
+      if (typeof res.then === 'function') {
+        // () => Promise
+        if (isUndef(factory.resolved)) {
+          res.then(resolve, reject);
+        }
+      } else if (isDef(res.component) && typeof res.component.then === 'function') {
+        res.component.then(resolve, reject);
+
+        if (isDef(res.error)) {
+          factory.errorComp = ensureCtor(res.error, baseCtor);
+        }
+
+        if (isDef(res.loading)) {
+          factory.loadingComp = ensureCtor(res.loading, baseCtor);
+          if (res.delay === 0) {
+            factory.loading = true;
+          } else {
+            setTimeout(function () {
+              if (isUndef(factory.resolved) && isUndef(factory.error)) {
+                factory.loading = true;
+                forceRender();
+              }
+            }, res.delay || 200);
+          }
+        }
+
+        if (isDef(res.timeout)) {
+          setTimeout(function () {
+            if (isUndef(factory.resolved)) {
+              reject(
+                "timeout (" + (res.timeout) + "ms)"
+              );
+            }
+          }, res.timeout);
+        }
+      }
+    }
+
+    sync = false;
+    // return in case resolved synchronously
+    return factory.loading
+      ? factory.loadingComp
+      : factory.resolved
+  }
+}
+
+/*  */
+
+function isAsyncPlaceholder (node) {
+  return node.isComment && node.asyncFactory
+}
+
+/*  */
+
+function getFirstComponentChild (children) {
+  if (Array.isArray(children)) {
+    for (var i = 0; i < children.length; i++) {
+      var c = children[i];
+      if (isDef(c) && (isDef(c.componentOptions) || isAsyncPlaceholder(c))) {
+        return c
+      }
+    }
+  }
+}
+
+/*  */
+
+/*  */
+
+function initEvents (vm) {
+  vm._events = Object.create(null);
+  vm._hasHookEvent = false;
+  // init parent attached events
+  var listeners = vm.$options._parentListeners;
+  if (listeners) {
+    updateComponentListeners(vm, listeners);
+  }
+}
+
+var target;
+
+function add (event, fn, once) {
+  if (once) {
+    target.$once(event, fn);
+  } else {
+    target.$on(event, fn);
+  }
+}
+
+function remove$1 (event, fn) {
+  target.$off(event, fn);
+}
+
+function updateComponentListeners (
+  vm,
+  listeners,
+  oldListeners
+) {
+  target = vm;
+  updateListeners(listeners, oldListeners || {}, add, remove$1, vm);
+  target = undefined;
+}
+
+function eventsMixin (Vue) {
+  var hookRE = /^hook:/;
+  Vue.prototype.$on = function (event, fn) {
+    var this$1 = this;
+
+    var vm = this;
+    if (Array.isArray(event)) {
+      for (var i = 0, l = event.length; i < l; i++) {
+        this$1.$on(event[i], fn);
+      }
+    } else {
+      (vm._events[event] || (vm._events[event] = [])).push(fn);
+      // optimize hook:event cost by using a boolean flag marked at registration
+      // instead of a hash lookup
+      if (hookRE.test(event)) {
+        vm._hasHookEvent = true;
+      }
+    }
+    return vm
+  };
+
+  Vue.prototype.$once = function (event, fn) {
+    var vm = this;
+    function on () {
+      vm.$off(event, on);
+      fn.apply(vm, arguments);
+    }
+    on.fn = fn;
+    vm.$on(event, on);
+    return vm
+  };
+
+  Vue.prototype.$off = function (event, fn) {
+    var this$1 = this;
+
+    var vm = this;
+    // all
+    if (!arguments.length) {
+      vm._events = Object.create(null);
+      return vm
+    }
+    // array of events
+    if (Array.isArray(event)) {
+      for (var i = 0, l = event.length; i < l; i++) {
+        this$1.$off(event[i], fn);
+      }
+      return vm
+    }
+    // specific event
+    var cbs = vm._events[event];
+    if (!cbs) {
+      return vm
+    }
+    if (!fn) {
+      vm._events[event] = null;
+      return vm
+    }
+    if (fn) {
+      // specific handler
+      var cb;
+      var i$1 = cbs.length;
+      while (i$1--) {
+        cb = cbs[i$1];
+        if (cb === fn || cb.fn === fn) {
+          cbs.splice(i$1, 1);
+          break
+        }
+      }
+    }
+    return vm
+  };
+
+  Vue.prototype.$emit = function (event) {
+    var vm = this;
+    {
+      var lowerCaseEvent = event.toLowerCase();
+      if (lowerCaseEvent !== event && vm._events[lowerCaseEvent]) {
+        tip(
+          "Event \"" + lowerCaseEvent + "\" is emitted in component " +
+          (formatComponentName(vm)) + " but the handler is registered for \"" + event + "\". " +
+          "Note that HTML attributes are case-insensitive and you cannot use " +
+          "v-on to listen to camelCase events when using in-DOM templates. " +
+          "You should probably use \"" + (hyphenate(event)) + "\" instead of \"" + event + "\"."
+        );
+      }
+    }
+    var cbs = vm._events[event];
+    if (cbs) {
+      cbs = cbs.length > 1 ? toArray(cbs) : cbs;
+      var args = toArray(arguments, 1);
+      for (var i = 0, l = cbs.length; i < l; i++) {
+        try {
+          cbs[i].apply(vm, args);
+        } catch (e) {
+          handleError(e, vm, ("event handler for \"" + event + "\""));
+        }
+      }
+    }
+    return vm
+  };
+}
+
+/*  */
+
+
+
+/**
+ * Runtime helper for resolving raw children VNodes into a slot object.
+ */
+function resolveSlots (
+  children,
+  context
+) {
+  var slots = {};
+  if (!children) {
+    return slots
+  }
+  for (var i = 0, l = children.length; i < l; i++) {
+    var child = children[i];
+    var data = child.data;
+    // remove slot attribute if the node is resolved as a Vue slot node
+    if (data && data.attrs && data.attrs.slot) {
+      delete data.attrs.slot;
+    }
+    // named slots should only be respected if the vnode was rendered in the
+    // same context.
+    if ((child.context === context || child.fnContext === context) &&
+      data && data.slot != null
+    ) {
+      var name = data.slot;
+      var slot = (slots[name] || (slots[name] = []));
+      if (child.tag === 'template') {
+        slot.push.apply(slot, child.children || []);
+      } else {
+        slot.push(child);
+      }
+    } else {
+      (slots.default || (slots.default = [])).push(child);
+    }
+  }
+  // ignore slots that contains only whitespace
+  for (var name$1 in slots) {
+    if (slots[name$1].every(isWhitespace)) {
+      delete slots[name$1];
+    }
+  }
+  return slots
+}
+
+function isWhitespace (node) {
+  return (node.isComment && !node.asyncFactory) || node.text === ' '
+}
+
+function resolveScopedSlots (
+  fns, // see flow/vnode
+  res
+) {
+  res = res || {};
+  for (var i = 0; i < fns.length; i++) {
+    if (Array.isArray(fns[i])) {
+      resolveScopedSlots(fns[i], res);
+    } else {
+      res[fns[i].key] = fns[i].fn;
+    }
+  }
+  return res
+}
+
+/*  */
+
+var activeInstance = null;
+var isUpdatingChildComponent = false;
+
+function initLifecycle (vm) {
+  var options = vm.$options;
+
+  // locate first non-abstract parent
+  var parent = options.parent;
+  if (parent && !options.abstract) {
+    while (parent.$options.abstract && parent.$parent) {
+      parent = parent.$parent;
+    }
+    parent.$children.push(vm);
+  }
+
+  vm.$parent = parent;
+  vm.$root = parent ? parent.$root : vm;
+
+  vm.$children = [];
+  vm.$refs = {};
+
+  vm._watcher = null;
+  vm._inactive = null;
+  vm._directInactive = false;
+  vm._isMounted = false;
+  vm._isDestroyed = false;
+  vm._isBeingDestroyed = false;
+}
+
+function lifecycleMixin (Vue) {
+  Vue.prototype._update = function (vnode, hydrating) {
+    var vm = this;
+    if (vm._isMounted) {
+      callHook(vm, 'beforeUpdate');
+    }
+    var prevEl = vm.$el;
+    var prevVnode = vm._vnode;
+    var prevActiveInstance = activeInstance;
+    activeInstance = vm;
+    vm._vnode = vnode;
+    // Vue.prototype.__patch__ is injected in entry points
+    // based on the rendering backend used.
+    if (!prevVnode) {
+      // initial render
+      vm.$el = vm.__patch__(
+        vm.$el, vnode, hydrating, false /* removeOnly */,
+        vm.$options._parentElm,
+        vm.$options._refElm
+      );
+      // no need for the ref nodes after initial patch
+      // this prevents keeping a detached DOM tree in memory (#5851)
+      vm.$options._parentElm = vm.$options._refElm = null;
+    } else {
+      // updates
+      vm.$el = vm.__patch__(prevVnode, vnode);
+    }
+    activeInstance = prevActiveInstance;
+    // update __vue__ reference
+    if (prevEl) {
+      prevEl.__vue__ = null;
+    }
+    if (vm.$el) {
+      vm.$el.__vue__ = vm;
+    }
+    // if parent is an HOC, update its $el as well
+    if (vm.$vnode && vm.$parent && vm.$vnode === vm.$parent._vnode) {
+      vm.$parent.$el = vm.$el;
+    }
+    // updated hook is called by the scheduler to ensure that children are
+    // updated in a parent's updated hook.
+  };
+
+  Vue.prototype.$forceUpdate = function () {
+    var vm = this;
+    if (vm._watcher) {
+      vm._watcher.update();
+    }
+  };
+
+  Vue.prototype.$destroy = function () {
+    var vm = this;
+    if (vm._isBeingDestroyed) {
+      return
+    }
+    callHook(vm, 'beforeDestroy');
+    vm._isBeingDestroyed = true;
+    // remove self from parent
+    var parent = vm.$parent;
+    if (parent && !parent._isBeingDestroyed && !vm.$options.abstract) {
+      remove(parent.$children, vm);
+    }
+    // teardown watchers
+    if (vm._watcher) {
+      vm._watcher.teardown();
+    }
+    var i = vm._watchers.length;
+    while (i--) {
+      vm._watchers[i].teardown();
+    }
+    // remove reference from data ob
+    // frozen object may not have observer.
+    if (vm._data.__ob__) {
+      vm._data.__ob__.vmCount--;
+    }
+    // call the last hook...
+    vm._isDestroyed = true;
+    // invoke destroy hooks on current rendered tree
+    vm.__patch__(vm._vnode, null);
+    // fire destroyed hook
+    callHook(vm, 'destroyed');
+    // turn off all instance listeners.
+    vm.$off();
+    // remove __vue__ reference
+    if (vm.$el) {
+      vm.$el.__vue__ = null;
+    }
+    // release circular reference (#6759)
+    if (vm.$vnode) {
+      vm.$vnode.parent = null;
+    }
+  };
+}
+
+function mountComponent (
+  vm,
+  el,
+  hydrating
+) {
+  vm.$el = el;
+  if (!vm.$options.render) {
+    vm.$options.render = createEmptyVNode;
+    {
+      /* istanbul ignore if */
+      if ((vm.$options.template && vm.$options.template.charAt(0) !== '#') ||
+        vm.$options.el || el) {
+        warn(
+          'You are using the runtime-only build of Vue where the template ' +
+          'compiler is not available. Either pre-compile the templates into ' +
+          'render functions, or use the compiler-included build.',
+          vm
+        );
+      } else {
+        warn(
+          'Failed to mount component: template or render function not defined.',
+          vm
+        );
+      }
+    }
+  }
+  callHook(vm, 'beforeMount');
+
+  var updateComponent;
+  /* istanbul ignore if */
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && config.performance && mark) {
+    updateComponent = function () {
+      var name = vm._name;
+      var id = vm._uid;
+      var startTag = "vue-perf-start:" + id;
+      var endTag = "vue-perf-end:" + id;
+
+      mark(startTag);
+      var vnode = vm._render();
+      mark(endTag);
+      measure(("vue " + name + " render"), startTag, endTag);
+
+      mark(startTag);
+      vm._update(vnode, hydrating);
+      mark(endTag);
+      measure(("vue " + name + " patch"), startTag, endTag);
+    };
+  } else {
+    updateComponent = function () {
+      vm._update(vm._render(), hydrating);
+    };
+  }
+
+  // we set this to vm._watcher inside the watcher's constructor
+  // since the watcher's initial patch may call $forceUpdate (e.g. inside child
+  // component's mounted hook), which relies on vm._watcher being already defined
+  new Watcher(vm, updateComponent, noop, null, true /* isRenderWatcher */);
+  hydrating = false;
+
+  // manually mounted instance, call mounted on self
+  // mounted is called for render-created child components in its inserted hook
+  if (vm.$vnode == null) {
+    vm._isMounted = true;
+    callHook(vm, 'mounted');
+  }
+  return vm
+}
+
+function updateChildComponent (
+  vm,
+  propsData,
+  listeners,
+  parentVnode,
+  renderChildren
+) {
+  {
+    isUpdatingChildComponent = true;
+  }
+
+  // determine whether component has slot children
+  // we need to do this before overwriting $options._renderChildren
+  var hasChildren = !!(
+    renderChildren ||               // has new static slots
+    vm.$options._renderChildren ||  // has old static slots
+    parentVnode.data.scopedSlots || // has new scoped slots
+    vm.$scopedSlots !== emptyObject // has old scoped slots
+  );
+
+  vm.$options._parentVnode = parentVnode;
+  vm.$vnode = parentVnode; // update vm's placeholder node without re-render
+
+  if (vm._vnode) { // update child tree's parent
+    vm._vnode.parent = parentVnode;
+  }
+  vm.$options._renderChildren = renderChildren;
+
+  // update $attrs and $listeners hash
+  // these are also reactive so they may trigger child update if the child
+  // used them during render
+  vm.$attrs = parentVnode.data.attrs || emptyObject;
+  vm.$listeners = listeners || emptyObject;
+
+  // update props
+  if (propsData && vm.$options.props) {
+    toggleObserving(false);
+    var props = vm._props;
+    var propKeys = vm.$options._propKeys || [];
+    for (var i = 0; i < propKeys.length; i++) {
+      var key = propKeys[i];
+      var propOptions = vm.$options.props; // wtf flow?
+      props[key] = validateProp(key, propOptions, propsData, vm);
+    }
+    toggleObserving(true);
+    // keep a copy of raw propsData
+    vm.$options.propsData = propsData;
+  }
+
+  // update listeners
+  listeners = listeners || emptyObject;
+  var oldListeners = vm.$options._parentListeners;
+  vm.$options._parentListeners = listeners;
+  updateComponentListeners(vm, listeners, oldListeners);
+
+  // resolve slots + force update if has children
+  if (hasChildren) {
+    vm.$slots = resolveSlots(renderChildren, parentVnode.context);
+    vm.$forceUpdate();
+  }
+
+  {
+    isUpdatingChildComponent = false;
+  }
+}
+
+function isInInactiveTree (vm) {
+  while (vm && (vm = vm.$parent)) {
+    if (vm._inactive) { return true }
+  }
+  return false
+}
+
+function activateChildComponent (vm, direct) {
+  if (direct) {
+    vm._directInactive = false;
+    if (isInInactiveTree(vm)) {
+      return
+    }
+  } else if (vm._directInactive) {
+    return
+  }
+  if (vm._inactive || vm._inactive === null) {
+    vm._inactive = false;
+    for (var i = 0; i < vm.$children.length; i++) {
+      activateChildComponent(vm.$children[i]);
+    }
+    callHook(vm, 'activated');
+  }
+}
+
+function deactivateChildComponent (vm, direct) {
+  if (direct) {
+    vm._directInactive = true;
+    if (isInInactiveTree(vm)) {
+      return
+    }
+  }
+  if (!vm._inactive) {
+    vm._inactive = true;
+    for (var i = 0; i < vm.$children.length; i++) {
+      deactivateChildComponent(vm.$children[i]);
+    }
+    callHook(vm, 'deactivated');
+  }
+}
+
+function callHook (vm, hook) {
+  // #7573 disable dep collection when invoking lifecycle hooks
+  pushTarget();
+  var handlers = vm.$options[hook];
+  if (handlers) {
+    for (var i = 0, j = handlers.length; i < j; i++) {
+      try {
+        handlers[i].call(vm);
+      } catch (e) {
+        handleError(e, vm, (hook + " hook"));
+      }
+    }
+  }
+  if (vm._hasHookEvent) {
+    vm.$emit('hook:' + hook);
+  }
+  popTarget();
+}
+
+/*  */
+
+
+var MAX_UPDATE_COUNT = 100;
+
+var queue = [];
+var activatedChildren = [];
+var has = {};
+var circular = {};
+var waiting = false;
+var flushing = false;
+var index = 0;
+
+/**
+ * Reset the scheduler's state.
+ */
+function resetSchedulerState () {
+  index = queue.length = activatedChildren.length = 0;
+  has = {};
+  {
+    circular = {};
+  }
+  waiting = flushing = false;
+}
+
+/**
+ * Flush both queues and run the watchers.
+ */
+function flushSchedulerQueue () {
+  flushing = true;
+  var watcher, id;
+
+  // Sort queue before flush.
+  // This ensures that:
+  // 1. Components are updated from parent to child. (because parent is always
+  //    created before the child)
+  // 2. A component's user watchers are run before its render watcher (because
+  //    user watchers are created before the render watcher)
+  // 3. If a component is destroyed during a parent component's watcher run,
+  //    its watchers can be skipped.
+  queue.sort(function (a, b) { return a.id - b.id; });
+
+  // do not cache length because more watchers might be pushed
+  // as we run existing watchers
+  for (index = 0; index < queue.length; index++) {
+    watcher = queue[index];
+    id = watcher.id;
+    has[id] = null;
+    watcher.run();
+    // in dev build, check and stop circular updates.
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && has[id] != null) {
+      circular[id] = (circular[id] || 0) + 1;
+      if (circular[id] > MAX_UPDATE_COUNT) {
+        warn(
+          'You may have an infinite update loop ' + (
+            watcher.user
+              ? ("in watcher with expression \"" + (watcher.expression) + "\"")
+              : "in a component render function."
+          ),
+          watcher.vm
+        );
+        break
+      }
+    }
+  }
+
+  // keep copies of post queues before resetting state
+  var activatedQueue = activatedChildren.slice();
+  var updatedQueue = queue.slice();
+
+  resetSchedulerState();
+
+  // call component updated and activated hooks
+  callActivatedHooks(activatedQueue);
+  callUpdatedHooks(updatedQueue);
+
+  // devtool hook
+  /* istanbul ignore if */
+  if (devtools && config.devtools) {
+    devtools.emit('flush');
+  }
+}
+
+function callUpdatedHooks (queue) {
+  var i = queue.length;
+  while (i--) {
+    var watcher = queue[i];
+    var vm = watcher.vm;
+    if (vm._watcher === watcher && vm._isMounted) {
+      callHook(vm, 'updated');
+    }
+  }
+}
+
+/**
+ * Queue a kept-alive component that was activated during patch.
+ * The queue will be processed after the entire tree has been patched.
+ */
+function queueActivatedComponent (vm) {
+  // setting _inactive to false here so that a render function can
+  // rely on checking whether it's in an inactive tree (e.g. router-view)
+  vm._inactive = false;
+  activatedChildren.push(vm);
+}
+
+function callActivatedHooks (queue) {
+  for (var i = 0; i < queue.length; i++) {
+    queue[i]._inactive = true;
+    activateChildComponent(queue[i], true /* true */);
+  }
+}
+
+/**
+ * Push a watcher into the watcher queue.
+ * Jobs with duplicate IDs will be skipped unless it's
+ * pushed when the queue is being flushed.
+ */
+function queueWatcher (watcher) {
+  var id = watcher.id;
+  if (has[id] == null) {
+    has[id] = true;
+    if (!flushing) {
+      queue.push(watcher);
+    } else {
+      // if already flushing, splice the watcher based on its id
+      // if already past its id, it will be run next immediately.
+      var i = queue.length - 1;
+      while (i > index && queue[i].id > watcher.id) {
+        i--;
+      }
+      queue.splice(i + 1, 0, watcher);
+    }
+    // queue the flush
+    if (!waiting) {
+      waiting = true;
+      nextTick(flushSchedulerQueue);
+    }
+  }
+}
+
+/*  */
+
+var uid$1 = 0;
+
+/**
+ * A watcher parses an expression, collects dependencies,
+ * and fires callback when the expression value changes.
+ * This is used for both the $watch() api and directives.
+ */
+var Watcher = function Watcher (
+  vm,
+  expOrFn,
+  cb,
+  options,
+  isRenderWatcher
+) {
+  this.vm = vm;
+  if (isRenderWatcher) {
+    vm._watcher = this;
+  }
+  vm._watchers.push(this);
+  // options
+  if (options) {
+    this.deep = !!options.deep;
+    this.user = !!options.user;
+    this.lazy = !!options.lazy;
+    this.sync = !!options.sync;
+  } else {
+    this.deep = this.user = this.lazy = this.sync = false;
+  }
+  this.cb = cb;
+  this.id = ++uid$1; // uid for batching
+  this.active = true;
+  this.dirty = this.lazy; // for lazy watchers
+  this.deps = [];
+  this.newDeps = [];
+  this.depIds = new _Set();
+  this.newDepIds = new _Set();
+  this.expression = expOrFn.toString();
+  // parse expression for getter
+  if (typeof expOrFn === 'function') {
+    this.getter = expOrFn;
+  } else {
+    this.getter = parsePath(expOrFn);
+    if (!this.getter) {
+      this.getter = function () {};
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+        "Failed watching path: \"" + expOrFn + "\" " +
+        'Watcher only accepts simple dot-delimited paths. ' +
+        'For full control, use a function instead.',
+        vm
+      );
+    }
+  }
+  this.value = this.lazy
+    ? undefined
+    : this.get();
+};
+
+/**
+ * Evaluate the getter, and re-collect dependencies.
+ */
+Watcher.prototype.get = function get () {
+  pushTarget(this);
+  var value;
+  var vm = this.vm;
+  try {
+    value = this.getter.call(vm, vm);
+  } catch (e) {
+    if (this.user) {
+      handleError(e, vm, ("getter for watcher \"" + (this.expression) + "\""));
+    } else {
+      throw e
+    }
+  } finally {
+    // "touch" every property so they are all tracked as
+    // dependencies for deep watching
+    if (this.deep) {
+      traverse(value);
+    }
+    popTarget();
+    this.cleanupDeps();
+  }
+  return value
+};
+
+/**
+ * Add a dependency to this directive.
+ */
+Watcher.prototype.addDep = function addDep (dep) {
+  var id = dep.id;
+  if (!this.newDepIds.has(id)) {
+    this.newDepIds.add(id);
+    this.newDeps.push(dep);
+    if (!this.depIds.has(id)) {
+      dep.addSub(this);
+    }
+  }
+};
+
+/**
+ * Clean up for dependency collection.
+ */
+Watcher.prototype.cleanupDeps = function cleanupDeps () {
+    var this$1 = this;
+
+  var i = this.deps.length;
+  while (i--) {
+    var dep = this$1.deps[i];
+    if (!this$1.newDepIds.has(dep.id)) {
+      dep.removeSub(this$1);
+    }
+  }
+  var tmp = this.depIds;
+  this.depIds = this.newDepIds;
+  this.newDepIds = tmp;
+  this.newDepIds.clear();
+  tmp = this.deps;
+  this.deps = this.newDeps;
+  this.newDeps = tmp;
+  this.newDeps.length = 0;
+};
+
+/**
+ * Subscriber interface.
+ * Will be called when a dependency changes.
+ */
+Watcher.prototype.update = function update () {
+  /* istanbul ignore else */
+  if (this.lazy) {
+    this.dirty = true;
+  } else if (this.sync) {
+    this.run();
+  } else {
+    queueWatcher(this);
+  }
+};
+
+/**
+ * Scheduler job interface.
+ * Will be called by the scheduler.
+ */
+Watcher.prototype.run = function run () {
+  if (this.active) {
+    var value = this.get();
+    if (
+      value !== this.value ||
+      // Deep watchers and watchers on Object/Arrays should fire even
+      // when the value is the same, because the value may
+      // have mutated.
+      isObject(value) ||
+      this.deep
+    ) {
+      // set new value
+      var oldValue = this.value;
+      this.value = value;
+      if (this.user) {
+        try {
+          this.cb.call(this.vm, value, oldValue);
+        } catch (e) {
+          handleError(e, this.vm, ("callback for watcher \"" + (this.expression) + "\""));
+        }
+      } else {
+        this.cb.call(this.vm, value, oldValue);
+      }
+    }
+  }
+};
+
+/**
+ * Evaluate the value of the watcher.
+ * This only gets called for lazy watchers.
+ */
+Watcher.prototype.evaluate = function evaluate () {
+  this.value = this.get();
+  this.dirty = false;
+};
+
+/**
+ * Depend on all deps collected by this watcher.
+ */
+Watcher.prototype.depend = function depend () {
+    var this$1 = this;
+
+  var i = this.deps.length;
+  while (i--) {
+    this$1.deps[i].depend();
+  }
+};
+
+/**
+ * Remove self from all dependencies' subscriber list.
+ */
+Watcher.prototype.teardown = function teardown () {
+    var this$1 = this;
+
+  if (this.active) {
+    // remove self from vm's watcher list
+    // this is a somewhat expensive operation so we skip it
+    // if the vm is being destroyed.
+    if (!this.vm._isBeingDestroyed) {
+      remove(this.vm._watchers, this);
+    }
+    var i = this.deps.length;
+    while (i--) {
+      this$1.deps[i].removeSub(this$1);
+    }
+    this.active = false;
+  }
+};
+
+/*  */
+
+var sharedPropertyDefinition = {
+  enumerable: true,
+  configurable: true,
+  get: noop,
+  set: noop
+};
+
+function proxy (target, sourceKey, key) {
+  sharedPropertyDefinition.get = function proxyGetter () {
+    return this[sourceKey][key]
+  };
+  sharedPropertyDefinition.set = function proxySetter (val) {
+    this[sourceKey][key] = val;
+  };
+  Object.defineProperty(target, key, sharedPropertyDefinition);
+}
+
+function initState (vm) {
+  vm._watchers = [];
+  var opts = vm.$options;
+  if (opts.props) { initProps(vm, opts.props); }
+  if (opts.methods) { initMethods(vm, opts.methods); }
+  if (opts.data) {
+    initData(vm);
+  } else {
+    observe(vm._data = {}, true /* asRootData */);
+  }
+  if (opts.computed) { initComputed(vm, opts.computed); }
+  if (opts.watch && opts.watch !== nativeWatch) {
+    initWatch(vm, opts.watch);
+  }
+}
+
+function initProps (vm, propsOptions) {
+  var propsData = vm.$options.propsData || {};
+  var props = vm._props = {};
+  // cache prop keys so that future props updates can iterate using Array
+  // instead of dynamic object key enumeration.
+  var keys = vm.$options._propKeys = [];
+  var isRoot = !vm.$parent;
+  // root instance props should be converted
+  if (!isRoot) {
+    toggleObserving(false);
+  }
+  var loop = function ( key ) {
+    keys.push(key);
+    var value = validateProp(key, propsOptions, propsData, vm);
+    /* istanbul ignore else */
+    {
+      var hyphenatedKey = hyphenate(key);
+      if (isReservedAttribute(hyphenatedKey) ||
+          config.isReservedAttr(hyphenatedKey)) {
+        warn(
+          ("\"" + hyphenatedKey + "\" is a reserved attribute and cannot be used as component prop."),
+          vm
+        );
+      }
+      defineReactive(props, key, value, function () {
+        if (vm.$parent && !isUpdatingChildComponent) {
+          warn(
+            "Avoid mutating a prop directly since the value will be " +
+            "overwritten whenever the parent component re-renders. " +
+            "Instead, use a data or computed property based on the prop's " +
+            "value. Prop being mutated: \"" + key + "\"",
+            vm
+          );
+        }
+      });
+    }
+    // static props are already proxied on the component's prototype
+    // during Vue.extend(). We only need to proxy props defined at
+    // instantiation here.
+    if (!(key in vm)) {
+      proxy(vm, "_props", key);
+    }
+  };
+
+  for (var key in propsOptions) loop( key );
+  toggleObserving(true);
+}
+
+function initData (vm) {
+  var data = vm.$options.data;
+  data = vm._data = typeof data === 'function'
+    ? getData(data, vm)
+    : data || {};
+  if (!isPlainObject(data)) {
+    data = {};
+    !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+      'data functions should return an object:\n' +
+      'https://vuejs.org/v2/guide/components.html#data-Must-Be-a-Function',
+      vm
+    );
+  }
+  // proxy data on instance
+  var keys = Object.keys(data);
+  var props = vm.$options.props;
+  var methods = vm.$options.methods;
+  var i = keys.length;
+  while (i--) {
+    var key = keys[i];
+    {
+      if (methods && hasOwn(methods, key)) {
+        warn(
+          ("Method \"" + key + "\" has already been defined as a data property."),
+          vm
+        );
+      }
+    }
+    if (props && hasOwn(props, key)) {
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+        "The data property \"" + key + "\" is already declared as a prop. " +
+        "Use prop default value instead.",
+        vm
+      );
+    } else if (!isReserved(key)) {
+      proxy(vm, "_data", key);
+    }
+  }
+  // observe data
+  observe(data, true /* asRootData */);
+}
+
+function getData (data, vm) {
+  // #7573 disable dep collection when invoking data getters
+  pushTarget();
+  try {
+    return data.call(vm, vm)
+  } catch (e) {
+    handleError(e, vm, "data()");
+    return {}
+  } finally {
+    popTarget();
+  }
+}
+
+var computedWatcherOptions = { lazy: true };
+
+function initComputed (vm, computed) {
+  // $flow-disable-line
+  var watchers = vm._computedWatchers = Object.create(null);
+  // computed properties are just getters during SSR
+  var isSSR = isServerRendering();
+
+  for (var key in computed) {
+    var userDef = computed[key];
+    var getter = typeof userDef === 'function' ? userDef : userDef.get;
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && getter == null) {
+      warn(
+        ("Getter is missing for computed property \"" + key + "\"."),
+        vm
+      );
+    }
+
+    if (!isSSR) {
+      // create internal watcher for the computed property.
+      watchers[key] = new Watcher(
+        vm,
+        getter || noop,
+        noop,
+        computedWatcherOptions
+      );
+    }
+
+    // component-defined computed properties are already defined on the
+    // component prototype. We only need to define computed properties defined
+    // at instantiation here.
+    if (!(key in vm)) {
+      defineComputed(vm, key, userDef);
+    } else {
+      if (key in vm.$data) {
+        warn(("The computed property \"" + key + "\" is already defined in data."), vm);
+      } else if (vm.$options.props && key in vm.$options.props) {
+        warn(("The computed property \"" + key + "\" is already defined as a prop."), vm);
+      }
+    }
+  }
+}
+
+function defineComputed (
+  target,
+  key,
+  userDef
+) {
+  var shouldCache = !isServerRendering();
+  if (typeof userDef === 'function') {
+    sharedPropertyDefinition.get = shouldCache
+      ? createComputedGetter(key)
+      : userDef;
+    sharedPropertyDefinition.set = noop;
+  } else {
+    sharedPropertyDefinition.get = userDef.get
+      ? shouldCache && userDef.cache !== false
+        ? createComputedGetter(key)
+        : userDef.get
+      : noop;
+    sharedPropertyDefinition.set = userDef.set
+      ? userDef.set
+      : noop;
+  }
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+      sharedPropertyDefinition.set === noop) {
+    sharedPropertyDefinition.set = function () {
+      warn(
+        ("Computed property \"" + key + "\" was assigned to but it has no setter."),
+        this
+      );
+    };
+  }
+  Object.defineProperty(target, key, sharedPropertyDefinition);
+}
+
+function createComputedGetter (key) {
+  return function computedGetter () {
+    var watcher = this._computedWatchers && this._computedWatchers[key];
+    if (watcher) {
+      if (watcher.dirty) {
+        watcher.evaluate();
+      }
+      if (Dep.target) {
+        watcher.depend();
+      }
+      return watcher.value
+    }
+  }
+}
+
+function initMethods (vm, methods) {
+  var props = vm.$options.props;
+  for (var key in methods) {
+    {
+      if (methods[key] == null) {
+        warn(
+          "Method \"" + key + "\" has an undefined value in the component definition. " +
+          "Did you reference the function correctly?",
+          vm
+        );
+      }
+      if (props && hasOwn(props, key)) {
+        warn(
+          ("Method \"" + key + "\" has already been defined as a prop."),
+          vm
+        );
+      }
+      if ((key in vm) && isReserved(key)) {
+        warn(
+          "Method \"" + key + "\" conflicts with an existing Vue instance method. " +
+          "Avoid defining component methods that start with _ or $."
+        );
+      }
+    }
+    vm[key] = methods[key] == null ? noop : bind(methods[key], vm);
+  }
+}
+
+function initWatch (vm, watch) {
+  for (var key in watch) {
+    var handler = watch[key];
+    if (Array.isArray(handler)) {
+      for (var i = 0; i < handler.length; i++) {
+        createWatcher(vm, key, handler[i]);
+      }
+    } else {
+      createWatcher(vm, key, handler);
+    }
+  }
+}
+
+function createWatcher (
+  vm,
+  expOrFn,
+  handler,
+  options
+) {
+  if (isPlainObject(handler)) {
+    options = handler;
+    handler = handler.handler;
+  }
+  if (typeof handler === 'string') {
+    handler = vm[handler];
+  }
+  return vm.$watch(expOrFn, handler, options)
+}
+
+function stateMixin (Vue) {
+  // flow somehow has problems with directly declared definition object
+  // when using Object.defineProperty, so we have to procedurally build up
+  // the object here.
+  var dataDef = {};
+  dataDef.get = function () { return this._data };
+  var propsDef = {};
+  propsDef.get = function () { return this._props };
+  {
+    dataDef.set = function (newData) {
+      warn(
+        'Avoid replacing instance root $data. ' +
+        'Use nested data properties instead.',
+        this
+      );
+    };
+    propsDef.set = function () {
+      warn("$props is readonly.", this);
+    };
+  }
+  Object.defineProperty(Vue.prototype, '$data', dataDef);
+  Object.defineProperty(Vue.prototype, '$props', propsDef);
+
+  Vue.prototype.$set = set;
+  Vue.prototype.$delete = del;
+
+  Vue.prototype.$watch = function (
+    expOrFn,
+    cb,
+    options
+  ) {
+    var vm = this;
+    if (isPlainObject(cb)) {
+      return createWatcher(vm, expOrFn, cb, options)
+    }
+    options = options || {};
+    options.user = true;
+    var watcher = new Watcher(vm, expOrFn, cb, options);
+    if (options.immediate) {
+      cb.call(vm, watcher.value);
+    }
+    return function unwatchFn () {
+      watcher.teardown();
+    }
+  };
+}
+
+/*  */
+
+function initProvide (vm) {
+  var provide = vm.$options.provide;
+  if (provide) {
+    vm._provided = typeof provide === 'function'
+      ? provide.call(vm)
+      : provide;
+  }
+}
+
+function initInjections (vm) {
+  var result = resolveInject(vm.$options.inject, vm);
+  if (result) {
+    toggleObserving(false);
+    Object.keys(result).forEach(function (key) {
+      /* istanbul ignore else */
+      {
+        defineReactive(vm, key, result[key], function () {
+          warn(
+            "Avoid mutating an injected value directly since the changes will be " +
+            "overwritten whenever the provided component re-renders. " +
+            "injection being mutated: \"" + key + "\"",
+            vm
+          );
+        });
+      }
+    });
+    toggleObserving(true);
+  }
+}
+
+function resolveInject (inject, vm) {
+  if (inject) {
+    // inject is :any because flow is not smart enough to figure out cached
+    var result = Object.create(null);
+    var keys = hasSymbol
+      ? Reflect.ownKeys(inject).filter(function (key) {
+        /* istanbul ignore next */
+        return Object.getOwnPropertyDescriptor(inject, key).enumerable
+      })
+      : Object.keys(inject);
+
+    for (var i = 0; i < keys.length; i++) {
+      var key = keys[i];
+      var provideKey = inject[key].from;
+      var source = vm;
+      while (source) {
+        if (source._provided && hasOwn(source._provided, provideKey)) {
+          result[key] = source._provided[provideKey];
+          break
+        }
+        source = source.$parent;
+      }
+      if (!source) {
+        if ('default' in inject[key]) {
+          var provideDefault = inject[key].default;
+          result[key] = typeof provideDefault === 'function'
+            ? provideDefault.call(vm)
+            : provideDefault;
+        } else {
+          warn(("Injection \"" + key + "\" not found"), vm);
+        }
+      }
+    }
+    return result
+  }
+}
+
+/*  */
+
+/**
+ * Runtime helper for rendering v-for lists.
+ */
+function renderList (
+  val,
+  render
+) {
+  var ret, i, l, keys, key;
+  if (Array.isArray(val) || typeof val === 'string') {
+    ret = new Array(val.length);
+    for (i = 0, l = val.length; i < l; i++) {
+      ret[i] = render(val[i], i);
+    }
+  } else if (typeof val === 'number') {
+    ret = new Array(val);
+    for (i = 0; i < val; i++) {
+      ret[i] = render(i + 1, i);
+    }
+  } else if (isObject(val)) {
+    keys = Object.keys(val);
+    ret = new Array(keys.length);
+    for (i = 0, l = keys.length; i < l; i++) {
+      key = keys[i];
+      ret[i] = render(val[key], key, i);
+    }
+  }
+  if (isDef(ret)) {
+    (ret)._isVList = true;
+  }
+  return ret
+}
+
+/*  */
+
+/**
+ * Runtime helper for rendering <slot>
+ */
+function renderSlot (
+  name,
+  fallback,
+  props,
+  bindObject
+) {
+  var scopedSlotFn = this.$scopedSlots[name];
+  var nodes;
+  if (scopedSlotFn) { // scoped slot
+    props = props || {};
+    if (bindObject) {
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && !isObject(bindObject)) {
+        warn(
+          'slot v-bind without argument expects an Object',
+          this
+        );
+      }
+      props = extend(extend({}, bindObject), props);
+    }
+    nodes = scopedSlotFn(props) || fallback;
+  } else {
+    var slotNodes = this.$slots[name];
+    // warn duplicate slot usage
+    if (slotNodes) {
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && slotNodes._rendered) {
+        warn(
+          "Duplicate presence of slot \"" + name + "\" found in the same render tree " +
+          "- this will likely cause render errors.",
+          this
+        );
+      }
+      slotNodes._rendered = true;
+    }
+    nodes = slotNodes || fallback;
+  }
+
+  var target = props && props.slot;
+  if (target) {
+    return this.$createElement('template', { slot: target }, nodes)
+  } else {
+    return nodes
+  }
+}
+
+/*  */
+
+/**
+ * Runtime helper for resolving filters
+ */
+function resolveFilter (id) {
+  return resolveAsset(this.$options, 'filters', id, true) || identity
+}
+
+/*  */
+
+function isKeyNotMatch (expect, actual) {
+  if (Array.isArray(expect)) {
+    return expect.indexOf(actual) === -1
+  } else {
+    return expect !== actual
+  }
+}
+
+/**
+ * Runtime helper for checking keyCodes from config.
+ * exposed as Vue.prototype._k
+ * passing in eventKeyName as last argument separately for backwards compat
+ */
+function checkKeyCodes (
+  eventKeyCode,
+  key,
+  builtInKeyCode,
+  eventKeyName,
+  builtInKeyName
+) {
+  var mappedKeyCode = config.keyCodes[key] || builtInKeyCode;
+  if (builtInKeyName && eventKeyName && !config.keyCodes[key]) {
+    return isKeyNotMatch(builtInKeyName, eventKeyName)
+  } else if (mappedKeyCode) {
+    return isKeyNotMatch(mappedKeyCode, eventKeyCode)
+  } else if (eventKeyName) {
+    return hyphenate(eventKeyName) !== key
+  }
+}
+
+/*  */
+
+/**
+ * Runtime helper for merging v-bind="object" into a VNode's data.
+ */
+function bindObjectProps (
+  data,
+  tag,
+  value,
+  asProp,
+  isSync
+) {
+  if (value) {
+    if (!isObject(value)) {
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+        'v-bind without argument expects an Object or Array value',
+        this
+      );
+    } else {
+      if (Array.isArray(value)) {
+        value = toObject(value);
+      }
+      var hash;
+      var loop = function ( key ) {
+        if (
+          key === 'class' ||
+          key === 'style' ||
+          isReservedAttribute(key)
+        ) {
+          hash = data;
+        } else {
+          var type = data.attrs && data.attrs.type;
+          hash = asProp || config.mustUseProp(tag, type, key)
+            ? data.domProps || (data.domProps = {})
+            : data.attrs || (data.attrs = {});
+        }
+        if (!(key in hash)) {
+          hash[key] = value[key];
+
+          if (isSync) {
+            var on = data.on || (data.on = {});
+            on[("update:" + key)] = function ($event) {
+              value[key] = $event;
+            };
+          }
+        }
+      };
+
+      for (var key in value) loop( key );
+    }
+  }
+  return data
+}
+
+/*  */
+
+/**
+ * Runtime helper for rendering static trees.
+ */
+function renderStatic (
+  index,
+  isInFor
+) {
+  var cached = this._staticTrees || (this._staticTrees = []);
+  var tree = cached[index];
+  // if has already-rendered static tree and not inside v-for,
+  // we can reuse the same tree.
+  if (tree && !isInFor) {
+    return tree
+  }
+  // otherwise, render a fresh tree.
+  tree = cached[index] = this.$options.staticRenderFns[index].call(
+    this._renderProxy,
+    null,
+    this // for render fns generated for functional component templates
+  );
+  markStatic(tree, ("__static__" + index), false);
+  return tree
+}
+
+/**
+ * Runtime helper for v-once.
+ * Effectively it means marking the node as static with a unique key.
+ */
+function markOnce (
+  tree,
+  index,
+  key
+) {
+  markStatic(tree, ("__once__" + index + (key ? ("_" + key) : "")), true);
+  return tree
+}
+
+function markStatic (
+  tree,
+  key,
+  isOnce
+) {
+  if (Array.isArray(tree)) {
+    for (var i = 0; i < tree.length; i++) {
+      if (tree[i] && typeof tree[i] !== 'string') {
+        markStaticNode(tree[i], (key + "_" + i), isOnce);
+      }
+    }
+  } else {
+    markStaticNode(tree, key, isOnce);
+  }
+}
+
+function markStaticNode (node, key, isOnce) {
+  node.isStatic = true;
+  node.key = key;
+  node.isOnce = isOnce;
+}
+
+/*  */
+
+function bindObjectListeners (data, value) {
+  if (value) {
+    if (!isPlainObject(value)) {
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+        'v-on without argument expects an Object value',
+        this
+      );
+    } else {
+      var on = data.on = data.on ? extend({}, data.on) : {};
+      for (var key in value) {
+        var existing = on[key];
+        var ours = value[key];
+        on[key] = existing ? [].concat(existing, ours) : ours;
+      }
+    }
+  }
+  return data
+}
+
+/*  */
+
+function installRenderHelpers (target) {
+  target._o = markOnce;
+  target._n = toNumber;
+  target._s = toString;
+  target._l = renderList;
+  target._t = renderSlot;
+  target._q = looseEqual;
+  target._i = looseIndexOf;
+  target._m = renderStatic;
+  target._f = resolveFilter;
+  target._k = checkKeyCodes;
+  target._b = bindObjectProps;
+  target._v = createTextVNode;
+  target._e = createEmptyVNode;
+  target._u = resolveScopedSlots;
+  target._g = bindObjectListeners;
+}
+
+/*  */
+
+function FunctionalRenderContext (
+  data,
+  props,
+  children,
+  parent,
+  Ctor
+) {
+  var options = Ctor.options;
+  // ensure the createElement function in functional components
+  // gets a unique context - this is necessary for correct named slot check
+  var contextVm;
+  if (hasOwn(parent, '_uid')) {
+    contextVm = Object.create(parent);
+    // $flow-disable-line
+    contextVm._original = parent;
+  } else {
+    // the context vm passed in is a functional context as well.
+    // in this case we want to make sure we are able to get a hold to the
+    // real context instance.
+    contextVm = parent;
+    // $flow-disable-line
+    parent = parent._original;
+  }
+  var isCompiled = isTrue(options._compiled);
+  var needNormalization = !isCompiled;
+
+  this.data = data;
+  this.props = props;
+  this.children = children;
+  this.parent = parent;
+  this.listeners = data.on || emptyObject;
+  this.injections = resolveInject(options.inject, parent);
+  this.slots = function () { return resolveSlots(children, parent); };
+
+  // support for compiled functional template
+  if (isCompiled) {
+    // exposing $options for renderStatic()
+    this.$options = options;
+    // pre-resolve slots for renderSlot()
+    this.$slots = this.slots();
+    this.$scopedSlots = data.scopedSlots || emptyObject;
+  }
+
+  if (options._scopeId) {
+    this._c = function (a, b, c, d) {
+      var vnode = createElement(contextVm, a, b, c, d, needNormalization);
+      if (vnode && !Array.isArray(vnode)) {
+        vnode.fnScopeId = options._scopeId;
+        vnode.fnContext = parent;
+      }
+      return vnode
+    };
+  } else {
+    this._c = function (a, b, c, d) { return createElement(contextVm, a, b, c, d, needNormalization); };
+  }
+}
+
+installRenderHelpers(FunctionalRenderContext.prototype);
+
+function createFunctionalComponent (
+  Ctor,
+  propsData,
+  data,
+  contextVm,
+  children
+) {
+  var options = Ctor.options;
+  var props = {};
+  var propOptions = options.props;
+  if (isDef(propOptions)) {
+    for (var key in propOptions) {
+      props[key] = validateProp(key, propOptions, propsData || emptyObject);
+    }
+  } else {
+    if (isDef(data.attrs)) { mergeProps(props, data.attrs); }
+    if (isDef(data.props)) { mergeProps(props, data.props); }
+  }
+
+  var renderContext = new FunctionalRenderContext(
+    data,
+    props,
+    children,
+    contextVm,
+    Ctor
+  );
+
+  var vnode = options.render.call(null, renderContext._c, renderContext);
+
+  if (vnode instanceof VNode) {
+    return cloneAndMarkFunctionalResult(vnode, data, renderContext.parent, options)
+  } else if (Array.isArray(vnode)) {
+    var vnodes = normalizeChildren(vnode) || [];
+    var res = new Array(vnodes.length);
+    for (var i = 0; i < vnodes.length; i++) {
+      res[i] = cloneAndMarkFunctionalResult(vnodes[i], data, renderContext.parent, options);
+    }
+    return res
+  }
+}
+
+function cloneAndMarkFunctionalResult (vnode, data, contextVm, options) {
+  // #7817 clone node before setting fnContext, otherwise if the node is reused
+  // (e.g. it was from a cached normal slot) the fnContext causes named slots
+  // that should not be matched to match.
+  var clone = cloneVNode(vnode);
+  clone.fnContext = contextVm;
+  clone.fnOptions = options;
+  if (data.slot) {
+    (clone.data || (clone.data = {})).slot = data.slot;
+  }
+  return clone
+}
+
+function mergeProps (to, from) {
+  for (var key in from) {
+    to[camelize(key)] = from[key];
+  }
+}
+
+/*  */
+
+
+
+
+// Register the component hook to weex native render engine.
+// The hook will be triggered by native, not javascript.
+
+
+// Updates the state of the component to weex native render engine.
+
+/*  */
+
+// https://github.com/Hanks10100/weex-native-directive/tree/master/component
+
+// listening on native callback
+
+/*  */
+
+/*  */
+
+// inline hooks to be invoked on component VNodes during patch
+var componentVNodeHooks = {
+  init: function init (
+    vnode,
+    hydrating,
+    parentElm,
+    refElm
+  ) {
+    if (
+      vnode.componentInstance &&
+      !vnode.componentInstance._isDestroyed &&
+      vnode.data.keepAlive
+    ) {
+      // kept-alive components, treat as a patch
+      var mountedNode = vnode; // work around flow
+      componentVNodeHooks.prepatch(mountedNode, mountedNode);
+    } else {
+      var child = vnode.componentInstance = createComponentInstanceForVnode(
+        vnode,
+        activeInstance,
+        parentElm,
+        refElm
+      );
+      child.$mount(hydrating ? vnode.elm : undefined, hydrating);
+    }
+  },
+
+  prepatch: function prepatch (oldVnode, vnode) {
+    var options = vnode.componentOptions;
+    var child = vnode.componentInstance = oldVnode.componentInstance;
+    updateChildComponent(
+      child,
+      options.propsData, // updated props
+      options.listeners, // updated listeners
+      vnode, // new parent vnode
+      options.children // new children
+    );
+  },
+
+  insert: function insert (vnode) {
+    var context = vnode.context;
+    var componentInstance = vnode.componentInstance;
+    if (!componentInstance._isMounted) {
+      componentInstance._isMounted = true;
+      callHook(componentInstance, 'mounted');
+    }
+    if (vnode.data.keepAlive) {
+      if (context._isMounted) {
+        // vue-router#1212
+        // During updates, a kept-alive component's child components may
+        // change, so directly walking the tree here may call activated hooks
+        // on incorrect children. Instead we push them into a queue which will
+        // be processed after the whole patch process ended.
+        queueActivatedComponent(componentInstance);
+      } else {
+        activateChildComponent(componentInstance, true /* direct */);
+      }
+    }
+  },
+
+  destroy: function destroy (vnode) {
+    var componentInstance = vnode.componentInstance;
+    if (!componentInstance._isDestroyed) {
+      if (!vnode.data.keepAlive) {
+        componentInstance.$destroy();
+      } else {
+        deactivateChildComponent(componentInstance, true /* direct */);
+      }
+    }
+  }
+};
+
+var hooksToMerge = Object.keys(componentVNodeHooks);
+
+function createComponent (
+  Ctor,
+  data,
+  context,
+  children,
+  tag
+) {
+  if (isUndef(Ctor)) {
+    return
+  }
+
+  var baseCtor = context.$options._base;
+
+  // plain options object: turn it into a constructor
+  if (isObject(Ctor)) {
+    Ctor = baseCtor.extend(Ctor);
+  }
+
+  // if at this stage it's not a constructor or an async component factory,
+  // reject.
+  if (typeof Ctor !== 'function') {
+    {
+      warn(("Invalid Component definition: " + (String(Ctor))), context);
+    }
+    return
+  }
+
+  // async component
+  var asyncFactory;
+  if (isUndef(Ctor.cid)) {
+    asyncFactory = Ctor;
+    Ctor = resolveAsyncComponent(asyncFactory, baseCtor, context);
+    if (Ctor === undefined) {
+      // return a placeholder node for async component, which is rendered
+      // as a comment node but preserves all the raw information for the node.
+      // the information will be used for async server-rendering and hydration.
+      return createAsyncPlaceholder(
+        asyncFactory,
+        data,
+        context,
+        children,
+        tag
+      )
+    }
+  }
+
+  data = data || {};
+
+  // resolve constructor options in case global mixins are applied after
+  // component constructor creation
+  resolveConstructorOptions(Ctor);
+
+  // transform component v-model data into props & events
+  if (isDef(data.model)) {
+    transformModel(Ctor.options, data);
+  }
+
+  // extract props
+  var propsData = extractPropsFromVNodeData(data, Ctor, tag);
+
+  // functional component
+  if (isTrue(Ctor.options.functional)) {
+    return createFunctionalComponent(Ctor, propsData, data, context, children)
+  }
+
+  // extract listeners, since these needs to be treated as
+  // child component listeners instead of DOM listeners
+  var listeners = data.on;
+  // replace with listeners with .native modifier
+  // so it gets processed during parent component patch.
+  data.on = data.nativeOn;
+
+  if (isTrue(Ctor.options.abstract)) {
+    // abstract components do not keep anything
+    // other than props & listeners & slot
+
+    // work around flow
+    var slot = data.slot;
+    data = {};
+    if (slot) {
+      data.slot = slot;
+    }
+  }
+
+  // install component management hooks onto the placeholder node
+  installComponentHooks(data);
+
+  // return a placeholder vnode
+  var name = Ctor.options.name || tag;
+  var vnode = new VNode(
+    ("vue-component-" + (Ctor.cid) + (name ? ("-" + name) : '')),
+    data, undefined, undefined, undefined, context,
+    { Ctor: Ctor, propsData: propsData, listeners: listeners, tag: tag, children: children },
+    asyncFactory
+  );
+
+  // Weex specific: invoke recycle-list optimized @render function for
+  // extracting cell-slot template.
+  // https://github.com/Hanks10100/weex-native-directive/tree/master/component
+  /* istanbul ignore if */
+  return vnode
+}
+
+function createComponentInstanceForVnode (
+  vnode, // we know it's MountedComponentVNode but flow doesn't
+  parent, // activeInstance in lifecycle state
+  parentElm,
+  refElm
+) {
+  var options = {
+    _isComponent: true,
+    parent: parent,
+    _parentVnode: vnode,
+    _parentElm: parentElm || null,
+    _refElm: refElm || null
+  };
+  // check inline-template render functions
+  var inlineTemplate = vnode.data.inlineTemplate;
+  if (isDef(inlineTemplate)) {
+    options.render = inlineTemplate.render;
+    options.staticRenderFns = inlineTemplate.staticRenderFns;
+  }
+  return new vnode.componentOptions.Ctor(options)
+}
+
+function installComponentHooks (data) {
+  var hooks = data.hook || (data.hook = {});
+  for (var i = 0; i < hooksToMerge.length; i++) {
+    var key = hooksToMerge[i];
+    hooks[key] = componentVNodeHooks[key];
+  }
+}
+
+// transform component v-model info (value and callback) into
+// prop and event handler respectively.
+function transformModel (options, data) {
+  var prop = (options.model && options.model.prop) || 'value';
+  var event = (options.model && options.model.event) || 'input';(data.props || (data.props = {}))[prop] = data.model.value;
+  var on = data.on || (data.on = {});
+  if (isDef(on[event])) {
+    on[event] = [data.model.callback].concat(on[event]);
+  } else {
+    on[event] = data.model.callback;
+  }
+}
+
+/*  */
+
+var SIMPLE_NORMALIZE = 1;
+var ALWAYS_NORMALIZE = 2;
+
+// wrapper function for providing a more flexible interface
+// without getting yelled at by flow
+function createElement (
+  context,
+  tag,
+  data,
+  children,
+  normalizationType,
+  alwaysNormalize
+) {
+  if (Array.isArray(data) || isPrimitive(data)) {
+    normalizationType = children;
+    children = data;
+    data = undefined;
+  }
+  if (isTrue(alwaysNormalize)) {
+    normalizationType = ALWAYS_NORMALIZE;
+  }
+  return _createElement(context, tag, data, children, normalizationType)
+}
+
+function _createElement (
+  context,
+  tag,
+  data,
+  children,
+  normalizationType
+) {
+  if (isDef(data) && isDef((data).__ob__)) {
+    !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+      "Avoid using observed data object as vnode data: " + (JSON.stringify(data)) + "\n" +
+      'Always create fresh vnode data objects in each render!',
+      context
+    );
+    return createEmptyVNode()
+  }
+  // object syntax in v-bind
+  if (isDef(data) && isDef(data.is)) {
+    tag = data.is;
+  }
+  if (!tag) {
+    // in case of component :is set to falsy value
+    return createEmptyVNode()
+  }
+  // warn against non-primitive key
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+    isDef(data) && isDef(data.key) && !isPrimitive(data.key)
+  ) {
+    {
+      warn(
+        'Avoid using non-primitive value as key, ' +
+        'use string/number value instead.',
+        context
+      );
+    }
+  }
+  // support single function children as default scoped slot
+  if (Array.isArray(children) &&
+    typeof children[0] === 'function'
+  ) {
+    data = data || {};
+    data.scopedSlots = { default: children[0] };
+    children.length = 0;
+  }
+  if (normalizationType === ALWAYS_NORMALIZE) {
+    children = normalizeChildren(children);
+  } else if (normalizationType === SIMPLE_NORMALIZE) {
+    children = simpleNormalizeChildren(children);
+  }
+  var vnode, ns;
+  if (typeof tag === 'string') {
+    var Ctor;
+    ns = (context.$vnode && context.$vnode.ns) || config.getTagNamespace(tag);
+    if (config.isReservedTag(tag)) {
+      // platform built-in elements
+      vnode = new VNode(
+        config.parsePlatformTagName(tag), data, children,
+        undefined, undefined, context
+      );
+    } else if (isDef(Ctor = resolveAsset(context.$options, 'components', tag))) {
+      // component
+      vnode = createComponent(Ctor, data, context, children, tag);
+    } else {
+      // unknown or unlisted namespaced elements
+      // check at runtime because it may get assigned a namespace when its
+      // parent normalizes children
+      vnode = new VNode(
+        tag, data, children,
+        undefined, undefined, context
+      );
+    }
+  } else {
+    // direct component options / constructor
+    vnode = createComponent(tag, data, context, children);
+  }
+  if (Array.isArray(vnode)) {
+    return vnode
+  } else if (isDef(vnode)) {
+    if (isDef(ns)) { applyNS(vnode, ns); }
+    if (isDef(data)) { registerDeepBindings(data); }
+    return vnode
+  } else {
+    return createEmptyVNode()
+  }
+}
+
+function applyNS (vnode, ns, force) {
+  vnode.ns = ns;
+  if (vnode.tag === 'foreignObject') {
+    // use default namespace inside foreignObject
+    ns = undefined;
+    force = true;
+  }
+  if (isDef(vnode.children)) {
+    for (var i = 0, l = vnode.children.length; i < l; i++) {
+      var child = vnode.children[i];
+      if (isDef(child.tag) && (
+        isUndef(child.ns) || (isTrue(force) && child.tag !== 'svg'))) {
+        applyNS(child, ns, force);
+      }
+    }
+  }
+}
+
+// ref #5318
+// necessary to ensure parent re-render when deep bindings like :style and
+// :class are used on slot nodes
+function registerDeepBindings (data) {
+  if (isObject(data.style)) {
+    traverse(data.style);
+  }
+  if (isObject(data.class)) {
+    traverse(data.class);
+  }
+}
+
+/*  */
+
+function initRender (vm) {
+  vm._vnode = null; // the root of the child tree
+  vm._staticTrees = null; // v-once cached trees
+  var options = vm.$options;
+  var parentVnode = vm.$vnode = options._parentVnode; // the placeholder node in parent tree
+  var renderContext = parentVnode && parentVnode.context;
+  vm.$slots = resolveSlots(options._renderChildren, renderContext);
+  vm.$scopedSlots = emptyObject;
+  // bind the createElement fn to this instance
+  // so that we get proper render context inside it.
+  // args order: tag, data, children, normalizationType, alwaysNormalize
+  // internal version is used by render functions compiled from templates
+  vm._c = function (a, b, c, d) { return createElement(vm, a, b, c, d, false); };
+  // normalization is always applied for the public version, used in
+  // user-written render functions.
+  vm.$createElement = function (a, b, c, d) { return createElement(vm, a, b, c, d, true); };
+
+  // $attrs & $listeners are exposed for easier HOC creation.
+  // they need to be reactive so that HOCs using them are always updated
+  var parentData = parentVnode && parentVnode.data;
+
+  /* istanbul ignore else */
+  {
+    defineReactive(vm, '$attrs', parentData && parentData.attrs || emptyObject, function () {
+      !isUpdatingChildComponent && warn("$attrs is readonly.", vm);
+    }, true);
+    defineReactive(vm, '$listeners', options._parentListeners || emptyObject, function () {
+      !isUpdatingChildComponent && warn("$listeners is readonly.", vm);
+    }, true);
+  }
+}
+
+function renderMixin (Vue) {
+  // install runtime convenience helpers
+  installRenderHelpers(Vue.prototype);
+
+  Vue.prototype.$nextTick = function (fn) {
+    return nextTick(fn, this)
+  };
+
+  Vue.prototype._render = function () {
+    var vm = this;
+    var ref = vm.$options;
+    var render = ref.render;
+    var _parentVnode = ref._parentVnode;
+
+    // reset _rendered flag on slots for duplicate slot check
+    {
+      for (var key in vm.$slots) {
+        // $flow-disable-line
+        vm.$slots[key]._rendered = false;
+      }
+    }
+
+    if (_parentVnode) {
+      vm.$scopedSlots = _parentVnode.data.scopedSlots || emptyObject;
+    }
+
+    // set parent vnode. this allows render functions to have access
+    // to the data on the placeholder node.
+    vm.$vnode = _parentVnode;
+    // render self
+    var vnode;
+    try {
+      vnode = render.call(vm._renderProxy, vm.$createElement);
+    } catch (e) {
+      handleError(e, vm, "render");
+      // return error render result,
+      // or previous vnode to prevent render error causing blank component
+      /* istanbul ignore else */
+      {
+        if (vm.$options.renderError) {
+          try {
+            vnode = vm.$options.renderError.call(vm._renderProxy, vm.$createElement, e);
+          } catch (e) {
+            handleError(e, vm, "renderError");
+            vnode = vm._vnode;
+          }
+        } else {
+          vnode = vm._vnode;
+        }
+      }
+    }
+    // return empty vnode in case the render function errored out
+    if (!(vnode instanceof VNode)) {
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && Array.isArray(vnode)) {
+        warn(
+          'Multiple root nodes returned from render function. Render function ' +
+          'should return a single root node.',
+          vm
+        );
+      }
+      vnode = createEmptyVNode();
+    }
+    // set parent
+    vnode.parent = _parentVnode;
+    return vnode
+  };
+}
+
+/*  */
+
+var uid$3 = 0;
+
+function initMixin (Vue) {
+  Vue.prototype._init = function (options) {
+    var vm = this;
+    // a uid
+    vm._uid = uid$3++;
+
+    var startTag, endTag;
+    /* istanbul ignore if */
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && config.performance && mark) {
+      startTag = "vue-perf-start:" + (vm._uid);
+      endTag = "vue-perf-end:" + (vm._uid);
+      mark(startTag);
+    }
+
+    // a flag to avoid this being observed
+    vm._isVue = true;
+    // merge options
+    if (options && options._isComponent) {
+      // optimize internal component instantiation
+      // since dynamic options merging is pretty slow, and none of the
+      // internal component options needs special treatment.
+      initInternalComponent(vm, options);
+    } else {
+      vm.$options = mergeOptions(
+        resolveConstructorOptions(vm.constructor),
+        options || {},
+        vm
+      );
+    }
+    /* istanbul ignore else */
+    {
+      initProxy(vm);
+    }
+    // expose real self
+    vm._self = vm;
+    initLifecycle(vm);
+    initEvents(vm);
+    initRender(vm);
+    callHook(vm, 'beforeCreate');
+    initInjections(vm); // resolve injections before data/props
+    initState(vm);
+    initProvide(vm); // resolve provide after data/props
+    callHook(vm, 'created');
+
+    /* istanbul ignore if */
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && config.performance && mark) {
+      vm._name = formatComponentName(vm, false);
+      mark(endTag);
+      measure(("vue " + (vm._name) + " init"), startTag, endTag);
+    }
+
+    if (vm.$options.el) {
+      vm.$mount(vm.$options.el);
+    }
+  };
+}
+
+function initInternalComponent (vm, options) {
+  var opts = vm.$options = Object.create(vm.constructor.options);
+  // doing this because it's faster than dynamic enumeration.
+  var parentVnode = options._parentVnode;
+  opts.parent = options.parent;
+  opts._parentVnode = parentVnode;
+  opts._parentElm = options._parentElm;
+  opts._refElm = options._refElm;
+
+  var vnodeComponentOptions = parentVnode.componentOptions;
+  opts.propsData = vnodeComponentOptions.propsData;
+  opts._parentListeners = vnodeComponentOptions.listeners;
+  opts._renderChildren = vnodeComponentOptions.children;
+  opts._componentTag = vnodeComponentOptions.tag;
+
+  if (options.render) {
+    opts.render = options.render;
+    opts.staticRenderFns = options.staticRenderFns;
+  }
+}
+
+function resolveConstructorOptions (Ctor) {
+  var options = Ctor.options;
+  if (Ctor.super) {
+    var superOptions = resolveConstructorOptions(Ctor.super);
+    var cachedSuperOptions = Ctor.superOptions;
+    if (superOptions !== cachedSuperOptions) {
+      // super option changed,
+      // need to resolve new options.
+      Ctor.superOptions = superOptions;
+      // check if there are any late-modified/attached options (#4976)
+      var modifiedOptions = resolveModifiedOptions(Ctor);
+      // update base extend options
+      if (modifiedOptions) {
+        extend(Ctor.extendOptions, modifiedOptions);
+      }
+      options = Ctor.options = mergeOptions(superOptions, Ctor.extendOptions);
+      if (options.name) {
+        options.components[options.name] = Ctor;
+      }
+    }
+  }
+  return options
+}
+
+function resolveModifiedOptions (Ctor) {
+  var modified;
+  var latest = Ctor.options;
+  var extended = Ctor.extendOptions;
+  var sealed = Ctor.sealedOptions;
+  for (var key in latest) {
+    if (latest[key] !== sealed[key]) {
+      if (!modified) { modified = {}; }
+      modified[key] = dedupe(latest[key], extended[key], sealed[key]);
+    }
+  }
+  return modified
+}
+
+function dedupe (latest, extended, sealed) {
+  // compare latest and sealed to ensure lifecycle hooks won't be duplicated
+  // between merges
+  if (Array.isArray(latest)) {
+    var res = [];
+    sealed = Array.isArray(sealed) ? sealed : [sealed];
+    extended = Array.isArray(extended) ? extended : [extended];
+    for (var i = 0; i < latest.length; i++) {
+      // push original options and not sealed options to exclude duplicated options
+      if (extended.indexOf(latest[i]) >= 0 || sealed.indexOf(latest[i]) < 0) {
+        res.push(latest[i]);
+      }
+    }
+    return res
+  } else {
+    return latest
+  }
+}
+
+function Vue (options) {
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+    !(this instanceof Vue)
+  ) {
+    warn('Vue is a constructor and should be called with the `new` keyword');
+  }
+  this._init(options);
+}
+
+initMixin(Vue);
+stateMixin(Vue);
+eventsMixin(Vue);
+lifecycleMixin(Vue);
+renderMixin(Vue);
+
+/*  */
+
+function initUse (Vue) {
+  Vue.use = function (plugin) {
+    var installedPlugins = (this._installedPlugins || (this._installedPlugins = []));
+    if (installedPlugins.indexOf(plugin) > -1) {
+      return this
+    }
+
+    // additional parameters
+    var args = toArray(arguments, 1);
+    args.unshift(this);
+    if (typeof plugin.install === 'function') {
+      plugin.install.apply(plugin, args);
+    } else if (typeof plugin === 'function') {
+      plugin.apply(null, args);
+    }
+    installedPlugins.push(plugin);
+    return this
+  };
+}
+
+/*  */
+
+function initMixin$1 (Vue) {
+  Vue.mixin = function (mixin) {
+    this.options = mergeOptions(this.options, mixin);
+    return this
+  };
+}
+
+/*  */
+
+function initExtend (Vue) {
+  /**
+   * Each instance constructor, including Vue, has a unique
+   * cid. This enables us to create wrapped "child
+   * constructors" for prototypal inheritance and cache them.
+   */
+  Vue.cid = 0;
+  var cid = 1;
+
+  /**
+   * Class inheritance
+   */
+  Vue.extend = function (extendOptions) {
+    extendOptions = extendOptions || {};
+    var Super = this;
+    var SuperId = Super.cid;
+    var cachedCtors = extendOptions._Ctor || (extendOptions._Ctor = {});
+    if (cachedCtors[SuperId]) {
+      return cachedCtors[SuperId]
+    }
+
+    var name = extendOptions.name || Super.options.name;
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && name) {
+      validateComponentName(name);
+    }
+
+    var Sub = function VueComponent (options) {
+      this._init(options);
+    };
+    Sub.prototype = Object.create(Super.prototype);
+    Sub.prototype.constructor = Sub;
+    Sub.cid = cid++;
+    Sub.options = mergeOptions(
+      Super.options,
+      extendOptions
+    );
+    Sub['super'] = Super;
+
+    // For props and computed properties, we define the proxy getters on
+    // the Vue instances at extension time, on the extended prototype. This
+    // avoids Object.defineProperty calls for each instance created.
+    if (Sub.options.props) {
+      initProps$1(Sub);
+    }
+    if (Sub.options.computed) {
+      initComputed$1(Sub);
+    }
+
+    // allow further extension/mixin/plugin usage
+    Sub.extend = Super.extend;
+    Sub.mixin = Super.mixin;
+    Sub.use = Super.use;
+
+    // create asset registers, so extended classes
+    // can have their private assets too.
+    ASSET_TYPES.forEach(function (type) {
+      Sub[type] = Super[type];
+    });
+    // enable recursive self-lookup
+    if (name) {
+      Sub.options.components[name] = Sub;
+    }
+
+    // keep a reference to the super options at extension time.
+    // later at instantiation we can check if Super's options have
+    // been updated.
+    Sub.superOptions = Super.options;
+    Sub.extendOptions = extendOptions;
+    Sub.sealedOptions = extend({}, Sub.options);
+
+    // cache constructor
+    cachedCtors[SuperId] = Sub;
+    return Sub
+  };
+}
+
+function initProps$1 (Comp) {
+  var props = Comp.options.props;
+  for (var key in props) {
+    proxy(Comp.prototype, "_props", key);
+  }
+}
+
+function initComputed$1 (Comp) {
+  var computed = Comp.options.computed;
+  for (var key in computed) {
+    defineComputed(Comp.prototype, key, computed[key]);
+  }
+}
+
+/*  */
+
+function initAssetRegisters (Vue) {
+  /**
+   * Create asset registration methods.
+   */
+  ASSET_TYPES.forEach(function (type) {
+    Vue[type] = function (
+      id,
+      definition
+    ) {
+      if (!definition) {
+        return this.options[type + 's'][id]
+      } else {
+        /* istanbul ignore if */
+        if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && type === 'component') {
+          validateComponentName(id);
+        }
+        if (type === 'component' && isPlainObject(definition)) {
+          definition.name = definition.name || id;
+          definition = this.options._base.extend(definition);
+        }
+        if (type === 'directive' && typeof definition === 'function') {
+          definition = { bind: definition, update: definition };
+        }
+        this.options[type + 's'][id] = definition;
+        return definition
+      }
+    };
+  });
+}
+
+/*  */
+
+function getComponentName (opts) {
+  return opts && (opts.Ctor.options.name || opts.tag)
+}
+
+function matches (pattern, name) {
+  if (Array.isArray(pattern)) {
+    return pattern.indexOf(name) > -1
+  } else if (typeof pattern === 'string') {
+    return pattern.split(',').indexOf(name) > -1
+  } else if (isRegExp(pattern)) {
+    return pattern.test(name)
+  }
+  /* istanbul ignore next */
+  return false
+}
+
+function pruneCache (keepAliveInstance, filter) {
+  var cache = keepAliveInstance.cache;
+  var keys = keepAliveInstance.keys;
+  var _vnode = keepAliveInstance._vnode;
+  for (var key in cache) {
+    var cachedNode = cache[key];
+    if (cachedNode) {
+      var name = getComponentName(cachedNode.componentOptions);
+      if (name && !filter(name)) {
+        pruneCacheEntry(cache, key, keys, _vnode);
+      }
+    }
+  }
+}
+
+function pruneCacheEntry (
+  cache,
+  key,
+  keys,
+  current
+) {
+  var cached$$1 = cache[key];
+  if (cached$$1 && (!current || cached$$1.tag !== current.tag)) {
+    cached$$1.componentInstance.$destroy();
+  }
+  cache[key] = null;
+  remove(keys, key);
+}
+
+var patternTypes = [String, RegExp, Array];
+
+var KeepAlive = {
+  name: 'keep-alive',
+  abstract: true,
+
+  props: {
+    include: patternTypes,
+    exclude: patternTypes,
+    max: [String, Number]
+  },
+
+  created: function created () {
+    this.cache = Object.create(null);
+    this.keys = [];
+  },
+
+  destroyed: function destroyed () {
+    var this$1 = this;
+
+    for (var key in this$1.cache) {
+      pruneCacheEntry(this$1.cache, key, this$1.keys);
+    }
+  },
+
+  mounted: function mounted () {
+    var this$1 = this;
+
+    this.$watch('include', function (val) {
+      pruneCache(this$1, function (name) { return matches(val, name); });
+    });
+    this.$watch('exclude', function (val) {
+      pruneCache(this$1, function (name) { return !matches(val, name); });
+    });
+  },
+
+  render: function render () {
+    var slot = this.$slots.default;
+    var vnode = getFirstComponentChild(slot);
+    var componentOptions = vnode && vnode.componentOptions;
+    if (componentOptions) {
+      // check pattern
+      var name = getComponentName(componentOptions);
+      var ref = this;
+      var include = ref.include;
+      var exclude = ref.exclude;
+      if (
+        // not included
+        (include && (!name || !matches(include, name))) ||
+        // excluded
+        (exclude && name && matches(exclude, name))
+      ) {
+        return vnode
+      }
+
+      var ref$1 = this;
+      var cache = ref$1.cache;
+      var keys = ref$1.keys;
+      var key = vnode.key == null
+        // same constructor may get registered as different local components
+        // so cid alone is not enough (#3269)
+        ? componentOptions.Ctor.cid + (componentOptions.tag ? ("::" + (componentOptions.tag)) : '')
+        : vnode.key;
+      if (cache[key]) {
+        vnode.componentInstance = cache[key].componentInstance;
+        // make current key freshest
+        remove(keys, key);
+        keys.push(key);
+      } else {
+        cache[key] = vnode;
+        keys.push(key);
+        // prune oldest entry
+        if (this.max && keys.length > parseInt(this.max)) {
+          pruneCacheEntry(cache, keys[0], keys, this._vnode);
+        }
+      }
+
+      vnode.data.keepAlive = true;
+    }
+    return vnode || (slot && slot[0])
+  }
+}
+
+var builtInComponents = {
+  KeepAlive: KeepAlive
+}
+
+/*  */
+
+function initGlobalAPI (Vue) {
+  // config
+  var configDef = {};
+  configDef.get = function () { return config; };
+  {
+    configDef.set = function () {
+      warn(
+        'Do not replace the Vue.config object, set individual fields instead.'
+      );
+    };
+  }
+  Object.defineProperty(Vue, 'config', configDef);
+
+  // exposed util methods.
+  // NOTE: these are not considered part of the public API - avoid relying on
+  // them unless you are aware of the risk.
+  Vue.util = {
+    warn: warn,
+    extend: extend,
+    mergeOptions: mergeOptions,
+    defineReactive: defineReactive
+  };
+
+  Vue.set = set;
+  Vue.delete = del;
+  Vue.nextTick = nextTick;
+
+  Vue.options = Object.create(null);
+  ASSET_TYPES.forEach(function (type) {
+    Vue.options[type + 's'] = Object.create(null);
+  });
+
+  // this is used to identify the "base" constructor to extend all plain-object
+  // components with in Weex's multi-instance scenarios.
+  Vue.options._base = Vue;
+
+  extend(Vue.options.components, builtInComponents);
+
+  initUse(Vue);
+  initMixin$1(Vue);
+  initExtend(Vue);
+  initAssetRegisters(Vue);
+}
+
+initGlobalAPI(Vue);
+
+Object.defineProperty(Vue.prototype, '$isServer', {
+  get: isServerRendering
+});
+
+Object.defineProperty(Vue.prototype, '$ssrContext', {
+  get: function get () {
+    /* istanbul ignore next */
+    return this.$vnode && this.$vnode.ssrContext
+  }
+});
+
+// expose FunctionalRenderContext for ssr runtime helper installation
+Object.defineProperty(Vue, 'FunctionalRenderContext', {
+  value: FunctionalRenderContext
+});
+
+Vue.version = '2.5.17';
+
+/*  */
+
+// these are reserved for web because they are directly compiled away
+// during template compilation
+var isReservedAttr = makeMap('style,class');
+
+// attributes that should be using props for binding
+var acceptValue = makeMap('input,textarea,option,select,progress');
+var mustUseProp = function (tag, type, attr) {
+  return (
+    (attr === 'value' && acceptValue(tag)) && type !== 'button' ||
+    (attr === 'selected' && tag === 'option') ||
+    (attr === 'checked' && tag === 'input') ||
+    (attr === 'muted' && tag === 'video')
+  )
+};
+
+var isEnumeratedAttr = makeMap('contenteditable,draggable,spellcheck');
+
+var isBooleanAttr = makeMap(
+  'allowfullscreen,async,autofocus,autoplay,checked,compact,controls,declare,' +
+  'default,defaultchecked,defaultmuted,defaultselected,defer,disabled,' +
+  'enabled,formnovalidate,hidden,indeterminate,inert,ismap,itemscope,loop,multiple,' +
+  'muted,nohref,noresize,noshade,novalidate,nowrap,open,pauseonexit,readonly,' +
+  'required,reversed,scoped,seamless,selected,sortable,translate,' +
+  'truespeed,typemustmatch,visible'
+);
+
+var xlinkNS = 'http://www.w3.org/1999/xlink';
+
+var isXlink = function (name) {
+  return name.charAt(5) === ':' && name.slice(0, 5) === 'xlink'
+};
+
+var getXlinkProp = function (name) {
+  return isXlink(name) ? name.slice(6, name.length) : ''
+};
+
+var isFalsyAttrValue = function (val) {
+  return val == null || val === false
+};
+
+/*  */
+
+function genClassForVnode (vnode) {
+  var data = vnode.data;
+  var parentNode = vnode;
+  var childNode = vnode;
+  while (isDef(childNode.componentInstance)) {
+    childNode = childNode.componentInstance._vnode;
+    if (childNode && childNode.data) {
+      data = mergeClassData(childNode.data, data);
+    }
+  }
+  while (isDef(parentNode = parentNode.parent)) {
+    if (parentNode && parentNode.data) {
+      data = mergeClassData(data, parentNode.data);
+    }
+  }
+  return renderClass(data.staticClass, data.class)
+}
+
+function mergeClassData (child, parent) {
+  return {
+    staticClass: concat(child.staticClass, parent.staticClass),
+    class: isDef(child.class)
+      ? [child.class, parent.class]
+      : parent.class
+  }
+}
+
+function renderClass (
+  staticClass,
+  dynamicClass
+) {
+  if (isDef(staticClass) || isDef(dynamicClass)) {
+    return concat(staticClass, stringifyClass(dynamicClass))
+  }
+  /* istanbul ignore next */
+  return ''
+}
+
+function concat (a, b) {
+  return a ? b ? (a + ' ' + b) : a : (b || '')
+}
+
+function stringifyClass (value) {
+  if (Array.isArray(value)) {
+    return stringifyArray(value)
+  }
+  if (isObject(value)) {
+    return stringifyObject(value)
+  }
+  if (typeof value === 'string') {
+    return value
+  }
+  /* istanbul ignore next */
+  return ''
+}
+
+function stringifyArray (value) {
+  var res = '';
+  var stringified;
+  for (var i = 0, l = value.length; i < l; i++) {
+    if (isDef(stringified = stringifyClass(value[i])) && stringified !== '') {
+      if (res) { res += ' '; }
+      res += stringified;
+    }
+  }
+  return res
+}
+
+function stringifyObject (value) {
+  var res = '';
+  for (var key in value) {
+    if (value[key]) {
+      if (res) { res += ' '; }
+      res += key;
+    }
+  }
+  return res
+}
+
+/*  */
+
+var namespaceMap = {
+  svg: 'http://www.w3.org/2000/svg',
+  math: 'http://www.w3.org/1998/Math/MathML'
+};
+
+var isHTMLTag = makeMap(
+  'html,body,base,head,link,meta,style,title,' +
+  'address,article,aside,footer,header,h1,h2,h3,h4,h5,h6,hgroup,nav,section,' +
+  'div,dd,dl,dt,figcaption,figure,picture,hr,img,li,main,ol,p,pre,ul,' +
+  'a,b,abbr,bdi,bdo,br,cite,code,data,dfn,em,i,kbd,mark,q,rp,rt,rtc,ruby,' +
+  's,samp,small,span,strong,sub,sup,time,u,var,wbr,area,audio,map,track,video,' +
+  'embed,object,param,source,canvas,script,noscript,del,ins,' +
+  'caption,col,colgroup,table,thead,tbody,td,th,tr,' +
+  'button,datalist,fieldset,form,input,label,legend,meter,optgroup,option,' +
+  'output,progress,select,textarea,' +
+  'details,dialog,menu,menuitem,summary,' +
+  'content,element,shadow,template,blockquote,iframe,tfoot'
+);
+
+// this map is intentionally selective, only covering SVG elements that may
+// contain child elements.
+var isSVG = makeMap(
+  'svg,animate,circle,clippath,cursor,defs,desc,ellipse,filter,font-face,' +
+  'foreignObject,g,glyph,image,line,marker,mask,missing-glyph,path,pattern,' +
+  'polygon,polyline,rect,switch,symbol,text,textpath,tspan,use,view',
+  true
+);
+
+var isPreTag = function (tag) { return tag === 'pre'; };
+
+var isReservedTag = function (tag) {
+  return isHTMLTag(tag) || isSVG(tag)
+};
+
+function getTagNamespace (tag) {
+  if (isSVG(tag)) {
+    return 'svg'
+  }
+  // basic support for MathML
+  // note it doesn't support other MathML elements being component roots
+  if (tag === 'math') {
+    return 'math'
+  }
+}
+
+var unknownElementCache = Object.create(null);
+function isUnknownElement (tag) {
+  /* istanbul ignore if */
+  if (!inBrowser) {
+    return true
+  }
+  if (isReservedTag(tag)) {
+    return false
+  }
+  tag = tag.toLowerCase();
+  /* istanbul ignore if */
+  if (unknownElementCache[tag] != null) {
+    return unknownElementCache[tag]
+  }
+  var el = document.createElement(tag);
+  if (tag.indexOf('-') > -1) {
+    // http://stackoverflow.com/a/28210364/1070244
+    return (unknownElementCache[tag] = (
+      el.constructor === window.HTMLUnknownElement ||
+      el.constructor === window.HTMLElement
+    ))
+  } else {
+    return (unknownElementCache[tag] = /HTMLUnknownElement/.test(el.toString()))
+  }
+}
+
+var isTextInputType = makeMap('text,number,password,search,email,tel,url');
+
+/*  */
+
+/**
+ * Query an element selector if it's not an element already.
+ */
+function query (el) {
+  if (typeof el === 'string') {
+    var selected = document.querySelector(el);
+    if (!selected) {
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+        'Cannot find element: ' + el
+      );
+      return document.createElement('div')
+    }
+    return selected
+  } else {
+    return el
+  }
+}
+
+/*  */
+
+function createElement$1 (tagName, vnode) {
+  var elm = document.createElement(tagName);
+  if (tagName !== 'select') {
+    return elm
+  }
+  // false or null will remove the attribute but undefined will not
+  if (vnode.data && vnode.data.attrs && vnode.data.attrs.multiple !== undefined) {
+    elm.setAttribute('multiple', 'multiple');
+  }
+  return elm
+}
+
+function createElementNS (namespace, tagName) {
+  return document.createElementNS(namespaceMap[namespace], tagName)
+}
+
+function createTextNode (text) {
+  return document.createTextNode(text)
+}
+
+function createComment (text) {
+  return document.createComment(text)
+}
+
+function insertBefore (parentNode, newNode, referenceNode) {
+  parentNode.insertBefore(newNode, referenceNode);
+}
+
+function removeChild (node, child) {
+  node.removeChild(child);
+}
+
+function appendChild (node, child) {
+  node.appendChild(child);
+}
+
+function parentNode (node) {
+  return node.parentNode
+}
+
+function nextSibling (node) {
+  return node.nextSibling
+}
+
+function tagName (node) {
+  return node.tagName
+}
+
+function setTextContent (node, text) {
+  node.textContent = text;
+}
+
+function setStyleScope (node, scopeId) {
+  node.setAttribute(scopeId, '');
+}
+
+
+var nodeOps = Object.freeze({
+  createElement: createElement$1,
+  createElementNS: createElementNS,
+  createTextNode: createTextNode,
+  createComment: createComment,
+  insertBefore: insertBefore,
+  removeChild: removeChild,
+  appendChild: appendChild,
+  parentNode: parentNode,
+  nextSibling: nextSibling,
+  tagName: tagName,
+  setTextContent: setTextContent,
+  setStyleScope: setStyleScope
+});
+
+/*  */
+
+var ref = {
+  create: function create (_, vnode) {
+    registerRef(vnode);
+  },
+  update: function update (oldVnode, vnode) {
+    if (oldVnode.data.ref !== vnode.data.ref) {
+      registerRef(oldVnode, true);
+      registerRef(vnode);
+    }
+  },
+  destroy: function destroy (vnode) {
+    registerRef(vnode, true);
+  }
+}
+
+function registerRef (vnode, isRemoval) {
+  var key = vnode.data.ref;
+  if (!isDef(key)) { return }
+
+  var vm = vnode.context;
+  var ref = vnode.componentInstance || vnode.elm;
+  var refs = vm.$refs;
+  if (isRemoval) {
+    if (Array.isArray(refs[key])) {
+      remove(refs[key], ref);
+    } else if (refs[key] === ref) {
+      refs[key] = undefined;
+    }
+  } else {
+    if (vnode.data.refInFor) {
+      if (!Array.isArray(refs[key])) {
+        refs[key] = [ref];
+      } else if (refs[key].indexOf(ref) < 0) {
+        // $flow-disable-line
+        refs[key].push(ref);
+      }
+    } else {
+      refs[key] = ref;
+    }
+  }
+}
+
+/**
+ * Virtual DOM patching algorithm based on Snabbdom by
+ * Simon Friis Vindum (@paldepind)
+ * Licensed under the MIT License
+ * https://github.com/paldepind/snabbdom/blob/master/LICENSE
+ *
+ * modified by Evan You (@yyx990803)
+ *
+ * Not type-checking this because this file is perf-critical and the cost
+ * of making flow understand it is not worth it.
+ */
+
+var emptyNode = new VNode('', {}, []);
+
+var hooks = ['create', 'activate', 'update', 'remove', 'destroy'];
+
+function sameVnode (a, b) {
+  return (
+    a.key === b.key && (
+      (
+        a.tag === b.tag &&
+        a.isComment === b.isComment &&
+        isDef(a.data) === isDef(b.data) &&
+        sameInputType(a, b)
+      ) || (
+        isTrue(a.isAsyncPlaceholder) &&
+        a.asyncFactory === b.asyncFactory &&
+        isUndef(b.asyncFactory.error)
+      )
+    )
+  )
+}
+
+function sameInputType (a, b) {
+  if (a.tag !== 'input') { return true }
+  var i;
+  var typeA = isDef(i = a.data) && isDef(i = i.attrs) && i.type;
+  var typeB = isDef(i = b.data) && isDef(i = i.attrs) && i.type;
+  return typeA === typeB || isTextInputType(typeA) && isTextInputType(typeB)
+}
+
+function createKeyToOldIdx (children, beginIdx, endIdx) {
+  var i, key;
+  var map = {};
+  for (i = beginIdx; i <= endIdx; ++i) {
+    key = children[i].key;
+    if (isDef(key)) { map[key] = i; }
+  }
+  return map
+}
+
+function createPatchFunction (backend) {
+  var i, j;
+  var cbs = {};
+
+  var modules = backend.modules;
+  var nodeOps = backend.nodeOps;
+
+  for (i = 0; i < hooks.length; ++i) {
+    cbs[hooks[i]] = [];
+    for (j = 0; j < modules.length; ++j) {
+      if (isDef(modules[j][hooks[i]])) {
+        cbs[hooks[i]].push(modules[j][hooks[i]]);
+      }
+    }
+  }
+
+  function emptyNodeAt (elm) {
+    return new VNode(nodeOps.tagName(elm).toLowerCase(), {}, [], undefined, elm)
+  }
+
+  function createRmCb (childElm, listeners) {
+    function remove () {
+      if (--remove.listeners === 0) {
+        removeNode(childElm);
+      }
+    }
+    remove.listeners = listeners;
+    return remove
+  }
+
+  function removeNode (el) {
+    var parent = nodeOps.parentNode(el);
+    // element may have already been removed due to v-html / v-text
+    if (isDef(parent)) {
+      nodeOps.removeChild(parent, el);
+    }
+  }
+
+  function isUnknownElement$$1 (vnode, inVPre) {
+    return (
+      !inVPre &&
+      !vnode.ns &&
+      !(
+        config.ignoredElements.length &&
+        config.ignoredElements.some(function (ignore) {
+          return isRegExp(ignore)
+            ? ignore.test(vnode.tag)
+            : ignore === vnode.tag
+        })
+      ) &&
+      config.isUnknownElement(vnode.tag)
+    )
+  }
+
+  var creatingElmInVPre = 0;
+
+  function createElm (
+    vnode,
+    insertedVnodeQueue,
+    parentElm,
+    refElm,
+    nested,
+    ownerArray,
+    index
+  ) {
+    if (isDef(vnode.elm) && isDef(ownerArray)) {
+      // This vnode was used in a previous render!
+      // now it's used as a new node, overwriting its elm would cause
+      // potential patch errors down the road when it's used as an insertion
+      // reference node. Instead, we clone the node on-demand before creating
+      // associated DOM element for it.
+      vnode = ownerArray[index] = cloneVNode(vnode);
+    }
+
+    vnode.isRootInsert = !nested; // for transition enter check
+    if (createComponent(vnode, insertedVnodeQueue, parentElm, refElm)) {
+      return
+    }
+
+    var data = vnode.data;
+    var children = vnode.children;
+    var tag = vnode.tag;
+    if (isDef(tag)) {
+      {
+        if (data && data.pre) {
+          creatingElmInVPre++;
+        }
+        if (isUnknownElement$$1(vnode, creatingElmInVPre)) {
+          warn(
+            'Unknown custom element: <' + tag + '> - did you ' +
+            'register the component correctly? For recursive components, ' +
+            'make sure to provide the "name" option.',
+            vnode.context
+          );
+        }
+      }
+
+      vnode.elm = vnode.ns
+        ? nodeOps.createElementNS(vnode.ns, tag)
+        : nodeOps.createElement(tag, vnode);
+      setScope(vnode);
+
+      /* istanbul ignore if */
+      {
+        createChildren(vnode, children, insertedVnodeQueue);
+        if (isDef(data)) {
+          invokeCreateHooks(vnode, insertedVnodeQueue);
+        }
+        insert(parentElm, vnode.elm, refElm);
+      }
+
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && data && data.pre) {
+        creatingElmInVPre--;
+      }
+    } else if (isTrue(vnode.isComment)) {
+      vnode.elm = nodeOps.createComment(vnode.text);
+      insert(parentElm, vnode.elm, refElm);
+    } else {
+      vnode.elm = nodeOps.createTextNode(vnode.text);
+      insert(parentElm, vnode.elm, refElm);
+    }
+  }
+
+  function createComponent (vnode, insertedVnodeQueue, parentElm, refElm) {
+    var i = vnode.data;
+    if (isDef(i)) {
+      var isReactivated = isDef(vnode.componentInstance) && i.keepAlive;
+      if (isDef(i = i.hook) && isDef(i = i.init)) {
+        i(vnode, false /* hydrating */, parentElm, refElm);
+      }
+      // after calling the init hook, if the vnode is a child component
+      // it should've created a child instance and mounted it. the child
+      // component also has set the placeholder vnode's elm.
+      // in that case we can just return the element and be done.
+      if (isDef(vnode.componentInstance)) {
+        initComponent(vnode, insertedVnodeQueue);
+        if (isTrue(isReactivated)) {
+          reactivateComponent(vnode, insertedVnodeQueue, parentElm, refElm);
+        }
+        return true
+      }
+    }
+  }
+
+  function initComponent (vnode, insertedVnodeQueue) {
+    if (isDef(vnode.data.pendingInsert)) {
+      insertedVnodeQueue.push.apply(insertedVnodeQueue, vnode.data.pendingInsert);
+      vnode.data.pendingInsert = null;
+    }
+    vnode.elm = vnode.componentInstance.$el;
+    if (isPatchable(vnode)) {
+      invokeCreateHooks(vnode, insertedVnodeQueue);
+      setScope(vnode);
+    } else {
+      // empty component root.
+      // skip all element-related modules except for ref (#3455)
+      registerRef(vnode);
+      // make sure to invoke the insert hook
+      insertedVnodeQueue.push(vnode);
+    }
+  }
+
+  function reactivateComponent (vnode, insertedVnodeQueue, parentElm, refElm) {
+    var i;
+    // hack for #4339: a reactivated component with inner transition
+    // does not trigger because the inner node's created hooks are not called
+    // again. It's not ideal to involve module-specific logic in here but
+    // there doesn't seem to be a better way to do it.
+    var innerNode = vnode;
+    while (innerNode.componentInstance) {
+      innerNode = innerNode.componentInstance._vnode;
+      if (isDef(i = innerNode.data) && isDef(i = i.transition)) {
+        for (i = 0; i < cbs.activate.length; ++i) {
+          cbs.activate[i](emptyNode, innerNode);
+        }
+        insertedVnodeQueue.push(innerNode);
+        break
+      }
+    }
+    // unlike a newly created component,
+    // a reactivated keep-alive component doesn't insert itself
+    insert(parentElm, vnode.elm, refElm);
+  }
+
+  function insert (parent, elm, ref$$1) {
+    if (isDef(parent)) {
+      if (isDef(ref$$1)) {
+        if (ref$$1.parentNode === parent) {
+          nodeOps.insertBefore(parent, elm, ref$$1);
+        }
+      } else {
+        nodeOps.appendChild(parent, elm);
+      }
+    }
+  }
+
+  function createChildren (vnode, children, insertedVnodeQueue) {
+    if (Array.isArray(children)) {
+      {
+        checkDuplicateKeys(children);
+      }
+      for (var i = 0; i < children.length; ++i) {
+        createElm(children[i], insertedVnodeQueue, vnode.elm, null, true, children, i);
+      }
+    } else if (isPrimitive(vnode.text)) {
+      nodeOps.appendChild(vnode.elm, nodeOps.createTextNode(String(vnode.text)));
+    }
+  }
+
+  function isPatchable (vnode) {
+    while (vnode.componentInstance) {
+      vnode = vnode.componentInstance._vnode;
+    }
+    return isDef(vnode.tag)
+  }
+
+  function invokeCreateHooks (vnode, insertedVnodeQueue) {
+    for (var i$1 = 0; i$1 < cbs.create.length; ++i$1) {
+      cbs.create[i$1](emptyNode, vnode);
+    }
+    i = vnode.data.hook; // Reuse variable
+    if (isDef(i)) {
+      if (isDef(i.create)) { i.create(emptyNode, vnode); }
+      if (isDef(i.insert)) { insertedVnodeQueue.push(vnode); }
+    }
+  }
+
+  // set scope id attribute for scoped CSS.
+  // this is implemented as a special case to avoid the overhead
+  // of going through the normal attribute patching process.
+  function setScope (vnode) {
+    var i;
+    if (isDef(i = vnode.fnScopeId)) {
+      nodeOps.setStyleScope(vnode.elm, i);
+    } else {
+      var ancestor = vnode;
+      while (ancestor) {
+        if (isDef(i = ancestor.context) && isDef(i = i.$options._scopeId)) {
+          nodeOps.setStyleScope(vnode.elm, i);
+        }
+        ancestor = ancestor.parent;
+      }
+    }
+    // for slot content they should also get the scopeId from the host instance.
+    if (isDef(i = activeInstance) &&
+      i !== vnode.context &&
+      i !== vnode.fnContext &&
+      isDef(i = i.$options._scopeId)
+    ) {
+      nodeOps.setStyleScope(vnode.elm, i);
+    }
+  }
+
+  function addVnodes (parentElm, refElm, vnodes, startIdx, endIdx, insertedVnodeQueue) {
+    for (; startIdx <= endIdx; ++startIdx) {
+      createElm(vnodes[startIdx], insertedVnodeQueue, parentElm, refElm, false, vnodes, startIdx);
+    }
+  }
+
+  function invokeDestroyHook (vnode) {
+    var i, j;
+    var data = vnode.data;
+    if (isDef(data)) {
+      if (isDef(i = data.hook) && isDef(i = i.destroy)) { i(vnode); }
+      for (i = 0; i < cbs.destroy.length; ++i) { cbs.destroy[i](vnode); }
+    }
+    if (isDef(i = vnode.children)) {
+      for (j = 0; j < vnode.children.length; ++j) {
+        invokeDestroyHook(vnode.children[j]);
+      }
+    }
+  }
+
+  function removeVnodes (parentElm, vnodes, startIdx, endIdx) {
+    for (; startIdx <= endIdx; ++startIdx) {
+      var ch = vnodes[startIdx];
+      if (isDef(ch)) {
+        if (isDef(ch.tag)) {
+          removeAndInvokeRemoveHook(ch);
+          invokeDestroyHook(ch);
+        } else { // Text node
+          removeNode(ch.elm);
+        }
+      }
+    }
+  }
+
+  function removeAndInvokeRemoveHook (vnode, rm) {
+    if (isDef(rm) || isDef(vnode.data)) {
+      var i;
+      var listeners = cbs.remove.length + 1;
+      if (isDef(rm)) {
+        // we have a recursively passed down rm callback
+        // increase the listeners count
+        rm.listeners += listeners;
+      } else {
+        // directly removing
+        rm = createRmCb(vnode.elm, listeners);
+      }
+      // recursively invoke hooks on child component root node
+      if (isDef(i = vnode.componentInstance) && isDef(i = i._vnode) && isDef(i.data)) {
+        removeAndInvokeRemoveHook(i, rm);
+      }
+      for (i = 0; i < cbs.remove.length; ++i) {
+        cbs.remove[i](vnode, rm);
+      }
+      if (isDef(i = vnode.data.hook) && isDef(i = i.remove)) {
+        i(vnode, rm);
+      } else {
+        rm();
+      }
+    } else {
+      removeNode(vnode.elm);
+    }
+  }
+
+  function updateChildren (parentElm, oldCh, newCh, insertedVnodeQueue, removeOnly) {
+    var oldStartIdx = 0;
+    var newStartIdx = 0;
+    var oldEndIdx = oldCh.length - 1;
+    var oldStartVnode = oldCh[0];
+    var oldEndVnode = oldCh[oldEndIdx];
+    var newEndIdx = newCh.length - 1;
+    var newStartVnode = newCh[0];
+    var newEndVnode = newCh[newEndIdx];
+    var oldKeyToIdx, idxInOld, vnodeToMove, refElm;
+
+    // removeOnly is a special flag used only by <transition-group>
+    // to ensure removed elements stay in correct relative positions
+    // during leaving transitions
+    var canMove = !removeOnly;
+
+    {
+      checkDuplicateKeys(newCh);
+    }
+
+    while (oldStartIdx <= oldEndIdx && newStartIdx <= newEndIdx) {
+      if (isUndef(oldStartVnode)) {
+        oldStartVnode = oldCh[++oldStartIdx]; // Vnode has been moved left
+      } else if (isUndef(oldEndVnode)) {
+        oldEndVnode = oldCh[--oldEndIdx];
+      } else if (sameVnode(oldStartVnode, newStartVnode)) {
+        patchVnode(oldStartVnode, newStartVnode, insertedVnodeQueue);
+        oldStartVnode = oldCh[++oldStartIdx];
+        newStartVnode = newCh[++newStartIdx];
+      } else if (sameVnode(oldEndVnode, newEndVnode)) {
+        patchVnode(oldEndVnode, newEndVnode, insertedVnodeQueue);
+        oldEndVnode = oldCh[--oldEndIdx];
+        newEndVnode = newCh[--newEndIdx];
+      } else if (sameVnode(oldStartVnode, newEndVnode)) { // Vnode moved right
+        patchVnode(oldStartVnode, newEndVnode, insertedVnodeQueue);
+        canMove && nodeOps.insertBefore(parentElm, oldStartVnode.elm, nodeOps.nextSibling(oldEndVnode.elm));
+        oldStartVnode = oldCh[++oldStartIdx];
+        newEndVnode = newCh[--newEndIdx];
+      } else if (sameVnode(oldEndVnode, newStartVnode)) { // Vnode moved left
+        patchVnode(oldEndVnode, newStartVnode, insertedVnodeQueue);
+        canMove && nodeOps.insertBefore(parentElm, oldEndVnode.elm, oldStartVnode.elm);
+        oldEndVnode = oldCh[--oldEndIdx];
+        newStartVnode = newCh[++newStartIdx];
+      } else {
+        if (isUndef(oldKeyToIdx)) { oldKeyToIdx = createKeyToOldIdx(oldCh, oldStartIdx, oldEndIdx); }
+        idxInOld = isDef(newStartVnode.key)
+          ? oldKeyToIdx[newStartVnode.key]
+          : findIdxInOld(newStartVnode, oldCh, oldStartIdx, oldEndIdx);
+        if (isUndef(idxInOld)) { // New element
+          createElm(newStartVnode, insertedVnodeQueue, parentElm, oldStartVnode.elm, false, newCh, newStartIdx);
+        } else {
+          vnodeToMove = oldCh[idxInOld];
+          if (sameVnode(vnodeToMove, newStartVnode)) {
+            patchVnode(vnodeToMove, newStartVnode, insertedVnodeQueue);
+            oldCh[idxInOld] = undefined;
+            canMove && nodeOps.insertBefore(parentElm, vnodeToMove.elm, oldStartVnode.elm);
+          } else {
+            // same key but different element. treat as new element
+            createElm(newStartVnode, insertedVnodeQueue, parentElm, oldStartVnode.elm, false, newCh, newStartIdx);
+          }
+        }
+        newStartVnode = newCh[++newStartIdx];
+      }
+    }
+    if (oldStartIdx > oldEndIdx) {
+      refElm = isUndef(newCh[newEndIdx + 1]) ? null : newCh[newEndIdx + 1].elm;
+      addVnodes(parentElm, refElm, newCh, newStartIdx, newEndIdx, insertedVnodeQueue);
+    } else if (newStartIdx > newEndIdx) {
+      removeVnodes(parentElm, oldCh, oldStartIdx, oldEndIdx);
+    }
+  }
+
+  function checkDuplicateKeys (children) {
+    var seenKeys = {};
+    for (var i = 0; i < children.length; i++) {
+      var vnode = children[i];
+      var key = vnode.key;
+      if (isDef(key)) {
+        if (seenKeys[key]) {
+          warn(
+            ("Duplicate keys detected: '" + key + "'. This may cause an update error."),
+            vnode.context
+          );
+        } else {
+          seenKeys[key] = true;
+        }
+      }
+    }
+  }
+
+  function findIdxInOld (node, oldCh, start, end) {
+    for (var i = start; i < end; i++) {
+      var c = oldCh[i];
+      if (isDef(c) && sameVnode(node, c)) { return i }
+    }
+  }
+
+  function patchVnode (oldVnode, vnode, insertedVnodeQueue, removeOnly) {
+    if (oldVnode === vnode) {
+      return
+    }
+
+    var elm = vnode.elm = oldVnode.elm;
+
+    if (isTrue(oldVnode.isAsyncPlaceholder)) {
+      if (isDef(vnode.asyncFactory.resolved)) {
+        hydrate(oldVnode.elm, vnode, insertedVnodeQueue);
+      } else {
+        vnode.isAsyncPlaceholder = true;
+      }
+      return
+    }
+
+    // reuse element for static trees.
+    // note we only do this if the vnode is cloned -
+    // if the new node is not cloned it means the render functions have been
+    // reset by the hot-reload-api and we need to do a proper re-render.
+    if (isTrue(vnode.isStatic) &&
+      isTrue(oldVnode.isStatic) &&
+      vnode.key === oldVnode.key &&
+      (isTrue(vnode.isCloned) || isTrue(vnode.isOnce))
+    ) {
+      vnode.componentInstance = oldVnode.componentInstance;
+      return
+    }
+
+    var i;
+    var data = vnode.data;
+    if (isDef(data) && isDef(i = data.hook) && isDef(i = i.prepatch)) {
+      i(oldVnode, vnode);
+    }
+
+    var oldCh = oldVnode.children;
+    var ch = vnode.children;
+    if (isDef(data) && isPatchable(vnode)) {
+      for (i = 0; i < cbs.update.length; ++i) { cbs.update[i](oldVnode, vnode); }
+      if (isDef(i = data.hook) && isDef(i = i.update)) { i(oldVnode, vnode); }
+    }
+    if (isUndef(vnode.text)) {
+      if (isDef(oldCh) && isDef(ch)) {
+        if (oldCh !== ch) { updateChildren(elm, oldCh, ch, insertedVnodeQueue, removeOnly); }
+      } else if (isDef(ch)) {
+        if (isDef(oldVnode.text)) { nodeOps.setTextContent(elm, ''); }
+        addVnodes(elm, null, ch, 0, ch.length - 1, insertedVnodeQueue);
+      } else if (isDef(oldCh)) {
+        removeVnodes(elm, oldCh, 0, oldCh.length - 1);
+      } else if (isDef(oldVnode.text)) {
+        nodeOps.setTextContent(elm, '');
+      }
+    } else if (oldVnode.text !== vnode.text) {
+      nodeOps.setTextContent(elm, vnode.text);
+    }
+    if (isDef(data)) {
+      if (isDef(i = data.hook) && isDef(i = i.postpatch)) { i(oldVnode, vnode); }
+    }
+  }
+
+  function invokeInsertHook (vnode, queue, initial) {
+    // delay insert hooks for component root nodes, invoke them after the
+    // element is really inserted
+    if (isTrue(initial) && isDef(vnode.parent)) {
+      vnode.parent.data.pendingInsert = queue;
+    } else {
+      for (var i = 0; i < queue.length; ++i) {
+        queue[i].data.hook.insert(queue[i]);
+      }
+    }
+  }
+
+  var hydrationBailed = false;
+  // list of modules that can skip create hook during hydration because they
+  // are already rendered on the client or has no need for initialization
+  // Note: style is excluded because it relies on initial clone for future
+  // deep updates (#7063).
+  var isRenderedModule = makeMap('attrs,class,staticClass,staticStyle,key');
+
+  // Note: this is a browser-only function so we can assume elms are DOM nodes.
+  function hydrate (elm, vnode, insertedVnodeQueue, inVPre) {
+    var i;
+    var tag = vnode.tag;
+    var data = vnode.data;
+    var children = vnode.children;
+    inVPre = inVPre || (data && data.pre);
+    vnode.elm = elm;
+
+    if (isTrue(vnode.isComment) && isDef(vnode.asyncFactory)) {
+      vnode.isAsyncPlaceholder = true;
+      return true
+    }
+    // assert node match
+    {
+      if (!assertNodeMatch(elm, vnode, inVPre)) {
+        return false
+      }
+    }
+    if (isDef(data)) {
+      if (isDef(i = data.hook) && isDef(i = i.init)) { i(vnode, true /* hydrating */); }
+      if (isDef(i = vnode.componentInstance)) {
+        // child component. it should have hydrated its own tree.
+        initComponent(vnode, insertedVnodeQueue);
+        return true
+      }
+    }
+    if (isDef(tag)) {
+      if (isDef(children)) {
+        // empty element, allow client to pick up and populate children
+        if (!elm.hasChildNodes()) {
+          createChildren(vnode, children, insertedVnodeQueue);
+        } else {
+          // v-html and domProps: innerHTML
+          if (isDef(i = data) && isDef(i = i.domProps) && isDef(i = i.innerHTML)) {
+            if (i !== elm.innerHTML) {
+              /* istanbul ignore if */
+              if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+                typeof console !== 'undefined' &&
+                !hydrationBailed
+              ) {
+                hydrationBailed = true;
+                console.warn('Parent: ', elm);
+                console.warn('server innerHTML: ', i);
+                console.warn('client innerHTML: ', elm.innerHTML);
+              }
+              return false
+            }
+          } else {
+            // iterate and compare children lists
+            var childrenMatch = true;
+            var childNode = elm.firstChild;
+            for (var i$1 = 0; i$1 < children.length; i$1++) {
+              if (!childNode || !hydrate(childNode, children[i$1], insertedVnodeQueue, inVPre)) {
+                childrenMatch = false;
+                break
+              }
+              childNode = childNode.nextSibling;
+            }
+            // if childNode is not null, it means the actual childNodes list is
+            // longer than the virtual children list.
+            if (!childrenMatch || childNode) {
+              /* istanbul ignore if */
+              if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+                typeof console !== 'undefined' &&
+                !hydrationBailed
+              ) {
+                hydrationBailed = true;
+                console.warn('Parent: ', elm);
+                console.warn('Mismatching childNodes vs. VNodes: ', elm.childNodes, children);
+              }
+              return false
+            }
+          }
+        }
+      }
+      if (isDef(data)) {
+        var fullInvoke = false;
+        for (var key in data) {
+          if (!isRenderedModule(key)) {
+            fullInvoke = true;
+            invokeCreateHooks(vnode, insertedVnodeQueue);
+            break
+          }
+        }
+        if (!fullInvoke && data['class']) {
+          // ensure collecting deps for deep class bindings for future updates
+          traverse(data['class']);
+        }
+      }
+    } else if (elm.data !== vnode.text) {
+      elm.data = vnode.text;
+    }
+    return true
+  }
+
+  function assertNodeMatch (node, vnode, inVPre) {
+    if (isDef(vnode.tag)) {
+      return vnode.tag.indexOf('vue-component') === 0 || (
+        !isUnknownElement$$1(vnode, inVPre) &&
+        vnode.tag.toLowerCase() === (node.tagName && node.tagName.toLowerCase())
+      )
+    } else {
+      return node.nodeType === (vnode.isComment ? 8 : 3)
+    }
+  }
+
+  return function patch (oldVnode, vnode, hydrating, removeOnly, parentElm, refElm) {
+    if (isUndef(vnode)) {
+      if (isDef(oldVnode)) { invokeDestroyHook(oldVnode); }
+      return
+    }
+
+    var isInitialPatch = false;
+    var insertedVnodeQueue = [];
+
+    if (isUndef(oldVnode)) {
+      // empty mount (likely as component), create new root element
+      isInitialPatch = true;
+      createElm(vnode, insertedVnodeQueue, parentElm, refElm);
+    } else {
+      var isRealElement = isDef(oldVnode.nodeType);
+      if (!isRealElement && sameVnode(oldVnode, vnode)) {
+        // patch existing root node
+        patchVnode(oldVnode, vnode, insertedVnodeQueue, removeOnly);
+      } else {
+        if (isRealElement) {
+          // mounting to a real element
+          // check if this is server-rendered content and if we can perform
+          // a successful hydration.
+          if (oldVnode.nodeType === 1 && oldVnode.hasAttribute(SSR_ATTR)) {
+            oldVnode.removeAttribute(SSR_ATTR);
+            hydrating = true;
+          }
+          if (isTrue(hydrating)) {
+            if (hydrate(oldVnode, vnode, insertedVnodeQueue)) {
+              invokeInsertHook(vnode, insertedVnodeQueue, true);
+              return oldVnode
+            } else {
+              warn(
+                'The client-side rendered virtual DOM tree is not matching ' +
+                'server-rendered content. This is likely caused by incorrect ' +
+                'HTML markup, for example nesting block-level elements inside ' +
+                '<p>, or missing <tbody>. Bailing hydration and performing ' +
+                'full client-side render.'
+              );
+            }
+          }
+          // either not server-rendered, or hydration failed.
+          // create an empty node and replace it
+          oldVnode = emptyNodeAt(oldVnode);
+        }
+
+        // replacing existing element
+        var oldElm = oldVnode.elm;
+        var parentElm$1 = nodeOps.parentNode(oldElm);
+
+        // create new node
+        createElm(
+          vnode,
+          insertedVnodeQueue,
+          // extremely rare edge case: do not insert if old element is in a
+          // leaving transition. Only happens when combining transition +
+          // keep-alive + HOCs. (#4590)
+          oldElm._leaveCb ? null : parentElm$1,
+          nodeOps.nextSibling(oldElm)
+        );
+
+        // update parent placeholder node element, recursively
+        if (isDef(vnode.parent)) {
+          var ancestor = vnode.parent;
+          var patchable = isPatchable(vnode);
+          while (ancestor) {
+            for (var i = 0; i < cbs.destroy.length; ++i) {
+              cbs.destroy[i](ancestor);
+            }
+            ancestor.elm = vnode.elm;
+            if (patchable) {
+              for (var i$1 = 0; i$1 < cbs.create.length; ++i$1) {
+                cbs.create[i$1](emptyNode, ancestor);
+              }
+              // #6513
+              // invoke insert hooks that may have been merged by create hooks.
+              // e.g. for directives that uses the "inserted" hook.
+              var insert = ancestor.data.hook.insert;
+              if (insert.merged) {
+                // start at index 1 to avoid re-invoking component mounted hook
+                for (var i$2 = 1; i$2 < insert.fns.length; i$2++) {
+                  insert.fns[i$2]();
+                }
+              }
+            } else {
+              registerRef(ancestor);
+            }
+            ancestor = ancestor.parent;
+          }
+        }
+
+        // destroy old node
+        if (isDef(parentElm$1)) {
+          removeVnodes(parentElm$1, [oldVnode], 0, 0);
+        } else if (isDef(oldVnode.tag)) {
+          invokeDestroyHook(oldVnode);
+        }
+      }
+    }
+
+    invokeInsertHook(vnode, insertedVnodeQueue, isInitialPatch);
+    return vnode.elm
+  }
+}
+
+/*  */
+
+var directives = {
+  create: updateDirectives,
+  update: updateDirectives,
+  destroy: function unbindDirectives (vnode) {
+    updateDirectives(vnode, emptyNode);
+  }
+}
+
+function updateDirectives (oldVnode, vnode) {
+  if (oldVnode.data.directives || vnode.data.directives) {
+    _update(oldVnode, vnode);
+  }
+}
+
+function _update (oldVnode, vnode) {
+  var isCreate = oldVnode === emptyNode;
+  var isDestroy = vnode === emptyNode;
+  var oldDirs = normalizeDirectives$1(oldVnode.data.directives, oldVnode.context);
+  var newDirs = normalizeDirectives$1(vnode.data.directives, vnode.context);
+
+  var dirsWithInsert = [];
+  var dirsWithPostpatch = [];
+
+  var key, oldDir, dir;
+  for (key in newDirs) {
+    oldDir = oldDirs[key];
+    dir = newDirs[key];
+    if (!oldDir) {
+      // new directive, bind
+      callHook$1(dir, 'bind', vnode, oldVnode);
+      if (dir.def && dir.def.inserted) {
+        dirsWithInsert.push(dir);
+      }
+    } else {
+      // existing directive, update
+      dir.oldValue = oldDir.value;
+      callHook$1(dir, 'update', vnode, oldVnode);
+      if (dir.def && dir.def.componentUpdated) {
+        dirsWithPostpatch.push(dir);
+      }
+    }
+  }
+
+  if (dirsWithInsert.length) {
+    var callInsert = function () {
+      for (var i = 0; i < dirsWithInsert.length; i++) {
+        callHook$1(dirsWithInsert[i], 'inserted', vnode, oldVnode);
+      }
+    };
+    if (isCreate) {
+      mergeVNodeHook(vnode, 'insert', callInsert);
+    } else {
+      callInsert();
+    }
+  }
+
+  if (dirsWithPostpatch.length) {
+    mergeVNodeHook(vnode, 'postpatch', function () {
+      for (var i = 0; i < dirsWithPostpatch.length; i++) {
+        callHook$1(dirsWithPostpatch[i], 'componentUpdated', vnode, oldVnode);
+      }
+    });
+  }
+
+  if (!isCreate) {
+    for (key in oldDirs) {
+      if (!newDirs[key]) {
+        // no longer present, unbind
+        callHook$1(oldDirs[key], 'unbind', oldVnode, oldVnode, isDestroy);
+      }
+    }
+  }
+}
+
+var emptyModifiers = Object.create(null);
+
+function normalizeDirectives$1 (
+  dirs,
+  vm
+) {
+  var res = Object.create(null);
+  if (!dirs) {
+    // $flow-disable-line
+    return res
+  }
+  var i, dir;
+  for (i = 0; i < dirs.length; i++) {
+    dir = dirs[i];
+    if (!dir.modifiers) {
+      // $flow-disable-line
+      dir.modifiers = emptyModifiers;
+    }
+    res[getRawDirName(dir)] = dir;
+    dir.def = resolveAsset(vm.$options, 'directives', dir.name, true);
+  }
+  // $flow-disable-line
+  return res
+}
+
+function getRawDirName (dir) {
+  return dir.rawName || ((dir.name) + "." + (Object.keys(dir.modifiers || {}).join('.')))
+}
+
+function callHook$1 (dir, hook, vnode, oldVnode, isDestroy) {
+  var fn = dir.def && dir.def[hook];
+  if (fn) {
+    try {
+      fn(vnode.elm, dir, vnode, oldVnode, isDestroy);
+    } catch (e) {
+      handleError(e, vnode.context, ("directive " + (dir.name) + " " + hook + " hook"));
+    }
+  }
+}
+
+var baseModules = [
+  ref,
+  directives
+]
+
+/*  */
+
+function updateAttrs (oldVnode, vnode) {
+  var opts = vnode.componentOptions;
+  if (isDef(opts) && opts.Ctor.options.inheritAttrs === false) {
+    return
+  }
+  if (isUndef(oldVnode.data.attrs) && isUndef(vnode.data.attrs)) {
+    return
+  }
+  var key, cur, old;
+  var elm = vnode.elm;
+  var oldAttrs = oldVnode.data.attrs || {};
+  var attrs = vnode.data.attrs || {};
+  // clone observed objects, as the user probably wants to mutate it
+  if (isDef(attrs.__ob__)) {
+    attrs = vnode.data.attrs = extend({}, attrs);
+  }
+
+  for (key in attrs) {
+    cur = attrs[key];
+    old = oldAttrs[key];
+    if (old !== cur) {
+      setAttr(elm, key, cur);
+    }
+  }
+  // #4391: in IE9, setting type can reset value for input[type=radio]
+  // #6666: IE/Edge forces progress value down to 1 before setting a max
+  /* istanbul ignore if */
+  if ((isIE || isEdge) && attrs.value !== oldAttrs.value) {
+    setAttr(elm, 'value', attrs.value);
+  }
+  for (key in oldAttrs) {
+    if (isUndef(attrs[key])) {
+      if (isXlink(key)) {
+        elm.removeAttributeNS(xlinkNS, getXlinkProp(key));
+      } else if (!isEnumeratedAttr(key)) {
+        elm.removeAttribute(key);
+      }
+    }
+  }
+}
+
+function setAttr (el, key, value) {
+  if (el.tagName.indexOf('-') > -1) {
+    baseSetAttr(el, key, value);
+  } else if (isBooleanAttr(key)) {
+    // set attribute for blank value
+    // e.g. <option disabled>Select one</option>
+    if (isFalsyAttrValue(value)) {
+      el.removeAttribute(key);
+    } else {
+      // technically allowfullscreen is a boolean attribute for <iframe>,
+      // but Flash expects a value of "true" when used on <embed> tag
+      value = key === 'allowfullscreen' && el.tagName === 'EMBED'
+        ? 'true'
+        : key;
+      el.setAttribute(key, value);
+    }
+  } else if (isEnumeratedAttr(key)) {
+    el.setAttribute(key, isFalsyAttrValue(value) || value === 'false' ? 'false' : 'true');
+  } else if (isXlink(key)) {
+    if (isFalsyAttrValue(value)) {
+      el.removeAttributeNS(xlinkNS, getXlinkProp(key));
+    } else {
+      el.setAttributeNS(xlinkNS, key, value);
+    }
+  } else {
+    baseSetAttr(el, key, value);
+  }
+}
+
+function baseSetAttr (el, key, value) {
+  if (isFalsyAttrValue(value)) {
+    el.removeAttribute(key);
+  } else {
+    // #7138: IE10 & 11 fires input event when setting placeholder on
+    // <textarea>... block the first input event and remove the blocker
+    // immediately.
+    /* istanbul ignore if */
+    if (
+      isIE && !isIE9 &&
+      el.tagName === 'TEXTAREA' &&
+      key === 'placeholder' && !el.__ieph
+    ) {
+      var blocker = function (e) {
+        e.stopImmediatePropagation();
+        el.removeEventListener('input', blocker);
+      };
+      el.addEventListener('input', blocker);
+      // $flow-disable-line
+      el.__ieph = true; /* IE placeholder patched */
+    }
+    el.setAttribute(key, value);
+  }
+}
+
+var attrs = {
+  create: updateAttrs,
+  update: updateAttrs
+}
+
+/*  */
+
+function updateClass (oldVnode, vnode) {
+  var el = vnode.elm;
+  var data = vnode.data;
+  var oldData = oldVnode.data;
+  if (
+    isUndef(data.staticClass) &&
+    isUndef(data.class) && (
+      isUndef(oldData) || (
+        isUndef(oldData.staticClass) &&
+        isUndef(oldData.class)
+      )
+    )
+  ) {
+    return
+  }
+
+  var cls = genClassForVnode(vnode);
+
+  // handle transition classes
+  var transitionClass = el._transitionClasses;
+  if (isDef(transitionClass)) {
+    cls = concat(cls, stringifyClass(transitionClass));
+  }
+
+  // set the class
+  if (cls !== el._prevClass) {
+    el.setAttribute('class', cls);
+    el._prevClass = cls;
+  }
+}
+
+var klass = {
+  create: updateClass,
+  update: updateClass
+}
+
+/*  */
+
+var validDivisionCharRE = /[\w).+\-_$\]]/;
+
+function parseFilters (exp) {
+  var inSingle = false;
+  var inDouble = false;
+  var inTemplateString = false;
+  var inRegex = false;
+  var curly = 0;
+  var square = 0;
+  var paren = 0;
+  var lastFilterIndex = 0;
+  var c, prev, i, expression, filters;
+
+  for (i = 0; i < exp.length; i++) {
+    prev = c;
+    c = exp.charCodeAt(i);
+    if (inSingle) {
+      if (c === 0x27 && prev !== 0x5C) { inSingle = false; }
+    } else if (inDouble) {
+      if (c === 0x22 && prev !== 0x5C) { inDouble = false; }
+    } else if (inTemplateString) {
+      if (c === 0x60 && prev !== 0x5C) { inTemplateString = false; }
+    } else if (inRegex) {
+      if (c === 0x2f && prev !== 0x5C) { inRegex = false; }
+    } else if (
+      c === 0x7C && // pipe
+      exp.charCodeAt(i + 1) !== 0x7C &&
+      exp.charCodeAt(i - 1) !== 0x7C &&
+      !curly && !square && !paren
+    ) {
+      if (expression === undefined) {
+        // first filter, end of expression
+        lastFilterIndex = i + 1;
+        expression = exp.slice(0, i).trim();
+      } else {
+        pushFilter();
+      }
+    } else {
+      switch (c) {
+        case 0x22: inDouble = true; break         // "
+        case 0x27: inSingle = true; break         // '
+        case 0x60: inTemplateString = true; break // `
+        case 0x28: paren++; break                 // (
+        case 0x29: paren--; break                 // )
+        case 0x5B: square++; break                // [
+        case 0x5D: square--; break                // ]
+        case 0x7B: curly++; break                 // {
+        case 0x7D: curly--; break                 // }
+      }
+      if (c === 0x2f) { // /
+        var j = i - 1;
+        var p = (void 0);
+        // find first non-whitespace prev char
+        for (; j >= 0; j--) {
+          p = exp.charAt(j);
+          if (p !== ' ') { break }
+        }
+        if (!p || !validDivisionCharRE.test(p)) {
+          inRegex = true;
+        }
+      }
+    }
+  }
+
+  if (expression === undefined) {
+    expression = exp.slice(0, i).trim();
+  } else if (lastFilterIndex !== 0) {
+    pushFilter();
+  }
+
+  function pushFilter () {
+    (filters || (filters = [])).push(exp.slice(lastFilterIndex, i).trim());
+    lastFilterIndex = i + 1;
+  }
+
+  if (filters) {
+    for (i = 0; i < filters.length; i++) {
+      expression = wrapFilter(expression, filters[i]);
+    }
+  }
+
+  return expression
+}
+
+function wrapFilter (exp, filter) {
+  var i = filter.indexOf('(');
+  if (i < 0) {
+    // _f: resolveFilter
+    return ("_f(\"" + filter + "\")(" + exp + ")")
+  } else {
+    var name = filter.slice(0, i);
+    var args = filter.slice(i + 1);
+    return ("_f(\"" + name + "\")(" + exp + (args !== ')' ? ',' + args : args))
+  }
+}
+
+/*  */
+
+function baseWarn (msg) {
+  console.error(("[Vue compiler]: " + msg));
+}
+
+function pluckModuleFunction (
+  modules,
+  key
+) {
+  return modules
+    ? modules.map(function (m) { return m[key]; }).filter(function (_) { return _; })
+    : []
+}
+
+function addProp (el, name, value) {
+  (el.props || (el.props = [])).push({ name: name, value: value });
+  el.plain = false;
+}
+
+function addAttr (el, name, value) {
+  (el.attrs || (el.attrs = [])).push({ name: name, value: value });
+  el.plain = false;
+}
+
+// add a raw attr (use this in preTransforms)
+function addRawAttr (el, name, value) {
+  el.attrsMap[name] = value;
+  el.attrsList.push({ name: name, value: value });
+}
+
+function addDirective (
+  el,
+  name,
+  rawName,
+  value,
+  arg,
+  modifiers
+) {
+  (el.directives || (el.directives = [])).push({ name: name, rawName: rawName, value: value, arg: arg, modifiers: modifiers });
+  el.plain = false;
+}
+
+function addHandler (
+  el,
+  name,
+  value,
+  modifiers,
+  important,
+  warn
+) {
+  modifiers = modifiers || emptyObject;
+  // warn prevent and passive modifier
+  /* istanbul ignore if */
+  if (
+    !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn &&
+    modifiers.prevent && modifiers.passive
+  ) {
+    warn(
+      'passive and prevent can\'t be used together. ' +
+      'Passive handler can\'t prevent default event.'
+    );
+  }
+
+  // check capture modifier
+  if (modifiers.capture) {
+    delete modifiers.capture;
+    name = '!' + name; // mark the event as captured
+  }
+  if (modifiers.once) {
+    delete modifiers.once;
+    name = '~' + name; // mark the event as once
+  }
+  /* istanbul ignore if */
+  if (modifiers.passive) {
+    delete modifiers.passive;
+    name = '&' + name; // mark the event as passive
+  }
+
+  // normalize click.right and click.middle since they don't actually fire
+  // this is technically browser-specific, but at least for now browsers are
+  // the only target envs that have right/middle clicks.
+  if (name === 'click') {
+    if (modifiers.right) {
+      name = 'contextmenu';
+      delete modifiers.right;
+    } else if (modifiers.middle) {
+      name = 'mouseup';
+    }
+  }
+
+  var events;
+  if (modifiers.native) {
+    delete modifiers.native;
+    events = el.nativeEvents || (el.nativeEvents = {});
+  } else {
+    events = el.events || (el.events = {});
+  }
+
+  var newHandler = {
+    value: value.trim()
+  };
+  if (modifiers !== emptyObject) {
+    newHandler.modifiers = modifiers;
+  }
+
+  var handlers = events[name];
+  /* istanbul ignore if */
+  if (Array.isArray(handlers)) {
+    important ? handlers.unshift(newHandler) : handlers.push(newHandler);
+  } else if (handlers) {
+    events[name] = important ? [newHandler, handlers] : [handlers, newHandler];
+  } else {
+    events[name] = newHandler;
+  }
+
+  el.plain = false;
+}
+
+function getBindingAttr (
+  el,
+  name,
+  getStatic
+) {
+  var dynamicValue =
+    getAndRemoveAttr(el, ':' + name) ||
+    getAndRemoveAttr(el, 'v-bind:' + name);
+  if (dynamicValue != null) {
+    return parseFilters(dynamicValue)
+  } else if (getStatic !== false) {
+    var staticValue = getAndRemoveAttr(el, name);
+    if (staticValue != null) {
+      return JSON.stringify(staticValue)
+    }
+  }
+}
+
+// note: this only removes the attr from the Array (attrsList) so that it
+// doesn't get processed by processAttrs.
+// By default it does NOT remove it from the map (attrsMap) because the map is
+// needed during codegen.
+function getAndRemoveAttr (
+  el,
+  name,
+  removeFromMap
+) {
+  var val;
+  if ((val = el.attrsMap[name]) != null) {
+    var list = el.attrsList;
+    for (var i = 0, l = list.length; i < l; i++) {
+      if (list[i].name === name) {
+        list.splice(i, 1);
+        break
+      }
+    }
+  }
+  if (removeFromMap) {
+    delete el.attrsMap[name];
+  }
+  return val
+}
+
+/*  */
+
+/**
+ * Cross-platform code generation for component v-model
+ */
+function genComponentModel (
+  el,
+  value,
+  modifiers
+) {
+  var ref = modifiers || {};
+  var number = ref.number;
+  var trim = ref.trim;
+
+  var baseValueExpression = '$$v';
+  var valueExpression = baseValueExpression;
+  if (trim) {
+    valueExpression =
+      "(typeof " + baseValueExpression + " === 'string'" +
+      "? " + baseValueExpression + ".trim()" +
+      ": " + baseValueExpression + ")";
+  }
+  if (number) {
+    valueExpression = "_n(" + valueExpression + ")";
+  }
+  var assignment = genAssignmentCode(value, valueExpression);
+
+  el.model = {
+    value: ("(" + value + ")"),
+    expression: ("\"" + value + "\""),
+    callback: ("function (" + baseValueExpression + ") {" + assignment + "}")
+  };
+}
+
+/**
+ * Cross-platform codegen helper for generating v-model value assignment code.
+ */
+function genAssignmentCode (
+  value,
+  assignment
+) {
+  var res = parseModel(value);
+  if (res.key === null) {
+    return (value + "=" + assignment)
+  } else {
+    return ("$set(" + (res.exp) + ", " + (res.key) + ", " + assignment + ")")
+  }
+}
+
+/**
+ * Parse a v-model expression into a base path and a final key segment.
+ * Handles both dot-path and possible square brackets.
+ *
+ * Possible cases:
+ *
+ * - test
+ * - test[key]
+ * - test[test1[key]]
+ * - test["a"][key]
+ * - xxx.test[a[a].test1[key]]
+ * - test.xxx.a["asa"][test1[key]]
+ *
+ */
+
+var len;
+var str;
+var chr;
+var index$1;
+var expressionPos;
+var expressionEndPos;
+
+
+
+function parseModel (val) {
+  // Fix https://github.com/vuejs/vue/pull/7730
+  // allow v-model="obj.val " (trailing whitespace)
+  val = val.trim();
+  len = val.length;
+
+  if (val.indexOf('[') < 0 || val.lastIndexOf(']') < len - 1) {
+    index$1 = val.lastIndexOf('.');
+    if (index$1 > -1) {
+      return {
+        exp: val.slice(0, index$1),
+        key: '"' + val.slice(index$1 + 1) + '"'
+      }
+    } else {
+      return {
+        exp: val,
+        key: null
+      }
+    }
+  }
+
+  str = val;
+  index$1 = expressionPos = expressionEndPos = 0;
+
+  while (!eof()) {
+    chr = next();
+    /* istanbul ignore if */
+    if (isStringStart(chr)) {
+      parseString(chr);
+    } else if (chr === 0x5B) {
+      parseBracket(chr);
+    }
+  }
+
+  return {
+    exp: val.slice(0, expressionPos),
+    key: val.slice(expressionPos + 1, expressionEndPos)
+  }
+}
+
+function next () {
+  return str.charCodeAt(++index$1)
+}
+
+function eof () {
+  return index$1 >= len
+}
+
+function isStringStart (chr) {
+  return chr === 0x22 || chr === 0x27
+}
+
+function parseBracket (chr) {
+  var inBracket = 1;
+  expressionPos = index$1;
+  while (!eof()) {
+    chr = next();
+    if (isStringStart(chr)) {
+      parseString(chr);
+      continue
+    }
+    if (chr === 0x5B) { inBracket++; }
+    if (chr === 0x5D) { inBracket--; }
+    if (inBracket === 0) {
+      expressionEndPos = index$1;
+      break
+    }
+  }
+}
+
+function parseString (chr) {
+  var stringQuote = chr;
+  while (!eof()) {
+    chr = next();
+    if (chr === stringQuote) {
+      break
+    }
+  }
+}
+
+/*  */
+
+var warn$1;
+
+// in some cases, the event used has to be determined at runtime
+// so we used some reserved tokens during compile.
+var RANGE_TOKEN = '__r';
+var CHECKBOX_RADIO_TOKEN = '__c';
+
+function model (
+  el,
+  dir,
+  _warn
+) {
+  warn$1 = _warn;
+  var value = dir.value;
+  var modifiers = dir.modifiers;
+  var tag = el.tag;
+  var type = el.attrsMap.type;
+
+  {
+    // inputs with type="file" are read only and setting the input's
+    // value will throw an error.
+    if (tag === 'input' && type === 'file') {
+      warn$1(
+        "<" + (el.tag) + " v-model=\"" + value + "\" type=\"file\">:\n" +
+        "File inputs are read only. Use a v-on:change listener instead."
+      );
+    }
+  }
+
+  if (el.component) {
+    genComponentModel(el, value, modifiers);
+    // component v-model doesn't need extra runtime
+    return false
+  } else if (tag === 'select') {
+    genSelect(el, value, modifiers);
+  } else if (tag === 'input' && type === 'checkbox') {
+    genCheckboxModel(el, value, modifiers);
+  } else if (tag === 'input' && type === 'radio') {
+    genRadioModel(el, value, modifiers);
+  } else if (tag === 'input' || tag === 'textarea') {
+    genDefaultModel(el, value, modifiers);
+  } else if (!config.isReservedTag(tag)) {
+    genComponentModel(el, value, modifiers);
+    // component v-model doesn't need extra runtime
+    return false
+  } else {
+    warn$1(
+      "<" + (el.tag) + " v-model=\"" + value + "\">: " +
+      "v-model is not supported on this element type. " +
+      'If you are working with contenteditable, it\'s recommended to ' +
+      'wrap a library dedicated for that purpose inside a custom component.'
+    );
+  }
+
+  // ensure runtime directive metadata
+  return true
+}
+
+function genCheckboxModel (
+  el,
+  value,
+  modifiers
+) {
+  var number = modifiers && modifiers.number;
+  var valueBinding = getBindingAttr(el, 'value') || 'null';
+  var trueValueBinding = getBindingAttr(el, 'true-value') || 'true';
+  var falseValueBinding = getBindingAttr(el, 'false-value') || 'false';
+  addProp(el, 'checked',
+    "Array.isArray(" + value + ")" +
+    "?_i(" + value + "," + valueBinding + ")>-1" + (
+      trueValueBinding === 'true'
+        ? (":(" + value + ")")
+        : (":_q(" + value + "," + trueValueBinding + ")")
+    )
+  );
+  addHandler(el, 'change',
+    "var $$a=" + value + "," +
+        '$$el=$event.target,' +
+        "$$c=$$el.checked?(" + trueValueBinding + "):(" + falseValueBinding + ");" +
+    'if(Array.isArray($$a)){' +
+      "var $$v=" + (number ? '_n(' + valueBinding + ')' : valueBinding) + "," +
+          '$$i=_i($$a,$$v);' +
+      "if($$el.checked){$$i<0&&(" + (genAssignmentCode(value, '$$a.concat([$$v])')) + ")}" +
+      "else{$$i>-1&&(" + (genAssignmentCode(value, '$$a.slice(0,$$i).concat($$a.slice($$i+1))')) + ")}" +
+    "}else{" + (genAssignmentCode(value, '$$c')) + "}",
+    null, true
+  );
+}
+
+function genRadioModel (
+  el,
+  value,
+  modifiers
+) {
+  var number = modifiers && modifiers.number;
+  var valueBinding = getBindingAttr(el, 'value') || 'null';
+  valueBinding = number ? ("_n(" + valueBinding + ")") : valueBinding;
+  addProp(el, 'checked', ("_q(" + value + "," + valueBinding + ")"));
+  addHandler(el, 'change', genAssignmentCode(value, valueBinding), null, true);
+}
+
+function genSelect (
+  el,
+  value,
+  modifiers
+) {
+  var number = modifiers && modifiers.number;
+  var selectedVal = "Array.prototype.filter" +
+    ".call($event.target.options,function(o){return o.selected})" +
+    ".map(function(o){var val = \"_value\" in o ? o._value : o.value;" +
+    "return " + (number ? '_n(val)' : 'val') + "})";
+
+  var assignment = '$event.target.multiple ? $$selectedVal : $$selectedVal[0]';
+  var code = "var $$selectedVal = " + selectedVal + ";";
+  code = code + " " + (genAssignmentCode(value, assignment));
+  addHandler(el, 'change', code, null, true);
+}
+
+function genDefaultModel (
+  el,
+  value,
+  modifiers
+) {
+  var type = el.attrsMap.type;
+
+  // warn if v-bind:value conflicts with v-model
+  // except for inputs with v-bind:type
+  {
+    var value$1 = el.attrsMap['v-bind:value'] || el.attrsMap[':value'];
+    var typeBinding = el.attrsMap['v-bind:type'] || el.attrsMap[':type'];
+    if (value$1 && !typeBinding) {
+      var binding = el.attrsMap['v-bind:value'] ? 'v-bind:value' : ':value';
+      warn$1(
+        binding + "=\"" + value$1 + "\" conflicts with v-model on the same element " +
+        'because the latter already expands to a value binding internally'
+      );
+    }
+  }
+
+  var ref = modifiers || {};
+  var lazy = ref.lazy;
+  var number = ref.number;
+  var trim = ref.trim;
+  var needCompositionGuard = !lazy && type !== 'range';
+  var event = lazy
+    ? 'change'
+    : type === 'range'
+      ? RANGE_TOKEN
+      : 'input';
+
+  var valueExpression = '$event.target.value';
+  if (trim) {
+    valueExpression = "$event.target.value.trim()";
+  }
+  if (number) {
+    valueExpression = "_n(" + valueExpression + ")";
+  }
+
+  var code = genAssignmentCode(value, valueExpression);
+  if (needCompositionGuard) {
+    code = "if($event.target.composing)return;" + code;
+  }
+
+  addProp(el, 'value', ("(" + value + ")"));
+  addHandler(el, event, code, null, true);
+  if (trim || number) {
+    addHandler(el, 'blur', '$forceUpdate()');
+  }
+}
+
+/*  */
+
+// normalize v-model event tokens that can only be determined at runtime.
+// it's important to place the event as the first in the array because
+// the whole point is ensuring the v-model callback gets called before
+// user-attached handlers.
+function normalizeEvents (on) {
+  /* istanbul ignore if */
+  if (isDef(on[RANGE_TOKEN])) {
+    // IE input[type=range] only supports `change` event
+    var event = isIE ? 'change' : 'input';
+    on[event] = [].concat(on[RANGE_TOKEN], on[event] || []);
+    delete on[RANGE_TOKEN];
+  }
+  // This was originally intended to fix #4521 but no longer necessary
+  // after 2.5. Keeping it for backwards compat with generated code from < 2.4
+  /* istanbul ignore if */
+  if (isDef(on[CHECKBOX_RADIO_TOKEN])) {
+    on.change = [].concat(on[CHECKBOX_RADIO_TOKEN], on.change || []);
+    delete on[CHECKBOX_RADIO_TOKEN];
+  }
+}
+
+var target$1;
+
+function createOnceHandler (handler, event, capture) {
+  var _target = target$1; // save current target element in closure
+  return function onceHandler () {
+    var res = handler.apply(null, arguments);
+    if (res !== null) {
+      remove$2(event, onceHandler, capture, _target);
+    }
+  }
+}
+
+function add$1 (
+  event,
+  handler,
+  once$$1,
+  capture,
+  passive
+) {
+  handler = withMacroTask(handler);
+  if (once$$1) { handler = createOnceHandler(handler, event, capture); }
+  target$1.addEventListener(
+    event,
+    handler,
+    supportsPassive
+      ? { capture: capture, passive: passive }
+      : capture
+  );
+}
+
+function remove$2 (
+  event,
+  handler,
+  capture,
+  _target
+) {
+  (_target || target$1).removeEventListener(
+    event,
+    handler._withTask || handler,
+    capture
+  );
+}
+
+function updateDOMListeners (oldVnode, vnode) {
+  if (isUndef(oldVnode.data.on) && isUndef(vnode.data.on)) {
+    return
+  }
+  var on = vnode.data.on || {};
+  var oldOn = oldVnode.data.on || {};
+  target$1 = vnode.elm;
+  normalizeEvents(on);
+  updateListeners(on, oldOn, add$1, remove$2, vnode.context);
+  target$1 = undefined;
+}
+
+var events = {
+  create: updateDOMListeners,
+  update: updateDOMListeners
+}
+
+/*  */
+
+function updateDOMProps (oldVnode, vnode) {
+  if (isUndef(oldVnode.data.domProps) && isUndef(vnode.data.domProps)) {
+    return
+  }
+  var key, cur;
+  var elm = vnode.elm;
+  var oldProps = oldVnode.data.domProps || {};
+  var props = vnode.data.domProps || {};
+  // clone observed objects, as the user probably wants to mutate it
+  if (isDef(props.__ob__)) {
+    props = vnode.data.domProps = extend({}, props);
+  }
+
+  for (key in oldProps) {
+    if (isUndef(props[key])) {
+      elm[key] = '';
+    }
+  }
+  for (key in props) {
+    cur = props[key];
+    // ignore children if the node has textContent or innerHTML,
+    // as these will throw away existing DOM nodes and cause removal errors
+    // on subsequent patches (#3360)
+    if (key === 'textContent' || key === 'innerHTML') {
+      if (vnode.children) { vnode.children.length = 0; }
+      if (cur === oldProps[key]) { continue }
+      // #6601 work around Chrome version <= 55 bug where single textNode
+      // replaced by innerHTML/textContent retains its parentNode property
+      if (elm.childNodes.length === 1) {
+        elm.removeChild(elm.childNodes[0]);
+      }
+    }
+
+    if (key === 'value') {
+      // store value as _value as well since
+      // non-string values will be stringified
+      elm._value = cur;
+      // avoid resetting cursor position when value is the same
+      var strCur = isUndef(cur) ? '' : String(cur);
+      if (shouldUpdateValue(elm, strCur)) {
+        elm.value = strCur;
+      }
+    } else {
+      elm[key] = cur;
+    }
+  }
+}
+
+// check platforms/web/util/attrs.js acceptValue
+
+
+function shouldUpdateValue (elm, checkVal) {
+  return (!elm.composing && (
+    elm.tagName === 'OPTION' ||
+    isNotInFocusAndDirty(elm, checkVal) ||
+    isDirtyWithModifiers(elm, checkVal)
+  ))
+}
+
+function isNotInFocusAndDirty (elm, checkVal) {
+  // return true when textbox (.number and .trim) loses focus and its value is
+  // not equal to the updated value
+  var notInFocus = true;
+  // #6157
+  // work around IE bug when accessing document.activeElement in an iframe
+  try { notInFocus = document.activeElement !== elm; } catch (e) {}
+  return notInFocus && elm.value !== checkVal
+}
+
+function isDirtyWithModifiers (elm, newVal) {
+  var value = elm.value;
+  var modifiers = elm._vModifiers; // injected by v-model runtime
+  if (isDef(modifiers)) {
+    if (modifiers.lazy) {
+      // inputs with lazy should only be updated when not in focus
+      return false
+    }
+    if (modifiers.number) {
+      return toNumber(value) !== toNumber(newVal)
+    }
+    if (modifiers.trim) {
+      return value.trim() !== newVal.trim()
+    }
+  }
+  return value !== newVal
+}
+
+var domProps = {
+  create: updateDOMProps,
+  update: updateDOMProps
+}
+
+/*  */
+
+var parseStyleText = cached(function (cssText) {
+  var res = {};
+  var listDelimiter = /;(?![^(]*\))/g;
+  var propertyDelimiter = /:(.+)/;
+  cssText.split(listDelimiter).forEach(function (item) {
+    if (item) {
+      var tmp = item.split(propertyDelimiter);
+      tmp.length > 1 && (res[tmp[0].trim()] = tmp[1].trim());
+    }
+  });
+  return res
+});
+
+// merge static and dynamic style data on the same vnode
+function normalizeStyleData (data) {
+  var style = normalizeStyleBinding(data.style);
+  // static style is pre-processed into an object during compilation
+  // and is always a fresh object, so it's safe to merge into it
+  return data.staticStyle
+    ? extend(data.staticStyle, style)
+    : style
+}
+
+// normalize possible array / string values into Object
+function normalizeStyleBinding (bindingStyle) {
+  if (Array.isArray(bindingStyle)) {
+    return toObject(bindingStyle)
+  }
+  if (typeof bindingStyle === 'string') {
+    return parseStyleText(bindingStyle)
+  }
+  return bindingStyle
+}
+
+/**
+ * parent component style should be after child's
+ * so that parent component's style could override it
+ */
+function getStyle (vnode, checkChild) {
+  var res = {};
+  var styleData;
+
+  if (checkChild) {
+    var childNode = vnode;
+    while (childNode.componentInstance) {
+      childNode = childNode.componentInstance._vnode;
+      if (
+        childNode && childNode.data &&
+        (styleData = normalizeStyleData(childNode.data))
+      ) {
+        extend(res, styleData);
+      }
+    }
+  }
+
+  if ((styleData = normalizeStyleData(vnode.data))) {
+    extend(res, styleData);
+  }
+
+  var parentNode = vnode;
+  while ((parentNode = parentNode.parent)) {
+    if (parentNode.data && (styleData = normalizeStyleData(parentNode.data))) {
+      extend(res, styleData);
+    }
+  }
+  return res
+}
+
+/*  */
+
+var cssVarRE = /^--/;
+var importantRE = /\s*!important$/;
+var setProp = function (el, name, val) {
+  /* istanbul ignore if */
+  if (cssVarRE.test(name)) {
+    el.style.setProperty(name, val);
+  } else if (importantRE.test(val)) {
+    el.style.setProperty(name, val.replace(importantRE, ''), 'important');
+  } else {
+    var normalizedName = normalize(name);
+    if (Array.isArray(val)) {
+      // Support values array created by autoprefixer, e.g.
+      // {display: ["-webkit-box", "-ms-flexbox", "flex"]}
+      // Set them one by one, and the browser will only set those it can recognize
+      for (var i = 0, len = val.length; i < len; i++) {
+        el.style[normalizedName] = val[i];
+      }
+    } else {
+      el.style[normalizedName] = val;
+    }
+  }
+};
+
+var vendorNames = ['Webkit', 'Moz', 'ms'];
+
+var emptyStyle;
+var normalize = cached(function (prop) {
+  emptyStyle = emptyStyle || document.createElement('div').style;
+  prop = camelize(prop);
+  if (prop !== 'filter' && (prop in emptyStyle)) {
+    return prop
+  }
+  var capName = prop.charAt(0).toUpperCase() + prop.slice(1);
+  for (var i = 0; i < vendorNames.length; i++) {
+    var name = vendorNames[i] + capName;
+    if (name in emptyStyle) {
+      return name
+    }
+  }
+});
+
+function updateStyle (oldVnode, vnode) {
+  var data = vnode.data;
+  var oldData = oldVnode.data;
+
+  if (isUndef(data.staticStyle) && isUndef(data.style) &&
+    isUndef(oldData.staticStyle) && isUndef(oldData.style)
+  ) {
+    return
+  }
+
+  var cur, name;
+  var el = vnode.elm;
+  var oldStaticStyle = oldData.staticStyle;
+  var oldStyleBinding = oldData.normalizedStyle || oldData.style || {};
+
+  // if static style exists, stylebinding already merged into it when doing normalizeStyleData
+  var oldStyle = oldStaticStyle || oldStyleBinding;
+
+  var style = normalizeStyleBinding(vnode.data.style) || {};
+
+  // store normalized style under a different key for next diff
+  // make sure to clone it if it's reactive, since the user likely wants
+  // to mutate it.
+  vnode.data.normalizedStyle = isDef(style.__ob__)
+    ? extend({}, style)
+    : style;
+
+  var newStyle = getStyle(vnode, true);
+
+  for (name in oldStyle) {
+    if (isUndef(newStyle[name])) {
+      setProp(el, name, '');
+    }
+  }
+  for (name in newStyle) {
+    cur = newStyle[name];
+    if (cur !== oldStyle[name]) {
+      // ie9 setting to null has no effect, must use empty string
+      setProp(el, name, cur == null ? '' : cur);
+    }
+  }
+}
+
+var style = {
+  create: updateStyle,
+  update: updateStyle
+}
+
+/*  */
+
+/**
+ * Add class with compatibility for SVG since classList is not supported on
+ * SVG elements in IE
+ */
+function addClass (el, cls) {
+  /* istanbul ignore if */
+  if (!cls || !(cls = cls.trim())) {
+    return
+  }
+
+  /* istanbul ignore else */
+  if (el.classList) {
+    if (cls.indexOf(' ') > -1) {
+      cls.split(/\s+/).forEach(function (c) { return el.classList.add(c); });
+    } else {
+      el.classList.add(cls);
+    }
+  } else {
+    var cur = " " + (el.getAttribute('class') || '') + " ";
+    if (cur.indexOf(' ' + cls + ' ') < 0) {
+      el.setAttribute('class', (cur + cls).trim());
+    }
+  }
+}
+
+/**
+ * Remove class with compatibility for SVG since classList is not supported on
+ * SVG elements in IE
+ */
+function removeClass (el, cls) {
+  /* istanbul ignore if */
+  if (!cls || !(cls = cls.trim())) {
+    return
+  }
+
+  /* istanbul ignore else */
+  if (el.classList) {
+    if (cls.indexOf(' ') > -1) {
+      cls.split(/\s+/).forEach(function (c) { return el.classList.remove(c); });
+    } else {
+      el.classList.remove(cls);
+    }
+    if (!el.classList.length) {
+      el.removeAttribute('class');
+    }
+  } else {
+    var cur = " " + (el.getAttribute('class') || '') + " ";
+    var tar = ' ' + cls + ' ';
+    while (cur.indexOf(tar) >= 0) {
+      cur = cur.replace(tar, ' ');
+    }
+    cur = cur.trim();
+    if (cur) {
+      el.setAttribute('class', cur);
+    } else {
+      el.removeAttribute('class');
+    }
+  }
+}
+
+/*  */
+
+function resolveTransition (def) {
+  if (!def) {
+    return
+  }
+  /* istanbul ignore else */
+  if (typeof def === 'object') {
+    var res = {};
+    if (def.css !== false) {
+      extend(res, autoCssTransition(def.name || 'v'));
+    }
+    extend(res, def);
+    return res
+  } else if (typeof def === 'string') {
+    return autoCssTransition(def)
+  }
+}
+
+var autoCssTransition = cached(function (name) {
+  return {
+    enterClass: (name + "-enter"),
+    enterToClass: (name + "-enter-to"),
+    enterActiveClass: (name + "-enter-active"),
+    leaveClass: (name + "-leave"),
+    leaveToClass: (name + "-leave-to"),
+    leaveActiveClass: (name + "-leave-active")
+  }
+});
+
+var hasTransition = inBrowser && !isIE9;
+var TRANSITION = 'transition';
+var ANIMATION = 'animation';
+
+// Transition property/event sniffing
+var transitionProp = 'transition';
+var transitionEndEvent = 'transitionend';
+var animationProp = 'animation';
+var animationEndEvent = 'animationend';
+if (hasTransition) {
+  /* istanbul ignore if */
+  if (window.ontransitionend === undefined &&
+    window.onwebkittransitionend !== undefined
+  ) {
+    transitionProp = 'WebkitTransition';
+    transitionEndEvent = 'webkitTransitionEnd';
+  }
+  if (window.onanimationend === undefined &&
+    window.onwebkitanimationend !== undefined
+  ) {
+    animationProp = 'WebkitAnimation';
+    animationEndEvent = 'webkitAnimationEnd';
+  }
+}
+
+// binding to window is necessary to make hot reload work in IE in strict mode
+var raf = inBrowser
+  ? window.requestAnimationFrame
+    ? window.requestAnimationFrame.bind(window)
+    : setTimeout
+  : /* istanbul ignore next */ function (fn) { return fn(); };
+
+function nextFrame (fn) {
+  raf(function () {
+    raf(fn);
+  });
+}
+
+function addTransitionClass (el, cls) {
+  var transitionClasses = el._transitionClasses || (el._transitionClasses = []);
+  if (transitionClasses.indexOf(cls) < 0) {
+    transitionClasses.push(cls);
+    addClass(el, cls);
+  }
+}
+
+function removeTransitionClass (el, cls) {
+  if (el._transitionClasses) {
+    remove(el._transitionClasses, cls);
+  }
+  removeClass(el, cls);
+}
+
+function whenTransitionEnds (
+  el,
+  expectedType,
+  cb
+) {
+  var ref = getTransitionInfo(el, expectedType);
+  var type = ref.type;
+  var timeout = ref.timeout;
+  var propCount = ref.propCount;
+  if (!type) { return cb() }
+  var event = type === TRANSITION ? transitionEndEvent : animationEndEvent;
+  var ended = 0;
+  var end = function () {
+    el.removeEventListener(event, onEnd);
+    cb();
+  };
+  var onEnd = function (e) {
+    if (e.target === el) {
+      if (++ended >= propCount) {
+        end();
+      }
+    }
+  };
+  setTimeout(function () {
+    if (ended < propCount) {
+      end();
+    }
+  }, timeout + 1);
+  el.addEventListener(event, onEnd);
+}
+
+var transformRE = /\b(transform|all)(,|$)/;
+
+function getTransitionInfo (el, expectedType) {
+  var styles = window.getComputedStyle(el);
+  var transitionDelays = styles[transitionProp + 'Delay'].split(', ');
+  var transitionDurations = styles[transitionProp + 'Duration'].split(', ');
+  var transitionTimeout = getTimeout(transitionDelays, transitionDurations);
+  var animationDelays = styles[animationProp + 'Delay'].split(', ');
+  var animationDurations = styles[animationProp + 'Duration'].split(', ');
+  var animationTimeout = getTimeout(animationDelays, animationDurations);
+
+  var type;
+  var timeout = 0;
+  var propCount = 0;
+  /* istanbul ignore if */
+  if (expectedType === TRANSITION) {
+    if (transitionTimeout > 0) {
+      type = TRANSITION;
+      timeout = transitionTimeout;
+      propCount = transitionDurations.length;
+    }
+  } else if (expectedType === ANIMATION) {
+    if (animationTimeout > 0) {
+      type = ANIMATION;
+      timeout = animationTimeout;
+      propCount = animationDurations.length;
+    }
+  } else {
+    timeout = Math.max(transitionTimeout, animationTimeout);
+    type = timeout > 0
+      ? transitionTimeout > animationTimeout
+        ? TRANSITION
+        : ANIMATION
+      : null;
+    propCount = type
+      ? type === TRANSITION
+        ? transitionDurations.length
+        : animationDurations.length
+      : 0;
+  }
+  var hasTransform =
+    type === TRANSITION &&
+    transformRE.test(styles[transitionProp + 'Property']);
+  return {
+    type: type,
+    timeout: timeout,
+    propCount: propCount,
+    hasTransform: hasTransform
+  }
+}
+
+function getTimeout (delays, durations) {
+  /* istanbul ignore next */
+  while (delays.length < durations.length) {
+    delays = delays.concat(delays);
+  }
+
+  return Math.max.apply(null, durations.map(function (d, i) {
+    return toMs(d) + toMs(delays[i])
+  }))
+}
+
+function toMs (s) {
+  return Number(s.slice(0, -1)) * 1000
+}
+
+/*  */
+
+function enter (vnode, toggleDisplay) {
+  var el = vnode.elm;
+
+  // call leave callback now
+  if (isDef(el._leaveCb)) {
+    el._leaveCb.cancelled = true;
+    el._leaveCb();
+  }
+
+  var data = resolveTransition(vnode.data.transition);
+  if (isUndef(data)) {
+    return
+  }
+
+  /* istanbul ignore if */
+  if (isDef(el._enterCb) || el.nodeType !== 1) {
+    return
+  }
+
+  var css = data.css;
+  var type = data.type;
+  var enterClass = data.enterClass;
+  var enterToClass = data.enterToClass;
+  var enterActiveClass = data.enterActiveClass;
+  var appearClass = data.appearClass;
+  var appearToClass = data.appearToClass;
+  var appearActiveClass = data.appearActiveClass;
+  var beforeEnter = data.beforeEnter;
+  var enter = data.enter;
+  var afterEnter = data.afterEnter;
+  var enterCancelled = data.enterCancelled;
+  var beforeAppear = data.beforeAppear;
+  var appear = data.appear;
+  var afterAppear = data.afterAppear;
+  var appearCancelled = data.appearCancelled;
+  var duration = data.duration;
+
+  // activeInstance will always be the <transition> component managing this
+  // transition. One edge case to check is when the <transition> is placed
+  // as the root node of a child component. In that case we need to check
+  // <transition>'s parent for appear check.
+  var context = activeInstance;
+  var transitionNode = activeInstance.$vnode;
+  while (transitionNode && transitionNode.parent) {
+    transitionNode = transitionNode.parent;
+    context = transitionNode.context;
+  }
+
+  var isAppear = !context._isMounted || !vnode.isRootInsert;
+
+  if (isAppear && !appear && appear !== '') {
+    return
+  }
+
+  var startClass = isAppear && appearClass
+    ? appearClass
+    : enterClass;
+  var activeClass = isAppear && appearActiveClass
+    ? appearActiveClass
+    : enterActiveClass;
+  var toClass = isAppear && appearToClass
+    ? appearToClass
+    : enterToClass;
+
+  var beforeEnterHook = isAppear
+    ? (beforeAppear || beforeEnter)
+    : beforeEnter;
+  var enterHook = isAppear
+    ? (typeof appear === 'function' ? appear : enter)
+    : enter;
+  var afterEnterHook = isAppear
+    ? (afterAppear || afterEnter)
+    : afterEnter;
+  var enterCancelledHook = isAppear
+    ? (appearCancelled || enterCancelled)
+    : enterCancelled;
+
+  var explicitEnterDuration = toNumber(
+    isObject(duration)
+      ? duration.enter
+      : duration
+  );
+
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && explicitEnterDuration != null) {
+    checkDuration(explicitEnterDuration, 'enter', vnode);
+  }
+
+  var expectsCSS = css !== false && !isIE9;
+  var userWantsControl = getHookArgumentsLength(enterHook);
+
+  var cb = el._enterCb = once(function () {
+    if (expectsCSS) {
+      removeTransitionClass(el, toClass);
+      removeTransitionClass(el, activeClass);
+    }
+    if (cb.cancelled) {
+      if (expectsCSS) {
+        removeTransitionClass(el, startClass);
+      }
+      enterCancelledHook && enterCancelledHook(el);
+    } else {
+      afterEnterHook && afterEnterHook(el);
+    }
+    el._enterCb = null;
+  });
+
+  if (!vnode.data.show) {
+    // remove pending leave element on enter by injecting an insert hook
+    mergeVNodeHook(vnode, 'insert', function () {
+      var parent = el.parentNode;
+      var pendingNode = parent && parent._pending && parent._pending[vnode.key];
+      if (pendingNode &&
+        pendingNode.tag === vnode.tag &&
+        pendingNode.elm._leaveCb
+      ) {
+        pendingNode.elm._leaveCb();
+      }
+      enterHook && enterHook(el, cb);
+    });
+  }
+
+  // start enter transition
+  beforeEnterHook && beforeEnterHook(el);
+  if (expectsCSS) {
+    addTransitionClass(el, startClass);
+    addTransitionClass(el, activeClass);
+    nextFrame(function () {
+      removeTransitionClass(el, startClass);
+      if (!cb.cancelled) {
+        addTransitionClass(el, toClass);
+        if (!userWantsControl) {
+          if (isValidDuration(explicitEnterDuration)) {
+            setTimeout(cb, explicitEnterDuration);
+          } else {
+            whenTransitionEnds(el, type, cb);
+          }
+        }
+      }
+    });
+  }
+
+  if (vnode.data.show) {
+    toggleDisplay && toggleDisplay();
+    enterHook && enterHook(el, cb);
+  }
+
+  if (!expectsCSS && !userWantsControl) {
+    cb();
+  }
+}
+
+function leave (vnode, rm) {
+  var el = vnode.elm;
+
+  // call enter callback now
+  if (isDef(el._enterCb)) {
+    el._enterCb.cancelled = true;
+    el._enterCb();
+  }
+
+  var data = resolveTransition(vnode.data.transition);
+  if (isUndef(data) || el.nodeType !== 1) {
+    return rm()
+  }
+
+  /* istanbul ignore if */
+  if (isDef(el._leaveCb)) {
+    return
+  }
+
+  var css = data.css;
+  var type = data.type;
+  var leaveClass = data.leaveClass;
+  var leaveToClass = data.leaveToClass;
+  var leaveActiveClass = data.leaveActiveClass;
+  var beforeLeave = data.beforeLeave;
+  var leave = data.leave;
+  var afterLeave = data.afterLeave;
+  var leaveCancelled = data.leaveCancelled;
+  var delayLeave = data.delayLeave;
+  var duration = data.duration;
+
+  var expectsCSS = css !== false && !isIE9;
+  var userWantsControl = getHookArgumentsLength(leave);
+
+  var explicitLeaveDuration = toNumber(
+    isObject(duration)
+      ? duration.leave
+      : duration
+  );
+
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && isDef(explicitLeaveDuration)) {
+    checkDuration(explicitLeaveDuration, 'leave', vnode);
+  }
+
+  var cb = el._leaveCb = once(function () {
+    if (el.parentNode && el.parentNode._pending) {
+      el.parentNode._pending[vnode.key] = null;
+    }
+    if (expectsCSS) {
+      removeTransitionClass(el, leaveToClass);
+      removeTransitionClass(el, leaveActiveClass);
+    }
+    if (cb.cancelled) {
+      if (expectsCSS) {
+        removeTransitionClass(el, leaveClass);
+      }
+      leaveCancelled && leaveCancelled(el);
+    } else {
+      rm();
+      afterLeave && afterLeave(el);
+    }
+    el._leaveCb = null;
+  });
+
+  if (delayLeave) {
+    delayLeave(performLeave);
+  } else {
+    performLeave();
+  }
+
+  function performLeave () {
+    // the delayed leave may have already been cancelled
+    if (cb.cancelled) {
+      return
+    }
+    // record leaving element
+    if (!vnode.data.show) {
+      (el.parentNode._pending || (el.parentNode._pending = {}))[(vnode.key)] = vnode;
+    }
+    beforeLeave && beforeLeave(el);
+    if (expectsCSS) {
+      addTransitionClass(el, leaveClass);
+      addTransitionClass(el, leaveActiveClass);
+      nextFrame(function () {
+        removeTransitionClass(el, leaveClass);
+        if (!cb.cancelled) {
+          addTransitionClass(el, leaveToClass);
+          if (!userWantsControl) {
+            if (isValidDuration(explicitLeaveDuration)) {
+              setTimeout(cb, explicitLeaveDuration);
+            } else {
+              whenTransitionEnds(el, type, cb);
+            }
+          }
+        }
+      });
+    }
+    leave && leave(el, cb);
+    if (!expectsCSS && !userWantsControl) {
+      cb();
+    }
+  }
+}
+
+// only used in dev mode
+function checkDuration (val, name, vnode) {
+  if (typeof val !== 'number') {
+    warn(
+      "<transition> explicit " + name + " duration is not a valid number - " +
+      "got " + (JSON.stringify(val)) + ".",
+      vnode.context
+    );
+  } else if (isNaN(val)) {
+    warn(
+      "<transition> explicit " + name + " duration is NaN - " +
+      'the duration expression might be incorrect.',
+      vnode.context
+    );
+  }
+}
+
+function isValidDuration (val) {
+  return typeof val === 'number' && !isNaN(val)
+}
+
+/**
+ * Normalize a transition hook's argument length. The hook may be:
+ * - a merged hook (invoker) with the original in .fns
+ * - a wrapped component method (check ._length)
+ * - a plain function (.length)
+ */
+function getHookArgumentsLength (fn) {
+  if (isUndef(fn)) {
+    return false
+  }
+  var invokerFns = fn.fns;
+  if (isDef(invokerFns)) {
+    // invoker
+    return getHookArgumentsLength(
+      Array.isArray(invokerFns)
+        ? invokerFns[0]
+        : invokerFns
+    )
+  } else {
+    return (fn._length || fn.length) > 1
+  }
+}
+
+function _enter (_, vnode) {
+  if (vnode.data.show !== true) {
+    enter(vnode);
+  }
+}
+
+var transition = inBrowser ? {
+  create: _enter,
+  activate: _enter,
+  remove: function remove$$1 (vnode, rm) {
+    /* istanbul ignore else */
+    if (vnode.data.show !== true) {
+      leave(vnode, rm);
+    } else {
+      rm();
+    }
+  }
+} : {}
+
+var platformModules = [
+  attrs,
+  klass,
+  events,
+  domProps,
+  style,
+  transition
+]
+
+/*  */
+
+// the directive module should be applied last, after all
+// built-in modules have been applied.
+var modules = platformModules.concat(baseModules);
+
+var patch = createPatchFunction({ nodeOps: nodeOps, modules: modules });
+
+/**
+ * Not type checking this file because flow doesn't like attaching
+ * properties to Elements.
+ */
+
+/* istanbul ignore if */
+if (isIE9) {
+  // http://www.matts411.com/post/internet-explorer-9-oninput/
+  document.addEventListener('selectionchange', function () {
+    var el = document.activeElement;
+    if (el && el.vmodel) {
+      trigger(el, 'input');
+    }
+  });
+}
+
+var directive = {
+  inserted: function inserted (el, binding, vnode, oldVnode) {
+    if (vnode.tag === 'select') {
+      // #6903
+      if (oldVnode.elm && !oldVnode.elm._vOptions) {
+        mergeVNodeHook(vnode, 'postpatch', function () {
+          directive.componentUpdated(el, binding, vnode);
+        });
+      } else {
+        setSelected(el, binding, vnode.context);
+      }
+      el._vOptions = [].map.call(el.options, getValue);
+    } else if (vnode.tag === 'textarea' || isTextInputType(el.type)) {
+      el._vModifiers = binding.modifiers;
+      if (!binding.modifiers.lazy) {
+        el.addEventListener('compositionstart', onCompositionStart);
+        el.addEventListener('compositionend', onCompositionEnd);
+        // Safari < 10.2 & UIWebView doesn't fire compositionend when
+        // switching focus before confirming composition choice
+        // this also fixes the issue where some browsers e.g. iOS Chrome
+        // fires "change" instead of "input" on autocomplete.
+        el.addEventListener('change', onCompositionEnd);
+        /* istanbul ignore if */
+        if (isIE9) {
+          el.vmodel = true;
+        }
+      }
+    }
+  },
+
+  componentUpdated: function componentUpdated (el, binding, vnode) {
+    if (vnode.tag === 'select') {
+      setSelected(el, binding, vnode.context);
+      // in case the options rendered by v-for have changed,
+      // it's possible that the value is out-of-sync with the rendered options.
+      // detect such cases and filter out values that no longer has a matching
+      // option in the DOM.
+      var prevOptions = el._vOptions;
+      var curOptions = el._vOptions = [].map.call(el.options, getValue);
+      if (curOptions.some(function (o, i) { return !looseEqual(o, prevOptions[i]); })) {
+        // trigger change event if
+        // no matching option found for at least one value
+        var needReset = el.multiple
+          ? binding.value.some(function (v) { return hasNoMatchingOption(v, curOptions); })
+          : binding.value !== binding.oldValue && hasNoMatchingOption(binding.value, curOptions);
+        if (needReset) {
+          trigger(el, 'change');
+        }
+      }
+    }
+  }
+};
+
+function setSelected (el, binding, vm) {
+  actuallySetSelected(el, binding, vm);
+  /* istanbul ignore if */
+  if (isIE || isEdge) {
+    setTimeout(function () {
+      actuallySetSelected(el, binding, vm);
+    }, 0);
+  }
+}
+
+function actuallySetSelected (el, binding, vm) {
+  var value = binding.value;
+  var isMultiple = el.multiple;
+  if (isMultiple && !Array.isArray(value)) {
+    !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+      "<select multiple v-model=\"" + (binding.expression) + "\"> " +
+      "expects an Array value for its binding, but got " + (Object.prototype.toString.call(value).slice(8, -1)),
+      vm
+    );
+    return
+  }
+  var selected, option;
+  for (var i = 0, l = el.options.length; i < l; i++) {
+    option = el.options[i];
+    if (isMultiple) {
+      selected = looseIndexOf(value, getValue(option)) > -1;
+      if (option.selected !== selected) {
+        option.selected = selected;
+      }
+    } else {
+      if (looseEqual(getValue(option), value)) {
+        if (el.selectedIndex !== i) {
+          el.selectedIndex = i;
+        }
+        return
+      }
+    }
+  }
+  if (!isMultiple) {
+    el.selectedIndex = -1;
+  }
+}
+
+function hasNoMatchingOption (value, options) {
+  return options.every(function (o) { return !looseEqual(o, value); })
+}
+
+function getValue (option) {
+  return '_value' in option
+    ? option._value
+    : option.value
+}
+
+function onCompositionStart (e) {
+  e.target.composing = true;
+}
+
+function onCompositionEnd (e) {
+  // prevent triggering an input event for no reason
+  if (!e.target.composing) { return }
+  e.target.composing = false;
+  trigger(e.target, 'input');
+}
+
+function trigger (el, type) {
+  var e = document.createEvent('HTMLEvents');
+  e.initEvent(type, true, true);
+  el.dispatchEvent(e);
+}
+
+/*  */
+
+// recursively search for possible transition defined inside the component root
+function locateNode (vnode) {
+  return vnode.componentInstance && (!vnode.data || !vnode.data.transition)
+    ? locateNode(vnode.componentInstance._vnode)
+    : vnode
+}
+
+var show = {
+  bind: function bind (el, ref, vnode) {
+    var value = ref.value;
+
+    vnode = locateNode(vnode);
+    var transition$$1 = vnode.data && vnode.data.transition;
+    var originalDisplay = el.__vOriginalDisplay =
+      el.style.display === 'none' ? '' : el.style.display;
+    if (value && transition$$1) {
+      vnode.data.show = true;
+      enter(vnode, function () {
+        el.style.display = originalDisplay;
+      });
+    } else {
+      el.style.display = value ? originalDisplay : 'none';
+    }
+  },
+
+  update: function update (el, ref, vnode) {
+    var value = ref.value;
+    var oldValue = ref.oldValue;
+
+    /* istanbul ignore if */
+    if (!value === !oldValue) { return }
+    vnode = locateNode(vnode);
+    var transition$$1 = vnode.data && vnode.data.transition;
+    if (transition$$1) {
+      vnode.data.show = true;
+      if (value) {
+        enter(vnode, function () {
+          el.style.display = el.__vOriginalDisplay;
+        });
+      } else {
+        leave(vnode, function () {
+          el.style.display = 'none';
+        });
+      }
+    } else {
+      el.style.display = value ? el.__vOriginalDisplay : 'none';
+    }
+  },
+
+  unbind: function unbind (
+    el,
+    binding,
+    vnode,
+    oldVnode,
+    isDestroy
+  ) {
+    if (!isDestroy) {
+      el.style.display = el.__vOriginalDisplay;
+    }
+  }
+}
+
+var platformDirectives = {
+  model: directive,
+  show: show
+}
+
+/*  */
+
+// Provides transition support for a single element/component.
+// supports transition mode (out-in / in-out)
+
+var transitionProps = {
+  name: String,
+  appear: Boolean,
+  css: Boolean,
+  mode: String,
+  type: String,
+  enterClass: String,
+  leaveClass: String,
+  enterToClass: String,
+  leaveToClass: String,
+  enterActiveClass: String,
+  leaveActiveClass: String,
+  appearClass: String,
+  appearActiveClass: String,
+  appearToClass: String,
+  duration: [Number, String, Object]
+};
+
+// in case the child is also an abstract component, e.g. <keep-alive>
+// we want to recursively retrieve the real component to be rendered
+function getRealChild (vnode) {
+  var compOptions = vnode && vnode.componentOptions;
+  if (compOptions && compOptions.Ctor.options.abstract) {
+    return getRealChild(getFirstComponentChild(compOptions.children))
+  } else {
+    return vnode
+  }
+}
+
+function extractTransitionData (comp) {
+  var data = {};
+  var options = comp.$options;
+  // props
+  for (var key in options.propsData) {
+    data[key] = comp[key];
+  }
+  // events.
+  // extract listeners and pass them directly to the transition methods
+  var listeners = options._parentListeners;
+  for (var key$1 in listeners) {
+    data[camelize(key$1)] = listeners[key$1];
+  }
+  return data
+}
+
+function placeholder (h, rawChild) {
+  if (/\d-keep-alive$/.test(rawChild.tag)) {
+    return h('keep-alive', {
+      props: rawChild.componentOptions.propsData
+    })
+  }
+}
+
+function hasParentTransition (vnode) {
+  while ((vnode = vnode.parent)) {
+    if (vnode.data.transition) {
+      return true
+    }
+  }
+}
+
+function isSameChild (child, oldChild) {
+  return oldChild.key === child.key && oldChild.tag === child.tag
+}
+
+var Transition = {
+  name: 'transition',
+  props: transitionProps,
+  abstract: true,
+
+  render: function render (h) {
+    var this$1 = this;
+
+    var children = this.$slots.default;
+    if (!children) {
+      return
+    }
+
+    // filter out text nodes (possible whitespaces)
+    children = children.filter(function (c) { return c.tag || isAsyncPlaceholder(c); });
+    /* istanbul ignore if */
+    if (!children.length) {
+      return
+    }
+
+    // warn multiple elements
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && children.length > 1) {
+      warn(
+        '<transition> can only be used on a single element. Use ' +
+        '<transition-group> for lists.',
+        this.$parent
+      );
+    }
+
+    var mode = this.mode;
+
+    // warn invalid mode
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+      mode && mode !== 'in-out' && mode !== 'out-in'
+    ) {
+      warn(
+        'invalid <transition> mode: ' + mode,
+        this.$parent
+      );
+    }
+
+    var rawChild = children[0];
+
+    // if this is a component root node and the component's
+    // parent container node also has transition, skip.
+    if (hasParentTransition(this.$vnode)) {
+      return rawChild
+    }
+
+    // apply transition data to child
+    // use getRealChild() to ignore abstract components e.g. keep-alive
+    var child = getRealChild(rawChild);
+    /* istanbul ignore if */
+    if (!child) {
+      return rawChild
+    }
+
+    if (this._leaving) {
+      return placeholder(h, rawChild)
+    }
+
+    // ensure a key that is unique to the vnode type and to this transition
+    // component instance. This key will be used to remove pending leaving nodes
+    // during entering.
+    var id = "__transition-" + (this._uid) + "-";
+    child.key = child.key == null
+      ? child.isComment
+        ? id + 'comment'
+        : id + child.tag
+      : isPrimitive(child.key)
+        ? (String(child.key).indexOf(id) === 0 ? child.key : id + child.key)
+        : child.key;
+
+    var data = (child.data || (child.data = {})).transition = extractTransitionData(this);
+    var oldRawChild = this._vnode;
+    var oldChild = getRealChild(oldRawChild);
+
+    // mark v-show
+    // so that the transition module can hand over the control to the directive
+    if (child.data.directives && child.data.directives.some(function (d) { return d.name === 'show'; })) {
+      child.data.show = true;
+    }
+
+    if (
+      oldChild &&
+      oldChild.data &&
+      !isSameChild(child, oldChild) &&
+      !isAsyncPlaceholder(oldChild) &&
+      // #6687 component root is a comment node
+      !(oldChild.componentInstance && oldChild.componentInstance._vnode.isComment)
+    ) {
+      // replace old child transition data with fresh one
+      // important for dynamic transitions!
+      var oldData = oldChild.data.transition = extend({}, data);
+      // handle transition mode
+      if (mode === 'out-in') {
+        // return placeholder node and queue update when leave finishes
+        this._leaving = true;
+        mergeVNodeHook(oldData, 'afterLeave', function () {
+          this$1._leaving = false;
+          this$1.$forceUpdate();
+        });
+        return placeholder(h, rawChild)
+      } else if (mode === 'in-out') {
+        if (isAsyncPlaceholder(child)) {
+          return oldRawChild
+        }
+        var delayedLeave;
+        var performLeave = function () { delayedLeave(); };
+        mergeVNodeHook(data, 'afterEnter', performLeave);
+        mergeVNodeHook(data, 'enterCancelled', performLeave);
+        mergeVNodeHook(oldData, 'delayLeave', function (leave) { delayedLeave = leave; });
+      }
+    }
+
+    return rawChild
+  }
+}
+
+/*  */
+
+// Provides transition support for list items.
+// supports move transitions using the FLIP technique.
+
+// Because the vdom's children update algorithm is "unstable" - i.e.
+// it doesn't guarantee the relative positioning of removed elements,
+// we force transition-group to update its children into two passes:
+// in the first pass, we remove all nodes that need to be removed,
+// triggering their leaving transition; in the second pass, we insert/move
+// into the final desired state. This way in the second pass removed
+// nodes will remain where they should be.
+
+var props = extend({
+  tag: String,
+  moveClass: String
+}, transitionProps);
+
+delete props.mode;
+
+var TransitionGroup = {
+  props: props,
+
+  render: function render (h) {
+    var tag = this.tag || this.$vnode.data.tag || 'span';
+    var map = Object.create(null);
+    var prevChildren = this.prevChildren = this.children;
+    var rawChildren = this.$slots.default || [];
+    var children = this.children = [];
+    var transitionData = extractTransitionData(this);
+
+    for (var i = 0; i < rawChildren.length; i++) {
+      var c = rawChildren[i];
+      if (c.tag) {
+        if (c.key != null && String(c.key).indexOf('__vlist') !== 0) {
+          children.push(c);
+          map[c.key] = c
+          ;(c.data || (c.data = {})).transition = transitionData;
+        } else {
+          var opts = c.componentOptions;
+          var name = opts ? (opts.Ctor.options.name || opts.tag || '') : c.tag;
+          warn(("<transition-group> children must be keyed: <" + name + ">"));
+        }
+      }
+    }
+
+    if (prevChildren) {
+      var kept = [];
+      var removed = [];
+      for (var i$1 = 0; i$1 < prevChildren.length; i$1++) {
+        var c$1 = prevChildren[i$1];
+        c$1.data.transition = transitionData;
+        c$1.data.pos = c$1.elm.getBoundingClientRect();
+        if (map[c$1.key]) {
+          kept.push(c$1);
+        } else {
+          removed.push(c$1);
+        }
+      }
+      this.kept = h(tag, null, kept);
+      this.removed = removed;
+    }
+
+    return h(tag, null, children)
+  },
+
+  beforeUpdate: function beforeUpdate () {
+    // force removing pass
+    this.__patch__(
+      this._vnode,
+      this.kept,
+      false, // hydrating
+      true // removeOnly (!important, avoids unnecessary moves)
+    );
+    this._vnode = this.kept;
+  },
+
+  updated: function updated () {
+    var children = this.prevChildren;
+    var moveClass = this.moveClass || ((this.name || 'v') + '-move');
+    if (!children.length || !this.hasMove(children[0].elm, moveClass)) {
+      return
+    }
+
+    // we divide the work into three loops to avoid mixing DOM reads and writes
+    // in each iteration - which helps prevent layout thrashing.
+    children.forEach(callPendingCbs);
+    children.forEach(recordPosition);
+    children.forEach(applyTranslation);
+
+    // force reflow to put everything in position
+    // assign to this to avoid being removed in tree-shaking
+    // $flow-disable-line
+    this._reflow = document.body.offsetHeight;
+
+    children.forEach(function (c) {
+      if (c.data.moved) {
+        var el = c.elm;
+        var s = el.style;
+        addTransitionClass(el, moveClass);
+        s.transform = s.WebkitTransform = s.transitionDuration = '';
+        el.addEventListener(transitionEndEvent, el._moveCb = function cb (e) {
+          if (!e || /transform$/.test(e.propertyName)) {
+            el.removeEventListener(transitionEndEvent, cb);
+            el._moveCb = null;
+            removeTransitionClass(el, moveClass);
+          }
+        });
+      }
+    });
+  },
+
+  methods: {
+    hasMove: function hasMove (el, moveClass) {
+      /* istanbul ignore if */
+      if (!hasTransition) {
+        return false
+      }
+      /* istanbul ignore if */
+      if (this._hasMove) {
+        return this._hasMove
+      }
+      // Detect whether an element with the move class applied has
+      // CSS transitions. Since the element may be inside an entering
+      // transition at this very moment, we make a clone of it and remove
+      // all other transition classes applied to ensure only the move class
+      // is applied.
+      var clone = el.cloneNode();
+      if (el._transitionClasses) {
+        el._transitionClasses.forEach(function (cls) { removeClass(clone, cls); });
+      }
+      addClass(clone, moveClass);
+      clone.style.display = 'none';
+      this.$el.appendChild(clone);
+      var info = getTransitionInfo(clone);
+      this.$el.removeChild(clone);
+      return (this._hasMove = info.hasTransform)
+    }
+  }
+}
+
+function callPendingCbs (c) {
+  /* istanbul ignore if */
+  if (c.elm._moveCb) {
+    c.elm._moveCb();
+  }
+  /* istanbul ignore if */
+  if (c.elm._enterCb) {
+    c.elm._enterCb();
+  }
+}
+
+function recordPosition (c) {
+  c.data.newPos = c.elm.getBoundingClientRect();
+}
+
+function applyTranslation (c) {
+  var oldPos = c.data.pos;
+  var newPos = c.data.newPos;
+  var dx = oldPos.left - newPos.left;
+  var dy = oldPos.top - newPos.top;
+  if (dx || dy) {
+    c.data.moved = true;
+    var s = c.elm.style;
+    s.transform = s.WebkitTransform = "translate(" + dx + "px," + dy + "px)";
+    s.transitionDuration = '0s';
+  }
+}
+
+var platformComponents = {
+  Transition: Transition,
+  TransitionGroup: TransitionGroup
+}
+
+/*  */
+
+// install platform specific utils
+Vue.config.mustUseProp = mustUseProp;
+Vue.config.isReservedTag = isReservedTag;
+Vue.config.isReservedAttr = isReservedAttr;
+Vue.config.getTagNamespace = getTagNamespace;
+Vue.config.isUnknownElement = isUnknownElement;
+
+// install platform runtime directives & components
+extend(Vue.options.directives, platformDirectives);
+extend(Vue.options.components, platformComponents);
+
+// install platform patch function
+Vue.prototype.__patch__ = inBrowser ? patch : noop;
+
+// public mount method
+Vue.prototype.$mount = function (
+  el,
+  hydrating
+) {
+  el = el && inBrowser ? query(el) : undefined;
+  return mountComponent(this, el, hydrating)
+};
+
+// devtools global hook
+/* istanbul ignore next */
+if (inBrowser) {
+  setTimeout(function () {
+    if (config.devtools) {
+      if (devtools) {
+        devtools.emit('init', Vue);
+      } else if (
+        !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+        isChrome
+      ) {
+        // Silently ignore missing devtools extension.
+      }
+    }
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+      config.productionTip !== false &&
+      typeof console !== 'undefined'
+    ) {
+      console[console.info ? 'info' : 'log'](
+        "You are running Sails + Vue.js in development mode.\n" +
+        "(To enable production mode for Vue.js, lift Sails in production.)\n" +
+        " [?] More tips at https://sailsjs.com/docs/concepts/deployment"
+      );
+    }
+  }, 0);
+}
+
+/*  */
+
+var defaultTagRE = /\{\{((?:.|\n)+?)\}\}/g;
+var regexEscapeRE = /[-.*+?^${}()|[\]\/\\]/g;
+
+var buildRegex = cached(function (delimiters) {
+  var open = delimiters[0].replace(regexEscapeRE, '\\$&');
+  var close = delimiters[1].replace(regexEscapeRE, '\\$&');
+  return new RegExp(open + '((?:.|\\n)+?)' + close, 'g')
+});
+
+
+
+function parseText (
+  text,
+  delimiters
+) {
+  var tagRE = delimiters ? buildRegex(delimiters) : defaultTagRE;
+  if (!tagRE.test(text)) {
+    return
+  }
+  var tokens = [];
+  var rawTokens = [];
+  var lastIndex = tagRE.lastIndex = 0;
+  var match, index, tokenValue;
+  while ((match = tagRE.exec(text))) {
+    index = match.index;
+    // push text token
+    if (index > lastIndex) {
+      rawTokens.push(tokenValue = text.slice(lastIndex, index));
+      tokens.push(JSON.stringify(tokenValue));
+    }
+    // tag token
+    var exp = parseFilters(match[1].trim());
+    tokens.push(("_s(" + exp + ")"));
+    rawTokens.push({ '@binding': exp });
+    lastIndex = index + match[0].length;
+  }
+  if (lastIndex < text.length) {
+    rawTokens.push(tokenValue = text.slice(lastIndex));
+    tokens.push(JSON.stringify(tokenValue));
+  }
+  return {
+    expression: tokens.join('+'),
+    tokens: rawTokens
+  }
+}
+
+/*  */
+
+function transformNode (el, options) {
+  var warn = options.warn || baseWarn;
+  var staticClass = getAndRemoveAttr(el, 'class');
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && staticClass) {
+    var res = parseText(staticClass, options.delimiters);
+    if (res) {
+      warn(
+        "class=\"" + staticClass + "\": " +
+        'Interpolation inside attributes has been removed. ' +
+        'Use v-bind or the colon shorthand instead. For example, ' +
+        'instead of <div class="{{ val }}">, use <div :class="val">.'
+      );
+    }
+  }
+  if (staticClass) {
+    el.staticClass = JSON.stringify(staticClass);
+  }
+  var classBinding = getBindingAttr(el, 'class', false /* getStatic */);
+  if (classBinding) {
+    el.classBinding = classBinding;
+  }
+}
+
+function genData (el) {
+  var data = '';
+  if (el.staticClass) {
+    data += "staticClass:" + (el.staticClass) + ",";
+  }
+  if (el.classBinding) {
+    data += "class:" + (el.classBinding) + ",";
+  }
+  return data
+}
+
+var klass$1 = {
+  staticKeys: ['staticClass'],
+  transformNode: transformNode,
+  genData: genData
+}
+
+/*  */
+
+function transformNode$1 (el, options) {
+  var warn = options.warn || baseWarn;
+  var staticStyle = getAndRemoveAttr(el, 'style');
+  if (staticStyle) {
+    /* istanbul ignore if */
+    {
+      var res = parseText(staticStyle, options.delimiters);
+      if (res) {
+        warn(
+          "style=\"" + staticStyle + "\": " +
+          'Interpolation inside attributes has been removed. ' +
+          'Use v-bind or the colon shorthand instead. For example, ' +
+          'instead of <div style="{{ val }}">, use <div :style="val">.'
+        );
+      }
+    }
+    el.staticStyle = JSON.stringify(parseStyleText(staticStyle));
+  }
+
+  var styleBinding = getBindingAttr(el, 'style', false /* getStatic */);
+  if (styleBinding) {
+    el.styleBinding = styleBinding;
+  }
+}
+
+function genData$1 (el) {
+  var data = '';
+  if (el.staticStyle) {
+    data += "staticStyle:" + (el.staticStyle) + ",";
+  }
+  if (el.styleBinding) {
+    data += "style:(" + (el.styleBinding) + "),";
+  }
+  return data
+}
+
+var style$1 = {
+  staticKeys: ['staticStyle'],
+  transformNode: transformNode$1,
+  genData: genData$1
+}
+
+/*  */
+
+var decoder;
+
+var he = {
+  decode: function decode (html) {
+    decoder = decoder || document.createElement('div');
+    decoder.innerHTML = html;
+    return decoder.textContent
+  }
+}
+
+/*  */
+
+var isUnaryTag = makeMap(
+  'area,base,br,col,embed,frame,hr,img,input,isindex,keygen,' +
+  'link,meta,param,source,track,wbr'
+);
+
+// Elements that you can, intentionally, leave open
+// (and which close themselves)
+var canBeLeftOpenTag = makeMap(
+  'colgroup,dd,dt,li,options,p,td,tfoot,th,thead,tr,source'
+);
+
+// HTML5 tags https://html.spec.whatwg.org/multipage/indices.html#elements-3
+// Phrasing Content https://html.spec.whatwg.org/multipage/dom.html#phrasing-content
+var isNonPhrasingTag = makeMap(
+  'address,article,aside,base,blockquote,body,caption,col,colgroup,dd,' +
+  'details,dialog,div,dl,dt,fieldset,figcaption,figure,footer,form,' +
+  'h1,h2,h3,h4,h5,h6,head,header,hgroup,hr,html,legend,li,menuitem,meta,' +
+  'optgroup,option,param,rp,rt,source,style,summary,tbody,td,tfoot,th,thead,' +
+  'title,tr,track'
+);
+
+/**
+ * Not type-checking this file because it's mostly vendor code.
+ */
+
+/*!
+ * HTML Parser By John Resig (ejohn.org)
+ * Modified by Juriy "kangax" Zaytsev
+ * Original code by Erik Arvidsson, Mozilla Public License
+ * http://erik.eae.net/simplehtmlparser/simplehtmlparser.js
+ */
+
+// Regular Expressions for parsing tags and attributes
+var attribute = /^\s*([^\s"'<>\/=]+)(?:\s*(=)\s*(?:"([^"]*)"+|'([^']*)'+|([^\s"'=<>`]+)))?/;
+// could use https://www.w3.org/TR/1999/REC-xml-names-19990114/#NT-QName
+// but for Vue templates we can enforce a simple charset
+var ncname = '[a-zA-Z_][\\w\\-\\.]*';
+var qnameCapture = "((?:" + ncname + "\\:)?" + ncname + ")";
+var startTagOpen = new RegExp(("^<" + qnameCapture));
+var startTagClose = /^\s*(\/?)>/;
+var endTag = new RegExp(("^<\\/" + qnameCapture + "[^>]*>"));
+var doctype = /^<!DOCTYPE [^>]+>/i;
+// #7298: escape - to avoid being pased as HTML comment when inlined in page
+var comment = /^<!\--/;
+var conditionalComment = /^<!\[/;
+
+var IS_REGEX_CAPTURING_BROKEN = false;
+'x'.replace(/x(.)?/g, function (m, g) {
+  IS_REGEX_CAPTURING_BROKEN = g === '';
+});
+
+// Special Elements (can contain anything)
+var isPlainTextElement = makeMap('script,style,textarea', true);
+var reCache = {};
+
+var decodingMap = {
+  '&lt;': '<',
+  '&gt;': '>',
+  '&quot;': '"',
+  '&amp;': '&',
+  '&#10;': '\n',
+  '&#9;': '\t'
+};
+var encodedAttr = /&(?:lt|gt|quot|amp);/g;
+var encodedAttrWithNewLines = /&(?:lt|gt|quot|amp|#10|#9);/g;
+
+// #5992
+var isIgnoreNewlineTag = makeMap('pre,textarea', true);
+var shouldIgnoreFirstNewline = function (tag, html) { return tag && isIgnoreNewlineTag(tag) && html[0] === '\n'; };
+
+function decodeAttr (value, shouldDecodeNewlines) {
+  var re = shouldDecodeNewlines ? encodedAttrWithNewLines : encodedAttr;
+  return value.replace(re, function (match) { return decodingMap[match]; })
+}
+
+function parseHTML (html, options) {
+  var stack = [];
+  var expectHTML = options.expectHTML;
+  var isUnaryTag$$1 = options.isUnaryTag || no;
+  var canBeLeftOpenTag$$1 = options.canBeLeftOpenTag || no;
+  var index = 0;
+  var last, lastTag;
+  while (html) {
+    last = html;
+    // Make sure we're not in a plaintext content element like script/style
+    if (!lastTag || !isPlainTextElement(lastTag)) {
+      var textEnd = html.indexOf('<');
+      if (textEnd === 0) {
+        // Comment:
+        if (comment.test(html)) {
+          var commentEnd = html.indexOf('-->');
+
+          if (commentEnd >= 0) {
+            if (options.shouldKeepComment) {
+              options.comment(html.substring(4, commentEnd));
+            }
+            advance(commentEnd + 3);
+            continue
+          }
+        }
+
+        // http://en.wikipedia.org/wiki/Conditional_comment#Downlevel-revealed_conditional_comment
+        if (conditionalComment.test(html)) {
+          var conditionalEnd = html.indexOf(']>');
+
+          if (conditionalEnd >= 0) {
+            advance(conditionalEnd + 2);
+            continue
+          }
+        }
+
+        // Doctype:
+        var doctypeMatch = html.match(doctype);
+        if (doctypeMatch) {
+          advance(doctypeMatch[0].length);
+          continue
+        }
+
+        // End tag:
+        var endTagMatch = html.match(endTag);
+        if (endTagMatch) {
+          var curIndex = index;
+          advance(endTagMatch[0].length);
+          parseEndTag(endTagMatch[1], curIndex, index);
+          continue
+        }
+
+        // Start tag:
+        var startTagMatch = parseStartTag();
+        if (startTagMatch) {
+          handleStartTag(startTagMatch);
+          if (shouldIgnoreFirstNewline(lastTag, html)) {
+            advance(1);
+          }
+          continue
+        }
+      }
+
+      var text = (void 0), rest = (void 0), next = (void 0);
+      if (textEnd >= 0) {
+        rest = html.slice(textEnd);
+        while (
+          !endTag.test(rest) &&
+          !startTagOpen.test(rest) &&
+          !comment.test(rest) &&
+          !conditionalComment.test(rest)
+        ) {
+          // < in plain text, be forgiving and treat it as text
+          next = rest.indexOf('<', 1);
+          if (next < 0) { break }
+          textEnd += next;
+          rest = html.slice(textEnd);
+        }
+        text = html.substring(0, textEnd);
+        advance(textEnd);
+      }
+
+      if (textEnd < 0) {
+        text = html;
+        html = '';
+      }
+
+      if (options.chars && text) {
+        options.chars(text);
+      }
+    } else {
+      var endTagLength = 0;
+      var stackedTag = lastTag.toLowerCase();
+      var reStackedTag = reCache[stackedTag] || (reCache[stackedTag] = new RegExp('([\\s\\S]*?)(</' + stackedTag + '[^>]*>)', 'i'));
+      var rest$1 = html.replace(reStackedTag, function (all, text, endTag) {
+        endTagLength = endTag.length;
+        if (!isPlainTextElement(stackedTag) && stackedTag !== 'noscript') {
+          text = text
+            .replace(/<!\--([\s\S]*?)-->/g, '$1') // #7298
+            .replace(/<!\[CDATA\[([\s\S]*?)]]>/g, '$1');
+        }
+        if (shouldIgnoreFirstNewline(stackedTag, text)) {
+          text = text.slice(1);
+        }
+        if (options.chars) {
+          options.chars(text);
+        }
+        return ''
+      });
+      index += html.length - rest$1.length;
+      html = rest$1;
+      parseEndTag(stackedTag, index - endTagLength, index);
+    }
+
+    if (html === last) {
+      options.chars && options.chars(html);
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && !stack.length && options.warn) {
+        options.warn(("Mal-formatted tag at end of template: \"" + html + "\""));
+      }
+      break
+    }
+  }
+
+  // Clean up any remaining tags
+  parseEndTag();
+
+  function advance (n) {
+    index += n;
+    html = html.substring(n);
+  }
+
+  function parseStartTag () {
+    var start = html.match(startTagOpen);
+    if (start) {
+      var match = {
+        tagName: start[1],
+        attrs: [],
+        start: index
+      };
+      advance(start[0].length);
+      var end, attr;
+      while (!(end = html.match(startTagClose)) && (attr = html.match(attribute))) {
+        advance(attr[0].length);
+        match.attrs.push(attr);
+      }
+      if (end) {
+        match.unarySlash = end[1];
+        advance(end[0].length);
+        match.end = index;
+        return match
+      }
+    }
+  }
+
+  function handleStartTag (match) {
+    var tagName = match.tagName;
+    var unarySlash = match.unarySlash;
+
+    if (expectHTML) {
+      if (lastTag === 'p' && isNonPhrasingTag(tagName)) {
+        parseEndTag(lastTag);
+      }
+      if (canBeLeftOpenTag$$1(tagName) && lastTag === tagName) {
+        parseEndTag(tagName);
+      }
+    }
+
+    var unary = isUnaryTag$$1(tagName) || !!unarySlash;
+
+    var l = match.attrs.length;
+    var attrs = new Array(l);
+    for (var i = 0; i < l; i++) {
+      var args = match.attrs[i];
+      // hackish work around FF bug https://bugzilla.mozilla.org/show_bug.cgi?id=369778
+      if (IS_REGEX_CAPTURING_BROKEN && args[0].indexOf('""') === -1) {
+        if (args[3] === '') { delete args[3]; }
+        if (args[4] === '') { delete args[4]; }
+        if (args[5] === '') { delete args[5]; }
+      }
+      var value = args[3] || args[4] || args[5] || '';
+      var shouldDecodeNewlines = tagName === 'a' && args[1] === 'href'
+        ? options.shouldDecodeNewlinesForHref
+        : options.shouldDecodeNewlines;
+      attrs[i] = {
+        name: args[1],
+        value: decodeAttr(value, shouldDecodeNewlines)
+      };
+    }
+
+    if (!unary) {
+      stack.push({ tag: tagName, lowerCasedTag: tagName.toLowerCase(), attrs: attrs });
+      lastTag = tagName;
+    }
+
+    if (options.start) {
+      options.start(tagName, attrs, unary, match.start, match.end);
+    }
+  }
+
+  function parseEndTag (tagName, start, end) {
+    var pos, lowerCasedTagName;
+    if (start == null) { start = index; }
+    if (end == null) { end = index; }
+
+    if (tagName) {
+      lowerCasedTagName = tagName.toLowerCase();
+    }
+
+    // Find the closest opened tag of the same type
+    if (tagName) {
+      for (pos = stack.length - 1; pos >= 0; pos--) {
+        if (stack[pos].lowerCasedTag === lowerCasedTagName) {
+          break
+        }
+      }
+    } else {
+      // If no tag name is provided, clean shop
+      pos = 0;
+    }
+
+    if (pos >= 0) {
+      // Close all the open elements, up the stack
+      for (var i = stack.length - 1; i >= pos; i--) {
+        if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+          (i > pos || !tagName) &&
+          options.warn
+        ) {
+          options.warn(
+            ("tag <" + (stack[i].tag) + "> has no matching end tag.")
+          );
+        }
+        if (options.end) {
+          options.end(stack[i].tag, start, end);
+        }
+      }
+
+      // Remove the open elements from the stack
+      stack.length = pos;
+      lastTag = pos && stack[pos - 1].tag;
+    } else if (lowerCasedTagName === 'br') {
+      if (options.start) {
+        options.start(tagName, [], true, start, end);
+      }
+    } else if (lowerCasedTagName === 'p') {
+      if (options.start) {
+        options.start(tagName, [], false, start, end);
+      }
+      if (options.end) {
+        options.end(tagName, start, end);
+      }
+    }
+  }
+}
+
+/*  */
+
+var onRE = /^@|^v-on:/;
+var dirRE = /^v-|^@|^:/;
+var forAliasRE = /([^]*?)\s+(?:in|of)\s+([^]*)/;
+var forIteratorRE = /,([^,\}\]]*)(?:,([^,\}\]]*))?$/;
+var stripParensRE = /^\(|\)$/g;
+
+var argRE = /:(.*)$/;
+var bindRE = /^:|^v-bind:/;
+var modifierRE = /\.[^.]+/g;
+
+var decodeHTMLCached = cached(he.decode);
+
+// configurable state
+var warn$2;
+var delimiters;
+var transforms;
+var preTransforms;
+var postTransforms;
+var platformIsPreTag;
+var platformMustUseProp;
+var platformGetTagNamespace;
+
+
+
+function createASTElement (
+  tag,
+  attrs,
+  parent
+) {
+  return {
+    type: 1,
+    tag: tag,
+    attrsList: attrs,
+    attrsMap: makeAttrsMap(attrs),
+    parent: parent,
+    children: []
+  }
+}
+
+/**
+ * Convert HTML string to AST.
+ */
+function parse (
+  template,
+  options
+) {
+  warn$2 = options.warn || baseWarn;
+
+  platformIsPreTag = options.isPreTag || no;
+  platformMustUseProp = options.mustUseProp || no;
+  platformGetTagNamespace = options.getTagNamespace || no;
+
+  transforms = pluckModuleFunction(options.modules, 'transformNode');
+  preTransforms = pluckModuleFunction(options.modules, 'preTransformNode');
+  postTransforms = pluckModuleFunction(options.modules, 'postTransformNode');
+
+  delimiters = options.delimiters;
+
+  var stack = [];
+  var preserveWhitespace = options.preserveWhitespace !== false;
+  var root;
+  var currentParent;
+  var inVPre = false;
+  var inPre = false;
+  var warned = false;
+
+  function warnOnce (msg) {
+    if (!warned) {
+      warned = true;
+      warn$2(msg);
+    }
+  }
+
+  function closeElement (element) {
+    // check pre state
+    if (element.pre) {
+      inVPre = false;
+    }
+    if (platformIsPreTag(element.tag)) {
+      inPre = false;
+    }
+    // apply post-transforms
+    for (var i = 0; i < postTransforms.length; i++) {
+      postTransforms[i](element, options);
+    }
+  }
+
+  parseHTML(template, {
+    warn: warn$2,
+    expectHTML: options.expectHTML,
+    isUnaryTag: options.isUnaryTag,
+    canBeLeftOpenTag: options.canBeLeftOpenTag,
+    shouldDecodeNewlines: options.shouldDecodeNewlines,
+    shouldDecodeNewlinesForHref: options.shouldDecodeNewlinesForHref,
+    shouldKeepComment: options.comments,
+    start: function start (tag, attrs, unary) {
+      // check namespace.
+      // inherit parent ns if there is one
+      var ns = (currentParent && currentParent.ns) || platformGetTagNamespace(tag);
+
+      // handle IE svg bug
+      /* istanbul ignore if */
+      if (isIE && ns === 'svg') {
+        attrs = guardIESVGBug(attrs);
+      }
+
+      var element = createASTElement(tag, attrs, currentParent);
+      if (ns) {
+        element.ns = ns;
+      }
+
+      if (isForbiddenTag(element) && !isServerRendering()) {
+        element.forbidden = true;
+        !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn$2(
+          'Templates should only be responsible for mapping the state to the ' +
+          'UI. Avoid placing tags with side-effects in your templates, such as ' +
+          "<" + tag + ">" + ', as they will not be parsed.'
+        );
+      }
+
+      // apply pre-transforms
+      for (var i = 0; i < preTransforms.length; i++) {
+        element = preTransforms[i](element, options) || element;
+      }
+
+      if (!inVPre) {
+        processPre(element);
+        if (element.pre) {
+          inVPre = true;
+        }
+      }
+      if (platformIsPreTag(element.tag)) {
+        inPre = true;
+      }
+      if (inVPre) {
+        processRawAttrs(element);
+      } else if (!element.processed) {
+        // structural directives
+        processFor(element);
+        processIf(element);
+        processOnce(element);
+        // element-scope stuff
+        processElement(element, options);
+      }
+
+      function checkRootConstraints (el) {
+        {
+          if (el.tag === 'slot' || el.tag === 'template') {
+            warnOnce(
+              "Cannot use <" + (el.tag) + "> as component root element because it may " +
+              'contain multiple nodes.'
+            );
+          }
+          if (el.attrsMap.hasOwnProperty('v-for')) {
+            warnOnce(
+              'Cannot use v-for on stateful component root element because ' +
+              'it renders multiple elements.'
+            );
+          }
+        }
+      }
+
+      // tree management
+      if (!root) {
+        root = element;
+        checkRootConstraints(root);
+      } else if (!stack.length) {
+        // allow root elements with v-if, v-else-if and v-else
+        if (root.if && (element.elseif || element.else)) {
+          checkRootConstraints(element);
+          addIfCondition(root, {
+            exp: element.elseif,
+            block: element
+          });
+        } else {
+          warnOnce(
+            "Component template should contain exactly one root element. " +
+            "If you are using v-if on multiple elements, " +
+            "use v-else-if to chain them instead."
+          );
+        }
+      }
+      if (currentParent && !element.forbidden) {
+        if (element.elseif || element.else) {
+          processIfConditions(element, currentParent);
+        } else if (element.slotScope) { // scoped slot
+          currentParent.plain = false;
+          var name = element.slotTarget || '"default"';(currentParent.scopedSlots || (currentParent.scopedSlots = {}))[name] = element;
+        } else {
+          currentParent.children.push(element);
+          element.parent = currentParent;
+        }
+      }
+      if (!unary) {
+        currentParent = element;
+        stack.push(element);
+      } else {
+        closeElement(element);
+      }
+    },
+
+    end: function end () {
+      // remove trailing whitespace
+      var element = stack[stack.length - 1];
+      var lastNode = element.children[element.children.length - 1];
+      if (lastNode && lastNode.type === 3 && lastNode.text === ' ' && !inPre) {
+        element.children.pop();
+      }
+      // pop stack
+      stack.length -= 1;
+      currentParent = stack[stack.length - 1];
+      closeElement(element);
+    },
+
+    chars: function chars (text) {
+      if (!currentParent) {
+        {
+          if (text === template) {
+            warnOnce(
+              'Component template requires a root element, rather than just text.'
+            );
+          } else if ((text = text.trim())) {
+            warnOnce(
+              ("text \"" + text + "\" outside root element will be ignored.")
+            );
+          }
+        }
+        return
+      }
+      // IE textarea placeholder bug
+      /* istanbul ignore if */
+      if (isIE &&
+        currentParent.tag === 'textarea' &&
+        currentParent.attrsMap.placeholder === text
+      ) {
+        return
+      }
+      var children = currentParent.children;
+      text = inPre || text.trim()
+        ? isTextTag(currentParent) ? text : decodeHTMLCached(text)
+        // only preserve whitespace if its not right after a starting tag
+        : preserveWhitespace && children.length ? ' ' : '';
+      if (text) {
+        var res;
+        if (!inVPre && text !== ' ' && (res = parseText(text, delimiters))) {
+          children.push({
+            type: 2,
+            expression: res.expression,
+            tokens: res.tokens,
+            text: text
+          });
+        } else if (text !== ' ' || !children.length || children[children.length - 1].text !== ' ') {
+          children.push({
+            type: 3,
+            text: text
+          });
+        }
+      }
+    },
+    comment: function comment (text) {
+      currentParent.children.push({
+        type: 3,
+        text: text,
+        isComment: true
+      });
+    }
+  });
+  return root
+}
+
+function processPre (el) {
+  if (getAndRemoveAttr(el, 'v-pre') != null) {
+    el.pre = true;
+  }
+}
+
+function processRawAttrs (el) {
+  var l = el.attrsList.length;
+  if (l) {
+    var attrs = el.attrs = new Array(l);
+    for (var i = 0; i < l; i++) {
+      attrs[i] = {
+        name: el.attrsList[i].name,
+        value: JSON.stringify(el.attrsList[i].value)
+      };
+    }
+  } else if (!el.pre) {
+    // non root node in pre blocks with no attributes
+    el.plain = true;
+  }
+}
+
+function processElement (element, options) {
+  processKey(element);
+
+  // determine whether this is a plain element after
+  // removing structural attributes
+  element.plain = !element.key && !element.attrsList.length;
+
+  processRef(element);
+  processSlot(element);
+  processComponent(element);
+  for (var i = 0; i < transforms.length; i++) {
+    element = transforms[i](element, options) || element;
+  }
+  processAttrs(element);
+}
+
+function processKey (el) {
+  var exp = getBindingAttr(el, 'key');
+  if (exp) {
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && el.tag === 'template') {
+      warn$2("<template> cannot be keyed. Place the key on real elements instead.");
+    }
+    el.key = exp;
+  }
+}
+
+function processRef (el) {
+  var ref = getBindingAttr(el, 'ref');
+  if (ref) {
+    el.ref = ref;
+    el.refInFor = checkInFor(el);
+  }
+}
+
+function processFor (el) {
+  var exp;
+  if ((exp = getAndRemoveAttr(el, 'v-for'))) {
+    var res = parseFor(exp);
+    if (res) {
+      extend(el, res);
+    } else {
+      warn$2(
+        ("Invalid v-for expression: " + exp)
+      );
+    }
+  }
+}
+
+
+
+function parseFor (exp) {
+  var inMatch = exp.match(forAliasRE);
+  if (!inMatch) { return }
+  var res = {};
+  res.for = inMatch[2].trim();
+  var alias = inMatch[1].trim().replace(stripParensRE, '');
+  var iteratorMatch = alias.match(forIteratorRE);
+  if (iteratorMatch) {
+    res.alias = alias.replace(forIteratorRE, '');
+    res.iterator1 = iteratorMatch[1].trim();
+    if (iteratorMatch[2]) {
+      res.iterator2 = iteratorMatch[2].trim();
+    }
+  } else {
+    res.alias = alias;
+  }
+  return res
+}
+
+function processIf (el) {
+  var exp = getAndRemoveAttr(el, 'v-if');
+  if (exp) {
+    el.if = exp;
+    addIfCondition(el, {
+      exp: exp,
+      block: el
+    });
+  } else {
+    if (getAndRemoveAttr(el, 'v-else') != null) {
+      el.else = true;
+    }
+    var elseif = getAndRemoveAttr(el, 'v-else-if');
+    if (elseif) {
+      el.elseif = elseif;
+    }
+  }
+}
+
+function processIfConditions (el, parent) {
+  var prev = findPrevElement(parent.children);
+  if (prev && prev.if) {
+    addIfCondition(prev, {
+      exp: el.elseif,
+      block: el
+    });
+  } else {
+    warn$2(
+      "v-" + (el.elseif ? ('else-if="' + el.elseif + '"') : 'else') + " " +
+      "used on element <" + (el.tag) + "> without corresponding v-if."
+    );
+  }
+}
+
+function findPrevElement (children) {
+  var i = children.length;
+  while (i--) {
+    if (children[i].type === 1) {
+      return children[i]
+    } else {
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && children[i].text !== ' ') {
+        warn$2(
+          "text \"" + (children[i].text.trim()) + "\" between v-if and v-else(-if) " +
+          "will be ignored."
+        );
+      }
+      children.pop();
+    }
+  }
+}
+
+function addIfCondition (el, condition) {
+  if (!el.ifConditions) {
+    el.ifConditions = [];
+  }
+  el.ifConditions.push(condition);
+}
+
+function processOnce (el) {
+  var once$$1 = getAndRemoveAttr(el, 'v-once');
+  if (once$$1 != null) {
+    el.once = true;
+  }
+}
+
+function processSlot (el) {
+  if (el.tag === 'slot') {
+    el.slotName = getBindingAttr(el, 'name');
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && el.key) {
+      warn$2(
+        "`key` does not work on <slot> because slots are abstract outlets " +
+        "and can possibly expand into multiple elements. " +
+        "Use the key on a wrapping element instead."
+      );
+    }
+  } else {
+    var slotScope;
+    if (el.tag === 'template') {
+      slotScope = getAndRemoveAttr(el, 'scope');
+      /* istanbul ignore if */
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && slotScope) {
+        warn$2(
+          "the \"scope\" attribute for scoped slots have been deprecated and " +
+          "replaced by \"slot-scope\" since 2.5. The new \"slot-scope\" attribute " +
+          "can also be used on plain elements in addition to <template> to " +
+          "denote scoped slots.",
+          true
+        );
+      }
+      el.slotScope = slotScope || getAndRemoveAttr(el, 'slot-scope');
+    } else if ((slotScope = getAndRemoveAttr(el, 'slot-scope'))) {
+      /* istanbul ignore if */
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && el.attrsMap['v-for']) {
+        warn$2(
+          "Ambiguous combined usage of slot-scope and v-for on <" + (el.tag) + "> " +
+          "(v-for takes higher priority). Use a wrapper <template> for the " +
+          "scoped slot to make it clearer.",
+          true
+        );
+      }
+      el.slotScope = slotScope;
+    }
+    var slotTarget = getBindingAttr(el, 'slot');
+    if (slotTarget) {
+      el.slotTarget = slotTarget === '""' ? '"default"' : slotTarget;
+      // preserve slot as an attribute for native shadow DOM compat
+      // only for non-scoped slots.
+      if (el.tag !== 'template' && !el.slotScope) {
+        addAttr(el, 'slot', slotTarget);
+      }
+    }
+  }
+}
+
+function processComponent (el) {
+  var binding;
+  if ((binding = getBindingAttr(el, 'is'))) {
+    el.component = binding;
+  }
+  if (getAndRemoveAttr(el, 'inline-template') != null) {
+    el.inlineTemplate = true;
+  }
+}
+
+function processAttrs (el) {
+  var list = el.attrsList;
+  var i, l, name, rawName, value, modifiers, isProp;
+  for (i = 0, l = list.length; i < l; i++) {
+    name = rawName = list[i].name;
+    value = list[i].value;
+    if (dirRE.test(name)) {
+      // mark element as dynamic
+      el.hasBindings = true;
+      // modifiers
+      modifiers = parseModifiers(name);
+      if (modifiers) {
+        name = name.replace(modifierRE, '');
+      }
+      if (bindRE.test(name)) { // v-bind
+        name = name.replace(bindRE, '');
+        value = parseFilters(value);
+        isProp = false;
+        if (modifiers) {
+          if (modifiers.prop) {
+            isProp = true;
+            name = camelize(name);
+            if (name === 'innerHtml') { name = 'innerHTML'; }
+          }
+          if (modifiers.camel) {
+            name = camelize(name);
+          }
+          if (modifiers.sync) {
+            addHandler(
+              el,
+              ("update:" + (camelize(name))),
+              genAssignmentCode(value, "$event")
+            );
+          }
+        }
+        if (isProp || (
+          !el.component && platformMustUseProp(el.tag, el.attrsMap.type, name)
+        )) {
+          addProp(el, name, value);
+        } else {
+          addAttr(el, name, value);
+        }
+      } else if (onRE.test(name)) { // v-on
+        name = name.replace(onRE, '');
+        addHandler(el, name, value, modifiers, false, warn$2);
+      } else { // normal directives
+        name = name.replace(dirRE, '');
+        // parse arg
+        var argMatch = name.match(argRE);
+        var arg = argMatch && argMatch[1];
+        if (arg) {
+          name = name.slice(0, -(arg.length + 1));
+        }
+        addDirective(el, name, rawName, value, arg, modifiers);
+        if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && name === 'model') {
+          checkForAliasModel(el, value);
+        }
+      }
+    } else {
+      // literal attribute
+      {
+        var res = parseText(value, delimiters);
+        if (res) {
+          warn$2(
+            name + "=\"" + value + "\": " +
+            'Interpolation inside attributes has been removed. ' +
+            'Use v-bind or the colon shorthand instead. For example, ' +
+            'instead of <div id="{{ val }}">, use <div :id="val">.'
+          );
+        }
+      }
+      addAttr(el, name, JSON.stringify(value));
+      // #6887 firefox doesn't update muted state if set via attribute
+      // even immediately after element creation
+      if (!el.component &&
+          name === 'muted' &&
+          platformMustUseProp(el.tag, el.attrsMap.type, name)) {
+        addProp(el, name, 'true');
+      }
+    }
+  }
+}
+
+function checkInFor (el) {
+  var parent = el;
+  while (parent) {
+    if (parent.for !== undefined) {
+      return true
+    }
+    parent = parent.parent;
+  }
+  return false
+}
+
+function parseModifiers (name) {
+  var match = name.match(modifierRE);
+  if (match) {
+    var ret = {};
+    match.forEach(function (m) { ret[m.slice(1)] = true; });
+    return ret
+  }
+}
+
+function makeAttrsMap (attrs) {
+  var map = {};
+  for (var i = 0, l = attrs.length; i < l; i++) {
+    if (
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+      map[attrs[i].name] && !isIE && !isEdge
+    ) {
+      warn$2('duplicate attribute: ' + attrs[i].name);
+    }
+    map[attrs[i].name] = attrs[i].value;
+  }
+  return map
+}
+
+// for script (e.g. type="x/template") or style, do not decode content
+function isTextTag (el) {
+  return el.tag === 'script' || el.tag === 'style'
+}
+
+function isForbiddenTag (el) {
+  return (
+    el.tag === 'style' ||
+    (el.tag === 'script' && (
+      !el.attrsMap.type ||
+      el.attrsMap.type === 'text/javascript'
+    ))
+  )
+}
+
+var ieNSBug = /^xmlns:NS\d+/;
+var ieNSPrefix = /^NS\d+:/;
+
+/* istanbul ignore next */
+function guardIESVGBug (attrs) {
+  var res = [];
+  for (var i = 0; i < attrs.length; i++) {
+    var attr = attrs[i];
+    if (!ieNSBug.test(attr.name)) {
+      attr.name = attr.name.replace(ieNSPrefix, '');
+      res.push(attr);
+    }
+  }
+  return res
+}
+
+function checkForAliasModel (el, value) {
+  var _el = el;
+  while (_el) {
+    if (_el.for && _el.alias === value) {
+      warn$2(
+        "<" + (el.tag) + " v-model=\"" + value + "\">: " +
+        "You are binding v-model directly to a v-for iteration alias. " +
+        "This will not be able to modify the v-for source array because " +
+        "writing to the alias is like modifying a function local variable. " +
+        "Consider using an array of objects and use v-model on an object property instead."
+      );
+    }
+    _el = _el.parent;
+  }
+}
+
+/*  */
+
+/**
+ * Expand input[v-model] with dyanmic type bindings into v-if-else chains
+ * Turn this:
+ *   <input v-model="data[type]" :type="type">
+ * into this:
+ *   <input v-if="type === 'checkbox'" type="checkbox" v-model="data[type]">
+ *   <input v-else-if="type === 'radio'" type="radio" v-model="data[type]">
+ *   <input v-else :type="type" v-model="data[type]">
+ */
+
+function preTransformNode (el, options) {
+  if (el.tag === 'input') {
+    var map = el.attrsMap;
+    if (!map['v-model']) {
+      return
+    }
+
+    var typeBinding;
+    if (map[':type'] || map['v-bind:type']) {
+      typeBinding = getBindingAttr(el, 'type');
+    }
+    if (!map.type && !typeBinding && map['v-bind']) {
+      typeBinding = "(" + (map['v-bind']) + ").type";
+    }
+
+    if (typeBinding) {
+      var ifCondition = getAndRemoveAttr(el, 'v-if', true);
+      var ifConditionExtra = ifCondition ? ("&&(" + ifCondition + ")") : "";
+      var hasElse = getAndRemoveAttr(el, 'v-else', true) != null;
+      var elseIfCondition = getAndRemoveAttr(el, 'v-else-if', true);
+      // 1. checkbox
+      var branch0 = cloneASTElement(el);
+      // process for on the main node
+      processFor(branch0);
+      addRawAttr(branch0, 'type', 'checkbox');
+      processElement(branch0, options);
+      branch0.processed = true; // prevent it from double-processed
+      branch0.if = "(" + typeBinding + ")==='checkbox'" + ifConditionExtra;
+      addIfCondition(branch0, {
+        exp: branch0.if,
+        block: branch0
+      });
+      // 2. add radio else-if condition
+      var branch1 = cloneASTElement(el);
+      getAndRemoveAttr(branch1, 'v-for', true);
+      addRawAttr(branch1, 'type', 'radio');
+      processElement(branch1, options);
+      addIfCondition(branch0, {
+        exp: "(" + typeBinding + ")==='radio'" + ifConditionExtra,
+        block: branch1
+      });
+      // 3. other
+      var branch2 = cloneASTElement(el);
+      getAndRemoveAttr(branch2, 'v-for', true);
+      addRawAttr(branch2, ':type', typeBinding);
+      processElement(branch2, options);
+      addIfCondition(branch0, {
+        exp: ifCondition,
+        block: branch2
+      });
+
+      if (hasElse) {
+        branch0.else = true;
+      } else if (elseIfCondition) {
+        branch0.elseif = elseIfCondition;
+      }
+
+      return branch0
+    }
+  }
+}
+
+function cloneASTElement (el) {
+  return createASTElement(el.tag, el.attrsList.slice(), el.parent)
+}
+
+var model$2 = {
+  preTransformNode: preTransformNode
+}
+
+var modules$1 = [
+  klass$1,
+  style$1,
+  model$2
+]
+
+/*  */
+
+function text (el, dir) {
+  if (dir.value) {
+    addProp(el, 'textContent', ("_s(" + (dir.value) + ")"));
+  }
+}
+
+/*  */
+
+function html (el, dir) {
+  if (dir.value) {
+    addProp(el, 'innerHTML', ("_s(" + (dir.value) + ")"));
+  }
+}
+
+var directives$1 = {
+  model: model,
+  text: text,
+  html: html
+}
+
+/*  */
+
+var baseOptions = {
+  expectHTML: true,
+  modules: modules$1,
+  directives: directives$1,
+  isPreTag: isPreTag,
+  isUnaryTag: isUnaryTag,
+  mustUseProp: mustUseProp,
+  canBeLeftOpenTag: canBeLeftOpenTag,
+  isReservedTag: isReservedTag,
+  getTagNamespace: getTagNamespace,
+  staticKeys: genStaticKeys(modules$1)
+};
+
+/*  */
+
+var isStaticKey;
+var isPlatformReservedTag;
+
+var genStaticKeysCached = cached(genStaticKeys$1);
+
+/**
+ * Goal of the optimizer: walk the generated template AST tree
+ * and detect sub-trees that are purely static, i.e. parts of
+ * the DOM that never needs to change.
+ *
+ * Once we detect these sub-trees, we can:
+ *
+ * 1. Hoist them into constants, so that we no longer need to
+ *    create fresh nodes for them on each re-render;
+ * 2. Completely skip them in the patching process.
+ */
+function optimize (root, options) {
+  if (!root) { return }
+  isStaticKey = genStaticKeysCached(options.staticKeys || '');
+  isPlatformReservedTag = options.isReservedTag || no;
+  // first pass: mark all non-static nodes.
+  markStatic$1(root);
+  // second pass: mark static roots.
+  markStaticRoots(root, false);
+}
+
+function genStaticKeys$1 (keys) {
+  return makeMap(
+    'type,tag,attrsList,attrsMap,plain,parent,children,attrs' +
+    (keys ? ',' + keys : '')
+  )
+}
+
+function markStatic$1 (node) {
+  node.static = isStatic(node);
+  if (node.type === 1) {
+    // do not make component slot content static. this avoids
+    // 1. components not able to mutate slot nodes
+    // 2. static slot content fails for hot-reloading
+    if (
+      !isPlatformReservedTag(node.tag) &&
+      node.tag !== 'slot' &&
+      node.attrsMap['inline-template'] == null
+    ) {
+      return
+    }
+    for (var i = 0, l = node.children.length; i < l; i++) {
+      var child = node.children[i];
+      markStatic$1(child);
+      if (!child.static) {
+        node.static = false;
+      }
+    }
+    if (node.ifConditions) {
+      for (var i$1 = 1, l$1 = node.ifConditions.length; i$1 < l$1; i$1++) {
+        var block = node.ifConditions[i$1].block;
+        markStatic$1(block);
+        if (!block.static) {
+          node.static = false;
+        }
+      }
+    }
+  }
+}
+
+function markStaticRoots (node, isInFor) {
+  if (node.type === 1) {
+    if (node.static || node.once) {
+      node.staticInFor = isInFor;
+    }
+    // For a node to qualify as a static root, it should have children that
+    // are not just static text. Otherwise the cost of hoisting out will
+    // outweigh the benefits and it's better off to just always render it fresh.
+    if (node.static && node.children.length && !(
+      node.children.length === 1 &&
+      node.children[0].type === 3
+    )) {
+      node.staticRoot = true;
+      return
+    } else {
+      node.staticRoot = false;
+    }
+    if (node.children) {
+      for (var i = 0, l = node.children.length; i < l; i++) {
+        markStaticRoots(node.children[i], isInFor || !!node.for);
+      }
+    }
+    if (node.ifConditions) {
+      for (var i$1 = 1, l$1 = node.ifConditions.length; i$1 < l$1; i$1++) {
+        markStaticRoots(node.ifConditions[i$1].block, isInFor);
+      }
+    }
+  }
+}
+
+function isStatic (node) {
+  if (node.type === 2) { // expression
+    return false
+  }
+  if (node.type === 3) { // text
+    return true
+  }
+  return !!(node.pre || (
+    !node.hasBindings && // no dynamic bindings
+    !node.if && !node.for && // not v-if or v-for or v-else
+    !isBuiltInTag(node.tag) && // not a built-in
+    isPlatformReservedTag(node.tag) && // not a component
+    !isDirectChildOfTemplateFor(node) &&
+    Object.keys(node).every(isStaticKey)
+  ))
+}
+
+function isDirectChildOfTemplateFor (node) {
+  while (node.parent) {
+    node = node.parent;
+    if (node.tag !== 'template') {
+      return false
+    }
+    if (node.for) {
+      return true
+    }
+  }
+  return false
+}
+
+/*  */
+
+var fnExpRE = /^([\w$_]+|\([^)]*?\))\s*=>|^function\s*\(/;
+var simplePathRE = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*|\['[^']*?']|\["[^"]*?"]|\[\d+]|\[[A-Za-z_$][\w$]*])*$/;
+
+// KeyboardEvent.keyCode aliases
+var keyCodes = {
+  esc: 27,
+  tab: 9,
+  enter: 13,
+  space: 32,
+  up: 38,
+  left: 37,
+  right: 39,
+  down: 40,
+  'delete': [8, 46]
+};
+
+// KeyboardEvent.key aliases
+var keyNames = {
+  esc: 'Escape',
+  tab: 'Tab',
+  enter: 'Enter',
+  space: ' ',
+  // #7806: IE11 uses key names without `Arrow` prefix for arrow keys.
+  up: ['Up', 'ArrowUp'],
+  left: ['Left', 'ArrowLeft'],
+  right: ['Right', 'ArrowRight'],
+  down: ['Down', 'ArrowDown'],
+  'delete': ['Backspace', 'Delete']
+};
+
+// #4868: modifiers that prevent the execution of the listener
+// need to explicitly return null so that we can determine whether to remove
+// the listener for .once
+var genGuard = function (condition) { return ("if(" + condition + ")return null;"); };
+
+var modifierCode = {
+  stop: '$event.stopPropagation();',
+  prevent: '$event.preventDefault();',
+  self: genGuard("$event.target !== $event.currentTarget"),
+  ctrl: genGuard("!$event.ctrlKey"),
+  shift: genGuard("!$event.shiftKey"),
+  alt: genGuard("!$event.altKey"),
+  meta: genGuard("!$event.metaKey"),
+  left: genGuard("'button' in $event && $event.button !== 0"),
+  middle: genGuard("'button' in $event && $event.button !== 1"),
+  right: genGuard("'button' in $event && $event.button !== 2")
+};
+
+function genHandlers (
+  events,
+  isNative,
+  warn
+) {
+  var res = isNative ? 'nativeOn:{' : 'on:{';
+  for (var name in events) {
+    res += "\"" + name + "\":" + (genHandler(name, events[name])) + ",";
+  }
+  return res.slice(0, -1) + '}'
+}
+
+function genHandler (
+  name,
+  handler
+) {
+  if (!handler) {
+    return 'function(){}'
+  }
+
+  if (Array.isArray(handler)) {
+    return ("[" + (handler.map(function (handler) { return genHandler(name, handler); }).join(',')) + "]")
+  }
+
+  var isMethodPath = simplePathRE.test(handler.value);
+  var isFunctionExpression = fnExpRE.test(handler.value);
+
+  if (!handler.modifiers) {
+    if (isMethodPath || isFunctionExpression) {
+      return handler.value
+    }
+    /* istanbul ignore if */
+    return ("function($event){" + (handler.value) + "}") // inline statement
+  } else {
+    var code = '';
+    var genModifierCode = '';
+    var keys = [];
+    for (var key in handler.modifiers) {
+      if (modifierCode[key]) {
+        genModifierCode += modifierCode[key];
+        // left/right
+        if (keyCodes[key]) {
+          keys.push(key);
+        }
+      } else if (key === 'exact') {
+        var modifiers = (handler.modifiers);
+        genModifierCode += genGuard(
+          ['ctrl', 'shift', 'alt', 'meta']
+            .filter(function (keyModifier) { return !modifiers[keyModifier]; })
+            .map(function (keyModifier) { return ("$event." + keyModifier + "Key"); })
+            .join('||')
+        );
+      } else {
+        keys.push(key);
+      }
+    }
+    if (keys.length) {
+      code += genKeyFilter(keys);
+    }
+    // Make sure modifiers like prevent and stop get executed after key filtering
+    if (genModifierCode) {
+      code += genModifierCode;
+    }
+    var handlerCode = isMethodPath
+      ? ("return " + (handler.value) + "($event)")
+      : isFunctionExpression
+        ? ("return (" + (handler.value) + ")($event)")
+        : handler.value;
+    /* istanbul ignore if */
+    return ("function($event){" + code + handlerCode + "}")
+  }
+}
+
+function genKeyFilter (keys) {
+  return ("if(!('button' in $event)&&" + (keys.map(genFilterCode).join('&&')) + ")return null;")
+}
+
+function genFilterCode (key) {
+  var keyVal = parseInt(key, 10);
+  if (keyVal) {
+    return ("$event.keyCode!==" + keyVal)
+  }
+  var keyCode = keyCodes[key];
+  var keyName = keyNames[key];
+  return (
+    "_k($event.keyCode," +
+    (JSON.stringify(key)) + "," +
+    (JSON.stringify(keyCode)) + "," +
+    "$event.key," +
+    "" + (JSON.stringify(keyName)) +
+    ")"
+  )
+}
+
+/*  */
+
+function on (el, dir) {
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && dir.modifiers) {
+    warn("v-on without argument does not support modifiers.");
+  }
+  el.wrapListeners = function (code) { return ("_g(" + code + "," + (dir.value) + ")"); };
+}
+
+/*  */
+
+function bind$1 (el, dir) {
+  el.wrapData = function (code) {
+    return ("_b(" + code + ",'" + (el.tag) + "'," + (dir.value) + "," + (dir.modifiers && dir.modifiers.prop ? 'true' : 'false') + (dir.modifiers && dir.modifiers.sync ? ',true' : '') + ")")
+  };
+}
+
+/*  */
+
+var baseDirectives = {
+  on: on,
+  bind: bind$1,
+  cloak: noop
+}
+
+/*  */
+
+var CodegenState = function CodegenState (options) {
+  this.options = options;
+  this.warn = options.warn || baseWarn;
+  this.transforms = pluckModuleFunction(options.modules, 'transformCode');
+  this.dataGenFns = pluckModuleFunction(options.modules, 'genData');
+  this.directives = extend(extend({}, baseDirectives), options.directives);
+  var isReservedTag = options.isReservedTag || no;
+  this.maybeComponent = function (el) { return !isReservedTag(el.tag); };
+  this.onceId = 0;
+  this.staticRenderFns = [];
+};
+
+
+
+function generate (
+  ast,
+  options
+) {
+  var state = new CodegenState(options);
+  var code = ast ? genElement(ast, state) : '_c("div")';
+  return {
+    render: ("with(this){return " + code + "}"),
+    staticRenderFns: state.staticRenderFns
+  }
+}
+
+function genElement (el, state) {
+  if (el.staticRoot && !el.staticProcessed) {
+    return genStatic(el, state)
+  } else if (el.once && !el.onceProcessed) {
+    return genOnce(el, state)
+  } else if (el.for && !el.forProcessed) {
+    return genFor(el, state)
+  } else if (el.if && !el.ifProcessed) {
+    return genIf(el, state)
+  } else if (el.tag === 'template' && !el.slotTarget) {
+    return genChildren(el, state) || 'void 0'
+  } else if (el.tag === 'slot') {
+    return genSlot(el, state)
+  } else {
+    // component or element
+    var code;
+    if (el.component) {
+      code = genComponent(el.component, el, state);
+    } else {
+      var data = el.plain ? undefined : genData$2(el, state);
+
+      var children = el.inlineTemplate ? null : genChildren(el, state, true);
+      code = "_c('" + (el.tag) + "'" + (data ? ("," + data) : '') + (children ? ("," + children) : '') + ")";
+    }
+    // module transforms
+    for (var i = 0; i < state.transforms.length; i++) {
+      code = state.transforms[i](el, code);
+    }
+    return code
+  }
+}
+
+// hoist static sub-trees out
+function genStatic (el, state) {
+  el.staticProcessed = true;
+  state.staticRenderFns.push(("with(this){return " + (genElement(el, state)) + "}"));
+  return ("_m(" + (state.staticRenderFns.length - 1) + (el.staticInFor ? ',true' : '') + ")")
+}
+
+// v-once
+function genOnce (el, state) {
+  el.onceProcessed = true;
+  if (el.if && !el.ifProcessed) {
+    return genIf(el, state)
+  } else if (el.staticInFor) {
+    var key = '';
+    var parent = el.parent;
+    while (parent) {
+      if (parent.for) {
+        key = parent.key;
+        break
+      }
+      parent = parent.parent;
+    }
+    if (!key) {
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && state.warn(
+        "v-once can only be used inside v-for that is keyed. "
+      );
+      return genElement(el, state)
+    }
+    return ("_o(" + (genElement(el, state)) + "," + (state.onceId++) + "," + key + ")")
+  } else {
+    return genStatic(el, state)
+  }
+}
+
+function genIf (
+  el,
+  state,
+  altGen,
+  altEmpty
+) {
+  el.ifProcessed = true; // avoid recursion
+  return genIfConditions(el.ifConditions.slice(), state, altGen, altEmpty)
+}
+
+function genIfConditions (
+  conditions,
+  state,
+  altGen,
+  altEmpty
+) {
+  if (!conditions.length) {
+    return altEmpty || '_e()'
+  }
+
+  var condition = conditions.shift();
+  if (condition.exp) {
+    return ("(" + (condition.exp) + ")?" + (genTernaryExp(condition.block)) + ":" + (genIfConditions(conditions, state, altGen, altEmpty)))
+  } else {
+    return ("" + (genTernaryExp(condition.block)))
+  }
+
+  // v-if with v-once should generate code like (a)?_m(0):_m(1)
+  function genTernaryExp (el) {
+    return altGen
+      ? altGen(el, state)
+      : el.once
+        ? genOnce(el, state)
+        : genElement(el, state)
+  }
+}
+
+function genFor (
+  el,
+  state,
+  altGen,
+  altHelper
+) {
+  var exp = el.for;
+  var alias = el.alias;
+  var iterator1 = el.iterator1 ? ("," + (el.iterator1)) : '';
+  var iterator2 = el.iterator2 ? ("," + (el.iterator2)) : '';
+
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+    state.maybeComponent(el) &&
+    el.tag !== 'slot' &&
+    el.tag !== 'template' &&
+    !el.key
+  ) {
+    state.warn(
+      "<" + (el.tag) + " v-for=\"" + alias + " in " + exp + "\">: component lists rendered with " +
+      "v-for should have explicit keys. " +
+      "See https://vuejs.org/guide/list.html#key for more info.",
+      true /* tip */
+    );
+  }
+
+  el.forProcessed = true; // avoid recursion
+  return (altHelper || '_l') + "((" + exp + ")," +
+    "function(" + alias + iterator1 + iterator2 + "){" +
+      "return " + ((altGen || genElement)(el, state)) +
+    '})'
+}
+
+function genData$2 (el, state) {
+  var data = '{';
+
+  // directives first.
+  // directives may mutate the el's other properties before they are generated.
+  var dirs = genDirectives(el, state);
+  if (dirs) { data += dirs + ','; }
+
+  // key
+  if (el.key) {
+    data += "key:" + (el.key) + ",";
+  }
+  // ref
+  if (el.ref) {
+    data += "ref:" + (el.ref) + ",";
+  }
+  if (el.refInFor) {
+    data += "refInFor:true,";
+  }
+  // pre
+  if (el.pre) {
+    data += "pre:true,";
+  }
+  // record original tag name for components using "is" attribute
+  if (el.component) {
+    data += "tag:\"" + (el.tag) + "\",";
+  }
+  // module data generation functions
+  for (var i = 0; i < state.dataGenFns.length; i++) {
+    data += state.dataGenFns[i](el);
+  }
+  // attributes
+  if (el.attrs) {
+    data += "attrs:{" + (genProps(el.attrs)) + "},";
+  }
+  // DOM props
+  if (el.props) {
+    data += "domProps:{" + (genProps(el.props)) + "},";
+  }
+  // event handlers
+  if (el.events) {
+    data += (genHandlers(el.events, false, state.warn)) + ",";
+  }
+  if (el.nativeEvents) {
+    data += (genHandlers(el.nativeEvents, true, state.warn)) + ",";
+  }
+  // slot target
+  // only for non-scoped slots
+  if (el.slotTarget && !el.slotScope) {
+    data += "slot:" + (el.slotTarget) + ",";
+  }
+  // scoped slots
+  if (el.scopedSlots) {
+    data += (genScopedSlots(el.scopedSlots, state)) + ",";
+  }
+  // component v-model
+  if (el.model) {
+    data += "model:{value:" + (el.model.value) + ",callback:" + (el.model.callback) + ",expression:" + (el.model.expression) + "},";
+  }
+  // inline-template
+  if (el.inlineTemplate) {
+    var inlineTemplate = genInlineTemplate(el, state);
+    if (inlineTemplate) {
+      data += inlineTemplate + ",";
+    }
+  }
+  data = data.replace(/,$/, '') + '}';
+  // v-bind data wrap
+  if (el.wrapData) {
+    data = el.wrapData(data);
+  }
+  // v-on data wrap
+  if (el.wrapListeners) {
+    data = el.wrapListeners(data);
+  }
+  return data
+}
+
+function genDirectives (el, state) {
+  var dirs = el.directives;
+  if (!dirs) { return }
+  var res = 'directives:[';
+  var hasRuntime = false;
+  var i, l, dir, needRuntime;
+  for (i = 0, l = dirs.length; i < l; i++) {
+    dir = dirs[i];
+    needRuntime = true;
+    var gen = state.directives[dir.name];
+    if (gen) {
+      // compile-time directive that manipulates AST.
+      // returns true if it also needs a runtime counterpart.
+      needRuntime = !!gen(el, dir, state.warn);
+    }
+    if (needRuntime) {
+      hasRuntime = true;
+      res += "{name:\"" + (dir.name) + "\",rawName:\"" + (dir.rawName) + "\"" + (dir.value ? (",value:(" + (dir.value) + "),expression:" + (JSON.stringify(dir.value))) : '') + (dir.arg ? (",arg:\"" + (dir.arg) + "\"") : '') + (dir.modifiers ? (",modifiers:" + (JSON.stringify(dir.modifiers))) : '') + "},";
+    }
+  }
+  if (hasRuntime) {
+    return res.slice(0, -1) + ']'
+  }
+}
+
+function genInlineTemplate (el, state) {
+  var ast = el.children[0];
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && (
+    el.children.length !== 1 || ast.type !== 1
+  )) {
+    state.warn('Inline-template components must have exactly one child element.');
+  }
+  if (ast.type === 1) {
+    var inlineRenderFns = generate(ast, state.options);
+    return ("inlineTemplate:{render:function(){" + (inlineRenderFns.render) + "},staticRenderFns:[" + (inlineRenderFns.staticRenderFns.map(function (code) { return ("function(){" + code + "}"); }).join(',')) + "]}")
+  }
+}
+
+function genScopedSlots (
+  slots,
+  state
+) {
+  return ("scopedSlots:_u([" + (Object.keys(slots).map(function (key) {
+      return genScopedSlot(key, slots[key], state)
+    }).join(',')) + "])")
+}
+
+function genScopedSlot (
+  key,
+  el,
+  state
+) {
+  if (el.for && !el.forProcessed) {
+    return genForScopedSlot(key, el, state)
+  }
+  var fn = "function(" + (String(el.slotScope)) + "){" +
+    "return " + (el.tag === 'template'
+      ? el.if
+        ? ((el.if) + "?" + (genChildren(el, state) || 'undefined') + ":undefined")
+        : genChildren(el, state) || 'undefined'
+      : genElement(el, state)) + "}";
+  return ("{key:" + key + ",fn:" + fn + "}")
+}
+
+function genForScopedSlot (
+  key,
+  el,
+  state
+) {
+  var exp = el.for;
+  var alias = el.alias;
+  var iterator1 = el.iterator1 ? ("," + (el.iterator1)) : '';
+  var iterator2 = el.iterator2 ? ("," + (el.iterator2)) : '';
+  el.forProcessed = true; // avoid recursion
+  return "_l((" + exp + ")," +
+    "function(" + alias + iterator1 + iterator2 + "){" +
+      "return " + (genScopedSlot(key, el, state)) +
+    '})'
+}
+
+function genChildren (
+  el,
+  state,
+  checkSkip,
+  altGenElement,
+  altGenNode
+) {
+  var children = el.children;
+  if (children.length) {
+    var el$1 = children[0];
+    // optimize single v-for
+    if (children.length === 1 &&
+      el$1.for &&
+      el$1.tag !== 'template' &&
+      el$1.tag !== 'slot'
+    ) {
+      return (altGenElement || genElement)(el$1, state)
+    }
+    var normalizationType = checkSkip
+      ? getNormalizationType(children, state.maybeComponent)
+      : 0;
+    var gen = altGenNode || genNode;
+    return ("[" + (children.map(function (c) { return gen(c, state); }).join(',')) + "]" + (normalizationType ? ("," + normalizationType) : ''))
+  }
+}
+
+// determine the normalization needed for the children array.
+// 0: no normalization needed
+// 1: simple normalization needed (possible 1-level deep nested array)
+// 2: full normalization needed
+function getNormalizationType (
+  children,
+  maybeComponent
+) {
+  var res = 0;
+  for (var i = 0; i < children.length; i++) {
+    var el = children[i];
+    if (el.type !== 1) {
+      continue
+    }
+    if (needsNormalization(el) ||
+        (el.ifConditions && el.ifConditions.some(function (c) { return needsNormalization(c.block); }))) {
+      res = 2;
+      break
+    }
+    if (maybeComponent(el) ||
+        (el.ifConditions && el.ifConditions.some(function (c) { return maybeComponent(c.block); }))) {
+      res = 1;
+    }
+  }
+  return res
+}
+
+function needsNormalization (el) {
+  return el.for !== undefined || el.tag === 'template' || el.tag === 'slot'
+}
+
+function genNode (node, state) {
+  if (node.type === 1) {
+    return genElement(node, state)
+  } if (node.type === 3 && node.isComment) {
+    return genComment(node)
+  } else {
+    return genText(node)
+  }
+}
+
+function genText (text) {
+  return ("_v(" + (text.type === 2
+    ? text.expression // no need for () because already wrapped in _s()
+    : transformSpecialNewlines(JSON.stringify(text.text))) + ")")
+}
+
+function genComment (comment) {
+  return ("_e(" + (JSON.stringify(comment.text)) + ")")
+}
+
+function genSlot (el, state) {
+  var slotName = el.slotName || '"default"';
+  var children = genChildren(el, state);
+  var res = "_t(" + slotName + (children ? ("," + children) : '');
+  var attrs = el.attrs && ("{" + (el.attrs.map(function (a) { return ((camelize(a.name)) + ":" + (a.value)); }).join(',')) + "}");
+  var bind$$1 = el.attrsMap['v-bind'];
+  if ((attrs || bind$$1) && !children) {
+    res += ",null";
+  }
+  if (attrs) {
+    res += "," + attrs;
+  }
+  if (bind$$1) {
+    res += (attrs ? '' : ',null') + "," + bind$$1;
+  }
+  return res + ')'
+}
+
+// componentName is el.component, take it as argument to shun flow's pessimistic refinement
+function genComponent (
+  componentName,
+  el,
+  state
+) {
+  var children = el.inlineTemplate ? null : genChildren(el, state, true);
+  return ("_c(" + componentName + "," + (genData$2(el, state)) + (children ? ("," + children) : '') + ")")
+}
+
+function genProps (props) {
+  var res = '';
+  for (var i = 0; i < props.length; i++) {
+    var prop = props[i];
+    /* istanbul ignore if */
+    {
+      res += "\"" + (prop.name) + "\":" + (transformSpecialNewlines(prop.value)) + ",";
+    }
+  }
+  return res.slice(0, -1)
+}
+
+// #3895, #4268
+function transformSpecialNewlines (text) {
+  return text
+    .replace(/\u2028/g, '\\u2028')
+    .replace(/\u2029/g, '\\u2029')
+}
+
+/*  */
+
+// these keywords should not appear inside expressions, but operators like
+// typeof, instanceof and in are allowed
+var prohibitedKeywordRE = new RegExp('\\b' + (
+  'do,if,for,let,new,try,var,case,else,with,await,break,catch,class,const,' +
+  'super,throw,while,yield,delete,export,import,return,switch,default,' +
+  'extends,finally,continue,debugger,function,arguments'
+).split(',').join('\\b|\\b') + '\\b');
+
+// these unary operators should not be used as property/method names
+var unaryOperatorsRE = new RegExp('\\b' + (
+  'delete,typeof,void'
+).split(',').join('\\s*\\([^\\)]*\\)|\\b') + '\\s*\\([^\\)]*\\)');
+
+// strip strings in expressions
+var stripStringRE = /'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*\$\{|\}(?:[^`\\]|\\.)*`|`(?:[^`\\]|\\.)*`/g;
+
+// detect problematic expressions in a template
+function detectErrors (ast) {
+  var errors = [];
+  if (ast) {
+    checkNode(ast, errors);
+  }
+  return errors
+}
+
+function checkNode (node, errors) {
+  if (node.type === 1) {
+    for (var name in node.attrsMap) {
+      if (dirRE.test(name)) {
+        var value = node.attrsMap[name];
+        if (value) {
+          if (name === 'v-for') {
+            checkFor(node, ("v-for=\"" + value + "\""), errors);
+          } else if (onRE.test(name)) {
+            checkEvent(value, (name + "=\"" + value + "\""), errors);
+          } else {
+            checkExpression(value, (name + "=\"" + value + "\""), errors);
+          }
+        }
+      }
+    }
+    if (node.children) {
+      for (var i = 0; i < node.children.length; i++) {
+        checkNode(node.children[i], errors);
+      }
+    }
+  } else if (node.type === 2) {
+    checkExpression(node.expression, node.text, errors);
+  }
+}
+
+function checkEvent (exp, text, errors) {
+  var stipped = exp.replace(stripStringRE, '');
+  var keywordMatch = stipped.match(unaryOperatorsRE);
+  if (keywordMatch && stipped.charAt(keywordMatch.index - 1) !== '$') {
+    errors.push(
+      "avoid using JavaScript unary operator as property name: " +
+      "\"" + (keywordMatch[0]) + "\" in expression " + (text.trim())
+    );
+  }
+  checkExpression(exp, text, errors);
+}
+
+function checkFor (node, text, errors) {
+  checkExpression(node.for || '', text, errors);
+  checkIdentifier(node.alias, 'v-for alias', text, errors);
+  checkIdentifier(node.iterator1, 'v-for iterator', text, errors);
+  checkIdentifier(node.iterator2, 'v-for iterator', text, errors);
+}
+
+function checkIdentifier (
+  ident,
+  type,
+  text,
+  errors
+) {
+  if (typeof ident === 'string') {
+    try {
+      new Function(("var " + ident + "=_"));
+    } catch (e) {
+      errors.push(("invalid " + type + " \"" + ident + "\" in expression: " + (text.trim())));
+    }
+  }
+}
+
+function checkExpression (exp, text, errors) {
+  try {
+    new Function(("return " + exp));
+  } catch (e) {
+    var keywordMatch = exp.replace(stripStringRE, '').match(prohibitedKeywordRE);
+    if (keywordMatch) {
+      errors.push(
+        "avoid using JavaScript keyword as property name: " +
+        "\"" + (keywordMatch[0]) + "\"\n  Raw expression: " + (text.trim())
+      );
+    } else {
+      errors.push(
+        "invalid expression: " + (e.message) + " in\n\n" +
+        "    " + exp + "\n\n" +
+        "  Raw expression: " + (text.trim()) + "\n"
+      );
+    }
+  }
+}
+
+/*  */
+
+function createFunction (code, errors) {
+  try {
+    return new Function(code)
+  } catch (err) {
+    errors.push({ err: err, code: code });
+    return noop
+  }
+}
+
+function createCompileToFunctionFn (compile) {
+  var cache = Object.create(null);
+
+  return function compileToFunctions (
+    template,
+    options,
+    vm
+  ) {
+    options = extend({}, options);
+    var warn$$1 = options.warn || warn;
+    delete options.warn;
+
+    /* istanbul ignore if */
+    {
+      // detect possible CSP restriction
+      try {
+        new Function('return 1');
+      } catch (e) {
+        if (e.toString().match(/unsafe-eval|CSP/)) {
+          warn$$1(
+            'It seems you are using the standalone build of Vue.js in an ' +
+            'environment with Content Security Policy that prohibits unsafe-eval. ' +
+            'The template compiler cannot work in this environment. Consider ' +
+            'relaxing the policy to allow unsafe-eval or pre-compiling your ' +
+            'templates into render functions.'
+          );
+        }
+      }
+    }
+
+    // check cache
+    var key = options.delimiters
+      ? String(options.delimiters) + template
+      : template;
+    if (cache[key]) {
+      return cache[key]
+    }
+
+    // compile
+    var compiled = compile(template, options);
+
+    // check compilation errors/tips
+    {
+      if (compiled.errors && compiled.errors.length) {
+        warn$$1(
+          "Error compiling template:\n\n" + template + "\n\n" +
+          compiled.errors.map(function (e) { return ("- " + e); }).join('\n') + '\n',
+          vm
+        );
+      }
+      if (compiled.tips && compiled.tips.length) {
+        compiled.tips.forEach(function (msg) { return tip(msg, vm); });
+      }
+    }
+
+    // turn code into functions
+    var res = {};
+    var fnGenErrors = [];
+    res.render = createFunction(compiled.render, fnGenErrors);
+    res.staticRenderFns = compiled.staticRenderFns.map(function (code) {
+      return createFunction(code, fnGenErrors)
+    });
+
+    // check function generation errors.
+    // this should only happen if there is a bug in the compiler itself.
+    // mostly for codegen development use
+    /* istanbul ignore if */
+    {
+      if ((!compiled.errors || !compiled.errors.length) && fnGenErrors.length) {
+        warn$$1(
+          "Failed to generate render function:\n\n" +
+          fnGenErrors.map(function (ref) {
+            var err = ref.err;
+            var code = ref.code;
+
+            return ((err.toString()) + " in\n\n" + code + "\n");
+        }).join('\n'),
+          vm
+        );
+      }
+    }
+
+    return (cache[key] = res)
+  }
+}
+
+/*  */
+
+function createCompilerCreator (baseCompile) {
+  return function createCompiler (baseOptions) {
+    function compile (
+      template,
+      options
+    ) {
+      var finalOptions = Object.create(baseOptions);
+      var errors = [];
+      var tips = [];
+      finalOptions.warn = function (msg, tip) {
+        (tip ? tips : errors).push(msg);
+      };
+
+      if (options) {
+        // merge custom modules
+        if (options.modules) {
+          finalOptions.modules =
+            (baseOptions.modules || []).concat(options.modules);
+        }
+        // merge custom directives
+        if (options.directives) {
+          finalOptions.directives = extend(
+            Object.create(baseOptions.directives || null),
+            options.directives
+          );
+        }
+        // copy other options
+        for (var key in options) {
+          if (key !== 'modules' && key !== 'directives') {
+            finalOptions[key] = options[key];
+          }
+        }
+      }
+
+      var compiled = baseCompile(template, finalOptions);
+      {
+        errors.push.apply(errors, detectErrors(compiled.ast));
+      }
+      compiled.errors = errors;
+      compiled.tips = tips;
+      return compiled
+    }
+
+    return {
+      compile: compile,
+      compileToFunctions: createCompileToFunctionFn(compile)
+    }
+  }
+}
+
+/*  */
+
+// `createCompilerCreator` allows creating compilers that use alternative
+// parser/optimizer/codegen, e.g the SSR optimizing compiler.
+// Here we just export a default compiler using the default parts.
+var createCompiler = createCompilerCreator(function baseCompile (
+  template,
+  options
+) {
+  var ast = parse(template.trim(), options);
+  if (options.optimize !== false) {
+    optimize(ast, options);
+  }
+  var code = generate(ast, options);
+  return {
+    ast: ast,
+    render: code.render,
+    staticRenderFns: code.staticRenderFns
+  }
+});
+
+/*  */
+
+var ref$1 = createCompiler(baseOptions);
+var compileToFunctions = ref$1.compileToFunctions;
+
+/*  */
+
+// check whether current browser encodes a char inside attribute values
+var div;
+function getShouldDecode (href) {
+  div = div || document.createElement('div');
+  div.innerHTML = href ? "<a href=\"\n\"/>" : "<div a=\"\n\"/>";
+  return div.innerHTML.indexOf('&#10;') > 0
+}
+
+// #3663: IE encodes newlines inside attribute values while other browsers don't
+var shouldDecodeNewlines = inBrowser ? getShouldDecode(false) : false;
+// #6828: chrome encodes content in a[href]
+var shouldDecodeNewlinesForHref = inBrowser ? getShouldDecode(true) : false;
+
+/*  */
+
+var idToTemplate = cached(function (id) {
+  var el = query(id);
+  return el && el.innerHTML
+});
+
+var mount = Vue.prototype.$mount;
+Vue.prototype.$mount = function (
+  el,
+  hydrating
+) {
+  el = el && query(el);
+
+  /* istanbul ignore if */
+  if (el === document.body || el === document.documentElement) {
+    !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+      "Do not mount Vue to <html> or <body> - mount to normal elements instead."
+    );
+    return this
+  }
+
+  var options = this.$options;
+  // resolve template/el and convert to render function
+  if (!options.render) {
+    var template = options.template;
+    if (template) {
+      if (typeof template === 'string') {
+        if (template.charAt(0) === '#') {
+          template = idToTemplate(template);
+          /* istanbul ignore if */
+          if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && !template) {
+            warn(
+              ("Template element not found or is empty: " + (options.template)),
+              this
+            );
+          }
+        }
+      } else if (template.nodeType) {
+        template = template.innerHTML;
+      } else {
+        {
+          warn('invalid template option:' + template, this);
+        }
+        return this
+      }
+    } else if (el) {
+      template = getOuterHTML(el);
+    }
+    if (template) {
+      /* istanbul ignore if */
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && config.performance && mark) {
+        mark('compile');
+      }
+
+      var ref = compileToFunctions(template, {
+        shouldDecodeNewlines: shouldDecodeNewlines,
+        shouldDecodeNewlinesForHref: shouldDecodeNewlinesForHref,
+        delimiters: options.delimiters,
+        comments: options.comments
+      }, this);
+      var render = ref.render;
+      var staticRenderFns = ref.staticRenderFns;
+      options.render = render;
+      options.staticRenderFns = staticRenderFns;
+
+      /* istanbul ignore if */
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && config.performance && mark) {
+        mark('compile end');
+        measure(("vue " + (this._name) + " compile"), 'compile', 'compile end');
+      }
+    }
+  }
+  return mount.call(this, el, hydrating)
+};
+
+/**
+ * Get outerHTML of elements, taking care
+ * of SVG elements in IE as well.
+ */
+function getOuterHTML (el) {
+  if (el.outerHTML) {
+    return el.outerHTML
+  } else {
+    var container = document.createElement('div');
+    container.appendChild(el.cloneNode(true));
+    return container.innerHTML
+  }
+}
+
+Vue.compile = compileToFunctions;
+
+return Vue;
+
+})));
diff --git a/ee/bulk-operations-dashboard/assets/favicon.ico b/ee/bulk-operations-dashboard/assets/favicon.ico
new file mode 100644
index 000000000000..05c85b1f94b1
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/favicon.ico differ
diff --git a/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.eot b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.eot
new file mode 100644
index 000000000000..e9f60ca953f9
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.eot differ
diff --git a/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.svg b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.svg
new file mode 100644
index 000000000000..855c845e538b
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.svg
@@ -0,0 +1,2671 @@
+<?xml version="1.0" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" >
+<svg>
+<metadata>
+Created by FontForge 20120731 at Mon Oct 24 17:37:40 2016
+ By ,,,
+Copyright Dave Gandy 2016. All rights reserved.
+</metadata>
+<defs>
+<font id="FontAwesome" horiz-adv-x="1536" >
+  <font-face 
+    font-family="FontAwesome"
+    font-weight="400"
+    font-stretch="normal"
+    units-per-em="1792"
+    panose-1="0 0 0 0 0 0 0 0 0 0"
+    ascent="1536"
+    descent="-256"
+    bbox="-1.02083 -256.962 2304.6 1537.02"
+    underline-thickness="0"
+    underline-position="0"
+    unicode-range="U+0020-F500"
+  />
+<missing-glyph horiz-adv-x="896" 
+d="M224 112h448v1312h-448v-1312zM112 0v1536h672v-1536h-672z" />
+    <glyph glyph-name=".notdef" horiz-adv-x="896" 
+d="M224 112h448v1312h-448v-1312zM112 0v1536h672v-1536h-672z" />
+    <glyph glyph-name=".null" horiz-adv-x="0" 
+ />
+    <glyph glyph-name="nonmarkingreturn" horiz-adv-x="597" 
+ />
+    <glyph glyph-name="space" unicode=" " horiz-adv-x="448" 
+ />
+    <glyph glyph-name="dieresis" unicode="&#xa8;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="copyright" unicode="&#xa9;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="registered" unicode="&#xae;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="acute" unicode="&#xb4;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="AE" unicode="&#xc6;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="Oslash" unicode="&#xd8;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="trademark" unicode="&#x2122;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="infinity" unicode="&#x221e;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="notequal" unicode="&#x2260;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="glass" unicode="&#xf000;" horiz-adv-x="1792" 
+d="M1699 1350q0 -35 -43 -78l-632 -632v-768h320q26 0 45 -19t19 -45t-19 -45t-45 -19h-896q-26 0 -45 19t-19 45t19 45t45 19h320v768l-632 632q-43 43 -43 78q0 23 18 36.5t38 17.5t43 4h1408q23 0 43 -4t38 -17.5t18 -36.5z" />
+    <glyph glyph-name="music" unicode="&#xf001;" 
+d="M1536 1312v-1120q0 -50 -34 -89t-86 -60.5t-103.5 -32t-96.5 -10.5t-96.5 10.5t-103.5 32t-86 60.5t-34 89t34 89t86 60.5t103.5 32t96.5 10.5q105 0 192 -39v537l-768 -237v-709q0 -50 -34 -89t-86 -60.5t-103.5 -32t-96.5 -10.5t-96.5 10.5t-103.5 32t-86 60.5t-34 89
+t34 89t86 60.5t103.5 32t96.5 10.5q105 0 192 -39v967q0 31 19 56.5t49 35.5l832 256q12 4 28 4q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="search" unicode="&#xf002;" horiz-adv-x="1664" 
+d="M1152 704q0 185 -131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5t316.5 131.5t131.5 316.5zM1664 -128q0 -52 -38 -90t-90 -38q-54 0 -90 38l-343 342q-179 -124 -399 -124q-143 0 -273.5 55.5t-225 150t-150 225t-55.5 273.5
+t55.5 273.5t150 225t225 150t273.5 55.5t273.5 -55.5t225 -150t150 -225t55.5 -273.5q0 -220 -124 -399l343 -343q37 -37 37 -90z" />
+    <glyph glyph-name="envelope" unicode="&#xf003;" horiz-adv-x="1792" 
+d="M1664 32v768q-32 -36 -69 -66q-268 -206 -426 -338q-51 -43 -83 -67t-86.5 -48.5t-102.5 -24.5h-1h-1q-48 0 -102.5 24.5t-86.5 48.5t-83 67q-158 132 -426 338q-37 30 -69 66v-768q0 -13 9.5 -22.5t22.5 -9.5h1472q13 0 22.5 9.5t9.5 22.5zM1664 1083v11v13.5t-0.5 13
+t-3 12.5t-5.5 9t-9 7.5t-14 2.5h-1472q-13 0 -22.5 -9.5t-9.5 -22.5q0 -168 147 -284q193 -152 401 -317q6 -5 35 -29.5t46 -37.5t44.5 -31.5t50.5 -27.5t43 -9h1h1q20 0 43 9t50.5 27.5t44.5 31.5t46 37.5t35 29.5q208 165 401 317q54 43 100.5 115.5t46.5 131.5z
+M1792 1120v-1088q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h1472q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="heart" unicode="&#xf004;" horiz-adv-x="1792" 
+d="M896 -128q-26 0 -44 18l-624 602q-10 8 -27.5 26t-55.5 65.5t-68 97.5t-53.5 121t-23.5 138q0 220 127 344t351 124q62 0 126.5 -21.5t120 -58t95.5 -68.5t76 -68q36 36 76 68t95.5 68.5t120 58t126.5 21.5q224 0 351 -124t127 -344q0 -221 -229 -450l-623 -600
+q-18 -18 -44 -18z" />
+    <glyph glyph-name="star" unicode="&#xf005;" horiz-adv-x="1664" 
+d="M1664 889q0 -22 -26 -48l-363 -354l86 -500q1 -7 1 -20q0 -21 -10.5 -35.5t-30.5 -14.5q-19 0 -40 12l-449 236l-449 -236q-22 -12 -40 -12q-21 0 -31.5 14.5t-10.5 35.5q0 6 2 20l86 500l-364 354q-25 27 -25 48q0 37 56 46l502 73l225 455q19 41 49 41t49 -41l225 -455
+l502 -73q56 -9 56 -46z" />
+    <glyph glyph-name="star_empty" unicode="&#xf006;" horiz-adv-x="1664" 
+d="M1137 532l306 297l-422 62l-189 382l-189 -382l-422 -62l306 -297l-73 -421l378 199l377 -199zM1664 889q0 -22 -26 -48l-363 -354l86 -500q1 -7 1 -20q0 -50 -41 -50q-19 0 -40 12l-449 236l-449 -236q-22 -12 -40 -12q-21 0 -31.5 14.5t-10.5 35.5q0 6 2 20l86 500
+l-364 354q-25 27 -25 48q0 37 56 46l502 73l225 455q19 41 49 41t49 -41l225 -455l502 -73q56 -9 56 -46z" />
+    <glyph glyph-name="user" unicode="&#xf007;" horiz-adv-x="1280" 
+d="M1280 137q0 -109 -62.5 -187t-150.5 -78h-854q-88 0 -150.5 78t-62.5 187q0 85 8.5 160.5t31.5 152t58.5 131t94 89t134.5 34.5q131 -128 313 -128t313 128q76 0 134.5 -34.5t94 -89t58.5 -131t31.5 -152t8.5 -160.5zM1024 1024q0 -159 -112.5 -271.5t-271.5 -112.5
+t-271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5t271.5 -112.5t112.5 -271.5z" />
+    <glyph glyph-name="film" unicode="&#xf008;" horiz-adv-x="1920" 
+d="M384 -64v128q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM384 320v128q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM384 704v128q0 26 -19 45t-45 19h-128
+q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM1408 -64v512q0 26 -19 45t-45 19h-768q-26 0 -45 -19t-19 -45v-512q0 -26 19 -45t45 -19h768q26 0 45 19t19 45zM384 1088v128q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45
+t45 -19h128q26 0 45 19t19 45zM1792 -64v128q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM1408 704v512q0 26 -19 45t-45 19h-768q-26 0 -45 -19t-19 -45v-512q0 -26 19 -45t45 -19h768q26 0 45 19t19 45zM1792 320v128
+q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM1792 704v128q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM1792 1088v128q0 26 -19 45t-45 19h-128q-26 0 -45 -19
+t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM1920 1248v-1344q0 -66 -47 -113t-113 -47h-1600q-66 0 -113 47t-47 113v1344q0 66 47 113t113 47h1600q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="th_large" unicode="&#xf009;" horiz-adv-x="1664" 
+d="M768 512v-384q0 -52 -38 -90t-90 -38h-512q-52 0 -90 38t-38 90v384q0 52 38 90t90 38h512q52 0 90 -38t38 -90zM768 1280v-384q0 -52 -38 -90t-90 -38h-512q-52 0 -90 38t-38 90v384q0 52 38 90t90 38h512q52 0 90 -38t38 -90zM1664 512v-384q0 -52 -38 -90t-90 -38
+h-512q-52 0 -90 38t-38 90v384q0 52 38 90t90 38h512q52 0 90 -38t38 -90zM1664 1280v-384q0 -52 -38 -90t-90 -38h-512q-52 0 -90 38t-38 90v384q0 52 38 90t90 38h512q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="th" unicode="&#xf00a;" horiz-adv-x="1792" 
+d="M512 288v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM512 800v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1152 288v-192q0 -40 -28 -68t-68 -28h-320
+q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM512 1312v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1152 800v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28
+h320q40 0 68 -28t28 -68zM1792 288v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1152 1312v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1792 800v-192
+q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1792 1312v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="th_list" unicode="&#xf00b;" horiz-adv-x="1792" 
+d="M512 288v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM512 800v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1792 288v-192q0 -40 -28 -68t-68 -28h-960
+q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h960q40 0 68 -28t28 -68zM512 1312v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1792 800v-192q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68v192q0 40 28 68t68 28
+h960q40 0 68 -28t28 -68zM1792 1312v-192q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h960q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="ok" unicode="&#xf00c;" horiz-adv-x="1792" 
+d="M1671 970q0 -40 -28 -68l-724 -724l-136 -136q-28 -28 -68 -28t-68 28l-136 136l-362 362q-28 28 -28 68t28 68l136 136q28 28 68 28t68 -28l294 -295l656 657q28 28 68 28t68 -28l136 -136q28 -28 28 -68z" />
+    <glyph glyph-name="remove" unicode="&#xf00d;" horiz-adv-x="1408" 
+d="M1298 214q0 -40 -28 -68l-136 -136q-28 -28 -68 -28t-68 28l-294 294l-294 -294q-28 -28 -68 -28t-68 28l-136 136q-28 28 -28 68t28 68l294 294l-294 294q-28 28 -28 68t28 68l136 136q28 28 68 28t68 -28l294 -294l294 294q28 28 68 28t68 -28l136 -136q28 -28 28 -68
+t-28 -68l-294 -294l294 -294q28 -28 28 -68z" />
+    <glyph glyph-name="zoom_in" unicode="&#xf00e;" horiz-adv-x="1664" 
+d="M1024 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-224v-224q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v224h-224q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h224v224q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5v-224h224
+q13 0 22.5 -9.5t9.5 -22.5zM1152 704q0 185 -131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5t316.5 131.5t131.5 316.5zM1664 -128q0 -53 -37.5 -90.5t-90.5 -37.5q-54 0 -90 38l-343 342q-179 -124 -399 -124q-143 0 -273.5 55.5
+t-225 150t-150 225t-55.5 273.5t55.5 273.5t150 225t225 150t273.5 55.5t273.5 -55.5t225 -150t150 -225t55.5 -273.5q0 -220 -124 -399l343 -343q37 -37 37 -90z" />
+    <glyph glyph-name="zoom_out" unicode="&#xf010;" horiz-adv-x="1664" 
+d="M1024 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-576q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h576q13 0 22.5 -9.5t9.5 -22.5zM1152 704q0 185 -131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5t316.5 131.5t131.5 316.5z
+M1664 -128q0 -53 -37.5 -90.5t-90.5 -37.5q-54 0 -90 38l-343 342q-179 -124 -399 -124q-143 0 -273.5 55.5t-225 150t-150 225t-55.5 273.5t55.5 273.5t150 225t225 150t273.5 55.5t273.5 -55.5t225 -150t150 -225t55.5 -273.5q0 -220 -124 -399l343 -343q37 -37 37 -90z
+" />
+    <glyph glyph-name="off" unicode="&#xf011;" 
+d="M1536 640q0 -156 -61 -298t-164 -245t-245 -164t-298 -61t-298 61t-245 164t-164 245t-61 298q0 182 80.5 343t226.5 270q43 32 95.5 25t83.5 -50q32 -42 24.5 -94.5t-49.5 -84.5q-98 -74 -151.5 -181t-53.5 -228q0 -104 40.5 -198.5t109.5 -163.5t163.5 -109.5
+t198.5 -40.5t198.5 40.5t163.5 109.5t109.5 163.5t40.5 198.5q0 121 -53.5 228t-151.5 181q-42 32 -49.5 84.5t24.5 94.5q31 43 84 50t95 -25q146 -109 226.5 -270t80.5 -343zM896 1408v-640q0 -52 -38 -90t-90 -38t-90 38t-38 90v640q0 52 38 90t90 38t90 -38t38 -90z" />
+    <glyph glyph-name="signal" unicode="&#xf012;" horiz-adv-x="1792" 
+d="M256 96v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM640 224v-320q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v320q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1024 480v-576q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23
+v576q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1408 864v-960q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v960q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1792 1376v-1472q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v1472q0 14 9 23t23 9h192q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="cog" unicode="&#xf013;" 
+d="M1024 640q0 106 -75 181t-181 75t-181 -75t-75 -181t75 -181t181 -75t181 75t75 181zM1536 749v-222q0 -12 -8 -23t-20 -13l-185 -28q-19 -54 -39 -91q35 -50 107 -138q10 -12 10 -25t-9 -23q-27 -37 -99 -108t-94 -71q-12 0 -26 9l-138 108q-44 -23 -91 -38
+q-16 -136 -29 -186q-7 -28 -36 -28h-222q-14 0 -24.5 8.5t-11.5 21.5l-28 184q-49 16 -90 37l-141 -107q-10 -9 -25 -9q-14 0 -25 11q-126 114 -165 168q-7 10 -7 23q0 12 8 23q15 21 51 66.5t54 70.5q-27 50 -41 99l-183 27q-13 2 -21 12.5t-8 23.5v222q0 12 8 23t19 13
+l186 28q14 46 39 92q-40 57 -107 138q-10 12 -10 24q0 10 9 23q26 36 98.5 107.5t94.5 71.5q13 0 26 -10l138 -107q44 23 91 38q16 136 29 186q7 28 36 28h222q14 0 24.5 -8.5t11.5 -21.5l28 -184q49 -16 90 -37l142 107q9 9 24 9q13 0 25 -10q129 -119 165 -170q7 -8 7 -22
+q0 -12 -8 -23q-15 -21 -51 -66.5t-54 -70.5q26 -50 41 -98l183 -28q13 -2 21 -12.5t8 -23.5z" />
+    <glyph glyph-name="trash" unicode="&#xf014;" horiz-adv-x="1408" 
+d="M512 800v-576q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v576q0 14 9 23t23 9h64q14 0 23 -9t9 -23zM768 800v-576q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v576q0 14 9 23t23 9h64q14 0 23 -9t9 -23zM1024 800v-576q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v576
+q0 14 9 23t23 9h64q14 0 23 -9t9 -23zM1152 76v948h-896v-948q0 -22 7 -40.5t14.5 -27t10.5 -8.5h832q3 0 10.5 8.5t14.5 27t7 40.5zM480 1152h448l-48 117q-7 9 -17 11h-317q-10 -2 -17 -11zM1408 1120v-64q0 -14 -9 -23t-23 -9h-96v-948q0 -83 -47 -143.5t-113 -60.5h-832
+q-66 0 -113 58.5t-47 141.5v952h-96q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h309l70 167q15 37 54 63t79 26h320q40 0 79 -26t54 -63l70 -167h309q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="home" unicode="&#xf015;" horiz-adv-x="1664" 
+d="M1408 544v-480q0 -26 -19 -45t-45 -19h-384v384h-256v-384h-384q-26 0 -45 19t-19 45v480q0 1 0.5 3t0.5 3l575 474l575 -474q1 -2 1 -6zM1631 613l-62 -74q-8 -9 -21 -11h-3q-13 0 -21 7l-692 577l-692 -577q-12 -8 -24 -7q-13 2 -21 11l-62 74q-8 10 -7 23.5t11 21.5
+l719 599q32 26 76 26t76 -26l244 -204v195q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-408l219 -182q10 -8 11 -21.5t-7 -23.5z" />
+    <glyph glyph-name="file_alt" unicode="&#xf016;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+" />
+    <glyph glyph-name="time" unicode="&#xf017;" 
+d="M896 992v-448q0 -14 -9 -23t-23 -9h-320q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h224v352q0 14 9 23t23 9h64q14 0 23 -9t9 -23zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="road" unicode="&#xf018;" horiz-adv-x="1920" 
+d="M1111 540v4l-24 320q-1 13 -11 22.5t-23 9.5h-186q-13 0 -23 -9.5t-11 -22.5l-24 -320v-4q-1 -12 8 -20t21 -8h244q12 0 21 8t8 20zM1870 73q0 -73 -46 -73h-704q13 0 22 9.5t8 22.5l-20 256q-1 13 -11 22.5t-23 9.5h-272q-13 0 -23 -9.5t-11 -22.5l-20 -256
+q-1 -13 8 -22.5t22 -9.5h-704q-46 0 -46 73q0 54 26 116l417 1044q8 19 26 33t38 14h339q-13 0 -23 -9.5t-11 -22.5l-15 -192q-1 -14 8 -23t22 -9h166q13 0 22 9t8 23l-15 192q-1 13 -11 22.5t-23 9.5h339q20 0 38 -14t26 -33l417 -1044q26 -62 26 -116z" />
+    <glyph glyph-name="download_alt" unicode="&#xf019;" horiz-adv-x="1664" 
+d="M1280 192q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1536 192q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1664 416v-320q0 -40 -28 -68t-68 -28h-1472q-40 0 -68 28t-28 68v320q0 40 28 68t68 28h465l135 -136
+q58 -56 136 -56t136 56l136 136h464q40 0 68 -28t28 -68zM1339 985q17 -41 -14 -70l-448 -448q-18 -19 -45 -19t-45 19l-448 448q-31 29 -14 70q17 39 59 39h256v448q0 26 19 45t45 19h256q26 0 45 -19t19 -45v-448h256q42 0 59 -39z" />
+    <glyph glyph-name="download" unicode="&#xf01a;" 
+d="M1120 608q0 -12 -10 -24l-319 -319q-11 -9 -23 -9t-23 9l-320 320q-15 16 -7 35q8 20 30 20h192v352q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-352h192q14 0 23 -9t9 -23zM768 1184q-148 0 -273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273
+t-73 273t-198 198t-273 73zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="upload" unicode="&#xf01b;" 
+d="M1118 660q-8 -20 -30 -20h-192v-352q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v352h-192q-14 0 -23 9t-9 23q0 12 10 24l319 319q11 9 23 9t23 -9l320 -320q15 -16 7 -35zM768 1184q-148 0 -273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198
+t73 273t-73 273t-198 198t-273 73zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="inbox" unicode="&#xf01c;" 
+d="M1023 576h316q-1 3 -2.5 8.5t-2.5 7.5l-212 496h-708l-212 -496q-1 -3 -2.5 -8.5t-2.5 -7.5h316l95 -192h320zM1536 546v-482q0 -26 -19 -45t-45 -19h-1408q-26 0 -45 19t-19 45v482q0 62 25 123l238 552q10 25 36.5 42t52.5 17h832q26 0 52.5 -17t36.5 -42l238 -552
+q25 -61 25 -123z" />
+    <glyph glyph-name="play_circle" unicode="&#xf01d;" 
+d="M1184 640q0 -37 -32 -55l-544 -320q-15 -9 -32 -9q-16 0 -32 8q-32 19 -32 56v640q0 37 32 56q33 18 64 -1l544 -320q32 -18 32 -55zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="repeat" unicode="&#xf01e;" 
+d="M1536 1280v-448q0 -26 -19 -45t-45 -19h-448q-42 0 -59 40q-17 39 14 69l138 138q-148 137 -349 137q-104 0 -198.5 -40.5t-163.5 -109.5t-109.5 -163.5t-40.5 -198.5t40.5 -198.5t109.5 -163.5t163.5 -109.5t198.5 -40.5q119 0 225 52t179 147q7 10 23 12q15 0 25 -9
+l137 -138q9 -8 9.5 -20.5t-7.5 -22.5q-109 -132 -264 -204.5t-327 -72.5q-156 0 -298 61t-245 164t-164 245t-61 298t61 298t164 245t245 164t298 61q147 0 284.5 -55.5t244.5 -156.5l130 129q29 31 70 14q39 -17 39 -59z" />
+    <glyph glyph-name="refresh" unicode="&#xf021;" 
+d="M1511 480q0 -5 -1 -7q-64 -268 -268 -434.5t-478 -166.5q-146 0 -282.5 55t-243.5 157l-129 -129q-19 -19 -45 -19t-45 19t-19 45v448q0 26 19 45t45 19h448q26 0 45 -19t19 -45t-19 -45l-137 -137q71 -66 161 -102t187 -36q134 0 250 65t186 179q11 17 53 117
+q8 23 30 23h192q13 0 22.5 -9.5t9.5 -22.5zM1536 1280v-448q0 -26 -19 -45t-45 -19h-448q-26 0 -45 19t-19 45t19 45l138 138q-148 137 -349 137q-134 0 -250 -65t-186 -179q-11 -17 -53 -117q-8 -23 -30 -23h-199q-13 0 -22.5 9.5t-9.5 22.5v7q65 268 270 434.5t480 166.5
+q146 0 284 -55.5t245 -156.5l130 129q19 19 45 19t45 -19t19 -45z" />
+    <glyph glyph-name="list_alt" unicode="&#xf022;" horiz-adv-x="1792" 
+d="M384 352v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 608v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M384 864v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM1536 352v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-960q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h960q13 0 22.5 -9.5t9.5 -22.5z
+M1536 608v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-960q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h960q13 0 22.5 -9.5t9.5 -22.5zM1536 864v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-960q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h960q13 0 22.5 -9.5
+t9.5 -22.5zM1664 160v832q0 13 -9.5 22.5t-22.5 9.5h-1472q-13 0 -22.5 -9.5t-9.5 -22.5v-832q0 -13 9.5 -22.5t22.5 -9.5h1472q13 0 22.5 9.5t9.5 22.5zM1792 1248v-1088q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h1472q66 0 113 -47
+t47 -113z" />
+    <glyph glyph-name="lock" unicode="&#xf023;" horiz-adv-x="1152" 
+d="M320 768h512v192q0 106 -75 181t-181 75t-181 -75t-75 -181v-192zM1152 672v-576q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68v576q0 40 28 68t68 28h32v192q0 184 132 316t316 132t316 -132t132 -316v-192h32q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="flag" unicode="&#xf024;" horiz-adv-x="1792" 
+d="M320 1280q0 -72 -64 -110v-1266q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v1266q-64 38 -64 110q0 53 37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1792 1216v-763q0 -25 -12.5 -38.5t-39.5 -27.5q-215 -116 -369 -116q-61 0 -123.5 22t-108.5 48
+t-115.5 48t-142.5 22q-192 0 -464 -146q-17 -9 -33 -9q-26 0 -45 19t-19 45v742q0 32 31 55q21 14 79 43q236 120 421 120q107 0 200 -29t219 -88q38 -19 88 -19q54 0 117.5 21t110 47t88 47t54.5 21q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="headphones" unicode="&#xf025;" horiz-adv-x="1664" 
+d="M1664 650q0 -166 -60 -314l-20 -49l-185 -33q-22 -83 -90.5 -136.5t-156.5 -53.5v-32q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v576q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-32q71 0 130 -35.5t93 -95.5l68 12q29 95 29 193q0 148 -88 279t-236.5 209t-315.5 78
+t-315.5 -78t-236.5 -209t-88 -279q0 -98 29 -193l68 -12q34 60 93 95.5t130 35.5v32q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-576q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v32q-88 0 -156.5 53.5t-90.5 136.5l-185 33l-20 49q-60 148 -60 314q0 151 67 291t179 242.5
+t266 163.5t320 61t320 -61t266 -163.5t179 -242.5t67 -291z" />
+    <glyph glyph-name="volume_off" unicode="&#xf026;" horiz-adv-x="768" 
+d="M768 1184v-1088q0 -26 -19 -45t-45 -19t-45 19l-333 333h-262q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h262l333 333q19 19 45 19t45 -19t19 -45z" />
+    <glyph glyph-name="volume_down" unicode="&#xf027;" horiz-adv-x="1152" 
+d="M768 1184v-1088q0 -26 -19 -45t-45 -19t-45 19l-333 333h-262q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h262l333 333q19 19 45 19t45 -19t19 -45zM1152 640q0 -76 -42.5 -141.5t-112.5 -93.5q-10 -5 -25 -5q-26 0 -45 18.5t-19 45.5q0 21 12 35.5t29 25t34 23t29 36
+t12 56.5t-12 56.5t-29 36t-34 23t-29 25t-12 35.5q0 27 19 45.5t45 18.5q15 0 25 -5q70 -27 112.5 -93t42.5 -142z" />
+    <glyph glyph-name="volume_up" unicode="&#xf028;" horiz-adv-x="1664" 
+d="M768 1184v-1088q0 -26 -19 -45t-45 -19t-45 19l-333 333h-262q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h262l333 333q19 19 45 19t45 -19t19 -45zM1152 640q0 -76 -42.5 -141.5t-112.5 -93.5q-10 -5 -25 -5q-26 0 -45 18.5t-19 45.5q0 21 12 35.5t29 25t34 23t29 36
+t12 56.5t-12 56.5t-29 36t-34 23t-29 25t-12 35.5q0 27 19 45.5t45 18.5q15 0 25 -5q70 -27 112.5 -93t42.5 -142zM1408 640q0 -153 -85 -282.5t-225 -188.5q-13 -5 -25 -5q-27 0 -46 19t-19 45q0 39 39 59q56 29 76 44q74 54 115.5 135.5t41.5 173.5t-41.5 173.5
+t-115.5 135.5q-20 15 -76 44q-39 20 -39 59q0 26 19 45t45 19q13 0 26 -5q140 -59 225 -188.5t85 -282.5zM1664 640q0 -230 -127 -422.5t-338 -283.5q-13 -5 -26 -5q-26 0 -45 19t-19 45q0 36 39 59q7 4 22.5 10.5t22.5 10.5q46 25 82 51q123 91 192 227t69 289t-69 289
+t-192 227q-36 26 -82 51q-7 4 -22.5 10.5t-22.5 10.5q-39 23 -39 59q0 26 19 45t45 19q13 0 26 -5q211 -91 338 -283.5t127 -422.5z" />
+    <glyph glyph-name="qrcode" unicode="&#xf029;" horiz-adv-x="1408" 
+d="M384 384v-128h-128v128h128zM384 1152v-128h-128v128h128zM1152 1152v-128h-128v128h128zM128 129h384v383h-384v-383zM128 896h384v384h-384v-384zM896 896h384v384h-384v-384zM640 640v-640h-640v640h640zM1152 128v-128h-128v128h128zM1408 128v-128h-128v128h128z
+M1408 640v-384h-384v128h-128v-384h-128v640h384v-128h128v128h128zM640 1408v-640h-640v640h640zM1408 1408v-640h-640v640h640z" />
+    <glyph glyph-name="barcode" unicode="&#xf02a;" horiz-adv-x="1792" 
+d="M63 0h-63v1408h63v-1408zM126 1h-32v1407h32v-1407zM220 1h-31v1407h31v-1407zM377 1h-31v1407h31v-1407zM534 1h-62v1407h62v-1407zM660 1h-31v1407h31v-1407zM723 1h-31v1407h31v-1407zM786 1h-31v1407h31v-1407zM943 1h-63v1407h63v-1407zM1100 1h-63v1407h63v-1407z
+M1226 1h-63v1407h63v-1407zM1352 1h-63v1407h63v-1407zM1446 1h-63v1407h63v-1407zM1635 1h-94v1407h94v-1407zM1698 1h-32v1407h32v-1407zM1792 0h-63v1408h63v-1408z" />
+    <glyph glyph-name="tag" unicode="&#xf02b;" 
+d="M448 1088q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1515 512q0 -53 -37 -90l-491 -492q-39 -37 -91 -37q-53 0 -90 37l-715 716q-38 37 -64.5 101t-26.5 117v416q0 52 38 90t90 38h416q53 0 117 -26.5t102 -64.5
+l715 -714q37 -39 37 -91z" />
+    <glyph glyph-name="tags" unicode="&#xf02c;" horiz-adv-x="1920" 
+d="M448 1088q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1515 512q0 -53 -37 -90l-491 -492q-39 -37 -91 -37q-53 0 -90 37l-715 716q-38 37 -64.5 101t-26.5 117v416q0 52 38 90t90 38h416q53 0 117 -26.5t102 -64.5
+l715 -714q37 -39 37 -91zM1899 512q0 -53 -37 -90l-491 -492q-39 -37 -91 -37q-36 0 -59 14t-53 45l470 470q37 37 37 90q0 52 -37 91l-715 714q-38 38 -102 64.5t-117 26.5h224q53 0 117 -26.5t102 -64.5l715 -714q37 -39 37 -91z" />
+    <glyph glyph-name="book" unicode="&#xf02d;" horiz-adv-x="1664" 
+d="M1639 1058q40 -57 18 -129l-275 -906q-19 -64 -76.5 -107.5t-122.5 -43.5h-923q-77 0 -148.5 53.5t-99.5 131.5q-24 67 -2 127q0 4 3 27t4 37q1 8 -3 21.5t-3 19.5q2 11 8 21t16.5 23.5t16.5 23.5q23 38 45 91.5t30 91.5q3 10 0.5 30t-0.5 28q3 11 17 28t17 23
+q21 36 42 92t25 90q1 9 -2.5 32t0.5 28q4 13 22 30.5t22 22.5q19 26 42.5 84.5t27.5 96.5q1 8 -3 25.5t-2 26.5q2 8 9 18t18 23t17 21q8 12 16.5 30.5t15 35t16 36t19.5 32t26.5 23.5t36 11.5t47.5 -5.5l-1 -3q38 9 51 9h761q74 0 114 -56t18 -130l-274 -906
+q-36 -119 -71.5 -153.5t-128.5 -34.5h-869q-27 0 -38 -15q-11 -16 -1 -43q24 -70 144 -70h923q29 0 56 15.5t35 41.5l300 987q7 22 5 57q38 -15 59 -43zM575 1056q-4 -13 2 -22.5t20 -9.5h608q13 0 25.5 9.5t16.5 22.5l21 64q4 13 -2 22.5t-20 9.5h-608q-13 0 -25.5 -9.5
+t-16.5 -22.5zM492 800q-4 -13 2 -22.5t20 -9.5h608q13 0 25.5 9.5t16.5 22.5l21 64q4 13 -2 22.5t-20 9.5h-608q-13 0 -25.5 -9.5t-16.5 -22.5z" />
+    <glyph glyph-name="bookmark" unicode="&#xf02e;" horiz-adv-x="1280" 
+d="M1164 1408q23 0 44 -9q33 -13 52.5 -41t19.5 -62v-1289q0 -34 -19.5 -62t-52.5 -41q-19 -8 -44 -8q-48 0 -83 32l-441 424l-441 -424q-36 -33 -83 -33q-23 0 -44 9q-33 13 -52.5 41t-19.5 62v1289q0 34 19.5 62t52.5 41q21 9 44 9h1048z" />
+    <glyph glyph-name="print" unicode="&#xf02f;" horiz-adv-x="1664" 
+d="M384 0h896v256h-896v-256zM384 640h896v384h-160q-40 0 -68 28t-28 68v160h-640v-640zM1536 576q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1664 576v-416q0 -13 -9.5 -22.5t-22.5 -9.5h-224v-160q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68
+v160h-224q-13 0 -22.5 9.5t-9.5 22.5v416q0 79 56.5 135.5t135.5 56.5h64v544q0 40 28 68t68 28h672q40 0 88 -20t76 -48l152 -152q28 -28 48 -76t20 -88v-256h64q79 0 135.5 -56.5t56.5 -135.5z" />
+    <glyph glyph-name="camera" unicode="&#xf030;" horiz-adv-x="1920" 
+d="M960 864q119 0 203.5 -84.5t84.5 -203.5t-84.5 -203.5t-203.5 -84.5t-203.5 84.5t-84.5 203.5t84.5 203.5t203.5 84.5zM1664 1280q106 0 181 -75t75 -181v-896q0 -106 -75 -181t-181 -75h-1408q-106 0 -181 75t-75 181v896q0 106 75 181t181 75h224l51 136
+q19 49 69.5 84.5t103.5 35.5h512q53 0 103.5 -35.5t69.5 -84.5l51 -136h224zM960 128q185 0 316.5 131.5t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="font" unicode="&#xf031;" horiz-adv-x="1664" 
+d="M725 977l-170 -450q33 0 136.5 -2t160.5 -2q19 0 57 2q-87 253 -184 452zM0 -128l2 79q23 7 56 12.5t57 10.5t49.5 14.5t44.5 29t31 50.5l237 616l280 724h75h53q8 -14 11 -21l205 -480q33 -78 106 -257.5t114 -274.5q15 -34 58 -144.5t72 -168.5q20 -45 35 -57
+q19 -15 88 -29.5t84 -20.5q6 -38 6 -57q0 -5 -0.5 -13.5t-0.5 -12.5q-63 0 -190 8t-191 8q-76 0 -215 -7t-178 -8q0 43 4 78l131 28q1 0 12.5 2.5t15.5 3.5t14.5 4.5t15 6.5t11 8t9 11t2.5 14q0 16 -31 96.5t-72 177.5t-42 100l-450 2q-26 -58 -76.5 -195.5t-50.5 -162.5
+q0 -22 14 -37.5t43.5 -24.5t48.5 -13.5t57 -8.5t41 -4q1 -19 1 -58q0 -9 -2 -27q-58 0 -174.5 10t-174.5 10q-8 0 -26.5 -4t-21.5 -4q-80 -14 -188 -14z" />
+    <glyph glyph-name="bold" unicode="&#xf032;" horiz-adv-x="1408" 
+d="M555 15q74 -32 140 -32q376 0 376 335q0 114 -41 180q-27 44 -61.5 74t-67.5 46.5t-80.5 25t-84 10.5t-94.5 2q-73 0 -101 -10q0 -53 -0.5 -159t-0.5 -158q0 -8 -1 -67.5t-0.5 -96.5t4.5 -83.5t12 -66.5zM541 761q42 -7 109 -7q82 0 143 13t110 44.5t74.5 89.5t25.5 142
+q0 70 -29 122.5t-79 82t-108 43.5t-124 14q-50 0 -130 -13q0 -50 4 -151t4 -152q0 -27 -0.5 -80t-0.5 -79q0 -46 1 -69zM0 -128l2 94q15 4 85 16t106 27q7 12 12.5 27t8.5 33.5t5.5 32.5t3 37.5t0.5 34v35.5v30q0 982 -22 1025q-4 8 -22 14.5t-44.5 11t-49.5 7t-48.5 4.5
+t-30.5 3l-4 83q98 2 340 11.5t373 9.5q23 0 68 -0.5t68 -0.5q70 0 136.5 -13t128.5 -42t108 -71t74 -104.5t28 -137.5q0 -52 -16.5 -95.5t-39 -72t-64.5 -57.5t-73 -45t-84 -40q154 -35 256.5 -134t102.5 -248q0 -100 -35 -179.5t-93.5 -130.5t-138 -85.5t-163.5 -48.5
+t-176 -14q-44 0 -132 3t-132 3q-106 0 -307 -11t-231 -12z" />
+    <glyph glyph-name="italic" unicode="&#xf033;" horiz-adv-x="1024" 
+d="M0 -126l17 85q22 7 61.5 16.5t72 19t59.5 23.5q28 35 41 101q1 7 62 289t114 543.5t52 296.5v25q-24 13 -54.5 18.5t-69.5 8t-58 5.5l19 103q33 -2 120 -6.5t149.5 -7t120.5 -2.5q48 0 98.5 2.5t121 7t98.5 6.5q-5 -39 -19 -89q-30 -10 -101.5 -28.5t-108.5 -33.5
+q-8 -19 -14 -42.5t-9 -40t-7.5 -45.5t-6.5 -42q-27 -148 -87.5 -419.5t-77.5 -355.5q-2 -9 -13 -58t-20 -90t-16 -83.5t-6 -57.5l1 -18q17 -4 185 -31q-3 -44 -16 -99q-11 0 -32.5 -1.5t-32.5 -1.5q-29 0 -87 10t-86 10q-138 2 -206 2q-51 0 -143 -9t-121 -11z" />
+    <glyph glyph-name="text_height" unicode="&#xf034;" horiz-adv-x="1792" 
+d="M1744 128q33 0 42 -18.5t-11 -44.5l-126 -162q-20 -26 -49 -26t-49 26l-126 162q-20 26 -11 44.5t42 18.5h80v1024h-80q-33 0 -42 18.5t11 44.5l126 162q20 26 49 26t49 -26l126 -162q20 -26 11 -44.5t-42 -18.5h-80v-1024h80zM81 1407l54 -27q12 -5 211 -5q44 0 132 2
+t132 2q36 0 107.5 -0.5t107.5 -0.5h293q6 0 21 -0.5t20.5 0t16 3t17.5 9t15 17.5l42 1q4 0 14 -0.5t14 -0.5q2 -112 2 -336q0 -80 -5 -109q-39 -14 -68 -18q-25 44 -54 128q-3 9 -11 48t-14.5 73.5t-7.5 35.5q-6 8 -12 12.5t-15.5 6t-13 2.5t-18 0.5t-16.5 -0.5
+q-17 0 -66.5 0.5t-74.5 0.5t-64 -2t-71 -6q-9 -81 -8 -136q0 -94 2 -388t2 -455q0 -16 -2.5 -71.5t0 -91.5t12.5 -69q40 -21 124 -42.5t120 -37.5q5 -40 5 -50q0 -14 -3 -29l-34 -1q-76 -2 -218 8t-207 10q-50 0 -151 -9t-152 -9q-3 51 -3 52v9q17 27 61.5 43t98.5 29t78 27
+q19 42 19 383q0 101 -3 303t-3 303v117q0 2 0.5 15.5t0.5 25t-1 25.5t-3 24t-5 14q-11 12 -162 12q-33 0 -93 -12t-80 -26q-19 -13 -34 -72.5t-31.5 -111t-42.5 -53.5q-42 26 -56 44v383z" />
+    <glyph glyph-name="text_width" unicode="&#xf035;" 
+d="M81 1407l54 -27q12 -5 211 -5q44 0 132 2t132 2q70 0 246.5 1t304.5 0.5t247 -4.5q33 -1 56 31l42 1q4 0 14 -0.5t14 -0.5q2 -112 2 -336q0 -80 -5 -109q-39 -14 -68 -18q-25 44 -54 128q-3 9 -11 47.5t-15 73.5t-7 36q-10 13 -27 19q-5 2 -66 2q-30 0 -93 1t-103 1
+t-94 -2t-96 -7q-9 -81 -8 -136l1 -152v52q0 -55 1 -154t1.5 -180t0.5 -153q0 -16 -2.5 -71.5t0 -91.5t12.5 -69q40 -21 124 -42.5t120 -37.5q5 -40 5 -50q0 -14 -3 -29l-34 -1q-76 -2 -218 8t-207 10q-50 0 -151 -9t-152 -9q-3 51 -3 52v9q17 27 61.5 43t98.5 29t78 27
+q7 16 11.5 74t6 145.5t1.5 155t-0.5 153.5t-0.5 89q0 7 -2.5 21.5t-2.5 22.5q0 7 0.5 44t1 73t0 76.5t-3 67.5t-6.5 32q-11 12 -162 12q-41 0 -163 -13.5t-138 -24.5q-19 -12 -34 -71.5t-31.5 -111.5t-42.5 -54q-42 26 -56 44v383zM1310 125q12 0 42 -19.5t57.5 -41.5
+t59.5 -49t36 -30q26 -21 26 -49t-26 -49q-4 -3 -36 -30t-59.5 -49t-57.5 -41.5t-42 -19.5q-13 0 -20.5 10.5t-10 28.5t-2.5 33.5t1.5 33t1.5 19.5h-1024q0 -2 1.5 -19.5t1.5 -33t-2.5 -33.5t-10 -28.5t-20.5 -10.5q-12 0 -42 19.5t-57.5 41.5t-59.5 49t-36 30q-26 21 -26 49
+t26 49q4 3 36 30t59.5 49t57.5 41.5t42 19.5q13 0 20.5 -10.5t10 -28.5t2.5 -33.5t-1.5 -33t-1.5 -19.5h1024q0 2 -1.5 19.5t-1.5 33t2.5 33.5t10 28.5t20.5 10.5z" />
+    <glyph glyph-name="align_left" unicode="&#xf036;" horiz-adv-x="1792" 
+d="M1792 192v-128q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1408 576v-128q0 -26 -19 -45t-45 -19h-1280q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1280q26 0 45 -19t19 -45zM1664 960v-128q0 -26 -19 -45
+t-45 -19h-1536q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1536q26 0 45 -19t19 -45zM1280 1344v-128q0 -26 -19 -45t-45 -19h-1152q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1152q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="align_center" unicode="&#xf037;" horiz-adv-x="1792" 
+d="M1792 192v-128q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1408 576v-128q0 -26 -19 -45t-45 -19h-896q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h896q26 0 45 -19t19 -45zM1664 960v-128q0 -26 -19 -45t-45 -19
+h-1408q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1408q26 0 45 -19t19 -45zM1280 1344v-128q0 -26 -19 -45t-45 -19h-640q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h640q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="align_right" unicode="&#xf038;" horiz-adv-x="1792" 
+d="M1792 192v-128q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1792 576v-128q0 -26 -19 -45t-45 -19h-1280q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1280q26 0 45 -19t19 -45zM1792 960v-128q0 -26 -19 -45
+t-45 -19h-1536q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1536q26 0 45 -19t19 -45zM1792 1344v-128q0 -26 -19 -45t-45 -19h-1152q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1152q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="align_justify" unicode="&#xf039;" horiz-adv-x="1792" 
+d="M1792 192v-128q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1792 576v-128q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1792 960v-128q0 -26 -19 -45
+t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1792 1344v-128q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="list" unicode="&#xf03a;" horiz-adv-x="1792" 
+d="M256 224v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-192q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h192q13 0 22.5 -9.5t9.5 -22.5zM256 608v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-192q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h192q13 0 22.5 -9.5
+t9.5 -22.5zM256 992v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-192q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h192q13 0 22.5 -9.5t9.5 -22.5zM1792 224v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1344q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1344
+q13 0 22.5 -9.5t9.5 -22.5zM256 1376v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-192q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h192q13 0 22.5 -9.5t9.5 -22.5zM1792 608v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1344q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5
+t22.5 9.5h1344q13 0 22.5 -9.5t9.5 -22.5zM1792 992v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1344q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1344q13 0 22.5 -9.5t9.5 -22.5zM1792 1376v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1344q-13 0 -22.5 9.5t-9.5 22.5v192
+q0 13 9.5 22.5t22.5 9.5h1344q13 0 22.5 -9.5t9.5 -22.5z" />
+    <glyph glyph-name="indent_left" unicode="&#xf03b;" horiz-adv-x="1792" 
+d="M384 992v-576q0 -13 -9.5 -22.5t-22.5 -9.5q-14 0 -23 9l-288 288q-9 9 -9 23t9 23l288 288q9 9 23 9q13 0 22.5 -9.5t9.5 -22.5zM1792 224v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1728q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1728q13 0 22.5 -9.5
+t9.5 -22.5zM1792 608v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1088q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1088q13 0 22.5 -9.5t9.5 -22.5zM1792 992v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1088q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1088
+q13 0 22.5 -9.5t9.5 -22.5zM1792 1376v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1728q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1728q13 0 22.5 -9.5t9.5 -22.5z" />
+    <glyph glyph-name="indent_right" unicode="&#xf03c;" horiz-adv-x="1792" 
+d="M352 704q0 -14 -9 -23l-288 -288q-9 -9 -23 -9q-13 0 -22.5 9.5t-9.5 22.5v576q0 13 9.5 22.5t22.5 9.5q14 0 23 -9l288 -288q9 -9 9 -23zM1792 224v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1728q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1728q13 0 22.5 -9.5
+t9.5 -22.5zM1792 608v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1088q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1088q13 0 22.5 -9.5t9.5 -22.5zM1792 992v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1088q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1088
+q13 0 22.5 -9.5t9.5 -22.5zM1792 1376v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1728q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1728q13 0 22.5 -9.5t9.5 -22.5z" />
+    <glyph glyph-name="facetime_video" unicode="&#xf03d;" horiz-adv-x="1792" 
+d="M1792 1184v-1088q0 -42 -39 -59q-13 -5 -25 -5q-27 0 -45 19l-403 403v-166q0 -119 -84.5 -203.5t-203.5 -84.5h-704q-119 0 -203.5 84.5t-84.5 203.5v704q0 119 84.5 203.5t203.5 84.5h704q119 0 203.5 -84.5t84.5 -203.5v-165l403 402q18 19 45 19q12 0 25 -5
+q39 -17 39 -59z" />
+    <glyph glyph-name="picture" unicode="&#xf03e;" horiz-adv-x="1920" 
+d="M640 960q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM1664 576v-448h-1408v192l320 320l160 -160l512 512zM1760 1280h-1600q-13 0 -22.5 -9.5t-9.5 -22.5v-1216q0 -13 9.5 -22.5t22.5 -9.5h1600q13 0 22.5 9.5t9.5 22.5v1216
+q0 13 -9.5 22.5t-22.5 9.5zM1920 1248v-1216q0 -66 -47 -113t-113 -47h-1600q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1600q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="pencil" unicode="&#xf040;" 
+d="M363 0l91 91l-235 235l-91 -91v-107h128v-128h107zM886 928q0 22 -22 22q-10 0 -17 -7l-542 -542q-7 -7 -7 -17q0 -22 22 -22q10 0 17 7l542 542q7 7 7 17zM832 1120l416 -416l-832 -832h-416v416zM1515 1024q0 -53 -37 -90l-166 -166l-416 416l166 165q36 38 90 38
+q53 0 91 -38l235 -234q37 -39 37 -91z" />
+    <glyph glyph-name="map_marker" unicode="&#xf041;" horiz-adv-x="1024" 
+d="M768 896q0 106 -75 181t-181 75t-181 -75t-75 -181t75 -181t181 -75t181 75t75 181zM1024 896q0 -109 -33 -179l-364 -774q-16 -33 -47.5 -52t-67.5 -19t-67.5 19t-46.5 52l-365 774q-33 70 -33 179q0 212 150 362t362 150t362 -150t150 -362z" />
+    <glyph glyph-name="adjust" unicode="&#xf042;" 
+d="M768 96v1088q-148 0 -273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="tint" unicode="&#xf043;" horiz-adv-x="1024" 
+d="M512 384q0 36 -20 69q-1 1 -15.5 22.5t-25.5 38t-25 44t-21 50.5q-4 16 -21 16t-21 -16q-7 -23 -21 -50.5t-25 -44t-25.5 -38t-15.5 -22.5q-20 -33 -20 -69q0 -53 37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1024 512q0 -212 -150 -362t-362 -150t-362 150t-150 362
+q0 145 81 275q6 9 62.5 90.5t101 151t99.5 178t83 201.5q9 30 34 47t51 17t51.5 -17t33.5 -47q28 -93 83 -201.5t99.5 -178t101 -151t62.5 -90.5q81 -127 81 -275z" />
+    <glyph glyph-name="edit" unicode="&#xf044;" horiz-adv-x="1792" 
+d="M888 352l116 116l-152 152l-116 -116v-56h96v-96h56zM1328 1072q-16 16 -33 -1l-350 -350q-17 -17 -1 -33t33 1l350 350q17 17 1 33zM1408 478v-190q0 -119 -84.5 -203.5t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h832
+q63 0 117 -25q15 -7 18 -23q3 -17 -9 -29l-49 -49q-14 -14 -32 -8q-23 6 -45 6h-832q-66 0 -113 -47t-47 -113v-832q0 -66 47 -113t113 -47h832q66 0 113 47t47 113v126q0 13 9 22l64 64q15 15 35 7t20 -29zM1312 1216l288 -288l-672 -672h-288v288zM1756 1084l-92 -92
+l-288 288l92 92q28 28 68 28t68 -28l152 -152q28 -28 28 -68t-28 -68z" />
+    <glyph glyph-name="share" unicode="&#xf045;" horiz-adv-x="1664" 
+d="M1408 547v-259q0 -119 -84.5 -203.5t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h255v0q13 0 22.5 -9.5t9.5 -22.5q0 -27 -26 -32q-77 -26 -133 -60q-10 -4 -16 -4h-112q-66 0 -113 -47t-47 -113v-832q0 -66 47 -113t113 -47h832
+q66 0 113 47t47 113v214q0 19 18 29q28 13 54 37q16 16 35 8q21 -9 21 -29zM1645 1043l-384 -384q-18 -19 -45 -19q-12 0 -25 5q-39 17 -39 59v192h-160q-323 0 -438 -131q-119 -137 -74 -473q3 -23 -20 -34q-8 -2 -12 -2q-16 0 -26 13q-10 14 -21 31t-39.5 68.5t-49.5 99.5
+t-38.5 114t-17.5 122q0 49 3.5 91t14 90t28 88t47 81.5t68.5 74t94.5 61.5t124.5 48.5t159.5 30.5t196.5 11h160v192q0 42 39 59q13 5 25 5q26 0 45 -19l384 -384q19 -19 19 -45t-19 -45z" />
+    <glyph glyph-name="check" unicode="&#xf046;" horiz-adv-x="1664" 
+d="M1408 606v-318q0 -119 -84.5 -203.5t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h832q63 0 117 -25q15 -7 18 -23q3 -17 -9 -29l-49 -49q-10 -10 -23 -10q-3 0 -9 2q-23 6 -45 6h-832q-66 0 -113 -47t-47 -113v-832
+q0 -66 47 -113t113 -47h832q66 0 113 47t47 113v254q0 13 9 22l64 64q10 10 23 10q6 0 12 -3q20 -8 20 -29zM1639 1095l-814 -814q-24 -24 -57 -24t-57 24l-430 430q-24 24 -24 57t24 57l110 110q24 24 57 24t57 -24l263 -263l647 647q24 24 57 24t57 -24l110 -110
+q24 -24 24 -57t-24 -57z" />
+    <glyph glyph-name="move" unicode="&#xf047;" horiz-adv-x="1792" 
+d="M1792 640q0 -26 -19 -45l-256 -256q-19 -19 -45 -19t-45 19t-19 45v128h-384v-384h128q26 0 45 -19t19 -45t-19 -45l-256 -256q-19 -19 -45 -19t-45 19l-256 256q-19 19 -19 45t19 45t45 19h128v384h-384v-128q0 -26 -19 -45t-45 -19t-45 19l-256 256q-19 19 -19 45
+t19 45l256 256q19 19 45 19t45 -19t19 -45v-128h384v384h-128q-26 0 -45 19t-19 45t19 45l256 256q19 19 45 19t45 -19l256 -256q19 -19 19 -45t-19 -45t-45 -19h-128v-384h384v128q0 26 19 45t45 19t45 -19l256 -256q19 -19 19 -45z" />
+    <glyph glyph-name="step_backward" unicode="&#xf048;" horiz-adv-x="1024" 
+d="M979 1395q19 19 32 13t13 -32v-1472q0 -26 -13 -32t-32 13l-710 710q-9 9 -13 19v-678q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v1408q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-678q4 10 13 19z" />
+    <glyph glyph-name="fast_backward" unicode="&#xf049;" horiz-adv-x="1792" 
+d="M1747 1395q19 19 32 13t13 -32v-1472q0 -26 -13 -32t-32 13l-710 710q-9 9 -13 19v-710q0 -26 -13 -32t-32 13l-710 710q-9 9 -13 19v-678q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v1408q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-678q4 10 13 19l710 710
+q19 19 32 13t13 -32v-710q4 10 13 19z" />
+    <glyph glyph-name="backward" unicode="&#xf04a;" horiz-adv-x="1664" 
+d="M1619 1395q19 19 32 13t13 -32v-1472q0 -26 -13 -32t-32 13l-710 710q-9 9 -13 19v-710q0 -26 -13 -32t-32 13l-710 710q-19 19 -19 45t19 45l710 710q19 19 32 13t13 -32v-710q4 10 13 19z" />
+    <glyph glyph-name="play" unicode="&#xf04b;" horiz-adv-x="1408" 
+d="M1384 609l-1328 -738q-23 -13 -39.5 -3t-16.5 36v1472q0 26 16.5 36t39.5 -3l1328 -738q23 -13 23 -31t-23 -31z" />
+    <glyph glyph-name="pause" unicode="&#xf04c;" 
+d="M1536 1344v-1408q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19t-19 45v1408q0 26 19 45t45 19h512q26 0 45 -19t19 -45zM640 1344v-1408q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19t-19 45v1408q0 26 19 45t45 19h512q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="stop" unicode="&#xf04d;" 
+d="M1536 1344v-1408q0 -26 -19 -45t-45 -19h-1408q-26 0 -45 19t-19 45v1408q0 26 19 45t45 19h1408q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="forward" unicode="&#xf04e;" horiz-adv-x="1664" 
+d="M45 -115q-19 -19 -32 -13t-13 32v1472q0 26 13 32t32 -13l710 -710q9 -9 13 -19v710q0 26 13 32t32 -13l710 -710q19 -19 19 -45t-19 -45l-710 -710q-19 -19 -32 -13t-13 32v710q-4 -10 -13 -19z" />
+    <glyph glyph-name="fast_forward" unicode="&#xf050;" horiz-adv-x="1792" 
+d="M45 -115q-19 -19 -32 -13t-13 32v1472q0 26 13 32t32 -13l710 -710q9 -9 13 -19v710q0 26 13 32t32 -13l710 -710q9 -9 13 -19v678q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-1408q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v678q-4 -10 -13 -19l-710 -710
+q-19 -19 -32 -13t-13 32v710q-4 -10 -13 -19z" />
+    <glyph glyph-name="step_forward" unicode="&#xf051;" horiz-adv-x="1024" 
+d="M45 -115q-19 -19 -32 -13t-13 32v1472q0 26 13 32t32 -13l710 -710q9 -9 13 -19v678q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-1408q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v678q-4 -10 -13 -19z" />
+    <glyph glyph-name="eject" unicode="&#xf052;" horiz-adv-x="1538" 
+d="M14 557l710 710q19 19 45 19t45 -19l710 -710q19 -19 13 -32t-32 -13h-1472q-26 0 -32 13t13 32zM1473 0h-1408q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h1408q26 0 45 -19t19 -45v-256q0 -26 -19 -45t-45 -19z" />
+    <glyph glyph-name="chevron_left" unicode="&#xf053;" horiz-adv-x="1280" 
+d="M1171 1235l-531 -531l531 -531q19 -19 19 -45t-19 -45l-166 -166q-19 -19 -45 -19t-45 19l-742 742q-19 19 -19 45t19 45l742 742q19 19 45 19t45 -19l166 -166q19 -19 19 -45t-19 -45z" />
+    <glyph glyph-name="chevron_right" unicode="&#xf054;" horiz-adv-x="1280" 
+d="M1107 659l-742 -742q-19 -19 -45 -19t-45 19l-166 166q-19 19 -19 45t19 45l531 531l-531 531q-19 19 -19 45t19 45l166 166q19 19 45 19t45 -19l742 -742q19 -19 19 -45t-19 -45z" />
+    <glyph glyph-name="plus_sign" unicode="&#xf055;" 
+d="M1216 576v128q0 26 -19 45t-45 19h-256v256q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-256h-256q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h256v-256q0 -26 19 -45t45 -19h128q26 0 45 19t19 45v256h256q26 0 45 19t19 45zM1536 640q0 -209 -103 -385.5
+t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="minus_sign" unicode="&#xf056;" 
+d="M1216 576v128q0 26 -19 45t-45 19h-768q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h768q26 0 45 19t19 45zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5
+t103 -385.5z" />
+    <glyph glyph-name="remove_sign" unicode="&#xf057;" 
+d="M1149 414q0 26 -19 45l-181 181l181 181q19 19 19 45q0 27 -19 46l-90 90q-19 19 -46 19q-26 0 -45 -19l-181 -181l-181 181q-19 19 -45 19q-27 0 -46 -19l-90 -90q-19 -19 -19 -46q0 -26 19 -45l181 -181l-181 -181q-19 -19 -19 -45q0 -27 19 -46l90 -90q19 -19 46 -19
+q26 0 45 19l181 181l181 -181q19 -19 45 -19q27 0 46 19l90 90q19 19 19 46zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="ok_sign" unicode="&#xf058;" 
+d="M1284 802q0 28 -18 46l-91 90q-19 19 -45 19t-45 -19l-408 -407l-226 226q-19 19 -45 19t-45 -19l-91 -90q-18 -18 -18 -46q0 -27 18 -45l362 -362q19 -19 45 -19q27 0 46 19l543 543q18 18 18 45zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103
+t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="question_sign" unicode="&#xf059;" 
+d="M896 160v192q0 14 -9 23t-23 9h-192q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h192q14 0 23 9t9 23zM1152 832q0 88 -55.5 163t-138.5 116t-170 41q-243 0 -371 -213q-15 -24 8 -42l132 -100q7 -6 19 -6q16 0 25 12q53 68 86 92q34 24 86 24q48 0 85.5 -26t37.5 -59
+q0 -38 -20 -61t-68 -45q-63 -28 -115.5 -86.5t-52.5 -125.5v-36q0 -14 9 -23t23 -9h192q14 0 23 9t9 23q0 19 21.5 49.5t54.5 49.5q32 18 49 28.5t46 35t44.5 48t28 60.5t12.5 81zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5
+t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="info_sign" unicode="&#xf05a;" 
+d="M1024 160v160q0 14 -9 23t-23 9h-96v512q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-160q0 -14 9 -23t23 -9h96v-320h-96q-14 0 -23 -9t-9 -23v-160q0 -14 9 -23t23 -9h448q14 0 23 9t9 23zM896 1056v160q0 14 -9 23t-23 9h-192q-14 0 -23 -9t-9 -23v-160q0 -14 9 -23
+t23 -9h192q14 0 23 9t9 23zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="screenshot" unicode="&#xf05b;" 
+d="M1197 512h-109q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h109q-32 108 -112.5 188.5t-188.5 112.5v-109q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v109q-108 -32 -188.5 -112.5t-112.5 -188.5h109q26 0 45 -19t19 -45v-128q0 -26 -19 -45t-45 -19h-109
+q32 -108 112.5 -188.5t188.5 -112.5v109q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-109q108 32 188.5 112.5t112.5 188.5zM1536 704v-128q0 -26 -19 -45t-45 -19h-143q-37 -161 -154.5 -278.5t-278.5 -154.5v-143q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v143
+q-161 37 -278.5 154.5t-154.5 278.5h-143q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h143q37 161 154.5 278.5t278.5 154.5v143q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-143q161 -37 278.5 -154.5t154.5 -278.5h143q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="remove_circle" unicode="&#xf05c;" 
+d="M1097 457l-146 -146q-10 -10 -23 -10t-23 10l-137 137l-137 -137q-10 -10 -23 -10t-23 10l-146 146q-10 10 -10 23t10 23l137 137l-137 137q-10 10 -10 23t10 23l146 146q10 10 23 10t23 -10l137 -137l137 137q10 10 23 10t23 -10l146 -146q10 -10 10 -23t-10 -23
+l-137 -137l137 -137q10 -10 10 -23t-10 -23zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5
+t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="ok_circle" unicode="&#xf05d;" 
+d="M1171 723l-422 -422q-19 -19 -45 -19t-45 19l-294 294q-19 19 -19 45t19 45l102 102q19 19 45 19t45 -19l147 -147l275 275q19 19 45 19t45 -19l102 -102q19 -19 19 -45t-19 -45zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273t73 -273t198 -198
+t273 -73t273 73t198 198t73 273zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="ban_circle" unicode="&#xf05e;" 
+d="M1312 643q0 161 -87 295l-754 -753q137 -89 297 -89q111 0 211.5 43.5t173.5 116.5t116 174.5t43 212.5zM313 344l755 754q-135 91 -300 91q-148 0 -273 -73t-198 -199t-73 -274q0 -162 89 -299zM1536 643q0 -157 -61 -300t-163.5 -246t-245 -164t-298.5 -61t-298.5 61
+t-245 164t-163.5 246t-61 300t61 299.5t163.5 245.5t245 164t298.5 61t298.5 -61t245 -164t163.5 -245.5t61 -299.5z" />
+    <glyph glyph-name="arrow_left" unicode="&#xf060;" 
+d="M1536 640v-128q0 -53 -32.5 -90.5t-84.5 -37.5h-704l293 -294q38 -36 38 -90t-38 -90l-75 -76q-37 -37 -90 -37q-52 0 -91 37l-651 652q-37 37 -37 90q0 52 37 91l651 650q38 38 91 38q52 0 90 -38l75 -74q38 -38 38 -91t-38 -91l-293 -293h704q52 0 84.5 -37.5
+t32.5 -90.5z" />
+    <glyph glyph-name="arrow_right" unicode="&#xf061;" 
+d="M1472 576q0 -54 -37 -91l-651 -651q-39 -37 -91 -37q-51 0 -90 37l-75 75q-38 38 -38 91t38 91l293 293h-704q-52 0 -84.5 37.5t-32.5 90.5v128q0 53 32.5 90.5t84.5 37.5h704l-293 294q-38 36 -38 90t38 90l75 75q38 38 90 38q53 0 91 -38l651 -651q37 -35 37 -90z" />
+    <glyph glyph-name="arrow_up" unicode="&#xf062;" horiz-adv-x="1664" 
+d="M1611 565q0 -51 -37 -90l-75 -75q-38 -38 -91 -38q-54 0 -90 38l-294 293v-704q0 -52 -37.5 -84.5t-90.5 -32.5h-128q-53 0 -90.5 32.5t-37.5 84.5v704l-294 -293q-36 -38 -90 -38t-90 38l-75 75q-38 38 -38 90q0 53 38 91l651 651q35 37 90 37q54 0 91 -37l651 -651
+q37 -39 37 -91z" />
+    <glyph glyph-name="arrow_down" unicode="&#xf063;" horiz-adv-x="1664" 
+d="M1611 704q0 -53 -37 -90l-651 -652q-39 -37 -91 -37q-53 0 -90 37l-651 652q-38 36 -38 90q0 53 38 91l74 75q39 37 91 37q53 0 90 -37l294 -294v704q0 52 38 90t90 38h128q52 0 90 -38t38 -90v-704l294 294q37 37 90 37q52 0 91 -37l75 -75q37 -39 37 -91z" />
+    <glyph glyph-name="share_alt" unicode="&#xf064;" horiz-adv-x="1792" 
+d="M1792 896q0 -26 -19 -45l-512 -512q-19 -19 -45 -19t-45 19t-19 45v256h-224q-98 0 -175.5 -6t-154 -21.5t-133 -42.5t-105.5 -69.5t-80 -101t-48.5 -138.5t-17.5 -181q0 -55 5 -123q0 -6 2.5 -23.5t2.5 -26.5q0 -15 -8.5 -25t-23.5 -10q-16 0 -28 17q-7 9 -13 22
+t-13.5 30t-10.5 24q-127 285 -127 451q0 199 53 333q162 403 875 403h224v256q0 26 19 45t45 19t45 -19l512 -512q19 -19 19 -45z" />
+    <glyph glyph-name="resize_full" unicode="&#xf065;" 
+d="M755 480q0 -13 -10 -23l-332 -332l144 -144q19 -19 19 -45t-19 -45t-45 -19h-448q-26 0 -45 19t-19 45v448q0 26 19 45t45 19t45 -19l144 -144l332 332q10 10 23 10t23 -10l114 -114q10 -10 10 -23zM1536 1344v-448q0 -26 -19 -45t-45 -19t-45 19l-144 144l-332 -332
+q-10 -10 -23 -10t-23 10l-114 114q-10 10 -10 23t10 23l332 332l-144 144q-19 19 -19 45t19 45t45 19h448q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="resize_small" unicode="&#xf066;" 
+d="M768 576v-448q0 -26 -19 -45t-45 -19t-45 19l-144 144l-332 -332q-10 -10 -23 -10t-23 10l-114 114q-10 10 -10 23t10 23l332 332l-144 144q-19 19 -19 45t19 45t45 19h448q26 0 45 -19t19 -45zM1523 1248q0 -13 -10 -23l-332 -332l144 -144q19 -19 19 -45t-19 -45
+t-45 -19h-448q-26 0 -45 19t-19 45v448q0 26 19 45t45 19t45 -19l144 -144l332 332q10 10 23 10t23 -10l114 -114q10 -10 10 -23z" />
+    <glyph glyph-name="plus" unicode="&#xf067;" horiz-adv-x="1408" 
+d="M1408 800v-192q0 -40 -28 -68t-68 -28h-416v-416q0 -40 -28 -68t-68 -28h-192q-40 0 -68 28t-28 68v416h-416q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h416v416q0 40 28 68t68 28h192q40 0 68 -28t28 -68v-416h416q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="minus" unicode="&#xf068;" horiz-adv-x="1408" 
+d="M1408 800v-192q0 -40 -28 -68t-68 -28h-1216q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h1216q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="asterisk" unicode="&#xf069;" horiz-adv-x="1664" 
+d="M1482 486q46 -26 59.5 -77.5t-12.5 -97.5l-64 -110q-26 -46 -77.5 -59.5t-97.5 12.5l-266 153v-307q0 -52 -38 -90t-90 -38h-128q-52 0 -90 38t-38 90v307l-266 -153q-46 -26 -97.5 -12.5t-77.5 59.5l-64 110q-26 46 -12.5 97.5t59.5 77.5l266 154l-266 154
+q-46 26 -59.5 77.5t12.5 97.5l64 110q26 46 77.5 59.5t97.5 -12.5l266 -153v307q0 52 38 90t90 38h128q52 0 90 -38t38 -90v-307l266 153q46 26 97.5 12.5t77.5 -59.5l64 -110q26 -46 12.5 -97.5t-59.5 -77.5l-266 -154z" />
+    <glyph glyph-name="exclamation_sign" unicode="&#xf06a;" 
+d="M768 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5t-103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103zM896 161v190q0 14 -9 23.5t-22 9.5h-192q-13 0 -23 -10t-10 -23v-190q0 -13 10 -23t23 -10h192
+q13 0 22 9.5t9 23.5zM894 505l18 621q0 12 -10 18q-10 8 -24 8h-220q-14 0 -24 -8q-10 -6 -10 -18l17 -621q0 -10 10 -17.5t24 -7.5h185q14 0 23.5 7.5t10.5 17.5z" />
+    <glyph glyph-name="gift" unicode="&#xf06b;" 
+d="M928 180v56v468v192h-320v-192v-468v-56q0 -25 18 -38.5t46 -13.5h192q28 0 46 13.5t18 38.5zM472 1024h195l-126 161q-26 31 -69 31q-40 0 -68 -28t-28 -68t28 -68t68 -28zM1160 1120q0 40 -28 68t-68 28q-43 0 -69 -31l-125 -161h194q40 0 68 28t28 68zM1536 864v-320
+q0 -14 -9 -23t-23 -9h-96v-416q0 -40 -28 -68t-68 -28h-1088q-40 0 -68 28t-28 68v416h-96q-14 0 -23 9t-9 23v320q0 14 9 23t23 9h440q-93 0 -158.5 65.5t-65.5 158.5t65.5 158.5t158.5 65.5q107 0 168 -77l128 -165l128 165q61 77 168 77q93 0 158.5 -65.5t65.5 -158.5
+t-65.5 -158.5t-158.5 -65.5h440q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="leaf" unicode="&#xf06c;" horiz-adv-x="1792" 
+d="M1280 832q0 26 -19 45t-45 19q-172 0 -318 -49.5t-259.5 -134t-235.5 -219.5q-19 -21 -19 -45q0 -26 19 -45t45 -19q24 0 45 19q27 24 74 71t67 66q137 124 268.5 176t313.5 52q26 0 45 19t19 45zM1792 1030q0 -95 -20 -193q-46 -224 -184.5 -383t-357.5 -268
+q-214 -108 -438 -108q-148 0 -286 47q-15 5 -88 42t-96 37q-16 0 -39.5 -32t-45 -70t-52.5 -70t-60 -32q-43 0 -63.5 17.5t-45.5 59.5q-2 4 -6 11t-5.5 10t-3 9.5t-1.5 13.5q0 35 31 73.5t68 65.5t68 56t31 48q0 4 -14 38t-16 44q-9 51 -9 104q0 115 43.5 220t119 184.5
+t170.5 139t204 95.5q55 18 145 25.5t179.5 9t178.5 6t163.5 24t113.5 56.5l29.5 29.5t29.5 28t27 20t36.5 16t43.5 4.5q39 0 70.5 -46t47.5 -112t24 -124t8 -96z" />
+    <glyph glyph-name="fire" unicode="&#xf06d;" horiz-adv-x="1408" 
+d="M1408 -160v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-1344q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h1344q13 0 22.5 -9.5t9.5 -22.5zM1152 896q0 -78 -24.5 -144t-64 -112.5t-87.5 -88t-96 -77.5t-87.5 -72t-64 -81.5t-24.5 -96.5q0 -96 67 -224l-4 1l1 -1
+q-90 41 -160 83t-138.5 100t-113.5 122.5t-72.5 150.5t-27.5 184q0 78 24.5 144t64 112.5t87.5 88t96 77.5t87.5 72t64 81.5t24.5 96.5q0 94 -66 224l3 -1l-1 1q90 -41 160 -83t138.5 -100t113.5 -122.5t72.5 -150.5t27.5 -184z" />
+    <glyph glyph-name="eye_open" unicode="&#xf06e;" horiz-adv-x="1792" 
+d="M1664 576q-152 236 -381 353q61 -104 61 -225q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 121 61 225q-229 -117 -381 -353q133 -205 333.5 -326.5t434.5 -121.5t434.5 121.5t333.5 326.5zM944 960q0 20 -14 34t-34 14q-125 0 -214.5 -89.5
+t-89.5 -214.5q0 -20 14 -34t34 -14t34 14t14 34q0 86 61 147t147 61q20 0 34 14t14 34zM1792 576q0 -34 -20 -69q-140 -230 -376.5 -368.5t-499.5 -138.5t-499.5 139t-376.5 368q-20 35 -20 69t20 69q140 229 376.5 368t499.5 139t499.5 -139t376.5 -368q20 -35 20 -69z" />
+    <glyph glyph-name="eye_close" unicode="&#xf070;" horiz-adv-x="1792" 
+d="M555 201l78 141q-87 63 -136 159t-49 203q0 121 61 225q-229 -117 -381 -353q167 -258 427 -375zM944 960q0 20 -14 34t-34 14q-125 0 -214.5 -89.5t-89.5 -214.5q0 -20 14 -34t34 -14t34 14t14 34q0 86 61 147t147 61q20 0 34 14t14 34zM1307 1151q0 -7 -1 -9
+q-106 -189 -316 -567t-315 -566l-49 -89q-10 -16 -28 -16q-12 0 -134 70q-16 10 -16 28q0 12 44 87q-143 65 -263.5 173t-208.5 245q-20 31 -20 69t20 69q153 235 380 371t496 136q89 0 180 -17l54 97q10 16 28 16q5 0 18 -6t31 -15.5t33 -18.5t31.5 -18.5t19.5 -11.5
+q16 -10 16 -27zM1344 704q0 -139 -79 -253.5t-209 -164.5l280 502q8 -45 8 -84zM1792 576q0 -35 -20 -69q-39 -64 -109 -145q-150 -172 -347.5 -267t-419.5 -95l74 132q212 18 392.5 137t301.5 307q-115 179 -282 294l63 112q95 -64 182.5 -153t144.5 -184q20 -34 20 -69z
+" />
+    <glyph glyph-name="warning_sign" unicode="&#xf071;" horiz-adv-x="1792" 
+d="M1024 161v190q0 14 -9.5 23.5t-22.5 9.5h-192q-13 0 -22.5 -9.5t-9.5 -23.5v-190q0 -14 9.5 -23.5t22.5 -9.5h192q13 0 22.5 9.5t9.5 23.5zM1022 535l18 459q0 12 -10 19q-13 11 -24 11h-220q-11 0 -24 -11q-10 -7 -10 -21l17 -457q0 -10 10 -16.5t24 -6.5h185
+q14 0 23.5 6.5t10.5 16.5zM1008 1469l768 -1408q35 -63 -2 -126q-17 -29 -46.5 -46t-63.5 -17h-1536q-34 0 -63.5 17t-46.5 46q-37 63 -2 126l768 1408q17 31 47 49t65 18t65 -18t47 -49z" />
+    <glyph glyph-name="plane" unicode="&#xf072;" horiz-adv-x="1408" 
+d="M1376 1376q44 -52 12 -148t-108 -172l-161 -161l160 -696q5 -19 -12 -33l-128 -96q-7 -6 -19 -6q-4 0 -7 1q-15 3 -21 16l-279 508l-259 -259l53 -194q5 -17 -8 -31l-96 -96q-9 -9 -23 -9h-2q-15 2 -24 13l-189 252l-252 189q-11 7 -13 23q-1 13 9 25l96 97q9 9 23 9
+q6 0 8 -1l194 -53l259 259l-508 279q-14 8 -17 24q-2 16 9 27l128 128q14 13 30 8l665 -159l160 160q76 76 172 108t148 -12z" />
+    <glyph glyph-name="calendar" unicode="&#xf073;" horiz-adv-x="1664" 
+d="M128 -128h288v288h-288v-288zM480 -128h320v288h-320v-288zM128 224h288v320h-288v-320zM480 224h320v320h-320v-320zM128 608h288v288h-288v-288zM864 -128h320v288h-320v-288zM480 608h320v288h-320v-288zM1248 -128h288v288h-288v-288zM864 224h320v320h-320v-320z
+M512 1088v288q0 13 -9.5 22.5t-22.5 9.5h-64q-13 0 -22.5 -9.5t-9.5 -22.5v-288q0 -13 9.5 -22.5t22.5 -9.5h64q13 0 22.5 9.5t9.5 22.5zM1248 224h288v320h-288v-320zM864 608h320v288h-320v-288zM1248 608h288v288h-288v-288zM1280 1088v288q0 13 -9.5 22.5t-22.5 9.5h-64
+q-13 0 -22.5 -9.5t-9.5 -22.5v-288q0 -13 9.5 -22.5t22.5 -9.5h64q13 0 22.5 9.5t9.5 22.5zM1664 1152v-1280q0 -52 -38 -90t-90 -38h-1408q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h128v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h384v96q0 66 47 113t113 47
+h64q66 0 113 -47t47 -113v-96h128q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="random" unicode="&#xf074;" horiz-adv-x="1792" 
+d="M666 1055q-60 -92 -137 -273q-22 45 -37 72.5t-40.5 63.5t-51 56.5t-63 35t-81.5 14.5h-224q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h224q250 0 410 -225zM1792 256q0 -14 -9 -23l-320 -320q-9 -9 -23 -9q-13 0 -22.5 9.5t-9.5 22.5v192q-32 0 -85 -0.5t-81 -1t-73 1
+t-71 5t-64 10.5t-63 18.5t-58 28.5t-59 40t-55 53.5t-56 69.5q59 93 136 273q22 -45 37 -72.5t40.5 -63.5t51 -56.5t63 -35t81.5 -14.5h256v192q0 14 9 23t23 9q12 0 24 -10l319 -319q9 -9 9 -23zM1792 1152q0 -14 -9 -23l-320 -320q-9 -9 -23 -9q-13 0 -22.5 9.5t-9.5 22.5
+v192h-256q-48 0 -87 -15t-69 -45t-51 -61.5t-45 -77.5q-32 -62 -78 -171q-29 -66 -49.5 -111t-54 -105t-64 -100t-74 -83t-90 -68.5t-106.5 -42t-128 -16.5h-224q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h224q48 0 87 15t69 45t51 61.5t45 77.5q32 62 78 171q29 66 49.5 111
+t54 105t64 100t74 83t90 68.5t106.5 42t128 16.5h256v192q0 14 9 23t23 9q12 0 24 -10l319 -319q9 -9 9 -23z" />
+    <glyph glyph-name="comment" unicode="&#xf075;" horiz-adv-x="1792" 
+d="M1792 640q0 -174 -120 -321.5t-326 -233t-450 -85.5q-70 0 -145 8q-198 -175 -460 -242q-49 -14 -114 -22q-17 -2 -30.5 9t-17.5 29v1q-3 4 -0.5 12t2 10t4.5 9.5l6 9t7 8.5t8 9q7 8 31 34.5t34.5 38t31 39.5t32.5 51t27 59t26 76q-157 89 -247.5 220t-90.5 281
+q0 130 71 248.5t191 204.5t286 136.5t348 50.5q244 0 450 -85.5t326 -233t120 -321.5z" />
+    <glyph glyph-name="magnet" unicode="&#xf076;" 
+d="M1536 704v-128q0 -201 -98.5 -362t-274 -251.5t-395.5 -90.5t-395.5 90.5t-274 251.5t-98.5 362v128q0 26 19 45t45 19h384q26 0 45 -19t19 -45v-128q0 -52 23.5 -90t53.5 -57t71 -30t64 -13t44 -2t44 2t64 13t71 30t53.5 57t23.5 90v128q0 26 19 45t45 19h384
+q26 0 45 -19t19 -45zM512 1344v-384q0 -26 -19 -45t-45 -19h-384q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h384q26 0 45 -19t19 -45zM1536 1344v-384q0 -26 -19 -45t-45 -19h-384q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h384q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="chevron_up" unicode="&#xf077;" horiz-adv-x="1792" 
+d="M1683 205l-166 -165q-19 -19 -45 -19t-45 19l-531 531l-531 -531q-19 -19 -45 -19t-45 19l-166 165q-19 19 -19 45.5t19 45.5l742 741q19 19 45 19t45 -19l742 -741q19 -19 19 -45.5t-19 -45.5z" />
+    <glyph glyph-name="chevron_down" unicode="&#xf078;" horiz-adv-x="1792" 
+d="M1683 728l-742 -741q-19 -19 -45 -19t-45 19l-742 741q-19 19 -19 45.5t19 45.5l166 165q19 19 45 19t45 -19l531 -531l531 531q19 19 45 19t45 -19l166 -165q19 -19 19 -45.5t-19 -45.5z" />
+    <glyph glyph-name="retweet" unicode="&#xf079;" horiz-adv-x="1920" 
+d="M1280 32q0 -13 -9.5 -22.5t-22.5 -9.5h-960q-8 0 -13.5 2t-9 7t-5.5 8t-3 11.5t-1 11.5v13v11v160v416h-192q-26 0 -45 19t-19 45q0 24 15 41l320 384q19 22 49 22t49 -22l320 -384q15 -17 15 -41q0 -26 -19 -45t-45 -19h-192v-384h576q16 0 25 -11l160 -192q7 -10 7 -21
+zM1920 448q0 -24 -15 -41l-320 -384q-20 -23 -49 -23t-49 23l-320 384q-15 17 -15 41q0 26 19 45t45 19h192v384h-576q-16 0 -25 12l-160 192q-7 9 -7 20q0 13 9.5 22.5t22.5 9.5h960q8 0 13.5 -2t9 -7t5.5 -8t3 -11.5t1 -11.5v-13v-11v-160v-416h192q26 0 45 -19t19 -45z
+" />
+    <glyph glyph-name="shopping_cart" unicode="&#xf07a;" horiz-adv-x="1664" 
+d="M640 0q0 -52 -38 -90t-90 -38t-90 38t-38 90t38 90t90 38t90 -38t38 -90zM1536 0q0 -52 -38 -90t-90 -38t-90 38t-38 90t38 90t90 38t90 -38t38 -90zM1664 1088v-512q0 -24 -16.5 -42.5t-40.5 -21.5l-1044 -122q13 -60 13 -70q0 -16 -24 -64h920q26 0 45 -19t19 -45
+t-19 -45t-45 -19h-1024q-26 0 -45 19t-19 45q0 11 8 31.5t16 36t21.5 40t15.5 29.5l-177 823h-204q-26 0 -45 19t-19 45t19 45t45 19h256q16 0 28.5 -6.5t19.5 -15.5t13 -24.5t8 -26t5.5 -29.5t4.5 -26h1201q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="folder_close" unicode="&#xf07b;" horiz-adv-x="1664" 
+d="M1664 928v-704q0 -92 -66 -158t-158 -66h-1216q-92 0 -158 66t-66 158v960q0 92 66 158t158 66h320q92 0 158 -66t66 -158v-32h672q92 0 158 -66t66 -158z" />
+    <glyph glyph-name="folder_open" unicode="&#xf07c;" horiz-adv-x="1920" 
+d="M1879 584q0 -31 -31 -66l-336 -396q-43 -51 -120.5 -86.5t-143.5 -35.5h-1088q-34 0 -60.5 13t-26.5 43q0 31 31 66l336 396q43 51 120.5 86.5t143.5 35.5h1088q34 0 60.5 -13t26.5 -43zM1536 928v-160h-832q-94 0 -197 -47.5t-164 -119.5l-337 -396l-5 -6q0 4 -0.5 12.5
+t-0.5 12.5v960q0 92 66 158t158 66h320q92 0 158 -66t66 -158v-32h544q92 0 158 -66t66 -158z" />
+    <glyph glyph-name="resize_vertical" unicode="&#xf07d;" horiz-adv-x="768" 
+d="M704 1216q0 -26 -19 -45t-45 -19h-128v-1024h128q26 0 45 -19t19 -45t-19 -45l-256 -256q-19 -19 -45 -19t-45 19l-256 256q-19 19 -19 45t19 45t45 19h128v1024h-128q-26 0 -45 19t-19 45t19 45l256 256q19 19 45 19t45 -19l256 -256q19 -19 19 -45z" />
+    <glyph glyph-name="resize_horizontal" unicode="&#xf07e;" horiz-adv-x="1792" 
+d="M1792 640q0 -26 -19 -45l-256 -256q-19 -19 -45 -19t-45 19t-19 45v128h-1024v-128q0 -26 -19 -45t-45 -19t-45 19l-256 256q-19 19 -19 45t19 45l256 256q19 19 45 19t45 -19t19 -45v-128h1024v128q0 26 19 45t45 19t45 -19l256 -256q19 -19 19 -45z" />
+    <glyph glyph-name="bar_chart" unicode="&#xf080;" horiz-adv-x="2048" 
+d="M640 640v-512h-256v512h256zM1024 1152v-1024h-256v1024h256zM2048 0v-128h-2048v1536h128v-1408h1920zM1408 896v-768h-256v768h256zM1792 1280v-1152h-256v1152h256z" />
+    <glyph glyph-name="twitter_sign" unicode="&#xf081;" 
+d="M1280 926q-56 -25 -121 -34q68 40 93 117q-65 -38 -134 -51q-61 66 -153 66q-87 0 -148.5 -61.5t-61.5 -148.5q0 -29 5 -48q-129 7 -242 65t-192 155q-29 -50 -29 -106q0 -114 91 -175q-47 1 -100 26v-2q0 -75 50 -133.5t123 -72.5q-29 -8 -51 -8q-13 0 -39 4
+q21 -63 74.5 -104t121.5 -42q-116 -90 -261 -90q-26 0 -50 3q148 -94 322 -94q112 0 210 35.5t168 95t120.5 137t75 162t24.5 168.5q0 18 -1 27q63 45 105 109zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5
+t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="facebook_sign" unicode="&#xf082;" 
+d="M1248 1408q119 0 203.5 -84.5t84.5 -203.5v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-188v595h199l30 232h-229v148q0 56 23.5 84t91.5 28l122 1v207q-63 9 -178 9q-136 0 -217.5 -80t-81.5 -226v-171h-200v-232h200v-595h-532q-119 0 -203.5 84.5t-84.5 203.5v960
+q0 119 84.5 203.5t203.5 84.5h960z" />
+    <glyph glyph-name="camera_retro" unicode="&#xf083;" horiz-adv-x="1792" 
+d="M928 704q0 14 -9 23t-23 9q-66 0 -113 -47t-47 -113q0 -14 9 -23t23 -9t23 9t9 23q0 40 28 68t68 28q14 0 23 9t9 23zM1152 574q0 -106 -75 -181t-181 -75t-181 75t-75 181t75 181t181 75t181 -75t75 -181zM128 0h1536v128h-1536v-128zM1280 574q0 159 -112.5 271.5
+t-271.5 112.5t-271.5 -112.5t-112.5 -271.5t112.5 -271.5t271.5 -112.5t271.5 112.5t112.5 271.5zM256 1216h384v128h-384v-128zM128 1024h1536v118v138h-828l-64 -128h-644v-128zM1792 1280v-1280q0 -53 -37.5 -90.5t-90.5 -37.5h-1536q-53 0 -90.5 37.5t-37.5 90.5v1280
+q0 53 37.5 90.5t90.5 37.5h1536q53 0 90.5 -37.5t37.5 -90.5z" />
+    <glyph glyph-name="key" unicode="&#xf084;" horiz-adv-x="1792" 
+d="M832 1024q0 80 -56 136t-136 56t-136 -56t-56 -136q0 -42 19 -83q-41 19 -83 19q-80 0 -136 -56t-56 -136t56 -136t136 -56t136 56t56 136q0 42 -19 83q41 -19 83 -19q80 0 136 56t56 136zM1683 320q0 -17 -49 -66t-66 -49q-9 0 -28.5 16t-36.5 33t-38.5 40t-24.5 26
+l-96 -96l220 -220q28 -28 28 -68q0 -42 -39 -81t-81 -39q-40 0 -68 28l-671 671q-176 -131 -365 -131q-163 0 -265.5 102.5t-102.5 265.5q0 160 95 313t248 248t313 95q163 0 265.5 -102.5t102.5 -265.5q0 -189 -131 -365l355 -355l96 96q-3 3 -26 24.5t-40 38.5t-33 36.5
+t-16 28.5q0 17 49 66t66 49q13 0 23 -10q6 -6 46 -44.5t82 -79.5t86.5 -86t73 -78t28.5 -41z" />
+    <glyph glyph-name="cogs" unicode="&#xf085;" horiz-adv-x="1920" 
+d="M896 640q0 106 -75 181t-181 75t-181 -75t-75 -181t75 -181t181 -75t181 75t75 181zM1664 128q0 52 -38 90t-90 38t-90 -38t-38 -90q0 -53 37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1664 1152q0 52 -38 90t-90 38t-90 -38t-38 -90q0 -53 37.5 -90.5t90.5 -37.5
+t90.5 37.5t37.5 90.5zM1280 731v-185q0 -10 -7 -19.5t-16 -10.5l-155 -24q-11 -35 -32 -76q34 -48 90 -115q7 -11 7 -20q0 -12 -7 -19q-23 -30 -82.5 -89.5t-78.5 -59.5q-11 0 -21 7l-115 90q-37 -19 -77 -31q-11 -108 -23 -155q-7 -24 -30 -24h-186q-11 0 -20 7.5t-10 17.5
+l-23 153q-34 10 -75 31l-118 -89q-7 -7 -20 -7q-11 0 -21 8q-144 133 -144 160q0 9 7 19q10 14 41 53t47 61q-23 44 -35 82l-152 24q-10 1 -17 9.5t-7 19.5v185q0 10 7 19.5t16 10.5l155 24q11 35 32 76q-34 48 -90 115q-7 11 -7 20q0 12 7 20q22 30 82 89t79 59q11 0 21 -7
+l115 -90q34 18 77 32q11 108 23 154q7 24 30 24h186q11 0 20 -7.5t10 -17.5l23 -153q34 -10 75 -31l118 89q8 7 20 7q11 0 21 -8q144 -133 144 -160q0 -8 -7 -19q-12 -16 -42 -54t-45 -60q23 -48 34 -82l152 -23q10 -2 17 -10.5t7 -19.5zM1920 198v-140q0 -16 -149 -31
+q-12 -27 -30 -52q51 -113 51 -138q0 -4 -4 -7q-122 -71 -124 -71q-8 0 -46 47t-52 68q-20 -2 -30 -2t-30 2q-14 -21 -52 -68t-46 -47q-2 0 -124 71q-4 3 -4 7q0 25 51 138q-18 25 -30 52q-149 15 -149 31v140q0 16 149 31q13 29 30 52q-51 113 -51 138q0 4 4 7q4 2 35 20
+t59 34t30 16q8 0 46 -46.5t52 -67.5q20 2 30 2t30 -2q51 71 92 112l6 2q4 0 124 -70q4 -3 4 -7q0 -25 -51 -138q17 -23 30 -52q149 -15 149 -31zM1920 1222v-140q0 -16 -149 -31q-12 -27 -30 -52q51 -113 51 -138q0 -4 -4 -7q-122 -71 -124 -71q-8 0 -46 47t-52 68
+q-20 -2 -30 -2t-30 2q-14 -21 -52 -68t-46 -47q-2 0 -124 71q-4 3 -4 7q0 25 51 138q-18 25 -30 52q-149 15 -149 31v140q0 16 149 31q13 29 30 52q-51 113 -51 138q0 4 4 7q4 2 35 20t59 34t30 16q8 0 46 -46.5t52 -67.5q20 2 30 2t30 -2q51 71 92 112l6 2q4 0 124 -70
+q4 -3 4 -7q0 -25 -51 -138q17 -23 30 -52q149 -15 149 -31z" />
+    <glyph glyph-name="comments" unicode="&#xf086;" horiz-adv-x="1792" 
+d="M1408 768q0 -139 -94 -257t-256.5 -186.5t-353.5 -68.5q-86 0 -176 16q-124 -88 -278 -128q-36 -9 -86 -16h-3q-11 0 -20.5 8t-11.5 21q-1 3 -1 6.5t0.5 6.5t2 6l2.5 5t3.5 5.5t4 5t4.5 5t4 4.5q5 6 23 25t26 29.5t22.5 29t25 38.5t20.5 44q-124 72 -195 177t-71 224
+q0 139 94 257t256.5 186.5t353.5 68.5t353.5 -68.5t256.5 -186.5t94 -257zM1792 512q0 -120 -71 -224.5t-195 -176.5q10 -24 20.5 -44t25 -38.5t22.5 -29t26 -29.5t23 -25q1 -1 4 -4.5t4.5 -5t4 -5t3.5 -5.5l2.5 -5t2 -6t0.5 -6.5t-1 -6.5q-3 -14 -13 -22t-22 -7
+q-50 7 -86 16q-154 40 -278 128q-90 -16 -176 -16q-271 0 -472 132q58 -4 88 -4q161 0 309 45t264 129q125 92 192 212t67 254q0 77 -23 152q129 -71 204 -178t75 -230z" />
+    <glyph glyph-name="thumbs_up_alt" unicode="&#xf087;" 
+d="M256 192q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1408 768q0 51 -39 89.5t-89 38.5h-352q0 58 48 159.5t48 160.5q0 98 -32 145t-128 47q-26 -26 -38 -85t-30.5 -125.5t-59.5 -109.5q-22 -23 -77 -91q-4 -5 -23 -30t-31.5 -41t-34.5 -42.5
+t-40 -44t-38.5 -35.5t-40 -27t-35.5 -9h-32v-640h32q13 0 31.5 -3t33 -6.5t38 -11t35 -11.5t35.5 -12.5t29 -10.5q211 -73 342 -73h121q192 0 192 167q0 26 -5 56q30 16 47.5 52.5t17.5 73.5t-18 69q53 50 53 119q0 25 -10 55.5t-25 47.5q32 1 53.5 47t21.5 81zM1536 769
+q0 -89 -49 -163q9 -33 9 -69q0 -77 -38 -144q3 -21 3 -43q0 -101 -60 -178q1 -139 -85 -219.5t-227 -80.5h-36h-93q-96 0 -189.5 22.5t-216.5 65.5q-116 40 -138 40h-288q-53 0 -90.5 37.5t-37.5 90.5v640q0 53 37.5 90.5t90.5 37.5h274q36 24 137 155q58 75 107 128
+q24 25 35.5 85.5t30.5 126.5t62 108q39 37 90 37q84 0 151 -32.5t102 -101.5t35 -186q0 -93 -48 -192h176q104 0 180 -76t76 -179z" />
+    <glyph glyph-name="thumbs_down_alt" unicode="&#xf088;" 
+d="M256 1088q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1408 512q0 35 -21.5 81t-53.5 47q15 17 25 47.5t10 55.5q0 69 -53 119q18 31 18 69q0 37 -17.5 73.5t-47.5 52.5q5 30 5 56q0 85 -49 126t-136 41h-128q-131 0 -342 -73q-5 -2 -29 -10.5
+t-35.5 -12.5t-35 -11.5t-38 -11t-33 -6.5t-31.5 -3h-32v-640h32q16 0 35.5 -9t40 -27t38.5 -35.5t40 -44t34.5 -42.5t31.5 -41t23 -30q55 -68 77 -91q41 -43 59.5 -109.5t30.5 -125.5t38 -85q96 0 128 47t32 145q0 59 -48 160.5t-48 159.5h352q50 0 89 38.5t39 89.5z
+M1536 511q0 -103 -76 -179t-180 -76h-176q48 -99 48 -192q0 -118 -35 -186q-35 -69 -102 -101.5t-151 -32.5q-51 0 -90 37q-34 33 -54 82t-25.5 90.5t-17.5 84.5t-31 64q-48 50 -107 127q-101 131 -137 155h-274q-53 0 -90.5 37.5t-37.5 90.5v640q0 53 37.5 90.5t90.5 37.5
+h288q22 0 138 40q128 44 223 66t200 22h112q140 0 226.5 -79t85.5 -216v-5q60 -77 60 -178q0 -22 -3 -43q38 -67 38 -144q0 -36 -9 -69q49 -73 49 -163z" />
+    <glyph glyph-name="star_half" unicode="&#xf089;" horiz-adv-x="896" 
+d="M832 1504v-1339l-449 -236q-22 -12 -40 -12q-21 0 -31.5 14.5t-10.5 35.5q0 6 2 20l86 500l-364 354q-25 27 -25 48q0 37 56 46l502 73l225 455q19 41 49 41z" />
+    <glyph glyph-name="heart_empty" unicode="&#xf08a;" horiz-adv-x="1792" 
+d="M1664 940q0 81 -21.5 143t-55 98.5t-81.5 59.5t-94 31t-98 8t-112 -25.5t-110.5 -64t-86.5 -72t-60 -61.5q-18 -22 -49 -22t-49 22q-24 28 -60 61.5t-86.5 72t-110.5 64t-112 25.5t-98 -8t-94 -31t-81.5 -59.5t-55 -98.5t-21.5 -143q0 -168 187 -355l581 -560l580 559
+q188 188 188 356zM1792 940q0 -221 -229 -450l-623 -600q-18 -18 -44 -18t-44 18l-624 602q-10 8 -27.5 26t-55.5 65.5t-68 97.5t-53.5 121t-23.5 138q0 220 127 344t351 124q62 0 126.5 -21.5t120 -58t95.5 -68.5t76 -68q36 36 76 68t95.5 68.5t120 58t126.5 21.5
+q224 0 351 -124t127 -344z" />
+    <glyph glyph-name="signout" unicode="&#xf08b;" horiz-adv-x="1664" 
+d="M640 96q0 -4 1 -20t0.5 -26.5t-3 -23.5t-10 -19.5t-20.5 -6.5h-320q-119 0 -203.5 84.5t-84.5 203.5v704q0 119 84.5 203.5t203.5 84.5h320q13 0 22.5 -9.5t9.5 -22.5q0 -4 1 -20t0.5 -26.5t-3 -23.5t-10 -19.5t-20.5 -6.5h-320q-66 0 -113 -47t-47 -113v-704
+q0 -66 47 -113t113 -47h288h11h13t11.5 -1t11.5 -3t8 -5.5t7 -9t2 -13.5zM1568 640q0 -26 -19 -45l-544 -544q-19 -19 -45 -19t-45 19t-19 45v288h-448q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h448v288q0 26 19 45t45 19t45 -19l544 -544q19 -19 19 -45z" />
+    <glyph glyph-name="linkedin_sign" unicode="&#xf08c;" 
+d="M237 122h231v694h-231v-694zM483 1030q-1 52 -36 86t-93 34t-94.5 -34t-36.5 -86q0 -51 35.5 -85.5t92.5 -34.5h1q59 0 95 34.5t36 85.5zM1068 122h231v398q0 154 -73 233t-193 79q-136 0 -209 -117h2v101h-231q3 -66 0 -694h231v388q0 38 7 56q15 35 45 59.5t74 24.5
+q116 0 116 -157v-371zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="pushpin" unicode="&#xf08d;" horiz-adv-x="1152" 
+d="M480 672v448q0 14 -9 23t-23 9t-23 -9t-9 -23v-448q0 -14 9 -23t23 -9t23 9t9 23zM1152 320q0 -26 -19 -45t-45 -19h-429l-51 -483q-2 -12 -10.5 -20.5t-20.5 -8.5h-1q-27 0 -32 27l-76 485h-404q-26 0 -45 19t-19 45q0 123 78.5 221.5t177.5 98.5v512q-52 0 -90 38
+t-38 90t38 90t90 38h640q52 0 90 -38t38 -90t-38 -90t-90 -38v-512q99 0 177.5 -98.5t78.5 -221.5z" />
+    <glyph glyph-name="external_link" unicode="&#xf08e;" horiz-adv-x="1792" 
+d="M1408 608v-320q0 -119 -84.5 -203.5t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h704q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-704q-66 0 -113 -47t-47 -113v-832q0 -66 47 -113t113 -47h832q66 0 113 47t47 113v320
+q0 14 9 23t23 9h64q14 0 23 -9t9 -23zM1792 1472v-512q0 -26 -19 -45t-45 -19t-45 19l-176 176l-652 -652q-10 -10 -23 -10t-23 10l-114 114q-10 10 -10 23t10 23l652 652l-176 176q-19 19 -19 45t19 45t45 19h512q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="signin" unicode="&#xf090;" 
+d="M1184 640q0 -26 -19 -45l-544 -544q-19 -19 -45 -19t-45 19t-19 45v288h-448q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h448v288q0 26 19 45t45 19t45 -19l544 -544q19 -19 19 -45zM1536 992v-704q0 -119 -84.5 -203.5t-203.5 -84.5h-320q-13 0 -22.5 9.5t-9.5 22.5
+q0 4 -1 20t-0.5 26.5t3 23.5t10 19.5t20.5 6.5h320q66 0 113 47t47 113v704q0 66 -47 113t-113 47h-288h-11h-13t-11.5 1t-11.5 3t-8 5.5t-7 9t-2 13.5q0 4 -1 20t-0.5 26.5t3 23.5t10 19.5t20.5 6.5h320q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="trophy" unicode="&#xf091;" horiz-adv-x="1664" 
+d="M458 653q-74 162 -74 371h-256v-96q0 -78 94.5 -162t235.5 -113zM1536 928v96h-256q0 -209 -74 -371q141 29 235.5 113t94.5 162zM1664 1056v-128q0 -71 -41.5 -143t-112 -130t-173 -97.5t-215.5 -44.5q-42 -54 -95 -95q-38 -34 -52.5 -72.5t-14.5 -89.5q0 -54 30.5 -91
+t97.5 -37q75 0 133.5 -45.5t58.5 -114.5v-64q0 -14 -9 -23t-23 -9h-832q-14 0 -23 9t-9 23v64q0 69 58.5 114.5t133.5 45.5q67 0 97.5 37t30.5 91q0 51 -14.5 89.5t-52.5 72.5q-53 41 -95 95q-113 5 -215.5 44.5t-173 97.5t-112 130t-41.5 143v128q0 40 28 68t68 28h288v96
+q0 66 47 113t113 47h576q66 0 113 -47t47 -113v-96h288q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="github_sign" unicode="&#xf092;" 
+d="M519 336q4 6 -3 13q-9 7 -14 2q-4 -6 3 -13q9 -7 14 -2zM491 377q-5 7 -12 4q-6 -4 0 -12q7 -8 12 -5q6 4 0 13zM450 417q2 4 -5 8q-7 2 -8 -2q-3 -5 4 -8q8 -2 9 2zM471 394q2 1 1.5 4.5t-3.5 5.5q-6 7 -10 3t1 -11q6 -6 11 -2zM557 319q2 7 -9 11q-9 3 -13 -4
+q-2 -7 9 -11q9 -3 13 4zM599 316q0 8 -12 8q-10 0 -10 -8t11 -8t11 8zM638 323q-2 7 -13 5t-9 -9q2 -8 12 -6t10 10zM1280 640q0 212 -150 362t-362 150t-362 -150t-150 -362q0 -167 98 -300.5t252 -185.5q18 -3 26.5 5t8.5 20q0 52 -1 95q-6 -1 -15.5 -2.5t-35.5 -2t-48 4
+t-43.5 20t-29.5 41.5q-23 59 -57 74q-2 1 -4.5 3.5l-8 8t-7 9.5t4 7.5t19.5 3.5q6 0 15 -2t30 -15.5t33 -35.5q16 -28 37.5 -42t43.5 -14t38 3.5t30 9.5q7 47 33 69q-49 6 -86 18.5t-73 39t-55.5 76t-19.5 119.5q0 79 53 137q-24 62 5 136q19 6 54.5 -7.5t60.5 -29.5l26 -16
+q58 17 128 17t128 -17q11 7 28.5 18t55.5 26t57 9q29 -74 5 -136q53 -58 53 -137q0 -57 -14 -100.5t-35.5 -70t-53.5 -44.5t-62.5 -26t-68.5 -12q35 -31 35 -95q0 -40 -0.5 -89t-0.5 -51q0 -12 8.5 -20t26.5 -5q154 52 252 185.5t98 300.5zM1536 1120v-960
+q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="upload_alt" unicode="&#xf093;" horiz-adv-x="1664" 
+d="M1280 64q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1536 64q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1664 288v-320q0 -40 -28 -68t-68 -28h-1472q-40 0 -68 28t-28 68v320q0 40 28 68t68 28h427q21 -56 70.5 -92
+t110.5 -36h256q61 0 110.5 36t70.5 92h427q40 0 68 -28t28 -68zM1339 936q-17 -40 -59 -40h-256v-448q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v448h-256q-42 0 -59 40q-17 39 14 69l448 448q18 19 45 19t45 -19l448 -448q31 -30 14 -69z" />
+    <glyph glyph-name="lemon" unicode="&#xf094;" 
+d="M1407 710q0 44 -7 113.5t-18 96.5q-12 30 -17 44t-9 36.5t-4 48.5q0 23 5 68.5t5 67.5q0 37 -10 55q-4 1 -13 1q-19 0 -58 -4.5t-59 -4.5q-60 0 -176 24t-175 24q-43 0 -94.5 -11.5t-85 -23.5t-89.5 -34q-137 -54 -202 -103q-96 -73 -159.5 -189.5t-88 -236t-24.5 -248.5
+q0 -40 12.5 -120t12.5 -121q0 -23 -11 -66.5t-11 -65.5t12 -36.5t34 -14.5q24 0 72.5 11t73.5 11q57 0 169.5 -15.5t169.5 -15.5q181 0 284 36q129 45 235.5 152.5t166 245.5t59.5 275zM1535 712q0 -165 -70 -327.5t-196 -288t-281 -180.5q-124 -44 -326 -44
+q-57 0 -170 14.5t-169 14.5q-24 0 -72.5 -14.5t-73.5 -14.5q-73 0 -123.5 55.5t-50.5 128.5q0 24 11 68t11 67q0 40 -12.5 120.5t-12.5 121.5q0 111 18 217.5t54.5 209.5t100.5 194t150 156q78 59 232 120q194 78 316 78q60 0 175.5 -24t173.5 -24q19 0 57 5t58 5
+q81 0 118 -50.5t37 -134.5q0 -23 -5 -68t-5 -68q0 -13 2 -25t3.5 -16.5t7.5 -20.5t8 -20q16 -40 25 -118.5t9 -136.5z" />
+    <glyph glyph-name="phone" unicode="&#xf095;" horiz-adv-x="1408" 
+d="M1408 296q0 -27 -10 -70.5t-21 -68.5q-21 -50 -122 -106q-94 -51 -186 -51q-27 0 -53 3.5t-57.5 12.5t-47 14.5t-55.5 20.5t-49 18q-98 35 -175 83q-127 79 -264 216t-216 264q-48 77 -83 175q-3 9 -18 49t-20.5 55.5t-14.5 47t-12.5 57.5t-3.5 53q0 92 51 186
+q56 101 106 122q25 11 68.5 21t70.5 10q14 0 21 -3q18 -6 53 -76q11 -19 30 -54t35 -63.5t31 -53.5q3 -4 17.5 -25t21.5 -35.5t7 -28.5q0 -20 -28.5 -50t-62 -55t-62 -53t-28.5 -46q0 -9 5 -22.5t8.5 -20.5t14 -24t11.5 -19q76 -137 174 -235t235 -174q2 -1 19 -11.5t24 -14
+t20.5 -8.5t22.5 -5q18 0 46 28.5t53 62t55 62t50 28.5q14 0 28.5 -7t35.5 -21.5t25 -17.5q25 -15 53.5 -31t63.5 -35t54 -30q70 -35 76 -53q3 -7 3 -21z" />
+    <glyph glyph-name="check_empty" unicode="&#xf096;" horiz-adv-x="1408" 
+d="M1120 1280h-832q-66 0 -113 -47t-47 -113v-832q0 -66 47 -113t113 -47h832q66 0 113 47t47 113v832q0 66 -47 113t-113 47zM1408 1120v-832q0 -119 -84.5 -203.5t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h832
+q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="bookmark_empty" unicode="&#xf097;" horiz-adv-x="1280" 
+d="M1152 1280h-1024v-1242l423 406l89 85l89 -85l423 -406v1242zM1164 1408q23 0 44 -9q33 -13 52.5 -41t19.5 -62v-1289q0 -34 -19.5 -62t-52.5 -41q-19 -8 -44 -8q-48 0 -83 32l-441 424l-441 -424q-36 -33 -83 -33q-23 0 -44 9q-33 13 -52.5 41t-19.5 62v1289
+q0 34 19.5 62t52.5 41q21 9 44 9h1048z" />
+    <glyph glyph-name="phone_sign" unicode="&#xf098;" 
+d="M1280 343q0 11 -2 16t-18 16.5t-40.5 25t-47.5 26.5t-45.5 25t-28.5 15q-5 3 -19 13t-25 15t-21 5q-15 0 -36.5 -20.5t-39.5 -45t-38.5 -45t-33.5 -20.5q-7 0 -16.5 3.5t-15.5 6.5t-17 9.5t-14 8.5q-99 55 -170 126.5t-127 170.5q-2 3 -8.5 14t-9.5 17t-6.5 15.5
+t-3.5 16.5q0 13 20.5 33.5t45 38.5t45 39.5t20.5 36.5q0 10 -5 21t-15 25t-13 19q-3 6 -15 28.5t-25 45.5t-26.5 47.5t-25 40.5t-16.5 18t-16 2q-48 0 -101 -22q-46 -21 -80 -94.5t-34 -130.5q0 -16 2.5 -34t5 -30.5t9 -33t10 -29.5t12.5 -33t11 -30q60 -164 216.5 -320.5
+t320.5 -216.5q6 -2 30 -11t33 -12.5t29.5 -10t33 -9t30.5 -5t34 -2.5q57 0 130.5 34t94.5 80q22 53 22 101zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z
+" />
+    <glyph glyph-name="twitter" unicode="&#xf099;" horiz-adv-x="1664" 
+d="M1620 1128q-67 -98 -162 -167q1 -14 1 -42q0 -130 -38 -259.5t-115.5 -248.5t-184.5 -210.5t-258 -146t-323 -54.5q-271 0 -496 145q35 -4 78 -4q225 0 401 138q-105 2 -188 64.5t-114 159.5q33 -5 61 -5q43 0 85 11q-112 23 -185.5 111.5t-73.5 205.5v4q68 -38 146 -41
+q-66 44 -105 115t-39 154q0 88 44 163q121 -149 294.5 -238.5t371.5 -99.5q-8 38 -8 74q0 134 94.5 228.5t228.5 94.5q140 0 236 -102q109 21 205 78q-37 -115 -142 -178q93 10 186 50z" />
+    <glyph glyph-name="facebook" unicode="&#xf09a;" horiz-adv-x="1024" 
+d="M959 1524v-264h-157q-86 0 -116 -36t-30 -108v-189h293l-39 -296h-254v-759h-306v759h-255v296h255v218q0 186 104 288.5t277 102.5q147 0 228 -12z" />
+    <glyph glyph-name="github" unicode="&#xf09b;" 
+d="M768 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5q0 -251 -146.5 -451.5t-378.5 -277.5q-27 -5 -40 7t-13 30q0 3 0.5 76.5t0.5 134.5q0 97 -52 142q57 6 102.5 18t94 39t81 66.5t53 105t20.5 150.5q0 119 -79 206q37 91 -8 204q-28 9 -81 -11t-92 -44l-38 -24
+q-93 26 -192 26t-192 -26q-16 11 -42.5 27t-83.5 38.5t-85 13.5q-45 -113 -8 -204q-79 -87 -79 -206q0 -85 20.5 -150t52.5 -105t80.5 -67t94 -39t102.5 -18q-39 -36 -49 -103q-21 -10 -45 -15t-57 -5t-65.5 21.5t-55.5 62.5q-19 32 -48.5 52t-49.5 24l-20 3q-21 0 -29 -4.5
+t-5 -11.5t9 -14t13 -12l7 -5q22 -10 43.5 -38t31.5 -51l10 -23q13 -38 44 -61.5t67 -30t69.5 -7t55.5 3.5l23 4q0 -38 0.5 -88.5t0.5 -54.5q0 -18 -13 -30t-40 -7q-232 77 -378.5 277.5t-146.5 451.5q0 209 103 385.5t279.5 279.5t385.5 103zM291 305q3 7 -7 12
+q-10 3 -13 -2q-3 -7 7 -12q9 -6 13 2zM322 271q7 5 -2 16q-10 9 -16 3q-7 -5 2 -16q10 -10 16 -3zM352 226q9 7 0 19q-8 13 -17 6q-9 -5 0 -18t17 -7zM394 184q8 8 -4 19q-12 12 -20 3q-9 -8 4 -19q12 -12 20 -3zM451 159q3 11 -13 16q-15 4 -19 -7t13 -15q15 -6 19 6z
+M514 154q0 13 -17 11q-16 0 -16 -11q0 -13 17 -11q16 0 16 11zM572 164q-2 11 -18 9q-16 -3 -14 -15t18 -8t14 14z" />
+    <glyph glyph-name="unlock" unicode="&#xf09c;" horiz-adv-x="1664" 
+d="M1664 960v-256q0 -26 -19 -45t-45 -19h-64q-26 0 -45 19t-19 45v256q0 106 -75 181t-181 75t-181 -75t-75 -181v-192h96q40 0 68 -28t28 -68v-576q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68v576q0 40 28 68t68 28h672v192q0 185 131.5 316.5t316.5 131.5
+t316.5 -131.5t131.5 -316.5z" />
+    <glyph glyph-name="credit_card" unicode="&#xf09d;" horiz-adv-x="1920" 
+d="M1760 1408q66 0 113 -47t47 -113v-1216q0 -66 -47 -113t-113 -47h-1600q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1600zM160 1280q-13 0 -22.5 -9.5t-9.5 -22.5v-224h1664v224q0 13 -9.5 22.5t-22.5 9.5h-1600zM1760 0q13 0 22.5 9.5t9.5 22.5v608h-1664v-608
+q0 -13 9.5 -22.5t22.5 -9.5h1600zM256 128v128h256v-128h-256zM640 128v128h384v-128h-384z" />
+    <glyph glyph-name="rss" unicode="&#xf09e;" horiz-adv-x="1408" 
+d="M384 192q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM896 69q2 -28 -17 -48q-18 -21 -47 -21h-135q-25 0 -43 16.5t-20 41.5q-22 229 -184.5 391.5t-391.5 184.5q-25 2 -41.5 20t-16.5 43v135q0 29 21 47q17 17 43 17h5q160 -13 306 -80.5
+t259 -181.5q114 -113 181.5 -259t80.5 -306zM1408 67q2 -27 -18 -47q-18 -20 -46 -20h-143q-26 0 -44.5 17.5t-19.5 42.5q-12 215 -101 408.5t-231.5 336t-336 231.5t-408.5 102q-25 1 -42.5 19.5t-17.5 43.5v143q0 28 20 46q18 18 44 18h3q262 -13 501.5 -120t425.5 -294
+q187 -186 294 -425.5t120 -501.5z" />
+    <glyph glyph-name="hdd" unicode="&#xf0a0;" 
+d="M1040 320q0 -33 -23.5 -56.5t-56.5 -23.5t-56.5 23.5t-23.5 56.5t23.5 56.5t56.5 23.5t56.5 -23.5t23.5 -56.5zM1296 320q0 -33 -23.5 -56.5t-56.5 -23.5t-56.5 23.5t-23.5 56.5t23.5 56.5t56.5 23.5t56.5 -23.5t23.5 -56.5zM1408 160v320q0 13 -9.5 22.5t-22.5 9.5
+h-1216q-13 0 -22.5 -9.5t-9.5 -22.5v-320q0 -13 9.5 -22.5t22.5 -9.5h1216q13 0 22.5 9.5t9.5 22.5zM178 640h1180l-157 482q-4 13 -16 21.5t-26 8.5h-782q-14 0 -26 -8.5t-16 -21.5zM1536 480v-320q0 -66 -47 -113t-113 -47h-1216q-66 0 -113 47t-47 113v320q0 25 16 75
+l197 606q17 53 63 86t101 33h782q55 0 101 -33t63 -86l197 -606q16 -50 16 -75z" />
+    <glyph glyph-name="bullhorn" unicode="&#xf0a1;" horiz-adv-x="1792" 
+d="M1664 896q53 0 90.5 -37.5t37.5 -90.5t-37.5 -90.5t-90.5 -37.5v-384q0 -52 -38 -90t-90 -38q-417 347 -812 380q-58 -19 -91 -66t-31 -100.5t40 -92.5q-20 -33 -23 -65.5t6 -58t33.5 -55t48 -50t61.5 -50.5q-29 -58 -111.5 -83t-168.5 -11.5t-132 55.5q-7 23 -29.5 87.5
+t-32 94.5t-23 89t-15 101t3.5 98.5t22 110.5h-122q-66 0 -113 47t-47 113v192q0 66 47 113t113 47h480q435 0 896 384q52 0 90 -38t38 -90v-384zM1536 292v954q-394 -302 -768 -343v-270q377 -42 768 -341z" />
+    <glyph glyph-name="bell" unicode="&#xf0a2;" horiz-adv-x="1792" 
+d="M912 -160q0 16 -16 16q-59 0 -101.5 42.5t-42.5 101.5q0 16 -16 16t-16 -16q0 -73 51.5 -124.5t124.5 -51.5q16 0 16 16zM246 128h1300q-266 300 -266 832q0 51 -24 105t-69 103t-121.5 80.5t-169.5 31.5t-169.5 -31.5t-121.5 -80.5t-69 -103t-24 -105q0 -532 -266 -832z
+M1728 128q0 -52 -38 -90t-90 -38h-448q0 -106 -75 -181t-181 -75t-181 75t-75 181h-448q-52 0 -90 38t-38 90q50 42 91 88t85 119.5t74.5 158.5t50 206t19.5 260q0 152 117 282.5t307 158.5q-8 19 -8 39q0 40 28 68t68 28t68 -28t28 -68q0 -20 -8 -39q190 -28 307 -158.5
+t117 -282.5q0 -139 19.5 -260t50 -206t74.5 -158.5t85 -119.5t91 -88z" />
+    <glyph glyph-name="certificate" unicode="&#xf0a3;" 
+d="M1376 640l138 -135q30 -28 20 -70q-12 -41 -52 -51l-188 -48l53 -186q12 -41 -19 -70q-29 -31 -70 -19l-186 53l-48 -188q-10 -40 -51 -52q-12 -2 -19 -2q-31 0 -51 22l-135 138l-135 -138q-28 -30 -70 -20q-41 11 -51 52l-48 188l-186 -53q-41 -12 -70 19q-31 29 -19 70
+l53 186l-188 48q-40 10 -52 51q-10 42 20 70l138 135l-138 135q-30 28 -20 70q12 41 52 51l188 48l-53 186q-12 41 19 70q29 31 70 19l186 -53l48 188q10 41 51 51q41 12 70 -19l135 -139l135 139q29 30 70 19q41 -10 51 -51l48 -188l186 53q41 12 70 -19q31 -29 19 -70
+l-53 -186l188 -48q40 -10 52 -51q10 -42 -20 -70z" />
+    <glyph glyph-name="hand_right" unicode="&#xf0a4;" horiz-adv-x="1792" 
+d="M256 192q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1664 768q0 51 -39 89.5t-89 38.5h-576q0 20 15 48.5t33 55t33 68t15 84.5q0 67 -44.5 97.5t-115.5 30.5q-24 0 -90 -139q-24 -44 -37 -65q-40 -64 -112 -145q-71 -81 -101 -106
+q-69 -57 -140 -57h-32v-640h32q72 0 167 -32t193.5 -64t179.5 -32q189 0 189 167q0 26 -5 56q30 16 47.5 52.5t17.5 73.5t-18 69q53 50 53 119q0 25 -10 55.5t-25 47.5h331q52 0 90 38t38 90zM1792 769q0 -105 -75.5 -181t-180.5 -76h-169q-4 -62 -37 -119q3 -21 3 -43
+q0 -101 -60 -178q1 -139 -85 -219.5t-227 -80.5q-133 0 -322 69q-164 59 -223 59h-288q-53 0 -90.5 37.5t-37.5 90.5v640q0 53 37.5 90.5t90.5 37.5h288q10 0 21.5 4.5t23.5 14t22.5 18t24 22.5t20.5 21.5t19 21.5t14 17q65 74 100 129q13 21 33 62t37 72t40.5 63t55 49.5
+t69.5 17.5q125 0 206.5 -67t81.5 -189q0 -68 -22 -128h374q104 0 180 -76t76 -179z" />
+    <glyph glyph-name="hand_left" unicode="&#xf0a5;" horiz-adv-x="1792" 
+d="M1376 128h32v640h-32q-35 0 -67.5 12t-62.5 37t-50 46t-49 54q-8 9 -12 14q-72 81 -112 145q-14 22 -38 68q-1 3 -10.5 22.5t-18.5 36t-20 35.5t-21.5 30.5t-18.5 11.5q-71 0 -115.5 -30.5t-44.5 -97.5q0 -43 15 -84.5t33 -68t33 -55t15 -48.5h-576q-50 0 -89 -38.5
+t-39 -89.5q0 -52 38 -90t90 -38h331q-15 -17 -25 -47.5t-10 -55.5q0 -69 53 -119q-18 -32 -18 -69t17.5 -73.5t47.5 -52.5q-4 -24 -4 -56q0 -85 48.5 -126t135.5 -41q84 0 183 32t194 64t167 32zM1664 192q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45z
+M1792 768v-640q0 -53 -37.5 -90.5t-90.5 -37.5h-288q-59 0 -223 -59q-190 -69 -317 -69q-142 0 -230 77.5t-87 217.5l1 5q-61 76 -61 178q0 22 3 43q-33 57 -37 119h-169q-105 0 -180.5 76t-75.5 181q0 103 76 179t180 76h374q-22 60 -22 128q0 122 81.5 189t206.5 67
+q38 0 69.5 -17.5t55 -49.5t40.5 -63t37 -72t33 -62q35 -55 100 -129q2 -3 14 -17t19 -21.5t20.5 -21.5t24 -22.5t22.5 -18t23.5 -14t21.5 -4.5h288q53 0 90.5 -37.5t37.5 -90.5z" />
+    <glyph glyph-name="hand_up" unicode="&#xf0a6;" 
+d="M1280 -64q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1408 700q0 189 -167 189q-26 0 -56 -5q-16 30 -52.5 47.5t-73.5 17.5t-69 -18q-50 53 -119 53q-25 0 -55.5 -10t-47.5 -25v331q0 52 -38 90t-90 38q-51 0 -89.5 -39t-38.5 -89v-576
+q-20 0 -48.5 15t-55 33t-68 33t-84.5 15q-67 0 -97.5 -44.5t-30.5 -115.5q0 -24 139 -90q44 -24 65 -37q64 -40 145 -112q81 -71 106 -101q57 -69 57 -140v-32h640v32q0 72 32 167t64 193.5t32 179.5zM1536 705q0 -133 -69 -322q-59 -164 -59 -223v-288q0 -53 -37.5 -90.5
+t-90.5 -37.5h-640q-53 0 -90.5 37.5t-37.5 90.5v288q0 10 -4.5 21.5t-14 23.5t-18 22.5t-22.5 24t-21.5 20.5t-21.5 19t-17 14q-74 65 -129 100q-21 13 -62 33t-72 37t-63 40.5t-49.5 55t-17.5 69.5q0 125 67 206.5t189 81.5q68 0 128 -22v374q0 104 76 180t179 76
+q105 0 181 -75.5t76 -180.5v-169q62 -4 119 -37q21 3 43 3q101 0 178 -60q139 1 219.5 -85t80.5 -227z" />
+    <glyph glyph-name="hand_down" unicode="&#xf0a7;" 
+d="M1408 576q0 84 -32 183t-64 194t-32 167v32h-640v-32q0 -35 -12 -67.5t-37 -62.5t-46 -50t-54 -49q-9 -8 -14 -12q-81 -72 -145 -112q-22 -14 -68 -38q-3 -1 -22.5 -10.5t-36 -18.5t-35.5 -20t-30.5 -21.5t-11.5 -18.5q0 -71 30.5 -115.5t97.5 -44.5q43 0 84.5 15t68 33
+t55 33t48.5 15v-576q0 -50 38.5 -89t89.5 -39q52 0 90 38t38 90v331q46 -35 103 -35q69 0 119 53q32 -18 69 -18t73.5 17.5t52.5 47.5q24 -4 56 -4q85 0 126 48.5t41 135.5zM1280 1344q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1536 580
+q0 -142 -77.5 -230t-217.5 -87l-5 1q-76 -61 -178 -61q-22 0 -43 3q-54 -30 -119 -37v-169q0 -105 -76 -180.5t-181 -75.5q-103 0 -179 76t-76 180v374q-54 -22 -128 -22q-121 0 -188.5 81.5t-67.5 206.5q0 38 17.5 69.5t49.5 55t63 40.5t72 37t62 33q55 35 129 100
+q3 2 17 14t21.5 19t21.5 20.5t22.5 24t18 22.5t14 23.5t4.5 21.5v288q0 53 37.5 90.5t90.5 37.5h640q53 0 90.5 -37.5t37.5 -90.5v-288q0 -59 59 -223q69 -190 69 -317z" />
+    <glyph glyph-name="circle_arrow_left" unicode="&#xf0a8;" 
+d="M1280 576v128q0 26 -19 45t-45 19h-502l189 189q19 19 19 45t-19 45l-91 91q-18 18 -45 18t-45 -18l-362 -362l-91 -91q-18 -18 -18 -45t18 -45l91 -91l362 -362q18 -18 45 -18t45 18l91 91q18 18 18 45t-18 45l-189 189h502q26 0 45 19t19 45zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="circle_arrow_right" unicode="&#xf0a9;" 
+d="M1285 640q0 27 -18 45l-91 91l-362 362q-18 18 -45 18t-45 -18l-91 -91q-18 -18 -18 -45t18 -45l189 -189h-502q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h502l-189 -189q-19 -19 -19 -45t19 -45l91 -91q18 -18 45 -18t45 18l362 362l91 91q18 18 18 45zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="circle_arrow_up" unicode="&#xf0aa;" 
+d="M1284 641q0 27 -18 45l-362 362l-91 91q-18 18 -45 18t-45 -18l-91 -91l-362 -362q-18 -18 -18 -45t18 -45l91 -91q18 -18 45 -18t45 18l189 189v-502q0 -26 19 -45t45 -19h128q26 0 45 19t19 45v502l189 -189q19 -19 45 -19t45 19l91 91q18 18 18 45zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="circle_arrow_down" unicode="&#xf0ab;" 
+d="M1284 639q0 27 -18 45l-91 91q-18 18 -45 18t-45 -18l-189 -189v502q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-502l-189 189q-19 19 -45 19t-45 -19l-91 -91q-18 -18 -18 -45t18 -45l362 -362l91 -91q18 -18 45 -18t45 18l91 91l362 362q18 18 18 45zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="globe" unicode="&#xf0ac;" 
+d="M768 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5t-103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103zM1042 887q-2 -1 -9.5 -9.5t-13.5 -9.5q2 0 4.5 5t5 11t3.5 7q6 7 22 15q14 6 52 12q34 8 51 -11
+q-2 2 9.5 13t14.5 12q3 2 15 4.5t15 7.5l2 22q-12 -1 -17.5 7t-6.5 21q0 -2 -6 -8q0 7 -4.5 8t-11.5 -1t-9 -1q-10 3 -15 7.5t-8 16.5t-4 15q-2 5 -9.5 11t-9.5 10q-1 2 -2.5 5.5t-3 6.5t-4 5.5t-5.5 2.5t-7 -5t-7.5 -10t-4.5 -5q-3 2 -6 1.5t-4.5 -1t-4.5 -3t-5 -3.5
+q-3 -2 -8.5 -3t-8.5 -2q15 5 -1 11q-10 4 -16 3q9 4 7.5 12t-8.5 14h5q-1 4 -8.5 8.5t-17.5 8.5t-13 6q-8 5 -34 9.5t-33 0.5q-5 -6 -4.5 -10.5t4 -14t3.5 -12.5q1 -6 -5.5 -13t-6.5 -12q0 -7 14 -15.5t10 -21.5q-3 -8 -16 -16t-16 -12q-5 -8 -1.5 -18.5t10.5 -16.5
+q2 -2 1.5 -4t-3.5 -4.5t-5.5 -4t-6.5 -3.5l-3 -2q-11 -5 -20.5 6t-13.5 26q-7 25 -16 30q-23 8 -29 -1q-5 13 -41 26q-25 9 -58 4q6 1 0 15q-7 15 -19 12q3 6 4 17.5t1 13.5q3 13 12 23q1 1 7 8.5t9.5 13.5t0.5 6q35 -4 50 11q5 5 11.5 17t10.5 17q9 6 14 5.5t14.5 -5.5
+t14.5 -5q14 -1 15.5 11t-7.5 20q12 -1 3 17q-4 7 -8 9q-12 4 -27 -5q-8 -4 2 -8q-1 1 -9.5 -10.5t-16.5 -17.5t-16 5q-1 1 -5.5 13.5t-9.5 13.5q-8 0 -16 -15q3 8 -11 15t-24 8q19 12 -8 27q-7 4 -20.5 5t-19.5 -4q-5 -7 -5.5 -11.5t5 -8t10.5 -5.5t11.5 -4t8.5 -3
+q14 -10 8 -14q-2 -1 -8.5 -3.5t-11.5 -4.5t-6 -4q-3 -4 0 -14t-2 -14q-5 5 -9 17.5t-7 16.5q7 -9 -25 -6l-10 1q-4 0 -16 -2t-20.5 -1t-13.5 8q-4 8 0 20q1 4 4 2q-4 3 -11 9.5t-10 8.5q-46 -15 -94 -41q6 -1 12 1q5 2 13 6.5t10 5.5q34 14 42 7l5 5q14 -16 20 -25
+q-7 4 -30 1q-20 -6 -22 -12q7 -12 5 -18q-4 3 -11.5 10t-14.5 11t-15 5q-16 0 -22 -1q-146 -80 -235 -222q7 -7 12 -8q4 -1 5 -9t2.5 -11t11.5 3q9 -8 3 -19q1 1 44 -27q19 -17 21 -21q3 -11 -10 -18q-1 2 -9 9t-9 4q-3 -5 0.5 -18.5t10.5 -12.5q-7 0 -9.5 -16t-2.5 -35.5
+t-1 -23.5l2 -1q-3 -12 5.5 -34.5t21.5 -19.5q-13 -3 20 -43q6 -8 8 -9q3 -2 12 -7.5t15 -10t10 -10.5q4 -5 10 -22.5t14 -23.5q-2 -6 9.5 -20t10.5 -23q-1 0 -2.5 -1t-2.5 -1q3 -7 15.5 -14t15.5 -13q1 -3 2 -10t3 -11t8 -2q2 20 -24 62q-15 25 -17 29q-3 5 -5.5 15.5
+t-4.5 14.5q2 0 6 -1.5t8.5 -3.5t7.5 -4t2 -3q-3 -7 2 -17.5t12 -18.5t17 -19t12 -13q6 -6 14 -19.5t0 -13.5q9 0 20 -10.5t17 -19.5q5 -8 8 -26t5 -24q2 -7 8.5 -13.5t12.5 -9.5l16 -8t13 -7q5 -2 18.5 -10.5t21.5 -11.5q10 -4 16 -4t14.5 2.5t13.5 3.5q15 2 29 -15t21 -21
+q36 -19 55 -11q-2 -1 0.5 -7.5t8 -15.5t9 -14.5t5.5 -8.5q5 -6 18 -15t18 -15q6 4 7 9q-3 -8 7 -20t18 -10q14 3 14 32q-31 -15 -49 18q0 1 -2.5 5.5t-4 8.5t-2.5 8.5t0 7.5t5 3q9 0 10 3.5t-2 12.5t-4 13q-1 8 -11 20t-12 15q-5 -9 -16 -8t-16 9q0 -1 -1.5 -5.5t-1.5 -6.5
+q-13 0 -15 1q1 3 2.5 17.5t3.5 22.5q1 4 5.5 12t7.5 14.5t4 12.5t-4.5 9.5t-17.5 2.5q-19 -1 -26 -20q-1 -3 -3 -10.5t-5 -11.5t-9 -7q-7 -3 -24 -2t-24 5q-13 8 -22.5 29t-9.5 37q0 10 2.5 26.5t3 25t-5.5 24.5q3 2 9 9.5t10 10.5q2 1 4.5 1.5t4.5 0t4 1.5t3 6q-1 1 -4 3
+q-3 3 -4 3q7 -3 28.5 1.5t27.5 -1.5q15 -11 22 2q0 1 -2.5 9.5t-0.5 13.5q5 -27 29 -9q3 -3 15.5 -5t17.5 -5q3 -2 7 -5.5t5.5 -4.5t5 0.5t8.5 6.5q10 -14 12 -24q11 -40 19 -44q7 -3 11 -2t4.5 9.5t0 14t-1.5 12.5l-1 8v18l-1 8q-15 3 -18.5 12t1.5 18.5t15 18.5q1 1 8 3.5
+t15.5 6.5t12.5 8q21 19 15 35q7 0 11 9q-1 0 -5 3t-7.5 5t-4.5 2q9 5 2 16q5 3 7.5 11t7.5 10q9 -12 21 -2q8 8 1 16q5 7 20.5 10.5t18.5 9.5q7 -2 8 2t1 12t3 12q4 5 15 9t13 5l17 11q3 4 0 4q18 -2 31 11q10 11 -6 20q3 6 -3 9.5t-15 5.5q3 1 11.5 0.5t10.5 1.5
+q15 10 -7 16q-17 5 -43 -12zM879 10q206 36 351 189q-3 3 -12.5 4.5t-12.5 3.5q-18 7 -24 8q1 7 -2.5 13t-8 9t-12.5 8t-11 7q-2 2 -7 6t-7 5.5t-7.5 4.5t-8.5 2t-10 -1l-3 -1q-3 -1 -5.5 -2.5t-5.5 -3t-4 -3t0 -2.5q-21 17 -36 22q-5 1 -11 5.5t-10.5 7t-10 1.5t-11.5 -7
+q-5 -5 -6 -15t-2 -13q-7 5 0 17.5t2 18.5q-3 6 -10.5 4.5t-12 -4.5t-11.5 -8.5t-9 -6.5t-8.5 -5.5t-8.5 -7.5q-3 -4 -6 -12t-5 -11q-2 4 -11.5 6.5t-9.5 5.5q2 -10 4 -35t5 -38q7 -31 -12 -48q-27 -25 -29 -40q-4 -22 12 -26q0 -7 -8 -20.5t-7 -21.5q0 -6 2 -16z" />
+    <glyph glyph-name="wrench" unicode="&#xf0ad;" horiz-adv-x="1664" 
+d="M384 64q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1028 484l-682 -682q-37 -37 -90 -37q-52 0 -91 37l-106 108q-38 36 -38 90q0 53 38 91l681 681q39 -98 114.5 -173.5t173.5 -114.5zM1662 919q0 -39 -23 -106q-47 -134 -164.5 -217.5
+t-258.5 -83.5q-185 0 -316.5 131.5t-131.5 316.5t131.5 316.5t316.5 131.5q58 0 121.5 -16.5t107.5 -46.5q16 -11 16 -28t-16 -28l-293 -169v-224l193 -107q5 3 79 48.5t135.5 81t70.5 35.5q15 0 23.5 -10t8.5 -25z" />
+    <glyph glyph-name="tasks" unicode="&#xf0ae;" horiz-adv-x="1792" 
+d="M1024 128h640v128h-640v-128zM640 640h1024v128h-1024v-128zM1280 1152h384v128h-384v-128zM1792 320v-256q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1792 832v-256q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19
+t-19 45v256q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1792 1344v-256q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h1664q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="filter" unicode="&#xf0b0;" horiz-adv-x="1408" 
+d="M1403 1241q17 -41 -14 -70l-493 -493v-742q0 -42 -39 -59q-13 -5 -25 -5q-27 0 -45 19l-256 256q-19 19 -19 45v486l-493 493q-31 29 -14 70q17 39 59 39h1280q42 0 59 -39z" />
+    <glyph glyph-name="briefcase" unicode="&#xf0b1;" horiz-adv-x="1792" 
+d="M640 1280h512v128h-512v-128zM1792 640v-480q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v480h672v-160q0 -26 19 -45t45 -19h320q26 0 45 19t19 45v160h672zM1024 640v-128h-256v128h256zM1792 1120v-384h-1792v384q0 66 47 113t113 47h352v160q0 40 28 68
+t68 28h576q40 0 68 -28t28 -68v-160h352q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="fullscreen" unicode="&#xf0b2;" 
+d="M1283 995l-355 -355l355 -355l144 144q29 31 70 14q39 -17 39 -59v-448q0 -26 -19 -45t-45 -19h-448q-42 0 -59 40q-17 39 14 69l144 144l-355 355l-355 -355l144 -144q31 -30 14 -69q-17 -40 -59 -40h-448q-26 0 -45 19t-19 45v448q0 42 40 59q39 17 69 -14l144 -144
+l355 355l-355 355l-144 -144q-19 -19 -45 -19q-12 0 -24 5q-40 17 -40 59v448q0 26 19 45t45 19h448q42 0 59 -40q17 -39 -14 -69l-144 -144l355 -355l355 355l-144 144q-31 30 -14 69q17 40 59 40h448q26 0 45 -19t19 -45v-448q0 -42 -39 -59q-13 -5 -25 -5q-26 0 -45 19z
+" />
+    <glyph glyph-name="group" unicode="&#xf0c0;" horiz-adv-x="1920" 
+d="M593 640q-162 -5 -265 -128h-134q-82 0 -138 40.5t-56 118.5q0 353 124 353q6 0 43.5 -21t97.5 -42.5t119 -21.5q67 0 133 23q-5 -37 -5 -66q0 -139 81 -256zM1664 3q0 -120 -73 -189.5t-194 -69.5h-874q-121 0 -194 69.5t-73 189.5q0 53 3.5 103.5t14 109t26.5 108.5
+t43 97.5t62 81t85.5 53.5t111.5 20q10 0 43 -21.5t73 -48t107 -48t135 -21.5t135 21.5t107 48t73 48t43 21.5q61 0 111.5 -20t85.5 -53.5t62 -81t43 -97.5t26.5 -108.5t14 -109t3.5 -103.5zM640 1280q0 -106 -75 -181t-181 -75t-181 75t-75 181t75 181t181 75t181 -75
+t75 -181zM1344 896q0 -159 -112.5 -271.5t-271.5 -112.5t-271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5t271.5 -112.5t112.5 -271.5zM1920 671q0 -78 -56 -118.5t-138 -40.5h-134q-103 123 -265 128q81 117 81 256q0 29 -5 66q66 -23 133 -23q59 0 119 21.5t97.5 42.5
+t43.5 21q124 0 124 -353zM1792 1280q0 -106 -75 -181t-181 -75t-181 75t-75 181t75 181t181 75t181 -75t75 -181z" />
+    <glyph glyph-name="link" unicode="&#xf0c1;" horiz-adv-x="1664" 
+d="M1456 320q0 40 -28 68l-208 208q-28 28 -68 28q-42 0 -72 -32q3 -3 19 -18.5t21.5 -21.5t15 -19t13 -25.5t3.5 -27.5q0 -40 -28 -68t-68 -28q-15 0 -27.5 3.5t-25.5 13t-19 15t-21.5 21.5t-18.5 19q-33 -31 -33 -73q0 -40 28 -68l206 -207q27 -27 68 -27q40 0 68 26
+l147 146q28 28 28 67zM753 1025q0 40 -28 68l-206 207q-28 28 -68 28q-39 0 -68 -27l-147 -146q-28 -28 -28 -67q0 -40 28 -68l208 -208q27 -27 68 -27q42 0 72 31q-3 3 -19 18.5t-21.5 21.5t-15 19t-13 25.5t-3.5 27.5q0 40 28 68t68 28q15 0 27.5 -3.5t25.5 -13t19 -15
+t21.5 -21.5t18.5 -19q33 31 33 73zM1648 320q0 -120 -85 -203l-147 -146q-83 -83 -203 -83q-121 0 -204 85l-206 207q-83 83 -83 203q0 123 88 209l-88 88q-86 -88 -208 -88q-120 0 -204 84l-208 208q-84 84 -84 204t85 203l147 146q83 83 203 83q121 0 204 -85l206 -207
+q83 -83 83 -203q0 -123 -88 -209l88 -88q86 88 208 88q120 0 204 -84l208 -208q84 -84 84 -204z" />
+    <glyph glyph-name="cloud" unicode="&#xf0c2;" horiz-adv-x="1920" 
+d="M1920 384q0 -159 -112.5 -271.5t-271.5 -112.5h-1088q-185 0 -316.5 131.5t-131.5 316.5q0 132 71 241.5t187 163.5q-2 28 -2 43q0 212 150 362t362 150q158 0 286.5 -88t187.5 -230q70 62 166 62q106 0 181 -75t75 -181q0 -75 -41 -138q129 -30 213 -134.5t84 -239.5z
+" />
+    <glyph glyph-name="beaker" unicode="&#xf0c3;" horiz-adv-x="1664" 
+d="M1527 88q56 -89 21.5 -152.5t-140.5 -63.5h-1152q-106 0 -140.5 63.5t21.5 152.5l503 793v399h-64q-26 0 -45 19t-19 45t19 45t45 19h512q26 0 45 -19t19 -45t-19 -45t-45 -19h-64v-399zM748 813l-272 -429h712l-272 429l-20 31v37v399h-128v-399v-37z" />
+    <glyph glyph-name="cut" unicode="&#xf0c4;" horiz-adv-x="1792" 
+d="M960 640q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1260 576l507 -398q28 -20 25 -56q-5 -35 -35 -51l-128 -64q-13 -7 -29 -7q-17 0 -31 8l-690 387l-110 -66q-8 -4 -12 -5q14 -49 10 -97q-7 -77 -56 -147.5t-132 -123.5q-132 -84 -277 -84
+q-136 0 -222 78q-90 84 -79 207q7 76 56 147t131 124q132 84 278 84q83 0 151 -31q9 13 22 22l122 73l-122 73q-13 9 -22 22q-68 -31 -151 -31q-146 0 -278 84q-82 53 -131 124t-56 147q-5 59 15.5 113t63.5 93q85 79 222 79q145 0 277 -84q83 -52 132 -123t56 -148
+q4 -48 -10 -97q4 -1 12 -5l110 -66l690 387q14 8 31 8q16 0 29 -7l128 -64q30 -16 35 -51q3 -36 -25 -56zM579 836q46 42 21 108t-106 117q-92 59 -192 59q-74 0 -113 -36q-46 -42 -21 -108t106 -117q92 -59 192 -59q74 0 113 36zM494 91q81 51 106 117t-21 108
+q-39 36 -113 36q-100 0 -192 -59q-81 -51 -106 -117t21 -108q39 -36 113 -36q100 0 192 59zM672 704l96 -58v11q0 36 33 56l14 8l-79 47l-26 -26q-3 -3 -10 -11t-12 -12q-2 -2 -4 -3.5t-3 -2.5zM896 480l96 -32l736 576l-128 64l-768 -431v-113l-160 -96l9 -8q2 -2 7 -6
+q4 -4 11 -12t11 -12l26 -26zM1600 64l128 64l-520 408l-177 -138q-2 -3 -13 -7z" />
+    <glyph glyph-name="copy" unicode="&#xf0c5;" horiz-adv-x="1792" 
+d="M1696 1152q40 0 68 -28t28 -68v-1216q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68v288h-544q-40 0 -68 28t-28 68v672q0 40 20 88t48 76l408 408q28 28 76 48t88 20h416q40 0 68 -28t28 -68v-328q68 40 128 40h416zM1152 939l-299 -299h299v299zM512 1323l-299 -299
+h299v299zM708 676l316 316v416h-384v-416q0 -40 -28 -68t-68 -28h-416v-640h512v256q0 40 20 88t48 76zM1664 -128v1152h-384v-416q0 -40 -28 -68t-68 -28h-416v-640h896z" />
+    <glyph glyph-name="paper_clip" unicode="&#xf0c6;" horiz-adv-x="1408" 
+d="M1404 151q0 -117 -79 -196t-196 -79q-135 0 -235 100l-777 776q-113 115 -113 271q0 159 110 270t269 111q158 0 273 -113l605 -606q10 -10 10 -22q0 -16 -30.5 -46.5t-46.5 -30.5q-13 0 -23 10l-606 607q-79 77 -181 77q-106 0 -179 -75t-73 -181q0 -105 76 -181
+l776 -777q63 -63 145 -63q64 0 106 42t42 106q0 82 -63 145l-581 581q-26 24 -60 24q-29 0 -48 -19t-19 -48q0 -32 25 -59l410 -410q10 -10 10 -22q0 -16 -31 -47t-47 -31q-12 0 -22 10l-410 410q-63 61 -63 149q0 82 57 139t139 57q88 0 149 -63l581 -581q100 -98 100 -235
+z" />
+    <glyph glyph-name="save" unicode="&#xf0c7;" 
+d="M384 0h768v384h-768v-384zM1280 0h128v896q0 14 -10 38.5t-20 34.5l-281 281q-10 10 -34 20t-39 10v-416q0 -40 -28 -68t-68 -28h-576q-40 0 -68 28t-28 68v416h-128v-1280h128v416q0 40 28 68t68 28h832q40 0 68 -28t28 -68v-416zM896 928v320q0 13 -9.5 22.5t-22.5 9.5
+h-192q-13 0 -22.5 -9.5t-9.5 -22.5v-320q0 -13 9.5 -22.5t22.5 -9.5h192q13 0 22.5 9.5t9.5 22.5zM1536 896v-928q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1344q0 40 28 68t68 28h928q40 0 88 -20t76 -48l280 -280q28 -28 48 -76t20 -88z" />
+    <glyph glyph-name="sign_blank" unicode="&#xf0c8;" 
+d="M1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="reorder" unicode="&#xf0c9;" 
+d="M1536 192v-128q0 -26 -19 -45t-45 -19h-1408q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1408q26 0 45 -19t19 -45zM1536 704v-128q0 -26 -19 -45t-45 -19h-1408q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1408q26 0 45 -19t19 -45zM1536 1216v-128q0 -26 -19 -45
+t-45 -19h-1408q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1408q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="ul" unicode="&#xf0ca;" horiz-adv-x="1792" 
+d="M384 128q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM384 640q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM1792 224v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1216q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5
+t22.5 9.5h1216q13 0 22.5 -9.5t9.5 -22.5zM384 1152q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM1792 736v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1216q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1216q13 0 22.5 -9.5t9.5 -22.5z
+M1792 1248v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1216q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1216q13 0 22.5 -9.5t9.5 -22.5z" />
+    <glyph glyph-name="ol" unicode="&#xf0cb;" horiz-adv-x="1792" 
+d="M381 -84q0 -80 -54.5 -126t-135.5 -46q-106 0 -172 66l57 88q49 -45 106 -45q29 0 50.5 14.5t21.5 42.5q0 64 -105 56l-26 56q8 10 32.5 43.5t42.5 54t37 38.5v1q-16 0 -48.5 -1t-48.5 -1v-53h-106v152h333v-88l-95 -115q51 -12 81 -49t30 -88zM383 543v-159h-362
+q-6 36 -6 54q0 51 23.5 93t56.5 68t66 47.5t56.5 43.5t23.5 45q0 25 -14.5 38.5t-39.5 13.5q-46 0 -81 -58l-85 59q24 51 71.5 79.5t105.5 28.5q73 0 123 -41.5t50 -112.5q0 -50 -34 -91.5t-75 -64.5t-75.5 -50.5t-35.5 -52.5h127v60h105zM1792 224v-192q0 -13 -9.5 -22.5
+t-22.5 -9.5h-1216q-13 0 -22.5 9.5t-9.5 22.5v192q0 14 9 23t23 9h1216q13 0 22.5 -9.5t9.5 -22.5zM384 1123v-99h-335v99h107q0 41 0.5 121.5t0.5 121.5v12h-2q-8 -17 -50 -54l-71 76l136 127h106v-404h108zM1792 736v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1216
+q-13 0 -22.5 9.5t-9.5 22.5v192q0 14 9 23t23 9h1216q13 0 22.5 -9.5t9.5 -22.5zM1792 1248v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1216q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1216q13 0 22.5 -9.5t9.5 -22.5z" />
+    <glyph glyph-name="strikethrough" unicode="&#xf0cc;" horiz-adv-x="1792" 
+d="M1760 640q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-1728q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h1728zM483 704q-28 35 -51 80q-48 98 -48 188q0 181 134 309q133 127 393 127q50 0 167 -19q66 -12 177 -48q10 -38 21 -118q14 -123 14 -183q0 -18 -5 -45l-12 -3l-84 6
+l-14 2q-50 149 -103 205q-88 91 -210 91q-114 0 -182 -59q-67 -58 -67 -146q0 -73 66 -140t279 -129q69 -20 173 -66q58 -28 95 -52h-743zM990 448h411q7 -39 7 -92q0 -111 -41 -212q-23 -56 -71 -104q-37 -35 -109 -81q-80 -48 -153 -66q-80 -21 -203 -21q-114 0 -195 23
+l-140 40q-57 16 -72 28q-8 8 -8 22v13q0 108 -2 156q-1 30 0 68l2 37v44l102 2q15 -34 30 -71t22.5 -56t12.5 -27q35 -57 80 -94q43 -36 105 -57q59 -22 132 -22q64 0 139 27q77 26 122 86q47 61 47 129q0 84 -81 157q-34 29 -137 71z" />
+    <glyph glyph-name="underline" unicode="&#xf0cd;" 
+d="M48 1313q-37 2 -45 4l-3 88q13 1 40 1q60 0 112 -4q132 -7 166 -7q86 0 168 3q116 4 146 5q56 0 86 2l-1 -14l2 -64v-9q-60 -9 -124 -9q-60 0 -79 -25q-13 -14 -13 -132q0 -13 0.5 -32.5t0.5 -25.5l1 -229l14 -280q6 -124 51 -202q35 -59 96 -92q88 -47 177 -47
+q104 0 191 28q56 18 99 51q48 36 65 64q36 56 53 114q21 73 21 229q0 79 -3.5 128t-11 122.5t-13.5 159.5l-4 59q-5 67 -24 88q-34 35 -77 34l-100 -2l-14 3l2 86h84l205 -10q76 -3 196 10l18 -2q6 -38 6 -51q0 -7 -4 -31q-45 -12 -84 -13q-73 -11 -79 -17q-15 -15 -15 -41
+q0 -7 1.5 -27t1.5 -31q8 -19 22 -396q6 -195 -15 -304q-15 -76 -41 -122q-38 -65 -112 -123q-75 -57 -182 -89q-109 -33 -255 -33q-167 0 -284 46q-119 47 -179 122q-61 76 -83 195q-16 80 -16 237v333q0 188 -17 213q-25 36 -147 39zM1536 -96v64q0 14 -9 23t-23 9h-1472
+q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h1472q14 0 23 9t9 23z" />
+    <glyph glyph-name="table" unicode="&#xf0ce;" horiz-adv-x="1664" 
+d="M512 160v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM512 544v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1024 160v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23
+v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM512 928v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1024 544v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1536 160v192
+q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1024 928v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1536 544v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192
+q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1536 928v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1664 1248v-1088q0 -66 -47 -113t-113 -47h-1344q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h1344q66 0 113 -47t47 -113
+z" />
+    <glyph glyph-name="magic" unicode="&#xf0d0;" horiz-adv-x="1664" 
+d="M1190 955l293 293l-107 107l-293 -293zM1637 1248q0 -27 -18 -45l-1286 -1286q-18 -18 -45 -18t-45 18l-198 198q-18 18 -18 45t18 45l1286 1286q18 18 45 18t45 -18l198 -198q18 -18 18 -45zM286 1438l98 -30l-98 -30l-30 -98l-30 98l-98 30l98 30l30 98zM636 1276
+l196 -60l-196 -60l-60 -196l-60 196l-196 60l196 60l60 196zM1566 798l98 -30l-98 -30l-30 -98l-30 98l-98 30l98 30l30 98zM926 1438l98 -30l-98 -30l-30 -98l-30 98l-98 30l98 30l30 98z" />
+    <glyph glyph-name="truck" unicode="&#xf0d1;" horiz-adv-x="1792" 
+d="M640 128q0 52 -38 90t-90 38t-90 -38t-38 -90t38 -90t90 -38t90 38t38 90zM256 640h384v256h-158q-13 0 -22 -9l-195 -195q-9 -9 -9 -22v-30zM1536 128q0 52 -38 90t-90 38t-90 -38t-38 -90t38 -90t90 -38t90 38t38 90zM1792 1216v-1024q0 -15 -4 -26.5t-13.5 -18.5
+t-16.5 -11.5t-23.5 -6t-22.5 -2t-25.5 0t-22.5 0.5q0 -106 -75 -181t-181 -75t-181 75t-75 181h-384q0 -106 -75 -181t-181 -75t-181 75t-75 181h-64q-3 0 -22.5 -0.5t-25.5 0t-22.5 2t-23.5 6t-16.5 11.5t-13.5 18.5t-4 26.5q0 26 19 45t45 19v320q0 8 -0.5 35t0 38
+t2.5 34.5t6.5 37t14 30.5t22.5 30l198 198q19 19 50.5 32t58.5 13h160v192q0 26 19 45t45 19h1024q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="pinterest" unicode="&#xf0d2;" 
+d="M1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103q-111 0 -218 32q59 93 78 164q9 34 54 211q20 -39 73 -67.5t114 -28.5q121 0 216 68.5t147 188.5t52 270q0 114 -59.5 214t-172.5 163t-255 63q-105 0 -196 -29t-154.5 -77t-109 -110.5t-67 -129.5t-21.5 -134
+q0 -104 40 -183t117 -111q30 -12 38 20q2 7 8 31t8 30q6 23 -11 43q-51 61 -51 151q0 151 104.5 259.5t273.5 108.5q151 0 235.5 -82t84.5 -213q0 -170 -68.5 -289t-175.5 -119q-61 0 -98 43.5t-23 104.5q8 35 26.5 93.5t30 103t11.5 75.5q0 50 -27 83t-77 33
+q-62 0 -105 -57t-43 -142q0 -73 25 -122l-99 -418q-17 -70 -13 -177q-206 91 -333 281t-127 423q0 209 103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="pinterest_sign" unicode="&#xf0d3;" 
+d="M1248 1408q119 0 203.5 -84.5t84.5 -203.5v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-725q85 122 108 210q9 34 53 209q21 -39 73.5 -67t112.5 -28q181 0 295.5 147.5t114.5 373.5q0 84 -35 162.5t-96.5 139t-152.5 97t-197 36.5q-104 0 -194.5 -28.5t-153 -76.5
+t-107.5 -109.5t-66.5 -128t-21.5 -132.5q0 -102 39.5 -180t116.5 -110q13 -5 23.5 0t14.5 19q10 44 15 61q6 23 -11 42q-50 62 -50 150q0 150 103.5 256.5t270.5 106.5q149 0 232.5 -81t83.5 -210q0 -168 -67.5 -286t-173.5 -118q-60 0 -97 43.5t-23 103.5q8 34 26.5 92.5
+t29.5 102t11 74.5q0 49 -26.5 81.5t-75.5 32.5q-61 0 -103.5 -56.5t-42.5 -139.5q0 -72 24 -121l-98 -414q-24 -100 -7 -254h-183q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960z" />
+    <glyph glyph-name="google_plus_sign" unicode="&#xf0d4;" 
+d="M917 631q0 26 -6 64h-362v-132h217q-3 -24 -16.5 -50t-37.5 -53t-66.5 -44.5t-96.5 -17.5q-99 0 -169 71t-70 171t70 171t169 71q92 0 153 -59l104 101q-108 100 -257 100q-160 0 -272 -112.5t-112 -271.5t112 -271.5t272 -112.5q165 0 266.5 105t101.5 270zM1262 585
+h109v110h-109v110h-110v-110h-110v-110h110v-110h110v110zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="google_plus" unicode="&#xf0d5;" horiz-adv-x="2304" 
+d="M1437 623q0 -208 -87 -370.5t-248 -254t-369 -91.5q-149 0 -285 58t-234 156t-156 234t-58 285t58 285t156 234t234 156t285 58q286 0 491 -192l-199 -191q-117 113 -292 113q-123 0 -227.5 -62t-165.5 -168.5t-61 -232.5t61 -232.5t165.5 -168.5t227.5 -62
+q83 0 152.5 23t114.5 57.5t78.5 78.5t49 83t21.5 74h-416v252h692q12 -63 12 -122zM2304 745v-210h-209v-209h-210v209h-209v210h209v209h210v-209h209z" />
+    <glyph glyph-name="money" unicode="&#xf0d6;" horiz-adv-x="1920" 
+d="M768 384h384v96h-128v448h-114l-148 -137l77 -80q42 37 55 57h2v-288h-128v-96zM1280 640q0 -70 -21 -142t-59.5 -134t-101.5 -101t-138 -39t-138 39t-101.5 101t-59.5 134t-21 142t21 142t59.5 134t101.5 101t138 39t138 -39t101.5 -101t59.5 -134t21 -142zM1792 384
+v512q-106 0 -181 75t-75 181h-1152q0 -106 -75 -181t-181 -75v-512q106 0 181 -75t75 -181h1152q0 106 75 181t181 75zM1920 1216v-1152q0 -26 -19 -45t-45 -19h-1792q-26 0 -45 19t-19 45v1152q0 26 19 45t45 19h1792q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="caret_down" unicode="&#xf0d7;" horiz-adv-x="1024" 
+d="M1024 832q0 -26 -19 -45l-448 -448q-19 -19 -45 -19t-45 19l-448 448q-19 19 -19 45t19 45t45 19h896q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="caret_up" unicode="&#xf0d8;" horiz-adv-x="1024" 
+d="M1024 320q0 -26 -19 -45t-45 -19h-896q-26 0 -45 19t-19 45t19 45l448 448q19 19 45 19t45 -19l448 -448q19 -19 19 -45z" />
+    <glyph glyph-name="caret_left" unicode="&#xf0d9;" horiz-adv-x="640" 
+d="M640 1088v-896q0 -26 -19 -45t-45 -19t-45 19l-448 448q-19 19 -19 45t19 45l448 448q19 19 45 19t45 -19t19 -45z" />
+    <glyph glyph-name="caret_right" unicode="&#xf0da;" horiz-adv-x="640" 
+d="M576 640q0 -26 -19 -45l-448 -448q-19 -19 -45 -19t-45 19t-19 45v896q0 26 19 45t45 19t45 -19l448 -448q19 -19 19 -45z" />
+    <glyph glyph-name="columns" unicode="&#xf0db;" horiz-adv-x="1664" 
+d="M160 0h608v1152h-640v-1120q0 -13 9.5 -22.5t22.5 -9.5zM1536 32v1120h-640v-1152h608q13 0 22.5 9.5t9.5 22.5zM1664 1248v-1216q0 -66 -47 -113t-113 -47h-1344q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1344q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="sort" unicode="&#xf0dc;" horiz-adv-x="1024" 
+d="M1024 448q0 -26 -19 -45l-448 -448q-19 -19 -45 -19t-45 19l-448 448q-19 19 -19 45t19 45t45 19h896q26 0 45 -19t19 -45zM1024 832q0 -26 -19 -45t-45 -19h-896q-26 0 -45 19t-19 45t19 45l448 448q19 19 45 19t45 -19l448 -448q19 -19 19 -45z" />
+    <glyph glyph-name="sort_down" unicode="&#xf0dd;" horiz-adv-x="1024" 
+d="M1024 448q0 -26 -19 -45l-448 -448q-19 -19 -45 -19t-45 19l-448 448q-19 19 -19 45t19 45t45 19h896q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="sort_up" unicode="&#xf0de;" horiz-adv-x="1024" 
+d="M1024 832q0 -26 -19 -45t-45 -19h-896q-26 0 -45 19t-19 45t19 45l448 448q19 19 45 19t45 -19l448 -448q19 -19 19 -45z" />
+    <glyph glyph-name="envelope_alt" unicode="&#xf0e0;" horiz-adv-x="1792" 
+d="M1792 826v-794q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v794q44 -49 101 -87q362 -246 497 -345q57 -42 92.5 -65.5t94.5 -48t110 -24.5h1h1q51 0 110 24.5t94.5 48t92.5 65.5q170 123 498 345q57 39 100 87zM1792 1120q0 -79 -49 -151t-122 -123
+q-376 -261 -468 -325q-10 -7 -42.5 -30.5t-54 -38t-52 -32.5t-57.5 -27t-50 -9h-1h-1q-23 0 -50 9t-57.5 27t-52 32.5t-54 38t-42.5 30.5q-91 64 -262 182.5t-205 142.5q-62 42 -117 115.5t-55 136.5q0 78 41.5 130t118.5 52h1472q65 0 112.5 -47t47.5 -113z" />
+    <glyph glyph-name="linkedin" unicode="&#xf0e1;" 
+d="M349 911v-991h-330v991h330zM370 1217q1 -73 -50.5 -122t-135.5 -49h-2q-82 0 -132 49t-50 122q0 74 51.5 122.5t134.5 48.5t133 -48.5t51 -122.5zM1536 488v-568h-329v530q0 105 -40.5 164.5t-126.5 59.5q-63 0 -105.5 -34.5t-63.5 -85.5q-11 -30 -11 -81v-553h-329
+q2 399 2 647t-1 296l-1 48h329v-144h-2q20 32 41 56t56.5 52t87 43.5t114.5 15.5q171 0 275 -113.5t104 -332.5z" />
+    <glyph glyph-name="undo" unicode="&#xf0e2;" 
+d="M1536 640q0 -156 -61 -298t-164 -245t-245 -164t-298 -61q-172 0 -327 72.5t-264 204.5q-7 10 -6.5 22.5t8.5 20.5l137 138q10 9 25 9q16 -2 23 -12q73 -95 179 -147t225 -52q104 0 198.5 40.5t163.5 109.5t109.5 163.5t40.5 198.5t-40.5 198.5t-109.5 163.5
+t-163.5 109.5t-198.5 40.5q-98 0 -188 -35.5t-160 -101.5l137 -138q31 -30 14 -69q-17 -40 -59 -40h-448q-26 0 -45 19t-19 45v448q0 42 40 59q39 17 69 -14l130 -129q107 101 244.5 156.5t284.5 55.5q156 0 298 -61t245 -164t164 -245t61 -298z" />
+    <glyph glyph-name="legal" unicode="&#xf0e3;" horiz-adv-x="1792" 
+d="M1771 0q0 -53 -37 -90l-107 -108q-39 -37 -91 -37q-53 0 -90 37l-363 364q-38 36 -38 90q0 53 43 96l-256 256l-126 -126q-14 -14 -34 -14t-34 14q2 -2 12.5 -12t12.5 -13t10 -11.5t10 -13.5t6 -13.5t5.5 -16.5t1.5 -18q0 -38 -28 -68q-3 -3 -16.5 -18t-19 -20.5
+t-18.5 -16.5t-22 -15.5t-22 -9t-26 -4.5q-40 0 -68 28l-408 408q-28 28 -28 68q0 13 4.5 26t9 22t15.5 22t16.5 18.5t20.5 19t18 16.5q30 28 68 28q10 0 18 -1.5t16.5 -5.5t13.5 -6t13.5 -10t11.5 -10t13 -12.5t12 -12.5q-14 14 -14 34t14 34l348 348q14 14 34 14t34 -14
+q-2 2 -12.5 12t-12.5 13t-10 11.5t-10 13.5t-6 13.5t-5.5 16.5t-1.5 18q0 38 28 68q3 3 16.5 18t19 20.5t18.5 16.5t22 15.5t22 9t26 4.5q40 0 68 -28l408 -408q28 -28 28 -68q0 -13 -4.5 -26t-9 -22t-15.5 -22t-16.5 -18.5t-20.5 -19t-18 -16.5q-30 -28 -68 -28
+q-10 0 -18 1.5t-16.5 5.5t-13.5 6t-13.5 10t-11.5 10t-13 12.5t-12 12.5q14 -14 14 -34t-14 -34l-126 -126l256 -256q43 43 96 43q52 0 91 -37l363 -363q37 -39 37 -91z" />
+    <glyph glyph-name="dashboard" unicode="&#xf0e4;" horiz-adv-x="1792" 
+d="M384 384q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM576 832q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1004 351l101 382q6 26 -7.5 48.5t-38.5 29.5
+t-48 -6.5t-30 -39.5l-101 -382q-60 -5 -107 -43.5t-63 -98.5q-20 -77 20 -146t117 -89t146 20t89 117q16 60 -6 117t-72 91zM1664 384q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1024 1024q0 53 -37.5 90.5
+t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1472 832q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1792 384q0 -261 -141 -483q-19 -29 -54 -29h-1402q-35 0 -54 29
+q-141 221 -141 483q0 182 71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="comment_alt" unicode="&#xf0e5;" horiz-adv-x="1792" 
+d="M896 1152q-204 0 -381.5 -69.5t-282 -187.5t-104.5 -255q0 -112 71.5 -213.5t201.5 -175.5l87 -50l-27 -96q-24 -91 -70 -172q152 63 275 171l43 38l57 -6q69 -8 130 -8q204 0 381.5 69.5t282 187.5t104.5 255t-104.5 255t-282 187.5t-381.5 69.5zM1792 640
+q0 -174 -120 -321.5t-326 -233t-450 -85.5q-70 0 -145 8q-198 -175 -460 -242q-49 -14 -114 -22h-5q-15 0 -27 10.5t-16 27.5v1q-3 4 -0.5 12t2 10t4.5 9.5l6 9t7 8.5t8 9q7 8 31 34.5t34.5 38t31 39.5t32.5 51t27 59t26 76q-157 89 -247.5 220t-90.5 281q0 174 120 321.5
+t326 233t450 85.5t450 -85.5t326 -233t120 -321.5z" />
+    <glyph glyph-name="comments_alt" unicode="&#xf0e6;" horiz-adv-x="1792" 
+d="M704 1152q-153 0 -286 -52t-211.5 -141t-78.5 -191q0 -82 53 -158t149 -132l97 -56l-35 -84q34 20 62 39l44 31l53 -10q78 -14 153 -14q153 0 286 52t211.5 141t78.5 191t-78.5 191t-211.5 141t-286 52zM704 1280q191 0 353.5 -68.5t256.5 -186.5t94 -257t-94 -257
+t-256.5 -186.5t-353.5 -68.5q-86 0 -176 16q-124 -88 -278 -128q-36 -9 -86 -16h-3q-11 0 -20.5 8t-11.5 21q-1 3 -1 6.5t0.5 6.5t2 6l2.5 5t3.5 5.5t4 5t4.5 5t4 4.5q5 6 23 25t26 29.5t22.5 29t25 38.5t20.5 44q-124 72 -195 177t-71 224q0 139 94 257t256.5 186.5
+t353.5 68.5zM1526 111q10 -24 20.5 -44t25 -38.5t22.5 -29t26 -29.5t23 -25q1 -1 4 -4.5t4.5 -5t4 -5t3.5 -5.5l2.5 -5t2 -6t0.5 -6.5t-1 -6.5q-3 -14 -13 -22t-22 -7q-50 7 -86 16q-154 40 -278 128q-90 -16 -176 -16q-271 0 -472 132q58 -4 88 -4q161 0 309 45t264 129
+q125 92 192 212t67 254q0 77 -23 152q129 -71 204 -178t75 -230q0 -120 -71 -224.5t-195 -176.5z" />
+    <glyph glyph-name="bolt" unicode="&#xf0e7;" horiz-adv-x="896" 
+d="M885 970q18 -20 7 -44l-540 -1157q-13 -25 -42 -25q-4 0 -14 2q-17 5 -25.5 19t-4.5 30l197 808l-406 -101q-4 -1 -12 -1q-18 0 -31 11q-18 15 -13 39l201 825q4 14 16 23t28 9h328q19 0 32 -12.5t13 -29.5q0 -8 -5 -18l-171 -463l396 98q8 2 12 2q19 0 34 -15z" />
+    <glyph glyph-name="sitemap" unicode="&#xf0e8;" horiz-adv-x="1792" 
+d="M1792 288v-320q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v320q0 40 28 68t68 28h96v192h-512v-192h96q40 0 68 -28t28 -68v-320q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v320q0 40 28 68t68 28h96v192h-512v-192h96q40 0 68 -28t28 -68v-320
+q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v320q0 40 28 68t68 28h96v192q0 52 38 90t90 38h512v192h-96q-40 0 -68 28t-28 68v320q0 40 28 68t68 28h320q40 0 68 -28t28 -68v-320q0 -40 -28 -68t-68 -28h-96v-192h512q52 0 90 -38t38 -90v-192h96q40 0 68 -28t28 -68
+z" />
+    <glyph glyph-name="umbrella" unicode="&#xf0e9;" horiz-adv-x="1664" 
+d="M896 708v-580q0 -104 -76 -180t-180 -76t-180 76t-76 180q0 26 19 45t45 19t45 -19t19 -45q0 -50 39 -89t89 -39t89 39t39 89v580q33 11 64 11t64 -11zM1664 681q0 -13 -9.5 -22.5t-22.5 -9.5q-11 0 -23 10q-49 46 -93 69t-102 23q-68 0 -128 -37t-103 -97
+q-7 -10 -17.5 -28t-14.5 -24q-11 -17 -28 -17q-18 0 -29 17q-4 6 -14.5 24t-17.5 28q-43 60 -102.5 97t-127.5 37t-127.5 -37t-102.5 -97q-7 -10 -17.5 -28t-14.5 -24q-11 -17 -29 -17q-17 0 -28 17q-4 6 -14.5 24t-17.5 28q-43 60 -103 97t-128 37q-58 0 -102 -23t-93 -69
+q-12 -10 -23 -10q-13 0 -22.5 9.5t-9.5 22.5q0 5 1 7q45 183 172.5 319.5t298 204.5t360.5 68q140 0 274.5 -40t246.5 -113.5t194.5 -187t115.5 -251.5q1 -2 1 -7zM896 1408v-98q-42 2 -64 2t-64 -2v98q0 26 19 45t45 19t45 -19t19 -45z" />
+    <glyph glyph-name="paste" unicode="&#xf0ea;" horiz-adv-x="1792" 
+d="M768 -128h896v640h-416q-40 0 -68 28t-28 68v416h-384v-1152zM1024 1312v64q0 13 -9.5 22.5t-22.5 9.5h-704q-13 0 -22.5 -9.5t-9.5 -22.5v-64q0 -13 9.5 -22.5t22.5 -9.5h704q13 0 22.5 9.5t9.5 22.5zM1280 640h299l-299 299v-299zM1792 512v-672q0 -40 -28 -68t-68 -28
+h-960q-40 0 -68 28t-28 68v160h-544q-40 0 -68 28t-28 68v1344q0 40 28 68t68 28h1088q40 0 68 -28t28 -68v-328q21 -13 36 -28l408 -408q28 -28 48 -76t20 -88z" />
+    <glyph glyph-name="light_bulb" unicode="&#xf0eb;" horiz-adv-x="1024" 
+d="M736 960q0 -13 -9.5 -22.5t-22.5 -9.5t-22.5 9.5t-9.5 22.5q0 46 -54 71t-106 25q-13 0 -22.5 9.5t-9.5 22.5t9.5 22.5t22.5 9.5q50 0 99.5 -16t87 -54t37.5 -90zM896 960q0 72 -34.5 134t-90 101.5t-123 62t-136.5 22.5t-136.5 -22.5t-123 -62t-90 -101.5t-34.5 -134
+q0 -101 68 -180q10 -11 30.5 -33t30.5 -33q128 -153 141 -298h228q13 145 141 298q10 11 30.5 33t30.5 33q68 79 68 180zM1024 960q0 -155 -103 -268q-45 -49 -74.5 -87t-59.5 -95.5t-34 -107.5q47 -28 47 -82q0 -37 -25 -64q25 -27 25 -64q0 -52 -45 -81q13 -23 13 -47
+q0 -46 -31.5 -71t-77.5 -25q-20 -44 -60 -70t-87 -26t-87 26t-60 70q-46 0 -77.5 25t-31.5 71q0 24 13 47q-45 29 -45 81q0 37 25 64q-25 27 -25 64q0 54 47 82q-4 50 -34 107.5t-59.5 95.5t-74.5 87q-103 113 -103 268q0 99 44.5 184.5t117 142t164 89t186.5 32.5
+t186.5 -32.5t164 -89t117 -142t44.5 -184.5z" />
+    <glyph glyph-name="exchange" unicode="&#xf0ec;" horiz-adv-x="1792" 
+d="M1792 352v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1376v-192q0 -13 -9.5 -22.5t-22.5 -9.5q-12 0 -24 10l-319 320q-9 9 -9 22q0 14 9 23l320 320q9 9 23 9q13 0 22.5 -9.5t9.5 -22.5v-192h1376q13 0 22.5 -9.5t9.5 -22.5zM1792 896q0 -14 -9 -23l-320 -320q-9 -9 -23 -9
+q-13 0 -22.5 9.5t-9.5 22.5v192h-1376q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1376v192q0 14 9 23t23 9q12 0 24 -10l319 -319q9 -9 9 -23z" />
+    <glyph glyph-name="cloud_download" unicode="&#xf0ed;" horiz-adv-x="1920" 
+d="M1280 608q0 14 -9 23t-23 9h-224v352q0 13 -9.5 22.5t-22.5 9.5h-192q-13 0 -22.5 -9.5t-9.5 -22.5v-352h-224q-13 0 -22.5 -9.5t-9.5 -22.5q0 -14 9 -23l352 -352q9 -9 23 -9t23 9l351 351q10 12 10 24zM1920 384q0 -159 -112.5 -271.5t-271.5 -112.5h-1088
+q-185 0 -316.5 131.5t-131.5 316.5q0 130 70 240t188 165q-2 30 -2 43q0 212 150 362t362 150q156 0 285.5 -87t188.5 -231q71 62 166 62q106 0 181 -75t75 -181q0 -76 -41 -138q130 -31 213.5 -135.5t83.5 -238.5z" />
+    <glyph glyph-name="cloud_upload" unicode="&#xf0ee;" horiz-adv-x="1920" 
+d="M1280 672q0 14 -9 23l-352 352q-9 9 -23 9t-23 -9l-351 -351q-10 -12 -10 -24q0 -14 9 -23t23 -9h224v-352q0 -13 9.5 -22.5t22.5 -9.5h192q13 0 22.5 9.5t9.5 22.5v352h224q13 0 22.5 9.5t9.5 22.5zM1920 384q0 -159 -112.5 -271.5t-271.5 -112.5h-1088
+q-185 0 -316.5 131.5t-131.5 316.5q0 130 70 240t188 165q-2 30 -2 43q0 212 150 362t362 150q156 0 285.5 -87t188.5 -231q71 62 166 62q106 0 181 -75t75 -181q0 -76 -41 -138q130 -31 213.5 -135.5t83.5 -238.5z" />
+    <glyph glyph-name="user_md" unicode="&#xf0f0;" horiz-adv-x="1408" 
+d="M384 192q0 -26 -19 -45t-45 -19t-45 19t-19 45t19 45t45 19t45 -19t19 -45zM1408 131q0 -121 -73 -190t-194 -69h-874q-121 0 -194 69t-73 190q0 68 5.5 131t24 138t47.5 132.5t81 103t120 60.5q-22 -52 -22 -120v-203q-58 -20 -93 -70t-35 -111q0 -80 56 -136t136 -56
+t136 56t56 136q0 61 -35.5 111t-92.5 70v203q0 62 25 93q132 -104 295 -104t295 104q25 -31 25 -93v-64q-106 0 -181 -75t-75 -181v-89q-32 -29 -32 -71q0 -40 28 -68t68 -28t68 28t28 68q0 42 -32 71v89q0 52 38 90t90 38t90 -38t38 -90v-89q-32 -29 -32 -71q0 -40 28 -68
+t68 -28t68 28t28 68q0 42 -32 71v89q0 68 -34.5 127.5t-93.5 93.5q0 10 0.5 42.5t0 48t-2.5 41.5t-7 47t-13 40q68 -15 120 -60.5t81 -103t47.5 -132.5t24 -138t5.5 -131zM1088 1024q0 -159 -112.5 -271.5t-271.5 -112.5t-271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5
+t271.5 -112.5t112.5 -271.5z" />
+    <glyph glyph-name="stethoscope" unicode="&#xf0f1;" horiz-adv-x="1408" 
+d="M1280 832q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1408 832q0 -62 -35.5 -111t-92.5 -70v-395q0 -159 -131.5 -271.5t-316.5 -112.5t-316.5 112.5t-131.5 271.5v132q-164 20 -274 128t-110 252v512q0 26 19 45t45 19q6 0 16 -2q17 30 47 48
+t65 18q53 0 90.5 -37.5t37.5 -90.5t-37.5 -90.5t-90.5 -37.5q-33 0 -64 18v-402q0 -106 94 -181t226 -75t226 75t94 181v402q-31 -18 -64 -18q-53 0 -90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5q35 0 65 -18t47 -48q10 2 16 2q26 0 45 -19t19 -45v-512q0 -144 -110 -252
+t-274 -128v-132q0 -106 94 -181t226 -75t226 75t94 181v395q-57 21 -92.5 70t-35.5 111q0 80 56 136t136 56t136 -56t56 -136z" />
+    <glyph glyph-name="suitcase" unicode="&#xf0f2;" horiz-adv-x="1792" 
+d="M640 1152h512v128h-512v-128zM288 1152v-1280h-64q-92 0 -158 66t-66 158v832q0 92 66 158t158 66h64zM1408 1152v-1280h-1024v1280h128v160q0 40 28 68t68 28h576q40 0 68 -28t28 -68v-160h128zM1792 928v-832q0 -92 -66 -158t-158 -66h-64v1280h64q92 0 158 -66
+t66 -158z" />
+    <glyph glyph-name="bell_alt" unicode="&#xf0f3;" horiz-adv-x="1792" 
+d="M912 -160q0 16 -16 16q-59 0 -101.5 42.5t-42.5 101.5q0 16 -16 16t-16 -16q0 -73 51.5 -124.5t124.5 -51.5q16 0 16 16zM1728 128q0 -52 -38 -90t-90 -38h-448q0 -106 -75 -181t-181 -75t-181 75t-75 181h-448q-52 0 -90 38t-38 90q50 42 91 88t85 119.5t74.5 158.5
+t50 206t19.5 260q0 152 117 282.5t307 158.5q-8 19 -8 39q0 40 28 68t68 28t68 -28t28 -68q0 -20 -8 -39q190 -28 307 -158.5t117 -282.5q0 -139 19.5 -260t50 -206t74.5 -158.5t85 -119.5t91 -88z" />
+    <glyph glyph-name="coffee" unicode="&#xf0f4;" horiz-adv-x="1920" 
+d="M1664 896q0 80 -56 136t-136 56h-64v-384h64q80 0 136 56t56 136zM0 128h1792q0 -106 -75 -181t-181 -75h-1280q-106 0 -181 75t-75 181zM1856 896q0 -159 -112.5 -271.5t-271.5 -112.5h-64v-32q0 -92 -66 -158t-158 -66h-704q-92 0 -158 66t-66 158v736q0 26 19 45
+t45 19h1152q159 0 271.5 -112.5t112.5 -271.5z" />
+    <glyph glyph-name="food" unicode="&#xf0f5;" horiz-adv-x="1408" 
+d="M640 1472v-640q0 -61 -35.5 -111t-92.5 -70v-779q0 -52 -38 -90t-90 -38h-128q-52 0 -90 38t-38 90v779q-57 20 -92.5 70t-35.5 111v640q0 26 19 45t45 19t45 -19t19 -45v-416q0 -26 19 -45t45 -19t45 19t19 45v416q0 26 19 45t45 19t45 -19t19 -45v-416q0 -26 19 -45
+t45 -19t45 19t19 45v416q0 26 19 45t45 19t45 -19t19 -45zM1408 1472v-1600q0 -52 -38 -90t-90 -38h-128q-52 0 -90 38t-38 90v512h-224q-13 0 -22.5 9.5t-9.5 22.5v800q0 132 94 226t226 94h256q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="file_text_alt" unicode="&#xf0f6;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M384 736q0 14 9 23t23 9h704q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-704q-14 0 -23 9t-9 23v64zM1120 512q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-704q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h704zM1120 256q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-704
+q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h704z" />
+    <glyph glyph-name="building" unicode="&#xf0f7;" horiz-adv-x="1408" 
+d="M384 224v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M640 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M1152 224v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM896 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M640 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 992v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M1152 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM896 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M640 992v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 1248v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M1152 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM896 992v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M640 1248v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM1152 992v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M896 1248v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM1152 1248v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M896 -128h384v1536h-1152v-1536h384v224q0 13 9.5 22.5t22.5 9.5h320q13 0 22.5 -9.5t9.5 -22.5v-224zM1408 1472v-1664q0 -26 -19 -45t-45 -19h-1280q-26 0 -45 19t-19 45v1664q0 26 19 45t45 19h1280q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="hospital" unicode="&#xf0f8;" horiz-adv-x="1408" 
+d="M384 224v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M640 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M1152 224v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM896 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M640 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM1152 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M896 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM1152 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M896 -128h384v1152h-256v-32q0 -40 -28 -68t-68 -28h-448q-40 0 -68 28t-28 68v32h-256v-1152h384v224q0 13 9.5 22.5t22.5 9.5h320q13 0 22.5 -9.5t9.5 -22.5v-224zM896 1056v320q0 13 -9.5 22.5t-22.5 9.5h-64q-13 0 -22.5 -9.5t-9.5 -22.5v-96h-128v96q0 13 -9.5 22.5
+t-22.5 9.5h-64q-13 0 -22.5 -9.5t-9.5 -22.5v-320q0 -13 9.5 -22.5t22.5 -9.5h64q13 0 22.5 9.5t9.5 22.5v96h128v-96q0 -13 9.5 -22.5t22.5 -9.5h64q13 0 22.5 9.5t9.5 22.5zM1408 1088v-1280q0 -26 -19 -45t-45 -19h-1280q-26 0 -45 19t-19 45v1280q0 26 19 45t45 19h320
+v288q0 40 28 68t68 28h448q40 0 68 -28t28 -68v-288h320q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="ambulance" unicode="&#xf0f9;" horiz-adv-x="1920" 
+d="M640 128q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM256 640h384v256h-158q-14 -2 -22 -9l-195 -195q-7 -12 -9 -22v-30zM1536 128q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5
+t90.5 37.5t37.5 90.5zM1664 800v192q0 14 -9 23t-23 9h-224v224q0 14 -9 23t-23 9h-192q-14 0 -23 -9t-9 -23v-224h-224q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h224v-224q0 -14 9 -23t23 -9h192q14 0 23 9t9 23v224h224q14 0 23 9t9 23zM1920 1344v-1152
+q0 -26 -19 -45t-45 -19h-192q0 -106 -75 -181t-181 -75t-181 75t-75 181h-384q0 -106 -75 -181t-181 -75t-181 75t-75 181h-128q-26 0 -45 19t-19 45t19 45t45 19v416q0 26 13 58t32 51l198 198q19 19 51 32t58 13h160v320q0 26 19 45t45 19h1152q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="medkit" unicode="&#xf0fa;" horiz-adv-x="1792" 
+d="M1280 416v192q0 14 -9 23t-23 9h-224v224q0 14 -9 23t-23 9h-192q-14 0 -23 -9t-9 -23v-224h-224q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h224v-224q0 -14 9 -23t23 -9h192q14 0 23 9t9 23v224h224q14 0 23 9t9 23zM640 1152h512v128h-512v-128zM256 1152v-1280h-32
+q-92 0 -158 66t-66 158v832q0 92 66 158t158 66h32zM1440 1152v-1280h-1088v1280h160v160q0 40 28 68t68 28h576q40 0 68 -28t28 -68v-160h160zM1792 928v-832q0 -92 -66 -158t-158 -66h-32v1280h32q92 0 158 -66t66 -158z" />
+    <glyph glyph-name="fighter_jet" unicode="&#xf0fb;" horiz-adv-x="1920" 
+d="M1920 576q-1 -32 -288 -96l-352 -32l-224 -64h-64l-293 -352h69q26 0 45 -4.5t19 -11.5t-19 -11.5t-45 -4.5h-96h-160h-64v32h64v416h-160l-192 -224h-96l-32 32v192h32v32h128v8l-192 24v128l192 24v8h-128v32h-32v192l32 32h96l192 -224h160v416h-64v32h64h160h96
+q26 0 45 -4.5t19 -11.5t-19 -11.5t-45 -4.5h-69l293 -352h64l224 -64l352 -32q128 -28 200 -52t80 -34z" />
+    <glyph glyph-name="beer" unicode="&#xf0fc;" horiz-adv-x="1664" 
+d="M640 640v384h-256v-256q0 -53 37.5 -90.5t90.5 -37.5h128zM1664 192v-192h-1152v192l128 192h-128q-159 0 -271.5 112.5t-112.5 271.5v320l-64 64l32 128h480l32 128h960l32 -192l-64 -32v-800z" />
+    <glyph glyph-name="h_sign" unicode="&#xf0fd;" 
+d="M1280 192v896q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-320h-512v320q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-896q0 -26 19 -45t45 -19h128q26 0 45 19t19 45v320h512v-320q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM1536 1120v-960
+q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="f0fe" unicode="&#xf0fe;" 
+d="M1280 576v128q0 26 -19 45t-45 19h-320v320q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-320h-320q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h320v-320q0 -26 19 -45t45 -19h128q26 0 45 19t19 45v320h320q26 0 45 19t19 45zM1536 1120v-960
+q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="double_angle_left" unicode="&#xf100;" horiz-adv-x="1024" 
+d="M627 160q0 -13 -10 -23l-50 -50q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23t10 23l466 466q10 10 23 10t23 -10l50 -50q10 -10 10 -23t-10 -23l-393 -393l393 -393q10 -10 10 -23zM1011 160q0 -13 -10 -23l-50 -50q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23
+t10 23l466 466q10 10 23 10t23 -10l50 -50q10 -10 10 -23t-10 -23l-393 -393l393 -393q10 -10 10 -23z" />
+    <glyph glyph-name="double_angle_right" unicode="&#xf101;" horiz-adv-x="1024" 
+d="M595 576q0 -13 -10 -23l-466 -466q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l393 393l-393 393q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l466 -466q10 -10 10 -23zM979 576q0 -13 -10 -23l-466 -466q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23
+l393 393l-393 393q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l466 -466q10 -10 10 -23z" />
+    <glyph glyph-name="double_angle_up" unicode="&#xf102;" horiz-adv-x="1152" 
+d="M1075 224q0 -13 -10 -23l-50 -50q-10 -10 -23 -10t-23 10l-393 393l-393 -393q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l466 466q10 10 23 10t23 -10l466 -466q10 -10 10 -23zM1075 608q0 -13 -10 -23l-50 -50q-10 -10 -23 -10t-23 10l-393 393l-393 -393
+q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l466 466q10 10 23 10t23 -10l466 -466q10 -10 10 -23z" />
+    <glyph glyph-name="double_angle_down" unicode="&#xf103;" horiz-adv-x="1152" 
+d="M1075 672q0 -13 -10 -23l-466 -466q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l393 -393l393 393q10 10 23 10t23 -10l50 -50q10 -10 10 -23zM1075 1056q0 -13 -10 -23l-466 -466q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23
+t10 23l50 50q10 10 23 10t23 -10l393 -393l393 393q10 10 23 10t23 -10l50 -50q10 -10 10 -23z" />
+    <glyph glyph-name="angle_left" unicode="&#xf104;" horiz-adv-x="640" 
+d="M627 992q0 -13 -10 -23l-393 -393l393 -393q10 -10 10 -23t-10 -23l-50 -50q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23t10 23l466 466q10 10 23 10t23 -10l50 -50q10 -10 10 -23z" />
+    <glyph glyph-name="angle_right" unicode="&#xf105;" horiz-adv-x="640" 
+d="M595 576q0 -13 -10 -23l-466 -466q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l393 393l-393 393q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l466 -466q10 -10 10 -23z" />
+    <glyph glyph-name="angle_up" unicode="&#xf106;" horiz-adv-x="1152" 
+d="M1075 352q0 -13 -10 -23l-50 -50q-10 -10 -23 -10t-23 10l-393 393l-393 -393q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l466 466q10 10 23 10t23 -10l466 -466q10 -10 10 -23z" />
+    <glyph glyph-name="angle_down" unicode="&#xf107;" horiz-adv-x="1152" 
+d="M1075 800q0 -13 -10 -23l-466 -466q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l393 -393l393 393q10 10 23 10t23 -10l50 -50q10 -10 10 -23z" />
+    <glyph glyph-name="desktop" unicode="&#xf108;" horiz-adv-x="1920" 
+d="M1792 544v832q0 13 -9.5 22.5t-22.5 9.5h-1600q-13 0 -22.5 -9.5t-9.5 -22.5v-832q0 -13 9.5 -22.5t22.5 -9.5h1600q13 0 22.5 9.5t9.5 22.5zM1920 1376v-1088q0 -66 -47 -113t-113 -47h-544q0 -37 16 -77.5t32 -71t16 -43.5q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19
+t-19 45q0 14 16 44t32 70t16 78h-544q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h1600q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="laptop" unicode="&#xf109;" horiz-adv-x="1920" 
+d="M416 256q-66 0 -113 47t-47 113v704q0 66 47 113t113 47h1088q66 0 113 -47t47 -113v-704q0 -66 -47 -113t-113 -47h-1088zM384 1120v-704q0 -13 9.5 -22.5t22.5 -9.5h1088q13 0 22.5 9.5t9.5 22.5v704q0 13 -9.5 22.5t-22.5 9.5h-1088q-13 0 -22.5 -9.5t-9.5 -22.5z
+M1760 192h160v-96q0 -40 -47 -68t-113 -28h-1600q-66 0 -113 28t-47 68v96h160h1600zM1040 96q16 0 16 16t-16 16h-160q-16 0 -16 -16t16 -16h160z" />
+    <glyph glyph-name="tablet" unicode="&#xf10a;" horiz-adv-x="1152" 
+d="M640 128q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1024 288v960q0 13 -9.5 22.5t-22.5 9.5h-832q-13 0 -22.5 -9.5t-9.5 -22.5v-960q0 -13 9.5 -22.5t22.5 -9.5h832q13 0 22.5 9.5t9.5 22.5zM1152 1248v-1088q0 -66 -47 -113t-113 -47h-832
+q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h832q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="mobile_phone" unicode="&#xf10b;" horiz-adv-x="768" 
+d="M464 128q0 33 -23.5 56.5t-56.5 23.5t-56.5 -23.5t-23.5 -56.5t23.5 -56.5t56.5 -23.5t56.5 23.5t23.5 56.5zM672 288v704q0 13 -9.5 22.5t-22.5 9.5h-512q-13 0 -22.5 -9.5t-9.5 -22.5v-704q0 -13 9.5 -22.5t22.5 -9.5h512q13 0 22.5 9.5t9.5 22.5zM480 1136
+q0 16 -16 16h-160q-16 0 -16 -16t16 -16h160q16 0 16 16zM768 1152v-1024q0 -52 -38 -90t-90 -38h-512q-52 0 -90 38t-38 90v1024q0 52 38 90t90 38h512q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="circle_blank" unicode="&#xf10c;" 
+d="M768 1184q-148 0 -273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273t-73 273t-198 198t-273 73zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103
+t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="quote_left" unicode="&#xf10d;" horiz-adv-x="1664" 
+d="M768 576v-384q0 -80 -56 -136t-136 -56h-384q-80 0 -136 56t-56 136v704q0 104 40.5 198.5t109.5 163.5t163.5 109.5t198.5 40.5h64q26 0 45 -19t19 -45v-128q0 -26 -19 -45t-45 -19h-64q-106 0 -181 -75t-75 -181v-32q0 -40 28 -68t68 -28h224q80 0 136 -56t56 -136z
+M1664 576v-384q0 -80 -56 -136t-136 -56h-384q-80 0 -136 56t-56 136v704q0 104 40.5 198.5t109.5 163.5t163.5 109.5t198.5 40.5h64q26 0 45 -19t19 -45v-128q0 -26 -19 -45t-45 -19h-64q-106 0 -181 -75t-75 -181v-32q0 -40 28 -68t68 -28h224q80 0 136 -56t56 -136z" />
+    <glyph glyph-name="quote_right" unicode="&#xf10e;" horiz-adv-x="1664" 
+d="M768 1216v-704q0 -104 -40.5 -198.5t-109.5 -163.5t-163.5 -109.5t-198.5 -40.5h-64q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h64q106 0 181 75t75 181v32q0 40 -28 68t-68 28h-224q-80 0 -136 56t-56 136v384q0 80 56 136t136 56h384q80 0 136 -56t56 -136zM1664 1216
+v-704q0 -104 -40.5 -198.5t-109.5 -163.5t-163.5 -109.5t-198.5 -40.5h-64q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h64q106 0 181 75t75 181v32q0 40 -28 68t-68 28h-224q-80 0 -136 56t-56 136v384q0 80 56 136t136 56h384q80 0 136 -56t56 -136z" />
+    <glyph glyph-name="spinner" unicode="&#xf110;" horiz-adv-x="1792" 
+d="M526 142q0 -53 -37.5 -90.5t-90.5 -37.5q-52 0 -90 38t-38 90q0 53 37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1024 -64q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM320 640q0 -53 -37.5 -90.5t-90.5 -37.5
+t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1522 142q0 -52 -38 -90t-90 -38q-53 0 -90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM558 1138q0 -66 -47 -113t-113 -47t-113 47t-47 113t47 113t113 47t113 -47t47 -113z
+M1728 640q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1088 1344q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM1618 1138q0 -93 -66 -158.5t-158 -65.5q-93 0 -158.5 65.5t-65.5 158.5
+q0 92 65.5 158t158.5 66q92 0 158 -66t66 -158z" />
+    <glyph glyph-name="circle" unicode="&#xf111;" 
+d="M1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="reply" unicode="&#xf112;" horiz-adv-x="1792" 
+d="M1792 416q0 -166 -127 -451q-3 -7 -10.5 -24t-13.5 -30t-13 -22q-12 -17 -28 -17q-15 0 -23.5 10t-8.5 25q0 9 2.5 26.5t2.5 23.5q5 68 5 123q0 101 -17.5 181t-48.5 138.5t-80 101t-105.5 69.5t-133 42.5t-154 21.5t-175.5 6h-224v-256q0 -26 -19 -45t-45 -19t-45 19
+l-512 512q-19 19 -19 45t19 45l512 512q19 19 45 19t45 -19t19 -45v-256h224q713 0 875 -403q53 -134 53 -333z" />
+    <glyph glyph-name="github_alt" unicode="&#xf113;" horiz-adv-x="1664" 
+d="M640 320q0 -40 -12.5 -82t-43 -76t-72.5 -34t-72.5 34t-43 76t-12.5 82t12.5 82t43 76t72.5 34t72.5 -34t43 -76t12.5 -82zM1280 320q0 -40 -12.5 -82t-43 -76t-72.5 -34t-72.5 34t-43 76t-12.5 82t12.5 82t43 76t72.5 34t72.5 -34t43 -76t12.5 -82zM1440 320
+q0 120 -69 204t-187 84q-41 0 -195 -21q-71 -11 -157 -11t-157 11q-152 21 -195 21q-118 0 -187 -84t-69 -204q0 -88 32 -153.5t81 -103t122 -60t140 -29.5t149 -7h168q82 0 149 7t140 29.5t122 60t81 103t32 153.5zM1664 496q0 -207 -61 -331q-38 -77 -105.5 -133t-141 -86
+t-170 -47.5t-171.5 -22t-167 -4.5q-78 0 -142 3t-147.5 12.5t-152.5 30t-137 51.5t-121 81t-86 115q-62 123 -62 331q0 237 136 396q-27 82 -27 170q0 116 51 218q108 0 190 -39.5t189 -123.5q147 35 309 35q148 0 280 -32q105 82 187 121t189 39q51 -102 51 -218
+q0 -87 -27 -168q136 -160 136 -398z" />
+    <glyph glyph-name="folder_close_alt" unicode="&#xf114;" horiz-adv-x="1664" 
+d="M1536 224v704q0 40 -28 68t-68 28h-704q-40 0 -68 28t-28 68v64q0 40 -28 68t-68 28h-320q-40 0 -68 -28t-28 -68v-960q0 -40 28 -68t68 -28h1216q40 0 68 28t28 68zM1664 928v-704q0 -92 -66 -158t-158 -66h-1216q-92 0 -158 66t-66 158v960q0 92 66 158t158 66h320
+q92 0 158 -66t66 -158v-32h672q92 0 158 -66t66 -158z" />
+    <glyph glyph-name="folder_open_alt" unicode="&#xf115;" horiz-adv-x="1920" 
+d="M1781 605q0 35 -53 35h-1088q-40 0 -85.5 -21.5t-71.5 -52.5l-294 -363q-18 -24 -18 -40q0 -35 53 -35h1088q40 0 86 22t71 53l294 363q18 22 18 39zM640 768h768v160q0 40 -28 68t-68 28h-576q-40 0 -68 28t-28 68v64q0 40 -28 68t-68 28h-320q-40 0 -68 -28t-28 -68
+v-853l256 315q44 53 116 87.5t140 34.5zM1909 605q0 -62 -46 -120l-295 -363q-43 -53 -116 -87.5t-140 -34.5h-1088q-92 0 -158 66t-66 158v960q0 92 66 158t158 66h320q92 0 158 -66t66 -158v-32h544q92 0 158 -66t66 -158v-160h192q54 0 99 -24.5t67 -70.5q15 -32 15 -68z
+" />
+    <glyph glyph-name="expand_alt" unicode="&#xf116;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="collapse_alt" unicode="&#xf117;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="smile" unicode="&#xf118;" 
+d="M1134 461q-37 -121 -138 -195t-228 -74t-228 74t-138 195q-8 25 4 48.5t38 31.5q25 8 48.5 -4t31.5 -38q25 -80 92.5 -129.5t151.5 -49.5t151.5 49.5t92.5 129.5q8 26 32 38t49 4t37 -31.5t4 -48.5zM640 896q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5
+t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1152 896q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1408 640q0 130 -51 248.5t-136.5 204t-204 136.5t-248.5 51t-248.5 -51t-204 -136.5t-136.5 -204t-51 -248.5
+t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="frown" unicode="&#xf119;" 
+d="M1134 307q8 -25 -4 -48.5t-37 -31.5t-49 4t-32 38q-25 80 -92.5 129.5t-151.5 49.5t-151.5 -49.5t-92.5 -129.5q-8 -26 -31.5 -38t-48.5 -4q-26 8 -38 31.5t-4 48.5q37 121 138 195t228 74t228 -74t138 -195zM640 896q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5
+t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1152 896q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1408 640q0 130 -51 248.5t-136.5 204t-204 136.5t-248.5 51t-248.5 -51t-204 -136.5t-136.5 -204
+t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="meh" unicode="&#xf11a;" 
+d="M1152 448q0 -26 -19 -45t-45 -19h-640q-26 0 -45 19t-19 45t19 45t45 19h640q26 0 45 -19t19 -45zM640 896q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1152 896q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5
+t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1408 640q0 130 -51 248.5t-136.5 204t-204 136.5t-248.5 51t-248.5 -51t-204 -136.5t-136.5 -204t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="gamepad" unicode="&#xf11b;" horiz-adv-x="1920" 
+d="M832 448v128q0 14 -9 23t-23 9h-192v192q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-192h-192q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h192v-192q0 -14 9 -23t23 -9h128q14 0 23 9t9 23v192h192q14 0 23 9t9 23zM1408 384q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5
+t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1664 640q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1920 512q0 -212 -150 -362t-362 -150q-192 0 -338 128h-220q-146 -128 -338 -128q-212 0 -362 150
+t-150 362t150 362t362 150h896q212 0 362 -150t150 -362z" />
+    <glyph glyph-name="keyboard" unicode="&#xf11c;" horiz-adv-x="1920" 
+d="M384 368v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM512 624v-96q0 -16 -16 -16h-224q-16 0 -16 16v96q0 16 16 16h224q16 0 16 -16zM384 880v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1408 368v-96q0 -16 -16 -16
+h-864q-16 0 -16 16v96q0 16 16 16h864q16 0 16 -16zM768 624v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM640 880v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1024 624v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16
+h96q16 0 16 -16zM896 880v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1280 624v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1664 368v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1152 880v-96
+q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1408 880v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1664 880v-352q0 -16 -16 -16h-224q-16 0 -16 16v96q0 16 16 16h112v240q0 16 16 16h96q16 0 16 -16zM1792 128v896h-1664v-896
+h1664zM1920 1024v-896q0 -53 -37.5 -90.5t-90.5 -37.5h-1664q-53 0 -90.5 37.5t-37.5 90.5v896q0 53 37.5 90.5t90.5 37.5h1664q53 0 90.5 -37.5t37.5 -90.5z" />
+    <glyph glyph-name="flag_alt" unicode="&#xf11d;" horiz-adv-x="1792" 
+d="M1664 491v616q-169 -91 -306 -91q-82 0 -145 32q-100 49 -184 76.5t-178 27.5q-173 0 -403 -127v-599q245 113 433 113q55 0 103.5 -7.5t98 -26t77 -31t82.5 -39.5l28 -14q44 -22 101 -22q120 0 293 92zM320 1280q0 -35 -17.5 -64t-46.5 -46v-1266q0 -14 -9 -23t-23 -9
+h-64q-14 0 -23 9t-9 23v1266q-29 17 -46.5 46t-17.5 64q0 53 37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1792 1216v-763q0 -39 -35 -57q-10 -5 -17 -9q-218 -116 -369 -116q-88 0 -158 35l-28 14q-64 33 -99 48t-91 29t-114 14q-102 0 -235.5 -44t-228.5 -102
+q-15 -9 -33 -9q-16 0 -32 8q-32 19 -32 56v742q0 35 31 55q35 21 78.5 42.5t114 52t152.5 49.5t155 19q112 0 209 -31t209 -86q38 -19 89 -19q122 0 310 112q22 12 31 17q31 16 62 -2q31 -20 31 -55z" />
+    <glyph glyph-name="flag_checkered" unicode="&#xf11e;" horiz-adv-x="1792" 
+d="M832 536v192q-181 -16 -384 -117v-185q205 96 384 110zM832 954v197q-172 -8 -384 -126v-189q215 111 384 118zM1664 491v184q-235 -116 -384 -71v224q-20 6 -39 15q-5 3 -33 17t-34.5 17t-31.5 15t-34.5 15.5t-32.5 13t-36 12.5t-35 8.5t-39.5 7.5t-39.5 4t-44 2
+q-23 0 -49 -3v-222h19q102 0 192.5 -29t197.5 -82q19 -9 39 -15v-188q42 -17 91 -17q120 0 293 92zM1664 918v189q-169 -91 -306 -91q-45 0 -78 8v-196q148 -42 384 90zM320 1280q0 -35 -17.5 -64t-46.5 -46v-1266q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v1266
+q-29 17 -46.5 46t-17.5 64q0 53 37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1792 1216v-763q0 -39 -35 -57q-10 -5 -17 -9q-218 -116 -369 -116q-88 0 -158 35l-28 14q-64 33 -99 48t-91 29t-114 14q-102 0 -235.5 -44t-228.5 -102q-15 -9 -33 -9q-16 0 -32 8
+q-32 19 -32 56v742q0 35 31 55q35 21 78.5 42.5t114 52t152.5 49.5t155 19q112 0 209 -31t209 -86q38 -19 89 -19q122 0 310 112q22 12 31 17q31 16 62 -2q31 -20 31 -55z" />
+    <glyph glyph-name="terminal" unicode="&#xf120;" horiz-adv-x="1664" 
+d="M585 553l-466 -466q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l393 393l-393 393q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l466 -466q10 -10 10 -23t-10 -23zM1664 96v-64q0 -14 -9 -23t-23 -9h-960q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h960q14 0 23 -9
+t9 -23z" />
+    <glyph glyph-name="code" unicode="&#xf121;" horiz-adv-x="1920" 
+d="M617 137l-50 -50q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23t10 23l466 466q10 10 23 10t23 -10l50 -50q10 -10 10 -23t-10 -23l-393 -393l393 -393q10 -10 10 -23t-10 -23zM1208 1204l-373 -1291q-4 -13 -15.5 -19.5t-23.5 -2.5l-62 17q-13 4 -19.5 15.5t-2.5 24.5
+l373 1291q4 13 15.5 19.5t23.5 2.5l62 -17q13 -4 19.5 -15.5t2.5 -24.5zM1865 553l-466 -466q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l393 393l-393 393q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l466 -466q10 -10 10 -23t-10 -23z" />
+    <glyph glyph-name="reply_all" unicode="&#xf122;" horiz-adv-x="1792" 
+d="M640 454v-70q0 -42 -39 -59q-13 -5 -25 -5q-27 0 -45 19l-512 512q-19 19 -19 45t19 45l512 512q29 31 70 14q39 -17 39 -59v-69l-397 -398q-19 -19 -19 -45t19 -45zM1792 416q0 -58 -17 -133.5t-38.5 -138t-48 -125t-40.5 -90.5l-20 -40q-8 -17 -28 -17q-6 0 -9 1
+q-25 8 -23 34q43 400 -106 565q-64 71 -170.5 110.5t-267.5 52.5v-251q0 -42 -39 -59q-13 -5 -25 -5q-27 0 -45 19l-512 512q-19 19 -19 45t19 45l512 512q29 31 70 14q39 -17 39 -59v-262q411 -28 599 -221q169 -173 169 -509z" />
+    <glyph glyph-name="star_half_empty" unicode="&#xf123;" horiz-adv-x="1664" 
+d="M1186 579l257 250l-356 52l-66 10l-30 60l-159 322v-963l59 -31l318 -168l-60 355l-12 66zM1638 841l-363 -354l86 -500q5 -33 -6 -51.5t-34 -18.5q-17 0 -40 12l-449 236l-449 -236q-23 -12 -40 -12q-23 0 -34 18.5t-6 51.5l86 500l-364 354q-32 32 -23 59.5t54 34.5
+l502 73l225 455q20 41 49 41q28 0 49 -41l225 -455l502 -73q45 -7 54 -34.5t-24 -59.5z" />
+    <glyph glyph-name="location_arrow" unicode="&#xf124;" horiz-adv-x="1408" 
+d="M1401 1187l-640 -1280q-17 -35 -57 -35q-5 0 -15 2q-22 5 -35.5 22.5t-13.5 39.5v576h-576q-22 0 -39.5 13.5t-22.5 35.5t4 42t29 30l1280 640q13 7 29 7q27 0 45 -19q15 -14 18.5 -34.5t-6.5 -39.5z" />
+    <glyph glyph-name="crop" unicode="&#xf125;" horiz-adv-x="1664" 
+d="M557 256h595v595zM512 301l595 595h-595v-595zM1664 224v-192q0 -14 -9 -23t-23 -9h-224v-224q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v224h-864q-14 0 -23 9t-9 23v864h-224q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h224v224q0 14 9 23t23 9h192q14 0 23 -9t9 -23
+v-224h851l246 247q10 9 23 9t23 -9q9 -10 9 -23t-9 -23l-247 -246v-851h224q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="code_fork" unicode="&#xf126;" horiz-adv-x="1024" 
+d="M288 64q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM288 1216q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM928 1088q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM1024 1088q0 -52 -26 -96.5t-70 -69.5
+q-2 -287 -226 -414q-67 -38 -203 -81q-128 -40 -169.5 -71t-41.5 -100v-26q44 -25 70 -69.5t26 -96.5q0 -80 -56 -136t-136 -56t-136 56t-56 136q0 52 26 96.5t70 69.5v820q-44 25 -70 69.5t-26 96.5q0 80 56 136t136 56t136 -56t56 -136q0 -52 -26 -96.5t-70 -69.5v-497
+q54 26 154 57q55 17 87.5 29.5t70.5 31t59 39.5t40.5 51t28 69.5t8.5 91.5q-44 25 -70 69.5t-26 96.5q0 80 56 136t136 56t136 -56t56 -136z" />
+    <glyph glyph-name="unlink" unicode="&#xf127;" horiz-adv-x="1664" 
+d="M439 265l-256 -256q-11 -9 -23 -9t-23 9q-9 10 -9 23t9 23l256 256q10 9 23 9t23 -9q9 -10 9 -23t-9 -23zM608 224v-320q0 -14 -9 -23t-23 -9t-23 9t-9 23v320q0 14 9 23t23 9t23 -9t9 -23zM384 448q0 -14 -9 -23t-23 -9h-320q-14 0 -23 9t-9 23t9 23t23 9h320
+q14 0 23 -9t9 -23zM1648 320q0 -120 -85 -203l-147 -146q-83 -83 -203 -83q-121 0 -204 85l-334 335q-21 21 -42 56l239 18l273 -274q27 -27 68 -27.5t68 26.5l147 146q28 28 28 67q0 40 -28 68l-274 275l18 239q35 -21 56 -42l336 -336q84 -86 84 -204zM1031 1044l-239 -18
+l-273 274q-28 28 -68 28q-39 0 -68 -27l-147 -146q-28 -28 -28 -67q0 -40 28 -68l274 -274l-18 -240q-35 21 -56 42l-336 336q-84 86 -84 204q0 120 85 203l147 146q83 83 203 83q121 0 204 -85l334 -335q21 -21 42 -56zM1664 960q0 -14 -9 -23t-23 -9h-320q-14 0 -23 9
+t-9 23t9 23t23 9h320q14 0 23 -9t9 -23zM1120 1504v-320q0 -14 -9 -23t-23 -9t-23 9t-9 23v320q0 14 9 23t23 9t23 -9t9 -23zM1527 1353l-256 -256q-11 -9 -23 -9t-23 9q-9 10 -9 23t9 23l256 256q10 9 23 9t23 -9q9 -10 9 -23t-9 -23z" />
+    <glyph glyph-name="question" unicode="&#xf128;" horiz-adv-x="1024" 
+d="M704 280v-240q0 -16 -12 -28t-28 -12h-240q-16 0 -28 12t-12 28v240q0 16 12 28t28 12h240q16 0 28 -12t12 -28zM1020 880q0 -54 -15.5 -101t-35 -76.5t-55 -59.5t-57.5 -43.5t-61 -35.5q-41 -23 -68.5 -65t-27.5 -67q0 -17 -12 -32.5t-28 -15.5h-240q-15 0 -25.5 18.5
+t-10.5 37.5v45q0 83 65 156.5t143 108.5q59 27 84 56t25 76q0 42 -46.5 74t-107.5 32q-65 0 -108 -29q-35 -25 -107 -115q-13 -16 -31 -16q-12 0 -25 8l-164 125q-13 10 -15.5 25t5.5 28q160 266 464 266q80 0 161 -31t146 -83t106 -127.5t41 -158.5z" />
+    <glyph glyph-name="_279" unicode="&#xf129;" horiz-adv-x="640" 
+d="M640 192v-128q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h64v384h-64q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h384q26 0 45 -19t19 -45v-576h64q26 0 45 -19t19 -45zM512 1344v-192q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v192
+q0 26 19 45t45 19h256q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="exclamation" unicode="&#xf12a;" horiz-adv-x="640" 
+d="M512 288v-224q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v224q0 26 19 45t45 19h256q26 0 45 -19t19 -45zM542 1344l-28 -768q-1 -26 -20.5 -45t-45.5 -19h-256q-26 0 -45.5 19t-20.5 45l-28 768q-1 26 17.5 45t44.5 19h320q26 0 44.5 -19t17.5 -45z" />
+    <glyph glyph-name="superscript" unicode="&#xf12b;" 
+d="M897 167v-167h-248l-159 252l-24 42q-8 9 -11 21h-3q-1 -3 -2.5 -6.5t-3.5 -8t-3 -6.5q-10 -20 -25 -44l-155 -250h-258v167h128l197 291l-185 272h-137v168h276l139 -228q2 -4 23 -42q8 -9 11 -21h3q3 9 11 21l25 42l140 228h257v-168h-125l-184 -267l204 -296h109z
+M1534 846v-206h-514l-3 27q-4 28 -4 46q0 64 26 117t65 86.5t84 65t84 54.5t65 54t26 64q0 38 -29.5 62.5t-70.5 24.5q-51 0 -97 -39q-14 -11 -36 -38l-105 92q26 37 63 66q83 65 188 65q110 0 178 -59.5t68 -158.5q0 -56 -24.5 -103t-62 -76.5t-81.5 -58.5t-82 -50.5
+t-65.5 -51.5t-30.5 -63h232v80h126z" />
+    <glyph glyph-name="subscript" unicode="&#xf12c;" 
+d="M897 167v-167h-248l-159 252l-24 42q-8 9 -11 21h-3q-1 -3 -2.5 -6.5t-3.5 -8t-3 -6.5q-10 -20 -25 -44l-155 -250h-258v167h128l197 291l-185 272h-137v168h276l139 -228q2 -4 23 -42q8 -9 11 -21h3q3 9 11 21l25 42l140 228h257v-168h-125l-184 -267l204 -296h109z
+M1536 -50v-206h-514l-4 27q-3 45 -3 46q0 64 26 117t65 86.5t84 65t84 54.5t65 54t26 64q0 38 -29.5 62.5t-70.5 24.5q-51 0 -97 -39q-14 -11 -36 -38l-105 92q26 37 63 66q80 65 188 65q110 0 178 -59.5t68 -158.5q0 -66 -34.5 -118.5t-84 -86t-99.5 -62.5t-87 -63t-41 -73
+h232v80h126z" />
+    <glyph glyph-name="_283" unicode="&#xf12d;" horiz-adv-x="1920" 
+d="M896 128l336 384h-768l-336 -384h768zM1909 1205q15 -34 9.5 -71.5t-30.5 -65.5l-896 -1024q-38 -44 -96 -44h-768q-38 0 -69.5 20.5t-47.5 54.5q-15 34 -9.5 71.5t30.5 65.5l896 1024q38 44 96 44h768q38 0 69.5 -20.5t47.5 -54.5z" />
+    <glyph glyph-name="puzzle_piece" unicode="&#xf12e;" horiz-adv-x="1664" 
+d="M1664 438q0 -81 -44.5 -135t-123.5 -54q-41 0 -77.5 17.5t-59 38t-56.5 38t-71 17.5q-110 0 -110 -124q0 -39 16 -115t15 -115v-5q-22 0 -33 -1q-34 -3 -97.5 -11.5t-115.5 -13.5t-98 -5q-61 0 -103 26.5t-42 83.5q0 37 17.5 71t38 56.5t38 59t17.5 77.5q0 79 -54 123.5
+t-135 44.5q-84 0 -143 -45.5t-59 -127.5q0 -43 15 -83t33.5 -64.5t33.5 -53t15 -50.5q0 -45 -46 -89q-37 -35 -117 -35q-95 0 -245 24q-9 2 -27.5 4t-27.5 4l-13 2q-1 0 -3 1q-2 0 -2 1v1024q2 -1 17.5 -3.5t34 -5t21.5 -3.5q150 -24 245 -24q80 0 117 35q46 44 46 89
+q0 22 -15 50.5t-33.5 53t-33.5 64.5t-15 83q0 82 59 127.5t144 45.5q80 0 134 -44.5t54 -123.5q0 -41 -17.5 -77.5t-38 -59t-38 -56.5t-17.5 -71q0 -57 42 -83.5t103 -26.5q64 0 180 15t163 17v-2q-1 -2 -3.5 -17.5t-5 -34t-3.5 -21.5q-24 -150 -24 -245q0 -80 35 -117
+q44 -46 89 -46q22 0 50.5 15t53 33.5t64.5 33.5t83 15q82 0 127.5 -59t45.5 -143z" />
+    <glyph glyph-name="microphone" unicode="&#xf130;" horiz-adv-x="1152" 
+d="M1152 832v-128q0 -221 -147.5 -384.5t-364.5 -187.5v-132h256q26 0 45 -19t19 -45t-19 -45t-45 -19h-640q-26 0 -45 19t-19 45t19 45t45 19h256v132q-217 24 -364.5 187.5t-147.5 384.5v128q0 26 19 45t45 19t45 -19t19 -45v-128q0 -185 131.5 -316.5t316.5 -131.5
+t316.5 131.5t131.5 316.5v128q0 26 19 45t45 19t45 -19t19 -45zM896 1216v-512q0 -132 -94 -226t-226 -94t-226 94t-94 226v512q0 132 94 226t226 94t226 -94t94 -226z" />
+    <glyph glyph-name="microphone_off" unicode="&#xf131;" horiz-adv-x="1408" 
+d="M271 591l-101 -101q-42 103 -42 214v128q0 26 19 45t45 19t45 -19t19 -45v-128q0 -53 15 -113zM1385 1193l-361 -361v-128q0 -132 -94 -226t-226 -94q-55 0 -109 19l-96 -96q97 -51 205 -51q185 0 316.5 131.5t131.5 316.5v128q0 26 19 45t45 19t45 -19t19 -45v-128
+q0 -221 -147.5 -384.5t-364.5 -187.5v-132h256q26 0 45 -19t19 -45t-19 -45t-45 -19h-640q-26 0 -45 19t-19 45t19 45t45 19h256v132q-125 13 -235 81l-254 -254q-10 -10 -23 -10t-23 10l-82 82q-10 10 -10 23t10 23l1234 1234q10 10 23 10t23 -10l82 -82q10 -10 10 -23
+t-10 -23zM1005 1325l-621 -621v512q0 132 94 226t226 94q102 0 184.5 -59t116.5 -152z" />
+    <glyph glyph-name="shield" unicode="&#xf132;" horiz-adv-x="1280" 
+d="M1088 576v640h-448v-1137q119 63 213 137q235 184 235 360zM1280 1344v-768q0 -86 -33.5 -170.5t-83 -150t-118 -127.5t-126.5 -103t-121 -77.5t-89.5 -49.5t-42.5 -20q-12 -6 -26 -6t-26 6q-16 7 -42.5 20t-89.5 49.5t-121 77.5t-126.5 103t-118 127.5t-83 150
+t-33.5 170.5v768q0 26 19 45t45 19h1152q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="calendar_empty" unicode="&#xf133;" horiz-adv-x="1664" 
+d="M128 -128h1408v1024h-1408v-1024zM512 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1280 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1664 1152v-1280
+q0 -52 -38 -90t-90 -38h-1408q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h128v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h384v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h128q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="fire_extinguisher" unicode="&#xf134;" horiz-adv-x="1408" 
+d="M512 1344q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1408 1376v-320q0 -16 -12 -25q-8 -7 -20 -7q-4 0 -7 1l-448 96q-11 2 -18 11t-7 20h-256v-102q111 -23 183.5 -111t72.5 -203v-800q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19t-19 45v800
+q0 106 62.5 190.5t161.5 114.5v111h-32q-59 0 -115 -23.5t-91.5 -53t-66 -66.5t-40.5 -53.5t-14 -24.5q-17 -35 -57 -35q-16 0 -29 7q-23 12 -31.5 37t3.5 49q5 10 14.5 26t37.5 53.5t60.5 70t85 67t108.5 52.5q-25 42 -25 86q0 66 47 113t113 47t113 -47t47 -113
+q0 -33 -14 -64h302q0 11 7 20t18 11l448 96q3 1 7 1q12 0 20 -7q12 -9 12 -25z" />
+    <glyph glyph-name="rocket" unicode="&#xf135;" horiz-adv-x="1664" 
+d="M1440 1088q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM1664 1376q0 -249 -75.5 -430.5t-253.5 -360.5q-81 -80 -195 -176l-20 -379q-2 -16 -16 -26l-384 -224q-7 -4 -16 -4q-12 0 -23 9l-64 64q-13 14 -8 32l85 276l-281 281l-276 -85q-3 -1 -9 -1
+q-14 0 -23 9l-64 64q-17 19 -5 39l224 384q10 14 26 16l379 20q96 114 176 195q188 187 358 258t431 71q14 0 24 -9.5t10 -22.5z" />
+    <glyph glyph-name="maxcdn" unicode="&#xf136;" horiz-adv-x="1792" 
+d="M1745 763l-164 -763h-334l178 832q13 56 -15 88q-27 33 -83 33h-169l-204 -953h-334l204 953h-286l-204 -953h-334l204 953l-153 327h1276q101 0 189.5 -40.5t147.5 -113.5q60 -73 81 -168.5t0 -194.5z" />
+    <glyph glyph-name="chevron_sign_left" unicode="&#xf137;" 
+d="M909 141l102 102q19 19 19 45t-19 45l-307 307l307 307q19 19 19 45t-19 45l-102 102q-19 19 -45 19t-45 -19l-454 -454q-19 -19 -19 -45t19 -45l454 -454q19 -19 45 -19t45 19zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5
+t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="chevron_sign_right" unicode="&#xf138;" 
+d="M717 141l454 454q19 19 19 45t-19 45l-454 454q-19 19 -45 19t-45 -19l-102 -102q-19 -19 -19 -45t19 -45l307 -307l-307 -307q-19 -19 -19 -45t19 -45l102 -102q19 -19 45 -19t45 19zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5
+t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="chevron_sign_up" unicode="&#xf139;" 
+d="M1165 397l102 102q19 19 19 45t-19 45l-454 454q-19 19 -45 19t-45 -19l-454 -454q-19 -19 -19 -45t19 -45l102 -102q19 -19 45 -19t45 19l307 307l307 -307q19 -19 45 -19t45 19zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5
+t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="chevron_sign_down" unicode="&#xf13a;" 
+d="M813 237l454 454q19 19 19 45t-19 45l-102 102q-19 19 -45 19t-45 -19l-307 -307l-307 307q-19 19 -45 19t-45 -19l-102 -102q-19 -19 -19 -45t19 -45l454 -454q19 -19 45 -19t45 19zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5
+t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="html5" unicode="&#xf13b;" horiz-adv-x="1408" 
+d="M1130 939l16 175h-884l47 -534h612l-22 -228l-197 -53l-196 53l-13 140h-175l22 -278l362 -100h4v1l359 99l50 544h-644l-15 181h674zM0 1408h1408l-128 -1438l-578 -162l-574 162z" />
+    <glyph glyph-name="css3" unicode="&#xf13c;" horiz-adv-x="1792" 
+d="M275 1408h1505l-266 -1333l-804 -267l-698 267l71 356h297l-29 -147l422 -161l486 161l68 339h-1208l58 297h1209l38 191h-1208z" />
+    <glyph glyph-name="anchor" unicode="&#xf13d;" horiz-adv-x="1792" 
+d="M960 1280q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1792 352v-352q0 -22 -20 -30q-8 -2 -12 -2q-12 0 -23 9l-93 93q-119 -143 -318.5 -226.5t-429.5 -83.5t-429.5 83.5t-318.5 226.5l-93 -93q-9 -9 -23 -9q-4 0 -12 2q-20 8 -20 30v352
+q0 14 9 23t23 9h352q22 0 30 -20q8 -19 -7 -35l-100 -100q67 -91 189.5 -153.5t271.5 -82.5v647h-192q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h192v163q-58 34 -93 92.5t-35 128.5q0 106 75 181t181 75t181 -75t75 -181q0 -70 -35 -128.5t-93 -92.5v-163h192q26 0 45 -19
+t19 -45v-128q0 -26 -19 -45t-45 -19h-192v-647q149 20 271.5 82.5t189.5 153.5l-100 100q-15 16 -7 35q8 20 30 20h352q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="unlock_alt" unicode="&#xf13e;" horiz-adv-x="1152" 
+d="M1056 768q40 0 68 -28t28 -68v-576q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68v576q0 40 28 68t68 28h32v320q0 185 131.5 316.5t316.5 131.5t316.5 -131.5t131.5 -316.5q0 -26 -19 -45t-45 -19h-64q-26 0 -45 19t-19 45q0 106 -75 181t-181 75t-181 -75t-75 -181
+v-320h736z" />
+    <glyph glyph-name="bullseye" unicode="&#xf140;" 
+d="M1024 640q0 -106 -75 -181t-181 -75t-181 75t-75 181t75 181t181 75t181 -75t75 -181zM1152 640q0 159 -112.5 271.5t-271.5 112.5t-271.5 -112.5t-112.5 -271.5t112.5 -271.5t271.5 -112.5t271.5 112.5t112.5 271.5zM1280 640q0 -212 -150 -362t-362 -150t-362 150
+t-150 362t150 362t362 150t362 -150t150 -362zM1408 640q0 130 -51 248.5t-136.5 204t-204 136.5t-248.5 51t-248.5 -51t-204 -136.5t-136.5 -204t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="ellipsis_horizontal" unicode="&#xf141;" horiz-adv-x="1408" 
+d="M384 800v-192q0 -40 -28 -68t-68 -28h-192q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h192q40 0 68 -28t28 -68zM896 800v-192q0 -40 -28 -68t-68 -28h-192q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h192q40 0 68 -28t28 -68zM1408 800v-192q0 -40 -28 -68t-68 -28h-192
+q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h192q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="ellipsis_vertical" unicode="&#xf142;" horiz-adv-x="384" 
+d="M384 288v-192q0 -40 -28 -68t-68 -28h-192q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h192q40 0 68 -28t28 -68zM384 800v-192q0 -40 -28 -68t-68 -28h-192q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h192q40 0 68 -28t28 -68zM384 1312v-192q0 -40 -28 -68t-68 -28h-192
+q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h192q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="_303" unicode="&#xf143;" 
+d="M512 256q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM863 162q-13 233 -176.5 396.5t-396.5 176.5q-14 1 -24 -9t-10 -23v-128q0 -13 8.5 -22t21.5 -10q154 -11 264 -121t121 -264q1 -13 10 -21.5t22 -8.5h128
+q13 0 23 10t9 24zM1247 161q-5 154 -56 297.5t-139.5 260t-205 205t-260 139.5t-297.5 56q-14 1 -23 -9q-10 -10 -10 -23v-128q0 -13 9 -22t22 -10q204 -7 378 -111.5t278.5 -278.5t111.5 -378q1 -13 10 -22t22 -9h128q13 0 23 10q11 9 9 23zM1536 1120v-960
+q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="play_sign" unicode="&#xf144;" 
+d="M768 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5t-103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103zM1152 585q32 18 32 55t-32 55l-544 320q-31 19 -64 1q-32 -19 -32 -56v-640q0 -37 32 -56
+q16 -8 32 -8q17 0 32 9z" />
+    <glyph glyph-name="ticket" unicode="&#xf145;" horiz-adv-x="1792" 
+d="M1024 1084l316 -316l-572 -572l-316 316zM813 105l618 618q19 19 19 45t-19 45l-362 362q-18 18 -45 18t-45 -18l-618 -618q-19 -19 -19 -45t19 -45l362 -362q18 -18 45 -18t45 18zM1702 742l-907 -908q-37 -37 -90.5 -37t-90.5 37l-126 126q56 56 56 136t-56 136
+t-136 56t-136 -56l-125 126q-37 37 -37 90.5t37 90.5l907 906q37 37 90.5 37t90.5 -37l125 -125q-56 -56 -56 -136t56 -136t136 -56t136 56l126 -125q37 -37 37 -90.5t-37 -90.5z" />
+    <glyph glyph-name="minus_sign_alt" unicode="&#xf146;" 
+d="M1280 576v128q0 26 -19 45t-45 19h-896q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h896q26 0 45 19t19 45zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5
+t84.5 -203.5z" />
+    <glyph glyph-name="check_minus" unicode="&#xf147;" horiz-adv-x="1408" 
+d="M1152 736v-64q0 -14 -9 -23t-23 -9h-832q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h832q14 0 23 -9t9 -23zM1280 288v832q0 66 -47 113t-113 47h-832q-66 0 -113 -47t-47 -113v-832q0 -66 47 -113t113 -47h832q66 0 113 47t47 113zM1408 1120v-832q0 -119 -84.5 -203.5
+t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h832q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="level_up" unicode="&#xf148;" horiz-adv-x="1024" 
+d="M1018 933q-18 -37 -58 -37h-192v-864q0 -14 -9 -23t-23 -9h-704q-21 0 -29 18q-8 20 4 35l160 192q9 11 25 11h320v640h-192q-40 0 -58 37q-17 37 9 68l320 384q18 22 49 22t49 -22l320 -384q27 -32 9 -68z" />
+    <glyph glyph-name="level_down" unicode="&#xf149;" horiz-adv-x="1024" 
+d="M32 1280h704q13 0 22.5 -9.5t9.5 -23.5v-863h192q40 0 58 -37t-9 -69l-320 -384q-18 -22 -49 -22t-49 22l-320 384q-26 31 -9 69q18 37 58 37h192v640h-320q-14 0 -25 11l-160 192q-13 14 -4 34q9 19 29 19z" />
+    <glyph glyph-name="check_sign" unicode="&#xf14a;" 
+d="M685 237l614 614q19 19 19 45t-19 45l-102 102q-19 19 -45 19t-45 -19l-467 -467l-211 211q-19 19 -45 19t-45 -19l-102 -102q-19 -19 -19 -45t19 -45l358 -358q19 -19 45 -19t45 19zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5
+t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="edit_sign" unicode="&#xf14b;" 
+d="M404 428l152 -152l-52 -52h-56v96h-96v56zM818 818q14 -13 -3 -30l-291 -291q-17 -17 -30 -3q-14 13 3 30l291 291q17 17 30 3zM544 128l544 544l-288 288l-544 -544v-288h288zM1152 736l92 92q28 28 28 68t-28 68l-152 152q-28 28 -68 28t-68 -28l-92 -92zM1536 1120
+v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_312" unicode="&#xf14c;" 
+d="M1280 608v480q0 26 -19 45t-45 19h-480q-42 0 -59 -39q-17 -41 14 -70l144 -144l-534 -534q-19 -19 -19 -45t19 -45l102 -102q19 -19 45 -19t45 19l534 534l144 -144q18 -19 45 -19q12 0 25 5q39 17 39 59zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960
+q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="share_sign" unicode="&#xf14d;" 
+d="M1005 435l352 352q19 19 19 45t-19 45l-352 352q-30 31 -69 14q-40 -17 -40 -59v-160q-119 0 -216 -19.5t-162.5 -51t-114 -79t-76.5 -95.5t-44.5 -109t-21.5 -111.5t-5 -110.5q0 -181 167 -404q11 -12 25 -12q7 0 13 3q22 9 19 33q-44 354 62 473q46 52 130 75.5
+t224 23.5v-160q0 -42 40 -59q12 -5 24 -5q26 0 45 19zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="compass" unicode="&#xf14e;" 
+d="M640 448l256 128l-256 128v-256zM1024 1039v-542l-512 -256v542zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103
+t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="collapse" unicode="&#xf150;" 
+d="M1145 861q18 -35 -5 -66l-320 -448q-19 -27 -52 -27t-52 27l-320 448q-23 31 -5 66q17 35 57 35h640q40 0 57 -35zM1280 160v960q0 13 -9.5 22.5t-22.5 9.5h-960q-13 0 -22.5 -9.5t-9.5 -22.5v-960q0 -13 9.5 -22.5t22.5 -9.5h960q13 0 22.5 9.5t9.5 22.5zM1536 1120
+v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="collapse_top" unicode="&#xf151;" 
+d="M1145 419q-17 -35 -57 -35h-640q-40 0 -57 35q-18 35 5 66l320 448q19 27 52 27t52 -27l320 -448q23 -31 5 -66zM1280 160v960q0 13 -9.5 22.5t-22.5 9.5h-960q-13 0 -22.5 -9.5t-9.5 -22.5v-960q0 -13 9.5 -22.5t22.5 -9.5h960q13 0 22.5 9.5t9.5 22.5zM1536 1120v-960
+q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_317" unicode="&#xf152;" 
+d="M1088 640q0 -33 -27 -52l-448 -320q-31 -23 -66 -5q-35 17 -35 57v640q0 40 35 57q35 18 66 -5l448 -320q27 -19 27 -52zM1280 160v960q0 14 -9 23t-23 9h-960q-14 0 -23 -9t-9 -23v-960q0 -14 9 -23t23 -9h960q14 0 23 9t9 23zM1536 1120v-960q0 -119 -84.5 -203.5
+t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="eur" unicode="&#xf153;" horiz-adv-x="1024" 
+d="M976 229l35 -159q3 -12 -3 -22.5t-17 -14.5l-5 -1q-4 -2 -10.5 -3.5t-16 -4.5t-21.5 -5.5t-25.5 -5t-30 -5t-33.5 -4.5t-36.5 -3t-38.5 -1q-234 0 -409 130.5t-238 351.5h-95q-13 0 -22.5 9.5t-9.5 22.5v113q0 13 9.5 22.5t22.5 9.5h66q-2 57 1 105h-67q-14 0 -23 9
+t-9 23v114q0 14 9 23t23 9h98q67 210 243.5 338t400.5 128q102 0 194 -23q11 -3 20 -15q6 -11 3 -24l-43 -159q-3 -13 -14 -19.5t-24 -2.5l-4 1q-4 1 -11.5 2.5l-17.5 3.5t-22.5 3.5t-26 3t-29 2.5t-29.5 1q-126 0 -226 -64t-150 -176h468q16 0 25 -12q10 -12 7 -26
+l-24 -114q-5 -26 -32 -26h-488q-3 -37 0 -105h459q15 0 25 -12q9 -12 6 -27l-24 -112q-2 -11 -11 -18.5t-20 -7.5h-387q48 -117 149.5 -185.5t228.5 -68.5q18 0 36 1.5t33.5 3.5t29.5 4.5t24.5 5t18.5 4.5l12 3l5 2q13 5 26 -2q12 -7 15 -21z" />
+    <glyph glyph-name="gbp" unicode="&#xf154;" horiz-adv-x="1024" 
+d="M1020 399v-367q0 -14 -9 -23t-23 -9h-956q-14 0 -23 9t-9 23v150q0 13 9.5 22.5t22.5 9.5h97v383h-95q-14 0 -23 9.5t-9 22.5v131q0 14 9 23t23 9h95v223q0 171 123.5 282t314.5 111q185 0 335 -125q9 -8 10 -20.5t-7 -22.5l-103 -127q-9 -11 -22 -12q-13 -2 -23 7
+q-5 5 -26 19t-69 32t-93 18q-85 0 -137 -47t-52 -123v-215h305q13 0 22.5 -9t9.5 -23v-131q0 -13 -9.5 -22.5t-22.5 -9.5h-305v-379h414v181q0 13 9 22.5t23 9.5h162q14 0 23 -9.5t9 -22.5z" />
+    <glyph glyph-name="usd" unicode="&#xf155;" horiz-adv-x="1024" 
+d="M978 351q0 -153 -99.5 -263.5t-258.5 -136.5v-175q0 -14 -9 -23t-23 -9h-135q-13 0 -22.5 9.5t-9.5 22.5v175q-66 9 -127.5 31t-101.5 44.5t-74 48t-46.5 37.5t-17.5 18q-17 21 -2 41l103 135q7 10 23 12q15 2 24 -9l2 -2q113 -99 243 -125q37 -8 74 -8q81 0 142.5 43
+t61.5 122q0 28 -15 53t-33.5 42t-58.5 37.5t-66 32t-80 32.5q-39 16 -61.5 25t-61.5 26.5t-62.5 31t-56.5 35.5t-53.5 42.5t-43.5 49t-35.5 58t-21 66.5t-8.5 78q0 138 98 242t255 134v180q0 13 9.5 22.5t22.5 9.5h135q14 0 23 -9t9 -23v-176q57 -6 110.5 -23t87 -33.5
+t63.5 -37.5t39 -29t15 -14q17 -18 5 -38l-81 -146q-8 -15 -23 -16q-14 -3 -27 7q-3 3 -14.5 12t-39 26.5t-58.5 32t-74.5 26t-85.5 11.5q-95 0 -155 -43t-60 -111q0 -26 8.5 -48t29.5 -41.5t39.5 -33t56 -31t60.5 -27t70 -27.5q53 -20 81 -31.5t76 -35t75.5 -42.5t62 -50
+t53 -63.5t31.5 -76.5t13 -94z" />
+    <glyph glyph-name="inr" unicode="&#xf156;" horiz-adv-x="898" 
+d="M898 1066v-102q0 -14 -9 -23t-23 -9h-168q-23 -144 -129 -234t-276 -110q167 -178 459 -536q14 -16 4 -34q-8 -18 -29 -18h-195q-16 0 -25 12q-306 367 -498 571q-9 9 -9 22v127q0 13 9.5 22.5t22.5 9.5h112q132 0 212.5 43t102.5 125h-427q-14 0 -23 9t-9 23v102
+q0 14 9 23t23 9h413q-57 113 -268 113h-145q-13 0 -22.5 9.5t-9.5 22.5v133q0 14 9 23t23 9h832q14 0 23 -9t9 -23v-102q0 -14 -9 -23t-23 -9h-233q47 -61 64 -144h171q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="jpy" unicode="&#xf157;" horiz-adv-x="1027" 
+d="M603 0h-172q-13 0 -22.5 9t-9.5 23v330h-288q-13 0 -22.5 9t-9.5 23v103q0 13 9.5 22.5t22.5 9.5h288v85h-288q-13 0 -22.5 9t-9.5 23v104q0 13 9.5 22.5t22.5 9.5h214l-321 578q-8 16 0 32q10 16 28 16h194q19 0 29 -18l215 -425q19 -38 56 -125q10 24 30.5 68t27.5 61
+l191 420q8 19 29 19h191q17 0 27 -16q9 -14 1 -31l-313 -579h215q13 0 22.5 -9.5t9.5 -22.5v-104q0 -14 -9.5 -23t-22.5 -9h-290v-85h290q13 0 22.5 -9.5t9.5 -22.5v-103q0 -14 -9.5 -23t-22.5 -9h-290v-330q0 -13 -9.5 -22.5t-22.5 -9.5z" />
+    <glyph glyph-name="rub" unicode="&#xf158;" horiz-adv-x="1280" 
+d="M1043 971q0 100 -65 162t-171 62h-320v-448h320q106 0 171 62t65 162zM1280 971q0 -193 -126.5 -315t-326.5 -122h-340v-118h505q14 0 23 -9t9 -23v-128q0 -14 -9 -23t-23 -9h-505v-192q0 -14 -9.5 -23t-22.5 -9h-167q-14 0 -23 9t-9 23v192h-224q-14 0 -23 9t-9 23v128
+q0 14 9 23t23 9h224v118h-224q-14 0 -23 9t-9 23v149q0 13 9 22.5t23 9.5h224v629q0 14 9 23t23 9h539q200 0 326.5 -122t126.5 -315z" />
+    <glyph glyph-name="krw" unicode="&#xf159;" horiz-adv-x="1792" 
+d="M514 341l81 299h-159l75 -300q1 -1 1 -3t1 -3q0 1 0.5 3.5t0.5 3.5zM630 768l35 128h-292l32 -128h225zM822 768h139l-35 128h-70zM1271 340l78 300h-162l81 -299q0 -1 0.5 -3.5t1.5 -3.5q0 1 0.5 3t0.5 3zM1382 768l33 128h-297l34 -128h230zM1792 736v-64q0 -14 -9 -23
+t-23 -9h-213l-164 -616q-7 -24 -31 -24h-159q-24 0 -31 24l-166 616h-209l-167 -616q-7 -24 -31 -24h-159q-11 0 -19.5 7t-10.5 17l-160 616h-208q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h175l-33 128h-142q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h109l-89 344q-5 15 5 28
+q10 12 26 12h137q26 0 31 -24l90 -360h359l97 360q7 24 31 24h126q24 0 31 -24l98 -360h365l93 360q5 24 31 24h137q16 0 26 -12q10 -13 5 -28l-91 -344h111q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-145l-34 -128h179q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="btc" unicode="&#xf15a;" horiz-adv-x="1280" 
+d="M1167 896q18 -182 -131 -258q117 -28 175 -103t45 -214q-7 -71 -32.5 -125t-64.5 -89t-97 -58.5t-121.5 -34.5t-145.5 -15v-255h-154v251q-80 0 -122 1v-252h-154v255q-18 0 -54 0.5t-55 0.5h-200l31 183h111q50 0 58 51v402h16q-6 1 -16 1v287q-13 68 -89 68h-111v164
+l212 -1q64 0 97 1v252h154v-247q82 2 122 2v245h154v-252q79 -7 140 -22.5t113 -45t82.5 -78t36.5 -114.5zM952 351q0 36 -15 64t-37 46t-57.5 30.5t-65.5 18.5t-74 9t-69 3t-64.5 -1t-47.5 -1v-338q8 0 37 -0.5t48 -0.5t53 1.5t58.5 4t57 8.5t55.5 14t47.5 21t39.5 30
+t24.5 40t9.5 51zM881 827q0 33 -12.5 58.5t-30.5 42t-48 28t-55 16.5t-61.5 8t-58 2.5t-54 -1t-39.5 -0.5v-307q5 0 34.5 -0.5t46.5 0t50 2t55 5.5t51.5 11t48.5 18.5t37 27t27 38.5t9 51z" />
+    <glyph glyph-name="file" unicode="&#xf15b;" 
+d="M1024 1024v472q22 -14 36 -28l408 -408q14 -14 28 -36h-472zM896 992q0 -40 28 -68t68 -28h544v-1056q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h800v-544z" />
+    <glyph glyph-name="file_text" unicode="&#xf15c;" 
+d="M1468 1060q14 -14 28 -36h-472v472q22 -14 36 -28zM992 896h544v-1056q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h800v-544q0 -40 28 -68t68 -28zM1152 160v64q0 14 -9 23t-23 9h-704q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h704
+q14 0 23 9t9 23zM1152 416v64q0 14 -9 23t-23 9h-704q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h704q14 0 23 9t9 23zM1152 672v64q0 14 -9 23t-23 9h-704q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h704q14 0 23 9t9 23z" />
+    <glyph glyph-name="sort_by_alphabet" unicode="&#xf15d;" horiz-adv-x="1664" 
+d="M1191 1128h177l-72 218l-12 47q-2 16 -2 20h-4l-3 -20q0 -1 -3.5 -18t-7.5 -29zM736 96q0 -12 -10 -24l-319 -319q-10 -9 -23 -9q-12 0 -23 9l-320 320q-15 16 -7 35q8 20 30 20h192v1376q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1376h192q14 0 23 -9t9 -23zM1572 -23
+v-233h-584v90l369 529q12 18 21 27l11 9v3q-2 0 -6.5 -0.5t-7.5 -0.5q-12 -3 -30 -3h-232v-115h-120v229h567v-89l-369 -530q-6 -8 -21 -26l-11 -11v-2l14 2q9 2 30 2h248v119h121zM1661 874v-106h-288v106h75l-47 144h-243l-47 -144h75v-106h-287v106h70l230 662h162
+l230 -662h70z" />
+    <glyph glyph-name="_329" unicode="&#xf15e;" horiz-adv-x="1664" 
+d="M1191 104h177l-72 218l-12 47q-2 16 -2 20h-4l-3 -20q0 -1 -3.5 -18t-7.5 -29zM736 96q0 -12 -10 -24l-319 -319q-10 -9 -23 -9q-12 0 -23 9l-320 320q-15 16 -7 35q8 20 30 20h192v1376q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1376h192q14 0 23 -9t9 -23zM1661 -150
+v-106h-288v106h75l-47 144h-243l-47 -144h75v-106h-287v106h70l230 662h162l230 -662h70zM1572 1001v-233h-584v90l369 529q12 18 21 27l11 9v3q-2 0 -6.5 -0.5t-7.5 -0.5q-12 -3 -30 -3h-232v-115h-120v229h567v-89l-369 -530q-6 -8 -21 -26l-11 -10v-3l14 3q9 1 30 1h248
+v119h121z" />
+    <glyph glyph-name="sort_by_attributes" unicode="&#xf160;" horiz-adv-x="1792" 
+d="M736 96q0 -12 -10 -24l-319 -319q-10 -9 -23 -9q-12 0 -23 9l-320 320q-15 16 -7 35q8 20 30 20h192v1376q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1376h192q14 0 23 -9t9 -23zM1792 -32v-192q0 -14 -9 -23t-23 -9h-832q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h832
+q14 0 23 -9t9 -23zM1600 480v-192q0 -14 -9 -23t-23 -9h-640q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h640q14 0 23 -9t9 -23zM1408 992v-192q0 -14 -9 -23t-23 -9h-448q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h448q14 0 23 -9t9 -23zM1216 1504v-192q0 -14 -9 -23t-23 -9h-256
+q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h256q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="sort_by_attributes_alt" unicode="&#xf161;" horiz-adv-x="1792" 
+d="M1216 -32v-192q0 -14 -9 -23t-23 -9h-256q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h256q14 0 23 -9t9 -23zM736 96q0 -12 -10 -24l-319 -319q-10 -9 -23 -9q-12 0 -23 9l-320 320q-15 16 -7 35q8 20 30 20h192v1376q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1376h192
+q14 0 23 -9t9 -23zM1408 480v-192q0 -14 -9 -23t-23 -9h-448q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h448q14 0 23 -9t9 -23zM1600 992v-192q0 -14 -9 -23t-23 -9h-640q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h640q14 0 23 -9t9 -23zM1792 1504v-192q0 -14 -9 -23t-23 -9h-832
+q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h832q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="sort_by_order" unicode="&#xf162;" 
+d="M1346 223q0 63 -44 116t-103 53q-52 0 -83 -37t-31 -94t36.5 -95t104.5 -38q50 0 85 27t35 68zM736 96q0 -12 -10 -24l-319 -319q-10 -9 -23 -9q-12 0 -23 9l-320 320q-15 16 -7 35q8 20 30 20h192v1376q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1376h192q14 0 23 -9t9 -23
+zM1486 165q0 -62 -13 -121.5t-41 -114t-68 -95.5t-98.5 -65.5t-127.5 -24.5q-62 0 -108 16q-24 8 -42 15l39 113q15 -7 31 -11q37 -13 75 -13q84 0 134.5 58.5t66.5 145.5h-2q-21 -23 -61.5 -37t-84.5 -14q-106 0 -173 71.5t-67 172.5q0 105 72 178t181 73q123 0 205 -94.5
+t82 -252.5zM1456 882v-114h-469v114h167v432q0 7 0.5 19t0.5 17v16h-2l-7 -12q-8 -13 -26 -31l-62 -58l-82 86l192 185h123v-654h165z" />
+    <glyph glyph-name="sort_by_order_alt" unicode="&#xf163;" 
+d="M1346 1247q0 63 -44 116t-103 53q-52 0 -83 -37t-31 -94t36.5 -95t104.5 -38q50 0 85 27t35 68zM736 96q0 -12 -10 -24l-319 -319q-10 -9 -23 -9q-12 0 -23 9l-320 320q-15 16 -7 35q8 20 30 20h192v1376q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1376h192q14 0 23 -9
+t9 -23zM1456 -142v-114h-469v114h167v432q0 7 0.5 19t0.5 17v16h-2l-7 -12q-8 -13 -26 -31l-62 -58l-82 86l192 185h123v-654h165zM1486 1189q0 -62 -13 -121.5t-41 -114t-68 -95.5t-98.5 -65.5t-127.5 -24.5q-62 0 -108 16q-24 8 -42 15l39 113q15 -7 31 -11q37 -13 75 -13
+q84 0 134.5 58.5t66.5 145.5h-2q-21 -23 -61.5 -37t-84.5 -14q-106 0 -173 71.5t-67 172.5q0 105 72 178t181 73q123 0 205 -94.5t82 -252.5z" />
+    <glyph glyph-name="_334" unicode="&#xf164;" horiz-adv-x="1664" 
+d="M256 192q0 26 -19 45t-45 19q-27 0 -45.5 -19t-18.5 -45q0 -27 18.5 -45.5t45.5 -18.5q26 0 45 18.5t19 45.5zM416 704v-640q0 -26 -19 -45t-45 -19h-288q-26 0 -45 19t-19 45v640q0 26 19 45t45 19h288q26 0 45 -19t19 -45zM1600 704q0 -86 -55 -149q15 -44 15 -76
+q3 -76 -43 -137q17 -56 0 -117q-15 -57 -54 -94q9 -112 -49 -181q-64 -76 -197 -78h-36h-76h-17q-66 0 -144 15.5t-121.5 29t-120.5 39.5q-123 43 -158 44q-26 1 -45 19.5t-19 44.5v641q0 25 18 43.5t43 20.5q24 2 76 59t101 121q68 87 101 120q18 18 31 48t17.5 48.5
+t13.5 60.5q7 39 12.5 61t19.5 52t34 50q19 19 45 19q46 0 82.5 -10.5t60 -26t40 -40.5t24 -45t12 -50t5 -45t0.5 -39q0 -38 -9.5 -76t-19 -60t-27.5 -56q-3 -6 -10 -18t-11 -22t-8 -24h277q78 0 135 -57t57 -135z" />
+    <glyph glyph-name="_335" unicode="&#xf165;" horiz-adv-x="1664" 
+d="M256 960q0 -26 -19 -45t-45 -19q-27 0 -45.5 19t-18.5 45q0 27 18.5 45.5t45.5 18.5q26 0 45 -18.5t19 -45.5zM416 448v640q0 26 -19 45t-45 19h-288q-26 0 -45 -19t-19 -45v-640q0 -26 19 -45t45 -19h288q26 0 45 19t19 45zM1545 597q55 -61 55 -149q-1 -78 -57.5 -135
+t-134.5 -57h-277q4 -14 8 -24t11 -22t10 -18q18 -37 27 -57t19 -58.5t10 -76.5q0 -24 -0.5 -39t-5 -45t-12 -50t-24 -45t-40 -40.5t-60 -26t-82.5 -10.5q-26 0 -45 19q-20 20 -34 50t-19.5 52t-12.5 61q-9 42 -13.5 60.5t-17.5 48.5t-31 48q-33 33 -101 120q-49 64 -101 121
+t-76 59q-25 2 -43 20.5t-18 43.5v641q0 26 19 44.5t45 19.5q35 1 158 44q77 26 120.5 39.5t121.5 29t144 15.5h17h76h36q133 -2 197 -78q58 -69 49 -181q39 -37 54 -94q17 -61 0 -117q46 -61 43 -137q0 -32 -15 -76z" />
+    <glyph glyph-name="youtube_sign" unicode="&#xf166;" 
+d="M919 233v157q0 50 -29 50q-17 0 -33 -16v-224q16 -16 33 -16q29 0 29 49zM1103 355h66v34q0 51 -33 51t-33 -51v-34zM532 621v-70h-80v-423h-74v423h-78v70h232zM733 495v-367h-67v40q-39 -45 -76 -45q-33 0 -42 28q-6 17 -6 54v290h66v-270q0 -24 1 -26q1 -15 15 -15
+q20 0 42 31v280h67zM985 384v-146q0 -52 -7 -73q-12 -42 -53 -42q-35 0 -68 41v-36h-67v493h67v-161q32 40 68 40q41 0 53 -42q7 -21 7 -74zM1236 255v-9q0 -29 -2 -43q-3 -22 -15 -40q-27 -40 -80 -40q-52 0 -81 38q-21 27 -21 86v129q0 59 20 86q29 38 80 38t78 -38
+q21 -29 21 -86v-76h-133v-65q0 -51 34 -51q24 0 30 26q0 1 0.5 7t0.5 16.5v21.5h68zM785 1079v-156q0 -51 -32 -51t-32 51v156q0 52 32 52t32 -52zM1318 366q0 177 -19 260q-10 44 -43 73.5t-76 34.5q-136 15 -412 15q-275 0 -411 -15q-44 -5 -76.5 -34.5t-42.5 -73.5
+q-20 -87 -20 -260q0 -176 20 -260q10 -43 42.5 -73t75.5 -35q137 -15 412 -15t412 15q43 5 75.5 35t42.5 73q20 84 20 260zM563 1017l90 296h-75l-51 -195l-53 195h-78q7 -23 23 -69l24 -69q35 -103 46 -158v-201h74v201zM852 936v130q0 58 -21 87q-29 38 -78 38
+q-51 0 -78 -38q-21 -29 -21 -87v-130q0 -58 21 -87q27 -38 78 -38q49 0 78 38q21 27 21 87zM1033 816h67v370h-67v-283q-22 -31 -42 -31q-15 0 -16 16q-1 2 -1 26v272h-67v-293q0 -37 6 -55q11 -27 43 -27q36 0 77 45v-40zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5
+h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="youtube" unicode="&#xf167;" 
+d="M971 292v-211q0 -67 -39 -67q-23 0 -45 22v301q22 22 45 22q39 0 39 -67zM1309 291v-46h-90v46q0 68 45 68t45 -68zM343 509h107v94h-312v-94h105v-569h100v569zM631 -60h89v494h-89v-378q-30 -42 -57 -42q-18 0 -21 21q-1 3 -1 35v364h-89v-391q0 -49 8 -73
+q12 -37 58 -37q48 0 102 61v-54zM1060 88v197q0 73 -9 99q-17 56 -71 56q-50 0 -93 -54v217h-89v-663h89v48q45 -55 93 -55q54 0 71 55q9 27 9 100zM1398 98v13h-91q0 -51 -2 -61q-7 -36 -40 -36q-46 0 -46 69v87h179v103q0 79 -27 116q-39 51 -106 51q-68 0 -107 -51
+q-28 -37 -28 -116v-173q0 -79 29 -116q39 -51 108 -51q72 0 108 53q18 27 21 54q2 9 2 58zM790 1011v210q0 69 -43 69t-43 -69v-210q0 -70 43 -70t43 70zM1509 260q0 -234 -26 -350q-14 -59 -58 -99t-102 -46q-184 -21 -555 -21t-555 21q-58 6 -102.5 46t-57.5 99
+q-26 112 -26 350q0 234 26 350q14 59 58 99t103 47q183 20 554 20t555 -20q58 -7 102.5 -47t57.5 -99q26 -112 26 -350zM511 1536h102l-121 -399v-271h-100v271q-14 74 -61 212q-37 103 -65 187h106l71 -263zM881 1203v-175q0 -81 -28 -118q-38 -51 -106 -51q-67 0 -105 51
+q-28 38 -28 118v175q0 80 28 117q38 51 105 51q68 0 106 -51q28 -37 28 -117zM1216 1365v-499h-91v55q-53 -62 -103 -62q-46 0 -59 37q-8 24 -8 75v394h91v-367q0 -33 1 -35q3 -22 21 -22q27 0 57 43v381h91z" />
+    <glyph glyph-name="xing" unicode="&#xf168;" horiz-adv-x="1408" 
+d="M597 869q-10 -18 -257 -456q-27 -46 -65 -46h-239q-21 0 -31 17t0 36l253 448q1 0 0 1l-161 279q-12 22 -1 37q9 15 32 15h239q40 0 66 -45zM1403 1511q11 -16 0 -37l-528 -934v-1l336 -615q11 -20 1 -37q-10 -15 -32 -15h-239q-42 0 -66 45l-339 622q18 32 531 942
+q25 45 64 45h241q22 0 31 -15z" />
+    <glyph glyph-name="xing_sign" unicode="&#xf169;" 
+d="M685 771q0 1 -126 222q-21 34 -52 34h-184q-18 0 -26 -11q-7 -12 1 -29l125 -216v-1l-196 -346q-9 -14 0 -28q8 -13 24 -13h185q31 0 50 36zM1309 1268q-7 12 -24 12h-187q-30 0 -49 -35l-411 -729q1 -2 262 -481q20 -35 52 -35h184q18 0 25 12q8 13 -1 28l-260 476v1
+l409 723q8 16 0 28zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="youtube_play" unicode="&#xf16a;" horiz-adv-x="1792" 
+d="M711 408l484 250l-484 253v-503zM896 1270q168 0 324.5 -4.5t229.5 -9.5l73 -4q1 0 17 -1.5t23 -3t23.5 -4.5t28.5 -8t28 -13t31 -19.5t29 -26.5q6 -6 15.5 -18.5t29 -58.5t26.5 -101q8 -64 12.5 -136.5t5.5 -113.5v-40v-136q1 -145 -18 -290q-7 -55 -25 -99.5t-32 -61.5
+l-14 -17q-14 -15 -29 -26.5t-31 -19t-28 -12.5t-28.5 -8t-24 -4.5t-23 -3t-16.5 -1.5q-251 -19 -627 -19q-207 2 -359.5 6.5t-200.5 7.5l-49 4l-36 4q-36 5 -54.5 10t-51 21t-56.5 41q-6 6 -15.5 18.5t-29 58.5t-26.5 101q-8 64 -12.5 136.5t-5.5 113.5v40v136
+q-1 145 18 290q7 55 25 99.5t32 61.5l14 17q14 15 29 26.5t31 19.5t28 13t28.5 8t23.5 4.5t23 3t17 1.5q251 18 627 18z" />
+    <glyph glyph-name="dropbox" unicode="&#xf16b;" horiz-adv-x="1792" 
+d="M402 829l494 -305l-342 -285l-490 319zM1388 274v-108l-490 -293v-1l-1 1l-1 -1v1l-489 293v108l147 -96l342 284v2l1 -1l1 1v-2l343 -284zM554 1418l342 -285l-494 -304l-338 270zM1390 829l338 -271l-489 -319l-343 285zM1239 1418l489 -319l-338 -270l-494 304z" />
+    <glyph glyph-name="stackexchange" unicode="&#xf16c;" 
+d="M1289 -96h-1118v480h-160v-640h1438v640h-160v-480zM347 428l33 157l783 -165l-33 -156zM450 802l67 146l725 -339l-67 -145zM651 1158l102 123l614 -513l-102 -123zM1048 1536l477 -641l-128 -96l-477 641zM330 65v159h800v-159h-800z" />
+    <glyph glyph-name="instagram" unicode="&#xf16d;" 
+d="M1024 640q0 106 -75 181t-181 75t-181 -75t-75 -181t75 -181t181 -75t181 75t75 181zM1162 640q0 -164 -115 -279t-279 -115t-279 115t-115 279t115 279t279 115t279 -115t115 -279zM1270 1050q0 -38 -27 -65t-65 -27t-65 27t-27 65t27 65t65 27t65 -27t27 -65zM768 1270
+q-7 0 -76.5 0.5t-105.5 0t-96.5 -3t-103 -10t-71.5 -18.5q-50 -20 -88 -58t-58 -88q-11 -29 -18.5 -71.5t-10 -103t-3 -96.5t0 -105.5t0.5 -76.5t-0.5 -76.5t0 -105.5t3 -96.5t10 -103t18.5 -71.5q20 -50 58 -88t88 -58q29 -11 71.5 -18.5t103 -10t96.5 -3t105.5 0t76.5 0.5
+t76.5 -0.5t105.5 0t96.5 3t103 10t71.5 18.5q50 20 88 58t58 88q11 29 18.5 71.5t10 103t3 96.5t0 105.5t-0.5 76.5t0.5 76.5t0 105.5t-3 96.5t-10 103t-18.5 71.5q-20 50 -58 88t-88 58q-29 11 -71.5 18.5t-103 10t-96.5 3t-105.5 0t-76.5 -0.5zM1536 640q0 -229 -5 -317
+q-10 -208 -124 -322t-322 -124q-88 -5 -317 -5t-317 5q-208 10 -322 124t-124 322q-5 88 -5 317t5 317q10 208 124 322t322 124q88 5 317 5t317 -5q208 -10 322 -124t124 -322q5 -88 5 -317z" />
+    <glyph glyph-name="flickr" unicode="&#xf16e;" 
+d="M1248 1408q119 0 203.5 -84.5t84.5 -203.5v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960zM698 640q0 88 -62 150t-150 62t-150 -62t-62 -150t62 -150t150 -62t150 62t62 150zM1262 640q0 88 -62 150
+t-150 62t-150 -62t-62 -150t62 -150t150 -62t150 62t62 150z" />
+    <glyph glyph-name="adn" unicode="&#xf170;" 
+d="M768 914l201 -306h-402zM1133 384h94l-459 691l-459 -691h94l104 160h522zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="f171" unicode="&#xf171;" horiz-adv-x="1408" 
+d="M815 677q8 -63 -50.5 -101t-111.5 -6q-39 17 -53.5 58t-0.5 82t52 58q36 18 72.5 12t64 -35.5t27.5 -67.5zM926 698q-14 107 -113 164t-197 13q-63 -28 -100.5 -88.5t-34.5 -129.5q4 -91 77.5 -155t165.5 -56q91 8 152 84t50 168zM1165 1240q-20 27 -56 44.5t-58 22
+t-71 12.5q-291 47 -566 -2q-43 -7 -66 -12t-55 -22t-50 -43q30 -28 76 -45.5t73.5 -22t87.5 -11.5q228 -29 448 -1q63 8 89.5 12t72.5 21.5t75 46.5zM1222 205q-8 -26 -15.5 -76.5t-14 -84t-28.5 -70t-58 -56.5q-86 -48 -189.5 -71.5t-202 -22t-201.5 18.5q-46 8 -81.5 18
+t-76.5 27t-73 43.5t-52 61.5q-25 96 -57 292l6 16l18 9q223 -148 506.5 -148t507.5 148q21 -6 24 -23t-5 -45t-8 -37zM1403 1166q-26 -167 -111 -655q-5 -30 -27 -56t-43.5 -40t-54.5 -31q-252 -126 -610 -88q-248 27 -394 139q-15 12 -25.5 26.5t-17 35t-9 34t-6 39.5
+t-5.5 35q-9 50 -26.5 150t-28 161.5t-23.5 147.5t-22 158q3 26 17.5 48.5t31.5 37.5t45 30t46 22.5t48 18.5q125 46 313 64q379 37 676 -50q155 -46 215 -122q16 -20 16.5 -51t-5.5 -54z" />
+    <glyph glyph-name="bitbucket_sign" unicode="&#xf172;" 
+d="M848 666q0 43 -41 66t-77 1q-43 -20 -42.5 -72.5t43.5 -70.5q39 -23 81 4t36 72zM928 682q8 -66 -36 -121t-110 -61t-119 40t-56 113q-2 49 25.5 93t72.5 64q70 31 141.5 -10t81.5 -118zM1100 1073q-20 -21 -53.5 -34t-53 -16t-63.5 -8q-155 -20 -324 0q-44 6 -63 9.5
+t-52.5 16t-54.5 32.5q13 19 36 31t40 15.5t47 8.5q198 35 408 1q33 -5 51 -8.5t43 -16t39 -31.5zM1142 327q0 7 5.5 26.5t3 32t-17.5 16.5q-161 -106 -365 -106t-366 106l-12 -6l-5 -12q26 -154 41 -210q47 -81 204 -108q249 -46 428 53q34 19 49 51.5t22.5 85.5t12.5 71z
+M1272 1020q9 53 -8 75q-43 55 -155 88q-216 63 -487 36q-132 -12 -226 -46q-38 -15 -59.5 -25t-47 -34t-29.5 -54q8 -68 19 -138t29 -171t24 -137q1 -5 5 -31t7 -36t12 -27t22 -28q105 -80 284 -100q259 -28 440 63q24 13 39.5 23t31 29t19.5 40q48 267 80 473zM1536 1120
+v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="tumblr" unicode="&#xf173;" horiz-adv-x="1024" 
+d="M944 207l80 -237q-23 -35 -111 -66t-177 -32q-104 -2 -190.5 26t-142.5 74t-95 106t-55.5 120t-16.5 118v544h-168v215q72 26 129 69.5t91 90t58 102t34 99t15 88.5q1 5 4.5 8.5t7.5 3.5h244v-424h333v-252h-334v-518q0 -30 6.5 -56t22.5 -52.5t49.5 -41.5t81.5 -14
+q78 2 134 29z" />
+    <glyph glyph-name="tumblr_sign" unicode="&#xf174;" 
+d="M1136 75l-62 183q-44 -22 -103 -22q-36 -1 -62 10.5t-38.5 31.5t-17.5 40.5t-5 43.5v398h257v194h-256v326h-188q-8 0 -9 -10q-5 -44 -17.5 -87t-39 -95t-77 -95t-118.5 -68v-165h130v-418q0 -57 21.5 -115t65 -111t121 -85.5t176.5 -30.5q69 1 136.5 25t85.5 50z
+M1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="long_arrow_down" unicode="&#xf175;" horiz-adv-x="768" 
+d="M765 237q8 -19 -5 -35l-350 -384q-10 -10 -23 -10q-14 0 -24 10l-355 384q-13 16 -5 35q9 19 29 19h224v1248q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1248h224q21 0 29 -19z" />
+    <glyph glyph-name="long_arrow_up" unicode="&#xf176;" horiz-adv-x="768" 
+d="M765 1043q-9 -19 -29 -19h-224v-1248q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v1248h-224q-21 0 -29 19t5 35l350 384q10 10 23 10q14 0 24 -10l355 -384q13 -16 5 -35z" />
+    <glyph glyph-name="long_arrow_left" unicode="&#xf177;" horiz-adv-x="1792" 
+d="M1792 736v-192q0 -14 -9 -23t-23 -9h-1248v-224q0 -21 -19 -29t-35 5l-384 350q-10 10 -10 23q0 14 10 24l384 354q16 14 35 6q19 -9 19 -29v-224h1248q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="long_arrow_right" unicode="&#xf178;" horiz-adv-x="1792" 
+d="M1728 643q0 -14 -10 -24l-384 -354q-16 -14 -35 -6q-19 9 -19 29v224h-1248q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h1248v224q0 21 19 29t35 -5l384 -350q10 -10 10 -23z" />
+    <glyph glyph-name="apple" unicode="&#xf179;" horiz-adv-x="1408" 
+d="M1393 321q-39 -125 -123 -250q-129 -196 -257 -196q-49 0 -140 32q-86 32 -151 32q-61 0 -142 -33q-81 -34 -132 -34q-152 0 -301 259q-147 261 -147 503q0 228 113 374q113 144 284 144q72 0 177 -30q104 -30 138 -30q45 0 143 34q102 34 173 34q119 0 213 -65
+q52 -36 104 -100q-79 -67 -114 -118q-65 -94 -65 -207q0 -124 69 -223t158 -126zM1017 1494q0 -61 -29 -136q-30 -75 -93 -138q-54 -54 -108 -72q-37 -11 -104 -17q3 149 78 257q74 107 250 148q1 -3 2.5 -11t2.5 -11q0 -4 0.5 -10t0.5 -10z" />
+    <glyph glyph-name="windows" unicode="&#xf17a;" horiz-adv-x="1664" 
+d="M682 530v-651l-682 94v557h682zM682 1273v-659h-682v565zM1664 530v-786l-907 125v661h907zM1664 1408v-794h-907v669z" />
+    <glyph glyph-name="android" unicode="&#xf17b;" horiz-adv-x="1408" 
+d="M493 1053q16 0 27.5 11.5t11.5 27.5t-11.5 27.5t-27.5 11.5t-27 -11.5t-11 -27.5t11 -27.5t27 -11.5zM915 1053q16 0 27 11.5t11 27.5t-11 27.5t-27 11.5t-27.5 -11.5t-11.5 -27.5t11.5 -27.5t27.5 -11.5zM103 869q42 0 72 -30t30 -72v-430q0 -43 -29.5 -73t-72.5 -30
+t-73 30t-30 73v430q0 42 30 72t73 30zM1163 850v-666q0 -46 -32 -78t-77 -32h-75v-227q0 -43 -30 -73t-73 -30t-73 30t-30 73v227h-138v-227q0 -43 -30 -73t-73 -30q-42 0 -72 30t-30 73l-1 227h-74q-46 0 -78 32t-32 78v666h918zM931 1255q107 -55 171 -153.5t64 -215.5
+h-925q0 117 64 215.5t172 153.5l-71 131q-7 13 5 20q13 6 20 -6l72 -132q95 42 201 42t201 -42l72 132q7 12 20 6q12 -7 5 -20zM1408 767v-430q0 -43 -30 -73t-73 -30q-42 0 -72 30t-30 73v430q0 43 30 72.5t72 29.5q43 0 73 -29.5t30 -72.5z" />
+    <glyph glyph-name="linux" unicode="&#xf17c;" 
+d="M663 1125q-11 -1 -15.5 -10.5t-8.5 -9.5q-5 -1 -5 5q0 12 19 15h10zM750 1111q-4 -1 -11.5 6.5t-17.5 4.5q24 11 32 -2q3 -6 -3 -9zM399 684q-4 1 -6 -3t-4.5 -12.5t-5.5 -13.5t-10 -13q-10 -11 -1 -12q4 -1 12.5 7t12.5 18q1 3 2 7t2 6t1.5 4.5t0.5 4v3t-1 2.5t-3 2z
+M1254 325q0 18 -55 42q4 15 7.5 27.5t5 26t3 21.5t0.5 22.5t-1 19.5t-3.5 22t-4 20.5t-5 25t-5.5 26.5q-10 48 -47 103t-72 75q24 -20 57 -83q87 -162 54 -278q-11 -40 -50 -42q-31 -4 -38.5 18.5t-8 83.5t-11.5 107q-9 39 -19.5 69t-19.5 45.5t-15.5 24.5t-13 15t-7.5 7
+q-14 62 -31 103t-29.5 56t-23.5 33t-15 40q-4 21 6 53.5t4.5 49.5t-44.5 25q-15 3 -44.5 18t-35.5 16q-8 1 -11 26t8 51t36 27q37 3 51 -30t4 -58q-11 -19 -2 -26.5t30 -0.5q13 4 13 36v37q-5 30 -13.5 50t-21 30.5t-23.5 15t-27 7.5q-107 -8 -89 -134q0 -15 -1 -15
+q-9 9 -29.5 10.5t-33 -0.5t-15.5 5q1 57 -16 90t-45 34q-27 1 -41.5 -27.5t-16.5 -59.5q-1 -15 3.5 -37t13 -37.5t15.5 -13.5q10 3 16 14q4 9 -7 8q-7 0 -15.5 14.5t-9.5 33.5q-1 22 9 37t34 14q17 0 27 -21t9.5 -39t-1.5 -22q-22 -15 -31 -29q-8 -12 -27.5 -23.5
+t-20.5 -12.5q-13 -14 -15.5 -27t7.5 -18q14 -8 25 -19.5t16 -19t18.5 -13t35.5 -6.5q47 -2 102 15q2 1 23 7t34.5 10.5t29.5 13t21 17.5q9 14 20 8q5 -3 6.5 -8.5t-3 -12t-16.5 -9.5q-20 -6 -56.5 -21.5t-45.5 -19.5q-44 -19 -70 -23q-25 -5 -79 2q-10 2 -9 -2t17 -19
+q25 -23 67 -22q17 1 36 7t36 14t33.5 17.5t30 17t24.5 12t17.5 2.5t8.5 -11q0 -2 -1 -4.5t-4 -5t-6 -4.5t-8.5 -5t-9 -4.5t-10 -5t-9.5 -4.5q-28 -14 -67.5 -44t-66.5 -43t-49 -1q-21 11 -63 73q-22 31 -25 22q-1 -3 -1 -10q0 -25 -15 -56.5t-29.5 -55.5t-21 -58t11.5 -63
+q-23 -6 -62.5 -90t-47.5 -141q-2 -18 -1.5 -69t-5.5 -59q-8 -24 -29 -3q-32 31 -36 94q-2 28 4 56q4 19 -1 18q-2 -1 -4 -5q-36 -65 10 -166q5 -12 25 -28t24 -20q20 -23 104 -90.5t93 -76.5q16 -15 17.5 -38t-14 -43t-45.5 -23q8 -15 29 -44.5t28 -54t7 -70.5q46 24 7 92
+q-4 8 -10.5 16t-9.5 12t-2 6q3 5 13 9.5t20 -2.5q46 -52 166 -36q133 15 177 87q23 38 34 30q12 -6 10 -52q-1 -25 -23 -92q-9 -23 -6 -37.5t24 -15.5q3 19 14.5 77t13.5 90q2 21 -6.5 73.5t-7.5 97t23 70.5q15 18 51 18q1 37 34.5 53t72.5 10.5t60 -22.5zM626 1152
+q3 17 -2.5 30t-11.5 15q-9 2 -9 -7q2 -5 5 -6q10 0 7 -15q-3 -20 8 -20q3 0 3 3zM1045 955q-2 8 -6.5 11.5t-13 5t-14.5 5.5q-5 3 -9.5 8t-7 8t-5.5 6.5t-4 4t-4 -1.5q-14 -16 7 -43.5t39 -31.5q9 -1 14.5 8t3.5 20zM867 1168q0 11 -5 19.5t-11 12.5t-9 3q-6 0 -8 -2t0 -4
+t5 -3q14 -4 18 -31q0 -3 8 2q2 2 2 3zM921 1401q0 2 -2.5 5t-9 7t-9.5 6q-15 15 -24 15q-9 -1 -11.5 -7.5t-1 -13t-0.5 -12.5q-1 -4 -6 -10.5t-6 -9t3 -8.5q4 -3 8 0t11 9t15 9q1 1 9 1t15 2t9 7zM1486 60q20 -12 31 -24.5t12 -24t-2.5 -22.5t-15.5 -22t-23.5 -19.5
+t-30 -18.5t-31.5 -16.5t-32 -15.5t-27 -13q-38 -19 -85.5 -56t-75.5 -64q-17 -16 -68 -19.5t-89 14.5q-18 9 -29.5 23.5t-16.5 25.5t-22 19.5t-47 9.5q-44 1 -130 1q-19 0 -57 -1.5t-58 -2.5q-44 -1 -79.5 -15t-53.5 -30t-43.5 -28.5t-53.5 -11.5q-29 1 -111 31t-146 43
+q-19 4 -51 9.5t-50 9t-39.5 9.5t-33.5 14.5t-17 19.5q-10 23 7 66.5t18 54.5q1 16 -4 40t-10 42.5t-4.5 36.5t10.5 27q14 12 57 14t60 12q30 18 42 35t12 51q21 -73 -32 -106q-32 -20 -83 -15q-34 3 -43 -10q-13 -15 5 -57q2 -6 8 -18t8.5 -18t4.5 -17t1 -22q0 -15 -17 -49
+t-14 -48q3 -17 37 -26q20 -6 84.5 -18.5t99.5 -20.5q24 -6 74 -22t82.5 -23t55.5 -4q43 6 64.5 28t23 48t-7.5 58.5t-19 52t-20 36.5q-121 190 -169 242q-68 74 -113 40q-11 -9 -15 15q-3 16 -2 38q1 29 10 52t24 47t22 42q8 21 26.5 72t29.5 78t30 61t39 54
+q110 143 124 195q-12 112 -16 310q-2 90 24 151.5t106 104.5q39 21 104 21q53 1 106 -13.5t89 -41.5q57 -42 91.5 -121.5t29.5 -147.5q-5 -95 30 -214q34 -113 133 -218q55 -59 99.5 -163t59.5 -191q8 -49 5 -84.5t-12 -55.5t-20 -22q-10 -2 -23.5 -19t-27 -35.5
+t-40.5 -33.5t-61 -14q-18 1 -31.5 5t-22.5 13.5t-13.5 15.5t-11.5 20.5t-9 19.5q-22 37 -41 30t-28 -49t7 -97q20 -70 1 -195q-10 -65 18 -100.5t73 -33t85 35.5q59 49 89.5 66.5t103.5 42.5q53 18 77 36.5t18.5 34.5t-25 28.5t-51.5 23.5q-33 11 -49.5 48t-15 72.5
+t15.5 47.5q1 -31 8 -56.5t14.5 -40.5t20.5 -28.5t21 -19t21.5 -13t16.5 -9.5z" />
+    <glyph glyph-name="dribble" unicode="&#xf17d;" 
+d="M1024 36q-42 241 -140 498h-2l-2 -1q-16 -6 -43 -16.5t-101 -49t-137 -82t-131 -114.5t-103 -148l-15 11q184 -150 418 -150q132 0 256 52zM839 643q-21 49 -53 111q-311 -93 -673 -93q-1 -7 -1 -21q0 -124 44 -236.5t124 -201.5q50 89 123.5 166.5t142.5 124.5t130.5 81
+t99.5 48l37 13q4 1 13 3.5t13 4.5zM732 855q-120 213 -244 378q-138 -65 -234 -186t-128 -272q302 0 606 80zM1416 536q-210 60 -409 29q87 -239 128 -469q111 75 185 189.5t96 250.5zM611 1277q-1 0 -2 -1q1 1 2 1zM1201 1132q-185 164 -433 164q-76 0 -155 -19
+q131 -170 246 -382q69 26 130 60.5t96.5 61.5t65.5 57t37.5 40.5zM1424 647q-3 232 -149 410l-1 -1q-9 -12 -19 -24.5t-43.5 -44.5t-71 -60.5t-100 -65t-131.5 -64.5q25 -53 44 -95q2 -5 6.5 -17t7.5 -17q36 5 74.5 7t73.5 2t69 -1.5t64 -4t56.5 -5.5t48 -6.5t36.5 -6
+t25 -4.5zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="skype" unicode="&#xf17e;" 
+d="M1173 473q0 50 -19.5 91.5t-48.5 68.5t-73 49t-82.5 34t-87.5 23l-104 24q-30 7 -44 10.5t-35 11.5t-30 16t-16.5 21t-7.5 30q0 77 144 77q43 0 77 -12t54 -28.5t38 -33.5t40 -29t48 -12q47 0 75.5 32t28.5 77q0 55 -56 99.5t-142 67.5t-182 23q-68 0 -132 -15.5
+t-119.5 -47t-89 -87t-33.5 -128.5q0 -61 19 -106.5t56 -75.5t80 -48.5t103 -32.5l146 -36q90 -22 112 -36q32 -20 32 -60q0 -39 -40 -64.5t-105 -25.5q-51 0 -91.5 16t-65 38.5t-45.5 45t-46 38.5t-54 16q-50 0 -75.5 -30t-25.5 -75q0 -92 122 -157.5t291 -65.5
+q73 0 140 18.5t122.5 53.5t88.5 93.5t33 131.5zM1536 256q0 -159 -112.5 -271.5t-271.5 -112.5q-130 0 -234 80q-77 -16 -150 -16q-143 0 -273.5 55.5t-225 150t-150 225t-55.5 273.5q0 73 16 150q-80 104 -80 234q0 159 112.5 271.5t271.5 112.5q130 0 234 -80
+q77 16 150 16q143 0 273.5 -55.5t225 -150t150 -225t55.5 -273.5q0 -73 -16 -150q80 -104 80 -234z" />
+    <glyph glyph-name="foursquare" unicode="&#xf180;" horiz-adv-x="1280" 
+d="M1000 1102l37 194q5 23 -9 40t-35 17h-712q-23 0 -38.5 -17t-15.5 -37v-1101q0 -7 6 -1l291 352q23 26 38 33.5t48 7.5h239q22 0 37 14.5t18 29.5q24 130 37 191q4 21 -11.5 40t-36.5 19h-294q-29 0 -48 19t-19 48v42q0 29 19 47.5t48 18.5h346q18 0 35 13.5t20 29.5z
+M1227 1324q-15 -73 -53.5 -266.5t-69.5 -350t-35 -173.5q-6 -22 -9 -32.5t-14 -32.5t-24.5 -33t-38.5 -21t-58 -10h-271q-13 0 -22 -10q-8 -9 -426 -494q-22 -25 -58.5 -28.5t-48.5 5.5q-55 22 -55 98v1410q0 55 38 102.5t120 47.5h888q95 0 127 -53t10 -159zM1227 1324
+l-158 -790q4 17 35 173.5t69.5 350t53.5 266.5z" />
+    <glyph glyph-name="trello" unicode="&#xf181;" 
+d="M704 192v1024q0 14 -9 23t-23 9h-480q-14 0 -23 -9t-9 -23v-1024q0 -14 9 -23t23 -9h480q14 0 23 9t9 23zM1376 576v640q0 14 -9 23t-23 9h-480q-14 0 -23 -9t-9 -23v-640q0 -14 9 -23t23 -9h480q14 0 23 9t9 23zM1536 1344v-1408q0 -26 -19 -45t-45 -19h-1408
+q-26 0 -45 19t-19 45v1408q0 26 19 45t45 19h1408q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="female" unicode="&#xf182;" horiz-adv-x="1280" 
+d="M1280 480q0 -40 -28 -68t-68 -28q-51 0 -80 43l-227 341h-45v-132l247 -411q9 -15 9 -33q0 -26 -19 -45t-45 -19h-192v-272q0 -46 -33 -79t-79 -33h-160q-46 0 -79 33t-33 79v272h-192q-26 0 -45 19t-19 45q0 18 9 33l247 411v132h-45l-227 -341q-29 -43 -80 -43
+q-40 0 -68 28t-28 68q0 29 16 53l256 384q73 107 176 107h384q103 0 176 -107l256 -384q16 -24 16 -53zM864 1280q0 -93 -65.5 -158.5t-158.5 -65.5t-158.5 65.5t-65.5 158.5t65.5 158.5t158.5 65.5t158.5 -65.5t65.5 -158.5z" />
+    <glyph glyph-name="male" unicode="&#xf183;" horiz-adv-x="1024" 
+d="M1024 832v-416q0 -40 -28 -68t-68 -28t-68 28t-28 68v352h-64v-912q0 -46 -33 -79t-79 -33t-79 33t-33 79v464h-64v-464q0 -46 -33 -79t-79 -33t-79 33t-33 79v912h-64v-352q0 -40 -28 -68t-68 -28t-68 28t-28 68v416q0 80 56 136t136 56h640q80 0 136 -56t56 -136z
+M736 1280q0 -93 -65.5 -158.5t-158.5 -65.5t-158.5 65.5t-65.5 158.5t65.5 158.5t158.5 65.5t158.5 -65.5t65.5 -158.5z" />
+    <glyph glyph-name="gittip" unicode="&#xf184;" 
+d="M773 234l350 473q16 22 24.5 59t-6 85t-61.5 79q-40 26 -83 25.5t-73.5 -17.5t-54.5 -45q-36 -40 -96 -40q-59 0 -95 40q-24 28 -54.5 45t-73.5 17.5t-84 -25.5q-46 -31 -60.5 -79t-6 -85t24.5 -59zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103
+t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="sun" unicode="&#xf185;" horiz-adv-x="1792" 
+d="M1472 640q0 117 -45.5 223.5t-123 184t-184 123t-223.5 45.5t-223.5 -45.5t-184 -123t-123 -184t-45.5 -223.5t45.5 -223.5t123 -184t184 -123t223.5 -45.5t223.5 45.5t184 123t123 184t45.5 223.5zM1748 363q-4 -15 -20 -20l-292 -96v-306q0 -16 -13 -26q-15 -10 -29 -4
+l-292 94l-180 -248q-10 -13 -26 -13t-26 13l-180 248l-292 -94q-14 -6 -29 4q-13 10 -13 26v306l-292 96q-16 5 -20 20q-5 17 4 29l180 248l-180 248q-9 13 -4 29q4 15 20 20l292 96v306q0 16 13 26q15 10 29 4l292 -94l180 248q9 12 26 12t26 -12l180 -248l292 94
+q14 6 29 -4q13 -10 13 -26v-306l292 -96q16 -5 20 -20q5 -16 -4 -29l-180 -248l180 -248q9 -12 4 -29z" />
+    <glyph glyph-name="_366" unicode="&#xf186;" 
+d="M1262 233q-54 -9 -110 -9q-182 0 -337 90t-245 245t-90 337q0 192 104 357q-201 -60 -328.5 -229t-127.5 -384q0 -130 51 -248.5t136.5 -204t204 -136.5t248.5 -51q144 0 273.5 61.5t220.5 171.5zM1465 318q-94 -203 -283.5 -324.5t-413.5 -121.5q-156 0 -298 61
+t-245 164t-164 245t-61 298q0 153 57.5 292.5t156 241.5t235.5 164.5t290 68.5q44 2 61 -39q18 -41 -15 -72q-86 -78 -131.5 -181.5t-45.5 -218.5q0 -148 73 -273t198 -198t273 -73q118 0 228 51q41 18 72 -13q14 -14 17.5 -34t-4.5 -38z" />
+    <glyph glyph-name="archive" unicode="&#xf187;" horiz-adv-x="1792" 
+d="M1088 704q0 26 -19 45t-45 19h-256q-26 0 -45 -19t-19 -45t19 -45t45 -19h256q26 0 45 19t19 45zM1664 896v-960q0 -26 -19 -45t-45 -19h-1408q-26 0 -45 19t-19 45v960q0 26 19 45t45 19h1408q26 0 45 -19t19 -45zM1728 1344v-256q0 -26 -19 -45t-45 -19h-1536
+q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h1536q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="bug" unicode="&#xf188;" horiz-adv-x="1664" 
+d="M1632 576q0 -26 -19 -45t-45 -19h-224q0 -171 -67 -290l208 -209q19 -19 19 -45t-19 -45q-18 -19 -45 -19t-45 19l-198 197q-5 -5 -15 -13t-42 -28.5t-65 -36.5t-82 -29t-97 -13v896h-128v-896q-51 0 -101.5 13.5t-87 33t-66 39t-43.5 32.5l-15 14l-183 -207
+q-20 -21 -48 -21q-24 0 -43 16q-19 18 -20.5 44.5t15.5 46.5l202 227q-58 114 -58 274h-224q-26 0 -45 19t-19 45t19 45t45 19h224v294l-173 173q-19 19 -19 45t19 45t45 19t45 -19l173 -173h844l173 173q19 19 45 19t45 -19t19 -45t-19 -45l-173 -173v-294h224q26 0 45 -19
+t19 -45zM1152 1152h-640q0 133 93.5 226.5t226.5 93.5t226.5 -93.5t93.5 -226.5z" />
+    <glyph glyph-name="vk" unicode="&#xf189;" horiz-adv-x="1920" 
+d="M1917 1016q23 -64 -150 -294q-24 -32 -65 -85q-40 -51 -55 -72t-30.5 -49.5t-12 -42t13 -34.5t32.5 -43t57 -53q4 -2 5 -4q141 -131 191 -221q3 -5 6.5 -12.5t7 -26.5t-0.5 -34t-25 -27.5t-59 -12.5l-256 -4q-24 -5 -56 5t-52 22l-20 12q-30 21 -70 64t-68.5 77.5t-61 58
+t-56.5 15.5q-3 -1 -8 -3.5t-17 -14.5t-21.5 -29.5t-17 -52t-6.5 -77.5q0 -15 -3.5 -27.5t-7.5 -18.5l-4 -5q-18 -19 -53 -22h-115q-71 -4 -146 16.5t-131.5 53t-103 66t-70.5 57.5l-25 24q-10 10 -27.5 30t-71.5 91t-106 151t-122.5 211t-130.5 272q-6 16 -6 27t3 16l4 6
+q15 19 57 19l274 2q12 -2 23 -6.5t16 -8.5l5 -3q16 -11 24 -32q20 -50 46 -103.5t41 -81.5l16 -29q29 -60 56 -104t48.5 -68.5t41.5 -38.5t34 -14t27 5q2 1 5 5t12 22t13.5 47t9.5 81t0 125q-2 40 -9 73t-14 46l-6 12q-25 34 -85 43q-13 2 5 24q16 19 38 30q53 26 239 24
+q82 -1 135 -13q20 -5 33.5 -13.5t20.5 -24t10.5 -32t3.5 -45.5t-1 -55t-2.5 -70.5t-1.5 -82.5q0 -11 -1 -42t-0.5 -48t3.5 -40.5t11.5 -39t22.5 -24.5q8 -2 17 -4t26 11t38 34.5t52 67t68 107.5q60 104 107 225q4 10 10 17.5t11 10.5l4 3l5 2.5t13 3t20 0.5l288 2
+q39 5 64 -2.5t31 -16.5z" />
+    <glyph glyph-name="weibo" unicode="&#xf18a;" horiz-adv-x="1792" 
+d="M675 252q21 34 11 69t-45 50q-34 14 -73 1t-60 -46q-22 -34 -13 -68.5t43 -50.5t74.5 -2.5t62.5 47.5zM769 373q8 13 3.5 26.5t-17.5 18.5q-14 5 -28.5 -0.5t-21.5 -18.5q-17 -31 13 -45q14 -5 29 0.5t22 18.5zM943 266q-45 -102 -158 -150t-224 -12
+q-107 34 -147.5 126.5t6.5 187.5q47 93 151.5 139t210.5 19q111 -29 158.5 -119.5t2.5 -190.5zM1255 426q-9 96 -89 170t-208.5 109t-274.5 21q-223 -23 -369.5 -141.5t-132.5 -264.5q9 -96 89 -170t208.5 -109t274.5 -21q223 23 369.5 141.5t132.5 264.5zM1563 422
+q0 -68 -37 -139.5t-109 -137t-168.5 -117.5t-226 -83t-270.5 -31t-275 33.5t-240.5 93t-171.5 151t-65 199.5q0 115 69.5 245t197.5 258q169 169 341.5 236t246.5 -7q65 -64 20 -209q-4 -14 -1 -20t10 -7t14.5 0.5t13.5 3.5l6 2q139 59 246 59t153 -61q45 -63 0 -178
+q-2 -13 -4.5 -20t4.5 -12.5t12 -7.5t17 -6q57 -18 103 -47t80 -81.5t34 -116.5zM1489 1046q42 -47 54.5 -108.5t-6.5 -117.5q-8 -23 -29.5 -34t-44.5 -4q-23 8 -34 29.5t-4 44.5q20 63 -24 111t-107 35q-24 -5 -45 8t-25 37q-5 24 8 44.5t37 25.5q60 13 119 -5.5t101 -65.5z
+M1670 1209q87 -96 112.5 -222.5t-13.5 -241.5q-9 -27 -34 -40t-52 -4t-40 34t-5 52q28 82 10 172t-80 158q-62 69 -148 95.5t-173 8.5q-28 -6 -52 9.5t-30 43.5t9.5 51.5t43.5 29.5q123 26 244 -11.5t208 -134.5z" />
+    <glyph glyph-name="renren" unicode="&#xf18b;" 
+d="M1133 -34q-171 -94 -368 -94q-196 0 -367 94q138 87 235.5 211t131.5 268q35 -144 132.5 -268t235.5 -211zM638 1394v-485q0 -252 -126.5 -459.5t-330.5 -306.5q-181 215 -181 495q0 187 83.5 349.5t229.5 269.5t325 137zM1536 638q0 -280 -181 -495
+q-204 99 -330.5 306.5t-126.5 459.5v485q179 -30 325 -137t229.5 -269.5t83.5 -349.5z" />
+    <glyph glyph-name="_372" unicode="&#xf18c;" horiz-adv-x="1408" 
+d="M1402 433q-32 -80 -76 -138t-91 -88.5t-99 -46.5t-101.5 -14.5t-96.5 8.5t-86.5 22t-69.5 27.5t-46 22.5l-17 10q-113 -228 -289.5 -359.5t-384.5 -132.5q-19 0 -32 13t-13 32t13 31.5t32 12.5q173 1 322.5 107.5t251.5 294.5q-36 -14 -72 -23t-83 -13t-91 2.5t-93 28.5
+t-92 59t-84.5 100t-74.5 146q114 47 214 57t167.5 -7.5t124.5 -56.5t88.5 -77t56.5 -82q53 131 79 291q-7 -1 -18 -2.5t-46.5 -2.5t-69.5 0.5t-81.5 10t-88.5 23t-84 42.5t-75 65t-54.5 94.5t-28.5 127.5q70 28 133.5 36.5t112.5 -1t92 -30t73.5 -50t56 -61t42 -63t27.5 -56
+t16 -39.5l4 -16q12 122 12 195q-8 6 -21.5 16t-49 44.5t-63.5 71.5t-54 93t-33 112.5t12 127t70 138.5q73 -25 127.5 -61.5t84.5 -76.5t48 -85t20.5 -89t-0.5 -85.5t-13 -76.5t-19 -62t-17 -42l-7 -15q1 -4 1 -50t-1 -72q3 7 10 18.5t30.5 43t50.5 58t71 55.5t91.5 44.5
+t112 14.5t132.5 -24q-2 -78 -21.5 -141.5t-50 -104.5t-69.5 -71.5t-81.5 -45.5t-84.5 -24t-80 -9.5t-67.5 1t-46.5 4.5l-17 3q-23 -147 -73 -283q6 7 18 18.5t49.5 41t77.5 52.5t99.5 42t117.5 20t129 -23.5t137 -77.5z" />
+    <glyph glyph-name="stack_exchange" unicode="&#xf18d;" horiz-adv-x="1280" 
+d="M1259 283v-66q0 -85 -57.5 -144.5t-138.5 -59.5h-57l-260 -269v269h-529q-81 0 -138.5 59.5t-57.5 144.5v66h1238zM1259 609v-255h-1238v255h1238zM1259 937v-255h-1238v255h1238zM1259 1077v-67h-1238v67q0 84 57.5 143.5t138.5 59.5h846q81 0 138.5 -59.5t57.5 -143.5z
+" />
+    <glyph glyph-name="_374" unicode="&#xf18e;" 
+d="M1152 640q0 -14 -9 -23l-320 -320q-9 -9 -23 -9q-13 0 -22.5 9.5t-9.5 22.5v192h-352q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h352v192q0 14 9 23t23 9q12 0 24 -10l319 -319q9 -9 9 -23zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198
+t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="arrow_circle_alt_left" unicode="&#xf190;" 
+d="M1152 736v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-352v-192q0 -14 -9 -23t-23 -9q-12 0 -24 10l-319 319q-9 9 -9 23t9 23l320 320q9 9 23 9q13 0 22.5 -9.5t9.5 -22.5v-192h352q13 0 22.5 -9.5t9.5 -22.5zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198
+t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_376" unicode="&#xf191;" 
+d="M1024 960v-640q0 -26 -19 -45t-45 -19q-20 0 -37 12l-448 320q-27 19 -27 52t27 52l448 320q17 12 37 12q26 0 45 -19t19 -45zM1280 160v960q0 13 -9.5 22.5t-22.5 9.5h-960q-13 0 -22.5 -9.5t-9.5 -22.5v-960q0 -13 9.5 -22.5t22.5 -9.5h960q13 0 22.5 9.5t9.5 22.5z
+M1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="dot_circle_alt" unicode="&#xf192;" 
+d="M1024 640q0 -106 -75 -181t-181 -75t-181 75t-75 181t75 181t181 75t181 -75t75 -181zM768 1184q-148 0 -273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273t-73 273t-198 198t-273 73zM1536 640q0 -209 -103 -385.5t-279.5 -279.5
+t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_378" unicode="&#xf193;" horiz-adv-x="1664" 
+d="M1023 349l102 -204q-58 -179 -210 -290t-339 -111q-156 0 -288.5 77.5t-210 210t-77.5 288.5q0 181 104.5 330t274.5 211l17 -131q-122 -54 -195 -165.5t-73 -244.5q0 -185 131.5 -316.5t316.5 -131.5q126 0 232.5 65t165 175.5t49.5 236.5zM1571 249l58 -114l-256 -128
+q-13 -7 -29 -7q-40 0 -57 35l-239 477h-472q-24 0 -42.5 16.5t-21.5 40.5l-96 779q-2 17 6 42q14 51 57 82.5t97 31.5q66 0 113 -47t47 -113q0 -69 -52 -117.5t-120 -41.5l37 -289h423v-128h-407l16 -128h455q40 0 57 -35l228 -455z" />
+    <glyph glyph-name="vimeo_square" unicode="&#xf194;" 
+d="M1292 898q10 216 -161 222q-231 8 -312 -261q44 19 82 19q85 0 74 -96q-4 -57 -74 -167t-105 -110q-43 0 -82 169q-13 54 -45 255q-30 189 -160 177q-59 -7 -164 -100l-81 -72l-81 -72l52 -67q76 52 87 52q57 0 107 -179q15 -55 45 -164.5t45 -164.5q68 -179 164 -179
+q157 0 383 294q220 283 226 444zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_380" unicode="&#xf195;" horiz-adv-x="1152" 
+d="M1152 704q0 -191 -94.5 -353t-256.5 -256.5t-353 -94.5h-160q-14 0 -23 9t-9 23v611l-215 -66q-3 -1 -9 -1q-10 0 -19 6q-13 10 -13 26v128q0 23 23 31l233 71v93l-215 -66q-3 -1 -9 -1q-10 0 -19 6q-13 10 -13 26v128q0 23 23 31l233 71v250q0 14 9 23t23 9h160
+q14 0 23 -9t9 -23v-181l375 116q15 5 28 -5t13 -26v-128q0 -23 -23 -31l-393 -121v-93l375 116q15 5 28 -5t13 -26v-128q0 -23 -23 -31l-393 -121v-487q188 13 318 151t130 328q0 14 9 23t23 9h160q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="plus_square_o" unicode="&#xf196;" horiz-adv-x="1408" 
+d="M1152 736v-64q0 -14 -9 -23t-23 -9h-352v-352q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v352h-352q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h352v352q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-352h352q14 0 23 -9t9 -23zM1280 288v832q0 66 -47 113t-113 47h-832
+q-66 0 -113 -47t-47 -113v-832q0 -66 47 -113t113 -47h832q66 0 113 47t47 113zM1408 1120v-832q0 -119 -84.5 -203.5t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h832q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_382" unicode="&#xf197;" horiz-adv-x="2176" 
+d="M620 416q-110 -64 -268 -64h-128v64h-64q-13 0 -22.5 23.5t-9.5 56.5q0 24 7 49q-58 2 -96.5 10.5t-38.5 20.5t38.5 20.5t96.5 10.5q-7 25 -7 49q0 33 9.5 56.5t22.5 23.5h64v64h128q158 0 268 -64h1113q42 -7 106.5 -18t80.5 -14q89 -15 150 -40.5t83.5 -47.5t22.5 -40
+t-22.5 -40t-83.5 -47.5t-150 -40.5q-16 -3 -80.5 -14t-106.5 -18h-1113zM1739 668q53 -36 53 -92t-53 -92l81 -30q68 48 68 122t-68 122zM625 400h1015q-217 -38 -456 -80q-57 0 -113 -24t-83 -48l-28 -24l-288 -288q-26 -26 -70.5 -45t-89.5 -19h-96l-93 464h29
+q157 0 273 64zM352 816h-29l93 464h96q46 0 90 -19t70 -45l288 -288q4 -4 11 -10.5t30.5 -23t48.5 -29t61.5 -23t72.5 -10.5l456 -80h-1015q-116 64 -273 64z" />
+    <glyph glyph-name="_383" unicode="&#xf198;" horiz-adv-x="1664" 
+d="M1519 760q62 0 103.5 -40.5t41.5 -101.5q0 -97 -93 -130l-172 -59l56 -167q7 -21 7 -47q0 -59 -42 -102t-101 -43q-47 0 -85.5 27t-53.5 72l-55 165l-310 -106l55 -164q8 -24 8 -47q0 -59 -42 -102t-102 -43q-47 0 -85 27t-53 72l-55 163l-153 -53q-29 -9 -50 -9
+q-61 0 -101.5 40t-40.5 101q0 47 27.5 85t71.5 53l156 53l-105 313l-156 -54q-26 -8 -48 -8q-60 0 -101 40.5t-41 100.5q0 47 27.5 85t71.5 53l157 53l-53 159q-8 24 -8 47q0 60 42 102.5t102 42.5q47 0 85 -27t53 -72l54 -160l310 105l-54 160q-8 24 -8 47q0 59 42.5 102
+t101.5 43q47 0 85.5 -27.5t53.5 -71.5l53 -161l162 55q21 6 43 6q60 0 102.5 -39.5t42.5 -98.5q0 -45 -30 -81.5t-74 -51.5l-157 -54l105 -316l164 56q24 8 46 8zM725 498l310 105l-105 315l-310 -107z" />
+    <glyph glyph-name="_384" unicode="&#xf199;" 
+d="M1248 1408q119 0 203.5 -84.5t84.5 -203.5v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960zM1280 352v436q-31 -35 -64 -55q-34 -22 -132.5 -85t-151.5 -99q-98 -69 -164 -69v0v0q-66 0 -164 69
+q-47 32 -142 92.5t-142 92.5q-12 8 -33 27t-31 27v-436q0 -40 28 -68t68 -28h832q40 0 68 28t28 68zM1280 925q0 41 -27.5 70t-68.5 29h-832q-40 0 -68 -28t-28 -68q0 -37 30.5 -76.5t67.5 -64.5q47 -32 137.5 -89t129.5 -83q3 -2 17 -11.5t21 -14t21 -13t23.5 -13
+t21.5 -9.5t22.5 -7.5t20.5 -2.5t20.5 2.5t22.5 7.5t21.5 9.5t23.5 13t21 13t21 14t17 11.5l267 174q35 23 66.5 62.5t31.5 73.5z" />
+    <glyph glyph-name="_385" unicode="&#xf19a;" horiz-adv-x="1792" 
+d="M127 640q0 163 67 313l367 -1005q-196 95 -315 281t-119 411zM1415 679q0 -19 -2.5 -38.5t-10 -49.5t-11.5 -44t-17.5 -59t-17.5 -58l-76 -256l-278 826q46 3 88 8q19 2 26 18.5t-2.5 31t-28.5 13.5l-205 -10q-75 1 -202 10q-12 1 -20.5 -5t-11.5 -15t-1.5 -18.5t9 -16.5
+t19.5 -8l80 -8l120 -328l-168 -504l-280 832q46 3 88 8q19 2 26 18.5t-2.5 31t-28.5 13.5l-205 -10q-7 0 -23 0.5t-26 0.5q105 160 274.5 253.5t367.5 93.5q147 0 280.5 -53t238.5 -149h-10q-55 0 -92 -40.5t-37 -95.5q0 -12 2 -24t4 -21.5t8 -23t9 -21t12 -22.5t12.5 -21
+t14.5 -24t14 -23q63 -107 63 -212zM909 573l237 -647q1 -6 5 -11q-126 -44 -255 -44q-112 0 -217 32zM1570 1009q95 -174 95 -369q0 -209 -104 -385.5t-279 -278.5l235 678q59 169 59 276q0 42 -6 79zM896 1536q182 0 348 -71t286 -191t191 -286t71 -348t-71 -348t-191 -286
+t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71zM896 -215q173 0 331.5 68t273 182.5t182.5 273t68 331.5t-68 331.5t-182.5 273t-273 182.5t-331.5 68t-331.5 -68t-273 -182.5t-182.5 -273t-68 -331.5t68 -331.5t182.5 -273
+t273 -182.5t331.5 -68z" />
+    <glyph glyph-name="_386" unicode="&#xf19b;" horiz-adv-x="1792" 
+d="M1086 1536v-1536l-272 -128q-228 20 -414 102t-293 208.5t-107 272.5q0 140 100.5 263.5t275 205.5t391.5 108v-172q-217 -38 -356.5 -150t-139.5 -255q0 -152 154.5 -267t388.5 -145v1360zM1755 954l37 -390l-525 114l147 83q-119 70 -280 99v172q277 -33 481 -157z" />
+    <glyph glyph-name="_387" unicode="&#xf19c;" horiz-adv-x="2048" 
+d="M960 1536l960 -384v-128h-128q0 -26 -20.5 -45t-48.5 -19h-1526q-28 0 -48.5 19t-20.5 45h-128v128zM256 896h256v-768h128v768h256v-768h128v768h256v-768h128v768h256v-768h59q28 0 48.5 -19t20.5 -45v-64h-1664v64q0 26 20.5 45t48.5 19h59v768zM1851 -64
+q28 0 48.5 -19t20.5 -45v-128h-1920v128q0 26 20.5 45t48.5 19h1782z" />
+    <glyph glyph-name="_388" unicode="&#xf19d;" horiz-adv-x="2304" 
+d="M1774 700l18 -316q4 -69 -82 -128t-235 -93.5t-323 -34.5t-323 34.5t-235 93.5t-82 128l18 316l574 -181q22 -7 48 -7t48 7zM2304 1024q0 -23 -22 -31l-1120 -352q-4 -1 -10 -1t-10 1l-652 206q-43 -34 -71 -111.5t-34 -178.5q63 -36 63 -109q0 -69 -58 -107l58 -433
+q2 -14 -8 -25q-9 -11 -24 -11h-192q-15 0 -24 11q-10 11 -8 25l58 433q-58 38 -58 107q0 73 65 111q11 207 98 330l-333 104q-22 8 -22 31t22 31l1120 352q4 1 10 1t10 -1l1120 -352q22 -8 22 -31z" />
+    <glyph glyph-name="_389" unicode="&#xf19e;" 
+d="M859 579l13 -707q-62 11 -105 11q-41 0 -105 -11l13 707q-40 69 -168.5 295.5t-216.5 374.5t-181 287q58 -15 108 -15q44 0 111 15q63 -111 133.5 -229.5t167 -276.5t138.5 -227q37 61 109.5 177.5t117.5 190t105 176t107 189.5q54 -14 107 -14q56 0 114 14v0
+q-28 -39 -60 -88.5t-49.5 -78.5t-56.5 -96t-49 -84q-146 -248 -353 -610z" />
+    <glyph glyph-name="uniF1A0" unicode="&#xf1a0;" 
+d="M768 750h725q12 -67 12 -128q0 -217 -91 -387.5t-259.5 -266.5t-386.5 -96q-157 0 -299 60.5t-245 163.5t-163.5 245t-60.5 299t60.5 299t163.5 245t245 163.5t299 60.5q300 0 515 -201l-209 -201q-123 119 -306 119q-129 0 -238.5 -65t-173.5 -176.5t-64 -243.5
+t64 -243.5t173.5 -176.5t238.5 -65q87 0 160 24t120 60t82 82t51.5 87t22.5 78h-436v264z" />
+    <glyph glyph-name="f1a1" unicode="&#xf1a1;" horiz-adv-x="1792" 
+d="M1095 369q16 -16 0 -31q-62 -62 -199 -62t-199 62q-16 15 0 31q6 6 15 6t15 -6q48 -49 169 -49q120 0 169 49q6 6 15 6t15 -6zM788 550q0 -37 -26 -63t-63 -26t-63.5 26t-26.5 63q0 38 26.5 64t63.5 26t63 -26.5t26 -63.5zM1183 550q0 -37 -26.5 -63t-63.5 -26t-63 26
+t-26 63t26 63.5t63 26.5t63.5 -26t26.5 -64zM1434 670q0 49 -35 84t-85 35t-86 -36q-130 90 -311 96l63 283l200 -45q0 -37 26 -63t63 -26t63.5 26.5t26.5 63.5t-26.5 63.5t-63.5 26.5q-54 0 -80 -50l-221 49q-19 5 -25 -16l-69 -312q-180 -7 -309 -97q-35 37 -87 37
+q-50 0 -85 -35t-35 -84q0 -35 18.5 -64t49.5 -44q-6 -27 -6 -56q0 -142 140 -243t337 -101q198 0 338 101t140 243q0 32 -7 57q30 15 48 43.5t18 63.5zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191
+t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="_392" unicode="&#xf1a2;" 
+d="M939 407q13 -13 0 -26q-53 -53 -171 -53t-171 53q-13 13 0 26q5 6 13 6t13 -6q42 -42 145 -42t145 42q5 6 13 6t13 -6zM676 563q0 -31 -23 -54t-54 -23t-54 23t-23 54q0 32 22.5 54.5t54.5 22.5t54.5 -22.5t22.5 -54.5zM1014 563q0 -31 -23 -54t-54 -23t-54 23t-23 54
+q0 32 22.5 54.5t54.5 22.5t54.5 -22.5t22.5 -54.5zM1229 666q0 42 -30 72t-73 30q-42 0 -73 -31q-113 78 -267 82l54 243l171 -39q1 -32 23.5 -54t53.5 -22q32 0 54.5 22.5t22.5 54.5t-22.5 54.5t-54.5 22.5q-48 0 -69 -43l-189 42q-17 5 -21 -13l-60 -268q-154 -6 -265 -83
+q-30 32 -74 32q-43 0 -73 -30t-30 -72q0 -30 16 -55t42 -38q-5 -25 -5 -48q0 -122 120 -208.5t289 -86.5q170 0 290 86.5t120 208.5q0 25 -6 49q25 13 40.5 37.5t15.5 54.5zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960
+q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_393" unicode="&#xf1a3;" 
+d="M866 697l90 27v62q0 79 -58 135t-138 56t-138 -55.5t-58 -134.5v-283q0 -20 -14 -33.5t-33 -13.5t-32.5 13.5t-13.5 33.5v120h-151v-122q0 -82 57.5 -139t139.5 -57q81 0 138.5 56.5t57.5 136.5v280q0 19 13.5 33t33.5 14q19 0 32.5 -14t13.5 -33v-54zM1199 502v122h-150
+v-126q0 -20 -13.5 -33.5t-33.5 -13.5q-19 0 -32.5 14t-13.5 33v123l-90 -26l-60 28v-123q0 -80 58 -137t139 -57t138.5 57t57.5 139zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103
+t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="f1a4" unicode="&#xf1a4;" horiz-adv-x="1920" 
+d="M1062 824v118q0 42 -30 72t-72 30t-72 -30t-30 -72v-612q0 -175 -126 -299t-303 -124q-178 0 -303.5 125.5t-125.5 303.5v266h328v-262q0 -43 30 -72.5t72 -29.5t72 29.5t30 72.5v620q0 171 126.5 292t301.5 121q176 0 302 -122t126 -294v-136l-195 -58zM1592 602h328
+v-266q0 -178 -125.5 -303.5t-303.5 -125.5q-177 0 -303 124.5t-126 300.5v268l131 -61l195 58v-270q0 -42 30 -71.5t72 -29.5t72 29.5t30 71.5v275z" />
+    <glyph glyph-name="_395" unicode="&#xf1a5;" 
+d="M1472 160v480h-704v704h-480q-93 0 -158.5 -65.5t-65.5 -158.5v-480h704v-704h480q93 0 158.5 65.5t65.5 158.5zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5
+t84.5 -203.5z" />
+    <glyph glyph-name="_396" unicode="&#xf1a6;" horiz-adv-x="2048" 
+d="M328 1254h204v-983h-532v697h328v286zM328 435v369h-123v-369h123zM614 968v-697h205v697h-205zM614 1254v-204h205v204h-205zM901 968h533v-942h-533v163h328v82h-328v697zM1229 435v369h-123v-369h123zM1516 968h532v-942h-532v163h327v82h-327v697zM1843 435v369h-123
+v-369h123z" />
+    <glyph glyph-name="_397" unicode="&#xf1a7;" 
+d="M1046 516q0 -64 -38 -109t-91 -45q-43 0 -70 15v277q28 17 70 17q53 0 91 -45.5t38 -109.5zM703 944q0 -64 -38 -109.5t-91 -45.5q-43 0 -70 15v277q28 17 70 17q53 0 91 -45t38 -109zM1265 513q0 134 -88 229t-213 95q-20 0 -39 -3q-23 -78 -78 -136q-87 -95 -211 -101
+v-636l211 41v206q51 -19 117 -19q125 0 213 95t88 229zM922 940q0 134 -88.5 229t-213.5 95q-74 0 -141 -36h-186v-840l211 41v206q55 -19 116 -19q125 0 213.5 95t88.5 229zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960
+q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_398" unicode="&#xf1a8;" horiz-adv-x="2038" 
+d="M1222 607q75 3 143.5 -20.5t118 -58.5t101 -94.5t84 -108t75.5 -120.5q33 -56 78.5 -109t75.5 -80.5t99 -88.5q-48 -30 -108.5 -57.5t-138.5 -59t-114 -47.5q-44 37 -74 115t-43.5 164.5t-33 180.5t-42.5 168.5t-72.5 123t-122.5 48.5l-10 -2l-6 -4q4 -5 13 -14
+q6 -5 28 -23.5t25.5 -22t19 -18t18 -20.5t11.5 -21t10.5 -27.5t4.5 -31t4 -40.5l1 -33q1 -26 -2.5 -57.5t-7.5 -52t-12.5 -58.5t-11.5 -53q-35 1 -101 -9.5t-98 -10.5q-39 0 -72 10q-2 16 -2 47q0 74 3 96q2 13 31.5 41.5t57 59t26.5 51.5q-24 2 -43 -24
+q-36 -53 -111.5 -99.5t-136.5 -46.5q-25 0 -75.5 63t-106.5 139.5t-84 96.5q-6 4 -27 30q-482 -112 -513 -112q-16 0 -28 11t-12 27q0 15 8.5 26.5t22.5 14.5l486 106q-8 14 -8 25t5.5 17.5t16 11.5t20 7t23 4.5t18.5 4.5q4 1 15.5 7.5t17.5 6.5q15 0 28 -16t20 -33
+q163 37 172 37q17 0 29.5 -11t12.5 -28q0 -15 -8.5 -26t-23.5 -14l-182 -40l-1 -16q-1 -26 81.5 -117.5t104.5 -91.5q47 0 119 80t72 129q0 36 -23.5 53t-51 18.5t-51 11.5t-23.5 34q0 16 10 34l-68 19q43 44 43 117q0 26 -5 58q82 16 144 16q44 0 71.5 -1.5t48.5 -8.5
+t31 -13.5t20.5 -24.5t15.5 -33.5t17 -47.5t24 -60l50 25q-3 -40 -23 -60t-42.5 -21t-40 -6.5t-16.5 -20.5zM1282 842q-5 5 -13.5 15.5t-12 14.5t-10.5 11.5t-10 10.5l-8 8t-8.5 7.5t-8 5t-8.5 4.5q-7 3 -14.5 5t-20.5 2.5t-22 0.5h-32.5h-37.5q-126 0 -217 -43
+q16 30 36 46.5t54 29.5t65.5 36t46 36.5t50 55t43.5 50.5q12 -9 28 -31.5t32 -36.5t38 -13l12 1v-76l22 -1q247 95 371 190q28 21 50 39t42.5 37.5t33 31t29.5 34t24 31t24.5 37t23 38t27 47.5t29.5 53l7 9q-2 -53 -43 -139q-79 -165 -205 -264t-306 -142q-14 -3 -42 -7.5
+t-50 -9.5t-39 -14q3 -19 24.5 -46t21.5 -34q0 -11 -26 -30zM1061 -79q39 26 131.5 47.5t146.5 21.5q9 0 22.5 -15.5t28 -42.5t26 -50t24 -51t14.5 -33q-121 -45 -244 -45q-61 0 -125 11zM822 568l48 12l109 -177l-73 -48zM1323 51q3 -15 3 -16q0 -7 -17.5 -14.5t-46 -13
+t-54 -9.5t-53.5 -7.5t-32 -4.5l-7 43q21 2 60.5 8.5t72 10t60.5 3.5h14zM866 679l-96 -20l-6 17q10 1 32.5 7t34.5 6q19 0 35 -10zM1061 45h31l10 -83l-41 -12v95zM1950 1535v1v-1zM1950 1535l-1 -5l-2 -2l1 3zM1950 1535l1 1z" />
+    <glyph glyph-name="_399" unicode="&#xf1a9;" 
+d="M1167 -50q-5 19 -24 5q-30 -22 -87 -39t-131 -17q-129 0 -193 49q-5 4 -13 4q-11 0 -26 -12q-7 -6 -7.5 -16t7.5 -20q34 -32 87.5 -46t102.5 -12.5t99 4.5q41 4 84.5 20.5t65 30t28.5 20.5q12 12 7 29zM1128 65q-19 47 -39 61q-23 15 -76 15q-47 0 -71 -10
+q-29 -12 -78 -56q-26 -24 -12 -44q9 -8 17.5 -4.5t31.5 23.5q3 2 10.5 8.5t10.5 8.5t10 7t11.5 7t12.5 5t15 4.5t16.5 2.5t20.5 1q27 0 44.5 -7.5t23 -14.5t13.5 -22q10 -17 12.5 -20t12.5 1q23 12 14 34zM1483 346q0 22 -5 44.5t-16.5 45t-34 36.5t-52.5 14
+q-33 0 -97 -41.5t-129 -83.5t-101 -42q-27 -1 -63.5 19t-76 49t-83.5 58t-100 49t-111 19q-115 -1 -197 -78.5t-84 -178.5q-2 -112 74 -164q29 -20 62.5 -28.5t103.5 -8.5q57 0 132 32.5t134 71t120 70.5t93 31q26 -1 65 -31.5t71.5 -67t68 -67.5t55.5 -32q35 -3 58.5 14
+t55.5 63q28 41 42.5 101t14.5 106zM1536 506q0 -164 -62 -304.5t-166 -236t-242.5 -149.5t-290.5 -54t-293 57.5t-247.5 157t-170.5 241.5t-64 302q0 89 19.5 172.5t49 145.5t70.5 118.5t78.5 94t78.5 69.5t64.5 46.5t42.5 24.5q14 8 51 26.5t54.5 28.5t48 30t60.5 44
+q36 28 58 72.5t30 125.5q129 -155 186 -193q44 -29 130 -68t129 -66q21 -13 39 -25t60.5 -46.5t76 -70.5t75 -95t69 -122t47 -148.5t19.5 -177.5z" />
+    <glyph glyph-name="_400" unicode="&#xf1aa;" 
+d="M1070 463l-160 -160l-151 -152l-30 -30q-65 -64 -151.5 -87t-171.5 -2q-16 -70 -72 -115t-129 -45q-85 0 -145 60.5t-60 145.5q0 72 44.5 128t113.5 72q-22 86 1 173t88 152l12 12l151 -152l-11 -11q-37 -37 -37 -89t37 -90q37 -37 89 -37t89 37l30 30l151 152l161 160z
+M729 1145l12 -12l-152 -152l-12 12q-37 37 -89 37t-89 -37t-37 -89.5t37 -89.5l29 -29l152 -152l160 -160l-151 -152l-161 160l-151 152l-30 30q-68 67 -90 159.5t5 179.5q-70 15 -115 71t-45 129q0 85 60 145.5t145 60.5q76 0 133.5 -49t69.5 -123q84 20 169.5 -3.5
+t149.5 -87.5zM1536 78q0 -85 -60 -145.5t-145 -60.5q-74 0 -131 47t-71 118q-86 -28 -179.5 -6t-161.5 90l-11 12l151 152l12 -12q37 -37 89 -37t89 37t37 89t-37 89l-30 30l-152 152l-160 160l152 152l160 -160l152 -152l29 -30q64 -64 87.5 -150.5t2.5 -171.5
+q76 -11 126.5 -68.5t50.5 -134.5zM1534 1202q0 -77 -51 -135t-127 -69q26 -85 3 -176.5t-90 -158.5l-12 -12l-151 152l12 12q37 37 37 89t-37 89t-89 37t-89 -37l-30 -30l-152 -152l-160 -160l-152 152l161 160l152 152l29 30q67 67 159 89.5t178 -3.5q11 75 68.5 126
+t135.5 51q85 0 145 -60.5t60 -145.5z" />
+    <glyph glyph-name="f1ab" unicode="&#xf1ab;" 
+d="M654 458q-1 -3 -12.5 0.5t-31.5 11.5l-20 9q-44 20 -87 49q-7 5 -41 31.5t-38 28.5q-67 -103 -134 -181q-81 -95 -105 -110q-4 -2 -19.5 -4t-18.5 0q6 4 82 92q21 24 85.5 115t78.5 118q17 30 51 98.5t36 77.5q-8 1 -110 -33q-8 -2 -27.5 -7.5t-34.5 -9.5t-17 -5
+q-2 -2 -2 -10.5t-1 -9.5q-5 -10 -31 -15q-23 -7 -47 0q-18 4 -28 21q-4 6 -5 23q6 2 24.5 5t29.5 6q58 16 105 32q100 35 102 35q10 2 43 19.5t44 21.5q9 3 21.5 8t14.5 5.5t6 -0.5q2 -12 -1 -33q0 -2 -12.5 -27t-26.5 -53.5t-17 -33.5q-25 -50 -77 -131l64 -28
+q12 -6 74.5 -32t67.5 -28q4 -1 10.5 -25.5t4.5 -30.5zM449 944q3 -15 -4 -28q-12 -23 -50 -38q-30 -12 -60 -12q-26 3 -49 26q-14 15 -18 41l1 3q3 -3 19.5 -5t26.5 0t58 16q36 12 55 14q17 0 21 -17zM1147 815l63 -227l-139 42zM39 15l694 232v1032l-694 -233v-1031z
+M1280 332l102 -31l-181 657l-100 31l-216 -536l102 -31l45 110l211 -65zM777 1294l573 -184v380zM1088 -29l158 -13l-54 -160l-40 66q-130 -83 -276 -108q-58 -12 -91 -12h-84q-79 0 -199.5 39t-183.5 85q-8 7 -8 16q0 8 5 13.5t13 5.5q4 0 18 -7.5t30.5 -16.5t20.5 -11
+q73 -37 159.5 -61.5t157.5 -24.5q95 0 167 14.5t157 50.5q15 7 30.5 15.5t34 19t28.5 16.5zM1536 1050v-1079l-774 246q-14 -6 -375 -127.5t-368 -121.5q-13 0 -18 13q0 1 -1 3v1078q3 9 4 10q5 6 20 11q107 36 149 50v384l558 -198q2 0 160.5 55t316 108.5t161.5 53.5
+q20 0 20 -21v-418z" />
+    <glyph glyph-name="_402" unicode="&#xf1ac;" horiz-adv-x="1792" 
+d="M288 1152q66 0 113 -47t47 -113v-1088q0 -66 -47 -113t-113 -47h-128q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h128zM1664 989q58 -34 93 -93t35 -128v-768q0 -106 -75 -181t-181 -75h-864q-66 0 -113 47t-47 113v1536q0 40 28 68t68 28h672q40 0 88 -20t76 -48
+l152 -152q28 -28 48 -76t20 -88v-163zM928 0v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM928 256v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM928 512v128q0 14 -9 23
+t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM1184 0v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM1184 256v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128
+q14 0 23 9t9 23zM1184 512v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM1440 0v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM1440 256v128q0 14 -9 23t-23 9h-128
+q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM1440 512v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM1536 896v256h-160q-40 0 -68 28t-28 68v160h-640v-512h896z" />
+    <glyph glyph-name="_403" unicode="&#xf1ad;" 
+d="M1344 1536q26 0 45 -19t19 -45v-1664q0 -26 -19 -45t-45 -19h-1280q-26 0 -45 19t-19 45v1664q0 26 19 45t45 19h1280zM512 1248v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23zM512 992v-64q0 -14 9 -23t23 -9h64q14 0 23 9
+t9 23v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23zM512 736v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23zM512 480v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23zM384 160v64
+q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM384 416v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM384 672v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64
+q14 0 23 9t9 23zM384 928v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM384 1184v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM896 -96v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9
+t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM896 416v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM896 672v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM896 928v64
+q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM896 1184v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1152 160v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64
+q14 0 23 9t9 23zM1152 416v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1152 672v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1152 928v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9
+t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1152 1184v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23z" />
+    <glyph glyph-name="_404" unicode="&#xf1ae;" horiz-adv-x="1280" 
+d="M1188 988l-292 -292v-824q0 -46 -33 -79t-79 -33t-79 33t-33 79v384h-64v-384q0 -46 -33 -79t-79 -33t-79 33t-33 79v824l-292 292q-28 28 -28 68t28 68q29 28 68.5 28t67.5 -28l228 -228h368l228 228q28 28 68 28t68 -28q28 -29 28 -68.5t-28 -67.5zM864 1152
+q0 -93 -65.5 -158.5t-158.5 -65.5t-158.5 65.5t-65.5 158.5t65.5 158.5t158.5 65.5t158.5 -65.5t65.5 -158.5z" />
+    <glyph glyph-name="uniF1B1" unicode="&#xf1b0;" horiz-adv-x="1664" 
+d="M780 1064q0 -60 -19 -113.5t-63 -92.5t-105 -39q-76 0 -138 57.5t-92 135.5t-30 151q0 60 19 113.5t63 92.5t105 39q77 0 138.5 -57.5t91.5 -135t30 -151.5zM438 581q0 -80 -42 -139t-119 -59q-76 0 -141.5 55.5t-100.5 133.5t-35 152q0 80 42 139.5t119 59.5
+q76 0 141.5 -55.5t100.5 -134t35 -152.5zM832 608q118 0 255 -97.5t229 -237t92 -254.5q0 -46 -17 -76.5t-48.5 -45t-64.5 -20t-76 -5.5q-68 0 -187.5 45t-182.5 45q-66 0 -192.5 -44.5t-200.5 -44.5q-183 0 -183 146q0 86 56 191.5t139.5 192.5t187.5 146t193 59zM1071 819
+q-61 0 -105 39t-63 92.5t-19 113.5q0 74 30 151.5t91.5 135t138.5 57.5q61 0 105 -39t63 -92.5t19 -113.5q0 -73 -30 -151t-92 -135.5t-138 -57.5zM1503 923q77 0 119 -59.5t42 -139.5q0 -74 -35 -152t-100.5 -133.5t-141.5 -55.5q-77 0 -119 59t-42 139q0 74 35 152.5
+t100.5 134t141.5 55.5z" />
+    <glyph glyph-name="_406" unicode="&#xf1b1;" horiz-adv-x="768" 
+d="M704 1008q0 -145 -57 -243.5t-152 -135.5l45 -821q2 -26 -16 -45t-44 -19h-192q-26 0 -44 19t-16 45l45 821q-95 37 -152 135.5t-57 243.5q0 128 42.5 249.5t117.5 200t160 78.5t160 -78.5t117.5 -200t42.5 -249.5z" />
+    <glyph glyph-name="_407" unicode="&#xf1b2;" horiz-adv-x="1792" 
+d="M896 -93l640 349v636l-640 -233v-752zM832 772l698 254l-698 254l-698 -254zM1664 1024v-768q0 -35 -18 -65t-49 -47l-704 -384q-28 -16 -61 -16t-61 16l-704 384q-31 17 -49 47t-18 65v768q0 40 23 73t61 47l704 256q22 8 44 8t44 -8l704 -256q38 -14 61 -47t23 -73z
+" />
+    <glyph glyph-name="_408" unicode="&#xf1b3;" horiz-adv-x="2304" 
+d="M640 -96l384 192v314l-384 -164v-342zM576 358l404 173l-404 173l-404 -173zM1664 -96l384 192v314l-384 -164v-342zM1600 358l404 173l-404 173l-404 -173zM1152 651l384 165v266l-384 -164v-267zM1088 1030l441 189l-441 189l-441 -189zM2176 512v-416q0 -36 -19 -67
+t-52 -47l-448 -224q-25 -14 -57 -14t-57 14l-448 224q-4 2 -7 4q-2 -2 -7 -4l-448 -224q-25 -14 -57 -14t-57 14l-448 224q-33 16 -52 47t-19 67v416q0 38 21.5 70t56.5 48l434 186v400q0 38 21.5 70t56.5 48l448 192q23 10 50 10t50 -10l448 -192q35 -16 56.5 -48t21.5 -70
+v-400l434 -186q36 -16 57 -48t21 -70z" />
+    <glyph glyph-name="_409" unicode="&#xf1b4;" horiz-adv-x="2048" 
+d="M1848 1197h-511v-124h511v124zM1596 771q-90 0 -146 -52.5t-62 -142.5h408q-18 195 -200 195zM1612 186q63 0 122 32t76 87h221q-100 -307 -427 -307q-214 0 -340.5 132t-126.5 347q0 208 130.5 345.5t336.5 137.5q138 0 240.5 -68t153 -179t50.5 -248q0 -17 -2 -47h-658
+q0 -111 57.5 -171.5t166.5 -60.5zM277 236h296q205 0 205 167q0 180 -199 180h-302v-347zM277 773h281q78 0 123.5 36.5t45.5 113.5q0 144 -190 144h-260v-294zM0 1282h594q87 0 155 -14t126.5 -47.5t90 -96.5t31.5 -154q0 -181 -172 -263q114 -32 172 -115t58 -204
+q0 -75 -24.5 -136.5t-66 -103.5t-98.5 -71t-121 -42t-134 -13h-611v1260z" />
+    <glyph glyph-name="_410" unicode="&#xf1b5;" 
+d="M1248 1408q119 0 203.5 -84.5t84.5 -203.5v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960zM499 1041h-371v-787h382q117 0 197 57.5t80 170.5q0 158 -143 200q107 52 107 164q0 57 -19.5 96.5
+t-56.5 60.5t-79 29.5t-97 8.5zM477 723h-176v184h163q119 0 119 -90q0 -94 -106 -94zM486 388h-185v217h189q124 0 124 -113q0 -104 -128 -104zM1136 356q-68 0 -104 38t-36 107h411q1 10 1 30q0 132 -74.5 220.5t-203.5 88.5q-128 0 -210 -86t-82 -216q0 -135 79 -217
+t213 -82q205 0 267 191h-138q-11 -34 -47.5 -54t-75.5 -20zM1126 722q113 0 124 -122h-254q4 56 39 89t91 33zM964 988h319v-77h-319v77z" />
+    <glyph glyph-name="_411" unicode="&#xf1b6;" horiz-adv-x="1792" 
+d="M1582 954q0 -101 -71.5 -172.5t-172.5 -71.5t-172.5 71.5t-71.5 172.5t71.5 172.5t172.5 71.5t172.5 -71.5t71.5 -172.5zM812 212q0 104 -73 177t-177 73q-27 0 -54 -6l104 -42q77 -31 109.5 -106.5t1.5 -151.5q-31 -77 -107 -109t-152 -1q-21 8 -62 24.5t-61 24.5
+q32 -60 91 -96.5t130 -36.5q104 0 177 73t73 177zM1642 953q0 126 -89.5 215.5t-215.5 89.5q-127 0 -216.5 -89.5t-89.5 -215.5q0 -127 89.5 -216t216.5 -89q126 0 215.5 89t89.5 216zM1792 953q0 -189 -133.5 -322t-321.5 -133l-437 -319q-12 -129 -109 -218t-229 -89
+q-121 0 -214 76t-118 192l-230 92v429l389 -157q79 48 173 48q13 0 35 -2l284 407q2 187 135.5 319t320.5 132q188 0 321.5 -133.5t133.5 -321.5z" />
+    <glyph glyph-name="_412" unicode="&#xf1b7;" 
+d="M1242 889q0 80 -57 136.5t-137 56.5t-136.5 -57t-56.5 -136q0 -80 56.5 -136.5t136.5 -56.5t137 56.5t57 136.5zM632 301q0 -83 -58 -140.5t-140 -57.5q-56 0 -103 29t-72 77q52 -20 98 -40q60 -24 120 1.5t85 86.5q24 60 -1.5 120t-86.5 84l-82 33q22 5 42 5
+q82 0 140 -57.5t58 -140.5zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v153l172 -69q20 -92 93.5 -152t168.5 -60q104 0 181 70t87 173l345 252q150 0 255.5 105.5t105.5 254.5q0 150 -105.5 255.5t-255.5 105.5
+q-148 0 -253 -104.5t-107 -252.5l-225 -322q-9 1 -28 1q-75 0 -137 -37l-297 119v468q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5zM1289 887q0 -100 -71 -170.5t-171 -70.5t-170.5 70.5t-70.5 170.5t70.5 171t170.5 71q101 0 171.5 -70.5t70.5 -171.5z
+" />
+    <glyph glyph-name="_413" unicode="&#xf1b8;" horiz-adv-x="1792" 
+d="M836 367l-15 -368l-2 -22l-420 29q-36 3 -67 31.5t-47 65.5q-11 27 -14.5 55t4 65t12 55t21.5 64t19 53q78 -12 509 -28zM449 953l180 -379l-147 92q-63 -72 -111.5 -144.5t-72.5 -125t-39.5 -94.5t-18.5 -63l-4 -21l-190 357q-17 26 -18 56t6 47l8 18q35 63 114 188
+l-140 86zM1680 436l-188 -359q-12 -29 -36.5 -46.5t-43.5 -20.5l-18 -4q-71 -7 -219 -12l8 -164l-230 367l211 362l7 -173q170 -16 283 -5t170 33zM895 1360q-47 -63 -265 -435l-317 187l-19 12l225 356q20 31 60 45t80 10q24 -2 48.5 -12t42 -21t41.5 -33t36 -34.5
+t36 -39.5t32 -35zM1550 1053l212 -363q18 -37 12.5 -76t-27.5 -74q-13 -20 -33 -37t-38 -28t-48.5 -22t-47 -16t-51.5 -14t-46 -12q-34 72 -265 436l313 195zM1407 1279l142 83l-220 -373l-419 20l151 86q-34 89 -75 166t-75.5 123.5t-64.5 80t-47 46.5l-17 13l405 -1
+q31 3 58 -10.5t39 -28.5l11 -15q39 -61 112 -190z" />
+    <glyph glyph-name="_414" unicode="&#xf1b9;" horiz-adv-x="2048" 
+d="M480 448q0 66 -47 113t-113 47t-113 -47t-47 -113t47 -113t113 -47t113 47t47 113zM516 768h1016l-89 357q-2 8 -14 17.5t-21 9.5h-768q-9 0 -21 -9.5t-14 -17.5zM1888 448q0 66 -47 113t-113 47t-113 -47t-47 -113t47 -113t113 -47t113 47t47 113zM2048 544v-384
+q0 -14 -9 -23t-23 -9h-96v-128q0 -80 -56 -136t-136 -56t-136 56t-56 136v128h-1024v-128q0 -80 -56 -136t-136 -56t-136 56t-56 136v128h-96q-14 0 -23 9t-9 23v384q0 93 65.5 158.5t158.5 65.5h28l105 419q23 94 104 157.5t179 63.5h768q98 0 179 -63.5t104 -157.5
+l105 -419h28q93 0 158.5 -65.5t65.5 -158.5z" />
+    <glyph glyph-name="_415" unicode="&#xf1ba;" horiz-adv-x="2048" 
+d="M1824 640q93 0 158.5 -65.5t65.5 -158.5v-384q0 -14 -9 -23t-23 -9h-96v-64q0 -80 -56 -136t-136 -56t-136 56t-56 136v64h-1024v-64q0 -80 -56 -136t-136 -56t-136 56t-56 136v64h-96q-14 0 -23 9t-9 23v384q0 93 65.5 158.5t158.5 65.5h28l105 419q23 94 104 157.5
+t179 63.5h128v224q0 14 9 23t23 9h448q14 0 23 -9t9 -23v-224h128q98 0 179 -63.5t104 -157.5l105 -419h28zM320 160q66 0 113 47t47 113t-47 113t-113 47t-113 -47t-47 -113t47 -113t113 -47zM516 640h1016l-89 357q-2 8 -14 17.5t-21 9.5h-768q-9 0 -21 -9.5t-14 -17.5z
+M1728 160q66 0 113 47t47 113t-47 113t-113 47t-113 -47t-47 -113t47 -113t113 -47z" />
+    <glyph glyph-name="_416" unicode="&#xf1bb;" 
+d="M1504 64q0 -26 -19 -45t-45 -19h-462q1 -17 6 -87.5t5 -108.5q0 -25 -18 -42.5t-43 -17.5h-320q-25 0 -43 17.5t-18 42.5q0 38 5 108.5t6 87.5h-462q-26 0 -45 19t-19 45t19 45l402 403h-229q-26 0 -45 19t-19 45t19 45l402 403h-197q-26 0 -45 19t-19 45t19 45l384 384
+q19 19 45 19t45 -19l384 -384q19 -19 19 -45t-19 -45t-45 -19h-197l402 -403q19 -19 19 -45t-19 -45t-45 -19h-229l402 -403q19 -19 19 -45z" />
+    <glyph glyph-name="_417" unicode="&#xf1bc;" 
+d="M1127 326q0 32 -30 51q-193 115 -447 115q-133 0 -287 -34q-42 -9 -42 -52q0 -20 13.5 -34.5t35.5 -14.5q5 0 37 8q132 27 243 27q226 0 397 -103q19 -11 33 -11q19 0 33 13.5t14 34.5zM1223 541q0 40 -35 61q-237 141 -548 141q-153 0 -303 -42q-48 -13 -48 -64
+q0 -25 17.5 -42.5t42.5 -17.5q7 0 37 8q122 33 251 33q279 0 488 -124q24 -13 38 -13q25 0 42.5 17.5t17.5 42.5zM1331 789q0 47 -40 70q-126 73 -293 110.5t-343 37.5q-204 0 -364 -47q-23 -7 -38.5 -25.5t-15.5 -48.5q0 -31 20.5 -52t51.5 -21q11 0 40 8q133 37 307 37
+q159 0 309.5 -34t253.5 -95q21 -12 40 -12q29 0 50.5 20.5t21.5 51.5zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_418" unicode="&#xf1bd;" horiz-adv-x="1024" 
+d="M1024 1233l-303 -582l24 -31h279v-415h-507l-44 -30l-142 -273l-30 -30h-301v303l303 583l-24 30h-279v415h507l44 30l142 273l30 30h301v-303z" />
+    <glyph glyph-name="_419" unicode="&#xf1be;" horiz-adv-x="2304" 
+d="M784 164l16 241l-16 523q-1 10 -7.5 17t-16.5 7q-9 0 -16 -7t-7 -17l-14 -523l14 -241q1 -10 7.5 -16.5t15.5 -6.5q22 0 24 23zM1080 193l11 211l-12 586q0 16 -13 24q-8 5 -16 5t-16 -5q-13 -8 -13 -24l-1 -6l-10 -579q0 -1 11 -236v-1q0 -10 6 -17q9 -11 23 -11
+q11 0 20 9q9 7 9 20zM35 533l20 -128l-20 -126q-2 -9 -9 -9t-9 9l-17 126l17 128q2 9 9 9t9 -9zM121 612l26 -207l-26 -203q-2 -9 -10 -9q-9 0 -9 10l-23 202l23 207q0 9 9 9q8 0 10 -9zM401 159zM213 650l25 -245l-25 -237q0 -11 -11 -11q-10 0 -12 11l-21 237l21 245
+q2 12 12 12q11 0 11 -12zM307 657l23 -252l-23 -244q-2 -13 -14 -13q-13 0 -13 13l-21 244l21 252q0 13 13 13q12 0 14 -13zM401 639l21 -234l-21 -246q-2 -16 -16 -16q-6 0 -10.5 4.5t-4.5 11.5l-20 246l20 234q0 6 4.5 10.5t10.5 4.5q14 0 16 -15zM784 164zM495 785
+l21 -380l-21 -246q0 -7 -5 -12.5t-12 -5.5q-16 0 -18 18l-18 246l18 380q2 18 18 18q7 0 12 -5.5t5 -12.5zM589 871l19 -468l-19 -244q0 -8 -5.5 -13.5t-13.5 -5.5q-18 0 -20 19l-16 244l16 468q2 19 20 19q8 0 13.5 -5.5t5.5 -13.5zM687 911l18 -506l-18 -242
+q-2 -21 -22 -21q-19 0 -21 21l-16 242l16 506q0 9 6.5 15.5t14.5 6.5q9 0 15 -6.5t7 -15.5zM1079 169v0v0v0zM881 915l15 -510l-15 -239q0 -10 -7.5 -17.5t-17.5 -7.5t-17 7t-8 18l-14 239l14 510q0 11 7.5 18t17.5 7t17.5 -7t7.5 -18zM980 896l14 -492l-14 -236
+q0 -11 -8 -19t-19 -8t-19 8t-9 19l-12 236l12 492q1 12 9 20t19 8t18.5 -8t8.5 -20zM1192 404l-14 -231v0q0 -13 -9 -22t-22 -9t-22 9t-10 22l-6 114l-6 117l12 636v3q2 15 12 24q9 7 20 7q8 0 15 -5q14 -8 16 -26zM2304 423q0 -117 -83 -199.5t-200 -82.5h-786
+q-13 2 -22 11t-9 22v899q0 23 28 33q85 34 181 34q195 0 338 -131.5t160 -323.5q53 22 110 22q117 0 200 -83t83 -201z" />
+    <glyph glyph-name="uniF1C0" unicode="&#xf1c0;" 
+d="M768 768q237 0 443 43t325 127v-170q0 -69 -103 -128t-280 -93.5t-385 -34.5t-385 34.5t-280 93.5t-103 128v170q119 -84 325 -127t443 -43zM768 0q237 0 443 43t325 127v-170q0 -69 -103 -128t-280 -93.5t-385 -34.5t-385 34.5t-280 93.5t-103 128v170q119 -84 325 -127
+t443 -43zM768 384q237 0 443 43t325 127v-170q0 -69 -103 -128t-280 -93.5t-385 -34.5t-385 34.5t-280 93.5t-103 128v170q119 -84 325 -127t443 -43zM768 1536q208 0 385 -34.5t280 -93.5t103 -128v-128q0 -69 -103 -128t-280 -93.5t-385 -34.5t-385 34.5t-280 93.5
+t-103 128v128q0 69 103 128t280 93.5t385 34.5z" />
+    <glyph glyph-name="uniF1C1" unicode="&#xf1c1;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M894 465q33 -26 84 -56q59 7 117 7q147 0 177 -49q16 -22 2 -52q0 -1 -1 -2l-2 -2v-1q-6 -38 -71 -38q-48 0 -115 20t-130 53q-221 -24 -392 -83q-153 -262 -242 -262q-15 0 -28 7l-24 12q-1 1 -6 5q-10 10 -6 36q9 40 56 91.5t132 96.5q14 9 23 -6q2 -2 2 -4q52 85 107 197
+q68 136 104 262q-24 82 -30.5 159.5t6.5 127.5q11 40 42 40h21h1q23 0 35 -15q18 -21 9 -68q-2 -6 -4 -8q1 -3 1 -8v-30q-2 -123 -14 -192q55 -164 146 -238zM318 54q52 24 137 158q-51 -40 -87.5 -84t-49.5 -74zM716 974q-15 -42 -2 -132q1 7 7 44q0 3 7 43q1 4 4 8
+q-1 1 -1 2q-1 2 -1 3q-1 22 -13 36q0 -1 -1 -2v-2zM592 313q135 54 284 81q-2 1 -13 9.5t-16 13.5q-76 67 -127 176q-27 -86 -83 -197q-30 -56 -45 -83zM1238 329q-24 24 -140 24q76 -28 124 -28q14 0 18 1q0 1 -2 3z" />
+    <glyph glyph-name="_422" unicode="&#xf1c2;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M233 768v-107h70l164 -661h159l128 485q7 20 10 46q2 16 2 24h4l3 -24q1 -3 3.5 -20t5.5 -26l128 -485h159l164 661h70v107h-300v-107h90l-99 -438q-5 -20 -7 -46l-2 -21h-4q0 3 -0.5 6.5t-1.5 8t-1 6.5q-1 5 -4 21t-5 25l-144 545h-114l-144 -545q-2 -9 -4.5 -24.5
+t-3.5 -21.5l-4 -21h-4l-2 21q-2 26 -7 46l-99 438h90v107h-300z" />
+    <glyph glyph-name="_423" unicode="&#xf1c3;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M429 106v-106h281v106h-75l103 161q5 7 10 16.5t7.5 13.5t3.5 4h2q1 -4 5 -10q2 -4 4.5 -7.5t6 -8t6.5 -8.5l107 -161h-76v-106h291v106h-68l-192 273l195 282h67v107h-279v-107h74l-103 -159q-4 -7 -10 -16.5t-9 -13.5l-2 -3h-2q-1 4 -5 10q-6 11 -17 23l-106 159h76v107
+h-290v-107h68l189 -272l-194 -283h-68z" />
+    <glyph glyph-name="_424" unicode="&#xf1c4;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M416 106v-106h327v106h-93v167h137q76 0 118 15q67 23 106.5 87t39.5 146q0 81 -37 141t-100 87q-48 19 -130 19h-368v-107h92v-555h-92zM769 386h-119v268h120q52 0 83 -18q56 -33 56 -115q0 -89 -62 -120q-31 -15 -78 -15z" />
+    <glyph glyph-name="_425" unicode="&#xf1c5;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M1280 320v-320h-1024v192l192 192l128 -128l384 384zM448 512q-80 0 -136 56t-56 136t56 136t136 56t136 -56t56 -136t-56 -136t-136 -56z" />
+    <glyph glyph-name="_426" unicode="&#xf1c6;" 
+d="M640 1152v128h-128v-128h128zM768 1024v128h-128v-128h128zM640 896v128h-128v-128h128zM768 768v128h-128v-128h128zM1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400
+v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-128v-128h-128v128h-512v-1536h1280zM781 593l107 -349q8 -27 8 -52q0 -83 -72.5 -137.5t-183.5 -54.5t-183.5 54.5t-72.5 137.5q0 25 8 52q21 63 120 396v128h128v-128h79
+q22 0 39 -13t23 -34zM640 128q53 0 90.5 19t37.5 45t-37.5 45t-90.5 19t-90.5 -19t-37.5 -45t37.5 -45t90.5 -19z" />
+    <glyph glyph-name="_427" unicode="&#xf1c7;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M620 686q20 -8 20 -30v-544q0 -22 -20 -30q-8 -2 -12 -2q-12 0 -23 9l-166 167h-131q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h131l166 167q16 15 35 7zM1037 -3q31 0 50 24q129 159 129 363t-129 363q-16 21 -43 24t-47 -14q-21 -17 -23.5 -43.5t14.5 -47.5
+q100 -123 100 -282t-100 -282q-17 -21 -14.5 -47.5t23.5 -42.5q18 -15 40 -15zM826 145q27 0 47 20q87 93 87 219t-87 219q-18 19 -45 20t-46 -17t-20 -44.5t18 -46.5q52 -57 52 -131t-52 -131q-19 -20 -18 -46.5t20 -44.5q20 -17 44 -17z" />
+    <glyph glyph-name="_428" unicode="&#xf1c8;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M768 768q52 0 90 -38t38 -90v-384q0 -52 -38 -90t-90 -38h-384q-52 0 -90 38t-38 90v384q0 52 38 90t90 38h384zM1260 766q20 -8 20 -30v-576q0 -22 -20 -30q-8 -2 -12 -2q-14 0 -23 9l-265 266v90l265 266q9 9 23 9q4 0 12 -2z" />
+    <glyph glyph-name="_429" unicode="&#xf1c9;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M480 768q8 11 21 12.5t24 -6.5l51 -38q11 -8 12.5 -21t-6.5 -24l-182 -243l182 -243q8 -11 6.5 -24t-12.5 -21l-51 -38q-11 -8 -24 -6.5t-21 12.5l-226 301q-14 19 0 38zM1282 467q14 -19 0 -38l-226 -301q-8 -11 -21 -12.5t-24 6.5l-51 38q-11 8 -12.5 21t6.5 24l182 243
+l-182 243q-8 11 -6.5 24t12.5 21l51 38q11 8 24 6.5t21 -12.5zM662 6q-13 2 -20.5 13t-5.5 24l138 831q2 13 13 20.5t24 5.5l63 -10q13 -2 20.5 -13t5.5 -24l-138 -831q-2 -13 -13 -20.5t-24 -5.5z" />
+    <glyph glyph-name="_430" unicode="&#xf1ca;" 
+d="M1497 709v-198q-101 -23 -198 -23q-65 -136 -165.5 -271t-181.5 -215.5t-128 -106.5q-80 -45 -162 3q-28 17 -60.5 43.5t-85 83.5t-102.5 128.5t-107.5 184t-105.5 244t-91.5 314.5t-70.5 390h283q26 -218 70 -398.5t104.5 -317t121.5 -235.5t140 -195q169 169 287 406
+q-142 72 -223 220t-81 333q0 192 104 314.5t284 122.5q178 0 273 -105.5t95 -297.5q0 -159 -58 -286q-7 -1 -19.5 -3t-46 -2t-63 6t-62 25.5t-50.5 51.5q31 103 31 184q0 87 -29 132t-79 45q-53 0 -85 -49.5t-32 -140.5q0 -186 105 -293.5t267 -107.5q62 0 121 14z" />
+    <glyph glyph-name="_431" unicode="&#xf1cb;" horiz-adv-x="1792" 
+d="M216 367l603 -402v359l-334 223zM154 511l193 129l-193 129v-258zM973 -35l603 402l-269 180l-334 -223v-359zM896 458l272 182l-272 182l-272 -182zM485 733l334 223v359l-603 -402zM1445 640l193 -129v258zM1307 733l269 180l-603 402v-359zM1792 913v-546
+q0 -41 -34 -64l-819 -546q-21 -13 -43 -13t-43 13l-819 546q-34 23 -34 64v546q0 41 34 64l819 546q21 13 43 13t43 -13l819 -546q34 -23 34 -64z" />
+    <glyph glyph-name="_432" unicode="&#xf1cc;" horiz-adv-x="2048" 
+d="M1800 764q111 -46 179.5 -145.5t68.5 -221.5q0 -164 -118 -280.5t-285 -116.5q-4 0 -11.5 0.5t-10.5 0.5h-1209h-1h-2h-5q-170 10 -288 125.5t-118 280.5q0 110 55 203t147 147q-12 39 -12 82q0 115 82 196t199 81q95 0 172 -58q75 154 222.5 248t326.5 94
+q166 0 306 -80.5t221.5 -218.5t81.5 -301q0 -6 -0.5 -18t-0.5 -18zM468 498q0 -122 84 -193t208 -71q137 0 240 99q-16 20 -47.5 56.5t-43.5 50.5q-67 -65 -144 -65q-55 0 -93.5 33.5t-38.5 87.5q0 53 38.5 87t91.5 34q44 0 84.5 -21t73 -55t65 -75t69 -82t77 -75t97 -55
+t121.5 -21q121 0 204.5 71.5t83.5 190.5q0 121 -84 192t-207 71q-143 0 -241 -97l93 -108q66 64 142 64q52 0 92 -33t40 -84q0 -57 -37 -91.5t-94 -34.5q-43 0 -82.5 21t-72 55t-65.5 75t-69.5 82t-77.5 75t-96.5 55t-118.5 21q-122 0 -207 -70.5t-85 -189.5z" />
+    <glyph glyph-name="_433" unicode="&#xf1cd;" horiz-adv-x="1792" 
+d="M896 1536q182 0 348 -71t286 -191t191 -286t71 -348t-71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71zM896 1408q-190 0 -361 -90l194 -194q82 28 167 28t167 -28l194 194q-171 90 -361 90zM218 279l194 194
+q-28 82 -28 167t28 167l-194 194q-90 -171 -90 -361t90 -361zM896 -128q190 0 361 90l-194 194q-82 -28 -167 -28t-167 28l-194 -194q171 -90 361 -90zM896 256q159 0 271.5 112.5t112.5 271.5t-112.5 271.5t-271.5 112.5t-271.5 -112.5t-112.5 -271.5t112.5 -271.5
+t271.5 -112.5zM1380 473l194 -194q90 171 90 361t-90 361l-194 -194q28 -82 28 -167t-28 -167z" />
+    <glyph glyph-name="_434" unicode="&#xf1ce;" horiz-adv-x="1792" 
+d="M1760 640q0 -176 -68.5 -336t-184 -275.5t-275.5 -184t-336 -68.5t-336 68.5t-275.5 184t-184 275.5t-68.5 336q0 213 97 398.5t265 305.5t374 151v-228q-221 -45 -366.5 -221t-145.5 -406q0 -130 51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5
+t136.5 204t51 248.5q0 230 -145.5 406t-366.5 221v228q206 -31 374 -151t265 -305.5t97 -398.5z" />
+    <glyph glyph-name="uniF1D0" unicode="&#xf1d0;" horiz-adv-x="1792" 
+d="M19 662q8 217 116 406t305 318h5q0 -1 -1 -3q-8 -8 -28 -33.5t-52 -76.5t-60 -110.5t-44.5 -135.5t-14 -150.5t39 -157.5t108.5 -154q50 -50 102 -69.5t90.5 -11.5t69.5 23.5t47 32.5l16 16q39 51 53 116.5t6.5 122.5t-21 107t-26.5 80l-14 29q-10 25 -30.5 49.5t-43 41
+t-43.5 29.5t-35 19l-13 6l104 115q39 -17 78 -52t59 -61l19 -27q1 48 -18.5 103.5t-40.5 87.5l-20 31l161 183l160 -181q-33 -46 -52.5 -102.5t-22.5 -90.5l-4 -33q22 37 61.5 72.5t67.5 52.5l28 17l103 -115q-44 -14 -85 -50t-60 -65l-19 -29q-31 -56 -48 -133.5t-7 -170
+t57 -156.5q33 -45 77.5 -60.5t85 -5.5t76 26.5t57.5 33.5l21 16q60 53 96.5 115t48.5 121.5t10 121.5t-18 118t-37 107.5t-45.5 93t-45 72t-34.5 47.5l-13 17q-14 13 -7 13l10 -3q40 -29 62.5 -46t62 -50t64 -58t58.5 -65t55.5 -77t45.5 -88t38 -103t23.5 -117t10.5 -136
+q3 -259 -108 -465t-312 -321t-456 -115q-185 0 -351 74t-283.5 198t-184 293t-60.5 353z" />
+    <glyph glyph-name="uniF1D1" unicode="&#xf1d1;" horiz-adv-x="1792" 
+d="M874 -102v-66q-208 6 -385 109.5t-283 275.5l58 34q29 -49 73 -99l65 57q148 -168 368 -212l-17 -86q65 -12 121 -13zM276 428l-83 -28q22 -60 49 -112l-57 -33q-98 180 -98 385t98 385l57 -33q-30 -56 -49 -112l82 -28q-35 -100 -35 -212q0 -109 36 -212zM1528 251
+l58 -34q-106 -172 -283 -275.5t-385 -109.5v66q56 1 121 13l-17 86q220 44 368 212l65 -57q44 50 73 99zM1377 805l-233 -80q14 -42 14 -85t-14 -85l232 -80q-31 -92 -98 -169l-185 162q-57 -67 -147 -85l48 -241q-52 -10 -98 -10t-98 10l48 241q-90 18 -147 85l-185 -162
+q-67 77 -98 169l232 80q-14 42 -14 85t14 85l-233 80q33 93 99 169l185 -162q59 68 147 86l-48 240q44 10 98 10t98 -10l-48 -240q88 -18 147 -86l185 162q66 -76 99 -169zM874 1448v-66q-65 -2 -121 -13l17 -86q-220 -42 -368 -211l-65 56q-38 -42 -73 -98l-57 33
+q106 172 282 275.5t385 109.5zM1705 640q0 -205 -98 -385l-57 33q27 52 49 112l-83 28q36 103 36 212q0 112 -35 212l82 28q-19 56 -49 112l57 33q98 -180 98 -385zM1585 1063l-57 -33q-35 56 -73 98l-65 -56q-148 169 -368 211l17 86q-56 11 -121 13v66q209 -6 385 -109.5
+t282 -275.5zM1748 640q0 173 -67.5 331t-181.5 272t-272 181.5t-331 67.5t-331 -67.5t-272 -181.5t-181.5 -272t-67.5 -331t67.5 -331t181.5 -272t272 -181.5t331 -67.5t331 67.5t272 181.5t181.5 272t67.5 331zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71
+t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="uniF1D2" unicode="&#xf1d2;" 
+d="M582 228q0 -66 -93 -66q-107 0 -107 63q0 64 98 64q102 0 102 -61zM546 694q0 -85 -74 -85q-77 0 -77 84q0 90 77 90q36 0 55 -25.5t19 -63.5zM712 769v125q-78 -29 -135 -29q-50 29 -110 29q-86 0 -145 -57t-59 -143q0 -50 29.5 -102t73.5 -67v-3q-38 -17 -38 -85
+q0 -53 41 -77v-3q-113 -37 -113 -139q0 -45 20 -78.5t54 -51t72 -25.5t81 -8q224 0 224 188q0 67 -48 99t-126 46q-27 5 -51.5 20.5t-24.5 39.5q0 44 49 52q77 15 122 70t45 134q0 24 -10 52q37 9 49 13zM771 350h137q-2 27 -2 82v387q0 46 2 69h-137q3 -23 3 -71v-392
+q0 -50 -3 -75zM1280 366v121q-30 -21 -68 -21q-53 0 -53 82v225h52q9 0 26.5 -1t26.5 -1v117h-105q0 82 3 102h-140q4 -24 4 -55v-47h-60v-117q36 3 37 3q3 0 11 -0.5t12 -0.5v-2h-2v-217q0 -37 2.5 -64t11.5 -56.5t24.5 -48.5t43.5 -31t66 -12q64 0 108 24zM924 1072
+q0 36 -24 63.5t-60 27.5t-60.5 -27t-24.5 -64q0 -36 25 -62.5t60 -26.5t59.5 27t24.5 62zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_438" unicode="&#xf1d3;" horiz-adv-x="1792" 
+d="M595 22q0 100 -165 100q-158 0 -158 -104q0 -101 172 -101q151 0 151 105zM536 777q0 61 -30 102t-89 41q-124 0 -124 -145q0 -135 124 -135q119 0 119 137zM805 1101v-202q-36 -12 -79 -22q16 -43 16 -84q0 -127 -73 -216.5t-197 -112.5q-40 -8 -59.5 -27t-19.5 -58
+q0 -31 22.5 -51.5t58 -32t78.5 -22t86 -25.5t78.5 -37.5t58 -64t22.5 -98.5q0 -304 -363 -304q-69 0 -130 12.5t-116 41t-87.5 82t-32.5 127.5q0 165 182 225v4q-67 41 -67 126q0 109 63 137v4q-72 24 -119.5 108.5t-47.5 165.5q0 139 95 231.5t235 92.5q96 0 178 -47
+q98 0 218 47zM1123 220h-222q4 45 4 134v609q0 94 -4 128h222q-4 -33 -4 -124v-613q0 -89 4 -134zM1724 442v-196q-71 -39 -174 -39q-62 0 -107 20t-70 50t-39.5 78t-18.5 92t-4 103v351h2v4q-7 0 -19 1t-18 1q-21 0 -59 -6v190h96v76q0 54 -6 89h227q-6 -41 -6 -165h171
+v-190q-15 0 -43.5 2t-42.5 2h-85v-365q0 -131 87 -131q61 0 109 33zM1148 1389q0 -58 -39 -101.5t-96 -43.5q-58 0 -98 43.5t-40 101.5q0 59 39.5 103t98.5 44q58 0 96.5 -44.5t38.5 -102.5z" />
+    <glyph glyph-name="_439" unicode="&#xf1d4;" 
+d="M809 532l266 499h-112l-157 -312q-24 -48 -44 -92l-42 92l-155 312h-120l263 -493v-324h101v318zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="uniF1D5" unicode="&#xf1d5;" horiz-adv-x="1280" 
+d="M842 964q0 -80 -57 -136.5t-136 -56.5q-60 0 -111 35q-62 -67 -115 -146q-247 -371 -202 -859q1 -22 -12.5 -38.5t-34.5 -18.5h-5q-20 0 -35 13.5t-17 33.5q-14 126 -3.5 247.5t29.5 217t54 186t69 155.5t74 125q61 90 132 165q-16 35 -16 77q0 80 56.5 136.5t136.5 56.5
+t136.5 -56.5t56.5 -136.5zM1223 953q0 -158 -78 -292t-212.5 -212t-292.5 -78q-64 0 -131 14q-21 5 -32.5 23.5t-6.5 39.5q5 20 23 31.5t39 7.5q51 -13 108 -13q97 0 186 38t153 102t102 153t38 186t-38 186t-102 153t-153 102t-186 38t-186 -38t-153 -102t-102 -153
+t-38 -186q0 -114 52 -218q10 -20 3.5 -40t-25.5 -30t-39.5 -3t-30.5 26q-64 123 -64 265q0 119 46.5 227t124.5 186t186 124t226 46q158 0 292.5 -78t212.5 -212.5t78 -292.5z" />
+    <glyph glyph-name="uniF1D6" unicode="&#xf1d6;" horiz-adv-x="1792" 
+d="M270 730q-8 19 -8 52q0 20 11 49t24 45q-1 22 7.5 53t22.5 43q0 139 92.5 288.5t217.5 209.5q139 66 324 66q133 0 266 -55q49 -21 90 -48t71 -56t55 -68t42 -74t32.5 -84.5t25.5 -89.5t22 -98l1 -5q55 -83 55 -150q0 -14 -9 -40t-9 -38q0 -1 1.5 -3.5t3.5 -5t2 -3.5
+q77 -114 120.5 -214.5t43.5 -208.5q0 -43 -19.5 -100t-55.5 -57q-9 0 -19.5 7.5t-19 17.5t-19 26t-16 26.5t-13.5 26t-9 17.5q-1 1 -3 1l-5 -4q-59 -154 -132 -223q20 -20 61.5 -38.5t69 -41.5t35.5 -65q-2 -4 -4 -16t-7 -18q-64 -97 -302 -97q-53 0 -110.5 9t-98 20
+t-104.5 30q-15 5 -23 7q-14 4 -46 4.5t-40 1.5q-41 -45 -127.5 -65t-168.5 -20q-35 0 -69 1.5t-93 9t-101 20.5t-74.5 40t-32.5 64q0 40 10 59.5t41 48.5q11 2 40.5 13t49.5 12q4 0 14 2q2 2 2 4l-2 3q-48 11 -108 105.5t-73 156.5l-5 3q-4 0 -12 -20q-18 -41 -54.5 -74.5
+t-77.5 -37.5h-1q-4 0 -6 4.5t-5 5.5q-23 54 -23 100q0 275 252 466z" />
+    <glyph glyph-name="uniF1D7" unicode="&#xf1d7;" horiz-adv-x="2048" 
+d="M580 1075q0 41 -25 66t-66 25q-43 0 -76 -25.5t-33 -65.5q0 -39 33 -64.5t76 -25.5q41 0 66 24.5t25 65.5zM1323 568q0 28 -25.5 50t-65.5 22q-27 0 -49.5 -22.5t-22.5 -49.5q0 -28 22.5 -50.5t49.5 -22.5q40 0 65.5 22t25.5 51zM1087 1075q0 41 -24.5 66t-65.5 25
+q-43 0 -76 -25.5t-33 -65.5q0 -39 33 -64.5t76 -25.5q41 0 65.5 24.5t24.5 65.5zM1722 568q0 28 -26 50t-65 22q-27 0 -49.5 -22.5t-22.5 -49.5q0 -28 22.5 -50.5t49.5 -22.5q39 0 65 22t26 51zM1456 965q-31 4 -70 4q-169 0 -311 -77t-223.5 -208.5t-81.5 -287.5
+q0 -78 23 -152q-35 -3 -68 -3q-26 0 -50 1.5t-55 6.5t-44.5 7t-54.5 10.5t-50 10.5l-253 -127l72 218q-290 203 -290 490q0 169 97.5 311t264 223.5t363.5 81.5q176 0 332.5 -66t262 -182.5t136.5 -260.5zM2048 404q0 -117 -68.5 -223.5t-185.5 -193.5l55 -181l-199 109
+q-150 -37 -218 -37q-169 0 -311 70.5t-223.5 191.5t-81.5 264t81.5 264t223.5 191.5t311 70.5q161 0 303 -70.5t227.5 -192t85.5 -263.5z" />
+    <glyph glyph-name="_443" unicode="&#xf1d8;" horiz-adv-x="1792" 
+d="M1764 1525q33 -24 27 -64l-256 -1536q-5 -29 -32 -45q-14 -8 -31 -8q-11 0 -24 5l-453 185l-242 -295q-18 -23 -49 -23q-13 0 -22 4q-19 7 -30.5 23.5t-11.5 36.5v349l864 1059l-1069 -925l-395 162q-37 14 -40 55q-2 40 32 59l1664 960q15 9 32 9q20 0 36 -11z" />
+    <glyph glyph-name="_444" unicode="&#xf1d9;" horiz-adv-x="1792" 
+d="M1764 1525q33 -24 27 -64l-256 -1536q-5 -29 -32 -45q-14 -8 -31 -8q-11 0 -24 5l-527 215l-298 -327q-18 -21 -47 -21q-14 0 -23 4q-19 7 -30 23.5t-11 36.5v452l-472 193q-37 14 -40 55q-3 39 32 59l1664 960q35 21 68 -2zM1422 26l221 1323l-1434 -827l336 -137
+l863 639l-478 -797z" />
+    <glyph glyph-name="_445" unicode="&#xf1da;" 
+d="M1536 640q0 -156 -61 -298t-164 -245t-245 -164t-298 -61q-172 0 -327 72.5t-264 204.5q-7 10 -6.5 22.5t8.5 20.5l137 138q10 9 25 9q16 -2 23 -12q73 -95 179 -147t225 -52q104 0 198.5 40.5t163.5 109.5t109.5 163.5t40.5 198.5t-40.5 198.5t-109.5 163.5
+t-163.5 109.5t-198.5 40.5q-98 0 -188 -35.5t-160 -101.5l137 -138q31 -30 14 -69q-17 -40 -59 -40h-448q-26 0 -45 19t-19 45v448q0 42 40 59q39 17 69 -14l130 -129q107 101 244.5 156.5t284.5 55.5q156 0 298 -61t245 -164t164 -245t61 -298zM896 928v-448q0 -14 -9 -23
+t-23 -9h-320q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h224v352q0 14 9 23t23 9h64q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="_446" unicode="&#xf1db;" 
+d="M768 1280q-130 0 -248.5 -51t-204 -136.5t-136.5 -204t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5t-51 248.5t-136.5 204t-204 136.5t-248.5 51zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103
+t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_447" unicode="&#xf1dc;" horiz-adv-x="1792" 
+d="M1682 -128q-44 0 -132.5 3.5t-133.5 3.5q-44 0 -132 -3.5t-132 -3.5q-24 0 -37 20.5t-13 45.5q0 31 17 46t39 17t51 7t45 15q33 21 33 140l-1 391q0 21 -1 31q-13 4 -50 4h-675q-38 0 -51 -4q-1 -10 -1 -31l-1 -371q0 -142 37 -164q16 -10 48 -13t57 -3.5t45 -15
+t20 -45.5q0 -26 -12.5 -48t-36.5 -22q-47 0 -139.5 3.5t-138.5 3.5q-43 0 -128 -3.5t-127 -3.5q-23 0 -35.5 21t-12.5 45q0 30 15.5 45t36 17.5t47.5 7.5t42 15q33 23 33 143l-1 57v813q0 3 0.5 26t0 36.5t-1.5 38.5t-3.5 42t-6.5 36.5t-11 31.5t-16 18q-15 10 -45 12t-53 2
+t-41 14t-18 45q0 26 12 48t36 22q46 0 138.5 -3.5t138.5 -3.5q42 0 126.5 3.5t126.5 3.5q25 0 37.5 -22t12.5 -48q0 -30 -17 -43.5t-38.5 -14.5t-49.5 -4t-43 -13q-35 -21 -35 -160l1 -320q0 -21 1 -32q13 -3 39 -3h699q25 0 38 3q1 11 1 32l1 320q0 139 -35 160
+q-18 11 -58.5 12.5t-66 13t-25.5 49.5q0 26 12.5 48t37.5 22q44 0 132 -3.5t132 -3.5q43 0 129 3.5t129 3.5q25 0 37.5 -22t12.5 -48q0 -30 -17.5 -44t-40 -14.5t-51.5 -3t-44 -12.5q-35 -23 -35 -161l1 -943q0 -119 34 -140q16 -10 46 -13.5t53.5 -4.5t41.5 -15.5t18 -44.5
+q0 -26 -12 -48t-36 -22z" />
+    <glyph glyph-name="_448" unicode="&#xf1dd;" horiz-adv-x="1280" 
+d="M1278 1347v-73q0 -29 -18.5 -61t-42.5 -32q-50 0 -54 -1q-26 -6 -32 -31q-3 -11 -3 -64v-1152q0 -25 -18 -43t-43 -18h-108q-25 0 -43 18t-18 43v1218h-143v-1218q0 -25 -17.5 -43t-43.5 -18h-108q-26 0 -43.5 18t-17.5 43v496q-147 12 -245 59q-126 58 -192 179
+q-64 117 -64 259q0 166 88 286q88 118 209 159q111 37 417 37h479q25 0 43 -18t18 -43z" />
+    <glyph glyph-name="_449" unicode="&#xf1de;" 
+d="M352 128v-128h-352v128h352zM704 256q26 0 45 -19t19 -45v-256q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h256zM864 640v-128h-864v128h864zM224 1152v-128h-224v128h224zM1536 128v-128h-736v128h736zM576 1280q26 0 45 -19t19 -45v-256
+q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h256zM1216 768q26 0 45 -19t19 -45v-256q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h256zM1536 640v-128h-224v128h224zM1536 1152v-128h-864v128h864z" />
+    <glyph glyph-name="uniF1E0" unicode="&#xf1e0;" 
+d="M1216 512q133 0 226.5 -93.5t93.5 -226.5t-93.5 -226.5t-226.5 -93.5t-226.5 93.5t-93.5 226.5q0 12 2 34l-360 180q-92 -86 -218 -86q-133 0 -226.5 93.5t-93.5 226.5t93.5 226.5t226.5 93.5q126 0 218 -86l360 180q-2 22 -2 34q0 133 93.5 226.5t226.5 93.5
+t226.5 -93.5t93.5 -226.5t-93.5 -226.5t-226.5 -93.5q-126 0 -218 86l-360 -180q2 -22 2 -34t-2 -34l360 -180q92 86 218 86z" />
+    <glyph glyph-name="_451" unicode="&#xf1e1;" 
+d="M1280 341q0 88 -62.5 151t-150.5 63q-84 0 -145 -58l-241 120q2 16 2 23t-2 23l241 120q61 -58 145 -58q88 0 150.5 63t62.5 151t-62.5 150.5t-150.5 62.5t-151 -62.5t-63 -150.5q0 -7 2 -23l-241 -120q-62 57 -145 57q-88 0 -150.5 -62.5t-62.5 -150.5t62.5 -150.5
+t150.5 -62.5q83 0 145 57l241 -120q-2 -16 -2 -23q0 -88 63 -150.5t151 -62.5t150.5 62.5t62.5 150.5zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_452" unicode="&#xf1e2;" horiz-adv-x="1792" 
+d="M571 947q-10 25 -34 35t-49 0q-108 -44 -191 -127t-127 -191q-10 -25 0 -49t35 -34q13 -5 24 -5q42 0 60 40q34 84 98.5 148.5t148.5 98.5q25 11 35 35t0 49zM1513 1303l46 -46l-244 -243l68 -68q19 -19 19 -45.5t-19 -45.5l-64 -64q89 -161 89 -343q0 -143 -55.5 -273.5
+t-150 -225t-225 -150t-273.5 -55.5t-273.5 55.5t-225 150t-150 225t-55.5 273.5t55.5 273.5t150 225t225 150t273.5 55.5q182 0 343 -89l64 64q19 19 45.5 19t45.5 -19l68 -68zM1521 1359q-10 -10 -22 -10q-13 0 -23 10l-91 90q-9 10 -9 23t9 23q10 9 23 9t23 -9l90 -91
+q10 -9 10 -22.5t-10 -22.5zM1751 1129q-11 -9 -23 -9t-23 9l-90 91q-10 9 -10 22.5t10 22.5q9 10 22.5 10t22.5 -10l91 -90q9 -10 9 -23t-9 -23zM1792 1312q0 -14 -9 -23t-23 -9h-96q-14 0 -23 9t-9 23t9 23t23 9h96q14 0 23 -9t9 -23zM1600 1504v-96q0 -14 -9 -23t-23 -9
+t-23 9t-9 23v96q0 14 9 23t23 9t23 -9t9 -23zM1751 1449l-91 -90q-10 -10 -22 -10q-13 0 -23 10q-10 9 -10 22.5t10 22.5l90 91q10 9 23 9t23 -9q9 -10 9 -23t-9 -23z" />
+    <glyph glyph-name="_453" unicode="&#xf1e3;" horiz-adv-x="1792" 
+d="M609 720l287 208l287 -208l-109 -336h-355zM896 1536q182 0 348 -71t286 -191t191 -286t71 -348t-71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71zM1515 186q149 203 149 454v3l-102 -89l-240 224l63 323
+l134 -12q-150 206 -389 282l53 -124l-287 -159l-287 159l53 124q-239 -76 -389 -282l135 12l62 -323l-240 -224l-102 89v-3q0 -251 149 -454l30 132l326 -40l139 -298l-116 -69q117 -39 240 -39t240 39l-116 69l139 298l326 40z" />
+    <glyph glyph-name="_454" unicode="&#xf1e4;" horiz-adv-x="1792" 
+d="M448 224v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM256 608v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM832 224v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23
+v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM640 608v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM66 768q-28 0 -47 19t-19 46v129h514v-129q0 -27 -19 -46t-46 -19h-383zM1216 224v-192q0 -14 -9 -23t-23 -9h-192
+q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1024 608v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1600 224v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23
+zM1408 608v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1792 1016v-13h-514v10q0 104 -382 102q-382 -1 -382 -102v-10h-514v13q0 17 8.5 43t34 64t65.5 75.5t110.5 76t160 67.5t224 47.5t293.5 18.5t293 -18.5t224 -47.5
+t160.5 -67.5t110.5 -76t65.5 -75.5t34 -64t8.5 -43zM1792 608v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1792 962v-129q0 -27 -19 -46t-46 -19h-384q-27 0 -46 19t-19 46v129h514z" />
+    <glyph glyph-name="_455" unicode="&#xf1e5;" horiz-adv-x="1792" 
+d="M704 1216v-768q0 -26 -19 -45t-45 -19v-576q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19t-19 45v512l249 873q7 23 31 23h424zM1024 1216v-704h-256v704h256zM1792 320v-512q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19t-19 45v576q-26 0 -45 19t-19 45v768h424q24 0 31 -23z
+M736 1504v-224h-352v224q0 14 9 23t23 9h288q14 0 23 -9t9 -23zM1408 1504v-224h-352v224q0 14 9 23t23 9h288q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="_456" unicode="&#xf1e6;" horiz-adv-x="1792" 
+d="M1755 1083q37 -38 37 -90.5t-37 -90.5l-401 -400l150 -150l-160 -160q-163 -163 -389.5 -186.5t-411.5 100.5l-362 -362h-181v181l362 362q-124 185 -100.5 411.5t186.5 389.5l160 160l150 -150l400 401q38 37 91 37t90 -37t37 -90.5t-37 -90.5l-400 -401l234 -234
+l401 400q38 37 91 37t90 -37z" />
+    <glyph glyph-name="_457" unicode="&#xf1e7;" horiz-adv-x="1792" 
+d="M873 796q0 -83 -63.5 -142.5t-152.5 -59.5t-152.5 59.5t-63.5 142.5q0 84 63.5 143t152.5 59t152.5 -59t63.5 -143zM1375 796q0 -83 -63 -142.5t-153 -59.5q-89 0 -152.5 59.5t-63.5 142.5q0 84 63.5 143t152.5 59q90 0 153 -59t63 -143zM1600 616v667q0 87 -32 123.5
+t-111 36.5h-1112q-83 0 -112.5 -34t-29.5 -126v-673q43 -23 88.5 -40t81 -28t81 -18.5t71 -11t70 -4t58.5 -0.5t56.5 2t44.5 2q68 1 95 -27q6 -6 10 -9q26 -25 61 -51q7 91 118 87q5 0 36.5 -1.5t43 -2t45.5 -1t53 1t54.5 4.5t61 8.5t62 13.5t67 19.5t67.5 27t72 34.5z
+M1763 621q-121 -149 -372 -252q84 -285 -23 -465q-66 -113 -183 -148q-104 -32 -182 15q-86 51 -82 164l-1 326v1q-8 2 -24.5 6t-23.5 5l-1 -338q4 -114 -83 -164q-79 -47 -183 -15q-117 36 -182 150q-105 180 -22 463q-251 103 -372 252q-25 37 -4 63t60 -1q4 -2 11.5 -7
+t10.5 -8v694q0 72 47 123t114 51h1257q67 0 114 -51t47 -123v-694l21 15q39 27 60 1t-4 -63z" />
+    <glyph glyph-name="_458" unicode="&#xf1e8;" horiz-adv-x="1792" 
+d="M896 1102v-434h-145v434h145zM1294 1102v-434h-145v434h145zM1294 342l253 254v795h-1194v-1049h326v-217l217 217h398zM1692 1536v-1013l-434 -434h-326l-217 -217h-217v217h-398v1158l109 289h1483z" />
+    <glyph glyph-name="_459" unicode="&#xf1e9;" 
+d="M773 217v-127q-1 -292 -6 -305q-12 -32 -51 -40q-54 -9 -181.5 38t-162.5 89q-13 15 -17 36q-1 12 4 26q4 10 34 47t181 216q1 0 60 70q15 19 39.5 24.5t49.5 -3.5q24 -10 37.5 -29t12.5 -42zM624 468q-3 -55 -52 -70l-120 -39q-275 -88 -292 -88q-35 2 -54 36
+q-12 25 -17 75q-8 76 1 166.5t30 124.5t56 32q13 0 202 -77q71 -29 115 -47l84 -34q23 -9 35.5 -30.5t11.5 -48.5zM1450 171q-7 -54 -91.5 -161t-135.5 -127q-37 -14 -63 7q-14 10 -184 287l-47 77q-14 21 -11.5 46t19.5 46q35 43 83 26q1 -1 119 -40q203 -66 242 -79.5
+t47 -20.5q28 -22 22 -61zM778 803q5 -102 -54 -122q-58 -17 -114 71l-378 598q-8 35 19 62q41 43 207.5 89.5t224.5 31.5q40 -10 49 -45q3 -18 22 -305.5t24 -379.5zM1440 695q3 -39 -26 -59q-15 -10 -329 -86q-67 -15 -91 -23l1 2q-23 -6 -46 4t-37 32q-30 47 0 87
+q1 1 75 102q125 171 150 204t34 39q28 19 65 2q48 -23 123 -133.5t81 -167.5v-3z" />
+    <glyph glyph-name="_460" unicode="&#xf1ea;" horiz-adv-x="2048" 
+d="M1024 1024h-384v-384h384v384zM1152 384v-128h-640v128h640zM1152 1152v-640h-640v640h640zM1792 384v-128h-512v128h512zM1792 640v-128h-512v128h512zM1792 896v-128h-512v128h512zM1792 1152v-128h-512v128h512zM256 192v960h-128v-960q0 -26 19 -45t45 -19t45 19
+t19 45zM1920 192v1088h-1536v-1088q0 -33 -11 -64h1483q26 0 45 19t19 45zM2048 1408v-1216q0 -80 -56 -136t-136 -56h-1664q-80 0 -136 56t-56 136v1088h256v128h1792z" />
+    <glyph glyph-name="_461" unicode="&#xf1eb;" horiz-adv-x="2048" 
+d="M1024 13q-20 0 -93 73.5t-73 93.5q0 32 62.5 54t103.5 22t103.5 -22t62.5 -54q0 -20 -73 -93.5t-93 -73.5zM1294 284q-2 0 -40 25t-101.5 50t-128.5 25t-128.5 -25t-101 -50t-40.5 -25q-18 0 -93.5 75t-75.5 93q0 13 10 23q78 77 196 121t233 44t233 -44t196 -121
+q10 -10 10 -23q0 -18 -75.5 -93t-93.5 -75zM1567 556q-11 0 -23 8q-136 105 -252 154.5t-268 49.5q-85 0 -170.5 -22t-149 -53t-113.5 -62t-79 -53t-31 -22q-17 0 -92 75t-75 93q0 12 10 22q132 132 320 205t380 73t380 -73t320 -205q10 -10 10 -22q0 -18 -75 -93t-92 -75z
+M1838 827q-11 0 -22 9q-179 157 -371.5 236.5t-420.5 79.5t-420.5 -79.5t-371.5 -236.5q-11 -9 -22 -9q-17 0 -92.5 75t-75.5 93q0 13 10 23q187 186 445 288t527 102t527 -102t445 -288q10 -10 10 -23q0 -18 -75.5 -93t-92.5 -75z" />
+    <glyph glyph-name="_462" unicode="&#xf1ec;" horiz-adv-x="1792" 
+d="M384 0q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM768 0q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM384 384q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5
+t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1152 0q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM768 384q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5
+t37.5 90.5zM384 768q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1152 384q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM768 768q0 53 -37.5 90.5t-90.5 37.5
+t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1536 0v384q0 52 -38 90t-90 38t-90 -38t-38 -90v-384q0 -52 38 -90t90 -38t90 38t38 90zM1152 768q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5z
+M1536 1088v256q0 26 -19 45t-45 19h-1280q-26 0 -45 -19t-19 -45v-256q0 -26 19 -45t45 -19h1280q26 0 45 19t19 45zM1536 768q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1664 1408v-1536q0 -52 -38 -90t-90 -38
+h-1408q-52 0 -90 38t-38 90v1536q0 52 38 90t90 38h1408q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_463" unicode="&#xf1ed;" 
+d="M1519 890q18 -84 -4 -204q-87 -444 -565 -444h-44q-25 0 -44 -16.5t-24 -42.5l-4 -19l-55 -346l-2 -15q-5 -26 -24.5 -42.5t-44.5 -16.5h-251q-21 0 -33 15t-9 36q9 56 26.5 168t26.5 168t27 167.5t27 167.5q5 37 43 37h131q133 -2 236 21q175 39 287 144q102 95 155 246
+q24 70 35 133q1 6 2.5 7.5t3.5 1t6 -3.5q79 -59 98 -162zM1347 1172q0 -107 -46 -236q-80 -233 -302 -315q-113 -40 -252 -42q0 -1 -90 -1l-90 1q-100 0 -118 -96q-2 -8 -85 -530q-1 -10 -12 -10h-295q-22 0 -36.5 16.5t-11.5 38.5l232 1471q5 29 27.5 48t51.5 19h598
+q34 0 97.5 -13t111.5 -32q107 -41 163.5 -123t56.5 -196z" />
+    <glyph glyph-name="_464" unicode="&#xf1ee;" horiz-adv-x="1792" 
+d="M441 864q33 0 52 -26q266 -364 362 -774h-446q-127 441 -367 749q-12 16 -3 33.5t29 17.5h373zM1000 507q-49 -199 -125 -393q-79 310 -256 594q40 221 44 449q211 -340 337 -650zM1099 1216q235 -324 384.5 -698.5t184.5 -773.5h-451q-41 665 -553 1472h435zM1792 640
+q0 -424 -101 -812q-67 560 -359 1083q-25 301 -106 584q-4 16 5.5 28.5t25.5 12.5h359q21 0 38.5 -13t22.5 -33q115 -409 115 -850z" />
+    <glyph glyph-name="uniF1F0" unicode="&#xf1f0;" horiz-adv-x="2304" 
+d="M1975 546h-138q14 37 66 179l3 9q4 10 10 26t9 26l12 -55zM531 611l-58 295q-11 54 -75 54h-268l-2 -13q311 -79 403 -336zM710 960l-162 -438l-17 89q-26 70 -85 129.5t-131 88.5l135 -510h175l261 641h-176zM849 318h166l104 642h-166zM1617 944q-69 27 -149 27
+q-123 0 -201 -59t-79 -153q-1 -102 145 -174q48 -23 67 -41t19 -39q0 -30 -30 -46t-69 -16q-86 0 -156 33l-22 11l-23 -144q74 -34 185 -34q130 -1 208.5 59t80.5 160q0 106 -140 174q-49 25 -71 42t-22 38q0 22 24.5 38.5t70.5 16.5q70 1 124 -24l15 -8zM2042 960h-128
+q-65 0 -87 -54l-246 -588h174l35 96h212q5 -22 20 -96h154zM2304 1280v-1280q0 -52 -38 -90t-90 -38h-2048q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h2048q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_466" unicode="&#xf1f1;" horiz-adv-x="2304" 
+d="M1119 1195q-128 85 -281 85q-103 0 -197.5 -40.5t-162.5 -108.5t-108.5 -162t-40.5 -197q0 -104 40.5 -198t108.5 -162t162 -108.5t198 -40.5q153 0 281 85q-131 107 -178 265.5t0.5 316.5t177.5 265zM1152 1171q-126 -99 -172 -249.5t-0.5 -300.5t172.5 -249
+q127 99 172.5 249t-0.5 300.5t-172 249.5zM1185 1195q130 -107 177.5 -265.5t0.5 -317t-178 -264.5q128 -85 281 -85q104 0 198 40.5t162 108.5t108.5 162t40.5 198q0 103 -40.5 197t-108.5 162t-162.5 108.5t-197.5 40.5q-153 0 -281 -85zM1926 473h7v3h-17v-3h7v-17h3v17z
+M1955 456h4v20h-5l-6 -13l-6 13h-5v-20h3v15l6 -13h4l5 13v-15zM1947 16v-2h-2h-3v3h3h2v-1zM1947 7h3l-4 5h2l1 1q1 1 1 3t-1 3l-1 1h-3h-6v-13h3v5h1zM685 75q0 19 11 31t30 12q18 0 29 -12.5t11 -30.5q0 -19 -11 -31t-29 -12q-19 0 -30 12t-11 31zM1158 119q30 0 35 -32
+h-70q5 32 35 32zM1514 75q0 19 11 31t29 12t29.5 -12.5t11.5 -30.5q0 -19 -11 -31t-30 -12q-18 0 -29 12t-11 31zM1786 75q0 18 11.5 30.5t29.5 12.5t29.5 -12.5t11.5 -30.5q0 -19 -11.5 -31t-29.5 -12t-29.5 12.5t-11.5 30.5zM1944 3q-2 0 -4 1q-1 0 -3 2t-2 3q-1 2 -1 4
+q0 3 1 4q0 2 2 4l1 1q2 0 2 1q2 1 4 1q3 0 4 -1l4 -2l2 -4v-1q1 -2 1 -3l-1 -1v-3t-1 -1l-1 -2q-2 -2 -4 -2q-1 -1 -4 -1zM599 7h30v85q0 24 -14.5 38.5t-39.5 15.5q-32 0 -47 -24q-14 24 -45 24q-24 0 -39 -20v16h-30v-135h30v75q0 36 33 36q30 0 30 -36v-75h29v75
+q0 36 33 36q30 0 30 -36v-75zM765 7h29v68v67h-29v-16q-17 20 -43 20q-29 0 -48 -20t-19 -51t19 -51t48 -20q28 0 43 20v-17zM943 48q0 34 -47 40l-14 2q-23 4 -23 14q0 15 25 15q23 0 43 -11l12 24q-22 14 -55 14q-26 0 -41 -12t-15 -32q0 -33 47 -39l13 -2q24 -4 24 -14
+q0 -17 -31 -17q-25 0 -45 14l-13 -23q25 -17 58 -17q29 0 45.5 12t16.5 32zM1073 14l-8 25q-13 -7 -26 -7q-19 0 -19 22v61h48v27h-48v41h-30v-41h-28v-27h28v-61q0 -50 47 -50q21 0 36 10zM1159 146q-29 0 -48 -20t-19 -51q0 -32 19.5 -51.5t49.5 -19.5q33 0 55 19l-14 22
+q-18 -15 -39 -15q-34 0 -41 33h101v12q0 32 -18 51.5t-46 19.5zM1318 146q-23 0 -35 -20v16h-30v-135h30v76q0 35 29 35q10 0 18 -4l9 28q-9 4 -21 4zM1348 75q0 -31 19.5 -51t52.5 -20q29 0 48 16l-14 24q-18 -13 -35 -12q-18 0 -29.5 12t-11.5 31t11.5 31t29.5 12
+q19 0 35 -12l14 24q-20 16 -48 16q-33 0 -52.5 -20t-19.5 -51zM1593 7h30v68v67h-30v-16q-15 20 -42 20q-29 0 -48.5 -20t-19.5 -51t19.5 -51t48.5 -20q28 0 42 20v-17zM1726 146q-23 0 -35 -20v16h-29v-135h29v76q0 35 29 35q10 0 18 -4l9 28q-8 4 -21 4zM1866 7h29v68v122
+h-29v-71q-15 20 -43 20t-47.5 -20.5t-19.5 -50.5t19.5 -50.5t47.5 -20.5q29 0 43 20v-17zM1944 27l-2 -1h-3q-2 -1 -4 -3q-3 -1 -3 -4q-1 -2 -1 -6q0 -3 1 -5q0 -2 3 -4q2 -2 4 -3t5 -1q4 0 6 1q0 1 2 2l2 1q1 1 3 4q1 2 1 5q0 4 -1 6q-1 1 -3 4q0 1 -2 2l-2 1q-1 0 -3 0.5
+t-3 0.5zM2304 1280v-1280q0 -52 -38 -90t-90 -38h-2048q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h2048q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_467" unicode="&#xf1f2;" horiz-adv-x="2304" 
+d="M313 759q0 -51 -36 -84q-29 -26 -89 -26h-17v220h17q61 0 89 -27q36 -31 36 -83zM2089 824q0 -52 -64 -52h-19v101h20q63 0 63 -49zM380 759q0 74 -50 120.5t-129 46.5h-95v-333h95q74 0 119 38q60 51 60 128zM410 593h65v333h-65v-333zM730 694q0 40 -20.5 62t-75.5 42
+q-29 10 -39.5 19t-10.5 23q0 16 13.5 26.5t34.5 10.5q29 0 53 -27l34 44q-41 37 -98 37q-44 0 -74 -27.5t-30 -67.5q0 -35 18 -55.5t64 -36.5q37 -13 45 -19q19 -12 19 -34q0 -20 -14 -33.5t-36 -13.5q-48 0 -71 44l-42 -40q44 -64 115 -64q51 0 83 30.5t32 79.5zM1008 604
+v77q-37 -37 -78 -37q-49 0 -80.5 32.5t-31.5 82.5q0 48 31.5 81.5t77.5 33.5q43 0 81 -38v77q-40 20 -80 20q-74 0 -125.5 -50.5t-51.5 -123.5t51 -123.5t125 -50.5q42 0 81 19zM2240 0v527q-65 -40 -144.5 -84t-237.5 -117t-329.5 -137.5t-417.5 -134.5t-504 -118h1569
+q26 0 45 19t19 45zM1389 757q0 75 -53 128t-128 53t-128 -53t-53 -128t53 -128t128 -53t128 53t53 128zM1541 584l144 342h-71l-90 -224l-89 224h-71l142 -342h35zM1714 593h184v56h-119v90h115v56h-115v74h119v57h-184v-333zM2105 593h80l-105 140q76 16 76 94q0 47 -31 73
+t-87 26h-97v-333h65v133h9zM2304 1274v-1268q0 -56 -38.5 -95t-93.5 -39h-2040q-55 0 -93.5 39t-38.5 95v1268q0 56 38.5 95t93.5 39h2040q55 0 93.5 -39t38.5 -95z" />
+    <glyph glyph-name="f1f3" unicode="&#xf1f3;" horiz-adv-x="2304" 
+d="M119 854h89l-45 108zM740 328l74 79l-70 79h-163v-49h142v-55h-142v-54h159zM898 406l99 -110v217zM1186 453q0 33 -40 33h-84v-69h83q41 0 41 36zM1475 457q0 29 -42 29h-82v-61h81q43 0 43 32zM1197 923q0 29 -42 29h-82v-60h81q43 0 43 31zM1656 854h89l-44 108z
+M699 1009v-271h-66v212l-94 -212h-57l-94 212v-212h-132l-25 60h-135l-25 -60h-70l116 271h96l110 -257v257h106l85 -184l77 184h108zM1255 453q0 -20 -5.5 -35t-14 -25t-22.5 -16.5t-26 -10t-31.5 -4.5t-31.5 -1t-32.5 0.5t-29.5 0.5v-91h-126l-80 90l-83 -90h-256v271h260
+l80 -89l82 89h207q109 0 109 -89zM964 794v-56h-217v271h217v-57h-152v-49h148v-55h-148v-54h152zM2304 235v-229q0 -55 -38.5 -94.5t-93.5 -39.5h-2040q-55 0 -93.5 39.5t-38.5 94.5v678h111l25 61h55l25 -61h218v46l19 -46h113l20 47v-47h541v99l10 1q10 0 10 -14v-86h279
+v23q23 -12 55 -18t52.5 -6.5t63 0.5t51.5 1l25 61h56l25 -61h227v58l34 -58h182v378h-180v-44l-25 44h-185v-44l-23 44h-249q-69 0 -109 -22v22h-172v-22q-24 22 -73 22h-628l-43 -97l-43 97h-198v-44l-22 44h-169l-78 -179v391q0 55 38.5 94.5t93.5 39.5h2040
+q55 0 93.5 -39.5t38.5 -94.5v-678h-120q-51 0 -81 -22v22h-177q-55 0 -78 -22v22h-316v-22q-31 22 -87 22h-209v-22q-23 22 -91 22h-234l-54 -58l-50 58h-349v-378h343l55 59l52 -59h211v89h21q59 0 90 13v-102h174v99h8q8 0 10 -2t2 -10v-87h529q57 0 88 24v-24h168
+q60 0 95 17zM1546 469q0 -23 -12 -43t-34 -29q25 -9 34 -26t9 -46v-54h-65v45q0 33 -12 43.5t-46 10.5h-69v-99h-65v271h154q48 0 77 -15t29 -58zM1269 936q0 -24 -12.5 -44t-33.5 -29q26 -9 34.5 -25.5t8.5 -46.5v-53h-65q0 9 0.5 26.5t0 25t-3 18.5t-8.5 16t-17.5 8.5
+t-29.5 3.5h-70v-98h-64v271l153 -1q49 0 78 -14.5t29 -57.5zM1798 327v-56h-216v271h216v-56h-151v-49h148v-55h-148v-54zM1372 1009v-271h-66v271h66zM2065 357q0 -86 -102 -86h-126v58h126q34 0 34 25q0 16 -17 21t-41.5 5t-49.5 3.5t-42 22.5t-17 55q0 39 26 60t66 21
+h130v-57h-119q-36 0 -36 -25q0 -16 17.5 -20.5t42 -4t49 -2.5t42 -21.5t17.5 -54.5zM2304 407v-101q-24 -35 -88 -35h-125v58h125q33 0 33 25q0 13 -12.5 19t-31 5.5t-40 2t-40 8t-31 24t-12.5 48.5q0 39 26.5 60t66.5 21h129v-57h-118q-36 0 -36 -25q0 -20 29 -22t68.5 -5
+t56.5 -26zM2139 1008v-270h-92l-122 203v-203h-132l-26 60h-134l-25 -60h-75q-129 0 -129 133q0 138 133 138h63v-59q-7 0 -28 1t-28.5 0.5t-23 -2t-21.5 -6.5t-14.5 -13.5t-11.5 -23t-3 -33.5q0 -38 13.5 -58t49.5 -20h29l92 213h97l109 -256v256h99l114 -188v188h66z" />
+    <glyph glyph-name="_469" unicode="&#xf1f4;" horiz-adv-x="2304" 
+d="M745 630q0 -37 -25.5 -61.5t-62.5 -24.5q-29 0 -46.5 16t-17.5 44q0 37 25 62.5t62 25.5q28 0 46.5 -16.5t18.5 -45.5zM1530 779q0 -42 -22 -57t-66 -15l-32 -1l17 107q2 11 13 11h18q22 0 35 -2t25 -12.5t12 -30.5zM1881 630q0 -36 -25.5 -61t-61.5 -25q-29 0 -47 16
+t-18 44q0 37 25 62.5t62 25.5q28 0 46.5 -16.5t18.5 -45.5zM513 801q0 59 -38.5 85.5t-100.5 26.5h-160q-19 0 -21 -19l-65 -408q-1 -6 3 -11t10 -5h76q20 0 22 19l18 110q1 8 7 13t15 6.5t17 1.5t19 -1t14 -1q86 0 135 48.5t49 134.5zM822 489l41 261q1 6 -3 11t-10 5h-76
+q-14 0 -17 -33q-27 40 -95 40q-72 0 -122.5 -54t-50.5 -127q0 -59 34.5 -94t92.5 -35q28 0 58 12t48 32q-4 -12 -4 -21q0 -16 13 -16h69q19 0 22 19zM1269 752q0 5 -4 9.5t-9 4.5h-77q-11 0 -18 -10l-106 -156l-44 150q-5 16 -22 16h-75q-5 0 -9 -4.5t-4 -9.5q0 -2 19.5 -59
+t42 -123t23.5 -70q-82 -112 -82 -120q0 -13 13 -13h77q11 0 18 10l255 368q2 2 2 7zM1649 801q0 59 -38.5 85.5t-100.5 26.5h-159q-20 0 -22 -19l-65 -408q-1 -6 3 -11t10 -5h82q12 0 16 13l18 116q1 8 7 13t15 6.5t17 1.5t19 -1t14 -1q86 0 135 48.5t49 134.5zM1958 489
+l41 261q1 6 -3 11t-10 5h-76q-14 0 -17 -33q-26 40 -95 40q-72 0 -122.5 -54t-50.5 -127q0 -59 34.5 -94t92.5 -35q29 0 59 12t47 32q0 -1 -2 -9t-2 -12q0 -16 13 -16h69q19 0 22 19zM2176 898v1q0 14 -13 14h-74q-11 0 -13 -11l-65 -416l-1 -2q0 -5 4 -9.5t10 -4.5h66
+q19 0 21 19zM392 764q-5 -35 -26 -46t-60 -11l-33 -1l17 107q2 11 13 11h19q40 0 58 -11.5t12 -48.5zM2304 1280v-1280q0 -52 -38 -90t-90 -38h-2048q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h2048q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_470" unicode="&#xf1f5;" horiz-adv-x="2304" 
+d="M1597 633q0 -69 -21 -106q-19 -35 -52 -35q-23 0 -41 9v224q29 30 57 30q57 0 57 -122zM2035 669h-110q6 98 56 98q51 0 54 -98zM476 534q0 59 -33 91.5t-101 57.5q-36 13 -52 24t-16 25q0 26 38 26q58 0 124 -33l18 112q-67 32 -149 32q-77 0 -123 -38q-48 -39 -48 -109
+q0 -58 32.5 -90.5t99.5 -56.5q39 -14 54.5 -25.5t15.5 -27.5q0 -31 -48 -31q-29 0 -70 12.5t-72 30.5l-18 -113q72 -41 168 -41q81 0 129 37q51 41 51 117zM771 749l19 111h-96v135l-129 -21l-18 -114l-46 -8l-17 -103h62v-219q0 -84 44 -120q38 -30 111 -30q32 0 79 11v118
+q-32 -7 -44 -7q-42 0 -42 50v197h77zM1087 724v139q-15 3 -28 3q-32 0 -55.5 -16t-33.5 -46l-10 56h-131v-471h150v306q26 31 82 31q16 0 26 -2zM1124 389h150v471h-150v-471zM1746 638q0 122 -45 179q-40 52 -111 52q-64 0 -117 -56l-8 47h-132v-645l150 25v151
+q36 -11 68 -11q83 0 134 56q61 65 61 202zM1278 986q0 33 -23 56t-56 23t-56 -23t-23 -56t23 -56.5t56 -23.5t56 23.5t23 56.5zM2176 629q0 113 -48 176q-50 64 -144 64q-96 0 -151.5 -66t-55.5 -180q0 -128 63 -188q55 -55 161 -55q101 0 160 40l-16 103q-57 -31 -128 -31
+q-43 0 -63 19q-23 19 -28 66h248q2 14 2 52zM2304 1280v-1280q0 -52 -38 -90t-90 -38h-2048q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h2048q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_471" unicode="&#xf1f6;" horiz-adv-x="2048" 
+d="M1558 684q61 -356 298 -556q0 -52 -38 -90t-90 -38h-448q0 -106 -75 -181t-181 -75t-180.5 74.5t-75.5 180.5zM1024 -176q16 0 16 16t-16 16q-59 0 -101.5 42.5t-42.5 101.5q0 16 -16 16t-16 -16q0 -73 51.5 -124.5t124.5 -51.5zM2026 1424q8 -10 7.5 -23.5t-10.5 -22.5
+l-1872 -1622q-10 -8 -23.5 -7t-21.5 11l-84 96q-8 10 -7.5 23.5t10.5 21.5l186 161q-19 32 -19 66q50 42 91 88t85 119.5t74.5 158.5t50 206t19.5 260q0 152 117 282.5t307 158.5q-8 19 -8 39q0 40 28 68t68 28t68 -28t28 -68q0 -20 -8 -39q124 -18 219 -82.5t148 -157.5
+l418 363q10 8 23.5 7t21.5 -11z" />
+    <glyph glyph-name="_472" unicode="&#xf1f7;" horiz-adv-x="2048" 
+d="M1040 -160q0 16 -16 16q-59 0 -101.5 42.5t-42.5 101.5q0 16 -16 16t-16 -16q0 -73 51.5 -124.5t124.5 -51.5q16 0 16 16zM503 315l877 760q-42 88 -132.5 146.5t-223.5 58.5q-93 0 -169.5 -31.5t-121.5 -80.5t-69 -103t-24 -105q0 -384 -137 -645zM1856 128
+q0 -52 -38 -90t-90 -38h-448q0 -106 -75 -181t-181 -75t-180.5 74.5t-75.5 180.5l149 129h757q-166 187 -227 459l111 97q61 -356 298 -556zM1942 1520l84 -96q8 -10 7.5 -23.5t-10.5 -22.5l-1872 -1622q-10 -8 -23.5 -7t-21.5 11l-84 96q-8 10 -7.5 23.5t10.5 21.5l186 161
+q-19 32 -19 66q50 42 91 88t85 119.5t74.5 158.5t50 206t19.5 260q0 152 117 282.5t307 158.5q-8 19 -8 39q0 40 28 68t68 28t68 -28t28 -68q0 -20 -8 -39q124 -18 219 -82.5t148 -157.5l418 363q10 8 23.5 7t21.5 -11z" />
+    <glyph glyph-name="_473" unicode="&#xf1f8;" horiz-adv-x="1408" 
+d="M512 160v704q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-704q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM768 160v704q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-704q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1024 160v704q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-704
+q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM480 1152h448l-48 117q-7 9 -17 11h-317q-10 -2 -17 -11zM1408 1120v-64q0 -14 -9 -23t-23 -9h-96v-948q0 -83 -47 -143.5t-113 -60.5h-832q-66 0 -113 58.5t-47 141.5v952h-96q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h309l70 167
+q15 37 54 63t79 26h320q40 0 79 -26t54 -63l70 -167h309q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="_474" unicode="&#xf1f9;" 
+d="M1150 462v-109q0 -50 -36.5 -89t-94 -60.5t-118 -32.5t-117.5 -11q-205 0 -342.5 139t-137.5 346q0 203 136 339t339 136q34 0 75.5 -4.5t93 -18t92.5 -34t69 -56.5t28 -81v-109q0 -16 -16 -16h-118q-16 0 -16 16v70q0 43 -65.5 67.5t-137.5 24.5q-140 0 -228.5 -91.5
+t-88.5 -237.5q0 -151 91.5 -249.5t233.5 -98.5q68 0 138 24t70 66v70q0 7 4.5 11.5t10.5 4.5h119q6 0 11 -4.5t5 -11.5zM768 1280q-130 0 -248.5 -51t-204 -136.5t-136.5 -204t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5
+t-51 248.5t-136.5 204t-204 136.5t-248.5 51zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_475" unicode="&#xf1fa;" 
+d="M972 761q0 108 -53.5 169t-147.5 61q-63 0 -124 -30.5t-110 -84.5t-79.5 -137t-30.5 -180q0 -112 53.5 -173t150.5 -61q96 0 176 66.5t122.5 166t42.5 203.5zM1536 640q0 -111 -37 -197t-98.5 -135t-131.5 -74.5t-145 -27.5q-6 0 -15.5 -0.5t-16.5 -0.5q-95 0 -142 53
+q-28 33 -33 83q-52 -66 -131.5 -110t-173.5 -44q-161 0 -249.5 95.5t-88.5 269.5q0 157 66 290t179 210.5t246 77.5q87 0 155 -35.5t106 -99.5l2 19l11 56q1 6 5.5 12t9.5 6h118q5 0 13 -11q5 -5 3 -16l-120 -614q-5 -24 -5 -48q0 -39 12.5 -52t44.5 -13q28 1 57 5.5t73 24
+t77 50t57 89.5t24 137q0 292 -174 466t-466 174q-130 0 -248.5 -51t-204 -136.5t-136.5 -204t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51q228 0 405 144q11 9 24 8t21 -12l41 -49q8 -12 7 -24q-2 -13 -12 -22q-102 -83 -227.5 -128t-258.5 -45q-156 0 -298 61
+t-245 164t-164 245t-61 298t61 298t164 245t245 164t298 61q344 0 556 -212t212 -556z" />
+    <glyph glyph-name="_476" unicode="&#xf1fb;" horiz-adv-x="1792" 
+d="M1698 1442q94 -94 94 -226.5t-94 -225.5l-225 -223l104 -104q10 -10 10 -23t-10 -23l-210 -210q-10 -10 -23 -10t-23 10l-105 105l-603 -603q-37 -37 -90 -37h-203l-256 -128l-64 64l128 256v203q0 53 37 90l603 603l-105 105q-10 10 -10 23t10 23l210 210q10 10 23 10
+t23 -10l104 -104l223 225q93 94 225.5 94t226.5 -94zM512 64l576 576l-192 192l-576 -576v-192h192z" />
+    <glyph glyph-name="f1fc" unicode="&#xf1fc;" horiz-adv-x="1792" 
+d="M1615 1536q70 0 122.5 -46.5t52.5 -116.5q0 -63 -45 -151q-332 -629 -465 -752q-97 -91 -218 -91q-126 0 -216.5 92.5t-90.5 219.5q0 128 92 212l638 579q59 54 130 54zM706 502q39 -76 106.5 -130t150.5 -76l1 -71q4 -213 -129.5 -347t-348.5 -134q-123 0 -218 46.5
+t-152.5 127.5t-86.5 183t-29 220q7 -5 41 -30t62 -44.5t59 -36.5t46 -17q41 0 55 37q25 66 57.5 112.5t69.5 76t88 47.5t103 25.5t125 10.5z" />
+    <glyph glyph-name="_478" unicode="&#xf1fd;" horiz-adv-x="1792" 
+d="M1792 128v-384h-1792v384q45 0 85 14t59 27.5t47 37.5q30 27 51.5 38t56.5 11q24 0 44 -7t31 -15t33 -27q29 -25 47 -38t58 -27t86 -14q45 0 85 14.5t58 27t48 37.5q21 19 32.5 27t31 15t43.5 7q35 0 56.5 -11t51.5 -38q28 -24 47 -37.5t59 -27.5t85 -14t85 14t59 27.5
+t47 37.5q30 27 51.5 38t56.5 11q34 0 55.5 -11t51.5 -38q28 -24 47 -37.5t59 -27.5t85 -14zM1792 448v-192q-24 0 -44 7t-31 15t-33 27q-29 25 -47 38t-58 27t-85 14q-46 0 -86 -14t-58 -27t-47 -38q-22 -19 -33 -27t-31 -15t-44 -7q-35 0 -56.5 11t-51.5 38q-29 25 -47 38
+t-58 27t-86 14q-45 0 -85 -14.5t-58 -27t-48 -37.5q-21 -19 -32.5 -27t-31 -15t-43.5 -7q-35 0 -56.5 11t-51.5 38q-28 24 -47 37.5t-59 27.5t-85 14q-46 0 -86 -14t-58 -27t-47 -38q-30 -27 -51.5 -38t-56.5 -11v192q0 80 56 136t136 56h64v448h256v-448h256v448h256v-448
+h256v448h256v-448h64q80 0 136 -56t56 -136zM512 1312q0 -77 -36 -118.5t-92 -41.5q-53 0 -90.5 37.5t-37.5 90.5q0 29 9.5 51t23.5 34t31 28t31 31.5t23.5 44.5t9.5 67q38 0 83 -74t45 -150zM1024 1312q0 -77 -36 -118.5t-92 -41.5q-53 0 -90.5 37.5t-37.5 90.5
+q0 29 9.5 51t23.5 34t31 28t31 31.5t23.5 44.5t9.5 67q38 0 83 -74t45 -150zM1536 1312q0 -77 -36 -118.5t-92 -41.5q-53 0 -90.5 37.5t-37.5 90.5q0 29 9.5 51t23.5 34t31 28t31 31.5t23.5 44.5t9.5 67q38 0 83 -74t45 -150z" />
+    <glyph glyph-name="_479" unicode="&#xf1fe;" horiz-adv-x="2048" 
+d="M2048 0v-128h-2048v1536h128v-1408h1920zM1664 1024l256 -896h-1664v576l448 576l576 -576z" />
+    <glyph glyph-name="_480" unicode="&#xf200;" horiz-adv-x="1792" 
+d="M768 646l546 -546q-106 -108 -247.5 -168t-298.5 -60q-209 0 -385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103v-762zM955 640h773q0 -157 -60 -298.5t-168 -247.5zM1664 768h-768v768q209 0 385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_481" unicode="&#xf201;" horiz-adv-x="2048" 
+d="M2048 0v-128h-2048v1536h128v-1408h1920zM1920 1248v-435q0 -21 -19.5 -29.5t-35.5 7.5l-121 121l-633 -633q-10 -10 -23 -10t-23 10l-233 233l-416 -416l-192 192l585 585q10 10 23 10t23 -10l233 -233l464 464l-121 121q-16 16 -7.5 35.5t29.5 19.5h435q14 0 23 -9
+t9 -23z" />
+    <glyph glyph-name="_482" unicode="&#xf202;" horiz-adv-x="1792" 
+d="M1292 832q0 -6 10 -41q10 -29 25 -49.5t41 -34t44 -20t55 -16.5q325 -91 325 -332q0 -146 -105.5 -242.5t-254.5 -96.5q-59 0 -111.5 18.5t-91.5 45.5t-77 74.5t-63 87.5t-53.5 103.5t-43.5 103t-39.5 106.5t-35.5 95q-32 81 -61.5 133.5t-73.5 96.5t-104 64t-142 20
+q-96 0 -183 -55.5t-138 -144.5t-51 -185q0 -160 106.5 -279.5t263.5 -119.5q177 0 258 95q56 63 83 116l84 -152q-15 -34 -44 -70l1 -1q-131 -152 -388 -152q-147 0 -269.5 79t-190.5 207.5t-68 274.5q0 105 43.5 206t116 176.5t172 121.5t204.5 46q87 0 159 -19t123.5 -50
+t95 -80t72.5 -99t58.5 -117t50.5 -124.5t50 -130.5t55 -127q96 -200 233 -200q81 0 138.5 48.5t57.5 128.5q0 42 -19 72t-50.5 46t-72.5 31.5t-84.5 27t-87.5 34t-81 52t-65 82t-39 122.5q-3 16 -3 33q0 110 87.5 192t198.5 78q78 -3 120.5 -14.5t90.5 -53.5h-1
+q12 -11 23 -24.5t26 -36t19 -27.5l-129 -99q-26 49 -54 70v1q-23 21 -97 21q-49 0 -84 -33t-35 -83z" />
+    <glyph glyph-name="_483" unicode="&#xf203;" 
+d="M1432 484q0 173 -234 239q-35 10 -53 16.5t-38 25t-29 46.5q0 2 -2 8.5t-3 12t-1 7.5q0 36 24.5 59.5t60.5 23.5q54 0 71 -15h-1q20 -15 39 -51l93 71q-39 54 -49 64q-33 29 -67.5 39t-85.5 10q-80 0 -142 -57.5t-62 -137.5q0 -7 2 -23q16 -96 64.5 -140t148.5 -73
+q29 -8 49 -15.5t45 -21.5t38.5 -34.5t13.5 -46.5v-5q1 -58 -40.5 -93t-100.5 -35q-97 0 -167 144q-23 47 -51.5 121.5t-48 125.5t-54 110.5t-74 95.5t-103.5 60.5t-147 24.5q-101 0 -192 -56t-144 -148t-50 -192v-1q4 -108 50.5 -199t133.5 -147.5t196 -56.5q186 0 279 110
+q20 27 31 51l-60 109q-42 -80 -99 -116t-146 -36q-115 0 -191 87t-76 204q0 105 82 189t186 84q112 0 170 -53.5t104 -172.5q8 -21 25.5 -68.5t28.5 -76.5t31.5 -74.5t38.5 -74t45.5 -62.5t55.5 -53.5t66 -33t80 -13.5q107 0 183 69.5t76 174.5zM1536 1120v-960
+q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_484" unicode="&#xf204;" horiz-adv-x="2048" 
+d="M1152 640q0 104 -40.5 198.5t-109.5 163.5t-163.5 109.5t-198.5 40.5t-198.5 -40.5t-163.5 -109.5t-109.5 -163.5t-40.5 -198.5t40.5 -198.5t109.5 -163.5t163.5 -109.5t198.5 -40.5t198.5 40.5t163.5 109.5t109.5 163.5t40.5 198.5zM1920 640q0 104 -40.5 198.5
+t-109.5 163.5t-163.5 109.5t-198.5 40.5h-386q119 -90 188.5 -224t69.5 -288t-69.5 -288t-188.5 -224h386q104 0 198.5 40.5t163.5 109.5t109.5 163.5t40.5 198.5zM2048 640q0 -130 -51 -248.5t-136.5 -204t-204 -136.5t-248.5 -51h-768q-130 0 -248.5 51t-204 136.5
+t-136.5 204t-51 248.5t51 248.5t136.5 204t204 136.5t248.5 51h768q130 0 248.5 -51t204 -136.5t136.5 -204t51 -248.5z" />
+    <glyph glyph-name="_485" unicode="&#xf205;" horiz-adv-x="2048" 
+d="M0 640q0 130 51 248.5t136.5 204t204 136.5t248.5 51h768q130 0 248.5 -51t204 -136.5t136.5 -204t51 -248.5t-51 -248.5t-136.5 -204t-204 -136.5t-248.5 -51h-768q-130 0 -248.5 51t-204 136.5t-136.5 204t-51 248.5zM1408 128q104 0 198.5 40.5t163.5 109.5
+t109.5 163.5t40.5 198.5t-40.5 198.5t-109.5 163.5t-163.5 109.5t-198.5 40.5t-198.5 -40.5t-163.5 -109.5t-109.5 -163.5t-40.5 -198.5t40.5 -198.5t109.5 -163.5t163.5 -109.5t198.5 -40.5z" />
+    <glyph glyph-name="_486" unicode="&#xf206;" horiz-adv-x="2304" 
+d="M762 384h-314q-40 0 -57.5 35t6.5 67l188 251q-65 31 -137 31q-132 0 -226 -94t-94 -226t94 -226t226 -94q115 0 203 72.5t111 183.5zM576 512h186q-18 85 -75 148zM1056 512l288 384h-480l-99 -132q105 -103 126 -252h165zM2176 448q0 132 -94 226t-226 94
+q-60 0 -121 -24l174 -260q15 -23 10 -49t-27 -40q-15 -11 -36 -11q-35 0 -53 29l-174 260q-93 -95 -93 -225q0 -132 94 -226t226 -94t226 94t94 226zM2304 448q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 97 39.5 183.5t109.5 149.5l-65 98l-353 -469
+q-18 -26 -51 -26h-197q-23 -164 -149 -274t-294 -110q-185 0 -316.5 131.5t-131.5 316.5t131.5 316.5t316.5 131.5q114 0 215 -55l137 183h-224q-26 0 -45 19t-19 45t19 45t45 19h384v-128h435l-85 128h-222q-26 0 -45 19t-19 45t19 45t45 19h256q33 0 53 -28l267 -400
+q91 44 192 44q185 0 316.5 -131.5t131.5 -316.5z" />
+    <glyph glyph-name="_487" unicode="&#xf207;" 
+d="M384 320q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1408 320q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1362 716l-72 384q-5 23 -22.5 37.5t-40.5 14.5
+h-918q-23 0 -40.5 -14.5t-22.5 -37.5l-72 -384q-5 -30 14 -53t49 -23h1062q30 0 49 23t14 53zM1136 1328q0 20 -14 34t-34 14h-640q-20 0 -34 -14t-14 -34t14 -34t34 -14h640q20 0 34 14t14 34zM1536 603v-603h-128v-128q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5
+t-37.5 90.5v128h-768v-128q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5v128h-128v603q0 112 25 223l103 454q9 78 97.5 137t230 89t312.5 30t312.5 -30t230 -89t97.5 -137l105 -454q23 -102 23 -223z" />
+    <glyph glyph-name="_488" unicode="&#xf208;" horiz-adv-x="2048" 
+d="M1463 704q0 -35 -25 -60.5t-61 -25.5h-702q-36 0 -61 25.5t-25 60.5t25 60.5t61 25.5h702q36 0 61 -25.5t25 -60.5zM1677 704q0 86 -23 170h-982q-36 0 -61 25t-25 60q0 36 25 61t61 25h908q-88 143 -235 227t-320 84q-177 0 -327.5 -87.5t-238 -237.5t-87.5 -327
+q0 -86 23 -170h982q36 0 61 -25t25 -60q0 -36 -25 -61t-61 -25h-908q88 -143 235.5 -227t320.5 -84q132 0 253 51.5t208 139t139 208t52 253.5zM2048 959q0 -35 -25 -60t-61 -25h-131q17 -85 17 -170q0 -167 -65.5 -319.5t-175.5 -263t-262.5 -176t-319.5 -65.5
+q-246 0 -448.5 133t-301.5 350h-189q-36 0 -61 25t-25 61q0 35 25 60t61 25h132q-17 85 -17 170q0 167 65.5 319.5t175.5 263t262.5 176t320.5 65.5q245 0 447.5 -133t301.5 -350h188q36 0 61 -25t25 -61z" />
+    <glyph glyph-name="_489" unicode="&#xf209;" horiz-adv-x="1280" 
+d="M953 1158l-114 -328l117 -21q165 451 165 518q0 56 -38 56q-57 0 -130 -225zM654 471l33 -88q37 42 71 67l-33 5.5t-38.5 7t-32.5 8.5zM362 1367q0 -98 159 -521q17 10 49 10q15 0 75 -5l-121 351q-75 220 -123 220q-19 0 -29 -17.5t-10 -37.5zM283 608q0 -36 51.5 -119
+t117.5 -153t100 -70q14 0 25.5 13t11.5 27q0 24 -32 102q-13 32 -32 72t-47.5 89t-61.5 81t-62 32q-20 0 -45.5 -27t-25.5 -47zM125 273q0 -41 25 -104q59 -145 183.5 -227t281.5 -82q227 0 382 170q152 169 152 427q0 43 -1 67t-11.5 62t-30.5 56q-56 49 -211.5 75.5
+t-270.5 26.5q-37 0 -49 -11q-12 -5 -12 -35q0 -34 21.5 -60t55.5 -40t77.5 -23.5t87.5 -11.5t85 -4t70 0h23q24 0 40 -19q15 -19 19 -55q-28 -28 -96 -54q-61 -22 -93 -46q-64 -46 -108.5 -114t-44.5 -137q0 -31 18.5 -88.5t18.5 -87.5l-3 -12q-4 -12 -4 -14
+q-137 10 -146 216q-8 -2 -41 -2q2 -7 2 -21q0 -53 -40.5 -89.5t-94.5 -36.5q-82 0 -166.5 78t-84.5 159q0 34 33 67q52 -64 60 -76q77 -104 133 -104q12 0 26.5 8.5t14.5 20.5q0 34 -87.5 145t-116.5 111q-43 0 -70 -44.5t-27 -90.5zM11 264q0 101 42.5 163t136.5 88
+q-28 74 -28 104q0 62 61 123t122 61q29 0 70 -15q-163 462 -163 567q0 80 41 130.5t119 50.5q131 0 325 -581q6 -17 8 -23q6 16 29 79.5t43.5 118.5t54 127.5t64.5 123t70.5 86.5t76.5 36q71 0 112 -49t41 -122q0 -108 -159 -550q61 -15 100.5 -46t58.5 -78t26 -93.5
+t7 -110.5q0 -150 -47 -280t-132 -225t-211 -150t-278 -55q-111 0 -223 42q-149 57 -258 191.5t-109 286.5z" />
+    <glyph glyph-name="_490" unicode="&#xf20a;" horiz-adv-x="2048" 
+d="M785 528h207q-14 -158 -98.5 -248.5t-214.5 -90.5q-162 0 -254.5 116t-92.5 316q0 194 93 311.5t233 117.5q148 0 232 -87t97 -247h-203q-5 64 -35.5 99t-81.5 35q-57 0 -88.5 -60.5t-31.5 -177.5q0 -48 5 -84t18 -69.5t40 -51.5t66 -18q95 0 109 139zM1497 528h206
+q-14 -158 -98 -248.5t-214 -90.5q-162 0 -254.5 116t-92.5 316q0 194 93 311.5t233 117.5q148 0 232 -87t97 -247h-204q-4 64 -35 99t-81 35q-57 0 -88.5 -60.5t-31.5 -177.5q0 -48 5 -84t18 -69.5t39.5 -51.5t65.5 -18q49 0 76.5 38t33.5 101zM1856 647q0 207 -15.5 307
+t-60.5 161q-6 8 -13.5 14t-21.5 15t-16 11q-86 63 -697 63q-625 0 -710 -63q-5 -4 -17.5 -11.5t-21 -14t-14.5 -14.5q-45 -60 -60 -159.5t-15 -308.5q0 -208 15 -307.5t60 -160.5q6 -8 15 -15t20.5 -14t17.5 -12q44 -33 239.5 -49t470.5 -16q610 0 697 65q5 4 17 11t20.5 14
+t13.5 16q46 60 61 159t15 309zM2048 1408v-1536h-2048v1536h2048z" />
+    <glyph glyph-name="_491" unicode="&#xf20b;" 
+d="M992 912v-496q0 -14 -9 -23t-23 -9h-160q-14 0 -23 9t-9 23v496q0 112 -80 192t-192 80h-272v-1152q0 -14 -9 -23t-23 -9h-160q-14 0 -23 9t-9 23v1344q0 14 9 23t23 9h464q135 0 249 -66.5t180.5 -180.5t66.5 -249zM1376 1376v-880q0 -135 -66.5 -249t-180.5 -180.5
+t-249 -66.5h-464q-14 0 -23 9t-9 23v960q0 14 9 23t23 9h160q14 0 23 -9t9 -23v-768h272q112 0 192 80t80 192v880q0 14 9 23t23 9h160q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="_492" unicode="&#xf20c;" 
+d="M1311 694v-114q0 -24 -13.5 -38t-37.5 -14h-202q-24 0 -38 14t-14 38v114q0 24 14 38t38 14h202q24 0 37.5 -14t13.5 -38zM821 464v250q0 53 -32.5 85.5t-85.5 32.5h-133q-68 0 -96 -52q-28 52 -96 52h-130q-53 0 -85.5 -32.5t-32.5 -85.5v-250q0 -22 21 -22h55
+q22 0 22 22v230q0 24 13.5 38t38.5 14h94q24 0 38 -14t14 -38v-230q0 -22 21 -22h54q22 0 22 22v230q0 24 14 38t38 14h97q24 0 37.5 -14t13.5 -38v-230q0 -22 22 -22h55q21 0 21 22zM1410 560v154q0 53 -33 85.5t-86 32.5h-264q-53 0 -86 -32.5t-33 -85.5v-410
+q0 -21 22 -21h55q21 0 21 21v180q31 -42 94 -42h191q53 0 86 32.5t33 85.5zM1536 1176v-1072q0 -96 -68 -164t-164 -68h-1072q-96 0 -164 68t-68 164v1072q0 96 68 164t164 68h1072q96 0 164 -68t68 -164z" />
+    <glyph glyph-name="_493" unicode="&#xf20d;" 
+d="M915 450h-294l147 551zM1001 128h311l-324 1024h-440l-324 -1024h311l383 314zM1536 1120v-960q0 -118 -85 -203t-203 -85h-960q-118 0 -203 85t-85 203v960q0 118 85 203t203 85h960q118 0 203 -85t85 -203z" />
+    <glyph glyph-name="_494" unicode="&#xf20e;" horiz-adv-x="2048" 
+d="M2048 641q0 -21 -13 -36.5t-33 -19.5l-205 -356q3 -9 3 -18q0 -20 -12.5 -35.5t-32.5 -19.5l-193 -337q3 -8 3 -16q0 -23 -16.5 -40t-40.5 -17q-25 0 -41 18h-400q-17 -20 -43 -20t-43 20h-399q-17 -20 -43 -20q-23 0 -40 16.5t-17 40.5q0 8 4 20l-193 335
+q-20 4 -32.5 19.5t-12.5 35.5q0 9 3 18l-206 356q-20 5 -32.5 20.5t-12.5 35.5q0 21 13.5 36.5t33.5 19.5l199 344q0 1 -0.5 3t-0.5 3q0 36 34 51l209 363q-4 10 -4 18q0 24 17 40.5t40 16.5q26 0 44 -21h396q16 21 43 21t43 -21h398q18 21 44 21q23 0 40 -16.5t17 -40.5
+q0 -6 -4 -18l207 -358q23 -1 39 -17.5t16 -38.5q0 -13 -7 -27l187 -324q19 -4 31.5 -19.5t12.5 -35.5zM1063 -158h389l-342 354h-143l-342 -354h360q18 16 39 16t39 -16zM112 654q1 -4 1 -13q0 -10 -2 -15l208 -360l15 -6l188 199v347l-187 194q-13 -8 -29 -10zM986 1438
+h-388l190 -200l554 200h-280q-16 -16 -38 -16t-38 16zM1689 226q1 6 5 11l-64 68l-17 -79h76zM1583 226l22 105l-252 266l-296 -307l63 -64h463zM1495 -142l16 28l65 310h-427l333 -343q8 4 13 5zM578 -158h5l342 354h-373v-335l4 -6q14 -5 22 -13zM552 226h402l64 66
+l-309 321l-157 -166v-221zM359 226h163v189l-168 -177q4 -8 5 -12zM358 1051q0 -1 0.5 -2t0.5 -2q0 -16 -8 -29l171 -177v269zM552 1121v-311l153 -157l297 314l-223 236zM556 1425l-4 -8v-264l205 74l-191 201q-6 -2 -10 -3zM1447 1438h-16l-621 -224l213 -225zM1023 946
+l-297 -315l311 -319l296 307zM688 634l-136 141v-284zM1038 270l-42 -44h85zM1374 618l238 -251l132 624l-3 5l-1 1zM1718 1018q-8 13 -8 29v2l-216 376q-5 1 -13 5l-437 -463l310 -327zM522 1142v223l-163 -282zM522 196h-163l163 -283v283zM1607 196l-48 -227l130 227h-82
+zM1729 266l207 361q-2 10 -2 14q0 1 3 16l-171 296l-129 -612l77 -82q5 3 15 7z" />
+    <glyph glyph-name="f210" unicode="&#xf210;" 
+d="M0 856q0 131 91.5 226.5t222.5 95.5h742l352 358v-1470q0 -132 -91.5 -227t-222.5 -95h-780q-131 0 -222.5 95t-91.5 227v790zM1232 102l-176 180v425q0 46 -32 79t-78 33h-484q-46 0 -78 -33t-32 -79v-492q0 -46 32.5 -79.5t77.5 -33.5h770z" />
+    <glyph glyph-name="_496" unicode="&#xf211;" 
+d="M934 1386q-317 -121 -556 -362.5t-358 -560.5q-20 89 -20 176q0 208 102.5 384.5t278.5 279t384 102.5q82 0 169 -19zM1203 1267q93 -65 164 -155q-389 -113 -674.5 -400.5t-396.5 -676.5q-93 72 -155 162q112 386 395 671t667 399zM470 -67q115 356 379.5 622t619.5 384
+q40 -92 54 -195q-292 -120 -516 -345t-343 -518q-103 14 -194 52zM1536 -125q-193 50 -367 115q-135 -84 -290 -107q109 205 274 370.5t369 275.5q-21 -152 -101 -284q65 -175 115 -370z" />
+    <glyph glyph-name="f212" unicode="&#xf212;" horiz-adv-x="2048" 
+d="M1893 1144l155 -1272q-131 0 -257 57q-200 91 -393 91q-226 0 -374 -148q-148 148 -374 148q-193 0 -393 -91q-128 -57 -252 -57h-5l155 1272q224 127 482 127q233 0 387 -106q154 106 387 106q258 0 482 -127zM1398 157q129 0 232 -28.5t260 -93.5l-124 1021
+q-171 78 -368 78q-224 0 -374 -141q-150 141 -374 141q-197 0 -368 -78l-124 -1021q105 43 165.5 65t148.5 39.5t178 17.5q202 0 374 -108q172 108 374 108zM1438 191l-55 907q-211 -4 -359 -155q-152 155 -374 155q-176 0 -336 -66l-114 -941q124 51 228.5 76t221.5 25
+q209 0 374 -102q172 107 374 102z" />
+    <glyph glyph-name="_498" unicode="&#xf213;" horiz-adv-x="2048" 
+d="M1500 165v733q0 21 -15 36t-35 15h-93q-20 0 -35 -15t-15 -36v-733q0 -20 15 -35t35 -15h93q20 0 35 15t15 35zM1216 165v531q0 20 -15 35t-35 15h-101q-20 0 -35 -15t-15 -35v-531q0 -20 15 -35t35 -15h101q20 0 35 15t15 35zM924 165v429q0 20 -15 35t-35 15h-101
+q-20 0 -35 -15t-15 -35v-429q0 -20 15 -35t35 -15h101q20 0 35 15t15 35zM632 165v362q0 20 -15 35t-35 15h-101q-20 0 -35 -15t-15 -35v-362q0 -20 15 -35t35 -15h101q20 0 35 15t15 35zM2048 311q0 -166 -118 -284t-284 -118h-1244q-166 0 -284 118t-118 284
+q0 116 63 214.5t168 148.5q-10 34 -10 73q0 113 80.5 193.5t193.5 80.5q102 0 180 -67q45 183 194 300t338 117q149 0 275 -73.5t199.5 -199.5t73.5 -275q0 -66 -14 -122q135 -33 221 -142.5t86 -247.5z" />
+    <glyph glyph-name="_499" unicode="&#xf214;" 
+d="M0 1536h1536v-1392l-776 -338l-760 338v1392zM1436 209v926h-1336v-926l661 -294zM1436 1235v201h-1336v-201h1336zM181 937v-115h-37v115h37zM181 789v-115h-37v115h37zM181 641v-115h-37v115h37zM181 493v-115h-37v115h37zM181 345v-115h-37v115h37zM207 202l15 34
+l105 -47l-15 -33zM343 142l15 34l105 -46l-15 -34zM478 82l15 34l105 -46l-15 -34zM614 23l15 33l104 -46l-15 -34zM797 10l105 46l15 -33l-105 -47zM932 70l105 46l15 -34l-105 -46zM1068 130l105 46l15 -34l-105 -46zM1203 189l105 47l15 -34l-105 -46zM259 1389v-36h-114
+v36h114zM421 1389v-36h-115v36h115zM583 1389v-36h-115v36h115zM744 1389v-36h-114v36h114zM906 1389v-36h-114v36h114zM1068 1389v-36h-115v36h115zM1230 1389v-36h-115v36h115zM1391 1389v-36h-114v36h114zM181 1049v-79h-37v115h115v-36h-78zM421 1085v-36h-115v36h115z
+M583 1085v-36h-115v36h115zM744 1085v-36h-114v36h114zM906 1085v-36h-114v36h114zM1068 1085v-36h-115v36h115zM1230 1085v-36h-115v36h115zM1355 970v79h-78v36h115v-115h-37zM1355 822v115h37v-115h-37zM1355 674v115h37v-115h-37zM1355 526v115h37v-115h-37zM1355 378
+v115h37v-115h-37zM1355 230v115h37v-115h-37zM760 265q-129 0 -221 91.5t-92 221.5q0 129 92 221t221 92q130 0 221.5 -92t91.5 -221q0 -130 -91.5 -221.5t-221.5 -91.5zM595 646q0 -36 19.5 -56.5t49.5 -25t64 -7t64 -2t49.5 -9t19.5 -30.5q0 -49 -112 -49q-97 0 -123 51
+h-3l-31 -63q67 -42 162 -42q29 0 56.5 5t55.5 16t45.5 33t17.5 53q0 46 -27.5 69.5t-67.5 27t-79.5 3t-67 5t-27.5 25.5q0 21 20.5 33t40.5 15t41 3q34 0 70.5 -11t51.5 -34h3l30 58q-3 1 -21 8.5t-22.5 9t-19.5 7t-22 7t-20 4.5t-24 4t-23 1q-29 0 -56.5 -5t-54 -16.5
+t-43 -34t-16.5 -53.5z" />
+    <glyph glyph-name="_500" unicode="&#xf215;" horiz-adv-x="2048" 
+d="M863 504q0 112 -79.5 191.5t-191.5 79.5t-191 -79.5t-79 -191.5t79 -191t191 -79t191.5 79t79.5 191zM1726 505q0 112 -79 191t-191 79t-191.5 -79t-79.5 -191q0 -113 79.5 -192t191.5 -79t191 79.5t79 191.5zM2048 1314v-1348q0 -44 -31.5 -75.5t-76.5 -31.5h-1832
+q-45 0 -76.5 31.5t-31.5 75.5v1348q0 44 31.5 75.5t76.5 31.5h431q44 0 76 -31.5t32 -75.5v-161h754v161q0 44 32 75.5t76 31.5h431q45 0 76.5 -31.5t31.5 -75.5z" />
+    <glyph glyph-name="_501" unicode="&#xf216;" horiz-adv-x="2048" 
+d="M1430 953zM1690 749q148 0 253 -98.5t105 -244.5q0 -157 -109 -261.5t-267 -104.5q-85 0 -162 27.5t-138 73.5t-118 106t-109 126t-103.5 132.5t-108.5 126.5t-117 106t-136 73.5t-159 27.5q-154 0 -251.5 -91.5t-97.5 -244.5q0 -157 104 -250t263 -93q100 0 208 37.5
+t193 98.5q5 4 21 18.5t30 24t22 9.5q14 0 24.5 -10.5t10.5 -24.5q0 -24 -60 -77q-101 -88 -234.5 -142t-260.5 -54q-133 0 -245.5 58t-180 165t-67.5 241q0 205 141.5 341t347.5 136q120 0 226.5 -43.5t185.5 -113t151.5 -153t139 -167.5t133.5 -153.5t149.5 -113
+t172.5 -43.5q102 0 168.5 61.5t66.5 162.5q0 95 -64.5 159t-159.5 64q-30 0 -81.5 -18.5t-68.5 -18.5q-20 0 -35.5 15t-15.5 35q0 18 8.5 57t8.5 59q0 159 -107.5 263t-266.5 104q-58 0 -111.5 -18.5t-84 -40.5t-55.5 -40.5t-33 -18.5q-15 0 -25.5 10.5t-10.5 25.5
+q0 19 25 46q59 67 147 103.5t182 36.5q191 0 318 -125.5t127 -315.5q0 -37 -4 -66q57 15 115 15z" />
+    <glyph glyph-name="_502" unicode="&#xf217;" horiz-adv-x="1664" 
+d="M1216 832q0 26 -19 45t-45 19h-128v128q0 26 -19 45t-45 19t-45 -19t-19 -45v-128h-128q-26 0 -45 -19t-19 -45t19 -45t45 -19h128v-128q0 -26 19 -45t45 -19t45 19t19 45v128h128q26 0 45 19t19 45zM640 0q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5
+t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1536 0q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1664 1088v-512q0 -24 -16 -42.5t-41 -21.5l-1044 -122q1 -7 4.5 -21.5t6 -26.5t2.5 -22q0 -16 -24 -64h920
+q26 0 45 -19t19 -45t-19 -45t-45 -19h-1024q-26 0 -45 19t-19 45q0 14 11 39.5t29.5 59.5t20.5 38l-177 823h-204q-26 0 -45 19t-19 45t19 45t45 19h256q16 0 28.5 -6.5t20 -15.5t13 -24.5t7.5 -26.5t5.5 -29.5t4.5 -25.5h1201q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="_503" unicode="&#xf218;" horiz-adv-x="1664" 
+d="M1280 832q0 26 -19 45t-45 19t-45 -19l-147 -146v293q0 26 -19 45t-45 19t-45 -19t-19 -45v-293l-147 146q-19 19 -45 19t-45 -19t-19 -45t19 -45l256 -256q19 -19 45 -19t45 19l256 256q19 19 19 45zM640 0q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5
+t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1536 0q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1664 1088v-512q0 -24 -16 -42.5t-41 -21.5l-1044 -122q1 -7 4.5 -21.5t6 -26.5t2.5 -22q0 -16 -24 -64h920
+q26 0 45 -19t19 -45t-19 -45t-45 -19h-1024q-26 0 -45 19t-19 45q0 14 11 39.5t29.5 59.5t20.5 38l-177 823h-204q-26 0 -45 19t-19 45t19 45t45 19h256q16 0 28.5 -6.5t20 -15.5t13 -24.5t7.5 -26.5t5.5 -29.5t4.5 -25.5h1201q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="_504" unicode="&#xf219;" horiz-adv-x="2048" 
+d="M212 768l623 -665l-300 665h-323zM1024 -4l349 772h-698zM538 896l204 384h-262l-288 -384h346zM1213 103l623 665h-323zM683 896h682l-204 384h-274zM1510 896h346l-288 384h-262zM1651 1382l384 -512q14 -18 13 -41.5t-17 -40.5l-960 -1024q-18 -20 -47 -20t-47 20
+l-960 1024q-16 17 -17 40.5t13 41.5l384 512q18 26 51 26h1152q33 0 51 -26z" />
+    <glyph glyph-name="_505" unicode="&#xf21a;" horiz-adv-x="2048" 
+d="M1811 -19q19 19 45 19t45 -19l128 -128l-90 -90l-83 83l-83 -83q-18 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83
+q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-128 128l90 90l83 -83l83 83q19 19 45 19t45 -19l83 -83l83 83q19 19 45 19t45 -19l83 -83l83 83q19 19 45 19t45 -19l83 -83l83 83q19 19 45 19t45 -19l83 -83l83 83q19 19 45 19t45 -19l83 -83l83 83
+q19 19 45 19t45 -19l83 -83zM237 19q-19 -19 -45 -19t-45 19l-128 128l90 90l83 -82l83 82q19 19 45 19t45 -19l83 -82l64 64v293l-210 314q-17 26 -7 56.5t40 40.5l177 58v299h128v128h256v128h256v-128h256v-128h128v-299l177 -58q30 -10 40 -40.5t-7 -56.5l-210 -314
+v-293l19 18q19 19 45 19t45 -19l83 -82l83 82q19 19 45 19t45 -19l128 -128l-90 -90l-83 83l-83 -83q-18 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83
+q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83zM640 1152v-128l384 128l384 -128v128h-128v128h-512v-128h-128z" />
+    <glyph glyph-name="_506" unicode="&#xf21b;" 
+d="M576 0l96 448l-96 128l-128 64zM832 0l128 640l-128 -64l-96 -128zM992 1010q-2 4 -4 6q-10 8 -96 8q-70 0 -167 -19q-7 -2 -21 -2t-21 2q-97 19 -167 19q-86 0 -96 -8q-2 -2 -4 -6q2 -18 4 -27q2 -3 7.5 -6.5t7.5 -10.5q2 -4 7.5 -20.5t7 -20.5t7.5 -17t8.5 -17t9 -14
+t12 -13.5t14 -9.5t17.5 -8t20.5 -4t24.5 -2q36 0 59 12.5t32.5 30t14.5 34.5t11.5 29.5t17.5 12.5h12q11 0 17.5 -12.5t11.5 -29.5t14.5 -34.5t32.5 -30t59 -12.5q13 0 24.5 2t20.5 4t17.5 8t14 9.5t12 13.5t9 14t8.5 17t7.5 17t7 20.5t7.5 20.5q2 7 7.5 10.5t7.5 6.5
+q2 9 4 27zM1408 131q0 -121 -73 -190t-194 -69h-874q-121 0 -194 69t-73 190q0 61 4.5 118t19 125.5t37.5 123.5t63.5 103.5t93.5 74.5l-90 220h214q-22 64 -22 128q0 12 2 32q-194 40 -194 96q0 57 210 99q17 62 51.5 134t70.5 114q32 37 76 37q30 0 84 -31t84 -31t84 31
+t84 31q44 0 76 -37q36 -42 70.5 -114t51.5 -134q210 -42 210 -99q0 -56 -194 -96q7 -81 -20 -160h214l-82 -225q63 -33 107.5 -96.5t65.5 -143.5t29 -151.5t8 -148.5z" />
+    <glyph glyph-name="_507" unicode="&#xf21c;" horiz-adv-x="2304" 
+d="M2301 500q12 -103 -22 -198.5t-99 -163.5t-158.5 -106t-196.5 -31q-161 11 -279.5 125t-134.5 274q-12 111 27.5 210.5t118.5 170.5l-71 107q-96 -80 -151 -194t-55 -244q0 -27 -18.5 -46.5t-45.5 -19.5h-256h-69q-23 -164 -149 -274t-294 -110q-185 0 -316.5 131.5
+t-131.5 316.5t131.5 316.5t316.5 131.5q76 0 152 -27l24 45q-123 110 -304 110h-64q-26 0 -45 19t-19 45t19 45t45 19h128q78 0 145 -13.5t116.5 -38.5t71.5 -39.5t51 -36.5h512h115l-85 128h-222q-30 0 -49 22.5t-14 52.5q4 23 23 38t43 15h253q33 0 53 -28l70 -105
+l114 114q19 19 46 19h101q26 0 45 -19t19 -45v-128q0 -26 -19 -45t-45 -19h-179l115 -172q131 63 275 36q143 -26 244 -134.5t118 -253.5zM448 128q115 0 203 72.5t111 183.5h-314q-35 0 -55 31q-18 32 -1 63l147 277q-47 13 -91 13q-132 0 -226 -94t-94 -226t94 -226
+t226 -94zM1856 128q132 0 226 94t94 226t-94 226t-226 94q-60 0 -121 -24l174 -260q15 -23 10 -49t-27 -40q-15 -11 -36 -11q-35 0 -53 29l-174 260q-93 -95 -93 -225q0 -132 94 -226t226 -94z" />
+    <glyph glyph-name="_508" unicode="&#xf21d;" 
+d="M1408 0q0 -63 -61.5 -113.5t-164 -81t-225 -46t-253.5 -15.5t-253.5 15.5t-225 46t-164 81t-61.5 113.5q0 49 33 88.5t91 66.5t118 44.5t131 29.5q26 5 48 -10.5t26 -41.5q5 -26 -10.5 -48t-41.5 -26q-58 -10 -106 -23.5t-76.5 -25.5t-48.5 -23.5t-27.5 -19.5t-8.5 -12
+q3 -11 27 -26.5t73 -33t114 -32.5t160.5 -25t201.5 -10t201.5 10t160.5 25t114 33t73 33.5t27 27.5q-1 4 -8.5 11t-27.5 19t-48.5 23.5t-76.5 25t-106 23.5q-26 4 -41.5 26t-10.5 48q4 26 26 41.5t48 10.5q71 -12 131 -29.5t118 -44.5t91 -66.5t33 -88.5zM1024 896v-384
+q0 -26 -19 -45t-45 -19h-64v-384q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v384h-64q-26 0 -45 19t-19 45v384q0 53 37.5 90.5t90.5 37.5h384q53 0 90.5 -37.5t37.5 -90.5zM928 1280q0 -93 -65.5 -158.5t-158.5 -65.5t-158.5 65.5t-65.5 158.5t65.5 158.5t158.5 65.5
+t158.5 -65.5t65.5 -158.5z" />
+    <glyph glyph-name="_509" unicode="&#xf21e;" horiz-adv-x="1792" 
+d="M1280 512h305q-5 -6 -10 -10.5t-9 -7.5l-3 -4l-623 -600q-18 -18 -44 -18t-44 18l-624 602q-5 2 -21 20h369q22 0 39.5 13.5t22.5 34.5l70 281l190 -667q6 -20 23 -33t39 -13q21 0 38 13t23 33l146 485l56 -112q18 -35 57 -35zM1792 940q0 -145 -103 -300h-369l-111 221
+q-8 17 -25.5 27t-36.5 8q-45 -5 -56 -46l-129 -430l-196 686q-6 20 -23.5 33t-39.5 13t-39 -13.5t-22 -34.5l-116 -464h-423q-103 155 -103 300q0 220 127 344t351 124q62 0 126.5 -21.5t120 -58t95.5 -68.5t76 -68q36 36 76 68t95.5 68.5t120 58t126.5 21.5q224 0 351 -124
+t127 -344z" />
+    <glyph glyph-name="venus" unicode="&#xf221;" horiz-adv-x="1280" 
+d="M1152 960q0 -221 -147.5 -384.5t-364.5 -187.5v-260h224q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-224v-224q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v224h-224q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h224v260q-150 16 -271.5 103t-186 224t-52.5 292
+q11 134 80.5 249t182 188t245.5 88q170 19 319 -54t236 -212t87 -306zM128 960q0 -185 131.5 -316.5t316.5 -131.5t316.5 131.5t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5z" />
+    <glyph glyph-name="_511" unicode="&#xf222;" 
+d="M1472 1408q26 0 45 -19t19 -45v-416q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v262l-382 -383q126 -156 126 -359q0 -117 -45.5 -223.5t-123 -184t-184 -123t-223.5 -45.5t-223.5 45.5t-184 123t-123 184t-45.5 223.5t45.5 223.5t123 184t184 123t223.5 45.5
+q203 0 359 -126l382 382h-261q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h416zM576 0q185 0 316.5 131.5t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_512" unicode="&#xf223;" horiz-adv-x="1280" 
+d="M830 1220q145 -72 233.5 -210.5t88.5 -305.5q0 -221 -147.5 -384.5t-364.5 -187.5v-132h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96v-96q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v96h-96q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96v132q-217 24 -364.5 187.5
+t-147.5 384.5q0 167 88.5 305.5t233.5 210.5q-165 96 -228 273q-6 16 3.5 29.5t26.5 13.5h69q21 0 29 -20q44 -106 140 -171t214 -65t214 65t140 171q8 20 37 20h61q17 0 26.5 -13.5t3.5 -29.5q-63 -177 -228 -273zM576 256q185 0 316.5 131.5t131.5 316.5t-131.5 316.5
+t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_513" unicode="&#xf224;" 
+d="M1024 1504q0 14 9 23t23 9h288q26 0 45 -19t19 -45v-288q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v134l-254 -255q126 -158 126 -359q0 -221 -147.5 -384.5t-364.5 -187.5v-132h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96v-96q0 -14 -9 -23t-23 -9h-64
+q-14 0 -23 9t-9 23v96h-96q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96v132q-149 16 -270.5 103t-186.5 223.5t-53 291.5q16 204 160 353.5t347 172.5q118 14 228 -19t198 -103l255 254h-134q-14 0 -23 9t-9 23v64zM576 256q185 0 316.5 131.5t131.5 316.5t-131.5 316.5
+t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_514" unicode="&#xf225;" horiz-adv-x="1792" 
+d="M1280 1504q0 14 9 23t23 9h288q26 0 45 -19t19 -45v-288q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v134l-254 -255q126 -158 126 -359q0 -221 -147.5 -384.5t-364.5 -187.5v-132h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96v-96q0 -14 -9 -23t-23 -9h-64
+q-14 0 -23 9t-9 23v96h-96q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96v132q-217 24 -364.5 187.5t-147.5 384.5q0 201 126 359l-52 53l-101 -111q-9 -10 -22 -10.5t-23 7.5l-48 44q-10 8 -10.5 21.5t8.5 23.5l105 115l-111 112v-134q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9
+t-9 23v288q0 26 19 45t45 19h288q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-133l106 -107l86 94q9 10 22 10.5t23 -7.5l48 -44q10 -8 10.5 -21.5t-8.5 -23.5l-90 -99l57 -56q158 126 359 126t359 -126l255 254h-134q-14 0 -23 9t-9 23v64zM832 256q185 0 316.5 131.5
+t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_515" unicode="&#xf226;" horiz-adv-x="1792" 
+d="M1790 1007q12 -155 -52.5 -292t-186 -224t-271.5 -103v-260h224q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-224v-224q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v224h-512v-224q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v224h-224q-14 0 -23 9t-9 23v64q0 14 9 23
+t23 9h224v260q-150 16 -271.5 103t-186 224t-52.5 292q17 206 164.5 356.5t352.5 169.5q206 21 377 -94q171 115 377 94q205 -19 352.5 -169.5t164.5 -356.5zM896 647q128 131 128 313t-128 313q-128 -131 -128 -313t128 -313zM576 512q115 0 218 57q-154 165 -154 391
+q0 224 154 391q-103 57 -218 57q-185 0 -316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5zM1152 128v260q-137 15 -256 94q-119 -79 -256 -94v-260h512zM1216 512q185 0 316.5 131.5t131.5 316.5t-131.5 316.5t-316.5 131.5q-115 0 -218 -57q154 -167 154 -391
+q0 -226 -154 -391q103 -57 218 -57z" />
+    <glyph glyph-name="_516" unicode="&#xf227;" horiz-adv-x="1920" 
+d="M1536 1120q0 14 9 23t23 9h288q26 0 45 -19t19 -45v-288q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v134l-254 -255q76 -95 107.5 -214t9.5 -247q-31 -182 -166 -312t-318 -156q-210 -29 -384.5 80t-241.5 300q-117 6 -221 57.5t-177.5 133t-113.5 192.5t-32 230
+q9 135 78 252t182 191.5t248 89.5q118 14 227.5 -19t198.5 -103l255 254h-134q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h288q26 0 45 -19t19 -45v-288q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v134l-254 -255q59 -74 93 -169q182 -9 328 -124l255 254h-134q-14 0 -23 9
+t-9 23v64zM1024 704q0 20 -4 58q-162 -25 -271 -150t-109 -292q0 -20 4 -58q162 25 271 150t109 292zM128 704q0 -168 111 -294t276 -149q-3 29 -3 59q0 210 135 369.5t338 196.5q-53 120 -163.5 193t-245.5 73q-185 0 -316.5 -131.5t-131.5 -316.5zM1088 -128
+q185 0 316.5 131.5t131.5 316.5q0 168 -111 294t-276 149q3 -28 3 -59q0 -210 -135 -369.5t-338 -196.5q53 -120 163.5 -193t245.5 -73z" />
+    <glyph glyph-name="_517" unicode="&#xf228;" horiz-adv-x="2048" 
+d="M1664 1504q0 14 9 23t23 9h288q26 0 45 -19t19 -45v-288q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v134l-254 -255q76 -95 107.5 -214t9.5 -247q-32 -180 -164.5 -310t-313.5 -157q-223 -34 -409 90q-117 -78 -256 -93v-132h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23
+t-23 -9h-96v-96q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v96h-96q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96v132q-155 17 -279.5 109.5t-187 237.5t-39.5 307q25 187 159.5 322.5t320.5 164.5q224 34 410 -90q146 97 320 97q201 0 359 -126l255 254h-134q-14 0 -23 9
+t-9 23v64zM896 391q128 131 128 313t-128 313q-128 -131 -128 -313t128 -313zM128 704q0 -185 131.5 -316.5t316.5 -131.5q117 0 218 57q-154 167 -154 391t154 391q-101 57 -218 57q-185 0 -316.5 -131.5t-131.5 -316.5zM1216 256q185 0 316.5 131.5t131.5 316.5
+t-131.5 316.5t-316.5 131.5q-117 0 -218 -57q154 -167 154 -391t-154 -391q101 -57 218 -57z" />
+    <glyph glyph-name="_518" unicode="&#xf229;" 
+d="M1472 1408q26 0 45 -19t19 -45v-416q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v262l-213 -214l140 -140q9 -10 9 -23t-9 -22l-46 -46q-9 -9 -22 -9t-23 9l-140 141l-78 -79q126 -156 126 -359q0 -117 -45.5 -223.5t-123 -184t-184 -123t-223.5 -45.5t-223.5 45.5
+t-184 123t-123 184t-45.5 223.5t45.5 223.5t123 184t184 123t223.5 45.5q203 0 359 -126l78 78l-172 172q-9 10 -9 23t9 22l46 46q9 9 22 9t23 -9l172 -172l213 213h-261q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h416zM576 0q185 0 316.5 131.5t131.5 316.5t-131.5 316.5
+t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_519" unicode="&#xf22a;" horiz-adv-x="1280" 
+d="M640 892q217 -24 364.5 -187.5t147.5 -384.5q0 -167 -87 -306t-236 -212t-319 -54q-133 15 -245.5 88t-182 188t-80.5 249q-12 155 52.5 292t186 224t271.5 103v132h-160q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h160v165l-92 -92q-10 -9 -23 -9t-22 9l-46 46q-9 9 -9 22
+t9 23l202 201q19 19 45 19t45 -19l202 -201q9 -10 9 -23t-9 -22l-46 -46q-9 -9 -22 -9t-23 9l-92 92v-165h160q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-160v-132zM576 -128q185 0 316.5 131.5t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5
+t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_520" unicode="&#xf22b;" horiz-adv-x="2048" 
+d="M1901 621q19 -19 19 -45t-19 -45l-294 -294q-9 -10 -22.5 -10t-22.5 10l-45 45q-10 9 -10 22.5t10 22.5l185 185h-294v-224q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v224h-132q-24 -217 -187.5 -364.5t-384.5 -147.5q-167 0 -306 87t-212 236t-54 319q15 133 88 245.5
+t188 182t249 80.5q155 12 292 -52.5t224 -186t103 -271.5h132v224q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-224h294l-185 185q-10 9 -10 22.5t10 22.5l45 45q9 10 22.5 10t22.5 -10zM576 128q185 0 316.5 131.5t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5
+t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_521" unicode="&#xf22c;" horiz-adv-x="1280" 
+d="M1152 960q0 -221 -147.5 -384.5t-364.5 -187.5v-612q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v612q-217 24 -364.5 187.5t-147.5 384.5q0 117 45.5 223.5t123 184t184 123t223.5 45.5t223.5 -45.5t184 -123t123 -184t45.5 -223.5zM576 512q185 0 316.5 131.5
+t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_522" unicode="&#xf22d;" horiz-adv-x="1280" 
+d="M1024 576q0 185 -131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5t316.5 131.5t131.5 316.5zM1152 576q0 -117 -45.5 -223.5t-123 -184t-184 -123t-223.5 -45.5t-223.5 45.5t-184 123t-123 184t-45.5 223.5t45.5 223.5t123 184t184 123
+t223.5 45.5t223.5 -45.5t184 -123t123 -184t45.5 -223.5z" />
+    <glyph glyph-name="_523" unicode="&#xf22e;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="_524" unicode="&#xf22f;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="_525" unicode="&#xf230;" 
+d="M1451 1408q35 0 60 -25t25 -60v-1366q0 -35 -25 -60t-60 -25h-391v595h199l30 232h-229v148q0 56 23.5 84t91.5 28l122 1v207q-63 9 -178 9q-136 0 -217.5 -80t-81.5 -226v-171h-200v-232h200v-595h-735q-35 0 -60 25t-25 60v1366q0 35 25 60t60 25h1366z" />
+    <glyph glyph-name="_526" unicode="&#xf231;" horiz-adv-x="1280" 
+d="M0 939q0 108 37.5 203.5t103.5 166.5t152 123t185 78t202 26q158 0 294 -66.5t221 -193.5t85 -287q0 -96 -19 -188t-60 -177t-100 -149.5t-145 -103t-189 -38.5q-68 0 -135 32t-96 88q-10 -39 -28 -112.5t-23.5 -95t-20.5 -71t-26 -71t-32 -62.5t-46 -77.5t-62 -86.5
+l-14 -5l-9 10q-15 157 -15 188q0 92 21.5 206.5t66.5 287.5t52 203q-32 65 -32 169q0 83 52 156t132 73q61 0 95 -40.5t34 -102.5q0 -66 -44 -191t-44 -187q0 -63 45 -104.5t109 -41.5q55 0 102 25t78.5 68t56 95t38 110.5t20 111t6.5 99.5q0 173 -109.5 269.5t-285.5 96.5
+q-200 0 -334 -129.5t-134 -328.5q0 -44 12.5 -85t27 -65t27 -45.5t12.5 -30.5q0 -28 -15 -73t-37 -45q-2 0 -17 3q-51 15 -90.5 56t-61 94.5t-32.5 108t-11 106.5z" />
+    <glyph glyph-name="_527" unicode="&#xf232;" 
+d="M985 562q13 0 97.5 -44t89.5 -53q2 -5 2 -15q0 -33 -17 -76q-16 -39 -71 -65.5t-102 -26.5q-57 0 -190 62q-98 45 -170 118t-148 185q-72 107 -71 194v8q3 91 74 158q24 22 52 22q6 0 18 -1.5t19 -1.5q19 0 26.5 -6.5t15.5 -27.5q8 -20 33 -88t25 -75q0 -21 -34.5 -57.5
+t-34.5 -46.5q0 -7 5 -15q34 -73 102 -137q56 -53 151 -101q12 -7 22 -7q15 0 54 48.5t52 48.5zM782 32q127 0 243.5 50t200.5 134t134 200.5t50 243.5t-50 243.5t-134 200.5t-200.5 134t-243.5 50t-243.5 -50t-200.5 -134t-134 -200.5t-50 -243.5q0 -203 120 -368l-79 -233
+l242 77q158 -104 345 -104zM782 1414q153 0 292.5 -60t240.5 -161t161 -240.5t60 -292.5t-60 -292.5t-161 -240.5t-240.5 -161t-292.5 -60q-195 0 -365 94l-417 -134l136 405q-108 178 -108 389q0 153 60 292.5t161 240.5t240.5 161t292.5 60z" />
+    <glyph glyph-name="_528" unicode="&#xf233;" horiz-adv-x="1792" 
+d="M128 128h1024v128h-1024v-128zM128 640h1024v128h-1024v-128zM1696 192q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM128 1152h1024v128h-1024v-128zM1696 704q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM1696 1216
+q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM1792 384v-384h-1792v384h1792zM1792 896v-384h-1792v384h1792zM1792 1408v-384h-1792v384h1792z" />
+    <glyph glyph-name="_529" unicode="&#xf234;" horiz-adv-x="2048" 
+d="M704 640q-159 0 -271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5t271.5 -112.5t112.5 -271.5t-112.5 -271.5t-271.5 -112.5zM1664 512h352q13 0 22.5 -9.5t9.5 -22.5v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-352v-352q0 -13 -9.5 -22.5t-22.5 -9.5h-192q-13 0 -22.5 9.5
+t-9.5 22.5v352h-352q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h352v352q0 13 9.5 22.5t22.5 9.5h192q13 0 22.5 -9.5t9.5 -22.5v-352zM928 288q0 -52 38 -90t90 -38h256v-238q-68 -50 -171 -50h-874q-121 0 -194 69t-73 190q0 53 3.5 103.5t14 109t26.5 108.5
+t43 97.5t62 81t85.5 53.5t111.5 20q19 0 39 -17q79 -61 154.5 -91.5t164.5 -30.5t164.5 30.5t154.5 91.5q20 17 39 17q132 0 217 -96h-223q-52 0 -90 -38t-38 -90v-192z" />
+    <glyph glyph-name="_530" unicode="&#xf235;" horiz-adv-x="2048" 
+d="M704 640q-159 0 -271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5t271.5 -112.5t112.5 -271.5t-112.5 -271.5t-271.5 -112.5zM1781 320l249 -249q9 -9 9 -23q0 -13 -9 -22l-136 -136q-9 -9 -22 -9q-14 0 -23 9l-249 249l-249 -249q-9 -9 -23 -9q-13 0 -22 9l-136 136
+q-9 9 -9 22q0 14 9 23l249 249l-249 249q-9 9 -9 23q0 13 9 22l136 136q9 9 22 9q14 0 23 -9l249 -249l249 249q9 9 23 9q13 0 22 -9l136 -136q9 -9 9 -22q0 -14 -9 -23zM1283 320l-181 -181q-37 -37 -37 -91q0 -53 37 -90l83 -83q-21 -3 -44 -3h-874q-121 0 -194 69
+t-73 190q0 53 3.5 103.5t14 109t26.5 108.5t43 97.5t62 81t85.5 53.5t111.5 20q19 0 39 -17q154 -122 319 -122t319 122q20 17 39 17q28 0 57 -6q-28 -27 -41 -50t-13 -56q0 -54 37 -91z" />
+    <glyph glyph-name="_531" unicode="&#xf236;" horiz-adv-x="2048" 
+d="M256 512h1728q26 0 45 -19t19 -45v-448h-256v256h-1536v-256h-256v1216q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-704zM832 832q0 106 -75 181t-181 75t-181 -75t-75 -181t75 -181t181 -75t181 75t75 181zM2048 576v64q0 159 -112.5 271.5t-271.5 112.5h-704
+q-26 0 -45 -19t-19 -45v-384h1152z" />
+    <glyph glyph-name="_532" unicode="&#xf237;" 
+d="M1536 1536l-192 -448h192v-192h-274l-55 -128h329v-192h-411l-357 -832l-357 832h-411v192h329l-55 128h-274v192h192l-192 448h256l323 -768h378l323 768h256zM768 320l108 256h-216z" />
+    <glyph glyph-name="_533" unicode="&#xf238;" 
+d="M1088 1536q185 0 316.5 -93.5t131.5 -226.5v-896q0 -130 -125.5 -222t-305.5 -97l213 -202q16 -15 8 -35t-30 -20h-1056q-22 0 -30 20t8 35l213 202q-180 5 -305.5 97t-125.5 222v896q0 133 131.5 226.5t316.5 93.5h640zM768 192q80 0 136 56t56 136t-56 136t-136 56
+t-136 -56t-56 -136t56 -136t136 -56zM1344 768v512h-1152v-512h1152z" />
+    <glyph glyph-name="_534" unicode="&#xf239;" 
+d="M1088 1536q185 0 316.5 -93.5t131.5 -226.5v-896q0 -130 -125.5 -222t-305.5 -97l213 -202q16 -15 8 -35t-30 -20h-1056q-22 0 -30 20t8 35l213 202q-180 5 -305.5 97t-125.5 222v896q0 133 131.5 226.5t316.5 93.5h640zM288 224q66 0 113 47t47 113t-47 113t-113 47
+t-113 -47t-47 -113t47 -113t113 -47zM704 768v512h-544v-512h544zM1248 224q66 0 113 47t47 113t-47 113t-113 47t-113 -47t-47 -113t47 -113t113 -47zM1408 768v512h-576v-512h576z" />
+    <glyph glyph-name="_535" unicode="&#xf23a;" horiz-adv-x="1792" 
+d="M597 1115v-1173q0 -25 -12.5 -42.5t-36.5 -17.5q-17 0 -33 8l-465 233q-21 10 -35.5 33.5t-14.5 46.5v1140q0 20 10 34t29 14q14 0 44 -15l511 -256q3 -3 3 -5zM661 1014l534 -866l-534 266v600zM1792 996v-1054q0 -25 -14 -40.5t-38 -15.5t-47 13l-441 220zM1789 1116
+q0 -3 -256.5 -419.5t-300.5 -487.5l-390 634l324 527q17 28 52 28q14 0 26 -6l541 -270q4 -2 4 -6z" />
+    <glyph glyph-name="_536" unicode="&#xf23b;" 
+d="M809 532l266 499h-112l-157 -312q-24 -48 -44 -92l-42 92l-155 312h-120l263 -493v-324h101v318zM1536 1408v-1536h-1536v1536h1536z" />
+    <glyph glyph-name="_537" unicode="&#xf23c;" horiz-adv-x="2296" 
+d="M478 -139q-8 -16 -27 -34.5t-37 -25.5q-25 -9 -51.5 3.5t-28.5 31.5q-1 22 40 55t68 38q23 4 34 -21.5t2 -46.5zM1819 -139q7 -16 26 -34.5t38 -25.5q25 -9 51.5 3.5t27.5 31.5q2 22 -39.5 55t-68.5 38q-22 4 -33 -21.5t-2 -46.5zM1867 -30q13 -27 56.5 -59.5t77.5 -41.5
+q45 -13 82 4.5t37 50.5q0 46 -67.5 100.5t-115.5 59.5q-40 5 -63.5 -37.5t-6.5 -76.5zM428 -30q-13 -27 -56 -59.5t-77 -41.5q-45 -13 -82 4.5t-37 50.5q0 46 67.5 100.5t115.5 59.5q40 5 63 -37.5t6 -76.5zM1158 1094h1q-41 0 -76 -15q27 -8 44 -30.5t17 -49.5
+q0 -35 -27 -60t-65 -25q-52 0 -80 43q-5 -23 -5 -42q0 -74 56 -126.5t135 -52.5q80 0 136 52.5t56 126.5t-56 126.5t-136 52.5zM1462 1312q-99 109 -220.5 131.5t-245.5 -44.5q27 60 82.5 96.5t118 39.5t121.5 -17t99.5 -74.5t44.5 -131.5zM2212 73q8 -11 -11 -42
+q7 -23 7 -40q1 -56 -44.5 -112.5t-109.5 -91.5t-118 -37q-48 -2 -92 21.5t-66 65.5q-687 -25 -1259 0q-23 -41 -66.5 -65t-92.5 -22q-86 3 -179.5 80.5t-92.5 160.5q2 22 7 40q-19 31 -11 42q6 10 31 1q14 22 41 51q-7 29 2 38q11 10 39 -4q29 20 59 34q0 29 13 37
+q23 12 51 -16q35 5 61 -2q18 -4 38 -19v73q-11 0 -18 2q-53 10 -97 44.5t-55 87.5q-9 38 0 81q15 62 93 95q2 17 19 35.5t36 23.5t33 -7.5t19 -30.5h13q46 -5 60 -23q3 -3 5 -7q10 1 30.5 3.5t30.5 3.5q-15 11 -30 17q-23 40 -91 43q0 6 1 10q-62 2 -118.5 18.5t-84.5 47.5
+q-32 36 -42.5 92t-2.5 112q16 126 90 179q23 16 52 4.5t32 -40.5q0 -1 1.5 -14t2.5 -21t3 -20t5.5 -19t8.5 -10q27 -14 76 -12q48 46 98 74q-40 4 -162 -14l47 46q61 58 163 111q145 73 282 86q-20 8 -41 15.5t-47 14t-42.5 10.5t-47.5 11t-43 10q595 126 904 -139
+q98 -84 158 -222q85 -10 121 9h1q5 3 8.5 10t5.5 19t3 19.5t3 21.5l1 14q3 28 32 40t52 -5q73 -52 91 -178q7 -57 -3.5 -113t-42.5 -91q-28 -32 -83.5 -48.5t-115.5 -18.5v-10q-71 -2 -95 -43q-14 -5 -31 -17q11 -1 32 -3.5t30 -3.5q1 5 5 8q16 18 60 23h13q5 18 19 30t33 8
+t36 -23t19 -36q79 -32 93 -95q9 -40 1 -81q-12 -53 -56 -88t-97 -44q-10 -2 -17 -2q0 -49 -1 -73q20 15 38 19q26 7 61 2q28 28 51 16q14 -9 14 -37q33 -16 59 -34q27 13 38 4q10 -10 2 -38q28 -30 41 -51q23 8 31 -1zM1937 1025q0 -29 -9 -54q82 -32 112 -132
+q4 37 -9.5 98.5t-41.5 90.5q-20 19 -36 17t-16 -20zM1859 925q35 -42 47.5 -108.5t-0.5 -124.5q67 13 97 45q13 14 18 28q-3 64 -31 114.5t-79 66.5q-15 -15 -52 -21zM1822 921q-30 0 -44 1q42 -115 53 -239q21 0 43 3q16 68 1 135t-53 100zM258 839q30 100 112 132
+q-9 25 -9 54q0 18 -16.5 20t-35.5 -17q-28 -29 -41.5 -90.5t-9.5 -98.5zM294 737q29 -31 97 -45q-13 58 -0.5 124.5t47.5 108.5v0q-37 6 -52 21q-51 -16 -78.5 -66t-31.5 -115q9 -17 18 -28zM471 683q14 124 73 235q-19 -4 -55 -18l-45 -19v1q-46 -89 -20 -196q25 -3 47 -3z
+M1434 644q8 -38 16.5 -108.5t11.5 -89.5q3 -18 9.5 -21.5t23.5 4.5q40 20 62 85.5t23 125.5q-24 2 -146 4zM1152 1285q-116 0 -199 -82.5t-83 -198.5q0 -117 83 -199.5t199 -82.5t199 82.5t83 199.5q0 116 -83 198.5t-199 82.5zM1380 646q-105 2 -211 0v1q-1 -27 2.5 -86
+t13.5 -66q29 -14 93.5 -14.5t95.5 10.5q9 3 11 39t-0.5 69.5t-4.5 46.5zM1112 447q8 4 9.5 48t-0.5 88t-4 63v1q-212 -3 -214 -3q-4 -20 -7 -62t0 -83t14 -46q34 -15 101 -16t101 10zM718 636q-16 -59 4.5 -118.5t77.5 -84.5q15 -8 24 -5t12 21q3 16 8 90t10 103
+q-69 -2 -136 -6zM591 510q3 -23 -34 -36q132 -141 271.5 -240t305.5 -154q172 49 310.5 146t293.5 250q-33 13 -30 34q0 2 0.5 3.5t1.5 3t1 2.5v1v-1q-17 2 -50 5.5t-48 4.5q-26 -90 -82 -132q-51 -38 -82 1q-5 6 -9 14q-7 13 -17 62q-2 -5 -5 -9t-7.5 -7t-8 -5.5t-9.5 -4
+l-10 -2.5t-12 -2l-12 -1.5t-13.5 -1t-13.5 -0.5q-106 -9 -163 11q-4 -17 -10 -26.5t-21 -15t-23 -7t-36 -3.5q-6 -1 -9 -1q-179 -17 -203 40q-2 -63 -56 -54q-47 8 -91 54q-12 13 -20 26q-17 29 -26 65q-58 -6 -87 -10q1 -2 4 -10zM507 -118q3 14 3 30q-17 71 -51 130
+t-73 70q-41 12 -101.5 -14.5t-104.5 -80t-39 -107.5q35 -53 100 -93t119 -42q51 -2 94 28t53 79zM510 53q23 -63 27 -119q195 113 392 174q-98 52 -180.5 120t-179.5 165q-6 -4 -29 -13q0 -1 -1 -4t-1 -5q31 -18 22 -37q-12 -23 -56 -34q-10 -13 -29 -24h-1q-2 -83 1 -150
+q19 -34 35 -73zM579 -113q532 -21 1145 0q-254 147 -428 196q-76 -35 -156 -57q-8 -3 -16 0q-65 21 -129 49q-208 -60 -416 -188h-1v-1q1 0 1 1zM1763 -67q4 54 28 120q14 38 33 71l-1 -1q3 77 3 153q-15 8 -30 25q-42 9 -56 33q-9 20 22 38q-2 4 -2 9q-16 4 -28 12
+q-204 -190 -383 -284q198 -59 414 -176zM2155 -90q5 54 -39 107.5t-104 80t-102 14.5q-38 -11 -72.5 -70.5t-51.5 -129.5q0 -16 3 -30q10 -49 53 -79t94 -28q54 2 119 42t100 93z" />
+    <glyph glyph-name="_538" unicode="&#xf23d;" horiz-adv-x="2304" 
+d="M1524 -25q0 -68 -48 -116t-116 -48t-116.5 48t-48.5 116t48.5 116.5t116.5 48.5t116 -48.5t48 -116.5zM775 -25q0 -68 -48.5 -116t-116.5 -48t-116 48t-48 116t48 116.5t116 48.5t116.5 -48.5t48.5 -116.5zM0 1469q57 -60 110.5 -104.5t121 -82t136 -63t166 -45.5
+t200 -31.5t250 -18.5t304 -9.5t372.5 -2.5q139 0 244.5 -5t181 -16.5t124 -27.5t71 -39.5t24 -51.5t-19.5 -64t-56.5 -76.5t-89.5 -91t-116 -104.5t-139 -119q-185 -157 -286 -247q29 51 76.5 109t94 105.5t94.5 98.5t83 91.5t54 80.5t13 70t-45.5 55.5t-116.5 41t-204 23.5
+t-304 5q-168 -2 -314 6t-256 23t-204.5 41t-159.5 51.5t-122.5 62.5t-91.5 66.5t-68 71.5t-50.5 69.5t-40 68t-36.5 59.5z" />
+    <glyph glyph-name="_539" unicode="&#xf23e;" horiz-adv-x="1792" 
+d="M896 1472q-169 0 -323 -66t-265.5 -177.5t-177.5 -265.5t-66 -323t66 -323t177.5 -265.5t265.5 -177.5t323 -66t323 66t265.5 177.5t177.5 265.5t66 323t-66 323t-177.5 265.5t-265.5 177.5t-323 66zM896 1536q182 0 348 -71t286 -191t191 -286t71 -348t-71 -348
+t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71zM496 704q16 0 16 -16v-480q0 -16 -16 -16h-32q-16 0 -16 16v480q0 16 16 16h32zM896 640q53 0 90.5 -37.5t37.5 -90.5q0 -35 -17.5 -64t-46.5 -46v-114q0 -14 -9 -23
+t-23 -9h-64q-14 0 -23 9t-9 23v114q-29 17 -46.5 46t-17.5 64q0 53 37.5 90.5t90.5 37.5zM896 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5t-103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103zM544 928v-96
+q0 -14 9 -23t23 -9h64q14 0 23 9t9 23v96q0 93 65.5 158.5t158.5 65.5t158.5 -65.5t65.5 -158.5v-96q0 -14 9 -23t23 -9h64q14 0 23 9t9 23v96q0 146 -103 249t-249 103t-249 -103t-103 -249zM1408 192v512q0 26 -19 45t-45 19h-896q-26 0 -45 -19t-19 -45v-512
+q0 -26 19 -45t45 -19h896q26 0 45 19t19 45z" />
+    <glyph glyph-name="_540" unicode="&#xf240;" horiz-adv-x="2304" 
+d="M1920 1024v-768h-1664v768h1664zM2048 448h128v384h-128v288q0 14 -9 23t-23 9h-1856q-14 0 -23 -9t-9 -23v-960q0 -14 9 -23t23 -9h1856q14 0 23 9t9 23v288zM2304 832v-384q0 -53 -37.5 -90.5t-90.5 -37.5v-160q0 -66 -47 -113t-113 -47h-1856q-66 0 -113 47t-47 113
+v960q0 66 47 113t113 47h1856q66 0 113 -47t47 -113v-160q53 0 90.5 -37.5t37.5 -90.5z" />
+    <glyph glyph-name="_541" unicode="&#xf241;" horiz-adv-x="2304" 
+d="M256 256v768h1280v-768h-1280zM2176 960q53 0 90.5 -37.5t37.5 -90.5v-384q0 -53 -37.5 -90.5t-90.5 -37.5v-160q0 -66 -47 -113t-113 -47h-1856q-66 0 -113 47t-47 113v960q0 66 47 113t113 47h1856q66 0 113 -47t47 -113v-160zM2176 448v384h-128v288q0 14 -9 23t-23 9
+h-1856q-14 0 -23 -9t-9 -23v-960q0 -14 9 -23t23 -9h1856q14 0 23 9t9 23v288h128z" />
+    <glyph glyph-name="_542" unicode="&#xf242;" horiz-adv-x="2304" 
+d="M256 256v768h896v-768h-896zM2176 960q53 0 90.5 -37.5t37.5 -90.5v-384q0 -53 -37.5 -90.5t-90.5 -37.5v-160q0 -66 -47 -113t-113 -47h-1856q-66 0 -113 47t-47 113v960q0 66 47 113t113 47h1856q66 0 113 -47t47 -113v-160zM2176 448v384h-128v288q0 14 -9 23t-23 9
+h-1856q-14 0 -23 -9t-9 -23v-960q0 -14 9 -23t23 -9h1856q14 0 23 9t9 23v288h128z" />
+    <glyph glyph-name="_543" unicode="&#xf243;" horiz-adv-x="2304" 
+d="M256 256v768h512v-768h-512zM2176 960q53 0 90.5 -37.5t37.5 -90.5v-384q0 -53 -37.5 -90.5t-90.5 -37.5v-160q0 -66 -47 -113t-113 -47h-1856q-66 0 -113 47t-47 113v960q0 66 47 113t113 47h1856q66 0 113 -47t47 -113v-160zM2176 448v384h-128v288q0 14 -9 23t-23 9
+h-1856q-14 0 -23 -9t-9 -23v-960q0 -14 9 -23t23 -9h1856q14 0 23 9t9 23v288h128z" />
+    <glyph glyph-name="_544" unicode="&#xf244;" horiz-adv-x="2304" 
+d="M2176 960q53 0 90.5 -37.5t37.5 -90.5v-384q0 -53 -37.5 -90.5t-90.5 -37.5v-160q0 -66 -47 -113t-113 -47h-1856q-66 0 -113 47t-47 113v960q0 66 47 113t113 47h1856q66 0 113 -47t47 -113v-160zM2176 448v384h-128v288q0 14 -9 23t-23 9h-1856q-14 0 -23 -9t-9 -23
+v-960q0 -14 9 -23t23 -9h1856q14 0 23 9t9 23v288h128z" />
+    <glyph glyph-name="_545" unicode="&#xf245;" horiz-adv-x="1280" 
+d="M1133 493q31 -30 14 -69q-17 -40 -59 -40h-382l201 -476q10 -25 0 -49t-34 -35l-177 -75q-25 -10 -49 0t-35 34l-191 452l-312 -312q-19 -19 -45 -19q-12 0 -24 5q-40 17 -40 59v1504q0 42 40 59q12 5 24 5q27 0 45 -19z" />
+    <glyph glyph-name="_546" unicode="&#xf246;" horiz-adv-x="1024" 
+d="M832 1408q-320 0 -320 -224v-416h128v-128h-128v-544q0 -224 320 -224h64v-128h-64q-272 0 -384 146q-112 -146 -384 -146h-64v128h64q320 0 320 224v544h-128v128h128v416q0 224 -320 224h-64v128h64q272 0 384 -146q112 146 384 146h64v-128h-64z" />
+    <glyph glyph-name="_547" unicode="&#xf247;" horiz-adv-x="2048" 
+d="M2048 1152h-128v-1024h128v-384h-384v128h-1280v-128h-384v384h128v1024h-128v384h384v-128h1280v128h384v-384zM1792 1408v-128h128v128h-128zM128 1408v-128h128v128h-128zM256 -128v128h-128v-128h128zM1664 0v128h128v1024h-128v128h-1280v-128h-128v-1024h128v-128
+h1280zM1920 -128v128h-128v-128h128zM1280 896h384v-768h-896v256h-384v768h896v-256zM512 512h640v512h-640v-512zM1536 256v512h-256v-384h-384v-128h640z" />
+    <glyph glyph-name="_548" unicode="&#xf248;" horiz-adv-x="2304" 
+d="M2304 768h-128v-640h128v-384h-384v128h-896v-128h-384v384h128v128h-384v-128h-384v384h128v640h-128v384h384v-128h896v128h384v-384h-128v-128h384v128h384v-384zM2048 1024v-128h128v128h-128zM1408 1408v-128h128v128h-128zM128 1408v-128h128v128h-128zM256 256
+v128h-128v-128h128zM1536 384h-128v-128h128v128zM384 384h896v128h128v640h-128v128h-896v-128h-128v-640h128v-128zM896 -128v128h-128v-128h128zM2176 -128v128h-128v-128h128zM2048 128v640h-128v128h-384v-384h128v-384h-384v128h-384v-128h128v-128h896v128h128z" />
+    <glyph glyph-name="_549" unicode="&#xf249;" 
+d="M1024 288v-416h-928q-40 0 -68 28t-28 68v1344q0 40 28 68t68 28h1344q40 0 68 -28t28 -68v-928h-416q-40 0 -68 -28t-28 -68zM1152 256h381q-15 -82 -65 -132l-184 -184q-50 -50 -132 -65v381z" />
+    <glyph glyph-name="_550" unicode="&#xf24a;" 
+d="M1400 256h-248v-248q29 10 41 22l185 185q12 12 22 41zM1120 384h288v896h-1280v-1280h896v288q0 40 28 68t68 28zM1536 1312v-1024q0 -40 -20 -88t-48 -76l-184 -184q-28 -28 -76 -48t-88 -20h-1024q-40 0 -68 28t-28 68v1344q0 40 28 68t68 28h1344q40 0 68 -28t28 -68
+z" />
+    <glyph glyph-name="_551" unicode="&#xf24b;" horiz-adv-x="2304" 
+d="M1951 538q0 -26 -15.5 -44.5t-38.5 -23.5q-8 -2 -18 -2h-153v140h153q10 0 18 -2q23 -5 38.5 -23.5t15.5 -44.5zM1933 751q0 -25 -15 -42t-38 -21q-3 -1 -15 -1h-139v129h139q3 0 8.5 -0.5t6.5 -0.5q23 -4 38 -21.5t15 -42.5zM728 587v308h-228v-308q0 -58 -38 -94.5
+t-105 -36.5q-108 0 -229 59v-112q53 -15 121 -23t109 -9l42 -1q328 0 328 217zM1442 403v113q-99 -52 -200 -59q-108 -8 -169 41t-61 142t61 142t169 41q101 -7 200 -58v112q-48 12 -100 19.5t-80 9.5l-28 2q-127 6 -218.5 -14t-140.5 -60t-71 -88t-22 -106t22 -106t71 -88
+t140.5 -60t218.5 -14q101 4 208 31zM2176 518q0 54 -43 88.5t-109 39.5v3q57 8 89 41.5t32 79.5q0 55 -41 88t-107 36q-3 0 -12 0.5t-14 0.5h-455v-510h491q74 0 121.5 36.5t47.5 96.5zM2304 1280v-1280q0 -52 -38 -90t-90 -38h-2048q-52 0 -90 38t-38 90v1280q0 52 38 90
+t90 38h2048q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_552" unicode="&#xf24c;" horiz-adv-x="2304" 
+d="M858 295v693q-106 -41 -172 -135.5t-66 -211.5t66 -211.5t172 -134.5zM1362 641q0 117 -66 211.5t-172 135.5v-694q106 41 172 135.5t66 211.5zM1577 641q0 -159 -78.5 -294t-213.5 -213.5t-294 -78.5q-119 0 -227.5 46.5t-187 125t-125 187t-46.5 227.5q0 159 78.5 294
+t213.5 213.5t294 78.5t294 -78.5t213.5 -213.5t78.5 -294zM1960 634q0 139 -55.5 261.5t-147.5 205.5t-213.5 131t-252.5 48h-301q-176 0 -323.5 -81t-235 -230t-87.5 -335q0 -171 87 -317.5t236 -231.5t323 -85h301q129 0 251.5 50.5t214.5 135t147.5 202.5t55.5 246z
+M2304 1280v-1280q0 -52 -38 -90t-90 -38h-2048q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h2048q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_553" unicode="&#xf24d;" horiz-adv-x="1792" 
+d="M1664 -96v1088q0 13 -9.5 22.5t-22.5 9.5h-1088q-13 0 -22.5 -9.5t-9.5 -22.5v-1088q0 -13 9.5 -22.5t22.5 -9.5h1088q13 0 22.5 9.5t9.5 22.5zM1792 992v-1088q0 -66 -47 -113t-113 -47h-1088q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h1088q66 0 113 -47t47 -113
+zM1408 1376v-160h-128v160q0 13 -9.5 22.5t-22.5 9.5h-1088q-13 0 -22.5 -9.5t-9.5 -22.5v-1088q0 -13 9.5 -22.5t22.5 -9.5h160v-128h-160q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h1088q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="_554" unicode="&#xf24e;" horiz-adv-x="2304" 
+d="M1728 1088l-384 -704h768zM448 1088l-384 -704h768zM1269 1280q-14 -40 -45.5 -71.5t-71.5 -45.5v-1291h608q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-1344q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h608v1291q-40 14 -71.5 45.5t-45.5 71.5h-491q-14 0 -23 9t-9 23v64
+q0 14 9 23t23 9h491q21 57 70 92.5t111 35.5t111 -35.5t70 -92.5h491q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-491zM1088 1264q33 0 56.5 23.5t23.5 56.5t-23.5 56.5t-56.5 23.5t-56.5 -23.5t-23.5 -56.5t23.5 -56.5t56.5 -23.5zM2176 384q0 -73 -46.5 -131t-117.5 -91
+t-144.5 -49.5t-139.5 -16.5t-139.5 16.5t-144.5 49.5t-117.5 91t-46.5 131q0 11 35 81t92 174.5t107 195.5t102 184t56 100q18 33 56 33t56 -33q4 -7 56 -100t102 -184t107 -195.5t92 -174.5t35 -81zM896 384q0 -73 -46.5 -131t-117.5 -91t-144.5 -49.5t-139.5 -16.5
+t-139.5 16.5t-144.5 49.5t-117.5 91t-46.5 131q0 11 35 81t92 174.5t107 195.5t102 184t56 100q18 33 56 33t56 -33q4 -7 56 -100t102 -184t107 -195.5t92 -174.5t35 -81z" />
+    <glyph glyph-name="_555" unicode="&#xf250;" 
+d="M1408 1408q0 -261 -106.5 -461.5t-266.5 -306.5q160 -106 266.5 -306.5t106.5 -461.5h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-1472q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96q0 261 106.5 461.5t266.5 306.5q-160 106 -266.5 306.5t-106.5 461.5h-96q-14 0 -23 9
+t-9 23v64q0 14 9 23t23 9h1472q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96zM874 700q77 29 149 92.5t129.5 152.5t92.5 210t35 253h-1024q0 -132 35 -253t92.5 -210t129.5 -152.5t149 -92.5q19 -7 30.5 -23.5t11.5 -36.5t-11.5 -36.5t-30.5 -23.5q-77 -29 -149 -92.5
+t-129.5 -152.5t-92.5 -210t-35 -253h1024q0 132 -35 253t-92.5 210t-129.5 152.5t-149 92.5q-19 7 -30.5 23.5t-11.5 36.5t11.5 36.5t30.5 23.5z" />
+    <glyph glyph-name="_556" unicode="&#xf251;" 
+d="M1408 1408q0 -261 -106.5 -461.5t-266.5 -306.5q160 -106 266.5 -306.5t106.5 -461.5h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-1472q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96q0 261 106.5 461.5t266.5 306.5q-160 106 -266.5 306.5t-106.5 461.5h-96q-14 0 -23 9
+t-9 23v64q0 14 9 23t23 9h1472q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96zM1280 1408h-1024q0 -66 9 -128h1006q9 61 9 128zM1280 -128q0 130 -34 249.5t-90.5 208t-126.5 152t-146 94.5h-230q-76 -31 -146 -94.5t-126.5 -152t-90.5 -208t-34 -249.5h1024z" />
+    <glyph glyph-name="_557" unicode="&#xf252;" 
+d="M1408 1408q0 -261 -106.5 -461.5t-266.5 -306.5q160 -106 266.5 -306.5t106.5 -461.5h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-1472q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96q0 261 106.5 461.5t266.5 306.5q-160 106 -266.5 306.5t-106.5 461.5h-96q-14 0 -23 9
+t-9 23v64q0 14 9 23t23 9h1472q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96zM1280 1408h-1024q0 -206 85 -384h854q85 178 85 384zM1223 192q-54 141 -145.5 241.5t-194.5 142.5h-230q-103 -42 -194.5 -142.5t-145.5 -241.5h910z" />
+    <glyph glyph-name="_558" unicode="&#xf253;" 
+d="M1408 1408q0 -261 -106.5 -461.5t-266.5 -306.5q160 -106 266.5 -306.5t106.5 -461.5h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-1472q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96q0 261 106.5 461.5t266.5 306.5q-160 106 -266.5 306.5t-106.5 461.5h-96q-14 0 -23 9
+t-9 23v64q0 14 9 23t23 9h1472q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96zM874 700q77 29 149 92.5t129.5 152.5t92.5 210t35 253h-1024q0 -132 35 -253t92.5 -210t129.5 -152.5t149 -92.5q19 -7 30.5 -23.5t11.5 -36.5t-11.5 -36.5t-30.5 -23.5q-137 -51 -244 -196
+h700q-107 145 -244 196q-19 7 -30.5 23.5t-11.5 36.5t11.5 36.5t30.5 23.5z" />
+    <glyph glyph-name="_559" unicode="&#xf254;" 
+d="M1504 -64q14 0 23 -9t9 -23v-128q0 -14 -9 -23t-23 -9h-1472q-14 0 -23 9t-9 23v128q0 14 9 23t23 9h1472zM130 0q3 55 16 107t30 95t46 87t53.5 76t64.5 69.5t66 60t70.5 55t66.5 47.5t65 43q-43 28 -65 43t-66.5 47.5t-70.5 55t-66 60t-64.5 69.5t-53.5 76t-46 87
+t-30 95t-16 107h1276q-3 -55 -16 -107t-30 -95t-46 -87t-53.5 -76t-64.5 -69.5t-66 -60t-70.5 -55t-66.5 -47.5t-65 -43q43 -28 65 -43t66.5 -47.5t70.5 -55t66 -60t64.5 -69.5t53.5 -76t46 -87t30 -95t16 -107h-1276zM1504 1536q14 0 23 -9t9 -23v-128q0 -14 -9 -23t-23 -9
+h-1472q-14 0 -23 9t-9 23v128q0 14 9 23t23 9h1472z" />
+    <glyph glyph-name="_560" unicode="&#xf255;" 
+d="M768 1152q-53 0 -90.5 -37.5t-37.5 -90.5v-128h-32v93q0 48 -32 81.5t-80 33.5q-46 0 -79 -33t-33 -79v-429l-32 30v172q0 48 -32 81.5t-80 33.5q-46 0 -79 -33t-33 -79v-224q0 -47 35 -82l310 -296q39 -39 39 -102q0 -26 19 -45t45 -19h640q26 0 45 19t19 45v25
+q0 41 10 77l108 436q10 36 10 77v246q0 48 -32 81.5t-80 33.5q-46 0 -79 -33t-33 -79v-32h-32v125q0 40 -25 72.5t-64 40.5q-14 2 -23 2q-46 0 -79 -33t-33 -79v-128h-32v122q0 51 -32.5 89.5t-82.5 43.5q-5 1 -13 1zM768 1280q84 0 149 -50q57 34 123 34q59 0 111 -27
+t86 -76q27 7 59 7q100 0 170 -71.5t70 -171.5v-246q0 -51 -13 -108l-109 -436q-6 -24 -6 -71q0 -80 -56 -136t-136 -56h-640q-84 0 -138 58.5t-54 142.5l-308 296q-76 73 -76 175v224q0 99 70.5 169.5t169.5 70.5q11 0 16 -1q6 95 75.5 160t164.5 65q52 0 98 -21
+q72 69 174 69z" />
+    <glyph glyph-name="_561" unicode="&#xf256;" horiz-adv-x="1792" 
+d="M880 1408q-46 0 -79 -33t-33 -79v-656h-32v528q0 46 -33 79t-79 33t-79 -33t-33 -79v-528v-256l-154 205q-38 51 -102 51q-53 0 -90.5 -37.5t-37.5 -90.5q0 -43 26 -77l384 -512q38 -51 102 -51h688q34 0 61 22t34 56l76 405q5 32 5 59v498q0 46 -33 79t-79 33t-79 -33
+t-33 -79v-272h-32v528q0 46 -33 79t-79 33t-79 -33t-33 -79v-528h-32v656q0 46 -33 79t-79 33zM880 1536q68 0 125.5 -35.5t88.5 -96.5q19 4 42 4q99 0 169.5 -70.5t70.5 -169.5v-17q105 6 180.5 -64t75.5 -175v-498q0 -40 -8 -83l-76 -404q-14 -79 -76.5 -131t-143.5 -52
+h-688q-60 0 -114.5 27.5t-90.5 74.5l-384 512q-51 68 -51 154q0 106 75 181t181 75q78 0 128 -34v434q0 99 70.5 169.5t169.5 70.5q23 0 42 -4q31 61 88.5 96.5t125.5 35.5z" />
+    <glyph glyph-name="_562" unicode="&#xf257;" horiz-adv-x="1792" 
+d="M1073 -128h-177q-163 0 -226 141q-23 49 -23 102v5q-62 30 -98.5 88.5t-36.5 127.5q0 38 5 48h-261q-106 0 -181 75t-75 181t75 181t181 75h113l-44 17q-74 28 -119.5 93.5t-45.5 145.5q0 106 75 181t181 75q46 0 91 -17l628 -239h401q106 0 181 -75t75 -181v-668
+q0 -88 -54 -157.5t-140 -90.5l-339 -85q-92 -23 -186 -23zM1024 583l-155 -71l-163 -74q-30 -14 -48 -41.5t-18 -60.5q0 -46 33 -79t79 -33q26 0 46 10l338 154q-49 10 -80.5 50t-31.5 90v55zM1344 272q0 46 -33 79t-79 33q-26 0 -46 -10l-290 -132q-28 -13 -37 -17
+t-30.5 -17t-29.5 -23.5t-16 -29t-8 -40.5q0 -50 31.5 -82t81.5 -32q20 0 38 9l352 160q30 14 48 41.5t18 60.5zM1112 1024l-650 248q-24 8 -46 8q-53 0 -90.5 -37.5t-37.5 -90.5q0 -40 22.5 -73t59.5 -47l526 -200v-64h-640q-53 0 -90.5 -37.5t-37.5 -90.5t37.5 -90.5
+t90.5 -37.5h535l233 106v198q0 63 46 106l111 102h-69zM1073 0q82 0 155 19l339 85q43 11 70 45.5t27 78.5v668q0 53 -37.5 90.5t-90.5 37.5h-308l-136 -126q-36 -33 -36 -82v-296q0 -46 33 -77t79 -31t79 35t33 81v208h32v-208q0 -70 -57 -114q52 -8 86.5 -48.5t34.5 -93.5
+q0 -42 -23 -78t-61 -53l-310 -141h91z" />
+    <glyph glyph-name="_563" unicode="&#xf258;" horiz-adv-x="2048" 
+d="M1151 1536q61 0 116 -28t91 -77l572 -781q118 -159 118 -359v-355q0 -80 -56 -136t-136 -56h-384q-80 0 -136 56t-56 136v177l-286 143h-546q-80 0 -136 56t-56 136v32q0 119 84.5 203.5t203.5 84.5h420l42 128h-686q-100 0 -173.5 67.5t-81.5 166.5q-65 79 -65 182v32
+q0 80 56 136t136 56h959zM1920 -64v355q0 157 -93 284l-573 781q-39 52 -103 52h-959q-26 0 -45 -19t-19 -45q0 -32 1.5 -49.5t9.5 -40.5t25 -43q10 31 35.5 50t56.5 19h832v-32h-832q-26 0 -45 -19t-19 -45q0 -44 3 -58q8 -44 44 -73t81 -29h640h91q40 0 68 -28t28 -68
+q0 -15 -5 -30l-64 -192q-10 -29 -35 -47.5t-56 -18.5h-443q-66 0 -113 -47t-47 -113v-32q0 -26 19 -45t45 -19h561q16 0 29 -7l317 -158q24 -13 38.5 -36t14.5 -50v-197q0 -26 19 -45t45 -19h384q26 0 45 19t19 45z" />
+    <glyph glyph-name="_564" unicode="&#xf259;" horiz-adv-x="2048" 
+d="M459 -256q-77 0 -137.5 47.5t-79.5 122.5l-101 401q-13 57 -13 108q0 45 -5 67l-116 477q-7 27 -7 57q0 93 62 161t155 78q17 85 82.5 139t152.5 54q83 0 148 -51.5t85 -132.5l83 -348l103 428q20 81 85 132.5t148 51.5q89 0 155.5 -57.5t80.5 -144.5q92 -10 152 -79
+t60 -162q0 -24 -7 -59l-123 -512q10 7 37.5 28.5t38.5 29.5t35 23t41 20.5t41.5 11t49.5 5.5q105 0 180 -74t75 -179q0 -62 -28.5 -118t-78.5 -94l-507 -380q-68 -51 -153 -51h-694zM1104 1408q-38 0 -68.5 -24t-39.5 -62l-164 -682h-127l-145 602q-9 38 -39.5 62t-68.5 24
+q-48 0 -80 -33t-32 -80q0 -15 3 -28l132 -547h-26l-99 408q-9 37 -40 62.5t-69 25.5q-47 0 -80 -33t-33 -79q0 -14 3 -26l116 -478q7 -28 9 -86t10 -88l100 -401q8 -32 34 -52.5t59 -20.5h694q42 0 76 26l507 379q56 43 56 110q0 52 -37.5 88.5t-89.5 36.5q-43 0 -77 -26
+l-307 -230v227q0 4 32 138t68 282t39 161q4 18 4 29q0 47 -32 81t-79 34q-39 0 -69.5 -24t-39.5 -62l-116 -482h-26l150 624q3 14 3 28q0 48 -31.5 82t-79.5 34z" />
+    <glyph glyph-name="_565" unicode="&#xf25a;" horiz-adv-x="1792" 
+d="M640 1408q-53 0 -90.5 -37.5t-37.5 -90.5v-512v-384l-151 202q-41 54 -107 54q-52 0 -89 -38t-37 -90q0 -43 26 -77l384 -512q38 -51 102 -51h718q22 0 39.5 13.5t22.5 34.5l92 368q24 96 24 194v217q0 41 -28 71t-68 30t-68 -28t-28 -68h-32v61q0 48 -32 81.5t-80 33.5
+q-46 0 -79 -33t-33 -79v-64h-32v90q0 55 -37 94.5t-91 39.5q-53 0 -90.5 -37.5t-37.5 -90.5v-96h-32v570q0 55 -37 94.5t-91 39.5zM640 1536q107 0 181.5 -77.5t74.5 -184.5v-220q22 2 32 2q99 0 173 -69q47 21 99 21q113 0 184 -87q27 7 56 7q94 0 159 -67.5t65 -161.5
+v-217q0 -116 -28 -225l-92 -368q-16 -64 -68 -104.5t-118 -40.5h-718q-60 0 -114.5 27.5t-90.5 74.5l-384 512q-51 68 -51 154q0 105 74.5 180.5t179.5 75.5q71 0 130 -35v547q0 106 75 181t181 75zM768 128v384h-32v-384h32zM1024 128v384h-32v-384h32zM1280 128v384h-32
+v-384h32z" />
+    <glyph glyph-name="_566" unicode="&#xf25b;" 
+d="M1288 889q60 0 107 -23q141 -63 141 -226v-177q0 -94 -23 -186l-85 -339q-21 -86 -90.5 -140t-157.5 -54h-668q-106 0 -181 75t-75 181v401l-239 628q-17 45 -17 91q0 106 75 181t181 75q80 0 145.5 -45.5t93.5 -119.5l17 -44v113q0 106 75 181t181 75t181 -75t75 -181
+v-261q27 5 48 5q69 0 127.5 -36.5t88.5 -98.5zM1072 896q-33 0 -60.5 -18t-41.5 -48l-74 -163l-71 -155h55q50 0 90 -31.5t50 -80.5l154 338q10 20 10 46q0 46 -33 79t-79 33zM1293 761q-22 0 -40.5 -8t-29 -16t-23.5 -29.5t-17 -30.5t-17 -37l-132 -290q-10 -20 -10 -46
+q0 -46 33 -79t79 -33q33 0 60.5 18t41.5 48l160 352q9 18 9 38q0 50 -32 81.5t-82 31.5zM128 1120q0 -22 8 -46l248 -650v-69l102 111q43 46 106 46h198l106 233v535q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5v-640h-64l-200 526q-14 37 -47 59.5t-73 22.5
+q-53 0 -90.5 -37.5t-37.5 -90.5zM1180 -128q44 0 78.5 27t45.5 70l85 339q19 73 19 155v91l-141 -310q-17 -38 -53 -61t-78 -23q-53 0 -93.5 34.5t-48.5 86.5q-44 -57 -114 -57h-208v32h208q46 0 81 33t35 79t-31 79t-77 33h-296q-49 0 -82 -36l-126 -136v-308
+q0 -53 37.5 -90.5t90.5 -37.5h668z" />
+    <glyph glyph-name="_567" unicode="&#xf25c;" horiz-adv-x="1973" 
+d="M857 992v-117q0 -13 -9.5 -22t-22.5 -9h-298v-812q0 -13 -9 -22.5t-22 -9.5h-135q-13 0 -22.5 9t-9.5 23v812h-297q-13 0 -22.5 9t-9.5 22v117q0 14 9 23t23 9h793q13 0 22.5 -9.5t9.5 -22.5zM1895 995l77 -961q1 -13 -8 -24q-10 -10 -23 -10h-134q-12 0 -21 8.5
+t-10 20.5l-46 588l-189 -425q-8 -19 -29 -19h-120q-20 0 -29 19l-188 427l-45 -590q-1 -12 -10 -20.5t-21 -8.5h-135q-13 0 -23 10q-9 10 -9 24l78 961q1 12 10 20.5t21 8.5h142q20 0 29 -19l220 -520q10 -24 20 -51q3 7 9.5 24.5t10.5 26.5l221 520q9 19 29 19h141
+q13 0 22 -8.5t10 -20.5z" />
+    <glyph glyph-name="_568" unicode="&#xf25d;" horiz-adv-x="1792" 
+d="M1042 833q0 88 -60 121q-33 18 -117 18h-123v-281h162q66 0 102 37t36 105zM1094 548l205 -373q8 -17 -1 -31q-8 -16 -27 -16h-152q-20 0 -28 17l-194 365h-155v-350q0 -14 -9 -23t-23 -9h-134q-14 0 -23 9t-9 23v960q0 14 9 23t23 9h294q128 0 190 -24q85 -31 134 -109
+t49 -180q0 -92 -42.5 -165.5t-115.5 -109.5q6 -10 9 -16zM896 1376q-150 0 -286 -58.5t-234.5 -157t-157 -234.5t-58.5 -286t58.5 -286t157 -234.5t234.5 -157t286 -58.5t286 58.5t234.5 157t157 234.5t58.5 286t-58.5 286t-157 234.5t-234.5 157t-286 58.5zM1792 640
+q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="_569" unicode="&#xf25e;" horiz-adv-x="1792" 
+d="M605 303q153 0 257 104q14 18 3 36l-45 82q-6 13 -24 17q-16 2 -27 -11l-4 -3q-4 -4 -11.5 -10t-17.5 -13.5t-23.5 -14.5t-28.5 -13t-33.5 -9.5t-37.5 -3.5q-76 0 -125 50t-49 127q0 76 48 125.5t122 49.5q37 0 71.5 -14t50.5 -28l16 -14q11 -11 26 -10q16 2 24 14l53 78
+q13 20 -2 39q-3 4 -11 12t-30 23.5t-48.5 28t-67.5 22.5t-86 10q-148 0 -246 -96.5t-98 -240.5q0 -146 97 -241.5t247 -95.5zM1235 303q153 0 257 104q14 18 4 36l-45 82q-8 14 -25 17q-16 2 -27 -11l-4 -3q-4 -4 -11.5 -10t-17.5 -13.5t-23.5 -14.5t-28.5 -13t-33.5 -9.5
+t-37.5 -3.5q-76 0 -125 50t-49 127q0 76 48 125.5t122 49.5q37 0 71.5 -14t50.5 -28l16 -14q11 -11 26 -10q16 2 24 14l53 78q13 20 -2 39q-3 4 -11 12t-30 23.5t-48.5 28t-67.5 22.5t-86 10q-147 0 -245.5 -96.5t-98.5 -240.5q0 -146 97 -241.5t247 -95.5zM896 1376
+q-150 0 -286 -58.5t-234.5 -157t-157 -234.5t-58.5 -286t58.5 -286t157 -234.5t234.5 -157t286 -58.5t286 58.5t234.5 157t157 234.5t58.5 286t-58.5 286t-157 234.5t-234.5 157t-286 58.5zM896 1536q182 0 348 -71t286 -191t191 -286t71 -348t-71 -348t-191 -286t-286 -191
+t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71z" />
+    <glyph glyph-name="f260" unicode="&#xf260;" horiz-adv-x="2048" 
+d="M736 736l384 -384l-384 -384l-672 672l672 672l168 -168l-96 -96l-72 72l-480 -480l480 -480l193 193l-289 287zM1312 1312l672 -672l-672 -672l-168 168l96 96l72 -72l480 480l-480 480l-193 -193l289 -287l-96 -96l-384 384z" />
+    <glyph glyph-name="f261" unicode="&#xf261;" horiz-adv-x="1792" 
+d="M717 182l271 271l-279 279l-88 -88l192 -191l-96 -96l-279 279l279 279l40 -40l87 87l-127 128l-454 -454zM1075 190l454 454l-454 454l-271 -271l279 -279l88 88l-192 191l96 96l279 -279l-279 -279l-40 40l-87 -88zM1792 640q0 -182 -71 -348t-191 -286t-286 -191
+t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="_572" unicode="&#xf262;" horiz-adv-x="2304" 
+d="M651 539q0 -39 -27.5 -66.5t-65.5 -27.5q-39 0 -66.5 27.5t-27.5 66.5q0 38 27.5 65.5t66.5 27.5q38 0 65.5 -27.5t27.5 -65.5zM1805 540q0 -39 -27.5 -66.5t-66.5 -27.5t-66.5 27.5t-27.5 66.5t27.5 66t66.5 27t66.5 -27t27.5 -66zM765 539q0 79 -56.5 136t-136.5 57
+t-136.5 -56.5t-56.5 -136.5t56.5 -136.5t136.5 -56.5t136.5 56.5t56.5 136.5zM1918 540q0 80 -56.5 136.5t-136.5 56.5q-79 0 -136 -56.5t-57 -136.5t56.5 -136.5t136.5 -56.5t136.5 56.5t56.5 136.5zM850 539q0 -116 -81.5 -197.5t-196.5 -81.5q-116 0 -197.5 82t-81.5 197
+t82 196.5t197 81.5t196.5 -81.5t81.5 -196.5zM2004 540q0 -115 -81.5 -196.5t-197.5 -81.5q-115 0 -196.5 81.5t-81.5 196.5t81.5 196.5t196.5 81.5q116 0 197.5 -81.5t81.5 -196.5zM1040 537q0 191 -135.5 326.5t-326.5 135.5q-125 0 -231 -62t-168 -168.5t-62 -231.5
+t62 -231.5t168 -168.5t231 -62q191 0 326.5 135.5t135.5 326.5zM1708 1110q-254 111 -556 111q-319 0 -573 -110q117 0 223 -45.5t182.5 -122.5t122 -183t45.5 -223q0 115 43.5 219.5t118 180.5t177.5 123t217 50zM2187 537q0 191 -135 326.5t-326 135.5t-326.5 -135.5
+t-135.5 -326.5t135.5 -326.5t326.5 -135.5t326 135.5t135 326.5zM1921 1103h383q-44 -51 -75 -114.5t-40 -114.5q110 -151 110 -337q0 -156 -77 -288t-209 -208.5t-287 -76.5q-133 0 -249 56t-196 155q-47 -56 -129 -179q-11 22 -53.5 82.5t-74.5 97.5
+q-80 -99 -196.5 -155.5t-249.5 -56.5q-155 0 -287 76.5t-209 208.5t-77 288q0 186 110 337q-9 51 -40 114.5t-75 114.5h365q149 100 355 156.5t432 56.5q224 0 421 -56t348 -157z" />
+    <glyph glyph-name="f263" unicode="&#xf263;" horiz-adv-x="1280" 
+d="M640 629q-188 0 -321 133t-133 320q0 188 133 321t321 133t321 -133t133 -321q0 -187 -133 -320t-321 -133zM640 1306q-92 0 -157.5 -65.5t-65.5 -158.5q0 -92 65.5 -157.5t157.5 -65.5t157.5 65.5t65.5 157.5q0 93 -65.5 158.5t-157.5 65.5zM1163 574q13 -27 15 -49.5
+t-4.5 -40.5t-26.5 -38.5t-42.5 -37t-61.5 -41.5q-115 -73 -315 -94l73 -72l267 -267q30 -31 30 -74t-30 -73l-12 -13q-31 -30 -74 -30t-74 30q-67 68 -267 268l-267 -268q-31 -30 -74 -30t-73 30l-12 13q-31 30 -31 73t31 74l267 267l72 72q-203 21 -317 94
+q-39 25 -61.5 41.5t-42.5 37t-26.5 38.5t-4.5 40.5t15 49.5q10 20 28 35t42 22t56 -2t65 -35q5 -4 15 -11t43 -24.5t69 -30.5t92 -24t113 -11q91 0 174 25.5t120 50.5l38 25q33 26 65 35t56 2t42 -22t28 -35z" />
+    <glyph glyph-name="_574" unicode="&#xf264;" 
+d="M927 956q0 -66 -46.5 -112.5t-112.5 -46.5t-112.5 46.5t-46.5 112.5t46.5 112.5t112.5 46.5t112.5 -46.5t46.5 -112.5zM1141 593q-10 20 -28 32t-47.5 9.5t-60.5 -27.5q-10 -8 -29 -20t-81 -32t-127 -20t-124 18t-86 36l-27 18q-31 25 -60.5 27.5t-47.5 -9.5t-28 -32
+q-22 -45 -2 -74.5t87 -73.5q83 -53 226 -67l-51 -52q-142 -142 -191 -190q-22 -22 -22 -52.5t22 -52.5l9 -9q22 -22 52.5 -22t52.5 22l191 191q114 -115 191 -191q22 -22 52.5 -22t52.5 22l9 9q22 22 22 52.5t-22 52.5l-191 190l-52 52q141 14 225 67q67 44 87 73.5t-2 74.5
+zM1092 956q0 134 -95 229t-229 95t-229 -95t-95 -229t95 -229t229 -95t229 95t95 229zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_575" unicode="&#xf265;" horiz-adv-x="1720" 
+d="M1565 1408q65 0 110 -45.5t45 -110.5v-519q0 -176 -68 -336t-182.5 -275t-274 -182.5t-334.5 -67.5q-176 0 -335.5 67.5t-274.5 182.5t-183 275t-68 336v519q0 64 46 110t110 46h1409zM861 344q47 0 82 33l404 388q37 35 37 85q0 49 -34.5 83.5t-83.5 34.5q-47 0 -82 -33
+l-323 -310l-323 310q-35 33 -81 33q-49 0 -83.5 -34.5t-34.5 -83.5q0 -51 36 -85l405 -388q33 -33 81 -33z" />
+    <glyph glyph-name="_576" unicode="&#xf266;" horiz-adv-x="2304" 
+d="M1494 -103l-295 695q-25 -49 -158.5 -305.5t-198.5 -389.5q-1 -1 -27.5 -0.5t-26.5 1.5q-82 193 -255.5 587t-259.5 596q-21 50 -66.5 107.5t-103.5 100.5t-102 43q0 5 -0.5 24t-0.5 27h583v-50q-39 -2 -79.5 -16t-66.5 -43t-10 -64q26 -59 216.5 -499t235.5 -540
+q31 61 140 266.5t131 247.5q-19 39 -126 281t-136 295q-38 69 -201 71v50l513 -1v-47q-60 -2 -93.5 -25t-12.5 -69q33 -70 87 -189.5t86 -187.5q110 214 173 363q24 55 -10 79.5t-129 26.5q1 7 1 25v24q64 0 170.5 0.5t180 1t92.5 0.5v-49q-62 -2 -119 -33t-90 -81
+l-213 -442q13 -33 127.5 -290t121.5 -274l441 1017q-14 38 -49.5 62.5t-65 31.5t-55.5 8v50l460 -4l1 -2l-1 -44q-139 -4 -201 -145q-526 -1216 -559 -1291h-49z" />
+    <glyph glyph-name="_577" unicode="&#xf267;" horiz-adv-x="1792" 
+d="M949 643q0 -26 -16.5 -45t-41.5 -19q-26 0 -45 16.5t-19 41.5q0 26 17 45t42 19t44 -16.5t19 -41.5zM964 585l350 581q-9 -8 -67.5 -62.5t-125.5 -116.5t-136.5 -127t-117 -110.5t-50.5 -51.5l-349 -580q7 7 67 62t126 116.5t136 127t117 111t50 50.5zM1611 640
+q0 -201 -104 -371q-3 2 -17 11t-26.5 16.5t-16.5 7.5q-13 0 -13 -13q0 -10 59 -44q-74 -112 -184.5 -190.5t-241.5 -110.5l-16 67q-1 10 -15 10q-5 0 -8 -5.5t-2 -9.5l16 -68q-72 -15 -146 -15q-199 0 -372 105q1 2 13 20.5t21.5 33.5t9.5 19q0 13 -13 13q-6 0 -17 -14.5
+t-22.5 -34.5t-13.5 -23q-113 75 -192 187.5t-110 244.5l69 15q10 3 10 15q0 5 -5.5 8t-10.5 2l-68 -15q-14 72 -14 139q0 206 109 379q2 -1 18.5 -12t30 -19t17.5 -8q13 0 13 12q0 6 -12.5 15.5t-32.5 21.5l-20 12q77 112 189 189t244 107l15 -67q2 -10 15 -10q5 0 8 5.5
+t2 10.5l-15 66q71 13 134 13q204 0 379 -109q-39 -56 -39 -65q0 -13 12 -13q11 0 48 64q111 -75 187.5 -186t107.5 -241l-56 -12q-10 -2 -10 -16q0 -5 5.5 -8t9.5 -2l57 13q14 -72 14 -140zM1696 640q0 163 -63.5 311t-170.5 255t-255 170.5t-311 63.5t-311 -63.5
+t-255 -170.5t-170.5 -255t-63.5 -311t63.5 -311t170.5 -255t255 -170.5t311 -63.5t311 63.5t255 170.5t170.5 255t63.5 311zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191
+t191 -286t71 -348z" />
+    <glyph glyph-name="_578" unicode="&#xf268;" horiz-adv-x="1792" 
+d="M893 1536q240 2 451 -120q232 -134 352 -372l-742 39q-160 9 -294 -74.5t-185 -229.5l-276 424q128 159 311 245.5t383 87.5zM146 1131l337 -663q72 -143 211 -217t293 -45l-230 -451q-212 33 -385 157.5t-272.5 316t-99.5 411.5q0 267 146 491zM1732 962
+q58 -150 59.5 -310.5t-48.5 -306t-153 -272t-246 -209.5q-230 -133 -498 -119l405 623q88 131 82.5 290.5t-106.5 277.5zM896 942q125 0 213.5 -88.5t88.5 -213.5t-88.5 -213.5t-213.5 -88.5t-213.5 88.5t-88.5 213.5t88.5 213.5t213.5 88.5z" />
+    <glyph glyph-name="_579" unicode="&#xf269;" horiz-adv-x="1792" 
+d="M903 -256q-283 0 -504.5 150.5t-329.5 398.5q-58 131 -67 301t26 332.5t111 312t179 242.5l-11 -281q11 14 68 15.5t70 -15.5q42 81 160.5 138t234.5 59q-54 -45 -119.5 -148.5t-58.5 -163.5q25 -8 62.5 -13.5t63 -7.5t68 -4t50.5 -3q15 -5 9.5 -45.5t-30.5 -75.5
+q-5 -7 -16.5 -18.5t-56.5 -35.5t-101 -34l15 -189l-139 67q-18 -43 -7.5 -81.5t36 -66.5t65.5 -41.5t81 -6.5q51 9 98 34.5t83.5 45t73.5 17.5q61 -4 89.5 -33t19.5 -65q-1 -2 -2.5 -5.5t-8.5 -12.5t-18 -15.5t-31.5 -10.5t-46.5 -1q-60 -95 -144.5 -135.5t-209.5 -29.5
+q74 -61 162.5 -82.5t168.5 -6t154.5 52t128 87.5t80.5 104q43 91 39 192.5t-37.5 188.5t-78.5 125q87 -38 137 -79.5t77 -112.5q15 170 -57.5 343t-209.5 284q265 -77 412 -279.5t151 -517.5q2 -127 -40.5 -255t-123.5 -238t-189 -196t-247.5 -135.5t-288.5 -49.5z" />
+    <glyph glyph-name="_580" unicode="&#xf26a;" horiz-adv-x="1792" 
+d="M1493 1308q-165 110 -359 110q-155 0 -293 -73t-240 -200q-75 -93 -119.5 -218t-48.5 -266v-42q4 -141 48.5 -266t119.5 -218q102 -127 240 -200t293 -73q194 0 359 110q-121 -108 -274.5 -168t-322.5 -60q-29 0 -43 1q-175 8 -333 82t-272 193t-181 281t-67 339
+q0 182 71 348t191 286t286 191t348 71h3q168 -1 320.5 -60.5t273.5 -167.5zM1792 640q0 -192 -77 -362.5t-213 -296.5q-104 -63 -222 -63q-137 0 -255 84q154 56 253.5 233t99.5 405q0 227 -99 404t-253 234q119 83 254 83q119 0 226 -65q135 -125 210.5 -295t75.5 -361z
+" />
+    <glyph glyph-name="_581" unicode="&#xf26b;" horiz-adv-x="1792" 
+d="M1792 599q0 -56 -7 -104h-1151q0 -146 109.5 -244.5t257.5 -98.5q99 0 185.5 46.5t136.5 130.5h423q-56 -159 -170.5 -281t-267.5 -188.5t-321 -66.5q-187 0 -356 83q-228 -116 -394 -116q-237 0 -237 263q0 115 45 275q17 60 109 229q199 360 475 606
+q-184 -79 -427 -354q63 274 283.5 449.5t501.5 175.5q30 0 45 -1q255 117 433 117q64 0 116 -13t94.5 -40.5t66.5 -76.5t24 -115q0 -116 -75 -286q101 -182 101 -390zM1722 1239q0 83 -53 132t-137 49q-108 0 -254 -70q121 -47 222.5 -131.5t170.5 -195.5q51 135 51 216z
+M128 2q0 -86 48.5 -132.5t134.5 -46.5q115 0 266 83q-122 72 -213.5 183t-137.5 245q-98 -205 -98 -332zM632 715h728q-5 142 -113 237t-251 95q-144 0 -251.5 -95t-112.5 -237z" />
+    <glyph glyph-name="_582" unicode="&#xf26c;" horiz-adv-x="2048" 
+d="M1792 288v960q0 13 -9.5 22.5t-22.5 9.5h-1600q-13 0 -22.5 -9.5t-9.5 -22.5v-960q0 -13 9.5 -22.5t22.5 -9.5h1600q13 0 22.5 9.5t9.5 22.5zM1920 1248v-960q0 -66 -47 -113t-113 -47h-736v-128h352q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-832q-14 0 -23 9t-9 23
+v64q0 14 9 23t23 9h352v128h-736q-66 0 -113 47t-47 113v960q0 66 47 113t113 47h1600q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="_583" unicode="&#xf26d;" horiz-adv-x="1792" 
+d="M138 1408h197q-70 -64 -126 -149q-36 -56 -59 -115t-30 -125.5t-8.5 -120t10.5 -132t21 -126t28 -136.5q4 -19 6 -28q51 -238 81 -329q57 -171 152 -275h-272q-48 0 -82 34t-34 82v1304q0 48 34 82t82 34zM1346 1408h308q48 0 82 -34t34 -82v-1304q0 -48 -34 -82t-82 -34
+h-178q212 210 196 565l-469 -101q-2 -45 -12 -82t-31 -72t-59.5 -59.5t-93.5 -36.5q-123 -26 -199 40q-32 27 -53 61t-51.5 129t-64.5 258q-35 163 -45.5 263t-5.5 139t23 77q20 41 62.5 73t102.5 45q45 12 83.5 6.5t67 -17t54 -35t43 -48t34.5 -56.5l468 100
+q-68 175 -180 287z" />
+    <glyph glyph-name="_584" unicode="&#xf26e;" 
+d="M1401 -11l-6 -6q-113 -113 -259 -175q-154 -64 -317 -64q-165 0 -317 64q-148 63 -259 175q-113 112 -175 258q-42 103 -54 189q-4 28 48 36q51 8 56 -20q1 -1 1 -4q18 -90 46 -159q50 -124 152 -226q98 -98 226 -152q132 -56 276 -56q143 0 276 56q128 55 225 152l6 6
+q10 10 25 6q12 -3 33 -22q36 -37 17 -58zM929 604l-66 -66l63 -63q21 -21 -7 -49q-17 -17 -32 -17q-10 0 -19 10l-62 61l-66 -66q-5 -5 -15 -5q-15 0 -31 16l-2 2q-18 15 -18 29q0 7 8 17l66 65l-66 66q-16 16 14 45q18 18 31 18q6 0 13 -5l65 -66l65 65q18 17 48 -13
+q27 -27 11 -44zM1400 547q0 -118 -46 -228q-45 -105 -126 -186q-80 -80 -187 -126t-228 -46t-228 46t-187 126q-82 82 -125 186q-15 33 -15 40h-1q-9 27 43 44q50 16 60 -12q37 -99 97 -167h1v339v2q3 136 102 232q105 103 253 103q147 0 251 -103t104 -249
+q0 -147 -104.5 -251t-250.5 -104q-58 0 -112 16q-28 11 -13 61q16 51 44 43l14 -3q14 -3 33 -6t30 -3q104 0 176 71.5t72 174.5q0 101 -72 171q-71 71 -175 71q-107 0 -178 -80q-64 -72 -64 -160v-413q110 -67 242 -67q96 0 185 36.5t156 103.5t103.5 155t36.5 183
+q0 198 -141 339q-140 140 -339 140q-200 0 -340 -140q-53 -53 -77 -87l-2 -2q-8 -11 -13 -15.5t-21.5 -9.5t-38.5 3q-21 5 -36.5 16.5t-15.5 26.5v680q0 15 10.5 26.5t27.5 11.5h877q30 0 30 -55t-30 -55h-811v-483h1q40 42 102 84t108 61q109 46 231 46q121 0 228 -46
+t187 -126q81 -81 126 -186q46 -112 46 -229zM1369 1128q9 -8 9 -18t-5.5 -18t-16.5 -21q-26 -26 -39 -26q-9 0 -16 7q-106 91 -207 133q-128 56 -276 56q-133 0 -262 -49q-27 -10 -45 37q-9 25 -8 38q3 16 16 20q130 57 299 57q164 0 316 -64q137 -58 235 -152z" />
+    <glyph glyph-name="_585" unicode="&#xf270;" horiz-adv-x="1792" 
+d="M1551 60q15 6 26 3t11 -17.5t-15 -33.5q-13 -16 -44 -43.5t-95.5 -68t-141 -74t-188 -58t-229.5 -24.5q-119 0 -238 31t-209 76.5t-172.5 104t-132.5 105t-84 87.5q-8 9 -10 16.5t1 12t8 7t11.5 2t11.5 -4.5q192 -117 300 -166q389 -176 799 -90q190 40 391 135z
+M1758 175q11 -16 2.5 -69.5t-28.5 -102.5q-34 -83 -85 -124q-17 -14 -26 -9t0 24q21 45 44.5 121.5t6.5 98.5q-5 7 -15.5 11.5t-27 6t-29.5 2.5t-35 0t-31.5 -2t-31 -3t-22.5 -2q-6 -1 -13 -1.5t-11 -1t-8.5 -1t-7 -0.5h-5.5h-4.5t-3 0.5t-2 1.5l-1.5 3q-6 16 47 40t103 30
+q46 7 108 1t76 -24zM1364 618q0 -31 13.5 -64t32 -58t37.5 -46t33 -32l13 -11l-227 -224q-40 37 -79 75.5t-58 58.5l-19 20q-11 11 -25 33q-38 -59 -97.5 -102.5t-127.5 -63.5t-140 -23t-137.5 21t-117.5 65.5t-83 113t-31 162.5q0 84 28 154t72 116.5t106.5 83t122.5 57
+t130 34.5t119.5 18.5t99.5 6.5v127q0 65 -21 97q-34 53 -121 53q-6 0 -16.5 -1t-40.5 -12t-56 -29.5t-56 -59.5t-48 -96l-294 27q0 60 22 119t67 113t108 95t151.5 65.5t190.5 24.5q100 0 181 -25t129.5 -61.5t81 -83t45 -86t12.5 -73.5v-589zM692 597q0 -86 70 -133
+q66 -44 139 -22q84 25 114 123q14 45 14 101v162q-59 -2 -111 -12t-106.5 -33.5t-87 -71t-32.5 -114.5z" />
+    <glyph glyph-name="_586" unicode="&#xf271;" horiz-adv-x="1792" 
+d="M1536 1280q52 0 90 -38t38 -90v-1280q0 -52 -38 -90t-90 -38h-1408q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h128v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h384v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h128zM1152 1376v-288q0 -14 9 -23t23 -9
+h64q14 0 23 9t9 23v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23zM384 1376v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23zM1536 -128v1024h-1408v-1024h1408zM896 448h224q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-224
+v-224q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v224h-224q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h224v224q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-224z" />
+    <glyph glyph-name="_587" unicode="&#xf272;" horiz-adv-x="1792" 
+d="M1152 416v-64q0 -14 -9 -23t-23 -9h-576q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h576q14 0 23 -9t9 -23zM128 -128h1408v1024h-1408v-1024zM512 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1280 1088v288q0 14 -9 23
+t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1664 1152v-1280q0 -52 -38 -90t-90 -38h-1408q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h128v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h384v96q0 66 47 113t113 47h64q66 0 113 -47
+t47 -113v-96h128q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_588" unicode="&#xf273;" horiz-adv-x="1792" 
+d="M1111 151l-46 -46q-9 -9 -22 -9t-23 9l-188 189l-188 -189q-10 -9 -23 -9t-22 9l-46 46q-9 9 -9 22t9 23l189 188l-189 188q-9 10 -9 23t9 22l46 46q9 9 22 9t23 -9l188 -188l188 188q10 9 23 9t22 -9l46 -46q9 -9 9 -22t-9 -23l-188 -188l188 -188q9 -10 9 -23t-9 -22z
+M128 -128h1408v1024h-1408v-1024zM512 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1280 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1664 1152v-1280
+q0 -52 -38 -90t-90 -38h-1408q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h128v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h384v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h128q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_589" unicode="&#xf274;" horiz-adv-x="1792" 
+d="M1303 572l-512 -512q-10 -9 -23 -9t-23 9l-288 288q-9 10 -9 23t9 22l46 46q9 9 22 9t23 -9l220 -220l444 444q10 9 23 9t22 -9l46 -46q9 -9 9 -22t-9 -23zM128 -128h1408v1024h-1408v-1024zM512 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23
+t23 -9h64q14 0 23 9t9 23zM1280 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1664 1152v-1280q0 -52 -38 -90t-90 -38h-1408q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h128v96q0 66 47 113t113 47h64q66 0 113 -47
+t47 -113v-96h384v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h128q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_590" unicode="&#xf275;" horiz-adv-x="1792" 
+d="M448 1536q26 0 45 -19t19 -45v-891l536 429q17 14 40 14q26 0 45 -19t19 -45v-379l536 429q17 14 40 14q26 0 45 -19t19 -45v-1152q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v1664q0 26 19 45t45 19h384z" />
+    <glyph glyph-name="_591" unicode="&#xf276;" horiz-adv-x="1024" 
+d="M512 448q66 0 128 15v-655q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v655q62 -15 128 -15zM512 1536q212 0 362 -150t150 -362t-150 -362t-362 -150t-362 150t-150 362t150 362t362 150zM512 1312q14 0 23 9t9 23t-9 23t-23 9q-146 0 -249 -103t-103 -249
+q0 -14 9 -23t23 -9t23 9t9 23q0 119 84.5 203.5t203.5 84.5z" />
+    <glyph glyph-name="_592" unicode="&#xf277;" horiz-adv-x="1792" 
+d="M1745 1239q10 -10 10 -23t-10 -23l-141 -141q-28 -28 -68 -28h-1344q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h576v64q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-64h512q40 0 68 -28zM768 320h256v-512q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v512zM1600 768
+q26 0 45 -19t19 -45v-256q0 -26 -19 -45t-45 -19h-1344q-40 0 -68 28l-141 141q-10 10 -10 23t10 23l141 141q28 28 68 28h512v192h256v-192h576z" />
+    <glyph glyph-name="_593" unicode="&#xf278;" horiz-adv-x="2048" 
+d="M2020 1525q28 -20 28 -53v-1408q0 -20 -11 -36t-29 -23l-640 -256q-24 -11 -48 0l-616 246l-616 -246q-10 -5 -24 -5q-19 0 -36 11q-28 20 -28 53v1408q0 20 11 36t29 23l640 256q24 11 48 0l616 -246l616 246q32 13 60 -6zM736 1390v-1270l576 -230v1270zM128 1173
+v-1270l544 217v1270zM1920 107v1270l-544 -217v-1270z" />
+    <glyph glyph-name="_594" unicode="&#xf279;" horiz-adv-x="1792" 
+d="M512 1536q13 0 22.5 -9.5t9.5 -22.5v-1472q0 -20 -17 -28l-480 -256q-7 -4 -15 -4q-13 0 -22.5 9.5t-9.5 22.5v1472q0 20 17 28l480 256q7 4 15 4zM1760 1536q13 0 22.5 -9.5t9.5 -22.5v-1472q0 -20 -17 -28l-480 -256q-7 -4 -15 -4q-13 0 -22.5 9.5t-9.5 22.5v1472
+q0 20 17 28l480 256q7 4 15 4zM640 1536q8 0 14 -3l512 -256q18 -10 18 -29v-1472q0 -13 -9.5 -22.5t-22.5 -9.5q-8 0 -14 3l-512 256q-18 10 -18 29v1472q0 13 9.5 22.5t22.5 9.5z" />
+    <glyph glyph-name="_595" unicode="&#xf27a;" horiz-adv-x="1792" 
+d="M640 640q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1024 640q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1408 640q0 53 -37.5 90.5t-90.5 37.5
+t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1792 640q0 -174 -120 -321.5t-326 -233t-450 -85.5q-110 0 -211 18q-173 -173 -435 -229q-52 -10 -86 -13q-12 -1 -22 6t-13 18q-4 15 20 37q5 5 23.5 21.5t25.5 23.5t23.5 25.5t24 31.5t20.5 37
+t20 48t14.5 57.5t12.5 72.5q-146 90 -229.5 216.5t-83.5 269.5q0 174 120 321.5t326 233t450 85.5t450 -85.5t326 -233t120 -321.5z" />
+    <glyph glyph-name="_596" unicode="&#xf27b;" horiz-adv-x="1792" 
+d="M640 640q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1024 640q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1408 640q0 -53 -37.5 -90.5t-90.5 -37.5
+t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM896 1152q-204 0 -381.5 -69.5t-282 -187.5t-104.5 -255q0 -112 71.5 -213.5t201.5 -175.5l87 -50l-27 -96q-24 -91 -70 -172q152 63 275 171l43 38l57 -6q69 -8 130 -8q204 0 381.5 69.5t282 187.5
+t104.5 255t-104.5 255t-282 187.5t-381.5 69.5zM1792 640q0 -174 -120 -321.5t-326 -233t-450 -85.5q-70 0 -145 8q-198 -175 -460 -242q-49 -14 -114 -22h-5q-15 0 -27 10.5t-16 27.5v1q-3 4 -0.5 12t2 10t4.5 9.5l6 9t7 8.5t8 9q7 8 31 34.5t34.5 38t31 39.5t32.5 51
+t27 59t26 76q-157 89 -247.5 220t-90.5 281q0 130 71 248.5t191 204.5t286 136.5t348 50.5t348 -50.5t286 -136.5t191 -204.5t71 -248.5z" />
+    <glyph glyph-name="_597" unicode="&#xf27c;" horiz-adv-x="1024" 
+d="M512 345l512 295v-591l-512 -296v592zM0 640v-591l512 296zM512 1527v-591l-512 -296v591zM512 936l512 295v-591z" />
+    <glyph glyph-name="_598" unicode="&#xf27d;" horiz-adv-x="1792" 
+d="M1709 1018q-10 -236 -332 -651q-333 -431 -562 -431q-142 0 -240 263q-44 160 -132 482q-72 262 -157 262q-18 0 -127 -76l-77 98q24 21 108 96.5t130 115.5q156 138 241 146q95 9 153 -55.5t81 -203.5q44 -287 66 -373q55 -249 120 -249q51 0 154 161q101 161 109 246
+q13 139 -109 139q-57 0 -121 -26q120 393 459 382q251 -8 236 -326z" />
+    <glyph glyph-name="f27e" unicode="&#xf27e;" 
+d="M0 1408h1536v-1536h-1536v1536zM1085 293l-221 631l221 297h-634l221 -297l-221 -631l317 -304z" />
+    <glyph glyph-name="uniF280" unicode="&#xf280;" 
+d="M0 1408h1536v-1536h-1536v1536zM908 1088l-12 -33l75 -83l-31 -114l25 -25l107 57l107 -57l25 25l-31 114l75 83l-12 33h-95l-53 96h-32l-53 -96h-95zM641 925q32 0 44.5 -16t11.5 -63l174 21q0 55 -17.5 92.5t-50.5 56t-69 25.5t-85 7q-133 0 -199 -57.5t-66 -182.5v-72
+h-96v-128h76q20 0 20 -8v-382q0 -14 -5 -20t-18 -7l-73 -7v-88h448v86l-149 14q-6 1 -8.5 1.5t-3.5 2.5t-0.5 4t1 7t0.5 10v387h191l38 128h-231q-6 0 -2 6t4 9v80q0 27 1.5 40.5t7.5 28t19.5 20t36.5 5.5zM1248 96v86l-54 9q-7 1 -9.5 2.5t-2.5 3t1 7.5t1 12v520h-275
+l-23 -101l83 -22q23 -7 23 -27v-370q0 -14 -6 -18.5t-20 -6.5l-70 -9v-86h352z" />
+    <glyph glyph-name="uniF281" unicode="&#xf281;" horiz-adv-x="1792" 
+d="M1792 690q0 -58 -29.5 -105.5t-79.5 -72.5q12 -46 12 -96q0 -155 -106.5 -287t-290.5 -208.5t-400 -76.5t-399.5 76.5t-290 208.5t-106.5 287q0 47 11 94q-51 25 -82 73.5t-31 106.5q0 82 58 140.5t141 58.5q85 0 145 -63q218 152 515 162l116 521q3 13 15 21t26 5
+l369 -81q18 37 54 59.5t79 22.5q62 0 106 -43.5t44 -105.5t-44 -106t-106 -44t-105.5 43.5t-43.5 105.5l-334 74l-104 -472q300 -9 519 -160q58 61 143 61q83 0 141 -58.5t58 -140.5zM418 491q0 -62 43.5 -106t105.5 -44t106 44t44 106t-44 105.5t-106 43.5q-61 0 -105 -44
+t-44 -105zM1228 136q11 11 11 26t-11 26q-10 10 -25 10t-26 -10q-41 -42 -121 -62t-160 -20t-160 20t-121 62q-11 10 -26 10t-25 -10q-11 -10 -11 -25.5t11 -26.5q43 -43 118.5 -68t122.5 -29.5t91 -4.5t91 4.5t122.5 29.5t118.5 68zM1225 341q62 0 105.5 44t43.5 106
+q0 61 -44 105t-105 44q-62 0 -106 -43.5t-44 -105.5t44 -106t106 -44z" />
+    <glyph glyph-name="_602" unicode="&#xf282;" horiz-adv-x="1792" 
+d="M69 741h1q16 126 58.5 241.5t115 217t167.5 176t223.5 117.5t276.5 43q231 0 414 -105.5t294 -303.5q104 -187 104 -442v-188h-1125q1 -111 53.5 -192.5t136.5 -122.5t189.5 -57t213 -3t208 46.5t173.5 84.5v-377q-92 -55 -229.5 -92t-312.5 -38t-316 53
+q-189 73 -311.5 249t-124.5 372q-3 242 111 412t325 268q-48 -60 -78 -125.5t-46 -159.5h635q8 77 -8 140t-47 101.5t-70.5 66.5t-80.5 41t-75 20.5t-56 8.5l-22 1q-135 -5 -259.5 -44.5t-223.5 -104.5t-176 -140.5t-138 -163.5z" />
+    <glyph glyph-name="_603" unicode="&#xf283;" horiz-adv-x="2304" 
+d="M0 32v608h2304v-608q0 -66 -47 -113t-113 -47h-1984q-66 0 -113 47t-47 113zM640 256v-128h384v128h-384zM256 256v-128h256v128h-256zM2144 1408q66 0 113 -47t47 -113v-224h-2304v224q0 66 47 113t113 47h1984z" />
+    <glyph glyph-name="_604" unicode="&#xf284;" horiz-adv-x="1792" 
+d="M1584 246l-218 111q-74 -120 -196.5 -189t-263.5 -69q-147 0 -271 72t-196 196t-72 270q0 110 42.5 209.5t115 172t172 115t209.5 42.5q131 0 247.5 -60.5t192.5 -168.5l215 125q-110 169 -286.5 265t-378.5 96q-161 0 -308 -63t-253 -169t-169 -253t-63 -308t63 -308
+t169 -253t253 -169t308 -63q213 0 397.5 107t290.5 292zM1030 643l693 -352q-116 -253 -334.5 -400t-492.5 -147q-182 0 -348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71q260 0 470.5 -133.5t335.5 -366.5zM1543 640h-39v-160h-96v352h136q32 0 54.5 -20
+t28.5 -48t1 -56t-27.5 -48t-57.5 -20z" />
+    <glyph glyph-name="uniF285" unicode="&#xf285;" horiz-adv-x="1792" 
+d="M1427 827l-614 386l92 151h855zM405 562l-184 116v858l1183 -743zM1424 697l147 -95v-858l-532 335zM1387 718l-500 -802h-855l356 571z" />
+    <glyph glyph-name="uniF286" unicode="&#xf286;" horiz-adv-x="1792" 
+d="M640 528v224q0 16 -16 16h-96q-16 0 -16 -16v-224q0 -16 16 -16h96q16 0 16 16zM1152 528v224q0 16 -16 16h-96q-16 0 -16 -16v-224q0 -16 16 -16h96q16 0 16 16zM1664 496v-752h-640v320q0 80 -56 136t-136 56t-136 -56t-56 -136v-320h-640v752q0 16 16 16h96
+q16 0 16 -16v-112h128v624q0 16 16 16h96q16 0 16 -16v-112h128v112q0 16 16 16h96q16 0 16 -16v-112h128v112q0 6 2.5 9.5t8.5 5t9.5 2t11.5 0t9 -0.5v391q-32 15 -32 50q0 23 16.5 39t38.5 16t38.5 -16t16.5 -39q0 -35 -32 -50v-17q45 10 83 10q21 0 59.5 -7.5t54.5 -7.5
+q17 0 47 7.5t37 7.5q16 0 16 -16v-210q0 -15 -35 -21.5t-62 -6.5q-18 0 -54.5 7.5t-55.5 7.5q-40 0 -90 -12v-133q1 0 9 0.5t11.5 0t9.5 -2t8.5 -5t2.5 -9.5v-112h128v112q0 16 16 16h96q16 0 16 -16v-112h128v112q0 16 16 16h96q16 0 16 -16v-624h128v112q0 16 16 16h96
+q16 0 16 -16z" />
+    <glyph glyph-name="_607" unicode="&#xf287;" horiz-adv-x="2304" 
+d="M2288 731q16 -8 16 -27t-16 -27l-320 -192q-8 -5 -16 -5q-9 0 -16 4q-16 10 -16 28v128h-858q37 -58 83 -165q16 -37 24.5 -55t24 -49t27 -47t27 -34t31.5 -26t33 -8h96v96q0 14 9 23t23 9h320q14 0 23 -9t9 -23v-320q0 -14 -9 -23t-23 -9h-320q-14 0 -23 9t-9 23v96h-96
+q-32 0 -61 10t-51 23.5t-45 40.5t-37 46t-33.5 57t-28.5 57.5t-28 60.5q-23 53 -37 81.5t-36 65t-44.5 53.5t-46.5 17h-360q-22 -84 -91 -138t-157 -54q-106 0 -181 75t-75 181t75 181t181 75q88 0 157 -54t91 -138h104q24 0 46.5 17t44.5 53.5t36 65t37 81.5q19 41 28 60.5
+t28.5 57.5t33.5 57t37 46t45 40.5t51 23.5t61 10h107q21 57 70 92.5t111 35.5q80 0 136 -56t56 -136t-56 -136t-136 -56q-62 0 -111 35.5t-70 92.5h-107q-17 0 -33 -8t-31.5 -26t-27 -34t-27 -47t-24 -49t-24.5 -55q-46 -107 -83 -165h1114v128q0 18 16 28t32 -1z" />
+    <glyph glyph-name="_608" unicode="&#xf288;" horiz-adv-x="1792" 
+d="M1150 774q0 -56 -39.5 -95t-95.5 -39h-253v269h253q56 0 95.5 -39.5t39.5 -95.5zM1329 774q0 130 -91.5 222t-222.5 92h-433v-896h180v269h253q130 0 222 91.5t92 221.5zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348
+t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="_609" unicode="&#xf289;" horiz-adv-x="2304" 
+d="M1645 438q0 59 -34 106.5t-87 68.5q-7 -45 -23 -92q-7 -24 -27.5 -38t-44.5 -14q-12 0 -24 3q-31 10 -45 38.5t-4 58.5q23 71 23 143q0 123 -61 227.5t-166 165.5t-228 61q-134 0 -247 -73t-167 -194q108 -28 188 -106q22 -23 22 -55t-22 -54t-54 -22t-55 22
+q-75 75 -180 75q-106 0 -181 -74.5t-75 -180.5t75 -180.5t181 -74.5h1046q79 0 134.5 55.5t55.5 133.5zM1798 438q0 -142 -100.5 -242t-242.5 -100h-1046q-169 0 -289 119.5t-120 288.5q0 153 100 267t249 136q62 184 221 298t354 114q235 0 408.5 -158.5t196.5 -389.5
+q116 -25 192.5 -118.5t76.5 -214.5zM2048 438q0 -175 -97 -319q-23 -33 -64 -33q-24 0 -43 13q-26 17 -32 48.5t12 57.5q71 104 71 233t-71 233q-18 26 -12 57t32 49t57.5 11.5t49.5 -32.5q97 -142 97 -318zM2304 438q0 -244 -134 -443q-23 -34 -64 -34q-23 0 -42 13
+q-26 18 -32.5 49t11.5 57q108 164 108 358q0 195 -108 357q-18 26 -11.5 57.5t32.5 48.5q26 18 57 12t49 -33q134 -198 134 -442z" />
+    <glyph glyph-name="_610" unicode="&#xf28a;" 
+d="M1500 -13q0 -89 -63 -152.5t-153 -63.5t-153.5 63.5t-63.5 152.5q0 90 63.5 153.5t153.5 63.5t153 -63.5t63 -153.5zM1267 268q-115 -15 -192.5 -102.5t-77.5 -205.5q0 -74 33 -138q-146 -78 -379 -78q-109 0 -201 21t-153.5 54.5t-110.5 76.5t-76 85t-44.5 83
+t-23.5 66.5t-6 39.5q0 19 4.5 42.5t18.5 56t36.5 58t64 43.5t94.5 18t94 -17.5t63 -41t35.5 -53t17.5 -49t4 -33.5q0 -34 -23 -81q28 -27 82 -42t93 -17l40 -1q115 0 190 51t75 133q0 26 -9 48.5t-31.5 44.5t-49.5 41t-74 44t-93.5 47.5t-119.5 56.5q-28 13 -43 20
+q-116 55 -187 100t-122.5 102t-72 125.5t-20.5 162.5q0 78 20.5 150t66 137.5t112.5 114t166.5 77t221.5 28.5q120 0 220 -26t164.5 -67t109.5 -94t64 -105.5t19 -103.5q0 -46 -15 -82.5t-36.5 -58t-48.5 -36t-49 -19.5t-39 -5h-8h-32t-39 5t-44 14t-41 28t-37 46t-24 70.5
+t-10 97.5q-15 16 -59 25.5t-81 10.5l-37 1q-68 0 -117.5 -31t-70.5 -70t-21 -76q0 -24 5 -43t24 -46t53 -51t97 -53.5t150 -58.5q76 -25 138.5 -53.5t109 -55.5t83 -59t60.5 -59.5t41 -62.5t26.5 -62t14.5 -63.5t6 -62t1 -62.5z" />
+    <glyph glyph-name="_611" unicode="&#xf28b;" 
+d="M704 352v576q0 14 -9 23t-23 9h-256q-14 0 -23 -9t-9 -23v-576q0 -14 9 -23t23 -9h256q14 0 23 9t9 23zM1152 352v576q0 14 -9 23t-23 9h-256q-14 0 -23 -9t-9 -23v-576q0 -14 9 -23t23 -9h256q14 0 23 9t9 23zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103
+t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_612" unicode="&#xf28c;" 
+d="M768 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5t-103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103zM768 96q148 0 273 73t198 198t73 273t-73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273
+t73 -273t198 -198t273 -73zM864 320q-14 0 -23 9t-9 23v576q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-576q0 -14 -9 -23t-23 -9h-192zM480 320q-14 0 -23 9t-9 23v576q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-576q0 -14 -9 -23t-23 -9h-192z" />
+    <glyph glyph-name="_613" unicode="&#xf28d;" 
+d="M1088 352v576q0 14 -9 23t-23 9h-576q-14 0 -23 -9t-9 -23v-576q0 -14 9 -23t23 -9h576q14 0 23 9t9 23zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5
+t103 -385.5z" />
+    <glyph glyph-name="_614" unicode="&#xf28e;" 
+d="M768 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5t-103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103zM768 96q148 0 273 73t198 198t73 273t-73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273
+t73 -273t198 -198t273 -73zM480 320q-14 0 -23 9t-9 23v576q0 14 9 23t23 9h576q14 0 23 -9t9 -23v-576q0 -14 -9 -23t-23 -9h-576z" />
+    <glyph glyph-name="_615" unicode="&#xf290;" horiz-adv-x="1792" 
+d="M1757 128l35 -313q3 -28 -16 -50q-19 -21 -48 -21h-1664q-29 0 -48 21q-19 22 -16 50l35 313h1722zM1664 967l86 -775h-1708l86 775q3 24 21 40.5t43 16.5h256v-128q0 -53 37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5v128h384v-128q0 -53 37.5 -90.5t90.5 -37.5
+t90.5 37.5t37.5 90.5v128h256q25 0 43 -16.5t21 -40.5zM1280 1152v-256q0 -26 -19 -45t-45 -19t-45 19t-19 45v256q0 106 -75 181t-181 75t-181 -75t-75 -181v-256q0 -26 -19 -45t-45 -19t-45 19t-19 45v256q0 159 112.5 271.5t271.5 112.5t271.5 -112.5t112.5 -271.5z" />
+    <glyph glyph-name="_616" unicode="&#xf291;" horiz-adv-x="2048" 
+d="M1920 768q53 0 90.5 -37.5t37.5 -90.5t-37.5 -90.5t-90.5 -37.5h-15l-115 -662q-8 -46 -44 -76t-82 -30h-1280q-46 0 -82 30t-44 76l-115 662h-15q-53 0 -90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5h1792zM485 -32q26 2 43.5 22.5t15.5 46.5l-32 416q-2 26 -22.5 43.5
+t-46.5 15.5t-43.5 -22.5t-15.5 -46.5l32 -416q2 -25 20.5 -42t43.5 -17h5zM896 32v416q0 26 -19 45t-45 19t-45 -19t-19 -45v-416q0 -26 19 -45t45 -19t45 19t19 45zM1280 32v416q0 26 -19 45t-45 19t-45 -19t-19 -45v-416q0 -26 19 -45t45 -19t45 19t19 45zM1632 27l32 416
+q2 26 -15.5 46.5t-43.5 22.5t-46.5 -15.5t-22.5 -43.5l-32 -416q-2 -26 15.5 -46.5t43.5 -22.5h5q25 0 43.5 17t20.5 42zM476 1244l-93 -412h-132l101 441q19 88 89 143.5t160 55.5h167q0 26 19 45t45 19h384q26 0 45 -19t19 -45h167q90 0 160 -55.5t89 -143.5l101 -441
+h-132l-93 412q-11 44 -45.5 72t-79.5 28h-167q0 -26 -19 -45t-45 -19h-384q-26 0 -45 19t-19 45h-167q-45 0 -79.5 -28t-45.5 -72z" />
+    <glyph glyph-name="_617" unicode="&#xf292;" horiz-adv-x="1792" 
+d="M991 512l64 256h-254l-64 -256h254zM1759 1016l-56 -224q-7 -24 -31 -24h-327l-64 -256h311q15 0 25 -12q10 -14 6 -28l-56 -224q-5 -24 -31 -24h-327l-81 -328q-7 -24 -31 -24h-224q-16 0 -26 12q-9 12 -6 28l78 312h-254l-81 -328q-7 -24 -31 -24h-225q-15 0 -25 12
+q-9 12 -6 28l78 312h-311q-15 0 -25 12q-9 12 -6 28l56 224q7 24 31 24h327l64 256h-311q-15 0 -25 12q-10 14 -6 28l56 224q5 24 31 24h327l81 328q7 24 32 24h224q15 0 25 -12q9 -12 6 -28l-78 -312h254l81 328q7 24 32 24h224q15 0 25 -12q9 -12 6 -28l-78 -312h311
+q15 0 25 -12q9 -12 6 -28z" />
+    <glyph glyph-name="_618" unicode="&#xf293;" 
+d="M841 483l148 -148l-149 -149zM840 1094l149 -149l-148 -148zM710 -130l464 464l-306 306l306 306l-464 464v-611l-255 255l-93 -93l320 -321l-320 -321l93 -93l255 255v-611zM1429 640q0 -209 -32 -365.5t-87.5 -257t-140.5 -162.5t-181.5 -86.5t-219.5 -24.5
+t-219.5 24.5t-181.5 86.5t-140.5 162.5t-87.5 257t-32 365.5t32 365.5t87.5 257t140.5 162.5t181.5 86.5t219.5 24.5t219.5 -24.5t181.5 -86.5t140.5 -162.5t87.5 -257t32 -365.5z" />
+    <glyph glyph-name="_619" unicode="&#xf294;" horiz-adv-x="1024" 
+d="M596 113l173 172l-173 172v-344zM596 823l173 172l-173 172v-344zM628 640l356 -356l-539 -540v711l-297 -296l-108 108l372 373l-372 373l108 108l297 -296v711l539 -540z" />
+    <glyph glyph-name="_620" unicode="&#xf295;" 
+d="M1280 256q0 52 -38 90t-90 38t-90 -38t-38 -90t38 -90t90 -38t90 38t38 90zM512 1024q0 52 -38 90t-90 38t-90 -38t-38 -90t38 -90t90 -38t90 38t38 90zM1536 256q0 -159 -112.5 -271.5t-271.5 -112.5t-271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5t271.5 -112.5
+t112.5 -271.5zM1440 1344q0 -20 -13 -38l-1056 -1408q-19 -26 -51 -26h-160q-26 0 -45 19t-19 45q0 20 13 38l1056 1408q19 26 51 26h160q26 0 45 -19t19 -45zM768 1024q0 -159 -112.5 -271.5t-271.5 -112.5t-271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5
+t271.5 -112.5t112.5 -271.5z" />
+    <glyph glyph-name="_621" unicode="&#xf296;" horiz-adv-x="1792" 
+d="M104 830l792 -1015l-868 630q-18 13 -25 34.5t0 42.5l101 308v0zM566 830h660l-330 -1015v0zM368 1442l198 -612h-462l198 612q8 23 33 23t33 -23zM1688 830l101 -308q7 -21 0 -42.5t-25 -34.5l-868 -630l792 1015v0zM1688 830h-462l198 612q8 23 33 23t33 -23z" />
+    <glyph glyph-name="_622" unicode="&#xf297;" horiz-adv-x="1792" 
+d="M384 704h160v224h-160v-224zM1221 372v92q-104 -36 -243 -38q-135 -1 -259.5 46.5t-220.5 122.5l1 -96q88 -80 212 -128.5t272 -47.5q129 0 238 49zM640 704h640v224h-640v-224zM1792 736q0 -187 -99 -352q89 -102 89 -229q0 -157 -129.5 -268t-313.5 -111
+q-122 0 -225 52.5t-161 140.5q-19 -1 -57 -1t-57 1q-58 -88 -161 -140.5t-225 -52.5q-184 0 -313.5 111t-129.5 268q0 127 89 229q-99 165 -99 352q0 209 120 385.5t326.5 279.5t449.5 103t449.5 -103t326.5 -279.5t120 -385.5z" />
+    <glyph glyph-name="_623" unicode="&#xf298;" 
+d="M515 625v-128h-252v128h252zM515 880v-127h-252v127h252zM1273 369v-128h-341v128h341zM1273 625v-128h-672v128h672zM1273 880v-127h-672v127h672zM1408 20v1240q0 8 -6 14t-14 6h-32l-378 -256l-210 171l-210 -171l-378 256h-32q-8 0 -14 -6t-6 -14v-1240q0 -8 6 -14
+t14 -6h1240q8 0 14 6t6 14zM553 1130l185 150h-406zM983 1130l221 150h-406zM1536 1260v-1240q0 -62 -43 -105t-105 -43h-1240q-62 0 -105 43t-43 105v1240q0 62 43 105t105 43h1240q62 0 105 -43t43 -105z" />
+    <glyph glyph-name="_624" unicode="&#xf299;" horiz-adv-x="1792" 
+d="M896 720q-104 196 -160 278q-139 202 -347 318q-34 19 -70 36q-89 40 -94 32t34 -38l39 -31q62 -43 112.5 -93.5t94.5 -116.5t70.5 -113t70.5 -131q9 -17 13 -25q44 -84 84 -153t98 -154t115.5 -150t131 -123.5t148.5 -90.5q153 -66 154 -60q1 3 -49 37q-53 36 -81 57
+q-77 58 -179 211t-185 310zM549 177q-76 60 -132.5 125t-98 143.5t-71 154.5t-58.5 186t-52 209t-60.5 252t-76.5 289q273 0 497.5 -36t379 -92t271 -144.5t185.5 -172.5t110 -198.5t56 -199.5t12.5 -198.5t-9.5 -173t-20 -143.5t-13 -107l323 -327h-104l-281 285
+q-22 -2 -91.5 -14t-121.5 -19t-138 -6t-160.5 17t-167.5 59t-179 111z" />
+    <glyph glyph-name="_625" unicode="&#xf29a;" horiz-adv-x="1792" 
+d="M1374 879q-6 26 -28.5 39.5t-48.5 7.5q-261 -62 -401 -62t-401 62q-26 6 -48.5 -7.5t-28.5 -39.5t7.5 -48.5t39.5 -28.5q194 -46 303 -58q-2 -158 -15.5 -269t-26.5 -155.5t-41 -115.5l-9 -21q-10 -25 1 -49t36 -34q9 -4 23 -4q44 0 60 41l8 20q54 139 71 259h42
+q17 -120 71 -259l8 -20q16 -41 60 -41q14 0 23 4q25 10 36 34t1 49l-9 21q-28 71 -41 115.5t-26.5 155.5t-15.5 269q109 12 303 58q26 6 39.5 28.5t7.5 48.5zM1024 1024q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5z
+M1600 640q0 -143 -55.5 -273.5t-150 -225t-225 -150t-273.5 -55.5t-273.5 55.5t-225 150t-150 225t-55.5 273.5t55.5 273.5t150 225t225 150t273.5 55.5t273.5 -55.5t225 -150t150 -225t55.5 -273.5zM896 1408q-156 0 -298 -61t-245 -164t-164 -245t-61 -298t61 -298
+t164 -245t245 -164t298 -61t298 61t245 164t164 245t61 298t-61 298t-164 245t-245 164t-298 61zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="_626" unicode="&#xf29b;" 
+d="M1438 723q34 -35 29 -82l-44 -551q-4 -42 -34.5 -70t-71.5 -28q-6 0 -9 1q-44 3 -72.5 36.5t-25.5 77.5l35 429l-143 -8q55 -113 55 -240q0 -216 -148 -372l-137 137q91 101 91 235q0 145 -102.5 248t-247.5 103q-134 0 -236 -92l-137 138q120 114 284 141l264 300
+l-149 87l-181 -161q-33 -30 -77 -27.5t-73 35.5t-26.5 77t34.5 73l239 213q26 23 60 26.5t64 -14.5l488 -283q36 -21 48 -68q17 -67 -26 -117l-205 -232l371 20q49 3 83 -32zM1240 1180q-74 0 -126 52t-52 126t52 126t126 52t126.5 -52t52.5 -126t-52.5 -126t-126.5 -52z
+M613 -62q106 0 196 61l139 -139q-146 -116 -335 -116q-148 0 -273.5 73t-198.5 198t-73 273q0 188 116 336l139 -139q-60 -88 -60 -197q0 -145 102.5 -247.5t247.5 -102.5z" />
+    <glyph glyph-name="_627" unicode="&#xf29c;" 
+d="M880 336v-160q0 -14 -9 -23t-23 -9h-160q-14 0 -23 9t-9 23v160q0 14 9 23t23 9h160q14 0 23 -9t9 -23zM1136 832q0 -50 -15 -90t-45.5 -69t-52 -44t-59.5 -36q-32 -18 -46.5 -28t-26 -24t-11.5 -29v-32q0 -14 -9 -23t-23 -9h-160q-14 0 -23 9t-9 23v68q0 35 10.5 64.5
+t24 47.5t39 35.5t41 25.5t44.5 21q53 25 75 43t22 49q0 42 -43.5 71.5t-95.5 29.5q-56 0 -95 -27q-29 -20 -80 -83q-9 -12 -25 -12q-11 0 -19 6l-108 82q-10 7 -12 20t5 23q122 192 349 192q129 0 238.5 -89.5t109.5 -214.5zM768 1280q-130 0 -248.5 -51t-204 -136.5
+t-136.5 -204t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5t-51 248.5t-136.5 204t-204 136.5t-248.5 51zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5
+t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_628" unicode="&#xf29d;" horiz-adv-x="1408" 
+d="M366 1225q-64 0 -110 45.5t-46 110.5q0 64 46 109.5t110 45.5t109.5 -45.5t45.5 -109.5q0 -65 -45.5 -110.5t-109.5 -45.5zM917 583q0 -50 -30 -67.5t-63.5 -6.5t-47.5 34l-367 438q-7 12 -14 15.5t-11 1.5l-3 -3q-7 -8 4 -21l122 -139l1 -354l-161 -457
+q-67 -192 -92 -234q-15 -26 -28 -32q-50 -26 -103 -1q-29 13 -41.5 43t-9.5 57q2 17 197 618l5 416l-85 -164l35 -222q4 -24 -1 -42t-14 -27.5t-19 -16t-17 -7.5l-7 -2q-19 -3 -34.5 3t-24 16t-14 22t-7.5 19.5t-2 9.5l-46 299l211 381q23 34 113 34q75 0 107 -40l424 -521
+q7 -5 14 -17l3 -3l-1 -1q7 -13 7 -29zM514 433q43 -113 88.5 -225t69.5 -168l24 -55q36 -93 42 -125q11 -70 -36 -97q-35 -22 -66 -16t-51 22t-29 35h-1q-6 16 -8 25l-124 351zM1338 -159q31 -49 31 -57q0 -5 -3 -7q-9 -5 -14.5 0.5t-15.5 26t-16 30.5q-114 172 -423 661
+q3 -1 7 1t7 4l3 2q11 9 11 17z" />
+    <glyph glyph-name="_629" unicode="&#xf29e;" horiz-adv-x="2304" 
+d="M504 542h171l-1 265zM1530 641q0 87 -50.5 140t-146.5 53h-54v-388h52q91 0 145 57t54 138zM956 1018l1 -756q0 -14 -9.5 -24t-23.5 -10h-216q-14 0 -23.5 10t-9.5 24v62h-291l-55 -81q-10 -15 -28 -15h-267q-21 0 -30.5 18t3.5 35l556 757q9 14 27 14h332q14 0 24 -10
+t10 -24zM1783 641q0 -193 -125.5 -303t-324.5 -110h-270q-14 0 -24 10t-10 24v756q0 14 10 24t24 10h268q200 0 326 -109t126 -302zM1939 640q0 -11 -0.5 -29t-8 -71.5t-21.5 -102t-44.5 -108t-73.5 -102.5h-51q38 45 66.5 104.5t41.5 112t21 98t9 72.5l1 27q0 8 -0.5 22.5
+t-7.5 60t-20 91.5t-41 111.5t-66 124.5h43q41 -47 72 -107t45.5 -111.5t23 -96t10.5 -70.5zM2123 640q0 -11 -0.5 -29t-8 -71.5t-21.5 -102t-45 -108t-74 -102.5h-51q38 45 66.5 104.5t41.5 112t21 98t9 72.5l1 27q0 8 -0.5 22.5t-7.5 60t-19.5 91.5t-40.5 111.5t-66 124.5
+h43q41 -47 72 -107t45.5 -111.5t23 -96t10.5 -70.5zM2304 640q0 -11 -0.5 -29t-8 -71.5t-21.5 -102t-44.5 -108t-73.5 -102.5h-51q38 45 66 104.5t41 112t21 98t9 72.5l1 27q0 8 -0.5 22.5t-7.5 60t-19.5 91.5t-40.5 111.5t-66 124.5h43q41 -47 72 -107t45.5 -111.5t23 -96
+t9.5 -70.5z" />
+    <glyph glyph-name="uniF2A0" unicode="&#xf2a0;" horiz-adv-x="1408" 
+d="M617 -153q0 11 -13 58t-31 107t-20 69q-1 4 -5 26.5t-8.5 36t-13.5 21.5q-15 14 -51 14q-23 0 -70 -5.5t-71 -5.5q-34 0 -47 11q-6 5 -11 15.5t-7.5 20t-6.5 24t-5 18.5q-37 128 -37 255t37 255q1 4 5 18.5t6.5 24t7.5 20t11 15.5q13 11 47 11q24 0 71 -5.5t70 -5.5
+q36 0 51 14q9 8 13.5 21.5t8.5 36t5 26.5q2 9 20 69t31 107t13 58q0 22 -43.5 52.5t-75.5 42.5q-20 8 -45 8q-34 0 -98 -18q-57 -17 -96.5 -40.5t-71 -66t-46 -70t-45.5 -94.5q-6 -12 -9 -19q-49 -107 -68 -216t-19 -244t19 -244t68 -216q56 -122 83 -161q63 -91 179 -127
+l6 -2q64 -18 98 -18q25 0 45 8q32 12 75.5 42.5t43.5 52.5zM776 760q-26 0 -45 19t-19 45.5t19 45.5q37 37 37 90q0 52 -37 91q-19 19 -19 45t19 45t45 19t45 -19q75 -75 75 -181t-75 -181q-21 -19 -45 -19zM957 579q-27 0 -45 19q-19 19 -19 45t19 45q112 114 112 272
+t-112 272q-19 19 -19 45t19 45t45 19t45 -19q150 -150 150 -362t-150 -362q-18 -19 -45 -19zM1138 398q-27 0 -45 19q-19 19 -19 45t19 45q90 91 138.5 208t48.5 245t-48.5 245t-138.5 208q-19 19 -19 45t19 45t45 19t45 -19q109 -109 167 -249t58 -294t-58 -294t-167 -249
+q-18 -19 -45 -19z" />
+    <glyph glyph-name="uniF2A1" unicode="&#xf2a1;" horiz-adv-x="2176" 
+d="M192 352q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM704 352q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM704 864q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM1472 352
+q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM1984 352q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM1472 864q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM1984 864
+q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM1984 1376q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM384 192q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM896 192q0 -80 -56 -136
+t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM384 704q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM896 704q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM384 1216q0 -80 -56 -136t-136 -56
+t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM1664 192q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM896 1216q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM2176 192q0 -80 -56 -136t-136 -56t-136 56
+t-56 136t56 136t136 56t136 -56t56 -136zM1664 704q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM2176 704q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM1664 1216q0 -80 -56 -136t-136 -56t-136 56t-56 136
+t56 136t136 56t136 -56t56 -136zM2176 1216q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136z" />
+    <glyph glyph-name="uniF2A2" unicode="&#xf2a2;" horiz-adv-x="1792" 
+d="M128 -192q0 -26 -19 -45t-45 -19t-45 19t-19 45t19 45t45 19t45 -19t19 -45zM320 0q0 -26 -19 -45t-45 -19t-45 19t-19 45t19 45t45 19t45 -19t19 -45zM365 365l256 -256l-90 -90l-256 256zM704 384q0 -26 -19 -45t-45 -19t-45 19t-19 45t19 45t45 19t45 -19t19 -45z
+M1411 704q0 -59 -11.5 -108.5t-37.5 -93.5t-44 -67.5t-53 -64.5q-31 -35 -45.5 -54t-33.5 -50t-26.5 -64t-7.5 -74q0 -159 -112.5 -271.5t-271.5 -112.5q-26 0 -45 19t-19 45t19 45t45 19q106 0 181 75t75 181q0 57 11.5 105.5t37 91t43.5 66.5t52 63q40 46 59.5 72
+t37.5 74.5t18 103.5q0 185 -131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5q0 -26 -19 -45t-45 -19t-45 19t-19 45q0 117 45.5 223.5t123 184t184 123t223.5 45.5t223.5 -45.5t184 -123t123 -184t45.5 -223.5zM896 576q0 -26 -19 -45t-45 -19t-45 19t-19 45t19 45
+t45 19t45 -19t19 -45zM1184 704q0 -26 -19 -45t-45 -19t-45 19t-19 45q0 93 -65.5 158.5t-158.5 65.5q-92 0 -158 -65.5t-66 -158.5q0 -26 -19 -45t-45 -19t-45 19t-19 45q0 146 103 249t249 103t249 -103t103 -249zM1578 993q10 -25 -1 -49t-36 -34q-9 -4 -23 -4
+q-19 0 -35.5 11t-23.5 30q-68 178 -224 295q-21 16 -25 42t12 47q17 21 43 25t47 -12q183 -137 266 -351zM1788 1074q9 -25 -1.5 -49t-35.5 -34q-11 -4 -23 -4q-44 0 -60 41q-92 238 -297 393q-22 16 -25.5 42t12.5 47q16 22 42 25.5t47 -12.5q235 -175 341 -449z" />
+    <glyph glyph-name="uniF2A3" unicode="&#xf2a3;" horiz-adv-x="2304" 
+d="M1032 576q-59 2 -84 55q-17 34 -48 53.5t-68 19.5q-53 0 -90.5 -37.5t-37.5 -90.5q0 -56 36 -89l10 -8q34 -31 82 -31q37 0 68 19.5t48 53.5q25 53 84 55zM1600 704q0 56 -36 89l-10 8q-34 31 -82 31q-37 0 -68 -19.5t-48 -53.5q-25 -53 -84 -55q59 -2 84 -55
+q17 -34 48 -53.5t68 -19.5q53 0 90.5 37.5t37.5 90.5zM1174 925q-17 -35 -55 -48t-73 4q-62 31 -134 31q-51 0 -99 -17q3 0 9.5 0.5t9.5 0.5q92 0 170.5 -50t118.5 -133q17 -36 3.5 -73.5t-49.5 -54.5q-18 -9 -39 -9q21 0 39 -9q36 -17 49.5 -54.5t-3.5 -73.5
+q-40 -83 -118.5 -133t-170.5 -50h-6q-16 2 -44 4l-290 27l-239 -120q-14 -7 -29 -7q-40 0 -57 35l-160 320q-11 23 -4 47.5t29 37.5l209 119l148 267q17 155 91.5 291.5t195.5 236.5q31 25 70.5 21.5t64.5 -34.5t21.5 -70t-34.5 -65q-70 -59 -117 -128q123 84 267 101
+q40 5 71.5 -19t35.5 -64q5 -40 -19 -71.5t-64 -35.5q-84 -10 -159 -55q46 10 99 10q115 0 218 -50q36 -18 49 -55.5t-5 -73.5zM2137 1085l160 -320q11 -23 4 -47.5t-29 -37.5l-209 -119l-148 -267q-17 -155 -91.5 -291.5t-195.5 -236.5q-26 -22 -61 -22q-45 0 -74 35
+q-25 31 -21.5 70t34.5 65q70 59 117 128q-123 -84 -267 -101q-4 -1 -12 -1q-36 0 -63.5 24t-31.5 60q-5 40 19 71.5t64 35.5q84 10 159 55q-46 -10 -99 -10q-115 0 -218 50q-36 18 -49 55.5t5 73.5q17 35 55 48t73 -4q62 -31 134 -31q51 0 99 17q-3 0 -9.5 -0.5t-9.5 -0.5
+q-92 0 -170.5 50t-118.5 133q-17 36 -3.5 73.5t49.5 54.5q18 9 39 9q-21 0 -39 9q-36 17 -49.5 54.5t3.5 73.5q40 83 118.5 133t170.5 50h6h1q14 -2 42 -4l291 -27l239 120q14 7 29 7q40 0 57 -35z" />
+    <glyph glyph-name="uniF2A4" unicode="&#xf2a4;" horiz-adv-x="1792" 
+d="M1056 704q0 -26 19 -45t45 -19t45 19t19 45q0 146 -103 249t-249 103t-249 -103t-103 -249q0 -26 19 -45t45 -19t45 19t19 45q0 93 66 158.5t158 65.5t158 -65.5t66 -158.5zM835 1280q-117 0 -223.5 -45.5t-184 -123t-123 -184t-45.5 -223.5q0 -26 19 -45t45 -19t45 19
+t19 45q0 185 131.5 316.5t316.5 131.5t316.5 -131.5t131.5 -316.5q0 -55 -18 -103.5t-37.5 -74.5t-59.5 -72q-34 -39 -52 -63t-43.5 -66.5t-37 -91t-11.5 -105.5q0 -106 -75 -181t-181 -75q-26 0 -45 -19t-19 -45t19 -45t45 -19q159 0 271.5 112.5t112.5 271.5q0 41 7.5 74
+t26.5 64t33.5 50t45.5 54q35 41 53 64.5t44 67.5t37.5 93.5t11.5 108.5q0 117 -45.5 223.5t-123 184t-184 123t-223.5 45.5zM591 561l226 -226l-579 -579q-12 -12 -29 -12t-29 12l-168 168q-12 12 -12 29t12 29zM1612 1524l168 -168q12 -12 12 -29t-12 -30l-233 -233
+l-26 -25l-71 -71q-66 153 -195 258l91 91l207 207q13 12 30 12t29 -12z" />
+    <glyph glyph-name="uniF2A5" unicode="&#xf2a5;" 
+d="M866 1021q0 -27 -13 -94q-11 -50 -31.5 -150t-30.5 -150q-2 -11 -4.5 -12.5t-13.5 -2.5q-20 -2 -31 -2q-58 0 -84 49.5t-26 113.5q0 88 35 174t103 124q28 14 51 14q28 0 36.5 -16.5t8.5 -47.5zM1352 597q0 14 -39 75.5t-52 66.5q-21 8 -34 8q-91 0 -226 -77l-2 2
+q3 22 27.5 135t24.5 178q0 233 -242 233q-24 0 -68 -6q-94 -17 -168.5 -89.5t-111.5 -166.5t-37 -189q0 -146 80.5 -225t227.5 -79q25 0 25 -3t-1 -5q-4 -34 -26 -117q-14 -52 -51.5 -101t-82.5 -49q-42 0 -42 47q0 24 10.5 47.5t25 39.5t29.5 28.5t26 20t11 8.5q0 3 -7 10
+q-24 22 -58.5 36.5t-65.5 14.5q-35 0 -63.5 -34t-41 -75t-12.5 -75q0 -88 51.5 -142t138.5 -54q82 0 155 53t117.5 126t65.5 153q6 22 15.5 66.5t14.5 66.5q3 12 14 18q118 60 227 60q48 0 127 -18q1 -1 4 -1q5 0 9.5 4.5t4.5 8.5zM1536 1120v-960q0 -119 -84.5 -203.5
+t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="uniF2A6" unicode="&#xf2a6;" horiz-adv-x="1535" 
+d="M744 1231q0 24 -2 38.5t-8.5 30t-21 23t-37.5 7.5q-39 0 -78 -23q-105 -58 -159 -190.5t-54 -269.5q0 -44 8.5 -85.5t26.5 -80.5t52.5 -62.5t81.5 -23.5q4 0 18 -0.5t20 0t16 3t15 8.5t7 16q16 77 48 231.5t48 231.5q19 91 19 146zM1498 575q0 -7 -7.5 -13.5t-15.5 -6.5
+l-6 1q-22 3 -62 11t-72 12.5t-63 4.5q-167 0 -351 -93q-15 -8 -21 -27q-10 -36 -24.5 -105.5t-22.5 -100.5q-23 -91 -70 -179.5t-112.5 -164.5t-154.5 -123t-185 -47q-135 0 -214.5 83.5t-79.5 219.5q0 53 19.5 117t63 116.5t97.5 52.5q38 0 120 -33.5t83 -61.5
+q0 -1 -16.5 -12.5t-39.5 -31t-46 -44.5t-39 -61t-16 -74q0 -33 16.5 -53t48.5 -20q45 0 85 31.5t66.5 78t48 105.5t32.5 107t16 90v9q0 2 -3.5 3.5t-8.5 1.5h-10t-10 -0.5t-6 -0.5q-227 0 -352 122.5t-125 348.5q0 108 34.5 221t96 210t156 167.5t204.5 89.5q52 9 106 9
+q374 0 374 -360q0 -98 -38 -273t-43 -211l3 -3q101 57 182.5 88t167.5 31q22 0 53 -13q19 -7 80 -102.5t61 -116.5z" />
+    <glyph glyph-name="uniF2A7" unicode="&#xf2a7;" horiz-adv-x="1664" 
+d="M831 863q32 0 59 -18l222 -148q61 -40 110 -97l146 -170q40 -46 29 -106l-72 -413q-6 -32 -29.5 -53.5t-55.5 -25.5l-527 -56l-352 -32h-9q-39 0 -67.5 28t-28.5 68q0 37 27 64t65 32l260 32h-448q-41 0 -69.5 30t-26.5 71q2 39 32 65t69 26l442 1l-521 64q-41 5 -66 37
+t-19 73q6 35 34.5 57.5t65.5 22.5h10l481 -60l-351 94q-38 10 -62 41.5t-18 68.5q6 36 33 58.5t62 22.5q6 0 20 -2l448 -96l217 -37q1 0 3 -0.5t3 -0.5q23 0 30.5 23t-12.5 36l-186 125q-35 23 -42 63.5t18 73.5q27 38 76 38zM761 661l186 -125l-218 37l-5 2l-36 38
+l-238 262q-1 1 -2.5 3.5t-2.5 3.5q-24 31 -18.5 70t37.5 64q31 23 68 17.5t64 -33.5l142 -147q-2 -1 -5 -3.5t-4 -4.5q-32 -45 -23 -99t55 -85zM1648 1115l15 -266q4 -73 -11 -147l-48 -219q-12 -59 -67 -87l-106 -54q2 62 -39 109l-146 170q-53 61 -117 103l-222 148
+q-34 23 -76 23q-51 0 -88 -37l-235 312q-25 33 -18 73.5t41 63.5q33 22 71.5 14t62.5 -40l266 -352l-262 455q-21 35 -10.5 75t47.5 59q35 18 72.5 6t57.5 -46l241 -420l-136 337q-15 35 -4.5 74t44.5 56q37 19 76 6t56 -51l193 -415l101 -196q8 -15 23 -17.5t27 7.5t11 26
+l-12 224q-2 41 26 71t69 31q39 0 67 -28.5t30 -67.5z" />
+    <glyph glyph-name="uniF2A8" unicode="&#xf2a8;" horiz-adv-x="1792" 
+d="M335 180q-2 0 -6 2q-86 57 -168.5 145t-139.5 180q-21 30 -21 69q0 9 2 19t4 18t7 18t8.5 16t10.5 17t10 15t12 15.5t11 14.5q184 251 452 365q-110 198 -110 211q0 19 17 29q116 64 128 64q18 0 28 -16l124 -229q92 19 192 19q266 0 497.5 -137.5t378.5 -369.5
+q20 -31 20 -69t-20 -69q-91 -142 -218.5 -253.5t-278.5 -175.5q110 -198 110 -211q0 -20 -17 -29q-116 -64 -127 -64q-19 0 -29 16l-124 229l-64 119l-444 820l7 7q-58 -24 -99 -47q3 -5 127 -234t243 -449t119 -223q0 -7 -9 -9q-13 -3 -72 -3q-57 0 -60 7l-456 841
+q-39 -28 -82 -68q24 -43 214 -393.5t190 -354.5q0 -10 -11 -10q-14 0 -82.5 22t-72.5 28l-106 197l-224 413q-44 -53 -78 -106q2 -3 18 -25t23 -34l176 -327q0 -10 -10 -10zM1165 282l49 -91q273 111 450 385q-180 277 -459 389q67 -64 103 -148.5t36 -176.5
+q0 -106 -47 -200.5t-132 -157.5zM848 896q0 -20 14 -34t34 -14q86 0 147 -61t61 -147q0 -20 14 -34t34 -14t34 14t14 34q0 126 -89 215t-215 89q-20 0 -34 -14t-14 -34zM1214 961l-9 4l7 -7z" />
+    <glyph glyph-name="uniF2A9" unicode="&#xf2a9;" horiz-adv-x="1280" 
+d="M1050 430q0 -215 -147 -374q-148 -161 -378 -161q-232 0 -378 161q-147 159 -147 374q0 147 68 270.5t189 196.5t268 73q96 0 182 -31q-32 -62 -39 -126q-66 28 -143 28q-167 0 -280.5 -123t-113.5 -291q0 -170 112.5 -288.5t281.5 -118.5t281 118.5t112 288.5
+q0 89 -32 166q66 13 123 49q41 -98 41 -212zM846 619q0 -192 -79.5 -345t-238.5 -253l-14 -1q-29 0 -62 5q83 32 146.5 102.5t99.5 154.5t58.5 189t30 192.5t7.5 178.5q0 69 -3 103q55 -160 55 -326zM791 947v-2q-73 214 -206 440q88 -59 142.5 -186.5t63.5 -251.5z
+M1035 744q-83 0 -160 75q218 120 290 247q19 37 21 56q-42 -94 -139.5 -166.5t-204.5 -97.5q-35 54 -35 113q0 37 17 79t43 68q46 44 157 74q59 16 106 58.5t74 100.5q74 -105 74 -253q0 -109 -24 -170q-32 -77 -88.5 -130.5t-130.5 -53.5z" />
+    <glyph glyph-name="uniF2AA" unicode="&#xf2aa;" 
+d="M1050 495q0 78 -28 147q-41 -25 -85 -34q22 -50 22 -114q0 -117 -77 -198.5t-193 -81.5t-193.5 81.5t-77.5 198.5q0 115 78 199.5t193 84.5q53 0 98 -19q4 43 27 87q-60 21 -125 21q-154 0 -257.5 -108.5t-103.5 -263.5t103.5 -261t257.5 -106t257.5 106.5t103.5 260.5z
+M872 850q2 -24 2 -71q0 -63 -5 -123t-20.5 -132.5t-40.5 -130t-68.5 -106t-100.5 -70.5q21 -3 42 -3h10q219 139 219 411q0 116 -38 225zM872 850q-4 80 -44 171.5t-98 130.5q92 -156 142 -302zM1207 955q0 102 -51 174q-41 -86 -124 -109q-69 -19 -109 -53.5t-40 -99.5
+q0 -40 24 -77q74 17 140.5 67t95.5 115q-4 -52 -74.5 -111.5t-138.5 -97.5q52 -52 110 -52q51 0 90 37t60 90q17 42 17 117zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5
+t84.5 -203.5z" />
+    <glyph glyph-name="uniF2AB" unicode="&#xf2ab;" 
+d="M1279 388q0 22 -22 27q-67 15 -118 59t-80 108q-7 19 -7 25q0 15 19.5 26t43 17t43 20.5t19.5 36.5q0 19 -18.5 31.5t-38.5 12.5q-12 0 -32 -8t-31 -8q-4 0 -12 2q5 95 5 114q0 79 -17 114q-36 78 -103 121.5t-152 43.5q-199 0 -275 -165q-17 -35 -17 -114q0 -19 5 -114
+q-4 -2 -14 -2q-12 0 -32 7.5t-30 7.5q-21 0 -38.5 -12t-17.5 -32q0 -21 19.5 -35.5t43 -20.5t43 -17t19.5 -26q0 -6 -7 -25q-64 -138 -198 -167q-22 -5 -22 -27q0 -46 137 -68q2 -5 6 -26t11.5 -30.5t23.5 -9.5q12 0 37.5 4.5t39.5 4.5q35 0 67 -15t54 -32.5t57.5 -32.5
+t76.5 -15q43 0 79 15t57.5 32.5t53.5 32.5t67 15q14 0 39.5 -4t38.5 -4q16 0 23 10t11 30t6 25q137 22 137 68zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5
+t103 -385.5z" />
+    <glyph glyph-name="uniF2AC" unicode="&#xf2ac;" horiz-adv-x="1664" 
+d="M848 1408q134 1 240.5 -68.5t163.5 -192.5q27 -58 27 -179q0 -47 -9 -191q14 -7 28 -7q18 0 51 13.5t51 13.5q29 0 56 -18t27 -46q0 -32 -31.5 -54t-69 -31.5t-69 -29t-31.5 -47.5q0 -15 12 -43q37 -82 102.5 -150t144.5 -101q28 -12 80 -23q28 -6 28 -35
+q0 -70 -219 -103q-7 -11 -11 -39t-14 -46.5t-33 -18.5q-20 0 -62 6.5t-64 6.5q-37 0 -62 -5q-32 -5 -63 -22.5t-58 -38t-58 -40.5t-76 -33.5t-99 -13.5q-52 0 -96.5 13.5t-75 33.5t-57.5 40.5t-58 38t-62 22.5q-26 5 -63 5q-24 0 -65.5 -7.5t-58.5 -7.5q-25 0 -35 18.5
+t-14 47.5t-11 40q-219 33 -219 103q0 29 28 35q52 11 80 23q78 32 144.5 101t102.5 150q12 28 12 43q0 28 -31.5 47.5t-69.5 29.5t-69.5 31.5t-31.5 52.5q0 27 26 45.5t55 18.5q15 0 48 -13t53 -13q18 0 32 7q-9 142 -9 190q0 122 27 180q64 137 172 198t264 63z" />
+    <glyph glyph-name="uniF2AD" unicode="&#xf2ad;" 
+d="M1280 388q0 22 -22 27q-67 14 -118 58t-80 109q-7 14 -7 25q0 15 19.5 26t42.5 17t42.5 20.5t19.5 36.5q0 19 -18.5 31.5t-38.5 12.5q-11 0 -31 -8t-32 -8q-4 0 -12 2q5 63 5 115q0 78 -17 114q-36 78 -102.5 121.5t-152.5 43.5q-198 0 -275 -165q-18 -38 -18 -115
+q0 -38 6 -114q-10 -2 -15 -2q-11 0 -31.5 8t-30.5 8q-20 0 -37.5 -12.5t-17.5 -32.5q0 -21 19.5 -35.5t42.5 -20.5t42.5 -17t19.5 -26q0 -11 -7 -25q-64 -138 -198 -167q-22 -5 -22 -27q0 -47 138 -69q2 -5 6 -26t11 -30.5t23 -9.5q13 0 38.5 5t38.5 5q35 0 67.5 -15
+t54.5 -32.5t57.5 -32.5t76.5 -15q43 0 79 15t57.5 32.5t54 32.5t67.5 15q13 0 39 -4.5t39 -4.5q15 0 22.5 9.5t11.5 31t5 24.5q138 22 138 69zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960
+q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="uniF2AE" unicode="&#xf2ae;" horiz-adv-x="2304" 
+d="M2304 1536q-69 -46 -125 -92t-89 -81t-59.5 -71.5t-37.5 -57.5t-22 -44.5t-14 -29.5q-10 -18 -35.5 -136.5t-48.5 -164.5q-15 -29 -50 -60.5t-67.5 -50.5t-72.5 -41t-48 -28q-47 -31 -151 -231q-341 14 -630 -158q-92 -53 -303 -179q47 16 86 31t55 22l15 7
+q71 27 163 64.5t133.5 53.5t108 34.5t142.5 31.5q186 31 465 -7q1 0 10 -3q11 -6 14 -17t-3 -22l-194 -345q-15 -29 -47 -22q-128 24 -354 24q-146 0 -402 -44.5t-392 -46.5q-82 -1 -149 13t-107 37t-61 40t-33 34l-1 1v2q0 6 6 6q138 0 371 55q192 366 374.5 524t383.5 158
+q5 0 14.5 -0.5t38 -5t55 -12t61.5 -24.5t63 -39.5t54 -59t40 -82.5l102 177q2 4 21 42.5t44.5 86.5t61 109.5t84 133.5t100.5 137q66 82 128 141.5t121.5 96.5t92.5 53.5t88 39.5z" />
+    <glyph glyph-name="uniF2B0" unicode="&#xf2b0;" 
+d="M1322 640q0 -45 -5 -76l-236 14l224 -78q-19 -73 -58 -141l-214 103l177 -158q-44 -61 -107 -108l-157 178l103 -215q-61 -37 -140 -59l-79 228l14 -240q-38 -6 -76 -6t-76 6l14 238l-78 -226q-74 19 -140 59l103 215l-157 -178q-59 43 -108 108l178 158l-214 -104
+q-39 69 -58 141l224 79l-237 -14q-5 42 -5 76q0 35 5 77l238 -14l-225 79q19 73 58 140l214 -104l-177 159q46 61 107 108l158 -178l-103 215q67 39 140 58l77 -224l-13 236q36 6 75 6q38 0 76 -6l-14 -237l78 225q74 -19 140 -59l-103 -214l158 178q61 -47 107 -108
+l-177 -159l213 104q37 -62 58 -141l-224 -78l237 14q5 -31 5 -77zM1352 640q0 160 -78.5 295.5t-213 214t-292.5 78.5q-119 0 -227 -46.5t-186.5 -125t-124.5 -187.5t-46 -229q0 -119 46 -228t124.5 -187.5t186.5 -125t227 -46.5q158 0 292.5 78.5t213 214t78.5 294.5z
+M1425 1023v-766l-657 -383l-657 383v766l657 383zM768 -183l708 412v823l-708 411l-708 -411v-823zM1536 1088v-896l-768 -448l-768 448v896l768 448z" />
+    <glyph glyph-name="uniF2B1" unicode="&#xf2b1;" horiz-adv-x="1664" 
+d="M339 1318h691l-26 -72h-665q-110 0 -188.5 -79t-78.5 -189v-771q0 -95 60.5 -169.5t153.5 -93.5q23 -5 98 -5v-72h-45q-140 0 -239.5 100t-99.5 240v771q0 140 99.5 240t239.5 100zM1190 1536h247l-482 -1294q-23 -61 -40.5 -103.5t-45 -98t-54 -93.5t-64.5 -78.5
+t-79.5 -65t-95.5 -41t-116 -18.5v195q163 26 220 182q20 52 20 105q0 54 -20 106l-285 733h228l187 -585zM1664 978v-1111h-795q37 55 45 73h678v1038q0 85 -49.5 155t-129.5 99l25 67q101 -34 163.5 -123.5t62.5 -197.5z" />
+    <glyph glyph-name="uniF2B2" unicode="&#xf2b2;" horiz-adv-x="1792" 
+d="M852 1227q0 -29 -17 -52.5t-45 -23.5t-45 23.5t-17 52.5t17 52.5t45 23.5t45 -23.5t17 -52.5zM688 -149v114q0 30 -20.5 51.5t-50.5 21.5t-50 -21.5t-20 -51.5v-114q0 -30 20.5 -52t49.5 -22q30 0 50.5 22t20.5 52zM860 -149v114q0 30 -20 51.5t-50 21.5t-50.5 -21.5
+t-20.5 -51.5v-114q0 -30 20.5 -52t50.5 -22q29 0 49.5 22t20.5 52zM1034 -149v114q0 30 -20.5 51.5t-50.5 21.5t-50.5 -21.5t-20.5 -51.5v-114q0 -30 20.5 -52t50.5 -22t50.5 22t20.5 52zM1208 -149v114q0 30 -20.5 51.5t-50.5 21.5t-50.5 -21.5t-20.5 -51.5v-114
+q0 -30 20.5 -52t50.5 -22t50.5 22t20.5 52zM1476 535q-84 -160 -232 -259.5t-323 -99.5q-123 0 -229.5 51.5t-178.5 137t-113 197.5t-41 232q0 88 21 174q-104 -175 -104 -390q0 -162 65 -312t185 -251q30 57 91 57q56 0 86 -50q32 50 87 50q56 0 86 -50q32 50 87 50t87 -50
+q30 50 86 50q28 0 52.5 -15.5t37.5 -40.5q112 94 177 231.5t73 287.5zM1326 564q0 75 -72 75q-17 0 -47 -6q-95 -19 -149 -19q-226 0 -226 243q0 86 30 204q-83 -127 -83 -275q0 -150 89 -260.5t235 -110.5q111 0 210 70q13 48 13 79zM884 1223q0 50 -32 89.5t-81 39.5
+t-81 -39.5t-32 -89.5q0 -51 31.5 -90.5t81.5 -39.5t81.5 39.5t31.5 90.5zM1513 884q0 96 -37.5 179t-113 137t-173.5 54q-77 0 -149 -35t-127 -94q-48 -159 -48 -268q0 -104 45.5 -157t147.5 -53q53 0 142 19q36 6 53 6q51 0 77.5 -28t26.5 -80q0 -26 -4 -46
+q75 68 117.5 165.5t42.5 200.5zM1792 667q0 -111 -33.5 -249.5t-93.5 -204.5q-58 -64 -195 -142.5t-228 -104.5l-4 -1v-114q0 -43 -29.5 -75t-72.5 -32q-56 0 -86 50q-32 -50 -87 -50t-87 50q-30 -50 -86 -50q-55 0 -87 50q-30 -50 -86 -50q-47 0 -75 33.5t-28 81.5
+q-90 -68 -198 -68q-118 0 -211 80q54 1 106 20q-113 31 -182 127q32 -7 71 -7q89 0 164 46q-192 192 -240 306q-24 56 -24 160q0 57 9 125.5t31.5 146.5t55 141t86.5 105t120 42q59 0 81 -52q19 29 42 54q2 3 12 13t13 16q10 15 23 38t25 42t28 39q87 111 211.5 177
+t260.5 66q35 0 62 -4q59 64 146 64q83 0 140 -57q5 -5 5 -12q0 -5 -6 -13.5t-12.5 -16t-16 -17l-10.5 -10.5q17 -6 36 -18t19 -24q0 -6 -16 -25q157 -138 197 -378q25 30 60 30q45 0 100 -49q90 -80 90 -279z" />
+    <glyph glyph-name="uniF2B3" unicode="&#xf2b3;" 
+d="M917 631q0 33 -6 64h-362v-132h217q-12 -76 -74.5 -120.5t-142.5 -44.5q-99 0 -169 71.5t-70 170.5t70 170.5t169 71.5q93 0 153 -59l104 101q-108 100 -257 100q-160 0 -272 -112.5t-112 -271.5t112 -271.5t272 -112.5q165 0 266.5 105t101.5 270zM1262 585h109v110
+h-109v110h-110v-110h-110v-110h110v-110h110v110zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="uniF2B4" unicode="&#xf2b4;" 
+d="M1536 1024v-839q0 -48 -49 -62q-174 -52 -338 -52q-73 0 -215.5 29.5t-227.5 29.5q-164 0 -370 -48v-338h-160v1368q-63 25 -101 81t-38 124q0 91 64 155t155 64t155 -64t64 -155q0 -68 -38 -124t-101 -81v-68q190 44 343 44q99 0 198 -15q14 -2 111.5 -22.5t149.5 -20.5
+q77 0 165 18q11 2 80 21t89 19q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="uniF2B5" unicode="&#xf2b5;" horiz-adv-x="2304" 
+d="M192 384q40 0 56 32t0 64t-56 32t-56 -32t0 -64t56 -32zM1665 442q-10 13 -38.5 50t-41.5 54t-38 49t-42.5 53t-40.5 47t-45 49l-125 -140q-83 -94 -208.5 -92t-205.5 98q-57 69 -56.5 158t58.5 157l177 206q-22 11 -51 16.5t-47.5 6t-56.5 -0.5t-49 -1q-92 0 -158 -66
+l-158 -158h-155v-544q5 0 21 0.5t22 0t19.5 -2t20.5 -4.5t17.5 -8.5t18.5 -13.5l297 -292q115 -111 227 -111q78 0 125 47q57 -20 112.5 8t72.5 85q74 -6 127 44q20 18 36 45.5t14 50.5q10 -10 43 -10q43 0 77 21t49.5 53t12 71.5t-30.5 73.5zM1824 384h96v512h-93l-157 180
+q-66 76 -169 76h-167q-89 0 -146 -67l-209 -243q-28 -33 -28 -75t27 -75q43 -51 110 -52t111 49l193 218q25 23 53.5 21.5t47 -27t8.5 -56.5q16 -19 56 -63t60 -68q29 -36 82.5 -105.5t64.5 -84.5q52 -66 60 -140zM2112 384q40 0 56 32t0 64t-56 32t-56 -32t0 -64t56 -32z
+M2304 960v-640q0 -26 -19 -45t-45 -19h-434q-27 -65 -82 -106.5t-125 -51.5q-33 -48 -80.5 -81.5t-102.5 -45.5q-42 -53 -104.5 -81.5t-128.5 -24.5q-60 -34 -126 -39.5t-127.5 14t-117 53.5t-103.5 81l-287 282h-358q-26 0 -45 19t-19 45v672q0 26 19 45t45 19h421
+q14 14 47 48t47.5 48t44 40t50.5 37.5t51 25.5t62 19.5t68 5.5h117q99 0 181 -56q82 56 181 56h167q35 0 67 -6t56.5 -14.5t51.5 -26.5t44.5 -31t43 -39.5t39 -42t41 -48t41.5 -48.5h355q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="uniF2B6" unicode="&#xf2b6;" horiz-adv-x="1792" 
+d="M1792 882v-978q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v978q0 15 11 24q8 7 39 34.5t41.5 36t45.5 37.5t70 55.5t96 73t143.5 107t192.5 140.5q5 4 52.5 40t71.5 52.5t64 35t69 18.5t69 -18.5t65 -35.5t71 -52t52 -40q110 -80 192.5 -140.5t143.5 -107
+t96 -73t70 -55.5t45.5 -37.5t41.5 -36t39 -34.5q11 -9 11 -24zM1228 297q263 191 345 252q11 8 12.5 20.5t-6.5 23.5l-38 52q-8 11 -21 12.5t-24 -6.5q-231 -169 -343 -250q-5 -3 -52 -39t-71.5 -52.5t-64.5 -35t-69 -18.5t-69 18.5t-64.5 35t-71.5 52.5t-52 39
+q-186 134 -343 250q-11 8 -24 6.5t-21 -12.5l-38 -52q-8 -11 -6.5 -23.5t12.5 -20.5q82 -61 345 -252q10 -8 50 -38t65 -47t64 -39.5t77.5 -33.5t75.5 -11t75.5 11t79 34.5t64.5 39.5t65 47.5t48 36.5z" />
+    <glyph glyph-name="uniF2B7" unicode="&#xf2b7;" horiz-adv-x="1792" 
+d="M1474 623l39 -51q8 -11 6.5 -23.5t-11.5 -20.5q-43 -34 -126.5 -98.5t-146.5 -113t-67 -51.5q-39 -32 -60 -48t-60.5 -41t-76.5 -36.5t-74 -11.5h-1h-1q-37 0 -74 11.5t-76 36.5t-61 41.5t-60 47.5q-5 4 -65 50.5t-143.5 111t-122.5 94.5q-11 8 -12.5 20.5t6.5 23.5
+l37 52q8 11 21.5 13t24.5 -7q94 -73 306 -236q5 -4 43.5 -35t60.5 -46.5t56.5 -32.5t58.5 -17h1h1q24 0 58.5 17t56.5 32.5t60.5 46.5t43.5 35q258 198 313 242q11 8 24 6.5t21 -12.5zM1664 -96v928q-90 83 -159 139q-91 74 -389 304q-3 2 -43 35t-61 48t-56 32.5t-59 17.5
+h-1h-1q-24 0 -59 -17.5t-56 -32.5t-61 -48t-43 -35q-215 -166 -315.5 -245.5t-129.5 -104t-82 -74.5q-14 -12 -21 -19v-928q0 -13 9.5 -22.5t22.5 -9.5h1472q13 0 22.5 9.5t9.5 22.5zM1792 832v-928q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v928q0 56 41 94
+q123 114 350 290.5t233 181.5q36 30 59 47.5t61.5 42t76 36.5t74.5 12h1h1q37 0 74.5 -12t76 -36.5t61.5 -42t59 -47.5q43 -36 156 -122t226 -177t201 -173q41 -38 41 -94z" />
+    <glyph glyph-name="uniF2B8" unicode="&#xf2b8;" 
+d="M330 1l202 -214l-34 236l-216 213zM556 -225l274 218l-11 245l-300 -215zM245 413l227 -213l-48 327l-245 204zM495 189l317 214l-14 324l-352 -200zM843 178l95 -80l-2 239l-103 79q0 -1 1 -8.5t0 -12t-5 -7.5l-78 -52l85 -70q7 -6 7 -88zM138 930l256 -200l-68 465
+l-279 173zM1173 267l15 234l-230 -164l2 -240zM417 722l373 194l-19 441l-423 -163zM1270 357l20 233l-226 142l-2 -105l144 -95q6 -4 4 -9l-7 -119zM1461 496l30 222l-179 -128l-20 -228zM1273 329l-71 49l-8 -117q0 -5 -4 -8l-234 -187q-7 -5 -14 0l-98 83l7 -161
+q0 -5 -4 -8l-293 -234q-4 -2 -6 -2q-8 2 -8 3l-228 242q-4 4 -59 277q-2 7 5 11l61 37q-94 86 -95 92l-72 351q-2 7 6 12l94 45q-133 100 -135 108l-96 466q-2 10 7 13l433 135q5 0 8 -1l317 -153q6 -4 6 -9l20 -463q0 -7 -6 -10l-118 -61l126 -85q5 -2 5 -8l5 -123l121 74
+q5 4 11 0l84 -56l3 110q0 6 5 9l206 126q6 3 11 0l245 -135q4 -4 5 -7t-6.5 -60t-17.5 -124.5t-10 -70.5q0 -5 -4 -7l-191 -153q-6 -5 -13 0z" />
+    <glyph glyph-name="uniF2B9" unicode="&#xf2b9;" horiz-adv-x="1664" 
+d="M1201 298q0 57 -5.5 107t-21 100.5t-39.5 86t-64 58t-91 22.5q-6 -4 -33.5 -20.5t-42.5 -24.5t-40.5 -20t-49 -17t-46.5 -5t-46.5 5t-49 17t-40.5 20t-42.5 24.5t-33.5 20.5q-51 0 -91 -22.5t-64 -58t-39.5 -86t-21 -100.5t-5.5 -107q0 -73 42 -121.5t103 -48.5h576
+q61 0 103 48.5t42 121.5zM1028 892q0 108 -76.5 184t-183.5 76t-183.5 -76t-76.5 -184q0 -107 76.5 -183t183.5 -76t183.5 76t76.5 183zM1664 352v-192q0 -14 -9 -23t-23 -9h-96v-224q0 -66 -47 -113t-113 -47h-1216q-66 0 -113 47t-47 113v1472q0 66 47 113t113 47h1216
+q66 0 113 -47t47 -113v-224h96q14 0 23 -9t9 -23v-192q0 -14 -9 -23t-23 -9h-96v-128h96q14 0 23 -9t9 -23v-192q0 -14 -9 -23t-23 -9h-96v-128h96q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="uniF2BA" unicode="&#xf2ba;" horiz-adv-x="1664" 
+d="M1028 892q0 -107 -76.5 -183t-183.5 -76t-183.5 76t-76.5 183q0 108 76.5 184t183.5 76t183.5 -76t76.5 -184zM980 672q46 0 82.5 -17t60 -47.5t39.5 -67t24 -81t11.5 -82.5t3.5 -79q0 -67 -39.5 -118.5t-105.5 -51.5h-576q-66 0 -105.5 51.5t-39.5 118.5q0 48 4.5 93.5
+t18.5 98.5t36.5 91.5t63 64.5t93.5 26h5q7 -4 32 -19.5t35.5 -21t33 -17t37 -16t35 -9t39.5 -4.5t39.5 4.5t35 9t37 16t33 17t35.5 21t32 19.5zM1664 928q0 -13 -9.5 -22.5t-22.5 -9.5h-96v-128h96q13 0 22.5 -9.5t9.5 -22.5v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-96v-128h96
+q13 0 22.5 -9.5t9.5 -22.5v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-96v-224q0 -66 -47 -113t-113 -47h-1216q-66 0 -113 47t-47 113v1472q0 66 47 113t113 47h1216q66 0 113 -47t47 -113v-224h96q13 0 22.5 -9.5t9.5 -22.5v-192zM1408 -96v1472q0 13 -9.5 22.5t-22.5 9.5h-1216
+q-13 0 -22.5 -9.5t-9.5 -22.5v-1472q0 -13 9.5 -22.5t22.5 -9.5h1216q13 0 22.5 9.5t9.5 22.5z" />
+    <glyph glyph-name="uniF2BB" unicode="&#xf2bb;" horiz-adv-x="2048" 
+d="M1024 405q0 64 -9 117.5t-29.5 103t-60.5 78t-97 28.5q-6 -4 -30 -18t-37.5 -21.5t-35.5 -17.5t-43 -14.5t-42 -4.5t-42 4.5t-43 14.5t-35.5 17.5t-37.5 21.5t-30 18q-57 0 -97 -28.5t-60.5 -78t-29.5 -103t-9 -117.5t37 -106.5t91 -42.5h512q54 0 91 42.5t37 106.5z
+M867 925q0 94 -66.5 160.5t-160.5 66.5t-160.5 -66.5t-66.5 -160.5t66.5 -160.5t160.5 -66.5t160.5 66.5t66.5 160.5zM1792 416v64q0 14 -9 23t-23 9h-576q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h576q14 0 23 9t9 23zM1792 676v56q0 15 -10.5 25.5t-25.5 10.5h-568
+q-15 0 -25.5 -10.5t-10.5 -25.5v-56q0 -15 10.5 -25.5t25.5 -10.5h568q15 0 25.5 10.5t10.5 25.5zM1792 928v64q0 14 -9 23t-23 9h-576q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h576q14 0 23 9t9 23zM2048 1248v-1216q0 -66 -47 -113t-113 -47h-352v96q0 14 -9 23t-23 9
+h-64q-14 0 -23 -9t-9 -23v-96h-768v96q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-96h-352q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1728q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2BC" unicode="&#xf2bc;" horiz-adv-x="2048" 
+d="M1024 405q0 -64 -37 -106.5t-91 -42.5h-512q-54 0 -91 42.5t-37 106.5t9 117.5t29.5 103t60.5 78t97 28.5q6 -4 30 -18t37.5 -21.5t35.5 -17.5t43 -14.5t42 -4.5t42 4.5t43 14.5t35.5 17.5t37.5 21.5t30 18q57 0 97 -28.5t60.5 -78t29.5 -103t9 -117.5zM867 925
+q0 -94 -66.5 -160.5t-160.5 -66.5t-160.5 66.5t-66.5 160.5t66.5 160.5t160.5 66.5t160.5 -66.5t66.5 -160.5zM1792 480v-64q0 -14 -9 -23t-23 -9h-576q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h576q14 0 23 -9t9 -23zM1792 732v-56q0 -15 -10.5 -25.5t-25.5 -10.5h-568
+q-15 0 -25.5 10.5t-10.5 25.5v56q0 15 10.5 25.5t25.5 10.5h568q15 0 25.5 -10.5t10.5 -25.5zM1792 992v-64q0 -14 -9 -23t-23 -9h-576q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h576q14 0 23 -9t9 -23zM1920 32v1216q0 13 -9.5 22.5t-22.5 9.5h-1728q-13 0 -22.5 -9.5
+t-9.5 -22.5v-1216q0 -13 9.5 -22.5t22.5 -9.5h352v96q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-96h768v96q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-96h352q13 0 22.5 9.5t9.5 22.5zM2048 1248v-1216q0 -66 -47 -113t-113 -47h-1728q-66 0 -113 47t-47 113v1216q0 66 47 113
+t113 47h1728q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2BD" unicode="&#xf2bd;" horiz-adv-x="1792" 
+d="M1523 197q-22 155 -87.5 257.5t-184.5 118.5q-67 -74 -159.5 -115.5t-195.5 -41.5t-195.5 41.5t-159.5 115.5q-119 -16 -184.5 -118.5t-87.5 -257.5q106 -150 271 -237.5t356 -87.5t356 87.5t271 237.5zM1280 896q0 159 -112.5 271.5t-271.5 112.5t-271.5 -112.5
+t-112.5 -271.5t112.5 -271.5t271.5 -112.5t271.5 112.5t112.5 271.5zM1792 640q0 -182 -71 -347.5t-190.5 -286t-285.5 -191.5t-349 -71q-182 0 -348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="uniF2BE" unicode="&#xf2be;" horiz-adv-x="1792" 
+d="M896 1536q182 0 348 -71t286 -191t191 -286t71 -348q0 -181 -70.5 -347t-190.5 -286t-286 -191.5t-349 -71.5t-349 71t-285.5 191.5t-190.5 286t-71 347.5t71 348t191 286t286 191t348 71zM1515 185q149 205 149 455q0 156 -61 298t-164 245t-245 164t-298 61t-298 -61
+t-245 -164t-164 -245t-61 -298q0 -250 149 -455q66 327 306 327q131 -128 313 -128t313 128q240 0 306 -327zM1280 832q0 159 -112.5 271.5t-271.5 112.5t-271.5 -112.5t-112.5 -271.5t112.5 -271.5t271.5 -112.5t271.5 112.5t112.5 271.5z" />
+    <glyph glyph-name="uniF2C0" unicode="&#xf2c0;" 
+d="M1201 752q47 -14 89.5 -38t89 -73t79.5 -115.5t55 -172t22 -236.5q0 -154 -100 -263.5t-241 -109.5h-854q-141 0 -241 109.5t-100 263.5q0 131 22 236.5t55 172t79.5 115.5t89 73t89.5 38q-79 125 -79 272q0 104 40.5 198.5t109.5 163.5t163.5 109.5t198.5 40.5
+t198.5 -40.5t163.5 -109.5t109.5 -163.5t40.5 -198.5q0 -147 -79 -272zM768 1408q-159 0 -271.5 -112.5t-112.5 -271.5t112.5 -271.5t271.5 -112.5t271.5 112.5t112.5 271.5t-112.5 271.5t-271.5 112.5zM1195 -128q88 0 150.5 71.5t62.5 173.5q0 239 -78.5 377t-225.5 145
+q-145 -127 -336 -127t-336 127q-147 -7 -225.5 -145t-78.5 -377q0 -102 62.5 -173.5t150.5 -71.5h854z" />
+    <glyph glyph-name="uniF2C1" unicode="&#xf2c1;" horiz-adv-x="1280" 
+d="M1024 278q0 -64 -37 -107t-91 -43h-512q-54 0 -91 43t-37 107t9 118t29.5 104t61 78.5t96.5 28.5q80 -75 188 -75t188 75q56 0 96.5 -28.5t61 -78.5t29.5 -104t9 -118zM870 797q0 -94 -67.5 -160.5t-162.5 -66.5t-162.5 66.5t-67.5 160.5t67.5 160.5t162.5 66.5
+t162.5 -66.5t67.5 -160.5zM1152 -96v1376h-1024v-1376q0 -13 9.5 -22.5t22.5 -9.5h960q13 0 22.5 9.5t9.5 22.5zM1280 1376v-1472q0 -66 -47 -113t-113 -47h-960q-66 0 -113 47t-47 113v1472q0 66 47 113t113 47h352v-96q0 -14 9 -23t23 -9h192q14 0 23 9t9 23v96h352
+q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2C2" unicode="&#xf2c2;" horiz-adv-x="2048" 
+d="M896 324q0 54 -7.5 100.5t-24.5 90t-51 68.5t-81 25q-64 -64 -156 -64t-156 64q-47 0 -81 -25t-51 -68.5t-24.5 -90t-7.5 -100.5q0 -55 31.5 -93.5t75.5 -38.5h426q44 0 75.5 38.5t31.5 93.5zM768 768q0 80 -56 136t-136 56t-136 -56t-56 -136t56 -136t136 -56t136 56
+t56 136zM1792 288v64q0 14 -9 23t-23 9h-704q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h704q14 0 23 9t9 23zM1408 544v64q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1792 544v64q0 14 -9 23t-23 9h-192q-14 0 -23 -9t-9 -23
+v-64q0 -14 9 -23t23 -9h192q14 0 23 9t9 23zM1792 800v64q0 14 -9 23t-23 9h-704q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h704q14 0 23 9t9 23zM128 1152h1792v96q0 14 -9 23t-23 9h-1728q-14 0 -23 -9t-9 -23v-96zM2048 1248v-1216q0 -66 -47 -113t-113 -47h-1728
+q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1728q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2C3" unicode="&#xf2c3;" horiz-adv-x="2048" 
+d="M896 324q0 -55 -31.5 -93.5t-75.5 -38.5h-426q-44 0 -75.5 38.5t-31.5 93.5q0 54 7.5 100.5t24.5 90t51 68.5t81 25q64 -64 156 -64t156 64q47 0 81 -25t51 -68.5t24.5 -90t7.5 -100.5zM768 768q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136z
+M1792 352v-64q0 -14 -9 -23t-23 -9h-704q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h704q14 0 23 -9t9 -23zM1408 608v-64q0 -14 -9 -23t-23 -9h-320q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h320q14 0 23 -9t9 -23zM1792 608v-64q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v64
+q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1792 864v-64q0 -14 -9 -23t-23 -9h-704q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h704q14 0 23 -9t9 -23zM1920 32v1120h-1792v-1120q0 -13 9.5 -22.5t22.5 -9.5h1728q13 0 22.5 9.5t9.5 22.5zM2048 1248v-1216q0 -66 -47 -113t-113 -47
+h-1728q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1728q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2C4" unicode="&#xf2c4;" horiz-adv-x="1792" 
+d="M1255 749q0 318 -105 474.5t-330 156.5q-222 0 -326 -157t-104 -474q0 -316 104 -471.5t326 -155.5q74 0 131 17q-22 43 -39 73t-44 65t-53.5 56.5t-63 36t-77.5 14.5q-46 0 -79 -16l-49 97q105 91 276 91q132 0 215.5 -54t150.5 -155q67 149 67 402zM1645 117h117
+q3 -27 -2 -67t-26.5 -95t-58 -100.5t-107 -78t-162.5 -32.5q-71 0 -130.5 19t-105.5 56t-79 78t-66 96q-97 -27 -205 -27q-150 0 -292.5 58t-253 158.5t-178 249t-67.5 317.5q0 170 67.5 319.5t178.5 250.5t253.5 159t291.5 58q121 0 238.5 -36t217 -106t176 -164.5
+t119.5 -219t43 -261.5q0 -190 -80.5 -347.5t-218.5 -264.5q47 -70 93.5 -106.5t104.5 -36.5q61 0 94 37.5t38 85.5z" />
+    <glyph glyph-name="uniF2C5" unicode="&#xf2c5;" horiz-adv-x="2304" 
+d="M453 -101q0 -21 -16 -37.5t-37 -16.5q-1 0 -13 3q-63 15 -162 140q-225 284 -225 676q0 341 213 614q39 51 95 103.5t94 52.5q19 0 35 -13.5t16 -32.5q0 -27 -63 -90q-98 -102 -147 -184q-119 -199 -119 -449q0 -281 123 -491q50 -85 136 -173q2 -3 14.5 -16t19.5 -21
+t17 -20.5t14.5 -23.5t4.5 -21zM1796 33q0 -29 -17.5 -48.5t-46.5 -19.5h-1081q-26 0 -45 19t-19 45q0 29 17.5 48.5t46.5 19.5h1081q26 0 45 -19t19 -45zM1581 644q0 -134 -67 -233q-25 -38 -69.5 -78.5t-83.5 -60.5q-16 -10 -27 -10q-7 0 -15 6t-8 12q0 9 19 30t42 46
+t42 67.5t19 88.5q0 76 -35 130q-29 42 -46 42q-3 0 -3 -5q0 -12 7.5 -35.5t7.5 -36.5q0 -22 -21.5 -35t-44.5 -13q-66 0 -66 76q0 15 1.5 44t1.5 44q0 25 -10 46q-13 25 -42 53.5t-51 28.5q-5 0 -7 -0.5t-3.5 -2.5t-1.5 -6q0 -2 16 -26t16 -54q0 -37 -19 -68t-46 -54
+t-53.5 -46t-45.5 -54t-19 -68q0 -98 42 -160q29 -43 79 -63q16 -5 17 -10q1 -2 1 -5q0 -16 -18 -16q-6 0 -33 11q-119 43 -195 139.5t-76 218.5q0 55 24.5 115.5t60 115t70.5 108.5t59.5 113.5t24.5 111.5q0 53 -25 94q-29 48 -56 64q-19 9 -19 21q0 20 41 20q50 0 110 -29
+q41 -19 71 -44.5t49.5 -51t33.5 -62.5t22 -69t16 -80q0 -1 3 -17.5t4.5 -25t5.5 -25t9 -27t11 -21.5t14.5 -16.5t18.5 -5.5q23 0 37 14t14 37q0 25 -20 67t-20 52t10 10q27 0 93 -70q72 -76 102.5 -156t30.5 -186zM2304 615q0 -274 -138 -503q-19 -32 -48 -72t-68 -86.5
+t-81 -77t-74 -30.5q-16 0 -31 15.5t-15 31.5q0 15 29 50.5t68.5 77t48.5 52.5q183 230 183 531q0 131 -20.5 235t-72.5 211q-58 119 -163 228q-2 3 -13 13.5t-16.5 16.5t-15 17.5t-15 20t-9.5 18.5t-4 19q0 19 16 35.5t35 16.5q70 0 196 -169q98 -131 146 -273t60 -314
+q2 -42 2 -64z" />
+    <glyph glyph-name="uniF2C6" unicode="&#xf2c6;" horiz-adv-x="1792" 
+d="M1189 229l147 693q9 44 -10.5 63t-51.5 7l-864 -333q-29 -11 -39.5 -25t-2.5 -26.5t32 -19.5l221 -69l513 323q21 14 32 6q7 -5 -4 -15l-415 -375v0v0l-16 -228q23 0 45 22l108 104l224 -165q64 -36 81 38zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71
+t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="uniF2C7" unicode="&#xf2c7;" horiz-adv-x="1024" 
+d="M640 192q0 -80 -56 -136t-136 -56t-136 56t-56 136q0 60 35 110t93 71v907h128v-907q58 -21 93 -71t35 -110zM768 192q0 77 -34 144t-94 112v768q0 80 -56 136t-136 56t-136 -56t-56 -136v-768q-60 -45 -94 -112t-34 -144q0 -133 93.5 -226.5t226.5 -93.5t226.5 93.5
+t93.5 226.5zM896 192q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 182 128 313v711q0 133 93.5 226.5t226.5 93.5t226.5 -93.5t93.5 -226.5v-711q128 -131 128 -313zM1024 768v-128h-192v128h192zM1024 1024v-128h-192v128h192zM1024 1280v-128h-192
+v128h192z" />
+    <glyph glyph-name="uniF2C8" unicode="&#xf2c8;" horiz-adv-x="1024" 
+d="M640 192q0 -80 -56 -136t-136 -56t-136 56t-56 136q0 60 35 110t93 71v651h128v-651q58 -21 93 -71t35 -110zM768 192q0 77 -34 144t-94 112v768q0 80 -56 136t-136 56t-136 -56t-56 -136v-768q-60 -45 -94 -112t-34 -144q0 -133 93.5 -226.5t226.5 -93.5t226.5 93.5
+t93.5 226.5zM896 192q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 182 128 313v711q0 133 93.5 226.5t226.5 93.5t226.5 -93.5t93.5 -226.5v-711q128 -131 128 -313zM1024 768v-128h-192v128h192zM1024 1024v-128h-192v128h192zM1024 1280v-128h-192
+v128h192z" />
+    <glyph glyph-name="uniF2C9" unicode="&#xf2c9;" horiz-adv-x="1024" 
+d="M640 192q0 -80 -56 -136t-136 -56t-136 56t-56 136q0 60 35 110t93 71v395h128v-395q58 -21 93 -71t35 -110zM768 192q0 77 -34 144t-94 112v768q0 80 -56 136t-136 56t-136 -56t-56 -136v-768q-60 -45 -94 -112t-34 -144q0 -133 93.5 -226.5t226.5 -93.5t226.5 93.5
+t93.5 226.5zM896 192q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 182 128 313v711q0 133 93.5 226.5t226.5 93.5t226.5 -93.5t93.5 -226.5v-711q128 -131 128 -313zM1024 768v-128h-192v128h192zM1024 1024v-128h-192v128h192zM1024 1280v-128h-192
+v128h192z" />
+    <glyph glyph-name="uniF2CA" unicode="&#xf2ca;" horiz-adv-x="1024" 
+d="M640 192q0 -80 -56 -136t-136 -56t-136 56t-56 136q0 60 35 110t93 71v139h128v-139q58 -21 93 -71t35 -110zM768 192q0 77 -34 144t-94 112v768q0 80 -56 136t-136 56t-136 -56t-56 -136v-768q-60 -45 -94 -112t-34 -144q0 -133 93.5 -226.5t226.5 -93.5t226.5 93.5
+t93.5 226.5zM896 192q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 182 128 313v711q0 133 93.5 226.5t226.5 93.5t226.5 -93.5t93.5 -226.5v-711q128 -131 128 -313zM1024 768v-128h-192v128h192zM1024 1024v-128h-192v128h192zM1024 1280v-128h-192
+v128h192z" />
+    <glyph glyph-name="uniF2CB" unicode="&#xf2cb;" horiz-adv-x="1024" 
+d="M640 192q0 -80 -56 -136t-136 -56t-136 56t-56 136q0 79 56 135.5t136 56.5t136 -56.5t56 -135.5zM768 192q0 77 -34 144t-94 112v768q0 80 -56 136t-136 56t-136 -56t-56 -136v-768q-60 -45 -94 -112t-34 -144q0 -133 93.5 -226.5t226.5 -93.5t226.5 93.5t93.5 226.5z
+M896 192q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 182 128 313v711q0 133 93.5 226.5t226.5 93.5t226.5 -93.5t93.5 -226.5v-711q128 -131 128 -313zM1024 768v-128h-192v128h192zM1024 1024v-128h-192v128h192zM1024 1280v-128h-192v128h192z" />
+    <glyph glyph-name="uniF2CC" unicode="&#xf2cc;" horiz-adv-x="1920" 
+d="M1433 1287q10 -10 10 -23t-10 -23l-626 -626q-10 -10 -23 -10t-23 10l-82 82q-10 10 -10 23t10 23l44 44q-72 91 -81.5 207t46.5 215q-74 71 -176 71q-106 0 -181 -75t-75 -181v-1280h-256v1280q0 104 40.5 198.5t109.5 163.5t163.5 109.5t198.5 40.5q106 0 201 -41
+t166 -115q94 39 197 24.5t185 -79.5l44 44q10 10 23 10t23 -10zM1344 1024q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1600 896q-26 0 -45 19t-19 45t19 45t45 19t45 -19t19 -45t-19 -45t-45 -19zM1856 1024q26 0 45 -19t19 -45t-19 -45t-45 -19
+t-45 19t-19 45t19 45t45 19zM1216 896q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1408 832q0 26 19 45t45 19t45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45zM1728 896q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1088 768
+q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1344 640q-26 0 -45 19t-19 45t19 45t45 19t45 -19t19 -45t-19 -45t-45 -19zM1600 768q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1216 512q-26 0 -45 19t-19 45t19 45t45 19t45 -19
+t19 -45t-19 -45t-45 -19zM1472 640q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1088 512q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1344 512q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1216 384
+q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1088 256q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19z" />
+    <glyph glyph-name="uniF2CD" unicode="&#xf2cd;" horiz-adv-x="1792" 
+d="M1664 448v-192q0 -169 -128 -286v-194q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v118q-63 -22 -128 -22h-768q-65 0 -128 22v-110q0 -17 -9.5 -28.5t-22.5 -11.5h-64q-13 0 -22.5 11.5t-9.5 28.5v186q-128 117 -128 286v192h1536zM704 864q0 -14 -9 -23t-23 -9t-23 9
+t-9 23t9 23t23 9t23 -9t9 -23zM768 928q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM704 992q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM832 992q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM768 1056q0 -14 -9 -23t-23 -9t-23 9
+t-9 23t9 23t23 9t23 -9t9 -23zM704 1120q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM1792 608v-64q0 -14 -9 -23t-23 -9h-1728q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96v640q0 106 75 181t181 75q108 0 184 -78q46 19 98 12t93 -39l22 22q11 11 22 0l42 -42
+q11 -11 0 -22l-314 -314q-11 -11 -22 0l-42 42q-11 11 0 22l22 22q-36 46 -40.5 104t23.5 108q-37 35 -88 35q-53 0 -90.5 -37.5t-37.5 -90.5v-640h1504q14 0 23 -9t9 -23zM896 1056q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM832 1120q0 -14 -9 -23t-23 -9
+t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM768 1184q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM960 1120q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM896 1184q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM832 1248q0 -14 -9 -23
+t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM1024 1184q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM960 1248q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM1088 1248q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23z" />
+    <glyph glyph-name="uniF2CE" unicode="&#xf2ce;" 
+d="M994 344q0 -86 -17 -197q-31 -215 -55 -313q-22 -90 -152 -90t-152 90q-24 98 -55 313q-17 110 -17 197q0 168 224 168t224 -168zM1536 768q0 -240 -134 -434t-350 -280q-8 -3 -15 3t-6 15q7 48 10 66q4 32 6 47q1 9 9 12q159 81 255.5 234t96.5 337q0 180 -91 330.5
+t-247 234.5t-337 74q-124 -7 -237 -61t-193.5 -140.5t-128 -202t-46.5 -240.5q1 -184 99 -336.5t257 -231.5q7 -3 9 -12q3 -21 6 -45q1 -9 5 -32.5t6 -35.5q1 -9 -6.5 -15t-15.5 -2q-148 58 -261 169.5t-173.5 264t-52.5 319.5q7 143 66 273.5t154.5 227t225 157.5t272.5 70
+q164 10 315.5 -46.5t261 -160.5t175 -250.5t65.5 -308.5zM994 800q0 -93 -65.5 -158.5t-158.5 -65.5t-158.5 65.5t-65.5 158.5t65.5 158.5t158.5 65.5t158.5 -65.5t65.5 -158.5zM1282 768q0 -122 -53.5 -228.5t-146.5 -177.5q-8 -6 -16 -2t-10 14q-6 52 -29 92q-7 10 3 20
+q58 54 91 127t33 155q0 111 -58.5 204t-157.5 141.5t-212 36.5q-133 -15 -229 -113t-109 -231q-10 -92 23.5 -176t98.5 -144q10 -10 3 -20q-24 -41 -29 -93q-2 -9 -10 -13t-16 2q-95 74 -148.5 183t-51.5 234q3 131 69 244t177 181.5t241 74.5q144 7 268 -60t196.5 -187.5
+t72.5 -263.5z" />
+    <glyph glyph-name="uniF2D0" unicode="&#xf2d0;" horiz-adv-x="1792" 
+d="M256 128h1280v768h-1280v-768zM1792 1248v-1216q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1472q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2D1" unicode="&#xf2d1;" horiz-adv-x="1792" 
+d="M1792 224v-192q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v192q0 66 47 113t113 47h1472q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2D2" unicode="&#xf2d2;" horiz-adv-x="2048" 
+d="M256 0h768v512h-768v-512zM1280 512h512v768h-768v-256h96q66 0 113 -47t47 -113v-352zM2048 1376v-960q0 -66 -47 -113t-113 -47h-608v-352q0 -66 -47 -113t-113 -47h-960q-66 0 -113 47t-47 113v960q0 66 47 113t113 47h608v352q0 66 47 113t113 47h960q66 0 113 -47
+t47 -113z" />
+    <glyph glyph-name="uniF2D3" unicode="&#xf2d3;" horiz-adv-x="1792" 
+d="M1175 215l146 146q10 10 10 23t-10 23l-233 233l233 233q10 10 10 23t-10 23l-146 146q-10 10 -23 10t-23 -10l-233 -233l-233 233q-10 10 -23 10t-23 -10l-146 -146q-10 -10 -10 -23t10 -23l233 -233l-233 -233q-10 -10 -10 -23t10 -23l146 -146q10 -10 23 -10t23 10
+l233 233l233 -233q10 -10 23 -10t23 10zM1792 1248v-1216q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1472q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2D4" unicode="&#xf2d4;" horiz-adv-x="1792" 
+d="M1257 425l-146 -146q-10 -10 -23 -10t-23 10l-169 169l-169 -169q-10 -10 -23 -10t-23 10l-146 146q-10 10 -10 23t10 23l169 169l-169 169q-10 10 -10 23t10 23l146 146q10 10 23 10t23 -10l169 -169l169 169q10 10 23 10t23 -10l146 -146q10 -10 10 -23t-10 -23
+l-169 -169l169 -169q10 -10 10 -23t-10 -23zM256 128h1280v1024h-1280v-1024zM1792 1248v-1216q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1472q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2D5" unicode="&#xf2d5;" horiz-adv-x="1792" 
+d="M1070 358l306 564h-654l-306 -564h654zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="uniF2D6" unicode="&#xf2d6;" horiz-adv-x="1794" 
+d="M1291 1060q-15 17 -35 8.5t-26 -28.5t5 -38q14 -17 40 -14.5t34 20.5t-18 52zM895 814q-8 -8 -19.5 -8t-18.5 8q-8 8 -8 19t8 18q7 8 18.5 8t19.5 -8q7 -7 7 -18t-7 -19zM1060 740l-35 -35q-12 -13 -29.5 -13t-30.5 13l-38 38q-12 13 -12 30t12 30l35 35q12 12 29.5 12
+t30.5 -12l38 -39q12 -12 12 -29.5t-12 -29.5zM951 870q-7 -8 -18.5 -8t-19.5 8q-7 8 -7 19t7 19q8 8 19 8t19 -8t8 -19t-8 -19zM1354 968q-34 -64 -107.5 -85.5t-127.5 16.5q-38 28 -61 66.5t-21 87.5t39 92t75.5 53t70.5 -5t70 -51q2 -2 13 -12.5t14.5 -13.5t13 -13.5
+t12.5 -15.5t10 -15.5t8.5 -18t4 -18.5t1 -21t-5 -22t-9.5 -24zM1555 486q3 20 -8.5 34.5t-27.5 21.5t-33 17t-23 20q-40 71 -84 98.5t-113 11.5q19 13 40 18.5t33 4.5l12 -1q2 45 -34 90q6 20 6.5 40.5t-2.5 30.5l-3 10q43 24 71 65t34 91q10 84 -43 150.5t-137 76.5
+q-60 7 -114 -18.5t-82 -74.5q-30 -51 -33.5 -101t14.5 -87t43.5 -64t56.5 -42q-45 4 -88 36t-57 88q-28 108 32 222q-16 21 -29 32q-50 0 -89 -19q19 24 42 37t36 14l13 1q0 50 -13 78q-10 21 -32.5 28.5t-47 -3.5t-37.5 -40q2 4 4 7q-7 -28 -6.5 -75.5t19 -117t48.5 -122.5
+q-25 -14 -47 -36q-35 -16 -85.5 -70.5t-84.5 -101.5l-33 -46q-90 -34 -181 -125.5t-75 -162.5q1 -16 11 -27q-15 -12 -30 -30q-21 -25 -21 -54t21.5 -40t63.5 6q41 19 77 49.5t55 60.5q-2 2 -6.5 5t-20.5 7.5t-33 3.5q23 5 51 12.5t40 10t27.5 6t26 4t23.5 0.5q14 -7 22 34
+q7 37 7 90q0 102 -40 150q106 -103 101 -219q-1 -29 -15 -50t-27 -27l-13 -6q-4 -7 -19 -32t-26 -45.5t-26.5 -52t-25 -61t-17 -63t-6.5 -66.5t10 -63q-35 54 -37 80q-22 -24 -34.5 -39t-33.5 -42t-30.5 -46t-16.5 -41t-0.5 -38t25.5 -27q45 -25 144 64t190.5 221.5
+t122.5 228.5q86 52 145 115.5t86 119.5q47 -93 154 -178q104 -83 167 -80q39 2 46 43zM1794 640q0 -182 -71 -348t-191 -286t-286.5 -191t-348.5 -71t-348.5 71t-286.5 191t-191 286t-71 348t71 348t191 286t286.5 191t348.5 71t348.5 -71t286.5 -191t191 -286t71 -348z" />
+    <glyph glyph-name="uniF2D7" unicode="&#xf2d7;" 
+d="M518 1353v-655q103 -1 191.5 1.5t125.5 5.5l37 3q68 2 90.5 24.5t39.5 94.5l33 142h103l-14 -322l7 -319h-103l-29 127q-15 68 -45 93t-84 26q-87 8 -352 8v-556q0 -78 43.5 -115.5t133.5 -37.5h357q35 0 59.5 2t55 7.5t54 18t48.5 32t46 50.5t39 73l93 216h89
+q-6 -37 -31.5 -252t-30.5 -276q-146 5 -263.5 8t-162.5 4h-44h-628l-376 -12v102l127 25q67 13 91.5 37t25.5 79l8 643q3 402 -8 645q-2 61 -25.5 84t-91.5 36l-127 24v102l376 -12h702q139 0 374 27q-6 -68 -14 -194.5t-12 -219.5l-5 -92h-93l-32 124q-31 121 -74 179.5
+t-113 58.5h-548q-28 0 -35.5 -8.5t-7.5 -30.5z" />
+    <glyph glyph-name="uniF2D8" unicode="&#xf2d8;" 
+d="M922 739v-182q0 -4 0.5 -15t0 -15l-1.5 -12t-3.5 -11.5t-6.5 -7.5t-11 -5.5t-16 -1.5v309q9 0 16 -1t11 -5t6.5 -5.5t3.5 -9.5t1 -10.5v-13.5v-14zM1238 643v-121q0 -1 0.5 -12.5t0 -15.5t-2.5 -11.5t-7.5 -10.5t-13.5 -3q-9 0 -14 9q-4 10 -4 165v7v8.5v9t1.5 8.5l3.5 7
+t5 5.5t8 1.5q6 0 10 -1.5t6.5 -4.5t4 -6t2 -8.5t0.5 -8v-9.5v-9zM180 407h122v472h-122v-472zM614 407h106v472h-159l-28 -221q-20 148 -32 221h-158v-472h107v312l45 -312h76l43 319v-319zM1039 712q0 67 -5 90q-3 16 -11 28.5t-17 20.5t-25 14t-26.5 8.5t-31 4t-29 1.5
+h-29.5h-12h-91v-472h56q169 -1 197 24.5t25 180.5q-1 62 -1 100zM1356 515v133q0 29 -2 45t-9.5 33.5t-24.5 25t-46 7.5q-46 0 -77 -34v154h-117v-472h110l7 30q30 -36 77 -36q50 0 66 30.5t16 83.5zM1536 1248v-1216q0 -66 -47 -113t-113 -47h-1216q-66 0 -113 47t-47 113
+v1216q0 66 47 113t113 47h1216q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2D9" unicode="&#xf2d9;" horiz-adv-x="2176" 
+d="M1143 -197q-6 1 -11 4q-13 8 -36 23t-86 65t-116.5 104.5t-112 140t-89.5 172.5q-17 3 -175 37q66 -213 235 -362t391 -184zM502 409l168 -28q-25 76 -41 167.5t-19 145.5l-4 53q-84 -82 -121 -224q5 -65 17 -114zM612 1018q-43 -64 -77 -148q44 46 74 68zM2049 584
+q0 161 -62 307t-167.5 252t-250.5 168.5t-304 62.5q-147 0 -281 -52.5t-240 -148.5q-30 -58 -45 -160q60 51 143 83.5t158.5 43t143 13.5t108.5 -1l40 -3q33 -1 53 -15.5t24.5 -33t6.5 -37t-1 -28.5q-126 11 -227.5 0.5t-183 -43.5t-142.5 -71.5t-131 -98.5
+q4 -36 11.5 -92.5t35.5 -178t62 -179.5q123 -6 247.5 14.5t214.5 53.5t162.5 67t109.5 59l37 24q22 16 39.5 20.5t30.5 -5t17 -34.5q14 -97 -39 -121q-208 -97 -467 -134q-135 -20 -317 -16q41 -96 110 -176.5t137 -127t130.5 -79t101.5 -43.5l39 -12q143 -23 263 15
+q195 99 314 289t119 418zM2123 621q-14 -135 -40 -212q-70 -208 -181.5 -346.5t-318.5 -253.5q-48 -33 -82 -44q-72 -26 -163 -16q-36 -3 -73 -3q-283 0 -504.5 173t-295.5 442q-1 0 -4 0.5t-5 0.5q-6 -50 2.5 -112.5t26 -115t36 -98t31.5 -71.5l14 -26q8 -12 54 -82
+q-71 38 -124.5 106.5t-78.5 140t-39.5 137t-17.5 107.5l-2 42q-5 2 -33.5 12.5t-48.5 18t-53 20.5t-57.5 25t-50 25.5t-42.5 27t-25 25.5q19 -10 50.5 -25.5t113 -45.5t145.5 -38l2 32q11 149 94 290q41 202 176 365q28 115 81 214q15 28 32 45t49 32q158 74 303.5 104
+t302 11t306.5 -97q220 -115 333 -336t87 -474z" />
+    <glyph glyph-name="uniF2DA" unicode="&#xf2da;" horiz-adv-x="1792" 
+d="M1341 752q29 44 -6.5 129.5t-121.5 142.5q-58 39 -125.5 53.5t-118 4.5t-68.5 -37q-12 -23 -4.5 -28t42.5 -10q23 -3 38.5 -5t44.5 -9.5t56 -17.5q36 -13 67.5 -31.5t53 -37t40 -38.5t30.5 -38t22 -34.5t16.5 -28.5t12 -18.5t10.5 -6t11 9.5zM1704 178
+q-52 -127 -148.5 -220t-214.5 -141.5t-253 -60.5t-266 13.5t-251 91t-210 161.5t-141.5 235.5t-46.5 303.5q1 41 8.5 84.5t12.5 64t24 80.5t23 73q-51 -208 1 -397t173 -318t291 -206t346 -83t349 74.5t289 244.5q20 27 18 14q0 -4 -4 -14zM1465 627q0 -104 -40.5 -199
+t-108.5 -164t-162 -109.5t-198 -40.5t-198 40.5t-162 109.5t-108.5 164t-40.5 199t40.5 199t108.5 164t162 109.5t198 40.5t198 -40.5t162 -109.5t108.5 -164t40.5 -199zM1752 915q-65 147 -180.5 251t-253 153.5t-292 53.5t-301 -36.5t-275.5 -129t-220 -211.5t-131 -297
+t-10 -373q-49 161 -51.5 311.5t35.5 272.5t109 227t165.5 180.5t207 126t232 71t242.5 9t236 -54t216 -124.5t178 -197q33 -50 62 -121t31 -112zM1690 573q12 244 -136.5 416t-396.5 240q-8 0 -10 5t24 8q125 -4 230 -50t173 -120t116 -168.5t58.5 -199t-1 -208
+t-61.5 -197.5t-122.5 -167t-185 -117.5t-248.5 -46.5q108 30 201.5 80t174 123t129.5 176.5t55 225.5z" />
+    <glyph glyph-name="uniF2DB" unicode="&#xf2db;" 
+d="M192 256v-128h-112q-16 0 -16 16v16h-48q-16 0 -16 16v32q0 16 16 16h48v16q0 16 16 16h112zM192 512v-128h-112q-16 0 -16 16v16h-48q-16 0 -16 16v32q0 16 16 16h48v16q0 16 16 16h112zM192 768v-128h-112q-16 0 -16 16v16h-48q-16 0 -16 16v32q0 16 16 16h48v16
+q0 16 16 16h112zM192 1024v-128h-112q-16 0 -16 16v16h-48q-16 0 -16 16v32q0 16 16 16h48v16q0 16 16 16h112zM192 1280v-128h-112q-16 0 -16 16v16h-48q-16 0 -16 16v32q0 16 16 16h48v16q0 16 16 16h112zM1280 1440v-1472q0 -40 -28 -68t-68 -28h-832q-40 0 -68 28
+t-28 68v1472q0 40 28 68t68 28h832q40 0 68 -28t28 -68zM1536 208v-32q0 -16 -16 -16h-48v-16q0 -16 -16 -16h-112v128h112q16 0 16 -16v-16h48q16 0 16 -16zM1536 464v-32q0 -16 -16 -16h-48v-16q0 -16 -16 -16h-112v128h112q16 0 16 -16v-16h48q16 0 16 -16zM1536 720v-32
+q0 -16 -16 -16h-48v-16q0 -16 -16 -16h-112v128h112q16 0 16 -16v-16h48q16 0 16 -16zM1536 976v-32q0 -16 -16 -16h-48v-16q0 -16 -16 -16h-112v128h112q16 0 16 -16v-16h48q16 0 16 -16zM1536 1232v-32q0 -16 -16 -16h-48v-16q0 -16 -16 -16h-112v128h112q16 0 16 -16v-16
+h48q16 0 16 -16z" />
+    <glyph glyph-name="uniF2DC" unicode="&#xf2dc;" horiz-adv-x="1664" 
+d="M1566 419l-167 -33l186 -107q23 -13 29.5 -38.5t-6.5 -48.5q-14 -23 -39 -29.5t-48 6.5l-186 106l55 -160q13 -38 -12 -63.5t-60.5 -20.5t-48.5 42l-102 300l-271 156v-313l208 -238q16 -18 17 -39t-11 -36.5t-28.5 -25t-37 -5.5t-36.5 22l-112 128v-214q0 -26 -19 -45
+t-45 -19t-45 19t-19 45v214l-112 -128q-16 -18 -36.5 -22t-37 5.5t-28.5 25t-11 36.5t17 39l208 238v313l-271 -156l-102 -300q-13 -37 -48.5 -42t-60.5 20.5t-12 63.5l55 160l-186 -106q-23 -13 -48 -6.5t-39 29.5q-13 23 -6.5 48.5t29.5 38.5l186 107l-167 33
+q-29 6 -42 29t-8.5 46.5t25.5 40t50 10.5l310 -62l271 157l-271 157l-310 -62q-4 -1 -13 -1q-27 0 -44 18t-19 40t11 43t40 26l167 33l-186 107q-23 13 -29.5 38.5t6.5 48.5t39 30t48 -7l186 -106l-55 160q-13 38 12 63.5t60.5 20.5t48.5 -42l102 -300l271 -156v313
+l-208 238q-16 18 -17 39t11 36.5t28.5 25t37 5.5t36.5 -22l112 -128v214q0 26 19 45t45 19t45 -19t19 -45v-214l112 128q16 18 36.5 22t37 -5.5t28.5 -25t11 -36.5t-17 -39l-208 -238v-313l271 156l102 300q13 37 48.5 42t60.5 -20.5t12 -63.5l-55 -160l186 106
+q23 13 48 6.5t39 -29.5q13 -23 6.5 -48.5t-29.5 -38.5l-186 -107l167 -33q27 -5 40 -26t11 -43t-19 -40t-44 -18q-9 0 -13 1l-310 62l-271 -157l271 -157l310 62q29 6 50 -10.5t25.5 -40t-8.5 -46.5t-42 -29z" />
+    <glyph glyph-name="uniF2DD" unicode="&#xf2dd;" horiz-adv-x="1792" 
+d="M1473 607q7 118 -33 226.5t-113 189t-177 131t-221 57.5q-116 7 -225.5 -32t-192 -110.5t-135 -175t-59.5 -220.5q-7 -118 33 -226.5t113 -189t177.5 -131t221.5 -57.5q155 -9 293 59t224 195.5t94 283.5zM1792 1536l-349 -348q120 -117 180.5 -272t50.5 -321
+q-11 -183 -102 -339t-241 -255.5t-332 -124.5l-999 -132l347 347q-120 116 -180.5 271.5t-50.5 321.5q11 184 102 340t241.5 255.5t332.5 124.5q167 22 500 66t500 66z" />
+    <glyph glyph-name="uniF2DE" unicode="&#xf2de;" horiz-adv-x="1792" 
+d="M948 508l163 -329h-51l-175 350l-171 -350h-49l179 374l-78 33l21 49l240 -102l-21 -50zM563 1100l304 -130l-130 -304l-304 130zM907 915l240 -103l-103 -239l-239 102zM1188 765l191 -81l-82 -190l-190 81zM1680 640q0 159 -62 304t-167.5 250.5t-250.5 167.5t-304 62
+t-304 -62t-250.5 -167.5t-167.5 -250.5t-62 -304t62 -304t167.5 -250.5t250.5 -167.5t304 -62t304 62t250.5 167.5t167.5 250.5t62 304zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71
+t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="uniF2E0" unicode="&#xf2e0;" horiz-adv-x="1920" 
+d="M1334 302q-4 24 -27.5 34t-49.5 10.5t-48.5 12.5t-25.5 38q-5 47 33 139.5t75 181t32 127.5q-14 101 -117 103q-45 1 -75 -16l-3 -2l-5 -2.5t-4.5 -2t-5 -2t-5 -0.5t-6 1.5t-6 3.5t-6.5 5q-3 2 -9 8.5t-9 9t-8.5 7.5t-9.5 7.5t-9.5 5.5t-11 4.5t-11.5 2.5q-30 5 -48 -3
+t-45 -31q-1 -1 -9 -8.5t-12.5 -11t-15 -10t-16.5 -5.5t-17 3q-54 27 -84 40q-41 18 -94 -5t-76 -65q-16 -28 -41 -98.5t-43.5 -132.5t-40 -134t-21.5 -73q-22 -69 18.5 -119t110.5 -46q30 2 50.5 15t38.5 46q7 13 79 199.5t77 194.5q6 11 21.5 18t29.5 0q27 -15 21 -53
+q-2 -18 -51 -139.5t-50 -132.5q-6 -38 19.5 -56.5t60.5 -7t55 49.5q4 8 45.5 92t81.5 163.5t46 88.5q20 29 41 28q29 0 25 -38q-2 -16 -65.5 -147.5t-70.5 -159.5q-12 -53 13 -103t74 -74q17 -9 51 -15.5t71.5 -8t62.5 14t20 48.5zM383 86q3 -15 -5 -27.5t-23 -15.5
+q-14 -3 -26.5 5t-15.5 23q-3 14 5 27t22 16t27 -5t16 -23zM953 -177q12 -17 8.5 -37.5t-20.5 -32.5t-37.5 -8t-32.5 21q-11 17 -7.5 37.5t20.5 32.5t37.5 8t31.5 -21zM177 635q-18 -27 -49.5 -33t-57.5 13q-26 18 -32 50t12 58q18 27 49.5 33t57.5 -12q26 -19 32 -50.5
+t-12 -58.5zM1467 -42q19 -28 13 -61.5t-34 -52.5t-60.5 -13t-51.5 34t-13 61t33 53q28 19 60.5 13t52.5 -34zM1579 562q69 -113 42.5 -244.5t-134.5 -207.5q-90 -63 -199 -60q-20 -80 -84.5 -127t-143.5 -44.5t-140 57.5q-12 -9 -13 -10q-103 -71 -225 -48.5t-193 126.5
+q-50 73 -53 164q-83 14 -142.5 70.5t-80.5 128t-2 152t81 138.5q-36 60 -38 128t24.5 125t79.5 98.5t121 50.5q32 85 99 148t146.5 91.5t168 17t159.5 -66.5q72 21 140 17.5t128.5 -36t104.5 -80t67.5 -115t17.5 -140.5q52 -16 87 -57t45.5 -89t-5.5 -99.5t-58 -87.5z
+M455 1222q14 -20 9.5 -44.5t-24.5 -38.5q-19 -14 -43.5 -9.5t-37.5 24.5q-14 20 -9.5 44.5t24.5 38.5q19 14 43.5 9.5t37.5 -24.5zM614 1503q4 -16 -5 -30.5t-26 -18.5t-31 5.5t-18 26.5q-3 17 6.5 31t25.5 18q17 4 31 -5.5t17 -26.5zM1800 555q4 -20 -6.5 -37t-30.5 -21
+q-19 -4 -36 6.5t-21 30.5t6.5 37t30.5 22q20 4 36.5 -7.5t20.5 -30.5zM1136 1448q16 -27 8.5 -58.5t-35.5 -47.5q-27 -16 -57.5 -8.5t-46.5 34.5q-16 28 -8.5 59t34.5 48t58 9t47 -36zM1882 792q4 -15 -4 -27.5t-23 -16.5q-15 -3 -27.5 5.5t-15.5 22.5q-3 15 5 28t23 16
+q14 3 26.5 -5t15.5 -23zM1691 1033q15 -22 10.5 -49t-26.5 -43q-22 -15 -49 -10t-42 27t-10 49t27 43t48.5 11t41.5 -28z" />
+    <glyph glyph-name="uniF2E1" unicode="&#xf2e1;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E2" unicode="&#xf2e2;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E3" unicode="&#xf2e3;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E4" unicode="&#xf2e4;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E5" unicode="&#xf2e5;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E6" unicode="&#xf2e6;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E7" unicode="&#xf2e7;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="_698" unicode="&#xf2e8;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E9" unicode="&#xf2e9;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2EA" unicode="&#xf2ea;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2EB" unicode="&#xf2eb;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2EC" unicode="&#xf2ec;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2ED" unicode="&#xf2ed;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2EE" unicode="&#xf2ee;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="lessequal" unicode="&#xf500;" horiz-adv-x="1792" 
+ />
+  </font>
+</defs></svg>
diff --git a/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.ttf b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.ttf
new file mode 100644
index 000000000000..35acda2fa119
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.ttf differ
diff --git a/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.woff b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.woff
new file mode 100644
index 000000000000..400014a4b06e
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.woff differ
diff --git a/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.woff2 b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.woff2
new file mode 100644
index 000000000000..4d13fc60404b
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.woff2 differ
diff --git a/ee/bulk-operations-dashboard/assets/images/delete-16x21@2x.png b/ee/bulk-operations-dashboard/assets/images/delete-16x21@2x.png
new file mode 100644
index 000000000000..275b3235c9af
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/delete-16x21@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/download-16x16@2x.png b/ee/bulk-operations-dashboard/assets/images/download-16x16@2x.png
new file mode 100644
index 000000000000..2e6e7ebe2311
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/download-16x16@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/edit-pencil-16x21@2x.png b/ee/bulk-operations-dashboard/assets/images/edit-pencil-16x21@2x.png
new file mode 100644
index 000000000000..b5bfe5913957
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/edit-pencil-16x21@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/fleet-logo-black-118x40@2x.png b/ee/bulk-operations-dashboard/assets/images/fleet-logo-black-118x40@2x.png
new file mode 100644
index 000000000000..4fc177bdb056
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/fleet-logo-black-118x40@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/icon-close.png b/ee/bulk-operations-dashboard/assets/images/icon-close.png
new file mode 100644
index 000000000000..fbced9c332df
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/icon-close.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/icon-hamburger-blue-16x14@2x.png b/ee/bulk-operations-dashboard/assets/images/icon-hamburger-blue-16x14@2x.png
new file mode 100644
index 000000000000..0b25dd5a3c59
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/icon-hamburger-blue-16x14@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/powered-by-fleet-159x24@2x.png b/ee/bulk-operations-dashboard/assets/images/powered-by-fleet-159x24@2x.png
new file mode 100644
index 000000000000..5a86548cd0ba
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/powered-by-fleet-159x24@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/profile-34x40@2x.png b/ee/bulk-operations-dashboard/assets/images/profile-34x40@2x.png
new file mode 100644
index 000000000000..0a886a220747
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/profile-34x40@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/script-icon-ps1-34x40@2x.png b/ee/bulk-operations-dashboard/assets/images/script-icon-ps1-34x40@2x.png
new file mode 100644
index 000000000000..ff87e6d14dd4
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/script-icon-ps1-34x40@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/script-icon-sh-34x40@2x.png b/ee/bulk-operations-dashboard/assets/images/script-icon-sh-34x40@2x.png
new file mode 100644
index 000000000000..de9042326757
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/script-icon-sh-34x40@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/trash-16x16@2x.png b/ee/bulk-operations-dashboard/assets/images/trash-16x16@2x.png
new file mode 100644
index 000000000000..880b8f41d659
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/trash-16x16@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/upload-16x17@2x.png b/ee/bulk-operations-dashboard/assets/images/upload-16x17@2x.png
new file mode 100644
index 000000000000..b390f3b368cd
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/upload-16x17@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/js/cloud.setup.js b/ee/bulk-operations-dashboard/assets/js/cloud.setup.js
new file mode 100644
index 000000000000..659d16fda2a5
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/cloud.setup.js
@@ -0,0 +1,19 @@
+/**
+ * cloud.setup.js
+ *
+ * Configuration for this Sails app's generated browser SDK ("Cloud").
+ *
+ * Above all, the purpose of this file is to provide endpoint definitions,
+ * each of which corresponds with one particular route+action on the server.
+ *
+ * > This file was automatically generated.
+ * > (To regenerate, run `sails run rebuild-cloud-sdk`)
+ */
+
+Cloud.setup({
+
+  /* eslint-disable */
+  methods: {"confirmEmail":{"verb":"GET","url":"/email/confirm","args":["token"]},"logout":{"verb":"GET","url":"/api/v1/account/logout","args":[]},"updatePassword":{"verb":"PUT","url":"/api/v1/account/update-password","args":["password"]},"updateProfile":{"verb":"PUT","url":"/api/v1/account/update-profile","args":["fullName","emailAddress"]},"login":{"verb":"PUT","url":"/api/v1/entrance/login","args":["emailAddress","password","rememberMe"]},"sendPasswordRecoveryEmail":{"verb":"POST","url":"/api/v1/entrance/send-password-recovery-email","args":["emailAddress"]},"updatePasswordAndLogin":{"verb":"POST","url":"/api/v1/entrance/update-password-and-login","args":["password","token"]},"observeMySession":{"verb":"POST","url":"/api/v1/observe-my-session","args":[],"protocol":"io.socket"},"deleteProfile":{"verb":"POST","url":"/api/v1/delete-profile","args":["profile"]},"downloadProfile":{"verb":"GET","url":"/download-profile","args":["id","uuid"]},"uploadProfile":{"verb":"POST","url":"/api/v1/upload-profile","args":["newProfile","teams"]},"editProfile":{"verb":"POST","url":"/api/v1/edit-profile","args":["profile","newTeamIds","newProfile"]},"getProfiles":{"verb":"GET","url":"/api/v1/get-profiles","args":[]},"getScripts":{"verb":"GET","url":"/api/v1/get-scripts","args":[]},"deleteScript":{"verb":"POST","url":"/api/v1/delete-script","args":["script"]},"downloadScript":{"verb":"GET","url":"/download-script","args":["id"]},"uploadScript":{"verb":"POST","url":"/api/v1/upload-script","args":["newScript","teams"]},"editScript":{"verb":"POST","url":"/api/v1/edit-script","args":["script","newTeamIds","newScript"]}}
+  /* eslint-enable */
+
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/components/account-notification-banner.component.js b/ee/bulk-operations-dashboard/assets/js/components/account-notification-banner.component.js
new file mode 100644
index 000000000000..5b153a98c426
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/components/account-notification-banner.component.js
@@ -0,0 +1,93 @@
+/**
+ * <account-notification-banner>
+ * -----------------------------------------------------------------------------
+ *
+ * @type {Component}
+ *
+ * -----------------------------------------------------------------------------
+ */
+
+parasails.registerComponent('account-notification-banner', {
+
+  //  ╔═╗╦ ╦╔╗ ╦  ╦╔═╗  ╔═╗╦═╗╔═╗╔═╗╔═╗
+  //  ╠═╝║ ║╠╩╗║  ║║    ╠═╝╠╦╝║ ║╠═╝╚═╗
+  //  ╩  ╚═╝╚═╝╩═╝╩╚═╝  ╩  ╩╚═╚═╝╩  ╚═╝
+  props: [],
+
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╦╔╗╔╔╦╗╔═╗╦═╗╔╗╔╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ║║║║ ║ ║╣ ╠╦╝║║║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╩╝╚╝ ╩ ╚═╝╩╚═╝╚╝╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: function () {
+    return {
+      notificationText: '',
+      roomName: undefined,
+    };
+  },
+
+
+  //  ╦ ╦╔╦╗╔╦╗╦
+  //  ╠═╣ ║ ║║║║
+  //  ╩ ╩ ╩ ╩ ╩╩═╝
+  template: `
+  <div>
+    <div class="container-fluid">
+      <div class="alert alert-warning mt-2 small" role="alert" v-if="notificationText">
+        {{notificationText}}
+      </div>
+    </div>
+  </div>
+  `,
+
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  mounted: async function() {
+    await Cloud.observeMySession();
+    // Listen for updates to the user's session
+    Cloud.on('session', (msg)=>{
+      if(msg.notificationText) {
+        this.notificationText = msg.notificationText;
+      } else {
+        this.notificationText = '';
+      }
+    });//œ
+  },
+
+  beforeDestroy: function() {
+    Cloud.off('session');
+  },
+
+  watch: {
+    loggedInUserId: function(unused) { throw new Error('Changes to `loggedInUserId` are not currently supported in <account-notification-banner>!'); },
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    //  ╦╔╗╔╔╦╗╔═╗╦═╗╔╗╔╔═╗╦    ╔═╗╦  ╦╔═╗╔╗╔╔╦╗  ╦ ╦╔═╗╔╗╔╔╦╗╦  ╔═╗╦═╗╔═╗
+    //  ║║║║ ║ ║╣ ╠╦╝║║║╠═╣║    ║╣ ╚╗╔╝║╣ ║║║ ║   ╠═╣╠═╣║║║ ║║║  ║╣ ╠╦╝╚═╗
+    //  ╩╝╚╝ ╩ ╚═╝╩╚═╝╚╝╩ ╩╩═╝  ╚═╝ ╚╝ ╚═╝╝╚╝ ╩   ╩ ╩╩ ╩╝╚╝═╩╝╩═╝╚═╝╩╚═╚═╝
+
+    //…
+
+    //  ╔═╗╦ ╦╔╗ ╦  ╦╔═╗  ╔╦╗╔═╗╔╦╗╦ ╦╔═╗╔╦╗╔═╗
+    //  ╠═╝║ ║╠╩╗║  ║║    ║║║║╣  ║ ╠═╣║ ║ ║║╚═╗
+    //  ╩  ╚═╝╚═╝╩═╝╩╚═╝  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝═╩╝╚═╝
+    // > Public methods are rarely exposed by Vue components, but sometimes they
+    // > are an important escape hatch.  They are callable via something like
+    // > `this.$refs.componentNameInCamelCase.doSomething())`, and, by convention,
+    // > are always prefixed with "do".
+    // N/A
+
+    //  ╔═╗╦═╗╦╦  ╦╔═╗╔╦╗╔═╗  ╔╦╗╔═╗╔╦╗╦ ╦╔═╗╔╦╗╔═╗
+    //  ╠═╝╠╦╝║╚╗╔╝╠═╣ ║ ║╣   ║║║║╣  ║ ╠═╣║ ║ ║║╚═╗
+    //  ╩  ╩╚═╩ ╚╝ ╩ ╩ ╩ ╚═╝  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝═╩╝╚═╝
+
+    //…
+
+  }
+
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/components/ajax-button.component.js b/ee/bulk-operations-dashboard/assets/js/components/ajax-button.component.js
new file mode 100644
index 000000000000..b6d8ebe663a5
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/components/ajax-button.component.js
@@ -0,0 +1,69 @@
+/**
+ * <ajax-button>
+ * -----------------------------------------------------------------------------
+ * A button with a built-in loading spinner.
+ *
+ * @type {Component}
+ *
+ * @event click   [emitted when clicked]
+ * -----------------------------------------------------------------------------
+ */
+
+parasails.registerComponent('ajaxButton', {
+  //  ╔═╗╦═╗╔═╗╔═╗╔═╗
+  //  ╠═╝╠╦╝║ ║╠═╝╚═╗
+  //  ╩  ╩╚═╚═╝╩  ╚═╝
+  props: [
+    'syncing'
+  ],
+
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: function (){
+    return {
+      //…
+    };
+  },
+
+  //  ╦ ╦╔╦╗╔╦╗╦
+  //  ╠═╣ ║ ║║║║
+  //  ╩ ╩ ╩ ╩ ╩╩═╝
+  template: `
+  <button @click="click()" type="submit" class="btn ajax-button" :class="[syncing ? 'syncing' : '']">
+    <span class="button-text" v-if="!syncing"><slot name="default">Submit</slot></span>
+    <span class="button-loader clearfix" v-if="syncing">
+      <slot name="syncing-state">
+        <span style="top: -4px; font-size: 12px; margin: 0 2px;" class="loading-dot dot1 position-relative"><small><span class="fa fa-circle"></span></small></span>
+        <span style="top: -4px; font-size: 12px; margin: 0 2px;" class="loading-dot dot2 position-relative"><small><span class="fa fa-circle"></span></small></span>
+        <span style="top: -4px; font-size: 12px; margin: 0 2px;" class="loading-dot dot3 position-relative"><small><span class="fa fa-circle"></span></small></span>
+        <span style="top: -4px; font-size: 12px; margin: 0 2px;" class="loading-dot dot4 position-relative"><small><span class="fa fa-circle"></span></small></span>
+      </slot>
+    </span>
+  </button>
+  `,
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function(){
+    //…
+  },
+  beforeDestroy: function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    click: async function(){
+      this.$emit('click');
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/components/ajax-form.component.js b/ee/bulk-operations-dashboard/assets/js/components/ajax-form.component.js
new file mode 100644
index 000000000000..8cc11d8f0478
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/components/ajax-form.component.js
@@ -0,0 +1,379 @@
+/**
+ * <ajax-form>
+ * -----------------------------------------------------------------------------
+ * A form that talks to the backend using AJAX.
+ * > For example usage, take a look at one of the forms generated in a new
+ * > Sails app when using the "Web app" template.
+ *
+ * @type {Component}
+ *
+ * @slot default                     [form contents]
+ *
+ * @event update:cloudError          [:cloud-error.sync="…"]
+ * @event update:syncing             [:syncing.sync="…"]
+ * @event update:formErrors          [:form-errors.sync="…"]
+ * @event submitted                  [emitted after the server responds with a 2xx status code]
+ * @event rejected                   [emitted after the server responds with a non-2xx status code]
+ * -----------------------------------------------------------------------------
+ */
+
+parasails.registerComponent('ajaxForm', {
+  //  ╔═╗╦═╗╔═╗╔═╗╔═╗
+  //  ╠═╝╠╦╝║ ║╠═╝╚═╗
+  //  ╩  ╩╚═╚═╝╩  ╚═╝
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // Note:
+  // Some of these props rely on the `.sync` modifier re-introduced in Vue 2.3.x.
+  // For more info, see: https://vuejs.org/v2/guide/components.html#sync-Modifier
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  props: [
+    'syncing',// « 2-way bound (:syncing.sync="…")
+    'cloudError',// « 2-way bound (:cloud-error.sync="…")
+    'action',
+    'formErrors',// « 2-way bound (:form-errors.sync="…")
+    'formData',
+    'formRules',
+
+    'handleSubmitting',// « alternative for `action`
+    'handleParsing',// « alternative for `formRules`+`formData`+`formErrors`
+  ],
+
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: function (){
+    return {
+      //…
+    };
+  },
+
+  //  ╦ ╦╔╦╗╔╦╗╦
+  //  ╠═╣ ║ ║║║║
+  //  ╩ ╩ ╩ ╩ ╩╩═╝
+  template: `
+  <form class="ajax-form" @submit.prevent="submit()" @keydown.meta.enter="keydownMetaEnter()">
+    <slot name="default"></slot>
+  </form>
+  `,
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function (){
+    if (this.action === undefined && this.handleSubmitting === undefined) {
+      throw new Error('Neither `:action` nor `:handle-submitting` was passed in to <ajax-form>, but one or the other must be provided.');
+    } else if (this.action !== undefined && this.handleSubmitting !== undefined) {
+      throw new Error('Both `:action` AND `:handle-submitting` were passed in to <ajax-form>, but only one or the other should be provided.');
+    } else if (this.action !== undefined && (!_.isString(this.action) || !_.isFunction(Cloud[_.camelCase(this.action)]))) {
+      throw new Error('Invalid `action` in <ajax-form>.  `action` should be the name of a method on the `Cloud` global.  For example: `action="login"` would make this form communicate using `Cloud.login()`, which corresponds to the "login" action on the server.');
+    } else if (this.action !== undefined && !_.isFunction(Cloud[this.action])) {
+      throw new Error('Unrecognized `action` in <ajax-form>.  Did you mean to type `action="'+_.camelCase(this.action)+'"`?  (<ajax-form> expects `action` to be provided in camelCase format.  In other words, to reference the action at "api/controllers/foo/bar/do-something", use `action="doSomething"`.)');
+    } else if (this.handleSubmitting !== undefined && !_.isFunction(this.handleSubmitting)) {
+      throw new Error('Invalid `:handle-submitting` function passed to <ajax-form>.  (Any chance you forgot the ":" in front of the prop name?)  For example: `:handle-submitting="handleSubmittingSomeForm"`.  This function should be an `async function`, and it should either throw a special exit signal or return response data from the server.  (If this custom `handleSubmitting` will be doing something more complex than a single request to a server, feel free to return whatever amalgamation of data you wish.)');
+    }
+
+    if (this.handleParsing === undefined && this.formData === undefined) {
+      throw new Error('Neither `:form-data` nor `:handle-parsing` was passed in to <ajax-form>, but one or the other must be provided.');
+    } else if (this.handleParsing !== undefined && this.formData !== undefined) {
+      throw new Error('Both `:form-data` AND `:handle-parsing` were passed in to <ajax-form>, but only one or the other should be provided.');
+    } else if (this.handleParsing !== undefined && !_.isFunction(this.handleParsing)) {
+      throw new Error('Invalid `:handle-parsing` function passed to <ajax-form>.  (Any chance you forgot the ":" in front of the prop name?)  For example: `:handle-parsing="handleParsingSomeForm"`.  This function should return a dictionary (plain JavaScript object like `{}`) of parsed form data, ready to be sent in a request to the server.');
+    } else if (this.formData !== undefined && (!_.isObject(this.formData) || _.isFunction(this.formData) || _.isArray(this.formData))) {
+      throw new Error('Invalid `:form-data` passed to <ajax-form>.  (Any chance you forgot the ":" in front of the prop name?)  For example: `:form-data="someFormData"`.  This should reference a dictionary (plain JavaScript object like `{}`).  Specifically, `:form-data` should only be used in the case where the raw data from the form in the user interface happens to correspond **EXACTLY** with the names and format of the argins that should be sent in a request to the server.  (For more nuanced behavior, use `handle-parsing` instead!)');
+    }
+
+    if (!this.formData && (this.formRules || this.formErrors)) {
+      throw new Error('If `:form-rules` or `:form-errors.sync` are in use, then `:form-data` must also be passed in.  (If the AJAX request doesn\'t need form data, then use an empty dictionary, i.e. `:form-data="{}"`.)');
+    } else if (this.formRules && !this.formErrors) {
+      throw new Error('If `:form-rules` are provided, then `:form-errors.sync` must also be passed in.');
+    }
+
+    if (this.formRules) {
+      var SUPPORTED_RULES = [
+        'required', 'isEmail', 'isIn', 'is', 'minLength', 'maxLength',
+        'sameAs', 'isHalfwayDecentPassword', 'custom'
+      ];
+      for (let fieldName in this.formRules) {
+        for (let ruleName in this.formRules[fieldName]) {
+          if (_.contains(SUPPORTED_RULES, ruleName)) {
+            // OK.  Good enough.
+            // - - - - - - - - - - - - - - - - - - - - -
+            // FUTURE: move rule rhs checks out here
+            // (so error messages from bad usage are
+            // logged sooner)
+            // - - - - - - - - - - - - - - - - - - - - -
+          } else {
+            let kebabRules = _.map(_.clone(SUPPORTED_RULES), (ruleName)=>_.kebabCase(ruleName));
+            let lowerCaseRules = _.map(_.clone(SUPPORTED_RULES), (ruleName)=>ruleName.toLowerCase());
+            let ruleIdx = (
+              _.indexOf(kebabRules, ruleName) === -1 ?
+              _.indexOf(lowerCaseRules, ruleName.toLowerCase()) === -1 ?
+              -1
+              : _.indexOf(lowerCaseRules, ruleName.toLowerCase())
+              : _.indexOf(kebabRules, ruleName)
+            );
+            if (ruleIdx !== -1) {
+              throw new Error('Did you mean `'+SUPPORTED_RULES[ruleIdx]+'`?  (note the capitalization)\nYou are seeing this error because <ajax-form> encountered an unsupported (but vaguely familiar-looking) client-side validation rule: `'+ruleName+'`.');
+            } else {
+              throw new Error('<ajax-form> does not support that client-side validation rule (`'+ruleName+'`).\n [?] If you\'re unsure, visit https://sailsjs.com/support');
+            }
+          }
+        }//∞
+      }//∞
+    }
+
+    // Focus our "focus-first" field, if relevant.
+    // (but not on mobile, because it can get weird)
+    if(typeof bowser !== 'undefined' && !bowser.mobile && this.$find('[focus-first]').length > 0) {
+      this.$focus('[focus-first]');
+    }
+  },
+  beforeDestroy: function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    keydownMetaEnter: async function() {
+      await this._submit();
+    },
+
+    submit: async function () {
+      await this._submit();
+    },
+
+    //  ╔═╗╦═╗╦╦  ╦╔═╗╔╦╗╔═╗  ╔╦╗╔═╗╔╦╗╦ ╦╔═╗╔╦╗╔═╗
+    //  ╠═╝╠╦╝║╚╗╔╝╠═╣ ║ ║╣   ║║║║╣  ║ ╠═╣║ ║ ║║╚═╗
+    //  ╩  ╩╚═╩ ╚╝ ╩ ╩ ╩ ╚═╝  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝═╩╝╚═╝
+    _submit: async function () {
+
+      // Prevent double-posting.
+      if (this.syncing) {
+        return;
+      }//•
+
+      // Clear the userland "cloudError" prop.
+      this.$emit('update:cloudError', '');
+
+      // Determine the argins that will be sent to the server in our request.
+      var argins;
+      if (this.handleParsing) {
+        // Run the provided "handle-parsing" logic.
+        // > This should clear out any pre-existing error messages, perform any additional
+        // > client-side form validation checks, and do any necessary data transformations
+        // > to munge the form data into the format expected by the server.
+        argins = this.handleParsing();
+        if (argins === undefined) {
+          // If argins came back undefined, then avast.
+          // (This means that parsing the form failed.  Submission will not be attempted.)
+          return;
+        } else if (!_.isObject(argins) || _.isArray(argins) || _.isFunction(argins)) {
+          throw new Error('Invalid data returned from custom form parsing logic.  (Should return a dictionary of argins, like `{}`.)');
+        }//•
+      } else if (this.formData) {
+        // Or use the simpler, built-in absorbtion strategy.
+        // > This uses the provided form data as our argins, verbatim.  Then it runs
+        // > built-in client-side validation, if configured to do so.
+        argins = this.formData;
+
+        let formData = this.formData;
+        let formErrors = {};
+
+        for (let fieldName in this.formRules) {
+          let fieldValue = formData[fieldName];
+
+          for (let ruleName in this.formRules[fieldName]) {
+            let ruleRhs = this.formRules[fieldName][ruleName];
+            let violation;
+
+            let isFieldValuePresent = (
+              fieldValue !== undefined &&
+              fieldValue !== '' &&
+              !_.isNull(fieldValue)
+            );
+
+            if (ruleName === 'required' && (ruleRhs === true || ruleRhs === false)) {
+              // ® Must be defined, non-null, and not the empty string
+              if (ruleRhs === false) {
+                violation = false;
+              } else {
+                violation = (
+                  !isFieldValuePresent
+                );
+              }
+            } else if (!isFieldValuePresent) {
+              // Do nothing.
+              // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+              // Note:
+              // In order to allow use with optional fields, all rules except for
+              // `required: true` are only actually checked when the field value
+              // is "present" -- i.e. some value other than `null`, `undefined`,
+              // or `''` (empty string).
+              //
+              // > Trying to figure out how to handle a conditionally-requiured
+              // > field that uses one of these validations?  For example, a
+              // > "Confirm email" re-entry field for an optional email address?
+              // > Just make `required` validation rule dynamic, and everything
+              // > else will work as expected.
+              // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            } else if (ruleName === 'isEmail' && (ruleRhs === true || ruleRhs === false)) {
+              // ® Must be an email address (unless falsy)
+              if (ruleRhs === false) {
+                violation = false;
+              } else {
+                violation = (
+                  !parasails.util.isValidEmailAddress(fieldValue)
+                );
+              }
+            } else if (ruleName === 'isIn' && _.isArray(ruleRhs)) {
+              // ® Must be one of these things
+              violation = (
+                !_.contains(ruleRhs, fieldValue)
+              );
+            } else if (ruleName === 'is') {
+              // ® Must be exactly this thing (useful for required checkboxes)
+              violation = (
+                ruleRhs !== fieldValue
+              );
+            } else if (ruleName === 'minLength' && _.isNumber(ruleRhs)) {
+              // ® Must consist of at least this many characters
+              violation = (
+                !_.isString(fieldValue) ||
+                fieldValue.length < ruleRhs
+              );
+            } else if (ruleName === 'maxLength' && _.isNumber(ruleRhs)) {
+              // ® Must consist of no more than this many characters
+              violation = (
+                !_.isString(fieldValue) ||
+                fieldValue.length > ruleRhs
+              );
+            } else if (ruleName === 'sameAs' && ruleRhs !== '' && _.isString(ruleRhs)) {
+              // ® Must match the value in another field
+              let otherFieldName = ruleRhs;
+              let otherFieldValue = formData[otherFieldName];
+              violation = (
+                otherFieldValue !== fieldValue
+              );
+            } else if (ruleName === 'isHalfwayDecentPassword' && (ruleRhs === true || ruleRhs === false)) {
+              // ® Must be a halfway-decent password
+              // > This is an arbitrary distinction, so change it if you want.
+              // > Just... please use common sense.  And try to avoid engaging
+              // > in security theater.
+              if (ruleRhs === false) {
+                violation = false;
+              } else {
+                violation = (
+                  (!_.isString(fieldValue) && !_.isNumber(fieldValue)) ||
+                  fieldValue.length < 6
+                );
+              }
+            } else if (ruleName === 'custom' && _.isFunction(ruleRhs)) {
+              // ® Provided function must return truthy when invoked with the value.
+              try {
+                violation = (
+                  !ruleRhs(fieldValue)
+                );
+              } catch (err) {
+                console.warn(err);
+                violation = true;
+              }
+            } else {
+              throw new Error('Cannot interpret client-side validation rule (`'+ruleName+'`) because the configuration provided for it is not recognized by <ajax-form>.\n [?] If you\'re unsure, visit https://sailsjs.com/support');
+            }
+
+            // If a rule violation was detected, then set it as a form error
+            // and break out of the `for` loop to continue on to the next field.
+            // (We only track one form error per field.)
+            if (violation) {
+              formErrors[fieldName] = ruleName;
+              break;
+            }//˚
+
+          }//∞
+        }//∞
+
+        // Whether there are any errors or not, update userland "formErrors" prop
+        // so that the markup reflects the new reality (i.e. inline validation errors
+        // either get rendered or go away.)
+        this.$emit('update:formErrors', formErrors);
+
+        // If there were any form errors, avast.  (Submission will not be attempted.)
+        if (Object.keys(formErrors).length > 0) {
+          // In development mode, also log a warning
+          // (so that it's clear what's going on just in case validation
+          // states/messages are not hooked up in the HTML template)
+          if (this._environment !== 'production') {
+            console.warn(`<ajax-form> encountered ${Object.keys(formErrors).length} form error${Object.keys(formErrors).length !== 1 ? 's' : ''} when performing client-side validation of "form-data" versus "form-rules".  (Note: This warning is only here to assist with debugging-- it will not be displayed in production.  If you're unsure, check out https://sailsjs.com/support for more resources.)`, _.cloneDeep(formErrors));
+          }//fi
+          return;
+        }//•
+      }//fi  (determining argins)
+
+
+      // Set syncing state to `true` on userland "syncing" prop.
+      this.$emit('update:syncing', true);
+
+
+      // Submit the form
+      var failedWithCloudExit;
+      var rawErrorFromCloudSDK;
+      var result;
+      if (this.handleSubmitting) {
+        try {
+          // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+          // FUTURE: Consider cloning the argins ahead of time to prevent accidental mutation of form data.
+          // (but remember argins could contain File instances that might not be clone-able)
+          // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+          result = await this.handleSubmitting(argins);
+        } catch (err) {
+          rawErrorFromCloudSDK = err;
+          if (_.isString(err) && err !== '') {
+            failedWithCloudExit = err;
+          } else if (_.isError(err) && err.exit) {
+            failedWithCloudExit = err.exit;
+          } else if (_.isObject(err) && !_.isError(err) && !_.isArray(err) && !_.isFunction(err) && Object.keys(err)[0] && _.isString(Object.keys(err)[0])) {
+            failedWithCloudExit = Object.keys(err)[0];
+          } else {
+            throw err;
+          }
+        }
+      } else {
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // FUTURE: Potentially filter unused data in argins here before proceeding
+        // (assuming cloudsdk has that information available)
+        // Or better yet, just have `Cloud.*.with()` take care of that automatically.
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        result = await Cloud[this.action].with(argins)
+        .tolerate((err)=>{
+          rawErrorFromCloudSDK = err;
+          failedWithCloudExit = err.exit || 'error';
+        });
+      }
+
+
+      // When a cloud error occurs, tolerate it, but set the userland "cloudError"
+      // prop accordingly.
+      if (failedWithCloudExit) {
+        this.$emit('update:cloudError', failedWithCloudExit);
+      }
+
+      // Set syncing state to `false` on userland "syncing" prop.
+      this.$emit('update:syncing', false);
+
+      // If the server says we were successful, then emit the "submitted" event.
+      if (!failedWithCloudExit) {
+        this.$emit('submitted', result);
+      } else {
+        this.$emit('rejected', rawErrorFromCloudSDK);
+      }
+
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/components/cloud-error.component.js b/ee/bulk-operations-dashboard/assets/js/components/cloud-error.component.js
new file mode 100644
index 000000000000..79107b6c1af6
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/components/cloud-error.component.js
@@ -0,0 +1,93 @@
+/**
+ * <cloud-error>
+ * -----------------------------------------------------------------------------
+ *
+ * @type {Component}
+ *
+ * --- SLOTS: ---
+ * @slot default
+ *
+ * --- EVENTS EMITTED: ---
+ * N/A
+ *
+ * -----------------------------------------------------------------------------
+ */
+
+parasails.registerComponent('cloud-error', {
+
+  //  ╔═╗╦ ╦╔╗ ╦  ╦╔═╗  ╔═╗╦═╗╔═╗╔═╗╔═╗
+  //  ╠═╝║ ║╠╩╗║  ║║    ╠═╝╠╦╝║ ║╠═╝╚═╗
+  //  ╩  ╚═╝╚═╝╩═╝╩╚═╝  ╩  ╩╚═╚═╝╩  ╚═╝
+  props: [
+    'withoutMargins'
+  ],
+
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╦╔╗╔╔╦╗╔═╗╦═╗╔╗╔╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ║║║║ ║ ║╣ ╠╦╝║║║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╩╝╚╝ ╩ ╚═╝╩╚═╝╚╝╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: function () {
+    return {
+      beWithoutMargins: undefined,
+    };
+  },
+
+  beforeMount: function() {
+    if (this.withoutMargins !== undefined && typeof this.withoutMargins !== 'boolean') {
+      throw new Error('<cloud-error> received an invalid `withoutMargins`.  If provided, this prop should be precisely true or false.');
+    }
+    this.beWithoutMargins = this.withoutMargins||false;
+  },
+
+  //  ╦ ╦╔╦╗╔╦╗╦
+  //  ╠═╣ ║ ║║║║
+  //  ╩ ╩ ╩ ╩ ╩╩═╝
+  template: `
+  <div>
+    <p :class="{ 'm-0': beWithoutMargins }" class="text-danger"><slot name="default">An error occured while processing your request. Please check your information and try again, or <a href="/contact">contact support</a> if the error persists.</slot></p>
+  </div>
+  `,
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  mounted: async function () {
+
+  },
+
+  watch: {
+    withoutMargins: function(unused) { throw new Error('Changes to `withoutMargins` are not currently supported in <cloud-error>!'); },
+  },
+
+  beforeDestroy: function() {
+
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    //  ╦╔╗╔╔╦╗╔═╗╦═╗╔╗╔╔═╗╦    ╔═╗╦  ╦╔═╗╔╗╔╔╦╗  ╦ ╦╔═╗╔╗╔╔╦╗╦  ╔═╗╦═╗╔═╗
+    //  ║║║║ ║ ║╣ ╠╦╝║║║╠═╣║    ║╣ ╚╗╔╝║╣ ║║║ ║   ╠═╣╠═╣║║║ ║║║  ║╣ ╠╦╝╚═╗
+    //  ╩╝╚╝ ╩ ╚═╝╩╚═╝╚╝╩ ╩╩═╝  ╚═╝ ╚╝ ╚═╝╝╚╝ ╩   ╩ ╩╩ ╩╝╚╝═╩╝╩═╝╚═╝╩╚═╚═╝
+
+    //…
+
+    //  ╔═╗╦ ╦╔╗ ╦  ╦╔═╗  ╔╦╗╔═╗╔╦╗╦ ╦╔═╗╔╦╗╔═╗
+    //  ╠═╝║ ║╠╩╗║  ║║    ║║║║╣  ║ ╠═╣║ ║ ║║╚═╗
+    //  ╩  ╚═╝╚═╝╩═╝╩╚═╝  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝═╩╝╚═╝
+    // > Public methods are rarely exposed by Vue components, but sometimes they
+    // > are an important escape hatch.  They are callable via something like
+    // > `this.$refs.componentNameInCamelCase.doSomething())`, and, by convention,
+    // > are always prefixed with "do".
+    // N/A
+
+    //  ╔═╗╦═╗╦╦  ╦╔═╗╔╦╗╔═╗  ╔╦╗╔═╗╔╦╗╦ ╦╔═╗╔╦╗╔═╗
+    //  ╠═╝╠╦╝║╚╗╔╝╠═╣ ║ ║╣   ║║║║╣  ║ ╠═╣║ ║ ║║╚═╗
+    //  ╩  ╩╚═╩ ╚╝ ╩ ╩ ╩ ╚═╝  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝═╩╝╚═╝
+
+    //…
+
+  }
+
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/components/file-upload.component.js b/ee/bulk-operations-dashboard/assets/js/components/file-upload.component.js
new file mode 100644
index 000000000000..d10816e7abbb
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/components/file-upload.component.js
@@ -0,0 +1,304 @@
+/**
+ * <file-upload>
+ * -----------------------------------------------------------------------------
+ * A form component which includes a file input,
+ * and handles showing a preview image when a file is selected.
+ *
+ * @type {Component}
+ *
+ * -----------------------------------------------------------------------------
+ * @slot image-upload-instructions
+ *                  Optional override for the HTML to display next to the image.
+ *                  (Only relevant when mode="image".)
+ * -----------------------------------------------------------------------------
+ * @event input   - emitted when a file upload is selectd or cleared privately
+ *                  (i.e. using the native file picker).  May be used implicitly
+ *                  with v-model -- e.g.:
+ *                      v-model="formData.logoUpload"
+ *
+ *                  And also explicitly with an @input listener -- e.g.:
+ *                      @input="inputLogoUpload($event)"
+ *
+ *                  In either case, the handler is passed a File instance.
+ *                  File instances can be passed around directly to a lot of
+ *                  things (like parasails/Cloud SDK), and you can also extract
+ *                  a data URI string from them using either FileReader's
+ *                  `.readAsDataURL()` or URL's `createObjectURL(file)`.
+ *                  Links:
+ *                   • https://developer.mozilla.org/en-US/docs/Web/API/FileReader/readAsDataURL
+ *                   • https://developer.mozilla.org/en-US/docs/Web/API/File/Using_files_from_web_applications#Example_Using_object_URLs_to_display_images#Example_Using_object_URLs_to_display_images
+ * -----------------------------------------------------------------------------
+ */
+
+parasails.registerComponent('fileUpload', {
+
+  //  ╔═╗╦═╗╔═╗╔═╗╔═╗
+  //  ╠═╝╠╦╝║ ║╠═╝╚═╗
+  //  ╩  ╩╚═╚═╝╩  ╚═╝
+  props: [
+    'mode', //« Tells us us whether this component should be mounted in the default "file" mode (miscellaneous file) or mounted with an image previewer in "image" mode.
+    'disabled',//« for disabling from the outside (e.g. while syncing)
+
+    'value',//« for v-model -- should not be used to set initial value
+
+    // Note that, for now, `value` is completely separate from initialFileName,
+    // initialMimeType, initialFileSize, and initialSrc.  These props are how
+    // you indicate the initial value for this file upload field.
+    // > FUTURE: Find some way to unify these props with `value` aka v-model
+    // > (see also other FUTURE note below about "value" watcher)
+    'initialFileName',// « file name (basename including extension; no path)
+    'initialFileMimeType',// « the file's MIME type (string)
+    'initialFileSize',// « number of bytes (positive integer)
+    'placeholderImageSrc',// « the placeholder image to display when no image is selected (e.g. a custom silhouette)
+    'initialSrc',// «Conventional approach is to either (A) prepare this on the
+    // backend so it can use the configured baseUrl and/or cache-busting, then
+    // pass that in here, or (B) to use a root-relative URL.  Either way, we
+    // always provide the proper dynamic URL here if we have one and just let
+    // the corresponding download action take care of either grabbing the real
+    // dynamic file or streaming a static placeholder file from disk (e.g. a
+    // fake avatar).  **THAT SAID:** If this initialSrc is omitted, then a
+    // baked-in placeholder image is used instead.  That allows the UI to
+    // display a file-upload-previewer-specific icon (by default, a photo icon)
+    'buttonClass',//« any classes to include on the button other than 'file-upload-button'.
+    // defaults to 'btn btn-outline-primary'
+  ],
+
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: function (){
+    return {
+      isEmpty: false,// « whether or not this upload field is empty
+      previewSrc: undefined,// « determined by initialSrc or the bytes from a selected file upload
+      isCurrentlyDisabled: false, //« controlled by watching `disabled` prop
+      isReadingFileUpload: false, //« spinlock
+      selectedFileName: undefined,
+      selectedFileMimeType: undefined,
+      selectedFileIconClass: undefined,
+      selectedFileSize: undefined,
+    };
+  },
+
+  //  ╦ ╦╔╦╗╔╦╗╦
+  //  ╠═╣ ║ ║║║║
+  //  ╩ ╩ ╩ ╩ ╩╩═╝
+  template: `
+  <div class="clearfix" :class="[mode === 'image' ? 'image-mode' : 'file-mode', isCurrentlyDisabled ? 'disabled' : '']">
+    <div v-if="mode === 'profiles'">
+      <div purpose="profile-upload-input" v-if="isEmpty">
+        <div class="d-flex flex-column align-items-center">
+          <!-- <input id='file-upload' type="file" > -->
+          <img style="height: 40px; width: 34px;" src="/images/profile-34x40@2x.png">
+          <p><strong>Upload configuration profile</strong></p>
+          <p class="muted">.mobileconfig and .json for macOS, iOS, and iPadOS.</p>
+          <p class="muted">.xml for Windows.</p>
+          <div class="btn-and-tips-if-relevant">
+            <label purpose="file-upload" for="file-upload-input">
+              <img src="/images/upload-16x17@2x.png" style="height: 16px; width: 16px; margin-right: 8px">Choose File
+            </label>
+            <input id="file-upload-input" type="file" class="file-input d-none" :disabled="isCurrentlyDisabled" accept=".xml,.mobileconfig,.json" @change="changeFileInput($event)"/>
+          </div>
+        </div>
+      </div>
+      <div purpose="profile-information" v-else>
+        <div class="d-flex flex-row justify-content-start">
+          <img style="height: 40px; width: 34px;" src="/images/profile-34x40@2x.png">
+          <div class="d-flex flex-column">
+            <p><strong>{{selectedFileName.replace(/\.(xml|mobileconfig|json)$/g, '').replace(/^\d{4}-\d{2}-\d{2}_/, '')}}</strong></p>
+            <p class="muted" v-if="_.endsWith(selectedFileName, 'xml')">Windows</p>
+            <p class="muted" v-else>macOS, iOS, iPadOS</p>
+          </div>
+        </div>
+      </div>
+    </div>
+    <div v-else-if="mode === 'scripts'">
+      <div purpose="script-upload-input" v-if="isEmpty">
+        <div class="d-flex flex-column align-items-center">
+          <!-- <input id='file-upload' type="file" > -->
+          <div class="d-flex flex-row justify-content-center mb-2">
+            <img style="height: 40px; width: 34px; margin-right: 16px;" src="/images/script-icon-sh-34x40@2x.png">
+            <img style="height: 40px; width: 34px;" src="/images/script-icon-ps1-34x40@2x.png">
+          </div>
+          <p class="mb-2">Shell (.sh) for macOS and Linux or PowerShell (.ps1) for Windows</p>
+          <p style="color: #8B8FA2" class="muted">By default, scripts will run with “#!/bin/sh” on macOS and Linux. </p>
+          <div class="btn-and-tips-if-relevant">
+            <label purpose="file-upload" for="file-upload-input">
+              <img src="/images/upload-16x17@2x.png" style="height: 16px; width: 16px; margin-right: 8px">Choose file
+            </label>
+            <input id="file-upload-input" type="file" class="file-input d-none" :disabled="isCurrentlyDisabled" accept=".sh,.ps1" @change="changeFileInput($event)"/>
+          </div>
+        </div>
+      </div>
+      <div purpose="script-information" v-else>
+        <div class="d-flex flex-row justify-content-start">
+          <img style="height: 40px; width: 34px;" src="/images/script-icon-ps1-34x40@2x.png" v-if="_.endsWith(selectedFileName, 'ps1')">
+          <img style="height: 40px; width: 34px;" src="/images/script-icon-sh-34x40@2x.png" v-else>
+          <div class="d-flex flex-column">
+            <p><strong>{{selectedFileName}}</strong></p>
+            <p class="muted" v-if="_.endsWith(selectedFileName, 'ps1')">Windows</p>
+            <p class="muted" v-else>macOS & Linux</p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  `,
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    // Validate and then absorb initial props
+    if ((this.initialFileMimeType || this.initialFileMimeType) && !this.initialFileName) {
+      throw new Error('<file-upload>: If "initial-file-mime-type" or "initial-file-size" is provided, then "initial-file-name" must also be provided.');
+    }
+    if (this.mode !== 'image' && this.initialSrc) {
+      throw new Error('<file-upload>: Cannot set "initial-src" unless "mode" is "image".');
+    }
+    if (this.mode === 'image' && this.initialFileName) {
+      throw new Error('<file-upload>: Cannot set "initial-file-name" or "initial-file-mime-type" if "mode" is "image".');
+    }
+
+    if (this.initialSrc) {
+      this.isEmpty = false;
+      this.previewSrc = this.initialSrc;
+    } else if (this.initialFileName) {
+      this.isEmpty = false;
+      this.selectedFileName = this.initialFileName;
+      this.selectedFileMimeType = this.initialFileMimeType;
+      // this.selectedFileIconClass = parasails.util.getMimetypeIconClass(this.initialFileMimeType);
+      this.selectedFileSize = this.initialFileSize;
+    } else {
+      this.isEmpty = true;
+    }
+
+    this.isCurrentlyDisabled = !!this.disabled;
+  },
+  mounted: function (){
+    //…
+  },
+  beforeDestroy: function() {
+    //…
+  },
+  watch: {
+    disabled: function(newVal, unusedOldVal) {
+      this.isCurrentlyDisabled = !!newVal;
+    },
+    value: function(newFile, unusedOldVal) {
+      this._absorbValue(newFile);
+    },
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+    // FUTURE: add alias that makes clicking on image previewer open the file picker (but only if there is no existing image)
+    // FUTURE: if dragging compatible file onto the window, display previewer and button as dropzones
+    // FUTURE: think of some way to elegantly deal with paste (probably only for images though)
+
+    changeFileInput: function($event) {
+      // Apply spinlock
+      if (this.isReadingFileUpload || this.isCurrentlyDisabled) {
+        // Note that we can't preventDefault on an input's change event (it's
+        // not supported by the browser), so it's possible to end up in a weird
+        // situation here where the file input has changed in the DOM, but neither
+        // our file previewer nor the harvested form data reflects that.
+        // FUTURE: Look for solutions to this edgiest of edge cases
+        return;
+      }//• (avast)
+
+      var files = $event.target.files;
+      if (files.length > 1) {
+        throw new Error('<file-upload> component received multiple files!  But at this time, multiple file uploads are not supported, so this should never happen!');
+      }
+
+      // Cancelling the native upload window sets `files` to an empty array.
+      // So to address this, if you cancel from the native upload window, then
+      // we just avast (return early).
+      // > In this case, we'll just leave the harvested form data as it was, and
+      // > the previewer displaying whatever you had there before.
+      var selectedFile = files[0];
+      if (!selectedFile) {
+        return;
+      }//•
+
+      // Even though triggering the input event should fire our watcher, which
+      // will do exactly the same thing as this, still go ahead and manually
+      // absorb the new file beforehand.
+      // > This is just in case the variable provided to v-model/:value is
+      // > immutable, such as if it came from `slot-scope` of a parent component.
+      this._absorbValue(selectedFile);
+      // • FUTURE: make this component smarter so that the browser doesn't have
+      //           to double-read the file's bytes in this edge case.  (But this
+      //           kind of caching is pretty bug-prone so we should be careful.)
+
+      // Emit an event so the v-model can update with our selected file.
+      this.$emit('input', selectedFile);
+
+    },
+
+    //  ╔═╗╦ ╦╔╗ ╦  ╦╔═╗  ╔╦╗╔═╗╔╦╗╦ ╦╔═╗╔╦╗╔═╗
+    //  ╠═╝║ ║╠╩╗║  ║║    ║║║║╣  ║ ╠═╣║ ║ ║║╚═╗
+    //  ╩  ╚═╝╚═╝╩═╝╩╚═╝  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝═╩╝╚═╝
+    doOpenFileBrowser: function() {
+      this.$find('[type="file"]').trigger('click');
+    },
+
+    //  ╔═╗╦═╗╦╦  ╦╔═╗╔╦╗╔═╗  ╔╦╗╔═╗╔╦╗╦ ╦╔═╗╔╦╗╔═╗
+    //  ╠═╝╠╦╝║╚╗╔╝╠═╣ ║ ║╣   ║║║║╣  ║ ╠═╣║ ║ ║║╚═╗
+    //  ╩  ╩╚═╩ ╚╝ ╩ ╩ ╩ ╚═╝  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝═╩╝╚═╝
+    _absorbValue: function(newFile) {
+      // console.log(newFile);
+      if (!newFile) {
+        this.isEmpty = true;
+        this.previewSrc = undefined;
+        this.selectedFileName = undefined;
+        this.selectedFileMimeType = undefined;
+        this.selectedFileSize = undefined;
+      } else if (_.isObject(newFile) && newFile.name) {
+        // Duck-type File instance
+
+        // Set vm data for the filename and file MIME type in order to render
+        // help text / appropriate icon in the DOM.
+        this.isEmpty = false;
+        this.selectedFileName = newFile.name;
+        this.selectedFileName = this.selectedFileName.replace(/^\d{4}\-\d{2}\-\d{2}_/, '');
+        this.selectedFileMimeType = newFile.type;
+        this.selectedFileIconClass = parasails.util.getMimetypeIconClass(newFile.type);
+        this.selectedFileSize = newFile.size;
+        // console.log(newFile);
+        if (this.mode === 'image') {
+          // Set up the file preview for the UI, start reading, and when finished,
+          // tear it all down.  (Note that we're using a spinlock just to be safe,
+          // in case it turns out we're dealing with a huge file for some reason.)
+          this.isReadingFileUpload = true;
+          let reader = new FileReader();
+          reader.onload = (event)=>{
+            this.previewSrc = event.target.result;
+
+            // Unbind this "onload" event & release the lock.
+            delete reader.onload;
+            this.isReadingFileUpload = false;
+          };//œ
+          reader.readAsDataURL(newFile);
+        }//fi
+        // • FUTURE: potentially support changing this "value" to any arbitrary
+        //           Blob instance.
+        //           (see also FUTURE note above about replacing initial-src,
+        //           etc. with tighter v-model integration)
+      } else {
+        throw new Error(
+          'Changing to that value (v-model) for a <file-upload> component from '+
+          'the outside is not yet supported!  (Currently, this component only '+
+          'supports programmatically setting the value to `null`.)'
+        );
+      }//fi
+      // • FUTURE: potentially also support passing in a string (URL) as some
+      //           other prop, then automatically fetching a Blob from it, and
+      //           finally emitting an "input" event to set the v-model properly.
+    }
+
+  }
+
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/components/js-timestamp.component.js b/ee/bulk-operations-dashboard/assets/js/components/js-timestamp.component.js
new file mode 100644
index 000000000000..e37cddb165a5
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/components/js-timestamp.component.js
@@ -0,0 +1,130 @@
+/**
+ * <js-timestamp>
+ * -----------------------------------------------------------------------------
+ * A human-readable, self-updating "timeago" timestamp, with some special rules:
+ *
+ * • Within 24 hours, displays in "timeago" format.
+ * • Within a month, displays month, day, and time of day.
+ * • Within a year, displays just the month and day.
+ * • Older/newer than that, displays the month and day with the full year.
+ *
+ * @type {Component}
+ * -----------------------------------------------------------------------------
+ */
+
+parasails.registerComponent('jsTimestamp', {
+
+  //  ╔═╗╦═╗╔═╗╔═╗╔═╗
+  //  ╠═╝╠╦╝║ ║╠═╝╚═╗
+  //  ╩  ╩╚═╚═╝╩  ╚═╝
+  props: [
+    'at',// « The JS timestamp to format
+    'short',// « Whether to shorten the formatted date by not including the time of day (may only be used with timeago, and even then only applicable in certain situations)
+    'format',// « one of: 'calendar', 'timeago' (defaults to 'timeago'.  Otherwise, the "calendar" format displays data as US-style calendar dates with a four-character year, separated by dashes.  In other words: "MM-DD-YYYY")
+  ],
+
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: function (){
+    return {
+      formatType: undefined,
+      formattedTimestamp: '',
+      interval: undefined
+    };
+  },
+
+  //  ╦ ╦╔╦╗╔╦╗╦
+  //  ╠═╣ ║ ║║║║
+  //  ╩ ╩ ╩ ╩ ╩╩═╝
+  template: `
+  <span>{{formattedTimestamp}}</span>
+  `,
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    if (this.at === undefined) {
+      throw new Error('Incomplete usage of <js-timestamp>:  Please specify `at` as a JS timestamp (i.e. epoch ms, a number).  For example: `<js-timestamp :at="something.createdAt">`');
+    }
+    if(this.format === undefined) {
+      this.formatType = 'timeago';
+    } else  {
+      if(!_.contains(['calendar', 'timeago'], this.format)) { throw new Error('Unsupported `format` ('+this.format+') passed in to the JS timestamp component! Must be either \'calendar\' or \'timeago\'.'); }
+      this.formatType = this.format;
+    }
+
+    // If timeago timestamp, update the timestamp every minute.
+    if(this.formatType === 'timeago') {
+      this._formatTimeago();
+      this.interval = setInterval(async()=>{
+        try {
+          this._formatTimeago();
+          await this.forceRender();
+        } catch (err) {
+          err.raw = err;
+          throw new Error('Encountered unexpected error while attempting to automatically re-render <js-timestamp> in the background, as the seconds tick by.  '+err.message);
+        }
+      },60*1000);//œ
+    }
+
+    // If calendar timestamp, just set it the once.
+    // (Also don't allow usage with `short`.)
+    if(this.formatType === 'calendar') {
+      this.formattedTimestamp = moment(this.at).format('MM-DD-YYYY');
+      if (this.short) {
+        throw new Error('Invalid usage of <js-timestamp>:  Cannot use `short="true"` at the same time as `format="calendar"`.');
+      }
+    }
+  },
+
+  beforeDestroy: function() {
+    if(this.formatType === 'timeago') {
+      clearInterval(this.interval);
+    }
+  },
+
+  watch: {
+    at: function() {
+      // Render to account for after-mount programmatic changes to `at`.
+      if(this.formatType === 'timeago') {
+        this._formatTimeago();
+      } else if(this.formatType === 'calendar') {
+        this.formattedTimestamp = moment(this.at).format('MM-DD-YYYY');
+      } else {
+        throw new Error();
+      }
+    }
+  },
+
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    _formatTimeago: function() {
+      var now = new Date().getTime();
+      var timeDifference = Math.abs(now - this.at);
+
+      // If the timestamp is less than a day old, format as time ago.
+      if(timeDifference < 1000*60*60*24) {
+        this.formattedTimestamp = moment(this.at).fromNow();
+      } else {
+        // If the timestamp is less than a month-ish old, we'll include the
+        // time of day in the formatted timestamp.
+        let includeTime = !this.short && timeDifference < 1000*60*60*24*31;
+
+        // If the timestamp is from a different year, we'll include the year
+        // in the formatted timestamp.
+        let includeYear = moment(now).format('YYYY') !== moment(this.at).format('YYYY');
+
+        this.formattedTimestamp = moment(this.at).format('MMMM DD'+(includeYear ? ', YYYY' : '')+(includeTime ? ' [at] h:mma' : ''));
+      }
+
+    }
+
+  }
+
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/components/modal.component.js b/ee/bulk-operations-dashboard/assets/js/components/modal.component.js
new file mode 100644
index 000000000000..a5f924fd39bc
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/components/modal.component.js
@@ -0,0 +1,226 @@
+/**
+ * <modal>
+ * -----------------------------------------------------------------------------
+ * A modal dialog pop-up.
+ *
+ * > Be careful adding other Vue.js lifecycle callbacks in this file!  The
+ * > finnicky combination of Vue transitions and bootstrap modal animations used
+ * > herein work, and are very well-tested in practical applications.  But any
+ * > changes to that specific cocktail could be unpredictable, with unsavory
+ * > consequences.
+ *
+ * @type {Component}
+ *
+ * @event close   [emitted when the closing process begins]
+ * @event opened  [emitted when the opening process is completely done]
+ * -----------------------------------------------------------------------------
+ */
+
+parasails.registerComponent('modal', {
+  //  ╔═╗╦═╗╔═╗╔═╗╔═╗
+  //  ╠═╝╠╦╝║ ║╠═╝╚═╗
+  //  ╩  ╩╚═╚═╝╩  ╚═╝
+  props: [
+    'hideCloseButton'//« removes the default "x" button
+  ],
+
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: function (){
+    return {
+      // Spinlock used for preventing trying to close the bootstrap modal more than once.
+      // (in practice it doesn't seem to hurt anything if it tries to close more than once,
+      // but still.... better safe than sorry!)
+      _bsModalIsAnimatingOut: false,
+
+      isMobileSafari: false,//« more on this below
+      originalScrollPosition: undefined,//« more on this below
+    };
+  },
+
+  //  ╦ ╦╔╦╗╔╦╗╦
+  //  ╠═╣ ║ ║║║║
+  //  ╩ ╩ ╩ ╩ ╩╩═╝
+  template: `
+  <transition name="modal" v-on:leave="leave" v-bind:css="false">
+    <div class="modal fade" tabindex="-1" role="dialog">
+      <div class="petticoat"></div>
+      <div class="modal-dialog custom-width position-relative" role="document" purpose="modal-dialog">
+        <div class="modal-content" purpose="modal-content">
+          <button type="button" style="top: 5px; right: 0; font-size: 28px; line-height: 1;" class="py-2 px-3 position-absolute" data-dismiss="modal" aria-label="Close" purpose="modal-close-button" v-if="!hideCloseButton">&times;</button>
+          <slot></slot>
+        </div><!-- /.modal-content -->
+      </div><!-- /.modal-dialog -->
+    </div><!-- /.modal -->
+  </transition>
+  `,
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    // If this is mobile safari, make note of it.
+    this.isMobileSafari = (typeof bowser !== 'undefined') && bowser.mobile && bowser.safari;
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    // ^^So there's a bug in mobile safari that misplaces the caret when the keyboard opening
+    // causes the page to scroll, so we need to do some special tricks to keep it from getting ugly.
+    // It's only in iOS 11... we think.  Hopefully it will be fixed.
+    // In the mean time, we have to get wacky.
+    //
+    // > More info about the bug here:
+    // > https://github.com/twbs/bootstrap/issues/24835#issuecomment-345974819
+    // > https://stackoverflow.com/questions/46567233/how-to-fix-the-ios-11-input-element-in-fixed-modals-bug?rq=1
+    //
+    // FUTURE: maybe the bug will be fixed and we can remove this someday?
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+    if(this.isMobileSafari) {
+      // Get our original scroll position before opening the modal and save it for later.
+      this.originalScrollPosition = $(window).scrollTop();
+    }
+  },
+  mounted: function(){
+    // ^^ Note that this is not an `async function`.
+    // This is just to be safe, since the timing here is a little tricky w/ the
+    // animations and the fact that we're integrating with Bootstrap's modal.
+    // (That said, it might work fine-- just hasn't been extensively tested.)
+
+    // Immediately call out to the Bootstrap modal and tell it to show itself.
+    $(this.$el).modal({
+      // Set the modal backdrop to the 'static' option, which means it doesn't close the modal
+      // when clicked.
+      backdrop: 'static',
+      show: true
+    });
+
+    // Attach listener for underlying custom modal closing event,
+    // and when that happens, have Vue emit a custom "close" event.
+    // (Note: This isn't just for convenience-- it's crucial that
+    // the parent logic can use this event to update its scope.)
+    $(this.$el).on('hide.bs.modal', ()=>{
+
+      // Undo any mobile safari workarounds we may have added.
+      // (i.e. shed the wackiness)
+      if(this.isMobileSafari) {
+        // Remove style overrides on our modal dialog.
+        $(this.$el).css({
+          'overflow-y': '',
+          'position': '',
+          'left': '',
+          'top': '',
+        });
+
+        // Beckon to our siblings so they come out of hiding
+        this.$get().parent().children().not(this.$el).css({
+          'display': ''
+        });
+
+        // Scroll to our original position when the modal was summoned.
+        window.scrollTo(0, this.originalScrollPosition);
+      }//fi
+
+      this._bsModalIsAnimatingOut = true;
+      this.$emit('close');
+
+    });//œ
+
+    // Attach listener for underlying custom modal "opened" event,
+    // and when that happens, have Vue emit our own custom "opened" event.
+    // This is so we know when the entry animation has completed, allows
+    // us to do cool things like auto-focus the first input in a form modal.
+    $(this.$el).on('shown.bs.modal', ()=>{
+
+      // If this is mobile safari, let's get wacky.
+      if(this.isMobileSafari) {
+        // Scroll to the top of the page.
+        window.scrollTo(0, 0);
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // ^^FUTURE: Don't actually do this -- instead, try setting `top` of the
+        // modal to whatever the original scrollTop of our window was.  This
+        // eliminates the need for auto-scrolling to the top and ripping you out
+        // of the context you were in before the modal opens.  It would also allow
+        // us to keep the nice animation when opening/closing modals on iOS.
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+        // Hide siblings to lop off any extra space at the bottom.
+        this.$get().parent().children().not(this.$el).css({
+          'display': 'none'
+        });
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // ^^FUTURE: Instead of just hiding siblings, which isn't perfect and won't
+        // always work for everyone, try grabbing outerHeight of the modal element
+        // and using that to set an explicit height for the body.
+        // (but also be sure to handle the case where the body is short!)
+        // But for now, this should work as long as we have sticky footer styles.
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+        // Hard code some style overrides on our modal dialog.
+        // Without these, it gets weird.
+        $(this.$el).css({
+          'overflow-y': 'auto!important',
+          'position': 'absolute',
+          'left': '0',
+          'top': '0',
+        });
+      }//fi
+
+      // Focus our "focus-first" field, if relevant.
+      // (but not on mobile, because it can get weird)
+      if(typeof bowser !== 'undefined' && !bowser.mobile && this.$find('[focus-first]').length > 0) {
+        this.$focus('[focus-first]');
+      }
+
+      this.$emit('opened');
+      $(this.$el).off('shown.bs.modal');
+    });//ƒ
+  },
+  // ^Note that there is no `beforeDestroy()` lifecycle callback in this
+  // component. This is on purpose, since the timing vs. `leave()` gets tricky.
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    leave: function (el, done) {
+      // > Note: This function signature comes from Vue.js's transition system.
+      // > It will likely be replaced with `async function (el){…}` in a future
+      // > release of Vue/Sails.js (i.e. no callback argument).
+
+      // If this shutting down was spawned by the bootstrap modal's built-in logic,
+      // then we'll have already begun animating the modal shut.  So we check our
+      // spinlock to make sure.  If it turns out that we HAVEN'T started that process
+      // yet, then we go ahead and start it now.
+      if (!this._bsModalIsAnimatingOut) {
+        $(this.$el).modal('hide');
+      }//fi
+
+      // When the bootstrap modal finishes animating into nothingness, unbind all
+      // the DOM events used by bootstrap, and then call `done()`, which passes
+      // control back to Vue and lets it finish the job (i.e. afterLeave).
+      //
+      // > Note that the other lifecycle events like `destroyed` were actually
+      // > already fired at this point.
+      // >
+      // > Also note that, since we're potentially long past the `destroyed` point
+      // > of the lifecycle here, we can't call `.$emit()` anymore either.  So,
+      // > for example, we wouldn't be able to emit a "fullyClosed" event --
+      // > because by the time it'd be appropriate to emit the Vue event, our
+      // > context for triggering it (i.e. the relevant instance of this component)
+      // > will no longer be capable of emitting custom Vue events (because by then,
+      // > it is no longer "reactive").
+      // >
+      // > For more info, see:
+      // > https://github.com/vuejs/vue-router/issues/1302#issuecomment-291207073
+      $(this.$el).on('hidden.bs.modal', ()=>{
+        $(this.$el).off('hide.bs.modal');
+        $(this.$el).off('hidden.bs.modal');
+        $(this.$el).off('shown.bs.modal');
+        done();
+      });//_∏_
+
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/components/multifield.component.js b/ee/bulk-operations-dashboard/assets/js/components/multifield.component.js
new file mode 100644
index 000000000000..530ab7ef6e2d
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/components/multifield.component.js
@@ -0,0 +1,282 @@
+/**
+ * <multifield>
+ * -----------------------------------------------------------------------------
+ *
+ * @type {Component}
+ *
+ * --- SLOTS: ---
+ * @slot item-field
+ *       The template to use for each field.
+ *       > Also note:
+ *       > If this slot contains exactly one element with `role="focusable"` or
+ *       > `focus-first`, that element will be focused automatically on add/remove.
+ *       @param {Ref} item
+ *       @param {Function} doSet
+ *       @param {Array} allItems
+ *       @param {Number} idx
+ *
+ * --- EVENTS EMITTED: ---
+ * @event input
+ *
+ * -----------------------------------------------------------------------------
+ */
+
+parasails.registerComponent('multifield', {
+
+  //  ╔═╗╦═╗╔═╗╔═╗╔═╗
+  //  ╠═╝╠╦╝║ ║╠═╝╚═╗
+  //  ╩  ╩╚═╚═╝╩  ╚═╝
+  props: [
+    'value',// « 2-way (for v-model)
+    'addButtonText',//« Custom text for the "+ Add another" button (optional)
+    'inputType',// For customizing the input type.
+    'selectOptions',// For select support. An array of objects that have a name and value. ex: [{name: macOS, value: darwin}, {name: Windows, value: windows}]
+    'nameAndHostCountSelectOptions',// For nameAndHostCountSelect support. An array of objects that have a name, id, and hostCount. ex: [{"name": "Microsoft office for macOS 16.76","id": 289874,"hostCount": 1}]
+    'cloudError',// For highlighting fields, for this to work, the error response needs to return the value of the invalid fields, see api/controllers/update-priority-vulnerabilities to see an example of this.
+    'placeholder',// an optional placeholder value for text type inputs
+  ],
+
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: function () {
+    return {
+      currentFieldValues: undefined, //« will be initialized to a single-item array in beforeMount
+      optionsForSelect: [],
+      inputPlaceholder: '',
+    };
+  },
+  //  ╦ ╦╔╦╗╔╦╗╦
+  //  ╠═╣ ║ ║║║║
+  //  ╩ ╩ ╩ ╩ ╩╩═╝
+  template: `
+  <div class="multifield-set">
+    <div class="multifield-item" v-for="(unused,idx) in currentFieldValues" :key="idx" :role="'item-'+idx">
+      <!-- <span class="multifield-item-label">{{idx+1}}.</span> -->
+      <slot name="item-field" :item="currentFieldValues[idx]" :do-set="_getCurriedDoSetFn(idx)" :all-items="currentFieldValues" :idx="idx">
+        <input type="text" :placeholder="inputPlaceholder" :class="[cloudError && _.contains(cloudError.responseInfo.data, currentFieldValues[idx]) ? 'text-danger is-invalid' : '']" :value.sync="currentFieldValues[idx]" @input="inputDefaultItemField($event, idx)" role="focusable" v-if="!inputType"/>
+        <select class="custom-select" :value.sync="currentFieldValues[idx]" @input="inputDefaultItemField($event, idx)" role="focusable" v-else-if="inputType && inputType === 'nameAndHostCountSelect'">
+          <option :value="undefined" selected>---</option>
+          <option v-for="option in optionsForSelect" :value="option.id">{{option.name}} ({{option.hostCount}} {{option.hostCount > 1 || option.hostCount === 0 ? 'hosts' : 'host'}})</option>
+        </select>
+        <select class="custom-select" :value.sync="currentFieldValues[idx]" @input="inputDefaultItemField($event, idx)" role="focusable" v-else-if="inputType && inputType === 'select'">
+          <option :value="undefined" selected>---</option>
+          <option v-for="option in optionsForSelect" :value="option.fleetApid">{{option.name}}</option>
+        </select>
+        <select class="custom-select" :value.sync="currentFieldValues[idx]" @input="inputTeamSelectItemField($event, idx)" role="focusable" v-else-if="inputType && inputType === 'teamSelect'">
+          <option :value="undefined" selected>---</option>
+          <option value="allTeams">All teams</option>
+          <option v-for="option in optionsForSelect" :value="option.fleetApid">{{option.teamName}}</option>
+        </select>
+        <input :type="inputType" :placeholder="inputPlaceholder" :value.sync="currentFieldValues[idx]" @input="inputDefaultItemField($event, idx)" role="focusable" v-else-if="inputType">
+      </slot>
+      <button class="multifield-item-remove-button" type="button" v-if="currentFieldValues.length >= 2" @click="clickRemoveItem(idx)"></button>
+      <button class="multifield-item-remove-button" type="button" v-else-if="currentFieldValues.length === 1 && currentFieldValues[0] !== undefined" @click="clickResetSingleItem()"></button>
+    </div>
+    <div class="add-button-wrapper d-flex flex-row justify-content-start" :class="_.all(currentFieldValues, (item)=> item !== undefined) ? '' : 'empty'">
+      <a class="add-button" @click="clickAddItem()" v-if="_.all(currentFieldValues, (item)=> item !== undefined)"><strong>+</strong>&nbsp;&nbsp;{{addButtonText || 'Add another'}}</a>
+      <span v-else>&nbsp;</span>
+    </div>
+  </div>
+  `,
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    // Absorb value
+    if (this.value !== undefined && !_.isArray(this.value)) {
+      throw new Error('In <multifield>, if specified, `v-model`/`:value` must be either an array or `undefined`.  But instead, got: '+this.value);
+    }//•
+
+    if (this.value === undefined || _.isEqual(this.value, [])) {
+      this.currentFieldValues = [ undefined ];
+    } else {
+      this.currentFieldValues = _.clone(this.value);
+      // ^^ The clone is to prevent entanglement risk.
+    }
+    if(this.inputType === 'nameAndHostCountSelect') {
+      if(!_.isArray(this.selectOptions)){
+        throw new Error('Missing selectOptions. When using inputType="nameAndHostCountSelect", an array of selectOptions is required.');
+      } else {
+        for(let option of this.selectOptions){
+          // If we're using inputType="nameAndHostCountSelect", we will validate all options before cloning the object.
+          if(!option.id){
+            throw new Error(`Option in selectOptions is missing an id. When using inputType="nameAndHostCountSelect", An id property is required for all objects in the selectOptions array. Object missing an id: ${option}`);
+          }
+          if(!option.name){
+            throw new Error(`Option in selectOptions is missing a name. When using inputType="nameAndHostCountSelect", A name property is required for all objects in the selectOptions array. Object missing a name: ${option}`);
+          }
+          if(option.hostCount === undefined){
+            throw new Error(`Option in selectOptions is missing a hostCount. When using inputType="nameAndHostCountSelect", A hostCount property is required for all objects in the selectOptions array. Object missing a hostCount: ${option}`);
+          }
+        }
+        this.optionsForSelect = _.clone(this.selectOptions);
+      }
+    }
+    if(this.inputType === 'teamSelect') {
+      if(!_.isArray(this.selectOptions)){
+        throw new Error('Missing selectOptions. When using inputType="teamSelect", an array of selectOptions is required.');
+      } else {
+        for(let option of this.selectOptions){
+          // If we're using inputType="nameAndHostCountSelect", we will validate all options before cloning the object.
+          if(typeof option.fleetApid !== 'number'){
+            throw new Error(`Option in selectOptions is missing an fleetApid. When using inputType="teamSelect", An fleetApid property is required for all objects in the selectOptions array. Object missing an fleetApid: ${option}`);
+          }
+          if(!option.teamName){
+            throw new Error(`Option in selectOptions is missing a teamName. When using inputType="teamSelect", A teamName property is required for all objects in the selectOptions array. Object missing a teamName: ${option}`);
+          }
+        }
+        this.optionsForSelect = _.clone(this.selectOptions);
+      }
+    }
+    if(this.inputType === 'select') {
+      if(!_.isArray(this.selectOptions)){
+        throw new Error('Missing selectOptions. When using inputType="select", an array of selectOptions is required.');
+      } else {
+        for(let option of this.selectOptions){
+          // If we're using inputType="select", we will validate all options before cloning the object.
+          if(!option.value){
+            throw new Error(`Option in selectOptions is missing a value. When using inputType="select", A value property is required for all objects in the selectOptions array. Object missing a value. ${option}`);
+          }
+          if(!option.name){
+            throw new Error(`Option in selectOptions is missing a name. When using inputType="select", A name property is required for all objects in the selectOptions array. Object missing a name. ${option}`);
+          }
+        }
+        this.optionsForSelect = _.clone(this.selectOptions);
+      }
+    }
+    if(this.placeholder){
+      this.inputPlaceholder = this.placeholder;
+    }
+  },
+
+  mounted: async function () {
+
+  },
+
+  beforeDestroy: function() {
+
+  },
+
+  watch: {
+
+    value: function(those) {
+      // console.log('ran the `value` watcher', those);
+      if (those !== undefined && !_.isArray(those)) {
+        throw new Error('Cannot programmatically set value for <multifield>: the given value must be an array or `undefined`, but instead got: '+those);
+      }
+      this.currentFieldValues = those;
+    }
+
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    //  ╔═╗╦  ╦╔═╗╔╗╔╔╦╗  ╦ ╦╔═╗╔╗╔╔╦╗╦  ╔═╗╦═╗╔═╗
+    //  ║╣ ╚╗╔╝║╣ ║║║ ║   ╠═╣╠═╣║║║ ║║║  ║╣ ╠╦╝╚═╗
+    //  ╚═╝ ╚╝ ╚═╝╝╚╝ ╩   ╩ ╩╩ ╩╝╚╝═╩╝╩═╝╚═╝╩╚═╚═╝
+    inputDefaultItemField: async function($event, idx) {
+      var parsedValue = $event.target.value || undefined;
+      this.currentFieldValues[idx] = parsedValue;
+      await this.forceRender();
+      this._handleChangingFieldValues();
+    },
+
+    inputTeamSelectItemField: async function($event, idx) {
+      var parsedValue = $event.target.value || undefined;
+      this.currentFieldValues[idx] = parsedValue;
+      if(parsedValue === 'allTeams') {
+        this.currentFieldValues = _.pluck(this.optionsForSelect, 'fleetApid');
+      }
+      await this.forceRender();
+      this._handleChangingFieldValues();
+    },
+
+    clickAddItem: async function() {
+      this.currentFieldValues.push(undefined);
+      await this.forceRender();//«« this is so that the programmatic focusing code below will work
+
+      // Autofocus (but only if we're sure it's going to work)
+      var idxToFocus = this.currentFieldValues.length - 1;
+      var focalSelector = `[role="item-${idxToFocus}"] [role="focusable"], [role="item-${idxToFocus}"] [focus-first]`;
+      var focusableEls = this.$find(focalSelector);
+      if (focusableEls.length === 1) {
+        this.$focus(focalSelector);
+      }
+      this.$emit('input', _.clone(this.currentFieldValues));
+    },
+
+    clickRemoveItem: async function(idx) {
+
+      this.currentFieldValues.splice(idx, 1);
+      this.$emit('input', _.clone(this.currentFieldValues));
+      // The _.clone() above is to prevent an entanglement issue caused by
+      // emitting the same reference if we were to use this.currentFieldValues
+      // directly.
+
+      // Autofocus (but only if we're sure it's going to work)
+      var idxToFocus = idx >= this.currentFieldValues.length ? this.currentFieldValues.length - 1 : idx;
+      var focalSelector = `[role="item-${idxToFocus}"] [role="focusable"], [role="item-${idxToFocus}"] [focus-first]`;
+      var focusableEls = this.$find(focalSelector);
+      if (focusableEls.length === 1) {
+        this.$focus(focalSelector);
+      }
+    },
+    // To accomodate the requested behavior in wireframes.
+    clickResetSingleItem: async function() {
+      this.currentFieldValues[0] = undefined;
+      this.$emit('input', _.clone(this.currentFieldValues));
+      await this.forceRender();
+    },
+
+    //  ╔═╗╦ ╦╔╗ ╦  ╦╔═╗  ╔╦╗╔═╗╔╦╗╦ ╦╔═╗╔╦╗╔═╗
+    //  ╠═╝║ ║╠╩╗║  ║║    ║║║║╣  ║ ╠═╣║ ║ ║║╚═╗
+    //  ╩  ╚═╝╚═╝╩═╝╩╚═╝  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝═╩╝╚═╝
+
+    //…
+
+    //  ╔═╗╦═╗╦╦  ╦╔═╗╔╦╗╔═╗  ╔╦╗╔═╗╔╦╗╦ ╦╔═╗╔╦╗╔═╗
+    //  ╠═╝╠╦╝║╚╗╔╝╠═╣ ║ ║╣   ║║║║╣  ║ ╠═╣║ ║ ║║╚═╗
+    //  ╩  ╩╚═╩ ╚╝ ╩ ╩ ╩ ╚═╝  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝═╩╝╚═╝
+    _getCurriedDoSetFn: function(idx) {
+      return async (newVal)=>{
+        // Note that it is the responsibility of the userland contents of the
+        // slot to make sure this incoming value is proper.  For example, if
+        // the slot contains an `<input>`, then when invoking doSet, you should
+        // do so like:
+        // ```
+        // <input :value="item" @input="doSet($event.target.value||undefined)"/>
+        // ```
+        //
+        // The `||undefined` is because otherwise, you get `null`, and you
+        // probably want blank fields to be treated as undefined so we can
+        // automatically splice them out of the array before emitting our input
+        // event.
+        //
+        // The reason this is left as a userland concern is because the `null`
+        // value itself, just like `''`, `0`, `false`, `NaN` or other similar
+        // values, is technically a valid thing that might be relevant under
+        // unusual circumstances.
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // console.log('FIRED DOSET for idx',idx,'and newVal', newVal);
+        this.currentFieldValues[idx] = newVal;
+        await this.forceRender();
+        this._handleChangingFieldValues();
+      };
+    },
+
+    _handleChangingFieldValues: function() {
+      // > Note that we do a `_.clone()`.  This is to prevent an entanglement
+      // > issue caused by emitting the same reference if we were to simply emit
+      // > `this.currentFieldValues` directly.
+      this.$emit('input', _.clone(this.currentFieldValues));
+      // console.log('emitting in <multifield>…', _.cloneDeep(this.currentFieldValues));
+    },
+
+  }
+
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/components/stripe-card-element.component.js b/ee/bulk-operations-dashboard/assets/js/components/stripe-card-element.component.js
new file mode 100644
index 000000000000..c7b540105704
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/components/stripe-card-element.component.js
@@ -0,0 +1,192 @@
+/**
+ * <stripe-card-element>
+ * -----------------------------------------------------------------------------
+ * A wrapper for the Stripe Elements "card" component (https://stripe.com/elements)
+ *
+ * @type {Component}
+ *
+ * @event update:busy  [:busy.sync="…"]
+ * @event input        [emitted when the stripe token changes (supports v-model)]
+ * @event invalidated  [emitted when the field had been changed to include an invalid value]
+ * @event validated    [emitted when the field had been changed to include a valid value]
+ * -----------------------------------------------------------------------------
+ */
+parasails.registerComponent('stripeCardElement', {
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔═╗╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠╣ ╠═╣║  ║╣
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╚  ╩ ╩╚═╝╚═╝
+  props: [
+    'stripePublishableKey',
+    'isErrored',
+    'errorMessage',//« optional custom error message to display
+    'value',//« the v-model passed in.
+    'busy',
+    'showExisting',// « whether to show the existing card info passed into `v-model`
+  ],
+  //  ╔╦╗╔═╗╦═╗╦╔═╦ ╦╔═╗
+  //  ║║║╠═╣╠╦╝╠╩╗║ ║╠═╝
+  //  ╩ ╩╩ ╩╩╚═╩ ╩╚═╝╩
+  template: `
+  <div>
+    <div v-if="existingCardData">
+      <span class="existing-card">{{existingCardData.billingCardBrand}} ending in <strong>{{existingCardData.billingCardLast4}}</strong></span>
+      <small class="new-card-text d-inline-block ml-2">(Want to use a different card ? <a class="text-primary change-card-button" type="button" @click="clickChangeExistingCard()">Click here</a>.)</small>
+    </div>
+    <div class="card-element-wrapper" :class="[existingCardData ? 'secret-card-element-wrapper' : '', isErrored ? 'is-invalid' : '']" :aria-hidden="existingCardData ? true : false">
+      <div class="card-element form-control" :class="isErrored ? 'is-invalid' : ''" card-element></div>
+      <span class="status-indicator syncing text-primary" :class="[isSyncing ? '' : 'hidden']"><span class="fa fa-spinner"></span></span>
+      <span class="status-indicator text-primary" :class="[isValidated ? '' : 'hidden']"><span class="fa fa-check-circle"></span></span>
+      <div class="invalid-feedback" v-if="!isValidated && isErrored">{{ errorMessage || 'Please check your card info.'}}</div>
+    </div>
+  </div>
+  `,
+  //  ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: function (){
+    return {
+      isSyncing: false,
+      isValidated: false,
+      existingCardData: undefined,
+      // The underlying Stripe instance
+      _stripe: undefined,
+      // The underlying Stripe elements instance
+      _elements: undefined,
+      // The underlying Stripe element instance this component creates as it mounts.
+      _element: undefined,
+    };
+  },
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    // Initialize an instance of Stripe "elements", which we'll pass into
+    // our <stripe-element> component instances.
+    // (We also save an instance of `stripe` for use below.)
+    this._stripe = Stripe(this.stripePublishableKey);
+    this._elements = this._stripe.elements();
+  },
+  mounted: function (){
+    if(this.showExisting && _.isObject(this.value) && this.value.stripeToken && this.value.billingCardBrand && this.value.billingCardLast4) {
+      this.existingCardData = _.extend({}, this.value);
+    }
+    this._element = this._elements.create('card', {
+      // Classes
+      // > https://stripe.com/docs/js/elements_object/create_element?type=card#elements_create-options-classes
+      classes: {
+        // When the iframe is focused, attach the "pseudofocused" class
+        // to our wrapper <div>.
+        focus: 'pseudofocused'
+      },
+      // iframe styles:
+      // > https://stripe.com/docs/js/appendix/style?type=card
+      // You can update this section to match your website's theme
+      style: {
+        base: {
+          lineHeight: '36px',
+          fontSize: '16px',
+          color: '#495057',
+          iconColor: '#14acc2',
+          fontFamily: '-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif',
+          '::placeholder': {
+            color: '#6c757d',
+          },
+        },
+        invalid: {
+          color: '#dc3545',
+        },
+      },
+    });
+    this._element.mount($(this.$el).find('[card-element]')[0]);
+    //  When a change occurs, immediately clear the token by
+    //  emitting an input event with '', show a loading spinner, and start
+    //  fetching a new token. Then in userland, the validation error for a missing
+    //  card becomes something reasonable that implies that we may not have finished
+    //  getting it yet, so hold your horses.
+    this._element.on('change', (stripeEvent)=> {
+      // If there is an error, set the v-model to be empty.
+      if(stripeEvent.error) {
+        this.$emit('input', '');
+      } else if(stripeEvent.complete) {
+        // If the field is complete, (aka valid), fetch a token and set that on the v-model
+        // (first clearing out the v-model, so this won't be considered valid yet e.g. if it was just changed.
+        if(this.isSyncing) { return; }
+        this.$emit('');
+        this.isSyncing = true;
+        this.$emit('update:busy', true);
+        this.isValidated = false;
+        this._fetchNewToken();
+      } else {
+        // FUTURE: possibly handle other events, if necessary.
+      }//fi
+    });//œ
+  },
+  beforeDestroy: function (){
+    // Note: There isn't any documented way to tear down a `stripe` instance.
+    // Same thing for the `elements` instance.  Only individual "element" instances
+    // can be cleaned up after, using `.unmount()`.
+    this._element.unmount();
+  },
+  //  ╔═╗╦  ╦╔═╗╔╗╔╔╦╗╔═╗
+  //  ║╣ ╚╗╔╝║╣ ║║║ ║ ╚═╗
+  //  ╚═╝ ╚╝ ╚═╝╝╚╝ ╩ ╚═╝
+  methods: {
+    clickChangeExistingCard: function() {
+      this.existingCardData = undefined;
+      this.$emit('input', '');
+    },
+    // Public method for fetching a fresh token (e.g. if card is declined)
+    doGetNewToken: function() {
+      this.isSyncing = true;
+      this.$emit('update:busy', true);
+      this.isValidated = false;
+      this.$emit('input', '');
+      this._fetchNewToken();
+    },
+    _fetchNewToken: function() {
+      this._getStripeTokenFromCardElement(this._stripe, this._element)
+      .then((paymentSourceInfo)=>{
+        this.isSyncing = false;
+        this.$emit('update:busy', false);
+        this.isValidated = true;
+        this.$emit('input', paymentSourceInfo);
+      }).catch((err)=>{
+        this.isSyncing = false;
+        this.$emit('update:busy', false);
+        this.isValidated = false;
+        // This error is only relevant if something COMPLETELY unexpected goes wrong,
+        // in which case we want to actually know about that.
+        throw err;
+      });//_∏_
+    },
+    _getStripeTokenFromCardElement: function(stripeInstance, stripeElement) {
+      // Build a Promise & send it back as our "thenable" (AsyncFunction's return value).
+      // (this is necessary b/c we're wrapping an api that isn't `await`-compatible)
+      return new Promise((resolve, reject)=>{
+        try {
+          // Create a stripe token using the Stripe "element".
+          stripeInstance.createToken(stripeElement)
+          .then((result)=>{
+            // Silently ignore the case where the field is empty, or if there are
+            // card validation issues.
+            if(!result || result.error) {
+              resolve();
+              return;
+            }
+            // Send back the token & payment info.
+            resolve({
+              stripeToken: result.token.id,
+              billingCardBrand: result.token.card.brand,
+              billingCardLast4: result.token.card.last4,
+              billingCardExpMonth: result.token.card.exp_month,
+              billingCardExpYear: result.token.card.exp_year
+            });
+          });
+        } catch (err) {
+          console.error('Could not obtain Stripe token:', err);
+          reject(err);
+        }
+      });//_∏_
+    }
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/account/account-overview.page.js b/ee/bulk-operations-dashboard/assets/js/pages/account/account-overview.page.js
new file mode 100644
index 000000000000..44f5893d6a7a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/account/account-overview.page.js
@@ -0,0 +1,106 @@
+parasails.registerPage('account-overview', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    isBillingEnabled: false,
+
+    hasBillingCard: false,
+
+    // Syncing/loading states for this page.
+    syncingOpenCheckout: false,
+    syncingUpdateCard: false,
+    syncingRemoveCard: false,
+
+    // For <ajax-form>
+    formData: { /* … */ },
+    formRules: { /* … */ },
+    formErrors: { /* … */ },
+    cloudError: '',
+    syncing: '',
+
+    // For <modal>:
+    modal: '',
+
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function (){
+    _.extend(this, window.SAILS_LOCALS);
+
+    this.isBillingEnabled = !!this.stripePublishableKey;
+
+    // Determine whether there is billing info for this user.
+    this.me.hasBillingCard = (
+      this.me.billingCardBrand &&
+      this.me.billingCardLast4 &&
+      this.me.billingCardExpMonth &&
+      this.me.billingCardExpYear
+    );
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    clickUpdateBillingCardButton: function() {
+      this.modal = 'update-billing-card';
+      this.formData = { newPaymentSource: undefined };
+      this.formRules = { newPaymentSource: {required: true}};
+    },
+
+    closeModal: async function() {
+      // Dismiss modal
+      this.modal = '';
+      await this._resetForms();
+    },
+
+    handleSubmittingUpdateBillingCard: async function(argins) {
+      var newPaymentSource = argins.newPaymentSource;
+      await Cloud.updateBillingCard.with(newPaymentSource);
+    },
+
+    submittedUpdateBillingCard: async function() {
+      Object.assign(this.me, _.pick(this.formData.newPaymentSource, ['billingCardLast4', 'billingCardBrand', 'billingCardExpMonth', 'billingCardExpYear']));
+      this.me.hasBillingCard = true;
+
+      // Dismiss modal
+      this.modal = '';
+      await this._resetForms();
+    },
+
+    _resetForms: async function() {
+      this.cloudError = '';
+      this.formData = {};
+      this.formRules = {};
+      this.formErrors = {};
+      await this.forceRender();
+    },
+
+    clickRemoveCardButton: async function() {
+      this.modal = 'remove-billing-card';
+      this.formData.stripeToken = '';
+    },
+
+    submittedRemoveCardForm: async function() {
+
+      // Update billing info on success.
+      this.me.billingCardLast4 = undefined;
+      this.me.billingCardBrand = undefined;
+      this.me.billingCardExpMonth = undefined;
+      this.me.billingCardExpYear = undefined;
+      this.me.hasBillingCard = false;
+
+      // Close the modal and clear it out.
+      this.closeModal();
+
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/account/edit-password.page.js b/ee/bulk-operations-dashboard/assets/js/pages/account/edit-password.page.js
new file mode 100644
index 000000000000..c6a614e05829
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/account/edit-password.page.js
@@ -0,0 +1,50 @@
+parasails.registerPage('edit-password', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    // Main syncing/loading state for this page.
+    syncing: false,
+
+    // Form data
+    formData: { /* … */ },
+
+    // For tracking client-side validation errors in our form.
+    // > Has property set to `true` for each invalid property in `formData`.
+    formErrors: { /* … */ },
+
+    // Form rules
+    formRules: {
+      password: {required: true},
+      confirmPassword: {required: true, sameAs: 'password'},
+    },
+
+    // Server error state for the form
+    cloudError: '',
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    submittedForm: async function() {
+      // Redirect to a different web page on success.
+      // > (Note that we re-enable the syncing state here.  This is on purpose--
+      // > to make sure the spinner stays there until the page navigation finishes.)
+      this.syncing = true;
+      window.location = '/account';
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/account/edit-profile.page.js b/ee/bulk-operations-dashboard/assets/js/pages/account/edit-profile.page.js
new file mode 100644
index 000000000000..4a9ce71221e2
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/account/edit-profile.page.js
@@ -0,0 +1,52 @@
+parasails.registerPage('edit-profile', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    // Main syncing/loading state for this page.
+    syncing: false,
+
+    // Form data
+    formData: { /* … */ },
+
+    // For tracking client-side validation errors in our form.
+    // > Has property set to `true` for each invalid property in `formData`.
+    formErrors: { /* … */ },
+
+    // Form rules
+    formRules: {
+      fullName: {required: true},
+      emailAddress: {required: true, isEmail: true},
+    },
+
+    // Server error state for the form
+    cloudError: '',
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    // Set the form data.
+    this.formData.fullName = this.me.fullName;
+    this.formData.emailAddress = this.me.emailChangeCandidate ? this.me.emailChangeCandidate : this.me.emailAddress;
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    submittedForm: async function() {
+      // Redirect to the account page on success.
+      // > (Note that we re-enable the syncing state here.  This is on purpose--
+      // > to make sure the spinner stays there until the page navigation finishes.)
+      this.syncing = true;
+      window.location = '/account';
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/contact.page.js b/ee/bulk-operations-dashboard/assets/js/pages/contact.page.js
new file mode 100644
index 000000000000..035e53d7b51b
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/contact.page.js
@@ -0,0 +1,54 @@
+parasails.registerPage('contact', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    // Main syncing/loading state for this page.
+    syncing: false,
+
+    // Form data
+    formData: { /* … */ },
+
+    // For tracking client-side validation errors in our form.
+    // > Has property set to `true` for each invalid property in `formData`.
+    formErrors: { /* … */ },
+
+    // Form rules
+    formRules: {
+      emailAddress: {isEmail: true, required: true},
+      fullName: {required: true},
+      topic: {required: true},
+      message: {required: true},
+    },
+
+    // Server error state for the form
+    cloudError: '',
+
+    // Success state when form has been submitted
+    cloudSuccess: false,
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    submittedForm: async function() {
+
+      // Show the success message.
+      this.cloudSuccess = true;
+
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/dashboard/welcome.page.js b/ee/bulk-operations-dashboard/assets/js/pages/dashboard/welcome.page.js
new file mode 100644
index 000000000000..2cc39bedae6c
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/dashboard/welcome.page.js
@@ -0,0 +1,59 @@
+parasails.registerPage('welcome', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    modal: '',
+    pageLoadedAt: Date.now()
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦  ╦╦╦═╗╔╦╗╦ ╦╔═╗╦    ╔═╗╔═╗╔═╗╔═╗╔═╗
+  //  ╚╗╔╝║╠╦╝ ║ ║ ║╠═╣║    ╠═╝╠═╣║ ╦║╣ ╚═╗
+  //   ╚╝ ╩╩╚═ ╩ ╚═╝╩ ╩╩═╝  ╩  ╩ ╩╚═╝╚═╝╚═╝
+  // Configure deep-linking (aka client-side routing)
+  virtualPagesRegExp: /^\/welcome\/?([^\/]+)?\/?/,
+  afterNavigate: async function(virtualPageSlug){
+    // `virtualPageSlug` is determined by the regular expression above, which
+    // corresponds with `:unused?` in the server-side route for this page.
+    switch (virtualPageSlug) {
+      case 'hello':
+        this.modal = 'example';
+        break;
+      default:
+        this.modal = '';
+    }
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    clickOpenExampleModalButton: async function() {
+      this.goto('/welcome/hello');
+      // Or, without deep links, instead do:
+      // ```
+      // this.modal = 'example';
+      // ```
+    },
+
+    closeExampleModal: async function() {
+      this.goto('/welcome');
+      // Or, without deep links, instead do:
+      // ```
+      // this.modal = '';
+      // ```
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/entrance/confirmed-email.page.js b/ee/bulk-operations-dashboard/assets/js/pages/entrance/confirmed-email.page.js
new file mode 100644
index 000000000000..26fccd8b11f0
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/entrance/confirmed-email.page.js
@@ -0,0 +1,25 @@
+parasails.registerPage('confirmed-email', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    //…
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function(){
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+    //…
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/entrance/forgot-password.page.js b/ee/bulk-operations-dashboard/assets/js/pages/entrance/forgot-password.page.js
new file mode 100644
index 000000000000..124fc244da51
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/entrance/forgot-password.page.js
@@ -0,0 +1,49 @@
+parasails.registerPage('forgot-password', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    // Main syncing/loading state for this page.
+    syncing: false,
+
+    // Form data
+    formData: { /* … */ },
+
+    // For tracking client-side validation errors in our form.
+    // > Has property set to `true` for each invalid property in `formData`.
+    formErrors: { /* … */ },
+
+    // Form rules
+    formRules: {
+      emailAddress: {required: true, isEmail: true},
+    },
+
+    // Server error state for the form
+    cloudError: '',
+
+    // Success state when form has been submitted
+    cloudSuccess: false,
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    submittedForm: async function() {
+      // If it worked, show the success message.
+      this.cloudSuccess = true;
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/entrance/login.page.js b/ee/bulk-operations-dashboard/assets/js/pages/entrance/login.page.js
new file mode 100644
index 000000000000..5af59267d556
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/entrance/login.page.js
@@ -0,0 +1,53 @@
+parasails.registerPage('login', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    // Main syncing/loading state for this page.
+    syncing: false,
+
+    // Form data
+    formData: {
+      rememberMe: true,
+    },
+
+    // For tracking client-side validation errors in our form.
+    // > Has property set to `true` for each invalid property in `formData`.
+    formErrors: { /* … */ },
+
+    // A set of validation rules for our form.
+    // > The form will not be submitted if these are invalid.
+    formRules: {
+      emailAddress: { required: true, isEmail: true },
+      password: { required: true },
+    },
+
+    // Server error state for the form
+    cloudError: '',
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    submittedForm: async function() {
+      // Redirect to the logged-in dashboard on success.
+      // > (Note that we re-enable the syncing state here.  This is on purpose--
+      // > to make sure the spinner stays there until the page navigation finishes.)
+      this.syncing = true;
+      window.location = '/';
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/entrance/new-password.page.js b/ee/bulk-operations-dashboard/assets/js/pages/entrance/new-password.page.js
new file mode 100644
index 000000000000..6729c2492272
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/entrance/new-password.page.js
@@ -0,0 +1,52 @@
+parasails.registerPage('new-password', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    // Main syncing/loading state for this page.
+    syncing: false,
+
+    // Form data
+    formData: { /* … */ },
+
+    // For tracking client-side validation errors in our form.
+    // > Has property set to `true` for each invalid property in `formData`.
+    formErrors: { /* … */ },
+
+    // Form rules
+    formRules: {
+      password: {required: true},
+      confirmPassword: {required: true, sameAs: 'password'},
+    },
+
+    // Server error state for the form
+    cloudError: '',
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function() {
+
+    this.formData.token = this.token;
+
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    submittedForm: async function() {
+      // Redirect to the logged-in dashboard on success.
+      // > (Note that we re-enable the syncing state here.  This is on purpose--
+      // > to make sure the spinner stays there until the page navigation finishes.)
+      this.syncing = true;
+      window.location = '/';
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/entrance/signup.page.js b/ee/bulk-operations-dashboard/assets/js/pages/entrance/signup.page.js
new file mode 100644
index 000000000000..596b65721e2a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/entrance/signup.page.js
@@ -0,0 +1,62 @@
+parasails.registerPage('signup', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    // Form data
+    formData: { /* … */ },
+
+    // For tracking client-side validation errors in our form.
+    // > Has property set to `true` for each invalid property in `formData`.
+    formErrors: { /* … */ },
+
+    // Form rules
+    formRules: {
+      fullName: {required: true},
+      emailAddress: {required: true, isEmail: true},
+      password: {required: true},
+      confirmPassword: {required: true, sameAs: 'password'},
+      agreed: {required: true},
+    },
+
+    // Syncing / loading state
+    syncing: false,
+
+    // Server error state
+    cloudError: '',
+
+    // Success state when form has been submitted
+    cloudSuccess: false,
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    submittedForm: async function() {
+      if(this.isEmailVerificationRequired) {
+        // If email confirmation is enabled, show the success message.
+        this.cloudSuccess = true;
+      }
+      else {
+        // Otherwise, redirect to the logged-in dashboard.
+        // > (Note that we re-enable the syncing state here.  This is on purpose--
+        // > to make sure the spinner stays there until the page navigation finishes.)
+        this.syncing = true;
+        window.location = '/';
+      }
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/faq.page.js b/ee/bulk-operations-dashboard/assets/js/pages/faq.page.js
new file mode 100644
index 000000000000..900d131ecc3a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/faq.page.js
@@ -0,0 +1,25 @@
+parasails.registerPage('faq', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    //…
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function(){
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+    //…
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/homepage.page.js b/ee/bulk-operations-dashboard/assets/js/pages/homepage.page.js
new file mode 100644
index 000000000000..f94537e4aa0c
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/homepage.page.js
@@ -0,0 +1,42 @@
+parasails.registerPage('homepage', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    //…
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function(){
+    this._setHeroHeight();
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    clickHeroButton: async function() {
+      // Scroll to the 'get started' section:
+      $('html, body').animate({
+        scrollTop: this.$find('[purpose="scroll-destination"]').offset().top
+      }, 500);
+    },
+
+    // Private methods not tied to a particular DOM event are prefixed with _
+    _setHeroHeight: function() {
+      var $hero = this.$find('[purpose="full-page-hero"]');
+      var headerHeight = $('[purpose="page-header"]').outerHeight();
+      var heightToSet = $(window).height();
+      heightToSet = Math.max(heightToSet, 500);//« ensure min height of 500px - header height
+      heightToSet = Math.min(heightToSet, 1000);//« ensure max height of 1000px - header height
+      $hero.css('min-height', heightToSet - headerHeight+'px');
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/legal/privacy.page.js b/ee/bulk-operations-dashboard/assets/js/pages/legal/privacy.page.js
new file mode 100644
index 000000000000..00ae8d3b9461
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/legal/privacy.page.js
@@ -0,0 +1,25 @@
+parasails.registerPage('privacy', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    //…
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function(){
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+    //…
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/legal/terms.page.js b/ee/bulk-operations-dashboard/assets/js/pages/legal/terms.page.js
new file mode 100644
index 000000000000..6dfccb7fba56
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/legal/terms.page.js
@@ -0,0 +1,25 @@
+parasails.registerPage('terms', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    //…
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function(){
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+    //…
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/profiles.page.js b/ee/bulk-operations-dashboard/assets/js/pages/profiles.page.js
new file mode 100644
index 000000000000..b3a6aa1ee034
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/profiles.page.js
@@ -0,0 +1,128 @@
+parasails.registerPage('profiles', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    sortDirection: 'ASC',
+    teamFilter: undefined,
+    profilesToDisplay: [],
+    platformFriendlyNames: {
+      'darwin': 'macOS, iOS, ipadOS',
+      'windows': 'Windows',
+      'linux': 'Linux'
+    },
+    selectedTeam: {},
+    modal: '',
+    syncing: false,
+    formData: {},
+    formErrors: {},
+    addProfileFormRules: {
+      newProfile: {required: true}
+    },
+    editProfileFormRules: {},
+    profileToEdit: {},
+    cloudError: '',
+    newProfile: undefined,
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    this.profilesToDisplay = this.profiles;
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+    clickChangeSortDirection: async function() {
+      if(this.sortDirection === 'ASC') {
+        this.sortDirection = 'DESC';
+        this.profilesToDisplay = _.sortByOrder(this.profiles, 'name', 'desc');
+      } else {
+        this.sortDirection = 'ASC';
+        this.profilesToDisplay = _.sortByOrder(this.profiles, 'name', 'asc');
+      }
+      await this.forceRender();
+    },
+    changeTeamFilter: async function() {// Used by the team picker dropdown.
+      if(this.teamFilter !== undefined){
+        this.selectedTeam = _.find(this.teams, {fleetApid: this.teamFilter});
+        let profilesOnThisTeam = _.filter(this.profiles, (profile)=>{
+          // console.log(profile.profiles);
+          return profile.teams && _.where(profile.teams, {'fleetApid': this.selectedTeam.fleetApid}).length > 0;
+        });
+        this.profilesToDisplay = profilesOnThisTeam;
+      } else {
+        this.profilesToDisplay = this.profiles;
+      }
+    },
+    clickChangeTeamFilter: async function(teamApid) {// Used by the tooltip links.
+      this.teamFilter = teamApid;
+      this.selectedTeam = _.find(this.teams, {'fleetApid': teamApid});
+      let profilesOnThisTeam = _.filter(this.profiles, (profile)=>{
+        return profile.teams && _.where(profile.teams, {'fleetApid': this.selectedTeam.fleetApid}).length > 0;
+      });
+      this.profilesToDisplay = profilesOnThisTeam;
+    },
+    clickDownloadProfile: async function(profile) {
+      if(!profile.teams){
+        window.open('/download-profile?id='+encodeURIComponent(profile.id));
+      } else {
+        window.open('/download-profile?uuid='+encodeURIComponent(profile.teams[0].uuid));
+      }
+    },
+    clickOpenEditModal: async function(profile) {
+      this.profileToEdit = _.clone(profile);
+      this.formData.newTeamIds = _.pluck(this.profileToEdit.teams, 'fleetApid');
+      this.formData.profile = profile;
+      this.modal = 'edit-profile';
+    },
+    clickOpenDeleteModal: async function(profile) {
+      this.formData.profile = _.clone(profile);
+      this.modal = 'delete-profile';
+    },
+    clickOpenAddProfileModal: async function() {
+      this.modal = 'add-profile';
+    },
+    closeModal: async function() {
+      this.modal = '';
+      this.formErrors = {};
+      this.formData = {};
+      await this.forceRender();
+    },
+    submittedForm: async function() {
+      this.syncing = false;
+      this.closeModal();
+    },
+    handleSubmittingDeleteProfileForm: async function() {
+      let argins = _.clone(this.formData);
+      await Cloud.deleteProfile.with({profile: argins.profile});
+      await this._getProfiles();
+    },
+    handleSubmittingAddProfileForm: async function() {
+      let argins = _.clone(this.formData);
+      await Cloud.uploadProfile.with({newProfile: argins.newProfile, teams: argins.teams});
+      await this._getProfiles();
+    },
+    handleSubmittingEditProfileForm: async function() {
+      let argins = _.clone(this.formData);
+      if(argins.newTeamIds === [undefined]){
+        argins.newTeamIds = [];
+      }
+      await Cloud.editProfile.with({profile: argins.profile, newProfile: argins.newProfile, newTeamIds: argins.newTeamIds});
+      await this._getProfiles();
+    },
+    _getProfiles: async function() {
+      this.syncing = true;
+      let newProfilesInformation = await Cloud.getProfiles();
+      this.profiles = newProfilesInformation;
+      this.syncing = false;
+      await this.changeTeamFilter();
+    }
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/scripts.page.js b/ee/bulk-operations-dashboard/assets/js/pages/scripts.page.js
new file mode 100644
index 000000000000..d7fb575946a7
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/scripts.page.js
@@ -0,0 +1,120 @@
+parasails.registerPage('scripts', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    sortDirection: 'ASC',
+    teamFilter: undefined,
+    scriptsToDisplay: [],
+    platformFriendlyNames: {
+      'darwin': 'macOS, iOS, ipadOS',
+      'windows': 'Windows',
+      'linux': 'Linux'
+    },
+    selectedTeam: {},
+    modal: '',
+    syncing: false,
+    formData: {},
+    formErrors: {},
+    addScriptFormRules: {
+      newScript: {required: true},
+    },
+    editScriptFormRules: {},
+    profileToEdit: {},
+    cloudError: '',
+    newScript: undefined,
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function() {
+    this.scriptsToDisplay = this.scripts;
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+    clickChangeSortDirection: async function() {
+      if(this.sortDirection === 'ASC') {
+        this.sortDirection = 'DESC';
+        this.scriptsToDisplay = _.sortByOrder(this.scripts, 'name', 'desc');
+      } else {
+        this.sortDirection = 'ASC';
+        this.scriptsToDisplay = _.sortByOrder(this.scripts, 'name', 'asc');
+      }
+      await this.forceRender();
+    },
+    changeTeamFilter: async function() {
+      if(this.teamFilter !== undefined){
+        this.selectedTeam = _.find(this.teams, {fleetApid: this.teamFilter});
+        let scriptsOnThisTeam = _.filter(this.scripts, (script)=>{
+          return _.where(script.teams, {'fleetApid': this.selectedTeam.fleetApid}).length > 0;
+        });
+        this.scriptsToDisplay = scriptsOnThisTeam;
+      } else {
+        this.scriptsToDisplay = this.scripts;
+      }
+    },
+    clickChangeTeamFilter: async function(teamApid) {
+      this.teamFilter = teamApid;
+      this.selectedTeam = _.find(this.teams, {'fleetApid': teamApid});
+      let scriptsOnThisTeam = _.filter(this.scripts, (script)=>{
+        return _.where(script.teams, {'fleetApid': this.selectedTeam.fleetApid}).length > 0;
+      });
+      this.scriptsToDisplay = scriptsOnThisTeam;
+    },
+    clickDownloadScript: async function(script) {
+      if(!script.teams){
+        window.open('/download-script?id='+encodeURIComponent(script.id));
+      } else {
+        window.open('/download-script?fleetApid='+encodeURIComponent(script.teams[0].scriptFleetApid));
+      }
+    },
+    clickOpenEditModal: async function(script) {
+      this.scriptToEdit = _.clone(script);
+      this.formData.newTeamIds = _.pluck(this.scriptToEdit.teams, 'fleetApid');
+      this.formData.script = script;
+      this.modal = 'edit-script';
+    },
+    clickOpenDeleteModal: async function(script) {
+      this.formData.script = _.clone(script);
+      this.modal = 'delete-script';
+    },
+    clickOpenAddScriptModal: async function() {
+      this.modal = 'add-script';
+    },
+    closeModal: async function() {
+      this.modal = '';
+      this.formErrors = {};
+      this.formData = {};
+      await this.forceRender();
+    },
+    submittedForm: async function() {
+      await this._getScripts();
+      this.syncing = false;
+      this.closeModal();
+    },
+    handleSubmittingDeleteScriptForm: async function() {
+      let argins = _.clone(this.formData);
+      await Cloud.deleteScript.with({script: argins.script});
+      await this._getScripts();
+    },
+    handleSubmittingAddScriptForm: async function() {
+      let argins = _.clone(this.formData);
+      await Cloud.uploadScript.with({newScript: argins.newScript, teams: argins.teams});
+      await this._getScripts();
+    },
+    _getScripts: async function() {
+      this.syncing = true;
+      let newScriptsInformation = await Cloud.getScripts();
+      this.scripts = newScriptsInformation;
+      this.syncing = false;
+      await this.changeTeamFilter();
+    }
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/utilities/get-mimetype-icon-class.js b/ee/bulk-operations-dashboard/assets/js/utilities/get-mimetype-icon-class.js
new file mode 100644
index 000000000000..b8c937fe8ead
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/utilities/get-mimetype-icon-class.js
@@ -0,0 +1,72 @@
+/**
+ * getMimetypeIconClass()
+ *
+ * -----------------------------------------------------------------
+ * @returns {String} the icon-bestowing class name for given MIME type
+ */
+
+parasails.registerUtility('getMimetypeIconClass', function getMimetypeIconClass(mimeType) {
+
+  var iconClassName;
+  switch(mimeType) {
+    case 'application/pdf':
+      iconClassName = 'fa fa-file-pdf-o';
+      break;
+    case 'image/png':
+    case 'image/jpeg':
+    case 'image/gif':
+    case 'application/icon':
+    case 'image/svg+xml':
+    case 'image/tiff':
+      iconClassName = 'fa fa-file-image-o';
+      break;
+    case 'application/zip':
+    case 'application/x-7z-compressed':
+    case 'application/x-rar-compressed':
+    case 'application/x-tar':
+    case 'application/x-bzip':
+    case 'application/x-bzip2':
+    case 'application/octet-stream':
+      iconClassName = 'fa fa-file-archive-o';
+      break;
+    case 'text/csv':
+    case 'application/vnd.ms-excel':
+    case 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet':
+    case 'application/vnd.oasis.opendocument.spreadsheet':
+      iconClassName = 'fa fa-file-excel-o';
+      break;
+    case 'application/msword':
+    case 'application/vnd.openxmlformats-officedocument.wordprocessingml.document':
+    case 'application/vnd.oasis.opendocument.text':
+    case 'application/rtf':
+      iconClassName = 'fa fa-file-word-o';
+      break;
+    case 'application/vnd.ms-powerpoint':
+    case 'application/vnd.openxmlformats-officedocument.presentationml.presentation':
+    case 'application/vnd.oasis.opendocument.presentation':
+      iconClassName = 'fa fa-file-powerpoint-o';
+      break;
+    case 'application/vnd.ms-outlook':
+      iconClassName = 'fa fa-envelope-o';
+      break;
+    case 'text/plain':
+      iconClassName = 'fa fa-file-text-o';
+      break;
+    default:
+      if(mimeType && mimeType.match(/^image/)) {
+        iconClassName = 'fa fa-file-image-o';
+      } else if(mimeType && mimeType.match(/^video/)) {
+        iconClassName = 'fa fa-file-video-o';
+      } else if(mimeType && mimeType.match(/^audio/)) {
+        iconClassName = 'fa fa-file-audio-o';
+      } else if(mimeType && mimeType.match(/^text/)) {
+        iconClassName = 'fa fa-file-text-o';
+      } else {
+        iconClassName = 'fa fa-file-o';
+      }
+      break;
+  }
+
+  return iconClassName;
+
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/utilities/open-stripe-checkout.js b/ee/bulk-operations-dashboard/assets/js/utilities/open-stripe-checkout.js
new file mode 100644
index 000000000000..3929fa38d384
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/utilities/open-stripe-checkout.js
@@ -0,0 +1,98 @@
+/**
+ * openStripeCheckout()
+ *
+ * Open the Stripe Checkout modal dialog and resolve when it is closed.
+ *
+ * -----------------------------------------------------------------
+ * @param {String} stripePublishableKey
+ * @param {String} billingEmailAddress
+ * @param {String} headingText (optional)
+ * @param {String} descriptionText (optional)
+ * @param {String} buttonText (optional)
+ * -----------------------------------------------------------------
+ * @returns {Dictionary?}  (or undefined if the form was cancelled)
+ *          e.g.
+ *          {
+ *            stripeToken: '…',
+ *            billingCardLast4: '…',
+ *            billingCardBrand: '…',
+ *            billingCardExpMonth: '…',
+ *            billingCardExpYear: '…'
+ *          }
+ * -----------------------------------------------------------------
+ * Example usage:
+ * ```
+ * var billingInfo = await openStripeCheckout(
+ *   'pk_test_Qz5RfDmVV5IunTFAHtDqDWn4',
+ *   'foo@example.com'
+ * );
+ * ```
+ */
+
+parasails.registerUtility('openStripeCheckout', async function openStripeCheckout(stripePublishableKey, billingEmailAddress, headingText, descriptionText, buttonText) {
+
+  // Cache (& use cached) "checkout handler" globally on the page so that we
+  // don't end up configuring it more than once (i.e. so Stripe.js doesn't
+  // complain).
+  var CACHE_KEY = '_cachedStripeCheckoutHandler';
+  if (!window[CACHE_KEY]) {
+    window[CACHE_KEY] = StripeCheckout.configure({
+      key: stripePublishableKey,
+    });
+  }
+  var checkoutHandler = window[CACHE_KEY];
+
+  // Track whether the "token" callback was triggered.
+  // (If it has NOT at the time the "closed" callback is triggered, then we
+  // know the checkout form was cancelled.)
+  var hasTriggeredTokenCallback;
+
+  // Build a Promise & send it back as our "thenable" (AsyncFunction's return value).
+  // (this is necessary b/c we're wrapping an api that isn't `await`-compatible)
+  return new Promise((resolve, reject)=>{
+    try {
+      // Open Stripe checkout.
+      // (https://stripe.com/docs/checkout#integration-custom)
+      checkoutHandler.open({
+        name: headingText || 'NEW_APP_NAME',
+        description: descriptionText || 'Link your credit card.',
+        panelLabel: buttonText || 'Save card',
+        email: billingEmailAddress,//« So that Stripe doesn't prompt for an email address
+        locale: 'auto',
+        zipCode: false,
+        allowRememberMe: false,
+        closed: ()=>{
+          // If the Checkout dialog was cancelled, resolve undefined.
+          if (!hasTriggeredTokenCallback) {
+            resolve();
+          }
+        },
+        token: (stripeData)=>{
+
+          // After payment info has been successfully added, and a token
+          // was obtained...
+          hasTriggeredTokenCallback = true;
+
+          // Normalize token and billing card info from Stripe and resolve
+          // with that.
+          let stripeToken = stripeData.id;
+          let billingCardLast4 = stripeData.card.last4;
+          let billingCardBrand = stripeData.card.brand;
+          let billingCardExpMonth = String(stripeData.card.exp_month);
+          let billingCardExpYear = String(stripeData.card.exp_year);
+
+          resolve({
+            stripeToken,
+            billingCardLast4,
+            billingCardBrand,
+            billingCardExpMonth,
+            billingCardExpYear
+          });
+        }//Œ
+      });//_∏_
+    } catch (err) {
+      reject(err);
+    }
+  });//_∏_
+
+});
diff --git a/ee/bulk-operations-dashboard/assets/styles/bootstrap-overrides.less b/ee/bulk-operations-dashboard/assets/styles/bootstrap-overrides.less
new file mode 100644
index 000000000000..02681de50f46
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/bootstrap-overrides.less
@@ -0,0 +1,37 @@
+/**
+ * This file is for overriding some default bootstrap styles.
+ *
+ * > NOTE THAT THIS FILE AFFECTS GLOBAL STYLES.
+ */
+
+// lesshint-disable
+* {
+  box-sizing: border-box;
+}
+// lesshint-enable
+
+img {
+  display: block;
+}
+
+// Get rid of weird background on <a>s with button styles
+.btn, [type='button'] {
+  -webkit-appearance: none;
+}
+
+// Custom link styles within bodies of text
+h1, h2, h3, h4, h5, h6, p, li, blockquote, label {
+  >a:not(.btn), small >a:not(.btn) {
+    color: @brand;
+    border-bottom: 1px solid @text-normal;
+    &:hover {
+      text-decoration: none;
+      color: @text-normal;
+    }
+  }
+}
+
+blockquote {
+  border-left: 3px solid @border-lt-gray;
+  padding-left: 20px;
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/components/ajax-button.component.less b/ee/bulk-operations-dashboard/assets/styles/components/ajax-button.component.less
new file mode 100644
index 000000000000..c1a655f39b17
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/components/ajax-button.component.less
@@ -0,0 +1,41 @@
+
+/**
+ * <ajax-button>
+ *
+ * App-wide styles for our ajax buttons.
+ */
+
+ [parasails-component='ajax-button'] {
+   .button-loader, .button-loading {
+     display: none;
+     margin: auto;
+     .loading-dot {
+       opacity: 0;
+       display: inline;
+       .fade-in();
+       .animation-duration(1s);
+       .animation-iteration-count(infinite);
+       .animation-direction(linear);
+       &.dot1 {
+         .animation-delay(0.25s);
+       }
+       &.dot2 {
+         .animation-delay(0.5s);
+       }
+       &.dot3 {
+         .animation-delay(0.75s);
+       }
+       &.dot4 {
+         .animation-delay(1s);
+       }
+     }
+   }
+   &.syncing {
+     .button-loader, .button-loading {
+       display: inline-block;
+     }
+     .button-text {
+       display: none;
+     }
+   }
+ }
diff --git a/ee/bulk-operations-dashboard/assets/styles/components/cloud-error.component.less b/ee/bulk-operations-dashboard/assets/styles/components/cloud-error.component.less
new file mode 100644
index 000000000000..c652c2691549
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/components/cloud-error.component.less
@@ -0,0 +1,9 @@
+/**
+ * <cloud-error>
+ *
+ * App-wide styles for our cloud-errors.
+ */
+
+[parasails-component='cloud-error'] {
+  // ...
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/components/file-upload.component.less b/ee/bulk-operations-dashboard/assets/styles/components/file-upload.component.less
new file mode 100644
index 000000000000..d2ab27513404
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/components/file-upload.component.less
@@ -0,0 +1,88 @@
+/**
+ * <file-upload>
+ */
+
+[parasails-component='file-upload'] {
+  @min-desired-image-preview-height: 280px;//« e.g. ~100px for a logo, ~280px for a headshot, etc.
+
+  position: relative;
+  .btn-and-tips-if-relevant {
+    min-width: 200px;
+    .file-upload-button {
+      position: relative;
+      cursor: pointer;
+      margin-bottom: 10px;
+      .button-text {
+        padding-top: 2px;
+      }
+      .file-input {
+        position: absolute;
+        top: 0px;
+        left: 0px;
+        height: 100%;
+        width: 100%;
+        cursor: pointer;
+        opacity: 0;
+      }
+    }
+    p {
+      margin-top: 10px;
+    }
+  }
+
+
+  &.file-mode {
+    .btn-and-tips-if-relevant {
+      display: inline-block;
+      min-width: 0;
+    }
+    .file-metadata-preview {
+      padding-right: 30px;
+      .selected-file-name {
+        font-weight: bold;
+      }
+      .selected-file-size {
+        color: @text-muted;
+      }
+    }
+  }
+
+  &.disabled {
+    .btn-and-tips-if-relevant {
+      .file-upload-button {
+        cursor: default;
+        border-color: @border-lt-gray;
+        color: @border-lt-gray;
+        &:hover {
+          cursor: default;
+          background-color: transparent;
+          border-color: @border-lt-gray;
+          color: @border-lt-gray;
+          .button-text, .file-input {
+            cursor: default;
+          }
+        }
+      }
+    }
+  }
+
+  @media screen and (max-width: 767px) {
+    padding-left: 0px;
+    .image-preview {
+      position: static;
+      .image-preview-field {
+        margin-left: auto;
+        margin-right: auto;
+      }
+    }
+    .btn-and-tips-if-relevant {
+      width: 100%;
+      margin-top: 25px;
+      max-width: 400px;
+      margin-left: auto;
+      margin-right: auto;
+      text-align: center;
+    }
+  }
+}
+
diff --git a/ee/bulk-operations-dashboard/assets/styles/components/modal.component.less b/ee/bulk-operations-dashboard/assets/styles/components/modal.component.less
new file mode 100644
index 000000000000..964e1b1808fa
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/components/modal.component.less
@@ -0,0 +1,95 @@
+/**
+ * <modal>
+ *
+ * App-wide styles for our modals.
+ */
+
+[parasails-component='modal'] {
+  -webkit-overflow-scrolling: touch;//« makes this actually scrollable on certain phones
+  [purpose='modal-dialog'] {
+    z-index: 100;
+    position: relative;
+    max-width: 700px;
+    [purpose='modal-content'] {
+      max-width: 650px;
+      [purpose='modal-close-button'] {
+        .btn-reset();
+        opacity: 0.6;
+        &:hover {
+          opacity: 1;
+        }
+      }
+    }
+  }
+  // Custom styles for the Bootstrap modal:
+  // (Want to use Bootstrap's default styles? Just comment out the rest of the rules below)
+  .petticoat {
+    display: none;// 2022-12-11: mikermcneil: This is appearing as a dark aberration after changing up the modal so I'm hiding it
+    position: fixed;
+    width: 100%;
+    height: 75px;// should cover topbar
+    z-index: 50;
+    left: 0px;
+    top: 0px;
+    background-color: #192147;
+    opacity: 0.35;
+  }
+  .modal-content {
+    border-radius: 8px;
+    border: 1px solid #B3B6C1;
+    background: #FFF;
+    box-shadow: 0px 4px 16px 0px rgba(25, 33, 71, 0.25);
+
+    /* elevation/modal */
+    padding: 32px;
+    .modal-header {
+      border-bottom: none;
+      display: block;
+      position: relative;
+      text-align: center;
+      padding-bottom: 0px;
+      padding-left: 0px;
+      padding-right: 0px;
+      padding-top: 0px;
+      .modal-title {
+        font-weight: @bold;
+      }
+      .modal-intro {
+        margin-left: auto;
+        margin-right: auto;
+        color: @text-muted;
+        margin-bottom: 20px;
+      }
+      hr {
+        margin-top: 25px;
+        margin-left: auto;
+        margin-right: auto;
+        margin-bottom: 10px;
+        width: 100px;
+        height: 2px;
+        border-top: 2px solid @brand;
+      }
+    }
+    .modal-body {
+      padding-top: 10px;
+      padding-bottom: 10px;
+      padding-left: 0px;
+      padding-right: 0px;
+    }
+    .modal-footer {
+      padding-top: 25px;
+      padding-bottom: 0px;
+      padding-left: 0px;
+      padding-right: 0px;
+      margin-top: 10px;
+    }
+  }
+}
+
+// Modal backdrop styles are exposed globally here because this gets appended to the <body>
+.modal-backdrop {
+  background-color: #192147;
+  &.show {
+    opacity: 0.35;
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/components/multifield.component.less b/ee/bulk-operations-dashboard/assets/styles/components/multifield.component.less
new file mode 100644
index 000000000000..7380ee05bfe1
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/components/multifield.component.less
@@ -0,0 +1,71 @@
+/**
+ * <multifield>
+ *
+ * App-wide styles for our multifields.
+ */
+
+[parasails-component='multifield'] {
+  .multifield-item {
+    position: relative;
+    padding-right: 30px;
+    margin-top: 15px;
+    margin-bottom: 15px;
+    &:first-child {
+      margin-top: 0px;
+    }
+    .multifield-item-label {
+      position: absolute;
+      left: 0px;
+      top: 0px;
+      line-height: 38px;
+      vertical-align: middle;
+      color: @text-muted;
+    }
+    .multifield-item-remove-button {
+      .btn-reset();
+      .transition(all 250ms);
+      position: absolute;
+      right: 0px;
+      top: 7px;
+      line-height: 24px;
+      padding-top: 0;
+      padding-bottom: 0;
+      padding-left: 10px;
+      padding-right: 10px;
+      background-image: url('/images/trash-16x16@2x.png');
+      background-repeat: no-repeat;
+      background-position: right center;
+      background-size: 16px 16px;
+      width: 20px;
+      height: 20px;
+      font-size: 14px;
+      color: #515774;
+      opacity: 1;
+      &:hover {
+        opacity: 1;
+        color: @text-normal;
+      }
+    }
+    input {
+      width: 100%;
+      height: 40px;
+      padding: 0px 12px;
+      border: 1px solid #E2E4EA;
+      border-radius: 4px;
+    }
+    select {
+      width: 100%;
+      height: 40px;
+      border: 1px solid #E2E4EA;
+      border-radius: 4px;
+    }
+  }
+  .is-invalid:focus-visible {
+    outline: red auto 1px;
+  }
+ .add-button-wrapper {
+    justify-content: flex-end;
+    color: #6A67FE;
+    cursor: pointer;
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/components/stripe-card-element.component.less b/ee/bulk-operations-dashboard/assets/styles/components/stripe-card-element.component.less
new file mode 100644
index 000000000000..507e90afcec1
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/components/stripe-card-element.component.less
@@ -0,0 +1,65 @@
+/**
+ * <stripe-card-element>
+ */
+[parasails-component='stripe-card-element'] {
+  .card-element-wrapper {
+    position: relative;
+    .card-element {
+      padding-top: 0;
+      padding-bottom: 0;
+      padding-right: 30px;
+      &.pseudofocused {
+        // These should mimic your normal form inputs' :focus styles:
+        border-color: #80bdff;
+        outline: 0;
+        box-shadow: 0 0 0 0.2rem rgba(0, 123, 255, 0.25);
+      }
+    }
+    .status-indicator {
+      font-size: 15px;
+      position: absolute;
+      right: 14px;
+      top: 8px;
+      &.hidden {
+        display: none;
+      }
+      &.syncing {
+        -webkit-animation: fa-spinner-rotate 1.5s infinite linear;
+        animation: fa-spinner-rotate 1.5s infinite linear;
+        @-webkit-keyframes fa-spinner-rotate {
+          0% {
+            -webkit-transform: rotate(0deg);
+          }
+          100% {
+            -webkit-transform: rotate(360deg);
+          }
+        }
+        @keyframes rotate-clockwise {
+          0% {
+            -ms-transform: rotate(0deg);
+            transform: rotate(0deg);
+          }
+          100% {
+            -ms-transform: rotate(360deg);
+            transform: rotate(360deg);
+          }
+        }
+      }
+    }
+    &.secret-card-element-wrapper {
+      opacity: 0;
+      height: 1px;
+    }
+  }
+
+  @media screen and (max-width: 450px) {
+    .card-element-wrapper {
+      .card-element {
+        padding-right: 20px;
+      }
+      .status-indicator {
+        right: 9px;
+      }
+    }
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/importer.less b/ee/bulk-operations-dashboard/assets/styles/importer.less
new file mode 100644
index 000000000000..2b812422ffe9
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/importer.less
@@ -0,0 +1,41 @@
+/**
+ * importer.less
+ *
+ * By default, new Sails projects are configured to compile this file
+ * from LESS to CSS.  Unlike CSS files, LESS files are not compiled and
+ * included automatically unless they are imported below.
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/assets/styles/importer-less
+ */
+
+// Mixins and variables  (LESS mixins/variables only, no global selectors)
+@import 'mixins-and-variables/index.less';
+
+// Overall layout  (contains global selectors)
+@import 'bootstrap-overrides.less';
+@import 'layout.less';
+
+// Per-component styles
+@import 'components/stripe-card-element.component.less';
+@import 'components/ajax-button.component.less';
+@import 'components/modal.component.less';
+@import 'components/cloud-error.component.less';
+@import 'components/multifield.component.less';
+@import 'components/file-upload.component.less';
+
+// Per-page styles
+@import 'pages/scripts.less';
+@import 'pages/profiles.less';
+@import 'pages/entrance/confirmed-email.less';
+@import 'pages/entrance/login.less';
+@import 'pages/entrance/forgot-password.less';
+@import 'pages/entrance/new-password.less';
+@import 'pages/account/account-overview.less';
+@import 'pages/account/edit-password.less';
+@import 'pages/account/edit-profile.less';
+@import 'pages/legal/terms.less';
+@import 'pages/legal/privacy.less';
+@import 'pages/404.less';
+@import 'pages/500.less';
+@import 'pages/498.less';
diff --git a/ee/bulk-operations-dashboard/assets/styles/layout.less b/ee/bulk-operations-dashboard/assets/styles/layout.less
new file mode 100644
index 000000000000..6744269ef7ce
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/layout.less
@@ -0,0 +1,86 @@
+@footer-height: 40px;
+@container-md-max-width: 1100px;
+
+[v-cloak] { display: none; }
+
+html, body {
+  height: 100%;
+  margin: 0;
+}
+[purpose='page-header'] {
+  background-color: #fff;
+  height: 60px;
+  border-bottom: 1px solid #c4ccd2;
+  .nav-link {
+    color: #292b2d;
+    font-weight: bold;
+    font-size: 14px;
+  }
+  .dropdown-item:hover {
+    background-color: unset;
+    color: #6a67fe;
+  }
+  button {
+    color: #292b2d;
+    font-weight: bold;
+    font-size: 14px;
+    background: none;
+    border: none;
+    &:focus {
+      outline: none;
+    }
+  }
+}
+[purpose='page-wrap'] {
+  height: 100%;
+  /* lesshint-disable */height: auto !important;/* lesshint-enable */
+  // ^^The above is to disable "importantRule" and "duplicateProperty" rules.
+  min-height: 100%;
+  position: relative;
+  padding-bottom: @footer-height;
+  color: #292b2d;
+  a {
+    color: #007697;
+  }
+}
+
+[purpose='page-footer'] {
+  border-top: 1px solid rgba(0, 0, 0, 0.1);
+  height: @footer-height;
+  width: 100%;
+  position: absolute;
+  left: 0px;
+  bottom: 0px;
+}
+
+body.detected-mobile {
+  // Above and beyond the media queries below, this selector (which relies on
+  // `parasails` automatically attaching this class, if appropriate) contains
+  // styles intended to be activated specifically when loaded from a recognized
+  // mobile device, regardless of viewport dimensions.  This includes tablet
+  // devices (like the iPad) as well as handset devices (like the iPhone).
+  // …
+}
+
+@media (max-width: 800px) {
+  [purpose='page-wrap'] {
+    padding-bottom: 75px;
+    [purpose='page-footer'] {
+      height: 75px;
+      [purpose='footer-copy'], [purpose='footer-nav'] {
+        width: 100%;
+        display: block;
+        text-align: center;
+      }
+    }
+  }
+}
+
+@media (max-width: 575px) {
+  [purpose='page-wrap'] {
+    padding-bottom: 100px;
+    [purpose='page-footer'] {
+      height: 100px;
+    }
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/animations.less b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/animations.less
new file mode 100644
index 000000000000..7b25a53556c0
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/animations.less
@@ -0,0 +1,270 @@
+.animation-delay(@delay) {
+  -moz-animation-delay: @delay;
+  -webkit-animation-delay: @delay;
+  -ms-animation-delay: @delay;
+  -o-animation-delay: @delay;
+  animation-delay: @delay;
+}
+
+.animation-name(@name) {
+  -moz-animation-name: @name;
+  -webkit-animation-name: @name;
+  -ms-animation-name: @name;
+  -o-animation-name: @name;
+  animation-name: @name;
+}
+
+.animation-duration(@duration) {
+  -moz-animation-duration: @duration;
+  -webkit-animation-duration: @duration;
+  -ms-animation-duration: @duration;
+  -o-animation-duration: @duration;
+  animation-duration: @duration;
+}
+
+.animation-iteration-count(@iteration-count) {
+  -moz-animation-iteration-count: @iteration-count;
+  -webkit-animation-iteration-count: @iteration-count;
+  -ms-animation-iteration-count: @iteration-count;
+  -o-animation-iteration-count: @iteration-count;
+  animation-iteration-count: @iteration-count;
+}
+
+.animation-direction(@direction) {
+  -moz-animation-direction: @direction;
+  -webkit-animation-direction: @direction;
+  -ms-animation-direction: @direction;
+  -o-animation-direction: @direction;
+  animation-direction: @direction;
+}
+
+.animation-timing-function(@timingFunction) {
+  -moz-animation-timing-function: @timingFunction;
+  -webkit-animation-timing-function: @timingFunction;
+  -ms-animation-timing-function: @timingFunction;
+   -o-animation-timing-function: @timingFunction;
+  animation-timing-function: @timingFunction;
+}
+
+.transition (@transition) {
+  -webkit-transition: @transition;
+  -moz-transition   : @transition;
+  -ms-transition    : @transition;
+  -o-transition     : @transition;
+}
+
+.translate (@x, @y:0) {
+  -webkit-transform: translate(@x, @y);
+  -moz-transform   : translate(@x, @y);
+  -ms-transform    : translate(@x, @y);
+  -o-transform     : translate(@x, @y);
+  transform        : translate(@x, @y);
+}
+
+//Animations
+.fade-in() {
+  .animation-name(fade-in);
+
+  @-webkit-keyframes fade-in {
+    0%    {opacity: 0;}// lesshint spaceBeforeBrace: false
+    100%  {opacity: 1;}// lesshint spaceBeforeBrace: false
+  }
+
+  @-moz-keyframes fade-in {
+    0%    {opacity: 0;}// lesshint spaceBeforeBrace: false
+    100%  {opacity: 1;}// lesshint spaceBeforeBrace: false
+  }
+
+  @-o-keyframes fade-in {
+    0%    {opacity: 0;}// lesshint spaceBeforeBrace: false
+    100%  {opacity: 1;}// lesshint spaceBeforeBrace: false
+  }
+
+  @keyframes fade-in {
+    0%    {opacity: 0;}// lesshint spaceBeforeBrace: false
+    100%  {opacity: 1;}// lesshint spaceBeforeBrace: false
+  }
+}
+
+.loader(@dot-color: @accent-white) {
+  display: inline-block;
+  margin: auto;
+
+  .loading-dot {
+    border-radius: 50%;
+    background-color: @dot-color;
+    float: left;
+    opacity: 0;
+    width: 16px;
+    height: 16px;
+    margin: 5px;
+    .fade-in();
+    .animation-duration(1s);
+    .animation-iteration-count(infinite);
+    .animation-direction(linear);
+
+    &.dot1 {
+      .animation-delay(0.25s);
+    }
+
+    &.dot2 {
+      .animation-delay(0.5s);
+    }
+
+    &.dot3 {
+      .animation-delay(0.75s);
+    }
+
+    &.dot4 {
+      .animation-delay(1s);
+    }
+  }
+}
+
+// Special rotation animation for a font awesome-based spinner:
+.fa-spinner-rotation() {
+  -webkit-animation: fa-spinner-rotate 1.5s infinite linear;
+  animation: fa-spinner-rotate 1.5s infinite linear;
+
+  @-webkit-keyframes fa-spinner-rotate {
+    0% {
+      -webkit-transform: rotate(0deg);
+    }
+    100% {
+      -webkit-transform: rotate(360deg);
+    }
+  }
+
+  @keyframes rotate-clockwise {
+    0% {
+      -ms-transform: rotate(0deg);
+      transform: rotate(0deg);
+    }
+    100% {
+      -ms-transform: rotate(360deg);
+      transform: rotate(360deg);
+    }
+  }
+}
+
+.skid() {
+  .animation-name(skid);
+  .animation-duration(2.5s);
+  .animation-iteration-count(infinite);
+  .animation-timing-function(linear);
+  @-webkit-keyframes skid {
+    0%   {-webkit-transform: translate(0px, 0px);}// lesshint spaceBeforeBrace: false
+    10%  {-webkit-transform: translate(-1px, -1px);}// lesshint spaceBeforeBrace: false
+    20%  {-webkit-transform: translate(-2px, -2px);}// lesshint spaceBeforeBrace: false
+    30%  {-webkit-transform: translate(-3px, -2px);}// lesshint spaceBeforeBrace: false
+    40%  {-webkit-transform: translate(-4px, -1px);}// lesshint spaceBeforeBrace: false
+    50%  {-webkit-transform: translate(-5px, 0px);}// lesshint spaceBeforeBrace: false
+    60%  {-webkit-transform: translate(-4px, 1px);}// lesshint spaceBeforeBrace: false
+    70%  {-webkit-transform: translate(-3px, 2px);}// lesshint spaceBeforeBrace: false
+    80%  {-webkit-transform: translate(-2px, 2px);}// lesshint spaceBeforeBrace: false
+    90%  {-webkit-transform: translate(-1px, 1px);}// lesshint spaceBeforeBrace: false
+    100% {-webkit-transform: translate(0, 0px);}// lesshint spaceBeforeBrace: false
+  }
+  @-moz-keyframes skid {
+    0%   {-moz-transform: translate(0px, 0px);}// lesshint spaceBeforeBrace: false
+    10%  {-moz-transform: translate(-1px, -1px);}// lesshint spaceBeforeBrace: false
+    20%  {-moz-transform: translate(-2px, -2px);}// lesshint spaceBeforeBrace: false
+    30%  {-moz-transform: translate(-3px, -2px);}// lesshint spaceBeforeBrace: false
+    40%  {-moz-transform: translate(-4px, -1px);}// lesshint spaceBeforeBrace: false
+    50%  {-moz-transform: translate(-5px, 0px);}// lesshint spaceBeforeBrace: false
+    60%  {-moz-transform: translate(-4px, 1px);}// lesshint spaceBeforeBrace: false
+    70%  {-moz-transform: translate(-3px, 2px);}// lesshint spaceBeforeBrace: false
+    80%  {-moz-transform: translate(-2px, 2px);}// lesshint spaceBeforeBrace: false
+    90%  {-moz-transform: translate(-1px, 1px);}// lesshint spaceBeforeBrace: false
+    100% {-moz-transform: translate(0, 0px);}// lesshint spaceBeforeBrace: false
+  }
+  @-o-keyframes skid {
+    0%   {-o-transform: translate(0px, 0px);}// lesshint spaceBeforeBrace: false
+    10%  {-o-transform: translate(-1px, -1px);}// lesshint spaceBeforeBrace: false
+    20%  {-o-transform: translate(-2px, -2px);}// lesshint spaceBeforeBrace: false
+    30%  {-o-transform: translate(-3px, -2px);}// lesshint spaceBeforeBrace: false
+    40%  {-o-transform: translate(-4px, -1px);}// lesshint spaceBeforeBrace: false
+    50%  {-o-transform: translate(-5px, 0px);}// lesshint spaceBeforeBrace: false
+    60%  {-o-transform: translate(-4px, 1px);}// lesshint spaceBeforeBrace: false
+    70%  {-o-transform: translate(-3px, 2px);}// lesshint spaceBeforeBrace: false
+    80%  {-o-transform: translate(-2px, 2px);}// lesshint spaceBeforeBrace: false
+    90%  {-o-transform: translate(-1px, 1px);}// lesshint spaceBeforeBrace: false
+    100% {-o-transform: translate(0, 0px);}// lesshint spaceBeforeBrace: false
+  }
+  @keyframes skid {
+    0%   {transform: translate(0px, 0px);}// lesshint spaceBeforeBrace: false
+    10%  {transform: translate(-1px, -1px);}// lesshint spaceBeforeBrace: false
+    20%  {transform: translate(-2px, -2px);}// lesshint spaceBeforeBrace: false
+    30%  {transform: translate(-3px, -2px);}// lesshint spaceBeforeBrace: false
+    40%  {transform: translate(-4px, -1px);}// lesshint spaceBeforeBrace: false
+    50%  {transform: translate(-5px, 0px);}// lesshint spaceBeforeBrace: false
+    60%  {transform: translate(-4px, 1px);}// lesshint spaceBeforeBrace: false
+    70%  {transform: translate(-3px, 2px);}// lesshint spaceBeforeBrace: false
+    80%  {transform: translate(-2px, 2px);}// lesshint spaceBeforeBrace: false
+    90%  {transform: translate(-1px, 1px);}// lesshint spaceBeforeBrace: false
+    100% {transform: translate(0, 0px);}// lesshint spaceBeforeBrace: false
+  }
+ }
+
+ .fly-fade() {
+  .animation-name(flyfade);
+  .animation-duration(7s);
+  .animation-iteration-count(infinite);
+  .animation-timing-function(linear);
+  @-webkit-keyframes flyfade {
+    0%   {-webkit-transform: translate(0px, 0px); opacity: 0;}// lesshint spaceBeforeBrace: false
+    25%  { opacity: 1;}// lesshint spaceBeforeBrace: false
+    50%  {-webkit-transform: translate(110px, 0px);}// lesshint spaceBeforeBrace: false
+    75%  { opacity: 1;}// lesshint spaceBeforeBrace: false
+    100% {-webkit-transform: translate(220px, 0); opacity: 0;}// lesshint spaceBeforeBrace: false
+  }
+  @-moz-keyframes flyfade {
+    0%   {-moz-transform: translate(0, 0px); opacity: 0;}// lesshint spaceBeforeBrace: false
+    25%  { opacity: 1;}// lesshint spaceBeforeBrace: false
+    50%  {-moz-transform: translate(110px, 0px); opacity: 1;}// lesshint spaceBeforeBrace: false
+    75%  { opacity: 1;}// lesshint spaceBeforeBrace: false
+    100% {-moz-transform: translate(220px, 0); opacity: 0;}// lesshint spaceBeforeBrace: false
+  }
+  @-o-keyframes flyfade {
+    0%   {-o-transform: translate(0, 0px); opacity: 0;}// lesshint spaceBeforeBrace: false
+    25%  { opacity: 1;}// lesshint spaceBeforeBrace: false
+    50%  {-o-transform: translate(110px, 0px); opacity: 1;}// lesshint spaceBeforeBrace: false
+    75%  { opacity: 1;}// lesshint spaceBeforeBrace: false
+    100% {-o-transform: translate(220px, 0); opacity: 0;}// lesshint spaceBeforeBrace: false
+  }
+  @keyframes flyfade {
+    0%   {transform: translate(0, 0px); opacity: 0;}// lesshint spaceBeforeBrace: false
+    25%  { opacity: 1;}// lesshint spaceBeforeBrace: false
+    50%  {transform: translate(110px, 0px); opacity: 1;}// lesshint spaceBeforeBrace: false
+    75%  { opacity: 1;}// lesshint spaceBeforeBrace: false
+    100% {transform: translate(220px, 0); opacity: 0;}// lesshint spaceBeforeBrace: false
+  }
+ }
+
+.bob() {
+  .animation-name(bob);
+  .animation-duration(3.2s);
+  .animation-iteration-count(infinite);
+  .animation-timing-function(ease-in-out);
+  @-webkit-keyframes bob {
+    0%   {-webkit-transform: translate(0px);}// lesshint spaceBeforeBrace: false
+    50%  {-webkit-transform: translatey(-7px);}// lesshint spaceBeforeBrace: false
+    100% {-webkit-transform: translatey(0px);}// lesshint spaceBeforeBrace: false
+  }
+  @-moz-keyframes bob {
+    0%   {-moz-transform: translatey(0px);}// lesshint spaceBeforeBrace: false
+    50%  {-moz-transform: translatey(-7px);}// lesshint spaceBeforeBrace: false
+    100% {-moz-transform: translatey(0px);}// lesshint spaceBeforeBrace: false
+  }
+  @-o-keyframes bob {
+    0%   {-o-transform: translatey(0px);}// lesshint spaceBeforeBrace: false
+    50%  {-o-transform: translatey(-7px);}// lesshint spaceBeforeBrace: false
+    100% {-o-transform: translatey(0px);}// lesshint spaceBeforeBrace: false
+  }
+  @keyframes bob {
+    0%   {transform: translatey(0px);}// lesshint spaceBeforeBrace: false
+    50%  {transform: translatey(-7px);}// lesshint spaceBeforeBrace: false
+    100% {transform: translatey(0px);}// lesshint spaceBeforeBrace: false
+  }
+ }
+
diff --git a/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/buttons.less b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/buttons.less
new file mode 100644
index 000000000000..dbfc1cfef52c
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/buttons.less
@@ -0,0 +1,13 @@
+.btn-reset() {
+  border-top: none;
+  border-bottom: none;
+  border-left: none;
+  border-right: none;
+  background: transparent;
+  font-family: inherit;
+  cursor: pointer;
+  &:focus {
+    border-image: none;
+    outline: none;
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/colors.less b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/colors.less
new file mode 100644
index 000000000000..93b68443e762
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/colors.less
@@ -0,0 +1,17 @@
+/**
+ * Color Variables
+ */
+
+@brand: #14acc2;
+@core-vibrant-blue: #6A67FE;
+@error: #B53A03;
+
+
+@text-normal: #000;
+@text-muted: lighten(@text-normal, 60%);
+
+@bg-lt-gray: #f1f1f1;
+@border-lt-gray: darken(@bg-lt-gray, 5%);
+@accent-lt-gray: darken(#fff, 5%);
+@accent-md-gray: darken(#fff, 25%);
+@accent-white: #fff;
diff --git a/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/containers.less b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/containers.less
new file mode 100644
index 000000000000..39577d35a37f
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/containers.less
@@ -0,0 +1,13 @@
+.container-sm() {
+  width: 100%;
+  max-width: 450px;
+  margin-left: auto;
+  margin-right: auto;
+}
+
+.container-md() {
+  width: 100%;
+  max-width: 650px;
+  margin-left: auto;
+  margin-right: auto;
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/index.less b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/index.less
new file mode 100644
index 000000000000..1311e4e81172
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/index.less
@@ -0,0 +1,6 @@
+@import 'colors.less';
+@import 'typography.less';
+@import 'buttons.less';
+@import 'animations.less';
+@import 'truncate.less';
+@import 'containers.less';
diff --git a/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/truncate.less b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/truncate.less
new file mode 100644
index 000000000000..38ebeffbdbe5
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/truncate.less
@@ -0,0 +1,5 @@
+.truncate() {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/typography.less b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/typography.less
new file mode 100644
index 000000000000..b5c860736301
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/typography.less
@@ -0,0 +1,7 @@
+// Font families:
+@main-font: 'Inter', sans-serif;
+@header-font: 'Inter', sans-serif;
+
+// Font weights:
+@bold: 700;
+@normal: 400;
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/404.less b/ee/bulk-operations-dashboard/assets/styles/pages/404.less
new file mode 100644
index 000000000000..b17ea3ae7808
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/404.less
@@ -0,0 +1,5 @@
+[id='404'] {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/498.less b/ee/bulk-operations-dashboard/assets/styles/pages/498.less
new file mode 100644
index 000000000000..45b38037771b
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/498.less
@@ -0,0 +1,5 @@
+[id='498'] {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/500.less b/ee/bulk-operations-dashboard/assets/styles/pages/500.less
new file mode 100644
index 000000000000..19aa03a49eae
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/500.less
@@ -0,0 +1,5 @@
+[id='500'] {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/account/account-overview.less b/ee/bulk-operations-dashboard/assets/styles/pages/account/account-overview.less
new file mode 100644
index 000000000000..60e82a78c136
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/account/account-overview.less
@@ -0,0 +1,9 @@
+#account-overview {
+
+  [purpose='remove-button'] {
+    color: @brand;
+    &:hover {
+      color: @text-normal;
+    }
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/account/edit-password.less b/ee/bulk-operations-dashboard/assets/styles/pages/account/edit-password.less
new file mode 100644
index 000000000000..b456d0084656
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/account/edit-password.less
@@ -0,0 +1,5 @@
+#edit-password {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/account/edit-profile.less b/ee/bulk-operations-dashboard/assets/styles/pages/account/edit-profile.less
new file mode 100644
index 000000000000..f06f5318a1b6
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/account/edit-profile.less
@@ -0,0 +1,5 @@
+#edit-profile {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/contact.less b/ee/bulk-operations-dashboard/assets/styles/pages/contact.less
new file mode 100644
index 000000000000..488cc71e7857
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/contact.less
@@ -0,0 +1,5 @@
+#contact {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/dashboard/welcome.less b/ee/bulk-operations-dashboard/assets/styles/pages/dashboard/welcome.less
new file mode 100644
index 000000000000..2bcb3aa09dd0
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/dashboard/welcome.less
@@ -0,0 +1,5 @@
+#welcome {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/entrance/confirmed-email.less b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/confirmed-email.less
new file mode 100644
index 000000000000..ad0858a47de1
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/confirmed-email.less
@@ -0,0 +1,5 @@
+#confirmed-email {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/entrance/forgot-password.less b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/forgot-password.less
new file mode 100644
index 000000000000..b3f5364e7ec0
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/forgot-password.less
@@ -0,0 +1,5 @@
+#forgot-password {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/entrance/login.less b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/login.less
new file mode 100644
index 000000000000..3132144eb2fc
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/login.less
@@ -0,0 +1,5 @@
+#login {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/entrance/new-password.less b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/new-password.less
new file mode 100644
index 000000000000..984d90cfa3a5
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/new-password.less
@@ -0,0 +1,5 @@
+#new-password {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/entrance/signup.less b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/signup.less
new file mode 100644
index 000000000000..a0fda1ba2508
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/signup.less
@@ -0,0 +1,5 @@
+#signup {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/faq.less b/ee/bulk-operations-dashboard/assets/styles/pages/faq.less
new file mode 100644
index 000000000000..5bd40558bbe8
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/faq.less
@@ -0,0 +1,11 @@
+#faq {
+
+  @media (max-width: 500px) {
+    code {
+      word-break: break-all;
+    }
+    [purpose='placeholder'] {
+      word-break: break-all;
+    }
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/homepage.less b/ee/bulk-operations-dashboard/assets/styles/pages/homepage.less
new file mode 100644
index 000000000000..581bc5c567ee
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/homepage.less
@@ -0,0 +1,27 @@
+#homepage {
+
+  [purpose='cloud-1'] {
+    .fly-fade();
+    opacity: 0;
+    }
+  [purpose='cloud-2'] {
+    .fly-fade();
+    .animation-delay(3.5s);
+    opacity: 0;
+  }
+  [purpose='ship'] {
+    .skid();
+  }
+  [purpose='more-info-text'] {
+    .bob();
+  }
+  [purpose='setup-step'] {
+    padding-left: 240px;
+  }
+
+  @media (max-width: 991px) {
+    [purpose='setup-step'] {
+      padding-left: 0px;
+    }
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/legal/privacy.less b/ee/bulk-operations-dashboard/assets/styles/pages/legal/privacy.less
new file mode 100644
index 000000000000..36db0a8cede3
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/legal/privacy.less
@@ -0,0 +1,5 @@
+#privacy {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/legal/terms.less b/ee/bulk-operations-dashboard/assets/styles/pages/legal/terms.less
new file mode 100644
index 000000000000..9580dcff76c1
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/legal/terms.less
@@ -0,0 +1,5 @@
+#terms {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/profiles.less b/ee/bulk-operations-dashboard/assets/styles/pages/profiles.less
new file mode 100644
index 000000000000..68e3a3736bdd
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/profiles.less
@@ -0,0 +1,235 @@
+#profiles {
+
+  [purpose='page-content'] {
+    padding: 24px 32px 64px 32px;
+  }
+  p {
+    margin-block-end: 0px;
+    font-size: 14px;
+    line-height: 150%;
+  }
+  .table td {
+    font-size: 14px;
+    line-height: 150%;
+    a {
+      cursor: pointer;
+      display: block;
+    }
+  }
+  .table thead th {
+    border-top: none;
+    border-bottom: none;
+    border-right: 1px solid #e2e4ea;
+    vertical-align: middle;
+  }
+  th.sortable {
+    cursor: pointer;
+  }
+  .table th, .table td {
+    padding: 0.5rem 1rem;
+    white-space: nowrap;
+  }
+  .table thead {
+    tr:first-child {
+      th {
+        border-top: none;
+        background-color: rgba(0, 43, 128, 0.0235294);
+        border-right: none;
+      }
+      th:first-child {
+        border-top-left-radius: 8px;
+      }
+      th:last-child {
+        border-top-right-radius: 8px;
+      }
+    }
+  }
+  .table tbody {
+    color: #515774;
+    border-radius: 8px;
+    td {
+      max-height: 48px;
+      height: 48px;
+      padding-left: 16px;
+      padding-right: 16px;
+      border-top: 1px solid @border-lt-gray;
+      position: relative;
+    }
+    tr {
+      td:last-child {
+        border-right: none;
+      }
+    }
+    tr:last-child {
+      td:first-child {
+        border-bottom-left-radius: 8px;
+      }
+      td:last-child {
+        border-bottom-right-radius: 8px;
+      }
+    }
+  }
+  .sort-arrows {
+    height: 14px;
+    padding-left: 0.5rem;
+    display: inline-flex;
+    flex-direction: column;
+    justify-content: space-between;
+    span {
+      display: flex;
+      align-items: center;
+      gap: 3px;
+    }
+    .ascending-arrow {
+      width: 0;
+      height: 0;
+      border-left: 5px solid transparent;
+      border-right: 5px solid transparent;
+      border-bottom: 6px solid #c5c7d1;
+    }
+    .descending-arrow {
+      width: 0;
+      height: 0;
+      border-left: 5px solid transparent;
+      border-right: 5px solid transparent;
+      border-top: 6px solid #c5c7d1;
+    }
+  }
+  .ascending .ascending-arrow {
+    border-bottom-color: #6a67fe;
+  }
+  .descending .descending-arrow {
+    border-top-color: #6a67fe;
+  }
+  .table td {
+    white-space: nowrap;
+    vertical-align: middle;
+  }
+
+  .affected-teams-link {
+    // color: #007697;
+    cursor: pointer;
+  }
+  .truncated-affected-teams {
+    color: #007697;
+    cursor: pointer;
+    position: relative;
+    .teams-tooltip {
+      display: none;
+    }
+  }
+  .truncated-affected-teams:hover {
+    text-decoration: underline;
+    .teams-tooltip {
+      z-index: 3;
+      display: flex;
+      flex-direction: column;
+      justify-content: center;
+      align-items: flex-start;
+      padding: 6px;
+      width: 250px;
+      background: #515774;
+      border-radius: 4px;
+      position: absolute;
+      top: 15px;
+      left: -30px;
+      color: #FFF;
+      p {
+        white-space: normal;
+        margin-bottom: 4px;
+        cursor: pointer;
+        color: #FFF;
+        &:hover {
+          text-decoration: underline;
+        }
+      }
+    }
+  }
+  .pointer {
+    cursor: pointer;
+  }
+  [parasails-component='file-upload'] {
+    &.is-invalid {
+      border: 1px solid #dc3545;
+    }
+  }
+  .is-invalid ~ .invalid-feedback {
+    display: block;
+  }
+  [purpose='profile-upload-input'] {
+    display: flex;
+    padding: 32px;
+    flex-direction: column;
+    justify-content: center;
+    align-items: center;
+    gap: 16px;
+    align-self: stretch;
+    border-radius: 4px;
+    border: 1px solid #E2E4EA;
+    background: #F9FAFC;
+  }
+  [purpose='profile-information'] {
+    display: flex;
+    flex-direction: column;
+    justify-content: center;
+    align-items: start;
+    gap: 16px;
+    // align-self: stretch;
+    border-radius: 4px;
+    padding: 16px 24px;
+    height: 72px;
+    border: 1px solid #E2E4EA;
+    background: #F9FAFC;
+    margin-bottom: 24px;
+    img {
+      margin-right: 16px;
+    }
+  }
+  [purpose='teams-picker'] {
+    // display: flex;
+    padding: 16px 24px;
+    // flex-direction: column;
+    // align-items: flex-start;
+    gap: 8px;
+    // align-self: stretch;
+    border-radius: 4px;
+    border: 1px solid #E2E4EA;
+    background: #F9FAFC;
+    margin-bottom: 24px;
+    margin-top: 24px;
+  }
+  // input[type='file'] {
+  //   display: none;
+  // }
+  [purpose='file-upload'] {
+    color: @core-vibrant-blue;
+    display: flex;
+    font-weight: 700;
+    font-size: 14px;
+    line-height: 150%;
+    margin-top: 24px;
+    cursor: pointer;
+    img {
+      margin-right: 8px;
+    }
+  }
+  [purpose='delete-button'] {
+    border-radius: 6px;
+    background: #D66C7B;
+    border-color: #D66C7B;
+    color: #FFF;
+  }
+  [purpose='modal-button'] {
+    border-radius: 6px;
+    background: #6A67FE;
+    color: #FFF;
+    border-color: #6A67FE;
+  }
+  [purpose='modal-buttons'] {
+    [purpose='cancel-button'] {
+      color: @core-vibrant-blue;
+      margin-right: 16px;
+      cursor: pointer;
+    }
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/scripts.less b/ee/bulk-operations-dashboard/assets/styles/pages/scripts.less
new file mode 100644
index 000000000000..9ef71d164ada
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/scripts.less
@@ -0,0 +1,231 @@
+#scripts {
+
+  [purpose='page-content'] {
+    padding: 24px 32px 64px 32px;
+  }
+  p {
+    margin-block-end: 0px;
+    font-size: 14px;
+    line-height: 150%;
+  }
+  .table td {
+    font-size: 14px;
+    line-height: 150%;
+    a {
+      cursor: pointer;
+      display: block;
+    }
+  }
+  .table thead th {
+    border-top: none;
+    border-bottom: none;
+    border-right: 1px solid #e2e4ea;
+    vertical-align: middle;
+  }
+  th.sortable {
+    cursor: pointer;
+  }
+  .table th, .table td {
+    padding: 0.5rem 1rem;
+    white-space: nowrap;
+  }
+  .table thead {
+    tr:first-child {
+      th {
+        border-top: none;
+        background-color: rgba(0, 43, 128, 0.0235294);
+        border-right: none;
+      }
+      th:first-child {
+        border-top-left-radius: 8px;
+      }
+      th:last-child {
+        border-top-right-radius: 8px;
+      }
+    }
+  }
+  .table tbody {
+    color: #515774;
+    border-radius: 8px;
+    td {
+      max-height: 48px;
+      height: 48px;
+      padding-left: 16px;
+      padding-right: 16px;
+      border-top: 1px solid @border-lt-gray;
+      position: relative;
+    }
+    tr {
+      td:last-child {
+        border-right: none;
+      }
+    }
+    tr:last-child {
+      td:first-child {
+        border-bottom-left-radius: 8px;
+      }
+      td:last-child {
+        border-bottom-right-radius: 8px;
+      }
+    }
+  }
+  .sort-arrows {
+    height: 14px;
+    padding-left: 0.5rem;
+    display: inline-flex;
+    flex-direction: column;
+    justify-content: space-between;
+    span {
+      display: flex;
+      align-items: center;
+      gap: 3px;
+    }
+    .ascending-arrow {
+      width: 0;
+      height: 0;
+      border-left: 5px solid transparent;
+      border-right: 5px solid transparent;
+      border-bottom: 6px solid #c5c7d1;
+    }
+    .descending-arrow {
+      width: 0;
+      height: 0;
+      border-left: 5px solid transparent;
+      border-right: 5px solid transparent;
+      border-top: 6px solid #c5c7d1;
+    }
+  }
+  .ascending .ascending-arrow {
+    border-bottom-color: #6a67fe;
+  }
+  .descending .descending-arrow {
+    border-top-color: #6a67fe;
+  }
+  .table td {
+    white-space: nowrap;
+    vertical-align: middle;
+  }
+
+  .affected-teams-link {
+    // color: #007697;
+    cursor: pointer;
+  }
+  .truncated-affected-teams {
+    color: #007697;
+    cursor: pointer;
+    position: relative;
+    .teams-tooltip {
+      display: none;
+    }
+  }
+  .truncated-affected-teams:hover {
+    text-decoration: underline;
+    .teams-tooltip {
+      z-index: 3;
+      display: flex;
+      flex-direction: column;
+      justify-content: center;
+      align-items: flex-start;
+      padding: 6px;
+      width: 250px;
+      background: #515774;
+      border-radius: 4px;
+      position: absolute;
+      top: 15px;
+      left: -30px;
+      color: #FFF;
+      p {
+        white-space: normal;
+        margin-bottom: 4px;
+        cursor: pointer;
+        color: #FFF;
+        &:hover {
+          text-decoration: underline;
+        }
+      }
+    }
+  }
+  .pointer {
+    cursor: pointer;
+  }
+  [purpose='script-upload-input'] {
+    display: flex;
+    padding: 32px;
+    flex-direction: column;
+    justify-content: center;
+    align-items: center;
+    gap: 16px;
+    align-self: stretch;
+    border-radius: 4px;
+    border: 1px solid #E2E4EA;
+    background: #F9FAFC;
+  }
+  [parasails-component='file-upload'] {
+    &.is-invalid {
+      border: 1px solid #dc3545;
+    }
+  }
+  .is-invalid ~ .invalid-feedback {
+    display: block;
+  }
+
+  [purpose='script-information'] {
+    display: flex;
+    flex-direction: column;
+    justify-content: center;
+    align-items: start;
+    gap: 16px;
+    // align-self: stretch;
+    border-radius: 4px;
+    padding: 16px 24px;
+    height: 72px;
+    border: 1px solid #E2E4EA;
+    background: #F9FAFC;
+    margin-bottom: 24px;
+    img {
+      margin-right: 16px;
+    }
+  }
+  [purpose='teams-picker'] {
+    padding: 16px 24px;
+    gap: 8px;
+    border-radius: 4px;
+    border: 1px solid #E2E4EA;
+    background: #F9FAFC;
+    margin-bottom: 24px;
+    &.is-invalid {
+      border: 1px solid #dc3545;
+    }
+  }
+  [purpose='delete-button'] {
+    border-radius: 6px;
+    background: #D66C7B;
+    border-color: #D66C7B;
+    color: #FFF;
+  }
+  [purpose='file-upload'] {
+    color: @core-vibrant-blue;
+    display: flex;
+    font-weight: 700;
+    font-size: 14px;
+    line-height: 150%;
+    margin-top: 24px;
+    cursor: pointer;
+    img {
+      margin-right: 8px;
+    }
+  }
+  [purpose='modal-button'] {
+    border-radius: 6px;
+    background: #6A67FE;
+    color: #FFF;
+    border-color: #6A67FE;
+  }
+  [purpose='modal-buttons'] {
+    [purpose='cancel-button'] {
+      color: @core-vibrant-blue;
+      margin-right: 16px;
+      cursor: pointer;
+    }
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/templates/.gitkeep b/ee/bulk-operations-dashboard/assets/templates/.gitkeep
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/ee/bulk-operations-dashboard/config/blueprints.js b/ee/bulk-operations-dashboard/config/blueprints.js
new file mode 100644
index 000000000000..b40598f80c3e
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/blueprints.js
@@ -0,0 +1,41 @@
+/**
+ * Blueprint API Configuration
+ * (sails.config.blueprints)
+ *
+ * For background on the blueprint API in Sails, check out:
+ * https://sailsjs.com/docs/reference/blueprint-api
+ *
+ * For details and more available options, see:
+ * https://sailsjs.com/config/blueprints
+ */
+
+module.exports.blueprints = {
+
+  /***************************************************************************
+  *                                                                          *
+  * Automatically expose implicit routes for every action in your app?       *
+  *                                                                          *
+  ***************************************************************************/
+
+  // actions: false,
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Automatically expose RESTful routes for your models?                     *
+  *                                                                          *
+  ***************************************************************************/
+
+  rest: false,
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Automatically expose CRUD "shortcut" routes to GET requests?             *
+  * (These are enabled by default in development only.)                      *
+  *                                                                          *
+  ***************************************************************************/
+
+  shortcuts: false,
+
+};
diff --git a/ee/bulk-operations-dashboard/config/bootstrap.js b/ee/bulk-operations-dashboard/config/bootstrap.js
new file mode 100644
index 000000000000..a43866b34a07
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/bootstrap.js
@@ -0,0 +1,79 @@
+/**
+ * Seed Function
+ * (sails.config.bootstrap)
+ *
+ * A function that runs just before your Sails app gets lifted.
+ * > Need more flexibility?  You can also create a hook.
+ *
+ * For more information on seeding your app with fake data, check out:
+ * https://sailsjs.com/config/bootstrap
+ */
+
+module.exports.bootstrap = async function() {
+
+  // Import dependencies
+  var path = require('path');
+
+  // This bootstrap version indicates what version of fake data we're dealing with here.
+  var HARD_CODED_DATA_VERSION = 0;
+
+  // This path indicates where to store/look for the JSON file that tracks the "last run bootstrap info"
+  // locally on this development computer (if we happen to be on a development computer).
+  var bootstrapLastRunInfoPath = path.resolve(sails.config.appPath, '.tmp/bootstrap-version.json');
+
+  // Whether or not to continue doing the stuff in this file (i.e. wiping and regenerating data)
+  // depends on some factors:
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+  // If the hard-coded data version has been incremented, or we're being forced
+  // (i.e. `--drop` or `--environment=test` was set), then run the meat of this
+  // bootstrap script to wipe all existing data and rebuild hard-coded data.
+  if (sails.config.models.migrate !== 'drop' && sails.config.environment !== 'test') {
+    // If this is _actually_ a production environment (real or simulated), or we have
+    // `migrate: safe` enabled, then prevent accidentally removing all data!
+    if (process.env.NODE_ENV==='production' || sails.config.models.migrate === 'safe') {
+      sails.log('Since we are running with migrate: \'safe\' and/or NODE_ENV=production (in the "'+sails.config.environment+'" Sails environment, to be precise), skipping the rest of the bootstrap to avoid data loss...');
+      return;
+    }//•
+
+    // Compare bootstrap version from code base to the version that was last run
+    var lastRunBootstrapInfo = await sails.helpers.fs.readJson(bootstrapLastRunInfoPath)
+    .tolerate('doesNotExist');// (it's ok if the file doesn't exist yet-- just keep going.)
+
+    if (lastRunBootstrapInfo && lastRunBootstrapInfo.lastRunVersion === HARD_CODED_DATA_VERSION) {
+      sails.log('Skipping v'+HARD_CODED_DATA_VERSION+' bootstrap script...  (because it\'s already been run)');
+      sails.log('(last run on this computer: @ '+(new Date(lastRunBootstrapInfo.lastRunAt))+')');
+      return;
+    }//•
+
+    sails.log('Running v'+HARD_CODED_DATA_VERSION+' bootstrap script...  ('+(lastRunBootstrapInfo ? 'before this, the last time the bootstrap ran on this computer was for v'+lastRunBootstrapInfo.lastRunVersion+' @ '+(new Date(lastRunBootstrapInfo.lastRunAt)) : 'looks like this is the first time the bootstrap has run on this computer')+')');
+  }
+  else {
+    sails.log('Running bootstrap script because it was forced...  (either `--drop` or `--environment=test` was used)');
+  }
+
+  // Since the hard-coded data version has been incremented, and we're running in
+  // a "throwaway data" environment, delete all records from all models.
+  for (let identity in sails.models) {
+    await sails.models[identity].destroy({});
+  }//∞
+
+  // By convention, this is a good place to set up fake data during development.
+  await User.createEach([
+    { emailAddress: 'admin@example.com', fullName: 'Ryan Dahl', isSuperAdmin: true, password: await sails.helpers.passwords.hashPassword('abc123') },
+  ]);
+
+  // Save new bootstrap version
+  await sails.helpers.fs.writeJson.with({
+    destination: bootstrapLastRunInfoPath,
+    json: {
+      lastRunVersion: HARD_CODED_DATA_VERSION,
+      lastRunAt: Date.now()
+    },
+    force: true
+  })
+  .tolerate((err)=>{
+    sails.log.warn('For some reason, could not write bootstrap version .json file.  This could be a result of a problem with your configured paths, or, if you are in production, a limitation of your hosting provider related to `pwd`.  As a workaround, try updating app.js to explicitly pass in `appPath: __dirname` instead of relying on `chdir`.  Current sails.config.appPath: `'+sails.config.appPath+'`.  Full error details: '+err.stack+'\n\n(Proceeding anyway this time...)');
+  });
+
+};
diff --git a/ee/bulk-operations-dashboard/config/custom.js b/ee/bulk-operations-dashboard/config/custom.js
new file mode 100644
index 000000000000..a33b5d98cc84
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/custom.js
@@ -0,0 +1,110 @@
+/**
+ * Custom configuration
+ * (sails.config.custom)
+ *
+ * One-off settings specific to your application.
+ *
+ * For more information on custom configuration, visit:
+ * https://sailsjs.com/config/custom
+ */
+
+module.exports.custom = {
+
+  /**************************************************************************
+  *                                                                         *
+  * The base URL to use during development.                                 *
+  *                                                                         *
+  * • No trailing slash at the end                                          *
+  * • `http://` or `https://` at the beginning.                             *
+  *                                                                         *
+  * > This is for use in custom logic that builds URLs.                     *
+  * > It is particularly handy for building dynamic links in emails,        *
+  * > but it can also be used for user-uploaded images, webhooks, etc.      *
+  *                                                                         *
+  **************************************************************************/
+  baseUrl: 'http://localhost:1337',
+
+  /**************************************************************************
+  *                                                                         *
+  * Display dates for your app                                              *
+  *                                                                         *
+  * > This is here to make it easier to change out the copyright date       *
+  * > that is displayed all over the app when it's first generated.         *
+  *                                                                         *
+  **************************************************************************/
+  platformCopyrightYear: '2024',
+
+  /**************************************************************************
+  *                                                                         *
+  * The TTL (time-to-live) for various sorts of tokens before they expire.  *
+  *                                                                         *
+  **************************************************************************/
+  passwordResetTokenTTL: 24*60*60*1000,// 24 hours
+  emailProofTokenTTL:    24*60*60*1000,// 24 hours
+
+  /**************************************************************************
+  *                                                                         *
+  * The extended length that browsers should retain the session cookie      *
+  * if "Remember Me" was checked while logging in.                          *
+  *                                                                         *
+  **************************************************************************/
+  rememberMeCookieMaxAge: 30*24*60*60*1000, // 30 days
+
+  /**************************************************************************
+  *                                                                         *
+  * Automated email configuration                                           *
+  *                                                                         *
+  * Sandbox Sendgrid credentials for use during development, as well as any *
+  * other default settings related to "how" and "where" automated emails    *
+  * are sent.                                                               *
+  *                                                                         *
+  * (https://app.sendgrid.com/settings/api_keys)                            *
+  *                                                                         *
+  **************************************************************************/
+  // sendgridSecret: 'SG.fake.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU',
+  //--------------------------------------------------------------------------
+  // /\  Configure this to enable support for automated emails.
+  // ||  (Important for password recovery, verification, contact form, etc.)
+  //--------------------------------------------------------------------------
+
+  // The sender that all outgoing emails will appear to come from.
+  fromEmailAddress: 'noreply@example.com',
+  fromName: 'The NEW_APP_NAME Team',
+
+  // Email address for receiving support messages & other correspondences.
+  // > If you're using the default privacy policy, this will be referenced
+  // > as the contact email of your "data protection officer" for the purpose
+  // > of compliance with regulations such as GDPR.
+  internalEmailAddress: 'support+development@example.com',
+
+  // Whether to require proof of email address ownership any time a new user
+  // signs up, or when an existing user attempts to change their email address.
+  verifyEmailAddresses: false,
+
+  /**************************************************************************
+  *                                                                         *
+  * Billing & payments configuration                                        *
+  *                                                                         *
+  * (https://dashboard.stripe.com/account/apikeys)                          *
+  *                                                                         *
+  **************************************************************************/
+  // stripePublishableKey: 'pk_test_Zzd814nldl91104qor5911gjald',
+  // stripeSecret: 'sk_test_Zzd814nldl91104qor5911gjald',
+  //--------------------------------------------------------------------------
+  // /\  Configure these to enable support for billing features.
+  // ||  (Or if you don't need billing, feel free to remove them.)
+  //--------------------------------------------------------------------------
+
+  /***************************************************************************
+  *                                                                          *
+  * Any other custom config this Sails app should use during development.    *
+  *                                                                          *
+  ***************************************************************************/
+  // The base URL of your Fleet instance.
+  fleetBaseUrl: 'https://dogfood.fleetdm.com',
+
+  // The API token of a Fleet API-only user for your Fleet instance.
+  // [?] Here's how you get one: https://fleetdm.com/docs/using-fleet/fleetctl-cli#get-the-api-token-of-an-api-only-user
+  // fleetApiToken: 'asdfasdfasdfasdf',
+
+};
diff --git a/ee/bulk-operations-dashboard/config/datastores.js b/ee/bulk-operations-dashboard/config/datastores.js
new file mode 100644
index 000000000000..3853184314ac
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/datastores.js
@@ -0,0 +1,57 @@
+/**
+ * Datastores
+ * (sails.config.datastores)
+ *
+ * A set of datastore configurations which tell Sails where to fetch or save
+ * data when you execute built-in model methods like `.find()` and `.create()`.
+ *
+ *  > This file is mainly useful for configuring your development database,
+ *  > as well as any additional one-off databases used by individual models.
+ *  > Ready to go live?  Head towards `config/env/production.js`.
+ *
+ * For more information on configuring datastores, check out:
+ * https://sailsjs.com/config/datastores
+ */
+
+module.exports.datastores = {
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Your app's default datastore.                                            *
+  *                                                                          *
+  * Sails apps read and write to local disk by default, using a built-in     *
+  * database adapter called `sails-disk`.  This feature is purely for        *
+  * convenience during development; since `sails-disk` is not designed for   *
+  * use in a production environment.                                         *
+  *                                                                          *
+  * To use a different db _in development_, follow the directions below.     *
+  * Otherwise, just leave the default datastore as-is, with no `adapter`.    *
+  *                                                                          *
+  * (For production configuration, see `config/env/production.js`.)          *
+  *                                                                          *
+  ***************************************************************************/
+
+  default: {
+
+    /***************************************************************************
+    *                                                                          *
+    * Want to use a different database during development?                     *
+    *                                                                          *
+    * 1. Choose an adapter:                                                    *
+    *    https://sailsjs.com/plugins/databases                                 *
+    *                                                                          *
+    * 2. Install it as a dependency of your Sails app.                         *
+    *    (For example:  npm install sails-mysql --save)                        *
+    *                                                                          *
+    * 3. Then pass it in, along with a connection URL.                         *
+    *    (See https://sailsjs.com/config/datastores for help.)                 *
+    *                                                                          *
+    ***************************************************************************/
+    // adapter: 'sails-mysql',
+    // url: 'mysql://user:password@host:port/database',
+
+  },
+
+
+};
diff --git a/ee/bulk-operations-dashboard/config/env/production.js b/ee/bulk-operations-dashboard/config/env/production.js
new file mode 100644
index 000000000000..8d28a4d013b1
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/env/production.js
@@ -0,0 +1,419 @@
+/**
+ * Production environment settings
+ * (sails.config.*)
+ *
+ * What you see below is a quick outline of the built-in settings you need
+ * to configure your Sails app for production.  The configuration in this file
+ * is only used in your production environment, i.e. when you lift your app using:
+ *
+ * ```
+ * NODE_ENV=production node app
+ * ```
+ *
+ * > If you're using git as a version control solution for your Sails app,
+ * > this file WILL BE COMMITTED to your repository by default, unless you add
+ * > it to your .gitignore file.  If your repository will be publicly viewable,
+ * > don't add private/sensitive data (like API secrets / db passwords) to this file!
+ *
+ * For more best practices and tips, see:
+ * https://sailsjs.com/docs/concepts/deployment
+ */
+
+module.exports = {
+
+
+  /**************************************************************************
+  *                                                                         *
+  * Tell Sails what database(s) it should use in production.                *
+  *                                                                         *
+  * (https://sailsjs.com/config/datastores)                                 *
+  *                                                                         *
+  **************************************************************************/
+  datastores: {
+
+    /***************************************************************************
+    *                                                                          *
+    * Configure your default production database.                              *
+    *                                                                          *
+    * 1. Choose an adapter:                                                    *
+    *    https://sailsjs.com/plugins/databases                                 *
+    *                                                                          *
+    * 2. Install it as a dependency of your Sails app.                         *
+    *    (For example:  npm install sails-mysql --save)                        *
+    *                                                                          *
+    * 3. Then set it here (`adapter`), along with a connection URL (`url`)     *
+    *    and any other, adapter-specific customizations.                       *
+    *    (See https://sailsjs.com/config/datastores for help.)                 *
+    *                                                                          *
+    ***************************************************************************/
+    default: {
+      adapter: 'sails-postgresql',
+      url: process.env.DATABASE_URL,
+      ssl: {
+        sslmode: 'require',
+        rejectUnauthorized: false,
+      }
+      //--------------------------------------------------------------------------
+      //  /\   To avoid checking it in to version control, you might opt to set
+      //  ||   sensitive credentials like `url` using an environment variable.
+      //
+      //  For example:
+      //  ```
+      //  sails_datastores__default__url=mysql://admin:myc00lpAssw2D@db.example.com:3306/my_prod_db
+      //  ```
+      //--------------------------------------------------------------------------
+
+      /****************************************************************************
+      *                                                                           *
+      * More adapter-specific options                                             *
+      *                                                                           *
+      * > For example, for some hosted PostgreSQL providers (like Heroku), the    *
+      * > extra `ssl` object with a `rejectUnauthorized` option must be provided. *
+      *                                                                           *
+      * More info:                                                                *
+      * https://sailsjs.com/config/datastores                                     *
+      *                                                                           *
+      ****************************************************************************/
+      // ssl: { rejectUnauthorized: true },
+
+    },
+
+  },
+
+
+
+  models: {
+
+    /***************************************************************************
+    *                                                                          *
+    * To help avoid accidents, Sails automatically sets the automigration      *
+    * strategy to "safe" when your app lifts in production mode.               *
+    * (This is just here as a reminder.)                                       *
+    *                                                                          *
+    * More info:                                                               *
+    * https://sailsjs.com/docs/concepts/models-and-orm/model-settings#?migrate *
+    *                                                                          *
+    ***************************************************************************/
+    migrate: 'safe',
+
+    /***************************************************************************
+    *                                                                          *
+    * If, in production, this app has access to physical-layer CASCADE         *
+    * constraints (e.g. PostgreSQL or MySQL), then set those up in the         *
+    * database and uncomment this to disable Waterline's `cascadeOnDestroy`    *
+    * polyfill.  (Otherwise, if you are using a databse like Mongo, you might  *
+    * choose to keep this enabled.)                                            *
+    *                                                                          *
+    ***************************************************************************/
+    // cascadeOnDestroy: false,
+
+  },
+
+
+
+  /**************************************************************************
+  *                                                                         *
+  * Always disable "shortcut" blueprint routes.                             *
+  *                                                                         *
+  * > You'll also want to disable any other blueprint routes if you are not *
+  * > actually using them (e.g. "actions" and "rest") -- but you can do     *
+  * > that in `config/blueprints.js`, since you'll want to disable them in  *
+  * > all environments (not just in production.)                            *
+  *                                                                         *
+  ***************************************************************************/
+  blueprints: {
+    shortcuts: false,
+  },
+
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Configure your security settings for production.                         *
+  *                                                                          *
+  * IMPORTANT:                                                               *
+  * If web browsers will be communicating with your app, be sure that        *
+  * you have CSRF protection enabled.  To do that, set `csrf: true` over     *
+  * in the `config/security.js` file (not here), so that CSRF app can be     *
+  * tested with CSRF protection turned on in development mode too.           *
+  *                                                                          *
+  ***************************************************************************/
+  security: {
+
+    /***************************************************************************
+    *                                                                          *
+    * If this app has CORS enabled (see `config/security.js`) with the         *
+    * `allowCredentials` setting enabled, then you should uncomment the        *
+    * `allowOrigins` whitelist below.  This sets which "origins" are allowed   *
+    * to send cross-domain (CORS) requests to your Sails app.                  *
+    *                                                                          *
+    * > Replace "https://example.com" with the URL of your production server.  *
+    * > Be sure to use the right protocol!  ("http://" vs. "https://")         *
+    *                                                                          *
+    ***************************************************************************/
+    cors: {
+      // allowOrigins: [
+      //   'https://example.com',
+      // ]
+    },
+
+  },
+
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Configure how your app handles sessions in production.                   *
+  *                                                                          *
+  * (https://sailsjs.com/config/session)                                     *
+  *                                                                          *
+  * > If you have disabled the "session" hook, then you can safely remove    *
+  * > this section from your `config/env/production.js` file.                *
+  *                                                                          *
+  ***************************************************************************/
+  session: {
+
+    /***************************************************************************
+    *                                                                          *
+    * Production session store configuration.                                  *
+    *                                                                          *
+    * Uncomment the following lines to finish setting up a package called      *
+    * "@sailshq/connect-redis" that will use Redis to handle session data.     *
+    * This makes your app more scalable by allowing you to share sessions      *
+    * across a cluster of multiple Sails/Node.js servers and/or processes.     *
+    * (See http://bit.ly/redis-session-config for more info.)                  *
+    *                                                                          *
+    * > While @sailshq/connect-redis is a popular choice for Sails apps, many  *
+    * > other compatible packages (like "connect-mongo") are available on NPM. *
+    * > (For a full list, see https://sailsjs.com/plugins/sessions)            *
+    *                                                                          *
+    ***************************************************************************/
+    adapter: '@sailshq/connect-redis',
+    url: process.env.REDIS_TLS_URL,
+    tls: {
+      rejectUnauthorized: false
+    },
+    //--------------------------------------------------------------------------
+    // /\   OR, to avoid checking it in to version control, you might opt to
+    // ||   set sensitive credentials like this using an environment variable.
+    //
+    // For example:
+    // ```
+    // sails_session__url=redis://admin:myc00lpAssw2D@bigsquid.redistogo.com:9562/0
+    // ```
+    //
+    //--------------------------------------------------------------------------
+
+    /***************************************************************************
+    *                                                                          *
+    * Production configuration for the session ID cookie name.                 *
+    *                                                                          *
+    * We reccomend prefixing your session cookie with `__Host-`, this limits   *
+    * the scope of your cookie to a single origin to protect against same-site *
+    * attacks.                                                                 *
+    *                                                                          *
+    * Note that with the `__Host-` prefix, session cookies will _not_ be sent  *
+    * unless `sails.config.cookie.secure` is set to `true`.                    *
+    *                                                                          *
+    * Read more:                                                               *
+    * https://sailsjs.com/config/session#?the-session-id-cookie                *
+    *                                                                          *
+    ***************************************************************************/
+    // name: '__Host-sails.sid',
+
+    /***************************************************************************
+    *                                                                          *
+    * Production configuration for the session ID cookie.                      *
+    *                                                                          *
+    * Tell browsers (or other user agents) to ensure that session ID cookies   *
+    * are always transmitted via HTTPS, and that they expire 24 hours after    *
+    * they are set.                                                            *
+    *                                                                          *
+    * Note that with `secure: true` set, session cookies will _not_ be         *
+    * transmitted over unsecured (HTTP) connections. Also, for apps behind     *
+    * proxies (like Heroku), the `trustProxy` setting under `http` must be     *
+    * configured in order for `secure: true` to work.                          *
+    *                                                                          *
+    * > While you might want to increase or decrease the `maxAge` or provide   *
+    * > other options, you should always set `secure: true` in production      *
+    * > if the app is being served over HTTPS.                                 *
+    *                                                                          *
+    * Read more:                                                               *
+    * https://sailsjs.com/config/session#?the-session-id-cookie                *
+    *                                                                          *
+    ***************************************************************************/
+    cookie: {
+      // secure: true,
+      maxAge: 24 * 60 * 60 * 1000,  // 24 hours
+    },
+
+  },
+
+
+
+  /**************************************************************************
+  *                                                                          *
+  * Set up Socket.io for your production environment.                        *
+  *                                                                          *
+  * (https://sailsjs.com/config/sockets)                                     *
+  *                                                                          *
+  * > If you have disabled the "sockets" hook, then you can safely remove    *
+  * > this section from your `config/env/production.js` file.                *
+  *                                                                          *
+  ***************************************************************************/
+  sockets: {
+
+    /***************************************************************************
+    *                                                                          *
+    * Uncomment the `onlyAllowOrigins` whitelist below to configure which      *
+    * "origins" are allowed to open socket connections to your Sails app.      *
+    *                                                                          *
+    * > Replace "https://example.com" etc. with the URL(s) of your app.        *
+    * > Be sure to use the right protocol!  ("http://" vs. "https://")         *
+    *                                                                          *
+    ***************************************************************************/
+    // onlyAllowOrigins: [
+    //   'https://example.com',
+    //   'https://staging.example.com',
+    // ],
+
+
+    /***************************************************************************
+    *                                                                          *
+    * If you are deploying a cluster of multiple servers and/or processes,     *
+    * then uncomment the following lines.  This tells Socket.io about a Redis  *
+    * server it can use to help it deliver broadcasted socket messages.        *
+    *                                                                          *
+    * > Be sure a compatible version of @sailshq/socket.io-redis is installed! *
+    * > (See https://sailsjs.com/config/sockets for the latest version info)   *
+    *                                                                          *
+    * (https://sailsjs.com/docs/concepts/deployment/scaling)                   *
+    *                                                                          *
+    ***************************************************************************/
+    // adapter: '@sailshq/socket.io-redis',
+    // url: 'redis://user:password@bigsquid.redistogo.com:9562/databasenumber',
+    //--------------------------------------------------------------------------
+    // /\   OR, to avoid checking it in to version control, you might opt to
+    // ||   set sensitive credentials like this using an environment variable.
+    //
+    // For example:
+    // ```
+    // sails_sockets__url=redis://admin:myc00lpAssw2D@bigsquid.redistogo.com:9562/0
+    // ```
+    //--------------------------------------------------------------------------
+
+  },
+
+
+
+  /**************************************************************************
+  *                                                                         *
+  * Set the production log level.                                           *
+  *                                                                         *
+  * (https://sailsjs.com/config/log)                                        *
+  *                                                                         *
+  ***************************************************************************/
+  log: {
+    level: 'debug'
+  },
+
+
+
+  http: {
+
+    /***************************************************************************
+    *                                                                          *
+    * The number of milliseconds to cache static assets in production.         *
+    * (the "max-age" to include in the "Cache-Control" response header)        *
+    *                                                                          *
+    * If you are caching assets with a tool like Cloudflare, you may want to   *
+    * reduce this considerably to allow more flexibility in purging the cache. *
+    *                                                                          *
+    ***************************************************************************/
+    cache: 365.25 * 24 * 60 * 60 * 1000, // One year
+
+    /***************************************************************************
+    *                                                                          *
+    * Proxy settings                                                           *
+    *                                                                          *
+    * If your app will be deployed behind a proxy/load balancer - for example, *
+    * on a PaaS like Heroku - then uncomment the `trustProxy` setting below.   *
+    * This tells Sails/Express how to interpret X-Forwarded headers.           *
+    *                                                                          *
+    * This setting is especially important if you are using secure cookies     *
+    * (see the `cookies: secure` setting under `session` above) or if your app *
+    * relies on knowing the original IP address that a request came from.      *
+    *                                                                          *
+    * (https://sailsjs.com/config/http)                                        *
+    *                                                                          *
+    ***************************************************************************/
+    // trustProxy: true,
+
+  },
+
+
+
+  /**************************************************************************
+  *                                                                         *
+  * Lift the server on port 80.                                             *
+  * (if deploying behind a proxy, or to a PaaS like Heroku or Deis, you     *
+  * probably don't need to set a port here, because it is oftentimes        *
+  * handled for you automatically.  If you are not sure if you need to set  *
+  * this, just try deploying without setting it and see if it works.)       *
+  *                                                                         *
+  ***************************************************************************/
+  // port: 80,
+
+
+
+  /**************************************************************************
+  *                                                                         *
+  * Configure an SSL certificate                                            *
+  *                                                                         *
+  * For the safety of your users' data, you should use SSL in production.   *
+  * ...But in many cases, you may not actually want to set it up _here_.    *
+  *                                                                         *
+  * Normally, this setting is only relevant when running a single-process   *
+  * deployment, with no proxy/load balancer in the mix.  But if, on the     *
+  * other hand, you are using a PaaS like Heroku, you'll want to set up     *
+  * SSL in your load balancer settings (usually somewhere in your hosting   *
+  * provider's dashboard-- not here.)                                       *
+  *                                                                         *
+  * > For more information about configuring SSL in Sails, see:             *
+  * > https://sailsjs.com/config/*#?sailsconfigssl                          *
+  *                                                                         *
+  **************************************************************************/
+  // ssl: undefined,
+
+
+
+  /**************************************************************************
+  *                                                                         *
+  * Production overrides for any custom settings specific to your app.      *
+  * (for example, production credentials for 3rd party APIs like Stripe)    *
+  *                                                                         *
+  * > See config/custom.js for more info on how to configure these options. *
+  *                                                                         *
+  ***************************************************************************/
+  custom: {
+    baseUrl: 'https://example.com',
+    internalEmailAddress: 'support@example.com',
+
+    // sendgridSecret: 'SG.fake.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU',
+    // stripeSecret: 'sk_prod__fake_Nfgh82401348jaDa3lkZ0d9Hm',
+    //--------------------------------------------------------------------------
+    // /\   OR, to avoid checking them in to version control, you might opt to
+    // ||   set sensitive credentials like these using environment variables.
+    //
+    // For example:
+    // ```
+    // sendgridSecret=SG.fake.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU
+    // sails_custom__stripeSecret=sk_prod__fake_Nfgh82401348jaDa3lkZ0d9Hm
+    // ```
+    //--------------------------------------------------------------------------
+
+  },
+
+
+
+};
diff --git a/ee/bulk-operations-dashboard/config/env/staging.js b/ee/bulk-operations-dashboard/config/env/staging.js
new file mode 100644
index 000000000000..226bdbe31436
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/env/staging.js
@@ -0,0 +1,96 @@
+/**
+ * Staging environment settings
+ * (sails.config.*)
+ *
+ * This is mostly a carbon copy of the production environment settings
+ * in config/env/production.js, but with the overrides listed below.
+ * For more detailed information and links about what these settings do
+ * see the production config file.
+ *
+ * > This file takes effect when `sails.config.environment` is "staging".
+ * > But note that NODE_ENV should still be "production" when lifting
+ * > your app in the staging environment.  In other words:
+ * > ```
+ * >     NODE_ENV=production sails_environment=staging node app
+ * > ```
+ *
+ * If you're unsure or want advice, stop by:
+ * https://sailsjs.com/support
+ */
+
+var PRODUCTION_CONFIG = require('./production');
+//--------------------------------------------------------------------------
+// /\  Start with your production config, even if it's just a guess for now,
+// ||  then configure your staging environment afterwards.
+//     (That way, all you need to do in this file is set overrides.)
+//--------------------------------------------------------------------------
+
+module.exports = Object.assign({}, PRODUCTION_CONFIG, {
+
+  datastores: Object.assign({}, PRODUCTION_CONFIG.datastores, {
+    default: Object.assign({}, PRODUCTION_CONFIG.datastores.default, {
+      // url: 'mysql://shared:some_password_everyone_knows@db.example.com:3306/my_staging_db',
+      //--------------------------------------------------------------------------
+      // /\  Hard-code your staging db `url`.
+      // ||  (or use system env var: `sails_datastores__default__url`)
+      //--------------------------------------------------------------------------
+    })
+  }),
+
+  sockets: Object.assign({}, PRODUCTION_CONFIG.sockets, {
+
+    onlyAllowOrigins: [
+      'http://localhost:1337',
+      // 'https://example-staging.herokuapp.com',
+      // 'http://example-staging.herokuapp.com',
+      // 'https://staging.example.com',
+      // 'http://staging.example.com',
+    ],
+    //--------------------------------------------------------------------------
+    // /\  Hard-code a staging-only override for allowed origins.
+    // ||  (or set this array via JSON-encoded system env var)
+    //     ```
+    //     sails_sockets__onlyAllowOrigins='["http://localhost:1337", "…"]'
+    //     ```
+    //--------------------------------------------------------------------------
+
+    // url: 'redis://shared:some_password_everyone_knows@bigsquid.redistogo.com:9562/',
+    //--------------------------------------------------------------------------
+    // /\  Hard-code your staging Redis server's `url`.
+    // ||  (or use system env var: `sails_sockets__url`)
+    //--------------------------------------------------------------------------
+  }),
+
+  session: Object.assign({}, PRODUCTION_CONFIG.session, {
+    // url: 'redis://shared:some_password_everyone_knows@bigsquid.redistogo.com:9562/staging-sessions',
+    //--------------------------------------------------------------------------
+    // /\  Hard-code your staging Redis server's `url` again here.
+    // ||  (or use system env var: `sails_session__url`)
+    //--------------------------------------------------------------------------
+  }),
+
+  custom: Object.assign({}, PRODUCTION_CONFIG.custom, {
+
+    baseUrl: 'https://staging.example.com',
+    //--------------------------------------------------------------------------
+    // /\  Hard-code the base URL where your staging environment is hosted.
+    // ||  (or use system env var: `sails_custom__baseUrl`)
+    //--------------------------------------------------------------------------
+
+    internalEmailAddress: 'support+staging@example.com',
+    //--------------------------------------------------------------------------
+    // /\  Hard-code the email address that should receive support/contact form
+    // ||  messages in staging (or use `sails_custom__internalEmailAddress`)
+    //--------------------------------------------------------------------------
+
+    // sendgridSecret: 'SG.fake.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU',
+    // stripeSecret: 'sk_sandbox__fake_Nfgh82401348jaDa3lkZ0d9Hm',
+    // stripePublishableKey: 'pk_sandbox__fake_fKd3mZJs1mlYrzWt7JQtkcRb',
+    //--------------------------------------------------------------------------
+    // /\  Hard-code credentials to use in staging for other 3rd party APIs, etc.
+    // ||  (or use system environment variables prefixed with "sails_custom__")
+    //--------------------------------------------------------------------------
+
+  })
+
+});
diff --git a/ee/bulk-operations-dashboard/config/globals.js b/ee/bulk-operations-dashboard/config/globals.js
new file mode 100644
index 000000000000..f63701f9afa9
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/globals.js
@@ -0,0 +1,52 @@
+/**
+ * Global Variable Configuration
+ * (sails.config.globals)
+ *
+ * Configure which global variables which will be exposed
+ * automatically by Sails.
+ *
+ * For more information on any of these options, check out:
+ * https://sailsjs.com/config/globals
+ */
+
+module.exports.globals = {
+
+  /****************************************************************************
+  *                                                                           *
+  * Whether to expose the locally-installed Lodash as a global variable       *
+  * (`_`), making  it accessible throughout your app.                         *
+  *                                                                           *
+  ****************************************************************************/
+
+  _: require('@sailshq/lodash'),
+
+  /****************************************************************************
+  *                                                                           *
+  * This app was generated without a dependency on the "async" NPM package.   *
+  *                                                                           *
+  * > Don't worry!  This is totally unrelated to JavaScript's "async/await".  *
+  * > Your code can (and probably should) use `await` as much as possible.    *
+  *                                                                           *
+  ****************************************************************************/
+
+  async: false,
+
+  /****************************************************************************
+  *                                                                           *
+  * Whether to expose each of your app's models as global variables.          *
+  * (See the link at the top of this file for more information.)              *
+  *                                                                           *
+  ****************************************************************************/
+
+  models: true,
+
+  /****************************************************************************
+  *                                                                           *
+  * Whether to expose the Sails app instance as a global variable (`sails`),  *
+  * making it accessible throughout your app.                                 *
+  *                                                                           *
+  ****************************************************************************/
+
+  sails: true,
+
+};
diff --git a/ee/bulk-operations-dashboard/config/http.js b/ee/bulk-operations-dashboard/config/http.js
new file mode 100644
index 000000000000..3cf438f1ffcf
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/http.js
@@ -0,0 +1,60 @@
+/**
+ * HTTP Server Settings
+ * (sails.config.http)
+ *
+ * Configuration for the underlying HTTP server in Sails.
+ * (for additional recommended settings, see `config/env/production.js`)
+ *
+ * For more information on configuration, check out:
+ * https://sailsjs.com/config/http
+ */
+
+module.exports.http = {
+
+  /****************************************************************************
+  *                                                                           *
+  * Sails/Express middleware to run for every HTTP request.                   *
+  * (Only applies to HTTP requests -- not virtual WebSocket requests.)        *
+  *                                                                           *
+  * https://sailsjs.com/documentation/concepts/middleware                     *
+  *                                                                           *
+  ****************************************************************************/
+
+  middleware: {
+
+    /***************************************************************************
+    *                                                                          *
+    * The order in which middleware should be run for HTTP requests.           *
+    * (This Sails app's routes are handled by the "router" middleware below.)  *
+    *                                                                          *
+    ***************************************************************************/
+
+    // order: [
+    //   'cookieParser',
+    //   'session',
+    //   'bodyParser',
+    //   'compress',
+    //   'poweredBy',
+    //   'router',
+    //   'www',
+    //   'favicon',
+    // ],
+
+
+    /***************************************************************************
+    *                                                                          *
+    * The body parser that will handle incoming multipart HTTP requests.       *
+    *                                                                          *
+    * https://sailsjs.com/config/http#?customizing-the-body-parser             *
+    *                                                                          *
+    ***************************************************************************/
+
+    // bodyParser: (function _configureBodyParser(){
+    //   var skipper = require('skipper');
+    //   var middlewareFn = skipper({ strict: true });
+    //   return middlewareFn;
+    // })(),
+
+  },
+
+};
diff --git a/ee/bulk-operations-dashboard/config/i18n.js b/ee/bulk-operations-dashboard/config/i18n.js
new file mode 100644
index 000000000000..0b652d26b59c
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/i18n.js
@@ -0,0 +1,45 @@
+/**
+ * Internationalization / Localization Settings
+ * (sails.config.i18n)
+ *
+ * If your app will touch people from all over the world, i18n (or internationalization)
+ * may be an important part of your international strategy.
+ *
+ * For a complete list of options for Sails' built-in i18n support, see:
+ * https://sailsjs.com/config/i-18-n
+ *
+ * For more info on i18n in Sails in general, check out:
+ * https://sailsjs.com/docs/concepts/internationalization
+ */
+
+module.exports.i18n = {
+
+  /***************************************************************************
+  *                                                                          *
+  * Which locales are supported?                                             *
+  *                                                                          *
+  ***************************************************************************/
+
+  locales: ['en', 'es', 'fr', 'de'],
+
+  /****************************************************************************
+  *                                                                           *
+  * What is the default locale for the site? Note that this setting will be   *
+  * overridden for any request that sends an "Accept-Language" header (i.e.   *
+  * most browsers), but it's still useful if you need to localize the         *
+  * response for requests made by non-browser clients (e.g. cURL).            *
+  *                                                                           *
+  ****************************************************************************/
+
+  // defaultLocale: 'en',
+
+  /****************************************************************************
+  *                                                                           *
+  * Path (relative to app root) of directory to store locale (translation)    *
+  * files in.                                                                 *
+  *                                                                           *
+  ****************************************************************************/
+
+  // localesDirectory: 'config/locales'
+
+};
diff --git a/ee/bulk-operations-dashboard/config/locales/de.json b/ee/bulk-operations-dashboard/config/locales/de.json
new file mode 100644
index 000000000000..12f23d94a293
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/locales/de.json
@@ -0,0 +1,4 @@
+{
+  "Welcome": "Willkommen",
+  "A brand new app.": "Eine neue App."
+}
diff --git a/ee/bulk-operations-dashboard/config/locales/en.json b/ee/bulk-operations-dashboard/config/locales/en.json
new file mode 100644
index 000000000000..5989bd9df910
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/locales/en.json
@@ -0,0 +1,4 @@
+{
+  "Welcome": "Welcome",
+  "A brand new app.": "A brand new app."
+}
diff --git a/ee/bulk-operations-dashboard/config/locales/es.json b/ee/bulk-operations-dashboard/config/locales/es.json
new file mode 100644
index 000000000000..bc6edbf0364e
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/locales/es.json
@@ -0,0 +1,4 @@
+{
+  "Welcome": "Bienvenido",
+  "A brand new app.": "Una nueva aplicación."
+}
diff --git a/ee/bulk-operations-dashboard/config/locales/fr.json b/ee/bulk-operations-dashboard/config/locales/fr.json
new file mode 100644
index 000000000000..b5997400f663
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/locales/fr.json
@@ -0,0 +1,4 @@
+{
+  "Welcome": "Bienvenue",
+  "A brand new app.": "Une toute nouvelle application."
+}
diff --git a/ee/bulk-operations-dashboard/config/log.js b/ee/bulk-operations-dashboard/config/log.js
new file mode 100644
index 000000000000..1ef07f552381
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/log.js
@@ -0,0 +1,29 @@
+/**
+ * Built-in Log Configuration
+ * (sails.config.log)
+ *
+ * Configure the log level for your app, as well as the transport
+ * (Underneath the covers, Sails uses Winston for logging, which
+ * allows for some pretty neat custom transports/adapters for log messages)
+ *
+ * For more information on the Sails logger, check out:
+ * https://sailsjs.com/docs/concepts/logging
+ */
+
+module.exports.log = {
+
+  /***************************************************************************
+  *                                                                          *
+  * Valid `level` configs: i.e. the minimum log level to capture with        *
+  * sails.log.*()                                                            *
+  *                                                                          *
+  * The order of precedence for log levels from lowest to highest is:        *
+  * silly, verbose, info, debug, warn, error                                 *
+  *                                                                          *
+  * You may also set the level to "silent" to suppress all logs.             *
+  *                                                                          *
+  ***************************************************************************/
+
+  // level: 'info'
+
+};
diff --git a/ee/bulk-operations-dashboard/config/models.js b/ee/bulk-operations-dashboard/config/models.js
new file mode 100644
index 000000000000..54b2a2b27a55
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/models.js
@@ -0,0 +1,124 @@
+/**
+ * Default model settings
+ * (sails.config.models)
+ *
+ * Your default, project-wide model settings. Can also be overridden on a
+ * per-model basis by setting a top-level properties in the model definition.
+ *
+ * For details about all available model settings, see:
+ * https://sailsjs.com/config/models
+ *
+ * For more general background on Sails model settings, and how to configure
+ * them on a project-wide or per-model basis, see:
+ * https://sailsjs.com/docs/concepts/models-and-orm/model-settings
+ */
+
+module.exports.models = {
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Whether model methods like `.create()` and `.update()` should ignore     *
+  * (and refuse to persist) unrecognized data-- i.e. properties other than   *
+  * those explicitly defined by attributes in the model definition.          *
+  *                                                                          *
+  * To ease future maintenance of your code base, it is usually a good idea  *
+  * to set this to `true`.                                                   *
+  *                                                                          *
+  * > Note that `schema: false` is not supported by every database.          *
+  * > For example, if you are using a SQL database, then relevant models     *
+  * > are always effectively `schema: true`.  And if no `schema` setting is  *
+  * > provided whatsoever, the behavior is left up to the database adapter.  *
+  * >                                                                        *
+  * > For more info, see:                                                    *
+  * > https://sailsjs.com/docs/concepts/orm/model-settings#?schema           *
+  *                                                                          *
+  ***************************************************************************/
+
+  schema: true,
+
+
+  /***************************************************************************
+  *                                                                          *
+  * How and whether Sails will attempt to automatically rebuild the          *
+  * tables/collections/etc. in your schema.                                  *
+  *                                                                          *
+  * > Note that, when running in a production environment, this will be      *
+  * > automatically set to `migrate: 'safe'`, no matter what you configure   *
+  * > here.  This is a failsafe to prevent Sails from accidentally running   *
+  * > auto-migrations on your production database.                           *
+  * >                                                                        *
+  * > For more info, see:                                                    *
+  * > https://sailsjs.com/docs/concepts/orm/model-settings#?migrate          *
+  *                                                                          *
+  ***************************************************************************/
+
+  migrate: 'alter',
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Base attributes that are included in all of your models by default.      *
+  * By convention, this is your primary key attribute (`id`), as well as two *
+  * other timestamp attributes for tracking when records were last created   *
+  * or updated.                                                              *
+  *                                                                          *
+  * > For more info, see:                                                    *
+  * > https://sailsjs.com/docs/concepts/orm/model-settings#?attributes       *
+  *                                                                          *
+  ***************************************************************************/
+
+  attributes: {
+    createdAt: { type: 'number', autoCreatedAt: true, },
+    updatedAt: { type: 'number', autoUpdatedAt: true, },
+    id: { type: 'number', autoIncrement: true, },
+    //--------------------------------------------------------------------------
+    //  /\   Using MongoDB?
+    //  ||   Replace `id` above with this instead:
+    //
+    // ```
+    // id: { type: 'string', columnName: '_id' },
+    // ```
+    //
+    // Plus, don't forget to configure MongoDB as your default datastore:
+    // https://sailsjs.com/docs/tutorials/using-mongo-db
+    //--------------------------------------------------------------------------
+  },
+
+
+  /******************************************************************************
+  *                                                                             *
+  * The set of DEKs (data encryption keys) for at-rest encryption.              *
+  * i.e. when encrypting/decrypting data for attributes with `encrypt: true`.   *
+  *                                                                             *
+  * > The `default` DEK is used for all new encryptions, but multiple DEKs      *
+  * > can be configured to allow for key rotation.  In production, be sure to   *
+  * > manage these keys like you would any other sensitive credential.          *
+  *                                                                             *
+  * > For more info, see:                                                       *
+  * > https://sailsjs.com/docs/concepts/orm/model-settings#?dataEncryptionKeys  *
+  *                                                                             *
+  ******************************************************************************/
+
+  dataEncryptionKeys: {
+    default: 'J3CduoHoKsowsRtNmgabXSEBzO8rwaz9c+mHPJKvXeY='
+  },
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Whether or not implicit records for associations should be cleaned up    *
+  * automatically using the built-in polyfill.  This is especially useful    *
+  * during development with sails-disk.                                      *
+  *                                                                          *
+  * Depending on which databases you're using, you may want to disable this  *
+  * polyfill in your production environment.                                 *
+  *                                                                          *
+  * (For production configuration, see `config/env/production.js`.)          *
+  *                                                                          *
+  ***************************************************************************/
+
+  cascadeOnDestroy: true
+
+
+};
diff --git a/ee/bulk-operations-dashboard/config/policies.js b/ee/bulk-operations-dashboard/config/policies.js
new file mode 100644
index 000000000000..eaf06d11d962
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/policies.js
@@ -0,0 +1,21 @@
+/**
+ * Policy Mappings
+ * (sails.config.policies)
+ *
+ * Policies are simple functions which run **before** your actions.
+ *
+ * For more information on configuring policies, check out:
+ * https://sailsjs.com/docs/concepts/policies
+ */
+
+module.exports.policies = {
+
+  '*': 'is-logged-in',
+
+  // Bypass the `is-logged-in` policy for:
+  'entrance/*': true,
+  'account/logout': true,
+  'legal/view-terms': true,
+  'legal/view-privacy': true,
+
+};
diff --git a/ee/bulk-operations-dashboard/config/routes.js b/ee/bulk-operations-dashboard/config/routes.js
new file mode 100644
index 000000000000..0b106dc6f1cf
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/routes.js
@@ -0,0 +1,65 @@
+/**
+ * Route Mappings
+ * (sails.config.routes)
+ *
+ * Your routes tell Sails what to do each time it receives a request.
+ *
+ * For more information on configuring custom routes, check out:
+ * https://sailsjs.com/anatomy/config/routes-js
+ */
+
+module.exports.routes = {
+
+  //  ╦ ╦╔═╗╔╗ ╔═╗╔═╗╔═╗╔═╗╔═╗
+  //  ║║║║╣ ╠╩╗╠═╝╠═╣║ ╦║╣ ╚═╗
+  //  ╚╩╝╚═╝╚═╝╩  ╩ ╩╚═╝╚═╝╚═╝
+  'GET /profiles': { action: 'profiles/view-profiles' },
+  'GET /scripts': { action: 'scripts/view-scripts' },
+
+  'GET /email/confirm':      { action: 'entrance/confirm-email' },
+  'GET /email/confirmed':    { action: 'entrance/view-confirmed-email' },
+
+  'GET /login':              { action: 'entrance/view-login' },
+  'GET /password/forgot':    { action: 'entrance/view-forgot-password' },
+  'GET /password/new':       { action: 'entrance/view-new-password' },
+
+  'GET /account':            { action: 'account/view-account-overview' },
+  'GET /account/password':   { action: 'account/view-edit-password' },
+  'GET /account/profile':    { action: 'account/view-edit-profile' },
+
+
+  //  ╔╦╗╦╔═╗╔═╗  ╦═╗╔═╗╔╦╗╦╦═╗╔═╗╔═╗╔╦╗╔═╗   ┬   ╔╦╗╔═╗╦ ╦╔╗╔╦  ╔═╗╔═╗╔╦╗╔═╗
+  //  ║║║║╚═╗║    ╠╦╝║╣  ║║║╠╦╝║╣ ║   ║ ╚═╗  ┌┼─   ║║║ ║║║║║║║║  ║ ║╠═╣ ║║╚═╗
+  //  ╩ ╩╩╚═╝╚═╝  ╩╚═╚═╝═╩╝╩╩╚═╚═╝╚═╝ ╩ ╚═╝  └┘   ═╩╝╚═╝╚╩╝╝╚╝╩═╝╚═╝╩ ╩═╩╝╚═╝
+  '/terms':                   '/legal/terms',
+  '/logout':                  '/api/v1/account/logout',
+  '/':                        '/profiles',
+
+  //  ╦ ╦╔═╗╔╗ ╦ ╦╔═╗╔═╗╦╔═╔═╗
+  //  ║║║║╣ ╠╩╗╠═╣║ ║║ ║╠╩╗╚═╗
+  //  ╚╩╝╚═╝╚═╝╩ ╩╚═╝╚═╝╩ ╩╚═╝
+  // …
+
+
+  //  ╔═╗╔═╗╦  ╔═╗╔╗╔╔╦╗╔═╗╔═╗╦╔╗╔╔╦╗╔═╗
+  //  ╠═╣╠═╝║  ║╣ ║║║ ║║╠═╝║ ║║║║║ ║ ╚═╗
+  //  ╩ ╩╩  ╩  ╚═╝╝╚╝═╩╝╩  ╚═╝╩╝╚╝ ╩ ╚═╝
+  // Note that, in this app, these API endpoints may be accessed using the `Cloud.*()` methods
+  // from the Parasails library, or by using those method names as the `action` in <ajax-form>.
+  '/api/v1/account/logout':                              { action: 'account/logout' },
+  'PUT   /api/v1/account/update-password':               { action: 'account/update-password' },
+  'PUT   /api/v1/account/update-profile':                { action: 'account/update-profile' },
+  'PUT   /api/v1/entrance/login':                        { action: 'entrance/login' },
+  'POST  /api/v1/entrance/send-password-recovery-email': { action: 'entrance/send-password-recovery-email' },
+  'POST  /api/v1/entrance/update-password-and-login':    { action: 'entrance/update-password-and-login' },
+  'POST /api/v1/delete-profile':                         { action: 'profiles/delete-profile' },
+  'GET /download-profile':                               { action: 'profiles/download-profile' },
+  'POST /api/v1/upload-profile':                         { action: 'profiles/upload-profile' },
+  'POST /api/v1/edit-profile':                           { action: 'profiles/edit-profile' },
+  'GET /api/v1/get-profiles':                            { action: 'get-profiles' },
+  'GET /api/v1/get-scripts':                             { action: 'get-scripts' },
+  'POST /api/v1/delete-script':                          { action: 'scripts/delete-script' },
+  'GET /download-script':                                { action: 'scripts/download-script' },
+  'POST /api/v1/upload-script':                          { action: 'scripts/upload-script' },
+  'POST /api/v1/edit-script':                            { action: 'scripts/edit-script' },
+};
diff --git a/ee/bulk-operations-dashboard/config/security.js b/ee/bulk-operations-dashboard/config/security.js
new file mode 100644
index 000000000000..6b0de0c99973
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/security.js
@@ -0,0 +1,49 @@
+/**
+ * Security Settings
+ * (sails.config.security)
+ *
+ * These settings affect aspects of your app's security, such
+ * as how it deals with cross-origin requests (CORS) and which
+ * routes require a CSRF token to be included with the request.
+ *
+ * For an overview of how Sails handles security, see:
+ * https://sailsjs.com/documentation/concepts/security
+ *
+ * For additional options and more information, see:
+ * https://sailsjs.com/config/security
+ */
+
+module.exports.security = {
+
+  /***************************************************************************
+  *                                                                          *
+  * CORS is like a more modern version of JSONP-- it allows your application *
+  * to circumvent browsers' same-origin policy, so that the responses from   *
+  * your Sails app hosted on one domain (e.g. example.com) can be received   *
+  * in the client-side JavaScript code from a page you trust hosted on _some *
+  * other_ domain (e.g. trustedsite.net).                                    *
+  *                                                                          *
+  * For additional options and more information, see:                        *
+  * https://sailsjs.com/docs/concepts/security/cors                          *
+  *                                                                          *
+  ***************************************************************************/
+
+  // cors: {
+  //   allRoutes: false,
+  //   allowOrigins: '*',
+  //   allowCredentials: false,
+  // },
+
+
+  /****************************************************************************
+  *                                                                           *
+  * CSRF protection should be enabled for this application.                   *
+  *                                                                           *
+  * For more information, see:                                                *
+  * https://sailsjs.com/docs/concepts/security/csrf                           *
+  *                                                                           *
+  ****************************************************************************/
+
+  csrf: true
+
+};
diff --git a/ee/bulk-operations-dashboard/config/session.js b/ee/bulk-operations-dashboard/config/session.js
new file mode 100644
index 000000000000..7b21600ed77d
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/session.js
@@ -0,0 +1,39 @@
+/**
+ * Session Configuration
+ * (sails.config.session)
+ *
+ * Use the settings below to configure session integration in your app.
+ * (for additional recommended settings, see `config/env/production.js`)
+ *
+ * For all available options, see:
+ * https://sailsjs.com/config/session
+ */
+
+module.exports.session = {
+
+  /***************************************************************************
+  *                                                                          *
+  * Session secret is automatically generated when your new app is created   *
+  * Replace at your own risk in production-- you will invalidate the cookies *
+  * of your users, forcing them to log in again.                             *
+  *                                                                          *
+  ***************************************************************************/
+  secret: 'DUMMY_SECRET_REPLACED_IN_PROD',
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Customize when built-in session support will be skipped.                 *
+  *                                                                          *
+  * (Useful for performance tuning; particularly to avoid wasting cycles on  *
+  * session management when responding to simple requests for static assets, *
+  * like images or stylesheets.)                                             *
+  *                                                                          *
+  * https://sailsjs.com/config/session                                       *
+  *                                                                          *
+  ***************************************************************************/
+  // isSessionDisabled: function (req){
+  //   return !!req.path.match(req._sails.LOOKS_LIKE_ASSET_RX);
+  // },
+
+};
diff --git a/ee/bulk-operations-dashboard/config/sockets.js b/ee/bulk-operations-dashboard/config/sockets.js
new file mode 100644
index 000000000000..9f466a04d9d2
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/sockets.js
@@ -0,0 +1,82 @@
+/**
+ * WebSocket Server Settings
+ * (sails.config.sockets)
+ *
+ * Use the settings below to configure realtime functionality in your app.
+ * (for additional recommended settings, see `config/env/production.js`)
+ *
+ * For all available options, see:
+ * https://sailsjs.com/config/sockets
+ */
+
+module.exports.sockets = {
+
+  /***************************************************************************
+  *                                                                          *
+  * `transports`                                                             *
+  *                                                                          *
+  * The protocols or "transports" that socket clients are permitted to       *
+  * use when connecting and communicating with this Sails application.       *
+  *                                                                          *
+  * > Never change this here without also configuring `io.sails.transports`  *
+  * > in your client-side code.  If the client and the server are not using  *
+  * > the same array of transports, sockets will not work properly.          *
+  * >                                                                        *
+  * > For more info, see:                                                    *
+  * > https://sailsjs.com/docs/reference/web-sockets/socket-client           *
+  *                                                                          *
+  ***************************************************************************/
+
+  // transports: [ 'websocket' ],
+
+
+  /***************************************************************************
+  *                                                                          *
+  * `beforeConnect`                                                          *
+  *                                                                          *
+  * This custom beforeConnect function will be run each time BEFORE a new    *
+  * socket is allowed to connect, when the initial socket.io handshake is    *
+  * performed with the server.                                               *
+  *                                                                          *
+  * https://sailsjs.com/config/sockets#?beforeconnect                        *
+  *                                                                          *
+  ***************************************************************************/
+
+  // beforeConnect: function(handshake, proceed) {
+  //
+  //   // `true` allows the socket to connect.
+  //   // (`false` would reject the connection)
+  //   return proceed(undefined, true);
+  //
+  // },
+
+
+  /***************************************************************************
+  *                                                                          *
+  * `afterDisconnect`                                                        *
+  *                                                                          *
+  * This custom afterDisconnect function will be run each time a socket      *
+  * disconnects                                                              *
+  *                                                                          *
+  ***************************************************************************/
+
+  // afterDisconnect: function(session, socket, done) {
+  //
+  //   // By default: do nothing.
+  //   // (but always trigger the callback)
+  //   return done();
+  //
+  // },
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Whether to expose a 'GET /__getcookie' route that sets an HTTP-only      *
+  * session cookie.                                                          *
+  *                                                                          *
+  ***************************************************************************/
+
+  // grant3rdPartyCookie: true,
+
+
+};
diff --git a/ee/bulk-operations-dashboard/config/views.js b/ee/bulk-operations-dashboard/config/views.js
new file mode 100644
index 000000000000..55d0f9243baf
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/views.js
@@ -0,0 +1,41 @@
+/**
+ * View Engine Configuration
+ * (sails.config.views)
+ *
+ * Server-sent views are a secure and effective way to get your app up
+ * and running. Views are normally served from actions.  Below, you can
+ * configure your templating language/framework of choice and configure
+ * Sails' layout support.
+ *
+ * For details on available options for configuring server-side views, check out:
+ * https://sailsjs.com/config/views
+ *
+ * For more background information on views and partials in Sails, check out:
+ * https://sailsjs.com/docs/concepts/views
+ */
+
+module.exports.views = {
+
+  /***************************************************************************
+  *                                                                          *
+  * Extension to use for your views. When calling `res.view()` in an action, *
+  * you can leave this extension off. For example, calling                   *
+  * `res.view('homepage')` will (using default settings) look for a          *
+  * `views/homepage.ejs` file.                                               *
+  *                                                                          *
+  ***************************************************************************/
+
+  // extension: 'ejs',
+
+  /***************************************************************************
+  *                                                                          *
+  * The path (relative to the views directory, and without extension) to     *
+  * the default layout file to use, or `false` to disable layouts entirely.  *
+  *                                                                          *
+  * Note that layouts only work with the built-in EJS view engine!           *
+  *                                                                          *
+  ***************************************************************************/
+
+  layout: 'layouts/layout'
+
+};
diff --git a/ee/bulk-operations-dashboard/docker-compose.yaml b/ee/bulk-operations-dashboard/docker-compose.yaml
new file mode 100644
index 000000000000..8e808b3d33c7
--- /dev/null
+++ b/ee/bulk-operations-dashboard/docker-compose.yaml
@@ -0,0 +1,28 @@
+version: '3'
+services:
+  bulk-operations-dashboard:
+    build: .
+    ports:
+      - "1337:1337"
+    depends_on:
+      - postgres
+    environment:
+      sails_datastores__default__url: postgres://user:password@postgres:5432/dbname
+      sails_datastores__default__adapter: sails-postgresql
+      sails_sockets__url: redis://redis:6379
+      sails_session__url: redis://redis:6379
+      sails_models__migrate: safe
+      sails_custom__fleetBaseUrl: '' #Add the base url of your Fleet instance: ex: https://fleet.example.com
+      sails_custom__fleetApiToken: '' # Add the API token of an API-only user [?] Here's how you get one: https://fleetdm.com/docs/using-fleet/fleetctl-cli#get-the-api-token-of-an-api-only-user
+
+  postgres:
+    image: "postgres:alpine"
+    environment:
+      POSTGRES_USER: user
+      POSTGRES_PASSWORD: password
+      POSTGRES_DB: dbname
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+
+volumes:
+  pgdata:
diff --git a/ee/bulk-operations-dashboard/entrypoint.sh b/ee/bulk-operations-dashboard/entrypoint.sh
new file mode 100644
index 000000000000..bbec7ef5da6a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/entrypoint.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+if [ -z "$sails_custom__fleetBaseUrl" ] && [ -z "$sails_custom__fleetApiToken" ]; then
+  echo 'ERROR: Missing environment variables. Please set "sails_custom__fleetApiToken" and "sails_custom__fleetBaseUrl" and and try starting this container again'
+  exit 1
+elif [ -z "$sails_custom__fleetBaseUrl" ]; then
+  echo 'ERROR: Missing environment variables. Please set "sails_custom__fleetBaseUrl" and try starting this container again'
+  exit 1
+elif [ -z "$sails_custom__fleetApiToken" ]; then
+  echo 'ERROR: Missing environment variables. Please set "sails_custom__fleetApiToken" and and try starting this container again'
+  exit 1
+fi
+
+# Check if the vulnerability dashboard has been initialized before
+if [ ! -f "/usr/src/app/.initialized" ]; then
+  # if it hasn't, lift the app with in console mode with the --drop flag to create our databsae tables.
+  echo '.exit' | node ./node_modules/sails/bin/sails console --drop
+
+fi
+
+# Start the dashboard
+exec node app.js
diff --git a/ee/bulk-operations-dashboard/package.json b/ee/bulk-operations-dashboard/package.json
new file mode 100644
index 000000000000..01df4711c490
--- /dev/null
+++ b/ee/bulk-operations-dashboard/package.json
@@ -0,0 +1,44 @@
+{
+  "name": "bulk-operations-dashboard",
+  "private": true,
+  "version": "0.0.0",
+  "description": "a Sails application",
+  "keywords": [],
+  "dependencies": {
+    "@sailshq/connect-redis": "^6.1.3",
+    "@sailshq/lodash": "^3.10.6",
+    "@sailshq/socket.io-redis": "^6.1.2",
+    "sails": "^1.5.11",
+    "sails-hook-apianalytics": "^2.0.6",
+    "sails-hook-organics": "^2.2.2",
+    "sails-hook-orm": "^4.0.3",
+    "sails-hook-sockets": "^3.0.0",
+    "sails-hook-uploads": "^0.4.3",
+    "sails-postgresql": "^5.0.1"
+  },
+  "devDependencies": {
+    "eslint": "5.16.0",
+    "grunt": "1.0.4",
+    "htmlhint": "0.11.0",
+    "lesshint": "6.3.6",
+    "sails-hook-grunt": "^5.0.0"
+  },
+  "scripts": {
+    "start": "NODE_ENV=production node app.js",
+    "test": "npm run lint && npm run custom-tests && echo 'Done.'",
+    "lint": "./node_modules/eslint/bin/eslint.js . --max-warnings=0 --report-unused-disable-directives && echo '✔  Your .js files look so good.' && ./node_modules/htmlhint/bin/htmlhint -c ./.htmlhintrc views/*.ejs && ./node_modules/htmlhint/bin/htmlhint -c ./.htmlhintrc views/**/*.ejs && ./node_modules/htmlhint/bin/htmlhint -c ./.htmlhintrc views/**/**/*.ejs && ./node_modules/htmlhint/bin/htmlhint -c ./.htmlhintrc views/**/**/**/*.ejs && ./node_modules/htmlhint/bin/htmlhint -c ./.htmlhintrc views/**/**/**/**/*.ejs && ./node_modules/htmlhint/bin/htmlhint -c ./.htmlhintrc views/**/**/**/**/**/*.ejs && ./node_modules/htmlhint/bin/htmlhint -c ./.htmlhintrc views/**/**/**/**/**/**/*.ejs && echo '✔  So do your .ejs files.' && ./node_modules/lesshint/bin/lesshint assets/styles/ --max-warnings=0 && echo '✔  Your .less files look good, too.'",
+    "custom-tests": "echo \"(No other custom tests yet.)\" && echo",
+    "deploy": "echo 'This script assumes a dead-simple, opinionated setup on Heroku.' && echo 'But, of course, you can deploy your app anywhere you like.' && echo '(Node.js/Sails.js apps are supported on all modern hosting platforms.)' && echo && echo 'Warning: Specifically, this script assumes you are on the master branch, and that your app can be deployed simply by force-pushing on top of the *deploy* branch.  It will also temporarily use a local *predeploy* branch for preparing assets, that it will delete after it finishes.  Please make sure there is nothing you care about on either of these two branches!!!' && echo '' && echo '' && echo 'Preparing to deploy...' && echo '--' && git status && echo '' && echo '--' && echo 'I hope you are on the master branch and have everything committed/pulled/pushed and are completely up to date and stuff.' && echo '********************************************'  && echo '** IF NOT THEN PLEASE PRESS <CTRL+C> NOW! **' && echo '********************************************' && echo 'Press CTRL+C to cancel.' && echo '(you have five seconds)' && sleep 1 && echo '...4' && sleep 1 && echo '...3' && sleep 1 && echo '...2' && sleep 1 && echo '...1' && sleep 1  && echo '' && echo 'Alright, here we go.  No turning back now!' && echo 'Trying to switch to master branch...' && git checkout master && echo && echo 'OK.  Now wiping node_modules/ and running npm install...' && rm -rf node_modules && rm -rf package-lock.json && npm install && (git add package-lock.json && git commit -am 'AUTOMATED COMMIT: Did fresh npm install before deploying, and it caused something relevant (probably the package-lock.json file) to change!  This commit tracks that change.' || true) && echo 'Deploying as version:' && npm version patch && echo '' && git push origin master && git push --tags && (git branch -D predeploy > /dev/null 2>&1 || true) && git checkout -b predeploy && (echo 'Now building+minifying assets for production...' && echo '(Hang tight, this could take a while.)' && echo && node node_modules/grunt/bin/grunt buildProd || (echo && echo '------------------------------------------' && echo 'IMPORTANT!  IMPORTANT!  IMPORTANT!' && echo 'ERROR: Could not compile assets for production!' && echo && echo 'Attempting to recover automatically by stashing, ' && echo 'switching back to the master branch, and then ' && echo 'deleting the predeploy branch... ' && echo && echo 'After this, please fix the issues logged above' && echo 'and push that up.  Then, try deploying again.' && echo '------------------------------------------' && echo && echo 'Staging, deleting the predeploy branch, and switching back to master...' && git stash && git checkout master && git branch -D predeploy && false)) && mv www .www && git add .www && node -e 'sailsrc = JSON.parse(require(\"fs\").readFileSync(\"./.sailsrc\", \"utf8\"));  if (sailsrc.paths&&sailsrc.paths.public !== undefined || sailsrc.hooks&&sailsrc.hooks.grunt !== undefined) { throw new Error(\"Cannot complete deployment script: .sailsrc file has conflicting contents!  Please throw away this midway-complete deployment, switch back to your original branch (master), remove the conflicting stuff from .sailsrc, then commit and push that up.\"); }  sailsrc.paths = sailsrc.paths || {};  sailsrc.paths.public = \"./.www\";   sailsrc.hooks = sailsrc.hooks || {};  sailsrc.hooks.grunt = false;  require(\"fs\").writeFileSync(\"./.sailsrc\", JSON.stringify(sailsrc))' && git commit -am 'AUTOMATED COMMIT: Automatically bundling compiled assets as part of deploy, updating the EJS layout and .sailsrc file accordingly.' && git push origin predeploy && git checkout master && git push origin +predeploy:deploy && git push --tags && git branch -D predeploy && git push origin :predeploy && echo '' && echo '--' && echo 'OK, done.  It should be live momentarily on your staging environment.' && echo '(if you get impatient, check the Heroku dashboard for status)' && echo && echo 'Staging environment:' && echo ' 🌐–•  https://staging.example.com' && echo '       (hold ⌘ and click to open links in the terminal)' && echo && echo 'Please review that to make sure it looks good.' && echo 'When you are ready to go to production, visit your pipeline on Heroku and press the PROMOTE TO PRODUCTION button.'",
+    "build-for-prod": "echo 'Now building+minifying assets for production...' && echo '(Hang tight, this could take a while.)' && echo && node node_modules/grunt/bin/grunt buildProd || (echo && echo '------------------------------------------' && echo 'IMPORTANT!  IMPORTANT!  IMPORTANT!' && echo 'ERROR: Could not compile assets for production!' && echo && echo 'Please fix the issues logged above' && echo 'and push that up.  Then, try deploying again.' && echo '------------------------------------------' && echo) && mv www .www && node -e 'sailsrc = JSON.parse(require(\"fs\").readFileSync(\"./.sailsrc\", \"utf8\"));  if (sailsrc.paths&&sailsrc.paths.public !== undefined || sailsrc.hooks&&sailsrc.hooks.grunt !== undefined) { throw new Error(\"Cannot complete deployment script: .sailsrc file has conflicting contents!  Please remove the conflicting stuff from .sailsrc, then commit and push that up.\"); }  sailsrc.paths = sailsrc.paths || {};  sailsrc.paths.public = \"./.www\";   sailsrc.hooks = sailsrc.hooks || {};  sailsrc.hooks.grunt = false;  require(\"fs\").writeFileSync(\"./.sailsrc\", JSON.stringify(sailsrc))' && echo 'Build is complete.  Ready to deploy.'"
+  },
+  "main": "app.js",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/eashaw/bulk-operations-dashboard.git"
+  },
+  "author": "eashaw",
+  "license": "",
+  "engines": {
+    "node": "^18.18"
+  }
+}
diff --git a/ee/bulk-operations-dashboard/scripts/rebuild-cloud-sdk.js b/ee/bulk-operations-dashboard/scripts/rebuild-cloud-sdk.js
new file mode 100644
index 000000000000..ce6789911c01
--- /dev/null
+++ b/ee/bulk-operations-dashboard/scripts/rebuild-cloud-sdk.js
@@ -0,0 +1,134 @@
+module.exports = {
+
+  friendlyName: 'Rebuild Cloud SDK',
+
+
+  description: 'Regenerate the configuration for the "Cloud SDK" -- the JavaScript module used for AJAX and WebSockets.',
+
+
+  fn: async function(){
+
+    var path = require('path');
+
+    var endpointsByMethodName = {};
+    var extraEndpointsOnlyForTestsByMethodName = {};
+
+    for (let address in sails.config.routes) {
+      let target = sails.config.routes[address];
+
+      // If the route target is an array, then only consider
+      // the very last sub-target in the array.
+      if (_.isArray(target)) {
+        target = _.last(target);
+      }//fi
+
+      // Skip redirects
+      // (Note that, by doing this, we also skip traditional shorthand
+      // -- that's ok though.)
+      if (_.isString(target)) {
+        continue;
+      }
+
+      // Skip routes whose target doesn't contain `action` for any
+      // other miscellaneous reason.
+      if (!target.action) {
+        continue;
+      }
+
+      // Just about everything else gets a Cloud SDK method.
+
+      // We determine its name using the bare action name.
+      var bareActionName = _.last(target.action.split(/\//));
+      var methodName = _.camelCase(bareActionName);
+      var expandedAddress = sails.getRouteFor(target);
+
+      // Skip routes that just serve views.
+      // (but still generate them for use in tests, for convenience)
+      if (target.view || (bareActionName.match(/^view-/))) {
+        extraEndpointsOnlyForTestsByMethodName[methodName] = {
+          verb: (expandedAddress.method||'get').toUpperCase(),
+          url: expandedAddress.url
+        };
+        continue;
+      }//•
+
+      endpointsByMethodName[methodName] = {
+        verb: (expandedAddress.method||'get').toUpperCase(),
+        url: expandedAddress.url,
+      };
+
+      // If this is an actions2 action, then determine appropriate serial usage.
+      // (deduced the same way as helpers)
+      // > If there is no such action for some reason, then don't compile a
+      // > method for this one.
+      var requestable = sails.getActions()[target.action];
+      if (!requestable) {
+        sails.log.warn('Skipping unrecognized action: `'+target.action+'`');
+        continue;
+      }
+      var def = requestable.toJSON && requestable.toJSON();
+      if (def && def.fn) {
+        if (def.args !== undefined) {
+          endpointsByMethodName[methodName].args = def.args;
+        } else {
+          endpointsByMethodName[methodName].args = _.reduce(def.inputs, (args, inputDef, inputCodeName)=>{
+            args.push(inputCodeName);
+            return args;
+          }, []);
+        }
+      }
+
+      // And we determine whether it needs to communicate over WebSockets
+      // by checking for an additional property in the route target.
+      if (target.isSocket || target.hasSocketFeatures) {
+        endpointsByMethodName[methodName].protocol = 'io.socket';
+      }
+    }//∞
+
+    // Smash and rewrite the `cloud.setup.js` file in the assets folder to
+    // reflect the latest set of available cloud actions exposed by this Sails
+    // app (as determined by its routes above)
+    await sails.helpers.fs.write.with({
+      destination: path.resolve(sails.config.appPath, 'assets/js/cloud.setup.js'),
+      force: true,
+      string: ``+
+`/**
+ * cloud.setup.js
+ *
+ * Configuration for this Sails app's generated browser SDK ("Cloud").
+ *
+ * Above all, the purpose of this file is to provide endpoint definitions,
+ * each of which corresponds with one particular route+action on the server.
+ *
+ * > This file was automatically generated.
+ * > (To regenerate, run \`sails run rebuild-cloud-sdk\`)
+ */
+
+Cloud.setup({
+
+  /* eslint-disable */
+  methods: ${JSON.stringify(endpointsByMethodName)}
+  /* eslint-enable */
+
+});`+
+      `\n`
+    });
+
+    // Also, if a `test/` folder exists, set up a barebones bounce of this data
+    // as a JSON file inside of it, for testing purposes:
+    var hasTestFolder = await sails.helpers.fs.exists(path.resolve(sails.config.appPath, 'test/'));
+    if (hasTestFolder) {
+      await sails.helpers.fs.write.with({
+        destination: path.resolve(sails.config.appPath, 'test/private/CLOUD_SDK_METHODS.json'),
+        string: JSON.stringify(_.extend(endpointsByMethodName, extraEndpointsOnlyForTestsByMethodName)),
+        force: true
+      });
+    }
+
+    sails.log.info('--');
+    sails.log.info('Successfully rebuilt Cloud SDK for use in the browser.');
+    sails.log.info('(and CLOUD_SDK_METHODS.json for use in automated tests)');
+
+  }
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/babel.js b/ee/bulk-operations-dashboard/tasks/config/babel.js
new file mode 100644
index 000000000000..c9720a1bdfd7
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/babel.js
@@ -0,0 +1,54 @@
+/**
+ * `tasks/config/babel`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Transpile >=ES6 code for broader browser compatibility.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/babel.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('babel', {
+    dist: {
+      options: {
+        presets: [require('sails-hook-grunt/accessible/babel-preset-env')]
+      },
+      files: [
+        {
+          expand: true,
+          cwd: '.tmp/public',
+          src: ['js/**/*.js'],
+          dest: '.tmp/public'
+        }
+      ]
+    }
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-babel --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-babel');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/clean.js b/ee/bulk-operations-dashboard/tasks/config/clean.js
new file mode 100644
index 000000000000..a267b8dfd0bc
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/clean.js
@@ -0,0 +1,52 @@
+/**
+ * `tasks/config/clean`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Remove generated files and folders.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/clean.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('clean', {
+    dev: ['.tmp/public/**'],
+    build: ['www'],
+    afterBuildProd: [
+      'www/concat',
+      'www/min',
+      'www/hash',
+      'www/js',
+      'www/styles',
+      'www/templates',
+      'www/dependencies'
+    ]
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-contrib-clean --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-contrib-clean');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/concat.js b/ee/bulk-operations-dashboard/tasks/config/concat.js
new file mode 100644
index 000000000000..4a3530ceb402
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/concat.js
@@ -0,0 +1,50 @@
+/**
+ * `tasks/config/concat`
+ *
+ * ---------------------------------------------------------------
+ *
+ * An intermediate step to generate monolithic files that can
+ * then be passed in to `uglify` and/or `cssmin` for minification.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/concat.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('concat', {
+    js: {
+      src: require('../pipeline').jsFilesToInject,
+      dest: '.tmp/public/concat/production.js'
+    },
+    css: {
+      src: require('../pipeline').cssFilesToInject,
+      dest: '.tmp/public/concat/production.css'
+    }
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-contrib-concat --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-contrib-concat');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/copy.js b/ee/bulk-operations-dashboard/tasks/config/copy.js
new file mode 100644
index 000000000000..f06c50b7db09
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/copy.js
@@ -0,0 +1,65 @@
+/**
+ * `tasks/config/copy`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Copy files and/or folders.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/copy.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('copy', {
+    dev: {
+      files: [{
+        expand: true,
+        cwd: './assets',
+        src: ['**/*.!(coffee|less)'],
+        dest: '.tmp/public'
+      }]
+    },
+    build: {
+      files: [{
+        expand: true,
+        cwd: '.tmp/public',
+        src: ['**/*'],
+        dest: 'www'
+      }]
+    },
+    beforeLinkBuildProd: {
+      files: [{
+        expand: true,
+        cwd: '.tmp/public/hash',
+        src: ['**/*'],
+        dest: '.tmp/public/dist'
+      }]
+    },
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-contrib-copy --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-contrib-copy');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/cssmin.js b/ee/bulk-operations-dashboard/tasks/config/cssmin.js
new file mode 100644
index 000000000000..e3f3edf5b398
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/cssmin.js
@@ -0,0 +1,47 @@
+/**
+ * `tasks/config/cssmin`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Together with the `concat` task, this is the final step that minifies
+ * all CSS files from `assets/styles/` (and potentially your LESS importer
+ * file from `assets/styles/importer.less`)
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/cssmin.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('cssmin', {
+    dist: {
+      src: ['.tmp/public/concat/production.css'],
+      dest: '.tmp/public/min/production.min.css'
+    }
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-contrib-cssmin --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-contrib-cssmin');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/hash.js b/ee/bulk-operations-dashboard/tasks/config/hash.js
new file mode 100644
index 000000000000..41435ac855cc
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/hash.js
@@ -0,0 +1,62 @@
+/**
+ * `tasks/config/hash`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Implement cache-busting for minified CSS and JavaScript files.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/hash.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('hash', {
+    options: {
+      mapping: '',
+      srcBasePath: '',
+      destBasePath: '',
+      flatten: false,
+      hashLength: 8,
+      hashFunction: function(source, encoding){
+        if (!source || !encoding) {
+          throw new Error('Consistency violation: Cannot compute unique hash for production .css/.js cache-busting suffix, because `source` and/or `encoding` are falsey-- but they should be truthy strings!  Here they are, respectively:\nsource: '+require('util').inspect(source, {depth:null})+'\nencoding: '+require('util').inspect(encoding, {depth:null}));
+        }
+        return require('crypto').createHash('sha1').update(source, encoding).digest('hex');
+      }
+    },
+    js: {
+      src: '.tmp/public/min/*.js',
+      dest: '.tmp/public/hash/'
+    },
+    css: {
+      src: '.tmp/public/min/*.css',
+      dest: '.tmp/public/hash/'
+    }
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-hash --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-hash');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/less.js b/ee/bulk-operations-dashboard/tasks/config/less.js
new file mode 100644
index 000000000000..06e3a0806a49
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/less.js
@@ -0,0 +1,50 @@
+/**
+ * `tasks/config/less`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Compile your LESS files into a CSS stylesheet.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/less.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('less', {
+    dev: {
+      files: [{
+        expand: true,
+        cwd: 'assets/styles/',
+        src: ['importer.less'],
+        dest: '.tmp/public/styles/',
+        ext: '.css'
+      }]
+    }
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-contrib-less --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-contrib-less');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/sails-linker.js b/ee/bulk-operations-dashboard/tasks/config/sails-linker.js
new file mode 100644
index 000000000000..c197efbfc0ac
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/sails-linker.js
@@ -0,0 +1,184 @@
+/**
+ * `tasks/config/sails-linker`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Automatically inject <script> tags and <link> tags into the specified
+ * specified HTML and/or EJS files.  The specified delimiters (`startTag`
+ * and `endTag`) determine the insertion points.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/sails-linker.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('sails-linker', {
+
+
+    //   ╦╔═╗╦  ╦╔═╗╔═╗╔═╗╦═╗╦╔═╗╔╦╗
+    //   ║╠═╣╚╗╔╝╠═╣╚═╗║  ╠╦╝║╠═╝ ║
+    //  ╚╝╩ ╩ ╚╝ ╩ ╩╚═╝╚═╝╩╚═╩╩   ╩
+    //  ┌─    ┌─┐┬  ┬┌─┐┌┐┌┌┬┐  ┌─┐┬┌┬┐┌─┐   ┬┌─┐┬  ┬┌─┐┌─┐┌─┐┬─┐┬┌─┐┌┬┐    ─┐
+    //  │───  │  │  │├┤ │││ │───└─┐│ ││├┤    │├─┤└┐┌┘├─┤└─┐│  ├┬┘│├─┘ │   ───│
+    //  └─    └─┘┴─┘┴└─┘┘└┘ ┴   └─┘┴─┴┘└─┘  └┘┴ ┴ └┘ ┴ ┴└─┘└─┘┴└─┴┴   ┴     ─┘
+    devJs: {
+      options: {
+        startTag: '<!--SCRIPTS-->',
+        endTag: '<!--SCRIPTS END-->',
+        fileTmpl: '<script src="%s"></script>',
+        appRoot: '.tmp/public'
+      },
+      files: {
+        '.tmp/public/**/*.html': require('../pipeline').jsFilesToInject,
+        'views/**/*.html': require('../pipeline').jsFilesToInject,
+        'views/**/*.ejs': require('../pipeline').jsFilesToInject
+      }
+    },
+
+    devJsBuild: {
+      options: {
+        startTag: '<!--SCRIPTS-->',
+        endTag: '<!--SCRIPTS END-->',
+        fileTmpl: '<script src="%s"></script>',
+        appRoot: '.tmp/public',
+        // relative: true
+        // ^^ Uncomment this if compiling assets for use in PhoneGap, CDN, etc.
+        //    (but be note that this can break custom font URLs)
+      },
+      files: {
+        '.tmp/public/**/*.html': require('../pipeline').jsFilesToInject,
+        'views/**/*.html': require('../pipeline').jsFilesToInject,
+        'views/**/*.ejs': require('../pipeline').jsFilesToInject
+      }
+    },
+
+    prodJs: {
+      options: {
+        startTag: '<!--SCRIPTS-->',
+        endTag: '<!--SCRIPTS END-->',
+        fileTmpl: '<script src="%s"></script>',
+        appRoot: '.tmp/public'
+      },
+      files: {
+        '.tmp/public/**/*.html': ['.tmp/public/min/production.min.js'],
+        'views/**/*.html': ['.tmp/public/min/production.min.js'],
+        'views/**/*.ejs': ['.tmp/public/min/production.min.js']
+      }
+    },
+
+    prodJsBuild: {
+      options: {
+        startTag: '<!--SCRIPTS-->',
+        endTag: '<!--SCRIPTS END-->',
+        fileTmpl: '<script src="%s"></script>',
+        appRoot: '.tmp/public',
+        // relative: true
+        // ^^ Uncomment this if compiling assets for use in PhoneGap, CDN, etc.
+        //    (but be note that this can break custom font URLs)
+      },
+      files: {
+        '.tmp/public/**/*.html': ['.tmp/public/dist/*.js'],
+        'views/**/*.html': ['.tmp/public/dist/*.js'],
+        'views/**/*.ejs': ['.tmp/public/dist/*.js']
+      }
+    },
+
+
+    //  ╔═╗╔╦╗╦ ╦╦  ╔═╗╔═╗╦ ╦╔═╗╔═╗╔╦╗╔═╗
+    //  ╚═╗ ║ ╚╦╝║  ║╣ ╚═╗╠═╣║╣ ║╣  ║ ╚═╗
+    //  ╚═╝ ╩  ╩ ╩═╝╚═╝╚═╝╩ ╩╚═╝╚═╝ ╩ ╚═╝
+    //  ┌─    ┬┌┐┌┌─┐┬  ┬ ┬┌┬┐┬┌┐┌┌─┐  ╔═╗╔═╗╔═╗   ┬   ┌─┐┌─┐┌┬┐┌─┐┬┬  ┌─┐┌┬┐  ╦  ╔═╗╔═╗╔═╗    ─┐
+    //  │───  │││││  │  │ │ │││││││ ┬  ║  ╚═╗╚═╗  ┌┼─  │  │ ││││├─┘││  ├┤  ││  ║  ║╣ ╚═╗╚═╗  ───│
+    //  └─    ┴┘└┘└─┘┴─┘└─┘─┴┘┴┘└┘└─┘  ╚═╝╚═╝╚═╝  └┘   └─┘└─┘┴ ┴┴  ┴┴─┘└─┘─┴┘  ╩═╝╚═╝╚═╝╚═╝    ─┘
+    devStyles: {
+      options: {
+        startTag: '<!--STYLES-->',
+        endTag: '<!--STYLES END-->',
+        fileTmpl: '<link rel="stylesheet" href="%s">',
+        appRoot: '.tmp/public'
+      },
+
+      files: {
+        '.tmp/public/**/*.html': require('../pipeline').cssFilesToInject,
+        'views/**/*.html': require('../pipeline').cssFilesToInject,
+        'views/**/*.ejs': require('../pipeline').cssFilesToInject
+      }
+    },
+
+    devStylesBuild: {
+      options: {
+        startTag: '<!--STYLES-->',
+        endTag: '<!--STYLES END-->',
+        fileTmpl: '<link rel="stylesheet" href="%s">',
+        appRoot: '.tmp/public',
+        // relative: true
+        // ^^ Uncomment this if compiling assets for use in PhoneGap, CDN, etc.
+        //    (but be note that this can break custom font URLs)
+      },
+
+      files: {
+        '.tmp/public/**/*.html': require('../pipeline').cssFilesToInject,
+        'views/**/*.html': require('../pipeline').cssFilesToInject,
+        'views/**/*.ejs': require('../pipeline').cssFilesToInject
+      }
+    },
+
+    prodStyles: {
+      options: {
+        startTag: '<!--STYLES-->',
+        endTag: '<!--STYLES END-->',
+        fileTmpl: '<link rel="stylesheet" href="%s">',
+        appRoot: '.tmp/public'
+      },
+      files: {
+        '.tmp/public/index.html': ['.tmp/public/min/production.min.css'],
+        'views/**/*.html': ['.tmp/public/min/production.min.css'],
+        'views/**/*.ejs': ['.tmp/public/min/production.min.css']
+      }
+    },
+
+    prodStylesBuild: {
+      options: {
+        startTag: '<!--STYLES-->',
+        endTag: '<!--STYLES END-->',
+        fileTmpl: '<link rel="stylesheet" href="%s">',
+        appRoot: '.tmp/public',
+        // relative: true
+        // ^^ Uncomment this if compiling assets for use in PhoneGap, CDN, etc.
+        //    (but be note that this can break custom font URLs)
+      },
+      files: {
+        '.tmp/public/index.html': ['.tmp/public/dist/*.css'],
+        'views/**/*.html': ['.tmp/public/dist/*.css'],
+        'views/**/*.ejs': ['.tmp/public/dist/*.css']
+      }
+    },
+
+  });//</ grunt.config.set() >
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-sails-linker --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-sails-linker');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/sync.js b/ee/bulk-operations-dashboard/tasks/config/sync.js
new file mode 100644
index 000000000000..23ff3b87c2f7
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/sync.js
@@ -0,0 +1,49 @@
+/**
+ * `tasks/config/sync`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Synchronize files from the `assets` folder to `.tmp/public`,
+ * smashing anything that's already there.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/sync.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('sync', {
+    dev: {
+      files: [{
+        cwd: './assets',
+        src: ['**/*.!(coffee|less)'],
+        dest: '.tmp/public'
+      }]
+    }
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-sync --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-sync');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/uglify.js b/ee/bulk-operations-dashboard/tasks/config/uglify.js
new file mode 100644
index 000000000000..34f591c7a0a7
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/uglify.js
@@ -0,0 +1,64 @@
+/**
+ * `tasks/config/uglify`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Minify client-side JavaScript files using UglifyES.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/uglify.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('uglify', {
+    dist: {
+      src: ['.tmp/public/concat/production.js'],
+      dest: '.tmp/public/min/production.min.js'
+    },
+    options: {
+      mangle: {
+        reserved: [
+          'AsyncFunction',
+          'SailsSocket',
+          'Promise',
+          'File',
+          'FileList',
+          'FormData',
+          'Location',
+          'RttcRefPlaceholder',
+        ],
+        keep_fnames: true//eslint-disable-line
+      },
+      compress: {
+        keep_fnames: true//eslint-disable-line
+      }
+    }
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-contrib-uglify --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-contrib-uglify');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
+
diff --git a/ee/bulk-operations-dashboard/tasks/config/watch.js b/ee/bulk-operations-dashboard/tasks/config/watch.js
new file mode 100644
index 000000000000..611e29770534
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/watch.js
@@ -0,0 +1,56 @@
+/**
+ * `tasks/config/watch`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Run predefined tasks whenever certain files are added, changed or deleted.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/watch.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('watch', {
+    assets: {
+
+      // Assets to watch:
+      files: [
+        'assets/**/*',
+        'tasks/pipeline.js',
+        '!**/node_modules/**'
+      ],
+
+      // When assets are changed:
+      tasks: [
+        'syncAssets',
+        'linkAssets'
+      ]
+    }
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-contrib-watch --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-contrib-watch');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/pipeline.js b/ee/bulk-operations-dashboard/tasks/pipeline.js
new file mode 100644
index 000000000000..d6bb9e47e29c
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/pipeline.js
@@ -0,0 +1,158 @@
+/**
+ * tasks/pipeline.js
+ *
+ * The order in which your CSS, JavaScript, and client-side template files
+ * injected as <script> or <link> tags.
+ *
+ * > If you are not relying on automatic asset linking, then you can safely ignore this file.
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/pipeline.js
+ */
+
+
+
+//  ██████╗ ██╗      █████╗ ██╗███╗   ██╗        ██████╗███████╗███████╗
+//  ██╔══██╗██║     ██╔══██╗██║████╗  ██║       ██╔════╝██╔════╝██╔════╝
+//  ██████╔╝██║     ███████║██║██╔██╗ ██║       ██║     ███████╗███████╗
+//  ██╔═══╝ ██║     ██╔══██║██║██║╚██╗██║       ██║     ╚════██║╚════██║
+//  ██║     ███████╗██║  ██║██║██║ ╚████║    ██╗╚██████╗███████║███████║
+//  ╚═╝     ╚══════╝╚═╝  ╚═╝╚═╝╚═╝  ╚═══╝    ╚═╝ ╚═════╝╚══════╝╚══════╝
+//
+//  ███████╗██╗██╗     ███████╗███████╗
+//  ██╔════╝██║██║     ██╔════╝██╔════╝
+//  █████╗  ██║██║     █████╗  ███████╗
+//  ██╔══╝  ██║██║     ██╔══╝  ╚════██║
+//  ██║     ██║███████╗███████╗███████║
+//  ╚═╝     ╚═╝╚══════╝╚══════╝╚══════╝
+//
+// CSS files to inject as <link> tags, in order.
+//
+// > Note: if you're using built-in LESS support with default settings,
+// > you'll want to change `assets/styles/importer.less` instead.
+//
+var cssFilesToInject = [
+
+  // Bring in `.css` files for themes and style guides (e.g. Bootstrap, Foundation)
+  'dependencies/**/*.css',
+
+  // All of the rest of your custom `.css` files will be injected here,
+  // in no particular order.  To customize the ordering, add additional
+  // items here, _above_ this one.
+  'styles/**/*.css'
+];
+
+
+//   ██████╗██╗     ██╗███████╗███╗   ██╗████████╗   ███████╗██╗██████╗ ███████╗
+//  ██╔════╝██║     ██║██╔════╝████╗  ██║╚══██╔══╝   ██╔════╝██║██╔══██╗██╔════╝
+//  ██║     ██║     ██║█████╗  ██╔██╗ ██║   ██║█████╗███████╗██║██║  ██║█████╗
+//  ██║     ██║     ██║██╔══╝  ██║╚██╗██║   ██║╚════╝╚════██║██║██║  ██║██╔══╝
+//  ╚██████╗███████╗██║███████╗██║ ╚████║   ██║      ███████║██║██████╔╝███████╗
+//   ╚═════╝╚══════╝╚═╝╚══════╝╚═╝  ╚═══╝   ╚═╝      ╚══════╝╚═╝╚═════╝ ╚══════╝
+//
+//          ██╗███████╗    ███████╗██╗██╗     ███████╗███████╗
+//          ██║██╔════╝    ██╔════╝██║██║     ██╔════╝██╔════╝
+//          ██║███████╗    █████╗  ██║██║     █████╗  ███████╗
+//     ██   ██║╚════██║    ██╔══╝  ██║██║     ██╔══╝  ╚════██║
+//  ██╗╚█████╔╝███████║    ██║     ██║███████╗███████╗███████║
+//  ╚═╝ ╚════╝ ╚══════╝    ╚═╝     ╚═╝╚══════╝╚══════╝╚══════╝
+//
+// Client-side javascript files to inject as <script> tags, in order.
+//
+var jsFilesToInject = [
+
+  // Load `sails.io` before everything else.
+  'dependencies/sails.io.js',
+
+  // Bring in `.js` files for any other client-side JavaScript dependencies.
+  // (e.g. Lodash, Vue.js, jQuery, Bootstrap, Ember, Angular, etc.)
+  // > Be sure to list dependencies that depend on each other in the right order!
+  'dependencies/lodash.js',
+  'dependencies/jquery.min.js',
+  'dependencies/vue.js',
+  'dependencies/vue-router.js',
+  'dependencies/**/*.js',
+
+  // First amongst the app-level files, bring in cloud configuration
+  'js/cloud.setup.js',
+
+  // Bring in components & utilities before bringing in the rest (i.e. page scripts)
+  'js/components/**/*.js',
+  'js/utilities/**/*.js',
+
+  // All of the rest of your custom client-side js files will be injected here,
+  // in no particular order.  To customize the ordering, add additional items
+  // here, _above_ this one.
+  'js/**/*.js'
+];
+
+
+//   ██████╗██╗     ██╗███████╗███╗   ██╗████████╗   ███████╗██╗██████╗ ███████╗
+//  ██╔════╝██║     ██║██╔════╝████╗  ██║╚══██╔══╝   ██╔════╝██║██╔══██╗██╔════╝
+//  ██║     ██║     ██║█████╗  ██╔██╗ ██║   ██║█████╗███████╗██║██║  ██║█████╗
+//  ██║     ██║     ██║██╔══╝  ██║╚██╗██║   ██║╚════╝╚════██║██║██║  ██║██╔══╝
+//  ╚██████╗███████╗██║███████╗██║ ╚████║   ██║      ███████║██║██████╔╝███████╗
+//   ╚═════╝╚══════╝╚═╝╚══════╝╚═╝  ╚═══╝   ╚═╝      ╚══════╝╚═╝╚═════╝ ╚══════╝
+//
+//  ████████╗███████╗███╗   ███╗██████╗ ██╗      █████╗ ████████╗███████╗███████╗
+//  ╚══██╔══╝██╔════╝████╗ ████║██╔══██╗██║     ██╔══██╗╚══██╔══╝██╔════╝██╔════╝
+//     ██║   █████╗  ██╔████╔██║██████╔╝██║     ███████║   ██║   █████╗  ███████╗
+//     ██║   ██╔══╝  ██║╚██╔╝██║██╔═══╝ ██║     ██╔══██║   ██║   ██╔══╝  ╚════██║
+//     ██║   ███████╗██║ ╚═╝ ██║██║     ███████╗██║  ██║   ██║   ███████╗███████║
+//     ╚═╝   ╚══════╝╚═╝     ╚═╝╚═╝     ╚══════╝╚═╝  ╚═╝   ╚═╝   ╚══════╝╚══════╝
+//
+// Client-side HTML templates to precompile and inject as a single <script> tag.
+// (The ordering of this array shouldn't matter.)
+//
+// > By default, Sails uses JST (~=lodash/underscore) templates and precompiles
+// > them into functions for you.  If you want to use handlebars, pug, dust, etc.,
+// > with the asset linker, no problem-- you'll just want to make sure the precompiled
+// > templates get spit out to the same file.  For information on customizing and
+// > installing your own Grunt tasks or using a different build pipeline, be sure
+// > to check out:
+// >   https://sailsjs.com/docs/concepts/assets/task-automation
+//
+var templateFilesToInject = [
+  'templates/**/*.html'
+];
+
+
+
+//  ███╗   ███╗██╗███████╗ ██████╗       ███████╗███████╗████████╗██╗   ██╗██████╗
+//  ████╗ ████║██║██╔════╝██╔════╝       ██╔════╝██╔════╝╚══██╔══╝██║   ██║██╔══██╗
+//  ██╔████╔██║██║███████╗██║            ███████╗█████╗     ██║   ██║   ██║██████╔╝
+//  ██║╚██╔╝██║██║╚════██║██║            ╚════██║██╔══╝     ██║   ██║   ██║██╔═══╝
+//  ██║ ╚═╝ ██║██║███████║╚██████╗██╗    ███████║███████╗   ██║   ╚██████╔╝██║
+//  ╚═╝     ╚═╝╚═╝╚══════╝ ╚═════╝╚═╝    ╚══════╝╚══════╝   ╚═╝    ╚═════╝ ╚═╝
+//
+// The following code exists to parse the arrays of glob expressions above, and
+// then expose them via `module.exports`.  **You should not need to change any of
+// the code below, unless you are modifying the default asset pipeline.**
+
+// Default path for public folder (see documentation on sailsjs.com for more information)
+var tmpPath = '.tmp/public/';
+
+// Prefix relative paths to source files so they point to the proper locations
+// (i.e. where the other Grunt tasks spit them out, or in some cases, where
+// they reside in the first place)
+module.exports.cssFilesToInject = cssFilesToInject.map((cssPath)=>{
+  // If we're ignoring the file, make sure the ! is at the beginning of the path
+  if (cssPath[0] === '!') {
+    return require('path').join('!' + tmpPath, cssPath.substr(1));
+  }
+  return require('path').join(tmpPath, cssPath);
+});
+module.exports.jsFilesToInject = jsFilesToInject.map((jsPath)=>{
+  // If we're ignoring the file, make sure the ! is at the beginning of the path
+  if (jsPath[0] === '!') {
+    return require('path').join('!' + tmpPath, jsPath.substr(1));
+  }
+  return require('path').join(tmpPath, jsPath);
+});
+module.exports.templateFilesToInject = templateFilesToInject.map((tplPath)=>{
+  // If we're ignoring the file, make sure the ! is at the beginning of the path
+  if (tplPath[0] === '!') {
+    return require('path').join('!assets/', tplPath.substr(1));
+  }
+  return require('path').join('assets/', tplPath);
+});
diff --git a/ee/bulk-operations-dashboard/tasks/register/build.js b/ee/bulk-operations-dashboard/tasks/register/build.js
new file mode 100644
index 000000000000..684b10ddd291
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/build.js
@@ -0,0 +1,22 @@
+/**
+ * `tasks/register/build.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * This Grunt tasklist will be executed if you run `sails www` or
+ * `grunt build` in a development environment.
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/build.js
+ *
+ */
+module.exports = function(grunt) {
+  grunt.registerTask('build', [
+    // 'polyfill:dev', //« uncomment to ALSO transpile during development (for broader browser compat.)
+    'compileAssets',
+    // 'babel',        //« uncomment to ALSO transpile during development (for broader browser compat.)
+    'linkAssetsBuild',
+    'clean:build',
+    'copy:build'
+  ]);
+};
diff --git a/ee/bulk-operations-dashboard/tasks/register/buildProd.js b/ee/bulk-operations-dashboard/tasks/register/buildProd.js
new file mode 100644
index 000000000000..67fdb8964c07
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/buildProd.js
@@ -0,0 +1,30 @@
+/**
+ * `tasks/register/buildProd.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * This Grunt tasklist will be executed instead of `build` if you
+ * run `sails www` in a production environment, e.g.:
+ * `NODE_ENV=production sails www`
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/build-prod.js
+ *
+ */
+module.exports = function(grunt) {
+  grunt.registerTask('buildProd', [
+    'polyfill:prod', //« Remove this to skip transpilation in production (not recommended)
+    'compileAssets',
+    'babel',         //« Remove this to skip transpilation in production (not recommended)
+    'concat',
+    'uglify',
+    'cssmin',
+    'hash',//« Cache-busting
+    'copy:beforeLinkBuildProd',//« For prettier URLs after cache-busting
+    'linkAssetsBuildProd',
+    'clean:build',
+    'copy:build',
+    'clean:afterBuildProd'
+  ]);
+};
+
diff --git a/ee/bulk-operations-dashboard/tasks/register/compileAssets.js b/ee/bulk-operations-dashboard/tasks/register/compileAssets.js
new file mode 100644
index 000000000000..c53a02a81919
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/compileAssets.js
@@ -0,0 +1,16 @@
+/**
+ * `tasks/register/compileAssets.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/compile-assets.js
+ *
+ */
+module.exports = function(grunt) {
+  grunt.registerTask('compileAssets', [
+    'clean:dev',
+    'less:dev',
+    'copy:dev',
+  ]);
+};
diff --git a/ee/bulk-operations-dashboard/tasks/register/default.js b/ee/bulk-operations-dashboard/tasks/register/default.js
new file mode 100644
index 000000000000..e76605c9c714
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/default.js
@@ -0,0 +1,27 @@
+/**
+ * `tasks/register/default.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * This is the default Grunt tasklist that will be executed if you
+ * run `grunt` in the top level directory of your app.  It is also
+ * called automatically when you start Sails in development mode using
+ * `sails lift` or `node app` in a development environment.
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/default.js
+ *
+ */
+module.exports = function (grunt) {
+
+
+  grunt.registerTask('default', [
+    // 'polyfill:dev', //« uncomment to ALSO transpile during development (for broader browser compat.)
+    'compileAssets',
+    // 'babel',        //« uncomment to ALSO transpile during development (for broader browser compat.)
+    'linkAssets',
+    'watch'
+  ]);
+
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/register/linkAssets.js b/ee/bulk-operations-dashboard/tasks/register/linkAssets.js
new file mode 100644
index 000000000000..b0ac855c6670
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/linkAssets.js
@@ -0,0 +1,15 @@
+/**
+ * `tasks/register/linkAssets.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/link-assets.js
+ *
+ */
+module.exports = function(grunt) {
+  grunt.registerTask('linkAssets', [
+    'sails-linker:devJs',
+    'sails-linker:devStyles',
+  ]);
+};
diff --git a/ee/bulk-operations-dashboard/tasks/register/linkAssetsBuild.js b/ee/bulk-operations-dashboard/tasks/register/linkAssetsBuild.js
new file mode 100644
index 000000000000..3a05cc1243ee
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/linkAssetsBuild.js
@@ -0,0 +1,15 @@
+/**
+ * `tasks/register/linkAssetsBuild.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/link-assets-build.js
+ *
+ */
+module.exports = function(grunt) {
+  grunt.registerTask('linkAssetsBuild', [
+    'sails-linker:devJsBuild',
+    'sails-linker:devStylesBuild',
+  ]);
+};
diff --git a/ee/bulk-operations-dashboard/tasks/register/linkAssetsBuildProd.js b/ee/bulk-operations-dashboard/tasks/register/linkAssetsBuildProd.js
new file mode 100644
index 000000000000..ac477be5b412
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/linkAssetsBuildProd.js
@@ -0,0 +1,15 @@
+/**
+ * `tasks/register/linkAssetsBuildProd.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/link-assets-build-prod.js
+ *
+ */
+module.exports = function(grunt) {
+  grunt.registerTask('linkAssetsBuildProd', [
+    'sails-linker:prodJsBuild',
+    'sails-linker:prodStylesBuild',
+  ]);
+};
diff --git a/ee/bulk-operations-dashboard/tasks/register/polyfill.js b/ee/bulk-operations-dashboard/tasks/register/polyfill.js
new file mode 100644
index 000000000000..a77d82c458f6
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/polyfill.js
@@ -0,0 +1,28 @@
+/**
+ * `tasks/register/polyfill.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/polyfill.js
+ *
+ */
+module.exports = function(grunt) {
+  grunt.registerTask('polyfill:prod', 'Add the polyfill file to the top of the list of files to concatenate', ()=>{
+    grunt.config.set('concat.js.src', [require('sails-hook-grunt/accessible/babel-polyfill')].concat(grunt.config.get('concat.js.src')));
+  });
+  grunt.registerTask('polyfill:dev', 'Add the polyfill file to the top of the list of files to copy and link', ()=>{
+    grunt.config.set('copy.dev.files', grunt.config.get('copy.dev.files').concat({
+      expand: true,
+      cwd: require('path').dirname(require('sails-hook-grunt/accessible/babel-polyfill')),
+      src: require('path').basename(require('sails-hook-grunt/accessible/babel-polyfill')),
+      dest: '.tmp/public/polyfill'
+    }));
+    var devLinkFiles = grunt.config.get('sails-linker.devJs.files');
+    grunt.config.set('sails-linker.devJs.files', Object.keys(devLinkFiles).reduce((linkerConfigSoFar, glob)=>{
+      linkerConfigSoFar[glob] = ['.tmp/public/polyfill/polyfill.min.js'].concat(devLinkFiles[glob]);
+      return linkerConfigSoFar;
+    }, {}));
+  });
+};
+
diff --git a/ee/bulk-operations-dashboard/tasks/register/prod.js b/ee/bulk-operations-dashboard/tasks/register/prod.js
new file mode 100644
index 000000000000..8188d25a97ee
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/prod.js
@@ -0,0 +1,26 @@
+/**
+ * `tasks/register/prod.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * This Grunt tasklist will be executed instead of `default` when
+ * your Sails app is lifted in a production environment (e.g. using
+ * `NODE_ENV=production node app`).
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/prod.js
+ *
+ */
+module.exports = function(grunt) {
+  grunt.registerTask('prod', [
+    'polyfill:prod', //« Remove this to skip transpilation in production (not recommended)
+    'compileAssets',
+    'babel',         //« Remove this to skip transpilation in production (not recommended)
+    'concat',
+    'uglify',
+    'cssmin',
+    'sails-linker:prodJs',
+    'sails-linker:prodStyles',
+  ]);
+};
+
diff --git a/ee/bulk-operations-dashboard/tasks/register/syncAssets.js b/ee/bulk-operations-dashboard/tasks/register/syncAssets.js
new file mode 100644
index 000000000000..3e0d0c97c85b
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/syncAssets.js
@@ -0,0 +1,15 @@
+/**
+ * `tasks/register/syncAssets.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/sync-assets.js
+ *
+ */
+module.exports = function(grunt) {
+  grunt.registerTask('syncAssets', [
+    'less:dev',
+    'sync:dev',
+  ]);
+};
diff --git a/ee/bulk-operations-dashboard/views/.eslintrc b/ee/bulk-operations-dashboard/views/.eslintrc
new file mode 100644
index 000000000000..ad4c06efcdb1
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/.eslintrc
@@ -0,0 +1,21 @@
+{
+  //   ╔═╗╔═╗╦  ╦╔╗╔╔╦╗┬─┐┌─┐  ┌─┐┬  ┬┌─┐┬─┐┬─┐┬┌┬┐┌─┐
+  //   ║╣ ╚═╗║  ║║║║ ║ ├┬┘│    │ │└┐┌┘├┤ ├┬┘├┬┘│ ││├┤
+  //  o╚═╝╚═╝╩═╝╩╝╚╝ ╩ ┴└─└─┘  └─┘ └┘ └─┘┴└─┴└─┴─┴┘└─┘
+  //  ┌─  ┌─┐┌─┐┬─┐  ┬┌┐┌┬  ┬┌┐┌┌─┐  ┌─┐┌─┐┬─┐┬┌─┐┌┬┐  ┌┬┐┌─┐┌─┐┌─┐  ─┐
+  //  │   ├┤ │ │├┬┘  │││││  ││││├┤   └─┐│  ├┬┘│├─┘ │    │ ├─┤│ ┬└─┐   │
+  //  └─  └  └─┘┴└─  ┴┘└┘┴─┘┴┘└┘└─┘  └─┘└─┘┴└─┴┴   ┴    ┴ ┴ ┴└─┘└─┘  ─┘
+  // > An .eslintrc configuration override for use in the `views/` directory.
+  //
+  // (This works just like assets/.eslintrc, with one minor addition)
+  //
+  // For more information see:
+  //   https://sailsjs.com/anatomy/views/.eslintrc
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  "extends": [
+    "../assets/.eslintrc"
+  ],
+  "rules": {
+    "eol-last": [0]
+  }
+}
diff --git a/ee/bulk-operations-dashboard/views/404.ejs b/ee/bulk-operations-dashboard/views/404.ejs
new file mode 100644
index 000000000000..9b76f76a65b3
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/404.ejs
@@ -0,0 +1,10 @@
+<div id="404">
+  <div style="max-width: 650px;" class="container text-center pt-5 pb-5">
+    <h1 class="display-1 mb-3">404</h1>
+    <hr/>
+    <h2>The page you seek doesn't exist.</h2>
+    <div>
+      <p>Think you're seeing this message in error?<br class="d-none d-sm-inline" /><span class="d-inline d-sm-none">&nbsp;</span>Please <a href="/contact">let us know.</a></p>
+    </div>
+  </div>
+</div>
diff --git a/ee/bulk-operations-dashboard/views/498.ejs b/ee/bulk-operations-dashboard/views/498.ejs
new file mode 100644
index 000000000000..2a02e2d0483f
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/498.ejs
@@ -0,0 +1,11 @@
+<div id="498">
+  <div style="max-width: 650px;" class="container text-center pt-5 pb-5">
+    <h1>Sorry, that link is expired, or<br class="d-none d-sm-inline" /><span class="d-inline d-sm-none">&nbsp;</span>it has already been used.</h1>
+    <hr/>
+    <div>
+      <p>Need further help accessing your account?<br class="d-none d-sm-inline" /><span class="d-inline d-sm-none">&nbsp;</span>Please <a href="/contact">contact support</a> or request a new <a href="/password/forgot">password reset.</a></p>
+      <a class="btn btn-lg btn-outline-dark" href="/password/forgot">Reset password</a>
+    </div>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/500.ejs b/ee/bulk-operations-dashboard/views/500.ejs
new file mode 100644
index 000000000000..34a36ab5eb4a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/500.ejs
@@ -0,0 +1,11 @@
+<div id="500">
+  <div style="max-width: 650px;" class="container text-center pt-5 pb-5">
+    <h1 class="display-1 mb-3">Oh my.</h1>
+    <hr/>
+    <h2>We've encountered an unexpected error.</h2>
+    <div>
+      <p>Need help with your account? Please <a href="/contact">let us know</a>.</p>
+      <a class="btn btn-lg btn-outline-dark" href="/contact">Open a help request</a>
+    </div>
+  </div>
+</div>
diff --git a/ee/bulk-operations-dashboard/views/emails/email-reset-password.ejs b/ee/bulk-operations-dashboard/views/emails/email-reset-password.ejs
new file mode 100644
index 000000000000..2c3df4b0dc4a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/emails/email-reset-password.ejs
@@ -0,0 +1,9 @@
+<% /* Note: This is injected into `views/layouts/layout-email.ejs` */ %>
+<p style="margin-bottom: 25px;">Dear <%= fullName %>,</p>
+<p style="margin-bottom: 25px;">Someone requested a password reset for your account. If this was not you, please disregard this email. Otherwise, simply click the button below:</p>
+<div style="margin-bottom: 25px; text-align: center;">
+  <a style="background-color: #00ACC4; display: inline-block; font-size: 1.1em; color: #fff; padding: 10px 35px 10px; font-weight: 500; text-decoration: none; border-radius: 7px;" href="<%= url.resolve(sails.config.custom.baseUrl,'/password/new')+'?token='+encodeURIComponent(token) %>">Update password</a>
+</div>
+<p style="margin-bottom: 25px;">If you have any trouble, try pasting this link in your browser: <a style="color: #00ACC4; word-wrap: break-word;" href="<%= url.resolve(sails.config.custom.baseUrl,'/password/new')+'?token='+encodeURIComponent(token) %>"><%= url.resolve(sails.config.custom.baseUrl,'/password/new')+'?token='+encodeURIComponent(token) %></a></p>
+<p style="margin-bottom: 5px;">Sincerely,</p>
+<p style="margin-top: 0px;">The NEW_APP_NAME Team</p>
diff --git a/ee/bulk-operations-dashboard/views/emails/email-verify-account.ejs b/ee/bulk-operations-dashboard/views/emails/email-verify-account.ejs
new file mode 100644
index 000000000000..a7de4965e104
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/emails/email-verify-account.ejs
@@ -0,0 +1,9 @@
+<% /* Note: This is injected into `views/layouts/layout-email.ejs` */ %>
+<p style="margin-bottom: 25px;">Welcome, <%= fullName %>!</p>
+<p style="margin-bottom: 25px;">You're almost ready to get started. Just click the button below to confirm the email address for your account:</p>
+<div style="margin-bottom: 25px; text-align: center;">
+  <a style="background-color: #00ACC4; display: inline-block; font-size: 1.1em; color: #fff; padding: 10px 35px 10px; font-weight: 500; text-decoration: none; border-radius: 7px;" href="<%= url.resolve(sails.config.custom.baseUrl,'/email/confirm')+'?token='+encodeURIComponent(token) %>">Confirm email</a>
+</div>
+<p style="margin-bottom: 25px;">If you have any trouble, try pasting this link in your browser: <a style="color: #00ACC4; word-wrap: break-word;" href="<%= url.resolve(sails.config.custom.baseUrl,'/email/confirm')+'?token='+encodeURIComponent(token) %>"><%= url.resolve(sails.config.custom.baseUrl,'/email/confirm')+'?token='+encodeURIComponent(token) %></a></p>
+<p style="margin-bottom: 5px;">Sincerely,</p>
+<p style="margin-top: 0px;">The NEW_APP_NAME Team</p>
diff --git a/ee/bulk-operations-dashboard/views/emails/email-verify-new-email.ejs b/ee/bulk-operations-dashboard/views/emails/email-verify-new-email.ejs
new file mode 100644
index 000000000000..e3bfe025e269
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/emails/email-verify-new-email.ejs
@@ -0,0 +1,9 @@
+<% /* Note: This is injected into `views/layouts/layout-email.ejs` */ %>
+<p style="margin-bottom: 25px;">Dear <%= fullName %>,</p>
+<p style="margin-bottom: 25px;">You recently requested an update to the email address for your account. To verify your new email, please click the button below:</p>
+<div style="margin-bottom: 25px; text-align: center;">
+  <a style="background-color: #28AFB0; display: inline-block; font-size: 1.1em; color: #fff; padding: 10px 35px 10px; font-weight: 500; text-decoration: none; border-radius: 7px;" href="<%= url.resolve(sails.config.custom.baseUrl,'/email/confirm')+'?token='+encodeURIComponent(token) %>">Confirm email</a>
+</div>
+<p style="margin-bottom: 25px;">If you have any trouble, try pasting this link in your browser: <a style="color: #28AFB0; word-wrap: break-word;" href="<%= url.resolve(sails.config.custom.baseUrl,'/email/confirm')+'?token='+encodeURIComponent(token) %>"><%= url.resolve(sails.config.custom.baseUrl,'/email/confirm')+'?token='+encodeURIComponent(token) %></a></p>
+<p style="margin-bottom: 5px;">Sincerely,</p>
+<p style="margin-top: 0px;">The NEW_APP_NAME Team</p>
diff --git a/ee/bulk-operations-dashboard/views/emails/internal/email-contact-form.ejs b/ee/bulk-operations-dashboard/views/emails/internal/email-contact-form.ejs
new file mode 100644
index 000000000000..fbdc58d3b98f
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/emails/internal/email-contact-form.ejs
@@ -0,0 +1,16 @@
+<% /* Note: Unlike other emails, this is NOT intended for use with a layout! */ %>
+<div style="background-color: #FAFAFA; width: 100%; font-family: 'Arial', 'Helvetica Neue', 'Helvetica', sans-serif; box-sizing: border-box; padding-bottom: 25px; margin: 0;">
+  <div style="background: transparent; padding-top: 30px; padding-bottom: 20px; text-align: center;">
+    <img style="display: inline-block; height: 30px; width: auto; margin-left: auto; margin-right: auto;" alt="Sails" src="https://sailsjs.com/images/logos/sails-logo_ltBg_ltBlue.png"/>
+  </div>
+  <div style="background-color: #fff; color: #000; font-size: 1em; border-top: 2px solid #00ACC4; border-bottom: 1px solid #E6E6E6; box-sizing: border-box; padding: 25px; width: 100%; max-width: 600px; margin-left: auto; margin-right: auto;">
+
+    <p style="margin-bottom: 25px;">Dear admin,</p>
+    <p style="margin-bottom: 25px;">We have received the following message through the contact form:</p>
+    <p><strong>From:</strong> <%= contactName %> &lt;<%= contactEmail %>&gt;</p>
+    <p><strong>Topic:</strong> <%= topic %></p>
+    <p style="margin-bottom: 35px;"><strong>Message:</strong> <%= message %></p>
+  </div>
+</div>
+
+
diff --git a/ee/bulk-operations-dashboard/views/layouts/layout-email.ejs b/ee/bulk-operations-dashboard/views/layouts/layout-email.ejs
new file mode 100644
index 000000000000..e32db825d66c
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/layouts/layout-email.ejs
@@ -0,0 +1,22 @@
+<% /* Default layout for email templates */ %>
+<div style="background-color: #FAFAFA; width: 100%; font-family: 'Arial', 'Helvetica Neue', 'Helvetica', sans-serif; box-sizing: border-box; padding-bottom: 25px; margin: 0;">
+  <div style="background: transparent; padding-top: 30px; padding-bottom: 20px; text-align: center;">
+    <img style="display: inline-block; height: 30px; width: auto; margin-left: auto; margin-right: auto;" alt="Logo" src="http://via.placeholder.com/200x60/fafafa/000?text=YOUR+LOGO+HERE"/>
+  </div>
+  <div style="background-color: #fff; color: #000; font-size: 1em; border-top: 2px solid #00ACC4; border-bottom: 1px solid #E6E6E6; box-sizing: border-box; padding: 25px; width: 100%; max-width: 600px; margin-left: auto; margin-right: auto;">
+
+    <%- body %>
+
+  </div>
+  <div style="text-align: center; padding-top: 15px; margin-bottom: 15px; font-size: 12px;">
+    <a style="color: #00ACC4;" href="<%= url.resolve(sails.config.custom.baseUrl, '/contact') %>">Help</a>
+    <span style="color: #ccc;">&nbsp;&nbsp;|&nbsp;&nbsp;</span>
+    <a style="color: #00ACC4;" href="<%= url.resolve(sails.config.custom.baseUrl, '/faq') %>">FAQ</a>
+    <span style="color: #ccc;">&nbsp;&nbsp;|&nbsp;&nbsp;</span>
+    <a style="color: #00ACC4;" href="<%= url.resolve(sails.config.custom.baseUrl, '/legal/terms') %>">Terms of Service</a>
+    <span style="color: #ccc;">&nbsp;&nbsp;|&nbsp;&nbsp;</span>
+    <a style="color: #00ACC4;" href="<%= url.resolve(sails.config.custom.baseUrl, '/legal/privacy') %>">Privacy Policy</a>
+  </div>
+  <p style="color: #777777; padding: 0 25px; max-width: 400px; box-sizing: border-box; margin-left: auto; margin-right: auto; font-size: 10px; text-align: center;">Please do not reply to this email. To get in touch with us, visit our <a style="color: #00ACC4;" href="<%= url.resolve(sails.config.custom.baseUrl, '/contact') %>"> help center.</a> If you have not signed up for an account with us, please disregard this message.</p>
+  <p style="color: #777777; padding: 0 25px; max-width: 400px; box-sizing: border-box; margin-left: auto; margin-right: auto; font-size: 10px; text-align: center;"><em>(built with <a style="color: #00ACC4;" href="https://sailsjs.com">Sails.js</a>)</em></p>
+</div>
diff --git a/ee/bulk-operations-dashboard/views/layouts/layout.ejs b/ee/bulk-operations-dashboard/views/layouts/layout.ejs
new file mode 100644
index 000000000000..462cf4f5821a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/layouts/layout.ejs
@@ -0,0 +1,233 @@
+<% if(typeof me === 'undefined') {
+  // In case we're displaying the 404 or 500 page and relevant code in the "custom" hook was not able to run,
+  // we make sure `me` exists.  This ensures we don't have to do `typeof` checks below.
+  var me = undefined;
+} %><!DOCTYPE html>
+<html>
+  <head>
+    <title>Bulk operations dashboard</title>
+
+    <% /* Viewport tag for sensible mobile support */ %>
+    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
+
+    <% /* Script tags should normally be included further down the page- but any
+    scripts that load fonts (e.g. Fontawesome ≥v5) are special exceptions to the
+    rule. (Include them up here along with any hard-coded «link» tags for Typekit,
+    Google Fonts, etc. - above the «body» to prevent the page flickering when fonts
+    load.) */ %>
+
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;700&display=swap" rel="stylesheet">
+
+    <% /* Certain scripts, normally analytics tools like Google Tag Manager and
+    Google Analytics, should only be included in production: */
+    if (sails.config.environment === 'production') { %>
+    <!-- Google Analytics, Google Tag Manager, etc. -->
+    <% }
+    /* Otherwise, any such scripts are excluded, and we instead inject a
+    robots/noindex meta tag to help prevent any unwanted visits from search engines. */
+    else { %>
+    <meta name="robots" content="noindex">
+    <% } %>
+
+    <% /*
+        Stylesheets
+        ========================
+
+        Stylesheets can be hard-coded as «link» tags, automatically injected
+        by the asset pipeline between "STYLES" and "STYLES END", or both.
+        (https://sailsjs.com/docs/concepts/assets/task-automation)
+    */ %>
+
+    <% /* Auto-injected «link» tags: */ %>
+    <!--STYLES-->
+    <link rel="stylesheet" href="/dependencies/bootstrap-4/bootstrap-4.css">
+    <link rel="stylesheet" href="/dependencies/fontawesome.css">
+    <link rel="stylesheet" href="/styles/importer.css">
+    <!--STYLES END-->
+  </head>
+  <body>
+    <div purpose="page-wrap">
+      <header class="navbar navbar-expand-sm navbar flex-row justify-content-between align-items-center" purpose="page-header">
+        <a style="cursor: pointer;" class="navbar-brand mr-0" href="/"><img style="height: 20px;" class="logo" alt="Fleet logo" src="images/fleet-logo-black-118x40@2x.png"/></a>
+        <div class="navbar-nav flex-row d-none d-sm-flex">
+          <!-- LOGGED-IN NAVIGATION -->
+          <a class="nav-item nav-link mr-3 d-flex align-items-center" href="/profiles">Configuration profiles</a>
+          <a class="nav-item nav-link ml-3 mr-3 d-flex align-items-center" href="/scripts">Scripts</a>
+          <% if(me) { %>
+          <a class="nav-item nav-link ml-3 d-flex align-items-center" href="/logout">Sign out</a>
+          <% } else { %>
+          <a class="nav-item nav-link ml-3 d-flex align-items-center mr-2" href="/login">Log in</a>
+          <% } %>
+        </div>
+        <div class="nav-item dropdown d-block d-sm-none">
+          <a class="nav-link nav-item d-flex" id="header-account-menu-link" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"><img class="align-self-center" alt="An icon indicating that interacting with this button will open the navigation menu." style="height: 16px;" src="/images/icon-hamburger-blue-16x14@2x.png"/></a>
+          <div style="left: auto; right: 0;" class="dropdown-menu" aria-labelledby="header-account-menu-link">
+            <a class="dropdown-item nav-link" href="/dashboard">Configuration profiles</a>
+            <a class="dropdown-item nav-link" href="/patch-progress">Scripts</a>
+            <% if(me) { %>
+            <a class="dropdown-item nav-link" href="/logout">Sign out</a>
+            <% } else { %>
+            <a class="dropdown-item nav-link" href="/login">Log in</a>
+            <% } %>
+          </div>
+        </div>
+      </header>
+
+
+      <!-- Alert if email has not been confirmed -->
+      <% if(me&&me.emailChangeCandidate) { %>
+      <div class="container-fluid">
+        <div class="alert alert-secondary mt-2 small" role="alert">
+        Your updated email address needs verification. Until you click the link sent to <strong><%= me.emailChangeCandidate %></strong>, you'll still need to sign in as <strong><%= me.emailAddress %></strong>.
+        </div>
+      </div>
+      <% } else if(me&&me.emailStatus === 'unconfirmed') { %>
+      <div class="container-fluid">
+        <div class="alert alert-secondary mt-2 small" role="alert">
+        Your email address still needs verification. Your account access may be limited until you click the link sent to <strong><%= me.emailChangeCandidate ? me.emailChangeCandidate : me.emailAddress%></strong>.
+        </div>
+      </div>
+      <% } %>
+
+      <%- body %>
+
+      <footer class="w-100 px-4 d-flex justify-content-end" style="position: absolute; bottom: 1rem;">
+        <a style="cursor: pointer;" class="navbar-brand mr-0" href="https://fleetdm.com"><img style="height: 24px;" class="logo" alt="Powered by Fleet" src="/images/powered-by-fleet-159x24@2x.png"/></a>
+      </footer>
+    </div>
+
+
+    <% /*
+      Client-side JavaScript
+      ========================
+
+      Scripts can be hard-coded as «script» tags, automatically injected
+      by the asset pipeline between "SCRIPTS" and "SCRIPTS END", or both.
+      (https://sailsjs.com/docs/concepts/assets/task-automation)
+    */ %>
+
+    <%/* Stripe.js */%>
+    <script src="https://js.stripe.com/v3/"></script>
+
+    <% /* Delete the global `self` to help avoid client-side bugs.
+    (see https://developer.mozilla.org/en-US/docs/Web/API/Window/self) */ %>
+    <script>delete window.self;</script>
+
+    <%/* bowser.js (for browser detection) -- included inline to avoid issues with minification that could affect the unsupported browser overlay */%>
+    <script>!function(e,i,s){if("undefined"!=typeof module&&module.exports)module.exports=s();else if("function"==typeof define&&define.amd)define(i,s);else e[i]=s()}(this,"bowser",function(){var e=true;function i(i){function s(e){var s=i.match(e);return s&&s.length>1&&s[1]||""}function o(e){var s=i.match(e);return s&&s.length>1&&s[2]||""}var r=s(/(ipod|iphone|ipad)/i).toLowerCase(),n=/like android/i.test(i),t=!n&&/android/i.test(i),a=/nexus\s*[0-6]\s*/i.test(i),d=!a&&/nexus\s*[0-9]+/i.test(i),l=/CrOS/.test(i),f=/silk/i.test(i),m=/sailfish/i.test(i),v=/tizen/i.test(i),p=/(web|hpw)os/i.test(i),c=/windows phone/i.test(i),u=/SamsungBrowser/i.test(i),h=!c&&/windows/i.test(i),w=!r&&!f&&/macintosh/i.test(i),b=!t&&!m&&!v&&!p&&/linux/i.test(i),g=o(/edg([ea]|ios)\/(\d+(\.\d+)?)/i),k=s(/version\/(\d+(\.\d+)?)/i),x=/tablet/i.test(i)&&!/tablet pc/i.test(i),y=!x&&/[^-]mobi/i.test(i),S=/xbox/i.test(i),B;if(/opera/i.test(i))B={name:"Opera",opera:e,version:k||s(/(?:opera|opr|opios)[\s\/](\d+(\.\d+)?)/i)};else if(/opr\/|opios/i.test(i))B={name:"Opera",opera:e,version:s(/(?:opr|opios)[\s\/](\d+(\.\d+)?)/i)||k};else if(/SamsungBrowser/i.test(i))B={name:"Samsung Internet for Android",samsungBrowser:e,version:k||s(/(?:SamsungBrowser)[\s\/](\d+(\.\d+)?)/i)};else if(/coast/i.test(i))B={name:"Opera Coast",coast:e,version:k||s(/(?:coast)[\s\/](\d+(\.\d+)?)/i)};else if(/yabrowser/i.test(i))B={name:"Yandex Browser",yandexbrowser:e,version:k||s(/(?:yabrowser)[\s\/](\d+(\.\d+)?)/i)};else if(/ucbrowser/i.test(i))B={name:"UC Browser",ucbrowser:e,version:s(/(?:ucbrowser)[\s\/](\d+(?:\.\d+)+)/i)};else if(/mxios/i.test(i))B={name:"Maxthon",maxthon:e,version:s(/(?:mxios)[\s\/](\d+(?:\.\d+)+)/i)};else if(/epiphany/i.test(i))B={name:"Epiphany",epiphany:e,version:s(/(?:epiphany)[\s\/](\d+(?:\.\d+)+)/i)};else if(/puffin/i.test(i))B={name:"Puffin",puffin:e,version:s(/(?:puffin)[\s\/](\d+(?:\.\d+)?)/i)};else if(/sleipnir/i.test(i))B={name:"Sleipnir",sleipnir:e,version:s(/(?:sleipnir)[\s\/](\d+(?:\.\d+)+)/i)};else if(/k-meleon/i.test(i))B={name:"K-Meleon",kMeleon:e,version:s(/(?:k-meleon)[\s\/](\d+(?:\.\d+)+)/i)};else if(c){B={name:"Windows Phone",osname:"Windows Phone",windowsphone:e};if(g){B.msedge=e;B.version=g}else{B.msie=e;B.version=s(/iemobile\/(\d+(\.\d+)?)/i)}}else if(/msie|trident/i.test(i))B={name:"Internet Explorer",msie:e,version:s(/(?:msie |rv:)(\d+(\.\d+)?)/i)};else if(l)B={name:"Chrome",osname:"Chrome OS",chromeos:e,chromeBook:e,chrome:e,version:s(/(?:chrome|crios|crmo)\/(\d+(\.\d+)?)/i)};else if(/edg([ea]|ios)/i.test(i))B={name:"Microsoft Edge",msedge:e,version:g};else if(/vivaldi/i.test(i))B={name:"Vivaldi",vivaldi:e,version:s(/vivaldi\/(\d+(\.\d+)?)/i)||k};else if(m)B={name:"Sailfish",osname:"Sailfish OS",sailfish:e,version:s(/sailfish\s?browser\/(\d+(\.\d+)?)/i)};else if(/seamonkey\//i.test(i))B={name:"SeaMonkey",seamonkey:e,version:s(/seamonkey\/(\d+(\.\d+)?)/i)};else if(/firefox|iceweasel|fxios/i.test(i)){B={name:"Firefox",firefox:e,version:s(/(?:firefox|iceweasel|fxios)[ \/](\d+(\.\d+)?)/i)};if(/\((mobile|tablet);[^\)]*rv:[\d\.]+\)/i.test(i)){B.firefoxos=e;B.osname="Firefox OS"}}else if(f)B={name:"Amazon Silk",silk:e,version:s(/silk\/(\d+(\.\d+)?)/i)};else if(/phantom/i.test(i))B={name:"PhantomJS",phantom:e,version:s(/phantomjs\/(\d+(\.\d+)?)/i)};else if(/slimerjs/i.test(i))B={name:"SlimerJS",slimer:e,version:s(/slimerjs\/(\d+(\.\d+)?)/i)};else if(/blackberry|\bbb\d+/i.test(i)||/rim\stablet/i.test(i))B={name:"BlackBerry",osname:"BlackBerry OS",blackberry:e,version:k||s(/blackberry[\d]+\/(\d+(\.\d+)?)/i)};else if(p){B={name:"WebOS",osname:"WebOS",webos:e,version:k||s(/w(?:eb)?osbrowser\/(\d+(\.\d+)?)/i)};/touchpad\//i.test(i)&&(B.touchpad=e)}else if(/bada/i.test(i))B={name:"Bada",osname:"Bada",bada:e,version:s(/dolfin\/(\d+(\.\d+)?)/i)};else if(v)B={name:"Tizen",osname:"Tizen",tizen:e,version:s(/(?:tizen\s?)?browser\/(\d+(\.\d+)?)/i)||k};else if(/qupzilla/i.test(i))B={name:"QupZilla",qupzilla:e,version:s(/(?:qupzilla)[\s\/](\d+(?:\.\d+)+)/i)||k};else if(/chromium/i.test(i))B={name:"Chromium",chromium:e,version:s(/(?:chromium)[\s\/](\d+(?:\.\d+)?)/i)||k};else if(/chrome|crios|crmo/i.test(i))B={name:"Chrome",chrome:e,version:s(/(?:chrome|crios|crmo)\/(\d+(\.\d+)?)/i)};else if(t)B={name:"Android",version:k};else if(/safari|applewebkit/i.test(i)){B={name:"Safari",safari:e};if(k)B.version=k}else if(r){B={name:"iphone"==r?"iPhone":"ipad"==r?"iPad":"iPod"};if(k)B.version=k}else if(/googlebot/i.test(i))B={name:"Googlebot",googlebot:e,version:s(/googlebot\/(\d+(\.\d+))/i)||k};else B={name:s(/^(.*)\/(.*) /),version:o(/^(.*)\/(.*) /)};if(!B.msedge&&/(apple)?webkit/i.test(i)){if(/(apple)?webkit\/537\.36/i.test(i)){B.name=B.name||"Blink";B.blink=e}else{B.name=B.name||"Webkit";B.webkit=e}if(!B.version&&k)B.version=k}else if(!B.opera&&/gecko\//i.test(i)){B.name=B.name||"Gecko";B.gecko=e;B.version=B.version||s(/gecko\/(\d+(\.\d+)?)/i)}if(!B.windowsphone&&(t||B.silk)){B.android=e;B.osname="Android"}else if(!B.windowsphone&&r){B[r]=e;B.ios=e;B.osname="iOS"}else if(w){B.mac=e;B.osname="macOS"}else if(S){B.xbox=e;B.osname="Xbox"}else if(h){B.windows=e;B.osname="Windows"}else if(b){B.linux=e;B.osname="Linux"}function O(e){switch(e){case"NT":return"NT";case"XP":return"XP";case"NT 5.0":return"2000";case"NT 5.1":return"XP";case"NT 5.2":return"2003";case"NT 6.0":return"Vista";case"NT 6.1":return"7";case"NT 6.2":return"8";case"NT 6.3":return"8.1";case"NT 10.0":return"10";default:return undefined}}var T="";if(B.windows)T=O(s(/Windows ((NT|XP)( \d\d?.\d)?)/i));else if(B.windowsphone)T=s(/windows phone (?:os)?\s?(\d+(\.\d+)*)/i);else if(B.mac){T=s(/Mac OS X (\d+([_\.\s]\d+)*)/i);T=T.replace(/[_\s]/g,".")}else if(r){T=s(/os (\d+([_\s]\d+)*) like mac os x/i);T=T.replace(/[_\s]/g,".")}else if(t)T=s(/android[ \/-](\d+(\.\d+)*)/i);else if(B.webos)T=s(/(?:web|hpw)os\/(\d+(\.\d+)*)/i);else if(B.blackberry)T=s(/rim\stablet\sos\s(\d+(\.\d+)*)/i);else if(B.bada)T=s(/bada\/(\d+(\.\d+)*)/i);else if(B.tizen)T=s(/tizen[\/\s](\d+(\.\d+)*)/i);if(T)B.osversion=T;var P=!B.windows&&T.split(".")[0];if(x||d||"ipad"==r||t&&(3==P||P>=4&&!y)||B.silk)B.tablet=e;else if(y||"iphone"==r||"ipod"==r||t||a||B.blackberry||B.webos||B.bada)B.mobile=e;if(B.msedge||B.msie&&B.version>=10||B.yandexbrowser&&B.version>=15||B.vivaldi&&B.version>=1||B.chrome&&B.version>=20||B.samsungBrowser&&B.version>=4||B.firefox&&B.version>=20||B.safari&&B.version>=6||B.opera&&B.version>=10||B.ios&&B.osversion&&B.osversion.split(".")[0]>=6||B.blackberry&&B.version>=10.1||B.chromium&&B.version>=20)B.a=e;else if(B.msie&&B.version<10||B.chrome&&B.version<20||B.firefox&&B.version<20||B.safari&&B.version<6||B.opera&&B.version<10||B.ios&&B.osversion&&B.osversion.split(".")[0]<6||B.chromium&&B.version<20)B.c=e;else B.x=e;return B}var s=i("undefined"!==typeof navigator?navigator.userAgent||"":"");s.test=function(e){for(var i=0;i<e.length;++i){var o=e[i];if("string"===typeof o)if(o in s)return true}return false};function o(e){return e.split(".").length}function r(e,i){var s=[],o;if(Array.prototype.map)return Array.prototype.map.call(e,i);for(o=0;o<e.length;o++)s.push(i(e[o]));return s}function n(e){var i=Math.max(o(e[0]),o(e[1]));var s=r(e,function(e){var s=i-o(e);e+=new Array(s+1).join(".0");return r(e.split("."),function(e){return new Array(20-e.length).join("0")+e}).reverse()});while(--i>=0)if(s[0][i]>s[1][i])return 1;else if(s[0][i]===s[1][i]){if(0===i)return 0}else return-1}function t(e,o,r){var t=s;if("string"===typeof o){r=o;o=void 0}if(void 0===o)o=false;if(r)t=i(r);var a=""+t.version;for(var d in e)if(e.hasOwnProperty(d))if(t[d]){if("string"!==typeof e[d])throw new Error("Browser version in the minVersion map should be a string: "+d+": "+String(e));return n([a,e[d]])<0}return o}function a(e,i,s){return!t(e,i,s)}s.isUnsupportedBrowser=t;s.compareVersions=n;s.check=a;s._detect=i;s.detect=i;return s});</script>
+
+    <% /* Auto-injected «script» tags: */ %>
+    <!--SCRIPTS-->
+    <script src="/dependencies/sails.io.js"></script>
+    <script src="/dependencies/lodash.js"></script>
+    <script src="/dependencies/jquery.min.js"></script>
+    <script src="/dependencies/vue.js"></script>
+    <script src="/dependencies/vue-router.js"></script>
+    <script src="/dependencies/bootstrap-4/bootstrap-4.bundle.js"></script>
+    <script src="/dependencies/cloud.js"></script>
+    <script src="/dependencies/moment.js"></script>
+    <script src="/dependencies/parasails.js"></script>
+    <script src="/js/cloud.setup.js"></script>
+    <script src="/js/components/account-notification-banner.component.js"></script>
+    <script src="/js/components/ajax-button.component.js"></script>
+    <script src="/js/components/ajax-form.component.js"></script>
+    <script src="/js/components/cloud-error.component.js"></script>
+    <script src="/js/components/file-upload.component.js"></script>
+    <script src="/js/components/js-timestamp.component.js"></script>
+    <script src="/js/components/modal.component.js"></script>
+    <script src="/js/components/multifield.component.js"></script>
+    <script src="/js/components/stripe-card-element.component.js"></script>
+    <script src="/js/utilities/get-mimetype-icon-class.js"></script>
+    <script src="/js/utilities/open-stripe-checkout.js"></script>
+    <script src="/js/pages/account/account-overview.page.js"></script>
+    <script src="/js/pages/account/edit-password.page.js"></script>
+    <script src="/js/pages/account/edit-profile.page.js"></script>
+    <script src="/js/pages/contact.page.js"></script>
+    <script src="/js/pages/dashboard/welcome.page.js"></script>
+    <script src="/js/pages/entrance/confirmed-email.page.js"></script>
+    <script src="/js/pages/entrance/forgot-password.page.js"></script>
+    <script src="/js/pages/entrance/login.page.js"></script>
+    <script src="/js/pages/entrance/new-password.page.js"></script>
+    <script src="/js/pages/entrance/signup.page.js"></script>
+    <script src="/js/pages/faq.page.js"></script>
+    <script src="/js/pages/homepage.page.js"></script>
+    <script src="/js/pages/legal/privacy.page.js"></script>
+    <script src="/js/pages/legal/terms.page.js"></script>
+    <script src="/js/pages/profiles.page.js"></script>
+    <script src="/js/pages/scripts.page.js"></script>
+    <!--SCRIPTS END-->
+
+    <% /* Display an overlay if the current browser is not supported.
+    (Relies on `bowser`, which is loaded inline above.) */ %>
+    <script>
+    (function(){
+      if (typeof bowser !== 'undefined') {
+        // --------------------------------------------------------------------
+        // Additional compatibility tips:
+        //
+        // • The browser/OS compatibility below is determined by the needs of Vue.js and Bootstrap.js.
+        // • All browsers on Windows XP are probably unsupported (because of compatibility issues with modern SSL certs)
+        // • See https://getbootstrap.com/docs/4.0/getting-started/browsers-devices/
+        // • See also https://github.com/vuejs/vue/tree/0e5306658ad7b83c553a6a3eeedb15f9066ab063#browser-compatibility
+        // • For more info, see:
+        //    - https://github.com/lancedikson/bowser/blob/1fb99ced0e8834fd9662604bad7e0f0c3eba2786/test/test.js#L110-L123
+        //    - https://github.com/lancedikson/bowser/tree/1fb99ced0e8834fd9662604bad7e0f0c3eba2786#rendering-engine-flags
+        // --------------------------------------------------------------------
+        var LATEST_SUPPORTED_VERSION_BY_OS = {
+          iOS: '10',//« earliest version to eliminate rare bug where `window.location` doesn't exist momentarily after doing a server-side redirect
+          Android: '6'
+        };
+        var LATEST_SUPPORTED_VERSION_BY_USER_AGENT = {
+          msedge: '16',
+          msie: '11',
+          safari: '10',//« earliest version to eliminate rare bug where `window.location` doesn't exist momentarily after doing a server-side redirect
+          firefox: '28',//« earliest version to support both ES5 (for Vue.js) and unprefixed flexbox (for Bootstrap 4)
+          chrome: '29',//« earliest version to support both ES5 (for Vue.js) and unprefixed flexbox (for Bootstrap 4)
+          opera: '17',//« earliest version to support both ES5 (for Vue.js) and unprefixed flexbox (for Bootstrap 4)
+        };
+        var LATEST_SUPPORTED_VERSION_BY_BROWSER_NAME = {
+          'microsoft edge': LATEST_SUPPORTED_VERSION_BY_USER_AGENT.msedge,
+          'internet explorer': LATEST_SUPPORTED_VERSION_BY_USER_AGENT.msie,
+          'safari': LATEST_SUPPORTED_VERSION_BY_USER_AGENT.safari,
+          'firefox': LATEST_SUPPORTED_VERSION_BY_USER_AGENT.firefox,
+          'chrome': LATEST_SUPPORTED_VERSION_BY_USER_AGENT.chrome,
+          'opera': LATEST_SUPPORTED_VERSION_BY_USER_AGENT.opera
+        };
+        var isUnsupportedBrowser = (
+          bowser.isUnsupportedBrowser(LATEST_SUPPORTED_VERSION_BY_USER_AGENT, window.navigator.userAgent)
+        );
+        var isUnsupportedOS = (
+          LATEST_SUPPORTED_VERSION_BY_OS[bowser.osname] &&
+          bowser.compareVersions([bowser.osversion, LATEST_SUPPORTED_VERSION_BY_OS[bowser.osname]]) < 0
+        );
+        if (isUnsupportedBrowser || isUnsupportedOS) {
+          document.body.innerHTML =
+          '<div class="container browser-warning-message text-center">'+
+          '  <a href="https://sailsjs.com/support">'+
+          '<img style="display: block; height: 75px; width: auto; margin: 0 auto 15px;" alt="Logo" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAASwAAABxCAYAAABvGp7oAAAMKWlDQ1BJQ0MgUHJvZmlsZQAASImVVwdYU8kWnluSkJDQAqFICb2J0qvU0AIISBVshCSQUEJMCCp2VFRgLaiIYkVXRRRdCyCLDXtZBOz1YUFFWRdXsaHyJgmgq99773vn++be/545c85/zp2ZbwYA9ViOWJyDagCQK8qXxIUFMcenpDJJjwACtIEu0AOqHK5UHBgbGwWgDL3/Ke9uQGsoVx3kvn7u/6+iyeNLuQAgsRCn86TcXIgPAYC7c8WSfAAIPVBvPi1fDDERsgTaEkgQYgs5zlRiTzlOV+IohU1CHAviNABUqByOJBMANTkvZgE3E/pRK4PYUcQTiiBuhtiPK+DwIP4M8cjc3DyI1W0gtkn/zk/mP3ymD/vkcDKHsTIXhagEC6XiHM6M/7Mc/1tyc2RDMcxhowok4XHynOV1y86LlGMqxOdF6dExEGtBfE3IU9jL8VOBLDxx0P4DV8qCNQMMAFAqjxMcCbEhxGainOioQb1fhjCUDTGsPZogzGcnKMeiPEle3KB/dDpfGhI/hDkSRSy5TYksOzFw0OcmAZ895LOpUJCQrOSJthUIk6IhVoP4njQ7PnLQ5kWhgBU9ZCORxck5w3+OgQxJaJzSBrPIlQ7lhXkLhOzoQRyVL0gIV47FJnM5Cm56EGfxpeOjhnjy+MEhyrywIr4ocZA/Vi7OD4obtN8uzokdtMea+Tlhcr0ZxK3Sgvihsb35cLIp88WBOD82QckN187iRMQqOeB2IAqwQDBgAhls6SAPZAFha09DD/xS9oQCDpCATMAHDoOaoRHJih4RfMaDQvAnRHwgHR4XpOjlgwKo/zKsVT4dQIait0AxIhs8hTgXRIIc+C1TjBINR0sCT6BG+FN0LuSaA5u87ycdU31IRwwhBhPDiaFEW9wA98N98Cj4DIDNGffEvYZ4fbMnPCW0Ex4RrhM6CbenCIskPzBngrGgE3IMHcwu/fvscCvo1Q0Pwn2hf+gbZ+AGwAF3hZECcX8Y2w1qv+cqG874Wy0HfZEdyShZlxxAtvmRgZqdmtuwF3mlvq+Fklf6cLVYwz0/5sH6rn48+I780RJbgh3EzmEnsQtYM9YAmNhxrBG7jB2V4+G58UQxN4aixSn4ZEM/wp/icQZjyqsmdax17Hb8PNgH8vnT8+WLhZUnniERZgrymYFwt+Yz2SLuqJFMZ0cnuIvK937l1vKGodjTEcbFb7qitwD48gYGBpq/6aLgmjy0CADK028662NwOesCcL6UK5MUKHW4/EEAFKAOV4o+MIZ7lw3MyBm4Ax8QAEJABIgBCSAFTIZ1FsB5KgHTwCwwHxSDUrACrAHrwWawDewCe8EB0ACawUlwFlwCbeA6uAvnShd4CXrBO9CPIAgJoSF0RB8xQSwRe8QZ8UT8kBAkColDUpA0JBMRITJkFrIAKUXKkfXIVqQG+Q05gpxELiDtyG3kIdKN/I18QjGUimqjRqgVOhr1RAPRSDQBnYRmolPRQnQhugytRKvRPWg9ehK9hF5HO9GXaB8GMFWMgZliDpgnxsJisFQsA5Ngc7ASrAKrxuqwJvinr2KdWA/2ESfidJyJO8D5Go4n4lx8Kj4HL8PX47vwevw0fhV/iPfiXwk0giHBnuBNYBPGEzIJ0wjFhArCDsJhwhm4droI74hEIoNoTfSAay+FmEWcSSwjbiTuI54gthMfE/tIJJI+yZ7kS4ohcUj5pGLSOtIe0nFSB6mL9EFFVcVExVklVCVVRaRSpFKhslvlmEqHyjOVfrIG2ZLsTY4h88gzyMvJ28lN5CvkLnI/RZNiTfGlJFCyKPMplZQ6yhnKPcobVVVVM1Uv1XGqQtV5qpWq+1XPqz5U/UjVotpRWdSJVBl1GXUn9QT1NvUNjUazogXQUmn5tGW0Gtop2gPaBzW62ig1thpPba5alVq9WofaK3WyuqV6oPpk9UL1CvWD6lfUezTIGlYaLA2OxhyNKo0jGjc1+jTpmk6aMZq5mmWauzUvaD7XImlZaYVo8bQWam3TOqX1mI7RzeksOpe+gL6dfobepU3UttZma2dpl2rv1W7V7tXR0nHVSdKZrlOlc1Snk4ExrBhsRg5jOeMA4wbjk66RbqAuX3epbp1uh+57vRF6AXp8vRK9fXrX9T7pM/VD9LP1V+o36N83wA3sDMYZTDPYZHDGoGeE9gifEdwRJSMOjLhjiBraGcYZzjTcZnjZsM/I2CjMSGy0zuiUUY8xwzjAOMt4tfEx424TuomfidBktclxkxdMHWYgM4dZyTzN7DU1NA03lZluNW017TezNks0KzLbZ3bfnGLuaZ5hvtq8xbzXwsRirMUsi1qLO5ZkS09LgeVay3OW762srZKtFls1WD231rNmWxda11rfs6HZ+NtMtam2uWZLtPW0zbbdaNtmh9q52Qnsquyu2KP27vZC+4327SMJI71GikZWj7zpQHUIdChwqHV4OIoxKmpU0aiGUa9GW4xOHb1y9LnRXx3dHHMctzveddJyinAqcmpy+tvZzpnrXOV8zYXmEuoy16XR5bWrvSvfdZPrLTe621i3xW4tbl/cPdwl7nXu3R4WHmkeGzxuemp7xnqWeZ73IngFec31avb66O3une99wPsvHwefbJ/dPs/HWI/hj9k+5rGvmS/Hd6tvpx/TL81vi1+nv6k/x7/a/1GAeQAvYEfAs0DbwKzAPYGvghyDJEGHg96zvFmzWSeCseCw4JLg1hCtkMSQ9SEPQs1CM0NrQ3vD3MJmhp0IJ4RHhq8Mv8k2YnPZNezeCI+I2RGnI6mR8ZHrIx9F2UVJoprGomMjxq4aey/aMloU3RADYtgxq2Lux1rHTo39fRxxXOy4qnFP45ziZsWdi6fHT4nfHf8uIShhecLdRJtEWWJLknrSxKSapPfJwcnlyZ3jR4+fPf5SikGKMKUxlZSalLojtW9CyIQ1E7omuk0snnhjkvWk6ZMuTDaYnDP56BT1KZwpB9MIaclpu9M+c2I41Zy+dHb6hvReLou7lvuSF8Bbzevm+/LL+c8yfDPKM55n+mauyuwW+AsqBD1ClnC98HVWeNbmrPfZMdk7swdyknP25arkpuUeEWmJskWn84zzpue1i+3FxeLOqd5T10ztlURKdkgR6SRpY742PGRfltnIFskeFvgVVBV8mJY07eB0zemi6Zdn2M1YOuNZYWjhrzPxmdyZLbNMZ82f9XB24Oytc5A56XNa5prPXTi3a17YvF3zKfOz5/9R5FhUXvR2QfKCpoVGC+ctfLwobFFtsVqxpPjmYp/Fm5fgS4RLWpe6LF239GsJr+RiqWNpRennMm7ZxV+cfqn8ZWBZxrLW5e7LN60grhCtuLHSf+Wucs3ywvLHq8auql/NXF2y+u2aKWsuVLhWbF5LWStb21kZVdm4zmLdinWf1wvWX68Kqtq3wXDD0g3vN/I2dmwK2FS32Whz6eZPW4Rbbm0N21pfbVVdsY24rWDb0+1J28/96vlrzQ6DHaU7vuwU7ezcFbfrdI1HTc1uw93La9FaWW33nol72vYG722sc6jbuo+xr3Q/2C/b/+K3tN9uHIg80HLQ82DdIctDGw7TD5fUI/Uz6nsbBA2djSmN7UcijrQ0+TQd/n3U7zubTZurjuocXX6McmzhsYHjhcf7TohP9JzMPPm4ZUrL3VPjT107Pe5065nIM+fPhp49dS7w3PHzvuebL3hfOHLR82LDJfdL9ZfdLh/+w+2Pw63urfVXPK40tnm1NbWPaT/W4d9x8mrw1bPX2NcuXY++3n4j8catmxNvdt7i3Xp+O+f26zsFd/rvzrtHuFdyX+N+xQPDB9X/sv3Xvk73zqMPgx9efhT/6O5j7uOXT6RPPnctfEp7WvHM5FnNc+fnzd2h3W0vJrzoeil+2d9T/Kfmnxte2bw69FfAX5d7x/d2vZa8Hvi77I3+m51vXd+29MX2PXiX+67/fckH/Q+7Pnp+PPcp+dOz/mmfSZ8rv9h+afoa+fXeQO7AgJgj4SiOAhhsaEYGAH/vBICWAgC9DZ4fJijvZgpBlPdJBQL/CSvvbwpxB6AOvuTHcNYJAPbDZjUP+g4AQH4ETwgAqIvLcBsUaYaLs9IXFd5YCB8GBt4YAUBqAuCLZGCgf+PAwJftkOxtAE5MVd4J5SK/g25xlKMOk4PgR/k3go9xAQNCqCIAAAAJcEhZcwAACxMAAAsTAQCanBgAAAILaVRYdFhNTDpjb20uYWRvYmUueG1wAAAAAAA8eDp4bXBtZXRhIHhtbG5zOng9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJYTVAgQ29yZSA1LjQuMCI+CiAgIDxyZGY6UkRGIHhtbG5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI+CiAgICAgIDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiCiAgICAgICAgICAgIHhtbG5zOnRpZmY9Imh0dHA6Ly9ucy5hZG9iZS5jb20vdGlmZi8xLjAvIj4KICAgICAgICAgPHRpZmY6UmVzb2x1dGlvblVuaXQ+MjwvdGlmZjpSZXNvbHV0aW9uVW5pdD4KICAgICAgICAgPHRpZmY6Q29tcHJlc3Npb24+MTwvdGlmZjpDb21wcmVzc2lvbj4KICAgICAgICAgPHRpZmY6T3JpZW50YXRpb24+MTwvdGlmZjpPcmllbnRhdGlvbj4KICAgICAgICAgPHRpZmY6UGhvdG9tZXRyaWNJbnRlcnByZXRhdGlvbj4yPC90aWZmOlBob3RvbWV0cmljSW50ZXJwcmV0YXRpb24+CiAgICAgIDwvcmRmOkRlc2NyaXB0aW9uPgogICA8L3JkZjpSREY+CjwveDp4bXBtZXRhPgoPRSqTAAA28ElEQVR4Ae19CZwdRbV3Vfe9d2YyQBIyk5BkksyEAEJAwCAqPCUBPxfUpyiJ6MPoU1z4VFYf8lOUARVFyQL6qfghSxB8hA/9XD7f5/YyqDwXREANKAbIMglkYQkkmZl7u7ve/3+qe+bOnbv0zNzZ7nT9pqf7Vp86derUqVOnttNKJSHhQMKBhAMJBxIOJBxIODCqHGhvdxSvJCQcSDiQcGDccsAqqlQvfcbo3ufkIeFAwoGEA+OCA1RM7e29imrGmnVHN61ed5LQVqOWVm9hx0UFJEQkHEg4EIcDVFSu0toDsNe05vbZWpv/qbR7hfb9qxH3RzV7tot7EAfZRIJJFNZEqq2E1oQD69e7asUKHwrLm7bmlmkp5VwEvfRxnWk4VKczKti/90AtMylRWLVcu0nZaocDy6GoFj9iRFlt2JBqfmjbh1G4y3XDlBbT06NMd3e3ct16ZXRNT7onCqt2RDopSS1ygPNUV13lqvYVnrpbqZmrbztLPbTtalXfcKzJ5ZTpOsBhIYaHCm259ufaE4VVi0KelKk2OMAJ9XCeauaq24832lyjMpkzWThYVFBUhtaUbcPGqivcajokCqumqzcp3ITkQLTCh3mqQ2/4ziEp37/SKHOhrm9wTfeBcCJd92+7tW9cSVX2L/SErN2E6IQDNcSB9g0p1b6MwzzVvHbdcuUHX1YNja2q60BoVRUoqhoqepyiJAorDpcSmIQDI82BXqtqmTf9+nXzU0avxarfWSoI7DyVxjyVMZO+vU56Boy0HCb4Ew5U5ECeVdW0dt0HdaC+rOvrp5nuLh9pOdhLqVqfnKrIJAuQKKyYjErAEg5UnQNcAbz7bketWOYduurmea6T+obO1L9JVv+6uzgsTNpnAdMThhQwJPmZcGBUOMANoFrTgvKb1972Tm30/8JWhRn9rKpRIWRiZZIorIlVXwm1tcABDgFhVbW231K/f6rzVZ2uP8/4MKgSq6pi7SYKqyKLEoCEA1XiQN4QcNbq7xy3Xwd3YKf6caZrP7YqyL6EpD1WYHXCoAoMSl4nHKgKB9qxyVNjOp1DwDXr3mdU8E2dqaszB7BTXU/urQqD4W9NnzsaDCMS2IQDI8YB7lhvF2WlZq5dt1rX1d1iHKfOZHt8e6RmxHKuOcSJhVVzVZoUaFxxINyyMPXrd0xP9/jrVf2U1+L8X+T2hS5gkjAIDiQKaxDMSkATDgyKA6Gyalr77aN0j/9DXT/lSBkCOpqbQCfJYZpBcawicKKwKrIoAUg4MAQOyDBwGZ3rLdXGfF9nMtgIeiCHIWAaymoICJMk5ECisBI5SDhQXQ5otX49NoOu8GauuvUdOLS8Xrkpx2Rz3Aiarm5Wkw9bMuk++eo8KfHIcUCr5aKssBl03QdMOv1/lOM4yvewQTQ5B1gNticWVjW4mOBIOMCNVO38KITGtoXbPo6DyzfwiI0yOL0MZ+sJg6rDgURhVYePCZbJzYFwGAhltXbdBTpddz22LJAjVFbJKKaKspEws4rMTFBNUg7YOStuCP1of2WlkvZVZZFILKwqMzRBN8k4EJ4LbF5923sxDPxan2WVKKuRkISkBxgJriY4JwcHwn1WM1bf9laVSt1qPMxZ2W8BJu1qhCQgYewIMTZBW+McCJXVrFW3vFJrvV72VhlDdzFJmxrBqk+GhCPI3AR1jXJAPma6zJt93R0LPMf/gZNKZ2BdUVklq4EjXOVJbzDCDE7Q1xgH6HudX15evz7jucE9uq5+JpQVN4UmymoUqjpRWKPA5CSL2uNA047uW3RDwxLT082Jq2SkMkpVnDB6lBidZFMDHAjnrZpX334hLKt3my7xu54ctxnFqk0U1igyO8lqAnMgnLc6dNV3Xql0sAaWFQpjkmHgKFdporBGmeFJdhOQA3QFgw9GtKxe39DjYCiYymiTyyaT7GNQlckc1hgwPclygnGAn+JC6Nbdq+DT6iUmm00m2ceoChOFNUaMT7KdIBygXyusCsK18euxfeF88RZKB3xJGBMOJEPCMWF7kumE4IAdCnpzbrxxSu6AukHTR6jGN5gNPiiRhDHhQML4MWF7kumE4MBVV4kllTvQcIVuaDwS7mI8qKvEuhrDyksU1hgyP8l6HHOAG0Tb273DVt+6GA6NL4V7YxKbKKsxrrJkSDjGFRAzew5G0LkszftwQQeT8usr0RdY+DtOyMMRBxw2xSQOvuN+zqmrz5jubk6012Z7sUPfCVHPtVkBtdXA2KtzCR1XR7GSRVZyXMU1IQSzWEFHLU72XK3wZ6xZd7py3LNMdxd5VrttResJIxO1WwmjJt0jmhGVEZWVSs1rezWMqZMdo5sDY3JaO1vwKeF7ezqf+EdIQaTYwp9Fb45qaalTQVDZynIcfJwYcLNn59QDD4jflKIYazFy+XJR/mD+Z3UqpYzv8XdNDgenf2n91FRD96m7L1z5EwyBOQyO2/GNSc0nCmtM2B4rUyqVINXS+gY8XIOVqRPR2yt+zU60DfrEwAQ96ZbWe1LKu6yrs3M74EspLSq+oG7uwkVI81OscWXobLycJxR8msrDIHSWeXrPFRgLrcZwFLLSwWFRbQdaV9gkCr/sb9Tp9GnY0V6ryopiZJ6b8nR3szf1M01rbn56z8Xv/xP80kNp2a9Uj8eKjoYT45G2yUwT68VAGV0IX0v/gQZ0In9DQ3mwenJymYCWVx2+yvLunErdn5k371j8ZlxJS8C4XhrarhU458BCa8EyfclL4Fy3AYRMA06llrwoelKea/lfaF0ZpT/BDgJhwgyXhlQtF1zQA/lq1jp1nU1/1ZDQjFaiRGGNFqfj58NWIpYVBGmtdQynaNlAYcinonjYlhfhOGzLQvnMNsa9RzUvPghxVFqllAsbX0/obC7AnXuKil9KZfkqgLWBNJMjWOvKNK++5dXacU+HdUV+lewAaoIpKDMK+ZzTePCypuvXnSNDQh7yHqchUVjjq2KoaERB4OFqS5qGsir5TTvCZzC6y8LSOjJVd+D8sDjlGllU50xb4eLrksovzKqGbnfbskBZfQRfambRJ4Wyxl5YbXxfOYG6duoX75iu2pdhvxknH8ZfiIR3/FE2OSkSIUnPWcAh4EliCcXzCIDJLQxilHl7yLbQIpucTBxSqTnhfPcK/7A1320FK986qbwxGI0vU+OzZPUN8zN1nu0ow/OTQ+LlCCZKFNYIMncIqG19aOc4DAepvDjhG6enc6xyU0ep1lY75zSEzCd5EuG9b3Ln6IYpjRhsTyqlr/GBatPTBTPL+djMVbefEnpVLWepj4m4JAprTNheKtOl9oUTHAyFxefBTvjWNeRSnMdKwuA4gC82t0fDoHOUR10VTLK2AXnjlGU6g5IbrAoj0BV0vA5TwEfj3ySrlNFg6XDy6AgT6wOhxRTHusrP0OvS9gxJfmTyXIEDy9dLO5i59rZTlKOPh68rJJiUX2x26TrHqW94RdOadRcJ19o3jCsrK1FYFWR5lF/bTXuBenSQCgsTWNJDPq46O58fZZonfnaLH5GOIVDOP2M4yPLQxJqkwch8FhjSPv36dfNlAp7ze+MkjBtCxgk/xpoMGQLmtm++HzNXj4TzWHFWqjwqLEy6/xgFiDY6DnY4OdZlH6v87XAQy/topG9UYl1hy+ykDCIyDrbKeHBUODVl9LXCho3HiEIfDyyZpBUzHlhflAZKDE1wHzvNvxDOYxGwnNLKAY5bG3ZmvNTXCIyQKCvLh8r/29ulMTZt7zkewMfChQxGg3YCsXLiWoPo1UspeKcIcCzpnFmr172Fq6eY4xsXe7MShTX+ZI7Kycl2brlTB/5XsGrDoyKixKCHOFTBe9mbJTPDeJ/G8LHHBOZd+3Y+vgvvCWuHlnhIQiUOnCZtAGbFUgwH0WLB23G6B6lSSar73vZ5OE16HX3Z5y1KVDebQWJLFNYgGTZK4CItUFqX4TjOh7DjfIcoLcdNiQJzNO545sRwEPwa+/5e4W3fsgG0hYptlKishWyuXCrWK7Yi/ZOdNxyfGyZHn9XYmwWHhVDiR/aorisk/9Ch4ejT0pfjuDDz+shJnkIOUGGJfZ7rfPJ/q4UL12ey/psws/5yDPZm4g2OzagtgNngdW6+N0yTKKuQEfFv8jUcM+sr6xrhAeNkuzo4WeevinLNhWsdSKK+DCuod+266L1/VstxOJxDxDEK1VZY0shQluheWCxrZ46/OZZK9BaWYzR+R7xy1RNP7MVC+53IlFexQEt5zISoGEEV4vL5nf8cJYvKzt/5z9H76tzbr8KEO7zHuOpoEDFH4XiKSO7I5VgdukcPC9ZxjI+PxqaC7i7uzXqtWg/XO8VqbJRoGu6QkKSzZ6fi4zOrmhfnUIpd0XvA0l2JpB2L4od0Cw3kQURX4R2vestXiVfEOZiLuMsF4mKe5KOjlixJyxXRs3gxDrv1o5/w4zWEZelHb8TrcnJCGMhXb7oql9HOX6H2T0SjJG4fz1XOY7xWSWy6XBxT8rE36wy43Hk/rC2jxvBw9FAsrFD4ehVTX8++aFGdOuAcnFHZJuM6B8EDShoLLvAKoHocJ/ViTzrYoxoautTGjTAYOvL3urBhEi+Fl0I6EoH4o2ET8wDdHX35UAHs3etiTkhjnsiozkVYLhIa+8pnaYyUSCGdhb/7cA/tifginAZO9MibvrBxY9/z+H0ir3ixrlGWjqgMrmo6akpDJjfd08GheFcPlxFYWkhltcp1p113z/5c7gXsKePnlfvXk+0cIyWH18MJ90pirAkei7xJYMTv4SCtxbTaeLJ6+oXDbrj5R09fsGw3JuHHxNnfYBVW1OBtI57ZNiuTVq/Gp7tPRls+znTnjkBjn4Va5zJ7CsqKSgKvtA9XTn46qw6o7P6dumXBJsT9BW9+n/Wz96kdO/YInP0X5ZEXNazHSBmSZqsk5xw+L6NzrwBhL0WHegTktEU9v3+G0qlGuC9z0YfkVMvmF7RqfQrvN0GPPojoX4XePSMF1p/OWbMaVdCE8nKhrlyYCecwzwUos3zVoCTkwoVTG5Saqnp60DjxFCN0TavbZTuDGMAjC5LPc9C/NJVu2fIyzBi9Grw9AVkfjc+SLsDmMRwjwgICDnhzF5kKICbwGZANTDYFJumW1q14/yjk60Ft3F9lO5+gzEQdHflPBRMpQTwOMrS3R3V5JLyKMrGV10GimQTgDobLnIA/LDhw4Aso74fUMWOzNyuuwqIAMrCCdWZe61sDo8/FAPcM9IvTFFfdpW/CP8wGDwziHgV56TqIxHQI5UtwfzNh007mGTW39edY7rqjZ/tWbnyUPJgPrqELo01PobYCvmDB7LTvnA0Cz0IWJxvtNkJp4jVCHs0SE0Ur9VLAvJ4OE6x3zwW/gQ6+Kbtt878jFejkUKXDU3Pnzkg76T8qs/8QpRqZX4iByPsFMGd/HfT5llxLyythQWBGU2DzmGZxprLBJZ7Wn1VO+gXsZqhUT8zPpPd6p6Mf/D2eWV/D4R2SDzmQVuF5XcvCIzAFstKoze9A3NHw2xWWlsXFs/A9r+jWAmadwTJXjQBuAf9PYbShud6y4CF0IHeng+ydXTt2bAMcQ29+9mfs/8KzRTfcULfXV0eoRGFVYlwKH5E1KuV+sGnN7XfuWbGiQ9F/mD1vWClt1d5XagjMiAIkPVGmZcFZEJjP4DpRO6hv9IeUJFhTaBzS+ikEvEoEwlO1QVLpHU40nZqhXOccKMBz0i1tD6AHvja7/Ul6JsL7IQtj1GC9hrmLWjzHuxQlWIlzYoeKj2F6Bx5IN2mOaGfeDKCThZSyQdm6ZyDiDNB5qXH8i7ytHfcRKJNKzTS+WgAwTlKG4HxTEMJ32BQ6U4aeBa/zf6IAdVhqB499HmZmeSoGsDQWXEVEQwOI6t5raGmZ66nUZwMVrFSuWy88YdnpMVWC0BnxunhuhLf8j2QL+9GcJWDxEk9lPgVvrLekXXPtgS1bngJclHd8JR3WxQtB0zTo18NEhPvqvzhNSWygXddVnr8arpRPUivoL4zbQNBqRylUEnAqNB8fLjgUyupuNKDvoVGeKI3dCh8JBQ6a9aLYiC8SnlJ3wkAJShrCWNe/VCBaLYEor8+0tP4U/sePxLtQwPEUP5AWEdz03NaLPe39BYJ+EeIOlQZjXQsXozufdj7n00mlTeWFSVmoJq1O0oHzm9TcBZcgHrrHacaNyop4S3vyJC8BgT8YQuUDZtKoVQnEzoIP5S7CIcnoCQ4zzAu2HkEDeP5eKKu/YmrgQ3hfD4XLjZihIqGlLdZ2Pq9LyQnjAdcrW+zkoANF6R0C/BfmfP2X9LzW8wFH3jAPpokXrrpKYAON6QChE8njp46XR+1ByeFoPWXKic3TvvNvUrz2DraNUQsUnFKBhHhUHGmV+oNx3LOlsbLBiiCJ4FWjioEjFGLixmUc53WBDv6Untu2shRxxeM5nIKS4/Cvpe0XsNy4FDtNGo0IteTDcg2FbqZhWoxPrCJFb7MKDfTDwA9f6b0oyzVGfOiGhPQBA1/xAKC8F3wudUVg0FZjsumRdIlmRUdzLRTJrSheHs9F4ZSTs4j+SnfmAzxSh+jkOIbTmHd0vo4PddyjWlsPC+kgXOUQzcEEwWGwAmG9oQz9eV4Zx+SE4KohqsF8pnn17YtG+3B0KUFivK/mLJzva/8/IRSHw4ygVWAb7MhVlMUvwog5DEffBivmVWF2pWiNqIGy6vCgQE5I+ep+pD2jT1H1WnMR7DDv0mjQ20uvvMbRzkdRgcQZr7EMM/dxllzKTGWFjuYymR4Qi6raPO9XauRJ/GB6EPQ4rvv2dE6tDSHi1cEj1kMD9FQzVwiBSiqwXy7Jj2IcgO3Pw9ENjdjh8JViACMZV0wJsMLFvE47wXfh33ouhJDKih8+GL0AD4gg45s4cvJbPEQ0lcpfLKv0vHknAfJXmNydaxXsiDYaEkghb8DCAybyrZVRisAajWcHE2Ra2s7FdAGOEVGDS10Vk6uRYAGN1Tr4I39Gu8HnBpfBaQKOCpwGCwvP8GiehLgckMPRKlP3NuzNOhtbHAJcbIMjHooJlsSl5mF+xnFOsQ1/yMqKDZrXIALmKNjl+cF/5bZt5vxEpUBp89TstgUwAH8MAT4YCpZzX6OhYKlIObfCMsbr2QFYI4Hl9dVhi5oxD3RdXjUPhQ+RnAxGVggrsooV3Pdlt27lxjRRoLH4O/uxkE5zMDplJEksrFh86wUC++xa25ebrv32wVBYo3JovFBhWSHEHiBMh1wc1iFrM26AEMmkqKwqIhHxhYIhk8hUJNEkcjGcmNB2UmDEzpTKvTMEEGkqBow4Sy8EFytG2GrgzALNsAbFsiqRpOrR+WWsOvJxjNB2bCnvfFi0Id+tAolJM+SAXiekQ4t4yDsVEd6JHNHqKaHEsEJFP+RBcIUv22Fk/jKSOySrEJ46UvBioaKhAmTyujgHHGwmpd+sNiedvlJARuFwdKHCEuWUyZq3yLCqd4K9OMUFsRQW7BKHdWS7LL6mUFiB4yacyNuA3VBKYcwXMMLJ119gsryra/v2TmWPZOTDAKRfsPTOXXAVhPeVwxi6Mm/k09tIokwQz7jehhXFT/a77ShwXAgP/zLIjo285lDOxTwjZKV3AYLxYDV+06WOyBH3dbBTKuQ/6oRpTXA3pgy4kREwHeXkhJgLwr3yG7lhk7NkDRxJGBQHtHKxN4tLPZc2rV53klhZ3Js1gqFw3Ck1hxHOayEQECvWZKx6xJYECKAxz2Ci+/ug93cmcLZiUu5F0o6Z0UZMTM+E6b5QGedE9IunYt4HqzrMQ+Y9rLBSUIPgIusqhT1mB3vgUoHC7GXmz1+Mxe7LxTy1+7ZKwReLZ75UnGggMi5gme1FaDYeWnwM3I5lFSwZUqjo+W4yBfLApHc9dwLuR4YNPg5PwETylKnNvdji9lNHm78FgdmNr7bkMGmfhhBNDzx/Hjj8ErSEUwF7oiinXv6jgsQK9zfmgtz7gImBGIc6B4VzWEkYEgfsqioPR7uqp5sr8q/BRlLWg9TwkHBWSJSvsJgJeyk0XnWcFULp4SqggKDAeoIY/djL6vPUrs07KyVQ+BRVxjevhz78CNIuFXjIMZTXrbnOzdfjN4S/rLJiEtKLJM6noWwwjJRl7vzy8HW5EJZVlOSLxg82APh32HfweGCcZ5kQjWkaviDSipWklyO70xHRFCo0m7Yc9tp+R+XE/WYnQHmwEuLwg3oBdRbsw/6L98HX1z3FWFTQQ2ms+h4P/CsB+6/IC5s8gcaofegel6tOOd7EHp35Dy1Eai6kbmhIJnUqORyNVcNXz1xz+/m7Ln7PN+RwND/GOgJhYAOfNQs7kxWOREhu9n/pjEVZQYI2e0H2nWoXBQheBdQDrP7oYuoQz1LcOwK1efPzOP18F+LvcucufLOjg68Bek+us/WDSm0mfKXABuNn5s07Fs4hl1vrCiIcP3CuDJ158AIMvFVpk7vZDkHLIJhzZFNK96zURl+OtM0xG2kZhBP41ZIlGoexUWVmrozoYEKjNJX4z2Eg5eAyHG2isgK8yEMpOWG8D//2D+H+EHbPr/KMeyVE6YPoQN6X3bLlUaSH/Fbs2JC8WDhNImHpZ2UwwX1YSRgqB7T1JWY+hwn4H+z55LIdGB46uKLuYKh4B6Rjw+8fGhupxBqshdX/1cBf8MQglpH+pRzmpQsU9QC3QFC7stcjwbz4jEuEi78puMxH+9uf+HFOeS/LucFbwve298bLMsEqQOOeK8MFO/dk48okCl9FyurXrmtOgAO8q0NlhXxl4pYNL++SOEfteGyPt23LakzuHw8F+fNwCDn0nr0yneMX4gHpkBSG9jjvx1BxwyqVAcBNN07R/kySSIcm8lBKTiLeUh5SXZ2d23OdWz7kGOeo0DpDfQ9VWQFjuEqIY1L45HFc0QkpT26FHIgOR8/QmfQX5WW0MbcQcpi/ByosulaxCiYGaggqoOVsHKEfkCQDcQ7ExDyo1HhP4RDws8qeCWPaSlqZ0uUruINB4rdZxRpr6IpkmLyFZYWdbz/C0PM13Vu2PBn6mArz7W1AbCzhJXFWyUIh8+waev3XwTLDMSWZ94oaFpJMlrA0LKhMhuM59pGg+oC74BmWLKlkkQkY/pH3lBXWkdOz/YnHcKcMUHaGHo60q4S+VvvDk0OJ1ho6N5mSh6Px4Yr0yplr171eDkWPwN6sgcrF8zBaU8+I5VRZKNBrYipDqzNT89peE1pXtnFbkz9lFYJYKbSoKKTMk8IRCQiFMfrNtJWCpEs/v/9lADwqtAQjXOXS8gwgV5Yezh7SCK8NElIY2tAijJMvfVIRVhqa1/nyFcj7AfCJvyeh0gLTNBZZJMhQzz4W/8/6oWWLRM6lAmJ5yUfKQygntNBLygrriBfhh6esgEDdey//o/rMXvE02iePEp/8GxIHOOzH+pRZpdrXZ0ZibxYrPwoUAo35pW5I1z/C+qskGBREDgvhQ8r8MD2v7aN0tYI4pkMjhnUigilWSv4wke9tflZAiSdmWCo0GwcrSLIbXnr5SumZl90yYcz51meUNAzSNNiAcjHt3WiA+iNQWhZ3NRrRYCkZM/gOlhkV6DxmOwz436kcOGdIgX4Xzv59j0eokITpqIRCOWGHUFJWCMtOT/LGfXjhmGMED2zDZxKFNTxW5qV2MZflOQ2Ni5umdV8u8VXem0UByA8UCjbi30J1vcE2xkq6AD2etamnQsl9La3TV6u5bQ8qx2yCMDyHIcB+yOQBPMMhnnoWmxie9nR6K2bJdqtNmzB/IAIa0UB6aK2UEcoOsYaA73ixy6KUZe/cZCj7dtZ7nXLUB+Xsl2/Z1ANfStpUbtsTf4SPpjuwZ+hcdCugW84YDgSvvRipA981f3A8tRfFQ91LnVUSFkwhGIiEg6NMwVlwEfMXpPsr6vFp6LJ9DmTFaMNVxOcDx9mFiZHt2UymE3LyAuAoF1Fgp8W88uOid/HudGCEgEWb3YreNGm50f1v8okv8mI4QT5cAQPmUzPWrLv7mYtXPgpXNJiAx3x3FUKhwgqR6v+LieXPQiaiHq2SIFoz3e6pOhRVfwbMfzj3C+00O4qCRKODxQaItPK6VbfaAY+Sf8Gw4o8Quw3eji2/R3kiiyfqeQsVF+kgjcjPYP8POSC+lfhQJsACACz2+6wrAzTYVzZ3pb+NyjkXdJDmyRJYdgfW+NOmZcHPMZV3NraVQHmIvFTiAacRqGj4vcXj5MIP2OgiH0wscgJjDLrDS3d7e1VL698B8SD0yX1Zx3SE850EpdwxDL4xLH7EKCgt7fo7dOBmsVoIH/lSpRZj8n+oHGBFcgd8ndN9YBWQnKnUVUPFNSBdVOHRC1EG2c4n/4z+63t2yNWrRCKYUncqEzZaSpov+6Lo4UEu7Ey2vqQoEYRrgKAejo2Cb8No8vNwBngfvUnixP/lPJuG9xRo2yjwMCDMmcMvBswP44mvXAAeDKyN2Q0P8/eFgIMX8IE5CA74Av0dcD+BLEhHNfAOzGl8xli+a+cGlB8UylweH+KESE7o8SKUFR+ygr10/B3OgoOn6DDpQgZeRx39UXR3d6Z9vRHDye9iWHkaMiK/eRV2vJVpuPJKodXX6Z3A+4LMr8WlvjL2SQ5hcDi6CxtKG96IvVn/ItsbqvThikKF1ctox7ifgvBgOCeHiAdjelOQIZDS22ISlen7+aGiWFCphcIqx2EA7hwLBfbFdMqjQF4EGAYK40DLxas7GEgOsQ1F4Mr9wxybvH6E+7/KAQ7yHctBK6MbpbmfOhFhMok8ZcLxtj35a3RGN6FzIwNkbEVGxAiEp/zlyYrIDOs7kkvwE9pQZAXKzCqy6fRQi/6hIzOv9Yd1LYcvAjwt84FygsiSwdaXevawDGTcbIVvM4JOpvoryZoqvdB0O43K+9LUr98xvVp+syLByKdReqyezsc3oU4/EDZE1uZglFY+vsJnCmqesIbzPpFQat0MgVwDD6f/D19WOTjMN6KT6VRdnUu3wTEFFPMSIpymk2kRiKtKgrlU6MLi1xOCeXJZWCyy8DGn/AvgXeNPUFoYVimuMlcr5MmKKDNbd/Q6CnmBS5u3BMqHZb6A7n0onzFlQsgzsrnR+iT/h3UxU515lmoVfoLjweFojx+uaMlkvaulLFXYmyUNrghjpMfCjuS7IJIfkgZvl+/Zg1apsQ/IFbRAKEVxBThX5p6Zru/5heLXaKwi6KXV6Gwd4mIKJ/UvAyf/JYjSC5+rckPLec4iqriBsir5jSMklAWXH9Oo81NvgEX+kFVasnIbMb7a5KL+pJPDd0sw5aB1I113Z+a00rvHIJXWaSJT6NEexcIJ0I6UaFebBRMEH3QGD0fDRvjYzOtvP0X2Zg3zcHSvEijCAql8fiodh5bfhFWwnRBGDvEoMFRoI1W7pCkNYcwiv5PTmYZbQtp689N+ivnHbBBhEfGBnkI84e/h37Qc4B4+nomJQeRk39Obdud69uMzXsFdUCL0wgDGi+Li+5EKaSgZznlx6eWO9IIF3JsXX2kds1tkCsPLv6mcbHgv1x5Gqgy1i9euuGKaEIZ3YHg4WoVf2Rmy0VCpgqTy/c4tP8nlNA+h3gjhgGsPupCRcRaUhigvKg9Wfq9SIW3DDBkUEorJWY7e8xzgMtHu6B7lUG3HVFjhbnwONW2oIo0dghHr4dx7hoDh5+QMVkns3r0PVvk5+ArluyAnf5OtJNYyJ2/YyRCu2nJC00hOMChffzVkP/OpHB7BSiGCG3h/NbkccEDJco0rCdXkgHy4QtU3vKJpzTo7N92+IeboaCAZlRQWU7DyU2rXkzvhAfQj8OxxIlZzvoql/Kekgvv5LZK5KcBT0fDqFdIhCiqHWNJ7fhI08MCtndStC17E725GxQgWhwpewuM8gKdAxkoYA3fUMI4NxTwOP2OgnZAg5AXL72R3bP73XApuYYz/ASiu/0Ic9pjS6sK4y3Z05D/qQeQDddpPVqLODyBxA6cSsLqI1cRwPosJKzeK9nZRTgelZm4CvJ14h7jFzTWBi8sBA6XVg0an22dfd9OC4UzAx21g7B0J62a3Pf5XHEK9AJ/mPQaeC87GZOs3IJQP4p39kjF7VHHUByuMQko/U4zrFVQR0rhCgf1TsPe1PgEfo1gWskfL5+6x2TBUO5VwcUsDkurD0/v2Le7FET4M42YbHbZhAP0paDBEFZefw8h2XCclE3i5XD3NbdtyM85sngo3b0vgvudTGC7+BB3d03hP5QJHfSIfaSsvvQqNPCRviSfqEPBYKdjFFSwJnxtCVpILgsnE+6YLzsR4EPsBU+zPkon3kH/VvEUfrpjquZlrBfHGoX05Os7+FQoPg7RI3K1AWRcx9+A3LwffLpydMu5R2NzXanxnNhJNh9hNxSgJ7pZVMzquRdCwc0VIrTM24ovRwDFHAbMOu6D/B+D/E8NCnv/LYtPpk9jsdzQErZJgghQoSTQOHRieIYRyXYp8O6LyIGoIwdKRS6dzy7EFaQbm3Ni4KvfqQ8hqAiVhfUaKhnJDfni5LVvYofFSXPlN12UXauMfAbOrBXvwqPCnItlUVOQ0yMgC1Gkb6pwrwazeuHLCz3ND5Mxr1Pz509XWrc8hNWmoIB8y8Y7d9+qPgF7BLJMwIhyQD1dgPuuds9beeufOi1b8EKu0KVw0hmKHSgorv8IpfGyUUUPnu0jh+Fgp2o6ct5fMuaWlIW1SR6GHPRvK60IRyFjCCFGyIne84H4gysE8AgE7Uywwkcsovtgdu9BBNfI9DxtT16qnO3YDKmpcxRJUinNkeDrrpY3KvPCJsE2QH5M5sPyRcmGN8YqEEbyWTsJXe/7+IsaAD+Mdr2LBxXclZ2YC8xqoqgvQ0cB6tSZyMeCBcboppdzFyPg3eJcvvwNBJeZekWfMu/06kBUtTH8kR3RK8Gq40RAJVCVW1a9rWb3+552XrOjCb/RR8ed+I4VTjBJb2fwghT3QTGVFBRc1TAok43gxjheVGmB46l5g+dvmgaVvOmPLbnvyClgky0Aoe0C+I55yAXhlYqHNzkE9wPwQ5dzPwiPbcmUQUAIhAT9aMBMbU78URkY0RzBx773p0pkXvgKcbSCPDTMOHXHzmGhw5Imply8XidJixbDuowCl0EEeSYXhTl7h/VLICi+BZRzx+Dx6wy01kJdTMdS+XYaPVs7wumRgWh7Eh5M1szCEqlwn4TxWWj/3MHJ/UqdAjlWQJTNKXgyVAziYxw9XNDQe0eP0XCFYBnk4ulyFisCls8HVKZ3+c3rewpcjg1DoRMgoIFGgIPKiMgGMTI4Tlr/ZgxGWl6MWLarjoWFMYXwDjR1RUCTlQ5TPDLVrFycZpEfM6tx9ECxOvguS8ijkLf3FU6Dfj530FyMmyje/YVVCw8Yl5cRn0C5Fkc4XnJPn0HMx/gj/6+a0HYXD0A/jeJV14Gb5S34Vyhj5xzoE/6nERJFFcsJ3VlbsAonKueqTqGfOj7Ke+L5MwPwTFBbADrVAS8vA9r4yavl6t/OSS9jb/0pxCT6UsV6I5KGaHJDD0ajJy2auuv14GRIOYm9WoTBFhFE4PCipk3D/GJTLHPR0v8vMXfA5zFU15PWWkUBGSiVKX3inoFlBnTpVFA5spk0WSCSsEL7/b7GkVJ2aOjWi1+EQFDh+ZZWeVWL9ExX9heElyHD0avjv+gwgSBMbC/CKEiZ+22D67tE7xlMJK/IBM8bXCS4Lx+hJHYxj+Jn6qZhXvBxeGH6bbmk7GQwhv1jflCdeleQEIFInxroAAnxT0x7E7LKKSN4RpkQQ0aJ/NtE6JYAGRi+2X4HG6ORn1tVMnAP1A9EkMbE4wCkeT9fVYeSuVkmK5cttxcVIHimAQtCw5oNVGHHRfQyPW+B4oXtFWqUeTs9r/VdaSoiLBJINn8orX4EVNnz8hlII3etCjGmxIcQYv1qd1q327g0LtlToRqbfrSTCNo/e/6QJeo6Ts/pqNKxfwtp6JeKAV3p64mdZ8q/onUnNn/9PSHMvduFfARwRTJxGCJQ1GVjfQWZu29lQVG+VhQcOj7UGT83vobRuwh66lwCGnQIv8izqAKjAWI9F5ASiHG5ByezYswgi0hKvc7DiDIRY9RtEuPJK0gZ9m/qlyfU8h1VLIiKtSRgRDuBwdE+3jy9Hn4EvR78f8oLV2g2UpYrB1nA/MLE0DIQNR3Kc18j+FhgVAOFsGYXxCFTtzXD78TCslE+HAkmho/LKV2BRg867i1KA5QaFpxWHU0RLwS0XIsHZidWfUBA7RMB85X8P9D0OmoiDyOIE0gqlJft2TgcdtAZ+AUV0YWrOglNUW9ssOQ7EI0GzDp+J7RSv4jsqNx04v0ZeEU+YF3FN1mDrvHnxQfBhZZeqhR+Gx6ukfmDJfgC2ysP0ruDOnf/m8Gxo1AEQRgQA9zwZkWefFlbjzLZZxtU3Qw5FMQKuAr+RGzsjrXbaSumIZMf+LPVfGky7s+uidyOd7tAZ9sWx5akU1iS+PAc05rMAoa857Ib1zXH3ZhVqNSiwDq8RjTabM58L84uEBHcKIytSpAJbGPTnMRS4Eq5hMGGp0Zix8uOrv+dUqlNl9z6PU8q+SqWMymad+nR6VhDok5H43SDyn62MinBG+EsUT+YlQJd5NNw4SiVLQacv+C41r20N8sZXd6j9Yk3AMx/myT1ebDTcI3YGL2wWUemc2a/SDTx3CBh/Cm5T0PXSjAUJ4qSJeVdSsgCp+UAeeJm6fZ+FxblQXMP0+cPiO3Zw5G+G3hUco89x63t2mHmtv4FK+QMWiB91A/1E1vF2oePqVpkM+QqM3pSU4xztBM7rssZ8GPUyC/XEd0U6V0kR/WMNhc4k9SNhZDyFZYFFrrBa+D3Qc5ZIyGBSR1Qk97gciD5cMcvr2n8NEn1QxTgcXaiwRHlkc8HnYRbPLBDCiBArOBQiUV44o6edkyBYJ1GPwXy3DvrqpmCiVO/DaDWnncxBcO82DTD1UHJQN3YjFhBKfhHisnej7rPvlyL/Dgqw9OK5bSd9M91y/3mg4YReBVQWUb+XVvGIry6J5+9G0MkD12hyocTKESHuuhdFZdMIwKT9Rx546TkLToTyudRaymLl5jME/EIH16u4sNuZc6Far8CLFZrGkGOymGLoxuM+7JTDpDc7j9R09BtT4WrI8j/qVPIxF3+macU5yn9kZz35qOoUoPgqh8PC9naVrlP/kc327BL5Nz7Tx5fR4nQlsaU5wA9XGO2mzmu6/o4796xYsUFxAt560Ciayiof+4pC6ItjNK3Ps0oFu49LB0qUFUgqLzpfs8LFCsbEvEPHawtQ3YsgqIchDt87JJxssCRMHEGAwCCPIDiAT3L9yJIiyoqPFCbQfLePj6l+PFQuLEN8ISUWG5guSss5LntZXJaGxKqKeMV6k84CQ77r0FFQhvi7VH0iXuSEysROK8hHb6U34FTDIbKoA4eOwNeK39hEimBdyIR1LDEV/kG2oK+Q2ffx9SaONaL6rJAufM1hIRrL9o+99xlI0I8wKYwXcK2dhJHmQEBfZDrwVnO11iorMQ6K5hspLCuEra3w5AkhtLJnTfSiyfpFMi3wiHKLhISNnI0eVphcFDxezI8wcQN2qCOJUXfJJ7ls2ny6KFCut+OJ34CIywXWChnzGkpgWYpd5XBFZSsHU0vvRGbSLfPpduh0mQuMX6fgLZWXyAr5bHlnOwgrK1FcpOTicQ54gBNDS63cb4dJhioDJOp2nn0DKYOR1XiUJlCFHJDD0dibdULzq7r/TV62d5TkuwgfgOTueuaN6OXs0K4Qbfzf+Q2eeHlFcfGx2HkquJnx97mp3vm0YkJIBaaznZuvhcB+C/SjQcjcSTHYweQfB5Z5QMdznCuNL06aiQzDcobWlP44LZrw91DLFMkF78ORFenYQM4aOp4ELgp8fscWj75wKLLnkpX3YnvD/TqTocmWWFnxuDccKH7uni3piubVty8qNwEvigo5SaXAjcwPjO9jQySCrLzxFP2YNEQqAhw1Exm+NLSuOPwsJoS9igkHbT+Mw9i3yGFaACOMpLCJopRcAvV1ULtPnseGX2HWI36zChpl1E76HPQLkZdR8mIkeV2uYDnICfxiBX/C9ybbQ8BiclIOR9+78OOfmBC7CXJU27XZV+qxfooOR8MZo/pKOWIihUUY9nKBt33Laiy4/ROGcn8PGz7ixcNCOTzVfEdho7JydeBfBweC38Jv0knlWSqwIUlZcJzj/fCnd7VYPSOndNk4HSpUjGY+nfMOXAbuUaFOhiBKK7t108bcIQe9CnNNXwOv4UeKk+7SwQ1dWQyee/A46qRR3zvcnHpHuNmU1lVvJzZolOGeLL+n7i58SGGbclNDs9YGnfGkTyCHo51M5m3Na9ctxwJIgGtAm8pXWFElp7wdW+/LKe9EKgywMbDDLArBoFzDDLYGmD9d3kL4HXwMzFyT7dxix7TxBJANheXh8PDK0Evq5j6lW5XGREVF1ygUYiqrT0DBXwN3N/B6ib0/dogU8ZEghSF8F6NN240Uhemr8bscfcXwF4NnnEsFgQ7l4/jxejBjo/BaPI1WhdfFaIniWA+QS7Gs/q6Vd1r305s3I471MjxLz+7JSj13+Yq96O1vwrAQKIta9oxPQlU5ANuIu5OM+XLTtd8+GAqLC3k0pHpDvsKKImnJiJ9uURjw8wmL6/uIs/6LeLdCQcEoJsyIjh2YHnhEEQK/k4YS2IWlxHPwNZZPh1iYX9x8Ik3gipfUrtTx2GXBPR7P9zUmYpUGZYXe4i7Ez9/RBTiBB5lQVHRCZ9QfaYWCRh4tkK9l8z+eGSK8pKXgwp4yrEVgYiSiUxIU/9d7AqAARyHOvt/AW1iOYqijcsXAK+hK4WQ5WTcu+PCz3NTGl1GB49qRx2vk0au8SuEpRmOxOKQXOeFqIOoBHVtgvpOrT53c09nJeSv2xqRp+CG0snS6/ltYdn8m7PSGS//w6ap9DNHh6FYnk2qX4hYcji6msAjXK4z0sOB1bn479kyeCu13JwRwH4dr0nCtwKIiKZRFlQArObqiBgLcvULMCWs4/JNVoxeA//r6nHucz49f2N5yMMqKdDMwP9Lvqmc3vQDvEJ9OKe9Y7Li4QqwAQoiDQXEsKBYZYpgPQ0Qrf5M2XIAjvLw1v0MjWQmr4mRaoYhivOUhHQpyzk1r7EuTIRKHSQUX4GVeDnu9KgSotDoxVrSuG4inH17beMFH4wZi+ZVEbdKkh/gs3wfQ1w+v5A8/ZGJilMDZx2tYW1TgnvKOA68/AT49KnT390gb1T3rJ5KHiOf5d77LhyVfbYdJmuHFFBb0maiH94RfhWa5y00ZlCC/RHRoZe3+6Ao6ifyG3eJQJWVYIsskOuQAlnn54Qp065fMWHvLy8XKyjscHTXUcvyKlBqFSNW3tS3wc+ZtwPgmVObJECQ46QvRyNaaPFTyG+/yc8mHNYZrxw9CUr+fDtzvdu14fFuYmoqgGgLInEk/GwiDi+M3r8DO6zOcwJwEY/M4xHGPGDfdsDHjhkC6tezleRY2y4OI+S1ifopJ/d/Le/svGn4wkUnPn79EBfoEMAnLHfKNvjzQvkcHs3OBDvZxgQOxEV19AJbegJsyQdHLKuFjwogQP0j/f7XjsT2IEprykNrfcBXkZv03OdiaHlQccgYBJummIOEf5MO6IV15OAsfmUef4liyJF23c89r4RnvrZCV1+JdG4f6fZRRP4VBHslzoogCnqOfGCZgj0wntOzPsKH0u97WJ34RQvWTzShlVe6hn6Y5193YlEs1/AXEHAa5oLxGeVYlmyoiwdeWGxpUd9cnd1288stqw4aUWrasXBsid2XvWdP27t+iX345VuTHR/kMvPOnU/XG9zbsvmjl6SGPhN5IJOLwjcJI0RLFJQlwhMfNBUvgKvl4IDoC8jYXAM14NwNXPS4qArQN1Y14ugjBV3bNDkc7j2FVZyNWjP8QmvN4JWFgHtGb4d0pZLz6VyD2nalcqimt/Tk4DzcdAKQZc7jmBUzl7sjub+xUuzdGq38RBVSmVDTkRRSEmdGPKtyHg284aUuRPhichO1TXMSIg/LpA7ljYF3iRIR6CYaNbTCYZkIBNAP4EDCSVhz5CmUvB5efRfxTiN+K3xux8fghr3vKnwrqgnkUU/iIrlIIPWLy4wnu9BlrVA/aM5UqSzjOAlb3lXPINOU/vePzuy9Z+Rl1441p9eEPcwNtqcBSiMJq3t61yZ3e1GpYvtJ9bSk8IxLPk3bOlEYV7Nndvuvi91wlm0rvXuFTSOKGSDiixu+rJ5/cicifAAGvKLhwQZNB5brKhzsYx8WBi+cDdfDBHsx3avBigXRQEUZ5FIMZThxx82Ilgf6luHf48tVmpTpRq51lkAN2KRpHR4Sjv9KzCam8Ir6UQdX7ivDlyjpYfBFi4mTaUoHlZ0MfTIjKHTcN8yePQl7jCfUOHtNS5dUX6PHjxRdTyp/mqGm+Fm8cPH/aySop6Fxsqoh2lrMc//ryGM5Te7vkUW/qb+x5/tk6GKVT4C0zcHAodjhoq502wBoVcAbwmHoQJlh+KvifeqoSf6yc4MtBZlrbl/znnpmHEUfW8XFQagwDy0L+BtgjYA7sz6CDwMkDUKarc+ogbABLqXAiYapUXCoMwvMic8ay8pk3L9JB+vOvsaYN5NRMiHgc1XvcOkd99MpW3DTVZtpY5Tv0crS3U3ZrMoxEZVTCWc4CqEkmJ4UqyoGJJCcaQywq2/EfaFlxD9NgAoe+s/ndmHEYnsLMwCA/VDEOS5GQlHAg4UDCgYQDCQcSDiQcSDiQcCDhQMKBhAPD58B/A683SXUvOOG7AAAAAElFTkSuQmCC"/>'+
+          '</a>'+
+          '  <h5 class="card-title">This '+(isUnsupportedBrowser ? 'browser' : 'operating system')+' is not supported.</h5>'+
+          '  <p style="max-width: 500px; margin-left: auto; margin-right: auto;">'+
+          '    This app does not currently support '+(
+            isUnsupportedBrowser?
+            '<strong>'+bowser.name+'</strong> for versions lower than <strong>v'+ LATEST_SUPPORTED_VERSION_BY_BROWSER_NAME[bowser.name.toLowerCase()]+'</strong>. '+
+            'To continue, please upgrade your browser to the newest version, or download the <a href="https://www.google.com/chrome">latest version of Google Chrome</a>.'+
+            '  </p>'+
+            '  <a class="btn btn-primary" style="padding: 5px 10px" href="https://www.google.com/chrome">Download Chrome</a>'
+            :
+            '<strong>'+bowser.osname+'</strong> for versions lower than <strong>v'+ LATEST_SUPPORTED_VERSION_BY_OS[bowser.osname]+'</strong>. '+
+            'To continue, please use a different device, or <a href="'+(bowser.osname === 'iOS' ? 'https://support.apple.com/en-us/HT204204' : 'https://support.google.com/android/?hl=en#topic=7313011')+'">upgrade this device\'s software</a> to the latest compatible version.'+
+            '  </p>'+
+            '  <a class="btn btn-primary" style="padding: 5px 10px" href="/contact">Need help?</a>'
+          )+
+          '</div>';
+          document.body.style.padding = '75px 0';
+        }
+      }
+    })();//†
+    </script>
+
+  </body>
+</html>
diff --git a/ee/bulk-operations-dashboard/views/pages/account/account-overview.ejs b/ee/bulk-operations-dashboard/views/pages/account/account-overview.ejs
new file mode 100644
index 000000000000..2f5f3dc3d180
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/account/account-overview.ejs
@@ -0,0 +1,62 @@
+<div id="account-overview" v-cloak>
+  <account-notification-banner></account-notification-banner>
+  <div class="container pt-5 pb-5">
+    <h1>My account</h1>
+    <hr/>
+    <div class="row mb-3">
+      <div class="col-sm-6">
+        <h4>Personal information</h4>
+      </div>
+      <div class="col-sm-6">
+        <span class="float-sm-right">
+          <a style="width: 150px" class="btn btn-sm btn-outline-info" href="/account/profile">Edit profile</a>
+        </span>
+      </div>
+    </div>
+    <div class="row">
+      <div class="col-3">Name:</div>
+      <div class="col"><strong>{{me.fullName}}</strong></div>
+    </div>
+    <div class="row">
+      <div class="col-3">Email:</div>
+      <div class="col">
+        <strong :class="[me.emailStatus === 'unconfirmed' || me.emailStatus === 'change-requested' ? 'text-muted' : '']">{{me.emailChangeCandidate ? me.emailChangeCandidate : me.emailAddress}}</strong>
+        <span v-if="me.emailStatus === 'unconfirmed' || me.emailStatus === 'change-requested'" class="badge badge-pill badge-warning">Unverified</span>
+      </div>
+    </div>
+    <hr/>
+    <div class="row mb-3">
+      <div class="col-sm-6">
+        <h4>Password</h4>
+      </div>
+      <div class="col-sm-6">
+        <span class="float-sm-right">
+          <a style="width: 150px" class="btn btn-sm btn-outline-info" href="/account/password">Change password</a>
+        </span>
+      </div>
+    </div>
+    <div class="row">
+      <div class="col-3">Password:</div>
+      <div class="col"><strong>••••••••••</strong></div>
+    </div>
+    <hr/>
+    <div class="row mb-3" v-if="isBillingEnabled">
+      <div class="col-sm-6">
+        <h4>Billing</h4>
+      </div>
+      <div class="col-sm-6">
+        <span class="float-sm-right">
+          <button style="width: 150px;" class="btn btn-sm btn-outline-info" @click="clickUpdateBillingCardButton()">{{ me.hasBillingCard ? 'Change card' : '+ Add card' }}</button>
+        </span>
+      </div>
+    </div>
+    <div class="alert alert-danger" v-else-if="isBillingEnabled && cloudError">
+      There was an error updating your credit card information. Please check your information and try again, or <a href="/contact">contact support</a> if the error persists.
+    </div>
+    <div class="alert alert-secondary" v-else-if="isBillingEnabled">
+      You have not linked a payment source to your account. In order to access paid features, you'll need to provide your credit card information. (Don't worry: you will only be charged when you've reached the limit of your free plan.)
+    </div>
+  </div>
+
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/account/edit-password.ejs b/ee/bulk-operations-dashboard/views/pages/account/edit-password.ejs
new file mode 100644
index 000000000000..689b7ccf63df
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/account/edit-password.ejs
@@ -0,0 +1,37 @@
+<div id="edit-password" v-cloak>
+  <account-notification-banner></account-notification-banner>
+  <div class="container pt-5 pb-5">
+    <h1>Change password</h1>
+    <hr/>
+    <ajax-form action="updatePassword" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-data="formData" :form-rules="formRules" :form-errors.sync="formErrors" @submitted="submittedForm()">
+      <div class="row">
+        <div class="col-sm-6">
+          <div class="form-group">
+            <label for="password">New password</label>
+            <input class="form-control" id="password" name="password" type="password"  :class="[formErrors.password ? 'is-invalid' : '']" v-model.trim="formData.password" placeholder="••••••••" autocomplete="new-password" focus-first>
+            <div class="invalid-feedback" v-if="formErrors.password">Please enter a password or choose "Cancel".</div>
+          </div>
+        </div>
+        <div class="col-sm-6">
+          <div class="form-group">
+            <label for="confirm-password">Confirm password</label>
+            <input class="form-control" id="confirm-password" name="confirm-password" type="password"  :class="[formErrors.confirmPassword ? 'is-invalid' : '']" v-model.trim="formData.confirmPassword" autocomplete="new-password" placeholder="••••••••">
+            <div class="invalid-feedback" v-if="formErrors.confirmPassword">Your new password and confirmation do not match.</div>
+          </div>
+        </div>
+      </div>
+      <div class="row">
+        <div class="col-sm-6">
+          <cloud-error v-if="cloudError"></cloud-error>
+        </div>
+        <div class="col-sm-6">
+          <div class="form-group text-right">
+            <a class="btn btn-outline-info" href="/account">Cancel</a>
+            <ajax-button type="submit" :syncing="syncing" class="btn btn-dark">Save changes</ajax-button>
+          </div>
+        </div>
+      </div>
+    </ajax-form>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/account/edit-profile.ejs b/ee/bulk-operations-dashboard/views/pages/account/edit-profile.ejs
new file mode 100644
index 000000000000..75589f176da6
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/account/edit-profile.ejs
@@ -0,0 +1,38 @@
+<div id="edit-profile" v-cloak>
+  <account-notification-banner></account-notification-banner>
+  <div class="container pt-5 pb-5">
+    <h1>Update personal info</h1>
+    <hr/>
+    <ajax-form action="updateProfile" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-data="formData" :form-rules="formRules" :form-errors.sync="formErrors" @submitted="submittedForm()">
+      <div class="row">
+        <div class="col-sm-6">
+          <div class="form-group">
+            <label for="full-name">Full name</label>
+            <input class="form-control" id="full-name" name="full-name" type="text"  :class="[formErrors.fullName ? 'is-invalid' : '']" v-model.trim="formData.fullName" placeholder="Sturgis P. Sturgeon" autocomplete="name" focus-first>
+            <div class="invalid-feedback" v-if="formErrors.fullName">Please enter your full name.</div>
+          </div>
+        </div>
+        <div class="col-sm-6">
+          <div class="form-group">
+            <label for="email-address">Email address</label>
+            <input class="form-control" id="email-address" name="email-address" type="email"  :class="[formErrors.emailAddress ? 'is-invalid' : '']" v-model.trim="formData.emailAddress" placeholder="sturgeon@example.com" autocomplete="email">
+            <div class="invalid-feedback" v-if="formErrors.emailAddress">Please enter a valid email address.</div>
+          </div>
+        </div>
+      </div>
+      <div class="row">
+        <div class="col-sm-6">
+          <cloud-error v-if="cloudError === 'emailAlreadyInUse'">There is already an account using that email address.</cloud-error>
+          <cloud-error v-if="cloudError"></cloud-error>
+        </div>
+        <div class="col-sm-6">
+          <div class="form-group text-right">
+            <a class="btn btn-outline-info" href="/account">Cancel</a>
+            <ajax-button type="submit" :syncing="syncing" class="btn btn-dark">Save changes</ajax-button>
+          </div>
+        </div>
+      </div>
+    </ajax-form>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/contact.ejs b/ee/bulk-operations-dashboard/views/pages/contact.ejs
new file mode 100644
index 000000000000..d1ed43b77556
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/contact.ejs
@@ -0,0 +1,41 @@
+<div id="contact" v-cloak>
+  <div class="container-fluid pt-5 pb-5">
+    <h1 class="text-center">Get in touch</h1>
+    <div style="max-width:  650px;" class="mx-auto" v-if="!cloudSuccess">
+      <p class="text-center">Have a question for us?  Maybe some feedback?  We love talking to users about NEW_APP_NAME, and we're happy to answer questions about our pricing, roadmap, or business solutions.  Send us a note and we'll get back to you as soon as possible.</p>
+      <hr/>
+      <ajax-form action="deliverContactFormMessage" :form-errors.sync="formErrors" :form-data="formData" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError" @submitted="submittedForm()">
+        <div class="form-group">
+          <label for="full-name">Name</label>
+          <input class="form-control" id="full-name" name="full-name" type="text"  :class="[formErrors.fullName ? 'is-invalid' : '']" v-model.trim="formData.fullName" placeholder="Sturgis P. Sturgeon" autocomplete="name" focus-first>
+          <div class="invalid-feedback" v-if="formErrors.fullName">Please let us know what to call you.</div>
+        </div>
+        <div class="form-group">
+          <label for="email-address">Email address</label>
+          <input class="form-control" id="email-address" name="email-address" type="email"  :class="[formErrors.emailAddress ? 'is-invalid' : '']" v-model.trim="formData.emailAddress" placeholder="sturgeon@example.com" autocomplete="email">
+          <div class="invalid-feedback" v-if="formErrors.emailAddress">Please enter a valid email address.</div>
+        </div>
+        <div class="form-group">
+          <label for="topic">Topic</label>
+          <input class="form-control" id="topic" name="topic" type="text"  :class="[formErrors.topic ? 'is-invalid' : '']" v-model.trim="formData.topic" placeholder="Pricing question" autocomplete="none">
+          <div class="invalid-feedback" v-if="formErrors.topic">Please choose a topic for your message.</div>
+        </div>
+        <div class="form-group">
+          <label for="message">Message</label>
+          <textarea class="form-control" id="message" name="message" :class="[formErrors.message ? 'is-invalid' : '']" v-model.trim="formData.message" placeholder="What is the difference between the &quot;Individual&quot; plan and the &quot;Professional&quot; plan?" autocomplete="none"></textarea>
+          <div class="invalid-feedback" v-if="formErrors.message">Message cannot be empty.</div>
+        </div>
+        <cloud-error v-if="cloudError"></cloud-error>
+        <div class="form-group">
+          <ajax-button type="submit" :syncing="syncing" class="btn btn-dark btn-lg btn-block">Send message</ajax-button>
+        </div>
+      </ajax-form>
+    </div>
+    <div style="max-width: 450px;" class="mx-auto text-center" v-else>
+      <p class="text-center">Thanks for reaching out!</p>
+      <hr/>
+      <p>We have received your message, and someone from our team will get back to you soon.</p>
+    </div>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/dashboard/welcome.ejs b/ee/bulk-operations-dashboard/views/pages/dashboard/welcome.ejs
new file mode 100644
index 000000000000..ce149d2d4731
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/dashboard/welcome.ejs
@@ -0,0 +1,102 @@
+<div id="welcome">
+  <account-notification-banner></account-notification-banner>
+  <div class="container pt-5 pb-5">
+    <h1>Welcome!</h1>
+    <hr/>
+    <p>This is a page that only logged-in people can visit. Don't you feel special? Try clicking on a button below to do some things you can't do when you're logged out.</p>
+    <div class="buttons">
+      <a class="btn btn-info" href="/account/profile">Update my email</a>
+      <button class="btn btn-outline-info ml-2" @click="clickOpenExampleModalButton()">Open a modal</button>
+    </div>
+  </div>
+
+  <router-view></router-view>
+
+  <!--  ╔═╗═╗ ╦╔═╗╔╦╗╔═╗╦  ╔═╗  ┌┬┐┌─┐┌┬┐┌─┐┬
+        ║╣ ╔╩╦╝╠═╣║║║╠═╝║  ║╣   ││││ │ ││├─┤│
+        ╚═╝╩ ╚═╩ ╩╩ ╩╩  ╩═╝╚═╝  ┴ ┴└─┘─┴┘┴ ┴┴─┘  -->
+  <modal class="example-modal" v-if="modal==='example'" @close="closeExampleModal()" v-cloak>
+    <div class="modal-header">
+      <h2 class="modal-title">Example modal</h2>
+      <p class="modal-intro">At your leisure, please peruse this excerpt from a whale of a tale.</p>
+      <hr>
+    </div>
+    <div class="modal-body">
+      <h5 class="pb-2 mb-3 border-bottom">Chapter 1: Loomings.</h5>
+      <p>Call me Ishmael. Some years ago—never mind how long precisely—having little or no money in my purse, and nothing particular to interest me on shore, I thought I would sail about a little and see the watery part of the world. It is a way I have of driving off the spleen and regulating the circulation. Whenever I find myself growing grim about the mouth; whenever it is a damp, drizzly November in my soul; whenever I find myself involuntarily pausing before coffin warehouses, and bringing up the rear of every funeral I meet; and especially whenever my hypos get such an upper hand of me, that it requires a strong moral principle to prevent me from deliberately stepping into the street, and methodically knocking people's hats off—then, I account it high time to get to sea as soon as I can. This is my substitute for pistol and ball. With a philosophical flourish Cato throws himself upon his sword; I quietly take to the ship. There is nothing surprising in this. If they but knew it, almost all men in their degree, some time or other, cherish very nearly the same feelings towards the ocean with me.</p>
+      <div class="js-timestamp-examples">
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">About 2 years ago</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt-(2*365*24*60*60*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(2*365*24*60*60*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(2*365*24*60*60*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">About 2 months ago</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt-(2*30*24*60*60*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(2*30*24*60*60*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(2*30*24*60*60*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">2 days ago</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt-(2*24*60*60*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(2*24*60*60*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(2*24*60*60*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">2 hours ago</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt-(2*60*60*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(2*60*60*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(2*60*60*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">15 minutes ago</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt-(15*60*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(15*60*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(15*60*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">45 seconds ago</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt-(45*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(45*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(45*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">Right now</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">In an hour</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt+(60*60*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt+(60*60*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt+(60*60*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">In two days</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt+(2*24*60*60*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt+(2*24*60*60*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt+(2*24*60*60*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">In about two months</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt+(2*30*24*60*60*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt+(2*30*24*60*60*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt+(2*30*24*60*60*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">In about two years</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt+(2*365*24*60*60*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt+(2*365*24*60*60*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt+(2*365*24*60*60*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+      </div>
+    </div>
+    <div class="modal-footer flex-row-reverse justify-content-between">
+      <button type="button" data-dismiss="modal" class="btn btn-info">Close</button>
+      <button type="button" data-dismiss="modal" class="btn btn-outline-info">Cancel</button>
+    </div>
+  </modal>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/entrance/confirmed-email.ejs b/ee/bulk-operations-dashboard/views/pages/entrance/confirmed-email.ejs
new file mode 100644
index 000000000000..0f3539dbb6cb
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/entrance/confirmed-email.ejs
@@ -0,0 +1,11 @@
+<div id="confirmed-email" v-cloak>
+  <div class="container-fluid pt-5 pb-5">
+    <h1 class="text-center">Email confirmed</h1>
+    <div style="max-width: 450px;" class="mx-auto text-center">
+      <hr/>
+      <p>Congratulations, your account is now verified! You now have full access to your account.</p>
+      <p><a class="btn btn-outline-info" href="/">To my dashboard</a></p>
+    </div>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/entrance/forgot-password.ejs b/ee/bulk-operations-dashboard/views/pages/entrance/forgot-password.ejs
new file mode 100644
index 000000000000..22d29591d6cc
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/entrance/forgot-password.ejs
@@ -0,0 +1,27 @@
+<div id="forgot-password" v-cloak>
+  <div class="container-fluid pt-5 pb-5">
+    <h1 class="text-center">Recover password</h1>
+    <div style="max-width:  450px;" class="mx-auto" v-if="!cloudSuccess">
+      <p class="text-center">Enter your email address below to reset the password for your account.</p>
+      <hr/>
+      <ajax-form action="sendPasswordRecoveryEmail" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-data="formData" :form-rules="formRules" :form-errors.sync="formErrors" @submitted="submittedForm()">
+        <div class="form-group">
+          <input type="email" name="email-address" class="form-control" placeholder="sturgeon@example.com" :class="[formErrors.emailAddress ? 'is-invalid' : '']" v-model.trim="formData.emailAddress" autocomplete="email" focus-first>
+          <div class="invalid-feedback" v-if="formErrors.emailAddress">Please enter a valid email address.</div>
+        </div>
+        <cloud-error v-if="cloudError"></cloud-error>
+        <div class="form-group">
+          <ajax-button type="submit" :syncing="syncing" class="btn btn-dark btn-lg btn-block">Send reset link</ajax-button>
+        </div>
+      </ajax-form>
+      <p class="text-center"><a href="/login">Back to login</a></p>
+    </div>
+    <div style="max-width:  450px;" class="mx-auto text-center" v-else>
+      <p>We've sent you a link to update your password.</p>
+      <hr/>
+      <p>If the email doesn’t arrive after a few minutes, try checking your spam folder.  If you still can’t find it, please try again, or <a href="/contact">contact support</a>.</p>
+      <p class="text-center"><a class="btn btn-outline-primary" href="/login">Back to login</a></p>
+    </div>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/entrance/login.ejs b/ee/bulk-operations-dashboard/views/pages/entrance/login.ejs
new file mode 100644
index 000000000000..e2855782cfca
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/entrance/login.ejs
@@ -0,0 +1,29 @@
+<div id="login" v-cloak>
+  <div class="container-fluid pt-5 pb-5">
+    <h1 class="text-center">Sign in to your account</h1>
+    <div style="max-width: 450px;" class="mx-auto">
+      <hr/>
+      <ajax-form action="login" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-data="formData" :form-rules="formRules" :form-errors.sync="formErrors" @submitted="submittedForm()">
+        <div class="form-group">
+          <input type="email" class="form-control" placeholder="Email address" :class="[formErrors.emailAddress ? 'is-invalid' : '']" v-model.trim="formData.emailAddress" autocomplete="email" focus-first>
+          <div class="invalid-feedback" v-if="formErrors.emailAddress">Please provide a valid email address.</div>
+        </div>
+        <div class="form-group">
+          <input type="password" class="form-control" placeholder="Password" :class="[formErrors.password ? 'is-invalid' : '']" v-model.trim="formData.password" autocomplete="current-password">
+          <div class="invalid-feedback" v-if="formErrors.password">Please enter your password.</div>
+        </div>
+        <div class="form-group form-check">
+          <input class="form-check-input" type="checkbox" id="remember" name="rememberMe" v-model="formData.rememberMe"/>
+          <label class="form-check-label" for="remember">Remember me</label>
+        </div>
+        <cloud-error v-if="cloudError==='badCombo'">The credentials you entered are not associated with an account. Please check your email and/or password and try again.</cloud-error>
+        <cloud-error v-else-if="cloudError"></cloud-error>
+        <div class="form-group">
+          <ajax-button :syncing="syncing" class="btn-dark btn-lg btn-block">Sign in</ajax-button>
+        </div>
+      </ajax-form>
+      <p class="text-center"><a href="/password/forgot">Forgot your password?</a></p>
+    </div>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/entrance/new-password.ejs b/ee/bulk-operations-dashboard/views/pages/entrance/new-password.ejs
new file mode 100644
index 000000000000..c276aaa8c78f
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/entrance/new-password.ejs
@@ -0,0 +1,26 @@
+<div id="new-password" v-cloak>
+  <div class="container-fluid pt-5 pb-5">
+    <h1 class="text-center">Reset password</h1>
+    <div style="max-width: 450px" class="mx-auto">
+      <hr/>
+      <ajax-form action="updatePasswordAndLogin" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-data="formData" :form-rules="formRules" :form-errors.sync="formErrors" @submitted="submittedForm()">
+        <div class="form-group">
+          <label for="password">New password</label>
+          <input class="form-control" id="password" name="password" type="password"  :class="[formErrors.password ? 'is-invalid' : '']" v-model.trim="formData.password" placeholder="••••••••" autocomplete="new-password" focus-first>
+          <div class="invalid-feedback" v-if="formErrors.password">Please enter a password.</div>
+        </div>
+        <div class="form-group">
+          <label for="confirm-password">Confirm password</label>
+          <input class="form-control" id="confirm-password" name="confirm-password" type="password"  :class="[formErrors.confirmPassword ? 'is-invalid' : '']" v-model.trim="formData.confirmPassword" placeholder="••••••••" autocomplete="new-password">
+          <div class="invalid-feedback" v-if="formErrors.confirmPassword">Your new password and confirmation do not match.</div>
+        </div>
+        <cloud-error v-if="cloudError"></cloud-error>
+        <div class="form-group">
+          <ajax-button type="submit" :syncing="syncing" class="btn btn-dark btn-lg btn-block">Submit</ajax-button>
+        </div>
+      </ajax-form>
+      <p class="text-center">Remember your password? <a href="/login">Login</a></p>
+    </div>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/entrance/signup.ejs b/ee/bulk-operations-dashboard/views/pages/entrance/signup.ejs
new file mode 100644
index 000000000000..5a76182f01c2
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/entrance/signup.ejs
@@ -0,0 +1,51 @@
+<div id="signup" v-cloak>
+  <div class="container-fluid pt-5 pb-5" v-if="!cloudSuccess">
+    <h1 class="text-center">Create an account</h1>
+    <div style="max-width: 450px;" class="mx-auto" >
+      <p class="text-center">Let's get started! Becoming a member is free and only takes a few minutes.</p>
+      <hr/>
+      <ajax-form action="signup" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-errors.sync="formErrors" :form-data="formData" :form-rules="formRules" @submitted="submittedForm()">
+        <div class="form-group">
+          <label for="full-name">Full name</label>
+          <input class="form-control" id="full-name" type="text"  :class="[formErrors.fullName ? 'is-invalid' : '']" v-model.trim="formData.fullName" placeholder="Sturgis P. Sturgeon" autocomplete="name" focus-first>
+          <div class="invalid-feedback" v-if="formErrors.fullName">Please enter your full name.</div>
+        </div>
+        <div class="form-group">
+          <label for="email-address">Email address</label>
+          <input class="form-control" id="email-address" type="email"  :class="[formErrors.emailAddress ? 'is-invalid' : '']" v-model.trim="formData.emailAddress" placeholder="sturgeon@example.com" autocomplete="email">
+          <div class="invalid-feedback" v-if="formErrors.emailAddress">Please enter a valid email address.</div>
+        </div>
+        <div class="form-group">
+          <label for="password">Choose a password</label>
+          <input class="form-control" id="password" type="password"  :class="[formErrors.password ? 'is-invalid' : '']" v-model.trim="formData.password" placeholder="••••••••" autocomplete="new-password">
+          <div class="invalid-feedback" v-if="formErrors.password">Please enter a password.</div>
+        </div>
+        <div class="form-group">
+          <label for="confirm-password">Confirm password</label>
+          <input class="form-control" id="confirm-password" type="password"  :class="[formErrors.confirmPassword ? 'is-invalid' : '']" v-model.trim="formData.confirmPassword" placeholder="••••••••" autocomplete="new-password">
+          <div class="invalid-feedback" v-if="formErrors.confirmPassword">Your password and confirmation do not match.</div>
+        </div>
+        <div class="form-group form-check">
+          <input class="form-check-input" id="terms-agreement" type="checkbox" v-model="formData.agreed">
+          <label for="terms-agreement" class="form-check-label" :class="[formErrors.agreed ? 'text-danger' : '']">I have read &amp; agree to the <a target="_blank" href="/terms">terms of service</a>.</label>
+        </div>
+        <cloud-error v-if="cloudError==='emailAlreadyInUse'">It looks like there's already an account with your email address. If you forgot your password, you can recover it <a href="password/forgot">here</a>.</cloud-error>
+        <cloud-error v-else-if="cloudError"></cloud-error>
+        <div class="form-group">
+          <ajax-button type="submit" :syncing="syncing" class="btn-dark btn-lg btn-block">Create account</ajax-button>
+        </div>
+      </ajax-form>
+      <p class="text-center">Have an account? <a href="/login">Sign in</a></p>
+    </div>
+  </div>
+  <div class="container-fluid pt-5 pb-5" v-if="cloudSuccess">
+    <h1 class="text-center">Check your email!</h1>
+    <div class="text-center">
+      <hr/>
+      <p>Your account is nearly ready. All you have to do is click the link we sent to <strong>{{formData.emailAddress}}</strong>.</p>
+      <p>(You can still access your dashboard now, but some features will be unvavailable until we've verified your email address.)</p>
+      <p><a class="btn btn-outline-info" href="/">Go to dashboard</a></p>
+    </div>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/faq.ejs b/ee/bulk-operations-dashboard/views/pages/faq.ejs
new file mode 100644
index 000000000000..d6f19b22b750
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/faq.ejs
@@ -0,0 +1,151 @@
+<div id="faq">
+  <div class="container pt-5 pb-5">
+    <h1>FAQ</h1>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>What is this page for?</h4>
+      <p>This is a template for building your own "Frequently Asked Questions" page.  It was generated automatically as part of the expanded seed app provided by <a href="https://sailsjs.com/about">Sails</a>.  On top of its primary purpose as a template, this page doubles as a handy guide about the seed app itself.</p>
+      <p><small>Before you deploy this app to production, be sure to replace the content on this page with real questions and answers that are relevant to your project.  Or if you don't need an FAQ, just delete this file altogether.</small></p>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>Other than Sails, what technologies, frameworks, or services does this app rely on?</h4>
+      <p>This app includes several tools and integrations that we use frequently on top of Sails.  They've worked well for us in the past; allowing us to focus on developing new features with minimal overhead.  Some are files we've rolled ourselves, and the rest are 3rd party services and frameworks. While a couple of these will require you to make an account (or obtain an API key, etc.), we want to emphasize that we only included trusted, reliable tools that we feel comfortable using on our own projects, and our customers' projects.</p>
+      <ul class="pl-3 pl-sm-5">
+        <li><a target="_blank" href="http://getbootstrap.com/docs/4.0/getting-started/introduction/"><strong>Bootstrap 4</strong></a> - Front-end component library</li>
+        <li><a target="_blank" href="http://fontawesome.io/icons/"><strong>Font Awesome 4</strong></a> - Icons</li>
+        <li><a target="_blank" href="https://vuejs.org/"><strong>Vue.js</strong></a> - Front-end framework</li>
+        <li><a target="_blank" href="https://npmjs.com/package/parasails"><strong>parasails.js</strong></a> - Thin layer of bundled conventions for using Vue.js with Sails.js, and dynamically-generated SDK for handling AJAX and/or WebSocket requests from the front-end to the actions in your Sails app. (More info on usage below.)</li>
+        <li><a target="_blank" href="https://www.sendgrid.com/"><strong>Sendgrid</strong></a>* - Emails</li>
+        <li><a target="_blank" href="https://stripe.com/docs"><strong>Stripe</strong></a>* - Payments</li>
+      </ul>
+      <p><small>* requires an API key</small></p>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>Why do I see placeholders like "NEW_APP_NAME" all over the place? What's the best way to customize these?</h4>
+      <p>Because projects are often generated before product and/or company names are finalized, we felt it made more sense to use easily find-and-replaceable placeholders than to prompt for an app or company name at the beginning. (It's a lot easier to find/replace "NEW_APP_NAME" without conflicts than it is to find/replace a more commonly-used word.)</p>
+      <p>When you've got your product, company name, and branding finalized, here are the placeholders you'll want to switch out:</p>
+      <ul class="pl-3 pl-sm-5">
+        <li><strong purpose="placeholder">NEW_APP_NAME</strong> - You can replace this with the name of your product.</li>
+        <li><strong purpose="placeholder">NEW_APP_COMPANY_NAME</strong> - This placeholder is used for the entity name in the default legal terms &amp; privacy policy, and can be replaced with the name of the company behind your app.</li>
+        <li><strong purpose="placeholder">DATE_PRIVACY_POLICY_LAST_UPDATED</strong> - Replace this with the date your Privacy Policy was updated (so if you're switching out the company name: today).</li>
+        <li><strong purpose="placeholder">DATE_TERMS_OF_SERVICE_LAST_UPDATED</strong> - Replace this with the date your Terms of Service were updated (so if you're switching out the company name: today).</li>
+        <li><strong purpose="placeholder">NEW_APP_COMPANY_ABOUT_HREF</strong> - This is the link in the copyright section of the footer. You'll probably want to switch it out for a link to your company's about page or marketing site.</li>
+        <li>Placeholder logo - To use your custom branding, you can simply replace the image file at <code>assets/images/logo.png</code> with a custom image of the same name, or change the image <code>src</code> in the header in <code>views/layouts/layout.ejs</code>.</li>
+      </ul>
+      <blockquote><small>Just a heads up, the previous couple paragraphs will make a lot less sense once you've done a find/replace on each of those placeholder words.</small></blockquote>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>How do I configure a new method to use with cloud.js?</h4>
+      <p>Once you've created a controller action and added it to your routes (see the <a target="_blank" href="https://sailsjs.com/documentation/concepts/routes">Sails.js docs for more info on how to do that</a>), there are just a few simple steps to add it to your global <code>Cloud</code> SDK:</p>
+      <ul class="pl-3 pl-sm-5">
+        <li>Rebuild this app's custom SDK using <code>sails run scripts/rebuild-cloud-sdk</code>.  (This automatically regenerates the method definitions in your <code>assets/js/cloud.setup.js</code> file based on your configured routes.)</li>
+        <li>You can then call any relevant new actions as "cloud methods" in your frontend code like so: <code>await Cloud.doSomething.with({…})</code></li>
+      </ul>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>How do I register a new page with parasails.js?</h4>
+      <p>To generate files for a new page (for example, "hotels-overview"), run:</p>
+      <p><code>sails generate page hotels-overview</code></p>
+      <p>Then you can add a route for the new view action to make it accessible from the browser.  For example:</p>
+      <p><code>'GET /hotels': { action: 'view-hotels-overview' }</code></p>
+      <p><small>To register a new page without the generator, make sure the top-level element of the view you wish to register has an <code>id</code> property (e.g. <code>&lt;div id="my-new-page"&gt;...&lt;/div&gt;</code>). Then, create a new javascript file, and include <code>parasails.registerPage('my-new-page', { /* options for the Vue.js instance */ })</code>. For more thorough examples, dig around in <code>assets/js/pages/</code>.</small></p>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>What's up with all the inline styles?</h4>
+      <p>Since this starter app uses Bootstrap, we wanted to make it a little clearer where our custom styles end and Bootstrap styles begin. Wherever possible, you'll see <code>style="..."</code> in the HTML. If for some reason a style tag wouldn't work (e.g. for media queries), you'll see <code>purpose="..."</code> in the HTML, and <code>[purpose='...']</code> in the .less file– we took that approach, rather than using custom class names, to help avoid confusion about which classes come from Bootstrap and which ones we added ourselves.</p>
+      <p>Another reason: copy/pasting! With the styles inline, it's easy to copy HTML from a page without the need to also duplicate styles from the matching .less files.</p>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>How do I deploy to Heroku?</h4>
+      <p>In your <a target="_blank" href="https://dashboard.heroku.com">Heroku dashboard</a>, configure your app to auto-deploy from the <code>deploy</code> branch of this project's GitHub repository. Then, from the command line, run <code>sails run deploy</code>.</p>
+      <p>For more deployment tips, <a href="https://sailsjs.com/documentation/concepts/deployment">click here</a>.</p>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>Do I have to host on Heroku?</h4>
+      <p>No way!  You can deploy your app <a target="_blank" href="https://sailsjs.com/documentation/concepts/deployment/hosting">anywhere that supports Node.js</a>.</p>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>How do I verify my user's email addresses?</h4>
+      <p>By default, email verification is neither required for signup, nor for when an existing user changes their email address from their account page.  To enable an email verification step for both of these actions, open <code>config/custom.js</code> and change <code>verifyEmailAddresses: false</code> to <code>verifyEmailAddresses: true</code>.</p>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>How do I finish setting up Sendgrid?</h4>
+      <p>To use Sendgrid, you'll need to <a target="_blank" href="https://www.sendgrid.com/">sign up for an account</a>. (While this <em>is</em> a paid service at higher usage levels, you should be able to use Sendgrid in development without having to provide any credit card information.)</p>
+      <p>After you've created an account, you'll need to add your Sendgrid API secret to your custom config. (In development, this will be either in <code>config/custom.js</code>, or in a <code>local.js</code> file you add to your <code>config/</code> folder. For your staging or production deployment, you'll want to set these using system environment variables -- aka "config variables" in Heroku.)</p>
+      <p>If you already own a domain for your app, you can follow Sendgrid's instructions for configuring a sending domain.</p>
+      <p>Otherwise, to send emails from this app <em>without</em> configuring a sending domain, you can <a target="_blank" href="https://app.sendgrid.com/settings/sender_auth">verify a single sender</a>. Just be sure to set <code>sails.config.custom.fromEmailAddress</code> to use the verified email, or there will be errors from the endpoints that attempt to send emails.</p>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>How do I finish setting up Stripe?</h4>
+      <p>To use Stripe for your app's payment processing, you'll need to <a target="_blank" href="https://stripe.com">sign up for an account</a>.</p>
+      <p>Once you have an account, you'll need to include your publishable and secret keys in your app's custom config as <code>sails.config.custom.stripePublishableKey</code> and <code>sails.config.custom.stripeSecret</code>. In development, you can add your test keys to <code>config/custom.js</code>, or in a <code>local.js</code> file you add to your <code>config/</code> folder.</p>
+      <p>In your staging or production deployment, you'll want to set your API keys using system environment variables (aka "config variables" in Heroku), and you will need ensure that your site meets Stripe's HTTPS requirements in order for Stripe Checkout to work. For more information, see Stripe's <a target="_blank" href="https://stripe.com/docs/checkout">Detailed Checkout Guide</a>.</p>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>How do I disable ___________?</h4>
+      <p class="pt-4 text-muted"><strong><em>To disable the Bootstrap framework:</em></strong></p>
+      <ul class="pl-3 pl-sm-5">
+        <li>Delete the folder <code>assets/dependencies/bootstrap/</code></li>
+        <li>In <code>tasks/pipeline.js</code>, delete <code>'dependencies/bootstrap/dependencies/**/*.js',</code> from <code>jsFilesToInject</code></li>
+      </ul>
+      <p class="pt-4 text-muted"><strong><em>To disable FontAwesome:</em></strong></p>
+      <ul class="pl-3 pl-sm-5">
+        <li>Delete the folder at <code>assets/dependencies/font-awesome-4/</code>. (You'll also likely want to search the project for "fa fa-" to check for any lingering icons in the HTML.)</li>
+      </ul>
+      <p class="pt-4 text-muted"><strong><em>To swap out Sendgrid:</em></strong></p>
+      <p>We chose Sendgrid because of its very generous free tier (you can send up to 100 emails per day).  Plus, it integrates easily, it's been around for a while (so it's stable and does a good job evading spam filters), and it's used internally at companies like Slack and Medium.</p>
+      <p>Out-of-the box, if Sendgrid is not configured for this app, the contact form and password recovery flow will fail outright unless an email address ending in "@example.com" is used.  Luckily, if you wish to use <a target="_blank" href="https://stackshare.io/twilio-sendgrid">a different solution for sending automated emails</a>, the logic for sending emails is fairly contained. To switch to a service other than Sendgrid, you'll need to make the following changes to your code:</p>
+      <ul class="pl-3 pl-sm-5">
+        <li>Modify the code in <code>api/helpers/send-template-email.js</code> to use the email service of your choice.</li>
+        <li>In <code>api/hooks/custom/index.js</code>, remove the warnings related to Sendgrid.</li>
+      </ul>
+      <p class="pt-4 text-muted"><strong><em>To remove or replace Stripe integration:</em></strong></p>
+      <p>We chose Stripe because it is the easiest-to-integrate payment processor in the industry.  Its rates are about the same <a target="_blank" href="https://stackshare.io/stripe/alternatives">as its competitors'</a>, but even if that weren't the case, Stripe's focus on developer happiness would probably make up for it.  Stripe processes payments, payouts, and more for <a target="_blank" href="https://stripe.com/us/customers">hundreds of thousands of businesses</a> all around the world.</p>
+      <p>By default, features related to billing are automatically disabled if you don't have a Stripe publishable key &amp; secret key in your custom config (<code>sails.config.custom.stripePublishableKey</code> and <code>sails.config.custom.stripeSecret</code>, respectively). Your app will not be negatively impacted or appear broken; it will merely have some extraneous code in places. If you don't anticipate integrating billing features into your app and want to remove this code entirely, you can make the following changes:</p>
+      <ul class="pl-3 pl-sm-5">
+        <li>In the <code>User</code> model definition at <code>api/models/User.js</code>, remove the <code>stripeCustomerId</code>, <code>billingCardBrand</code>, <code>billingCardLast4</code>, <code>billingCardExpMonth</code>, and <code>billingCardExpYear</code> attribute definitions.</li>
+        <li>In the "signup" action at <code>api/controllers/entrance/signup.js</code>:
+          <ul class="pl-3 pl-sm-5">
+            <li>Remove the line at the top requiring the Stripe dependency</li>
+            <li>Remove the block of code creating a Stripe customer. (If you have trouble finding where this happens, be sure to read the comments.)</li>
+            <li>In the call to <code>User.create()</code>, remove the <code>stripeCustomerId</code> property.</li>
+          </ul>
+        </li>
+        <li>In the "confirm email" action at <code>api/controllers/entrance/confirm-email.js</code>:
+          <ul class="pl-3 pl-sm-5">
+            <li>Remove the line at the top requiring the Stripe dependency.</li>
+            <li>Remove the block of code that handles creating/updating a Stripe customer. (If you have trouble finding where this happens, be sure to read the comments.)</li>
+          </ul>
+        </li>
+        <li>Remove the update billing card endpoint and all references to it by doing the following:
+          <ul class="pl-3 pl-sm-5">
+            <li>Delete the file at <code>api/controllers/account/update-billing-card.js</code>.</li>
+            <li>In <code>config/routes.js</code>, delete the route configuration for <code>'PUT /api/v1/account/update-billing-card'</code>.</li>
+            <li>In <code>assets/js/cloud.setup.js</code>, delete the <code>updateBillingCard</code> method.</li>
+            <li>In <code>assets/js/pages/account/account-overview.page.js</code>, remove the <code>clickStripeCheckoutButton</code> method.</li>
+            <li>In <code>views/pages/account/account-overview.ejs</code>, remove the HTML related to billing.</li>
+          </ul>
+        </li>
+        <li>In <code>api/hooks/custom/index.js</code>, remove the warnings related to Stripe.</li>
+        <li>In <code>api/hooks/custom/index.js</code>, remove <code>sails.config.custom.enableBillingFeatures = !isMissingStripeConfig;</code>.</li>
+      </ul>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>Where can I go for more help?</h4>
+      <p>If you run into trouble, you can often find the answer in the <a target="_blank" href="http://sailsjs.com/documentation">Sails.js documentation</a>.  If you're unsure about how to proceed, or completely stumped, be sure to check out the <a target="_blank" href="http://sailsjs.com/support">latest available resources</a>.</p>
+    </div>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/homepage.ejs b/ee/bulk-operations-dashboard/views/pages/homepage.ejs
new file mode 100644
index 000000000000..b96f3a651e70
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/homepage.ejs
@@ -0,0 +1,106 @@
+<div id="homepage" v-cloak>
+  <div style="padding-top: 100px; padding-bottom: 25px; color: #14acc2;" class="d-flex flex-column justify-content-center position-relative" purpose="full-page-hero">
+    <div class="container text-center">
+      <div style="width: 220px; height: 170px;" class="mx-auto position-relative">
+        <img style="width: 170px; left: 25px; top: 25px;" class="position-absolute" alt="The sky above the ocean" src="/images/hero-sky.png"/>
+        <img style="width: 80px; top: 55px; left: -40px;" class="position-absolute" purpose="cloud-1" alt="A grayish-blue cloud" src="/images/hero-cloud.png"/>
+        <img style="width: 80px; top: 45px; left: -40px;" class="position-absolute" purpose="cloud-2" alt="Another grayish-blue cloud" src="/images/hero-cloud.png"/>
+        <img style="width: 160px; bottom: 50px; left: 18px;" class="position-absolute" purpose="ship" alt="A ship hovering a few feet over the surface of the water, bearing a flagpole with the Sails.js logo" src="/images/hero-ship.png"/>
+        <img style="width: 170px; bottom: 40px; left: 25px;" class="position-absolute" alt="The shadow of the floating ship on the water" src="/images/hero-water.png"/>
+      </div>
+      <h1 class="display-4 pb-5">A new <strong>Sails</strong> app.</h1>
+      <div>
+        <div style="cursor: pointer; bottom: 25px; left: 0;" class="position-absolute w-100 mt-5" purpose="more-info-text" @click="clickHeroButton()">
+          <div style="letter-spacing: 2px;" class="text-uppercase font-weight-bold">Dive in</div>
+          <div style="font-size: 20px;">&darr;</div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <div style="background-color: rgba(238, 245, 249, 0.72);" class="text-center py-5" purpose="scroll-destination">
+    <div class="container pt-3 pb-5" purpose="about-section">
+      <h3>This is your freshly-generated project + a few extras.</h3>
+      <p style="max-width: 800px;" class="mx-auto">In our time <a target="_blank" href="https://sailsjs.com/about">building apps for customers</a>, we've found ourselves re-rolling some of the same key features over and over again between projects.  So we picked some of the things that kept popping up, implemented our own opinionated solutions for them, and then included it all in this free and open-source starter app.  We hope it helps you as much as it helps us!</p>
+      <div class="row pt-5">
+        <div class="mb-4 mb-sm-0 col-sm">
+          <div style="color: #fff; background-color: #14acc2; font-size: 35px; line-height: 75px; height: 75px; width: 75px;" class="rounded-circle mx-auto text-center mb-3">
+            <i class="fa fa-envelope"></i>
+          </div>
+          <h4>Emails</h4>
+          <p class="text-muted">Built-in support for internal emails from the <a href="/contact">contact form</a>, as well as transactional emails for users.</p>
+        </div>
+        <div class="pt-4 pt-sm-0 mb-4 mb-sm-0 col-sm">
+          <div style="color: #fff; background-color: #14acc2; font-size: 35px; line-height: 75px; height: 75px; width: 75px;" class="rounded-circle mx-auto text-center mb-3">
+            <i class="fa fa-lock"></i>
+          </div>
+          <h4>Authentication</h4>
+          <p class="text-muted">Ready-to-go, customizable <a href="/signup">sign up</a>, <a href="/login">login</a>, and <a href="/password/forgot">password recovery</a> flows for your users.</p>
+        </div>
+        <div class="pt-4 pt-sm-0 col-sm">
+          <div style="color: #fff; background-color: #14acc2; font-size: 35px; line-height: 75px; height: 75px; width: 75px;" class="rounded-circle mx-auto text-center mb-3">
+            <i class="fa fa-credit-card"></i>
+          </div>
+          <h4>Billing</h4>
+          <p class="text-muted">Hook up to your Stripe account for managing customers and payment sources.</p>
+        </div>
+      </div>
+      <a class="btn btn-outline-info mt-3" href="/faq">Learn more</a>
+    </div>
+  </div>
+  <div class="container pt-5">
+    <div class="pt-5" purpose="setup-section">
+      <h3 class="text-center">How to get started:</h3>
+      <div class="position-relative my-5" purpose="setup-step">
+        <div style="left: 0; top: 0; width: 140px;" class="position-absolute d-none d-lg-block">
+          <img alt="computer with email symbol on screen" src="/images/setup-email.png" class="w-100"/>
+        </div>
+        <h5>Set up your branding and content</h5>
+        <p>This starter app includes several different page templates (including the one you're reading right now) that you can change as much or as little as you like.  If there are any pages you won't need, just remove them.</p>
+        <p>To get started, do a global find/replace in this project for occurrences of <code>NEW_APP_NAME</code> and replace them all with the actual name of your app or platform (e.g. "Facebag").  Then do the same thing again to replace <code>NEW_APP_COMPANY_NAME</code> with the actual name of your organization (e.g. "Facebag Corporation").</p>
+        <blockquote><small>This app also includes a default <a href="/legal/terms">Terms of Use</a> and <a href="/legal/privacy">Privacy Policy</a>.  We want to make it easier for apps to be transparent about their users' rights and privacy.  But we are developers, not lawyers; and this is <em>definitely not legal advice</em>.  Before going live, be sure to replace these example documents with your own company's policies, and <a href="https://en.wikipedia.org/wiki/Counsel" target="_blank">seek counsel</a> for assistance if you need to design new terms from scratch.</small></blockquote>
+      </div>
+      <div class="position-relative my-5" purpose="setup-step">
+        <div style="left: 0; top: 0; width: 140px;" class="position-absolute d-none d-lg-block">
+          <img alt="computer with credit card icon on screen" src="/images/setup-payment.png" class="w-100"/>
+        </div>
+        <h5>Configure integrations</h5>
+        <p>In order for this app to send automated emails, you'll need to create a <a target="_blank" href="https://sendgrid.com/">Sendgrid</a> account.  Then, in <code>config/custom.js</code>, configure the following:</p>
+        <div class="card bg-light mb-4">
+          <div class="card-body"><pre><code><span class="text-muted">// Recipient of contact form messages</span>
+internalEmailAddress: my.email@example.com,
+
+<span class="text-muted">// For outgoing emails</span>
+fromEmailAddress: 'noreply@example.com',
+fromName: 'The NEW_APP_NAME Team',
+
+<span class="text-muted">// Sendgrid settings</span>
+sendgridSecret: 'SG.fake.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU'</code></pre>
+          </div>
+        </div>
+        <p>To enable support for billing features, you'll need to make a <a target="_blank" href="https://stripe.com">Stripe</a> account, then include your test credentials like so:</p>
+        <div class="card bg-light mb-4">
+          <div class="card-body"><pre><code><span class="text-muted">// Stripe credentials</span>
+stripePublishableKey: 'pk_test_Zzd814nldl91104qor5911gjald',
+stripeSecret: 'sk_test_Zzd814nldl91104qor5911gjald'</code></pre>
+          </div>
+        </div>
+        <blockquote><small>If your app doesn't need payment processing, it will still work without Stripe configuration. In this case, all references to billing will just be omitted from the UI.</small></blockquote>
+      </div>
+      <div class="position-relative my-5" purpose="setup-step">
+        <div style="left: 0; top: 0; width: 140px;" class="position-absolute d-none d-lg-block">
+          <img alt="computer with sails logo on screen" src="/images/setup-customize.png" class="w-100"/>
+        </div>
+        <h5>Customize</h5>
+        <p>Once the initial configuration is done, you're ready to start building out the rest of your app.</p>
+        <p>We worked hard to make this starter app's structure consistent and its files are as bare-bones as possible, so it's easy to add new pages and business logic following the conventions we set up. If you run into trouble, have a look at <a href="/faq">your new FAQ page</a>, which covers the tools we used and how to customize.  For a deeper dive, check out the Sails <a href="https://courses.platzi.com/courses/sails-js/">walkthrough</a>, <a href="https://sailsjs.com/documentation">reference documentation</a> and <a href="https://sailsjs.com/support">support</a> pages.</p>
+      </div>
+    </div>
+    <hr/>
+    <div class="text-center py-5" purpose="pep-talk">
+      <h3>Let's get to work.</h3>
+      <p style="max-width: 800px;" class="mx-auto">We think this project is a pretty convenient starting point, but of course there's no one-size-fits-all solution. The good news is, this app is in your hands now, so you can jump into the files and adapt it to your needs. Change some code around. Break stuff.  Fix it. And above all: <strong>make something people want to use</strong>.</p>
+      <p class="mb-5"><span class="text-muted">&hearts;</span> <a href="https://sailsjs.com/about" class="border-0">The Sails Team</a></p>
+    </div>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/legal/privacy.ejs b/ee/bulk-operations-dashboard/views/pages/legal/privacy.ejs
new file mode 100644
index 000000000000..a82bcd603446
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/legal/privacy.ejs
@@ -0,0 +1,82 @@
+<div id="privacy">
+  <div class="container pt-5 pb-5">
+    <h1>NEW_APP_COMPANY_NAME privacy policy</h1>
+    <hr/>
+    <p>At NEW_APP_COMPANY_NAME we care deeply about your privacy, and we take pride in being a good steward of any data you choose to share with us.  If you have any questions about how we use or handle user data, just <a href="/contact">ask</a> and we'll get back to you in a jiffy.</p>
+
+    <h3>General information</h3>
+    <p>We believe it is important for you to understand what types of information we are collecting and what may happen to that information when using our website and related applications and resources (collectively, the “Service”). This Privacy Policy is designed to explain NEW_APP_COMPANY_NAME’s policies and procedures with respect of collection, use and disclosure by NEW_APP_COMPANY_NAME of information about you in connection with the Service. This Privacy Policy has a limited scope and applies only to the Service.</p>
+    <p>By accessing the Service, you consent to the collection, use and disclosure of your personal information as explained in this privacy policy (the “Privacy Policy”). This Privacy Policy is incorporated into and is subject to the Terms of Service, which can be accessed <a href="/terms">here</a>. Your use of the Service and any information you provide through the Service is subject to the terms of this Privacy Policy and our Terms of Service.</p>
+
+    <h3>What you will find in this privacy policy?</h3>
+    <ol>
+      <li>How we collect information about you</li>
+      <li>How we use or share information about you</li>
+      <li>How we safeguard information about you</li>
+      <li>Other matters related to the information we collect about you</li>
+    </ol>
+
+    <h3>Collection of information</h3>
+    <p>We collect information about you in a variety of ways in connection the Service. NEW_APP_COMPANY_NAME will be the controller of your personal data processed in connection with the Service, and can be contacted <a href="/contact">here</a>.</p>
+    <h5>Registration</h5>
+    <p>To use some features and resources available through the Service, a user must complete our registration process. During registration, a user is required to provide certain categories of information, which may include personally identifiable information and other information about you such as your name, address, e-mail address, social network account information, password, user type, birthdate, gender, phone number, and how you heard about NEW_APP_COMPANY_NAME.</p>
+    <h5>Optional information</h5>
+    <p>At various other points during your use of the Service, you may have the option to provide additional information related to you. For example, you may wish to create a profile, post, comment on another user’s post or share a post with another person, or you may wish to utilize social network integrations or location-based features of the Service.  For voluntary activities like these you have the choice about whether to disclose the information necessary to use these features of the Service.</p>
+    <h5>Passive collection of information</h5>
+    <p>In addition to the information which you actively provide to us by methods such as completing our registration process, commenting on, or sharing a post, we collect information about how you interact with the Service. We collect passive information for purposes such as testing and improving user experience with the Service and the compilation of demographic data and related usage information for internal purposes and for disclosure to third parties such as advertisers and business partners. The types of passive information we collect include, without limitation, certain standard information sent by your browser, such as your Internet Protocol (IP) address, your device ID, your browser type and capabilities and language, your operating system, the date and time you access the Service, and the referring website from which you linked to the Service.  We also collect information related to your behavior within the Service (such as pages viewed, links clicked, and other actions taken within the Service).  We also may utilize special links, electronic images or other objects embedded within the Site—sometimes referred to as web beacons or tracking pixels—to collect information that helps determine and analyze how you and other visitors use the Site.  If you have provided us with personal information through registration or other voluntary means, we may connect your personal information with passive information collected through our Site and use the combined information to help determine your potential interests in certain products, services or information and for other purposes described in this Privacy Policy.</p>
+    <h5>Cookies</h5>
+    <p>Information related to your interactions with the Service may be collected and stored by us in small data files—commonly referred to as cookies—that are placed onto your device by our servers. We may use temporary session cookies, which are terminated when you close your current session, to store certain personal information you provide for purposes of administering that session and facilitating transactions requested by you during that session. We also may use persistent cookies, which remain saved on your device after your current session is closed, to store information related to your interactions with the Service to facilitate future sessions.  Most browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies or to notify you when a cookie is being placed on your device. Each browser is different, but generally users can remove cookies by following directions provided in the browser’s “help” file. Please note that, if you reject cookies or disable cookies, some features of the Service may not function properly.</p>
+    <h5>Collection of information from minors</h5>
+    <p>The Service is intended for a general audience and it is not intended for children under the age of 16.  Use of the Service is prohibited for anyone under the age of 16.   If you are between 16 and 18 years of age, you must secure authorization from your parents or legal guardian before using the Service.  Although the Service may contain information that may be of interest to children, the Service is not directed at children and we do not knowingly collect or solicit personal information from children under the age 16.</p>
+
+    <h3>Use and sharing of information</h3>
+    <p>The Service enables that enable users to post, access and share user generated content and other information across the NEW_APP_COMPANY_NAME community, other social networks and other websites and online services and may include various features and functionality such as comments, message boards or chat areas, where users can post information and communicate with one another. Please be aware that these posts and communications are being made publicly available online and you do so at your own risk.</p>
+    <p>We will not knowingly use, share, or otherwise transfer information about you other than in accordance with the terms set forth in this Privacy Policy.  Additionally, we may use, share, or otherwise transfer information about you for other purposes for which we have obtained your consent. Your consent may be implied, deemed (using an opt-out mechanism) or express. Express consent can be given orally, electronically or in writing. Implied consent is consent that can reasonably be inferred from your action or inaction. Regardless of your decision regarding the sharing of your personal information, we may share demographic data and related usage information with our business partners in an aggregated or anonymized manner intended to remove or obscure any personal information which can identify any individual user.</p>
+    <p>We may use information about you in order to deliver products and services to you and to customize the Service to your interests and enhance your overall experience with the Service. We try to recognize you using various methods, including having you log in with your user name and your password. Once we recognize you, your experience may be customized for you so that you can see what interests you the most. In addition, as described above, we utilize passive information to learn more about how you interact with the Service. This passive information may be combined with other information and used for purposes such as enhancing your experience using the Service, improving the Service, testing and enhancing security and compilation of demographic data and related usage information for our internal purposes and for other purposes described in this Privacy Policy.</p>
+    <p>While we strive to protect the personal information of our users, we may use, share, or otherwise transfer your personal without your knowledge or consent if required by applicable law or regulatory requirements or in the good-faith belief that such action is necessary or appropriate.</p>
+    <p>From time to time, we may decide that it is more efficient to use third parties to perform specific functions related to the Service. If we use a third party to perform specific functions (such as sending communications to our users on our behalf), then information (such as contact information) may be shared with that third party to the extent necessary for that third party to perform that function. We authorize these third party service providers to use personally identifiable information only for the purpose of providing the specific services requested by us. Third party service providers covered by this paragraph do not include third party sites, applications or services that are accessed via links within the Service, which are governed by a more specific provision below.</p>
+    <p>If you opt-in to a feature that allows third parties to contact you, personal information about you (such as your contact information and other information collected during your visit to the Service) may be shared with data aggregators, marketers, and other organizations (possibly in the form of list rental).</p>
+    <p>In the event that we sell, assign or transfer some or all of our business to a successor or acquirer, we may sell, assign or transfer all of your information, regardless of your status, to such successor or acquirer.</p>
+
+    <h3>How long we store information</h3>
+    <p>NEW_APP_COMPANY_NAME will store your data as long as needed to provide you with our services and to operate our organization. If you ask NEW_APP_COMPANY_NAME to delete specific personal information, we'll honor your request unless deleting that information prevents us from carrying out necessary functions, like calculating taxes or conducting required audits.</p>
+
+    <h3>Security</h3>
+    <p>We have security measures in place to help protect against the unauthorized access to personally identifiable information under our control. We utilize both online and offline security methods, including firewalls, passwords and restricted physical access to the places where your information is stored to help protect personally identifiable information. Our team is trained to comply with our security procedures, and our security procedures are regularly reviewed and revised as we deem necessary.</p>
+
+    <h3>How you can access and update your information</h3>
+    <p>Our goal is for any personal information in our possession to be as accurate, current and complete as necessary for the purposes for which we use that information. If you want to review, verify or correct your personal information, please contact us using the contact information set out below. We reserve the right not to change any personal information and instead append any alternative information the individual concerned believes is appropriate. To some extent, we rely on individuals to update their own personal information. Unless an individual advises us of these important changes, we may have no way of knowing about them.</p>
+
+    <h3>Your legal rights</h3>
+    <p>The State of California enacted the Shine the Light law (CA Civil Code Sec 198.83) that permits users who are California residents to request certain information regarding the disclosure of personal information during the past year for marketing purposes. To make such a request, you can <a href="/contact">contact us</a>.</p>
+    <p>If you are in the European Union, you have certain rights under the General Data Protection Regulation in relation to your personal data:</p>
+    <ul>
+      <li><strong>Access</strong> - You are welcome to request NEW_APP_COMPANY_NAME for copies of your personal data. We may charge you a small fee for this service.</li>
+      <li><strong>Rectification</strong> - You may request that NEW_APP_COMPANY_NAME correct any information you believe is inaccurate. You may also request NEW_APP_COMPANY_NAME to complete the information you believe is incomplete.</li>
+      <li><strong>Erasure</strong> - You may request that NEW_APP_COMPANY_NAME erase your personal data, under certain conditions.</li>
+      <li><strong>Restriction of processing</strong> - You may request that NEW_APP_COMPANY_NAME restrict the processing of your personal data, under certain conditions.</li>
+      <li><strong>Objection to processing</strong> -  You may object to NEW_APP_COMPANY_NAME's processing of your personal data, under certain conditions.</li>
+      <li><strong>Data portability</strong> - You may request that NEW_APP_COMPANY_NAME transfer the data that we have collected to another organization, or directly to you, under certain conditions.</li>
+    </ul>
+    <p>If you make such a request, please be sure to include your contact information. We will reply within 30 days. If you would like to exercise any of these rights, please <a href="/contact">contact us</a>.</p>
+    <p>Should you wish to report a complaint or if you feel that we have not addressed your concern in a satisfactory manner, you have the right to lodge a complaint with your local data protection authority.</p>
+
+    <h3>Electronic mailing lists and how to unsubscribe</h3>
+    <p>We may use your contact information periodically in order to send you email or other communications regarding updates to the Service and to alert you or remind you of happenings related to the Service. The frequency of these messages will vary depending upon various factors.</p>
+    <p>If you no longer wish to receive e-mails from us and want to be removed from our electronic mailing list, please <a href="/contact">contact us</a> and include “Email Unsubscribe” in the body of your message.  If you choose to unsubscribe from our mailing lists, we will hold your contact information on file marked so that we do not inadvertently contact you if your details are subsequently provided to us by a third party.</p>
+
+    <h3>Data protection officer</h3>
+    <p>To communicate with our Data Protection Officer, please email <%= sails.config.custom.internalEmailAddress %>.</p>
+
+    <h3>Other provisions</h3>
+    <p>Your use of the Service indicates an acceptance of the terms of the Privacy Policy. We reserve the right to update or amend this Privacy Policy at any time. We will post any revised version of this Privacy Policy on our website, and we encourage you to refer back to it on a regular basis. The changes contained in any such revised version of this Privacy Policy will be effective from the time such revised version is posted unless otherwise specifically stated therein.</p>
+    <p>This Privacy Policy does not create or confer upon any individual any rights, or impose upon NEW_APP_COMPANY_NAME any rights or obligations outside of, or in addition to, any rights or obligations imposed by the privacy laws of such individual’s jurisdiction, as applicable. Privacy legislation or an individual’s right to privacy may differ from one jurisdiction to another. The rights and obligations described in this Privacy Policy may not apply to all individuals or in all jurisdictions. Should there be, in a specific case, any inconsistency between this Privacy Policy and the applicable privacy laws of such individual’s jurisdiction, this Privacy Policy shall be interpreted, in respect of that case, to give effect to, and comply with, such privacy laws.</p>
+    <p>Please be aware that, by accessing our Service, you acknowledge that our servers are currently located in the United States and that the various communications necessarily result in the transfer of information across international boundaries. By accessing the Service and communicating electronically with us, you consent to the processing and transfer of your personal information as set out in this Privacy Policy.  Personal information collected by us may be stored and processed in the United States of America or any other country in which we maintain facilities. Personal information collected by us may be transferred among our various divisions and affiliated companies around the world, which may involve transfer from countries within the European Economic Area to countries outside the European Economic Area.  By choosing to access the Service, you consent to any such transfer, storage or processing of personal data outside of your country.</p>
+    <p>This Privacy Policy applies solely to the information collected by us on-line through the Service and does not apply to any website, application or service other than the Service.  The Service contains links to other websites, applications and services provided by third parties that we do not own or control and we are not responsible for the privacy policies and practices of those third parties.  Similarly, we are not responsible for the privacy policies and practices of any other websites, applications and services from which you linked to our Service.  We encourage you to be aware when you leave our Service and to read the privacy policies of each and every third party that may be providing websites, applications or information linked to the Service.</p>
+    <p>This Privacy Policy may include examples but is not intended to be restricted in its application to such examples, thus ‘including’ means ‘including without limitation.’</p>
+    <p>Your privacy is important to us. If you have questions about any of the provisions described above, please <a href="/contact">contact us</a>.</p>
+
+    <p><strong>Last updated: DATE_PRIVACY_POLICY_LAST_UPDATED</strong></p>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/legal/terms.ejs b/ee/bulk-operations-dashboard/views/pages/legal/terms.ejs
new file mode 100644
index 000000000000..f959e137d7bd
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/legal/terms.ejs
@@ -0,0 +1,38 @@
+<div id="terms">
+  <div class="container pt-5 pb-5">
+    <h1>Terms of service</h1>
+    <hr/>
+    <p>There are some simple ground rules you'll need to agree to before using NEW_APP_NAME.  Playing by these rules is a mandatory part of using our application, so if you have any questions about them, please <a href="/contact">drop us a line</a> and we'll respond posthaste.</p>
+
+    <h3>NEW_APP_NAME agreement</h3>
+    <p>By using or signing up for NEW_APP_NAME, you are agreeing to be bound by the following terms and conditions (the “<strong>Agreement</strong>”). </p>
+    <p>By marking the applicable "I have read and agree to the terms of service" checkbox, you hereby agree to the Agreement.</p>
+
+    <h5>1. NEW_APP_NAME services</h5>
+    <p>In exchange for your payment of the applicable subscription fee, you may request NEW_APP_NAME services, as described on our website at <%= sails.config.custom.baseUrl %>. We will provide the NEW_APP_NAME services in accordance with this Agreement and the other terms and conditions described on our website at <%= sails.config.custom.baseUrl %>.</p>
+
+    <h5>2. NEW_APP_NAME account</h5>
+    <p>To become a customer, you must complete an order form and create an account by providing first name, last name and company name (if applicable), email address, and any other information indicated as required. We may reject any order form or application for an account for any reason, in our sole discretion. You acknowledge that we will use the email address provided by you as the primary method for communication. You are responsible for keeping your account password secure. We cannot and will not be liable for any loss or damage arising from any failure to maintain the security of the account and password.</p>
+    <p>If you place an order and sign up for an account on behalf of your employer, your employer will be deemed to be the customer for the purpose of this Agreement, and you represent and warrant that you have the authority to bind your employer to this Agreement. Each customer is responsible for assuring that its employees, agents and subcontractors comply with this Agreement.</p>
+
+    <h5>3. Fees</h5>
+    <p>You will pay a fee for your subscription as specified in your NEW_APP_NAME order form.  Fees are based on the subscription term and not actual usage, and fees paid are non-refundable.</p>
+
+    <h5>4. Termination</h5>
+    <p>Either party may terminate this Agreement at any time, with or without cause, effective immediately upon written or electronic notice. Upon termination of this Agreement, all rights granted to you hereunder will immediately cease, including but not limited to the right to access the Account, unless otherwise determined in our sole discretion.</p>
+
+    <h5>5. Intellectual property rights</h5>
+    <p>You agree not to provide us with any confidential or proprietary information. Each party acknowledges and agrees that the other party may freely use and otherwise commercially exploit any ideas, feedback or suggestions provided by it to the other party.</p>
+
+    <h5>6. Disclaimers and limitation of liability of warranty</h5>
+    <p><strong>THE SERVICES ARE PROVIDED “AS-IS” AND WE EXPRESSLY DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT AND FITNESS FOR A PARTICULAR PURPOSE.</strong></p>
+    <p><strong>NEITHER PARTY WILL HAVE ANY LIABILITY WITH RESPECT TO THE SERVICES OR OBLIGATIONS UNDER THIS AGREEMENT OR OTHERWISE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, INCLUDING BUT NOT LIMITED TO, DAMAGES FOR LOSSES OF PROFITS, GOODWILL, USE, DATA OR OTHER INTANGIBLE LOSSES RESULTING IN ANY WAY FROM THE SERVICES.  IN ANY EVENT, EACH PARTY’S LIABILITY UNDER THIS AGREEMENT FOR ANY REASON WILL BE LIMITED TO THE FEES PAID BY YOU DURING THE SIX MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM FOR DAMAGES. THIS LIMITATION APPLIES TO ALL CAUSES OF ACTION IN THE AGGREGATE, INCLUDING, BUT NOT LIMITED TO, BREACH OF CONTRACT, BREACH OF WARRANTY, NEGLIGENCE, STRICT LIABILITY, MISREPRESENTATIONS, AND OTHER TORTS. THESE LIMITATIONS APPLY EVEN IF A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE FOREGOING LIMITATIONS APPLY TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW.</strong></p>
+
+    <h5>7. General provisions</h5>
+    <p>This Agreement sets forth the entire agreement and supersedes any and all prior agreements, written or oral, of the parties with respect to the subject matter hereof. We reserve the right to update and change the Agreement prospectively by posting updates and changes on our website, <%= sails.config.custom.baseUrl %>. You are advised to please check the Agreement from time to time for any updates or changes that may impact you. If a significant change is made, we will provide reasonable notice by email and an opportunity to terminate this Agreement if you do not agree with the change.</p>
+    <p>The parties to this Agreement are independent contractors. Neither party is an agent, representative or related entity of the other party. Nothing in this Agreement is intended to create, nor will it be construed as creating, any exclusive arrangement between the parties to this Agreement. This Agreement does not restrict either party from entering into similar arrangements with others. Each party understands that the other party may now or in the future be involved in developing or providing competitive products or services. Neither party is liability for any failure or delay caused by any circumstance or event beyond its reasonable control.</p>
+
+    <p><strong>Last updated: DATE_TERMS_OF_SERVICE_LAST_UPDATED</strong></p>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/profiles.ejs b/ee/bulk-operations-dashboard/views/pages/profiles.ejs
new file mode 100644
index 000000000000..a7f298900968
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/profiles.ejs
@@ -0,0 +1,154 @@
+<div id="profiles" v-cloak>
+
+  <div purpose="page-content" class="container-fluid">
+    <div class="d-flex flex-column">
+      <div class="pb-4 d-flex flex-row justify-content-between">
+        <div>
+        <h3 purpose="page-heading">Configuration profiles</h3>
+        </div>
+        <div class="d-flex flex-row align-items-center">
+          <p class="mb-0 mr-2">Team:</p>
+          <select class="custom-select team-select" v-model="teamFilter" @change="changeTeamFilter()">
+            <option :value="undefined" selected>All teams</option>
+            <option v-for="team of teams" :value="team.fleetApid">{{team.teamName}}</option>
+          </select>
+        </div>
+      </div>
+    </div>
+    <div class="d-flex flex-row justify-content-between pb-3">
+      <div>
+        <p><strong>Profiles</strong></p>
+      </div>
+      <div>
+        <p style="color: #6A67FE; cursor: pointer;" @click="clickOpenAddProfileModal()">+ Add profile</p>
+      </div>
+    </div>
+    <div style="overflow: visible;" class="mb-4 border rounded table-responsive-md" v-if="profilesToDisplay.length > 0">
+      <table class="table my-0">
+        <thead>
+          <tr>
+            <th class="sortable" :class="sortDirection === 'ASC' ? 'ascending' : sortDirection === 'DESC' ? 'descending' : ''" @click="clickChangeSortDirection()">
+              <div style="cursor: pointer;" class="d-flex flex-row align-items-center pointer">
+                <small><strong>Name</strong></small>
+                <div class="sort-arrows"><span class="ascending-arrow"></span><span class="descending-arrow"></span></div>
+              </div>
+            </th>
+            <th><small><strong>Platform</strong></small></th>
+            <th v-if="teamFilter === undefined"><span><small><strong>Team</strong></small></span></th>
+            <th><span><small><strong>Upload date</strong></small></span></th>
+            <th></th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr v-for="profile in profilesToDisplay">
+            <td class="name-column">{{profile.name}}</td>
+            <td>{{platformFriendlyNames[profile.platform]}}</td>
+            <td v-if="teamFilter === undefined">
+              <a class="affected-teams-link" v-if="profile.teams && profile.teams.length > 0">
+                <span class="truncated-affected-teams" v-if="profile.teams.length > 1">
+                  {{profile.teams.length}} teams
+                  <div class="teams-tooltip">
+                    <p v-for="team in profile.teams" @click="clickChangeTeamFilter(team.fleetApid)">{{team.teamName}}</p>
+                  </div>
+                </span>
+                <span v-else @click="clickChangeTeamFilter(profile.teams[0].fleetApid)">
+                  {{profile.teams[0].teamName}}
+                </span>
+              </a>
+              <p v-else>---</p>
+            </td>
+            <td>
+              <js-timestamp :at="profile.createdAt" format="timeago"></js-timestamp>
+            </td>
+            <td>
+              <div class="d-flex flex-row align-items-start justify-content-end">
+                <img style="height: 16px; margin-right: 24px;" alt="download" class="pointer" src="/images/download-16x16@2x.png" @click="clickDownloadProfile(profile)">
+                <img style="height: 16px; margin-right: 24px;" alt="edit" class="pointer" src="/images/edit-pencil-16x21@2x.png" @click="clickOpenEditModal(profile)">
+                <img style="height: 16px" alt="delete" class="pointer" src="/images/delete-16x21@2x.png" @click="clickOpenDeleteModal(profile)">
+              </div>
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <div v-else>
+      <h2 class="px-3 text-center mx-auto pt-5">No profiles matching the selected filters were found.</h2>
+    </div>
+  </div>
+<%//  ╔═╗╔╦╗╦╔╦╗  ╔═╗╦═╗╔═╗╔═╗╦╦  ╔═╗
+  //  ║╣  ║║║ ║   ╠═╝╠╦╝║ ║╠╣ ║║  ║╣
+  //  ╚═╝═╩╝╩ ╩   ╩  ╩╚═╚═╝╚  ╩╩═╝╚═╝%>
+  <modal v-if="modal === 'edit-profile'" hide-close-button="true" @close="closeModal()">
+    <div>
+      <div class="d-flex flex-row justify-content-between">
+        <h3 class="mb-4">Edit profile</h3>
+        <div class="pointer" @click="closeModal()">&times;</div>
+      </div>
+      <ajax-form :handle-submitting="handleSubmittingEditProfileForm" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-errors.sync="formErrors" :form-data="formData" :form-rules="editProfileFormRules" @submitted="submittedForm()">
+        <div purpose="profile-information" v-if="!formData.newProfile">
+          <div class="d-flex flex-row justify-content-start">
+            <img style="height: 40px; width: 34px;" alt="Configuration profile" src="/images/profile-34x40@2x.png">
+            <div class="d-flex flex-column">
+              <p><strong>{{profileToEdit.name}}</strong></p>
+              <p class="muted">{{platformFriendlyNames[profileToEdit.platform]}}</p>
+            </div>
+          </div>
+        </div>
+        <cloud-error v-if="cloudError === 'payloadIdentifierDoesNotMatch'"></cloud-error>
+        <file-upload id="edit-file-upload" mode="profiles" :disabled="syncing" accept=".xml,.mobileconfig" v-model="formData.newProfile"></file-upload>
+        <div purpose="teams-picker">
+          <p class="mb-2"><strong>Teams</strong></p>
+          <multifield :value="formData.teams" v-model="formData.newTeamIds" input-type="teamSelect" :select-options="teams" add-button-text="Add team"></multifield>
+        </div>
+        <div purpose="modal-buttons" class="d-flex flex-row justify-content-end align-items-center">
+          <cloud-error v-if="cloudError && cloudError !== 'payloadIdentifierDoesNotMatch'"></cloud-error>
+          <ajax-button :syncing.sync="syncing" purpose="modal-button" type="submit">Save</ajax-button>
+        </div>
+      </ajax-form>
+    </div>
+  </modal>
+  <%//  ╔╦╗╔═╗╦  ╔═╗╔╦╗╔═╗  ╔═╗╦═╗╔═╗╔═╗╦╦  ╔═╗
+    //   ║║║╣ ║  ║╣  ║ ║╣   ╠═╝╠╦╝║ ║╠╣ ║║  ║╣
+    //  ═╩╝╚═╝╩═╝╚═╝ ╩ ╚═╝  ╩  ╩╚═╚═╝╚  ╩╩═╝╚═╝%>
+  <modal v-if="modal === 'delete-profile'" hide-close-button="true" @close="closeModal()">
+    <div class="d-flex flex-row justify-content-between">
+      <h3 class="mb-4">Delete profile</h3>
+      <div class="pointer" @click="closeModal()">&times;</div>
+    </div>
+    <p>Delete this profile from all teams</p>
+    <ajax-form :handle-submitting="handleSubmittingDeleteProfileForm" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-errors.sync="formErrors" :form-data="formData" :form-rules="editProfileFormRules" @submitted="submittedForm()">
+    <cloud-error v-if="cloudError"></cloud-error>
+    <div class="d-flex flex-row justify-content-end align-items-center">
+      <a class="mr-3" style="color: #D66C7B; cursor: pointer;" @click="closeModal()">Cancel</a>
+      <ajax-button class="btn" purpose="delete-button" :syncing.sync="syncing">Delete</ajax-button>
+    </div>
+    </ajax-form>
+  </modal>
+  <%//  ╔═╗╔╦╗╔╦╗  ╔═╗╦═╗╔═╗╔═╗╦╦  ╔═╗
+    //  ╠═╣ ║║ ║║  ╠═╝╠╦╝║ ║╠╣ ║║  ║╣
+    //  ╩ ╩═╩╝═╩╝  ╩  ╩╚═╚═╝╚  ╩╩═╝╚═╝%>
+  <modal v-if="modal === 'add-profile'" hide-close-button="true" @close="closeModal()">
+    <div>
+      <div class="d-flex flex-row justify-content-between">
+        <h3 class="mb-4">Add profile</h3>
+        <div class="pointer" @click="closeModal()">&times;</div>
+      </div>
+      <ajax-form :handle-submitting="handleSubmittingAddProfileForm" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-errors.sync="formErrors" :form-data="formData" :form-rules="addProfileFormRules" @submitted="submittedForm()">
+        <file-upload id="add-file-upload" mode="profiles" :class="[formErrors.newProfile ? 'is-invalid' : '']"  :disabled="syncing" v-model="formData.newProfile">
+        </file-upload>
+        <div class="invalid-feedback text-center" v-if="formErrors.newProfile">Please upload a new profile.</div>
+
+        <div purpose="teams-picker" class="mt-4">
+          <p class="mb-2"><strong>Teams</strong></p>
+          <multifield :value="formData.teams" v-model="formData.teams" input-type="teamSelect" :select-options="teams" add-button-text="Add team"></multifield>
+        </div>
+        <cloud-error v-if="cloudError"></cloud-error>
+        <div purpose="modal-buttons" class="d-flex flex-row justify-content-end align-items-center">
+          <a purpose="cancel-button" @click="closeModal()">Cancel</a>
+          <ajax-button :syncing.sync="syncing" purpose="modal-button" :disabled="!formData.newProfile" type="submit">Add</ajax-button>
+        </div>
+      </ajax-form>
+    </div>
+  </modal>
+</div>
+<%- /* Expose server-rendered data as window.SAILS_LOCALS :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/scripts.ejs b/ee/bulk-operations-dashboard/views/pages/scripts.ejs
new file mode 100644
index 000000000000..2b00b7771c3c
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/scripts.ejs
@@ -0,0 +1,164 @@
+<div id="scripts" v-cloak>
+    <div purpose="page-content" class="container-fluid">
+      <div class="d-flex flex-column">
+        <div class="pb-4 d-flex flex-row justify-content-between">
+          <div>
+          <h3 purpose="page-heading" @click="clickChangeTeamFilter(9)">Scripts</h3>
+          </div>
+          <div class="d-flex flex-row align-items-center">
+            <p class="mb-0 mr-2">Team:</p>
+            <select class="custom-select team-select" v-model="teamFilter" @change="changeTeamFilter()">
+              <option :value="undefined" selected>All teams</option>
+              <option v-for="team of teams" :value="team.fleetApid">{{team.teamName}}</option>
+            </select>
+          </div>
+        </div>
+      </div>
+      <div class="d-flex flex-row justify-content-between pb-3">
+        <div>
+          <p><strong>Scripts</strong></p>
+        </div>
+        <div>
+          <p style="color: #6A67FE; cursor: pointer;" @click="clickOpenAddScriptModal()">+ Add script</p>
+        </div>
+      </div>
+      <div style="overflow-y: visible;" class="mb-4 border rounded table-responsive-md" v-if="scriptsToDisplay.length > 0">
+        <table class="table my-0">
+          <thead>
+            <tr>
+              <th class="sortable" :class="sortDirection === 'ASC' ? 'ascending' : sortDirection === 'DESC' ? 'descending' : ''" @click="clickChangeSortDirection()">
+                <div style="cursor: pointer;" class="d-flex flex-row align-items-center pointer">
+                  <small><strong>Name</strong></small>
+                  <div class="sort-arrows">
+                    <span class="ascending-arrow"></span>
+                    <span class="descending-arrow"></span>
+                  </div>
+                </div>
+              </th>
+              <th>
+                <small><strong>Platform</strong></small>
+              </th>
+              <th v-if="teamFilter === undefined">
+                <span><small><strong>Team</strong></small></span>
+              </th>
+              <th>
+                <span><small><strong>Upload date</strong></small></span>
+              </th>
+              <th></th>
+            </tr>
+          </thead>
+          <tbody>
+            <tr v-for="script in scriptsToDisplay" :key="script.name">
+              <td class="name-column">{{script.name}}</td>
+              <td>{{script.platform}}</td>
+              <td v-if="teamFilter === undefined">
+                <a class="affected-teams-link" v-if="script.teams && script.teams.length > 0">
+                  <span class="truncated-affected-teams" v-if="script.teams.length > 1">
+                    {{script.teams.length}} teams
+                    <div class="teams-tooltip">
+                      <p v-for="team in script.teams" @click="clickChangeTeamFilter(team.fleetApid)">{{team.teamName}}</p>
+                    </div>
+                  </span>
+                  <span v-else @click="clickChangeTeamFilter(script.teams[0].fleetApid)">
+                    {{script.teams[0].teamName}}
+                  </span>
+                </a>
+                <span v-else>---</span>
+              </td>
+              <td>
+                <js-timestamp :at="script.createdAt" format="timeago"></js-timestamp>
+              </td>
+              <td>
+                <div class="d-flex flex-row align-items-start justify-content-end">
+                  <img style="height: 16px; margin-right: 24px;" alt="download" class="pointer" src="/images/download-16x16@2x.png" @click="clickDownloadScript(script)">
+                  <img style="height: 16px; margin-right: 24px;" alt="edit" class="pointer" src="/images/edit-pencil-16x21@2x.png" @click="clickOpenEditModal(script)">
+                  <img style="height: 16px" alt="delete" class="pointer" src="/images/delete-16x21@2x.png" @click="clickOpenDeleteModal(script)">
+                </div>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </div>
+      <div v-else>
+        <h3 class="px-3 text-center mx-auto pt-5">No scripts matching the selected filters were found.</h3>
+      </div>
+    </div>
+  <%//  ╔═╗╔╦╗╦╔╦╗  ╔═╗╔═╗╦═╗╦╔═╗╔╦╗
+    //  ║╣  ║║║ ║   ╚═╗║  ╠╦╝║╠═╝ ║
+    //  ╚═╝═╩╝╩ ╩   ╚═╝╚═╝╩╚═╩╩   ╩ %>
+    <modal v-if="modal === 'edit-script'" hide-close-button="true" @close="closeModal()">
+      <div>
+        <div class="d-flex flex-row justify-content-between">
+          <h3 class="mb-4">Edit script</h3>
+          <div class="pointer" @click="closeModal()">&times;</div>
+        </div>
+        <ajax-form action="editScript" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-errors.sync="formErrors" :form-data="formData" :form-rules="editScriptFormRules" @submitted="submittedForm()">
+          <div purpose="script-information" v-if="!formData.newScripts">
+            <div class="d-flex flex-row justify-content-start">
+              <img style="height: 40px; width: 34px;" alt="Windows script" src="/images/script-icon-ps1-34x40@2x.png" v-if="scriptToEdit.platform === 'Windows'">
+              <img style="height: 40px; width: 34px;" alt="macOs and Linux script" src="/images/script-icon-sh-34x40@2x.png" v-else>
+              <div class="d-flex flex-column">
+                <p><strong>{{scriptToEdit.name}}</strong></p>
+                <p class="muted">{{scriptToEdit.platform}}</p>
+              </div>
+            </div>
+          </div>
+          <file-upload id="edit-file-upload" mode="scripts" :disabled="syncing" accept=".xml,.mobileconfig" v-model="formData.newScript"></file-upload>
+          <div purpose="teams-picker" class="mt-4">
+            <p class="mb-2"><strong>Teams</strong></p>
+            <multifield :value="formData.teams" v-model="formData.newTeamIds" input-type="teamSelect" :select-options="teams" add-button-text="Add team"></multifield>
+          </div>
+          <cloud-error v-if="cloudError === 'scriptNameDoesNotMatch'">The new scripts file name identifier must match the old scripts’ file name.</cloud-error>
+          <cloud-error v-else-if="cloudError"></cloud-error>
+          <div purpose="modal-buttons" class="d-flex flex-row justify-content-end align-items-center">
+            <ajax-button :syncing.sync="syncing" purpose="modal-button" type="submit">Save</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+    </modal>
+    <%//  ╔╦╗╔═╗╦  ╔═╗╔╦╗╔═╗  ╔═╗╔═╗╦═╗╦╔═╗╔╦╗
+      //   ║║║╣ ║  ║╣  ║ ║╣   ╚═╗║  ╠╦╝║╠═╝ ║
+      //  ═╩╝╚═╝╩═╝╚═╝ ╩ ╚═╝  ╚═╝╚═╝╩╚═╩╩   ╩ %>
+    <modal v-if="modal === 'delete-script'" hide-close-button="true" @close="closeModal()">
+      <div class="d-flex flex-row justify-content-between">
+        <h3 class="mb-4">Delete script</h3>
+        <div class="pointer" @click="closeModal()">&times;</div>
+      </div>
+      <p class="mb-2">Delete this script from all teams.</p>
+      <p>This will cancel the script from running.</p>
+      <ajax-form :handle-submitting="handleSubmittingDeleteScriptForm" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-errors.sync="formErrors" :form-data="formData" :form-rules="editScriptFormRules" @submitted="submittedForm()">
+        <cloud-error v-if="cloudError"></cloud-error>
+      <div class="d-flex flex-row justify-content-end align-items-center">
+        <a class="mr-3" style="color: #D66C7B; cursor: pointer;" @click="closeModal()">Cancel</a>
+        <ajax-button class="btn" purpose="delete-button" :syncing.sync="syncing">Delete</ajax-button>
+      </div>
+      </ajax-form>
+    </modal>
+    <%//  ╔═╗╔╦╗╔╦╗  ╔═╗╔═╗╦═╗╦╔═╗╔╦╗
+      //  ╠═╣ ║║ ║║  ╚═╗║  ╠╦╝║╠═╝ ║
+      //  ╩ ╩═╩╝═╩╝  ╚═╝╚═╝╩╚═╩╩   ╩ %>
+    <modal v-if="modal === 'add-script'" hide-close-button="true" @close="closeModal()">
+      <div>
+        <div class="d-flex flex-row justify-content-between">
+          <h3 class="mb-4">Add script</h3>
+          <div class="pointer" @click="closeModal()">&times;</div>
+        </div>
+        <ajax-form :handle-submitting="handleSubmittingAddScriptForm" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-errors.sync="formErrors" :form-data="formData" :form-rules="addScriptFormRules" @submitted="submittedForm()">
+          <file-upload id="file-upload" :class="[formErrors.newScript ? 'is-invalid' : '']"  mode="scripts" :disabled="syncing" v-model="formData.newScript"></file-upload>
+          <div class="invalid-feedback text-center" v-if="formErrors.newScript">Please upload a new script.</div>
+          <div purpose="teams-picker" class="mt-4">
+            <p class="mb-2"><strong>Teams</strong></p>
+            <multifield :value="formData.teams" v-model="formData.teams" input-type="teamSelect" :select-options="teams" add-button-text="Add team"></multifield>
+          </div>
+          <div class="invalid-feedback text-center" v-if="formErrors.teams">Please select the teams you want to deploy this script to.</div>
+          <cloud-error v-if="cloudError && cloudError === 'scriptWithThisNameAlreadyExists'">A script with the same name as the uploaded script already exists on one or more of the selected teams.</cloud-error>
+          <cloud-error v-else-if="cloudError"></cloud-error>
+          <div purpose="modal-buttons" class="d-flex flex-row justify-content-end align-items-center">
+            <a purpose="cancel-button" @click="closeModal()">Cancel</a>
+            <ajax-button :syncing.sync="syncing" purpose="modal-button" :disabled="!formData.newScript"  type="submit">Add</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+    </modal>
+</div>
+<%- /* Expose server-rendered data as window.SAILS_LOCALS :: */ exposeLocalsToBrowser() %>
diff --git a/ee/fleetctl/updates.go b/ee/fleetctl/updates.go
index 09010e62ee3a..2e55081fa4e7 100644
--- a/ee/fleetctl/updates.go
+++ b/ee/fleetctl/updates.go
@@ -259,7 +259,7 @@ func updatesAddFunc(c *cli.Context) error {
 		case name == "desktop" && platform == "windows":
 			// This is a special case for the desktop target on Windows.
 			dstPath = filepath.Join(filepath.Dir(dstPath), constant.DesktopAppExecName+".exe")
-		case name == "desktop" && platform == "linux":
+		case name == "desktop" && (platform == "linux" || platform == "linux-arm64"):
 			// This is a special case for the desktop target on Linux.
 			dstPath += ".tar.gz"
 		// The convention for Windows extensions is to use the extension `.ext.exe`
@@ -270,6 +270,8 @@ func updatesAddFunc(c *cli.Context) error {
 			dstPath += ".exe"
 		case strings.HasSuffix(target, ".app.tar.gz"):
 			dstPath += ".app.tar.gz"
+		case strings.HasSuffix(target, ".pkg"):
+			dstPath += ".pkg"
 		// osquery extensions require the .ext suffix
 		case strings.HasSuffix(target, ".ext"):
 			dstPath += ".ext"
@@ -352,7 +354,7 @@ func updatesRotateCommand() *cli.Command {
 		Usage:     "Rotate signing keys",
 		ArgsUsage: "<role>",
 		Description: `Rotate the signing keys used for updates metadata signing. This should be used when keys are compromised or expiring.
-		
+
 role must be one of ['root', 'targets', 'timestamp', 'snapshot']
 		`,
 		Flags:  updatesFlags(),
diff --git a/ee/fleetctl/updates_test.go b/ee/fleetctl/updates_test.go
index 3c5b16f796ab..041cfea6368d 100644
--- a/ee/fleetctl/updates_test.go
+++ b/ee/fleetctl/updates_test.go
@@ -210,7 +210,7 @@ func compressSingleFile(t *testing.T, filePath, outFilePath string) {
 	require.NoError(t, err)
 }
 
-func TestUpdatesIntegration(t *testing.T) {
+func TestIntegrationsUpdates(t *testing.T) {
 	// Not t.Parallel() due to modifications to environment.
 	tmpDir := t.TempDir()
 
diff --git a/ee/fleetd-chrome/package-lock.json b/ee/fleetd-chrome/package-lock.json
index db80f6472538..b2e657bd5891 100644
--- a/ee/fleetd-chrome/package-lock.json
+++ b/ee/fleetd-chrome/package-lock.json
@@ -29,7 +29,7 @@
         "ts-loader": "^9.4.2",
         "ts-node": "^10.9.2",
         "typescript": "^4.9.5",
-        "webpack": "^5.75.0",
+        "webpack": "^5.94.0",
         "webpack-cli": "^5.0.1",
         "webpack-merge": "^5.8.0"
       }
@@ -1122,14 +1122,14 @@
       }
     },
     "node_modules/@jridgewell/gen-mapping": {
-      "version": "0.3.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.2.tgz",
-      "integrity": "sha512-mh65xKQAzI6iBcFzwv28KVWSmCkdRBWoOh+bYQGW3+6OZvbbN3TqMGo5hqYxQniRcH9F2VZIoJCm4pa3BPDK/A==",
+      "version": "0.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.5.tgz",
+      "integrity": "sha512-IzL8ZoEDIBRWEzlCcRhOaCupYyN5gdIK+Q6fbFdPDg6HqX6jpkItn7DFIpW9LQzXG6Df9sA7+OKnq0qlz/GaQg==",
       "dev": true,
       "dependencies": {
-        "@jridgewell/set-array": "^1.0.1",
+        "@jridgewell/set-array": "^1.2.1",
         "@jridgewell/sourcemap-codec": "^1.4.10",
-        "@jridgewell/trace-mapping": "^0.3.9"
+        "@jridgewell/trace-mapping": "^0.3.24"
       },
       "engines": {
         "node": ">=6.0.0"
@@ -1145,22 +1145,22 @@
       }
     },
     "node_modules/@jridgewell/set-array": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.1.2.tgz",
-      "integrity": "sha512-xnkseuNADM0gt2bs+BvhO0p78Mk762YnZdsuzFV018NoG1Sj1SCQvpSqa7XUaTam5vAGasABV9qXASMKnFMwMw==",
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.2.1.tgz",
+      "integrity": "sha512-R8gLRTZeyp03ymzP/6Lil/28tGeGEzhx1q2k703KGWRAI1VdvPIXdG70VJc2pAMw3NA6JKL5hhFu1sJX0Mnn/A==",
       "dev": true,
       "engines": {
         "node": ">=6.0.0"
       }
     },
     "node_modules/@jridgewell/source-map": {
-      "version": "0.3.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.2.tgz",
-      "integrity": "sha512-m7O9o2uR8k2ObDysZYzdfhb08VuEml5oWGiosa1VdaPZ/A6QyPkAJuwN0Q1lhULOf6B7MtQmHENS743hWtCrgw==",
+      "version": "0.3.6",
+      "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.6.tgz",
+      "integrity": "sha512-1ZJTZebgqllO79ue2bm3rIGud/bOe0pP5BjSRCRxxYkEZS8STV7zN84UBbiYu7jy+eCKSnVIUgoWWE/tt+shMQ==",
       "dev": true,
       "dependencies": {
-        "@jridgewell/gen-mapping": "^0.3.0",
-        "@jridgewell/trace-mapping": "^0.3.9"
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.25"
       }
     },
     "node_modules/@jridgewell/sourcemap-codec": {
@@ -1170,13 +1170,13 @@
       "dev": true
     },
     "node_modules/@jridgewell/trace-mapping": {
-      "version": "0.3.17",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.17.tgz",
-      "integrity": "sha512-MCNzAp77qzKca9+W/+I0+sEpaUnZoeasnghNeVc41VZCEKaCH73Vq3BZZ/SzWIgrqE4H4ceI+p+b6C0mHf9T4g==",
+      "version": "0.3.25",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.25.tgz",
+      "integrity": "sha512-vNk6aEwybGtawWmy/PzwnGDOjCkLWSD2wqvjGGAgOAwCGWySYXfYoxt00IJkTF+8Lb57DwOb3Aa0o9CApepiYQ==",
       "dev": true,
       "dependencies": {
-        "@jridgewell/resolve-uri": "3.1.0",
-        "@jridgewell/sourcemap-codec": "1.4.14"
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
     "node_modules/@mswjs/cookies": {
@@ -1411,30 +1411,10 @@
         "@types/ms": "*"
       }
     },
-    "node_modules/@types/eslint": {
-      "version": "8.21.1",
-      "resolved": "https://registry.npmjs.org/@types/eslint/-/eslint-8.21.1.tgz",
-      "integrity": "sha512-rc9K8ZpVjNcLs8Fp0dkozd5Pt2Apk1glO4Vgz8ix1u6yFByxfqo5Yavpy65o+93TAe24jr7v+eSBtFLvOQtCRQ==",
-      "dev": true,
-      "dependencies": {
-        "@types/estree": "*",
-        "@types/json-schema": "*"
-      }
-    },
-    "node_modules/@types/eslint-scope": {
-      "version": "3.7.4",
-      "resolved": "https://registry.npmjs.org/@types/eslint-scope/-/eslint-scope-3.7.4.tgz",
-      "integrity": "sha512-9K4zoImiZc3HlIp6AVUDE4CWYx22a+lhSZMYNpbjW04+YF0KWj4pJXnEMjdnFTiQibFFmElcsasJXDbdI/EPhA==",
-      "dev": true,
-      "dependencies": {
-        "@types/eslint": "*",
-        "@types/estree": "*"
-      }
-    },
     "node_modules/@types/estree": {
-      "version": "0.0.51",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-0.0.51.tgz",
-      "integrity": "sha512-CuPgU6f3eT/XgKKPqKd/gLZV1Xmvf1a2R5POBOGQa6uv82xpls89HU5zKeVoyR8XzHd1RGNOlQlvUe3CFkjWNQ==",
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.5.tgz",
+      "integrity": "sha512-/kYRxGDLWzHOB7q+wtSUQlFrtcdUccpfy+X+9iMBpHK8QLLhx2wIPYuS5DYtR9Wa/YlZAbIovy7qVdB1Aq6Lyw==",
       "dev": true
     },
     "node_modules/@types/filesystem": {
@@ -1597,148 +1577,148 @@
       "dev": true
     },
     "node_modules/@webassemblyjs/ast": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/ast/-/ast-1.11.1.tgz",
-      "integrity": "sha512-ukBh14qFLjxTQNTXocdyksN5QdM28S1CxHt2rdskFyL+xFV7VremuBLVbmCePj+URalXBENx/9Lm7lnhihtCSw==",
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/ast/-/ast-1.12.1.tgz",
+      "integrity": "sha512-EKfMUOPRRUTy5UII4qJDGPpqfwjOmZ5jeGFwid9mnoqIFK+e0vqoi1qH56JpmZSzEL53jKnNzScdmftJyG5xWg==",
       "dev": true,
       "dependencies": {
-        "@webassemblyjs/helper-numbers": "1.11.1",
-        "@webassemblyjs/helper-wasm-bytecode": "1.11.1"
+        "@webassemblyjs/helper-numbers": "1.11.6",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6"
       }
     },
     "node_modules/@webassemblyjs/floating-point-hex-parser": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/floating-point-hex-parser/-/floating-point-hex-parser-1.11.1.tgz",
-      "integrity": "sha512-iGRfyc5Bq+NnNuX8b5hwBrRjzf0ocrJPI6GWFodBFzmFnyvrQ83SHKhmilCU/8Jv67i4GJZBMhEzltxzcNagtQ==",
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/floating-point-hex-parser/-/floating-point-hex-parser-1.11.6.tgz",
+      "integrity": "sha512-ejAj9hfRJ2XMsNHk/v6Fu2dGS+i4UaXBXGemOfQ/JfQ6mdQg/WXtwleQRLLS4OvfDhv8rYnVwH27YJLMyYsxhw==",
       "dev": true
     },
     "node_modules/@webassemblyjs/helper-api-error": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-api-error/-/helper-api-error-1.11.1.tgz",
-      "integrity": "sha512-RlhS8CBCXfRUR/cwo2ho9bkheSXG0+NwooXcc3PAILALf2QLdFyj7KGsKRbVc95hZnhnERon4kW/D3SZpp6Tcg==",
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-api-error/-/helper-api-error-1.11.6.tgz",
+      "integrity": "sha512-o0YkoP4pVu4rN8aTJgAyj9hC2Sv5UlkzCHhxqWj8butaLvnpdc2jOwh4ewE6CX0txSfLn/UYaV/pheS2Txg//Q==",
       "dev": true
     },
     "node_modules/@webassemblyjs/helper-buffer": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-buffer/-/helper-buffer-1.11.1.tgz",
-      "integrity": "sha512-gwikF65aDNeeXa8JxXa2BAk+REjSyhrNC9ZwdT0f8jc4dQQeDQ7G4m0f2QCLPJiMTTO6wfDmRmj/pW0PsUvIcA==",
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-buffer/-/helper-buffer-1.12.1.tgz",
+      "integrity": "sha512-nzJwQw99DNDKr9BVCOZcLuJJUlqkJh+kVzVl6Fmq/tI5ZtEyWT1KZMyOXltXLZJmDtvLCDgwsyrkohEtopTXCw==",
       "dev": true
     },
     "node_modules/@webassemblyjs/helper-numbers": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-numbers/-/helper-numbers-1.11.1.tgz",
-      "integrity": "sha512-vDkbxiB8zfnPdNK9Rajcey5C0w+QJugEglN0of+kmO8l7lDb77AnlKYQF7aarZuCrv+l0UvqL+68gSDr3k9LPQ==",
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-numbers/-/helper-numbers-1.11.6.tgz",
+      "integrity": "sha512-vUIhZ8LZoIWHBohiEObxVm6hwP034jwmc9kuq5GdHZH0wiLVLIPcMCdpJzG4C11cHoQ25TFIQj9kaVADVX7N3g==",
       "dev": true,
       "dependencies": {
-        "@webassemblyjs/floating-point-hex-parser": "1.11.1",
-        "@webassemblyjs/helper-api-error": "1.11.1",
+        "@webassemblyjs/floating-point-hex-parser": "1.11.6",
+        "@webassemblyjs/helper-api-error": "1.11.6",
         "@xtuc/long": "4.2.2"
       }
     },
     "node_modules/@webassemblyjs/helper-wasm-bytecode": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-bytecode/-/helper-wasm-bytecode-1.11.1.tgz",
-      "integrity": "sha512-PvpoOGiJwXeTrSf/qfudJhwlvDQxFgelbMqtq52WWiXC6Xgg1IREdngmPN3bs4RoO83PnL/nFrxucXj1+BX62Q==",
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-bytecode/-/helper-wasm-bytecode-1.11.6.tgz",
+      "integrity": "sha512-sFFHKwcmBprO9e7Icf0+gddyWYDViL8bpPjJJl0WHxCdETktXdmtWLGVzoHbqUcY4Be1LkNfwTmXOJUFZYSJdA==",
       "dev": true
     },
     "node_modules/@webassemblyjs/helper-wasm-section": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-section/-/helper-wasm-section-1.11.1.tgz",
-      "integrity": "sha512-10P9No29rYX1j7F3EVPX3JvGPQPae+AomuSTPiF9eBQeChHI6iqjMIwR9JmOJXwpnn/oVGDk7I5IlskuMwU/pg==",
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-section/-/helper-wasm-section-1.12.1.tgz",
+      "integrity": "sha512-Jif4vfB6FJlUlSbgEMHUyk1j234GTNG9dBJ4XJdOySoj518Xj0oGsNi59cUQF4RRMS9ouBUxDDdyBVfPTypa5g==",
       "dev": true,
       "dependencies": {
-        "@webassemblyjs/ast": "1.11.1",
-        "@webassemblyjs/helper-buffer": "1.11.1",
-        "@webassemblyjs/helper-wasm-bytecode": "1.11.1",
-        "@webassemblyjs/wasm-gen": "1.11.1"
+        "@webassemblyjs/ast": "1.12.1",
+        "@webassemblyjs/helper-buffer": "1.12.1",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
+        "@webassemblyjs/wasm-gen": "1.12.1"
       }
     },
     "node_modules/@webassemblyjs/ieee754": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/ieee754/-/ieee754-1.11.1.tgz",
-      "integrity": "sha512-hJ87QIPtAMKbFq6CGTkZYJivEwZDbQUgYd3qKSadTNOhVY7p+gfP6Sr0lLRVTaG1JjFj+r3YchoqRYxNH3M0GQ==",
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/ieee754/-/ieee754-1.11.6.tgz",
+      "integrity": "sha512-LM4p2csPNvbij6U1f19v6WR56QZ8JcHg3QIJTlSwzFcmx6WSORicYj6I63f9yU1kEUtrpG+kjkiIAkevHpDXrg==",
       "dev": true,
       "dependencies": {
         "@xtuc/ieee754": "^1.2.0"
       }
     },
     "node_modules/@webassemblyjs/leb128": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/leb128/-/leb128-1.11.1.tgz",
-      "integrity": "sha512-BJ2P0hNZ0u+Th1YZXJpzW6miwqQUGcIHT1G/sf72gLVD9DZ5AdYTqPNbHZh6K1M5VmKvFXwGSWZADz+qBWxeRw==",
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/leb128/-/leb128-1.11.6.tgz",
+      "integrity": "sha512-m7a0FhE67DQXgouf1tbN5XQcdWoNgaAuoULHIfGFIEVKA6tu/edls6XnIlkmS6FrXAquJRPni3ZZKjw6FSPjPQ==",
       "dev": true,
       "dependencies": {
         "@xtuc/long": "4.2.2"
       }
     },
     "node_modules/@webassemblyjs/utf8": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/utf8/-/utf8-1.11.1.tgz",
-      "integrity": "sha512-9kqcxAEdMhiwQkHpkNiorZzqpGrodQQ2IGrHHxCy+Ozng0ofyMA0lTqiLkVs1uzTRejX+/O0EOT7KxqVPuXosQ==",
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/utf8/-/utf8-1.11.6.tgz",
+      "integrity": "sha512-vtXf2wTQ3+up9Zsg8sa2yWiQpzSsMyXj0qViVP6xKGCUT8p8YJ6HqI7l5eCnWx1T/FYdsv07HQs2wTFbbof/RA==",
       "dev": true
     },
     "node_modules/@webassemblyjs/wasm-edit": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-edit/-/wasm-edit-1.11.1.tgz",
-      "integrity": "sha512-g+RsupUC1aTHfR8CDgnsVRVZFJqdkFHpsHMfJuWQzWU3tvnLC07UqHICfP+4XyL2tnr1amvl1Sdp06TnYCmVkA==",
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-edit/-/wasm-edit-1.12.1.tgz",
+      "integrity": "sha512-1DuwbVvADvS5mGnXbE+c9NfA8QRcZ6iKquqjjmR10k6o+zzsRVesil54DKexiowcFCPdr/Q0qaMgB01+SQ1u6g==",
       "dev": true,
       "dependencies": {
-        "@webassemblyjs/ast": "1.11.1",
-        "@webassemblyjs/helper-buffer": "1.11.1",
-        "@webassemblyjs/helper-wasm-bytecode": "1.11.1",
-        "@webassemblyjs/helper-wasm-section": "1.11.1",
-        "@webassemblyjs/wasm-gen": "1.11.1",
-        "@webassemblyjs/wasm-opt": "1.11.1",
-        "@webassemblyjs/wasm-parser": "1.11.1",
-        "@webassemblyjs/wast-printer": "1.11.1"
+        "@webassemblyjs/ast": "1.12.1",
+        "@webassemblyjs/helper-buffer": "1.12.1",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
+        "@webassemblyjs/helper-wasm-section": "1.12.1",
+        "@webassemblyjs/wasm-gen": "1.12.1",
+        "@webassemblyjs/wasm-opt": "1.12.1",
+        "@webassemblyjs/wasm-parser": "1.12.1",
+        "@webassemblyjs/wast-printer": "1.12.1"
       }
     },
     "node_modules/@webassemblyjs/wasm-gen": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-gen/-/wasm-gen-1.11.1.tgz",
-      "integrity": "sha512-F7QqKXwwNlMmsulj6+O7r4mmtAlCWfO/0HdgOxSklZfQcDu0TpLiD1mRt/zF25Bk59FIjEuGAIyn5ei4yMfLhA==",
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-gen/-/wasm-gen-1.12.1.tgz",
+      "integrity": "sha512-TDq4Ojh9fcohAw6OIMXqiIcTq5KUXTGRkVxbSo1hQnSy6lAM5GSdfwWeSxpAo0YzgsgF182E/U0mDNhuA0tW7w==",
       "dev": true,
       "dependencies": {
-        "@webassemblyjs/ast": "1.11.1",
-        "@webassemblyjs/helper-wasm-bytecode": "1.11.1",
-        "@webassemblyjs/ieee754": "1.11.1",
-        "@webassemblyjs/leb128": "1.11.1",
-        "@webassemblyjs/utf8": "1.11.1"
+        "@webassemblyjs/ast": "1.12.1",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
+        "@webassemblyjs/ieee754": "1.11.6",
+        "@webassemblyjs/leb128": "1.11.6",
+        "@webassemblyjs/utf8": "1.11.6"
       }
     },
     "node_modules/@webassemblyjs/wasm-opt": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-opt/-/wasm-opt-1.11.1.tgz",
-      "integrity": "sha512-VqnkNqnZlU5EB64pp1l7hdm3hmQw7Vgqa0KF/KCNO9sIpI6Fk6brDEiX+iCOYrvMuBWDws0NkTOxYEb85XQHHw==",
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-opt/-/wasm-opt-1.12.1.tgz",
+      "integrity": "sha512-Jg99j/2gG2iaz3hijw857AVYekZe2SAskcqlWIZXjji5WStnOpVoat3gQfT/Q5tb2djnCjBtMocY/Su1GfxPBg==",
       "dev": true,
       "dependencies": {
-        "@webassemblyjs/ast": "1.11.1",
-        "@webassemblyjs/helper-buffer": "1.11.1",
-        "@webassemblyjs/wasm-gen": "1.11.1",
-        "@webassemblyjs/wasm-parser": "1.11.1"
+        "@webassemblyjs/ast": "1.12.1",
+        "@webassemblyjs/helper-buffer": "1.12.1",
+        "@webassemblyjs/wasm-gen": "1.12.1",
+        "@webassemblyjs/wasm-parser": "1.12.1"
       }
     },
     "node_modules/@webassemblyjs/wasm-parser": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-parser/-/wasm-parser-1.11.1.tgz",
-      "integrity": "sha512-rrBujw+dJu32gYB7/Lup6UhdkPx9S9SnobZzRVL7VcBH9Bt9bCBLEuX/YXOOtBsOZ4NQrRykKhffRWHvigQvOA==",
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-parser/-/wasm-parser-1.12.1.tgz",
+      "integrity": "sha512-xikIi7c2FHXysxXe3COrVUPSheuBtpcfhbpFj4gmu7KRLYOzANztwUU0IbsqvMqzuNK2+glRGWCEqZo1WCLyAQ==",
       "dev": true,
       "dependencies": {
-        "@webassemblyjs/ast": "1.11.1",
-        "@webassemblyjs/helper-api-error": "1.11.1",
-        "@webassemblyjs/helper-wasm-bytecode": "1.11.1",
-        "@webassemblyjs/ieee754": "1.11.1",
-        "@webassemblyjs/leb128": "1.11.1",
-        "@webassemblyjs/utf8": "1.11.1"
+        "@webassemblyjs/ast": "1.12.1",
+        "@webassemblyjs/helper-api-error": "1.11.6",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
+        "@webassemblyjs/ieee754": "1.11.6",
+        "@webassemblyjs/leb128": "1.11.6",
+        "@webassemblyjs/utf8": "1.11.6"
       }
     },
     "node_modules/@webassemblyjs/wast-printer": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wast-printer/-/wast-printer-1.11.1.tgz",
-      "integrity": "sha512-IQboUWM4eKzWW+N/jij2sRatKMh99QEelo3Eb2q0qXkvPRISAj8Qxtmw5itwqK+TTkBuUIE45AxYPToqPtL5gg==",
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wast-printer/-/wast-printer-1.12.1.tgz",
+      "integrity": "sha512-+X4WAlOisVWQMikjbcvY2e0rwPsKQ9F688lksZhBcPycBBuii3O7m8FACbDMWDojpAqvjIncrG8J0XHKyQfVeA==",
       "dev": true,
       "dependencies": {
-        "@webassemblyjs/ast": "1.11.1",
+        "@webassemblyjs/ast": "1.12.1",
         "@xtuc/long": "4.2.2"
       }
     },
@@ -1849,10 +1829,10 @@
         "acorn-walk": "^8.0.2"
       }
     },
-    "node_modules/acorn-import-assertions": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/acorn-import-assertions/-/acorn-import-assertions-1.8.0.tgz",
-      "integrity": "sha512-m7VZ3jwz4eK6A4Vtt8Ew1/mNbP24u0FhdyfA7fSvnJR6LMdfOYnmuIrrJAgrYfYJ10F/otaHTtrtrtmHdMNzEw==",
+    "node_modules/acorn-import-attributes": {
+      "version": "1.9.5",
+      "resolved": "https://registry.npmjs.org/acorn-import-attributes/-/acorn-import-attributes-1.9.5.tgz",
+      "integrity": "sha512-n02Vykv5uA3eHGM/Z2dQrcD56kL8TyDb2p1+0P83PClMnC/nc+anbQRhIOWnSq4Ke/KvDPrY3C9hDtC/A3eHnQ==",
       "dev": true,
       "peerDependencies": {
         "acorn": "^8"
@@ -2268,9 +2248,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.21.5",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.21.5.tgz",
-      "integrity": "sha512-tUkiguQGW7S3IhB7N+c2MV/HZPSCPAAiYBZXLsBhFB/PCy6ZKKsZrmBayHV9fdGV/ARIfJ14NkxKzRDjvp7L6w==",
+      "version": "4.23.3",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.23.3.tgz",
+      "integrity": "sha512-btwCFJVjI4YWDNfau8RhZ+B1Q/VLoUITrm3RlP6y1tYGWIOa+InuYiRGXUBXo8nA1qKmHMyLB/iVQg5TT4eFoA==",
       "dev": true,
       "funding": [
         {
@@ -2280,13 +2260,17 @@
         {
           "type": "tidelift",
           "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
         }
       ],
       "dependencies": {
-        "caniuse-lite": "^1.0.30001449",
-        "electron-to-chromium": "^1.4.284",
-        "node-releases": "^2.0.8",
-        "update-browserslist-db": "^1.0.10"
+        "caniuse-lite": "^1.0.30001646",
+        "electron-to-chromium": "^1.5.4",
+        "node-releases": "^2.0.18",
+        "update-browserslist-db": "^1.1.0"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -2474,9 +2458,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001611",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001611.tgz",
-      "integrity": "sha512-19NuN1/3PjA3QI8Eki55N8my4LzfkMCRLgCVfrl/slbSAchQfV0+GwjPrK3rq37As4UCLlM/DHajbKkAqbv92Q==",
+      "version": "1.0.30001653",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001653.tgz",
+      "integrity": "sha512-XGWQVB8wFQ2+9NZwZ10GxTYC5hk0Fa+q8cSkr0tgvMhYhMHP/QC+WTgrePMDBWiWc/pV+1ik82Al20XOK25Gcw==",
       "dev": true,
       "funding": [
         {
@@ -3230,9 +3214,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.4.315",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.315.tgz",
-      "integrity": "sha512-ndBQYz3Eyy3rASjjQ9poMJGoAlsZ/aZnq6GBsGL4w/4sWIAwiUHVSsMuADbxa8WJw7pZ0oxLpGbtoDt4vRTdCg==",
+      "version": "1.5.13",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.13.tgz",
+      "integrity": "sha512-lbBcvtIJ4J6sS4tb5TLp1b4LyfCdMkwStzXPyAgVgTRAsep4bvrAGaBOP7ZJtQMNJpSQ9SqG4brWOroNaQtm7Q==",
       "dev": true
     },
     "node_modules/emittery": {
@@ -3264,9 +3248,9 @@
       }
     },
     "node_modules/enhanced-resolve": {
-      "version": "5.12.0",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.12.0.tgz",
-      "integrity": "sha512-QHTXI/sZQmko1cbDoNAa3mJ5qhWUUNAq3vR0/YiD379fWQrcfuoX1+HW2S0MTt7XmoPLapdaDKUtelUSPic7hQ==",
+      "version": "5.17.1",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.17.1.tgz",
+      "integrity": "sha512-LMHl3dXhTcfv8gM4kEzIUeTQ+7fpdA0l2tUf34BddXPkz2A5xJ5L/Pchd5BL6rdccM9QGvu0sWZzK1Z1t4wwyg==",
       "dev": true,
       "dependencies": {
         "graceful-fs": "^4.2.4",
@@ -3322,15 +3306,15 @@
       }
     },
     "node_modules/es-module-lexer": {
-      "version": "0.9.3",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-0.9.3.tgz",
-      "integrity": "sha512-1HQ2M2sPtxwnvOvT1ZClHyQDiggdNjURWpY2we6aMKCQiUVxTmVs2UYPLIrD84sS+kMdUwfBSylbJPwNnBrnHQ==",
+      "version": "1.5.4",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.5.4.tgz",
+      "integrity": "sha512-MVNK56NiMrOwitFB7cqDwq0CQutbw+0BvLshJSse0MUNU+y1FC3bUS/AQg7oUng+/wKrrki7JfmwtVHkVfPLlw==",
       "dev": true
     },
     "node_modules/escalade": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.1.tgz",
-      "integrity": "sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw==",
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.2.tgz",
+      "integrity": "sha512-ErCHMCae19vR8vQGe50xIsVomy19rg6gFu3+r3jkEO46suLMWBksvVyoGgQV+jOfl84ZSOSlmv6Gxa89PmTGmA==",
       "dev": true,
       "engines": {
         "node": ">=6"
@@ -3909,9 +3893,9 @@
       }
     },
     "node_modules/graceful-fs": {
-      "version": "4.2.10",
-      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.10.tgz",
-      "integrity": "sha512-9ByhssR2fPVsNZj478qUUbKfmL0+t5BDVyjShtyZZLiK7ZDAArFFfopyOTj0M05wE2tJPisA4iTnnXl2YoPvOA==",
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
       "dev": true
     },
     "node_modules/graphql": {
@@ -6287,9 +6271,9 @@
       "dev": true
     },
     "node_modules/node-releases": {
-      "version": "2.0.10",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.10.tgz",
-      "integrity": "sha512-5GFldHPXVG/YZmFzJvKK2zDSzPKhEp0+ZR5SVaoSag9fsL5YgHbUHDfnG5494ISANDcK4KwPXAx2xqVEydmd7w==",
+      "version": "2.0.18",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.18.tgz",
+      "integrity": "sha512-d9VeXT4SJ7ZeOqGX6R5EM022wpL+eWPooLI+5UpWn2jCT1aosUQEhQP214x33Wkwx3JQMvIm+tIoVOdodFS40g==",
       "dev": true
     },
     "node_modules/node-sass": {
@@ -6629,9 +6613,9 @@
       }
     },
     "node_modules/picocolors": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.0.tgz",
-      "integrity": "sha512-1fygroTLlHu66zi26VoTDv8yRgm0Fccecssto+MhsZ0D/DGW2sm8E8AjW7NU5VVTRt5GxbeZ5qBuJr+HyLYkjQ==",
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.1.tgz",
+      "integrity": "sha512-anP1Z8qwhkbmu7MFP5iTt+wQKXgwzf7zTyGlcdzabySa9vd0Xt392U0rVmz9poOaBj0uHJKyyo9/upk0HrEQew==",
       "dev": true
     },
     "node_modules/picomatch": {
@@ -7828,13 +7812,13 @@
       }
     },
     "node_modules/terser": {
-      "version": "5.16.5",
-      "resolved": "https://registry.npmjs.org/terser/-/terser-5.16.5.tgz",
-      "integrity": "sha512-qcwfg4+RZa3YvlFh0qjifnzBHjKGNbtDo9yivMqMFDy9Q6FSaQWSB/j1xKhsoUFJIqDOM3TsN6D5xbrMrFcHbg==",
+      "version": "5.31.6",
+      "resolved": "https://registry.npmjs.org/terser/-/terser-5.31.6.tgz",
+      "integrity": "sha512-PQ4DAriWzKj+qgehQ7LK5bQqCFNMmlhjR2PFFLuqGCpuCAauxemVBWwWOxo3UIwWQx8+Pr61Df++r76wDmkQBg==",
       "dev": true,
       "dependencies": {
-        "@jridgewell/source-map": "^0.3.2",
-        "acorn": "^8.5.0",
+        "@jridgewell/source-map": "^0.3.3",
+        "acorn": "^8.8.2",
         "commander": "^2.20.0",
         "source-map-support": "~0.5.20"
       },
@@ -7846,16 +7830,16 @@
       }
     },
     "node_modules/terser-webpack-plugin": {
-      "version": "5.3.6",
-      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.3.6.tgz",
-      "integrity": "sha512-kfLFk+PoLUQIbLmB1+PZDMRSZS99Mp+/MHqDNmMA6tOItzRt+Npe3E+fsMs5mfcM0wCtrrdU387UnV+vnSffXQ==",
+      "version": "5.3.10",
+      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.3.10.tgz",
+      "integrity": "sha512-BKFPWlPDndPs+NGGCr1U59t0XScL5317Y0UReNrHaw9/FwhPENlq6bfgs+4yPfyP51vqC1bQ4rp1EfXW5ZSH9w==",
       "dev": true,
       "dependencies": {
-        "@jridgewell/trace-mapping": "^0.3.14",
+        "@jridgewell/trace-mapping": "^0.3.20",
         "jest-worker": "^27.4.5",
         "schema-utils": "^3.1.1",
-        "serialize-javascript": "^6.0.0",
-        "terser": "^5.14.1"
+        "serialize-javascript": "^6.0.1",
+        "terser": "^5.26.0"
       },
       "engines": {
         "node": ">= 10.13.0"
@@ -7911,9 +7895,9 @@
       "dev": true
     },
     "node_modules/terser-webpack-plugin/node_modules/schema-utils": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-3.1.1.tgz",
-      "integrity": "sha512-Y5PQxS4ITlC+EahLuXaY86TXfR7Dc5lw294alXOq86JAHCihAIZfqv8nNCWvaEJvaC51uN9hbLGeV0cFBdH+Fw==",
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-3.3.0.tgz",
+      "integrity": "sha512-pN/yOAvcC+5rQ5nERGuwrjLlYvLTbCibnZ1I7B1LaiAz9BRBlE9GMgE/eqV30P7aJQUf7Ddimy/RsbYO/GrVGg==",
       "dev": true,
       "dependencies": {
         "@types/json-schema": "^7.0.8",
@@ -8216,9 +8200,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.0.13",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.0.13.tgz",
-      "integrity": "sha512-xebP81SNcPuNpPP3uzeW1NYXxI3rxyJzF3pD6sH4jE7o/IX+WtSpwnVU+qIsDPyk0d3hmFQ7mjqc6AtV604hbg==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.0.tgz",
+      "integrity": "sha512-EdRAaAyk2cUE1wOf2DkEhzxqOQvFOoRJFNS6NeyJ01Gp2beMRpBAINjM2iDXE3KCuKhwnvHIQCJm6ThL2Z+HzQ==",
       "dev": true,
       "funding": [
         {
@@ -8235,8 +8219,8 @@
         }
       ],
       "dependencies": {
-        "escalade": "^3.1.1",
-        "picocolors": "^1.0.0"
+        "escalade": "^3.1.2",
+        "picocolors": "^1.0.1"
       },
       "bin": {
         "update-browserslist-db": "cli.js"
@@ -8351,9 +8335,9 @@
       }
     },
     "node_modules/watchpack": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.4.0.tgz",
-      "integrity": "sha512-Lcvm7MGST/4fup+ifyKi2hjyIAwcdI4HRgtvTpIUxBRhB+RFtUh8XtDOxUfctVCnhVi+QQj49i91OyvzkJl6cg==",
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.4.2.tgz",
+      "integrity": "sha512-TnbFSbcOCcDgjZ4piURLCbJ3nJhznVh9kw6F6iokjiFPl8ONxe9A6nMDVXDiNbrSfLILs6vB07F7wLBrwPYzJw==",
       "dev": true,
       "dependencies": {
         "glob-to-regexp": "^0.4.1",
@@ -8391,34 +8375,33 @@
       "dev": true
     },
     "node_modules/webpack": {
-      "version": "5.76.1",
-      "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.76.1.tgz",
-      "integrity": "sha512-4+YIK4Abzv8172/SGqObnUjaIHjLEuUasz9EwQj/9xmPPkYJy2Mh03Q/lJfSD3YLzbxy5FeTq5Uw0323Oh6SJQ==",
+      "version": "5.94.0",
+      "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.94.0.tgz",
+      "integrity": "sha512-KcsGn50VT+06JH/iunZJedYGUJS5FGjow8wb9c0v5n1Om8O1g4L6LjtfxwlXIATopoQu+vOXXa7gYisWxCoPyg==",
       "dev": true,
       "dependencies": {
-        "@types/eslint-scope": "^3.7.3",
-        "@types/estree": "^0.0.51",
-        "@webassemblyjs/ast": "1.11.1",
-        "@webassemblyjs/wasm-edit": "1.11.1",
-        "@webassemblyjs/wasm-parser": "1.11.1",
+        "@types/estree": "^1.0.5",
+        "@webassemblyjs/ast": "^1.12.1",
+        "@webassemblyjs/wasm-edit": "^1.12.1",
+        "@webassemblyjs/wasm-parser": "^1.12.1",
         "acorn": "^8.7.1",
-        "acorn-import-assertions": "^1.7.6",
-        "browserslist": "^4.14.5",
+        "acorn-import-attributes": "^1.9.5",
+        "browserslist": "^4.21.10",
         "chrome-trace-event": "^1.0.2",
-        "enhanced-resolve": "^5.10.0",
-        "es-module-lexer": "^0.9.0",
+        "enhanced-resolve": "^5.17.1",
+        "es-module-lexer": "^1.2.1",
         "eslint-scope": "5.1.1",
         "events": "^3.2.0",
         "glob-to-regexp": "^0.4.1",
-        "graceful-fs": "^4.2.9",
+        "graceful-fs": "^4.2.11",
         "json-parse-even-better-errors": "^2.3.1",
         "loader-runner": "^4.2.0",
         "mime-types": "^2.1.27",
         "neo-async": "^2.6.2",
-        "schema-utils": "^3.1.0",
+        "schema-utils": "^3.2.0",
         "tapable": "^2.1.1",
-        "terser-webpack-plugin": "^5.1.3",
-        "watchpack": "^2.4.0",
+        "terser-webpack-plugin": "^5.3.10",
+        "watchpack": "^2.4.1",
         "webpack-sources": "^3.2.3"
       },
       "bin": {
@@ -8545,9 +8528,9 @@
       "dev": true
     },
     "node_modules/webpack/node_modules/schema-utils": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-3.1.1.tgz",
-      "integrity": "sha512-Y5PQxS4ITlC+EahLuXaY86TXfR7Dc5lw294alXOq86JAHCihAIZfqv8nNCWvaEJvaC51uN9hbLGeV0cFBdH+Fw==",
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-3.3.0.tgz",
+      "integrity": "sha512-pN/yOAvcC+5rQ5nERGuwrjLlYvLTbCibnZ1I7B1LaiAz9BRBlE9GMgE/eqV30P7aJQUf7Ddimy/RsbYO/GrVGg==",
       "dev": true,
       "dependencies": {
         "@types/json-schema": "^7.0.8",
@@ -8680,9 +8663,9 @@
       }
     },
     "node_modules/ws": {
-      "version": "8.16.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.16.0.tgz",
-      "integrity": "sha512-HS0c//TP7Ina87TfiPUz1rQzMhHrl/SG2guqRcTOIUYD2q8uhUdNHZYJUaQ8aTGPzCh+c6oawMKW35nFl1dxyQ==",
+      "version": "8.17.1",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.17.1.tgz",
+      "integrity": "sha512-6XQFvXTkbfUOZOKKILFG1PDK2NDQs4azKQl26T0YS5CxqWLgXajbPZ+h4gZekJyRqFU8pvnbAbbs/3TgRPy+GQ==",
       "dev": true,
       "engines": {
         "node": ">=10.0.0"
diff --git a/ee/fleetd-chrome/package.json b/ee/fleetd-chrome/package.json
index e8c3f9e3222b..19582559364a 100644
--- a/ee/fleetd-chrome/package.json
+++ b/ee/fleetd-chrome/package.json
@@ -24,7 +24,7 @@
     "ts-loader": "^9.4.2",
     "ts-node": "^10.9.2",
     "typescript": "^4.9.5",
-    "webpack": "^5.75.0",
+    "webpack": "^5.94.0",
     "webpack-cli": "^5.0.1",
     "webpack-merge": "^5.8.0"
   },
diff --git a/ee/server/calendar/google_calendar.go b/ee/server/calendar/google_calendar.go
index db7f98cc7998..7abbc6c4c661 100644
--- a/ee/server/calendar/google_calendar.go
+++ b/ee/server/calendar/google_calendar.go
@@ -89,6 +89,7 @@ type GoogleCalendarAPI interface {
 	GetSetting(name string) (*calendar.Setting, error)
 	ListEvents(timeMin, timeMax string) (*calendar.Events, error)
 	CreateEvent(event *calendar.Event) (*calendar.Event, error)
+	UpdateEvent(event *calendar.Event) (*calendar.Event, error)
 	GetEvent(id, eTag string) (*calendar.Event, error)
 	DeleteEvent(id string) error
 	Watch(eventUUID string, channelID string, ttl uint64) (resourceID string, err error)
@@ -101,6 +102,8 @@ type eventDetails struct {
 	// ChannelID and ResourceID are for watching event changes
 	ChannelID  string `json:"channel_id"`
 	ResourceID string `json:"resource_id"`
+	// BodyTag is an identifier for the body content of the event
+	BodyTag string `json:"body_tag"`
 }
 
 type GoogleCalendarLowLevelAPI struct {
@@ -141,6 +144,9 @@ func adjustEmail(email string) string {
 func (lowLevelAPI *GoogleCalendarLowLevelAPI) GetSetting(name string) (*calendar.Setting, error) {
 	result, err := lowLevelAPI.withRetry(
 		func() (any, error) {
+			if lowLevelAPI.service == nil || lowLevelAPI.service.Settings == nil {
+				return nil, errors.New("calendar service or settings not initialized")
+			}
 			return lowLevelAPI.service.Settings.Get(name).Do()
 		},
 	)
@@ -150,15 +156,33 @@ func (lowLevelAPI *GoogleCalendarLowLevelAPI) GetSetting(name string) (*calendar
 func (lowLevelAPI *GoogleCalendarLowLevelAPI) CreateEvent(event *calendar.Event) (*calendar.Event, error) {
 	result, err := lowLevelAPI.withRetry(
 		func() (any, error) {
+			if lowLevelAPI.service == nil || lowLevelAPI.service.Events == nil {
+				return nil, errors.New("calendar service or events not initialized (CreateEvent)")
+			}
 			return lowLevelAPI.service.Events.Insert(calendarID, event).Do()
 		},
 	)
 	return result.(*calendar.Event), err
 }
 
+func (lowLevelAPI *GoogleCalendarLowLevelAPI) UpdateEvent(event *calendar.Event) (*calendar.Event, error) {
+	result, err := lowLevelAPI.withRetry(
+		func() (any, error) {
+			if lowLevelAPI.service == nil || lowLevelAPI.service.Events == nil {
+				return nil, errors.New("calendar service or events not initialized (UpdateEvent)")
+			}
+			return lowLevelAPI.service.Events.Update(calendarID, event.Id, event).Do()
+		},
+	)
+	return result.(*calendar.Event), err
+}
+
 func (lowLevelAPI *GoogleCalendarLowLevelAPI) GetEvent(id, eTag string) (*calendar.Event, error) {
 	result, err := lowLevelAPI.withRetry(
 		func() (any, error) {
+			if lowLevelAPI.service == nil || lowLevelAPI.service.Events == nil {
+				return nil, errors.New("calendar service or events not initialized (GetEvent)")
+			}
 			return lowLevelAPI.service.Events.Get(calendarID, id).IfNoneMatch(eTag).Do()
 		},
 	)
@@ -168,6 +192,9 @@ func (lowLevelAPI *GoogleCalendarLowLevelAPI) GetEvent(id, eTag string) (*calend
 func (lowLevelAPI *GoogleCalendarLowLevelAPI) ListEvents(timeMin, timeMax string) (*calendar.Events, error) {
 	result, err := lowLevelAPI.withRetry(
 		func() (any, error) {
+			if lowLevelAPI.service == nil || lowLevelAPI.service.Events == nil {
+				return nil, errors.New("calendar service or events not initialized (ListEvents)")
+			}
 			// Default maximum number of events returned is 250, which should be sufficient for most calendars.
 			return lowLevelAPI.service.Events.List(calendarID).
 				EventTypes("default").
@@ -185,6 +212,9 @@ func (lowLevelAPI *GoogleCalendarLowLevelAPI) ListEvents(timeMin, timeMax string
 func (lowLevelAPI *GoogleCalendarLowLevelAPI) DeleteEvent(id string) error {
 	_, err := lowLevelAPI.withRetry(
 		func() (any, error) {
+			if lowLevelAPI.service == nil || lowLevelAPI.service.Events == nil {
+				return nil, errors.New("calendar service or events not initialized (DeleteEvent)")
+			}
 			return nil, lowLevelAPI.service.Events.Delete(calendarID, id).Do()
 		},
 	)
@@ -194,6 +224,9 @@ func (lowLevelAPI *GoogleCalendarLowLevelAPI) DeleteEvent(id string) error {
 func (lowLevelAPI *GoogleCalendarLowLevelAPI) Watch(eventUUID string, channelID string, ttl uint64) (resourceID string, err error) {
 	resp, err := lowLevelAPI.withRetry(
 		func() (any, error) {
+			if lowLevelAPI.service == nil || lowLevelAPI.service.Events == nil {
+				return nil, errors.New("calendar service or events not initialized (Watch)")
+			}
 			return lowLevelAPI.service.Events.Watch(calendarID, &calendar.Channel{
 				Id:   channelID, // channelID is also used for authentication -- it should be a random value
 				Type: "web_hook",
@@ -214,6 +247,9 @@ func (lowLevelAPI *GoogleCalendarLowLevelAPI) Watch(eventUUID string, channelID
 func (lowLevelAPI *GoogleCalendarLowLevelAPI) Stop(channelID string, resourceID string) error {
 	_, err := lowLevelAPI.withRetry(
 		func() (any, error) {
+			if lowLevelAPI.service == nil || lowLevelAPI.service.Channels == nil {
+				return nil, errors.New("calendar service or channels not initialized (Stop)")
+			}
 			return nil, lowLevelAPI.service.Channels.Stop(&calendar.Channel{
 				Id:         channelID,
 				ResourceId: resourceID,
@@ -261,7 +297,35 @@ func (c *GoogleCalendar) Configure(userEmail string) error {
 	return nil
 }
 
-func (c *GoogleCalendar) GetAndUpdateEvent(event *fleet.CalendarEvent, genBodyFn func(conflict bool) (body string, ok bool, err error)) (
+func (c *GoogleCalendar) UpdateEventBody(event *fleet.CalendarEvent,
+	genBodyFn fleet.CalendarGenBodyFn) (string, error) {
+	details, err := c.unmarshalDetails(event)
+	if err != nil {
+		return "", err
+	}
+	gEvent, err := c.config.API.GetEvent(details.ID, "")
+	if err != nil {
+		return "", ctxerr.Wrap(c.config.Context, err, "retrieving Google calendar event")
+	}
+	// Check if the current description contains the conflict text
+	conflict := strings.Contains(gEvent.Description, fleet.CalendarEventConflictText)
+	var ok bool
+	gEvent.Description, ok, err = genBodyFn(conflict)
+	if err != nil {
+		return "", ctxerr.Wrap(c.config.Context, err, "generating calendar event body")
+	}
+	if !ok {
+		return "", nil
+	}
+	updatedEvent, err := c.config.API.UpdateEvent(gEvent)
+	if err != nil {
+		return "", ctxerr.Wrap(c.config.Context, err, "updating Google calendar event")
+	}
+	return updatedEvent.Etag, nil
+}
+
+func (c *GoogleCalendar) GetAndUpdateEvent(event *fleet.CalendarEvent, genBodyFn fleet.CalendarGenBodyFn,
+	opts fleet.CalendarGetAndUpdateEventOpts) (
 	*fleet.CalendarEvent, bool, error,
 ) {
 	// We assume that the Fleet event has not already ended. We will simply return it if it has not been modified.
@@ -269,26 +333,54 @@ func (c *GoogleCalendar) GetAndUpdateEvent(event *fleet.CalendarEvent, genBodyFn
 	if err != nil {
 		return nil, false, err
 	}
+
+	// Set current calendar instance timezone to the latest from Google calendar.
+	var tzUpdated bool
+	var latestTzName string
+	updateTimezone := func() error {
+		c.location, err = getTimezone(c)
+		if err != nil {
+			return err
+		}
+		latestTzName = c.location.String()
+		// nil if cal event created before Fleet tracked timezone
+		tzUpdated = event.TimeZone == nil || (latestTzName != *event.TimeZone)
+		return nil
+	}
+	if opts.UpdateTimezone {
+		err = updateTimezone()
+		if err != nil {
+			return nil, false, err
+		}
+	}
+
 	gEvent, err := c.config.API.GetEvent(details.ID, details.ETag)
 	var deleted bool
 	switch {
 	// http.StatusNotModified is returned sometimes, but not always, so we need to check ETag explicitly later
 	case googleapi.IsNotModified(err):
+		if tzUpdated {
+			// this condition occurs when the event itself hasn't been updated, but the calendar timezone
+			// has been, so update the Fleet event's timezone
+			event.TimeZone = &latestTzName
+			return event, true, nil
+		}
 		return event, false, nil
 	// http.StatusNotFound should be very rare -- Google keeps events for a while after they are deleted
 	case isNotFound(err):
 		deleted = true
-		// If event was deleted, we need to stop watching it
-		err = c.config.API.Stop(details.ChannelID, details.ResourceID)
-		if err != nil {
-			level.Warn(c.config.Logger).Log("msg", "stopping Google calendar event watch", "err", err)
-		}
 	case err != nil:
 		return nil, false, ctxerr.Wrap(c.config.Context, err, "retrieving Google calendar event")
 	}
 	if !deleted && gEvent.Status != "cancelled" {
 		if details.ETag != "" && details.ETag == gEvent.Etag {
 			// Event was not modified
+			if tzUpdated {
+				// this condition occurs when the event itself hasn't been updated, but the calendar timezone
+				// has been, so just update the event's timezone
+				event.TimeZone = &latestTzName
+				return event, true, nil
+			}
 			return event, false, nil
 		}
 		if gEvent.End == nil || (gEvent.End.DateTime == "" && gEvent.End.Date == "") {
@@ -338,11 +430,19 @@ func (c *GoogleCalendar) GetAndUpdateEvent(event *fleet.CalendarEvent, genBodyFn
 			}
 		}
 		if !deleted {
+			if c.location == nil {
+				// When we are updating the event, also update the timezone if needed
+				err = updateTimezone()
+				if err != nil {
+					return nil, false, err
+				}
+			}
 			startTime, err := c.parseDateTime(gEvent.Start)
 			if err != nil {
 				return nil, false, err
 			}
-			fleetEvent, err := c.googleEventToFleetEvent(*startTime, *endTime, gEvent, event.UUID, details.ChannelID, details.ResourceID)
+			fleetEvent, err := c.googleEventToFleetEvent(*startTime, *endTime, gEvent, event.UUID, details.ChannelID, details.ResourceID,
+				details.BodyTag)
 			if err != nil {
 				return nil, false, err
 			}
@@ -350,9 +450,19 @@ func (c *GoogleCalendar) GetAndUpdateEvent(event *fleet.CalendarEvent, genBodyFn
 		}
 	}
 
+	// When calculating the new event date, we don't check if the user's calendar timezone has changed.
+	// If the user went across international dateline into "tomorrow", then their event may be re-scheduled for the same day.
+	// Since this rare corner case does not cause any harm, we will ignore it.
 	newStartDate := calculateNewEventDate(event.StartTime)
 
-	fleetEvent, err := c.CreateEvent(newStartDate, genBodyFn)
+	var createOpts fleet.CalendarCreateEventOpts
+	// Check for backward compatibility, for events created before we introduced notification channels
+	if details.ChannelID != "" && details.ResourceID != "" {
+		createOpts.EventUUID = event.UUID
+		createOpts.ChannelID = details.ChannelID
+		createOpts.ResourceID = details.ResourceID
+	}
+	fleetEvent, err := c.CreateEvent(newStartDate, genBodyFn, createOpts)
 	if err != nil {
 		return nil, false, err
 	}
@@ -430,14 +540,16 @@ func (c *GoogleCalendar) unmarshalDetails(event *fleet.CalendarEvent) (*eventDet
 }
 
 func (c *GoogleCalendar) CreateEvent(dayOfEvent time.Time,
-	genBodyFn func(conflict bool) (body string, ok bool, err error)) (*fleet.CalendarEvent, error) {
-	return c.createEvent(dayOfEvent, genBodyFn, time.Now)
+	genBodyFn fleet.CalendarGenBodyFn,
+	opts fleet.CalendarCreateEventOpts) (*fleet.CalendarEvent, error) {
+	return c.createEvent(dayOfEvent, genBodyFn, time.Now, opts)
 }
 
 // createEvent creates a new event on the calendar on the given date. timeNow is a function that returns the current time.
 // timeNow can be overwritten for testing
 func (c *GoogleCalendar) createEvent(
-	dayOfEvent time.Time, genBodyFn func(conflict bool) (body string, ok bool, err error), timeNow func() time.Time,
+	dayOfEvent time.Time, genBodyFn fleet.CalendarGenBodyFn, timeNow func() time.Time,
+	opts fleet.CalendarCreateEventOpts,
 ) (*fleet.CalendarEvent, error) {
 	var err error
 	if c.location == nil {
@@ -485,6 +597,11 @@ func (c *GoogleCalendar) createEvent(
 			continue
 		}
 
+		if gEvent.Transparency == "transparent" {
+			// Ignore events that do not block time on the calendar (e.g. free events)
+			continue
+		}
+
 		// Ignore events that the user has declined
 		var declined bool
 		for _, attendee := range gEvent.Attendees {
@@ -545,17 +662,26 @@ func (c *GoogleCalendar) createEvent(
 		return nil, ctxerr.Wrap(c.config.Context, err, "creating Google calendar event")
 	}
 
-	// Watch for event changes
-	secondsToEventEnd := eventEnd.Sub(now).Milliseconds() / 1000
-	eventUUID := uuid.New().String()
-	channelUUID := uuid.New().String()
-	resourceID, err := c.config.API.Watch(eventUUID, channelUUID, uint64(secondsToEventEnd))
-	if err != nil {
-		return nil, ctxerr.Wrap(c.config.Context, err, "watching Google calendar event")
+	// Watch for event changes, if not already watching.
+	var eventUUID, channelID, resourceID string
+	if opts.EventUUID == "" || opts.ChannelID == "" || opts.ResourceID == "" {
+		// Watch for changes until the end of the event, plus 1 more week. The extra time is to handle cases when end user moves the event forward.
+		// We don't support watching events longer than 1 week from the original event time.
+		secondsToEventEnd := (eventEnd.Sub(now).Milliseconds() / 1000) + (7 * 24 * 60 * 60)
+		eventUUID = strings.ToUpper(uuid.New().String()) // Standardize on uppercase UUIDs since that's how they come from DB
+		channelID = uuid.New().String()
+		resourceID, err = c.config.API.Watch(eventUUID, channelID, uint64(secondsToEventEnd))
+		if err != nil {
+			return nil, ctxerr.Wrap(c.config.Context, err, "watching Google calendar event")
+		}
+	} else {
+		eventUUID = opts.EventUUID
+		channelID = opts.ChannelID
+		resourceID = opts.ResourceID
 	}
 
-	// Convert Google event to Fleet event
-	fleetEvent, err := c.googleEventToFleetEvent(eventStart, eventEnd, event, eventUUID, channelUUID, resourceID)
+	// Convert Google event to Fleet event. Body tag will be updated by the calling function.
+	fleetEvent, err := c.googleEventToFleetEvent(eventStart, eventEnd, event, eventUUID, channelID, resourceID, "body_tag")
 	if err != nil {
 		return nil, err
 	}
@@ -587,12 +713,12 @@ func adjustEventTimes(endTime time.Time, dayEnd time.Time) (eventStart time.Time
 func getTimezone(gCal *GoogleCalendar) (location *time.Location, err error) {
 	config := gCal.config
 	// "The ID of the user’s timezone." https://developers.google.com/calendar/api/v3/reference/settings
-	tz, err := config.API.GetSetting("timezone")
+	gCalTz, err := config.API.GetSetting("timezone")
 	if err != nil {
 		return nil, ctxerr.Wrap(config.Context, err, "retrieving Google calendar timezone")
 	}
 
-	return getLocation(tz.Value, config), nil
+	return getLocation(gCalTz.Value, config), nil
 }
 
 func getLocation(tz string, config *GoogleCalendarConfig) *time.Location {
@@ -606,21 +732,22 @@ func getLocation(tz string, config *GoogleCalendarConfig) *time.Location {
 }
 
 func (c *GoogleCalendar) googleEventToFleetEvent(startTime time.Time, endTime time.Time, event *calendar.Event, eventUUID string,
-	channelID string,
-	resourceID string) (
+	channelID string, resourceID string, bodyTag string) (
 	*fleet.CalendarEvent, error,
 ) {
+	tzName := c.location.String()
 	fleetEvent := &fleet.CalendarEvent{}
 	fleetEvent.StartTime = startTime
 	fleetEvent.EndTime = endTime
 	fleetEvent.Email = c.currentUserEmail
-	fleetEvent.TimeZone = c.location.String()
+	fleetEvent.TimeZone = &tzName
 	fleetEvent.UUID = eventUUID
 	details := &eventDetails{
 		ID:         event.Id,
 		ETag:       event.Etag,
 		ChannelID:  channelID,
 		ResourceID: resourceID,
+		BodyTag:    bodyTag,
 	}
 	detailsJson, err := json.Marshal(details)
 	if err != nil {
@@ -635,13 +762,6 @@ func (c *GoogleCalendar) DeleteEvent(event *fleet.CalendarEvent) error {
 	if err != nil {
 		return err
 	}
-	// Stop watching the event before deleting the event so that we don't get a callback for the deletion
-	if details.ChannelID != "" && details.ResourceID != "" {
-		stopErr := c.config.API.Stop(details.ChannelID, details.ResourceID)
-		if stopErr != nil {
-			level.Warn(c.config.Logger).Log("msg", "stopping Google calendar event watch", "err", stopErr)
-		}
-	}
 	// Delete the event
 	err = c.config.API.DeleteEvent(details.ID)
 	switch {
@@ -661,7 +781,7 @@ func (c *GoogleCalendar) StopEventChannel(event *fleet.CalendarEvent) error {
 	if details.ChannelID != "" && details.ResourceID != "" {
 		stopErr := c.config.API.Stop(details.ChannelID, details.ResourceID)
 		if stopErr != nil {
-			level.Warn(c.config.Logger).Log("msg", "stopping Google calendar event watch", "err", stopErr)
+			level.Info(c.config.Logger).Log("msg", "stopping Google calendar event watch", "err", stopErr)
 		}
 	}
 	return nil
diff --git a/ee/server/calendar/google_calendar_integration_test.go b/ee/server/calendar/google_calendar_integration_test.go
index 6e2bce57a202..7e51a4d1f719 100644
--- a/ee/server/calendar/google_calendar_integration_test.go
+++ b/ee/server/calendar/google_calendar_integration_test.go
@@ -2,16 +2,17 @@ package calendar
 
 import (
 	"context"
+	"net/http/httptest"
+	"os"
+	"testing"
+	"time"
+
 	"github.com/fleetdm/fleet/v4/ee/server/calendar/load_test"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	kitlog "github.com/go-kit/log"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
-	"net/http/httptest"
-	"os"
-	"testing"
-	"time"
 )
 
 type googleCalendarIntegrationTestSuite struct {
@@ -44,7 +45,7 @@ func (s *googleCalendarIntegrationTestSuite) TearDownSuite() {
 
 // TestGoogleCalendarIntegration tests should be able to be run in parallel, but this is not natively supported by suites: https://github.com/stretchr/testify/issues/187
 // There are workarounds that can be explored.
-func TestGoogleCalendarIntegration(t *testing.T) {
+func TestIntegrationsGoogleCalendar(t *testing.T) {
 	testingSuite := new(googleCalendarIntegrationTestSuite)
 	suite.Run(t, testingSuite)
 }
@@ -66,16 +67,24 @@ func (s *googleCalendarIntegrationTestSuite) TestCreateGetDeleteEvent() {
 	gCal := NewGoogleCalendar(config)
 	err := gCal.Configure(userEmail)
 	require.NoError(t, err)
-	genBodyFn := func(bool) (string, bool, error) {
+	var genBodyFn fleet.CalendarGenBodyFn = func(bool) (string, bool, error) {
 		return "Test event", true, nil
 	}
 	eventDate := time.Now().Add(48 * time.Hour)
-	event, err := gCal.CreateEvent(eventDate, genBodyFn)
+	event, err := gCal.CreateEvent(eventDate, genBodyFn, fleet.CalendarCreateEventOpts{})
 	require.NoError(t, err)
 	assert.Equal(t, startHour, event.StartTime.Hour())
 	assert.Equal(t, 0, event.StartTime.Minute())
+	details, err := gCal.unmarshalDetails(event)
+	require.NoError(t, err)
+	eventUUID := event.UUID
+	channelID := details.ChannelID
+	resourceID := details.ResourceID
+	assert.NotEmpty(t, eventUUID)
+	assert.NotEmpty(t, channelID)
+	assert.NotEmpty(t, resourceID)
 
-	eventRsp, updated, err := gCal.GetAndUpdateEvent(event, genBodyFn)
+	eventRsp, updated, err := gCal.GetAndUpdateEvent(event, genBodyFn, fleet.CalendarGetAndUpdateEventOpts{})
 	require.NoError(t, err)
 	assert.False(t, updated)
 	assert.Equal(t, event, eventRsp)
@@ -87,10 +96,25 @@ func (s *googleCalendarIntegrationTestSuite) TestCreateGetDeleteEvent() {
 	assert.NoError(t, err)
 
 	// Try to get deleted event
-	eventRsp, updated, err = gCal.GetAndUpdateEvent(event, genBodyFn)
+	eventRsp, updated, err = gCal.GetAndUpdateEvent(event, genBodyFn, fleet.CalendarGetAndUpdateEventOpts{})
 	require.NoError(t, err)
 	assert.True(t, updated)
 	assert.NotEqual(t, event.StartTime.UTC().Truncate(24*time.Hour), eventRsp.StartTime.UTC().Truncate(24*time.Hour))
+
+	opts := fleet.CalendarCreateEventOpts{
+		ChannelID:  channelID,
+		ResourceID: resourceID,
+		EventUUID:  eventUUID,
+	}
+	event, err = gCal.CreateEvent(eventDate, genBodyFn, opts)
+	require.NoError(t, err)
+	assert.Equal(t, startHour, event.StartTime.Hour())
+	assert.Equal(t, 0, event.StartTime.Minute())
+	details, err = gCal.unmarshalDetails(event)
+	require.NoError(t, err)
+	assert.Equal(t, channelID, details.ChannelID)
+	assert.Equal(t, resourceID, details.ResourceID)
+	assert.Equal(t, eventUUID, event.UUID)
 }
 
 func (s *googleCalendarIntegrationTestSuite) TestFillUpCalendar() {
@@ -114,7 +138,7 @@ func (s *googleCalendarIntegrationTestSuite) TestFillUpCalendar() {
 		return "Test event", true, nil
 	}
 	eventDate := time.Now().Add(48 * time.Hour)
-	event, err := gCal.CreateEvent(eventDate, genBodyFn)
+	event, err := gCal.CreateEvent(eventDate, genBodyFn, fleet.CalendarCreateEventOpts{})
 	require.NoError(t, err)
 	assert.Equal(t, startHour, event.StartTime.Hour())
 	assert.Equal(t, 0, event.StartTime.Minute())
@@ -124,7 +148,7 @@ func (s *googleCalendarIntegrationTestSuite) TestFillUpCalendar() {
 		if !(currentEventTime.Hour() == endHour-1 && currentEventTime.Minute() == 30) {
 			currentEventTime = currentEventTime.Add(30 * time.Minute)
 		}
-		event, err = gCal.CreateEvent(eventDate, genBodyFn)
+		event, err = gCal.CreateEvent(eventDate, genBodyFn, fleet.CalendarCreateEventOpts{})
 		require.NoError(t, err)
 		assert.Equal(t, currentEventTime.UTC(), event.StartTime.UTC())
 	}
diff --git a/ee/server/calendar/google_calendar_load.go b/ee/server/calendar/google_calendar_load.go
index cb9c1bf91774..0e348b8e8eb3 100644
--- a/ee/server/calendar/google_calendar_load.go
+++ b/ee/server/calendar/google_calendar_load.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
 	kitlog "github.com/go-kit/log"
@@ -123,6 +124,10 @@ func (lowLevelAPI *GoogleCalendarLoadAPI) CreateEvent(event *calendar.Event) (*c
 	return &rspEvent, nil
 }
 
+func (lowLevelAPI *GoogleCalendarLoadAPI) UpdateEvent(event *calendar.Event) (*calendar.Event, error) {
+	return nil, errors.New("GoogleCalendarLoadAPI.UpdateEvent is not implemented")
+}
+
 func (lowLevelAPI *GoogleCalendarLoadAPI) GetEvent(id, _ string) (*calendar.Event, error) {
 	reqUrl, err := url.Parse(lowLevelAPI.baseUrl + "/events")
 	if err != nil {
diff --git a/ee/server/calendar/google_calendar_mock.go b/ee/server/calendar/google_calendar_mock.go
index cc6ab94c3552..ff6cd1e41e7f 100644
--- a/ee/server/calendar/google_calendar_mock.go
+++ b/ee/server/calendar/google_calendar_mock.go
@@ -64,6 +64,15 @@ func (lowLevelAPI *GoogleCalendarMockAPI) CreateEvent(event *calendar.Event) (*c
 	return event, nil
 }
 
+func (lowLevelAPI *GoogleCalendarMockAPI) UpdateEvent(event *calendar.Event) (*calendar.Event, error) {
+	time.Sleep(latency)
+	mu.Lock()
+	defer mu.Unlock()
+	lowLevelAPI.logger.Log("msg", "UpdateEvent", "id", event.Id, "start", event.Start.DateTime)
+	mockEvents[event.Id] = event
+	return event, nil
+}
+
 func (lowLevelAPI *GoogleCalendarMockAPI) GetEvent(id, _ string) (*calendar.Event, error) {
 	time.Sleep(latency)
 	mu.Lock()
diff --git a/ee/server/calendar/google_calendar_test.go b/ee/server/calendar/google_calendar_test.go
index 848be3693b8d..1c37b919b3d9 100644
--- a/ee/server/calendar/google_calendar_test.go
+++ b/ee/server/calendar/google_calendar_test.go
@@ -2,16 +2,17 @@ package calendar
 
 import (
 	"context"
+	"net/http"
+	"os"
+	"testing"
+	"time"
+
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/go-kit/log"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/api/calendar/v3"
 	"google.golang.org/api/googleapi"
-	"net/http"
-	"os"
-	"testing"
-	"time"
 )
 
 const (
@@ -31,6 +32,7 @@ type MockGoogleCalendarLowLevelAPI struct {
 	GetSettingFunc  func(name string) (*calendar.Setting, error)
 	ListEventsFunc  func(timeMin, timeMax string) (*calendar.Events, error)
 	CreateEventFunc func(event *calendar.Event) (*calendar.Event, error)
+	UpdateEventFunc func(event *calendar.Event) (*calendar.Event, error)
 	GetEventFunc    func(id, eTag string) (*calendar.Event, error)
 	DeleteEventFunc func(id string) error
 	WatchFunc       func(eventUUID string, channelID string, ttl uint64) (resourceID string, err error)
@@ -63,6 +65,10 @@ func (m *MockGoogleCalendarLowLevelAPI) CreateEvent(event *calendar.Event) (*cal
 	return m.CreateEventFunc(event)
 }
 
+func (m *MockGoogleCalendarLowLevelAPI) UpdateEvent(event *calendar.Event) (*calendar.Event, error) {
+	return m.UpdateEventFunc(event)
+}
+
 func (m *MockGoogleCalendarLowLevelAPI) GetEvent(id, eTag string) (*calendar.Event, error) {
 	return m.GetEventFunc(id, eTag)
 }
@@ -202,6 +208,8 @@ func TestGoogleCalendar_GetAndUpdateEvent(t *testing.T) {
 	const baseETag = "event-eTag"
 	const baseEventID = "event-id"
 	const baseResourceID = "resource-id"
+	baseTzName := "America/New_York"
+	baseTzLocation, _ := time.LoadLocation(baseTzName)
 	mockAPI.GetEventFunc = func(id, eTag string) (*calendar.Event, error) {
 		assert.Equal(t, baseEventID, id)
 		assert.Equal(t, baseETag, eTag)
@@ -209,7 +217,10 @@ func TestGoogleCalendar_GetAndUpdateEvent(t *testing.T) {
 			Etag: baseETag, // ETag matches -- no modifications to event
 		}, nil
 	}
-	genBodyFn := func(bool) (string, bool, error) {
+	mockAPI.GetSettingFunc = func(name string) (*calendar.Setting, error) {
+		return &calendar.Setting{Value: baseTzName}, nil
+	}
+	var genBodyFn fleet.CalendarGenBodyFn = func(bool) (string, bool, error) {
 		t.Error("genBodyFn should not be called")
 		return "event-body", false, nil
 	}
@@ -217,15 +228,16 @@ func TestGoogleCalendar_GetAndUpdateEvent(t *testing.T) {
 	err := cal.Configure(baseUserEmail)
 	assert.NoError(t, err)
 
-	eventStartTime := time.Now().UTC()
+	eventStartTime := time.Now().In(baseTzLocation)
 	event := &fleet.CalendarEvent{
 		StartTime: eventStartTime,
-		EndTime:   time.Now().Add(time.Hour),
+		EndTime:   time.Now().Add(time.Hour).In(baseTzLocation),
 		Data:      []byte(`{"ID":"` + baseEventID + `","ETag":"` + baseETag + `"}`),
+		TimeZone:  &baseTzName,
 	}
 
 	// ETag matches
-	retrievedEvent, updated, err := cal.GetAndUpdateEvent(event, genBodyFn)
+	retrievedEvent, updated, err := cal.GetAndUpdateEvent(event, genBodyFn, fleet.CalendarGetAndUpdateEventOpts{})
 	assert.NoError(t, err)
 	assert.False(t, updated)
 	assert.Equal(t, event, retrievedEvent)
@@ -234,7 +246,7 @@ func TestGoogleCalendar_GetAndUpdateEvent(t *testing.T) {
 	mockAPI.GetEventFunc = func(id, eTag string) (*calendar.Event, error) {
 		return nil, &googleapi.Error{Code: http.StatusNotModified}
 	}
-	retrievedEvent, updated, err = cal.GetAndUpdateEvent(event, genBodyFn)
+	retrievedEvent, updated, err = cal.GetAndUpdateEvent(event, genBodyFn, fleet.CalendarGetAndUpdateEventOpts{})
 	assert.NoError(t, err)
 	assert.False(t, updated)
 	assert.Equal(t, event, retrievedEvent)
@@ -245,14 +257,14 @@ func TestGoogleCalendar_GetAndUpdateEvent(t *testing.T) {
 		EndTime:   time.Now().Add(time.Hour),
 		Data:      []byte(`{"bozo`),
 	}
-	_, _, err = cal.GetAndUpdateEvent(eventBadDetails, genBodyFn)
+	_, _, err = cal.GetAndUpdateEvent(eventBadDetails, genBodyFn, fleet.CalendarGetAndUpdateEventOpts{})
 	assert.Error(t, err)
 
 	// API error test
 	mockAPI.GetEventFunc = func(id, eTag string) (*calendar.Event, error) {
 		return nil, assert.AnError
 	}
-	_, _, err = cal.GetAndUpdateEvent(event, genBodyFn)
+	_, _, err = cal.GetAndUpdateEvent(event, genBodyFn, fleet.CalendarGetAndUpdateEventOpts{})
 	assert.ErrorIs(t, err, assert.AnError)
 
 	// Event has been modified
@@ -266,7 +278,7 @@ func TestGoogleCalendar_GetAndUpdateEvent(t *testing.T) {
 			End:   &calendar.EventDateTime{DateTime: endTime.Format(time.RFC3339)},
 		}, nil
 	}
-	retrievedEvent, updated, err = cal.GetAndUpdateEvent(event, genBodyFn)
+	retrievedEvent, updated, err = cal.GetAndUpdateEvent(event, genBodyFn, fleet.CalendarGetAndUpdateEventOpts{})
 	assert.NoError(t, err)
 	assert.True(t, updated)
 	assert.NotEqual(t, event, retrievedEvent)
@@ -289,7 +301,7 @@ func TestGoogleCalendar_GetAndUpdateEvent(t *testing.T) {
 			End:   &calendar.EventDateTime{DateTime: ""},
 		}, nil
 	}
-	_, _, err = cal.GetAndUpdateEvent(event, genBodyFn)
+	_, _, err = cal.GetAndUpdateEvent(event, genBodyFn, fleet.CalendarGetAndUpdateEventOpts{})
 	assert.Error(t, err)
 
 	// missing start time
@@ -300,7 +312,7 @@ func TestGoogleCalendar_GetAndUpdateEvent(t *testing.T) {
 			End:  &calendar.EventDateTime{DateTime: endTime.Format(time.RFC3339)},
 		}, nil
 	}
-	_, _, err = cal.GetAndUpdateEvent(event, genBodyFn)
+	_, _, err = cal.GetAndUpdateEvent(event, genBodyFn, fleet.CalendarGetAndUpdateEventOpts{})
 	assert.Error(t, err)
 
 	// Bad time format
@@ -312,23 +324,26 @@ func TestGoogleCalendar_GetAndUpdateEvent(t *testing.T) {
 			End:   &calendar.EventDateTime{DateTime: "bozo"},
 		}, nil
 	}
-	_, _, err = cal.GetAndUpdateEvent(event, genBodyFn)
+	_, _, err = cal.GetAndUpdateEvent(event, genBodyFn, fleet.CalendarGetAndUpdateEventOpts{})
 	assert.Error(t, err)
 
 	// Event has been modified, with custom timezone.
-	tzId := "Africa/Kinshasa"
-	location, _ := time.LoadLocation(tzId)
-	startTime = time.Now().Add(time.Minute).Truncate(time.Second).In(location)
-	endTime = time.Now().Add(time.Hour).Truncate(time.Second).In(location)
+	newTzName := "Africa/Kinshasa"
+	newTzLocation, _ := time.LoadLocation(newTzName)
+	mockAPI.GetSettingFunc = func(name string) (*calendar.Setting, error) {
+		return &calendar.Setting{Value: newTzName}, nil
+	}
+	startTime = time.Now().Add(time.Minute).Truncate(time.Second).In(newTzLocation)
+	endTime = time.Now().Add(time.Hour).Truncate(time.Second).In(newTzLocation)
 	mockAPI.GetEventFunc = func(id, eTag string) (*calendar.Event, error) {
 		return &calendar.Event{
 			Id:    baseEventID,
 			Etag:  "new-eTag",
-			Start: &calendar.EventDateTime{DateTime: startTime.UTC().Format(time.RFC3339), TimeZone: tzId},
-			End:   &calendar.EventDateTime{DateTime: endTime.Format(time.RFC3339), TimeZone: tzId},
+			Start: &calendar.EventDateTime{DateTime: startTime.UTC().Format(time.RFC3339), TimeZone: newTzName},
+			End:   &calendar.EventDateTime{DateTime: endTime.Format(time.RFC3339), TimeZone: newTzName},
 		}, nil
 	}
-	retrievedEvent, updated, err = cal.GetAndUpdateEvent(event, genBodyFn)
+	retrievedEvent, updated, err = cal.GetAndUpdateEvent(event, genBodyFn, fleet.CalendarGetAndUpdateEventOpts{UpdateTimezone: true})
 	assert.NoError(t, err)
 	assert.True(t, updated)
 	assert.NotEqual(t, event, retrievedEvent)
@@ -341,9 +356,6 @@ func TestGoogleCalendar_GetAndUpdateEvent(t *testing.T) {
 	mockAPI.GetEventFunc = func(id, eTag string) (*calendar.Event, error) {
 		return nil, &googleapi.Error{Code: http.StatusNotFound}
 	}
-	mockAPI.GetSettingFunc = func(name string) (*calendar.Setting, error) {
-		return &calendar.Setting{Value: "UTC"}, nil
-	}
 	mockAPI.ListEventsFunc = func(timeMin, timeMax string) (*calendar.Events, error) {
 		return &calendar.Events{}, nil
 	}
@@ -375,7 +387,7 @@ func TestGoogleCalendar_GetAndUpdateEvent(t *testing.T) {
 		eventCreated = true
 		return event, nil
 	}
-	retrievedEvent, updated, err = cal.GetAndUpdateEvent(event, genBodyFn)
+	retrievedEvent, updated, err = cal.GetAndUpdateEvent(event, genBodyFn, fleet.CalendarGetAndUpdateEventOpts{})
 	require.NoError(t, err)
 	assert.True(t, updated)
 	assert.NotEqual(t, event, retrievedEvent)
@@ -383,7 +395,7 @@ func TestGoogleCalendar_GetAndUpdateEvent(t *testing.T) {
 	assert.Equal(t, uuid, retrievedEvent.UUID)
 	assert.Equal(t, baseUserEmail, retrievedEvent.Email)
 	newEventDate := calculateNewEventDate(eventStartTime)
-	expectedStartTime := time.Date(newEventDate.Year(), newEventDate.Month(), newEventDate.Day(), startHour, 0, 0, 0, time.UTC)
+	expectedStartTime := time.Date(newEventDate.Year(), newEventDate.Month(), newEventDate.Day(), startHour, 0, 0, 0, newTzLocation)
 	assert.Equal(t, expectedStartTime.UTC(), retrievedEvent.StartTime.UTC())
 	assert.Equal(t, expectedStartTime.Add(eventLength).UTC(), retrievedEvent.EndTime.UTC())
 	assert.True(t, eventCreated)
@@ -403,7 +415,7 @@ func TestGoogleCalendar_GetAndUpdateEvent(t *testing.T) {
 		}, nil
 	}
 	eventCreated = false
-	retrievedEvent, updated, err = cal.GetAndUpdateEvent(event, genBodyFn)
+	retrievedEvent, updated, err = cal.GetAndUpdateEvent(event, genBodyFn, fleet.CalendarGetAndUpdateEventOpts{})
 	require.NoError(t, err)
 	assert.True(t, updated)
 	require.NotNil(t, retrievedEvent)
@@ -426,7 +438,7 @@ func TestGoogleCalendar_GetAndUpdateEvent(t *testing.T) {
 		}, nil
 	}
 	eventCreated = false
-	retrievedEvent, updated, err = cal.GetAndUpdateEvent(event, genBodyFn)
+	retrievedEvent, updated, err = cal.GetAndUpdateEvent(event, genBodyFn, fleet.CalendarGetAndUpdateEventOpts{})
 	require.NoError(t, err)
 	assert.True(t, updated)
 	require.NotNil(t, retrievedEvent)
@@ -439,13 +451,13 @@ func TestGoogleCalendar_GetAndUpdateEvent(t *testing.T) {
 	mockAPI.GetEventFunc = func(id, eTag string) (*calendar.Event, error) {
 		return &calendar.Event{
 			Id:    baseEventID,
-			Etag:  "new-eTag",
+			Etag:  "new-eTag in past",
 			Start: &calendar.EventDateTime{DateTime: startTime.Add(-2 * time.Hour).Format(time.RFC3339)},
 			End:   &calendar.EventDateTime{DateTime: endTime.Add(-2 * time.Hour).Format(time.RFC3339)},
 		}, nil
 	}
 	eventCreated = false
-	retrievedEvent, updated, err = cal.GetAndUpdateEvent(event, genBodyFn)
+	retrievedEvent, updated, err = cal.GetAndUpdateEvent(event, genBodyFn, fleet.CalendarGetAndUpdateEventOpts{})
 	require.NoError(t, err)
 	assert.True(t, updated)
 	require.NotNil(t, retrievedEvent)
@@ -501,7 +513,7 @@ func TestGoogleCalendar_CreateEvent(t *testing.T) {
 		assert.Greater(t, ttl, uint64(60*30-1))
 		return baseResourceID, nil
 	}
-	event, err := cal.CreateEvent(date, genBodyFn)
+	event, err := cal.CreateEvent(date, genBodyFn, fleet.CalendarCreateEventOpts{})
 	require.NoError(t, err)
 	assert.Equal(t, uuid, event.UUID)
 	assert.Equal(t, baseUserEmail, event.Email)
@@ -518,11 +530,11 @@ func TestGoogleCalendar_CreateEvent(t *testing.T) {
 	assert.Equal(t, baseEventID, details.ID)
 	assert.Equal(t, channelUUID, details.ChannelID)
 	assert.Equal(t, baseResourceID, details.ResourceID)
-	assert.Equal(t, tzId, event.TimeZone)
+	assert.Equal(t, tzId, *event.TimeZone)
 
 	// Workday already ended
 	date = time.Now().Add(-48 * time.Hour)
-	_, err = cal.CreateEvent(date, genBodyFn)
+	_, err = cal.CreateEvent(date, genBodyFn, fleet.CalendarCreateEventOpts{})
 	assert.ErrorAs(t, err, &fleet.DayEndedError{})
 
 	// There is no time left in the day to schedule an event
@@ -531,7 +543,7 @@ func TestGoogleCalendar_CreateEvent(t *testing.T) {
 		now := time.Date(date.Year(), date.Month(), date.Day(), endHour-1, 45, 0, 0, location)
 		return now
 	}
-	_, err = gCal.createEvent(date, genBodyFn, timeNow)
+	_, err = gCal.createEvent(date, genBodyFn, timeNow, fleet.CalendarCreateEventOpts{})
 	assert.ErrorAs(t, err, &fleet.DayEndedError{})
 
 	// Workday already started
@@ -540,7 +552,7 @@ func TestGoogleCalendar_CreateEvent(t *testing.T) {
 	timeNow = func() time.Time {
 		return expectedStartTime
 	}
-	event, err = gCal.createEvent(date, genBodyFn, timeNow)
+	event, err = gCal.createEvent(date, genBodyFn, timeNow, fleet.CalendarCreateEventOpts{})
 	require.NoError(t, err)
 	assert.Equal(t, expectedStartTime.UTC(), event.StartTime.UTC())
 	assert.Equal(t, expectedStartTime.Add(eventLength).UTC(), event.EndTime.UTC())
@@ -633,7 +645,7 @@ func TestGoogleCalendar_CreateEvent(t *testing.T) {
 		return gEvents, nil
 	}
 	expectedStartTime = time.Date(date.Year(), date.Month(), date.Day(), 12, 0, 0, 0, location)
-	event, err = gCal.CreateEvent(date, genBodyFn)
+	event, err = gCal.CreateEvent(date, genBodyFn, fleet.CalendarCreateEventOpts{})
 	require.NoError(t, err)
 	assert.Equal(t, expectedStartTime.UTC(), event.StartTime.UTC())
 	assert.Equal(t, expectedStartTime.Add(eventLength).UTC(), event.EndTime.UTC())
@@ -653,7 +665,7 @@ func TestGoogleCalendar_CreateEvent(t *testing.T) {
 		return gEvents, nil
 	}
 	expectedStartTime = time.Date(date.Year(), date.Month(), date.Day(), endHour-1, 30, 0, 0, location)
-	event, err = gCal.CreateEvent(date, genBodyConflictFn)
+	event, err = gCal.CreateEvent(date, genBodyConflictFn, fleet.CalendarCreateEventOpts{})
 	require.NoError(t, err)
 	assert.Equal(t, expectedStartTime.UTC(), event.StartTime.UTC())
 	assert.Equal(t, expectedStartTime.Add(eventLength).UTC(), event.EndTime.UTC())
@@ -673,7 +685,7 @@ func TestGoogleCalendar_CreateEvent(t *testing.T) {
 		return gEvents, nil
 	}
 	expectedStartTime = dayEnd
-	event, err = gCal.CreateEvent(date, genBodyFn)
+	event, err = gCal.CreateEvent(date, genBodyFn, fleet.CalendarCreateEventOpts{})
 	require.NoError(t, err)
 	assert.Equal(t, expectedStartTime.UTC(), event.StartTime.UTC())
 	assert.Equal(t, expectedStartTime.Add(eventLength).UTC(), event.EndTime.UTC())
@@ -682,7 +694,7 @@ func TestGoogleCalendar_CreateEvent(t *testing.T) {
 	mockAPI.ListEventsFunc = func(timeMin, timeMax string) (*calendar.Events, error) {
 		return nil, assert.AnError
 	}
-	_, err = gCal.CreateEvent(date, genBodyFn)
+	_, err = gCal.CreateEvent(date, genBodyFn, fleet.CalendarCreateEventOpts{})
 	assert.ErrorIs(t, err, assert.AnError)
 
 	// API error in CreateEvent
@@ -692,6 +704,6 @@ func TestGoogleCalendar_CreateEvent(t *testing.T) {
 	mockAPI.CreateEventFunc = func(event *calendar.Event) (*calendar.Event, error) {
 		return nil, assert.AnError
 	}
-	_, err = gCal.CreateEvent(date, genBodyFn)
+	_, err = gCal.CreateEvent(date, genBodyFn, fleet.CalendarCreateEventOpts{})
 	assert.ErrorIs(t, err, assert.AnError)
 }
diff --git a/ee/server/service/calendar.go b/ee/server/service/calendar.go
index eee0e84fa48f..57ac9834bcb4 100644
--- a/ee/server/service/calendar.go
+++ b/ee/server/service/calendar.go
@@ -3,16 +3,25 @@ package service
 import (
 	"context"
 	"fmt"
+	"sync"
+	"time"
+
 	"github.com/fleetdm/fleet/v4/server/authz"
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/service/calendar"
 	"github.com/go-kit/log/level"
-	"sync"
+	"github.com/google/uuid"
 )
 
+var asyncCalendarProcessing bool
+var asyncMutex sync.Mutex
+
 func (svc *Service) CalendarWebhook(ctx context.Context, eventUUID string, channelID string, resourceState string) error {
 
+	// We don't want the sender to cancel the context since we want to make sure we process the webhook.
+	ctx = context.WithoutCancel(ctx)
+
 	appConfig, err := svc.ds.AppConfig(ctx)
 	if err != nil {
 		return fmt.Errorf("load app config: %w", err)
@@ -31,14 +40,38 @@ func (svc *Service) CalendarWebhook(ctx context.Context, eventUUID string, chann
 		return nil
 	}
 
+	// If the event was updated recently, we will ignore the callback.
+	// If this was a legitimate update, then it will be caught by the next cron job run (or a future callback).
+	recent, err := svc.distributedLock.Get(ctx, calendar.RecentUpdateKeyPrefix+eventUUID)
+	if err != nil {
+		return err
+	}
+	if recent != nil && *recent == calendar.RecentCalendarUpdateValue {
+		svc.authz.SkipAuthorization(ctx)
+		return nil
+	}
+
+	// In the common case, we get the lock right away and process the event.
+	// Otherwise, we do additional validation to see if we need to process the event.
+	lockValue, reserved, err := svc.getCalendarLock(ctx, eventUUID, false)
+	if err != nil {
+		return err
+	}
+	unlocked := false
+	defer func() {
+		if !unlocked && lockValue != "" {
+			svc.releaseCalendarLock(ctx, eventUUID, lockValue)
+		}
+	}()
+
 	eventDetails, err := svc.ds.GetCalendarEventDetailsByUUID(ctx, eventUUID)
 	if err != nil {
 		svc.authz.SkipAuthorization(ctx)
 		if fleet.IsNotFound(err) {
 			// We could try to stop the channel callbacks here, but that may not be secure since we don't know if the request is legitimate
-			level.Warn(svc.logger).Log("msg", "Received calendar callback, but did not find corresponding event in database", "event_uuid",
+			level.Info(svc.logger).Log("msg", "Received calendar callback, but did not find corresponding event in database", "event_uuid",
 				eventUUID, "channel_id", channelID)
-			return err
+			return nil
 		}
 		return err
 	}
@@ -47,7 +80,7 @@ func (svc *Service) CalendarWebhook(ctx context.Context, eventUUID string, chann
 		return fmt.Errorf("calendar event %s has no team ID", eventUUID)
 	}
 
-	localConfig := &calendar.CalendarConfig{
+	localConfig := &calendar.Config{
 		GoogleCalendarIntegration: *googleCalendarIntegrationConfig,
 		ServerURL:                 appConfig.ServerSettings.ServerURL,
 	}
@@ -63,7 +96,75 @@ func (svc *Service) CalendarWebhook(ctx context.Context, eventUUID string, chann
 		return authz.ForbiddenWithInternal(fmt.Sprintf("calendar channel ID mismatch: %s != %s", savedChannelID, channelID), nil, nil, nil)
 	}
 
-	genBodyFn := func(conflict bool) (body string, ok bool, err error) {
+	// Now that we fully validated the request, try to get the lock again if we didn't get it the first time.
+	// This time the event will be added to the queue if needed.
+	if lockValue == "" {
+		lockValue, reserved, err = svc.getCalendarLock(ctx, eventUUID, true)
+		if err != nil {
+			return err
+		}
+		if lockValue != "" {
+			// We got the lock, so we can process the event. We need to refetch the event from DB, since it may have changed since the last fetch.
+			eventDetails, err = svc.ds.GetCalendarEventDetailsByUUID(ctx, eventUUID)
+			if err != nil {
+				if fleet.IsNotFound(err) {
+					// We found the event the first time, but it was deleted before we got the lock.
+					level.Info(svc.logger).Log("msg", "Received calendar callback, but the event was just deleted", "event_uuid",
+						eventUUID, "channel_id", channelID)
+					return nil
+				}
+				return err
+			}
+		}
+	}
+
+	// If lock has been reserved by cron, we will need to re-process this event in case the calendar event was changed after the cron job read it.
+	if lockValue == "" && !reserved {
+		// We did not get a lock, so there is nothing to do here
+		return nil
+	}
+
+	if !reserved {
+		// Remove event from the queue so that we don't process this event again.
+		// Note: This item can be added back to the queue while we are processing it.
+		err = svc.distributedLock.RemoveFromSet(ctx, calendar.QueueKey, eventUUID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "remove calendar event from queue")
+		}
+
+		err = svc.processCalendarEvent(ctx, eventDetails, googleCalendarIntegrationConfig, userCalendar)
+		if err != nil {
+			return err
+		}
+		svc.releaseCalendarLock(ctx, eventUUID, lockValue)
+		unlocked = true
+	}
+
+	// Now, we need to check if there are any events in the queue that need to be re-processed.
+	asyncMutex.Lock()
+	defer asyncMutex.Unlock()
+	if !asyncCalendarProcessing {
+		eventIDs, err := svc.distributedLock.GetSet(ctx, calendar.QueueKey)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "get calendar event queue")
+		}
+		if len(eventIDs) > 0 {
+			asyncCalendarProcessing = true
+			go svc.processCalendarAsync(ctx, eventIDs)
+		}
+		return nil
+	}
+
+	return nil
+}
+
+func (svc *Service) processCalendarEvent(ctx context.Context, eventDetails *fleet.CalendarEventDetails,
+	googleCalendarIntegrationConfig *fleet.GoogleCalendarIntegration, userCalendar fleet.UserCalendar) error {
+
+	var generatedTag string
+	// This flag indicates that calendar event should no longer exist, and we can stop watching it.
+	stopChannel := false
+	var genBodyFn fleet.CalendarGenBodyFn = func(conflict bool) (body string, ok bool, err error) {
 
 		// This function is called when a new event is being created.
 		var team *fleet.Team
@@ -74,6 +175,7 @@ func (svc *Service) CalendarWebhook(ctx context.Context, eventUUID string, chann
 
 		if team.Config.Integrations.GoogleCalendar == nil ||
 			!team.Config.Integrations.GoogleCalendar.Enable {
+			stopChannel = true
 			return "", false, nil
 		}
 
@@ -84,6 +186,7 @@ func (svc *Service) CalendarWebhook(ctx context.Context, eventUUID string, chann
 		}
 
 		if len(policies) == 0 {
+			stopChannel = true
 			return "", false, nil
 		}
 
@@ -99,10 +202,12 @@ func (svc *Service) CalendarWebhook(ctx context.Context, eventUUID string, chann
 			return "", false, err
 		}
 		if len(hosts) != 1 {
+			stopChannel = true
 			return "", false, nil
 		}
 		host := hosts[0]
 		if host.Passing { // host is passing all configured policies
+			stopChannel = true
 			return "", false, nil
 		}
 		if host.Email == "" {
@@ -110,24 +215,224 @@ func (svc *Service) CalendarWebhook(ctx context.Context, eventUUID string, chann
 			return "", false, err
 		}
 
-		return calendar.GenerateCalendarEventBody(ctx, svc.ds, team.Name, host, &sync.Map{}, conflict, svc.logger), true, nil
+		body, generatedTag = calendar.GenerateCalendarEventBody(ctx, svc.ds, team.Name, host, &sync.Map{}, conflict, svc.logger)
+		return body, true, nil
 	}
 
-	err = userCalendar.Configure(eventDetails.Email)
+	err := userCalendar.Configure(eventDetails.Email)
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "configure calendar")
 	}
-	event, updated, err := userCalendar.GetAndUpdateEvent(&eventDetails.CalendarEvent, genBodyFn)
+	event, updated, err := userCalendar.GetAndUpdateEvent(&eventDetails.CalendarEvent, genBodyFn, fleet.CalendarGetAndUpdateEventOpts{})
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "get and update event")
 	}
 	if updated && event != nil {
+		// Event was updated, so we set a flag.
+		_, err = svc.distributedLock.SetIfNotExist(ctx, calendar.RecentUpdateKeyPrefix+event.UUID, calendar.RecentCalendarUpdateValue,
+			uint64(calendar.RecentCalendarUpdateDuration.Milliseconds()))
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "set recent update flag")
+		}
 		// Event was updated, so we need to save it
+		if generatedTag != "" {
+			err = event.SaveDataItems("body_tag", generatedTag)
+		}
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "save calendar event body tag")
+		}
 		_, err = svc.ds.CreateOrUpdateCalendarEvent(ctx, event.UUID, event.Email, event.StartTime, event.EndTime, event.Data,
-			event.TimeZone, eventDetails.ID, fleet.CalendarWebhookStatusNone)
+			event.TimeZone, eventDetails.HostID, fleet.CalendarWebhookStatusNone)
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "create or update calendar event")
 		}
+		// Remove event from the queue (again) so that we don't process this event again in case we got a callback from the event change which we ourselves made.
+		err = svc.distributedLock.RemoveFromSet(ctx, calendar.QueueKey, event.UUID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "remove calendar event from queue")
+		}
+
+	}
+	if stopChannel {
+		// The cron job could have already stopped the channel. For example, if calendar was disabled.
+		err = userCalendar.StopEventChannel(&eventDetails.CalendarEvent)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "stop event channel")
+		}
 	}
+
 	return nil
 }
+
+func (svc *Service) releaseCalendarLock(ctx context.Context, eventUUID string, lockValue string) {
+	ok, err := svc.distributedLock.ReleaseLock(ctx, calendar.LockKeyPrefix+eventUUID, lockValue)
+	if err != nil {
+		level.Error(svc.logger).Log("msg", "Failed to release calendar lock", "err", err)
+	}
+	if !ok {
+		// If the lock was not released, it will expire on its own.
+		level.Error(svc.logger).Log("msg", "Failed to release calendar lock", "event uuid", eventUUID, "lockValue", lockValue)
+	}
+}
+
+func (svc *Service) getCalendarLock(ctx context.Context, eventUUID string, addToQueue bool) (lockValue string, reserved bool, err error) {
+	// Check if lock has been reserved, which means we can't have it.
+	reservedValue, err := svc.distributedLock.Get(ctx, calendar.ReservedLockKeyPrefix+eventUUID)
+	if err != nil {
+		return "", false, ctxerr.Wrap(ctx, err, "get calendar reserved lock")
+	}
+	reserved = reservedValue != nil
+	if reserved && !addToQueue {
+		// We flag the lock as reserved.
+		return "", reserved, nil
+	}
+	var lockAcquired bool
+	if !reserved {
+		// Try to acquire the lock
+		lockValue = uuid.New().String()
+		lockAcquired, err = svc.distributedLock.SetIfNotExist(ctx, calendar.LockKeyPrefix+eventUUID, lockValue,
+			calendar.DistributedLockExpireMs)
+		if err != nil {
+			return "", false, ctxerr.Wrap(ctx, err, "acquire calendar lock")
+		}
+	}
+	if (!lockAcquired || reserved) && addToQueue {
+		// Could not acquire lock, so we are already processing this event. In this case, we add the event to
+		// the queue (actually a set) to indicate that we need to re-process the event.
+		err = svc.distributedLock.AddToSet(ctx, calendar.QueueKey, eventUUID)
+		if err != nil {
+			return "", false, ctxerr.Wrap(ctx, err, "add calendar event to queue")
+		}
+
+		if reserved {
+			// We flag the lock as reserved.
+			return "", reserved, nil
+		}
+
+		// Try to acquire the lock again in case it was released while we were adding the event to the queue.
+		lockAcquired, err = svc.distributedLock.SetIfNotExist(ctx, calendar.LockKeyPrefix+eventUUID, lockValue,
+			calendar.DistributedLockExpireMs)
+		if err != nil {
+			return "", false, ctxerr.Wrap(ctx, err, "acquire calendar lock again")
+		}
+	}
+	if !lockAcquired {
+		// We could not acquire the lock, so we are done here.
+		return "", reserved, nil
+	}
+	return lockValue, false, nil
+}
+
+func (svc *Service) processCalendarAsync(ctx context.Context, eventIDs []string) {
+	defer func() {
+		asyncMutex.Lock()
+		asyncCalendarProcessing = false
+		asyncMutex.Unlock()
+	}()
+	const minLoopTime = time.Second
+	runTime := minLoopTime
+	for {
+		if len(eventIDs) == 0 {
+			return
+		}
+		// We want to make sure we don't run this too often to reduce load on CPU/Redis, so we wait at least a second between runs.
+		if runTime < minLoopTime && runTime > 0 {
+			time.Sleep(minLoopTime - runTime)
+		}
+		start := svc.clock.Now()
+		for _, eventUUID := range eventIDs {
+			if ok := svc.processCalendarEventAsync(ctx, eventUUID); !ok {
+				return
+			}
+		}
+		end := svc.clock.Now()
+		runTime = end.Sub(start)
+
+		// Now we check whether there are any more events in the queue.
+		var err error
+		eventIDs, err = svc.distributedLock.GetSet(ctx, calendar.QueueKey)
+		if err != nil {
+			level.Error(svc.logger).Log("msg", "Failed to get calendar event queue", "err", err)
+			return
+		}
+	}
+}
+
+func (svc *Service) processCalendarEventAsync(ctx context.Context, eventUUID string) bool {
+	// If the event was updated recently, we will ignore it.
+	// If this was a legitimate update, then it will be caught by the next cron job run (or a future callback).
+	recent, err := svc.distributedLock.Get(ctx, calendar.RecentUpdateKeyPrefix+eventUUID)
+	if err != nil {
+		level.Error(svc.logger).Log("msg", "Failed to get recent update flag", "err", err)
+		return false
+	}
+	if recent != nil && *recent == calendar.RecentCalendarUpdateValue {
+		err = svc.distributedLock.RemoveFromSet(ctx, calendar.QueueKey, eventUUID)
+		if err != nil {
+			level.Error(svc.logger).Log("msg", "Failed to remove calendar event from queue", "err", err)
+			return false
+		}
+		return true
+	}
+
+	lockValue, _, err := svc.getCalendarLock(ctx, eventUUID, false)
+	if err != nil {
+		level.Error(svc.logger).Log("msg", "Failed to get calendar lock", "err", err)
+		return false
+	}
+	if lockValue == "" {
+		// We did not get a lock, so there is nothing to do here
+		return true
+	}
+	defer func() {
+		svc.releaseCalendarLock(ctx, eventUUID, lockValue)
+	}()
+
+	// Remove event from the queue so that we don't process this event again.
+	// Note: This item can be added back to the queue while we are processing it.
+	err = svc.distributedLock.RemoveFromSet(ctx, calendar.QueueKey, eventUUID)
+	if err != nil {
+		level.Error(svc.logger).Log("msg", "Failed to remove calendar event from queue", "err", err)
+		return false
+	}
+
+	appConfig, err := svc.ds.AppConfig(ctx)
+	if err != nil {
+		level.Error(svc.logger).Log("msg", "Failed to load app config", "err", err)
+		return false
+	}
+
+	if len(appConfig.Integrations.GoogleCalendar) == 0 {
+		// Google Calendar integration is not configured
+		return true
+	}
+	googleCalendarIntegrationConfig := appConfig.Integrations.GoogleCalendar[0]
+
+	eventDetails, err := svc.ds.GetCalendarEventDetailsByUUID(ctx, eventUUID)
+	if err != nil {
+		if fleet.IsNotFound(err) {
+			// We found this event when the callback initially came in. So the event may have been removed or re-created since then.
+			return true
+		}
+		level.Error(svc.logger).Log("msg", "Failed to get calendar event details", "err", err)
+		return false
+	}
+	if eventDetails.TeamID == nil {
+		// Should not happen
+		level.Error(svc.logger).Log("msg", "Calendar event has no team ID", "uuid", eventUUID)
+		return false
+	}
+
+	localConfig := &calendar.Config{
+		GoogleCalendarIntegration: *googleCalendarIntegrationConfig,
+		ServerURL:                 appConfig.ServerSettings.ServerURL,
+	}
+	userCalendar := calendar.CreateUserCalendarFromConfig(ctx, localConfig, svc.logger)
+
+	err = svc.processCalendarEvent(ctx, eventDetails, googleCalendarIntegrationConfig, userCalendar)
+	if err != nil {
+		level.Error(svc.logger).Log("msg", "Failed to process calendar event", "err", err)
+		return false
+	}
+	return true
+}
diff --git a/ee/server/service/calendar_test.go b/ee/server/service/calendar_test.go
new file mode 100644
index 000000000000..9000bab13798
--- /dev/null
+++ b/ee/server/service/calendar_test.go
@@ -0,0 +1,112 @@
+package service
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Implement fleet.Lock interface
+type mockLock struct {
+	AcquireLockFn func(ctx context.Context, key string, value string, expireMs uint64) (ok bool, err error)
+	GetFn         func(ctx context.Context, key string) (*string, error)
+	AddToSetFn    func(ctx context.Context, key string, value string) error
+}
+
+func (m *mockLock) SetIfNotExist(ctx context.Context, key string, value string, expireMs uint64) (ok bool, err error) {
+	return m.AcquireLockFn(ctx, key, value, expireMs)
+}
+
+func (m *mockLock) ReleaseLock(ctx context.Context, key string, value string) (ok bool, err error) {
+	panic("implement me")
+}
+
+func (m *mockLock) Get(ctx context.Context, key string) (*string, error) {
+	return m.GetFn(ctx, key)
+}
+
+func (m *mockLock) GetAndDelete(ctx context.Context, key string) (*string, error) {
+	panic("implement me")
+}
+
+func (m *mockLock) AddToSet(ctx context.Context, key string, value string) error {
+	return m.AddToSetFn(ctx, key, value)
+}
+
+func (m *mockLock) RemoveFromSet(ctx context.Context, key string, value string) error {
+	panic("implement me")
+}
+
+func (m *mockLock) GetSet(ctx context.Context, key string) ([]string, error) {
+	panic("implement me")
+}
+
+var calendarTestSetup = func(t *testing.T) (*mockLock, *Service) {
+	lock := &mockLock{}
+	svc := &Service{
+		distributedLock: lock,
+	}
+	return lock, svc
+}
+
+func TestGetCalendarLock(t *testing.T) {
+	lock, svc := calendarTestSetup(t)
+	ctx := context.Background()
+	eventUUID := "testUUID"
+	lock.AcquireLockFn = func(ctx context.Context, key string, value string, expireMs uint64) (ok bool, err error) {
+		return true, nil
+	}
+	lock.GetFn = func(ctx context.Context, key string) (*string, error) {
+		// not reserved
+		return nil, nil
+	}
+	lockValue, reserved, err := svc.getCalendarLock(ctx, eventUUID, false)
+	require.NoError(t, err)
+	assert.False(t, reserved)
+	assert.NotEmpty(t, lockValue)
+
+	// Make sure lock value is empty if we don't acquire the lock.
+	lock.AcquireLockFn = func(ctx context.Context, key string, value string, expireMs uint64) (ok bool, err error) {
+		return false, nil
+	}
+	lock.GetFn = func(ctx context.Context, key string) (*string, error) {
+		value := "value"
+		return &value, nil
+	}
+	lockValue, reserved, err = svc.getCalendarLock(ctx, eventUUID, false)
+	require.NoError(t, err)
+	assert.True(t, reserved)
+	assert.Empty(t, lockValue)
+
+	addedToSet := false
+	lock.AddToSetFn = func(ctx context.Context, key string, value string) error {
+		addedToSet = true
+		return nil
+	}
+	lockValue, reserved, err = svc.getCalendarLock(ctx, eventUUID, true)
+	require.NoError(t, err)
+	assert.True(t, reserved)
+	assert.Empty(t, lockValue)
+	assert.True(t, addedToSet)
+
+	addedToSet = false
+	lock.GetFn = func(ctx context.Context, key string) (*string, error) {
+		// not reserved
+		return nil, nil
+	}
+	lockValue, reserved, err = svc.getCalendarLock(ctx, eventUUID, false)
+	require.NoError(t, err)
+	assert.False(t, reserved)
+	assert.Empty(t, lockValue)
+	assert.False(t, addedToSet)
+
+	addedToSet = false
+	lockValue, reserved, err = svc.getCalendarLock(ctx, eventUUID, true)
+	require.NoError(t, err)
+	assert.False(t, reserved)
+	assert.Empty(t, lockValue)
+	assert.True(t, addedToSet)
+
+}
diff --git a/ee/server/service/devices.go b/ee/server/service/devices.go
index 4208ee15c5c2..7c3b580e92b3 100644
--- a/ee/server/service/devices.go
+++ b/ee/server/service/devices.go
@@ -17,10 +17,6 @@ func (svc *Service) ListDevicePolicies(ctx context.Context, host *fleet.Host) ([
 	return svc.ds.ListPoliciesForHost(ctx, host)
 }
 
-func (svc *Service) RequestEncryptionKeyRotation(ctx context.Context, hostID uint) error {
-	return svc.ds.SetDiskEncryptionResetStatus(ctx, hostID, true)
-}
-
 const refetchMDMUnenrollCriticalQueryDuration = 3 * time.Minute
 
 // TriggerMigrateMDMDevice triggers the webhook associated with the MDM
@@ -66,7 +62,12 @@ func (svc *Service) TriggerMigrateMDMDevice(ctx context.Context, host *fleet.Hos
 		return ctxerr.Wrap(ctx, err, "fetching host mdm info")
 	}
 
-	if !fleet.IsEligibleForDEPMigration(host, mdmInfo, connected) {
+	manualMigrationEligible, err := fleet.IsEligibleForManualMigration(host, mdmInfo, connected)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "checking manual migration eligibility")
+	}
+
+	if !fleet.IsEligibleForDEPMigration(host, mdmInfo, connected) && !manualMigrationEligible {
 		bre.InternalErr = ctxerr.New(ctx, "host not eligible for macOS migration")
 	}
 
@@ -143,9 +144,15 @@ func (svc *Service) GetFleetDesktopSummary(ctx context.Context) (fleet.DesktopSu
 			sum.Notifications.RenewEnrollmentProfile = true
 		}
 
-		if fleet.IsEligibleForDEPMigration(host, mdmInfo, connected) {
+		manualMigrationEligible, err := fleet.IsEligibleForManualMigration(host, mdmInfo, connected)
+		if err != nil {
+			return sum, ctxerr.Wrap(ctx, err, "checking manual migration eligibility")
+		}
+
+		if fleet.IsEligibleForDEPMigration(host, mdmInfo, connected) || manualMigrationEligible {
 			sum.Notifications.NeedsMDMMigration = true
 		}
+
 	}
 
 	// organization information
diff --git a/ee/server/service/embedded_scripts/linux_lock.sh b/ee/server/service/embedded_scripts/linux_lock.sh
index 6c7e3172409b..227b05fd7371 100644
--- a/ee/server/service/embedded_scripts/linux_lock.sh
+++ b/ee/server/service/embedded_scripts/linux_lock.sh
@@ -29,4 +29,21 @@ do
     fi
 done
 
+# Logout any non-passwd users
+logged_in=$(users | tr ' ' '\n' | sort  | uniq)
+for user in $logged_in; do
+    [ "$user" = "root" ] && continue
+    echo "Logging out $user"
+    pkill -KILL -u "$user"
+done
+
+# Create the pam_nologin file
+echo "Locked by administrator" > /etc/nologin
+
+# Disable systemd-user-sessions, a service that deletes /etc/nologin
+if [ -f /usr/lib/systemd/system/systemd-user-sessions.service ]; then
+    systemctl mask systemd-user-sessions
+    systemctl daemon-reload
+fi
+
 echo "All non-root users have been logged out and their accounts locked."
diff --git a/ee/server/service/embedded_scripts/linux_unlock.sh b/ee/server/service/embedded_scripts/linux_unlock.sh
index e981d4ce4469..6e6880c54225 100644
--- a/ee/server/service/embedded_scripts/linux_unlock.sh
+++ b/ee/server/service/embedded_scripts/linux_unlock.sh
@@ -19,3 +19,13 @@ do
         fi
     fi
 done
+
+# Remove the pam_nologin file
+[ -f /etc/nologin ] && rm /etc/nologin
+
+# Enable systemd-user-sessions, a service that deletes /etc/nologin
+if [ -f /usr/lib/systemd/system/systemd-user-sessions.service ]; then
+    systemctl unmask systemd-user-sessions
+    systemctl daemon-reload
+    /usr/lib/systemd/systemd-user-sessions start
+fi
diff --git a/ee/server/service/embedded_scripts/windows_lock.ps1 b/ee/server/service/embedded_scripts/windows_lock.ps1
index c46010f9615b..3cb43acc40b4 100644
--- a/ee/server/service/embedded_scripts/windows_lock.ps1
+++ b/ee/server/service/embedded_scripts/windows_lock.ps1
@@ -33,3 +33,18 @@ Get-LocalUser | Where-Object { $_.Enabled -eq $true } | ForEach-Object {
 }
 
 Write-Host "All users have been logged out and their accounts disabled."
+
+
+# Disable additional AD logins
+New-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\Settings\AllowSignInOptions" -Name 'value' -Value 3 -PropertyType DWORD -Force
+
+# Disable cached logins for AD/Azure/Entra accounts
+New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name 'CachedLogonsCount' -Value 0 -PropertyType String -Force
+
+Write-Host "All local non-administrative users have been logged out and their accounts disabled."
+Write-Host "Logging in with other Microsoft accounts has been disabled"
+Write-Host "Cached Logins have been disabled, disable the MDM-Enroled account to prevent further logins"
+
+# Shutdown computer in 15 seconds, after command has returned to fleet
+Write-Host "Shutting down in 15 seconds"
+shutdown /s /f /t 15
diff --git a/ee/server/service/embedded_scripts/windows_unlock.ps1 b/ee/server/service/embedded_scripts/windows_unlock.ps1
index 6a10c00fb39c..92c290d32b48 100644
--- a/ee/server/service/embedded_scripts/windows_unlock.ps1
+++ b/ee/server/service/embedded_scripts/windows_unlock.ps1
@@ -12,3 +12,10 @@ foreach ($user in $localUsers) {
 }
 
 Write-Host "All disabled user accounts have been enabled."
+
+
+# Re-enable additional AD logins
+New-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\Settings\AllowSignInOptions" -Name 'value' -Value 0 -PropertyType DWORD -Force
+
+# Re-enable cached logins for AD/Azure/Entra accounts
+New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name 'CachedLogonsCount' -Value 10 -PropertyType String -Force
diff --git a/ee/server/service/mdm.go b/ee/server/service/mdm.go
index d433f5d2464b..9d9442879028 100644
--- a/ee/server/service/mdm.go
+++ b/ee/server/service/mdm.go
@@ -4,12 +4,13 @@ import (
 	"bytes"
 	"context"
 	"crypto/sha256"
+	"crypto/x509"
 	"encoding/base64"
 	"encoding/json"
+	"encoding/pem"
 	"errors"
 	"fmt"
 	"io"
-	"net/http"
 	"net/url"
 	"sort"
 	"strings"
@@ -20,17 +21,14 @@ import (
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxdb"
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/contexts/logging"
-	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/mdm"
 	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
 	"github.com/fleetdm/fleet/v4/server/mdm/apple/mobileconfig"
 	"github.com/fleetdm/fleet/v4/server/mdm/assets"
-	depclient "github.com/fleetdm/fleet/v4/server/mdm/nanodep/client"
-	"github.com/fleetdm/fleet/v4/server/mdm/nanodep/storage"
+	"github.com/fleetdm/fleet/v4/server/mdm/nanodep/client"
 	"github.com/fleetdm/fleet/v4/server/sso"
 	"github.com/fleetdm/fleet/v4/server/worker"
-	kitlog "github.com/go-kit/log"
 	"github.com/go-kit/log/level"
 	"github.com/google/uuid"
 )
@@ -49,75 +47,30 @@ func (svc *Service) GetAppleBM(ctx context.Context) (*fleet.AppleBM, error) {
 		return nil, err
 	}
 
-	abmAssets, err := svc.ds.GetAllMDMConfigAssetsHashes(ctx, []fleet.MDMAssetName{
-		fleet.MDMAssetABMKey,
-		fleet.MDMAssetABMCert,
-		fleet.MDMAssetABMToken,
-	})
+	tokens, err := svc.ds.ListABMTokens(ctx)
 	if err != nil {
-		if errors.Is(err, mysql.ErrPartialResult) {
-			_, hasABMKey := abmAssets[fleet.MDMAssetABMKey]
-			_, hasABMCert := abmAssets[fleet.MDMAssetABMCert]
-			_, hasABMToken := abmAssets[fleet.MDMAssetABMToken]
-
-			// to preserve existing behavior, if the ABM setup is
-			// incomplete, return a not found error
-			if hasABMKey && hasABMCert && !hasABMToken {
-				return nil, notFoundError{}
-			}
-		}
-		return nil, err
+		return nil, ctxerr.Wrap(ctx, err, "GetAppleBM: listing ABM tokens")
 	}
 
-	appleBM, err := getAppleBMAccountDetail(ctx, svc.depStorage, svc.ds, svc.logger)
-	if err != nil {
-		return nil, err
+	if len(tokens) == 0 {
+		return nil, notFoundError{}
 	}
 
-	token, err := assets.ABMToken(ctx, svc.ds)
-	if err != nil {
-		return nil, err
+	if len(tokens) > 1 {
+		return nil, errors.New("This API endpoint has been deprecated. Please use the new GET /abm_tokens API endpoint documented here: https://fleetdm.com/learn-more-about/apple-business-manager-tokens-api")
 	}
 
-	// fill the rest of the AppleBM fields
-	appleBM.RenewDate = token.AccessTokenExpiry
-	appleBM.DefaultTeam = appCfg.MDM.AppleBMDefaultTeam
+	abmToken := tokens[0]
+
+	var appleBM fleet.AppleBM
+	// transfer the abmToken metadata info to the appleBM struct
+	appleBM.AppleID = abmToken.AppleID
+	appleBM.OrgName = abmToken.OrganizationName
+	appleBM.RenewDate = abmToken.RenewAt
+	appleBM.DefaultTeam = appCfg.MDM.DeprecatedAppleBMDefaultTeam
 	appleBM.MDMServerURL = mdmServerURL
 
-	return appleBM, nil
-}
-
-func getAppleBMAccountDetail(ctx context.Context, depStorage storage.AllDEPStorage, ds fleet.Datastore, logger kitlog.Logger) (*fleet.AppleBM, error) {
-	depClient := apple_mdm.NewDEPClient(depStorage, ds, logger)
-	res, err := depClient.AccountDetail(ctx, apple_mdm.DEPName)
-	if err != nil {
-		var authErr *depclient.AuthError
-		if errors.As(err, &authErr) {
-			// authentication failure with 401 unauthorized means that the configured
-			// Apple BM certificate and/or token are invalid. Fail with a 400 Bad
-			// Request.
-			msg := err.Error()
-			if authErr.StatusCode == http.StatusUnauthorized {
-				msg = "The Apple Business Manager certificate or server token is invalid. Restart Fleet with a valid certificate and token. See https://fleetdm.com/learn-more-about/setup-abm for help."
-			}
-			return nil, ctxerr.Wrap(ctx, &fleet.BadRequestError{
-				Message:     msg,
-				InternalErr: err,
-			}, "apple GET /account request failed with authentication error")
-		}
-		return nil, ctxerr.Wrap(ctx, err, "apple GET /account request failed")
-	}
-
-	if res.AdminID == "" {
-		// fallback to facilitator ID, as this is the same information but for
-		// older versions of the Apple API.
-		// https://github.com/fleetdm/fleet/issues/7515#issuecomment-1346579398
-		res.AdminID = res.FacilitatorID
-	}
-	return &fleet.AppleBM{
-		AppleID: res.AdminID,
-		OrgName: res.OrgName,
-	}, nil
+	return &appleBM, nil
 }
 
 func (svc *Service) MDMAppleDeviceLock(ctx context.Context, hostID uint) error {
@@ -367,7 +320,7 @@ func (svc *Service) MDMAppleUploadBootstrapPackage(ctx context.Context, name str
 		Sha256: hash.Sum(nil),
 		Bytes:  pkgBuf.Bytes(),
 	}
-	if err := svc.ds.InsertMDMAppleBootstrapPackage(ctx, bp); err != nil {
+	if err := svc.ds.InsertMDMAppleBootstrapPackage(ctx, bp, svc.bootstrapPackageStore); err != nil {
 		return err
 	}
 
@@ -385,7 +338,7 @@ func (svc *Service) GetMDMAppleBootstrapPackageBytes(ctx context.Context, token
 	// skipauth: bootstrap packages are gated by token
 	svc.authz.SkipAuthorization(ctx)
 
-	pkg, err := svc.ds.GetMDMAppleBootstrapPackageBytes(ctx, token)
+	pkg, err := svc.ds.GetMDMAppleBootstrapPackageBytes(ctx, token, svc.bootstrapPackageStore)
 	if err != nil {
 		return nil, ctxerr.Wrap(ctx, err)
 	}
@@ -769,7 +722,6 @@ func (svc *Service) mdmSSOHandleCallbackAuth(ctx context.Context, auth fleet.Aut
 		appConfig.ServerSettings.ServerURL,
 		appConfig.ServerSettings.ServerURL+svc.config.Server.URLPrefix+"/api/v1/fleet/mdm/sso/callback",
 	)
-
 	if err != nil {
 		return "", "", "", ctxerr.Wrap(ctx, err, "validating sso response")
 	}
@@ -1081,28 +1033,53 @@ func (svc *Service) GetMDMDiskEncryptionSummary(ctx context.Context, teamID *uin
 	}, nil
 }
 
-func (svc *Service) mdmAppleEditedMacOSUpdates(ctx context.Context, teamID *uint, updates fleet.MacOSUpdates) error {
+func (svc *Service) mdmAppleEditedAppleOSUpdates(ctx context.Context, teamID *uint, appleDevice fleet.AppleDevice, updates fleet.AppleOSUpdateSettings) error {
+	const (
+		softwareUpdateType        = `com.apple.configuration.softwareupdate.enforcement.specific`
+		softwareUpdateIdentSuffix = `-software-update-94f4bbdf-f439-4fb1-8d27-ae1bb793e105`
+	)
+	var (
+		softwareUpdateIdentifier string
+		osUpdatesProfileName     string
+		labelName                string
+	)
+	switch appleDevice {
+	case fleet.MacOS:
+		softwareUpdateIdentifier = "macos" + softwareUpdateIdentSuffix
+		osUpdatesProfileName = mdm.FleetMacOSUpdatesProfileName
+		labelName = fleet.BuiltinLabelMacOS14Plus // OS update DDMs are supported on macOS 14+ devices.
+	case fleet.IOS:
+		softwareUpdateIdentifier = "ios" + softwareUpdateIdentSuffix
+		osUpdatesProfileName = mdm.FleetIOSUpdatesProfileName
+		labelName = fleet.BuiltinLabelIOS
+	case fleet.IPadOS:
+		softwareUpdateIdentifier = "ipados" + softwareUpdateIdentSuffix
+		osUpdatesProfileName = mdm.FleetIPadOSUpdatesProfileName
+		labelName = fleet.BuiltinLabelIPadOS
+	default:
+		panic(fmt.Sprintf("invalid AppleDevice: %d", appleDevice))
+	}
+
 	if updates.MinimumVersion.Value == "" {
 		// OS updates disabled, remove the profile
-		if err := svc.ds.DeleteMDMAppleDeclarationByName(ctx, teamID, mdm.FleetMacOSUpdatesProfileName); err != nil {
+		if err := svc.ds.DeleteMDMAppleDeclarationByName(ctx, teamID, osUpdatesProfileName); err != nil {
 			return err
 		}
 		var globalOrTeamID uint
 		if teamID != nil {
 			globalOrTeamID = *teamID
 		}
-		if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{globalOrTeamID}, nil, nil); err != nil {
+		// This only sets profiles that haven't been queued by the cron to 'pending' (both removes and installs, which includes
+		// the OS updates we just deleted). It doesn't have a functional difference because if you don't call this function
+		// the cron will catch up, but it's important for the UX to mark them as pending immediately so it's reflected in the UI.
+		if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{globalOrTeamID}, nil, nil); err != nil {
 			return ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 		}
 		return nil
 	}
 
-	// OS updates enabled, create or update the profile with the current settings
+	// OS updates enabled, create or update the profile with the current settings.
 
-	const (
-		macOSSoftwareUpdateType  = `com.apple.configuration.softwareupdate.enforcement.specific`
-		macOSSoftwareUpdateIdent = `macos-software-update-94f4bbdf-f439-4fb1-8d27-ae1bb793e105`
-	)
 	rawDecl := []byte(fmt.Sprintf(`{
 	"Identifier": %q,
 	"Type": %q,
@@ -1110,17 +1087,17 @@ func (svc *Service) mdmAppleEditedMacOSUpdates(ctx context.Context, teamID *uint
 		"TargetOSVersion": %q,
 		"TargetLocalDateTime": "%sT12:00:00"
 	}
-}`, macOSSoftwareUpdateIdent, macOSSoftwareUpdateType, updates.MinimumVersion.Value, updates.Deadline.Value))
-	d := fleet.NewMDMAppleDeclaration(rawDecl, teamID, mdm.FleetMacOSUpdatesProfileName, macOSSoftwareUpdateType, macOSSoftwareUpdateIdent)
+}`, softwareUpdateIdentifier, softwareUpdateType, updates.MinimumVersion.Value, updates.Deadline.Value))
+
+	d := fleet.NewMDMAppleDeclaration(rawDecl, teamID, osUpdatesProfileName, softwareUpdateType, softwareUpdateIdentifier)
 
-	// associate the profile with the built-in label that ensures the host is on
-	// macOS 14+ to receive that profile
-	lblIDs, err := svc.ds.LabelIDsByName(ctx, []string{fleet.BuiltinLabelMacOS14Plus})
+	// Associate the profile with the built-in label to ensure that the profile is applied to the targeted devices.
+	lblIDs, err := svc.ds.LabelIDsByName(ctx, []string{labelName})
 	if err != nil {
 		return err
 	}
 	d.LabelsIncludeAll = []fleet.ConfigurationProfileLabel{
-		{LabelName: fleet.BuiltinLabelMacOS14Plus, LabelID: lblIDs[fleet.BuiltinLabelMacOS14Plus]},
+		{LabelName: labelName, LabelID: lblIDs[labelName]},
 	}
 
 	decl, err := svc.ds.SetOrUpdateMDMAppleDeclaration(ctx, d)
@@ -1128,8 +1105,7 @@ func (svc *Service) mdmAppleEditedMacOSUpdates(ctx context.Context, teamID *uint
 		return err
 	}
 
-	// mark all hosts affected by that profile as pending
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl.DeclarationUUID}, nil); err != nil {
+	if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl.DeclarationUUID}, nil); err != nil {
 		return ctxerr.Wrap(ctx, err, "bulk set pending host declarations")
 	}
 	return nil
@@ -1202,3 +1178,220 @@ func (svc *Service) GetMDMManualEnrollmentProfile(ctx context.Context) ([]byte,
 	// need arises.
 	return mobileConfig, nil
 }
+
+func (svc *Service) UploadABMToken(ctx context.Context, token io.Reader) (*fleet.ABMToken, error) {
+	encryptedToken, decryptedToken, err := svc.decryptUploadedABMToken(ctx, token)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "decrypting uploaded ABM token")
+	}
+
+	if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionWrite); err != nil {
+		return nil, err
+	}
+
+	tok := &fleet.ABMToken{
+		EncryptedToken: encryptedToken,
+	}
+
+	if err := apple_mdm.SetDecryptedABMTokenMetadata(ctx, tok, decryptedToken, svc.depStorage, svc.ds, svc.logger); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "setting ABM token metadata")
+	}
+
+	tok, err = svc.ds.InsertABMToken(ctx, tok)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "save ABM token")
+	}
+
+	// flip the app config flag
+	appCfg, err := svc.ds.AppConfig(ctx)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "retrieving app config")
+	}
+
+	appCfg.MDM.AppleBMEnabledAndConfigured = true
+
+	if err := svc.ds.SaveAppConfig(ctx, appCfg); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "saving app config after ABM enablement")
+	}
+
+	return tok, nil
+}
+
+func (svc *Service) DeleteABMToken(ctx context.Context, tokenID uint) error {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionWrite); err != nil {
+		return err
+	}
+
+	if err := svc.ds.DeleteABMToken(ctx, tokenID); err != nil {
+		return ctxerr.Wrap(ctx, err, "removing ABM token")
+	}
+
+	count, err := svc.ds.GetABMTokenCount(ctx)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "getting ABM token count")
+	}
+
+	if count == 0 {
+		// flip the app config flag
+		appCfg, err := svc.ds.AppConfig(ctx)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "retrieving app config")
+		}
+
+		appCfg.MDM.AppleBMEnabledAndConfigured = false
+		return svc.ds.SaveAppConfig(ctx, appCfg)
+	}
+
+	return nil
+}
+
+func (svc *Service) ListABMTokens(ctx context.Context) ([]*fleet.ABMToken, error) {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionList); err != nil {
+		return nil, err
+	}
+
+	tokens, err := svc.ds.ListABMTokens(ctx)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "list ABM tokens")
+	}
+
+	return tokens, nil
+}
+
+func (svc *Service) UpdateABMTokenTeams(ctx context.Context, tokenID uint, macOSTeamID, iOSTeamID, iPadOSTeamID *uint) (*fleet.ABMToken, error) {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionWrite); err != nil {
+		return nil, err
+	}
+
+	token, err := svc.ds.GetABMTokenByID(ctx, tokenID)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get ABM token to update teams")
+	}
+
+	// validate the team IDs
+
+	token.MacOSTeam = fleet.ABMTokenTeam{Name: fleet.TeamNameNoTeam}
+	token.MacOSDefaultTeamID = nil
+	token.IOSTeam = fleet.ABMTokenTeam{Name: fleet.TeamNameNoTeam}
+	token.IOSDefaultTeamID = nil
+	token.IPadOSTeam = fleet.ABMTokenTeam{Name: fleet.TeamNameNoTeam}
+	token.IPadOSDefaultTeamID = nil
+
+	if macOSTeamID != nil && *macOSTeamID != 0 {
+		macOSTeam, err := svc.ds.Team(ctx, *macOSTeamID)
+		if err != nil {
+			return nil, &fleet.BadRequestError{
+				Message:     fmt.Sprintf("team with ID %d not found", *macOSTeamID),
+				InternalErr: ctxerr.Wrap(ctx, err, "checking existence of macOS team"),
+			}
+		}
+
+		token.MacOSTeam.Name = macOSTeam.Name
+		token.MacOSTeam.ID = *macOSTeamID
+		token.MacOSDefaultTeamID = macOSTeamID
+	}
+
+	if iOSTeamID != nil && *iOSTeamID != 0 {
+		iOSTeam, err := svc.ds.Team(ctx, *iOSTeamID)
+		if err != nil {
+			return nil, &fleet.BadRequestError{
+				Message:     fmt.Sprintf("team with ID %d not found", *iOSTeamID),
+				InternalErr: ctxerr.Wrap(ctx, err, "checking existence of iOS team"),
+			}
+		}
+		token.IOSTeam.Name = iOSTeam.Name
+		token.IOSTeam.ID = *iOSTeamID
+		token.IOSDefaultTeamID = iOSTeamID
+	}
+
+	if iPadOSTeamID != nil && *iPadOSTeamID != 0 {
+		iPadOSTeam, err := svc.ds.Team(ctx, *iPadOSTeamID)
+		if err != nil {
+			return nil, &fleet.BadRequestError{
+				Message:     fmt.Sprintf("team with ID %d not found", *iPadOSTeamID),
+				InternalErr: ctxerr.Wrap(ctx, err, "checking existence of iPadOS team"),
+			}
+		}
+		token.IPadOSTeam.Name = iPadOSTeam.Name
+		token.IPadOSTeam.ID = *iPadOSTeamID
+		token.IPadOSDefaultTeamID = iPadOSTeamID
+	}
+
+	if err := svc.ds.SaveABMToken(ctx, token); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "updating token teams in db")
+	}
+
+	return token, nil
+}
+
+func (svc *Service) RenewABMToken(ctx context.Context, token io.Reader, tokenID uint) (*fleet.ABMToken, error) {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionRead); err != nil {
+		return nil, err
+	}
+
+	oldTok, err := svc.ds.GetABMTokenByID(ctx, tokenID)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get ABM token by id")
+	}
+
+	encryptedToken, decryptedToken, err := svc.decryptUploadedABMToken(ctx, token)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "decrypting ABM token for renewal")
+	}
+
+	if err := apple_mdm.SetDecryptedABMTokenMetadata(ctx, oldTok, decryptedToken, svc.depStorage, svc.ds, svc.logger); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "setting ABM token metadata")
+	}
+
+	oldTok.EncryptedToken = encryptedToken
+
+	if err := svc.ds.SaveABMToken(ctx, oldTok); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "renewing ABM token")
+	}
+
+	return oldTok, nil
+}
+
+func (svc *Service) decryptUploadedABMToken(ctx context.Context, token io.Reader) (encryptedToken []byte, decryptedToken *client.OAuth1Tokens, err error) {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionRead); err != nil {
+		return nil, nil, err
+	}
+
+	pair, err := svc.ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{
+		fleet.MDMAssetABMCert,
+		fleet.MDMAssetABMKey,
+	})
+	if err != nil {
+		if fleet.IsNotFound(err) {
+			return nil, nil, ctxerr.Wrap(ctx, &fleet.BadRequestError{
+				Message: "Please generate a keypair first.",
+			}, "renewing ABM token")
+		}
+
+		return nil, nil, ctxerr.Wrap(ctx, err, "retrieving stored ABM assets")
+	}
+
+	encryptedToken, err = io.ReadAll(token)
+	if err != nil {
+		return nil, nil, ctxerr.Wrap(ctx, err, "reading token bytes")
+	}
+
+	derCert, _ := pem.Decode(pair[fleet.MDMAssetABMCert].Value)
+	if derCert == nil {
+		return nil, nil, ctxerr.New(ctx, "ABM certificate in the database cannot be parsed")
+	}
+
+	cert, err := x509.ParseCertificate(derCert.Bytes)
+	if err != nil {
+		return nil, nil, ctxerr.Wrap(ctx, err, "parsing ABM certificate")
+	}
+
+	decryptedToken, err = assets.DecryptRawABMToken(encryptedToken, cert, pair[fleet.MDMAssetABMKey].Value)
+	if err != nil {
+		return nil, nil, ctxerr.Wrap(ctx, &fleet.BadRequestError{
+			Message:     "Invalid token. Please provide a valid token from Apple Business Manager.",
+			InternalErr: err,
+		}, "validating ABM token")
+	}
+	return encryptedToken, decryptedToken, nil
+}
diff --git a/ee/server/service/mdm_external_test.go b/ee/server/service/mdm_external_test.go
index 424d417ee6c5..c6324f84fe0c 100644
--- a/ee/server/service/mdm_external_test.go
+++ b/ee/server/service/mdm_external_test.go
@@ -82,6 +82,8 @@ func setupMockDatastorePremiumService() (*mock.Store, *eeservice.Service, contex
 		nil,
 		nil,
 		nil,
+		nil,
+		nil,
 	)
 	if err != nil {
 		panic(err)
@@ -198,8 +200,9 @@ func TestGetOrCreatePreassignTeam(t *testing.T) {
 			declaration.DeclarationUUID = uuid.NewString()
 			return declaration, nil
 		}
-		ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string) error {
-			return nil
+		ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string,
+		) (updates fleet.MDMProfilesUpdates, err error) {
+			return fleet.MDMProfilesUpdates{}, nil
 		}
 		apnsCert, apnsKey, err := mysql.GenerateTestCertBytes()
 		require.NoError(t, err)
@@ -207,13 +210,13 @@ func TestGetOrCreatePreassignTeam(t *testing.T) {
 		require.NoError(t, err)
 		ds.GetAllMDMConfigAssetsByNameFunc = func(ctx context.Context, assetNames []fleet.MDMAssetName) (map[fleet.MDMAssetName]fleet.MDMConfigAsset, error) {
 			return map[fleet.MDMAssetName]fleet.MDMConfigAsset{
-				fleet.MDMAssetABMCert:  {Name: fleet.MDMAssetABMCert, Value: certPEM},
-				fleet.MDMAssetABMKey:   {Name: fleet.MDMAssetABMKey, Value: keyPEM},
-				fleet.MDMAssetABMToken: {Name: fleet.MDMAssetABMToken, Value: tokenBytes},
-				fleet.MDMAssetAPNSCert: {Name: fleet.MDMAssetAPNSCert, Value: apnsCert},
-				fleet.MDMAssetAPNSKey:  {Name: fleet.MDMAssetAPNSKey, Value: apnsKey},
-				fleet.MDMAssetCACert:   {Name: fleet.MDMAssetCACert, Value: certPEM},
-				fleet.MDMAssetCAKey:    {Name: fleet.MDMAssetCAKey, Value: keyPEM},
+				fleet.MDMAssetABMCert:            {Name: fleet.MDMAssetABMCert, Value: certPEM},
+				fleet.MDMAssetABMKey:             {Name: fleet.MDMAssetABMKey, Value: keyPEM},
+				fleet.MDMAssetABMTokenDeprecated: {Name: fleet.MDMAssetABMTokenDeprecated, Value: tokenBytes},
+				fleet.MDMAssetAPNSCert:           {Name: fleet.MDMAssetAPNSCert, Value: apnsCert},
+				fleet.MDMAssetAPNSKey:            {Name: fleet.MDMAssetAPNSKey, Value: apnsKey},
+				fleet.MDMAssetCACert:             {Name: fleet.MDMAssetCACert, Value: certPEM},
+				fleet.MDMAssetCAKey:              {Name: fleet.MDMAssetCAKey, Value: keyPEM},
 			}, nil
 		}
 	}
@@ -317,11 +320,10 @@ func TestGetOrCreatePreassignTeam(t *testing.T) {
 		}
 		setupAsstByTeam := make(map[uint]*fleet.MDMAppleSetupAssistant)
 		globalSetupAsst := &fleet.MDMAppleSetupAssistant{
-			ID:          15,
-			TeamID:      nil,
-			Name:        "test asst",
-			Profile:     json.RawMessage(`{"foo": "bar"}`),
-			ProfileUUID: "abc-def",
+			ID:      15,
+			TeamID:  nil,
+			Name:    "test asst",
+			Profile: json.RawMessage(`{"foo": "bar"}`),
 		}
 		setupAsstByTeam[0] = globalSetupAsst
 		ds.GetMDMAppleSetupAssistantFunc = func(ctx context.Context, teamID *uint) (*fleet.MDMAppleSetupAssistant, error) {
@@ -531,7 +533,7 @@ func TestGetOrCreatePreassignTeam(t *testing.T) {
 		spec := &fleet.TeamSpec{
 			Name: "new team spec",
 			MDM: fleet.TeamSpecMDM{
-				MacOSUpdates: fleet.MacOSUpdates{
+				MacOSUpdates: fleet.AppleOSUpdateSettings{
 					MinimumVersion: optjson.SetString("12.0"),
 					Deadline:       optjson.SetString("2024-01-01"),
 				},
diff --git a/ee/server/service/mdm_profiles.go b/ee/server/service/mdm_profiles.go
index 1e07385a44d7..fa9e0b23cb1b 100644
--- a/ee/server/service/mdm_profiles.go
+++ b/ee/server/service/mdm_profiles.go
@@ -33,6 +33,8 @@ var fileVaultProfileTemplate = template.Must(template.New("").Option("missingkey
 			<false/>
 			<key>DeferForceAtUserLoginMaxBypassAttempts</key>
 			<integer>1</integer>
+			<key>ForceEnableInSetupAssistant</key>
+			<true/>
 		</dict>
 		<dict>
 			<key>EncryptCertPayloadUUID</key>
diff --git a/ee/server/service/service.go b/ee/server/service/service.go
index 0a0eab686133..7ef6f8b8a530 100644
--- a/ee/server/service/service.go
+++ b/ee/server/service/service.go
@@ -17,17 +17,19 @@ import (
 type Service struct {
 	fleet.Service
 
-	ds                   fleet.Datastore
-	logger               kitlog.Logger
-	config               config.FleetConfig
-	clock                clock.Clock
-	authz                *authz.Authorizer
-	depStorage           storage.AllDEPStorage
-	mdmAppleCommander    fleet.MDMAppleCommandIssuer
-	ssoSessionStore      sso.SessionStore
-	depService           *apple_mdm.DEPService
-	profileMatcher       fleet.ProfileMatcher
-	softwareInstallStore fleet.SoftwareInstallerStore
+	ds                    fleet.Datastore
+	logger                kitlog.Logger
+	config                config.FleetConfig
+	clock                 clock.Clock
+	authz                 *authz.Authorizer
+	depStorage            storage.AllDEPStorage
+	mdmAppleCommander     fleet.MDMAppleCommandIssuer
+	ssoSessionStore       sso.SessionStore
+	depService            *apple_mdm.DEPService
+	profileMatcher        fleet.ProfileMatcher
+	softwareInstallStore  fleet.SoftwareInstallerStore
+	bootstrapPackageStore fleet.MDMBootstrapPackageStore
+	distributedLock       fleet.Lock
 }
 
 func NewService(
@@ -42,6 +44,8 @@ func NewService(
 	sso sso.SessionStore,
 	profileMatcher fleet.ProfileMatcher,
 	softwareInstallStore fleet.SoftwareInstallerStore,
+	bootstrapPackageStore fleet.MDMBootstrapPackageStore,
+	distributedLock fleet.Lock,
 ) (*Service, error) {
 	authorizer, err := authz.NewAuthorizer()
 	if err != nil {
@@ -49,18 +53,20 @@ func NewService(
 	}
 
 	eeservice := &Service{
-		Service:              svc,
-		ds:                   ds,
-		logger:               logger,
-		config:               config,
-		clock:                c,
-		authz:                authorizer,
-		depStorage:           depStorage,
-		mdmAppleCommander:    mdmAppleCommander,
-		ssoSessionStore:      sso,
-		depService:           apple_mdm.NewDEPService(ds, depStorage, logger),
-		profileMatcher:       profileMatcher,
-		softwareInstallStore: softwareInstallStore,
+		Service:               svc,
+		ds:                    ds,
+		logger:                logger,
+		config:                config,
+		clock:                 c,
+		authz:                 authorizer,
+		depStorage:            depStorage,
+		mdmAppleCommander:     mdmAppleCommander,
+		ssoSessionStore:       sso,
+		depService:            apple_mdm.NewDEPService(ds, depStorage, logger),
+		profileMatcher:        profileMatcher,
+		softwareInstallStore:  softwareInstallStore,
+		bootstrapPackageStore: bootstrapPackageStore,
+		distributedLock:       distributedLock,
 	}
 
 	// Override methods that can't be easily overriden via
@@ -76,7 +82,7 @@ func NewService(
 		DeleteMDMAppleBootstrapPackage:    eeservice.DeleteMDMAppleBootstrapPackage,
 		MDMWindowsEnableOSUpdates:         eeservice.mdmWindowsEnableOSUpdates,
 		MDMWindowsDisableOSUpdates:        eeservice.mdmWindowsDisableOSUpdates,
-		MDMAppleEditedMacOSUpdates:        eeservice.mdmAppleEditedMacOSUpdates,
+		MDMAppleEditedAppleOSUpdates:      eeservice.mdmAppleEditedAppleOSUpdates,
 	})
 
 	return eeservice, nil
diff --git a/ee/server/service/software_installers.go b/ee/server/service/software_installers.go
index 988e2d4df53f..281d1b05f97f 100644
--- a/ee/server/service/software_installers.go
+++ b/ee/server/service/software_installers.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/hex"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -18,10 +19,15 @@ import (
 	hostctx "github.com/fleetdm/fleet/v4/server/contexts/host"
 	"github.com/fleetdm/fleet/v4/server/contexts/viewer"
 	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/mdm/apple/vpp"
+	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/go-kit/log/level"
+	"github.com/google/uuid"
 	"golang.org/x/sync/errgroup"
 )
 
+const softwareInstallerTokenMaxLength = 36 // UUID length
+
 func (svc *Service) UploadSoftwareInstaller(ctx context.Context, payload *fleet.UploadSoftwareInstallerPayload) error {
 	if err := svc.authz.Authorize(ctx, &fleet.SoftwareInstaller{TeamID: payload.TeamID}, fleet.ActionWrite); err != nil {
 		return err
@@ -31,6 +37,7 @@ func (svc *Service) UploadSoftwareInstaller(ctx context.Context, payload *fleet.
 	if !ok {
 		return fleet.ErrNoContext
 	}
+	payload.UserID = vc.UserID()
 
 	// make sure all scripts use unix-style newlines to prevent errors when
 	// running them, browsers use windows-style newlines, which breaks the
@@ -58,7 +65,7 @@ func (svc *Service) UploadSoftwareInstaller(ctx context.Context, payload *fleet.
 	// TODO: QA what breaks when you have a software title with no versions?
 
 	var teamName *string
-	if payload.TeamID != nil {
+	if payload.TeamID != nil && *payload.TeamID != 0 {
 		t, err := svc.ds.Team(ctx, *payload.TeamID)
 		if err != nil {
 			return err
@@ -81,19 +88,65 @@ func (svc *Service) UploadSoftwareInstaller(ctx context.Context, payload *fleet.
 }
 
 func (svc *Service) DeleteSoftwareInstaller(ctx context.Context, titleID uint, teamID *uint) error {
-	if teamID == nil || *teamID == 0 {
-		return fleet.NewInvalidArgumentError("team_id", "is required and can't be zero")
+	if teamID == nil {
+		return fleet.NewInvalidArgumentError("team_id", "is required")
 	}
 
+	// we authorize with SoftwareInstaller here, but it uses the same AuthzType
+	// as VPPApp, so this is correct for both software installers and VPP apps.
 	if err := svc.authz.Authorize(ctx, &fleet.SoftwareInstaller{TeamID: teamID}, fleet.ActionWrite); err != nil {
 		return err
 	}
 
+	// first, look for a software installer
 	meta, err := svc.ds.GetSoftwareInstallerMetadataByTeamAndTitleID(ctx, teamID, titleID, false)
 	if err != nil {
+		if fleet.IsNotFound(err) {
+			// no software installer, look for a VPP app
+			meta, err := svc.ds.GetVPPAppMetadataByTeamAndTitleID(ctx, teamID, titleID)
+			if err != nil {
+				return ctxerr.Wrap(ctx, err, "getting software app metadata")
+			}
+			return svc.deleteVPPApp(ctx, teamID, meta)
+		}
 		return ctxerr.Wrap(ctx, err, "getting software installer metadata")
 	}
+	return svc.deleteSoftwareInstaller(ctx, meta)
+}
 
+func (svc *Service) deleteVPPApp(ctx context.Context, teamID *uint, meta *fleet.VPPAppStoreApp) error {
+	vc, ok := viewer.FromContext(ctx)
+	if !ok {
+		return fleet.ErrNoContext
+	}
+
+	if err := svc.ds.DeleteVPPAppFromTeam(ctx, teamID, meta.VPPAppID); err != nil {
+		return ctxerr.Wrap(ctx, err, "deleting VPP app")
+	}
+
+	var teamName *string
+	if teamID != nil && *teamID != 0 {
+		t, err := svc.ds.Team(ctx, *teamID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "getting team name for deleted VPP app")
+		}
+		teamName = &t.Name
+	}
+
+	if err := svc.NewActivity(ctx, vc.User, fleet.ActivityDeletedAppStoreApp{
+		AppStoreID:    meta.AdamID,
+		SoftwareTitle: meta.Name,
+		TeamName:      teamName,
+		TeamID:        teamID,
+		Platform:      meta.Platform,
+	}); err != nil {
+		return ctxerr.Wrap(ctx, err, "creating activity for deleted VPP app")
+	}
+
+	return nil
+}
+
+func (svc *Service) deleteSoftwareInstaller(ctx context.Context, meta *fleet.SoftwareInstaller) error {
 	vc, ok := viewer.FromContext(ctx)
 	if !ok {
 		return fleet.ErrNoContext
@@ -112,11 +165,19 @@ func (svc *Service) DeleteSoftwareInstaller(ctx context.Context, titleID uint, t
 		teamName = &t.Name
 	}
 
+	var teamID *uint
+	switch {
+	case meta.TeamID == nil:
+		teamID = ptr.Uint(0)
+	case meta.TeamID != nil:
+		teamID = meta.TeamID
+	}
+
 	if err := svc.NewActivity(ctx, vc.User, fleet.ActivityTypeDeletedSoftware{
 		SoftwareTitle:   meta.SoftwareTitle,
 		SoftwarePackage: meta.Name,
 		TeamName:        teamName,
-		TeamID:          meta.TeamID,
+		TeamID:          teamID,
 		SelfService:     meta.SelfService,
 	}); err != nil {
 		return ctxerr.Wrap(ctx, err, "creating activity for deleted software")
@@ -125,9 +186,13 @@ func (svc *Service) DeleteSoftwareInstaller(ctx context.Context, titleID uint, t
 	return nil
 }
 
-func (svc *Service) GetSoftwareInstallerMetadata(ctx context.Context, titleID uint, teamID *uint) (*fleet.SoftwareInstaller, error) {
-	if err := svc.authz.Authorize(ctx, &fleet.SoftwareInstaller{TeamID: teamID}, fleet.ActionRead); err != nil {
-		return nil, err
+func (svc *Service) GetSoftwareInstallerMetadata(ctx context.Context, skipAuthz bool, titleID uint, teamID *uint) (*fleet.SoftwareInstaller,
+	error,
+) {
+	if !skipAuthz {
+		if err := svc.authz.Authorize(ctx, &fleet.SoftwareInstaller{TeamID: teamID}, fleet.ActionRead); err != nil {
+			return nil, err
+		}
 	}
 
 	meta, err := svc.ds.GetSoftwareInstallerMetadataByTeamAndTitleID(ctx, teamID, titleID, true)
@@ -138,12 +203,93 @@ func (svc *Service) GetSoftwareInstallerMetadata(ctx context.Context, titleID ui
 	return meta, nil
 }
 
-func (svc *Service) DownloadSoftwareInstaller(ctx context.Context, titleID uint, teamID *uint) (*fleet.DownloadSoftwareInstallerPayload, error) {
-	if teamID == nil || *teamID == 0 {
-		return nil, fleet.NewInvalidArgumentError("team_id", "is required and can't be zero")
+func (svc *Service) GenerateSoftwareInstallerToken(ctx context.Context, alt string, titleID uint, teamID *uint) (string, error) {
+	downloadRequested := alt == "media"
+	if !downloadRequested {
+		svc.authz.SkipAuthorization(ctx)
+		return "", fleet.NewInvalidArgumentError("alt", "only alt=media is supported")
+	}
+
+	if teamID == nil {
+		svc.authz.SkipAuthorization(ctx)
+		return "", fleet.NewInvalidArgumentError("team_id", "is required")
+	}
+
+	if err := svc.authz.Authorize(ctx, &fleet.SoftwareInstaller{TeamID: teamID}, fleet.ActionRead); err != nil {
+		return "", err
+	}
+
+	meta := fleet.SoftwareInstallerTokenMetadata{
+		TitleID: titleID,
+		TeamID:  *teamID,
+	}
+	metaByte, err := json.Marshal(meta)
+	if err != nil {
+		return "", ctxerr.Wrap(ctx, err, "marshaling software installer metadata")
+	}
+
+	// Generate token and store in Redis
+	token := uuid.NewString()
+	const tokenExpirationMs = 10 * 60 * 1000 // 10 minutes
+	ok, err := svc.distributedLock.SetIfNotExist(ctx, fmt.Sprintf("software_installer_token:%s", token), string(metaByte),
+		tokenExpirationMs)
+	if err != nil {
+		return "", ctxerr.Wrap(ctx, err, "saving software installer token")
+	}
+	if !ok {
+		// Should not happen since token is unique
+		return "", ctxerr.Errorf(ctx, "failed to save software installer token")
+	}
+
+	return token, nil
+}
+
+func (svc *Service) GetSoftwareInstallerTokenMetadata(ctx context.Context, token string,
+	titleID uint,
+) (*fleet.SoftwareInstallerTokenMetadata, error) {
+	// We will manually authorize this endpoint based on the token.
+	svc.authz.SkipAuthorization(ctx)
+
+	if len(token) > softwareInstallerTokenMaxLength {
+		return nil, fleet.NewPermissionError("invalid token")
 	}
 
-	meta, err := svc.GetSoftwareInstallerMetadata(ctx, titleID, teamID)
+	metaStr, err := svc.distributedLock.GetAndDelete(ctx, fmt.Sprintf("software_installer_token:%s", token))
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting software installer token metadata")
+	}
+	if metaStr == nil {
+		return nil, ctxerr.Wrap(ctx, fleet.NewPermissionError("invalid token"))
+	}
+
+	var meta fleet.SoftwareInstallerTokenMetadata
+	if err := json.Unmarshal([]byte(*metaStr), &meta); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "unmarshaling software installer token metadata")
+	}
+
+	if titleID != meta.TitleID {
+		return nil, ctxerr.Wrap(ctx, fleet.NewPermissionError("invalid token"))
+	}
+
+	// The token is valid.
+	return &meta, nil
+}
+
+func (svc *Service) DownloadSoftwareInstaller(ctx context.Context, skipAuthz bool, alt string, titleID uint,
+	teamID *uint,
+) (*fleet.DownloadSoftwareInstallerPayload, error) {
+	downloadRequested := alt == "media"
+	if !downloadRequested {
+		svc.authz.SkipAuthorization(ctx)
+		return nil, fleet.NewInvalidArgumentError("alt", "only alt=media is supported")
+	}
+
+	if teamID == nil {
+		svc.authz.SkipAuthorization(ctx)
+		return nil, fleet.NewInvalidArgumentError("team_id", "is required")
+	}
+
+	meta, err := svc.GetSoftwareInstallerMetadata(ctx, skipAuthz, titleID, teamID)
 	if err != nil {
 		return nil, err
 	}
@@ -213,11 +359,13 @@ func (svc *Service) InstallSoftwareTitle(ctx context.Context, hostID uint, softw
 		return ctxerr.Wrap(ctx, err, "get host")
 	}
 
-	if host.OrbitNodeKey == nil || *host.OrbitNodeKey == "" {
+	platform := host.FleetPlatform()
+	mobileAppleDevice := fleet.AppleDevicePlatform(platform) == fleet.IOSPlatform || fleet.AppleDevicePlatform(platform) == fleet.IPadOSPlatform
+
+	if !mobileAppleDevice && (host.OrbitNodeKey == nil || *host.OrbitNodeKey == "") {
 		// fleetd is required to install software so if the host is
 		// enrolled via plain osquery we return an error
 		svc.authz.SkipAuthorization(ctx)
-		// TODO(roberto): for cleanup task, confirm with product error message.
 		return fleet.NewUserMessageError(errors.New("Host doesn't have fleetd installed"), http.StatusUnprocessableEntity)
 	}
 
@@ -226,21 +374,179 @@ func (svc *Service) InstallSoftwareTitle(ctx context.Context, hostID uint, softw
 		return err
 	}
 
-	installer, err := svc.ds.GetSoftwareInstallerMetadataByTeamAndTitleID(ctx, host.TeamID, softwareTitleID, false)
+	if !mobileAppleDevice {
+		installer, err := svc.ds.GetSoftwareInstallerMetadataByTeamAndTitleID(ctx, host.TeamID, softwareTitleID, false)
+		if err != nil {
+			if !fleet.IsNotFound(err) {
+				return ctxerr.Wrap(ctx, err, "finding software installer for title")
+			}
+			installer = nil
+		}
+
+		// if we found an installer, use that
+		if installer != nil {
+			lastInstallRequest, err := svc.ds.GetHostLastInstallData(ctx, host.ID, installer.InstallerID)
+			if err != nil {
+				return ctxerr.Wrapf(ctx, err, "getting last install data for host %d and installer %d", host.ID, installer.InstallerID)
+			}
+			if lastInstallRequest != nil && lastInstallRequest.Status != nil && *lastInstallRequest.Status == fleet.SoftwareInstallerPending {
+				return &fleet.BadRequestError{
+					Message: "Couldn't install software. Host has a pending install request.",
+					InternalErr: ctxerr.WrapWithData(
+						ctx, err, "host already has a pending install for this installer",
+						map[string]any{
+							"host_id":               host.ID,
+							"software_installer_id": installer.InstallerID,
+							"team_id":               host.TeamID,
+							"title_id":              softwareTitleID,
+						},
+					),
+				}
+			}
+			return svc.installSoftwareTitleUsingInstaller(ctx, host, installer)
+		}
+	}
+
+	vppApp, err := svc.ds.GetVPPAppByTeamAndTitleID(ctx, host.TeamID, softwareTitleID)
 	if err != nil {
+		// if we couldn't find an installer or a VPP app, return a bad
+		// request error
 		if fleet.IsNotFound(err) {
 			return &fleet.BadRequestError{
-				Message: "Software title has no package added. Please add software package to install.",
+				Message: "Couldn't install software. Software title is not available for install. Please add software package or App Store app to install.",
 				InternalErr: ctxerr.WrapWithData(
-					ctx, err, "couldn't find an installer for software title",
+					ctx, err, "couldn't find an installer or VPP app for software title",
 					map[string]any{"host_id": host.ID, "team_id": host.TeamID, "title_id": softwareTitleID},
 				),
 			}
 		}
 
-		return ctxerr.Wrap(ctx, err, "finding software installer for title")
+		return ctxerr.Wrap(ctx, err, "finding VPP app for title")
+	}
+
+	return svc.installSoftwareFromVPP(ctx, host, vppApp, mobileAppleDevice || fleet.AppleDevicePlatform(platform) == fleet.MacOSPlatform, false)
+}
+
+func (svc *Service) installSoftwareFromVPP(ctx context.Context, host *fleet.Host, vppApp *fleet.VPPApp, appleDevice bool, selfService bool) error {
+	if !appleDevice {
+		return &fleet.BadRequestError{
+			Message: "VPP apps can only be installed only on Apple hosts.",
+			InternalErr: ctxerr.NewWithData(
+				ctx, "invalid host platform for requested installer",
+				map[string]any{"host_id": host.ID, "team_id": host.TeamID, "title_id": vppApp.TitleID},
+			),
+		}
+	}
+
+	config, err := svc.ds.AppConfig(ctx)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "fetching config to check MDM status")
+	}
+
+	if !config.MDM.EnabledAndConfigured {
+		return fleet.NewUserMessageError(errors.New("Couldn't install. MDM is turned off. Please make sure that MDM is turned on to install App Store apps."), http.StatusUnprocessableEntity)
 	}
 
+	mdmConnected, err := svc.ds.IsHostConnectedToFleetMDM(ctx, host)
+	if err != nil {
+		return ctxerr.Wrapf(ctx, err, "checking MDM status for host %d", host.ID)
+	}
+
+	if !mdmConnected {
+		return &fleet.BadRequestError{
+			Message: "VPP apps can only be installed only on hosts enrolled in MDM.",
+			InternalErr: ctxerr.NewWithData(
+				ctx, "VPP install attempted on non-MDM host",
+				map[string]any{"host_id": host.ID, "team_id": host.TeamID, "title_id": vppApp.TitleID},
+			),
+		}
+	}
+
+	token, err := svc.getVPPToken(ctx, host.TeamID)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "getting VPP token")
+	}
+
+	// at this moment, neither the UI or the back-end are prepared to
+	// handle [asyncronous errors][1] on assignment, so before assigning a
+	// device to a license, we need to:
+	//
+	// 1. Check if the app is already assigned to the serial number.
+	// 2. If it's not assigned yet, check if we have enough licenses.
+	//
+	// A race still might happen, so async error checking needs to be
+	// implemented anyways at some point.
+	//
+	// [1]: https://developer.apple.com/documentation/devicemanagement/app_and_book_management/handling_error_responses#3729433
+	assignments, err := vpp.GetAssignments(token, &vpp.AssignmentFilter{AdamID: vppApp.AdamID, SerialNumber: host.HardwareSerial})
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "getting assignments from VPP API")
+	}
+
+	var eventID string
+
+	// this app is not assigned to this device, check if we have licenses
+	// left and assign it.
+	if len(assignments) == 0 {
+		assets, err := vpp.GetAssets(token, &vpp.AssetFilter{AdamID: vppApp.AdamID})
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "getting assets from VPP API")
+		}
+
+		if len(assets) == 0 {
+			level.Debug(svc.logger).Log(
+				"msg", "trying to assign VPP asset to host",
+				"adam_id", vppApp.AdamID,
+				"host_serial", host.HardwareSerial,
+			)
+			return &fleet.BadRequestError{
+				Message:     "Couldn't add software. <app_store_id> isn't available in Apple Business Manager. Please purchase license in Apple Business Manager and try again.",
+				InternalErr: ctxerr.Errorf(ctx, "VPP API didn't return any assets for adamID %s", vppApp.AdamID),
+			}
+		}
+
+		if len(assets) > 1 {
+			return ctxerr.Errorf(ctx, "VPP API returned more than one asset for adamID %s", vppApp.AdamID)
+		}
+
+		if assets[0].AvailableCount <= 0 {
+			return &fleet.BadRequestError{
+				Message: "Couldn't install. No available licenses. Please purchase license in Apple Business Manager and try again.",
+				InternalErr: ctxerr.NewWithData(
+					ctx, "license available count <= 0",
+					map[string]any{
+						"host_id": host.ID,
+						"team_id": host.TeamID,
+						"adam_id": vppApp.AdamID,
+						"count":   assets[0].AvailableCount,
+					},
+				),
+			}
+		}
+
+		eventID, err = vpp.AssociateAssets(token, &vpp.AssociateAssetsRequest{Assets: assets, SerialNumbers: []string{host.HardwareSerial}})
+		if err != nil {
+			return ctxerr.Wrapf(ctx, err, "associating asset with adamID %s to host %s", vppApp.AdamID, host.HardwareSerial)
+		}
+
+	}
+
+	// add command to install
+	cmdUUID := uuid.NewString()
+	err = svc.mdmAppleCommander.InstallApplication(ctx, []string{host.UUID}, cmdUUID, vppApp.AdamID)
+	if err != nil {
+		return ctxerr.Wrapf(ctx, err, "sending command to install VPP %s application to host with serial %s", vppApp.AdamID, host.HardwareSerial)
+	}
+
+	err = svc.ds.InsertHostVPPSoftwareInstall(ctx, host.ID, vppApp.VPPAppID, cmdUUID, eventID, selfService)
+	if err != nil {
+		return ctxerr.Wrapf(ctx, err, "inserting host vpp software install for host with serial %s and app with adamID %s", host.HardwareSerial, vppApp.AdamID)
+	}
+
+	return nil
+}
+
+func (svc *Service) installSoftwareTitleUsingInstaller(ctx context.Context, host *fleet.Host, installer *fleet.SoftwareInstaller) error {
 	ext := filepath.Ext(installer.Name)
 	requiredPlatform := packageExtensionToPlatform(ext)
 	if requiredPlatform == "" {
@@ -251,14 +557,14 @@ func (svc *Service) InstallSoftwareTitle(ctx context.Context, hostID uint, softw
 	if host.FleetPlatform() != requiredPlatform {
 		return &fleet.BadRequestError{
 			Message: fmt.Sprintf("Package (%s) can be installed only on %s hosts.", ext, requiredPlatform),
-			InternalErr: ctxerr.WrapWithData(
-				ctx, err, "invalid host platform for requested installer",
-				map[string]any{"host_id": host.ID, "team_id": host.TeamID, "title_id": softwareTitleID},
+			InternalErr: ctxerr.NewWithData(
+				ctx, "invalid host platform for requested installer",
+				map[string]any{"host_id": host.ID, "team_id": host.TeamID, "title_id": installer.TitleID},
 			),
 		}
 	}
 
-	_, err = svc.ds.InsertSoftwareInstallRequest(ctx, hostID, installer.InstallerID, false)
+	_, err := svc.ds.InsertSoftwareInstallRequest(ctx, host.ID, installer.InstallerID, false)
 	return ctxerr.Wrap(ctx, err, "inserting software install request")
 }
 
@@ -270,12 +576,38 @@ func (svc *Service) GetSoftwareInstallResults(ctx context.Context, resultUUID st
 
 	res, err := svc.ds.GetSoftwareInstallResults(ctx, resultUUID)
 	if err != nil {
-		return nil, err
+		if fleet.IsNotFound(err) {
+			if err := svc.authz.Authorize(ctx, &fleet.HostSoftwareInstallerResultAuthz{}, fleet.ActionRead); err != nil {
+				return nil, err
+			}
+		}
+		svc.authz.SkipAuthorization(ctx)
+		return nil, ctxerr.Wrap(ctx, err, "get software install result")
 	}
 
-	// Team specific auth check
-	if err := svc.authz.Authorize(ctx, &fleet.HostSoftwareInstallerResultAuthz{HostTeamID: res.HostTeamID}, fleet.ActionRead); err != nil {
-		return nil, err
+	if res.HostDeletedAt == nil {
+		// host is not deleted, get it and authorize for the host's team
+		host, err := svc.ds.HostLite(ctx, res.HostID)
+		// if error is because the host does not exist, check first if the user
+		// had access to run a script (to prevent leaking valid host ids).
+		if err != nil {
+			if fleet.IsNotFound(err) {
+				if err := svc.authz.Authorize(ctx, &fleet.HostSoftwareInstallerResultAuthz{}, fleet.ActionRead); err != nil {
+					return nil, err
+				}
+			}
+			svc.authz.SkipAuthorization(ctx)
+			return nil, ctxerr.Wrap(ctx, err, "get host lite")
+		}
+		// Team specific auth check
+		if err := svc.authz.Authorize(ctx, &fleet.HostSoftwareInstallerResultAuthz{HostTeamID: host.TeamID}, fleet.ActionRead); err != nil {
+			return nil, err
+		}
+	} else {
+		// host was deleted, authorize for no-team as a fallback
+		if err := svc.authz.Authorize(ctx, &fleet.HostSoftwareInstallerResultAuthz{}, fleet.ActionRead); err != nil {
+			return nil, err
+		}
 	}
 
 	res.EnhanceOutputDetails()
@@ -316,6 +648,14 @@ func (svc *Service) addMetadataToSoftwarePayload(ctx context.Context, payload *f
 		}
 		return "", ctxerr.Wrap(ctx, err, "extracting metadata from installer")
 	}
+
+	if meta.Version == "" {
+		return "", &fleet.BadRequestError{
+			Message:     fmt.Sprintf("Couldn't add. Fleet couldn't read the version from %s.", payload.Filename),
+			InternalErr: ctxerr.New(ctx, "extracting version from installer metadata"),
+		}
+	}
+
 	payload.Title = meta.Name
 	if payload.Title == "" {
 		// use the filename if no title from metadata
@@ -351,27 +691,42 @@ func (svc *Service) addMetadataToSoftwarePayload(ctx context.Context, payload *f
 
 const maxInstallerSizeBytes int64 = 1024 * 1024 * 500
 
-func (svc *Service) BatchSetSoftwareInstallers(ctx context.Context, tmName string, payloads []fleet.SoftwareInstallerPayload, dryRun bool) error {
-	if tmName == "" {
-		svc.authz.SkipAuthorization(ctx) // so that the error message is not replaced by "forbidden"
-		return ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError("team_name", "must not be empty"))
+func (svc *Service) BatchSetSoftwareInstallers(
+	ctx context.Context, tmName string, payloads []fleet.SoftwareInstallerPayload, dryRun bool,
+) ([]fleet.SoftwareInstaller, error) {
+	if err := svc.authz.Authorize(ctx, &fleet.Team{}, fleet.ActionRead); err != nil {
+		return nil, err
+	}
+
+	var teamID *uint
+	if tmName != "" {
+		tm, err := svc.ds.TeamByName(ctx, tmName)
+		if err != nil {
+			// If this is a dry run, the team may not have been created yet
+			if dryRun && fleet.IsNotFound(err) {
+				return nil, nil
+			}
+			return nil, err
+		}
+		teamID = &tm.ID
 	}
 
-	if err := svc.authz.Authorize(ctx, &fleet.Team{}, fleet.ActionRead); err != nil {
-		return err
+	if err := svc.authz.Authorize(ctx, &fleet.SoftwareInstaller{TeamID: teamID}, fleet.ActionWrite); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "validating authorization")
 	}
 
-	tm, err := svc.ds.TeamByName(ctx, tmName)
-	if err != nil {
-		// If this is a dry run, the team may not have been created yet
-		if dryRun && fleet.IsNotFound(err) {
-			return nil
+	for _, payload := range payloads {
+		if len(payload.URL) > fleet.SoftwareInstallerURLMaxLength {
+			return nil, fleet.NewInvalidArgumentError(
+				"software.url",
+				"software URL is too long, must be less than 256 characters",
+			)
 		}
-		return err
 	}
 
-	if err := svc.authz.Authorize(ctx, &fleet.SoftwareInstaller{TeamID: &tm.ID}, fleet.ActionWrite); err != nil {
-		return ctxerr.Wrap(ctx, err, "validating authorization")
+	vc, ok := viewer.FromContext(ctx)
+	if !ok {
+		return nil, fleet.ErrNoContext
 	}
 
 	g, workerCtx := errgroup.WithContext(ctx)
@@ -380,8 +735,6 @@ func (svc *Service) BatchSetSoftwareInstallers(ctx context.Context, tmName strin
 	// goroutine only writes to its index.
 	installers := make([]*fleet.UploadSoftwareInstallerPayload, len(payloads))
 
-	client := fleethttp.NewClient()
-	client.Transport = fleethttp.NewSizeLimitTransport(maxInstallerSizeBytes)
 	for i, p := range payloads {
 		i, p := i, p
 
@@ -394,6 +747,8 @@ func (svc *Service) BatchSetSoftwareInstallers(ctx context.Context, tmName strin
 					fmt.Sprintf("Couldn't edit software. URL (%q) is invalid", p.URL),
 				)
 			}
+			client := fleethttp.NewClient()
+			client.Transport = fleethttp.NewSizeLimitTransport(maxInstallerSizeBytes)
 
 			req, err := http.NewRequestWithContext(workerCtx, http.MethodGet, p.URL, nil)
 			if err != nil {
@@ -444,12 +799,14 @@ func (svc *Service) BatchSetSoftwareInstallers(ctx context.Context, tmName strin
 			}
 
 			installer := &fleet.UploadSoftwareInstallerPayload{
-				TeamID:            &tm.ID,
+				TeamID:            teamID,
 				InstallScript:     p.InstallScript,
 				PreInstallQuery:   p.PreInstallQuery,
 				PostInstallScript: p.PostInstallScript,
 				InstallerFile:     bytes.NewReader(bodyBytes),
 				SelfService:       p.SelfService,
+				UserID:            vc.UserID(),
+				URL:               p.URL,
 			}
 
 			// set the filename before adding metadata, as it is used as fallback
@@ -491,46 +848,89 @@ func (svc *Service) BatchSetSoftwareInstallers(ctx context.Context, tmName strin
 	if err := g.Wait(); err != nil {
 		// NOTE: intentionally not wrapping to avoid polluting user
 		// errors.
-		return err
+		return nil, err
 	}
 
 	if dryRun {
-		return nil
+		return nil, nil
 	}
 
 	for _, payload := range installers {
 		if err := svc.storeSoftware(ctx, payload); err != nil {
-			return ctxerr.Wrap(ctx, err, "storing software installer")
+			return nil, ctxerr.Wrap(ctx, err, "storing software installer")
 		}
 	}
 
-	if err := svc.ds.BatchSetSoftwareInstallers(ctx, &tm.ID, installers); err != nil {
-		return ctxerr.Wrap(ctx, err, "batch set software installers")
+	insertedSoftwareInstallers, err := svc.ds.BatchSetSoftwareInstallers(ctx, teamID, installers)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "batch set software installers")
 	}
 
 	// Note: per @noahtalerman we don't want activity items for CLI actions
 	// anymore, so that's intentionally skipped.
 
-	return nil
+	return insertedSoftwareInstallers, nil
 }
 
 func (svc *Service) SelfServiceInstallSoftwareTitle(ctx context.Context, host *fleet.Host, softwareTitleID uint) error {
 	installer, err := svc.ds.GetSoftwareInstallerMetadataByTeamAndTitleID(ctx, host.TeamID, softwareTitleID, false)
 	if err != nil {
+		if !fleet.IsNotFound(err) {
+			return ctxerr.Wrap(ctx, err, "finding software installer for title")
+		}
+		installer = nil
+	}
+
+	if installer != nil {
+		if !installer.SelfService {
+			return &fleet.BadRequestError{
+				Message: "Software title is not available through self-service",
+				InternalErr: ctxerr.NewWithData(
+					ctx, "software title not available through self-service",
+					map[string]any{"host_id": host.ID, "team_id": host.TeamID, "title_id": softwareTitleID},
+				),
+			}
+		}
+
+		ext := filepath.Ext(installer.Name)
+		requiredPlatform := packageExtensionToPlatform(ext)
+		if requiredPlatform == "" {
+			// this should never happen
+			return ctxerr.Errorf(ctx, "software installer has unsupported type %s", ext)
+		}
+
+		if host.FleetPlatform() != requiredPlatform {
+			return &fleet.BadRequestError{
+				Message: fmt.Sprintf("Package (%s) can be installed only on %s hosts.", ext, requiredPlatform),
+				InternalErr: ctxerr.WrapWithData(
+					ctx, err, "invalid host platform for requested installer",
+					map[string]any{"host_id": host.ID, "team_id": host.TeamID, "title_id": softwareTitleID},
+				),
+			}
+		}
+
+		_, err = svc.ds.InsertSoftwareInstallRequest(ctx, host.ID, installer.InstallerID, true)
+		return ctxerr.Wrap(ctx, err, "inserting self-service software install request")
+	}
+
+	vppApp, err := svc.ds.GetVPPAppByTeamAndTitleID(ctx, host.TeamID, softwareTitleID)
+	if err != nil {
+		// if we couldn't find an installer or a VPP app, return a bad
+		// request error
 		if fleet.IsNotFound(err) {
 			return &fleet.BadRequestError{
-				Message: "Software title has no package added. Please add software package to install.",
+				Message: "Couldn't install software. Software title is not available for install. Please add software package or App Store app to install.",
 				InternalErr: ctxerr.WrapWithData(
-					ctx, err, "couldn't find an installer for software title",
+					ctx, err, "couldn't find an installer or VPP app for software title",
 					map[string]any{"host_id": host.ID, "team_id": host.TeamID, "title_id": softwareTitleID},
 				),
 			}
 		}
 
-		return ctxerr.Wrap(ctx, err, "finding software installer for title")
+		return ctxerr.Wrap(ctx, err, "finding VPP app for title")
 	}
 
-	if !installer.SelfService {
+	if !vppApp.SelfService {
 		return &fleet.BadRequestError{
 			Message: "Software title is not available through self-service",
 			InternalErr: ctxerr.NewWithData(
@@ -540,25 +940,10 @@ func (svc *Service) SelfServiceInstallSoftwareTitle(ctx context.Context, host *f
 		}
 	}
 
-	ext := filepath.Ext(installer.Name)
-	requiredPlatform := packageExtensionToPlatform(ext)
-	if requiredPlatform == "" {
-		// this should never happen
-		return ctxerr.Errorf(ctx, "software installer has unsupported type %s", ext)
-	}
-
-	if host.FleetPlatform() != requiredPlatform {
-		return &fleet.BadRequestError{
-			Message: fmt.Sprintf("Package (%s) can be installed only on %s hosts.", ext, requiredPlatform),
-			InternalErr: ctxerr.WrapWithData(
-				ctx, err, "invalid host platform for requested installer",
-				map[string]any{"host_id": host.ID, "team_id": host.TeamID, "title_id": softwareTitleID},
-			),
-		}
-	}
+	platform := host.FleetPlatform()
+	mobileAppleDevice := fleet.AppleDevicePlatform(platform) == fleet.IOSPlatform || fleet.AppleDevicePlatform(platform) == fleet.IPadOSPlatform
 
-	_, err = svc.ds.InsertSoftwareInstallRequest(ctx, host.ID, installer.InstallerID, true)
-	return ctxerr.Wrap(ctx, err, "inserting self-service software install request")
+	return svc.installSoftwareFromVPP(ctx, host, vppApp, mobileAppleDevice || fleet.AppleDevicePlatform(platform) == fleet.MacOSPlatform, true)
 }
 
 // packageExtensionToPlatform returns the platform name based on the
diff --git a/ee/server/service/teams.go b/ee/server/service/teams.go
index ebdb716a0740..448abc367401 100644
--- a/ee/server/service/teams.go
+++ b/ee/server/service/teams.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"strings"
 
 	"github.com/fleetdm/fleet/v4/pkg/optjson"
 	"github.com/fleetdm/fleet/v4/server"
@@ -73,6 +74,13 @@ func (svc *Service) NewTeam(ctx context.Context, p fleet.TeamPayload) (*fleet.Te
 	if *p.Name == "" {
 		return nil, fleet.NewInvalidArgumentError("name", "may not be empty")
 	}
+	l := strings.ToLower(*p.Name)
+	if l == strings.ToLower(fleet.ReservedNameAllTeams) {
+		return nil, fleet.NewInvalidArgumentError("name", `"All teams" is a reserved team name`)
+	}
+	if l == strings.ToLower(fleet.ReservedNameNoTeam) {
+		return nil, fleet.NewInvalidArgumentError("name", `"No team" is a reserved team name`)
+	}
 	team.Name = *p.Name
 
 	if p.Description != nil {
@@ -129,6 +137,13 @@ func (svc *Service) ModifyTeam(ctx context.Context, teamID uint, payload fleet.T
 		if *payload.Name == "" {
 			return nil, fleet.NewInvalidArgumentError("name", "may not be empty")
 		}
+		l := strings.ToLower(*payload.Name)
+		if l == strings.ToLower(fleet.ReservedNameAllTeams) {
+			return nil, fleet.NewInvalidArgumentError("name", `"All teams" is a reserved team name`)
+		}
+		if l == strings.ToLower(fleet.ReservedNameNoTeam) {
+			return nil, fleet.NewInvalidArgumentError("name", `"No team" is a reserved team name`)
+		}
 		team.Name = *payload.Name
 	}
 	if payload.Description != nil {
@@ -144,7 +159,14 @@ func (svc *Service) ModifyTeam(ctx context.Context, teamID uint, payload fleet.T
 		return nil, err
 	}
 
-	var macOSMinVersionUpdated, windowsUpdatesUpdated, macOSDiskEncryptionUpdated, macOSEnableEndUserAuthUpdated bool
+	var (
+		macOSMinVersionUpdated        bool
+		iOSMinVersionUpdated          bool
+		iPadOSMinVersionUpdated       bool
+		windowsUpdatesUpdated         bool
+		macOSDiskEncryptionUpdated    bool
+		macOSEnableEndUserAuthUpdated bool
+	)
 	if payload.MDM != nil {
 		if payload.MDM.MacOSUpdates != nil {
 			if err := payload.MDM.MacOSUpdates.Validate(); err != nil {
@@ -156,6 +178,26 @@ func (svc *Service) ModifyTeam(ctx context.Context, teamID uint, payload fleet.T
 				team.Config.MDM.MacOSUpdates = *payload.MDM.MacOSUpdates
 			}
 		}
+		if payload.MDM.IOSUpdates != nil {
+			if err := payload.MDM.IOSUpdates.Validate(); err != nil {
+				return nil, fleet.NewInvalidArgumentError("ios_updates", err.Error())
+			}
+			if payload.MDM.IOSUpdates.MinimumVersion.Set || payload.MDM.IOSUpdates.Deadline.Set {
+				iOSMinVersionUpdated = team.Config.MDM.IOSUpdates.MinimumVersion.Value != payload.MDM.IOSUpdates.MinimumVersion.Value ||
+					team.Config.MDM.IOSUpdates.Deadline.Value != payload.MDM.IOSUpdates.Deadline.Value
+				team.Config.MDM.IOSUpdates = *payload.MDM.IOSUpdates
+			}
+		}
+		if payload.MDM.IPadOSUpdates != nil {
+			if err := payload.MDM.IPadOSUpdates.Validate(); err != nil {
+				return nil, fleet.NewInvalidArgumentError("ipados_updates", err.Error())
+			}
+			if payload.MDM.IPadOSUpdates.MinimumVersion.Set || payload.MDM.IPadOSUpdates.Deadline.Set {
+				iPadOSMinVersionUpdated = team.Config.MDM.IPadOSUpdates.MinimumVersion.Value != payload.MDM.IPadOSUpdates.MinimumVersion.Value ||
+					team.Config.MDM.IPadOSUpdates.Deadline.Value != payload.MDM.IPadOSUpdates.Deadline.Value
+				team.Config.MDM.IPadOSUpdates = *payload.MDM.IPadOSUpdates
+			}
+		}
 
 		if payload.MDM.WindowsUpdates != nil {
 			if err := payload.MDM.WindowsUpdates.Validate(); err != nil {
@@ -249,8 +291,9 @@ func (svc *Service) ModifyTeam(ctx context.Context, teamID uint, payload fleet.T
 	if err != nil {
 		return nil, err
 	}
+
 	if macOSMinVersionUpdated {
-		if err := svc.mdmAppleEditedMacOSUpdates(ctx, &team.ID, team.Config.MDM.MacOSUpdates); err != nil {
+		if err := svc.mdmAppleEditedAppleOSUpdates(ctx, &team.ID, fleet.MacOS, team.Config.MDM.MacOSUpdates); err != nil {
 			return nil, ctxerr.Wrap(ctx, err, "update DDM profile on macOS updates change")
 		}
 
@@ -264,9 +307,46 @@ func (svc *Service) ModifyTeam(ctx context.Context, teamID uint, payload fleet.T
 				Deadline:       team.Config.MDM.MacOSUpdates.Deadline.Value,
 			},
 		); err != nil {
-			return nil, ctxerr.Wrap(ctx, err, "create activity for team macos min version edited")
+			return nil, ctxerr.Wrap(ctx, err, "create activity for team macOS min version edited")
+		}
+	}
+	if iOSMinVersionUpdated {
+		if err := svc.mdmAppleEditedAppleOSUpdates(ctx, &team.ID, fleet.IOS, team.Config.MDM.IOSUpdates); err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "update DDM profile on iOS updates change")
+		}
+
+		if err := svc.NewActivity(
+			ctx,
+			authz.UserFromContext(ctx),
+			fleet.ActivityTypeEditedIOSMinVersion{
+				TeamID:         &team.ID,
+				TeamName:       &team.Name,
+				MinimumVersion: team.Config.MDM.IOSUpdates.MinimumVersion.Value,
+				Deadline:       team.Config.MDM.IOSUpdates.Deadline.Value,
+			},
+		); err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "create activity for team iOS min version edited")
+		}
+	}
+	if iPadOSMinVersionUpdated {
+		if err := svc.mdmAppleEditedAppleOSUpdates(ctx, &team.ID, fleet.IPadOS, team.Config.MDM.IPadOSUpdates); err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "update DDM profile on iPadOS updates change")
+		}
+
+		if err := svc.NewActivity(
+			ctx,
+			authz.UserFromContext(ctx),
+			fleet.ActivityTypeEditedIPadOSMinVersion{
+				TeamID:         &team.ID,
+				TeamName:       &team.Name,
+				MinimumVersion: team.Config.MDM.IPadOSUpdates.MinimumVersion.Value,
+				Deadline:       team.Config.MDM.IPadOSUpdates.Deadline.Value,
+			},
+		); err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "create activity for team iPadOS min version edited")
 		}
 	}
+
 	if windowsUpdatesUpdated {
 		var deadline, grace *int
 		if team.Config.MDM.WindowsUpdates.DeadlineDays.Valid {
@@ -547,7 +627,7 @@ func (svc *Service) DeleteTeam(ctx context.Context, teamID uint) error {
 	}
 
 	if len(hostIDs) > 0 {
-		if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, hostIDs, nil, nil, nil); err != nil {
+		if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, hostIDs, nil, nil, nil); err != nil {
 			return ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 		}
 
@@ -795,6 +875,14 @@ func (svc *Service) ApplyTeamSpecs(ctx context.Context, specs []*fleet.TeamSpec,
 			}
 		}
 
+		l := strings.ToLower(spec.Name)
+		if l == strings.ToLower(fleet.ReservedNameAllTeams) {
+			return nil, fleet.NewInvalidArgumentError("name", `"All teams" is a reserved team name`)
+		}
+		if l == strings.ToLower(fleet.ReservedNameNoTeam) {
+			return nil, fleet.NewInvalidArgumentError("name", `"No team" is a reserved team name`)
+		}
+
 		var team *fleet.Team
 		// If filename is provided, try to find the team by filename first.
 		// This is needed in case user is trying to modify the team name.
@@ -803,7 +891,22 @@ func (svc *Service) ApplyTeamSpecs(ctx context.Context, specs []*fleet.TeamSpec,
 			if err != nil && !fleet.IsNotFound(err) {
 				return nil, err
 			}
+			if team != nil && team.Name != spec.Name {
+				// If user is trying to change team name, check that the new name is not already taken.
+				_, err = svc.ds.TeamByName(ctx, spec.Name)
+				switch {
+				case err == nil:
+					return nil, fleet.NewInvalidArgumentError("name",
+						fmt.Sprintf("cannot change team name from '%s' (filename: %s) to '%s' because team name already exists", team.Name,
+							*spec.Filename, spec.Name))
+				case fleet.IsNotFound(err):
+					// OK
+				default:
+					return nil, err
+				}
+			}
 		}
+
 		var create bool
 		if team == nil {
 			team, err = svc.ds.TeamByName(ctx, spec.Name)
@@ -1018,6 +1121,7 @@ func (svc *Service) createTeamFromSpec(
 			Integrations: fleet.TeamIntegrations{
 				GoogleCalendar: spec.Integrations.GoogleCalendar,
 			},
+			Software: spec.Software,
 		},
 		Secrets: secrets,
 	})
@@ -1078,6 +1182,16 @@ func (svc *Service) editTeamFromSpec(
 		team.Config.MDM.MacOSUpdates = spec.MDM.MacOSUpdates
 		mdmMacOSUpdatesEdited = true
 	}
+	var mdmIOSUpdatesEdited bool
+	if spec.MDM.IOSUpdates.Deadline.Set || spec.MDM.IOSUpdates.MinimumVersion.Set {
+		team.Config.MDM.IOSUpdates = spec.MDM.IOSUpdates
+		mdmIOSUpdatesEdited = true
+	}
+	var mdmIPadOSUpdatesEdited bool
+	if spec.MDM.IPadOSUpdates.Deadline.Set || spec.MDM.IPadOSUpdates.MinimumVersion.Set {
+		team.Config.MDM.IPadOSUpdates = spec.MDM.IPadOSUpdates
+		mdmIPadOSUpdatesEdited = true
+	}
 	if spec.MDM.WindowsUpdates.DeadlineDays.Set || spec.MDM.WindowsUpdates.GracePeriodDays.Set {
 		team.Config.MDM.WindowsUpdates = spec.MDM.WindowsUpdates
 	}
@@ -1168,8 +1282,18 @@ func (svc *Service) editTeamFromSpec(
 		team.Config.Scripts = spec.Scripts
 	}
 
-	if spec.Software.Set {
-		team.Config.Software = spec.Software
+	if spec.Software != nil {
+		if team.Config.Software == nil {
+			team.Config.Software = &fleet.SoftwareSpec{}
+		}
+
+		if spec.Software.Packages.Set {
+			team.Config.Software.Packages = spec.Software.Packages
+		}
+
+		if spec.Software.AppStoreApps.Set {
+			team.Config.Software.AppStoreApps = spec.Software.AppStoreApps
+		}
 	}
 
 	if secrets != nil {
@@ -1281,7 +1405,17 @@ func (svc *Service) editTeamFromSpec(
 	}
 
 	if mdmMacOSUpdatesEdited {
-		if err := svc.mdmAppleEditedMacOSUpdates(ctx, &team.ID, team.Config.MDM.MacOSUpdates); err != nil {
+		if err := svc.mdmAppleEditedAppleOSUpdates(ctx, &team.ID, fleet.MacOS, team.Config.MDM.MacOSUpdates); err != nil {
+			return err
+		}
+	}
+	if mdmIOSUpdatesEdited {
+		if err := svc.mdmAppleEditedAppleOSUpdates(ctx, &team.ID, fleet.IOS, team.Config.MDM.IOSUpdates); err != nil {
+			return err
+		}
+	}
+	if mdmIPadOSUpdatesEdited {
+		if err := svc.mdmAppleEditedAppleOSUpdates(ctx, &team.ID, fleet.IPadOS, team.Config.MDM.IPadOSUpdates); err != nil {
 			return err
 		}
 	}
diff --git a/ee/server/service/vpp.go b/ee/server/service/vpp.go
new file mode 100644
index 000000000000..b03291ff4693
--- /dev/null
+++ b/ee/server/service/vpp.go
@@ -0,0 +1,562 @@
+package service
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/authz"
+	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/mdm/apple/itunes"
+	"github.com/fleetdm/fleet/v4/server/mdm/apple/vpp"
+)
+
+// Used for overriding the env var value in testing
+var testSetEmptyPrivateKey bool
+
+// getVPPToken returns the base64 encoded VPP token, ready for use in requests to Apple's VPP API.
+// It returns an error if the token is expired.
+func (svc *Service) getVPPToken(ctx context.Context, teamID *uint) (string, error) {
+	token, err := svc.ds.GetVPPTokenByTeamID(ctx, teamID)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return "", fleet.NewUserMessageError(errors.New("No available VPP Token"), http.StatusUnprocessableEntity)
+		}
+		return "", ctxerr.Wrap(ctx, err, "fetching vpp token")
+	}
+
+	if time.Now().After(token.RenewDate) {
+		return "", fleet.NewUserMessageError(errors.New("Couldn't install. VPP token expired."), http.StatusUnprocessableEntity)
+	}
+
+	return token.Token, nil
+}
+
+func (svc *Service) BatchAssociateVPPApps(ctx context.Context, teamName string, payloads []fleet.VPPBatchPayload, dryRun bool) error {
+	if teamName == "" {
+		svc.authz.SkipAuthorization(ctx) // so that the error message is not replaced by "forbidden"
+		return ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError("team_name", "must not be empty"))
+	}
+
+	if err := svc.authz.Authorize(ctx, &fleet.Team{}, fleet.ActionRead); err != nil {
+		return err
+	}
+
+	team, err := svc.ds.TeamByName(ctx, teamName)
+	if err != nil {
+		// If this is a dry run, the team may not have been created yet
+		if dryRun && fleet.IsNotFound(err) {
+			return nil
+		}
+		return err
+	}
+
+	if err := svc.authz.Authorize(ctx, &fleet.SoftwareInstaller{TeamID: &team.ID}, fleet.ActionWrite); err != nil {
+		return ctxerr.Wrap(ctx, err, "validating authorization")
+	}
+
+	// Adding VPP apps will add them to all available platforms per decision:
+	// https://github.com/fleetdm/fleet/issues/19447#issuecomment-2256598681
+	// The code is already here to support individual platforms, so we can easily enable it later.
+
+	payloadsWithPlatform := make([]fleet.VPPBatchPayloadWithPlatform, 0, len(payloads))
+	for _, payload := range payloads {
+		// Currently only macOS is supported for self-service. Don't
+		// import vpp apps as self-service for ios or ipados
+		payloadsWithPlatform = append(payloadsWithPlatform, []fleet.VPPBatchPayloadWithPlatform{{
+			AppStoreID:  payload.AppStoreID,
+			SelfService: false,
+			Platform:    fleet.IOSPlatform,
+		}, {
+			AppStoreID:  payload.AppStoreID,
+			SelfService: false,
+			Platform:    fleet.IPadOSPlatform,
+		}, {
+			AppStoreID:  payload.AppStoreID,
+			SelfService: payload.SelfService,
+			Platform:    fleet.MacOSPlatform,
+		}}...)
+	}
+
+	var vppAppTeams []fleet.VPPAppTeam
+	// Don't check for token if we're only disassociating assets
+	if len(payloads) > 0 {
+		token, err := svc.getVPPToken(ctx, &team.ID)
+		if err != nil {
+			return fleet.NewUserMessageError(ctxerr.Wrap(ctx, err, "could not retrieve vpp token"), http.StatusUnprocessableEntity)
+		}
+
+		for _, payload := range payloadsWithPlatform {
+			if payload.Platform == "" {
+				payload.Platform = fleet.MacOSPlatform
+			}
+			if payload.Platform != fleet.IOSPlatform && payload.Platform != fleet.IPadOSPlatform && payload.Platform != fleet.MacOSPlatform {
+				return fleet.NewInvalidArgumentError("app_store_apps.platform",
+					fmt.Sprintf("platform must be one of '%s', '%s', or '%s", fleet.IOSPlatform, fleet.IPadOSPlatform, fleet.MacOSPlatform))
+			}
+			vppAppTeams = append(vppAppTeams, fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: payload.AppStoreID, Platform: payload.Platform}, SelfService: payload.SelfService})
+		}
+
+		var missingAssets []string
+
+		assets, err := vpp.GetAssets(token, nil)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "unable to retrieve assets")
+		}
+
+		assetMap := map[string]struct{}{}
+		for _, asset := range assets {
+			assetMap[asset.AdamID] = struct{}{}
+		}
+
+		for _, vppAppID := range vppAppTeams {
+			if _, ok := assetMap[vppAppID.AdamID]; !ok {
+				missingAssets = append(missingAssets, vppAppID.AdamID)
+			}
+		}
+
+		if len(missingAssets) != 0 {
+			reqErr := ctxerr.Errorf(ctx, "requested app not available on vpp account: %s", strings.Join(missingAssets, ","))
+			return fleet.NewUserMessageError(reqErr, http.StatusUnprocessableEntity)
+		}
+	}
+
+	if !dryRun {
+		if len(vppAppTeams) > 0 {
+			apps, err := getVPPAppsMetadata(ctx, vppAppTeams)
+			if err != nil {
+				return ctxerr.Wrap(ctx, err, "refreshing VPP app metadata")
+			}
+			if len(apps) == 0 {
+				return fleet.NewInvalidArgumentError("app_store_apps",
+					"no valid apps found matching the provided app store IDs and platforms")
+			}
+
+			if err := svc.ds.BatchInsertVPPApps(ctx, apps); err != nil {
+				return ctxerr.Wrap(ctx, err, "inserting vpp app metadata")
+			}
+			// Filter out the apps with invalid platforms
+			if len(apps) != len(vppAppTeams) {
+				vppAppTeams = make([]fleet.VPPAppTeam, 0, len(apps))
+				for _, app := range apps {
+					vppAppTeams = append(vppAppTeams, app.VPPAppTeam)
+				}
+			}
+		}
+
+		if err := svc.ds.SetTeamVPPApps(ctx, &team.ID, vppAppTeams); err != nil {
+			if errors.Is(err, sql.ErrNoRows) {
+				return fleet.NewUserMessageError(ctxerr.Wrap(ctx, err, "no vpp token to set team vpp assets"), http.StatusUnprocessableEntity)
+			}
+			return ctxerr.Wrap(ctx, err, "set team vpp assets")
+		}
+	}
+
+	return nil
+}
+
+func (svc *Service) GetAppStoreApps(ctx context.Context, teamID *uint) ([]*fleet.VPPApp, error) {
+	if err := svc.authz.Authorize(ctx, &fleet.VPPApp{TeamID: teamID}, fleet.ActionRead); err != nil {
+		return nil, err
+	}
+
+	vppToken, err := svc.getVPPToken(ctx, teamID)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "retrieving VPP token")
+	}
+
+	assets, err := vpp.GetAssets(vppToken, nil)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "fetching Apple VPP assets")
+	}
+
+	if len(assets) == 0 {
+		return []*fleet.VPPApp{}, nil
+	}
+
+	var adamIDs []string
+	for _, a := range assets {
+		adamIDs = append(adamIDs, a.AdamID)
+	}
+
+	assetMetadata, err := itunes.GetAssetMetadata(adamIDs, &itunes.AssetMetadataFilter{Entity: "software"})
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "fetching VPP asset metadata")
+	}
+
+	assignedApps, err := svc.ds.GetAssignedVPPApps(ctx, teamID)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "retrieving assigned VPP apps")
+	}
+
+	var apps []*fleet.VPPApp
+	var appsToUpdate []*fleet.VPPApp
+	for _, a := range assets {
+		m, ok := assetMetadata[a.AdamID]
+		if !ok {
+			// Then this adam_id is not a VPP software entity, so skip it.
+			continue
+		}
+
+		platforms := getPlatformsFromSupportedDevices(m.SupportedDevices)
+
+		for platform := range platforms {
+			vppAppID := fleet.VPPAppID{
+				AdamID:   a.AdamID,
+				Platform: platform,
+			}
+			vppAppTeam := fleet.VPPAppTeam{
+				VPPAppID: vppAppID,
+			}
+			app := &fleet.VPPApp{
+				VPPAppTeam:       vppAppTeam,
+				BundleIdentifier: m.BundleID,
+				IconURL:          m.ArtworkURL,
+				Name:             m.TrackName,
+				LatestVersion:    m.Version,
+			}
+
+			if appFleet, ok := assignedApps[vppAppID]; ok {
+				// Then this is already assigned, so filter it out.
+				app.SelfService = appFleet.SelfService
+				appsToUpdate = append(appsToUpdate, app)
+				continue
+			}
+
+			apps = append(apps, app)
+		}
+	}
+
+	if len(appsToUpdate) > 0 {
+		if err := svc.ds.BatchInsertVPPApps(ctx, appsToUpdate); err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "updating existing VPP apps")
+		}
+	}
+
+	// Sort apps by name and by platform
+	sort.Slice(apps, func(i, j int) bool {
+		if apps[i].Name != apps[j].Name {
+			return apps[i].Name < apps[j].Name
+		}
+		return apps[i].Platform < apps[j].Platform
+	})
+
+	return apps, nil
+}
+
+func getPlatformsFromSupportedDevices(supportedDevices []string) map[fleet.AppleDevicePlatform]struct{} {
+	platforms := make(map[fleet.AppleDevicePlatform]struct{}, 1)
+	if len(supportedDevices) == 0 {
+		platforms[fleet.MacOSPlatform] = struct{}{}
+		return platforms
+	}
+	for _, device := range supportedDevices {
+		// It is rare that a single app supports all platforms, but it is possible.
+		switch {
+		case strings.HasPrefix(device, "iPhone"):
+			platforms[fleet.IOSPlatform] = struct{}{}
+		case strings.HasPrefix(device, "iPad"):
+			platforms[fleet.IPadOSPlatform] = struct{}{}
+		case strings.HasPrefix(device, "Mac"):
+			platforms[fleet.MacOSPlatform] = struct{}{}
+		}
+	}
+	return platforms
+}
+
+func (svc *Service) AddAppStoreApp(ctx context.Context, teamID *uint, appID fleet.VPPAppTeam) error {
+	if err := svc.authz.Authorize(ctx, &fleet.VPPApp{TeamID: teamID}, fleet.ActionWrite); err != nil {
+		return err
+	}
+	// Validate platform
+	if appID.Platform == "" {
+		appID.Platform = fleet.MacOSPlatform
+	}
+	if appID.Platform != fleet.IOSPlatform && appID.Platform != fleet.IPadOSPlatform && appID.Platform != fleet.MacOSPlatform {
+		return fleet.NewInvalidArgumentError("platform",
+			fmt.Sprintf("platform must be one of '%s', '%s', or '%s", fleet.IOSPlatform, fleet.IPadOSPlatform, fleet.MacOSPlatform))
+	}
+
+	var teamName string
+	if teamID != nil && *teamID != 0 {
+		tm, err := svc.ds.Team(ctx, *teamID)
+		if fleet.IsNotFound(err) {
+			return fleet.NewInvalidArgumentError("team_id", fmt.Sprintf("team %d does not exist", *teamID)).
+				WithStatus(http.StatusNotFound)
+		} else if err != nil {
+			return ctxerr.Wrap(ctx, err, "checking if team exists")
+		}
+
+		teamName = tm.Name
+	}
+
+	if appID.SelfService && appID.Platform != fleet.MacOSPlatform {
+		return fleet.NewUserMessageError(errors.New("Currently, self-service only supports macOS"), http.StatusBadRequest)
+	}
+
+	vppToken, err := svc.getVPPToken(ctx, teamID)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "retrieving VPP token")
+	}
+
+	assets, err := vpp.GetAssets(vppToken, &vpp.AssetFilter{AdamID: appID.AdamID})
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "retrieving VPP asset")
+	}
+
+	if len(assets) == 0 {
+		return ctxerr.New(ctx,
+			fmt.Sprintf("Error: Couldn't add software. %s isn't available in Apple Business Manager. Please purchase license in Apple Business Manager and try again.",
+				appID.AdamID))
+	}
+
+	asset := assets[0]
+
+	assetMetadata, err := itunes.GetAssetMetadata([]string{asset.AdamID}, &itunes.AssetMetadataFilter{Entity: "software"})
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "fetching VPP asset metadata")
+	}
+
+	assetMD := assetMetadata[asset.AdamID]
+
+	platforms := getPlatformsFromSupportedDevices(assetMD.SupportedDevices)
+	if _, ok := platforms[appID.Platform]; !ok {
+		return fleet.NewInvalidArgumentError("app_store_id", fmt.Sprintf("%s isn't available for %s", assetMD.TrackName, appID.Platform))
+	}
+
+	if appID.Platform == fleet.MacOSPlatform {
+		// Check if we've already added an installer for this app
+		exists, err := svc.ds.UploadedSoftwareExists(ctx, assetMD.BundleID, teamID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "checking existence of VPP app installer")
+		}
+
+		if exists {
+			return ctxerr.New(ctx,
+				fmt.Sprintf("Error: Couldn't add software. %s already has software available for install on the %s team.",
+					assetMD.TrackName, teamName))
+		}
+	}
+
+	app := &fleet.VPPApp{
+		VPPAppTeam:       appID,
+		BundleIdentifier: assetMD.BundleID,
+		IconURL:          assetMD.ArtworkURL,
+		Name:             assetMD.TrackName,
+		LatestVersion:    assetMD.Version,
+	}
+	if _, err := svc.ds.InsertVPPAppWithTeam(ctx, app, teamID); err != nil {
+		return ctxerr.Wrap(ctx, err, "writing VPP app to db")
+	}
+
+	act := fleet.ActivityAddedAppStoreApp{
+		AppStoreID:    app.AdamID,
+		Platform:      app.Platform,
+		TeamName:      &teamName,
+		SoftwareTitle: app.Name,
+		TeamID:        teamID,
+		SelfService:   app.SelfService,
+	}
+	if err := svc.NewActivity(ctx, authz.UserFromContext(ctx), act); err != nil {
+		return ctxerr.Wrap(ctx, err, "create activity for add app store app")
+	}
+
+	return nil
+}
+
+func getVPPAppsMetadata(ctx context.Context, ids []fleet.VPPAppTeam) ([]*fleet.VPPApp, error) {
+	var apps []*fleet.VPPApp
+
+	// Map of adamID to platform, then to whether it's available as self-service.
+	var adamIDMap = make(map[string]map[fleet.AppleDevicePlatform]bool)
+	for _, id := range ids {
+		if _, ok := adamIDMap[id.AdamID]; !ok {
+			adamIDMap[id.AdamID] = make(map[fleet.AppleDevicePlatform]bool, 1)
+			adamIDMap[id.AdamID][id.Platform] = id.SelfService
+		} else {
+			adamIDMap[id.AdamID][id.Platform] = id.SelfService
+		}
+	}
+
+	var adamIDs []string
+	for adamID := range adamIDMap {
+		adamIDs = append(adamIDs, adamID)
+	}
+	assetMetatada, err := itunes.GetAssetMetadata(adamIDs, &itunes.AssetMetadataFilter{Entity: "software"})
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "fetching VPP asset metadata")
+	}
+
+	for adamID, metadata := range assetMetatada {
+		platforms := getPlatformsFromSupportedDevices(metadata.SupportedDevices)
+		for platform := range platforms {
+			if selfService, ok := adamIDMap[adamID][platform]; ok {
+				app := &fleet.VPPApp{
+					VPPAppTeam: fleet.VPPAppTeam{
+						VPPAppID: fleet.VPPAppID{
+							AdamID:   adamID,
+							Platform: platform,
+						},
+						SelfService: selfService,
+					},
+					BundleIdentifier: metadata.BundleID,
+					IconURL:          metadata.ArtworkURL,
+					Name:             metadata.TrackName,
+					LatestVersion:    metadata.Version,
+				}
+				apps = append(apps, app)
+			} else {
+				continue
+			}
+		}
+	}
+
+	return apps, nil
+}
+
+func (svc *Service) UploadVPPToken(ctx context.Context, token io.ReadSeeker) (*fleet.VPPTokenDB, error) {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleCSR{}, fleet.ActionWrite); err != nil {
+		return nil, err
+	}
+
+	privateKey := svc.config.Server.PrivateKey
+	if testSetEmptyPrivateKey {
+		privateKey = ""
+	}
+
+	if len(privateKey) == 0 {
+		return nil, ctxerr.New(ctx, "Couldn't upload content token. Missing required private key. Learn how to configure the private key here: https://fleetdm.com/learn-more-about/fleet-server-private-key")
+	}
+
+	if token == nil {
+		return nil, ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError("token", "Invalid token. Please provide a valid content token from Apple Business Manager."))
+	}
+
+	tokenBytes, err := io.ReadAll(token)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "reading VPP token")
+	}
+
+	locName, err := vpp.GetConfig(string(tokenBytes))
+	if err != nil {
+		var vppErr *vpp.ErrorResponse
+		if errors.As(err, &vppErr) {
+			// Per https://developer.apple.com/documentation/devicemanagement/app_and_book_management/app_and_book_management_legacy/interpreting_error_codes
+			if vppErr.ErrorNumber == 9622 {
+				return nil, ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError("token", "Invalid token. Please provide a valid content token from Apple Business Manager."))
+			}
+		}
+		return nil, ctxerr.Wrap(ctx, err, "validating VPP token with Apple")
+	}
+
+	data := fleet.VPPTokenData{
+		Token:    string(tokenBytes),
+		Location: locName,
+	}
+
+	tok, err := svc.ds.InsertVPPToken(ctx, &data)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "writing VPP token to db")
+	}
+
+	if err := svc.NewActivity(ctx, authz.UserFromContext(ctx), fleet.ActivityEnabledVPP{
+		Location: locName,
+	}); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "create activity for upload VPP token")
+	}
+
+	return tok, nil
+}
+
+func (svc *Service) UpdateVPPToken(ctx context.Context, tokenID uint, token io.ReadSeeker) (*fleet.VPPTokenDB, error) {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleCSR{}, fleet.ActionWrite); err != nil {
+		return nil, err
+	}
+
+	privateKey := svc.config.Server.PrivateKey
+	if testSetEmptyPrivateKey {
+		privateKey = ""
+	}
+
+	if len(privateKey) == 0 {
+		return nil, ctxerr.New(ctx, "Couldn't upload content token. Missing required private key. Learn how to configure the private key here: https://fleetdm.com/learn-more-about/fleet-server-private-key")
+	}
+
+	if token == nil {
+		return nil, ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError("token", "Invalid token. Please provide a valid content token from Apple Business Manager."))
+	}
+
+	tokenBytes, err := io.ReadAll(token)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "reading VPP token")
+	}
+
+	locName, err := vpp.GetConfig(string(tokenBytes))
+	if err != nil {
+		var vppErr *vpp.ErrorResponse
+		if errors.As(err, &vppErr) {
+			// Per https://developer.apple.com/documentation/devicemanagement/app_and_book_management/app_and_book_management_legacy/interpreting_error_codes
+			if vppErr.ErrorNumber == 9622 {
+				return nil, ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError("token", "Invalid token. Please provide a valid content token from Apple Business Manager."))
+			}
+		}
+		return nil, ctxerr.Wrap(ctx, err, "validating VPP token with Apple")
+	}
+
+	data := fleet.VPPTokenData{
+		Token:    string(tokenBytes),
+		Location: locName,
+	}
+
+	tok, err := svc.ds.UpdateVPPToken(ctx, tokenID, &data)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "updating vpp token")
+	}
+
+	return tok, nil
+}
+
+func (svc *Service) UpdateVPPTokenTeams(ctx context.Context, tokenID uint, teamIDs []uint) (*fleet.VPPTokenDB, error) {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleCSR{}, fleet.ActionWrite); err != nil {
+		return nil, err
+	}
+
+	tok, err := svc.ds.UpdateVPPTokenTeams(ctx, tokenID, teamIDs)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "updating vpp token team")
+	}
+
+	return tok, nil
+}
+
+func (svc *Service) GetVPPTokens(ctx context.Context) ([]*fleet.VPPTokenDB, error) {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleCSR{}, fleet.ActionRead); err != nil {
+		return nil, err
+	}
+
+	return svc.ds.ListVPPTokens(ctx)
+}
+
+func (svc *Service) DeleteVPPToken(ctx context.Context, tokenID uint) error {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleCSR{}, fleet.ActionWrite); err != nil {
+		return err
+	}
+	tok, err := svc.ds.GetVPPToken(ctx, tokenID)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "getting vpp token")
+	}
+	if err := svc.NewActivity(ctx, authz.UserFromContext(ctx), fleet.ActivityDisabledVPP{
+		Location: tok.Location,
+	}); err != nil {
+		return ctxerr.Wrap(ctx, err, "create activity for delete VPP token")
+	}
+
+	return svc.ds.DeleteVPPToken(ctx, tokenID)
+}
diff --git a/ee/server/service/vulnerabilities.go b/ee/server/service/vulnerabilities.go
index 1e5583e13404..c94e14c356aa 100644
--- a/ee/server/service/vulnerabilities.go
+++ b/ee/server/service/vulnerabilities.go
@@ -21,6 +21,7 @@ func (svc *Service) ListVulnerabilities(ctx context.Context, opt fleet.VulnListO
 	return svc.Service.ListVulnerabilities(ctx, opt)
 }
 
-func (svc *Service) Vulnerability(ctx context.Context, cve string, teamID *uint, useCVSScores bool) (*fleet.VulnerabilityWithMetadata, error) {
+func (svc *Service) Vulnerability(ctx context.Context, cve string, teamID *uint, useCVSScores bool) (vuln *fleet.VulnerabilityWithMetadata,
+	known bool, err error) {
 	return svc.Service.Vulnerability(ctx, cve, teamID, true)
 }
diff --git a/ee/vulnerability-dashboard/api/controllers/dashboard/view-welcome.js b/ee/vulnerability-dashboard/api/controllers/dashboard/view-welcome.js
index dc3d56ba7b36..71069df830fe 100644
--- a/ee/vulnerability-dashboard/api/controllers/dashboard/view-welcome.js
+++ b/ee/vulnerability-dashboard/api/controllers/dashboard/view-welcome.js
@@ -369,74 +369,11 @@ module.exports = {
     // console.log(realDataForGraphs);
 
 
-    //  ┌─┐┌─┐┌┬┐  ┌─┐┬─┐┬┌─┐┬─┐┬┌┬┐┬ ┬  ┌─┐┬  ┬┌─┐  ┌─┐┬─┐┌─┐┌─┐┬─┐┌─┐┌─┐┌─┐
-    //  │ ┬├┤  │   ├─┘├┬┘││ │├┬┘│ │ └┬┘  │  └┐┌┘├┤   ├─┘├┬┘│ ││ ┬├┬┘├┤ └─┐└─┐
-    //  └─┘└─┘ ┴   ┴  ┴└─┴└─┘┴└─┴ ┴  ┴   └─┘ └┘ └─┘  ┴  ┴└─└─┘└─┘┴└─└─┘└─┘└─┘
-
-    // Get the JSON array of Priority CVE IDs from the platform record.
-    let platformRecord = await Platform.find({}).limit(1);
-    let priorityVulnerabilities = platformRecord[0].priorityCveIds;
-    let priorityVulnerabilitiesThatExistInTheDatabase = await Vulnerability.find({isPriority: true});
-    let cveIdsThatDontExistInTheDatabase = _.difference(priorityVulnerabilities, _.pluck(priorityVulnerabilitiesThatExistInTheDatabase, 'cveId'));
-    let priorityVulnPatchProgress = [];
-
-    // Get patch progress for priority CVE IDs that only exist in the Platform record.
-    for(let cve of cveIdsThatDontExistInTheDatabase){
-      // Trim whitespace from the CVE ID. https://github.com/fleetdm/fleet/issues/14904
-      let trimmedCveId = _.trim(cve);
-      // Check to see if a Vulnerability record has been created for this CVE ID.
-      let vulnRecordForThisCveExists = await Vulnerability.findOne({cveId: trimmedCveId, isPriority: false});
-      if(vulnRecordForThisCveExists){// If we found a Vulnerability record that matches a CVE ID, we'll update it to have `isPriority: true`.
-        let updatedVulnRecord = await Vulnerability.updateOne({id: vulnRecordForThisCveExists.id}).set({isPriority: true});
-        priorityVulnerabilitiesThatExistInTheDatabase.push(updatedVulnRecord);
-      } else {// Otherwise, we'll add 100% patch progress for this CVE.
-        let patchProgress = {
-          cveId: trimmedCveId,
-          patchProgressPercentage: 100,
-          additionalDetailsUrl: 'https://nvd.nist.gov/vuln/detail/'+ encodeURIComponent(cve),
-        };
-        priorityVulnPatchProgress.push(patchProgress);
-      }
-    }
-
-    // Get patch progress for CVEs we have records for.
-    for(let vuln of priorityVulnerabilitiesThatExistInTheDatabase) {
-      let vulnPatchProgress = _.clone(vuln);
-      vulnPatchProgress.affectedSoftware = [];
-      // Calculate how many host have been affected by this vulnerability, and how many hosts are currently affected by this vulnerability
-      let installsForThisVulnerability = await VulnerabilityInstall.find({vulnerability: vuln.id});
-      // This number will represent the number of hosts that are currently affected by the vulnerability
-      let uniqueAffectedHosts = _.uniq(_.pluck(installsForThisVulnerability, 'host'));
-
-      let resolvedInstallsForThisVuln = [];
-      let affectedSoftwareForThisVulnerability = [];
-      vulnPatchProgress.numberOfHostsAffected = uniqueAffectedHosts.length;
-      for(let install of installsForThisVulnerability) {
-        // If the install has a non-zero uninstalledAt value, then it has been uninstalled.
-        if(install.uninstalledAt !== 0) {
-          // If this is a resolved install, we'll check the other installs for this vulnerability to see if there is an unresolved VulnerabilityInstall for this host.
-          if(!_.find(installsForThisVulnerability, {host: install.host, uninstalledAt: 0})){
-            // If an unresolved vulnerabilityInstall record affecting this host is found, we won't count this vulnerability as resolved for this host.
-            resolvedInstallsForThisVuln.push(install);
-          }
-        }
-        affectedSoftwareForThisVulnerability.push({name: install.softwareName, version: install.versionName, url: sails.config.custom.fleetBaseUrl+'/software/'+install.fleetApid });
-      }//∞
-
-      // Get the number of unique hosts who were previosuly affected by this vulnerability.
-      let uniqNumberOfResolvedInstallsForThisVuln = _.uniq(resolvedInstallsForThisVuln, 'host').length;
-      vulnPatchProgress.affectedSoftware = _.uniq(affectedSoftwareForThisVulnerability, 'url');
-      // To calculate the patch progress, we'll use the number of unique hosts who were previously affected by this vulnerability as the numerator and the number of unique hosts affected by the vulnerability as the denominator.
-      vulnPatchProgress.patchProgressPercentage = Math.floor((uniqNumberOfResolvedInstallsForThisVuln / vulnPatchProgress.numberOfHostsAffected) * 100);
-      priorityVulnPatchProgress.push(vulnPatchProgress);
-    }//∞
 
-    // Sort the priority vulnerabilities by CVE ID.
-    priorityVulnPatchProgress = _.sortBy(priorityVulnPatchProgress, 'cveId');
 
     return {
       realDataForGraphs: {
-        priorityVulnPatchProgress,
+        priorityVulnPatchProgress: [],// This information is gathered after the initial page load.
         remediationTimeline: realDataForGraphs.remediationTimeline,
         timelineDatasets: realDataForGraphs.timelineDatasets,
         newPublishedVulnerabilities:realDataForGraphs.newPublishedVulnerabilities,//last 48 hours
diff --git a/ee/vulnerability-dashboard/api/controllers/get-priority-vulnerabilities.js b/ee/vulnerability-dashboard/api/controllers/get-priority-vulnerabilities.js
new file mode 100644
index 000000000000..9f55ec19c8d7
--- /dev/null
+++ b/ee/vulnerability-dashboard/api/controllers/get-priority-vulnerabilities.js
@@ -0,0 +1,80 @@
+module.exports = {
+
+
+  friendlyName: 'Get priority vulnerabilities',
+
+
+  description: 'Returns information about priority CVEs.',
+  extendedDescription: 'This code was previously in the view action for the dashboard page, but was moved to a separate action to reduce inital page laoding time.',
+
+  exits: {
+    success: {
+      outputType: [{}],
+    },
+  },
+
+
+  fn: async function () {
+    //  ┌─┐┌─┐┌┬┐  ┌─┐┬─┐┬┌─┐┬─┐┬┌┬┐┬ ┬  ┌─┐┬  ┬┌─┐  ┌─┐┬─┐┌─┐┌─┐┬─┐┌─┐┌─┐┌─┐
+    //  │ ┬├┤  │   ├─┘├┬┘││ │├┬┘│ │ └┬┘  │  └┐┌┘├┤   ├─┘├┬┘│ ││ ┬├┬┘├┤ └─┐└─┐
+    //  └─┘└─┘ ┴   ┴  ┴└─┴└─┘┴└─┴ ┴  ┴   └─┘ └┘ └─┘  ┴  ┴└─└─┘└─┘┴└─└─┘└─┘└─┘
+
+    // Get the JSON array of Priority CVE IDs from the platform record.
+    let platformRecord = await Platform.find({}).limit(1);
+    let priorityVulnerabilities = platformRecord[0].priorityCveIds;
+    let priorityVulnerabilitiesThatExistInTheDatabase = await Vulnerability.find({isPriority: true});
+    let cveIdsThatDontExistInTheDatabase = _.difference(priorityVulnerabilities, _.pluck(priorityVulnerabilitiesThatExistInTheDatabase, 'cveId'));
+    let priorityVulnPatchProgress = [];
+
+    // Get patch progress for priority CVE IDs that only exist in the Platform record.
+    for(let cve of cveIdsThatDontExistInTheDatabase){
+      // Trim whitespace from the CVE ID. https://github.com/fleetdm/fleet/issues/14904
+      let trimmedCveId = _.trim(cve);
+      // Check to see if a Vulnerability record has been created for this CVE ID.
+      let vulnRecordForThisCveExists = await Vulnerability.findOne({cveId: trimmedCveId, isPriority: false});
+      if(vulnRecordForThisCveExists){// If we found a Vulnerability record that matches a CVE ID, we'll update it to have `isPriority: true`.
+        let updatedVulnRecord = await Vulnerability.updateOne({id: vulnRecordForThisCveExists.id}).set({isPriority: true});
+        priorityVulnerabilitiesThatExistInTheDatabase.push(updatedVulnRecord);
+      } else {// Otherwise, we'll add 100% patch progress for this CVE.
+        let patchProgress = {
+          cveId: trimmedCveId,
+          patchProgressPercentage: 100,
+          additionalDetailsUrl: 'https://nvd.nist.gov/vuln/detail/'+ encodeURIComponent(cve),
+        };
+        priorityVulnPatchProgress.push(patchProgress);
+      }
+    }
+
+    // Get patch progress for CVEs we have records for.
+    for(let vuln of priorityVulnerabilitiesThatExistInTheDatabase) {
+      let vulnPatchProgress = _.clone(vuln);
+      vulnPatchProgress.affectedSoftware = [];
+      // Calculate how many host have been affected by this vulnerability, and how many hosts are currently affected by this vulnerability
+      let installsForThisVulnerability = await VulnerabilityInstall.find({vulnerability: vuln.id});
+      // This number will represent the number of hosts that have been affected by the vulnerability.
+      let uniqueAffectedHosts = _.uniq(_.pluck(installsForThisVulnerability, 'host'));
+      // Get a list of software that is currently installed and affected by this vulnerability.
+      let unresolvedInstallsForThisVuln = _.filter(installsForThisVulnerability, {uninstalledAt: 0});
+      let unresolvedHosts = _.uniq(_.pluck(unresolvedInstallsForThisVuln, 'host'));
+      let resolvedHosts = _.difference(uniqueAffectedHosts, unresolvedHosts);
+      let uniqNumberOfResolvedInstallsForThisVuln = resolvedHosts.length;
+      // Iterate through the installs for this vulnerability to build a list of software
+      await sails.helpers.flow.simultaneouslyForEach(_.uniq(installsForThisVulnerability, 'fleetApid'), (install)=>{
+        vulnPatchProgress.affectedSoftware.push({name: install.softwareName, version: install.versionName, url: sails.config.custom.fleetBaseUrl+'/software/'+install.fleetApid });
+      });
+      // Get the number of unique hosts who were previosuly affected by this vulnerability.
+      vulnPatchProgress.numberOfHostsAffected = uniqueAffectedHosts.length;
+      // To calculate the patch progress, we'll use the number of unique hosts who were previously affected by this vulnerability as the numerator and the number of unique hosts affected by the vulnerability as the denominator.
+      vulnPatchProgress.patchProgressPercentage = Math.floor((uniqNumberOfResolvedInstallsForThisVuln / vulnPatchProgress.numberOfHostsAffected) * 100);
+      priorityVulnPatchProgress.push(vulnPatchProgress);
+    }//∞
+
+    // Sort the priority vulnerabilities by CVE ID.
+    priorityVulnPatchProgress = _.sortBy(priorityVulnPatchProgress, 'cveId');
+
+    return priorityVulnPatchProgress;
+
+  }
+
+
+};
diff --git a/ee/vulnerability-dashboard/api/controllers/update-priority-vulnerabilities.js b/ee/vulnerability-dashboard/api/controllers/update-priority-vulnerabilities.js
index 6e10db81c5c3..92de07fc259c 100644
--- a/ee/vulnerability-dashboard/api/controllers/update-priority-vulnerabilities.js
+++ b/ee/vulnerability-dashboard/api/controllers/update-priority-vulnerabilities.js
@@ -88,25 +88,17 @@ module.exports = {
       let installsForThisVulnerability = await VulnerabilityInstall.find({vulnerability: vuln.id});
       // This number will represent the number of hosts that are currently affected by the vulnerability
       let uniqueAffectedHosts = _.uniq(_.pluck(installsForThisVulnerability, 'host'));
-
-      let resolvedInstallsForThisVuln = [];
-      let affectedSoftwareForThisVulnerability = [];
-      vulnPatchProgress.numberOfHostsAffected = uniqueAffectedHosts.length;
-      for(let install of installsForThisVulnerability) {
-        // If the install has a non-zero uninstalledAt value, then it has been uninstalled.
-        if(install.uninstalledAt !== 0) {
-          // If this is a resolved install, we'll check the other installs for this vulnerability to see if there is an unresolved VulnerabilityInstall for this host.
-          if(!_.find(installsForThisVulnerability, {host: install.host, uninstalledAt: 0})){
-            // If an unresolved vulnerabilityInstall record affecting this host is found, we won't count this vulnerability as resolved for this host.
-            resolvedInstallsForThisVuln.push(install);
-          }
-        }
-        affectedSoftwareForThisVulnerability.push({name: install.softwareName, version: install.versionName, url: sails.config.custom.fleetBaseUrl+'/software/'+install.fleetApid });
-      }//∞
-
+      // Get a list of software that is currently installed and affected by this vulnerability.
+      let unresolvedInstallsForThisVuln = _.filter(installsForThisVulnerability, {uninstalledAt: 0});
+      let unresolvedHosts = _.uniq(_.pluck(unresolvedInstallsForThisVuln, 'host'));
+      let resolvedHosts = _.difference(uniqueAffectedHosts, unresolvedHosts);
+      let uniqNumberOfResolvedInstallsForThisVuln = resolvedHosts.length;
+      // Iterate through the installs for this vulnerability to build a list of software
+      await sails.helpers.flow.simultaneouslyForEach(_.uniq(installsForThisVulnerability, 'fleetApid'), (install)=>{
+        vulnPatchProgress.affectedSoftware.push({name: install.softwareName, version: install.versionName, url: sails.config.custom.fleetBaseUrl+'/software/'+install.fleetApid });
+      });
       // Get the number of unique hosts who were previosuly affected by this vulnerability.
-      let uniqNumberOfResolvedInstallsForThisVuln = _.uniq(resolvedInstallsForThisVuln, 'host').length;
-      vulnPatchProgress.affectedSoftware = _.uniq(affectedSoftwareForThisVulnerability, 'url');
+      vulnPatchProgress.numberOfHostsAffected = uniqueAffectedHosts.length;
       // To calculate the patch progress, we'll use the number of unique hosts who were previously affected by this vulnerability as the numerator and the number of unique hosts affected by the vulnerability as the denominator.
       vulnPatchProgress.patchProgressPercentage = Math.floor((uniqNumberOfResolvedInstallsForThisVuln / vulnPatchProgress.numberOfHostsAffected) * 100);
       priorityVulnPatchProgress.push(vulnPatchProgress);
diff --git a/ee/vulnerability-dashboard/assets/js/cloud.setup.js b/ee/vulnerability-dashboard/assets/js/cloud.setup.js
index e230bec29606..b4d0951c46b8 100644
--- a/ee/vulnerability-dashboard/assets/js/cloud.setup.js
+++ b/ee/vulnerability-dashboard/assets/js/cloud.setup.js
@@ -13,7 +13,7 @@
 Cloud.setup({
 
   /* eslint-disable */
-  methods: {"logout":{"verb":"GET","url":"/api/v1/account/logout","args":[]},"updatePassword":{"verb":"PUT","url":"/api/v1/account/update-password","args":["password"]},"updateProfile":{"verb":"PUT","url":"/api/v1/account/update-profile","args":["fullName","emailAddress"]},"login":{"verb":"PUT","url":"/api/v1/entrance/login","args":["emailAddress","password","rememberMe"]},"sendPasswordRecoveryEmail":{"verb":"POST","url":"/api/v1/entrance/send-password-recovery-email","args":["emailAddress"]},"updatePasswordAndLogin":{"verb":"POST","url":"/api/v1/entrance/update-password-and-login","args":["password","token"]},"signupOktaUserOrRedirect":{"verb":"GET","url":"/entrance/signup-okta-user-or-redirect","args":[]},"getVulnerabilities":{"verb":"GET","url":"/api/v1/get-vulnerabilities","args":["minSeverity","maxSeverity","sortBy","sortDirection","page","teamApid"],"protocol":"io.socket"},"getRemediationTimeline":{"verb":"GET","url":"/api/v1/get-remediation-timeline","args":["vulnerabilityId","teamApid"],"protocol":"io.socket"},"downloadVulnerabilitiesCsv":{"verb":"GET","url":"/download-vulnerabilities-csv","args":["minSeverity","maxSeverity","sortBy","sortDirection","page","teamApid","pageSize","exportType"]},"downloadOneVulnerabilityCsv":{"verb":"GET","url":"/download-one-vulnerability-csv","args":["cveId","teamApid"]},"setCompliantVersions":{"verb":"POST","url":"/api/v1/set-compliant-versions","args":["complianceType","compliantVersions"]},"updatePriorityVulnerabilities":{"verb":"GET","url":"/api/v1/update-priority-vulnerabilities","args":["newPriorityCveIds"]},"getPatchProgressForASingleTeam":{"verb":"GET","url":"/api/v1/get-patch-progress-for-a-single-team","args":["teamApid"]},"downloadUnpatchedHostsCsv":{"verb":"GET","url":"/download-unpatched-hosts-csv","args":["exportType","teamApid"]}}
+  methods: {"logout":{"verb":"GET","url":"/api/v1/account/logout","args":[]},"updatePassword":{"verb":"PUT","url":"/api/v1/account/update-password","args":["password"]},"updateProfile":{"verb":"PUT","url":"/api/v1/account/update-profile","args":["fullName","emailAddress"]},"login":{"verb":"PUT","url":"/api/v1/entrance/login","args":["emailAddress","password","rememberMe"]},"sendPasswordRecoveryEmail":{"verb":"POST","url":"/api/v1/entrance/send-password-recovery-email","args":["emailAddress"]},"updatePasswordAndLogin":{"verb":"POST","url":"/api/v1/entrance/update-password-and-login","args":["password","token"]},"signupOktaUserOrRedirect":{"verb":"GET","url":"/entrance/signup-okta-user-or-redirect","args":[]},"getPriorityVulnerabilities":{"verb":"GET","url":"/api/v1/get-priority-vulnerabilities","args":[]},"getVulnerabilities":{"verb":"GET","url":"/api/v1/get-vulnerabilities","args":["minSeverity","maxSeverity","sortBy","sortDirection","page","teamApid"],"protocol":"io.socket"},"getRemediationTimeline":{"verb":"GET","url":"/api/v1/get-remediation-timeline","args":["vulnerabilityId","teamApid"],"protocol":"io.socket"},"downloadVulnerabilitiesCsv":{"verb":"GET","url":"/download-vulnerabilities-csv","args":["minSeverity","maxSeverity","sortBy","sortDirection","page","teamApid","pageSize","exportType"]},"downloadOneVulnerabilityCsv":{"verb":"GET","url":"/download-one-vulnerability-csv","args":["cveId","teamApid"]},"setCompliantVersions":{"verb":"POST","url":"/api/v1/set-compliant-versions","args":["complianceType","compliantVersions"]},"updatePriorityVulnerabilities":{"verb":"GET","url":"/api/v1/update-priority-vulnerabilities","args":["newPriorityCveIds"]},"getPatchProgressForASingleTeam":{"verb":"GET","url":"/api/v1/get-patch-progress-for-a-single-team","args":["teamApid"]},"downloadUnpatchedHostsCsv":{"verb":"GET","url":"/download-unpatched-hosts-csv","args":["exportType","teamApid"]}}
   /* eslint-enable */
 
 });
diff --git a/ee/vulnerability-dashboard/assets/js/pages/dashboard/welcome.page.js b/ee/vulnerability-dashboard/assets/js/pages/dashboard/welcome.page.js
index d5b62c3dafff..5f991bd440be 100644
--- a/ee/vulnerability-dashboard/assets/js/pages/dashboard/welcome.page.js
+++ b/ee/vulnerability-dashboard/assets/js/pages/dashboard/welcome.page.js
@@ -48,6 +48,7 @@ parasails.registerPage('welcome', {
       }]
     };
     await this.drawGraphsOnPage();
+    await this.getPriorityCves();
   },
 
   //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
@@ -56,7 +57,6 @@ parasails.registerPage('welcome', {
   methods: {
     clickOpenEditModal: function () {
       this.formData.priorityCves = _.pluck(this.dataForGraphs.priorityVulnPatchProgress, 'cveId');
-      console.log(this.formData);
       this.modal = 'priority-cves';
     },
     handleSubmittingPriorityCveForm: async function(argins) {
@@ -79,6 +79,12 @@ parasails.registerPage('welcome', {
       this.syncing = false;
       this.modal = '';
     },
+    getPriorityCves: async function () {
+      this.syncing = true;
+      let priorityCveProgress = await Cloud.getPriorityVulnerabilities();
+      this.dataForGraphs.priorityVulnPatchProgress = priorityCveProgress;
+      this.syncing = false;
+    },
     drawGraphsOnPage: async function(){
       new Chart('average-remediation-time', {
         type: 'line',
diff --git a/ee/vulnerability-dashboard/assets/styles/pages/dashboard/welcome.less b/ee/vulnerability-dashboard/assets/styles/pages/dashboard/welcome.less
index dcd7ced24e99..4611ac980d15 100644
--- a/ee/vulnerability-dashboard/assets/styles/pages/dashboard/welcome.less
+++ b/ee/vulnerability-dashboard/assets/styles/pages/dashboard/welcome.less
@@ -100,6 +100,9 @@
       text-align: center;
     }
   }
+  [purpose='loading-indicator'] {
+    .loader(@brand);
+  }
   [purpose='vuln-patch-progress-bar'] {
     width: 300px;
     height: 16px;
diff --git a/ee/vulnerability-dashboard/config/routes.js b/ee/vulnerability-dashboard/config/routes.js
index 1960f3352dd1..cf026e4db32c 100644
--- a/ee/vulnerability-dashboard/config/routes.js
+++ b/ee/vulnerability-dashboard/config/routes.js
@@ -67,7 +67,7 @@ module.exports.routes = {
   'GET  /entrance/signup-okta-user-or-redirect':    { action: 'entrance/signup-okta-user-or-redirect' },
   // 'POST  /api/v1/deliver-contact-form-message':          { action: 'deliver-contact-form-message' },
   // 'POST  /api/v1/observe-my-session':                 { action: 'observe-my-session', hasSocketFeatures: true },
-
+  'GET /api/v1/get-priority-vulnerabilities': { action: 'get-priority-vulnerabilities' },
   'GET   /api/v1/get-vulnerabilities':                { action: 'get-vulnerabilities', hasSocketFeatures: true },
   'GET   /api/v1/get-remediation-timeline':           { action: 'get-remediation-timeline', hasSocketFeatures: true  },
   'GET /download-vulnerabilities-csv':                { action: 'download-vulnerabilities-csv'},
diff --git a/ee/vulnerability-dashboard/views/pages/dashboard/welcome.ejs b/ee/vulnerability-dashboard/views/pages/dashboard/welcome.ejs
index bdc36573baa0..f4fe23c906a1 100644
--- a/ee/vulnerability-dashboard/views/pages/dashboard/welcome.ejs
+++ b/ee/vulnerability-dashboard/views/pages/dashboard/welcome.ejs
@@ -6,14 +6,25 @@
           <p style="font-size: 14px; margin-bottom: 0px; font-wieght: 700;">
             Priority CVEs
           </p>
-          <a purpose="edit-button" @click="clickOpenEditModal">
+          <a purpose="edit-button" @click="clickOpenEditModal" v-if="!syncing">
             <img alt="a small pencil" src="/images/pencil-14x14@2x.png">Edit
           </a>
         </div>
-          <div class="d-flex flex-column align-items-center w-100" v-if="dataForGraphs.priorityVulnPatchProgress.length === 0">
+          <div class="d-flex flex-column align-items-center w-100" v-if="dataForGraphs.priorityVulnPatchProgress.length === 0 && !syncing">
             <p class="font-weight-bold mb-1">No priority CVEs</p>
             <p class="text-muted mb-0">Configure a list <a @click="clickOpenEditModal">here</a> to track your organization's progress patching particular vulnerabilities.</p>
           </div>
+          <div class="d-flex flex-column align-items-center w-100" v-else-if="syncing">
+            <p class="font-weight-bold mb-1">Loading priority CVE progress</p>
+            <p>
+              <span purpose="loading-indicator">
+                <span class="loading-dot dot1"></span>
+                <span class="loading-dot dot2"></span>
+                <span class="loading-dot dot3"></span>
+                <span class="loading-dot dot4"></span>
+              </span>
+            </p>
+          </div>
           <div v-else>
             <p class="">This is the list of particular CVEs your organization is currently working to patch.</p>
             <table purpose="priority-cve-table" class="table table-responsive-md my-0">
diff --git a/frontend/__mocks__/appleMdm.ts b/frontend/__mocks__/appleMdm.ts
index 1ed7964056dd..c58a96f891ac 100644
--- a/frontend/__mocks__/appleMdm.ts
+++ b/frontend/__mocks__/appleMdm.ts
@@ -1,4 +1,5 @@
 import { IMdmApple } from "interfaces/mdm";
+import { IGetVppInfoResponse, IVppApp } from "services/entities/mdm_apple";
 
 const DEFAULT_MDM_APPLE_MOCK: IMdmApple = {
   common_name: "APSP:12345",
@@ -13,4 +14,30 @@ export const createMockMdmApple = (
   return { ...DEFAULT_MDM_APPLE_MOCK, ...overrides };
 };
 
+const DEFAULT_MDM_APPLE_VPP_INFO_MOCK: IGetVppInfoResponse = {
+  org_name: "test org",
+  renew_date: "2024-09-19T00:00:00Z",
+  location: "test location",
+};
+
+export const createMockVppInfo = (
+  overrides?: Partial<IGetVppInfoResponse>
+): IGetVppInfoResponse => {
+  return { ...DEFAULT_MDM_APPLE_VPP_INFO_MOCK, ...overrides };
+};
+
+const DEFAULT_MDM_APPLE_VPP_APP_MOCK: IVppApp = {
+  name: "Test App",
+  bundle_identifier: "com.test.app",
+  icon_url: "https://via.placeholder.com/512",
+  latest_version: "1.0",
+  app_store_id: "1",
+  added: false,
+  platform: "darwin",
+};
+
+export const createMockVppApp = (overrides?: Partial<IVppApp>): IVppApp => {
+  return { ...DEFAULT_MDM_APPLE_VPP_APP_MOCK, ...overrides };
+};
+
 export default createMockMdmApple;
diff --git a/frontend/__mocks__/configMock.ts b/frontend/__mocks__/configMock.ts
index f15c09ce2bb7..bcaaffb9ee42 100644
--- a/frontend/__mocks__/configMock.ts
+++ b/frontend/__mocks__/configMock.ts
@@ -1,4 +1,57 @@
-import { IConfig } from "interfaces/config";
+import { IConfig, IMdmConfig } from "interfaces/config";
+
+const DEFAULT_CONFIG_MDM_MOCK: IMdmConfig = {
+  enable_disk_encryption: false,
+  windows_enabled_and_configured: true,
+  apple_bm_default_team: "Apples",
+  apple_bm_enabled_and_configured: true,
+  apple_bm_terms_expired: false,
+  enabled_and_configured: true,
+  macos_updates: {
+    minimum_version: "",
+    deadline: "",
+  },
+  ios_updates: {
+    minimum_version: "",
+    deadline: "",
+  },
+  ipados_updates: {
+    minimum_version: "",
+    deadline: "",
+  },
+  macos_settings: {
+    custom_settings: null,
+    enable_disk_encryption: false,
+  },
+  macos_setup: {
+    bootstrap_package: "",
+    enable_end_user_authentication: false,
+    macos_setup_assistant: null,
+    enable_release_device_manually: false,
+  },
+  macos_migration: {
+    enable: false,
+    mode: "",
+    webhook_url: "",
+  },
+  windows_updates: {
+    deadline_days: null,
+    grace_period_days: null,
+  },
+  end_user_authentication: {
+    entity_id: "",
+    issuer_uri: "",
+    metadata: "",
+    metadata_url: "",
+    idp_name: "",
+  },
+};
+
+export const createMockMdmConfig = (
+  overrides?: Partial<IMdmConfig>
+): IMdmConfig => {
+  return { ...DEFAULT_CONFIG_MDM_MOCK, ...overrides };
+};
 
 const DEFAULT_CONFIG_MOCK: IConfig = {
   org_info: {
@@ -136,44 +189,7 @@ const DEFAULT_CONFIG_MOCK: IConfig = {
     enable_software_inventory: true,
   },
   fleet_desktop: { transparency_url: "https://fleetdm.com/transparency" },
-  mdm: {
-    enable_disk_encryption: false,
-    windows_enabled_and_configured: true,
-    apple_bm_default_team: "Apples",
-    apple_bm_enabled_and_configured: true,
-    apple_bm_terms_expired: false,
-    enabled_and_configured: true,
-    macos_updates: {
-      minimum_version: "",
-      deadline: "",
-    },
-    macos_settings: {
-      custom_settings: null,
-      enable_disk_encryption: false,
-    },
-    macos_setup: {
-      bootstrap_package: "",
-      enable_end_user_authentication: false,
-      macos_setup_assistant: null,
-      enable_release_device_manually: false,
-    },
-    macos_migration: {
-      enable: false,
-      mode: "",
-      webhook_url: "",
-    },
-    windows_updates: {
-      deadline_days: null,
-      grace_period_days: null,
-    },
-    end_user_authentication: {
-      entity_id: "",
-      issuer_uri: "",
-      metadata: "",
-      metadata_url: "",
-      idp_name: "",
-    },
-  },
+  mdm: createMockMdmConfig(),
 };
 
 const createMockConfig = (overrides?: Partial<IConfig>): IConfig => {
diff --git a/frontend/__mocks__/deviceUserMock.ts b/frontend/__mocks__/deviceUserMock.ts
index 38017864fd7d..fe5c2344cb39 100644
--- a/frontend/__mocks__/deviceUserMock.ts
+++ b/frontend/__mocks__/deviceUserMock.ts
@@ -1,6 +1,7 @@
 import { IDeviceUser } from "interfaces/host";
 import { IDeviceSoftware } from "interfaces/software";
 import { IGetDeviceSoftwareResponse } from "services/entities/device_user";
+import { createMockHostSoftwarePackage } from "./hostMock";
 
 const DEFAULT_DEVICE_USER_MOCK: IDeviceUser = {
   email: "test@test.com",
@@ -16,16 +17,12 @@ const createMockDeviceUser = (
 const DEFAULT_DEVICE_SOFTWARE_MOCK: IDeviceSoftware = {
   id: 1,
   name: "mock software 1.app",
-  self_service: false,
   source: "apps",
   bundle_identifier: "com.app.mock",
   status: null,
-  last_install: null,
   installed_versions: null,
-  package: {
-    name: "mock software 1",
-    version: "1.0.0",
-  },
+  software_package: createMockHostSoftwarePackage(),
+  app_store_app: null,
 };
 
 export const createMockDeviceSoftware = (
diff --git a/frontend/__mocks__/hostMock.ts b/frontend/__mocks__/hostMock.ts
index 4c67aebe8f7a..f6d8b6342e82 100644
--- a/frontend/__mocks__/hostMock.ts
+++ b/frontend/__mocks__/hostMock.ts
@@ -5,7 +5,11 @@ import { pick } from "lodash";
 import { normalizeEmptyValues } from "utilities/helpers";
 import { HOST_SUMMARY_DATA } from "utilities/constants";
 import { IGetHostSoftwareResponse } from "services/entities/hosts";
-import { IHostSoftware } from "interfaces/software";
+import {
+  IHostAppStoreApp,
+  IHostSoftware,
+  IHostSoftwarePackage,
+} from "interfaces/software";
 
 const DEFAULT_HOST_PROFILE_MOCK: IHostMdmProfile = {
   profile_uuid: "123-abc",
@@ -136,18 +140,45 @@ export const createMockHostSummary = (overrides?: Partial<IHost>) => {
   );
 };
 
-const DEFAULT_HOST_SOFTWARE_MOCK: IHostSoftware = {
-  id: 1,
+const DEFAULT_HOST_SOFTWARE_PACKAGE_MOCK: IHostSoftwarePackage = {
   name: "mock software.app",
-  package_available_for_install: "mockSoftware.app",
+  version: "1.0.0",
   self_service: false,
-  source: "apps",
-  bundle_identifier: "com.test.mock",
-  status: "installed",
+  icon_url: "https://example.com/icon.png",
   last_install: {
     install_uuid: "123-abc",
     installed_at: "2022-01-01T12:00:00Z",
   },
+};
+
+export const createMockHostSoftwarePackage = (
+  overrides?: Partial<IHostSoftwarePackage>
+): IHostSoftwarePackage => {
+  return { ...DEFAULT_HOST_SOFTWARE_PACKAGE_MOCK, ...overrides };
+};
+
+const DEFAULT_HOST_APP_STORE_APP_MOCK: IHostAppStoreApp = {
+  app_store_id: "123456789",
+  version: "1.0.0",
+  self_service: false,
+  icon_url: "https://via.placeholder.com/512",
+  last_install: null,
+};
+
+export const createMockHostAppStoreApp = (
+  overrides?: Partial<IHostAppStoreApp>
+): IHostAppStoreApp => {
+  return { ...DEFAULT_HOST_APP_STORE_APP_MOCK, ...overrides };
+};
+
+const DEFAULT_HOST_SOFTWARE_MOCK: IHostSoftware = {
+  id: 1,
+  name: "mock software.app",
+  software_package: createMockHostSoftwarePackage(),
+  app_store_app: null,
+  source: "apps",
+  bundle_identifier: "com.test.mock",
+  status: "installed",
   installed_versions: [
     {
       version: "1.0.0",
diff --git a/frontend/__mocks__/policyMock.ts b/frontend/__mocks__/policyMock.ts
index b14095463ec6..ba60c55c74db 100644
--- a/frontend/__mocks__/policyMock.ts
+++ b/frontend/__mocks__/policyMock.ts
@@ -23,6 +23,10 @@ const DEFAULT_POLICY_MOCK: IPolicyStats = {
   has_run: true,
   next_update_ms: 3600000,
   calendar_events_enabled: true,
+  install_software: {
+    name: "testSw0",
+    software_title_id: 1,
+  },
 };
 
 const createMockPolicy = (overrides?: Partial<IPolicyStats>): IPolicyStats => {
diff --git a/frontend/__mocks__/softwareMock.ts b/frontend/__mocks__/softwareMock.ts
index eb1f67f638ca..9ef0b14e9a0e 100644
--- a/frontend/__mocks__/softwareMock.ts
+++ b/frontend/__mocks__/softwareMock.ts
@@ -1,11 +1,12 @@
 import {
   ISoftware,
   ISoftwareVersion,
-  ISoftwareTitleWithPackageDetail,
-  ISoftwareTitleWithPackageName,
   ISoftwareVulnerability,
   ISoftwareTitleVersion,
   ISoftwarePackage,
+  ISoftwareTitle,
+  ISoftwareTitleDetails,
+  IAppStoreApp,
 } from "interfaces/software";
 import {
   ISoftwareTitlesResponse,
@@ -13,6 +14,8 @@ import {
   ISoftwareVersionsResponse,
   ISoftwareVersionResponse,
 } from "services/entities/software";
+import { IOSVersionsResponse } from "../services/entities/operating_systems";
+import { IOperatingSystemVersion } from "../interfaces/operating_system";
 
 const DEFAULT_SOFTWARE_MOCK: ISoftware = {
   hosts_count: 1,
@@ -44,53 +47,6 @@ export const createMockSoftwareTitleVersion = (
   return { ...DEFAULT_SOFTWARE_TITLE_VERSION_MOCK, ...overrides };
 };
 
-type MockSoftwareTitle =
-  | Partial<ISoftwareTitleWithPackageDetail>
-  | Partial<ISoftwareTitleWithPackageName>;
-
-const DEFAULT_SOFTWARE_TITLE_MOCK = {
-  id: 1,
-  name: "mock software 1.app",
-  software_package: null,
-  versions_count: 1,
-  source: "apps",
-  hosts_count: 1,
-  browser: "chrome",
-  versions: [createMockSoftwareTitleVersion()],
-};
-
-export const createMockSoftwareTitle = <
-  T extends
-    | Partial<ISoftwareTitleWithPackageDetail>
-    | Partial<ISoftwareTitleWithPackageName>
->(
-  overrides: T
-) => {
-  const mock = {
-    ...DEFAULT_SOFTWARE_TITLE_MOCK,
-    ...overrides,
-  };
-  return mock;
-};
-
-const DEFAULT_SOFTWARE_TITLES_RESPONSE_MOCK: ISoftwareTitlesResponse = {
-  counts_updated_at: "2020-01-01T00:00:00.000Z",
-  count: 1,
-  software_titles: [
-    createMockSoftwareTitle({ software_package: null, self_service: false }),
-  ],
-  meta: {
-    has_next_results: false,
-    has_previous_results: false,
-  },
-};
-
-export const createMockSoftwareTitlesReponse = (
-  overrides?: Partial<ISoftwareTitlesResponse>
-): ISoftwareTitlesResponse => {
-  return { ...DEFAULT_SOFTWARE_TITLES_RESPONSE_MOCK, ...overrides };
-};
-
 const DEFAULT_SOFTWARE_VULNERABILITY_MOCK = {
   cve: "CVE-2020-0001",
   details_link: "https://test.com",
@@ -139,23 +95,91 @@ const DEFAULT_SOFTWARE_VERSIONS_RESPONSE_MOCK: ISoftwareVersionsResponse = {
   },
 };
 
-export const createMockSoftwareVersionsReponse = (
+export const createMockSoftwareVersionsResponse = (
   overrides?: Partial<ISoftwareVersionsResponse>
 ): ISoftwareVersionsResponse => {
   return { ...DEFAULT_SOFTWARE_VERSIONS_RESPONSE_MOCK, ...overrides };
 };
 
-const DEFAULT_SOFTWARE_TITLE_RESPONSE = {
-  software_title: createMockSoftwareTitle({
-    software_package: null,
-  } as Partial<ISoftwareTitleWithPackageDetail>),
+const DEFAULT_OS_VERSION_MOCK = {
+  os_version_id: 1,
+  name: "macOS 14.6.1",
+  name_only: "macOS",
+  version: "14.6.1",
+  platform: "darwin",
+  hosts_count: 42,
+  generated_cpes: [],
+  vulnerabilities: [],
+};
+
+export const createMockOSVersion = (
+  overrides?: Partial<IOperatingSystemVersion>
+): IOperatingSystemVersion => {
+  return {
+    ...DEFAULT_OS_VERSION_MOCK,
+    ...overrides,
+  };
+};
+
+const DEFAULT_OS_VERSIONS_RESPONSE_MOCK: IOSVersionsResponse = {
+  counts_updated_at: "2020-01-01T00:00:00.000Z",
+  count: 1,
+  os_versions: [createMockOSVersion()],
+  meta: {
+    has_next_results: false,
+    has_previous_results: false,
+  },
+};
+
+export const createMockOSVersionsResponse = (
+  overrides?: Partial<IOSVersionsResponse>
+): IOSVersionsResponse => {
+  return { ...DEFAULT_OS_VERSIONS_RESPONSE_MOCK, ...overrides };
+};
+
+const DEFAULT_APP_STORE_APP_MOCK: IAppStoreApp = {
+  name: "test app",
+  app_store_id: 1,
+  icon_url: "https://via.placeholder.com/512",
+  latest_version: "1.2.3",
+  self_service: true,
+  status: {
+    installed: 1,
+    pending: 2,
+    failed: 3,
+  },
+};
+
+export const createMockAppStoreApp = (overrides?: Partial<IAppStoreApp>) => {
+  return { ...DEFAULT_APP_STORE_APP_MOCK, ...overrides };
+};
+
+const DEFAULT_SOFTWARE_TITLE_DETAILS_MOCK: ISoftwareTitleDetails = {
+  id: 1,
+  name: "test.app",
+  software_package: null,
+  app_store_app: null,
+  source: "test_package",
+  hosts_count: 1,
+  versions: [createMockSoftwareTitleVersion()],
+  bundle_identifier: "com.test.Desktop",
+  versions_count: 1,
+};
+
+export const createMockSoftwareTitleDetails = (
+  overrides?: Partial<ISoftwareTitleDetails>
+) => {
+  return { ...DEFAULT_SOFTWARE_TITLE_DETAILS_MOCK, ...overrides };
+};
+
+const DEFAULT_SOFTWARE_TITLE_RESPONSE: ISoftwareTitleResponse = {
+  software_title: createMockSoftwareTitleDetails(),
 };
 
 export const createMockSoftwareTitleResponse = (
-  overrides: Partial<ISoftwareTitleWithPackageDetail> = {}
+  overrides?: Partial<ISoftwareTitleResponse>
 ): ISoftwareTitleResponse => {
-  const mock = DEFAULT_SOFTWARE_TITLE_RESPONSE.software_title;
-  return { software_title: { ...mock, ...overrides } };
+  return { ...DEFAULT_SOFTWARE_TITLE_RESPONSE, ...overrides };
 };
 
 const DEFAULT_SOFTWARE_VERSION_RESPONSE = {
@@ -168,7 +192,7 @@ export const createMockSoftwareVersionResponse = (
   return { ...DEFAULT_SOFTWARE_VERSION_RESPONSE, ...overrides };
 };
 
-const DEFAULT_SOFTWAREPACKAGE_MOCK: ISoftwarePackage = {
+const DEFAULT_SOFTWARE_PACKAGE_MOCK: ISoftwarePackage = {
   name: "TestPackage-1.2.3.pkg",
   version: "1.2.3",
   uploaded_at: "2020-01-01T00:00:00.000Z",
@@ -177,6 +201,7 @@ const DEFAULT_SOFTWAREPACKAGE_MOCK: ISoftwarePackage = {
   post_install_script:
     "sudo /Applications/Falcon.app/Contents/Resources/falconctl license abc123",
   self_service: false,
+  icon_url: null,
   status: {
     installed: 1,
     pending: 2,
@@ -187,5 +212,42 @@ const DEFAULT_SOFTWAREPACKAGE_MOCK: ISoftwarePackage = {
 export const createMockSoftwarePackage = (
   overrides?: Partial<ISoftwarePackage>
 ) => {
-  return { ...DEFAULT_SOFTWAREPACKAGE_MOCK, ...overrides };
+  return { ...DEFAULT_SOFTWARE_PACKAGE_MOCK, ...overrides };
+};
+
+const DEFAULT_SOFTWARE_TITLE_MOCK: ISoftwareTitle = {
+  id: 1,
+  name: "mock software 1.app",
+  versions_count: 1,
+  source: "apps",
+  hosts_count: 1,
+  browser: "chrome",
+  versions: [createMockSoftwareTitleVersion()],
+  software_package: createMockSoftwarePackage(),
+  app_store_app: null,
+};
+
+export const createMockSoftwareTitle = (
+  overrides?: Partial<ISoftwareTitle>
+): ISoftwareTitle => {
+  return {
+    ...DEFAULT_SOFTWARE_TITLE_MOCK,
+    ...overrides,
+  };
+};
+
+const DEFAULT_SOFTWARE_TITLES_RESPONSE_MOCK: ISoftwareTitlesResponse = {
+  counts_updated_at: "2020-01-01T00:00:00.000Z",
+  count: 1,
+  software_titles: [createMockSoftwareTitle()],
+  meta: {
+    has_next_results: false,
+    has_previous_results: false,
+  },
+};
+
+export const createMockSoftwareTitlesResponse = (
+  overrides?: Partial<ISoftwareTitlesResponse>
+): ISoftwareTitlesResponse => {
+  return { ...DEFAULT_SOFTWARE_TITLES_RESPONSE_MOCK, ...overrides };
 };
diff --git a/frontend/components/ActivityDetails/InstallDetails/AppInstallDetails/AppInstallDetails.tsx b/frontend/components/ActivityDetails/InstallDetails/AppInstallDetails/AppInstallDetails.tsx
new file mode 100644
index 000000000000..f6ed1a97be53
--- /dev/null
+++ b/frontend/components/ActivityDetails/InstallDetails/AppInstallDetails/AppInstallDetails.tsx
@@ -0,0 +1,163 @@
+import React from "react";
+import { useQuery } from "react-query";
+
+import { SoftwareInstallStatus } from "interfaces/software";
+import mdmApi from "services/entities/mdm";
+
+import Modal from "components/Modal";
+import Button from "components/buttons/Button";
+import Icon from "components/Icon";
+import Textarea from "components/Textarea";
+import DataError from "components/DataError/DataError";
+import Spinner from "components/Spinner/Spinner";
+import { IMdmCommandResult } from "interfaces/mdm";
+import { IActivityDetails } from "interfaces/activity";
+
+import {
+  getInstallDetailsStatusPredicate,
+  INSTALL_DETAILS_STATUS_ICONS,
+} from "../constants";
+
+const baseClass = "app-install-details";
+
+export type IAppInstallDetails = Pick<
+  IActivityDetails,
+  | "host_id"
+  | "command_uuid"
+  | "host_display_name"
+  | "software_title"
+  | "app_store_id"
+  | "status"
+>;
+
+export const AppInstallDetails = ({
+  status,
+  command_uuid = "",
+  host_display_name = "",
+  software_title = "",
+}: IAppInstallDetails) => {
+  const { data: result, isLoading, isError } = useQuery<
+    IMdmCommandResult,
+    Error
+  >(
+    ["mdm_command_results", command_uuid],
+    async () => {
+      return mdmApi.getCommandResults(command_uuid).then((response) => {
+        const results = response.results?.[0];
+        if (!results) {
+          // FIXME: It's currently possible that the command results API response is empty for pending
+          // commands. As a temporary workaround to handle this case, we'll ignore the empty response and
+          // display some minimal pending UI. This should be removed once the API response is fixed.
+          return {} as IMdmCommandResult;
+        }
+        return {
+          ...results,
+          payload: atob(results.payload),
+          result: atob(results.result),
+        };
+      });
+    },
+    {
+      refetchOnWindowFocus: false,
+      staleTime: 3000,
+    }
+  );
+
+  if (isLoading) {
+    return <Spinner />;
+  } else if (isError) {
+    return <DataError description="Close this modal and try again." />;
+  } else if (!result) {
+    // FIXME: It's currently possible that the command results API response is empty for pending
+    // commands. As a temporary workaround to handle this case, we'll ignore the empty response and
+    // display some minimal pending UI. This should be updated once the API response is fixed.
+  }
+
+  const displayStatus = (status as SoftwareInstallStatus) || "pending";
+  const iconName = INSTALL_DETAILS_STATUS_ICONS[displayStatus];
+
+  // Note: We need to reconcile status values from two different sources. From props, we
+  // get the status from the activity item details (which can be "failed", "pending", or
+  // "installed"). From the command results API response, we also receive the raw status
+  // from the MDM protocol, e.g., "NotNow" or "Acknowledged". We need to display some special
+  // messaging for the "NotNow" status, which otherwise would be treated as "pending".
+  const isStatusNotNow = result?.status === "NotNow";
+  let predicate: string;
+  let subordinate: string;
+  if (isStatusNotNow) {
+    predicate = "tried to install";
+    subordinate =
+      " but couldn’t because the host was locked or was running on battery power while in Power Nap. Fleet will try again";
+  } else {
+    predicate = getInstallDetailsStatusPredicate(displayStatus);
+    subordinate = status === "pending" ? " when it comes online" : "";
+  }
+
+  const formattedHost = host_display_name ? (
+    <b>{host_display_name}</b>
+  ) : (
+    "the host"
+  );
+
+  const showCommandPayload = !!result?.payload;
+  const showCommandResponse =
+    !!result?.result && (isStatusNotNow || status !== "pending");
+
+  return (
+    <>
+      <div className={`${baseClass}__software-install-details`}>
+        <div className={`${baseClass}__status-message`}>
+          {!!iconName && <Icon name={iconName} />}
+          <span>
+            Fleet {predicate} <b>{software_title}</b> on {formattedHost}
+            {subordinate}.
+          </span>
+        </div>
+        {showCommandPayload && (
+          <div className={`${baseClass}__script-output`}>
+            Request payload:
+            <Textarea className={`${baseClass}__output-textarea`}>
+              {result.payload}
+            </Textarea>
+          </div>
+        )}
+        {showCommandResponse && (
+          <div className={`${baseClass}__script-output`}>
+            The response from {formattedHost}:
+            <Textarea className={`${baseClass}__output-textarea`}>
+              {result.result}
+            </Textarea>
+          </div>
+        )}
+      </div>
+    </>
+  );
+};
+
+export const AppInstallDetailsModal = ({
+  details,
+  onCancel,
+}: {
+  details: IAppInstallDetails;
+  onCancel: () => void;
+}) => {
+  return (
+    <Modal
+      title="Install details"
+      onExit={onCancel}
+      onEnter={onCancel}
+      className={baseClass}
+    >
+      <>
+        <div className={`${baseClass}__modal-content`}>
+          <AppInstallDetails {...details} />
+        </div>
+        <div className="modal-cta-wrap">
+          <Button onClick={onCancel} variant="brand">
+            Done
+          </Button>
+        </div>
+      </>
+    </Modal>
+  );
+};
diff --git a/frontend/components/ActivityDetails/InstallDetails/AppInstallDetails/_styles.scss b/frontend/components/ActivityDetails/InstallDetails/AppInstallDetails/_styles.scss
new file mode 100644
index 000000000000..2de4b0386ee2
--- /dev/null
+++ b/frontend/components/ActivityDetails/InstallDetails/AppInstallDetails/_styles.scss
@@ -0,0 +1,27 @@
+.app-install-details {
+  .modal__content {
+    margin-top: $pad-xlarge;
+  }
+  &__status-message {
+    display: flex;
+    align-items: center;
+    gap: $pad-small;
+    margin: 0;
+    .icon {
+      padding-top: 3px;
+      align-self: flex-start;
+    }
+  }
+  &__script-output {
+    padding-top: $pad-xlarge;
+    .textarea {
+      margin-top: $pad-medium;
+      overflow-wrap: break-word;
+    }
+  }
+
+  &__output-textarea {
+    max-height: 300px;
+    overflow-y: auto;
+  }
+}
diff --git a/frontend/components/ActivityDetails/InstallDetails/AppInstallDetails/index.ts b/frontend/components/ActivityDetails/InstallDetails/AppInstallDetails/index.ts
new file mode 100644
index 000000000000..509d370bb9d3
--- /dev/null
+++ b/frontend/components/ActivityDetails/InstallDetails/AppInstallDetails/index.ts
@@ -0,0 +1 @@
+export { AppInstallDetails, AppInstallDetailsModal } from "./AppInstallDetails";
diff --git a/frontend/pages/SoftwarePage/components/SoftwareInstallDetails/SoftwareInstallDetails.tsx b/frontend/components/ActivityDetails/InstallDetails/SoftwareInstallDetails/SoftwareInstallDetails.tsx
similarity index 67%
rename from frontend/pages/SoftwarePage/components/SoftwareInstallDetails/SoftwareInstallDetails.tsx
rename to frontend/components/ActivityDetails/InstallDetails/SoftwareInstallDetails/SoftwareInstallDetails.tsx
index ca735dcf5ab4..61c2d5f04f42 100644
--- a/frontend/pages/SoftwarePage/components/SoftwareInstallDetails/SoftwareInstallDetails.tsx
+++ b/frontend/components/ActivityDetails/InstallDetails/SoftwareInstallDetails/SoftwareInstallDetails.tsx
@@ -1,10 +1,10 @@
 import React from "react";
 import { useQuery } from "react-query";
 
+import { IActivityDetails } from "interfaces/activity";
 import {
   ISoftwareInstallResult,
   ISoftwareInstallResults,
-  SoftwareInstallStatus,
 } from "interfaces/software";
 import softwareAPI from "services/entities/software";
 
@@ -14,55 +14,52 @@ import Icon from "components/Icon";
 import Textarea from "components/Textarea";
 import DataError from "components/DataError/DataError";
 import Spinner from "components/Spinner/Spinner";
-import { IconNames } from "components/icons";
+import {
+  INSTALL_DETAILS_STATUS_ICONS,
+  SOFTWARE_INSTALL_OUTPUT_DISPLAY_LABELS,
+  getInstallDetailsStatusPredicate,
+} from "../constants";
 
 const baseClass = "software-install-details";
 
-const STATUS_ICONS: Record<SoftwareInstallStatus, IconNames> = {
-  pending: "pending-outline",
-  installed: "success-outline",
-  failed: "error-outline",
-} as const;
-
-const STATUS_PREDICATES: Record<SoftwareInstallStatus, string> = {
-  pending: "will install",
-  installed: "installed",
-  failed: "failed to install",
-} as const;
+// TODO: Expand to include more details as needed
+export type IPackageInstallDetails = Pick<
+  IActivityDetails,
+  "install_uuid" | "host_display_name"
+>;
 
 const StatusMessage = ({
   result: { host_display_name, software_package, software_title, status },
 }: {
   result: ISoftwareInstallResult;
 }) => {
+  const formattedHost = host_display_name ? (
+    <b>{host_display_name}</b>
+  ) : (
+    "the host"
+  );
   return (
     <div className={`${baseClass}__status-message`}>
-      <Icon name={STATUS_ICONS[status]} />
+      <Icon name={INSTALL_DETAILS_STATUS_ICONS[status]} />
       <span>
-        Fleet {STATUS_PREDICATES[status]} <b>{software_title}</b> (
-        {software_package}) on <b>{host_display_name}</b>
+        Fleet {getInstallDetailsStatusPredicate(status)} <b>{software_title}</b>{" "}
+        ({software_package}) on {formattedHost}
         {status === "pending" ? " when it comes online" : ""}.
       </span>
     </div>
   );
 };
 
-const OUTPUT_DISPLAY_LABELS = {
-  pre_install_query_output: "Pre-install condition",
-  output: "Software install output",
-  post_install_script_output: "Post-install script output",
-} as const;
-
 const Output = ({
   displayKey,
   result,
 }: {
-  displayKey: keyof typeof OUTPUT_DISPLAY_LABELS;
+  displayKey: keyof typeof SOFTWARE_INSTALL_OUTPUT_DISPLAY_LABELS;
   result: ISoftwareInstallResult;
 }) => {
   return (
     <div className={`${baseClass}__script-output`}>
-      {OUTPUT_DISPLAY_LABELS[displayKey]}:
+      {SOFTWARE_INSTALL_OUTPUT_DISPLAY_LABELS[displayKey]}:
       <Textarea className={`${baseClass}__output-textarea`}>
         {result[displayKey]}
       </Textarea>
@@ -71,18 +68,17 @@ const Output = ({
 };
 
 export const SoftwareInstallDetails = ({
-  installUuid,
-}: {
-  installUuid: string;
-}) => {
+  host_display_name = "",
+  install_uuid = "",
+}: IPackageInstallDetails) => {
   const { data: result, isLoading, isError } = useQuery<
     ISoftwareInstallResults,
     Error,
     ISoftwareInstallResult
   >(
-    ["softwareInstallResults", installUuid],
+    ["softwareInstallResults", install_uuid],
     () => {
-      return softwareAPI.getSoftwareInstallResult(installUuid);
+      return softwareAPI.getSoftwareInstallResult(install_uuid);
     },
     {
       refetchOnWindowFocus: false,
@@ -103,7 +99,11 @@ export const SoftwareInstallDetails = ({
   return (
     <>
       <div className={`${baseClass}__software-install-details`}>
-        <StatusMessage result={result} />
+        <StatusMessage
+          result={
+            result.host_display_name ? result : { ...result, host_display_name } // prefer result.host_display_name (it may be empty if the host was deleted) otherwise default to whatever we received via props
+          }
+        />
         {result.status !== "pending" && (
           <>
             {result.pre_install_query_output && (
@@ -121,10 +121,10 @@ export const SoftwareInstallDetails = ({
 };
 
 export const SoftwareInstallDetailsModal = ({
-  installUuid,
+  details,
   onCancel,
 }: {
-  installUuid: string;
+  details: IPackageInstallDetails;
   onCancel: () => void;
 }) => {
   return (
@@ -136,7 +136,7 @@ export const SoftwareInstallDetailsModal = ({
     >
       <>
         <div className={`${baseClass}__modal-content`}>
-          <SoftwareInstallDetails installUuid={installUuid} />
+          <SoftwareInstallDetails {...details} />
         </div>
         <div className="modal-cta-wrap">
           <Button onClick={onCancel} variant="brand">
diff --git a/frontend/pages/SoftwarePage/components/SoftwareInstallDetails/_styles.scss b/frontend/components/ActivityDetails/InstallDetails/SoftwareInstallDetails/_styles.scss
similarity index 82%
rename from frontend/pages/SoftwarePage/components/SoftwareInstallDetails/_styles.scss
rename to frontend/components/ActivityDetails/InstallDetails/SoftwareInstallDetails/_styles.scss
index 5e8df96d6710..8cdc2ef6004b 100644
--- a/frontend/pages/SoftwarePage/components/SoftwareInstallDetails/_styles.scss
+++ b/frontend/components/ActivityDetails/InstallDetails/SoftwareInstallDetails/_styles.scss
@@ -7,6 +7,10 @@
     align-items: center;
     gap: $pad-small;
     margin: 0;
+    .icon {
+      padding-top: 3px;
+      align-self: flex-start;
+    }
   }
   &__script-output {
     padding-top: $pad-xlarge;
diff --git a/frontend/pages/SoftwarePage/components/SoftwareInstallDetails/index.ts b/frontend/components/ActivityDetails/InstallDetails/SoftwareInstallDetails/index.ts
similarity index 100%
rename from frontend/pages/SoftwarePage/components/SoftwareInstallDetails/index.ts
rename to frontend/components/ActivityDetails/InstallDetails/SoftwareInstallDetails/index.ts
diff --git a/frontend/components/ActivityDetails/InstallDetails/constants.ts b/frontend/components/ActivityDetails/InstallDetails/constants.ts
new file mode 100644
index 000000000000..c4c1ae8cb7b9
--- /dev/null
+++ b/frontend/components/ActivityDetails/InstallDetails/constants.ts
@@ -0,0 +1,39 @@
+import { IconNames } from "components/icons";
+import { SoftwareInstallStatus } from "interfaces/software";
+
+export const INSTALL_DETAILS_STATUS_ICONS: Record<
+  SoftwareInstallStatus,
+  IconNames
+> = {
+  pending: "pending-outline",
+  installed: "success-outline",
+  failed: "error-outline",
+} as const;
+
+const INSTALL_DETAILS_STATUS_PREDICATES: Record<
+  SoftwareInstallStatus,
+  string
+> = {
+  pending: "is installing or will install",
+  installed: "installed",
+  failed: "failed to install",
+} as const;
+
+export const getInstallDetailsStatusPredicate = (
+  status: string | undefined
+) => {
+  if (!status) {
+    return INSTALL_DETAILS_STATUS_PREDICATES.pending;
+  }
+  return (
+    INSTALL_DETAILS_STATUS_PREDICATES[
+      status.toLowerCase() as SoftwareInstallStatus
+    ] || INSTALL_DETAILS_STATUS_PREDICATES.pending
+  );
+};
+
+export const SOFTWARE_INSTALL_OUTPUT_DISPLAY_LABELS = {
+  pre_install_query_output: "Pre-install condition",
+  output: "Software install output",
+  post_install_script_output: "Post-install script output",
+} as const;
diff --git a/frontend/components/AddHostsModal/AddHostsModal.tests.tsx b/frontend/components/AddHostsModal/AddHostsModal.tests.tsx
index 658bbd11882e..2af31091f6b8 100644
--- a/frontend/components/AddHostsModal/AddHostsModal.tests.tsx
+++ b/frontend/components/AddHostsModal/AddHostsModal.tests.tsx
@@ -73,8 +73,9 @@ describe("AddHostsModal", () => {
     expect(screen.queryByText(/--enable-scripts/i)).not.toBeInTheDocument();
 
     await user.click(screen.getByRole("tab", { name: "iOS & iPadOS" }));
-    expect(screen.queryByText(/Apple Business Manager/i)).toBeInTheDocument();
-    expect(screen.queryByText(/Learn more/i)).toBeInTheDocument();
+    expect(
+      screen.queryByText(/Send this to your end users:/i)
+    ).toBeInTheDocument();
 
     await user.click(screen.getByRole("tab", { name: "Advanced" }));
     const advancedText = screen.getByText(/--type=YOUR_TYPE/i);
diff --git a/frontend/components/AddHostsModal/AddHostsModal.tsx b/frontend/components/AddHostsModal/AddHostsModal.tsx
index 04a42908ed2e..1cac7712099c 100644
--- a/frontend/components/AddHostsModal/AddHostsModal.tsx
+++ b/frontend/components/AddHostsModal/AddHostsModal.tsx
@@ -9,7 +9,6 @@ import Modal from "components/Modal";
 import Spinner from "components/Spinner";
 
 import PlatformWrapper from "./PlatformWrapper/PlatformWrapper";
-import DownloadInstallers from "./DownloadInstallers/DownloadInstallers";
 
 const baseClass = "add-hosts-modal";
 
diff --git a/frontend/components/AddHostsModal/PlatformWrapper/IosIpadosPanel/IosIpadosPanel.tsx b/frontend/components/AddHostsModal/PlatformWrapper/IosIpadosPanel/IosIpadosPanel.tsx
new file mode 100644
index 000000000000..40d991e2f841
--- /dev/null
+++ b/frontend/components/AddHostsModal/PlatformWrapper/IosIpadosPanel/IosIpadosPanel.tsx
@@ -0,0 +1,46 @@
+import React, { useContext } from "react";
+
+import { AppContext } from "context/app";
+
+// @ts-ignore
+import InputField from "components/forms/fields/InputField";
+
+const generateUrl = (serverUrl: string, enrollSecret: string) => {
+  return `${serverUrl}/enroll?enroll_secret=${enrollSecret}`;
+};
+
+const baseClass = "ios-ipados-panel";
+
+interface IosIpadosPanelProps {
+  enrollSecret: string;
+}
+
+const IosIpadosPanel = ({ enrollSecret }: IosIpadosPanelProps) => {
+  const { config } = useContext(AppContext);
+
+  const helpText =
+    "When the end user navigates to this URL, the enrollment profile " +
+    "will download in their browser. End users will have to install the profile " +
+    "to enroll to Fleet.";
+
+  if (!config) return null;
+
+  const url = generateUrl(config.server_settings.server_url, enrollSecret);
+
+  return (
+    <div className={baseClass}>
+      <InputField
+        label="Send this to your end users:"
+        enableCopy
+        copyButtonPosition="inside"
+        readOnly
+        inputWrapperClass
+        name="enroll-link"
+        value={url}
+        helpText={helpText}
+      />
+    </div>
+  );
+};
+
+export default IosIpadosPanel;
diff --git a/frontend/components/AddHostsModal/PlatformWrapper/IosIpadosPanel/_styles.scss b/frontend/components/AddHostsModal/PlatformWrapper/IosIpadosPanel/_styles.scss
new file mode 100644
index 000000000000..e781e7ca7072
--- /dev/null
+++ b/frontend/components/AddHostsModal/PlatformWrapper/IosIpadosPanel/_styles.scss
@@ -0,0 +1,5 @@
+.ios-ipados-panel {
+  &__spinner {
+    margin: $pad-xxlarge auto;
+  }
+}
diff --git a/frontend/components/AddHostsModal/PlatformWrapper/IosIpadosPanel/index.ts b/frontend/components/AddHostsModal/PlatformWrapper/IosIpadosPanel/index.ts
new file mode 100644
index 000000000000..4dc628ef88a5
--- /dev/null
+++ b/frontend/components/AddHostsModal/PlatformWrapper/IosIpadosPanel/index.ts
@@ -0,0 +1 @@
+export { default } from "./IosIpadosPanel";
diff --git a/frontend/components/AddHostsModal/PlatformWrapper/PlatformWrapper.tsx b/frontend/components/AddHostsModal/PlatformWrapper/PlatformWrapper.tsx
index f10fbead552b..a2a8ccb1d1c3 100644
--- a/frontend/components/AddHostsModal/PlatformWrapper/PlatformWrapper.tsx
+++ b/frontend/components/AddHostsModal/PlatformWrapper/PlatformWrapper.tsx
@@ -19,6 +19,7 @@ import InfoBanner from "components/InfoBanner/InfoBanner";
 import CustomLink from "components/CustomLink/CustomLink";
 
 import { isValidPemCertificate } from "../../../pages/hosts/ManageHostsPage/helpers";
+import IosIpadosPanel from "./IosIpadosPanel";
 
 interface IPlatformSubNav {
   name: string;
@@ -324,7 +325,7 @@ const PlatformWrapper = ({
     );
   };
 
-  const renderTab = (packageType: string) => {
+  const renderPanel = (packageType: string) => {
     const CHROME_OS_INFO = {
       extensionId: "fleeedmmihkfkeemmipgmhhjemlljidg",
       installationUrl: "https://chrome.fleetdm.com/updates.xml",
@@ -395,19 +396,7 @@ const PlatformWrapper = ({
     }
 
     if (packageType === "ios-ipados") {
-      return (
-        <div className={`${baseClass}__ios-ipados--info`}>
-          <p>
-            Enroll iPhones and iPads by adding them to Fleet in Apple Business
-            Manager (ABM).{" "}
-            <CustomLink
-              url="https://fleetdm.com/learn-more-about/setup-abm"
-              text="Learn more"
-              newTab
-            />
-          </p>
-        </div>
-      );
+      return <IosIpadosPanel enrollSecret={enrollSecret} />;
     }
 
     if (packageType === "advanced") {
@@ -590,7 +579,7 @@ const PlatformWrapper = ({
             return (
               <TabPanel className={`${baseClass}__info`} key={navItem.type}>
                 <div className={`${baseClass} form`}>
-                  {renderTab(navItem.type)}
+                  {renderPanel(navItem.type)}
                 </div>
               </TabPanel>
             );
diff --git a/frontend/components/App/App.tsx b/frontend/components/App/App.tsx
index d2f4cd55953b..da850f26d0de 100644
--- a/frontend/components/App/App.tsx
+++ b/frontend/components/App/App.tsx
@@ -1,10 +1,8 @@
-import React, { FC, useContext, useEffect, useState } from "react";
-import { AxiosResponse } from "axios";
-import {
-  QueryClient,
-  QueryClientProvider,
-  QueryClientProviderProps,
-} from "react-query";
+import React, { useContext, useEffect, useState } from "react";
+import { AxiosError, AxiosResponse } from "axios";
+import { useQuery } from "react-query";
+import { ErrorBoundary } from "react-error-boundary";
+import { isBefore } from "date-fns";
 
 import page_titles from "router/page_titles";
 import TableProvider from "context/table";
@@ -14,22 +12,27 @@ import NotificationProvider from "context/notification";
 import { AppContext } from "context/app";
 import { authToken, clearToken } from "utilities/local";
 import useDeepEffect from "hooks/useDeepEffect";
-
+import { QueryParams } from "utilities/url";
+import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
 import usersAPI from "services/entities/users";
 import configAPI from "services/entities/config";
 import hostCountAPI from "services/entities/host_count";
-import mdmAppleBMAPI from "services/entities/mdm_apple_bm";
-import mdmAppleAPI from "services/entities/mdm_apple";
+import mdmAppleBMAPI, {
+  IGetAbmTokensResponse,
+} from "services/entities/mdm_apple_bm";
+import mdmAppleAPI, {
+  IGetVppTokensResponse,
+} from "services/entities/mdm_apple";
 
-import { ErrorBoundary } from "react-error-boundary";
 // @ts-ignore
 import Fleet403 from "pages/errors/Fleet403";
 // @ts-ignore
 import Fleet404 from "pages/errors/Fleet404";
 // @ts-ignore
 import Fleet500 from "pages/errors/Fleet500";
+
 import Spinner from "components/Spinner";
-import { QueryParams } from "utilities/url";
+import { IMdmVppToken } from "interfaces/mdm";
 
 interface IAppProps {
   children: JSX.Element;
@@ -41,18 +44,32 @@ interface IAppProps {
   };
 }
 
-// We create a CustomQueryClientProvider that takes the same props as the original
-// QueryClientProvider but adds the children prop as a ReactNode. This children
-// prop is not required explicitly in React 18. We do it this way to avoid
-// having to update the react-query package version and typings for now.
-// When we upgrade React Query we should be able to remove this.
-type ICustomQueryClientProviderProps = React.PropsWithChildren<QueryClientProviderProps>;
-const CustomQueryClientProvider: FC<ICustomQueryClientProviderProps> = QueryClientProvider;
+interface RecordWithRenewDate {
+  renew_date: string;
+}
+
+const GUARANTEED_PAST_DATE = "2000-01-01T01:00:00Z";
+
+// TODO: add tests for this function
+const getEarliestExpiry = (records: RecordWithRenewDate[]): string => {
+  const earliest = records.reduce((acc, record) => {
+    const renewDate = new Date(record.renew_date);
+    return isBefore(acc, renewDate) ? acc : renewDate;
+  }, new Date(NaN));
+
+  if (isNaN(earliest.valueOf())) {
+    // this should never happen assuming the API always returns valid dates, but just in case we'll
+    // return a guaranteed past date and log a warning to aid debugging
+    console.warn("No valid renew dates found, returning guaranteed past date.");
+    return GUARANTEED_PAST_DATE;
+  }
+
+  return earliest.toISOString();
+};
 
 const baseClass = "app";
 
 const App = ({ children, location }: IAppProps): JSX.Element => {
-  const queryClient = new QueryClient();
   const {
     config,
     currentUser,
@@ -66,12 +83,67 @@ const App = ({ children, location }: IAppProps): JSX.Element => {
     setEnrollSecret,
     setABMExpiry,
     setAPNsExpiry,
+    setVppExpiry,
     setSandboxExpiry,
     setNoSandboxHosts,
   } = useContext(AppContext);
 
   const [isLoading, setIsLoading] = useState(false);
 
+  // We will do a series of API calls to get the data that we need to display
+  // warnings to the user about various token expirations.
+
+  // Get the ABM tokens
+  useQuery<IGetAbmTokensResponse, AxiosError>(
+    ["abm_tokens"],
+    () => mdmAppleBMAPI.getTokens(),
+    {
+      ...DEFAULT_USE_QUERY_OPTIONS,
+      enabled: !!isGlobalAdmin && !!config?.mdm.enabled_and_configured,
+      onSuccess: ({ abm_tokens }) => {
+        abm_tokens.length &&
+          setABMExpiry({
+            earliestExpiry: getEarliestExpiry(abm_tokens),
+            needsAbmTermsRenewal: abm_tokens.some(
+              (token) => token.terms_expired
+            ),
+          });
+      },
+      // TODO: Do we need to catch and check for a 400 status code? The old
+      // API behaved this way when the token is already expired or invalid.
+      onError: (err) => {
+        if (err.status === 400) {
+          setABMExpiry({
+            earliestExpiry: GUARANTEED_PAST_DATE,
+            needsAbmTermsRenewal: true, // TODO: if order of precedence for banners changes, we may need to upate this
+          });
+        }
+      },
+    }
+  );
+
+  // Get the Apple Push Notification token expiration date
+  useQuery(["apns"], () => mdmAppleAPI.getAppleAPNInfo(), {
+    ...DEFAULT_USE_QUERY_OPTIONS,
+    enabled: !!isGlobalAdmin && !!config?.mdm.enabled_and_configured,
+    onSuccess: (data) => {
+      setAPNsExpiry(data.renew_date);
+    },
+  });
+
+  // Get the Apple VPP token expiration date
+  useQuery<IGetVppTokensResponse>(
+    ["vpp_tokens"],
+    () => mdmAppleAPI.getVppTokens(),
+    {
+      ...DEFAULT_USE_QUERY_OPTIONS,
+      enabled: !!isGlobalAdmin && !!config?.mdm.enabled_and_configured,
+      onSuccess: ({ vpp_tokens }) => {
+        vpp_tokens.length && setVppExpiry(getEarliestExpiry(vpp_tokens));
+      },
+    }
+  );
+
   const fetchConfig = async () => {
     try {
       const configResponse = await configAPI.loadAll();
@@ -82,38 +154,6 @@ const App = ({ children, location }: IAppProps): JSX.Element => {
         const noSandboxHosts = hostCount.count === 0;
         setNoSandboxHosts(noSandboxHosts);
       }
-
-      // These endpoints 403 for non-global admins
-      if (isGlobalAdmin) {
-        if (configResponse.mdm.apple_bm_enabled_and_configured) {
-          // FIXME: we need to catch and check for a 400 status code because the
-          // API behaves this way when the token is already expired or invalid.
-          //
-          // This is a quick fix to not completely break the UI, but it doesn't
-          // allow us to show ABM information when the token is expired so it
-          // should be fixed upstream.
-          try {
-            const abmInfo = await mdmAppleBMAPI.getAppleBMInfo();
-            setABMExpiry(abmInfo.renew_date);
-          } catch (error) {
-            console.error(error);
-            const abmError = error as AxiosResponse;
-            if (abmError.status === 400) {
-              const pastDate = "2024-06-03T17:28:44Z";
-              setABMExpiry(pastDate);
-            }
-          }
-        }
-        if (configResponse.mdm.enabled_and_configured) {
-          try {
-            const apnsInfo = await mdmAppleAPI.getAppleAPNInfo();
-            setAPNsExpiry(apnsInfo.renew_date);
-          } catch (error) {
-            console.error(error);
-          }
-        }
-      }
-
       setConfig(configResponse);
     } catch (error) {
       console.error(error);
@@ -219,22 +259,20 @@ const App = ({ children, location }: IAppProps): JSX.Element => {
   return isLoading ? (
     <Spinner />
   ) : (
-    <CustomQueryClientProvider client={queryClient}>
-      <TableProvider>
-        <QueryProvider>
-          <PolicyProvider>
-            <NotificationProvider>
-              <ErrorBoundary
-                fallbackRender={renderErrorOverlay}
-                resetKeys={[location?.pathname]}
-              >
-                <div className={baseClass}>{children}</div>
-              </ErrorBoundary>
-            </NotificationProvider>
-          </PolicyProvider>
-        </QueryProvider>
-      </TableProvider>
-    </CustomQueryClientProvider>
+    <TableProvider>
+      <QueryProvider>
+        <PolicyProvider>
+          <NotificationProvider>
+            <ErrorBoundary
+              fallbackRender={renderErrorOverlay}
+              resetKeys={[location?.pathname]}
+            >
+              <div className={baseClass}>{children}</div>
+            </ErrorBoundary>
+          </NotificationProvider>
+        </PolicyProvider>
+      </QueryProvider>
+    </TableProvider>
   );
 };
 
diff --git a/frontend/components/ClickableUrls/ClickableUrls.tsx b/frontend/components/ClickableUrls/ClickableUrls.tsx
index 444dee0f3d5d..2dffcc2d63da 100644
--- a/frontend/components/ClickableUrls/ClickableUrls.tsx
+++ b/frontend/components/ClickableUrls/ClickableUrls.tsx
@@ -20,21 +20,19 @@ const ClickableUrls = ({ text, className }: IClickableUrls): JSX.Element => {
   const clickableUrlClasses = classnames(baseClass, className);
 
   // Regex to find case insensitive URLs and replace with link
-  const replacedLinks = text.replaceAll(
+  const textWithLinks = text.replaceAll(
     /(((https?)?(:\/\/))|((https?)?(:\/\/)?(www\.)))[-a-zA-Z0-9@:%._+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_+.~#?&//=]*)/g,
     urlReplacer
   );
-  const sanitizedResolutionContent = DOMPurify.sanitize(replacedLinks, {
+  const sanitizedTextWithLinks = DOMPurify.sanitize(textWithLinks, {
     ADD_ATTR: ["target"], // Allows opening in a new tab
   });
 
-  const textWithLinks = (
+  return (
     <div
       className={clickableUrlClasses}
-      dangerouslySetInnerHTML={{ __html: sanitizedResolutionContent }}
+      dangerouslySetInnerHTML={{ __html: sanitizedTextWithLinks }}
     />
   );
-
-  return textWithLinks;
 };
 export default ClickableUrls;
diff --git a/frontend/components/DataError/DataError.tsx b/frontend/components/DataError/DataError.tsx
index a148ac994f2e..7b2cfd6d55b4 100644
--- a/frontend/components/DataError/DataError.tsx
+++ b/frontend/components/DataError/DataError.tsx
@@ -3,6 +3,7 @@ import classnames from "classnames";
 
 import CustomLink from "components/CustomLink";
 import Icon from "components/Icon";
+import Graphic from "components/Graphic";
 
 const baseClass = "data-error";
 
@@ -14,6 +15,8 @@ interface IDataErrorProps {
   children?: React.ReactNode;
   card?: boolean;
   className?: string;
+  /** Flag to use the updated DataError design */
+  useNew?: boolean;
 }
 
 const DEFAULT_DESCRIPTION = "Refresh the page or log in again.";
@@ -24,8 +27,36 @@ const DataError = ({
   children,
   card,
   className,
+  useNew = false,
 }: IDataErrorProps): JSX.Element => {
   const classes = classnames(baseClass, className);
+  if (useNew) {
+    return (
+      <div className={classes}>
+        <div className={`${baseClass}__${card ? "card" : "inner-new"}`}>
+          <Graphic name="data-error" />
+          <div className={`${baseClass}__header`}>
+            Something&apos;s gone wrong.
+          </div>
+          {children || (
+            <>
+              <div className={`${baseClass}__data`}>Refresh to try again.</div>
+              {!excludeIssueLink && (
+                <div className={`${baseClass}__data`}>
+                  If this keeps happening please&nbsp;
+                  <CustomLink
+                    url="https://github.com/fleetdm/fleet/issues/new/choose"
+                    text="file an issue"
+                    newTab
+                  />
+                </div>
+              )}
+            </>
+          )}
+        </div>
+      </div>
+    );
+  }
 
   return (
     <div className={classes}>
diff --git a/frontend/components/DataError/_styles.scss b/frontend/components/DataError/_styles.scss
index a54f5b1a8562..9ea6ed3a9d7f 100644
--- a/frontend/components/DataError/_styles.scss
+++ b/frontend/components/DataError/_styles.scss
@@ -32,4 +32,21 @@
       margin-top: 10px;
     }
   }
+  
+  //  // // // // // // // // // // //
+  // new version
+  &__inner-new {
+    display: flex;
+    flex-direction: column;
+    gap: 8px;
+    text-align: center;
+    .graphic {
+      margin-bottom: 8px;
+    }
+    color: $core-fleet-black;
+    font-size: $x-small;
+  }
+    &__header {
+      font-weight: $bold;
+    }
 }
diff --git a/frontend/components/DataSet/_styles.scss b/frontend/components/DataSet/_styles.scss
index bac96ebc16f7..9f08ff247833 100644
--- a/frontend/components/DataSet/_styles.scss
+++ b/frontend/components/DataSet/_styles.scss
@@ -2,6 +2,13 @@
   font-size: $x-small;
   min-width: max-content;
 
+  // ff only
+  @-moz-document url-prefix() {
+    display: flex;
+    flex-direction: column;
+    gap: 6px;
+  }
+
   dt {
     font-weight: $bold;
     display: flex;
diff --git a/frontend/components/Editor/Editor.tsx b/frontend/components/Editor/Editor.tsx
index c9bd360508e4..b724a296c39e 100644
--- a/frontend/components/Editor/Editor.tsx
+++ b/frontend/components/Editor/Editor.tsx
@@ -29,6 +29,10 @@ interface IEditorProps {
    * @default "editor"
    */
   name?: string;
+  /** Include correct styles as a form field.
+   * @default false
+   */
+  isFormField?: boolean;
   maxLines?: number;
   className?: string;
   onChange?: (value: string, event?: any) => void;
@@ -52,11 +56,13 @@ const Editor = ({
   readOnly = false,
   wrapEnabled = false,
   name = "editor",
+  isFormField = false,
   maxLines = 20,
   className,
   onChange,
 }: IEditorProps) => {
   const classNames = classnames(baseClass, className, {
+    "form-field": isFormField,
     [`${baseClass}__error`]: !!error,
   });
 
@@ -75,7 +81,7 @@ const Editor = ({
         <TooltipWrapper
           className={labelClassName}
           tipContent={labelTooltip}
-          position="top"
+          position="top-start"
         >
           {labelText}
         </TooltipWrapper>
diff --git a/frontend/components/Editor/_styles.scss b/frontend/components/Editor/_styles.scss
index 676172697dd5..22fbacfd337c 100644
--- a/frontend/components/Editor/_styles.scss
+++ b/frontend/components/Editor/_styles.scss
@@ -3,7 +3,6 @@
   &__label {
     font-size: $x-small;
     font-weight: $bold;
-    margin-bottom: $pad-small;
 
     &--error {
       color: $core-vibrant-red;
diff --git a/frontend/components/EmptyTable/_styles.scss b/frontend/components/EmptyTable/_styles.scss
index 2aa30b7d6859..76591c83e8fc 100644
--- a/frontend/components/EmptyTable/_styles.scss
+++ b/frontend/components/EmptyTable/_styles.scss
@@ -4,7 +4,7 @@
     flex-direction: column;
     align-items: center;
     margin: 96px auto; // 96px to top of div
-    max-width: 450px; // standard empty state width
+    max-width: 500px; // standard empty state width
     gap: $pad-medium; // 16px between image, text, and buttons
   }
 
diff --git a/frontend/components/FileUploader/FileUploader.tsx b/frontend/components/FileUploader/FileUploader.tsx
index 9c22930f444d..a79955df28b0 100644
--- a/frontend/components/FileUploader/FileUploader.tsx
+++ b/frontend/components/FileUploader/FileUploader.tsx
@@ -20,6 +20,7 @@ type ISupportedGraphicNames = Extract<
   | "file-pkg"
   | "file-p7m"
   | "file-pem"
+  | "file-vpp"
 >;
 
 export const FileDetails = ({
diff --git a/frontend/components/FileUploader/_styles.scss b/frontend/components/FileUploader/_styles.scss
index 2862466e1754..a02d768e5def 100644
--- a/frontend/components/FileUploader/_styles.scss
+++ b/frontend/components/FileUploader/_styles.scss
@@ -2,7 +2,7 @@
   display: flex;
   flex-direction: column;
   align-items: center;
-  border-radius: $border-radius;
+  border-radius: $border-radius-medium;
   background-color: $ui-fleet-blue-10;
   border: 1px solid $ui-fleet-black-10;
   padding: $pad-xlarge $pad-large;
@@ -43,6 +43,7 @@
   }
   &__message {
     margin: 0;
+    color: $ui-fleet-black-75;
   }
 
   &__additional-info {
@@ -55,7 +56,6 @@
   }
 
   &__upload-button {
-    margin-top: 8px;
     // we handle the padding in the label so the entire button is clickable
     padding: 0;
   }
diff --git a/frontend/components/FlashMessage/FlashMessage.tsx b/frontend/components/FlashMessage/FlashMessage.tsx
index 102b2c3601d0..d8c36caf6c35 100644
--- a/frontend/components/FlashMessage/FlashMessage.tsx
+++ b/frontend/components/FlashMessage/FlashMessage.tsx
@@ -65,38 +65,40 @@ const FlashMessage = ({
   }
 
   return (
-    <div className={baseClasses} id={baseClasses}>
-      <div className={`${baseClass}__content`}>
-        <Icon
-          name={alertType === "success" ? "success" : "error"}
-          color="core-fleet-white"
-        />
-        <span>{message}</span>
-        {onUndoActionClick && undoAction && (
-          <Button
-            className={`${baseClass}__undo`}
-            variant="unstyled"
-            onClick={onUndoActionClick(undoAction)}
-          >
-            Undo
-          </Button>
-        )}
-      </div>
-      <div className={`${baseClass}__action`}>
-        <div className={`${baseClass}__ex`}>
-          <button
-            className={`${baseClass}__remove ${baseClass}__remove--${alertType} button--unstyled`}
-            onClick={onRemoveFlash}
-          >
-            <Icon
-              name="close"
-              color={
-                alertType === "warning-filled"
-                  ? "core-fleet-black"
-                  : "core-fleet-white"
-              }
-            />
-          </button>
+    <div className={"flash-message-container"}>
+      <div className={baseClasses} id={baseClasses}>
+        <div className={`${baseClass}__content`}>
+          <Icon
+            name={alertType === "success" ? "success" : "error"}
+            color="core-fleet-white"
+          />
+          <span>{message}</span>
+          {onUndoActionClick && undoAction && (
+            <Button
+              className={`${baseClass}__undo`}
+              variant="unstyled"
+              onClick={onUndoActionClick(undoAction)}
+            >
+              Undo
+            </Button>
+          )}
+        </div>
+        <div className={`${baseClass}__action`}>
+          <div className={`${baseClass}__ex`}>
+            <button
+              className={`${baseClass}__remove ${baseClass}__remove--${alertType} button--unstyled`}
+              onClick={onRemoveFlash}
+            >
+              <Icon
+                name="close"
+                color={
+                  alertType === "warning-filled"
+                    ? "core-fleet-black"
+                    : "core-fleet-white"
+                }
+              />
+            </button>
+          </div>
         </div>
       </div>
     </div>
diff --git a/frontend/components/FlashMessage/_styles.scss b/frontend/components/FlashMessage/_styles.scss
index 26b9ce8907f5..f4e67d492860 100644
--- a/frontend/components/FlashMessage/_styles.scss
+++ b/frontend/components/FlashMessage/_styles.scss
@@ -8,11 +8,18 @@
   }
 }
 
-.flash-message {
+// Allows for centering flash message for short and long, wrapped messages
+.flash-message-container {
   @include position(fixed);
   top: 80px;
-  left: 50%;
-  transform: translate(-50%, 0);
+  left: 0;
+  right: 0;
+  display: flex;
+  justify-content: center;
+  z-index: 999;
+}
+
+.flash-message {
   display: flex;
   align-items: center;
   justify-content: center;
@@ -20,11 +27,11 @@
   padding: $pad-small $pad-medium;
   z-index: 999;
   background-color: $core-vibrant-blue;
-  margin: auto;
   border: 1px solid $ui-fleet-black-10;
   box-sizing: border-box;
   box-shadow: 0px 7px 3px -5px rgba(25, 33, 71, 0.1);
   border-radius: 8px;
+  max-width: calc(100% - 64px); // Same horizontal margin as .main-content
 
   &--success {
     background-color: $ui-success;
@@ -42,7 +49,6 @@
       margin-right: 15px;
       font-size: $x-small;
       color: $core-fleet-black;
-      white-space: nowrap;
     }
   }
 
@@ -54,7 +60,6 @@
       margin-left: 15px;
       margin-right: 15px;
       font-size: $x-small;
-      white-space: nowrap;
     }
 
     .fleeticon {
@@ -65,6 +70,10 @@
       width: 16px;
       height: 16px;
     }
+
+    a {
+      color: inherit;
+    }
   }
 
   &__undo {
diff --git a/frontend/components/FleetAce/FleetAce.tsx b/frontend/components/FleetAce/FleetAce.tsx
index c30232cb596b..b0422d4cde21 100644
--- a/frontend/components/FleetAce/FleetAce.tsx
+++ b/frontend/components/FleetAce/FleetAce.tsx
@@ -29,6 +29,7 @@ export interface IFleetAceProps {
   label?: string;
   name?: string;
   value?: string;
+  placeholder?: string;
   readOnly?: boolean;
   maxLines?: number;
   showGutter?: boolean;
@@ -55,6 +56,7 @@ const FleetAce = ({
   labelActionComponent,
   name = "query-editor",
   value,
+  placeholder,
   readOnly,
   maxLines = 20,
   showGutter = true,
@@ -266,6 +268,7 @@ const FleetAce = ({
         showPrintMargin={false}
         theme="fleet"
         value={value}
+        placeholder={placeholder}
         width="100%"
         wrapEnabled={wrapEnabled}
         style={style}
diff --git a/frontend/components/FleetAce/_styles.scss b/frontend/components/FleetAce/_styles.scss
index c12237a3a771..f9f0dccf8960 100644
--- a/frontend/components/FleetAce/_styles.scss
+++ b/frontend/components/FleetAce/_styles.scss
@@ -25,6 +25,16 @@
     }
   }
 
+  .ace_content {
+    padding-left: 4px;
+  }
+
+  .ace_placeholder {
+    font-family: "SourceCodePro", $monospace;
+    margin: initial;
+    font-size: 15px;
+  }
+
   &__help-text {
     @include help-text;
 
diff --git a/frontend/components/InfoBanner/InfoBanner.tsx b/frontend/components/InfoBanner/InfoBanner.tsx
index 74e72c899797..8ab31c103a6c 100644
--- a/frontend/components/InfoBanner/InfoBanner.tsx
+++ b/frontend/components/InfoBanner/InfoBanner.tsx
@@ -87,7 +87,11 @@ const InfoBanner = ({
     );
   }
 
-  return <div className={wrapperClasses}>{content}</div>;
+  return (
+    <div className={wrapperClasses} role="status">
+      {content}
+    </div>
+  );
 };
 
 export default InfoBanner;
diff --git a/frontend/components/LicenseExpirationBanner/_styles.scss b/frontend/components/LicenseExpirationBanner/_styles.scss
deleted file mode 100644
index f5ed0dc99d60..000000000000
--- a/frontend/components/LicenseExpirationBanner/_styles.scss
+++ /dev/null
@@ -1,5 +0,0 @@
-.license-expiry-banner {
-  margin-bottom: $pad-large;
-  position: sticky; // Needed for settings page scroll
-  z-index: 4; // Needed for settings page scroll
-}
diff --git a/frontend/components/MDM/AppleBMRenewalMessage/AppleBMRenewalMessage.tsx b/frontend/components/MDM/AppleBMRenewalMessage/AppleBMRenewalMessage.tsx
index 819b6f4dc704..c64031d51f1e 100644
--- a/frontend/components/MDM/AppleBMRenewalMessage/AppleBMRenewalMessage.tsx
+++ b/frontend/components/MDM/AppleBMRenewalMessage/AppleBMRenewalMessage.tsx
@@ -16,10 +16,9 @@ const AppleBMRenewalMessage = ({ expired }: IAppleBMRenewalMessageProps) => {
       color="yellow"
       cta={
         <CustomLink
-          url="https://fleetdm.com/learn-more-about/renew-abm"
+          url="/settings/integrations/mdm/abm"
           text="Renew ABM"
-          className={`${baseClass}__new-tab`}
-          newTab
+          className={`${baseClass}`}
           color="core-fleet-black"
           iconColor="core-fleet-black"
         />
@@ -27,14 +26,16 @@ const AppleBMRenewalMessage = ({ expired }: IAppleBMRenewalMessageProps) => {
     >
       {expired ? (
         <>
-          Your Apple Business Manager (ABM) server token has expired or is
-          invalid. New macOS hosts will not automatically enroll to Fleet.
+          Your Apple Business Manager (ABM) server token has expired. macOS,
+          iOS, and iPadOS hosts won’t automatically enroll to Fleet. Users with
+          the admin role in Fleet can renew ABM.
         </>
       ) : (
         <>
           Your Apple Business Manager (ABM) server token is less than 30 days
-          from expiration. If it expires, new macOS hosts will not automatically
-          enroll to Fleet.
+          from expiration. If it expires, macOS, iOS, and iPadOS hosts won’t
+          automatically enroll to Fleet. Users with the admin role in Fleet can
+          renew ABM.
         </>
       )}
     </InfoBanner>
diff --git a/frontend/components/MDM/AppleBMRenewalMessage/_styles.scss b/frontend/components/MDM/AppleBMRenewalMessage/_styles.scss
deleted file mode 100644
index de792329db6b..000000000000
--- a/frontend/components/MDM/AppleBMRenewalMessage/_styles.scss
+++ /dev/null
@@ -1,5 +0,0 @@
-.apple-bm-renewal-message {
-  margin-bottom: $pad-large;
-  position: sticky; // Needed for settings page scroll
-  z-index: 4; // Needed for settings page scroll
-}
diff --git a/frontend/components/MDM/AppleBMTermsMessage/AppleBMTermsMessage.tsx b/frontend/components/MDM/AppleBMTermsMessage/AppleBMTermsMessage.tsx
index 432f88e55cf6..6fcff4be6716 100644
--- a/frontend/components/MDM/AppleBMTermsMessage/AppleBMTermsMessage.tsx
+++ b/frontend/components/MDM/AppleBMTermsMessage/AppleBMTermsMessage.tsx
@@ -12,7 +12,7 @@ const AppleBMTermsMessage = () => {
       color="yellow"
       cta={
         <CustomLink
-          url="https://business.apple.com/"
+          url="https://business.apple.com/" // TODO: maybe point to new /settings/integrations/mdm/abm
           text="Go to ABM"
           className={`${baseClass}__new-tab`}
           newTab
@@ -21,10 +21,9 @@ const AppleBMTermsMessage = () => {
         />
       }
     >
-      Your organization can&apos;t automatically enroll macOS hosts until you
-      accept the new terms and conditions for Apple Business Manager (ABM). An
-      ABM administrator can accept these terms. Done? It might take some time
-      for ABM to report back to Fleet.
+      You can’t automatically enroll macOS, iOS, and iPadOS hosts until you
+      accept the new terms and conditions for your Apple Business Manager (ABM).
+      An ABM administrator can accept these terms.
     </InfoBanner>
   );
 };
diff --git a/frontend/components/MDM/AppleBMTermsMessage/_styles.scss b/frontend/components/MDM/AppleBMTermsMessage/_styles.scss
deleted file mode 100644
index 6cdee07c808f..000000000000
--- a/frontend/components/MDM/AppleBMTermsMessage/_styles.scss
+++ /dev/null
@@ -1,5 +0,0 @@
-.apple-bm-terms-message {
-  margin-bottom: $pad-large;
-  position: sticky; // Needed for settings page scroll
-  z-index: 4; // Needed for settings page scroll
-}
diff --git a/frontend/components/MDM/ApplePNCertRenewalMessage/_styles.scss b/frontend/components/MDM/ApplePNCertRenewalMessage/_styles.scss
deleted file mode 100644
index aec4323e0cd6..000000000000
--- a/frontend/components/MDM/ApplePNCertRenewalMessage/_styles.scss
+++ /dev/null
@@ -1,5 +0,0 @@
-.apple-pn-cert-renewal-message {
-  margin-bottom: $pad-large;
-  position: sticky; // Needed for settings page scroll
-  z-index: 4; // Needed for settings page scroll
-}
diff --git a/frontend/components/MainContent/MainContent.tsx b/frontend/components/MainContent/MainContent.tsx
index 2215cdc79f2c..6733a437cb7f 100644
--- a/frontend/components/MainContent/MainContent.tsx
+++ b/frontend/components/MainContent/MainContent.tsx
@@ -11,6 +11,7 @@ import { AppContext } from "context/app";
 import LicenseExpirationBanner from "components/LicenseExpirationBanner";
 import ApplePNCertRenewalMessage from "components/MDM/ApplePNCertRenewalMessage";
 import AppleBMRenewalMessage from "components/MDM/AppleBMRenewalMessage";
+import VppRenewalMessage from "./banners/VppRenewalMessage";
 
 interface IMainContentProps {
   children: ReactNode;
@@ -36,8 +37,13 @@ const MainContent = ({
     config,
     isPremiumTier,
     noSandboxHosts,
-    apnsExpiry,
-    abmExpiry,
+    isApplePnsExpired,
+    isAppleBmExpired,
+    isVppExpired,
+    needsAbmTermsRenewal,
+    willAppleBmExpire,
+    willApplePnsExpire,
+    willVppExpire,
   } = useContext(AppContext);
 
   const sandboxExpiryTime =
@@ -46,40 +52,31 @@ const MainContent = ({
       : formatDistanceToNow(new Date(sandboxExpiry));
 
   const renderAppWideBanner = () => {
-    const isAppleBmTermsExpired = config?.mdm?.apple_bm_terms_expired;
-    const isApplePnsExpired = hasLicenseExpired(apnsExpiry || "");
-    const willApplePnsExpireIn30Days = willExpireWithinXDays(
-      apnsExpiry || "",
-      30
-    );
-    const isAppleBmExpired = hasLicenseExpired(abmExpiry || ""); // NOTE: See Rachel's related FIXME added to App.tsx in https://github.com/fleetdm/fleet/pull/19571
-    const willAppleBmExpireIn30Days = willExpireWithinXDays(
-      abmExpiry || "",
-      30
-    );
     const isFleetLicenseExpired = hasLicenseExpired(
       config?.license.expiration || ""
     );
 
-    if (isPremiumTier) {
-      if (isApplePnsExpired || willApplePnsExpireIn30Days) {
-        return <ApplePNCertRenewalMessage expired={isApplePnsExpired} />;
-      }
+    let banner: JSX.Element | null = null;
 
-      if (isAppleBmExpired || willAppleBmExpireIn30Days) {
-        return <AppleBMRenewalMessage expired={isAppleBmExpired} />;
-      }
-
-      if (isAppleBmTermsExpired) {
-        return <AppleBMTermsMessage />;
+    if (isPremiumTier) {
+      if (isApplePnsExpired || willApplePnsExpire) {
+        banner = <ApplePNCertRenewalMessage expired={isApplePnsExpired} />;
+      } else if (isAppleBmExpired || willAppleBmExpire) {
+        banner = <AppleBMRenewalMessage expired={isAppleBmExpired} />;
+      } else if (needsAbmTermsRenewal) {
+        banner = <AppleBMTermsMessage />;
+      } else if (isVppExpired || willVppExpire) {
+        banner = <VppRenewalMessage expired={isVppExpired} />;
+      } else if (isFleetLicenseExpired) {
+        banner = <LicenseExpirationBanner />;
       }
+    }
 
-      if (isFleetLicenseExpired) {
-        return <LicenseExpirationBanner />;
-      }
+    if (banner) {
+      return <div className={`${baseClass}__warning-banner`}>{banner}</div>;
     }
 
-    return <></>;
+    return null;
   };
   return (
     <div className={classes}>
diff --git a/frontend/components/MainContent/_styles.scss b/frontend/components/MainContent/_styles.scss
index a8e15e26f1d3..bbece996d765 100644
--- a/frontend/components/MainContent/_styles.scss
+++ b/frontend/components/MainContent/_styles.scss
@@ -10,4 +10,11 @@
   > :not(.main-content--animation-disabled) {
     animation: fade-in 250ms ease-out;
   }
+
+  &__warning-banner {
+    margin-bottom: $pad-large;
+    // TODO: figure out if sticky styling is needed?
+    position: sticky; // Needed for settings page scroll
+    z-index: 4; // Needed for settings page scroll
+  }
 }
diff --git a/frontend/components/MainContent/banners/VppRenewalMessage/VppRenewalMessage.tsx b/frontend/components/MainContent/banners/VppRenewalMessage/VppRenewalMessage.tsx
new file mode 100644
index 000000000000..8980f485f278
--- /dev/null
+++ b/frontend/components/MainContent/banners/VppRenewalMessage/VppRenewalMessage.tsx
@@ -0,0 +1,45 @@
+import React from "react";
+
+import CustomLink from "components/CustomLink";
+import InfoBanner from "components/InfoBanner";
+
+const baseClass = "vpp-renewal-message";
+
+interface IVppRenewalMessageProps {
+  expired: boolean;
+}
+
+const VppRenewalMessage = ({ expired }: IVppRenewalMessageProps) => {
+  return (
+    <InfoBanner
+      className={baseClass}
+      color="yellow"
+      cta={
+        <CustomLink
+          url="/settings/integrations/mdm/vpp"
+          text="Renew VPP"
+          className={`${baseClass}`}
+          color="core-fleet-black"
+          iconColor="core-fleet-black"
+        />
+      }
+    >
+      {expired ? (
+        <>
+          Your Volume Purchasing Program (VPP) content token has expired. You
+          can’t add or install App Store apps. Users with the admin role in
+          Fleet can renew VPP.
+        </>
+      ) : (
+        <>
+          Your Volume Purchasing Program (VPP) content token is less than 30
+          days from expiration. If it expires, you won’t be able to add or
+          install App Store apps. Users with the admin role in Fleet can renew
+          VPP.
+        </>
+      )}
+    </InfoBanner>
+  );
+};
+
+export default VppRenewalMessage;
diff --git a/frontend/components/MainContent/banners/VppRenewalMessage/index.ts b/frontend/components/MainContent/banners/VppRenewalMessage/index.ts
new file mode 100644
index 000000000000..0a8279397cbd
--- /dev/null
+++ b/frontend/components/MainContent/banners/VppRenewalMessage/index.ts
@@ -0,0 +1 @@
+export { default } from "./VppRenewalMessage";
diff --git a/frontend/components/Modal/Modal.tsx b/frontend/components/Modal/Modal.tsx
index 8d96a3781815..d69c10c481f5 100644
--- a/frontend/components/Modal/Modal.tsx
+++ b/frontend/components/Modal/Modal.tsx
@@ -12,12 +12,25 @@ export interface IModalProps {
   children: JSX.Element;
   onExit: () => void;
   onEnter?: () => void;
-  /**     default 650px, large 800px, xlarge 850px, auto auto-width */
+  /**     medium 650px, large 800px, xlarge 850px, auto auto-width
+   * @default "medium"
+   */
   width?: ModalWidth;
-  /**    isHidden can be set true to hide the modal when opening another modal */
+  /**    isHidden can be set true to hide the modal when opening another modal
+   * @default false
+   */
   isHidden?: boolean;
-  /**    isLoading can be set true to enable targeting elements by loading state */
+  /**    isLoading can be set true to enable targeting elements by loading state
+   * @default false
+   */
   isLoading?: boolean;
+  /** `isContentDisabled` can be set to true to display the modal content as disabled.
+   * At the moment this will place an overlay over the modal content and make it
+   * unclickable. The top right will not be disabled and will still be clickable.
+   *
+   * @default false
+   */
+  isContentDisabled?: boolean;
   className?: string;
 }
 
@@ -29,6 +42,7 @@ const Modal = ({
   width = "medium",
   isHidden = false,
   isLoading = false,
+  isContentDisabled = false,
   className,
 }: IModalProps): JSX.Element => {
   useEffect(() => {
@@ -61,26 +75,30 @@ const Modal = ({
     }
   }, [onEnter]);
 
-  const modalContainerClassName = classnames(
-    `${baseClass}__modal_container`,
+  const backgroundClasses = classnames(`${baseClass}__background`, {
+    [`${baseClass}__hidden`]: isHidden,
+  });
+
+  const modalContainerClasses = classnames(
     className,
-    { [`${baseClass}__modal_container__medium`]: width === "medium" },
-    { [`${baseClass}__modal_container__large`]: width === "large" },
-    { [`${baseClass}__modal_container__xlarge`]: width === "xlarge" },
-    { [`${baseClass}__modal_container__auto`]: width === "auto" }
+    `${baseClass}__modal_container`,
+    `${baseClass}__modal_container__${width}`,
+    {
+      [`${className}__loading`]: isLoading,
+    }
   );
 
+  const contentWrapperClasses = classnames(`${baseClass}__content-wrapper`, {
+    [`${baseClass}__content-wrapper-disabled`]: isContentDisabled,
+  });
+
+  const contentClasses = classnames(`${baseClass}__content`, {
+    [`${baseClass}__content-disabled`]: isContentDisabled,
+  });
+
   return (
-    <div
-      className={`${baseClass}__background ${
-        isHidden ? `${baseClass}__hidden` : ""
-      }`}
-    >
-      <div
-        className={`${modalContainerClassName} ${
-          isLoading ? `${className}__loading` : ""
-        }`}
-      >
+    <div className={backgroundClasses}>
+      <div className={modalContainerClasses}>
         <div className={`${baseClass}__header`}>
           <span>{title}</span>
           <div className={`${baseClass}__ex`}>
@@ -89,7 +107,13 @@ const Modal = ({
             </Button>
           </div>
         </div>
-        <div className={`${baseClass}__content`}>{children}</div>
+
+        <div className={contentWrapperClasses}>
+          {isContentDisabled && (
+            <div className={`${baseClass}__disabled-overlay`} />
+          )}
+          <div className={contentClasses}>{children}</div>
+        </div>
       </div>
     </div>
   );
diff --git a/frontend/components/Modal/_styles.scss b/frontend/components/Modal/_styles.scss
index 33fc9939eba6..04dc539176cd 100644
--- a/frontend/components/Modal/_styles.scss
+++ b/frontend/components/Modal/_styles.scss
@@ -16,7 +16,7 @@
     }
   }
 
-  &__content {
+  &__content-wrapper {
     margin-top: $pad-large;
     font-size: $x-small;
 
@@ -100,4 +100,21 @@
       width: auto;
     }
   }
+
+  // these styles are for the modal content when it is disabled
+  &__content-wrapper-disabled {
+    position: relative;
+  }
+
+  &__content-disabled {
+    transition: opacity 150ms ease-in-out;
+    opacity: 0.5; // this adds a disabled effect to the modal content
+  }
+
+  &__disabled-overlay {
+    position: absolute;
+    height: 100%;
+    width: 100%;
+    z-index: 1000;
+  }
 }
diff --git a/frontend/components/Pagination/Pagination.jsx b/frontend/components/Pagination/Pagination.jsx
index 26f699632364..9f3b88db3b1c 100644
--- a/frontend/components/Pagination/Pagination.jsx
+++ b/frontend/components/Pagination/Pagination.jsx
@@ -25,6 +25,10 @@ class Pagination extends PureComponent {
   };
 
   disableNext = () => {
+    // NOTE: Disable next page is passed through from api metadata
+    if (this.props.disableNextPage !== undefined) {
+      return this.props.disableNextPage;
+    }
     // NOTE: not sure why resultsOnCurrentPage is getting assigned undefined.
     // but this seems to work when there is no data in the table.
     return (
diff --git a/frontend/components/PremiumFeatureMessage/PremiumFeatureMessage.tsx b/frontend/components/PremiumFeatureMessage/PremiumFeatureMessage.tsx
index 40a7fbf775e2..7b07e1dc201a 100644
--- a/frontend/components/PremiumFeatureMessage/PremiumFeatureMessage.tsx
+++ b/frontend/components/PremiumFeatureMessage/PremiumFeatureMessage.tsx
@@ -6,10 +6,23 @@ import Icon from "components/Icon";
 
 interface IPremiumFeatureMessage {
   className?: string;
+  /** Aligns premium message, default: centered */
+  alignment?: "left";
 }
 
-const PremiumFeatureMessage = ({ className }: IPremiumFeatureMessage) => {
-  const classes = classnames("premium-feature-message-container", className);
+const baseClass = "premium-feature-message-container";
+
+const PremiumFeatureMessage = ({
+  className,
+  alignment,
+}: IPremiumFeatureMessage) => {
+  const classes = classnames(
+    baseClass,
+    {
+      [`${baseClass}__align-${alignment}`]: alignment !== undefined,
+    },
+    className
+  );
 
   return (
     <div className={classes}>
diff --git a/frontend/components/PremiumFeatureMessage/_styles.scss b/frontend/components/PremiumFeatureMessage/_styles.scss
index f24d2364a120..c8a895d785bb 100644
--- a/frontend/components/PremiumFeatureMessage/_styles.scss
+++ b/frontend/components/PremiumFeatureMessage/_styles.scss
@@ -4,6 +4,11 @@
   align-items: center;
   font-size: $x-small;
 
+  &__align-left {
+    justify-content: left;
+    align-items: left;
+  }
+
   .premium-feature-message {
     display: flex;
     gap: 4px;
@@ -18,10 +23,6 @@
       display: flex;
       gap: 4px;
       align-items: center;
-
-      .custom-link {
-        font-weight: normal;
-      }
     }
   }
 }
diff --git a/frontend/components/QueryFrequencyIndicator/_styles.scss b/frontend/components/QueryFrequencyIndicator/_styles.scss
index 8559b82ec2c8..b10b18973144 100644
--- a/frontend/components/QueryFrequencyIndicator/_styles.scss
+++ b/frontend/components/QueryFrequencyIndicator/_styles.scss
@@ -1,12 +1,12 @@
 .query-frequency-indicator {
   width: 90px;
-  display: flex;
   align-items: center;
   text-overflow: ellipsis;
   overflow: hidden;
   white-space: nowrap;
 
   .icon {
+    vertical-align: middle;
     padding-right: $pad-small;
   }
 }
diff --git a/frontend/components/StatusIndicator/StatusIndicator.tsx b/frontend/components/StatusIndicator/StatusIndicator.tsx
index 236d3139cce4..bd573ea455cb 100644
--- a/frontend/components/StatusIndicator/StatusIndicator.tsx
+++ b/frontend/components/StatusIndicator/StatusIndicator.tsx
@@ -1,17 +1,32 @@
-import React from "react";
+import React, { ReactNode } from "react";
 import classnames from "classnames";
 import { DEFAULT_EMPTY_CELL_VALUE } from "utilities/constants";
 import TooltipWrapper from "components/TooltipWrapper";
 import { capitalize } from "lodash";
 
+const baseClass = "status-indicator";
+
+export type IIndicatorValue = "success" | "warning" | "error" | "indeterminate";
+
 interface IStatusIndicatorProps {
-  /** Only the first letter of value will be capitalized by the component */
+  /** Only the first letter of value will be capitalized by the component.
+   * NOTE: Do not rely on the value prop to determine the status indicator. Use the
+   * `indicator` prop instead.
+   */
   value: string;
+  /** The indicator type allows for showing the desired indicator.
+   * NOTE: use this instead relying on the `value` prop to determine the indicator.
+   */
+  indicator?: IIndicatorValue;
   tooltip?: {
-    tooltipText: string | JSX.Element;
+    tooltipText: ReactNode;
     position?: "top" | "bottom";
   };
+  /**
+   * @deprecated Use `indicator` instead to show the desired indicator.
+   */
   customIndicatorType?: string;
+  className?: string;
 }
 
 const generateIndicatorStateClassTag = (
@@ -27,17 +42,22 @@ const generateIndicatorStateClassTag = (
 
 const StatusIndicator = ({
   value,
+  indicator,
   tooltip,
   customIndicatorType,
+  className,
 }: IStatusIndicatorProps): JSX.Element => {
   const indicatorStateClassTag = generateIndicatorStateClassTag(
     value,
     customIndicatorType
   );
-  const indicatorClassNames = classnames(
-    "status-indicator",
-    `status-indicator--${indicatorStateClassTag}`,
-    `status--${indicatorStateClassTag}`
+
+  const classes = classnames(
+    baseClass,
+    className,
+    `${baseClass}--${indicatorStateClassTag}`,
+    `status--${indicatorStateClassTag}`,
+    indicator ? `${baseClass}--${indicator}` : null
   );
 
   const capitalizedValue = capitalize(value);
@@ -56,7 +76,7 @@ const StatusIndicator = ({
     capitalizedValue
   );
 
-  return <span className={indicatorClassNames}>{indicatorContent}</span>;
+  return <span className={classes}>{indicatorContent}</span>;
 };
 
 export default StatusIndicator;
diff --git a/frontend/components/StatusIndicator/_styles.scss b/frontend/components/StatusIndicator/_styles.scss
index b601663c1b86..ebe03cc19091 100644
--- a/frontend/components/StatusIndicator/_styles.scss
+++ b/frontend/components/StatusIndicator/_styles.scss
@@ -11,6 +11,38 @@
     min-width: 8px;
   }
 
+  // New indicator styles
+  &--success {
+    &:before {
+      background-color: $ui-success;
+    }
+  }
+
+  &--warning {
+    &:before {
+      background-color: $ui-warning;
+    }
+  }
+
+  &--error {
+    &:before {
+      background-color: $ui-error;
+    }
+  }
+
+  &--indeterminate {
+    &:before {
+      background-color: $ui-offline;
+    }
+  }
+
+
+  // NOTE: We will move away from styling the indicator status depending
+  // on the value passed to the component. Instead we have added an `indicator`
+  // prop that will allow us explicitly define the desired status. This makes
+  // the component more flexible and easier to use. The next two blocks of
+  // styles (host status and user status) will be removed in the future.
+
   // host status
   &--online:before,
   &--enabled:before,
@@ -39,8 +71,4 @@
       background-color: $ui-warning;
     }
   }
-
-  .component__tooltip-wrapper__tip-text {
-    text-align: center;
-  }
 }
diff --git a/frontend/components/TableContainer/DataTable/DataTable.tests.tsx b/frontend/components/TableContainer/DataTable/DataTable.tests.tsx
index 424f4982b267..ce10b6e70c6c 100644
--- a/frontend/components/TableContainer/DataTable/DataTable.tests.tsx
+++ b/frontend/components/TableContainer/DataTable/DataTable.tests.tsx
@@ -165,4 +165,69 @@ describe("DataTable - component", () => {
     expect(firstNameInTableCell).toHaveTextContent("bar user");
     expect(secondNameInTableCell).toHaveTextContent("foo user");
   });
+
+  it("does not render help text when no rows are present", () => {
+    const columns = [
+      {
+        title: "Name",
+        Header: "Name",
+        accessor: "name",
+        disableHidden: false,
+      },
+    ];
+
+    const data: any = [];
+
+    render(
+      <DataTable
+        columns={columns}
+        data={data}
+        sortHeader="name"
+        sortDirection="desc"
+        isLoading
+        onSort={noop}
+        showMarkAllPages={false}
+        isAllPagesSelected={false}
+        resultsTitle="users"
+        defaultPageSize={DEFAULT_PAGE_SIZE}
+        disableMultiRowSelect={false}
+        renderTableHelpText={() => <div>Help text</div>}
+      />
+    );
+
+    const helpText = screen.queryByText("Help text");
+    expect(helpText).toBeNull();
+  });
+  it("renders help text when rows are present", () => {
+    const columns = [
+      {
+        title: "Name",
+        Header: "Name",
+        accessor: "name",
+        disableHidden: false,
+      },
+    ];
+
+    const data = [{ name: "Gabe" }];
+
+    render(
+      <DataTable
+        columns={columns}
+        data={data}
+        sortHeader="name"
+        sortDirection="desc"
+        isLoading={false}
+        onSort={noop}
+        showMarkAllPages={false}
+        isAllPagesSelected={false}
+        resultsTitle="users"
+        defaultPageSize={DEFAULT_PAGE_SIZE}
+        disableMultiRowSelect={false}
+        renderTableHelpText={() => <div>Help text</div>}
+      />
+    );
+
+    const helpText = screen.getByText("Help text");
+    expect(helpText).toBeInTheDocument();
+  });
 });
diff --git a/frontend/components/TableContainer/DataTable/DataTable.tsx b/frontend/components/TableContainer/DataTable/DataTable.tsx
index 8f8906ee1c6b..43bde85890ef 100644
--- a/frontend/components/TableContainer/DataTable/DataTable.tsx
+++ b/frontend/components/TableContainer/DataTable/DataTable.tsx
@@ -58,7 +58,9 @@ interface IDataTableProps {
   onSelectSingleRow?: (value: Row) => void;
   onClickRow?: (value: any) => void;
   onResultsCountChange?: (value: number) => void;
-  renderFooter?: () => JSX.Element | null;
+  /** Optional help text to render on bottom-left of the table. Hidden when table is loading and no
+   * rows of data are present. */
+  renderTableHelpText?: () => JSX.Element | null;
   renderPagination?: () => JSX.Element | null;
   setExportRows?: (rows: Row[]) => void;
 }
@@ -100,7 +102,7 @@ const DataTable = ({
   onSelectSingleRow,
   onClickRow,
   onResultsCountChange,
-  renderFooter,
+  renderTableHelpText,
   renderPagination,
   setExportRows,
 }: IDataTableProps): JSX.Element => {
@@ -443,6 +445,7 @@ const DataTable = ({
 
   const tableStyles = classnames({
     "data-table__table": true,
+    "data-table__no-rows": !rows.length,
     "is-observer": isOnlyObserver,
   });
 
@@ -554,8 +557,10 @@ const DataTable = ({
         </table>
       </div>
       <div className={`${baseClass}__footer`}>
-        {renderFooter && (
-          <div className={`${baseClass}__footer-text`}>{renderFooter()}</div>
+        {renderTableHelpText && !!rows?.length && (
+          <div className={`${baseClass}__table-help-text`}>
+            {renderTableHelpText()}
+          </div>
         )}
         {isClientSidePagination ? (
           <div className={`${baseClass}__pagination`}>
diff --git a/frontend/components/TableContainer/DataTable/SoftwareNameCell/SoftwareNameCell.tsx b/frontend/components/TableContainer/DataTable/SoftwareNameCell/SoftwareNameCell.tsx
index 38fc05db8293..d8301b9b8b11 100644
--- a/frontend/components/TableContainer/DataTable/SoftwareNameCell/SoftwareNameCell.tsx
+++ b/frontend/components/TableContainer/DataTable/SoftwareNameCell/SoftwareNameCell.tsx
@@ -61,6 +61,7 @@ interface ISoftwareNameCellProps {
   router?: InjectedRouter;
   hasPackage?: boolean;
   isSelfService?: boolean;
+  iconUrl?: string;
 }
 
 const SoftwareNameCell = ({
@@ -70,6 +71,7 @@ const SoftwareNameCell = ({
   router,
   hasPackage = false,
   isSelfService = false,
+  iconUrl,
 }: ISoftwareNameCellProps) => {
   // NO path or router means it's not clickable. return
   // a non-clickable cell early
@@ -95,7 +97,7 @@ const SoftwareNameCell = ({
       customOnClick={onClickSoftware}
       value={
         <>
-          <SoftwareIcon name={name} source={source} />
+          <SoftwareIcon name={name} source={source} url={iconUrl} />
           <span className="software-name">{name}</span>
           {hasPackage && (
             <InstallIconWithTooltip isSelfService={isSelfService} />
diff --git a/frontend/components/TableContainer/DataTable/TextCell/TextCell.tsx b/frontend/components/TableContainer/DataTable/TextCell/TextCell.tsx
index 1761cd41142a..565ad1c82401 100644
--- a/frontend/components/TableContainer/DataTable/TextCell/TextCell.tsx
+++ b/frontend/components/TableContainer/DataTable/TextCell/TextCell.tsx
@@ -7,7 +7,7 @@ import { DEFAULT_EMPTY_CELL_VALUE } from "utilities/constants";
 
 const baseClass = "text-cell";
 interface ITextCellProps {
-  value?: string | number | boolean | { timeString: string } | null;
+  value?: React.ReactNode | { timeString: string };
   formatter?: (val: any) => React.ReactNode; // string, number, or null
   grey?: boolean;
   italic?: boolean;
diff --git a/frontend/components/TableContainer/DataTable/TooltipTruncatedTextCell/TooltipTruncatedTextCell.tsx b/frontend/components/TableContainer/DataTable/TooltipTruncatedTextCell/TooltipTruncatedTextCell.tsx
index 0a787181468a..995665a66935 100644
--- a/frontend/components/TableContainer/DataTable/TooltipTruncatedTextCell/TooltipTruncatedTextCell.tsx
+++ b/frontend/components/TableContainer/DataTable/TooltipTruncatedTextCell/TooltipTruncatedTextCell.tsx
@@ -1,4 +1,4 @@
-import React from "react";
+import React, { useState, useRef, useLayoutEffect } from "react";
 import { uniqueId } from "lodash";
 import classnames from "classnames";
 
@@ -8,13 +8,11 @@ import { COLORS } from "styles/var/colors";
 
 interface ITooltipTruncatedTextCellProps {
   value: React.ReactNode;
-  /** Tooltip to dispay. If this is provided then this will be rendered as the tooltip content. If
-   * not, the value will be displayed as the tooltip content. Defaults to `undefined` */
+  /** Tooltip to display. If this is provided then this will be rendered as the tooltip content. If
+   * not, the value will be displayed as the tooltip content. Default: undefined */
   tooltip?: React.ReactNode;
   /** If set to `true` the text inside the tooltip will break on words instead of any character.
-   * By default the tooltip text breaks on any character.
-   * Default is `false`.
-   */
+   * By default the tooltip text breaks on any character. Default: false */
   tooltipBreakOnWord?: boolean;
   /** @deprecated use the prop `className` in order to add custom classes to this component */
   classes?: string;
@@ -34,20 +32,35 @@ const TooltipTruncatedTextCell = ({
     "tooltip-break-on-word": tooltipBreakOnWord,
   });
 
+  // Tooltip visibility logic: Enable only when text is truncated
+  const ref = useRef<HTMLInputElement>(null);
+  const [tooltipDisabled, setTooltipDisabled] = useState(true);
+
+  useLayoutEffect(() => {
+    if (ref?.current !== null) {
+      const scrollWidth = ref.current.scrollWidth;
+      const offsetWidth = ref.current.offsetWidth;
+      setTooltipDisabled(scrollWidth <= offsetWidth);
+    }
+  }, [ref]);
+  // End
+
   const tooltipId = uniqueId();
   const isDefaultValue = value === DEFAULT_EMPTY_CELL_VALUE;
+
   return (
     <div className={classNames}>
       <div
         className="data-table__tooltip-truncated-text"
         data-tip
         data-for={tooltipId}
-        data-tip-disable={isDefaultValue}
+        data-tip-disable={isDefaultValue || tooltipDisabled}
       >
         <span
+          ref={ref}
           className={`data-table__tooltip-truncated-text--cell ${
             isDefaultValue ? "text-muted" : ""
-          } `}
+          } ${tooltipDisabled ? "" : "truncated"}`}
         >
           {value}
         </span>
diff --git a/frontend/components/TableContainer/DataTable/TooltipTruncatedTextCell/_styles.scss b/frontend/components/TableContainer/DataTable/TooltipTruncatedTextCell/_styles.scss
index 8d47e73e4217..fecad0a775fc 100644
--- a/frontend/components/TableContainer/DataTable/TooltipTruncatedTextCell/_styles.scss
+++ b/frontend/components/TableContainer/DataTable/TooltipTruncatedTextCell/_styles.scss
@@ -10,9 +10,20 @@
       text-overflow: ellipsis;
       max-width: 101%;
     }
+
+    .truncated {
+      display: inline-block;
+      max-width: 100%;
+      overflow: hidden;
+      text-overflow: ellipsis;
+      vertical-align: middle;
+    }
   }
 
   .truncated-tooltip {
+    text-wrap: wrap;
+    overflow-wrap: break-word;
+
     .safari-hack {
       height: 0px;
     }
diff --git a/frontend/components/TableContainer/DataTable/_styles.scss b/frontend/components/TableContainer/DataTable/_styles.scss
index 230ac590e3bd..ecb3ccce2ef8 100644
--- a/frontend/components/TableContainer/DataTable/_styles.scss
+++ b/frontend/components/TableContainer/DataTable/_styles.scss
@@ -37,6 +37,11 @@ $shadow-transition-width: 10px;
       background-attachment: local, local, scroll, scroll;
       // End shadow
     }
+    
+    // applied to same element as data-table__table while loading
+    &__no-rows {
+      min-height: 272px;
+    }
 
     &__table {
       position: relative;
@@ -46,33 +51,6 @@ $shadow-transition-width: 10px;
       font-size: $x-small;
     }
 
-    tbody {
-      .component__tooltip-wrapper {
-        margin: 10px 0; // vertical padding multiline text with tooltip
-      }
-
-      .component__tooltip-wrapper__element {
-        white-space: initial; // wraps long text with tooltip
-      }
-
-      tr,
-      .single-row {
-        transition: background-color 150ms ease-out;
-        &:hover {
-          background-color: $ui-off-white-opaque; // opaque needed for horizontal scroll shadow
-        }
-      }
-
-      .single-row {
-        &:hover {
-          cursor: pointer;
-        }
-        &:active {
-          background-color: $ui-vibrant-blue-10-opaque; // opaque needed for horizontal scroll shadow
-        }
-      }
-    }
-
     tr {
       border-bottom: 1px solid $ui-fleet-black-10;
 
@@ -205,6 +183,31 @@ $shadow-transition-width: 10px;
     }
 
     tbody {
+      .component__tooltip-wrapper {
+        margin: 10px 0; // vertical padding multiline text with tooltip
+      }
+
+      .component__tooltip-wrapper__element {
+        white-space: initial; // wraps long text with tooltip
+      }
+
+      tr,
+      .single-row {
+        transition: background-color 150ms ease-out;
+        &:hover {
+          background-color: $ui-off-white-opaque; // opaque needed for horizontal scroll shadow
+        }
+      }
+
+      .single-row {
+        &:hover {
+          cursor: pointer;
+        }
+        &:active {
+          background-color: $ui-vibrant-blue-10-opaque; // opaque needed for horizontal scroll shadow
+        }
+      }
+
       td {
         height: 40px;
         padding: 0 $pad-large;
@@ -361,7 +364,7 @@ $shadow-transition-width: 10px;
     align-items: center;
   }
 
-  &__footer-text {
+  &__table-help-text {
     font-size: $x-small;
 
     display: flex;
diff --git a/frontend/components/TableContainer/TableContainer.tsx b/frontend/components/TableContainer/TableContainer.tsx
index 3b68cbb47006..4ba6af202750 100644
--- a/frontend/components/TableContainer/TableContainer.tsx
+++ b/frontend/components/TableContainer/TableContainer.tsx
@@ -45,7 +45,6 @@ interface ITableContainerProps<T = any> {
   disableMultiRowSelect?: boolean;
   /** resultsTitle used in DataTable for matching results text */
   resultsTitle?: string;
-  resultsHtml?: JSX.Element;
   additionalQueries?: string;
   emptyComponent: React.ElementType;
   className?: string;
@@ -82,6 +81,8 @@ interface ITableContainerProps<T = any> {
     | ((queryData: ITableQueryData) => void)
     | ((queryData: ITableQueryData) => number);
   customControl?: () => JSX.Element;
+  /** Filter button right of the search rendering alternative responsive design where search bar moves to new line but filter button remains inline with other table headers */
+  customFiltersButton?: () => JSX.Element;
   stackControls?: boolean;
   onSelectSingleRow?: (value: Row | IRowProps) => void;
   /** This is called when you click on a row. This was added as `onSelectSingleRow`
@@ -93,7 +94,9 @@ interface ITableContainerProps<T = any> {
    * key */
   filters?: Record<string, string | number | boolean>;
   renderCount?: () => JSX.Element | null;
-  renderFooter?: () => JSX.Element | null;
+  /** Optional help text to render on bottom-left of the table. Hidden when table is loading and no
+   * rows of data are present. */
+  renderTableHelpText?: () => JSX.Element | null;
   setExportRows?: (rows: Row[]) => void;
   /** Use for serverside filtering: Set to true when filters change in URL
    * bar and API call so TableContainer will reset its page state to 0  */
@@ -119,7 +122,6 @@ const TableContainer = <T,>({
   inputPlaceHolder = "Search",
   additionalQueries,
   resultsTitle,
-  resultsHtml,
   emptyComponent,
   className,
   disableActionButton,
@@ -146,11 +148,12 @@ const TableContainer = <T,>({
   searchQueryColumn,
   onQueryChange,
   customControl,
+  customFiltersButton,
   stackControls,
   onSelectSingleRow,
   onClickRow,
   renderCount,
-  renderFooter,
+  renderTableHelpText,
   setExportRows,
   resetPageIndex,
   disableTableHeader,
@@ -268,30 +271,15 @@ const TableContainer = <T,>({
     onPaginationChange,
   ]);
 
-  const opacity = isLoading ? { opacity: 0.4 } : { opacity: 1 };
+  const renderFilters = useCallback(() => {
+    const opacity = isLoading ? { opacity: 0.4 } : { opacity: 1 };
 
-  return (
-    <div className={wrapperClasses}>
-      {wideSearch && searchable && (
-        <div className={`${baseClass}__search-input wide-search`}>
-          <SearchField
-            placeholder={inputPlaceHolder}
-            defaultValue={searchQuery}
-            onChange={onSearchQueryChange}
-          />
-        </div>
-      )}
-      {!disableTableHeader && (
-        <div
-          className={`${baseClass}__header ${
-            stackControls ? "stack-table-controls" : ""
-          }`}
-        >
-          <div
-            className={`${baseClass}__header-left ${
-              stackControls ? "stack-table-controls" : ""
-            }`}
-          >
+    // New preferred pattern uses grid container/box to allow for more dynamic responsiveness
+    // At low widths, search bar (3rd div of 4) moves above other 3 divs
+    if (customFiltersButton) {
+      return (
+        <div className="container">
+          <div className="box">
             {renderCount && !disableCount && (
               <div
                 className={`${baseClass}__results-count ${
@@ -302,57 +290,160 @@ const TableContainer = <T,>({
                 {renderCount()}
               </div>
             )}
-            <span className="controls">
-              {actionButton && !actionButton.hideButton && (
-                <Button
-                  disabled={disableActionButton}
-                  onClick={actionButton.onActionButtonClick}
-                  variant={actionButton.variant || "brand"}
-                  className={`${baseClass}__table-action-button`}
-                >
-                  <>
-                    {actionButton.buttonText}
-                    {actionButton.iconSvg && (
-                      <Icon name={actionButton.iconSvg} />
-                    )}
-                  </>
-                </Button>
-              )}
-              {customControl && customControl()}
-            </span>
           </div>
-
-          {/* Render search bar only if not empty component */}
-          {searchable && !wideSearch && (
-            <div className={`${baseClass}__search`}>
-              <div
-                className={`${baseClass}__search-input ${
-                  stackControls ? "stack-table-controls" : ""
-                }`}
-                data-tip
-                data-for="search-tooltip"
-                data-tip-disable={!searchToolTipText}
+          <div className="box">
+            {actionButton && !actionButton.hideButton && (
+              <Button
+                disabled={disableActionButton}
+                onClick={actionButton.onActionButtonClick}
+                variant={actionButton.variant || "brand"}
+                className={`${baseClass}__table-action-button`}
               >
-                <SearchField
-                  placeholder={inputPlaceHolder}
-                  defaultValue={searchQuery}
-                  onChange={onSearchQueryChange}
-                />
+                <>
+                  {actionButton.buttonText}
+                  {actionButton.iconSvg && <Icon name={actionButton.iconSvg} />}
+                </>
+              </Button>
+            )}
+            {customControl && customControl()}
+          </div>
+          <div className="box search">
+            {searchable && !wideSearch && (
+              <div className={`${baseClass}__search`}>
+                <div
+                  className={`${baseClass}__search-input`}
+                  data-tip
+                  data-for="search-tooltip"
+                  data-tip-disable={!searchToolTipText}
+                >
+                  <SearchField
+                    placeholder={inputPlaceHolder}
+                    defaultValue={searchQuery}
+                    onChange={onSearchQueryChange}
+                  />
+                </div>
+                <ReactTooltip
+                  effect="solid"
+                  backgroundColor={COLORS["tooltip-bg"]}
+                  id="search-tooltip"
+                  data-html
+                >
+                  <span className={`tooltip ${baseClass}__tooltip-text`}>
+                    {searchToolTipText}
+                  </span>
+                </ReactTooltip>
               </div>
-              <ReactTooltip
-                effect="solid"
-                backgroundColor={COLORS["tooltip-bg"]}
-                id="search-tooltip"
-                data-html
-              >
-                <span className={`tooltip ${baseClass}__tooltip-text`}>
-                  {searchToolTipText}
-                </span>
-              </ReactTooltip>
-            </div>
-          )}
+            )}
+          </div>
+          <div className="box"> {customFiltersButton()} </div>
         </div>
-      )}
+      );
+    }
+    return (
+      <>
+        {wideSearch && searchable && (
+          <div className={`${baseClass}__search-input wide-search`}>
+            <SearchField
+              placeholder={inputPlaceHolder}
+              defaultValue={searchQuery}
+              onChange={onSearchQueryChange}
+            />
+          </div>
+        )}
+        {!disableTableHeader && (
+          <div
+            className={`${baseClass}__header ${
+              stackControls ? "stack-table-controls" : ""
+            }`}
+          >
+            <div
+              className={`${baseClass}__header-left ${
+                stackControls ? "stack-table-controls" : ""
+              }`}
+            >
+              {renderCount && !disableCount && (
+                <div
+                  className={`${baseClass}__results-count ${
+                    stackControls ? "stack-table-controls" : ""
+                  }`}
+                  style={opacity}
+                >
+                  {renderCount()}
+                </div>
+              )}
+              <span className="controls">
+                {actionButton && !actionButton.hideButton && (
+                  <Button
+                    disabled={disableActionButton}
+                    onClick={actionButton.onActionButtonClick}
+                    variant={actionButton.variant || "brand"}
+                    className={`${baseClass}__table-action-button`}
+                  >
+                    <>
+                      {actionButton.buttonText}
+                      {actionButton.iconSvg && (
+                        <Icon name={actionButton.iconSvg} />
+                      )}
+                    </>
+                  </Button>
+                )}
+                {customControl && customControl()}
+              </span>
+            </div>
+
+            {/* Render search bar only if not empty component */}
+            {searchable && !wideSearch && (
+              <div className={`${baseClass}__search`}>
+                <div
+                  className={`${baseClass}__search-input ${
+                    stackControls ? "stack-table-controls" : ""
+                  }`}
+                  data-tip
+                  data-for="search-tooltip"
+                  data-tip-disable={!searchToolTipText}
+                >
+                  <SearchField
+                    placeholder={inputPlaceHolder}
+                    defaultValue={searchQuery}
+                    onChange={onSearchQueryChange}
+                  />
+                </div>
+                <ReactTooltip
+                  effect="solid"
+                  backgroundColor={COLORS["tooltip-bg"]}
+                  id="search-tooltip"
+                  data-html
+                >
+                  <span className={`tooltip ${baseClass}__tooltip-text`}>
+                    {searchToolTipText}
+                  </span>
+                </ReactTooltip>
+              </div>
+            )}
+          </div>
+        )}
+      </>
+    );
+  }, [
+    actionButton,
+    customControl,
+    customFiltersButton,
+    disableActionButton,
+    disableCount,
+    disableTableHeader,
+    inputPlaceHolder,
+    isLoading,
+    renderCount,
+    searchQuery,
+    searchToolTipText,
+    searchable,
+    stackControls,
+    wideSearch,
+  ]);
+
+  return (
+    <div className={wrapperClasses}>
+      {renderFilters()}
       <div className={`${baseClass}__data-table-block`}>
         {/* No entities for this result. */}
         {(!isLoading && data.length === 0 && !isMultiColumnFilter) ||
@@ -417,7 +508,7 @@ const TableContainer = <T,>({
                 searchQuery={searchQuery}
                 searchQueryColumn={searchQueryColumn}
                 selectedDropdownFilter={selectedDropdownFilter}
-                renderFooter={renderFooter}
+                renderTableHelpText={renderTableHelpText}
                 renderPagination={
                   isClientSidePagination ? undefined : renderPagination
                 }
diff --git a/frontend/components/TableContainer/_styles.scss b/frontend/components/TableContainer/_styles.scss
index 326937a5f510..9abf8769441c 100644
--- a/frontend/components/TableContainer/_styles.scss
+++ b/frontend/components/TableContainer/_styles.scss
@@ -1,4 +1,82 @@
 .table-container {
+  .form-field {
+    width: initial; // 100% causes weird rendering in dropdown
+  }
+
+  // Container is responsive design used when customFilters is rendered
+  .container {
+    display: grid;
+    grid-template-columns: 1fr auto auto; /* First column takes all remaining space */
+    grid-template-rows: auto auto; /* Two rows */
+    width: 100%;
+    height: max-content;
+    gap: $pad-small $pad-medium;
+  }
+
+  .box {
+    min-width: max-content;
+    align-content: center;
+    display: flex;
+    flex-direction: row;
+    gap: $pad-medium;
+
+    > div {
+      display: flex;
+      flex-direction: row;
+    }
+  }
+
+  .search {
+    grid-column: 1 / -1; /* Span across all columns */
+    grid-row: 1; /* Place in the first row */
+  }
+
+  .box:nth-child(1) {
+    grid-column: 1 / span 2; /* Make Box 1 expand across two columns */
+    grid-row: 2;
+  }
+
+  .box:nth-child(2) {
+    grid-column: 2; /* Place Box 2 in the second row, second column */
+    grid-row: 2;
+  }
+
+  .box:nth-child(4) {
+    grid-column: 3; /* Place Box 4 in the second row, third column */
+    grid-row: 2;
+    max-width: min-content;
+  }
+
+  /* Media query for larger screens */
+  @media (min-width: $table-controls-break) {
+    .container {
+      grid-template-columns: 1fr auto auto auto; /* First column takes all remaining space */
+      grid-template-rows: auto; /* Single row */
+    }
+
+    .search {
+      grid-column: 1 / -1; /* Keep spanning across all columns if needed */
+      grid-row: auto;
+    }
+
+    .box:nth-child(1) {
+      grid-column: 1; /* Ensure Box 1 stays in the first column */
+    }
+
+    .box:nth-child(2) {
+      grid-column: 2; /* Place Box 2 in the second column */
+    }
+
+    .box:nth-child(3) {
+      grid-column: 3; /* Place Box 3 in the third column */
+      grid-row: 2;
+    }
+
+    .box:nth-child(4) {
+      grid-column: 4; /* Place Box 4 in the fourth column */
+    }
+  }
+
   // TODO: Fix hacky solution to clientside search being 0 no longer accessing rows.length
   .client-result-count-0 {
     display: none;
@@ -13,16 +91,28 @@
     margin-top: 3px; // Fits button highlight during tabbing
 
     &.stack-table-controls {
-      flex-direction: column-reverse;
       align-items: start;
 
       @media (min-width: $break-xs) {
         flex-direction: row;
         align-items: end;
         justify-content: space-between;
+
+        .table-container__search {
+          order: -2;
+        }
+
+        .table-container__results-count {
+          order: -1;
+        }
       }
+
       @media (min-width: $break-md) {
         align-items: center;
+
+        .table-container__search {
+          order: initial;
+        }
       }
     }
 
@@ -37,16 +127,15 @@
     display: flex;
     width: 100%;
     justify-content: space-between;
+    flex-direction: row;
     align-items: center;
 
     &.stack-table-controls {
-      flex-direction: column-reverse;
+      flex-direction: column;
       align-items: start;
 
       @media (min-width: $break-md) {
-        flex-direction: row;
         justify-content: space-between;
-        align-items: center;
       }
     }
 
diff --git a/frontend/components/TeamsDropdown/TeamsDropdown.tsx b/frontend/components/TeamsDropdown/TeamsDropdown.tsx
index 26b8733ac99d..c7dfa508ac8e 100644
--- a/frontend/components/TeamsDropdown/TeamsDropdown.tsx
+++ b/frontend/components/TeamsDropdown/TeamsDropdown.tsx
@@ -42,7 +42,6 @@ interface ITeamsDropdownProps {
   includeAll?: boolean; // Include the "All Teams" option;
   includeNoTeams?: boolean;
   isDisabled?: boolean;
-  isSandboxMode?: boolean;
   onChange: (newSelectedValue: number) => void;
   onOpen?: () => void;
   onClose?: () => void;
@@ -56,7 +55,6 @@ const TeamsDropdown = ({
   includeAll = true,
   includeNoTeams = false,
   isDisabled = false,
-  isSandboxMode = false,
   onChange,
   onOpen,
   onClose,
@@ -77,43 +75,6 @@ const TeamsDropdown = ({
   });
 
   const renderDropdown = () => {
-    if (isSandboxMode) {
-      const tooltipId = uniqueId();
-      return (
-        <>
-          <span data-tip data-for={tooltipId}>
-            <Dropdown
-              value={selectedValue}
-              placeholder="All teams"
-              options={teamOptions}
-              className={baseClass}
-              searchable={false}
-              disabled
-            />
-          </span>
-          <ReactTooltip
-            type="light"
-            effect="solid"
-            id={tooltipId}
-            clickable
-            delayHide={200}
-            arrowColor="transparent"
-            overridePosition={(pos: { left: number; top: number }) => {
-              return {
-                left: pos.left - 150,
-                top: pos.top + 78,
-              };
-            }}
-          >
-            {`Teams allow you to segment hosts into specific groups of endpoints. This feature is included in Fleet Premium.`}
-            <br />
-            <a href="https://calendly.com/fleetdm/demo">
-              Contact us to learn more.
-            </a>
-          </ReactTooltip>
-        </>
-      );
-    }
     if (teamOptions.length) {
       return (
         <Dropdown
diff --git a/frontend/components/TeamsHeader/TeamsHeader.tsx b/frontend/components/TeamsHeader/TeamsHeader.tsx
index 2e9ee9b67477..72edca3830cf 100644
--- a/frontend/components/TeamsHeader/TeamsHeader.tsx
+++ b/frontend/components/TeamsHeader/TeamsHeader.tsx
@@ -8,7 +8,6 @@ interface ITeamsHeader {
   isOnGlobalTeam?: boolean;
   currentTeamId?: number;
   userTeams?: ITeamSummary[];
-  isSandboxMode?: boolean;
   onTeamChange: (teamId: number) => void;
 }
 
@@ -16,7 +15,6 @@ const TeamsHeader = ({
   isOnGlobalTeam,
   currentTeamId,
   userTeams = [],
-  isSandboxMode = false,
   onTeamChange,
 }: ITeamsHeader) => {
   if (userTeams) {
@@ -26,7 +24,7 @@ const TeamsHeader = ({
           currentUserTeams={userTeams}
           selectedTeamId={currentTeamId}
           onChange={onTeamChange}
-          isSandboxMode={isSandboxMode}
+          includeNoTeams
         />
       );
     }
diff --git a/frontend/components/TooltipTruncatedText/TooltipTruncatedText.tsx b/frontend/components/TooltipTruncatedText/TooltipTruncatedText.tsx
new file mode 100644
index 000000000000..caaee7184b13
--- /dev/null
+++ b/frontend/components/TooltipTruncatedText/TooltipTruncatedText.tsx
@@ -0,0 +1,71 @@
+import React, { useState, useRef, useLayoutEffect } from "react";
+import { uniqueId } from "lodash";
+import classnames from "classnames";
+
+import ReactTooltip from "react-tooltip";
+import { COLORS } from "styles/var/colors";
+
+interface ITooltipTruncatedTextCellProps {
+  value: React.ReactNode;
+  /** Tooltip to display. If this is provided then this will be rendered as the tooltip content. If
+   * not, the value will be displayed as the tooltip content. Default: undefined */
+  tooltip?: React.ReactNode;
+  /** If set to `true` the text inside the tooltip will break on words instead of any character.
+   * By default the tooltip text breaks on any character. Default: false */
+  tooltipBreakOnWord?: boolean;
+  className?: string;
+}
+
+const baseClass = "tooltip-truncated-text";
+
+const TooltipTruncatedText = ({
+  value,
+  tooltip,
+  tooltipBreakOnWord = false,
+  className,
+}: ITooltipTruncatedTextCellProps): JSX.Element => {
+  const classNames = classnames(baseClass, className, {
+    "tooltip-break-on-word": tooltipBreakOnWord,
+  });
+
+  // Tooltip visibility logic: Enable only when text is truncated
+  const ref = useRef<HTMLInputElement>(null);
+  const [tooltipDisabled, setTooltipDisabled] = useState(true);
+
+  useLayoutEffect(() => {
+    if (ref?.current !== null) {
+      const scrollWidth = ref.current.scrollWidth;
+      const offsetWidth = ref.current.offsetWidth;
+      setTooltipDisabled(scrollWidth <= offsetWidth);
+    }
+  }, [ref]);
+  // End
+
+  const tooltipId = uniqueId();
+  return (
+    <div ref={ref} className={classNames}>
+      <div className={"tooltip-truncated"} data-tip data-for={tooltipId}>
+        <span className={tooltipDisabled ? "" : "truncated"}>{value}</span>
+      </div>
+      <ReactTooltip
+        place="top"
+        effect="solid"
+        backgroundColor={COLORS["tooltip-bg"]}
+        id={tooltipId}
+        data-html
+        className="truncated-tooltip" // responsive widths
+        clickable
+        delayHide={200} // need delay set to hover using clickable
+        disable={tooltipDisabled}
+      >
+        <>
+          {tooltip ?? value}
+          <div className="safari-hack">&nbsp;</div>
+          {/* Fixes triple click selecting next element in Safari */}
+        </>
+      </ReactTooltip>
+    </div>
+  );
+};
+
+export default TooltipTruncatedText;
diff --git a/frontend/components/TooltipTruncatedText/_styles.scss b/frontend/components/TooltipTruncatedText/_styles.scss
new file mode 100644
index 000000000000..eb0af333f9bd
--- /dev/null
+++ b/frontend/components/TooltipTruncatedText/_styles.scss
@@ -0,0 +1,41 @@
+/** Modify with extreme caution as this CSS:
+- determines whether a tooltip is being rendered via useRef
+- is implemented in widely used checkbox labels
+- is highly sensitive */
+
+.tooltip-truncated-text {
+  max-width: 101%; // Required for implementation in checkbox labels
+
+  .tooltip-truncated {
+    max-width: 100%;
+  }
+
+  .truncated {
+    display: inline-block;
+    max-width: 99%;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    vertical-align: middle;
+  }
+
+  .inner-text {
+    text-overflow: ellipsis;
+    overflow: hidden;
+    white-space: nowrap;
+  }
+  .truncated-tooltip {
+    text-wrap: wrap;
+    overflow-wrap: break-word;
+
+    .safari-hack {
+      height: 0px;
+    }
+  }
+
+  // allows for the tooltip text to break on a word instead of a character
+  &.tooltip-break-on-word {
+    .truncated-tooltip {
+      word-break: normal;
+    }
+  }
+}
diff --git a/frontend/components/TooltipTruncatedText/index.ts b/frontend/components/TooltipTruncatedText/index.ts
new file mode 100644
index 000000000000..67ae6de96040
--- /dev/null
+++ b/frontend/components/TooltipTruncatedText/index.ts
@@ -0,0 +1 @@
+export { default } from "./TooltipTruncatedText";
diff --git a/frontend/components/buttons/Button/_styles.scss b/frontend/components/buttons/Button/_styles.scss
index c2e78a9b8199..f38badbccec3 100644
--- a/frontend/components/buttons/Button/_styles.scss
+++ b/frontend/components/buttons/Button/_styles.scss
@@ -70,6 +70,7 @@ $base-class: "button";
   border: 0;
   position: relative;
   cursor: pointer;
+  min-width: max-content;
 
   &:focus {
     outline: none;
diff --git a/frontend/components/forms/FormField/FormField.tsx b/frontend/components/forms/FormField/FormField.tsx
index 4d40930179c6..3417bb9d051c 100644
--- a/frontend/components/forms/FormField/FormField.tsx
+++ b/frontend/components/forms/FormField/FormField.tsx
@@ -18,6 +18,7 @@ export interface IFormFieldProps {
   className?: string;
   tooltip?: React.ReactNode;
   labelTooltipPosition?: PlacesType;
+  disabled?: boolean;
 }
 
 const FormField = ({
@@ -30,10 +31,12 @@ const FormField = ({
   type,
   tooltip,
   labelTooltipPosition,
+  disabled,
 }: IFormFieldProps): JSX.Element => {
   const renderLabel = () => {
     const labelWrapperClasses = classnames(`${baseClass}__label`, {
       [`${baseClass}__label--error`]: !isEmpty(error),
+      [`${baseClass}__label--disabled`]: disabled,
     });
 
     if (!label) {
diff --git a/frontend/components/forms/fields/Dropdown/Dropdown.jsx b/frontend/components/forms/fields/Dropdown/Dropdown.jsx
index 337851793ca3..302233e5d674 100644
--- a/frontend/components/forms/fields/Dropdown/Dropdown.jsx
+++ b/frontend/components/forms/fields/Dropdown/Dropdown.jsx
@@ -27,6 +27,19 @@ class Dropdown extends Component {
     onClose: PropTypes.func,
     options: PropTypes.arrayOf(dropdownOptionInterface).isRequired,
     placeholder: PropTypes.oneOfType([PropTypes.array, PropTypes.string]),
+    /**
+     value must correspond to the value of a dropdown option to render
+     e.g. with options:
+
+     [
+       {
+       label: "Display name",
+       value: 1,  <– the id of the thing
+       }
+     ]
+
+     set value to 1, not "Display name"
+    */
     value: PropTypes.oneOfType([
       PropTypes.array,
       PropTypes.string,
@@ -75,7 +88,7 @@ class Dropdown extends Component {
     const { multi, onChange, clearable, name, parseTarget } = this.props;
 
     if (parseTarget) {
-      // Returns both name and value
+      // Returns both name of the Dropdown and value of the selected option
       return onChange({ value: selected.value, name });
     }
 
@@ -188,9 +201,11 @@ class Dropdown extends Component {
       "error",
       "name",
       "tooltip",
+      "disabled",
     ]);
     const selectClasses = classnames(className, `${baseClass}__select`, {
       [`${baseClass}__select--error`]: error,
+      [`${baseClass}__select--disabled`]: disabled,
     });
 
     return (
diff --git a/frontend/components/forms/fields/Dropdown/_styles.scss b/frontend/components/forms/fields/Dropdown/_styles.scss
index b7466ae888e6..1b5f15309d30 100644
--- a/frontend/components/forms/fields/Dropdown/_styles.scss
+++ b/frontend/components/forms/fields/Dropdown/_styles.scss
@@ -51,14 +51,14 @@
   &__option {
     display: flex;
     flex-direction: column;
+    gap: $pad-small;
     width: 100%;
   }
 
   &__help-text {
-    margin-top: $pad-xsmall;
     font-size: $xx-small;
     white-space: normal;
-    color: $core-fleet-blue;
+    color: $ui-fleet-black-50;
     font-style: italic;
   }
 }
@@ -67,11 +67,13 @@
   &.dropdown__select {
     border: 1px solid $ui-fleet-black-10;
     border-radius: $border-radius;
-    &:hover {
+
+    &:hover:not(.is-disabled) {
       box-shadow: none;
-      border: 1px solid $core-vibrant-blue;
+      border-color: $core-vibrant-blue;
     }
   }
+
   .Select-control {
     background-color: $ui-light-grey;
     border: 0;
@@ -206,6 +208,12 @@
         }
       }
     }
+
+    &.is-disabled {
+      > .Select-control .Select-value .Select-value-label {
+        color: $ui-fleet-black-50;
+      }
+    }
   }
 
   .Select-menu-outer {
@@ -309,7 +317,7 @@
 
     .Select-option {
       &.is-disabled {
-        color: $core-fleet-black;
+        color: $ui-fleet-black-50;
         cursor: default;
 
         &.is-focused {
@@ -330,3 +338,11 @@
     margin-left: 3px;
   }
 }
+
+.form-field {
+  &__label {
+    &--disabled {
+      color: $ui-fleet-black-50;
+    }
+  }
+}
diff --git a/frontend/components/forms/fields/InputField/InputField.jsx b/frontend/components/forms/fields/InputField/InputField.jsx
index 09ffad2fa4af..758ef70ab4c0 100644
--- a/frontend/components/forms/fields/InputField/InputField.jsx
+++ b/frontend/components/forms/fields/InputField/InputField.jsx
@@ -43,6 +43,7 @@ class InputField extends Component {
       PropTypes.object,
     ]),
     enableCopy: PropTypes.bool,
+    copyButtonPosition: PropTypes.oneOfType(["inside", "outside"]),
     ignore1password: PropTypes.bool,
   };
 
@@ -62,6 +63,7 @@ class InputField extends Component {
     labelTooltipPosition: undefined,
     helpText: "",
     enableCopy: false,
+    copyButtonPosition: "outside",
     ignore1password: false,
   };
 
@@ -97,6 +99,59 @@ class InputField extends Component {
     return onChange(value);
   };
 
+  renderCopyButton = () => {
+    const { value, copyButtonPosition } = this.props;
+
+    const copyValue = (e) => {
+      e.preventDefault();
+      stringToClipboard(value).then(() => {
+        this.setState({ copied: true });
+        setTimeout(() => {
+          this.setState({ copied: false });
+        }, 2000);
+      });
+    };
+
+    const copyButtonValue =
+      copyButtonPosition === "outside" ? (
+        <>
+          <Icon name="copy" />
+          <span>Copy</span>
+        </>
+      ) : (
+        <Icon name="copy" />
+      );
+
+    const wrapperClasses = classnames(
+      `${baseClass}__copy-wrapper`,
+      copyButtonPosition === "outside"
+        ? `${baseClass}__copy-wrapper-outside`
+        : `${baseClass}__copy-wrapper-inside`
+    );
+
+    const copiedConfirmationClasses = classnames(
+      `${baseClass}__copied-confirmation`,
+      copyButtonPosition === "outside"
+        ? `${baseClass}__copied-confirmation-outside`
+        : `${baseClass}__copied-confirmation-inside`
+    );
+
+    return (
+      <div className={wrapperClasses}>
+        <Button
+          variant="text-icon"
+          onClick={copyValue}
+          className={`${baseClass}__copy-value-button`}
+        >
+          {copyButtonValue}
+        </Button>
+        {this.state.copied && (
+          <span className={copiedConfirmationClasses}>Copied!</span>
+        )}
+      </div>
+    );
+  };
+
   render() {
     const {
       readOnly,
@@ -113,6 +168,8 @@ class InputField extends Component {
       blockAutoComplete,
       value,
       ignore1password,
+      enableCopy,
+      copyButtonPosition,
     } = this.props;
 
     const { onInputChange } = this;
@@ -139,16 +196,6 @@ class InputField extends Component {
       "labelTooltipPosition",
     ]);
 
-    const copyValue = (e) => {
-      e.preventDefault();
-      stringToClipboard(value).then(() => {
-        this.setState({ copied: true });
-        setTimeout(() => {
-          this.setState({ copied: false });
-        }, 2000);
-      });
-    };
-
     if (type === "textarea") {
       return (
         <FormField
@@ -175,7 +222,9 @@ class InputField extends Component {
     }
 
     const inputContainerClasses = classnames(`${baseClass}__input-container`, {
-      "copy-enabled": this.props.enableCopy,
+      "copy-enabled": enableCopy,
+      "copy-outside": enableCopy && copyButtonPosition === "outside",
+      "copy-inside": enableCopy && copyButtonPosition === "inside",
     });
 
     return (
@@ -203,22 +252,8 @@ class InputField extends Component {
             autoComplete={blockAutoComplete ? "new-password" : ""}
             data-1p-ignore={ignore1password}
           />
-          {this.props.enableCopy && (
-            <div className={`${baseClass}__copy-wrapper`}>
-              <Button
-                variant="text-icon"
-                onClick={copyValue}
-                className={`${baseClass}__copy-value-button`}
-              >
-                <Icon name="copy" /> Copy
-              </Button>
-              {this.state.copied && (
-                <span className={`${baseClass}__copied-confirmation`}>
-                  Copied!
-                </span>
-              )}
-            </div>
-          )}
+
+          {enableCopy && this.renderCopyButton()}
         </div>
       </FormField>
     );
diff --git a/frontend/components/forms/fields/InputField/InputField.stories.jsx b/frontend/components/forms/fields/InputField/InputField.stories.jsx
index 09ccb5a19702..7b27aa435c2d 100644
--- a/frontend/components/forms/fields/InputField/InputField.stories.jsx
+++ b/frontend/components/forms/fields/InputField/InputField.stories.jsx
@@ -8,3 +8,16 @@ const meta = {
 export default meta;
 
 export const Basic = {};
+
+export const WithCopyEnabled = {
+  args: {
+    enableCopy: true,
+  },
+};
+
+export const WithCopyEnabledInsideInput = {
+  args: {
+    enableCopy: true,
+    copyButtonPosition: "inside",
+  },
+};
diff --git a/frontend/components/forms/fields/InputField/_styles.scss b/frontend/components/forms/fields/InputField/_styles.scss
index caf6c237133d..c70b7551756a 100644
--- a/frontend/components/forms/fields/InputField/_styles.scss
+++ b/frontend/components/forms/fields/InputField/_styles.scss
@@ -86,17 +86,32 @@
     }
   }
 
-  &__copy-wrapper {
+  &__copy-wrapper-outside {
     position: relative;
   }
 
+  &__copy-wrapper-inside {
+    position: absolute;
+    top: 50%;
+    transform: translateY(-50%);
+    right: 12px;
+  }
+
+
   &__input-container.copy-enabled {
-    display: flex;
-    align-items: center;
-    gap: $pad-medium;
+    &.copy-outside {
+      display: flex;
+      align-items: center;
+      gap: $pad-medium;
+    }
+
+    &.copy-inside {
+      position: relative;
+    }
   }
 
   &__copied-confirmation {
+    font-size: $x-small;
     position: absolute;
     background-color: $ui-light-grey;
     border: solid 1px $ui-fleet-black-10;
@@ -104,6 +119,13 @@
     padding: $pad-xxsmall 6px;
     top: 50%;
     transform: translateY(-50%);
+  }
+
+  &__copied-confirmation-inside {
+    right: 24px;
+  }
+
+  &__copied-confirmation-outside {
     left: -90px;
   }
 }
diff --git a/frontend/components/forms/fields/Radio/Radio.tsx b/frontend/components/forms/fields/Radio/Radio.tsx
index cf38349bac2b..de8a153df5a6 100644
--- a/frontend/components/forms/fields/Radio/Radio.tsx
+++ b/frontend/components/forms/fields/Radio/Radio.tsx
@@ -1,4 +1,4 @@
-import React from "react";
+import React, { ReactNode } from "react";
 import classnames from "classnames";
 
 import TooltipWrapper from "components/TooltipWrapper";
@@ -6,7 +6,7 @@ import TooltipWrapper from "components/TooltipWrapper";
 const baseClass = "radio";
 
 export interface IRadioProps {
-  label: string;
+  label: ReactNode;
   value: string;
   id: string;
   onChange: (value: string) => void;
diff --git a/frontend/components/forms/fields/SelectTargetsDropdown/TargetDetails/TargetDetails.jsx b/frontend/components/forms/fields/SelectTargetsDropdown/TargetDetails/TargetDetails.tsx
similarity index 73%
rename from frontend/components/forms/fields/SelectTargetsDropdown/TargetDetails/TargetDetails.jsx
rename to frontend/components/forms/fields/SelectTargetsDropdown/TargetDetails/TargetDetails.tsx
index 9b0765ed4cdf..d3780901c695 100644
--- a/frontend/components/forms/fields/SelectTargetsDropdown/TargetDetails/TargetDetails.jsx
+++ b/frontend/components/forms/fields/SelectTargetsDropdown/TargetDetails/TargetDetails.tsx
@@ -1,28 +1,35 @@
-import React, { Component } from "react";
-import PropTypes from "prop-types";
+import React from "react";
 import { noop } from "lodash";
 import AceEditor from "react-ace";
 import classnames from "classnames";
 
 import { humanHostMemory } from "utilities/helpers";
+// @ts-ignore
 import FleetIcon from "components/icons/FleetIcon";
+// @ts-ignore
 import PlatformIcon from "components/icons/PlatformIcon";
-import targetInterface from "interfaces/target";
+import { ISelectHost, ISelectLabel, ISelectTeam } from "interfaces/target";
 
-const baseClass = "target-details";
+import { isTargetHost, isTargetTeam, isTargetLabel } from "../helpers";
 
-class TargetDetails extends Component {
-  static propTypes = {
-    target: targetInterface,
-    className: PropTypes.string,
-    handleBackToResults: PropTypes.func,
-  };
+const baseClass = "target-details";
 
-  static defaultProps = {
-    handleBackToResults: noop,
-  };
+interface ITargetDetailsProps {
+  target: ISelectHost | ISelectTeam | ISelectLabel; // Replace with Target
+  className?: string;
+  handleBackToResults?: () => void;
+}
 
-  onlineHosts = (labelBaseClass, count, online) => {
+const TargetDetails = ({
+  target,
+  className = "",
+  handleBackToResults = noop,
+}: ITargetDetailsProps): JSX.Element => {
+  const onlineHosts = (
+    labelBaseClass: string,
+    count: number,
+    online: number
+  ) => {
     const offline = count - online;
     const percentCount = ((count - offline) / count) * 100;
     const percentOnline = parseFloat(percentCount.toFixed(2));
@@ -39,8 +46,7 @@ class TargetDetails extends Component {
     return false;
   };
 
-  renderHost = () => {
-    const { className, handleBackToResults, target } = this.props;
+  const renderHost = (hostTarget: ISelectHost) => {
     const {
       display_text: displayText,
       primary_mac: hostMac,
@@ -50,7 +56,7 @@ class TargetDetails extends Component {
       os_version: osVersion,
       platform,
       status,
-    } = target;
+    } = hostTarget;
     const hostBaseClass = "host-target";
     const isOnline = status === "online";
     const isOffline = status === "offline";
@@ -131,19 +137,17 @@ class TargetDetails extends Component {
     );
   };
 
-  renderLabel = () => {
-    const { onlineHosts } = this;
-    const { handleBackToResults, className, target } = this.props;
+  const renderLabel = (labelTarget: ISelectLabel) => {
     const {
       count,
       description,
       display_text: displayText,
       label_type: labelType,
-      online,
+      // online,
       query,
-    } = target;
+    } = labelTarget;
     const labelBaseClass = "label-target";
-
+    console.log("ERROR 1: labelTarget", labelTarget);
     return (
       <div className={`${labelBaseClass} ${className}`}>
         <button
@@ -162,39 +166,35 @@ class TargetDetails extends Component {
           <span className={`${labelBaseClass}__hosts-count`}>
             <strong>{count}</strong>HOSTS
           </span>
-          {onlineHosts(labelBaseClass, count, online)}
+          {/* {onlineHosts(labelBaseClass, count, online)} */}
         </p>
 
         <p className={`${labelBaseClass}__description`}>
           {description || "No Description"}
         </p>
-
-        {labelType !== 1 && (
-          <div className={`${labelBaseClass}__editor`}>
-            <AceEditor
-              editorProps={{ $blockScrolling: Infinity }}
-              mode="fleet"
-              minLines={1}
-              maxLines={20}
-              name="label-query"
-              readOnly
-              setOptions={{ wrap: true }}
-              showGutter={false}
-              showPrintMargin={false}
-              theme="fleet"
-              value={query}
-              width="100%"
-              fontSize={14}
-            />
-          </div>
-        )}
+        <div className={`${labelBaseClass}__editor`}>
+          <AceEditor
+            editorProps={{ $blockScrolling: Infinity }}
+            mode="fleet"
+            minLines={1}
+            maxLines={20}
+            name="label-query"
+            readOnly
+            setOptions={{ wrap: true }}
+            showGutter={false}
+            showPrintMargin={false}
+            theme="fleet"
+            value={query}
+            width="100%"
+            fontSize={14}
+          />
+        </div>
       </div>
     );
   };
 
-  renderTeam = () => {
-    const { className, target } = this.props;
-    const { count, display_text: displayText } = target;
+  const renderTeam = (teamTarget: ISelectTeam) => {
+    const { count, display_text: displayText } = teamTarget;
     const labelBaseClass = "label-target";
 
     return (
@@ -217,26 +217,22 @@ class TargetDetails extends Component {
     );
   };
 
-  render() {
-    const { target } = this.props;
-
-    if (!target) {
-      return false;
-    }
-
-    const { target_type: targetType } = target;
-    const { renderHost, renderLabel, renderTeam } = this;
+  if (!target) {
+    return <></>;
+  }
 
-    if (targetType === "labels") {
-      return renderLabel();
-    }
+  if (isTargetHost(target)) {
+    return renderHost(target);
+  }
 
-    if (targetType === "teams") {
-      return renderTeam();
-    }
+  if (isTargetLabel(target)) {
+    return renderLabel(target);
+  }
 
-    return renderHost();
+  if (isTargetTeam(target)) {
+    return renderTeam(target);
   }
-}
+  return <></>;
+};
 
 export default TargetDetails;
diff --git a/frontend/components/forms/fields/SelectTargetsDropdown/TargetDetails/index.js b/frontend/components/forms/fields/SelectTargetsDropdown/TargetDetails/index.ts
similarity index 100%
rename from frontend/components/forms/fields/SelectTargetsDropdown/TargetDetails/index.js
rename to frontend/components/forms/fields/SelectTargetsDropdown/TargetDetails/index.ts
diff --git a/frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/TargetIcon.jsx b/frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/TargetIcon.jsx
deleted file mode 100644
index f5488d4b49a7..000000000000
--- a/frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/TargetIcon.jsx
+++ /dev/null
@@ -1,32 +0,0 @@
-import React from "react";
-import classnames from "classnames";
-
-import FleetIcon from "components/icons/FleetIcon";
-import targetInterface from "interfaces/target";
-
-const baseClass = "target-option";
-
-const TargetIcon = ({ target }) => {
-  const iconName = () => {
-    const { name, platform, target_type: targetType } = target;
-
-    if (targetType === "labels") {
-      return name === "All Hosts" ? "all-hosts" : "label";
-    }
-
-    return platform === "darwin" ? "apple" : platform;
-  };
-
-  const { status } = target;
-
-  const targetClasses = classnames(
-    `${baseClass}__icon`,
-    `${baseClass}__icon--${status}`
-  );
-
-  return <FleetIcon name={iconName()} className={targetClasses} />;
-};
-
-TargetIcon.propTypes = { target: targetInterface.isRequired };
-
-export default TargetIcon;
diff --git a/frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/TargetIcon.tsx b/frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/TargetIcon.tsx
new file mode 100644
index 000000000000..a332ac31e766
--- /dev/null
+++ b/frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/TargetIcon.tsx
@@ -0,0 +1,36 @@
+import React from "react";
+import classnames from "classnames";
+
+// @ts-ignore
+import FleetIcon from "components/icons/FleetIcon";
+
+import { ISelectTargetsEntity } from "interfaces/target";
+import { isTargetLabel, isTargetHost } from "../helpers";
+
+const baseClass = "target-option";
+
+interface ITargetIconProps {
+  target: ISelectTargetsEntity;
+}
+
+const TargetIcon = ({ target }: ITargetIconProps): JSX.Element => {
+  const iconName = (): string => {
+    if (isTargetLabel(target)) {
+      return target.name === "All Hosts" ? "all-hosts" : "label";
+    }
+    if (isTargetHost(target)) {
+      return target.platform === "darwin" ? "apple" : target.platform;
+    }
+    return "";
+  };
+
+  const targetClasses = classnames(`${baseClass}__icon`, {
+    [`${baseClass}__icon--${
+      isTargetHost(target) && target.status
+    }`]: isTargetHost(target),
+  });
+
+  return <FleetIcon name={iconName()} className={targetClasses} />;
+};
+
+export default TargetIcon;
diff --git a/frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/TargetOption.jsx b/frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/TargetOption.jsx
deleted file mode 100644
index 205e7b1fb870..000000000000
--- a/frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/TargetOption.jsx
+++ /dev/null
@@ -1,79 +0,0 @@
-import React, { Component } from "react";
-import PropTypes from "prop-types";
-import classnames from "classnames";
-
-import targetInterface from "interfaces/target";
-import TargetIcon from "./TargetIcon";
-
-const baseClass = "target-option";
-
-class TargetOption extends Component {
-  static propTypes = {
-    onMoreInfoClick: PropTypes.func,
-    onSelect: PropTypes.func,
-    target: targetInterface.isRequired,
-  };
-
-  handleSelect = (evt) => {
-    const { onSelect, target } = this.props;
-
-    return onSelect(target, evt);
-  };
-
-  renderTargetDetail = () => {
-    const { target } = this.props;
-    const {
-      count,
-      primary_ip: hostIpAddress,
-      target_type: targetType,
-    } = target;
-
-    if (targetType === "hosts") {
-      if (!hostIpAddress) {
-        return false;
-      }
-
-      return (
-        <span>
-          <span className={`${baseClass}__ip`}>{hostIpAddress}</span>
-        </span>
-      );
-    }
-
-    return <span className={`${baseClass}__count`}>{count} hosts</span>;
-  };
-
-  render() {
-    const { onMoreInfoClick, target } = this.props;
-    const { display_text: displayText, target_type: targetType } = target;
-    const { handleSelect, renderTargetDetail } = this;
-    const wrapperClassName = classnames(`${baseClass}__wrapper`, {
-      "is-team": targetType === "teams",
-      "is-label": targetType === "labels",
-      "is-host": targetType === "hosts",
-    });
-
-    return (
-      <div className={wrapperClassName}>
-        <button
-          className={`button button--unstyled ${baseClass}__target-content`}
-          onClick={onMoreInfoClick(target)}
-        >
-          <div>
-            <TargetIcon target={target} />
-            <span className={`${baseClass}__label-label`}>
-              {displayText !== "All Hosts" ? displayText : "All hosts"}
-            </span>
-          </div>
-          {renderTargetDetail()}
-        </button>
-        <button
-          className={`button button--unstyled ${baseClass}__add-btn`}
-          onClick={handleSelect}
-        />
-      </div>
-    );
-  }
-}
-
-export default TargetOption;
diff --git a/frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/TargetOption.tests.jsx b/frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/TargetOption.tests.tsx
similarity index 52%
rename from frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/TargetOption.tests.jsx
rename to frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/TargetOption.tests.tsx
index 0d508996c622..94b15315a8a8 100644
--- a/frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/TargetOption.tests.jsx
+++ b/frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/TargetOption.tests.tsx
@@ -1,7 +1,9 @@
 import React from "react";
 import { fireEvent, render, screen } from "@testing-library/react";
+import { noop } from "lodash";
 
-import { hostStub, labelStub } from "test/stubs";
+import { createMockLabel } from "__mocks__/labelsMock";
+import createMockHost from "__mocks__/hostMock";
 import TargetOption from "./TargetOption";
 
 describe("TargetOption - component", () => {
@@ -10,27 +12,31 @@ describe("TargetOption - component", () => {
     return onMoreInfoClickSpy;
   };
   it("renders a label option for label targets", () => {
-    const count = 5;
     const { container } = render(
       <TargetOption
+        onSelect={noop}
         onMoreInfoClick={onMoreInfoClick}
-        target={{ ...labelStub, count }}
+        target={createMockLabel({
+          target_type: "labels",
+          count: 20,
+        })}
       />
     );
     expect(container.querySelectorAll(".is-label").length).toEqual(1);
-    expect(screen.getByText(`${count} hosts`)).toBeInTheDocument();
+    expect(screen.getByText(`20 hosts`)).toBeInTheDocument();
   });
 
   it("renders a host option for host targets", () => {
     const { container } = render(
       <TargetOption
+        onSelect={noop}
         onMoreInfoClick={onMoreInfoClick}
-        target={{ ...hostStub, platform: "windows" }}
+        target={createMockHost({ target_type: "hosts", platform: "windows" })}
       />
     );
     expect(container.querySelectorAll(".is-host").length).toEqual(1);
     expect(container.querySelectorAll("i.fleeticon-windows").length).toEqual(1);
-    expect(screen.getByText(hostStub.primary_ip)).toBeInTheDocument();
+    expect(screen.getByText(createMockHost().primary_ip)).toBeInTheDocument();
   });
 
   it("calls the onSelect prop when + icon button is clicked", () => {
@@ -39,18 +45,36 @@ describe("TargetOption - component", () => {
       <TargetOption
         onMoreInfoClick={onMoreInfoClick}
         onSelect={onSelectSpy}
-        target={hostStub}
+        target={createMockHost()}
       />
     );
-    fireEvent.click(container.querySelector(".target-option__add-btn"));
-    expect(onSelectSpy).toHaveBeenCalled();
+
+    const addButton = container.querySelector(".target-option__add-btn");
+
+    expect(addButton).toBeInTheDocument();
+
+    if (addButton) {
+      fireEvent.click(addButton);
+      expect(onSelectSpy).toHaveBeenCalled();
+    }
   });
 
   it("calls the onMoreInfoClick prop when the item content is clicked", () => {
     const { container } = render(
-      <TargetOption onMoreInfoClick={onMoreInfoClick} target={hostStub} />
+      <TargetOption
+        onSelect={noop}
+        onMoreInfoClick={onMoreInfoClick}
+        target={createMockHost()}
+      />
     );
-    fireEvent.click(container.querySelector(".target-option__target-content"));
-    expect(onMoreInfoClickSpy).toHaveBeenCalled();
+
+    const moreInfo = container.querySelector(".target-option__target-content");
+
+    expect(moreInfo).toBeInTheDocument();
+
+    if (moreInfo) {
+      fireEvent.click(moreInfo);
+      expect(onMoreInfoClickSpy).toHaveBeenCalled();
+    }
   });
 });
diff --git a/frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/TargetOption.tsx b/frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/TargetOption.tsx
new file mode 100644
index 000000000000..ddc4e83f9ea1
--- /dev/null
+++ b/frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/TargetOption.tsx
@@ -0,0 +1,81 @@
+import React from "react";
+import classnames from "classnames";
+
+import { ISelectTargetsEntity } from "interfaces/target";
+// @ts-ignore
+import TargetIcon from "./TargetIcon";
+import { isTargetHost, isTargetLabel, isTargetTeam } from "../helpers";
+
+const baseClass = "target-option";
+
+interface ITargetOptionProps {
+  onMoreInfoClick: (
+    target: ISelectTargetsEntity
+  ) => (event: React.MouseEvent) => void;
+  onSelect: (target: ISelectTargetsEntity, event: React.MouseEvent) => void;
+  target: ISelectTargetsEntity;
+}
+
+const TargetOption = ({
+  onMoreInfoClick,
+  onSelect,
+  target,
+}: ITargetOptionProps): JSX.Element => {
+  const handleSelect = (evt: React.MouseEvent) => {
+    return onSelect(target, evt);
+  };
+
+  const renderTargetDetail = () => {
+    if (isTargetHost(target)) {
+      const { primary_ip: hostIpAddress } = target;
+
+      if (!hostIpAddress) {
+        return null;
+      }
+
+      return (
+        <span>
+          <span className={`${baseClass}__ip`}>{hostIpAddress}</span>
+        </span>
+      );
+    }
+
+    if (isTargetTeam(target) || isTargetLabel(target)) {
+      return (
+        <span className={`${baseClass}__count`}>{target.count} hosts</span>
+      );
+    }
+
+    return <></>;
+  };
+
+  const { display_text: displayText, target_type: targetType } = target;
+  const wrapperClassName = classnames(`${baseClass}__wrapper`, {
+    "is-team": targetType === "teams",
+    "is-label": targetType === "labels",
+    "is-host": targetType === "hosts",
+  });
+
+  return (
+    <div className={wrapperClassName}>
+      <button
+        className={`button button--unstyled ${baseClass}__target-content`}
+        onClick={onMoreInfoClick(target)}
+      >
+        <div>
+          <TargetIcon target={target} />
+          <span className={`${baseClass}__label-label`}>
+            {displayText !== "All Hosts" ? displayText : "All hosts"}
+          </span>
+        </div>
+        {renderTargetDetail()}
+      </button>
+      <button
+        className={`button button--unstyled ${baseClass}__add-btn`}
+        onClick={handleSelect}
+      />
+    </div>
+  );
+};
+
+export default TargetOption;
diff --git a/frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/index.js b/frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/index.ts
similarity index 100%
rename from frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/index.js
rename to frontend/components/forms/fields/SelectTargetsDropdown/TargetOption/index.ts
diff --git a/frontend/components/forms/fields/SelectTargetsDropdown/helpers.ts b/frontend/components/forms/fields/SelectTargetsDropdown/helpers.ts
new file mode 100644
index 000000000000..9b9207ef1e3a
--- /dev/null
+++ b/frontend/components/forms/fields/SelectTargetsDropdown/helpers.ts
@@ -0,0 +1,24 @@
+import {
+  ISelectTargetsEntity,
+  ISelectHost,
+  ISelectLabel,
+  ISelectTeam,
+} from "interfaces/target";
+
+export const isTargetHost = (
+  target: ISelectTargetsEntity
+): target is ISelectHost => {
+  return target.target_type === "hosts";
+};
+
+export const isTargetLabel = (
+  target: ISelectTargetsEntity
+): target is ISelectLabel => {
+  return target.target_type === "labels";
+};
+
+export const isTargetTeam = (
+  target: ISelectTargetsEntity
+): target is ISelectTeam => {
+  return target.target_type === "teams";
+};
diff --git a/frontend/components/graphics/DataError.tsx b/frontend/components/graphics/DataError.tsx
new file mode 100644
index 000000000000..3f504b423d25
--- /dev/null
+++ b/frontend/components/graphics/DataError.tsx
@@ -0,0 +1,404 @@
+import React from "react";
+
+const DataError = () => {
+  return (
+    <svg
+      width="128"
+      height="135"
+      viewBox="0 0 128 135"
+      fill="none"
+      xmlns="http://www.w3.org/2000/svg"
+    >
+      <g id="graphic">
+        <path
+          id="Vector"
+          d="M116.225 104.587C117.868 105.533 117.877 107.073 116.234 108.027L71.8866 133.796C70.261 134.742 67.6033 134.742 65.9605 133.796L1.2375 96.433C-0.405306 95.4869 -0.413907 93.9473 1.22029 93.0012L45.5674 67.2324C47.2016 66.2777 49.8593 66.2777 51.5021 67.2324L116.225 104.604V104.587Z"
+          fill="#D3E8F3"
+        />
+        <g id="Group">
+          <path
+            id="Vector_2"
+            d="M127.037 35.7782C126.976 35.6836 126.916 35.589 126.847 35.5029C126.796 35.4341 126.744 35.3653 126.684 35.2965C126.632 35.2363 126.589 35.1847 126.538 35.1245C126.495 35.0815 126.452 35.0299 126.4 34.9869C126.357 34.9439 126.314 34.9009 126.271 34.8665C126.228 34.8321 126.185 34.789 126.142 34.7546C126.099 34.7202 126.065 34.6944 126.022 34.66C125.979 34.6342 125.944 34.5998 125.901 34.574C125.858 34.5482 125.824 34.5224 125.781 34.4966C125.755 34.4794 125.729 34.4622 125.703 34.445L66.8378 0.462207C66.8378 0.462207 66.812 0.445004 66.7948 0.436403C66.7518 0.4106 66.7174 0.393398 66.6744 0.376196C66.6314 0.358994 66.597 0.341792 66.554 0.315989C66.511 0.298786 66.4766 0.281584 66.4335 0.264382C66.4163 0.264382 66.3991 0.255781 66.3819 0.24718C66.3819 0.24718 66.3733 0.24718 66.3647 0.24718C66.3475 0.24718 66.3303 0.238579 66.3131 0.229978C66.2701 0.212776 66.2271 0.204175 66.1927 0.195574C66.1497 0.186973 66.1067 0.16977 66.0637 0.161169C66.0207 0.152568 65.9777 0.143967 65.9347 0.135366C65.9347 0.135366 65.9347 0.135366 65.9261 0.135366C65.8831 0.135366 65.8401 0.126765 65.8057 0.118164C65.7541 0.118164 65.7025 0.118164 65.6595 0.118164C65.6078 0.118164 65.5562 0.118164 65.5046 0.118164C65.4444 0.118164 65.3842 0.126765 65.324 0.143967C65.2466 0.161169 65.1692 0.178372 65.0918 0.204175L59.8193 1.86418C59.9484 1.82117 60.086 1.79537 60.2322 1.78677C60.3698 1.77817 60.516 1.78677 60.6622 1.80397C60.8085 1.82117 60.9547 1.86418 61.1009 1.91579C61.1009 1.91579 61.1095 1.91579 61.1181 1.91579C61.2643 1.96739 61.4191 2.0362 61.5654 2.12221L120.431 36.105C120.431 36.105 120.483 36.1394 120.508 36.1566C120.551 36.1824 120.586 36.2082 120.629 36.234C120.672 36.2598 120.706 36.2942 120.749 36.32C120.792 36.3544 120.827 36.3802 120.87 36.4146C120.913 36.4491 120.956 36.4835 120.999 36.5265C121.042 36.5695 121.085 36.6039 121.128 36.6469C121.171 36.6899 121.214 36.7415 121.265 36.7845C121.317 36.8361 121.369 36.8963 121.412 36.9565C121.472 37.0253 121.523 37.0941 121.575 37.1629C121.644 37.249 121.704 37.3436 121.764 37.4382C121.953 37.7306 122.108 38.0575 122.229 38.4015L127.518 36.7931C127.389 36.4405 127.226 36.0964 127.028 35.7868L127.037 35.7782Z"
+            fill="white"
+          />
+          <path
+            id="Vector_3"
+            d="M127.863 38.4789C127.863 38.4187 127.863 38.3671 127.863 38.3069C127.863 38.2467 127.863 38.1865 127.846 38.1263C127.846 38.066 127.828 38.0058 127.828 37.9456C127.82 37.8768 127.811 37.808 127.794 37.7478C127.785 37.679 127.768 37.6016 127.751 37.5328C127.734 37.4468 127.717 37.3694 127.691 37.2834C127.665 37.1801 127.631 37.0769 127.596 36.9737C127.579 36.9135 127.544 36.8533 127.527 36.7931L122.238 38.4015C122.263 38.4789 122.306 38.5563 122.332 38.6337C122.367 38.7369 122.392 38.8401 122.427 38.9434C122.453 39.0208 122.47 39.1068 122.487 39.1928C122.504 39.2616 122.513 39.339 122.53 39.4078C122.539 39.4766 122.556 39.5454 122.564 39.6056C122.564 39.6658 122.582 39.7261 122.582 39.7863C122.582 39.8465 122.59 39.9067 122.599 39.9669C122.599 40.0271 122.599 40.0787 122.599 40.1389C122.599 40.1905 122.599 40.2507 122.599 40.3023C122.599 40.3539 122.599 40.4055 122.599 40.4657C122.599 40.5174 122.599 40.569 122.59 40.6206C122.59 40.6722 122.59 40.7238 122.573 40.7754C122.573 40.827 122.564 40.8786 122.556 40.9302C122.556 40.9732 122.539 41.0248 122.53 41.0678L113.327 91.7883C113.275 92.0635 113.198 92.313 113.103 92.5452C113.009 92.7602 112.897 92.958 112.768 93.1301C112.759 93.1473 112.751 93.1559 112.733 93.1731C112.639 93.2935 112.527 93.3881 112.415 93.4827C112.364 93.5257 112.321 93.5773 112.269 93.6117C112.106 93.7235 111.934 93.8181 111.753 93.8698L117.025 92.2097C117.206 92.1495 117.378 92.0635 117.541 91.9517C117.593 91.9173 117.636 91.8657 117.688 91.8227C117.774 91.7453 117.868 91.6851 117.946 91.5905C117.963 91.5647 117.98 91.5389 118.006 91.5131C118.015 91.4959 118.023 91.4873 118.04 91.4701C118.066 91.4356 118.092 91.4098 118.109 91.3754C118.144 91.3152 118.187 91.2636 118.221 91.1948C118.247 91.1432 118.281 91.0916 118.307 91.0314C118.333 90.9798 118.35 90.9368 118.376 90.8852C118.393 90.8336 118.419 90.7906 118.436 90.739C118.453 90.6874 118.47 90.6443 118.488 90.5927C118.505 90.5411 118.513 90.4981 118.531 90.4465C118.539 90.3949 118.556 90.3519 118.565 90.3003C118.574 90.2487 118.582 90.1971 118.599 90.1541C118.599 90.1541 118.599 90.1541 118.599 90.1455L127.803 39.425C127.803 39.382 127.82 39.3304 127.828 39.2874C127.828 39.2358 127.846 39.1842 127.846 39.1326C127.846 39.081 127.854 39.0294 127.863 38.9778C127.863 38.9262 127.863 38.8745 127.871 38.8229C127.871 38.7713 127.871 38.7197 127.871 38.6595C127.871 38.6079 127.871 38.5477 127.871 38.4961L127.863 38.4789Z"
+            fill="#C0CCCF"
+          />
+          <path
+            id="Vector_4"
+            d="M111.804 93.9816L111.727 93.7321C111.89 93.6805 112.054 93.5945 112.209 93.4913C112.234 93.4741 112.26 93.4483 112.286 93.4225C112.303 93.4053 112.329 93.3795 112.346 93.3623C112.449 93.2763 112.553 93.1817 112.639 93.0698L112.665 93.0354C112.785 92.872 112.897 92.6914 112.974 92.5022V92.4764C113.077 92.2527 113.155 92.0119 113.198 91.7453L122.444 40.741C122.444 40.698 122.453 40.6464 122.461 40.5947C122.461 40.5431 122.461 40.4915 122.461 40.4485C122.461 40.3969 122.461 40.3453 122.461 40.2937C122.461 40.2421 122.461 40.1905 122.461 40.1389C122.461 40.0873 122.461 40.0271 122.461 39.9755C122.461 39.9153 122.461 39.8637 122.444 39.8034C122.444 39.7432 122.427 39.683 122.427 39.6228C122.418 39.5626 122.41 39.4938 122.392 39.425C122.384 39.3562 122.366 39.2788 122.349 39.21C122.332 39.1326 122.315 39.0466 122.289 38.9691C122.263 38.8659 122.229 38.7627 122.194 38.6681C122.177 38.6251 122.16 38.5735 122.143 38.5305L122.108 38.4359C121.971 38.0746 121.816 37.765 121.653 37.4984C121.592 37.4038 121.532 37.3177 121.463 37.2317C121.412 37.1629 121.36 37.0941 121.309 37.0339C121.266 36.9737 121.214 36.9221 121.162 36.8705C121.119 36.8275 121.076 36.7845 121.033 36.7415C120.99 36.6985 120.947 36.6641 120.904 36.6211C120.861 36.5867 120.818 36.5522 120.784 36.5178C120.749 36.4834 120.706 36.4576 120.672 36.4318C120.638 36.406 120.595 36.3716 120.552 36.3458C120.517 36.32 120.474 36.2942 120.44 36.2684L120.38 36.234L61.5054 2.234C61.3678 2.15659 61.2215 2.08779 61.0753 2.03618C60.9205 1.98457 60.7829 1.95017 60.6453 1.92437C60.5076 1.90716 60.3786 1.89856 60.2582 1.90716H60.241C60.112 1.91576 59.983 1.94157 59.8626 1.98457L59.7852 1.74374L65.049 0.0923394C65.1264 0.0665362 65.2124 0.049334 65.2898 0.0321319C65.3586 0.0235309 65.4189 0.0149298 65.4877 0.00632873C65.5995 -0.00227234 65.7027 -0.00227234 65.8145 0.00632873C65.8575 0.00632873 65.9005 0.00632873 65.9435 0.0235309C66.0037 0.0235309 66.0467 0.040733 66.0983 0.049334C66.1413 0.0579351 66.1929 0.0665362 66.236 0.0837383C66.279 0.0923394 66.322 0.109541 66.365 0.118143L66.4424 0.143946C66.4424 0.143946 66.4768 0.152547 66.494 0.161148C66.537 0.17835 66.5714 0.195552 66.6144 0.212754C66.6574 0.229956 66.7004 0.247159 66.7434 0.272962C66.7864 0.290164 66.8208 0.315967 66.8638 0.34177L66.9068 0.367573L125.764 34.3504C125.764 34.3504 125.824 34.3848 125.85 34.402C125.893 34.4278 125.936 34.4536 125.97 34.4794C126.013 34.5052 126.056 34.5396 126.099 34.5654C126.142 34.5998 126.185 34.6256 126.22 34.66C126.263 34.6944 126.306 34.7374 126.349 34.7718C126.392 34.8148 126.443 34.8578 126.486 34.9008C126.529 34.9438 126.581 34.9955 126.624 35.0471C126.676 35.0987 126.727 35.1589 126.779 35.2191C126.839 35.2879 126.891 35.3567 126.951 35.4341C127.02 35.5287 127.088 35.6233 127.149 35.7179C127.338 36.0104 127.501 36.3544 127.648 36.7501C127.656 36.7759 127.665 36.8017 127.682 36.8275C127.699 36.8619 127.716 36.9049 127.725 36.9393C127.759 37.0425 127.794 37.1543 127.82 37.2575C127.845 37.3435 127.863 37.4296 127.88 37.507C127.897 37.5844 127.914 37.6532 127.923 37.7306C127.931 37.7994 127.949 37.8682 127.957 37.937C127.957 37.9972 127.974 38.066 127.983 38.1262C127.983 38.1864 127.992 38.2467 128 38.3069C128 38.3671 128 38.4187 128 38.4789C128 38.5305 128 38.5907 128 38.6423C128 38.6939 128 38.7541 128 38.8057V38.9691C127.983 39.0294 127.983 39.081 127.974 39.1326C127.974 39.1842 127.966 39.2358 127.957 39.2874C127.957 39.339 127.94 39.382 127.931 39.4336L118.728 90.1541C118.72 90.2143 118.702 90.2659 118.694 90.3175C118.685 90.3691 118.668 90.4207 118.659 90.4723L118.616 90.6271C118.599 90.6787 118.582 90.7303 118.565 90.782C118.548 90.8336 118.53 90.8852 118.505 90.9368L118.487 90.9712C118.47 91.0142 118.444 91.0572 118.427 91.1002C118.401 91.1604 118.367 91.212 118.341 91.2722C118.307 91.3324 118.264 91.4012 118.229 91.4528C118.212 91.4786 118.195 91.4958 118.178 91.5216L118.1 91.6249C118.1 91.6249 118.075 91.6593 118.066 91.6765C117.997 91.7539 117.928 91.8141 117.86 91.8743L117.799 91.9259C117.799 91.9259 117.765 91.9603 117.748 91.9775C117.713 92.0119 117.679 92.0463 117.645 92.0721C117.464 92.1925 117.283 92.2871 117.094 92.3473L111.83 94.0074L111.804 93.9816ZM113.241 92.5624V92.5882C113.138 92.8032 113.017 93.0096 112.88 93.1989L112.845 93.2419C112.785 93.3193 112.716 93.3881 112.647 93.4483L116.999 92.0807C117.163 92.0291 117.326 91.9517 117.481 91.8399C117.507 91.8227 117.533 91.7969 117.55 91.7711C117.567 91.7539 117.593 91.7281 117.619 91.7109L117.688 91.6507C117.748 91.5991 117.808 91.5474 117.86 91.4872L117.971 91.341C117.971 91.341 117.997 91.3066 118.006 91.2894C118.04 91.2378 118.075 91.1776 118.109 91.1174C118.135 91.0658 118.161 91.0142 118.186 90.9626C118.212 90.9196 118.229 90.868 118.255 90.825V90.7992C118.29 90.7562 118.298 90.7132 118.315 90.6701C118.333 90.6271 118.35 90.5755 118.367 90.5239L118.41 90.3777C118.419 90.3347 118.436 90.2831 118.444 90.2401C118.453 90.1971 118.462 90.1455 118.47 90.0939L127.673 39.3648C127.682 39.3218 127.691 39.2702 127.699 39.2272C127.699 39.1756 127.716 39.1326 127.716 39.081C127.716 39.0294 127.725 38.9863 127.734 38.9347V38.7799C127.742 38.7283 127.742 38.6767 127.742 38.6251C127.742 38.5735 127.742 38.5219 127.742 38.4703C127.742 38.4187 127.742 38.3585 127.742 38.3069C127.742 38.2467 127.742 38.195 127.725 38.1348C127.725 38.0746 127.716 38.0144 127.708 37.9542C127.699 37.8854 127.691 37.8252 127.673 37.7564C127.665 37.6876 127.648 37.6102 127.63 37.5414C127.613 37.464 127.596 37.3779 127.57 37.3005C127.544 37.1973 127.51 37.0941 127.484 36.9995C127.476 36.9651 127.458 36.9393 127.45 36.9049C127.441 36.8791 127.424 36.8447 127.415 36.8189C127.269 36.4404 127.114 36.1136 126.942 35.8384C126.882 35.7437 126.822 35.6577 126.753 35.5717C126.701 35.5029 126.65 35.4341 126.598 35.3739C126.555 35.3223 126.504 35.2621 126.452 35.2105C126.409 35.1675 126.366 35.1245 126.323 35.0729C126.28 35.0299 126.237 34.9955 126.194 34.9524C126.151 34.918 126.117 34.8836 126.074 34.8492C126.039 34.8148 125.996 34.789 125.962 34.7632C125.919 34.7374 125.884 34.703 125.841 34.6772C125.807 34.6514 125.764 34.6256 125.73 34.6084C125.704 34.5912 125.678 34.574 125.652 34.5568L66.7348 0.556797C66.7348 0.556797 66.6574 0.513791 66.623 0.496589C66.5886 0.479387 66.5456 0.462185 66.5112 0.444983C66.4768 0.427781 66.4338 0.410579 66.3994 0.401978L66.3048 0.367573C66.2446 0.350371 66.2015 0.333169 66.1671 0.324568C66.1241 0.315967 66.0811 0.307366 66.0467 0.298765C66.0037 0.298765 65.9693 0.281563 65.9263 0.281563C65.8661 0.281563 65.8317 0.272962 65.7887 0.264361C65.6941 0.264361 65.5909 0.264361 65.5049 0.264361C65.4447 0.264361 65.3844 0.272962 65.3328 0.290164C65.264 0.307366 65.1866 0.324568 65.1178 0.34177L60.7915 1.70074C60.9119 1.72654 61.0237 1.75234 61.1441 1.79535C61.3247 1.85556 61.4796 1.93297 61.6344 2.01898L120.586 36.0534C120.586 36.0534 120.663 36.105 120.706 36.1308C120.749 36.1566 120.793 36.191 120.836 36.2168C120.879 36.2512 120.922 36.2856 120.965 36.3114C121.008 36.3458 121.051 36.3888 121.094 36.4232C121.137 36.4662 121.188 36.5092 121.231 36.5522C121.274 36.5952 121.326 36.6469 121.369 36.6899C121.42 36.7501 121.472 36.8017 121.524 36.8619C121.584 36.9307 121.635 36.9995 121.696 37.0769C121.764 37.1715 121.833 37.2661 121.893 37.3607C122.074 37.6446 122.229 37.9628 122.375 38.3413L122.41 38.4273C122.427 38.4789 122.453 38.5305 122.47 38.5821C122.504 38.6853 122.539 38.7971 122.564 38.9003C122.59 38.9864 122.607 39.0638 122.625 39.1498C122.642 39.2272 122.659 39.296 122.668 39.3734C122.676 39.4422 122.693 39.511 122.702 39.5798C122.702 39.64 122.719 39.7088 122.728 39.769C122.728 39.8293 122.736 39.8895 122.745 39.9497C122.745 40.0099 122.745 40.0701 122.745 40.1303C122.745 40.1819 122.745 40.2421 122.745 40.2937C122.745 40.3539 122.745 40.4055 122.745 40.4571C122.745 40.5087 122.745 40.5603 122.736 40.6119C122.736 40.6636 122.736 40.7152 122.719 40.7668L122.676 41.0678L113.473 91.7883C113.421 92.0635 113.353 92.3215 113.249 92.5452L113.241 92.5624Z"
+            fill="black"
+          />
+          <path
+            id="Vector_5"
+            d="M120.431 36.1051C121.928 36.9738 122.866 39.1843 122.53 41.0593L113.327 91.7798C112.992 93.6548 111.504 94.4633 110.007 93.6032L51.1413 59.6204C49.6447 58.7517 48.7072 56.5412 49.0426 54.6662L58.2458 3.94573C58.5812 2.0707 60.0692 1.2622 61.5658 2.1223L120.431 36.1051Z"
+            fill="#E0E3E3"
+          />
+          <path
+            id="Vector_6"
+            d="M111.194 94.0762C110.781 94.0762 110.351 93.9558 109.938 93.715L51.0723 59.7321C49.5327 58.8462 48.5694 56.567 48.9134 54.6489L58.1166 3.92844C58.2972 2.93072 58.8132 2.17382 59.5271 1.83838C60.1722 1.53735 60.9119 1.60615 61.6258 2.019L120.491 36.0018C122.031 36.8877 122.994 39.167 122.65 41.085L113.447 91.8055C113.267 92.8032 112.751 93.5601 112.037 93.8956C111.77 94.016 111.486 94.0762 111.194 94.0762ZM60.3786 1.90719C60.1206 1.90719 59.8798 1.9588 59.6475 2.07061C59.0025 2.37165 58.5466 3.05973 58.3746 3.97145L49.1714 54.6919C48.8446 56.5067 49.7563 58.6742 51.2013 59.5085L110.067 93.4913C110.703 93.8612 111.366 93.9214 111.933 93.6634C112.578 93.3623 113.034 92.6742 113.206 91.7625L122.41 41.042C122.736 39.2272 121.825 37.0597 120.38 36.2254L61.5054 2.23403C61.1269 2.019 60.7399 1.90719 60.3786 1.90719Z"
+            fill="black"
+          />
+        </g>
+        <g id="screen">
+          <path
+            id="Vector_7"
+            d="M52.5776 53.5911L60.5852 8.66776C60.8002 7.4464 62.1678 6.81853 63.2343 7.4378L116.991 38.6769C118.281 39.4252 118.969 40.9045 118.711 42.3839L110.704 87.3073C110.489 88.5286 109.121 89.1565 108.054 88.5372L54.2978 57.2982C53.0077 56.5499 52.3196 55.0705 52.5776 53.5911Z"
+            fill="#C0CCCF"
+          />
+          <path
+            id="Vector_8"
+            d="M108.94 88.9071C108.613 88.9071 108.278 88.8211 107.985 88.6491L54.2288 57.41C52.8956 56.6359 52.1818 55.0877 52.4484 53.5739L60.456 8.65056C60.5678 8.03128 60.9548 7.51522 61.5311 7.25719C62.1074 6.99055 62.7525 7.02496 63.2943 7.3346L117.051 38.5737C118.384 39.3478 119.098 40.8959 118.831 42.4097L110.824 87.3331C110.712 87.9524 110.325 88.4684 109.749 88.7265C109.491 88.8469 109.215 88.9071 108.94 88.9071ZM52.6978 53.6169C52.4484 55.0275 53.1107 56.4639 54.3492 57.1864L108.106 88.4254C108.579 88.7007 109.138 88.7265 109.628 88.4942C110.127 88.262 110.463 87.8234 110.557 87.2815L118.565 42.3581C118.814 40.9476 118.152 39.5112 116.913 38.7887L63.1653 7.54962C62.6923 7.27439 62.1332 7.24859 61.6429 7.48081C61.1441 7.71304 60.8086 8.1517 60.714 8.69356L52.7064 53.6169H52.6978Z"
+            fill="black"
+          />
+          <path
+            id="Vector_9"
+            d="M54.8826 54.4684L63.088 7.48938L116.888 38.7972C118.186 39.5541 118.866 41.0335 118.599 42.5129L110.669 86.6966L54.874 54.4684H54.8826Z"
+            fill="#EDEEF2"
+          />
+          <path
+            id="Vector_10"
+            d="M59.2517 49.4884L64.3349 16.1851C64.6102 14.3875 66.6142 13.4241 68.1882 14.3445L118.307 43.5795C117.128 50.7098 111.452 82.3015 111.452 82.3015L61.6084 54.1932C59.8968 53.2987 58.942 51.3978 59.2517 49.4884Z"
+            fill="white"
+          />
+          <path
+            id="Vector_11"
+            d="M88.826 34.9692C93.7035 37.7887 96.626 45.0536 95.35 51.2072C94.074 57.3607 89.0935 60.0362 84.216 57.2373C79.3384 54.4383 76.3954 47.1528 77.6714 41.0199C78.9474 34.8869 83.9278 32.1703 88.826 34.9898V34.9692ZM87.1178 40.2172L85.6772 47.194C85.5949 47.5645 85.7801 48.0378 86.0888 48.2024C86.3975 48.3671 86.7062 48.2024 86.7885 47.832L88.2291 40.8552C88.3115 40.4848 88.1262 40.0114 87.8175 39.8468C87.5088 39.6822 87.2001 39.8468 87.1178 40.2172ZM85.0803 53.0594C85.6772 53.4093 86.3152 53.0594 86.4798 52.298C86.6445 51.5365 86.274 50.6104 85.6566 50.2605C85.0392 49.9106 84.4218 50.2399 84.2571 51.022C84.0925 51.804 84.4629 52.689 85.0803 53.0594Z"
+            fill="#D56C7B"
+          />
+          <path
+            id="Vector_12"
+            d="M110.669 86.9977C110.669 86.9977 110.626 86.9977 110.6 86.9805L54.9085 54.7523C54.8655 54.7265 54.8397 54.6749 54.8483 54.6147L63.0537 7.63568C63.0623 7.56687 63.1312 7.52386 63.2 7.53246C63.2688 7.54106 63.3204 7.60987 63.3032 7.67868L55.115 54.5631L110.729 86.7483C110.79 86.7827 110.815 86.8601 110.772 86.9289C110.747 86.9719 110.704 86.9977 110.661 86.9977H110.669Z"
+            fill="black"
+          />
+          <path
+            id="Vector_13"
+            d="M52.8699 55.879C52.8269 55.879 52.7753 55.8532 52.7581 55.8102C52.7237 55.75 52.7495 55.6726 52.8097 55.6382L54.9084 54.52C54.9686 54.4856 55.046 54.5114 55.0804 54.5717C55.1148 54.6319 55.089 54.7093 55.0288 54.7437L52.9301 55.8618C52.9301 55.8618 52.8871 55.879 52.8699 55.879Z"
+            fill="black"
+          />
+        </g>
+        <g id="Group_2">
+          <path
+            id="Vector_14"
+            d="M110.084 93.6548C111.572 94.5149 111.58 95.9169 110.092 96.777L69.7535 120.215C68.2741 121.075 65.8572 121.075 64.3606 120.215L5.49492 86.2321C4.00694 85.372 3.99834 83.97 5.47772 83.1099L45.8167 59.672C47.3047 58.8033 49.7216 58.8033 51.2096 59.672L110.075 93.6634L110.084 93.6548Z"
+            fill="white"
+          />
+          <path
+            id="Vector_15"
+            d="M111.142 95.6158C111.142 95.6158 111.142 95.6416 111.133 95.6588C111.09 95.7792 111.03 95.8997 110.952 96.0115C110.935 96.0287 110.927 96.0545 110.909 96.0717C110.823 96.1835 110.729 96.2953 110.608 96.4071C110.531 96.4759 110.428 96.5447 110.342 96.6049C110.264 96.6651 110.196 96.7254 110.101 96.777L69.762 120.215C69.5383 120.344 69.2803 120.456 69.0137 120.542C68.919 120.576 68.8244 120.602 68.7298 120.628C68.6008 120.662 68.4804 120.697 68.3514 120.722C68.1966 120.757 68.0417 120.783 67.8869 120.8C67.8525 120.8 67.8095 120.808 67.7751 120.817C67.5601 120.843 67.3451 120.851 67.1386 120.851C67.1128 120.851 67.0956 120.851 67.0698 120.851V127.07C67.0698 127.07 67.1042 127.07 67.1214 127.07C67.1816 127.07 67.2332 127.07 67.2934 127.07C67.4311 127.07 67.5773 127.053 67.7149 127.044C67.7321 127.044 67.7493 127.044 67.7579 127.044C67.7923 127.044 67.8353 127.036 67.8697 127.027C67.9815 127.01 68.0847 127.001 68.1966 126.984C68.2396 126.984 68.2912 126.958 68.3342 126.949C68.4632 126.924 68.5922 126.889 68.7126 126.855C68.7814 126.838 68.8502 126.829 68.919 126.803C68.9535 126.795 68.9707 126.777 69.0051 126.769C69.2717 126.674 69.5297 126.571 69.7534 126.442L110.092 103.004C110.092 103.004 110.127 102.987 110.135 102.978C110.204 102.935 110.264 102.884 110.325 102.841C110.419 102.772 110.514 102.712 110.591 102.643C110.591 102.643 110.608 102.634 110.617 102.626C110.703 102.54 110.789 102.454 110.858 102.368C110.875 102.35 110.884 102.325 110.901 102.307C110.918 102.29 110.927 102.264 110.944 102.247C110.97 102.213 110.995 102.178 111.013 102.144C111.056 102.075 111.09 101.998 111.116 101.929C111.116 101.92 111.116 101.903 111.124 101.895C111.124 101.877 111.124 101.869 111.133 101.852C111.15 101.809 111.167 101.757 111.176 101.714C111.193 101.645 111.202 101.568 111.202 101.499C111.202 101.49 111.202 101.473 111.202 101.465L111.219 95.246C111.219 95.375 111.193 95.5126 111.15 95.6416L111.142 95.6158Z"
+            fill="#C0CCCF"
+          />
+          <path
+            id="Vector_16"
+            d="M67.0184 120.86C66.8034 120.86 66.597 120.843 66.3906 120.826C66.3562 120.826 66.3303 120.826 66.2959 120.817C66.0895 120.791 65.8831 120.757 65.6853 120.714C65.6509 120.714 65.6165 120.697 65.5735 120.688C65.3928 120.645 65.2122 120.593 65.0488 120.525C65.0144 120.516 64.9886 120.507 64.9542 120.49C64.7477 120.413 64.5585 120.318 64.3779 120.215L5.49502 86.2321C4.74672 85.802 4.36828 85.2258 4.36828 84.6581L4.35107 90.8766C4.35107 91.4443 4.72092 92.012 5.47781 92.4506L64.3435 126.442C64.5155 126.545 64.6961 126.631 64.894 126.709C64.9026 126.709 64.9112 126.709 64.9284 126.717C64.9628 126.726 64.9886 126.734 65.023 126.752C65.1348 126.795 65.2466 126.829 65.3584 126.863C65.4186 126.881 65.4874 126.898 65.5476 126.907C65.5821 126.915 65.6165 126.924 65.6595 126.932C65.6939 126.932 65.7197 126.95 65.7541 126.958C65.8745 126.984 66.0035 127.01 66.1325 127.027C66.1755 127.027 66.2271 127.036 66.2701 127.044C66.3045 127.044 66.3304 127.044 66.3648 127.053C66.4078 127.053 66.4594 127.061 66.5024 127.07C66.6314 127.079 66.7518 127.087 66.8808 127.087C66.9238 127.087 66.9582 127.087 67.0012 127.087C67.0184 127.087 67.0356 127.087 67.0528 127.087V120.869C67.0528 120.869 67.027 120.869 67.0184 120.869V120.86Z"
+            fill="#E0E3E3"
+          />
+          <path
+            id="Vector_17"
+            d="M66.8806 127.216C66.7516 127.216 66.6226 127.208 66.4936 127.199L66.2011 127.165C66.2011 127.165 66.1409 127.165 66.1151 127.156C65.9861 127.139 65.8571 127.113 65.7281 127.087C65.7023 127.087 65.6851 127.079 65.6593 127.07L65.4442 127.018C65.4442 127.018 65.3582 127.001 65.3238 126.984C65.2034 126.95 65.0916 126.907 64.9798 126.863L64.9368 126.846C64.9368 126.846 64.9024 126.838 64.8852 126.829L64.9024 126.7L64.8508 126.821C64.6443 126.743 64.4551 126.648 64.2831 126.545L5.41741 92.5625C4.65192 92.1152 4.23047 91.5217 4.23047 90.8766L4.24767 84.6581H4.5057C4.5057 85.1999 4.88415 85.7246 5.56363 86.1203L64.4293 120.112C64.6013 120.206 64.7906 120.301 64.9884 120.378L65.083 120.413C65.255 120.473 65.427 120.525 65.5991 120.568L65.7023 120.593C65.9001 120.636 66.0979 120.671 66.3043 120.697H66.399C66.6054 120.731 66.8118 120.74 67.0182 120.74H67.1215C67.3365 120.74 67.5515 120.722 67.7493 120.705L67.8525 120.688C68.0074 120.671 68.1622 120.645 68.3084 120.611C68.4374 120.585 68.5578 120.55 68.6782 120.516C68.7729 120.49 68.8675 120.464 68.9621 120.43C69.2545 120.327 69.4953 120.223 69.6932 120.112L110.032 96.6738C110.084 96.6394 110.135 96.605 110.178 96.5706L110.325 96.4673C110.393 96.4243 110.462 96.3727 110.514 96.3211C110.626 96.2265 110.72 96.1147 110.798 96.0029L110.823 95.9685C110.918 95.8309 110.97 95.719 111.004 95.6158H111.073V95.5986L111.013 95.5814C111.056 95.4524 111.073 95.3406 111.073 95.2288H111.331L111.314 101.49C111.314 101.568 111.305 101.654 111.288 101.731C111.288 101.774 111.262 101.817 111.254 101.869L111.219 101.972C111.193 102.049 111.15 102.127 111.107 102.204C111.09 102.23 111.073 102.256 111.056 102.282L110.987 102.385C110.987 102.385 110.952 102.436 110.944 102.454C110.866 102.548 110.78 102.643 110.694 102.72L110.669 102.738C110.6 102.798 110.522 102.849 110.445 102.91L110.385 102.953C110.385 102.953 110.342 102.987 110.316 103.004C110.273 103.039 110.239 103.064 110.187 103.099L110.135 103.125L69.7964 126.562C69.5814 126.683 69.3405 126.795 69.0223 126.898C68.9793 126.924 68.9535 126.932 68.9363 126.932C68.9019 126.941 68.8589 126.958 68.8159 126.967C68.7901 126.967 68.7643 126.975 68.7384 126.984C68.6094 127.018 68.4804 127.053 68.3428 127.079C68.3256 127.079 68.3084 127.087 68.2912 127.096C68.2654 127.096 68.2396 127.113 68.2052 127.113C68.1106 127.13 68.0074 127.147 67.9041 127.156L67.7063 127.182C67.5601 127.199 67.4225 127.208 67.2763 127.208C67.2419 127.208 67.1989 127.208 67.1559 127.208H66.8806V127.216ZM67.6805 126.932L67.7407 127.053L67.7235 126.924L67.8697 126.907C67.9644 126.898 68.059 126.881 68.1536 126.863C68.1708 126.863 68.1966 126.855 68.2138 126.846C68.2396 126.846 68.2654 126.829 68.2826 126.829C68.4116 126.803 68.532 126.769 68.6524 126.734C68.6868 126.734 68.7126 126.717 68.7471 126.709C68.7815 126.709 68.8159 126.691 68.8503 126.683H68.8847C68.8847 126.683 68.9191 126.657 68.9363 126.648C69.2373 126.545 69.4695 126.442 69.6674 126.33L110.006 102.892L110.118 102.978L110.049 102.867C110.049 102.867 110.118 102.815 110.153 102.789C110.178 102.772 110.204 102.746 110.23 102.729L110.29 102.686C110.359 102.634 110.428 102.591 110.488 102.54L110.514 102.522C110.591 102.454 110.669 102.368 110.737 102.282L110.841 102.127C110.841 102.127 110.866 102.092 110.875 102.075C110.909 102.006 110.944 101.946 110.97 101.877C110.97 101.869 110.97 101.852 110.978 101.843V101.809C111.004 101.757 111.013 101.723 111.021 101.68C111.038 101.611 111.038 101.551 111.047 101.482L111.064 96.0631C111.064 96.0631 111.047 96.0889 111.047 96.0975C111.021 96.1319 111.013 96.1491 111.004 96.1663C110.909 96.2867 110.806 96.4071 110.686 96.519C110.626 96.5792 110.548 96.6308 110.471 96.6824L110.333 96.777C110.282 96.82 110.221 96.863 110.161 96.8974L69.8222 120.335C69.6072 120.456 69.3577 120.568 69.0481 120.671C68.9535 120.705 68.8503 120.731 68.7557 120.757C68.6266 120.791 68.4976 120.826 68.3686 120.851C68.2138 120.886 68.059 120.912 67.8955 120.929L67.7837 120.946C67.5773 120.972 67.3537 120.98 67.1301 120.98H67.0268C66.8118 120.98 66.5968 120.963 66.3818 120.946H66.2871C66.0721 120.912 65.8657 120.877 65.6593 120.826C65.6335 120.826 65.6163 120.817 65.5905 120.808H65.5475C65.3668 120.757 65.1862 120.697 65.0056 120.636H64.9712C64.9712 120.636 64.9282 120.611 64.911 120.602C64.696 120.516 64.4895 120.421 64.3089 120.318L5.43462 86.3439C5.02177 86.1031 4.70353 85.8192 4.5057 85.501L4.4885 90.8766C4.4885 91.4271 4.86695 91.9432 5.54643 92.3388L64.4121 126.33C64.5755 126.425 64.7562 126.511 64.9454 126.588L64.9282 126.717L64.9712 126.597L65.0056 126.614C65.0056 126.614 65.04 126.623 65.0572 126.631C65.1604 126.666 65.2722 126.709 65.384 126.743C65.4184 126.752 65.4614 126.76 65.4958 126.769L65.7711 126.838C65.8915 126.863 66.0205 126.881 66.1409 126.907L66.5022 126.95C66.6226 126.958 66.743 126.967 66.872 126.967H67.1473C67.1473 126.967 67.2161 126.967 67.2591 126.967C67.3967 126.967 67.5343 126.95 67.6719 126.941L67.6805 126.932Z"
+            fill="black"
+          />
+          <path
+            id="Vector_18"
+            d="M67.0611 120.989C66.0634 120.989 65.0571 120.765 64.3002 120.327L5.4345 86.3439C4.66901 85.9052 4.24756 85.3032 4.24756 84.6667C4.24756 84.0302 4.66041 83.4367 5.4173 82.9981L45.7563 59.5602C47.2787 58.6743 49.7558 58.6743 51.2782 59.5602L110.144 93.5516C110.909 93.9902 111.331 94.5923 111.331 95.2288C111.331 95.8653 110.918 96.4587 110.152 96.8974L69.8135 120.335C69.0566 120.774 68.0589 120.998 67.0611 120.998V120.989ZM48.5086 59.1473C47.5539 59.1473 46.5992 59.3624 45.8767 59.7838L5.53772 83.2217C4.86684 83.6174 4.49699 84.1248 4.49699 84.6667C4.49699 85.2086 4.87544 85.7246 5.55492 86.1203L64.4206 120.112C65.8742 120.955 68.2309 120.955 69.6845 120.112L110.023 96.6738C110.703 96.2781 111.073 95.7707 111.073 95.2288C111.073 94.6869 110.694 94.1709 110.015 93.7752L51.1492 59.7838C50.4267 59.3624 49.472 59.1559 48.5172 59.1559L48.5086 59.1473Z"
+            fill="black"
+          />
+        </g>
+        <path
+          id="Vector_19"
+          d="M56.9466 66.7335L56.938 69.0644L47.3306 74.6551V72.3242L56.9466 66.7335Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_20"
+          d="M47.3307 72.3242V74.6551L36.5708 68.4451L36.5794 66.1143L47.3307 72.3242Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_21"
+          d="M47.3304 74.8013L47.2615 74.7669L36.4414 68.5225V65.8906L47.3304 72.1694L57.0754 66.5099V69.1418L57.0065 69.1762L47.3304 74.8013ZM36.708 68.3677L47.3304 74.5003L56.8173 68.987V66.9572L47.339 72.4704L47.2701 72.436L36.708 66.3379V68.3763V68.3677Z"
+          fill="black"
+        />
+        <path
+          id="Vector_22"
+          d="M56.9464 66.7335L47.3304 72.3242L36.5791 66.1143L46.1951 60.5236L56.9464 66.7335Z"
+          fill="white"
+        />
+        <path
+          id="Vector_23"
+          d="M47.3305 72.4704L47.2617 72.436L36.3125 66.1142L46.1865 60.3773L57.1959 66.7335L47.3219 72.4704H47.3305ZM36.8372 66.1142L47.3305 72.1694L56.6884 66.7335L46.1865 60.6698L36.8286 66.1056L36.8372 66.1142Z"
+          fill="black"
+        />
+        <path
+          id="Vector_24"
+          d="M68.7215 73.537V75.8679L59.1055 81.4586L59.1141 79.1191L68.7215 73.537Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_25"
+          d="M59.1139 79.119L59.1053 81.4585L48.354 75.2485L48.3626 72.9176L59.1139 79.119Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_26"
+          d="M59.1054 81.6047L59.0366 81.5703L48.2251 75.3259V72.694L59.1054 78.9727L68.8505 73.3132V75.9452L68.7816 75.9796L59.1054 81.6047ZM48.4831 75.1711L59.1054 81.3036L68.5924 75.7904V73.7605L59.114 79.2738L59.0452 79.2394L48.4917 73.1498V75.1883L48.4831 75.1711Z"
+          fill="black"
+        />
+        <path
+          id="Vector_27"
+          d="M68.7215 73.5369L59.1141 79.119L48.3628 72.9176L57.9788 67.3269L68.7215 73.5369Z"
+          fill="white"
+        />
+        <path
+          id="Vector_28"
+          d="M59.1139 79.274L59.045 79.2395L48.1045 72.9264L57.9785 67.1895L68.9793 73.5456L59.1053 79.2826L59.1139 79.274ZM48.6206 72.9178L59.1139 78.9729L68.4718 73.537L57.9785 67.4819L48.6206 72.9178Z"
+          fill="black"
+        />
+        <path
+          id="Vector_29"
+          d="M80.5047 80.3403V82.6712L70.8887 88.2619L70.8973 85.9224L80.5047 80.3403Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_30"
+          d="M70.8976 85.9225L70.889 88.262L60.1377 82.052V79.7125L70.8976 85.9225Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_31"
+          d="M70.8889 88.4081L70.8201 88.3737L60 82.1294V79.4974L70.8889 85.7762L80.634 80.1167V82.7486L80.5651 82.783L70.8889 88.4081ZM60.2666 81.9745L70.8889 88.1071L80.3759 82.5938V80.564L70.8975 86.0772L70.8287 86.0428L60.2666 79.9447V81.9831V81.9745Z"
+          fill="black"
+        />
+        <path
+          id="Vector_32"
+          d="M80.505 80.3405L70.8976 85.9226L60.1377 79.7126L69.7537 74.1305L80.505 80.3405Z"
+          fill="white"
+        />
+        <path
+          id="Vector_33"
+          d="M70.8974 86.0772L70.8285 86.0428L59.8794 79.721L69.7534 73.9841L69.8222 74.0185L80.7714 80.3403L70.8974 86.0772ZM60.3955 79.721L70.8974 85.7762L80.2553 80.3403L69.762 74.2852L60.4041 79.721H60.3955Z"
+          fill="black"
+        />
+        <path
+          id="Vector_34"
+          d="M53.2307 77.2612L53.2221 79.5921L43.6147 85.1828V82.8519L53.2307 77.2612Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_35"
+          d="M43.6149 82.8518V85.1827L25.6387 74.8012V72.4703L43.6149 82.8518Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_36"
+          d="M43.6148 85.329L43.546 85.2946L25.501 74.8787V72.2468L43.6148 82.6971L53.3598 77.0376V79.6695L53.291 79.7039L43.6148 85.329ZM25.7676 74.7239L43.6148 85.028L53.1018 79.5147V77.4849L43.6234 82.9982L43.5546 82.9638L25.7676 72.6941V74.7325V74.7239Z"
+          fill="black"
+        />
+        <path
+          id="Vector_37"
+          d="M53.2309 77.2611L43.6149 82.8518L25.6387 72.4703L35.2547 66.8796L53.2309 77.2611Z"
+          fill="white"
+        />
+        <path
+          id="Vector_38"
+          d="M43.6148 82.9809C43.6148 82.9809 43.5718 82.9809 43.546 82.9637L25.5698 72.5823C25.5698 72.5823 25.501 72.5134 25.501 72.4704C25.501 72.4274 25.5268 72.3844 25.5698 72.3586L35.1858 66.7679C35.1858 66.7679 35.2718 66.7421 35.3148 66.7679L53.291 77.1494C53.291 77.1494 53.3598 77.2182 53.3598 77.2612C53.3598 77.3042 53.334 77.3472 53.291 77.3731L43.675 82.9637C43.675 82.9637 43.632 82.9809 43.6062 82.9809H43.6148ZM25.8966 72.4704L43.6148 82.6971L52.9728 77.2612L35.2546 67.0346L25.8966 72.4704Z"
+          fill="black"
+        />
+        <path
+          id="Vector_39"
+          d="M65.0574 84.0905L65.0488 86.4213L55.4414 92.012V89.6811L65.0574 84.0905Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_40"
+          d="M55.4416 89.6812V92.012L44.6816 85.8021L44.6902 83.4712L55.4416 89.6812Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_41"
+          d="M55.4412 92.1583L55.3724 92.1239L44.5522 85.8795V83.2476L55.4412 89.5263L65.1862 83.8668V86.4988L65.1174 86.5332L55.4412 92.1583ZM44.8189 85.7247L55.4412 91.8572L64.9282 86.3439V84.3141L55.4498 89.8274L55.381 89.793L44.8189 83.6948V85.7333V85.7247Z"
+          fill="black"
+        />
+        <path
+          id="Vector_42"
+          d="M65.0573 84.0905L55.4413 89.6812L44.6899 83.4712L54.3059 77.8805L65.0573 84.0905Z"
+          fill="white"
+        />
+        <path
+          id="Vector_43"
+          d="M55.4412 89.8102C55.4412 89.8102 55.3982 89.8102 55.3724 89.793L44.621 83.583C44.621 83.583 44.5522 83.5142 44.5522 83.4712C44.5522 83.4282 44.578 83.3852 44.621 83.3594L54.237 77.7687C54.237 77.7687 54.3231 77.7429 54.3661 77.7687L65.1174 83.9786C65.1174 83.9786 65.1862 84.0474 65.1862 84.0905C65.1862 84.1335 65.1604 84.1765 65.1174 84.2023L55.5014 89.793C55.5014 89.793 55.4584 89.8102 55.4326 89.8102H55.4412ZM44.9393 83.4712L55.4412 89.5263L64.7991 84.0905L54.2972 78.0353L44.9393 83.4712Z"
+          fill="black"
+        />
+        <path
+          id="Vector_44"
+          d="M92.4347 87.1869L92.4261 89.5178L82.8101 95.1085L82.8187 92.7776L92.4347 87.1869Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_45"
+          d="M82.8185 92.7775L82.8099 95.1084L72.0586 88.8984L72.0672 86.5675L82.8185 92.7775Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_46"
+          d="M82.8098 95.2546L82.741 95.2202L71.9209 88.9758V86.3439L82.8098 92.6226L92.5548 86.9631V89.5951L92.486 89.6295L82.8098 95.2546ZM72.1875 88.821L82.8098 94.9535L92.2968 89.4403V87.4104L82.8184 92.9237L82.7496 92.8893L72.1875 86.7911V88.8296V88.821Z"
+          fill="black"
+        />
+        <path
+          id="Vector_47"
+          d="M92.4347 87.1868L82.8187 92.7775L72.0674 86.5675L81.6748 80.9768L92.4347 87.1868Z"
+          fill="white"
+        />
+        <path
+          id="Vector_48"
+          d="M82.8186 92.9066C82.8186 92.9066 82.7756 92.9066 82.7498 92.8894L71.9985 86.6794C71.9985 86.6794 71.9297 86.6106 71.9297 86.5676C71.9297 86.5246 71.9555 86.4816 71.9985 86.4558L81.6145 80.8651C81.6145 80.8651 81.7005 80.8393 81.7435 80.8651L92.4948 87.0751C92.4948 87.0751 92.5636 87.1439 92.5636 87.1869C92.5636 87.2299 92.5378 87.2729 92.4948 87.2987L82.8788 92.8894C82.8788 92.8894 82.8358 92.9066 82.81 92.9066H82.8186ZM72.3253 86.5676L82.8186 92.6228L92.1766 87.1869L81.6747 81.1317L72.3167 86.5676H72.3253Z"
+          fill="black"
+        />
+        <path
+          id="Vector_49"
+          d="M67.3711 96.5276L67.3625 98.8585L56.6025 92.6485L56.6111 90.3176L67.3711 96.5276Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_50"
+          d="M76.9783 90.937V93.2679L67.3623 98.8586L67.3709 96.5277L76.9783 90.937Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_51"
+          d="M67.3626 99.0048L67.2938 98.9704L56.4736 92.726V90.0941L67.3626 96.3729L77.1076 90.7134V93.3453L77.0388 93.3797L67.3626 99.0048ZM56.7403 92.5712L67.3626 98.7038L76.8495 93.1905V91.1606L67.3712 96.6739L67.3024 96.6395L56.7403 90.5414V92.5798V92.5712Z"
+          fill="black"
+        />
+        <path
+          id="Vector_52"
+          d="M76.9786 90.9369L67.3713 96.5276L56.6113 90.3176L66.2273 84.7269L76.9786 90.9369Z"
+          fill="white"
+        />
+        <path
+          id="Vector_53"
+          d="M67.3709 96.6566C67.3709 96.6566 67.3279 96.6566 67.3021 96.6394L56.5507 90.4294C56.5507 90.4294 56.4819 90.3606 56.4819 90.3176C56.4819 90.2746 56.5077 90.2316 56.5507 90.2058L66.1667 84.6151C66.1667 84.6151 66.2527 84.5893 66.2958 84.6151L77.0471 90.8251C77.0471 90.8251 77.1159 90.8939 77.1159 90.9369C77.1159 90.9799 77.0901 91.0229 77.0471 91.0487L67.4311 96.6394C67.4311 96.6394 67.3881 96.6566 67.3623 96.6566H67.3709ZM56.869 90.3176L67.3709 96.3728L76.7288 90.9369L66.2355 84.8817L56.8776 90.3176H56.869Z"
+          fill="black"
+        />
+        <path
+          id="Vector_54"
+          d="M104.287 94.0677L93.3637 100.415L92.9852 100.639L83.7563 105.997L68.4292 97.1555L78.0366 91.5648L82.6124 94.2139L93.5443 87.8663L104.287 94.0677Z"
+          fill="white"
+        />
+        <path
+          id="Vector_55"
+          d="M83.7562 105.997L83.7476 108.337L104.278 96.3986L104.287 94.0677L83.7562 105.997Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_56"
+          d="M83.7561 105.997L83.7475 108.337L68.4204 99.4864L68.429 97.1555L83.7561 105.997Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_57"
+          d="M83.7562 106.135C83.7562 106.135 83.7132 106.135 83.6874 106.118L68.3603 97.2673C68.3603 97.2673 68.2915 97.1985 68.2915 97.1555C68.2915 97.1125 68.3173 97.0695 68.3603 97.0437L77.9677 91.4616C77.9677 91.4616 78.0537 91.4358 78.0967 91.4616L82.6123 94.0677L93.4754 87.7545C93.4754 87.7545 93.5614 87.7287 93.6044 87.7545L104.356 93.9559C104.356 93.9559 104.425 94.0247 104.425 94.0677C104.425 94.1107 104.399 94.1537 104.356 94.1795L83.825 106.109C83.825 106.109 83.782 106.126 83.7562 106.126V106.135ZM68.6872 97.1555L83.7562 105.86L104.038 94.0763L93.5442 88.0211L82.6811 94.3343C82.6811 94.3343 82.5951 94.3601 82.5521 94.3343L78.0365 91.7282L68.6872 97.1641V97.1555Z"
+          fill="black"
+        />
+        <path
+          id="Vector_58"
+          d="M83.7474 108.466C83.7474 108.466 83.7044 108.466 83.6786 108.449L68.3515 99.5981C68.3515 99.5981 68.2827 99.5293 68.2827 99.4863V97.1554C68.2827 97.1124 68.3171 97.0694 68.3515 97.0436C68.3945 97.0178 68.4375 97.0178 68.4805 97.0436L83.7388 105.851L104.209 93.9558C104.209 93.9558 104.295 93.93 104.338 93.9558C104.381 93.9816 104.407 94.0246 104.407 94.0676V96.3985C104.407 96.4415 104.373 96.4845 104.338 96.5103L83.8076 108.44C83.8076 108.44 83.7646 108.457 83.7388 108.457L83.7474 108.466ZM68.5493 99.4089L83.7474 108.182L104.149 96.3211V94.2912L83.8076 106.109C83.7646 106.135 83.7216 106.135 83.6786 106.109L68.5493 97.3704V99.4089Z"
+          fill="black"
+        />
+        <path
+          id="Vector_59"
+          d="M35.1256 79.4202L25.5096 85.0023L14.7583 78.7923L24.3743 73.2102L35.1256 79.4202Z"
+          fill="white"
+        />
+        <path
+          id="Vector_60"
+          d="M35.1256 79.4202L35.117 81.7511L25.501 87.3331L25.5096 85.0023L35.1256 79.4202Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_61"
+          d="M25.5099 85.0022L25.5013 87.3331L14.75 81.1317L14.7586 78.7922L25.5099 85.0022Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_62"
+          d="M25.5099 85.0022L14.7586 78.7922L14.75 81.1317L25.5013 87.3331L35.1173 81.751L35.1259 79.4201L25.5099 85.0022Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_63"
+          d="M25.5013 87.4707C25.5013 87.4707 25.4582 87.4707 25.4324 87.4535L14.6811 81.2435C14.6811 81.2435 14.6123 81.1747 14.6123 81.1317V78.8008C14.6123 78.7578 14.6467 78.7148 14.6811 78.689C14.7241 78.6632 14.7671 78.6632 14.8101 78.689L25.5013 84.856L35.0484 79.3083C35.0484 79.3083 35.1344 79.2825 35.1774 79.3083C35.2205 79.3341 35.2463 79.3771 35.2463 79.4201V81.751C35.2463 81.794 35.2119 81.837 35.1774 81.8628L25.5615 87.4535C25.5615 87.4535 25.5185 87.4707 25.4926 87.4707H25.5013ZM14.8789 81.0543L25.5013 87.1869L34.9882 81.6736V79.6437L25.5701 85.114C25.5271 85.1398 25.484 85.1398 25.441 85.114L14.8789 79.0159V81.0543Z"
+          fill="black"
+        />
+        <path
+          id="Vector_64"
+          d="M25.5096 85.1312C25.5096 85.1312 25.4665 85.1312 25.4407 85.114L14.6894 78.904C14.6894 78.904 14.6206 78.8352 14.6206 78.7922C14.6206 78.7492 14.6464 78.7062 14.6894 78.6804L24.3054 73.0897C24.3054 73.0897 24.3914 73.0639 24.4344 73.0897L35.1857 79.2997C35.1857 79.2997 35.2546 79.3685 35.2546 79.4115C35.2546 79.4545 35.2288 79.4975 35.1857 79.5233L25.5698 85.114C25.5698 85.114 25.5268 85.1312 25.501 85.1312H25.5096ZM15.0163 78.7922L25.5096 84.8474L34.8675 79.4115L24.3656 73.3477L15.0077 78.7836L15.0163 78.7922Z"
+          fill="black"
+        />
+        <path
+          id="Vector_65"
+          d="M70.545 99.8648L60.929 105.455L26.585 85.6214L36.201 80.0393L70.545 99.8648Z"
+          fill="white"
+        />
+        <path
+          id="Vector_66"
+          d="M70.545 99.8649L70.5364 102.196L60.9204 107.786L60.929 105.456L70.545 99.8649Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_67"
+          d="M60.9288 105.456L60.9202 107.786L26.5762 87.9523L26.5848 85.6215L60.9288 105.456Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_68"
+          d="M60.9288 105.456L26.5848 85.6215L26.5762 87.9523L60.9202 107.786L70.5362 102.196L70.5448 99.8648L60.9288 105.456Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_69"
+          d="M60.9201 107.915C60.9201 107.915 60.8771 107.915 60.8513 107.898L26.5073 88.0728C26.5073 88.0728 26.4385 88.004 26.4385 87.961V85.6301C26.4385 85.5871 26.4729 85.5441 26.5073 85.5183C26.5503 85.4925 26.5933 85.4925 26.6363 85.5183L60.9201 105.309L70.4673 99.7616C70.4673 99.7616 70.5533 99.7358 70.5963 99.7616C70.6393 99.7874 70.6651 99.8304 70.6651 99.8734V102.204C70.6651 102.247 70.6307 102.29 70.5963 102.316L60.9804 107.907C60.9804 107.907 60.9373 107.924 60.9115 107.924L60.9201 107.915ZM26.7051 87.8835L60.9201 107.64L70.4071 102.127V100.097L60.9975 105.576C60.9545 105.602 60.9115 105.602 60.8685 105.576L26.7137 85.8623V87.9007L26.7051 87.8835Z"
+          fill="black"
+        />
+        <path
+          id="Vector_70"
+          d="M60.9289 105.585C60.9289 105.585 60.8859 105.585 60.8601 105.567L26.5161 85.7419C26.5161 85.7419 26.4473 85.6731 26.4473 85.6301C26.4473 85.5871 26.4731 85.5441 26.5161 85.5183L36.1321 79.9276C36.1321 79.9276 36.2181 79.9018 36.2611 79.9276L70.6051 99.7531C70.6051 99.7531 70.6739 99.8219 70.6739 99.8649C70.6739 99.9079 70.6481 99.9509 70.6051 99.9767L60.9891 105.567C60.9891 105.567 60.9461 105.585 60.9203 105.585H60.9289ZM26.8429 85.6215L60.9289 105.301L70.2869 99.8649L36.2009 80.1856L26.8429 85.6215Z"
+          fill="black"
+        />
+        <path
+          id="Vector_71"
+          d="M82.3712 106.694L72.7552 112.285L62.0039 106.075L71.6199 100.493L82.3712 106.694Z"
+          fill="white"
+        />
+        <path
+          id="Vector_72"
+          d="M82.3712 106.694L82.3626 109.025L72.7466 114.616L72.7552 112.285L82.3712 106.694Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_73"
+          d="M72.7552 112.285L72.7466 114.616L62.0039 108.406V106.075L72.7552 112.285Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_74"
+          d="M72.7552 112.285L62.0039 106.075V108.406L72.7466 114.616L82.3626 109.025L82.3712 106.694L72.7552 112.285Z"
+          fill="#C0CCCF"
+        />
+        <path
+          id="Vector_75"
+          d="M72.7469 114.745C72.7469 114.745 72.7039 114.745 72.6781 114.727L61.9267 108.526C61.9267 108.526 61.8579 108.457 61.8579 108.414V106.083C61.8579 106.04 61.8923 105.997 61.9267 105.972C61.9697 105.946 62.0127 105.946 62.0557 105.972L72.7383 112.139L82.2854 106.591C82.2854 106.591 82.3715 106.565 82.4145 106.591C82.4575 106.617 82.4833 106.66 82.4833 106.703V109.034C82.4833 109.077 82.4489 109.12 82.4145 109.145L72.7985 114.736C72.7985 114.736 72.7555 114.753 72.7297 114.753L72.7469 114.745ZM62.1245 108.337L72.7469 114.469L82.2338 108.956V106.926L72.8157 112.405C72.7727 112.431 72.7297 112.431 72.6867 112.405L62.1331 106.316V108.354L62.1245 108.337Z"
+          fill="black"
+        />
+        <path
+          id="Vector_76"
+          d="M72.7552 112.414C72.7552 112.414 72.7122 112.414 72.6864 112.397L61.935 106.195C61.935 106.195 61.8662 106.126 61.8662 106.083C61.8662 106.04 61.892 105.997 61.935 105.972L71.551 100.381C71.551 100.381 71.637 100.355 71.68 100.381L82.4314 106.582C82.4314 106.582 82.5002 106.651 82.5002 106.694C82.5002 106.737 82.4744 106.78 82.4314 106.806L72.8154 112.397C72.8154 112.397 72.7724 112.414 72.7466 112.414H72.7552ZM62.2619 106.075L72.7552 112.13L82.1131 106.694L71.6198 100.639L62.2619 106.075Z"
+          fill="black"
+        />
+      </g>
+    </svg>
+  );
+};
+
+export default DataError;
diff --git a/frontend/components/graphics/EmptySearchCheck.tsx b/frontend/components/graphics/EmptySearchCheck.tsx
new file mode 100644
index 000000000000..3c15d02f3841
--- /dev/null
+++ b/frontend/components/graphics/EmptySearchCheck.tsx
@@ -0,0 +1,5 @@
+import { renderEmptySearch } from "./EmptySearchQuestion";
+
+const EmptySearchCheck = () => renderEmptySearch("check");
+
+export default EmptySearchCheck;
diff --git a/frontend/components/graphics/EmptySearchExclamation.tsx b/frontend/components/graphics/EmptySearchExclamation.tsx
new file mode 100644
index 000000000000..a86cf0265877
--- /dev/null
+++ b/frontend/components/graphics/EmptySearchExclamation.tsx
@@ -0,0 +1,5 @@
+import { renderEmptySearch } from "./EmptySearchQuestion";
+
+const EmptySearchExclamation = () => renderEmptySearch("exclamation");
+
+export default EmptySearchExclamation;
diff --git a/frontend/components/graphics/EmptySearchQuestion.tsx b/frontend/components/graphics/EmptySearchQuestion.tsx
new file mode 100644
index 000000000000..2d93529d8224
--- /dev/null
+++ b/frontend/components/graphics/EmptySearchQuestion.tsx
@@ -0,0 +1,78 @@
+import React from "react";
+
+export const renderEmptySearch = (
+  type: "exclamation" | "question" | "check"
+) => {
+  const renderIconPath = () => {
+    switch (type) {
+      case "exclamation":
+        return (
+          <path
+            d="m24.24 28.656-1.022-9.774a2.5 2.5 0 1 1 4.973-.003l-1.012 9.775a1.478 1.478 0 0 1-2.94.002h.001Zm-.803 4.951a2.28 2.28 0 1 1 4.562 0 2.28 2.28 0 0 1-4.562 0Z"
+            fill="#9C9EDB"
+          />
+        );
+      case "question":
+        return (
+          <path
+            d="M25.836 30.184a1.966 1.966 0 0 1-1.954-2.167c.059-.587.182-1.194.422-1.682.235-.477.995-1.115 2.166-1.979.613-.45 1.04-.87 1.28-1.259.24-.388.36-.87.36-1.446 0-.71-.226-1.268-.677-1.676-.451-.408-.998-.612-1.64-.612-1.274 0-2.13.675-2.566 2.024a1.945 1.945 0 0 1-2.128 1.313 1.932 1.932 0 0 1-1.53-2.614c.416-1.064 1.017-1.933 1.799-2.608 1.29-1.112 2.866-1.668 4.727-1.668 1.86 0 3.491.547 4.777 1.64 1.285 1.094 1.928 2.48 1.928 4.159 0 2.081-1.07 3.822-3.208 5.223-.931.614-1.495 1.093-1.691 1.439-.065.113-.119.259-.162.436a1.955 1.955 0 0 1-1.903 1.478v-.001Zm.317 5.626h-.173a2.172 2.172 0 1 1 0-4.345h.173a2.173 2.173 0 0 1 0 4.345Z"
+            fill="#9C9EDB"
+          />
+        );
+      case "check":
+        return (
+          <path
+            d="m31.503 18.45-8.13 10.054a.142.142 0 0 1-.202 0l-3.294-4.383a1.855 1.855 0 1 0-2.641 2.606l4.493 5.58a2.284 2.284 0 0 0 3.275-.026l9.181-11.252c.72-.752.68-1.95-.088-2.652l-.008-.007a1.856 1.856 0 0 0-2.586.08Z"
+            fill="#9C9EDB"
+          />
+        );
+      default:
+        return null;
+    }
+  };
+
+  return (
+    <svg width="55" height="71" fill="none" xmlns="http://www.w3.org/2000/svg">
+      <path
+        d="M25.73 49.4c13.123 0 23.762-10.638 23.762-23.761S38.853 1.878 25.73 1.878c-13.123 0-23.761 10.638-23.761 23.76C1.97 38.763 12.608 49.4 25.73 49.4Z"
+        fill="#F1F0FF"
+        stroke="#fff"
+        strokeWidth="1.199"
+      />
+      <path
+        fillRule="evenodd"
+        clipRule="evenodd"
+        d="M11.669 7.23a23.06 23.06 0 0 1 14.06-4.755c12.792 0 23.162 10.37 23.162 23.162a23.06 23.06 0 0 1-4.758 14.065 23.06 23.06 0 0 1-14.06 4.754c-12.792 0-23.162-10.37-23.162-23.161A23.06 23.06 0 0 1 11.67 7.23Z"
+        fill="#fff"
+      />
+      <path
+        fillRule="evenodd"
+        clipRule="evenodd"
+        d="M11.669 7.809a23.06 23.06 0 0 1 14.06-4.755c12.792 0 23.162 10.37 23.162 23.162a23.06 23.06 0 0 1-4.758 14.065 23.06 23.06 0 0 1-14.06 4.754c-12.792 0-23.162-10.37-23.162-23.161A23.06 23.06 0 0 1 11.67 7.809Z"
+        fill="#fff"
+      />
+      {renderIconPath()}
+      <path
+        fillRule="evenodd"
+        clipRule="evenodd"
+        d="M13.687 4.313C1.875 11.132-2.172 26.235 4.647 38.047c6.473 11.211 20.41 15.427 31.91 9.994l4.452 7.712 4.074-2.352-4.48-7.76c10.074-7.34 13.19-21.252 6.818-32.29C40.6 1.542 25.498-2.506 13.687 4.314Zm-6 31.98C1.835 26.158 5.306 13.201 15.44 7.35c10.133-5.85 23.09-2.378 28.941 7.755 5.85 10.133 2.379 23.09-7.755 28.941-10.133 5.85-23.09 2.379-28.94-7.755Z"
+        fill="#E3E3FE"
+        stroke="#9C9EDB"
+        strokeWidth=".882"
+      />
+      <path
+        d="M37.443 52.516a1 1 0 0 1 .366-1.366l4.888-2.822a1 1 0 0 1 1.366.366l9.171 15.886a3 3 0 0 1-1.098 4.098l-1.423.822a3 3 0 0 1-4.098-1.098l-9.172-15.886Z"
+        fill="#9C9EDB"
+      />
+      <path
+        d="M37.825 52.296a.559.559 0 0 1 .205-.764l4.887-2.822a.559.559 0 0 1 .764.205L52.853 64.8a2.56 2.56 0 0 1-.937 3.495l-1.423.822a2.559 2.559 0 0 1-3.496-.937l-9.172-15.885Z"
+        stroke="#9C9EDB"
+        strokeWidth=".882"
+      />
+    </svg>
+  );
+};
+
+const EmptySearchQuestion = () => renderEmptySearch("question");
+
+export default EmptySearchQuestion;
diff --git a/frontend/components/graphics/FileVpp.tsx b/frontend/components/graphics/FileVpp.tsx
new file mode 100644
index 000000000000..35b0abaa5efd
--- /dev/null
+++ b/frontend/components/graphics/FileVpp.tsx
@@ -0,0 +1,59 @@
+import React from "react";
+
+const FileVpp = () => {
+  return (
+    <svg width="34" height="40" fill="none" xmlns="http://www.w3.org/2000/svg">
+      <g clipPath="url(#a)">
+        <path
+          d="M29.333 39.75H4.667a2.417 2.417 0 0 1-2.417-2.416V2.667A2.417 2.417 0 0 1 4.667.25h19.562c.64 0 1.255.255 1.709.708l5.104 5.105c.453.453.708 1.068.708 1.709v29.562a2.417 2.417 0 0 1-2.417 2.416Z"
+          fill="#fff"
+          stroke="#192147"
+          strokeWidth=".5"
+        />
+        <path
+          d="M23.5.5h.834l.5 6.5 6.666.5v1h-6a2 2 0 0 1-2-2v-6Z"
+          fill="#C5C7D1"
+        />
+        <path
+          d="M24.5.334v5.667c0 .736.597 1.333 1.333 1.333h6"
+          stroke="#192147"
+          strokeWidth=".5"
+        />
+        <path
+          d="M2.5 20h25a2 2 0 0 1 2 2v13a2 2 0 0 1-2 2h-25V20Z"
+          fill="#C5C7D1"
+        />
+        <rect
+          x=".25"
+          y="18.25"
+          width="27.7"
+          height="16.35"
+          rx="1.75"
+          fill="#515774"
+        />
+        <rect
+          x=".25"
+          y="18.25"
+          width="27.7"
+          height="16.35"
+          rx="1.75"
+          stroke="#192147"
+          strokeWidth=".5"
+        />
+        <path
+          fillRule="evenodd"
+          clipRule="evenodd"
+          d="M10.752 31.045v-7.5h1.946v.952h.043c.07-.185.175-.354.312-.508.137-.156.308-.28.511-.373.204-.094.44-.142.71-.142.36 0 .703.096 1.027.288.327.192.592.494.795.905.206.412.31.947.31 1.606 0 .63-.099 1.151-.296 1.566-.194.414-.454.723-.78.927-.325.203-.681.305-1.07.305-.255 0-.484-.042-.685-.124-.199-.086-.37-.2-.511-.345a1.593 1.593 0 0 1-.323-.497h-.029v2.94h-1.96Zm1.917-4.772c0 .265.035.494.104.689.07.191.17.34.298.447.13.104.285.156.465.156.18 0 .333-.05.458-.152a.96.96 0 0 0 .291-.444c.069-.194.103-.427.103-.696 0-.27-.034-.501-.103-.693a.936.936 0 0 0-.291-.444.693.693 0 0 0-.458-.156.722.722 0 0 0-.465.156.981.981 0 0 0-.298.444 2.061 2.061 0 0 0-.104.693Zm4.758 4.772v-7.5h1.945v.952h.043c.071-.185.175-.354.313-.508.137-.156.307-.28.511-.373.204-.094.44-.142.71-.142.36 0 .702.096 1.026.288.327.192.592.494.796.905.206.412.309.947.309 1.606 0 .63-.098 1.151-.295 1.566-.194.414-.454.723-.781.927-.325.203-.68.305-1.069.305-.256 0-.484-.042-.685-.124-.2-.086-.37-.2-.512-.345a1.593 1.593 0 0 1-.323-.497h-.028v2.94h-1.96Zm1.917-4.772c0 .265.034.494.103.689.071.191.17.34.298.447.13.104.286.156.466.156.18 0 .332-.05.458-.152a.96.96 0 0 0 .29-.444c.07-.194.104-.427.104-.696 0-.27-.034-.501-.103-.693a.935.935 0 0 0-.291-.444.693.693 0 0 0-.458-.156.722.722 0 0 0-.466.156.98.98 0 0 0-.298.444 2.061 2.061 0 0 0-.103.693ZM8.162 29l1.832-5.455h-2.06l-.88 3.608h-.057l-.88-3.608h-2.06L5.889 29h2.273Z"
+          fill="#fff"
+        />
+      </g>
+      <defs>
+        <clipPath id="a">
+          <path fill="#fff" d="M0 0h34v40H0z" />
+        </clipPath>
+      </defs>
+    </svg>
+  );
+};
+
+export default FileVpp;
diff --git a/frontend/components/graphics/index.ts b/frontend/components/graphics/index.ts
index 84e10a37113c..38862d51da16 100644
--- a/frontend/components/graphics/index.ts
+++ b/frontend/components/graphics/index.ts
@@ -12,11 +12,16 @@ import FilePdf from "./FilePdf";
 import FilePkg from "./FilePkg";
 import FileP7m from "./FileP7m";
 import FilePem from "./FilePem";
+import FileVpp from "./FileVpp";
 import EmptyHosts from "./EmptyHosts";
 import EmptyTeams from "./EmptyTeams";
 import EmptyPacks from "./EmptyPacks";
 import EmptySchedule from "./EmptySchedule";
+import EmptySearchExclamation from "./EmptySearchExclamation";
+import EmptySearchCheck from "./EmptySearchCheck";
+import EmptySearchQuestion from "./EmptySearchQuestion";
 import CollectingResults from "./CollectingResults";
+import DataError from "./DataError";
 
 export const GRAPHIC_MAP = {
   // Empty state graphics
@@ -29,6 +34,9 @@ export const GRAPHIC_MAP = {
   "empty-teams": EmptyTeams,
   "empty-packs": EmptyPacks,
   "empty-schedule": EmptySchedule,
+  "empty-search-exclamation": EmptySearchExclamation,
+  "empty-search-check": EmptySearchCheck,
+  "empty-search-question": EmptySearchQuestion,
   // File type graphics
   "file-configuration-profile": FileConfigurationProfile,
   "file-sh": FileSh,
@@ -39,8 +47,10 @@ export const GRAPHIC_MAP = {
   "file-pkg": FilePkg,
   "file-p7m": FileP7m,
   "file-pem": FilePem,
+  "file-vpp": FileVpp,
   // Other graphics
   "collecting-results": CollectingResults,
+  "data-error": DataError,
 };
 
 export type GraphicNames = keyof typeof GRAPHIC_MAP;
diff --git a/frontend/components/icons/FleetIcon/FleetIcon.jsx b/frontend/components/icons/FleetIcon/FleetIcon.jsx
deleted file mode 100644
index c38763eeb8ae..000000000000
--- a/frontend/components/icons/FleetIcon/FleetIcon.jsx
+++ /dev/null
@@ -1,32 +0,0 @@
-import React, { Component } from "react";
-import PropTypes from "prop-types";
-import classnames from "classnames";
-
-const baseClass = "fleeticon";
-
-export class FleetIcon extends Component {
-  static propTypes = {
-    className: PropTypes.string,
-    fw: PropTypes.bool,
-    name: PropTypes.string,
-    size: PropTypes.string,
-    title: PropTypes.string,
-  };
-
-  render() {
-    const { className, fw, name, size, title } = this.props;
-    const iconClasses = classnames(
-      baseClass,
-      `${baseClass}-${name}`,
-      className,
-      {
-        [`${baseClass}-fw`]: fw,
-        [`${baseClass}-${size}`]: size,
-      }
-    );
-
-    return <i className={iconClasses} title={title} />;
-  }
-}
-
-export default FleetIcon;
diff --git a/frontend/components/icons/FleetIcon/FleetIcon.tests.jsx b/frontend/components/icons/FleetIcon/FleetIcon.tests.tsx
similarity index 100%
rename from frontend/components/icons/FleetIcon/FleetIcon.tests.jsx
rename to frontend/components/icons/FleetIcon/FleetIcon.tests.tsx
diff --git a/frontend/components/icons/FleetIcon/FleetIcon.tsx b/frontend/components/icons/FleetIcon/FleetIcon.tsx
new file mode 100644
index 000000000000..e46b37bfba9d
--- /dev/null
+++ b/frontend/components/icons/FleetIcon/FleetIcon.tsx
@@ -0,0 +1,29 @@
+import React from "react";
+import classnames from "classnames";
+
+interface IFleetIconProps {
+  className?: string;
+  fw?: boolean;
+  name: string;
+  size?: string;
+  title?: string;
+}
+
+const baseClass = "fleeticon";
+
+const FleetIcon = ({
+  className,
+  fw,
+  name,
+  size,
+  title,
+}: IFleetIconProps): JSX.Element => {
+  const iconClasses = classnames(baseClass, `${baseClass}-${name}`, className, {
+    [`${baseClass}-fw`]: fw,
+    [`${baseClass}-${size}`]: !!size,
+  });
+
+  return <i className={iconClasses} title={title} />;
+};
+
+export default FleetIcon;
diff --git a/frontend/components/icons/FleetIcon/index.js b/frontend/components/icons/FleetIcon/index.ts
similarity index 100%
rename from frontend/components/icons/FleetIcon/index.js
rename to frontend/components/icons/FleetIcon/index.ts
diff --git a/frontend/components/icons/PlatformIcon/PlatformIcon.jsx b/frontend/components/icons/PlatformIcon/PlatformIcon.jsx
deleted file mode 100644
index 0fefdd8e584c..000000000000
--- a/frontend/components/icons/PlatformIcon/PlatformIcon.jsx
+++ /dev/null
@@ -1,40 +0,0 @@
-import React, { Component } from "react";
-import PropTypes from "prop-types";
-import classnames from "classnames";
-
-import FleetIcon from "components/icons/FleetIcon";
-import platformIconClass from "utilities/platform_icon_class";
-
-const baseClass = "platform-icon";
-
-export class PlatformIcon extends Component {
-  static propTypes = {
-    className: PropTypes.string,
-    fw: PropTypes.bool,
-    name: PropTypes.string.isRequired,
-    size: PropTypes.string,
-    title: PropTypes.string,
-  };
-
-  render() {
-    const { className, name, fw, size, title } = this.props;
-    const iconClasses = classnames(baseClass, className);
-    let iconName = platformIconClass(name);
-
-    if (!iconName) {
-      iconName = "single-host";
-    }
-
-    return (
-      <FleetIcon
-        className={iconClasses}
-        fw={fw}
-        name={iconName}
-        size={size}
-        title={title}
-      />
-    );
-  }
-}
-
-export default PlatformIcon;
diff --git a/frontend/components/icons/PlatformIcon/PlatformIcon.tests.jsx b/frontend/components/icons/PlatformIcon/PlatformIcon.tests.tsx
similarity index 100%
rename from frontend/components/icons/PlatformIcon/PlatformIcon.tests.jsx
rename to frontend/components/icons/PlatformIcon/PlatformIcon.tests.tsx
diff --git a/frontend/components/icons/PlatformIcon/PlatformIcon.tsx b/frontend/components/icons/PlatformIcon/PlatformIcon.tsx
new file mode 100644
index 000000000000..4077ea4cf807
--- /dev/null
+++ b/frontend/components/icons/PlatformIcon/PlatformIcon.tsx
@@ -0,0 +1,43 @@
+import React from "react";
+import classnames from "classnames";
+
+// @ts-ignore
+import FleetIcon from "components/icons/FleetIcon";
+import platformIconClass from "utilities/platform_icon_class";
+
+interface IPlatformIconProps {
+  className?: string;
+  fw?: boolean;
+  name: string;
+  size?: string;
+  title?: string;
+}
+
+const baseClass = "platform-icon";
+
+const PlatformIcon = ({
+  className,
+  name,
+  fw,
+  size,
+  title,
+}: IPlatformIconProps): JSX.Element => {
+  const iconClasses = classnames(baseClass, className);
+  let iconName = platformIconClass(name);
+
+  if (!iconName) {
+    iconName = "single-host";
+  }
+
+  return (
+    <FleetIcon
+      className={iconClasses}
+      fw={fw}
+      name={iconName}
+      size={size}
+      title={title}
+    />
+  );
+};
+
+export default PlatformIcon;
diff --git a/frontend/components/icons/PlatformIcon/index.js b/frontend/components/icons/PlatformIcon/index.ts
similarity index 100%
rename from frontend/components/icons/PlatformIcon/index.js
rename to frontend/components/icons/PlatformIcon/index.ts
diff --git a/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx b/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx
index 86944020b630..7dbf45785dbf 100644
--- a/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx
+++ b/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx
@@ -56,6 +56,7 @@ const REGEX_GLOBAL_PAGES = {
 
 const REGEX_EXCLUDE_NO_TEAM_PAGES = {
   MANAGE_POLICIES: /\/policies\/manage/i,
+  MANAGE_QUERIES: /\/queries\/manage/i,
 };
 
 const testDetailPage = (path: string, re: RegExp) => {
@@ -96,7 +97,6 @@ const SiteTopNav = ({
     isGlobalMaintainer,
     isAnyTeamMaintainer,
     isNoAccess,
-    isSandboxMode,
   } = useContext(AppContext);
 
   const isActiveDetailPage = isDetailPage(currentPath);
@@ -187,7 +187,7 @@ const SiteTopNav = ({
           <LinkWithContext
             className={`${navItemBaseClass}__link`}
             withParams={withParams}
-            currentQueryParams={currentQueryParams}
+            currentQueryParams={{ team_id: currentQueryParams.team_id }}
             to={navItem.location.pathname}
           >
             <span
@@ -220,8 +220,7 @@ const SiteTopNav = ({
     isAnyTeamAdmin,
     isAnyTeamMaintainer,
     isGlobalMaintainer,
-    isNoAccess,
-    isSandboxMode
+    isNoAccess
   );
 
   const renderNavItems = () => {
@@ -238,7 +237,6 @@ const SiteTopNav = ({
           currentUser={currentUser}
           isAnyTeamAdmin={isAnyTeamAdmin}
           isGlobalAdmin={isGlobalAdmin}
-          isSandboxMode={isSandboxMode}
         />
       </div>
     );
diff --git a/frontend/components/top_nav/SiteTopNav/navItems.ts b/frontend/components/top_nav/SiteTopNav/navItems.ts
index cbf065472309..00e145ae4b00 100644
--- a/frontend/components/top_nav/SiteTopNav/navItems.ts
+++ b/frontend/components/top_nav/SiteTopNav/navItems.ts
@@ -27,8 +27,7 @@ export default (
   isAnyTeamAdmin = false,
   isAnyTeamMaintainer = false,
   isGlobalMaintainer = false,
-  isNoAccess = false,
-  isSandboxMode = false
+  isNoAccess = false
 ): INavItem[] => {
   if (!user) {
     return [];
@@ -67,7 +66,7 @@ export default (
         regex: new RegExp(`^${URL_PREFIX}/controls/`),
         pathname: PATHS.CONTROLS,
       },
-      exclude: isSandboxMode || !isMaintainerOrAdmin,
+      exclude: !isMaintainerOrAdmin,
       withParams: { type: "query", names: ["team_id"] },
     },
     {
diff --git a/frontend/components/top_nav/UserMenu/UserMenu.tsx b/frontend/components/top_nav/UserMenu/UserMenu.tsx
index 4e0846412028..38f7986a4362 100644
--- a/frontend/components/top_nav/UserMenu/UserMenu.tsx
+++ b/frontend/components/top_nav/UserMenu/UserMenu.tsx
@@ -17,7 +17,6 @@ interface IUserMenuProps {
   isAnyTeamAdmin: boolean | undefined;
   isGlobalAdmin: boolean | undefined;
   currentUser: IUser;
-  isSandboxMode?: boolean;
 }
 
 const UserMenu = ({
@@ -26,7 +25,6 @@ const UserMenu = ({
   isAnyTeamAdmin,
   isGlobalAdmin,
   currentUser,
-  isSandboxMode = false,
 }: IUserMenuProps): JSX.Element => {
   const accountNavigate = onNavItemClick(PATHS.ACCOUNT);
   const dropdownItems = [
@@ -44,7 +42,7 @@ const UserMenu = ({
     },
   ];
 
-  if (isGlobalAdmin && !isSandboxMode) {
+  if (isGlobalAdmin) {
     const manageUsersNavigate = onNavItemClick(PATHS.ADMIN_USERS);
 
     const manageUserNavItem = {
diff --git a/frontend/context/app.tsx b/frontend/context/app.tsx
index 32728fd082c8..afa607a69795 100644
--- a/frontend/context/app.tsx
+++ b/frontend/context/app.tsx
@@ -11,6 +11,7 @@ import {
 import { IUser } from "interfaces/user";
 import permissions from "utilities/permissions";
 import sort from "utilities/sort";
+import { hasLicenseExpired, willExpireWithinXDays } from "utilities/helpers";
 
 enum ACTIONS {
   SET_AVAILABLE_TEAMS = "SET_AVAILABLE_TEAMS",
@@ -20,6 +21,7 @@ enum ACTIONS {
   SET_ENROLL_SECRET = "SET_ENROLL_SECRET",
   SET_ABM_EXPIRY = "SET_ABM_EXPIRY",
   SET_APNS_EXPIRY = "SET_APNS_EXPIRY",
+  SET_VPP_EXPIRY = "SET_VPP_EXPIRY",
   SET_SANDBOX_EXPIRY = "SET_SANDBOX_EXPIRY",
   SET_NO_SANDBOX_HOSTS = "SET_NO_SANDBOX_HOSTS",
   SET_FILTERED_HOSTS_PATH = "SET_FILTERED_HOSTS_PATH",
@@ -52,9 +54,14 @@ interface ISetEnrollSecretAction {
   enrollSecret: IEnrollSecret[];
 }
 
+interface IAbmExpiry {
+  earliestExpiry: string;
+  needsAbmTermsRenewal: boolean;
+}
+
 interface ISetABMExpiryAction {
   type: ACTIONS.SET_ABM_EXPIRY;
-  abmExpiry: string;
+  abmExpiry: IAbmExpiry;
 }
 
 interface ISetAPNsExpiryAction {
@@ -62,6 +69,11 @@ interface ISetAPNsExpiryAction {
   apnsExpiry: string;
 }
 
+interface ISetVppExpiryAction {
+  type: ACTIONS.SET_VPP_EXPIRY;
+  vppExpiry: string;
+}
+
 interface ISetSandboxExpiryAction {
   type: ACTIONS.SET_SANDBOX_EXPIRY;
   sandboxExpiry: string;
@@ -99,6 +111,7 @@ type IAction =
   | ISetEnrollSecretAction
   | ISetABMExpiryAction
   | ISetAPNsExpiryAction
+  | ISetVppExpiryAction
   | ISetSandboxExpiryAction
   | ISetNoSandboxHostsAction
   | ISetFilteredHostsPathAction
@@ -137,14 +150,23 @@ type InitialStateType = {
   isOnlyObserver?: boolean;
   isObserverPlus?: boolean;
   isNoAccess?: boolean;
-  abmExpiry?: string;
+  isAppleBmExpired: boolean;
+  isApplePnsExpired: boolean;
+  isVppExpired: boolean;
+  needsAbmTermsRenewal: boolean;
+  willAppleBmExpire: boolean;
+  willApplePnsExpire: boolean;
+  willVppExpire: boolean;
+  abmExpiry?: IAbmExpiry;
   apnsExpiry?: string;
+  vppExpiry?: string;
   sandboxExpiry?: string;
   noSandboxHosts?: boolean;
   filteredHostsPath?: string;
   filteredSoftwarePath?: string;
   filteredQueriesPath?: string;
   filteredPoliciesPath?: string;
+  isVppEnabled?: boolean;
   setAvailableTeams: (
     user: IUser | null,
     availableTeams: ITeamSummary[]
@@ -154,7 +176,8 @@ type InitialStateType = {
   setConfig: (config: IConfig) => void;
   setEnrollSecret: (enrollSecret: IEnrollSecret[]) => void;
   setAPNsExpiry: (apnsExpiry: string) => void;
-  setABMExpiry: (abmExpiry: string) => void;
+  setABMExpiry: (abmExpiry: IAbmExpiry) => void;
+  setVppExpiry: (vppExpiry: string) => void;
   setSandboxExpiry: (sandboxExpiry: string) => void;
   setNoSandboxHosts: (noSandboxHosts: boolean) => void;
   setFilteredHostsPath: (filteredHostsPath: string) => void;
@@ -196,6 +219,13 @@ export const initialState = {
   filteredSoftwarePath: undefined,
   filteredQueriesPath: undefined,
   filteredPoliciesPath: undefined,
+  isAppleBmExpired: false,
+  isApplePnsExpired: false,
+  isVppExpired: false,
+  needsAbmTermsRenewal: false,
+  willAppleBmExpire: false,
+  willApplePnsExpire: false,
+  willVppExpire: false,
   setAvailableTeams: () => null,
   setCurrentUser: () => null,
   setCurrentTeam: () => null,
@@ -203,6 +233,7 @@ export const initialState = {
   setEnrollSecret: () => null,
   setAPNsExpiry: () => null,
   setABMExpiry: () => null,
+  setVppExpiry: () => null,
   setSandboxExpiry: () => null,
   setNoSandboxHosts: () => null,
   setFilteredHostsPath: () => null,
@@ -325,9 +356,13 @@ const reducer = (state: InitialStateType, action: IAction) => {
     }
     case ACTIONS.SET_ABM_EXPIRY: {
       const { abmExpiry } = action;
+      const { earliestExpiry, needsAbmTermsRenewal } = abmExpiry;
       return {
         ...state,
         abmExpiry,
+        isAppleBmExpired: hasLicenseExpired(earliestExpiry),
+        willAppleBmExpire: willExpireWithinXDays(earliestExpiry, 30),
+        needsAbmTermsRenewal,
       };
     }
     case ACTIONS.SET_APNS_EXPIRY: {
@@ -335,6 +370,17 @@ const reducer = (state: InitialStateType, action: IAction) => {
       return {
         ...state,
         apnsExpiry,
+        isApplePnsExpired: hasLicenseExpired(apnsExpiry),
+        willApplePnsExpire: willExpireWithinXDays(apnsExpiry, 30),
+      };
+    }
+    case ACTIONS.SET_VPP_EXPIRY: {
+      const { vppExpiry } = action;
+      return {
+        ...state,
+        vppExpiry,
+        isVppExpired: hasLicenseExpired(vppExpiry),
+        willVppExpire: willExpireWithinXDays(vppExpiry, 30),
       };
     }
     case ACTIONS.SET_SANDBOX_EXPIRY: {
@@ -399,6 +445,14 @@ const AppProvider = ({ children }: Props): JSX.Element => {
     sandboxExpiry: state.sandboxExpiry,
     abmExpiry: state.abmExpiry,
     apnsExpiry: state.apnsExpiry,
+    vppExpiry: state.vppExpiry,
+    isAppleBmExpired: state.isAppleBmExpired,
+    isApplePnsExpired: state.isApplePnsExpired,
+    isVppExpired: state.isVppExpired,
+    needsAbmTermsRenewal: state.needsAbmTermsRenewal,
+    willAppleBmExpire: state.willAppleBmExpire,
+    willApplePnsExpire: state.willApplePnsExpire,
+    willVppExpire: state.willVppExpire,
     noSandboxHosts: state.noSandboxHosts,
     filteredHostsPath: state.filteredHostsPath,
     filteredSoftwarePath: state.filteredSoftwarePath,
@@ -444,12 +498,18 @@ const AppProvider = ({ children }: Props): JSX.Element => {
     setEnrollSecret: (enrollSecret: IEnrollSecret[]) => {
       dispatch({ type: ACTIONS.SET_ENROLL_SECRET, enrollSecret });
     },
-    setABMExpiry: (abmExpiry: string) => {
+    setABMExpiry: (abmExpiry: IAbmExpiry) => {
       dispatch({ type: ACTIONS.SET_ABM_EXPIRY, abmExpiry });
     },
     setAPNsExpiry: (apnsExpiry: string) => {
       dispatch({ type: ACTIONS.SET_APNS_EXPIRY, apnsExpiry });
     },
+    setVppExpiry: (vppExpiry: string) => {
+      dispatch({
+        type: ACTIONS.SET_VPP_EXPIRY,
+        vppExpiry,
+      });
+    },
     setSandboxExpiry: (sandboxExpiry: string) => {
       dispatch({ type: ACTIONS.SET_SANDBOX_EXPIRY, sandboxExpiry });
     },
diff --git a/frontend/hooks/useTeamIdParam.ts b/frontend/hooks/useTeamIdParam.ts
index f1683aa204cc..530ec3bb9f71 100644
--- a/frontend/hooks/useTeamIdParam.ts
+++ b/frontend/hooks/useTeamIdParam.ts
@@ -395,6 +395,8 @@ export const useTeamIdParam = ({
     currentTeamName: currentTeam?.name,
     currentTeamSummary: currentTeam,
     isAnyTeamSelected: isAnyTeamSelected(currentTeam?.id),
+    isAllTeamsSelected:
+      !isAnyTeamSelected(currentTeam?.id) && currentTeam?.id !== 0,
     isRouteOk,
     isTeamAdmin:
       !!currentTeam?.id && permissions.isTeamAdmin(currentUser, currentTeam.id),
diff --git a/frontend/interfaces/activity.ts b/frontend/interfaces/activity.ts
index 06732e90efcf..c3cf09f71918 100644
--- a/frontend/interfaces/activity.ts
+++ b/frontend/interfaces/activity.ts
@@ -1,3 +1,4 @@
+import { Platform } from "./platform";
 import { IPolicy } from "./policy";
 import { IQuery } from "./query";
 import { ISchedulableQueryStats } from "./schedulable_query";
@@ -35,10 +36,15 @@ export enum ActivityType {
   MdmEnrolled = "mdm_enrolled",
   MdmUnenrolled = "mdm_unenrolled",
   EditedMacosMinVersion = "edited_macos_min_version",
+  EditedIosMinVersion = "edited_ios_min_version",
+  EditedIpadosMinVersion = "edited_ipados_min_version",
   ReadHostDiskEncryptionKey = "read_host_disk_encryption_key",
-  CreatedMacOSProfile = "created_macos_profile",
-  DeletedMacOSProfile = "deleted_macos_profile",
-  EditedMacOSProfile = "edited_macos_profile",
+  /** Note: BE not renamed (yet) from macOS even though activity is also used for iOS and iPadOS */
+  CreatedAppleOSProfile = "created_macos_profile",
+  /** Note: BE not renamed (yet) from macOS even though activity is also used for iOS and iPadOS */
+  DeletedAppleOSProfile = "deleted_macos_profile",
+  /** Note: BE not renamed (yet) from macOS even though activity is also used for iOS and iPadOS */
+  EditedAppleOSProfile = "edited_macos_profile",
   CreatedWindowsProfile = "created_windows_profile",
   DeletedWindowsProfile = "deleted_windows_profile",
   EditedWindowsProfile = "edited_windows_profile",
@@ -74,6 +80,11 @@ export enum ActivityType {
   AddedSoftware = "added_software",
   DeletedSoftware = "deleted_software",
   InstalledSoftware = "installed_software",
+  EnabledVpp = "enabled_vpp",
+  DisabledVpp = "disabled_vpp",
+  AddedAppStoreApp = "added_app_store_app",
+  DeletedAppStoreApp = "deleted_app_store_app",
+  InstalledAppStoreApp = "installed_app_store_app",
 }
 
 // This is a subset of ActivityType that are shown only for the host past activities
@@ -81,12 +92,14 @@ export type IHostPastActivityType =
   | ActivityType.RanScript
   | ActivityType.LockedHost
   | ActivityType.UnlockedHost
-  | ActivityType.InstalledSoftware;
+  | ActivityType.InstalledSoftware
+  | ActivityType.InstalledAppStoreApp;
 
 // This is a subset of ActivityType that are shown only for the host upcoming activities
 export type IHostUpcomingActivityType =
   | ActivityType.RanScript
-  | ActivityType.InstalledSoftware;
+  | ActivityType.InstalledSoftware
+  | ActivityType.InstalledAppStoreApp;
 
 export interface IActivity {
   created_at: string;
@@ -150,7 +163,11 @@ export interface IActivityDetails {
   stats?: ISchedulableQueryStats;
   software_title?: string;
   software_package?: string;
+  platform?: Platform; // software platform
   status?: string;
   install_uuid?: string;
   self_service?: boolean;
+  command_uuid?: string;
+  app_store_id?: number;
+  location?: string; // name of location associated with VPP token
 }
diff --git a/frontend/interfaces/config.ts b/frontend/interfaces/config.ts
index f52cfd392549..4c4d4d6e9ec4 100644
--- a/frontend/interfaces/config.ts
+++ b/frontend/interfaces/config.ts
@@ -35,18 +35,30 @@ interface ICustomSetting {
   labels_exclude_any?: string[];
 }
 
+export interface IAppleDeviceUpdates {
+  minimum_version: string;
+  deadline: string;
+}
+
 export interface IMdmConfig {
   enable_disk_encryption: boolean;
+  /** `enabled_and_configured` only tells us if Apples MDM has been enabled and
+  configured correctly. The naming is slightly confusing but at one point we
+  only supported apple mdm, so thats why it's name the way it is. */
   enabled_and_configured: boolean;
   apple_bm_default_team?: string;
+  /**
+   * @deprecated
+   * Refer to needsAbmTermsRenewal from AppContext instead of config.apple_bm_terms_expired.
+   * https://github.com/fleetdm/fleet/pull/21043/files#r1705977965
+   */
   apple_bm_terms_expired: boolean;
   apple_bm_enabled_and_configured: boolean;
   windows_enabled_and_configured: boolean;
   end_user_authentication: IEndUserAuthentication;
-  macos_updates: {
-    minimum_version: string | null;
-    deadline: string | null;
-  };
+  macos_updates: IAppleDeviceUpdates;
+  ios_updates: IAppleDeviceUpdates;
+  ipados_updates: IAppleDeviceUpdates;
   macos_settings: {
     custom_settings: null | ICustomSetting[];
     enable_disk_encryption: boolean;
diff --git a/frontend/interfaces/errors.ts b/frontend/interfaces/errors.ts
index 9fc72c82bd34..4a109200bd93 100644
--- a/frontend/interfaces/errors.ts
+++ b/frontend/interfaces/errors.ts
@@ -122,22 +122,6 @@ const filterFleetErrorReasonIncludes = (errs: unknown[], value: string) => {
     | undefined;
 };
 
-const DEFAULT_ERROR_MSG_FOR_SQL_ERROR =
-  "An error occurred with the Fleet server.";
-
-/**
- * This function checks if the error reason is a SQL error. The API sends a
- * specific error message for sql errors that begin with this format:
- * `Error 123 (123):`
-
- * This will look to match strings in this format, for example:
- *
- * Error 1234 (23000): Duplicate entry 'foo' for key 'bar'
- */
-const isSqlError = (reason: string) => {
-  return new RegExp(/^Error \d+ \(\d+\):/g).test(reason);
-};
-
 const getReasonFromErrors = (errors: unknown[], filter?: IFilterFleetError) => {
   if (!errors.length) {
     return "";
@@ -152,20 +136,7 @@ const getReasonFromErrors = (errors: unknown[], filter?: IFilterFleetError) => {
     fleetError = isFleetApiError(errors[0]) ? errors[0] : undefined;
   }
 
-  // We do not want to display the specific SQL error message to the user in the UI.
-  // Instead, we want to display a generic error message. This at least offers
-  // some level of security by not leaking the specific SQL error message
-  // to the user, even though you can still find the SQL error message in the
-  // API response.
-  //
-  // TODO: This should really be handled on the server and in the future
-  // we can remove this.
-  let reason = fleetError?.reason ?? "";
-  if (isSqlError(reason)) {
-    reason = DEFAULT_ERROR_MSG_FOR_SQL_ERROR;
-  }
-
-  return reason;
+  return fleetError?.reason || "";
 };
 
 const getReasonFromRecordWithDataErrors = (
diff --git a/frontend/interfaces/host.ts b/frontend/interfaces/host.ts
index 604b0c761b4b..762dc5b76eb0 100644
--- a/frontend/interfaces/host.ts
+++ b/frontend/interfaces/host.ts
@@ -13,6 +13,7 @@ import {
   BootstrapPackageStatus,
   DiskEncryptionStatus,
 } from "./mdm";
+import { HostPlatform } from "./platform";
 
 export default PropTypes.shape({
   created_at: PropTypes.string,
@@ -179,8 +180,8 @@ export interface IHostMdmData {
 }
 
 export interface IHostMaintenanceWindow {
-  starts_at: string;
-  timezone: string | null;
+  starts_at: string; // e.g. "2024-06-18T13:27:18−07:00"
+  timezone: string | null; // e.g. "America/Los_Angeles"
 }
 
 export interface IMunkiIssue {
@@ -243,7 +244,7 @@ export interface IDeviceUserResponse {
   org_logo_url: string;
   org_contact_url: string;
   disk_encryption_enabled?: boolean;
-  platform?: string;
+  platform?: HostPlatform;
   global_config: IDeviceGlobalConfig;
   self_service: boolean;
 }
@@ -277,7 +278,7 @@ export interface IHost {
   refetch_critical_queries_until: string | null;
   hostname: string;
   uuid: string;
-  platform: string;
+  platform: HostPlatform;
   osquery_version: string;
   orbit_version: string | null;
   fleet_desktop_version: string | null;
diff --git a/frontend/interfaces/label.ts b/frontend/interfaces/label.ts
index bae3e980b42a..622cc4730103 100644
--- a/frontend/interfaces/label.ts
+++ b/frontend/interfaces/label.ts
@@ -6,8 +6,8 @@ export default PropTypes.shape({
   id: PropTypes.oneOfType([PropTypes.number]),
   name: PropTypes.string,
   query: PropTypes.string,
-  label_type: PropTypes.string,
-  label_membership_type: PropTypes.string,
+  label_type: PropTypes.oneOf(["regular", "builtin"]),
+  label_membership_type: PropTypes.oneOf(["dynamic", "manual"]),
   hosts_count: PropTypes.number,
   display_text: PropTypes.string,
   count: PropTypes.number, // seems to be a repeat of hosts_count issue #1618
diff --git a/frontend/interfaces/mdm.ts b/frontend/interfaces/mdm.ts
index 3a75fc825866..2f822eb96866 100644
--- a/frontend/interfaces/mdm.ts
+++ b/frontend/interfaces/mdm.ts
@@ -1,4 +1,5 @@
 import { IConfigServerSettings } from "./config";
+import { ITeamSummary } from "./team";
 
 export interface IMdmApple {
   common_name: string;
@@ -15,6 +16,31 @@ export interface IMdmAppleBm {
   renew_date: string;
 }
 
+export type ITokenTeam = {
+  team_id: number;
+  name: string;
+};
+
+export interface IMdmAbmToken {
+  id: number;
+  apple_id: string;
+  org_name: string;
+  mdm_server_url: string;
+  renew_date: string;
+  terms_expired: boolean;
+  macos_team: ITokenTeam;
+  ios_team: ITokenTeam;
+  ipados_team: ITokenTeam;
+}
+
+export interface IMdmVppToken {
+  id: number;
+  org_name: string;
+  location: string;
+  renew_date: string;
+  teams: ITokenTeam[] | null; // null means token isn't configured to a team; empty array means all teams
+}
+
 export const getMdmServerUrl = ({ server_url }: IConfigServerSettings) => {
   return server_url.concat("/mdm/apple/mdm");
 };
@@ -160,3 +186,22 @@ export enum BootstrapPackageStatus {
   PENDING = "pending",
   FAILED = "failed",
 }
+
+/**
+ * IMdmCommandResult is the shape of an mdm command result object
+ * returned by the Fleet API.
+ */
+export interface IMdmCommandResult {
+  host_uuid: string;
+  command_uuid: string;
+  /** Status is the status of the command. It can be one of Acknowledged, Error, or NotNow for
+	// Apple, or 200, 400, etc for Windows.  */
+  status: string;
+  updated_at: string;
+  request_type: string;
+  hostname: string;
+  /** Payload is a base64-encoded string containing the MDM command request */
+  payload: string;
+  /** Result is a base64-enconded string containing the MDM command response */
+  result: string;
+}
diff --git a/frontend/interfaces/platform.ts b/frontend/interfaces/platform.ts
index 5c9a9042cdd8..2be1f412d4b3 100644
--- a/frontend/interfaces/platform.ts
+++ b/frontend/interfaces/platform.ts
@@ -1,24 +1,25 @@
-export type DisplayPlatform =
-  | "macOS"
-  | "Windows"
-  | "Linux"
-  | "ChromeOS"
-  | "iOS"
-  | "iPadOS";
+export const APPLE_PLATFORM_DISPLAY_NAMES = {
+  darwin: "macOS",
+  ios: "iOS",
+  ipados: "iPadOS",
+} as const;
 
-export type Platform =
-  | "darwin"
-  | "windows"
-  | "linux"
-  | "chrome"
-  | "ios"
-  | "ipados";
+export type ApplePlatform = keyof typeof APPLE_PLATFORM_DISPLAY_NAMES;
+export type AppleDisplayPlatform = typeof APPLE_PLATFORM_DISPLAY_NAMES[keyof typeof APPLE_PLATFORM_DISPLAY_NAMES];
+
+export const PLATFORM_DISPLAY_NAMES = {
+  windows: "Windows",
+  linux: "Linux",
+  chrome: "ChromeOS",
+  ...APPLE_PLATFORM_DISPLAY_NAMES,
+} as const;
 
+export type Platform = keyof typeof PLATFORM_DISPLAY_NAMES;
+export type DisplayPlatform = typeof PLATFORM_DISPLAY_NAMES[keyof typeof PLATFORM_DISPLAY_NAMES];
 export type QueryableDisplayPlatform = Exclude<
   DisplayPlatform,
   "iOS" | "iPadOS"
 >;
-
 export type QueryablePlatform = Exclude<Platform, "ios" | "ipados">;
 
 export const SUPPORTED_PLATFORMS: QueryablePlatform[] = [
@@ -28,6 +29,9 @@ export const SUPPORTED_PLATFORMS: QueryablePlatform[] = [
   "chrome",
 ];
 
+// TODO - add "iOS" and "iPadOS" once we support them
+export const VULN_SUPPORTED_PLATFORMS: Platform[] = ["darwin", "windows"];
+
 export type SelectedPlatform = QueryablePlatform | "all";
 
 export type SelectedPlatformString =
@@ -82,6 +86,12 @@ export const HOST_LINUX_PLATFORMS = [
 
 export const HOST_APPLE_PLATFORMS = ["darwin", "ios", "ipados"] as const;
 
+export type HostPlatform =
+  | typeof HOST_LINUX_PLATFORMS[number]
+  | typeof HOST_APPLE_PLATFORMS[number]
+  | "windows"
+  | "chrome";
+
 /**
  * Checks if the provided platform is a Linux-like OS. We can recieve many
  * different types of host platforms so we need a check that will cover all
@@ -98,3 +108,6 @@ export const isAppleDevice = (platform: string) => {
     platform as typeof HOST_APPLE_PLATFORMS[number]
   );
 };
+
+export const isIPadOrIPhone = (platform: string | HostPlatform) =>
+  ["ios", "ipados"].includes(platform);
diff --git a/frontend/interfaces/policy.ts b/frontend/interfaces/policy.ts
index 41586ea22da9..621c52f63872 100644
--- a/frontend/interfaces/policy.ts
+++ b/frontend/interfaces/policy.ts
@@ -41,6 +41,12 @@ export interface IPolicy {
   updated_at: string;
   critical: boolean;
   calendar_events_enabled: boolean;
+  install_software?: IPolicySoftwareToInstall;
+}
+
+export interface IPolicySoftwareToInstall {
+  name: string;
+  software_title_id: number;
 }
 
 // Used on the manage hosts page and other places where aggregate stats are displayed
@@ -94,6 +100,8 @@ export interface IPolicyFormData {
   team_id?: number | null;
   id?: number;
   calendar_events_enabled?: boolean;
+  // undefined from GET/LIST when not set, null for PATCH to unset
+  software_title_id?: number | null;
 }
 
 export interface IPolicyNew {
diff --git a/frontend/interfaces/software.ts b/frontend/interfaces/software.ts
index 91e45130bc25..9d6d3617b2fb 100644
--- a/frontend/interfaces/software.ts
+++ b/frontend/interfaces/software.ts
@@ -1,5 +1,8 @@
 import { startCase } from "lodash";
 import PropTypes from "prop-types";
+
+import { IconNames } from "components/icons";
+
 import vulnerabilityInterface from "./vulnerability";
 
 export default PropTypes.shape({
@@ -31,12 +34,14 @@ export interface ISoftware {
   name: string; // e.g., "Figma.app"
   version: string; // e.g., "2.1.11"
   bundle_identifier?: string | null; // e.g., "com.figma.Desktop"
-  source: string; // e.g., "apps"
+  source: string; // "apps" | "ipados_apps" | "ios_apps" | "programs" | ?
   generated_cpe: string;
   vulnerabilities: ISoftwareVulnerability[] | null;
   hosts_count?: number;
   last_opened_at?: string | null; // e.g., "2021-08-18T15:11:35Z”
   installed_paths?: string[];
+  browser?: string;
+  vendor?: string;
 }
 
 export type IVulnerabilitySoftware = Omit<ISoftware, "vulnerabilities"> & {
@@ -58,6 +63,25 @@ export interface ISoftwarePackage {
   pre_install_query?: string;
   post_install_script?: string;
   self_service: boolean;
+  icon_url: string | null;
+  status: {
+    installed: number;
+    pending: number;
+    failed: number;
+  };
+}
+
+export const isSoftwarePackage = (
+  data: ISoftwarePackage | IAppStoreApp
+): data is ISoftwarePackage =>
+  (data as ISoftwarePackage).install_script !== undefined;
+
+export interface IAppStoreApp {
+  name: string;
+  app_store_id: number;
+  latest_version: string;
+  icon_url: string;
+  self_service: boolean;
   status: {
     installed: number;
     pending: number;
@@ -65,28 +89,30 @@ export interface ISoftwarePackage {
   };
 }
 
-interface ISoftwareTitle {
+export interface ISoftwareTitle {
   id: number;
   name: string;
-  software_package: ISoftwarePackage | string | null;
   versions_count: number;
-  source: string;
+  source: string; // "apps" | "ios_apps" | "ipados_apps" | ?
   hosts_count: number;
   versions: ISoftwareTitleVersion[] | null;
-  browser: string;
-  self_service?: boolean;
-}
-
-export interface ISoftwareTitleWithPackageName
-  extends Omit<ISoftwareTitle, "software_package" | "self-service"> {
-  software_package: string | null;
-  self_service: boolean;
+  software_package: ISoftwarePackage | null;
+  app_store_app: IAppStoreApp | null;
+  browser?: string;
 }
 
-export interface ISoftwareTitleWithPackageDetail
-  extends Omit<ISoftwareTitle, "software_package" | "self-service"> {
+export interface ISoftwareTitleDetails {
+  id: number;
+  name: string;
   software_package: ISoftwarePackage | null;
-  self_service?: never;
+  app_store_app: IAppStoreApp | null;
+  source: string; // "apps" | "ios_apps" | "ipados_apps" | ?
+  hosts_count: number;
+  versions: ISoftwareTitleVersion[] | null;
+  versions_updated_at?: string;
+  bundle_identifier?: string;
+  browser?: string;
+  versions_count?: number;
 }
 
 export interface ISoftwareVulnerability {
@@ -106,7 +132,7 @@ export interface ISoftwareVersion {
   name: string; // e.g., "Figma.app"
   version: string; // e.g., "2.1.11"
   bundle_identifier?: string; // e.g., "com.figma.Desktop"
-  source: string; // e.g., "apps"
+  source: string; // "apps" | "ipados_apps" | "ios_apps" | ?
   browser: string; // e.g., "chrome"
   release: string; // TODO: on software/verions/:id?
   vendor: string;
@@ -126,6 +152,8 @@ export const SOURCE_TYPE_CONVERSION: Record<string, string> = {
   atom_packages: "Package (Atom)", // Atom packages were removed from software inventory. Mapping is maintained for backwards compatibility. (2023-12-04)
   python_packages: "Package (Python)",
   apps: "Application (macOS)",
+  ios_apps: "Application (iOS)",
+  ipados_apps: "Application (iPadOS)",
   chrome_extensions: "Browser plugin", // chrome_extensions can include any chrome-based browser (e.g., edge), so we rely instead on the `browser` field computed by Fleet server and fallback to this value if it is not present.
   firefox_addons: "Browser plugin (Firefox)",
   safari_extensions: "Browser plugin (Safari)",
@@ -213,6 +241,11 @@ export interface ISoftwareLastInstall {
   installed_at: string;
 }
 
+export interface IAppLastInstall {
+  command_uuid: string;
+  installed_at: string;
+}
+
 export interface ISoftwareInstallVersion {
   version: string;
   last_opened_at: string | null;
@@ -220,24 +253,80 @@ export interface ISoftwareInstallVersion {
   installed_paths: string[];
 }
 
+export interface IHostSoftwarePackage {
+  name: string;
+  self_service: boolean;
+  icon_url: string;
+  version: string;
+  last_install: ISoftwareLastInstall | null;
+}
+
+export interface IHostAppStoreApp {
+  app_store_id: string;
+  self_service: boolean;
+  icon_url: string;
+  version: string;
+  last_install: IAppLastInstall | null;
+}
+
 export interface IHostSoftware {
   id: number;
   name: string;
-  package_available_for_install?: string | null;
-  self_service: boolean;
+  software_package: IHostSoftwarePackage | null;
+  app_store_app: IHostAppStoreApp | null;
   source: string;
   bundle_identifier?: string;
   status: SoftwareInstallStatus | null;
-  last_install: ISoftwareLastInstall | null;
   installed_versions: ISoftwareInstallVersion[] | null;
 }
 
-export type IDeviceSoftware = Omit<
-  IHostSoftware,
-  "package_available_for_install"
-> & {
-  package: {
-    name: string;
-    version: string;
-  };
+export type IDeviceSoftware = IHostSoftware;
+
+const INSTALL_STATUS_PREDICATES: Record<SoftwareInstallStatus, string> = {
+  failed: "failed to install",
+  installed: "installed",
+  pending: "told Fleet to install",
+} as const;
+
+export const getInstallStatusPredicate = (status: string | undefined) => {
+  if (!status) {
+    return INSTALL_STATUS_PREDICATES.pending;
+  }
+  return (
+    INSTALL_STATUS_PREDICATES[status.toLowerCase() as SoftwareInstallStatus] ||
+    INSTALL_STATUS_PREDICATES.pending
+  );
+};
+
+export const INSTALL_STATUS_ICONS: Record<SoftwareInstallStatus, IconNames> = {
+  pending: "pending-outline",
+  installed: "success-outline",
+  failed: "error-outline",
+} as const;
+
+type IHostSoftwarePackageWithLastInstall = IHostSoftwarePackage & {
+  last_install: ISoftwareLastInstall;
 };
+
+export const hasHostSoftwarePackageLastInstall = (
+  software: IHostSoftware
+): software is IHostSoftware & {
+  software_package: IHostSoftwarePackageWithLastInstall;
+} => {
+  return !!software.software_package?.last_install;
+};
+
+type IHostAppWithLastInstall = IHostAppStoreApp & {
+  last_install: IAppLastInstall;
+};
+
+export const hasHostSoftwareAppLastInstall = (
+  software: IHostSoftware
+): software is IHostSoftware & {
+  app_store_app: IHostAppWithLastInstall;
+} => {
+  return !!software.app_store_app?.last_install;
+};
+
+export const isIpadOrIphoneSoftwareSource = (source: string) =>
+  ["ios_apps", "ipados_apps"].includes(source);
diff --git a/frontend/interfaces/target.ts b/frontend/interfaces/target.ts
index 06f464cf51b3..284811e4322d 100644
--- a/frontend/interfaces/target.ts
+++ b/frontend/interfaces/target.ts
@@ -30,10 +30,14 @@ export interface ISelectHost extends IHost {
 
 export interface ISelectLabel extends ILabelSummary {
   target_type?: string;
+  display_text?: string;
+  query?: string;
+  count?: number;
 }
 
 export interface ISelectTeam extends ITeam {
   target_type?: string;
+  display_text?: string;
 }
 
 export type ISelectTargetsEntity = ISelectHost | ISelectLabel | ISelectTeam;
diff --git a/frontend/interfaces/team.ts b/frontend/interfaces/team.ts
index 1939b8d93bce..b0bf6ca6e5a9 100644
--- a/frontend/interfaces/team.ts
+++ b/frontend/interfaces/team.ts
@@ -1,5 +1,9 @@
 import PropTypes from "prop-types";
-import { IConfigFeatures, IWebhookSettings } from "./config";
+import {
+  IAppleDeviceUpdates,
+  IConfigFeatures,
+  IWebhookSettings,
+} from "./config";
 import enrollSecretInterface, { IEnrollSecret } from "./enroll_secret";
 import { ITeamIntegrations } from "./integration";
 import { UserRole } from "./user";
@@ -45,10 +49,9 @@ export interface ITeam extends ITeamSummary {
   role?: UserRole; // role value is included when the team is in the context of a user
   mdm?: {
     enable_disk_encryption: boolean;
-    macos_updates: {
-      minimum_version: string | null;
-      deadline: string | null;
-    };
+    macos_updates: IAppleDeviceUpdates;
+    ios_updates: IAppleDeviceUpdates;
+    ipados_updates: IAppleDeviceUpdates;
     macos_settings: {
       custom_settings: null; // TODO: types?
       enable_disk_encryption: boolean;
diff --git a/frontend/interfaces/vulnerability.ts b/frontend/interfaces/vulnerability.ts
index 92329b2b1a90..40c2e237b14e 100644
--- a/frontend/interfaces/vulnerability.ts
+++ b/frontend/interfaces/vulnerability.ts
@@ -1,8 +1,5 @@
 import PropTypes from "prop-types";
 
-import { IVulnerabilityOSVersion } from "./operating_system";
-import { IVulnerabilitySoftware } from "./software";
-
 export default PropTypes.shape({
   cve: PropTypes.string,
   details_link: PropTypes.string,
diff --git a/frontend/pages/DashboardPage/DashboardPage.tsx b/frontend/pages/DashboardPage/DashboardPage.tsx
index 321ba4c2c7db..1816ab4ceec6 100644
--- a/frontend/pages/DashboardPage/DashboardPage.tsx
+++ b/frontend/pages/DashboardPage/DashboardPage.tsx
@@ -4,6 +4,7 @@ import React, {
   useEffect,
   useRef,
   useCallback,
+  useMemo,
 } from "react";
 import { InjectedRouter } from "react-router";
 import { useQuery } from "react-query";
@@ -19,11 +20,7 @@ import {
 } from "interfaces/enroll_secret";
 import { IHostSummary, IHostSummaryPlatforms } from "interfaces/host_summary";
 import { ILabelSummary } from "interfaces/label";
-import {
-  IMacadminAggregate,
-  IMunkiIssuesAggregate,
-  IMunkiVersionsAggregate,
-} from "interfaces/macadmins";
+import { IMacadminAggregate } from "interfaces/macadmins";
 import {
   IMdmStatusCardData,
   IMdmSummaryResponse,
@@ -150,7 +147,6 @@ const DashboardPage = ({ router, location }: IDashboardProps): JSX.Element => {
   const [softwareNavTabIndex, setSoftwareNavTabIndex] = useState(0);
   const [softwarePageIndex, setSoftwarePageIndex] = useState(0);
   const [softwareActionUrl, setSoftwareActionUrl] = useState<string>();
-  const [showMunkiCard, setShowMunkiCard] = useState(true);
   const [showMdmCard, setShowMdmCard] = useState(true);
   const [showSoftwareCard, setShowSoftwareCard] = useState(false);
   const [showAddHostsModal, setShowAddHostsModal] = useState(false);
@@ -172,18 +168,9 @@ const DashboardPage = ({ router, location }: IDashboardProps): JSX.Element => {
 
   const selectedMdmSolutionName = useRef<string>("");
 
-  const [munkiIssuesData, setMunkiIssuesData] = useState<
-    IMunkiIssuesAggregate[]
-  >([]);
-  const [munkiVersionsData, setMunkiVersionsData] = useState<
-    IMunkiVersionsAggregate[]
-  >([]);
   const [mdmTitleDetail, setMdmTitleDetail] = useState<
     JSX.Element | string | null
   >();
-  const [munkiTitleDetail, setMunkiTitleDetail] = useState<
-    JSX.Element | string | null
-  >();
 
   useEffect(() => {
     const platformByPathname =
@@ -423,26 +410,24 @@ const DashboardPage = ({ router, location }: IDashboardProps): JSX.Element => {
     }
   );
 
-  const { isFetching: isMacAdminsFetching, error: errorMacAdmins } = useQuery<
-    IMacadminAggregate,
-    Error
-  >(["macAdmins", teamIdForApi], () => macadminsAPI.loadAll(teamIdForApi), {
-    keepPreviousData: true,
-    enabled: isRouteOk && selectedPlatform === "darwin",
-    onSuccess: ({
-      macadmins: { munki_issues, munki_versions, counts_updated_at },
-    }) => {
-      setMunkiVersionsData(munki_versions);
-      setMunkiIssuesData(munki_issues);
-      setShowMunkiCard(!!munki_versions);
-      setMunkiTitleDetail(
-        <LastUpdatedText
-          lastUpdatedAt={counts_updated_at}
-          whatToRetrieve="Munki"
-        />
-      );
-    },
-  });
+  const {
+    data: macAdminsData,
+    isFetching: isMacAdminsFetching,
+    error: errorMacAdmins,
+  } = useQuery<IMacadminAggregate, Error, IMacadminAggregate["macadmins"]>(
+    ["macAdmins", teamIdForApi],
+    () => macadminsAPI.loadAll(teamIdForApi),
+    {
+      select: (data) => data.macadmins,
+      keepPreviousData: true,
+      enabled: isRouteOk && selectedPlatform === "darwin",
+    }
+  );
+  const {
+    munki_issues: munkiIssues,
+    munki_versions: munkiVersions,
+    counts_updated_at: munkiCountsUpdatedAt,
+  } = macAdminsData || {};
 
   useEffect(() => {
     softwareCount && softwareCount > 0
@@ -536,13 +521,6 @@ const DashboardPage = ({ router, location }: IDashboardProps): JSX.Element => {
       renderFlash,
     ]
   );
-  // TODO: Rework after backend is adjusted to differentiate empty search/filter results from
-  // collecting inventory
-  const isCollectingInventory =
-    !isAnyTeamSelected &&
-    !softwarePageIndex &&
-    !software?.software &&
-    software?.counts_updated_at === null;
 
   const HostsSummaryCard = useInfoCard({
     title: "Hosts",
@@ -655,12 +633,10 @@ const DashboardPage = ({ router, location }: IDashboardProps): JSX.Element => {
     children: (
       <Software
         errorSoftware={errorSoftware}
-        isCollectingInventory={isCollectingInventory}
         isSoftwareFetching={isSoftwareFetching}
         isSoftwareEnabled={isSoftwareEnabled}
         software={software}
         teamId={currentTeamId}
-        pageIndex={softwarePageIndex}
         navTabIndex={softwareNavTabIndex}
         onTabChange={onSoftwareTabChange}
         onQueryChange={onSoftwareQueryChange}
@@ -669,6 +645,16 @@ const DashboardPage = ({ router, location }: IDashboardProps): JSX.Element => {
     ),
   });
 
+  const munkiTitleDetail = useMemo(
+    () => (
+      <LastUpdatedText
+        lastUpdatedAt={munkiCountsUpdatedAt}
+        whatToRetrieve="Munki"
+      />
+    ),
+    [munkiCountsUpdatedAt]
+  );
+
   const MunkiCard = useInfoCard({
     title: "Munki",
     titleDetail: munkiTitleDetail,
@@ -687,8 +673,8 @@ const DashboardPage = ({ router, location }: IDashboardProps): JSX.Element => {
       <Munki
         errorMacAdmins={errorMacAdmins}
         isMacAdminsFetching={isMacAdminsFetching}
-        munkiIssuesData={munkiIssuesData}
-        munkiVersionsData={munkiVersionsData}
+        munkiIssuesData={munkiIssues || []}
+        munkiVersionsData={munkiVersions || []}
         selectedTeamId={currentTeamId}
       />
     ),
@@ -753,7 +739,7 @@ const DashboardPage = ({ router, location }: IDashboardProps): JSX.Element => {
     <>
       <div className={`${baseClass}__section`}>{OperatingSystemsCard}</div>
       {showMdmCard && <div className={`${baseClass}__section`}>{MDMCard}</div>}
-      {showMunkiCard && (
+      {!!munkiVersions && (
         <div className={`${baseClass}__section`}>{MunkiCard}</div>
       )}
     </>
diff --git a/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityFeed.tsx b/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityFeed.tsx
index b51946d0f382..c9e6b08af9f1 100644
--- a/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityFeed.tsx
+++ b/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityFeed.tsx
@@ -16,7 +16,8 @@ import Spinner from "components/Spinner";
 // @ts-ignore
 import FleetIcon from "components/icons/FleetIcon";
 
-import { SoftwareInstallDetailsModal } from "pages/SoftwarePage/components/SoftwareInstallDetails";
+import { AppInstallDetailsModal } from "components/ActivityDetails/InstallDetails/AppInstallDetails";
+import { SoftwareInstallDetailsModal } from "components/ActivityDetails/InstallDetails/SoftwareInstallDetails/SoftwareInstallDetails";
 
 import ActivityItem from "./ActivityItem";
 import ScriptDetailsModal from "./components/ScriptDetailsModal/ScriptDetailsModal";
@@ -36,7 +37,14 @@ const ActivityFeed = ({
   const [pageIndex, setPageIndex] = useState(0);
   const [showShowQueryModal, setShowShowQueryModal] = useState(false);
   const [showScriptDetailsModal, setShowScriptDetailsModal] = useState(false);
-  const [installedSoftwareUuid, setInstalledSoftwareUuid] = useState("");
+  const [
+    packageInstallDetails,
+    setPackageInstallDetails,
+  ] = useState<IActivityDetails | null>(null);
+  const [
+    appInstallDetails,
+    setAppInstallDetails,
+  ] = useState<IActivityDetails | null>(null);
   const queryShown = useRef("");
   const queryImpact = useRef<string | undefined>(undefined);
   const scriptExecutionId = useRef("");
@@ -83,7 +91,6 @@ const ActivityFeed = ({
     activityType: ActivityType,
     details: IActivityDetails
   ) => {
-    console.log("activityType", activityType);
     switch (activityType) {
       case ActivityType.LiveQuery:
         queryShown.current = details.query_sql ?? "";
@@ -97,9 +104,10 @@ const ActivityFeed = ({
         setShowScriptDetailsModal(true);
         break;
       case ActivityType.InstalledSoftware:
-        // installUuid.current = details.install_uuid ?? "";
-        // console.log("installUuid.current", installUuid.current);
-        setInstalledSoftwareUuid(details.install_uuid ?? "");
+        setPackageInstallDetails({ ...details });
+        break;
+      case ActivityType.InstalledAppStoreApp:
+        setAppInstallDetails({ ...details });
         break;
       default:
         break;
@@ -191,10 +199,16 @@ const ActivityFeed = ({
           onCancel={() => setShowScriptDetailsModal(false)}
         />
       )}
-      {installedSoftwareUuid && (
+      {packageInstallDetails && (
         <SoftwareInstallDetailsModal
-          installUuid={installedSoftwareUuid}
-          onCancel={() => setInstalledSoftwareUuid("")}
+          details={packageInstallDetails}
+          onCancel={() => setPackageInstallDetails(null)}
+        />
+      )}
+      {appInstallDetails && (
+        <AppInstallDetailsModal
+          details={appInstallDetails}
+          onCancel={() => setAppInstallDetails(null)}
         />
       )}
     </div>
diff --git a/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityItem/ActivityItem.tests.tsx b/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityItem/ActivityItem.tests.tsx
index f04e855af728..c7ca0274021a 100644
--- a/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityItem/ActivityItem.tests.tsx
+++ b/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityItem/ActivityItem.tests.tsx
@@ -1203,4 +1203,34 @@ describe("Activity Feed", () => {
     render(<ActivityItem activity={activity} isPremiumTier />);
     expect(screen.getByText("An end user")).toBeInTheDocument();
   });
+
+  it("renders the correct actor for a installed_app_store_app activity without self_service", () => {
+    const activity = createMockActivity({
+      type: ActivityType.InstalledAppStoreApp,
+      actor_id: 1,
+      actor_full_name: "Test Admin",
+      details: {
+        software_title: "Foo Software",
+        host_display_name: "Foo Host",
+      },
+    });
+
+    render(<ActivityItem activity={activity} isPremiumTier />);
+    expect(screen.getByText("Test Admin")).toBeInTheDocument();
+  });
+
+  it("renders the correct actor for a installed_app_store_app activity that was self_service", () => {
+    const activity = createMockActivity({
+      type: ActivityType.InstalledAppStoreApp,
+      actor_id: 1,
+      details: {
+        software_title: "Foo Software",
+        self_service: true,
+        host_display_name: "Foo Host",
+      },
+    });
+
+    render(<ActivityItem activity={activity} isPremiumTier />);
+    expect(screen.getByText("An end user")).toBeInTheDocument();
+  });
 });
diff --git a/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityItem/ActivityItem.tsx b/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityItem/ActivityItem.tsx
index d8deaf0fe7ad..0e4bb125fab3 100644
--- a/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityItem/ActivityItem.tsx
+++ b/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityItem/ActivityItem.tsx
@@ -1,8 +1,14 @@
 import React from "react";
-import { find, lowerCase, noop } from "lodash";
+import { find, lowerCase, noop, trimEnd } from "lodash";
 import { formatDistanceToNowStrict } from "date-fns";
 
 import { ActivityType, IActivity, IActivityDetails } from "interfaces/activity";
+import { getInstallStatusPredicate } from "interfaces/software";
+import {
+  AppleDisplayPlatform,
+  PLATFORM_DISPLAY_NAMES,
+} from "interfaces/platform";
+
 import {
   addGravatarUrlToResource,
   formatScriptNameForActivityItem,
@@ -16,7 +22,6 @@ import Icon from "components/Icon";
 import ReactTooltip from "react-tooltip";
 import PremiumFeatureIconWithTooltip from "components/PremiumFeatureIconWithTooltip";
 import { COLORS } from "styles/var/colors";
-import { getSoftwareInstallStatusPredicate } from "pages/hosts/details/cards/Activity/ActivityItems/InstalledSoftwareActivityItem/InstalledSoftwareActivityItem";
 
 const baseClass = "activity-item";
 
@@ -36,10 +41,11 @@ const PREMIUM_ACTIVITIES = new Set([
 
 const getProfileMessageSuffix = (
   isPremiumTier: boolean,
-  platform: "darwin" | "windows",
+  platform: "apple" | "windows",
   teamName?: string | null
 ) => {
-  const platformDisplayName = platform === "darwin" ? "macOS" : "Windows";
+  const platformDisplayName =
+    platform === "apple" ? "macOS, iOS, and iPadOS" : "Windows";
   let messageSuffix = <>all {platformDisplayName} hosts</>;
   if (isPremiumTier) {
     messageSuffix = teamName ? (
@@ -306,7 +312,10 @@ const TAGGED_TEMPLATES = {
       </>
     );
   },
-  editedMacosMinVersion: (activity: IActivity) => {
+  editedAppleosMinVersion: (
+    applePlatform: AppleDisplayPlatform,
+    activity: IActivity
+  ) => {
     const editedActivity =
       activity.details?.minimum_version === "" ? "removed" : "updated";
 
@@ -330,7 +339,7 @@ const TAGGED_TEMPLATES = {
 
     return (
       <>
-        {editedActivity} the minimum macOS version {versionSection}{" "}
+        {editedActivity} the minimum {applePlatform} version {versionSection}{" "}
         {deadlineSection} on hosts assigned to {teamSection}.
       </>
     );
@@ -345,7 +354,7 @@ const TAGGED_TEMPLATES = {
       </>
     );
   },
-  createMacOSProfile: (activity: IActivity, isPremiumTier: boolean) => {
+  createdAppleOSProfile: (activity: IActivity, isPremiumTier: boolean) => {
     const profileName = activity.details?.profile_name;
     return (
       <>
@@ -361,14 +370,14 @@ const TAGGED_TEMPLATES = {
         to{" "}
         {getProfileMessageSuffix(
           isPremiumTier,
-          "darwin",
+          "apple",
           activity.details?.team_name
         )}
         .
       </>
     );
   },
-  deleteMacOSProfile: (activity: IActivity, isPremiumTier: boolean) => {
+  deletedAppleOSProfile: (activity: IActivity, isPremiumTier: boolean) => {
     const profileName = activity.details?.profile_name;
     return (
       <>
@@ -384,28 +393,28 @@ const TAGGED_TEMPLATES = {
         from{" "}
         {getProfileMessageSuffix(
           isPremiumTier,
-          "darwin",
+          "apple",
           activity.details?.team_name
         )}
         .
       </>
     );
   },
-  editMacOSProfile: (activity: IActivity, isPremiumTier: boolean) => {
+  editedAppleOSProfile: (activity: IActivity, isPremiumTier: boolean) => {
     return (
       <>
         {" "}
         edited configuration profiles for{" "}
         {getProfileMessageSuffix(
           isPremiumTier,
-          "darwin",
+          "apple",
           activity.details?.team_name
         )}{" "}
         via fleetctl.
       </>
     );
   },
-  createWindowsProfile: (activity: IActivity, isPremiumTier: boolean) => {
+  createdWindowsProfile: (activity: IActivity, isPremiumTier: boolean) => {
     const profileName = activity.details?.profile_name;
     return (
       <>
@@ -428,7 +437,7 @@ const TAGGED_TEMPLATES = {
       </>
     );
   },
-  deleteWindowsProfile: (activity: IActivity, isPremiumTier: boolean) => {
+  deletedWindowsProfile: (activity: IActivity, isPremiumTier: boolean) => {
     const profileName = activity.details?.profile_name;
     return (
       <>
@@ -451,7 +460,7 @@ const TAGGED_TEMPLATES = {
       </>
     );
   },
-  editWindowsProfile: (activity: IActivity, isPremiumTier: boolean) => {
+  editedWindowsProfile: (activity: IActivity, isPremiumTier: boolean) => {
     return (
       <>
         {" "}
@@ -781,7 +790,7 @@ const TAGGED_TEMPLATES = {
         to{" "}
         {getProfileMessageSuffix(
           isPremiumTier,
-          "darwin",
+          "apple",
           activity.details?.team_name
         )}
         .
@@ -796,7 +805,7 @@ const TAGGED_TEMPLATES = {
         <b>{activity.details?.profile_name}</b> from{" "}
         {getProfileMessageSuffix(
           isPremiumTier,
-          "darwin",
+          "apple",
           activity.details?.team_name
         )}
         .
@@ -811,7 +820,7 @@ const TAGGED_TEMPLATES = {
         <b>{activity.details?.profile_name}</b> for{" "}
         {getProfileMessageSuffix(
           isPremiumTier,
-          "darwin",
+          "apple",
           activity.details?.team_name
         )}{" "}
         via fleetctl.
@@ -833,7 +842,7 @@ const TAGGED_TEMPLATES = {
       <>
         {" "}
         added <b>{activity.details?.software_title}</b> (
-        {activity.details?.software_package}) software to{" "}
+        {activity.details?.software_package}) to{" "}
         {activity.details?.team_name ? (
           <>
             {" "}
@@ -850,7 +859,7 @@ const TAGGED_TEMPLATES = {
       <>
         {" "}
         deleted <b>{activity.details?.software_title}</b> (
-        {activity.details?.software_package}) software from{" "}
+        {activity.details?.software_package}) from{" "}
         {activity.details?.team_name ? (
           <>
             {" "}
@@ -875,20 +884,22 @@ const TAGGED_TEMPLATES = {
       host_display_name: hostName,
       software_title: title,
       status,
-      install_uuid,
     } = details;
 
+    const showSoftwarePackage =
+      !!details.software_package &&
+      activity.type === ActivityType.InstalledSoftware;
+
     return (
       <>
         {" "}
-        {getSoftwareInstallStatusPredicate(status)} <b>{title}</b> software on{" "}
+        {getInstallStatusPredicate(status)} <b>{title}</b>
+        {showSoftwarePackage && ` (${details.software_package})`} on{" "}
         <b>{hostName}</b>.{" "}
         <Button
           className={`${baseClass}__show-query-link`}
           variant="text-link"
-          onClick={() =>
-            onDetailsClick?.(ActivityType.InstalledSoftware, { install_uuid })
-          }
+          onClick={() => onDetailsClick?.(activity.type, details)}
         >
           Show details{" "}
           <Icon className={`${baseClass}__show-query-icon`} name="eye" />
@@ -896,6 +907,78 @@ const TAGGED_TEMPLATES = {
       </>
     );
   },
+  enabledVpp: (activity: IActivity) => {
+    return (
+      <>
+        {" "}
+        enabled <b>Volume Purchasing Program (VPP)</b>
+        {activity.details?.location ? (
+          <>
+            {" "}
+            for <b>{trimEnd(activity.details?.location, ".")}</b>
+          </>
+        ) : (
+          ""
+        )}
+        .
+      </>
+    );
+  },
+  disabledVpp: (activity: IActivity) => {
+    return (
+      <>
+        {" "}
+        disabled <b>Volume Purchasing Program (VPP)</b>
+        {activity.details?.location ? (
+          <>
+            {" "}
+            for <b>{trimEnd(activity.details?.location, ".")}</b>
+          </>
+        ) : (
+          ""
+        )}
+        .
+      </>
+    );
+  },
+  addedAppStoreApp: (activity: IActivity) => {
+    const { software_title: swTitle, platform: swPlatform } =
+      activity.details || {};
+    return (
+      <>
+        {" "}
+        added <b>{swTitle}</b>{" "}
+        {swPlatform ? `(${PLATFORM_DISPLAY_NAMES[swPlatform]}) ` : ""}to{" "}
+        {activity.details?.team_name ? (
+          <>
+            {" "}
+            the <b>{activity.details?.team_name}</b> team.
+          </>
+        ) : (
+          "no team."
+        )}
+      </>
+    );
+  },
+  deletedAppStoreApp: (activity: IActivity) => {
+    const { software_title: swTitle, platform: swPlatform } =
+      activity.details || {};
+    return (
+      <>
+        {" "}
+        deleted <b>{swTitle}</b>{" "}
+        {swPlatform ? `(${PLATFORM_DISPLAY_NAMES[swPlatform]}) ` : ""}from{" "}
+        {activity.details?.team_name ? (
+          <>
+            {" "}
+            the <b>{activity.details?.team_name}</b> team.
+          </>
+        ) : (
+          "no team."
+        )}
+      </>
+    );
+  },
 };
 
 const getDetail = (
@@ -962,28 +1045,35 @@ const getDetail = (
       return TAGGED_TEMPLATES.mdmUnenrolled(activity);
     }
     case ActivityType.EditedMacosMinVersion: {
-      return TAGGED_TEMPLATES.editedMacosMinVersion(activity);
+      return TAGGED_TEMPLATES.editedAppleosMinVersion("macOS", activity);
+    }
+    case ActivityType.EditedIosMinVersion: {
+      return TAGGED_TEMPLATES.editedAppleosMinVersion("iOS", activity);
     }
+    case ActivityType.EditedIpadosMinVersion: {
+      return TAGGED_TEMPLATES.editedAppleosMinVersion("iPadOS", activity);
+    }
+
     case ActivityType.ReadHostDiskEncryptionKey: {
       return TAGGED_TEMPLATES.readHostDiskEncryptionKey(activity);
     }
-    case ActivityType.CreatedMacOSProfile: {
-      return TAGGED_TEMPLATES.createMacOSProfile(activity, isPremiumTier);
+    case ActivityType.CreatedAppleOSProfile: {
+      return TAGGED_TEMPLATES.createdAppleOSProfile(activity, isPremiumTier);
     }
-    case ActivityType.DeletedMacOSProfile: {
-      return TAGGED_TEMPLATES.deleteMacOSProfile(activity, isPremiumTier);
+    case ActivityType.DeletedAppleOSProfile: {
+      return TAGGED_TEMPLATES.deletedAppleOSProfile(activity, isPremiumTier);
     }
-    case ActivityType.EditedMacOSProfile: {
-      return TAGGED_TEMPLATES.editMacOSProfile(activity, isPremiumTier);
+    case ActivityType.EditedAppleOSProfile: {
+      return TAGGED_TEMPLATES.editedAppleOSProfile(activity, isPremiumTier);
     }
     case ActivityType.CreatedWindowsProfile: {
-      return TAGGED_TEMPLATES.createWindowsProfile(activity, isPremiumTier);
+      return TAGGED_TEMPLATES.createdWindowsProfile(activity, isPremiumTier);
     }
     case ActivityType.DeletedWindowsProfile: {
-      return TAGGED_TEMPLATES.deleteWindowsProfile(activity, isPremiumTier);
+      return TAGGED_TEMPLATES.deletedWindowsProfile(activity, isPremiumTier);
     }
     case ActivityType.EditedWindowsProfile: {
-      return TAGGED_TEMPLATES.editWindowsProfile(activity, isPremiumTier);
+      return TAGGED_TEMPLATES.editedWindowsProfile(activity, isPremiumTier);
     }
     // Note: Both "enabled_disk_encryption" and "enabled_macos_disk_encryption" display the same
     // message. The latter is deprecated in the API but it is retained here for backwards compatibility.
@@ -1078,6 +1168,21 @@ const getDetail = (
     case ActivityType.InstalledSoftware: {
       return TAGGED_TEMPLATES.installedSoftware(activity, onDetailsClick);
     }
+    case ActivityType.AddedAppStoreApp: {
+      return TAGGED_TEMPLATES.addedAppStoreApp(activity);
+    }
+    case ActivityType.DeletedAppStoreApp: {
+      return TAGGED_TEMPLATES.deletedAppStoreApp(activity);
+    }
+    case ActivityType.InstalledAppStoreApp: {
+      return TAGGED_TEMPLATES.installedSoftware(activity, onDetailsClick);
+    }
+    case ActivityType.EnabledVpp: {
+      return TAGGED_TEMPLATES.enabledVpp(activity);
+    }
+    case ActivityType.DisabledVpp: {
+      return TAGGED_TEMPLATES.disabledVpp(activity);
+    }
 
     default: {
       return TAGGED_TEMPLATES.defaultActivityTemplate(activity);
@@ -1129,6 +1234,7 @@ const ActivityItem = ({
           DEFAULT_ACTOR_DISPLAY
         );
       case ActivityType.InstalledSoftware:
+      case ActivityType.InstalledAppStoreApp:
         return activity.details?.self_service ? (
           <span>An end user</span>
         ) : (
diff --git a/frontend/pages/DashboardPage/cards/ActivityFeed/components/ScriptDetailsModal/ScriptDetailsModal.tsx b/frontend/pages/DashboardPage/cards/ActivityFeed/components/ScriptDetailsModal/ScriptDetailsModal.tsx
index f2d30b528553..3a741c884a04 100644
--- a/frontend/pages/DashboardPage/cards/ActivityFeed/components/ScriptDetailsModal/ScriptDetailsModal.tsx
+++ b/frontend/pages/DashboardPage/cards/ActivityFeed/components/ScriptDetailsModal/ScriptDetailsModal.tsx
@@ -55,7 +55,7 @@ const StatusMessageFailed = ({ exitCode }: { exitCode: number }) => (
   </div>
 );
 
-const StatusMessageError = ({ message }: { message: string }) => (
+const StatusMessageError = ({ message }: { message: React.ReactNode }) => (
   <div className={`${baseClass}__status-message`}>
     <p>
       <Icon name="error-outline" />
@@ -87,9 +87,28 @@ const StatusMessage = ({
     case -2:
       // Expected API message: "Scripts are disabled for this host. To run scripts, deploy the fleetd agent with scripts enabled."
       return <StatusMessageError message={message} />;
-    case -1:
-      // Expected API message: "Timeout. Fleet stopped the script after 5 minutes to protect host performance."
-      return <StatusMessageError message={message} />;
+    case -1: {
+      // message should look like: "Timeout. Fleet stopped the script after 600 seconds to protect host performance.";
+      const timeOutValue = message.match(/(\d+\s(?:seconds))/);
+
+      // should always be there, but handle cleanly if not
+      const varText = timeOutValue ? (
+        <>
+          after{" "}
+          <TooltipWrapper tipContent="Timeout can be configured by updating agent options.">
+            {timeOutValue[0]}
+          </TooltipWrapper>{" "}
+        </>
+      ) : null;
+
+      const modMessage = (
+        <>
+          Timeout. Fleet stopped the script {varText}to protect host
+          performance.
+        </>
+      );
+      return <StatusMessageError message={modMessage} />;
+    }
     case 0:
       // Expected API message: ""
       return <StatusMessageSuccess />;
diff --git a/frontend/pages/DashboardPage/cards/ActivityFeed/components/ScriptDetailsModal/_styles.scss b/frontend/pages/DashboardPage/cards/ActivityFeed/components/ScriptDetailsModal/_styles.scss
index a69a6cb84918..b7a7e1e1060a 100644
--- a/frontend/pages/DashboardPage/cards/ActivityFeed/components/ScriptDetailsModal/_styles.scss
+++ b/frontend/pages/DashboardPage/cards/ActivityFeed/components/ScriptDetailsModal/_styles.scss
@@ -27,6 +27,12 @@
       align-items: center;
       gap: $pad-small;
       margin: 0;
+
+      .component__tooltip-wrapper {
+        margin-left: -$pad-xsmall;
+        margin-right: -$pad-xsmall;
+        margin-top: -1px;
+      }
     }
   }
 
diff --git a/frontend/pages/DashboardPage/cards/Munki/Munki.tests.tsx b/frontend/pages/DashboardPage/cards/Munki/Munki.tests.tsx
new file mode 100644
index 000000000000..b533c26956d6
--- /dev/null
+++ b/frontend/pages/DashboardPage/cards/Munki/Munki.tests.tsx
@@ -0,0 +1,89 @@
+import React from "react";
+import { screen } from "@testing-library/react";
+import { createCustomRenderer } from "test/test-utils";
+import createMockUser from "__mocks__/userMock";
+
+import {
+  IMunkiIssuesAggregate,
+  IMunkiVersionsAggregate,
+} from "interfaces/macadmins";
+import Munki from "./Munki";
+
+describe("Munki card", () => {
+  it("renders data normally when present", async () => {
+    const [name1, name2] = ["Munki issue 1", "Munki issue 2"];
+    const [
+      errorMacAdmins,
+      isMacAdminsFetching,
+      munkiIssuesData,
+      munkiVersionsData,
+      selectedTeamId,
+    ] = [
+      null,
+      false,
+      [
+        {
+          id: 476,
+          name: name1,
+          type: "warning",
+          hosts_count: 2345,
+        },
+        {
+          id: 555,
+          name: name2,
+          type: "error",
+          hosts_count: 5432,
+        },
+      ] as IMunkiIssuesAggregate[],
+      [
+        {
+          version: "1.2.3",
+          hosts_count: 37,
+        },
+      ] as IMunkiVersionsAggregate[],
+      undefined,
+    ];
+
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          isPremiumTier: true,
+          isGlobalAdmin: true,
+          currentUser: createMockUser(),
+        },
+      },
+    });
+
+    const { user } = render(
+      <Munki
+        errorMacAdmins={errorMacAdmins}
+        isMacAdminsFetching={isMacAdminsFetching}
+        munkiIssuesData={munkiIssuesData}
+        munkiVersionsData={munkiVersionsData}
+        selectedTeamId={selectedTeamId}
+      />
+    );
+
+    // Issues tab
+    expect(screen.getByText("Issue")).toBeInTheDocument();
+    expect(screen.getByText("Type")).toBeInTheDocument();
+    expect(screen.getByText("Hosts")).toBeInTheDocument();
+
+    expect(screen.getAllByText(name1)).toHaveLength(2);
+    expect(screen.getByText("Warning")).toBeInTheDocument();
+    expect(screen.getByText("2345")).toBeInTheDocument();
+
+    expect(screen.getAllByText(name2)).toHaveLength(2);
+    expect(screen.getByText("Error")).toBeInTheDocument();
+    expect(screen.getByText("5432")).toBeInTheDocument();
+
+    // Versions tab
+
+    await user.click(screen.getByText("Versions"));
+
+    expect(screen.getByText("Version")).toBeInTheDocument();
+    expect(screen.getByText("Hosts")).toBeInTheDocument();
+    expect(screen.getByText("1.2.3")).toBeInTheDocument();
+    expect(screen.getByText("37")).toBeInTheDocument();
+  });
+});
diff --git a/frontend/pages/DashboardPage/cards/OperatingSystems/OSTable.tests.tsx b/frontend/pages/DashboardPage/cards/OperatingSystems/OSTable.tests.tsx
new file mode 100644
index 000000000000..934bd5db442c
--- /dev/null
+++ b/frontend/pages/DashboardPage/cards/OperatingSystems/OSTable.tests.tsx
@@ -0,0 +1,55 @@
+import React from "react";
+import { render, screen } from "@testing-library/react";
+
+import OSTable from "./OSTable";
+
+describe("Dashboard OS table", () => {
+  it("renders data normally when present", () => {
+    render(
+      <OSTable
+        currentTeamId={undefined}
+        osVersions={[
+          {
+            os_version_id: 1,
+            hosts_count: 234,
+            name: "Microsoft Windows 11 Enterprise 22H2 10.0.22621",
+            name_only: "Microsoft Windows 11 Enterprise 22H2",
+            version: "1.2.3",
+            platform: "windows",
+            vulnerabilities: [],
+          },
+          {
+            os_version_id: 2,
+            hosts_count: 567,
+            name: "Microsoft Windows 11 Pro 22H2 10.0.22621.3880",
+            name_only: "Microsoft Windows 11 Pro 22H2",
+            version: "4.5.6",
+            platform: "windows",
+            vulnerabilities: [
+              {
+                cve: "CVE-2022-2601",
+                details_link: "https://nvd.nist.gov/vuln/detail/CVE-2022-2601",
+                created_at: "2024-08-14T01:01:19Z",
+                cvss_score: 8.6,
+                epss_probability: 0.00075,
+                cisa_known_exploit: false,
+                cve_published: "2022-12-14T21:15:00Z",
+                cve_description: "Very bad",
+                resolved_in_version: "10.0.22621.4037",
+              },
+            ],
+          },
+        ]}
+        selectedPlatform="windows"
+        isLoading={false}
+      />
+    );
+
+    expect(screen.getByText("Version")).toBeInTheDocument();
+    expect(screen.getByText("Hosts")).toBeInTheDocument();
+    expect(screen.getByText("1.2.3")).toBeInTheDocument();
+    expect(screen.getByText("234")).toBeInTheDocument();
+    expect(screen.getByText("4.5.6")).toBeInTheDocument();
+    expect(screen.getByText("567")).toBeInTheDocument();
+  });
+});
diff --git a/frontend/pages/DashboardPage/cards/OperatingSystems/OSTable.tsx b/frontend/pages/DashboardPage/cards/OperatingSystems/OSTable.tsx
new file mode 100644
index 000000000000..ad2a98512494
--- /dev/null
+++ b/frontend/pages/DashboardPage/cards/OperatingSystems/OSTable.tsx
@@ -0,0 +1,68 @@
+import EmptyTable from "components/EmptyTable";
+import TableContainer from "components/TableContainer";
+import { IOperatingSystemVersion } from "interfaces/operating_system";
+import React, { useMemo } from "react";
+import {
+  PlatformValueOptions,
+  PLATFORM_DISPLAY_NAMES,
+} from "utilities/constants";
+
+import generateTableHeaders from "./OSTableConfig";
+
+const DEFAULT_SORT_DIRECTION = "desc";
+const DEFAULT_SORT_HEADER = "hosts_count";
+const PAGE_SIZE = 8;
+
+const baseClass = "operating-systems";
+
+const EmptyOS = (platform: PlatformValueOptions): JSX.Element => (
+  <EmptyTable
+    className={`${baseClass}__os-empty-table`}
+    header={`No${
+      ` ${PLATFORM_DISPLAY_NAMES[platform]}` || ""
+    } operating systems detected`}
+    info="This report is updated every hour to protect the performance of your
+  devices."
+  />
+);
+
+interface IOSTableProps {
+  currentTeamId?: number;
+  osVersions: IOperatingSystemVersion[];
+  selectedPlatform: PlatformValueOptions;
+  isLoading: boolean;
+}
+
+const OSTable = ({
+  currentTeamId,
+  osVersions,
+  selectedPlatform,
+  isLoading,
+}: IOSTableProps) => {
+  const columnConfigs = useMemo(
+    () => generateTableHeaders(currentTeamId, undefined),
+    [currentTeamId]
+  );
+
+  const showPaginationControls = osVersions.length > PAGE_SIZE;
+
+  return (
+    <TableContainer
+      columnConfigs={columnConfigs}
+      data={osVersions}
+      isLoading={isLoading}
+      defaultSortHeader={DEFAULT_SORT_HEADER}
+      defaultSortDirection={DEFAULT_SORT_DIRECTION}
+      resultsTitle="Operating systems"
+      emptyComponent={() => EmptyOS(selectedPlatform)}
+      showMarkAllPages={false}
+      isAllPagesSelected={false}
+      disableCount
+      isClientSidePagination={showPaginationControls}
+      disablePagination={!showPaginationControls}
+      pageSize={PAGE_SIZE}
+    />
+  );
+};
+
+export default OSTable;
diff --git a/frontend/pages/DashboardPage/cards/OperatingSystems/OperatingSystemsTableConfig.tsx b/frontend/pages/DashboardPage/cards/OperatingSystems/OSTableConfig.tsx
similarity index 96%
rename from frontend/pages/DashboardPage/cards/OperatingSystems/OperatingSystemsTableConfig.tsx
rename to frontend/pages/DashboardPage/cards/OperatingSystems/OSTableConfig.tsx
index f5a529221702..1ddc7c0e70d8 100644
--- a/frontend/pages/DashboardPage/cards/OperatingSystems/OperatingSystemsTableConfig.tsx
+++ b/frontend/pages/DashboardPage/cards/OperatingSystems/OSTableConfig.tsx
@@ -108,7 +108,7 @@ const generateDefaultTableHeaders = (
     Cell: (cellProps: IVulnCellProps) => {
       const platform = cellProps.row.original.platform;
       if (platform !== "darwin" && platform !== "windows") {
-        return <TextCell value="Not supported" grey italic />;
+        return <TextCell value="Not supported" grey />;
       }
       return <VulnerabilitiesCell vulnerabilities={cellProps.cell.value} />;
     },
@@ -146,6 +146,7 @@ const generateDefaultTableHeaders = (
   },
 ];
 
+// this is also used by frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tsx
 const generateTableHeaders = (
   teamId?: number,
   router?: InjectedRouter,
diff --git a/frontend/pages/DashboardPage/cards/OperatingSystems/OperatingSystems.tsx b/frontend/pages/DashboardPage/cards/OperatingSystems/OperatingSystems.tsx
index 5d2ef7f5dafb..343f74fe7066 100644
--- a/frontend/pages/DashboardPage/cards/OperatingSystems/OperatingSystems.tsx
+++ b/frontend/pages/DashboardPage/cards/OperatingSystems/OperatingSystems.tsx
@@ -1,4 +1,4 @@
-import React, { useEffect, useMemo } from "react";
+import React, { useEffect } from "react";
 import { useQuery } from "react-query";
 
 import {
@@ -11,20 +11,15 @@ import {
   IOSVersionsResponse,
   OS_VERSIONS_API_SUPPORTED_PLATFORMS,
 } from "services/entities/operating_systems";
-import {
-  PLATFORM_DISPLAY_NAMES,
-  PlatformValueOptions,
-} from "utilities/constants";
+import { PlatformValueOptions } from "utilities/constants";
 
-import TableContainer from "components/TableContainer";
 import Spinner from "components/Spinner";
 import TableDataError from "components/DataError";
 import LastUpdatedText from "components/LastUpdatedText";
 import CustomLink from "components/CustomLink";
-import EmptyTable from "components/EmptyTable";
 import { AxiosError } from "axios";
 
-import generateTableHeaders from "./OperatingSystemsTableConfig";
+import OSTable from "./OSTable";
 
 interface IOperatingSystemsCardProps {
   currentTeamId: number | undefined;
@@ -32,40 +27,23 @@ interface IOperatingSystemsCardProps {
   showTitle: boolean;
   /** controls the displaying of description text under the title. Defaults to `true` */
   showDescription?: boolean;
-  /** controls the displaying of the **Name** column in the table. Defaults to `true` */
-  includeNameColumn?: boolean;
   setShowTitle: (showTitle: boolean) => void;
   setTitleDetail?: (content: JSX.Element | string | null) => void;
   setTitleDescription?: (content: JSX.Element | string | null) => void;
 }
 
-const DEFAULT_SORT_DIRECTION = "desc";
-const DEFAULT_SORT_HEADER = "hosts_count";
-const PAGE_SIZE = 8;
 const baseClass = "operating-systems";
 
-const EmptyOperatingSystems = (platform: PlatformValueOptions): JSX.Element => (
-  <EmptyTable
-    className={`${baseClass}__os-empty-table`}
-    header={`No${
-      ` ${PLATFORM_DISPLAY_NAMES[platform]}` || ""
-    } operating systems detected`}
-    info="This report is updated every hour to protect the performance of your
-      devices."
-  />
-);
-
 const OperatingSystems = ({
   currentTeamId,
   selectedPlatform,
   showTitle,
   showDescription = true,
-  includeNameColumn = true,
   setShowTitle,
   setTitleDetail,
   setTitleDescription,
 }: IOperatingSystemsCardProps): JSX.Element => {
-  const { data: osInfo, error, isFetching } = useQuery<
+  const { data: osInfo, error, isLoading } = useQuery<
     IOSVersionsResponse,
     AxiosError,
     IOSVersionsResponse,
@@ -133,36 +111,31 @@ const OperatingSystems = ({
     />
   ) : null;
 
+  const osVersions = osInfo?.os_versions || [];
+
   useEffect(() => {
-    if (isFetching) {
+    if (isLoading) {
       setShowTitle(false);
       setTitleDescription?.(null);
       setTitleDetail?.(null);
       return;
     }
     setShowTitle(true);
-    if (osInfo?.os_versions?.length) {
+    if (osVersions.length) {
       setTitleDescription?.(renderDescription());
       setTitleDetail?.(titleDetail);
       return;
     }
     setTitleDescription?.(null);
     setTitleDetail?.(null);
-  }, [isFetching, osInfo, setTitleDescription, setTitleDetail]);
-
-  const tableHeaders = useMemo(
-    () => generateTableHeaders(currentTeamId, undefined, { includeName: true }),
-    [includeNameColumn, currentTeamId]
-  );
-
-  const showPaginationControls = (osInfo?.os_versions?.length || 0) > 8;
+  }, [isLoading, osInfo, setTitleDescription, setTitleDetail]);
 
   // Renders opaque information as host information is loading
-  const opacity = isFetching || !showTitle ? { opacity: 0 } : { opacity: 1 };
+  const opacity = isLoading || !showTitle ? { opacity: 0 } : { opacity: 1 };
 
   return (
     <div className={baseClass}>
-      {isFetching && (
+      {isLoading && (
         <div className="spinner">
           <Spinner />
         </div>
@@ -171,20 +144,11 @@ const OperatingSystems = ({
         {error?.status && error?.status >= 500 ? (
           <TableDataError card />
         ) : (
-          <TableContainer
-            columnConfigs={tableHeaders}
-            data={osInfo?.os_versions || []}
-            isLoading={isFetching}
-            defaultSortHeader={DEFAULT_SORT_HEADER}
-            defaultSortDirection={DEFAULT_SORT_DIRECTION}
-            resultsTitle="Operating systems"
-            emptyComponent={() => EmptyOperatingSystems(selectedPlatform)}
-            showMarkAllPages={false}
-            isAllPagesSelected={false}
-            disableCount
-            isClientSidePagination={showPaginationControls}
-            disablePagination={!showPaginationControls}
-            pageSize={PAGE_SIZE}
+          <OSTable
+            currentTeamId={currentTeamId}
+            osVersions={osVersions}
+            selectedPlatform={selectedPlatform}
+            isLoading={isLoading}
           />
         )}
       </div>
diff --git a/frontend/pages/DashboardPage/cards/Software/DashboardSoftware.tests.tsx b/frontend/pages/DashboardPage/cards/Software/DashboardSoftware.tests.tsx
new file mode 100644
index 000000000000..c6ddbdaa105c
--- /dev/null
+++ b/frontend/pages/DashboardPage/cards/Software/DashboardSoftware.tests.tsx
@@ -0,0 +1,141 @@
+import React from "react";
+import { render, screen } from "@testing-library/react";
+import { createMockRouter } from "test/test-utils";
+
+import { ISoftwareResponse } from "interfaces/software";
+
+import Software from "./Software";
+
+describe("Dashboard software card", () => {
+  const vulnSwInfo = {
+    name: "ms-toolsai.jupyter",
+    version: "2.3.4",
+    hostsCount: 432,
+  };
+  const noVulnSwInfo = {
+    name: "common.extension_2",
+    version: "5.6.7",
+    hostsCount: 543,
+  };
+
+  it("renders all software normally when present", () => {
+    const allSwResponse: ISoftwareResponse = {
+      counts_updated_at: "2024-08-21T21:01:31Z",
+      software: [
+        {
+          id: 784,
+          name: vulnSwInfo.name,
+          version: vulnSwInfo.version,
+          source: "vscode_extensions",
+          browser: "",
+          vendor: "Microsoft",
+          generated_cpe:
+            "cpe:2.3:a:microsoft:jupyter:2023.10.10:*:*:*:*:visual_studio_code:*:*",
+          vulnerabilities: [
+            {
+              cve: "CVE-2023-36018",
+              details_link: "https://nvd.nist.gov/vuln/detail/CVE-2023-36018",
+              created_at: "2024-07-12T04:00:56Z",
+              cvss_score: 9.8,
+              epss_probability: 0.00162,
+              cisa_known_exploit: false,
+              cve_published: "2023-11-14T18:15:00Z",
+              cve_description:
+                "Visual Studio Code Jupyter Extension Spoofing Vulnerability",
+              resolved_in_version: "2023.10.1100000000",
+            },
+          ],
+          hosts_count: vulnSwInfo.hostsCount,
+        },
+        {
+          id: 758,
+          name: noVulnSwInfo.name,
+          version: noVulnSwInfo.version,
+          source: "vscode_extensions",
+          browser: "",
+          generated_cpe: "",
+          vulnerabilities: null,
+          hosts_count: noVulnSwInfo.hostsCount,
+        },
+      ],
+    };
+    render(
+      <Software
+        errorSoftware={null}
+        isSoftwareFetching={false}
+        isSoftwareEnabled
+        navTabIndex={0}
+        onTabChange={jest.fn()}
+        onQueryChange={jest.fn()}
+        software={allSwResponse}
+        teamId={-1}
+        router={createMockRouter()}
+      />
+    );
+
+    expect(screen.getByText("Name")).toBeInTheDocument();
+    expect(screen.getByText("Version")).toBeInTheDocument();
+    expect(screen.getByText("Hosts")).toBeInTheDocument();
+
+    Object.keys(noVulnSwInfo).forEach((key) => {
+      expect(
+        screen.getByText(noVulnSwInfo[key as keyof typeof noVulnSwInfo])
+      ).toBeInTheDocument();
+    });
+  });
+  it("renders vulnerable software normally when present", () => {
+    const vulnSwResponse: ISoftwareResponse = {
+      counts_updated_at: "2024-08-21T21:01:31Z",
+      software: [
+        {
+          id: 784,
+          name: vulnSwInfo.name,
+          version: vulnSwInfo.version,
+          source: "vscode_extensions",
+          browser: "",
+          vendor: "Microsoft",
+          generated_cpe:
+            "cpe:2.3:a:microsoft:jupyter:2023.10.10:*:*:*:*:visual_studio_code:*:*",
+          vulnerabilities: [
+            {
+              cve: "CVE-2023-36018",
+              details_link: "https://nvd.nist.gov/vuln/detail/CVE-2023-36018",
+              created_at: "2024-07-12T04:00:56Z",
+              cvss_score: 9.8,
+              epss_probability: 0.00162,
+              cisa_known_exploit: false,
+              cve_published: "2023-11-14T18:15:00Z",
+              cve_description:
+                "Visual Studio Code Jupyter Extension Spoofing Vulnerability",
+              resolved_in_version: "2023.10.1100000000",
+            },
+          ],
+          hosts_count: vulnSwInfo.hostsCount,
+        },
+      ],
+    };
+    render(
+      <Software
+        errorSoftware={null}
+        isSoftwareFetching={false}
+        isSoftwareEnabled
+        navTabIndex={1}
+        onTabChange={jest.fn()}
+        onQueryChange={jest.fn()}
+        software={vulnSwResponse}
+        teamId={-1}
+        router={createMockRouter()}
+      />
+    );
+
+    expect(screen.getByText("Name")).toBeInTheDocument();
+    expect(screen.getByText("Version")).toBeInTheDocument();
+    expect(screen.getByText("Hosts")).toBeInTheDocument();
+
+    Object.keys(vulnSwInfo).forEach((key) => {
+      expect(
+        screen.getByText(vulnSwInfo[key as keyof typeof vulnSwInfo])
+      ).toBeInTheDocument();
+    });
+  });
+});
diff --git a/frontend/pages/DashboardPage/cards/Software/Software.tsx b/frontend/pages/DashboardPage/cards/Software/Software.tsx
index 86e0836ef7d2..a8b8d9874119 100644
--- a/frontend/pages/DashboardPage/cards/Software/Software.tsx
+++ b/frontend/pages/DashboardPage/cards/Software/Software.tsx
@@ -18,12 +18,10 @@ import generateTableHeaders from "./SoftwareTableConfig";
 
 interface ISoftwareCardProps {
   errorSoftware: Error | null;
-  isCollectingInventory: boolean;
   isSoftwareFetching: boolean;
   isSoftwareEnabled?: boolean;
   software?: ISoftwareResponse;
   teamId?: number;
-  pageIndex: number;
   navTabIndex: number;
   onTabChange: (index: number, last: number, event: Event) => boolean | void;
   onQueryChange?:
@@ -46,7 +44,6 @@ const baseClass = "home-software";
 
 const Software = ({
   errorSoftware,
-  isCollectingInventory,
   isSoftwareFetching,
   isSoftwareEnabled,
   navTabIndex,
@@ -96,11 +93,7 @@ const Software = ({
                   defaultSortHeader={SOFTWARE_DEFAULT_SORT_DIRECTION}
                   defaultSortDirection={SOFTWARE_DEFAULT_SORT_DIRECTION}
                   resultsTitle="software"
-                  emptyComponent={() => (
-                    <EmptySoftwareTable
-                      isCollectingSoftware={isCollectingInventory}
-                    />
-                  )}
+                  emptyComponent={() => <EmptySoftwareTable />}
                   showMarkAllPages={false}
                   isAllPagesSelected={false}
                   disableCount
@@ -123,10 +116,7 @@ const Software = ({
                   defaultSortDirection={SOFTWARE_DEFAULT_SORT_DIRECTION}
                   resultsTitle="software"
                   emptyComponent={() => (
-                    <EmptySoftwareTable
-                      isCollectingSoftware={isCollectingInventory}
-                      softwareFilter="vulnerableSoftware"
-                    />
+                    <EmptySoftwareTable vulnFilters={{ vulnerable: true }} />
                   )}
                   showMarkAllPages={false}
                   isAllPagesSelected={false}
diff --git a/frontend/pages/DashboardPage/components/MdmSolutionModal/MdmSolutionModal.tests.tsx b/frontend/pages/DashboardPage/components/MdmSolutionModal/MdmSolutionModal.tests.tsx
new file mode 100644
index 000000000000..7e0d5e2bdcab
--- /dev/null
+++ b/frontend/pages/DashboardPage/components/MdmSolutionModal/MdmSolutionModal.tests.tsx
@@ -0,0 +1,27 @@
+import React from "react";
+
+import { render, screen } from "@testing-library/react";
+
+import { IMdmSolution } from "interfaces/mdm";
+
+import MdmSolutionModal from "./MdmSolutionModal";
+
+describe("MdmSolutionModal table", () => {
+  it("Renders table data normally", () => {
+    const [server_url, hosts_count] = ["a.b.c", 123];
+    const mdmSolutions: IMdmSolution[] = [
+      {
+        id: 1,
+        name: "test solution",
+        server_url,
+        hosts_count,
+      },
+    ];
+    render(
+      <MdmSolutionModal mdmSolutions={mdmSolutions} onCancel={() => null} />
+    );
+
+    expect(screen.getByText(server_url)).toBeInTheDocument();
+    expect(screen.getByText(hosts_count)).toBeInTheDocument();
+  });
+});
diff --git a/frontend/pages/DashboardPage/components/MdmSolutionModal/MdmSolutionModal.tsx b/frontend/pages/DashboardPage/components/MdmSolutionModal/MdmSolutionModal.tsx
index aeae56538e22..bc2ce8196b6e 100644
--- a/frontend/pages/DashboardPage/components/MdmSolutionModal/MdmSolutionModal.tsx
+++ b/frontend/pages/DashboardPage/components/MdmSolutionModal/MdmSolutionModal.tsx
@@ -24,7 +24,7 @@ interface IMdmSolutionModalProps {
   onCancel: () => void;
 }
 
-const MdmSolutionsModal = ({
+const MdmSolutionModal = ({
   mdmSolutions,
   selectedPlatformLabelId,
   selectedTeamId,
@@ -73,4 +73,4 @@ const MdmSolutionsModal = ({
   );
 };
 
-export default MdmSolutionsModal;
+export default MdmSolutionModal;
diff --git a/frontend/pages/ManageControlsPage/ManageControlsPage.tsx b/frontend/pages/ManageControlsPage/ManageControlsPage.tsx
index 5d95de538c9e..5304c1aa4e3b 100644
--- a/frontend/pages/ManageControlsPage/ManageControlsPage.tsx
+++ b/frontend/pages/ManageControlsPage/ManageControlsPage.tsx
@@ -9,6 +9,7 @@ import useTeamIdParam from "hooks/useTeamIdParam";
 import TabsWrapper from "components/TabsWrapper";
 import MainContent from "components/MainContent";
 import TeamsDropdown from "components/TeamsDropdown";
+import { parseOSUpdatesCurrentVersionsQueryParams } from "./OSUpdates/components/CurrentVersionSection/CurrentVersionSection";
 
 interface IControlsSubNavItem {
   name: string;
@@ -43,6 +44,8 @@ interface IManageControlsPageProps {
     query: {
       team_id?: string;
       page?: string;
+      order_key?: string;
+      order_direction?: "asc" | "desc";
     };
   };
   router: InjectedRouter; // v3
@@ -67,12 +70,7 @@ const ManageControlsPage = ({
 }: IManageControlsPageProps): JSX.Element => {
   const page = parseInt(location?.query?.page || "", 10) || 0;
 
-  const {
-    isFreeTier,
-    isOnGlobalTeam,
-    isPremiumTier,
-    isSandboxMode,
-  } = useContext(AppContext);
+  const { isFreeTier, isOnGlobalTeam, isPremiumTier } = useContext(AppContext);
 
   const {
     currentTeamId,
@@ -121,7 +119,11 @@ const ManageControlsPage = ({
             </TabList>
           </Tabs>
         </TabsWrapper>
-        {React.cloneElement(children, { teamIdForApi, currentPage: page })}
+        {React.cloneElement(children, {
+          teamIdForApi,
+          currentPage: page,
+          queryParams: parseOSUpdatesCurrentVersionsQueryParams(location.query),
+        })}
       </div>
     );
   };
@@ -144,7 +146,6 @@ const ManageControlsPage = ({
                         onChange={handleTeamChange}
                         includeAll={false}
                         includeNoTeams
-                        isSandboxMode={isSandboxMode}
                       />
                     )}
                   {isPremiumTier &&
diff --git a/frontend/pages/ManageControlsPage/OSSettings/ProfileStatusAggregate/ProfileStatusAggregateOptions.ts b/frontend/pages/ManageControlsPage/OSSettings/ProfileStatusAggregate/ProfileStatusAggregateOptions.ts
index 22c941ff0bad..0eb19fa4a2b2 100644
--- a/frontend/pages/ManageControlsPage/OSSettings/ProfileStatusAggregate/ProfileStatusAggregateOptions.ts
+++ b/frontend/pages/ManageControlsPage/OSSettings/ProfileStatusAggregate/ProfileStatusAggregateOptions.ts
@@ -28,7 +28,7 @@ const AGGREGATE_STATUS_DISPLAY_OPTIONS: IAggregateDisplayOption[] = [
     text: "Pending",
     iconName: "pendingPartial",
     tooltipText:
-      "These hosts will receive MDM command to apply OS settings when the host come online.",
+      "These hosts will apply the latest OS settings. Click on a host to view which settings.",
   },
   {
     value: "failed",
diff --git a/frontend/pages/ManageControlsPage/OSSettings/_styles.scss b/frontend/pages/ManageControlsPage/OSSettings/_styles.scss
index 986234a84271..37228609c6e9 100644
--- a/frontend/pages/ManageControlsPage/OSSettings/_styles.scss
+++ b/frontend/pages/ManageControlsPage/OSSettings/_styles.scss
@@ -18,4 +18,9 @@
   .side-nav__card-container > .custom-settings {
     max-width: none;
   }
+  @media (max-width: 1120px) {
+    .side-nav__nav-list {
+      padding-right: 0;
+    }
+  }
 }
diff --git a/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/_styles.scss b/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/_styles.scss
index cb9b50f1f0ff..14828cfb9d89 100644
--- a/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/_styles.scss
+++ b/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/_styles.scss
@@ -99,10 +99,10 @@
       flex-direction: column;
       align-items: center;
       gap: $pad-small;
-    }
 
-    &__profile-graphic--message {
-      text-align: center;
+      &--message {
+        text-align: center;
+      }
     }
 
     &__button-wrap {
diff --git a/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileListItem/ProfileListItem.tsx b/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileListItem/ProfileListItem.tsx
index a7ba5829c469..9fb0039d28ed 100644
--- a/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileListItem/ProfileListItem.tsx
+++ b/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileListItem/ProfileListItem.tsx
@@ -40,7 +40,7 @@ const ProfileDetails = ({
 }: IProfileDetailsProps) => {
   const getPlatformName = () => {
     if (platform === "windows") return "Windows";
-    return isDDM ? "macOS (declaration)" : "macOS, iOS, iPadOS";
+    return isDDM ? "macOS, iOS, iPadOS (declaration)" : "macOS, iOS, iPadOS";
   };
 
   return (
diff --git a/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileUploader/components/AddProfileModal/AddProfileModal.tsx b/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileUploader/components/AddProfileModal/AddProfileModal.tsx
index 88b7e96ed9da..694970c4ca1a 100644
--- a/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileUploader/components/AddProfileModal/AddProfileModal.tsx
+++ b/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileUploader/components/AddProfileModal/AddProfileModal.tsx
@@ -7,7 +7,7 @@ import { NotificationContext } from "context/notification";
 import { IApiError } from "interfaces/errors";
 import { ILabelSummary } from "interfaces/label";
 
-import labelsAPI from "services/entities/labels";
+import labelsAPI, { getCustomLabels } from "services/entities/labels";
 import mdmAPI from "services/entities/mdm";
 
 // @ts-ignore
@@ -77,7 +77,7 @@ interface IFileDetailsProps {
 
 // TODO: if we reuse this one more time, we should consider moving this
 // into FileUploader as a default preview. Currently we have this in
-// AddSoftwareForm.tsx and here.
+// AddPackageForm.tsx and here.
 const FileDetails = ({ details: { name, platform } }: IFileDetailsProps) => (
   <div className={`${baseClass}__selected-file`}>
     <ProfileGraphic baseClass={baseClass} />
@@ -250,10 +250,7 @@ const AddProfileModal = ({
     isError: isErrorLabels,
   } = useQuery<ILabelSummary[], Error>(
     ["custom_labels"],
-    () =>
-      labelsAPI
-        .summary()
-        .then((res) => res.labels.filter((l) => l.label_type !== "builtin")),
+    () => labelsAPI.summary().then((res) => getCustomLabels(res.labels)),
 
     {
       enabled: isPremiumTier,
diff --git a/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileUploader/components/AddProfileModal/_styles.scss b/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileUploader/components/AddProfileModal/_styles.scss
index 261799fe7315..087e2a54d115 100644
--- a/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileUploader/components/AddProfileModal/_styles.scss
+++ b/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileUploader/components/AddProfileModal/_styles.scss
@@ -57,6 +57,10 @@
     flex-direction: column;
     align-items: center;
     gap: $pad-small;
+
+    &--message {
+      text-align: center;
+    }
   }
 
   &__button-wrap {
diff --git a/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileUploader/components/AddProfileModal/helpers.tsx b/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileUploader/components/AddProfileModal/helpers.tsx
index f1ed1acdd7b8..d6d61c562887 100644
--- a/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileUploader/components/AddProfileModal/helpers.tsx
+++ b/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileUploader/components/AddProfileModal/helpers.tsx
@@ -16,7 +16,7 @@ export const CUSTOM_TARGET_OPTIONS: IDropdownOption[] = [
   },
   {
     value: "labelsExcludeAny",
-    label: "Exclude all",
+    label: "Exclude any",
     helpText: (
       <>
         Profile will be applied to hosts that don&apos;t have <b>any</b> of
diff --git a/frontend/pages/ManageControlsPage/OSSettings/cards/DiskEncryption/components/DiskEncryptionTable/_styles.scss b/frontend/pages/ManageControlsPage/OSSettings/cards/DiskEncryption/components/DiskEncryptionTable/_styles.scss
index 4b9fe65d32ac..45790a53892f 100644
--- a/frontend/pages/ManageControlsPage/OSSettings/cards/DiskEncryption/components/DiskEncryptionTable/_styles.scss
+++ b/frontend/pages/ManageControlsPage/OSSettings/cards/DiskEncryption/components/DiskEncryptionTable/_styles.scss
@@ -9,11 +9,29 @@
     border-right: none;
   }
 
-  @media (max-width: $break-md) {
-    .view-hosts-link {
-      span {
-        display: none;
+  .linkToFilteredHosts__header {
+    width: auto;
+    max-width: 120px;
+  }
+
+}
+
+@media (max-width: 1120px) {
+  .view-hosts-link {
+    span {
+      display: none;
+    }
+  }
+  .linkToFilteredHosts {
+    &__header {
+      width: 0;
+      .column-header {
+        width: 0;
       }
     }
+    &__cell {
+      width: min-content;
+    }
+
   }
-}
+}
\ No newline at end of file
diff --git a/frontend/pages/ManageControlsPage/OSUpdates/OSUpdates.tsx b/frontend/pages/ManageControlsPage/OSUpdates/OSUpdates.tsx
index e18a4afca21e..efe6b7fb229a 100644
--- a/frontend/pages/ManageControlsPage/OSUpdates/OSUpdates.tsx
+++ b/frontend/pages/ManageControlsPage/OSUpdates/OSUpdates.tsx
@@ -6,6 +6,7 @@ import { AppContext } from "context/app";
 
 import { IConfig } from "interfaces/config";
 import { ITeamConfig } from "interfaces/team";
+import { ApplePlatform } from "interfaces/platform";
 
 import configAPI from "services/entities/config";
 import teamsAPI, { ILoadTeamResponse } from "services/entities/teams";
@@ -13,16 +14,13 @@ import teamsAPI, { ILoadTeamResponse } from "services/entities/teams";
 import PremiumFeatureMessage from "components/PremiumFeatureMessage";
 import Spinner from "components/Spinner";
 
-import NudgePreview from "./components/NudgePreview";
+import EndUserOSRequirementPreview from "./components/EndUserOSRequirementPreview";
 import TurnOnMdmMessage from "../components/TurnOnMdmMessage/TurnOnMdmMessage";
 import CurrentVersionSection from "./components/CurrentVersionSection";
 import TargetSection from "./components/TargetSection";
+import { parseOSUpdatesCurrentVersionsQueryParams } from "./components/CurrentVersionSection/CurrentVersionSection";
 
-export type OSUpdatesSupportedPlatform =
-  | "darwin"
-  | "windows"
-  | "iOS"
-  | "iPadOS";
+export type OSUpdatesSupportedPlatform = ApplePlatform | "windows";
 
 const baseClass = "os-updates";
 
@@ -42,9 +40,10 @@ const getSelectedPlatform = (
 interface IOSUpdates {
   router: InjectedRouter;
   teamIdForApi: number;
+  queryParams: ReturnType<typeof parseOSUpdatesCurrentVersionsQueryParams>;
 }
 
-const OSUpdates = ({ router, teamIdForApi }: IOSUpdates) => {
+const OSUpdates = ({ router, teamIdForApi, queryParams }: IOSUpdates) => {
   const { isPremiumTier, config, setConfig } = useContext(AppContext);
 
   const [
@@ -113,9 +112,13 @@ const OSUpdates = ({ router, teamIdForApi }: IOSUpdates) => {
       </p>
       <div className={`${baseClass}__content`}>
         <div className={`${baseClass}__current-version-container`}>
-          <CurrentVersionSection currentTeamId={teamIdForApi} />
+          <CurrentVersionSection
+            router={router}
+            currentTeamId={teamIdForApi}
+            queryParams={queryParams}
+          />
         </div>
-        <div className={`${baseClass}__taget-container`}>
+        <div className={`${baseClass}__target-container`}>
           <TargetSection
             key={teamIdForApi} // if the team changes, remount the target section
             appConfig={config}
@@ -129,7 +132,7 @@ const OSUpdates = ({ router, teamIdForApi }: IOSUpdates) => {
           />
         </div>
         <div className={`${baseClass}__nudge-preview`}>
-          <NudgePreview platform={selectedPlatform} />
+          <EndUserOSRequirementPreview platform={selectedPlatform} />
         </div>
       </div>
     </div>
diff --git a/frontend/pages/ManageControlsPage/OSUpdates/components/MacOSTargetForm/MacOSTargetForm.tsx b/frontend/pages/ManageControlsPage/OSUpdates/components/AppleOSTargetForm/AppleOSTargetForm.tsx
similarity index 59%
rename from frontend/pages/ManageControlsPage/OSUpdates/components/MacOSTargetForm/MacOSTargetForm.tsx
rename to frontend/pages/ManageControlsPage/OSUpdates/components/AppleOSTargetForm/AppleOSTargetForm.tsx
index 7fe0e228a89e..8c12c4905388 100644
--- a/frontend/pages/ManageControlsPage/OSUpdates/components/MacOSTargetForm/MacOSTargetForm.tsx
+++ b/frontend/pages/ManageControlsPage/OSUpdates/components/AppleOSTargetForm/AppleOSTargetForm.tsx
@@ -10,15 +10,16 @@ import teamsAPI from "services/entities/teams";
 import InputField from "components/forms/fields/InputField";
 import Button from "components/buttons/Button";
 import validatePresence from "components/forms/validators/validate_presence";
+import { ApplePlatform } from "interfaces/platform";
 
-const baseClass = "mac-os-target-form";
+const baseClass = "apple-os-target-form";
 
-interface IMacOSTargetFormData {
+interface IAppleOSTargetFormData {
   minOsVersion: string;
   deadline: string;
 }
 
-interface IMacOSTargetFormErrors {
+interface IAppleOSTargetFormErrors {
   minOsVersion?: string;
   deadline?: string;
 }
@@ -31,8 +32,16 @@ const validateDeadline = (value: string) => {
   return /^\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$/.test(value);
 };
 
-const validateForm = (formData: IMacOSTargetFormData) => {
-  const errors: IMacOSTargetFormErrors = {};
+const validateForm = (formData: IAppleOSTargetFormData) => {
+  const errors: IAppleOSTargetFormErrors = {};
+
+  // Both fields may be cleared out and saved
+  if (
+    !validatePresence(formData.minOsVersion) &&
+    !validatePresence(formData.deadline)
+  ) {
+    return errors;
+  }
 
   if (!validatePresence(formData.minOsVersion)) {
     errors.minOsVersion = "The minimum version is required.";
@@ -49,22 +58,37 @@ const validateForm = (formData: IMacOSTargetFormData) => {
   return errors;
 };
 
-interface IMacMdmConfigData {
+const APPLE_PLATFORMS_TO_CONFIG_FIELDS = {
+  darwin: "macos_updates",
+  ios: "ios_updates",
+  ipados: "ipados_updates",
+};
+
+interface IAppleUpdatesMdmConfigData {
   mdm: {
-    macos_updates: {
+    macos_updates?: {
+      minimum_version: string;
+      deadline: string;
+    };
+    ipados_updates?: {
+      minimum_version: string;
+      deadline: string;
+    };
+    ios_updates?: {
       minimum_version: string;
       deadline: string;
     };
   };
 }
 
-const createMdmConfigData = (
+const createAppleOSUpdatesData = (
+  applePlatform: ApplePlatform,
   minOsVersion: string,
   deadline: string
-): IMacMdmConfigData => {
+): IAppleUpdatesMdmConfigData => {
   return {
     mdm: {
-      macos_updates: {
+      [APPLE_PLATFORMS_TO_CONFIG_FIELDS[applePlatform]]: {
         minimum_version: minOsVersion,
         deadline,
       },
@@ -72,21 +96,23 @@ const createMdmConfigData = (
   };
 };
 
-interface IMacOSTargetFormProps {
+interface IAppleOSTargetFormProps {
   currentTeamId: number;
+  applePlatform: ApplePlatform;
   defaultMinOsVersion: string;
   defaultDeadline: string;
   refetchAppConfig: () => void;
   refetchTeamConfig: () => void;
 }
 
-const MacOSTargetForm = ({
+const AppleOSTargetForm = ({
   currentTeamId,
+  applePlatform,
   defaultMinOsVersion,
   defaultDeadline,
   refetchAppConfig,
   refetchTeamConfig,
-}: IMacOSTargetFormProps) => {
+}: IAppleOSTargetFormProps) => {
   const { renderFlash } = useContext(NotificationContext);
 
   const [isSaving, setIsSaving] = useState(false);
@@ -111,7 +137,11 @@ const MacOSTargetForm = ({
 
     if (isEmpty(errors)) {
       setIsSaving(true);
-      const updateData = createMdmConfigData(minOsVersion, deadline);
+      const updateData = createAppleOSUpdatesData(
+        applePlatform,
+        minOsVersion,
+        deadline
+      );
       try {
         currentTeamId === APP_CONTEXT_NO_TEAM_ID
           ? await configAPI.update(updateData)
@@ -136,22 +166,58 @@ const MacOSTargetForm = ({
     setDeadline(val);
   };
 
+  const getMinimumVersionPlaceholder = (platform: ApplePlatform) => {
+    switch (platform) {
+      case "darwin":
+        return "13.0.1";
+      case "ios":
+      case "ipados":
+        return "17.5.1";
+      default:
+        return "";
+    }
+  };
+
+  const getMinimumVersionTooltip = (platform: ApplePlatform) => {
+    switch (platform) {
+      case "darwin":
+        return "The end user sees the window until their macOS is at or above this version.";
+      case "ios":
+      case "ipados":
+        return "If the end user's host is below the minimum version, they see a notification in their Notification Center after the deadline. They can’t continue until the OS update is installed.";
+      default:
+        return "";
+    }
+  };
+
+  const getDeadlineTooltip = (platform: ApplePlatform) => {
+    switch (platform) {
+      case "darwin":
+        return "The end user can't dismiss the window once they reach this deadline. Deadline is at 12:00 (Noon) Pacific Standard Time (GMT-8).";
+      case "ios":
+      case "ipados":
+        return "Deadline is at 12:00 (Noon) Pacific Standard Time (GMT-8).";
+      default:
+        return "";
+    }
+  };
+
   return (
     <form className={baseClass} onSubmit={handleSubmit}>
       <InputField
         label="Minimum version"
-        tooltip="The end user sees the window until their macOS is at or above this version."
+        tooltip={getMinimumVersionTooltip(applePlatform)}
         helpText="Version number only (e.g., “13.0.1” not “Ventura 13” or “13.0.1 (22A400)”)"
-        placeholder="13.0.1"
+        placeholder={getMinimumVersionPlaceholder(applePlatform)}
         value={minOsVersion}
         error={minOsVersionError}
         onChange={handleMinVersionChange}
       />
       <InputField
         label="Deadline"
-        tooltip="The end user can’t dismiss the window once they reach this deadline. Deadline is at 12:00 (Noon) Pacific Standard Time (GMT-8)."
-        helpText="YYYY-MM-DD format only (e.g., “2023-06-01”)."
-        placeholder="2023-06-01"
+        tooltip={getDeadlineTooltip(applePlatform)}
+        helpText="YYYY-MM-DD format only (e.g., “2024-07-01”)."
+        placeholder="2024-07-01"
         value={deadline}
         error={deadlineError}
         onChange={handleDeadlineChange}
@@ -163,4 +229,4 @@ const MacOSTargetForm = ({
   );
 };
 
-export default MacOSTargetForm;
+export default AppleOSTargetForm;
diff --git a/frontend/pages/ManageControlsPage/OSUpdates/components/AppleOSTargetForm/index.ts b/frontend/pages/ManageControlsPage/OSUpdates/components/AppleOSTargetForm/index.ts
new file mode 100644
index 000000000000..ed35c4d880e4
--- /dev/null
+++ b/frontend/pages/ManageControlsPage/OSUpdates/components/AppleOSTargetForm/index.ts
@@ -0,0 +1 @@
+export { default } from "./AppleOSTargetForm";
diff --git a/frontend/pages/ManageControlsPage/OSUpdates/components/CurrentVersionSection/CurrentVersionSection.tsx b/frontend/pages/ManageControlsPage/OSUpdates/components/CurrentVersionSection/CurrentVersionSection.tsx
index 98ce7349ab73..a8305675c1a7 100644
--- a/frontend/pages/ManageControlsPage/OSUpdates/components/CurrentVersionSection/CurrentVersionSection.tsx
+++ b/frontend/pages/ManageControlsPage/OSUpdates/components/CurrentVersionSection/CurrentVersionSection.tsx
@@ -1,6 +1,7 @@
 import React from "react";
 import { useQuery } from "react-query";
 import { AxiosError } from "axios";
+import { InjectedRouter } from "react-router";
 
 import { IOperatingSystemVersion } from "interfaces/operating_system";
 import {
@@ -29,18 +30,47 @@ export type IFilteredOperatingSystemVersion = Omit<
 const baseClass = "os-updates-current-version-section";
 
 interface ICurrentVersionSectionProps {
+  router: InjectedRouter;
   currentTeamId: number;
+  queryParams: ReturnType<typeof parseOSUpdatesCurrentVersionsQueryParams>;
 }
 
+const DEFAULT_SORT_DIRECTION = "desc";
+const DEFAULT_SORT_HEADER = "hosts_count";
+const DEFAULT_PAGE = 0;
+const DEFAULT_PAGE_SIZE = 8;
+
+export const parseOSUpdatesCurrentVersionsQueryParams = (queryParams: {
+  page?: string;
+  order_key?: string;
+  order_direction?: "asc" | "desc";
+}) => {
+  const sortHeader = queryParams?.order_key ?? DEFAULT_SORT_HEADER;
+  const sortDirection = queryParams?.order_direction ?? DEFAULT_SORT_DIRECTION;
+  const page = queryParams?.page
+    ? parseInt(queryParams.page, 10)
+    : DEFAULT_PAGE;
+  const pageSize = DEFAULT_PAGE_SIZE;
+
+  return {
+    page,
+    order_key: sortHeader,
+    order_direction: sortDirection,
+    per_page: pageSize,
+  };
+};
+
 const CurrentVersionSection = ({
+  router,
   currentTeamId,
+  queryParams,
 }: ICurrentVersionSectionProps) => {
   const { data, isError, isLoading: isLoadingOsVersions } = useQuery<
     IOSVersionsResponse,
     AxiosError
   >(
-    ["os_versions", currentTeamId],
-    () => getOSVersions({ teamId: currentTeamId }),
+    ["os_versions", currentTeamId, queryParams],
+    () => getOSVersions({ teamId: currentTeamId, ...queryParams }),
     {
       retry: false,
       refetchOnWindowFocus: false,
@@ -91,9 +121,12 @@ const CurrentVersionSection = ({
 
     return (
       <OSVersionTable
+        router={router}
         osVersionData={filteredOSVersionData}
         currentTeamId={currentTeamId}
         isLoading={isLoadingOsVersions}
+        queryParams={queryParams}
+        hasNextPage={data.meta.has_next_results}
       />
     );
   };
diff --git a/frontend/pages/ManageControlsPage/OSUpdates/components/EmptyTargetForm/EmptyTargetForm.tsx b/frontend/pages/ManageControlsPage/OSUpdates/components/EmptyTargetForm/EmptyTargetForm.tsx
deleted file mode 100644
index 80d24adc39a3..000000000000
--- a/frontend/pages/ManageControlsPage/OSUpdates/components/EmptyTargetForm/EmptyTargetForm.tsx
+++ /dev/null
@@ -1,29 +0,0 @@
-import React from "react";
-
-import CustomLink from "components/CustomLink";
-
-const baseClass = "empty-target-form";
-
-interface IEmptyTargetFormProps {
-  targetPlatform: string;
-}
-
-const EmptyTargetForm = ({ targetPlatform }: IEmptyTargetFormProps) => {
-  return (
-    <div className={baseClass}>
-      <p>
-        <b>{targetPlatform} updates are coming soon.</b>
-      </p>
-      <p>
-        Need to remotely encourage installation of {targetPlatform} updates?{" "}
-        <CustomLink
-          url="https://www.fleetdm.com/support"
-          text="Let us know"
-          newTab
-        />
-      </p>
-    </div>
-  );
-};
-
-export default EmptyTargetForm;
diff --git a/frontend/pages/ManageControlsPage/OSUpdates/components/EmptyTargetForm/index.ts b/frontend/pages/ManageControlsPage/OSUpdates/components/EmptyTargetForm/index.ts
deleted file mode 100644
index 284c5dbd3a0a..000000000000
--- a/frontend/pages/ManageControlsPage/OSUpdates/components/EmptyTargetForm/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./EmptyTargetForm";
diff --git a/frontend/pages/ManageControlsPage/OSUpdates/components/EndUserOSRequirementPreview/EndUserOSRequirementPreview.tsx b/frontend/pages/ManageControlsPage/OSUpdates/components/EndUserOSRequirementPreview/EndUserOSRequirementPreview.tsx
new file mode 100644
index 000000000000..67eb19591d2d
--- /dev/null
+++ b/frontend/pages/ManageControlsPage/OSUpdates/components/EndUserOSRequirementPreview/EndUserOSRequirementPreview.tsx
@@ -0,0 +1,112 @@
+import React from "react";
+
+import CustomLink from "components/CustomLink";
+
+import { OSUpdatesSupportedPlatform } from "../../OSUpdates";
+
+import MacOSUpdateScreenshot from "../../../../../../assets/images/macos-updates-preview.png";
+import WindowsUpdateScreenshot from "../../../../../../assets/images/windows-nudge-screenshot.png";
+import IOSUpdateScreenshot from "../../../../../../assets/images/ios-updates-preview.png";
+import IPadOSUpdateScreenshot from "../../../../../../assets/images/ipados-updates-preview.png";
+
+const baseClass = "os-requirement-preview";
+
+interface IEndUserOSRequirementPreviewProps {
+  platform: OSUpdatesSupportedPlatform;
+}
+const OSRequirementDescription = ({
+  platform,
+}: IEndUserOSRequirementPreviewProps) => {
+  switch (platform) {
+    case "darwin":
+      return (
+        <>
+          <h3>End user experience on macOS</h3>
+          <p>
+            For macOS 14 and above, end users will see native macOS
+            notifications (DDM).
+          </p>
+          <p>Everyone else will see the Nudge window.</p>
+          <CustomLink
+            text="Learn more"
+            url="https://fleetdm.com/learn-more-about/os-updates"
+            newTab
+          />
+        </>
+      );
+    case "windows":
+      return (
+        <>
+          <h3>End user experience on Windows</h3>
+          <p>
+            When a Windows host becomes aware of a new update, end users are
+            able to defer restarts. Automatic restarts happen before 8am and
+            after 5pm (end user&apos;s local time). After the deadline, restarts
+            are forced regardless of active hours.
+          </p>
+          <CustomLink
+            text="Learn more about Windows updates in Fleet"
+            url="https://fleetdm.com/learn-more-about/os-updates"
+            newTab
+          />
+        </>
+      );
+    case "ios":
+      return (
+        <>
+          <h3>End user experience on iOS</h3>
+        </>
+      );
+    case "ipados":
+      return (
+        <>
+          <h3>End user experience on iPadOS</h3>
+        </>
+      );
+    default:
+      return <></>;
+  }
+};
+
+const OSRequirementImage = ({
+  platform,
+}: IEndUserOSRequirementPreviewProps) => {
+  const getScreenshot = () => {
+    switch (platform) {
+      case "darwin":
+        return MacOSUpdateScreenshot;
+      case "windows":
+        return WindowsUpdateScreenshot;
+      case "ios":
+        return IOSUpdateScreenshot;
+      case "ipados":
+        return IPadOSUpdateScreenshot;
+      default:
+        MacOSUpdateScreenshot;
+    }
+  };
+
+  return (
+    <img
+      className={`${baseClass}__preview-img`}
+      src={getScreenshot()}
+      alt="OS update preview screenshot"
+    />
+  );
+};
+
+const EndUserOSRequirementPreview = ({
+  platform,
+}: IEndUserOSRequirementPreviewProps) => {
+  // FIXME: on slow connection the image loads after the text which looks weird and can cause a
+  // mismatch between the text and the image when switching between platforms. We should load the
+  // image first and then the text.
+  return (
+    <div className={baseClass}>
+      <OSRequirementDescription platform={platform} />
+      <OSRequirementImage platform={platform} />
+    </div>
+  );
+};
+
+export default EndUserOSRequirementPreview;
diff --git a/frontend/pages/ManageControlsPage/OSUpdates/components/NudgePreview/_styles.scss b/frontend/pages/ManageControlsPage/OSUpdates/components/EndUserOSRequirementPreview/_styles.scss
similarity index 93%
rename from frontend/pages/ManageControlsPage/OSUpdates/components/NudgePreview/_styles.scss
rename to frontend/pages/ManageControlsPage/OSUpdates/components/EndUserOSRequirementPreview/_styles.scss
index ed6294722c3b..a9f2aaf03cb8 100644
--- a/frontend/pages/ManageControlsPage/OSUpdates/components/NudgePreview/_styles.scss
+++ b/frontend/pages/ManageControlsPage/OSUpdates/components/EndUserOSRequirementPreview/_styles.scss
@@ -1,4 +1,4 @@
-.nudge-preview {
+.os-requirement-preview {
   box-sizing: border-box;
   background-color: $ui-off-white;
   border-radius: $border-radius;
diff --git a/frontend/pages/ManageControlsPage/OSUpdates/components/EndUserOSRequirementPreview/index.ts b/frontend/pages/ManageControlsPage/OSUpdates/components/EndUserOSRequirementPreview/index.ts
new file mode 100644
index 000000000000..e727b5e79c17
--- /dev/null
+++ b/frontend/pages/ManageControlsPage/OSUpdates/components/EndUserOSRequirementPreview/index.ts
@@ -0,0 +1 @@
+export { default } from "./EndUserOSRequirementPreview";
diff --git a/frontend/pages/ManageControlsPage/OSUpdates/components/MacOSTargetForm/index.ts b/frontend/pages/ManageControlsPage/OSUpdates/components/MacOSTargetForm/index.ts
deleted file mode 100644
index 7afd2afdb4e4..000000000000
--- a/frontend/pages/ManageControlsPage/OSUpdates/components/MacOSTargetForm/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./MacOSTargetForm";
diff --git a/frontend/pages/ManageControlsPage/OSUpdates/components/NudgePreview/NudgePreview.tsx b/frontend/pages/ManageControlsPage/OSUpdates/components/NudgePreview/NudgePreview.tsx
deleted file mode 100644
index 9f75ee13bb90..000000000000
--- a/frontend/pages/ManageControlsPage/OSUpdates/components/NudgePreview/NudgePreview.tsx
+++ /dev/null
@@ -1,84 +0,0 @@
-import React from "react";
-
-import CustomLink from "components/CustomLink";
-
-import { OSUpdatesSupportedPlatform } from "../../OSUpdates";
-
-import MacOSUpdateScreenshot from "../../../../../../assets/images/macos-updates-preview.png";
-import WindowsUpdateScreenshot from "../../../../../../assets/images/windows-nudge-screenshot.png";
-
-const baseClass = "nudge-preview";
-
-interface INudgeDescriptionProps {
-  platform: OSUpdatesSupportedPlatform;
-}
-const NudgeDescription = ({ platform }: INudgeDescriptionProps) => {
-  return platform === "darwin" ? (
-    <>
-      <h3>End user experience on macOS</h3>
-      <p>
-        For macOS 14 and above, end users will see native macOS notifications
-        (DDM).
-      </p>
-      <p>Everyone else will see the Nudge window.</p>
-      <CustomLink
-        text="Learn more"
-        url="https://fleetdm.com/learn-more-about/os-updates"
-        newTab
-      />
-    </>
-  ) : (
-    <>
-      <h3>End user experience on Windows</h3>
-      <p>
-        When a Windows host becomes aware of a new update, end users are able to
-        defer restarts. Automatic restarts happen before 8am and after 5pm (end
-        user&apos;s local time). After the deadline, restarts are forced
-        regardless of active hours.
-      </p>
-      <CustomLink
-        text="Learn more about Windows updates in Fleet"
-        url="https://fleetdm.com/learn-more-about/os-updates"
-        newTab
-      />
-    </>
-  );
-};
-
-type INudgeImageProps = INudgeDescriptionProps;
-
-const NudgeImage = ({ platform }: INudgeImageProps) => {
-  return (
-    <img
-      className={`${baseClass}__preview-img`}
-      src={
-        platform === "darwin" ? MacOSUpdateScreenshot : WindowsUpdateScreenshot
-      }
-      alt="OS update preview screenshot"
-    />
-  );
-};
-
-interface INudgePreviewProps {
-  platform: OSUpdatesSupportedPlatform;
-}
-
-const NudgePreview = ({ platform }: INudgePreviewProps) => {
-  const isSupportedPlatform = platform === "windows" || platform === "darwin";
-
-  if (!isSupportedPlatform) {
-    return null;
-  }
-
-  // FIXME: on slow connection the image loads after the text which looks weird and can cause a
-  // mismatch between the text and the image when switching between platforms. We should load the
-  // image first and then the text.
-  return (
-    <div className={baseClass}>
-      <NudgeDescription platform={platform} />
-      <NudgeImage platform={platform} />
-    </div>
-  );
-};
-
-export default NudgePreview;
diff --git a/frontend/pages/ManageControlsPage/OSUpdates/components/NudgePreview/index.ts b/frontend/pages/ManageControlsPage/OSUpdates/components/NudgePreview/index.ts
deleted file mode 100644
index 53f2dd506eb8..000000000000
--- a/frontend/pages/ManageControlsPage/OSUpdates/components/NudgePreview/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./NudgePreview";
diff --git a/frontend/pages/ManageControlsPage/OSUpdates/components/OSVersionTable/OSVersionTable.tsx b/frontend/pages/ManageControlsPage/OSUpdates/components/OSVersionTable/OSVersionTable.tsx
index 372430e0c036..8de50359f3cb 100644
--- a/frontend/pages/ManageControlsPage/OSUpdates/components/OSVersionTable/OSVersionTable.tsx
+++ b/frontend/pages/ManageControlsPage/OSUpdates/components/OSVersionTable/OSVersionTable.tsx
@@ -1,30 +1,94 @@
-import React from "react";
+import React, { useCallback } from "react";
+import { InjectedRouter } from "react-router";
 
+import PATHS from "router/paths";
 import { IOperatingSystemVersion } from "interfaces/operating_system";
+import { getNextLocationPath } from "utilities/helpers";
 
+import { ITableQueryData } from "components/TableContainer/TableContainer";
 import TableContainer from "components/TableContainer";
 
 import { generateTableHeaders } from "./OSVersionTableConfig";
 import OSVersionsEmptyState from "../OSVersionsEmptyState";
+import { parseOSUpdatesCurrentVersionsQueryParams } from "../CurrentVersionSection/CurrentVersionSection";
 
 const baseClass = "os-version-table";
 
 interface IOSVersionTableProps {
+  router: InjectedRouter;
   osVersionData: IOperatingSystemVersion[];
   currentTeamId: number;
   isLoading: boolean;
+  queryParams: ReturnType<typeof parseOSUpdatesCurrentVersionsQueryParams>;
+  hasNextPage: boolean;
 }
 
-const DEFAULT_SORT_HEADER = "hosts_count";
-const DEFAULT_SORT_DIRECTION = "desc";
-
 const OSVersionTable = ({
+  router,
   osVersionData,
   currentTeamId,
   isLoading,
+  queryParams,
+  hasNextPage,
 }: IOSVersionTableProps) => {
   const columns = generateTableHeaders(currentTeamId);
 
+  const determineQueryParamChange = useCallback(
+    (newTableQuery: ITableQueryData) => {
+      const changedEntry = Object.entries(newTableQuery).find(([key, val]) => {
+        switch (key) {
+          case "sortDirection":
+            return val !== queryParams.order_direction;
+          case "sortHeader":
+            return val !== queryParams.order_key;
+          case "pageIndex":
+            return val !== queryParams.page;
+          default:
+            return false;
+        }
+      });
+      return changedEntry?.[0] ?? "";
+    },
+    [queryParams.order_direction, queryParams.order_key, queryParams.page]
+  );
+
+  const generateNewQueryParams = useCallback(
+    (newTableQuery: ITableQueryData, changedParam: string) => {
+      const newQueryParam: Record<string, string | number | undefined> = {
+        team_id: currentTeamId,
+        order_direction: newTableQuery.sortDirection,
+        order_key: newTableQuery.sortHeader,
+        page: changedParam === "pageIndex" ? newTableQuery.pageIndex : 0,
+      };
+
+      return newQueryParam;
+    },
+    [currentTeamId]
+  );
+  // NOTE: this is called once on initial render and every time the query changes
+  const onQueryChange = useCallback(
+    (newTableQuery: ITableQueryData) => {
+      // we want to determine which query param has changed in order to
+      // reset the page index to 0 if any other param has changed.
+      const changedParam = determineQueryParamChange(newTableQuery);
+
+      // if nothing has changed, don't update the route. this can happen when
+      // this handler is called on the inital render. Can also happen when
+      // the filter dropdown is changed. That is handled on the onChange handler
+      // for the dropdown.
+      if (changedParam === "") return;
+
+      const newRoute = getNextLocationPath({
+        pathPrefix: PATHS.CONTROLS_OS_UPDATES,
+        routeTemplate: "",
+        queryParams: generateNewQueryParams(newTableQuery, changedParam),
+      });
+
+      router.replace(newRoute);
+    },
+    [determineQueryParamChange, generateNewQueryParams, router]
+  );
+
   return (
     <div className={baseClass}>
       <TableContainer
@@ -35,12 +99,14 @@ const OSVersionTable = ({
         emptyComponent={OSVersionsEmptyState}
         showMarkAllPages={false}
         isAllPagesSelected={false}
-        defaultSortHeader={DEFAULT_SORT_HEADER}
-        defaultSortDirection={DEFAULT_SORT_DIRECTION}
+        defaultSortHeader={queryParams.order_key}
+        defaultSortDirection={queryParams.order_direction}
+        defaultPageIndex={queryParams.page}
         disableTableHeader
         disableCount
-        pageSize={8}
-        isClientSidePagination
+        pageSize={queryParams.per_page}
+        onQueryChange={onQueryChange}
+        disableNextPage={!hasNextPage}
       />
     </div>
   );
diff --git a/frontend/pages/ManageControlsPage/OSUpdates/components/PlatformTabs/PlatformTabs.tsx b/frontend/pages/ManageControlsPage/OSUpdates/components/PlatformTabs/PlatformTabs.tsx
index 3befce43aab7..df5be12011e7 100644
--- a/frontend/pages/ManageControlsPage/OSUpdates/components/PlatformTabs/PlatformTabs.tsx
+++ b/frontend/pages/ManageControlsPage/OSUpdates/components/PlatformTabs/PlatformTabs.tsx
@@ -2,10 +2,9 @@ import React from "react";
 import { Tab, TabList, TabPanel, Tabs } from "react-tabs";
 import TabsWrapper from "components/TabsWrapper";
 
-import MacOSTargetForm from "../MacOSTargetForm";
 import WindowsTargetForm from "../WindowsTargetForm";
 import { OSUpdatesSupportedPlatform } from "../../OSUpdates";
-import EmptyTargetForm from "../EmptyTargetForm";
+import AppleOSTargetForm from "../AppleOSTargetForm";
 
 const baseClass = "platform-tabs";
 
@@ -13,34 +12,41 @@ interface IPlatformTabsProps {
   currentTeamId: number;
   defaultMacOSVersion: string;
   defaultMacOSDeadline: string;
+  defaultIOSVersion: string;
+  defaultIOSDeadline: string;
+  defaultIPadOSVersion: string;
+  defaultIPadOSDeadline: string;
   defaultWindowsDeadlineDays: string;
   defaultWindowsGracePeriodDays: string;
   selectedPlatform: OSUpdatesSupportedPlatform;
   onSelectPlatform: (platform: OSUpdatesSupportedPlatform) => void;
   refetchAppConfig: () => void;
   refetchTeamConfig: () => void;
+  isWindowsMdmEnabled: boolean;
 }
 
 const PlatformTabs = ({
   currentTeamId,
   defaultMacOSDeadline,
   defaultMacOSVersion,
+  defaultIOSDeadline,
+  defaultIOSVersion,
+  defaultIPadOSDeadline,
+  defaultIPadOSVersion,
   defaultWindowsDeadlineDays,
   defaultWindowsGracePeriodDays,
   selectedPlatform,
   onSelectPlatform,
   refetchAppConfig,
   refetchTeamConfig,
+  isWindowsMdmEnabled,
 }: IPlatformTabsProps) => {
   // FIXME: This behaves unexpectedly when a user switches tabs or changes the teams dropdown while a form is
   // submitting.
 
-  const PLATFORM_BY_INDEX: OSUpdatesSupportedPlatform[] = [
-    "darwin",
-    "windows",
-    "iOS",
-    "iPadOS",
-  ];
+  const PLATFORM_BY_INDEX: OSUpdatesSupportedPlatform[] = isWindowsMdmEnabled
+    ? ["darwin", "windows", "ios", "ipados"]
+    : ["darwin", "ios", "ipados"];
 
   const onTabChange = (index: number) => {
     onSelectPlatform(PLATFORM_BY_INDEX[index]);
@@ -59,9 +65,11 @@ const PlatformTabs = ({
             <Tab key="macOS" data-text="macOS">
               macOS
             </Tab>
-            <Tab key="Windows" data-text="Windows">
-              Windows
-            </Tab>
+            {isWindowsMdmEnabled && (
+              <Tab key="Windows" data-text="Windows">
+                Windows
+              </Tab>
+            )}
             <Tab key="iOS" data-text="iOS">
               iOS
             </Tab>
@@ -70,8 +78,9 @@ const PlatformTabs = ({
             </Tab>
           </TabList>
           <TabPanel>
-            <MacOSTargetForm
+            <AppleOSTargetForm
               currentTeamId={currentTeamId}
+              applePlatform="darwin"
               defaultMinOsVersion={defaultMacOSVersion}
               defaultDeadline={defaultMacOSDeadline}
               key={currentTeamId}
@@ -79,21 +88,39 @@ const PlatformTabs = ({
               refetchTeamConfig={refetchTeamConfig}
             />
           </TabPanel>
+          {isWindowsMdmEnabled && (
+            <TabPanel>
+              <WindowsTargetForm
+                currentTeamId={currentTeamId}
+                defaultDeadlineDays={defaultWindowsDeadlineDays}
+                defaultGracePeriodDays={defaultWindowsGracePeriodDays}
+                key={currentTeamId}
+                refetchAppConfig={refetchAppConfig}
+                refetchTeamConfig={refetchTeamConfig}
+              />
+            </TabPanel>
+          )}
           <TabPanel>
-            <WindowsTargetForm
+            <AppleOSTargetForm
               currentTeamId={currentTeamId}
-              defaultDeadlineDays={defaultWindowsDeadlineDays}
-              defaultGracePeriodDays={defaultWindowsGracePeriodDays}
+              applePlatform="ios"
+              defaultMinOsVersion={defaultIOSVersion}
+              defaultDeadline={defaultIOSDeadline}
               key={currentTeamId}
               refetchAppConfig={refetchAppConfig}
               refetchTeamConfig={refetchTeamConfig}
             />
           </TabPanel>
           <TabPanel>
-            <EmptyTargetForm targetPlatform="iOS" />
-          </TabPanel>
-          <TabPanel>
-            <EmptyTargetForm targetPlatform="iPadOS" />
+            <AppleOSTargetForm
+              currentTeamId={currentTeamId}
+              applePlatform="ipados"
+              defaultMinOsVersion={defaultIPadOSVersion}
+              defaultDeadline={defaultIPadOSDeadline}
+              key={currentTeamId}
+              refetchAppConfig={refetchAppConfig}
+              refetchTeamConfig={refetchTeamConfig}
+            />
           </TabPanel>
         </Tabs>
       </TabsWrapper>
diff --git a/frontend/pages/ManageControlsPage/OSUpdates/components/TargetSection/TargetSection.tsx b/frontend/pages/ManageControlsPage/OSUpdates/components/TargetSection/TargetSection.tsx
index e9af3e926e59..0bc2f80c91d9 100644
--- a/frontend/pages/ManageControlsPage/OSUpdates/components/TargetSection/TargetSection.tsx
+++ b/frontend/pages/ManageControlsPage/OSUpdates/components/TargetSection/TargetSection.tsx
@@ -2,11 +2,11 @@ import React from "react";
 
 import { API_NO_TEAM_ID, ITeamConfig } from "interfaces/team";
 import { IConfig } from "interfaces/config";
+import { ApplePlatform } from "interfaces/platform";
 
 import SectionHeader from "components/SectionHeader";
 import Spinner from "components/Spinner";
 
-import MacOSTargetForm from "../MacOSTargetForm";
 import WindowsTargetForm from "../WindowsTargetForm";
 import PlatformTabs from "../PlatformTabs";
 import { OSUpdatesSupportedPlatform } from "../../OSUpdates";
@@ -14,29 +14,52 @@ import { OSUpdatesSupportedPlatform } from "../../OSUpdates";
 const baseClass = "os-updates-target-section";
 
 type GetDefaultFnParams = {
+  osType?: ApplePlatform;
   currentTeamId: number;
   appConfig: IConfig;
   teamConfig?: ITeamConfig;
 };
 
-const getDefaultMacOSVersion = ({
+const getDefaultOSVersion = ({
+  osType,
   currentTeamId,
   appConfig,
   teamConfig,
 }: GetDefaultFnParams) => {
-  return currentTeamId === API_NO_TEAM_ID
-    ? appConfig?.mdm.macos_updates.minimum_version ?? ""
-    : teamConfig?.mdm?.macos_updates.minimum_version ?? "";
+  const mdmData =
+    currentTeamId === API_NO_TEAM_ID ? appConfig?.mdm : teamConfig?.mdm;
+
+  switch (osType) {
+    case "darwin":
+      return mdmData?.macos_updates.minimum_version ?? "";
+    case "ios":
+      return mdmData?.ios_updates.minimum_version ?? "";
+    case "ipados":
+      return mdmData?.ipados_updates.minimum_version ?? "";
+    default:
+      return "";
+  }
 };
 
-const getDefaultMacOSDeadline = ({
+const getDefaultDeadline = ({
+  osType,
   currentTeamId,
   appConfig,
   teamConfig,
 }: GetDefaultFnParams) => {
-  return currentTeamId === API_NO_TEAM_ID
-    ? appConfig?.mdm.macos_updates.deadline || ""
-    : teamConfig?.mdm?.macos_updates.deadline || "";
+  const mdmData =
+    currentTeamId === API_NO_TEAM_ID ? appConfig?.mdm : teamConfig?.mdm;
+
+  switch (osType) {
+    case "darwin":
+      return mdmData?.macos_updates.deadline ?? "";
+    case "ios":
+      return mdmData?.ios_updates.deadline ?? "";
+    case "ipados":
+      return mdmData?.ipados_updates.deadline ?? "";
+    default:
+      return "";
+  }
 };
 
 const getDefaultWindowsDeadlineDays = ({
@@ -84,19 +107,48 @@ const TargetSection = ({
     return <Spinner />;
   }
 
-  const isMacMdmEnabled = appConfig.mdm.enabled_and_configured;
+  const isAppleMdmEnabled = appConfig.mdm.enabled_and_configured;
+
   const isWindowsMdmEnabled = appConfig.mdm.windows_enabled_and_configured;
 
-  const defaultMacOSVersion = getDefaultMacOSVersion({
+  const defaultMacOSVersion = getDefaultOSVersion({
+    osType: "darwin",
     currentTeamId,
     appConfig,
     teamConfig,
   });
-  const defaultMacOSDeadline = getDefaultMacOSDeadline({
+  const defaultMacOSDeadline = getDefaultDeadline({
+    osType: "darwin",
     currentTeamId,
     appConfig,
     teamConfig,
   });
+  const defaultIOSVersion = getDefaultOSVersion({
+    osType: "ios",
+    currentTeamId,
+    appConfig,
+    teamConfig,
+  });
+
+  const defaultIOSDeadline = getDefaultDeadline({
+    osType: "ios",
+    currentTeamId,
+    appConfig,
+    teamConfig,
+  });
+  const defaultIPadOSOSVersion = getDefaultOSVersion({
+    osType: "ipados",
+    currentTeamId,
+    appConfig,
+    teamConfig,
+  });
+  const defaultIPadOSDeadline = getDefaultDeadline({
+    osType: "ipados",
+    currentTeamId,
+    appConfig,
+    teamConfig,
+  });
+
   const defaultWindowsDeadlineDays = getDefaultWindowsDeadlineDays({
     currentTeamId,
     appConfig,
@@ -109,28 +161,23 @@ const TargetSection = ({
   });
 
   const renderTargetForms = () => {
-    if (isMacMdmEnabled && isWindowsMdmEnabled) {
+    if (isAppleMdmEnabled) {
       return (
         <PlatformTabs
           currentTeamId={currentTeamId}
           defaultMacOSVersion={defaultMacOSVersion}
           defaultMacOSDeadline={defaultMacOSDeadline}
+          defaultIOSVersion={defaultIOSVersion}
+          defaultIOSDeadline={defaultIOSDeadline}
+          defaultIPadOSVersion={defaultIPadOSOSVersion}
+          defaultIPadOSDeadline={defaultIPadOSDeadline}
           defaultWindowsDeadlineDays={defaultWindowsDeadlineDays}
           defaultWindowsGracePeriodDays={defaultWindowsGracePeriodDays}
           selectedPlatform={selectedPlatform}
           onSelectPlatform={onSelectPlatform}
           refetchAppConfig={refetchAppConfig}
           refetchTeamConfig={refetchTeamConfig}
-        />
-      );
-    } else if (isMacMdmEnabled) {
-      return (
-        <MacOSTargetForm
-          currentTeamId={currentTeamId}
-          defaultMinOsVersion={defaultMacOSVersion}
-          defaultDeadline={defaultMacOSDeadline}
-          refetchAppConfig={refetchAppConfig}
-          refetchTeamConfig={refetchTeamConfig}
+          isWindowsMdmEnabled={isWindowsMdmEnabled}
         />
       );
     }
diff --git a/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/EndUserAuthentication.tsx b/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/EndUserAuthentication.tsx
index 30602d704930..6f114df0a676 100644
--- a/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/EndUserAuthentication.tsx
+++ b/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/EndUserAuthentication.tsx
@@ -79,7 +79,7 @@ const EndUserAuthentication = ({
   );
 
   const onClickConnect = () => {
-    router.push(PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT);
+    router.push(PATHS.ADMIN_INTEGRATIONS_MDM);
   };
 
   return (
diff --git a/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/components/EndUserAuthForm/EndUserAuthForm.tsx b/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/components/EndUserAuthForm/EndUserAuthForm.tsx
index 1b8a5056578e..924992b54ccd 100644
--- a/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/components/EndUserAuthForm/EndUserAuthForm.tsx
+++ b/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/components/EndUserAuthForm/EndUserAuthForm.tsx
@@ -55,9 +55,7 @@ const EndUserAuthForm = ({
           Require end users to authenticate with your identity provider (IdP)
           and agree to an end user license agreement (EULA) when they setup
           their new macOS hosts.{" "}
-          <Link to={PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT}>
-            View IdP and EULA
-          </Link>
+          <Link to={PATHS.ADMIN_INTEGRATIONS_MDM}>View IdP and EULA</Link>
         </p>
         <Button isLoading={isUpdating} onClick={onClickSave}>
           Save
diff --git a/frontend/pages/ManageControlsPage/components/EndUserExperiencePreview/EndUserExperiencePreview.tsx b/frontend/pages/ManageControlsPage/components/EndUserExperiencePreview/EndUserExperiencePreview.tsx
index 81fe5808e854..9c0140a4d50e 100644
--- a/frontend/pages/ManageControlsPage/components/EndUserExperiencePreview/EndUserExperiencePreview.tsx
+++ b/frontend/pages/ManageControlsPage/components/EndUserExperiencePreview/EndUserExperiencePreview.tsx
@@ -3,7 +3,7 @@ import React from "react";
 
 const baseClass = "end-user-experience-preview";
 
-interface IEndUserExperiencePerviewProps {
+interface IEndUserExperiencePreviewProps {
   previewImage: string;
   altText?: string;
   children?: React.ReactNode;
@@ -15,7 +15,7 @@ const EndUserExperiencePerview = ({
   altText = "end user experience preview",
   children,
   className,
-}: IEndUserExperiencePerviewProps) => {
+}: IEndUserExperiencePreviewProps) => {
   const classes = classnames(baseClass, className);
 
   return (
diff --git a/frontend/pages/NoAccessPage/NoAccessPage.tsx b/frontend/pages/NoAccessPage/NoAccessPage.tsx
index 017ea3f8b473..1c7a83dd9906 100644
--- a/frontend/pages/NoAccessPage/NoAccessPage.tsx
+++ b/frontend/pages/NoAccessPage/NoAccessPage.tsx
@@ -4,6 +4,8 @@ import React, { useEffect } from "react";
 import { InjectedRouter } from "react-router";
 import PATHS from "router/paths";
 
+import { CONTACT_FLEET_LINK } from "utilities/constants";
+
 import Button from "components/buttons/Button/Button";
 // @ts-ignore
 import StackedWhiteBoxes from "components/StackedWhiteBoxes";
@@ -48,7 +50,7 @@ const NoAccessPage = ({ router, orgContactUrl }: INoAccessPageProps) => {
           <p>
             To get access,{" "}
             <CustomLink
-              url={orgContactUrl || "https://fleetdm.com/contact"}
+              url={orgContactUrl || CONTACT_FLEET_LINK}
               text="contact your administrator"
             />
             .
diff --git a/frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tests.tsx b/frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tests.tsx
new file mode 100644
index 000000000000..21a59614b279
--- /dev/null
+++ b/frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tests.tsx
@@ -0,0 +1,70 @@
+import React from "react";
+import { render, screen } from "@testing-library/react";
+
+import { createMockOSVersionsResponse } from "__mocks__/softwareMock";
+
+import SoftwareOSTable from "./SoftwareOSTable";
+
+// TODO: figure out how to mock the router properly.
+const mockRouter = {
+  push: jest.fn(),
+  replace: jest.fn(),
+  goBack: jest.fn(),
+  goForward: jest.fn(),
+  go: jest.fn(),
+  setRouteLeaveHook: jest.fn(),
+  isActive: jest.fn(),
+  createHref: jest.fn(),
+  createPath: jest.fn(),
+};
+
+describe("Software operating systems table", () => {
+  it("Renders the page-wide disabled state when software inventory is disabled", async () => {
+    render(
+      <SoftwareOSTable
+        router={mockRouter}
+        isSoftwareEnabled={false} // Set to false
+        data={createMockOSVersionsResponse({
+          count: 0,
+          os_versions: [],
+        })}
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        currentPage={0}
+        teamId={1}
+        isLoading={false}
+        resetPageIndex={false}
+      />
+    );
+
+    expect(screen.getByText("Software inventory disabled")).toBeInTheDocument();
+  });
+
+  it("Renders the page-wide empty state when no software is present", () => {
+    render(
+      <SoftwareOSTable
+        router={mockRouter}
+        isSoftwareEnabled
+        data={createMockOSVersionsResponse({
+          count: 0,
+          os_versions: [],
+        })}
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        currentPage={0}
+        teamId={1}
+        isLoading={false}
+        resetPageIndex={false}
+      />
+    );
+
+    expect(
+      screen.getByText("No operating systems detected")
+    ).toBeInTheDocument();
+    expect(screen.getByText("0 items")).toBeInTheDocument();
+    expect(screen.queryByText("Search")).toBeNull();
+    expect(screen.queryByText("Updated")).toBeNull();
+  });
+});
diff --git a/frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tsx b/frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tsx
index f76a6deca640..9be6ee4d1626 100644
--- a/frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tsx
@@ -17,7 +17,7 @@ import TableCount from "components/TableContainer/TableCount";
 import EmptySoftwareTable from "pages/SoftwarePage/components/EmptySoftwareTable";
 import { IOSVersionsResponse } from "services/entities/operating_systems";
 
-import generateTableConfig from "pages/DashboardPage/cards/OperatingSystems/OperatingSystemsTableConfig";
+import generateTableConfig from "pages/DashboardPage/cards/OperatingSystems/OSTableConfig";
 import { buildQueryStringFromParams } from "utilities/url";
 import { getNextLocationPath } from "utilities/helpers";
 
@@ -129,7 +129,7 @@ const SoftwareOSTable = ({
   };
 
   const renderSoftwareCount = () => {
-    if (!data?.os_versions || !data?.count) return null;
+    if (!data) return null;
 
     return (
       <>
@@ -150,7 +150,7 @@ const SoftwareOSTable = ({
     );
   };
 
-  const renderTableFooter = () => {
+  const renderTableHelpText = () => {
     return (
       <div>
         Seeing unexpected software or vulnerabilities?{" "}
@@ -174,7 +174,7 @@ const SoftwareOSTable = ({
           <EmptySoftwareTable
             tableName="operating systems"
             isSoftwareDisabled={!isSoftwareEnabled}
-            isNotDetectingSoftware // non-searchable table renders not detecting by default
+            noSearchQuery // non-searchable table renders not detecting by default
           />
         )}
         defaultSortHeader={orderKey}
@@ -189,7 +189,7 @@ const SoftwareOSTable = ({
         onQueryChange={onQueryChange}
         stackControls
         renderCount={renderSoftwareCount}
-        renderFooter={renderTableFooter}
+        renderTableHelpText={renderTableHelpText}
         disableMultiRowSelect
         onSelectSingleRow={handleRowSelect}
         resetPageIndex={resetPageIndex}
diff --git a/frontend/pages/SoftwarePage/SoftwareOSDetailsPage/SoftwareOSDetailsPage.tsx b/frontend/pages/SoftwarePage/SoftwareOSDetailsPage/SoftwareOSDetailsPage.tsx
index 257b09365c13..39a69bb01fd2 100644
--- a/frontend/pages/SoftwarePage/SoftwareOSDetailsPage/SoftwareOSDetailsPage.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareOSDetailsPage/SoftwareOSDetailsPage.tsx
@@ -11,46 +11,34 @@ import useTeamIdParam from "hooks/useTeamIdParam";
 import { AppContext } from "context/app";
 
 import { ignoreAxiosError } from "interfaces/errors";
+import {
+  isLinuxLike,
+  Platform,
+  VULN_SUPPORTED_PLATFORMS,
+} from "interfaces/platform";
 
 import osVersionsAPI, {
   IOSVersionResponse,
   IGetOsVersionQueryKey,
 } from "services/entities/operating_systems";
 import { IOperatingSystemVersion } from "interfaces/operating_system";
-import { DEFAULT_USE_QUERY_OPTIONS, SUPPORT_LINK } from "utilities/constants";
+import {
+  DEFAULT_USE_QUERY_OPTIONS,
+  PLATFORM_DISPLAY_NAMES,
+} from "utilities/constants";
 
 import Spinner from "components/Spinner";
 import MainContent from "components/MainContent";
-import EmptyTable from "components/EmptyTable";
-import CustomLink from "components/CustomLink";
 import TeamsHeader from "components/TeamsHeader";
 import Card from "components/Card";
 
 import SoftwareDetailsSummary from "../components/SoftwareDetailsSummary";
 import SoftwareVulnerabilitiesTable from "../components/SoftwareVulnerabilitiesTable";
 import DetailsNoHosts from "../components/DetailsNoHosts";
+import { VulnsNotSupported } from "../components/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable";
 
 const baseClass = "software-os-details-page";
 
-interface INotSupportedVulnProps {
-  platform: string;
-}
-
-const NotSupportedVuln = ({ platform }: INotSupportedVulnProps) => {
-  return (
-    <EmptyTable
-      header="Vulnerabilities are not supported for this type of host"
-      info={
-        <>
-          Interested in vulnerability management for{" "}
-          {platform === "chrome" ? "Chromebooks" : "Linux hosts"}?{" "}
-          <CustomLink url={SUPPORT_LINK} text="Let us know" newTab />
-        </>
-      }
-    />
-  );
-};
-
 interface ISoftwareOSDetailsRouteParams {
   id: string;
   team_id?: string;
@@ -80,7 +68,7 @@ const SoftwareOSDetailsPage = ({
     location,
     router,
     includeAllTeams: true,
-    includeNoTeam: false,
+    includeNoTeam: true,
   });
 
   const {
@@ -127,10 +115,13 @@ const SoftwareOSDetailsPage = ({
     }
 
     if (
-      osVersionDetails.platform !== "darwin" &&
-      osVersionDetails.platform !== "windows"
+      // TODO - detangle platform typing here
+      !VULN_SUPPORTED_PLATFORMS.includes(osVersionDetails.platform as Platform)
     ) {
-      return <NotSupportedVuln platform={osVersionDetails.platform} />;
+      const platformText = isLinuxLike(osVersionDetails.platform)
+        ? "Linux"
+        : PLATFORM_DISPLAY_NAMES[osVersionDetails.platform];
+      return <VulnsNotSupported platformText={platformText} />;
     }
 
     return (
@@ -166,9 +157,7 @@ const SoftwareOSDetailsPage = ({
         {isOsVersionError ? (
           <DetailsNoHosts
             header="OS not detected"
-            details={`No hosts ${
-              teamIdForApi ? "on this team " : ""
-            }have this OS installed.`}
+            details="No hosts have this OS installed."
           />
         ) : (
           <>
diff --git a/frontend/pages/SoftwarePage/SoftwarePage.tsx b/frontend/pages/SoftwarePage/SoftwarePage.tsx
index 3737606aa567..9dcf95250fe2 100644
--- a/frontend/pages/SoftwarePage/SoftwarePage.tsx
+++ b/frontend/pages/SoftwarePage/SoftwarePage.tsx
@@ -17,10 +17,15 @@ import { ITeamConfig } from "interfaces/team";
 import { IWebhookSoftwareVulnerabilities } from "interfaces/webhook";
 import configAPI from "services/entities/config";
 import teamsAPI, { ILoadTeamResponse } from "services/entities/teams";
+import { ISoftwareApiParams } from "services/entities/software";
 import { AppContext } from "context/app";
 import { NotificationContext } from "context/notification";
 import useTeamIdParam from "hooks/useTeamIdParam";
-import { buildQueryStringFromParams } from "utilities/url";
+import {
+  buildQueryStringFromParams,
+  convertParamsToSnakeCase,
+} from "utilities/url";
+import { getNextLocationPath } from "utilities/helpers";
 
 import Button from "components/buttons/Button";
 import MainContent from "components/MainContent";
@@ -29,7 +34,14 @@ import TabsWrapper from "components/TabsWrapper";
 
 import ManageAutomationsModal from "./components/ManageSoftwareAutomationsModal";
 import AddSoftwareModal from "./components/AddSoftwareModal";
-import { getSoftwareFilterFromQueryParams } from "./SoftwareTitles/SoftwareTable/helpers";
+import {
+  buildSoftwareFilterQueryParams,
+  buildSoftwareVulnFiltersQueryParams,
+  getSoftwareFilterFromQueryParams,
+  getSoftwareVulnFiltersFromQueryParams,
+  ISoftwareVulnFiltersParams,
+} from "./SoftwareTitles/SoftwareTable/helpers";
+import SoftwareFiltersModal from "./components/SoftwareFiltersModal";
 
 interface ISoftwareSubNavItem {
   name: string;
@@ -93,9 +105,11 @@ interface ISoftwarePageProps {
     search: string;
     query: {
       team_id?: string;
-      vulnerable?: string;
       available_for_install?: string;
+      vulnerable?: string;
       exploit?: string;
+      min_cvss_score?: string;
+      max_cvss_score?: string;
       page?: string;
       query?: string;
       order_key?: string;
@@ -116,7 +130,6 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
     isTeamAdmin,
     isTeamMaintainer,
     isPremiumTier,
-    isSandboxMode,
   } = useContext(AppContext);
   const { renderFlash } = useContext(NotificationContext);
 
@@ -145,17 +158,27 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
   // defined redirect behavior if the params are invalid
   const softwareFilter = getSoftwareFilterFromQueryParams(queryParams);
 
+  const softwareVulnFilters = getSoftwareVulnFiltersFromQueryParams(
+    queryParams
+  );
+
   const [showManageAutomationsModal, setShowManageAutomationsModal] = useState(
     false
   );
   const [showPreviewPayloadModal, setShowPreviewPayloadModal] = useState(false);
   const [showPreviewTicketModal, setShowPreviewTicketModal] = useState(false);
   const [showAddSoftwareModal, setShowAddSoftwareModal] = useState(false);
+  const [showSoftwareFiltersModal, setShowSoftwareFiltersModal] = useState(
+    false
+  );
   const [resetPageIndex, setResetPageIndex] = useState<boolean>(false);
+  const [addedSoftwareToken, setAddedSoftwareToken] = useState<string | null>(
+    null
+  );
 
   const {
     currentTeamId,
-    isAnyTeamSelected,
+    isAllTeamsSelected,
     isRouteOk,
     teamIdForApi,
     userTeams,
@@ -164,7 +187,7 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
     location,
     router,
     includeAllTeams: true,
-    includeNoTeam: false,
+    includeNoTeam: true,
   });
 
   // softwareConfig is either the global config or the team config of the
@@ -244,6 +267,10 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
     setShowPreviewTicketModal(!showPreviewTicketModal);
   }, [setShowPreviewTicketModal, showPreviewTicketModal]);
 
+  const toggleSoftwareFiltersModal = useCallback(() => {
+    setShowSoftwareFiltersModal(!showSoftwareFiltersModal);
+  }, [setShowSoftwareFiltersModal, showSoftwareFiltersModal]);
+
   // TODO: move into manage automations modal
   const onCreateWebhookSubmit = async (
     configSoftwareAutomations: ISoftwareAutomations
@@ -282,6 +309,27 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
     [handleTeamChange]
   );
 
+  const onApplyVulnFilters = (vulnFilters: ISoftwareVulnFiltersParams) => {
+    const newQueryParams: ISoftwareApiParams = {
+      query,
+      teamId: currentTeamId,
+      orderDirection: sortDirection,
+      orderKey: sortHeader,
+      page: 0, // resets page index
+      ...buildSoftwareFilterQueryParams(softwareFilter),
+      ...buildSoftwareVulnFiltersQueryParams(vulnFilters),
+    };
+
+    router.replace(
+      getNextLocationPath({
+        pathPrefix: location.pathname,
+        routeTemplate: "",
+        queryParams: convertParamsToSnakeCase(newQueryParams),
+      })
+    );
+    toggleSoftwareFiltersModal();
+  };
+
   const navigateToNav = useCallback(
     (i: number): void => {
       setResetPageIndex(true); // Fixes flakey page reset in table state when switching between tabs
@@ -308,7 +356,6 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
             currentTeamId={currentTeamId}
             userTeams={userTeams}
             onTeamChange={onTeamChange}
-            isSandboxMode={isSandboxMode}
           />
         )}
       </>
@@ -317,7 +364,7 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
 
   const renderPageActions = () => {
     const canManageAutomations =
-      isGlobalAdmin && (!isPremiumTier || !isAnyTeamSelected);
+      isGlobalAdmin && (!isPremiumTier || isAllTeamsSelected);
 
     const canAddSoftware =
       isGlobalAdmin || isGlobalMaintainer || isTeamAdmin || isTeamMaintainer;
@@ -347,8 +394,8 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
   const renderHeaderDescription = () => {
     return (
       <p>
-        Manage software and search for installed software, OS and
-        vulnerabilities {isAnyTeamSelected ? "on this team" : "for all hosts"}.
+        Manage software and search for installed software, OS, and
+        vulnerabilities {isAllTeamsSelected ? "for all hosts" : "on this team"}.
       </p>
     );
   };
@@ -386,7 +433,10 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
           query,
           showExploitedVulnerabilitiesOnly,
           softwareFilter,
+          vulnFilters: softwareVulnFilters,
           resetPageIndex,
+          addedSoftwareToken,
+          onAddFiltersClick: toggleSoftwareFiltersModal,
         })}
       </div>
     );
@@ -426,6 +476,16 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
             teamId={currentTeamId ?? 0}
             router={router}
             onExit={toggleAddSoftwareModal}
+            setAddedSoftwareToken={setAddedSoftwareToken}
+            isFreeTier={isFreeTier}
+          />
+        )}
+        {showSoftwareFiltersModal && (
+          <SoftwareFiltersModal
+            onExit={toggleSoftwareFiltersModal}
+            onSubmit={onApplyVulnFilters}
+            vulnFilters={softwareVulnFilters}
+            isPremiumTier={isPremiumTier || false}
           />
         )}
       </div>
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/AdvancedOptionsModal/AdvancedOptionsModal.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/AdvancedOptionsModal/AdvancedOptionsModal.tsx
index 8f95044ae0e8..5cfc313e4416 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/AdvancedOptionsModal/AdvancedOptionsModal.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/AdvancedOptionsModal/AdvancedOptionsModal.tsx
@@ -22,7 +22,7 @@ const AdvancedOptionsModal = ({
   onExit,
 }: IAdvancedOptionsModalProps) => {
   return (
-    <Modal className={baseClass} title="Advanced Options" onExit={onExit}>
+    <Modal className={baseClass} title="Advanced options" onExit={onExit}>
       <>
         <p>
           Advanced options are read-only. To change options, delete software and
@@ -38,6 +38,7 @@ const AdvancedOptionsModal = ({
             helpText="Fleet will run this command on hosts to install software."
             label="Install script"
             labelTooltip="For security agents, add the script provided by the vendor."
+            isFormField
           />
           {preInstallQuery && (
             <div className={`${baseClass}__input-field`}>
@@ -72,6 +73,7 @@ const AdvancedOptionsModal = ({
                 maxLines={10}
                 value={postInstallScript}
                 helpText="Shell (macOS and Linux) or PowerShell (Windows)."
+                isFormField
               />
             </div>
           )}
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/DeleteSoftwareModal/DeleteSoftwareModal.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/DeleteSoftwareModal/DeleteSoftwareModal.tsx
index 23d03c58521c..fa75f1d5541d 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/DeleteSoftwareModal/DeleteSoftwareModal.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/DeleteSoftwareModal/DeleteSoftwareModal.tsx
@@ -3,11 +3,15 @@ import React, { useCallback, useContext } from "react";
 import softwareAPI from "services/entities/software";
 import { NotificationContext } from "context/notification";
 
+import { getErrorReason } from "interfaces/errors";
+
 import Modal from "components/Modal";
 import Button from "components/buttons/Button";
 
 const baseClass = "delete-software-modal";
 
+const DELETE_SW_USED_BY_POLICY_ERROR_MSG =
+  "Couldn't delete. Policy automation uses this software. Please disable policy automation for this software and try again.";
 interface IDeleteSoftwareModalProps {
   softwareId: number;
   teamId: number;
@@ -28,8 +32,13 @@ const DeleteSoftwareModal = ({
       await softwareAPI.deleteSoftwarePackage(softwareId, teamId);
       renderFlash("success", "Software deleted successfully!");
       onSuccess();
-    } catch {
-      renderFlash("error", "Couldn't delete. Please try again.");
+    } catch (error) {
+      const reason = getErrorReason(error);
+      if (reason.includes("Policy automation uses this software")) {
+        renderFlash("error", DELETE_SW_USED_BY_POLICY_ERROR_MSG);
+      } else {
+        renderFlash("error", "Couldn't delete. Please try again.");
+      }
     }
     onExit();
   }, [softwareId, teamId, renderFlash, onSuccess, onExit]);
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/SoftwarePackageCard.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/SoftwarePackageCard.tsx
index 7336d16a678d..1c6a31e9d769 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/SoftwarePackageCard.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/SoftwarePackageCard.tsx
@@ -5,15 +5,10 @@ import React, {
   useState,
 } from "react";
 
-import FileSaver from "file-saver";
-
 import PATHS from "router/paths";
-
 import { AppContext } from "context/app";
 import { NotificationContext } from "context/notification";
-
 import { SoftwareInstallStatus, ISoftwarePackage } from "interfaces/software";
-
 import softwareAPI from "services/entities/software";
 
 import { buildQueryStringFromParams } from "utilities/url";
@@ -22,15 +17,23 @@ import { uploadedFromNow } from "utilities/date_format";
 
 // @ts-ignore
 import Dropdown from "components/forms/fields/Dropdown";
-
 import Card from "components/Card";
 import Graphic from "components/Graphic";
 import TooltipWrapper from "components/TooltipWrapper";
 import DataSet from "components/DataSet";
 import Icon from "components/Icon";
 
+import SoftwareIcon from "pages/SoftwarePage/components/icons/SoftwareIcon";
+import endpoints from "utilities/endpoints";
+import URL_PREFIX from "router/url_prefix";
+
 import DeleteSoftwareModal from "../DeleteSoftwareModal";
 import AdvancedOptionsModal from "../AdvancedOptionsModal";
+import {
+  APP_STORE_APP_DROPDOWN_OPTIONS,
+  SOFTWARE_PACAKGE_DROPDOWN_OPTIONS,
+  downloadFile,
+} from "./helpers";
 
 const baseClass = "software-package-card";
 
@@ -40,10 +43,15 @@ function useTruncatedElement<T extends HTMLElement>(ref: React.RefObject<T>) {
 
   useLayoutEffect(() => {
     const element = ref.current;
-    if (element) {
-      const { scrollWidth, clientWidth } = element;
-      setIsTruncated(scrollWidth > clientWidth);
+    function updateIsTruncated() {
+      if (element) {
+        const { scrollWidth, clientWidth } = element;
+        setIsTruncated(scrollWidth > clientWidth);
+      }
     }
+    window.addEventListener("resize", updateIsTruncated);
+    updateIsTruncated();
+    return () => window.removeEventListener("resize", updateIsTruncated);
   }, [ref]);
 
   return isTruncated;
@@ -75,7 +83,7 @@ const SoftwareName = ({ name }: ISoftwareNameProps) => {
 interface IStatusDisplayOption {
   displayName: string;
   iconName: "success" | "pending-outline" | "error";
-  tooltip: string;
+  tooltip: React.ReactNode;
 }
 
 const STATUS_DISPLAY_OPTIONS: Record<
@@ -85,17 +93,31 @@ const STATUS_DISPLAY_OPTIONS: Record<
   installed: {
     displayName: "Installed",
     iconName: "success",
-    tooltip: "Fleet installed software on these hosts.",
+    tooltip: (
+      <>
+        Software is installed on these hosts (install script finished
+        <br />
+        with exit code 0). Currently, if the software is uninstalled, the
+        <br />
+        &quot;installed&quot; status won&apos;t be updated.
+      </>
+    ),
   },
   pending: {
     displayName: "Pending",
     iconName: "pending-outline",
-    tooltip: "Fleet will install software when these hosts come online.",
+    tooltip: "Fleet is installing or will install when the host comes online.",
   },
   failed: {
     displayName: "Failed",
     iconName: "error",
-    tooltip: "Fleet failed to install software on these hosts.",
+    tooltip: (
+      <>
+        These hosts failed to install software. Click on a host to view
+        <br />
+        error(s).
+      </>
+    ),
   },
 };
 
@@ -120,16 +142,18 @@ const PackageStatusCount = ({
   })}`;
   return (
     <DataSet
+      className={`${baseClass}__status`}
       title={
         <TooltipWrapper
           position="top"
           tipContent={displayData.tooltip}
           underline={false}
           showArrow
+          tipOffset={10}
         >
           <div className={`${baseClass}__status-title`}>
             <Icon name={displayData.iconName} />
-            <span>{displayData.displayName}</span>
+            <div>{displayData.displayName}</div>
           </div>
         </TooltipWrapper>
       }
@@ -142,30 +166,19 @@ const PackageStatusCount = ({
   );
 };
 
-const DROPDOWN_OPTIONS = [
-  {
-    label: "Download",
-    value: "download",
-  },
-  {
-    label: "Delete",
-    value: "delete",
-  },
-  {
-    label: "Advanced options",
-    value: "advanced",
-  },
-] as const;
+interface IActionsDropdownProps {
+  isSoftwarePackage: boolean;
+  onDownloadClick: () => void;
+  onDeleteClick: () => void;
+  onAdvancedOptionsClick: () => void;
+}
 
 const ActionsDropdown = ({
+  isSoftwarePackage,
   onDownloadClick,
   onDeleteClick,
   onAdvancedOptionsClick,
-}: {
-  onDownloadClick: () => void;
-  onDeleteClick: () => void;
-  onAdvancedOptionsClick: () => void;
-}) => {
+}: IActionsDropdownProps) => {
   const onSelect = (value: string) => {
     switch (value) {
       case "download":
@@ -189,20 +202,42 @@ const ActionsDropdown = ({
         onChange={onSelect}
         placeholder="Actions"
         searchable={false}
-        options={DROPDOWN_OPTIONS}
+        options={
+          isSoftwarePackage
+            ? SOFTWARE_PACAKGE_DROPDOWN_OPTIONS
+            : APP_STORE_APP_DROPDOWN_OPTIONS
+        }
       />
     </div>
   );
 };
 
 interface ISoftwarePackageCardProps {
-  softwarePackage: ISoftwarePackage;
+  name: string;
+  version: string;
+  uploadedAt: string; // TODO: optional?
+  status: {
+    installed: number;
+    pending: number;
+    failed: number;
+  };
+  isSelfService: boolean;
   softwareId: number;
   teamId: number;
+  // NOTE: we will only have this if we are working with a software package.
+  softwarePackage?: ISoftwarePackage;
   onDelete: () => void;
 }
 
+// NOTE: This component is depeent on having either a software package
+// (ISoftwarePackage) or an app store app (IAppStoreApp). If we add more types
+// of packages we should consider refactoring this to be more dynamic.
 const SoftwarePackageCard = ({
+  name,
+  version,
+  uploadedAt,
+  status,
+  isSelfService,
   softwarePackage,
   softwareId,
   teamId,
@@ -236,105 +271,110 @@ const SoftwarePackageCard = ({
 
   const onDownloadClick = useCallback(async () => {
     try {
-      const resp = await softwareAPI.downloadSoftwarePackage(
+      const resp = await softwareAPI.getSoftwarePackageToken(
         softwareId,
         teamId
       );
-      const contentLength = parseInt(resp.headers["content-length"], 10);
-      if (contentLength !== resp.data.size) {
-        throw new Error(
-          `Byte size (${resp.data.size}) does not match content-length header (${contentLength})`
-        );
-      }
-      const filename = softwarePackage.name;
-      const file = new File([resp.data], filename, {
-        type: "application/octet-stream",
-      });
-      if (file.size === 0) {
-        throw new Error("Downloaded file is empty");
+      if (!resp.token) {
+        throw new Error("No download token returned");
       }
-      if (file.size !== resp.data.size) {
-        throw new Error(
-          `File size (${file.size}) does not match expected size (${resp.data.size})`
-        );
-      }
-      FileSaver.saveAs(file);
+      // Now that we received the download token, we construct the download URL.
+      const { origin } = global.window.location;
+      const url = `${origin}${URL_PREFIX}/api${endpoints.SOFTWARE_PACKAGE_TOKEN(
+        softwareId
+      )}/${resp.token}`;
+      // The download occurs without any additional authentication.
+      downloadFile(url, name);
     } catch (e) {
-      console.log(e);
-      renderFlash("error", "Couldn’t download. Please try again.");
+      renderFlash("error", "Couldn't download. Please try again.");
     }
-  }, [renderFlash, softwareId, softwarePackage.name, teamId]);
+  }, [renderFlash, softwareId, name, teamId]);
+
+  const renderIcon = () => {
+    return softwarePackage ? (
+      <Graphic name="file-pkg" />
+    ) : (
+      <SoftwareIcon name="appStore" size="medium" />
+    );
+  };
+
+  const renderDetails = () => {
+    return !uploadedAt ? (
+      <span>Version {version}</span>
+    ) : (
+      <>
+        <span>Version {version} &bull; </span>
+        <TooltipWrapper
+          tipContent={internationalTimeFormat(new Date(uploadedAt))}
+          underline={false}
+        >
+          {uploadedFromNow(uploadedAt)}
+        </TooltipWrapper>
+      </>
+    );
+  };
 
   const showActions =
     isGlobalAdmin || isGlobalMaintainer || isTeamAdmin || isTeamMaintainer;
 
   return (
     <Card borderRadiusSize="xxlarge" includeShadow className={baseClass}>
-      <div className={`${baseClass}__main-content`}>
+      <div className={`${baseClass}__row-1`}>
         {/* TODO: main-info could be a seperate component as its reused on a couple
         pages already. Come back and pull this into a component */}
         <div className={`${baseClass}__main-info`}>
-          <Graphic name="file-pkg" />
+          {renderIcon()}
           <div className={`${baseClass}__info`}>
-            <SoftwareName name={softwarePackage.name} />
-            <span className={`${baseClass}__details`}>
-              <span>Version {softwarePackage.version} &bull; </span>
-              <TooltipWrapper
-                tipContent={internationalTimeFormat(
-                  new Date(softwarePackage.uploaded_at)
-                )}
-                underline={false}
-              >
-                {uploadedFromNow(softwarePackage.uploaded_at)}
-              </TooltipWrapper>
-            </span>
+            <SoftwareName name={name} />
+            <span className={`${baseClass}__details`}>{renderDetails()}</span>
           </div>
         </div>
-        <div className={`${baseClass}__package-statuses`}>
-          <PackageStatusCount
-            softwareId={softwareId}
-            status="installed"
-            count={softwarePackage.status.installed}
-            teamId={teamId}
-          />
-          <PackageStatusCount
-            softwareId={softwareId}
-            status="pending"
-            count={softwarePackage.status.pending}
-            teamId={teamId}
-          />
-          <PackageStatusCount
-            softwareId={softwareId}
-            status="failed"
-            count={softwarePackage.status.failed}
-            teamId={teamId}
-          />
+        <div className={`${baseClass}__actions-wrapper`}>
+          {isSelfService && (
+            <div className={`${baseClass}__self-service-badge`}>
+              <Icon
+                name="install-self-service"
+                size="small"
+                color="ui-fleet-black-75"
+              />
+              Self-service
+            </div>
+          )}
+          {showActions && (
+            <ActionsDropdown
+              isSoftwarePackage={!!softwarePackage}
+              onDownloadClick={onDownloadClick}
+              onDeleteClick={onDeleteClick}
+              onAdvancedOptionsClick={onAdvancedOptionsClick}
+            />
+          )}
         </div>
       </div>
-      <div className={`${baseClass}__actions-wrapper`}>
-        {softwarePackage.self_service && (
-          <div className={`${baseClass}__self-service-badge`}>
-            <Icon
-              name="install-self-service"
-              size="small"
-              color="ui-fleet-black-75"
-            />
-            Self-service
-          </div>
-        )}
-        {showActions && (
-          <ActionsDropdown
-            onDownloadClick={onDownloadClick}
-            onDeleteClick={onDeleteClick}
-            onAdvancedOptionsClick={onAdvancedOptionsClick}
-          />
-        )}
+      <div className={`${baseClass}__package-statuses`}>
+        <PackageStatusCount
+          softwareId={softwareId}
+          status="installed"
+          count={status.installed}
+          teamId={teamId}
+        />
+        <PackageStatusCount
+          softwareId={softwareId}
+          status="pending"
+          count={status.pending}
+          teamId={teamId}
+        />
+        <PackageStatusCount
+          softwareId={softwareId}
+          status="failed"
+          count={status.failed}
+          teamId={teamId}
+        />
       </div>
       {showAdvancedOptionsModal && (
         <AdvancedOptionsModal
-          installScript={softwarePackage.install_script}
-          preInstallQuery={softwarePackage.pre_install_query}
-          postInstallScript={softwarePackage.post_install_script}
+          installScript={softwarePackage?.install_script ?? ""}
+          preInstallQuery={softwarePackage?.pre_install_query}
+          postInstallScript={softwarePackage?.post_install_script}
           onExit={() => setShowAdvancedOptionsModal(false)}
         />
       )}
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/_styles.scss b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/_styles.scss
index 6897dffe7bd2..f4c5f6a9e0b7 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/_styles.scss
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/_styles.scss
@@ -1,13 +1,15 @@
 .software-package-card {
   display: flex;
+  flex-direction: column;
   justify-content: space-between;
   align-items: center;
   gap: $pad-medium;
 
-  &__main-content {
+  &__row-1 {
     display: flex;
-    align-items: flex-start;
-    gap: $pad-xxlarge;
+    justify-content: space-between;
+    width: 100%;
+    gap: $pad-medium;
   }
 
   &__main-info {
@@ -19,13 +21,14 @@
     display: flex;
     flex-direction: column;
     gap: $pad-xsmall;
+    justify-content: center;
   }
 
   &__title {
     font-size: $x-small;
     font-weight: $bold;
     @include ellipse-text;
-    max-width: 290px;
+    max-width: 48vw;
   }
 
   &__details {
@@ -34,13 +37,36 @@
 
   &__package-statuses {
     display: flex;
-    gap: $pad-xxlarge;
+    align-items: flex-start;
+    align-self: stretch;
+    border-radius: 6px;
+    border: 1px solid $ui-fleet-black-10;
+    font-size: $x-small;
   }
 
-  &__status-title {
+  &__status {
     display: flex;
+    flex-direction: column;
+    padding: 16px 24px;
+    justify-content: center;
     align-items: center;
-    gap: $pad-xsmall;
+    flex: 1 0 0;
+    border-right: 1px solid var(--UI-Fleet-Black-10, #e2e4ea);
+
+    &:last-child {
+      border-right: none;
+    }
+
+    .react-tooltip {
+      text-align: center;
+    }
+  }
+
+  &__status-title{
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: $pad-small;
   }
 
   &__status-count {
@@ -51,6 +77,7 @@
     display: flex;
     justify-content: flex-end;
     gap: $pad-medium;
+    align-items: center;
   }
 
   &__self-service-badge {
@@ -65,6 +92,7 @@
     color: $ui-fleet-black-75;
     font-size: $xx-small;
     font-weight: $bold;
+    white-space: nowrap;
   }
 
   &__actions {
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/helpers.ts b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/helpers.ts
new file mode 100644
index 000000000000..db049c2a9d69
--- /dev/null
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/helpers.ts
@@ -0,0 +1,32 @@
+export const SOFTWARE_PACAKGE_DROPDOWN_OPTIONS = [
+  {
+    label: "Download",
+    value: "download",
+  },
+  {
+    label: "Delete",
+    value: "delete",
+  },
+  {
+    label: "Advanced options",
+    value: "advanced",
+  },
+] as const;
+
+export const APP_STORE_APP_DROPDOWN_OPTIONS = [
+  {
+    label: "Delete",
+    value: "delete",
+  },
+] as const;
+
+export const downloadFile = (url: string, fileName: string) => {
+  // Download a file by simulating a link click.
+  const downloadLink = document.createElement("a");
+  downloadLink.href = url;
+  downloadLink.download = fileName;
+  downloadLink.click();
+
+  // Clean up above-created "a" element
+  downloadLink.remove();
+};
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsPage.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsPage.tsx
index 10d5b41fd051..ae2084e6b726 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsPage.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsPage.tsx
@@ -13,15 +13,19 @@ import useTeamIdParam from "hooks/useTeamIdParam";
 import { AppContext } from "context/app";
 
 import {
-  ISoftwareTitleWithPackageDetail,
+  ISoftwareTitleDetails,
   formatSoftwareType,
+  isIpadOrIphoneSoftwareSource,
 } from "interfaces/software";
 import { ignoreAxiosError } from "interfaces/errors";
 import softwareAPI, {
   ISoftwareTitleResponse,
   IGetSoftwareTitleQueryKey,
 } from "services/entities/software";
-import { APP_CONTEXT_ALL_TEAMS_ID } from "interfaces/team";
+import {
+  APP_CONTEXT_ALL_TEAMS_ID,
+  APP_CONTEXT_NO_TEAM_ID,
+} from "interfaces/team";
 import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
 
 import Spinner from "components/Spinner";
@@ -33,6 +37,7 @@ import SoftwareDetailsSummary from "../components/SoftwareDetailsSummary";
 import SoftwareTitleDetailsTable from "./SoftwareTitleDetailsTable";
 import DetailsNoHosts from "../components/DetailsNoHosts";
 import SoftwarePackageCard from "./SoftwarePackageCard";
+import { getPackageCardInfo } from "./helpers";
 
 const baseClass = "software-title-details-page";
 
@@ -72,7 +77,7 @@ const SoftwareTitleDetailsPage = ({
     location,
     router,
     includeAllTeams: true,
-    includeNoTeam: false,
+    includeNoTeam: true,
   });
 
   const {
@@ -83,7 +88,7 @@ const SoftwareTitleDetailsPage = ({
   } = useQuery<
     ISoftwareTitleResponse,
     AxiosError,
-    ISoftwareTitleWithPackageDetail,
+    ISoftwareTitleDetails,
     IGetSoftwareTitleQueryKey[]
   >(
     [{ scope: "softwareById", softwareId, teamId: teamIdForApi }],
@@ -100,13 +105,16 @@ const SoftwareTitleDetailsPage = ({
     }
   );
 
+  const isAvailableForInstall =
+    !!softwareTitle?.software_package || !!softwareTitle?.app_store_app;
+
   const onDeleteInstaller = useCallback(() => {
     if (softwareTitle?.versions?.length) {
       refetchSoftwareTitle();
       return;
     }
     // redirect to software titles page if no versions are available
-    if (teamIdForApi && teamIdForApi > 0) {
+    if (teamIdForApi) {
       router.push(paths.SOFTWARE_TITLES.concat(`?team_id=${teamIdForApi}`));
     } else {
       router.push(paths.SOFTWARE_TITLES);
@@ -120,85 +128,106 @@ const SoftwareTitleDetailsPage = ({
     [handleTeamChange]
   );
 
-  const hasPermission = Boolean(
-    isOnGlobalTeam || isTeamAdmin || isTeamMaintainer || isTeamObserver
-  );
-  const hasSoftwarePackage = softwareTitle && softwareTitle.software_package;
-  const showPackageCard =
-    currentTeamId !== APP_CONTEXT_ALL_TEAMS_ID &&
-    hasPermission &&
-    hasSoftwarePackage;
+  const renderSoftwarePackageCard = (title: ISoftwareTitleDetails) => {
+    const hasPermission = Boolean(
+      isOnGlobalTeam || isTeamAdmin || isTeamMaintainer || isTeamObserver
+    );
+
+    const showPackageCard =
+      currentTeamId !== APP_CONTEXT_ALL_TEAMS_ID &&
+      hasPermission &&
+      isAvailableForInstall;
+
+    if (showPackageCard) {
+      const packageCardData = getPackageCardInfo(title);
+      return (
+        <SoftwarePackageCard
+          softwarePackage={packageCardData.softwarePackage}
+          name={packageCardData.name}
+          version={packageCardData.version}
+          uploadedAt={packageCardData.uploadedAt}
+          status={packageCardData.status}
+          isSelfService={packageCardData.isSelfService}
+          softwareId={softwareId}
+          teamId={currentTeamId ?? APP_CONTEXT_NO_TEAM_ID}
+          onDelete={onDeleteInstaller}
+        />
+      );
+    }
+
+    return null;
+  };
 
   const renderContent = () => {
     if (isSoftwareTitleLoading) {
       return <Spinner />;
     }
 
-    if (!softwareTitle && !isSoftwareTitleError) {
-      return null;
+    if (isSoftwareTitleError) {
+      return (
+        <DetailsNoHosts
+          header="Software not detected"
+          details="Expecting to see software? Check back later."
+        />
+      );
     }
-    return (
-      <>
-        {isPremiumTier && (
-          <TeamsHeader
-            isOnGlobalTeam={isOnGlobalTeam}
-            currentTeamId={currentTeamId}
-            userTeams={userTeams}
-            onTeamChange={onTeamChange}
-          />
-        )}
-        {isSoftwareTitleError ? (
-          <DetailsNoHosts
-            header="Software not detected"
-            details={`No hosts ${
-              teamIdForApi ? "on this team " : ""
-            }have this software installed.`}
+
+    if (softwareTitle) {
+      return (
+        <>
+          <SoftwareDetailsSummary
+            title={softwareTitle.name}
+            type={formatSoftwareType(softwareTitle)}
+            versions={softwareTitle.versions?.length ?? 0}
+            hosts={softwareTitle.hosts_count}
+            queryParams={{
+              software_title_id: softwareId,
+              team_id: teamIdForApi,
+            }}
+            name={softwareTitle.name}
+            source={softwareTitle.source}
+            iconUrl={
+              softwareTitle.app_store_app
+                ? softwareTitle.app_store_app.icon_url
+                : undefined
+            }
           />
-        ) : (
-          <>
-            <SoftwareDetailsSummary
-              title={softwareTitle.name}
-              type={formatSoftwareType(softwareTitle)}
-              versions={softwareTitle.versions?.length ?? 0}
-              hosts={softwareTitle.hosts_count}
-              queryParams={{
-                software_title_id: softwareId,
-                team_id: teamIdForApi,
-              }}
-              name={softwareTitle.name}
-              source={softwareTitle.source}
-            />
-            {showPackageCard &&
-              softwareTitle.software_package &&
-              currentTeamId && (
-                <SoftwarePackageCard
-                  softwarePackage={softwareTitle.software_package}
-                  softwareId={softwareId}
-                  teamId={currentTeamId}
-                  onDelete={onDeleteInstaller}
-                />
+          {renderSoftwarePackageCard(softwareTitle)}
+          <Card
+            borderRadiusSize="xxlarge"
+            includeShadow
+            className={`${baseClass}__versions-section`}
+          >
+            <h2>Versions</h2>
+            <SoftwareTitleDetailsTable
+              router={router}
+              data={softwareTitle.versions ?? []}
+              isLoading={isSoftwareTitleLoading}
+              teamIdForApi={teamIdForApi}
+              isIPadOSOrIOSApp={isIpadOrIphoneSoftwareSource(
+                softwareTitle.source
               )}
-            <Card
-              borderRadiusSize="xxlarge"
-              includeShadow
-              className={`${baseClass}__versions-section`}
-            >
-              <h2>Versions</h2>
-              <SoftwareTitleDetailsTable
-                router={router}
-                data={softwareTitle.versions ?? []}
-                isLoading={isSoftwareTitleLoading}
-                teamIdForApi={teamIdForApi}
-              />
-            </Card>
-          </>
-        )}
-      </>
-    );
+              isAvailableForInstall={isAvailableForInstall}
+              countsUpdatedAt={softwareTitle.versions_updated_at}
+            />
+          </Card>
+        </>
+      );
+    }
+
+    return null;
   };
 
   return (
     <MainContent className={baseClass}>
+      {isPremiumTier && (
+        <TeamsHeader
+          isOnGlobalTeam={isOnGlobalTeam}
+          currentTeamId={currentTeamId}
+          userTeams={userTeams}
+          onTeamChange={onTeamChange}
+        />
+      )}
       <>{renderContent()}</>
     </MainContent>
   );
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTable.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTable.tsx
index 99587e2b9c73..6eaafa2a28e0 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTable.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTable.tsx
@@ -13,6 +13,7 @@ import TableContainer from "components/TableContainer";
 import TableCount from "components/TableContainer/TableCount";
 import EmptyTable from "components/EmptyTable";
 import CustomLink from "components/CustomLink";
+import LastUpdatedText from "components/LastUpdatedText";
 
 import generateSoftwareTitleDetailsTableConfig from "./SoftwareTitleDetailsTableConfig";
 
@@ -21,29 +22,55 @@ const DEFAULT_SORT_DIRECTION = "desc";
 
 const baseClass = "software-title-details-table";
 
-const NoVersionsDetected = (): JSX.Element => {
+const SoftwareLastUpdatedInfo = (lastUpdatedAt: string) => {
   return (
-    <EmptyTable
-      header="No versions detected for this software item."
-      info={
+    <LastUpdatedText
+      lastUpdatedAt={lastUpdatedAt}
+      customTooltipText={
         <>
-          Expecting to see versions?{" "}
-          <CustomLink
-            url={GITHUB_NEW_ISSUE_LINK}
-            text="File an issue on GitHub"
-            newTab
-          />
+          The last time software data was <br />
+          updated, including vulnerabilities <br />
+          and host counts.
         </>
       }
     />
   );
 };
 
+const NoVersionsDetected = (isAvailableForInstall = false): JSX.Element => {
+  return (
+    <EmptyTable
+      header={
+        isAvailableForInstall
+          ? "No versions detected."
+          : "No versions detected for this software item."
+      }
+      info={
+        isAvailableForInstall ? (
+          "Install this software on a host to see versions."
+        ) : (
+          <>
+            Expecting to see versions?{" "}
+            <CustomLink
+              url={GITHUB_NEW_ISSUE_LINK}
+              text="File an issue on GitHub"
+              newTab
+            />
+          </>
+        )
+      }
+    />
+  );
+};
+
 interface ISoftwareTitleDetailsTableProps {
   router: InjectedRouter;
   data: ISoftwareTitleVersion[];
   isLoading: boolean;
   teamIdForApi?: number;
+  isIPadOSOrIOSApp: boolean;
+  isAvailableForInstall?: boolean;
+  countsUpdatedAt?: string;
 }
 
 interface IRowProps extends Row {
@@ -57,6 +84,9 @@ const SoftwareTitleDetailsTable = ({
   data,
   isLoading,
   teamIdForApi,
+  isIPadOSOrIOSApp,
+  isAvailableForInstall,
+  countsUpdatedAt,
 }: ISoftwareTitleDetailsTableProps) => {
   const handleRowSelect = (row: IRowProps) => {
     const hostsBySoftwareParams = {
@@ -74,12 +104,19 @@ const SoftwareTitleDetailsTable = ({
 
   const softwareTableHeaders = useMemo(
     () =>
-      generateSoftwareTitleDetailsTableConfig({ router, teamId: teamIdForApi }),
-    [router, teamIdForApi]
+      generateSoftwareTitleDetailsTableConfig({
+        router,
+        teamId: teamIdForApi,
+        isIPadOSOrIOSApp,
+      }),
+    [router, teamIdForApi, isIPadOSOrIOSApp]
   );
 
   const renderVersionsCount = () => (
-    <TableCount name="versions" count={data?.length} />
+    <>
+      <TableCount name="versions" count={data?.length} />
+      {countsUpdatedAt && SoftwareLastUpdatedInfo(countsUpdatedAt)}
+    </>
   );
 
   return (
@@ -88,7 +125,7 @@ const SoftwareTitleDetailsTable = ({
       columnConfigs={softwareTableHeaders}
       data={data}
       isLoading={isLoading}
-      emptyComponent={NoVersionsDetected}
+      emptyComponent={() => NoVersionsDetected(isAvailableForInstall)}
       showMarkAllPages={false}
       isAllPagesSelected={false}
       defaultSortHeader={DEFAULT_SORT_HEADER}
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTableConfig.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTableConfig.tsx
index e5990b58a6c3..fc98bd54beba 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTableConfig.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTableConfig.tsx
@@ -17,6 +17,7 @@ import VulnerabilitiesCell from "../../components/VulnerabilitiesCell";
 interface ISoftwareTitleDetailsTableConfigProps {
   router: InjectedRouter;
   teamId?: number;
+  isIPadOSOrIOSApp: boolean;
 }
 interface ICellProps {
   cell: {
@@ -48,6 +49,7 @@ interface IVulnCellProps extends ICellProps {
 const generateSoftwareTitleDetailsTableConfig = ({
   router,
   teamId,
+  isIPadOSOrIOSApp,
 }: ISoftwareTitleDetailsTableConfigProps) => {
   const tableHeaders = [
     {
@@ -56,6 +58,10 @@ const generateSoftwareTitleDetailsTableConfig = ({
       disableSortBy: true,
       accessor: "version",
       Cell: (cellProps: IVersionCellProps): JSX.Element => {
+        if (!cellProps.cell.value) {
+          // renders desired empty state
+          return <TextCell />;
+        }
         const { id } = cellProps.row.original;
         const teamQueryParam = buildQueryStringFromParams({ team_id: teamId });
         const softwareVersionDetailsPath = `${PATHS.SOFTWARE_VERSION_DETAILS(
@@ -90,10 +96,13 @@ const generateSoftwareTitleDetailsTableConfig = ({
       // With the versions data, we can sum up the vulnerabilities to get the
       // total number of vulnerabilities for the software title
       accessor: "vulnerabilities",
-      Cell: (cellProps: IVulnCellProps): JSX.Element => (
-        <VulnerabilitiesCell vulnerabilities={cellProps.cell.value} />
+      Cell: (cellProps: IVulnCellProps): JSX.Element => {
+        if (isIPadOSOrIOSApp) {
+          return <TextCell value="Not supported" grey />;
+        }
+        return <VulnerabilitiesCell vulnerabilities={cellProps.cell.value} />;
         // TODO: tooltip
-      ),
+      },
     },
     {
       title: "Hosts",
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/helpers.ts b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/helpers.ts
new file mode 100644
index 000000000000..04bf2d18d4bc
--- /dev/null
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/helpers.ts
@@ -0,0 +1,30 @@
+import {
+  IAppStoreApp,
+  ISoftwareTitleDetails,
+  isSoftwarePackage,
+} from "interfaces/software";
+import { DEFAULT_EMPTY_CELL_VALUE } from "utilities/constants";
+
+/**
+ * Generates the data needed to render the package card.
+ */
+// eslint-disable-next-line import/prefer-default-export
+export const getPackageCardInfo = (softwareTitle: ISoftwareTitleDetails) => {
+  // we know at this point that softwareTitle.software_package or
+  // softwareTitle.app_store_app is not null so we will do a type assertion.
+  const packageData = softwareTitle.software_package
+    ? softwareTitle.software_package
+    : (softwareTitle.app_store_app as IAppStoreApp);
+
+  return {
+    softwarePackage: isSoftwarePackage(packageData) ? packageData : undefined,
+    name: softwareTitle.name,
+    version:
+      (isSoftwarePackage(packageData)
+        ? packageData.version
+        : packageData.latest_version) || DEFAULT_EMPTY_CELL_VALUE,
+    uploadedAt: isSoftwarePackage(packageData) ? packageData.uploaded_at : "",
+    status: packageData.status,
+    isSelfService: packageData.self_service,
+  };
+};
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTable.tests.tsx b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTable.tests.tsx
new file mode 100644
index 000000000000..1c07bc5cd7ea
--- /dev/null
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTable.tests.tsx
@@ -0,0 +1,262 @@
+import React from "react";
+import { screen } from "@testing-library/react";
+import { createCustomRenderer } from "test/test-utils";
+
+import createMockUser from "__mocks__/userMock";
+import {
+  createMockSoftwareTitlesResponse,
+  createMockSoftwareVersionsResponse,
+} from "__mocks__/softwareMock";
+import { noop } from "lodash";
+
+import SoftwareTable from "./SoftwareTable";
+
+// TODO: figure out how to mock the router properly.
+const mockRouter = {
+  push: jest.fn(),
+  replace: jest.fn(),
+  goBack: jest.fn(),
+  goForward: jest.fn(),
+  go: jest.fn(),
+  setRouteLeaveHook: jest.fn(),
+  isActive: jest.fn(),
+  createHref: jest.fn(),
+  createPath: jest.fn(),
+};
+
+describe("Software table", () => {
+  it("Renders the page-wide disabled state when software inventory is disabled", () => {
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          isGlobalAdmin: true,
+          currentUser: createMockUser(),
+        },
+      },
+    });
+
+    render(
+      <SoftwareTable
+        router={mockRouter}
+        isSoftwareEnabled={false} // Set to false
+        showVersions={false}
+        data={createMockSoftwareTitlesResponse({
+          counts_updated_at: null,
+          software_titles: [],
+        })}
+        installableSoftwareExists={false}
+        query=""
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        softwareFilter="allSoftware"
+        vulnFilters={{
+          vulnerable: false,
+          exploit: false,
+          minCvssScore: undefined,
+          maxCvssScore: undefined,
+        }}
+        currentPage={0}
+        teamId={1}
+        isLoading={false}
+        resetPageIndex={false}
+        onAddFiltersClick={noop}
+      />
+    );
+
+    expect(screen.getByText("Software inventory disabled")).toBeInTheDocument();
+    expect(screen.queryByText("Vulnerability")).toBeNull();
+  });
+
+  it("Renders the page-wide empty state when no software are present", () => {
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          isGlobalAdmin: true,
+          currentUser: createMockUser(),
+        },
+      },
+    });
+
+    render(
+      <SoftwareTable
+        router={mockRouter}
+        isSoftwareEnabled
+        showVersions={false}
+        data={createMockSoftwareTitlesResponse({
+          count: 0,
+          counts_updated_at: null,
+          software_titles: [],
+        })}
+        installableSoftwareExists={false}
+        query=""
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        softwareFilter="allSoftware"
+        vulnFilters={{
+          vulnerable: false,
+          exploit: false,
+          minCvssScore: undefined,
+          maxCvssScore: undefined,
+        }}
+        currentPage={0}
+        teamId={1}
+        isLoading={false}
+        resetPageIndex={false}
+        onAddFiltersClick={noop}
+      />
+    );
+
+    expect(screen.getByText("No software detected")).toBeInTheDocument();
+    expect(
+      screen.getByText("Expecting to see software? Check back later.")
+    ).toBeInTheDocument();
+    expect(screen.getByText("0 items")).toBeInTheDocument();
+    expect(screen.queryByText("Search")).toBeNull();
+    expect(screen.queryByText("Updated")).toBeNull();
+  });
+
+  it("Renders the page-wide empty state when search query does not exist but versions toggle is applied", () => {
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          isGlobalAdmin: true,
+          currentUser: createMockUser(),
+        },
+      },
+    });
+
+    render(
+      <SoftwareTable
+        router={mockRouter}
+        isSoftwareEnabled
+        showVersions // Versions toggle applied
+        data={createMockSoftwareVersionsResponse({
+          counts_updated_at: null,
+          software: [],
+        })}
+        installableSoftwareExists={false}
+        query=""
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        softwareFilter="allSoftware"
+        vulnFilters={{
+          vulnerable: false,
+          exploit: false,
+          minCvssScore: undefined,
+          maxCvssScore: undefined,
+        }}
+        currentPage={0}
+        teamId={1}
+        isLoading={false}
+        resetPageIndex={false}
+        onAddFiltersClick={noop}
+      />
+    );
+
+    expect(screen.getByText("No software detected")).toBeInTheDocument();
+    expect(
+      screen.getByText("Expecting to see software? Check back later.")
+    ).toBeInTheDocument();
+  });
+
+  it("Renders the empty search state when search query does not exist but dropdown is applied", () => {
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          isGlobalAdmin: true,
+          currentUser: createMockUser(),
+        },
+      },
+    });
+
+    render(
+      <SoftwareTable
+        router={mockRouter}
+        isSoftwareEnabled
+        showVersions={false}
+        data={createMockSoftwareTitlesResponse({
+          counts_updated_at: null,
+          software_titles: [],
+        })}
+        installableSoftwareExists={false}
+        query=""
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        softwareFilter="installableSoftware" // Dropdown applied
+        vulnFilters={{
+          vulnerable: false,
+          exploit: false,
+          minCvssScore: undefined,
+          maxCvssScore: undefined,
+        }}
+        currentPage={0}
+        teamId={1}
+        isLoading={false}
+        resetPageIndex={false}
+        onAddFiltersClick={noop}
+      />
+    );
+
+    expect(
+      screen.getByText("No items match the current search criteria")
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText(
+        "Expecting to see installable software? Check back later."
+      )
+    ).toBeInTheDocument();
+  });
+
+  it("Renders the empty search state when search query does not exist but vulnerability filter is applied", () => {
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          isGlobalAdmin: true,
+          currentUser: createMockUser(),
+        },
+      },
+    });
+
+    render(
+      <SoftwareTable
+        router={mockRouter}
+        isSoftwareEnabled
+        showVersions={false}
+        data={createMockSoftwareTitlesResponse({
+          counts_updated_at: null,
+          software_titles: [],
+        })}
+        installableSoftwareExists={false}
+        query=""
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        softwareFilter="allSoftware"
+        vulnFilters={{
+          vulnerable: true,
+          exploit: false,
+          minCvssScore: undefined,
+          maxCvssScore: undefined,
+        }}
+        currentPage={0}
+        teamId={1}
+        isLoading={false}
+        resetPageIndex={false}
+        onAddFiltersClick={noop}
+      />
+    );
+
+    expect(
+      screen.getByText("No items match the current search criteria")
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText(
+        "Expecting to see vulnerable software? Check back later."
+      )
+    ).toBeInTheDocument();
+  });
+});
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTable.tsx b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTable.tsx
index ceb61c2a41b5..9b8df49c2cf9 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTable.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTable.tsx
@@ -19,10 +19,7 @@ import {
   ISoftwareTitlesResponse,
   ISoftwareVersionsResponse,
 } from "services/entities/software";
-import {
-  ISoftwareTitleWithPackageName,
-  ISoftwareVersion,
-} from "interfaces/software";
+import { ISoftwareTitle, ISoftwareVersion } from "interfaces/software";
 
 // @ts-ignore
 import Dropdown from "components/forms/fields/Dropdown";
@@ -32,6 +29,9 @@ import CustomLink from "components/CustomLink";
 import LastUpdatedText from "components/LastUpdatedText";
 import { ITableQueryData } from "components/TableContainer/TableContainer";
 import TableCount from "components/TableContainer/TableCount";
+import Button from "components/buttons/Button";
+import Icon from "components/Icon";
+import TooltipWrapper from "components/TooltipWrapper";
 
 import EmptySoftwareTable from "pages/SoftwarePage/components/EmptySoftwareTable";
 
@@ -39,9 +39,11 @@ import generateTitlesTableConfig from "./SoftwareTitlesTableConfig";
 import generateVersionsTableConfig from "./SoftwareVersionsTableConfig";
 import {
   ISoftwareDropdownFilterVal,
+  ISoftwareVulnFiltersParams,
   SOFTWARE_TITLES_DROPDOWN_OPTIONS,
-  SOFTWARE_VERSIONS_DROPDOWN_OPTIONS,
-  getSoftwareFilterForQueryKey,
+  buildSoftwareFilterQueryParams,
+  buildSoftwareVulnFiltersQueryParams,
+  getVulnFilterRenderDetails,
 } from "./helpers";
 
 interface IRowProps extends Row {
@@ -63,16 +65,19 @@ interface ISoftwareTableProps {
   router: InjectedRouter;
   data?: ISoftwareTitlesResponse | ISoftwareVersionsResponse;
   showVersions: boolean;
+  installableSoftwareExists: boolean;
   isSoftwareEnabled: boolean;
   query: string;
   perPage: number;
   orderDirection: "asc" | "desc";
   orderKey: string;
   softwareFilter: ISoftwareDropdownFilterVal;
+  vulnFilters: ISoftwareVulnFiltersParams;
   currentPage: number;
   teamId?: number;
   isLoading: boolean;
   resetPageIndex: boolean;
+  onAddFiltersClick: () => void;
 }
 
 const baseClass = "software-table";
@@ -81,16 +86,19 @@ const SoftwareTable = ({
   router,
   data,
   showVersions,
+  installableSoftwareExists,
   isSoftwareEnabled,
   query,
   perPage,
   orderDirection,
   orderKey,
   softwareFilter,
+  vulnFilters,
   currentPage,
   teamId,
   isLoading,
   resetPageIndex,
+  onAddFiltersClick,
 }: ISoftwareTableProps) => {
   const currentPath = showVersions
     ? PATHS.SOFTWARE_VERSIONS
@@ -125,18 +133,18 @@ const SoftwareTable = ({
         order_direction: newTableQuery.sortDirection,
         order_key: newTableQuery.sortHeader,
         page: changedParam === "pageIndex" ? newTableQuery.pageIndex : 0,
+        ...buildSoftwareVulnFiltersQueryParams(vulnFilters),
       };
       if (softwareFilter === "installableSoftware") {
         newQueryParam.available_for_install = true.toString();
-      } else {
-        newQueryParam.vulnerable = (
-          softwareFilter === "vulnerableSoftware"
-        ).toString();
+      }
+      if (softwareFilter === "selfServiceSoftware") {
+        newQueryParam.self_service = true.toString();
       }
 
       return newQueryParam;
     },
-    [softwareFilter, teamId]
+    [softwareFilter, teamId, vulnFilters]
   );
 
   // NOTE: this is called once on initial render and every time the query changes
@@ -163,10 +171,7 @@ const SoftwareTable = ({
     [determineQueryParamChange, generateNewQueryParams, router, currentPath]
   );
 
-  let tableData:
-    | ISoftwareTitleWithPackageName[]
-    | ISoftwareVersion[]
-    | undefined;
+  let tableData: ISoftwareTitle[] | ISoftwareVersion[] | undefined;
   let generateTableConfig: ITableConfigGenerator;
 
   if (data === undefined) {
@@ -185,32 +190,33 @@ const SoftwareTable = ({
     return generateTableConfig(router, teamId);
   }, [generateTableConfig, data, router, teamId]);
 
-  // determines if a user be able to search in the table
-  const searchable =
+  // Determines if a user should be able to filter or search in the table
+  const hasData = tableData && tableData.length > 0;
+  const hasQuery = query !== "";
+  const hasSoftwareFilter = softwareFilter !== "allSoftware";
+  const hasVersionFilter = showVersions;
+  const vulnFilterDetails = getVulnFilterRenderDetails(vulnFilters);
+  const hasVulnFilters = vulnFilterDetails.filterCount > 0;
+
+  const showFilterHeaders =
     isSoftwareEnabled &&
-    ((tableData && tableData.length > 0) ||
-      query !== "" ||
-      softwareFilter !== "allSoftware");
+    (hasData ||
+      hasQuery ||
+      hasSoftwareFilter ||
+      hasVersionFilter ||
+      hasVulnFilters);
 
   const handleShowVersionsToggle = () => {
-    const queryParams: Record<string, string | number | undefined> = {
+    const queryParams: Record<string, string | number | boolean | undefined> = {
       query,
       team_id: teamId,
       order_direction: orderDirection,
       order_key: orderKey,
       page: 0, // resets page index
+      ...buildSoftwareFilterQueryParams("allSoftware"), // Reset to all software
+      ...buildSoftwareVulnFiltersQueryParams(vulnFilters),
     };
 
-    // if we are currently showing installable titles, we want to switch to
-    // all software versions. If not, we want to keep the current filter.
-    if (softwareFilter === "installableSoftware") {
-      queryParams.vulnerable = "false";
-    } else {
-      queryParams.vulnerable = (
-        softwareFilter === "vulnerableSoftware"
-      ).toString();
-    }
-
     router.replace(
       getNextLocationPath({
         pathPrefix: showVersions
@@ -231,7 +237,8 @@ const SoftwareTable = ({
       orderDirection,
       orderKey,
       page: 0, // resets page index
-      ...getSoftwareFilterForQueryKey(value),
+      ...buildSoftwareVulnFiltersQueryParams(vulnFilters),
+      ...buildSoftwareFilterQueryParams(value),
     };
 
     router.replace(
@@ -262,7 +269,7 @@ const SoftwareTable = ({
   };
 
   const renderSoftwareCount = () => {
-    if (!tableData || !data?.count) return null;
+    if (!tableData || !data) return null;
 
     return (
       <>
@@ -283,56 +290,59 @@ const SoftwareTable = ({
     );
   };
 
-  const renderCustomFilters = () => {
-    // Hide filters if no software is detected with no filters present
-    if (
-      query === "" &&
-      !showVersions &&
-      softwareFilter === "allSoftware" &&
-      data?.count === 0
-    )
-      return <></>;
-
-    const options = showVersions
-      ? SOFTWARE_VERSIONS_DROPDOWN_OPTIONS
-      : SOFTWARE_TITLES_DROPDOWN_OPTIONS;
-
+  const renderCustomControls = () => {
     return (
       <div className={`${baseClass}__filter-controls`}>
-        <div className={`${baseClass}__version-slider`}>
-          {/* div required dropdown form field width bug */}
-          <Slider
-            value={showVersions}
-            onChange={handleShowVersionsToggle}
-            inactiveText="Show versions"
-            activeText="Show versions"
+        {!showVersions && ( // Hidden when viewing versions table
+          <Dropdown
+            value={softwareFilter}
+            className={`${baseClass}__vuln_dropdown`}
+            options={SOFTWARE_TITLES_DROPDOWN_OPTIONS}
+            searchable={false}
+            onChange={handleCustomFilterDropdownChange}
+            tableFilterDropdown
           />
-        </div>
-        <Dropdown
-          value={softwareFilter}
-          className={`${baseClass}__vuln_dropdown`}
-          options={options}
-          searchable={false}
-          onChange={handleCustomFilterDropdownChange}
-          tableFilterDropdown
+        )}
+        <Slider
+          value={showVersions}
+          onChange={handleShowVersionsToggle}
+          inactiveText="Show versions"
+          activeText="Show versions"
         />
       </div>
     );
   };
 
-  const renderTableFooter = () => {
+  const renderCustomFiltersButton = () => {
     return (
-      <div>
-        Seeing unexpected software or vulnerabilities?{" "}
-        <CustomLink
-          url={GITHUB_NEW_ISSUE_LINK}
-          text="File an issue on GitHub"
-          newTab
-        />
-      </div>
+      <TooltipWrapper
+        className={`${baseClass}__filters`}
+        position="left"
+        underline={false}
+        showArrow
+        tipOffset={12}
+        tipContent={vulnFilterDetails.tooltipText}
+        disableTooltip={!hasVulnFilters}
+      >
+        <Button variant="text-link" onClick={onAddFiltersClick}>
+          <Icon name="filter" color="core-fleet-blue" />
+          <span>{vulnFilterDetails.buttonText}</span>
+        </Button>
+      </TooltipWrapper>
     );
   };
 
+  const renderTableHelpText = () => (
+    <div>
+      Seeing unexpected software or vulnerabilities?{" "}
+      <CustomLink
+        url={GITHUB_NEW_ISSUE_LINK}
+        text="File an issue on GitHub"
+        newTab
+      />
+    </div>
+  );
+
   return (
     <div className={baseClass}>
       <TableContainer
@@ -343,8 +353,10 @@ const SoftwareTable = ({
         emptyComponent={() => (
           <EmptySoftwareTable
             softwareFilter={softwareFilter}
+            vulnFilters={vulnFilters}
             isSoftwareDisabled={!isSoftwareEnabled}
-            isNotDetectingSoftware={query === ""}
+            noSearchQuery={query === ""}
+            installableSoftwareExists={installableSoftwareExists}
           />
         )}
         defaultSortHeader={orderKey}
@@ -356,17 +368,20 @@ const SoftwareTable = ({
         showMarkAllPages={false}
         isAllPagesSelected={false}
         disableNextPage={!data?.meta.has_next_results}
-        searchable={searchable}
-        inputPlaceHolder="Search by name or vulnerabilities (CVEs)"
+        searchable={showFilterHeaders}
+        inputPlaceHolder="Search by name or vulnerability (CVE)"
         onQueryChange={onQueryChange}
         // additionalQueries serves as a trigger for the useDeepEffect hook
         // to fire onQueryChange for events happeing outside of
         // the TableContainer.
         // additionalQueries={softwareFilter}
-        customControl={searchable ? renderCustomFilters : undefined}
+        customControl={showFilterHeaders ? renderCustomControls : undefined}
+        customFiltersButton={
+          showFilterHeaders ? renderCustomFiltersButton : undefined
+        }
         stackControls
         renderCount={renderSoftwareCount}
-        renderFooter={renderTableFooter}
+        renderTableHelpText={renderTableHelpText}
         disableMultiRowSelect
         onSelectSingleRow={handleRowSelect}
         resetPageIndex={resetPageIndex}
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTitlesTableConfig.tsx b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTitlesTableConfig.tsx
index 00839a7748e8..f9758cb3ba3e 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTitlesTableConfig.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTitlesTableConfig.tsx
@@ -3,8 +3,9 @@ import { CellProps, Column } from "react-table";
 import { InjectedRouter } from "react-router";
 
 import {
-  ISoftwareTitleWithPackageName,
+  ISoftwareTitle,
   formatSoftwareType,
+  isIpadOrIphoneSoftwareSource,
 } from "interfaces/software";
 import PATHS from "router/paths";
 
@@ -22,20 +23,17 @@ import VulnerabilitiesCell from "../../components/VulnerabilitiesCell";
 // NOTE: cellProps come from react-table
 // more info here https://react-table.tanstack.com/docs/api/useTable#cell-properties
 
-type ISoftwareTitlesTableConfig = Column<ISoftwareTitleWithPackageName>;
-type ITableStringCellProps = IStringCellProps<ISoftwareTitleWithPackageName>;
-type IVersionsCellProps = CellProps<
-  ISoftwareTitleWithPackageName,
-  ISoftwareTitleWithPackageName["versions"]
->;
+type ISoftwareTitlesTableConfig = Column<ISoftwareTitle>;
+type ITableStringCellProps = IStringCellProps<ISoftwareTitle>;
+type IVersionsCellProps = CellProps<ISoftwareTitle, ISoftwareTitle["versions"]>;
 type IVulnerabilitiesCellProps = IVersionsCellProps;
 type IHostCountCellProps = CellProps<
-  ISoftwareTitleWithPackageName,
-  ISoftwareTitleWithPackageName["hosts_count"]
+  ISoftwareTitle,
+  ISoftwareTitle["hosts_count"]
 >;
-type IViewAllHostsLinkProps = CellProps<ISoftwareTitleWithPackageName>;
+type IViewAllHostsLinkProps = CellProps<ISoftwareTitle>;
 
-type ITableHeaderProps = IHeaderProps<ISoftwareTitleWithPackageName>;
+type ITableHeaderProps = IHeaderProps<ISoftwareTitle>;
 
 export const getVulnerabilities = <
   T extends { vulnerabilities: string[] | null }
@@ -57,6 +55,43 @@ export const getVulnerabilities = <
   return vulnerabilities;
 };
 
+/**
+ * Gets the data needed to render the software name cell.
+ */
+const getSoftwareNameCellData = (
+  softwareTitle: ISoftwareTitle,
+  teamId?: number
+) => {
+  const teamQueryParam = buildQueryStringFromParams({ team_id: teamId });
+  const softwareTitleDetailsPath = `${PATHS.SOFTWARE_TITLE_DETAILS(
+    softwareTitle.id.toString()
+  )}?${teamQueryParam}`;
+
+  const { software_package, app_store_app } = softwareTitle;
+  let hasPackage = false;
+  let isSelfService = false;
+  let iconUrl: string | null = null;
+  if (software_package) {
+    hasPackage = true;
+    isSelfService = software_package.self_service;
+  } else if (app_store_app) {
+    hasPackage = true;
+    isSelfService = app_store_app.self_service;
+    iconUrl = app_store_app.icon_url;
+  }
+
+  const isAllTeams = teamId === undefined;
+
+  return {
+    name: softwareTitle.name,
+    source: softwareTitle.source,
+    path: softwareTitleDetailsPath,
+    hasPackage: hasPackage && !isAllTeams,
+    isSelfService,
+    iconUrl,
+  };
+};
+
 const generateTableHeaders = (
   router: InjectedRouter,
   teamId?: number
@@ -69,42 +104,25 @@ const generateTableHeaders = (
       disableSortBy: false,
       accessor: "name",
       Cell: (cellProps: ITableStringCellProps) => {
-        const {
-          id,
-          name,
-          source,
-          software_package,
-          self_service,
-        } = cellProps.row.original;
-
-        const teamQueryParam = buildQueryStringFromParams({ team_id: teamId });
-        const softwareTitleDetailsPath = `${PATHS.SOFTWARE_TITLE_DETAILS(
-          id.toString()
-        )}?${teamQueryParam}`;
-
-        const hasPackage = Boolean(software_package) && !!teamId; // teamId is required for package installation
+        const nameCellData = getSoftwareNameCellData(
+          cellProps.row.original,
+          teamId
+        );
 
         return (
           <SoftwareNameCell
-            name={name}
-            source={source}
-            path={softwareTitleDetailsPath}
+            name={nameCellData.name}
+            source={nameCellData.source}
+            path={nameCellData.path}
             router={router}
-            hasPackage={hasPackage}
-            isSelfService={self_service === true}
+            hasPackage={nameCellData.hasPackage}
+            isSelfService={nameCellData.isSelfService}
+            iconUrl={nameCellData.iconUrl ?? undefined}
           />
         );
       },
       sortType: "caseInsensitive",
     },
-    {
-      Header: "Type",
-      disableSortBy: true,
-      accessor: "source",
-      Cell: (cellProps: ITableStringCellProps) => (
-        <TextCell value={formatSoftwareType(cellProps.row.original)} />
-      ),
-    },
     {
       Header: "Version",
       disableSortBy: true,
@@ -113,6 +131,14 @@ const generateTableHeaders = (
         <VersionCell versions={cellProps.cell.value} />
       ),
     },
+    {
+      Header: "Type",
+      disableSortBy: true,
+      accessor: "source",
+      Cell: (cellProps: ITableStringCellProps) => (
+        <TextCell value={formatSoftwareType(cellProps.row.original)} />
+      ),
+    },
     // the "vulnerabilities" accessor is used but the data is actually coming
     // from the version attribute. We do this as we already have a "versions"
     // attribute used for the "Version" column and we cannot reuse. This is a
@@ -123,6 +149,9 @@ const generateTableHeaders = (
       Header: "Vulnerabilities",
       disableSortBy: true,
       Cell: (cellProps: IVulnerabilitiesCellProps) => {
+        if (isIpadOrIphoneSoftwareSource(cellProps.row.original.source)) {
+          return <TextCell value="Not supported" grey />;
+        }
         const vulnerabilities = getVulnerabilities(
           cellProps.row.original.versions ?? []
         );
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareVersionsTableConfig.tsx b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareVersionsTableConfig.tsx
index d22aab9e86d1..0be57bf962a9 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareVersionsTableConfig.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareVersionsTableConfig.tsx
@@ -64,28 +64,33 @@ const generateTableHeaders = (
       sortType: "caseInsensitive",
     },
     {
-      Header: "Type",
+      Header: "Version",
       disableSortBy: true,
-      accessor: "source",
+      accessor: "version",
       Cell: (cellProps: ITableStringCellProps) => (
-        <TextCell value={formatSoftwareType(cellProps.row.original)} />
+        <TextCell value={cellProps.cell.value} />
       ),
     },
     {
-      Header: "Version",
+      Header: "Type",
       disableSortBy: true,
-      accessor: "version",
+      accessor: "source",
       Cell: (cellProps: ITableStringCellProps) => (
-        <TextCell value={cellProps.cell.value} />
+        <TextCell value={formatSoftwareType(cellProps.row.original)} />
       ),
     },
     {
       Header: "Vulnerabilities",
       disableSortBy: true,
       accessor: "vulnerabilities",
-      Cell: (cellProps: IVulnerabilitiesCellProps) => (
-        <VulnerabilitiesCell vulnerabilities={cellProps.cell.value} />
-      ),
+      Cell: (cellProps: IVulnerabilitiesCellProps) => {
+        if (
+          ["ipados_apps", "ios_apps"].includes(cellProps.row.original.source)
+        ) {
+          return <TextCell value="Not supported" grey />;
+        }
+        return <VulnerabilitiesCell vulnerabilities={cellProps.cell.value} />;
+      },
     },
     {
       Header: (cellProps: ITableHeaderProps) => (
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/_styles.scss b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/_styles.scss
index 0727dfe0bd33..8e413e481868 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/_styles.scss
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/_styles.scss
@@ -25,9 +25,15 @@
     gap: $pad-medium;
   }
 
-  // Fix dropdown form bug
-  &__version-slider {
-    width: 210px;
+  &__filters {
+    .component__tooltip-wrapper__element {
+      display: flex;
+      align-items: center;
+    }
+
+    .children-wrapper {
+      gap: $pad-small;
+    }
   }
 
   .table-container {
@@ -46,6 +52,9 @@
         .form-field--dropdown {
           margin: 0;
         }
+        .form-field {
+          width: initial; // Negate form-field styling on slider
+        }
       }
     }
 
@@ -61,7 +70,7 @@
         width: auto;
 
         .input-icon-field__input {
-          width: 375px;
+          width: 310px; // Any wider would run up against time ago header
         }
       }
     }
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers.tests.ts b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers.tests.ts
new file mode 100644
index 000000000000..aed9762f450c
--- /dev/null
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers.tests.ts
@@ -0,0 +1,49 @@
+import { isValidNumber } from "./helpers";
+
+describe("isValidNumber", () => {
+  // Test valid numbers
+  it("returns true for valid numbers", () => {
+    expect(isValidNumber(0)).toBe(true);
+    expect(isValidNumber(42)).toBe(true);
+    expect(isValidNumber(-10)).toBe(true);
+    expect(isValidNumber(3.14)).toBe(true);
+  });
+
+  // Test invalid inputs
+  it("returns false for non-number inputs", () => {
+    expect(isValidNumber("42")).toBe(false);
+    expect(isValidNumber(null)).toBe(false);
+    expect(isValidNumber(undefined)).toBe(false);
+    expect(isValidNumber({})).toBe(false);
+    expect(isValidNumber([])).toBe(false);
+    expect(isValidNumber(true)).toBe(false);
+  });
+
+  // Test NaN
+  it("returns false for NaN", () => {
+    expect(isValidNumber(NaN)).toBe(false);
+  });
+
+  // Test with min value
+  it("respects min value when provided", () => {
+    expect(isValidNumber(5, 0)).toBe(true);
+    expect(isValidNumber(5, 5)).toBe(true);
+    expect(isValidNumber(5, 6)).toBe(false);
+  });
+
+  // Test with max value
+  it("respects max value when provided", () => {
+    expect(isValidNumber(5, undefined, 10)).toBe(true);
+    expect(isValidNumber(5, undefined, 5)).toBe(true);
+    expect(isValidNumber(5, undefined, 4)).toBe(false);
+  });
+
+  // Test with both min and max values
+  it("respects both min and max values when provided", () => {
+    expect(isValidNumber(5, 0, 10)).toBe(true);
+    expect(isValidNumber(0, 0, 10)).toBe(true);
+    expect(isValidNumber(10, 0, 10)).toBe(true);
+    expect(isValidNumber(-1, 0, 10)).toBe(false);
+    expect(isValidNumber(11, 0, 10)).toBe(false);
+  });
+});
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers.ts b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers.ts
index 5cdc0fcde95a..b4dacf1c7d03 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers.ts
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers.ts
@@ -1,29 +1,23 @@
-import { QueryParams } from "utilities/url";
+import { QueryParams, parseQueryValueToNumberOrUndefined } from "utilities/url";
+import stringUtils from "utilities/strings/stringUtils";
+import { tooltipTextWithLineBreaks } from "utilities/helpers";
 
 export type ISoftwareDropdownFilterVal =
   | "allSoftware"
-  | "vulnerableSoftware"
   | "installableSoftware"
   | "selfServiceSoftware";
 
-export const SOFTWARE_VERSIONS_DROPDOWN_OPTIONS = [
+export type IHostSoftwareDropdownFilterVal =
+  | ISoftwareDropdownFilterVal
+  | "vulnerableSoftware";
+
+export const SOFTWARE_TITLES_DROPDOWN_OPTIONS = [
   {
     disabled: false,
     label: "All software",
     value: "allSoftware",
     helpText: "All software installed on your hosts.",
   },
-  {
-    disabled: false,
-    label: "Vulnerable software",
-    value: "vulnerableSoftware",
-    helpText:
-      "All software installed on your hosts with detected vulnerabilities.",
-  },
-];
-
-export const SOFTWARE_TITLES_DROPDOWN_OPTIONS = [
-  ...SOFTWARE_VERSIONS_DROPDOWN_OPTIONS,
   {
     disabled: false,
     label: "Available for install",
@@ -38,7 +32,50 @@ export const SOFTWARE_TITLES_DROPDOWN_OPTIONS = [
   },
 ];
 
-export const getSoftwareFilterForQueryKey = (
+export const SEVERITY_DROPDOWN_OPTIONS = [
+  {
+    disabled: false,
+    label: "Any severity",
+    value: "any",
+    helpText: "CVSS score 0-10",
+    minSeverity: undefined,
+    maxSeverity: undefined,
+  },
+  {
+    disabled: false,
+    label: "Low severity",
+    value: "low",
+    helpText: "CVSS score 0.1-3.9",
+    minSeverity: 0.1,
+    maxSeverity: 3.9,
+  },
+  {
+    disabled: false,
+    label: "Medium severity",
+    value: "medium",
+    helpText: "CVSS score 4.0-6.9",
+    minSeverity: 4.0,
+    maxSeverity: 6.9,
+  },
+  {
+    disabled: false,
+    label: "High severity",
+    value: "high",
+    helpText: "CVSS score 7.0-8.9",
+    minSeverity: 7.0,
+    maxSeverity: 8.9,
+  },
+  {
+    disabled: false,
+    label: "Critical severity",
+    value: "critical",
+    helpText: "CVSS score 9.0-10",
+    minSeverity: 9.0,
+    maxSeverity: 10,
+  },
+];
+
+export const buildSoftwareFilterQueryParams = (
   val: ISoftwareDropdownFilterVal
 ) => {
   switch (val) {
@@ -46,23 +83,142 @@ export const getSoftwareFilterForQueryKey = (
       return { availableForInstall: true };
     case "selfServiceSoftware":
       return { selfService: true };
-    case "vulnerableSoftware":
-      return { vulnerable: true };
     default:
       return {};
   }
 };
 
 export const getSoftwareFilterFromQueryParams = (queryParams: QueryParams) => {
-  const { vulnerable, available_for_install, self_service } = queryParams;
+  const { available_for_install, self_service } = queryParams;
   switch (true) {
     case available_for_install === "true":
       return "installableSoftware";
     case self_service === "true":
       return "selfServiceSoftware";
-    case vulnerable === "true":
-      return "vulnerableSoftware";
     default:
       return "allSoftware";
   }
 };
+
+export const getSoftwareVulnFiltersFromQueryParams = (
+  queryParams: QueryParams
+) => {
+  const { vulnerable, exploit, min_cvss_score, max_cvss_score } = queryParams;
+
+  return {
+    vulnerable: stringUtils.strToBool(vulnerable as string),
+    exploit: stringUtils.strToBool(exploit as string),
+    minCvssScore: parseQueryValueToNumberOrUndefined(min_cvss_score, 0, 10),
+    maxCvssScore: parseQueryValueToNumberOrUndefined(max_cvss_score, 0, 10),
+  };
+};
+
+export type ISoftwareVulnFilters = {
+  vulnerable?: boolean;
+  exploit?: boolean;
+  min_cvss_score?: number;
+  max_cvss_score?: number;
+};
+
+export type ISoftwareVulnFiltersParams = {
+  vulnerable?: boolean;
+  exploit?: boolean;
+  minCvssScore?: number;
+  maxCvssScore?: number;
+};
+
+export const isValidNumber = (
+  value: any,
+  min?: number,
+  max?: number
+): value is number => {
+  // Check if the value is a number and not NaN
+  const isNumber = typeof value === "number" && !isNaN(value);
+
+  // If min or max is provided, check if the number is within the range
+  const withinRange =
+    (min === undefined || value >= min) && (max === undefined || value <= max);
+
+  return isNumber && withinRange;
+};
+
+export const buildSoftwareVulnFiltersQueryParams = (
+  vulnFilters: ISoftwareVulnFiltersParams
+) => {
+  const { vulnerable, exploit, minCvssScore, maxCvssScore } = vulnFilters;
+
+  if (!vulnerable) {
+    return {};
+  }
+
+  return {
+    vulnerable: true,
+    ...(exploit && { exploit: true }),
+    ...(isValidNumber(minCvssScore, 0, maxCvssScore || 10) && {
+      min_cvss_score: minCvssScore.toString(),
+    }),
+    ...(isValidNumber(maxCvssScore, minCvssScore || 0, 10) && {
+      max_cvss_score: maxCvssScore.toString(),
+    }),
+  };
+};
+
+export const findOptionBySeverityRange = (
+  minSeverityValue: number | undefined,
+  maxSeverityValue: number | undefined
+) => {
+  const severityOption = SEVERITY_DROPDOWN_OPTIONS.find(
+    (option) =>
+      option.minSeverity === minSeverityValue &&
+      option.maxSeverity === maxSeverityValue
+  ) || {
+    disabled: true,
+    label: "Custom severity",
+    value: "custom",
+    helpText: `CVSS score ${minSeverityValue || 0}-${maxSeverityValue || 10}`,
+    minSeverity: minSeverityValue || 0,
+    maxSeverity: maxSeverityValue || 10,
+  };
+
+  return severityOption;
+};
+
+export const getVulnFilterRenderDetails = (
+  vulnFilters?: ISoftwareVulnFiltersParams
+) => {
+  let filterCount = 0;
+  const tooltipText = [];
+
+  if (vulnFilters) {
+    if (vulnFilters.vulnerable) {
+      filterCount += 1;
+      tooltipText.push("Vulnerable software");
+
+      if (vulnFilters.minCvssScore || vulnFilters.maxCvssScore) {
+        filterCount += 1;
+        const severityOption = findOptionBySeverityRange(
+          vulnFilters.minCvssScore,
+          vulnFilters.maxCvssScore
+        );
+        const severityText = stringUtils.capitalize(severityOption?.value);
+        tooltipText.push(`Severity: ${severityText}`);
+      }
+
+      if (vulnFilters.exploit) {
+        filterCount += 1;
+        tooltipText.push("Has known exploit");
+      }
+    }
+  }
+
+  const buttonText =
+    filterCount > 0
+      ? `${filterCount} filter${filterCount > 1 ? "s" : ""}`
+      : "Add filters";
+
+  return {
+    filterCount,
+    buttonText,
+    tooltipText: tooltipTextWithLineBreaks(tooltipText),
+  };
+};
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTitles.tsx b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTitles.tsx
index 1a90c284f5ce..4d28342bcbe5 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTitles.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTitles.tsx
@@ -21,7 +21,8 @@ import TableDataError from "components/DataError";
 import SoftwareTable from "./SoftwareTable";
 import {
   ISoftwareDropdownFilterVal,
-  getSoftwareFilterForQueryKey,
+  ISoftwareVulnFilters,
+  buildSoftwareFilterQueryParams,
 } from "./SoftwareTable/helpers";
 
 const baseClass = "software-titles";
@@ -40,9 +41,12 @@ interface ISoftwareTitlesProps {
   orderDirection: "asc" | "desc";
   orderKey: string;
   softwareFilter: ISoftwareDropdownFilterVal;
+  vulnFilters: ISoftwareVulnFilters;
   currentPage: number;
   teamId?: number;
   resetPageIndex: boolean;
+  addedSoftwareToken: string | null;
+  onAddFiltersClick: () => void;
 }
 
 const SoftwareTitles = ({
@@ -53,13 +57,16 @@ const SoftwareTitles = ({
   orderDirection,
   orderKey,
   softwareFilter,
+  vulnFilters,
   currentPage,
   teamId,
   resetPageIndex,
+  addedSoftwareToken,
+  onAddFiltersClick,
 }: ISoftwareTitlesProps) => {
   const showVersions = location.pathname === PATHS.SOFTWARE_VERSIONS;
 
-  // request to get software data
+  // for Titles view, request to get software data
   const {
     data: titlesData,
     isFetching: isTitlesFetching,
@@ -80,7 +87,9 @@ const SoftwareTitles = ({
         orderDirection,
         orderKey,
         teamId,
-        ...getSoftwareFilterForQueryKey(softwareFilter),
+        addedSoftwareToken,
+        ...vulnFilters,
+        ...buildSoftwareFilterQueryParams(softwareFilter),
       },
     ],
     ({ queryKey: [queryKey] }) =>
@@ -91,7 +100,9 @@ const SoftwareTitles = ({
     }
   );
 
-  // request to get software versions data
+  // For Versions view, request software versions data. If empty, request titles available for
+  // install to determine empty state copy
+
   const {
     data: versionsData,
     isFetching: isVersionsFetching,
@@ -112,7 +123,8 @@ const SoftwareTitles = ({
         orderDirection,
         orderKey,
         teamId,
-        vulnerable: softwareFilter === "vulnerableSoftware",
+        addedSoftwareToken,
+        ...vulnFilters,
       },
     ],
     ({ queryKey: [queryKey] }) =>
@@ -123,11 +135,46 @@ const SoftwareTitles = ({
     }
   );
 
-  if (isTitlesLoading || isVersionsLoading) {
+  const {
+    data: titlesAvailableForInstallResponse,
+    isFetching: isTitlesAFIFetching,
+    isLoading: isTitlesAFILoading,
+    isError: isTitlesAFIError,
+  } = useQuery<
+    ISoftwareTitlesResponse,
+    Error,
+    ISoftwareTitlesResponse,
+    [ISoftwareTitlesQueryKey]
+  >(
+    [
+      {
+        scope: "software-titles",
+        page: 0,
+        perPage,
+        query: "",
+        orderDirection,
+        orderKey,
+        teamId,
+        availableForInstall: true,
+        ...vulnFilters,
+      },
+    ],
+    ({ queryKey: [queryKey] }) =>
+      softwareAPI.getSoftwareTitles(omit(queryKey, "scope")),
+    {
+      ...QUERY_OPTIONS,
+      enabled:
+        location.pathname === PATHS.SOFTWARE_VERSIONS &&
+        versionsData &&
+        versionsData.count === 0,
+    }
+  );
+
+  if (isTitlesLoading || isVersionsLoading || isTitlesAFILoading) {
     return <Spinner />;
   }
 
-  if (isTitlesError || isVersionsError) {
+  if (isTitlesError || isVersionsError || isTitlesAFIError) {
     return <TableDataError className={`${baseClass}__table-error`} />;
   }
 
@@ -137,6 +184,7 @@ const SoftwareTitles = ({
         router={router}
         data={showVersions ? versionsData : titlesData}
         showVersions={showVersions}
+        installableSoftwareExists={!!titlesAvailableForInstallResponse?.count}
         isSoftwareEnabled={isSoftwareEnabled}
         query={query}
         perPage={perPage}
@@ -145,8 +193,12 @@ const SoftwareTitles = ({
         softwareFilter={softwareFilter}
         currentPage={currentPage}
         teamId={teamId}
-        isLoading={isTitlesFetching || isVersionsFetching}
+        isLoading={
+          isTitlesFetching || isVersionsFetching || isTitlesAFIFetching
+        }
         resetPageIndex={resetPageIndex}
+        onAddFiltersClick={onAddFiltersClick}
+        vulnFilters={vulnFilters}
       />
     </div>
   );
diff --git a/frontend/pages/SoftwarePage/SoftwareVersionDetailsPage/SoftwareVersionDetailsPage.tsx b/frontend/pages/SoftwarePage/SoftwareVersionDetailsPage/SoftwareVersionDetailsPage.tsx
index 328713f78ca9..afb9d0ec4766 100644
--- a/frontend/pages/SoftwarePage/SoftwareVersionDetailsPage/SoftwareVersionDetailsPage.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareVersionDetailsPage/SoftwareVersionDetailsPage.tsx
@@ -18,7 +18,11 @@ import hostsCountAPI, {
   IHostsCountQueryKey,
   IHostsCountResponse,
 } from "services/entities/host_count";
-import { ISoftwareVersion, formatSoftwareType } from "interfaces/software";
+import {
+  ISoftwareVersion,
+  formatSoftwareType,
+  isIpadOrIphoneSoftwareSource,
+} from "interfaces/software";
 import { ignoreAxiosError } from "interfaces/errors";
 
 import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
@@ -31,6 +35,7 @@ import Card from "components/Card";
 import SoftwareDetailsSummary from "../components/SoftwareDetailsSummary";
 import SoftwareVulnerabilitiesTable from "../components/SoftwareVulnerabilitiesTable";
 import DetailsNoHosts from "../components/DetailsNoHosts";
+import { VulnsNotSupported } from "../components/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable";
 
 const baseClass = "software-version-details-page";
 
@@ -63,7 +68,7 @@ const SoftwareVersionDetailsPage = ({
     location,
     router,
     includeAllTeams: true,
-    includeNoTeam: false,
+    includeNoTeam: true,
   });
 
   const {
@@ -112,6 +117,22 @@ const SoftwareVersionDetailsPage = ({
     [handleTeamChange]
   );
 
+  const renderVulnTable = (swVersion: ISoftwareVersion) => {
+    if (isIpadOrIphoneSoftwareSource(swVersion.source)) {
+      const platformText = swVersion.source === "ios_apps" ? "iOS" : "iPadOS";
+      return <VulnsNotSupported platformText={platformText} />;
+    }
+    return (
+      <SoftwareVulnerabilitiesTable
+        data={swVersion.vulnerabilities ?? []}
+        itemName="software item"
+        isLoading={isSoftwareVersionLoading}
+        router={router}
+        teamIdForApi={teamIdForApi}
+      />
+    );
+  };
+
   const renderContent = () => {
     if (isSoftwareVersionLoading) {
       return <Spinner />;
@@ -134,9 +155,7 @@ const SoftwareVersionDetailsPage = ({
         {isSoftwareVersionError ? (
           <DetailsNoHosts
             header="Software not detected"
-            details={`No hosts ${
-              teamIdForApi ? "on this team " : ""
-            }have this software installed.`}
+            details="No hosts have this software installed."
           />
         ) : (
           <>
@@ -157,13 +176,7 @@ const SoftwareVersionDetailsPage = ({
               className={`${baseClass}__vulnerabilities-section`}
             >
               <h2 className="section__header">Vulnerabilities</h2>
-              <SoftwareVulnerabilitiesTable
-                data={softwareVersion.vulnerabilities ?? []}
-                itemName="software item"
-                isLoading={isSoftwareVersionLoading}
-                router={router}
-                teamIdForApi={teamIdForApi}
-              />
+              {renderVulnTable(softwareVersion)}
             </Card>
           </>
         )}
diff --git a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilities.tsx b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilities.tsx
index 845275db5b8c..3c7bdd5663f6 100644
--- a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilities.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilities.tsx
@@ -1,18 +1,27 @@
 /** software/vulnerabilities Vulnerabilities tab */
 
-import React from "react";
+import React, { useState, useEffect } from "react";
 import { useQuery } from "react-query";
 import { InjectedRouter } from "react-router";
-import {
+import { AxiosError } from "axios";
+import softwareVulnAPI, {
   IGetVulnerabilitiesQueryKey,
   IVulnerabilitiesResponse,
+  IGetVulnerabilityQueryKey,
+  IVulnerabilityResponse,
   getVulnerabilities,
+  IVulnerabilitiesEmptyStateReason,
 } from "services/entities/vulnerabilities";
+import { IApiError } from "interfaces/errors";
+
+import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
+import { stripQuotes } from "utilities/strings/stringUtils";
 
 import TableDataError from "components/DataError";
 import Spinner from "components/Spinner";
 
 import SoftwareVulnerabilitiesTable from "./SoftwareVulnerabilitiesTable";
+import { isValidCVEFormat } from "./SoftwareVulnerabilitiesTable/helpers";
 
 const baseClass = "software-vulnerabilities";
 
@@ -41,6 +50,12 @@ const SoftwareVulnerabilities = ({
   showExploitedVulnerabilitiesOnly,
   resetPageIndex,
 }: ISoftwareVulnerabilitiesProps) => {
+  const [tableData, setTableData] = useState<IVulnerabilitiesResponse>();
+  const [
+    emptyStateReason,
+    setEmptyStateReason,
+  ] = useState<IVulnerabilitiesEmptyStateReason>();
+
   const queryParams = {
     page: currentPage,
     per_page: perPage,
@@ -51,7 +66,15 @@ const SoftwareVulnerabilities = ({
     exploit: showExploitedVulnerabilitiesOnly,
   };
 
-  const { data, isFetching, isLoading, isError } = useQuery<
+  const isExactMatchQuery = (() => {
+    if (query) {
+      const pattern = /^(['"]).*\1$/;
+      return pattern.test(query);
+    }
+    return false;
+  })();
+
+  const { isFetching, isLoading, isError } = useQuery<
     IVulnerabilitiesResponse,
     Error,
     IVulnerabilitiesResponse,
@@ -66,11 +89,156 @@ const SoftwareVulnerabilities = ({
     () => getVulnerabilities(queryParams),
     {
       keepPreviousData: true,
-      staleTime: 30000,
+      enabled: !isExactMatchQuery && isSoftwareEnabled,
+      onSuccess: (data) => {
+        setTableData(data);
+        if (data.count === 0) {
+          if (
+            queryParams.exploit ||
+            (queryParams.query && queryParams.query.length > 0)
+          ) {
+            setEmptyStateReason("no-matching-items");
+          } else {
+            setEmptyStateReason("no-vulns-detected");
+          }
+        }
+      },
+    }
+  );
+
+  // Calling software/vulnerabilities/:CVE endpoint when user searches with quotation marks
+  const {
+    isLoading: isLoadingExactMatch,
+    isFetching: isFetchingExactMatch,
+    refetch: refetchExactMatch,
+  } = useQuery<
+    IVulnerabilityResponse | null,
+    AxiosError<IApiError>,
+    IVulnerabilityResponse,
+    IGetVulnerabilityQueryKey[]
+  >(
+    [
+      {
+        scope: "softwareVulnByCVE",
+        vulnerability: (query && stripQuotes(query)) || "",
+        teamId,
+      },
+    ],
+    ({ queryKey }) => {
+      // Revisit: Refactor to return status alongside data and check for 204 instead of !data
+      return softwareVulnAPI.getVulnerability(queryKey[0]);
+    },
+    {
+      ...DEFAULT_USE_QUERY_OPTIONS,
+      retry: false,
+      onSuccess: (data) => {
+        // Handle 204 response which doesn't return data if it is a known CVE but doesn't exist in response
+        if (!data) {
+          setTableData({
+            count: 0,
+            counts_updated_at: "",
+            vulnerabilities: [],
+            meta: {
+              has_next_results: false,
+              has_previous_results: false,
+            },
+          });
+          setEmptyStateReason("known-vuln");
+        }
+        // If filtering for exploited vulns, hide vulnerability if cisa_known_exploit is false
+        else if (
+          queryParams.exploit &&
+          !data.vulnerability.cisa_known_exploit
+        ) {
+          setTableData({
+            count: 0,
+            counts_updated_at: "",
+            vulnerabilities: [],
+            meta: {
+              has_next_results: false,
+              has_previous_results: false,
+            },
+          });
+          setEmptyStateReason("no-matching-items");
+          // Otherwise return IVulnerabilityResponse as IVulnerabilitiesResponse format
+        } else {
+          setTableData({
+            count: 1,
+            counts_updated_at: data.vulnerability.hosts_count_updated_at,
+            vulnerabilities: [data.vulnerability],
+            meta: {
+              has_next_results: false,
+              has_previous_results: false,
+            },
+          });
+        }
+      },
+      onError: (err) => {
+        // Type assertion for failing "Property 'data' does not exist on type 'AxiosError<IApiError, any>"
+        const error = err as AxiosError<IApiError> & {
+          data?: IApiError;
+        };
+
+        // Handle 400 response which is an invalid CVE format
+        if (error.status === 400) {
+          if (
+            error?.data?.errors &&
+            error.data.errors[0].reason.includes(
+              "That vulnerability (CVE) is not valid."
+            )
+          ) {
+            setTableData({
+              count: 0,
+              counts_updated_at: "",
+              vulnerabilities: [],
+              meta: {
+                has_next_results: false,
+                has_previous_results: false,
+              },
+            });
+            setEmptyStateReason("invalid-cve");
+          }
+
+          // Handle 404 response which is BE validated CVE string but not a known CVE
+        } else if (error.status === 404) {
+          if (
+            error?.data?.errors &&
+            (error.data.errors[0].reason.includes("This is not a known CVE.") ||
+              error.data.errors[0].reason.includes(
+                "was not found in the datastore"
+              ))
+          ) {
+            // FE validatation for CVE string
+            if (query && !isValidCVEFormat(stripQuotes(query))) {
+              setEmptyStateReason("invalid-cve");
+            } else {
+              setEmptyStateReason("unknown-cve");
+            }
+          }
+          setTableData({
+            count: 0,
+            counts_updated_at: "",
+            vulnerabilities: [],
+            meta: {
+              has_next_results: false,
+              has_previous_results: false,
+            },
+          });
+        }
+      },
+      enabled: isExactMatchQuery && isSoftwareEnabled,
     }
   );
 
-  if (isLoading) {
+  // If a user toggles between exact exploit and non-exploit,
+  // we need the table data to recheck cisa_known_exploit and populate accordingly
+  useEffect(() => {
+    if (isExactMatchQuery) {
+      refetchExactMatch();
+    }
+  }, [queryParams.exploit, isExactMatchQuery]);
+
+  if (isLoading || isLoadingExactMatch) {
     return <Spinner />;
   }
 
@@ -82,7 +250,8 @@ const SoftwareVulnerabilities = ({
     <div className={baseClass}>
       <SoftwareVulnerabilitiesTable
         router={router}
-        data={data}
+        data={tableData}
+        emptyStateReason={emptyStateReason}
         query={query}
         showExploitedVulnerabilitiesOnly={showExploitedVulnerabilitiesOnly}
         isSoftwareEnabled={isSoftwareEnabled}
@@ -91,7 +260,7 @@ const SoftwareVulnerabilities = ({
         orderKey={orderKey}
         currentPage={currentPage}
         teamId={teamId}
-        isLoading={isFetching}
+        isLoading={isFetching || isFetchingExactMatch}
         resetPageIndex={resetPageIndex}
       />
     </div>
diff --git a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tests.tsx b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tests.tsx
index 0ec5fcd96bf6..2e869892d182 100644
--- a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tests.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tests.tsx
@@ -1,9 +1,11 @@
 import React from "react";
 import { screen, waitFor } from "@testing-library/react";
-import { noop } from "lodash";
 import { createCustomRenderer } from "test/test-utils";
 
-import { createMockVulnerabilitiesResponse } from "__mocks__/vulnerabilitiesMock";
+import {
+  createMockVulnerabilitiesResponse,
+  createMockVulnerability,
+} from "__mocks__/vulnerabilitiesMock";
 import createMockUser from "__mocks__/userMock";
 
 import SoftwareVulnerabilitiesTable from "./SoftwareVulnerabilitiesTable";
@@ -22,7 +24,7 @@ const mockRouter = {
 };
 
 describe("Software Vulnerabilities table", () => {
-  it("Renders the page-wide disabled state when software inventory is disabled", async () => {
+  it("Renders the page-wide disabled state when software inventory is disabled", () => {
     const render = createCustomRenderer({
       context: {
         app: {
@@ -60,7 +62,7 @@ describe("Software Vulnerabilities table", () => {
   });
 
   // TODO: Reinstate collecting software view
-  it("Renders the page-wide empty state when no software vulnerabilities are present", async () => {
+  it("Renders the page-wide empty state when no software vulnerabilities are present", () => {
     const render = createCustomRenderer({
       context: {
         app: {
@@ -82,6 +84,7 @@ describe("Software Vulnerabilities table", () => {
             has_previous_results: false,
           },
         })}
+        emptyStateReason="no-vulns-detected"
         query=""
         perPage={20}
         orderDirection="asc"
@@ -93,11 +96,15 @@ describe("Software Vulnerabilities table", () => {
       />
     );
 
-    expect(screen.getByText("No software detected")).toBeInTheDocument();
+    expect(screen.getByText("No vulnerabilities detected")).toBeInTheDocument();
+    expect(screen.getByText("0 items")).toBeInTheDocument();
+    expect(
+      screen.getByText("Expecting to see vulnerabilities? Check back later.")
+    ).toBeInTheDocument();
     expect(screen.queryByText("Vulnerability")).toBeNull();
   });
 
-  it("Renders the empty search state when search query exists for server side search with no results", async () => {
+  it("Renders the empty search state when search query does not exist but exploited vulnerabilities dropdown is applied", () => {
     const render = createCustomRenderer({
       context: {
         app: {
@@ -119,11 +126,11 @@ describe("Software Vulnerabilities table", () => {
             has_previous_results: false,
           },
         })}
-        query="abcdefg"
+        query=""
         perPage={20}
         orderDirection="asc"
         orderKey="hosts_count"
-        showExploitedVulnerabilitiesOnly={false}
+        showExploitedVulnerabilitiesOnly
         currentPage={0}
         isLoading={false}
         resetPageIndex={false}
@@ -133,10 +140,144 @@ describe("Software Vulnerabilities table", () => {
     expect(
       screen.getByText("No items match the current search criteria")
     ).toBeInTheDocument();
+    expect(
+      screen.getByText("Expecting to see vulnerabilities? Check back later.")
+    ).toBeInTheDocument();
+    expect(screen.queryByText("Vulnerability")).toBeNull();
+  });
+
+  it("Renders the invalid CVE empty search state when search query wrapped in quotes is invalid with no results", () => {
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          isGlobalAdmin: true,
+          currentUser: createMockUser(),
+        },
+      },
+    });
+
+    render(
+      <SoftwareVulnerabilitiesTable
+        router={mockRouter}
+        isSoftwareEnabled
+        data={createMockVulnerabilitiesResponse({
+          count: 0,
+          vulnerabilities: null,
+          meta: {
+            has_next_results: false,
+            has_previous_results: false,
+          },
+        })}
+        emptyStateReason="invalid-cve"
+        query='"abcdefg"'
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        showExploitedVulnerabilitiesOnly={false}
+        currentPage={0}
+        isLoading={false}
+        resetPageIndex={false}
+      />
+    );
+
+    expect(
+      screen.getByText("That vulnerability (CVE) is not valid")
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText(/Try updating your search to use CVE format:/i)
+    ).toBeInTheDocument();
     expect(screen.queryByText("Vulnerability")).toBeNull();
   });
 
-  it("Renders premium columns", async () => {
+  it("Renders the valid known CVE empty search state when search query wrapped in quotes is valid known CVE with no results", () => {
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          isGlobalAdmin: true,
+          currentUser: createMockUser(),
+        },
+      },
+    });
+
+    render(
+      <SoftwareVulnerabilitiesTable
+        router={mockRouter}
+        isSoftwareEnabled
+        data={createMockVulnerabilitiesResponse({
+          count: 0,
+          vulnerabilities: null,
+          meta: {
+            has_next_results: false,
+            has_previous_results: false,
+          },
+        })}
+        emptyStateReason="known-vuln"
+        query='"cve-2002-1000"'
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        showExploitedVulnerabilitiesOnly={false}
+        currentPage={0}
+        isLoading={false}
+        resetPageIndex={false}
+      />
+    );
+
+    expect(
+      screen.getByText(
+        "This is a known vulnerability (CVE), but it wasn't detected on any hosts"
+      )
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText("Expecting to see vulnerabilities? Check back later.")
+    ).toBeInTheDocument();
+    expect(screen.queryByText("Vulnerability")).toBeNull();
+  });
+
+  it("Renders the valid unknown CVE empty search state when search query wrapped in quotes is not a valid known CVE with no results", () => {
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          isGlobalAdmin: true,
+          currentUser: createMockUser(),
+        },
+      },
+    });
+
+    render(
+      <SoftwareVulnerabilitiesTable
+        router={mockRouter}
+        isSoftwareEnabled
+        data={createMockVulnerabilitiesResponse({
+          count: 0,
+          vulnerabilities: null,
+          meta: {
+            has_next_results: false,
+            has_previous_results: false,
+          },
+        })}
+        emptyStateReason="unknown-cve"
+        query="cve-2002-12345"
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        showExploitedVulnerabilitiesOnly={false}
+        currentPage={0}
+        isLoading={false}
+        resetPageIndex={false}
+      />
+    );
+
+    expect(screen.getByText("This is not a known CVE")).toBeInTheDocument();
+    expect(
+      screen.getByText(
+        "None of Fleet's vulnerability sources are aware of this CVE."
+      )
+    ).toBeInTheDocument();
+    expect(screen.queryByText("Vulnerability")).toBeNull();
+  });
+
+  it("Renders premium columns", () => {
     const render = createCustomRenderer({
       context: {
         app: {
@@ -152,7 +293,7 @@ describe("Software Vulnerabilities table", () => {
         router={mockRouter}
         isSoftwareEnabled
         data={createMockVulnerabilitiesResponse()}
-        query=""
+        query="CVE-2018-16463"
         perPage={20}
         orderDirection="asc"
         orderKey="hosts_count"
diff --git a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx
index 1152c1337695..390a3dc86682 100644
--- a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx
@@ -7,7 +7,11 @@ import { Row } from "react-table";
 import PATHS from "router/paths";
 
 import { AppContext } from "context/app";
-import { GITHUB_NEW_ISSUE_LINK } from "utilities/constants";
+import {
+  GITHUB_NEW_ISSUE_LINK,
+  VULNERABILITIES_SEARCH_BOX_TOOLTIP,
+} from "utilities/constants";
+import { isIncompleteQuoteQuery } from "utilities/strings/stringUtils";
 
 // @ts-ignore
 import Dropdown from "components/forms/fields/Dropdown";
@@ -17,12 +21,17 @@ import LastUpdatedText from "components/LastUpdatedText";
 import { ITableQueryData } from "components/TableContainer/TableContainer";
 import TableCount from "components/TableContainer/TableCount";
 
-import EmptySoftwareTable from "pages/SoftwarePage/components/EmptySoftwareTable";
-import { IVulnerabilitiesResponse } from "services/entities/vulnerabilities";
+import EmptyVulnerabilitiesTable from "pages/SoftwarePage/components/EmptyVulnerabilitiesTable";
+
+import {
+  IVulnerabilitiesResponse,
+  IVulnerabilitiesEmptyStateReason,
+} from "services/entities/vulnerabilities";
 import { buildQueryStringFromParams } from "utilities/url";
 import { getNextLocationPath } from "utilities/helpers";
 
 import generateTableConfig from "./VulnerabilitiesTableConfig";
+import { getExploitedVulnerabilitiesDropdownOptions } from "./helpers";
 
 const baseClass = "software-vulnerabilities-table";
 
@@ -36,6 +45,7 @@ interface ISoftwareVulnerabilitiesTableProps {
   router: InjectedRouter;
   isSoftwareEnabled: boolean;
   data?: IVulnerabilitiesResponse;
+  emptyStateReason?: IVulnerabilitiesEmptyStateReason;
   query?: string;
   perPage: number;
   orderDirection: "asc" | "desc";
@@ -51,6 +61,7 @@ const SoftwareVulnerabilitiesTable = ({
   router,
   isSoftwareEnabled,
   data,
+  emptyStateReason,
   query,
   perPage,
   orderDirection,
@@ -108,6 +119,11 @@ const SoftwareVulnerabilitiesTable = ({
 
   const onQueryChange = useCallback(
     (newTableQuery: ITableQueryData) => {
+      // We don't want to start searching until a user completes their quote query
+      if (isIncompleteQuoteQuery(newTableQuery.searchQuery)) {
+        return;
+      }
+
       // we want to determine which query param has changed in order to
       // reset the page index to 0 if any other param has changed.
       const changedParam = determineQueryParamChange(newTableQuery);
@@ -181,11 +197,13 @@ const SoftwareVulnerabilitiesTable = ({
   };
 
   const renderVulnerabilityCount = () => {
-    if (!data?.vulnerabilities || !data?.count) return null;
+    if (!data) return null;
+
+    const count = data?.count;
 
     return (
       <>
-        <TableCount name="items" count={data?.count} />
+        <TableCount name="items" count={count} />
         {data?.vulnerabilities && data?.counts_updated_at && (
           <LastUpdatedText
             lastUpdatedAt={data.counts_updated_at}
@@ -202,7 +220,7 @@ const SoftwareVulnerabilitiesTable = ({
     );
   };
 
-  const renderTableFooter = () => {
+  const renderTableHelpText = () => {
     return (
       <div>
         Seeing unexpected software or vulnerabilities?{" "}
@@ -215,34 +233,13 @@ const SoftwareVulnerabilitiesTable = ({
     );
   };
 
-  const getExploitedVulnerabiltiesDropdownOptions = () => {
-    const disabledTooltipContent = "Available in Fleet Premium.";
-
-    return [
-      {
-        disabled: false,
-        label: "All vulnerabilities",
-        value: false,
-        helpText: "All vulnerabilities detected on your hosts.",
-      },
-      {
-        disabled: !isPremiumTier,
-        label: "Exploited vulnerabilities",
-        value: true,
-        helpText:
-          "Vulnerabilities that have been actively exploited in the wild.",
-        tooltipContent: !isPremiumTier && disabledTooltipContent,
-      },
-    ];
-  };
-
   // Exploited vulnerabilities is a premium feature
   const renderExploitedVulnerabilitiesDropdown = () => {
     return (
       <Dropdown
         value={showExploitedVulnerabilitiesOnly}
         className={`${baseClass}__exploited-vulnerabilities-dropdown`}
-        options={getExploitedVulnerabiltiesDropdownOptions()}
+        options={getExploitedVulnerabilitiesDropdownOptions(isPremiumTier)}
         searchable={false}
         onChange={handleExploitedVulnFilterDropdownChange}
         tableFilterDropdown
@@ -254,16 +251,19 @@ const SoftwareVulnerabilitiesTable = ({
     <div className={baseClass}>
       <TableContainer
         columnConfigs={vulnerabilitiesTableHeaders}
-        data={data?.vulnerabilities ?? []}
+        data={data?.vulnerabilities || []}
         isLoading={isLoading}
         resultsTitle={"items"}
         emptyComponent={() => (
-          <EmptySoftwareTable
-            tableName="vulnerabilities"
+          <EmptyVulnerabilitiesTable
+            isPremiumTier={isPremiumTier}
+            teamId={teamId}
+            exploitedFilter={showExploitedVulnerabilitiesOnly}
             isSoftwareDisabled={!isSoftwareEnabled}
-            isNotDetectingSoftware={query === ""}
+            emptyStateReason={emptyStateReason}
           />
         )}
+        defaultSearchQuery={query}
         defaultSortHeader={orderKey}
         defaultSortDirection={orderDirection}
         defaultPageIndex={currentPage}
@@ -275,12 +275,13 @@ const SoftwareVulnerabilitiesTable = ({
         searchable={searchable}
         searchQueryColumn="vulnerability"
         inputPlaceHolder="Search by CVE"
+        searchToolTipText={VULNERABILITIES_SEARCH_BOX_TOOLTIP}
         onQueryChange={onQueryChange}
         customControl={
           searchable ? renderExploitedVulnerabilitiesDropdown : undefined
         }
         renderCount={renderVulnerabilityCount}
-        renderFooter={renderTableFooter}
+        renderTableHelpText={renderTableHelpText}
         disableMultiRowSelect
         onSelectSingleRow={handleRowSelect}
         resetPageIndex={resetPageIndex}
diff --git a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/helpers.ts b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/helpers.ts
new file mode 100644
index 000000000000..39fba03fa415
--- /dev/null
+++ b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/helpers.ts
@@ -0,0 +1,31 @@
+export const getExploitedVulnerabilitiesDropdownOptions = (
+  isPremiumTier = false
+) => {
+  const disabledTooltipContent = "Available in Fleet Premium.";
+
+  return [
+    {
+      disabled: false,
+      label: "All vulnerabilities",
+      value: false,
+      helpText: "All vulnerabilities detected on your hosts.",
+    },
+    {
+      disabled: !isPremiumTier,
+      label: "Exploited vulnerabilities",
+      value: true,
+      helpText:
+        "Vulnerabilities that have been actively exploited in the wild.",
+      tooltipContent: !isPremiumTier && disabledTooltipContent,
+    },
+  ];
+};
+
+export const isValidCVEFormat = (query: string): boolean => {
+  if (query.length < 9) {
+    return false;
+  }
+
+  const cveRegex = /^CVE-\d{4}-\d{4,}$/i;
+  return cveRegex.test(query);
+};
diff --git a/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnerabilityDetailsPage.tsx b/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnerabilityDetailsPage.tsx
index 4a243b46be23..8b65779ed900 100644
--- a/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnerabilityDetailsPage.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnerabilityDetailsPage.tsx
@@ -56,7 +56,7 @@ const SoftwareVulnerabilityDetailsPage = ({
     location,
     router,
     includeAllTeams: true,
-    includeNoTeam: false,
+    includeNoTeam: true,
   });
 
   const {
@@ -141,9 +141,7 @@ const SoftwareVulnerabilityDetailsPage = ({
         {isVulnError || !vuln ? (
           <DetailsNoHosts
             header="Vulnerability not detected"
-            details={`No hosts ${
-              teamIdForApi ? "on this team " : ""
-            }are affected by this CVE.`}
+            details="No hosts are affected by this CVE."
           />
         ) : (
           renderCards(vuln)
diff --git a/frontend/pages/SoftwarePage/components/AddPackage/AddPackage.tsx b/frontend/pages/SoftwarePage/components/AddPackage/AddPackage.tsx
new file mode 100644
index 000000000000..52cb805f7f46
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/AddPackage/AddPackage.tsx
@@ -0,0 +1,140 @@
+import React, { useContext, useEffect, useState } from "react";
+import { InjectedRouter } from "react-router";
+
+import { getErrorReason } from "interfaces/errors";
+
+import PATHS from "router/paths";
+import { NotificationContext } from "context/notification";
+import softwareAPI from "services/entities/software";
+import { QueryParams, buildQueryStringFromParams } from "utilities/url";
+
+import { LEARN_MORE_ABOUT_BASE_LINK } from "utilities/constants";
+
+import CustomLink from "components/CustomLink";
+
+import AddPackageForm from "../AddPackageForm";
+import { IAddPackageFormData } from "../AddPackageForm/AddPackageForm";
+import { getErrorMessage } from "../AddSoftwareModal/helpers";
+
+const baseClass = "add-package";
+
+// 8 minutes + 15 seconds to account for extra roundtrip time.
+const UPLOAD_TIMEOUT = (8 * 60 + 15) * 1000;
+const MAX_FILE_SIZE_MB = 500;
+const MAX_FILE_SIZE_BYTES = MAX_FILE_SIZE_MB * 1024 * 1024;
+
+interface IAddPackageProps {
+  teamId: number;
+  router: InjectedRouter;
+  onExit: () => void;
+  setAddedSoftwareToken: (token: string) => void;
+}
+
+const AddPackage = ({
+  teamId,
+  router,
+  onExit,
+  setAddedSoftwareToken,
+}: IAddPackageProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+  const [isUploading, setIsUploading] = useState(false);
+
+  useEffect(() => {
+    let timeout: NodeJS.Timeout;
+
+    const beforeUnloadHandler = (e: BeforeUnloadEvent) => {
+      e.preventDefault();
+      // Next line with e.returnValue is included for legacy support
+      // e.g.Chrome / Edge < 119
+      e.returnValue = true;
+    };
+
+    // set up event listener to prevent user from leaving page while uploading
+    if (isUploading) {
+      addEventListener("beforeunload", beforeUnloadHandler);
+      timeout = setTimeout(() => {
+        removeEventListener("beforeunload", beforeUnloadHandler);
+      }, UPLOAD_TIMEOUT);
+    } else {
+      removeEventListener("beforeunload", beforeUnloadHandler);
+    }
+
+    // clean up event listener and timeout on component unmount
+    return () => {
+      removeEventListener("beforeunload", beforeUnloadHandler);
+      clearTimeout(timeout);
+    };
+  }, [isUploading]);
+
+  const onAddPackage = async (formData: IAddPackageFormData) => {
+    setIsUploading(true);
+
+    if (formData.software && formData.software.size > MAX_FILE_SIZE_BYTES) {
+      renderFlash(
+        "error",
+        `Couldn't add. The maximum file size is ${MAX_FILE_SIZE_MB} MB.`
+      );
+      onExit();
+      setIsUploading(false);
+      return;
+    }
+
+    // TODO: confirm we are deleting the second sentence (not modifying it) for non-self-service installers
+    try {
+      await softwareAPI.addSoftwarePackage(formData, teamId, UPLOAD_TIMEOUT);
+      renderFlash(
+        "success",
+        <>
+          <b>{formData.software?.name}</b> successfully added.
+          {formData.selfService
+            ? " The end user can install from Fleet Desktop."
+            : ""}
+        </>
+      );
+
+      const newQueryParams: QueryParams = { team_id: teamId };
+      if (formData.selfService) {
+        newQueryParams.self_service = true;
+      } else {
+        newQueryParams.available_for_install = true;
+      }
+      // any unique string - triggers SW refetch
+      setAddedSoftwareToken(`${Date.now()}`);
+      router.push(
+        `${PATHS.SOFTWARE_TITLES}?${buildQueryStringFromParams(newQueryParams)}`
+      );
+    } catch (e) {
+      const reason = getErrorReason(e);
+      if (
+        reason.includes("Couldn't add. Fleet couldn't read the version from")
+      ) {
+        renderFlash(
+          "error",
+          `${reason}. ${(
+            <CustomLink
+              newTab
+              url={`${LEARN_MORE_ABOUT_BASE_LINK}/read-package-version`}
+              text="Learn more"
+            />
+          )} `
+        );
+      }
+      renderFlash("error", getErrorMessage(e));
+    }
+
+    onExit();
+    setIsUploading(false);
+  };
+
+  return (
+    <div className={baseClass}>
+      <AddPackageForm
+        isUploading={isUploading}
+        onCancel={onExit}
+        onSubmit={onAddPackage}
+      />
+    </div>
+  );
+};
+
+export default AddPackage;
diff --git a/frontend/pages/SoftwarePage/components/AddPackage/_styles.scss b/frontend/pages/SoftwarePage/components/AddPackage/_styles.scss
new file mode 100644
index 000000000000..2387af120ac2
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/AddPackage/_styles.scss
@@ -0,0 +1,3 @@
+.add-package {
+  margin-top: $pad-large;
+}
diff --git a/frontend/pages/SoftwarePage/components/AddPackage/index.ts b/frontend/pages/SoftwarePage/components/AddPackage/index.ts
new file mode 100644
index 000000000000..393d7d621b4d
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/AddPackage/index.ts
@@ -0,0 +1 @@
+export { default } from "./AddPackage";
diff --git a/frontend/pages/SoftwarePage/components/AddPackageAdvancedOptions/AddPackageAdvancedOptions.tsx b/frontend/pages/SoftwarePage/components/AddPackageAdvancedOptions/AddPackageAdvancedOptions.tsx
new file mode 100644
index 000000000000..5d6524e8dce1
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/AddPackageAdvancedOptions/AddPackageAdvancedOptions.tsx
@@ -0,0 +1,101 @@
+import React, { useState } from "react";
+
+import Editor from "components/Editor";
+import CustomLink from "components/CustomLink";
+import FleetAce from "components/FleetAce";
+import RevealButton from "components/buttons/RevealButton";
+
+const baseClass = "add-package-advanced-options";
+
+interface IAddPackageAdvancedOptionsProps {
+  errors: { preInstallQuery?: string; postInstallScript?: string };
+  preInstallQuery?: string;
+  installScript: string;
+  postInstallScript?: string;
+  onChangePreInstallQuery: (value?: string) => void;
+  onChangeInstallScript: (value: string) => void;
+  onChangePostInstallScript: (value?: string) => void;
+}
+
+const AddPackageAdvancedOptions = ({
+  errors,
+  preInstallQuery,
+  installScript,
+  postInstallScript,
+  onChangePreInstallQuery,
+  onChangeInstallScript,
+  onChangePostInstallScript,
+}: IAddPackageAdvancedOptionsProps) => {
+  const [showAdvancedOptions, setShowAdvancedOptions] = useState(false);
+
+  return (
+    <div className={baseClass}>
+      <RevealButton
+        className={`${baseClass}__accordion-title`}
+        isShowing={showAdvancedOptions}
+        showText="Advanced options"
+        hideText="Advanced options"
+        caretPosition="after"
+        onClick={() => setShowAdvancedOptions(!showAdvancedOptions)}
+      />
+      {showAdvancedOptions && (
+        <div className={`${baseClass}__input-fields`}>
+          <FleetAce
+            className="form-field"
+            focus
+            error={errors.preInstallQuery}
+            value={preInstallQuery}
+            placeholder="SELECT * FROM osquery_info WHERE start_time > 1"
+            label="Pre-install query"
+            name="preInstallQuery"
+            maxLines={10}
+            onChange={onChangePreInstallQuery}
+            helpText={
+              <>
+                Software will be installed only if the{" "}
+                <CustomLink
+                  className={`${baseClass}__table-link`}
+                  text="query returns results"
+                  url="https://fleetdm.com/tables"
+                  newTab
+                />
+              </>
+            }
+          />
+          <Editor
+            wrapEnabled
+            maxLines={10}
+            name="install-script"
+            onChange={onChangeInstallScript}
+            value={installScript}
+            helpText="Shell (macOS and Linux) or PowerShell (Windows)."
+            label="Install script"
+            labelTooltip={
+              <>
+                Fleet will run this script on hosts to install software. Use the
+                <br />
+                $INSTALLER_PATH variable to point to the installer.
+              </>
+            }
+            isFormField
+          />
+          <Editor
+            label="Post-install script"
+            labelTooltip="Fleet will run this script after install."
+            focus
+            error={errors.postInstallScript}
+            wrapEnabled
+            name="post-install-script-editor"
+            maxLines={10}
+            onChange={onChangePostInstallScript}
+            value={postInstallScript}
+            helpText="Shell (macOS and Linux) or PowerShell (Windows)."
+            isFormField
+          />
+        </div>
+      )}
+    </div>
+  );
+};
+
+export default AddPackageAdvancedOptions;
diff --git a/frontend/pages/SoftwarePage/components/AddSoftwareAdvancedOptions/_styles.scss b/frontend/pages/SoftwarePage/components/AddPackageAdvancedOptions/_styles.scss
similarity index 88%
rename from frontend/pages/SoftwarePage/components/AddSoftwareAdvancedOptions/_styles.scss
rename to frontend/pages/SoftwarePage/components/AddPackageAdvancedOptions/_styles.scss
index 58f1f85892b9..0728e3241560 100644
--- a/frontend/pages/SoftwarePage/components/AddSoftwareAdvancedOptions/_styles.scss
+++ b/frontend/pages/SoftwarePage/components/AddPackageAdvancedOptions/_styles.scss
@@ -1,4 +1,4 @@
-.add-software-advanced-options {
+.add-package-advanced-options {
   display: flex;
   flex-direction: column;
   align-items: flex-start;
diff --git a/frontend/pages/SoftwarePage/components/AddPackageAdvancedOptions/index.ts b/frontend/pages/SoftwarePage/components/AddPackageAdvancedOptions/index.ts
new file mode 100644
index 000000000000..004c96332d47
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/AddPackageAdvancedOptions/index.ts
@@ -0,0 +1 @@
+export { default } from "./AddPackageAdvancedOptions";
diff --git a/frontend/pages/SoftwarePage/components/AddSoftwareForm/AddSoftwareForm.tsx b/frontend/pages/SoftwarePage/components/AddPackageForm/AddPackageForm.tsx
similarity index 55%
rename from frontend/pages/SoftwarePage/components/AddSoftwareForm/AddSoftwareForm.tsx
rename to frontend/pages/SoftwarePage/components/AddPackageForm/AddPackageForm.tsx
index acad6e777d66..cf3802b3f6f8 100644
--- a/frontend/pages/SoftwarePage/components/AddSoftwareForm/AddSoftwareForm.tsx
+++ b/frontend/pages/SoftwarePage/components/AddPackageForm/AddPackageForm.tsx
@@ -6,7 +6,6 @@ import getInstallScript from "utilities/software_install_scripts";
 
 import Button from "components/buttons/Button";
 import Checkbox from "components/forms/fields/Checkbox";
-import Editor from "components/Editor";
 import {
   FileUploader,
   FileDetails,
@@ -14,25 +13,25 @@ import {
 import Spinner from "components/Spinner";
 import TooltipWrapper from "components/TooltipWrapper";
 
-import AddSoftwareAdvancedOptions from "../AddSoftwareAdvancedOptions";
+import AddPackageAdvancedOptions from "../AddPackageAdvancedOptions";
 
 import { generateFormValidation } from "./helpers";
 
-export const baseClass = "add-software-form";
+export const baseClass = "add-package-form";
 
 const UploadingSoftware = () => {
   return (
     <div className={`${baseClass}__uploading-message`}>
       <Spinner centered={false} />
-      <p>Uploading. It may take few minutes to finish.</p>
+      <p>Adding software. This may take a few minutes to finish.</p>
     </div>
   );
 };
 
-export interface IAddSoftwareFormData {
+export interface IAddPackageFormData {
   software: File | null;
   installScript: string;
-  preInstallCondition?: string;
+  preInstallQuery?: string;
   postInstallScript?: string;
   selfService: boolean;
 }
@@ -40,30 +39,28 @@ export interface IAddSoftwareFormData {
 export interface IFormValidation {
   isValid: boolean;
   software: { isValid: boolean };
-  preInstallCondition?: { isValid: boolean; message?: string };
+  preInstallQuery?: { isValid: boolean; message?: string };
   postInstallScript?: { isValid: boolean; message?: string };
   selfService?: { isValid: boolean };
 }
 
-interface IAddSoftwareFormProps {
+interface IAddPackageFormProps {
   isUploading: boolean;
   onCancel: () => void;
-  onSubmit: (formData: IAddSoftwareFormData) => void;
+  onSubmit: (formData: IAddPackageFormData) => void;
 }
 
-const AddSoftwareForm = ({
+const AddPackageForm = ({
   isUploading,
   onCancel,
   onSubmit,
-}: IAddSoftwareFormProps) => {
+}: IAddPackageFormProps) => {
   const { renderFlash } = useContext(NotificationContext);
 
-  const [showPreInstallCondition, setShowPreInstallCondition] = useState(false);
-  const [showPostInstallScript, setShowPostInstallScript] = useState(false);
-  const [formData, setFormData] = useState<IAddSoftwareFormData>({
+  const [formData, setFormData] = useState<IAddPackageFormData>({
     software: null,
     installScript: "",
-    preInstallCondition: undefined,
+    preInstallQuery: undefined,
     postInstallScript: undefined,
     selfService: false,
   });
@@ -90,13 +87,7 @@ const AddSoftwareForm = ({
         installScript,
       };
       setFormData(newData);
-      setFormValidation(
-        generateFormValidation(
-          newData,
-          showPreInstallCondition,
-          showPostInstallScript
-        )
-      );
+      setFormValidation(generateFormValidation(newData));
     }
   };
 
@@ -105,62 +96,26 @@ const AddSoftwareForm = ({
     onSubmit(formData);
   };
 
-  const onTogglePreInstallConditionCheckbox = (value: boolean) => {
-    const newData = { ...formData, preInstallCondition: undefined };
-    setShowPreInstallCondition(value);
-    setFormData(newData);
-    setFormValidation(
-      generateFormValidation(newData, value, showPostInstallScript)
-    );
-  };
-
-  const onTogglePostInstallScriptCheckbox = (value: boolean) => {
-    const newData = { ...formData, postInstallScript: undefined };
-    setShowPostInstallScript(value);
-    setFormData(newData);
-    setFormValidation(
-      generateFormValidation(newData, showPreInstallCondition, value)
-    );
-  };
-
   const onChangeInstallScript = (value: string) => {
     setFormData({ ...formData, installScript: value });
   };
 
-  const onChangePreInstallCondition = (value?: string) => {
-    const newData = { ...formData, preInstallCondition: value };
+  const onChangePreInstallQuery = (value?: string) => {
+    const newData = { ...formData, preInstallQuery: value };
     setFormData(newData);
-    setFormValidation(
-      generateFormValidation(
-        newData,
-        showPreInstallCondition,
-        showPostInstallScript
-      )
-    );
+    setFormValidation(generateFormValidation(newData));
   };
 
   const onChangePostInstallScript = (value?: string) => {
     const newData = { ...formData, postInstallScript: value };
     setFormData(newData);
-    setFormValidation(
-      generateFormValidation(
-        newData,
-        showPreInstallCondition,
-        showPostInstallScript
-      )
-    );
+    setFormValidation(generateFormValidation(newData));
   };
 
   const onToggleSelfServiceCheckbox = (value: boolean) => {
     const newData = { ...formData, selfService: value };
     setFormData(newData);
-    setFormValidation(
-      generateFormValidation(
-        newData,
-        showPreInstallCondition,
-        showPostInstallScript
-      )
-    );
+    setFormValidation(generateFormValidation(newData));
   };
 
   const isSubmitDisabled = !formValidation.isValid;
@@ -185,25 +140,6 @@ const AddSoftwareForm = ({
               )
             }
           />
-          {formData.software && (
-            <Editor
-              wrapEnabled
-              maxLines={10}
-              name="install-script"
-              onChange={onChangeInstallScript}
-              value={formData.installScript}
-              helpText="Fleet will run this command on hosts to install software."
-              label="Install script"
-              labelTooltip={
-                <>
-                  For security agents, add the script provided by the vendor.
-                  <br />
-                  In custom scripts, you can use the $INSTALLER_PATH variable to
-                  point to the installer.
-                </>
-              }
-            />
-          )}
           <Checkbox
             value={formData.selfService}
             onChange={onToggleSelfServiceCheckbox}
@@ -219,19 +155,17 @@ const AddSoftwareForm = ({
               Self-service
             </TooltipWrapper>
           </Checkbox>
-          <AddSoftwareAdvancedOptions
+          <AddPackageAdvancedOptions
             errors={{
-              preInstallCondition: formValidation.preInstallCondition?.message,
+              preInstallQuery: formValidation.preInstallQuery?.message,
               postInstallScript: formValidation.postInstallScript?.message,
             }}
-            showPreInstallCondition={showPreInstallCondition}
-            showPostInstallScript={showPostInstallScript}
-            preInstallCondition={formData.preInstallCondition}
+            preInstallQuery={formData.preInstallQuery}
             postInstallScript={formData.postInstallScript}
-            onTogglePreInstallCondition={onTogglePreInstallConditionCheckbox}
-            onTogglePostInstallScript={onTogglePostInstallScriptCheckbox}
-            onChangePreInstallCondition={onChangePreInstallCondition}
+            onChangePreInstallQuery={onChangePreInstallQuery}
+            onChangeInstallScript={onChangeInstallScript}
             onChangePostInstallScript={onChangePostInstallScript}
+            installScript={formData.installScript}
           />
           <div className="modal-cta-wrap">
             <Button type="submit" variant="brand" disabled={isSubmitDisabled}>
@@ -247,4 +181,4 @@ const AddSoftwareForm = ({
   );
 };
 
-export default AddSoftwareForm;
+export default AddPackageForm;
diff --git a/frontend/pages/SoftwarePage/components/AddSoftwareForm/_styles.scss b/frontend/pages/SoftwarePage/components/AddPackageForm/_styles.scss
similarity index 93%
rename from frontend/pages/SoftwarePage/components/AddSoftwareForm/_styles.scss
rename to frontend/pages/SoftwarePage/components/AddPackageForm/_styles.scss
index 8e09f0a64d53..aee078016f36 100644
--- a/frontend/pages/SoftwarePage/components/AddSoftwareForm/_styles.scss
+++ b/frontend/pages/SoftwarePage/components/AddPackageForm/_styles.scss
@@ -1,4 +1,4 @@
-.add-software-form {
+.add-package-form {
   &__uploading-message {
     display: flex;
     align-items: center;
diff --git a/frontend/pages/SoftwarePage/components/AddPackageForm/helpers.ts b/frontend/pages/SoftwarePage/components/AddPackageForm/helpers.ts
new file mode 100644
index 000000000000..d527049c1474
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/AddPackageForm/helpers.ts
@@ -0,0 +1,101 @@
+import validator from "validator";
+
+// @ts-ignore
+import validateQuery from "components/forms/validators/validate_query";
+
+import { IAddPackageFormData, IFormValidation } from "./AddPackageForm";
+
+type IAddPackageFormValidatorKey = Exclude<
+  keyof IAddPackageFormData,
+  "installScript"
+>;
+
+type IMessageFunc = (formData: IAddPackageFormData) => string;
+type IValidationMessage = string | IMessageFunc;
+
+interface IValidation {
+  name: string;
+  isValid: (formData: IAddPackageFormData) => boolean;
+  message?: IValidationMessage;
+}
+
+/** configuration defines validations for each filed in the form. It defines rules
+ *  to determine if a field is valid, and rules for generating an error message.
+ */
+const FORM_VALIDATION_CONFIG: Record<
+  IAddPackageFormValidatorKey,
+  { validations: IValidation[] }
+> = {
+  software: {
+    validations: [
+      {
+        name: "required",
+        isValid: (formData) => formData.software !== null,
+      },
+    ],
+  },
+  preInstallQuery: {
+    validations: [
+      {
+        name: "invalidQuery",
+        isValid: (formData) => {
+          const query = formData.preInstallQuery;
+          return (
+            query === undefined || query === "" || validateQuery(query).valid
+          );
+        },
+        message: (formData) => validateQuery(formData.preInstallQuery).error,
+      },
+    ],
+  },
+  postInstallScript: {
+    // no validations related to postInstallScript
+    validations: [],
+  },
+  selfService: {
+    // no validations related to self service
+    validations: [],
+  },
+};
+
+const getErrorMessage = (
+  formData: IAddPackageFormData,
+  message?: IValidationMessage
+) => {
+  if (message === undefined || typeof message === "string") {
+    return message;
+  }
+  return message(formData);
+};
+
+export const generateFormValidation = (formData: IAddPackageFormData) => {
+  const formValidation: IFormValidation = {
+    isValid: true,
+    software: {
+      isValid: false,
+    },
+  };
+
+  Object.keys(FORM_VALIDATION_CONFIG).forEach((key) => {
+    const objKey = key as keyof typeof FORM_VALIDATION_CONFIG;
+    const failedValidation = FORM_VALIDATION_CONFIG[objKey].validations.find(
+      (validation) => !validation.isValid(formData)
+    );
+
+    if (!failedValidation) {
+      formValidation[objKey] = {
+        isValid: true,
+      };
+    } else {
+      formValidation.isValid = false;
+      formValidation[objKey] = {
+        isValid: false,
+        message: getErrorMessage(formData, failedValidation.message),
+      };
+    }
+  });
+
+  return formValidation;
+};
+
+export default generateFormValidation;
diff --git a/frontend/pages/SoftwarePage/components/AddPackageForm/index.ts b/frontend/pages/SoftwarePage/components/AddPackageForm/index.ts
new file mode 100644
index 000000000000..2795e058dc01
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/AddPackageForm/index.ts
@@ -0,0 +1 @@
+export { default } from "./AddPackageForm";
diff --git a/frontend/pages/SoftwarePage/components/AddSoftwareAdvancedOptions/AddSoftwareAdvancedOptions.tsx b/frontend/pages/SoftwarePage/components/AddSoftwareAdvancedOptions/AddSoftwareAdvancedOptions.tsx
deleted file mode 100644
index 96de54fd33f4..000000000000
--- a/frontend/pages/SoftwarePage/components/AddSoftwareAdvancedOptions/AddSoftwareAdvancedOptions.tsx
+++ /dev/null
@@ -1,110 +0,0 @@
-import React, { useState } from "react";
-
-import Editor from "components/Editor";
-import CustomLink from "components/CustomLink";
-import FleetAce from "components/FleetAce";
-import RevealButton from "components/buttons/RevealButton";
-import Checkbox from "components/forms/fields/Checkbox";
-
-const baseClass = "add-software-advanced-options";
-
-interface IAddSoftwareAdvancedOptionsProps {
-  errors: { preInstallCondition?: string; postInstallScript?: string };
-  showPreInstallCondition: boolean;
-  showPostInstallScript: boolean;
-  preInstallCondition?: string;
-  postInstallScript?: string;
-  onTogglePreInstallCondition: (value: boolean) => void;
-  onTogglePostInstallScript: (value: boolean) => void;
-  onChangePreInstallCondition: (value?: string) => void;
-  onChangePostInstallScript: (value?: string) => void;
-}
-
-const AddSoftwareAdvancedOptions = ({
-  errors,
-  showPreInstallCondition,
-  showPostInstallScript,
-  preInstallCondition,
-  postInstallScript,
-  onTogglePreInstallCondition,
-  onTogglePostInstallScript,
-  onChangePreInstallCondition,
-  onChangePostInstallScript,
-}: IAddSoftwareAdvancedOptionsProps) => {
-  const [showAdvancedOptions, setShowAdvancedOptions] = useState(false);
-
-  const onChangePreInstallCheckbox = () => {
-    onTogglePreInstallCondition(!showPreInstallCondition);
-  };
-
-  const onChangePostInstallCheckbox = () => {
-    onTogglePostInstallScript(!showPostInstallScript);
-  };
-
-  return (
-    <div className={baseClass}>
-      <RevealButton
-        className={`${baseClass}__accordion-title`}
-        isShowing={showAdvancedOptions}
-        showText="Advanced options"
-        hideText="Advanced options"
-        caretPosition="after"
-        onClick={() => setShowAdvancedOptions(!showAdvancedOptions)}
-      />
-      {showAdvancedOptions && (
-        <div className={`${baseClass}__input-fields`}>
-          <Checkbox
-            value={showPreInstallCondition}
-            onChange={onChangePreInstallCheckbox}
-          >
-            Pre-install condition
-          </Checkbox>
-          {showPreInstallCondition && (
-            <FleetAce
-              focus
-              error={errors.preInstallCondition}
-              value={preInstallCondition}
-              label="Query"
-              name="preInstallQuery"
-              maxLines={10}
-              onChange={onChangePreInstallCondition}
-              helpText={
-                <>
-                  Software will be installed only if the{" "}
-                  <CustomLink
-                    className={`${baseClass}__table-link`}
-                    text="query returns results"
-                    url="https://fleetdm.com/tables"
-                    newTab
-                  />
-                </>
-              }
-            />
-          )}
-          <Checkbox
-            value={showPostInstallScript}
-            onChange={onChangePostInstallCheckbox}
-          >
-            Post-install script
-          </Checkbox>
-          {showPostInstallScript && (
-            <>
-              <Editor
-                focus
-                error={errors.postInstallScript}
-                wrapEnabled
-                name="post-install-script-editor"
-                maxLines={10}
-                onChange={onChangePostInstallScript}
-                value={postInstallScript}
-                helpText="Shell (macOS and Linux) or PowerShell (Windows)."
-              />
-            </>
-          )}
-        </div>
-      )}
-    </div>
-  );
-};
-
-export default AddSoftwareAdvancedOptions;
diff --git a/frontend/pages/SoftwarePage/components/AddSoftwareAdvancedOptions/index.ts b/frontend/pages/SoftwarePage/components/AddSoftwareAdvancedOptions/index.ts
deleted file mode 100644
index 264fa61b112e..000000000000
--- a/frontend/pages/SoftwarePage/components/AddSoftwareAdvancedOptions/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./AddSoftwareAdvancedOptions";
diff --git a/frontend/pages/SoftwarePage/components/AddSoftwareForm/helpers.ts b/frontend/pages/SoftwarePage/components/AddSoftwareForm/helpers.ts
deleted file mode 100644
index d38ca110d5d1..000000000000
--- a/frontend/pages/SoftwarePage/components/AddSoftwareForm/helpers.ts
+++ /dev/null
@@ -1,161 +0,0 @@
-import validator from "validator";
-
-// @ts-ignore
-import validateQuery from "components/forms/validators/validate_query";
-
-import { IAddSoftwareFormData, IFormValidation } from "./AddSoftwareForm";
-
-type IAddSoftwareFormValidatorKey = Exclude<
-  keyof IAddSoftwareFormData,
-  "installScript"
->;
-
-type IMessageFunc = (formData: IAddSoftwareFormData) => string;
-type IValidationMessage = string | IMessageFunc;
-
-interface IValidation {
-  name: string;
-  isValid: (
-    formData: IAddSoftwareFormData,
-    enabledPreInstallCondition?: boolean,
-    enabledPostInstallScript?: boolean
-  ) => boolean;
-  message?: IValidationMessage;
-}
-
-/** configuration defines validations for each filed in the form. It defines rules
- *  to determine if a field is valid, and rules for generating an error message.
- */
-const FORM_VALIDATION_CONFIG: Record<
-  IAddSoftwareFormValidatorKey,
-  { validations: IValidation[] }
-> = {
-  software: {
-    validations: [
-      {
-        name: "required",
-        isValid: (formData) => formData.software !== null,
-      },
-    ],
-  },
-  preInstallCondition: {
-    validations: [
-      {
-        name: "required",
-        isValid: (
-          formData: IAddSoftwareFormData,
-          enabledPreInstallCondition
-        ) => {
-          if (!enabledPreInstallCondition) {
-            return true;
-          }
-          return (
-            formData.preInstallCondition !== undefined &&
-            !validator.isEmpty(formData.preInstallCondition)
-          );
-        },
-        message: (formData) => {
-          // we dont want an error message until the user has interacted with
-          // the field. This is why we check for undefined here.
-          if (formData.preInstallCondition === undefined) {
-            return "";
-          }
-          return "Pre-install condition is required when enabled.";
-        },
-      },
-      {
-        name: "invalidQuery",
-        isValid: (formData, enabledPreInstallCondition) => {
-          if (!enabledPreInstallCondition) {
-            return true;
-          }
-          return (
-            formData.preInstallCondition !== undefined &&
-            validateQuery(formData.preInstallCondition).valid
-          );
-        },
-        message: (formData) =>
-          validateQuery(formData.preInstallCondition).error,
-      },
-    ],
-  },
-  postInstallScript: {
-    validations: [
-      {
-        name: "required",
-        message: (formData) => {
-          // we dont want an error message until the user has interacted with
-          // the field. This is why we check for undefined here.
-          if (formData.postInstallScript === undefined) {
-            return "";
-          }
-          return "Post-install script is required when enabled.";
-        },
-        isValid: (formData, _, enabledPostInstallScript) => {
-          if (!enabledPostInstallScript) {
-            return true;
-          }
-          return (
-            formData.postInstallScript !== undefined &&
-            !validator.isEmpty(formData.postInstallScript)
-          );
-        },
-      },
-    ],
-  },
-  selfService: {
-    // no validations related to self service
-    validations: [],
-  },
-};
-
-const getErrorMessage = (
-  formData: IAddSoftwareFormData,
-  message?: IValidationMessage
-) => {
-  if (message === undefined || typeof message === "string") {
-    return message;
-  }
-  return message(formData);
-};
-
-export const generateFormValidation = (
-  formData: IAddSoftwareFormData,
-  showingPreInstallCondition: boolean,
-  showingPostInstallScript: boolean
-) => {
-  const formValidation: IFormValidation = {
-    isValid: true,
-    software: {
-      isValid: false,
-    },
-  };
-
-  Object.keys(FORM_VALIDATION_CONFIG).forEach((key) => {
-    const objKey = key as keyof typeof FORM_VALIDATION_CONFIG;
-    const failedValidation = FORM_VALIDATION_CONFIG[objKey].validations.find(
-      (validation) =>
-        !validation.isValid(
-          formData,
-          showingPreInstallCondition,
-          showingPostInstallScript
-        )
-    );
-
-    if (!failedValidation) {
-      formValidation[objKey] = {
-        isValid: true,
-      };
-    } else {
-      formValidation.isValid = false;
-      formValidation[objKey] = {
-        isValid: false,
-        message: getErrorMessage(formData, failedValidation.message),
-      };
-    }
-  });
-
-  return formValidation;
-};
-
-export default generateFormValidation;
diff --git a/frontend/pages/SoftwarePage/components/AddSoftwareForm/index.ts b/frontend/pages/SoftwarePage/components/AddSoftwareForm/index.ts
deleted file mode 100644
index d3ea76d47d3c..000000000000
--- a/frontend/pages/SoftwarePage/components/AddSoftwareForm/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./AddSoftwareForm";
diff --git a/frontend/pages/SoftwarePage/components/AddSoftwareModal/AddSoftwareModal.tsx b/frontend/pages/SoftwarePage/components/AddSoftwareModal/AddSoftwareModal.tsx
index 3f83cac72531..4046e090c9fd 100644
--- a/frontend/pages/SoftwarePage/components/AddSoftwareModal/AddSoftwareModal.tsx
+++ b/frontend/pages/SoftwarePage/components/AddSoftwareModal/AddSoftwareModal.tsx
@@ -1,25 +1,16 @@
-import React, { useContext, useEffect, useState } from "react";
+import React from "react";
 import { InjectedRouter } from "react-router";
-import { AxiosResponse } from "axios";
+import { Tab, TabList, TabPanel, Tabs } from "react-tabs";
 
-import PATHS from "router/paths";
 import { APP_CONTEXT_ALL_TEAMS_ID } from "interfaces/team";
-import softwareAPI from "services/entities/software";
-import { NotificationContext } from "context/notification";
-import { QueryParams, buildQueryStringFromParams } from "utilities/url";
-import { IApiError } from "interfaces/errors";
 
 import Modal from "components/Modal";
 import Button from "components/buttons/Button";
+import TabsWrapper from "components/TabsWrapper";
+import PremiumFeatureMessage from "components/PremiumFeatureMessage";
 
-import AddSoftwareForm from "../AddSoftwareForm";
-import { IAddSoftwareFormData } from "../AddSoftwareForm/AddSoftwareForm";
-import { getErrorMessage } from "./helpers";
-
-// 2 minutes + 15 seconds to account for extra roundtrip time.
-const UPLOAD_TIMEOUT = (2 * 60 + 15) * 1000;
-const MAX_FILE_SIZE_MB = 500;
-const MAX_FILE_SIZE_BYTES = MAX_FILE_SIZE_MB * 1024 * 1024;
+import AppStoreVpp from "../AppStoreVpp";
+import AddPackage from "../AddPackage";
 
 const baseClass = "add-software-modal";
 
@@ -47,86 +38,61 @@ interface IAddSoftwareModalProps {
   teamId: number;
   router: InjectedRouter;
   onExit: () => void;
+  setAddedSoftwareToken: (token: string) => void;
+  isFreeTier?: boolean;
 }
 
 const AddSoftwareModal = ({
   teamId,
   router,
   onExit,
+  setAddedSoftwareToken,
+  isFreeTier,
 }: IAddSoftwareModalProps) => {
-  const { renderFlash } = useContext(NotificationContext);
-  const [isUploading, setIsUploading] = useState(false);
-
-  useEffect(() => {
-    let timeout: NodeJS.Timeout;
-
-    const beforeUnloadHandler = (e: BeforeUnloadEvent) => {
-      e.preventDefault();
-      // Next line with e.returnValue is included for legacy support
-      // e.g.Chrome / Edge < 119
-      e.returnValue = true;
-    };
-
-    // set up event listener to prevent user from leaving page while uploading
-    if (isUploading) {
-      addEventListener("beforeunload", beforeUnloadHandler);
-      timeout = setTimeout(() => {
-        removeEventListener("beforeunload", beforeUnloadHandler);
-      }, UPLOAD_TIMEOUT);
-    } else {
-      removeEventListener("beforeunload", beforeUnloadHandler);
-    }
-
-    // clean up event listener and timeout on component unmount
-    return () => {
-      removeEventListener("beforeunload", beforeUnloadHandler);
-      clearTimeout(timeout);
-    };
-  }, [isUploading]);
-
-  const onAddSoftware = async (formData: IAddSoftwareFormData) => {
-    setIsUploading(true);
-
-    if (formData.software && formData.software.size > MAX_FILE_SIZE_BYTES) {
-      renderFlash(
-        "error",
-        `Couldn’t add. The maximum file size is ${MAX_FILE_SIZE_MB} MB.`
-      );
-      onExit();
-      setIsUploading(false);
-      return;
-    }
-
-    // TODO: confirm we are deleting the second sentence (not modifying it) for non-self-service installers
-    try {
-      await softwareAPI.addSoftwarePackage(formData, teamId, UPLOAD_TIMEOUT);
-      renderFlash(
-        "success",
+  const renderModalContent = () => {
+    if (isFreeTier) {
+      return (
         <>
-          <b>{formData.software?.name}</b> successfully added.
-          {formData.selfService
-            ? " The end user can install from Fleet Desktop."
-            : ""}
+          <PremiumFeatureMessage alignment="left" />{" "}
+          <div className="modal-cta-wrap">
+            <Button variant="brand" onClick={onExit}>
+              Done
+            </Button>
+          </div>
         </>
       );
-      onExit();
-
-      const newQueryParams: QueryParams = { team_id: teamId };
-      if (formData.selfService) {
-        newQueryParams.self_service = true;
-      } else {
-        newQueryParams.available_for_install = true;
-      }
+    }
 
-      router.push(
-        `${PATHS.SOFTWARE_TITLES}?${buildQueryStringFromParams(newQueryParams)}`
-      );
-    } catch (e) {
-      renderFlash("error", getErrorMessage(e));
-      onExit();
+    if (teamId === APP_CONTEXT_ALL_TEAMS_ID) {
+      return <AllTeamsMessage onExit={onExit} />;
     }
 
-    setIsUploading(false);
+    return (
+      <TabsWrapper className={`${baseClass}__tabs`}>
+        <Tabs>
+          <TabList>
+            <Tab>Package</Tab>
+            <Tab>App Store (VPP)</Tab>
+          </TabList>
+          <TabPanel>
+            <AddPackage
+              teamId={teamId}
+              router={router}
+              onExit={onExit}
+              setAddedSoftwareToken={setAddedSoftwareToken}
+            />
+          </TabPanel>
+          <TabPanel>
+            <AppStoreVpp
+              teamId={teamId}
+              router={router}
+              onExit={onExit}
+              setAddedSoftwareToken={setAddedSoftwareToken}
+            />
+          </TabPanel>
+        </Tabs>
+      </TabsWrapper>
+    );
   };
 
   return (
@@ -136,17 +102,7 @@ const AddSoftwareModal = ({
       width="large"
       className={baseClass}
     >
-      <>
-        {teamId === APP_CONTEXT_ALL_TEAMS_ID ? (
-          <AllTeamsMessage onExit={onExit} />
-        ) : (
-          <AddSoftwareForm
-            isUploading={isUploading}
-            onCancel={onExit}
-            onSubmit={onAddSoftware}
-          />
-        )}
-      </>
+      {renderModalContent()}
     </Modal>
   );
 };
diff --git a/frontend/pages/SoftwarePage/components/AddSoftwareModal/_styles.scss b/frontend/pages/SoftwarePage/components/AddSoftwareModal/_styles.scss
new file mode 100644
index 000000000000..706272708b59
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/AddSoftwareModal/_styles.scss
@@ -0,0 +1,7 @@
+.add-software-modal {
+
+  // have to use this selector to override the default styles
+  .component__tabs-wrapper {
+    margin-bottom: 0;
+  }
+}
diff --git a/frontend/pages/SoftwarePage/components/AppStoreVpp/AppStoreVpp.tsx b/frontend/pages/SoftwarePage/components/AppStoreVpp/AppStoreVpp.tsx
new file mode 100644
index 000000000000..ffde9220a271
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/AppStoreVpp/AppStoreVpp.tsx
@@ -0,0 +1,280 @@
+import React, { useContext, useState } from "react";
+import { useQuery } from "react-query";
+import { InjectedRouter } from "react-router";
+import { AxiosError } from "axios";
+
+import PATHS from "router/paths";
+import mdmAppleAPI, {
+  IGetVppTokensResponse,
+  IVppApp,
+} from "services/entities/mdm_apple";
+import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
+import { PLATFORM_DISPLAY_NAMES } from "interfaces/platform";
+import { NotificationContext } from "context/notification";
+
+import Card from "components/Card";
+import CustomLink from "components/CustomLink";
+import Spinner from "components/Spinner";
+import Button from "components/buttons/Button";
+import DataError from "components/DataError";
+import Radio from "components/forms/fields/Radio";
+import Checkbox from "components/forms/fields/Checkbox";
+
+import SoftwareIcon from "../icons/SoftwareIcon";
+import {
+  generateRedirectQueryParams,
+  getErrorMessage,
+  getUniqueAppId,
+  teamHasVPPToken,
+} from "./helpers";
+
+const baseClass = "app-store-vpp";
+
+const EnableVppCard = () => {
+  return (
+    <Card borderRadiusSize="medium">
+      <div className={`${baseClass}__enable-vpp`}>
+        <p className={`${baseClass}__enable-vpp-title`}>
+          <b>No Volume Purchasing Program (VPP) token assigned</b>
+        </p>
+        <p className={`${baseClass}__enable-vpp-description`}>
+          To add App Store apps, assign a VPP token to this team.
+        </p>
+        <CustomLink
+          url={PATHS.ADMIN_INTEGRATIONS_VPP}
+          text="Edit VPP"
+          className={`${baseClass}__enable-vpp-link`}
+        />
+      </div>
+    </Card>
+  );
+};
+
+const NoVppAppsCard = () => (
+  <Card borderRadiusSize="medium">
+    <div className={`${baseClass}__no-software`}>
+      <p className={`${baseClass}__no-software-title`}>
+        You don&apos;t have any App Store apps
+      </p>
+      <p className={`${baseClass}__no-software-description`}>
+        You must purchase apps in ABM. App Store apps that are already added to
+        this team are not listed.
+      </p>
+    </div>
+  </Card>
+);
+
+interface IVppAppListItemProps {
+  app: IVppApp;
+  selected: boolean;
+  uniqueAppId: string;
+  onSelect: (software: IVppApp) => void;
+}
+
+const VppAppListItem = ({
+  app,
+  selected,
+  uniqueAppId,
+  onSelect,
+}: IVppAppListItemProps) => {
+  return (
+    <li className={`${baseClass}__list-item`}>
+      <Radio
+        label={
+          <div className={`${baseClass}__app-info`}>
+            <SoftwareIcon url={app.icon_url} />
+            <span>{app.name}</span>
+          </div>
+        }
+        id={`vppApp-${uniqueAppId}`}
+        checked={selected}
+        value={uniqueAppId}
+        name="vppApp"
+        onChange={() => onSelect(app)}
+      />
+      {app.platform && (
+        <div className="app-platform">
+          {PLATFORM_DISPLAY_NAMES[app.platform]}
+        </div>
+      )}
+    </li>
+  );
+};
+
+interface IVppAppListProps {
+  apps: IVppApp[];
+  selectedApp: IVppApp | null;
+  onSelect: (app: IVppApp) => void;
+}
+
+const VppAppList = ({ apps, selectedApp, onSelect }: IVppAppListProps) => {
+  const uniqueSelectedAppId = selectedApp ? getUniqueAppId(selectedApp) : null;
+  return (
+    <div className={`${baseClass}__list-container`}>
+      <ul className={`${baseClass}__list`}>
+        {apps.map((app) => {
+          const uniqueAppId = getUniqueAppId(app);
+          return (
+            <VppAppListItem
+              key={uniqueAppId}
+              app={app}
+              selected={uniqueSelectedAppId === uniqueAppId}
+              uniqueAppId={uniqueAppId}
+              onSelect={onSelect}
+            />
+          );
+        })}
+      </ul>
+    </div>
+  );
+};
+
+interface IAppStoreVppProps {
+  teamId: number;
+  router: InjectedRouter;
+  onExit: () => void;
+  setAddedSoftwareToken: (token: string) => void;
+}
+
+const AppStoreVpp = ({
+  teamId,
+  router,
+  onExit,
+  setAddedSoftwareToken,
+}: IAppStoreVppProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+  const [isSubmitDisabled, setIsSubmitDisabled] = useState(true);
+  const [selectedApp, setSelectedApp] = useState<IVppApp | null>(null);
+  const [isSelfService, setIsSelfService] = useState(false);
+
+  const {
+    data: vppInfo,
+    isLoading: isLoadingVppInfo,
+    error: errorVppInfo,
+  } = useQuery<IGetVppTokensResponse, AxiosError>(
+    ["vppInfo"],
+    () => mdmAppleAPI.getVppTokens(),
+    {
+      ...DEFAULT_USE_QUERY_OPTIONS,
+      staleTime: 30000,
+      retry: (tries, error) => error.status !== 404 && tries <= 3,
+    }
+  );
+
+  const hasVPPToken = teamHasVPPToken(teamId, vppInfo?.vpp_tokens);
+
+  const {
+    data: vppApps,
+    isLoading: isLoadingVppApps,
+    error: errorVppApps,
+  } = useQuery(["vppSoftware", teamId], () => mdmAppleAPI.getVppApps(teamId), {
+    ...DEFAULT_USE_QUERY_OPTIONS,
+    enabled: hasVPPToken,
+    staleTime: 30000,
+    select: (res) => res.app_store_apps,
+  });
+
+  const onSelectApp = (app: IVppApp) => {
+    setIsSubmitDisabled(false);
+    setSelectedApp(app);
+  };
+
+  const onAddSoftware = async () => {
+    if (!selectedApp) {
+      return;
+    }
+
+    try {
+      await mdmAppleAPI.addVppApp(
+        teamId,
+        selectedApp.app_store_id,
+        selectedApp.platform,
+        isSelfService
+      );
+      renderFlash(
+        "success",
+        <>
+          <b>{selectedApp.name}</b> successfully added. Go to Host details page
+          to install software.
+        </>
+      );
+
+      const queryParams = generateRedirectQueryParams(teamId, isSelfService);
+      // any unique string - triggers SW refetch
+      setAddedSoftwareToken(`${Date.now()}`);
+      router.push(`${PATHS.SOFTWARE}?${queryParams}`);
+    } catch (e) {
+      renderFlash("error", getErrorMessage(e));
+    }
+    onExit();
+  };
+
+  const renderContent = () => {
+    if (isLoadingVppInfo || isLoadingVppApps) {
+      return <Spinner />;
+    }
+
+    if (!hasVPPToken) {
+      return <EnableVppCard />;
+    }
+
+    if (errorVppInfo || errorVppApps) {
+      return <DataError className={`${baseClass}__error`} />;
+    }
+
+    if (vppApps) {
+      if (vppApps.length === 0) {
+        return <NoVppAppsCard />;
+      }
+      return (
+        <div className={`${baseClass}__modal-body`}>
+          <VppAppList
+            apps={vppApps}
+            selectedApp={selectedApp}
+            onSelect={onSelectApp}
+          />
+          <div className={`${baseClass}__help-text`}>
+            These apps were added in Apple Business Manager (ABM). To add more
+            apps, head to{" "}
+            <CustomLink url="https://business.apple.com" text="ABM" newTab />
+          </div>
+          <Checkbox
+            value={isSelfService}
+            onChange={(newVal: boolean) => setIsSelfService(newVal)}
+            className={`${baseClass}__self-service-checkbox`}
+            tooltipContent={
+              <>
+                End users can install from <b>Fleet Desktop</b> {">"}{" "}
+                <b>Self-service</b>.
+              </>
+            }
+          >
+            Self-service
+          </Checkbox>
+        </div>
+      );
+    }
+    return null;
+  };
+
+  return (
+    <div className={baseClass}>
+      {renderContent()}
+      <div className="modal-cta-wrap">
+        <Button
+          type="submit"
+          variant="brand"
+          disabled={isSubmitDisabled}
+          onClick={onAddSoftware}
+        >
+          Add software
+        </Button>
+        <Button onClick={onExit} variant="inverse">
+          Cancel
+        </Button>
+      </div>
+    </div>
+  );
+};
+
+export default AppStoreVpp;
diff --git a/frontend/pages/SoftwarePage/components/AppStoreVpp/_styles.scss b/frontend/pages/SoftwarePage/components/AppStoreVpp/_styles.scss
new file mode 100644
index 000000000000..604750a25808
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/AppStoreVpp/_styles.scss
@@ -0,0 +1,88 @@
+.app-store-vpp {
+  margin-top: $pad-large;
+
+  &__list-container {
+    border: 1px solid $ui-fleet-black-10;
+    border-radius: $border-radius-medium;
+  }
+
+  &__list {
+    max-height: 315px;
+    overflow-y: auto;
+    list-style: none;
+    margin: 0;
+    padding: 0;
+  }
+
+  &__list-item {
+    display: flex;
+    gap: $pad-medium;
+    align-items: center;
+    padding: $pad-small $pad-medium;
+    border-bottom: 1px solid $ui-fleet-black-10;
+
+    .app-platform {
+      color: $ui-fleet-black-50;
+    }
+
+    &:last-child {
+      border-bottom: none;
+    }
+  }
+
+  &__app-info {
+    display: flex;
+    align-items: center;
+    gap: $pad-small;
+  }
+
+  &__no-software {
+    display: flex;
+    flex-direction: column;
+    gap: $pad-small;
+    align-items: center;
+    padding: $pad-xxlarge 48px;
+    font-size: $x-small;
+  }
+
+  &__no-software-title {
+    font-weight: $bold;
+    margin: 0;
+  }
+
+  &__no-software-description {
+    margin: 0;
+    color: $ui-fleet-black-75;
+    text-align: center;
+  }
+
+  &__error {
+    margin: $pad-xxlarge 0;
+  }
+
+  &__modal-body {
+    display: flex;
+    flex-direction: column;
+    gap: $pad-medium;
+  }
+
+  &__enable-vpp {
+    display: flex;
+    flex-direction: column;
+    min-height: 149px;
+    align-items: center;
+    justify-content: center;
+    gap: $pad-small;
+
+    p {
+      margin: 0;
+    }
+  }
+
+  &__help-text {
+    @include help-text;
+    .custom-link {
+      font-size: $xx-small;
+    }
+  }
+}
diff --git a/frontend/pages/SoftwarePage/components/AppStoreVpp/helpers.tsx b/frontend/pages/SoftwarePage/components/AppStoreVpp/helpers.tsx
new file mode 100644
index 000000000000..76c131769fa1
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/AppStoreVpp/helpers.tsx
@@ -0,0 +1,90 @@
+import React from "react";
+import { getErrorReason } from "interfaces/errors";
+import { IMdmVppToken } from "interfaces/mdm";
+import { IVppApp } from "services/entities/mdm_apple";
+import { buildQueryStringFromParams } from "utilities/url";
+
+const ADD_SOFTWARE_ERROR_PREFIX = "Couldn’t add software.";
+const DEFAULT_ERROR_MESSAGE = `${ADD_SOFTWARE_ERROR_PREFIX} Please try again.`;
+
+const generateAlreadyAvailableMessage = (msg: string) => {
+  // This regex matches the API message where the title already has a software package (non-VPP) available for install.
+  const regex = new RegExp(
+    `${ADD_SOFTWARE_ERROR_PREFIX} (.+) already.+on the (.+) team.`
+  );
+
+  const match = msg.match(regex);
+  if (!match) {
+    if (msg.includes("VPPApp")) {
+      // This is the case where someone already added this VPP app. This should almost never happen
+      // because we omit apps that are already available from the list in the UI, but just in case of
+      // shenanigans with concurrent requests or something, we'll handle it with a generic message.
+      // The list should clear itself up on the next page load.
+      return `${ADD_SOFTWARE_ERROR_PREFIX} The software is already available to install on this team.`;
+    }
+    return DEFAULT_ERROR_MESSAGE;
+  }
+
+  return (
+    <>
+      {ADD_SOFTWARE_ERROR_PREFIX} <b>{match[1]}</b> already has software
+      available for install on the <b>{match[2]}</b> team.{" "}
+    </>
+  );
+};
+
+// eslint-disable-next-line import/prefer-default-export
+export const getErrorMessage = (e: unknown) => {
+  const reason = getErrorReason(e);
+
+  // software is already available for install
+  if (reason.toLowerCase().includes("already")) {
+    return generateAlreadyAvailableMessage(reason);
+  }
+  return DEFAULT_ERROR_MESSAGE;
+};
+
+export const getUniqueAppId = (app: IVppApp) =>
+  `${app.app_store_id}_${app.platform}`;
+
+/**
+ * Generates the query params for the redirect to the software page. This
+ * will either generate query params to filter by available for install or
+ * self service.
+ */
+export const generateRedirectQueryParams = (
+  teamId: number,
+  isSelfService: boolean
+) => {
+  let queryParams = buildQueryStringFromParams({ team_id: teamId });
+  if (isSelfService) {
+    queryParams = `${queryParams}&self_service=true`;
+  } else {
+    queryParams = `${queryParams}&available_for_install=true`;
+  }
+  return queryParams;
+};
+
+/**
+ * Checks if the given team has an available VPP token (either a token
+ * that's associated with the team, or a token that's available to "All
+ * teams")
+ */
+export const teamHasVPPToken = (
+  currentTeamId: number,
+  tokens?: IMdmVppToken[]
+) => {
+  if (!tokens || tokens.length === 0) {
+    return false;
+  }
+
+  return tokens.some((token) => {
+    // if we've got a non-null, empty array it means the token is available for
+    // "All teams"
+    if (token.teams?.length === 0) {
+      return true;
+    }
+
+    return token.teams?.some((team) => team.team_id === currentTeamId);
+  });
+};
diff --git a/frontend/pages/SoftwarePage/components/AppStoreVpp/index.ts b/frontend/pages/SoftwarePage/components/AppStoreVpp/index.ts
new file mode 100644
index 000000000000..b0dbd383b223
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/AppStoreVpp/index.ts
@@ -0,0 +1 @@
+export { default } from "./AppStoreVpp";
diff --git a/frontend/pages/SoftwarePage/components/EmptySoftwareTable/EmptySoftwareTable.tsx b/frontend/pages/SoftwarePage/components/EmptySoftwareTable/EmptySoftwareTable.tsx
index 32149da0ca0a..829b4ff136a1 100644
--- a/frontend/pages/SoftwarePage/components/EmptySoftwareTable/EmptySoftwareTable.tsx
+++ b/frontend/pages/SoftwarePage/components/EmptySoftwareTable/EmptySoftwareTable.tsx
@@ -1,33 +1,31 @@
-// This component is used on DashboardPage.tsx > Software.tsx,
-// Host Details / Device User > Software.tsx, and SoftwarePage.tsx
-
 import React from "react";
-
 import CustomLink from "components/CustomLink";
 import EmptyTable from "components/EmptyTable";
 import { IEmptyTableProps } from "interfaces/empty_table";
-import { ISoftwareDropdownFilterVal } from "pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers";
+import {
+  getVulnFilterRenderDetails,
+  ISoftwareDropdownFilterVal,
+  ISoftwareVulnFiltersParams,
+} from "pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers";
 
 export interface IEmptySoftwareTableProps {
   softwareFilter?: ISoftwareDropdownFilterVal;
-  /** tableName is displayed in the search empty state */
+  vulnFilters?: ISoftwareVulnFiltersParams;
   tableName?: string;
   isSoftwareDisabled?: boolean;
-  /** isNotDetectingSoftware renders empty states when no search string is present */
-  isNotDetectingSoftware?: boolean;
-  /** isCollectingSoftware is only used on the Dashboard page with a TODO to revisit */
-  isCollectingSoftware?: boolean;
-  isFilterVulnerable?: boolean;
+  noSearchQuery?: boolean;
+  installableSoftwareExists?: boolean;
 }
 
 const generateTypeText = (
   tableName: string,
-  softwareFilter?: ISoftwareDropdownFilterVal
+  softwareFilter?: ISoftwareDropdownFilterVal,
+  vulnFilters?: ISoftwareVulnFiltersParams
 ) => {
   if (softwareFilter === "installableSoftware") {
     return "installable software";
   }
-  if (softwareFilter === "vulnerableSoftware") {
+  if (vulnFilters?.vulnerable) {
     return "vulnerable software";
   }
   return tableName;
@@ -35,47 +33,69 @@ const generateTypeText = (
 
 const EmptySoftwareTable = ({
   softwareFilter = "allSoftware",
+  vulnFilters,
   tableName = "software",
   isSoftwareDisabled,
-  isNotDetectingSoftware,
-  isCollectingSoftware,
-  isFilterVulnerable,
+  noSearchQuery,
+  installableSoftwareExists,
 }: IEmptySoftwareTableProps): JSX.Element => {
-  const softwareTypeText = generateTypeText(tableName, softwareFilter);
+  const softwareTypeText = generateTypeText(
+    tableName,
+    softwareFilter,
+    vulnFilters
+  );
 
-  const emptySoftware: IEmptyTableProps = {
-    header: "No items match the current search criteria",
-    info: `Expecting to see ${softwareTypeText}? Check back later.`,
-  };
+  const { filterCount: vulnFiltersCount } = getVulnFilterRenderDetails(
+    vulnFilters
+  );
 
-  if (isNotDetectingSoftware && softwareFilter === "allSoftware") {
-    emptySoftware.header = "No software detected";
-  }
+  const isFiltered =
+    vulnFiltersCount > 0 || !noSearchQuery || softwareFilter !== "allSoftware";
 
-  if (isCollectingSoftware) {
-    emptySoftware.header = "No software detected";
-    emptySoftware.info =
-      "This report is updated every hour to protect the performance of your devices.";
-  }
+  const getEmptySoftwareInfo = (): IEmptyTableProps => {
+    if (isSoftwareDisabled) {
+      return {
+        header: "Software inventory disabled",
+        info: (
+          <>
+            Users with the admin role can{" "}
+            <CustomLink
+              url="https://fleetdm.com/docs/using-fleet/vulnerability-processing#configuration"
+              text="turn on software inventory"
+              newTab
+            />
+            .
+          </>
+        ),
+      };
+    }
 
-  if (isSoftwareDisabled) {
-    emptySoftware.header = "Software inventory disabled";
-    emptySoftware.info = (
-      <>
-        Users with the admin role can{" "}
-        <CustomLink
-          url="https://fleetdm.com/docs/using-fleet/vulnerability-processing#configuration"
-          text="turn on software inventory"
-          newTab
-        />
-        .
-      </>
-    );
-  }
+    if (!isFiltered) {
+      if (softwareFilter === "allSoftware") {
+        if (installableSoftwareExists) {
+          return {
+            header: `No ${tableName} detected`,
+            info: "Install software on your hosts to see versions.",
+          };
+        }
+        return {
+          header: `No ${tableName} detected`,
+          info: `Expecting to see ${softwareTypeText}? Check back later.`,
+        };
+      }
+    }
+
+    return {
+      header: "No items match the current search criteria",
+      info: `Expecting to see ${softwareTypeText}? Check back later.`,
+    };
+  };
+
+  const emptySoftware = getEmptySoftwareInfo();
 
   return (
     <EmptyTable
-      graphicName="empty-software"
+      graphicName="empty-search-question"
       header={emptySoftware.header}
       info={emptySoftware.info}
     />
diff --git a/frontend/pages/SoftwarePage/components/EmptyVulnerabilitiesTable/EmptyVulnerabilitiesTable.tsx b/frontend/pages/SoftwarePage/components/EmptyVulnerabilitiesTable/EmptyVulnerabilitiesTable.tsx
new file mode 100644
index 000000000000..107fd9fb328c
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/EmptyVulnerabilitiesTable/EmptyVulnerabilitiesTable.tsx
@@ -0,0 +1,111 @@
+import React from "react";
+import CustomLink from "components/CustomLink";
+import EmptyTable from "components/EmptyTable";
+import { IEmptyTableProps } from "interfaces/empty_table";
+import { IVulnerabilitiesEmptyStateReason } from "services/entities/vulnerabilities";
+
+export interface IEmptyVulnerabilitiesTableProps {
+  isPremiumTier?: boolean;
+  teamId?: number;
+  exploitedFilter?: boolean;
+  isSoftwareDisabled?: boolean;
+  emptyStateReason?: IVulnerabilitiesEmptyStateReason;
+}
+
+const LearnMoreLink = () => (
+  <CustomLink
+    url="https://fleetdm.com/learn-more-about/vulnerability-processing"
+    text="Learn more"
+    newTab
+  />
+);
+
+const emptyStateDetails: Record<
+  IVulnerabilitiesEmptyStateReason,
+  Partial<IEmptyTableProps>
+> = {
+  "no-vulns-detected": {
+    graphicName: "empty-search-question",
+    header: "No vulnerabilities detected",
+    info: "Expecting to see vulnerabilities? Check back later.",
+  },
+  "no-matching-items": {
+    graphicName: "empty-search-question",
+    header: "No items match the current search criteria",
+    info: "Expecting to see vulnerabilities? Check back later.",
+  },
+  "invalid-cve": {
+    graphicName: "empty-search-exclamation",
+    header: "That vulnerability (CVE) is not valid",
+    info:
+      'Try updating your search to use CVE format: "CVE-YYYY-<4 or more digits>"',
+  },
+  "unknown-cve": {
+    graphicName: "empty-search-question",
+    header: "This is not a known CVE",
+    info: "None of Fleet's vulnerability sources are aware of this CVE.",
+    additionalInfo: <LearnMoreLink />,
+  },
+  "known-vuln": {
+    graphicName: "empty-search-check",
+    header:
+      "This is a known vulnerability (CVE), but it wasn't detected on any hosts",
+    additionalInfo: <LearnMoreLink />,
+  },
+};
+
+const EmptyVulnerabilitiesTable: React.FC<IEmptyVulnerabilitiesTableProps> = ({
+  isPremiumTier,
+  teamId,
+  exploitedFilter,
+  isSoftwareDisabled,
+  emptyStateReason,
+}) => {
+  if (isSoftwareDisabled) {
+    return (
+      <EmptyTable
+        graphicName="empty-search-question"
+        header="Software inventory disabled"
+        info={
+          <>
+            Users with the admin role can{" "}
+            <CustomLink
+              url="https://fleetdm.com/docs/using-fleet/vulnerability-processing#configuration"
+              text="turn on software inventory"
+              newTab
+            />
+            .
+          </>
+        }
+      />
+    );
+  }
+
+  const defaultEmptyState: IEmptyTableProps = {
+    graphicName: "empty-search-question",
+    header: "No items match the current search criteria",
+    info: "Expecting to see vulnerabilities? Check back later.",
+  };
+
+  const emptyState = emptyStateReason
+    ? { ...defaultEmptyState, ...emptyStateDetails[emptyStateReason] }
+    : defaultEmptyState;
+
+  if (emptyStateReason === "known-vuln" && teamId !== undefined) {
+    emptyState.header += " in this team";
+  }
+
+  if (
+    isPremiumTier &&
+    exploitedFilter &&
+    emptyStateReason !== "unknown-cve" &&
+    emptyStateReason !== "invalid-cve"
+  ) {
+    emptyState.info =
+      "Try removing the exploited vulnerabilities filter to expand your search.";
+  }
+
+  return <EmptyTable {...emptyState} />;
+};
+
+export default EmptyVulnerabilitiesTable;
diff --git a/frontend/pages/SoftwarePage/components/EmptyVulnerabilitiesTable/index.ts b/frontend/pages/SoftwarePage/components/EmptyVulnerabilitiesTable/index.ts
new file mode 100644
index 000000000000..66d385ed4e40
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/EmptyVulnerabilitiesTable/index.ts
@@ -0,0 +1 @@
+export { default } from "./EmptyVulnerabilitiesTable";
diff --git a/frontend/pages/SoftwarePage/components/SoftwareDetailsSummary/SoftwareDetailsSummary.tsx b/frontend/pages/SoftwarePage/components/SoftwareDetailsSummary/SoftwareDetailsSummary.tsx
index bf18d8c47d17..2dd8c25dc114 100644
--- a/frontend/pages/SoftwarePage/components/SoftwareDetailsSummary/SoftwareDetailsSummary.tsx
+++ b/frontend/pages/SoftwarePage/components/SoftwareDetailsSummary/SoftwareDetailsSummary.tsx
@@ -24,6 +24,7 @@ interface ISoftwareDetailsSummaryProps {
   name?: string;
   source?: string;
   versions?: number;
+  iconUrl?: string;
 }
 
 const SoftwareDetailsSummary = ({
@@ -34,10 +35,11 @@ const SoftwareDetailsSummary = ({
   name,
   source,
   versions,
+  iconUrl,
 }: ISoftwareDetailsSummaryProps) => {
   return (
     <div className={baseClass}>
-      <SoftwareIcon name={name} source={source} size="large" />
+      <SoftwareIcon name={name} source={source} url={iconUrl} size="xlarge" />
       <dl className={`${baseClass}__info`}>
         <h1>{title}</h1>
         <dl className={`${baseClass}__description-list`}>
diff --git a/frontend/pages/SoftwarePage/components/SoftwareFiltersModal/SoftwareFiltersModal.tsx b/frontend/pages/SoftwarePage/components/SoftwareFiltersModal/SoftwareFiltersModal.tsx
new file mode 100644
index 000000000000..91223b5746b5
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/SoftwareFiltersModal/SoftwareFiltersModal.tsx
@@ -0,0 +1,127 @@
+import React, { useState } from "react";
+
+// @ts-ignore
+import Dropdown from "components/forms/fields/Dropdown";
+import Modal from "components/Modal";
+import Button from "components/buttons/Button";
+import Slider from "components/forms/fields/Slider";
+import Checkbox from "components/forms/fields/Checkbox";
+import TooltipWrapper from "components/TooltipWrapper";
+import {
+  findOptionBySeverityRange,
+  ISoftwareVulnFilters,
+  ISoftwareVulnFiltersParams,
+  SEVERITY_DROPDOWN_OPTIONS,
+} from "pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers";
+
+const baseClass = "software-filters-modal";
+
+interface ISoftwareFiltersModalProps {
+  onExit: () => void;
+  onSubmit: (vulnFilters: ISoftwareVulnFiltersParams) => void;
+  vulnFilters: ISoftwareVulnFiltersParams;
+  isPremiumTier: boolean;
+}
+
+const SoftwareFiltersModal = ({
+  onExit,
+  onSubmit,
+  vulnFilters,
+  isPremiumTier,
+}: ISoftwareFiltersModalProps) => {
+  const [vulnSoftwareFilterEnabled, setVulnSoftwareFilterEnabled] = useState(
+    vulnFilters.vulnerable || false
+  );
+  const [severity, setSeverity] = useState(
+    findOptionBySeverityRange(
+      vulnFilters.minCvssScore,
+      vulnFilters.maxCvssScore
+    )
+  );
+  const [hasKnownExploit, setHasKnownExploit] = useState(vulnFilters.exploit);
+
+  const onChangeSeverity = (value: string) => {
+    const selectedOption = SEVERITY_DROPDOWN_OPTIONS.find(
+      (option) => option.value === value
+    );
+    if (selectedOption) {
+      setSeverity(selectedOption);
+    }
+  };
+
+  const onApplyFilters = () => {
+    onSubmit({
+      vulnerable: vulnSoftwareFilterEnabled,
+      exploit: hasKnownExploit || undefined,
+      minCvssScore: severity?.minSeverity || undefined,
+      maxCvssScore: severity?.maxSeverity || undefined,
+    });
+  };
+
+  const renderSeverityLabel = () => {
+    return (
+      <TooltipWrapper
+        tipContent="The worst case impact across different environments (CVSS version 3.x base score)."
+        clickable={false}
+      >
+        Severity
+      </TooltipWrapper>
+    );
+  };
+
+  const renderModalContent = () => {
+    return (
+      <>
+        <Slider
+          value={vulnSoftwareFilterEnabled}
+          onChange={() =>
+            setVulnSoftwareFilterEnabled(!vulnSoftwareFilterEnabled)
+          }
+          inactiveText="Vulnerable software"
+          activeText="Vulnerable software"
+        />
+        {isPremiumTier && (
+          <Dropdown
+            label={renderSeverityLabel()}
+            options={SEVERITY_DROPDOWN_OPTIONS}
+            value={severity}
+            onChange={onChangeSeverity}
+            placeholder="Any severity"
+            className={`${baseClass}__select-severity`}
+            disabled={!vulnSoftwareFilterEnabled}
+          />
+        )}
+        {isPremiumTier && (
+          <Checkbox
+            onChange={({ value }: { value: boolean }) =>
+              setHasKnownExploit(value)
+            }
+            name="hasKnownExploit"
+            value={hasKnownExploit}
+            parseTarget
+            helpText="Software has vulnerabilities that have been actively exploited in the wild."
+            disabled={!vulnSoftwareFilterEnabled}
+          >
+            Has known exploit
+          </Checkbox>
+        )}
+        <div className="modal-cta-wrap">
+          <Button variant="brand" onClick={onApplyFilters}>
+            Apply
+          </Button>
+          <Button variant="inverse" onClick={onExit}>
+            Cancel
+          </Button>
+        </div>
+      </>
+    );
+  };
+
+  return (
+    <Modal title="Filters" onExit={onExit} className={baseClass}>
+      {renderModalContent()}
+    </Modal>
+  );
+};
+
+export default SoftwareFiltersModal;
diff --git a/frontend/pages/SoftwarePage/components/SoftwareFiltersModal/_styles.scss b/frontend/pages/SoftwarePage/components/SoftwareFiltersModal/_styles.scss
new file mode 100644
index 000000000000..6239c7da77b5
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/SoftwareFiltersModal/_styles.scss
@@ -0,0 +1,15 @@
+.software-filters-modal {
+  .select-menu-outer {
+    min-height: 500px;
+  }
+
+  .modal__content {
+    display: flex;
+    flex-direction: column;
+    gap: $pad-medium;
+  }
+
+  .Select-menu {
+    padding-bottom: $pad-medium;
+  }
+}
diff --git a/frontend/pages/SoftwarePage/components/SoftwareFiltersModal/index.ts b/frontend/pages/SoftwarePage/components/SoftwareFiltersModal/index.ts
new file mode 100644
index 000000000000..7afc56184cce
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/SoftwareFiltersModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./SoftwareFiltersModal";
diff --git a/frontend/pages/SoftwarePage/components/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx b/frontend/pages/SoftwarePage/components/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx
index 0cc5f31ac5a3..172d09569eb2 100644
--- a/frontend/pages/SoftwarePage/components/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx
+++ b/frontend/pages/SoftwarePage/components/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx
@@ -1,7 +1,7 @@
 /**
-software/versions/:id > Vulnerabilities table
-software/os/:id > Vulnerabilities table
-*/
+ software/versions/:id > Vulnerabilities table
+ software/os/:id > Vulnerabilities table
+ */
 
 import React, { useContext, useMemo } from "react";
 import classnames from "classnames";
@@ -11,7 +11,8 @@ import PATHS from "router/paths";
 
 import { AppContext } from "context/app";
 import { ISoftwareVulnerability } from "interfaces/software";
-import { GITHUB_NEW_ISSUE_LINK } from "utilities/constants";
+import { CONTACT_FLEET_LINK, GITHUB_NEW_ISSUE_LINK } from "utilities/constants";
+import { DisplayPlatform } from "interfaces/platform";
 import { buildQueryStringFromParams } from "utilities/url";
 import TableContainer from "components/TableContainer";
 import TableCount from "components/TableContainer/TableCount";
@@ -26,6 +27,10 @@ interface INoVulnsDetectedProps {
   itemName: string;
 }
 
+interface IVulnsNotSupportedProps {
+  platformText?: DisplayPlatform;
+}
+
 const NoVulnsDetected = ({ itemName }: INoVulnsDetectedProps): JSX.Element => {
   return (
     <EmptyTable
@@ -44,6 +49,20 @@ const NoVulnsDetected = ({ itemName }: INoVulnsDetectedProps): JSX.Element => {
   );
 };
 
+export const VulnsNotSupported = ({
+  platformText,
+}: IVulnsNotSupportedProps) => (
+  <EmptyTable
+    header="Vulnerabilities are not supported for this type of host"
+    info={
+      <>
+        Interested in vulnerabilities in {platformText ?? "this platform"}?{" "}
+        <CustomLink url={CONTACT_FLEET_LINK} text="Let us know" newTab />
+      </>
+    }
+  />
+);
+
 interface ISoftwareVulnerabilitiesTableProps {
   data: ISoftwareVulnerability[];
   /** Name displayed on the empty state */
diff --git a/frontend/pages/SoftwarePage/components/VersionCell/VersionCell.tsx b/frontend/pages/SoftwarePage/components/VersionCell/VersionCell.tsx
index 8452a0f92bdc..3143eb32bab8 100644
--- a/frontend/pages/SoftwarePage/components/VersionCell/VersionCell.tsx
+++ b/frontend/pages/SoftwarePage/components/VersionCell/VersionCell.tsx
@@ -5,7 +5,7 @@ import TooltipWrapper from "components/TooltipWrapper";
 
 const generateText = <T extends { version: string }>(versions: T[] | null) => {
   if (!versions) {
-    return <TextCell value="---" grey italic />;
+    return <TextCell value="---" grey />;
   }
   const text =
     versions.length !== 1 ? `${versions.length} versions` : versions[0].version;
diff --git a/frontend/pages/SoftwarePage/components/VulnerabilitiesCell/VulnerabilitiesCell.tsx b/frontend/pages/SoftwarePage/components/VulnerabilitiesCell/VulnerabilitiesCell.tsx
index 2fd45edfbd0b..2ba4ba17757b 100644
--- a/frontend/pages/SoftwarePage/components/VulnerabilitiesCell/VulnerabilitiesCell.tsx
+++ b/frontend/pages/SoftwarePage/components/VulnerabilitiesCell/VulnerabilitiesCell.tsx
@@ -12,15 +12,13 @@ const baseClass = "vulnerabilities-cell";
 const generateCell = (
   vulnerabilities: ISoftwareVulnerability[] | string[] | null
 ) => {
-  if (vulnerabilities === null) {
-    return <TextCell value="---" grey italic />;
+  if (vulnerabilities === null || vulnerabilities.length === 0) {
+    return <TextCell value="---" grey />;
   }
 
   let text = "";
   let italicize = true;
-  if (vulnerabilities.length === 0) {
-    text = "---";
-  } else if (vulnerabilities.length === 1) {
+  if (vulnerabilities.length === 1) {
     italicize = false;
     text =
       typeof vulnerabilities[0] === "string"
@@ -63,7 +61,7 @@ const generateTooltip = (
     return null;
   }
 
-  const condensedVulnerabilties = condenseVulnerabilities(vulnerabilities);
+  const condensedVulnerabilities = condenseVulnerabilities(vulnerabilities);
 
   return (
     <ReactTooltip
@@ -73,8 +71,10 @@ const generateTooltip = (
       data-html
     >
       <ul className={`${baseClass}__vulnerability-list`}>
-        {condensedVulnerabilties.map((vulnerability) => {
-          return <li>{vulnerability}</li>;
+        {condensedVulnerabilities.map((vulnerability) => {
+          const key =
+            typeof vulnerability === "string" ? vulnerability : uniqueId();
+          return <li key={key}>{vulnerability}</li>;
         })}
       </ul>
     </ReactTooltip>
diff --git a/frontend/pages/SoftwarePage/components/icons/AppStore.tsx b/frontend/pages/SoftwarePage/components/icons/AppStore.tsx
new file mode 100644
index 000000000000..42632e584af8
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/icons/AppStore.tsx
@@ -0,0 +1,14 @@
+import React from "react";
+
+import type { SVGProps } from "react";
+
+const AppStore = (props: SVGProps<SVGSVGElement>) => (
+  <svg xmlns="http://www.w3.org/2000/svg" fill="none" {...props}>
+    <path fill="#515774" d="M0 0h32v32H0z" />
+    <path
+      d="m15.96 7.564.648-1.12A1.458 1.458 0 1 1 19.136 7.9l-6.244 10.808h4.516c1.464 0 2.284 1.72 1.648 2.912H5.816a1.451 1.451 0 0 1-1.456-1.456c0-.808.648-1.456 1.456-1.456h3.712l4.752-8.236-1.484-2.576a1.46 1.46 0 0 1 2.528-1.456l.636 1.124ZM10.344 23.12l-1.4 2.428a1.458 1.458 0 1 1-2.528-1.456l1.04-1.8c1.176-.364 2.132-.084 2.888.828ZM22.4 18.716h3.788c.808 0 1.456.648 1.456 1.456 0 .808-.648 1.456-1.456 1.456h-2.104l1.42 2.464a1.46 1.46 0 0 1-2.528 1.456c-2.392-4.148-4.188-7.252-5.38-9.32-1.22-2.104-.348-4.216.512-4.932.956 1.64 2.384 4.116 4.292 7.42Z"
+      fill="#fff"
+    />
+  </svg>
+);
+export default AppStore;
diff --git a/frontend/pages/SoftwarePage/components/icons/MacApp.tsx b/frontend/pages/SoftwarePage/components/icons/AppleApp.tsx
similarity index 93%
rename from frontend/pages/SoftwarePage/components/icons/MacApp.tsx
rename to frontend/pages/SoftwarePage/components/icons/AppleApp.tsx
index 57d0977f082d..0139e2094cb6 100644
--- a/frontend/pages/SoftwarePage/components/icons/MacApp.tsx
+++ b/frontend/pages/SoftwarePage/components/icons/AppleApp.tsx
@@ -2,7 +2,7 @@ import React from "react";
 
 import type { SVGProps } from "react";
 
-const MacApp = (props: SVGProps<SVGSVGElement>) => (
+const AppleApp = (props: SVGProps<SVGSVGElement>) => (
   <svg xmlns="http://www.w3.org/2000/svg" fill="none" {...props}>
     <path fill="#515774" d="M0 0h32v32H0z" />
     <path
@@ -13,4 +13,4 @@ const MacApp = (props: SVGProps<SVGSVGElement>) => (
     />
   </svg>
 );
-export default MacApp;
+export default AppleApp;
diff --git a/frontend/pages/SoftwarePage/components/icons/SoftwareIcon/SoftwareIcon.tsx b/frontend/pages/SoftwarePage/components/icons/SoftwareIcon/SoftwareIcon.tsx
index 2e93fc927222..e7c29fec988e 100644
--- a/frontend/pages/SoftwarePage/components/icons/SoftwareIcon/SoftwareIcon.tsx
+++ b/frontend/pages/SoftwarePage/components/icons/SoftwareIcon/SoftwareIcon.tsx
@@ -1,34 +1,57 @@
 import React from "react";
+import classnames from "classnames";
+
 import getMatchedSoftwareIcon from "../";
 
 const baseClass = "software-icon";
 
+type SoftwareIconSizes = "small" | "medium" | "large" | "xlarge";
+
 interface ISoftwareIconProps {
   name?: string;
   source?: string;
   size?: SoftwareIconSizes;
+  /** Accepts an image url to display for a the software icon image. */
+  url?: string;
 }
 
-const SOFTWARE_ICON_SIZES: Record<string, string> = {
-  medium: "24",
-  meduim_large: "64", // TODO: rename this to large and update large to xlarge
-  large: "96",
-} as const;
-
-type SoftwareIconSizes = keyof typeof SOFTWARE_ICON_SIZES;
+const SOFTWARE_ICON_SIZES: Record<SoftwareIconSizes, string> = {
+  small: "24",
+  medium: "40",
+  large: "64",
+  xlarge: "96",
+};
 
 const SoftwareIcon = ({
   name = "",
   source = "",
-  size = "medium",
+  size = "small",
+  url,
 }: ISoftwareIconProps) => {
+  const classNames = classnames(baseClass, `${baseClass}__${size}`);
+
+  // If we are given a url to render as the icon, we need to render it
+  // differently than the svg icons. We will use an img tag instead with the
+  // src set to the url.
+  if (url) {
+    const imgClasses = classnames(
+      `${baseClass}__software-img`,
+      `${baseClass}__software-img-${size}`
+    );
+    return (
+      <div className={classNames}>
+        <img className={imgClasses} src={url} alt="" />
+      </div>
+    );
+  }
+
   const MatchedIcon = getMatchedSoftwareIcon({ name, source });
   return (
     <MatchedIcon
       width={SOFTWARE_ICON_SIZES[size]}
       height={SOFTWARE_ICON_SIZES[size]}
       viewBox="0 0 32 32"
-      className={baseClass}
+      className={classNames}
     />
   );
 };
diff --git a/frontend/pages/SoftwarePage/components/icons/SoftwareIcon/_styles.scss b/frontend/pages/SoftwarePage/components/icons/SoftwareIcon/_styles.scss
index 328a564a1e7a..bb62bd5cb87b 100644
--- a/frontend/pages/SoftwarePage/components/icons/SoftwareIcon/_styles.scss
+++ b/frontend/pages/SoftwarePage/components/icons/SoftwareIcon/_styles.scss
@@ -1,5 +1,64 @@
 .software-icon {
   flex-shrink: 0;
   border: 1px solid $ui-fleet-black-10;
-  border-radius: 8px;
+
+  &__small {
+    border-radius: $border-radius;
+  }
+
+  &__medium {
+    border-radius: $border-radius-xlarge;
+  }
+
+  &__large {
+    border-radius: $border-radius-xxlarge;
+  }
+
+  &__xlarge {
+    border-radius: $border-radius-xxlarge;
+  }
+
+  &__software-img {
+    display: block;
+  }
+
+  // These following classs are when a software icon is passed a url prop. In
+  // this case we need to add custom width,height, and padding to show these
+  // icons correctly.
+
+  // we use this selector to give higher specifity than the selector
+  // ".core-wrapper a img" which is in /styles/global/_styles.scss
+  // TODO: we should change ".core-wrapper a img" selector in that file
+  // as it too generic and can affect other parts of the app.
+  > img.software-icon__software-img-small {
+    width: 22px;
+    height: 22px;
+    border-radius: $border-radius-small;
+    padding: 1px;
+    margin-left: 0;
+  }
+
+  >img.software-icon__software-img-medium {
+    width: 38px;
+    height: 38px;
+    border-radius: $border-radius-xlarge;
+    padding: 1px;
+    margin-left: 0;
+  }
+
+  >img.software-icon__software-img-large {
+    width: 60px;
+    height: 60px;
+    border-radius: $border-radius-xxlarge;
+    padding: 1px;
+    margin-left: 0;
+  }
+
+  >img.software-icon__software-img-xlarge {
+    width: 88px;
+    height: 88px;
+    border-radius: $border-radius-xxlarge;
+    padding: $pad-xsmall;
+    margin-left: 0;
+  }
 }
diff --git a/frontend/pages/SoftwarePage/components/icons/iOS.tsx b/frontend/pages/SoftwarePage/components/icons/iOS.tsx
new file mode 100644
index 000000000000..0feb26a0bd4c
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/icons/iOS.tsx
@@ -0,0 +1,61 @@
+import React from "react";
+
+import type { SVGProps } from "react";
+
+const iOS = (props: SVGProps<SVGSVGElement>) => {
+  // Note: smaller icon on OS table has thicker outline and a smaller Apple logo
+  if (props.width === "24") {
+    return (
+      <svg fill="none" xmlns="http://www.w3.org/2000/svg" {...props}>
+        <g transform="translate(4, 4) scale(1.5)">
+          <rect
+            x="5"
+            y="2.75"
+            width="6"
+            height="10.5"
+            rx="1.25"
+            stroke="#515774"
+            strokeWidth="1.5"
+          />
+          <path
+            fillRule="evenodd"
+            clipRule="evenodd"
+            d="M8.832 5.938c.027.22-.079.438-.22.595a.793.793 0 0 1-.613.265c-.03-.213.084-.438.22-.576a.969.969 0 0 1 .613-.285Zm.393 2.324v.004c.075.146.286.367.463.423a.337.337 0 0 1-.01.025l-.008.026c-.049.134-.18.359-.269.477-.176.23-.353.454-.64.466a.834.834 0 0 1-.316-.073c-.101-.039-.205-.079-.37-.077a.902.902 0 0 0-.381.081c-.09.035-.176.07-.299.073-.273.012-.48-.245-.656-.47a3.037 3.037 0 0 1-.27-.473 2.205 2.205 0 0 1-.132-.462v-.008a2.041 2.041 0 0 1-.017-.458v-.008c.013-.146.092-.379.163-.477.176-.277.48-.458.824-.466l.053-.004h.004c.147-.007.29.046.416.092.097.036.183.068.255.066a.915.915 0 0 0 .268-.066c.154-.052.335-.114.512-.1.3.004.59.13.771.367a1.617 1.617 0 0 0-.145.107c0 .004-.005.004-.005.004a.754.754 0 0 0-.282.473v.004a.748.748 0 0 0 .07.454Z"
+            fill="#515774"
+          />
+          <path
+            d="M6.875 3h2.25v1a.5.5 0 0 1-.5.5h-1.25a.5.5 0 0 1-.5-.5V3Z"
+            fill="#515774"
+          />
+        </g>
+      </svg>
+    );
+  }
+  return (
+    <svg fill="none" xmlns="http://www.w3.org/2000/svg" {...props}>
+      <g transform="translate(7, 7) scale(0.75)">
+        <rect
+          x="5.25"
+          y=".75"
+          width="13.5"
+          height="22.5"
+          rx="1.25"
+          stroke="#515774"
+          strokeWidth="1.5"
+        />
+        <path
+          fillRule="evenodd"
+          clipRule="evenodd"
+          d="M13.665 7.875c.053.442-.159.876-.441 1.192-.29.324-.767.56-1.225.529-.062-.426.167-.876.44-1.153.3-.315.803-.552 1.226-.568Zm.784 4.65v.007c.15.293.573.735.926.845a.7.7 0 0 1-.018.051c-.006.018-.013.036-.017.052-.097.268-.362.718-.538.955-.353.458-.705.908-1.278.931-.27-.003-.45-.074-.634-.145-.203-.079-.41-.159-.742-.155-.34-.004-.554.08-.76.162-.179.07-.352.139-.597.146-.547.024-.961-.49-1.314-.94-.167-.236-.44-.702-.538-.946-.097-.23-.238-.687-.264-.924v-.016c-.035-.237-.07-.726-.035-.915v-.016c.026-.292.185-.758.326-.955.352-.553.96-.916 1.648-.932l.106-.008h.009c.294-.013.579.092.83.184.194.071.368.135.51.132.137.003.324-.06.538-.133.306-.104.669-.227 1.022-.199.6.008 1.182.26 1.543.735a3.243 3.243 0 0 0-.29.213c0 .008-.01.008-.01.008-.229.15-.51.552-.564.947v.008c-.053.3.01.67.141.907Z"
+          fill="#515774"
+        />
+        <path
+          d="M9.75 1h4.5v1a.5.5 0 0 1-.5.5h-3.5a.5.5 0 0 1-.5-.5V1Z"
+          fill="#515774"
+        />
+      </g>
+    </svg>
+  );
+};
+
+export default iOS;
diff --git a/frontend/pages/SoftwarePage/components/icons/iPadOS.tsx b/frontend/pages/SoftwarePage/components/icons/iPadOS.tsx
new file mode 100644
index 000000000000..7416c688db93
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/icons/iPadOS.tsx
@@ -0,0 +1,53 @@
+import React from "react";
+
+import type { SVGProps } from "react";
+
+const iPadOS = (props: SVGProps<SVGSVGElement>) => {
+  // Note: smaller icon on OS table has thicker outline and a smaller Apple logo
+  if (props.width === "24") {
+    return (
+      <svg fill="none" xmlns="http://www.w3.org/2000/svg" {...props}>
+        <g transform="translate(4, 4) scale(1.5)">
+          <rect
+            x="3.875"
+            y="2.75"
+            width="8.25"
+            height="10.5"
+            rx="1.25"
+            stroke="#515774"
+            strokeWidth="1.5"
+          />
+          <path
+            fillRule="evenodd"
+            clipRule="evenodd"
+            d="M8.832 5.938c.027.22-.079.438-.22.595a.793.793 0 0 1-.613.265c-.03-.213.084-.438.22-.576a.969.969 0 0 1 .613-.285Zm.393 2.324v.004c.075.146.286.367.463.423a.337.337 0 0 1-.01.025l-.008.026c-.049.134-.18.359-.269.477-.176.23-.353.454-.64.466a.834.834 0 0 1-.316-.073c-.101-.039-.205-.079-.37-.077a.902.902 0 0 0-.381.081c-.09.035-.176.07-.299.073-.273.012-.48-.245-.656-.47a3.037 3.037 0 0 1-.27-.473 2.205 2.205 0 0 1-.132-.462v-.008a2.041 2.041 0 0 1-.017-.458v-.008c.013-.146.092-.379.163-.477.176-.277.48-.458.824-.466l.053-.004h.004c.147-.007.29.046.416.092.097.036.183.068.255.066a.915.915 0 0 0 .268-.066c.154-.052.335-.114.512-.1.3.004.59.13.771.367a1.617 1.617 0 0 0-.145.107c0 .004-.005.004-.005.004a.754.754 0 0 0-.282.473v.004a.748.748 0 0 0 .07.454Z"
+            fill="#515774"
+          />
+        </g>
+      </svg>
+    );
+  }
+  return (
+    <svg fill="none" xmlns="http://www.w3.org/2000/svg" {...props}>
+      <g transform="translate(6, 7) scale(0.75)">
+        <rect
+          x="3.666"
+          y=".75"
+          width="18"
+          height="22.5"
+          rx="1.25"
+          stroke="#515774"
+          strokeWidth="1.5"
+        />
+        <path
+          fillRule="evenodd"
+          clipRule="evenodd"
+          d="M14.33 7.875c.054.442-.158.876-.44 1.192-.29.324-.767.56-1.225.529-.062-.426.167-.876.44-1.153.3-.315.803-.552 1.226-.568Zm.785 4.65v.007c.15.293.573.735.926.845a.7.7 0 0 1-.018.051.669.669 0 0 0-.017.052c-.097.268-.362.718-.538.955-.353.458-.705.908-1.278.931-.27-.003-.45-.074-.634-.145-.203-.079-.41-.159-.742-.155-.34-.004-.554.08-.76.162-.179.07-.352.139-.597.146-.547.024-.961-.49-1.314-.94-.167-.236-.44-.702-.538-.946-.097-.23-.238-.687-.264-.924v-.016c-.035-.237-.07-.726-.035-.915v-.016c.026-.292.185-.758.326-.955a2.009 2.009 0 0 1 1.648-.932l.106-.008h.009c.294-.013.579.092.83.184.194.071.368.135.51.132.138.003.324-.06.538-.133.306-.104.669-.227 1.023-.199.599.008 1.18.26 1.542.735a3.243 3.243 0 0 0-.29.213c0 .008-.01.008-.01.008-.229.15-.51.552-.564.947v.008c-.053.3.01.67.141.907Z"
+          fill="#515774"
+        />
+      </g>
+    </svg>
+  );
+};
+
+export default iPadOS;
diff --git a/frontend/pages/SoftwarePage/components/icons/index.ts b/frontend/pages/SoftwarePage/components/icons/index.ts
index 0d30e286cd68..59e618700949 100644
--- a/frontend/pages/SoftwarePage/components/icons/index.ts
+++ b/frontend/pages/SoftwarePage/components/icons/index.ts
@@ -6,7 +6,7 @@ import ChromeApp from "./ChromeApp";
 import Excel from "./Excel";
 import Extension from "./Extension";
 import Firefox from "./Firefox";
-import MacApp from "./MacApp";
+import AppleApp from "./AppleApp";
 import MacOS from "./MacOS";
 import Package from "./Package";
 import Safari from "./Safari";
@@ -20,6 +20,9 @@ import Zoom from "./Zoom";
 import ChromeOS from "./ChromeOS";
 import LinuxOS from "./LinuxOS";
 import Falcon from "./Falcon";
+import AppStore from "./AppStore";
+import iOS from "./iOS";
+import iPadOS from "./iPadOS";
 
 // Maps all known Linux platforms to the LinuxOS icon
 const LINUX_OS_NAME_TO_ICON_MAP = HOST_LINUX_PLATFORMS.reduce(
@@ -31,6 +34,7 @@ const LINUX_OS_NAME_TO_ICON_MAP = HOST_LINUX_PLATFORMS.reduce(
 // icon for them, keys refer to application names, and are intended to be fuzzy
 // matched in the application logic.
 const SOFTWARE_NAME_TO_ICON_MAP = {
+  appStore: AppStore,
   "adobe acrobat reader": AcrobatReader,
   "microsoft excel": Excel,
   falcon: Falcon,
@@ -44,6 +48,8 @@ const SOFTWARE_NAME_TO_ICON_MAP = {
   darwin: MacOS,
   windows: WindowsOS,
   chrome: ChromeOS,
+  ios: iOS,
+  ipados: iPadOS,
   ...LINUX_OS_NAME_TO_ICON_MAP,
 } as const;
 
@@ -59,7 +65,9 @@ const SOFTWARE_SOURCE_TO_ICON_MAP = {
   atom_packages: Package,
   python_packages: Package,
   homebrew_packages: Package,
-  apps: MacApp,
+  apps: AppleApp,
+  ios_apps: AppleApp,
+  ipados_apps: AppleApp,
   programs: WindowsApp,
   chrome_extensions: Extension,
   safari_extensions: Extension,
diff --git a/frontend/pages/admin/IntegrationsPage/IntegrationNavItems.tsx b/frontend/pages/admin/IntegrationsPage/IntegrationNavItems.tsx
index a3f8734da8c0..3669bac65e52 100644
--- a/frontend/pages/admin/IntegrationsPage/IntegrationNavItems.tsx
+++ b/frontend/pages/admin/IntegrationsPage/IntegrationNavItems.tsx
@@ -2,9 +2,8 @@ import PATHS from "router/paths";
 
 import { ISideNavItem } from "../components/SideNav/SideNav";
 import Integrations from "./cards/Integrations";
-import Mdm from "./cards/MdmSettings/MdmSettings";
-import AutomaticEnrollment from "./cards/AutomaticEnrollment/AutomaticEnrollment";
-import Calendars from "./cards/Calendars/Calendars";
+import MdmSettings from "./cards/MdmSettings";
+import Calendars from "./cards/Calendars";
 
 const integrationSettingsNavItems: ISideNavItem<any>[] = [
   // TODO: types
@@ -18,13 +17,7 @@ const integrationSettingsNavItems: ISideNavItem<any>[] = [
     title: "Mobile device management (MDM)",
     urlSection: "mdm",
     path: PATHS.ADMIN_INTEGRATIONS_MDM,
-    Card: Mdm,
-  },
-  {
-    title: "Automatic enrollment",
-    urlSection: "automatic-enrollment",
-    path: PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT,
-    Card: AutomaticEnrollment,
+    Card: MdmSettings,
   },
   {
     title: "Calendars",
diff --git a/frontend/pages/admin/IntegrationsPage/IntegrationPage.tests.tsx b/frontend/pages/admin/IntegrationsPage/IntegrationPage.tests.tsx
index a5675066535c..af91a1478749 100644
--- a/frontend/pages/admin/IntegrationsPage/IntegrationPage.tests.tsx
+++ b/frontend/pages/admin/IntegrationsPage/IntegrationPage.tests.tsx
@@ -1,24 +1,14 @@
 import React from "react";
 import { screen } from "@testing-library/react";
 
-import { createCustomRenderer } from "test/test-utils";
+import { createCustomRenderer, createMockRouter } from "test/test-utils";
 import IntegrationsPage from "./IntegrationsPage";
 
-// TODO: figure out how to mock the router properly.
-const mockRouter = {
-  push: jest.fn(),
-  replace: jest.fn(),
-  goBack: jest.fn(),
-  goForward: jest.fn(),
-  go: jest.fn(),
-  setRouteLeaveHook: jest.fn(),
-  isActive: jest.fn(),
-  createHref: jest.fn(),
-  createPath: jest.fn(),
-};
-
 describe("Integrations Page", () => {
+  // TODO: change this test to cover rendering all other sections displayed.
   it("renders the MDM sidenav and content if MDM feature is enabled", () => {
+    const mockRouter = createMockRouter();
+
     const render = createCustomRenderer({
       withBackendMock: true,
       context: {
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/AppleAutomaticEnrollmentPage.tsx b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/AppleAutomaticEnrollmentPage.tsx
deleted file mode 100644
index 1bf40cbb7587..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/AppleAutomaticEnrollmentPage.tsx
+++ /dev/null
@@ -1,288 +0,0 @@
-import React, { useCallback, useContext, useState } from "react";
-
-import { useQuery } from "react-query";
-import { InjectedRouter } from "react-router";
-
-import { AxiosError } from "axios";
-
-import PATHS from "router/paths";
-
-import { NotificationContext } from "context/notification";
-import { getErrorReason } from "interfaces/errors";
-import { IMdmAppleBm } from "interfaces/mdm";
-import mdmAppleBmAPI from "services/entities/mdm_apple_bm";
-import { readableDate } from "utilities/helpers";
-
-import BackLink from "components/BackLink";
-import Button from "components/buttons/Button";
-import CustomLink from "components/CustomLink/CustomLink";
-import DataError from "components/DataError";
-import FileUploader from "components/FileUploader";
-import MainContent from "components/MainContent";
-import Spinner from "components/Spinner";
-
-import DownloadKey from "../../../../components/DownloadFileButtons/DownloadABMKey";
-import DisableAutomaticEnrollmentModal from "./modals/DisableAutomaticEnrollmentModal";
-import RenewTokenModal from "./modals/RenewTokenModal";
-
-const baseClass = "apple-automatic-enrollment-page";
-
-const ButtonWrap = ({
-  onClickDisable,
-  onClickRenew,
-}: {
-  onClickDisable: () => void;
-  onClickRenew: () => void;
-}) => {
-  return (
-    <div className={`${baseClass}__button-wrap`}>
-      <Button variant="inverse" onClick={onClickDisable}>
-        Disable automatic enrollment
-      </Button>
-      <Button variant="brand" onClick={onClickRenew}>
-        Renew token
-      </Button>
-    </div>
-  );
-};
-
-const AppleAutomaticEnrollmentPage = ({
-  router,
-}: {
-  router: InjectedRouter;
-}) => {
-  const { renderFlash } = useContext(NotificationContext);
-
-  const [isUploading, setIsUploading] = useState(false);
-  const [showDisableModal, setShowDisableModal] = useState(false);
-  const [showRenewModal, setShowRenewModal] = useState(false);
-
-  const {
-    data: mdmAppleBm,
-    error: errorMdmAppleBm,
-    isLoading,
-    isRefetching,
-    refetch,
-  } = useQuery<IMdmAppleBm, AxiosError, IMdmAppleBm>(
-    ["mdmAppleBmAPI"],
-    () => mdmAppleBmAPI.getAppleBMInfo(),
-    {
-      refetchOnWindowFocus: false,
-      retry: (tries, error) =>
-        error.status !== 404 && error.status !== 400 && tries <= 3,
-    }
-  );
-
-  const uploadToken = useCallback(
-    async (data: FileList | null) => {
-      setIsUploading(true);
-      const token = data?.[0];
-      if (!token) {
-        setIsUploading(false);
-        renderFlash("error", "No token selected.");
-        return;
-      }
-
-      try {
-        await mdmAppleBmAPI.uploadToken(token);
-        renderFlash(
-          "success",
-          "Automatic enrollment for macOS hosts is enabled."
-        );
-        router.push(PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT);
-      } catch (e) {
-        const msg = getErrorReason(e);
-        if (msg.toLowerCase().includes("valid token")) {
-          renderFlash("error", msg);
-        } else {
-          renderFlash("error", "Couldn’t enable. Please try again.");
-        }
-      } finally {
-        setIsUploading(false);
-      }
-    },
-    [renderFlash, router]
-  );
-
-  const onClickDisable = useCallback(() => {
-    setShowDisableModal(true);
-  }, []);
-
-  const onClickRenew = useCallback(() => {
-    setShowRenewModal(true);
-  }, []);
-
-  const disableAutomaticEnrollment = useCallback(async () => {
-    try {
-      await mdmAppleBmAPI.disableAutomaticEnrollment();
-      renderFlash("success", "Automatic enrollment disabled successfully.");
-      router.push(PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT);
-    } catch (e) {
-      renderFlash(
-        "error",
-        "Couldn’t disable automatic enrollment. Please try again."
-      );
-      setShowDisableModal(false);
-    }
-  }, [renderFlash, router]);
-
-  const onCancelDisable = useCallback(() => {
-    setShowDisableModal(false);
-  }, []);
-
-  const onRenew = useCallback(() => {
-    refetch();
-    setShowRenewModal(false);
-  }, [refetch]);
-
-  const onCancelRenew = useCallback(() => {
-    setShowRenewModal(false);
-  }, []);
-
-  if (isLoading || isRefetching) {
-    return <Spinner />;
-  }
-
-  const showDataError = errorMdmAppleBm && errorMdmAppleBm.status !== 404;
-  const showConnectAbm = !mdmAppleBm;
-
-  return (
-    <MainContent className={baseClass}>
-      <>
-        <BackLink
-          text="Back to automatic enrollment"
-          path={PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT}
-          className={`${baseClass}__back-to-automatic-enrollment`}
-        />
-        <h1>Apple Business Manager (ABM)</h1>
-        {showDataError && (
-          <div>
-            <DataError />
-            <ButtonWrap
-              onClickDisable={onClickDisable}
-              onClickRenew={onClickRenew}
-            />
-          </div>
-        )}
-        {!showDataError && !showConnectAbm && (
-          <div>
-            <h4>Apple ID</h4>
-            <p>{mdmAppleBm.apple_id}</p>
-            <h4>Organization name</h4>
-            <p>{mdmAppleBm.org_name}</p>
-            <h4>MDM server URL</h4>
-            <p>{mdmAppleBm.mdm_server_url}</p>
-            <h4>Renew date</h4>
-            <p>{readableDate(mdmAppleBm.renew_date)}</p>
-            <ButtonWrap
-              onClickDisable={onClickDisable}
-              onClickRenew={onClickRenew}
-            />
-          </div>
-        )}
-        {!showDataError && showConnectAbm && (
-          <>
-            <p>
-              Connect Fleet to your Apple Business Manager account to
-              automatically enroll macOS hosts to Fleet when they’re first
-              booted.{" "}
-            </p>
-            {/* Ideally we'd use the native browser list styles and css to display
-        the list numbers but this does not allow us to style the list items as we'd
-        like so we write the numbers in the JSX instead. */}
-            <ol className={`${baseClass}__setup-list`}>
-              <li>
-                <span>1.</span>
-                <p>
-                  Download your public key.{" "}
-                  <DownloadKey baseClass={baseClass} />
-                </p>
-              </li>
-              <li>
-                <span>2.</span>
-                <span>
-                  <span>
-                    Sign in to{" "}
-                    <CustomLink
-                      newTab
-                      text="Apple Business Manager"
-                      url="https://business.apple.com"
-                    />
-                    <br />
-                    If your organization doesn’t have an account, select{" "}
-                    <b>Sign up now</b>.
-                  </span>
-                </span>
-              </li>
-              <li>
-                <span>3.</span>
-                <span>
-                  Select your <b>account name</b> at the bottom left of the
-                  screen, then select <b>Preferences</b>.
-                </span>
-              </li>
-              <li>
-                <span>4.</span>
-                <span>
-                  In the <b>Your MDM Servers</b> section, select <b>Add</b>.
-                </span>
-              </li>
-              <li>
-                <span>5.</span>
-                <span>Enter a name for the server such as “Fleet”.</span>
-              </li>
-              <li>
-                <span>6.</span>
-                <span>
-                  Under <b>MDM Server Settings</b>, upload the public key
-                  downloaded in the first step and select <b>Save</b>.
-                </span>
-              </li>
-              <li>
-                <span>7.</span>
-                <span>
-                  In the <b>Default Device Assignment</b> section, select{" "}
-                  <b>Change</b>, then assign the newly created server as the
-                  default for your Macs, and select <b>Done</b>.
-                </span>
-              </li>
-              <li>
-                <span>8.</span>
-                <span>
-                  Select newly created server in the sidebar, then select{" "}
-                  <b>Download Token</b> on the top.
-                </span>
-              </li>
-              <li>
-                <span>9.</span>
-                <span>Upload the downloaded token (.p7m file).</span>
-              </li>
-            </ol>
-            <FileUploader
-              className={`${baseClass}__file-uploader ${
-                isUploading ? `${baseClass}__file-uploader--loading` : ""
-              }`}
-              accept=".p7m"
-              message="ABM token (.p7m)"
-              graphicName={"file-p7m"}
-              buttonType="link"
-              buttonMessage={isUploading ? "Uploading..." : "Upload"}
-              onFileUpload={uploadToken}
-            />
-          </>
-        )}
-      </>
-      {showDisableModal && (
-        <DisableAutomaticEnrollmentModal
-          onCancel={onCancelDisable}
-          onConfirm={disableAutomaticEnrollment}
-        />
-      )}
-      {showRenewModal && (
-        <RenewTokenModal onCancel={onCancelRenew} onRenew={onRenew} />
-      )}
-    </MainContent>
-  );
-};
-
-export default AppleAutomaticEnrollmentPage;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/_styles.scss
deleted file mode 100644
index 7f47c4dbd4ca..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/_styles.scss
+++ /dev/null
@@ -1,110 +0,0 @@
-.apple-automatic-enrollment-page {
-  &__back-to-automatic-enrollment {
-    margin-bottom: $pad-xlarge;
-  }
-
-  h1 {
-    margin-bottom: $pad-xxlarge;
-    font-size: $large;
-  }
-
-  h4 {
-    margin-bottom: 0;
-    font-size: $x-small;
-  }
-
-  p {
-    font-size: $x-small;
-    margin: 0 0 $pad-large;
-  }
-
-  &__setup-list {
-    font-size: $x-small;
-    display: flex;
-    flex-direction: column;
-    gap: $pad-large;
-    padding: 0;
-    margin: 0;
-    max-width: 660px;
-    list-style: none;
-
-    li {
-      display: flex;
-      flex-direction: row;
-      gap: $pad-small;
-
-      p {
-        display: flex;
-        flex-direction: column;
-        align-items: flex-start;
-        margin: 0;
-      }
-    }
-  }
-
-  &__url-inputs-wrapper {
-    display: flex;
-    flex-direction: column;
-    gap: $pad-icon;
-    margin-top: $pad-large;
-  }
-
-  &__url-input {
-    margin-bottom: 0;
-  }
-
-  &__permissions-list {
-    margin-top: $pad-large;
-    list-style: disc;
-    display: flex;
-    flex-direction: column;
-    gap: $pad-medium;
-  }
-
-  &__request-button {
-    display: flex;
-    gap: $pad-small;
-    align-items: center;
-    margin-top: $pad-small;
-
-    label {
-      display: flex;
-      gap: $pad-small;
-      cursor: pointer;
-    }
-  }
-
-  &__file-uploader {
-    margin-top: $pad-medium;
-    margin-left: $pad-medium;
-    border-radius: 6px;
-
-    .file-uploader__message {
-      color: $ui-fleet-black-75;
-      margin: 0;
-    }
-
-    button {
-      margin-top: 0;
-    }
-
-    &--loading {
-      label {
-        opacity: 0.5;
-      }
-    }
-  }
-  &__button-wrap {
-    display: flex;
-    gap: $pad-medium;
-  }
-
-  // TODO: remove these styles when the updated error component is used
-  .data-error {
-    margin: $pad-xxlarge 0;
-    padding: $pad-xlarge 0;
-  }
-  .data-error__inner {
-    padding: $pad-xlarge 0;
-  }
-}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/index.ts b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/index.ts
deleted file mode 100644
index f488014c97f1..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./AppleAutomaticEnrollmentPage";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/DisableAutomaticEnrollmentModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/DisableAutomaticEnrollmentModal.tsx
deleted file mode 100644
index b15b1a0b6747..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/DisableAutomaticEnrollmentModal.tsx
+++ /dev/null
@@ -1,61 +0,0 @@
-import React, { useCallback, useState } from "react";
-
-import Button from "components/buttons/Button";
-
-import Modal from "components/Modal";
-
-const baseClass = "modal disable-automatic-enrollment-modal";
-
-interface IDisableAutomaticEnrollmentModalProps {
-  onCancel: () => void;
-  onConfirm: () => void;
-}
-
-const DisableAutomaticEnrollmentModal = ({
-  onConfirm,
-  onCancel,
-}: IDisableAutomaticEnrollmentModalProps): JSX.Element => {
-  const [isDeleting, setIsDeleting] = useState(false);
-
-  const onClickConfirm: React.MouseEventHandler<HTMLButtonElement> = useCallback(() => {
-    setIsDeleting(true);
-    onConfirm();
-  }, [onConfirm]);
-
-  return (
-    <Modal
-      title="Disable macOS automatic enrollment"
-      onExit={onCancel}
-      className={baseClass}
-    >
-      <div className={baseClass}>
-        New macOS hosts won’t automatically enroll to Fleet.
-        <br />
-        <br />
-        If you want to enable automatic enrollment, you’ll have to create a new
-        MDM server in Apple Business Manager, reassign all devices, and upload
-        your new server token in Fleet.{" "}
-        <div className="modal-cta-wrap">
-          <Button
-            type="button"
-            variant="alert"
-            onClick={onClickConfirm}
-            disabled={isDeleting}
-            isLoading={isDeleting}
-          >
-            Disable
-          </Button>
-          <Button
-            onClick={onCancel}
-            disabled={isDeleting}
-            variant="inverse-alert"
-          >
-            Cancel
-          </Button>
-        </div>
-      </div>
-    </Modal>
-  );
-};
-
-export default DisableAutomaticEnrollmentModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/RenewTokenModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/RenewTokenModal/index.ts
deleted file mode 100644
index 2714cd78b98f..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/RenewTokenModal/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./RenewTokenModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AutomaticEnrollment.tsx b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AutomaticEnrollment.tsx
deleted file mode 100644
index 59bfa2403003..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AutomaticEnrollment.tsx
+++ /dev/null
@@ -1,90 +0,0 @@
-import React, { useCallback, useContext, useState } from "react";
-import { useQuery } from "react-query";
-import { AxiosError } from "axios";
-import { InjectedRouter } from "react-router";
-
-import PATHS from "router/paths";
-import { AppContext } from "context/app";
-import { IConfig } from "interfaces/config";
-import { IMdmApple } from "interfaces/mdm";
-import mdmAppleAPI from "services/entities/mdm_apple";
-
-import Spinner from "components/Spinner";
-import DataError from "components/DataError";
-import PremiumFeatureMessage from "components/PremiumFeatureMessage/PremiumFeatureMessage";
-import EmptyTable from "components/EmptyTable/EmptyTable";
-import Button from "components/buttons/Button/Button";
-
-import MdmPlatformsSection from "./components/MdmPlatformsSection/MdmPlatformsSection";
-import DefaultTeamSection from "./components/DefaultTeamSection/DefaultTeamSection";
-import IdpSection from "./components/IdpSection/IdpSection";
-import EulaSection from "./components/EulaSection/EulaSection";
-
-const baseClass = "automatic-enrollment";
-
-interface IAutomaticEnrollment {
-  router: InjectedRouter;
-}
-
-const AutomaticEnrollment = ({ router }: IAutomaticEnrollment) => {
-  const { config, isPremiumTier } = useContext(AppContext);
-
-  const { isLoading: isLoadingAPNInfo, error: errorAPNInfo } = useQuery<
-    IMdmApple,
-    AxiosError
-  >(["appleAPNInfo"], () => mdmAppleAPI.getAppleAPNInfo(), {
-    refetchOnWindowFocus: false,
-    retry: false,
-    enabled: config?.mdm.enabled_and_configured,
-  });
-
-  const onClickConnect = () => {
-    router.push(PATHS.ADMIN_INTEGRATIONS_MDM);
-  };
-
-  if (!isPremiumTier) return <PremiumFeatureMessage />;
-
-  if (isLoadingAPNInfo) {
-    return (
-      <div className={baseClass}>
-        <Spinner />
-      </div>
-    );
-  }
-
-  if (errorAPNInfo?.status === 404) {
-    return (
-      <EmptyTable
-        header="Automatic enrollment for macOS hosts"
-        info="Connect Fleet to the Apple Push Certificates Portal to get started."
-        primaryButton={<Button onClick={onClickConnect}>Connect</Button>}
-        className={`${baseClass}__connect-message`}
-      />
-    );
-  }
-
-  if (errorAPNInfo) {
-    return <DataError />;
-  }
-
-  return (
-    <div className={baseClass}>
-      <div className={`${baseClass}__section`}>
-        <MdmPlatformsSection router={router} />
-      </div>
-      {!!config?.mdm.apple_bm_enabled_and_configured && (
-        <div className={`${baseClass}__section`}>
-          <DefaultTeamSection />
-        </div>
-      )}
-      <div className={`${baseClass}__section`}>
-        <IdpSection />
-      </div>
-      <div className={`${baseClass}__section`}>
-        <EulaSection />
-      </div>
-    </div>
-  );
-};
-
-export default AutomaticEnrollment;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/_styles.scss
deleted file mode 100644
index c09bd27fa90b..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/_styles.scss
+++ /dev/null
@@ -1,9 +0,0 @@
-.automatic-enrollment {
-  &__connect-message {
-    margin-top: 0;
-  }
-
-  &__section {
-    margin-bottom: $pad-xxlarge;
-  }
-}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/DefaultTeamSection/DefaultTeamSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/DefaultTeamSection/DefaultTeamSection.tsx
deleted file mode 100644
index f4d11ed3f84a..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/DefaultTeamSection/DefaultTeamSection.tsx
+++ /dev/null
@@ -1,55 +0,0 @@
-import React, { useCallback, useContext, useState } from "react";
-
-import { AppContext } from "context/app";
-
-import Button from "components/buttons/Button";
-import Icon from "components/Icon";
-import SectionHeader from "components/SectionHeader";
-import TooltipWrapper from "components/TooltipWrapper";
-import EditTeamModal from "../EditTeamModal";
-
-const baseClass = "default-team-section";
-
-const DefaultTeamSection = () => {
-  const { config } = useContext(AppContext);
-  const [showEditTeamModal, setShowEditTeamModal] = useState(false);
-
-  const toggleEditTeamModal = useCallback(() => {
-    setShowEditTeamModal((prev) => !prev);
-  }, []);
-
-  const defaultTeamName = config?.mdm?.apple_bm_default_team || "No team";
-
-  return (
-    <div className={`${baseClass}`}>
-      <SectionHeader title="Default team" />
-      <p>macOS hosts automatically enroll to this team.</p>
-      <h4>
-        <TooltipWrapper
-          position="top-start"
-          tipContent="macOS hosts will be added to this team when they’re first unboxed."
-        >
-          Team
-        </TooltipWrapper>
-      </h4>
-      <p>
-        {config?.mdm?.apple_bm_default_team || "No team"}{" "}
-        <Button
-          className={`${baseClass}__edit-team-btn`}
-          onClick={toggleEditTeamModal}
-          variant="text-icon"
-        >
-          Edit <Icon name="pencil" />
-        </Button>
-      </p>
-      {showEditTeamModal && (
-        <EditTeamModal
-          defaultTeamName={defaultTeamName}
-          onCancel={toggleEditTeamModal}
-        />
-      )}
-    </div>
-  );
-};
-
-export default DefaultTeamSection;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/DefaultTeamSection/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/DefaultTeamSection/_styles.scss
deleted file mode 100644
index 3d96a55416d4..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/DefaultTeamSection/_styles.scss
+++ /dev/null
@@ -1,16 +0,0 @@
-.default-team-section {
-  h4 {
-    margin: $pad-medium 0 0;
-    font-size: $x-small;
-  }
-
-  p {
-    display: flex;
-    align-items: center;
-    margin: 0;
-  }
-
-  &__edit-team-btn {
-    margin-left: $pad-medium;
-  }
-}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/DefaultTeamSection/index.ts b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/DefaultTeamSection/index.ts
deleted file mode 100644
index a2168a26a846..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/DefaultTeamSection/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./DefaultTeamSection";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EditTeamModal/EditTeamModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EditTeamModal/EditTeamModal.tsx
deleted file mode 100644
index 429e77612924..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EditTeamModal/EditTeamModal.tsx
+++ /dev/null
@@ -1,101 +0,0 @@
-import React, { useState, useContext, FormEvent, useCallback } from "react";
-
-import { AppContext } from "context/app";
-import { NotificationContext } from "context/notification";
-import {
-  APP_CONTEXT_NO_TEAM_ID,
-  APP_CONTEX_NO_TEAM_SUMMARY,
-} from "interfaces/team";
-import configAPI from "services/entities/config";
-
-// @ts-ignore
-import Dropdown from "components/forms/fields/Dropdown";
-import Modal from "components/Modal";
-import Button from "components/buttons/Button";
-
-interface IEditTeamModal {
-  onCancel: () => void;
-  defaultTeamName: string;
-}
-
-const baseClass = "edit-team-modal";
-
-const EditTeamModal = ({
-  onCancel,
-  defaultTeamName,
-}: IEditTeamModal): JSX.Element => {
-  const { availableTeams, setConfig } = useContext(AppContext);
-  const { renderFlash } = useContext(NotificationContext);
-
-  const [selectedTeam, setSelectedTeam] = useState(defaultTeamName);
-
-  const teamNameOptions = availableTeams
-    ?.filter((t) => t.id >= APP_CONTEXT_NO_TEAM_ID)
-    .map((teamSummary) => {
-      return {
-        value:
-          teamSummary.name === APP_CONTEX_NO_TEAM_SUMMARY.name
-            ? ""
-            : teamSummary.name,
-        label: teamSummary.name,
-      };
-    });
-
-  const [isLoading, setIsLoading] = useState(false);
-
-  const handleUpdateTeam = useCallback(
-    async (newName: string) => {
-      try {
-        const configData = await configAPI.update({
-          mdm: { apple_bm_default_team: newName },
-        });
-        renderFlash("success", "Default team updated successfully.");
-        setConfig(configData);
-      } catch (e) {
-        renderFlash(
-          "error",
-          "Unable to update default team. Please try again."
-        );
-      } finally {
-        onCancel();
-      }
-    },
-    [renderFlash, setConfig, onCancel]
-  );
-
-  const onFormSubmit = useCallback(
-    (evt: FormEvent<HTMLFormElement>) => {
-      evt.preventDefault();
-      setIsLoading(true);
-      handleUpdateTeam(selectedTeam);
-    },
-    [selectedTeam, setIsLoading, handleUpdateTeam]
-  );
-
-  return (
-    <Modal title="Edit team" onExit={onCancel} className={baseClass}>
-      <form className={`${baseClass}__form`} onSubmit={onFormSubmit}>
-        <div className="bottom-label">
-          <Dropdown
-            placeholder={selectedTeam}
-            options={teamNameOptions}
-            onChange={setSelectedTeam}
-            value={selectedTeam}
-            label="Team"
-            helpText="macOS hosts will be added to this team when they're first unboxed."
-          />
-        </div>
-        <div className="modal-cta-wrap">
-          <Button type="submit" variant="brand" isLoading={isLoading}>
-            Save
-          </Button>
-          <Button onClick={onCancel} variant="inverse">
-            Cancel
-          </Button>
-        </div>
-      </form>
-    </Modal>
-  );
-};
-
-export default EditTeamModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EditTeamModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EditTeamModal/index.ts
deleted file mode 100644
index 4e5065e76c39..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EditTeamModal/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./EditTeamModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/EulaSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/EulaSection.tsx
deleted file mode 100644
index f37f10e3a434..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/EulaSection.tsx
+++ /dev/null
@@ -1,85 +0,0 @@
-import React, { useContext, useState } from "react";
-import { useQuery } from "react-query";
-import { AxiosResponse } from "axios";
-
-import { IApiError } from "interfaces/errors";
-import mdmAPI, { IEulaMetadataResponse } from "services/entities/mdm";
-import { NotificationContext } from "context/notification";
-
-import Spinner from "components/Spinner";
-import SectionHeader from "components/SectionHeader";
-
-import EulaUploader from "./components/EulaUploader/EulaUploader";
-import UploadedEulaView from "./components/UploadedEulaView/UploadedEulaView";
-import DeleteEulaModal from "./components/DeleteEulaModal/DeleteEulaModal";
-
-const baseClass = "eula-section";
-
-const EulaSection = () => {
-  const { renderFlash } = useContext(NotificationContext);
-  const [showDeleteEulaModal, setShowDeleteEulaModal] = useState(false);
-
-  const {
-    data: eulaMetadata,
-    isLoading,
-    error,
-    refetch: refetchEulaMetadata,
-  } = useQuery<IEulaMetadataResponse, AxiosResponse<IApiError>>(
-    ["eula-metadata"],
-    () => mdmAPI.getEULAMetadata(),
-    {
-      retry: false,
-      refetchOnWindowFocus: false,
-    }
-  );
-
-  const onUpload = () => {
-    refetchEulaMetadata();
-  };
-
-  const onDelete = async () => {
-    if (!eulaMetadata) return;
-
-    try {
-      await mdmAPI.deleteEULA(eulaMetadata.token);
-      renderFlash("success", "Successfully deleted!");
-    } catch {
-      renderFlash("error", "Couldn’t delete. Please try again.");
-    } finally {
-      setShowDeleteEulaModal(false);
-      refetchEulaMetadata();
-    }
-  };
-
-  // we are relying on the API to tell us this resource does not exist to
-  // determine if the user has uploaded a bootstrap package.
-  const noEulaUploaded = (error && error.status === 404) || !eulaMetadata;
-
-  return (
-    <div className={baseClass}>
-      <SectionHeader title="End user license agreement (EULA)" />
-      {isLoading ? (
-        <Spinner />
-      ) : (
-        <div className={`${baseClass}__content`}>
-          {noEulaUploaded ? (
-            <EulaUploader onUpload={onUpload} />
-          ) : (
-            <UploadedEulaView
-              eulaMetadata={eulaMetadata}
-              onDelete={() => setShowDeleteEulaModal(true)}
-            />
-          )}
-        </div>
-      )}
-      {showDeleteEulaModal && (
-        <DeleteEulaModal
-          onDelete={onDelete}
-          onCancel={() => setShowDeleteEulaModal(false)}
-        />
-      )}
-    </div>
-  );
-};
-
-export default EulaSection;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/UploadedEulaView/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/UploadedEulaView/_styles.scss
deleted file mode 100644
index a2b5824ba74d..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/UploadedEulaView/_styles.scss
+++ /dev/null
@@ -1,10 +0,0 @@
-.uploaded-eula-view {
-
-  > p {
-    font-size: $x-small;
-  }
-
-  .upload-list__list-item {
-    border-top: 1px solid $ui-fleet-black-10;
-  }
-}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/MdmPlatformsSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/MdmPlatformsSection.tsx
deleted file mode 100644
index f00fb5b7e49c..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/MdmPlatformsSection.tsx
+++ /dev/null
@@ -1,50 +0,0 @@
-import React, { useContext } from "react";
-import { InjectedRouter } from "react-router";
-import PATHS from "router/paths";
-import { AppContext } from "context/app";
-import SectionHeader from "components/SectionHeader";
-
-import WindowsAutomaticEnrollmentCard from "./components/WindowsAutomaticEnrollmentCard";
-import AppleAutomaticEnrollmentCard from "./components/AppleAutomaticEnrollmentCard";
-
-const baseClass = "mdm-platforms-section";
-
-interface IMdmPlatformsSectionProps {
-  router: InjectedRouter;
-}
-
-const MdmPlatformsSection = ({ router }: IMdmPlatformsSectionProps) => {
-  const { config } = useContext(AppContext);
-
-  const navigateToWindowsAutomaticEnrollment = () => {
-    router.push(PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT_WINDOWS);
-  };
-
-  const navigateToAppleAutomaticEnrollment = () => {
-    router.push(PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT_APPLE);
-  };
-
-  const navigateToApplePushCertSetup = () => {
-    router.push(PATHS.ADMIN_INTEGRATIONS_MDM);
-  };
-
-  return (
-    <div className={baseClass}>
-      <SectionHeader title="Apple Business Manager" />
-      <AppleAutomaticEnrollmentCard
-        viewDetails={navigateToAppleAutomaticEnrollment}
-        turnOn={
-          !config?.mdm.enabled_and_configured
-            ? navigateToApplePushCertSetup
-            : undefined
-        }
-        configured={!!config?.mdm.apple_bm_enabled_and_configured}
-      />
-      <WindowsAutomaticEnrollmentCard
-        viewDetails={navigateToWindowsAutomaticEnrollment}
-      />
-    </div>
-  );
-};
-
-export default MdmPlatformsSection;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/_styles.scss
deleted file mode 100644
index eb17869fdb53..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/_styles.scss
+++ /dev/null
@@ -1,80 +0,0 @@
-.mdm-platforms-section {
-  h4 {
-    margin-bottom: 0;
-  }
-
-  .section-header {
-    margin-bottom: $pad-xxlarge;
-  }
-
-  .mdm-settings-team-btn {
-    margin-left: 12px;
-
-    .children-wrapper {
-      gap: $pad-small;
-    }
-  }
-
-  .component__tooltip-wrapper__tip-text {
-    max-width: initial;
-  }
-
-  &__section-description,
-  &__section-instructions,
-  &__section-information {
-    font-size: $x-small;
-    color: $core-fleet-black;
-    width: 100%;
-  }
-
-  &__section-information {
-    p {
-      margin: 0;
-    }
-  }
-
-  &__400-error-info {
-    display: block;
-    color: $core-fleet-black;
-    font-weight: normal;
-    font-size: $x-small;
-    text-align: left;
-    margin-top: 10px;
-  }
-}
-
-.automatic-enrollment-card {
-  margin-top: 0;
-  margin-bottom: $pad-xxlarge;
-  font-size: $x-small;
-  display: flex;
-  justify-content: space-between;
-  align-items: center;
-
-  h3 {
-    font-size: $x-small;
-    font-weight: $bold;
-    margin: 0 0 $pad-xsmall;
-  }
-
-  p {
-    margin: 0;
-    max-width: 520px;
-
-    span {
-      display: flex;
-      align-items: center;
-      gap: $pad-small;
-    }
-  }
-
-  &__turn-on-mdm {
-    flex-direction: column;
-    align-items: flex-start;
-    gap: $pad-medium;
-
-    .button {
-      height: auto;
-    }
-  }
-}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/components/AppleAutomaticEnrollmentCard/AppleAutomaticEnrollmentCard.tsx b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/components/AppleAutomaticEnrollmentCard/AppleAutomaticEnrollmentCard.tsx
deleted file mode 100644
index 32138f8a9050..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/components/AppleAutomaticEnrollmentCard/AppleAutomaticEnrollmentCard.tsx
+++ /dev/null
@@ -1,81 +0,0 @@
-import React from "react";
-
-import Card from "components/Card";
-import Button from "components/buttons/Button";
-import Icon from "components/Icon/Icon";
-
-const baseClass = "automatic-enrollment-card";
-
-interface IAppleAutomaticEnrollmentCardProps {
-  viewDetails: () => void;
-  turnOn?: () => void;
-  configured?: boolean;
-}
-
-const AppleAutomaticEnrollmentCard = ({
-  viewDetails,
-  turnOn,
-  configured,
-}: IAppleAutomaticEnrollmentCardProps) => {
-  let icon = "";
-  let msg =
-    "To enable automatic enrollment for macOS devices, first turn on macOS MDM.";
-  if (!turnOn && !configured) {
-    msg =
-      "Automatically enroll newly purchased macOS devices when they’re first unboxed and set up by your end user.";
-  } else if (!turnOn && configured) {
-    msg = "Automatic enrollment for macOS enabled.";
-    icon = "success";
-  }
-
-  return (
-    <Card
-      className={`${baseClass} ${turnOn ? `${baseClass}__turn-on-mdm` : ""}`}
-      color="gray"
-    >
-      <div>
-        {!icon && <h3>Automatic enrollment for macOS hosts</h3>}
-        <p>
-          {icon ? (
-            <span>
-              <Icon name="success" />
-              {msg}
-            </span>
-          ) : (
-            msg
-          )}
-        </p>
-      </div>
-      {turnOn && (
-        <Button
-          className="apple-details-button"
-          onClick={turnOn}
-          variant="text-icon"
-        >
-          Turn on MDM
-        </Button>
-      )}
-      {!turnOn && !configured && (
-        <Button
-          className="apple-details-button"
-          onClick={viewDetails}
-          variant="brand"
-        >
-          Enable
-        </Button>
-      )}
-      {!turnOn && configured && (
-        <Button
-          className="apple-details-button"
-          onClick={viewDetails}
-          variant="text-icon"
-        >
-          <Icon name="pencil" />
-          Edit
-        </Button>
-      )}
-    </Card>
-  );
-};
-
-export default AppleAutomaticEnrollmentCard;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/index.ts b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/index.ts
deleted file mode 100644
index a8608e00c119..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./MdmPlatformsSection";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/index.ts b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/index.ts
deleted file mode 100644
index bee5a5abf5d1..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./AutomaticEnrollment";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/AppleBusinessManagerPage.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/AppleBusinessManagerPage.tsx
new file mode 100644
index 000000000000..c484171eeb16
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/AppleBusinessManagerPage.tsx
@@ -0,0 +1,266 @@
+import React, { useCallback, useContext, useRef, useState } from "react";
+
+import { useQuery } from "react-query";
+import { InjectedRouter } from "react-router";
+
+import { AxiosError } from "axios";
+
+import PATHS from "router/paths";
+
+import { AppContext } from "context/app";
+import { IMdmAbmToken } from "interfaces/mdm";
+import mdmAbmAPI, {
+  IGetAbmTokensResponse,
+} from "services/entities/mdm_apple_bm";
+
+import BackLink from "components/BackLink";
+import Button from "components/buttons/Button";
+import DataError from "components/DataError";
+import MainContent from "components/MainContent";
+import Spinner from "components/Spinner";
+import PremiumFeatureMessage from "components/PremiumFeatureMessage";
+
+import AppleBusinessManagerTable from "./components/AppleBusinessManagerTable";
+import AddAbmModal from "./components/AddAbmModal";
+import RenewAbmModal from "./components/RenewAbmModal";
+import DeleteAbmModal from "./components/DeleteAbmModal";
+import EditTeamsAbmModal from "./components/EditTeamsAbmModal";
+
+const baseClass = "apple-business-manager-page";
+
+interface ITurnOnMdmMessageProps {
+  router: InjectedRouter;
+}
+
+const TurnOnMdmMessage = ({ router }: ITurnOnMdmMessageProps) => {
+  return (
+    <div className={`${baseClass}__turn-on-mdm-message`}>
+      <h2>Turn on Apple MDM</h2>
+      <p>
+        To add your ABM and enable automatic enrollment for macOS, iOS, and
+        iPadOS hosts, first turn on Apple MDM.
+      </p>
+      <Button
+        variant="brand"
+        onClick={() => {
+          router.push(PATHS.ADMIN_INTEGRATIONS_MDM);
+        }}
+      >
+        Turn on
+      </Button>
+    </div>
+  );
+};
+
+interface IAddAbmMessageProps {
+  onAddAbm: () => void;
+}
+
+const AddAbmMessage = ({ onAddAbm }: IAddAbmMessageProps) => {
+  return (
+    <div className={`${baseClass}__add-adm-message`}>
+      <h2>Add your ABM</h2>
+      <p>
+        Automatically enroll newly purchased Apple hosts when they&apos;re first
+        unboxed and set up by your end users.
+      </p>
+      <Button variant="brand" onClick={onAddAbm}>
+        Add ABM
+      </Button>
+    </div>
+  );
+};
+
+const AppleBusinessManagerPage = ({ router }: { router: InjectedRouter }) => {
+  const { config, isPremiumTier } = useContext(AppContext);
+
+  const [showRenewModal, setShowRenewModal] = useState(false);
+  const [showDeleteModal, setShowDeleteModal] = useState(false);
+  const [showAddAbmModal, setShowAddAbmModal] = useState(false);
+  const [showEditTeamsModal, setShowEditTeamsModal] = useState(false);
+
+  const selectedToken = useRef<IMdmAbmToken | null>(null);
+
+  const {
+    data: abmTokens,
+    error: errorAbmTokens,
+    isLoading,
+    isRefetching,
+    refetch,
+  } = useQuery<IGetAbmTokensResponse, AxiosError, IMdmAbmToken[]>(
+    ["abmTokens"],
+    () => mdmAbmAPI.getTokens(),
+    {
+      refetchOnWindowFocus: false,
+      retry: (tries, error) =>
+        error.status !== 404 && error.status !== 400 && tries <= 3,
+      select: (data) => data?.abm_tokens,
+      enabled: isPremiumTier,
+    }
+  );
+
+  const onEditTokenTeam = (abmToken: IMdmAbmToken) => {
+    selectedToken.current = abmToken;
+    setShowEditTeamsModal(true);
+  };
+
+  const onCancelEditTeam = useCallback(() => {
+    selectedToken.current = null;
+    setShowEditTeamsModal(false);
+  }, []);
+
+  const onEditedTeam = useCallback(() => {
+    selectedToken.current = null;
+    refetch();
+    setShowEditTeamsModal(false);
+  }, [refetch]);
+
+  const onAddAbm = () => {
+    setShowAddAbmModal(true);
+  };
+
+  const onAdded = () => {
+    refetch();
+    setShowAddAbmModal(false);
+  };
+
+  const onRenewToken = (abmToken: IMdmAbmToken) => {
+    selectedToken.current = abmToken;
+    setShowRenewModal(true);
+  };
+
+  const onCancelRenewToken = useCallback(() => {
+    selectedToken.current = null;
+    setShowRenewModal(false);
+  }, []);
+
+  const onRenewed = useCallback(() => {
+    selectedToken.current = null;
+    refetch();
+    setShowRenewModal(false);
+  }, [refetch]);
+
+  const onDeleteToken = (abmToken: IMdmAbmToken) => {
+    selectedToken.current = abmToken;
+    setShowDeleteModal(true);
+  };
+
+  const onCancelDeleteToken = useCallback(() => {
+    selectedToken.current = null;
+    setShowDeleteModal(false);
+  }, []);
+
+  const onDeleted = useCallback(() => {
+    selectedToken.current = null;
+    refetch();
+    setShowDeleteModal(false);
+  }, [refetch]);
+
+  if (isLoading || isRefetching) {
+    return <Spinner />;
+  }
+
+  const showDataError = errorAbmTokens && errorAbmTokens.status !== 404;
+
+  const renderContent = () => {
+    if (!isPremiumTier) {
+      return <PremiumFeatureMessage />;
+    }
+
+    if (!config?.mdm.enabled_and_configured) {
+      return <TurnOnMdmMessage router={router} />;
+    }
+
+    if (isLoading) {
+      return <Spinner />;
+    }
+
+    // TODO: error UI
+    if (showDataError) {
+      return (
+        <div>
+          <DataError />
+        </div>
+      );
+    }
+
+    if (abmTokens?.length === 0) {
+      return <AddAbmMessage onAddAbm={onAddAbm} />;
+    }
+
+    if (abmTokens) {
+      return (
+        <>
+          <p>
+            Add your ABM to automatically enroll newly purchased Apple hosts
+            when they&apos;re first unboxed and set up by your end users.
+          </p>
+          <AppleBusinessManagerTable
+            abmTokens={abmTokens}
+            onEditTokenTeam={onEditTokenTeam}
+            onRenewToken={onRenewToken}
+            onDeleteToken={onDeleteToken}
+          />
+        </>
+      );
+    }
+
+    return null;
+  };
+
+  return (
+    <MainContent className={baseClass}>
+      <>
+        <BackLink
+          text="Back to MDM"
+          path={PATHS.ADMIN_INTEGRATIONS_MDM}
+          className={`${baseClass}__back-to-mdm`}
+        />
+        <div className={`${baseClass}__page-content`}>
+          <div className={`${baseClass}__page-header-section`}>
+            <h1>Apple Business Manager (ABM)</h1>
+            {isPremiumTier &&
+              abmTokens?.length !== 0 &&
+              !!config?.mdm.enabled_and_configured && (
+                <Button variant="brand" onClick={onAddAbm}>
+                  Add ABM
+                </Button>
+              )}
+          </div>
+          <>{renderContent()}</>
+        </div>
+      </>
+      {showAddAbmModal && (
+        <AddAbmModal
+          onAdded={onAdded}
+          onCancel={() => setShowAddAbmModal(false)}
+        />
+      )}
+      {showRenewModal && selectedToken.current && (
+        <RenewAbmModal
+          tokenId={selectedToken.current.id}
+          orgName={selectedToken.current.org_name}
+          onCancel={onCancelRenewToken}
+          onRenewedToken={onRenewed}
+        />
+      )}
+      {showDeleteModal && selectedToken.current && (
+        <DeleteAbmModal
+          tokenOrgName={selectedToken.current.org_name}
+          tokenId={selectedToken.current.id}
+          onCancel={onCancelDeleteToken}
+          onDeletedToken={onDeleted}
+        />
+      )}
+      {showEditTeamsModal && selectedToken.current && (
+        <EditTeamsAbmModal
+          token={selectedToken.current}
+          onCancel={onCancelEditTeam}
+          onSuccess={onEditedTeam}
+        />
+      )}
+    </MainContent>
+  );
+};
+
+export default AppleBusinessManagerPage;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/_styles.scss
new file mode 100644
index 000000000000..ea3356cff8e9
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/_styles.scss
@@ -0,0 +1,65 @@
+.apple-business-manager-page {
+  &__back-to-mdm {
+    margin-bottom: $pad-xlarge;
+  }
+
+  &__page-content {
+    display: flex;
+    flex-direction: column;
+    gap: $pad-xxlarge;
+  }
+
+  &__page-header-section {
+    display: flex;
+    flex-direction: row;
+    gap: $pad-large;
+    align-items: center;
+    justify-content: space-between;
+
+    h1 {
+      margin-bottom: 0;
+      font-size: $large;
+    }
+  }
+
+
+  &__turn-on-mdm-message, &__add-adm-message {
+    margin: 0 auto;
+    text-align: center;
+    width: 450px;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+
+    > h2 {
+      margin-bottom: $pad-small;
+      font-size: $small;
+      font-weight: $bold;
+    }
+
+    > p {
+      margin: 0 0 $pad-medium;
+    }
+  }
+
+  &__url-inputs-wrapper {
+    display: flex;
+    flex-direction: column;
+    gap: $pad-icon;
+    margin-top: $pad-large;
+  }
+
+  &__url-input {
+    margin-bottom: 0;
+  }
+
+  // TODO: remove these styles when the updated error component is used
+  .data-error {
+    margin: $pad-xxlarge 0;
+    padding: $pad-xlarge 0;
+  }
+  .data-error__inner {
+    padding: $pad-xlarge 0;
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/AddAbmModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/AddAbmModal.tsx
new file mode 100644
index 000000000000..71e501524878
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/AddAbmModal.tsx
@@ -0,0 +1,163 @@
+import React, { useCallback, useContext, useState } from "react";
+
+import { NotificationContext } from "context/notification";
+import mdmAbmAPI from "services/entities/mdm_apple_bm";
+
+import Modal from "components/Modal";
+import Button from "components/buttons/Button";
+import FileUploader from "components/FileUploader";
+import CustomLink from "components/CustomLink";
+import { FileDetails } from "components/FileUploader/FileUploader";
+import DownloadABMKey from "pages/admin/components/DownloadFileButtons/DownloadABMKey";
+import { getErrorMessage } from "./helpers";
+
+const baseClass = "add-abm-modal";
+
+interface IAddAbmModalProps {
+  onCancel: () => void;
+  onAdded: () => void;
+}
+
+const AddAbmModal = ({ onCancel, onAdded }: IAddAbmModalProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+
+  const [tokenFile, setTokenFile] = useState<File | null>(null);
+  const [isUploading, setIsUploading] = useState(false);
+
+  const onSelectFile = useCallback((files: FileList | null) => {
+    const file = files?.[0];
+    if (file) {
+      setTokenFile(file);
+    }
+  }, []);
+
+  const uploadAbmToken = useCallback(async () => {
+    setIsUploading(true);
+    if (!tokenFile) {
+      setIsUploading(false);
+      renderFlash("error", "No token selected.");
+      return;
+    }
+
+    try {
+      await mdmAbmAPI.uploadToken(tokenFile);
+      renderFlash("success", "Added successfully.");
+      onAdded();
+    } catch (e) {
+      renderFlash("error", getErrorMessage(e));
+      onCancel();
+    } finally {
+      setIsUploading(false);
+    }
+  }, [tokenFile, renderFlash, onAdded, onCancel]);
+
+  return (
+    <Modal
+      className={baseClass}
+      title="Add ABM"
+      onExit={onCancel}
+      width="large"
+    >
+      <>
+        <ol className={`${baseClass}__setup-list`}>
+          <li>
+            <span>1.</span>
+            <p>
+              Download your public key. <DownloadABMKey baseClass={baseClass} />
+            </p>
+          </li>
+          <li>
+            <span>2.</span>
+            <span>
+              <span>
+                Sign in to{" "}
+                <CustomLink
+                  newTab
+                  text="Apple Business Manager"
+                  url="https://business.apple.com"
+                />
+                <br />
+                If your organization doesn&apos;t have an account, select{" "}
+                <b>Enroll now</b>.
+              </span>
+            </span>
+          </li>
+          <li>
+            <span>3.</span>
+            <span>
+              Select your <b>account name</b> at the bottom left of the screen,
+              then select <b>Preferences</b>.
+            </span>
+          </li>
+          <li>
+            <span>4.</span>
+            <span>
+              In the <b>Your MDM Servers</b> section, select <b>Add</b>.
+            </span>
+          </li>
+          <li>
+            <span>5.</span>
+            <span>Enter a name for the server such as “Fleet”.</span>
+          </li>
+          <li>
+            <span>6.</span>
+            <span>
+              Under <b>MDM Server Settings</b>, upload the public key downloaded
+              in the first step and select <b>Save</b>.
+            </span>
+          </li>
+          <li>
+            <span>7.</span>
+            <span>
+              In the <b>Default Device Assignment</b> section, select{" "}
+              <b>Change</b>, then assign the newly created server as the default
+              for your Macs, and select <b>Done</b>.
+            </span>
+          </li>
+          <li>
+            <span>8.</span>
+            <span>
+              Select newly created server in the sidebar, then select{" "}
+              <b>Download Token</b> on the top.
+            </span>
+          </li>
+          <li>
+            <span>9.</span>
+            <span>Upload the downloaded token (.p7m file).</span>
+          </li>
+        </ol>
+        <FileUploader
+          className={`${baseClass}__file-uploader ${
+            isUploading ? `${baseClass}__file-uploader--loading` : ""
+          }`}
+          accept=".p7m"
+          message="ABM token (.p7m)"
+          graphicName={"file-p7m"}
+          buttonType="link"
+          buttonMessage={isUploading ? "Uploading..." : "Upload"}
+          filePreview={
+            tokenFile && (
+              <FileDetails
+                details={{ name: tokenFile.name }}
+                graphicName="file-p7m"
+              />
+            )
+          }
+          onFileUpload={onSelectFile}
+        />
+        <div className="modal-cta-wrap">
+          <Button
+            variant="brand"
+            onClick={uploadAbmToken}
+            isLoading={isUploading}
+            disabled={!tokenFile || isUploading}
+          >
+            Add ABM
+          </Button>
+        </div>
+      </>
+    </Modal>
+  );
+};
+
+export default AddAbmModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/_styles.scss
new file mode 100644
index 000000000000..74ccf5138bad
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/_styles.scss
@@ -0,0 +1,59 @@
+.add-abm-modal {
+
+  &__request-button {
+    display: flex;
+    gap: $pad-small;
+    align-items: center;
+    margin-top: $pad-small;
+
+    label {
+      display: flex;
+      gap: $pad-small;
+      cursor: pointer;
+    }
+  }
+
+  &__setup-list {
+    font-size: $x-small;
+    display: flex;
+    flex-direction: column;
+    gap: $pad-large;
+    padding: 0;
+    margin: 0;
+    max-width: 660px;
+    list-style: none;
+
+    li {
+      display: flex;
+      flex-direction: row;
+      gap: $pad-small;
+
+      p {
+        display: flex;
+        flex-direction: column;
+        align-items: flex-start;
+        margin: 0;
+      }
+    }
+  }
+
+  &__file-uploader {
+    margin-top: $pad-medium;
+    margin-left: $pad-medium;
+
+    .file-uploader__message {
+      color: $ui-fleet-black-75;
+      margin: 0;
+    }
+
+    button {
+      margin-top: 0;
+    }
+
+    &--loading {
+      label {
+        opacity: 0.5;
+      }
+    }
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/helpers.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/helpers.tsx
new file mode 100644
index 000000000000..a7ec3afc7be3
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/helpers.tsx
@@ -0,0 +1,35 @@
+import React from "react";
+
+import { getErrorReason } from "interfaces/errors";
+
+const DEFAULT_ERROR_MESSAGE = "Couldn't add. Please try again.";
+
+const generateDuplicateMessage = (msg: string) => {
+  const orgName = msg.split("'")[1];
+  return (
+    <>
+      Couldn&apos;t add. There&apos;s already an ABM connection for the{" "}
+      <b>{orgName}</b> organization.
+    </>
+  );
+};
+
+// eslint-disable-next-line import/prefer-default-export
+export const getErrorMessage = (err: unknown) => {
+  const duplicateEntryReason = getErrorReason(err, {
+    reasonIncludes: "Duplicate entry",
+  });
+  const invalidTokenReason = getErrorReason(err, {
+    reasonIncludes: "Invalid token",
+  });
+
+  if (duplicateEntryReason) {
+    return generateDuplicateMessage(duplicateEntryReason);
+  }
+
+  if (invalidTokenReason) {
+    return invalidTokenReason;
+  }
+
+  return DEFAULT_ERROR_MESSAGE;
+};
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/index.ts
new file mode 100644
index 000000000000..b20b39d0f21e
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./AddAbmModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/AppleBusinessManagerTable.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/AppleBusinessManagerTable.tsx
new file mode 100644
index 000000000000..27a3f9aa2ab2
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/AppleBusinessManagerTable.tsx
@@ -0,0 +1,58 @@
+import React from "react";
+
+import { IMdmAbmToken } from "interfaces/mdm";
+
+import TableContainer from "components/TableContainer";
+
+import { generateTableConfig } from "./AppleBusinessManagerTableConfig";
+
+const baseClass = "apple-business-manager-table";
+
+interface IAppleBusinessManagerTableProps {
+  abmTokens: IMdmAbmToken[];
+  onEditTokenTeam: (token: IMdmAbmToken) => void;
+  onRenewToken: (token: IMdmAbmToken) => void;
+  onDeleteToken: (token: IMdmAbmToken) => void;
+}
+
+const AppleBusinessManagerTable = ({
+  abmTokens,
+  onEditTokenTeam,
+  onRenewToken,
+  onDeleteToken,
+}: IAppleBusinessManagerTableProps) => {
+  const onSelectAction = (action: string, abmToken: IMdmAbmToken) => {
+    switch (action) {
+      case "editTeams":
+        onEditTokenTeam(abmToken);
+        break;
+      case "renew":
+        onRenewToken(abmToken);
+        break;
+      case "delete":
+        onDeleteToken(abmToken);
+        break;
+      default:
+        break;
+    }
+  };
+
+  const tableConfig = generateTableConfig(onSelectAction);
+
+  return (
+    <TableContainer<IMdmAbmToken>
+      columnConfigs={tableConfig}
+      defaultSortHeader="org_name"
+      disableTableHeader
+      disablePagination
+      showMarkAllPages={false}
+      isAllPagesSelected={false}
+      emptyComponent={() => <></>}
+      isLoading={false}
+      data={abmTokens}
+      className={baseClass}
+    />
+  );
+};
+
+export default AppleBusinessManagerTable;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/AppleBusinessManagerTableConfig.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/AppleBusinessManagerTableConfig.tsx
new file mode 100644
index 000000000000..d79e1d3eb16c
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/AppleBusinessManagerTableConfig.tsx
@@ -0,0 +1,180 @@
+import React from "react";
+import { CellProps, Column } from "react-table";
+
+import { IMdmAbmToken } from "interfaces/mdm";
+import { IHeaderProps, IStringCellProps } from "interfaces/datatable_config";
+import { IDropdownOption } from "interfaces/dropdownOption";
+
+import HeaderCell from "components/TableContainer/DataTable/HeaderCell";
+import DropdownCell from "components/TableContainer/DataTable/DropdownCell";
+import TextCell from "components/TableContainer/DataTable/TextCell";
+import TooltipWrapper from "components/TooltipWrapper";
+
+import RenewDateCell from "../../../components/RenewDateCell";
+import OrgNameCell from "./OrgNameCell";
+import { IRenewDateCellStatusConfig } from "../../../components/RenewDateCell/RenewDateCell";
+
+type IAbmTableConfig = Column<IMdmAbmToken>;
+type ITableStringCellProps = IStringCellProps<IMdmAbmToken>;
+type IRenewDateCellProps = CellProps<IMdmAbmToken, IMdmAbmToken["renew_date"]>;
+
+type ITableHeaderProps = IHeaderProps<IMdmAbmToken>;
+
+const DEFAULT_ACTION_OPTIONS: IDropdownOption[] = [
+  { value: "editTeams", label: "Edit teams", disabled: false },
+  { value: "renew", label: "Renew", disabled: false },
+  { value: "delete", label: "Delete", disabled: false },
+];
+
+const generateActions = () => {
+  return DEFAULT_ACTION_OPTIONS;
+};
+
+const RENEW_DATE_CELL_STATUS_CONFIG: IRenewDateCellStatusConfig = {
+  warning: {
+    tooltipText: (
+      <>
+        ABM server token is less than 30 days from expiration.
+        <br /> To renew, go to <b>Actions {">"} Renew.</b>
+      </>
+    ),
+  },
+  error: {
+    tooltipText: (
+      <>
+        ABM server token is expired.
+        <br /> To renew, go to <b>Actions {">"} Renew</b>.
+      </>
+    ),
+  },
+};
+
+export const generateTableConfig = (
+  actionSelectHandler: (value: string, team: IMdmAbmToken) => void
+): IAbmTableConfig[] => {
+  return [
+    {
+      accessor: "org_name",
+      sortType: "caseInsensitive",
+      Header: (cellProps: ITableHeaderProps) => (
+        <HeaderCell
+          value="Organization name"
+          isSortedDesc={cellProps.column.isSortedDesc}
+        />
+      ),
+      Cell: (cellProps: ITableStringCellProps) => {
+        const { terms_expired, org_name } = cellProps.cell.row.original;
+        return <OrgNameCell orgName={org_name} termsExpired={terms_expired} />;
+      },
+    },
+    {
+      accessor: "renew_date",
+      Header: "Renew date",
+      disableSortBy: true,
+      Cell: (cellProps: IRenewDateCellProps) => (
+        <RenewDateCell
+          value={cellProps.cell.value}
+          statusConfig={RENEW_DATE_CELL_STATUS_CONFIG}
+          className="abm-renew-date-cell"
+        />
+      ),
+    },
+    {
+      accessor: "apple_id",
+      Header: "Apple ID",
+      disableSortBy: true,
+      Cell: (cellProps: ITableStringCellProps) => (
+        <TextCell value={cellProps.cell.value} />
+      ),
+    },
+    {
+      id: "macos_team",
+      accessor: (originalRow) => originalRow.macos_team.name,
+      Header: () => {
+        const titleWithToolTip = (
+          <TooltipWrapper
+            tipContent={
+              <>
+                macOS hosts are automatically added to this team in Fleet when
+                they appear in Apple Business Manager.
+              </>
+            }
+          >
+            macOS team
+          </TooltipWrapper>
+        );
+        return <HeaderCell value={titleWithToolTip} disableSortBy />;
+      },
+      disableSortBy: true,
+      Cell: (cellProps: ITableStringCellProps) => (
+        <TextCell value={cellProps.cell.value} />
+      ),
+    },
+    {
+      id: "ios_team",
+      accessor: (originalRow) => originalRow.ios_team.name,
+      Header: () => {
+        const titleWithToolTip = (
+          <TooltipWrapper
+            tipContent={
+              <>
+                iOS hosts are automatically added to this team in Fleet when
+                they appear in Apple Business Manager.
+              </>
+            }
+          >
+            iOS team
+          </TooltipWrapper>
+        );
+        return <HeaderCell value={titleWithToolTip} disableSortBy />;
+      },
+      disableSortBy: true,
+      Cell: (cellProps: ITableStringCellProps) => (
+        <TextCell value={cellProps.cell.value} />
+      ),
+    },
+    {
+      id: "ipados_team",
+      accessor: (originalRow) => originalRow.ipados_team.name,
+      Header: () => {
+        const titleWithToolTip = (
+          <TooltipWrapper
+            tipContent={
+              <>
+                iPadOS hosts are automatically added to this team in Fleet when
+                they appear in Apple Business Manager.
+              </>
+            }
+          >
+            iPadOS team
+          </TooltipWrapper>
+        );
+        return <HeaderCell value={titleWithToolTip} disableSortBy />;
+      },
+      disableSortBy: true,
+      Cell: (cellProps: ITableStringCellProps) => (
+        <TextCell value={cellProps.cell.value} />
+      ),
+    },
+    {
+      Header: "",
+      disableSortBy: true,
+      // the accessor here is insignificant, we just need it as its required
+      // but we don't use it.
+      accessor: "id",
+      Cell: (cellProps) => (
+        <DropdownCell
+          options={generateActions()}
+          onChange={(value: string) =>
+            actionSelectHandler(value, cellProps.row.original)
+          }
+          placeholder="Actions"
+        />
+      ),
+    },
+  ];
+};
+
+export const generateTableData = (data: IMdmAbmToken[]) => {
+  return data;
+};
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/OrgNameCell/OrgNameCell.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/OrgNameCell/OrgNameCell.tsx
new file mode 100644
index 000000000000..e1ff84532fc4
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/OrgNameCell/OrgNameCell.tsx
@@ -0,0 +1,23 @@
+import Icon from "components/Icon";
+import TextCell from "components/TableContainer/DataTable/TextCell";
+import React from "react";
+
+const baseClass = "org-name-cell";
+
+interface IOrgNameCellProps {
+  orgName: string;
+  termsExpired: boolean;
+}
+
+const OrgNameCell = ({ orgName, termsExpired }: IOrgNameCellProps) => {
+  const cellContent = termsExpired ? (
+    <>
+      <span>{orgName}</span> <Icon name="warning" />
+    </>
+  ) : (
+    orgName
+  );
+  return <TextCell value={cellContent} className={baseClass} />;
+};
+
+export default OrgNameCell;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/OrgNameCell/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/OrgNameCell/_styles.scss
new file mode 100644
index 000000000000..43a212797a42
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/OrgNameCell/_styles.scss
@@ -0,0 +1,3 @@
+.org-name-cell {
+
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/OrgNameCell/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/OrgNameCell/index.ts
new file mode 100644
index 000000000000..93810b068e3f
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/OrgNameCell/index.ts
@@ -0,0 +1 @@
+export { default } from "./OrgNameCell";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/_styles.scss
new file mode 100644
index 000000000000..6dc700f6bd7d
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/_styles.scss
@@ -0,0 +1,33 @@
+.apple-business-manager-table {
+
+  // The desired behavior is to hide the header and team cell one by one
+  // as the viewport gets smaller. This is achieved by using the max-width
+  // media query with the breakpoint values taken from when the table content
+  // starts to overflow.
+  @media (max-width: $break-lg) {
+    .ipados_team__header, .ipados_team__cell {
+      display: none;
+    }
+  }
+
+  @media (max-width: 1230px) {
+    .ios_team__header, .ios_team__cell {
+      display: none;
+    }
+  }
+
+  @media (max-width: $break-md) {
+    .macos_team__header, .macos_team__cell {
+      display: none;
+    }
+  }
+
+  // this is a special case where the org name cell is too long at smaller widths.
+  // We dont want to remove any more columns so we need to reduce the width of
+  // the org name cell content to prevent table content overflow.
+  @media (max-width: $break-sm) {
+    .org-name-cell {
+      width: 140px;
+    }
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/index.ts
new file mode 100644
index 000000000000..ca9ab1586174
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/index.ts
@@ -0,0 +1 @@
+export { default } from "./AppleBusinessManagerTable";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/DeleteAbmModal/DeleteAbmModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/DeleteAbmModal/DeleteAbmModal.tsx
new file mode 100644
index 000000000000..afa47290313e
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/DeleteAbmModal/DeleteAbmModal.tsx
@@ -0,0 +1,86 @@
+import React, { useCallback, useContext, useState } from "react";
+
+import mdmAbmAPI from "services/entities/mdm_apple_bm";
+import { IMdmAbmToken } from "interfaces/mdm";
+import { NotificationContext } from "context/notification";
+
+import Button from "components/buttons/Button";
+import Modal from "components/Modal";
+
+const baseClass = "delete-abm-modal";
+
+interface IDeleteAbmModalProps {
+  tokenOrgName: string;
+  tokenId: number;
+  onCancel: () => void;
+  onDeletedToken: () => void;
+}
+
+const DeleteAbmModal = ({
+  tokenOrgName,
+  tokenId,
+  onCancel,
+  onDeletedToken,
+}: IDeleteAbmModalProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+
+  const [isDeleting, setIsDeleting] = useState(false);
+
+  const onDeleteToken = useCallback(async () => {
+    setIsDeleting(true);
+
+    try {
+      await mdmAbmAPI.deleteToken(tokenId);
+      renderFlash("success", "Deleted successfully.");
+      onDeletedToken();
+    } catch (e) {
+      // TODO: Check API sends back correct error messages
+      renderFlash(
+        "error",
+        "Couldn’t disable automatic enrollment. Please try again."
+      );
+      onCancel();
+    }
+  }, [onCancel, onDeletedToken, renderFlash, tokenId]);
+
+  return (
+    <Modal
+      title="Delete ABM"
+      className={baseClass}
+      onExit={onCancel}
+      isContentDisabled={isDeleting}
+    >
+      <>
+        <p>
+          New hosts purchased in the <b>{tokenOrgName}</b> won&apos;t
+          automatically enroll to Fleet.{" "}
+        </p>
+        <p>
+          If you want to re-enable automatic enrollment, you&apos;ll have to
+          upload a new ABM token.
+        </p>
+
+        <div className="modal-cta-wrap">
+          <Button
+            type="button"
+            variant="alert"
+            onClick={onDeleteToken}
+            disabled={isDeleting}
+            isLoading={isDeleting}
+          >
+            Delete
+          </Button>
+          <Button
+            onClick={onCancel}
+            disabled={isDeleting}
+            variant="inverse-alert"
+          >
+            Cancel
+          </Button>
+        </div>
+      </>
+    </Modal>
+  );
+};
+
+export default DeleteAbmModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/DeleteAbmModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/DeleteAbmModal/index.ts
new file mode 100644
index 000000000000..6621778d726d
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/DeleteAbmModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./DeleteAbmModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/EditTeamsAbmModal.tests.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/EditTeamsAbmModal.tests.ts
new file mode 100644
index 000000000000..00bf0bdce508
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/EditTeamsAbmModal.tests.ts
@@ -0,0 +1,41 @@
+import {
+  APP_CONTEX_NO_TEAM_SUMMARY,
+  APP_CONTEXT_ALL_TEAMS_SUMMARY,
+} from "interfaces/team";
+import { getOptions, getSelectedTeamIds } from "./EditTeamsAbmModal";
+
+describe("EditTeamsAbmModal", () => {
+  const availableTeams = [
+    APP_CONTEXT_ALL_TEAMS_SUMMARY,
+    APP_CONTEX_NO_TEAM_SUMMARY,
+    { name: "Team 1", id: 1 },
+    { name: "Team 2", id: 2 },
+  ];
+
+  describe("getOptions", () => {
+    it("excludes all teams", () => {
+      const expectedOptions = availableTeams.reduce((acc, t) => {
+        if (t.name !== "All teams") {
+          acc.push({ value: t.name, label: t.name });
+        }
+        return acc;
+      }, [] as { value: string; label: string }[]);
+      expect(getOptions(availableTeams)).toEqual(expectedOptions);
+    });
+  });
+
+  describe("getSelectedTeamIds", () => {
+    it("returns selected team ids", () => {
+      const selectedTeamNames = {
+        ios_team: "Team 1",
+        ipados_team: "Team 2",
+        macos_team: "No team",
+      };
+      expect(getSelectedTeamIds(selectedTeamNames, availableTeams)).toEqual({
+        ios_team_id: 1,
+        ipados_team_id: 2,
+        macos_team_id: 0,
+      });
+    });
+  });
+});
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/EditTeamsAbmModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/EditTeamsAbmModal.tsx
new file mode 100644
index 000000000000..c33f9ebd5678
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/EditTeamsAbmModal.tsx
@@ -0,0 +1,204 @@
+import React, { useCallback, useContext, useMemo, useState } from "react";
+
+import { AppContext } from "context/app";
+import { NotificationContext } from "context/notification";
+
+import { IMdmAbmToken } from "interfaces/mdm";
+import { ITeamSummary } from "interfaces/team";
+
+import mdmAbmAPI from "services/entities/mdm_apple_bm";
+
+import Modal from "components/Modal";
+// @ts-ignore
+import Dropdown from "components/forms/fields/Dropdown";
+import Button from "components/buttons/Button";
+
+const baseClass = "edit-teams-abm-modal";
+
+interface IEditTeamsAbmModalProps {
+  token: IMdmAbmToken;
+  onCancel: () => void;
+  onSuccess: () => void;
+}
+
+/**
+ * Given available teams, return the options for the dropdowns. The "All teams" option is excluded.
+ */
+export const getOptions = (availableTeams: ITeamSummary[] = []) => {
+  return availableTeams
+    ?.filter((t) => t.name !== "All teams")
+    .map((t) => ({
+      value: t.name,
+      label: t.name,
+    }));
+};
+
+/**
+ * Type for the selected team names, which is derived from the shape of the teams object
+ * returned by the get token API.
+ */
+interface SelectedTeamNames {
+  ios_team: IMdmAbmToken["ios_team"]["name"];
+  ipados_team: IMdmAbmToken["ipados_team"]["name"];
+  macos_team: IMdmAbmToken["macos_team"]["name"];
+}
+
+/**
+ * Type for the selected team ids, which takes the shape of the teams object
+ * expected by the edit token teams API.
+ */
+type SelectedTeamIds = Parameters<typeof mdmAbmAPI.editTeams>[0]["teams"];
+
+/**
+ * Given selected team names and available teams, return the corresponding team ids with the keys
+ * expected by the API. If a team name does not exist in the available teams, its id will be undefined.
+ * The caller is responsible for handling undefined ids appropriately (e.g., using error messages from
+ * `validateSelectedTeamIds` function).
+ */
+export const getSelectedTeamIds = (
+  { ios_team, ipados_team, macos_team }: SelectedTeamNames,
+  availableTeams: ITeamSummary[] = []
+): SelectedTeamIds => {
+  const byName = availableTeams.reduce((acc, t) => {
+    acc[t.name] = t.id;
+    return acc;
+  }, {} as Record<string, number>);
+  return {
+    ios_team_id: byName[ios_team],
+    ipados_team_id: byName[ipados_team],
+    macos_team_id: byName[macos_team],
+  };
+};
+
+const EditTeamsAbmModal = ({
+  token,
+  onCancel,
+  onSuccess,
+}: IEditTeamsAbmModalProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+  const { availableTeams } = useContext(AppContext);
+
+  const [isSaving, setIsSaving] = useState(false);
+
+  const [selectedTeamNames, setSelectedTeamNames] = useState<SelectedTeamNames>(
+    {
+      ios_team: token.ios_team.name,
+      ipados_team: token.ipados_team.name,
+      macos_team: token.macos_team.name,
+    }
+  );
+
+  const options = useMemo(() => {
+    return availableTeams
+      ?.filter((t) => t.name !== "All teams")
+      .map((t) => ({
+        value: t.name,
+        label: t.name,
+      }));
+  }, [availableTeams]);
+
+  const onSave = useCallback(
+    async (evt: React.MouseEvent<HTMLFormElement>) => {
+      evt.preventDefault();
+
+      setIsSaving(true);
+      try {
+        await mdmAbmAPI.editTeams({
+          tokenId: token.id,
+          teams: getSelectedTeamIds(selectedTeamNames, availableTeams),
+        });
+        renderFlash("success", "Edited successfully.");
+        onSuccess();
+      } catch (e) {
+        renderFlash("error", "Couldn’t edit. Please try again.");
+        onCancel();
+      }
+    },
+    [
+      token.id,
+      selectedTeamNames,
+      availableTeams,
+      renderFlash,
+      onSuccess,
+      onCancel,
+    ]
+  );
+
+  return (
+    <Modal
+      className={baseClass}
+      title="Edit teams"
+      onExit={onCancel}
+      width="large"
+      isContentDisabled={isSaving}
+    >
+      <>
+        <p>
+          Edit teams for <b>{token.org_name}</b>.
+        </p>
+        <form onSubmit={onSave} className={baseClass} autoComplete="off">
+          <Dropdown
+            searchable={false}
+            options={options}
+            onChange={(value: string) => {
+              setSelectedTeamNames((prev) => ({ ...prev, macos_team: value }));
+            }}
+            value={selectedTeamNames.macos_team}
+            label="macOS team"
+            wrapperClassName={`${baseClass}__form-field form-field--macos`}
+            tooltip={
+              <>
+                macOS hosts are automatically added to this team in Fleet when
+                they appear in Apple Business Manager.
+              </>
+            }
+          />
+          <Dropdown
+            searchable={false}
+            options={options}
+            onChange={(value: string) => {
+              setSelectedTeamNames((prev) => ({ ...prev, ios_team: value }));
+            }}
+            value={selectedTeamNames.ios_team}
+            label="iOS team"
+            wrapperClassName={`${baseClass}__form-field form-field--ios`}
+            tooltip={
+              <>
+                iOS hosts are automatically added to this team in Fleet when
+                they appear in Apple Business Manager.
+              </>
+            }
+          />
+          <Dropdown
+            searchable={false}
+            options={options}
+            onChange={(value: string) =>
+              setSelectedTeamNames((prev) => ({ ...prev, ipados_team: value }))
+            }
+            value={selectedTeamNames.ipados_team}
+            label="iPadOS team"
+            wrapperClassName={`${baseClass}__form-field form-field--ipados`}
+            tooltip={
+              <>
+                iPadOS hosts are automatically added to this team in Fleet when
+                they appear in Apple Business Manager.
+              </>
+            }
+          />
+          <div className="modal-cta-wrap">
+            <Button
+              type="submit"
+              variant="brand"
+              className="save-abm-teams-loading"
+              isLoading={isSaving}
+            >
+              Save
+            </Button>
+          </div>
+        </form>
+      </>
+    </Modal>
+  );
+};
+
+export default EditTeamsAbmModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/index.ts
new file mode 100644
index 000000000000..8e8451b1e006
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./EditTeamsAbmModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/RenewTokenModal/RenewTokenModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/RenewAbmModal.tsx
similarity index 75%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/RenewTokenModal/RenewTokenModal.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/RenewAbmModal.tsx
index 5e99d7c8c03a..d95334d06950 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/RenewTokenModal/RenewTokenModal.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/RenewAbmModal.tsx
@@ -1,9 +1,7 @@
 import React, { useState, useContext, useCallback } from "react";
 
 import { NotificationContext } from "context/notification";
-
 import { getErrorReason } from "interfaces/errors";
-
 import mdmAppleBmAPI from "services/entities/mdm_apple_bm";
 
 import Button from "components/buttons/Button";
@@ -14,17 +12,23 @@ import {
 } from "components/FileUploader/FileUploader";
 import Modal from "components/Modal";
 
-const baseClass = "modal renew-token-modal";
+import { getErrorMessage } from "./helpers";
+
+const baseClass = "renew-abm-modal";
 
-interface IRenewCertModalProps {
+interface IRenewAbmModalProps {
+  tokenId: number;
+  orgName: string;
   onCancel: () => void;
-  onRenew: () => void;
+  onRenewedToken: () => void;
 }
 
-const RenewCertModal = ({
+const RenewAbmModal = ({
+  tokenId,
+  orgName,
   onCancel,
-  onRenew,
-}: IRenewCertModalProps): JSX.Element => {
+  onRenewedToken,
+}: IRenewAbmModalProps) => {
   const { renderFlash } = useContext(NotificationContext);
 
   const [isUploading, setIsUploading] = useState(false);
@@ -37,7 +41,7 @@ const RenewCertModal = ({
     }
   }, []);
 
-  const onRenewClick = useCallback(async () => {
+  const onRenewToken = useCallback(async () => {
     if (!tokenFile) {
       // this shouldn'r happen, but just in case
       renderFlash("error", "Please provide a token file.");
@@ -45,24 +49,29 @@ const RenewCertModal = ({
     }
     setIsUploading(true);
     try {
-      await mdmAppleBmAPI.uploadToken(tokenFile);
-      renderFlash("success", "ABM token renewed successfully.");
+      await mdmAppleBmAPI.renewToken(tokenId, tokenFile);
+      renderFlash("success", "Renewed successfully.");
       setIsUploading(false);
-      onRenew();
+      onRenewedToken();
     } catch (e) {
-      const msg = getErrorReason(e);
-      if (msg.toLowerCase().includes("valid token")) {
-        renderFlash("error", msg);
-      } else {
-        renderFlash("error", "Couldn’t renew. Please try again.");
-      }
+      renderFlash("error", getErrorMessage(e));
+      onCancel();
       setIsUploading(false);
     }
-  }, [tokenFile, renderFlash, onRenew]);
+  }, [tokenFile, renderFlash, tokenId, onRenewedToken, onCancel]);
 
   return (
-    <Modal title="Renew token" onExit={onCancel} className={baseClass}>
+    <Modal
+      title="Renew token"
+      onExit={onCancel}
+      className={baseClass}
+      isContentDisabled={isUploading}
+      width="large"
+    >
       <div className={`${baseClass}__page-content ${baseClass}__setup-content`}>
+        <p className={`${baseClass}__description`}>
+          Renew Apple Business Manager for <b>{orgName}</b>.
+        </p>
         <ol className={`${baseClass}__setup-instructions-list`}>
           <li>
             <p>
@@ -109,7 +118,7 @@ const RenewCertModal = ({
             </p>
           </li>
         </ol>
-        <div className={`${baseClass}__button-wrap`}>
+        <div className="modal-cta-wrap">
           <Button
             className={`${baseClass}__submit-button ${
               isUploading ? `uploading` : ""
@@ -118,9 +127,9 @@ const RenewCertModal = ({
             disabled={!tokenFile || isUploading}
             isLoading={isUploading}
             type="button"
-            onClick={onRenewClick}
+            onClick={onRenewToken}
           >
-            Renew token
+            Renew ABM
           </Button>
         </div>
       </div>
@@ -128,4 +137,4 @@ const RenewCertModal = ({
   );
 };
 
-export default RenewCertModal;
+export default RenewAbmModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/RenewTokenModal/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/_styles.scss
similarity index 55%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/RenewTokenModal/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/_styles.scss
index 8b78546b0ba4..03d6b4d42d3b 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/RenewTokenModal/_styles.scss
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/_styles.scss
@@ -1,9 +1,4 @@
-.renew-token-modal {
-  width: 760px;
-
-  &__info-header {
-    margin-bottom: $pad-xlarge;
-  }
+.renew-abm-modal {
 
   &__setup-content {
     display: flex;
@@ -29,33 +24,10 @@
     }
   }
 
-  &__request-button {
-    display: flex;
-    gap: $pad-small;
-    align-items: center;
-    margin-top: $pad-small;
-    margin-left: $pad-medium;
-
-    label {
-      display: flex;
-      gap: $pad-small;
-      cursor: pointer;
-    }
-  }
 
   &__file-uploader {
     margin-top: $pad-medium;
     margin-left: $pad-medium;
-    border-radius: 6px;
-
-    .file-uploader__message {
-      color: $ui-fleet-black-75;
-      margin: 0;
-    }
-
-    button {
-      margin-top: 0;
-    }
   }
 
   &__button-wrap {
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/helpers.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/helpers.tsx
new file mode 100644
index 000000000000..7eaa905cb97a
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/helpers.tsx
@@ -0,0 +1,18 @@
+import React from "react";
+
+import { getErrorReason } from "interfaces/errors";
+
+const DEFAULT_ERROR_MESSAGE = "Couldn’t renew. Please try again.";
+
+// eslint-disable-next-line import/prefer-default-export
+export const getErrorMessage = (err: unknown) => {
+  const invalidTokenReason = getErrorReason(err, {
+    reasonIncludes: "Invalid token",
+  });
+
+  if (invalidTokenReason) {
+    return invalidTokenReason;
+  }
+
+  return DEFAULT_ERROR_MESSAGE;
+};
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/index.ts
new file mode 100644
index 000000000000..892e78e3904a
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./RenewAbmModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/index.ts
new file mode 100644
index 000000000000..7d921836ae5b
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/index.ts
@@ -0,0 +1 @@
+export { default } from "./AppleBusinessManagerPage";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/MacOSMdmPage.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/AppleMdmPage.tsx
similarity index 91%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/MacOSMdmPage.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/AppleMdmPage.tsx
index 0aa061dc2f96..4e373f60e0d8 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/MacOSMdmPage.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/AppleMdmPage.tsx
@@ -19,11 +19,11 @@ import ApplePushCertSetup from "./components/content/ApplePushCertSetup";
 import ApplePushCertInfo from "./components/content/ApplePushCertInfo";
 
 import RenewCertModal from "./components/modals/RenewCertModal";
-import TurnOffMacOsMdmModal from "./components/modals/TurnOffMacOsMdmModal";
+import TurnOffAppleMdmModal from "./components/modals/TurnOffAppleMdmModal";
 
-export const baseClass = "mac-os-mdm-page";
+export const baseClass = "apple-mdm-page";
 
-const MacOSMdmPage = ({ router }: { router: InjectedRouter }) => {
+const AppleMdmPage = ({ router }: { router: InjectedRouter }) => {
   const { config } = useContext(AppContext);
   const { renderFlash } = useContext(NotificationContext);
 
@@ -65,10 +65,10 @@ const MacOSMdmPage = ({ router }: { router: InjectedRouter }) => {
     toggleTurnOffMdmModal();
     try {
       await mdmAppleAPI.deleteApplePushCertificate();
-      renderFlash("success", "macOS MDM turned off successfully.");
+      renderFlash("success", "MDM turned off successfully.");
       router.push(PATHS.ADMIN_INTEGRATIONS_MDM);
     } catch (e) {
-      renderFlash("error", "Couldn’t turn off MDM. Please try again.");
+      renderFlash("error", "Couldn't turn off MDM. Please try again.");
       setIsUpdating(false);
     }
   }, [renderFlash, router]);
@@ -124,7 +124,7 @@ const MacOSMdmPage = ({ router }: { router: InjectedRouter }) => {
           />
         )}
         {showTurnOffMdmModal && (
-          <TurnOffMacOsMdmModal
+          <TurnOffAppleMdmModal
             onCancel={toggleTurnOffMdmModal}
             onConfirm={turnOffMdm}
           />
@@ -134,4 +134,4 @@ const MacOSMdmPage = ({ router }: { router: InjectedRouter }) => {
   );
 };
 
-export default MacOSMdmPage;
+export default AppleMdmPage;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/_styles.scss
similarity index 98%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/_styles.scss
index 68c6626180f7..2538cc73ba9e 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/_styles.scss
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/_styles.scss
@@ -1,4 +1,4 @@
-.mac-os-mdm-page {
+.apple-mdm-page {
   &__back-to-mdm {
     margin-bottom: $pad-xlarge;
   }
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/content/ApplePushCertInfo.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/content/ApplePushCertInfo.tsx
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/content/ApplePushCertInfo.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/content/ApplePushCertInfo.tsx
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/content/ApplePushCertSetup.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/content/ApplePushCertSetup.tsx
similarity index 89%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/content/ApplePushCertSetup.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/content/ApplePushCertSetup.tsx
index 272c74f75c9c..b219de4b4033 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/content/ApplePushCertSetup.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/content/ApplePushCertSetup.tsx
@@ -6,6 +6,7 @@ import mdmAppleApi from "services/entities/mdm_apple";
 
 import CustomLink from "components/CustomLink";
 import FileUploader from "components/FileUploader";
+import ClickableUrls from "components/ClickableUrls";
 import DownloadCSR from "../../../../../../components/DownloadFileButtons/DownloadCSR";
 
 interface IApplePushCertSetupProps {
@@ -28,7 +29,7 @@ const ApplePushCertSetup = ({
       setIsUploading(true);
       try {
         await mdmAppleApi.uploadApplePushCertificate(files[0]);
-        renderFlash("success", "macOS MDM turned on successfully.");
+        renderFlash("success", "MDM turned on successfully.");
         onSetupSuccess();
       } catch (e) {
         const msg = getErrorReason(e);
@@ -49,13 +50,13 @@ const ApplePushCertSetup = ({
   const onDownloadError = useCallback(
     (e: unknown) => {
       const msg = getErrorReason(e);
-      if (
-        msg.toLowerCase().includes("email address") ||
-        msg.toLowerCase().includes("required private key")
-      ) {
+      if (msg.toLowerCase().includes("email address")) {
         renderFlash("error", msg);
+      } else if (msg.toLowerCase().includes("required private key")) {
+        // replace link with actually clickable link
+        renderFlash("error", ClickableUrls({ text: msg }));
       } else {
-        renderFlash("error", "Something’s gone wrong. Please try again.");
+        renderFlash("error", "Something's gone wrong. Please try again.");
       }
     },
     [renderFlash]
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/modals/RenewCertModal/RenewCertModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/RenewCertModal/RenewCertModal.tsx
similarity index 98%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/modals/RenewCertModal/RenewCertModal.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/RenewCertModal/RenewCertModal.tsx
index b070f4bdc30f..f596e8574cb2 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/modals/RenewCertModal/RenewCertModal.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/RenewCertModal/RenewCertModal.tsx
@@ -65,7 +65,7 @@ const RenewCertModal = ({
   const onDownloadError = useCallback(
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     (e: unknown) => {
-      renderFlash("error", "Something’s gone wrong. Please try again.");
+      renderFlash("error", "Something's gone wrong. Please try again.");
     },
     [renderFlash]
   );
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/modals/RenewCertModal/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/RenewCertModal/_styles.scss
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/modals/RenewCertModal/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/RenewCertModal/_styles.scss
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/modals/RenewCertModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/RenewCertModal/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/modals/RenewCertModal/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/RenewCertModal/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/modals/TurnOffMacOsMdmModal/TurnOffMacOsMdmModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/TurnOffAppleMdmModal/TurnOffAppleMdmModal.tsx
similarity index 67%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/modals/TurnOffMacOsMdmModal/TurnOffMacOsMdmModal.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/TurnOffAppleMdmModal/TurnOffAppleMdmModal.tsx
index 3db66fe6f744..cf83d11ea458 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/modals/TurnOffMacOsMdmModal/TurnOffMacOsMdmModal.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/TurnOffAppleMdmModal/TurnOffAppleMdmModal.tsx
@@ -4,17 +4,17 @@ import Button from "components/buttons/Button";
 
 import Modal from "components/Modal";
 
-const baseClass = "modal turn-off-mdm-modal";
+const baseClass = "modal turn-off-apple-mdm-modal";
 
-interface ITurnOffMacOsMdmModalProps {
+interface ITurnOffAppleMdmModalProps {
   onCancel: () => void;
   onConfirm: () => void;
 }
 
-const TurnOffMacOsMdmModal = ({
+const TurnOffAppleMdmModal = ({
   onConfirm,
   onCancel,
-}: ITurnOffMacOsMdmModalProps): JSX.Element => {
+}: ITurnOffAppleMdmModalProps): JSX.Element => {
   const [isDeleting, setIsDeleting] = useState(false);
 
   const onClickConfirm = useCallback(() => {
@@ -23,10 +23,11 @@ const TurnOffMacOsMdmModal = ({
   }, [onConfirm]);
 
   return (
-    <Modal title="Turn off macOS MDM" onExit={onCancel} className={baseClass}>
+    <Modal title="Turn off MDM" onExit={onCancel} className={baseClass}>
       <div className={baseClass}>
-        If you want to use MDM features again, you’ll have to upload a new APNs
-        certificate and all end users will have to turn MDM off and back on.
+        If you want to use MDM features again, you&apos;ll have to upload a new
+        APNs certificate and all end users will have to turn MDM off and back
+        on.
         <div className="modal-cta-wrap">
           <Button
             type="button"
@@ -50,4 +51,4 @@ const TurnOffMacOsMdmModal = ({
   );
 };
 
-export default TurnOffMacOsMdmModal;
+export default TurnOffAppleMdmModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/modals/TurnOffMacOsMdmModal/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/TurnOffAppleMdmModal/_styles.scss
similarity index 88%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/modals/TurnOffMacOsMdmModal/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/TurnOffAppleMdmModal/_styles.scss
index 0233907b7c5b..635128b75606 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/modals/TurnOffMacOsMdmModal/_styles.scss
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/TurnOffAppleMdmModal/_styles.scss
@@ -1,4 +1,4 @@
-.turn-off-mdm-modal {
+.turn-off-apple-mdm-modal {
   &__info-header {
     margin-bottom: $pad-xlarge;
   }
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/TurnOffAppleMdmModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/TurnOffAppleMdmModal/index.ts
new file mode 100644
index 000000000000..eea2ac803ba4
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/TurnOffAppleMdmModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./TurnOffAppleMdmModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/index.ts
new file mode 100644
index 000000000000..96551b4bb5f2
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/index.ts
@@ -0,0 +1 @@
+export { default } from "./AppleMdmPage";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/modals/TurnOffMacOsMdmModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/modals/TurnOffMacOsMdmModal/index.ts
deleted file mode 100644
index fc6c93f694f6..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/components/modals/TurnOffMacOsMdmModal/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./TurnOffMacOsMdmModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/index.ts
deleted file mode 100644
index 6a6ac996b1e6..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./MacOSMdmPage";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MdmSettings.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MdmSettings.tsx
index e8e2695f1606..b6e0f02795f0 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MdmSettings.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MdmSettings.tsx
@@ -3,19 +3,20 @@ import { useQuery } from "react-query";
 import { AxiosError } from "axios";
 import { InjectedRouter } from "react-router";
 
+import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
 import { AppContext } from "context/app";
-
-import mdmAppleAPI from "services/entities/mdm_apple";
 import { IMdmApple } from "interfaces/mdm";
+import mdmAppleAPI, {
+  IGetVppTokensResponse,
+} from "services/entities/mdm_apple";
+import mdmAPI, { IEulaMetadataResponse } from "services/entities/mdm";
 
-import PATHS from "router/paths";
-
-import Spinner from "components/Spinner";
-import SectionHeader from "components/SectionHeader";
-
-import EndUserMigrationSection from "./components/EndUserMigrationSection/EndUserMigrationSection";
-import WindowsMdmCard from "./components/WindowsMdmCard/WindowsMdmCard";
-import MacOSMdmCard from "./components/MacOSMdmCard/MacOSMdmCard";
+import MdmSettingsSection from "./components/MdmSettingsSection";
+import AutomaticEnrollmentSection from "./components/AutomaticEnrollmentSection";
+import VppSection from "./components/VppSection";
+import IdpSection from "./components/IdpSection";
+import EulaSection from "./components/EulaSection";
+import EndUserMigrationSection from "./components/EndUserMigrationSection";
 
 const baseClass = "mdm-settings";
 
@@ -26,17 +27,21 @@ interface IMdmSettingsProps {
 const MdmSettings = ({ router }: IMdmSettingsProps) => {
   const { isPremiumTier, config } = useContext(AppContext);
 
+  const isMdmEnabled = !!config?.mdm.enabled_and_configured;
+
   // Currently the status of this API call is what determines various UI states on
   // this page. Because of this we will not render any of this components UI until this API
   // call has completed.
   const {
-    data: appleAPNInfo,
-    isLoading: isLoadingMdmApple,
-    error: errorMdmApple,
+    data: APNSInfo,
+    isLoading: isLoadingAPNSInfo,
+    isError: isAPNSInfoError,
+    error: errorAPNSInfo,
   } = useQuery<IMdmApple, AxiosError, IMdmApple>(
     ["appleAPNInfo"],
     () => mdmAppleAPI.getAppleAPNInfo(),
     {
+      ...DEFAULT_USE_QUERY_OPTIONS,
       retry: (tries, error) =>
         error.status !== 404 && error.status !== 400 && tries <= 3,
       // TODO: There is a potential race condition here immediately after MDM is turned off. This
@@ -44,44 +49,100 @@ const MdmSettings = ({ router }: IMdmSettingsProps) => {
       // enabled, resulting in a 400 response. The race really should  be fixed higher up the chain where
       // we're fetching and setting the config, but for now we'll just assume that any 400 response
       // means that MDM is not enabled and we'll show the "Turn on MDM" button.
-      enabled: !!config?.mdm.enabled_and_configured,
       staleTime: 5000,
+      enabled: isMdmEnabled,
+    }
+  );
+
+  // get the vpp info
+  const {
+    data: vppData,
+    isLoading: isLoadingVpp,
+    isError: isVppError,
+  } = useQuery<IGetVppTokensResponse, AxiosError>(
+    "vppInfo",
+    () => mdmAppleAPI.getVppTokens(),
+    {
+      ...DEFAULT_USE_QUERY_OPTIONS,
+      retry: false,
+      enabled: isPremiumTier && isMdmEnabled,
     }
   );
 
-  const navigateToMacOSMdm = () => {
-    router.push(PATHS.ADMIN_INTEGRATIONS_MDM_MAC);
-  };
+  // get the eula metadata
+  const {
+    data: eulaMetadata,
+    isLoading: isLoadingEula,
+    isError: isEulaError,
+    error: eulaError,
+    refetch: refetchEulaMetadata,
+  } = useQuery<IEulaMetadataResponse, AxiosError>(
+    ["eula-metadata"],
+    () => mdmAPI.getEULAMetadata(),
+    {
+      ...DEFAULT_USE_QUERY_OPTIONS,
+      retry: false,
+      enabled: isPremiumTier && isMdmEnabled,
+    }
+  );
+
+  // we use this to determine if we any of the request are still in progress
+  // and should show a spinner.
+  const isLoading = isLoadingAPNSInfo || isLoadingVpp || isLoadingEula;
+
+  const noVppTokenUploaded = !vppData || !vppData.vpp_tokens.length;
+  const hasVppError = isVppError && !noVppTokenUploaded;
+
+  // We are relying on the API to give us a 404 to
+  // tell use the user has not uploaded a eula.
+  const noEulaUploaded = eulaError && eulaError.status === 404;
+  const hasEulaError = isEulaError && !noEulaUploaded;
+
+  // we use this to determine if there was any errors when getting any of the
+  // data we depend on to render the page. We will not include the VPP or EULA
+  // 404 errors. We only want to show an error if there was a "real" error
+  // (e.g.non 404 error).
+  const hasError = isAPNSInfoError || hasVppError || hasEulaError;
 
-  const navigateToWindowsMdm = () => {
-    router.push(PATHS.ADMIN_INTEGRATIONS_MDM_WINDOWS);
-  };
+  // we use this to determine if we have all the data we need to render the UI.
+  // Notice that we do not need VPP or EULA data to render this page.
+  const hasAllData = !isMdmEnabled || !!APNSInfo;
 
   return (
     <div className={baseClass}>
-      <div className={`${baseClass}__section`}>
-        <SectionHeader title="Mobile device management (MDM)" />
-        {isLoadingMdmApple ? (
-          <Spinner />
-        ) : (
-          <div className={`${baseClass}__section ${baseClass}__mdm-section`}>
-            <MacOSMdmCard
-              appleAPNInfo={appleAPNInfo}
-              errorData={errorMdmApple}
-              turnOnMacOSMdm={navigateToMacOSMdm}
-              viewDetails={navigateToMacOSMdm}
-            />
-            <WindowsMdmCard
-              turnOnWindowsMdm={navigateToWindowsMdm}
-              editWindowsMdm={navigateToWindowsMdm}
-            />
-          </div>
-        )}
-      </div>
-      {isPremiumTier && appleAPNInfo && (
-        <div className={`${baseClass}__section`}>
-          <EndUserMigrationSection router={router} />
-        </div>
+      {/* The MDM settings section component handles showing the pages overall
+       * loading and error states */}
+      <MdmSettingsSection
+        isLoading={isLoading}
+        isError={hasError}
+        appleAPNSInfo={APNSInfo}
+        appleAPNSError={errorAPNSInfo}
+        router={router}
+      />
+      {!isLoading && !hasError && hasAllData && (
+        <>
+          <AutomaticEnrollmentSection
+            router={router}
+            isPremiumTier={!!isPremiumTier}
+          />
+          <VppSection
+            router={router}
+            isVppOn={!noVppTokenUploaded}
+            isPremiumTier={!!isPremiumTier}
+          />
+          {isPremiumTier && !!config?.mdm.apple_bm_enabled_and_configured && (
+            <>
+              <IdpSection />
+              <EulaSection
+                eulaMetadata={eulaMetadata}
+                isEulaUploaded={!noEulaUploaded}
+                onUpload={refetchEulaMetadata}
+                onDelete={refetchEulaMetadata}
+              />
+              <EndUserMigrationSection router={router} />
+            </>
+          )}
+        </>
       )}
     </div>
   );
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/VppPage.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/VppPage.tsx
new file mode 100644
index 000000000000..3c08f6291211
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/VppPage.tsx
@@ -0,0 +1,262 @@
+import React, { useCallback, useContext, useRef, useState } from "react";
+import { InjectedRouter } from "react-router";
+import { AxiosError } from "axios";
+import { useQuery } from "react-query";
+
+import PATHS from "router/paths";
+import { AppContext } from "context/app";
+import { IMdmVppToken } from "interfaces/mdm";
+import mdmAppleAPI, {
+  IGetVppTokensResponse,
+} from "services/entities/mdm_apple";
+
+import BackLink from "components/BackLink";
+import MainContent from "components/MainContent";
+import Button from "components/buttons/Button";
+import DataError from "components/DataError";
+import Spinner from "components/Spinner";
+import PremiumFeatureMessage from "components/PremiumFeatureMessage";
+
+import AddVppModal from "./components/AddVppModal";
+import RenewVppModal from "./components/RenewVppModal";
+import DeleteVppModal from "./components/DeleteVppModal";
+import VppTable from "./components/VppTable";
+import EditTeamsVppModal from "./components/EditTeamsVppModal";
+
+const baseClass = "vpp-page";
+
+interface ITurnOnMdmMessageProps {
+  router: InjectedRouter;
+}
+
+const TurnOnMdmMessage = ({ router }: ITurnOnMdmMessageProps) => {
+  return (
+    <div className={`${baseClass}__turn-on-mdm-message`}>
+      <h2>Turn on Apple MDM</h2>
+      <p>
+        To install Apple App Store apps purchased through Apple Business
+        Manager, first turn on Apple MDM.
+      </p>
+      <Button
+        variant="brand"
+        onClick={() => {
+          router.push(PATHS.ADMIN_INTEGRATIONS_MDM);
+        }}
+      >
+        Turn on
+      </Button>
+    </div>
+  );
+};
+
+interface IAddVppMessageProps {
+  onAddVpp: () => void;
+}
+
+const AddVppMessage = ({ onAddVpp }: IAddVppMessageProps) => {
+  return (
+    <div className={`${baseClass}__add-vpp-message`}>
+      <h2>Add your VPP</h2>
+      <p>
+        Install Apple App Store apps purchased through Apple Business Manager.
+      </p>
+      <Button variant="brand" onClick={onAddVpp}>
+        Add VPP
+      </Button>
+    </div>
+  );
+};
+
+interface IVppPageProps {
+  router: InjectedRouter;
+}
+
+const VppPage = ({ router }: IVppPageProps) => {
+  const { config, isPremiumTier } = useContext(AppContext);
+
+  const [showRenewModal, setShowRenewModal] = useState(false);
+  const [showDeleteModal, setShowDeleteModal] = useState(false);
+  const [showAddVppModal, setShowAddVppModal] = useState(false);
+  const [showEditTeamsModal, setShowEditTeamsModal] = useState(false);
+
+  const selectedToken = useRef<IMdmVppToken | null>(null);
+
+  const {
+    data: vppTokens,
+    error: errorVppTokens,
+    isLoading,
+    refetch,
+  } = useQuery<IGetVppTokensResponse, AxiosError, IMdmVppToken[]>(
+    ["vpp_tokens"],
+    () => mdmAppleAPI.getVppTokens(),
+    {
+      refetchOnWindowFocus: false,
+      retry: (tries, error) =>
+        error.status !== 404 && error.status !== 400 && tries <= 3,
+      select: (data) => data.vpp_tokens,
+      enabled: isPremiumTier,
+    }
+  );
+
+  const onEditTokenTeams = (token: IMdmVppToken) => {
+    selectedToken.current = token;
+    setShowEditTeamsModal(true);
+  };
+
+  const onCancelEditTokenTeams = useCallback(() => {
+    selectedToken.current = null;
+    setShowEditTeamsModal(false);
+  }, []);
+
+  const onEditedTeams = useCallback(() => {
+    selectedToken.current = null;
+    refetch();
+    setShowEditTeamsModal(false);
+  }, [refetch]);
+
+  const onAddVpp = () => {
+    setShowAddVppModal(true);
+  };
+
+  const onAdded = () => {
+    refetch();
+    setShowAddVppModal(false);
+  };
+
+  const onRenewToken = (vppToken: IMdmVppToken) => {
+    selectedToken.current = vppToken;
+    setShowRenewModal(true);
+  };
+
+  const onCancelRenewToken = useCallback(() => {
+    selectedToken.current = null;
+    setShowRenewModal(false);
+  }, []);
+
+  const onRenewed = useCallback(() => {
+    selectedToken.current = null;
+    refetch();
+    setShowRenewModal(false);
+  }, [refetch]);
+
+  const onDeleteToken = (vppToken: IMdmVppToken) => {
+    selectedToken.current = vppToken;
+    setShowDeleteModal(true);
+  };
+
+  const onCancelDeleteToken = useCallback(() => {
+    selectedToken.current = null;
+    setShowDeleteModal(false);
+  }, []);
+
+  const onDeleted = useCallback(() => {
+    selectedToken.current = null;
+    refetch();
+    setShowDeleteModal(false);
+  }, [refetch]);
+
+  const showDataError = errorVppTokens && errorVppTokens.status !== 404;
+
+  const renderContent = () => {
+    if (!isPremiumTier) {
+      return <PremiumFeatureMessage />;
+    }
+
+    if (!config?.mdm.enabled_and_configured) {
+      return <TurnOnMdmMessage router={router} />;
+    }
+
+    if (isLoading) {
+      return <Spinner />;
+    }
+
+    // TODO: error UI
+    if (showDataError) {
+      return (
+        <div>
+          <DataError />
+        </div>
+      );
+    }
+
+    if (vppTokens?.length === 0) {
+      return <AddVppMessage onAddVpp={onAddVpp} />;
+    }
+
+    if (vppTokens) {
+      return (
+        <>
+          <p>
+            Add your VPP to install Apple App Store apps purchased through Apple
+            Business Manager.
+          </p>
+          <VppTable
+            vppTokens={vppTokens}
+            onEditTokenTeam={onEditTokenTeams}
+            onRenewToken={onRenewToken}
+            onDeleteToken={onDeleteToken}
+          />
+        </>
+      );
+    }
+
+    return null;
+  };
+
+  return (
+    <MainContent className={baseClass}>
+      <>
+        <BackLink
+          text="Back to MDM"
+          path={PATHS.ADMIN_INTEGRATIONS_MDM}
+          className={`${baseClass}__back-to-mdm`}
+        />
+        <div className={`${baseClass}__page-content`}>
+          <div className={`${baseClass}__page-header-section`}>
+            <h1>Volume Purchasing Program (VPP)</h1>
+            {isPremiumTier &&
+              vppTokens?.length !== 0 &&
+              !!config?.mdm.enabled_and_configured && (
+                <Button variant="brand" onClick={onAddVpp}>
+                  Add VPP
+                </Button>
+              )}
+          </div>
+          <>{renderContent()}</>
+        </div>
+      </>
+      {showAddVppModal && (
+        <AddVppModal
+          onAdded={onAdded}
+          onCancel={() => setShowAddVppModal(false)}
+        />
+      )}
+      {showRenewModal && selectedToken.current && (
+        <RenewVppModal
+          tokenId={selectedToken.current.id}
+          orgName={selectedToken.current.org_name}
+          onCancel={onCancelRenewToken}
+          onRenewedToken={onRenewed}
+        />
+      )}
+      {showDeleteModal && selectedToken.current && (
+        <DeleteVppModal
+          orgName={selectedToken.current.org_name}
+          tokenId={selectedToken.current.id}
+          onCancel={onCancelDeleteToken}
+          onDeletedToken={onDeleted}
+        />
+      )}
+      {showEditTeamsModal && selectedToken.current && (
+        <EditTeamsVppModal
+          currentToken={selectedToken.current}
+          tokens={vppTokens || []}
+          onCancel={onCancelEditTokenTeams}
+          onSuccess={onEditedTeams}
+        />
+      )}
+    </MainContent>
+  );
+};
+
+export default VppPage;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/_styles.scss
new file mode 100644
index 000000000000..dd76601ce95b
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/_styles.scss
@@ -0,0 +1,67 @@
+.vpp-page {
+  &__back-to-mdm {
+    margin-bottom: $pad-xlarge;
+  }
+
+  &__page-content {
+    display: flex;
+    flex-direction: column;
+    gap: $pad-xxlarge;
+  }
+
+  &__page-header-section {
+    display: flex;
+    flex-direction: row;
+    gap: $pad-large;
+    align-items: center;
+    justify-content: space-between;
+
+    h1 {
+      margin-bottom: 0;
+      font-size: $large;
+    }
+  }
+
+
+  &__turn-on-mdm-message,
+  &__add-vpp-message {
+    margin: 0 auto;
+    text-align: center;
+    width: 450px;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+
+    >h2 {
+      margin-bottom: $pad-small;
+      font-size: $small;
+      font-weight: $bold;
+    }
+
+    >p {
+      margin: 0 0 $pad-medium;
+    }
+  }
+
+  &__url-inputs-wrapper {
+    display: flex;
+    flex-direction: column;
+    gap: $pad-icon;
+    margin-top: $pad-large;
+  }
+
+  &__url-input {
+    margin-bottom: 0;
+  }
+
+  // TODO: remove these styles when the updated error component is used
+  .data-error {
+    margin: $pad-xxlarge 0;
+    padding: $pad-xlarge 0;
+  }
+
+  .data-error__inner {
+    padding: $pad-xlarge 0;
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/AddVppModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/AddVppModal.tsx
new file mode 100644
index 000000000000..d18156d36392
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/AddVppModal.tsx
@@ -0,0 +1,98 @@
+import React, { useCallback, useContext, useState } from "react";
+
+import { NotificationContext } from "context/notification";
+import { getErrorReason } from "interfaces/errors";
+import mdmAppleAPI from "services/entities/mdm_apple";
+
+import Modal from "components/Modal";
+import Button from "components/buttons/Button";
+import FileUploader from "components/FileUploader";
+import { FileDetails } from "components/FileUploader/FileUploader";
+
+import VppSetupSteps from "../VppSetupSteps";
+import { getErrorMessage } from "./helpers";
+
+const baseClass = "add-vpp-modal";
+
+interface IAddVppModalProps {
+  onCancel: () => void;
+  onAdded: () => void;
+}
+
+const AddVppModal = ({ onCancel, onAdded }: IAddVppModalProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+
+  const [tokenFile, setTokenFile] = useState<File | null>(null);
+  const [isUploading, setIsUploading] = useState(false);
+
+  const onSelectFile = useCallback((files: FileList | null) => {
+    const file = files?.[0];
+    if (file) {
+      setTokenFile(file);
+    }
+  }, []);
+
+  const uploadVppToken = useCallback(async () => {
+    setIsUploading(true);
+    if (!tokenFile) {
+      setIsUploading(false);
+      renderFlash("error", "No token selected.");
+      return;
+    }
+
+    try {
+      await mdmAppleAPI.uploadVppToken(tokenFile);
+      renderFlash("success", "Added successfully.");
+      onAdded();
+    } catch (e) {
+      renderFlash("error", getErrorMessage(e));
+      onCancel();
+    } finally {
+      setIsUploading(false);
+    }
+  }, [tokenFile, renderFlash, onAdded, onCancel]);
+
+  return (
+    <Modal
+      className={baseClass}
+      title="Add VPP"
+      onExit={onCancel}
+      width="large"
+    >
+      <>
+        <VppSetupSteps extendendSteps />
+        <FileUploader
+          className={`${baseClass}__file-uploader ${
+            isUploading ? `${baseClass}__file-uploader--loading` : ""
+          }`}
+          accept=".vpptoken"
+          message="Content token (.vpptoken)"
+          graphicName="file-vpp"
+          buttonType="link"
+          buttonMessage={isUploading ? "Uploading..." : "Upload"}
+          filePreview={
+            tokenFile && (
+              <FileDetails
+                details={{ name: tokenFile.name }}
+                graphicName="file-vpp"
+              />
+            )
+          }
+          onFileUpload={onSelectFile}
+        />
+        <div className="modal-cta-wrap">
+          <Button
+            variant="brand"
+            onClick={uploadVppToken}
+            isLoading={isUploading}
+            disabled={!tokenFile || isUploading}
+          >
+            Add VPP
+          </Button>
+        </div>
+      </>
+    </Modal>
+  );
+};
+
+export default AddVppModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/_styles.scss
new file mode 100644
index 000000000000..072f29a9d535
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/_styles.scss
@@ -0,0 +1,59 @@
+.add-vpp-modal {
+
+  &__request-button {
+    display: flex;
+    gap: $pad-small;
+    align-items: center;
+    margin-top: $pad-small;
+
+    label {
+      display: flex;
+      gap: $pad-small;
+      cursor: pointer;
+    }
+  }
+
+  &__setup-list {
+    font-size: $x-small;
+    display: flex;
+    flex-direction: column;
+    gap: $pad-large;
+    padding: 0;
+    margin: 0;
+    max-width: 660px;
+    list-style: none;
+
+    li {
+      display: flex;
+      flex-direction: row;
+      gap: $pad-small;
+
+      p {
+        display: flex;
+        flex-direction: column;
+        align-items: flex-start;
+        margin: 0;
+      }
+    }
+  }
+
+  &__file-uploader {
+    margin-top: $pad-medium;
+    margin-left: $pad-medium;
+
+    .file-uploader__message {
+      color: $ui-fleet-black-75;
+      margin: 0;
+    }
+
+    button {
+      margin-top: 0;
+    }
+
+    &--loading {
+      label {
+        opacity: 0.5;
+      }
+    }
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/helpers.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/helpers.tsx
new file mode 100644
index 000000000000..7716c6de6c92
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/helpers.tsx
@@ -0,0 +1,35 @@
+import React from "react";
+
+import { getErrorReason } from "interfaces/errors";
+
+const DEFAULT_ERROR_MESSAGE = "Couldn’t add. Please try again.";
+
+const generateDuplicateMessage = (msg: string) => {
+  const orgName = msg.split("'")[1];
+  return (
+    <>
+      Couldn&apos;t add. There&apos;s already a VPP connection for the{" "}
+      <b>{orgName}</b> location.
+    </>
+  );
+};
+
+// eslint-disable-next-line import/prefer-default-export
+export const getErrorMessage = (err: unknown) => {
+  const duplicateEntryReason = getErrorReason(err, {
+    reasonIncludes: "Duplicate entry",
+  });
+  const invalidTokenReason = getErrorReason(err, {
+    reasonIncludes: "Invalid token",
+  });
+
+  if (duplicateEntryReason) {
+    return generateDuplicateMessage(duplicateEntryReason);
+  }
+
+  if (invalidTokenReason) {
+    return invalidTokenReason;
+  }
+
+  return DEFAULT_ERROR_MESSAGE;
+};
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/index.ts
new file mode 100644
index 000000000000..766b0c2cfe5c
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./AddVppModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/DeleteVppModal/DeleteVppModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/DeleteVppModal/DeleteVppModal.tsx
new file mode 100644
index 000000000000..8f361498618e
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/DeleteVppModal/DeleteVppModal.tsx
@@ -0,0 +1,82 @@
+import React, { useCallback, useContext, useState } from "react";
+
+import mdmAppleAPI from "services/entities/mdm_apple";
+import { NotificationContext } from "context/notification";
+
+import Button from "components/buttons/Button";
+import Modal from "components/Modal";
+
+const baseClass = "delete-vpp-modal";
+
+interface IDeleteVppModalProps {
+  orgName: string;
+  tokenId: number;
+  onCancel: () => void;
+  onDeletedToken: () => void;
+}
+
+const DeleteVppModal = ({
+  orgName,
+  tokenId,
+  onCancel,
+  onDeletedToken,
+}: IDeleteVppModalProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+
+  const [isDeleting, setIsDeleting] = useState(false);
+
+  const onDeleteToken = useCallback(async () => {
+    setIsDeleting(true);
+
+    try {
+      await mdmAppleAPI.deleteVppToken(tokenId);
+      renderFlash("success", "Deleted successfully.");
+      onDeletedToken();
+    } catch (e) {
+      // TODO: Check API sends back correct error messages
+      renderFlash("error", "Couldn’t delete. Please try again.");
+      onCancel();
+    }
+  }, [onCancel, onDeletedToken, renderFlash, tokenId]);
+
+  return (
+    <Modal
+      title="Delete VPP"
+      className={baseClass}
+      onExit={onCancel}
+      isContentDisabled={isDeleting}
+    >
+      <>
+        <p>
+          Apps purchased for the <b>{orgName}</b> location won&apos;t appear in
+          Fleet. Apps won&apos;t be uninstalled from hosts.
+        </p>
+        <p>
+          If you want to enable VPP integration again, you&apos;ll have to
+          upload a new token.
+        </p>
+
+        <div className="modal-cta-wrap">
+          <Button
+            type="button"
+            variant="alert"
+            onClick={onDeleteToken}
+            disabled={isDeleting}
+            isLoading={isDeleting}
+          >
+            Delete
+          </Button>
+          <Button
+            onClick={onCancel}
+            disabled={isDeleting}
+            variant="inverse-alert"
+          >
+            Cancel
+          </Button>
+        </div>
+      </>
+    </Modal>
+  );
+};
+
+export default DeleteVppModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/DeleteVppModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/DeleteVppModal/index.ts
new file mode 100644
index 000000000000..a95996dfdb6e
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/DeleteVppModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./DeleteVppModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/EditTeamsVppModal.tests.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/EditTeamsVppModal.tests.tsx
new file mode 100644
index 000000000000..8db87eb38e25
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/EditTeamsVppModal.tests.tsx
@@ -0,0 +1,224 @@
+import {
+  APP_CONTEXT_ALL_TEAMS_ID,
+  APP_CONTEXT_NO_TEAM_ID,
+} from "interfaces/team";
+import {
+  getOptions,
+  selectedValueFromToken,
+  teamIdsFromSelectedValue,
+  updateSelectedValue,
+} from "./EditTeamsVppModal";
+
+describe("EditTeamsVppModal", () => {
+  const allTeamsToken = {
+    id: 1,
+    org_name: "Org 1",
+    location: "https://example.com/mdm/apple/mdm",
+    renew_date: "2024-11-29T00:00:00Z",
+    teams: [], // all teams
+  };
+
+  const unassignedToken = {
+    id: 2,
+    org_name: "Org 2",
+    location: "https://example.com/mdm/apple/mdm",
+    renew_date: "2024-11-29T00:00:00Z",
+    teams: null, // unassigned
+  };
+
+  const noTeamToken = {
+    id: 3,
+    org_name: "Org 3",
+    location: "https://example.com/mdm/apple/mdm",
+    renew_date: "2024-11-29T00:00:00Z",
+    teams: [{ team_id: 0, name: "No team" }],
+  };
+
+  const piratesAndNinjasToken = {
+    id: 4,
+    org_name: "Org 4",
+    location: "https://example.com/mdm/apple/mdm",
+    renew_date: "2024-11-29T00:00:00Z",
+    teams: [
+      { team_id: 2, name: "Pirates" },
+      { team_id: 1, name: "Ninjas" },
+    ],
+  };
+
+  const pandasToken = {
+    id: 5,
+    org_name: "Org 5",
+    location: "https://example.com/mdm/apple/mdm",
+    renew_date: "2024-11-29T00:00:00Z",
+    teams: [{ team_id: 3, name: "Pandas" }],
+  };
+
+  const availableTeams = [
+    { id: APP_CONTEXT_ALL_TEAMS_ID, name: "All teams" },
+    { id: APP_CONTEXT_NO_TEAM_ID, name: "No team" },
+    { id: 1, name: "Ninjas" },
+    { id: 2, name: "Pirates" },
+    { id: 3, name: "Pandas" },
+    { id: 4, name: "Penguins" },
+  ];
+
+  const allOptions = availableTeams.map((t) => ({
+    label: t.name,
+    value: t.id,
+  }));
+
+  describe("getOptions", () => {
+    it("returns no options when another token is all teams", () => {
+      const tokens = [allTeamsToken, piratesAndNinjasToken];
+      const currentToken = piratesAndNinjasToken;
+      const options = getOptions(availableTeams, tokens, currentToken);
+      expect(options).toEqual([]);
+    });
+
+    it("includes all options when all tokens are unassigned", () => {
+      const tokens = [
+        unassignedToken,
+        { ...unassignedToken, id: 1337 },
+        { ...unassignedToken, id: 1338 },
+      ];
+      const currentToken = unassignedToken;
+      const options = getOptions(availableTeams, tokens, currentToken);
+      expect(options).toEqual(allOptions);
+    });
+
+    it("includes all options when current token is all teams and other tokens are unassigned", () => {
+      const tokens = [
+        allTeamsToken,
+        unassignedToken,
+        { ...unassignedToken, id: 1337 },
+        { ...unassignedToken, id: 1338 },
+      ];
+      const currentToken = allTeamsToken;
+      const options = getOptions(availableTeams, tokens, currentToken);
+      expect(options).toEqual(allOptions);
+    });
+
+    it("excludes all teams option when any token is assigned", () => {
+      const tokens = [unassignedToken, piratesAndNinjasToken];
+      const currentToken = unassignedToken;
+      const options = getOptions(availableTeams, tokens, currentToken);
+      expect(options).toEqual(
+        options.filter((o) => o.value !== APP_CONTEXT_ALL_TEAMS_ID)
+      );
+    });
+
+    it("excludes teams assigned to other tokens", () => {
+      const tokens = [
+        piratesAndNinjasToken,
+        noTeamToken,
+        pandasToken,
+        unassignedToken,
+      ];
+
+      // test with unassignedToken
+      expect(getOptions(availableTeams, tokens, unassignedToken)).toEqual([
+        { label: "Penguins", value: 4 }, // only penguins is available
+      ]);
+
+      // test with piratesAndNinjasToken
+      let unavailableTeamIds = [
+        APP_CONTEXT_ALL_TEAMS_ID, // all teams is excluded unless current token is all teams or all tokens are unassigned
+        APP_CONTEXT_NO_TEAM_ID, // already assigned to noTeamToken
+        3, // already assigned to pandasToken
+      ];
+      expect(getOptions(availableTeams, tokens, piratesAndNinjasToken)).toEqual(
+        allOptions.filter((o) => !unavailableTeamIds.includes(o.value))
+      );
+
+      // test with pandasToken
+      unavailableTeamIds = [
+        APP_CONTEXT_ALL_TEAMS_ID, // all teams is excluded unless current token is all teams or all tokens are unassigned
+        APP_CONTEXT_NO_TEAM_ID, // already assigned to noTeamToken
+        1, // already assigned to piratesAndNinjasToken
+        2, // already assigned to piratesAndNinjasToken
+      ];
+      expect(getOptions(availableTeams, tokens, pandasToken)).toEqual(
+        allOptions.filter((o) => !unavailableTeamIds.includes(o.value))
+      );
+
+      // test with noTeamToken
+      unavailableTeamIds = [
+        APP_CONTEXT_ALL_TEAMS_ID, // all teams is excluded unless current token is all teams or all tokens are unassigned
+        1, // already assigned to piratesAndNinjasToken
+        2, // already assigned to piratesAndNinjasToken
+        3, // already assigned to pandasToken
+      ];
+      expect(getOptions(availableTeams, tokens, noTeamToken)).toEqual(
+        allOptions.filter((o) => !unavailableTeamIds.includes(o.value))
+      );
+
+      // test with allTeamsToken
+      unavailableTeamIds = [
+        APP_CONTEXT_NO_TEAM_ID, // already assigned to noTeamToken
+        1, // already assigned to piratesAndNinjasToken
+        2, // already assigned to piratesAndNinjasToken
+        3, // already assigned to pandasToken
+      ];
+      expect(
+        getOptions(availableTeams, [...tokens, allTeamsToken], allTeamsToken)
+      ).toEqual(
+        allOptions.filter((o) => !unavailableTeamIds.includes(o.value))
+      );
+    });
+  });
+  describe("updateSelectedValue", () => {
+    it("returns next value when only one team is selected", () => {
+      const prev = "1";
+      const next = "2";
+      expect(updateSelectedValue(prev, next)).toEqual(next);
+    });
+
+    it("removes all teams when all teams was previously selected", () => {
+      const prev = "-1,2";
+      const next = "2";
+      expect(updateSelectedValue(prev, next)).toEqual(next);
+    });
+
+    it("selects all teams when all teams is newly selected", () => {
+      const prev = "2";
+      const next = "2,-1";
+      expect(updateSelectedValue(prev, next)).toEqual("-1");
+    });
+
+    it("returns next value when all teams is not selected", () => {
+      const prev = "2";
+      const next = "2,3";
+      expect(updateSelectedValue(prev, next)).toEqual(next);
+    });
+  });
+
+  describe("selectedValueFromToken", () => {
+    it("returns empty string when teams is null", () => {
+      expect(selectedValueFromToken(unassignedToken)).toEqual("");
+    });
+
+    it("returns all teams when teams is empty", () => {
+      expect(selectedValueFromToken(allTeamsToken)).toEqual("-1");
+    });
+
+    it("returns team ids when teams is not empty", () => {
+      expect(selectedValueFromToken(piratesAndNinjasToken)).toEqual("2,1");
+    });
+  });
+
+  describe("teamIdsFromSelectedValue", () => {
+    it("returns empty array when value is all teams id", () => {
+      expect(
+        teamIdsFromSelectedValue(APP_CONTEXT_ALL_TEAMS_ID.toString())
+      ).toEqual([]);
+    });
+
+    it("returns mull when value is empty string", () => {
+      expect(teamIdsFromSelectedValue("")).toEqual(null);
+    });
+
+    it("returns team ids when value is not all teams id", () => {
+      expect(teamIdsFromSelectedValue("2,1")).toEqual([2, 1]);
+    });
+  });
+});
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/EditTeamsVppModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/EditTeamsVppModal.tsx
new file mode 100644
index 000000000000..029380e60e17
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/EditTeamsVppModal.tsx
@@ -0,0 +1,259 @@
+import React, { useCallback, useContext, useMemo, useState } from "react";
+
+import { AppContext } from "context/app";
+import { NotificationContext } from "context/notification";
+
+import { IMdmVppToken } from "interfaces/mdm";
+import { APP_CONTEXT_ALL_TEAMS_ID, ITeamSummary } from "interfaces/team";
+
+import mdmAppleAPI from "services/entities/mdm_apple";
+
+import Modal from "components/Modal";
+// @ts-ignore
+import Dropdown from "components/forms/fields/Dropdown";
+import Button from "components/buttons/Button";
+import TooltipWrapper from "components/TooltipWrapper";
+
+const baseClass = "edit-teams-vpp-modal";
+
+interface IEditTeamsVppModalProps {
+  currentToken: IMdmVppToken;
+  tokens: IMdmVppToken[];
+  onCancel: () => void;
+  onSuccess: () => void;
+}
+
+/**
+ * Returns an array of team ids from a token. It includes special handling for "All teams".
+ */
+export const selectedValueFromToken = (token: IMdmVppToken) => {
+  if (!token.teams) {
+    // if teams is null, it means the token isn't configured to any team
+    return "";
+  }
+  if (token.teams.length === 0) {
+    // if teams is an empty array, it means the token is configured to all teams
+    return APP_CONTEXT_ALL_TEAMS_ID.toString();
+  }
+  return token.teams.map((team) => team.team_id).join(",");
+};
+
+/** Returns an array of team ids for the API. It includes special handling for "All teams". */
+export const teamIdsFromSelectedValue = (selectedValue: string) => {
+  if (!selectedValue) {
+    // TODO: confirm whether the API will allow un-configuring a token
+    return null;
+  }
+  if (selectedValue === APP_CONTEXT_ALL_TEAMS_ID.toString()) {
+    return [];
+  }
+  const ids = selectedValue.split(",").map((str) => parseInt(str, 10));
+  // NOTE: We could do some extra frontend validation here like filtering out -1 (to ensure that
+  // we're not trying to send all teams and other teams at the same time) and checking for isNaN,
+  // but instead we're relying on the API to return an error if the request is invalid.
+  return ids;
+};
+
+/**
+ * Compare two comma-separated strings of team names and returns an updated value. It includes
+ * special handling for "All teams".
+ */
+export const updateSelectedValue = (prev: string, next: string) => {
+  // react-select uses a string of comma-separated values for multi-select so we split it
+  // fo get an array of selected team ids
+  const nextParts = next.split(",").map((p) => p.trim());
+  if (nextParts.length === 1) {
+    // if only one team is selected, no need for other checks
+    return next;
+  }
+
+  // we need to do some special handling for "All teams"
+  const allTeamsId = APP_CONTEXT_ALL_TEAMS_ID.toString();
+  // split the previous value to get an array of team ids
+  const prevParts = prev.split(",").map((p) => p.trim());
+  if (prevParts.includes(allTeamsId)) {
+    // if "All teams" was previously selected, we need to remove it from the next selections
+    return nextParts.filter((p) => p !== allTeamsId).join(", ");
+  }
+
+  // if "All teams" is newly selected, we need to remove any other selections
+  if (nextParts.includes(allTeamsId)) {
+    return allTeamsId;
+  }
+
+  // otherwise, just return the next selections
+  return next;
+};
+
+const isTokenAllTeams = (token: IMdmVppToken) => token.teams?.length === 0;
+
+const isTokenUnassigned = (token: IMdmVppToken) => token.teams === null;
+
+/**
+ * Returns a dictionary of team ids that are already assigned tokens other than the current token.
+ */
+const getUnavailableTeamIds = (
+  currentTokenId: number,
+  tokens: IMdmVppToken[]
+) => {
+  const unavailableTeamIds = {} as Record<string, boolean>;
+  tokens.forEach((token) => {
+    if (token.id === currentTokenId) {
+      return;
+    }
+    token.teams?.forEach((team) => {
+      unavailableTeamIds[team.team_id.toString()] = true;
+    });
+  });
+  return unavailableTeamIds;
+};
+
+/**
+ * Returns an array of options for the dropdown. It includes special handling for "All teams".
+ */
+export const getOptions = (
+  availableTeams: ITeamSummary[],
+  tokens: IMdmVppToken[],
+  currentToken: IMdmVppToken
+) => {
+  const allOptions =
+    availableTeams?.map((t) => ({
+      label: t.name,
+      value: t.id,
+    })) || [];
+
+  if (tokens.every(isTokenUnassigned)) {
+    // if all tokens are unassigned, we can include all options
+    return allOptions;
+  }
+
+  if (tokens.some(isTokenAllTeams) && !isTokenAllTeams(currentToken)) {
+    // if another token is assigned to all teams, we can't assign this token to any team
+    return [];
+  }
+
+  // if other tokens are assigned to specific teams, we'll filter out those team options
+  const unavailableTeamIds = getUnavailableTeamIds(currentToken.id, tokens);
+  if (!isTokenAllTeams(currentToken)) {
+    // if current token isn't already assigned to all teams, we'll exclude that option too
+    unavailableTeamIds[APP_CONTEXT_ALL_TEAMS_ID] = true;
+  }
+
+  return allOptions.filter((o) => !unavailableTeamIds[o.value]);
+};
+
+const EditTeamsVppModal = ({
+  tokens,
+  currentToken,
+  onCancel,
+  onSuccess,
+}: IEditTeamsVppModalProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+  const { availableTeams } = useContext(AppContext);
+
+  // react-select uses a string of comma-separated values for multi-select so we're using a string
+  // of ids here so that we don't need to worry about a team name including a comma
+  const [selectedValue, setSelectedValue] = useState<string>(
+    selectedValueFromToken(currentToken)
+  );
+  const [isSaving, setIsSaving] = useState(false);
+
+  const options = useMemo(() => {
+    return getOptions(availableTeams || [], tokens, currentToken);
+  }, [availableTeams, tokens, currentToken]);
+
+  const isAnyTokenAllTeams = useMemo(() => tokens.some(isTokenAllTeams), [
+    tokens,
+  ]);
+
+  const onChange = useCallback((val: string) => {
+    setSelectedValue((prev) => updateSelectedValue(prev, val));
+  }, []);
+
+  const onSave = useCallback(
+    async (evt: React.MouseEvent<HTMLFormElement>) => {
+      evt.preventDefault();
+      setIsSaving(true);
+      try {
+        await mdmAppleAPI.editVppTeams({
+          tokenId: currentToken.id,
+          teamIds: teamIdsFromSelectedValue(selectedValue),
+        });
+        renderFlash("success", "Edited successfully.");
+        onSuccess();
+      } catch (e) {
+        renderFlash("error", "Couldn’t edit. Please try again.");
+      }
+    },
+    [currentToken.id, selectedValue, renderFlash, onSuccess]
+  );
+
+  const isDropdownDisabled = options.length === 0 && isAnyTokenAllTeams;
+
+  return (
+    <Modal
+      className={baseClass}
+      title="Edit teams"
+      onExit={onCancel}
+      width="large"
+      isContentDisabled={isSaving}
+    >
+      <>
+        <p>
+          Edit teams for <b>{currentToken.org_name}</b>.
+        </p>
+        <form onSubmit={onSave} className={baseClass} autoComplete="off">
+          <TooltipWrapper
+            position="top"
+            underline={false}
+            showArrow
+            tipContent={
+              <div className={`${baseClass}__tooltip--all-teams`}>
+                You can&apos;t choose teams because you already have a VPP token
+                assigned to all teams. First, edit teams for that VPP token to
+                choose teams here.
+              </div>
+            }
+            disableTooltip={!isDropdownDisabled}
+          >
+            <Dropdown
+              options={options}
+              multi
+              onChange={onChange}
+              placeholder="Search teams"
+              value={selectedValue}
+              label="Teams"
+              className={`${baseClass}__vpp-dropdown`}
+              wrapperClassName={`${baseClass}__form-field--vpp-teams ${
+                isDropdownDisabled ? `${baseClass}__form-field--disabled` : ""
+              }`}
+              tooltip={
+                isDropdownDisabled ? undefined : (
+                  <>
+                    Each team can have only one VPP token. Teams that already
+                    have a VPP token won&apos;t show up here.
+                  </>
+                )
+              }
+              helpText="App Store apps in this VPP token’s Apple Business Manager (ABM) will only be available to install on hosts in these teams."
+              disabled={isDropdownDisabled}
+            />
+          </TooltipWrapper>
+          <div className="modal-cta-wrap">
+            <Button
+              type="submit"
+              variant="brand"
+              className="save-vpp-teams-loading"
+              isLoading={isSaving}
+              disabled={isDropdownDisabled}
+            >
+              Save
+            </Button>
+          </div>
+        </form>
+      </>
+    </Modal>
+  );
+};
+
+export default EditTeamsVppModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/_styles.scss
new file mode 100644
index 000000000000..72ed9e4a10f1
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/_styles.scss
@@ -0,0 +1,29 @@
+.edit-teams-vpp-modal {
+  .component__tooltip-wrapper__element {
+    width: 100%; // default component style was causing the select box not to be full width
+  }
+
+  // this is needed to wrap the selected team names in that are displayed
+  // in the dropdown select box.
+  .dropdown__select {
+    text-wrap: wrap;
+  }
+
+  // styles needed to make select look like figma design when disabled,
+  // default styles in the Dropdown component were not enough
+  &__form-field--disabled {
+    .Select.dropdown__select {
+      background-color: $ui-off-white;
+    }
+    .Select-placeholder {
+      color: $ui-fleet-black-50;
+    }
+    .form-field__help-text {
+      opacity: 0.6;
+    }
+  }
+  // TODO: how to adjust positioning of the tooltip so that it is just above the select box?
+  &__tooltip--all-teams {
+    text-align: center;
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/index.ts
new file mode 100644
index 000000000000..0465dee0b0a5
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./EditTeamsVppModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/RenewVppModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/RenewVppModal.tsx
new file mode 100644
index 000000000000..797b14e6eb74
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/RenewVppModal.tsx
@@ -0,0 +1,110 @@
+import React, { useState, useContext, useCallback } from "react";
+
+import { NotificationContext } from "context/notification";
+import { getErrorReason } from "interfaces/errors";
+import mdmAppleAPI from "services/entities/mdm_apple";
+
+import Button from "components/buttons/Button";
+import {
+  FileUploader,
+  FileDetails,
+} from "components/FileUploader/FileUploader";
+import Modal from "components/Modal";
+import VppSetupSteps from "../VppSetupSteps";
+import { getErrorMessage } from "./helpers";
+
+const baseClass = "modal renew-vpp-modal";
+
+interface IRenewVppModalProps {
+  tokenId: number;
+  orgName: string;
+  onCancel: () => void;
+  onRenewedToken: () => void;
+}
+
+const RenewVppModal = ({
+  tokenId,
+  orgName,
+  onCancel,
+  onRenewedToken,
+}: IRenewVppModalProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+  const [isRenewing, setIsRenewing] = useState(false);
+  const [tokenFile, setTokenFile] = useState<File | null>(null);
+
+  const onSelectFile = (files: FileList | null) => {
+    const file = files?.[0];
+    if (file) {
+      setTokenFile(file);
+    }
+  };
+
+  const onRenewToken = useCallback(async () => {
+    setIsRenewing(true);
+
+    if (!tokenFile) {
+      setIsRenewing(false);
+      renderFlash("error", "No token selected.");
+      return;
+    }
+
+    try {
+      await mdmAppleAPI.renewVppToken(tokenId, tokenFile);
+      renderFlash(
+        "success",
+        "Volume Purchasing Program (VPP) integration enabled successfully."
+      );
+      onRenewedToken();
+    } catch (e) {
+      renderFlash("error", getErrorMessage(e));
+      onCancel();
+    }
+    setIsRenewing(false);
+  }, [onCancel, onRenewedToken, renderFlash, tokenFile, tokenId]);
+
+  return (
+    <Modal
+      title="Renew VPP"
+      onExit={onCancel}
+      className={baseClass}
+      isContentDisabled={isRenewing}
+      width="large"
+    >
+      <>
+        <p className={`${baseClass}__description`}>
+          Renew Volume Purchasing Program for <b>{orgName}</b> location.
+        </p>
+        <VppSetupSteps />
+        <FileUploader
+          className={`${baseClass}__file-uploader`}
+          accept=".vpptoken"
+          message="Content token (.vpptoken)"
+          graphicName="file-vpp"
+          buttonType="link"
+          buttonMessage="Upload"
+          filePreview={
+            tokenFile && (
+              <FileDetails
+                details={{ name: tokenFile.name }}
+                graphicName="file-vpp"
+              />
+            )
+          }
+          onFileUpload={onSelectFile}
+        />
+        <div className="modal-cta-wrap">
+          <Button
+            variant="brand"
+            onClick={onRenewToken}
+            isLoading={isRenewing}
+            disabled={!tokenFile}
+          >
+            Renew token
+          </Button>
+        </div>
+      </>
+    </Modal>
+  );
+};
+
+export default RenewVppModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/_styles.scss
new file mode 100644
index 000000000000..c9079fd58954
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/_styles.scss
@@ -0,0 +1,11 @@
+.renew-vpp-modal {
+
+  &__description {
+    margin: 0 0 $pad-large;
+  }
+
+  &__file-uploader {
+    margin-top: $pad-medium;
+    margin-left: $pad-medium;
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/helpers.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/helpers.ts
new file mode 100644
index 000000000000..a7c0fe9ea2d8
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/helpers.ts
@@ -0,0 +1,16 @@
+import { getErrorReason } from "interfaces/errors";
+
+const DEFAULT_ERROR_MESSAGE = "Couldn’t renew. Please try again.";
+
+// eslint-disable-next-line import/prefer-default-export
+export const getErrorMessage = (err: unknown) => {
+  const invalidTokenReason = getErrorReason(err, {
+    reasonIncludes: "invalid",
+  });
+
+  if (invalidTokenReason) {
+    return "Invalid token. Please provide a valid token from Apple Business Manager.";
+  }
+
+  return DEFAULT_ERROR_MESSAGE;
+};
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/index.ts
new file mode 100644
index 000000000000..2064650e094f
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./RenewVppModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppSetupSteps/VppSetupSteps.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppSetupSteps/VppSetupSteps.tsx
new file mode 100644
index 000000000000..303003f20ce0
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppSetupSteps/VppSetupSteps.tsx
@@ -0,0 +1,68 @@
+import CustomLink from "components/CustomLink";
+import React from "react";
+
+const baseClass = "vpp-setup-steps";
+
+interface IVppSetupStepsProps {
+  /** This prop is used to display additional setup steps content. We have this
+   * because some places that use this component show additional content.
+   */
+  extendendSteps?: boolean;
+}
+
+const VppSetupSteps = ({ extendendSteps = false }: IVppSetupStepsProps) => {
+  return (
+    <ol className={baseClass}>
+      <li>
+        <span>1.</span>
+        <p>
+          Sign in to{" "}
+          <CustomLink
+            newTab
+            url="https://business.apple.com"
+            text="Apple Business Manager"
+          />
+          {extendendSteps && (
+            <>
+              <br />
+              If your organization doesn&apos;t have an account, select{" "}
+              <b>Sign up now</b>.
+            </>
+          )}
+        </p>
+      </li>
+      <li>
+        <span>2.</span>
+        <p>
+          Select your <b>account name</b> at the bottom left of the screen, then
+          select <b>Preferences</b>.
+        </p>
+      </li>
+      <li>
+        <span>3.</span>
+        <p>
+          Select <b>Payments and Billings</b> in the menu.
+        </p>
+      </li>
+      <li>
+        <span>4.</span>
+        <p>
+          Under the <b>Content Tokens</b>, download the token for the location
+          you want to use.
+          {extendendSteps && (
+            <>
+              <br /> Each token is based on a location in Apple Business
+              Manager.
+            </>
+          )}
+        </p>
+      </li>
+      <li>
+        <span>5.</span>
+        <p>Upload content token (.vpptoken file) below.</p>
+      </li>
+    </ol>
+  );
+};
+
+export default VppSetupSteps;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppSetupSteps/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppSetupSteps/_styles.scss
new file mode 100644
index 000000000000..23dd2748b9b1
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppSetupSteps/_styles.scss
@@ -0,0 +1,20 @@
+.vpp-setup-steps {
+  font-size: $x-small;
+  display: flex;
+  flex-direction: column;
+  gap: $pad-large;
+  padding: 0;
+  margin: 0;
+  max-width: 660px;
+  list-style: none;
+
+  li {
+    display: flex;
+    flex-direction: row;
+    gap: $pad-small;
+
+    p {
+      margin: 0;
+    }
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppSetupSteps/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppSetupSteps/index.ts
new file mode 100644
index 000000000000..94ab3ee83604
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppSetupSteps/index.ts
@@ -0,0 +1 @@
+export { default } from "./VppSetupSteps";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/TeamsCell/TeamsCell.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/TeamsCell/TeamsCell.tsx
new file mode 100644
index 000000000000..57a21e7e48b1
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/TeamsCell/TeamsCell.tsx
@@ -0,0 +1,110 @@
+import React from "react";
+import classnames from "classnames";
+
+import { ITokenTeam } from "interfaces/mdm";
+
+import TextCell from "components/TableContainer/DataTable/TextCell";
+import { uniqueId } from "lodash";
+import ReactTooltip from "react-tooltip";
+
+const baseClass = "teams-cell";
+
+const NUM_TEAMS_IN_TOOLTIP = 3;
+
+const generateCell = (teams: ITokenTeam[] | null) => {
+  if (!teams) {
+    return <TextCell value="---" grey />;
+  }
+
+  if (teams.length === 0) {
+    return <TextCell value="All Teams" />;
+  }
+
+  let text = "";
+  let italicize = true;
+  if (teams.length === 1) {
+    italicize = false;
+    text = teams[0].name;
+  } else {
+    text = `${teams.length} teams`;
+  }
+
+  return <TextCell value={text} italic={italicize} />;
+};
+
+const condenseTeams = (teams: ITokenTeam[]) => {
+  const condensed =
+    (teams?.length &&
+      teams
+        .slice(-NUM_TEAMS_IN_TOOLTIP)
+        .map((team) => team.name)
+        .reverse()) ||
+    [];
+
+  return teams.length > NUM_TEAMS_IN_TOOLTIP
+    ? condensed.concat(`+${teams.length - NUM_TEAMS_IN_TOOLTIP} more`)
+    : condensed;
+};
+
+const generateTooltip = (teams: ITokenTeam[] | null, tooltipId: string) => {
+  if (teams === null || teams.length <= 1) {
+    return null;
+  }
+
+  const condensedTeams = condenseTeams(teams);
+
+  return (
+    <ReactTooltip
+      effect="solid"
+      backgroundColor="#3e4771"
+      id={tooltipId}
+      data-html
+    >
+      <ul className={`${baseClass}__team-list`}>
+        {condensedTeams.map((teamName) => {
+          return <li key={teamName}>{teamName}</li>;
+        })}
+      </ul>
+    </ReactTooltip>
+  );
+};
+
+interface ITeamsCellProps {
+  teams: ITokenTeam[] | null;
+  className?: string;
+}
+
+const TeamsCell = ({ teams, className }: ITeamsCellProps) => {
+  const tooltipId = uniqueId();
+  const classNames = classnames(baseClass, className);
+
+  if (!teams) {
+    return <TextCell value={teams} />;
+  }
+
+  if (teams.length === 0) {
+    return <TextCell value="All Teams" />;
+  }
+
+  if (teams.length === 1) {
+    return <TextCell value={teams[0].name} />;
+  }
+
+  const cell = generateCell(teams);
+  const tooltip = generateTooltip(teams, tooltipId);
+
+  return (
+    <>
+      <div
+        className={`${baseClass}__team-text-with-tooltip`}
+        data-tip
+        data-for={tooltipId}
+      >
+        {cell}
+      </div>
+      {tooltip}
+    </>
+  );
+};
+
+export default TeamsCell;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/TeamsCell/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/TeamsCell/_styles.scss
new file mode 100644
index 000000000000..58f64d8de921
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/TeamsCell/_styles.scss
@@ -0,0 +1,12 @@
+.teams-cell {
+  &__team-text-with-tooltip {
+    display: inline-block;
+  }
+
+  &__team-list {
+    margin: 0;
+    padding: 0;
+    list-style: none;
+    text-align: left;
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/TeamsCell/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/TeamsCell/index.ts
new file mode 100644
index 000000000000..958df7313fe9
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/TeamsCell/index.ts
@@ -0,0 +1 @@
+export { default } from "./TeamsCell";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/VppTable.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/VppTable.tsx
new file mode 100644
index 000000000000..703c5af41ebc
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/VppTable.tsx
@@ -0,0 +1,58 @@
+import React from "react";
+
+import { IMdmVppToken } from "interfaces/mdm";
+
+import TableContainer from "components/TableContainer";
+
+import { generateTableConfig } from "./VppTableConfig";
+
+const baseClass = "vpp-table";
+
+interface IVppTableProps {
+  vppTokens: IMdmVppToken[];
+  onEditTokenTeam: (token: IMdmVppToken) => void;
+  onRenewToken: (token: IMdmVppToken) => void;
+  onDeleteToken: (token: IMdmVppToken) => void;
+}
+
+const VppTable = ({
+  vppTokens,
+  onEditTokenTeam,
+  onRenewToken,
+  onDeleteToken,
+}: IVppTableProps) => {
+  const onSelectAction = (action: string, abmToken: IMdmVppToken) => {
+    switch (action) {
+      case "editTeams":
+        onEditTokenTeam(abmToken);
+        break;
+      case "renew":
+        onRenewToken(abmToken);
+        break;
+      case "delete":
+        onDeleteToken(abmToken);
+        break;
+      default:
+        break;
+    }
+  };
+
+  const tableConfig = generateTableConfig(onSelectAction);
+
+  return (
+    <TableContainer<IMdmVppToken>
+      columnConfigs={tableConfig}
+      defaultSortHeader="org_name"
+      disableTableHeader
+      disablePagination
+      showMarkAllPages={false}
+      isAllPagesSelected={false}
+      emptyComponent={() => <></>}
+      isLoading={false}
+      data={vppTokens}
+      className={baseClass}
+    />
+  );
+};
+
+export default VppTable;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/VppTableConfig.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/VppTableConfig.tsx
new file mode 100644
index 000000000000..28e1e32cae02
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/VppTableConfig.tsx
@@ -0,0 +1,121 @@
+import React from "react";
+import { CellProps, Column } from "react-table";
+
+import { IMdmAbmToken, IMdmVppToken } from "interfaces/mdm";
+import { IHeaderProps, IStringCellProps } from "interfaces/datatable_config";
+import { IDropdownOption } from "interfaces/dropdownOption";
+
+import HeaderCell from "components/TableContainer/DataTable/HeaderCell";
+import DropdownCell from "components/TableContainer/DataTable/DropdownCell";
+import TextCell from "components/TableContainer/DataTable/TextCell";
+
+import RenewDateCell from "../../../components/RenewDateCell";
+import { IRenewDateCellStatusConfig } from "../../../components/RenewDateCell/RenewDateCell";
+import TeamsCell from "./TeamsCell";
+
+type IAbmTableConfig = Column<IMdmVppToken>;
+type ITableStringCellProps = IStringCellProps<IMdmVppToken>;
+type IRenewDateCellProps = CellProps<IMdmVppToken, IMdmVppToken["renew_date"]>;
+type ITeamsCellProps = CellProps<IMdmVppToken, IMdmVppToken["teams"]>;
+
+type ITableHeaderProps = IHeaderProps<IMdmVppToken>;
+
+const DEFAULT_ACTION_OPTIONS: IDropdownOption[] = [
+  { value: "editTeams", label: "Edit teams", disabled: false },
+  { value: "renew", label: "Renew", disabled: false },
+  { value: "delete", label: "Delete", disabled: false },
+];
+
+const generateActions = () => {
+  return DEFAULT_ACTION_OPTIONS;
+};
+
+const RENEW_DATE_CELL_STATUS_CONFIG: IRenewDateCellStatusConfig = {
+  warning: {
+    tooltipText: (
+      <>
+        VPP content token is less than 30 days from expiration.
+        <br />
+        To renew, go to <b>Actions {">"} Renew</b>.
+      </>
+    ),
+  },
+  error: {
+    tooltipText: (
+      <>
+        VPP content token is expired.
+        <br />
+        To renew, go to <b>Actions {">"} Renew</b>.
+      </>
+    ),
+  },
+};
+
+export const generateTableConfig = (
+  actionSelectHandler: (value: string, team: IMdmVppToken) => void
+): IAbmTableConfig[] => {
+  return [
+    {
+      accessor: "org_name",
+      sortType: "caseInsensitive",
+      Header: (cellProps: ITableHeaderProps) => (
+        <HeaderCell
+          value="Organization name"
+          isSortedDesc={cellProps.column.isSortedDesc}
+        />
+      ),
+      Cell: (cellProps: ITableStringCellProps) => (
+        <TextCell value={cellProps.cell.value} />
+      ),
+    },
+    {
+      accessor: "location",
+      Header: "Location",
+      disableSortBy: true,
+      Cell: (cellProps: ITableStringCellProps) => (
+        <TextCell value={cellProps.cell.value} />
+      ),
+    },
+    {
+      accessor: "renew_date",
+      Header: "Renew date",
+      disableSortBy: true,
+      Cell: (cellProps: IRenewDateCellProps) => (
+        <RenewDateCell
+          value={cellProps.cell.value}
+          statusConfig={RENEW_DATE_CELL_STATUS_CONFIG}
+          className="vpp-renew-date-cell"
+        />
+      ),
+    },
+
+    {
+      accessor: "teams",
+      Header: "Teams",
+      disableSortBy: true,
+      Cell: (cellProps: ITeamsCellProps) => (
+        <TeamsCell teams={cellProps.cell.value} className="vpp-teams-cell" />
+      ),
+    },
+    {
+      Header: "",
+      disableSortBy: true,
+      // the accessor here is insignificant, we just need it as its required
+      // but we don't use it.
+      accessor: "id",
+      Cell: (cellProps) => (
+        <DropdownCell
+          options={generateActions()}
+          onChange={(value: string) =>
+            actionSelectHandler(value, cellProps.row.original)
+          }
+          placeholder="Actions"
+        />
+      ),
+    },
+  ];
+};
+
+export const generateTableData = (data: IMdmAbmToken[]) => {
+  return data;
+};
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/_styles.scss
new file mode 100644
index 000000000000..e60fe16747a2
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/_styles.scss
@@ -0,0 +1,20 @@
+.vpp-table {
+  // The desired behavior is to remove the location header and cell as the
+  // viewport gets smaller. This is achieved by using the max-width media query
+  // with the breakpoint value taken from when the table content starts to overflow.
+  @media (max-width: $break-md) {
+    .location__header,
+    .location__cell {
+      display: none;
+    }
+  }
+
+  // this is a special case where the org name cell is too long at smaller widths.
+  // We dont want to remove any more columns so we need to reduce the width of
+  // the org name cell content to prevent table content overflow.
+  @media (max-width: $break-sm) {
+    .org_name__cell > span {
+      width: 140px;
+    }
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/index.ts
new file mode 100644
index 000000000000..321386ec4f84
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/index.ts
@@ -0,0 +1 @@
+export { default } from "./VppTable";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/index.ts
new file mode 100644
index 000000000000..11d6ddfc4f90
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/index.ts
@@ -0,0 +1 @@
+export { default } from "./VppPage";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/WindowsAutomaticEnrollmentPage/WindowsAutomaticEnrollmentPage.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/WindowsAutomaticEnrollmentPage.tsx
similarity index 98%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/WindowsAutomaticEnrollmentPage/WindowsAutomaticEnrollmentPage.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/WindowsAutomaticEnrollmentPage.tsx
index 2397d0b83658..70e2ee636d1f 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/WindowsAutomaticEnrollmentPage/WindowsAutomaticEnrollmentPage.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/WindowsAutomaticEnrollmentPage.tsx
@@ -26,8 +26,8 @@ const WindowsAutomaticEnrollmentPage = () => {
     <MainContent className={baseClass}>
       <>
         <BackLink
-          text="Back to automatic enrollment"
-          path={PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT}
+          text="Back to MDM"
+          path={PATHS.ADMIN_INTEGRATIONS_MDM}
           className={`${baseClass}__back-to-automatic-enrollment`}
         />
         <h1>Azure Active Directory</h1>
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/WindowsAutomaticEnrollmentPage/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/_styles.scss
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/WindowsAutomaticEnrollmentPage/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/_styles.scss
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/WindowsAutomaticEnrollmentPage/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/WindowsAutomaticEnrollmentPage/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/_styles.scss
index a724544af216..a957eece068a 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/_styles.scss
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/_styles.scss
@@ -16,10 +16,4 @@
       max-width: initial;
     }
   }
-
-  &__mdm-section {
-    display: flex;
-    flex-direction: column;
-    gap: 40px;
-  }
 }
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/AppleAutomaticEnrollmentCard/AppleAutomaticEnrollmentCard.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/AppleAutomaticEnrollmentCard/AppleAutomaticEnrollmentCard.tsx
new file mode 100644
index 000000000000..69d2c65ad542
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/AppleAutomaticEnrollmentCard/AppleAutomaticEnrollmentCard.tsx
@@ -0,0 +1,68 @@
+import React from "react";
+
+import Card from "components/Card";
+import Button from "components/buttons/Button";
+import Icon from "components/Icon/Icon";
+
+const baseClass = "automatic-enrollment-card";
+
+interface IAppleAutomaticEnrollmentCardProps {
+  isAppleMdmOn: boolean;
+  viewDetails: () => void;
+  configured?: boolean;
+}
+
+const AppleAutomaticEnrollmentCard = ({
+  isAppleMdmOn,
+  viewDetails,
+  configured,
+}: IAppleAutomaticEnrollmentCardProps) => {
+  let icon = "";
+  let msg =
+    "To enable automatic enrollment for macOS, iOS, and iPadOS hosts, first turn on Apple MDM.";
+  if (isAppleMdmOn && !configured) {
+    msg =
+      "Add an Apple Business Manager (ABM) connection to automatically enroll newly " +
+      "purchased Apple hosts when they're first unboxed and set up by your end users.";
+  } else if (isAppleMdmOn && configured) {
+    msg = "Automatic enrollment for Apple (macOS, iOS, iPadOS) is enabled.";
+    icon = "success";
+  }
+
+  return (
+    <Card className={baseClass} color="gray">
+      <div>
+        {!icon && (
+          <h3>Automatic enrollment for Apple (macOS, iOS, iPadOS) hosts.</h3>
+        )}
+        <p>
+          {icon ? (
+            <span>
+              <Icon name="success" />
+              {msg}
+            </span>
+          ) : (
+            msg
+          )}
+        </p>
+      </div>
+      {isAppleMdmOn && !configured && (
+        <Button
+          className="add-abm-button"
+          onClick={viewDetails}
+          variant="brand"
+        >
+          Add ABM
+        </Button>
+      )}
+      {isAppleMdmOn && configured && (
+        <Button onClick={viewDetails} variant="text-icon">
+          <Icon name="pencil" />
+          Edit
+        </Button>
+      )}
+    </Card>
+  );
+};
+
+export default AppleAutomaticEnrollmentCard;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/components/AppleAutomaticEnrollmentCard/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/AppleAutomaticEnrollmentCard/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/components/AppleAutomaticEnrollmentCard/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/AppleAutomaticEnrollmentCard/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/AutomaticEnrollmentSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/AutomaticEnrollmentSection.tsx
new file mode 100644
index 000000000000..5badb918e587
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/AutomaticEnrollmentSection.tsx
@@ -0,0 +1,54 @@
+import React, { useContext } from "react";
+import { InjectedRouter } from "react-router";
+import PATHS from "router/paths";
+
+import { AppContext } from "context/app";
+
+import PremiumFeatureMessage from "components/PremiumFeatureMessage";
+import SettingsSection from "pages/admin/components/SettingsSection";
+
+import AppleAutomaticEnrollmentCard from "./AppleAutomaticEnrollmentCard";
+import WindowsAutomaticEnrollmentCard from "./WindowsAutomaticEnrollmentCard";
+
+const baseClass = "automatic-enrollment-section";
+
+interface IAutomaticEnrollmentSectionProps {
+  router: InjectedRouter;
+  isPremiumTier: boolean;
+}
+
+const AutomaticEnrollmentSection = ({
+  router,
+  isPremiumTier,
+}: IAutomaticEnrollmentSectionProps) => {
+  const { config } = useContext(AppContext);
+
+  const navigateToWindowsAutomaticEnrollment = () => {
+    router.push(PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT_WINDOWS);
+  };
+
+  const navigateToAppleAutomaticEnrollment = () => {
+    router.push(PATHS.ADMIN_INTEGRATIONS_APPLE_BUSINESS_MANAGER);
+  };
+
+  return (
+    <SettingsSection title="Automatic Enrollment" className={baseClass}>
+      {!isPremiumTier ? (
+        <PremiumFeatureMessage alignment="left" />
+      ) : (
+        <div className={`${baseClass}__content`}>
+          <AppleAutomaticEnrollmentCard
+            viewDetails={navigateToAppleAutomaticEnrollment}
+            isAppleMdmOn={!!config?.mdm.enabled_and_configured}
+            configured={!!config?.mdm.apple_bm_enabled_and_configured}
+          />
+          <WindowsAutomaticEnrollmentCard
+            viewDetails={navigateToWindowsAutomaticEnrollment}
+          />
+        </div>
+      )}
+    </SettingsSection>
+  );
+};
+
+export default AutomaticEnrollmentSection;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/components/WindowsAutomaticEnrollmentCard/WindowsAutomaticEnrollmentCard.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/WindowsAutomaticEnrollmentCard/WindowsAutomaticEnrollmentCard.tsx
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/components/WindowsAutomaticEnrollmentCard/WindowsAutomaticEnrollmentCard.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/WindowsAutomaticEnrollmentCard/WindowsAutomaticEnrollmentCard.tsx
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/components/WindowsAutomaticEnrollmentCard/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/WindowsAutomaticEnrollmentCard/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/components/WindowsAutomaticEnrollmentCard/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/WindowsAutomaticEnrollmentCard/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/_styles.scss
new file mode 100644
index 000000000000..d1a74a4e63db
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/_styles.scss
@@ -0,0 +1,36 @@
+.automatic-enrollment-section {
+  &__content {
+    display: flex;
+    flex-direction: column;
+    gap: $pad-xxlarge;
+
+    // styles for the apple and windows automatic enrollment cards.
+    .automatic-enrollment-card {
+      font-size: $x-small;
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+      gap: $pad-medium;
+
+      h3 {
+        font-size: $x-small;
+        font-weight: $bold;
+        margin: 0 0 $pad-xsmall;
+      }
+
+      p {
+        margin: 0;
+
+        span {
+          display: flex;
+          align-items: center;
+          gap: $pad-small;
+        }
+      }
+
+      .add-abm-button {
+        white-space: nowrap;
+      }
+    }
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/index.ts
new file mode 100644
index 000000000000..45ccdee57c20
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/index.ts
@@ -0,0 +1 @@
+export { default } from "./AutomaticEnrollmentSection";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EndUserMigrationSection/EndUserMigrationSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EndUserMigrationSection/EndUserMigrationSection.tsx
index 8e4eac52e7e8..7b9cc54164c9 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EndUserMigrationSection/EndUserMigrationSection.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EndUserMigrationSection/EndUserMigrationSection.tsx
@@ -21,6 +21,7 @@ import Button from "components/buttons/Button/Button";
 import SectionHeader from "components/SectionHeader";
 import PremiumFeatureMessage from "components/PremiumFeatureMessage/PremiumFeatureMessage";
 import EmptyTable from "components/EmptyTable/EmptyTable";
+import SettingsSection from "pages/admin/components/SettingsSection";
 
 import ExampleWebhookUrlPayloadModal from "../ExampleWebhookUrlPayloadModal/ExampleWebhookUrlPayloadModal";
 
@@ -78,7 +79,7 @@ const EndUserMigrationSection = ({ router }: IEndUserMigrationSectionProps) => {
   };
 
   const onClickConnect = () => {
-    router.push(PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT);
+    router.push(PATHS.ADMIN_INTEGRATIONS_MDM);
   };
 
   const onChangeMode = (mode: string) => {
@@ -159,14 +160,9 @@ const EndUserMigrationSection = ({ router }: IEndUserMigrationSectionProps) => {
   }
 
   return (
-    <div className={baseClass}>
-      <SectionHeader title="End user migration workflow" />
+    <SettingsSection className={baseClass} title="End user migration workflow">
       <form>
-        <p>
-          Control the end user migration workflow for macOS hosts that
-          automatically enrolled to your old MDM solution.
-        </p>
-
+        <p>Control the end user migration workflow for macOS hosts.</p>
         <img
           src={MdmMigrationPreview}
           alt="end user migration preview"
@@ -240,7 +236,7 @@ const EndUserMigrationSection = ({ router }: IEndUserMigrationSectionProps) => {
       {showExamplePayload && (
         <ExampleWebhookUrlPayloadModal onCancel={toggleExamplePayloadModal} />
       )}
-    </div>
+    </SettingsSection>
   );
 };
 
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/EulaSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/EulaSection.tsx
new file mode 100644
index 000000000000..bf6f632eeb84
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/EulaSection.tsx
@@ -0,0 +1,73 @@
+import React, { useContext, useState } from "react";
+import { useQuery } from "react-query";
+import { AxiosResponse } from "axios";
+
+import { IApiError } from "interfaces/errors";
+import mdmAPI, { IEulaMetadataResponse } from "services/entities/mdm";
+import { NotificationContext } from "context/notification";
+
+import Spinner from "components/Spinner";
+import SettingsSection from "pages/admin/components/SettingsSection";
+
+import EulaUploader from "./components/EulaUploader/EulaUploader";
+import UploadedEulaView from "./components/UploadedEulaView/UploadedEulaView";
+import DeleteEulaModal from "./components/DeleteEulaModal/DeleteEulaModal";
+
+const baseClass = "eula-section";
+
+interface IEulaSectionProps {
+  eulaMetadata?: IEulaMetadataResponse;
+  isEulaUploaded: boolean;
+  onUpload: () => void;
+  onDelete: () => void;
+}
+
+const EulaSection = ({
+  eulaMetadata,
+  isEulaUploaded,
+  onUpload,
+  onDelete,
+}: IEulaSectionProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+  const [showDeleteEulaModal, setShowDeleteEulaModal] = useState(false);
+
+  const onDeleteEula = async () => {
+    if (!eulaMetadata) return;
+
+    try {
+      await mdmAPI.deleteEULA(eulaMetadata.token);
+      renderFlash("success", "Successfully deleted!");
+    } catch {
+      renderFlash("error", "Couldn’t delete. Please try again.");
+    } finally {
+      setShowDeleteEulaModal(false);
+      onDelete();
+    }
+  };
+
+  return (
+    <SettingsSection
+      className={baseClass}
+      title="End user license agreement (EULA)"
+    >
+      <div className={`${baseClass}__content`}>
+        {!isEulaUploaded || !eulaMetadata ? (
+          <EulaUploader onUpload={onUpload} />
+        ) : (
+          <UploadedEulaView
+            eulaMetadata={eulaMetadata}
+            onDelete={() => setShowDeleteEulaModal(true)}
+          />
+        )}
+      </div>
+      {showDeleteEulaModal && (
+        <DeleteEulaModal
+          onDelete={onDeleteEula}
+          onCancel={() => setShowDeleteEulaModal(false)}
+        />
+      )}
+    </SettingsSection>
+  );
+};
+
+export default EulaSection;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/DeleteEulaModal/DeleteEulaModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/DeleteEulaModal/DeleteEulaModal.tsx
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/DeleteEulaModal/DeleteEulaModal.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/DeleteEulaModal/DeleteEulaModal.tsx
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/DeleteEulaModal/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/DeleteEulaModal/_styles.scss
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/DeleteEulaModal/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/DeleteEulaModal/_styles.scss
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/DeleteEulaModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/DeleteEulaModal/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/DeleteEulaModal/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/DeleteEulaModal/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaListItem/EulaListItem.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaListItem/EulaListItem.tsx
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaListItem/EulaListItem.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaListItem/EulaListItem.tsx
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaListItem/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaListItem/_styles.scss
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaListItem/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaListItem/_styles.scss
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaListItem/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaListItem/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaListItem/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaListItem/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaUploader/EulaUploader.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/EulaUploader.tsx
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaUploader/EulaUploader.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/EulaUploader.tsx
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaUploader/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/_styles.scss
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaUploader/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/_styles.scss
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaUploader/helpers.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/helpers.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaUploader/helpers.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/helpers.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaUploader/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaUploader/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/UploadedEulaView/UploadedEulaView.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/UploadedEulaView/UploadedEulaView.tsx
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/UploadedEulaView/UploadedEulaView.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/UploadedEulaView/UploadedEulaView.tsx
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/UploadedEulaView/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/UploadedEulaView/_styles.scss
new file mode 100644
index 000000000000..fb74a0eb4279
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/UploadedEulaView/_styles.scss
@@ -0,0 +1,6 @@
+.uploaded-eula-view {
+
+  > p {
+    font-size: $x-small;
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/UploadedEulaView/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/UploadedEulaView/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/UploadedEulaView/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/UploadedEulaView/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/IdpSection/IdpSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/IdpSection/IdpSection.tsx
similarity index 96%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/IdpSection/IdpSection.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/IdpSection/IdpSection.tsx
index 5889ec50af5d..a3f50e6e2f79 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/IdpSection/IdpSection.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/IdpSection/IdpSection.tsx
@@ -7,11 +7,11 @@ import configAPI from "services/entities/config";
 import InputField from "components/forms/fields/InputField";
 import CustomLink from "components/CustomLink/CustomLink";
 import Button from "components/buttons/Button/Button";
-import SectionHeader from "components/SectionHeader";
 import validateUrl from "components/forms/validators/valid_url";
 import ReactTooltip from "react-tooltip";
 import { NotificationContext } from "context/notification";
 import { AppContext } from "context/app";
+import SettingsSection from "pages/admin/components/SettingsSection";
 
 const baseClass = "idp-section";
 
@@ -74,8 +74,7 @@ const IdpSection = () => {
   };
 
   return (
-    <div className={baseClass}>
-      <SectionHeader title="End user authentication" />
+    <SettingsSection className={baseClass} title="End user authentication">
       <form>
         <p>
           Connect Fleet to your identity provider to require end users to
@@ -130,7 +129,7 @@ const IdpSection = () => {
           Complete all fields to save end user authentication.
         </ReactTooltip>
       </form>
-    </div>
+    </SettingsSection>
   );
 };
 
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/IdpSection/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/IdpSection/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/IdpSection/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/IdpSection/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MacOSMdmCard/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MacOSMdmCard/index.ts
deleted file mode 100644
index c49eac27ed21..000000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MacOSMdmCard/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./MacOSMdmCard";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MacOSMdmCard/MacOSMdmCard.tests.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/AppleMdmCard.tests.tsx
similarity index 55%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MacOSMdmCard/MacOSMdmCard.tests.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/AppleMdmCard.tests.tsx
index 06042587cc65..0ff7ece81d3b 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MacOSMdmCard/MacOSMdmCard.tests.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/AppleMdmCard.tests.tsx
@@ -5,41 +5,45 @@ import { render, screen } from "@testing-library/react";
 import createMockMdmApple from "__mocks__/appleMdm";
 import createMockAxiosError from "__mocks__/axiosError";
 
-import MacOSMdmCard from "./MacOSMdmCard";
+import AppleMdmCard from "./AppleMdmCard";
 
-describe("MacOSMdmCard", () => {
-  it("renders the turn on macOs mdm state when there is no appleAPNInfo", () => {
+describe("AppleMdmCard", () => {
+  it("renders the turn on Apple mdm state when there is no appleAPNInfo", () => {
     render(
-      <MacOSMdmCard
-        appleAPNInfo={undefined}
+      <AppleMdmCard
+        appleAPNSInfo={undefined}
         errorData={null}
-        turnOnMacOSMdm={noop}
+        turnOnAppleMdm={noop}
         viewDetails={noop}
       />
     );
 
-    expect(screen.getByText("Turn on macOS MDM")).toBeInTheDocument();
+    expect(
+      screen.getByText("Turn on Apple (macOS, iOS, iPadOS) MDM")
+    ).toBeInTheDocument();
   });
 
   it("renders the show details state when there is appleAPNInfo", () => {
     render(
-      <MacOSMdmCard
-        appleAPNInfo={createMockMdmApple()}
+      <AppleMdmCard
+        appleAPNSInfo={createMockMdmApple()}
         errorData={null}
-        turnOnMacOSMdm={noop}
+        turnOnAppleMdm={noop}
         viewDetails={noop}
       />
     );
 
-    expect(screen.getByText("macOS MDM turned on")).toBeInTheDocument();
+    expect(
+      screen.getByText("Apple (macOS, iOS, iPadOS) MDM turned on.")
+    ).toBeInTheDocument();
   });
 
   it("renders the error state when there is a non 404 error", () => {
     render(
-      <MacOSMdmCard
-        appleAPNInfo={createMockMdmApple()}
+      <AppleMdmCard
+        appleAPNSInfo={createMockMdmApple()}
         errorData={createMockAxiosError({ status: 500 })}
-        turnOnMacOSMdm={noop}
+        turnOnAppleMdm={noop}
         viewDetails={noop}
       />
     );
@@ -47,10 +51,10 @@ describe("MacOSMdmCard", () => {
     expect(screen.getByText(/Something's gone wrong/)).toBeInTheDocument();
 
     render(
-      <MacOSMdmCard
-        appleAPNInfo={createMockMdmApple()}
+      <AppleMdmCard
+        appleAPNSInfo={createMockMdmApple()}
         errorData={createMockAxiosError({ status: 404 })}
-        turnOnMacOSMdm={noop}
+        turnOnAppleMdm={noop}
         viewDetails={noop}
       />
     );
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MacOSMdmCard/MacOSMdmCard.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/AppleMdmCard.tsx
similarity index 64%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MacOSMdmCard/MacOSMdmCard.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/AppleMdmCard.tsx
index 5eb5d014cafc..ebfebcfb445a 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MacOSMdmCard/MacOSMdmCard.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/AppleMdmCard.tsx
@@ -7,17 +7,17 @@ import DataError from "components/DataError";
 import { AxiosError } from "axios";
 import { IMdmApple } from "interfaces/mdm";
 
-const baseClass = "mac-os-mdm-card";
+const baseClass = "apple-mdm-card";
 
-interface ITurnOnMacOSMdmProps {
+interface ITurnOnAppleMdmProps {
   onClickTurnOn: () => void;
 }
 
-const TurnOnMacOSMdm = ({ onClickTurnOn }: ITurnOnMacOSMdmProps) => {
+const TurnOnAppleMdm = ({ onClickTurnOn }: ITurnOnAppleMdmProps) => {
   return (
-    <div className={`${baseClass}__turn-on-mac-os`}>
+    <div className={`${baseClass}__turn-on-apple-mdm`}>
       <div>
-        <h3>Turn on macOS MDM</h3>
+        <h3>Turn on Apple (macOS, iOS, iPadOS) MDM</h3>
         <p>Enforce settings, OS updates, disk encryption, and more.</p>
       </div>
       <Button variant="brand" onClick={onClickTurnOn}>
@@ -27,16 +27,16 @@ const TurnOnMacOSMdm = ({ onClickTurnOn }: ITurnOnMacOSMdmProps) => {
   );
 };
 
-interface ITurnOffMacOSMdmProps {
+interface ITurnOffAppleMdmProps {
   onClickDetails: () => void;
 }
 
-const SeeDetailsMacOSMdm = ({ onClickDetails }: ITurnOffMacOSMdmProps) => {
+const SeeDetailsAppleMdm = ({ onClickDetails }: ITurnOffAppleMdmProps) => {
   return (
     <div className={`${baseClass}__turn-off-mac-os`}>
       <div>
         <Icon name="success" />
-        <p>macOS MDM turned on</p>
+        <p>Apple (macOS, iOS, iPadOS) MDM turned on.</p>
       </div>
       <Button onClick={onClickDetails} variant="text-icon">
         <Icon name="pencil" />
@@ -46,25 +46,25 @@ const SeeDetailsMacOSMdm = ({ onClickDetails }: ITurnOffMacOSMdmProps) => {
   );
 };
 
-interface IMacOSMdmCardProps {
-  appleAPNInfo: IMdmApple | undefined;
+interface IAppleMdmCardProps {
+  appleAPNSInfo: IMdmApple | undefined;
   errorData: AxiosError | null;
-  turnOnMacOSMdm: () => void;
+  turnOnAppleMdm: () => void;
   viewDetails: () => void;
 }
 
 /**
- * This compoent is responsible for showing the correct UI for the macOS MDM card.
+ * This component is responsible for showing the correct UI for the Apple MDM card.
  * We pass in the appleAPNInfo and errorData from the MdmSettings component because
  * we need to make that API call higher up in the component tree to correctly show
  * loading states on the page.
  */
-const MacOSMdmCard = ({
-  appleAPNInfo,
+const AppleMdmCard = ({
+  appleAPNSInfo,
   errorData,
-  turnOnMacOSMdm,
+  turnOnAppleMdm,
   viewDetails,
-}: IMacOSMdmCardProps) => {
+}: IAppleMdmCardProps) => {
   // The API returns an error if MDM is turned off or APNS is not configured yet.
   // If there is any other error we will show the DataError component.
   const showError =
@@ -76,13 +76,13 @@ const MacOSMdmCard = ({
 
   return (
     <Card className={baseClass} color="gray">
-      {appleAPNInfo !== undefined ? (
-        <SeeDetailsMacOSMdm onClickDetails={viewDetails} />
+      {appleAPNSInfo !== undefined ? (
+        <SeeDetailsAppleMdm onClickDetails={viewDetails} />
       ) : (
-        <TurnOnMacOSMdm onClickTurnOn={turnOnMacOSMdm} />
+        <TurnOnAppleMdm onClickTurnOn={turnOnAppleMdm} />
       )}
     </Card>
   );
 };
 
-export default MacOSMdmCard;
+export default AppleMdmCard;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MacOSMdmCard/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/_styles.scss
similarity index 89%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MacOSMdmCard/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/_styles.scss
index 53ee9f0ab91d..a335e512232c 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MacOSMdmCard/_styles.scss
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/_styles.scss
@@ -1,11 +1,11 @@
-.mac-os-mdm-card {
+.apple-mdm-card {
   font-size: $x-small;
 
   p {
     margin: 0;
   }
 
-  &__turn-on-mac-os,
+  &__turn-on-apple-mdm,
   &__turn-off-mac-os {
     display: flex;
     justify-content: space-between;
@@ -22,7 +22,7 @@
     }
   }
 
-  &__turn-on-mac-os {
+  &__turn-on-apple-mdm {
     h3 {
       font-size: $x-small;
       font-weight: $bold;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/index.ts
new file mode 100644
index 000000000000..a9fded1c4338
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/index.ts
@@ -0,0 +1 @@
+export { default } from "./AppleMdmCard";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/MdmSettingsSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/MdmSettingsSection.tsx
new file mode 100644
index 000000000000..c845eec181fe
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/MdmSettingsSection.tsx
@@ -0,0 +1,75 @@
+import React from "react";
+import { InjectedRouter } from "react-router";
+import { AxiosError } from "axios";
+
+import PATHS from "router/paths";
+import { IMdmApple } from "interfaces/mdm";
+
+import Spinner from "components/Spinner";
+import DataError from "components/DataError";
+import SettingsSection from "pages/admin/components/SettingsSection";
+
+import AppleMdmCard from "./AppleMdmCard";
+import WindowsMdmCard from "./WindowsMdmCard";
+
+const baseClass = "mdm-settings-section";
+
+interface IMdmSectionProps {
+  isLoading: boolean;
+  isError: boolean;
+  appleAPNSError: AxiosError | null;
+  router: InjectedRouter;
+  appleAPNSInfo?: IMdmApple;
+}
+
+const MdmSettingsSection = ({
+  isLoading,
+  isError,
+  appleAPNSError,
+  router,
+  appleAPNSInfo,
+}: IMdmSectionProps) => {
+  const navigateToAppleMdm = () => {
+    router.push(PATHS.ADMIN_INTEGRATIONS_MDM_APPLE);
+  };
+
+  const navigateToWindowsMdm = () => {
+    router.push(PATHS.ADMIN_INTEGRATIONS_MDM_WINDOWS);
+  };
+
+  const renderContent = () => {
+    if (isLoading) {
+      return <Spinner />;
+    }
+
+    if (isError) {
+      return <DataError />;
+    }
+
+    return (
+      <div className={`${baseClass}__content`}>
+        <AppleMdmCard
+          appleAPNSInfo={appleAPNSInfo}
+          errorData={appleAPNSError}
+          turnOnAppleMdm={navigateToAppleMdm}
+          viewDetails={navigateToAppleMdm}
+        />
+        <WindowsMdmCard
+          turnOnWindowsMdm={navigateToWindowsMdm}
+          editWindowsMdm={navigateToWindowsMdm}
+        />
+      </div>
+    );
+  };
+
+  return (
+    <SettingsSection
+      title="Mobile device management (MDM)"
+      className={baseClass}
+    >
+      {renderContent()}
+    </SettingsSection>
+  );
+};
+
+export default MdmSettingsSection;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/WindowsMdmCard/WindowsMdmCard.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/WindowsMdmCard/WindowsMdmCard.tsx
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/WindowsMdmCard/WindowsMdmCard.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/WindowsMdmCard/WindowsMdmCard.tsx
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/WindowsMdmCard/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/WindowsMdmCard/_styles.scss
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/WindowsMdmCard/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/WindowsMdmCard/_styles.scss
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/WindowsMdmCard/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/WindowsMdmCard/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/WindowsMdmCard/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/WindowsMdmCard/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/_styles.scss
new file mode 100644
index 000000000000..60dd8e6136d7
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/_styles.scss
@@ -0,0 +1,8 @@
+.mdm-settings-section {
+
+  &__content {
+    display: flex;
+    flex-direction: column;
+    gap: 40px;
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/index.ts
new file mode 100644
index 000000000000..822a78c2abda
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/index.ts
@@ -0,0 +1 @@
+export { default } from "./MdmSettingsSection";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/RenewDateCell/RenewDateCell.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/RenewDateCell/RenewDateCell.tsx
new file mode 100644
index 000000000000..be5f5b7990dd
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/RenewDateCell/RenewDateCell.tsx
@@ -0,0 +1,68 @@
+import React, { ReactNode } from "react";
+import classnames from "classnames";
+
+import StatusIndicator from "components/StatusIndicator";
+
+import { monthDayYearFormat } from "utilities/date_format";
+import { hasLicenseExpired, willExpireWithinXDays } from "utilities/helpers";
+import { IIndicatorValue } from "components/StatusIndicator/StatusIndicator";
+
+const baseClass = "renew-date-cell";
+
+export type IRenewDateCellStatusConfig = Record<
+  Exclude<IIndicatorValue, "indeterminate" | "success">,
+  {
+    tooltipText: ReactNode;
+  }
+>;
+
+interface IRenewDateCellProps {
+  value: string;
+  /**
+   * `statusConfig` currently this allows us to dynamically change the tooltip
+   * text depending on the status of the date. Can be extended later if needed.
+   */
+  statusConfig: IRenewDateCellStatusConfig;
+  className?: string;
+}
+
+const RenewDateCell = ({
+  value,
+  statusConfig,
+  className,
+}: IRenewDateCellProps) => {
+  const formattedDate = monthDayYearFormat(value);
+
+  // "w250" is a utility class that sets the width the the same as
+  // the other text cells in the table.
+  // TODO: consider creating a generic StatusIndicatorCell component that
+  // take in a value, a desired status to display and, can contain these
+  // table cell styles.
+  const classNames = classnames(baseClass, className, "w250");
+
+  let indicatorStatus: Exclude<IIndicatorValue, "indeterminate"> = "success";
+  let tooltipText: ReactNode = null;
+
+  if (willExpireWithinXDays(value, 30)) {
+    indicatorStatus = "warning";
+  } else if (hasLicenseExpired(value)) {
+    indicatorStatus = "error";
+  }
+
+  if (indicatorStatus !== "success") {
+    tooltipText = statusConfig[indicatorStatus].tooltipText;
+  }
+
+  const tooltipProp = tooltipText ? { tooltipText } : undefined;
+
+  return (
+    <StatusIndicator
+      className={classNames}
+      value={formattedDate}
+      indicator={indicatorStatus}
+      tooltip={tooltipProp}
+    />
+  );
+};
+
+export default RenewDateCell;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/RenewDateCell/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/RenewDateCell/index.ts
new file mode 100644
index 000000000000..6a678382f30f
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/RenewDateCell/index.ts
@@ -0,0 +1 @@
+export { default } from "./RenewDateCell";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/VppSection.tests.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/VppSection.tests.tsx
new file mode 100644
index 000000000000..1c95cb0310ae
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/VppSection.tests.tsx
@@ -0,0 +1,106 @@
+import React from "react";
+import { screen } from "@testing-library/react";
+
+import { createCustomRenderer, createMockRouter } from "test/test-utils";
+import mockServer from "test/mock-server";
+import {
+  defaultVppInfoHandler,
+  errorNoVppInfoHandler,
+} from "test/handlers/apple_mdm";
+import createMockConfig, { createMockMdmConfig } from "__mocks__/configMock";
+
+import VppSection from "./VppSection";
+
+describe("Vpp Section", () => {
+  it("renders mdm is off message when apple mdm is not turned on ", async () => {
+    mockServer.use(defaultVppInfoHandler);
+
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          config: createMockConfig({
+            mdm: createMockMdmConfig({ enabled_and_configured: false }),
+          }),
+        },
+      },
+      withBackendMock: true,
+    });
+
+    render(
+      <VppSection router={createMockRouter()} isVppOn={false} isPremiumTier />
+    );
+
+    expect(
+      await screen.findByText(
+        "To enable Volume Purchasing Program (VPP), first turn on Apple (macOS, iOS, iPadOS) MDM."
+      )
+    ).toBeInTheDocument();
+  });
+
+  it("renders add vpp when vpp is disabled", async () => {
+    mockServer.use(errorNoVppInfoHandler);
+
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          config: createMockConfig({
+            mdm: createMockMdmConfig({ enabled_and_configured: true }),
+          }),
+        },
+      },
+      withBackendMock: true,
+    });
+
+    render(
+      <VppSection router={createMockRouter()} isVppOn={false} isPremiumTier />
+    );
+
+    expect(
+      await screen.findByRole("button", { name: "Add VPP" })
+    ).toBeInTheDocument();
+  });
+
+  it("renders edit vpp when vpp is enabled", async () => {
+    mockServer.use(defaultVppInfoHandler);
+
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          config: createMockConfig({
+            mdm: createMockMdmConfig({ enabled_and_configured: true }),
+          }),
+        },
+      },
+      withBackendMock: true,
+    });
+    render(<VppSection router={createMockRouter()} isVppOn isPremiumTier />);
+    expect(
+      await screen.findByRole("button", { name: "Edit" })
+    ).toBeInTheDocument();
+  });
+
+  it("render the premium message when not in premium tier", async () => {
+    mockServer.use(defaultVppInfoHandler);
+
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          config: createMockConfig({
+            mdm: createMockMdmConfig({ enabled_and_configured: true }),
+          }),
+        },
+      },
+      withBackendMock: true,
+    });
+    render(
+      <VppSection
+        router={createMockRouter()}
+        isVppOn={false}
+        isPremiumTier={false}
+      />
+    );
+    expect(
+      await screen.findByText("This feature is included in Fleet Premium.")
+    ).toBeInTheDocument();
+  });
+});
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/VppSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/VppSection.tsx
new file mode 100644
index 000000000000..afcd3af3c213
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/VppSection.tsx
@@ -0,0 +1,126 @@
+import React, { useContext } from "react";
+import { InjectedRouter } from "react-router";
+import { useQuery } from "react-query";
+import { AxiosError } from "axios";
+
+import PATHS from "router/paths";
+import { AppContext } from "context/app";
+import mdmAppleAPI, { IGetVppInfoResponse } from "services/entities/mdm_apple";
+import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
+
+import Card from "components/Card";
+import Button from "components/buttons/Button";
+import Icon from "components/Icon";
+import Spinner from "components/Spinner";
+import DataError from "components/DataError";
+import SettingsSection from "pages/admin/components/SettingsSection";
+import PremiumFeatureMessage from "components/PremiumFeatureMessage";
+
+const baseClass = "vpp-section";
+
+interface IVppCardProps {
+  isAppleMdmOn: boolean;
+  isVppOn: boolean;
+  router: InjectedRouter;
+}
+
+const VppCard = ({ isAppleMdmOn, isVppOn, router }: IVppCardProps) => {
+  const navigateToVppSetup = () => {
+    router.push(PATHS.ADMIN_INTEGRATIONS_VPP_SETUP);
+  };
+
+  const appleMdmDiabledContent = (
+    <div className={`${baseClass}__mdm-disabled-content`}>
+      <div>
+        <h3>Volume Purchasing Program (VPP)</h3>
+        <p>
+          To enable Volume Purchasing Program (VPP), first turn on Apple (macOS,
+          iOS, iPadOS) MDM.
+        </p>
+      </div>
+    </div>
+  );
+
+  const isVppOnContent = (
+    <div className={`${baseClass}__vpp-on-content`}>
+      <p>
+        <span>
+          <Icon name="success" />
+          Volume Purchasing Program (VPP) is enabled.
+        </span>
+      </p>
+      <Button onClick={navigateToVppSetup} variant="text-icon">
+        <Icon name="pencil" />
+        Edit
+      </Button>
+    </div>
+  );
+
+  const isVppOffContent = (
+    <div className={`${baseClass}__vpp-off-content`}>
+      <div>
+        <h3>Volume Purchasing Program (VPP)</h3>
+        <p>
+          Add a VPP connection to install Apple App Store apps purchased through
+          Apple Business Manager.
+        </p>
+      </div>
+      <Button
+        className={`${baseClass}__add-vpp-button`}
+        onClick={navigateToVppSetup}
+        variant="brand"
+      >
+        Add VPP
+      </Button>
+    </div>
+  );
+
+  const renderCardContent = () => {
+    if (!isAppleMdmOn) {
+      return appleMdmDiabledContent;
+    }
+
+    return isVppOn ? isVppOnContent : isVppOffContent;
+  };
+
+  return (
+    <Card className={`${baseClass}__card`} color="gray">
+      {renderCardContent()}
+    </Card>
+  );
+};
+
+interface IVppSectionProps {
+  router: InjectedRouter;
+  isVppOn: boolean;
+  isPremiumTier: boolean;
+}
+
+const VppSection = ({ router, isVppOn, isPremiumTier }: IVppSectionProps) => {
+  const { config } = useContext(AppContext);
+
+  const renderContent = () => {
+    if (!isPremiumTier) {
+      return <PremiumFeatureMessage alignment="left" />;
+    }
+
+    return (
+      <VppCard
+        isAppleMdmOn={!!config?.mdm.enabled_and_configured}
+        isVppOn={isVppOn}
+        router={router}
+      />
+    );
+  };
+
+  return (
+    <SettingsSection
+      title="Volume Purchasing Program (VPP)"
+      className={baseClass}
+    >
+      <>{renderContent()}</>
+    </SettingsSection>
+  );
+};
+
+export default VppSection;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/_styles.scss
new file mode 100644
index 000000000000..9cbe7e0e6372
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/_styles.scss
@@ -0,0 +1,51 @@
+.vpp-section {
+
+  // TODO: this is very similar to the Apple Mdm card, consider pulling out
+  // into a shared component if we do this pattern one more time.
+  &__card {
+
+    h3 {
+      font-size: $x-small;
+      font-weight: $bold;
+      margin: 0 0 $pad-xsmall;
+    }
+
+    p {
+      margin: 0;
+
+      span {
+        display: flex;
+        align-items: center;
+        gap: $pad-small;
+      }
+    }
+
+    &__turn-on-mdm {
+      flex-direction: column;
+      align-items: flex-start;
+      gap: $pad-medium;
+
+      .button {
+        height: auto;
+      }
+    }
+  }
+
+  &__mdm-disabled-content {
+    display: flex;
+    flex-direction: column;
+    align-items: flex-start;
+    gap: $pad-medium;
+  }
+
+  &__vpp-on-content, &__vpp-off-content {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    gap: $pad-medium;
+  }
+
+  &__add-vpp-button {
+    white-space: nowrap;
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/index.ts
new file mode 100644
index 000000000000..656c50cfa669
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/index.ts
@@ -0,0 +1 @@
+export { default } from "./VppSection";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/index.ts
new file mode 100644
index 000000000000..06899675d093
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/index.ts
@@ -0,0 +1 @@
+export { default } from "./MdmSettings";
diff --git a/frontend/pages/admin/OrgSettingsPage/OrgSettingsPage.tsx b/frontend/pages/admin/OrgSettingsPage/OrgSettingsPage.tsx
index f0afb86a75d1..6e3aa637e7ae 100644
--- a/frontend/pages/admin/OrgSettingsPage/OrgSettingsPage.tsx
+++ b/frontend/pages/admin/OrgSettingsPage/OrgSettingsPage.tsx
@@ -77,21 +77,23 @@ const OrgSettingsPage = ({ params, router }: IOrgSettingsPageProps) => {
               "Could not connect to SMTP server. Please try again."
             );
           } else if (response?.data.errors) {
+            const reason = response?.data.errors[0].reason;
             const agentOptionsInvalid =
-              response.data.errors[0].reason.includes(
-                "unsupported key provided"
-              ) ||
-              response.data.errors[0].reason.includes("invalid value type");
-
+              reason.includes("unsupported key provided") ||
+              reason.includes("invalid value type");
+            const isAgentOptionsError =
+              agentOptionsInvalid ||
+              reason.includes("script_execution_timeout' value exceeds limit.");
             renderFlash(
               "error",
               <>
-                Could not update settings. {response.data.errors[0].reason}
+                Couldn&apos;t update{" "}
+                {isAgentOptionsError ? "agent options" : "settings"}: {reason}
                 {agentOptionsInvalid && (
                   <>
                     <br />
-                    If you’re not using the latest osquery, use the fleetctl
-                    apply --force command to override validation.
+                    If you&apos;re not using the latest osquery, use the
+                    fleetctl apply --force command to override validation.
                   </>
                 )}
               </>
diff --git a/frontend/pages/admin/OrgSettingsPage/cards/Smtp/Smtp.tsx b/frontend/pages/admin/OrgSettingsPage/cards/Smtp/Smtp.tsx
index cd1a7ebe103f..d1f6160a5b1c 100644
--- a/frontend/pages/admin/OrgSettingsPage/cards/Smtp/Smtp.tsx
+++ b/frontend/pages/admin/OrgSettingsPage/cards/Smtp/Smtp.tsx
@@ -1,6 +1,9 @@
 import React, { useState, useEffect, useContext } from "react";
 
 import { AppContext } from "context/app";
+
+import { CONTACT_FLEET_LINK } from "utilities/constants";
+
 import Button from "components/buttons/Button";
 import Checkbox from "components/forms/fields/Checkbox";
 // @ts-ignore
@@ -188,11 +191,7 @@ const Smtp = ({
       <>
         To configure SMTP,{" "}
         <CustomLink
-          url={
-            isPremiumTier
-              ? "https://fleetdm.com/contact"
-              : "https://fleetdm.com/slack"
-          }
+          url={isPremiumTier ? CONTACT_FLEET_LINK : "https://fleetdm.com/slack"}
           text="get help"
           newTab
         />
diff --git a/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/AgentOptionsPage/AgentOptionsPage.tsx b/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/AgentOptionsPage/AgentOptionsPage.tsx
index 96ca8708098a..97f1152ccd68 100644
--- a/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/AgentOptionsPage/AgentOptionsPage.tsx
+++ b/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/AgentOptionsPage/AgentOptionsPage.tsx
@@ -110,21 +110,21 @@ const AgentOptionsPage = ({
       })
       .catch((response: { data: IApiError }) => {
         console.error(response);
-
+        const reason = response.data.errors[0].reason;
         const agentOptionsInvalid =
-          response.data.errors[0].reason.includes("unsupported key provided") ||
-          response.data.errors[0].reason.includes("invalid value type");
+          reason.includes("unsupported key provided") ||
+          reason.includes("invalid value type");
 
         return renderFlash(
           "error",
           <>
-            Could not update {teamName} team agent options.{" "}
-            {response.data.errors[0].reason}
+            Couldn&apos;t update {teamName} team agent options:
+            {reason}
             {agentOptionsInvalid && (
               <>
                 <br />
-                If you’re not using the latest osquery, use the fleetctl apply
-                --force command to override validation.
+                If you&apos;re not using the latest osquery, use the fleetctl
+                apply --force command to override validation.
               </>
             )}
           </>
diff --git a/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/TeamDetailsWrapper.tsx b/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/TeamDetailsWrapper.tsx
index 90a3d609d929..dc7d191ec209 100644
--- a/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/TeamDetailsWrapper.tsx
+++ b/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/TeamDetailsWrapper.tsx
@@ -337,11 +337,18 @@ const TeamDetailsWrapper = ({
           setBackendValidators({
             name: "A team with this name already exists",
           });
+        } else if (errorObject.base.includes("all teams")) {
+          setBackendValidators({
+            name: `"All teams" is a reserved team name. Please try another name.`,
+          });
+        } else if (errorObject.base.includes("no team")) {
+          setBackendValidators({
+            name: `"No team" is a reserved team name. Please try another name.`,
+          });
         } else {
           renderFlash("error", "Could not create team. Please try again.");
         }
       } finally {
-        toggleRenameTeamModal();
         setIsUpdatingTeams(false);
       }
     },
diff --git a/frontend/pages/admin/TeamManagementPage/TeamManagementPage.tsx b/frontend/pages/admin/TeamManagementPage/TeamManagementPage.tsx
index 92bbec028043..7243f01eedd6 100644
--- a/frontend/pages/admin/TeamManagementPage/TeamManagementPage.tsx
+++ b/frontend/pages/admin/TeamManagementPage/TeamManagementPage.tsx
@@ -116,6 +116,14 @@ const TeamManagementPage = (): JSX.Element => {
             setBackendValidators({
               name: "A team with this name already exists",
             });
+          } else if (createError.data.errors[0].reason.includes("all teams")) {
+            setBackendValidators({
+              name: `"All teams" is a reserved team name. Please try another name.`,
+            });
+          } else if (createError.data.errors[0].reason.includes("no team")) {
+            setBackendValidators({
+              name: `"No team" is a reserved team name. Please try another name.`,
+            });
           } else {
             renderFlash("error", "Could not create team. Please try again.");
             toggleCreateTeamModal();
@@ -185,6 +193,16 @@ const TeamManagementPage = (): JSX.Element => {
               setBackendValidators({
                 name: "A team with this name already exists",
               });
+            } else if (
+              updateError.data.errors[0].reason.includes("all teams")
+            ) {
+              setBackendValidators({
+                name: `"All teams" is a reserved team name.`,
+              });
+            } else if (updateError.data.errors[0].reason.includes("no team")) {
+              setBackendValidators({
+                name: `"No team" is a reserved team name. Please try another name.`,
+              });
             } else {
               renderFlash(
                 "error",
diff --git a/frontend/pages/admin/UserManagementPage/helpers/userManagementHelpers.tests.ts b/frontend/pages/admin/UserManagementPage/helpers/userManagementHelpers.tests.ts
index c7dd43fef4f4..5fad9e0da882 100644
--- a/frontend/pages/admin/UserManagementPage/helpers/userManagementHelpers.tests.ts
+++ b/frontend/pages/admin/UserManagementPage/helpers/userManagementHelpers.tests.ts
@@ -1,4 +1,5 @@
-import { userStub, userTeamStub } from "test/stubs";
+import { userTeamStub } from "test/stubs";
+import createMockUser from "__mocks__/userMock";
 import { IUserUpdateBody } from "interfaces/user";
 
 import { IFormData, NewUserType } from "../components/UserForm/UserForm";
@@ -20,13 +21,13 @@ describe("userManagementHelpers module", () => {
       const formData: IFormData = {
         email: "newemail@test.com",
         sso_enabled: false,
-        name: "Gnar Mike",
+        name: "Test User",
         newUserType: NewUserType.AdminCreated, // TODO revisit test
         global_role: "admin",
         teams: [updatedTeam, newTeam],
       };
       const updatedData = userManagementHelpers.generateUpdateData(
-        userStub,
+        createMockUser({ role: "Observer", global_role: null }),
         formData
       );
 
diff --git a/frontend/pages/admin/components/SettingsSection/SettingsSection.tsx b/frontend/pages/admin/components/SettingsSection/SettingsSection.tsx
new file mode 100644
index 000000000000..d3a93ab09b8d
--- /dev/null
+++ b/frontend/pages/admin/components/SettingsSection/SettingsSection.tsx
@@ -0,0 +1,30 @@
+import React from "react";
+import classnames from "classnames";
+
+import SectionHeader from "components/SectionHeader";
+
+const baseClass = "settings-section";
+
+interface ISettingsSectionProps {
+  title: string;
+  children: React.ReactNode;
+  className?: string;
+}
+
+/** This component encapsulates the common styles for each settings section */
+const SettingsSection = ({
+  title,
+  children,
+  className,
+}: ISettingsSectionProps) => {
+  const classes = classnames(baseClass, className);
+
+  return (
+    <section className={classes}>
+      <SectionHeader title={title} className={`${baseClass}__title`} />
+      <>{children}</>
+    </section>
+  );
+};
+
+export default SettingsSection;
diff --git a/frontend/pages/admin/components/SettingsSection/index.ts b/frontend/pages/admin/components/SettingsSection/index.ts
new file mode 100644
index 000000000000..279f1769e8c6
--- /dev/null
+++ b/frontend/pages/admin/components/SettingsSection/index.ts
@@ -0,0 +1 @@
+export { default } from "./SettingsSection";
diff --git a/frontend/pages/hosts/ManageHostsPage/HostTableConfig.tsx b/frontend/pages/hosts/ManageHostsPage/HostTableConfig.tsx
index fa52ec67b7ce..7666f46876aa 100644
--- a/frontend/pages/hosts/ManageHostsPage/HostTableConfig.tsx
+++ b/frontend/pages/hosts/ManageHostsPage/HostTableConfig.tsx
@@ -23,6 +23,7 @@ import {
   humanHostMemory,
   humanHostLastSeen,
   hostTeamName,
+  tooltipTextWithLineBreaks,
 } from "utilities/helpers";
 import { COLORS } from "styles/var/colors";
 import {
@@ -69,17 +70,6 @@ const condenseDeviceUsers = (users: IDeviceUser[]): string[] => {
     : condensed;
 };
 
-const tooltipTextWithLineBreaks = (lines: string[]) => {
-  return lines.map((line) => {
-    return (
-      <span key={Math.random().toString().slice(2)}>
-        {line}
-        <br />
-      </span>
-    );
-  });
-};
-
 const lastSeenTime = (status: string, seenTime: string): string => {
   if (status !== "online") {
     return `Last Seen: ${humanHostLastSeen(seenTime)} UTC`;
@@ -148,9 +138,8 @@ const allHostTableHeaders: IHostTableColumnConfig[] = [
               <span className={`tooltip__tooltip-text`}>
                 This host was ordered using <br />
                 Apple Business Manager <br />
-                (ABM). You can&apos;t see host <br />
-                vitals until it&apos;s unboxed and <br />
-                automatically enrolls to Fleet.
+                (ABM). You will see host <br />
+                vitals when it is enrolled in Fleet <br />
               </span>
             </ReactTooltip>
           </>
diff --git a/frontend/pages/hosts/ManageHostsPage/HostsPageConfig.tsx b/frontend/pages/hosts/ManageHostsPage/HostsPageConfig.tsx
index 114b537d3bcd..910f4813f398 100644
--- a/frontend/pages/hosts/ManageHostsPage/HostsPageConfig.tsx
+++ b/frontend/pages/hosts/ManageHostsPage/HostsPageConfig.tsx
@@ -55,7 +55,7 @@ export const LABEL_SLUG_PREFIX = "labels/";
 
 export const DEFAULT_SORT_HEADER = "display_name";
 export const DEFAULT_SORT_DIRECTION = "asc";
-export const DEFAULT_PAGE_SIZE = 20;
+export const DEFAULT_PAGE_SIZE = 50;
 export const DEFAULT_PAGE_INDEX = 0;
 
 export const getHostSelectStatuses = (isSandboxMode = false) => {
diff --git a/frontend/pages/hosts/ManageHostsPage/ManageHostsPage.tsx b/frontend/pages/hosts/ManageHostsPage/ManageHostsPage.tsx
index d3d69af8d373..71f2386c587d 100644
--- a/frontend/pages/hosts/ManageHostsPage/ManageHostsPage.tsx
+++ b/frontend/pages/hosts/ManageHostsPage/ManageHostsPage.tsx
@@ -169,9 +169,8 @@ const ManageHostsPage = ({
     includeAllTeams: true,
     includeNoTeam: true,
     overrideParamsOnTeamChange: {
-      // remove the software status filter when selecting all teams or no team
-      [HOSTS_QUERY_PARAMS.SOFTWARE_STATUS]: (newTeamId?: number) =>
-        !newTeamId || newTeamId < 1,
+      // remove the software status filter when selecting all teams
+      [HOSTS_QUERY_PARAMS.SOFTWARE_STATUS]: (newTeamId?: number) => !newTeamId,
     },
   });
 
@@ -406,8 +405,8 @@ const ManageHostsPage = ({
         osName,
         osVersion,
         vulnerability,
-        page: tableQueryData ? tableQueryData.pageIndex : 0,
-        perPage: tableQueryData ? tableQueryData.pageSize : 50,
+        page: tableQueryData ? tableQueryData.pageIndex : DEFAULT_PAGE_INDEX,
+        perPage: tableQueryData ? tableQueryData.pageSize : DEFAULT_PAGE_SIZE,
         device_mapping: true,
         osSettings: osSettingsStatus,
         diskEncryptionStatus,
@@ -1197,7 +1196,6 @@ const ManageHostsPage = ({
       isDisabled={isLoadingHosts || isLoadingHostsCount} // TODO: why?
       onChange={onTeamChange}
       includeNoTeams
-      isSandboxMode={isSandboxMode}
     />
   );
 
@@ -1580,7 +1578,7 @@ const ManageHostsPage = ({
         }
         defaultPageIndex={page || DEFAULT_PAGE_INDEX}
         defaultSearchQuery={searchQuery}
-        pageSize={50}
+        pageSize={DEFAULT_PAGE_SIZE}
         additionalQueries={JSON.stringify(selectedFilters)}
         inputPlaceHolder={HOSTS_SEARCH_BOX_PLACEHOLDER}
         actionButton={{
diff --git a/frontend/pages/hosts/ManageHostsPage/_styles.scss b/frontend/pages/hosts/ManageHostsPage/_styles.scss
index 290ea1d0983a..76cce5f2984b 100644
--- a/frontend/pages/hosts/ManageHostsPage/_styles.scss
+++ b/frontend/pages/hosts/ManageHostsPage/_styles.scss
@@ -108,6 +108,7 @@
 
         .manage-hosts__filter-dropdowns {
           display: flex;
+          flex-direction: row;
           margin-left: $pad-medium;
 
           // Dropdown height matches search bar height
@@ -166,10 +167,12 @@
         }
 
         .controls {
-          order: 1;
-          margin-bottom: $pad-medium;
+          order: -2;
+          margin-bottom: $pad-small;
 
           .manage-hosts__filter-dropdowns {
+            display: flex;
+            flex-direction: row;
             flex: 1;
 
             .form-field--dropdown,
diff --git a/frontend/pages/hosts/ManageHostsPage/components/LabelFilterSelect/_styles.scss b/frontend/pages/hosts/ManageHostsPage/components/LabelFilterSelect/_styles.scss
index 72ab4f59e942..c3d1f4802e80 100644
--- a/frontend/pages/hosts/ManageHostsPage/components/LabelFilterSelect/_styles.scss
+++ b/frontend/pages/hosts/ManageHostsPage/components/LabelFilterSelect/_styles.scss
@@ -1,5 +1,5 @@
 .label-filter-select {
-  width: 175px;
+  width: 300px;
 
   svg {
     transition: transform 0.25s ease;
diff --git a/frontend/pages/hosts/ManageHostsPage/components/LabelFilterSelect/helpers.ts b/frontend/pages/hosts/ManageHostsPage/components/LabelFilterSelect/helpers.ts
index b6aad87e53ef..746a2b6ddbbd 100644
--- a/frontend/pages/hosts/ManageHostsPage/components/LabelFilterSelect/helpers.ts
+++ b/frontend/pages/hosts/ManageHostsPage/components/LabelFilterSelect/helpers.ts
@@ -1,4 +1,6 @@
 import { ILabel } from "interfaces/label";
+import { getCustomLabels } from "services/entities/labels";
+
 import { EMPTY_OPTION, FILTERED_LINUX, NO_LABELS_OPTION } from "./constants";
 
 export interface IEmptyOption {
@@ -27,7 +29,7 @@ const createOptionGroup = (
 /** Will create the custom label group options and handles when no labels have been created yet or
  * will filter by the desired search query */
 const createCustomLabelOptions = (labels: ILabel[], query: string) => {
-  const customLabels = labels.filter((label) => label.label_type === "regular");
+  const customLabels = getCustomLabels(labels);
 
   let customLabelGroupOptions: ILabel[] | IEmptyOption[];
   if (customLabels.length === 0) {
diff --git a/frontend/pages/hosts/details/DeviceUserPage/AutoEnrollMdmModal/AutoEnrollMdmModal.tsx b/frontend/pages/hosts/details/DeviceUserPage/AutoEnrollMdmModal/AutoEnrollMdmModal.tsx
index 2f40fa82b615..e4b50bdbdba4 100644
--- a/frontend/pages/hosts/details/DeviceUserPage/AutoEnrollMdmModal/AutoEnrollMdmModal.tsx
+++ b/frontend/pages/hosts/details/DeviceUserPage/AutoEnrollMdmModal/AutoEnrollMdmModal.tsx
@@ -23,6 +23,57 @@ const AutoEnrollMdmModal = ({
       .map((s) => parseInt(s, 10));
     isMacOsSonomaOrLater = major >= 14;
   }
+
+  const preSonomaBody = (
+    <>
+      <p className={`${baseClass}__description`}>
+        To turn on MDM, Apple Inc. requires you to follow the steps below.
+      </p>
+      <ol>
+        <li>
+          Open your Mac&apos;s notification center by selecting the date and
+          time in the top right corner of your screen.
+        </li>
+        <li>
+          Select the <b>Device Enrollment</b> notification. This will open{" "}
+          <b>System Settings</b>. Select <b>Allow</b>.
+        </li>
+        <li>
+          Enter your password, and select <b>Enroll</b>.
+        </li>
+        <li>
+          Select <b>Done</b> to close this window and select Refetch on your My
+          device page to tell your organization that MDM is on.
+        </li>
+      </ol>
+    </>
+  );
+
+  const sonomaAndAboveBody = (
+    <>
+      <p className={`${baseClass}__description`}>
+        To turn on MDM, Apple Inc. requires that you install a profile.
+      </p>
+      <ol>
+        <li>
+          From the Apple menu in the top left corner of your screen, select{" "}
+          <b>System Settings</b> or <b>System Preferences</b>.
+        </li>
+        <li>
+          In the sidebar menu, select <b>Enroll in Remote Management</b>, and
+          select <b>Enroll</b>.
+        </li>
+        <li>
+          Enter your password, and select <b>Enroll</b>.
+        </li>
+        <li>
+          Close this window and select <b>Refetch</b> on your My device page to
+          tell your organization that MDM is on.
+        </li>
+      </ol>
+    </>
+  );
+
   return (
     <Modal
       title="Turn on MDM"
@@ -31,35 +82,7 @@ const AutoEnrollMdmModal = ({
       width="xlarge"
     >
       <div>
-        <p className={`${baseClass}__description`}>
-          To turn on MDM, Apple Inc. requires that you install a profile.
-        </p>
-        <ol>
-          <li>
-            From the Apple menu in the top left corner of your screen, select{" "}
-            <b>System Settings</b> or <b>System Preferences</b>.
-          </li>
-          <li>
-            {isMacOsSonomaOrLater ? (
-              <>
-                In the sidebar menu, select <b>Enroll in Remote Management</b>,
-                and select <b>Enroll</b>.
-              </>
-            ) : (
-              <>
-                In the search bar, type “Profiles.” Select <b>Profiles</b>, find
-                and select <b>Enrollment Profile</b>, and select <b>Install</b>.
-              </>
-            )}
-          </li>
-          <li>
-            Enter your password, and select <b>Enroll</b>.
-          </li>
-          <li>
-            Close this window and select <b>Refetch</b> on your My device page
-            to tell your organization that MDM is on.
-          </li>
-        </ol>
+        {isMacOsSonomaOrLater ? sonomaAndAboveBody : preSonomaBody}
         <div className="modal-cta-wrap">
           <Button type="button" onClick={onCancel} variant="brand">
             Done
diff --git a/frontend/pages/hosts/details/DeviceUserPage/DeviceUserPage.tsx b/frontend/pages/hosts/details/DeviceUserPage/DeviceUserPage.tsx
index 93b45300b6a8..1a03eeeecf56 100644
--- a/frontend/pages/hosts/details/DeviceUserPage/DeviceUserPage.tsx
+++ b/frontend/pages/hosts/details/DeviceUserPage/DeviceUserPage.tsx
@@ -42,7 +42,6 @@ import PolicyDetailsModal from "../cards/Policies/HostPoliciesTable/PolicyDetail
 import AutoEnrollMdmModal from "./AutoEnrollMdmModal";
 import ManualEnrollMdmModal from "./ManualEnrollMdmModal";
 import OSSettingsModal from "../OSSettingsModal";
-import ResetKeyModal from "./ResetKeyModal";
 import BootstrapPackageModal from "../HostDetailsPage/modals/BootstrapPackageModal";
 import { parseHostSoftwareQueryParams } from "../cards/Software/HostSoftware";
 import SelfService from "../cards/Software/SelfService";
@@ -90,7 +89,6 @@ const DeviceUserPage = ({
   const [isPremiumTier, setIsPremiumTier] = useState(false);
   const [showInfoModal, setShowInfoModal] = useState(false);
   const [showEnrollMdmModal, setShowEnrollMdmModal] = useState(false);
-  const [showResetKeyModal, setShowResetKeyModal] = useState(false);
   const [refetchStartTime, setRefetchStartTime] = useState<number | null>(null);
   const [showRefetchSpinner, setShowRefetchSpinner] = useState(false);
   const [orgLogoURL, setOrgLogoURL] = useState("");
@@ -248,10 +246,6 @@ const DeviceUserPage = ({
     setShowEnrollMdmModal(!showEnrollMdmModal);
   }, [showEnrollMdmModal, setShowEnrollMdmModal]);
 
-  const toggleResetKeyModal = useCallback(() => {
-    setShowResetKeyModal(!showResetKeyModal);
-  }, [showResetKeyModal, setShowResetKeyModal]);
-
   const togglePolicyDetailsModal = useCallback(
     (policy: IHostPolicy) => {
       setShowPolicyDetailsModal(!showPolicyDetailsModal);
@@ -361,7 +355,6 @@ const DeviceUserPage = ({
                 host.mdm.macos_settings?.action_required ?? null
               }
               onTurnOnMdm={toggleEnrollMdmModal}
-              onResetKey={toggleResetKeyModal}
             />
             <HostSummaryCard
               summaryData={summaryData}
@@ -422,13 +415,13 @@ const DeviceUserPage = ({
                     <SoftwareCard
                       id={deviceAuthToken}
                       softwareUpdatedAt={host.software_updated_at}
-                      isFleetdHost={!!host.orbit_version}
+                      hostCanInstallSoftware={!!host.orbit_version}
                       router={router}
                       pathname={location.pathname}
                       queryParams={parseHostSoftwareQueryParams(location.query)}
                       isMyDevicePage
+                      platform={host.platform}
                       hostTeamId={host.team_id || 0}
-                      hostPlatform={host?.platform || ""}
                       isSoftwareEnabled={isSoftwareEnabled}
                     />
                   </TabPanel>
@@ -449,12 +442,6 @@ const DeviceUserPage = ({
             </TabsWrapper>
             {showInfoModal && <InfoModal onCancel={toggleInfoModal} />}
             {showEnrollMdmModal && renderEnrollMdmModal()}
-            {showResetKeyModal && (
-              <ResetKeyModal
-                onClose={toggleResetKeyModal}
-                deviceAuthToken={deviceAuthToken}
-              />
-            )}
           </div>
         )}
         {!!host && showPolicyDetailsModal && (
diff --git a/frontend/pages/hosts/details/DeviceUserPage/ResetKeyModal/ResetKeyModal.tsx b/frontend/pages/hosts/details/DeviceUserPage/ResetKeyModal/ResetKeyModal.tsx
deleted file mode 100644
index e9fe2b3f0588..000000000000
--- a/frontend/pages/hosts/details/DeviceUserPage/ResetKeyModal/ResetKeyModal.tsx
+++ /dev/null
@@ -1,70 +0,0 @@
-import React from "react";
-
-import Button from "components/buttons/Button";
-import Modal from "components/Modal";
-import mdmAPI from "services/entities/mdm";
-import { useQuery } from "react-query";
-import Spinner from "components/Spinner";
-import DataError from "components/DataError";
-
-interface IResetKeyModalProps {
-  onClose: () => void;
-  deviceAuthToken: string;
-}
-
-const baseClass = "reset-key-modal";
-
-const ResetKeyModal = ({
-  onClose,
-  deviceAuthToken,
-}: IResetKeyModalProps): JSX.Element => {
-  const { isLoading: isLoadingResetDEKey, error: errorResetDEKey } = useQuery(
-    ["resetDEkey", deviceAuthToken],
-    () => mdmAPI.resetEncryptionKey(deviceAuthToken),
-    { refetchOnWindowFocus: false }
-  );
-
-  const renderModalBody = () => {
-    if (isLoadingResetDEKey) {
-      return <Spinner />;
-    }
-    if (errorResetDEKey) {
-      return <DataError />;
-    }
-
-    return (
-      <div>
-        <ol>
-          <li>
-            Wait 30 seconds for the <b>Reset disk encryption key</b> pop up to
-            open.
-          </li>
-          <li>
-            In the popup, enter the password you use to login to your Mac.
-          </li>
-          <li>
-            Close this window and select <b>Refetch</b> on your My device page.
-            This tells your organization that you reset your key.
-          </li>
-        </ol>
-        <div className="modal-cta-wrap">
-          <Button type="button" onClick={onClose} variant="brand">
-            Done
-          </Button>
-        </div>
-      </div>
-    );
-  };
-  return (
-    <Modal
-      title="Reset key"
-      onExit={onClose}
-      className={baseClass}
-      width="medium"
-    >
-      {renderModalBody()}
-    </Modal>
-  );
-};
-
-export default ResetKeyModal;
diff --git a/frontend/pages/hosts/details/DeviceUserPage/ResetKeyModal/_styles.scss b/frontend/pages/hosts/details/DeviceUserPage/ResetKeyModal/_styles.scss
deleted file mode 100644
index f40c1f1c1d3b..000000000000
--- a/frontend/pages/hosts/details/DeviceUserPage/ResetKeyModal/_styles.scss
+++ /dev/null
@@ -1,10 +0,0 @@
-.reset-key-modal {
-  ol {
-    padding-left: 0;
-  }
-
-  li {
-    margin-bottom: $pad-large;
-    list-style: number inside;
-  }
-}
diff --git a/frontend/pages/hosts/details/DeviceUserPage/ResetKeyModal/index.ts b/frontend/pages/hosts/details/DeviceUserPage/ResetKeyModal/index.ts
deleted file mode 100644
index 3cd713ee620e..000000000000
--- a/frontend/pages/hosts/details/DeviceUserPage/ResetKeyModal/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./ResetKeyModal";
diff --git a/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tests.tsx b/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tests.tsx
index dc7a05265385..cd3f28c01bc8 100644
--- a/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tests.tsx
+++ b/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tests.tsx
@@ -6,8 +6,7 @@ import DeviceUserBanners from "./DeviceUserBanners";
 
 describe("Device User Banners", () => {
   const turnOnMdmExpcetedText = /Mobile device management \(MDM\) is off\./;
-  const logoutDiskEncryptExpectedText = /Disk encryption: Log out of your device or restart to turn on disk encryption\./;
-  const resetKeyDiskEncryptExpcetedText = /Disk encryption: Reset your disk encryption key\./;
+  const resetKeyDiskEncryptExpcetedText = /Disk encryption: Log out of your device or restart it to safeguard your data in case your device is lost or stolen\./;
 
   it("renders the turn on mdm banner correctly", () => {
     render(
@@ -19,28 +18,11 @@ describe("Device User Banners", () => {
         diskEncryptionStatus={null}
         diskEncryptionActionRequired={null}
         onTurnOnMdm={noop}
-        onResetKey={noop}
       />
     );
     expect(screen.getByText(turnOnMdmExpcetedText)).toBeInTheDocument();
   });
 
-  it("renders the logout for disk encrpytion banner correctly", () => {
-    render(
-      <DeviceUserBanners
-        hostPlatform="darwin"
-        mdmEnrollmentStatus="On (automatic)"
-        mdmEnabledAndConfigured
-        mdmConnectedToFleet
-        diskEncryptionStatus="action_required"
-        diskEncryptionActionRequired="log_out"
-        onTurnOnMdm={noop}
-        onResetKey={noop}
-      />
-    );
-    expect(screen.getByText(logoutDiskEncryptExpectedText)).toBeInTheDocument();
-  });
-
   it("renders the reset key for disk encryption banner correctly", () => {
     render(
       <DeviceUserBanners
@@ -51,7 +33,6 @@ describe("Device User Banners", () => {
         diskEncryptionStatus="action_required"
         diskEncryptionActionRequired="rotate_key"
         onTurnOnMdm={noop}
-        onResetKey={noop}
       />
     );
     expect(
@@ -59,28 +40,6 @@ describe("Device User Banners", () => {
     ).toBeInTheDocument();
   });
 
-  it("renders only one banner in a priority order", () => {
-    // set up to render logout disk encryption banner, which is 2nd in priority
-    render(
-      <DeviceUserBanners
-        hostPlatform="darwin"
-        mdmEnrollmentStatus="On (automatic)"
-        mdmEnabledAndConfigured
-        mdmConnectedToFleet
-        diskEncryptionStatus="action_required"
-        diskEncryptionActionRequired="log_out"
-        onTurnOnMdm={noop}
-        onResetKey={noop}
-      />
-    );
-
-    expect(screen.queryByText(turnOnMdmExpcetedText)).not.toBeInTheDocument();
-    expect(screen.getByText(logoutDiskEncryptExpectedText)).toBeInTheDocument();
-    expect(
-      screen.queryByText(resetKeyDiskEncryptExpcetedText)
-    ).not.toBeInTheDocument();
-  });
-
   it("renders no banner correctly", () => {
     // setup so mdm is not enabled and configured.
     render(
@@ -92,13 +51,12 @@ describe("Device User Banners", () => {
         diskEncryptionStatus={null}
         diskEncryptionActionRequired={null}
         onTurnOnMdm={noop}
-        onResetKey={noop}
       />
     );
 
     expect(screen.queryByText(turnOnMdmExpcetedText)).not.toBeInTheDocument();
     expect(
-      screen.queryByText(logoutDiskEncryptExpectedText)
+      screen.queryByText(resetKeyDiskEncryptExpcetedText)
     ).not.toBeInTheDocument();
     expect(
       screen.queryByText(resetKeyDiskEncryptExpcetedText)
diff --git a/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tsx b/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tsx
index 9cc5e3256a34..286101a026ff 100644
--- a/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tsx
+++ b/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tsx
@@ -15,7 +15,6 @@ interface IDeviceUserBannersProps {
   diskEncryptionStatus: DiskEncryptionStatus | null;
   diskEncryptionActionRequired: MacDiskEncryptionActionRequired | null;
   onTurnOnMdm: () => void;
-  onResetKey: () => void;
 }
 
 const DeviceUserBanners = ({
@@ -26,7 +25,6 @@ const DeviceUserBanners = ({
   diskEncryptionStatus,
   diskEncryptionActionRequired,
   onTurnOnMdm,
-  onResetKey,
 }: IDeviceUserBannersProps) => {
   const isMdmUnenrolled =
     mdmEnrollmentStatus === "Off" || mdmEnrollmentStatus === null;
@@ -37,11 +35,6 @@ const DeviceUserBanners = ({
   const showTurnOnMdmBanner =
     hostPlatform === "darwin" && isMdmUnenrolled && mdmEnabledAndConfigured;
 
-  const showDiskEncryptionLogoutRestart =
-    diskEncryptionBannersEnabled &&
-    diskEncryptionStatus === "action_required" &&
-    diskEncryptionActionRequired === "log_out";
-
   const showDiskEncryptionKeyResetRequired =
     diskEncryptionBannersEnabled &&
     diskEncryptionStatus === "action_required" &&
@@ -53,34 +46,24 @@ const DeviceUserBanners = ({
     </Button>
   );
 
-  const resetKeyButton = (
-    <Button variant="unstyled" onClick={onResetKey}>
-      <b>Reset key</b>
-    </Button>
-  );
-
   const renderBanner = () => {
     if (showTurnOnMdmBanner) {
       return (
         <InfoBanner color="yellow" cta={turnOnMdmButton}>
           Mobile device management (MDM) is off. MDM allows your organization to
-          change settings and install software. This lets your organization keep
-          your device up to date so you don&apos;t have to.
+          enforce settings, OS updates, disk encryption, and more. This lets
+          your organization keep your device up to date so you don&apos;t have
+          to.
         </InfoBanner>
       );
-    } else if (showDiskEncryptionLogoutRestart) {
+    }
+
+    if (showDiskEncryptionKeyResetRequired) {
       return (
         <InfoBanner color="yellow">
-          Disk encryption: Log out of your device or restart to turn on disk
-          encryption. Then, select <strong>Refetch</strong>. This prevents
-          unauthorized access to the information on your device.
-        </InfoBanner>
-      );
-    } else if (showDiskEncryptionKeyResetRequired) {
-      return (
-        <InfoBanner color="yellow" cta={resetKeyButton}>
-          Disk encryption: Reset your disk encryption key. This lets your
-          organization help you unlock your device if you forget your password.
+          Disk encryption: Log out of your device or restart it to safeguard
+          your data in case your device is lost or stolen. After, select{" "}
+          <strong>Refetch</strong> to clear this banner.
         </InfoBanner>
       );
     }
diff --git a/frontend/pages/hosts/details/HostDetailsPage/HostActionsDropdown/HostActionsDropdown.tests.tsx b/frontend/pages/hosts/details/HostDetailsPage/HostActionsDropdown/HostActionsDropdown.tests.tsx
index 51beb650fe22..ecc33559d4de 100644
--- a/frontend/pages/hosts/details/HostDetailsPage/HostActionsDropdown/HostActionsDropdown.tests.tsx
+++ b/frontend/pages/hosts/details/HostDetailsPage/HostActionsDropdown/HostActionsDropdown.tests.tsx
@@ -921,7 +921,7 @@ describe("Host Actions Dropdown", () => {
       expect(screen.queryByText("Wipe")).not.toBeInTheDocument();
     });
 
-    it("does not renders when a macOS host but does not have Fleet macOS mdm enabled and configured", async () => {
+    it("does not render for a macOS host if Fleet Apple MDM is not enabled and configured", async () => {
       const render = createCustomRenderer({
         context: {
           app: {
diff --git a/frontend/pages/hosts/details/HostDetailsPage/HostDetailsPage.tsx b/frontend/pages/hosts/details/HostDetailsPage/HostDetailsPage.tsx
index 8fb425ce091e..172b6e4bd9f5 100644
--- a/frontend/pages/hosts/details/HostDetailsPage/HostDetailsPage.tsx
+++ b/frontend/pages/hosts/details/HostDetailsPage/HostDetailsPage.tsx
@@ -53,12 +53,21 @@ import {
   HOST_OSQUERY_DATA,
 } from "utilities/constants";
 
+import { isIPadOrIPhone } from "interfaces/platform";
+
 import Spinner from "components/Spinner";
 import TabsWrapper from "components/TabsWrapper";
 import MainContent from "components/MainContent";
 import BackLink from "components/BackLink";
 import ScriptDetailsModal from "pages/DashboardPage/cards/ActivityFeed/components/ScriptDetailsModal";
-import { SoftwareInstallDetailsModal } from "pages/SoftwarePage/components/SoftwareInstallDetails";
+import {
+  AppInstallDetailsModal,
+  IAppInstallDetails,
+} from "components/ActivityDetails/InstallDetails/AppInstallDetails/AppInstallDetails";
+import {
+  SoftwareInstallDetailsModal,
+  IPackageInstallDetails,
+} from "components/ActivityDetails/InstallDetails/SoftwareInstallDetails/SoftwareInstallDetails";
 
 import HostSummaryCard from "../cards/HostSummary";
 import AboutCard from "../cards/About";
@@ -168,7 +177,15 @@ const HostDetailsPage = ({
   const [selectedPolicy, setSelectedPolicy] = useState<IHostPolicy | null>(
     null
   );
-  const [softwareInstallUuid, setSoftwareInstallUuid] = useState("");
+  const [
+    packageInstallDetails,
+    setPackageInstallDetails,
+  ] = useState<IPackageInstallDetails | null>(null);
+  const [
+    appInstallDetails,
+    setAppInstallDetails,
+  ] = useState<IAppInstallDetails | null>(null);
+
   const [isUpdatingHost, setIsUpdatingHost] = useState(false);
   const [refetchStartTime, setRefetchStartTime] = useState<number | null>(null);
   const [showRefetchSpinner, setShowRefetchSpinner] = useState(false);
@@ -298,7 +315,10 @@ const HostDetailsPage = ({
             // If our 60 second timer wasn't already started (e.g., if a refetch was pending when
             // the first page loads), we start it now if the host is online. If the host is offline,
             // we skip the refetch on page load.
-            if (returnedHost.status === "online") {
+            if (
+              returnedHost.status === "online" ||
+              isIPadOrIPhone(returnedHost.platform)
+            ) {
               setRefetchStartTime(Date.now());
               setTimeout(() => {
                 refetchHostDetails();
@@ -308,9 +328,13 @@ const HostDetailsPage = ({
               setShowRefetchSpinner(false);
             }
           } else {
+            // !!refetchStartTime
             const totalElapsedTime = Date.now() - refetchStartTime;
             if (totalElapsedTime < 60000) {
-              if (returnedHost.status === "online") {
+              if (
+                returnedHost.status === "online" ||
+                isIPadOrIPhone(returnedHost.platform)
+              ) {
                 setTimeout(() => {
                   refetchHostDetails();
                   refetchExtensions();
@@ -323,6 +347,7 @@ const HostDetailsPage = ({
                 setShowRefetchSpinner(false);
               }
             } else {
+              // totalElapsedTime > 60000
               renderFlash(
                 "error",
                 `We're having trouble fetching fresh vitals for this host. Please try again later.`
@@ -441,6 +466,23 @@ const HostDetailsPage = ({
     ? teams?.find((t) => t.id === host.team_id)?.features
     : config?.features;
 
+  const getOSVersionRequirementFromMDMConfig = (hostPlatform: string) => {
+    const mdmConfig = host?.team_id
+      ? teams?.find((t) => t.id === host.team_id)?.mdm
+      : config?.mdm;
+
+    switch (hostPlatform) {
+      case "darwin":
+        return mdmConfig?.macos_updates;
+      case "ipados":
+        return mdmConfig?.ipados_updates;
+      case "ios":
+        return mdmConfig?.ios_updates;
+      default:
+        return undefined;
+    }
+  };
+
   useEffect(() => {
     setUsersState(() => {
       return (
@@ -551,12 +593,29 @@ const HostDetailsPage = ({
           setScriptDetailsId(details?.script_execution_id || "");
           break;
         case "installed_software":
-          setSoftwareInstallUuid(details?.install_uuid || "");
+          setPackageInstallDetails({
+            ...details,
+            // FIXME: It seems like the backend is not using the correct display name when it returns
+            // upcoming install activities. As a workaround, we'll prefer the display name from
+            // the host object if it's available.
+            host_display_name:
+              host?.display_name || details?.host_display_name || "",
+          });
+          break;
+        case "installed_app_store_app":
+          setAppInstallDetails({
+            ...details,
+            // FIXME: It seems like the backend is not using the correct display name when it returns
+            // upcoming install activities. As a workaround, we'll prefer the display name from
+            // the host object if it's available.
+            host_display_name:
+              host?.display_name || details?.host_display_name || "",
+          });
           break;
         default: // do nothing
       }
     },
-    []
+    [host?.display_name]
   );
 
   const onLabelClick = (label: ILabel) => {
@@ -583,10 +642,17 @@ const HostDetailsPage = ({
 
   const onCancelScriptDetailsModal = useCallback(() => {
     setScriptDetailsId("");
-  }, []);
+    // refetch activities to make sure they up-to-date with what was displayed in the modal
+    refetchPastActivities();
+    refetchUpcomingActivities();
+  }, [refetchPastActivities, refetchUpcomingActivities]);
 
   const onCancelSoftwareInstallDetailsModal = useCallback(() => {
-    setSoftwareInstallUuid("");
+    setPackageInstallDetails(null);
+  }, []);
+
+  const onCancelAppInstallDetailsModal = useCallback(() => {
+    setAppInstallDetails(null);
   }, []);
 
   const onTransferHostSubmit = async (team: ITeam) => {
@@ -794,6 +860,9 @@ const HostDetailsPage = ({
           onRefetchHost={onRefetchHost}
           renderActionDropdown={renderActionDropdown}
           osSettings={host?.mdm.os_settings}
+          osVersionRequirement={getOSVersionRequirementFromMDMConfig(
+            host.platform
+          )}
           hostMdmDeviceStatus={hostMdmDeviceStatus}
         />
         <TabsWrapper className={`${baseClass}__tabs-wrapper`}>
@@ -815,31 +884,29 @@ const HostDetailsPage = ({
                 munki={macadmins?.munki}
                 mdm={mdm}
               />
-              {!isIosOrIpadosHost && (
-                <ActivityCard
-                  activeTab={activeActivityTab}
-                  activities={
-                    activeActivityTab === "past"
-                      ? pastActivities
-                      : upcomingActivities
-                  }
-                  isLoading={
-                    activeActivityTab === "past"
-                      ? pastActivitiesIsFetching
-                      : upcomingActivitiesIsFetching
-                  }
-                  isError={
-                    activeActivityTab === "past"
-                      ? pastActivitiesIsError
-                      : upcomingActivitiesIsError
-                  }
-                  upcomingCount={upcomingActivities?.count || 0}
-                  onChangeTab={onChangeActivityTab}
-                  onNextPage={() => setActivityPage(activityPage + 1)}
-                  onPreviousPage={() => setActivityPage(activityPage - 1)}
-                  onShowDetails={onShowActivityDetails}
-                />
-              )}
+              <ActivityCard
+                activeTab={activeActivityTab}
+                activities={
+                  activeActivityTab === "past"
+                    ? pastActivities
+                    : upcomingActivities
+                }
+                isLoading={
+                  activeActivityTab === "past"
+                    ? pastActivitiesIsFetching
+                    : upcomingActivitiesIsFetching
+                }
+                isError={
+                  activeActivityTab === "past"
+                    ? pastActivitiesIsError
+                    : upcomingActivitiesIsError
+                }
+                upcomingCount={upcomingActivities?.count || 0}
+                onChangeTab={onChangeActivityTab}
+                onNextPage={() => setActivityPage(activityPage + 1)}
+                onPreviousPage={() => setActivityPage(activityPage - 1)}
+                onShowDetails={onShowActivityDetails}
+              />
               {!isIosOrIpadosHost && (
                 <AgentOptionsCard
                   osqueryData={osqueryData}
@@ -864,15 +931,17 @@ const HostDetailsPage = ({
             <TabPanel>
               <SoftwareCard
                 id={host.id}
+                platform={host.platform}
                 softwareUpdatedAt={host.software_updated_at}
-                isFleetdHost={!!host.orbit_version}
+                hostCanInstallSoftware={
+                  !!host.orbit_version || isIosOrIpadosHost
+                }
                 isSoftwareEnabled={featuresConfig?.enable_software_inventory}
                 router={router}
                 queryParams={parseHostSoftwareQueryParams(location.query)}
                 pathname={location.pathname}
                 onShowSoftwareDetails={setSelectedSoftwareDetails}
                 hostTeamId={host.team_id || 0}
-                hostPlatform={host.platform}
               />
               {host?.platform === "darwin" && macadmins?.munki?.version && (
                 <MunkiIssuesCard
@@ -927,15 +996,17 @@ const HostDetailsPage = ({
             hostsTeamId={host?.team_id}
           />
         )}
-        {showRunScriptModal && (
-          <RunScriptModal
-            host={host}
-            currentUser={currentUser}
-            scriptDetailsId={scriptDetailsId}
-            setScriptDetailsId={setScriptDetailsId}
-            onClose={onCloseRunScriptModal}
-          />
-        )}
+        {showRunScriptModal &&
+          // force run script modal to unmount when script details modal is shown;
+          // it will be remounted when script details modal is closed
+          !scriptDetailsId && (
+            <RunScriptModal
+              host={host}
+              currentUser={currentUser}
+              setScriptDetailsId={setScriptDetailsId}
+              onClose={onCloseRunScriptModal}
+            />
+          )}
         {!!host && showTransferHostModal && (
           <TransferHostModal
             onCancel={() => setShowTransferHostModal(false)}
@@ -988,12 +1059,18 @@ const HostDetailsPage = ({
             onCancel={onCancelScriptDetailsModal}
           />
         )}
-        {!!softwareInstallUuid && (
+        {!!packageInstallDetails && (
           <SoftwareInstallDetailsModal
-            installUuid={softwareInstallUuid}
+            details={packageInstallDetails}
             onCancel={onCancelSoftwareInstallDetailsModal}
           />
         )}
+        {!!appInstallDetails && (
+          <AppInstallDetailsModal
+            details={appInstallDetails}
+            onCancel={onCancelAppInstallDetailsModal}
+          />
+        )}
         {showLockHostModal && (
           <LockModal
             id={host.id}
@@ -1024,6 +1101,7 @@ const HostDetailsPage = ({
         )}
         {selectedSoftwareDetails && (
           <SoftwareDetailsModal
+            hostDisplayName={host.display_name}
             software={selectedSoftwareDetails}
             onExit={() => setSelectedSoftwareDetails(null)}
           />
diff --git a/frontend/pages/hosts/details/HostDetailsPage/_styles.scss b/frontend/pages/hosts/details/HostDetailsPage/_styles.scss
index c3c473dc783e..3809916a6b4a 100644
--- a/frontend/pages/hosts/details/HostDetailsPage/_styles.scss
+++ b/frontend/pages/hosts/details/HostDetailsPage/_styles.scss
@@ -24,14 +24,12 @@
       grid-auto-flow: column;
     }
 
-    // Note: CSS for labels card spans the whole grid for iOS and iPadOS
-    // because activity card is missing
+    // No agent options card for i(Pad)OS, so extend Labels card vertically
     &__details-panel--ios-grid.react-tabs__tab-panel--selected {
-      // Must be selected to show grid
-      grid-template-columns: 1fr;
+      grid-template-columns: 1fr 1fr;
       grid-template-areas:
-        "about"
-        "labels";
+        "about about"
+        "activity labels";
       grid-auto-flow: column;
     }
 
diff --git a/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tsx b/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tsx
index ea3110af9ba0..656d3f2debb8 100644
--- a/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tsx
+++ b/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tsx
@@ -23,32 +23,34 @@ const HostDetailsBanners = ({
   connectedToFleetMdm,
   diskEncryptionStatus,
 }: IHostDetailsBannersProps) => {
-  const { config, isPremiumTier, apnsExpiry, abmExpiry } = useContext(
-    AppContext
-  );
+  const {
+    config,
+    isPremiumTier,
+    isAppleBmExpired,
+    isApplePnsExpired,
+    isVppExpired,
+    needsAbmTermsRenewal,
+    willAppleBmExpire,
+    willApplePnsExpire,
+    willVppExpire,
+  } = useContext(AppContext);
 
   // Checks to see if an app-wide banner is being shown (the ABM terms, ABM expiry,
   // or APNs expiry banner) in a parent component. App-wide banners found in parent
   // component take priority over host details page-level banners.
-  const isAppleBmTermsExpired = config?.mdm?.apple_bm_terms_expired;
-  const isApplePnsExpired = hasLicenseExpired(apnsExpiry || "");
-  const willApplePnsExpireIn30Days = willExpireWithinXDays(
-    apnsExpiry || "",
-    30
-  );
-  const isAppleBmExpired = hasLicenseExpired(abmExpiry || "");
-  const willAppleBmExpireIn30Days = willExpireWithinXDays(abmExpiry || "", 30);
   const isFleetLicenseExpired = hasLicenseExpired(
     config?.license.expiration || ""
   );
 
   const showingAppWideBanner =
     isPremiumTier &&
-    (isAppleBmTermsExpired ||
+    (needsAbmTermsRenewal ||
       isApplePnsExpired ||
-      willApplePnsExpireIn30Days ||
+      willApplePnsExpire ||
       isAppleBmExpired ||
-      willAppleBmExpireIn30Days ||
+      willAppleBmExpire ||
+      isVppExpired ||
+      willVppExpire ||
       isFleetLicenseExpired);
 
   const isMdmUnenrolled =
@@ -71,16 +73,15 @@ const HostDetailsBanners = ({
       <div className={baseClass}>
         {showTurnOnMdmInfoBanner && (
           <InfoBanner color="yellow">
-            To change settings and install software, ask the end user to follow
-            the <strong>Turn on MDM</strong> instructions on their{" "}
-            <strong>My device</strong> page.
+            To enforce settings, OS updates, disk encryption, and more, ask the
+            end user to follow the <strong>Turn on MDM</strong> instructions on
+            their <strong>My device</strong> page.
           </InfoBanner>
         )}
         {showDiskEncryptionUserActionRequired && (
           <InfoBanner color="yellow">
             Disk encryption: Requires action from the end user. Ask the end user
-            to follow <b>Disk encryption</b> instructions on their{" "}
-            <b>My device</b> page.
+            to log out of their device or restart it.
           </InfoBanner>
         )}
       </div>
diff --git a/frontend/pages/hosts/details/HostDetailsPage/modals/RunScriptModal/RunScriptModal.tsx b/frontend/pages/hosts/details/HostDetailsPage/modals/RunScriptModal/RunScriptModal.tsx
index 02838417264c..5df4dda24da4 100644
--- a/frontend/pages/hosts/details/HostDetailsPage/modals/RunScriptModal/RunScriptModal.tsx
+++ b/frontend/pages/hosts/details/HostDetailsPage/modals/RunScriptModal/RunScriptModal.tsx
@@ -31,7 +31,6 @@ const baseClass = "run-script-modal";
 interface IScriptsProps {
   currentUser: IUser | null;
   host: IHost;
-  scriptDetailsId: string;
   setScriptDetailsId: React.Dispatch<React.SetStateAction<string>>;
   onClose: () => void;
 }
@@ -41,7 +40,6 @@ const EmptyComponent = () => <></>;
 const RunScriptModal = ({
   currentUser,
   host,
-  scriptDetailsId,
   setScriptDetailsId,
   onClose,
 }: IScriptsProps) => {
@@ -123,7 +121,6 @@ const RunScriptModal = ({
 
   if (!config) return null;
 
-  const isShowingScriptDetails = !!scriptDetailsId; // used to set css visibility for this modal to hidden when the script details modal is open
   const tableData = hostScriptResponse?.scripts;
 
   return (
@@ -132,7 +129,6 @@ const RunScriptModal = ({
       onExit={onClose}
       onEnter={onClose}
       className={`${baseClass}`}
-      isHidden={isShowingScriptDetails}
       isLoading={runScriptRequested || isFetching || isLoading}
     >
       <>
diff --git a/frontend/pages/hosts/details/HostDetailsPage/modals/RunScriptModal/ScriptsTableConfig.tsx b/frontend/pages/hosts/details/HostDetailsPage/modals/RunScriptModal/ScriptsTableConfig.tsx
index c870ab55e41e..d115185f1a30 100644
--- a/frontend/pages/hosts/details/HostDetailsPage/modals/RunScriptModal/ScriptsTableConfig.tsx
+++ b/frontend/pages/hosts/details/HostDetailsPage/modals/RunScriptModal/ScriptsTableConfig.tsx
@@ -1,8 +1,4 @@
 import React from "react";
-import ReactTooltip from "react-tooltip";
-import { noop } from "lodash";
-
-import { COLORS } from "styles/var/colors";
 
 import { IDropdownOption } from "interfaces/dropdownOption";
 import { IHostScript, ILastExecution } from "interfaces/script";
@@ -42,6 +38,7 @@ const generateActionDropdownOptions = (
   teamId: number | null,
   { last_execution }: IHostScript
 ): IDropdownOption[] => {
+  const isPending = last_execution?.status === "pending";
   const hasRunPermission =
     !!currentUser &&
     (isGlobalAdmin(currentUser) ||
@@ -58,14 +55,15 @@ const generateActionDropdownOptions = (
       disabled: last_execution === null,
       value: "showDetails",
     },
-    {
+  ];
+  hasRunPermission &&
+    options.push({
       label: "Run",
-      disabled: last_execution?.status === "pending",
+      disabled: isPending,
       value: "run",
-      tooltipContent: "Script is already running.",
-    },
-  ];
-  return hasRunPermission ? options : options.slice(0, 1);
+      tooltipContent: isPending ? "Script is already running." : undefined,
+    });
+  return options;
 };
 
 // eslint-disable-next-line import/prefer-default-export
diff --git a/frontend/pages/hosts/details/HostDetailsPage/modals/UnenrollMdmModal/UnenrollMdmModal.tsx b/frontend/pages/hosts/details/HostDetailsPage/modals/UnenrollMdmModal/UnenrollMdmModal.tsx
index ef2135dc19ed..a254ea2fa4a8 100644
--- a/frontend/pages/hosts/details/HostDetailsPage/modals/UnenrollMdmModal/UnenrollMdmModal.tsx
+++ b/frontend/pages/hosts/details/HostDetailsPage/modals/UnenrollMdmModal/UnenrollMdmModal.tsx
@@ -25,11 +25,15 @@ const UnenrollMdmModal = ({ hostId, onClose }: IUnenrollMdmModalProps) => {
     setRequestState("unenrolling");
     try {
       await mdmAPI.unenrollHostFromMdm(hostId, 5000);
-      renderFlash("success", "Successfully turned off MDM.");
+      renderFlash(
+        "success",
+        "Turning off MDM or will turn off when the host comes online."
+      );
       onClose();
     } catch (unenrollMdmError: unknown) {
+      renderFlash("error", "Couldn't turn off MDM. Please try again.");
       console.log(unenrollMdmError);
-      setRequestState("error");
+      onClose();
     }
   };
 
diff --git a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsModal.tsx b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsModal.tsx
index a9c916f57083..f86226a967c6 100644
--- a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsModal.tsx
+++ b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsModal.tsx
@@ -43,7 +43,7 @@ const OSSettingsModal = ({
       title="OS settings"
       onExit={onClose}
       className={baseClass}
-      width="large"
+      width="xlarge"
     >
       <>
         <OSSettingsTable
diff --git a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingStatusCell/helpers.ts b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingStatusCell/helpers.ts
index 3bb306c42b7a..588e4e8d2954 100644
--- a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingStatusCell/helpers.ts
+++ b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingStatusCell/helpers.ts
@@ -29,15 +29,15 @@ type OperationTypeOption = Record<
 
 type ProfileDisplayConfig = Record<ProfileOperationType, OperationTypeOption>;
 
-const MAC_PROFILE_VERIFIED_DISPLAY_CONFIG: ProfileDisplayOption = {
+// Profiles for iOS and iPadOS skip the verifying step
+const APPLE_PROFILE_VERIFIED_DISPLAY_CONFIG: ProfileDisplayOption = {
   statusText: "Verified",
   iconName: "success",
   tooltip: (innerProps) =>
     innerProps.isDiskEncryptionProfile
       ? "The host turned disk encryption on and sent the key to Fleet. " +
-        "Fleet verified with osquery."
-      : "The host applied the setting. Fleet verified with osquery. " +
-        "Declaration profiles are verified with DDM.",
+        "Fleet verified."
+      : "The host applied the setting. Fleet verified.",
 } as const;
 
 const MAC_PROFILE_VERIFYING_DISPLAY_CONFIG: ProfileDisplayOption = {
@@ -54,8 +54,8 @@ const MAC_PROFILE_VERIFYING_DISPLAY_CONFIG: ProfileDisplayOption = {
 
 export const PROFILE_DISPLAY_CONFIG: ProfileDisplayConfig = {
   install: {
-    verified: MAC_PROFILE_VERIFIED_DISPLAY_CONFIG,
-    success: MAC_PROFILE_VERIFIED_DISPLAY_CONFIG,
+    verified: APPLE_PROFILE_VERIFIED_DISPLAY_CONFIG,
+    success: APPLE_PROFILE_VERIFIED_DISPLAY_CONFIG,
     verifying: MAC_PROFILE_VERIFYING_DISPLAY_CONFIG,
     acknowledged: MAC_PROFILE_VERIFYING_DISPLAY_CONFIG,
     pending: {
@@ -114,7 +114,7 @@ export const WINDOWS_DISK_ENCRYPTION_DISPLAY_CONFIG: WindowsDiskEncryptionDispla
     statusText: "Verified",
     iconName: "success",
     tooltip: () =>
-      "The host turned disk encryption on and sent the key to Fleet. Fleet verified with osquery.",
+      "The host turned disk encryption on and sent the key to Fleet. Fleet verified.",
   },
   verifying: {
     statusText: "Verifying",
diff --git a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsErrorCell/OSSettingsErrorCell.tsx b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsErrorCell/OSSettingsErrorCell.tsx
index 3e8abd790c07..818fbfd55b7f 100644
--- a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsErrorCell/OSSettingsErrorCell.tsx
+++ b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsErrorCell/OSSettingsErrorCell.tsx
@@ -136,7 +136,7 @@ const OSSettingsErrorCell = ({
         tooltip={tooltip}
         value={value}
         // we dont want the default "w250" class so we pass in empty string
-        classes={""}
+        classes=""
         className={
           isFailed || showRefetchButton
             ? `${baseClass}__failed-message`
diff --git a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsErrorCell/_styles.scss b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsErrorCell/_styles.scss
index b5fe68c4042f..10de839ebb14 100644
--- a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsErrorCell/_styles.scss
+++ b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsErrorCell/_styles.scss
@@ -5,7 +5,7 @@
   gap: $pad-small;
 
   &__failed-message {
-    min-width: 100px;
+    min-width: 168px; // Aligns resend button to right end
 
     .data-table__tooltip-truncated-text--cell {
       // for some reason this is need to vertically align the text and
@@ -15,6 +15,7 @@
   }
 
   &__resend-button {
+    width: 106px;
     display: flex;
 
     .children-wrapper {
diff --git a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsTableConfig.tsx b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsTableConfig.tsx
index 197c8603ccca..8f6d2650c93a 100644
--- a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsTableConfig.tsx
+++ b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsTableConfig.tsx
@@ -12,8 +12,7 @@ import {
   isWindowsDiskEncryptionStatus,
 } from "interfaces/mdm";
 
-import TextCell from "components/TableContainer/DataTable/TextCell";
-
+import TooltipTruncatedTextCell from "components/TableContainer/DataTable/TooltipTruncatedTextCell";
 import OSSettingStatusCell from "./OSSettingStatusCell";
 import { generateWinDiskEncryptionProfile } from "../../helpers";
 import OSSettingsErrorCell from "./OSSettingsErrorCell";
@@ -53,7 +52,7 @@ const generateTableConfig = (
       accessor: "name",
       Cell: (cellProps: ITableStringCellProps) => {
         return (
-          <TextCell
+          <TooltipTruncatedTextCell
             value={cellProps.cell.value}
             className="os-settings-name-cell"
           />
diff --git a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/_styles.scss b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/_styles.scss
index c4a39112866e..dc330199451c 100644
--- a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/_styles.scss
+++ b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/_styles.scss
@@ -4,8 +4,15 @@
   // for these cells in the table. Total width of the table cell will be
   // 240px including the padding.
   .data-table-block .data-table tbody td {
-    .os-settings-name-cell, .os-settings-status-cell, .os-settings-error-cell {
-      max-width: 192px;
+    .os-settings-name-cell {
+      width: 135px;
+      max-width: none;
+    }
+    .os-settings-status-cell {
+      width: 200px;
+    }
+    .os-settings-error-cell {
+      width: 237px;
     }
   }
 
diff --git a/frontend/pages/hosts/details/cards/Activity/Activity.tsx b/frontend/pages/hosts/details/cards/Activity/Activity.tsx
index acb20b81cd6c..507ceaa335bc 100644
--- a/frontend/pages/hosts/details/cards/Activity/Activity.tsx
+++ b/frontend/pages/hosts/details/cards/Activity/Activity.tsx
@@ -31,11 +31,12 @@ const UpcomingTooltip = () => {
     <TooltipWrapper
       tipContent={
         <>
-          Upcoming activities will run as listed. Failure of one activity
-          won&apos;t cancel other activities.
+          Currently, only scripts run before other scripts and
           <br />
+          software is installed before other software.
           <br />
-          Currently, only scripts are guaranteed to run in order.
+          <br />
+          Failure of one activity won&apos;t cancel other activities.
         </>
       }
       className={`${baseClass}__upcoming-tooltip`}
@@ -68,7 +69,6 @@ const Activity = ({
   onPreviousPage,
   onShowDetails,
 }: IActivityProps) => {
-  // TODO: add count to upcoming activities tab when available via API
   return (
     <Card
       borderRadiusSize="xxlarge"
diff --git a/frontend/pages/hosts/details/cards/Activity/ActivityConfig.tsx b/frontend/pages/hosts/details/cards/Activity/ActivityConfig.tsx
index ca87ffaa0d44..24802d95a593 100644
--- a/frontend/pages/hosts/details/cards/Activity/ActivityConfig.tsx
+++ b/frontend/pages/hosts/details/cards/Activity/ActivityConfig.tsx
@@ -36,6 +36,7 @@ export const pastActivityComponentMap: Record<
   [ActivityType.LockedHost]: LockedHostActivityItem,
   [ActivityType.UnlockedHost]: UnlockedHostActivityItem,
   [ActivityType.InstalledSoftware]: InstalledSoftwareActivityItem,
+  [ActivityType.InstalledAppStoreApp]: InstalledSoftwareActivityItem,
 };
 
 export const upcomingActivityComponentMap: Record<
@@ -45,4 +46,5 @@ export const upcomingActivityComponentMap: Record<
 > = {
   [ActivityType.RanScript]: RanScriptActivityItem,
   [ActivityType.InstalledSoftware]: InstalledSoftwareActivityItem,
+  [ActivityType.InstalledAppStoreApp]: InstalledSoftwareActivityItem,
 };
diff --git a/frontend/pages/hosts/details/cards/Activity/ActivityItems/InstalledSoftwareActivityItem/InstalledSoftwareActivityItem.tsx b/frontend/pages/hosts/details/cards/Activity/ActivityItems/InstalledSoftwareActivityItem/InstalledSoftwareActivityItem.tsx
index b5edd5f4b59f..5d474d4d8b0a 100644
--- a/frontend/pages/hosts/details/cards/Activity/ActivityItems/InstalledSoftwareActivityItem/InstalledSoftwareActivityItem.tsx
+++ b/frontend/pages/hosts/details/cards/Activity/ActivityItems/InstalledSoftwareActivityItem/InstalledSoftwareActivityItem.tsx
@@ -1,6 +1,6 @@
 import React from "react";
 
-import { SoftwareInstallStatus } from "interfaces/software";
+import { getInstallStatusPredicate } from "interfaces/software";
 
 import { IHostActivityItemComponentPropsWithShowDetails } from "../../ActivityConfig";
 import HostActivityItem from "../../HostActivityItem";
@@ -8,24 +8,6 @@ import ShowDetailsButton from "../../ShowDetailsButton";
 
 const baseClass = "installed-software-activity-item";
 
-const STATUS_PREDICATES: Record<SoftwareInstallStatus, string> = {
-  failed: "failed to install",
-  installed: "installed",
-  pending: "told Fleet to install",
-} as const;
-
-export const getSoftwareInstallStatusPredicate = (
-  status: string | undefined
-) => {
-  if (!status) {
-    return STATUS_PREDICATES.pending;
-  }
-  return (
-    STATUS_PREDICATES[status as SoftwareInstallStatus] ||
-    STATUS_PREDICATES.pending
-  );
-};
-
 const InstalledSoftwareActivityItem = ({
   activity,
   onShowDetails,
@@ -41,8 +23,8 @@ const InstalledSoftwareActivityItem = ({
 
   return (
     <HostActivityItem className={baseClass} activity={activity}>
-      <>{actorDisplayName}</> {getSoftwareInstallStatusPredicate(status)}{" "}
-      <b>{title}</b> software on this host.{" "}
+      <>{actorDisplayName}</> {getInstallStatusPredicate(status)} <b>{title}</b>{" "}
+      on this host.{" "}
       <ShowDetailsButton activity={activity} onShowDetails={onShowDetails} />
     </HostActivityItem>
   );
diff --git a/frontend/pages/hosts/details/cards/Activity/PastActivityFeed/PastActivityFeed.tsx b/frontend/pages/hosts/details/cards/Activity/PastActivityFeed/PastActivityFeed.tsx
index 5e58a50f4ce4..2321f9674d90 100644
--- a/frontend/pages/hosts/details/cards/Activity/PastActivityFeed/PastActivityFeed.tsx
+++ b/frontend/pages/hosts/details/cards/Activity/PastActivityFeed/PastActivityFeed.tsx
@@ -44,7 +44,7 @@ const PastActivityFeed = ({
     return (
       <EmptyFeed
         title="No activity"
-        message="When a script runs on a host, it shows up here."
+        message="Completed actions will appear here (scripts, software, lock, and wipe)."
         className={`${baseClass}__empty-feed`}
       />
     );
diff --git a/frontend/pages/hosts/details/cards/Activity/PastActivityFeed/_styles.scss b/frontend/pages/hosts/details/cards/Activity/PastActivityFeed/_styles.scss
index 1bd505eab6a1..6681e77af087 100644
--- a/frontend/pages/hosts/details/cards/Activity/PastActivityFeed/_styles.scss
+++ b/frontend/pages/hosts/details/cards/Activity/PastActivityFeed/_styles.scss
@@ -5,10 +5,6 @@
   position: relative;
   min-height: 500px;
 
-  &__empty-feed {
-    min-height: 484px;
-  }
-
   &__pagination {
     position: absolute;
     bottom: 0px;
diff --git a/frontend/pages/hosts/details/cards/Activity/UpcomingActivityFeed/UpcomingActivityFeed.tsx b/frontend/pages/hosts/details/cards/Activity/UpcomingActivityFeed/UpcomingActivityFeed.tsx
index c9c12696f2a0..ab4a3ba5652c 100644
--- a/frontend/pages/hosts/details/cards/Activity/UpcomingActivityFeed/UpcomingActivityFeed.tsx
+++ b/frontend/pages/hosts/details/cards/Activity/UpcomingActivityFeed/UpcomingActivityFeed.tsx
@@ -43,7 +43,7 @@ const UpcomingActivityFeed = ({
     return (
       <EmptyFeed
         title="No pending activity "
-        message="When you run a script on an offline host, it will appear here."
+        message="Pending actions will appear here (scripts, software, lock, and wipe)."
         className={`${baseClass}__empty-feed`}
       />
     );
diff --git a/frontend/pages/hosts/details/cards/Activity/UpcomingActivityFeed/_styles.scss b/frontend/pages/hosts/details/cards/Activity/UpcomingActivityFeed/_styles.scss
index 50bfcbb84078..3b46b3fa13f8 100644
--- a/frontend/pages/hosts/details/cards/Activity/UpcomingActivityFeed/_styles.scss
+++ b/frontend/pages/hosts/details/cards/Activity/UpcomingActivityFeed/_styles.scss
@@ -5,10 +5,6 @@
   position: relative;
   min-height: 500px;
 
-  &__empty-feed {
-    min-height: 484px;
-  }
-
   &__pagination {
     position: absolute;
     bottom: 0px;
diff --git a/frontend/pages/hosts/details/cards/HostSummary/HostSummary.tests.tsx b/frontend/pages/hosts/details/cards/HostSummary/HostSummary.tests.tsx
index 83c55da97646..0f003b653a78 100644
--- a/frontend/pages/hosts/details/cards/HostSummary/HostSummary.tests.tsx
+++ b/frontend/pages/hosts/details/cards/HostSummary/HostSummary.tests.tsx
@@ -140,7 +140,7 @@ describe("Host Summary section", () => {
     });
   });
   describe("iOS and iPadOS data", () => {
-    it("for iOS, renders Team, Disk space, and Operating system data only and hides the refetch button", async () => {
+    it("for iOS, renders Team, Disk space, and Operating system data only", async () => {
       const render = createCustomRenderer({
         context: {
           app: {
@@ -181,15 +181,15 @@ describe("Host Summary section", () => {
       expect(
         screen.getByText("Operating system").nextElementSibling
       ).toHaveTextContent(osVersion);
+      expect(screen.queryByText("Refetch")).toBeInTheDocument();
 
-      expect(screen.queryByText("Refetch")).not.toBeInTheDocument();
       expect(screen.queryByText("Status")).not.toBeInTheDocument();
       expect(screen.queryByText("Memory")).not.toBeInTheDocument();
       expect(screen.queryByText("Processor type")).not.toBeInTheDocument();
       expect(screen.queryByText("Agent")).not.toBeInTheDocument();
       expect(screen.queryByText("Osquery")).not.toBeInTheDocument();
     });
-    it("for iPadOS, renders Team, Disk space, and Operating system data only and hides the refetch button", async () => {
+    it("for iPadOS, renders Team, Disk space, and Operating system data only", async () => {
       const render = createCustomRenderer({
         context: {
           app: {
@@ -230,8 +230,8 @@ describe("Host Summary section", () => {
       expect(
         screen.getByText("Operating system").nextElementSibling
       ).toHaveTextContent(osVersion);
+      expect(screen.queryByText("Refetch")).toBeInTheDocument();
 
-      expect(screen.queryByText("Refetch")).not.toBeInTheDocument();
       expect(screen.queryByText("Status")).not.toBeInTheDocument();
       expect(screen.queryByText("Memory")).not.toBeInTheDocument();
       expect(screen.queryByText("Processor type")).not.toBeInTheDocument();
diff --git a/frontend/pages/hosts/details/cards/HostSummary/HostSummary.tsx b/frontend/pages/hosts/details/cards/HostSummary/HostSummary.tsx
index 146809ad5628..2a1c13b98b77 100644
--- a/frontend/pages/hosts/details/cards/HostSummary/HostSummary.tsx
+++ b/frontend/pages/hosts/details/cards/HostSummary/HostSummary.tsx
@@ -8,6 +8,7 @@ import {
   isWindowsDiskEncryptionStatus,
 } from "interfaces/mdm";
 import { IOSSettings, IHostMaintenanceWindow } from "interfaces/host";
+import { IAppleDeviceUpdates } from "interfaces/config";
 import getHostStatusTooltipText from "pages/hosts/helpers";
 
 import TooltipWrapper from "components/TooltipWrapper";
@@ -19,7 +20,12 @@ import StatusIndicator from "components/StatusIndicator";
 import IssuesIndicator from "pages/hosts/components/IssuesIndicator";
 import DiskSpaceIndicator from "pages/hosts/components/DiskSpaceIndicator";
 import { HumanTimeDiffWithFleetLaunchCutoff } from "components/HumanTimeDiffWithDateTip";
-import { humanHostMemory, wrapFleetHelper } from "utilities/helpers";
+import {
+  humanHostMemory,
+  wrapFleetHelper,
+  removeOSPrefix,
+  compareVersions,
+} from "utilities/helpers";
 import {
   DATE_FNS_FORMAT_STRINGS,
   DEFAULT_EMPTY_CELL_VALUE,
@@ -120,6 +126,7 @@ interface IHostSummaryProps {
   ) => void;
   renderActionDropdown: () => JSX.Element | null;
   deviceUser?: boolean;
+  osVersionRequirement?: IAppleDeviceUpdates;
   osSettings?: IOSSettings;
   hostMdmDeviceStatus?: HostMdmDeviceStatusUIState;
 }
@@ -178,6 +185,7 @@ const HostSummary = ({
   onRefetchHost,
   renderActionDropdown,
   deviceUser,
+  osVersionRequirement,
   osSettings,
   hostMdmDeviceStatus,
 }: IHostSummaryProps): JSX.Element => {
@@ -191,30 +199,29 @@ const HostSummary = ({
   const isIosOrIpadosHost = platform === "ios" || platform === "ipados";
 
   const renderRefetch = () => {
-    if (isIosOrIpadosHost) {
-      return null;
-    }
-
     const isOnline = summaryData.status === "online";
     let isDisabled = false;
-    let tooltip: React.ReactNode = <></>;
-
-    // deviceStatus can be `undefined` in the case of the MyDevice Page not sending
-    // this prop. When this is the case or when it is `unlocked`, we only take
-    // into account the host being online or offline for correctly render the
-    // refresh button. If we have a value for deviceStatus, we then need to also
-    // take it account for rendering the button.
-    if (
-      hostMdmDeviceStatus === undefined ||
-      hostMdmDeviceStatus === "unlocked"
-    ) {
-      isDisabled = !isOnline;
-      tooltip = !isOnline ? REFETCH_TOOLTIP_MESSAGES.offline : null;
-    } else {
-      isDisabled = true;
-      tooltip = !isOnline
-        ? REFETCH_TOOLTIP_MESSAGES.offline
-        : REFETCH_TOOLTIP_MESSAGES[hostMdmDeviceStatus];
+    let tooltip;
+
+    // we don't have a concept of "online" for iPads and iPhones, so always enable refetch
+    if (!isIosOrIpadosHost) {
+      // deviceStatus can be `undefined` in the case of the MyDevice Page not sending
+      // this prop. When this is the case or when it is `unlocked`, we only take
+      // into account the host being online or offline for correctly render the
+      // refresh button. If we have a value for deviceStatus, we then need to also
+      // take it account for rendering the button.
+      if (
+        hostMdmDeviceStatus === undefined ||
+        hostMdmDeviceStatus === "unlocked"
+      ) {
+        isDisabled = !isOnline;
+        tooltip = !isOnline ? REFETCH_TOOLTIP_MESSAGES.offline : null;
+      } else {
+        isDisabled = true;
+        tooltip = !isOnline
+          ? REFETCH_TOOLTIP_MESSAGES.offline
+          : REFETCH_TOOLTIP_MESSAGES[hostMdmDeviceStatus];
+      }
     }
 
     return (
@@ -312,6 +319,50 @@ const HostSummary = ({
     );
   };
 
+  const renderOperatingSystemSummary = () => {
+    // No tooltip if minimum version is not set, including all Windows, Linux, ChromeOS operating systems
+    if (!osVersionRequirement?.minimum_version) {
+      return (
+        <DataSet title="Operating system" value={summaryData.os_version} />
+      );
+    }
+
+    const osVersionWithoutPrefix = removeOSPrefix(summaryData.os_version);
+    const osVersionRequirementMet =
+      compareVersions(
+        osVersionWithoutPrefix,
+        osVersionRequirement.minimum_version
+      ) >= 0;
+
+    return (
+      <DataSet
+        title="Operating system"
+        value={
+          <>
+            {!osVersionRequirementMet && (
+              <Icon name="error-outline" color="ui-fleet-black-75" />
+            )}
+            <TooltipWrapper
+              tipContent={
+                osVersionRequirementMet ? (
+                  "Meets minimum version requirement."
+                ) : (
+                  <>
+                    Does not meet minimum version requirement.
+                    <br />
+                    Deadline to update: {osVersionRequirement.deadline}
+                  </>
+                )
+              }
+            >
+              {summaryData.os_version}
+            </TooltipWrapper>
+          </>
+        }
+      />
+    );
+  };
+
   const renderAgentSummary = () => {
     if (isChromeHost) {
       return <DataSet title="Agent" value={summaryData.osquery_version} />;
@@ -364,19 +415,20 @@ const HostSummary = ({
       DATE_FNS_FORMAT_STRINGS.dateAtTime
     );
 
-    const tip = timezone ? (
-      <>
-        End user&apos;s time zone:
-        <br />
-        (GMT{starts_at.slice(-6)}) {timezone.replace("_", " ")}
-      </>
-    ) : (
-      <>
-        End user&apos;s timezone unavailable.
-        <br />
-        Displaying in UTC.
-      </>
-    );
+    const tip =
+      timezone && timezone !== "UTC" ? (
+        <>
+          End user&apos;s time zone:
+          <br />
+          (GMT{starts_at.slice(-6)}) {timezone.replace("_", " ")}
+        </>
+      ) : (
+        <>
+          End user&apos;s timezone unavailable.
+          <br />
+          Displaying in UTC.
+        </>
+      );
 
     return (
       <DataSet
@@ -389,6 +441,7 @@ const HostSummary = ({
   };
 
   const renderSummary = () => {
+    console.log(hostMdmProfiles);
     // for windows hosts we have to manually add a profile for disk encryption
     // as this is not currently included in the `profiles` value from the API
     // response for windows hosts.
@@ -472,7 +525,7 @@ const HostSummary = ({
         {!isIosOrIpadosHost && (
           <DataSet title="Processor type" value={summaryData.cpu_type} />
         )}
-        <DataSet title="Operating system" value={summaryData.os_version} />
+        {renderOperatingSystemSummary()}
         {!isIosOrIpadosHost && renderAgentSummary()}
         {isPremiumTier &&
           // TODO - refactor normalizeEmptyValues pattern
diff --git a/frontend/pages/hosts/details/cards/HostSummary/OSSettingsIndicator/OSSettingsIndicator.tsx b/frontend/pages/hosts/details/cards/HostSummary/OSSettingsIndicator/OSSettingsIndicator.tsx
index bd129a20c5bb..60cc9c069b6d 100644
--- a/frontend/pages/hosts/details/cards/HostSummary/OSSettingsIndicator/OSSettingsIndicator.tsx
+++ b/frontend/pages/hosts/details/cards/HostSummary/OSSettingsIndicator/OSSettingsIndicator.tsx
@@ -1,12 +1,10 @@
 import React from "react";
-import ReactTooltip from "react-tooltip";
 
 import { IHostMdmProfile, MdmProfileStatus } from "interfaces/mdm";
 
 import Icon from "components/Icon";
 import Button from "components/buttons/Button";
 import { IconNames } from "components/icons";
-import { COLORS } from "styles/var/colors";
 
 const baseClass = "os-settings-indicator";
 
@@ -21,7 +19,6 @@ interface IStatusDisplayOption {
     IconNames,
     "success" | "success-outline" | "pending" | "pending-outline" | "error"
   >;
-  tooltipText: string;
 }
 type StatusDisplayOptions = Record<
   MdmProfileStatusForDisplay,
@@ -31,23 +28,15 @@ type StatusDisplayOptions = Record<
 const STATUS_DISPLAY_OPTIONS: StatusDisplayOptions = {
   Verified: {
     iconName: "success",
-    tooltipText: "These hosts applied all OS settings. Fleet verified.",
   },
   Verifying: {
     iconName: "success-outline",
-    tooltipText:
-      "The host acknowledged all MDM commands to apply OS settings. " +
-      "Fleet is verifying the OS settings are applied with osquery.",
   },
   Pending: {
     iconName: "pending-outline",
-    tooltipText:
-      "The host will receive MDM command to apply OS settings when the host comes online.",
   },
   Failed: {
     iconName: "error",
-    tooltipText:
-      "The host failed to apply the latest OS settings. Click to view error(s).",
   },
 };
 
@@ -128,31 +117,13 @@ const OSSettingsIndicator = ({
   return (
     <span className={`${baseClass} info-flex__data`}>
       <Icon name={statusDisplayOption.iconName} />
-      <span
-        className="tooltip tooltip__tooltip-icon"
-        data-tip
-        data-for={`${baseClass}-tooltip`}
-        data-tip-disable={false}
+      <Button
+        onClick={onClick}
+        variant="text-link"
+        className={`${baseClass}__button`}
       >
-        <Button
-          onClick={onClick}
-          variant="text-link"
-          className={`${baseClass}__button`}
-        >
-          {displayStatus}
-        </Button>
-      </span>
-      <ReactTooltip
-        place="bottom"
-        effect="solid"
-        backgroundColor={COLORS["tooltip-bg"]}
-        id={`${baseClass}-tooltip`}
-        data-html
-      >
-        <span className="tooltip__tooltip-text">
-          {statusDisplayOption.tooltipText}
-        </span>
-      </ReactTooltip>
+        {displayStatus}
+      </Button>
     </span>
   );
 };
diff --git a/frontend/pages/hosts/details/cards/Policies/_styles.scss b/frontend/pages/hosts/details/cards/Policies/_styles.scss
index e7d90c567660..2ee63c773238 100644
--- a/frontend/pages/hosts/details/cards/Policies/_styles.scss
+++ b/frontend/pages/hosts/details/cards/Policies/_styles.scss
@@ -22,7 +22,7 @@
       tbody {
         tr {
           .name__cell {
-            max-width: 0; // sets ellipses
+            max-width: 0; // sets ellipsis
           }
 
           .policy-link {
@@ -36,7 +36,7 @@
             }
           }
           .policy-info {
-            width: 100%; // sets ellipses
+            width: 100%; // sets ellipsis
             justify-content: left;
 
             .policy-info-text {
diff --git a/frontend/pages/hosts/details/cards/Software/HostSoftware.tsx b/frontend/pages/hosts/details/cards/Software/HostSoftware.tsx
index 6cf80111ac02..a8a7c7028459 100644
--- a/frontend/pages/hosts/details/cards/Software/HostSoftware.tsx
+++ b/frontend/pages/hosts/details/cards/Software/HostSoftware.tsx
@@ -2,7 +2,6 @@ import React, { useCallback, useContext, useMemo, useState } from "react";
 import { InjectedRouter } from "react-router";
 import { useQuery } from "react-query";
 import { AxiosError } from "axios";
-import { trimEnd, upperFirst } from "lodash";
 
 import hostAPI, {
   IGetHostSoftwareResponse,
@@ -12,21 +11,20 @@ import deviceAPI, {
   IDeviceSoftwareQueryKey,
   IGetDeviceSoftwareResponse,
 } from "services/entities/device_user";
-import { getErrorReason } from "interfaces/errors";
 import { IHostSoftware, ISoftware } from "interfaces/software";
-import { DEFAULT_USE_QUERY_OPTIONS, SUPPORT_LINK } from "utilities/constants";
+import { HostPlatform, isIPadOrIPhone } from "interfaces/platform";
+import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
 import { NotificationContext } from "context/notification";
 import { AppContext } from "context/app";
 
 import Card from "components/Card/Card";
 import DataError from "components/DataError";
 import Spinner from "components/Spinner";
-import EmptyTable from "components/EmptyTable";
-import CustomLink from "components/CustomLink";
 
 import { generateSoftwareTableHeaders as generateHostSoftwareTableConfig } from "./HostSoftwareTableConfig";
 import { generateSoftwareTableHeaders as generateDeviceSoftwareTableConfig } from "./DeviceSoftwareTableConfig";
 import HostSoftwareTable from "./HostSoftwareTable";
+import { getErrorMessage } from "./helpers";
 
 const baseClass = "software-card";
 
@@ -37,13 +35,13 @@ export interface ITableSoftware extends Omit<ISoftware, "vulnerabilities"> {
 interface IHostSoftwareProps {
   /** This is the host id or the device token */
   id: number | string;
+  platform?: HostPlatform;
   softwareUpdatedAt?: string;
-  isFleetdHost: boolean;
+  hostCanInstallSoftware: boolean;
   router: InjectedRouter;
   queryParams: ReturnType<typeof parseHostSoftwareQueryParams>;
   pathname: string;
   hostTeamId: number;
-  hostPlatform: string;
   onShowSoftwareDetails?: (software: IHostSoftware) => void;
   isSoftwareEnabled?: boolean;
   isMyDevicePage?: boolean;
@@ -61,6 +59,7 @@ export const parseHostSoftwareQueryParams = (queryParams: {
   order_key?: string;
   order_direction?: "asc" | "desc";
   vulnerable?: string;
+  available_for_install?: string;
 }) => {
   const searchQuery = queryParams?.query ?? DEFAULT_SEARCH_QUERY;
   const sortHeader = queryParams?.order_key ?? DEFAULT_SORT_HEADER;
@@ -70,6 +69,7 @@ export const parseHostSoftwareQueryParams = (queryParams: {
     : DEFAULT_PAGE;
   const pageSize = DEFAULT_PAGE_SIZE;
   const vulnerable = queryParams.vulnerable === "true";
+  const availableForInstall = queryParams.available_for_install === "true";
 
   return {
     page,
@@ -78,23 +78,26 @@ export const parseHostSoftwareQueryParams = (queryParams: {
     order_direction: sortDirection,
     per_page: pageSize,
     vulnerable,
+    available_for_install: availableForInstall,
   };
 };
 
 const HostSoftware = ({
   id,
+  platform,
   softwareUpdatedAt,
-  isFleetdHost,
+  hostCanInstallSoftware,
   router,
   queryParams,
   pathname,
   hostTeamId = 0,
-  hostPlatform,
   onShowSoftwareDetails,
   isSoftwareEnabled = false,
   isMyDevicePage = false,
 }: IHostSoftwareProps) => {
   const { renderFlash } = useContext(NotificationContext);
+  const vulnFilterAndNotSupported =
+    isIPadOrIPhone(platform ?? "") && queryParams.vulnerable;
   const {
     isGlobalAdmin,
     isGlobalMaintainer,
@@ -106,8 +109,6 @@ const HostSoftware = ({
     number | null
   >(null);
 
-  const isIosOrIpadOs = hostPlatform === "ipados" || hostPlatform === "ios";
-
   const {
     data: hostSoftwareRes,
     isLoading: hostSoftwareLoading,
@@ -133,7 +134,8 @@ const HostSoftware = ({
     },
     {
       ...DEFAULT_USE_QUERY_OPTIONS,
-      enabled: isSoftwareEnabled && !isMyDevicePage && !isIosOrIpadOs, // if disabled, we'll always show a generic "No software detected" message
+      enabled:
+        isSoftwareEnabled && !isMyDevicePage && !vulnFilterAndNotSupported,
       keepPreviousData: true,
       staleTime: 7000,
     }
@@ -162,7 +164,7 @@ const HostSoftware = ({
     ({ queryKey }) => deviceAPI.getDeviceSoftware(queryKey[0]),
     {
       ...DEFAULT_USE_QUERY_OPTIONS,
-      enabled: isSoftwareEnabled && isMyDevicePage, // if disabled, we'll always show a generic "No software detected" message
+      enabled: isSoftwareEnabled && isMyDevicePage, // if disabled, we'll always show a generic "No software detected" message. No DUP for iPad/iPhone
       keepPreviousData: true,
       staleTime: 7000,
     }
@@ -173,7 +175,7 @@ const HostSoftware = ({
     [isMyDevicePage, refetchDeviceSoftware, refetchHostSoftware]
   );
 
-  const canInstallSoftware = Boolean(
+  const userHasSWInstallPermission = Boolean(
     isGlobalAdmin || isGlobalMaintainer || isTeamAdmin || isTeamMaintainer
   );
 
@@ -187,17 +189,7 @@ const HostSoftware = ({
           "Software is installing or will install when the host comes online."
         );
       } catch (e) {
-        const reason = upperFirst(trimEnd(getErrorReason(e), "."));
-        if (reason.includes("fleetd installed")) {
-          renderFlash("error", `Couldn't install. ${reason}.`);
-        } else if (reason.includes("can be installed only on")) {
-          renderFlash(
-            "error",
-            `Couldn't install. ${reason.replace("darwin", "macOS")}.`
-          );
-        } else {
-          renderFlash("error", "Couldn't install. Please try again.");
-        }
+        renderFlash("error", getErrorMessage(e));
       }
       setInstallingSoftwareId(null);
       refetchSoftware();
@@ -227,19 +219,19 @@ const HostSoftware = ({
       : generateHostSoftwareTableConfig({
           router,
           installingSoftwareId,
-          canInstall: canInstallSoftware,
+          userHasSWInstallPermission,
           onSelectAction,
           teamId: hostTeamId,
-          isFleetdHost,
+          hostCanInstallSoftware,
         });
   }, [
     isMyDevicePage,
     router,
     installingSoftwareId,
-    canInstallSoftware,
+    userHasSWInstallPermission,
     onSelectAction,
     hostTeamId,
-    isFleetdHost,
+    hostCanInstallSoftware,
   ]);
 
   const isLoading = isMyDevicePage
@@ -250,26 +242,25 @@ const HostSoftware = ({
 
   const data = isMyDevicePage ? deviceSoftwareRes : hostSoftwareRes;
 
+  const getHostSoftwareFilterFromQueryParams = () => {
+    const { vulnerable, available_for_install } = queryParams;
+    if (available_for_install) {
+      return "installableSoftware";
+    }
+    if (vulnerable) {
+      return "vulnerableSoftware";
+    }
+    return "allSoftware";
+  };
+
   const renderHostSoftware = () => {
     if (isLoading) {
       return <Spinner />;
     }
-
-    if (isIosOrIpadOs) {
-      return (
-        <EmptyTable
-          header="Software is not supported for this host"
-          info={
-            <>
-              Interested in viewing software for{" "}
-              {hostPlatform === "ios" ? "iPhones" : "iPads"}?{" "}
-              <CustomLink url={SUPPORT_LINK} text="Let us know" newTab />
-            </>
-          }
-        />
-      );
+    // will never be the case - to handle `platform` typing discrepancy with DeviceUserPage
+    if (!platform) {
+      return null;
     }
-
     return (
       <>
         {isError && <DataError />}
@@ -278,7 +269,20 @@ const HostSoftware = ({
             isLoading={
               isMyDevicePage ? deviceSoftwareFetching : hostSoftwareFetching
             }
-            data={data}
+            // this could be cleaner, however, we are going to revert this commit anyway once vulns are
+            // supported for iPad/iPhone, by the end of next sprint
+            data={
+              vulnFilterAndNotSupported
+                ? ({
+                    count: 0,
+                    meta: {
+                      has_next_results: false,
+                      has_previous_results: false,
+                    },
+                  } as IGetHostSoftwareResponse)
+                : data
+            } // eshould be mpty for iPad/iPhone since API call is disabled, but to be sure to trigger empty state
+            platform={platform}
             router={router}
             tableConfig={tableConfig}
             sortHeader={queryParams.order_key}
@@ -286,7 +290,7 @@ const HostSoftware = ({
             searchQuery={queryParams.query}
             page={queryParams.page}
             pagePath={pathname}
-            vulnerable={queryParams.vulnerable}
+            hostSoftwareFilter={getHostSoftwareFilterFromQueryParams()}
             pathPrefix={pathname}
           />
         )}
diff --git a/frontend/pages/hosts/details/cards/Software/HostSoftwareTable/HostSoftwareTable.tsx b/frontend/pages/hosts/details/cards/Software/HostSoftwareTable/HostSoftwareTable.tsx
index e08058cfa64b..c3da51aafaf5 100644
--- a/frontend/pages/hosts/details/cards/Software/HostSoftwareTable/HostSoftwareTable.tsx
+++ b/frontend/pages/hosts/details/cards/Software/HostSoftwareTable/HostSoftwareTable.tsx
@@ -4,6 +4,16 @@ import { InjectedRouter } from "react-router";
 import { IGetHostSoftwareResponse } from "services/entities/hosts";
 import { IGetDeviceSoftwareResponse } from "services/entities/device_user";
 import { getNextLocationPath } from "utilities/helpers";
+import { QueryParams } from "utilities/url";
+
+import { IHostSoftwareDropdownFilterVal } from "pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers";
+
+import {
+  ApplePlatform,
+  APPLE_PLATFORM_DISPLAY_NAMES,
+  HostPlatform,
+  isIPadOrIPhone,
+} from "interfaces/platform";
 
 import TableContainer from "components/TableContainer";
 import { ITableQueryData } from "components/TableContainer/TableContainer";
@@ -12,30 +22,38 @@ import Dropdown from "components/forms/fields/Dropdown";
 
 import EmptySoftwareTable from "pages/SoftwarePage/components/EmptySoftwareTable";
 import TableCount from "components/TableContainer/TableCount";
+import { VulnsNotSupported } from "pages/SoftwarePage/components/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable";
 
 const DEFAULT_PAGE_SIZE = 20;
 
 const baseClass = "host-software-table";
 
-export const VULNERABLE_DROPDOWN_OPTIONS = [
+export const DROPDOWN_OPTIONS = [
   {
     disabled: false,
     label: "All software",
-    value: false,
+    value: "allSoftware",
     helpText: "All software installed on your hosts.",
   },
   {
     disabled: false,
     label: "Vulnerable software",
-    value: true,
+    value: "vulnerableSoftware",
     helpText:
       "All software installed on your hosts with detected vulnerabilities.",
   },
+  {
+    disabled: false,
+    label: "Available for install",
+    value: "installableSoftware",
+    helpText: "Software that can be installed on your hosts.",
+  },
 ] as const;
 
 interface IHostSoftwareTableProps {
   tableConfig: any; // TODO: type
   data?: IGetHostSoftwareResponse | IGetDeviceSoftwareResponse;
+  platform: HostPlatform;
   isLoading: boolean;
   router: InjectedRouter;
   sortHeader: string;
@@ -45,12 +63,13 @@ interface IHostSoftwareTableProps {
   pagePath: string;
   routeTemplate?: string;
   pathPrefix: string;
-  vulnerable?: boolean;
+  hostSoftwareFilter: IHostSoftwareDropdownFilterVal;
 }
 
 const HostSoftwareTable = ({
   tableConfig,
   data,
+  platform,
   isLoading,
   router,
   sortHeader,
@@ -60,38 +79,45 @@ const HostSoftwareTable = ({
   pagePath,
   routeTemplate,
   pathPrefix,
-  vulnerable,
+  hostSoftwareFilter,
 }: IHostSoftwareTableProps) => {
-  const handleVulnFilterDropdownChange = useCallback(
-    (isFilterVulnerable: boolean) => {
+  const handleFilterDropdownChange = useCallback(
+    (val: IHostSoftwareDropdownFilterVal) => {
+      const newParams: QueryParams = {
+        query: searchQuery,
+        order_key: sortHeader,
+        order_direction: sortDirection,
+        page: 0,
+      };
+
+      // mutually exclusive
+      if (val === "installableSoftware") {
+        newParams.available_for_install = true.toString();
+      } else if (val === "vulnerableSoftware") {
+        newParams.vulnerable = true.toString();
+      }
+
       const nextPath = getNextLocationPath({
         pathPrefix,
         routeTemplate,
-        queryParams: {
-          query: searchQuery,
-          order_key: sortHeader,
-          order_direction: sortDirection,
-          page: 0,
-          vulnerable: isFilterVulnerable.toString(),
-        },
+        queryParams: newParams,
       });
       router.replace(nextPath);
     },
     [pathPrefix, routeTemplate, router, searchQuery, sortDirection, sortHeader]
   );
 
-  const memoizedVulnFilterDropdown = useCallback(() => {
+  const memoizedFilterDropdown = useCallback(() => {
     return (
       <Dropdown
-        value={vulnerable}
-        className={`${baseClass}__vuln_dropdown`}
-        options={VULNERABLE_DROPDOWN_OPTIONS}
+        value={hostSoftwareFilter}
+        options={DROPDOWN_OPTIONS}
         searchable={false}
-        onChange={handleVulnFilterDropdownChange}
+        onChange={handleFilterDropdownChange}
         tableFilterDropdown
       />
     );
-  }, [handleVulnFilterDropdownChange, vulnerable]);
+  }, [handleFilterDropdownChange, hostSoftwareFilter]);
   const determineQueryParamChange = useCallback(
     (newTableQuery: ITableQueryData) => {
       const changedEntry = Object.entries(newTableQuery).find(([key, val]) => {
@@ -115,20 +141,16 @@ const HostSoftwareTable = ({
 
   const generateNewQueryParams = useCallback(
     (newTableQuery: ITableQueryData, changedParam: string) => {
-      const newQueryParam: Record<
-        string,
-        string | number | boolean | undefined
-      > = {
+      const newQueryParam: QueryParams = {
         query: newTableQuery.searchQuery,
         order_direction: newTableQuery.sortDirection,
         order_key: newTableQuery.sortHeader,
         page: changedParam === "pageIndex" ? newTableQuery.pageIndex : 0,
-        vulnerable,
       };
 
       return newQueryParam;
     },
-    [vulnerable]
+    []
   );
 
   // TODO: Look into useDebounceCallback with dependencies
@@ -155,7 +177,7 @@ const HostSoftwareTable = ({
     [determineQueryParamChange, pagePath, generateNewQueryParams, router]
   );
 
-  const count = data?.count || data?.software.length || 0;
+  const count = data?.count || data?.software?.length || 0;
   const isSoftwareNotDetected = count === 0 && searchQuery === "";
 
   const memoizedSoftwareCount = useCallback(() => {
@@ -167,13 +189,16 @@ const HostSoftwareTable = ({
   }, [count, isSoftwareNotDetected]);
 
   const memoizedEmptyComponent = useCallback(() => {
-    return (
-      <EmptySoftwareTable
-        isFilterVulnerable={vulnerable}
-        isNotDetectingSoftware={searchQuery === ""}
+    const vulnFilterAndNotSupported =
+      isIPadOrIPhone(platform) && hostSoftwareFilter === "vulnerableSoftware";
+    return vulnFilterAndNotSupported ? (
+      <VulnsNotSupported
+        platformText={APPLE_PLATFORM_DISPLAY_NAMES[platform as ApplePlatform]}
       />
+    ) : (
+      <EmptySoftwareTable noSearchQuery={searchQuery === ""} />
     );
-  }, [searchQuery, vulnerable]);
+  }, [hostSoftwareFilter, platform, searchQuery]);
 
   return (
     <div className={baseClass}>
@@ -191,7 +216,7 @@ const HostSoftwareTable = ({
         inputPlaceHolder="Search by name"
         onQueryChange={onQueryChange}
         emptyComponent={memoizedEmptyComponent}
-        customControl={memoizedVulnFilterDropdown}
+        customControl={memoizedFilterDropdown}
         showMarkAllPages={false}
         isAllPagesSelected={false}
         searchable
diff --git a/frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tsx b/frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tsx
index 1e8cd5fbb88a..31c8a03a2117 100644
--- a/frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tsx
+++ b/frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tsx
@@ -4,9 +4,12 @@ import { CellProps, Column } from "react-table";
 import { cloneDeep } from "lodash";
 
 import {
+  IHostAppStoreApp,
   IHostSoftware,
+  IHostSoftwarePackage,
   SoftwareInstallStatus,
   formatSoftwareType,
+  isIpadOrIphoneSoftwareSource,
 } from "interfaces/software";
 import {
   IHeaderProps,
@@ -45,22 +48,23 @@ type IInstalledVersionsCellProps = CellProps<
   IHostSoftware["installed_versions"]
 >;
 type IVulnerabilitiesCellProps = IInstalledVersionsCellProps;
-// type IActionsCellProps = CellProps<IHostSoftware, IHostSoftware["id"]>;
 
 const generateActions = ({
-  canInstall,
+  userHasSWInstallPermission,
+  hostCanInstallSoftware,
   installingSoftwareId,
-  isFleetdHost,
   softwareId,
   status,
-  packageToInstall,
+  software_package,
+  app_store_app,
 }: {
-  canInstall: boolean;
+  userHasSWInstallPermission: boolean;
+  hostCanInstallSoftware: boolean;
   installingSoftwareId: number | null;
-  isFleetdHost: boolean;
   softwareId: number;
   status: SoftwareInstallStatus | null;
-  packageToInstall?: string | null;
+  software_package: IHostSoftwarePackage | null;
+  app_store_app: IHostAppStoreApp | null;
 }) => {
   // this gives us a clean slate of the default actions so we can modify
   // the options.
@@ -73,14 +77,19 @@ const generateActions = ({
     throw new Error("Install action not found in default actions");
   }
 
-  // remove install if there is no package to install
-  if (!packageToInstall || !canInstall) {
+  const hasSoftwareToInstall = !!software_package || !!app_store_app;
+  // remove install if there is no package to install or if the software is already installed
+  if (
+    !hasSoftwareToInstall ||
+    !userHasSWInstallPermission ||
+    status === "installed"
+  ) {
     actions.splice(indexInstallAction, 1);
     return actions;
   }
 
-  // disable install option if not a fleetd host
-  if (!isFleetdHost) {
+  // disable install option if not a fleetd, iPad, or iOS host
+  if (!hostCanInstallSoftware) {
     actions[indexInstallAction].disabled = true;
     actions[indexInstallAction].tooltipContent =
       "To install software on this host, deploy the fleetd agent with --enable-scripts and refetch host vitals.";
@@ -97,9 +106,9 @@ const generateActions = ({
 };
 
 interface ISoftwareTableHeadersProps {
-  canInstall: boolean;
+  userHasSWInstallPermission: boolean;
+  hostCanInstallSoftware: boolean;
   installingSoftwareId: number | null;
-  isFleetdHost: boolean;
   router: InjectedRouter;
   teamId: number;
   onSelectAction: (software: IHostSoftware, action: string) => void;
@@ -108,9 +117,9 @@ interface ISoftwareTableHeadersProps {
 // NOTE: cellProps come from react-table
 // more info here https://react-table.tanstack.com/docs/api/useTable#cell-properties
 export const generateSoftwareTableHeaders = ({
-  canInstall,
+  userHasSWInstallPermission,
+  hostCanInstallSoftware,
   installingSoftwareId,
-  isFleetdHost,
   router,
   teamId,
   onSelectAction,
@@ -123,7 +132,7 @@ export const generateSoftwareTableHeaders = ({
       accessor: "name",
       disableSortBy: false,
       Cell: (cellProps: ITableStringCellProps) => {
-        const { id, name, source } = cellProps.row.original;
+        const { id, name, source, app_store_app } = cellProps.row.original;
 
         const softwareTitleDetailsPath = PATHS.SOFTWARE_TITLE_DETAILS(
           id.toString().concat(`?team_id=${teamId}`)
@@ -133,6 +142,7 @@ export const generateSoftwareTableHeaders = ({
           <SoftwareNameCell
             name={name}
             source={source}
+            iconUrl={app_store_app?.icon_url}
             path={softwareTitleDetailsPath}
             router={router}
           />
@@ -174,6 +184,9 @@ export const generateSoftwareTableHeaders = ({
       accessor: (originalRow) => originalRow.installed_versions,
       disableSortBy: true,
       Cell: (cellProps: IVulnerabilitiesCellProps) => {
+        if (isIpadOrIphoneSoftwareSource(cellProps.row.original.source)) {
+          return <TextCell value="Not supported" grey />;
+        }
         const vulnerabilities = getVulnerabilities(cellProps.cell.value ?? []);
         return <VulnerabilitiesCell vulnerabilities={vulnerabilities} />;
       },
@@ -188,18 +201,21 @@ export const generateSoftwareTableHeaders = ({
         const {
           id: softwareId,
           status,
-          package_available_for_install: packageToInstall,
+          software_package,
+          app_store_app,
         } = original;
+
         return (
           <DropdownCell
             placeholder="Actions"
             options={generateActions({
-              canInstall,
-              isFleetdHost,
+              userHasSWInstallPermission,
+              hostCanInstallSoftware,
               installingSoftwareId,
               softwareId,
               status,
-              packageToInstall,
+              software_package,
+              app_store_app,
             })}
             onChange={(action) => onSelectAction(original, action)}
           />
diff --git a/frontend/pages/hosts/details/cards/Software/InstallStatusCell/InstallStatusCell.tsx b/frontend/pages/hosts/details/cards/Software/InstallStatusCell/InstallStatusCell.tsx
index 8dfceee72116..ef5ac1b737fb 100644
--- a/frontend/pages/hosts/details/cards/Software/InstallStatusCell/InstallStatusCell.tsx
+++ b/frontend/pages/hosts/details/cards/Software/InstallStatusCell/InstallStatusCell.tsx
@@ -4,7 +4,6 @@ import ReactTooltip from "react-tooltip";
 import { uniqueId } from "lodash";
 
 import { IHostSoftware, SoftwareInstallStatus } from "interfaces/software";
-import { dateAgo } from "utilities/date_format";
 
 import Icon from "components/Icon";
 import TextCell from "components/TableContainer/DataTable/TextCell";
@@ -12,6 +11,12 @@ import TextCell from "components/TableContainer/DataTable/TextCell";
 const baseClass = "install-status-cell";
 
 type IStatusValue = SoftwareInstallStatus | "avaiableForInstall";
+interface TootipArgs {
+  softwareName?: string | null;
+  // this field is used in My device > Self-service
+  lastInstalledAt?: string;
+  isAppStoreApp?: boolean;
+}
 
 export type IStatusDisplayConfig = {
   iconName:
@@ -21,10 +26,7 @@ export type IStatusDisplayConfig = {
     | "install"
     | "install-self-service";
   displayText: string;
-  tooltip: (args: {
-    softwareName?: string | null;
-    lastInstalledAt?: string;
-  }) => ReactNode;
+  tooltip: (args: TootipArgs) => ReactNode;
 };
 
 export const INSTALL_STATUS_DISPLAY_OPTIONS: Record<
@@ -34,37 +36,41 @@ export const INSTALL_STATUS_DISPLAY_OPTIONS: Record<
   installed: {
     iconName: "success",
     displayText: "Installed",
-    tooltip: ({ lastInstalledAt: lastInstall }) => (
-      <>
-        Fleet installed software on these hosts. (
-        {dateAgo(lastInstall as string)})
-      </>
-    ),
+    tooltip: () =>
+      "Software is installed (install script finished with exit code 0).",
   },
   pending: {
     iconName: "pending-outline",
     displayText: "Pending",
-    tooltip: () => "Fleet will install software when the host comes online.",
+    tooltip: () =>
+      "Fleet is installing or will install when the host comes online.",
   },
   failed: {
     iconName: "error",
     displayText: "Failed",
-    tooltip: ({ lastInstalledAt: lastInstall }) => (
+    tooltip: () => (
       <>
-        Fleet failed to install software ({dateAgo(lastInstall as string)} ago).
-        Select <b>Actions &gt; Software details</b> to see more.
+        The host failed to install software. To view errors, select
+        <br />
+        <b>Actions &gt; Show details</b>.
       </>
     ),
   },
   avaiableForInstall: {
     iconName: "install",
     displayText: "Available for install",
-    tooltip: ({ softwareName }) => (
-      <>
-        {softwareName ? <b>{softwareName}</b> : "Software"} can be installed on
-        the host. Select <b>Actions {">"} Install</b> to install.
-      </>
-    ),
+    tooltip: ({ softwareName, isAppStoreApp }) =>
+      isAppStoreApp ? (
+        <>
+          App Store app can be installed on the host. Select{" "}
+          <b>Actions {">"} Install</b> to install.
+        </>
+      ) : (
+        <>
+          {softwareName ? <b>{softwareName}</b> : "Software"} can be installed
+          on the host. Select <b>Actions {">"} Install</b> to install.
+        </>
+      ),
   },
   selfService: {
     iconName: "install-self-service",
@@ -79,21 +85,25 @@ export const INSTALL_STATUS_DISPLAY_OPTIONS: Record<
   },
 };
 
+type IInstallStatusCellProps = IHostSoftware;
+
 const InstallStatusCell = ({
   status,
-  last_install,
-  package_available_for_install: softwareName,
-  self_service,
-}: IHostSoftware) => {
-  const lastInstalledAt = last_install?.installed_at;
+  software_package,
+  app_store_app,
+}: IInstallStatusCellProps) => {
+  // FIXME: Improve the way we handle polymophism of software_package and app_store_app
+  const hasPackage = !!software_package;
+  const hasAppStoreApp = !!app_store_app;
 
   let displayStatus: keyof typeof INSTALL_STATUS_DISPLAY_OPTIONS;
 
   if (status !== null) {
     displayStatus = status;
-  } else if (softwareName && self_service) {
+  } else if (software_package?.self_service) {
+    // currently only software packages can be self-service
     displayStatus = "selfService";
-  } else if (softwareName) {
+  } else if (hasPackage || hasAppStoreApp) {
     displayStatus = "avaiableForInstall";
   } else {
     return <TextCell value="---" grey italic />;
@@ -101,6 +111,7 @@ const InstallStatusCell = ({
 
   const displayConfig = INSTALL_STATUS_DISPLAY_OPTIONS[displayStatus];
   const tooltipId = uniqueId();
+  const softwareName = software_package?.name;
 
   return (
     <div className={`${baseClass}__status-content`}>
@@ -122,7 +133,7 @@ const InstallStatusCell = ({
         <span className={`${baseClass}__status-tooltip-text`}>
           {displayConfig.tooltip({
             softwareName,
-            lastInstalledAt,
+            isAppStoreApp: hasAppStoreApp,
           })}
         </span>
       </ReactTooltip>
diff --git a/frontend/pages/hosts/details/cards/Software/SelfService/SelfService.tests.tsx b/frontend/pages/hosts/details/cards/Software/SelfService/SelfService.tests.tsx
index 18179aa90dae..a7ca5e5cdd6c 100644
--- a/frontend/pages/hosts/details/cards/Software/SelfService/SelfService.tests.tsx
+++ b/frontend/pages/hosts/details/cards/Software/SelfService/SelfService.tests.tsx
@@ -6,7 +6,24 @@ import mockServer from "test/mock-server";
 import { customDeviceSoftwareHandler } from "test/handlers/device-handler";
 import { createMockDeviceSoftware } from "__mocks__/deviceUserMock";
 
-import SelfService from "./SelfService";
+import SelfService, { ISoftwareSelfServiceProps } from "./SelfService";
+
+const TEST_PROPS: ISoftwareSelfServiceProps = {
+  contactUrl: "http://example.com",
+  deviceToken: "123-456",
+  isSoftwareEnabled: true,
+  pathname: "/test",
+  queryParams: {
+    page: 1,
+    query: "",
+    order_key: "name",
+    order_direction: "asc",
+    per_page: 10,
+    vulnerable: true,
+    available_for_install: false,
+  },
+  router: createMockRouter(),
+};
 
 describe("SelfService", () => {
   it("should render the self service items correctly", async () => {
@@ -23,23 +40,7 @@ describe("SelfService", () => {
 
     const render = createCustomRenderer({ withBackendMock: true });
 
-    render(
-      <SelfService
-        contactUrl={"http://example.com"}
-        deviceToken={"123-456"}
-        isSoftwareEnabled
-        pathname={"/test"}
-        queryParams={{
-          page: 1,
-          query: "",
-          order_key: "name",
-          order_direction: "asc",
-          per_page: 10,
-          vulnerable: true,
-        }}
-        router={createMockRouter()}
-      />
-    );
+    render(<SelfService {...TEST_PROPS} />);
 
     // waiting for the device software data to render
     await screen.findByText("test1");
@@ -55,6 +56,27 @@ describe("SelfService", () => {
   it("should render the contact link text if contact url is provided", () => {
     mockServer.use(customDeviceSoftwareHandler());
 
+    const render = createCustomRenderer({ withBackendMock: true });
+    render(<SelfService {...TEST_PROPS} router={createMockRouter()} />);
+
+    expect(screen.getByText("reach out to IT")).toBeInTheDocument();
+    expect(screen.getByText("reach out to IT").getAttribute("href")).toBe(
+      "http://example.com"
+    );
+  });
+
+  it("renders 'Reinstall' action button with 'Installed' status", async () => {
+    mockServer.use(
+      customDeviceSoftwareHandler({
+        software: [
+          createMockDeviceSoftware({
+            name: "test-software",
+            status: "installed",
+          }),
+        ],
+      })
+    );
+
     const render = createCustomRenderer({ withBackendMock: true });
 
     const expectedUrl = "http://example.com";
@@ -72,14 +94,102 @@ describe("SelfService", () => {
           order_direction: "asc",
           per_page: 10,
           vulnerable: true,
+          available_for_install: false,
         }}
         router={createMockRouter()}
       />
     );
 
-    expect(screen.getByText("reach out to IT")).toBeInTheDocument();
-    expect(screen.getByText("reach out to IT").getAttribute("href")).toBe(
-      expectedUrl
+    // waiting for the device software data to render
+    await screen.findByText("test-software");
+
+    expect(
+      screen.getByTestId("self-service-item__status--test")
+    ).toHaveTextContent("Installed");
+
+    expect(
+      screen.getByTestId("self-service-item__item-action-button--test")
+    ).toHaveTextContent("Reinstall");
+  });
+
+  it("renders 'Retry' action button with 'Failed' status", async () => {
+    mockServer.use(
+      customDeviceSoftwareHandler({
+        software: [
+          createMockDeviceSoftware({
+            name: "test-software",
+            status: "failed",
+          }),
+        ],
+      })
+    );
+
+    const render = createCustomRenderer({ withBackendMock: true });
+    render(<SelfService {...TEST_PROPS} />);
+
+    // waiting for the device software data to render
+    await screen.findByText("test-software");
+
+    expect(
+      screen.getByTestId("self-service-item__status--test")
+    ).toHaveTextContent("Failed");
+
+    expect(
+      screen.getByTestId("self-service-item__item-action-button--test")
+    ).toHaveTextContent("Retry");
+  });
+
+  it("renders 'Install' action button with no status", async () => {
+    mockServer.use(
+      customDeviceSoftwareHandler({
+        software: [
+          createMockDeviceSoftware({
+            name: "test-software",
+            status: null,
+          }),
+        ],
+      })
+    );
+
+    const render = createCustomRenderer({ withBackendMock: true });
+    render(<SelfService {...TEST_PROPS} />);
+
+    // waiting for the device software data to render
+    await screen.findByText("test-software");
+
+    expect(
+      screen.queryByTestId("self-service-item__status--test")
+    ).not.toBeInTheDocument();
+
+    expect(
+      screen.getByTestId("self-service-item__item-action-button--test")
+    ).toHaveTextContent("Install");
+  });
+
+  it("renders no action button with 'Pending' status", async () => {
+    mockServer.use(
+      customDeviceSoftwareHandler({
+        software: [
+          createMockDeviceSoftware({
+            name: "test-software",
+            status: "pending",
+          }),
+        ],
+      })
     );
+
+    const render = createCustomRenderer({ withBackendMock: true });
+    render(<SelfService {...TEST_PROPS} />);
+
+    // waiting for the device software data to render
+    await screen.findByText("test-software");
+
+    expect(
+      screen.getByTestId("self-service-item__status--test")
+    ).toHaveTextContent("Pending");
+
+    expect(
+      screen.queryByTestId("self-service-item__item-action-button--test")
+    ).not.toBeInTheDocument();
   });
 });
diff --git a/frontend/pages/hosts/details/cards/Software/SelfService/SelfService.tsx b/frontend/pages/hosts/details/cards/Software/SelfService/SelfService.tsx
index dddc18c49e41..2a772a8e7532 100644
--- a/frontend/pages/hosts/details/cards/Software/SelfService/SelfService.tsx
+++ b/frontend/pages/hosts/details/cards/Software/SelfService/SelfService.tsx
@@ -32,7 +32,7 @@ const DEFAULT_SELF_SERVICE_QUERY_PARAMS = {
   self_service: true,
 } as const;
 
-interface ISoftwareSelfServiceProps {
+export interface ISoftwareSelfServiceProps {
   contactUrl: string;
   deviceToken: string;
   isSoftwareEnabled?: boolean;
@@ -122,8 +122,14 @@ const SoftwareSelfService = ({
                   </div>
                   <div className={`${baseClass}__items`}>
                     {data.software.map((s) => {
-                      // concatenating install_uuid so item updates with fresh data on refetch
-                      const key = `${s.id}${s.last_install?.install_uuid}`;
+                      let uuid =
+                        s.software_package?.last_install?.install_uuid ??
+                        s.app_store_app?.last_install?.command_uuid;
+                      if (!uuid) {
+                        uuid = "";
+                      }
+                      // concatenating uuid so item updates with fresh data on refetch
+                      const key = `${s.id}${uuid}`;
                       return (
                         <SelfServiceItem
                           key={key}
diff --git a/frontend/pages/hosts/details/cards/Software/SelfService/SelfServiceItem/SelfServiceItem.tsx b/frontend/pages/hosts/details/cards/Software/SelfService/SelfServiceItem/SelfServiceItem.tsx
index d04e235e663c..3d817c9d16c0 100644
--- a/frontend/pages/hosts/details/cards/Software/SelfService/SelfServiceItem/SelfServiceItem.tsx
+++ b/frontend/pages/hosts/details/cards/Software/SelfService/SelfServiceItem/SelfServiceItem.tsx
@@ -2,8 +2,10 @@ import React, { useCallback, useContext, useEffect, useRef } from "react";
 import ReactTooltip from "react-tooltip";
 
 import {
+  IAppLastInstall,
   IDeviceSoftware,
   IHostSoftware,
+  ISoftwareLastInstall,
   SoftwareInstallStatus,
 } from "interfaces/software";
 import deviceApi from "services/entities/device_user";
@@ -23,24 +25,21 @@ const STATUS_CONFIG: Record<SoftwareInstallStatus, IStatusDisplayConfig> = {
   installed: {
     iconName: "success",
     displayText: "Installed",
-    tooltip: ({ lastInstalledAt }) => (
-      <>
-        Software installed successfully ({dateAgo(lastInstalledAt as string)}).
-      </>
-    ),
+    tooltip: ({ lastInstalledAt }) =>
+      `Software is installed (${dateAgo(lastInstalledAt as string)}).`,
   },
   pending: {
     iconName: "pending-outline",
-    displayText: "Install in progress...",
-    tooltip: () => "Software installation in progress...",
+    displayText: "Pending",
+    tooltip: () => "Fleet is installing software.",
   },
   failed: {
     iconName: "error",
     displayText: "Failed",
     tooltip: ({ lastInstalledAt = "" }) => (
       <>
-        Software failed to install
-        {lastInstalledAt ? `(${dateAgo(lastInstalledAt)})` : ""}. Select{" "}
+        Software failed to install{" "}
+        {lastInstalledAt ? ` (${dateAgo(lastInstalledAt)})` : ""}. Select{" "}
         <b>Retry</b> to install again, or contact your IT department.
       </>
     ),
@@ -52,28 +51,38 @@ interface IInstallerInfoProps {
 }
 
 const InstallerInfo = ({ software }: IInstallerInfoProps) => {
-  const { name, source, package: installerPackage } = software;
+  const {
+    name,
+    source,
+    software_package: installerPackage,
+    app_store_app: vppApp,
+  } = software;
   return (
     <div className={`${baseClass}__item-topline`}>
       <div className={`${baseClass}__item-icon`}>
-        <SoftwareIcon name={name} source={source} size="medium_large" />
+        <SoftwareIcon
+          url={vppApp?.icon_url}
+          name={name}
+          source={source}
+          size="large"
+        />
       </div>
       <div className={`${baseClass}__item-name-version`}>
         <div className={`${baseClass}__item-name`}>
           {name || installerPackage?.name}
         </div>
         <div className={`${baseClass}__item-version`}>
-          {installerPackage?.version || ""}
+          {installerPackage?.version || vppApp?.version || ""}
         </div>
       </div>
     </div>
   );
 };
 
-type IInstallerStatusProps = Pick<
-  IHostSoftware,
-  "id" | "status" | "last_install"
->;
+// TODO: update if/when we support self-service app store apps
+type IInstallerStatusProps = Pick<IHostSoftware, "id" | "status"> & {
+  last_install: ISoftwareLastInstall | IAppLastInstall | null;
+};
 
 const InstallerStatus = ({
   id,
@@ -94,7 +103,9 @@ const InstallerStatus = ({
         data-for={`install-tooltip__${id}`}
       >
         <Icon name={displayConfig.iconName} />
-        <span>{displayConfig.displayText}</span>
+        <span data-testid={`${baseClass}__status--test`}>
+          {displayConfig.displayText}
+        </span>
       </div>
       <ReactTooltip
         className={`${baseClass}__status-tooltip`}
@@ -119,23 +130,38 @@ interface IInstallerStatusActionProps {
   onInstall: () => void;
 }
 
+const getInstallButtonText = (status: SoftwareInstallStatus | null) => {
+  switch (status) {
+    case null:
+      return "Install";
+    case "failed":
+      return "Retry";
+    case "installed":
+      return "Reinstall";
+    default:
+      return "";
+  }
+};
+
 const InstallerStatusAction = ({
   deviceToken,
-  software: { id, status, last_install },
+  software: { id, status, software_package, app_store_app },
   onInstall,
 }: IInstallerStatusActionProps) => {
   const { renderFlash } = useContext(NotificationContext);
 
+  // TODO: update this if/when we support self-service app store apps
+  const last_install =
+    software_package?.last_install ?? app_store_app?.last_install ?? null;
+
   // localStatus is used to track the status of the any user-initiated install action
   const [localStatus, setLocalStatus] = React.useState<
     SoftwareInstallStatus | undefined
   >(undefined);
 
-  // displayStatus allows us to display the localStatus (if any) or the status from the list
-  // software reponse
-  const displayStatus = localStatus || status;
+  const installButtonText = getInstallButtonText(status);
 
-  // if the localStatus is "failed", we don't our tooltip to include the old installed_at date so we
+  // if the localStatus is "failed", we don't want our tooltip to include the old installed_at date so we
   // set this to null, which tells the tooltip to omit the parenthetical date
   const lastInstall = localStatus === "failed" ? null : last_install;
 
@@ -165,23 +191,20 @@ const InstallerStatusAction = ({
   return (
     <div className={`${baseClass}__item-status-action`}>
       <div className={`${baseClass}__item-status`}>
-        <InstallerStatus
-          id={id}
-          status={displayStatus}
-          last_install={lastInstall}
-        />
+        <InstallerStatus id={id} status={status} last_install={lastInstall} />
       </div>
       <div className={`${baseClass}__item-action`}>
-        {(displayStatus === "failed" || displayStatus === null) && (
+        {!!installButtonText && (
           <Button
             variant="text-icon"
             type="button"
-            className={`${baseClass}__item-action-button${
-              localStatus === "pending" ? "--installing" : ""
-            }`}
+            className={`${baseClass}__item-action-button`}
             onClick={onClick}
+            disabled={localStatus === "pending"}
           >
-            {displayStatus === "failed" ? "Retry" : "Install"}
+            <span data-testid={`${baseClass}__item-action-button--test`}>
+              {installButtonText}
+            </span>
           </Button>
         )}
       </div>
diff --git a/frontend/pages/hosts/details/cards/Software/SelfService/SelfServiceItem/_styles.scss b/frontend/pages/hosts/details/cards/Software/SelfService/SelfServiceItem/_styles.scss
index 56d357f7981e..eb21c7d118a8 100644
--- a/frontend/pages/hosts/details/cards/Software/SelfService/SelfServiceItem/_styles.scss
+++ b/frontend/pages/hosts/details/cards/Software/SelfService/SelfServiceItem/_styles.scss
@@ -21,8 +21,6 @@
 
   &__item-icon {
     display: flex;
-    height: 64px;
-    min-width: 64px;
   }
 
   &__item-name-version {
@@ -89,9 +87,5 @@
 
   &__item-action-button {
     height: auto;
-
-    &--installing {
-      display: none;
-    }
   }
 }
diff --git a/frontend/pages/hosts/details/cards/Software/SoftwareDetailsModal/SoftwareDetailsModal.tsx b/frontend/pages/hosts/details/cards/Software/SoftwareDetailsModal/SoftwareDetailsModal.tsx
index ba20637ce4b9..2fff0a4fb4d5 100644
--- a/frontend/pages/hosts/details/cards/Software/SoftwareDetailsModal/SoftwareDetailsModal.tsx
+++ b/frontend/pages/hosts/details/cards/Software/SoftwareDetailsModal/SoftwareDetailsModal.tsx
@@ -5,6 +5,8 @@ import {
   IHostSoftware,
   ISoftwareInstallVersion,
   formatSoftwareType,
+  hasHostSoftwareAppLastInstall,
+  hasHostSoftwarePackageLastInstall,
 } from "interfaces/software";
 
 import Modal from "components/Modal";
@@ -13,7 +15,9 @@ import Button from "components/buttons/Button";
 import DataSet from "components/DataSet";
 import { dateAgo } from "utilities/date_format";
 
-import { SoftwareInstallDetails } from "pages/SoftwarePage/components/SoftwareInstallDetails";
+import { AppInstallDetails } from "components/ActivityDetails/InstallDetails/AppInstallDetails";
+import { SoftwareInstallDetails } from "components/ActivityDetails/InstallDetails/SoftwareInstallDetails";
+import TooltipTruncatedText from "components/TooltipTruncatedText";
 
 const baseClass = "software-details-modal";
 
@@ -67,7 +71,7 @@ const SoftwareDetailsInfo = ({
             value={
               <div className={`${baseClass}__file-path-values`}>
                 {installed_paths.map((path) => (
-                  <span key={path}>{path}</span>
+                  <TooltipTruncatedText value={path} />
                 ))}
               </div>
             }
@@ -87,69 +91,118 @@ const SoftwareDetailsInfo = ({
 };
 
 interface ISoftwareDetailsModalProps {
+  hostDisplayName: string;
   software: IHostSoftware;
   onExit: () => void;
 }
 
-const SoftwareDetailsModal = ({
+const SoftwareDetailsContent = ({
   software,
-  onExit,
-}: ISoftwareDetailsModalProps) => {
-  const installUuid = software.last_install?.install_uuid || "";
-
-  const renderSoftwareDetails = () => {
-    const { installed_versions } = software;
-
-    // special case when we dont have installed versions. We can only show the
-    // software type atm.
-    if (!installed_versions || installed_versions.length === 0) {
-      return (
-        <div className={`${baseClass}__software-details`}>
-          <DataSet
-            title="Type"
-            value={formatSoftwareType({ source: software.source })}
-          />
-        </div>
-      );
-    }
+}: Pick<ISoftwareDetailsModalProps, "software">) => {
+  const { installed_versions } = software;
 
+  // special case when we dont have installed versions. We can only show the
+  // software type atm.
+  if (!installed_versions || installed_versions.length === 0) {
     return (
       <div className={`${baseClass}__software-details`}>
-        {installed_versions?.map((installedVersion) => {
-          return (
-            <SoftwareDetailsInfo
-              key={installedVersion.version}
-              installedVersion={installedVersion}
-              source={software.source}
-              bundleIdentifier={software.bundle_identifier}
-            />
-          );
-        })}
+        <DataSet
+          title="Type"
+          value={formatSoftwareType({ source: software.source })}
+        />
       </div>
     );
-  };
+  }
 
-  const renderTabs = () => {
+  return (
+    <div className={`${baseClass}__software-details`}>
+      {installed_versions?.map((installedVersion) => {
+        return (
+          <SoftwareDetailsInfo
+            key={installedVersion.version}
+            installedVersion={installedVersion}
+            source={software.source}
+            bundleIdentifier={software.bundle_identifier}
+          />
+        );
+      })}
+    </div>
+  );
+};
+
+const InstallDetailsContent = ({
+  hostDisplayName,
+  software,
+}: {
+  hostDisplayName: string;
+  software: IHostSoftware;
+}) => {
+  if (hasHostSoftwareAppLastInstall(software)) {
     return (
-      <TabsWrapper>
-        <Tabs>
-          <TabList>
-            <Tab>Software details</Tab>
-            <Tab>Install Details</Tab>
-          </TabList>
-          <TabPanel>{renderSoftwareDetails()}</TabPanel>
-          <TabPanel>
-            <SoftwareInstallDetails installUuid={installUuid} />
-          </TabPanel>
-        </Tabs>
-      </TabsWrapper>
+      <AppInstallDetails
+        command_uuid={software.app_store_app.last_install.command_uuid}
+        host_display_name={hostDisplayName}
+        software_title={software.name}
+        status={software.status || undefined} // FIXME: we have a type mismatch here; as a workaroud this will coerce null to undefined, which in turn defaults to "pending"
+      />
     );
-  };
+  } else if (hasHostSoftwarePackageLastInstall(software)) {
+    return (
+      <SoftwareInstallDetails
+        install_uuid={software.software_package.last_install.install_uuid}
+        host_display_name={hostDisplayName}
+      />
+    );
+  }
+
+  // caller should ensure this nevers happen
+  return null;
+};
+
+const TabsContent = ({
+  hostDisplayName,
+  software,
+}: {
+  hostDisplayName: string;
+  software: IHostSoftware;
+}) => {
+  return (
+    <TabsWrapper>
+      <Tabs>
+        <TabList>
+          <Tab>Software details</Tab>
+          <Tab>Install details</Tab>
+        </TabList>
+        <TabPanel>
+          <SoftwareDetailsContent software={software} />
+        </TabPanel>
+        <TabPanel>
+          <InstallDetailsContent
+            hostDisplayName={hostDisplayName}
+            software={software}
+          />
+        </TabPanel>
+      </Tabs>
+    </TabsWrapper>
+  );
+};
 
+const SoftwareDetailsModal = ({
+  hostDisplayName,
+  software,
+  onExit,
+}: ISoftwareDetailsModalProps) => {
+  const hasLastInstall =
+    hasHostSoftwarePackageLastInstall(software) ||
+    hasHostSoftwareAppLastInstall(software);
   return (
     <Modal title={software.name} className={baseClass} onExit={onExit}>
       <>
-        {software.last_install ? renderTabs() : renderSoftwareDetails()}
+        {!hasLastInstall ? (
+          <SoftwareDetailsContent software={software} />
+        ) : (
+          <TabsContent hostDisplayName={hostDisplayName} software={software} />
+        )}
         <div className="modal-cta-wrap">
           <Button type="submit" variant="brand" onClick={onExit}>
             Done
diff --git a/frontend/pages/hosts/details/cards/Software/_styles.scss b/frontend/pages/hosts/details/cards/Software/_styles.scss
index fa395ddd79c7..a87305760ad1 100644
--- a/frontend/pages/hosts/details/cards/Software/_styles.scss
+++ b/frontend/pages/hosts/details/cards/Software/_styles.scss
@@ -5,7 +5,7 @@
 
   .host-software-table {
     .controls {
-      // vulnerable software dropdown filter
+      // software filter
       .Select {
         .Select-menu-outer {
           width: 364px;
diff --git a/frontend/pages/hosts/details/cards/Software/helpers.tsx b/frontend/pages/hosts/details/cards/Software/helpers.tsx
new file mode 100644
index 000000000000..2020a1487090
--- /dev/null
+++ b/frontend/pages/hosts/details/cards/Software/helpers.tsx
@@ -0,0 +1,45 @@
+import React from "react";
+import { getErrorReason } from "interfaces/errors";
+import { trimEnd, upperFirst } from "lodash";
+
+const INSTALL_SOFTWARE_ERROR_PREFIX = "Couldn't install.";
+const DEFAULT_ERROR_MESSAGE = `${INSTALL_SOFTWARE_ERROR_PREFIX} Please try again.`;
+
+const createOnlyInstallableOnMacOSMessage = (reason: string) =>
+  `Couldn't install. ${reason.replace("darwin", "macOS")}.`;
+
+const createVPPTokenExpiredMessage = () => (
+  <>
+    {INSTALL_SOFTWARE_ERROR_PREFIX} VPP token expired. Go to{" "}
+    <b>
+      Settings {">"} Integration {">"} Volume Purchasing Program
+    </b>{" "}
+    and renew token.
+  </>
+);
+
+// determines if we want to show the API message as is to the user.
+const showAPIMessage = (message: string) => {
+  return (
+    message.includes("MDM is turned off") ||
+    message.includes("No available licenses") ||
+    message.includes("Software title is not available for install")
+  );
+};
+
+// eslint-disable-next-line import/prefer-default-export
+export const getErrorMessage = (e: unknown) => {
+  const reason = upperFirst(trimEnd(getErrorReason(e), "."));
+
+  if (reason.includes("fleetd installed")) {
+    return `${INSTALL_SOFTWARE_ERROR_PREFIX}. ${reason}.`;
+  } else if (reason.includes("can be installed only on")) {
+    return createOnlyInstallableOnMacOSMessage(reason);
+  } else if (reason.includes("VPP token expired")) {
+    return createVPPTokenExpiredMessage();
+  } else if (showAPIMessage(reason)) {
+    return reason;
+  }
+
+  return DEFAULT_ERROR_MESSAGE;
+};
diff --git a/frontend/pages/policies/ManagePoliciesPage/ManagePoliciesPage.tsx b/frontend/pages/policies/ManagePoliciesPage/ManagePoliciesPage.tsx
index bc0d9765b776..e4b97e18d124 100644
--- a/frontend/pages/policies/ManagePoliciesPage/ManagePoliciesPage.tsx
+++ b/frontend/pages/policies/ManagePoliciesPage/ManagePoliciesPage.tsx
@@ -49,6 +49,8 @@ import AddPolicyModal from "./components/AddPolicyModal";
 import DeletePolicyModal from "./components/DeletePolicyModal";
 import CalendarEventsModal from "./components/CalendarEventsModal";
 import { ICalendarEventsFormData } from "./components/CalendarEventsModal/CalendarEventsModal";
+import InstallSoftwareModal from "./components/InstallSoftwareModal";
+import { IInstallSoftwareFormData } from "./components/InstallSoftwareModal/InstallSoftwareModal";
 
 interface IManagePoliciesPageProps {
   router: InjectedRouter;
@@ -85,7 +87,6 @@ const ManagePolicyPage = ({
     isOnGlobalTeam,
     isFreeTier,
     isPremiumTier,
-    isSandboxMode,
     setConfig,
     setFilteredPoliciesPath,
     filteredPoliciesPath,
@@ -128,12 +129,19 @@ const ManagePolicyPage = ({
   const [isUpdatingCalendarEvents, setIsUpdatingCalendarEvents] = useState(
     false
   );
+  const [
+    isUpdatingPolicySoftwareInstall,
+    setIsUpdatingPolicySoftwareInstall,
+  ] = useState(false);
   const [isUpdatingOtherWorkflows, setIsUpdatingOtherWorkflows] = useState(
     false
   );
   const [selectedPolicyIds, setSelectedPolicyIds] = useState<number[]>([]);
   const [showAddPolicyModal, setShowAddPolicyModal] = useState(false);
   const [showDeletePolicyModal, setShowDeletePolicyModal] = useState(false);
+  const [showInstallSoftwareModal, setShowInstallSoftwareModal] = useState(
+    false
+  );
   const [showCalendarEventsModal, setShowCalendarEventsModal] = useState(false);
   const [showOtherWorkflowsModal, setShowOtherWorkflowsModal] = useState(false);
   const [
@@ -439,6 +447,10 @@ const ManagePolicyPage = ({
   const toggleDeletePolicyModal = () =>
     setShowDeletePolicyModal(!showDeletePolicyModal);
 
+  const toggleInstallSoftwareModal = () => {
+    setShowInstallSoftwareModal(!showInstallSoftwareModal);
+  };
+
   const toggleCalendarEventsModal = () => {
     setShowCalendarEventsModal(!showCalendarEventsModal);
   };
@@ -448,6 +460,9 @@ const ManagePolicyPage = ({
       case "calendar_events":
         toggleCalendarEventsModal();
         break;
+      case "install_software":
+        toggleInstallSoftwareModal();
+        break;
       case "other_workflows":
         toggleOtherWorkflowsModal();
         break;
@@ -477,6 +492,63 @@ const ManagePolicyPage = ({
     }
   };
 
+  const onUpdatePolicySoftwareInstall = async (
+    formData: IInstallSoftwareFormData
+  ) => {
+    try {
+      setIsUpdatingPolicySoftwareInstall(true);
+      const changedPolicies = formData.filter((formPolicy) => {
+        const prevPolicyState = policiesAvailableToAutomate.find(
+          (policy) => policy.id === formPolicy.id
+        );
+
+        const turnedOff =
+          prevPolicyState?.install_software !== undefined &&
+          formPolicy.installSoftwareEnabled === false;
+
+        const turnedOn =
+          prevPolicyState?.install_software === undefined &&
+          formPolicy.installSoftwareEnabled === true;
+
+        const updatedSwId =
+          prevPolicyState?.install_software?.software_title_id !== undefined &&
+          formPolicy.swIdToInstall !==
+            prevPolicyState?.install_software?.software_title_id;
+
+        return turnedOff || turnedOn || updatedSwId;
+      });
+      if (!changedPolicies.length) {
+        renderFlash("success", "No changes detected.");
+        return;
+      }
+      const responses: Promise<
+        ReturnType<typeof teamPoliciesAPI.update>
+      >[] = [];
+      responses.concat(
+        changedPolicies.map((changedPolicy) => {
+          return teamPoliciesAPI.update(changedPolicy.id, {
+            // "software_title_id:" 0 will unset software install for the policy
+            // "software_title_id": X will set the value to the given integer (except 0).
+            software_title_id: changedPolicy.swIdToInstall || 0,
+            team_id: teamIdForApi,
+          });
+        })
+      );
+      await Promise.all(responses);
+      await wait(100); // prevent race
+      refetchTeamPolicies();
+      renderFlash("success", "Successfully updated policy automations.");
+    } catch {
+      renderFlash(
+        "error",
+        "Could not update policy automations. Please try again."
+      );
+    } finally {
+      toggleInstallSoftwareModal();
+      setIsUpdatingPolicySoftwareInstall(false);
+    }
+  };
+
   const onUpdateCalendarEvents = async (formData: ICalendarEventsFormData) => {
     setIsUpdatingCalendarEvents(true);
 
@@ -699,11 +771,20 @@ const ManagePolicyPage = ({
 
   const getAutomationsDropdownOptions = () => {
     const isAllTeams = teamIdForApi === undefined || teamIdForApi === -1;
-    let disabledTooltipContent: React.ReactNode;
+    let disabledInstallTooltipContent: React.ReactNode;
+    let disabledCalendarTooltipContent: React.ReactNode;
     if (!isPremiumTier) {
-      disabledTooltipContent = "Available in Fleet Premium.";
+      disabledInstallTooltipContent = "Available in Fleet Premium.";
+      disabledCalendarTooltipContent = "Available in Fleet Premium.";
     } else if (isAllTeams) {
-      disabledTooltipContent = (
+      disabledInstallTooltipContent = (
+        <>
+          Select a team to manage
+          <br />
+          install software automation.
+        </>
+      );
+      disabledCalendarTooltipContent = (
         <>
           Select a team to manage
           <br />
@@ -716,9 +797,16 @@ const ManagePolicyPage = ({
       {
         label: "Calendar events",
         value: "calendar_events",
-        disabled: !isPremiumTier || isAllTeams,
+        disabled: !!disabledCalendarTooltipContent,
         helpText: "Automatically reserve time to resolve failing policies.",
-        tooltipContent: disabledTooltipContent,
+        tooltipContent: disabledCalendarTooltipContent,
+      },
+      {
+        label: "Install software",
+        value: "install_software",
+        disabled: !!disabledInstallTooltipContent,
+        helpText: "Install software to resolve failing policies.",
+        tooltipContent: disabledInstallTooltipContent,
       },
       {
         label: "Other workflows",
@@ -748,7 +836,6 @@ const ManagePolicyPage = ({
                       currentUserTeams={userTeams || []}
                       selectedTeamId={currentTeamId}
                       onChange={onTeamChange}
-                      isSandboxMode={isSandboxMode}
                     />
                   )}
                 {isPremiumTier &&
@@ -818,6 +905,16 @@ const ManagePolicyPage = ({
             onSubmit={onDeletePolicySubmit}
           />
         )}
+        {showInstallSoftwareModal && (
+          <InstallSoftwareModal
+            onExit={toggleInstallSoftwareModal}
+            onSubmit={onUpdatePolicySoftwareInstall}
+            isUpdating={isUpdatingPolicySoftwareInstall}
+            policies={policiesAvailableToAutomate}
+            // currentTeamId will at this point be present
+            teamId={currentTeamId ?? 0}
+          />
+        )}
         {showCalendarEventsModal && (
           <CalendarEventsModal
             onExit={toggleCalendarEventsModal}
diff --git a/frontend/pages/policies/ManagePoliciesPage/_styles.scss b/frontend/pages/policies/ManagePoliciesPage/_styles.scss
index ca0978671dd2..a9300ee34b1c 100644
--- a/frontend/pages/policies/ManagePoliciesPage/_styles.scss
+++ b/frontend/pages/policies/ManagePoliciesPage/_styles.scss
@@ -21,9 +21,6 @@
     .Select > .Select-menu-outer {
       left: -186px;
       width: 360px;
-      .dropdown__help-text {
-        color: $ui-fleet-black-50;
-      }
     }
     .Select-control {
       margin-top: 0;
@@ -223,7 +220,7 @@
     }
   }
 
-  // Used in both CalendarEventsModal and OtherWorkflowsModal
+  // Used in CalendarEventsModal, InstallSoftwareModal, and OtherWorkflowsModal
   .automated-policies-section {
     display: flex;
     flex-direction: column;
@@ -231,16 +228,39 @@
     align-self: stretch;
     border-radius: 4px;
     border: 1px solid $ui-fleet-black-10;
+    // negate ul padding
+    padding-left: 0;
 
-    .checkbox-row {
+    .policy-row {
       display: flex;
+      max-width: 100%;
       padding: 8px 12px;
       justify-content: space-between;
       align-items: center;
       align-self: stretch;
       border-bottom: 1px solid $ui-fleet-black-10;
+      gap: 20px;
+
+      .form-field--checkbox {
+        flex: 1 1 0%; /* This allows growing and shrinking */
+        min-width: 0; /* This is crucial for proper shrinking */
+      }
+
+      .fleet-checkbox__tick {
+        flex: 0 0 auto; /* This prevents growing and shrinking */
+        width: fit-content; /* This ensures button isn't cut off */
+      }
+
+      .fleet-checkbox__label {
+        display: flex;
+        white-space: nowrap;
+        flex: 1 1 0%; /* This allows growing and shrinking */
+        min-width: 0; /* This is crucial for proper shrinking */
+      }
 
       &__preview-button {
+        flex: 0 0 auto; /* This prevents growing and shrinking */
+        width: fit-content; /* This ensures button isn't cut off */
         visibility: hidden;
       }
 
@@ -252,7 +272,7 @@
           cursor: pointer;
         }
 
-        .checkbox-row__preview-button {
+        .policy-row__preview-button {
           visibility: visible;
         }
       }
diff --git a/frontend/pages/policies/ManagePoliciesPage/components/AddPolicyModal/_styles.scss b/frontend/pages/policies/ManagePoliciesPage/components/AddPolicyModal/_styles.scss
index 924a16b0d8ef..c1cfe99bb9ab 100644
--- a/frontend/pages/policies/ManagePoliciesPage/components/AddPolicyModal/_styles.scss
+++ b/frontend/pages/policies/ManagePoliciesPage/components/AddPolicyModal/_styles.scss
@@ -1,17 +1,25 @@
 .add-policy-modal {
   height: 90%;
   overflow: hidden;
-  min-height: 460px;
-  max-height: fit-content;
+
+  // we have to reach into the modal component classes to style the content
+  // correctly. This is because this modal always has a fixed height and
+  // the content is scrollable.
+  .modal__content-wrapper {
+    height: 95%;
+  }
 
   .modal__content {
-    height: 90%;
-    overflow: scroll;
+    height: 100%;
     display: flex;
     flex-direction: column;
     gap: $pad-large;
   }
 
+  &__policy-selection {
+    overflow-y: auto;
+  }
+
   .Select-multi-value-wrapper {
     display: flex;
   }
diff --git a/frontend/pages/policies/ManagePoliciesPage/components/CalendarEventPreviewModal/CalendarEventPreviewModal.tsx b/frontend/pages/policies/ManagePoliciesPage/components/CalendarEventPreviewModal/CalendarEventPreviewModal.tsx
index f6b5379675ec..0199d029c927 100644
--- a/frontend/pages/policies/ManagePoliciesPage/components/CalendarEventPreviewModal/CalendarEventPreviewModal.tsx
+++ b/frontend/pages/policies/ManagePoliciesPage/components/CalendarEventPreviewModal/CalendarEventPreviewModal.tsx
@@ -51,7 +51,7 @@ const CalendarEventPreviewModal = ({
                 💻 🚫 Scheduled maintenance
               </div>
               <div className={`${baseClass}__preview-header__time`}>
-                <span>Friday, April 5</span>
+                <span>Tuesday, June 18</span>
                 <span>⋅</span>
                 <span>5-5:30pm</span>
               </div>
diff --git a/frontend/pages/policies/ManagePoliciesPage/components/CalendarEventsModal/CalendarEventsModal.tsx b/frontend/pages/policies/ManagePoliciesPage/components/CalendarEventsModal/CalendarEventsModal.tsx
index b2746d425778..3e2a9167899a 100644
--- a/frontend/pages/policies/ManagePoliciesPage/components/CalendarEventsModal/CalendarEventsModal.tsx
+++ b/frontend/pages/policies/ManagePoliciesPage/components/CalendarEventsModal/CalendarEventsModal.tsx
@@ -2,8 +2,8 @@ import React, { useCallback, useState, useEffect } from "react";
 
 import { IPolicyStats } from "interfaces/policy";
 
+import { syntaxHighlight } from "utilities/helpers";
 import validURL from "components/forms/validators/valid_url";
-
 import Button from "components/buttons/Button";
 import RevealButton from "components/buttons/RevealButton";
 import CustomLink from "components/CustomLink";
@@ -12,7 +12,7 @@ import Slider from "components/forms/fields/Slider";
 import InputField from "components/forms/fields/InputField";
 import Modal from "components/Modal";
 import Checkbox from "components/forms/fields/Checkbox";
-import { syntaxHighlight } from "utilities/helpers";
+import TooltipTruncatedText from "components/TooltipTruncatedText";
 import Icon from "components/Icon";
 import CalendarEventPreviewModal from "../CalendarEventPreviewModal";
 import CalendarPreview from "../../../../../../assets/images/calendar-preview-720x436@2x.png";
@@ -185,11 +185,11 @@ const CalendarEventsModal = ({
     return (
       <div className="form-field">
         <div className="form-field__label">Policies:</div>
-        <div className="automated-policies-section">
+        <ul className="automated-policies-section">
           {formData.policies.map((policy) => {
             const { isChecked, name, id } = policy;
             return (
-              <div className="checkbox-row" id={`checkbox-row--${id}`} key={id}>
+              <li className="policy-row" id={`policy-row--${id}`} key={id}>
                 <Checkbox
                   value={isChecked}
                   name={name}
@@ -198,26 +198,24 @@ const CalendarEventsModal = ({
                     onPolicyEnabledChange({ name, value: !isChecked });
                   }}
                 >
-                  {name}
+                  <TooltipTruncatedText value={name} />
                 </Checkbox>
-                <div>
-                  <Button
-                    variant="text-icon"
-                    onClick={() => {
-                      setSelectedPolicyToPreview(
-                        policies.find((p) => p.id === id)
-                      );
-                      togglePreviewCalendarEvent();
-                    }}
-                    className="checkbox-row__preview-button"
-                  >
-                    <Icon name="eye" /> Preview
-                  </Button>
-                </div>
-              </div>
+                <Button
+                  variant="text-icon"
+                  onClick={() => {
+                    setSelectedPolicyToPreview(
+                      policies.find((p) => p.id === id)
+                    );
+                    togglePreviewCalendarEvent();
+                  }}
+                  className="policy-row__preview-button"
+                >
+                  <Icon name="eye" /> Preview
+                </Button>
+              </li>
             );
           })}
-        </div>
+        </ul>
         <span className="form-field__help-text">
           A calendar event will be created for end users if one of their hosts
           fail any of these policies.{" "}
diff --git a/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/InstallSoftwareModal.tsx b/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/InstallSoftwareModal.tsx
new file mode 100644
index 000000000000..7c29b4979f3b
--- /dev/null
+++ b/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/InstallSoftwareModal.tsx
@@ -0,0 +1,276 @@
+import React, { useCallback, useState } from "react";
+
+import { useQuery } from "react-query";
+import { omit } from "lodash";
+
+import { IPolicyStats } from "interfaces/policy";
+import softwareAPI, {
+  ISoftwareTitlesQueryKey,
+  ISoftwareTitlesResponse,
+} from "services/entities/software";
+import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
+
+// @ts-ignore
+import Dropdown from "components/forms/fields/Dropdown";
+import Modal from "components/Modal";
+import DataError from "components/DataError";
+import Spinner from "components/Spinner";
+import Checkbox from "components/forms/fields/Checkbox";
+import TooltipTruncatedText from "components/TooltipTruncatedText";
+import CustomLink from "components/CustomLink";
+import Button from "components/buttons/Button";
+import { ISoftwareTitle } from "interfaces/software";
+
+const getPlatformDisplayFromPackageSuffix = (packageName: string) => {
+  const split = packageName.split(".");
+  const suff = split[split.length - 1];
+  switch (suff) {
+    case "pkg":
+      return "macOS";
+    case "deb":
+      return "Linux";
+    case "exe":
+      return "Windows";
+    case "msi":
+      return "Windows";
+    default:
+      return null;
+  }
+};
+
+const AFI_SOFTWARE_BATCH_SIZE = 1000;
+
+const baseClass = "install-software-modal";
+
+interface ISwDropdownField {
+  name: string;
+  value: number;
+}
+interface IFormPolicy {
+  name: string;
+  id: number;
+  installSoftwareEnabled: boolean;
+  swIdToInstall?: number;
+}
+
+export type IInstallSoftwareFormData = IFormPolicy[];
+
+interface IInstallSoftwareModal {
+  onExit: () => void;
+  onSubmit: (formData: IInstallSoftwareFormData) => void;
+  isUpdating: boolean;
+  policies: IPolicyStats[];
+  teamId: number;
+}
+const InstallSoftwareModal = ({
+  onExit,
+  onSubmit,
+  isUpdating,
+  policies,
+  teamId,
+}: IInstallSoftwareModal) => {
+  const [formData, setFormData] = useState<IInstallSoftwareFormData>(
+    policies.map((policy) => ({
+      name: policy.name,
+      id: policy.id,
+      installSoftwareEnabled: !!policy.install_software,
+      swIdToInstall: policy.install_software?.software_title_id,
+    }))
+  );
+
+  const anyPolicyEnabledWithoutSelectedSoftware = formData.some(
+    (policy) => policy.installSoftwareEnabled && !policy.swIdToInstall
+  );
+  const {
+    data: titlesAFI,
+    isLoading: isTitlesAFILoading,
+    isError: isTitlesAFIError,
+  } = useQuery<
+    ISoftwareTitlesResponse,
+    Error,
+    ISoftwareTitle[],
+    [ISoftwareTitlesQueryKey]
+  >(
+    [
+      {
+        scope: "software-titles",
+        page: 0,
+        perPage: AFI_SOFTWARE_BATCH_SIZE,
+        query: "",
+        orderDirection: "desc",
+        orderKey: "hosts_count",
+        teamId,
+        availableForInstall: true,
+        packagesOnly: true,
+      },
+    ],
+    ({ queryKey: [queryKey] }) =>
+      softwareAPI.getSoftwareTitles(omit(queryKey, "scope")),
+    {
+      select: (data) => data.software_titles,
+      ...DEFAULT_USE_QUERY_OPTIONS,
+    }
+  );
+
+  const onUpdateInstallSoftware = useCallback(() => {
+    onSubmit(formData);
+  }, [formData, onSubmit]);
+
+  const onChangeEnableInstallSoftware = useCallback(
+    (newVal: { policyName: string; value: boolean }) => {
+      const { policyName, value } = newVal;
+      setFormData(
+        formData.map((policy) => {
+          if (policy.name === policyName) {
+            return {
+              ...policy,
+              installSoftwareEnabled: value,
+              swIdToInstall: value ? policy.swIdToInstall : undefined,
+            };
+          }
+          return policy;
+        })
+      );
+    },
+    [formData]
+  );
+
+  const onSelectPolicySoftware = useCallback(
+    ({ name, value }: ISwDropdownField) => {
+      const [policyName, softwareId] = [name, value];
+      setFormData(
+        formData.map((policy) => {
+          if (policy.name === policyName) {
+            return { ...policy, swIdToInstall: softwareId };
+          }
+          return policy;
+        })
+      );
+    },
+    [formData]
+  );
+
+  const availableSoftwareOptions = titlesAFI?.map((title) => {
+    const platformDisplay = getPlatformDisplayFromPackageSuffix(
+      title.software_package?.name ?? ""
+    );
+    const platformString = platformDisplay ? `${platformDisplay} • ` : "";
+    return {
+      label: title.name,
+      value: title.id,
+      helpText: `${platformString}${title.software_package?.version ?? ""}`,
+    };
+  });
+
+  const renderPolicySwInstallOption = (policy: IFormPolicy) => {
+    const {
+      name: policyName,
+      id: policyId,
+      installSoftwareEnabled: enabled,
+      swIdToInstall,
+    } = policy;
+
+    return (
+      <li
+        className={`${baseClass}__policy-row policy-row`}
+        id={`policy-row--${policyId}`}
+        key={policyId}
+      >
+        <Checkbox
+          value={enabled}
+          name={policyName}
+          onChange={() => {
+            onChangeEnableInstallSoftware({
+              policyName,
+              value: !enabled,
+            });
+          }}
+        >
+          <TooltipTruncatedText value={policyName} />
+        </Checkbox>
+        {enabled && (
+          <Dropdown
+            options={availableSoftwareOptions}
+            value={swIdToInstall}
+            onChange={onSelectPolicySoftware}
+            placeholder="Select software"
+            className={`${baseClass}__software-dropdown`}
+            name={policyName}
+            parseTarget
+          />
+        )}
+      </li>
+    );
+  };
+
+  const renderContent = () => {
+    if (isTitlesAFIError) {
+      return <DataError />;
+    }
+    if (isTitlesAFILoading) {
+      return <Spinner />;
+    }
+    if (!titlesAFI?.length) {
+      return (
+        <div className={`${baseClass}__no-software`}>
+          <b>No software available for install</b>
+          <span>
+            Go to <b>Software</b> to add software to this team.
+          </span>
+        </div>
+      );
+    }
+
+    return (
+      <div className={`${baseClass} form`}>
+        <div className="form-field">
+          <div className="form-field__label">Policies:</div>
+          <ul className="automated-policies-section">
+            {formData.map((policyData) =>
+              renderPolicySwInstallOption(policyData)
+            )}
+          </ul>
+          <span className="form-field__help-text">
+            Selected software will be installed when hosts fail the chosen
+            policy.{" "}
+            <CustomLink
+              url="https://fleetdm.com/learn-more-about/policy-automation-install-software"
+              text="Learn more"
+              newTab
+            />
+          </span>
+        </div>
+        <div className="modal-cta-wrap">
+          <Button
+            type="submit"
+            variant="brand"
+            onClick={onUpdateInstallSoftware}
+            className="save-loading"
+            isLoading={isUpdating}
+            disabled={anyPolicyEnabledWithoutSelectedSoftware}
+          >
+            Save
+          </Button>
+          <Button onClick={onExit} variant="inverse">
+            Cancel
+          </Button>
+        </div>
+      </div>
+    );
+  };
+
+  return (
+    <Modal
+      title="Install software"
+      className={baseClass}
+      onExit={onExit}
+      onEnter={onUpdateInstallSoftware}
+      width="large"
+      isContentDisabled={isUpdating}
+    >
+      {renderContent()}
+    </Modal>
+  );
+};
+
+export default InstallSoftwareModal;
diff --git a/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/_styles.scss b/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/_styles.scss
new file mode 100644
index 000000000000..de9cfc05be59
--- /dev/null
+++ b/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/_styles.scss
@@ -0,0 +1,41 @@
+.manage-policies-page {
+  .install-software-modal {
+    .form-field--dropdown {
+      width: 276px;
+      .Select-placeholder {
+        color: $ui-fleet-black-50;
+      }
+      .Select-menu {
+        max-height: none;
+        overflow: visible;
+      }
+      .Select-menu-outer {
+        max-height: 240px;
+        overflow-y: auto;
+      }
+    }
+    .policy-row {
+      height: 40px;
+      padding-top: 4px;
+      padding-bottom: 4px;
+    }
+
+    &__no-software {
+      display: flex;
+      height: 178px;
+      flex-direction: column;
+      align-items: center;
+      gap: $pad-small;
+      justify-content: center;
+      font-size: $small;
+      
+      span {
+        color: $ui-fleet-black-75;
+        font-size: $xx-small;
+      }
+    }
+    .data-error {
+      padding: 78px;
+    }
+  }
+}
diff --git a/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/index.ts b/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/index.ts
new file mode 100644
index 000000000000..a9f46a726a03
--- /dev/null
+++ b/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./InstallSoftwareModal";
diff --git a/frontend/pages/policies/ManagePoliciesPage/components/OtherWorkflowsModal/OtherWorkflowsModal.tsx b/frontend/pages/policies/ManagePoliciesPage/components/OtherWorkflowsModal/OtherWorkflowsModal.tsx
index 77a488f73045..7a9668e82544 100644
--- a/frontend/pages/policies/ManagePoliciesPage/components/OtherWorkflowsModal/OtherWorkflowsModal.tsx
+++ b/frontend/pages/policies/ManagePoliciesPage/components/OtherWorkflowsModal/OtherWorkflowsModal.tsx
@@ -26,6 +26,7 @@ import Radio from "components/forms/fields/Radio";
 import validUrl from "components/forms/validators/valid_url";
 import RevealButton from "components/buttons/RevealButton";
 import CustomLink from "components/CustomLink";
+import TooltipTruncatedText from "components/TooltipTruncatedText";
 import ExampleTicket from "../ExampleTicket";
 import ExamplePayload from "../ExamplePayload";
 
@@ -366,6 +367,7 @@ const OtherWorkflowsModal = ({
       title="Other workflows"
       className={baseClass}
       width="large"
+      isContentDisabled={isUpdating}
     >
       <div className={`${baseClass} form`}>
         <Slider
@@ -414,8 +416,8 @@ const OtherWorkflowsModal = ({
                       const { isChecked, name, id } = policyItem;
                       return (
                         <div
-                          className="checkbox-row"
-                          id={`checkbox-row--${id}`}
+                          className="policy-row"
+                          id={`policy-row--${id}`}
                           key={id}
                         >
                           <Checkbox
@@ -427,7 +429,7 @@ const OtherWorkflowsModal = ({
                                 setErrors((errs) => omit(errs, "policyItems"));
                             }}
                           >
-                            {name}
+                            <TooltipTruncatedText value={name} />
                           </Checkbox>
                         </div>
                       );
diff --git a/frontend/pages/queries/ManageQueriesPage/ManageQueriesPage.tsx b/frontend/pages/queries/ManageQueriesPage/ManageQueriesPage.tsx
index f737f22cfd3b..34550c98728e 100644
--- a/frontend/pages/queries/ManageQueriesPage/ManageQueriesPage.tsx
+++ b/frontend/pages/queries/ManageQueriesPage/ManageQueriesPage.tsx
@@ -87,7 +87,6 @@ const ManageQueriesPage = ({
     setFilteredQueriesPath,
     filteredQueriesPath,
     isPremiumTier,
-    isSandboxMode,
     config,
   } = useContext(AppContext);
   const { setLastEditedQueryBody, setSelectedQueryTargetsByType } = useContext(
@@ -253,7 +252,6 @@ const ManageQueriesPage = ({
               currentUserTeams={userTeams}
               selectedTeamId={currentTeamId}
               onChange={handleTeamChange}
-              isSandboxMode={isSandboxMode}
             />
           );
         } else if (!isOnGlobalTeam && userTeams.length === 1) {
diff --git a/frontend/pages/queries/ManageQueriesPage/components/ManageQueryAutomationsModal/ManageQueryAutomationsModal.tsx b/frontend/pages/queries/ManageQueriesPage/components/ManageQueryAutomationsModal/ManageQueryAutomationsModal.tsx
index 391881bcf7b6..ca4c67bf1bf8 100644
--- a/frontend/pages/queries/ManageQueriesPage/components/ManageQueryAutomationsModal/ManageQueryAutomationsModal.tsx
+++ b/frontend/pages/queries/ManageQueriesPage/components/ManageQueryAutomationsModal/ManageQueryAutomationsModal.tsx
@@ -9,6 +9,8 @@ import QueryFrequencyIndicator from "components/QueryFrequencyIndicator/QueryFre
 import LogDestinationIndicator from "components/LogDestinationIndicator/LogDestinationIndicator";
 
 import { ISchedulableQuery } from "interfaces/schedulable_query";
+import TooltipTruncatedText from "components/TooltipTruncatedText";
+import { CONTACT_FLEET_LINK } from "utilities/constants";
 
 interface IManageQueryAutomationsModalProps {
   isUpdatingAutomations: boolean;
@@ -135,7 +137,7 @@ const ManageQueryAutomationsModal = ({
                           //   setErrors((errs) => omit(errs, "queryItems"));
                         }}
                       >
-                        {name}
+                        <TooltipTruncatedText value={name} />
                       </Checkbox>
                       <QueryFrequencyIndicator
                         frequency={interval}
@@ -170,11 +172,7 @@ const ManageQueryAutomationsModal = ({
           <p>Automations currently run on macOS, Windows, and Linux hosts.</p>
           <p>
             Interested in query automations for your Chromebooks? &nbsp;
-            <CustomLink
-              url="https://fleetdm.com/contact"
-              text="Let us know"
-              newTab
-            />
+            <CustomLink url={CONTACT_FLEET_LINK} text="Let us know" newTab />
           </p>
         </InfoBanner>
         <Button
diff --git a/frontend/router/index.tsx b/frontend/router/index.tsx
index 2d3c83a8d833..ecdb4aa9fca9 100644
--- a/frontend/router/index.tsx
+++ b/frontend/router/index.tsx
@@ -1,4 +1,9 @@
-import React from "react";
+import React, { FC } from "react";
+import {
+  QueryClient,
+  QueryClientProvider,
+  QueryClientProviderProps,
+} from "react-query";
 import {
   browserHistory,
   IndexRedirect,
@@ -57,10 +62,11 @@ import OSUpdates from "pages/ManageControlsPage/OSUpdates";
 import OSSettings from "pages/ManageControlsPage/OSSettings";
 import SetupExperience from "pages/ManageControlsPage/SetupExperience/SetupExperience";
 import WindowsMdmPage from "pages/admin/IntegrationsPage/cards/MdmSettings/WindowsMdmPage";
-import MacOSMdmPage from "pages/admin/IntegrationsPage/cards/MdmSettings/MacOSMdmPage";
+import AppleMdmPage from "pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage";
 import Scripts from "pages/ManageControlsPage/Scripts/Scripts";
-import AppleAutomaticEnrollmentPage from "pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage";
-import WindowsAutomaticEnrollmentPage from "pages/admin/IntegrationsPage/cards/AutomaticEnrollment/WindowsAutomaticEnrollmentPage";
+import WindowsAutomaticEnrollmentPage from "pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage";
+import AppleBusinessManagerPage from "pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage";
+import VppPage from "pages/admin/IntegrationsPage/cards/MdmSettings/VppPage";
 import HostQueryReport from "pages/hosts/details/HostQueryReport";
 import SoftwarePage from "pages/SoftwarePage";
 import SoftwareTitles from "pages/SoftwarePage/SoftwareTitles";
@@ -87,19 +93,35 @@ import AuthAnyMaintainerAdminObserverPlusRoutes from "./components/AuthAnyMainta
 import PremiumRoutes from "./components/PremiumRoutes";
 import ExcludeInSandboxRoutes from "./components/ExcludeInSandboxRoutes";
 
+// We create a CustomQueryClientProvider that takes the same props as the original
+// QueryClientProvider but adds the children prop as a ReactNode. This children
+// prop is now required explicitly in React 18. We do it this way to avoid
+// having to update the react-query package version and typings for now.
+// When we upgrade React Query we should be able to remove this.
+type ICustomQueryClientProviderProps = React.PropsWithChildren<QueryClientProviderProps>;
+const CustomQueryClientProvider: FC<ICustomQueryClientProviderProps> = QueryClientProvider;
+
 interface IAppWrapperProps {
   children: JSX.Element;
   location?: any;
 }
 
-// App.tsx needs the context for user and config
-const AppWrapper = ({ children, location }: IAppWrapperProps) => (
-  <AppProvider>
-    <RoutingProvider>
-      <App location={location}>{children}</App>
-    </RoutingProvider>
-  </AppProvider>
-);
+// App.tsx needs the context for user and config. We also wrap the application
+// component in the required query client priovider for react-query. This
+// will allow us to use react-query hooks in the application component.
+const AppWrapper = ({ children, location }: IAppWrapperProps) => {
+  const queryClient = new QueryClient();
+  return (
+    <AppProvider>
+      <RoutingProvider>
+        <CustomQueryClientProvider client={queryClient}>
+          <App location={location}>{children}</App>
+        </CustomQueryClientProvider>
+      </RoutingProvider>
+    </AppProvider>
+  );
+};
+
 const routes = (
   <Router history={browserHistory}>
     <Route path={PATHS.ROOT} component={AppWrapper}>
@@ -146,6 +168,13 @@ const routes = (
                   component={OrgSettingsPage}
                 />
                 <Route path="integrations" component={AdminIntegrationsPage} />
+                {/* This redirect is used to handle the old URL for these two
+                pages */}
+                <Redirect
+                  from="integrations/automatic-enrollment"
+                  to="integrations/mdm"
+                />
+                <Redirect from="integrations/vpp" to="integrations/mdm" />
                 <Route
                   path="integrations/:section"
                   component={AdminIntegrationsPage}
@@ -159,15 +188,24 @@ const routes = (
               </Route>
             </Route>
             <Route path="integrations/mdm/windows" component={WindowsMdmPage} />
-            <Route path="integrations/mdm/apple" component={MacOSMdmPage} />
+            <Route path="integrations/mdm/apple" component={AppleMdmPage} />
+            {/* This redirect is used to handle old apple automatic enrollments page */}
+            <Redirect
+              from="integrations/automatic-enrollment/apple"
+              to="integrations/mdm/abm"
+            />
             <Route
-              path="integrations/automatic-enrollment/apple"
-              component={AppleAutomaticEnrollmentPage}
+              path="integrations/mdm/abm"
+              component={AppleBusinessManagerPage}
             />
             <Route
               path="integrations/automatic-enrollment/windows"
               component={WindowsAutomaticEnrollmentPage}
             />
+            {/* This redirect is used to handle old vpp setup page */}
+            <Redirect from="integrations/vpp/setup" to="integrations/mdm/vpp" />
+            <Route path="integrations/mdm/vpp" component={VppPage} />
+
             <Route path="teams" component={TeamDetailsWrapper}>
               <Redirect from="members" to="users" />
               <Route path="users" component={UsersPage} />
diff --git a/frontend/router/paths.ts b/frontend/router/paths.ts
index 0aedc5ee3029..3c22cd097a01 100644
--- a/frontend/router/paths.ts
+++ b/frontend/router/paths.ts
@@ -26,18 +26,25 @@ export default {
   DASHBOARD_IOS: `${URL_PREFIX}/dashboard/ios`,
   DASHBOARD_IPADOS: `${URL_PREFIX}/dashboard/ipados`,
 
-  // Admin pages
+  /**
+   * Admin pages
+   */
+
   ADMIN_SETTINGS: `${URL_PREFIX}/settings`,
   ADMIN_USERS: `${URL_PREFIX}/settings/users`,
+
+  // Integrations pages
   ADMIN_INTEGRATIONS: `${URL_PREFIX}/settings/integrations`,
   ADMIN_INTEGRATIONS_TICKET_DESTINATIONS: `${URL_PREFIX}/settings/integrations/ticket-destinations`,
   ADMIN_INTEGRATIONS_MDM: `${URL_PREFIX}/settings/integrations/mdm`,
-  ADMIN_INTEGRATIONS_MDM_MAC: `${URL_PREFIX}/settings/integrations/mdm/apple`,
+  ADMIN_INTEGRATIONS_MDM_APPLE: `${URL_PREFIX}/settings/integrations/mdm/apple`,
   ADMIN_INTEGRATIONS_MDM_WINDOWS: `${URL_PREFIX}/settings/integrations/mdm/windows`,
-  ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT: `${URL_PREFIX}/settings/integrations/automatic-enrollment`,
-  ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT_APPLE: `${URL_PREFIX}/settings/integrations/automatic-enrollment/apple`,
+  ADMIN_INTEGRATIONS_APPLE_BUSINESS_MANAGER: `${URL_PREFIX}/settings/integrations/mdm/abm`,
   ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT_WINDOWS: `${URL_PREFIX}/settings/integrations/automatic-enrollment/windows`,
   ADMIN_INTEGRATIONS_CALENDARS: `${URL_PREFIX}/settings/integrations/calendars`,
+  ADMIN_INTEGRATIONS_VPP: `${URL_PREFIX}/settings/integrations/mdm/vpp`,
+  ADMIN_INTEGRATIONS_VPP_SETUP: `${URL_PREFIX}/settings/integrations/vpp/setup`,
+
   ADMIN_TEAMS: `${URL_PREFIX}/settings/teams`,
   ADMIN_ORGANIZATION: `${URL_PREFIX}/settings/organization`,
   ADMIN_ORGANIZATION_INFO: `${URL_PREFIX}/settings/organization/info`,
diff --git a/frontend/services/entities/labels.ts b/frontend/services/entities/labels.ts
index 7a58cb9a0473..5ce8d04938b1 100644
--- a/frontend/services/entities/labels.ts
+++ b/frontend/services/entities/labels.ts
@@ -49,6 +49,28 @@ const generateCreateLabelBody = (
 
 const generateUpdateLabelBody = generateCreateLabelBody;
 
+/** gets the custom label and returns them in case-insensitive alphabetical
+ * ascending order by label name. (e.g. [A, B, C, a, b, c] => [A, a, B, b, C, c])
+ */
+export const getCustomLabels = <T extends { label_type: string; name: string }>(
+  labels: T[]
+) => {
+  if (labels.length === 0) {
+    return [];
+  }
+
+  return labels
+    .filter((label) => label.label_type === "regular")
+    .sort((a, b) => {
+      // Found this technique here
+      // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/localeCompare
+      // This is a case insensitive sort
+      return a.name.localeCompare(b.name, undefined, {
+        sensitivity: "base",
+      });
+    });
+};
+
 export default {
   create: (
     formData: IDynamicLabelFormData | IManualLabelFormData
diff --git a/frontend/services/entities/mdm.ts b/frontend/services/entities/mdm.ts
index e9c288db0918..f8cae4461f83 100644
--- a/frontend/services/entities/mdm.ts
+++ b/frontend/services/entities/mdm.ts
@@ -3,6 +3,7 @@ import { createMockMdmProfile } from "__mocks__/mdmMock";
 import {
   DiskEncryptionStatus,
   IHostMdmProfile,
+  IMdmCommandResult,
   IMdmProfile,
   MdmProfileStatus,
 } from "interfaces/mdm";
@@ -67,11 +68,21 @@ export interface IAppleSetupEnrollmentProfileResponse {
   enrollment_profile: Record<string, unknown>;
 }
 
+export interface IMDMSSOParams {
+  dep_device_info: string;
+}
+
+export interface IMDMAppleEnrollmentProfileParams {
+  token: string;
+  ref?: string;
+  dep_device_info?: string;
+}
+
+export interface IGetMdmCommandResultsResponse {
+  results: IMdmCommandResult[];
+}
+
 const mdmService = {
-  resetEncryptionKey: (token: string) => {
-    const { DEVICE_USER_RESET_ENCRYPTION_KEY } = endpoints;
-    return sendRequest("POST", DEVICE_USER_RESET_ENCRYPTION_KEY(token));
-  },
   unenrollHostFromMdm: (hostId: number, timeout?: number) => {
     const { HOST_MDM_UNENROLL } = endpoints;
     return sendRequest(
@@ -313,6 +324,13 @@ const mdmService = {
     )}`;
     return sendRequest("DELETE", path);
   },
+  getCommandResults: (
+    command_uuid: string
+  ): Promise<IGetMdmCommandResultsResponse> => {
+    const { COMMANDS_RESULTS: MDM_COMMANDS_RESULTS } = endpoints;
+    const url = `${MDM_COMMANDS_RESULTS}?command_uuid=${command_uuid}`;
+    return sendRequest("GET", url);
+  },
 };
 
 export default mdmService;
diff --git a/frontend/services/entities/mdm_apple.ts b/frontend/services/entities/mdm_apple.ts
index 1d5b9babf515..4a50779df44d 100644
--- a/frontend/services/entities/mdm_apple.ts
+++ b/frontend/services/entities/mdm_apple.ts
@@ -1,7 +1,45 @@
-/* eslint-disable @typescript-eslint/explicit-module-boundary-types */
+import { IMdmVppToken } from "interfaces/mdm";
+import { ApplePlatform } from "interfaces/platform";
 import sendRequest from "services";
 import endpoints from "utilities/endpoints";
 
+export interface IGetVppInfoResponse {
+  org_name: string;
+  renew_date: string;
+  location: string;
+}
+
+export interface IVppApp {
+  name: string;
+  bundle_identifier: string;
+  icon_url: string;
+  latest_version: string;
+  app_store_id: string;
+  added: boolean;
+  platform: ApplePlatform;
+}
+
+interface IAddVppAppPostBody {
+  app_store_id: string;
+  team_id: number;
+  platform: ApplePlatform;
+  self_service?: boolean;
+}
+
+export interface IGetVppAppsResponse {
+  app_store_apps: IVppApp[];
+}
+
+export interface IGetVppTokensResponse {
+  vpp_tokens: IMdmVppToken[];
+}
+
+export interface IUploadVppTokenReponse {
+  vpp_token: IMdmVppToken;
+}
+
+export type IRenewVppTokenResponse = IUploadVppTokenReponse;
+
 export default {
   getAppleAPNInfo: () => {
     const { MDM_APPLE_PNS } = endpoints;
@@ -25,4 +63,70 @@ export default {
     const { MDM_REQUEST_CSR } = endpoints;
     return sendRequest("GET", MDM_REQUEST_CSR);
   },
+
+  disableVpp: () => {
+    const { MDM_APPLE_VPP_TOKEN } = endpoints;
+    return sendRequest("DELETE", MDM_APPLE_VPP_TOKEN);
+  },
+
+  getVppApps: (teamId: number): Promise<IGetVppAppsResponse> => {
+    const { MDM_APPLE_VPP_APPS } = endpoints;
+    const path = `${MDM_APPLE_VPP_APPS}?team_id=${teamId}`;
+    return sendRequest("GET", path);
+  },
+
+  addVppApp: (
+    teamId: number,
+    appStoreId: string,
+    platform: ApplePlatform,
+    isSelfService: boolean
+  ) => {
+    const { MDM_APPLE_VPP_APPS } = endpoints;
+    const postBody: IAddVppAppPostBody = {
+      app_store_id: appStoreId,
+      team_id: teamId,
+      platform,
+    };
+
+    if (isSelfService) {
+      postBody.self_service = isSelfService;
+    }
+
+    return sendRequest("POST", MDM_APPLE_VPP_APPS, postBody);
+  },
+
+  getVppTokens: (): Promise<IGetVppTokensResponse> => {
+    const { MDM_VPP_TOKENS } = endpoints;
+    return sendRequest("GET", MDM_VPP_TOKENS);
+  },
+
+  uploadVppToken: (token: File): Promise<IUploadVppTokenReponse> => {
+    const { MDM_VPP_TOKENS } = endpoints;
+    const formData = new FormData();
+    formData.append("token", token);
+    return sendRequest("POST", MDM_VPP_TOKENS, formData);
+  },
+
+  renewVppToken(id: number, token: File): Promise<IRenewVppTokenResponse> {
+    const { MDM_VPP_TOKENS_RENEW } = endpoints;
+    const path = MDM_VPP_TOKENS_RENEW(id);
+    const formData = new FormData();
+    formData.append("token", token);
+    return sendRequest("PATCH", path, formData);
+  },
+
+  deleteVppToken: (id: number): Promise<void> => {
+    const { MDM_VPP_TOKEN } = endpoints;
+    const path = MDM_VPP_TOKEN(id);
+    return sendRequest("DELETE", path);
+  },
+
+  editVppTeams: async (params: {
+    tokenId: number;
+    teamIds: number[] | null;
+  }) => {
+    const { MDM_VPP_TOKEN_TEAMS } = endpoints;
+    const path = MDM_VPP_TOKEN_TEAMS(params.tokenId);
+    return sendRequest("PATCH", path, { teams: params.teamIds });
+  },
 };
diff --git a/frontend/services/entities/mdm_apple_bm.ts b/frontend/services/entities/mdm_apple_bm.ts
index 26f8336f616a..f00ad36a4b6f 100644
--- a/frontend/services/entities/mdm_apple_bm.ts
+++ b/frontend/services/entities/mdm_apple_bm.ts
@@ -1,4 +1,5 @@
 /* eslint-disable @typescript-eslint/explicit-module-boundary-types */
+import { IMdmAbmToken } from "interfaces/mdm";
 import sendRequest from "services";
 import endpoints from "utilities/endpoints";
 
@@ -6,8 +7,24 @@ export interface IAppleBusinessManagerTokenFormData {
   token: File | null;
 }
 
+export interface IGetAppleBMInfoResponse {
+  apple_id: string;
+  default_team: string;
+  mdm_server_url: string;
+  org_name: string;
+  renew_date: string;
+}
+
+export interface IGetAbmTokensResponse {
+  abm_tokens: IMdmAbmToken[];
+}
+
+export interface IAbmTokenResponse {
+  abm_token: IMdmAbmToken;
+}
+
 export default {
-  getAppleBMInfo: () => {
+  getAppleBMInfo: (): Promise<IGetAppleBMInfoResponse> => {
     const { MDM_APPLE_BM } = endpoints;
     const path = MDM_APPLE_BM;
     return sendRequest("GET", path);
@@ -38,16 +55,45 @@ export default {
     return sendRequest("GET", MDM_APPLE_ABM_PUBLIC_KEY);
   },
 
-  uploadToken: (token: File) => {
-    const { MDM_APPLE_ABM_TOKEN: MDM_APPLE_BM_TOKEN } = endpoints;
+  uploadToken: (token: File): Promise<IMdmAbmToken> => {
+    const { MDM_ABM_TOKENS } = endpoints;
+    const formData = new FormData();
+    formData.append("token", token);
+
+    return sendRequest("POST", MDM_ABM_TOKENS, formData);
+  },
+
+  renewToken: (id: number, token: File): Promise<IAbmTokenResponse> => {
+    const { MDM_ABM_TOKEN_RENEW } = endpoints;
+    const path = MDM_ABM_TOKEN_RENEW(id);
+
     const formData = new FormData();
     formData.append("token", token);
 
-    return sendRequest("POST", MDM_APPLE_BM_TOKEN, formData);
+    return sendRequest("PATCH", path, formData);
+  },
+
+  deleteToken: (id: number): Promise<void> => {
+    const { MDM_ABM_TOKEN } = endpoints;
+    const path = MDM_ABM_TOKEN(id);
+    return sendRequest("DELETE", path);
+  },
+
+  getTokens: (): Promise<IGetAbmTokensResponse> => {
+    const { MDM_ABM_TOKENS } = endpoints;
+    return sendRequest("GET", MDM_ABM_TOKENS);
   },
 
-  disableAutomaticEnrollment: () => {
-    const { MDM_APPLE_ABM_TOKEN: MDM_APPLE_BM_TOKEN } = endpoints;
-    return sendRequest("DELETE", MDM_APPLE_BM_TOKEN);
+  editTeams: async (params: {
+    tokenId: number;
+    teams: {
+      ios_team_id: number;
+      ipados_team_id: number;
+      macos_team_id: number;
+    };
+  }) => {
+    const { MDM_ABM_TOKEN_TEAMS } = endpoints;
+    const path = MDM_ABM_TOKEN_TEAMS(params.tokenId);
+    return sendRequest("PATCH", path, params.teams);
   },
 };
diff --git a/frontend/services/entities/operating_systems.ts b/frontend/services/entities/operating_systems.ts
index 1611243bfd91..2aa36227bd83 100644
--- a/frontend/services/entities/operating_systems.ts
+++ b/frontend/services/entities/operating_systems.ts
@@ -4,7 +4,6 @@ import endpoints from "utilities/endpoints";
 import { IOperatingSystemVersion } from "interfaces/operating_system";
 import { Platform } from "interfaces/platform";
 import { buildQueryStringFromParams } from "utilities/url";
-import { API_NO_TEAM_ID } from "interfaces/team";
 
 // TODO: add platforms to this constant as new ones are supported
 export const OS_VERSIONS_API_SUPPORTED_PLATFORMS = [
@@ -72,6 +71,7 @@ export const getOSVersions = ({
 
   const params: IGetOSVersionsRequestQueryParams = {
     platform,
+    team_id: teamId,
     os_name,
     os_version,
     order_key,
@@ -80,10 +80,6 @@ export const getOSVersions = ({
     per_page,
   };
 
-  if (teamId !== API_NO_TEAM_ID) {
-    params.team_id = teamId;
-  }
-
   const queryString = buildQueryStringFromParams(params);
 
   if (queryString) path += `?${queryString}`;
@@ -96,7 +92,8 @@ const getOSVersion = ({
   teamId,
 }: IGetOsVersionOptions): Promise<IOSVersionResponse> => {
   const endpoint = endpoints.OS_VERSION(os_version_id);
-  const path = teamId ? `${endpoint}?team_id=${teamId}` : endpoint;
+  const queryString = buildQueryStringFromParams({ team_id: teamId });
+  const path = teamId !== undefined ? `${endpoint}?${queryString}` : endpoint;
 
   return sendRequest("GET", path);
 };
diff --git a/frontend/services/entities/software.ts b/frontend/services/entities/software.ts
index 372b8b52686c..2db788093223 100644
--- a/frontend/services/entities/software.ts
+++ b/frontend/services/entities/software.ts
@@ -1,20 +1,17 @@
-import { AxiosResponse } from "axios";
-
 import sendRequest from "services";
 import endpoints from "utilities/endpoints";
 import {
   ISoftwareResponse,
   ISoftwareCountResponse,
   ISoftwareVersion,
-  ISoftwareTitleWithPackageDetail,
-  ISoftwareTitleWithPackageName,
+  ISoftwareTitle,
+  ISoftwareTitleDetails,
 } from "interfaces/software";
 import {
   buildQueryStringFromParams,
   convertParamsToSnakeCase,
 } from "utilities/url";
-
-import { IAddSoftwareFormData } from "pages/SoftwarePage/components/AddSoftwareForm/AddSoftwareForm";
+import { IAddPackageFormData } from "pages/SoftwarePage/components/AddPackageForm/AddPackageForm";
 
 export interface ISoftwareApiParams {
   page?: number;
@@ -23,7 +20,11 @@ export interface ISoftwareApiParams {
   orderDirection?: "asc" | "desc";
   query?: string;
   vulnerable?: boolean;
+  max_cvss_score?: number;
+  min_cvss_score?: number;
+  exploit?: boolean;
   availableForInstall?: boolean;
+  packagesOnly?: boolean;
   selfService?: boolean;
   teamId?: number;
 }
@@ -31,7 +32,7 @@ export interface ISoftwareApiParams {
 export interface ISoftwareTitlesResponse {
   counts_updated_at: string | null;
   count: number;
-  software_titles: ISoftwareTitleWithPackageName[];
+  software_titles: ISoftwareTitle[];
   meta: {
     has_next_results: boolean;
     has_previous_results: boolean;
@@ -49,7 +50,7 @@ export interface ISoftwareVersionsResponse {
 }
 
 export interface ISoftwareTitleResponse {
-  software_title: ISoftwareTitleWithPackageDetail;
+  software_title: ISoftwareTitleDetails;
 }
 
 export interface ISoftwareVersionResponse {
@@ -57,10 +58,14 @@ export interface ISoftwareVersionResponse {
 }
 
 export interface ISoftwareVersionsQueryKey extends ISoftwareApiParams {
+  // used to trigger software refetches from sibling pages
+  addedSoftwareToken: string | null;
   scope: "software-versions";
 }
 
 export interface ISoftwareTitlesQueryKey extends ISoftwareApiParams {
+  // used to trigger software refetches from sibling pages
+  addedSoftwareToken?: string | null;
   scope: "software-titles";
 }
 
@@ -93,6 +98,10 @@ export interface IGetSoftwareVersionQueryKey
   scope: "softwareVersion";
 }
 
+export interface ISoftwareInstallTokenResponse {
+  token: string;
+}
+
 const ORDER_KEY = "name";
 const ORDER_DIRECTION = "asc";
 
@@ -169,7 +178,9 @@ export default {
     teamId,
   }: IGetSoftwareTitleQueryParams): Promise<ISoftwareTitleResponse> => {
     const endpoint = endpoints.SOFTWARE_TITLE(softwareId);
-    const path = teamId ? `${endpoint}?team_id=${teamId}` : endpoint;
+    const queryString = buildQueryStringFromParams({ team_id: teamId });
+    const path =
+      typeof teamId === "undefined" ? endpoint : `${endpoint}?${queryString}`;
     return sendRequest("GET", path);
   },
 
@@ -186,13 +197,15 @@ export default {
     teamId,
   }: IGetSoftwareVersionQueryParams) => {
     const endpoint = endpoints.SOFTWARE_VERSION(versionId);
-    const path = teamId ? `${endpoint}?team_id=${teamId}` : endpoint;
+    const queryString = buildQueryStringFromParams({ team_id: teamId });
+    const path =
+      typeof teamId === "undefined" ? endpoint : `${endpoint}?${queryString}`;
 
     return sendRequest("GET", path);
   },
 
   addSoftwarePackage: (
-    data: IAddSoftwareFormData,
+    data: IAddPackageFormData,
     teamId?: number,
     timeout?: number
   ) => {
@@ -206,8 +219,8 @@ export default {
     formData.append("software", data.software);
     formData.append("self_service", data.selfService.toString());
     data.installScript && formData.append("install_script", data.installScript);
-    data.preInstallCondition &&
-      formData.append("pre_install_query", data.preInstallCondition);
+    data.preInstallQuery &&
+      formData.append("pre_install_query", data.preInstallQuery);
     data.postInstallScript &&
       formData.append("post_install_script", data.postInstallScript);
     teamId && formData.append("team_id", teamId.toString());
@@ -223,28 +236,22 @@ export default {
   },
 
   deleteSoftwarePackage: (softwareId: number, teamId: number) => {
-    const { SOFTWARE_PACKAGE } = endpoints;
-    const path = `${SOFTWARE_PACKAGE(softwareId)}?team_id=${teamId}`;
+    const { SOFTWARE_AVAILABLE_FOR_INSTALL } = endpoints;
+    const path = `${SOFTWARE_AVAILABLE_FOR_INSTALL(
+      softwareId
+    )}?team_id=${teamId}`;
     return sendRequest("DELETE", path);
   },
 
-  downloadSoftwarePackage: (
+  getSoftwarePackageToken: (
     softwareTitleId: number,
     teamId: number
-  ): Promise<AxiosResponse> => {
-    const path = `${endpoints.SOFTWARE_PACKAGE(
+  ): Promise<ISoftwareInstallTokenResponse> => {
+    const path = `${endpoints.SOFTWARE_PACKAGE_TOKEN(
       softwareTitleId
     )}?${buildQueryStringFromParams({ alt: "media", team_id: teamId })}`;
 
-    return sendRequest(
-      "GET",
-      path,
-      undefined,
-      "blob",
-      undefined,
-      undefined,
-      true // return raw response
-    );
+    return sendRequest("POST", path);
   },
 
   getSoftwareInstallResult: (installUuid: string) => {
diff --git a/frontend/services/entities/team_policies.ts b/frontend/services/entities/team_policies.ts
index a10d954e8b00..d2e13863729b 100644
--- a/frontend/services/entities/team_policies.ts
+++ b/frontend/services/entities/team_policies.ts
@@ -86,6 +86,7 @@ export default {
       platform,
       critical,
       calendar_events_enabled,
+      software_title_id,
     } = data;
     const { TEAMS } = endpoints;
     const path = `${TEAMS}/${team_id}/policies/${id}`;
@@ -98,6 +99,7 @@ export default {
       platform,
       critical,
       calendar_events_enabled,
+      software_title_id,
     });
   },
   destroy: (teamId: number | undefined, ids: number[]) => {
diff --git a/frontend/services/entities/teams.ts b/frontend/services/entities/teams.ts
index 8bea47a64d17..6a78909a8220 100644
--- a/frontend/services/entities/teams.ts
+++ b/frontend/services/entities/teams.ts
@@ -45,6 +45,14 @@ export interface IUpdateTeamFormData {
       minimum_version: string;
       deadline: string;
     };
+    ios_updates?: {
+      minimum_version: string;
+      deadline: string;
+    };
+    ipados_updates?: {
+      minimum_version: string;
+      deadline: string;
+    };
     windows_updates?: {
       deadline_days: number;
       grace_period_days: number;
diff --git a/frontend/services/entities/vulnerabilities.ts b/frontend/services/entities/vulnerabilities.ts
index c40ce5d7bfd7..baadb559bdf7 100644
--- a/frontend/services/entities/vulnerabilities.ts
+++ b/frontend/services/entities/vulnerabilities.ts
@@ -78,11 +78,20 @@ const getVulnerability = ({
   teamId,
 }: IGetVulnerabilityOptions): Promise<IVulnerabilityResponse> => {
   const endpoint = endpoints.VULNERABILITY(vulnerability);
-  const path = teamId ? `${endpoint}?team_id=${teamId}` : endpoint;
+  const queryString = buildQueryStringFromParams({ team_id: teamId });
+  const path =
+    typeof teamId === "undefined" ? endpoint : `${endpoint}?${queryString}`;
 
   return sendRequest("GET", path);
 };
 
+export type IVulnerabilitiesEmptyStateReason =
+  | "unknown-cve"
+  | "invalid-cve"
+  | "known-vuln"
+  | "no-matching-items"
+  | "no-vulns-detected";
+
 export default {
   getVulnerabilities,
   getVulnerability,
diff --git a/frontend/styles/byod.css b/frontend/styles/byod.css
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/frontend/styles/var/_global.scss b/frontend/styles/var/_global.scss
index 74e758e2dbbe..f439ba4b974e 100644
--- a/frontend/styles/var/_global.scss
+++ b/frontend/styles/var/_global.scss
@@ -1,4 +1,5 @@
 // border radius
+$border-radius-small: 3px;
 $border-radius: 4px;
 $border-radius-medium: 6px;
 $border-radius-large: 8px;
diff --git a/frontend/templates/enroll-ota.html b/frontend/templates/enroll-ota.html
new file mode 100644
index 000000000000..6aafd2870de5
--- /dev/null
+++ b/frontend/templates/enroll-ota.html
@@ -0,0 +1,180 @@
+<html>
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="robots" content="noindex" />
+    <link rel="shortcut icon" href="{{.URLPrefix}}/assets/favicon.ico" />
+    <title>Fleet</title>
+    <style>
+      @font-face {
+        font-family: "Inter";
+        font-weight: 400;
+        src: url("../assets/fonts/inter/Inter-Regular.woff2") format("woff2"),
+          url("../assets/fonts/inter/Inter-Regular.woff") format("woff");
+      }
+      @font-face {
+        font-family: "Inter";
+        font-weight: 700;
+        src: url("../assets/fonts/inter/Inter-Bold.woff2") format("woff2"),
+          url("../assets/fonts/inter/Inter-Bold.woff") format("woff");
+      }
+
+      html {
+        box-sizing: border-box;
+        font-family: "Inter", sans-serif;
+        color: #192147;
+      }
+
+      *,
+      *:before,
+      *:after {
+        box-sizing: inherit;
+      }
+
+      body,
+      h1,
+      p {
+        margin: 0;
+      }
+
+      .download-link {
+        color: #fff;
+        background-color: #6a67fe;
+        padding: 8px 16px;
+        border-radius: 4px;
+        text-decoration: none;
+        font-weight: 700;
+        font-size: 14px;
+        width: 100px;
+        line-height: 21px;
+      }
+
+      header {
+        background-color: #192147;
+        padding: 13px 20px;
+      }
+
+      h1 {
+        margin-bottom: 8px;
+      }
+
+      p {
+        font-size: 14px;
+      }
+
+      ol {
+        display: flex;
+        flex-direction: column;
+        gap: 48px;
+        list-style: none;
+        padding: 0;
+      }
+
+      li {
+        display: flex;
+        flex-direction: column;
+        gap: 20px;
+      }
+
+      li > p {
+        display: flex;
+        gap: 4px;
+      }
+
+      .page-description {
+        font-size: 16px;
+        margin-bottom: 48px;
+      }
+
+      .profile-downloaded-container,
+      .install-profile-container {
+        width: 100%;
+        background-color: #f9fafc;
+        text-align: center;
+      }
+
+      .profile-downloaded-img,
+      .install-profile-img {
+        max-width: 100%;
+      }
+
+      .profile-downloaded-img {
+        max-height: 150px;
+      }
+
+      .install-profile-img {
+        max-height: 118px;
+      }
+
+      #main-content {
+        padding: 48px 24px;
+      }
+    </style>
+  </head>
+  <body>
+    <header>
+      <img src="{{.URLPrefix}}/assets/images/fleet-logo.svg" />
+    </header>
+    <section id="main-content">
+      <h1>Enroll your device to Fleet</h1>
+      <p class="page-description">
+        Follow the instructions below to download and install the Fleet profile
+        on your device.
+      </p>
+      <ol>
+        <li>
+          <p>
+            <span>1.</span>
+            <span>
+              <b>Download</b> the Fleet profile and select <b>Allow</b> in the
+              pop-up.
+            </span>
+          </p>
+          <a class="download-link" href="{{.EnrollURL}}">Download</a>
+        </li>
+        <li>
+          <p>
+            <span>2.</span>
+            <span>
+              Navigate to <b>Settings</b> and select <b>Profile Downloaded</b>.
+            </span>
+          </p>
+          <div class="profile-downloaded-container">
+            <img
+              class="profile-downloaded-img"
+              src=""
+              alt="select profile downloaded in settings"
+            />
+          </div>
+        </li>
+        <li>
+          <p>
+            <span>3.</span>
+            <span>Select <b>Install</b>.</span>
+          </p>
+          <div class="install-profile-container">
+            <img class="install-profile-img" src="" alt="select install" />
+          </div>
+        </li>
+      </ol>
+    </section>
+    <script>
+      const os = navigator.userAgent.includes("iPhone") ? "ios" : "iPadOS";
+
+      const profileDownloadedImg = document.querySelector(
+        ".profile-downloaded-img"
+      );
+      const installProfileImg = document.querySelector(".install-profile-img");
+
+      // setting image src based on OS
+      profileDownloadedImg.setAttribute(
+        "src",
+        `{{.URLPrefix}}/assets/images/${os}-profile-downloaded.png`
+      );
+      installProfileImg.setAttribute(
+        "src",
+        `{{.URLPrefix}}/assets/images/${os}-install-profile.png`
+      );
+    </script>
+  </body>
+</html>
diff --git a/frontend/test/handlers/apple_mdm.ts b/frontend/test/handlers/apple_mdm.ts
new file mode 100644
index 000000000000..5f8be1c3764d
--- /dev/null
+++ b/frontend/test/handlers/apple_mdm.ts
@@ -0,0 +1,19 @@
+import { rest } from "msw";
+
+import { createMockVppInfo } from "__mocks__/appleMdm";
+import { baseUrl } from "test/test-utils";
+
+// eslint-disable-next-line import/prefer-default-export
+export const defaultVppInfoHandler = rest.get(
+  baseUrl("/vpp"),
+  (req, res, context) => {
+    return res(context.json(createMockVppInfo()));
+  }
+);
+
+export const errorNoVppInfoHandler = rest.get(
+  baseUrl("/vpp"),
+  (req, res, context) => {
+    return res(context.status(404));
+  }
+);
diff --git a/frontend/test/stubs.ts b/frontend/test/stubs.ts
index dceeb54370fd..6901ce23cff8 100644
--- a/frontend/test/stubs.ts
+++ b/frontend/test/stubs.ts
@@ -1,203 +1,6 @@
 import { IUser } from "interfaces/user";
 import { ITeam } from "interfaces/team";
 
-export const adminUserStub = {
-  id: 1,
-  email: "hi@gnar.dog",
-  force_password_reset: false,
-  api_only: false,
-  global_role: "admin",
-  gravatar_url: "https://image.com",
-  name: "Gnar Mike",
-  sso_enabled: false,
-  teams: [],
-};
-
-export const configStub = {
-  org_info: {
-    org_name: "Fleet",
-    org_logo_url: "0.0.0.0:8080/logo.png",
-  },
-  server_settings: {
-    server_url: "",
-    live_query_disabled: false,
-  },
-  smtp_settings: {
-    configured: false,
-    domain: "",
-    sender_address: "",
-    server: "",
-    port: 587,
-    authentication_type: "authtype_username_password",
-    user_name: "",
-    password: "",
-    enable_ssl_tls: true,
-    authentication_method: "authmethod_plain",
-    verify_ssl_certs: true,
-    enable_start_tls: true,
-  },
-  host_expiry_settings: {
-    host_expiry_enabled: false,
-    host_expiry_window: 0,
-  },
-  webhook_settings: {
-    host_status_webhook: {
-      enable_host_status_webhook: false,
-      destination_url: "http://server.com/example",
-      host_percentage: 5,
-      days_count: 7,
-    },
-  },
-};
-
-export const flatConfigStub = {
-  org_name: "Fleet",
-  org_logo_url: "0.0.0.0:8080/logo.png",
-  server_url: "",
-  configured: false,
-  domain: "",
-  sender_address: "",
-  server: "",
-  port: 587,
-  authentication_type: "authtype_username_password",
-  user_name: "",
-  password: "",
-  enable_ssl_tls: true,
-  authentication_method: "authmethod_plain",
-  verify_ssl_certs: true,
-  enable_start_tls: true,
-  host_expiry_enabled: false,
-  host_expiry_window: 0,
-  live_query_disabled: false,
-  enable_host_status_webhook: false,
-  destination_url: "http://server.com/example",
-  host_percentage: 5,
-  days_count: 7,
-};
-
-export const hostStub = {
-  created_at: "2017-01-10T19:18:55Z",
-  updated_at: "2017-01-10T20:13:52Z",
-  id: 1,
-  detail_updated_at: "2017-01-10T20:01:48Z",
-  seen_time: "2017-01-10T20:13:54Z",
-  hostname: "52883a0ba916",
-  display_name: "52883a0ba916",
-  uuid: "FD87130B-09A9-683D-9095-D92CD20728CA",
-  platform: "ubuntu",
-  osquery_version: "2.1.2",
-  os_version: "Ubuntu 14.4.",
-  build: "",
-  platform_like: "debian",
-  code_name: "",
-  uptime: 45469000000000,
-  memory: 2094940160,
-  cpu_type: "1 x 2.4Ghz",
-  cpu_subtype: "78",
-  cpu_brand: "Intel(R) Core(TM) i5-6267U CPU @ 2.90GHz",
-  cpu_physical_cores: 2,
-  cpu_logical_cores: 2,
-  hardware_vendor: " ",
-  hardware_model: "BHYVE",
-  hardware_version: "1.0",
-  hardware_serial: "None",
-  computer_name: "52883a0ba916",
-  primary_ip: "172.19.0.8",
-  primary_mac: "02:42:ac:13:00:08",
-  status: "online",
-  display_text: "52883a0ba916",
-  target_type: "hosts",
-};
-
-export const labelStub = {
-  created_at: "2017-01-16T23:11:01Z",
-  updated_at: "2017-01-16T23:11:01Z",
-  id: 1,
-  name: "All Hosts",
-  description: "",
-  query: "select 1;",
-  platform: "",
-  label_type: 1,
-  display_text: "All Hosts",
-  count: 20,
-  online: 20,
-  offline: 0,
-  missing_in_action: 0,
-  host_ids: [],
-  type: "all",
-  target_type: "labels",
-};
-
-export const packStub = {
-  created_at: "0001-01-01T00:00:00Z",
-  updated_at: "0001-01-01T00:00:00Z",
-  id: 3,
-  name: "Pack Name",
-  description: "Pack Description",
-  platform: "",
-  created_by: 1,
-  disabled: false,
-  host_ids: [],
-  label_ids: [],
-  team_ids: [],
-};
-
-export const queryStub = {
-  created_at: "2016-10-17T07:06:00Z",
-  description: "",
-  differential: false,
-  id: 1,
-  interval: 0,
-  name: "dev_query_1",
-  platform: "",
-  query: "select * from processes",
-  snapshot: false,
-  updated_at: "2016-10-17T07:06:00Z",
-  version: "",
-  observer_can_run: true,
-};
-
-export const scheduledQueryStub = {
-  id: 1,
-  interval: 60,
-  name: "Get all users",
-  query_name: "users",
-  pack_id: 123,
-  platform: "darwin",
-  query: "SELECT * FROM users",
-  query_id: 5,
-  removed: false,
-  shard: 12,
-  snapshot: true,
-};
-
-export const globalScheduledQueryStub = {
-  id: 1,
-  interval: 60,
-  name: "Get all users",
-  query_name: "users",
-  platform: "darwin",
-  query: "SELECT * FROM users",
-  query_id: 5,
-  removed: false,
-  shard: 12,
-  snapshot: true,
-};
-
-export const teamScheduledQueryStub = {
-  id: 1,
-  interval: 60,
-  name: "Get all users",
-  query_name: "users",
-  platform: "darwin",
-  query: "SELECT * FROM users",
-  query_id: 5,
-  removed: false,
-  shard: 12,
-  snapshot: true,
-  team_id: 2,
-};
-
 export const teamStub: ITeam = {
   description: "This is the test team",
   host_count: 10,
@@ -224,48 +27,6 @@ export const userStub: IUser = {
   teams: [{ ...userTeamStub }],
 };
 
-const queryResultStub = {
-  description: "root",
-  directory: "/root",
-  gid: "0",
-  gid_signed: "0",
-  groupname: "root",
-  host_display_name: hostStub.display_name,
-};
-
-export const campaignStub = {
-  hosts: [hostStub, { ...hostStub, id: 100 }],
-  hosts_count: {
-    failed: 0,
-    successful: 2,
-    total: 2,
-  },
-  Metrics: {
-    OnlineHosts: 2,
-    OfflineHosts: 0,
-  },
-  id: 1,
-  query_id: queryStub.id,
-  query_results: [queryResultStub],
-  totals: {
-    count: 2,
-    missing_in_action: 0,
-    offline: 0,
-    online: 2,
-  },
-};
-
 export default {
-  adminUserStub,
-  campaignStub,
-  configStub,
-  flatConfigStub,
-  hostStub,
-  labelStub,
-  packStub,
-  queryStub,
-  scheduledQueryStub,
-  globalScheduledQueryStub,
-  teamScheduledQueryStub,
   userStub,
 };
diff --git a/frontend/test/test-utils.tsx b/frontend/test/test-utils.tsx
index ce7bde4298e7..5e4e089889e4 100644
--- a/frontend/test/test-utils.tsx
+++ b/frontend/test/test-utils.tsx
@@ -171,3 +171,17 @@ export const createMockRouter = (overrides?: Partial<InjectedRouter>) => {
     ...overrides,
   };
 };
+
+/** helper method to generate a date "x" days ago. */
+export const getPastDate = (days: number) => {
+  const targetDate = new Date();
+  targetDate.setDate(targetDate.getDate() - days);
+  return targetDate.toISOString();
+};
+
+/** helper method to generate a date "x" days from now */
+export const getFutureDate = (days: number) => {
+  const targetDate = new Date();
+  targetDate.setDate(targetDate.getDate() + days);
+  return targetDate.toISOString();
+};
diff --git a/frontend/utilities/constants.tsx b/frontend/utilities/constants.tsx
index b3267c4580a4..4b780aebc98c 100644
--- a/frontend/utilities/constants.tsx
+++ b/frontend/utilities/constants.tsx
@@ -59,7 +59,14 @@ export const HOST_STATUS_WEBHOOK_WINDOW_DROPDOWN_OPTIONS: IDropdownOption[] = [
 
 export const GITHUB_NEW_ISSUE_LINK =
   "https://github.com/fleetdm/fleet/issues/new?assignees=&labels=bug%2C%3Areproduce&template=bug-report.md";
-export const SUPPORT_LINK = "https://fleetdm.com/support";
+
+export const FLEET_WEBSITE_URL = "https://fleetdm.com";
+
+export const SUPPORT_LINK = `${FLEET_WEBSITE_URL}/support`;
+
+export const CONTACT_FLEET_LINK = `${FLEET_WEBSITE_URL}/contact`;
+
+export const LEARN_MORE_ABOUT_BASE_LINK = `${FLEET_WEBSITE_URL}/learn-more-about`;
 
 /**  July 28, 2016 is the date of the initial commit to fleet/fleet. */
 export const INITIAL_FLEET_DATE = "2016-07-28T00:00:00Z";
@@ -304,6 +311,9 @@ export const HOSTS_SEARCH_BOX_PLACEHOLDER =
 export const HOSTS_SEARCH_BOX_TOOLTIP =
   "Search hosts by name, hostname, UUID, serial number, or private IP address";
 
+export const VULNERABILITIES_SEARCH_BOX_TOOLTIP =
+  'To search for an exact CVE, surround the string in double quotes (e.g. "CVE-2024-1234")';
+
 // Keys from API
 export const MDM_STATUS_TOOLTIP: Record<string, string | React.ReactNode> = {
   "On (automatic)": (
diff --git a/frontend/utilities/date_format/date_format.tests.ts b/frontend/utilities/date_format/date_format.tests.ts
index 102f34d04837..b39d0d1eebbe 100644
--- a/frontend/utilities/date_format/date_format.tests.ts
+++ b/frontend/utilities/date_format/date_format.tests.ts
@@ -1,6 +1,6 @@
-import { uploadedFromNow } from ".";
+import { monthDayYearFormat, uploadedFromNow } from ".";
 
-describe("date_format", () => {
+describe("date_format utilities", () => {
   describe("uploadedFromNow util", () => {
     it("returns an user friendly uploaded at message", () => {
       const currentDate = new Date();
@@ -10,4 +10,11 @@ describe("date_format", () => {
       expect(uploadedFromNow(twoDaysAgo)).toEqual("Uploaded 2 days ago");
     });
   });
+
+  describe("monthDayYearFormat util", () => {
+    it("returns a date in the format of 'MonthName Date, Year' (e.g. January 01, 2024)", () => {
+      const date = "2024-11-29T00:00:00Z";
+      expect(monthDayYearFormat(date)).toEqual("November 29, 2024");
+    });
+  });
 });
diff --git a/frontend/utilities/date_format/index.ts b/frontend/utilities/date_format/index.ts
index 329d977dba74..538c3a827da7 100644
--- a/frontend/utilities/date_format/index.ts
+++ b/frontend/utilities/date_format/index.ts
@@ -1,4 +1,4 @@
-import { formatDistanceToNow } from "date-fns";
+import { format, formatDistanceToNow, intlFormat } from "date-fns";
 
 /** Utility to create a string from a date in this format:
   `Uploaded .... ago`
@@ -15,3 +15,11 @@ export const dateAgo = (date: string) => {
   // NOTE: Malformed dates will result in errors. This is expected "fail loudly" behavior.
   return `${formatDistanceToNow(new Date(date))} ago`;
 };
+
+/**
+ * returns a date in the format of 'MonthName Date, Year'
+ * @example "January 01, 2024"
+ */
+export const monthDayYearFormat = (date: string) => {
+  return format(date, "MMMM d, yyyy");
+};
diff --git a/frontend/utilities/endpoints.ts b/frontend/utilities/endpoints.ts
index d096fd4a0a67..2abe094de134 100644
--- a/frontend/utilities/endpoints.ts
+++ b/frontend/utilities/endpoints.ts
@@ -31,9 +31,6 @@ export default {
     `/${API_VERSION}/fleet/device/${token}/software`,
   DEVICE_SOFTWARE_INSTALL: (token: string, softwareTitleId: number) =>
     `/${API_VERSION}/fleet/device/${token}/software/install/${softwareTitleId}`,
-  DEVICE_USER_RESET_ENCRYPTION_KEY: (token: string): string => {
-    return `/${API_VERSION}/fleet/device/${token}/rotate_encryption_key`;
-  },
   DEVICE_USER_MDM_ENROLLMENT_PROFILE: (token: string): string => {
     return `/${API_VERSION}/fleet/device/${token}/mdm/apple/manual_enrollment_profile`;
   },
@@ -74,17 +71,39 @@ export default {
   LOGOUT: `/${API_VERSION}/fleet/logout`,
   MACADMINS: `/${API_VERSION}/fleet/macadmins`,
 
-  // MDM endpoints
+  /**
+   * MDM endpoints
+   */
+
+  MDM_SUMMARY: `/${API_VERSION}/fleet/hosts/summary/mdm`,
+
+  // apple mdm endpoints
   MDM_APPLE: `/${API_VERSION}/fleet/mdm/apple`,
-  MDM_APPLE_ABM_TOKEN: `/${API_VERSION}/fleet/mdm/apple/abm_token`,
+
+  // Apple Business Manager (ABM) endpoints
+  MDM_ABM_TOKENS: `/${API_VERSION}/fleet/abm_tokens`,
+  MDM_ABM_TOKEN: (id: number) => `/${API_VERSION}/fleet/abm_tokens/${id}`,
+  MDM_ABM_TOKEN_RENEW: (id: number) =>
+    `/${API_VERSION}/fleet/abm_tokens/${id}/renew`,
+  MDM_ABM_TOKEN_TEAMS: (id: number) =>
+    `/${API_VERSION}/fleet/abm_tokens/${id}/teams`,
   MDM_APPLE_ABM_PUBLIC_KEY: `/${API_VERSION}/fleet/mdm/apple/abm_public_key`,
   MDM_APPLE_APNS_CERTIFICATE: `/${API_VERSION}/fleet/mdm/apple/apns_certificate`,
   MDM_APPLE_PNS: `/${API_VERSION}/fleet/apns`,
-  MDM_APPLE_BM: `/${API_VERSION}/fleet/abm`,
+  MDM_APPLE_BM: `/${API_VERSION}/fleet/abm`, // TODO: Deprecated?
   MDM_APPLE_BM_KEYS: `/${API_VERSION}/fleet/mdm/apple/dep/key_pair`,
-  MDM_SUMMARY: `/${API_VERSION}/fleet/hosts/summary/mdm`,
+  MDM_APPLE_VPP_APPS: `/${API_VERSION}/fleet/software/app_store_apps`,
   MDM_REQUEST_CSR: `/${API_VERSION}/fleet/mdm/apple/request_csr`,
 
+  // Apple VPP endpoints
+  MDM_APPLE_VPP_TOKEN: `/${API_VERSION}/fleet/mdm/apple/vpp_token`, // TODO: Deprecated?
+  MDM_VPP_TOKENS: `/${API_VERSION}/fleet/vpp_tokens`,
+  MDM_VPP_TOKEN: (id: number) => `/${API_VERSION}/fleet/vpp_tokens/${id}`,
+  MDM_VPP_TOKENS_RENEW: (id: number) =>
+    `/${API_VERSION}/fleet/vpp_tokens/${id}/renew`,
+  MDM_VPP_TOKEN_TEAMS: (id: number) =>
+    `/${API_VERSION}/fleet/vpp_tokens/${id}/teams`,
+
   // MDM profile endpoints
   MDM_PROFILES: `/${API_VERSION}/fleet/mdm/profiles`,
   MDM_PROFILE: (id: string) => `/${API_VERSION}/fleet/mdm/profiles/${id}`,
@@ -143,12 +162,14 @@ export default {
   SOFTWARE_VERSION: (id: number) =>
     `/${API_VERSION}/fleet/software/versions/${id}`,
   SOFTWARE_PACKAGE_ADD: `/${API_VERSION}/fleet/software/package`,
-  SOFTWARE_PACKAGE: (id: number) =>
-    `/${API_VERSION}/fleet/software/${id}/package`,
+  SOFTWARE_PACKAGE_TOKEN: (id: number) =>
+    `/${API_VERSION}/fleet/software/titles/${id}/package/token`,
   SOFTWARE_INSTALL_RESULTS: (uuid: string) =>
     `/${API_VERSION}/fleet/software/install/results/${uuid}`,
   SOFTWARE_PACKAGE_INSTALL: (id: number) =>
     `/${API_VERSION}/fleet/software/packages/${id}`,
+  SOFTWARE_AVAILABLE_FOR_INSTALL: (id: number) =>
+    `/${API_VERSION}/fleet/software/titles/${id}/available_for_install`,
 
   // AI endpoints
   AUTOFILL_POLICY: `/${API_VERSION}/fleet/autofill/policy`,
@@ -199,4 +220,6 @@ export default {
   SCRIPT_RESULT: (executionId: string) =>
     `/${API_VERSION}/fleet/scripts/results/${executionId}`,
   SCRIPT_RUN: `/${API_VERSION}/fleet/scripts/run`,
+
+  COMMANDS_RESULTS: `/${API_VERSION}/fleet/commands/results`,
 };
diff --git a/frontend/utilities/helpers.tests.tsx b/frontend/utilities/helpers.tests.tsx
new file mode 100644
index 000000000000..f7acfa7944a0
--- /dev/null
+++ b/frontend/utilities/helpers.tests.tsx
@@ -0,0 +1,80 @@
+import { getPastDate, getFutureDate } from "test/test-utils";
+import {
+  removeOSPrefix,
+  compareVersions,
+  willExpireWithinXDays,
+} from "./helpers";
+
+describe("helpers utilities", () => {
+  describe("removeOSPrefix function", () => {
+    it("properly removes Apple prefix from a host's operating system version", () => {
+      expect(removeOSPrefix("macOS 14.1.2")).toEqual("14.1.2");
+      expect(removeOSPrefix("iOS 18.0")).toEqual("18.0");
+      expect(removeOSPrefix("iPadOS 17.5.1")).toEqual("17.5.1");
+    });
+  });
+
+  describe("compareVersions function", () => {
+    it("properly checks if a version is older than another", () => {
+      expect(compareVersions("14.4.1", "14.4.2")).toEqual(-1);
+      expect(compareVersions("14.4.1", "14.5")).toEqual(-1);
+      expect(compareVersions("14.4.1", "15")).toEqual(-1);
+
+      expect(compareVersions("14.4", "14.4.2")).toEqual(-1);
+      expect(compareVersions("14.4", "14.5")).toEqual(-1);
+      expect(compareVersions("14.4", "15")).toEqual(-1);
+
+      expect(compareVersions("14", "14.4.2")).toEqual(-1);
+      expect(compareVersions("14", "14.0.5")).toEqual(-1);
+      expect(compareVersions("14", "15")).toEqual(-1);
+    });
+
+    it("properly checks if a version is newer than another", () => {
+      expect(compareVersions("14.4.4", "14.4.3")).toEqual(1);
+      expect(compareVersions("14.3.4", "14.3")).toEqual(1);
+      expect(compareVersions("14.0.4", "14")).toEqual(1);
+
+      expect(compareVersions("14.5", "14.4.3")).toEqual(1);
+      expect(compareVersions("14.5", "14.3")).toEqual(1);
+      expect(compareVersions("14.5", "14")).toEqual(1);
+
+      expect(compareVersions("14", "13.9.21")).toEqual(1);
+      expect(compareVersions("14", "13.9")).toEqual(1);
+      expect(compareVersions("14", "13")).toEqual(1);
+    });
+
+    it("properly checks if a version is equal to another", () => {
+      expect(compareVersions("14.0.4", "14.0.4")).toEqual(0);
+      expect(compareVersions("14.3", "14.3")).toEqual(0);
+      expect(compareVersions("14", "14")).toEqual(0);
+      expect(compareVersions("14.3", "14.3.0")).toEqual(0);
+      expect(compareVersions("14", "14.0.0")).toEqual(0);
+    });
+  });
+
+  describe("willExpireWithinXDays function", () => {
+    it("will return true if the date is within x number of days", () => {
+      const fiveDaysFromNow = getFutureDate(5);
+      expect(willExpireWithinXDays(fiveDaysFromNow, 10)).toEqual(true);
+
+      const tenDaysFromNow = getFutureDate(10);
+      expect(willExpireWithinXDays(tenDaysFromNow, 30)).toEqual(true);
+    });
+
+    it("will return false if the date is not within x number of days", () => {
+      const thirtyDaysFromNow = getFutureDate(30);
+      expect(willExpireWithinXDays(thirtyDaysFromNow, 10)).toEqual(false);
+
+      const fiftyDaysFromNow = getFutureDate(50);
+      expect(willExpireWithinXDays(fiftyDaysFromNow, 30)).toEqual(false);
+    });
+
+    it("will return false if the date has already expired", () => {
+      const fiveDaysAgo = getPastDate(5);
+      expect(willExpireWithinXDays(fiveDaysAgo, 10)).toEqual(false);
+
+      const fiftyDaysAgo = getPastDate(50);
+      expect(willExpireWithinXDays(fiftyDaysAgo, 30)).toEqual(false);
+    });
+  });
+});
diff --git a/frontend/utilities/helpers.tsx b/frontend/utilities/helpers.tsx
index f050ef02c470..49f0022383a0 100644
--- a/frontend/utilities/helpers.tsx
+++ b/frontend/utilities/helpers.tsx
@@ -11,6 +11,7 @@ import {
   trim,
   trimEnd,
   union,
+  uniqueId,
 } from "lodash";
 import md5 from "js-md5";
 import {
@@ -104,6 +105,37 @@ export const createHostsByPolicyPath = (
   })}`;
 };
 
+/** Removes Apple OS Prefix from host.os_version. */
+export const removeOSPrefix = (version: string): string => {
+  return version.replace(/^(macOS |iOS |iPadOS )/i, "");
+};
+
+/** Returns 1 if first version is newer, -1 if first version is older, and 0 if equal  */
+export const compareVersions = (version1: string, version2: string) => {
+  const v1Parts = version1.split(".").map(Number);
+  const v2Parts = version2.split(".").map(Number);
+
+  const maxLength = Math.max(v1Parts.length, v2Parts.length);
+
+  // Create a new array with a length of maxLength, mapping each index to a comparison result
+  return (
+    Array.from({ length: maxLength }, (_, index) => {
+      // Retrieve the corresponding parts from v1Parts and v2Parts, defaulting to 0
+      const v1Part = v1Parts[index] || 0;
+      const v2Part = v2Parts[index] || 0;
+
+      // Compare the current parts and return -1, 1, or 0 based on the result
+      if (v1Part < v2Part) return -1;
+      if (v1Part > v2Part) return 1;
+      return 0;
+    })
+      // Use Array.find to return the first non-equal version number in the comparison array
+      .find((result) => result !== 0) ||
+    // If no difference is found, return 0 to indicate equal versions
+    0
+  );
+};
+
 const labelSlug = (label: ILabel): string => {
   const { id, name } = label;
 
@@ -691,13 +723,17 @@ export const hasLicenseExpired = (expiration: string): boolean => {
   return isAfter(new Date(), new Date(expiration));
 };
 
-export const willExpireWithinXDays = (
-  expiration: string,
-  x: number
-): boolean => {
+/**
+ * determines if a date will expire within "x" number of days. If the date has
+ * has already expired, this function will return false.
+ */
+export const willExpireWithinXDays = (expiration: string, x: number) => {
   const xDaysFromNow = addDays(new Date(), x);
 
-  return isAfter(xDaysFromNow, new Date(expiration));
+  return (
+    !hasLicenseExpired(expiration) &&
+    isAfter(xDaysFromNow, new Date(expiration))
+  );
 };
 
 export const readableDate = (date: string) => {
@@ -790,6 +826,17 @@ export const syntaxHighlight = (json: any): string => {
   /* eslint-enable no-useless-escape */
 };
 
+export const tooltipTextWithLineBreaks = (lines: string[]) => {
+  return lines.map((line) => {
+    return (
+      <span key={uniqueId()}>
+        {line}
+        <br />
+      </span>
+    );
+  });
+};
+
 export const getSortedTeamOptions = memoize((teams: ITeam[]) =>
   teams
     .map((team) => {
@@ -978,6 +1025,8 @@ export function getCustomDropdownOptions(
 
 export default {
   addGravatarUrlToResource,
+  removeOSPrefix,
+  compareVersions,
   createHostsByPolicyPath,
   formatConfigDataForServer,
   formatLabelResponse,
diff --git a/frontend/utilities/strings/stringUtils.tests.ts b/frontend/utilities/strings/stringUtils.tests.ts
index 25755873ff65..4ebc69c6327a 100644
--- a/frontend/utilities/strings/stringUtils.tests.ts
+++ b/frontend/utilities/strings/stringUtils.tests.ts
@@ -1,4 +1,10 @@
-import { enforceFleetSentenceCasing, pluralize } from "./stringUtils";
+import {
+  enforceFleetSentenceCasing,
+  pluralize,
+  strToBool,
+  stripQuotes,
+  isIncompleteQuoteQuery,
+} from "./stringUtils";
 
 describe("string utilities", () => {
   describe("enforceFleetSentenceCasing utility", () => {
@@ -44,4 +50,45 @@ describe("string utilities", () => {
       expect(pluralize(100, "hero")).toEqual("heros");
     });
   });
+
+  describe("strToBool utility", () => {
+    it("converts 'true' to true and 'false' to false", () => {
+      expect(strToBool("true")).toBe(true);
+      expect(strToBool("false")).toBe(false);
+    });
+
+    it("returns false for undefined, null, or empty string", () => {
+      expect(strToBool(undefined)).toBe(false);
+      expect(strToBool(null)).toBe(false);
+      expect(strToBool("")).toBe(false);
+    });
+  });
+
+  describe("stripQuotes utility", () => {
+    it("removes matching single or double quotes from the start and end of a string", () => {
+      expect(stripQuotes('"Hello, World!"')).toEqual("Hello, World!");
+      expect(stripQuotes("'Hello, World!'")).toEqual("Hello, World!");
+    });
+    it("does not modify a string without quotes or mismatched quotes", () => {
+      expect(stripQuotes("No quotes here")).toEqual("No quotes here");
+      expect(stripQuotes(`'Mismatched quotes"`)).toEqual(`'Mismatched quotes"`);
+    });
+  });
+
+  describe("isIncompleteQuoteQuery utility", () => {
+    it("returns true for a string starting with a quote but not ending with one", () => {
+      expect(isIncompleteQuoteQuery('"incomplete')).toBe(true);
+      expect(isIncompleteQuoteQuery("'incomplete")).toBe(true);
+    });
+
+    it("returns false for a string with matching quotes", () => {
+      expect(isIncompleteQuoteQuery('"complete"')).toBe(false);
+      expect(isIncompleteQuoteQuery("'complete'")).toBe(false);
+    });
+
+    it("returns false for a string without any quotes or an empty string", () => {
+      expect(isIncompleteQuoteQuery("no quotes")).toBe(false);
+      expect(isIncompleteQuoteQuery("")).toBe(false);
+    });
+  });
 });
diff --git a/frontend/utilities/strings/stringUtils.ts b/frontend/utilities/strings/stringUtils.ts
index 6d0c8756feee..7a679b933ba3 100644
--- a/frontend/utilities/strings/stringUtils.ts
+++ b/frontend/utilities/strings/stringUtils.ts
@@ -75,8 +75,30 @@ export const pluralize = (
   return `${root}${count !== 1 ? pluralSuffix : singularSuffix}`;
 };
 
+export const strToBool = (str?: string | null) => {
+  return str ? JSON.parse(str) : false;
+};
+
+export const stripQuotes = (string: string) => {
+  // Regular expression to match quotes at the start and end of the string
+  const quoteRegex = /^([''""])([\s\S]*?)(\1)$/;
+
+  // If the string matches the regex, return the content between the quotes
+  // Otherwise, return the original string
+  const match = string.match(quoteRegex);
+  return match ? match[2] : string;
+};
+
+export const isIncompleteQuoteQuery = (str: string) => {
+  const pattern = /^(['"])(?!.*\1$)/;
+  return pattern.test(str);
+};
+
 export default {
   capitalize,
   capitalizeRole,
   pluralize,
+  strToBool,
+  stripQuotes,
+  isIncompleteQuoteQuery,
 };
diff --git a/frontend/utilities/url/index.ts b/frontend/utilities/url/index.ts
index b8f274ee1777..a8557f4ab8c8 100644
--- a/frontend/utilities/url/index.ts
+++ b/frontend/utilities/url/index.ts
@@ -11,7 +11,7 @@ import {
 } from "services/entities/hosts";
 import { isValidSoftwareInstallStatus } from "interfaces/software";
 
-type QueryValues = string | number | boolean | undefined | null;
+export type QueryValues = string | number | boolean | undefined | null;
 export type QueryParams = Record<string, QueryValues>;
 type FilteredQueryValues = string | number | boolean;
 type FilteredQueryParams = Record<string, FilteredQueryValues>;
@@ -45,6 +45,30 @@ interface IMutuallyExclusiveHostParams {
   bootstrapPackageStatus?: BootstrapPackageStatus;
 }
 
+export const parseQueryValueToNumberOrUndefined = (
+  value: QueryValues,
+  min?: number,
+  max?: number
+): number | undefined => {
+  const isWithinRange = (num: number) => {
+    if (min !== undefined && max !== undefined) {
+      return num >= min && num <= max;
+    }
+    return true; // No range check if min or max is undefined
+  };
+
+  if (typeof value === "number") {
+    return isWithinRange(value) ? value : undefined;
+  }
+  if (typeof value === "string") {
+    const parsedValue = parseFloat(value);
+    return !isNaN(parsedValue) && isWithinRange(parsedValue)
+      ? parsedValue
+      : undefined;
+  }
+  return undefined;
+};
+
 const reduceQueryParams = (
   params: string[],
   value: FilteredQueryValues,
diff --git a/go.mod b/go.mod
index 93df3cccf59a..d1458f2471d6 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/fleetdm/fleet/v4
 
-go 1.22.4
+go 1.23.1
 
 require (
 	cloud.google.com/go/pubsub v1.36.1
@@ -14,20 +14,20 @@ require (
 	github.com/XSAM/otelsql v0.10.0
 	github.com/andygrunwald/go-jira v1.16.0
 	github.com/antchfx/xmlquery v1.3.14
+	github.com/apex/log v1.9.0
 	github.com/aws/aws-sdk-go v1.44.288
 	github.com/beevik/etree v1.3.0
 	github.com/beevik/ntp v0.3.0
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
-	github.com/boltdb/bolt v1.3.1
-	github.com/briandowns/spinner v1.13.0
+	github.com/briandowns/spinner v1.23.1
 	github.com/cenkalti/backoff v2.2.1+incompatible
-	github.com/cenkalti/backoff/v4 v4.2.1
+	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/clbanning/mxj v1.8.4
 	github.com/danieljoos/wincred v1.2.1
 	github.com/davecgh/go-spew v1.1.1
 	github.com/dgraph-io/badger/v2 v2.2007.4
 	github.com/digitalocean/go-smbios v0.0.0-20180907143718-390a4f403a8e
-	github.com/docker/docker v24.0.9+incompatible
+	github.com/docker/docker v26.1.5+incompatible
 	github.com/docker/go-units v0.5.0
 	github.com/doug-martin/goqu/v9 v9.18.0
 	github.com/e-dard/netbug v0.0.0-20151029172837-e64d308a0b20
@@ -66,7 +66,7 @@ require (
 	github.com/kevinburke/go-bindata v3.24.0+incompatible
 	github.com/kolide/launcher v1.0.12
 	github.com/lib/pq v1.10.9
-	github.com/macadmins/osquery-extension v1.1.3-0.20240530154548-05bb97403086
+	github.com/macadmins/osquery-extension v1.2.1
 	github.com/mattermost/xml-roundtrip-validator v0.0.0-20201213122252-bcd7e1b9601e
 	github.com/mattn/go-sqlite3 v1.14.22
 	github.com/micromdm/micromdm v1.9.0
@@ -112,22 +112,22 @@ require (
 	go.etcd.io/bbolt v1.3.9
 	go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352
 	go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux v0.44.0
-	go.opentelemetry.io/otel v1.22.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0
+	go.opentelemetry.io/otel v1.28.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0
-	go.opentelemetry.io/otel/sdk v1.22.0
-	golang.org/x/crypto v0.23.0
+	go.opentelemetry.io/otel/sdk v1.28.0
+	golang.org/x/crypto v0.24.0
 	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842
 	golang.org/x/image v0.18.0
 	golang.org/x/mod v0.17.0
-	golang.org/x/net v0.25.0
-	golang.org/x/oauth2 v0.16.0
+	golang.org/x/net v0.26.0
+	golang.org/x/oauth2 v0.20.0
 	golang.org/x/sync v0.7.0
-	golang.org/x/sys v0.20.0
+	golang.org/x/sys v0.21.0
 	golang.org/x/text v0.16.0
 	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d
-	google.golang.org/api v0.161.0
-	google.golang.org/grpc v1.61.0
+	google.golang.org/api v0.169.0
+	google.golang.org/grpc v1.64.1
 	gopkg.in/guregu/null.v3 v3.5.0
 	gopkg.in/ini.v1 v1.67.0
 	gopkg.in/natefinch/lumberjack.v2 v2.0.0
@@ -137,12 +137,11 @@ require (
 )
 
 require (
-	cloud.google.com/go v0.112.0 // indirect
-	cloud.google.com/go/compute v1.23.4 // indirect
-	cloud.google.com/go/compute/metadata v0.2.3 // indirect
+	cloud.google.com/go v0.112.1 // indirect
+	cloud.google.com/go/compute/metadata v0.3.0 // indirect
 	cloud.google.com/go/iam v1.1.6 // indirect
-	cloud.google.com/go/kms v1.15.6 // indirect
-	cloud.google.com/go/storage v1.36.0 // indirect
+	cloud.google.com/go/kms v1.15.7 // indirect
+	cloud.google.com/go/storage v1.38.0 // indirect
 	code.gitea.io/sdk/gitea v0.15.0 // indirect
 	dario.cat/mergo v1.0.0 // indirect
 	github.com/AlekSi/pointer v1.2.0 // indirect
@@ -174,7 +173,6 @@ require (
 	github.com/alecthomas/jsonschema v0.0.0-20211022214203-8b29eab41725 // indirect
 	github.com/antchfx/xpath v1.2.2 // indirect
 	github.com/apache/thrift v0.18.1 // indirect
-	github.com/apex/log v1.9.0 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/atc0005/go-teams-notify/v2 v2.6.0 // indirect
 	github.com/aws/aws-sdk-go-v2 v1.24.1 // indirect
@@ -200,6 +198,7 @@ require (
 	github.com/cespare/xxhash v1.1.0 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/cloudflare/circl v1.3.7 // indirect
+	github.com/containerd/log v0.1.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
 	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
 	github.com/dghubble/go-twitter v0.0.0-20210609183100-2fdbf421508e // indirect
@@ -208,7 +207,7 @@ require (
 	github.com/dgraph-io/ristretto v0.1.0 // indirect
 	github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect
 	github.com/dimchansky/utfbom v1.1.1 // indirect
-	github.com/docker/distribution v2.8.2+incompatible // indirect
+	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/edsrzf/mmap-go v1.1.0 // indirect
@@ -218,19 +217,18 @@ require (
 	github.com/fatih/structs v1.1.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
-	github.com/garyburd/go-oauth v0.0.0-20180319155456-bca2e7f09a17 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.5.0 // indirect
 	github.com/go-logfmt/logfmt v0.5.1 // indirect
-	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-telegram-bot-api/telegram-bot-api v4.6.4+incompatible // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/glog v1.1.2 // indirect
+	github.com/golang/glog v1.2.0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/go-github/v39 v39.2.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
@@ -238,11 +236,11 @@ require (
 	github.com/google/s2a-go v0.1.7 // indirect
 	github.com/google/wire v0.5.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
-	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
+	github.com/googleapis/gax-go/v2 v2.12.2 // indirect
 	github.com/goreleaser/chglog v0.1.2 // indirect
 	github.com/goreleaser/fileglob v1.2.0 // indirect
 	github.com/gorilla/schema v1.4.1 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-hclog v1.6.3 // indirect
@@ -272,6 +270,7 @@ require (
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/mapstructure v1.4.3 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0-rc6 // indirect
 	github.com/oschwald/maxminddb-golang v1.10.0 // indirect
@@ -310,21 +309,21 @@ require (
 	go.elastic.co/apm/module/apmhttp/v2 v2.3.0 // indirect
 	go.elastic.co/fastjson v1.1.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 // indirect
-	go.opentelemetry.io/otel/metric v1.22.0 // indirect
-	go.opentelemetry.io/otel/trace v1.22.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.28.0 // indirect
+	go.opentelemetry.io/otel/metric v1.28.0 // indirect
+	go.opentelemetry.io/otel/trace v1.28.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
 	go.uber.org/goleak v1.3.0 // indirect
 	gocloud.dev v0.24.0 // indirect
-	golang.org/x/term v0.20.0 // indirect
+	golang.org/x/term v0.21.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
-	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto v0.0.0-20240205150955-31a09d347014 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
+	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
+	google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240701130421-f6361c86f094 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 // indirect
+	google.golang.org/protobuf v1.34.2 // indirect
 	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
 	gopkg.in/mail.v2 v2.3.1 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
diff --git a/go.sum b/go.sum
index 4f7c3d2e5741..239c87b7d176 100644
--- a/go.sum
+++ b/go.sum
@@ -31,18 +31,16 @@ cloud.google.com/go v0.92.2/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+Y
 cloud.google.com/go v0.92.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
 cloud.google.com/go v0.93.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
 cloud.google.com/go v0.94.0/go.mod h1:qAlAugsXlC+JWO+Bke5vCtc9ONxjQT3drlTTnAplMW4=
-cloud.google.com/go v0.112.0 h1:tpFCD7hpHFlQ8yPwT3x+QeXqc2T6+n6T+hmABHfDUSM=
-cloud.google.com/go v0.112.0/go.mod h1:3jEEVwZ/MHU4djK5t5RHuKOA/GbLddgTdVubX1qnPD4=
+cloud.google.com/go v0.112.1 h1:uJSeirPke5UNZHIb4SxfZklVSiWWVqW4oXlETwZziwM=
+cloud.google.com/go v0.112.1/go.mod h1:+Vbu+Y1UU+I1rjmzeMOb/8RfkKJK2Gyxi1X6jJCZLo4=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
 cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
 cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/compute v1.23.4 h1:EBT9Nw4q3zyE7G45Wvv3MzolIrCJEuHys5muLY0wvAw=
-cloud.google.com/go/compute v1.23.4/go.mod h1:/EJMj55asU6kAFnuZET8zqgwgJ9FvXWXOkkfQZa4ioI=
-cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
-cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
+cloud.google.com/go/compute/metadata v0.3.0 h1:Tz+eQXMEqDIKRsmY3cHTL6FVaynIjX2QxYC4trgAKZc=
+cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqClKRT5SZwBmk=
@@ -50,8 +48,8 @@ cloud.google.com/go/firestore v1.5.0/go.mod h1:c4nNYR1qdq7eaZ+jSc5fonrQN2k3M7sWA
 cloud.google.com/go/iam v1.1.6 h1:bEa06k05IO4f4uJonbB5iAgKTPpABy1ayxaIZV/GHVc=
 cloud.google.com/go/iam v1.1.6/go.mod h1:O0zxdPeGBoFdWW3HWmBxJsk0pfvNM/p/qa82rWOGTwI=
 cloud.google.com/go/kms v0.1.0/go.mod h1:8Qp8PCAypHg4FdmlyW1QRAv09BGQ9Uzh7JnmIZxPk+c=
-cloud.google.com/go/kms v1.15.6 h1:ktpEMQmsOAYj3VZwH020FcQlm23BVYg8T8O1woG2GcE=
-cloud.google.com/go/kms v1.15.6/go.mod h1:yF75jttnIdHfGBoE51AKsD/Yqf+/jICzB9v1s1acsms=
+cloud.google.com/go/kms v1.15.7 h1:7caV9K3yIxvlQPAcaFffhlT7d1qpxjB1wHBtjWa13SM=
+cloud.google.com/go/kms v1.15.7/go.mod h1:ub54lbsa6tDkUwnu4W7Yt1aAIFLnspgh0kPGToDukeI=
 cloud.google.com/go/monitoring v0.1.0/go.mod h1:Hpm3XfzJv+UTiXzCG5Ffp0wijzHTC7Cv4eR7o3x/fEE=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
@@ -67,8 +65,8 @@ cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohl
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
 cloud.google.com/go/storage v1.16.1/go.mod h1:LaNorbty3ehnU3rEjXSNV/NRgQA0O8Y+uh6bPe5UOk4=
-cloud.google.com/go/storage v1.36.0 h1:P0mOkAcaJxhCTvAkMhxMfrTKiNcub4YmmPBtlhAyTr8=
-cloud.google.com/go/storage v1.36.0/go.mod h1:M6M/3V/D3KpzMTJyPOR/HU6n2Si5QdaXYEsng2xgOs8=
+cloud.google.com/go/storage v1.38.0 h1:Az68ZRGlnNTpIBbLjSMIV2BDcwwXYlRlQzis0llkpJg=
+cloud.google.com/go/storage v1.38.0/go.mod h1:tlUADB0mAb9BgYls9lq+8MGkfzOXuLrnHXlpHmvFJoY=
 cloud.google.com/go/trace v0.1.0/go.mod h1:wxEwsoeRVPbeSkt7ZC9nWCgmoKQRAoySN7XHW2AmI7g=
 code.gitea.io/gitea-vet v0.2.1/go.mod h1:zcNbT/aJEmivCAhfmkHOlT645KNOf9W2KnkLgFjGGfE=
 code.gitea.io/sdk/gitea v0.15.0 h1:tsNhxDM/2N1Ohv1Xq5UWrht/esg0WmtRj4wsHVHriTg=
@@ -299,10 +297,8 @@ github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kB
 github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
 github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb h1:m935MPodAbYS46DG4pJSv7WO+VECIWUQ7OJYSoTrMh4=
 github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb/go.mod h1:PkYb9DJNAwrSvRx5DYA+gUcOIgTGVMNkfSCbZM8cWpI=
-github.com/boltdb/bolt v1.3.1 h1:JQmyP4ZBrce+ZQu0dY660FMfatumYDLun9hBCUVIkF4=
-github.com/boltdb/bolt v1.3.1/go.mod h1:clJnj/oiGkjum5o1McbSZDSLxVThjynRyGBgiAx27Ps=
-github.com/briandowns/spinner v1.13.0 h1:q/Y9LtpwtvL0CRzXrAMj0keVXqNhBYUFg6tBOUiY8ek=
-github.com/briandowns/spinner v1.13.0/go.mod h1:QOuQk7x+EaDASo80FEXwlwiA+j/PPIcX3FScO+3/ZPQ=
+github.com/briandowns/spinner v1.23.1 h1:t5fDPmScwUjozhDj4FA46p5acZWIPXYE30qW2Ptu650=
+github.com/briandowns/spinner v1.23.1/go.mod h1:LaZeM4wm2Ywy6vO571mvhQNRcWfRUnXOs0RcKV0wYKM=
 github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
 github.com/bytecodealliance/wasmtime-go v0.36.0 h1:B6thr7RMM9xQmouBtUqm1RpkJjuLS37m6nxX+iwsQSc=
 github.com/bytecodealliance/wasmtime-go v0.36.0/go.mod h1:q320gUxqyI8yB+ZqRuaJOEnGkAnHh6WtJjMaT2CW4wI=
@@ -323,8 +319,8 @@ github.com/cavaliercoder/go-cpio v0.0.0-20180626203310-925f9528c45e/go.mod h1:oD
 github.com/cenkalti/backoff v2.1.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
 github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
 github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
-github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
-github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/certifi/gocertifi v0.0.0-20180118203423-deb3ae2ef261/go.mod h1:GJKEexRPVJrBSOjoqN5VNOIKJ5Q3RViH6eu3puDRwx4=
@@ -346,8 +342,8 @@ github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGX
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20231109132714-523115ebc101 h1:7To3pQ+pZo0i3dsWEbinPNFs5gPSBOsJtx3wTT94VBY=
-github.com/cncf/xds/go v0.0.0-20231109132714-523115ebc101/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
 github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
@@ -399,10 +395,10 @@ github.com/digitalocean/go-smbios v0.0.0-20180907143718-390a4f403a8e/go.mod h1:Y
 github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
 github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi/U=
 github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
-github.com/docker/distribution v2.8.2+incompatible h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8=
-github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v24.0.9+incompatible h1:HPGzNmwfLZWdxHqK9/II92pyi1EpYKsAqcl4G0Of9v0=
-github.com/docker/docker v24.0.9+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/docker/docker v26.1.5+incompatible h1:NEAxTwEjxV6VbBMBoGG3zPqbiJosIApZjxlbrG9q3/g=
+github.com/docker/docker v26.1.5+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
@@ -438,8 +434,6 @@ github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.m
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/envoyproxy/protoc-gen-validate v1.0.2 h1:QkIBuU5k+x7/QXPvPPnWXWlCdaBFApVqftFV6k087DA=
-github.com/envoyproxy/protoc-gen-validate v1.0.2/go.mod h1:GpiZQP3dDbg4JouG/NNS7QWXpgx6x8QiMKdmN72jogE=
 github.com/facebookincubator/flog v0.0.0-20190930132826-d2511d0ce33c h1:KqlxcP2nuOcMjudCvK0qME2K/aFBDH+xcvYv7HYQaYc=
 github.com/facebookincubator/flog v0.0.0-20190930132826-d2511d0ce33c/go.mod h1:QGzNH9ujQ2ZUr/CjDGZGWeDAVStrWNjHeEcjJL96Nuk=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
@@ -461,8 +455,6 @@ github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4
 github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/garyburd/go-oauth v0.0.0-20180319155456-bca2e7f09a17 h1:GOfMz6cRgTJ9jWV0qAezv642OhPnKEG7gtUjJSdStHE=
-github.com/garyburd/go-oauth v0.0.0-20180319155456-bca2e7f09a17/go.mod h1:HfkOCN6fkKKaPSAeNq/er3xObxTW4VLeY6UUK895gLQ=
 github.com/getsentry/sentry-go v0.18.0 h1:MtBW5H9QgdcJabtZcuJG80BMOwaBpkRDZkxRkNC1sN0=
 github.com/getsentry/sentry-go v0.18.0/go.mod h1:Kgon4Mby+FJ7ZWHFUAZgVaIa8sxHtnRJRLTXZr51aKQ=
 github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
@@ -507,8 +499,8 @@ github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KE
 github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.1/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
-github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.0/go.mod h1:YkVgnZu1ZjjL7xTxrfm/LLZBfkhTqSR1ydtm6jTKKwI=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
@@ -551,8 +543,8 @@ github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOW
 github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.1.2 h1:DVjP2PbBOzHyzA+dn3WhHIq4NdVu3Q+pvivFICf/7fo=
-github.com/golang/glog v1.1.2/go.mod h1:zR+okUeTbrL6EL3xHUDxZuEtGv04p5shwip1+mL/rLQ=
+github.com/golang/glog v1.2.0 h1:uCdmnmatrKCgMBlM4rMuJZWOkPDqdbZPnrMXDY4gI68=
+github.com/golang/glog v1.2.0/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -586,8 +578,8 @@ github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
@@ -676,8 +668,8 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksP
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
-github.com/googleapis/gax-go/v2 v2.12.0 h1:A+gCJKdRfqXkr+BIRGtZLibNXf0m1f9E4HG56etFpas=
-github.com/googleapis/gax-go/v2 v2.12.0/go.mod h1:y+aIqrI5eb1YGMVJfuV3185Ts/D7qKpsEkdD5+I6QGU=
+github.com/googleapis/gax-go/v2 v2.12.2 h1:mhN09QQW1jEWeMF74zGR81R30z4VJzjZsfkUhuHF+DA=
+github.com/googleapis/gax-go/v2 v2.12.2/go.mod h1:61M8vcyyXR2kqKFxKrfA22jaA8JGF7Dc8App1U3H6jc=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/goreleaser/chglog v0.1.2 h1:tdzAb/ILeMnphzI9zQ7Nkq+T8R9qyXli8GydD8plFRY=
 github.com/goreleaser/chglog v0.1.2/go.mod h1:tTZsFuSZK4epDXfjMkxzcGbrIOXprf0JFp47BjIr3B8=
@@ -708,8 +700,8 @@ github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmg
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.0 h1:RtRsiaGvWxcwd8y3BiRZxsylPT8hLWZ5SPcfI+3IDNk=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.0/go.mod h1:TzP6duP4Py2pHLVPPQp42aoYI92+PCrVotyR5e8Vqlk=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 h1:bkypFPDjIYGfCYD5mRBvpqxfYX1YCS1PXdKYWi8FsN0=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k=
 github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
 github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -842,8 +834,8 @@ github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
-github.com/macadmins/osquery-extension v1.1.3-0.20240530154548-05bb97403086 h1:pom8HjoknG5GF+cqeTP+2sXIn8Tl8Y7cinlPNv0O+LY=
-github.com/macadmins/osquery-extension v1.1.3-0.20240530154548-05bb97403086/go.mod h1:q0BnBuYocHBRB+m3AQwdQNETH5a2KzVT3S8TKMHo9Lk=
+github.com/macadmins/osquery-extension v1.2.1 h1:p7tAAhfEjUjoMQJNb+X7Qc3FraVqGZqMhZ1BYJbrlaw=
+github.com/macadmins/osquery-extension v1.2.1/go.mod h1:q0BnBuYocHBRB+m3AQwdQNETH5a2KzVT3S8TKMHo9Lk=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.4/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
@@ -917,6 +909,8 @@ github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zx
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/mna/redisc v1.3.2 h1:sc9C+nj6qmrTFnsXb70xkjAHpXKtjjBuE6v2UcQV0ZE=
 github.com/mna/redisc v1.3.2/go.mod h1:CplIoaSTDi5h9icnj4FLbRgHoNKCHDNJDVRztWDGeSQ=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/term v0.0.0-20221205130635-1aeaba878587 h1:HfkjXDfhgVaN5rmueG8cL8KKeFNecRCXFhaJ2qZ5SKA=
 github.com/moby/term v0.0.0-20221205130635-1aeaba878587/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -1015,8 +1009,8 @@ github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6L
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
-github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
-github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
 github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
 github.com/rs/zerolog v1.32.0 h1:keLypqrlIjaFsbmJOBdB/qvyF8KEtCWHwobLp5l/mQ0=
 github.com/rs/zerolog v1.32.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
@@ -1217,28 +1211,30 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux v0.44.0 h1:QaNUlLvmettd1vnmFHrgBYQHearxWP3uO4h4F3pVtkM=
 go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux v0.44.0/go.mod h1:cJu+5jZwoZfkBOECSFtBZK/O7h/pY5djn0fwnIGnQ4A=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0 h1:UNQQKPfTDe1J81ViolILjTKPr9WetKW6uei2hFgJmFs=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0/go.mod h1:r9vWsPS/3AQItv3OSlEJ/E4mbrhUbbw18meOjArPtKQ=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 h1:sv9kVfal0MK0wBMCOGr+HeJm9v803BkJxGrk2au7j08=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0/go.mod h1:SK2UL73Zy1quvRPonmOmRDiWk1KBV3LyIeeIxcEApWw=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 h1:4Pp6oUg3+e/6M4C0A/3kJ2VYa++dsWVTtGgLVj5xtHg=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0/go.mod h1:Mjt1i1INqiaoZOMGR1RIUJN+i3ChKoFRqzrRQhlkbs0=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 h1:jq9TW8u3so/bN+JPT166wjOI6/vQPF6Xe7nMNIltagk=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0/go.mod h1:p8pYQP+m5XfbZm9fxtSKAbM6oIllS7s2AfxrChvc7iw=
 go.opentelemetry.io/otel v1.3.0/go.mod h1:PWIKzi6JCp7sM0k9yZ43VX+T345uNbAkDKwHVjb2PTs=
-go.opentelemetry.io/otel v1.22.0 h1:xS7Ku+7yTFvDfDraDIJVpw7XPyuHlB9MCiqqX5mcJ6Y=
-go.opentelemetry.io/otel v1.22.0/go.mod h1:eoV4iAi3Ea8LkAEI9+GFT44O6T/D0GWAVFyZVCC6pMI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 h1:Mne5On7VWdx7omSrSSZvM4Kw7cS7NQkOOmLcgscI51U=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0/go.mod h1:IPtUMKL4O3tH5y+iXVyAXqpAwMuzC1IrxVS81rummfE=
+go.opentelemetry.io/otel v1.28.0 h1:/SqNcYk+idO0CxKEUOtKQClMK/MimZihKYMruSMViUo=
+go.opentelemetry.io/otel v1.28.0/go.mod h1:q68ijF8Fc8CnMHKyzqL6akLO46ePnjkgfIMIjUIX9z4=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 h1:3Q/xZUyC1BBkualc9ROb4G8qkH90LXEIICcs5zv1OYY=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0/go.mod h1:s75jGIWA9OfCMzF0xr+ZgfrB5FEbbV7UuYo32ahUiFI=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0 h1:3d+S281UTjM+AbF31XSOYn1qXn3BgIdWl8HNEpx08Jk=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0/go.mod h1:0+KuTDyKL4gjKCF75pHOX4wuzYDUZYfAQdSu43o+Z2I=
-go.opentelemetry.io/otel/metric v1.22.0 h1:lypMQnGyJYeuYPhOM/bgjbFM6WE44W1/T45er4d8Hhg=
-go.opentelemetry.io/otel/metric v1.22.0/go.mod h1:evJGjVpZv0mQ5QBRJoBF64yMuOf4xCWdXjK8pzFvliY=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.28.0 h1:j9+03ymgYhPKmeXGk5Zu+cIZOlVzd9Zv7QIiyItjFBU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.28.0/go.mod h1:Y5+XiUG4Emn1hTfciPzGPJaSI+RpDts6BnCIir0SLqk=
+go.opentelemetry.io/otel/metric v1.28.0 h1:f0HGvSl1KRAU1DLgLGFjrwVyismPlnuU6JD6bOeuA5Q=
+go.opentelemetry.io/otel/metric v1.28.0/go.mod h1:Fb1eVBFZmLVTMb6PPohq3TO9IIhUisDsbJoL/+uQW4s=
 go.opentelemetry.io/otel/sdk v1.3.0/go.mod h1:rIo4suHNhQwBIPg9axF8V9CA72Wz2mKF1teNrup8yzs=
-go.opentelemetry.io/otel/sdk v1.22.0 h1:6coWHw9xw7EfClIC/+O31R8IY3/+EiRFHevmHafB2Gw=
-go.opentelemetry.io/otel/sdk v1.22.0/go.mod h1:iu7luyVGYovrRpe2fmj3CVKouQNdTOkxtLzPvPz1DOc=
+go.opentelemetry.io/otel/sdk v1.28.0 h1:b9d7hIry8yZsgtbmM0DKyPWMMUMlK9NEKuIG4aBqWyE=
+go.opentelemetry.io/otel/sdk v1.28.0/go.mod h1:oYj7ClPUA7Iw3m+r7GeEjz0qckQRJK2B8zjcZEfu7Pg=
 go.opentelemetry.io/otel/trace v1.3.0/go.mod h1:c/VDhno8888bvQYmbYLqe41/Ldmr/KKunbvWM4/fEjk=
-go.opentelemetry.io/otel/trace v1.22.0 h1:Hg6pPujv0XG9QaVbGOBVHunyuLcCC3jN7WEhPx83XD0=
-go.opentelemetry.io/otel/trace v1.22.0/go.mod h1:RbbHXVqKES9QhzZq/fE5UnOSILqRt40a21sPw2He1xo=
+go.opentelemetry.io/otel/trace v1.28.0 h1:GhQ9cUuQGmNDd5BTCP2dAvv75RdMxEfTmYejp+lkx9g=
+go.opentelemetry.io/otel/trace v1.28.0/go.mod h1:jPyXzNPg6da9+38HEwElrQiHlVMTnVfM3/yv2OlIHaI=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
-go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
+go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
+go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
@@ -1279,8 +1275,8 @@ golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI=
-golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/crypto v0.24.0 h1:mnl8DM0o513X8fdIkmyFE/5hTYxbwYOjDS/+rK6qpRI=
+golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1385,8 +1381,8 @@ golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
-golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
+golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1405,8 +1401,8 @@ golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.16.0 h1:aDkGMBSYxElaoP81NpoUoz2oo2R2wHdZpGToUxfyQrQ=
-golang.org/x/oauth2 v0.16.0/go.mod h1:hqZ+0LWXsiVoZpeld6jVt06P3adbS2Uu911W1SsJv2o=
+golang.org/x/oauth2 v0.20.0 h1:4mQdhULixXKP1rwYBW0vAijoXnkTG0BLCDRzfe1idMo=
+golang.org/x/oauth2 v0.20.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1520,8 +1516,8 @@ golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
-golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
+golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -1530,8 +1526,8 @@ golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.20.0 h1:VnkxpohqXaOBYJtBmEppKUG6mXpi+4O6purfc2+sMhw=
-golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
+golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1541,7 +1537,6 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
@@ -1625,8 +1620,8 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
 google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
@@ -1658,8 +1653,8 @@ google.golang.org/api v0.52.0/go.mod h1:Him/adpjt0sxtkWViy0b6xyKW/SD71CwdJ7HqJo7
 google.golang.org/api v0.54.0/go.mod h1:7C4bFFOvVDGXjfDTAsgGwDgAxRDeQ4X8NvUedIt6z3k=
 google.golang.org/api v0.55.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
 google.golang.org/api v0.56.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
-google.golang.org/api v0.161.0 h1:oYzk/bs26WN10AV7iU7MVJVXBH8oCPS2hHyBiEeFoSU=
-google.golang.org/api v0.161.0/go.mod h1:0mu0TpK33qnydLvWqbImq2b1eQ5FHRSDCBzAxX9ZHyw=
+google.golang.org/api v0.169.0 h1:QwWPy71FgMWqJN/l6jVlFHUa29a7dcUy02I8o799nPY=
+google.golang.org/api v0.169.0/go.mod h1:gpNOiMA2tZ4mf5R9Iwf4rK/Dcz0fbdIgWYWVoxmsyLg=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -1669,8 +1664,6 @@ google.golang.org/appengine v1.6.2/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
-google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
@@ -1731,12 +1724,12 @@ google.golang.org/genproto v0.0.0-20210821163610-241b8fcbd6c8/go.mod h1:eFjDcFEc
 google.golang.org/genproto v0.0.0-20210825212027-de86158e7fda/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
 google.golang.org/genproto v0.0.0-20210828152312-66f60bf46e71/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
 google.golang.org/genproto v0.0.0-20210831024726-fe130286e0e2/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20240205150955-31a09d347014 h1:g/4bk7P6TPMkAUbUhquq98xey1slwvuVJPosdBqYJlU=
-google.golang.org/genproto v0.0.0-20240205150955-31a09d347014/go.mod h1:xEgQu1e4stdSSsxPDK8Azkrk/ECl5HvdPf6nbZrTS5M=
-google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe h1:0poefMBYvYbs7g5UkjS6HcxBPaTRAmznle9jnxYoAI8=
-google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe/go.mod h1:4jWUdICTdgc3Ibxmr8nAJiiLHwQBY0UI0XZcEMaFKaA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe h1:bQnxqljG/wqi4NTXu2+DJ3n7APcEA882QZ1JvhQAq9o=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe/go.mod h1:PAREbraiVEVGVdTZsVWjSbbTtSyGbAgIIvni8a8CD5s=
+google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9 h1:9+tzLLstTlPTRyJTh+ah5wIMsBW5c4tQwGTN3thOW9Y=
+google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9/go.mod h1:mqHbVIp48Muh7Ywss/AD6I5kNVKZMmAa/QEW58Gxp2s=
+google.golang.org/genproto/googleapis/api v0.0.0-20240701130421-f6361c86f094 h1:0+ozOGcrp+Y8Aq8TLNN2Aliibms5LEzsq99ZZmAGYm0=
+google.golang.org/genproto/googleapis/api v0.0.0-20240701130421-f6361c86f094/go.mod h1:fJ/e3If/Q67Mj99hin0hMhiNyCRmt6BQ2aWIJshUSJw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 h1:BwIjyKYGsK9dMCBOorzRri8MQwmi7mT9rGHsCEinZkA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -1762,8 +1755,8 @@ google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQ
 google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.61.0 h1:TOvOcuXn30kRao+gfcvsebNEa5iZIiLkisYEkf7R7o0=
-google.golang.org/grpc v1.61.0/go.mod h1:VUbo7IFqmF1QtCAstipjG0GIoq49KvMe9+h1jFLBNJs=
+google.golang.org/grpc v1.64.1 h1:LKtvyfbX3UGVPFcGqJ9ItpVWW6oN/2XqTxfAnwRRXiA=
+google.golang.org/grpc v1.64.1/go.mod h1:hiQF4LFZelK2WKaP6W0L92zGHtiQdZxk8CrSdvyjeP0=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -1778,8 +1771,8 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
+google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc h1:2gGKlE2+asNV9m7xrywl36YYNnBG5ZQ0r/BOOxqPpmk=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc/go.mod h1:m7x9LTH6d71AHyAX77c9yqWCCa3UKHcVEj9y7hAtKDk=
diff --git a/handbook/business-operations/README.md b/handbook/business-operations/README.md
index f21dc3506ed3..11bc287b1793 100644
--- a/handbook/business-operations/README.md
+++ b/handbook/business-operations/README.md
@@ -40,6 +40,17 @@ Recurring monthly or annual expenses, such as the tools we use throughout Fleet,
 All Fleet team members undergo a background check provided through [Vetty](https://vetty.co/). Only the most recent background checks appear on the home page of Vetty's dashboard. To access a complete list of background checks run in Vetty, scroll down to the bottom of the candidates page and click "View Historical".
 
 
+### Register Fleet as an employer with a new state 
+Fleet must register as an employer in any state where we hire new teammates. To do this, complete the following steps in Gusto:
+1. After a new teammate completes their Gusto profile, the Business Operations department will be prompted to approve it for payroll. Sign in to your Gusto admin account and begin the approval process.
+2. Select "yes" when prompted to file a new hire report and complete the approval process.
+3. Once the profile is approved, navigate to Tax setup and select the state you’d like to register Fleet in.
+4. Select “Have us register for you” and then “Start registration.”
+5. Verify, add, and amend any company information to ensure accuracy.
+6. Select “Send registration” and authorize payment for the specified amount. CorpNet will then send an email with next steps, which vary by state.
+7. Update the [list of states that Fleet is currently registered with as an employer](https://fleetdm.com/handbook/business-operations#review-state-employment-tax-filings-for-the-previous-quarter).
+    
+
 ### Process an email from a state agency
 From time to time, you may get notices via email (or in the mail) from state agencies regarding Fleet's withholding and/or unemployment tax accounts. You can resolve some of these notices on your own by verifying and/or updating the settings in your Gusto account.
 
@@ -52,19 +63,48 @@ In Gusto, you can click **How to review your notice** to help you understand wha
 
 > **Note:** Many agencies do not send notices to Gusto directly, so it’s important that you read and take action before any listed deadlines or effective dates of requested changes, in case you have to do something.  If you can't resolve the notice on your own, are unsure what the notice is in reference to, or the tax notice has a missing payment or balance owed, follow the steps in the Report and upload a tax notice in Gusto.
 
-<!-- 2023-08-19: I commented this out because I wasn't sure if we were still doing it this way and I didn't want to leave infomration that was potentially incorrect or contradictory.  -mikermcneil
-#### Process an email from a state agency with help from CorpNet
-In CorpNet, select "place an order for an existing business":
-- Email the CorpNet account rep "Subject: Fleet Device Management: State - Foreign Registration and Payroll Tax Registration" (this takes about two weeks).
-- Select "Foreign Qualification," place the order and email the confirmation to the CorpNet rep for "Payroll registration" (this is a shorter turnaround).
-  - You can also do this on your own by visiting the state's "Secretary of State" website and checking that the company name is available. To register online, you'll need the EIN, business address, information about the owners and their percentages, the first date of business, sales within the state, and the business type (usually get an email right away for approval ~24-48 hrs). 
--->
+Every quarter, payroll and tax filings are due for each state. Gusto can handle these automatically if Third-party authorization (TPA) is enabled. Each state is unique and Gusto has a library of [State registration and resources](https://support.gusto.com/hub/Employers-and-admins/Taxes-forms-and-compliance/State-registration-and-resources) available to review.  You will need to grant Third-party authorization (TPA) per state and this should be checked quarterly before the filing due dates to ensure that Gusto can file on time. -->
 
-<!-- 2023-08-19: This linked sheet is out of date so I'm commenting it out.  -mikermcneil
-For more information about how Fleet and our accounting team work together, check out [Fleet - who does what](https://docs.google.com/spreadsheets/d/1FFOudmHmfVFIk-hdIWoPFsvMPmsjnRB8/edit#gid=829046836) (private doc). -->
 
-<!-- 2023-08-19: I commented this out because I wasn't sure how to map it to an imperative mood verb phrase (responsibility) that bizops is doing either ad hoc or as part of a ritual (recurring task). -mikermcneil
-Every quarter, payroll and tax filings are due for each state. Gusto can handle these automatically if Third-party authorization (TPA) is enabled. Each state is unique and Gusto has a library of [State registration and resources](https://support.gusto.com/hub/Employers-and-admins/Taxes-forms-and-compliance/State-registration-and-resources) available to review.  You will need to grant Third-party authorization (TPA) per state and this should be checked quarterly before the filing due dates to ensure that Gusto can file on time. -->
+### Review state employment tax filings for the previous quarter
+
+Every quarter, payroll and tax filings are due for each state. Gusto automates this process, however there are often delays or quirks between Gusto's submission and the state receiving the filings.
+To mitigate the risk of penalties and to ensure filings occur as expected, follow these steps in the first month of the new quarter, verifying past quarter submission:
+1. Create an issue to "Review state filings for the previous quarter".
+2. Copy this text block into the issue to track progress by state:
+
+
+```
+States checked:
+- [ ] California
+- [ ] Colorado
+- [ ] Connecticut
+- [ ] Florida
+- [ ] Georgia
+- [ ] Hawaii
+- [ ] Illinois
+- [ ] Kansas
+- [ ] Maryland
+- [ ] Massachusetts
+- [ ] New York
+- [ ] Ohio
+- [ ] Oregon
+- [ ] Pennsylvania
+- [ ] Rhode Island
+- [ ] Tennessee
+- [ ] Texas
+- [ ] Utah
+- [ ] Virginia
+- [ ] Washington
+- [ ] Washington, DC
+- [ ] West Virginia
+- [ ] Wisconsin
+```
+ 
+
+3. Login to Gusto and navigate to "Taxes and compliance", then "Tax documents".
+4. Login to each State portal (using the details saved in 1Password) and verify that the portal has received the automated submission from Gusto.
+5. Check off states that are correct, and use comments to explain any quirks or remediation that's needed.
 
 
 ### Inform managers about hours worked
@@ -73,12 +113,11 @@ Every Friday at 2:00 PM CT, we collect hours worked for all hourly employees at
 
 Here's how:
 
-1. For each hourly core team member in Gusto or Plane.com, find the DRI by checking [who they report to](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0).
-   - If any direct report is hourly in Plane.com and submits hours monthly, still list them and provide an explanation.
-2. Consultants submit their hours through Gusto (US consultants) or Plane.com (international consultants) and require DRI approval. Find the DRI using the [Business Operations KPIs](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit#gid=0).
-3. Send the teammate's DRI a direct message in Slack with a screenshot of the HRIS portal, showing hours logged since last Saturday at midnight, and ask them to confirm the hours are expected. Ensure the screenshot does not include compensation information.
-4. The following Monday, check for updates to logged hours and ensure the KPI sheet aligns with HRIS records.
-   - If there are discrepancies between what was previously reported, reconfirm logged hours with the teammate's DRI and update the KPI sheet to reflect the correct amount.
+1. Consultants submit their hours through Gusto (US consultants) or Plane.com (international consultants) and require DRI approval (generally their manager) for hours worked. Find the DRI using the [Business Operations KPIs](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit#gid=0).
+2. Send the teammate's DRI a direct message in Slack with a screenshot of the HRIS portal, showing hours logged since last Saturday at midnight, and ask them to confirm the hours are expected. Ensure the screenshot does not include compensation information.
+     - For international teammates, they cannot enter hours weekly in Plane.com, so you will need to request the hours worked from them in order to have the DRI approve them.
+3. The following Monday, check for updates to logged hours and ensure the KPI sheet aligns with HRIS records.
+     - If there are discrepancies between what was previously reported, reconfirm logged hours with the teammate's DRI and update the KPI sheet to reflect the correct amount.
 
 
 ### Change the DRI of a consultant
@@ -228,7 +267,9 @@ When BizOps receives notification of a Fleetie's job title changing, follow thes
     - Input the new job title in the Fleetie's row in the "Job title" cell.
     - Navigate to the "Org chart" tab of the spreadsheet, and verify that the Fleetie's title appears correctly in the org chart.
 2. Update the departmental handbook page with the change of job title
-3. Update the relevant payroll/HRIS system.
+3. [Prepare salary benchmarking information](https://fleetdm.com/handbook/business-operations#prepare-salary-benchmarking-information) to determine whether the teammate's current compensation aligns with the benchmarks of the new role.
+   -  If the benchmark is significantly different, take the steps to [update a team member's compensation](https://fleetdm.com/handbook/business-operations#prepare-salary-benchmarking-information).
+4. Update the relevant payroll/HRIS system.
     - For updating Gusto (US-based Fleeties):
       - Login to Gusto and navigate to "People > Team members".
       - Find the Fleetie and select them to see their profile page.
@@ -244,7 +285,7 @@ When BizOps receives notification of a Fleetie's job title changing, follow thes
 When BizOps receives notification of a Fleetie's manager changing, follow these steps to ensure correct recording in our systems.
 1. Update [🧑‍🚀 Fleeties](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0):
     - Search for the Fleetie's new manager, and copy the new manager's unique ID from the far left "Unique ID" column.
-    - Search for the Fleetie who's manager is changing, and paste (without formatting) their new manager's unique ID in the "Reports to: (manager unique ID)" cell in the Fleetie's row.
+    - Search for the Fleetie whose manager is changing, and paste (without formatting) their new manager's unique ID in the "Reports to: (manager unique ID)" cell in the Fleetie's row.
     - Verify that the "Reports to (auto: manager name and job title)" cell in the Fleetie's row reflects the new manager's details.
     - Verify that in the new manager's row, the "# direct reports" cell reflect the correct number.
     - Navigate to the "Org chart" tab in the spreadsheet, and verify that the Fleetie now appears in the correct place in the org chart.
@@ -295,18 +336,28 @@ At Fleet, everyone is recognized on their [workiversary](https://fleetdm.com/han
 
 
 ### Update a team member's compensation
-To [change a team member's compensation](https://fleetdm.com/handbook/company/communications#compensation-changes), follow these steps:
-1. Create a copy of the ["Values assessment" template](https://docs.google.com/spreadsheets/d/1P5TyRV2v-YN0aR_X8vd8GksKcr3uHfUDdshqpVzamV8/edit?usp=drive_link) and move it to the team member's [personnel folder in Google Drive](https://drive.google.com/drive/folders/1UL7o3BzkTKnpvIS4hm_RtbOilSABo3oG?usp=drive_link).
+To [change a teammate's compensation](https://fleetdm.com/handbook/company/communications#compensation-changes), follow these steps:
+1. Create a copy of the ["Values assessment" template](https://docs.google.com/spreadsheets/d/1P5TyRV2v-YN0aR_X8vd8GksKcr3uHfUDdshqpVzamV8/edit?usp=drive_link) and move it to the teammate's [personnel folder in Google Drive](https://drive.google.com/drive/folders/1UL7o3BzkTKnpvIS4hm_RtbOilSABo3oG?usp=drive_link).
 2. Share the values assessment document with the manager and ask them to perform the values assessment.
-3. Once the values assessment is complete, [prepare salary benchmarking information](#prepare-salary-benchmarking-information) and set a meeting between the manager, head of department, and Head of Business Operations about level of job skill in relation to compensation benchmarking levels.
-4. Schedule a new calendar event for the Head of Business Operations with the founders over an existing founders' 1:1 to discuss if an adjustment needs to be made to team member's compensation to align with benchmarking. During the 1:1 call, founders review values assessment, benchmarking for role and geography, and decide if there will be an adjustment.
-5. Head of Business Operations will post in slack to `#help-classified` with the decision on compensation changes and effective date, if any.
-6. Communicate via Slack DM the decision to the teammate's people manager, who will then communicate to their teammate.
-7. Update the respective payroll platform (Gusto or Plane) by navigating to the personnel page, selecting salary field, and updating with an effective date that makes the next payroll.
-8. Update the [equity spreadsheet](https://docs.google.com/spreadsheets/d/1_GJlqnWWIQBiZFOoyl9YbTr72bg5qdSSp4O3kuKm1Jc/edit?usp=sharing) (internal doc) by copying existing OTE to the bottom of the "Notes" cell, updating the OTE column with the new compensation information, and updating the "Last compensation change" column with the effective date from payroll platform.
+3. Once the values assessment is complete, [prepare salary benchmarking information](#prepare-salary-benchmarking-information) and notify the Head of Business Operations so the compensation change can be added to the e-group agenda for discussion amongst Fleet leadership.
+   - If the teammate's manager is not part of the e-group, the Head of Business Operations will ensure they're included in the discussion at e-group as well. 
+4. Once compensation decisions have been finalized, the Head of Business Operations will post in slack to `#help-classified` to confirm the decisions have been recorded in ["¶¶ 💌 Compensation decisions (offer math)"](https://docs.google.com/document/d/1NQ-IjcOTbyFluCWqsFLMfP4SvnopoXDcX0civ-STS5c/edit#heading=h.slomq4whmyas). 
+5. Send the teammates manager a Slack DM to determine who will communicate the decision to the teammate.
+6. Update the respective payroll platform (Gusto or Plane) by navigating to the personnel page, selecting salary field, and updating with an effective date that makes the next payroll.
+7. Update the [equity spreadsheet](https://docs.google.com/spreadsheets/d/1_GJlqnWWIQBiZFOoyl9YbTr72bg5qdSSp4O3kuKm1Jc/edit?usp=sharing) (internal doc) by copying existing OTE to the bottom of the "Notes" cell, updating the OTE column with the new compensation information, and updating the "Last compensation change" column with the effective date from payroll platform.
+8. Calculate the monthly burn rate increase percentage and notify the CEO via a Slack DM.
 
 > If the company decides on an additional equity grant as part of a compensation change, note the previous equity and new situation in detail in the "Notes" column of the equity plan. Update the "Grant started?" column to "todo" which adds it to the queue for the next time grants are processed (quarterly).
 
+### Review Fleet's US company benefits
+
+Annually, around mid-year, Fleet will be prompted by Gusto to review company benefits. The goal is to keep changes minimal. Follow these steps:
+1. Log in to your [Gusto admin account](https://gusto.com/).
+2. Navigate to "Benefits" and select "Renewal survey".
+3. Complete the survey questions, aiming for minimal changes.
+4. Approximately 2-3 months after survery completion, Gusto will suggest plans based on Fleet's responses. Choose plans with minimal changes.
+5. Gusto will offer these plans to employees during open enrollment, with new coverage starting 3-4 weeks afterward.
+   
 
 ### Process monthly accounting
 Create a [new montly accounting issue](https://github.com/fleetdm/confidential/issues/new/choose) for the current month and year named "Closing out YYYY-MM" in GitHub and complete all of the tasks in the issue. (This uses the [monthly accounting issue template](https://github.com/fleetdm/confidential/blob/main/.github/ISSUE_TEMPLATE/5-monthly-accounting.md).
@@ -335,7 +386,7 @@ No later than the second month of every quarter, we check [Delaware divison of c
 ### Check finances for quirks
 Every quarter, we check Quickbooks Online (QBO) for discrepancies and follow up on quirks.
 1. Check to make sure [bookkeeping quirks](https://docs.google.com/spreadsheets/d/1nuUPMZb1z_lrbaQEcgjnxppnYv_GWOTTo4FMqLOlsWg/edit?usp=sharing) are all accounted for and resolved or in progress toward resolution.
-2. Check balance sheet and profit and loss statements (P&Ls) in QBO against the latest [monthly workbooks](https://drive.google.com/drive/folders/1ben-xJgL5MlMJhIl2OeQpDjbk-pF6eJM) in Google Drive.
+2. Check balance sheet and profit and loss statements (P&Ls) in QBO against the latest [monthly workbooks](https://drive.google.com/drive/folders/1ben-xJgL5MlMJhIl2OeQpDjbk-pF6eJM) in Google Drive. Ensure reports are in the "accural" accounting method.
 3. Reach out to Pilot with any differences or quirks, and ask them to resolve/provide clarity.  This often will need to happen over a call to review sycnhronously.
 4. Once quirks are resolved, note the day it was resolved in the spreadsheet.
 
@@ -384,7 +435,12 @@ Within 60 days of the end of the year, follow these steps:
 
 
 ### Process a new vendor invoice
-- After making sure that an invoice received from a new vendor is valid, add the new vendor to the recurring expenses section of ["The numbers"](https://docs.google.com/spreadsheets/d/1X-brkmUK7_Rgp7aq42drNcUg8ZipzEiS153uKZSabWc/edit#gid=2112277278) before paying the invoice.
+Fleet pays its vendors in less than 15 business days in most cases. All invoices and tax documents should be submitted to the Business Operations department using the [appropriate Fleet email address (confidential Google Doc)](https://docs.google.com/document/d/1tE-NpNfw1icmU2MjYuBRib0VWBPVAdmq4NiCrpuI0F0/edit#heading=h.wqalwz1je6rq).
+- After making sure the invoice received from a new vendor is valid, add the new vendor to the recurring expenses section of ["The numbers"](https://docs.google.com/spreadsheets/d/1X-brkmUK7_Rgp7aq42drNcUg8ZipzEiS153uKZSabWc/edit#gid=2112277278) before paying the invoice.
+- If we have not paid this vendor before, make sure we have received the required W-9 or W-8 form from the vendor. **Accounting cannot process a payment without these tax forms for compliance reasons.**
+  - **US-based vendors** are required to complete a [W-9 form](https://www.irs.gov/pub/irs-pdf/fw9.pdf).
+  - **Non-US based vendors and individuals** are required to follow these [instructions](https://www.irs.gov/instructions/iw8bene) and provide a completed [W-8BEN-E](https://www.irs.gov/pub/irs-pdf/fw8bene.pdf) form.
+
 
 
 ### Process a request to cancel a vendor
diff --git a/handbook/business-operations/business-operations.rituals.yml b/handbook/business-operations/business-operations.rituals.yml
index c7c9cefd70a7..fec505589810 100644
--- a/handbook/business-operations/business-operations.rituals.yml
+++ b/handbook/business-operations/business-operations.rituals.yml
@@ -52,7 +52,7 @@
   task: "Prioritize for next sprint" # Title that will actually show in rituals table
   startedOn: "2023-08-09" # Needs to align with frequency e.g. if frequency is every thrid Thursday startedOn === any third thursday
   frequency: "Triweekly" # must be supported by https://github.com/fleetdm/fleet/blob/dbbb501358e226fa3fdf48865175efe3334c826c/website/scripts/build-static-content.js
-  description: "Drag next sprint's priorities to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/digital-experiencemunication)"
+  description: "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/digital-experiencemunication)"
   moreInfoUrl: "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible" #URL used to highlight "description:" test in table
   dri: "jostableford" # DRI for ritual (assignee if autoIssue) (TODO display GitHub proflie pic instead of name or title)
   autoIssue:   # Enables automation of GitHub issues
@@ -142,6 +142,13 @@
   description: "Verify completion of any objective or outcome based bonus plans, and process payroll." 
   moreInfoUrl: "https://fleetdm.com/handbook/business-operations#run-us-commission-payroll" # TODO update linked process and add a new process that captures MBO payment
   dri: "jostableford" 
+-
+  task: "Review state filings for the previous quarter"
+  startedOn: "2024-07-19" 
+  frequency: "Quarterly"
+  description: "Verify that state filings have been successfully submitted for the previous quarter" 
+  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#review-state-employment-tax-filings-for-the-previous-quarter"
+  dri: "ireedy" 
 -
   task: "Investor reporting" 
   startedOn: "2024-03-31" 
diff --git a/handbook/business-operations/security-audits.md b/handbook/business-operations/security-audits.md
index 0df67d30d31b..81a3af83b697 100644
--- a/handbook/business-operations/security-audits.md
+++ b/handbook/business-operations/security-audits.md
@@ -1,6 +1,15 @@
 # Security audits
 This page contains explanations of the latest external security audits performed on Fleet software.
 
+## June 2024 penetration testing of Fleet 4.50.1
+In June 2024, [Latacora](https://www.latacora.com/) performed an application penetration assessment of the application from Fleet. 
+
+An application penetration test captures a point-in-time assessment of vulnerabilities, misconfigurations, and gaps in applications that could allow an attacker to compromise the security, availability, processing integrity, confidentiality, and privacy (SAPCP) of sensitive data and application resources. An application penetration test simulates the capabilities of a real adversary, but accelerates testing by using information provided by the target company.
+
+Latacora identified a few medium and low severity risks, and Fleet is prioritizing and responding to those within SLAs. Once all action has been taken, a summary will be provided.
+
+You can find the full report here: [2024-06-14-fleet-penetration-test.pdf](https://github.com/fleetdm/fleet/raw/main/docs/files/2024-06-14-fleet-penetration-test.pdf).
+
 ## June 2023 penetration testing of Fleet 4.32 
 In June 2023, [Latacora](https://www.latacora.com/) performed an application penetration assessment of the application from Fleet. 
 
diff --git a/handbook/business-operations/security-policies.md b/handbook/business-operations/security-policies.md
index 501dd7d88127..42a911c99174 100644
--- a/handbook/business-operations/security-policies.md
+++ b/handbook/business-operations/security-policies.md
@@ -378,7 +378,8 @@ Fleet policy requires all workforce members to comply with the HR Security Polic
 
 Fleet policy requires that:
 
-- Background verification checks on candidates for all employees and contractors must be carried out in accordance with relevant laws, regulations, and ethics. These checks should be proportional to the business requirements, the classification of the information to be accessed, and the perceived risk.
+
+- Background verification checks on candidates for all Fleet employees and contractors must be carried out in accordance with relevant laws, regulations, and ethics. These checks should be proportional to the business requirements, the classification of the information to be accessed, and the perceived risk.
 - Employees, contractors, and third-party users must agree to and sign the terms and conditions of their employment contract and comply with acceptable use.
 - Employees will perform an onboarding process that familiarizes them with the environments, systems, security requirements, and procedures that Fleet already has in place. Employees will also have ongoing security awareness training that is audited.
 - Employee offboarding will include reiterating any duties and responsibilities still valid after terminations, verifying that access to any Fleet systems has been removed, and ensuring that all company-owned assets are returned.
diff --git a/handbook/business-operations/security.md b/handbook/business-operations/security.md
index ab0b90337b00..0bb01c4ef278 100644
--- a/handbook/business-operations/security.md
+++ b/handbook/business-operations/security.md
@@ -311,32 +311,6 @@ We do not apply ultra restrictive Data Loss Prevention style policies to our dev
 
 We use osquery and Fleet to monitor our own devices. This is used for vulnerability detection, security posture tracking, and incident response when necessary.
 
-#### Deploy Nudge
-Keeping operating systems up to date is important to fix known vulnerabilities. This is why we enable automatic updates on macOS, but as that system is neither aggressive or reliable enough, we also use Nudge to push individuals to update their systems before a deadline.
-
-##### Deploying Nudge
-Two packages from the Nudge [releases](https://github.com/macadmins/nudge/releases) must be deployed via MDM.
-
-1. Nudge itself. This is the Nudge executables that display prompts to update the system.
-2. Nudge LaunchAgent. This is the package that contains the automated tasks that make Nudge check if the system is up to date, and if not, to show the prompt.
-
-If only Nudge is deployed, nothing will happen on the system, as it will never launch unless triggered manually. The main reason to only install Nudge would be to run it manually for testing purposes, or if some other tool was used to schedule running it. 
-
-At Fleet, we use the standard LaunchAgent.
-
-We do not bundle any configuration with the Nudge packages themselves.
-
-##### Nudge configuration
-Nudge supports multiple configuration modes, but the one we use is via a [profile](https://github.com/fleetdm/confidential/blob/main/mdm_profiles/nudge_configuration.mobileconfig). (Note: our MDM profiles are not public simply because a few of them contain secrets, such as Chrome organization identification strings. Our Nudge profile is extremely similar to the [sample one](https://github.com/macadmins/nudge/blob/main/Example%20Assets/com.github.macadmins.Nudge.mobileconfig)).
-
-By joining a laptop to our MDM and deploying profiles, Nudge will get configured. 
-
-When a new update is released, the following fields must be updated:
-
-* `aboutUpdateURLs` in all languages, pointing to the Apple page with information about vulnerabilities fixed in each update. If an update had no vulnerabilities fixed, we'd typically not enforce it via Nudge, but this is extremely rare.
-* `requiredMinimumOSVersion` must be set to the new version (ex: `13.1`).
-* `requiredInstallationDate` must be set to a date in the future, based on the criticality of the vulnerabilities fixed by the update.
-
 ### Chrome configuration
 We configure Chrome on company-owned devices with a basic policy.
 
diff --git a/handbook/company/communications.md b/handbook/company/communications.md
index 8d11e360b97f..7b5a97b1ae54 100644
--- a/handbook/company/communications.md
+++ b/handbook/company/communications.md
@@ -1,19 +1,26 @@
 # Communications
 This page covers the things every team member needs to know to effectively contribute at Fleet.
 
+
 ## All hands
+
 Every month, Fleet holds a company-wide meeting called the "All hands". 
 
 All team members should attend the "All hands" every month.  "All hands" meetings are recorded, To see the evolution over time or catch up with the latest happenings, review [decks](https://drive.google.com/drive/folders/1cw_lL3_Xu9ZOXKGPghh8F4tc0ND9kQeY) and [recordings](https://us-65885.app.gong.io/conversations?workspace-id=9148397688380544352&callSearch=%7B%22search%22%3A%7B%22type%22%3A%22And%22%2C%22filters%22%3A%5B%7B%22type%22%3A%22CallTitle%22%2C%22phrase%22%3A%22all%20hands%22%7D%5D%7D%7D) from recent company-wide "All hands" meetings. Team members who cannot attend are expected to watch the recording within a few days. 
 
+
 ## Strategy
+
 You can read about the company's positioning and product strategy in ["🎐 Why Fleet?" (private google doc)](https://docs.google.com/document/d/1E0VU4AcB6UTVRd4JKD45Saxh9Gz-mkO3LnGSTBDLEZo/edit#).
 
+
 ### Competition
+
 We track competitors' capabilities and adjacent (or commonly integrated) products in Google doc [Competition](https://docs.google.com/document/d/1Bqdui6oQthdv5XtD5l7EZVB-duNRcqVRg7NVA4lCXeI/edit) (private Google doc).
 
 <img width="384" alt="image" src="https://github.com/fleetdm/fleet/assets/618009/680adba6-f5b7-4726-b2ea-73d0549a45eb">
 
+
 ## Directly responsible individuals (DRIs)
 
 | Area of responsibility | [DRI](https://fleetdm.com/handbook/company/why-this-way#why-direct-responsibility) |
@@ -41,18 +48,35 @@ We track competitors' capabilities and adjacent (or commonly integrated) product
 | Feature prioritization               | <sup><sub>_See [🦢 Head of Product Design](https://fleetdm.com/handbook/product-design#team)_</sup></sub>
 | Intentionality of Fleet's interfaces | <sup><sub>_See [🦢 Head of Product Design](https://fleetdm.com/handbook/product-design#team)_</sup></sub>
 | Best practices for using Fleet       | <sup><sub>_See [🦢 Product Design team](https://fleetdm.com/handbook/product-design#team)_</sup></sub>
-| [API design](https://fleetdm.com/docs/rest-api/rest-api) | <sup><sub>_See [🦢 Rachael Shaw](https://fleetdm.com/handbook/product-design#team)_</sup></sub>
+| [API design](https://fleetdm.com/docs/rest-api/rest-api) | <sup><sub>_See [🚀 Chief Technology Officer](https://fleetdm.com/handbook/engineering#team)_</sup></sub>
 | Structure of the [docs](https://fleetdm.com/docs/get-started/why-fleet) | <sup><sub>_See [🌐 Head of Design](https://fleetdm.com/handbook/digital-experience#team)_</sup></sub>
 | Product introduction docs            | <sup><sub>_See [🛠️ CEO responsibilities](https://fleetdm.com/handbook/company/leadership#ceo-responsibilities)_</sup></sub>
 | Product deployment docs              | <sup><sub>_See [🚀 Chief Technology Officer](https://fleetdm.com/handbook/engineering#team)_</sup></sub>
 | Product usage docs                   | <sup><sub>_See [🦢 Head of Product Design](https://fleetdm.com/handbook/product-design#team)_</sup></sub>
-| Product reference docs               | <sup><sub>_See [🦢 Rachael Shaw](https://fleetdm.com/handbook/product-design#team)_</sup></sub>
+| Product reference docs               | <sup><sub>_See [🦢 Noah Talerman](https://fleetdm.com/handbook/product-design#team)_</sup></sub>
 | What goes in a release               | <sup><sub>_See [🚀 Chief Technology Officer](https://fleetdm.com/handbook/engineering#team)_ </sup></sub> 
 | Engineering output and architecture  | <sup><sub>_See [🚀 Chief Technology Officer](https://fleetdm.com/handbook/engineering#team)_ </sup></sub>
 | Product development                  | <sup><sub>_See [🛩️ Product groups](https://fleetdm.com/handbook/company/product-groups#current-product-groups)_ </sup></sub>
 
+## Tech stack admins
+
+| Role | Google Workspace | Slack | GitHub | Gusto | Pilot | Plane | 1Password |
+|:----------------------|------------------:|------------------:|------------------:|------------------:|------------------:|------------------:|------------------:|
+| CEO | ✅ Super admin | ✅ Primary workspace owner | ✅ Owner | ✅ Primary admin | ✅ Admin| ✅ Owner | ✅ Owner |
+| CTO | ❌ | ❌ | ✅ Owner | ❌ | ✅ Admin | ❌ | ❌ |
+| Head of BizOps | ✅ Super admin | ✅ Owner | ✅ Owner| ✅ Admin | ✅ Admin| ✅ Admin | ✅ Admin |
+| BizOps Engineer | ✅ Super admin| ✅ Owner | ✅ Owner| ✅ Admin | ✅ Admin| ✅ Admin | ✅ Admin|
+| Head of Digital Experience | ✅ Super admin| ✅ Owner | ✅ Owner| ❌ | ✅ Admin| ❌ | ✅ Admin|
+| Apprentice | ❌ | ❌ | ❌ | ❌ | ✅ Admin| ❌ | ❌ |
+| Digital Experience Engineer | ✅ Super admin | ✅ Admin | ❌ | ❌ | ❌ | ❌ | ✅ Admin|
+| Head of Product Design | ❌ | ✅ Admin | ❌ | ❌ | ❌ | ❌ | ❌ |
+| VP of CX | ❌ | ✅ Owner | ❌ | ❌ | ❌ | ❌ | ❌ |
+| CX Sr. Suppoert Engineer | ❌ | ✅ Admin | ❌ | ❌ | ❌ | ❌ | ❌ |
+| Pilot bookkeeper | ❌ | ❌ | ❌ | ✅ Admin  | ❌ | ✅ Admin | ❌ |
+
 ### Docs
-This page details processes related to maintaining and updating the [Fleet documentation](https://fleetdm.com/docs).
+
+This section details processes related to maintaining and updating the [Fleet documentation](https://fleetdm.com/docs).
 
 When someone asks a question in a public channel, it's safe to assume they aren't the only person looking for an answer. 
 
@@ -76,19 +100,23 @@ The docs are separated into four categories:
 - [Data tables](https://fleetdm.com/tables/account_policy_data)
 - [Built-in queries](https://fleetdm.com/queries)
 
+
 ## Fleetdm.com
+
 Any change to fleetdm.com follows the same process as [making changes](https://fleetdm.com/handbook/company/product-groups#making-changes) to the core product. To propose a change to Fleet's website [create a website request](https://github.com/fleetdm/fleet/issues/new?assignees=&labels=%23g-digital-experience&projects=&template=website-request.md&title=Request%3A+__________________________) on the #g-digital-experience kanban board. 
 
 Before committing anything to code, we create wireframes (referred to as ["drafting"](https://fleetdm.com/handbook/company/product-groups#making-changes)) to illustrate all changes that affect the layout and structure of the user interface, design, or APIs of fleetdm.com. See [Why do we use a wireframe first approach](https://fleetdm.com/handbook/company/why-this-way#why-do-we-use-a-wireframe-first-approach) for more information. 
 
-The [Digital Experience team](https://fleetdm.com/handbook/digital-experience#team) holds regular design review sessions to evaluate, revise, and approve wireframes before moving into production. Design review sessions are hosted by the [Head of Design](https://calendar.google.com/calendar/u/0?cid=bXRob21hc0BmbGVldGRtLmNvbQ) and typically take place daily, late afternoon (CST). Anyone is welcome to join.
+The [Digital Experience team](https://fleetdm.com/handbook/digital-experience#team) holds regular design review sessions to evaluate, revise, and approve wireframes before moving into production. Design review sessions are hosted by the [Head of Design](https://calendar.google.com/calendar/u/0?cid=bXRob21hc0BmbGVldGRtLmNvbQ) and typically take place daily, late afternoon (CT). Anyone is welcome to join.
 
 
 ## Marketing programs
+
 Fleet's community programs are rooted in several areas; created to nurture communication between all current and future Fleet users through events, community support, [social media](#social-media), conversation-starting, [ads](#ads), video, and articles.
 
 
 ### Social media
+
 Fleet's largest asset is our user community, the people actually using Fleet. Public conversations on social media create valuable opportunities for contributors to answer technical questions and collect feedback.
 
 Fleet [does not self-promote](https://www.audible.com/pd/The-Impact-Equation-Audiobook/B00AR1VFBU).  (Great brands are [magnanimous](https://en.wikipedia.org/wiki/Magnanimity).) In fact, conversations are already happening in our social spaces that open up opportunities for Fleet to [engage with the community](https://fleetdm.com/handbook/demand#engage-with-the-community).
@@ -102,34 +130,45 @@ Here are some topics for social media posts:
 - Industry news about device management
 - Upcoming events, interviews, and podcasts
 
+
 #### Fleet on LinkedIn
+
 Original posts on LinkedIn by Fleet employees [can be promoted using the Fleet company page](https://fleetdm.com/handbook/demand#promote-a-post-on-linkedin). If you think your post would make sense in front of a bigger audience, [create an issue on the demand board](https://fleetdm.com/handbook/demand#contact-us) linking the team to your personal LinkedIn post (only original posts please, reposts and quotes of other posts can not be promoted). Include any context in the issue and keep an eye on your inbox, The Demand team will request permission to use the post in a promoted post.
 
 
 ### Ads
+
 Fleet uses advertising to spread awareness through a broader audience and foster greater engagement within user communities. The more people actively using Fleet, or contributing, the better Fleet will be.
 
 
 ### Events
+
 It's important for Fleet to engage at [events](https://docs.google.com/spreadsheets/d/1YQXAX2Q_WnGkAwMYjMbQpV3nbCj7gOBbv7Y0u4twxzQ/edit#gid=1931288160). This provides an opportunity to directly engage with potential users and contributors, build relationships, gather feedback, and create a stronger sense of community and trust.
 
+
 #### Event lead follow-up
-Eventgoers are expecting a timely follow-up from Fleet based on the conversations that they had at the event. It is up to Digital Marketing Manager to make sure this process is followed.
 
-1. Once a list of badge scans is available, Fleeties that attended the event are to add any follow up notes that note buying situation, amount of endpoints, level of interest, and general talking points.
-2. Within 3 business days of returning from the event, attendees will set up a debrief meeting with the demand team to discuss follow-up.
-3. Demand will determine appropriate follow-up to each potential lead, and sales will be notified of actions needed immediately following.
+Eventgoers expect a timely [follow-up from Fleet](https://fleetdm.com/handbook/demand#upload-contacts-to-salesforce-after-an-event) based on the conversations that they had at the event.
+
+1. Once a list of badge scans is available, Fleeties who attended the event are to add any follow-up notes, including primary buying situation, amount of endpoints, level of interest, and general talking points.
+2. Within three business days of returning from the event, attendees will set up a debrief meeting with the demand team to discuss follow-up and provide the list of badge scans uploaded to the ["Events" folder in Google Drive](https://drive.google.com/drive/u/0/folders/1uXf95V6CHKHnqxRc9iQr0a0FnTZk3bXR).
+
 
 ### Podcast
+
 Fleet has created the [ExpedITioners podcast](https://expeditioners.podbean.com/) to open discussions and help IT and security professionals get ahead of the curve and prepare themselves and their organizations for what lies ahead. 
 <!-- TODO: Find a way to link to the meetings section below and make it make sense-->
+
+
 ### Video
+
 Fleet uses YouTube to help keep the community up-to-date and informed. These videos facilitate community engagement, provide educational resources, and help share essential information about Fleet and the people using it. Meetings regularly uploaded to YouTube will have a "▶️" emoji prepended to the calendar event title (e.g. "▶️ ☁️🌈 Sprint demos!").  
 
 <img width="384" alt="image" src="https://github.com/fleetdm/fleet/assets/618009/29167232-652c-4c64-a37c-910cc781f2c1">
 
 
 ## Meetings
+
 - **Plan to join meetings on time.** At Fleet, we start on time and do not wait for folks to join.  As most of our meetings are conducted over zoom, please join with a working microphone and with your camera on whenever possible.  Being even a few minutes late can make a big difference and slow your meeting counterparts down. When in doubt, show up a couple of minutes early. 
 - **Turn on your camera.** This allows for more complete and intuitive verbal and non-verbal communication. Feel free to leave your camera on or turn it off when joining meetings with new participants you might not be familiar with yet. Turn your camera on when you lead or cohost a meeting, or when you present your work during a demo session.
   - **If you would prefer not to be on YouTube** when presenting on a meeting, you can prep your demo ahead of the meeting and communicate to your manager who will present for you.  It's always ok to do this.
@@ -139,18 +178,24 @@ Fleet uses YouTube to help keep the community up-to-date and informed. These vid
   - There is a designated notetaker during the meeting. 
   - All action items are tracked and assigned to the correct individuals. 
 
+
 ### Meeting agendas
+
 ["**No agenda, no attenda**."](https://about.gitlab.com/company/culture/all-remote/live-doc-meetings/#gitlab-meeting-best-practices) Every work-related meeting should have an editable agenda (e.g. edit access shared with all attendees) attached to the calendar invite. 
 - To create a meeting agenda please make a copy of [Fleet's meeting template](https://docs.google.com/document/d/1TaZ654gTwadWGDYhP3zuAzWe0eiY0s9NhaU9KLCokgw/copy).
 
 >Please do not use Google Calendar's automatic agenda/notes creation function, as it does not adhere to Fleet's preferred agenda format. If the automatic agenda doc has been created in error, edit the calendar invite to delete it from the meeting to avoid confusion.
 
+
 ### External meeting scheduling
+
 When scheduling external meetings, provide external participants with a
 [Calendly](https://calendly.com) link to schedule with the relevant internal participants. If you
 need a Calendly account, reach out to `#g-business-operations` via Slack.
 
+
 ### Internal meeting scheduling
+
 Fleet uses the Zoom add-on for Google Calendar to schedule meetings (exceptions are customers that are non-negotiably required to use a different tool) when we [create calendar events](https://support.google.com/calendar/answer/72143?hl=en&ref_topic=10510646&sjid=7187599067132459840-NA#zippy=%2Cclick-an-empty-time-in-your-calendar). 
 Our Zoom meetings are configured to let participants join before the host arrives, to make sure meetings start on time even if the host isn't there.
 
@@ -169,6 +214,7 @@ In an all-remote company, "face time" matters. Remember: even if someone's calen
 
 
 #### Schedule time with the CEO
+
 All invitations to meetings are welcomed, and quickly considering them is a top priority for the CEO.
 
 > Please do not add events to the CEO's calendar. **Events added directly to the CEO's calendar will be declined and removed.** Even if the CEO asks you to set up a meeting or add him to a call, please get scheduling help from the [Apprentice](https://www.fleetdm.com/handbook/digital-experience#team)).
@@ -179,11 +225,15 @@ To request time with the CEO, [submit an issue](https://github.com/fleetdm/confi
 - **Self-service scheduling:** Unlike other team members, who you can schedule with by simply dropping an event on their calendar unless requested directly from Mike, please do not directly schedule a meeting onto the CEO's calendar without using this process to confirm with the Apprentice first.
 - **Rescheduling:** All items on Mike's calendar are subject to change by the CEO to better serve the company.  Send last-minute changes or cancellations to Mike [via direct message (DM)](https://www.fleetdm.com/handbook/company/why-this-way#why-not-mention-the-ceo-in-slack-threads).
 
+
 ### Modifying an event organized by someone else
+
 To edit an event where someone else at Fleet is the organizer, you can first subscribe to their calendar in Google Calendar and then edit the event on their calendar.  Your edits will automatically apply to all attendees.
 This works because every Fleetie grants edit access to everyone else at Fleet as part of onboarding.
 
+
 ### Shared calendars
+
 Team calendars are the primary source for sprint rituals; they facilitate the execution of each sprint. 
 Looking to add, change, or remove a shared calendar? [Create an issue for the CEO](https://fleetdm.com/handbook/digital-experience#contact-us) and the appropriate DRI will reply with feedback.
 
@@ -199,7 +249,7 @@ Fleet uses skip-level 1:1 meetings as a recurring pulse check to encourage [valu
 3. Link the skip-level agenda in the calendar event description before saving.
 
 
-### Zoom
+## Zoom
 
 We use [Zoom](https://zoom.us) for virtual meetings at Fleet, and it is important that every team member feels comfortable hosting, joining, and scheduling Zoom meetings.
 By default, Zoom settings are the same for all Fleet team members, but you can change your personal settings on your [profile settings](https://zoom.us/profile/setting) page. 
@@ -229,17 +279,31 @@ Here are some tips for troubleshooting Gong:
 - To counter this, Nathan Holliday will periodically delete all recordings found in Zoom's storage without viewing them.
 - If you need help using Gong, please check out [Gong Academy](https://academy.gong.io/).
 
+
 ### Excluding calls from being recorded
+
 For those with a Gong seat or scheduling a call with someone in attendance that has a Gong seat who does not wish for their Zoom call with an external party to record, make sure your calendar event title contains `[no shadows]`.  You can also read the [complete list of exclusion rules](https://docs.google.com/document/d/1OOxLajvqf-on5I8viN7k6aCzqEWS2B24_mE47OefutE/edit?usp=sharing).
 
 
+### Sharing a local Zoom recording 
+
+In some instances, you may need to record a call locally (i.e. save the recording on your computer and not in the cloud ☁️). You can use the following steps to upload the call recording:
+1. Log into [Zoom](https://zoom.us/recording) using SSO (Single-Sign-On) and go to "Recordings". 
+2. After the recording is finished processing (which sometimes can take a couple of hours), you will see the hotdog (or "overflow menu") menu appear. Select the call you want to share and use the hotdog menu to download all files.
+3. Rename the mp4 file to match the meeting name and prefix it with the date of the recording (e.g. "YYYY-MM-DD *Name of the calendar event*").
+4. Upload the mp4 recording to the [whiteboards folder](https://drive.google.com/drive/u/0/folders/1prO98fmB2WKzpubZ2-z0sju9dQ4ijpNE) in Google Drive.
+
+
 ## Levels of confidentiality
+
 Fleet uses these levels to standardize a commitment to minimal esotericism across the company.  
 - **Public:**   _Share with anyone, anywhere in the world_
 - **Confidential:**  _Share only with team members who've signed an NDA, consulting agreement, or employment agreement_
 - **Classified:**  _Share only with founders of Fleet, business operations, and/or the people involved.  e.g., US social security numbers during hiring_
 
+
 ### Document titles
+
 Fleet uses these levels to standardize a commitment to minimal esotericism across the company. 
 - **"Public":** _(Available to public)_ 
 - _(Confidential - for Fleet eyes only)_     
@@ -247,13 +311,25 @@ Fleet uses these levels to standardize a commitment to minimal esotericism acros
 - **"¶¶":** _(Classified - CEO, Apprentice, and BizOps)_
 - **"¶¶¶":** _(CEO, Apprentice to the CEO, and board members)_
 
+## Google Drive
+
+Fleet uses Google Drive to keep files correctly bucketed and accessible for team members. When adding a file, you can: 
+- Check for existing files to avoid duplication.
+- Avoid breaking Google Drive links. In some cases, you can update files by using the "Manage versions" option (in the right-click menu) so that links continue to work.
+
+
 ## Email relays
+
 There are [several special email addresses](https://docs.google.com/document/d/1tE-NpNfw1icmU2MjYuBRib0VWBPVAdmq4NiCrpuI0F0/edit#) that automatically relay messages to the appropriate people in Fleet. Each email address meets a minimum response time ("Min RT"), expressed in business hours/days, and has a dedicated, directly responsible individual (DRI) who is responsible for reading and replying to emails sent to that address.
 
+
 ## Slack
+
 At Fleet, we do not send internal emails to each other. Instead, we prefer to use [Slack](https://www.linkedin.com/pulse/remote-work-how-set-boundaries-when-office-your-house-lora-vaughn/) to communicate with other folks who work at Fleet.
 
+
 ### Key Slack channels
+
 The following Slack channels are useful for every Fleetie:
 
 | Slack channel               | Purpose |
@@ -262,7 +338,9 @@ The following Slack channels are useful for every Fleetie:
 | `#thanks`                   | Say thank you.
 | `#random`                   | Be random.
 
+
 ### Slack channel prefixes
+
 - We have specific channels for various topics, but we also have more general channels for the teams at Fleet.
 We use these prefixes to organize the Fleet Slack:
  * ***g-***: for team/group channels *(Note: "g-" is short for "grupo" or "group")*.
@@ -271,13 +349,17 @@ We use these prefixes to organize the Fleet Slack:
  * ***at*** or ***fleet-at***: for customer channels.
  * ***2023-***: for temporary channels _(Note: specify the relevant year in four digits, like "YYYY-`)_
 
+
 ### Slack communications and best practices
+
 - We use [channels over DMs](https://fleetdm.com/handbook/company/why-this-way#why-group-slack-channels).
 - We use threads in Slack as much as possible. Threads help limit noise for other people following the channel and reduce notification overload.
 - We configure our [working hours in Slack](https://slack.com/help/articles/360025054173-Set-up-Slack-for-work-hours-) to make sure everyone knows when they can get in touch with others.
 - In consideration of our team, Fleet avoids using global tags in channels (i.e. @here, @channel, etc.) (What about polls? Good question, Fleeties are asked to post their poll in the channel and @mention the teammates they would like to hear from.)
 
+
 ### Create a GitHub issue from a Slack thread
+
 If you need to track content from a Slack channel (ie. #g-sales), you can automatically generate a github issue by selecting the `create-github-issue` emoji on the thread. This will automatically create an issue tagged with the #g-business-operations label. If you need the issue logged against a specific board, ensure that you have updated the label during issue creation.
 
 <img width="384" alt="image" src="https://github.com/fleetdm/fleet/assets/618009/97ce6caa-4b21-4cc2-8fcb-91aa03dfc6d6">
@@ -310,9 +392,12 @@ If you need to track content from a Slack channel (ie. #g-sales), you can automa
 
 
 ## GitHub
+
 Fleet uses GitHub as the [source of truth](https://fleetdm.com/handbook/company/why-this-way#why-do-we-use-one-repo) for the product and documentation. GitHub allows community members to interact with Fleet, [contribute and provide feedback](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#committing-changes).
 
+
 ### GitHub labels
+
 Fleet prefixes all GitHub labels with special characters or words to organize and categorize GitHub issues.
 
 | Prefix            | Label type  | Examples                            |
@@ -334,7 +419,9 @@ Labels with a `#g-` prefix refer to a kanban board. Since it is best practice to
 > - `P-` A [priority level](https://fleetdm.com/handbook/company/communications#high-priority-user-stories-and-bugs).
 > - `Epic` Do not use. _(TODO: ZenHub automatically recreates this label when we group sub-tasks inside of a user story. Find a way to remove this. It is an artifact from Zenhub and not something we actually want to exist or use, as it is confusing.)_
 
+
 ### Process new requests
+
 Team members [process their department's kanban boards](https://fleetdm.com/handbook/company/why-this-way#why-lean-software-development) daily, prioritizing all new requests including issues and PRs within one business day.
 
 To process intake team members will:
@@ -343,7 +430,9 @@ To process intake team members will:
 - If the goal/user story is unclear, assign the issue to the requestor and at-mention them in an issue comment asking to clarify the intended action. 
 - If the task is to be backlogged (i.e. "Not yet"), place the issue in the "Not yet" column and at-mention the requestor in an issue comment. Explain why the task is unable to be prioritized and provide a tentative ETA on when the task will be completed. 
 
+
 ## High priority user stories and bugs
+
 All issues are treated as standard priority by default. Some issues are assigned a priority label to indicate the level of urgency.
 
 - Emergency: `P0`
@@ -374,10 +463,12 @@ Any Fleetie can follow the process below to add a priority label to an issue.
    for the assigned priority label. If so, they will assign the issue to the appropriate EM and PM. If not,
    they will comment on the issue explaining why. 
 
+
 ### Estimation points
+
 Estimation points represent the effort required to complete a task. After accessing wireframes, we typically play planning poker, a gamified estimation technique, to determine the necessary story point value.
 
-We use the following story points to estimate website tasks:
+We use the following story points to estimate tasks:
 
 | Story point | Time |
 |:---|:--------------|
@@ -388,7 +479,11 @@ We use the following story points to estimate website tasks:
 | 8  | Up to a week  |
 | 13 | 1 to 2 weeks  |
 
+> Larger projects are estimated in a way that can sometimes look disproportionate to account for edge cases that weren't caught during planning. This helps us develop [iteratively](https://fleetdm.com/handbook/company#results) and deliver bite-sized functionality on more predictable time scales.
+
+
 ### Making a pull request
+
 Our handbook and docs pages are written in Markdown and are editable from our website (via GitHub). Follow the instructions below to propose an edit to the handbook or docs.
 1. Click the _"Edit page"_ button from the relevant handbook or docs page on [fleetdm.com](https://www.fleetdm.com) (this will take you to the GitHub browser).
 2. Make your suggested edits in the GitHub.
@@ -402,12 +497,16 @@ Our handbook and docs pages are written in Markdown and are editable from our we
 
 > Note: Pages in the `./docs/Contributing/` folder and folders with a underscore prefix (e.g., `./docs/Deploy/_kubernetes/`) are not included in the documentation on the Fleet website.
 
+
 ### Merging changes
+
 When merging a PR to the master branch of the [Fleet repo](https://github.com/fleetdm/fleet), remember that whatever you merge gets deployed live immediately. Ensure that the appropriate quality checks have been completed before merging. [Learn about the website QA process](#quality).
 
 When merging changes to the [docs](https://fleetdm.com/docs), [handbook](https://fleetdm.com/handbook), and articles, make sure that the PR’s changes do not contain inappropriate content (goes without saying) or confidential information, and that the content represents our [brand](#brand) accordingly. When in doubt reach out to the product manager of the [website group](https://fleetdm.com/handbook/digital-experience) in the [#g-digital-experience](https://fleetdm.slack.com/archives/C058S8PFSK0) channel on Slack.
 
+
 ### Editing a merged pull requests 
+
 We approach editing retrospectively for pull requests (PRs) to handbook pages. Remember our goal above about moving quickly and reducing time to value for our contributors? We avoid the editor becoming a bottleneck for merging quickly by editing for typos and grammatical errors after-the-fact. Here's how to do it:
 
 1. Check that the previous day's edits are formatted correctly on the website (more on this in the note below.)
@@ -425,11 +524,14 @@ We approach editing retrospectively for pull requests (PRs) to handbook pages. R
 
 
 ### Linking to a location on GitHub
+
 When adding a link to any text in the docs, handbook, or website always be sure to use the canonical form of the URL (e.g. _"https//www.fleetdm.com/
 handbook/..."_).
 Navigate to the file's location on GitHub, and press "y" to transform the URL into its canonical form.
 
+
 #### Fixing a broken link
+
 For instance when a broken link is discovered on fleetdm.com, always check if the link is a relative link to a location outside of `/docs`.
 
 An example of a link that lives outside of `/docs` is:
@@ -442,6 +544,7 @@ If the link lives outside `/docs`, head to the file's location (in this case, [h
 
 
 ### Meta tags
+
 - **Page order:** The order we display documentation pages on fleetdm.com is determined by `pageOrderInSection` meta tags. These pages are sorted in their respective sections in **ascending** order by the `pageOrderInSection` value. Every Markdown file (except readme and faq pages) in the `docs/` folder must have a meta tag with a positive 'pageOrderInSection' value.
 
 We leave large gaps between values to make future changes easier. For example, the first page in the "Using Fleet" section of the docs has a `pageOrderInSection` value of 100, and the next page has a value of 200. The significant difference between values allows us to add, remove and reorder pages without changing the value of multiple pages at a time.
@@ -450,7 +553,9 @@ When adding or reordering a page, try to leave as much room between values as po
 
 - **Page description:** TODO: Document.
 
+
 ### Images
+
 Try to keep images in the docs at a minimum. Images can be a quick way to help users understand a concept or direct them towards a specific user interface(UI) element. Still, too many can make the documentation feel cluttered and more difficult to maintain.
 
 When adding images to the Fleet repo, follow these guidelines:
@@ -467,7 +572,9 @@ The images used in the docs live in `docs/images/`. Note that you must provide t
 
 > Note that the instructions above also apply to adding images in the Fleet handbook.
 
+
 ### Audit logs
+
 The [Audit logs doc page](https://fleetdm.com/docs/Using-Fleet/Audit-logs) has a page generator that is used to speed up doc writing when Fleet adds new activity types.
 
 - If you're making a copy change to an exiting activity type, edit the `activities.go` file [here](https://github.com/fleetdm/fleet/blob/main/server/fleet/activities.go).
@@ -476,7 +583,9 @@ The [Audit logs doc page](https://fleetdm.com/docs/Using-Fleet/Audit-logs) has a
 
 After making your changes, save them and run `make generate-doc`. This will generate a new `Audit-logs.md` file. Make sure you run the command in the top level folder of your cloned, Fleet repo.
 
+
 ## Figma
+
 We use Figma for virtually all our design work. This includes the Fleet product, our website, and our marketing collateral. 
 
 - **Fleet product:** All product design work is done in the [Fleet product](https://www.figma.com/files/project/17318630/%F0%9F%94%9C%F0%9F%93%A6-Fleet-EE%C2%AE-(product)?fuid=1234929285759903870) Figma project.  
@@ -488,7 +597,9 @@ See [📖Product#Working with Figma](https://fleetdm.com/handbook/product#workin
 **Marketing assets:** Product screenshots and artwork for social media, articles, and other marketing assets can be found in [Collateral](https://www.figma.com/files/project/20798819).
 
 
+
 ## Spending company money
+
 As we continue to expand our company policies, we use [GitLab's open expense policy](https://about.gitlab.com/handbook/spending-company-money/) as a guide for company spending.
 In brief, this means that as a Fleet team member, you may:
 * Spend company money like it is your own money.
@@ -496,9 +607,12 @@ In brief, this means that as a Fleet team member, you may:
 * Feel free to make purchases __in the company's interest__ without asking for permission beforehand (when in doubt, do __inform__ your manager prior to purchase or as soon as possible after the purchase).
 For more developed thoughts about __spending guidelines and limits__, please read [GitLab's open expense policy](https://about.gitlab.com/handbook/spending-company-money/).
 
+
 ### Brex
 
+
 #### Non-travel purchases that exceed a Brex cardholder's limit
+
 For non-travel purchases that would require an increase in the Brex cardholder's limit ($2,000 by default), please [make a request](https://fleetdm.com/handbook/business-operations#contact-us) with following information:
 - The nature of the purchase (i.e. SaaS subscription and what it's used for)
 - The cost of the purchase and whether it is a fixed or variable (i.e. use-based) cost.
@@ -509,7 +623,19 @@ For non-travel purchases that would require an increase in the Brex cardholder's
 
 <img width="384" alt="image" src="https://github.com/fleetdm/fleet/assets/618009/1890e56b-7b03-4340-97d4-a6590c7715a9">
 
+
+### SaaS tool purchases
+
+When procuring SaaS tools and services, analyze the purchase of these subscription services look for these way to help the company:
+- Get product demos whenever possible.  Does the product do what it's supposed to do in the way that it is supposed to do it?
+- Avoid extra features you don't need, and if they're there anyway, avoid using them.
+- Data portability: is it possible for Fleet to export it's data if we stop using it? Is it easy to pull that data in an understandable format?
+- Programability: Does it have a publicly documented legible REST API that requires at most a single API token?
+- Intentionality: The product fits into other tools and processes that Fleet uses today. Avoid [unintended consequences](https://en.wikipedia.org/wiki/Midas). The tool will change to fit the company, or we won't use it. 
+
+
 #### Reimbursements
+
 Fleet does not reimburse expenses. We provide all of our team members with Brex cards for making purchases for the company. For company expenses, **use your Brex card.**  If there was an extreme accident, [get help](https://fleetdm.com/handbook/business-operations#contact-us).
 
 <!-- 
@@ -520,7 +646,9 @@ Team members can request reimbursement through [Gusto]([https://app.gusto.com/ex
 Operations will review the expense and reach out to the team member if they have any questions. The reimbursement will be added to the team member's next payroll when an expense is approved.
 >Pilot handles reimbursements differently depending on if the international team member is classified as an employee or a contractor. If the reimbursement is for a contractor, Operations will need to add the expense reimbursement to an upcoming recurring payment or schedule the reimbursement as an off-cycle payment. If the reimbursement is for an employee, no other action is needed; Pilot will add the reimbursement to the team member's next payroll.  -->
 
+
 ### Individualized expenses
+
 Recurring expenses related to a particular team member, such as coworking fees, are called _individualized expenses_.  These expenses are still considered [non-personnel expenses](https://docs.google.com/spreadsheets/d/1X-brkmUK7_Rgp7aq42drNcUg8ZipzEiS153uKZSabWc/edit#gid=2112277278), with a few extra considerations:
 
 - Non-recurring (one-off) expenses such as an Uber ride from the airport are NOT considered "individualized".
@@ -532,7 +660,9 @@ Recurring expenses related to a particular team member, such as coworking fees,
 
 For all new individualized expenses, [create an issue](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-business-operations&projects=&template=custom-request.md&title=Request%3A+_______________________) to notify the Business Operations department.  
 
+
 ### Accounts payable cards
+
 For recurring business expenses paid by credit card, there are four accounts payable (AP) cards that can be used based on the purpose:
 
 | Card title  | Purpose | Card owner |
@@ -546,11 +676,15 @@ For recurring business expenses paid by credit card, there are four accounts pay
 
 ## Travel
 
+
 ### Flights
+
 - Everyone at Fleet, including the CEO, uses the same [principles for booking flights](https://fleetdm.com/handbook/digital-experience#schedule-travel-for-the-ceo).
 - For example, feel free to book a direct flight if there is one that is less than double the price of the cheapest non-direct flight.
 
+
 ### Lodging
+
 - Choose a modest location with inexpensive lodging and [minimally-viable comfort](https://fleetdm.com/handbook/company/why-this-way#why-spend-less).
 - For events, check the event's website for travel & hotel accommodations and book as soon as the event is approved. As a general rule, do not spend more on lodging than the average listed hotel accommodations.
 - Avoid expensive neighborhoods and popular destination cities.
@@ -559,7 +693,9 @@ For recurring business expenses paid by credit card, there are four accounts pay
 - If the stay is longer than 4 nights and an Airbnb with a washing machine is not available, then dry cleaning can be purchased with your Brex card.
 - If you need to meet with a large group that won't fit in your hotel room or Airbnb (e.g. more than 5 people), [contact Business Operations](https://fleetdm.com/handbook/business-operations#contact-us) for their help approving and booking additional event space.
 
+
 ### Spending company money while traveling
+
 When attending a conference or traveling for Fleet, keep the following in mind:
 - **No reimbursements:** Use your company Brex card.  Reimbursements are time consuming, so Fleet does not do reimbursements for spending on personal credit cards.
 - **Food:** Be efficient and use your own credit card when it makes sense.  There is a $100 allowance per day for your own personal food and beverage on your company Brex card. _(There are many good reasons to make exceptions to this allowance, such as dinners with customers.  Before proceeding, please [request approval from the Head of Business Operations](https://fleetdm.com/handbook/business-operations#contact-us) to avoid complexities._
@@ -572,10 +708,14 @@ When attending a conference or traveling for Fleet, keep the following in mind:
   - The [price of your hotel or Airbnb](https://fletdm.com/handbook/comopany/communications#lodging) per night
   - The price of the admission fees (if attending a conference)
 
+
 ### Sales kickoffs
+
 From time to time, Fleet holds a sales kickoff (SKO) meeting.  This is a type of [offsite](https://fleetdm.com/handbook/company/communications#offsites).
 
+
 ### Offsites
+
 From time to time, Fleet organizes offsites to bring team members together in person.  This encourages trust and makes the company more productive.
 
 Offsites are:
@@ -593,29 +733,35 @@ Before spending any money on an offsite, inviting people, booking travel, or oth
     - a lean budget (including links and street address of lodging and event spaces, estimated airfare, and spending for other food or accomodations)
     - a detailed agenda of how time will be spent
   - **Bring to e-group:** Ask your manager to bring your plan for the offsite to the next weekly e-group meeting for feedback, edits, and CEO approval.
-  - **Iteration:** The E-group will discuss live, make edits, and may ask you to provide additional information or changes and return the following week for another pass.
+  - **Iteration:** The E-group will discuss live, make edits, and establish a DRI for the offsite.
 
-After the plan for the offsite is approved at the e-group meeting (including participants, detailed agenda, and final budget):
-  - The Head of Business Operations will confirm dates with all approved participants, then book all [lodging](#lodging) and coordinate any additional event space.  (Participants [book their own flights](https://fleetdm.com/handbook/company/communications#flights).)
+After the plan for the offsite is approved at the e-group meeting (including recommended participants, goals, and budget):
+  - The DRI will confirm dates with all approved participants, then book all [lodging](#lodging) and coordinate any additional event space.  (Participants [book their own flights](https://fleetdm.com/handbook/company/communications#flights).)
   - _**Note:** If the plan needs to change again, after it is approved, [ask Apprentice to the CEO for help](https://fleetdm.com/handbook/digital-experience#contact-us)._
 
+
 ### Attending conferences
+
 When attending a conference for Fleet, treat it [like other travel for the company](https://fleetdm.com/handbook/company/communications#travel).
 
 <img width="384" alt="image" src="https://github.com/fleetdm/fleet/assets/618009/8c3eeeb4-f322-44cf-8405-4f94f10fde6d">
 
 
 ## SOC 2
+
 You can find a copy of Fleet's SOC 2 report in [Google Drive](https://drive.google.com/file/d/1B-Xb4ZVmZk7Fk0IA1eCr8tCVJ-cfipid/view?usp=drivesdk).  In its current form, this SOC 2 report is intended to be shared only with parties who have signed a non-disclosure agreement with Fleet.
 
 You can learn more about how Fleet approaches security in the [security handbook](https://fleetdm.com/handbook/security) or in [Fleet's trust report](https://fleetdm.com/trust).
 
 
 ## Vendor questionnaires 
+
 In responding to security questionnaires, Fleet endeavors to provide full transparency via our [security policies](https://fleetdm.com/handbook/security/security-policies#security-policies), [trust](https://trust.fleetdm.com/), and [application security](https://fleetdm.com/handbook/business-operations/application-security) documentation. In addition to this documentation, please refer to [the vendor questionnaires page](https://fleetdm.com/handbook/business-operations/vendor-questionnaires). [Contact the Sales department](https://fleetdm.com/handbook/sales#contact-us) to address any pending questionnaires.
 
+
 ## Getting a contract signed
-If a contract is ready for signature and requires no review or revision, the requestor logins into DocuSign using hello@ from the 1Password vault and routes the agreement to the CEO for signature. 
+
+If a contract is ready for signature and requires no review or revision, log into DocuSign (credentials in 1Password) and route the agreement to the CEO for signature. 
 
 When a contract is going to be routed for signature by someone outside of Fleet (i.e. the vendor or customer), the requestor is responsible for working with the other party to make sure the document gets routed to the CEO for signature.
 
@@ -623,10 +769,11 @@ The SLA for contract signature is **2 business days**. Please do not follow up o
 
 _**Note:** Signature open time for the CEO is not currently measured, to avoid the overhead of creating separate signature issues to measure open and close time. This may change as signature volume increases._
 
-> _**Note:** If a contract is ready for signature and requires no review or revision, the requestor logins into DocuSign using hello@ from the 1Password and routes the agreement to the CEO for signature._ 
+> _**Note:** If a contract is ready for signature and requires no review or revision, log into DocuSign (credentials in 1Password) and route the agreement to the CEO for signature._ 
 
 Please use [Fleet's billing email address](https://fleetdm.com/handbook/company/communications#email-relays) for all contracts, and never use individual emails except for signature.  If the page to sign includes any individual emails in the docusign contract, please remove it before routing to the CEO for signature.
 
+
 ## Getting a contract reviewed
 
 > If a document is ready for signature and does not need to be reviewed or negotiated, you can skip the review process and use the signature process documented above.
@@ -647,10 +794,14 @@ When no further review or action is required for an agreement and the document i
 
 > **Note:** Please submit other legal questions and requests to [Business Operations department](https://fleetdm.com/handbook/business-operations#contact-us).
 
+
 ## Trust
+
 Fleet is successful because of our customers and community, and those relationships are built on trust.
 
+
 ### Security
+
 Security policies are best when they're alive, in context of how an organization operates.  Fleeties carry Yubikeys, and change control of policies and access control is driven primarily through GitOps and SSO.
 
 Here are a few different entry points for a tour of Fleet's security policies and best practices:
@@ -661,16 +812,22 @@ Here are a few different entry points for a tour of Fleet's security policies an
 5. [Hardware security keys](https://fleetdm.com/handbook/security#hardware-security-keys)
 6. More details about internal security processes at Fleet are located on [the Security page](https://fleetdm.com/handbook/business-operations/security).
 
+
 ## Benefits
+
 In this section, you can find information about Fleet's benefit strategies and decisions.
 
+
 ### Paid time off
+
 What matters most is your results, which are driven by your focus, your availability to collaborate, and the time and consideration you put into your work. Fleet offers all team members unlimited time off. Whether you're sick, you want to take a trip, you are eager for some time to relax, or you need to get some chores done around the house, any reason is a good reason.
 For team members working in jurisdictions that require certain mandatory sick leave or PTO policies, Fleet complies to the extent required by law.
 
 <img width="384" alt="image" src="https://github.com/fleetdm/fleet/assets/618009/dc417031-82fd-4348-b811-6a2e73a654a2">
 
+
 #### Holidays
+
 At Fleet, we have team members with various employment classifications in many different countries worldwide. Fleet is a US company, but we think you should choose the days you want to work and what days you are on holiday, rather than being locked into any particular nation or culture's expectation about when to take time off.
 When a team member joins Fleet, they pick one of the following holiday schedules:
  - **Traditional**: This is based on the country where you work. Non-US team members should let their managers know the dates of national holidays.
@@ -679,13 +836,16 @@ When a team member joins Fleet, they pick one of the following holiday schedules
 
 Either way, it's up to you to make sure that your responsibilities are covered, and that your team knows you're out of the office.
 
+
 #### New parent leave
+
 Fleet gives new parents six weeks of paid leave. After six weeks, if you don't feel ready to return yet, we'll set up a quick call to discuss and work together to come up with a plan to help you return to work gradually or when you're ready.
 
 <img width="384" alt="image" src="https://github.com/fleetdm/fleet/assets/618009/80808c80-8e39-4413-b87b-988014aa4348">
 
 
 #### Taking time off
+
 When you need to take time off, follow this process:
 - Let your manager and team know the days when you will be out by posting a message in your department Slack channel mentioning your manager, with when and how long.
 - Life happens and things come up.  But as soon as you know when you'll be out, let the company know.  (Extra notice helps!)
@@ -697,37 +857,53 @@ When you need to take time off, follow this process:
 
 
 ### Retirement contributions
+
 - **US based team members:** Starting August 2023, Fleet offers the ability for US based team members to contribute to a 401(k) retirement plan directly from their salary. Team members will be auto-enrolled in our plan with Guideline at a default 1% contribution unless they opt out or change their contribution amount within 30 days of commencement. Fleet currently does not match any contributions made by team members to 401(k) plans.
 - **Non-US team members**: Fleet meets the relevant country's retirement contribution requirements for team members outside the US.
 
+
 ### Coworking
+
 Your Brex card may be used for up to $500 USD per month in coworking costs. Please get prior approval by making a [custom request to the business operations team](https://fleetdm.com/handbook/business-operations#contact-us).
 
+
 ## Compensation
+
 Compensation at Fleet is determined by benchmarking using [Pave](https://pave.com). Annual raises are not guaranteed, instead we ensure teammates are compensated fairly based on the role, experience, location, and performance relative to benchmarks.
 
+
 ### Payroll dates
+
 US based Fleeties get paid on the last business day of the month. International teammates pay dates follow the same structure as US pay, unless there are in-country requirement that dictate a more frequent cadence.
 
 Variable compensation (i.e. commission) is reviewed and submitted for processing by RevOps by the 7th of each month for the previous month or quarter's contributions. US based Fleeties that receive variable compensation will be paid by the 10th. International Fleeties will be paid no later than the last day of the month for the previous month's or quarter’s contributions. 
 
+
 ### Workiversaries
+
 We're happy you've ventured a trip around the sun with Fleet- let's celebrate! The team will celebrate your tenure at the monthly "All Hands" meeting to highlight your dedication and contribution to Fleet, giving an opportunity for teammates to share their appreciation of your contribution!
 
+
 ### Compensation changes
+
 Fleet evaluates and (if relevant) updates compensation decisions yearly, shortly after the anniversary of a team member's start date. The Head of BizOps is responsible for the process to [update compensation](https://fleetdm.com/handbook/business-operations#updating-compensation)
 
+
 ### Relocating
+
 When Fleeties relocate, there are vendors that need to be notified of the change. Before relocating, please [let the company know in advance](https://fleetdm.com/handbook/business-operations#contact-us) by following the directions listed in the relevant issue template ("Moving").
 
 
 ## Team member onboarding
 
+
 ### Before the start date
 
 Fleet is open source and anyone can contribute at any time.  Before a core team member's start date, they are welcome to contribute, but not expected to.
 
+
 #### Recommendations for new teammates
+
 Welcome to Fleet!
 
 1. Understand the company
@@ -741,6 +917,7 @@ Welcome to Fleet!
 
 
 ### Training expectations
+
 It's [important](https://fleetdm.com/handbook/company/why-this-way#why-the-emphasis-on-training) that every team member at Fleet takes the time to get fully trained and onboarded. 
 When a new team member joins Fleet, we create an onboarding issue for them in the [fleetdm/confidential](https://github.com/fleetdm/confidential) repo using this [issue template](https://github.com/fleetdm/confidential/blob/main/.github/ISSUE_TEMPLATE/onboarding.md). 
 We want to make sure that the new team member will be able to complete every task in their issue. To make sure the new team member is successful in their onboarding, we customize their issue by commenting on any tasks they won't need to complete.
@@ -751,7 +928,9 @@ Expectations during onboarding:
 - The first 3 weekdays (excluding days off) for **every new team member** at Fleet is reserved for completing onboarding tasks from the checkboxes in their onboarding issue.  New team members **should not work on anything else during this time**, whether or not other tasks are stacking up or assigned.  It is OK, expected, and appreciated for new team members to **remind their manager and colleagues** of this [important](https://fleetdm.com/handbook/company/why-this-way#why-the-emphasis-on-training) responsibility.
 - Even after the first 3 days, during the rest of their first 2 weeks, completing onboarding tasks on time is a new team member's [highest priority](https://fleetdm.com/handbook/company/why-this-way#why-the-emphasis-on-training).
 
+
 ### Sightseeing tour
+
 During their first day at Fleet, new team members join a sightseeing tour call. During this call, the new team member will participate in an interactive tour of the seven main attractions in our all-remote company, including the primary tools used company-wide, what the human experience is like, and when/why we use them at Fleet.
 
 In this meeting, we'll take a look at:
@@ -767,7 +946,9 @@ In this meeting, we'll take a look at:
   - The walkie talkies (DMs).
   - The watering hole (#oooh-, #random, #news, #help-).
 
+
 ### Contributor experience training
+
 During their first week at Fleet, every new team member schedules a contributor experience training call. During this call, the new team member will share their screen, and their counterpart will:
 - make sure emails will get seen and responded to quickly.
 - make sure Slack messages will get seen and responded to quickly.
@@ -775,6 +956,7 @@ During their first week at Fleet, every new team member schedules a contributor
 - make sure you can succeed with submitting a PR with the GitHub web editor, modifying docs or handbook, and working with Markdown.
 - talk about Google calendar.
 - give you a quick tour of the Fleet Google Drive folder.
+- make sure new team members understand the expectations of, and [how to prepare](https://fleetdm.com/handbook/company/leadership#prepare-for-the-program) for, the [CEO shadow program](https://fleetdm.com/handbook/company/leadership#ceo-shadow-program).
 
 
 
@@ -793,13 +975,17 @@ Make sure you know how to share a google doc into the folder for all fleeties to
 A high level overview of the Company values
 -->
 
+
 ### Onboarding retrospective
+
 At the end of their first two weeks of onboarding at Fleet, every new team member schedules an onboarding retro call.  Agenda: 
 > Welcome once again to the team! Please tell me about your first few weeks at Fleet. How did your onboarding/training go? What didn't you manage to get to? Anything you weren't sure how to do? Any feedback on how we can make the experience better for Fleet's next hire?
 
 Fleet prioritizes a [bias for action](https://fleetdm.com/handbook/company#ownership).  If possible, apply onboarding feedback to the handbook and issue templates in realtime, during this call.  This avoids backlogging tasks that may just get out of date before we get around to them anyway.
 
+
 ## Performance feedback
+
 At Fleet, performance feedback is a continuous process. We give feedback (particularly negative) as soon as possible. Managers at Fleet will provide performance feedback [during scheduled 1:1 meetings](https://fleetdm.com/handbook/company/leadership#performance-feedback), if not sooner.
 
 Feedback is how we improve. We encourage all Fleeties to share candid and helpful feedback with each other. We use the "4A" feedback pattern:
@@ -825,9 +1011,12 @@ When _receiving_ feedback:
 
 
 ## Equipment
+
 Fleet provides laptops, YubiKey security keys, and software licenses for core team members to use while working at Fleet. 
 
+
 ### Requesting new equipment
+
 As soon as an offer is accepted, Business Operations will reach out to the new team member to start this process and will work with the new team member to get their equipment requested and shipped to them on time. From time to time, team members need to purchase additional equipment in the interest of the company.
 
 If you are in need of additional equipment for any reason, [open an IT support request](https://github.com/fleetdm/confidential/issues/new?assignees=spokanemac&labels=%3Ahelp-it&projects=&template=request-it-support.md&title=%F0%9F%92%BB+Request+IT+support). When possible, Fleet will pull from its warehouse of existing assets before spending [more money on new equipment](https://fleetdm.com/handbook/company/why-this-way#why-spend-less).
@@ -840,13 +1029,19 @@ If you are in need of additional equipment for any reason, [open an IT support r
 
 > If your Apple device is less than 3 years old, has normal battery condition, but is experiencing operating difficulties, you should first contact Apple support and troubleshoot performance issues before requesting a new device.
 
+
 ### Requesting IT support
+
 If you are in need of IT support to assist with a software or hardware issue, [open an IT support request](https://github.com/fleetdm/confidential/issues/new?assignees=spokanemac&labels=%3Ahelp-it&projects=&template=request-it-support.md&title=%F0%9F%92%BB+Request+IT+support). A Fleet IT team member will attempt to correct your issue remotely using Fleet, and will notify you if any action is needed on your part.
 
+
 ## Writing
+
 Learn how to communicate as Fleet with guidelines for tone of voice, our approach, grammar and mechanics, and more.
 
+
 ### Writing style
+
   - Infuse the core [values](https://fleetdm.com/handbook/company#values) into everything you write. 
   - Read and reread, then rewrite to make it shorter. Use links rather than explanations, short sentences. 
   - Get to where you feel like it’s really good, short, simple, and clear, hack away at any word that’s too confusing. 
@@ -863,7 +1058,8 @@ Learn how to communicate as Fleet with guidelines for tone of voice, our approac
 
 
 ### What would Mister Rogers say?
-[*Mister Rogers’ Neighborhood*](https://en.wikipedia.org/wiki/Mister_Rogers%27_Neighborhood) was one of the longest-running children’s TV series. That’s thanks to [Fred Rogers](https://en.wikipedia.org/wiki/Fred_Rogers)’ communication skills. He knew kids heard things differently than adults. So, he checked every line to avoid confusion and encourage positivity.
+
+[*Mister Rogers’ Neighborhood*](https://en.wikipedia.org/wiki/Mister_Rogers%27_Neighborhood) was one of the longest-running children’s T.V. series. That’s thanks to [Fred Rogers](https://en.wikipedia.org/wiki/Fred_Rogers)’ communication skills. He knew kids heard things differently than adults. So, he checked every line to avoid confusion and encourage positivity.
 
 Our audience is a little older. But just like the show, Mister Rogers’ method is appropriate for all ages. Here are some steps you can take to communicate like Mister Rogers:
 
@@ -886,6 +1082,7 @@ By Mister Rogersing our writing, we can encourage our readers to succeed by emph
 
 
 ### Grammarly
+
 All of our writers and editors have access to Grammarly, which comes with a handy set of tools, including:
 - **Style guide**, which helps us write consistently in the style of Fleet.
 - **Brand tones** to keep the tone of our messaging consistent with just the right amount of confidence, optimism, and joy.
@@ -894,7 +1091,9 @@ All of our writers and editors have access to Grammarly, which comes with a hand
 
 ### Using sentence case and capitalization
 
+
 #### Sentence case
+
 Fleet uses sentence case capitalization for all headings, subheadings, button text in the Fleet product, fleetdm.com, the documentation, the handbook, marketing material, direct emails, in Slack, and in every other conceivable situation.
 
 In sentence case, we write and capitalize words as if they were in sentences:
@@ -920,6 +1119,7 @@ As we use sentence case, only the first word is capitalized. But, if a word woul
 
 
 #### Capitalization and proper nouns
+
 - **Fleet:** When talking about Fleet the company, we stylize our name as either "Fleet" or "Fleet Device Management".
 - **Fleet the product:** We always say “Fleet” or “Fleet for osquery".  We _NEVER_ say "fleetDM" or "FleetDM" or "fleetdm".
 - **Team members:** [Core team members](https://fleetdm.com/handbook/company/leadership#who-isnt-a-consultant) are “fleeties".
@@ -929,38 +1129,78 @@ As we use sentence case, only the first word is capitalized. But, if a word woul
 
 
 #### Device vs endpoint
+
 - When talking about a users' computer, we prefer to use "device" over _endpoint._ Devices in this context can be a physical device or virtual instance that connect to and exchange information with a computer network. Examples of devices include mobile devices, desktop computers, laptop computers, virtual machines, and servers.
 
 
-### Headings
-Headings help readers quickly scan content to find what they need and guide readers through your writing. Organize page content using clear headings specific to the topic they describe. 
+### Headings and titles
+
+Headings and titles should give an accurate idea of a topic's content and help guide readers through your writing so they can quickly find what they need.
+
+#### Static headings
+
+Use static headings (a `noun` or `noun phrase`) e.g., “Log destinations,” for concept or reference topics. Be as short and specific as possible.
+
+#### Task-based headings
+
+Use task-based headings (`verb` + `topic`) e.g., _“Configure a log destination”_ for guides and tutorials where the heading should reveal the task that the reader is trying to achieve. 
+
+#### Avoid _-ing_ verb forms in headings
+
+Avoid starting a heading with _-ing_ verb form, if possible.
+
+_-ing_ verb forms are more difficult for non-native English readers to understand, translate inconsistently, and increase character counts in limit spaces, such as in docs navigation.
+
+| ✅ Recommended | ❌ Not recommended | 
+| ---------------- | -------------------- |
+| “Configure a log destination” | “Configuring a log destination” |
+
+#### Avoid vague verbs in headings
+
+Were possible, avoid starting a heading with a vague verb, like “understand,” “learn,” or “Use.” Headings that start with a vague verb can mislead readers by making a topic appear to be task-oriented (a guide) when it is actually reference or conceptual information. 
 
-While our readers are more tech-savvy than most, we can’t expect them to recognize queries by SQL alone.  Avoid using code for headings. Instead, say what the code does and include code examples in the body of your document.
+| ✅ Recommended | ❌ Not recommended | 
+| ---------------- | -------------------- |
+| “Log destinations” | “Understand log destinations.” |
+
+
+#### Avoid code in headings
+
+While our readers are more tech-savvy than most, we can’t expect them to recognize queries by SQL alone.  Avoid using code for headings. Instead, say what the code does and include code examples in the body of your document. That aside, it doesn't render well on the website.
+
+#### Heading hierarchy 
+
+Use heading tags to structure your content hierarchically. Try to stay within three or four heading levels. Detailed documents may use more, but pages with a simpler structure are easier to read.
 
-Keep headings brief, organized, and in a logical order:
 - H1: Page title
 - H2: Main headings
 - H3: Subheadings
 - H4: Sub-subheadings
 
-Try to stay within three or four heading levels. Detailed documents may use more, but pages with a simpler structure are easier to read.
-
 #### Punctuation in headings
+
 Fleet headings do not use end punctuation unless the heading is a question:
 
 <blockquote purpose= "large-quote">Learn how to use osquery, nanoMDM, and Nudge to manage and monitor laptops and servers running Linux, Windows, ChromeOS, and macOS</blockquote>
 
 If the heading is a question, end the heading with a question mark.
 
+
 ### Grammar mechanics
 
+
 #### Contractions 
+
 They’re great! Don’t be afraid to use them. They’ll help your writing sound more approachable
 
+
 #### Ampersands 
+
 (&) Only use ampersands if they appear in a brand name, or if you’re quoting the title of an article from another source. Otherwise, write out “and”.
 
+
 #### Commas 
+
 When listing three or more things, use commas to separate the words. This is called a serial comma.
 
 ✅ **Do:** Fleet is for IT professionals, client platform engineers, and security practitioners.
@@ -969,7 +1209,9 @@ When listing three or more things, use commas to separate the words. This is cal
 
 Aside from the serial comma, use commas, as usual, to break up your sentences. If you’re unsure whether you need a comma, saying the sentence aloud can give you a clue. If you pause or take a breath, that’s when you probably need a comma.
 
+
 #### Hyphens
+
 ✅ **Do** use a hyphen to indicate a range:
 - Monday-Friday
 
@@ -981,7 +1223,9 @@ Aside from the serial comma, use commas, as usual, to break up your sentences. I
 - Fleet is released every three weeks.
 - Osquery is open source.
 
+
 #### Colons 
+
 Colons introduce one or more elements that add detail to the idea before the colon. 
 
 ✅ **Do** use a colon to introduce a list:
@@ -990,10 +1234,14 @@ Colons introduce one or more elements that add detail to the idea before the col
 ✅ **Do** use a colon to introduce a phrase (Only capitalize the first word following a colon if it’s a proper noun):
 - Introducing Sandbox: the fastest way to play with Fleet.
 
+
 #### Exclamation points 
+
 They’re fun! But too many can undermine your credibility!!!1! Please use them sparingly. Take context into consideration. And only use one at a time.
 
+
 #### Abbreviations and acronyms
+
 If there’s a chance your reader won’t recognize an abbreviation or acronym, spell it out the first time you mention it and specify the abbreviation in parentheses. 
 
 Then use the short version for all other references.
@@ -1006,22 +1254,28 @@ If the abbreviation or acronym is well known, like API or HTML, use it instead (
 
 ### Numbers and times
 
+
 #### Numbers
+
 Spell out a number when it begins a sentence. Otherwise, use the numeral. 
 
 Sometimes numerals seem out of place. If an expression typically spells out the number, leave it as is:
 - First impression
 - Third-party integration
 - All-in-one platform
+
 Numbers over 3 digits get commas:
 - 999
 - 1,000
 - 150,000
 
+
 #### Times
+
 Use numerals and am or pm without a space in between:
 - 7am
 - 7:30pm
+
 Use a hyphen between times to indicate a time period:
 - 7am–10:30pm
 
@@ -1037,23 +1291,31 @@ Spell out international time zones:
 - Central European Time
 - Japan Standard Time
 
+
 ### Emphasis
+
 - **Bold:** Use bold text to emphasize words or phrases. Just don’t overdo it. Too much bold text may make it hard to see what’s really important.
 
 - _Italics:_ Use italics when referencing UI elements (e.g., buttons and navigation labels):
   - On the settings page, go to *Organization Settings* and select *Fleet Desktop*.
 
+
 ### Lists
+
 Lists help readers scan content for essential information. They should be as concise and symmetrical as possible.
 If you find your list running long, or if each item contains several sentences, you may want to reconsider whether a list is the best approach.
 Use a numbered list if it follows a specific order or includes a set number of items. Otherwise, use bullet points.
 
+
 #### How to introduce a list 
+
 ✅ **Do** use a colon if you introduce a list with a complete sentence.
 
 ❌ **Don’t** use a colon if you start a list right after a heading.
 
+
 #### How to use end punctuation with list items
+
 End punctuation refers to punctuation marks that are used to end sentences, such as periods, question marks, and exclamation points.
 
 ✅ **Do** use end punctuation if your list items are complete sentences:
@@ -1070,11 +1332,15 @@ End punctuation refers to punctuation marks that are used to end sentences, such
 
 ❌ **Don’t** use commas or semicolons to end bullet points.
 
+
 #### How to capitalize list items
+
 ✅ **Do** use a capital letter at the beginning of every bullet point. The only exceptions are words that follow specific style guides (e.g., macOS).
 
+
 ### Web elements
 
+
 #### SQL statements
 
 When adding SQL statements, all SQL reserved words should be uppercase, and all identifiers (such as tables and columns) should be lowercase. Here’s an example:
@@ -1086,7 +1352,36 @@ When adding SQL statements, all SQL reserved words should be uppercase, and all
 
 Markdown is a simple formatting syntax used to write content on the web. In order to publish content like [docs](https://fleetdm.com/docs), [handbook entries](https://fleetdm.com/handbook), and [articles](https://fleetdm.com/articles), you must format your content in Markdown. 
 
+
 ### Headings
+
+Each heading needs two lines of empty space separating it from the previous section and one line of empty space between the heading and related content. This helps break up blocks of text and is especially important on larger, more detailed pages. Here's an example:
+
+```
+...previous content.
+
+
+### New heading
+
+Related content... 
+```
+
+
+#### Nested headings
+
+Wherever possible, avoid creating nested headings. For example:
+
+```
+## Things
+
+### Thing 1
+
+Hi my name is Thing 1
+```
+
+
+#### Heading levels
+
 Try to stay within three or four heading levels. Complicated documents may use more, but pages with a simpler structure are easier to read.
 | Markdown | Rendered heading |
 |:--------------------|:-----------------------------|
@@ -1095,7 +1390,9 @@ Try to stay within three or four heading levels. Complicated documents may use m
 | `### Heading 3` | <h3>Heading 3</h3> |
 | `#### Heading 4` | <h4>Heading 4</h4> |
 
+
 ### Emphasis
+
 | Markdown | Rendered text |
 |:--------------------|:-----------------------------|
 | `**Bold**` | <strong>Bold</strong> |
@@ -1103,7 +1400,9 @@ Try to stay within three or four heading levels. Complicated documents may use m
 | `***Bold italic***` | <em><strong>Bold italic</strong></em> |
 | `~~Strikethrough~~` | <s>Strikethrough</s> |
 
+
 ### Line breaks and new lines
+
 Any time you need to add a line break in Markdown, you should add a new line. It is vital to make sure paragraphs are separated by new lines. Otherwise, they will render as the same HTML element.
 
 For example, if you were adding this section:
@@ -1132,16 +1431,17 @@ line one
 
 line two
 
+
 ### Lists
 
+
 #### Ordered lists
+
 | Markdown | Rendered list |
 |:-------------|:-----------------------------|
 | <pre>1. Line one<br>2. Line two  <br>3. Line three<br>4. Line four</pre> | 1. Line one<br>2. Line two<br> 3. Line three<br>4. Line four |
 | <pre>1. Line one<br>1. Indent one<br>2. Line two<br>3. Line three<br>1. Indent one<br>2. Indent two<br>4. Line four</pre> | 1. Line one<br>&nbsp;1. Indent one<br>2. Line two<br>3. Line three<br>&nbsp;1. Indent one<br>&nbsp;2. Indent two<br>4. Line four |
 
-Content nested within an ordered list needs to be indented. If the list is not formatted correctly, the number will reset on each list item, as shown in the example below.
-
 **Markdown:**
 
 ```
@@ -1160,55 +1460,49 @@ Paragraph about item one
 
 2. Item two
 
-To make sure that ordered lists increment correctly, you can indent the content nested within the list. For example, the same ordered list with indentation:
-
-**Markdown:**
-
-```
-1. Item one
-
-   Paragraph about item one
-
-2. Item two
-```
-
-**Rendered output:**
-
-1. Item one
-
-   Paragraph about item one
-
-2. Item two
 
 #### Unordered lists
+
 | Markdown | Rendered list |
 |:-------------|:-----------------------------|
 | <pre>- Line one<br>- Line two  <br>- Line three<br>- Line four</pre> | - Line one<br>- Line two<br>- Line three<br>- Line four |
 | <pre>- Line one<br> - Indent one<br>- Line two<br>- Line three<br> - Indent one<br> - Indent two<br>- Line four</pre> | - Line one<br>&nbsp;- Indent one<br>- Line two<br>- Line three<br>&nbsp;- Indent one<br>&nbsp;- Indent two<br>- Line four |
 
+
 ### Links
+
 The Fleet website currently supports the following Markdown link types.
 
+
 #### Inline link
+
 It's a classic.
 - **Markdown:** `[This is an inline link](https://domain.com/example.md)`
 - **Rendered output:** [This is an inline link](https://domain.com/example.md)
 
+
 #### Link with a tooltip
+
 Adding a tooltip to your link is a great way to provide additional information.
 - **Markdown:** `[This is link with a tooltip](https://domain.com/example.md "You're awesome!")`
 - **Rendered output:** [This is link with a tooltip](https://domain.com/example.md "You're awesome!")
 
+
 ### URLs
+
 Add angle brackets "< >" around a URL to turn it into a link.
 - **Markdown:** `<https://fleetdm.com>`
 - **Rendered output:** <https://fleetdm.com>
 
+
 ### Emails
+
 To create a mailto link... oh wait, I'm not going to tell you.
 - ***Important: To avoid spam, we **NEVER** use mailto links.***
 
+
 ### Tables
+
 To create a table, start with the header by separating rows with pipes (" | ").
 Use dashes (at least 3) to separate the header, and add colons to align the text in the table columns.
 
@@ -1225,10 +1519,19 @@ Use dashes (at least 3) to separate the header, and add colons to align the text
 |:---|---:|:---:|
 | Left alignment | Right alignment | Center Alignment |
 
+> When using tables to document API endpoint parameters, we use the following conventions:
+> + Document nested objects in their own separate tables. See the [**Modify configuration**](https://fleetdm.com/docs/rest-api/rest-api#modify-configuration) documentation for example formatting.
+> + In the **Type** column, use the terms "boolean" (not "bool"), and "array" (not "list").
+> + In the **Description** column for required parameters, begin the description with "**Required.**"
+
+
 ### Blockquotes
+
 To add a tip blockquote, start a line with ">" and end the blockquote with a blank newline.
 
+
 #### Tip blockquotes
+
 Tip blockquotes are the default blockquote style in our Markdown content.
 
 - **Markdown:**
@@ -1247,7 +1550,9 @@ This line is rendered inside of the tip blockquote.
 
 This line is rendered outside of the tip blockquote.
 
+
 #### Quote blockquotes
+
 To add a quote blockquote, add a `<blockquote>` HTML element with `purpose="quote"`.
 
 - **Markdown:**
@@ -1268,6 +1573,7 @@ This is a quote blockquote.
 Lines seperated by a blank newline will be rendered on a different line in the blockquote.
 </blockquote>
 
+
 #### Large quote blockquote
 
 You can add a large quote blockquote by adding a `<blockquote>` HTML element with `purpose="large-quote"`.
@@ -1290,6 +1596,7 @@ This is a large blockquote.
 You can use a large quote blockquote to reduce the font size and line height of the rendered text.
 </blockquote>
 
+
 #### Mermaid diagrams
 
 The Fleet Docs support diagrams that are written in mermaid.js syntax. Take a look at the [Mermaid docs](https://mermaid-js.github.io/mermaid/#/README) to learn about the syntax language and what types of diagrams you can display.
@@ -1324,7 +1631,9 @@ graph TD;
 ```
 
 
+
 ## Commonly used terms
+
 This glossary provides definitions to commonly used terms within our space.
 
 | Term | Meaning | 
@@ -1366,7 +1675,7 @@ This glossary provides definitions to commonly used terms within our space.
 | **open source** | Software with intentionally public code for the sake of transparency. |
 | **OS** | (Operating System) Software that provides the groundwork and instructions for a device's basic functions, including application use and controlling peripherals. |
 | **osquery**  | A tool that assembles low-level operating system analytics and monitoring. |
-| **out-of-policy device** | A device that is fails any security or vulnerability policy created in Fleet. |
+| **out-of-policy device** | A device that fails any security or vulnerability policy created in Fleet. |
 | **permissions** | Users have different abilities depending on the access level they have. |
 | **platform** | Any software or hardware for hosting an application, data, or service. |
 | **policies** | Yes or no questions you can ask using Fleet about your host devices. |
@@ -1392,6 +1701,7 @@ This glossary provides definitions to commonly used terms within our space.
 
 
 #### Stubs
+
 The following stubs are included only to make links backward compatible.
 
 ##### Website
diff --git a/handbook/company/leadership.md b/handbook/company/leadership.md
index 6885a8ca9704..4afb95d4fc11 100644
--- a/handbook/company/leadership.md
+++ b/handbook/company/leadership.md
@@ -244,16 +244,17 @@ A completed open position entry should look something like this:
 - _**Why bother with approvals?**  We avoid cancelling or significantly changing a role after opening it.  It hurts candidates too much.  Instead, get the position approved first, before you start recruiting and interviewing.  This gives you a sounding board and avoids misunderstandings._
 
 ### Approving a new position
-When review is requested on a proposal to open a new position, the 🐈‍⬛ CEO will complete the following steps when reviewing the pull request:
+When review is requested on a proposal to open a new position, the Apprentice to the CEO will complete the following steps when reviewing the pull request:
 
 1. **Consider role and reporting structure:** Confirm the new row in "Fleeties" has a manager, job title, and department, that it doesn't have any corrupted spreadsheet formulas or formatting, and that the start date is set to the first Monday of the next month.
 2. **Read job description:** Confirm the job description consists only of changes to "Responsibilities" and "Experience," with an appropriate filename, and that the content looks accurate, is grammatically correct, and is otherwise ready to post in a public job description on fleetdm.com.
 3. **Budget compensation:** Ballpark and document compensation research for the role based on 
    - _Add screenshot:_ Scroll to the very bottom of ["¶¶ 💌 Compensation decisions (offer math)"](https://docs.google.com/document/d/1NQ-IjcOTbyFluCWqsFLMfP4SvnopoXDcX0civ-STS5c/edit#heading=h.slomq4whmyas) and add a new heading for the role, pattern-matching off of the names of other nearby role headings. Then create written documentation of your research for future reference.  The easiest way to do this is to take screenshots of the [relevant benchmarks in Pave](https://pave.com) and paste those screenshots under the new heading.
+4. **Decide**: Decide whether to approve this role or to consider it a different time.  If approving, then:
+   - _Update financial model:_ Update ["¶ Financial model"](https://docs.google.com/spreadsheets/d/1tIcuwhmOKolnwNJqQ0zH5rWCqjawYzySDsKTb98RvxI/edit?gid=1184088923#gid=1184088923)
    - _Update team database:_ Update the row in ["¶¶ 🥧 Equity plan"](https://docs.google.com/spreadsheets/d/1_GJlqnWWIQBiZFOoyl9YbTr72bg5qdSSp4O3kuKm1Jc/edit#gid=0) using the benchmarked compensation and share count.
      - _Salary:_ Enter the salary: If the role has variable compensation, use the role's OTE (on-target earning estimate) as the budgeted salary amount, and leave a note in the "Notes (¶¶)" cell clarifying the role's bonus or commission structure.
      - _Equity:_ Enter the equity as a number of shares, watching the percentage that is automatically calculated in the next cell.  Keep guessing different numbers of shares until you get the derived percentage looking like what you want to see.
-4. **Decide**: Decide whether to approve this role or to consider it a different time.  If approving, then:
    - _Create Slack channel:_ Create a private "#hiring-xxxxxx-YYYY" Slack channel (where "xxxxxx" is the job title and YYYY is the current year) for discussion and invite the hiring manager and Head of Business Operations.
    - _Publish opening:_ Approve and merge the pull request.  The job posting will go live within ≤10 minutes.
    - _Track as approved in "Fleeties":_ In the "Fleeties" spreadsheet, find the row for the new position and update the "Job description" column and replace the URL of the pull request that originally proposed this new position with the URL of the GitHub merge commit when that PR was merged.
@@ -309,17 +310,33 @@ Here are the steps hiring managers follow to get an offer out to a candidate:
 1. **Call references:** Before proceeding, make sure you have 2-5+ references. Ask the candidate for at least 2-5+ references and contact each reference in parallel using the instructions in [Fleet's reference check template](https://docs.google.com/document/d/1LMOUkLJlAohuFykdgxTPL0RjAQxWkypzEYP_AT-bUAw/edit?usp=sharing).  Be respectful and keep these calls very short.
 2. **Add to team database:** Update the [Fleeties](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0) doc to accurately reflect the candidate's:
    - Start date
+
 > _**Tip:** No need to check with the candidate if you haven't already.  Just guess.  First Mondays tend to make good start dates.  When hiring an international employee, Pilot.co recommends starting the hiring process a month before the new employee's start date._
+
    - First and last name
    - Preferred pronoun _("them", "her", or "him")_
    - LinkedIn URL _(If the fleetie does not have a LinkedIn account, enter `N/A`)_
    - Location of candidate
-3. **Schedule CEO interview:** [Book a quick chat](https://fleetdm.com/handbook/digital-experience#contact-us) so our CEO can get to know the future Fleetie.  (Please take care of all of the previous steps first.)
-4. **Confirm intent to offer:** Compile feedback about the candidate into a single document and share that document (the "interview packet") with the Head of Business Operations via Google Drive.  _This will be interpreted as a signal that you are ready for them to make an offer to this candidate._
-   - _Compile feedback into a single doc:_ Include feedback from interviews, reference checks, and challenge submissions.  Include any other notes you can think of offhand, and embed links to any supporting documents that were impactful in your final decision-making, such as portfolios or challenge submissions.
+
+3. **Compile feedback into a single doc:** In the "interview packet", include feedback from interviews, reference checks, and challenge submissions. Include any other notes you can think of offhand, and embed links to any supporting documents that were impactful in your final decision-making, such as portfolios or challenge submissions.
+   - Name the doc with a short, formulaic name that's easy to understand in an instant from just an email subject line (e.g. "_Why hire Jane Doe ("Train Conductor") - 2023-03-21_").
+   - _Share_ this single document with the CEO.
+4. **Request a CEO interview:** Copy the template below, paste it in the hiring Slack channel for the position, and complete all "TODOs" before sending.
+
+     ```
+    *CEO interview request:*
+    Hi @Savannah Friend, the following candidate is ready for a CEO interview. cc: @Sam Pfluger
+    - Name: TODO
+    - Position: TODO
+    - LinkedIn: TODO
+    - Email: TODO
+    - Single doc URL: TODO
+     ```
+     
+5. **Confirm intent to offer:** Share the single document (the "interview packet") with the Head of Business Operations via Google Drive.  
    - _Share_ this single document with the Head of Business Operations via email.
-    - Share only _one, single Google Doc, please_; with a short, formulaic name that's easy to understand in an instant from just an email subject line (e.g. "_Why hire Jane Doe ("Train Conductor") - 2023-03-21_").
-    - When the Head of Business Operations receives this doc shared doc in their email with the compiled feedback about the candidate, they will understand that to mean that it is time for Fleet to make an offer to the candidate.
+   - When the Head of Business Operations receives this shared doc in their email with the compiled feedback about the candidate, they will understand that to mean that it is time for Fleet to make an offer to the candidate.
+
 
 ### Making an offer
 After receiving the interview packet, the Head of Business Operations uses the following steps to make an offer:
@@ -374,12 +391,40 @@ Once the new team member replies and accepts their offer in writing, 🔦 Head o
      ```
 2. **Ask hiring manager to send rejections:** Post to the `hiring-xxxxx-yyyy` Slack channel to let folks know the offer was accepted, and at-mention the _hiring manager_ to ask them to communicate with [all other interviewees](https://fleetdm.com/handbook/company#empathy) who are still in the running and [let them know that we chose a different person](https://fleetdm.com/handbook/company/leadership#candidate-correspondence-email-templates).
    >_**Note:** Send rejection emails quickly, within 1 business day.  It only gets harder if you wait._
-3. **Remove open position:** The hiring manager removes the newly-filled position from the fleetdm.com website by [making a pull request](https://fleetdm.com/handbook/company/communications#making-a-pull-request) to delete it from the [open-positions.yml](https://github.com/fleetdm/fleet/blob/main/handbook/company/open-positions.yml) file.
-4. **Close Slack channel:** Then archive and close the channel.
+3. **Remove open position:** Ensure the hiring manager removes the newly-filled position from the fleetdm.com website by [making a pull request](https://fleetdm.com/handbook/company/communications#making-a-pull-request) to delete it from the [open-positions.yml](https://github.com/fleetdm/fleet/blob/main/handbook/company/open-positions.yml) file.
+4. **Create 30-60-90 day plan:** 🧑‍🚀 Hiring manager creates a 30-60-90 day plan outlining key role objectives. The plan is reviewed weekly in 1:1 meetings during the first three months of employment, ensuring continuous support and alignment with company goals. To create the 30-60-90 day plan, hiring manager will:
+    - Create a copy of the [30-60-90 day plan template](https://docs.google.com/document/d/1EztmPBuMFXbVoy4ZToXcxasNO38ooOh8Gh5hPXFvJhI/copy) and rename the copied file using the naming convention `[start date] - 30-60-90 day plan - [teammate full name]` and move it to the [30-60-90 day plan folder](https://drive.google.com/drive/u/0/folders/1QWiAbgBFuuofT_3M8oIoBsbEBmubQAj7) in Google Drive.
+    - Follow the prompts in the template to fill out the 30-60-90 day plan for the new teammate before they start.
+5. **Close Slack channel:** Then archive and close the channel.
 
 Now what happens?  🔦 Business Operations will then follow the steps in the "Hiring" issue, which includes reaching out to the new team member within 1 business day from a separate email thread to get additional information as needed, prepare their agreement, add them to the company's payroll system, and get their new laptop and hardware security keys ordered so that everything is ready for them to start on their first day.
 
 
+## CEO shadow program
+
+The CEO shadow program is a three-day temporary assignment (usually completed during onboarding) in which core team members will shadow all relevant meetings on the CEO's calendar. This gives team members an overview of all aspects of the company and provides high context and in turn, high-output contributors. The program also creates opportunities for the CEO to build relationships with team members across the company and to identify [challenges and opportunities](https://fleetdm.com/handbook/company/leadership#ceo-flaws) earlier. 
+ 
+> **What it's not**: The CEO shadow program is not a performance evaluation or a determinating factor for a promotion or raise. 
+
+As a CEO shadow, you will be attending both internal and external meetings regarding various areas of the company. In order to make the most of your time as a shadow:
+- **Be on time**: Your time is priceless, your time as a CEO shadow is short! Join each meeting on time, this limits the distraction for other attendees and gives the CEO the opportunity to introduce you to other folks on the call without interrupting the meeting.
+- **Be present**: During meetings outside of your department, it can be easy to find yourself charging ahead on other projects. The interactions you'll have in these meetings and the context you'll gain are important.
+- **Be active**: There are many short-term tasks you'll be asked to perform as a shadow. Here are some examples:
+  - Prepare for, participate in, take notes during, and follow up on meetings.
+  - Make handbook updates and shadow PR reviews.
+  - Solve urgent issues. For example, help solve a complaint from a customer or coordinate the response to a technical issue.
+  - Create and/or complete GitHub issues involving multiple departments at Fleet, and work towards closing or creating pull requests to complete issues.
+
+
+### Prepare for the program
+
+CEO shadows join all meetings on the [CEO's calendar](https://calendar.google.com/calendar/embed?src=mike%40fleetdm.com&ctz=America%2FChicago) that **do not have** "[no shadows]" appended to the calendar event title. Before beginning your time as a [CEO shadow](https://fleetdm.com/handbook/company/leadership#ceo-shadow-program):
+1. Make sure you've read through the [CEO flaws](https://fleetdm.com/handbook/company/leadership#ceo-flaws) to better understand how to communicate with him.
+2. Update your Zoom display name to be "[your name] | CEO shadow" (e.g. "Jayne Doo | CEO shadow").
+3. Know which meetings you're expected to join. **You won't be listed as an attendee on any of the CEO's calendar events** to avoid confusion when scheduling meetings with external participants. You're intentionally marked out of office to avoid scheduling conflicts.
+
+> Please **DO NOT** add yourself as an attendee to any of the CEO's meetings. The CEO regularly meets with prospects and customers in the community, and without the context of the CEO shadow program, an unknown name on the calendar event could be mistaken for a sales tactic.
+
 
 ## Tracking hours
 Fleet asks US-based hourly contributors to track hours in Gusto, and contributors outside the US to track hours via Pilot.co.
@@ -397,14 +442,6 @@ Although it's sad to see someone go, Fleet understands that not everything is me
 4. **CEO**: The CEO will make an announcement during the "🌈 Weekly Update" post on Friday in the `#general` channel on Slack. 
 
 
-## Changing someone's position
-
-From time to time, someone's job title changes.  To do this, Business Operations follows these steps:
-
-1. Change "Fleeties" to reflect the new job title, manager, and/or department.
-2. If there is a compensation change, update "Equity plan".  Use the first day of a month as the date, and enter this in the corresponding column.
-3. If applicable, schedule the change in the appropriate payroll system.  (Don't worry about updating job titles in the payroll system.)
-
 <img width="384" alt="image" src="https://github.com/fleetdm/fleet/assets/618009/1e59ac8f-26d8-4f2f-9ff4-2e303753c910">
 
 
diff --git a/handbook/company/open-positions.yml b/handbook/company/open-positions.yml
index 2558d77a30b7..36eb7e05dfb1 100644
--- a/handbook/company/open-positions.yml
+++ b/handbook/company/open-positions.yml
@@ -36,26 +36,35 @@
       - 🛠️ Technical: You understand the software development processes. You understand that software quality matters.
       - 🟣 Openness: You are flexible and open to new ideas and ways of working.
       - ➕ Bonus: Cybersecurity or IT background.
-- jobTitle: 🐋 Solutions Consultant
-  department: Sales
-  hiringManagerName: Dave Herder
-  hiringManagerLinkedInUrl: https://linkedin.com/in/daveherder
-  hiringManagerGithubUsername: dherder
+      
+- jobTitle: 🐋 Account Executive
+  department: Customers
+  hiringManagerName: Alex Mitchell
+  hiringManagerLinkedInUrl: https://www.linkedin.com/in/alexandercmitchell/
+  hiringManagerGithubUsername: alexmitchelliii
   responsibilities: |
-      - ⏫ Work hand-in-hand with the Sales team by participating in calls with potential customers to show them a demonstration of Fleet in action.
-      - 📖 You’ll provide commentary, detailed technical explanations, examples from your experience, and answer customer questions based on your experience managing Apple, Windows, and Linux devices with MDM and other tools (osquery).
-      - 🏃‍♂️ Provide internal technical training, and participate in sales enablement activities to ensure our team is prepared to explain how Fleet works, where we fit in the Security and IT ecosystem, and how we can solve problems with our customers. 
+    - 🎯 Direct and participate in prospecting target companies, identifying key decision makers and influencers, leading when assigned/necessary/appropriate.
+    - 📈 Use available data to identify opportunities and trends with individual prospects.
+    - 📣 Actively promote FleetDM product and services on social media.
+    - 🖥️ Actively present and demonstrate the value of FleetDM products and services and upgrades targeting customer expansion opportunities.
+    - ❔ Appropriately use and follow MEDDPPICC process to qualify and progress opportunities to best help prospects solve problems.
+    - 🤔 Anticipate market trends and identify new opportunities for growth.
+    - 🕴️ Utilize systems and tools such as salesforce to analyze pipeline and opportunity data and keep all information up to date for leadership reporting.
+    - 🚀 Work collaboratively with the product management, customer support, and engineering teams to facilitate feature development based on customer asks.
+    - 🧑‍💻 Collaborate with the marketing team to plan, execute and track impactful marketing campaigns, in order to meet and/or exceed quarterly pipeline and revenue targets.
+    - 🤝 Work with prospects to find win-win commercial agreements.
   experience: |
-      - 🦉 3+ years of experience in a technical sales role (Solutions Consultant, Sales Engineer, Solutions Architect, Technical Account Manager, etc) in the device management or cybersecurity space.
-      - 🧑‍🔬 Experience working with Enterprise customers to help resolve complex technical issues.
-      - 💭 Cybersecurity or IT background, experience with device management solutions like Fleet, Intune, Jamf Pro, Workspace One, etc. in addition to EDR platforms like Crowdstrike, SentinelOne, CarbonBlack, etc. 
-      - ➕ Familiarity with GitOps workflows and steps to contribute code in open source projects.
-      - 🛠️ Has deployed infrastructure via some form of CI tooling to at least one of the big cloud platforms and lived to tell the tale.
-      - 💖 An excellent understanding of macOS, Windows, Linux and core services like Autopilot, ABM/ASM, MDM, ADE, APNs, syslog, etc.
-      - ✍️ Familiarity with SQLite, shell scripting, Python, Powershell, and using Terminal to execute commands or run scripts.
-      - 🎯 Strong attention to detail and can act as an encyclopedia of knowledge about how Fleet works - our potential customers represent a wide range of needs across many different use cases. Be adaptable to learning new things quickly and then share this knowledge with others.
-      - 💡 Excellent communication and collaboration skills, with the ability to work closely with sales, engineering, and product teams.
-      - 🌐 Coordinate with our Customer Success team to assist with any technical questions during renewal discussions. You’ll be a resource for existing customers too.
-      - 👥 A customer-centric mindset, focusing on delivering value and a positive user experience.
-      - 🤝 Collaboration: You work best in a participatory, team-based environment.
-      - 🟣 Openness: You are flexible and open to new ideas and ways of working.
+    - 🦉 5+ years experience selling to enterprise customers.
+    - 📣 Have excellent communication and interpersonal skills.
+    - 🧑‍💻 Love technology and can explain how things work in detail.
+    - 🧪 Extensive experience with Slack, Salesforce, Google Suite, and GitHub.
+    - ⏩ Thrive in a complex, fast-paced, results driven environment with the ability to pivot to organizational changes easily.
+    - 🤝 Decisive with the ability to shift gears between thinking and doing.
+    - 📈 Ability to partner with various teams and stakeholders to drive sales.
+    - 👀 Strong understanding of the enterprise procurement process.
+    - ➕ Bonus: Direct experience with Fleet, MDM, osquery or SQL query writing, and working with Client Platform Engineering, SRE, or Security Engineering teams.
+    - 💭 You know how to manage complex sales, difficult escalations, and challenging procurement processes with the utmost care and organization.
+    - 💖 You know how to manage your time and priorities between leads, opportunities other day-to-day responsibilities.
+    - ✍ You have the ability to effectively influence key stakeholders, from senior executives to day-to-day engineering contacts, and discuss Fleet's value with them.
+    - 🧬 You care about delivering an outstanding customer experience and advocating for the customer's needs within Fleet.
+    - ➕ Bonus: You are comfortable with concepts like DevOps/GitOps, APIs, and security.
diff --git a/handbook/company/pricing-features-table.yml b/handbook/company/pricing-features-table.yml
index 3aa2ba2c4ce3..85392beb5d1b 100644
--- a/handbook/company/pricing-features-table.yml
+++ b/handbook/company/pricing-features-table.yml
@@ -1,3 +1,471 @@
+# [?]: To generate new ASCII art headings used in this file, you can use the @mikermcneil/kit npm package. See https://github.com/mikermcneil/kit for more details
+#
+# Example feature:
+# - industryName: Feature name - Displayed on the features table on fleetdm.com/pricing
+#   tier: The tier of Fleet that users can use this feature on. Either "Free" or "Premium"
+#   description: Description of feature - This value is added to the tooltip for this feature on fleetdm.com/pricing
+#   pricingTableCategories: [Array] - The section of the pricing features table this feature is. in. Supports multiple categories, but it is usally best to pick one. Supported values: "Support", "Integrations", "Deployment", "Endpoint operations", "Vulnerability management", "Device management". 
+#   documentationUrl: URL of relavant Fleet documentation - If provided with a description, this link will be added to the tooltip for this feature
+#   usualDepartment:  The type of buyer who would be interested in this feature. Supports "IT" or "Security". This value determines what category switcher this feature is under.
+#   productCategories: [Array] - The product category this feature is under. Supported values: "Vulnerability management", "Endpoint operations", "Device management". (Currently not used by the Fleet website UI)
+#   moreInfoUrl: URL where users can learn more about this feature - Not used on the pricing page currently
+#   jamfProHasFeature: Whether or not Jamf Pro has this (or a comparable) feature. Supported values: "yes", "no" or "appleOnly" (currently not used by Fleet website UI)
+#   jamfProtectHasFeature: Whether or not Jamf Protext has this (or a comparable) feature. Supported values: "yes", "no" or "appleOnly" (currently not used by Fleet website UI)
+#
+#                                                                                                                                                                                                                                                                                                                             
+#
+#  ██████╗ ███████╗██████╗ ██╗      ██████╗ ██╗   ██╗███╗   ███╗███████╗███╗   ██╗████████╗ 
+#  ██╔══██╗██╔════╝██╔══██╗██║     ██╔═══██╗╚██╗ ██╔╝████╗ ████║██╔════╝████╗  ██║╚══██╔══╝
+#  ██║  ██║█████╗  ██████╔╝██║     ██║   ██║ ╚████╔╝ ██╔████╔██║█████╗  ██╔██╗ ██║   ██║   
+#  ██║  ██║██╔══╝  ██╔═══╝ ██║     ██║   ██║  ╚██╔╝  ██║╚██╔╝██║██╔══╝  ██║╚██╗██║   ██║   
+#  ██████╔╝███████╗██║     ███████╗╚██████╔╝   ██║   ██║ ╚═╝ ██║███████╗██║ ╚████║   ██║   
+#  ╚═════╝ ╚══════╝╚═╝     ╚══════╝ ╚═════╝    ╚═╝   ╚═╝     ╚═╝╚══════╝╚═╝  ╚═══╝   ╚═╝   
+#         
+#
+#  ╔╦╗╔═╗╔╗╔╔═╗╔═╗╔═╗╔╦╗  ╔═╗╦  ╔═╗╦ ╦╔╦╗
+#  ║║║╠═╣║║║╠═╣║ ╦║╣  ║║  ║  ║  ║ ║║ ║ ║║
+#  ╩ ╩╩ ╩╝╚╝╩ ╩╚═╝╚═╝═╩╝  ╚═╝╩═╝╚═╝╚═╝═╩╝
+- industryName: Managed cloud
+  description: Have Fleet host it for you (currently only available for customers with 700+ hosts.  PS. Wish we could host for you?  We're working on it!  Please let us know if you know of a good partner.  In the meantime, join fleetdm.com/support and we're happy to help you deploy Fleet yourself.)
+  pricingTableCategories: [Deployment]
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+# 
+#  ╔═╗╔═╗╦  ╔═╗  ╦ ╦╔═╗╔═╗╔╦╗╔═╗╔╦╗
+#  ╚═╗║╣ ║  ╠╣───╠═╣║ ║╚═╗ ║ ║╣  ║║
+#  ╚═╝╚═╝╩═╝╚    ╩ ╩╚═╝╚═╝ ╩ ╚═╝═╩╝
+- industryName: Self-hosted
+  friendlyName: Host it yourself
+  description: Deploy Fleet anywhere and host it yourself, even in air-gapped environments except where technologically impossible.
+  pricingTableCategories: [Deployment]
+  documentationUrl: https://fleetdm.com/docs/deploy/introduction
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: no
+  buzzwords: [Self-hosted]
+#  
+#  ╔╦╗╦ ╦╦ ╔╦╗╦  ╔╦╗╔═╗╔╗╔╔═╗╔╗╔╔═╗╦ ╦
+#  ║║║║ ║║  ║ ║───║ ║╣ ║║║╠═╣║║║║  ╚╦╝
+#  ╩ ╩╚═╝╩═╝╩ ╩   ╩ ╚═╝╝╚╝╩ ╩╝╚╝╚═╝ ╩ 
+- industryName: Multi-tenancy
+  description: For managed service providers to use a single instance of Fleet for multiple customers.
+  documentationUrl: https://github.com/fleetdm/fleet/issues/9956
+  productCategories: [Device management]
+  pricingTableCategories: [Deployment]
+  usualDepartment: IT
+  buzzwords: [OEM,Private label,House brand,Clear label,Multi-tenancy]
+  tier: Premium
+  comingSoonOn: 2024-08-26 #customer-deebradel 
+#  
+#  ╔╦╗╔═╗╔═╗╦  ╔═╗╦ ╦╔╦╗╔═╗╔╗╔╔╦╗  ╔╦╗╔═╗╔═╗╦  ╔═╗
+#   ║║║╣ ╠═╝║  ║ ║╚╦╝║║║║╣ ║║║ ║    ║ ║ ║║ ║║  ╚═╗
+#  ═╩╝╚═╝╩  ╩═╝╚═╝ ╩ ╩ ╩╚═╝╝╚╝ ╩    ╩ ╚═╝╚═╝╩═╝╚═╝
+- industryName: Deployment tools 
+  description: Pre-built Terraform modules and Helm charts to help you get up and running. 
+  documentationUrl: https://fleetdm.com/docs/deploy/introduction
+  usualDepartment: IT
+  tier: Free
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Deployment] 
+#
+#
+#   ██████╗ ██████╗ ███╗   ██╗███████╗██╗ ██████╗ ██╗   ██╗██████╗  █████╗ ████████╗██╗ ██████╗ ███╗   ██╗
+#  ██╔════╝██╔═══██╗████╗  ██║██╔════╝██║██╔════╝ ██║   ██║██╔══██╗██╔══██╗╚══██╔══╝██║██╔═══██╗████╗  ██║
+#  ██║     ██║   ██║██╔██╗ ██║█████╗  ██║██║  ███╗██║   ██║██████╔╝███████║   ██║   ██║██║   ██║██╔██╗ ██║
+#  ██║     ██║   ██║██║╚██╗██║██╔══╝  ██║██║   ██║██║   ██║██╔══██╗██╔══██║   ██║   ██║██║   ██║██║╚██╗██║
+#  ╚██████╗╚██████╔╝██║ ╚████║██║     ██║╚██████╔╝╚██████╔╝██║  ██║██║  ██║   ██║   ██║╚██████╔╝██║ ╚████║
+#   ╚═════╝ ╚═════╝ ╚═╝  ╚═══╝╚═╝     ╚═╝ ╚═════╝  ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝   ╚═╝   ╚═╝ ╚═════╝ ╚═╝  ╚═══╝
+#
+#
+#  ╔═╗╦═╗╦╦  ╦╔═╗╔╦╗╔═╗  ╦ ╦╔═╗╔╦╗╔═╗╔╦╗╔═╗  ╦═╗╔═╗╔═╗╦╔═╗╔╦╗╦═╗╦ ╦
+#  ╠═╝╠╦╝║╚╗╔╝╠═╣ ║ ║╣   ║ ║╠═╝ ║║╠═╣ ║ ║╣   ╠╦╝║╣ ║ ╦║╚═╗ ║ ╠╦╝╚╦╝
+#  ╩  ╩╚═╩ ╚╝ ╩ ╩ ╩ ╚═╝  ╚═╝╩  ═╩╝╩ ╩ ╩ ╚═╝  ╩╚═╚═╝╚═╝╩╚═╝ ╩ ╩╚═ ╩
+- industryName: Private update registry
+  friendlyName: Update agents from a secret URL
+  description: Load agent code from a secret URL that you manage.
+  documentationUrl: https://fleetdm.com/docs/using-fleet/update-agents
+  tier: Premium
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Configuration]
+  usualDepartment: Security
+#
+#  ╔═╗╔═╗╔╗╔╔╦╗╦═╗╔═╗╦    ╔═╗╔═╗╔═╗╔╗╔╔╦╗  ╦  ╦╔═╗╦═╗╔═╗╦╔═╗╔╗╔╔═╗
+#  ║  ║ ║║║║ ║ ╠╦╝║ ║║    ╠═╣║ ╦║╣ ║║║ ║   ╚╗╔╝║╣ ╠╦╝╚═╗║║ ║║║║╚═╗
+#  ╚═╝╚═╝╝╚╝ ╩ ╩╚═╚═╝╩═╝  ╩ ╩╚═╝╚═╝╝╚╝ ╩    ╚╝ ╚═╝╩╚═╚═╝╩╚═╝╝╚╝╚═╝
+- industryName: Control agent versions
+  description: Manage agents remotely by setting different versions per-baseline.
+  documentationUrl: https://fleetdm.com/docs/configuration/agent-configuration#configure-fleetd-update-channels
+  tier: Premium
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Configuration]
+  usualDepartment: IT
+  waysToUse:
+    - description: Supply-chain Levels for Software Artifacts (SLSA) attestations for the fleetd binary artifacts and server container image to enable verification that the binaries are built and uploaded using GitHub Actions from the Fleet repository at a particular commit SHA coming soon (2024-12-31).
+    - moreInfoUrl: https://github.com/fleetdm/fleet/issues/20219 #customer-figali
+#
+#  ╔═╗╔═╗╔╦╗╔╦╗╔═╗╔╗╔╔╦╗  ╦  ╦╔╗╔╔═╗  ╔╦╗╔═╗╔═╗╦    ┌─  ╔═╗╦  ╦  ─┐
+#  ║  ║ ║║║║║║║╠═╣║║║ ║║  ║  ║║║║║╣    ║ ║ ║║ ║║    │   ║  ║  ║   │
+#  ╚═╝╚═╝╩ ╩╩ ╩╩ ╩╝╚╝═╩╝  ╩═╝╩╝╚╝╚═╝   ╩ ╚═╝╚═╝╩═╝  └─  ╚═╝╩═╝╩  ─┘
+- industryName: Command line tool (CLI)
+  friendlyName: fleetctl
+  documentationUrl: https://fleetdm.com/docs/using-fleet/fleetctl-cli
+  productCategories: [Endpoint operations,Device management]
+  pricingTableCategories: [Configuration]
+  usualDepartment: IT
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes      
+#
+#  ╔═╗╦╔╦╗╔═╗╔═╗╔═╗
+#  ║ ╦║ ║ ║ ║╠═╝╚═╗
+#  ╚═╝╩ ╩ ╚═╝╩  ╚═╝
+- industryName: GitOps
+  friendlyName: Manage endpoints in git
+  documentationUrl: https://github.com/fleetdm/fleet-gitops
+  description: Fork the best practices GitHub repo and use the included GitHub Actions to quickly automate Fleet console and configuration workflow management.
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Configuration]
+  usualDepartment: IT
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  demos:
+    description: A top savings and investment company wanted workflows and automation so that one bad actor can't brick their fleet.  This way, they have to make a pull request first.
+    quote: I don't want one bad actor to brick my fleet.  I want them to make a pull request first.
+    moreInfoUrl: https://docs.google.com/document/d/1hAQL6P--Tt3syq1MTRONAxhQA_2Vjt3oOJJt_O4xbiE/edit?disco=AAABAVnYvns&usp_dm=true#heading=h.7en766pueek4
+#  
+#  ╔╦╗╦ ╦╔═╗   ╔═╗╔═╗╔═╗╔╦╗╔═╗╦═╗  ╔═╗╦ ╦╔╦╗╦ ╦╔═╗╔╗╔╔╦╗╦╔═╗╔═╗╔╦╗╦╔═╗╔╗╔
+#   ║ ║║║║ ║───╠╣ ╠═╣║   ║ ║ ║╠╦╝  ╠═╣║ ║ ║ ╠═╣║╣ ║║║ ║ ║║  ╠═╣ ║ ║║ ║║║║
+#   ╩ ╚╩╝╚═╝   ╚  ╩ ╩╚═╝ ╩ ╚═╝╩╚═  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝╝╚╝ ╩ ╩╚═╝╩ ╩ ╩ ╩╚═╝╝╚╝
+- industryName: Two-factor authentication
+  moreInfoUrl: https://github.com/fleetdm/fleet/issues/5478
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Configuration]
+  usualDepartment: IT
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  waysToUse:
+    - description: Enforce two-factor authentication when logging in to Fleet for added security.
+  comingSoonOn: 2024-12-31 #customer-rosner
+#  
+#  ╔═╗╦ ╦╔═╗╔╦╗╔═╗╔╦╗  ╔═╗╔═╗╦═╗  ╔═╗╦═╗╔═╗╔═╗╔═╗  ╔╦╗╔═╗╔╦╗╔═╗╦╔╗╔  ╦╔╦╗╔═╗╔╗╔╔╦╗╦╔╦╗╦ ╦  
+#  ╚═╗╚╦╝╚═╗ ║ ║╣ ║║║  ╠╣ ║ ║╠╦╝  ║  ╠╦╝║ ║╚═╗╚═╗───║║║ ║║║║╠═╣║║║║  ║ ║║║╣ ║║║ ║ ║ ║ ╚╦╝  
+#  ╚═╝ ╩ ╚═╝ ╩ ╚═╝╩ ╩  ╚  ╚═╝╩╚═  ╚═╝╩╚═╚═╝╚═╝╚═╝  ═╩╝╚═╝╩ ╩╩ ╩╩╝╚╝  ╩═╩╝╚═╝╝╚╝ ╩ ╩ ╩  ╩   
+#  ╔╦╗╔═╗╔╗╔╔═╗╔═╗╔═╗╔╦╗╔═╗╔╗╔╔╦╗  ╔═╗╦═╗╔═╗╦  ╦╦╔═╗╦╔═╗╔╗╔╦╔╗╔╔═╗                         
+#  ║║║╠═╣║║║╠═╣║ ╦║╣ ║║║║╣ ║║║ ║   ╠═╝╠╦╝║ ║╚╗╔╝║╚═╗║║ ║║║║║║║║║ ╦                         
+#  ╩ ╩╩ ╩╝╚╝╩ ╩╚═╝╚═╝╩ ╩╚═╝╝╚╝ ╩   ╩  ╩╚═╚═╝ ╚╝ ╩╚═╝╩╚═╝╝╚╝╩╝╚╝╚═╝                         
+- industryName: System for Cross-domain Identity Management (SCIM) provisioning
+  moreInfoUrl: https://github.com/fleetdm/fleet/issues/15671
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Configuration]
+  usualDepartment: IT
+  tier: Premium
+  comingSoonOn: 2024-12-31 #customer-rosner
+#  
+#  ╦═╗╔═╗╦  ╔═╗  ╔╗ ╔═╗╔═╗╔═╗╔╦╗  ╔═╗╔═╗╔═╗╔═╗╔═╗╔═╗  ╔═╗╔═╗╔╗╔╔╦╗╦═╗╔═╗╦  
+#  ╠╦╝║ ║║  ║╣───╠╩╗╠═╣╚═╗║╣  ║║  ╠═╣║  ║  ║╣ ╚═╗╚═╗  ║  ║ ║║║║ ║ ╠╦╝║ ║║  
+#  ╩╚═╚═╝╩═╝╚═╝  ╚═╝╩ ╩╚═╝╚═╝═╩╝  ╩ ╩╚═╝╚═╝╚═╝╚═╝╚═╝  ╚═╝╚═╝╝╚╝ ╩ ╩╚═╚═╝╩═╝
+- industryName: Role-based access control
+  documentationUrl: https://fleetdm.com/docs/using-fleet/manage-access#manage-access
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Configuration]
+  usualDepartment: IT
+  tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+#
+#  ╔═╗╦ ╦╔╦╗╦╔╦╗  ╦  ╔═╗╔═╗╔═╗╦╔╗╔╔═╗
+#  ╠═╣║ ║ ║║║ ║   ║  ║ ║║ ╦║ ╦║║║║║ ╦
+#  ╩ ╩╚═╝═╩╝╩ ╩   ╩═╝╚═╝╚═╝╚═╝╩╝╚╝╚═╝
+- industryName: Audit logging
+  description: Log all activity, including queries, scripts, access, etc.
+  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#list-activities
+  productCategories: [Endpoint operations, Device management]
+  pricingTableCategories: [Configuration]
+  tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  usualDepartment: Security
+  waysToUse:
+    - description: Export activity of Fleet admins to your SIEM or data lake
+#  
+#  ╔═╗╔═╗╔═╗╔═╗╔═╗  ╔╦╗╦═╗╔═╗╔╗╔╔═╗╔═╗╔═╗╦═╗╔═╗╔╗╔╔═╗╦ ╦
+#  ╚═╗║  ║ ║╠═╝║╣    ║ ╠╦╝╠═╣║║║╚═╗╠═╝╠═╣╠╦╝║╣ ║║║║  ╚╦╝
+#  ╚═╝╚═╝╚═╝╩  ╚═╝   ╩ ╩╚═╩ ╩╝╚╝╚═╝╩  ╩ ╩╩╚═╚═╝╝╚╝╚═╝ ╩ 
+- industryName: Scope transparency
+  description: Let end users see the source code for exactly how they are being monitored, and set clear expectations about what is and isn’t acceptable use of work computers.
+  tier: Free
+  documentationUrl: https://fleetdm.com/transparency
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Configuration]
+#        
+#  
+#  ██████╗ ███████╗██╗   ██╗██╗ ██████╗███████╗                                                
+#  ██╔══██╗██╔════╝██║   ██║██║██╔════╝██╔════╝                                                
+#  ██║  ██║█████╗  ██║   ██║██║██║     █████╗                                                  
+#  ██║  ██║██╔══╝  ╚██╗ ██╔╝██║██║     ██╔══╝                                                  
+#  ██████╔╝███████╗ ╚████╔╝ ██║╚██████╗███████╗                                                
+#  ╚═════╝ ╚══════╝  ╚═══╝  ╚═╝ ╚═════╝╚══════╝                                                
+#                                                                                              
+#  ███╗   ███╗ █████╗ ███╗   ██╗ █████╗  ██████╗ ███████╗███╗   ███╗███████╗███╗   ██╗████████╗
+#  ████╗ ████║██╔══██╗████╗  ██║██╔══██╗██╔════╝ ██╔════╝████╗ ████║██╔════╝████╗  ██║╚══██╔══╝
+#  ██╔████╔██║███████║██╔██╗ ██║███████║██║  ███╗█████╗  ██╔████╔██║█████╗  ██╔██╗ ██║   ██║   
+#  ██║╚██╔╝██║██╔══██║██║╚██╗██║██╔══██║██║   ██║██╔══╝  ██║╚██╔╝██║██╔══╝  ██║╚██╗██║   ██║   
+#  ██║ ╚═╝ ██║██║  ██║██║ ╚████║██║  ██║╚██████╔╝███████╗██║ ╚═╝ ██║███████╗██║ ╚████║   ██║   
+#  ╚═╝     ╚═╝╚═╝  ╚═╝╚═╝  ╚═══╝╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═══╝   ╚═╝   
+#
+#  
+#  ╔═╗╦═╗╔═╗╔═╗╔═╗   ╔═╗╦  ╔═╗╔╦╗╔═╗╔═╗╦═╗╔╦╗  ╔╦╗╔╦╗╔╦╗  ╔═╗╦ ╦╔═╗╔═╗╔═╗╦═╗╔╦╗
+#  ║  ╠╦╝║ ║╚═╗╚═╗───╠═╝║  ╠═╣ ║ ╠╣ ║ ║╠╦╝║║║  ║║║ ║║║║║  ╚═╗║ ║╠═╝╠═╝║ ║╠╦╝ ║ 
+#  ╚═╝╩╚═╚═╝╚═╝╚═╝   ╩  ╩═╝╩ ╩ ╩ ╚  ╚═╝╩╚═╩ ╩  ╩ ╩═╩╝╩ ╩  ╚═╝╚═╝╩  ╩  ╚═╝╩╚═ ╩ 
+- industryName: Cross-platform MDM support
+  description: macOS, Windows, and Linux.
+  documentationUrl: https://fleetdm.com/announcements/fleet-introduces-windows-mdm
+  tier: Premium
+  jamfProHasFeature: appleOnly
+  jamfProtectHasFeature: no
+  usualDepartment: IT
+  productCategories: [Device management]
+  pricingTableCategories: [Devices]       
+#  
+#  ╔╦╗╔╦╗╔╦╗  ╔╦╗╦╔═╗╦═╗╔═╗╔╦╗╦╔═╗╔╗╔
+#  ║║║ ║║║║║  ║║║║║ ╦╠╦╝╠═╣ ║ ║║ ║║║║
+#  ╩ ╩═╩╝╩ ╩  ╩ ╩╩╚═╝╩╚═╩ ╩ ╩ ╩╚═╝╝╚╝
+- industryName: MDM migration #   « end-user initiated MDM migration, with interactive UI
+  description: Easily move your devices from your current MDM solution to Fleet.
+  tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: no
+  documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-migration-guide
+  usualDepartment: IT
+  productCategories: [Device management]
+  pricingTableCategories: [Devices]
+#  
+#  ╔═╗╔═╗╦═╗╔═╗  ╔╦╗╔═╗╦ ╦╔═╗╦ ╦  ╔═╗╔═╗╔╦╗╦ ╦╔═╗
+#  ╔═╝║╣ ╠╦╝║ ║───║ ║ ║║ ║║  ╠═╣  ╚═╗║╣  ║ ║ ║╠═╝
+#  ╚═╝╚═╝╩╚═╚═╝   ╩ ╚═╝╚═╝╚═╝╩ ╩  ╚═╝╚═╝ ╩ ╚═╝╩  
+- industryName: Zero-touch setup
+  description: Zero-touch setup for macOS, iOS/iPadOS, and Windows.
+  documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-macos-setup-experience
+  tier: Premium
+  jamfProHasFeature: appleOnly
+  jamfProtectHasFeature: no
+  usualDepartment: IT
+  productCategories: [Device management]
+  pricingTableCategories: [Devices]
+  waysToUse:
+    - description: Ship a macOS, iOS, or iPadOS device to the end user's home and have them automatically enroll to Fleet during out-of-the-box setup.
+    - description: Ship a Windows workstation to the end user's home and have them automatically enroll to Fleet during out-of-the-box setup.
+    - description: Customize the out-of-the-box setup experience for your end users.
+    - description: Install a bootstrap package to run custom scripts during the setup experience. Store the bootstrap package outside the Fleet database coming soon (2024-09-15) #customer-faltona
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/19037
+    - description: Require end users to authenticate with your identity provider (IdP) and agree to an end user license agreement (EULA) before they can use their new workstation
+#  
+#  ╔╗ ╦ ╦╔═╗╔╦╗  ╔═╗╔╗╔╦═╗╔═╗╦  ╦  ╔╦╗╔═╗╔╗╔╔╦╗
+#  ╠╩╗╚╦╝║ ║ ║║  ║╣ ║║║╠╦╝║ ║║  ║  ║║║║╣ ║║║ ║ 
+#  ╚═╝ ╩ ╚═╝═╩╝  ╚═╝╝╚╝╩╚═╚═╝╩═╝╩═╝╩ ╩╚═╝╝╚╝ ╩ 
+- industryName: Bring your own device (BYOD) enrollment
+  description: BYOD enrollment for macOS, iOS/iPadOS (coming soon), Windows, and Android (coming soon) devices.
+  documentationUrl: https://fleetdm.com/guides/sysadmin-diaries-device-enrollment#byod-enrollment
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: no
+  usualDepartment: IT
+  productCategories: [Device management]
+  pricingTableCategories: [Devices]
+  waysToUse:
+    - description: Support ACME as a protocol for MDM certificate generation. Coming soon (2024-12-31) #customer-rosner
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/15611 
+#  
+#  ╦ ╦╔═╗╔═╗╦═╗  ╔═╗╔═╗╔═╗╔═╗╦ ╦╔╗╔╔╦╗  ╔═╗╦ ╦╔╗╔╔═╗
+#  ║ ║╚═╗║╣ ╠╦╝  ╠═╣║  ║  ║ ║║ ║║║║ ║   ╚═╗╚╦╝║║║║  
+#  ╚═╝╚═╝╚═╝╩╚═  ╩ ╩╚═╝╚═╝╚═╝╚═╝╝╚╝ ╩   ╚═╝ ╩ ╝╚╝╚═╝
+- industryName: User account sync
+  description: Sync user accounts via Okta, AD, or any IDP. 
+  documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-macos-setup-experience
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Devices]
+  usualDepartment: IT
+  tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  waysToUse:
+    - description: Automatically set admin access to Fleet based on your IDP
+#
+#  ╦ ╦╦ ╦╔╦╗╔═╗╔╗╔   ╔═╗╔╗╔╔╦╗╔═╗╔═╗╦╔╗╔╔╦╗  ╔╦╗╔═╗╔═╗╔═╗╦╔╗╔╔═╗
+#  ╠═╣║ ║║║║╠═╣║║║───║╣ ║║║ ║║╠═╝║ ║║║║║ ║   ║║║╠═╣╠═╝╠═╝║║║║║ ╦
+#  ╩ ╩╚═╝╩ ╩╩ ╩╝╚╝   ╚═╝╝╚╝═╩╝╩  ╚═╝╩╝╚╝ ╩   ╩ ╩╩ ╩╩  ╩  ╩╝╚╝╚═╝
+- industryName: Human-endpoint mapping
+  friendlyName: See who logs in on every computer
+  description: Identify who logs in to any system, including login history and current sessions.  Look up any host by the email address of the person using it.
+  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#get-hosts-google-chrome-profiles
+  screenshotSrc:
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Devices]
+  usualDepartment: IT
+  buzzwords: [Device users,human-to-device mapping]
+  dri: mikermcneil
+  demos:
+    - description: Security engineers at a top gaming company wanted to get demographics off their macOS, Windows, and Linux machines about who the user is and who's logged in.
+      moreInfoUrl: https://docs.google.com/document/d/1qFYtMoKh3zyERLhbErJOEOo2me6Bc7KOOkjKn482Sqc/edit
+    - description: Data engineers at a top biotech corporation needed to know who is logged into their devices. 
+      quote: So we don't know exactly what's going on after we deploy the device, we know that they are compliant with the security because we are running these stuff, but we don't know certainly who is running, who is logging in the device?
+      moreInfoUrl: https://docs.google.com/document/d/17MNI5ykzlFjdVmQ8SPMrT1oR_hY_vkYAJx31F7l7Pv8/edit#heading=h.7en766pueek4 
+  waysToUse:
+    - description: Look up computer by ActiveDirectory account
+    - description: Find device by Google Chrome user
+    - description: Identify who logs in to any system, including login history and current sessions.
+    - description: Look up any host by the email address of the person using it.
+    - description: Check user login history
+      moreInfoUrl: https://www.lepide.com/how-to/audit-who-logged-into-a-computer-and-when.html#:~:text=To%20find%20out%20the%20details,logs%20in%20%E2%80%9CWindows%20Logs%E2%80%9D.
+    - description: See currently logged in users
+      moreInfoUrl: https://www.top-password.com/blog/see-currently-logged-in-users-in-windows/
+    - description: Get demographics off of our machines about who the user is and who's logged in
+      moreInfoUrl: https://docs.google.com/document/d/1qFYtMoKh3zyERLhbErJOEOo2me6Bc7KOOkjKn482Sqc/edit
+    - description: See what servers someone is logged-in on
+      moreInfoUrl: https://community.spiceworks.com/topic/138171-is-there-a-way-to-see-what-servers-someone-is-logged-in-on
+#  
+#  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗  ╦╔╗╔╦  ╦╔═╗╔╗╔╔╦╗╔═╗╦═╗╦ ╦
+#   ║║║╣ ╚╗╔╝║║  ║╣   ║║║║╚╗╔╝║╣ ║║║ ║ ║ ║╠╦╝╚╦╝
+#  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝  ╩╝╚╝ ╚╝ ╚═╝╝╚╝ ╩ ╚═╝╩╚═ ╩ 
+- industryName: Device inventory
+  description:  Includes a list of all devices and all hardware and software attributes for each device.
+  documentationUrl: https://fleetdm.com/docs/using-fleet/understanding-host-vitals
+  moreInfoUrl: https://github.com/fleetdm/fleet/issues/14415
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  usualDepartment: IT
+  productCategories: [Endpoint operations,Device management, Vulnerability management]
+  pricingTableCategories: [Devices]
+  waysToUse:
+    - description: Implement software inventory recommendations from the SANS 20 / CIS 18.
+      moreInfoUrl: https://docs.google.com/document/d/1E6EQMMqrsRc6Z3YsR6Q33OaF9eAa8zLNaz4K2YzFdyo/edit#heading=h.7en766pueek4
+    - description: View a list of all hardware attributes of a device.
+      moreInfoUrl: https://fleetdm.com/tables/system_info  
+    - description: View a list of all software and their versions installed on all your hosts.
+      moreInfoUrl: https://fleetdm.com/docs/get-started/anatomy#software-library
+    - description: View a list of software rolled up by title.
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/14674
+    - description: Implement hardware and infrastructure inventory recommendations from the SANS 20 / CIS 18.
+      moreInfoUrl: https://docs.google.com/document/d/1E6EQMMqrsRc6Z3YsR6Q33OaF9eAa8zLNaz4K2YzFdyo/edit#heading=h.7en766pueek4 
+#  
+#  ╔═╗╔═╗╔═╗╦═╗╔═╗╦ ╦  ╦╔╗╔╦  ╦╔═╗╔╗╔╔╦╗╔═╗╦═╗╦ ╦
+#  ╚═╗║╣ ╠═╣╠╦╝║  ╠═╣  ║║║║╚╗╔╝║╣ ║║║ ║ ║ ║╠╦╝╚╦╝
+#  ╚═╝╚═╝╩ ╩╩╚═╚═╝╩ ╩  ╩╝╚╝ ╚╝ ╚═╝╝╚╝ ╩ ╚═╝╩╚═ ╩ 
+- industryName: Search inventory
+  description: Search devices by IP, serial, hostname, and UUID.
+  documentationUrl: https://fleetdm.com/docs/using-fleet/learn-how-to-use-fleet#how-to-ask-questions-about-your-device
+  productCategories: [Endpoint operations,Device management]
+  pricingTableCategories: [Devices]
+  usualDepartment: IT
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+#  
+#  ╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╔═╗╔╦╗  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗  ╔═╗╔═╗╔═╗╔═╗╦╔╗╔╔═╗
+#   ║ ╠═╣╠╦╝║ ╦║╣  ║ ║╣  ║║   ║║║╣ ╚╗╔╝║║  ║╣   ╚═╗║  ║ ║╠═╝║║║║║ ╦
+#   ╩ ╩ ╩╩╚═╚═╝╚═╝ ╩ ╚═╝═╩╝  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝  ╚═╝╚═╝╚═╝╩  ╩╝╚╝╚═╝
+- industryName: Targeted device scoping
+  description: Organize devices with Teams and Labels.
+  documentationUrl: https://fleetdm.com/guides/managing-labels-in-fleet
+  tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  usualDepartment: IT
+  productCategories: [Device management]
+  pricingTableCategories: [Devices]      
+#  
+#  ╔═╗╔╗╔╔═╗╔═╗╦═╗╔═╗╔═╗  ╔╦╗╦╔═╗╦╔═  ╔═╗╔╗╔╔═╗╦═╗╦ ╦╔═╗╔╦╗╦╔═╗╔╗╔
+#  ║╣ ║║║╠╣ ║ ║╠╦╝║  ║╣    ║║║╚═╗╠╩╗  ║╣ ║║║║  ╠╦╝╚╦╝╠═╝ ║ ║║ ║║║║
+#  ╚═╝╝╚╝╚  ╚═╝╩╚═╚═╝╚═╝  ═╩╝╩╚═╝╩ ╩  ╚═╝╝╚╝╚═╝╩╚═ ╩ ╩   ╩ ╩╚═╝╝╚╝
+- industryName: Enforce disk encryption
+  description: Encrypt system drives on macOS and Windows computers, manage escrowed encryption keys, and report on disk encryption status (FileVault, BitLocker).
+  documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-disk-encryption
+  friendlyName: Ensure hard disks are encrypted
+  productCategories: [Device management]
+  pricingTableCategories: [Devices]
+  usualDepartment: Security
+  tier: Premium
+  jamfProHasFeature: appleOnly
+  jamfProtectHasFeature: no
+  waysToUse:
+    - description: Report on disk encryption status
+    - description: Encrypt hard disks on macOS with FileVault
+    - description: Escrow FileVault keys on macOS
+    - description: Encrypt hard disks on Windows with BitLocker.
+#  
+#  ╔═╗╔╗╔╔═╗╔═╗╦═╗╔═╗╔═╗  ╔═╗╔═╗╔═╗╦═╗╔═╗╔╦╗╦╔╗╔╔═╗  ╔═╗╦ ╦╔═╗╔╦╗╔═╗╔╦╗  ╦ ╦╔═╗╔╦╗╔═╗╔╦╗╔═╗╔═╗
+#  ║╣ ║║║╠╣ ║ ║╠╦╝║  ║╣   ║ ║╠═╝║╣ ╠╦╝╠═╣ ║ ║║║║║ ╦  ╚═╗╚╦╝╚═╗ ║ ║╣ ║║║  ║ ║╠═╝ ║║╠═╣ ║ ║╣ ╚═╗
+#  ╚═╝╝╚╝╚  ╚═╝╩╚═╚═╝╚═╝  ╚═╝╩  ╚═╝╩╚═╩ ╩ ╩ ╩╝╚╝╚═╝  ╚═╝ ╩ ╚═╝ ╩ ╚═╝╩ ╩  ╚═╝╩  ═╩╝╩ ╩ ╩ ╚═╝╚═╝
+- industryName: Enforce operating system (OS) updates
+  description: Keep operating systems up to date for macOS, iOS/iPadOS, Windows, and Android (coming soon) devices.
+  documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-macos-updates
+  tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: no
+  usualDepartment: IT
+  productCategories: [Device management,Vulnerability management]
+  pricingTableCategories: [Devices]
+  waysToUse:
+    - description: Enforce macOS updates via Nudge.
+    - description: Progressively enhance from Nudge to DDM-based OS updates.
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/17295
+    - description: Automatically update Windows after the end user reaches a deadline.
+#  
+#  ╔═╗╔╗╔╔═╗╔═╗╦═╗╔═╗╔═╗  ╔═╗╔═╗  ╔═╗╔═╗╔╦╗╔╦╗╦╔╗╔╔═╗╔═╗
+#  ║╣ ║║║╠╣ ║ ║╠╦╝║  ║╣   ║ ║╚═╗  ╚═╗║╣  ║  ║ ║║║║║ ╦╚═╗
+#  ╚═╝╝╚╝╚  ╚═╝╩╚═╚═╝╚═╝  ╚═╝╚═╝  ╚═╝╚═╝ ╩  ╩ ╩╝╚╝╚═╝╚═╝
+- industryName: Enforce OS settings
+  description: MDM support for macOS, iOS/iPadOS, Windows, and Android (coming soon) devices. Management support for Linux.
+  documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-custom-os-settings
+  usualDepartment: IT
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: no
+  waysToUse:
+    - description: Deploy configuration profiles on macOS and Windows and verify that they're installed.
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/13281
+    - description: Deploy custom declaration (DDM) profiles on macOS.
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/14550
+    - description: Target profiles to specific hosts using SQL.
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/17315
+    - description: Automatically re-deploy configuration profiles when they're not installed.
+    - description: Deploy configuration profiles on iOS/iPadOS.
+    - description: See a list of the upcoming MDM commands and scripts in unified queue. Coming soon (2024-07-15)
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/15920
+    - description: Send MDM commands to tell end users to update their OS.
+      moreInfoUrl: https://developer.apple.com/documentation/devicemanagement/schedule_an_os_update
+    - description: Configure agent options remotely, over the air.  (Includes osquery config, and osquery startup flags.).
+      moreInfoUrl: https://fleetdm.com/docs/configuration/agent-configuration
+  productCategories: [Device management]
+  pricingTableCategories: [Devices]
+#  
+#  ╔╦╗╔═╗╔═╗╦  ╔═╗╦═╗╔═╗╔╦╗╦╦  ╦╔═╗  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗  ╔╦╗╔═╗╔╗╔╔═╗╔═╗╔═╗╔╦╗╔═╗╔╗╔╔╦╗  
+#   ║║║╣ ║  ║  ╠═╣╠╦╝╠═╣ ║ ║╚╗╔╝║╣    ║║║╣ ╚╗╔╝║║  ║╣   ║║║╠═╣║║║╠═╣║ ╦║╣ ║║║║╣ ║║║ ║   
+#  ═╩╝╚═╝╚═╝╩═╝╩ ╩╩╚═╩ ╩ ╩ ╩ ╚╝ ╚═╝  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝  ╩ ╩╩ ╩╝╚╝╩ ╩╚═╝╚═╝╩ ╩╚═╝╝╚╝ ╩            
+- industryName: Declarative Device Management (DDM) support for configuration profiles
+  description: Full support for Apple DDM configuration profiles.
+  documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-os-updates#macos
+  tier: Free
+  jamfProHasFeature: cloudOnly
+  jamfProtectHasFeature: cloudOnly
+  usualDepartment: IT
+  productCategories: [Device management]
+  pricingTableCategories: [Devices]
 #
 #  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗  ╦ ╦╔═╗╔═╗╦ ╔╦╗╦ ╦
 #   ║║║╣ ╚╗╔╝║║  ║╣   ╠═╣║╣ ╠═╣║  ║ ╠═╣
@@ -8,8 +476,10 @@
   documentationUrl: https://fleetdm.com/docs/using-fleet/automations#automations
   screenshotSrc:
   tier: Free
+  jamfProHasFeature: no
+  jamfProtectHasFeature: yes
   productCategories: [Device management,Endpoint operations]
-  pricingTableCategories: [Device management,Endpoint operations]
+  pricingTableCategories: [Devices]
   usualDepartment: IT
   dri: mikermcneil
   demos:
@@ -32,19 +502,86 @@
       moreInfoUrl: https://cloud.google.com/beyondcorp
     - description: Get endpoint data into ServiceNow and make your asset management teams happy
       moreInfoUrl: https://www.youtube.com/watch?v=aVbU6_9JoM0
-- industryName: Maintenance windows
-  friendlyName: Fleet in your calendar
-  description: Create a calendar event to auto-remediate failing policies when your end users are free.
-  documentationUrl: https://github.com/fleetdm/fleet/issues/17230
+    - description: Monitor devices that don't meet your organization's custom security policies
+    - description: Quickly report your posture and vulnerabilities to auditors, showing remediation status and timing.
+    - description: Keep your devices compliant with customizable baselines, or use common benchmarks like CIS.
+    - description: Discover security misconfigurations that increase attack surface.
+    - description: Detect suspcious services listening on open ports that should not be connected to the internet, such as Remote Desktop Protocol (RDP).
+      moreInfoUrl: https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WHERE%20statename%20%3D%20%E2%80%9CEnabled%E2%80%9D-,OPEN%20SOCKETS,-Lastly%2C%20an%20examination
+    - description: Discover potentially unwanted programs that increase attack surface.
+      moreInfoUrl: https://paraflare.com/articles/vulnerability-management-via-osquery/
+    - description: Detect self-signed certifcates
+    - description: Detect legacy protocols with safer versions
+      moreInfoUrl: https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WHERE%20self_signed%20%3D%201%3B-,LEGACY%20PROTOCOLS,-This%20section%20will
+    - description: Detect exposed secrets on the command line
+      moreInfoUrl: https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WDigest%20is%20disabled.-,EXPOSED%20SECRETS,-Often%2C%20to%20create
+    - description: Detect and surface issues with devices
+    - description: Share device health reports
+    - description: Align endpoints with your security policies
+      moreInfoUrl: https://www.axonius.com/use-cases/cmdb-reconciliation
+    - description: Maximize security control coverage
+    - description: Uncover gaps in security policies, configurations, and hygiene
+      moreInfoUrl: https://www.axonius.com/use-cases/coverage-gap-discovery
+    - description: Automatically apply security policies to protect endpoints against attack.
+    - description: Surface security issues in all your deployed endpoints even data centers and factories.
+    - description: Continually validate controls and policies
+    - description: Block access to corporate apps if your end users are failing a specific number of critical policies.
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/16206       
+#  
+#  ╔═╗╔═╗╔═╗╦  ╦╔═╗╔═╗╔╦╗╦╔═╗╔╗╔  ╔╦╗╔═╗╔═╗╦  ╔═╗╦ ╦╔╦╗╔═╗╔╗╔╔╦╗
+#  ╠═╣╠═╝╠═╝║  ║║  ╠═╣ ║ ║║ ║║║║   ║║║╣ ╠═╝║  ║ ║╚╦╝║║║║╣ ║║║ ║ 
+#  ╩ ╩╩  ╩  ╩═╝╩╚═╝╩ ╩ ╩ ╩╚═╝╝╚╝  ═╩╝╚═╝╩  ╩═╝╚═╝ ╩ ╩ ╩╚═╝╝╚╝ ╩ 
+- industryName: Application deployment
+  description: Deploy applications and security agents on macOS, iOS/iPadOS, Linux, Windows, and Android (coming soon) devices. Additionally, install macOS and iOS/iPadOS apps from the App Store (coming soon).
   tier: Premium
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-- industryName: AI-generated descriptions
-  description: Use AI to explain why your security policies matter.
-  documentationUrl: https://github.com/fleetdm/fleet/issues/18187
-  tier: Free
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
+  jamfProHasFeature: appleOnly
+  jamfProtectHasFeature: no
+  isExperimental: yes
+  usualDepartment: IT
+  productCategories: [Device management]
+  pricingTableCategories: [Devices]
+  moreInfoUrl: https://github.com/fleetdm/fleet/issues/18867
+  waysToUse:
+   - description: Easily configure and install SentinelOne, Crowdstrike, and other security tools.
+     moreInfoUrl: https://github.com/fleetdm/fleet/issues/14921 
+   - description: Offer licenses for Photoshop and other App Sore apps for your end users.
+   - description: iOS/iPadOS coming soon (2024-08-11).
+     moreInfoUrl: https://github.com/fleetdm/fleet/issues/14899
+#  
+#  ╔═╗╔═╗╦  ╔═╗  ╔═╗╔═╗╦═╗╦  ╦╦╔═╗╔═╗  ╔═╗╔═╗╔═╗╦  ╦╔═╗╔═╗╔╦╗╦╔═╗╔╗╔  ╦╔╗╔╔═╗╔╦╗╔═╗╦  ╦  ╔═╗╔╦╗╦╔═╗╔╗╔                                   
+#  ╚═╗║╣ ║  ╠╣───╚═╗║╣ ╠╦╝╚╗╔╝║║  ║╣   ╠═╣╠═╝╠═╝║  ║║  ╠═╣ ║ ║║ ║║║║  ║║║║╚═╗ ║ ╠═╣║  ║  ╠═╣ ║ ║║ ║║║║                                   
+#  ╚═╝╚═╝╩═╝╚    ╚═╝╚═╝╩╚═ ╚╝ ╩╚═╝╚═╝  ╩ ╩╩  ╩  ╩═╝╩╚═╝╩ ╩ ╩ ╩╚═╝╝╚╝  ╩╝╚╝╚═╝ ╩ ╩ ╩╩═╝╩═╝╩ ╩ ╩ ╩╚═╝╝╚╝                                   
+- industryName: Self-service application installation
+  description: Allow end users to install apps through Fleet Desktop for macOS, Linux, and Windows.
+  tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: no
+  isExperimental: yes
+  usualDepartment: IT
+  productCategories: [Device management]
+  pricingTableCategories: [Devices]
+  moreInfoUrl: https://github.com/fleetdm/fleet/issues/17587
+  waysToUse:
+   - description: Build scripts for Ansible deployments
+     moreInfoUrl: https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4
+   - description: Deploy osquery to macOS via Jamf
+     moreInfoUrl: https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4
+   - description: Package osquery for Linux servers via Workspace One and Windows servers via group policies
+     moreInfoUrl: https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4
+#  
+#  ╔═╗╔═╗╔═╗╦  ╦╔═╗╔═╗╔╦╗╦╔═╗╔╗╔  ╔╦╗╔═╗╔╗╔╔═╗╔═╗╔═╗╔╦╗╔═╗╔╗╔╔╦╗
+#  ╠═╣╠═╝╠═╝║  ║║  ╠═╣ ║ ║║ ║║║║  ║║║╠═╣║║║╠═╣║ ╦║╣ ║║║║╣ ║║║ ║ 
+#  ╩ ╩╩  ╩  ╩═╝╩╚═╝╩ ╩ ╩ ╩╚═╝╝╚╝  ╩ ╩╩ ╩╝╚╝╩ ╩╚═╝╚═╝╩ ╩╚═╝╝╚╝ ╩ 
+- industryName: Application management
+  description: Manage updates and patches for apps on macOS, Windows, and Linux computers.
+  tier: Premium
+  jamfProHasFeature: appleOnly
+  jamfProtectHasFeature: no
+  comingSoonOn: 2024-08-25
+  usualDepartment: IT
+  productCategories: [Device management]
+  pricingTableCategories: [Devices]
+  moreInfoUrl: https://github.com/fleetdm/fleet/issues/18865
 #
 #  ╔═╗╔═╗╦═╗╦╔═╗╔╦╗  ╔═╗═╗ ╦╔═╗╔═╗╦ ╦╔╦╗╦╔═╗╔╗╔
 #  ╚═╗║  ╠╦╝║╠═╝ ║   ║╣ ╔╩╦╝║╣ ║  ║ ║ ║ ║║ ║║║║
@@ -54,10 +591,12 @@
   description: Deploy and execute custom scripts using a REST API, and manage your library of scripts in the UI or a git repo.
   documentationUrl: https://fleetdm.com/docs/using-fleet/scripts
   tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: no
   dri: mikermcneil
   usualDepartment: IT
   productCategories: [Endpoint operations,Device management]
-  pricingTableCategories: [Device management]
+  pricingTableCategories: [Devices]
   demos:
     - description: A large tech company used scripts to fix issues with their security and compliance agents on workstations.
   buzzwords: [Remote script execution,PowerShell scripts,Bash scripts]
@@ -76,117 +615,199 @@
       moreInfoUrl: https://scalefusion.com/custom-scripting
     - description: Run scripts on online/offline hosts
       moreInfoUrl: https://github.com/fleetdm/fleet/issues/15529
-#
-#  ╔═╗╦ ╦╔╦╗╔═╗╔╦╗╔═╗╔╦╗╦╔═╗  ╔═╗╔═╗╔═╗╔╦╗╦ ╦╦═╗╔═╗  ╔═╗╔═╗╔═╗╔═╗╔═╗╔═╗╔╦╗╔═╗╔╗╔╔╦╗
-#  ╠═╣║ ║ ║ ║ ║║║║╠═╣ ║ ║║    ╠═╝║ ║╚═╗ ║ ║ ║╠╦╝║╣   ╠═╣╚═╗╚═╗║╣ ╚═╗╚═╗║║║║╣ ║║║ ║
-#  ╩ ╩╚═╝ ╩ ╚═╝╩ ╩╩ ╩ ╩ ╩╚═╝  ╩  ╚═╝╚═╝ ╩ ╚═╝╩╚═╚═╝  ╩ ╩╚═╝╚═╝╚═╝╚═╝╚═╝╩ ╩╚═╝╝╚╝ ╩
-- industryName: Automatic posture assessment
-  friendlyName: Verify any security or compliance goal
-  description: Simplify security audits, build definitive reports, and discover + verify ongoing compliance for every endpoint, from workstations to data centers.
-  documentationUrl: https://fleetdm.com/docs/using-fleet/cis-benchmarks#cis-benchmarks
-  screenshotSrc:
-  usualDepartment: Security
-  tier: Free
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  dri: mikermcneil
-  demos:
-    - description: A large tech company used Fleet's CIS Benchmark policies to automatically assess posuture of 80,000 endpoints. 
-      quote:
-      moreInfoUrl: 
-  buzzwords: [Attack surface management (ASM),Endpoint hardening,Security posture,Cyber hygiene,Anomaly detection,Configuration management,Attack Surface Monitoring,Policy assessment]
+    - description: Only maintainers and admins can run scripts.
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/19055  
+#  
+#  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗  ╦═╗╔═╗╔╦╗╔═╗╔╦╗╦╔═╗╔╦╗╦╔═╗╔╗╔
+#   ║║║╣ ╚╗╔╝║║  ║╣   ╠╦╝║╣ ║║║║╣  ║║║╠═╣ ║ ║║ ║║║║
+#  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝  ╩╚═╚═╝╩ ╩╚═╝═╩╝╩╩ ╩ ╩ ╩╚═╝╝╚╝
+- industryName: Device remediation
+  description: Use Fleet Policies to detect the device state. Automate remediations for issues or allow users to remediate problems in self-service.
+  documentationUrl: https://fleetdm.com/securing/end-user-self-remediation # « NOTE: This link will change when auto-remediation is delivered.
+  tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: no
+  usualDepartment: IT
+  productCategories: [Device management, Vulnerability management]
+  pricingTableCategories: [Devices]
   waysToUse:
-    - description: Monitor devices that don't meet your organization's custom security policies
-    - description: Quickly report your posture and vulnerabilities to auditors, showing remediation status and timing.
-    - description: Keep your devices compliant with customizable baselines, or use common benchmarks like CIS.
-    - description: Discover security misconfigurations that increase attack surface.
-    - description: Detect suspcious services listening on open ports that should not be connected to the internet, such as Remote Desktop Protocol (RDP).
-      moreInfoUrl: https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WHERE%20statename%20%3D%20%E2%80%9CEnabled%E2%80%9D-,OPEN%20SOCKETS,-Lastly%2C%20an%20examination
-    - description: Discover potentially unwanted programs that increase attack surface.
-      moreInfoUrl: https://paraflare.com/articles/vulnerability-management-via-osquery/
-    - description: Detect self-signed certifcates
-    - description: Detect legacy protocols with safer versions
-      moreInfoUrl: https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WHERE%20self_signed%20%3D%201%3B-,LEGACY%20PROTOCOLS,-This%20section%20will
-    - description: Detect exposed secrets on the command line
-      moreInfoUrl: https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WDigest%20is%20disabled.-,EXPOSED%20SECRETS,-Often%2C%20to%20create
-    - description: Detect and surface issues with devices
-    - description: Share device health reports
-    - description: Align endpoints with your security policies
-      moreInfoUrl: https://www.axonius.com/use-cases/cmdb-reconciliation
-    - description: Maximize security control coverage
-    - description: Uncover gaps in security policies, configurations, and hygiene
-      moreInfoUrl: https://www.axonius.com/use-cases/coverage-gap-discovery
-    - description: Automatically apply security policies to protect endpoints against attack.
-    - description: Surface security issues in all your deployed endpoints even data centers and factories.
-    - description: Continually validate controls and policies
+    - description: Send software vulnerability emails to end users to encourage self-remediation.
 #
-#  ╦ ╦╦ ╦╔╦╗╔═╗╔╗╔   ╔═╗╔╗╔╔╦╗╔═╗╔═╗╦╔╗╔╔╦╗  ╔╦╗╔═╗╔═╗╔═╗╦╔╗╔╔═╗
-#  ╠═╣║ ║║║║╠═╣║║║───║╣ ║║║ ║║╠═╝║ ║║║║║ ║   ║║║╠═╣╠═╝╠═╝║║║║║ ╦
-#  ╩ ╩╚═╝╩ ╩╩ ╩╝╚╝   ╚═╝╝╚╝═╩╝╩  ╚═╝╩╝╚╝ ╩   ╩ ╩╩ ╩╩  ╩  ╩╝╚╝╚═╝
-- industryName: Human-endpoint mapping
-  friendlyName: See who logs in on every computer
-  description: Identify who logs in to any system, including login history and current sessions.  Look up any host by the email address of the person using it.
-  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#get-hosts-google-chrome-profiles
-  screenshotSrc:
+#  ╔╦╗╔═╗╦╔╗╔╔╦╗╔═╗╔╗╔╔═╗╔╗╔╔═╗╔═╗  ╦ ╦╦╔╗╔╔╦╗╔═╗╦ ╦╔═╗
+#  ║║║╠═╣║║║║ ║ ║╣ ║║║╠═╣║║║║  ║╣   ║║║║║║║ ║║║ ║║║║╚═╗
+#  ╩ ╩╩ ╩╩╝╚╝ ╩ ╚═╝╝╚╝╩ ╩╝╚╝╚═╝╚═╝  ╚╩╝╩╝╚╝═╩╝╚═╝╚╩╝╚═╝
+- industryName: Maintenance windows
+  friendlyName: Fleet in your calendar
+  description: Create a calendar event to auto-remediate failing policies when your end users are free.
+  documentationUrl: https://github.com/fleetdm/fleet/issues/17230
+  tier: Premium
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+  isExperimental: yes
+  productCategories: [Device management, Endpoint operations]
+  pricingTableCategories: [Devices]
+#  
+#  ╔═╗╔═╗╔╗╔╔╦╗  ╦  ╔═╗╔═╗╦╔═  ╔═╗╔╗╔╔╦╗  ╦ ╦╦╔═╗╔═╗  ╔═╗╔═╗╔╦╗╔╦╗╔═╗╔╗╔╔╦╗╔═╗
+#  ╚═╗║╣ ║║║ ║║  ║  ║ ║║  ╠╩╗  ╠═╣║║║ ║║  ║║║║╠═╝║╣   ║  ║ ║║║║║║║╠═╣║║║ ║║╚═╗
+#  ╚═╝╚═╝╝╚╝═╩╝  ╩═╝╚═╝╚═╝╩ ╩  ╩ ╩╝╚╝═╩╝  ╚╩╝╩╩  ╚═╝  ╚═╝╚═╝╩ ╩╩ ╩╩ ╩╝╚╝═╩╝╚═╝
+- industryName: Send lock and wipe commands
+  description: Secure your devices with remote lock and wipe commands if lost or stolen.
+  documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-commands
+  waysToUse:
+    - description: High-level remote lock for macOS, Windows, and Linux.
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/9949
+    - description: High-level remote wipe for macOS, Windows, and Linux.
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/9951
+  tier: Premium
+  jamfProHasFeature: appleOnly
+  jamfProtectHasFeature: no
+  usualDepartment: IT
+  productCategories: [Device management]
+  pricingTableCategories: [Devices]
+#  
+#
+#  ███████╗███╗   ██╗██████╗ ██████╗  ██████╗ ██╗███╗   ██╗████████╗               
+#  ██╔════╝████╗  ██║██╔══██╗██╔══██╗██╔═══██╗██║████╗  ██║╚══██╔══╝               
+#  █████╗  ██╔██╗ ██║██║  ██║██████╔╝██║   ██║██║██╔██╗ ██║   ██║                  
+#  ██╔══╝  ██║╚██╗██║██║  ██║██╔═══╝ ██║   ██║██║██║╚██╗██║   ██║                  
+#  ███████╗██║ ╚████║██████╔╝██║     ╚██████╔╝██║██║ ╚████║   ██║                  
+#  ╚══════╝╚═╝  ╚═══╝╚═════╝ ╚═╝      ╚═════╝ ╚═╝╚═╝  ╚═══╝   ╚═╝                  
+#                                                                                  
+#   ██████╗ ██████╗ ███████╗██████╗  █████╗ ████████╗██╗ ██████╗ ███╗   ██╗███████╗
+#  ██╔═══██╗██╔══██╗██╔════╝██╔══██╗██╔══██╗╚══██╔══╝██║██╔═══██╗████╗  ██║██╔════╝
+#  ██║   ██║██████╔╝█████╗  ██████╔╝███████║   ██║   ██║██║   ██║██╔██╗ ██║███████╗
+#  ██║   ██║██╔═══╝ ██╔══╝  ██╔══██╗██╔══██║   ██║   ██║██║   ██║██║╚██╗██║╚════██║
+#  ╚██████╔╝██║     ███████╗██║  ██║██║  ██║   ██║   ██║╚██████╔╝██║ ╚████║███████║
+#   ╚═════╝ ╚═╝     ╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝   ╚═╝   ╚═╝ ╚═════╝ ╚═╝  ╚═══╝╚══════╝
+#                                                                                  
+#
+#      
+#  ╔═╗ ╦ ╦╔═╗╦═╗╦╔═╗╔═╗ 
+#  ║═╬╗║ ║║╣ ╠╦╝║║╣ ╚═╗ 
+#  ╚═╝╚╚═╝╚═╝╩╚═╩╚═╝╚═╝                                                                                                                                                                                                          
+- industryName: Queries
+  description: Scheduled or saved queries with optional AI-generated descriptions, and, live queries for real-time data collection.  
+  documentationUrl: https://fleetdm.com/docs/using-fleet/fleet-ui
   tier: Free
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Devices]
   usualDepartment: IT
-  buzzwords: [Device users,human-to-device mapping]
-  dri: mikermcneil
   demos:
-    - description: Security engineers at a top gaming company wanted to get demographics off their macOS, Windows, and Linux machines about who the user is and who's logged in.
-      moreInfoUrl: https://docs.google.com/document/d/1qFYtMoKh3zyERLhbErJOEOo2me6Bc7KOOkjKn482Sqc/edit
-    - description: Data engineers at a top biotech corporation needed to know who is logged into their devices. 
-      quote: So we don't know exactly what's going on after we deploy the device, we know that they are compliant with the security because we are running these stuff, but we don't know certainly who is running, who is logging in the device?
-      moreInfoUrl: https://docs.google.com/document/d/17MNI5ykzlFjdVmQ8SPMrT1oR_hY_vkYAJx31F7l7Pv8/edit#heading=h.7en766pueek4 
+    - description: A top financial services company needed to set up rolling deployments for changes to osquery agents running on their production servers.
+      moreInfoUrl: https://docs.google.com/document/d/1UdzZMyBLbs9SUXfSXN2x2wZQCbjZZUetYlNWH6-ryqQ/edit#heading=h.2lh6ehprpvl6
+#
+#  ╔═╗ ╦ ╦╔═╗╦═╗╦ ╦  ╔═╗╔═╗╦═╗╔═╗╔═╗╦═╗╔╦╗╔═╗╔╗╔╔═╗╔═╗  ╔╦╗╔═╗╔╗╔╦╔╦╗╔═╗╦═╗╦╔╗╔╔═╗
+#  ║═╬╗║ ║║╣ ╠╦╝╚╦╝  ╠═╝║╣ ╠╦╝╠╣ ║ ║╠╦╝║║║╠═╣║║║║  ║╣   ║║║║ ║║║║║ ║ ║ ║╠╦╝║║║║║ ╦
+#  ╚═╝╚╚═╝╚═╝╩╚═ ╩   ╩  ╚═╝╩╚═╚  ╚═╝╩╚═╩ ╩╩ ╩╝╚╝╚═╝╚═╝  ╩ ╩╚═╝╝╚╝╩ ╩ ╚═╝╩╚═╩╝╚╝╚═╝
+- industryName: Query performance monitoring
+  documentationUrl: https://fleetdm.com/docs/get-started/faq#will-fleet-slow-down-my-servers-what-about-my-employee-laptops
+  tier: Free
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Devices]
+  demos:
+    - description: A top software company needed to understand the performance impact of osquery queries before running them on all of their production Linux servers.
+      moreInfoUrl: https://docs.google.com/document/d/1WzMc8GJCRU6tTBb6gLsSTzFysqtXO8CtP2sXMPKgYSk/edit?disco=AAAA6xuVxGg
+    - description: A top software company wanted to detect regressions when adding/changing queries and fail builds if queries were too expensive.
+      moreInfoUrl: https://docs.google.com/document/d/1WzMc8GJCRU6tTBb6gLsSTzFysqtXO8CtP2sXMPKgYSk/edit?disco=AAAA6xuVxGg
   waysToUse:
-    - description: Look up computer by ActiveDirectory account
-    - description: Find device by Google Chrome user
-    - description: Identify who logs in to any system, including login history and current sessions.
-    - description: Look up any host by the email address of the person using it.
-    - description: Check user login history
-      moreInfoUrl: https://www.lepide.com/how-to/audit-who-logged-into-a-computer-and-when.html#:~:text=To%20find%20out%20the%20details,logs%20in%20%E2%80%9CWindows%20Logs%E2%80%9D.
-    - description: See currently logged in users
-      moreInfoUrl: https://www.top-password.com/blog/see-currently-logged-in-users-in-windows/
-    - description: Get demographics off of our machines about who the user is and who's logged in
-      moreInfoUrl: https://docs.google.com/document/d/1qFYtMoKh3zyERLhbErJOEOo2me6Bc7KOOkjKn482Sqc/edit
-    - description: See what servers someone is logged-in on
-      moreInfoUrl: https://community.spiceworks.com/topic/138171-is-there-a-way-to-see-what-servers-someone-is-logged-in-on
-- industryName: Intrusion detection
-  friendlyName: Build custom query and policy automations to detect suspicious behavior
-  description: Send webhooks and ship logs to detect intrusions and issues with devices.
-  documentationUrl: https://fleetdm.com/docs/using-fleet/log-destinations
+    - description: Monitor performance for automated queries.
+    - description: Monitor performance for live queries.
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/467
+#  
+#  ╔═╗╦ ╦╔═╗╔╦╗╔═╗╔╦╗  ╔╦╗╔═╗╔╗ ╦  ╔═╗╔═╗
+#  ║  ║ ║╚═╗ ║ ║ ║║║║   ║ ╠═╣╠╩╗║  ║╣ ╚═╗
+#  ╚═╝╚═╝╚═╝ ╩ ╚═╝╩ ╩   ╩ ╩ ╩╚═╝╩═╝╚═╝╚═╝
+- industryName: Custom tables
+  friendlyName: Add tables to osquery with extensions
+  description: Create your own osquery tables, extensions & automatic table configurations or disable existing tables to maintain PII or privacy.
+  documentationUrl: https://fleetdm.com/docs/configuration/agent-configuration#extensions
+  moreInfoUrl: https://github.com/trailofbits/osquery-extensions/blob/3df2b72ad78549e25344c79dbc9bce6808c4d92a/README.md#extensions
+  tier: Premium
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Devices]
+  usualDepartment: IT
+# 
+#  ╦═╗╔═╗╔╦╗╔═╗╔╦╗╔═╗  ╔═╗╔═╗╔╦╗╔╦╗╦╔╗╔╔═╗╔═╗
+#  ╠╦╝║╣ ║║║║ ║ ║ ║╣   ╚═╗║╣  ║  ║ ║║║║║ ╦╚═╗
+#  ╩╚═╚═╝╩ ╩╚═╝ ╩ ╚═╝  ╚═╝╚═╝ ╩  ╩ ╩╝╚╝╚═╝╚═╝
+- industryName: Remote settings
+  description: Configure agent options remotely, over the air.  (Includes osquery config, and osquery startup flags.).
+  documentationUrl: https://fleetdm.com/docs/configuration/agent-configuration
+  moreInfoUrl: https://github.com/fleetdm/fleet/issues/13825
   tier: Free
-  usualDepartment: Security
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
   productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  buzzwords: [Host-based intrusion detection system (HIDS,Indicators of Compromise (IOCs),Feeder for SIEM]
+  pricingTableCategories: [Devices]
+  usualDepartment: Security
+#      
+#  ╔╦╗╔═╗╔═╗╔╦╗╔═╗
+#   ║ ║╣ ╠═╣║║║╚═╗
+#   ╩ ╚═╝╩ ╩╩ ╩╚═╝
+- industryName: Teams
+  friendlyName: Manage different endpoints differently
+  documentationUrl: https://fleetdm.com/docs/using-fleet/segment-hosts
+  description: Teams are what Fleet calls baselines, kinda like security groups or images. Every host in a team matches the same baseline, with minor exceptions. This makes it faster and less risky to maintain computers, leading to faster timelines and fewer tickets. #Enroll hosts into device groups ("teams") using different enrollment secrets and/or installers. Set baselines and strategies for hosts in different situations, and move hosts between them via API-driven automations or a simple, delegatable user interface with role-based access.
+  tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Devices]
+  waysToUse:
+    - description: Automate remediation for different applications with different security postures (cloud security engineering)
+#     
+#  ╦  ╔═╗╔╗ ╔═╗╦  ╔═╗
+#  ║  ╠═╣╠╩╗║╣ ║  ╚═╗
+#  ╩═╝╩ ╩╚═╝╚═╝╩═╝╚═╝
+- industryName: Labels
+  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#add-label
+  friendlyName: Filter hosts using SQL
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Devices]
+  usualDepartment: IT
+  tier: Free
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+#  
+#  ╔═╗╔═╗╦  ╦╔═╗╦╔═╗╔═╗ 
+#  ╠═╝║ ║║  ║║  ║║╣ ╚═╗ 
+#  ╩  ╚═╝╩═╝╩╚═╝╩╚═╝╚═╝                                                                                                                                                                                                          
+- industryName: Policies
+  description: A policy is a specific “yes” or “no” query. Use policies to manage security compliance in your organization.  
+  documentationUrl: https://fleetdm.com/docs/using-fleet/fleet-ui
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: no
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Devices]
+  usualDepartment: IT
   demos:
-    - description: A top media company wanted to share more security data with other departments without slowing down hosts.
+    - description: A top financial services company needed to set up rolling deployments for changes to osquery agents running on their production servers.
+      moreInfoUrl: https://docs.google.com/document/d/1UdzZMyBLbs9SUXfSXN2x2wZQCbjZZUetYlNWH6-ryqQ/edit#heading=h.2lh6ehprpvl6
   waysToUse:
-    - description: Send webhooks to generate alerts when an IOC is detected on one or more devices.
-    - description: Ship logs to Splunk, Snowflake, and other SIEMs to build a host-based intrusion detection system (HIDS).
-    - description: Synchronize live state of endpoints to a data lake or SIEM in a consistent shape.
-    - description: Export the data to other systems
-      moreInfoUrl: https://docs.google.com/document/d/1pE9U-1E4YDiy6h4TorszrTOiFAauFiORikSUFUqW7Pk/edit
-    - description: Export data to a third-party SIEM tool
-      moreInfoUrl: https://www.websense.com/content/support/library/web/hosted/admin_guide/siem_integration_explain.aspx
-    - description: Gather data and log events from endpoints
-      moreInfoUrl: https://techbeacon.com/security/how-osquery-can-lift-your-security-teams-game#:~:text=%22If%20security%20teams%20didn%27t%20have%20osquery%2C%20they%20would%20have%20to%20find%20a%20way%20to%20manually%20go%20into%20each%20endpoint%20and%20gather%20data%2C%20or%20buy%20a%20third%2Dparty%20tool%20to%20do%20that%20for%20them
-#
-#  ╔═╗╦╔╦╗
-#  ╠╣ ║║║║
-#  ╚  ╩╩ ╩
+    - description: Trigger a workflow based on a failing policy
+      moreInfoUrl: https://fleetdm.com/docs/using-fleet/automations#policy-automations
+#
+#  ╔═╗╦╦  ╔═╗  ╦╔╗╔╔╦╗╔═╗╔═╗╦═╗╦╔╦╗╦ ╦  ╔╦╗╔═╗╔╗╔╦╔╦╗╔═╗╦═╗╦╔╗╔╔═╗
+#  ╠╣ ║║  ║╣   ║║║║ ║ ║╣ ║ ╦╠╦╝║ ║ ╚╦╝  ║║║║ ║║║║║ ║ ║ ║╠╦╝║║║║║ ╦
+#  ╚  ╩╩═╝╚═╝  ╩╝╚╝ ╩ ╚═╝╚═╝╩╚═╩ ╩  ╩   ╩ ╩╚═╝╝╚╝╩ ╩ ╚═╝╩╚═╩╝╚╝╚═╝
 - industryName: File integrity monitoring (FIM) # Short industry phrase
   friendlyName: Detect changes to critical files # Short, Fleet one-liner for the feature, written in the imperative mood.  (If easy to do, base this off of the words that an actual customer is saying.)
   description: Specify files to monitor for changes or deletions, then log those events to your SIEM or data lake, including key information such as filepath and checksum. # Clear Mr. Rogers description
   documentationUrl: https://fleetdm.com/guides/osquery-evented-tables-overview#file-integrity-monitoring-fim # URL of the single-best page within the docs which serves as a "jumping-off point" for this feature.
   screenshotSrc: "" # A screenshot of the single, best, simplifying, obvious example 
   tier: Free # Either "Free" or "Premium"
+  jamfProHasFeature: no
+  jamfProtectHasFeature: yes
   usualDepartment: Security # or omit if there isn't a particular departmental leaning we've noticed
   productCategories: [Endpoint operations] # or omit if this isn't associated with a single product category
-  pricingTableCategories: [Endpoint operations]
+  pricingTableCategories: [Devices]
   dri: mikermcneil #GitHub user name
   demos:
     - description: A top gaming company needed a way to monitor critical files on production Debian servers.
@@ -203,93 +824,34 @@
       moreInfoUrl: https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring
     - description: Meet compliance mandates
       moreInfoUrl: https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring
-#  ╔╦╗╔═╗╦  ╦ ╦╔═╗╦═╗╔═╗  ╔╦╗╔═╗╔╦╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔  ┌─╦ ╦╔═╗╦═╗╔═╗─┐
-#  ║║║╠═╣║  ║║║╠═╣╠╦╝║╣    ║║║╣  ║ ║╣ ║   ║ ║║ ║║║║  │ ╚╦╝╠═╣╠╦╝╠═╣ │
-#  ╩ ╩╩ ╩╩═╝╚╩╝╩ ╩╩╚═╚═╝  ═╩╝╚═╝ ╩ ╚═╝╚═╝ ╩ ╩╚═╝╝╚╝  └─ ╩ ╩ ╩╩╚═╩ ╩─┘
-- industryName: Malware detection (YARA/custom IoCs)  # TODO: consider: technically more than YARA, consider generalizing this and including the concept of comparing known binary hashes and other IoCs (either via live query or in the data lake to compare threat intel feed)
-  friendlyName: Scan files for zero days and malware signatures
-  description: Use YARA signatures to report and trigger automations when zero days, malware, or unexpected files are detected on a host.
-  documentationUrl: https://fleetdm.com/tables/yara
-  tier: Free
-  dri: mikermcneil
-  usualDepartment: Security
-  productCategories: [Endpoint operations,Vulnerability management]
-  pricingTableCategories: [Endpoint operations,Vulnerability management]
-  buzzwords: [YARA scanning,Cyber Threat Intelligence (CTI),Indicators of compromise (IOCs),Antivirus (AV),Endpoint protection platform (EPP),Endpoint detection and response (EDR),Malware detection,Signature-based malware detection,Malware scanning,Malware analysis,Anomaly detection]
-  demos:
-    - description: A top media company used Fleet policies with YARA rules to continuously scan host filesystems for malware signatures provided by internal and external threat intelligence teams.
-      moreInfoUrl: # short demo video
-  waysToUse:
-    - description: Detect suspicious bytecode in JAR files
-    - description: Identify suspicious patterns in binaries using YARA signatures  # (≈regular expressions for binary)
-    - description: Continuously scan host filesystems for malware signatures.
-      moreInfoUrl: https://yara.readthedocs.io/en/stable/writingrules.html
-    - description: Monitor for relevent filesystem changes (YARA events) and on-demand YARA signature scans.
-      moreInfoUrl: https://osquery.readthedocs.io/en/stable/deployment/yara/
-    - description: Use YARA for malware detection
-      moreInfoUrl: https://www.cisa.gov/sites/default/files/FactSheets/NCCIC%20ICS_FactSheet_YARA_S508C.pdf
-    - description: Scan for indicators of compromise (IoC) for common malware.
-      moreInfoUrl: https://github.com/Cisco-Talos/osquery_queries
-    - description: Analyze malware using data from osquery, such as endpoint certificates and launch daemons (launchd).
-      moreInfoUrl: https://medium.com/hackernoon/malware-analysis-using-osquery-part-3-9dc805b67d16
-    - description: Detect persistent malware (e.g. WireLurker) in endpoints by generating simple policies that search for their static indicators of compromise (IoCs).
-      moreInfoUrl: https://osquery.readthedocs.io/en/stable/deployment/anomaly-detection/
-    - description: Run a targeted YARA scan with osquery as a lightweight approach to scan anything on a host filesystem, with minimal performance impact.  Unlike full system YARA scans which consume considerable CPU resources, an equivalent YARA scan targeted in Fleet can be 8x cheaper (CPU %).
-      moreInfoUrl: https://www.tripwire.com/state-of-security/signature-socket-based-malware-detection-osquery-yara
-- industryName: Detection engineering
-  friendlyName: # Ship logs to your data lake and comopare with known bad binary hashes or capture behavioral data and build custom detections (e.g. using a framework like MITRE)
-  description: 
-  documentationUrl: https://fleetdm.com/docs/using-fleet/log-destinations
-  tier: Free
-  dri: mikermcneil
-  usualDepartment: Security
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  buzzwords: [Security analytics,Behavioral analytics,MITRE ATT&CK,Tactics techniques and procedures (TTPs),Security information and event management (SIEM)]
-  demos:
-    - description: 
-      moreInfoUrl: 
-  waysToUse:
-    - description: 
-- industryName: Threat hunting
-  friendlyName: # TODO: live query
-  description: 
-  documentationUrl: https://fleetdm.com/queries
-  tier: Free
-  dri: mikermcneil
-  usualDepartment: Security
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  buzzwords: []
-  demos:
-    - description: 
-      moreInfoUrl: 
-  waysToUse:
-    - description: 
-- industryName: Incident response
-  friendlyName: Interrogate hosts in real time
-  description: Live query, triage, figuring out scope of impact, remediate using scripts or MDM commands (e.g. remote wipe), and quarantine or reimage using other systems and APIs (e.g. remove from network, decommission container)
-  documentationUrl: https://fleetdm.com/securing/how-osquery-can-help-cyber-responders#simplifying-endpoint-visibility-with-osquery-and-fleet
+#  
+#  ╔═╗╦╦  ╔═╗  ╔═╗╔═╗╦═╗╦  ╦╦╔╗╔╔═╗
+#  ╠╣ ║║  ║╣   ║  ╠═╣╠╦╝╚╗╔╝║║║║║ ╦
+#  ╚  ╩╩═╝╚═╝  ╚═╝╩ ╩╩╚═ ╚╝ ╩╝╚╝╚═╝
+- industryName: File carving
+  description: Write the results of complex queries to AWS S3.
+  documentationUrl: https://fleetdm.com/docs/configuration/fleet-server-configuration#s-3-file-carving-backend
   tier: Free
-  dri: mikermcneil
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
   usualDepartment: Security
   productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  buzzwords: []
-  demos:
-    - description: 
-      moreInfoUrl: 
-  waysToUse:
-    - description: 
+  pricingTableCategories: [Devices]           
+#
+#  ╔╗ ╦╔╗╔╔═╗╦═╗╦ ╦  ╔═╗╦ ╦╔╦╗╦ ╦╔═╗╦═╗╦╔═╗╔═╗╔╦╗╦╔═╗╔╗╔
+#  ╠╩╗║║║║╠═╣╠╦╝╚╦╝  ╠═╣║ ║ ║ ╠═╣║ ║╠╦╝║╔═╝╠═╣ ║ ║║ ║║║║
+#  ╚═╝╩╝╚╝╩ ╩╩╚═ ╩   ╩ ╩╚═╝ ╩ ╩ ╩╚═╝╩╚═╩╚═╝╩ ╩ ╩ ╩╚═╝╝╚╝
 - industryName: Binary authorization
   friendlyName: Restrict what programs can run, and what files running programs can access.
   description: 
   documentationUrl: 
   tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
   dri: mikermcneil
   usualDepartment: Security
   productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
+  pricingTableCategories: [Devices]
   comingSoonOn: 2025-06-30
   buzzwords: [Mandatory Access Control (MAC),Privilege confinement,Binary authorization,Santa,Binary allowlisting,Binary whitelisting]
   demos:
@@ -302,555 +864,119 @@
     - description: Confine programs according to a set of rules that specify which files a program can access.
       moreInfoUrl: https://wiki.debian.org/AppArmor
     - description: Proactively protect the system against both known and unknown vulnerabilities.
-#  ╔═╗╔═╗╔═╗╔╗╔╔╦╗  ╔═╗╦ ╦╔╦╗╔═╗   ╦ ╦╔═╗╔╦╗╔═╗╔╦╗╔═╗
-#  ╠═╣║ ╦║╣ ║║║ ║   ╠═╣║ ║ ║ ║ ║───║ ║╠═╝ ║║╠═╣ ║ ║╣
-#  ╩ ╩╚═╝╚═╝╝╚╝ ╩   ╩ ╩╚═╝ ╩ ╚═╝   ╚═╝╩  ═╩╝╩ ╩ ╩ ╚═╝
-- industryName: Agent auto-update
-  friendlyName: Keep agents and extensions up to date
-  descrption: Keep agents and extensions up to date by loading code from Fleet's free update registry.
-  documentationUrl: https://fleetdm.com/docs/using-fleet/enroll-hosts
-  tier: Free
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-#  ╦╔╗╔╔═╗╔╦╗╔═╗╦  ╦  ╔═╗╦═╗╔═╗
-#  ║║║║╚═╗ ║ ╠═╣║  ║  ║╣ ╠╦╝╚═╗
-#  ╩╝╚╝╚═╝ ╩ ╩ ╩╩═╝╩═╝╚═╝╩╚═╚═╝
-- industryName: Installers (self-service)
-  tier: Free
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  documentationUrl: https://fleetdm.com/docs/using-fleet/enroll-hosts
-  waysToUse:
-    - description: Build scripts for Ansible deployments
-      moreInfoUrl: https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4
-    - description: Deploy osquery to macOS via Jamf
-      moreInfoUrl: https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4
-    - description: Package osquery for Linux servers via Workspace One and Windows servers via group policies
-      moreInfoUrl: https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4
-#  ╔╗ ╔═╗╔╦╗╔═╗╦ ╦  ╦╔╗╔╔═╗╔╦╗╔═╗╦  ╦  ╔═╗╔╦╗╦╔═╗╔╗╔
-#  ╠╩╗╠═╣ ║ ║  ╠═╣  ║║║║╚═╗ ║ ╠═╣║  ║  ╠═╣ ║ ║║ ║║║║
-#  ╚═╝╩ ╩ ╩ ╚═╝╩ ╩  ╩╝╚╝╚═╝ ╩ ╩ ╩╩═╝╩═╝╩ ╩ ╩ ╩╚═╝╝╚╝
-- industryName: Batch installation (Chef, Ansible, Puppet, MDM)
-  friendlyName: Install agents over the air
-  documentationUrl: https://fleetdm.com/docs/using-fleet/enroll-hosts
-  tier: Free
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-#  ╦═╗╔═╗╔╦╗╔═╗╔╦╗╔═╗  ╔═╗╔═╗╔╦╗╔╦╗╦╔╗╔╔═╗╔═╗
-#  ╠╦╝║╣ ║║║║ ║ ║ ║╣   ╚═╗║╣  ║  ║ ║║║║║ ╦╚═╗
-#  ╩╚═╚═╝╩ ╩╚═╝ ╩ ╚═╝  ╚═╝╚═╝ ╩  ╩ ╩╝╚╝╚═╝╚═╝
-- industryName: Remote settings
-  description: Configure agent options remotely, over the air.  (Includes osquery config, and osquery startup flags.).
-  documentationUrl: https://fleetdm.com/docs/configuration/agent-configuration
-  moreInfoUrl: https://github.com/fleetdm/fleet/issues/13825
-  tier: Free
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: Security
-#  ╦  ╦╔═╗╦═╗╦╔═╗╔╗ ╦  ╔═╗  ╔═╗╔╗╔╦═╗╔═╗╦  ╦  ╔╦╗╔═╗╔╗╔╔╦╗
-#  ╚╗╔╝╠═╣╠╦╝║╠═╣╠╩╗║  ║╣   ║╣ ║║║╠╦╝║ ║║  ║  ║║║║╣ ║║║ ║
-#   ╚╝ ╩ ╩╩╚═╩╩ ╩╚═╝╩═╝╚═╝  ╚═╝╝╚╝╩╚═╚═╝╩═╝╩═╝╩ ╩╚═╝╝╚╝ ╩
-- industryName: Variable enrollment
-  description: Enroll hosts in different groups using different enrollment secrets and/or installers per-baseline.
-  documentationUrl: https://fleetdm.com/docs/using-fleet/segment-hosts
-  tier: Premium
-  productCategories: [Endpoint operations, Device management]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-#  ╔═╗╦═╗╦╦  ╦╔═╗╔╦╗╔═╗  ╦ ╦╔═╗╔╦╗╔═╗╔╦╗╔═╗  ╦═╗╔═╗╔═╗╦╔═╗╔╦╗╦═╗╦ ╦
-#  ╠═╝╠╦╝║╚╗╔╝╠═╣ ║ ║╣   ║ ║╠═╝ ║║╠═╣ ║ ║╣   ╠╦╝║╣ ║ ╦║╚═╗ ║ ╠╦╝╚╦╝
-#  ╩  ╩╚═╩ ╚╝ ╩ ╩ ╩ ╚═╝  ╚═╝╩  ═╩╝╩ ╩ ╩ ╚═╝  ╩╚═╚═╝╚═╝╩╚═╝ ╩ ╩╚═ ╩
-- industryName: Private update registry
-  friendlyName: Update agents from a secret URL
-  description: Load agent code from a secret URL that you manage.
-  documentationUrl: https://fleetdm.com/docs/using-fleet/update-agents
-  tier: Premium
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: Security
-- industryName: Variable agent versions
-  descrption: Manage agents remotely by setting different versions per-baseline.
-  documentationUrl: https://fleetdm.com/docs/configuration/agent-configuration#configure-fleetd-update-channels
-  tier: Premium
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
+#  
+#  ╦═╗╔═╗╔═╗╔═╗╦═╗╔╦╗╦╔╗╔╔═╗  
+#  ╠╦╝║╣ ╠═╝║ ║╠╦╝ ║ ║║║║║ ╦   
+#  ╩╚═╚═╝╩  ╚═╝╩╚═ ╩ ╩╝╚╝╚═╝                                                                                                                                                                                                               
+- industryName: Reporting
+  description: Generate reports based on searchable device attributes
+  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#get-query-report
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Devices]
   usualDepartment: IT
-#  ╔═╗╦ ╦╔═╗╔╦╗╔═╗╔╦╗  ╔╦╗╔═╗╔╗ ╦  ╔═╗╔═╗
-#  ║  ║ ║╚═╗ ║ ║ ║║║║   ║ ╠═╣╠╩╗║  ║╣ ╚═╗
-#  ╚═╝╚═╝╚═╝ ╩ ╚═╝╩ ╩   ╩ ╩ ╩╚═╝╩═╝╚═╝╚═╝
-- industryName: Custom tables
-  friendlyName: Add tables to osquery with extensions
-  description: Install osquery extensions over the air. #  (GitOptional)
-  documentationUrl: https://fleetdm.com/docs/configuration/agent-configuration#extensions
-  moreInfoUrl: https://github.com/trailofbits/osquery-extensions/blob/3df2b72ad78549e25344c79dbc9bce6808c4d92a/README.md#extensions
   tier: Premium
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
 #
-#  ╦═╗╔═╗╔═╗╔╦╗  ╔═╗╔═╗╦
-#  ╠╦╝║╣ ╚═╗ ║   ╠═╣╠═╝║
-#  ╩╚═╚═╝╚═╝ ╩   ╩ ╩╩  ╩
-- industryName: REST API
-  friendlyName: Automate any feature
-  description: 
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Integrations]
-  usualDepartment: IT
-  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api 
-  screenshotSrc:
-  tier: Free
-  dri: rachaelshaw
-#  ╔═╗╔═╗╔╦╗╔╦╗╔═╗╔╗╔╔╦╗  ╦  ╦╔╗╔╔═╗  ╔╦╗╔═╗╔═╗╦    ┌─  ╔═╗╦  ╦  ─┐
-#  ║  ║ ║║║║║║║╠═╣║║║ ║║  ║  ║║║║║╣    ║ ║ ║║ ║║    │   ║  ║  ║   │
-#  ╚═╝╚═╝╩ ╩╩ ╩╩ ╩╝╚╝═╩╝  ╩═╝╩╝╚╝╚═╝   ╩ ╚═╝╚═╝╩═╝  └─  ╚═╝╩═╝╩  ─┘
-- industryName: Command line tool (CLI)
-  friendlyName: fleetctl
-  documentationUrl: https://fleetdm.com/docs/using-fleet/fleetctl-cli
-  productCategories: [Endpoint operations,Device management]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  tier: Free
-#  ╦ ╦╔═╗╔╗ ╦ ╦╔═╗╔═╗╦╔═╔═╗
-#  ║║║║╣ ╠╩╗╠═╣║ ║║ ║╠╩╗╚═╗
-#  ╚╩╝╚═╝╚═╝╩ ╩╚═╝╚═╝╩ ╩╚═╝
-- industryName: Webhooks
-  friendlyName: Automations
-  documentationUrl: https://fleetdm.com/docs/using-fleet/automations#automations
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Integrations]
-  usualDepartment: IT 
-  tier: Free
-#  ╔╦╗╔═╗╔═╗╔═╗  ╔═╗╦ ╦╔╦╗╔═╗╔╦╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
-#   ║║║╣ ║╣ ╠═╝  ╠═╣║ ║ ║ ║ ║║║║╠═╣ ║ ║║ ║║║║╚═╗
-#  ═╩╝╚═╝╚═╝╩    ╩ ╩╚═╝ ╩ ╚═╝╩ ╩╩ ╩ ╩ ╩╚═╝╝╚╝╚═╝
-- industryName: Deep automations
-  friendlyName: Trigger webhooks or run scripts
-  documentationUrl: https://fleetdm.com/docs/using-fleet/automations#automations
-  description: Fire off webhooks or run scripts on hosts when certain things happen in Fleet.
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Integrations]
-  comingSoonOn: 2024-06-30
-  tier: Free
-  buzzwords: [Automated remediation,Auto-remediation,Self-healing]
-  waysToUse:
-    - description: Use policy automations to automatically remediate issues and mitigate vulnerabilities.
-    - description: Use osquery and santa to work around inflexibilities in proprietary MDMs and other protection solutions.
-    - description: Listen to webhooks to perform autonomous self-healing (cloud security engineering)
-      moreInfoUrl: https://www.fugue.co/blog/automated-remediation-scripts-vs.-self-healing-infrastructure-two-approaches-to-cloud-security
-#  ╔═╗╦╔╦╗╔═╗╔═╗╔═╗
-#  ║ ╦║ ║ ║ ║╠═╝╚═╗
-#  ╚═╝╩ ╩ ╚═╝╩  ╚═╝
-- industryName: GitOps
-  friendlyName: Manage endpoints in git
-  documentationUrl: https://github.com/fleetdm/fleet-gitops
-  description: Fork the best practices repo and use the GitHub Action to hook it up to your Fleet instance in minutes.
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Deployment]
-  usualDepartment: IT
-  tier: Free
-  demos:
-    description: A top savings and investment company wanted workflows and automation so that one bad actor can't brick their fleet.  This way, they have to make a pull request first.
-    quote: I don't want one bad actor to brick my fleet.  I want them to make a pull request first.
-    moreInfoUrl: https://docs.google.com/document/d/1hAQL6P--Tt3syq1MTRONAxhQA_2Vjt3oOJJt_O4xbiE/edit?disco=AAABAVnYvns&usp_dm=true#heading=h.7en766pueek4
-  #  ╔═╗╦═╗╔═╗╔═╗  ╦╔╗╔╔╦╗╔═╗╔═╗╦═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
-  #  ╠╣ ╠╦╝║╣ ║╣   ║║║║ ║ ║╣ ║ ╦╠╦╝╠═╣ ║ ║║ ║║║║╚═╗
-  #  ╚  ╩╚═╚═╝╚═╝  ╩╝╚╝ ╩ ╚═╝╚═╝╩╚═╩ ╩ ╩ ╩╚═╝╝╚╝╚═╝
-- industryName: Free integrations (Tines, Snowflake, Terraform, Chronicle, Jira, Zendesk, etc)
-  friendlyName: Borrow off-the-shelf tactics from the community
-  documentationUrl: https://fleetdm.com/integrations
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Integrations]
-  usualDepartment: IT
-  description:
-  moreInfoUrl: https://fleetdm.com/integrations
-  tier: Free
-  waysToUse:
-    - description: (ActiveDirectory) Know who opened your computer and check their device posture before you let them log into anything.
-    - description: (Ansible) Easily issue MDM commands and standardize data across operating systems.
-    - description: (AWS) Deploy your own self-managed Fleet in any AWS environment in minutes.
-    - description: (Azure) Deploy your own self-managed Fleet in the Microsoft Cloud in minutes.
-    - description: (Chef) Easily issue MDM commands and standardize data across operating systems.
-    - description: (Elastic) Ingest osquery data and monitor for important changes or events.
-    - description: (GitHub) Version control using git, enabling collaboration and a GitOps workflow.
-    - description: (GitLab) Version control using git, enabling collaboration and a GitOps workflow.
-    - description: (Chronicle) Ingest osquery data and monitor for important changes or events.
-    - description: (Google Cloud) Deploy your own self-managed Fleet in any GCP environment in minutes.
-    - description: (Munki) Easily issue MDM commands and standardize data across operating systems.
-    - description: (Okta) Know who opened your computer and check their device posture before you let them log into anything.
-    - description: (Snowflake) Ingest osquery data and monitor for important changes or events.
-    - description: (Splunk) Ingest osquery data and monitor for important changes or events.
-    - description: (Tines) Build custom workflows that trigger in various situations.
-    - description: (Webhooks) Configure automations that send webhooks to specific URLs when Fleet detects changes to host, policy, and CVE statuses.
-    - description: (Zendesk) Automatically create Zendesk tickets in various situations.
-    - description: (Jira) Automatically create Jira tickets in various situations, including exporting vulnerabilities to Jira and syncing tickets.
-  buzzwords: [Snowflake,Okta,Tines,Splunk,Elastic,AWS,ActiveDirectory,Ansible,GitHub,GitLab,Chronicle,Google Cloud,Munki,Vanta,Chef,Zendesk,Jira]
-  #  ╔═╗╦═╗╔═╗╔╦╗╦╦ ╦╔╦╗  ╦╔╗╔╔╦╗╔═╗╔═╗╦═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
-  #  ╠═╝╠╦╝║╣ ║║║║║ ║║║║  ║║║║ ║ ║╣ ║ ╦╠╦╝╠═╣ ║ ║║ ║║║║╚═╗
-  #  ╩  ╩╚═╚═╝╩ ╩╩╚═╝╩ ╩  ╩╝╚╝ ╩ ╚═╝╚═╝╩╚═╩ ╩ ╩ ╩╚═╝╝╚╝╚═╝
-- industryName: Premium integrations (Puppet, Vanta, etc)
-  friendlyName: Borrow off-the-shelf tactics from legendary brands
-  documentationUrl: https://fleetdm.com/integrations
-  description: Plug Fleet into other frameworks and tools.
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Integrations]
-  usualDepartment: IT
-  moreInfoUrl: https://fleetdm.com/integrations
-  tier: Premium
-  waysToUse:
-    - description: (Vanta) Trigger a workflow based on a failing policy.
-    - description: (Puppet) Easily issue MDM commands, standardize data across operating systems, and map macOS+Windows settings to computers with the Puppet module.
-    - description: (Torq) Build custom workflows that trigger in various situations.
-    - description: (Custom IdP) Manage access to Fleet single sign-on (SSO) through any IdP (using SAML).
-  buzzwords: [Vanta,Puppet,Custom IdP]
-- industryName: Public issue tracker (GitHub)
-  documentationUrl: https://fleetdm.com/support
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Support]
-  tier: Free
-- industryName: Community Slack channel
-  documentationUrl: https://fleetdm.com/support
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Support]
-  tier: Free
-- industryName: Unlimited email support (confidential)
-  documentationUrl: https://fleetdm.com/support
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Support]
-  tier: Premium
-- industryName: Phone and video call support
-  documentationUrl: https://fleetdm.com/support
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Support]
-  tier: Premium
-- industryName: Self-managed
-  friendlyName: Host it yourself
-  description: Deploy Fleet anywhere and host it yourself, even in air-gapped environments except where technologically impossible.
-  pricingTableCategories: [Deployment]
-  documentationUrl: https://fleetdm.com/docs/deploy/introduction
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  tier: Free
-  buzzwords: [Self-hosted]
-- industryName: Deployment tools (Terraform, Helm)
-  documentationUrl: https://fleetdm.com/docs/deploy/introduction
-  usualDepartment: IT
-  tier: Free
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Deployment]
-- industryName: Managed Cloud (700+ hosts)
-  description: Have Fleet host it for you (currently only available for customers with 700+ hosts.  PS. Wish we could host for you?  We're working on it!  Please let us know if you know of a good partner.  In the meantime, join fleetdm.com/support and we're happy to help you deploy Fleet yourself.)
-  pricingTableCategories: [Deployment]
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  tier: Premium
-- industryName: Interactive MDM migration #   « end-user initiated MDM migration, with interactive UI
-  tier: Premium
-  documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-migration-guide#migrate-automatically-enrolled-dep-hosts
-  usualDepartment: IT
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
-- industryName: Remotely enforce OS settings
-  documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-custom-os-settings
-  usualDepartment: IT
-  tier: Free
-  waysToUse:
-    - description: Deploy configuration profiles on macOS and Windows and verify that they're installed.
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/13281
-    - description: Deploy custom declaration (DDM) profiles on macOS.
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/14550
-    - description: Target profiles to specific hosts using SQL. Exclusions coming soon (2024-07-15) #customer-rosner
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/17315
-    - description: Automatically re-deploy configuration profiles when they're not installed.
-    - description: Deploy configuration profiles on iOS/iPadOS. Coming soon (2024-07-15).
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
-- industryName: Self service
-  description: Provide resolution instructions for end users through Fleet Desktop that suggest how an end user can fix a posture issue themselves.
-  documentationUrl: https://fleetdm.com/docs/using-fleet/fleet-desktop
-  tier: Premium
-  usualDepartment: IT
-  productCategories: [Device management, Vulnerability management]
-  pricingTableCategories: [Device management]
-  waysToUse:
-    - description: Send software vulnerability emails to end users to encourage self-remediation.
-- industryName: User-initiated enrollment of macOS computers
-  documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-migration-guide#migrate-manually-enrolled-hosts
-  tier: Free
-  usualDepartment: IT
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
-  waysToUse:
-    - description: Support ACME as a protocol for MDM certificate generation. Coming soon (2024-12-31) #customer-rosner
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/15611 
-- industryName: Low-level MDM commands for macOS, iOS/iPadOS*, and Windows (e.g. remote restart)
-  documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-commands
-  tier: Free
-  usualDepartment: IT
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
-  waysToUse:
-    - description: See a list of the upcoming MDM commands and scripts in unified queue. Coming soon (2024-07-15)
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/15920
-    - description: MDM commands for iOS/iPadOS are coming soon (2024-07-15).
-- industryName: Native macOS update reminders
-  description: Send low-level MDM commands to tell end users to update their OS.
-  moreInfoUrl: https://developer.apple.com/documentation/devicemanagement/schedule_an_os_update
-  tier: Free
-  usualDepartment: IT
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
-- industryName: Zero-touch setup for macOS, iOS/iPadOS*, and Windows
-  documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-macos-setup-experience
-  tier: Premium
-  usualDepartment: IT
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
-  waysToUse:
-    - description: Zero-touch for iOS/iPadOS is coming soon (2024-07-15).
-    - description: Ship a macOS workstation to the end user's home and have them automatically enroll to Fleet during out-of-the-box setup.
-    - description: Ship a Windows workstation to the end user's home and have them automatically enroll to Fleet during out-of-the-box setup.
-    - description: Customize the out-of-the-box setup experience for your end users.
-    - description: Require end users to authenticate with your identity provider (IdP) and agree to an end user license agreement (EULA) before they can use their new workstation
-- industryName: Enforce OS updates
-  documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-macos-updates
-  tier: Premium
-  usualDepartment: IT
-  productCategories: [Device management,Vulnerability management]
-  pricingTableCategories: [Device management]
-  waysToUse:
-    - description: Enforce macOS updates via Nudge.
-    - description: Progressively enhance from Nudge to DDM-based OS updates.
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/17295
-    - description: Automatically update Windows after the end user reaches a deadline.
-- industryName: Cross-platform remote lock and wipe
-  documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-commands
-  waysToUse:
-    - description: High-level remote lock for macOS, Windows, and Linux.
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/9949
-    - description: High-level remote wipe for macOS, Windows, and Linux.
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/9951
-  tier: Premium
-  usualDepartment: IT
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
-- industryName: Deploy security agents on macOS, Windows, and Linux computers.
-  documentationUrl: https://github.com/fleetdm/fleet/issues/14921
-  description: Easily configure and install SentinelOne, Crowdstrike, and other security tools.
-  moreInfoUrl: https://github.com/fleetdm/fleet/issues/14921
-  tier: Premium
-  usualDepartment: IT
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
-- industryName: Update apps on macOS, Windows, and Linux computers.
-  description: Update Zoom, Slack, Chrome, and other apps without interrupting your end users.
-  tier: Premium
-  comingSoonOn: 2024-07-15
-  usualDepartment: IT
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
-  moreInfoUrl: https://github.com/fleetdm/fleet/issues/18865
-- industryName: Self-service portal for users to install apps
-  description: Add optional apps for your end users through Fleet Desktop (for macOS, Windows, and Linux).
-  tier: Premium
-  comingSoonOn: 2024-06-30
-  usualDepartment: IT
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
-  moreInfoUrl: https://github.com/fleetdm/fleet/issues/17587
-- industryName: Install Apple App Store apps through Volume Purchasing Program (VPP).
-  description: Offer licenses for Photoshop and other App Sore apps for your end users.
-  tier: Premium
-  comingSoonOn: 2024-08-11
-  waysToUse:
-    - description: macOS coming soon (2024-07-15). #customer-rosner
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/18867
-    - description: iOS/iPadOS coming soon (2024-08-11).
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/14899
-  usualDepartment: IT
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
-  moreInfoUrl: https://github.com/fleetdm/fleet/issues/18867
-- industryName: Puppet module
-  documentationUrl: https://fleetdm.com/docs/using-fleet/puppet-module
-  friendlyName: Map macOS settings to computers with Puppet module
-  tier: Premium
-  usualDepartment: IT
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
-- industryName: Software inventory
-  documentationUrl: https://fleetdm.com/docs/get-started/anatomy#software-library
-  tier: Free
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
-  waysToUse:
-    - description: Implement software inventory recommendations from the SANS 20 / CIS 18.
-      moreInfoUrl: https://docs.google.com/document/d/1E6EQMMqrsRc6Z3YsR6Q33OaF9eAa8zLNaz4K2YzFdyo/edit#heading=h.7en766pueek4
-    - description: View a list of all software and their versions installed on all your hosts.
-    - description: View a list of software rolled up by title.
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/14674
-- industryName: Hardware inventory
-  documentationUrl: https://fleetdm.com/tables/system_info
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
-  tier: Free
-  waysToUse:
-    - description: Implement hardware and infrastructure inventory recommendations from the SANS 20 / CIS 18.
-      moreInfoUrl: https://docs.google.com/document/d/1E6EQMMqrsRc6Z3YsR6Q33OaF9eAa8zLNaz4K2YzFdyo/edit#heading=h.7en766pueek4
-- industryName: Device inventory dashboard
-  documentationUrl: 
-  productCategories: [Endpoint operations,Device management]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  tier: Free
-- industryName: Browse installed software packages
-  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#software
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
-  tier: Free
-- industryName: Search devices by IP, serial, hostname, UUID
-  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#hosts
-  productCategories: [Endpoint operations,Device management]
-  pricingTableCategories: [Endpoint operations]
-  tier: Free
-- industryName: Labels (SQL-driven)
-  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#add-label
-  friendlyName: Filter hosts using SQL
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  tier: Free
-- industryName: Custom device data for help desk
-  documentationUrl: https://fleetdm.com/securing/end-user-self-remediation#set-your-enforcement-standards
-  description:
-  moreInfoUrl: https://github.com/fleetdm/fleet/issues/14415
-  tier: Free
-  usualDepartment: IT
-  productCategories: [Endpoint operations,Device management]
-  pricingTableCategories: [Device management]
-- industryName: Baselines (device groups)
-  friendlyName: Manage different endpoints differently
-  documentationUrl: https://fleetdm.com/docs/using-fleet/segment-hosts
-  description: Set baselines and strategies for hosts in different situations called "teams", and move hosts between them via API-driven automations or a simple, delegatable user interface with role-based access.
-  tier: Premium
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
-  waysToUse:
-    - description: Automate remediation for different applications with different security postures (cloud security engineering)
-- industryName: Generate reports for groups of devices
-  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#get-query-report
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  tier: Premium
-- industryName: Versionable queries and config (GitOps)
-  documentationUrl: https://fleetdm.com/guides/using-github-actions-to-apply-configuration-profiles-with-fleet#basic-article
-  tier: Free
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  demos:
-    - description: A top financial services company needed to set up rolling deployments for changes to osquery agents running on their production servers.
-      moreInfoUrl: https://docs.google.com/document/d/1UdzZMyBLbs9SUXfSXN2x2wZQCbjZZUetYlNWH6-ryqQ/edit#heading=h.2lh6ehprpvl6
-- industryName: Scope transparency
-  tier: Free
-  documentationUrl: https://fleetdm.com/transparency
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-- industryName: Single sign on (SSO, SAML)
-  documentationUrl: https://fleetdm.com/docs/deploy/single-sign-on-sso#single-sign-on-sso
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  tier: Free
-- industryName: Two-factor authentication
-  moreInfoUrl: https://github.com/fleetdm/fleet/issues/5478
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  tier: Free
-  waysToUse:
-    - description: Enforce two-factor authentication when logging in to Fleet for added security.
-  comingSoonOn: 2024-12-31 #customer-rosner
-- industryName: Disk encryption
-  documentationURL: https://fleetdm.com/docs/using-fleet/mdm-disk-encryption
-  friendlyName: Ensure hard disks are encrypted
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
+#  ╦╔╗╔╔═╗╦╔╦╗╔═╗╔╗╔╔╦╗  ╦═╗╔═╗╔═╗╔═╗╔═╗╔╗╔╔═╗╔═╗
+#  ║║║║║  ║ ║║║╣ ║║║ ║   ╠╦╝║╣ ╚═╗╠═╝║ ║║║║╚═╗║╣ 
+#  ╩╝╚╝╚═╝╩═╩╝╚═╝╝╚╝ ╩   ╩╚═╚═╝╚═╝╩  ╚═╝╝╚╝╚═╝╚═╝
+- industryName: Incident response
+  friendlyName: Interrogate hosts in real time
+  description: Live query, triage, figuring out scope of impact, remediate using scripts or MDM commands (e.g. remote wipe), and quarantine or reimage using other systems and APIs (e.g. remove from network, decommission container)
+  documentationUrl: https://fleetdm.com/securing/how-osquery-can-help-cyber-responders#simplifying-endpoint-visibility-with-osquery-and-fleet
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  dri: mikermcneil
   usualDepartment: Security
-  description: Encrypt hard disks of macOS and Windows computers, manage escrowed encryption keys, and report on disk encryption status (FileVault, BitLocker).
-  tier: Premium
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Devices]
+  buzzwords: []
+  demos:
+    - description: 
+      moreInfoUrl: 
   waysToUse:
-    - description: Report on disk encryption status
-    - description: Encrypt hard disks on macOS with FileVault
-    - description: Escrow FileVault keys on macOS
-    - description: Encrypt hard disks on Windows with BitLocker.
-- industryName: Grant API-only access
-  documentationUrl: https://fleetdm.com/docs/using-fleet/fleetctl-cli#using-fleetctl-with-an-api-only-user
+    - description: 
+#      
+#  ╔═╗╦ ╦╔═╗╔╦╗╔═╗╔╦╗ ╦  ╔═╗╔═╗╔═╗╦╔╗╔╔═╗
+#  ║  ║ ║╚═╗ ║ ║ ║║║║ ║  ║ ║║ ╦║ ╦║║║║║ ╦
+#  ╚═╝╚═╝╚═╝ ╩ ╚═╝╩ ╩ ╩═╝╚═╝╚═╝╚═╝╩╝╚╝╚═╝
+- industryName: Custom logging
+  description: Flexible, configurable logging destinations (AWS Kinesis, Lambda, GCP, Kafka).
+  documentationUrl: https://fleetdm.com/docs/using-fleet/log-destinations#log-destinations
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  usualDepartment: Security
   productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
+  pricingTableCategories: [Devices]
+  buzzwords: [Real-time export,Ship logs]
+#
+#
+#  ██╗   ██╗██╗   ██╗██╗     ███╗   ██╗███████╗██████╗  █████╗ ██████╗ ██╗██╗     ██╗████████╗██╗   ██╗    
+#  ██║   ██║██║   ██║██║     ████╗  ██║██╔════╝██╔══██╗██╔══██╗██╔══██╗██║██║     ██║╚══██╔══╝╚██╗ ██╔╝    
+#  ██║   ██║██║   ██║██║     ██╔██╗ ██║█████╗  ██████╔╝███████║██████╔╝██║██║     ██║   ██║    ╚████╔╝     
+#  ╚██╗ ██╔╝██║   ██║██║     ██║╚██╗██║██╔══╝  ██╔══██╗██╔══██║██╔══██╗██║██║     ██║   ██║     ╚██╔╝      
+#   ╚████╔╝ ╚██████╔╝███████╗██║ ╚████║███████╗██║  ██║██║  ██║██████╔╝██║███████╗██║   ██║      ██║       
+#    ╚═══╝   ╚═════╝ ╚══════╝╚═╝  ╚═══╝╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝╚═════╝ ╚═╝╚══════╝╚═╝   ╚═╝      ╚═╝       
+#                                                                                                          
+#  ███╗   ███╗ █████╗ ███╗   ██╗ █████╗  ██████╗ ███████╗███╗   ███╗███████╗███╗   ██╗████████╗            
+#  ████╗ ████║██╔══██╗████╗  ██║██╔══██╗██╔════╝ ██╔════╝████╗ ████║██╔════╝████╗  ██║╚══██╔══╝            
+#  ██╔████╔██║███████║██╔██╗ ██║███████║██║  ███╗█████╗  ██╔████╔██║█████╗  ██╔██╗ ██║   ██║               
+#  ██║╚██╔╝██║██╔══██║██║╚██╗██║██╔══██║██║   ██║██╔══╝  ██║╚██╔╝██║██╔══╝  ██║╚██╗██║   ██║               
+#  ██║ ╚═╝ ██║██║  ██║██║ ╚████║██║  ██║╚██████╔╝███████╗██║ ╚═╝ ██║███████╗██║ ╚████║   ██║               
+#  ╚═╝     ╚═╝╚═╝  ╚═╝╚═╝  ╚═══╝╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═══╝   ╚═╝               
+#                                                                                                          
+#
+#  ╔╦╗╔═╗╦  ╦ ╦╔═╗╦═╗╔═╗  ╔╦╗╔═╗╔╦╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔  ┌─╦ ╦╔═╗╦═╗╔═╗─┐
+#  ║║║╠═╣║  ║║║╠═╣╠╦╝║╣    ║║║╣  ║ ║╣ ║   ║ ║║ ║║║║  │ ╚╦╝╠═╣╠╦╝╠═╣ │
+#  ╩ ╩╩ ╩╩═╝╚╩╝╩ ╩╩╚═╚═╝  ═╩╝╚═╝ ╩ ╚═╝╚═╝ ╩ ╩╚═╝╝╚╝  └─ ╩ ╩ ╩╩╚═╩ ╩─┘
+- industryName: Malware detection (YARA/custom IoCs)  # TODO: consider: technically more than YARA, consider generalizing this and including the concept of comparing known binary hashes and other IoCs (either via live query or in the data lake to compare threat intel feed)
+  friendlyName: Scan files for zero days and malware signatures
+  description: Use YARA signatures to report and trigger automations when zero days, malware, or unexpected files are detected on a host.
+  documentationUrl: https://fleetdm.com/tables/yara
   tier: Free
-- industryName: Audit log of Fleet activity (queries, scripts, logins, etc)
-  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#list-activities
-  productCategories: [Endpoint operations, Device management]
-  pricingTableCategories: [Endpoint operations, Device management]
-  tier: Premium
+  jamfProHasFeature: no
+  jamfProtectHasFeature: yes
+  dri: mikermcneil
   usualDepartment: Security
+  productCategories: [Endpoint operations,Vulnerability management]
+  pricingTableCategories: [Devices]
+  buzzwords: [YARA scanning,Cyber Threat Intelligence (CTI),Indicators of compromise (IOCs),Antivirus (AV),Endpoint protection platform (EPP),Endpoint detection and response (EDR),Malware detection,Signature-based malware detection,Malware scanning,Malware analysis,Anomaly detection]
+  demos:
+    - description: A top media company used Fleet policies with YARA rules to continuously scan host filesystems for malware signatures provided by internal and external threat intelligence teams.
+      moreInfoUrl: # short demo video
   waysToUse:
-    - description: Export activity of Fleet admins to your SIEM or data lake
-- industryName: Just-in-time (JIT) provisioning
-  documentationUrl: https://fleetdm.com/docs/deploy/single-sign-on-sso#just-in-time-jit-user-provisioning
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  tier: Premium
-- industryName: System for Cross-domain Identity Management (SCIM) provisioning
-  moreInfoUrl: https://github.com/fleetdm/fleet/issues/15671
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  tier: Premium
-  comingSoonOn: 2024-12-31 #customer-rosner
-- industryName: Automated user role sync via Okta, AD, or any IDP
-  documentationUrl:
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Device management]
-  usualDepartment: IT
-  tier: Premium
-  waysToUse:
-    - description: Automatically set admin access to Fleet based on your IDP
-- industryName: Multi-tenancy for white label MDM solutions
-  description: Build your MDM solution on top of the Fleet API to manage workstations for multiple customers.
-  documentationUrl: https://github.com/fleetdm/fleet/issues/9956 #customer-deebradel
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
-  usualDepartment: IT
-  buzzwords: [OEM,Private label,House brand,Clear label,Multi-tenancy]
-  tier: Premium
-  comingSoonOn: 2024-08-26
-- industryName: Trigger a workflow based on a failing policy
-  documentationUrl: https://fleetdm.com/docs/using-fleet/automations#policy-automations
-  productCategories: [Endpoint operations,Device management]
-  pricingTableCategories: [Integrations]
-  usualDepartment: IT
-  tier: Free
-- industryName: Role-based access control
-  documentationUrl: https://fleetdm.com/docs/using-fleet/manage-access#manage-access
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  tier: Premium
-#   ╦═╗╦╔═╗╦╔═   ╔╗ ╔═╗╔═╗╔═╗╔╦╗  ╦  ╦╦ ╦╦  ╔╗╔╔═╗╦═╗╔═╗╔╗ ╦╦  ╦╔╦╗╦ ╦  ╔╦╗╔═╗╔╗╔╔═╗╔═╗╔═╗╔╦╗╔═╗╔╗╔╔╦╗
-#   ╠╦╝║╚═╗╠╩╗───╠╩╗╠═╣╚═╗║╣  ║║  ╚╗╔╝║ ║║  ║║║║╣ ╠╦╝╠═╣╠╩╗║║  ║ ║ ╚╦╝  ║║║╠═╣║║║╠═╣║ ╦║╣ ║║║║╣ ║║║ ║ 
-#   ╩╚═╩╚═╝╩ ╩   ╚═╝╩ ╩╚═╝╚═╝═╩╝   ╚╝ ╚═╝╩═╝╝╚╝╚═╝╩╚═╩ ╩╚═╝╩╩═╝╩ ╩  ╩   ╩ ╩╩ ╩╝╚╝╩ ╩╚═╝╚═╝╩ ╩╚═╝╝╚╝ ╩
+    - description: Detect suspicious bytecode in JAR files
+    - description: Identify suspicious patterns in binaries using YARA signatures  # (≈regular expressions for binary)
+    - description: Continuously scan host filesystems for malware signatures.
+      moreInfoUrl: https://yara.readthedocs.io/en/stable/writingrules.html
+    - description: Monitor for relevent filesystem changes (YARA events) and on-demand YARA signature scans.
+      moreInfoUrl: https://osquery.readthedocs.io/en/stable/deployment/yara/
+    - description: Use YARA for malware detection
+      moreInfoUrl: https://www.cisa.gov/sites/default/files/FactSheets/NCCIC%20ICS_FactSheet_YARA_S508C.pdf
+    - description: Scan for indicators of compromise (IoC) for common malware.
+      moreInfoUrl: https://github.com/Cisco-Talos/osquery_queries
+    - description: Analyze malware using data from osquery, such as endpoint certificates and launch daemons (launchd).
+      moreInfoUrl: https://medium.com/hackernoon/malware-analysis-using-osquery-part-3-9dc805b67d16
+    - description: Detect persistent malware (e.g. WireLurker) in endpoints by generating simple policies that search for their static indicators of compromise (IoCs).
+      moreInfoUrl: https://osquery.readthedocs.io/en/stable/deployment/anomaly-detection/
+    - description: Run a targeted YARA scan with osquery as a lightweight approach to scan anything on a host filesystem, with minimal performance impact.  Unlike full system YARA scans which consume considerable CPU resources, an equivalent YARA scan targeted in Fleet can be 8x cheaper (CPU %).
+      moreInfoUrl: https://www.tripwire.com/state-of-security/signature-socket-based-malware-detection-osquery-yara
+#
+#  ╔═╗╔═╗╔╗╔╔╦╗╦╔╗╔╦ ╦╔═╗╦ ╦╔═╗  ╔═╗╔═╗╔═╗╔╗╔╔╗╔╦╔╗╔╔═╗
+#  ║  ║ ║║║║ ║ ║║║║║ ║║ ║║ ║╚═╗  ╚═╗║  ╠═╣║║║║║║║║║║║ ╦
+#  ╚═╝╚═╝╝╚╝ ╩ ╩╝╚╝╚═╝╚═╝╚═╝╚═╝  ╚═╝╚═╝╩ ╩╝╚╝╝╚╝╩╝╚╝╚═╝
 - industryName: Continuous scanning
   friendlyName: Detect vulnerable software
   documentationUrl: https://fleetdm.com/vulnerability-management
   productCategories: [Vulnerability management]
-  pricingTableCategories: [Vulnerability management]
+  pricingTableCategories: [Devices]
   usualDepartment: Security
   tier: Free
+  jamfProHasFeature: no
+  jamfProtectHasFeature: yes
   buzzwords: [Stakeholder-specific vulnerability categorization (SSVC),Continuous scanning,Continuous vulnerability scanning,Risk-based vulnerability management]
   waysToUse:
     - description: 'Use an SSVC decision tree model to prioritize relevant vulnerabilities into four possible decisions: "Track", "Track*", "Attend", and "Act".'
@@ -865,31 +991,19 @@
       moreInfoUrl: https://docs.google.com/document/d/1JWtRsW1FUTCkZEESJj9-CvXjLXK4219by-C6vvVVyBY/edit
     - description: One of the world's largest, top transportation companies uses Fleet's API to email relevant, actually-installed vulnerabilities to responsible teams so they can fix them.
       moreInfoUrl: https://docs.google.com/document/d/1oeCmT077o_5nxzLhnxs7kcg_4Qn1Pn1F5zx10nQOAp8/edit
-#  ╦  ╦╦ ╦╦  ╔╗╔╔═╗╦═╗╔═╗╔╗ ╦╦  ╦╔╦╗╦ ╦  ╔╦╗╔═╗╔═╗╦ ╦╔╗ ╔═╗╔═╗╦═╗╔╦╗
-#  ╚╗╔╝║ ║║  ║║║║╣ ╠╦╝╠═╣╠╩╗║║  ║ ║ ╚╦╝   ║║╠═╣╚═╗╠═╣╠╩╗║ ║╠═╣╠╦╝ ║║
-#   ╚╝ ╚═╝╩═╝╝╚╝╚═╝╩╚═╩ ╩╚═╝╩╩═╝╩ ╩  ╩   ═╩╝╩ ╩╚═╝╩ ╩╚═╝╚═╝╩ ╩╩╚══╩╝
-- industryName: Vulnerability dashboard 
-  friendlyName: Vulnerability dashboard
-  documentationUrl: https://fleetdm.com/vulnerability-management
-  productCategories: [Vulnerability management]
-  pricingTableCategories: [Vulnerability management]
-  usualDepartment: Security
-  tier: Premium
-  demos:
-    - description: See a list of all vulnerabilities across your hosts.
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/15919
-    - description: AI generated CVSS v4 context. Coming soon (2024-12-31).
-  waysToUse:
-    - description: Easily communicate to executives regarding the progress of patching vulnerable software. Only show vulnerabilities that you care about.
+#
 #  ╦  ╦╦ ╦╦  ╔╗╔╔═╗╦═╗╔═╗╔╗ ╦╦  ╦╔╦╗╦ ╦  ╔═╗╔═╗╔═╗╦═╗╔═╗╔═╗       ╔═╗╔═╗╔═╗╔═╗  ╔═╗╔╗╔╔╦╗  ╔═╗╦  ╦╔═╗╔═╗
 #  ╚╗╔╝║ ║║  ║║║║╣ ╠╦╝╠═╣╠╩╗║║  ║ ║ ╚╦╝  ╚═╗║  ║ ║╠╦╝║╣ ╚═╗  ───  ║╣ ╠═╝╚═╗╚═╗  ╠═╣║║║ ║║  ║  ╚╗╔╝╚═╗╚═╗
 #   ╚╝ ╚═╝╩═╝╝╚╝╚═╝╩╚═╩ ╩╚═╝╩╩═╝╩ ╩  ╩   ╚═╝╚═╝╚═╝╩╚═╚═╝╚═╝       ╚═╝╩  ╚═╝╚═╝  ╩ ╩╝╚╝═╩╝  ╚═╝ ╚╝ ╚═╝╚═╝
-- industryName: Vulnerability scores (EPSS and CVSS) 
+- industryName: Vulnerability scores
+  friendlyName: EPSS and CVSS
   documentationUrl: https://fleetdm.com/vulnerability-management
   tier: Premium
+  jamfProHasFeature: no
+  jamfProtectHasFeature: yes
   usualDepartment: Security
   productCategories: [Vulnerability management]
-  pricingTableCategories: [Vulnerability management]
+  pricingTableCategories: [Devices]
   buzzwords: [Risk scores,Cyber risk,Risk reduction,Security operations effectiveness,Peer benchmarking,Security program effectiveness,Risk-based exposure scoring,Threat context,Cyber exposure,Exposure quantification and benchmarking,Optimize security investments,Vulnerability assessment]
   demos:
     - description: Fleet enables a more modern, threat-first prioritization approach to vulnerability management.
@@ -900,15 +1014,19 @@
     - description: An Introduction to EPSS, The Exploit Prediction Scoring System
     - moreInfoUrl: https://www.youtube.com/watch?v=vw1RlZCSRcQ
     - description: By extracting metadata from the National Vulnerability Database (NVD) and Microsoft Security Response Center (MSRC), we can determine which version of software is no longer vulnerable.
+#
 #  ╔═╗╦╔═╗╔═╗  ╦╔═╔═╗╦  ╦╔═╗
 #  ║  ║╚═╗╠═╣  ╠╩╗║╣ ╚╗╔╝╚═╗
 #  ╚═╝╩╚═╝╩ ╩  ╩ ╩╚═╝ ╚╝ ╚═╝
-- industryName: CISA KEVs (known exploited vulnerabilities)
+- industryName: CISA KEVs
+  description: Known exploited vulnerabilities
   documentationUrl: https://fleetdm.com/vulnerability-management
   tier: Premium
+  jamfProHasFeature: no
+  jamfProtectHasFeature: yes
   usualDepartment: Security
   productCategories: [Vulnerability management]
-  pricingTableCategories: [Vulnerability management]
+  pricingTableCategories: [Devices]
   demos:
     - description: 
       moreInfoUrl:
@@ -916,53 +1034,559 @@
     - description: Help teams work on vulnerabilities that have actually been exploited (CISA KEVs) or have a high probability of being exploited (EPSS), or whatever is important in your environment.
     - description: Use CISA KEVs for vulnerability management
     - moreInfoUrl: https://www.youtube.com/watch?v=Z3mw2oxssYk
-- industryName: Query performance monitoring
-  documentationUrl: https://fleetdm.com/docs/get-started/faq#will-fleet-slow-down-my-servers-what-about-my-employee-laptops
+#  
+#   ╔═╗╔═╗╔═╗╔═╗╔╦╗  ╔╦╗╦╔═╗╔═╗╔═╗╦  ╦╔═╗╦═╗╦ ╦
+#   ╠═╣╚═╗╚═╗║╣  ║    ║║║╚═╗║  ║ ║╚╗╔╝║╣ ╠╦╝╚╦╝
+#   ╩ ╩╚═╝╚═╝╚═╝ ╩   ═╩╝╩╚═╝╚═╝╚═╝ ╚╝ ╚═╝╩╚═ ╩ 
+- industryName: Asset discovery
+  documentationUrl:
+  tier: Premium
+  comingSoonOn: 2025-06-30
+  usualDepartment: Security
+  productCategories: [Vulnerability management]
+  pricingTableCategories: [Devices]  
+#     
+#
+#
+#  ██╗███╗   ██╗████████╗███████╗ ██████╗ ██████╗  █████╗ ████████╗██╗ ██████╗ ███╗   ██╗███████╗
+#  ██║████╗  ██║╚══██╔══╝██╔════╝██╔════╝ ██╔══██╗██╔══██╗╚══██╔══╝██║██╔═══██╗████╗  ██║██╔════╝
+#  ██║██╔██╗ ██║   ██║   █████╗  ██║  ███╗██████╔╝███████║   ██║   ██║██║   ██║██╔██╗ ██║███████╗
+#  ██║██║╚██╗██║   ██║   ██╔══╝  ██║   ██║██╔══██╗██╔══██║   ██║   ██║██║   ██║██║╚██╗██║╚════██║
+#  ██║██║ ╚████║   ██║   ███████╗╚██████╔╝██║  ██║██║  ██║   ██║   ██║╚██████╔╝██║ ╚████║███████║
+#  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚══════╝ ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝   ╚═╝   ╚═╝ ╚═════╝ ╚═╝  ╚═══╝╚══════╝
+#                                                                                                                                                                                 
+#
+#  ╦═╗╔═╗╔═╗╔╦╗  ╔═╗╔═╗╦
+#  ╠╦╝║╣ ╚═╗ ║   ╠═╣╠═╝║
+#  ╩╚═╚═╝╚═╝ ╩   ╩ ╩╩  ╩
+- industryName: REST API
+  friendlyName: Automate any feature
+  description: 
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Integrations]
+  usualDepartment: IT
+  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api 
+  screenshotSrc:
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  dri: rachaelshaw
+#
+#  ╦ ╦╔═╗╔╗ ╦ ╦╔═╗╔═╗╦╔═╔═╗
+#  ║║║║╣ ╠╩╗╠═╣║ ║║ ║╠╩╗╚═╗
+#  ╚╩╝╚═╝╚═╝╩ ╩╚═╝╚═╝╩ ╩╚═╝
+- industryName: Webhooks
+  friendlyName: Automations
+  documentationUrl: https://fleetdm.com/docs/using-fleet/automations#automations
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Integrations]
+  usualDepartment: IT 
   tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+#  
+#  ╔═╗╦═╗╔═╗╔╗╔╔╦╗  ╔═╗╔═╗╦   ╔═╗╔╗╔╦ ╦ ╦  ╔═╗╔═╗╔═╗╔═╗╔═╗╔═╗
+#  ║ ╦╠╦╝╠═╣║║║ ║   ╠═╣╠═╝║───║ ║║║║║ ╚╦╝  ╠═╣║  ║  ║╣ ╚═╗╚═╗
+#  ╚═╝╩╚═╩ ╩╝╚╝ ╩   ╩ ╩╩  ╩   ╚═╝╝╚╝╩═╝╩   ╩ ╩╚═╝╚═╝╚═╝╚═╝╚═╝
+- industryName: Grant API-only access
+  description: Grant API-only access to accounts exclusively for automation.
+  documentationUrl: https://fleetdm.com/docs/using-fleet/fleetctl-cli#using-fleetctl-with-an-api-only-user
   productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  demos:
-    - description: A top software company needed to understand the performance impact of osquery queries before running them on all of their production Linux servers.
-      moreInfoUrl: https://docs.google.com/document/d/1WzMc8GJCRU6tTBb6gLsSTzFysqtXO8CtP2sXMPKgYSk/edit?disco=AAAA6xuVxGg
-    - description: A top software company wanted to detect regressions when adding/changing queries and fail builds if queries were too expensive.
-      moreInfoUrl: https://docs.google.com/document/d/1WzMc8GJCRU6tTBb6gLsSTzFysqtXO8CtP2sXMPKgYSk/edit?disco=AAAA6xuVxGg
-  waysToUse:
-    - description: Monitor performance for automated queries.
-    - description: Monitor performance for live queries.
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/467
-- industryName: Detect and surface issues with devices (policies)
-  documentationUrl: https://fleetdm.com/docs/get-started/anatomy#policy
-  productCategories: [Endpoint operations,Device management]
-  pricingTableCategories: [Endpoint operations]
+  pricingTableCategories: [Integrations]
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+#  
+#  ╔═╗╦╔╗╔╔═╗╦  ╔═╗  ╔═╗╦╔═╗╔╗╔  ╔═╗╔╗╔
+#  ╚═╗║║║║║ ╦║  ║╣   ╚═╗║║ ╦║║║  ║ ║║║║
+#  ╚═╝╩╝╚╝╚═╝╩═╝╚═╝  ╚═╝╩╚═╝╝╚╝  ╚═╝╝╚╝
+- industryName: Single sign on
+  description: SSO, SAML
+  documentationUrl: https://fleetdm.com/docs/deploy/single-sign-on-sso#single-sign-on-sso
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Integrations]
   usualDepartment: IT
   tier: Free
-- industryName: Policy scoring
-  documentationUrl: 
-  friendlyName: Mark policies as critical
-  productCategories: [Endpoint operations,Device management]
-  pricingTableCategories: [Endpoint operations]
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+#  
+#   ╦╦ ╦╔═╗╔╦╗  ╦╔╗╔  ╔╦╗╦╔╦╗╔═╗  ╔═╗╦═╗╔═╗╦  ╦╦╔═╗╦╔═╗╔╗╔╦╔╗╔╔═╗
+#   ║║ ║╚═╗ ║───║║║║───║ ║║║║║╣   ╠═╝╠╦╝║ ║╚╗╔╝║╚═╗║║ ║║║║║║║║║ ╦
+#  ╚╝╚═╝╚═╝ ╩   ╩╝╚╝   ╩ ╩╩ ╩╚═╝  ╩  ╩╚═╚═╝ ╚╝ ╩╚═╝╩╚═╝╝╚╝╩╝╚╝╚═╝
+- industryName: Just-in-time (JIT) provisioning
+  documentationUrl: https://fleetdm.com/docs/deploy/single-sign-on-sso#just-in-time-jit-user-provisioning
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Integrations]
   usualDepartment: IT
   tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: no
+#
+#  ╔╦╗╦ ╦╦╦═╗╔╦╗   ╔═╗╔═╗╦═╗╔╦╗╦ ╦  ╔═╗╦ ╦╔╦╗╔═╗╔╦╗╔═╗╔╦╗╦╔═╗╔╗╔
+#   ║ ╠═╣║╠╦╝ ║║───╠═╝╠═╣╠╦╝ ║ ╚╦╝  ╠═╣║ ║ ║ ║ ║║║║╠═╣ ║ ║║ ║║║║
+#   ╩ ╩ ╩╩╩╚══╩╝   ╩  ╩ ╩╩╚═ ╩  ╩   ╩ ╩╚═╝ ╩ ╚═╝╩ ╩╩ ╩ ╩ ╩╚═╝╝╚╝
+- industryName: Third-party automation
+  friendlyName: Borrow off-the-shelf tactics from the community
+  documentationUrl: https://fleetdm.com/integrations
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Integrations]
+  usualDepartment: IT
+  description: Plug Fleet into other frameworks and tools like Tines, Snowflake, Terraform, Chronicle, Jira, Zendesk, etc
+  moreInfoUrl: https://fleetdm.com/integrations
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
   waysToUse:
-    - description: Block access to corporate apps if your end users are failing a specific number of critical policies.
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/16206
-- industryName: Flexible log destinations (AWS Kinesis, Lambda, GCP, Kafka)
-  documentationUrl: https://fleetdm.com/docs/using-fleet/log-destinations#log-destinations
+    - description: (ActiveDirectory) Know who opened your computer and check their device posture before you let them log into anything.
+    - description: (Ansible) Easily issue MDM commands and standardize data across operating systems.
+    - description: (AWS) Deploy your own self-managed Fleet in any AWS environment in minutes.
+    - description: (Azure) Deploy your own self-managed Fleet in the Microsoft Cloud in minutes.
+    - description: (Chef) Easily issue MDM commands and standardize data across operating systems.
+    - description: (Elastic) Ingest osquery data and monitor for important changes or events.
+    - description: (GitHub) Version control using git, enabling collaboration and a GitOps workflow.
+    - description: (GitLab) Version control using git, enabling collaboration and a GitOps workflow.
+    - description: (Chronicle) Ingest osquery data and monitor for important changes or events.
+    - description: (Google Cloud) Deploy your own self-managed Fleet in any GCP environment in minutes.
+    - description: (Munki) Easily issue MDM commands and standardize data across operating systems.
+    - description: (Okta) Know who opened your computer and check their device posture before you let them log into anything.
+    - description: (Snowflake) Ingest osquery data and monitor for important changes or events.
+    - description: (Splunk) Ingest osquery data and monitor for important changes or events.
+    - description: (Tines) Build custom workflows that trigger in various situations.
+    - description: (Webhooks) Configure automations that send webhooks to specific URLs when Fleet detects changes to host, policy, and CVE statuses.
+    - description: (Zendesk) Automatically create Zendesk tickets in various situations.
+    - description: (Jira) Automatically create Jira tickets in various situations, including exporting vulnerabilities to Jira and syncing tickets.
+  buzzwords: [Snowflake,Okta,Tines,Splunk,Elastic,AWS,ActiveDirectory,Ansible,GitHub,GitLab,Chronicle,Google Cloud,Munki,Vanta,Chef,Zendesk,Jira]
+#
+#  ╔╦╗╦ ╦╦╦═╗╔╦╗   ╔═╗╔═╗╦═╗╔╦╗╦ ╦  ╔═╗╦═╗╔═╗╦ ╦╔═╗╔═╗╔╦╗╦═╗╔═╗╔╦╗╦╔═╗╔╗╔
+#   ║ ╠═╣║╠╦╝ ║║───╠═╝╠═╣╠╦╝ ║ ╚╦╝  ║ ║╠╦╝║  ╠═╣║╣ ╚═╗ ║ ╠╦╝╠═╣ ║ ║║ ║║║║
+#   ╩ ╩ ╩╩╩╚══╩╝   ╩  ╩ ╩╩╚═ ╩  ╩   ╚═╝╩╚═╚═╝╩ ╩╚═╝╚═╝ ╩ ╩╚═╩ ╩ ╩ ╩╚═╝╝╚╝
+- industryName: Third-party orchestration
+  friendlyName: Borrow off-the-shelf tactics from legendary brands
+  documentationUrl: https://fleetdm.com/integrations
+  description: Plug Fleet into other frameworks and tools like Puppet, Vanta, etc.
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Integrations]
+  usualDepartment: IT
+  moreInfoUrl: https://fleetdm.com/integrations
+  tier: Premium
+  waysToUse:
+    - description: (Vanta) Trigger a workflow based on a failing policy.
+    - description: (Puppet) Easily issue MDM commands, standardize data across operating systems, and map macOS+Windows settings to computers with the Puppet module.
+    - description: (Torq) Build custom workflows that trigger in various situations.
+    - description: (Custom IdP) Manage access to Fleet single sign-on (SSO) through any IdP (using SAML).
+  buzzwords: [Vanta,Puppet,Custom IdP]
+#  
+#  ╔╦╗╦ ╦╔╗╔╦╔═╦  ╔═╗╔═╗╔╦╗╔═╗╔═╗╔╦╗╦╔╗ ╦╦  ╦╔╦╗╦ ╦ 
+#  ║║║║ ║║║║╠╩╗║  ║  ║ ║║║║╠═╝╠═╣ ║ ║╠╩╗║║  ║ ║ ╚╦╝ 
+#  ╩ ╩╚═╝╝╚╝╩ ╩╩  ╚═╝╚═╝╩ ╩╩  ╩ ╩ ╩ ╩╚═╝╩╩═╝╩ ╩  ╩  
+- industryName: Munki compatibility + visibility
+  tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  usualDepartment: IT
+  productCategories: [Device management]
+  pricingTableCategories: [Integrations]
+#
+#
+#  ███████╗██╗   ██╗██████╗ ██████╗  ██████╗ ██████╗ ████████╗
+#  ██╔════╝██║   ██║██╔══██╗██╔══██╗██╔═══██╗██╔══██╗╚══██╔══╝
+#  ███████╗██║   ██║██████╔╝██████╔╝██║   ██║██████╔╝   ██║   
+#  ╚════██║██║   ██║██╔═══╝ ██╔═══╝ ██║   ██║██╔══██╗   ██║   
+#  ███████║╚██████╔╝██║     ██║     ╚██████╔╝██║  ██║   ██║   
+#  ╚══════╝ ╚═════╝ ╚═╝     ╚═╝      ╚═════╝ ╚═╝  ╚═╝   ╚═╝   
+#   
+#
+#  ╔═╗╔═╗╔═╗╔╗╔   ╔═╗╔═╗╦ ╦╦═╗╔═╗╔═╗  ╦╔═╗╔═╗╦ ╦╔═╗  ╔╦╗╦═╗╔═╗╔═╗╦╔═╔═╗╦═╗  ╔═╗╦╔╦╗╦ ╦╦ ╦╔╗ 
+#  ║ ║╠═╝║╣ ║║║───╚═╗║ ║║ ║╠╦╝║  ║╣   ║╚═╗╚═╗║ ║║╣    ║ ╠╦╝╠═╣║  ╠╩╗║╣ ╠╦╝  ║ ╦║ ║ ╠═╣║ ║╠╩╗
+#  ╚═╝╩  ╚═╝╝╚╝   ╚═╝╚═╝╚═╝╩╚═╚═╝╚═╝  ╩╚═╝╚═╝╚═╝╚═╝   ╩ ╩╚═╩ ╩╚═╝╩ ╩╚═╝╩╚═  ╚═╝╩ ╩ ╩ ╩╚═╝╚═╝
+- industryName: Open-source issue tracker (GitHub)
+  documentationUrl: https://fleetdm.com/support
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Support]
   tier: Free
-  usualDepartment: Security
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  buzzwords: [Real-time export,Ship logs]
-- industryName: File carving (AWS S3)
-  documentationUrl: https://fleetdm.com/docs/configuration/fleet-server-configuration#s-3-file-carving-backend
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+#
+#  ╔═╗╔═╗╔╦╗╔╦╗╦ ╦╔╗╔╦╔╦╗╦ ╦  ╔═╗╦  ╔═╗╔═╗╦╔═  ╔═╗╦ ╦╔═╗╔╗╔╔╗╔╔═╗╦  
+#  ║  ║ ║║║║║║║║ ║║║║║ ║ ╚╦╝  ╚═╗║  ╠═╣║  ╠╩╗  ║  ╠═╣╠═╣║║║║║║║╣ ║  
+#  ╚═╝╚═╝╩ ╩╩ ╩╚═╝╝╚╝╩ ╩  ╩   ╚═╝╩═╝╩ ╩╚═╝╩ ╩  ╚═╝╩ ╩╩ ╩╝╚╝╝╚╝╚═╝╩═╝
+- industryName: Community Slack channel
+  documentationUrl: https://fleetdm.com/support
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Support]
   tier: Free
-  usualDepartment: Security
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-- industryName: Asset discovery
-  documentationUrl:
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+#
+#  ╦ ╦╔╗╔╦  ╦╔╦╗╦╔╦╗╔═╗╔╦╗  ╔═╗╔╦╗╔═╗╦╦    ╔═╗╦ ╦╔═╗╔═╗╔═╗╦═╗╔╦╗
+#  ║ ║║║║║  ║║║║║ ║ ║╣  ║║  ║╣ ║║║╠═╣║║    ╚═╗║ ║╠═╝╠═╝║ ║╠╦╝ ║
+#  ╚═╝╝╚╝╩═╝╩╩ ╩╩ ╩ ╚═╝═╩╝  ╚═╝╩ ╩╩ ╩╩╩═╝  ╚═╝╚═╝╩  ╩  ╚═╝╩╚═ ╩
+- industryName: Unlimited email support (confidential)
+  documentationUrl: https://fleetdm.com/support
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Support]
   tier: Premium
-  comingSoonOn: 2024-06-30
-  usualDepartment: Security
-  productCategories: [Vulnerability management]
-  pricingTableCategories: [Vulnerability management]
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+#
+#  ╔═╗╦ ╦╔═╗╔╗╔╔═╗  ╔═╗╔╗╔╔╦╗  ╦  ╦╦╔╦╗╔═╗╔═╗  ╔═╗╔═╗╦  ╦    ╔═╗╦ ╦╔═╗╔═╗╔═╗╦═╗╔╦╗
+#  ╠═╝╠═╣║ ║║║║║╣   ╠═╣║║║ ║║  ╚╗╔╝║ ║║║╣ ║ ║  ║  ╠═╣║  ║    ╚═╗║ ║╠═╝╠═╝║ ║╠╦╝ ║ 
+#  ╩  ╩ ╩╚═╝╝╚╝╚═╝  ╩ ╩╝╚╝═╩╝   ╚╝ ╩═╩╝╚═╝╚═╝  ╚═╝╩ ╩╩═╝╩═╝  ╚═╝╚═╝╩  ╩  ╚═╝╩╚═ ╩ 
+- industryName: Phone and video call support
+  documentationUrl: https://fleetdm.com/support
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Support]
+  tier: Premium
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+#
+# 
+#
+#
+#
+#
+#
+#
+#   █████╗ ██████╗  ██████╗██╗  ██╗██╗██╗   ██╗███████╗
+#  ██╔══██╗██╔══██╗██╔════╝██║  ██║██║██║   ██║██╔════╝
+#  ███████║██████╔╝██║     ███████║██║██║   ██║█████╗  
+#  ██╔══██║██╔══██╗██║     ██╔══██║██║╚██╗ ██╔╝██╔══╝  
+#  ██║  ██║██║  ██║╚██████╗██║  ██║██║ ╚████╔╝ ███████╗
+#  ╚═╝  ╚═╝╚═╝  ╚═╝ ╚═════╝╚═╝  ╚═╝╚═╝  ╚═══╝  ╚══════╝
+#
+#
+# #  ╔╦╗╔═╗╔╦╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔  ╔═╗╔╗╔╔═╗╦╔╗╔╔═╗╔═╗╦═╗╦╔╗╔╔═╗
+# #   ║║║╣  ║ ║╣ ║   ║ ║║ ║║║║  ║╣ ║║║║ ╦║║║║║╣ ║╣ ╠╦╝║║║║║ ╦
+# #  ═╩╝╚═╝ ╩ ╚═╝╚═╝ ╩ ╩╚═╝╝╚╝  ╚═╝╝╚╝╚═╝╩╝╚╝╚═╝╚═╝╩╚═╩╝╚╝╚═╝
+# - industryName: Detection engineering
+#   friendlyName: # Ship logs to your data lake and comopare with known bad binary hashes or capture behavioral data and build custom detections (e.g. using a framework like MITRE)
+#   description: 
+#   documentationUrl: https://fleetdm.com/docs/using-fleet/log-destinations
+#   tier: Free
+#   jamfProHasFeature: no
+#   jamfProtectHasFeature: yes
+#   dri: mikermcneil
+#   usualDepartment: Security
+#   productCategories: [Endpoint operations]
+#   pricingTableCategories: [Devices]
+#   buzzwords: [Security analytics,Behavioral analytics,MITRE ATT&CK,Tactics techniques and procedures (TTPs),Security information and event management (SIEM)]
+#   demos:
+#     - description: 
+#       moreInfoUrl: 
+#   waysToUse:
+#     - description: 
+#
+#
+# #  ╦╔╗╔╔╦╗╦═╗╦ ╦╔═╗╔╦╗╦╔═╗╔╗╔  ╔╦╗╔═╗╔╦╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔
+# #  ║║║║ ║ ╠╦╝║ ║╚═╗ ║ ║║ ║║║║   ║║║╣  ║ ║╣ ║   ║ ║║ ║║║║
+# #  ╩╝╚╝ ╩ ╩╚═╚═╝╚═╝ ╩ ╩╚═╝╝╚╝  ═╩╝╚═╝ ╩ ╚═╝╚═╝ ╩ ╩╚═╝╝╚╝     
+# - industryName: Intrusion detection
+#   friendlyName: Build custom query and policy automations to detect suspicious behavior
+#   description: Send webhooks and ship logs to detect intrusions and issues with devices.
+#   documentationUrl: https://fleetdm.com/docs/using-fleet/log-destinations
+#   tier: Free
+#   jamfProHasFeature: no
+#   jamfProtectHasFeature: yes
+#   usualDepartment: Security
+#   productCategories: [Endpoint operations]
+#   pricingTableCategories: [Devices]
+#   buzzwords: [Host-based intrusion detection system (HIDS,Indicators of Compromise (IOCs),Feeder for SIEM]
+#   demos:
+#     - description: A top media company wanted to share more security data with other departments without slowing down hosts.
+#   waysToUse:
+#     - description: Send webhooks to generate alerts when an IOC is detected on one or more devices.
+#     - description: Ship logs to Splunk, Snowflake, and other SIEMs to build a host-based intrusion detection system (HIDS).
+#     - description: Synchronize live state of endpoints to a data lake or SIEM in a consistent shape.
+#     - description: Export the data to other systems
+#       moreInfoUrl: https://docs.google.com/document/d/1pE9U-1E4YDiy6h4TorszrTOiFAauFiORikSUFUqW7Pk/edit
+#     - description: Export data to a third-party SIEM tool
+#       moreInfoUrl: https://www.websense.com/content/support/library/web/hosted/admin_guide/siem_integration_explain.aspx
+#     - description: Gather data and log events from endpoints
+#       moreInfoUrl: https://techbeacon.com/security/how-osquery-can-lift-your-security-teams-game#:~:text=%22If%20security%20teams%20didn%27t%20have%20osquery%2C%20they%20would%20have%20to%20find%20a%20way%20to%20manually%20go%20into%20each%20endpoint%20and%20gather%20data%2C%20or%20buy%20a%20third%2Dparty%20tool%20to%20do%20that%20for%20them
+# 
+# #  ╔╦╗╦ ╦╦═╗╔═╗╔═╗╔╦╗  ╦ ╦╦ ╦╔╗╔╔╦╗╦╔╗╔╔═╗
+# #   ║ ╠═╣╠╦╝║╣ ╠═╣ ║   ╠═╣║ ║║║║ ║ ║║║║║ ╦
+# #   ╩ ╩ ╩╩╚═╚═╝╩ ╩ ╩   ╩ ╩╚═╝╝╚╝ ╩ ╩╝╚╝╚═╝
+# - industryName: Threat hunting
+#   friendlyName: # TODO: live query
+#   description: 
+#   documentationUrl: https://fleetdm.com/queries
+#   tier: Free
+#   jamfProHasFeature: no
+#   jamfProtectHasFeature: yes
+#   dri: mikermcneil
+#   usualDepartment: Security
+#   productCategories: [Endpoint operations]
+#   pricingTableCategories: [Devices]
+#   buzzwords: []
+#   demos:
+#     - description: 
+#       moreInfoUrl: 
+#   waysToUse:
+#     - description:
+#
+#   
+# #  ╔╦╗╔═╗╔╦╗╔═╗╔═╗╔╦╗  ╔═╗╔╗╔╔╦╗  ╔═╗╦ ╦╦═╗╔═╗╔═╗╔═╗╔═╗  ╦╔═╗╔═╗╦ ╦╔═╗╔═╗  ╦ ╦╦╔╦╗╦ ╦  
+# #   ║║║╣  ║ ║╣ ║   ║   ╠═╣║║║ ║║  ╚═╗║ ║╠╦╝╠╣ ╠═╣║  ║╣   ║╚═╗╚═╗║ ║║╣ ╚═╗  ║║║║ ║ ╠═╣  
+# #  ═╩╝╚═╝ ╩ ╚═╝╚═╝ ╩   ╩ ╩╝╚╝═╩╝  ╚═╝╚═╝╩╚═╚  ╩ ╩╚═╝╚═╝  ╩╚═╝╚═╝╚═╝╚═╝╚═╝  ╚╩╝╩ ╩ ╩ ╩  
+# #  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗╔═╗                                                                
+# #   ║║║╣ ╚╗╔╝║║  ║╣ ╚═╗                                                                
+# #  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝╚═╝                                                                
+# - industryName: Detect and surface issues with devices (policies)
+#   documentationUrl: https://fleetdm.com/docs/get-started/anatomy#policy
+#   productCategories: [Endpoint operations,Device management]
+#   pricingTableCategories: [Devices]
+#   usualDepartment: IT
+#   tier: Free
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: yes
+#
+# 
+# #  ╔╗ ╔═╗╔╦╗╔═╗╦ ╦  ╦╔╗╔╔═╗╔╦╗╔═╗╦  ╦  ╔═╗╔╦╗╦╔═╗╔╗╔
+# #  ╠╩╗╠═╣ ║ ║  ╠═╣  ║║║║╚═╗ ║ ╠═╣║  ║  ╠═╣ ║ ║║ ║║║║
+# #  ╚═╝╩ ╩ ╩ ╚═╝╩ ╩  ╩╝╚╝╚═╝ ╩ ╩ ╩╩═╝╩═╝╩ ╩ ╩ ╩╚═╝╝╚╝
+# - industryName: Batch installation (Chef, Ansible, Puppet, MDM)
+#   friendlyName: Install agents over the air
+#   documentationUrl: https://fleetdm.com/docs/using-fleet/enroll-hosts
+#   tier: Free
+#   jamfProHasFeature: no
+#   jamfProtectHasFeature: no
+#   productCategories: [Endpoint operations]
+#   pricingTableCategories: [Devices]
+#   usualDepartment: IT
+#
+# 
+# #  ╦  ╦╦ ╦╦  ╔╗╔╔═╗╦═╗╔═╗╔╗ ╦╦  ╦╔╦╗╦ ╦  ╔╦╗╔═╗╔═╗╦ ╦╔╗ ╔═╗╔═╗╦═╗╔╦╗
+# #  ╚╗╔╝║ ║║  ║║║║╣ ╠╦╝╠═╣╠╩╗║║  ║ ║ ╚╦╝   ║║╠═╣╚═╗╠═╣╠╩╗║ ║╠═╣╠╦╝ ║║
+# #   ╚╝ ╚═╝╩═╝╝╚╝╚═╝╩╚═╩ ╩╚═╝╩╩═╝╩ ╩  ╩   ═╩╝╩ ╩╚═╝╩ ╩╚═╝╚═╝╩ ╩╩╚══╩╝
+# - industryName: Vulnerability dashboard 
+#   friendlyName: Vulnerability dashboard
+#   documentationUrl: https://fleetdm.com/vulnerability-management
+#   productCategories: [Vulnerability management]
+#   pricingTableCategories: [Devices]
+#   usualDepartment: Security
+#   tier: Premium
+#   jamfProHasFeature: no
+#   jamfProtectHasFeature: yes
+#   demos:
+#     - description: See a list of all vulnerabilities across your hosts.
+#       moreInfoUrl: https://github.com/fleetdm/fleet/issues/15919
+#     - description: AI generated CVSS v4 context. Coming soon (2024-12-31).
+#   waysToUse:
+#     - description: Easily communicate to executives regarding the progress of patching vulnerable software. Only show vulnerabilities that you care about.
+#
+#
+# #  ╔═╗╦   ╔═╗╔═╗╔╗╔╔═╗╦═╗╔═╗╔╦╗╔═╗╔╦╗  ╔╦╗╔═╗╔═╗╔═╗╦═╗╦╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+# #  ╠═╣║───║ ╦║╣ ║║║║╣ ╠╦╝╠═╣ ║ ║╣  ║║   ║║║╣ ╚═╗║  ╠╦╝║╠═╝ ║ ║║ ║║║║╚═╗
+# #  ╩ ╩╩   ╚═╝╚═╝╝╚╝╚═╝╩╚═╩ ╩ ╩ ╚═╝═╩╝  ═╩╝╚═╝╚═╝╚═╝╩╚═╩╩   ╩ ╩╚═╝╝╚╝╚═╝
+# - industryName: AI-generated descriptions (optional)
+#   description: Optionally use AI to explain why your security policies matter.
+#   documentationUrl: https://github.com/fleetdm/fleet/issues/18187
+#   tier: Free
+#   jamfProHasFeature: no
+#   jamfProtectHasFeature: no
+#   productCategories: [Endpoint operations]
+#   pricingTableCategories: [Devices] 
+# 
+# 
+# CONSOLIDATED WITH DEVICE HEALTH       
+# #  ╔═╗╦ ╦╔╦╗╔═╗╔╦╗╔═╗╔╦╗╦╔═╗  ╔═╗╔═╗╔═╗╔╦╗╦ ╦╦═╗╔═╗  ╔═╗╔═╗╔═╗╔═╗╔═╗╔═╗╔╦╗╔═╗╔╗╔╔╦╗
+# #  ╠═╣║ ║ ║ ║ ║║║║╠═╣ ║ ║║    ╠═╝║ ║╚═╗ ║ ║ ║╠╦╝║╣   ╠═╣╚═╗╚═╗║╣ ╚═╗╚═╗║║║║╣ ║║║ ║
+# #  ╩ ╩╚═╝ ╩ ╚═╝╩ ╩╩ ╩ ╩ ╩╚═╝  ╩  ╚═╝╚═╝ ╩ ╚═╝╩╚═╚═╝  ╩ ╩╚═╝╚═╝╚═╝╚═╝╚═╝╩ ╩╚═╝╝╚╝ ╩
+# - industryName: Automatic posture assessment
+#   friendlyName: Verify any security or compliance goal
+#   description: Simplify security audits, build definitive reports, and discover + verify ongoing compliance for every endpoint, from workstations to data centers.
+#   documentationUrl: https://fleetdm.com/docs/using-fleet/cis-benchmarks#cis-benchmarks
+#   screenshotSrc:
+#   usualDepartment: Security
+#   tier: Free
+#   jamfProHasFeature: no
+#   jamfProtectHasFeature: yes
+#   productCategories: [Endpoint operations]
+#   pricingTableCategories: [Devices]
+#   dri: mikermcneil
+#   demos:
+#     - description: A large tech company used Fleet's CIS Benchmark policies to automatically assess posuture of 80,000 endpoints. 
+#       quote:
+#       moreInfoUrl: 
+#   buzzwords: [Attack surface management (ASM),Endpoint hardening,Security posture,Cyber hygiene,Anomaly detection,Configuration management,Attack Surface Monitoring,Policy assessment]
+#   waysToUse: 
+#     # Consolidated ways to use with "Device health"
+# 
+#
+#  CONSOLIDATED WITH DEVICE HEALTH
+# #  ╔═╗╔═╗╦  ╦╔═╗╦ ╦  ╔═╗╔═╗╔═╗╦═╗╦╔╗╔╔═╗
+# #  ╠═╝║ ║║  ║║  ╚╦╝  ╚═╗║  ║ ║╠╦╝║║║║║ ╦
+# #  ╩  ╚═╝╩═╝╩╚═╝ ╩   ╚═╝╚═╝╚═╝╩╚═╩╝╚╝╚═╝
+# - industryName: Policy scoring
+#   documentationUrl: 
+#   friendlyName: Mark policies as critical
+#   productCategories: [Endpoint operations,Device management]
+#   pricingTableCategories: [Devices]
+#   usualDepartment: IT
+#   tier: Premium
+#   jamfProHasFeature: no
+#   jamfProtectHasFeature: no
+#   waysToUse:
+#     # Consolidated ways to use with "Device health"
+# 
+#
+#  CONSOLIDATED WITH TEAMS
+# #  ╦  ╦╔═╗╦═╗╦╔═╗╔╗ ╦  ╔═╗  ╔═╗╔╗╔╦═╗╔═╗╦  ╦  ╔╦╗╔═╗╔╗╔╔╦╗
+# #  ╚╗╔╝╠═╣╠╦╝║╠═╣╠╩╗║  ║╣   ║╣ ║║║╠╦╝║ ║║  ║  ║║║║╣ ║║║ ║
+# #   ╚╝ ╩ ╩╩╚═╩╩ ╩╚═╝╩═╝╚═╝  ╚═╝╝╚╝╩╚═╚═╝╩═╝╩═╝╩ ╩╚═╝╝╚╝ ╩
+# - industryName: Variable enrollment
+#   description: Enroll hosts in different groups using different enrollment secrets and/or installers per-baseline.
+#   documentationUrl: https://fleetdm.com/docs/using-fleet/segment-hosts
+#   tier: Premium
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: no
+#   productCategories: [Endpoint operations, Device management]
+#   pricingTableCategories: [Devices]
+#   usualDepartment: IT  
+# 
+#
+# #  ╔═╗╔═╗╔═╗╔╗╔╔╦╗  ╔═╗╦ ╦╔╦╗╔═╗   ╦ ╦╔═╗╔╦╗╔═╗╔╦╗╔═╗
+# #  ╠═╣║ ╦║╣ ║║║ ║   ╠═╣║ ║ ║ ║ ║───║ ║╠═╝ ║║╠═╣ ║ ║╣
+# #  ╩ ╩╚═╝╚═╝╝╚╝ ╩   ╩ ╩╚═╝ ╩ ╚═╝   ╚═╝╩  ═╩╝╩ ╩ ╩ ╚═╝
+# - industryName: Agent auto-update (optional)
+#   friendlyName: Keep agents and extensions up to date
+#   description: Optionally keep agents and extensions up to date automatically using Fleet's free update registry, powered by The Update Framework (TUF).
+#   documentationUrl: https://fleetdm.com/docs/using-fleet/enroll-hosts
+#   tier: Free
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: no
+#   productCategories: [Endpoint operations]
+#   pricingTableCategories: [Devices]
+#   usualDepartment: IT
+# 
+#
+# #  ╔╦╗╔═╗╔═╗╔═╗  ╔═╗╦ ╦╔╦╗╔═╗╔╦╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+# #   ║║║╣ ║╣ ╠═╝  ╠═╣║ ║ ║ ║ ║║║║╠═╣ ║ ║║ ║║║║╚═╗
+# #  ═╩╝╚═╝╚═╝╩    ╩ ╩╚═╝ ╩ ╚═╝╩ ╩╩ ╩ ╩ ╩╚═╝╝╚╝╚═╝
+# - industryName: Deep automations
+#   friendlyName: Trigger webhooks or run scripts
+#   documentationUrl: https://fleetdm.com/docs/using-fleet/automations#automations
+#   description: Fire off webhooks or run scripts on hosts when certain things happen in Fleet.
+#   productCategories: [Endpoint operations,Device management,Vulnerability management]
+#   pricingTableCategories: [Integrations]
+#   comingSoonOn: 2024-12-31
+#   tier: Free
+#   buzzwords: [Automated remediation,Auto-remediation,Self-healing]
+#   waysToUse:
+#     - description: Use policy automations to automatically remediate issues and mitigate vulnerabilities.
+#     - description: Use osquery and santa to work around inflexibilities in proprietary MDMs and other protection solutions.
+#     - description: Listen to webhooks to perform autonomous self-healing (cloud security engineering)
+#       moreInfoUrl: https://www.fugue.co/blog/automated-remediation-scripts-vs.-self-healing-infrastructure-two-approaches-to-cloud-security
+# 
+#
+#    CONSOLIDATED WITH "SELF-SERVICE APPLICATION INSTALLATION"
+# #  ╦╔╗╔╔═╗╔╦╗╔═╗╦  ╦  ╔═╗╦═╗╔═╗
+# #  ║║║║╚═╗ ║ ╠═╣║  ║  ║╣ ╠╦╝╚═╗
+# #  ╩╝╚╝╚═╝ ╩ ╩ ╩╩═╝╩═╝╚═╝╩╚═╚═╝
+# - industryName: Installers (self-service)
+#   tier: Free
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: no
+#   productCategories: [Endpoint operations]
+#   pricingTableCategories: [Devices]
+#   usualDepartment: IT
+#   documentationUrl: https://fleetdm.com/docs/using-fleet/enroll-hosts
+#   waysToUse:
+#     CONSOLIDATED WITH "SELF-SERVICE APPLICATION INSTALLATION"
+# 
+#
+#   CONSOLIDATED WITH "POLICIES"
+#  ╔╦╗╦═╗╦╔═╗╔═╗╔═╗╦═╗  ╔═╗  ╦ ╦╔═╗╦═╗╦╔═╔═╗╦  ╔═╗╦ ╦  ╔╗ ╔═╗╔═╗╔═╗╔╦╗  ╔═╗╔╗╔  ╔═╗  
+#   ║ ╠╦╝║║ ╦║ ╦║╣ ╠╦╝  ╠═╣  ║║║║ ║╠╦╝╠╩╗╠╣ ║  ║ ║║║║  ╠╩╗╠═╣╚═╗║╣  ║║  ║ ║║║║  ╠═╣  
+#   ╩ ╩╚═╩╚═╝╚═╝╚═╝╩╚═  ╩ ╩  ╚╩╝╚═╝╩╚═╩ ╩╚  ╩═╝╚═╝╚╩╝  ╚═╝╩ ╩╚═╝╚═╝═╩╝  ╚═╝╝╚╝  ╩ ╩  
+#  ╔═╗╔═╗╦╦  ╦╔╗╔╔═╗  ╔═╗╔═╗╦  ╦╔═╗╦ ╦                                               
+#  ╠╣ ╠═╣║║  ║║║║║ ╦  ╠═╝║ ║║  ║║  ╚╦╝                                               
+#  ╚  ╩ ╩╩╩═╝╩╝╚╝╚═╝  ╩  ╚═╝╩═╝╩╚═╝ ╩                                                
+# - industryName: Trigger a workflow based on a failing policy
+#   documentationUrl: https://fleetdm.com/docs/using-fleet/automations#policy-automations
+#   productCategories: [Endpoint operations,Device management]
+#   pricingTableCategories: [Integrations]
+#   usualDepartment: IT
+#   tier: Free
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: no
+# 
+#
+#   CONSOLIDATED WITH "DEVICE INVENTORY"
+# #  ╦ ╦╔═╗╦═╗╔╦╗╦ ╦╔═╗╦═╗╔═╗  ╦╔╗╔╦  ╦╔═╗╔╗╔╔╦╗╔═╗╦═╗╦ ╦
+# #  ╠═╣╠═╣╠╦╝ ║║║║║╠═╣╠╦╝║╣   ║║║║╚╗╔╝║╣ ║║║ ║ ║ ║╠╦╝╚╦╝
+# #  ╩ ╩╩ ╩╩╚══╩╝╚╩╝╩ ╩╩╚═╚═╝  ╩╝╚╝ ╚╝ ╚═╝╝╚╝ ╩ ╚═╝╩╚═ ╩ 
+# - industryName: Hardware inventory
+#   documentationUrl: https://fleetdm.com/tables/system_info
+#   productCategories: [Endpoint operations,Device management,Vulnerability management]
+#   pricingTableCategories: [Devices]
+#   tier: Free
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: no
+#   waysToUse:
+#     - description: Implement hardware and infrastructure inventory recommendations from the SANS 20 / CIS 18.
+#       moreInfoUrl: https://docs.google.com/document/d/1E6EQMMqrsRc6Z3YsR6Q33OaF9eAa8zLNaz4K2YzFdyo/edit#heading=h.7en766pueek4
+#   
+
+#   CONSOLIDATED WITH "DEVICE INVENTORY"
+# #  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗  ╦╔╗╔╦  ╦╔═╗╔╗╔╔╦╗╔═╗╦═╗╦ ╦  ╔╦╗╔═╗╔═╗╦ ╦╔╗ ╔═╗╔═╗╦═╗╔╦╗
+# #   ║║║╣ ╚╗╔╝║║  ║╣   ║║║║╚╗╔╝║╣ ║║║ ║ ║ ║╠╦╝╚╦╝   ║║╠═╣╚═╗╠═╣╠╩╗║ ║╠═╣╠╦╝ ║║
+# #  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝  ╩╝╚╝ ╚╝ ╚═╝╝╚╝ ╩ ╚═╝╩╚═ ╩   ═╩╝╩ ╩╚═╝╩ ╩╚═╝╚═╝╩ ╩╩╚══╩╝
+# - industryName: Device inventory dashboard
+#   documentationUrl: 
+#   productCategories: [Endpoint operations,Device management]
+#   pricingTableCategories: [Devices]
+#   usualDepartment: IT
+#   tier: Free
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: yes
+# 
+#
+#   CONSOLIDATED WITH "DEVICE INVENTORY"
+# #  ╔═╗╔═╗╔═╗╔╦╗╦ ╦╔═╗╦═╗╔═╗  ╦╔╗╔╦  ╦╔═╗╔╗╔╔╦╗╔═╗╦═╗╦ ╦
+# #  ╚═╗║ ║╠╣  ║ ║║║╠═╣╠╦╝║╣   ║║║║╚╗╔╝║╣ ║║║ ║ ║ ║╠╦╝╚╦╝
+# #  ╚═╝╚═╝╚   ╩ ╚╩╝╩ ╩╩╚═╚═╝  ╩╝╚╝ ╚╝ ╚═╝╝╚╝ ╩ ╚═╝╩╚═ ╩ 
+# - industryName: Software inventory
+#   documentationUrl: https://fleetdm.com/docs/get-started/anatomy#software-library
+#   tier: Free
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: no
+#   productCategories: [Endpoint operations,Device management,Vulnerability management]
+#   pricingTableCategories: [Devices]
+#   waysToUse:
+#     - description: Implement software inventory recommendations from the SANS 20 / CIS 18.
+#       moreInfoUrl: https://docs.google.com/document/d/1E6EQMMqrsRc6Z3YsR6Q33OaF9eAa8zLNaz4K2YzFdyo/edit#heading=h.7en766pueek4
+#     - description: View a list of all software and their versions installed on all your hosts.
+#     - description: View a list of software rolled up by title.
+#       moreInfoUrl: https://github.com/fleetdm/fleet/issues/14674
+# #
+# 
+#   CONSOLIDATED WITH "DEVICE INVENTORY"
+# #  ╔╗ ╦═╗╔═╗╦ ╦╔═╗╔═╗  ╦╔╗╔╔═╗╔╦╗╔═╗╦  ╦  ╔═╗╔╦╗  ╔═╗╔═╗╔═╗╔╦╗╦ ╦╔═╗╦═╗╔═╗  ╔═╗╔═╗╔═╗╦╔═╔═╗╔═╗╔═╗╔═╗
+# #  ╠╩╗╠╦╝║ ║║║║╚═╗║╣   ║║║║╚═╗ ║ ╠═╣║  ║  ║╣  ║║  ╚═╗║ ║╠╣  ║ ║║║╠═╣╠╦╝║╣   ╠═╝╠═╣║  ╠╩╗╠═╣║ ╦║╣ ╚═╗
+# #  ╚═╝╩╚═╚═╝╚╩╝╚═╝╚═╝  ╩╝╚╝╚═╝ ╩ ╩ ╩╩═╝╩═╝╚═╝═╩╝  ╚═╝╚═╝╚   ╩ ╚╩╝╩ ╩╩╚═╚═╝  ╩  ╩ ╩╚═╝╩ ╩╩ ╩╚═╝╚═╝╚═╝
+# - industryName: Browse installed software packages
+#   documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#software
+#   productCategories: [Endpoint operations,Device management,Vulnerability management]
+#   pricingTableCategories: [Devices]
+#   tier: Free
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: no
+#  
+#
+#   CONSOLIDATED WITH "SEARCH INVENTORY"
+# #  ╔═╗╔═╗╔═╗╦═╗╔═╗╦ ╦  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗╔═╗  ╔╗ ╦ ╦  ╦╔═╗  ╔═╗╔═╗╦═╗╦╔═╗╦     
+# #  ╚═╗║╣ ╠═╣╠╦╝║  ╠═╣   ║║║╣ ╚╗╔╝║║  ║╣ ╚═╗  ╠╩╗╚╦╝  ║╠═╝  ╚═╗║╣ ╠╦╝║╠═╣║     
+# #  ╚═╝╚═╝╩ ╩╩╚═╚═╝╩ ╩  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝╚═╝  ╚═╝ ╩   ╩╩┘   ╚═╝╚═╝╩╚═╩╩ ╩╩═╝┘  
+# #  ╦ ╦╔═╗╔═╗╔╦╗╔╗╔╔═╗╔╦╗╔═╗   ╦ ╦╦ ╦╦╔╦╗                                      
+# #  ╠═╣║ ║╚═╗ ║ ║║║╠═╣║║║║╣    ║ ║║ ║║ ║║                                      
+# #  ╩ ╩╚═╝╚═╝ ╩ ╝╚╝╩ ╩╩ ╩╚═╝┘  ╚═╝╚═╝╩═╩╝                                      
+# - industryName: Search devices by IP, serial, hostname, UUID
+#   documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#hosts
+#   productCategories: [Endpoint operations,Device management]
+#   pricingTableCategories: [Devices]
+#   tier: Free
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: yes
+#
diff --git a/handbook/company/product-groups.md b/handbook/company/product-groups.md
index 2a4bb4ac6e2f..2783f7faa31f 100644
--- a/handbook/company/product-groups.md
+++ b/handbook/company/product-groups.md
@@ -1,4 +1,5 @@
 # 🛩️ Product groups
+
 This page covers what all contributors (fleeties or not) need to know in order to contribute changes to [the core product](https://fleetdm.com/docs).
 
 When creating software, handoffs between teams or contributors are one of the most common sources of miscommunication and waste.  Like [GitLab](https://docs.google.com/document/d/1RxqS2nR5K0vN6DbgaBw7SEgpPLi0Kr9jXNGzpORT-OY/edit#heading=h.7sfw1n9c1i2t), Fleet uses product groups to minimize handoffs and maximize iteration and efficiency in the way we build the product.
@@ -6,10 +7,14 @@ When creating software, handoffs between teams or contributors are one of the mo
 > - Write down philosophies and show how the pieces of the development process fit together on this "🛩️ Product groups" page.
 > - Use the dedicated [departmental](https://fleetdm.com/handbook/company#org-chart) handbook pages for [🚀 Engineering](https://fleetdm.com/handbook/engineering) and [🦢 Product Design](https://fleetdm.com/handbook/product) to keep track of specific, rote responsibilities and recurring rituals designed to be read and used only by people within those departments.
 
+
 ## Product roadmap
-Fleet team members can read [Fleet's high-level product goals and planned releases for the current quarter and the next quarter](https://docs.google.com/document/d/11XEb__EJoGQJE9hXwaLrN45_5_k1NCi-zlJKH-OlKKk/edit#heading=h.33k3ii7z7ubc) (confidential Google Doc).
+
+Fleet team members can read [Fleet's high-level product goals for the current quarter](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit?usp=sharing) (confidential Google Sheet).
+
 
 ## What are product groups?
+
 Fleet organizes product development efforts into separate, cross-functional product groups that include product designers, developers, and quality engineers.  These product groups are organized by business goal, and designed to operate in parallel.
 
 Security, performance, stability, scalability, database migrations, release compatibility, usage documentation (such as REST API and configuration reference), contributor experience, and support escalation are the responsibility of every product group.
@@ -18,25 +23,24 @@ At Fleet, [anyone can contribute](https://fleetdm.com/handbook/company#openness)
 
 > Ideas expressed in wireframes, like code contributions, [are welcome from everyone](https://chat.osquery.io/c/fleet), inside or outside the company.
 
+
 ## Current product groups
 
-| Product group             | Goal _(value for customers and/or community)_                       | Capacity\* |
-|:--------------------------|:--------------------------------------------------------------------|:-----------------|
-| [Endpoint ops](#endpoint-ops-group)                     | Increase and exceed maturity in the "Endpoint operations" category.             | 130       |
-| [MDM](#mdm-group)                                       | Reach maturity in the "MDM" product category.           | 130       |
+| Product group                            | Goal _(value for customers and/or community)_                         | Capacity\*   |
+|:-----------------------------------------|:----------------------------------------------------------------------|:-------------|
+| [Endpoint ops](#endpoint-ops-group)      | Increase and exceed maturity in the "Endpoint operations" category.   | 130          |
+| [MDM](#mdm-group)                        | Reach maturity in the "MDM" product category.                         | 156          |
 
-\* The number of estimated story points this group can take on per-sprint under ideal circumstances, used as a baseline number for planning and prioritizing user stories for drafting. In reality, capacity will vary as engineers are on-call, out-of-office, filling in for other product groups, etc.
+\* The number of [estimated story points](https://fleetdm.com/handbook/company/communications#estimation-points) this group can take on per-sprint under ideal circumstances, used as a baseline number for planning and prioritizing user stories for drafting. In reality, capacity will vary as engineers are on-call, out-of-office, filling in for other product groups, etc.
 
-> _**What happened to "CX"?**  The customer experience (CX) group at Fleet is now [`#g-endpoint-ops`](#endpoint-ops-group)._
->
-> _Why?  Making users and customers happier and more successful is the goal of _every_ product group.  This includes simpler usage, lovable design + help text + error messages, fixed bugs, responding quickly to incidents, using Fleet's brand standards, more successful customer onboarding, features that drive more win-win meetings with contributors and Fleet's sales team, and "whole product solutions", including professional services, design partnerships, and training._
 
 ### Endpoint ops group
+
 The goal of the endpoint ops group is to increase and exceed [Fleet's product maturity goals in the endpoint operations category](https://drive.google.com/file/d/11yQ_2WG7TbRErUpMBKWu_hQ5wRIZyQhr/view?usp=sharing).
 
 | Responsibility                    | Human(s)                  |
 |:----------------------------------|:--------------------------|
-| Product Designer                  | [Rachael Shaw](https://www.linkedin.com/in/rachaelcshaw/) _([@rachaelshaw](https://github.com/rachaelshaw))_
+| Product Designer                  | [Rachael Shaw](https://www.linkedin.com/in/rachaelcshaw/) _([@rachaelshaw](https://github.com/rachaelshaw))_, [Randy Hill](https://www.linkedin.com/in/rockingmoose/) _([@randy-fleet](https://github.com/randy-fleet))_
 | Engineering Manager               | [Sharon Katz](https://www.linkedin.com/in/sharon-katz-45b1b3a/) _([@sharon-fdm](https://github.com/sharon-fdm))_
 | Product Manager                   | [Noah Talerman](https://www.linkedin.com/in/noah-talerman/) _([@noahtalerman](https://github.com/@noahtalerman))_
 | Quality Assurance                 | [Reed Haynes](https://www.linkedin.com/in/reed-haynes-633a69a3/) _([@xpkoala](https://github.com/xpkoala))_
@@ -44,7 +48,9 @@ The goal of the endpoint ops group is to increase and exceed [Fleet's product ma
 
 > The [Slack channel](https://fleetdm.slack.com/archives/C01EZVBHFHU), [kanban release board](https://app.zenhub.com/workspaces/-g-endpoint-ops-current-sprint-63bd7e0bf75dba002a2343ac/board), and [GitHub label](https://github.com/fleetdm/fleet/issues?q=is%3Aopen+is%3Aissue+label%3A%23g-endpoint-ops) for this product group is `#g-endpoint-ops`.
 
+
 ### MDM group
+
 The goal of the MDM group is to increase and exceed [Fleet's product maturity goals](https://drive.google.com/file/d/11yQ_2WG7TbRErUpMBKWu_hQ5wRIZyQhr/view?usp=sharing) in the "MDM" product category.
 
 | Responsibility                    | Human(s)                  |
@@ -57,7 +63,9 @@ The goal of the MDM group is to increase and exceed [Fleet's product maturity go
 
 > The [Slack channel](https://fleetdm.slack.com/archives/C03C41L5YEL), [kanban release board](https://app.zenhub.com/workspaces/-g-mdm-current-sprint-63bc507f6558550011840298/board), and [GitHub label](https://github.com/fleetdm/fleet/issues?q=is%3Aopen+is%3Aissue+label%3A%23g-mdm) for this product group is `#g-mdm`.
 
+
 ## Making changes
+
 Fleet's highest product ambition is to create experiences that users want.
 
 To deliver on this mission, we need a clear, repeatable process for turning an idea into a set of cohesively-designed changes in the product. We also need to allow [open source contributions](https://fleetdm.com/handbook/company#open-source) at any point in the process from the wider Fleet community - these won't necessarily follow this process.
@@ -69,30 +77,49 @@ To make a change to Fleet:
 - Then, it will be [drafted](https://fleetdm.com/handbook/company/product-groups#drafting) (planned).
 - Next, it will be [implemented](https://fleetdm.com/handbook/company/product-groups#implementing) and [released](https://fleetdm.com/handbook/engineering#release-process).
 
+
 ### Planned and unplanned changes
+
 Most changes to Fleet are planned changes. They are [prioritized](https://fleetdm.com/handbook/product), defined, designed, revised, estimated, and scheduled into a release sprint _prior to starting implementation_.  The process of going from a prioritized goal to an estimated, scheduled, committed user story with a target release is called "drafting", or "the drafting phase".
 
 Occasionally, changes are unplanned.  Like a patch for an unexpected bug, or a hotfix for a security issue.  Or if an open source contributor suggests an unplanned change in the form of a pull request.  These unplanned changes are sometimes OK to merge as-is.  But if they change the user interface, the CLI usage, or the REST API, then they need to go through drafting and reconsideration before merging.
 
 > But wait, [isn't this "waterfall"?](https://about.gitlab.com/handbook/product-development-flow/#but-wait-isnt-this-waterfall) Waterfall is something else.  Between 2015-2023, GitLab and The Sails Company independently developed and coevolved similar delivery processes.  (What we call "drafting" and "implementation" at Fleet, is called "the validation phase" and "the build phase" at GitLab.)
 
+
+### Experimental features
+
+When a new feature is introduced it may be labeled as experimental. Experimental features are undergoing a rapid [incremental improvement and iteration process](https://fleetdm.com/handbook/company/why-this-way#why-lean-software-development) where new learnings may requires breaking changes. When we introduce experimental features, it is important that any API endpoints or configuration surface that may change in the future be clearly labeled as experimental.
+
+1. Apply the `~experimental` label to all associated user stories.
+2. Set the optional `isExperimental` property to "yes" in [pricing-features-table.yml](https://github.com/fleetdm/fleet/blob/main/handbook/company/pricing-features-table.yml).
+3. Make sure all API endpoints and configuration surface documentation includes the following message:
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+
 ### Breaking changes
-For product changes that cause breaking API or configuration changes or major impact for users (or even just the _impression_ of major impact!), the company plans migration thoughtfully.  That means the product department and E-group:
 
-1. **Written:** Write a migration guide, even if that's just a Google Doc
-2. **Tested:** Test out the migration ourselves, first-hand, as an engineer.
-3. **Gamed out:** We pretend we are one or two key customers and try it out as a role play.
-4. **Adapt:** If it becomes clear that the plan is insufficient, then fix it.
-5. **Communicate:** Develop a plan for how to proactively communicate the change to customers.
+For product changes that cause breaking API or configuration changes or major impact for users (or even just the _impression_ of major impact!), the company plans migration thoughtfully. If the feature was released as stable (not experimental), the product group and E-group:
+
+1. **Written:** Write a migration guide.
+2. **Tested:** Test the migration thoroughly as engineers.
+3. **Gamed out:** Pretend we are one or two key customers and try it out as a role play.
+4. **Adapt:** If it becomes clear that the plan is insufficient, fix it.
+5. **Communicate:** Create a plan for how to proactively communicate the change to customers.
+
+All of the steps above happen prior to any breaking changes to stable features being prioritized for implementation.
 
-That all happens prior to work getting prioritized for the change.
 
 #### API changes
+
 To maintain consistency, ensure perspective, and provide a single pair of eyes in the design of Fleet's REST API and API documentation, there is a single Directly Responsible Individual (DRI). The API design DRI will review and approve any alterations at the pull request stage, instead of making it a prerequisite during drafting of the story. You may tag the DRI in a GitHub issue with draft API specs in place to receive a review and feedback prior to implementation. Receiving a pre-review from the DRI is encouraged if the API changes introduce new endpoints, or substantially change existing endpoints.
 
 No API changes are merged without accompanying API documentation and approval from the DRI. The DRI is responsible for ensuring that the API design remains consistent and adequately addresses both standard and edge-case scenarios. The DRI is also the code owner of the API documentation Markdown file. The DRI is committed to reviewing PRs within one business day. In instances where the DRI is unavailable, the Head of Product will act as the substitute code owner and reviewer.
 
+
 #### Changes to tables' schema
+
 Whenever a PR is proposed for making changes to our [tables' schema](https://fleetdm.com/tables/screenlock)(e.g. to schema/tables/screenlock.yml), it also has to be reflected in our osquery_fleet_schema.json file.
 
 The website team will [periodically](https://fleetdm.com/handbook/marketing/website-handbook#rituals) update the json file with the latest changes. If the changes should be deployed sooner, you can generate the new json file yourself by running these commands:
@@ -105,14 +132,18 @@ cd website
 
 > If a table is added to our ChromeOS extension but it does not exist in osquery or if it is a table added by fleetd, add a note that mentions it, as in this [example](https://github.com/fleetdm/fleet/blob/e95e075e77b683167e86d50960e3dc17045e3c44/schema/tables/mdm.yml#L2).
 
+
 ### Drafting
+
 "Drafting" is the art of defining a change, designing and shepherding it through the drafting process until it is ready for implementation.
 
-The goal of drafting is to deliver software that works every time with less total effort and investment, without making contribution any less fun.  By researching and iterating [prior to development](https://fleetdm.com/handbook/company/why-this-way#why-do-we-use-a-wireframe-first-approach), we design better product features, crystallize fewer bad, preemptive naming decisions, and achieve better throughput: getting more done in less time. 
+The goal of drafting is to deliver software that works every time with less total effort and investment, without making contribution any less fun.  By researching and iterating [prior to development](https://fleetdm.com/handbook/company/why-this-way#why-do-we-use-a-wireframe-first-approach), we design better product features, crystallize fewer bad, preemptive naming decisions, and achieve better throughput: getting more done in less time.
 
 > Fleet's drafting process is focused first and foremost on product development, but it can be used for any kind of change that benefits from planning or a "dry run".  For example, imagine you work for a business who has decided to swap out one of your payroll or device management vendors.  You will probably need to plan and execute changes to a number of complicated onboarding/offboarding processes.
 
+
 #### Drafting process
+
 The DRI for defining and drafting issues for a product group is the product manager, with close involvement from the designer and engineering manager.  But drafting is a team effort, and all contributors participate.
 
 A user story is considered ready for implementation once:
@@ -125,19 +156,25 @@ A user story is considered ready for implementation once:
 
 > All user stories intended for the next sprint are estimated by the last estimation session before the sprint begins. This makes sure contributors have adequate time to complete the current sprint and provide accurate estimates for the next sprint.
 
+
 #### Writing a good user story
+
 Good user stories are short, with clear, unambiguous language.
 - What screen are they looking at?  (`As an observer on the host details page…`)
-- What do they want to do? (`As an observer on the host details page, I want to run a permitted query.`) 
+- What do they want to do? (`As an observer on the host details page, I want to run a permitted query.`)
 - Don't get hung up on the "so that I can ________" clause.  It is helpful, but optional.
 - Example: "As an admin I would like to be asked for confirmation before deleting a user so that I do not accidentally delete a user."
 
+
 #### Is it actually a story?
+
 User stories are small and independently valuable.
 - Is it small enough? Will this task be likely to fit in 1 sprint when estimated?
 - Is it valuable enough? Will this task drive business value when released, independent of other tasks?
 
+
 #### Defining "done"
+
 To successfully deliver a user story, the people working on it need to know what "done" means.
 
 Since the goal of a user story is to implement certain changes to the product, the "definition of done" is written and maintained by the product manager.  But ultimately, this "definition of done" involves everyone in the product group.  We all collectively rely on accuracy of estimations, astuteness of designs, and cohesiveness of changes envisioned in order to deliver on time and without fuss.
@@ -149,6 +186,7 @@ Things to consider when writing the "definition of done" for a user story:
   - **REST API:** If the Fleet API is changing, then the [REST API docs](https://fleetdm.com/docs/using-fleet/rest-api) will need to be updated.
   - **Configuration changes:** If this user story includes any changes to the way Fleet is configured, then the server configuration reference will need to be updated.
   - **Telemetry schema:** If osquery-compatible tables are changing as part of this user story, then the [telemetry data model reference](https://fleetdm.com/tables) will need to be updated.
+  - **Articles and guides:** If an article needs to be updated, make sure to also change the "publishedOn" meta tag to the date of the edit to show visitors that the information is fresh and authoritative.
   - **Other content:** What keywords should we [search for](https://github.com/fleetdm/fleet/search?q=path%3A%2Fdocs%2F+path%3A%2Farticles%2F+path%3A%2Fschema+sso&type=) to locate doc pages and articles that need updates?  List these and any other aspects/gotchas the product group should make sure are covered by the documentation.
 - **Changes to paid features or tiers:** Does this user story add or change any paid features, or modify features' tiers? If so, describe the changes that should be made to the [pricing page](https://fleetdm.com/pricing), and make sure that code for any non-free features lives in the `ee/` directory.
 - **Semantic versioning:** Does this change introduce breaking changes to Fleet's REST API or CLI usage?  If so, then we need to either figure out a crafty way to maintain backwards compatibility, or discuss a major version release with the CTO (`#help-engineering` and mention `@lukeheath`).
@@ -157,7 +195,9 @@ Things to consider when writing the "definition of done" for a user story:
 - **QA:** Changes are tested by hand prior to submitting pull requests. In addition, quality assurance will do an extra QA check prior to considering this story "done".  Any special QA notes?
 - **Follow-through:** Is there anything in particular that we should inform others (people who aren't in this product group) about after this user story is released?  For example: communication to specific customers, tips on how best to highlight this in a release post, gotchas, etc.
 
+
 #### Providing context
+
 User story issues contain an optional section called "Context".
 
 This section is optional and hidden by default.  It can be included or omitted, as time allows.  As Fleet grows as an all-remote company with more asynchronous processes across timezones, we will rely on this section more and more.
@@ -175,14 +215,18 @@ Here are some examples of questions that might be helpful to answer:
 
 These questions are helpful for the product team when considering what to prioritize.  (The act of writing the answers is a lot of the value!)  But these answers can also be helpful when users or contributors (including our future selves) have questions about how best to estimate, iterate, or refine.
 
+
 #### Initiate an air guitar session
-Anyone in the product group can initiate an air guitar session.   
+
+Anyone in the product group can initiate an air guitar session.
 
 1. Initiate: Create a user story and add the `~air-guitar` label to indicate that it is going through the air guitar process. Air guitar issues are always intended to be designed right away. If they can't be, the requestor is notified via at-mention in the issue (that person is either the CSM or AE).
 
+> An air guitar session may be used to design features that won't be delivered in the next 6 weeks.
+
 2. Prioritize: Bring the user story to [feature fest](https://fleetdm.com/handbook/product#rituals). If the user story is prioritized, proceed through the regular steps of specifying and designing as outlined in the drafting process. However, keep in mind that these are conceptual and may or may not proceed to engineering.
 
-> An air guitar session may be needed before the next feature fest. In this case, the product group PM will prioritize the user story. 
+> An air guitar session may be needed before the next feature fest. In this case, the product group PM will prioritize the user story.
 
 3. Review: Conduct an air guitar meeting where the idea or feature is discussed. Involve roles like the product manager, designer, and a sampling of engineers to provide various perspectives.
 
@@ -197,9 +241,12 @@ Anyone in the product group can initiate an air guitar session.
 
 Air guitar sessions are timeboxed to ensure they are fast and focused. Documentation from this process may inform future user stories and can be invaluable when revisiting the idea at a later stage. While the air guitar process is exploratory in nature, it should be thorough enough to provide meaningful insights and data for future decision-making.
 
+
 ### Implementing
 
+
 #### Developing from wireframes
+
 Please read carefully and [pay special attention](https://fleetdm.com/handbook/company/why-this-way#why-do-we-use-a-wireframe-first-approach) to UI wireframes.
 
 Designs have usually gone through multiple rounds of revisions, but they could easily still be overlooking complexities or edge cases! When you think you've discovered a blocker, here's how to proceed:
@@ -218,7 +265,9 @@ At Fleet, we prioritize [iteration](https://fleetdm.com/handbook/company#results
 
 After these considerations, if you still think you've found a blocker, alert the [appropriate PM](https://fleetdm.com/handbook/company/product-groups#current-product-groups) so that the user story can be brought back for [expedited drafting](https://fleetdm.com/handbook/product#expedited-drafting). Otherwise, make a [feature request](https://fleetdm.com/handbook/product#intake).
 
+
 #### Sub-tasks
+
 The simplest way to manage work is to use a single user story issue, then pass it around between contributors/asignees as seldom as possible.  But on a case-by-case basis, for particular user stories and teams, it can sometimes be worthwhile to invest additional overhead in creating separate **unestimated sub-task** issues ("sub-tasks").
 
 A user story is estimated to fit within 1 sprint and drives business value when released, independent of other stories.  Sub-tasks are not.
@@ -233,20 +282,28 @@ Sub-tasks:
 - are NOT the best place to post GitHub comments (instead, concentrate conversation in the top-level "user story" issue)
 - will NOT be looked at or QA'd by quality assurance
 
+
 ## Outages
+
 At Fleet, we consider an outage to be a situation where new features or previously stable features are broken or unusable.
 
 - Occurences of outages are tracked in the [Outages](https://docs.google.com/spreadsheets/d/1a8rUk0pGlCPpPHAV60kCEUBLvavHHXbk_L3BI0ybME4/edit#gid=0) spreadsheet.
 - Fleet encourages embracing the inevitability of mistakes and discourages blame games.
 - Fleet stresses the critical importance of avoiding outages because they make customers' lives worse instead of better.
 
+
 ## Scaling Fleet
+
 Fleet, as a Go server, scales horizontally very well. It’s not very CPU or memory intensive. However, there are some specific gotchas to be aware of when implementing new features. Visit our [scaling Fleet page](https://fleetdm.com/handbook/engineering/scaling-fleet) for tips on scaling Fleet as efficiently and effectively as possible.
 
+
 ## Load testing
+
 The [load testing page](https://fleetdm.com/handbook/engineering/load-testing) outlines the process we use to load test Fleet, and contains the results of our semi-annual load test.
 
+
 ## Version support
+
 To provide the most accurate and efficient support, Fleet will only target fixes based on the latest released version. In the current version fixes, Fleet will not backport to older releases.
 
 Community version supported for bug fixes: **Latest version only**
@@ -257,7 +314,9 @@ Premium version supported for bug fixes: **Latest version only**
 
 Premium support for support/troubleshooting: **All versions**
 
+
 ## Release testing
+
 When a release is in testing, QA should use the Slack channel #help-qa to keep everyone aware of issues found. All bugs found should be reported in the channel after creating the bug first.
 
 When a critical bug is found, the Fleetie who labels the bug as critical is responsible for following the [critical bug notification process](https://fleetdm.com/handbook/engineering#notify-community-members-about-a-critical-bug) below.
@@ -272,14 +331,16 @@ All unreleased bugs are addressed before publishing a release. Released bugs tha
   - Causes irreversible damage, such as data loss
   - Introduces a security vulnerability
 
+
 ### Notify the community about a critical bug
+
 We inform customers and the community about critical bugs immediately so they don’t trigger it themselves. When a bug meeting the definition of critical is found, the bug finder is responsible for raising an alarm. Raising an alarm means pinging @here in the `#g-mdm` or `#g-endpoint-ops` channel with the filed bug.
 
 If the bug finder is not a Fleetie (e.g., a member of the community), then whoever sees the critical bug should raise the alarm. Note that the bug finder here is NOT necessarily the **first** person who sees the bug. If you come across a bug you think is critical, but it has not been escalated, raise the alarm!
 
 Once raised, product design confirms whether or not it's critical and defines expected behavior. When outside of working hours for the product design team or if no one from product design responds within 1 hour, then fall back to the #help-p1 channel.
 
-Once the critical bug is confirmed, a [priority label](https://fleetdm.com/handbook/company/product-groups#high-priority-user-stories-and-bugs) is applied and the priority response process begins. Customer Success notifies impacted customers and the community if community features are impacted. If Customer Success is not available, the on-call engineer or infrastructure on-call engineer is responsible for this. If a quick fix workaround exists, that should be communicated as well for those who are already upgraded.
+Once the critical bug is confirmed, a [priority label](https://fleetdm.com/handbook/company/communications#high-priority-user-stories-and-bugs) is applied and the priority response process begins. Customer Success notifies impacted customers and the community if community features are impacted. If Customer Success is not available, the on-call engineer or infrastructure on-call engineer is responsible for this. If a quick fix workaround exists, that should be communicated as well for those who are already upgraded.
 
 The relevant release page on GitHub is updated to indicate that the release contains a critical bug, as shown on the [fleet-v4.45.0 release page](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.45.0).
 
@@ -287,41 +348,33 @@ When a critical bug is identified, we will then follow the patch release process
 
 > After a critical bug is fixed, [an incident postmortem](https://fleetdm.com/handbook/engineering#preform-an-incident-postmortem) is scheduled by the EM of the product group that fixed the bug.
 
+
 ## Feature fest
-To stay in-sync with our customers' needs, Fleet accepts feature requests from customers and community members on a sprint-by-sprint basis in the regular 🎁🗣 Feature Fest meeting. Anyone in the company is invited to submit requests or simply listen in on the 🎁🗣 Feature Fest meeting. Folks from the wider community can also [request an invite](https://fleetdm.com/contact). 
+
+To stay in-sync with our customers' needs, Fleet accepts feature requests from customers and community members on a sprint-by-sprint basis in the regular 🎁🗣 Feature Fest meeting. Anyone in the company is invited to submit requests or simply listen in on the 🎁🗣 Feature Fest meeting. Folks from the wider community can also [request an invite](https://fleetdm.com/contact).
 
 ### Making a request
-To make a feature request or advocate for a feature request from a customer or community member, [create an issue](https://github.com/fleetdm/fleet/issues/new/choose) using the feature request template and attend the next scheduled 🎁🗣 Feature Fest meeting. 
+To make a feature request or advocate for a feature request from a customer or community member, [create an issue](https://github.com/fleetdm/fleet/issues/new/choose) using the feature request template and attend the next scheduled 🎁🗣 Feature Fest meeting.
 
 Requests are weighed from top to bottom while prioritizing attendee requests. This means that if the individual that added a feature request is not in attendance, the feature request will be discussed towards the end of the call if there's time.
 
-To be acceptable for consideration, a request must:
-- Have a clear proposed change
-- Have a well-articulated underlying user need
-- Specify the requestor (either internal stakeholder or customer or community user)
 
-To help the product team, other pieces of information can be optionally included:
-- How would they solve the problem without any changes if pressed?
-- How does this change fit into the requester's overall usage of Fleet?
-- What other potential changes to the product have you considered?
+### How feature requests are evaluated
 
-To ensure your request appears on the ["Feature Fest" board](https://app.zenhub.com/workspaces/-feature-fest-651b2962605ba29209324c57/board):
-- Add the `~feature fest` label to your issue
-- Add the relevant customer label (if applicable) 
+Digestion of these new product ideas (requests) happens at the **🎁🗣 Feature Fest** meeting.
 
-To maximize your chances of having a feature accepted, requesters can visit the [🗣 Product office hours](#rituals) meeting to get feedback on requests prior to being accepted. 
+Before the **🎁🗣 Feature Fest** meeting, the [Customer renewals DRI](https://fleetdm.com/handbook/company/communications#directly-responsible-individuals-dris) goes through the "Inbox" column and removes customer requests that are not a high priority for the business. Stakeholders will be notified by the Customer renewals DRI.
 
-### How feature requests are evaluated
-Digestion of these new product ideas (requests) happens at the **🎁🗣 Feature Fest** meeting.
+All community and contributor requests (non-customer) are left in the inbox. A high priority customer request may be a request that's blocking a customer from getting their job done or a request that's critical for customer renewal.
 
-At the **🎁🗣 Feature Fest** meeting, the DRI (Head of Product) weighs all requests on the board. When the team weighs a request, it is immediately prioritized or put to the side.
+Before the meeting, the Feature prioritization DRI adds requests from Fleet's roadmap that are planned for the next design sprint. The quarterly roadmap is in the [OKRs spreadsheet](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit?gid=1846478041#gid=1846478041&range=393:419).
 
-Product Managers prioritize all potential product improvements worked on by Fleeties. Anyone (Fleeties, customers, and community members) are invited to suggest improvements.
+At the **🎁🗣 Feature Fest** meeting, the Feature prioritization DRI weighs all requests in the inbox. When the team weighs a request, it is immediately prioritized or put to the side (not prioritized).
 
-- A _request is prioritized_ when the DRI decides it is a priority. When this happens, the team sets the request to be estimated within five business days.
+- A _request is prioritized_ when the Feature prioritization DRI decides it is a priority.
 - A _request is put to the side_ when the business perceives competing priorities as more pressing in the immediate moment.
 
-If a feature is not prioritized during a 🎁🗣 Feature Fest meeting, it only means the feature has been rejected _at that time_. Requestors will be notified by the Head of Product, and they can resubmit their request at a future meeting.
+If a feature is not prioritized during a 🎁🗣 Feature Fest meeting, it only means the feature has been rejected _at that time_. Requestors will be notified by the Feature prioritization DRI, and they can resubmit their request at a future meeting.
 
 Requests are weighed by:
 - The completeness of the request (see [making a request](#making-a-request))
@@ -330,21 +383,17 @@ Requests are weighed by:
 - How well the request fits within Fleet's product vision and roadmap
 - Whether the feature seems like it can be designed, estimated, and developed in 6 weeks, given its individual complexity and when combined with other work already accepted
 
-### Customer feature requests 
-The product team's goal is to prioritize 16 customer feature requests at Feature Fest, then take them from settled to shipped. The customer success team is responsible for providing the Head of Product a live count during the Feature Fest meeting. Product Operations is responsible for monitoring this KPI and raising alarms throughout the design and engineering sprints. 
-> Customer stories should be estimated at 1-3 points each to count as 1 request. If a feature request spans across multiple customers, it will be counted as the number of customers involved. 
 
 ### After the feature is accepted
-After the 🎁🗣 Feature Fest meeting, Product Operations will clear the Feature Fest board as follows:
-**Prioritized features:** Remove `feature fest` label, add `:product` label, and assign the group Product Manager. 
-**Put to the side features:** Remove `feature fest` label and close the issue.
 
-Group Product Managers will then develop user stories for the prioritized features. 
+After the 🎁🗣 Feature Fest meeting, the Feature prioritization DRI  will clear the Feature Fest board as follows:
+**Prioritized features:** Remove `feature fest` label, add `:product` label, and move the issue to the "Ready" column in the drafting board. The request will then be assigned to a [Product Designer](https://fleetdm.com/handbook/company/product-groups#current-product-groups) during the "Design sprint kick-off" ritual.
+**Put to the side features:** Remove `feature fest` label and notify the requestor.
 
-> The product team's commitment to the requester is that a prioritized feature will be delivered within 6 weeks or the requester will be notified within 1 business day of the decision to de-prioritize the feature. 
+> The product team's commitment to the requester is that a prioritized feature will be delivered within 6 weeks or the requester will be notified within 1 business day of the decision to de-prioritize the feature.
 
 Potential reasons for why a feature may be de-prioritized include:
-- The work was not designed in time. Since Fleet's engineering sprints are 3 weeks each, this means that a prioritized feature has 3 weeks to be designed, approved, and estimated in order to make it to the engineering sprint. At the prioritization meeting, the perceived design complexity of proposed features will inevitably be different from the actual complexity. 
+- The work was not designed in time. Since Fleet's engineering sprints are 3 weeks each, this means that a prioritized feature has 3 weeks to be designed, approved, and estimated in order to make it to the engineering sprint. At the prioritization meeting, the perceived design complexity of proposed features will inevitably be different from the actual complexity.
   - This may be because other higher-priority design work took longer than expected or the work itself was more complex than expected
 - The was designed but was not selected for the sprint. When a new sprint starts, it is populated with bugs, features, and technical tasks. Depending on the size and quantity of non-feature work, certain features may not be selected for the sprint.
 
@@ -373,14 +422,18 @@ You can read our guide to diagnosing issues in Fleet on the [debugging page](htt
   - [In engineering](https://fleetdm.com/handbook/company/product-groups#in-engineering)
   - [Awaiting QA](https://fleetdm.com/handbook/company/product-groups#awaiting-qa)
 
+
 ### All bugs
+
 - [See on GitHub](https://github.com/fleetdm/fleet/issues?q=is%3Aissue+is%3Aopen+label%3Abug).
 
 - **Bugs opened this week:** This filter returns all "bug" issues opened after the specified date. Simply replace the date with a YYYY-MM-DD equal to one week ago. [See on GitHub](https://github.com/fleetdm/fleet/issues?q=is%3Aissue+archived%3Afalse+label%3Abug+created%3A%3E%3DREPLACE_ME_YYYY-MM-DD).
 
 - **Bugs closed this week:** This filter returns all "bug" issues closed after the specified date. Simply replace the date with a YYYY-MM-DD equal to one week ago. [See on Github](https://github.com/fleetdm/fleet/issues?q=is%3Aissue+archived%3Afalse+is%3Aclosed+label%3Abug+closed%3A%3E%3DREPLACE_ME_YYYY-MM-DD).
 
+
 #### Inbox
+
 Quickly reproducing bug reports is a [priority for Fleet](https://fleetdm.com/handbook/company/why-this-way#why-make-it-obvious-when-stuff-breaks). When a new bug is created using the [bug report form](https://github.com/fleetdm/fleet/issues/new?assignees=&labels=bug%2C%3Areproduce&template=bug-report.md&title=), it is in the "inbox" state.
 
 At this state, the bug review DRI (QA) is responsible for going through the inbox and documenting reproduction steps, asking for more reproduction details from the reporter, or asking the product team for more guidance.  QA has **1 business day** to move the bug to the next step (reproduced).
@@ -389,27 +442,33 @@ For community-reported bugs, this may require QA to gather more information from
 
 Once reproduced, QA documents the reproduction steps in the description and moves it to the reproduced state. If QA or the engineering manager feels the bug report may be expected behavior, or if clarity is required on the intended behavior, it is assigned to the group's product manager. [See on GitHub](https://github.com/fleetdm/fleet/issues?q=archived%3Afalse+org%3Afleetdm+is%3Aissue+is%3Aopen+label%3Abug+label%3A%3Areproduce+sort%3Acreated-asc+).
 
+
 #### Reproduced
+
 QA has reproduced the issue successfully. It should now be transferred to engineering.
 
-Remove the “reproduce” label, add the following labels: 
+Remove the “reproduce” label, add the following labels:
 
 1. The relevant product group (e.g. `#g-endpoint-ops`, `#g-mdm`, `#g-digital-experience`).
 3. The `~released bug` label if the bug is in a published version of Fleet, or `~unreleased bug` if it is not yet published.
-2. The `:incoming` label indicates to the EM that it is a new bug. 
-3. The `:release` label will place the bug on the team's release board. 
+2. The `:incoming` label indicates to the EM that it is a new bug.
+3. The `:release` label will place the bug on the team's release board.
 
 Once the bug is properly labeled, assign it to the [relevant engineering manager](https://fleetdm.com/handbook/company/product-groups#current-product-groups). (Make your best guess as to which team. The EM will re-assign if they think it belongs to another team.) [See on GitHub](https://github.com/fleetdm/fleet/issues?q=archived%3Afalse+org%3Afleetdm+is%3Aissue+is%3Aopen+label%3Abug+label%3A%3Aproduct%2C%3Arelease+-label%3A%3Areproduce+sort%3Aupdated-asc+).
 
 > **Fast track for Fleeties:** Fleeties do not have to wait for QA to reproduce the bug. If you're confident it's reproducible, it's a bug, and the reproduction steps are well-documented, it can be moved directly to the reproduced state.
 
+
 #### In product drafting (as needed)
+
 If a bug requires input from product the `:product` label is added, the `:release` label is removed, and the PM is assigned to the issue. It will stay in this state until product closes the bug, or removes the `:product` label and assigns to an EM.
 
-#### In engineering 
+
+#### In engineering
+
 A bug is in engineering after it has been reproduced and assigned to an EM. If a bug meets the criteria for a [critical bug](https://fleetdm.com/handbook/engineering#critical-bugs), the `~critical bug` label is added, and the EM follows the [critical bug notification process](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Releasing-Fleet.md#critical-bug-notification-process).
 
-During daily standup, the EM will filter the board to only `:incoming` bugs and review with the team. The EM will remove the `:incoming` label, prioritize the bug in the "Ready" coulmn, unassign themselves, and assign an engineer or leave it unassigned for the first available engineer.  
+During daily standup, the EM will filter the board to only `:incoming` bugs and review with the team. The EM will remove the `:incoming` label, prioritize the bug in the "Ready" coulmn, unassign themselves, and assign an engineer or leave it unassigned for the first available engineer.
 
 When fixing the bug, if the proposed solution requires changes that would affect the user experience (UI, API, or CLI), notify the EM and PM to align on the acceptability of the change.
 
@@ -423,50 +482,36 @@ For Endpoint ops support on MDM bugs:
 - Remove the `#g-mdm` label and add `#g-endpoint-ops` label.
 - Add `~assisting g-mdm` to clarify the bug’s origin.
 
-Fleet [always prioritizes bugs](https://fleetdm.com/handbook/product#prioritizing-improvements). 
-
-#### Awaiting QA
-Bugs will be verified as fixed by QA when they are placed in the "Awaiting QA" column of the relevant product group's sprint board. If the bug is verified as fixed, it is moved to the "Ready for release" column of the sprint board. Otherwise, the remaining issues are noted in a comment, and it is moved back to the "In progress" column of the sprint board.
-
-## High priority user stories and bugs
-All issues are treated as standard priority by default. Some issues are assigned a priority label to indicate the level of urgency.
-
-- Emergency: `P0`
-  - Examples: Customer outage, confirmed security vulnerability ([critical bug](https://fleetdm.com/handbook/company/product-groups#release-testing)), a new feature is needed to address an immediate Fleet emergency.
-  - Response: Immediately stop other work to swarm the issue. Work 24/7 in shifts until resolved.
-  - Impact: Significant impact. May void current sprint.
+Fleet [always prioritizes bugs](https://fleetdm.com/handbook/product#prioritizing-improvements).
 
-- Critical: `P1`
-  - Examples: A supported workflow is broken ([critical bug](https://fleetdm.com/handbook/company/product-groups#release-testing)), a potential security vulnerability, a new feature is required to address an immediate critical Fleet need.
-  - Response: Issue brought to next standup for estimation and immediately brought into the sprint. Necessary team members are assigned as their top priority.
-  - Impact: High impact. Does not void sprint, but reduces overall velocity and requires deprioritizing other work.
 
-- Urgent: `P2`
-  - Examples: A supported workflow is not functioning as intended, a newly drafted feature has an associated urgent Fleet need.
-  - Response: Issue is prioritized at the top of the next sprint. If opporunity cost of waiting for the next sprint is too high, it may be considered for current sprint.
-  - Impact: Low to medium impact. If prioritized into current sprint, may reduce overall velocity and require deprioritizing other work.
+#### Awaiting QA
 
-Add as much context as possible to the issue description and assign labels to help the team understand the problem and what is driving the urgency. All issues with a `P0`, `P1`, or `P2` label should be assigned to the [DRI for what goes in a release](https://fleetdm.com/handbook/company/communications#directly-responsible-individuals-dris). For immediate action, follow up on Slack or by phone.
+Bugs will be verified as fixed by QA when they are placed in the "Awaiting QA" column of the relevant product group's sprint board. If the bug is verified as fixed, it is moved to the "Ready for release" column of the sprint board. Otherwise, the remaining issues are noted in a comment, and it is moved back to the "In progress" column of the sprint board.
 
-Once the release DRI is aware of the issue, they will adjust the labels as needed and assign to the PM and EM of the appropriate product group. If they disagree with the priority label applied to the issue, they will contact the requestor to discuss further.
 
 ## How to reach the developer on-call
+
 Oncall engineers do not need to actively monitor Slack channels, except when called in by the Community or Customer teams. Members of those teams are instructed to `@oncall` in `#help-engineering` to get the attention of the on-call engineer to continue discussing any issues that come up. In some cases, the Community or Customer representative will continue to communicate with the requestor. In others, the on-call engineer will communicate directly (team members should use their judgment and discuss on a case-by-case basis how to best communicate with community members and customers).
 
+
 ### The developer on-call rotation
+
 See [the internal Google Doc](https://docs.google.com/document/d/1FNQdu23wc1S9Yo6x5k04uxT2RwT77CIMzLLeEI2U7JA/edit#) for the engineers in the rotation.
 
 Fleet team members can also subscribe to the [shared calendar](https://calendar.google.com/calendar/u/0?cid=Y181MzVkYThiNzMxMGQwN2QzOWEwMzU0MWRkYzc5ZmVhYjk4MmU0NzQ1ZTFjNzkzNmIwMTAxOTllOWRmOTUxZWJhQGdyb3VwLmNhbGVuZGFyLmdvb2dsZS5jb20) for calendar events.
 
-New developers are added to the on-call rotation by their manager after they have completed onboarding and at least one full release cycle. We aim to alternate the rotation between product groups when possible. 
+New developers are added to the on-call rotation by their manager after they have completed onboarding and at least one full release cycle. We aim to alternate the rotation between product groups when possible.
 
 > The on-call rotation may be adjusted with approval from the EMs of any product groups affected. Any changes should be made before the start of the sprint so that capacity can be planned accordingly.
 
+
 ### Developer on-call responsibilities
+
 - **Second-line response**
 The on-call developer is a second-line responder to questions raised by customers and community members.
 
-The on-call developer is responsible for the first response to community pull requests. 
+The on-call developer is responsible for the first response to community pull requests.
 
 Customer Support Engineers are responsible for the first response to Slack messages in the [#fleet channel](https://osquery.slack.com/archives/C01DXJL16D8) of osquery Slack, and other public Slacks. The Customer Success group is responsible for the first response to messages in private customer Slack channels.
 
@@ -491,7 +536,9 @@ Fleet's documentation for contributors can be found in the [Fleet GitHub repo](h
 
 The on-call developer is asked to read, understand, test, correct, and improve at least one doc page per week. Our goal is to 1, ensure accuracy and verify that our deployment guides and tutorials are up to date and work as expected. And 2, improve the readability, consistency, and simplicity of our documentation – with empathy towards first-time users. See [Writing documentation](https://fleetdm.com/handbook/marketing#writing-documentation) for writing guidelines, and don't hesitate to reach out to [#g-digital-experience](https://fleetdm.slack.com/archives/C01GQUZ91TN) on Slack for writing support. A backlog of documentation improvement needs is kept [here](https://github.com/fleetdm/fleet/issues?q=is%3Aopen+is%3Aissue+label%3A%22%3Aimprove+documentation%22).
 
+
 ### Escalations
+
 When the on-call developer is unsure of the answer, they should follow this process for escalation.
 
 To achieve quick "first-response" times, you are encouraged to say something like "I don't know the answer and I'm taking it back to the team," or "I think X, but I'm confirming that with the team (or by looking in the code)."
@@ -502,21 +549,16 @@ How to escalate:
 
 2. Create a new thread in the [#help-engineering channel](https://fleetdm.slack.com/archives/C019WG4GH0A), tagging `@lukeheath` and provide the information turned up in your research. Please include possibly relevant links (even if you didn't find what you were looking for there). Luke will work with you to craft an appropriate answer or find another team member who can help.
 
+
 ### Changing of the guard
+
 The on-call developer changes each week on Wednesday.
 
 A Slack reminder should notify the on-call of the handoff. Please do the following:
 
-1. The new on-call developer should change the `@oncall` alias in Slack to point to them. In the
-   search box, type "people" and select "People & user groups." Switch to the "User groups" tab.
-   Click `@oncall`. In the right sidebar, click "Edit Members." Remove the former on-call, and add
-   yourself.
+1. The new on-call developer should change the `@oncall` alias in Slack to point to them. In the search box, type "people" and select "People & user groups." Switch to the "User groups" tab. Click `@oncall`. In the right sidebar, click "Edit Members." Remove the former on-call, and add yourself.
 
-2. Hand off newer conversations (Slack threads, issues, PRs, etc.). For more recent threads, the former on-call can unsubscribe from the thread, and the new on-call should subscribe. The former on-call should explicitly share each of
-   these threads and the new on-call can select "Get notified about new replies" in the "..." menu.
-   The former on-call can select "Turn off notifications for replies" in that same menu. It can be
-   helpful for the former on-call to remain available for any conversations they were deeply involved
-   in, so use your judgment on which threads to hand off. Anything not clearly handed off remains the responsibility of the former on-call developer.
+2. Hand off newer conversations (Slack threads, issues, PRs, etc.). For more recent threads, the former on-call can unsubscribe from the thread, and the new on-call should subscribe. The former on-call should explicitly share each of these threads and the new on-call can select "Get notified about new replies" in the "..." menu. The former on-call can select "Turn off notifications for replies" in that same menu. It can be helpful for the former on-call to remain available for any conversations they were deeply involved in, so use your judgment on which threads to hand off. Anything not clearly handed off remains the responsibility of the former on-call developer.
 
 In the Slack reminder thread, the on-call developer includes their retrospective. Please answer the following:
 
@@ -526,7 +568,9 @@ In the Slack reminder thread, the on-call developer includes their retrospective
 
 3. How did you spend the rest of your on-call week? This is a chance to demo or share what you learned.
 
-## Wireframes 
+
+## Wireframes
+
 - Showing these principles and ideas, to help remember the pros and cons and conceptualize the above visually.
 - Figma: [⚗️ Fleet product project](https://www.figma.com/files/project/17318630/%E2%9A%97%EF%B8%8F-Fleet-product?fuid=1234929285759903870)
 
@@ -540,6 +584,10 @@ Use the 🧩 ["Design System (current)"](https://www.figma.com/file/8oXlYXpgCV1S
 
 Use `---`, with color `$ui-fleet-black-50` as the default UI for empty columns.
 
+**Images**
+
+Simple icons (aka any images used in the icon [design system component](https://www.figma.com/design/8oXlYXpgCV1Sn4ek7OworP/%F0%9F%A7%A9-Design-system-(current)?node-id=12-2&t=iO2vXbQ9Sc1kFVEJ-1)) are exported as SVGs. All other images are exported as PNGs, following the [Fleet website image](https://github.com/fleetdm/fleet/tree/main/website/assets/images) naming conventions.
+
 **Form behavior**
 
 Pressing the return or enter key with an open form will cause the form to be submitted.
@@ -556,7 +604,7 @@ When including an external link, specify a [redirect on fleetdm.com](https://git
 
 **Tooltips**
 
-All tooltips change the cursor to a question mark on hover. All tooltips have a solid background color. 
+All tooltips change the cursor to a question mark on hover. All tooltips have a solid background color.
 
 There are two types of tooltips. The two types of tooltips have some unique styles:
 
@@ -595,13 +643,16 @@ When writing copy for CLI help pages use the following descriptions:
 $ fleetctl <command with --hosts/--host flag> -h
 
 OPTIONS
---hosts     Hosts specified by hostname, uuid, osquery_host_id or node_key that you want to target.     
---host      Host specified by hostname, uuid, osquery_host_id or node_key that you want to target.     
+--hosts     Hosts specified by hostname, uuid, osquery_host_id or node_key that you want to target.
+--host      Host specified by hostname, uuid, osquery_host_id or node_key that you want to target.
 ```
 
+
 ## Meetings
 
+
 ### User story discovery
+
 User story discovery meetings are scheduled as needed to align on large or complicated user stories. Before a discovery meeting is scheduled, the user story must be prioritized for product drafting and go through the design and specification process. When the user story is ready to be estimated, a user story discovery meeting may be scheduled to provide more dedicated, synchronous time for the team to discuss the user story than is available during weekly estimation sessions.
 
 All participants are expected to review the user story and associated designs and specifications before the discovery meeting.
@@ -621,8 +672,10 @@ All participants are expected to review the user story and associated designs an
 - Software Engineers: Clarifying questions and implementation details
 - Product Quality Specialist: Testing plan
 
+
 ### Design consultation
-Design consultations are scheduled as needed with the relevant participants, typically product designers and frontend engineers. It is an opportunity to collaborate and discuss design, implementation, and story requirements. The meeting is scheduled as needed by the product designer or frontend engineer when a user story is in the "Prioritized" column on the [drafting board](https://app.zenhub.com/workspaces/-drafting-ships-in-6-weeks-6192dd66ea2562000faea25c/board). 
+
+Design consultations are scheduled as needed with the relevant participants, typically product designers and frontend engineers. It is an opportunity to collaborate and discuss design, implementation, and story requirements. The meeting is scheduled as needed by the product designer or frontend engineer when a user story is in the "Prioritized" column on the [drafting board](https://app.zenhub.com/workspaces/-drafting-ships-in-6-weeks-6192dd66ea2562000faea25c/board).
 
 **Participants:**
 - Product Designer
@@ -631,30 +684,40 @@ Design consultations are scheduled as needed with the relevant participants, typ
 **Sample agenda**
 - Review user story requirements
 - Review wireframes
-- Discuss design input 
+- Discuss design input
 - Discuss implementation details
 
+
 ### Design reviews
-Design reviews are conducted daily between the [Head of Product Design](https://fleetdm.com/handbook/product-design#team) and contributors proposing changes to Fleet's interfaces, such as the graphical user interface (GUI) or REST API.  This fast cadence shortens the feedback loop, makes progress visible, and encourages early feedback.  This helps Fleet stay intentional about how the product is designed and minimize common issues like UI inconsistencies or accidental breaking changes to the API.
 
-Product designers or other contributors come prepared to this meeting with their proposed changes in a GitHub issue.  Usually these are in the form of Figma wireframes, a pull request to the API docs showing changes, or a demo of a prototype.  The Head of Product Design and other participants review the changes quickly and give feedback, and then the contributor applies revisions and attends again the next day or as soon as possible for another go-round.  The Head of Product Design is responsible for looping in the right engineers, community members, and other subject-matter experts to iterate on and refine upcoming product changes in the best interest of the business.
+Design reviews are conducted daily between the [Head of Product Design](https://fleetdm.com/handbook/product-design#team), [CTO](https://fleetdm.com/handbook/engineering#team), and contributors (most often Product Designers) proposing changes to Fleet's interfaces, such as the graphical user interface (GUI) or REST API.  This fast cadence shortens the feedback loop, makes progress visible, and encourages early feedback. This helps Fleet stay intentional about how the product is designed and minimize common issues like UI inconsistencies or accidental breaking changes to the API.
+
+Design reviews operate in "Feedback" mode on Mondays and "Final review" mode all other days of the week:
+  - **Feedback** mode — contributor knows the design is not ready for final review, but would like to get early feedback. Anyone at Fleet can attend and provide feedback.
+  - **Final review** mode — contributor is 70% sure the design is 100% done. Only Head of Product Design + CTO + Product Designers give feedback. Anyone at Fleet can attend as a shadow. This helps the team iterate and move designs to ready for dev faster. 
+
+> In addition to design reviews, Fleeties or community member can provide feedback asynchronously at any time by finding the GitHub issue (user story) associated with the designs and @ mentioning the assigned Product Designer in the comment section.
+
+Product Designers or other contributors come prepared to this meeting with their proposed changes in a GitHub issue.  Usually these are in the form of Figma wireframes, a pull request to the API docs showing changes, or a demo of a prototype.  
+
+After the meeting, the contributor applies revisions and attends again the next day or as soon as possible for another go-round.  The Head of Product Design is responsible for looping in the right engineers, community members, and other subject-matter experts to iterate on and refine upcoming product changes in the best interest of the business.
 
 Here are some tips for making this meeting effective:
-- Bring 1 key engineer who has been helping out with the user story, when possible and helpful.
 - Say the user story out loud to remind participants of what it is.
-- At the beginning of describing your change, indicate whether you are 70% sure you are 100% done, or are looking for early feedback.
 - Avoid explaining or showing multiple ways it could work.  Show the one way you think it should work and let your work speak for itself.
 - For follow-ups, repeat the user story, but show only what has changed or been added since the last review.
+- Bring 1 key engineer who has been helping out with the user story, when possible and helpful.
 - Read Fleet's [best practices for meetings](https://fleetdm.com/handbook/company/communications#meetings).
 
-> To allow for asynchronous participation, instead of attending, contributors can alternatively choose to add an agenda item to the "Product design review" meeting with a GitHub link.  Then, the Head of Product Design will review during the meeting and provide feedback.  Every "Product design review" is recorded and automatically transcribed to a Google Doc so that it is searchable by every Fleet team member.
-
 ### Weekly bug review
+
 QA has weekly check-in with product to go over the inbox items. QA is responsible for proposing “not a bug”, closing due to lack of response (with a nice message), or raising other relevant questions. All requires product agreement
 
 QA may also propose that a reported bug is not actually a bug. A bug is defined as “behavior that is not according to spec or implied by spec.” If agreed that it is not a bug, then it's assigned to the relevant product manager to determine its priority.
 
+
 ### Group weeklies
+
 A chance for deeper, synchronous discussion on topics relevant across product groups like “Frontend weekly”, “Backend weekly”, etc.
 
 **Participants:** Anyone who wishes to participate.
@@ -664,7 +727,9 @@ A chance for deeper, synchronous discussion on topics relevant across product gr
 - Review difficult frontend bugs
 - Write engineering-initiated stories
 
+
 ### Eng Together
+
 This meeting is to disseminate engineering-wide announcements, promote cohesion across groups within the engineering team, and connect with engineers (and the "engineering-curious") in other departments. Held monthly for one hour.
 
 **Participants:** Everyone at the company is welcome to attend. All engineers are asked to attend. The subject matter is focused on engineering.
@@ -678,31 +743,39 @@ This meeting is to disseminate engineering-wide announcements, promote cohesion
 - Social
   - Structured and/or unstructured social activities
 
+
 ## Development best practices
+
 - Remember the user.  What would you do if you saw that error message? [🔴](https://fleetdm.com/handbook/company#empathy)
 - Communicate any blockers ASAP in your group Slack channel or standup. [🟠](https://fleetdm.com/handbook/company#ownership)
 - Think fast and iterate.  [🟢](https://fleetdm.com/handbook/company#results)
 - If it probably works, assume it's still broken.  Assume it's your fault.  [🔵](https://fleetdm.com/handbook/company#objectivity)
 - Speak up and have short toes.  Write things down to make them complete. [🟣](https://fleetdm.com/handbook/company#openness)
 
+
 ## Product design conventions
-Behind every [wireframe at Fleet](https://fleetdm.com/handbook/company/why-this-way#why-do-we-use-a-wireframe-first-approach), there are 3 foundational design principles:  
+
+Behind every [wireframe at Fleet](https://fleetdm.com/handbook/company/why-this-way#why-do-we-use-a-wireframe-first-approach), there are 3 foundational design principles:
 
 - **Use-case first.** Taking advantage of top-level features vs. per-platform options allows us to take advantage of similarities and avoid having two different ways to configure the same thing.
 Start off cross-platform for every option, setting, and feature. If we **prove** it's impossible, _then_ work backward making it platform-specific.
 
 - **Bridge the gap.** Implement enough help text, links, guides, gifs, etc that a reasonably persistent human being can figure it out just by trying to use the UI.
-   Even if that means we have fewer features or slightly lower granularity (we can iterate and add more granularity later), make it easy enough to understand. Whether they're experienced Mac admins people or career Windows folks (even if someone has never used a Windows tool) they should _"get it"_. 
+   Even if that means we have fewer features or slightly lower granularity (we can iterate and add more granularity later), make it easy enough to understand. Whether they're experienced Mac admins people or career Windows folks (even if someone has never used a Windows tool) they should _"get it"_.
 
 - **Control the noise.** Bring the needs surface level, tuck away things you don't need by default (when possible, given time). For example, hide Windows controls if there are no Windows devices (based on number of Windows hosts).
 
+
 ## Scrum at Fleet
+
 Fleet product groups employ scrum, an agile methodology, as a core practice in software development. This process is designed around sprints, which last three weeks to align with our release cadence.
 
 New tickets are estimated, specified, and prioritized on the roadmap:
 - [Roadmap](https://app.zenhub.com/workspaces/-roadmap-ships-in-6-weeks-6192dd66ea2562000faea25c/board)
 
+
 ### Scrum items
+
 Our scrum boards are exclusively composed of four types of scrum items:
 
 1. **User stories**: These are simple and concise descriptions of features or requirements from the user's perspective, marked with the `story` label. They keep our focus on delivering value to our customers. Occasionally, due to ZenHub's ticket sub-task structure, the term "epic" may be seen. However, we treat these as regular user stories.
@@ -715,26 +788,34 @@ Our scrum boards are exclusively composed of four types of scrum items:
 
 > Our sprint boards do not accommodate any other type of ticket. By strictly adhering to these four types of scrum items, we maintain an organized and focused workflow that consistently adds value for our users.
 
+
 ## Sprints
+
 Sprints align with Fleet's [3-week release cycle](https://fleetdm.com/handbook/company/why-this-way#why-a-three-week-cadence).
 
-On the first day of each release, all estimated issues are moved into the relevant section of the new "Release" board, which has a kanban view per group. 
+On the first day of each release, all estimated issues are moved into the relevant section of the new "Release" board, which has a kanban view per group.
 
 Sprints are managed in [Zenhub](https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible). To plan capacity for a sprint, [create a "Sprint" issue](https://github.com/fleetdm/confidential/issues/new/choose), replace the fake constants with real numbers, and attach the appropriate labels for your product group.
 
+
 ### Sprint numbering
+
 Sprints are numbered according to the release version. For example, for the sprint ending on June 30th, 2023, on which date we expect to release Fleet v4.34, the sprint is called the 4.34 sprint.
 
+
 ### Sprint ceremonies
+
 Each sprint is marked by five essential ceremonies:
 
 1. **Sprint kickoff**: On the first day of the sprint, the team, along with stakeholders, select items from the backlog to work on. The team then commits to completing these items within the sprint.
-2. **Daily standup**: Every day, the team convenes for updates. During this session, each team member shares what they accomplished since the last standup, their plans until the next meeting, and any blockers they are experiencing. Standups should last no longer than fifteen minutes. If additional discussion is necessary, it takes place after the standup with only the required partipants. 
+2. **Daily standup**: Every day, the team convenes for updates. During this session, each team member shares what they accomplished since the last standup, their plans until the next meeting, and any blockers they are experiencing. Standups should last no longer than fifteen minutes. If additional discussion is necessary, it takes place after the standup with only the required partipants.
 3. **Weekly estimation sessions**: The team estimates backlog items once a week (three times per sprint). These sessions help to schedule work completion and align the roadmap with business needs. They also provide estimated work units for upcoming sprints. The EM is responsible for the point values assigned to each item and ensures they are as realistic as possible.
 4. **Sprint demo**: On the last day of each sprint, all engineering teams and stakeholders come together to review the next release. Engineers are allotted 3-10 minutes to showcase features, improvements, and bug fixes they have contributed to the upcoming release. We focus on changes that can be demoed live and avoid overly technical details so the presentation is accessible to everyone. Features should show what is capable and bugs should identify how this might have impacted existing customers and how this resolution fixed that. (These meetings are recorded and posted publicly to YouTube or other platforms, so participants should avoid mentioning customer names.  For example, instead of "Fastly", you can say "a publicly-traded hosting company", or use the [customer's codename](https://fleetdm.com/handbook/customers#customer-codenames).)
 5. **Sprint retrospective**: Also held on the last day of the sprint, this meeting encourages discussions among the team and stakeholders around three key areas: what went well, what could have been better, and what the team learned during the sprint.
 
+
 ## Outside contributions
+
 [Anyone can contribute](https://fleetdm.com/handbook/company#openness) at Fleet, from inside or outside the company.  Since contributors from the wider community don't receive a paycheck from Fleet, they work on whatever they want.
 
 Many open source contributions that start as a small, seemingly innocuous pull request come with lots of additional [unplanned work](https://fleetdm.com/handbook/company/development-groups#planned-and-unplanned-changes) down the road: unforseen side effects, documentation, testing, potential breaking changes, database migrations, [and more](https://fleetdm.com/handbook/company/development-groups#defining-done).
@@ -746,11 +827,13 @@ Thus, to ensure consistency, completeness, and secure development practices, no
 The following stubs are included only to make links backward compatible
 
 ##### Endpoint ops group
-Please see [handbook/company/product-groups#endpoint-ops-group](https://fleetdm.com/handbook/company/product-groups#endpoint-ops-group)
+Please see [handbook/company/product-groups/endpoint-ops-group](https://fleetdm.com/handbook/company/product-groups#endpoint-ops-group)
 
 ##### Air guitar
 Please see [handbook/company/initiate-an-air-guitar-session](https://fleetdm.com/handbook/company/product-groups#initiate-an-air-guitar-session)
 
+##### High priority user stories and bugs
+Please see [handbook/company/communications/high-priority-user-stories-and-bugs](https://fleetdm.com/handbook/company/communications#high-priority-user-stories-and-bugs)
 
 <meta name="maintainedBy" value="mikermcneil">
 <meta name="title" value="🛩️ Product groups">
diff --git a/handbook/company/testimonials.yml b/handbook/company/testimonials.yml
index b53139b13476..909daf02e3b8 100644
--- a/handbook/company/testimonials.yml
+++ b/handbook/company/testimonials.yml
@@ -9,6 +9,27 @@
 #.  productCategories: [Endpoint operations, Vulnerability management, Device management]
 #
 # TODO figure out what to do with this other quote that both Austin and Dre :+1:'d: "Fleet lets us be more actionable with fewer people. It helps us to filter out the noise better than we could with the other big name products we replaced."
+-
+  quote: Yes Sir. Great tools for the everyday open-source geeks 💯
+  quoteAuthorName: Alvaro Gutierrez
+  quoteAuthorProfileImageFilename: testimonial-authour-alvaro-gutierrez-100x100@2x.png
+  quoteLinkUrl: https://www.linkedin.com/in/aantoniogutierrez/
+  quoteAuthorJobTitle: Technology Evangelist
+  productCategories: [Endpoint operations]
+-
+  quote: Fleet / osquery are some of my favorite open source detection tooling.
+  quoteAuthorName: Joe Pistone
+  quoteAuthorProfileImageFilename: testimonial-author-joe-pistone-100x100@2x.png
+  quoteLinkUrl: https://www.linkedin.com/in/josephpistone/
+  quoteAuthorJobTitle: Manager, Security Operations
+  productCategories: [Endpoint operations]
+-
+  quote: I had to answer some really complex questions for a compliance audit, and I was able to do it in about 15 minutes by munging some data together via a few queries into a csv. It took me longer to remember how to use `xsv` than to actually put together the report. If you aren't using osquery in your environment, you should be.
+  quoteAuthorName: Charles Zaffery
+  quoteAuthorProfileImageFilename: testimonial-author-charles-zaffery-48x48@2x.png
+  quoteLinkUrl: https://www.linkedin.com/in/charleszaffery/
+  quoteAuthorJobTitle: Principle Computer Janitor
+  productCategories: [Vulnerability management]
 -
   quote: The visibility down into the assets covered by the agent is phenomenal. Fleet has become the central source for a lot of things.
   quoteAuthorName: Andre Shields
@@ -120,15 +141,6 @@
   quoteAuthorProfileImageFilename: testimonial-author-dhruv-majumdar-48x48@2x.png
   quoteAuthorJobTitle: Director Of Cyber Risk & Advisory
   productCategories: [Vulnerability management, Endpoint operations]
--
-  quote: When we look at vendors, we look for ones that are very receptive to feedback, where you’re just part of the family, I guess. Fleet’s really good at that.
-  quoteImageFilename: logo-deputy-118x28@2x.png
-  quoteAuthorName: Harrison Ravazzolo
-  quoteAuthorProfileImageFilename: testimonial-author-harrison-ravazzolo-48x48@2x.png
-  quoteLinkUrl: https://www.linkedin.com/in/harrison-ravazzolo/
-  quoteAuthorJobTitle: Lead platform and identity engineer
-  youtubeVideoUrl: https://www.youtube.com/watch?v=5W0q5yQE3R0
-  productCategories: [Endpoint operations]
 -
   quote: Fleet has such a huge amount of use cases. My goal was to get telemetry on endpoints, but then our IR team, our TBM team, and multiple other folks in security started heavily utilizing the system in ways I didn’t expect. It spread so naturally, even our corporate and infrastructure teams want to run it.
   quoteAuthorName: Charles Zaffery
diff --git a/handbook/company/why-this-way.md b/handbook/company/why-this-way.md
index da8748cd092c..189eb4aa3983 100644
--- a/handbook/company/why-this-way.md
+++ b/handbook/company/why-this-way.md
@@ -12,6 +12,7 @@ Here are some of Fleet's decisions about the best way to work, and the reasoning
 
 
 ## Why open source?
+
 Fleet's source code, website, documentation, company handbook, and internal tools are [public](https://github.com/fleetdm/fleet) and accessible to everyone, including engineers, executives, and end users. (Even [paid features](https://fleetdm.com/pricing) are source-available.)
 
 Meanwhile, the [company behind Fleet](https://twitter.com/fleetctl) is built on the [open-core](https://www.heavybit.com/library/video/commercial-open-source-business-strategies) business model.  Openness is one of our core [values](https://fleetdm.com/handbook/company#values), and everything we do is [public by default](https://handbook.gitlab.com/handbook/values/#public-by-default).  Even the [company handbook](https://fleetdm.com/handbook) is open to the world.
@@ -31,6 +32,7 @@ Here are some of the reasons we build in the open:
 
 
 ## Why handbook-first strategy?
+
 The Fleet handbook provides team members with up-to-date information about how to do things in the company. 
 
 At Fleet, we make changes to the handbook first.  That means, before any change to how we run the business is "live" or "official", it is first changed in the relevant [handbook pages](https://fleetdm.com/handbook) and [issue templates](https://github.com/fleetdm/confidential/tree/main/.github/ISSUE_TEMPLATE).
@@ -43,6 +45,7 @@ To contribute to the handbook, click "Edit this page" and make your [edits in Ma
 
 
 ## Why read documentation?
+
 There are three reasons for visiting [the docs](https://fleetdm.com/docs):
 - **Tire-kicking**: "I think this is cool, now is it something that I could ACTUALLY use? Does it ACTUALLY work? What all's in it?  What links can I share with my colleagues to help them see what I'm seeing?"
 - **Committed learning**: "I've decided to learn this. I need a curriculum to get me there; with content that makes it as easy as possible, surface-level as possible. I want to learn how Fleet works and how to do all the things."
@@ -61,6 +64,7 @@ Everyone [can contribute](https://fleetdm.com/handbook/company#openness) to Flee
 <!-- 🔌🚪🪟 -->
 
 ## Why the emphasis on training?
+
 Investing in people and providing generous, prioritized training, especially up front, helps contributors understand what is going on at Fleet. By making training a prerequisite at Fleet, we can:
 - help team members feel confident in the better decisions they make at work. 
 - create a culture of helping others, which results in team members feeling more comfortable even if they aren’t familiar with the osquery, security, startup, or IT space. 
@@ -74,6 +78,7 @@ Here are a few examples of how Fleet prioritizes training:
 
 
 ## Why direct responsibility?
+
 Like Apple and GitLab, Fleet uses the concept of [directly responsible individuals (DRIs)](https://about.gitlab.com/handbook/people-group/directly-responsible-individuals/) to know who is responsible for what. 
 
 DRIs help us collaborate efficiently by knowing exactly who is responsible and can make decisions about the work they're doing.  This saves time by eliminating a requirement for consensus decisions or political presenteeism, enables faster decision-making, and ensures a single individual is aware of what to do next.
@@ -85,9 +90,8 @@ DRIs help us collaborate efficiently by knowing exactly who is responsible and c
 - **Multiple maintainers**: In some cases, multiple subject-matter experts called "maintainers" can merge changes to certain file paths, even though there is already a dedicated DRI configured as the "CODEOWNER".  For examples of this, see the auto-approval flows configured as `sails.config.custom.githubRepoMaintainersByPath` and related configuration in [`website/config/custom.js`](https://github.com/fleetdm/fleet/blob/main/website/config/custom.js).
 
 
-
-
 ## Why do we use a wireframe-first approach?
+
 Wireframing (usually as part of what Fleet calls ["drafting"](https://fleetdm.com/handbook/company/development-groups#making-changes)) provides a clear overview of page layout, information architecture, user flow, and functionality. The [wireframe-first approach](https://speakerdeck.com/mikermcneil/i-love-apis?slide=28) extends beyond what users see on their screens. Wireframe-first is also excellent for drafting APIs, config settings, CLI options, and even business processes.
 
 It's design thinking, applied to software development.
@@ -109,8 +113,8 @@ Here's why Fleet uses a wireframe-first approach:
 - While the "wireframe first" practice is [still sometimes misunderstood](https://about.gitlab.com/handbook/product-development-flow/#but-wait-isnt-this-waterfall), today many modern high-performing teams now use a [wireframe-first methodology](https://speakerdeck.com/mikermcneil/i-love-apis), including [startups](https://www.forbes.com/sites/danwoods/2015/10/19/dont-get-ubered-apis-hold-key-to-digital-transformation/?sh=50112fea182c#:~:text=One%20recommendation%20that,deep%20experience) and [publicly-traded companies](https://about.gitlab.com/handbook/product-development-flow/#validation-phase-3-design).
 
 
-
 ## Why do we use one repo?
+
 At Fleet, we keep everything in one repo ([`fleetdm/fleet`](https://github.com/fleetdm/fleet)). Here's why:
 
 - One repo is easier to manage. It has less surface area for keeping content up to date and reduces the risk of things getting lost and forgotten.
@@ -138,8 +142,8 @@ Besides the exceptions above, Fleet does not use any other repositories.  Other
 > _**Tip:** In addition to the built-in search available for the public handbook on fleetdm.com, you can also [search any public AND non-public content, including issue templates, at the same time](https://github.com/search?q=org%3Afleetdm+path%3A.github%2FISSUE_TEMPLATE+path%3Ahandbook%2F+path%3Adocs%2F+foo&type=code)._
 
 
-
 ## Why not continuously generate REST API reference docs from javadoc-style code comments?
+
 Here are a few of the drawbacks that we have experienced when generating docs via tools like Swagger or OpenAPI, and some of the advantages of doing it by hand with Markdown.
 
 - Markdown gives us more control over how the docs are compiled, what annotations we can include, and how we [present the information to the end-user](https://x.com/wesleytodd/status/1769810305448616185?s=46&t=4_cwTxqV5IXDLBvCm8KI6Q). 
@@ -153,12 +157,14 @@ Here are a few of the drawbacks that we have experienced when generating docs vi
 
 
 ## Why group Slack channels?
+
 Groups (`g-*`) are organized around goals. Connecting people with the same goals helps them produce better results by fostering freer communication. Some groups align with teams in the org chart.  Other groups, such as [product groups](https://fleetdm.com/handbook/company/development-groups), are cross-functional, with some group members who do not report to the same manager.
 
 Every group at Fleet maintains their own Slack channel, which all group members join and keep unmuted.  Everyone else at Fleet is encouraged to mute these channels, using them only as needed.  Each channel has a directly responsible individual responsible for keeping up with all new messages, even if they aren't explicitly mentioned (`@`).
 
 
 ## Why make work visible?
+
 Work is tracked in [GitHub issues](https://github.com/issues?q=archived%3Afalse+org%3Afleetdm+is%3Aissue+is%3Aopen+).
 
 Every department organizes their work into [team-based kanban boards](https://app.zenhub.com/workspaces/-g-business-operations-63f3dc3cc931f6247fcf55a9/board?sprints=none).  This provides a consistent framework for how every team works, plans, and requests things from each other.
@@ -167,7 +173,9 @@ Every department organizes their work into [team-based kanban boards](https://ap
 2. **Planning:** Give the team's manager and other team members a way to plan the [next three-week iteration](https://fleetdm.com/handbook/company/why-this-way#why-a-three-week-cadence) of what the team is working on.  Provide a world (the kanban board) where the team has clarity, and the appropriate [DRI](https://fleetdm.com/handbook/company#why-direct-responsibility) can confidently [prioritize and plan changes](https://fleetdm.com/handbook/company/development-groups#planned-and-unplanned-changes) with enough context to make the right decisions.
 3. **Shared to-do list:** What should I work on next? Who needs help? What important work is blocked? Is that bug fix merged yet? When will it be released? When will that new feature ship? What did I do yesterday?
 
+
 ## Why agile?
+
 Releasing software [🟢iteratively](https://fleetdm.com/handbook/company#results) gets changes and improvements into the hands of users faster and generally results in [🔵software that works](https://fleetdm.com/handbook/company#objectivity). This makes contributors fitter, happier, and more productive.
 
 We apply the [twelve principles of agile](https://agilemanifesto.org) to Fleet's [development process](https://fleetdm.com/handbook/company/product-groups#making-changes):
@@ -187,6 +195,7 @@ We apply the [twelve principles of agile](https://agilemanifesto.org) to Fleet's
 
 
 ### Why scrum?
+
 Scrum is an agile framework for software development that helps teams deliver high quality software faster. It emphasizes teamwork, collaboration, and continuous improvement to achieve business objectives. Here are some of the key reasons why [we use scrum at Fleet](https://fleetdm.com/handbook/engineering#scrum)): 
 - Improved collaboration and communication: Scrum emphasizes teamwork and collaboration, which leads to better communication between team members and stakeholders. This helps ensure that everyone is aligned and working towards the same goals.
 - Flexibility and adaptability: Scrum allows teams to respond quickly to changing requirements and market conditions. By working in short sprints, teams can continuously adapt to new information and feedback, and adjust their approach as needed.
@@ -194,7 +203,9 @@ Scrum is an agile framework for software development that helps teams deliver hi
 - Faster delivery of working software: Scrum helps teams deliver working software faster by breaking down the development process into manageable chunks that can be completed within a sprint. Stakeholders can see progress and provide feedback more quickly, which helps ensure the final product meets their needs.
 - Higher quality software: Scrum includes regular testing and quality assurance activities, which help ensure that the software being developed is of high quality and meets the required standards.
 
+
 ### Why lean software development?
+
 [Lean software development](https://en.wikipedia.org/wiki/Lean_software_development) is an iterative and incremental approach to software development that aims to eliminate waste and deliver value to customers quickly. It is based on the principles of [lean manufacturing](https://en.wikipedia.org/wiki/Lean_manufacturing) and emphasizes continuous improvement, collaboration, and customer focus.
 
 Lean development can be summarized by its seven principles:
@@ -206,7 +217,9 @@ Lean development can be summarized by its seven principles:
 6. Build integrity in: Build quality into the software by continuously testing, reviewing, and improving the code throughout the development process.
 7. Optimize the whole: Optimize the entire process and focus on the system's overall performance rather than just individual parts to ensure the most efficient and effective use of resources.
 
+
 ## Why a three-week cadence?
+
 The Fleet product is released every three weeks. By syncing the whole company to this schedule, we can:
 
 - Keep all team members (especially those who aren't directly involved with the core product) aware of the current version of Fleet and when the next release is shipping.
@@ -228,7 +241,9 @@ Why bother with all that?  And why do it in this particular order?
 - **Better customer experience.** Understanding the impact of every production issue means we can reach out to affected users ASAP and acknowledge their challenge, showing them that Fleet takes quality and stability seriously.  This kind of customer support is rare and memorable.
 - **It helps us prevent future outages.** By finding outages sooner, we incentivize ourselves to fix the root cause sooner.  And by fixing bugs sooner, we prevent them from stacking and bleeding into one another, and we prevent ourselves from implementing future fixes and improvements on top of shaky foundations.  This makes contributions less risky and reduces the number of outages.
 
+
 ## Why make it obvious when stuff breaks?
+
 At Fleet, we detect and fix bugs as quickly as possible.  
 
 Breaking loudly means we can fix the break sooner and improve how fast and certain we are about making future changes.  Especially in an all-remote environment, this provides contributors with discipline around quality and stability of the main branch.  This is ["good annoying"](https://agilehope.blogspot.com/2014/12/diy-build-light-indicator.html).
@@ -239,7 +254,9 @@ If that happens by mistake, first priority is merging a fix, then notifying the
 
 > Here is [an example of a deliberate decision to make broken images in Fleet fail more loudly](https://github.com/fleetdm/fleet/issues/12305#issuecomment-1671924257) so that they can't be overlooked, even though this might slow down short-term development.
 
+
 ## Why keep issue templates simple?
+
 At Fleet, we optimize for the person submitting the issue, not the person receiving it.
 
 We avoid making the submitter read anything.  We prompt for as little information as possible.  Why?
@@ -251,6 +268,7 @@ For example, here is the [philosophy behind Fleet's bug report template](https:/
 
 
 ## Why spend less?
+
 - **Default to efficiency. Reward richly.** At Fleet, we celebrate success and reward hard work.  But we do everyday things cheap.  And that is very important, because it shapes the kind of people we hire, and the kind of expectations we set for the team about what "comfortable" feels like.
 - **Offsites are not rewards.** Day to day, Fleet does not look rich.  Rich !== welcoming.  The company is open, not closed.  Work here means flexible collaboration, accessible people, and clear expectations.  And a rich, exciting future worth working for.  Not a rich, complacent baseline worth coasting for.
 - **Minimally viable comfort.**  We stay at La Quintas by the train tracks every single time unless customers are coming into the room and we need more space.  Even then, we accommodate in the spirit of _hospitality_, not to show off how well Fleet is doing.  They'll know how well we're doing by how great the product is, how great the support is, and [how that makes them feel](https://fleetdm.com/handbook/company#purpose).  They'll remember openness, flexibility, accessibility, and clarity in all of their interactions with the brand.  Not the view from our hotel rooms.
@@ -258,6 +276,7 @@ For example, here is the [philosophy behind Fleet's bug report template](https:/
 
 
 ## Why don't we sell like everyone else?
+
 Many companies encourage salespeople to ["spray and pray"](https://www.linkedin.com/posts/amstech_the-rampant-abuse-of-linkedin-connections-activity-7178412289413246978-Ci0I?utm_source=share&utm_medium=member_ios) email blasts, and to do whatever it takes to close deals.  This can sometimes be temporarily effective.  But Fleet takes a [🟠longer-term](https://fleetdm.com/handbook/company#ownership) approach:
 - **No spam.**  Fleet is deliberate and thoughtful in the way we do outreach, whether that's for community-building, education, or [🧊 conversation-starting](https://github.com/fleetdm/confidential/blob/main/cold-outbound-strategy.md).
 - **Be a helper.**  We focus on [🔴being helpers](https://fleetdm.com/handbook/company#empathy).  Always be depositing value.  This is how we create a virtuous cycle. (That doesn't mean sharing a random article; it means genuinely hearing, doing whatever it takes to fully understand, and offering only advice or links that we would actually want.)  We are genuinely curious and desperate to help, because creating real value for people is the way we win.
@@ -268,39 +287,8 @@ Many companies encourage salespeople to ["spray and pray"](https://www.linkedin.
 - **Step up.** We look at the [🟠big picture](https://fleetdm.com/handbook/company#ownership).  The goal is for the organization using Fleet to be successful, as well as the individuals who decide to use or buy the product.  There are multiple versions of Fleet, and so many ways to "do" open-source security and IT.  It is in the company's best interest to help engineers pick the right one; even if that's Fleet Free, or another solution altogether.  We think about our customer's needs like they are our own.
 
 
-## Why don't we track leads differently?
-There are about as many "MQL" definitions as there are sales orgs in the world. Exaggerating here, but only somewhat.
-
-Fleet documents all KPI's with clear definitions that are simple to evaluate, easy to track, and highly iterable.
-
-- **Lead** == A "Lead" row in Salesforce.
-  
-- **MQL** == a human from an in-ICP organization that meets these parameters when the lead is created:
-  - Their organization is _not_ already a Fleet customer
-  - Their organization is _not_ already considering buying Fleet as part of a qualified, mutually beneficial opportunity
-  - Our friend, the human, has chosen to open or widen their line of communication with the company. This could come from an event or or sending a contact form message requesting a call.
-    - Attendees at events are considered MQLs if they have done any of the following:
-      -  Had a 5+ minute conversation or a badge scan at a physical event.
-      -  RSVPed yes to extracurricular in-person side event (e.g. dinner or activity) OR attended the in-person side event and a Fleetie was able to track their attendance.
-      -  RSVPed yes to a virtual event OR indicated intent by sending a follow-up email.
-  - Multiple people from the same org each count as _separate_ MQLs. <!-- However, Once the opportunity is created for an account, all MQLs associated with that account become "converted". Meaning they no longer count towards "open MQLs", though they still count as MQLs created. -->
-  - When an account converts to an opportunity, all subsequent new leads created for that account are ***NOT*** MQLs (i.e. do not count towards "MQLs created".). If an opportunity is marked "closed lost", then it is _no longer_ open, so subsequent new leads associated with the prospective customer are considered MQLs again.
-
-- **Open MQL** == An MQL whose lead status is neither _"disqualified" nor "converted"_.
-  
-- **SQL** == An MQL whose lead status in Salesforce has exceeded a _certain threshold_, for **any** reason, from **any** source (threshold TBD: we aren't reporting these yet in KPIs)
-  
-- **Lead source** == where a lead came from. To determine attribution, we will consider the lead source. (e.g. sales-sourced vs. marketing-sourced vs. misc-sourced leads can be determined by looking at the lead source. No need to establish any other *QL or change these.)
-
-  - Instead of saying _"outbound lead"_ or _"inbound lead"_, you can say _"a lead from a badge scan at an event"_ or _"a lead from a customer referral"_ or _"a lead from the website"_.
-
-- **Opportunity** == A _"Opportunity"_ row in Salesforce.
-
-- **Open opportunity** == An opportunity whose stats is not _"closed lost"_ nor _"closed won"_.
-
-
-
 ## Why does Fleet support query packs?
+
 As originally envisioned by Zach Wasserman and the team when creating osquery, packs are a way to import and export queries into (and out of!) any platform that speaks osquery, whether that's Fleet, [Security Onion](https://securityonionsolutions.com/), an EDR, or even Rapid7. Queries [should be portable](https://github.com/fleetdm/fleet/blob/f711e60de47c69ab8be5bc13cf73fedf88adc338/README.md#lighter-than-air) to minimize lock-in to particular tools.
 
 The "Packs" section of the UI that began in `kolide/fleet` c. 2017 was an early attempt to  segment and target formations of hosts that share certain characteristics.  This came with some difficulties with debugging and collaboration, since it could be hard to tell which queries were running on which hosts. It also made it harder to understand what performance impact running all those queries might cause.
@@ -311,7 +299,9 @@ The first step was to add a simpler way to schedule queries, and tuck away the l
 
 Packs will always be supported in Fleet.
 
+
 ## Why does Fleet use sentence case?
+
 Fleet uses sentence case capitalization for all headings, subheadings, button text in the Fleet product, fleetdm.com, the documentation, the handbook, marketing material, direct emails, in Slack, and in every other conceivable situation.
 
 In sentence case, we write and capitalize words as if they were in sentences:
@@ -322,7 +312,9 @@ As we use sentence case, only the first word is capitalized. But, if a word woul
 
 The reason for sentence case at Fleet is that everyone capitalizes differently in English, and capitalization conventions have not been taught very consistently in schools.  Sentence case simplifies capitalization rules so that contributors can deliver more natural, even-looking content with a voice that feels similar no matter where you're reading it.
 
+
 ## Why not use superlatives?
+
 A superlative is an adjective or adverb that expresses the degree of a quality, such as "best," "worst," or "most beautiful."
 
 A superlative is a judgment or evaluation, [which only the customer can decide](https://twitter.com/mikermcneil/status/1686837625187930112). 
@@ -341,6 +333,7 @@ Avoid using too many unnecessary words or superlatives, so your writing is short
 
 
 ## Why does Fleet use "MDM on/off" instead of "MDM enrolled/unenrolled"?
+
 MDM should be a capability, not a product category.
 
 In Fleet, the word "enrolled" means "the host shows up in the dashboard and API".
@@ -351,7 +344,9 @@ Since Fleet is more than MDM, you can collect logs and health data on any comput
 
 That means you can collect logs from Linux servers or Windows factory workstations without enabling remote script execution on those computers, even if you're using script execution on your Macs.
 
+
 ## Why not mention the CEO in Slack threads?
+
 Everyone else who works at Fleet is expected to read (and reply or acknowledge with an emoji reaction) every time they're mentioned in Slack, even deep inside long threads.
 
 Now that the company has grown, the CEO gets mentioned in threads [too often](https://docs.google.com/document/d/1vK-Dy2BVrw7doYUzabOPyCiN4RfolWFgOKMm23l91s0/edit) to keep up with thread replies, even for threads he participates in.
@@ -377,6 +372,7 @@ Thank you so much!" 🙇
 
 
 #### Stubs
+
 The following stubs are included only so that old links continue to work (for backwards compatibility.)
 
 ##### Reporting structure
diff --git a/handbook/customer-success/README.md b/handbook/customer-success/README.md
index 57d82480c277..ccac764339fb 100644
--- a/handbook/customer-success/README.md
+++ b/handbook/customer-success/README.md
@@ -1,31 +1,86 @@
 # Customer Success
+
 This handbook page details processes specific to working [with](#contact-us) and [within](#responsibilities) this department.
 
+
 ## Team
+
 | Role                                  | Contributor(s)           |
 |:--------------------------------------|:------------------------------------------------------------------------------------------------------------------------|
 | VP of Customer Success                | [Zay Hanlon](https://www.linkedin.com/in/zayhanlon/) _([@zayhanlon](https://github.com/zayhanlon))_
 | Infrastructure Engineer               | [Robert Fairburn](https://www.linkedin.com/in/robert-fairburn/) _([@rfairburn](https://github.com/rfairburn))_
-| Customer Support (CSE/CSA)       | [Kathy Satterlee](https://www.linkedin.com/in/ksatter/) _([@ksatter](https://github.com/ksatter))_ <br> [Grant Bilstad](https://www.linkedin.com/in/grantbilstad/) _([@Pacamaster](https://github.com/Pacamaster))_ <br> [Dale Ribeiro](https://www.linkedin.com/in/daleribeiro/) _([@ddribeiro](https://github.com/ddribeiro))_ <br> Ben Edwards _([@edwardsb](https://github.com/edwardsb))_ <br> [Brock Walters](https://www.linkedin.com/in/brock-walters-247a2990/) _([@nonpunctual](https://github.com/nonpunctual))_
+| Customer Support (CSE/CSA)       | [Kathy Satterlee](https://www.linkedin.com/in/ksatter/) _([@ksatter](https://github.com/ksatter))_ <br> [Rebecca Cowart](https://www.linkedin.com/in/rebeccaui/) _([@rebeccaui](https://github.com/rebeccaui))_ <br> [Dale Ribeiro](https://www.linkedin.com/in/daleribeiro/) _([@ddribeiro](https://github.com/ddribeiro))_ <br> Ben Edwards _([@edwardsb](https://github.com/edwardsb))_ <br> [Brock Walters](https://www.linkedin.com/in/brock-walters-247a2990/) _([@nonpunctual](https://github.com/nonpunctual))_
 | Customer Success Manager (CSM)        | [Jason Lewis](https://www.linkedin.com/in/jlewis0451/) _([@patagonia121](https://github.com/patagonia121))_ <br> [Michael Pinto](https://www.linkedin.com/in/michael-pinto-a06b4515a/) _([@pintomi1989](https://github.com/pintomi1989))_
 
+
 ## Contact us
+
 - To **make a request** of this department, [create an issue](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-customer-success&projects=&template=custom-request.md&title=Request%3A+_______________________) and a team member will get back to you within one business day (If urgent, mention a [team member](#team) in the [#g-customer-success](https://fleetdm.slack.com/archives/C062D0THVV1)).
   - Any Fleet team member can [view the kanban board](https://github.com/fleetdm/fleet#workspaces/-g-customer-success-642c83a53e96760014c978bd/board) for this department, including pending tasks and the status of new requests.
   - Please **use issue comments and GitHub mentions** to communicate follow-ups or answer questions related to your request. 
 
+
 ## Responsibilities
+
 The customer success department is directly responsible for ensuring that customers and community members of Fleet achieve their desired outcomes with Fleet products and services.
 
 
 ### Assign a customer codename
+
 Occasionally, we will need to track public issues for customers and prospects who wish to remain anonymous on our public issue tracker. To do this: 
 
 1. The team member creating the issue will choose an appropriate minor planet name from this [Minor planets page](https://minorplanetcenter.net//iau/lists/MPNames.html) (alphabetical).
 2. Create a label in the fleetdm/fleet and fleetdm/confidential repos which can be attached to current and future issues for the customer or prospect. As part of the label description in the fleetdm/confidential repo, add the customer or prospect name. This way, we maintain a confidential mapping of codename to customer or prospect.
 
 
+### Prepare for routine customer meeting
+
+Before a routine customer call, the CSM prepares an agenda including the following items:
+1. Customer and Fleet expected attendees
+2. Release notes for the latest version of Fleet
+3. Update notes for which version of Fleet the customer is running (if self-hosted)
+4. Follow ups to the agenda from the previous call or Slack
+5. Provide updates to open feature requests (can be done monthly or quarterly)
+6. Provide updates to open bug reports
+
+
+### Generate an expansion opportunity in Salesforce
+
+[Customer Success Managers (CSMs)](https://fleetdm.com/handbook/customer-success#team) are responsible for developing customer expansion opportunities that are not being worked on in conjunction with an Account Executive (AE). An AE may be assigned by the [Chief Revenue Officer (CRO)](https://fleetdm.com/handbook/sales#team) for large-scale expansion opportunities such as bringing on a new Fleet use case or bringing on a new group of hosts to an existing Fleet use case. CSMs manage expansion opportunities for things like host count increases for customer growth and price increases on renewals. Discuss examples of these scenarios with your manager to learn more. Moving forward, CSM's are responsible for keeping the stage, next steps, and date of next steps fields updated as the opportunity progresses through the sales cycle. Take the steps below when creating an expansion opportunity in Salesforce:
+
+1. Navigate to the customer account record in [Salesforce](https://fleetdm.lightning.force.com/lightning/page/home).
+2. Scroll down to the "Upcoming renewal (± expansions)" table (in the "Customer" section) and click "New".
+3. Change the opportunity name to reflect the following naming structure: CustomerName_FleetProduct_Expansion_QuarterDue
+    - Example: ABCTestCompany_FleetPremiumMDM_HostExpansion_Q12025
+    - Example: ABCTestCompany_FleetPremium_PriceIncreaseExpansion_Q12025
+4. Fill out all the required fields making sure to pick "Expansion" in the  "Type" dropdown menu and then click "Save".
+
+
+### Conduct a health check
+
+Health checks are conducted quarterly or bi-annually, in preparation for a quarterly business review (QBR). The purpose of a health check is to understand what features and functionality the customer is currently using in Fleet. This information will be used to provide guidance to the customer during their QBR. For more information around QBRs, please see the section below, titled "Conduct a quarterly business review".
+
+1. Work with your champion to schedule the health check at a time when their Fleet admins and daily users are available. Be sure to take notes, and record the meeting if possible.
+2. During the meeting, ask the customer to share their screen and walk through their day-to-day use of Fleet.
+3. Ask the customer questions about the features they are using to understand the "why" behind their use cases for Fleet. Try not to provide guidance directly on this call.
+4. Review your notes after the meeting, and find areas of improvement that you can highlight to help your partner more thoroughly utilize Fleet and add your findings to the QBR deck.
+
+
+### Conduct a quarterly business review (QBR)
+
+Business reviews are conducted quarterly or bi-annually to ensure initial success criteria completion, ongoing adoption, alignment on goals, and delivery of value as a vendor. Use the meeting to assess customer priorities for the coming year, review performance metrics, address any challenges and showcase value in upcoming and unutilized features.
+1. Work with your champion to schedule the business review at a time their stakeholders are available (typically 90 days after kickoff and again, 90 days before renewal).
+2. Collect usage metrics from the [usage data report](https://docs.google.com/spreadsheets/d/1Mh7Vf4kJL8b5TWlHxcX7mYwaakZMg_ZGNLY3kl1VI-c/edit?gid=0#gid=0) (internal Fleet document) and the following:
+    - Optionally schedule a health check with day to day admins prior to the QBR to better understand how the product is being used and which features have been adopted.
+    - Have a support engineer collect data on open and closed bugs from the previous quarter and highlight any P0 or P1 incidents along with a summary of the postmortem (search Unthread and GitHub for issues tagged with the customer codename and ':bug').
+    - Summarize status updates for open feature requests and highlight delivered feature requests.
+    - For managed cloud customers, reach out to #help-infrastructure to collect information on cloud uptime and any outages or alarms.
+    - Provide one slide with information on the latest Fleet release and any upcoming big ticket features which can be found on the product board and current release board for #g-mdm and #g-endpoint-ops
+3. After the business review, save the presentation as a PDF and share it with your customer.
+
+
 ### Create customer support issue
+
 Locate the relevant issue or create it if it doesn't already exist (to avoid duplication, be creative when searching GitHub for issues - it can often take a couple of tries with different keywords to find an existing issue). When creating a new issue, make sure the following:
 - Make sure the issue has a "customer request" label or "customer-codename" label.
   - Occasionally, we will need to track public issues for customers that wish to remain anonymous on our public issue tracker. To do this, we choose an appropriate minor planet name from this [Wikipedia page](https://en.wikipedia.org/wiki/List_of_named_minor_planets_(alphabetical)) and create a label which we attach to the issue and any future issues for this customer.
@@ -54,7 +109,9 @@ Locate the relevant issue or create it if it doesn't already exist (to avoid dup
     - The output of fleetctl debug archive
 - Have we provided a link to that issue for the customer to remind everyone of the plan and for the sake of visibility, so other folks who weren't directly involved are up to speed  (e.g., "Hi everyone, here's a link to the issue we discussed on today's call: […link…](https://omfgdogs.com)")?
 
+
 ### Contact the developer on-call
+
 The acting developer on-call rotation is reflected in the [📈KPIs spreadsheet (confidential Google sheet)](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit#gid=0&range=F2 ). The developer on-call is responsible for responses to technical Slack comments, Slack threads, and GitHub issues raised by customers and the community, which the CSE team cannot address.
 - To reach the developer on-call for assistance, mention them in Fleet Slack using `@oncall` in the [#help-engineering](https://fleetdm.slack.com/archives/C019WG4GH0A) channel. 
   - Support issues should be handled in the relevant Slack channel rather than Direct Messages (DMs). This will ensure that questions and solutions can be easily referenced in the future. If it is necessary to use DMs to share sensitive information, a summary of the conversation should be posted in the Slack channel as well. 
@@ -63,13 +120,17 @@ The acting developer on-call rotation is reflected in the [📈KPIs spreadsheet
 
 - An automated weekly [on-call handoff](https://fleetdm.com/handbook/engineering#handoff) Slack thread in #g-engineering provides the opportunity to discuss highlights, improvements, and hand off ongoing issues.
 
+
 ### Onboard a customer success team member
+
 - **Customer Success Manager:** Follow the [training steps for this role](https://docs.google.com/document/d/1itrBeztwjK253Q548wbveVWdDaldBYCEOS6Cbz5Z4Uc/edit).
 - **Customer Solutions Architect (CSA):** Follow the [training steps for this role](https://docs.google.com/document/d/1G26Aqmn4tSKa7s0jMcSRqNTtz6h47Tvf8Ddi2-cP1ek/edit#heading=h.2i16pc77rnb7).
 - **Customer Support Engineer (CSE):** Follow the [training steps for this role](https://docs.google.com/document/d/1GB8i_VMaFxeb9ipLock9MVWGJ2RqIW8lZ5n3MLiXG4s/edit).
 - **Infrastructure Engineer:** Follow the [training steps for this role](https://docs.google.com/document/d/1G26Aqmn4tSKa7s0jMcSRqNTtz6h47Tvf8Ddi2-cP1ek/edit#heading=h.2i16pc77rnb7).
 
+
 ### Manage automation of customer slack
+
 1. A new message is posted in any Slack channel
 2. (Zapier filter) The automation will continue if the message is:
     - Not from a Fleet team member
@@ -80,7 +141,9 @@ The acting developer on-call rotation is reflected in the [📈KPIs spreadsheet
 
 > **Note:** New customer channels that the automation will run in must be configured manually. Submit requests for additions to the Zapier administrator. 
 
+
 ### Generate a trial license key
+
 1. Fleet's self-service license key creator is the best way to generate a proof of concept (POC) or renewal/expansion Fleet Premium license key. 
     - [Here is a tutorial on using the self-service method](https://www.loom.com/share/b519e6a42a7d479fa628e394ee1d1517) (internal video)
     - Pre-sales license key DRI is the Director of Solutions Consulting
@@ -88,12 +151,16 @@ The acting developer on-call rotation is reflected in the [📈KPIs spreadsheet
 
 2. Legacy method: [create an opportunity issue](https://github.com/fleetdm/confidential/issues/new/choose) for the customer and follow the instructions in the issue for generating a trial license key.
 
+
 ### Respond to messages and alerts 
+
 Customer Support and 24/7 on-call Engineers are responsible for the first response to Slack messages in the [#fleet channel](https://osquery.slack.com/archives/C01DXJL16D8) of osquery Slack, and other public Slacks. 
 - The 24/7 on-call is responsible for alarms related to fleetdm.com and Fleet Managed Cloud, as well as delivering 24/7 support for Fleet Premium customers. Use [on-call runbooks](https://github.com/fleetdm/confidential/tree/main/infrastructure/runbooks#readme) to guide your response. Runbooks provided detailed, step-by-step instructions to quickly and effectively respond to and resolve most 24/7 on-call alerts.
 - We respond within 1-hour during business hours and 4 hours outside business hours. Note that we do not need to have answers within 1 hour -- we need to at least acknowledge and collect any additional necessary information while researching/escalating to find answers internally.
 
+
 ### Maintain first responder SLA
+
 The first responder on-call for Managed Cloud will take ownership of the @infrastructure-oncall alias in Slack first thing Monday morning. The previous week's on-call will provide a summary in the #g-customer-success Slack channel with an update on alarms that came up the week before, open issues with or without direct end-user impact, and other issues to keep an eye out for.
 - **First responders:** Robert Fairburn, Kathy Satterlee
 
diff --git a/handbook/customer-success/customer-success.rituals.yml b/handbook/customer-success/customer-success.rituals.yml
index 017063ae964f..2c493ccf7472 100644
--- a/handbook/customer-success/customer-success.rituals.yml
+++ b/handbook/customer-success/customer-success.rituals.yml
@@ -2,7 +2,7 @@
   task: "Prioritize for next sprint" # Title that will actually show in rituals table
   startedOn: "2023-09-04" # Needs to align with frequency e.g. if frequency is every thrid Thursday startedOn === any third thursday
   frequency: "Triweekly" # must be supported by
-  description: "Drag next sprint's priorities to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/company/communication)"
+  description: "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/company/communication)"
   moreInfoUrl: "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible" #URL used to highlight "description:" test in table
   dri: "zayhanlon" # DRI for ritual (assignee if autoIssue) (TODO display GitHub proflie pic instead of name or title)
   autoIssue:   # Enables automation of GitHub issues
diff --git a/handbook/demand/README.md b/handbook/demand/README.md
index 90d7b451e4ec..40843ada9b7c 100644
--- a/handbook/demand/README.md
+++ b/handbook/demand/README.md
@@ -1,23 +1,38 @@
 # Demand
+
 This handbook page details processes specific to working [with](#contact-us) and [within](#responsibilities) this department.
 
+
 ## Team
+
 | Role                               | Contributor(s)
 |:-----------------------------------|:------------------------------------------------------------------------------------------------------------------------|
 | Digital Marketing Manager          | [Drew Baker](https://www.linkedin.com/in/andrew-baker-51547179/) _([@drewbakerfdm](https://github.com/drewbakerfdm))_
 
 
 ## Contact us
+
 - To **make a request** of the Demand department, [create an issue](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-demand&projects=&template=custom-request.md&title=Request%3A+_______________________) and a team member will get back to you within one business day (If urgent, at-mention a [team member](#team) in the [#g-demand](https://fleetdm.slack.com/archives/C01ALP02RB5) Slack channel).
   - Please use **issue comments and GitHub mentions** to communicate follow-ups or answer questions related to your request.
   - Any Fleet team member can [view the kanban board](https://app.zenhub.com/workspaces/g-demand-64e6c8e2d35c7f001a457b7f/board?sprints=none) for this department, including pending tasks and the status of new requests.
 
 > To **make a request** related to **product marketing**, **press**, **brandfronts**, **pitchfronts**, **featurefronts**, **ideal customer profiles (ICPs)**, **personas**, or **targeting** [create an issue](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-digital-experience&projects=&template=custom-request.md&title=Product%20marketing%20request%3A+_______________________) (If urgent, at-mention the [Head of Product Marketing](#team) in the [#help-leadership](https://fleetdm.slack.com/archives/C0600L1TTPY) Slack channel).
 
+
 ## Responsibilities
+
 The Demand department is directly responsible for achieving revenue pipeline targets, increasing awareness and interest in the open-source project, and nurturing the Fleet community through participation in video, sponsored events, and other [programs](https://fleetdm.com/handbook/company/communications#programs).
 
+
+### Refresh event calendar
+
+Fleet's public relations firm is directly responsible for the accuracy of event locations, attendance dates, and CFP deadlines in the event strategy workbook.  At the end of every quarter, the PR firm updates every event in the ["Event strategy workbook"](https://docs.google.com/spreadsheets/d/1YQXAX2Q_WnGkAwMYjMbQpV3nbCj7gOBbv7Y0u4twxzQ/edit) (private Google doc) by following these steps:
+1. Visit the latest website for each event.
+2. Update the workbook with the latest location, dates, and CFP deadlines from the website.
+
+
 ### Respond to a "Contact us" submission
+
 1. Check the [_from-prospective-customers](https://fleetdm.slack.com/archives/C01HE9GQW6B) Slack channel for "Contact us" submissions. 
 2. Mark submission as seen with the "👀" emoji.
 3. Within 4 business hours, use the [best practices template (private Google doc)](https://docs.google.com/document/d/1D02k0tc5v-sEJ4uahAouuqnvZ6phxA_gP-IqmkBdMTE/edit) to respond to general asks.
@@ -31,6 +46,7 @@ The Demand department is directly responsible for achieving revenue pipeline ta
 
 
 ### Begin or modify an advertising campaign
+
 Any new ads or changes to current running ads are approved in ["🦢🗣 Design review (#g-digital-experience)"](https://app.zenhub.com/workspaces/-g-digital-experience-6451748b4eb15200131d4bab/board?sprints=none).
 
 To propose an ad, or a change to an ad:
@@ -41,6 +57,50 @@ To propose an ad, or a change to an ad:
 5. Make revisions and re-attend the meeting as needed until the planned change is executed.
 7. Create a calendar reminder to check ad performance two weeks from the date changes were made.
 
+
+### Measure intent signals
+
+Intent signals help measure an individual's current level of engagement with the Fleet brand. Use the following steps to decide if:  
+
+(a) A contact and/or account needs to be created/updated. 
+
+(b) An account should be prioritized for [manual research](https://fleetdm.com/handbook/demand#research-an-account).
+
+(c) An account/contact would benefit from a sales conversation.
+
+(in order of how worthwhile it is to spend time looking at the intent signal)
+
+1. Accounts currently assigned to reps (i.e. pipeline + stage0 + pre-pipeline IQMs).
+2. Accounts with trending psychological progression (as measured by fleetdm.com website signups (i.e. new contacts ± contacts that have increased their psystage to a certain point).
+3. Accounts that fleeties have suggested to go after in ABM maneuver sheet.
+4. [MacAdmins Slack traffic](https://macadmins.slack.com/archives/C0214NELAE7/p1722561481530559) in the #fleet AND #osquery channels (channel joins, posts, reactions, thread replies, thread reactions).
+5. [LinkedIn page follows](https://www.linkedin.com/company/71111416/admin/analytics/followers/).
+6. [GitHub stars to fleetdm/fleet](https://github.com/fleetdm/fleet/stargazers) from non-fleeties.
+
+
+### Research an account
+
+Follow these steps to research an account and move it toward sales-readiness **after** discovering [relevant intent signals](https://fleetdm.com/handbook/demand#measure-intent-signals).
+
+1. Create the account in SalesForce if it doesn't already exist.
+2. Update any incorrect, mistagged, or incomplete contacts already on the account and merge any duplicates that are found. Verify the following data is current for each existing contact:
+  - "Title"
+  - "Role"
+  - "Primary buying situation" 
+  - "LinkedIn"
+  - "Psychological stage" 
+  - "intent signals" 
+3. If you any reason that the account organization wouldn't benefit from a relationship with Fleet, change the "Type" to "Distraction" stop here. If you haven't disqualified the account at this point, update the "Marketing stage" to "Research-ready". 
+After an account is marked "[Research-ready](https://fleetdm.lightning.force.com/lightning/r/Report/00OUG000001LerV2AS/view?queryScope=userFolders)".
+
+1. Research missing contacts and add them to salesforce if they are real by using the [ABM maneuvers spreadsheet](https://docs.google.com/spreadsheets/d/1ijtBKTjPg_AodnKEZY0ivia70ttDR3VMURT8rpYwYiw/edit?gid=0#gid=0) to generate a Sales Nav search. Make sure they have "role", "buying situation", "linkedinUrl", "psychological stage", "intent signals" completely filled out and correct.
+2. For "Contact source" for any new contacts, use "Manual research".
+3. Rank the account in terms of closability and fit based on what we see from it and its contacts. Mark any account that is not a fit as "Distraction" instead of "Prospect".
+4. Research and discover mutual connections between fleeties and Mac admin community members within those contacts to help determine fit.
+5. Check Snitcher activity for the account and the psystages of its contacts in Salesforce.
+6. Update the "marketing stage" AND "type" accordingly (qualify or disqualify based on whether the contacts look good). Start running ABM ads on the account if moving it to "Ads running" for a total of 60 days otherwise, stop them if moving it out of "Ads running".
+
+
 ### Promote a post on LinkedIn
 
 1. Create a classic campaign under ["Experiments"](https://www.linkedin.com/campaignmanager/accounts/509911695/campaigns?campaignGroupIds=%5B678398233%5D) following the YYYY-MM-DD.buying-situation - ad description with a goal of website visits or engagement to run for two weeks.
@@ -48,7 +108,9 @@ To propose an ad, or a change to an ad:
 3. When creating the ad for the new campaign, select "browse existing content" and find the post under the employee tab.
 4. Launch campaign once approved.
 
+
 ### Settle event strategy
+
 The Head of Demand is the DRI for deploying Fleet's event budget, and events are settled significantly in advance to provide ample time for strategy and planning.  Fleet's [Client Platform Engineer & Community Advocate](https://fleetdm.com/handbook/engineering#team) is the DRI for executing Fleet events efficiently, on-brand, and on-strategy.
 
 1. Using the [event strategy workbook](https://docs.google.com/spreadsheets/d/1YQXAX2Q_WnGkAwMYjMbQpV3nbCj7gOBbv7Y0u4twxzQ/edit#gid=1411322737), propose the events that Fleet will attend in the next 6 months, and the strategy for those events, including:
@@ -63,7 +125,29 @@ The Head of Demand is the DRI for deploying Fleet's event budget, and events are
   - Next, decide which events in the **_following quarter_** the company will invest time or money into.  This includes any event that Fleet pays to send someone to or to sponsor, and even events where Fleet's only involvement is that a fleetie will be giving a talk or otherwise representing the brand.
   - Finally, qualify or disqualify any newly-entered event ideas by either verifying and setting the buying situation, or removing the event idea from the spreadsheet.
 
+
+### Upload contacts to Salesforce after an event
+
+1. [Create a new lead source](https://fleetdm.lightning.force.com/lightning/setup/ObjectManager/Contact/FieldsAndRelationships/LeadSource/view) with naming convention "[Retired]Events - {Event name}". 
+2. Add the new lead source name to the .csv of leads before uploading to Salesforce.
+    a. Add a new column header labeled "Lead source" and add the new lead source name to each row in the CSV.
+
+
+3. Navigate to the [contact import wizard](https://fleetdm.lightning.force.com/one/one.app#eyJjb21wb25lbnREZWYiOiJvbmU6YWxvaGFQYWdlIiwiYXR0cmlidXRlcyI6eyJhZGRyZXNzIjoiL2RhdGFJbXBvcnRlci9kYXRhSW1wb3J0ZXIuYXBwP29iamVjdFNlbGVjdGlvbj1BY2NvdW50In0sInN0YXRlIjp7fX0%3D):
+    a. Select the standard object "Accounts and Contacts".
+    b. Select "Add new and update existing records" (Do not change the matching rules). 
+    c. Upload the CSV.
+    d. Verify the data is mapped to the correct Salesforce fields and start the Import.
+
+
+### Follow up after an event
+
+1. Email relevant information according to the event buying situation, but refer to the original lead list in [Google Drive](https://drive.google.com/drive/u/0/folders/1uXf95V6CHKHnqxRc9iQr0a0FnTZk3bXR) for those who asked for contact.
+2. If feedback is present in the original event CSV, manually add any worthwhile feedback to the contact description in Salesforce.
+
+
 ### Optimize ads through experimentation
+
 Fleet improves click-through rates in their campaigns to make the most of their advertising budget and attract more engaged users, boosting product adoption and community participation.
 
 Here's how:
@@ -92,6 +176,7 @@ Here's how:
 
 
 ### Process pending swag requests from the website
+
 On a weekly basis, log in to [Printful](https://www.printful.com/) and complete any draft orders so that they are sent. We currently only ship within the 48 contiguous United States and approve one free order per household under normal circumstances.
 To do this:
 1. Go to the ["Orders"](https://www.printful.com/ca/dashboard/default/orders) page in Printful
@@ -103,6 +188,7 @@ To do this:
 
 
 ### Fulfill a swag request
+
 There are many times in which community members, customers, and contributors are in need of some cool Fleet swag. Swag requests are received in the form of issues and will be fulfilled based on availability. To process a swag request:
 1. Check and communicate availability to the requestor.
 2. Use the appropriate shipping method that best serves the company.
@@ -111,13 +197,15 @@ There are many times in which community members, customers, and contributors are
 
 
 ### Send swag for community contributions to Fleet
+
 - Reach out to the contributor to thank them for their contribution
 - Consider sharing the contribution on social media
 - Ask if we could send the contributor any swag
-- If yes, follow the steps to fufuill a swag request.
+- If yes, follow the steps to fulfill a swag request.
 
 
 ### Run a new ad or change an existing ad
+
 Any changes to the current running ads visible to a user, including designs, keywords, or targeting, are approved in 🦢🗣 Design review (#g-digital-experience), which [occurs regularly](https://fleetdm.com/handbook/company/product-groups#design-reviews) and is open to all fleeties.
 1. [Digital Marketing Manager](https://fleetdm.com/handbook/demand#team) adds a discussion item about the change to the [website design review agenda](https://docs.google.com/document/d/1Q73ublh9bcIL01JsY--gpZRd3KPT_KCX-F0RaorKJcM/edit)
 2. During the call, they compare existing ads against the planned updates within the corresponding ad platform. ([Google Ads](https://ads.google.com/home/), [LinkedIn Campaign Manager](https://www.linkedin.com/campaignmanager/), etc.)
@@ -125,8 +213,8 @@ Any changes to the current running ads visible to a user, including designs, key
 
 > **Do changes to keywords or targeting require a design review?** Currently, all changes to these things require discussion with our product marketer.
 
-
 ### Engage with the community
+
 Public conversations on social media create valuable opportunities for contributors to answer technical questions and collect feedback.
 
 Here are some links that filter relevant conversations on each platform:
@@ -140,12 +228,15 @@ Here are some links that filter relevant conversations on each platform:
 
 
 ### Respond to  a "Talk to an expert" request
+
 When a community member has a question about getting started with Fleet, they can [book a 15-minute call](https://calendly.com/jd-fleet/let-s-talk-fleet) with the Community Advocate.
 
 1. Add questionnaire details to the [Talk to an Expert](https://docs.google.com/spreadsheets/d/1aMLQ9z5TYn90AnE3g1sMPoxsMNMKXn_l3aWb9Kdi7G4/edit) spreadsheet.
 2. After meeting the contributor, follow up with an email including appropriate links.
 
+
 ### Upload to YouTube
+
 Fleet regularly uploads a variety of content to YouTube such as podcast episodes, sprint demos, educational updates, design reviews, and more.
 
 - Login to the Fleet YouTube channel, click the create button and then upload the video.
@@ -154,7 +245,9 @@ Fleet regularly uploads a variety of content to YouTube such as podcast episodes
 - Set the visibility to "Public"
 - Share video link on social media
 
+
 ### Create a podcast episode
+
 Fleet invites guests to discuss the future of IT and security on the [ExpedITioners podcast](https://expeditioners.podbean.com/) to be shared with the community,
 
 - Find the new episode in the [Fleet drive](https://drive.google.com/drive/folders/1v2sBswrqaayxRTfqoDDZBhz0xViqoNbC?usp=drive_link).
@@ -168,6 +261,7 @@ Fleet invites guests to discuss the future of IT and security on the [ExpedITion
 
 
 ## Rituals
+
 <rituals :rituals="rituals['handbook/demand/demand.rituals.yml']"></rituals>
 
 
diff --git a/handbook/demand/demand.rituals.yml b/handbook/demand/demand.rituals.yml
index 78ddbda7b2ce..dc1ae27b478c 100644
--- a/handbook/demand/demand.rituals.yml
+++ b/handbook/demand/demand.rituals.yml
@@ -1,8 +1,15 @@
+-
+  task: "Refresh event calendar"
+  startedOn: "2023-12-31"
+  frequency: "Quarterly"
+  description: "https://fleetdm.com/handbook/demand#refresh-event-calendar"
+  moreInfoUrl: "https://fleetdm.com/handbook/demand#refresh-event-calendar"
+  dri: "Drew-P-drawers"
 -
   task: "Prioritize for next sprint" # Title that will actually show in rituals table
   startedOn: "2023-09-04" # Needs to align with frequency e.g. if frequency is every thrid Thursday startedOn === any third thursday
   frequency: "Triweekly"
-  description: "Drag next sprint's priorities to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/company/communication)"
+  description: "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/company/communication)"
   moreInfoUrl: "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible" #URL used to highlight "description:" test in table
   dri: "mikermcneil" # DRI for ritual (assignee if autoIssue) (TODO display GitHub proflie pic instead of name or title)
   autoIssue:   # « Enable automation of GitHub issues
@@ -14,39 +21,60 @@
   frequency: "Quarterly (first Tuesday)"
   description: "https://fleetdm.com/handbook/demand#settle-event-strategy"
   moreInfoUrl: "https://fleetdm.com/handbook/demand#settle-event-strategy"
-  dri: "drewbakerfdm"
+  dri: "Drew-P-drawers"
+-
+  task: "🫧 Pipeline sync"
+  startedOn: "2024-08-29"
+  frequency: "Weekly"
+  description: "Allign with CRO and AEs on pipeline processes and incoming leads"
+  moreInfoUrl: ""
+  dri: "Drew-P-drawers"
 -
   task: "Optimize ads"
   startedOn: "2024-02-26"
   frequency: "Weekly"
   description: "Remove all but the top 5 perfoming ads in each evergreen campaign. Make sure ABM campaigns are using top performing evergreen ads."
   moreInfoUrl: "https://fleetdm.com/handbook/demand#optimize-ads-through-experimentation"
-  dri: "drewbakerfdm"
+  dri: "Drew-P-drawers"
 -
   task: "Process pending swag requests from the website" # Title that will actually show in rituals table
   startedOn: "2023-09-20" # Needs to align with frequency e.g. if frequency is every thrid Thursday startedOn === any third thursday
   frequency: "Weekly" # must be supported by
   description: "Complete draft orders." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/company/communication)"
   moreInfoUrl: "https://fleetdm.com/handbook/demand#process-pending-swag-requests-from-the-website" #URL used to highlight "description:" test in table
-  dri: "drewbakerfdm" # DRI for ritual (assignee if autoIssue) (TODO display GitHub proflie pic instead of name or title)
+  dri: "Drew-P-drawers" # DRI for ritual (assignee if autoIssue) (TODO display GitHub proflie pic instead of name or title)
 -
   task: "Engage with the community"
   startedOn: "2023-09-20"
   frequency: "Daily"
   description: "Find relevant conversations with the community and contribute"
   moreInfoUrl: "https://fleetdm.com/handbook/demand#engage-with-the-community"
-  dri: "drewbakerfdm"
+  dri: "Drew-P-drawers"
 - 
   task: "Publish ☁️🌈 Sprint demos"
   startedOn: "2023-11-03"
   frequency: "Triweekly"
   description: "Every release cycle, upload the ☁️🌈 Sprint demos video to YouTube"
   moreInfoUrl: "https://fleetdm.com/handbook/demand#upload-to-youtube"
-  dri: "drewbakerfdm"
+  dri: "Drew-P-drawers"
+- 
+  task: "Measure intent signals"
+  startedOn: "2024-08-09"
+  frequency: "Daily"
+  description: "Measure intent signals and update SalesForce"
+  moreInfoUrl: "https://fleetdm.com/handbook/demand#measure-intent-signals"
+  dri: "Drew-P-drawers"
+- 
+  task: "Research accounts"
+  startedOn: "2024-08-09"
+  frequency: "Daily"
+  description: "Research SalesForce accounts and begin ABM ads"
+  moreInfoUrl: "https://fleetdm.com/handbook/demand#warm-up-actions"
+  dri: "Drew-P-drawers"
 # -
 #   task: "Propose a fleet event"
 #   startedOn: "2023-10-02"
 #   frequency: "Daily"
 #   description: "Populate ideas for future events"
 #   moreInfoUrl: "https://fleetdm.com/handbook/demand#settle-event-strategy"
-#   dri: "drewbakerfdm"
+#   dri: "Drew-P-drawers"
diff --git a/handbook/digital-experience/README.md b/handbook/digital-experience/README.md
index 718ae38649b1..9232c11b6f35 100644
--- a/handbook/digital-experience/README.md
+++ b/handbook/digital-experience/README.md
@@ -1,7 +1,10 @@
 # Digital Experience 
+
 This page details processes specific to working [with](#contact-us) and [within](#responsibilities) this department.
 
+
 ## Team
+
 | Role                            | Contributor(s)
 |:--------------------------------|:----------------------------------------------------------------------|
 | Head of Digital Experience      | [Sam Pfluger](https://www.linkedin.com/in/sampfluger88/) _([@sampfluger88](https://github.com/sampfluger88))_ 
@@ -14,16 +17,19 @@ This page details processes specific to working [with](#contact-us) and [within]
 ## Contact us
 
 - To **make a request** of this department, [create an issue](https://github.com/fleetdm/fleet/issues/new?assignees=&labels=%23g-digital-experience&projects=&template=digital-experience-request.md&title=TODO%3A+) and a team member will get back to you within one business day (If urgent, mention a [team member](#team) in the [#g-digital-experience](https://fleetdm.slack.com/archives/C058S8PFSK0) Slack channel.
-  - Any Fleet team member can [view the kanban board](https://app.zenhub.com/workspaces/g-digital-experience-6451748b4eb15200131d4bab/board) for this department, including pending tasks and the status of new requests.
+  - Any Fleet team member can [view the kanban board](https://app.zenhub.com/workspaces/g-digital-experience-6451748b4eb15200131d4bab/board?sprints=none) for this department, including pending tasks and the status of new requests.
   - Please **use issue comments and GitHub mentions** to communicate follow-ups or answer questions related to your request.
 
 
 ## Responsibilities
+
 The Digital Experience department is directly responsible for the framework, content design, and technology behind Fleet's remote work culture, including fleetdm.com, the handbook, issue templates, UI style guides, internal tooling, Zapier flows, Docusign templates, key spreadsheets, and project management processes. 
 
 > _**Note:** If a user story involves only changes to fleetdm.com, without changing the core product, then that user story is prioritized, drafted, implemented, and shipped by the [Digital Experience](https://fleetdm.com/handbook/digital-experience) department.  Otherwise, if the story **also** involves changes to the core product **as well as** fleetdm.com, then that user story is prioritized, drafted, implemented, and shipped by [the other relevant product group](https://fleetdm.com/handbook/company/product-groups#current-product-groups), and not by `#g-digital-experience`._
 
+
 ### QA a change to fleetdm.com
+
 Each PR to the website is manually checked for quality and tested before going live on fleetdm.com. To test any change to fleetdm.com
 
 1. Write clear step-by-step instructions to confirm that the change to the fleetdm.com functions as expected and doesn't break any possible automation. These steps should be simple and clear enough for anybody to follow.
@@ -34,7 +40,8 @@ Each PR to the website is manually checked for quality and tested before going l
 
 
 ### Update the host count of a premium subscription
-When a self-service license dispenser customer reaches out to upgrade a license via the contact form, a member of the [Demand department](https://fleetdm.com/handbook/demand) will create a confidential issue detailing the request and add it to the new requests column of Ditigal Experience kanban board. A member of this team will then log into Stripe using the shared login, and upgrade the customer's subscription.
+
+When a self-service license dispenser customer reaches out to upgrade a license via the contact form, a member of the [Demand department](https://fleetdm.com/handbook/demand) will create a confidential issue detailing the request and add it to the new requests column of [Digital Experience kanban board](https://github.com/fleetdm/confidential/issues#workspaces/g-digital-experience-6451748b4eb15200131d4bab/board). A member of this team will then log into Stripe using the shared login, and upgrade the customer's subscription.
 
 To update the host count on a user's subscription:
 
@@ -46,7 +53,9 @@ To update the host count on a user's subscription:
 6. Select "Update subscription" to send the user an updated invoice for their subscription. Once the customer pays their new invoice, the Fleet website will update the user's subscription and generate a new Fleet Premium license with an updated host count.
 7. Let the person who created the request know what actions were taken so they can communicate them to the customer.
 
+
 ### Test fleetdm.com locally 
+
 When making changes to the Fleet website, you can test your changes by running the website locally. To do this, you'll need the following:
 
 - A local copy of the [Fleet repo](https://github.com/fleetdm/fleet).
@@ -78,10 +87,12 @@ Once you have the above follow these steps:
 
 
 ### Check production dependencies of fleetdm.com
+
 Every week, we run `npm audit --only=prod` to check for vulnerabilities on the production dependencies of fleetdm.com. Once we have a solution to configure GitHub's Dependabot to ignore devDependencies, this manual process can be replaced with Dependabot.
 
 
 ### Respond to a 5xx error on fleetdm.com
+
 Production systems can fail for various reasons, and it can be frustrating to users when they do, and customer experience is significant to Fleet. In the event of system failure, Fleet will:
 - investigate the problem to determine the root cause.
 - identify affected users.
@@ -92,6 +103,7 @@ Production systems can fail for various reasons, and it can be frustrating to us
 
 
 ### Check browser compatibility for fleetdm.com
+
 A browser compatibility check of [fleetdm.com](https://fleetdm.com/) should be carried out monthly to verify that the website looks and functions as expected across all [supported browsers](https://fleetdm.com/docs/using-fleet/supported-browsers).
 
 - We use [BrowserStack](https://www.browserstack.com/users/sign_in) (logins can be found in [1Password](https://start.1password.com/open/i?a=N3F7LHAKQ5G3JPFPX234EC4ZDQ&v=3ycqkai6naxhqsylmsos6vairu&i=nwnxrrbpcwkuzaazh3rywzoh6e&h=fleetdevicemanagement.1password.com)) for our cross-browser checks.
@@ -101,6 +113,7 @@ A browser compatibility check of [fleetdm.com](https://fleetdm.com/) should be c
 
 
 ### Export an image for fleetdm.com
+
 In Figma:
 1. Select the layers you want to export.
 2. Confirm export settings and naming convention:
@@ -110,8 +123,9 @@ In Figma:
   - Avoid using SVGs or icon fonts.
 3. Click the __Export__ button.
 
-
+<!-- Commenting this out as we don't have any planned landing pages in the future see: https://github.com/fleetdm/fleet/issues/21117
 ### Generate a new landing page
+
 Experimental pages are short-lived, temporary landing pages intended for a small audience. All experiments and landing pages need to go through the standard [drafting process](https://fleetdm.com/handbook/company/product-groups#making-changes) before they are created.
 
 Website experiments and landing pages live behind `/imagine` url. Which is hidden from the sitemap and intended to be linked to from ads and marketing campaigns. Design experiments (flyers, swag, etc.) should be limited to small audiences (less than 500 people) to avoid damaging the brand or confusing our customers. In general, experiments that are of a design nature should be targeted at prospects and random users, never targeted at our customers.
@@ -146,9 +160,10 @@ To generate a new page, you'll need:
 5. Start the website by running `node ./node_modules/sails/bin/sails lift` (or `sails lift` if you have Sails installed globally). The new landing page will be availible at `http://localhost:1337/imagine/{page-name}`.
 
 6. Replace the lorum ipsum and placeholder images on the generated page with the page's real content, and add a meta description and title by changing the `pageTitleForMeta` and `pageDescriptionForMeta in the page's `locals` in `website/config/routes.js`.
-
+-->
 
 ### Restart Algolia manually
+
 At least once every hour, an Algolia crawler reindexes the Fleet website's content. If an error occurs while the website is being indexed, Algolia will block our crawler and respond to requests with this message: `"This action cannot be executed on a blocked crawler"`.
 
 When this happens, you'll need to manually start the crawler in the [Algolia crawler dashboard](https://crawler.algolia.com/admin/) to unblock it. 
@@ -158,6 +173,7 @@ No further action is needed if the crawler successfully reindexes the Fleet webs
 
 
 ### Re-run the "Deploy Fleet Website" action
+
 If the action fails, please complete the following steps:
 1. Head to the fleetdm-website app in the [Heroku dashboard](https://heroku.com) and select the "Activity" tab.
 2. Select "Roll back to here" on the second to most recent deploy.
@@ -165,6 +181,7 @@ If the action fails, please complete the following steps:
 
 
 ### Communicate Fleet's potential energy to stakeholders
+
 On the first business day of every month, the Head of Digital Experience will send an update to the stakeholders of Fleet using the following steps:
 1. Copy the following template into an outgoing email with the subject line: "[Investor update] Fleet, YYYY-MM".
 
@@ -184,12 +201,6 @@ Mike and the Fleet team
 3. Using the [🌧️🦉 Investors + advisors](https://docs.google.com/spreadsheets/d/15knBE2-PrQ1Ad-QcIk0mxCN-xFsATKK9hcifqrm0qFQ/edit#gid=1068113636) spreadsheet, bcc the correct individuals and send the email.
 
 
-### Refresh event calendar
-Fleet's public relations firm is directly responsible for the accuracy of event locations, attendance dates, and CFP deadlines in the event strategy workbook.  At the end of every quarter, the PR firm updates every event in the ["Event strategy workbook"](https://docs.google.com/spreadsheets/d/1YQXAX2Q_WnGkAwMYjMbQpV3nbCj7gOBbv7Y0u4twxzQ/edit) (private Google doc) by following these steps:
-1. Visit the latest website for each event.
-2. Update the workbook with the latest location, dates, and CFP deadlines from the website.
-
-
 ### Grant role-specific license to a team member
 
 Certain new team members, especially in go-to-market (GTM) roles, will need paid access to paid tools like Salesforce and LinkedIn Sales Navigator immediately on their first day with the company. Gong licenses that other departments need may [request them from Digital Experience](https://fleetdm.com/handbook/digital-experience#contact-us) and we will make sure there is no license redundancy in that department. The table below can be used to determine which paid licenses they will need, based on their role:
@@ -234,7 +245,8 @@ Here are the steps we take to grant appropriate Salesforce licenses to a new hir
 
 
 ### Schedule press release
-Fleet will occasionally release information to the press regarding upcoming initiatives before updating the functionality of the core product. This process sUse the following steps to schedule a press release:  
+
+Fleet will occasionally release information to the press regarding upcoming initiatives before updating the functionality of the core product. Use the following steps to schedule a press release:  
 
 1. Add context for the next press release to the [e-group agenda](https://docs.google.com/document/d/13fjq3T0bZGOUah9cqHVxngckv0EB2R24A3gfl5cH7eo/edit) as a "DISCUSS:" to be reviewed by Fleet's executive team for alignment and finalization of date.
 2. Once a release date is set, at-mention our public relations firm in the [#help-public-relations-firm--mindshare-pr--brand-marketing](https://fleetdm.slack.com/archives/C04PC9H34LF) and schedule a 30m call for our CEO and to communicate the press release.
@@ -247,12 +259,15 @@ Fleet will occasionally release information to the press regarding upcoming init
 
 
 ### Process the help-being-ceo Slack channel
+
 The Apprentice will perform the following steps to process all communication from the CEO in the [help-being-ceo Slack channel](https://fleetdm.slack.com/archives/C03U703J0G5).
 1. As soon as the message is received in the channel, add the "`:eyes:` (👀)" emoji to the Slack message to signify that you have seen and understood the task or question.
 2. Start a Slack thread to add any context or let the stakeholders know the status of the task. 
 3. After each task is completed, apply the "`:white_check_mark:`" (✅) to the slack message.
 
+
 ### Archive a document
+
 Follow these steps to archive any document:
 1. Create a copy of the document prefixed with the date using the format "`YYYY-MM-DD` Backup of `DOCUMENT_NAME`" (e.g. "2024-03-22 Backup of 🪂🗞️ Customer voice").
 2. Be sure to "Share it with the same people", "Copy comments and suggestions", and "Include resolved comments and suggestions" as shown below.
@@ -265,15 +280,27 @@ Follow these steps to archive any document:
 
 
 ### Schedule CEO interview
-From time to time, you will need to schedule an interview between a candidate and the CEO:
-1. [Make a copy of the "¶¶ CEO interview template"](https://docs.google.com/document/d/1yARlH6iZY-cP9cQbmL3z6TbMy-Ii7lO64RbuolpWQzI/copy) (private Google doc)
-2. Change file name and heading of doc to `¶¶ CANDIDATE_NAME (CANDIDATE_TITLE) <> Mike McNeil, CEO final interview (YYYY-MM-DD)`
+
+Use the following steps to schedule an interview between a candidate and the CEO:
+1. Once you receive a [CEO interview request](https://fleetdm.com/handbook/company/leadership#hiring-a-new-team-member), apply the "eyes" (👀) emoji to the Slack post to acknowledge you've seen the request.
+2. Reach out to the candidate via email to find a time when the CEO and candidate are both available.
+   > This entire process takes an hour for the CEO: a 30-minute interview followed by a 30-minute "¶¶ Postgame" Be sure to offer times that accommodate this.
+3. [Make a copy of the "¶¶ CEO interview template"](https://docs.google.com/document/d/1yARlH6iZY-cP9cQbmL3z6TbMy-Ii7lO64RbuolpWQzI/copy) (private Google doc) and move it to the "[🕵️ ¶±¶ Reference checks & hiring data](https://drive.google.com/drive/folders/1VgKT6_VrQ9zYMnDOwJGE1mT1WrrMFqJw?usp=drive_link)" folder in Google Drive. 
+4. Prep the CEO interview doc:
+   - Change file name and heading of doc to `¶¶ CANDIDATE_NAME (CANDIDATE_TITLE) <> Mike McNeil, CEO final interview (YYYY-MM-DD)`.
    - Add candidate's personal email in the "👥" (attendees) section at the top of the doc.
    - Add candidate's [LinkedIn url](https://www.linkedin.com/search/results/all/?keywords=people) on the first bullet for Mike.
-3. Set the Google Calendar description of the calendar event to: `Agenda: URL_FOR_NEW_COPY_OF_FINAL_INTERVIEW_DOC`
+   - Share the CEO interview doc with the hiring manager as a "Commenter".
+5. Link the CEO interview doc at the top of the "feedback" doc shared in the CEO interview request
+6. Create a Google Calendar event at a time when the CEO and the candidate are both available.
+   - Create a Google Calendar event matching the title of the interview doc.
+   - Add the interview doc to the calendar event description as the agenda (i.e. `Agenda: INTERVIEW_DOC_FULL_URL`) and save the calendar event.
+7. Schedule a 30-minute "¶¶ Postgame" working session for the CEO to evaluate the candidate and give his recommendation.
+8. In the hiring channel for the position, apply the "green-check-mark" (✅) emoji to the CEO interview request to confirm the request has been processed. 
 
 
 ### Program the CEO to do something
+
 1. If necessary or if unsure, immediately direct message the CEO on Slack to clarify priority level, timing, and level of effort.  (For example, whether to schedule 30m or 60m to complete in full, or 30m planning as an iterative step.)
 2. If there is not room on the calendar to schedule this soon enough with both Mike and Sam as needed (erring on the side of sooner), then either immediately direct message the CEO with a backup plan, or if it can obviously wait, then discuss at the next roundup.
 3. Create a calendar event with a Zoom meeting for the CEO and Apprentice.  Keep the title short.  For the description, keep it very brief and use this template:
@@ -288,6 +315,7 @@ Agenda:
 ```
 
 ### Obtain a signature from the CEO
+
 When an agreement is routed to the CEO for signature, the [Apprentice](https://fleetdm.com/handbook/digital-experience#team) is responsible for obtaining a signature from the CEO using the following steps:
 1. Drag the email to the ["🔏 SAM: Signature wanted"](https://mail.google.com/mail/u/0/#label/SAM%3A+Signature+wanted) label making sure to mark the email as unread.
 2. A Business Operations Engineer will at-mention the Apprentice in a legal review issue, letting them know the contract is good to go. After that, move the email to the "[✍️ MIKE: Ready to sign](https://mail.google.com/mail/u/0/#label/%E2%9C%8D%EF%B8%8F+MIKE%3A+Ready+to+sign)" label
@@ -298,6 +326,7 @@ When an agreement is routed to the CEO for signature, the [Apprentice](https://f
 
 
 ### Prepare for CEO office minutes 
+
 Before the start of the meeting, the Apprentice will prepare the "CEO office minutes" meeting [agenda](https://docs.google.com/document/d/12cd0N8KvHkfJxYlo7ggdisrvqw4MCErDoIzLjmBIdj4/edit) such that the following is true:
 1. All agenda items are prefixed with a date of when the item will be covered and name of the person requesting to discuss the issue.
 2. All team members with an agenda item have added themselves **and their manager** to the correct calendar event. If the team member or manager hasn't been added to the calendar event before the meeting begins, the agenda item is de-prioritized in favor of others with representatives in attendance. 
@@ -307,6 +336,7 @@ Before the start of the meeting, the Apprentice will prepare the "CEO office min
 
 
 ### Process the CEO's calendar
+
 Time management for the CEO is essential.  The Apprentice processes the CEO's calendar multiple times per day.
 
 - **Clear any unexpected new events or double-bookings.** Look for any new double-bookings, invites that haven't been accepted, or other events you don't recognize.
@@ -335,20 +365,32 @@ Time management for the CEO is essential.  The Apprentice processes the CEO's ca
   6. Edit the calendar event description, changing “Notes” to “Agenda” when you're finished preparing the document to signify that this meeting has been prepped.
 
 
+### Confirm CEO shadow dates
+
+After the team member notifies the Head of Digital Experience (via Slack), the Head of DigExp will bring the dates to the next roundup as a "DISCUSS: CEO shadow dates". Use the following steps to confirm CEO shadow dates:
+1. Create an "All day", "Free" event on the CEO's calendar that matches the CEO shadow dates and name the calendar event "CEO shadow - [NAME] (Job title)".
+3. Confirm the "shadowability" for external and nonrecurring internal meetings with the CEO during the next daily 🐈‍⬛🌪️ Roundup.
+4. Go through the calendar and make sure all private meetings (e.g. 1:1's, E-Group, and quarterly board meetings) have "[no shadows]" in the event title.
+
+
 ### Process the CEO's inbox
+
 - The Apprentice is [responsible](https://fleetdm.com/handbook/company/why-this-way#why-direct-responsibility) for [processing all email traffic](https://docs.google.com/document/d/1gH3IRRgptrqSYzBFy-77g98JROTL8wqrazJIMkp-Gb4/edit#heading=h.i7mkhr6m123r) prior to CEO review to reduce the scope of Mike's inbox to only include necessary and actionable communication.
  -  Marking spam emails as read (same for emails Mike doesn't actually need to read).
  -  Escalate actionable sales communication and update Mike directly.
  -  Ensure all calendar invites have the necessary documents included.
  -  Forward any emails from customers about paying Fleet to the Buisness Operations department using [Fleet's billing email](https://docs.google.com/document/d/1tE-NpNfw1icmU2MjYuBRib0VWBPVAdmq4NiCrpuI0F0/edit#heading=h.wqalwz1je6rq).
 
+
 ### Document performance feedback
+
 Every Friday at 5PM a [Business Operations team member](https://fleetdm.com/handbook/business-operations#team) will look for missing data in the [KPIs spreadsheet](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit#gid=0). 
 1. If KPIs are not reported on time, the BizOps Engineer will notify the Apprentice to the CEO and the DRI.
 2. The Apprentice will update the "performance management" section of the appropriate individual's 1:1 doc so that the CEO can address during the next 1:1 meeting with the DRI.
 
 
 ### Send the weekly update
+
 We like to be open about milestones and announcements. Every Friday, e-group members [report their KPIs for the week](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit) by 5:00pm U.S. CT. Every Friday at 6PM, the Apprentice will post a short update in [#general](https://fleetdm.slack.com/archives/C019FNQPA23) including:
     - A link to view KPIs
     - Who was on-call that week
@@ -369,6 +411,7 @@ We like to be open about milestones and announcements. Every Friday, e-group mem
 
 
 ### Troubleshoot signature automation
+
 We use Zapier to automate how completed DocuSign envelopes are formatted and stored. This process ensures we store signed documents in the correct folder and that filenames are formatted consistently. 
 When the final signature is added to an envelope in DocuSign, it is marked as completed and sent to Zapier, where it goes through these steps:
 1. Zapier sends the following information about the DocuSign envelope to our Hydroplane webhook:
@@ -388,6 +431,7 @@ When the final signature is added to an envelope in DocuSign, it is marked as co
 
 
 ### Schedule travel for the CEO
+
 The Apprentice schedules all travel arrangements for the CEO including flights, hotel, and reservations if needed. CEO traveling preferences in descending order of importance are:
   - Direct flight whenever possible  (as long as the cost of the direct flight is ≤2x the cost of a reasonable non-direct flight)
   - Select a non-middle seat, whenever possible
@@ -399,6 +443,7 @@ The Apprentice schedules all travel arrangements for the CEO including flights,
 
 
 ### Prepare for the All hands
+
 - **Every month** the Apprentice will do the prep work for the monthly "✌️ All hands 🖐👋🤲👏🙌🤘" call.
   -  In the ["👋 All hands" folder](https://drive.google.com/drive/folders/1cw_lL3_Xu9ZOXKGPghh8F4tc0ND9kQeY?usp=sharing), create a new folder using "yyyy-mm - All hands".
   - Update "End of the quarter" slides to reflect the current countdown.
@@ -416,6 +461,7 @@ The day before the All hands, Mike will prepare slides that reflect the CEO visi
 
 
 #### Share recording of all hands meeting
+
 The Apprentice will post a link to the All hands Gong recording and slide deck in Slack.
 
 Template to use:
@@ -438,28 +484,35 @@ You can also grab a copy of the [original slides](https://fleetdm.com/handbook/c
 
 
 ### Process and backup Sid agenda
+
 Every two weeks, our CEO Mike has a meeting with Sid Sijbrandij. The CEO uses dedicated (blocked, recurring) time to prepare for this meeting earlier in the week.
 1. 30 minutes After each meeting [archive the "💻 Sid : Mike(Fleet)" agenda](https://fleetdm.com/handbook/digital-experience#archive-a-document), moving it to the [(¶¶) Sid archive](https://drive.google.com/drive/folders/1izVfIBt2nr4APlkm36E6DJg1k1PDjmae) folder in Google Drive.
-2. **In the backup copy**, leave Google Doc comments assigning all Fleet TODOs to the correct DRI.   
+2. **In the backup copy**, create Google Doc comments assigning all Fleet TODOs to the correct DRI.   
 3. In the ¶¶¶¶🦿🌪️CEO Roundup doc, update the URL in `Sam: FYI: Agenda from last time:` [LINK](link).
 
 
 ### Process and backup E-group agenda 
+
 Follow these steps to process and backup the E-group agenda: 
 1. [Archive the E-group agenda](https://fleetdm.com/handbook/digital-experience#archive-a-document) after each meeting, moving it to the ["¶¶ E-group archive"](https://drive.google.com/drive/u/0/folders/1IsSGMgbt4pDcP8gSnLj8Z8NGY7_6UTt6) folder in Google Drive.
 2. **In the backup copy**, leave Google Doc comments assigning all TODOs to the correct DRI.  
 3. If the "All hands" meeting has happened today remove any spotlights covered in the current "All hands" presentation.
 
-### Check LinkedIn for unread messages 
-Once a day the Apprentice will confirm check LinkedIn for unread messages. 
-- Log into the CEO's [LinkedIn](https://www.linkedin.com/search/results/all/?sid=s2%3A).
-  - Bring up the messaging window and filter out all read messages. 
-    - Click the "filter" icon in the messaging search bar.
-    - Click "Unread".
-    Bring all unreads to the CEO.
+### Check LinkedIn for new activity 
+
+Once a day the Apprentice will check LinkedIn for unread messages and pending connect request. 
+
+  1. Log into the CEO's [LinkedIn](https://www.linkedin.com/search/results/all/?sid=s2%3A) and bring up the messaging window.
+  2. Filter out all read messages by clicking "filter" and then "Unread".
+  3. Bring all unreads to the CEO during the daily roundup.
+     
+To check for pending connect requests, perform the following steps:
+  1. Log into the CEO's LinkedIn (if you're not already) and click "My Network".
+  2. Bring all pending connect requests to the CEO during the daily roundup.  
 
 
 ### Unroll a Slack thread
+
 From time to time the CEO will ask the Apprentice to unroll a Slack thread into a well-named whiteboard Google doc for safekeeping and future searching. 
   1. Start with a new doc.
   2. Name the file with "yyyy-mm-dd - topic" (something empathetic and easy to find).
@@ -468,13 +521,13 @@ From time to time the CEO will ask the Apprentice to unroll a Slack thread into
       - To copy images right-click+copy and then paste in the doc (some resizing may be necessary to fit the page).
 
 
-
 ### Delete an accidental meeting recording
+
 It's not enough to just "delete" a recording of a meeting in Gong.  Instead, use these steps:
 
 - Wait for at least 30 minutes after the meeting has ended to ensure the recording and transcript exist and can be deleted.
 - [Sign in to Gong](https://us-65885.app.gong.io/deals?company-id=2676443513846037003&workspace-id=9148397688380544352&board-id=8761946992754097113&view-mode=DEALS&tab-idx=0&account-activity=true&owner-ids=&owner-team-ids=5778354842532790437&timespan-id=34&sort-by=DealActivity&sort-field=%7B%22type%22%3A%22RegularField%22%2C%22name%22%3A%22DealActivity%22%7D&sort-order=DESC&owner-id=5778354842532790437&include-team=true) through the CEO's browser.
-- Click `Conversations`
+- Scroll down to `Conversations`
 - Select the call recording no longer needed
 - Click the "hotdog" menu in the right-hand corner
 <img width="264" alt="image" src="https://github.com/fleetdm/fleet/assets/108141731/86948d02-a972-42ef-9a2d-1d93f24a1780">
@@ -482,6 +535,12 @@ It's not enough to just "delete" a recording of a meeting in Gong.  Instead, use
 - Search for the title of the meeting Google Drive and delete the auto-generated Google Doc containing the transcript. 
 - Always check back to ensure the recording **and** transcript were both deleted.
 
+### Update a company brand front
+
+Fleet has several brand fronts that need to be updated from time to time. Check each [brand front](https://docs.google.com/spreadsheets/d/1c15vwMZytpCLHUdGvXxi0d6WGgPcQU1UBMniC1F9oKk/edit?gid=0#gid=0) for consistency and update as needed with the following: 
+- The current pitch, found in the blurbs section of the [🎐 Why Fleet?](https://docs.google.com/document/d/1E0VU4AcB6UTVRd4JKD45Saxh9Gz-mkO3LnGSTBDLEZo/edit#heading=h.uovxedjegxdc) doc. 
+- The current [brand imagery](https://www.figma.com/design/1J2yxqH8Q7u8V7YTtA1iej/Social-media-(logos%2C-covers%2C-banners)?node-id=3962-65895). Check this [Loom video](https://www.loom.com/share/4432646cc9614046aaa4a74da1c0adb5?sid=2f84779f-f0bd-4055-be69-282c5a16f5c5) for more info.
+
 
 ## Rituals
 
diff --git a/handbook/digital-experience/digital-experience.rituals.yml b/handbook/digital-experience/digital-experience.rituals.yml
index 9dd46d69b58a..9e1999d304b2 100644
--- a/handbook/digital-experience/digital-experience.rituals.yml
+++ b/handbook/digital-experience/digital-experience.rituals.yml
@@ -1,6 +1,24 @@
 # https://github.com/fleetdm/fleet/pull/13084
-
-
+- 
+  task: "Complete Digital Experience KPIs"
+  startedOn: "2024-08-30" 
+  frequency: "Weekly"
+  description: "Complete Digital Experience KPIs for this week"
+  moreInfoUrl: "https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit?gid=0#gid=0&range=DB1"
+  dri: "SFriendLee"
+  autoIssue:   
+    labels: [ "#g-digital-experience" ]
+    repo: "fleet"
+- 
+  task: "Prep 1:1s for OKR planning"
+  startedOn: "2024-09-09" 
+  frequency: "Monthly"
+  description: "Add ”DISCUSS: Mike: Expectations of OKR planning“ to each e-group member's 1:1 document"
+  moreInfoUrl: "https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit"
+  dri: "SFriendLee"
+  autoIssue:   
+    labels: [ "#g-digital-experience" ]
+    repo: fleet
 - 
   task: "Check browser compatibility for fleetdm.com"
   startedOn: "2024-03-06" 
@@ -9,8 +27,22 @@
   moreInfoUrl: "https://fleetdm.com/handbook/digital-experience#check-browser-compatibility-for-fleetdm-com"
   dri: "eashaw"
   autoIssue:   
-    labels: [ "#g-digital-experience" ] # label to be applied to issue
+    labels: [ "#g-digital-experience" ]
     repo: fleet
+- 
+  task: "Regenerate messaging framework"
+  startedOn: "2024-07-15"
+  frequency: "Quarterly"
+  description: "Run through the entire website in `?utm_content=clear` mode and build a fresh outline of the headings to make sure they all still make sense."
+  moreInfoUrl: ""
+  dri: "mike-j-thomas"
+- 
+  task: "Check brand fronts are up to date"
+  startedOn: "2024-08-01"
+  frequency: "Quarterly"
+  description: "Check all brand fronts for consistancy and update as needed with the current product pitch and graphics."
+  moreInfoUrl: "https://fleetdm.com/handbook/digital-experience#update-a-company-brand-front"
+  dri: "mike-j-thomas"  
 - 
   task: "Check production dependencies of fleetdm.com"
   startedOn: "2023-11-10" 
@@ -21,16 +53,6 @@
   autoIssue:  
     labels: [ "#g-digital-experience" ] 
     repo: fleet
-- 
-  task: "Generate latest schema"
-  startedOn: "2024-02-19" 
-  frequency: "Weekly"
-  description: "After each sprint, generate the latest tables json file to incorporate any new schema documentation."
-  moreInfoUrl: https://fleetdm.com/handbook/company/product-groups#changes-to-tables-schema
-  dri: "eashaw"
-  autoIssue:   
-    labels: [ "#g-digital-experience" ]
-    repo: fleet
 - 
   task: "Check osquery Slack invitation"
   startedOn: "2023-11-10" 
@@ -48,18 +70,11 @@
   description: "Prepare the CEO office minutes calendar event and meeting agenda"
   moreInfoUrl: "https://fleetdm.com/handbook/digital-experience#prepare-for-ceo-office-minutes"
   dri: "SFriendLee"
-- 
-  task: "Refresh event calendar"
-  startedOn: "2023-12-31"
-  frequency: "Quarterly"
-  description: "https://fleetdm.com/handbook/digital-experience#refresh-event-calendar"
-  moreInfoUrl: "https://fleetdm.com/handbook/digital-experience#refresh-event-calendar"
-  dri: "sampfluger88"
 -
   task: "Prioritize for next sprint" # Title that will actually show in rituals table
   startedOn: "2023-08-09" # Needs to align with frequency e.g. if frequency is every thrid Thursday startedOn === any third thursday
   frequency: "Triweekly" # must be supported by https://github.com/fleetdm/fleet/blob/dbbb501358e226fa3fdf48865175efe3334c826c/website/scripts/build-static-content.js
-  description: "Drag next sprint's priorities to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/digital-experiencemunication)"
+  description: "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/digital-experiencemunication)"
   moreInfoUrl: "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible" #URL used to highlight "description:" test in table
   dri: "sampfluger88" # DRI for ritual (assignee if autoIssue) (TODO display GitHub proflie pic instead of name or title)
   autoIssue:   # Enables automation of GitHub issues
@@ -108,8 +123,8 @@
     repo: "confidential"
 -
   task: "Process and backup Sid agenda"
-  startedOn: "2023-09-15"
-  frequency: "Weekly"
+  startedOn: "2023-09-25"
+  frequency: "Monthly"
   description: "Process and backup Sid agenda"
   moreInfoUrl: "https://fleetdm.com/handbook/digital-experience#process-and-backup-e-group-agenda"
   dri: "SFriendLee"
@@ -147,24 +162,14 @@
   startedOn: "2023-07-29"
   frequency: "Daily"
   description: "Filter all action items from CEO's GitHub notifications"
-  dri: "sampfluger88"
+  dri: "SFriendLee"
 -
   task: "Check LinkedIn for unread messages"
   startedOn: "2023-09-25"
   frequency: "Daily"
   description: "Prevent connections from slipping through the cracks"
   moreInfoUrl: "https://fleetdm.com/handbook/digital-experience#check-linkedin-for-unread-messages"
-  dri: "sampfluger88"
--
-  task: "Add funds to coresignal account"
-  startedOn: "2023-09-25"
-  frequency: "Monthly"
-  description: "Top up coresignal account once per month: https://dashboard.coresignal.com/pricing-plans"
-  moreInfoUrl: "https://dashboard.coresignal.com/pricing-plans"
   dri: "SFriendLee"
-  autoIssue:  
-    labels: [ "#g-digital-experience" ] 
-    repo: "confidential" 
 -
   task: "Downgrade unused license seats" 
   startedOn: "2024-03-31" 
diff --git a/handbook/engineering/README.md b/handbook/engineering/README.md
index 5bc5efe84da4..70d9cd75f46e 100644
--- a/handbook/engineering/README.md
+++ b/handbook/engineering/README.md
@@ -1,7 +1,10 @@
 # Engineering
+
 This handbook page details processes specific to working [with](#contact-us) and [within](#responsibilities) this department.
 
+
 ## Team
+
 | Role                            | Contributor(s)           |
 |:--------------------------------|:-----------------------------------------------------------------------------------------------------------|
 | Chief Technology Officer (CTO)  | [Luke Heath](https://www.linkedin.com/in/lukeheath/) _([@lukeheath](https://github.com/lukeheath))_
@@ -12,14 +15,19 @@ This handbook page details processes specific to working [with](#contact-us) and
 
 
 ## Contact us
+
 - To **make a request** of this department, [create an issue](https://fleetdm.com/handbook/company/product-groups#current-product-groups) and a team member will get back to you within one business day (If urgent, mention a [team member](#team) in the [#help-engineering](https://fleetdm.slack.com/archives/C019WG4GH0A) Slack channel.
   - Any Fleet team member can [view the kanban boards](https://fleetdm.com/handbook/company/product-groups#current-product-groups) for this department, including pending tasks and the status of new requests.
   - Please **use issue comments and GitHub mentions** to communicate follow-ups or answer questions related to your request.
 
+
 ## Responsibilities
+
 The 🚀 Engineering department at Fleet is directly responsible for writing and maintaining the [code](https://github.com/fleetdm/fleet) for Fleet's core product and infrastructure.
 
+
 ### Record engineering KPIs
+
 We track the success of this process by observing the throughput of issues through the system and identifying where buildups (and therefore bottlenecks) are occurring.
 The metrics are:
 * Number of bugs opened this week
@@ -29,7 +37,19 @@ The metrics are:
 
 Each week these are tracked and shared in the weekly KPI sheet by Luke Heath.
 
+
+### Write a feature guide 
+
+We write [guides](https://fleetdm.com/guides) for all new features. Feature guides are published before the feature is released so that our users understand how the feature is intended to work. A guide is a type of article, so the process for writing a guide and article is the same.
+
+1. Review and follow the [Fleet writing style guide](https://fleetdm.com/handbook/company/communications#writing).
+2. Make a copy of the ["Article: Guide Template"](https://docs.google.com/document/d/1OPcDouyfyFPg3ScrN4bo6ol8vMfMa3P9-BIfbnEdcg4/copy) and rename "Article: [Guide] {feature name}".
+3. Open the template and insert your [drafted content](https://fleetdm.com/handbook/company/product-groups#defining-done) into the provided template format. 
+4. Create a [new GitHub issue](https://github.com/fleetdm/fleet/issues/new?assignees=spokanemac&labels=:help-it&title=New%20guide:) with the guide title, and add the `:help-it` label. It will be processed and added to the website by our [Community Advocate](https://fleetdm.com/handbook/engineering#team).
+
+
 ### Create an engineering-initiated story
+
 Engineering-initiated stories are types of user stories created by engineers to make technical changes to Fleet. Technical changes should improve the user experience or contributor experience. For example, optimizing SQL that improves the response time of an API endpoint improves user experience by reducing latency. A script that generates common boilerplate, or automated tests to cover important business logic, improves the quality of life for contributors, making them happier and more productive, resulting in faster delivery of features to our customers.
 
 It is important to frame engineering-initiated user stories the same way we frame all user stories. Stay focused on how this technical change will drive value for our users.
@@ -44,6 +64,7 @@ If there are no product changes, and the DRI decides to prioritize the story, th
 
 > We prefer the term engineering-initiated stories over technical debt because the user story format helps keep us focused on our users and contributors.
 
+
 ### Fix a bug
 
 All bug fix pull requests should have a mention back to the issue they resolve with #<ticket_number> in the description or even in a comment. Please do not use any [automated words](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword) since we don't want the tickets auto-closing when PR's are merged. 
@@ -51,37 +72,49 @@ If the bug is labeled `~unreleased bug`, branch off and put your PR into `main`.
 
 If the bug is labeled `~released bug`, branch off and put your PR into `main`. After merging checkout the latest tag, for example `git checkout fleet-v4.48.2`, then `git fetch; git cherry-pick <commit>`. If the cherry-pick fails with a conflict call out in the ticket how to resolve or if it is sufficiently complicated call out this fix is not suited for the patch release process and should only be included in the end of sprint release. This approach makes sure the bug fix is not built on top of unreleased feature code, which can cause merge conflicts during patch releases. 
 
-### Begin a merge freeze
-To ensure release quality, Fleet has a freeze period for testing beginning the Tuesday before the release at 11:00 AM Pacific. Effective at the start of the freeze period, new feature work will not be merged into `main`.
 
-Bugs are exempt from the release freeze period.
+### Create a release candidate
+
+All minor releases go through the release candidate process before they are published. A release candidate for the next minor release is created on the Tuesday before the release at 11:00 AM Pacific. A release candidate branch is created at `minor-fleet-v4.x.x` and no additional feature work is merged without EM and QA approval.
+
+All bug fixes that are merged into `main` after the release candidate is created are merged into the release candidate by the engineer responsible for the fix.
+
+[Run the first step](https://github.com/fleetdm/fleet/tree/main/tools/release#minor-release-typically-end-of-sprint) of the minor release section of the Fleet releases script to create the release candidate branch, the release QA issue, and announce the release candidate in Slack.
+
+
+### Deploy the release candidate to QA Wolf
+
+During the release candidate period, the release candidate is deployed to our QA Wolf instance every morning instead of `main` to ensure that any new bugs reported by QA Wolf are in the upcoming release and need to be fixed before publishing the release.
+
+Open the [confidential repo environment variables](https://github.com/fleetdm/confidential/settings/variables/actions) page and update the `QAWOLF_DEPLOY_TAG` repository variable with the name of the release candidate branch. 
 
-To begin the freeze, [open the repo on Merge Freeze](https://www.mergefreeze.com/installations/3704/branches/6847) and click the "Freeze now" button. This will freeze the `main` branch and require any PRs to be manually unfrozen before merging. PRs can be manually unfrozen in Merge Freeze using the PR number.
 
-> Any Fleetie can [unfreeze PRs on Merge Freeze](https://www.mergefreeze.com/installations/3704/branches) if the PR contains documentation changes or bug fixes only. If the PR contains other changes, please confirm with your manager before unfreezing.
+### Merge bug fixes into the release candidate
 
-### Merge a pull request during the freeze period
-We merge bug fixes, documentation changes, and website updates during the freeze period, but we do not merge other code changes. This minimizes code churn and helps ensure a stable release. To merge a bug fix, you must first unfreeze the PR in [Merge Freeze](https://app.mergefreeze.com/installations/3704/branches), and click the "Unfreeze 1 pull request" text link. 
+Only merge bug fixes during the release candidate period to minimize code churn and help ensure a stable release. To merge a bug fix into the release candidate, it should first be merged into `main`. Then, `git checkout` the release candidate branch and create a new local branch. Next, `git cherry-pick` your commit from `main` into your new local branch, then create a pull request from your new branch to the release candidate. This process ensures your bug fix is included in `main` for future releases, as well as the release candidate branch for the pending release.
 
 > To allow a stable release test, the final 24 hours before release is a deep freeze when only bugs with the `~release-blocker` or `~unreleased-bug` labels are merged.
 
-If there is partially merged feature work when freeze begins, the previously merged code must be reverted. If there is an exceptional, business-critical need to merge feature work during freeze, as determined by the [release ritual DRI](#rituals), the following exception process may be followed:
+If there is partially merged feature work when the release candidate is created, the previously merged code must be reverted. If there is an exceptional, business-critical need to merge feature work into the release candidate, as determined by the [release ritual DRI](#rituals), the release candidate [feature merge exception process](https://fleetdm.com/handbook/engineering#request-release-candidate-feature-merge-exception) may be followed.
 
-1. The engineer requesting the feature work merge exception during freeze notifies their Engineering Manager. 
-2. The Engineering Manager notifies the QA lead for the product group and the [release ritual DRI](https://fleetdm.com/handbook/engineering#rituals). 
-3. The Engineering Manager, QA lead, and [release ritual DRI](#rituals) must all approve the feature work PR before it is unfrozen and merged.
+### Request release candidate feature merge exception
+
+1. Notify product group EM that feature work will not merge into `main` before the release candidate is cut and requires a feature merge exception.
+2. EM notifies QA lead for the product group and the [release ritual DRI](https://fleetdm.com/handbook/engineering#rituals).
+3. EM, QA lead, and [release ritual DRI](#rituals) must all approve the feature work PR before it is merged into the release candidate branch.
+
+> This exception process should be avoided whenever possible. Any feature work merged into the release candidate will likely result in a significant release delay.
 
-> This exception process should be avoided whenever possible. Any feature work merged during freeze will likely result in a significant release delay.
 
 ### Confirm latest versions of dependencies
+
 Before kicking off release QA, confirm that we are using the latest versions of dependencies we want to keep up-to-date with each release. Currently, those dependencies are:
 
 1. **Go**: Latest minor release
-- Check the [version included in Fleet](https://github.com/fleetdm/fleet/settings/variables/actions).
+- Check the [Go version specified in Fleet's go.mod file](https://github.com/fleetdm/fleet/blob/main/go.mod) (`go 1.XX.YY`).
 - Check the [latest minor version of Go](https://go.dev/dl/). For example, if we are using `go1.19.8`, and there is a new minor version `go1.19.9`, we will upgrade.
-- If the latest minor version is greater than the version included in Fleet, [file a bug](https://github.com/fleetdm/fleet/issues/new?assignees=&labels=bug%2C%3Areproduce&projects=&template=bug-report.md&title=) and assign it to the [release ritual DRI](https://fleetdm.com/handbook/engineering#rituals) and the [current oncall engineer](https://fleetdm.com/handbook/engineering#how-to-reach-the-oncall-engineer). Add the `~release blocker` label. We must upgrade to the latest minor version before publishing the next release.
-- If the latest major version is greater than the version included in Fleet, [create a story](https://github.com/fleetdm/fleet/issues/new?assignees=&labels=story%2C%3Aproduct&projects=&template=story.md&title=) and assign it to the [release ritual DRI](https://fleetdm.com/handbook/engineering#rituals) and the [current oncall engineer](https://fleetdm.com/handbook/engineering#how-to-reach-the-oncall-engineer). This will be considered for an upcoming sprint. The release can proceed without upgrading the major version.
-- Note that major version upgrades also require an [update to go.mod](https://github.com/fleetdm/fleet/blob/7b3134498873a31ba748ca27fabb0059cef70db9/go.mod#L3). 
+- If the latest minor version is greater than the version included in Fleet, [file a bug](https://github.com/fleetdm/fleet/issues/new?assignees=&labels=bug%2C%3Areproduce&projects=&template=bug-report.md&title=) and assign it to the [release ritual DRI](https://fleetdm.com/handbook/engineering#rituals) and the current oncall engineer. Add the `~release blocker` label. We must upgrade to the latest minor version before publishing the next release.
+- If the latest major version is greater than the version included in Fleet, [create a story](https://github.com/fleetdm/fleet/issues/new?assignees=&labels=story%2C%3Aproduct&projects=&template=story.md&title=) and assign it to the [release ritual DRI](https://fleetdm.com/handbook/engineering#rituals) and the current oncall engineer. This will be considered for an upcoming sprint. The release can proceed without upgrading the major version.
 
 > In Go versioning, the number after the first dot is the "major" version, while the number after the second dot is the "minor" version. For example, in Go 1.19.9, "19" is the major version and "9" is the minor version. Major version upgrades are assessed separately by engineering.
 
@@ -114,13 +147,19 @@ If an announcement is found for either data source that may impact data feed ava
 
 If code changes are found for any `fleetd` components, create a new release QA issue to update `fleetd`. Delete the top section for Fleet core, and retain the bottom section for `fleetd`. Populate the necessary version changes for each `fleetd` component.
 
+
 ### Indicate your product group is release-ready
-Once a product group completes its QA process during the freeze period, its QA lead moves the smoke testing ticket to the "Ready for release" column on their ZenHub board. They then notify the release ritual DRI by tagging them in a comment, indicating that their group is prepared for release. The release ritual DRI starts the [release process](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Releasing-Fleet.md) after all QA leads have made these updates and confirmed their readiness for release.
+
+Once a product group completes its QA process during the release candidate period, its QA lead moves the smoke testing ticket to the "Ready for release" column on their ZenHub board. They then notify the release ritual DRI by tagging them in a comment, indicating that their group is prepared for release. The release ritual DRI starts the [release process](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Releasing-Fleet.md) after all QA leads have made these updates and confirmed their readiness for release.
+
 
 ### Prepare Fleet release
+
 Documentation on completing the release process can be found [here](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Releasing-Fleet.md).
 
+
 ### Deploy a new release to dogfood
+
 After each Fleet release, the new release is deployed to Fleet's "dogfood" (internal) instance.
 
 How to deploy a new release to dogfood:
@@ -135,7 +174,9 @@ How to deploy a new release to dogfood:
 >
 > Note that "fleetdm/fleet:main" is not a image name, instead use the commit hash in place of "main".
 
+
 ### Conclude current milestone 
+
 Immediately after publishing a new release, we close out the associated GitHub issues and milestones. 
 
 1. **Rename current milestone**: In GitHub, [change the current milestone name](https://github.com/fleetdm/fleet/milestones) from `4.x.x-tentative` to `4.x.x`. `4.37.0-tentative` becomes `4.37.0`.
@@ -156,16 +197,18 @@ Immediately after publishing a new release, we close out the associated GitHub i
 
 10. **Create next milestone**: Create a new milestone for the next versioned release, `4.x.x-tentative`.
 
-11. **Remove the freeze**: [Open the repo in Merge Freeze](https://app.mergefreeze.com/installations/3704/branches/6847) and click the "Unfreeze" button. 
+11. Announce that the release milestone has been closed in #help-engineering.
 
-12. Announce that `main` is unfrozen and the milestone has been closed in #help-engineering.
+12. Visit the [confidential repo variables](https://github.com/fleetdm/confidential/settings/variables/actions) page and update the `QAWOLF_DEPLOY_TAG` repository variable to `main` so that the latest code is deployed to QA Wolf every morning.
 
-13. Create a branch for the next patch and push it to GitHub. For example, if you release `fleet-v4.44.0`, create a branch called `patch-fleet-v4.44.1`. 
 
 ### Update the Fleet releases calendar
+
 The [Fleet releases Google calendar](https://calendar.google.com/calendar/embed?src=c_v7943deqn1uns488a65v2d94bs%40group.calendar.google.com&ctz=America%2FChicago) is kept up-to-date by the [release ritual DRI](https://fleetdm.com/handbook/engineering#rituals). Any change to targeted release dates is reflected on this calendar.
 
+
 ### Secure company-issued equipment for a team member
+
 As soon as an offer is accepted, Fleet provides laptops and YubiKey security keys for core team members to use while working at Fleet. The IT engineer will work with the new team member to get their equipment requested and shipped to them on time.
 
 - [**Check the Fleet IT warehouse**](https://docs.google.com/spreadsheets/d/1hFlymLlRWIaWeVh14IRz03yE-ytBLfUaqVz0VVmmoGI/edit#gid=0) before purchasing any equipment including laptops, monitors, and Yubikeys to ensure we efficiently [utilize existing assets before spending money](https://fleetdm.com/handbook/company/why-this-way#why-spend-less). If Fleet IT warehouse inventory can meet the needs of the request, file a [warehouse request](https://github.com/fleetdm/confidential/issues/new?assignees=sampfluger88&labels=%23g-digital-experience&projects=&template=warehouse-request.md&title=%F0%9F%92%BB+Warehouse+request).
@@ -183,17 +226,23 @@ As soon as an offer is accepted, Fleet provides laptops and YubiKey security key
 
 - Include delivery tracking information when closing the support request so the new employee can be notified.
 
+
 ### Register a domain for Fleet
+
 Domain name registrations are handled through Namecheap. Access is managed via 1Password.
 
+
 ### Fix a laptop that's not checking in
+
 It is [possible for end users to remove launch agents](https://github.com/fleetdm/confidential/issues/6088) (this is true not just for osquery, but for anything). 
 
 If the host has MDM turned on, use the `fleetctl mdm run-command` CLI command to push the XML file located at https://github.com/fleetdm/fleet/blob/main/it-and-security/lib/macos-send-fleetd.xml to the device, which will reinstall fleetd.
 
 If the host doesn't have MDM turned on or isn't enrolled to dogfood, it is beyond our ability to control remotely.
 
+
 ### Enroll a macOS host in dogfood
+
 When a device is purchased using the Apple eCommerce store, the device is automatically enrolled in Apple Business Manager (ABM) and assigned to the correct server to ensure the device is in dogfood.
 You can confirm that the device has been ordered correctly by following these steps:
 - Log into ABM
@@ -210,14 +259,20 @@ On occasion there will be a need to manually enroll a macOS host in dogfood. Thi
   - Once complete, follow instructions to reset disk encryption key.
 - Disk encryption key will now be stored in Fleet dogfood, which signifies that the device is now enrolled in dogfood.
 
+
 ### Enroll a Windows or Ubuntu Linux device in dogfood
+
 To enroll a windows or Ubuntu Linux device in dogfood, instruct the user to install fleetd for their platform from internal shared drive folder [here](https://drive.google.com/drive/folders/1-hMwk4P7NRzCU5kDxkEcOo8Sluuaux1h?usp=drive_link).
 Once the user has installed fleetd, verify the device is correctly enrolled by confirming the device encryption key is in dogfood.
 
+
 ### Enroll a ChromeOS device in dogfood
+
 ChromeOS devices are automatically enrolled in dogfood after the IT admin sets up automatic enrollment. This is done in dogfood by following the steps found in the dialog popup when selecting "Add hosts > ChromeOS" from the dogfood Hosts page.
 
+
 ### Lock a macOS host in dogfood using fleetctl CLI tool
+
 - Download the lock command XML file from Google Drive [here](https://drive.google.com/file/d/1o6vJ1fHilRtBmyKAj0I5URiKn77qe4gS/view?usp=drive_link).
 - Customize any messaging that will appear on the locked device, and modify the pin for unlocking the device by editing the file in text editor.
   - Note you will need to safely store the recovery pin for the device, suggest using 1Password or other secure storage method
@@ -233,7 +288,9 @@ ChromeOS devices are automatically enrolled in dogfood after the IT admin sets u
   - Enter disk encryption key on laptop. This should prompt you to create a new password.
 - You will then be logged into the default device profile, and can complete any needed actions (wipe, recover data).
 
+
 ### Book an event
+
 Fleet's Client Platform Engineer & Community Advocate is responsible for booking events that Fleet has chosen to attend and/or sponsor. To book an event, complete the steps in each event issue. Contact the [🫧 Digital Marketing Manager](https://fleetdm.com/handbook/demand#team) as needed with any questions or blockers to booking an event.
 
 > Note: The Demand department [settles all event strategy](https://fleetdm.com/handbook/demand#settle-event-strategy) prior to booking an event. 
@@ -250,6 +307,7 @@ Article creation begins with creation of an issue using the "Article request" te
 Check the "📃 Planned articles" column in [#g-demand board](https://app.zenhub.com/workspaces/g-demand-64e6c8e2d35c7f001a457b7f/board) and continue to work through steps in each event's issue.
 -->
 
+
 ### Order SWAG
 
 **To order T-shirts:**
@@ -281,14 +339,18 @@ Check the "📃 Planned articles" column in [#g-demand board](https://app.zenhub
     - [Sharpie Fine Point Markers](https://www.everythingbranded.com/product/sharpie-fine-point-332908)
     - [Custom sticky note pads](https://www.everythingbranded.com/product/custom-sticky-notes-585601) (design is in the StickerMule [brand kit](https://www.stickermule.com/studio/brand-kits))
 
+
 ### Review another product group's pull request
+
 Some code paths require pull request review from multiple product groups to confirm there are no
 unintended side effects of the change for another product group. All code paths defined in
 [CODEOWNERS](https://github.com/fleetdm/fleet/blob/main/CODEOWNERS) that are assigned to individual
 engineers across multiple product groups must be approved by one engineer from each product group
 before merging.
 
+
 ### Review a community pull request
+
 If you're assigned a community pull request for review, it is important to keep things moving for the contributor. The goal is to not go more than one business day without following up with the contributor.
 
 A PR should be merged if:
@@ -315,7 +377,9 @@ For PRs that will not be merged:
 - Thank the contributor for their effort and explain why the changes won't be merged.
 - Close the PR.
 
+
 ### Merge a community pull request
+
 When merging a pull request from a community contributor:
 
 - Ensure that the checklist for the submitter is complete.
@@ -324,10 +388,14 @@ When merging a pull request from a community contributor:
 - Thank and congratulate the contributor.
 - Share the merged PR with the team in the #help-promote channel of Fleet Slack to be publicized on social media. Those who contribute to Fleet and are recognized for their contributions often become great champions for the project.
 
+
 ### Close a stale community issue
+
 If a community member opens an issue that we can't reproduce leave a comment asking the author for more context. After one week with no reply, close the issue with a comment letting them know they are welcome to re-open it with any updates.
 
+
 ### Schedule developer on-call workload
+
 Engineering managers are asked to be aware of the [on-call rotation](https://docs.google.com/document/d/1FNQdu23wc1S9Yo6x5k04uxT2RwT77CIMzLLeEI2U7JA/edit#) and schedule a light workload for engineers while they are on-call. While it varies week to week considerably, the on-call responsibilities can sometimes take up a substantial portion of the engineer's time.
 
 We aspire to clear sprint work for the on-call engineer, but due to capacity or other constraints, sometimes the on-call engineer is required for sprint work. When this is the case, the EM will work with the on-call engineer to take over support requests or @oncall assignment completely when necessary.
@@ -342,7 +410,9 @@ Some ideas:
 - Create a blog post (or other content) for fleetdm.com.
 - Try out an experimental refactor. 
 
+
 ### Edit a DNS record
+
 We use Cloudflare to manage the DNS records of fleetdm.com and our other domains. To make DNS changes in Cloudflare:
 1. Log into your Cloudflare account and select the "Fleet" account.
 2. Select the domain you want to change and go to the DNS panel on that domain's dashboard.
@@ -350,22 +420,28 @@ We use Cloudflare to manage the DNS records of fleetdm.com and our other domains
 
 > If you need access to Fleet's Cloudflare account, please ask the [DRI](https://fleetdm.com/handbook/company/why-this-way#why-direct-responsibility) [Luke Heath](https://fleetdm.com/handbook/engineering#team) in Slack for an invitation.
 
+
 ### Assume developer on-call alias
+
 The on-call developer is responsible for: 
 - Knowing [the on-call rotation](https://fleetdm.com/handbook/company/product-groups#the-developer-on-call-rotation).
 - Preforming the [on-call responsibilities](https://fleetdm.com/handbook/company/product-groups#developer-on-call-responsibilities).
 - [Escalating community questions and issues](https://fleetdm.com/handbook/company/product-groups#escalations).
 - Successfully [transferring the on-call persona to the next developer](https://fleetdm.com/handbook/company/product-groups#changing-of-the-guard).
 
+
 ### Notify stakeholders when a user story is pushed to the next release
-[User stories](https://fleetdm.com/handbook/company/product-groups#scrum-items) are intended to be completed in a single sprint. When a user story selected for a release has not merged into `main` by the time the [merge freeze](https://fleetdm.com/handbook/engineering#begin-a-merge-freeze) begins, it is the product group EM's responsibility to notify stakeholders:
+
+[User stories](https://fleetdm.com/handbook/company/product-groups#scrum-items) are intended to be completed in a single sprint. When a user story selected for a release has not merged into `main` by the time the release candidate is created, it is the product group EM's responsibility to notify stakeholders:
 
 1. Add the `~pushed` label to the user story.
 2. Update the user story's milestone to the next minor version milestone.
 3. Comment on the GitHub issue and at-mention the PM and anyone listed in the requester field.
 4. If `customer-` labels are applied to the user story, at-mention the [VP of Customer Success](https://fleetdm.com/handbook/customer-success#team).
 
+
 ### Run Fleet locally for QA purposes
+
 To try Fleet locally for QA purposes, run `fleetctl preview`, which defaults to running the latest stable release.
 
 To target a different version of Fleet, use the `--tag` flag to target any tag in [Docker Hub](https://hub.docker.com/r/fleetdm/fleet/tags?page=1&ordering=last_updated), including any git commit hash or branch name. For example, to QA the latest code on the `main` branch of fleetdm/fleet, you can run: `fleetctl preview --tag=main`.
@@ -376,7 +452,9 @@ For each bug found, please use the [bug report template](https://github.com/flee
 
 For unreleased bugs in an active sprint, a new bug is created with the `~unreleased bug` label. The `:release` label and associated product group label is added, and the engineer responsible for the feature is assigned. If QA is unsure who the bug should be assigned to, it is assigned to the EM. Fixing the bug becomes part of the story.
 
+
 ### Accept new Apple developer account terms
+
 Engineering is responsible for managing third-party accounts required to support engineering infrastructure. We use the official Fleet Apple developer account to notarize installers we generate for Apple devices. Whenever Apple releases new terms of service, we are unable to notarize new packages until the new terms are accepted.
 
 When this occurs, we will begin receiving the following error message when attempting to notarize packages: "You must first sign the relevant contracts online." To resolve this error, follow the steps below.
@@ -391,20 +469,24 @@ When this occurs, we will begin receiving the following error message when attem
 
 5. Accept the new terms of service.
 
+
 ### Interview a developer candidate
-As a hiring manager we want to ensure the interview process follows these steps in order. This process must follow [creating a new position](https://fleetdm.com/handbook/company/leadership#creating-a-new-position) through [receiving job applications](https://fleetdm.com/handbook/company/leadership#receiving-job-applications). Once the position is approved manage this process per candidate in [hiring pipeline](https://drive.google.com/drive/folders/1dLZaor9dQmAxcxyU6prm-MWNd-C-U8_1?usp=drive_link)
-
-1. **Reach out**: If you are not already the primary contact with this candidate send an email or linkedin message introducing yourself and the intent that you would like the start the interview process including the link to the position and asking if they are comfortable with completing a coding exercise.
-2. **Deliver code prompt**: After recieving confirmation that they are interested download the zip of the [code challenge](https://github.com/fleetdm/wordgame) and ask them to complete this and send their entry back within 5 business days.
-3. **Test code prompt**: Verify the code runs and can complete the challenge correctly. Check the code for good style and tests that match our standards here at Fleet.
-4. **Schedule manager interview**: Send the candidate a calendly link for 1hr to talk to you and screen them if they are a good fit for this role and our culture.
-5. **Schedule technical interview**: Send the candidate a calendly link for 1hr to talk to a senior engineer on your team where the goal is to understand the thechnical capabilities of the candidate. An additional engineer can optionally join if available.
-6. **Schedule DOPD interview**: Send the candidate a calendly link for 30m talk to the Director of Product Development @lukeheath.
+
+Ensure the interview process follows these steps in order. This process must follow [creating a new position](https://fleetdm.com/handbook/company/leadership#creating-a-new-position) through [receiving job applications](https://fleetdm.com/handbook/company/leadership#receiving-job-applications). Once the position is approved manage this process per candidate in a [hiring pipeline](https://drive.google.com/drive/folders/1dLZaor9dQmAxcxyU6prm-MWNd-C-U8_1?usp=drive_link)
+
+1. **Reach out**: Send an email or LinkedIn message introducing yourself. Include the URL for the position, your Calendly URL, and invite the candidate to schedule a 30-minute introduction call.
+2. **Conduct screening call**: Discuss the requirements of the position with the candidate, and answer any questions they have about Fleet. Look for alignment with [Fleet's values](https://fleetdm.com/handbook/company#values) and technical expertise necessary to meet the requirements of the role.
+2. **Deliver technical assessment**: Download the zip of the [code challenge](https://github.com/fleetdm/wordgame) and ask them to complete and send their project back within 5 business days.
+3. **Test technical assessment**: Verify the code runs and completes the challenge correctly. Check the code for best practices, good style, and tests that meet our standards.
+5. **Schedule technical interview**: Send the candidate a calendly link for 1hr to talk to a Software Engineer on your team where the goal is to understand the thechnical capabilities of the candidate. An additional Software Engineer can optionally join if available. Share the candidate's project with the Software Engineers and ask them to review in advance so they are prepared with questions about the candidate's code.
+6. **Schedule HOPD interview**: Send the candidate a calendly link for 30m talk to the Head of Product Design @noahtalerman.
 7. **Schedule CTO interview**: Send the candidate a calendly link for 30m talk with our CTO @lukeheath.
 
 If the candidate passes all of these steps then continue with [hiring a new team member](https://fleetdm.com/handbook/company/leadership#hiring-a-new-team-member).
 
+
 ### Renew MDM certificate signing request (CSR) 
+
 The certificate signing request (CSR) certificate expires every year. It needs to be renewed prior to expiring. This is notified to the team by the MDM calendar event [IMPORTANT: Renew MDM CSR certificate](https://calendar.google.com/calendar/u/0/r/eventedit/MmdqNTY4dG9nbWZycnNxbDBzYjQ5dGplM2FfMjAyNDA5MDlUMTczMDAwWiBjXzMyMjM3NjgyZGRlOThlMzI4MjVhNTY1ZDEyZjk0MDEyNmNjMWI0ZDljYjZjNjgyYzQ2MjcxZGY0N2UzNjM5NDZAZw)
 
 Steps to renew the certificate:
@@ -424,7 +506,9 @@ Steps to renew the certificate:
 10. Verify by logging into a normal apple account (not billing@...) and Generate a new Push Certificate following our [setup MDM](https://fleetdm.com/docs/using-fleet/mdm-setup) steps and verify the Expiration date is 1 year from today.
 11. Adjust calendar event to be between 2-4 weeks before the next expiration.
 
+
 ### Perform an incident postmortem
+
 Conduct a postmortem meetings for every service or feature outage and every critical bug, whether it's a customer's environment or on fleetdm.com.
 
 1. Copy this [postmortem template](https://docs.google.com/document/d/1Ajp2LfIclWfr4Bm77lnUggkYNQyfjePiWSnBv1b1nwM/edit?usp=sharing) document and pre-populate where possible.
@@ -434,7 +518,9 @@ Conduct a postmortem meetings for every service or feature outage and every crit
 
 [Example Finished Document](https://docs.google.com/document/d/1YnETKhH9R7STAY-PaFnPy2qxhNht2EAFfkv-kyEwebQ/edit?usp=share_link)
 
+
 ### Process incoming equipment
+
 Upon receiving any device, follow these steps to process incoming equipment.
 1. Search for the SN of the physical device in the ["Company equipment" spreadsheet](https://docs.google.com/spreadsheets/d/1hFlymLlRWIaWeVh14IRz03yE-ytBLfUaqVz0VVmmoGI/edit#gid=0) to confirm the correct equipment was received.
 3. Visibly inspect equipment and all related components (e.g. laptop charger) for damage.
@@ -446,7 +532,9 @@ Upon receiving any device, follow these steps to process incoming equipment.
 9. Follow the prompts to activate the device and reinstall the appropriate version of macOS.
 > If you are prevented from completing the steps above, create a ["💻 IT support issue](https://github.com/fleetdm/confidential/issues/new?assignees=%40spokanemac&labels=%3Ahelp-it&projects=&template=request-it-support.md&title=%F0%9F%92%BB+Request+IT+support) for IT, for the device to be scheduled for troubleshooting and remediation. Please note in the issue where you encountered blockers to completing the steps.
 
+
 ### Ship approved equipment
+
 Once the Business Operations department approves inventory to be shipped from Fleet IT, follow these step to ship the equipment.
 1. Compare the equipment request issue with the ["Company equipment" spreadsheet](https://docs.google.com/spreadsheets/d/1hFlymLlRWIaWeVh14IRz03yE-ytBLfUaqVz0VVmmoGI/edit#gid=0) and verify physical inventory.
 2. Plug in the device and ensure inventory has been correctly processed and all components are present (e.g. charger cord, power converter).
@@ -456,9 +544,12 @@ Once the Business Operations department approves inventory to be shipped from Fl
 6. Ship via FedEx to the address listed in the equipment request.
 7. Add a comment to the equipment request issue, at-mentioning the requestor with the FedEx tracking info and close the issue.
 
+
 ## Rituals
+
 <rituals :rituals="rituals['handbook/engineering/engineering.rituals.yml']"></rituals>
 
+
 #### Stubs
 The following stubs are included only to make links backward compatible.
 
@@ -526,6 +617,15 @@ Please see [handbook/engineering#accept-new-apple-developer-account-terms](https
 ##### Merging during the freeze period
 Please see [handbook/engineering#merge-a-pull-request-during-the-freeze-period](https://fleetdm.com/handbook/engineering#merge-a-pull-request-during-the-freeze-period)
 
+##### Merge a bug fix during the freeze period
+Please see [merge-bug-fixes-into-the-release-candidate](https://fleetdm.com/handbook/engineering#merge-bug-fixes-into-the-release-candidate)
+
+##### Merge a pull request during the freeze period
+Please see [merge-bug-fixes-into-the-release-candidate](https://fleetdm.com/handbook/engineering#merge-bug-fixes-into-the-release-candidate)
+
+##### Begin a merge freeze
+Please see [handbook/engineering#create-a-release-candidate](https://fleetdm.com/handbook/engineering#create-a-release-candidate)
+
 ##### Scrum boards
 Please see [handbook//product-groups#current-product-groups](https://fleetdm.com/handbook/engineering#contact-us)
 
diff --git a/handbook/engineering/engineering.rituals.yml b/handbook/engineering/engineering.rituals.yml
index 4ff04b98b9f4..2616976cd302 100644
--- a/handbook/engineering/engineering.rituals.yml
+++ b/handbook/engineering/engineering.rituals.yml
@@ -43,11 +43,11 @@
   moreInfoUrl: "https://github.com/fleetdm/fleet/security"
   dri: "lukeheath"
 - 
-  task: "Freeze ritual"
+  task: "Release candidate ritual"
   startedOn: "2023-08-09" 
   frequency: "Triweekly"
-  description: "Go through the process of freezing the `main` branch to prepare for the next release."
-  moreInfoUrl: "https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Releasing-Fleet.md#patch-releases"
+  description: "Go through the process of creating a release candidate."
+  moreInfoUrl: "https://github.com/fleetdm/fleet/blob/main/tools/release/README.md#minor-release-typically-end-of-sprint"
   dri: "lukeheath"
 - 
   task: "Release ritual"
@@ -74,14 +74,14 @@
   task: "QA report"
   startedOn: "2023-08-09" 
   frequency: "Triweekly"
-  description: "Every release cycle, on the Monday of release week, the DRI for the release ritual is updated on status of testing."
+  description: "Every release cycle, on the Monday of release week, update the DRI for the release ritual on status of testing."
   moreInfoUrl:
   dri: "xpkoala"
 - 
   task: "Release QA"
   startedOn: "2023-08-09" 
   frequency: "Triweekly"
-  description: "Every release cycle, by end of day Friday of release week, all issues move to Ready for release on the #g-mdm and #g-endpoint-ops sprint boards."
+  description: "Every release cycle, by end of day Friday of release week, move all issues to the ”✅ Ready for release” column on the #g-mdm and #g-endpoint-ops sprint boards."
   moreInfoUrl:
   dri: "xpkoala"
 #-
@@ -95,7 +95,7 @@
   task: "Check ongoing events"
   startedOn: "2024-02-09"
   frequency: "Daily"
-  description: "Check event issues and complete steps"
+  description: "Check event issues and complete steps."
   moreInfoUrl: "https://fleetdm.com/handbook/business-operations#book-an-event"
   dri: "spokanemac"
 
diff --git a/handbook/product-design/README.md b/handbook/product-design/README.md
index af31d259ee85..30d1dcece063 100644
--- a/handbook/product-design/README.md
+++ b/handbook/product-design/README.md
@@ -1,78 +1,83 @@
 # Product Design
+
 This handbook page details processes specific to working [with](#contact-us) and [within](#responsibilities) this department.
 
+
 ## Team
+
 | Role                             | Contributor(s)           |
 |:---------------------------------|:-----------------------------------------------------------------------------------------------------------|
 | Head of Product Design           | [Noah Talerman](https://www.linkedin.com/in/noah-talerman/) _([@noahtalerman](https://github.com/noahtalerman))_
 | Product Designer                 | <sup><sub>_See [🛩️ Product groups](https://fleetdm.com/handbook/company/product-groups#current-product-groups)_ </sup></sub>
 
+
 ## Contact us
+
 - To **make a request** of this department, [create an issue](https://github.com/fleetdm/confidential/issues/new?labels=%3Aproduct&title=Product%20design%20request%C2%BB______________________&template=custom-request.md) and a team member will get back to you within one business day (If urgent, mention a [team member](#team) in `#help-design`.
   - Please **use issue comments and GitHub mentions** to communicate follow-ups or answer questions related to your request.
-  - Any Fleet team member can [view the kanban board](https://app.zenhub.com/workspaces/-g-digital-experience-6451748b4eb15200131d4bab/board?sprints=none) for this department, including pending tasks and the status of new requests.
+  - Any Fleet team member can [view the kanban board](https://app.zenhub.com/workspaces/-g-digital-experience-6451748b4eb15200131d4bab/board) for this department, including pending tasks and the status of new requests.
+
 
 ## Responsibilities
+
 The Product Design department is responsible for reviewing and collecting feedback from users, would-be users, and future users, prioritizing changes, designing the changes, and delivering these changes to the engineering team. Product Design prioritizes and shapes all changes involving functionality or usage, including the UI, REST API, command line, and webhooks. 
 
-### Release relavent Figma files
-- Once your designs are reviewed and approved, change the status on the cover page of the relevant Figma file and move the issue to the "Settled" column.
-- After each release (every 3 weeks) make sure you change the status on the cover page of the relevant Figma files that you worked on during the sprint to "Released".
 
->**Questions and missing information:** Take a screenshot of the area in Figma and add a comment in the story's GitHub issue. Figma does have a commenting system, but it is not easy to search for outstanding concerns and is therefore not preferred.
->
->For external contributors: please consider opening an issue with reference screenshots if you have a Figma related question you need to resolve.
+### Drafting
 
-### Create a new Figma file
 At Fleet, like [GitLab](https://about.gitlab.com/handbook/product-development-flow/#but-wait-isnt-this-waterfall) and [other organizations](https://speakerdeck.com/mikermcneil/i-love-apis), every change to the product's UI gets [wireframed first](https://fleetdm.com/handbook/company/why-this-way#why-do-we-use-a-wireframe-first-approach).
 
-- Take the top user story that is assigned to you in the "Prioritized" column of the [drafting board](https://app.zenhub.com/workspaces/-product-backlog-coming-soon-6192dd66ea2562000faea25c/board).
+- Take the top user story that is assigned to you in the "Ready" column of the [drafting board](https://app.zenhub.com/workspaces/-product-backlog-coming-soon-6192dd66ea2562000faea25c/board) and move it to "In progress."
   
-- Create a new file inside the [Fleet product](https://www.figma.com/files/project/17318630/%F0%9F%94%9C%F0%9F%93%A6-Fleet-EE%C2%AE-(product)?fuid=1234929285759903870) Figma project. See [Working with Figma](https://fleetdm.com/handbook/product#working-with-figma) below for more details.
-  
-- Use dev notes (component available in our library) to highlight important information to engineers and other teammates.
+- Create a new file inside the [Fleet product](https://www.figma.com/files/project/17318630/%F0%9F%94%9C%F0%9F%93%A6-Fleet-EE%C2%AE-(product)?fuid=1234929285759903870) Figma project by duplicating "\[TEMPLATE\] Starter file" (pinned to the top of the project).
+
+- The starter file includes 3 predefined pages: Cover, Ready, and Scratchpad.
+  -  **Cover.** This page has a component with issue number, issue name, and status fields. There are 3 statuses: Work in progress, Approved, and Released (the main source of truth is still the drafting board).
+  -  **Ready.** Use this page to communicate designs reviews and development.
+  -  **Scratchpad.** Use this page for work in progress and design that might be useful in the future.
+
+- If the story requires API or YAML file changes, open a draft PR with the proposed design.
+
+- Add links to the Figma file's cover page and draft PRs in the user story.
 
 - Draft changes to the Fleet product that solve the problem specified in the story. Constantly place yourself in the shoes of a user while drafting changes. Place these drafts in the appropriate Figma file in Fleet product project.
 
+- Use dev notes (component available in our library) to highlight important information to engineers and other teammates.
+
+- To help contributors find Figma wireframes for the area of the UI you're making changes to, add page names (ex. Host details page) to the user story's title and/or description.
+
 - Be intentional about changes to design components (e.g. button border-radius or modal width) because these are expensive. They'll require code changes and QA in multiple parts of the product. Propose changes to a design component as part of an already-prioritized user story instead of [making a new request](#making-a-request) in 🎁🗣 Feature Fest.
 
-- While drafting, reach out to sales, customer success, and demand for a business perspective.
+- Reach out to sales, customer success, and demand for a business perspective.
 
-- While drafting, engage engineering to gain insight into technical costs and feasibility.
+- Engage engineering to gain insight into technical costs and feasibility.
 
-When starting a new draft:
-- Create a new file inside the [Fleet product](https://www.figma.com/files/project/17318630/%F0%9F%94%9C%F0%9F%93%A6-Fleet-EE%C2%AE-(product)?fuid=1234929285759903870) project by duplicating "\[TEMPLATE\] Starter file" (pinned to the top of the project).
-- Right-click on the duplicated file, select "Share", and ensure **anyone with the link** can view the file.
-- Rename each Figma file to include the number and name of the corresponding issue on the [drafting board](https://app.zenhub.com/workspaces/-product-backlog-coming-soon-6192dd66ea2562000faea25c/board). (e.g. # 11766 Instructions for Autopilot enrollment).
-- The starter file includes 3 predefined pages: Cover, Ready, and Scratchpad.
-    -  **Cover.** This page has a component with issue number, issue name, and status fields. There are 3 statuses: Work in progress, Approved, and Released (the main source of truth is still the drafting board).
-    -  **Ready.** Use this page to communicate designs reviews and development.
-    -  **Scratchpad.** Use this page for work in progress and design that might be useful in the future.
-- If the story requires API changes, open a draft PR with the proposed API design.
-    - These draft PRs are not actually merged, since they're often created weeks ahead of implementation and can artificially affect our PR open time KPI. Instead, once the documentation changes are ready for final review, the designer closes the draft PR and opens a fresh PR from the same branch.
-      
-### Schedule a design review
-- Prepare your draft in the user story issue.
-- Prepare the agenda for your design review meeting, which should be an empty document other than the proposed changes you will present.
-- Review the draft with the CEO at one of the daily design review meetings, or schedule an ad-hoc design review if you need to move faster.  (Efficient access to design reviews on-demand [is a priority for Fleet's CEO](https://fleetdm.com/handbook/company/ceo). Emphasizing design helps us live our [empathy](https://fleetdm.com/handbook/company#empathy) value.)
-- When introducing a story, clarify which review "mode" the CEO should operate in:
-  + **Final review** mode — you are 70% sure the design is 100% done.
-  + **Feedback** mode — you know the design is not ready for final review, but would like to get early feedback. Before bringing something in feedback mode consider whether the CEO will be best for giving feedback or if it would be better suited for someone else (engineer or PM).
-- During the review meeting, take detailed notes of any feedback on the draft.
-- Address the feedback by modifying your draft.
-- Rinse and repeat at subsequent sessions until there is no more feedback.
+>**Questions, missing information, and notes:** Take a screenshot of the area in Figma and add a comment in the story's GitHub issue. Figma does have a commenting system, but it is not easy to search for outstanding concerns and is therefore not preferred. Also, commenting in Figma, sends all contributors email notifications.
+>
+>For external contributors: please consider opening an issue with reference screenshots if you have a Figma related question you need to resolve.
+
+### Prepare for design review
+
+1. Link to your draft in the user story issue.
+2. Add the user story to the agenda for the [design review](https://fleetdm.com/handbook/company/product-groups#design-reviews) meeting.
+3. Attend design review or schedule an ad-hoc design review if you need to move faster.
 
 > As drafting occurs, inevitably, the requirements will change. The main description of the issue should be the single source of truth for the problem to be solved and the required outcome. The product manager is responsible for keeping the main description of the issue up-to-date. Comments and other items can and should be kept in the issue for historical record-keeping.
 
+
 ### Ensure story drafting is complete
-<!--TODO update responsibility to reflect reality (e.g. line 75 == "Bugs board"?)-->
-Once a story has gone through design and is considered "Settled", it moves to the "Settled" column on the drafting board and assign to the Engineering Manager (EM).
 
-Before assigning an EM to [estimate](https://fleetdm.com/handbook/engineering#sprint-ceremonies) a user story, the product designer ensures the product section of the user story [checklist](https://github.com/fleetdm/fleet/issues/new?assignees=&labels=story&projects=&template=story.md&title=) is complete. 
+Once a story is approved in [design review](https://fleetdm.com/handbook/company/product-groups#design-reviews), the Product Designer is responsible for moving the user story to the "Ready to spec" column, assigning the appropriate Engineering Manager (EM), and changing the status on the cover page of the relevant Figma file to "Approved".
+
+The EM is responsible for moving the user story to the "Specified" and "Estimated" columns.
+
+Before assigning an EM, double-check that the "Product" section of the user story [checklist](https://github.com/fleetdm/fleet/issues/new?assignees=&labels=story&projects=&template=story.md&title=) is complete (no TODOs). 
+
+Once a bug is approved in design review, The Product Designer is responsible for moving the bug to the appropriate release board.
 
-Once a bug has gone through design and is considered "Settled", the designer removes the `:product` label and moves the issue to the 'Sprint backlog' column on the "Bugs" board and assigns the group engineering manager. 
 
 ### Revise a draft currently in development
+
 Expedited drafting is the revision of drafted changes currently being developed by
 the engineering team. Expedited drafting aims to quickly adapt to unknown edge cases and
 changing specifications while ensuring that Fleet meets our brand and quality guidelines. 
@@ -80,15 +85,17 @@ changing specifications while ensuring that Fleet meets our brand and quality gu
 You'll know it's time for expedited drafting when:
 - The team discovers that a drafted user story is missing crucial information that prevents contributors from continuing the development task.
 - A user story is taking more effort than was originally estimated, and Product Manager wants to find ways to cut aspects of planned functionality in order to still ship the improvement in the currently scheduled release.
-- A user story on the drafting board won't reach "Settled" by the last estimation session in the current sprint and cannot wait until the next sprint. This can also happen when we decide to bring a user story in mid-sprint.
+- A user story on the drafting board won't reach "Ready for spec" by the last estimation session in the current sprint and cannot wait until the next sprint. This can also happen when we decide to bring a user story in mid-sprint.
 
 What happens during expedited drafting?
-1. If the user story wasn't "Settled" by the last estimation session, the product group's engineering manager (EM), [release DRI](https://fleetdm.com/handbook/company/communications#directly-responsible-individuals-dris), and Head of Product Design are notified in `#g-mdm` or `#g-endpoint-ops`. Decision to allow the user story to make it into the sprint is up to the release DRI.
+1. If the user story wasn't "Ready for spec" by the last estimation session, the product group's engineering manager (EM), [release DRI](https://fleetdm.com/handbook/company/communications#directly-responsible-individuals-dris), and Head of Product Design are notified in `#g-mdm` or `#g-endpoint-ops`. Decision to allow the user story to make it into the sprint is up to the release DRI.
 2. If the user story is already in the sprint, the EM, release DRI, and Head of Product Design are notified in `#g-mdm` or `#g-endpoint-ops`. If there are significant changes to the requirements, then the user story might be pushed to the next sprint. Decision is up to the release DRI.
 3. If the release DRI decides the user story will be worked on this sprint, drafts are updated or finished.
 4. UI changes [are approved](https://fleetdm.com/handbook/company/development-groups#drafting-process), and the UI changes are brought back into the sprint or are estimated.
 
+
 ### Correctly prioritize a bug
+
 Bugs are always prioritized. (Fleet takes quality and stability [very seriously](https://fleetdm.com/handbook/company/why-this-way#why-spend-so-much-energy-responding-to-every-potential-production-incident).) Bugs should be prioritized in the following order:
 1. Quality: product does what it's supposed to (what is documented).
 2. Common-sense user criticality: If no one can load any page, that's obviously important.
@@ -108,17 +115,23 @@ After aligning with the Director of Product Development on the outcomes, The Hea
 - **Schedule**: Remove the `:product` label, move the bug ticket to the 'Sprint backlog' column on the bug board, and assign it to the appropriate group's Engineering Manager so that it can be prioritized into the sprint backlog.
 - **De-prioritized**: The Head of Product Design should close the issue and, as the DRI, ensure all follow-up actions are finalized.
 
+
 ### Write a user story
+
 Product Managers [write user stories](https://fleetdm.com/handbook/company/product-groups#writing-a-good-user-story) in the [drafting board](https://app.zenhub.com/workspaces/-product-backlog-coming-soon-6192dd66ea2562000faea25c/board). The drafting board is shared by every [product group](https://fleetdm.com/handbook/company/development-groups).
 
+
 ### Draft a user story
+
 Product Designers [draft user stories](https://fleetdm.com/handbook/company/product-groups#drafting) that have been prioritized by PMs. If the estimated user stories for a product group exceed [that group's capacity](https://fleetdm.com/handbook/company/product-groups#current-product-groups), all new design work for that group is paused, and the designer will contribute in other ways (documentation & handbook work, Figma maintenance, QA, etc.) until the PM deprioritizes estimated stories to make room, or until the next sprint begins. (If the designer has existing work-in-progress, they will continue to review and iterate on those designs and see the stories through to estimation.)
 
 If an issue's title or user story summary (_"as a…I want to…so that"_) does not match the intended change being discussed, the designer will move the issue to the "Needs clarity" column of the drafting board and assign the group product manager.  The group product manager will revisit ASAP and edit the issue title and user story summary, then reassign the designer and move the issue back to the "Prioritized" column.
 
 Engineering Managers estimate user stories.  They are responsible for delivering planned work in the current sprint (0-3 weeks) while quickly getting user stories estimated for the next sprint (3-6 weeks).  Only work that is slated to be released into the hands of users within ≤six weeks will be estimated. Estimation is run by each group's Engineering Manager and occurs on the [drafting board](https://app.zenhub.com/workspaces/-product-backlog-coming-soon-6192dd66ea2562000faea25c/board).
 
+
 ### Rank features before release
+
 These measures exist to keep all contributors (including other departments besides engineering and product) up to date with improvements and changes to the Fleet product.  This helps folks plan and communicate with customers and users more effectively.
 
 After the kickoff of a product sprint, the demand and product teams decide which improvements are most important to highlight in this release, whether that's through social media "drumbeat" tweets, collaboration with partners, or emphasized [content blocks](https://about.gitlab.com/handbook/marketing/blog/release-posts/#3rd-to-10th) within the release blog post.
@@ -129,12 +142,16 @@ When an improvement gets scheduled for release, the Head of Product sets its "ec
 - **Echelon 2: A highlighted feature in the release notes.** This product feature will be highlighted at the top of the Sprint Release blog post. Depending on the feature specifics this will include: a 1-2 paragraph write-up of the feature, a demo video (if applicable) and a link to the docs. Ideally there would be no more than three _echelon 2_ features in a release post, otherwise the top features will be crowded.
 - **Echelon 3: A notable feature to mention in the [changelog](https://github.com/fleetdm/fleet/blob/main/CHANGELOG.md)**. Most product improvements fit into this echelon. This includes 1-2 sentences in the changelog and [release blog post](https://fleetdm.com/releases).
 
+
 ### Create release issue
+
 Before each release, the Head of Product [creates a "Release" issue](https://github.com/fleetdm/confidential/issues/new/choose), which includes a list of all improvements included in the upcoming release.  Each improvement links to the relevant bug or user story issue on GitHub so it is easy to read the related discussion and history.
 
 The product team is responsible for providing the demand team with the necessary information for writing the release blog post. Every three weeks after the sprint is kicked off, the product team meets with the relevant demand team members to go over the features for that sprint and recommend items to highlight as _echelon 2_ features and provide relevant context for other features to help demand decide which features to highlight.
 
+
 ### Consider a feature eligible to be flagged
+
 At Fleet, features are placed behind feature flags if the changes could affect Fleet's availability of existing functionalities. The following highlights should be considered when deciding if we should leverage feature flags:
 
 - The feature flag must be disabled by default.
@@ -146,7 +163,9 @@ At Fleet, features are placed behind feature flags if the changes could affect F
 
 > Fleet's feature flag guidelines is borrowed from GitLab's ["When to use feature flags" section](https://about.gitlab.com/handbook/product-development-flow/feature-flag-lifecycle/#when-to-use-feature-flags) of their handbook. Check out [GitLab's "Feature flags only when needed" video](https://www.youtube.com/watch?v=DQaGqyolOd8) for an explanation of the costs of introducing feature flags.
 
+
 ### Consider promoting a feature as "beta"
+
 At Fleet, features are advertised as "beta" if there are concerns that the feature may not work as intended in certain Fleet
 deployments. For example, these concerns could be related to the feature's performance in Fleet
 deployments with hundreds of thousands of hosts.
@@ -158,7 +177,9 @@ The following highlights should be considered when deciding if we promote a feat
   explains why the feature is advertised as "beta" and tracking the feature's progress towards advertising the feature as "stable."
 - The feature will be advertised as "beta" in the documentation on fleetdm.com/docs, release notes, release blog posts, and Twitter.
 
+
 ### View Fleet usage statistics
+
 In order to understand the usage of the Fleet product, we [collect statistics](https://fleetdm.com/docs/using-fleet/usage-statistics) from installations where this functionality is enabled.
 
 Fleeties can view these statistics in the Google spreadsheet [Fleet
@@ -275,5 +296,11 @@ Please see [handbook/product-groups#after-the-feature-is-accepted](https://fleet
 ##### Restart Algolia manually
 Please see [handbook/digital-experience#restart-algolia-manually](https://fleetdm.com/handbook/digital-experience#restart-algolia-manually)
 
+##### Schedule a design review
+Please see [handbook/product#prepare-for-design-review](https://fleetdm.com/handbook/product#prepare-for-design-review)
+
+##### Create a new Figma file
+Please see [handbook/product#drafting](https://fleetdm.com/handbook/product#drafting)
+
 <meta name="maintainedBy" value="noahtalerman">
 <meta name="title" value="🦢 Product design">
diff --git a/handbook/product-design/product-design.rituals.yml b/handbook/product-design/product-design.rituals.yml
index bea04e39bb8b..d9225ce778ff 100644
--- a/handbook/product-design/product-design.rituals.yml
+++ b/handbook/product-design/product-design.rituals.yml
@@ -1,13 +1,3 @@
--
-  task: "Prioritize for next sprint" # Title that will actually show in rituals table
-  startedOn: "2023-08-09" # Needs to align with frequency e.g. if frequency is every thrid Thursday startedOn === any third thursday
-  frequency: "Triweekly" # must be supported by
-  description: "Drag next sprint's priorities to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/company/communication)"
-  moreInfoUrl: "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible" #URL used to highlight "description:" test in table
-  dri: "noahtalerman" # DRI for ritual (assignee if autoIssue) (TODO display GitHub proflie pic instead of name or title)
-  autoIssue:   # Enables automation of GitHub issues
-    labels: [ "#g-endpoint-ops" ] # label to be applied to issue
-    repo: "confidential"
 -
   task: "Design sprint review" # 2024-03-06 TODO: Link to responsibility or corresponding "how to" info e.g. https://fleetdm.com/handbook/company/product-groups#making-changes
   startedOn: "2024-03-07" 
@@ -37,19 +27,12 @@
   moreInfoUrl: 
   dri: "noahtalerman"
 -
-  task: "🦢🗣 Design review (#g-mdm)"
-  startedOn: "2024-03-07" 
-  frequency: "Daily" 
-  description: "Contributors present wireframes (UI changes) that are “Ready for review”. Head of Product Design provides feedback on UI/CLI/API changes." 
-  moreInfoUrl: "https://fleetdm.com/handbook/company/product-groups#design-reviews" 
-  dri: "marko-lisica"
--
-  task: "🦢🗣 Design review (#g-endpoint-ops)"
+  task: "🦢🗣 Design review"
   startedOn: "2024-03-07" 
   frequency: "Daily" 
-  description: "Contributors present wireframes (UI changes) that are “Ready for review”. Head of Product Design provides feedback on UI/CLI/API changes." 
+  description: "On Mondays, contributors present wireframes in 'Feedback' mode and anyone can give feedback. 'Final review' mode during all other days and only Head of Product Design + CTO + Product Designers give feedback." 
   moreInfoUrl: "https://fleetdm.com/handbook/company/product-groups#design-reviews" 
-  dri: "rachaelshaw"
+  dri: "noahtalerman"
 -
   task: "🦢🔄 Product design sync"
   startedOn: "2023-07-11" 
@@ -81,7 +64,6 @@
 -
   task: "Pre-sprint prioritization" # 2024-03-06 TODO: Link to responsibility or corresponding "how to" info e.g. https://fleetdm.com/handbook/company/product-groups#making-changes
   startedOn: "2024-02-27" 
-  frequency: "Triweekly" 
-  description: "The Head of Product Design and each group's EM meet before each sprint to align on priorities and discuss what stories weren't completed in the previous sprint. Head of Product Design records number of stories that weren't completed in the “Stories dropped” product KPI." 
-  moreInfoUrl: 
+  frequency: "Triweekly"
+  description: "Discuss what stories weren't completed in the previous sprint. Record the number of stories in KPIs. Align on priorities for upcoming sprint."
   dri: "noahtalerman"
diff --git a/handbook/sales/README.md b/handbook/sales/README.md
index 46eff35914cc..8213a86777c6 100644
--- a/handbook/sales/README.md
+++ b/handbook/sales/README.md
@@ -1,35 +1,37 @@
 # Sales
+
 This handbook page details processes specific to working [with](#contact-us) and [within](#responsibilities) this department.
 
+
 ## Team
+
 | Role                                  | Contributor(s)           |
 |:--------------------------------------|:------------------------------------------------------------------------------------------------------------------------|
 | Chief Revenue Officer (CRO)                  | [Alex Mitchell](https://www.linkedin.com/in/alexandercmitchell/) _([@alexmitchelliii](https://github.com/alexmitchelliii))_
-| Solutions Consulting (SC)                    | [Dave Herder](https://www.linkedin.com/in/daveherder/) _([@dherder](https://github.com/dherder))_ <br> [Zach Wasserman](https://www.linkedin.com/in/zacharywasserman/) _([@zwass](https://github.com/zwass))_ <br> [Will Mayhone](https://www.linkedin.com/in/william-mayhone-671977b6/) _([@willmayhone88](https://github.com/willmayhone88))_
+| Solutions Consulting (SC)                    | [Dave Herder](https://www.linkedin.com/in/daveherder/) _([@dherder](https://github.com/dherder))_ <br> [Zach Wasserman](https://www.linkedin.com/in/zacharywasserman/) _([@zwass](https://github.com/zwass))_ <br> [Allen Houchins](https://www.linkedin.com/in/allenhouchins/) _([@allenhouchins](https://github.com/allenhouchins))_ <br> [Harrison Ravazzolo](https://www.linkedin.com/in/harrison-ravazzolo/) _([@harrisonravazzolo](https://github.com/harrisonravazzolo))_
 | Channel Sales                                | [Tom Ostertag](https://www.linkedin.com/in/tom-ostertag-77212791/) _([@tomostertag](https://github.com/TomOstertag))_
 | Account Executive (AE)                       | [Patricia Ambrus](https://www.linkedin.com/in/pambrus/) _([@ambrusps](https://github.com/ambrusps))_ <br> [Anthony Snyder](https://www.linkedin.com/in/anthonysnyder8/) _([@anthonysnyder8](https://github.com/AnthonySnyder8))_ <br> [Paul Tardif](https://www.linkedin.com/in/paul-t-750833/) _([@phtardif1](https://github.com/phtardif1))_
 
 
 ## Contact us
+
 - To **make a request** of this department, [create an issue](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-sales&projects=&template=custom-request.md&title=Request%3A+_______________________) and a team member will get back to you within one business day (If urgent, mention a [team member](#team) in the [#g-sales](https://fleetdm.slack.com/archives/C030A767HQV)).
   - Any Fleet team member can [view the kanban board](https://app.zenhub.com/workspaces/g-sales-64fbb46c65f9ff003a1530a8/board?sprints=none) for this department, including pending tasks and the status of new requests.
   - Please **use issue comments and GitHub mentions** to communicate follow-ups or answer questions related to your request.
 
-<!---
-Rituals (out-dated 2023-10-19)
-
-| Opportunity pipeline review | Weekly | Agenda: Go through every [open opportunity](https://fleetdm.lightning.force.com/lightning/o/Opportunity/list?filterName=00B4x00000CTHZIEA5) and update the next steps, amounts, dates, and status (including choosing Closed Lost if no communications for >= 45 days). | Alex Mitchell
-
-| Lead pipeline review  | Weekly | Agenda: Review leads by status/stage; make sure SLAs are met. Clean up Open MQL list. Ask CRO if questions. | Alex Mitchell |
---->
 
 ## Responsibilities
+
 The Sales department is directly responsible for attaining the revenue goals of Fleet and helping to deliver upon our customers' objectives.
 
+
 ### Onboard a new sales team member
+
 Once the standard Fleetie onboarding issue is complete, create a new ["Sales team onboarding"](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-sales&projects=&template=sales-team-onboarding.md&title=Sales%20onboarding%3A_____________) issue and complete it.
 
+
 ### Send a quote
+
 During the buying cycle, the champion will need to start the process to secure funding in cooperation with the economic buyer and the finance org.
 
 All quotes and purchase orders must be approved by CRO before being sent to the prospect or customer. Often, the CRO will request Fleet business operations/legal of any unique terms required.
@@ -37,25 +39,46 @@ All quotes and purchase orders must be approved by CRO before being sent to the
 The Fleet owner of the opportunity (usually AE or CSM) will prepare a quote and/or a Purchase Order when requested.
 - Because the champion may need to socialize "what is Fleet" or "what are we getting when buying Fleet," it is most often best to send the quote in [slide form](https://docs.google.com/presentation/d/15kbqm0OYPf1OmmTZvDp4F7VvMERnX4K6TMYqCYNr-wI/edit?usp=sharing).
 - Docusign can be used to create a [standard Purchase Order](https://www.loom.com/share/Loom-Message-16-January-2023-2ba8cf195ec645ebabac267d7df59823?sid=214f8c6b-beb3-427a-a3a8-e8c20b5dc350) if no special terms or pricing are needed.
+- Before sending to prospect, work with the Business operations team to verify if sales tax needs to be charged and, if so, how much.
+
 
 ### Obtain a copy of Fleet's W-9
+
 A recent signed copy of Fleet's W-9 form can be found in [this confidential PDF in Google Drive](https://drive.google.com/file/d/1ugXazEBk1oVm_LqGbYNsIFECcv5jXLA9/view?usp=drivesdk).
 
+
 ### Provide payment information to a prospect
+
 For customers with large deployments, Fleet accepts payment via wire transfer or electronic debit (ACH/SWIFT).
 
-Provide remittance information to customers by exporting ["💸 Paying Fleet"](https://docs.google.com/document/d/1KP_-x9c1x3sS1X9Q8Wlib2H7tq69xRONn1KMA3nVFQc/edit) into a PDF, then sending that to the prospect.
+Payment information for customers within the United States is on Fleet's invoices. Typically, payment information does not need to be sent separately.
+
+For Fleet customers outside of the United States or instances where a customer is requesting payment information prior to invoicing, provide remittance information to customers by exporting ["💸 Paying Fleet"](https://docs.google.com/document/d/1KP_-x9c1x3sS1X9Q8Wlib2H7tq69xRONn1KMA3nVFQc/edit) into a PDF, then sending that to the prospect.
+
 
 ### Review rep activity
+
 Following up with people interested in Fleet is an important part of finding out whether or not they'd like to continue the process of buying the product.  It is also very important not to be annoying.  At Fleet, team members follow up with people, but not too often.
 
 To help coach reps and avoid being annoying to Fleet users, Fleet reviews rep activity on a regular basis following these steps:
-1. In Salesforce, visit the activity report on your dashboard.  (TODO: taylor will replace this and/or link it)
+1. In Salesforce, visit the activity report on your dashboard.
 2. For each rep, review recent activity from the last 30 days across all of that rep's accounts.
 3. If outreach is too frequent or doesn't fit the company's strategy, then set up a 30 minute coaching session to discuss with the rep.
 
+Every week, AEs will review the status of all qualified opportunities with leadership in an opportunity pipeline review meeting. For this meeting, reps will:
+1. Update the following information in Salesforce for every opp:
+  - Contacts (and Roles)
+  - Amount
+  - Close date
+  - Stage
+  - Next steps
+2. Make sure all contacts have been sent a connection request from Mike McNeil.
+3. Identify and discuss where gaps are in [MEDDPICC](https://handbook.gitlab.com/handbook/sales/meddppicc/).
+4. Relay how many meetings they had with attendees from both IT and security this week.
+
 
 ### Validate Salesforce data (RevOps) 
+
 In order to maintain a consistent contributor experience in Salesforce, we log in to make sure the structure of Salesforce data continues to look correct based on processes started elsewhere. Then we can look and see that the goals we want to achieve as a business are in line with our view inside Salesforce by conducting the following checkup. Any discrepancies between how information is presented in Salesforce and what should be in there per this ritual should be flagged so that they can be fixed or discussed.
 
 1. Make sure the default tabs for a standard user include a detailed view of contacts, opportunities, accounts, and leads. No other tabs should exist.
@@ -92,6 +115,7 @@ In order to maintain a consistent contributor experience in Salesforce, we log i
 
 
 ### Invite new customer DRI
+
 Sometimes there is a change in the champion within the customer's organization.
 1. Get an introduction to the new DRIs including names, roles, contact information.
 2. Make sure they're in the Slack channel.
@@ -102,14 +126,18 @@ Sometimes there is a change in the champion within the customer's organization.
     3. Offer training to get them up to speed.
     4. Provide a white glove experience.
 
+
 ### To schedule Solutions Consultant (SC) for a prospect meeting
+
 To schedule an [ad hoc meeting](https://www.vocabulary.com/dictionary/ad%20hoc) with a Fleet prospect, the Account Executive (AE) will [open an issue](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-sales%2C%23solutions-consultant%2C%3Adiscovery%2C%3Ademo%2C%3Ascoping%2C%3Atech-eval&projects=&template=custom-request.md&title=prospect+name+-+prep+%28date%29+-+discovery%2Cdemo%2Cscoping+%28date%29). 
  - Use [this calendly link](https://calendly.com/fleetdm/talk-to-a-solutions-consultant) to obtain SC availability.
  - The AE will populate this issue with the appropriate dates for an internal prep meeting as well as the dates for the external prospect meeting.
  - Do not assign the issue. The Director of Solutions Consulting will assign the issue.
  - Ensure that the product category is defined ("Endpoint ops", "Device management", or "Vulnerability management") in the description of the issue.
 
+
 ### Hand off a technical evaluation to a temporary DRI
+
 Tech evals will have a DRI at all times; should the DRI be unavailable (ie: vacation), a hand off process to a temporary DRI will be required. In advance of vacation time (target one week in advance), refer to the following examples and review with each individual that will act as the temporary DRI for the technical evaluation while you are away. This can be documented as a google doc or can be added to the relevant tech eval epic issue in github.
 
 Ensure that our valued customers know that you will be away and that the temporary DRI has been debriefed on their setup and can handle any technical questions that come up. 
@@ -157,14 +185,18 @@ Temp Transfer to: Temp technical DRI
   - an alternative date and time. Suggest two to three options from which the prospect can choose.
     - Confirm that contact information is accurate and that the prospect can receive and access meeting invites.
    
+
 ### Send an NDA to a customer
+
 - Fleet uses "Non-Disclosure Agreements" (NDAs) to protect the company and the companies we collaborate with. Always offer to send Fleet's NDA and, whenever possible, default to using the company's version. To send an NDA to a customer, follow these steps: 
 1. If a customer has no objections to using Fleet's NDA, route the NDA to them for signature using the "🙊 NDA (Non-disclosure agreement)" template in [DocuSign](https://apps.docusign.com/send/home).
 > If a customer would like to review the NDA first, download a .docx of [Fleet's NDA](https://docs.google.com/document/d/1gQCrF3silBFG9dJgyCvpmLa6hPhX_T4V7pL3XAwgqEU/edit?usp=sharing) and send it to the customer.
 2. If the customer has no objections, route the NDA using the template in DocuSign (do not upload and use the copy you emailed to the customer).
 3. If the customer "redlines" (i.e. wants to change) the NDA, follow the [contract review process](https://fleetdm.com/handbook/company/communications#getting-a-contract-reviewed) so that BizOps can look over any proposed changes and provide guidance on how to proceed.
 
+
 ### Create a customer agreement
+
 - **Contract terms:** Fleet's subscription agreement is available at [fleetdm.com/terms](https://fleetdm.com/terms). 
   - **Effective date:** The start date for the subscription service.
   - **Close date:** The date the last party to the contract signed the agreement.
@@ -175,19 +207,26 @@ Temp Transfer to: Temp technical DRI
 
 > All non-standard (from another party) subscription agreements, NDAs, and similar contracts require legal review from the Business Operations department before being signed. [Create an issue to request legal review](https://github.com/fleetdm/confidential/blob/main/.github/ISSUE_TEMPLATE/contract-review.md).
 
+
 ### Close a new customer deal
+
 To close a deal with a new customer (non-self-service), create and complete a GitHub issue using the ["Sale" issue template](https://github.com/fleetdm/confidential/issues/new?assignees=hughestaylor&labels=%23g-business-operations&projects=&template=3-sale.md&title=New+customer%3A+_____________).
 
+
 ### Change customer credit card number
+
 You can help a Premium license dispenser customers change their credit card by directing them to their [account dashboard](https://fleetdm.com/customers/dashboard). On that page, the customer can update their billing card by clicking the pencil icon next to their billing information.
 
+
 ### Process a security questionnaire
+
 - The AE will [use the handbook](https://fleetdm.com/handbook/company/communications#vendor-questionnaires) to answer most of the questions with links to appropriate sections in the handbook. After this first pass has been completed, and if there are outstanding questions, the AE will [assign the issue to Business Operations (#g-business-operations)](https://fleetdm.com/handbook/business-operations#contact-us)  with a requested timeline for completion defined.
 - BizOps consults the handbook to validate that nothing was missed by the AE. After the second pass has been completed, and if there are outstanding questions, BizOps will [reassign the issue to Sales (#g-sales)](https://fleetdm.com/handbook/sales#contact-us) for intake.
 - The issue will be assigned to the Solutions Consultant (SC) associated to the opportunity in order to complete any unanswered questions.
 - The SC will search for unanswered questions and confirm again that nothing was missed from the handbook. Content missing from the handbook will need to be added via PR by the SC. Any unanswered questions after this pass has been completed by the SC will need to be [escalated to the Infrastructure team (#g-customer-success)](https://fleetdm.com/handbook/customer-success#contact-us) with the requested timeline for completion defined in the issue. Once complete, the infra team will assign the issue back to the #g-sales board.
 - Any questions answered by the infra team will be added to the handbook by the SC.
 
+
 ## Rituals
 
 <rituals :rituals="rituals['handbook/sales/sales.rituals.yml']"></rituals>
diff --git a/handbook/sales/sales.rituals.yml b/handbook/sales/sales.rituals.yml
index 6b2fd8fd0d3c..e83a43e85103 100644
--- a/handbook/sales/sales.rituals.yml
+++ b/handbook/sales/sales.rituals.yml
@@ -1,12 +1,18 @@
 # https://github.com/fleetdm/fleet/pull/13084
 
 
-
+ -
+  task: "Close leads contacted ≥7 days ago"
+  startedOn: "2024-07-05"
+  frequency: "Daily"
+  description: "Close all of your leads in the 'Attempted to contact' stage and which have been there for 7 or more days.  If follow-up is appropriate, and won't be bothersome, it can be done after closing the lead.  (A new lead can always be opened for the contact later.)"
+  moreInfoUrl: ""
+  dri: "Every AE"
  -
   task: "Prioritize for next sprint" # Title that will actually show in rituals table
   startedOn: "2023-09-04" # Needs to align with frequency e.g. if frequency is every thrid Thursday startedOn === any third thursday
   frequency: "Triweekly" # must be supported by
-  description: "Drag next sprint's priorities to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/company/communication)"
+  description: "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/company/communication)"
   moreInfoUrl: "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible" #URL used to highlight "description:" test in table
   dri: "alexmitchelliii" # DRI for ritual (assignee if autoIssue) (TODO display GitHub proflie pic instead of name or title)
   autoIssue:   # Enables automation of GitHub issues
diff --git a/infrastructure/dogfood/terraform/aws-tf-module/free.tf b/infrastructure/dogfood/terraform/aws-tf-module/free.tf
index 308db90bfaf9..37eb03f37e33 100644
--- a/infrastructure/dogfood/terraform/aws-tf-module/free.tf
+++ b/infrastructure/dogfood/terraform/aws-tf-module/free.tf
@@ -25,7 +25,7 @@ module "free" {
   }
   rds_config = {
     name                = local.customer_free
-    engine_version      = "8.0.mysql_aurora.3.05.2"
+    engine_version      = "8.0.mysql_aurora.3.07.1"
     snapshot_identifier = "arn:aws:rds:us-east-2:611884880216:cluster-snapshot:a2023-03-06-pre-migration"
     db_parameters = {
       # 8mb up from 262144 (256k) default
diff --git a/infrastructure/dogfood/terraform/aws-tf-module/main.tf b/infrastructure/dogfood/terraform/aws-tf-module/main.tf
index 4256d37d253d..2bede111ec00 100644
--- a/infrastructure/dogfood/terraform/aws-tf-module/main.tf
+++ b/infrastructure/dogfood/terraform/aws-tf-module/main.tf
@@ -76,7 +76,7 @@ module "main" {
   }
   rds_config = {
     name                = local.customer
-    engine_version      = "8.0.mysql_aurora.3.05.2"
+    engine_version      = "8.0.mysql_aurora.3.07.1"
     snapshot_identifier = "arn:aws:rds:us-east-2:611884880216:cluster-snapshot:a2023-03-06-pre-migration"
     db_parameters = {
       # 8mb up from 262144 (256k) default
diff --git a/infrastructure/dogfood/terraform/aws/variables.tf b/infrastructure/dogfood/terraform/aws/variables.tf
index 8d2e57c3f904..4329e1f0b4b7 100644
--- a/infrastructure/dogfood/terraform/aws/variables.tf
+++ b/infrastructure/dogfood/terraform/aws/variables.tf
@@ -56,7 +56,7 @@ variable "database_name" {
 
 variable "fleet_image" {
   description = "the name of the container image to run"
-  default     = "fleetdm/fleet:v4.53.1"
+  default     = "fleetdm/fleet:v4.54.1"
 }
 
 variable "software_inventory" {
diff --git a/infrastructure/dogfood/terraform/gcp/.terraform.lock.hcl b/infrastructure/dogfood/terraform/gcp/.terraform.lock.hcl
new file mode 100644
index 000000000000..afe278409c49
--- /dev/null
+++ b/infrastructure/dogfood/terraform/gcp/.terraform.lock.hcl
@@ -0,0 +1,82 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/google" {
+  version     = "4.51.0"
+  constraints = ">= 2.12.0, >= 3.45.0, >= 3.53.0, >= 3.60.0, >= 4.51.0, 4.51.0, < 5.0.0, < 6.0.0"
+  hashes = [
+    "h1:7JFdiV9bvV6R+AeWzvNbVeoega481sJY3PqtIbrwTsM=",
+    "zh:001bf7478e495d497ffd4054453c97ab4dd3e6a24d46496d51d4c8094e95b2b1",
+    "zh:19db72113552dd295854a99840e85678d421312708e8329a35787fff1baeed8b",
+    "zh:42c3e629ace225a2cb6cf87b8fabeaf1c56ac8eca6a77b9e3fc489f3cc0a9db5",
+    "zh:50b930755c4b1f8a01c430d8f688ea79de0b0198c87511baa3a783e360d7e624",
+    "zh:5acd67f0aafff5ad59e179543cccd1ffd48d69b98af0228506403b8d8193b340",
+    "zh:70128d57b4b4bf07df941172e6af15c4eda8396af5cc2b0128c906983c7b7fad",
+    "zh:7905fac0ba2becf0e97edfcd4224e57466b04f960f36a3ec654a0a3c2ffececb",
+    "zh:79b4cc760305cd77c1ff841f789184f808b8052e8f4faa5cb8d518e4c13beb22",
+    "zh:c7aebd7d7dd2b29de28e382500d36fae8b4d8a192cf05e41ea29c66f1251acfc",
+    "zh:d8b4494b13ef5af65d3afedf05bf7565918f1e31ad68ae0df81f5c3b12baf519",
+    "zh:e6e68ef6881bc3312db50c9fd761f226f34d7834b64f90d96616b7ca6b1daf34",
+    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/google-beta" {
+  version     = "4.85.0"
+  constraints = ">= 3.45.0, >= 3.53.0, >= 3.62.0, < 5.0.0, < 6.0.0"
+  hashes = [
+    "h1:YkCDGkP0AUZoNobLoxRnM52Pi4alYE9EFXalEu8p8E8=",
+    "zh:40e9c7ec46955b4d79065a14185043a4ad6af8d0246715853fc5c99208b66980",
+    "zh:5950a9ba2f96420ea5335b543e315b1a47a705f9a9abfc53c6fec52d084eddcb",
+    "zh:5dfa98d32246a5d97e018f2b91b0e921cc6f061bc8591884f3b144f0d62f1c20",
+    "zh:628d0ca35c6d4c35077859bb0a5534c1de44f23a91e190f9c3f06f2358172e75",
+    "zh:6e78d54fd4de4151968149b4c3521f563a8b5c55aad423dba5968a9114b65ae4",
+    "zh:91c3bc443188638353285bd35b06d3a3b39b42b3b4cc0637599a430438fba2f7",
+    "zh:9e91b03363ebf39eea5ec0fbe7675f6979883aa9ad9a36664357d8513a007cf3",
+    "zh:db9a8d6bfe075fb38c260986ab557d40e8d18e5698c62956a6da8120fae01d59",
+    "zh:e41169c49f3bb53217905509e2ba8bb4680c373e1f54db7fac1b7f72943a1004",
+    "zh:f32f55a8af605afbc940814e17493ac83d9d66cd6da9bbc247e0a833a0aa37ec",
+    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+    "zh:f6561a6badc3af842f9ad5bb926104954047f07cb90fadcca1357441cc67d91d",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/null" {
+  version     = "3.1.1"
+  constraints = "~> 3.1.0"
+  hashes = [
+    "h1:71sNUDvmiJcijsvfXpiLCz0lXIBSsEJjMxljt7hxMhw=",
+    "zh:063466f41f1d9fd0dd93722840c1314f046d8760b1812fa67c34de0afcba5597",
+    "zh:08c058e367de6debdad35fc24d97131c7cf75103baec8279aba3506a08b53faf",
+    "zh:73ce6dff935150d6ddc6ac4a10071e02647d10175c173cfe5dca81f3d13d8afe",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:8fdd792a626413502e68c195f2097352bdc6a0df694f7df350ed784741eb587e",
+    "zh:976bbaf268cb497400fd5b3c774d218f3933271864345f18deebe4dcbfcd6afa",
+    "zh:b21b78ca581f98f4cdb7a366b03ae9db23a73dfa7df12c533d7c19b68e9e72e5",
+    "zh:b7fc0c1615dbdb1d6fd4abb9c7dc7da286631f7ca2299fb9cd4664258ccfbff4",
+    "zh:d1efc942b2c44345e0c29bc976594cb7278c38cfb8897b344669eafbc3cddf46",
+    "zh:e356c245b3cd9d4789bab010893566acace682d7db877e52d40fc4ca34a50924",
+    "zh:ea98802ba92fcfa8cf12cbce2e9e7ebe999afbf8ed47fa45fc847a098d89468b",
+    "zh:eff8872458806499889f6927b5d954560f3d74bf20b6043409edf94d26cd906f",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/random" {
+  version     = "3.1.3"
+  constraints = "~> 3.1.0"
+  hashes = [
+    "h1:nLWniS8xhb32qRQy+n4bDPjQ7YWZPVMR3v1vSrx7QyY=",
+    "zh:26e07aa32e403303fc212a4367b4d67188ac965c37a9812e07acee1470687a73",
+    "zh:27386f48e9c9d849fbb5a8828d461fde35e71f6b6c9fc235bc4ae8403eb9c92d",
+    "zh:5f4edda4c94240297bbd9b83618fd362348cadf6bf24ea65ea0e1844d7ccedc0",
+    "zh:646313a907126cd5e69f6a9fafe816e9154fccdc04541e06fed02bb3a8fa2d2e",
+    "zh:7349692932a5d462f8dee1500ab60401594dddb94e9aa6bf6c4c0bd53e91bbb8",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:9034daba8d9b32b35930d168f363af04cecb153d5849a7e4a5966c97c5dc956e",
+    "zh:bb81dfca59ef5f949ef39f19ea4f4de25479907abc28cdaa36d12ecd7c0a9699",
+    "zh:bcf7806b99b4c248439ae02c8e21f77aff9fadbc019ce619b929eef09d1221bb",
+    "zh:d708e14d169e61f326535dd08eecd3811cd4942555a6f8efabc37dbff9c6fc61",
+    "zh:dc294e19a46e1cefb9e557a7b789c8dd8f319beca99b8c265181bc633dc434cc",
+    "zh:f9d758ee53c55dc016dd736427b6b0c3c8eb4d0dbbc785b6a3579b0ffedd9e42",
+  ]
+}
diff --git a/infrastructure/dogfood/terraform/gcp/artifact_registry.tf b/infrastructure/dogfood/terraform/gcp/artifact_registry.tf
deleted file mode 100644
index 7e87e4c4ddd1..000000000000
--- a/infrastructure/dogfood/terraform/gcp/artifact_registry.tf
+++ /dev/null
@@ -1,7 +0,0 @@
-resource "google_artifact_registry_repository" "my-repo" {
-  provider      = google-beta
-  location      = var.region
-  repository_id = "${var.prefix}-repository"
-  description   = "repository to hold fleet container images for cloud run"
-  format        = "DOCKER"
-}
\ No newline at end of file
diff --git a/infrastructure/dogfood/terraform/gcp/cloud_run.tf b/infrastructure/dogfood/terraform/gcp/cloud_run.tf
index cdda0abbb271..61fc941729a9 100644
--- a/infrastructure/dogfood/terraform/gcp/cloud_run.tf
+++ b/infrastructure/dogfood/terraform/gcp/cloud_run.tf
@@ -28,6 +28,10 @@ resource "random_pet" "suffix" {
   length = 1
 }
 
+resource "random_password" "private_key" {
+  length = 32
+}
+
 resource "google_secret_manager_secret" "secret" {
   secret_id = "fleet-db-password-${random_pet.suffix.id}"
   replication {
@@ -35,6 +39,18 @@ resource "google_secret_manager_secret" "secret" {
   }
 }
 
+resource "google_secret_manager_secret" "private_key" {
+  secret_id = "fleet-private-key-${random_pet.suffix.id}"
+  replication {
+    automatic = true
+  }
+}
+
+resource "google_secret_manager_secret_version" "private_key" {
+  secret      = google_secret_manager_secret.private_key.name
+  secret_data = random_password.private_key.result
+}
+
 resource "google_secret_manager_secret_version" "secret-version-data" {
   secret      = google_secret_manager_secret.secret.name
   secret_data = module.fleet-mysql.generated_user_password
@@ -49,6 +65,13 @@ resource "google_secret_manager_secret_iam_member" "secret-access" {
   depends_on = [google_secret_manager_secret.secret]
 }
 
+resource "google_secret_manager_secret_iam_member" "private-key-access" {
+  secret_id  = google_secret_manager_secret.private_key.id
+  role       = "roles/secretmanager.secretAccessor"
+  member     = "serviceAccount:${data.google_compute_default_service_account.default.email}"
+  depends_on = [google_secret_manager_secret.private_key]
+}
+
 resource "google_cloud_run_service" "default" {
   name     = "${var.prefix}-backend"
   location = var.region
@@ -69,7 +92,7 @@ resource "google_cloud_run_service" "default" {
             memory = var.fleet_memory
           }
         }
-        image = "${var.region}-docker.pkg.dev/${var.project_id}/${google_artifact_registry_repository.my-repo.name}/${var.image}"
+        image = var.image
         ports {
           name           = "http1"
           container_port = 8080
@@ -82,6 +105,43 @@ resource "google_cloud_run_service" "default" {
           name  = "FLEET_MYSQL_DATABASE"
           value = var.db_name
         }
+        env {
+          name  = "FLEET_S3_SOFTWARE_INSTALLERS_BUCKET"
+          value = google_storage_bucket.software_installers.id
+        }
+        env {
+          name  = "FLEET_S3_SOFTWARE_INSTALLERS_ACCESS_KEY_ID"
+          value = google_storage_hmac_key.key.access_id
+        }
+        env {
+          name  = "FLEET_S3_SOFTWARE_INSTALLERS_SECRET_ACCESS_KEY"
+          value = google_storage_hmac_key.key.secret
+        }
+        env {
+          name  = "FLEET_S3_SOFTWARE_INSTALLERS_ENDPOINT_URL"
+          value = "https://storage.googleapis.com"
+        }
+        env {
+          // software_installers_force_s3_path_style
+          name  = "FLEET_S3_SOFTWARE_INSTALLERS_FORCE_S3_PATH_STYLE"
+          value = "true"
+        }
+        env {
+          name  = "FLEET_S3_SOFTWARE_INSTALLERS_REGION"
+          value = "auto"
+        }
+        env {
+          name  = "FLEET_LOGGING_JSON"
+          value = "true"
+        }
+        env {
+          name  = "FLEET_LOGGING_DEBUG"
+          value = var.debug_logging
+        }
+        env {
+          name  = "FLEET_LICENSE_KEY"
+          value = var.license_key
+        }
         env {
           name  = "FLEET_SERVER_TLS"
           value = false
@@ -103,6 +163,15 @@ resource "google_cloud_run_service" "default" {
             }
           }
         }
+        env {
+          name = "FLEET_SERVER_PRIVATE_KEY"
+          value_from {
+            secret_key_ref {
+              name = google_secret_manager_secret.private_key.secret_id
+              key  = "latest"
+            }
+          }
+        }
         command = ["/bin/sh"]
         args = [
           "-c",
diff --git a/infrastructure/dogfood/terraform/gcp/main.tf b/infrastructure/dogfood/terraform/gcp/main.tf
index 978826378936..858579d3aefa 100644
--- a/infrastructure/dogfood/terraform/gcp/main.tf
+++ b/infrastructure/dogfood/terraform/gcp/main.tf
@@ -2,7 +2,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = "4.9.0"
+      version = "4.51.0"
     }
     google-beta = {
       source = "hashicorp/google-beta"
diff --git a/infrastructure/dogfood/terraform/gcp/readme.md b/infrastructure/dogfood/terraform/gcp/readme.md
index b4872b181212..65a9f08a579c 100644
--- a/infrastructure/dogfood/terraform/gcp/readme.md
+++ b/infrastructure/dogfood/terraform/gcp/readme.md
@@ -21,31 +21,6 @@ using [Serverless VPC Access Connector](https://cloud.google.com/sql/docs/mysql/
 We are running Redis using [Google Cloud Memorystore (Redis engine)](https://cloud.google.com/memorystore). This can run in cluster mode, but by default we
 are running in standalone mode.
 
-### Pushing the Fleet image into Google Artifact registry
-
-More details can be found [here](https://cloud.google.com/artifact-registry/docs/docker/pushing-and-pulling).
-
-Login with gcloud helper:
-
-```shell
-gcloud auth configure-docker \
-    us-central1-docker.pkg.dev
-```
-
-Pull latest image:
-
-`docker pull <latest fleet version>` for example `docker pull fleetdm/fleet:v4.10.0`
-
-Tag it:
-
-```
-docker tag fleetdm/fleet:v10.0.0 us-central1-docker.pkg.dev/<project_id>/fleet-repository/fleet:v10.0.0
-```
-
-Push to Google Artifact registry:
-
-`docker push us-central1-docker.pkg.dev/<project_id>/fleet-repository/fleet:v4.9.1`
-
 ### GCP Managed Certificates
 
 In this example we are using [GCP Managed Certificates](https://cloud.google.com/load-balancing/docs/ssl-certificates/google-managed-certs) to handle TLS and TLS termination at the LoadBalancer.
diff --git a/infrastructure/dogfood/terraform/gcp/storage.tf b/infrastructure/dogfood/terraform/gcp/storage.tf
new file mode 100644
index 000000000000..251cc0193cb2
--- /dev/null
+++ b/infrastructure/dogfood/terraform/gcp/storage.tf
@@ -0,0 +1,23 @@
+data "google_client_config" "current" {}
+
+resource "google_service_account" "service_account" {
+  account_id = "fleet-svc"
+}
+
+resource "google_storage_hmac_key" "key" {
+  service_account_email = google_service_account.service_account.email
+}
+
+resource "google_storage_bucket" "software_installers" {
+  name          = var.software_installers_bucket_name
+  location      = data.google_client_config.current.region
+  force_destroy = true
+
+  uniform_bucket_level_access = true
+}
+
+resource "google_storage_bucket_iam_member" "hmac_sa_storage_admin" {
+  bucket = google_storage_bucket.software_installers.name
+  role   = "roles/storage.objectAdmin"
+  member = "serviceAccount:${google_service_account.service_account.email}"
+}
\ No newline at end of file
diff --git a/infrastructure/dogfood/terraform/gcp/variables.tf b/infrastructure/dogfood/terraform/gcp/variables.tf
index 2e74c457a910..0850224609a5 100644
--- a/infrastructure/dogfood/terraform/gcp/variables.tf
+++ b/infrastructure/dogfood/terraform/gcp/variables.tf
@@ -68,5 +68,18 @@ variable "redis_mem" {
 }
 
 variable "image" {
-  default = "fleet:v4.53.1"
+  default = "fleetdm/fleet:v4.54.1"
+}
+
+variable "software_installers_bucket_name" {
+  default = "fleet-software-installers"
+}
+
+variable "license_key" {
+  default = ""
+  description = "Fleet license key"
+}
+
+variable "debug_logging" {
+  default = "false"
 }
diff --git a/infrastructure/dogfood/terraform/gcp/vpc.tf b/infrastructure/dogfood/terraform/gcp/vpc.tf
index 527d44e008ab..a8b5fa6713f8 100644
--- a/infrastructure/dogfood/terraform/gcp/vpc.tf
+++ b/infrastructure/dogfood/terraform/gcp/vpc.tf
@@ -43,3 +43,16 @@ module "private-service-access" {
   vpc_network = module.vpc.network_name
   depends_on  = [module.vpc]
 }
+
+module "cloud_router" {
+  source  = "terraform-google-modules/cloud-router/google"
+  version = "~> 6.0"
+  name    = "fleet-cloud-router"
+  project = var.project_id
+  network = module.vpc.network_name
+  region  = var.region
+
+  nats = [{
+    name = "fleet-vpc-nat"
+  }]
+}
diff --git a/infrastructure/loadtesting/terraform/docker/loadtest.Dockerfile b/infrastructure/loadtesting/terraform/docker/loadtest.Dockerfile
index 18936fa2d81b..c232760b4412 100644
--- a/infrastructure/loadtesting/terraform/docker/loadtest.Dockerfile
+++ b/infrastructure/loadtesting/terraform/docker/loadtest.Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.22.4-alpine3.20@sha256:ace6cc3fe58d0c7b12303c57afe6d6724851152df55e08057b43990b927ad5e8
+FROM golang:1.23.1-alpine3.20@sha256:436e2d978524b15498b98faa367553ba6c3655671226f500c72ceb7afb2ef0b1
 ARG TAG
 RUN apk add git
 RUN git clone -b $TAG --depth=1 --no-tags --progress --no-recurse-submodules https://github.com/fleetdm/fleet.git && cd /go/fleet/cmd/osquery-perf/ && go build .
diff --git a/infrastructure/loadtesting/terraform/rds.tf b/infrastructure/loadtesting/terraform/rds.tf
index 4276c0d81cba..87dea8134898 100644
--- a/infrastructure/loadtesting/terraform/rds.tf
+++ b/infrastructure/loadtesting/terraform/rds.tf
@@ -28,7 +28,7 @@ module "aurora_mysql" { #tfsec:ignore:aws-rds-enable-performance-insights-encryp
 
   name                  = "${local.name}-mysql"
   engine                = "aurora-mysql"
-  engine_version        = "8.0.mysql_aurora.3.03.3"
+  engine_version        = "8.0.mysql_aurora.3.05.2"
   instance_class         = var.db_instance_type
 
   instances = {
diff --git a/infrastructure/loadtesting/terraform/readme.md b/infrastructure/loadtesting/terraform/readme.md
index 9e14ad8d0e19..378d9eaf35db 100644
--- a/infrastructure/loadtesting/terraform/readme.md
+++ b/infrastructure/loadtesting/terraform/readme.md
@@ -97,8 +97,8 @@ There are a few main places of interest to monitor the load and resource usage:
 
 You can deploy new code changes to an environment the following way:
 
-1. Push the code changes to the `BRANCH_NAME` and wait for the [Docker publish](https://github.com/fleetdm/fleet/actions/workflows/goreleaser-snapshot-fleet.yaml) action to complete.
-2. Find the docker image ID corresponding to your branch:
+1. Push the code changes to the `BRANCH_NAME`, trigger a manual run of the [Docker publish](https://github.com/fleetdm/fleet/actions/workflows/goreleaser-snapshot-fleet.yaml) workflow (make sure to select the branch) and wait for it to complete.
+2. Find the docker image IDs corresponding to your branch:
 ```sh
 docker images | grep 'BRANCH_NAME' | awk '{print $3}'
 ```
diff --git a/infrastructure/render/README.md b/infrastructure/render/README.md
index 23bd1618d05c..2a464c75ae4f 100644
--- a/infrastructure/render/README.md
+++ b/infrastructure/render/README.md
@@ -1,43 +1,43 @@
 [![Deploy to Render](https://render.com/images/deploy-to-render-button.svg)](https://render.com/deploy?repo=https://github.com/fleetdm/fleet)
 
-# Fleet Deployment Guide
+# Fleet deployment guide
 
 This guide outlines the services configured in the Render blueprint for deploying the Fleet system, which includes a web service, a MySQL database, and a Redis server.
 
-## Services Overview
+## Services overview
 
-### 1. Fleet Web Service
+### 1. Fleet web service
 - **Type:** Web
 - **Runtime:** Image
 - **Image:** `fleetdm/fleet:latest` 
 - **Description:** Main web service running the Fleet application, which is deployed using the latest Fleet Docker image. Configured to prepare the database before deployment.
-- **Health Check Path:** `/healthz`
-- **Environment Variables:** Connects to MySQL and Redis using service-bound environment variables.
+- **Health check path:** `/healthz`
+- **Environment variables:** Connects to MySQL and Redis using service-bound environment variables.
 
-### 2. Fleet MySQL Database
-- **Type:** Private Service (pserv)
+### 2. Fleet MySQL database
+- **Type:** Private service (pserv)
 - **Runtime:** Docker
 - **Repository:** [MySQL Example on Render](https://github.com/render-examples/mysql)
 - **Disk:** 10 GB mounted at `/var/lib/mysql`
 - **Description:** MySQL database used by the Fleet web service. Environment variables for database credentials are managed within the service and some are automatically generated.
 
-### 3. Fleet Redis Service
-- **Type:** Private Service (pserv)
+### 3. Fleet Redis service
+- **Type:** Private service (pserv)
 - **Runtime:** Image
 - **Repository:** [Redis Docker image](https://hub.docker.com/_/redis)
 - **Description:** Redis service for caching and other in-memory data storage needs of the Fleet web service.
 
-## Deployment Guide
+## Deployment guide
 
 ### Prerequisites
 - You need an account on [Render](https://render.com).
 - Familiarity with Render's dashboard and deployment concepts.
 
-### Steps to Deploy
+### Steps to deploy
 
 Click the deploy on render button or import the blueprint from the Render service deployment dashboard.
 
-### Post-Deployment
+### Post-deployment
 
 Navigate to the generated URL and run through the initial setup. If you have a license key you can add it post-deploy as
 an environment variable `FLEET_LICENSE_KEY=value` in the Fleet service configuration.
diff --git a/it-and-security/default.yml b/it-and-security/default.yml
index c94732459b6e..52baadb564d1 100644
--- a/it-and-security/default.yml
+++ b/it-and-security/default.yml
@@ -38,6 +38,10 @@ org_settings:
     zendesk: [ ]
   mdm:
     apple_bm_default_team: $DOGFOOD_APPLE_BM_DEFAULT_TEAM
+    end_user_authentication:
+      entity_id: dogfood-eula.fleetdm.com
+      idp_name: Google Workspace
+      metadata_url: $DOGFOOD_MDM_SSO_METADATA_URL
   org_info:
     contact_url: https://fleetdm.com/company/contact
     org_logo_url: ""
@@ -86,3 +90,4 @@ org_settings:
 policies:
 queries:
   - path: ./lib/collect-fleetd-update-channels.queries.yml
+software:
diff --git a/it-and-security/lib/collect-crowdstrike-info.queries.yml b/it-and-security/lib/collect-crowdstrike-info.queries.yml
new file mode 100644
index 000000000000..e68970df5453
--- /dev/null
+++ b/it-and-security/lib/collect-crowdstrike-info.queries.yml
@@ -0,0 +1,8 @@
+- name: Get Crowdstrike Falcon network content filter status
+  description: "Collects crowdstrike information"
+  query: |
+    /* Load up the plist */ WITH extensions_plist AS (SELECT *, rowid FROM plist WHERE path = '/Library/Preferences/com.apple.networkextension.plist') /* Find the first "Enabled" key after the key indicating the crowdstrike app */ SELECT value AS enabled FROM extensions_plist WHERE subkey = 'Enabled' AND rowid > (SELECT rowid FROM extensions_plist WHERE value = 'com.crowdstrike.falcon.App') LIMIT 1;
+  interval: 300 # 5 minutes
+  observer_can_run: true
+  automations_enabled: false
+  platform: darwin,linux,windows
diff --git a/it-and-security/lib/collect-crowdstrike-info.yml b/it-and-security/lib/collect-crowdstrike-info.yml
new file mode 100644
index 000000000000..e68970df5453
--- /dev/null
+++ b/it-and-security/lib/collect-crowdstrike-info.yml
@@ -0,0 +1,8 @@
+- name: Get Crowdstrike Falcon network content filter status
+  description: "Collects crowdstrike information"
+  query: |
+    /* Load up the plist */ WITH extensions_plist AS (SELECT *, rowid FROM plist WHERE path = '/Library/Preferences/com.apple.networkextension.plist') /* Find the first "Enabled" key after the key indicating the crowdstrike app */ SELECT value AS enabled FROM extensions_plist WHERE subkey = 'Enabled' AND rowid > (SELECT rowid FROM extensions_plist WHERE value = 'com.crowdstrike.falcon.App') LIMIT 1;
+  interval: 300 # 5 minutes
+  observer_can_run: true
+  automations_enabled: false
+  platform: darwin,linux,windows
diff --git a/it-and-security/lib/configuration-profiles/passcode-settings-ddm.json b/it-and-security/lib/configuration-profiles/passcode-settings-ddm.json
index dabb02d1a674..f4811f765bee 100644
--- a/it-and-security/lib/configuration-profiles/passcode-settings-ddm.json
+++ b/it-and-security/lib/configuration-profiles/passcode-settings-ddm.json
@@ -2,7 +2,7 @@
     "Type": "com.apple.configuration.passcode.settings",
     "Identifier": "956e0d14-6019-479b-a6f9-a69ef77668c5",
     "Payload": {
-        "MaximumFailedAttempts": "five",
+        "MaximumFailedAttempts": 5,
         "MaximumInactivityInMinutes ": 5,
         "MinimumLength ": 12,
         "MinimumComplexCharacters": 3
diff --git a/it-and-security/lib/configuration-profiles/windows-firewall.xml b/it-and-security/lib/configuration-profiles/windows-firewall.xml
new file mode 100644
index 000000000000..424d89f886ee
--- /dev/null
+++ b/it-and-security/lib/configuration-profiles/windows-firewall.xml
@@ -0,0 +1,25 @@
+<Replace>
+  <!-- Enable firewall -->
+  <Item>
+    <Meta>
+      <Format xmlns="syncml:metinf">bool</Format>
+    </Meta>
+    <Target>
+      <LocURI>./Vendor/MSFT/Firewall/MdmStore/DomainProfile/EnableFirewall</LocURI>
+    </Target>
+    <Data>true</Data>
+  </Item>
+</Replace>
+<Replace>
+  <!-- Enable stealth mode -->
+  <Item>
+    <Meta>
+      <Format xmlns="syncml:metinf">bool</Format>
+    </Meta>
+    <Target>
+      <LocURI>./Vendor/MSFT/Firewall/MdmStore/DomainProfile/DisableStealthMode
+</LocURI>
+    </Target>
+    <Data>true</Data>
+  </Item>
+</Replace>
diff --git a/it-and-security/lib/configuration-profiles/windows-password.xml b/it-and-security/lib/configuration-profiles/windows-password.xml
new file mode 100644
index 000000000000..ce9c96ff9cee
--- /dev/null
+++ b/it-and-security/lib/configuration-profiles/windows-password.xml
@@ -0,0 +1,24 @@
+<Replace>
+  <!-- Enforce PIN or password length (10 characters) -->
+  <Item>
+    <Meta>
+      <Format xmlns="syncml:metinf">int</Format>
+    </Meta>
+    <Target>
+      <LocURI>./Device/Vendor/MSFT/Policy/Config/DeviceLock/MinDevicePasswordLength</LocURI>
+    </Target>
+    <Data>10</Data>
+  </Item>
+</Replace>
+<Replace>
+  <!-- Enforce PIN or password has at least one lowercase letter and at least one number -->
+  <Item>
+    <Meta>
+      <Format xmlns="syncml:metinf">int</Format>
+    </Meta>
+    <Target>
+      <LocURI>./Device/Vendor/MSFT/Policy/Config/DeviceLock/MinDevicePasswordComplexCharacters</LocURI>
+    </Target>
+    <Data>2</Data>
+  </Item>
+</Replace>
diff --git a/it-and-security/lib/configuration-profiles/windows-screen-lock.xml b/it-and-security/lib/configuration-profiles/windows-screen-lock.xml
new file mode 100644
index 000000000000..f7d95aa803cc
--- /dev/null
+++ b/it-and-security/lib/configuration-profiles/windows-screen-lock.xml
@@ -0,0 +1,24 @@
+<Replace>
+  <!-- Enforce screenlock -->
+  <Item>
+    <Meta>
+      <Format xmlns="syncml:metinf">int</Format>
+    </Meta>
+    <Target>
+      <LocURI>./Device/Vendor/MSFT/Policy/Config/DeviceLock/DevicePasswordEnabled</LocURI>
+    </Target>
+    <Data>0</Data>
+  </Item>
+</Replace>
+<Replace>
+  <!-- Enforce screenlock after 15 minutes -->
+  <Item>
+    <Meta>
+      <Format xmlns="syncml:metinf">int</Format>
+    </Meta>
+    <Target>
+      <LocURI>./Device/Vendor/MSFT/Policy/Config/DeviceLock/MaxInactivityTimeDeviceLock</LocURI>
+    </Target>
+    <Data>15</Data>
+  </Item>
+</Replace>
diff --git a/it-and-security/lib/install-update-homebrew.sh b/it-and-security/lib/install-update-homebrew.sh
new file mode 100755
index 000000000000..720ad00d689f
--- /dev/null
+++ b/it-and-security/lib/install-update-homebrew.sh
@@ -0,0 +1,50 @@
+#!/bin/zsh
+
+################################################################################################
+# Homebrew Update Script
+################################################################################################
+
+# Logging function
+logging() {
+    local log_level=$(printf "%s" "$1" | /usr/bin/tr '[:lower:]' '[:upper:]')
+    local log_statement="$2"
+    local script_name="$(/usr/bin/basename "$0")"
+    local prefix=$(/bin/date +"[%b %d, %Y %Z %T $log_level]:")
+
+    # Log file path
+    local LOG_PATH="/var/log/homebrew_update.log"
+
+    # Default log level to INFO if not provided
+    [[ -z $log_level ]] && log_level="INFO"
+
+    # Log to stdout and file
+    /bin/echo "$prefix $log_statement"
+    printf "%s %s\n" "$prefix" "$log_statement" >>"$LOG_PATH"
+}
+
+# Check if Homebrew is installed and update if it is
+check_and_update_brew() {
+    local brew_path="$(/usr/bin/find /usr/local/bin /opt -maxdepth 3 -name brew 2>/dev/null)"
+
+    if [[ -n $brew_path ]]; then
+        logging "info" "Homebrew already installed at $brew_path..."
+        logging "info" "Updating homebrew ..."
+        /usr/bin/su - "$current_user" -c "$brew_path update --force" | /usr/bin/tee -a "/Library/Logs/homebrew_update.log"
+        logging "info" "Done ..."
+    else
+        logging "info" "Homebrew is not installed..."
+    fi
+}
+
+# Get the current logged-in user excluding loginwindow, _mbsetupuser, and root
+current_user=$(/usr/sbin/scutil <<<"show State:/Users/ConsoleUser" | /usr/bin/awk '/Name :/ && ! /loginwindow/ && ! /root/ && ! /_mbsetupuser/ { print $3 }' | /usr/bin/awk -F '@' '{print $1}')
+
+# Verify the current_user is valid
+if ! /usr/bin/dscl . -read "/Users/$current_user" >/dev/null 2>&1; then
+    logging "error" "Specified user \"$current_user\" is invalid"
+    exit 1
+fi
+
+logging "info" "--- Start homebrew update log ---"
+check_and_update_brew
+logging "info" "--- End homebrew update log ---"
diff --git a/it-and-security/lib/macos-check-if-apple-silicon.queries.yml b/it-and-security/lib/macos-check-if-apple-silicon.queries.yml
new file mode 100644
index 000000000000..4597cebd7ac0
--- /dev/null
+++ b/it-and-security/lib/macos-check-if-apple-silicon.queries.yml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: query
+spec:
+  name: Check if Mac has Apple silicon
+  query: SELECT 1 FROM system_info WHERE cpu_type = "arm64e";
+# - name: Determine macOS cpu type as Apple Silicon
+#   automations_enabled: false
+#   description: Returns true if macOS cpu type is Apple Silicon.
+#   discard_data: false
+#   interval: 3600
+#   logging: snapshot
+#   min_osquery_version: ""
+#   observer_can_run: true
+#   platform: "darwin"
+#   query: SELECT 1 FROM system_info WHERE cpu_type = "arm64e";
\ No newline at end of file
diff --git a/it-and-security/teams/company-owned-ipads.yml b/it-and-security/teams/company-owned-ipads.yml
new file mode 100644
index 000000000000..1405455c28f4
--- /dev/null
+++ b/it-and-security/teams/company-owned-ipads.yml
@@ -0,0 +1,22 @@
+name: 🔳🏢 Company-owned iPads
+team_settings:
+  features:
+  host_expiry_settings:
+    host_expiry_enabled: false
+    host_expiry_window: 0
+  secrets:
+    - secret: $DOGFOOD_COMPANY_OWNED_IPADS_ENROLL_SECRET
+  integrations:
+    google_calendar:
+      enable_calendar_events: false
+agent_options:
+controls:
+  ipados_updates:
+    deadline: "2024-08-23"
+    minimum_version: "17.6"
+  macos_settings:
+    custom_settings:
+  scripts:
+policies:
+queries:
+software:
diff --git a/it-and-security/teams/iphones.yml b/it-and-security/teams/company-owned-iphones.yml
similarity index 52%
rename from it-and-security/teams/iphones.yml
rename to it-and-security/teams/company-owned-iphones.yml
index 193d65a814fa..b5107054b0f2 100644
--- a/it-and-security/teams/iphones.yml
+++ b/it-and-security/teams/company-owned-iphones.yml
@@ -1,38 +1,26 @@
-name: 📱 iPhones
+name: 📱🏢 Company-owned iPhones
 team_settings:
   features:
-    enable_host_users: true
-    enable_software_inventory: true
   host_expiry_settings:
     host_expiry_enabled: false
     host_expiry_window: 0
   secrets:
-    - secret: $DOGFOOD_IPHONES_ENROLL_SECRET
+    - secret: $DOGFOOD_COMPANY_OWNED_IPHONES_ENROLL_SECRET
   integrations:
     google_calendar:
       enable_calendar_events: false
 agent_options:
-  path: ../lib/agent-options.yml
 controls:
-  enable_disk_encryption: true
+  ios_updates:
+    deadline: "2024-08-23"
+    minimum_version: "17.6"
   macos_settings:
     custom_settings:
       - path: ../lib/configuration-profiles/ios-restrictions.mobileconfig
       - path: ../lib/configuration-profiles/ios-passcode-settings-ddm.json
       - path: ../lib/configuration-profiles/ios-lock-screen-message.mobileconfig
       - path: ../lib/configuration-profiles/ios-content-filtering.mobileconfig
-  macos_setup:
-    bootstrap_package: ""
-    enable_end_user_authentication: true
-    macos_setup_assistant: null
-  macos_updates:
-    deadline: ""
-    minimum_version: ""
-  windows_settings:
-    custom_settings: null
-  windows_updates:
-    deadline_days: 7
-    grace_period_days: 2
-  scripts: []
-policies: []
-queries: []
+  scripts:
+policies:
+queries:
+software:
diff --git a/it-and-security/teams/compliance-exclusions.yml b/it-and-security/teams/compliance-exclusions.yml
new file mode 100644
index 000000000000..fde00d1aeacb
--- /dev/null
+++ b/it-and-security/teams/compliance-exclusions.yml
@@ -0,0 +1,33 @@
+name: Compliance exclusions
+team_settings:
+  features:
+    enable_host_users: true
+    enable_software_inventory: true
+  host_expiry_settings:
+    host_expiry_enabled: false
+    host_expiry_window: 0
+  secrets:
+    - secret: $DOGFOOD_COMPLIANCE_EXCLUSIONS_ENROLL_SECRET
+agent_options:
+  config:
+    decorators:
+      load:
+        - SELECT uuid AS host_uuid FROM system_info;
+        - SELECT hostname AS hostname FROM system_info;
+    options:
+      disable_distributed: false
+      distributed_interval: 10
+      distributed_plugin: tls
+      distributed_tls_max_attempts: 3
+      logger_tls_endpoint: /api/osquery/log
+      logger_tls_period: 10
+      pack_delimiter: /
+  update_channels:
+    # We want to use these hosts to smoke test edge releases.
+    osqueryd: edge
+    orbit: edge
+    desktop: edge
+controls:
+policies:
+queries:
+software:
diff --git a/it-and-security/teams/explore-data.yml b/it-and-security/teams/explore-data.yml
index abea724c2acd..eecc64965d06 100644
--- a/it-and-security/teams/explore-data.yml
+++ b/it-and-security/teams/explore-data.yml
@@ -41,3 +41,4 @@ controls:
 policies:
 queries:
   - path: ../lib/explore-data.queries.yml
+software:
diff --git a/it-and-security/teams/servers-canary.yml b/it-and-security/teams/servers-canary.yml
index 4911176def37..e324a8ab4d58 100644
--- a/it-and-security/teams/servers-canary.yml
+++ b/it-and-security/teams/servers-canary.yml
@@ -29,3 +29,4 @@ controls:
   scripts:
 policies:
 queries:
+software:
diff --git a/it-and-security/teams/servers.yml b/it-and-security/teams/servers.yml
index c43085a6951f..5d9e4586a6c0 100644
--- a/it-and-security/teams/servers.yml
+++ b/it-and-security/teams/servers.yml
@@ -29,3 +29,4 @@ controls:
   scripts:
 policies:
 queries:
+software:
diff --git a/it-and-security/teams/workstations-canary.yml b/it-and-security/teams/workstations-canary.yml
index 73f280909dbf..518b32d94e94 100644
--- a/it-and-security/teams/workstations-canary.yml
+++ b/it-and-security/teams/workstations-canary.yml
@@ -65,7 +65,6 @@ controls:
   enable_disk_encryption: true
   macos_settings:
     custom_settings:
-      - path: ../lib/configuration-profiles/macos-automatic-updates.mobileconfig
       - path: ../lib/configuration-profiles/macos-chrome-enrollment.mobileconfig
       - path: ../lib/configuration-profiles/macos-date-time.mobileconfig
       - path: ../lib/configuration-profiles/macos-disable-bluetooth-file-sharing.mobileconfig
@@ -93,10 +92,13 @@ controls:
     enable_end_user_authentication: true
     macos_setup_assistant: null
   macos_updates:
-    deadline: ""
-    minimum_version: ""
+    deadline: "2024-08-23"
+    minimum_version: "14.6.1"
   windows_settings:
-    custom_settings: null
+    custom_settings:
+      - path: ../lib/configuration-profiles/windows-firewall.xml
+      - path: ../lib/configuration-profiles/windows-password.xml
+      - path: ../lib/configuration-profiles/windows-screen-lock.xml
   windows_updates:
     deadline_days: 7
     grace_period_days: 2
@@ -129,7 +131,7 @@ policies:
     platform: darwin
     calendar_events_enabled: false
   - name: macOS - System maintenance complete
-    query: SELECT 1 AS result FROM system_info WHERE computer_name NOT IN ('Titanosauria', 'Drew’s MacBook Pro','fleetwoodmike','Anthony’s MacBook Pro','Patricia’s MacBook Pro','Paul’s MacBook Pro','Tom’s MacBook Air');
+    query: SELECT 1 AS result FROM system_info WHERE computer_name NOT IN ('Drew’s MacBook Pro','Anthony’s MacBook Pro','Patricia’s MacBook Pro','Paul’s MacBook Pro','Tom’s MacBook Air');
     critical: false
     description: Determines if the device has completed system maintenance.
     resolution: We will perform system maintenance on your device.
@@ -142,3 +144,5 @@ queries:
   - path: ../lib/collect-vs-code-extensions.queries.yml
   - path: ../lib/collect-software-permissions-system.queries.yml
   - path: ../lib/collect-software-permissions-user.queries.yml
+  - path: ../lib/collect-crowdstrike-info.queries.yml
+software:
diff --git a/it-and-security/teams/workstations.yml b/it-and-security/teams/workstations.yml
index 81d2d0d9e8b2..79dd914a7bb9 100644
--- a/it-and-security/teams/workstations.yml
+++ b/it-and-security/teams/workstations.yml
@@ -18,7 +18,6 @@ controls:
   enable_disk_encryption: true
   macos_settings:
     custom_settings:
-      - path: ../lib/configuration-profiles/macos-automatic-updates.mobileconfig
       - path: ../lib/configuration-profiles/macos-date-time.mobileconfig
       - path: ../lib/configuration-profiles/macos-chrome-enrollment.mobileconfig
       - path: ../lib/configuration-profiles/macos-disable-bluetooth-file-sharing.mobileconfig
@@ -44,8 +43,8 @@ controls:
     enable_end_user_authentication: true
     macos_setup_assistant: null
   macos_updates:
-    deadline: "2024-07-12"
-    minimum_version: "14.5"
+    deadline: "2024-08-23"
+    minimum_version: "14.6.1"
   windows_settings:
     custom_settings: null
   windows_updates:
@@ -55,6 +54,7 @@ controls:
     - path: ../lib/collect-fleetd-logs.sh
     - path: ../lib/macos-see-automatic-enrollment-profile.sh
     - path: ../lib/macos-remove-old-nudge.sh
+    - path: ../lib/install-update-homebrew.sh
     - path: ../lib/windows-remove-fleetd.ps1
     - path: ../lib/windows-turn-off-mdm.ps1
 policies:
@@ -74,4 +74,9 @@ queries:
     interval: 300
     automations_enabled: false
     observer_can_run: true
-
+software:
+  packages:
+    - url: https://zoom.us/client/latest/Zoom.pkg?archType=arm64
+      pre_install_query:
+        path: ../lib/macos-check-if-apple-silicon.queries.yml
+      self_service: true
diff --git a/orbit/CHANGELOG.md b/orbit/CHANGELOG.md
index 1aa588e1ece9..1d11365182eb 100644
--- a/orbit/CHANGELOG.md
+++ b/orbit/CHANGELOG.md
@@ -1,3 +1,44 @@
+## Orbit 1.32.0 (Aug 29, 2024)
+
+* Bumped macadmins extension to use SOFA feed sofafeed.macadmins.io
+
+* Fixed Fleet Desktop to refresh host status when the user clicks on "My Device" or "Self-service" dropdown option.
+
+* Updated go to go1.22.6
+
+* Added ability for MDM migrations if the host is manually enrolled to a 3rd party MDM.
+
+* Fixed a formatting error when an unrecognized error happens during BitLocker encryption.
+
+## Orbit 1.31.0 (Aug 19, 2024)
+
+* Fixed an issue that would display a disk encryption modal with MDM configured and FileVault enabled if the user hadn't escrowed the key in the past.
+
+## Orbit 1.30.0 (Aug 05, 2024)
+
+* Use Escrow Buddy to rotate FileVault keys on macOS
+
+## Orbit 1.29.0 (Jul 24, 2024)
+
+* Fixed a startup bug by performing an early restart of orbit if an agent options setting has changed.
+* Implemented a small refactor of orbit subsystems.
+
+## Orbit 1.28.0 (Jul 18, 2024)
+
+* Hid "Self-service" in Fleet Desktop and My device page if there is no self-service software available.
+
+* Fixed a bug that caused log Orbit's osquery table log output to be inconsistent.
+
+* Added support for new agent option `script_execution_timeout` to configure seconds until a script is killed due to timeout.
+
+* Updated Go version to go1.22.4.
+
+* Fixed boot loop caused by Linux hosts with no hardware UUID.
+
+* Added support for Linux ARM64.
+
+* Fixed bug where UTC timezone could cause error in `fleetd_logs` table time parsing.
+
 ## Orbit 1.27.0 (Jun 21, 2024)
 
 * Disabled `mdm_bridge` table on Windows Server.
diff --git a/orbit/README.md b/orbit/README.md
index 1a55fc263e63..6fc1f75d1eef 100644
--- a/orbit/README.md
+++ b/orbit/README.md
@@ -16,6 +16,7 @@ For reference, here are the build configuration files:
 - [Goreleaser github workflow](../.github/workflows/goreleaser-orbit.yml)
 - Goreleaser configuration file for each platform:
     - [goreleaser-linux.yml](./goreleaser-linux.yml)
+    - [goreleaser-linux-arm64.yml](./goreleaser-linux-arm64.yml)
     - [goreleaser-macos.yml](./goreleaser-macos.yml)
     - [goreleaser-windows.yml](./goreleaser-windows.yml)
 
diff --git a/orbit/TUF.md b/orbit/TUF.md
index 741df8f4bade..727e5f34b60d 100644
--- a/orbit/TUF.md
+++ b/orbit/TUF.md
@@ -5,20 +5,22 @@ Following are the currently deployed versions of fleetd components on the `stabl
 
 ## `stable`
 
-| Component\OS |    macOS     | Linux  | Windows |
-|--------------|--------------|--------|---------|
-| orbit        | 1.27.0       | 1.27.0 | 1.27.0  |
-| desktop      | 1.27.0       | 1.27.0 | 1.27.0  |
-| osqueryd     | 5.12.1       | 5.12.1 | 5.12.1  |
-| nudge        | 1.1.10.81462 | -      | -       |
-| swiftDialog  | 2.1.0        | -      | -       |
+| Component\OS |    macOS     | Linux  | Windows | Linux (arm64) |
+|--------------|--------------|--------|---------|---------------|
+| orbit        | 1.32.0       | 1.32.0 | 1.32.0  | 1.32.0        |
+| desktop      | 1.32.0       | 1.32.0 | 1.32.0  | 1.32.0        |
+| osqueryd     | 5.13.1       | 5.13.1 | 5.13.1  | 5.13.1        |
+| nudge        | 1.1.10.81462 | -      | -       | -             |
+| swiftDialog  | 2.1.0        | -      | -       | -             |
+| escrowBuddy  | 1.0.0        | -      | -       | -             |
 
 ## `edge`
 
-| Component\OS | macOS  | Linux  | Windows |
-|--------------|--------|--------|---------|
-| orbit        | 1.27.0 | 1.27.0 | 1.27.0  |
-| desktop      | 1.27.0 | 1.27.0 | 1.27.0  |
-| osqueryd     | 5.12.2 | 5.12.2 | 5.12.2  |
-| nudge        | -      | -      | -       |
-| swiftDialog  | -      | -      | -       |
+| Component\OS | macOS  | Linux  | Windows | Linux (arm64) |
+|--------------|--------|--------|---------|---------------|
+| orbit        | 1.32.0 | 1.32.0 | 1.32.0  | 1.32.0        |
+| desktop      | 1.32.0 | 1.32.0 | 1.32.0  | 1.32.0        |
+| osqueryd     | 5.13.1 | 5.13.1 | 5.13.1  | 5.13.1        |
+| nudge        | -      | -      | -       | -             |
+| swiftDialog  | -      | -      | -       | -             |
+| escrowBuddy  | -      | -      | -       | -             |
diff --git a/orbit/changes/19844-update-go b/orbit/changes/19844-update-go
deleted file mode 100644
index 7de847f94418..000000000000
--- a/orbit/changes/19844-update-go
+++ /dev/null
@@ -1 +0,0 @@
-* Updated Go version to go1.22.4
diff --git a/orbit/changes/19886-use-zerolog b/orbit/changes/19886-use-zerolog
deleted file mode 100644
index 89f8d39811c4..000000000000
--- a/orbit/changes/19886-use-zerolog
+++ /dev/null
@@ -1 +0,0 @@
-- Fixes a bug that caused log Orbit's osquery table log output to be inconsistent.
\ No newline at end of file
diff --git a/orbit/changes/20168-linux-uuid-check b/orbit/changes/20168-linux-uuid-check
deleted file mode 100644
index af5d7621dd2c..000000000000
--- a/orbit/changes/20168-linux-uuid-check
+++ /dev/null
@@ -1 +0,0 @@
-- Fix boot loop caused by Linux hosts with no hardware UUID
diff --git a/orbit/changes/update-go1.23.1 b/orbit/changes/update-go1.23.1
new file mode 100644
index 000000000000..d9a689e4e905
--- /dev/null
+++ b/orbit/changes/update-go1.23.1
@@ -0,0 +1,2 @@
+* Updated Go to go1.23.1
+
diff --git a/orbit/cmd/desktop/desktop.go b/orbit/cmd/desktop/desktop.go
index b42393606123..89915c8f4a5a 100644
--- a/orbit/cmd/desktop/desktop.go
+++ b/orbit/cmd/desktop/desktop.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"context"
 	_ "embed"
 	"errors"
 	"fmt"
@@ -12,6 +13,7 @@ import (
 	"fyne.io/systray"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/constant"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/go-paniclog"
+	"github.com/fleetdm/fleet/v4/orbit/pkg/migration"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/profiles"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/token"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/update"
@@ -59,6 +61,11 @@ func setupRunners() {
 }
 
 func main() {
+	// FIXME: we need to do a better job of graceful shutdown, releasing resources, stopping
+	// tickers, etc. (https://github.com/fleetdm/fleet/issues/21256)
+	// This context will be used as a general context to handle graceful shutdown in the future.
+	offlineWatcherCtx, cancelOfflineWatcherCtx := context.WithCancel(context.Background())
+
 	// Orbits uses --version to get the fleet-desktop version. Logs do not need to be set up when running this.
 	if len(os.Args) > 1 && os.Args[1] == "--version" {
 		// Must work with update.GetVersion
@@ -105,6 +112,15 @@ func main() {
 	go setupRunners()
 
 	var mdmMigrator useraction.MDMMigrator
+	// swiftDialogCh is a channel shared by the migrator and the offline watcher to
+	// coordinate the display of the dialog and ensure only one dialog is shown at a time.
+	var swiftDialogCh chan struct{}
+	var offlineWatcher useraction.MDMOfflineWatcher
+
+	// This ticker is used for fetching the desktop summary. It is initialized here because it is
+	// stopped in `OnExit.`
+	const checkInterval = 5 * time.Minute
+	summaryTicker := time.NewTicker(checkInterval)
 
 	onReady := func() {
 		log.Info().Msg("ready")
@@ -157,6 +173,7 @@ func main() {
 		if err != nil {
 			log.Fatal().Err(err).Msg("unable to initialize request client")
 		}
+
 		client.WithInvalidTokenRetry(func() string {
 			log.Debug().Msg("refetching token from disk for API retry")
 			newToken, err := tokenReader.Read()
@@ -168,13 +185,6 @@ func main() {
 			return newToken
 		})
 
-		refetchToken := func() {
-			if _, err := tokenReader.Read(); err != nil {
-				log.Error().Err(err).Msg("refetch token")
-			}
-			log.Debug().Msg("successfully refetched the token from disk")
-		}
-
 		disableTray := func() {
 			log.Debug().Msg("disabling tray items")
 			myDeviceItem.SetTitle("Connecting...")
@@ -186,6 +196,44 @@ func main() {
 			migrateMDMItem.Hide()
 		}
 
+		reportError := func(err error, info map[string]any) {
+			if !client.GetServerCapabilities().Has(fleet.CapabilityErrorReporting) {
+				log.Info().Msg("skipped reporting error to the server as it doesn't have the capability enabled")
+				return
+			}
+
+			fleetdErr := fleet.FleetdError{
+				ErrorSource:         "fleet-desktop",
+				ErrorSourceVersion:  version,
+				ErrorTimestamp:      time.Now(),
+				ErrorMessage:        err.Error(),
+				ErrorAdditionalInfo: info,
+			}
+
+			if err := client.ReportError(tokenReader.GetCached(), fleetdErr); err != nil {
+				log.Error().Err(err).EmbedObject(fleetdErr).Msg("reporting error to Fleet server")
+			}
+		}
+
+		if runtime.GOOS == "darwin" {
+			m, s, o, err := mdmMigrationSetup(offlineWatcherCtx, tufUpdateRoot, fleetURL, client, &tokenReader)
+			if err != nil {
+				go reportError(err, nil)
+				log.Error().Err(err).Msg("setting up MDM migration resources")
+			}
+
+			mdmMigrator = m
+			swiftDialogCh = s
+			offlineWatcher = o
+		}
+
+		refetchToken := func() {
+			if _, err := tokenReader.Read(); err != nil {
+				log.Error().Err(err).Msg("refetch token")
+			}
+			log.Debug().Msg("successfully refetched the token from disk")
+		}
+
 		// checkToken performs API test calls to enable the "My device" item as
 		// soon as the device auth token is registered by Fleet.
 		checkToken := func() <-chan interface{} {
@@ -246,50 +294,15 @@ func main() {
 			}
 		}()
 
-		if runtime.GOOS == "darwin" {
-			_, swiftDialogPath, _ := update.LocalTargetPaths(
-				tufUpdateRoot,
-				"swiftDialog",
-				update.SwiftDialogMacOSTarget,
-			)
-			mdmMigrator = useraction.NewMDMMigrator(
-				swiftDialogPath,
-				15*time.Minute,
-				&mdmMigrationHandler{
-					client:      client,
-					tokenReader: &tokenReader,
-				},
-			)
-		}
-
-		reportError := func(err error, info map[string]any) {
-			if !client.GetServerCapabilities().Has(fleet.CapabilityErrorReporting) {
-				log.Info().Msg("skipped reporting error to the server as it doesn't have the capability enabled")
-				return
-			}
-
-			fleetdErr := fleet.FleetdError{
-				ErrorSource:         "fleet-desktop",
-				ErrorSourceVersion:  version,
-				ErrorTimestamp:      time.Now(),
-				ErrorMessage:        err.Error(),
-				ErrorAdditionalInfo: info,
-			}
-
-			if err := client.ReportError(tokenReader.GetCached(), fleetdErr); err != nil {
-				log.Error().Err(err).EmbedObject(fleetdErr).Msg("reporting error to Fleet server")
-			}
-		}
-
 		// poll the server to check the policy status of the host and update the
 		// tray icon accordingly
 		go func() {
 			<-deviceEnabledChan
-			tic := time.NewTicker(5 * time.Minute)
-			defer tic.Stop()
 
 			for {
-				<-tic.C
+				<-summaryTicker.C
+				// Reset the ticker to the intended interval, in case we reset it to 1ms
+				summaryTicker.Reset(checkInterval)
 				sum, err := client.DesktopSummary(tokenReader.GetCached())
 				switch {
 				case err == nil:
@@ -306,42 +319,22 @@ func main() {
 					continue
 				}
 
-				// Check for null for backward compatibility with an old Fleet server
-				if sum.SelfService != nil && !*sum.SelfService {
-					selfServiceItem.Disable()
-					selfServiceItem.Hide()
-				} else {
-					selfServiceItem.Enable()
-					selfServiceItem.Show()
-				}
-
-				failingPolicies := 0
-				if sum.FailingPolicies != nil {
-					failingPolicies = int(*sum.FailingPolicies)
-				}
+				refreshMenuItems(sum.DesktopSummary, selfServiceItem, myDeviceItem)
+				myDeviceItem.Enable()
 
-				if failingPolicies > 0 {
-					if runtime.GOOS == "windows" {
-						// Windows (or maybe just the systray library?) doesn't support color emoji
-						// in the system tray menu, so we use text as an alternative.
-						if failingPolicies == 1 {
-							myDeviceItem.SetTitle("My device (1 issue)")
-						} else {
-							myDeviceItem.SetTitle(fmt.Sprintf("My device (%d issues)", failingPolicies))
-						}
-					} else {
-						myDeviceItem.SetTitle(fmt.Sprintf("🔴 My device (%d)", failingPolicies))
-					}
-				} else {
-					if runtime.GOOS == "windows" {
-						myDeviceItem.SetTitle("My device")
-					} else {
-						myDeviceItem.SetTitle("🟢 My device")
+				// Check our file to see if we should migrate
+				var migrationType string
+				if runtime.GOOS == "darwin" {
+					migrationType, err = mdmMigrator.MigrationInProgress()
+					if err != nil {
+						go reportError(err, nil)
+						log.Error().Err(err).Msg("checking if MDM migration is in progress")
 					}
 				}
-				myDeviceItem.Enable()
 
-				shouldRunMigrator := sum.Notifications.NeedsMDMMigration || sum.Notifications.RenewEnrollmentProfile
+				migrationInProgress := migrationType != ""
+
+				shouldRunMigrator := sum.Notifications.NeedsMDMMigration || sum.Notifications.RenewEnrollmentProfile || migrationInProgress
 
 				if runtime.GOOS == "darwin" && shouldRunMigrator && mdmMigrator.CanRun() {
 					enrolled, enrollURL, err := profiles.IsEnrolledInMDM()
@@ -376,18 +369,28 @@ func main() {
 						})
 
 						// enable tray items
-						migrateMDMItem.Enable()
-						migrateMDMItem.Show()
+						if migrationType != constant.MDMMigrationTypeADE {
+							migrateMDMItem.Enable()
+							migrateMDMItem.Show()
+						}
 
 						// if the device is unmanaged or we're in force mode and the device needs
 						// migration, enable aggressive mode.
-						if isUnmanaged || forceModeEnabled {
+						if isUnmanaged || forceModeEnabled || migrationInProgress {
 							log.Info().Msg("MDM device is unmanaged or force mode enabled, automatically showing dialog")
 							if err := mdmMigrator.ShowInterval(); err != nil {
 								go reportError(err, nil)
 								log.Error().Err(err).Msg("showing MDM migration dialog at interval")
 							}
 						}
+					} else {
+						// we're done with the migration, so mark it as complete.
+						if err := mdmMigrator.MarkMigrationCompleted(); err != nil {
+							go reportError(err, nil)
+							log.Error().Err(err).Msg("failed to mark MDM migration as completed")
+						}
+						migrateMDMItem.Disable()
+						migrateMDMItem.Hide()
 					}
 				} else {
 					migrateMDMItem.Disable()
@@ -404,6 +407,8 @@ func main() {
 					if err := open.Browser(openURL); err != nil {
 						log.Error().Err(err).Str("url", openURL).Msg("open browser my device")
 					}
+					// Also refresh the device status by forcing the polling ticker to fire
+					summaryTicker.Reset(1 * time.Millisecond)
 				case <-transparencyItem.ClickedCh:
 					openURL := client.BrowserTransparencyURL(tokenReader.GetCached())
 					if err := open.Browser(openURL); err != nil {
@@ -414,7 +419,13 @@ func main() {
 					if err := open.Browser(openURL); err != nil {
 						log.Error().Err(err).Str("url", openURL).Msg("open browser self-service")
 					}
+					// Also refresh the device status by forcing the polling ticker to fire
+					summaryTicker.Reset(1 * time.Millisecond)
 				case <-migrateMDMItem.ClickedCh:
+					if offline := offlineWatcher.ShowIfOffline(offlineWatcherCtx); offline {
+						continue
+					}
+
 					if err := mdmMigrator.Show(); err != nil {
 						go reportError(err, nil)
 						log.Error().Err(err).Msg("showing MDM migration dialog on user action")
@@ -423,16 +434,60 @@ func main() {
 			}
 		}()
 	}
+
+	// FIXME: it doesn't look like this is actually triggering, at least when desktop gets
+	// killed (https://github.com/fleetdm/fleet/issues/21256)
 	onExit := func() {
+		log.Info().Msg("exit")
 		if mdmMigrator != nil {
 			mdmMigrator.Exit()
 		}
-		log.Info().Msg("exit")
+		if swiftDialogCh != nil {
+			close(swiftDialogCh)
+		}
+		summaryTicker.Stop()
+		cancelOfflineWatcherCtx()
 	}
 
 	systray.Run(onReady, onExit)
 }
 
+func refreshMenuItems(sum fleet.DesktopSummary, selfServiceItem *systray.MenuItem, myDeviceItem *systray.MenuItem) {
+	// Check for null for backward compatibility with an old Fleet server
+	if sum.SelfService != nil && !*sum.SelfService {
+		selfServiceItem.Disable()
+		selfServiceItem.Hide()
+	} else {
+		selfServiceItem.Enable()
+		selfServiceItem.Show()
+	}
+
+	failingPolicies := 0
+	if sum.FailingPolicies != nil {
+		failingPolicies = int(*sum.FailingPolicies)
+	}
+
+	if failingPolicies > 0 {
+		if runtime.GOOS == "windows" {
+			// Windows (or maybe just the systray library?) doesn't support color emoji
+			// in the system tray menu, so we use text as an alternative.
+			if failingPolicies == 1 {
+				myDeviceItem.SetTitle("My device (1 issue)")
+			} else {
+				myDeviceItem.SetTitle(fmt.Sprintf("My device (%d issues)", failingPolicies))
+			}
+		} else {
+			myDeviceItem.SetTitle(fmt.Sprintf("🔴 My device (%d)", failingPolicies))
+		}
+	} else {
+		if runtime.GOOS == "windows" {
+			myDeviceItem.SetTitle("My device")
+		} else {
+			myDeviceItem.SetTitle("🟢 My device")
+		}
+	}
+}
+
 type mdmMigrationHandler struct {
 	client      *service.DeviceClient
 	tokenReader *token.Reader
@@ -563,3 +618,36 @@ func logDir() (string, error) {
 
 	return dir, nil
 }
+
+func mdmMigrationSetup(ctx context.Context, tufUpdateRoot, fleetURL string, client *service.DeviceClient, tokenReader *token.Reader) (useraction.MDMMigrator, chan struct{}, useraction.MDMOfflineWatcher, error) {
+	dir, err := migration.Dir()
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	mrw := migration.NewReadWriter(dir, constant.MigrationFileName)
+
+	// we use channel buffer size of 1 to allow one dialog at a time with non-blocking sends.
+	swiftDialogCh := make(chan struct{}, 1)
+
+	_, swiftDialogPath, _ := update.LocalTargetPaths(
+		tufUpdateRoot,
+		"swiftDialog",
+		update.SwiftDialogMacOSTarget,
+	)
+	mdmMigrator := useraction.NewMDMMigrator(
+		swiftDialogPath,
+		15*time.Minute,
+		&mdmMigrationHandler{
+			client:      client,
+			tokenReader: tokenReader,
+		},
+		mrw,
+		fleetURL,
+		swiftDialogCh,
+	)
+
+	offlineWatcher := useraction.StartMDMMigrationOfflineWatcher(ctx, client, swiftDialogPath, swiftDialogCh, migration.FileWatcher(mrw))
+
+	return mdmMigrator, swiftDialogCh, offlineWatcher, nil
+}
diff --git a/orbit/cmd/orbit/orbit.go b/orbit/cmd/orbit/orbit.go
index 8a962b56d2b7..334d69be85ed 100644
--- a/orbit/cmd/orbit/orbit.go
+++ b/orbit/cmd/orbit/orbit.go
@@ -431,7 +431,11 @@ func main() {
 			case "windows":
 				opt.Targets["desktop"] = update.DesktopWindowsTarget
 			case "linux":
-				opt.Targets["desktop"] = update.DesktopLinuxTarget
+				if runtime.GOARCH == "arm64" {
+					opt.Targets["desktop"] = update.DesktopLinuxArm64Target
+				} else {
+					opt.Targets["desktop"] = update.DesktopLinuxTarget
+				}
 			default:
 				log.Fatal().Str("GOOS", runtime.GOOS).Msg("unsupported GOOS for desktop target")
 			}
@@ -459,10 +463,12 @@ func main() {
 		// Setting up the system service management early on the process lifetime
 		appDoneCh = make(chan struct{})
 
-		// Initializing service runner and system service manager
-		systemChecker := newSystemChecker()
-		g.Add(systemChecker.Execute, systemChecker.Interrupt)
-		go osservice.SetupServiceManagement(constant.SystemServiceName, systemChecker.svcInterruptCh, appDoneCh)
+		// Initializing windows service runner and system service manager.
+		if runtime.GOOS == "windows" {
+			systemChecker := newSystemChecker()
+			addSubsystem(&g, "system checker", systemChecker)
+			go osservice.SetupServiceManagement(constant.SystemServiceName, systemChecker.svcInterruptCh, appDoneCh)
+		}
 
 		// sofwareupdated is a macOS daemon that automatically updates Apple software.
 		if c.Bool("disable-kickstart-softwareupdated") && runtime.GOOS == "darwin" {
@@ -533,7 +539,7 @@ func main() {
 				return nil
 			}
 
-			g.Add(updateRunner.Execute, updateRunner.Interrupt)
+			addSubsystem(&g, "update runner", updateRunner)
 
 			// if getting any of the targets fails, keep on
 			// retrying, the `updater.Get` method has built-in backoff functionality.
@@ -712,8 +718,8 @@ func main() {
 				return fmt.Errorf("create TLS proxy: %w", err)
 			}
 
-			g.Add(
-				func() error {
+			addSubsystem(&g, "insecure proxy", &wrapSubsystem{
+				execute: func() error {
 					log.Info().
 						Str("addr", fmt.Sprintf("localhost:%d", proxy.Port)).
 						Str("target", c.String("fleet-url")).
@@ -721,12 +727,12 @@ func main() {
 					err := proxy.InsecureServeTLS()
 					return err
 				},
-				func(error) {
+				interrupt: func(err error) {
 					if err := proxy.Close(); err != nil {
 						log.Error().Err(err).Msg("close proxy")
 					}
 				},
-			)
+			})
 
 			// Directory to store proxy related assets
 			proxyDirectory := filepath.Join(c.String("root-dir"), "proxy")
@@ -845,12 +851,11 @@ func main() {
 		// create the notifications middleware that wraps the orbit client
 		// (must be shared by all runners that use a ConfigFetcher).
 		const (
-			renewEnrollmentProfileCommandFrequency = time.Hour
+			renewEnrollmentProfileCommandFrequency = 3 * time.Minute
 			windowsMDMEnrollmentCommandFrequency   = time.Hour
 			windowsMDMBitlockerCommandFrequency    = time.Hour
 		)
 
-		orbitClient.RegisterConfigReceiver(update.ApplyRenewEnrollmentProfileConfigFetcherMiddleware(orbitClient, renewEnrollmentProfileCommandFrequency, fleetURL))
 		scriptConfigReceiver, scriptsEnabledFn := update.ApplyRunScriptsConfigFetcherMiddleware(
 			c.Bool("enable-scripts"), orbitClient,
 		)
@@ -858,22 +863,22 @@ func main() {
 
 		switch runtime.GOOS {
 		case "darwin":
-			// add middleware to handle nudge installation and updates
+			orbitClient.RegisterConfigReceiver(update.ApplyRenewEnrollmentProfileConfigFetcherMiddleware(
+				orbitClient, renewEnrollmentProfileCommandFrequency, fleetURL))
 			const nudgeLaunchInterval = 30 * time.Minute
 			orbitClient.RegisterConfigReceiver(update.ApplyNudgeConfigReceiverMiddleware(update.NudgeConfigFetcherOptions{
 				UpdateRunner: updateRunner, RootDir: c.String("root-dir"), Interval: nudgeLaunchInterval,
 			}))
-			orbitClient.RegisterConfigReceiver(update.ApplyDiskEncryptionRunnerMiddleware())
 			orbitClient.RegisterConfigReceiver(update.ApplySwiftDialogDownloaderMiddleware(updateRunner))
 		case "windows":
 			orbitClient.RegisterConfigReceiver(update.ApplyWindowsMDMEnrollmentFetcherMiddleware(windowsMDMEnrollmentCommandFrequency, orbitHostInfo.HardwareUUID, orbitClient))
 			orbitClient.RegisterConfigReceiver(update.ApplyWindowsMDMBitlockerFetcherMiddleware(windowsMDMBitlockerCommandFrequency, orbitClient))
 		}
 
-		flagUpdateReciver := update.NewFlagReceiver(orbitClient.ReceiverUpdateCancelFunc, update.FlagUpdateOptions{
+		flagUpdateReceiver := update.NewFlagReceiver(orbitClient.TriggerOrbitRestart, update.FlagUpdateOptions{
 			RootDir: c.String("root-dir"),
 		})
-		orbitClient.RegisterConfigReceiver(flagUpdateReciver)
+		orbitClient.RegisterConfigReceiver(flagUpdateReceiver)
 
 		if !c.Bool("disable-updates") {
 			serverOverridesReceiver := newServerOverridesReceiver(
@@ -883,7 +888,7 @@ func main() {
 					DesktopPath:  desktopPath,
 				},
 				c.Bool("fleet-desktop"),
-				orbitClient.ReceiverUpdateCancelFunc,
+				orbitClient.TriggerOrbitRestart,
 			)
 
 			orbitClient.RegisterConfigReceiver(serverOverridesReceiver)
@@ -895,7 +900,7 @@ func main() {
 		if !c.Bool("disable-updates") || c.Bool("dev-mode") {
 			extRunner := update.NewExtensionConfigUpdateRunner(update.ExtensionUpdateOptions{
 				RootDir: c.String("root-dir"),
-			}, updateRunner, orbitClient.ReceiverUpdateCancelFunc)
+			}, updateRunner, orbitClient.TriggerOrbitRestart)
 
 			// call UpdateAction on the updateRunner after we have fetched extensions from Fleet
 			_, err := updateRunner.UpdateAction()
@@ -926,11 +931,26 @@ func main() {
 			orbitClient.RegisterConfigReceiver(extRunner)
 		}
 
+		// Run a early check of fleetd configuration to check if orbit needs to
+		// restart before proceeding to start the sub-systems.
+		//
+		// E.g. the administrator has updated the following agent options for this device:
+		//	- `update_channels`
+		//	- `extensions` were removed/unset
+		//	- `command_line_flags` (osquery startup flags)
 		if err := orbitClient.RunConfigReceivers(); err != nil {
 			log.Error().Msgf("failed initial config fetch: %s", err)
+		} else {
+			if orbitClient.RestartTriggered() {
+				log.Info().Msg("exiting after early config fetch")
+				return nil
+			}
 		}
 
-		g.Add(orbitClient.ExecuteConfigReceivers, orbitClient.InterruptConfigReceivers)
+		addSubsystem(&g, "config receivers", &wrapSubsystem{
+			execute:   orbitClient.ExecuteConfigReceivers,
+			interrupt: orbitClient.InterruptConfigReceivers,
+		})
 
 		var trw *token.ReadWriter
 		if c.Bool("fleet-desktop") {
@@ -1079,7 +1099,7 @@ func main() {
 		if err != nil {
 			return fmt.Errorf("create osquery runner: %w", err)
 		}
-		g.Add(r.Execute, r.Interrupt)
+		addSubsystem(&g, "osqueryd runner", r)
 
 		// rootDir string, addr string, rootCA string, insecureSkipVerify bool, enrollSecret, uuid string
 		checkerClient, err := service.NewOrbitClient(
@@ -1105,7 +1125,7 @@ func main() {
 		capabilitiesChecker := newCapabilitiesChecker(checkerClient)
 		// We populate the known capabilities so that the capability checker does not need to do the initial check on startup.
 		checkerClient.GetServerCapabilities().Copy(orbitClient.GetServerCapabilities())
-		g.Add(capabilitiesChecker.actor())
+		addSubsystem(&g, "capabilities checker", capabilitiesChecker)
 
 		var desktopVersion string
 		if c.Bool("fleet-desktop") {
@@ -1156,7 +1176,7 @@ func main() {
 				c.String("fleet-desktop-alternative-browser-host"),
 				opt.RootDirectory,
 			)
-			g.Add(desktopRunner.actor())
+			addSubsystem(&g, "desktop runner", desktopRunner)
 		}
 
 		// --end-user-email is only supported on Windows and Linux (for macOS it gets the
@@ -1198,10 +1218,28 @@ func main() {
 		softwareRunner := installer.NewRunner(orbitClient, r.ExtensionSocketPath(), scriptsEnabledFn)
 		orbitClient.RegisterConfigReceiver(softwareRunner)
 
+		if runtime.GOOS == "darwin" {
+			log.Info().Msgf("orbitClient.GetServerCapabilities() %+v", orbitClient.GetServerCapabilities())
+			if orbitClient.GetServerCapabilities().Has(fleet.CapabilityEscrowBuddy) {
+				orbitClient.RegisterConfigReceiver(update.NewEscrowBuddyRunner(updateRunner, 5*time.Minute))
+			} else {
+				orbitClient.RegisterConfigReceiver(
+					update.ApplyDiskEncryptionRunnerMiddleware(
+						orbitClient.GetServerCapabilities,
+						orbitClient.TriggerOrbitRestart,
+					),
+				)
+			}
+		}
+
 		// Install a signal handler
 		ctx, cancel := context.WithCancel(context.Background())
 		defer cancel()
-		g.Add(signalHandler(ctx))
+		signalHandlerExecute, signalHandlerInterrupt := signalHandler(ctx)
+		addSubsystem(&g, "signal handler", &wrapSubsystem{
+			execute:   signalHandlerExecute,
+			interrupt: signalHandlerInterrupt,
+		})
 
 		go sigusrListener(c.String("root-dir"))
 
@@ -1308,7 +1346,7 @@ func getFleetdComponentPaths(
 
 func registerExtensionRunner(g *run.Group, extSockPath string, opts ...table.Opt) {
 	ext := table.NewRunner(extSockPath, opts...)
-	g.Add(ext.Execute, ext.Interrupt)
+	addSubsystem(g, "osqueryd extension runner", ext)
 }
 
 // desktopRunner runs the Fleet Desktop application.
@@ -1362,10 +1400,6 @@ func newDesktopRunner(
 	}
 }
 
-func (d *desktopRunner) actor() (func() error, func(error)) {
-	return d.execute, d.interrupt
-}
-
 // execute makes sure the fleet-desktop application is running.
 //
 // We have to support the scenario where the user closes its sessions (log out).
@@ -1375,7 +1409,7 @@ func (d *desktopRunner) actor() (func() error, func(error)) {
 // closes all its sessions).
 //
 // NOTE(lucas): This logic could be improved to detect if there's a valid session or not first.
-func (d *desktopRunner) execute() error {
+func (d *desktopRunner) Execute() error {
 	defer close(d.executeDoneCh)
 
 	log.Info().Msg("killing any pre-existing fleet-desktop instances")
@@ -1485,9 +1519,7 @@ func retry(d time.Duration, waitFirst bool, done chan struct{}, fn func() bool)
 	}
 }
 
-func (d *desktopRunner) interrupt(err error) {
-	log.Debug().Err(err).Msg("interrupt desktopRunner")
-
+func (d *desktopRunner) Interrupt(err error) {
 	close(d.interruptCh) // Signal execute to return.
 	<-d.executeDoneCh    // Wait for execute to return.
 
@@ -1600,7 +1632,6 @@ func (s *serviceChecker) Execute() error {
 }
 
 func (s *serviceChecker) Interrupt(err error) {
-	log.Error().Err(err).Msg("interrupt serviceChecker")
 	close(s.localInterruptCh) // Signal execute to return.
 }
 
@@ -1622,15 +1653,11 @@ func newCapabilitiesChecker(client *service.OrbitClient) *capabilitiesChecker {
 	}
 }
 
-func (f *capabilitiesChecker) actor() (func() error, func(error)) {
-	return f.execute, f.interrupt
-}
-
 // execute will poll the server for capabilities and emit a stop signal to restart
 // Orbit if certain capabilities are enabled.
 //
 // You need to add an explicit check for each capability you want to watch for
-func (f *capabilitiesChecker) execute() error {
+func (f *capabilitiesChecker) Execute() error {
 	defer close(f.executeDoneCh)
 	capabilitiesCheckTicker := time.NewTicker(5 * time.Minute)
 
@@ -1674,8 +1701,7 @@ func (f *capabilitiesChecker) execute() error {
 	}
 }
 
-func (f *capabilitiesChecker) interrupt(err error) {
-	log.Debug().Err(err).Msg("interrupt capabilitiesChecker")
+func (f *capabilitiesChecker) Interrupt(err error) {
 	close(f.interruptCh) // Signal execute to return.
 	<-f.executeDoneCh    // Wait for execute to return.
 }
@@ -1702,11 +1728,11 @@ func writeSecret(enrollSecret string, orbitRoot string) error {
 
 // serverOverridesRunner is a oklog.Group runner that polls for configuration overrides from Fleet.
 type serverOverridesRunner struct {
-	rootDir           string
-	fallbackCfg       fallbackServerOverridesConfig
-	desktopEnabled    bool
-	cancel            chan struct{}
-	queueOrbitRestart context.CancelFunc
+	rootDir             string
+	fallbackCfg         fallbackServerOverridesConfig
+	desktopEnabled      bool
+	cancel              chan struct{}
+	triggerOrbitRestart func(reason string)
 }
 
 // newServerOverridesReveiver creates a runner for updating server overrides configuration with values fetched from Fleet.
@@ -1714,14 +1740,14 @@ func newServerOverridesReceiver(
 	rootDir string,
 	fallbackCfg fallbackServerOverridesConfig,
 	desktopEnabled bool,
-	queueOrbitRestart context.CancelFunc,
+	triggerOrbitRestart func(reason string),
 ) *serverOverridesRunner {
 	return &serverOverridesRunner{
-		rootDir:           rootDir,
-		fallbackCfg:       fallbackCfg,
-		desktopEnabled:    desktopEnabled,
-		cancel:            make(chan struct{}),
-		queueOrbitRestart: queueOrbitRestart,
+		rootDir:             rootDir,
+		fallbackCfg:         fallbackCfg,
+		desktopEnabled:      desktopEnabled,
+		cancel:              make(chan struct{}),
+		triggerOrbitRestart: triggerOrbitRestart,
 	}
 }
 
@@ -1741,7 +1767,7 @@ func (r *serverOverridesRunner) Run(orbitCfg *fleet.OrbitConfig) error {
 		if err := r.updateServerOverrides(orbitCfg); err != nil {
 			return err
 		}
-		r.queueOrbitRestart()
+		r.triggerOrbitRestart("server overrides updated")
 		return nil
 	}
 
@@ -1849,3 +1875,42 @@ func loadServerOverrides(rootDir string) (*serverOverridesConfig, error) {
 	}
 	return &cfg, nil
 }
+
+// subSystem is an interface that implements the methods needed for oklog/run.Group.
+type subSystem interface {
+	// Execute partially implements the interface needed for oklog/run.Group.Add.
+	Execute() error
+	// Interrupt partially implements the interface needed for oklog/run.Group.Add.
+	Interrupt(err error)
+}
+
+// addSubsystem adds a new subsystem to the oklog/run.Group.
+func addSubsystem(g *run.Group, name string, s subSystem) {
+	g.Add(
+		func() error {
+			log.Debug().Msgf("start %s", name)
+
+			return s.Execute()
+		}, func(err error) {
+			log.Info().Err(err).Msgf("interrupt %s", name)
+
+			s.Interrupt(err)
+		},
+	)
+}
+
+// wrapSubsystem wraps functions to implement the subSystem interface.
+type wrapSubsystem struct {
+	execute   func() error
+	interrupt func(err error)
+}
+
+// Execute partially implements subSystem.
+func (w *wrapSubsystem) Execute() error {
+	return w.execute()
+}
+
+// Interrupt partially implements subSystem.
+func (w *wrapSubsystem) Interrupt(err error) {
+	w.interrupt(err)
+}
diff --git a/orbit/goreleaser-linux-arm64.yml b/orbit/goreleaser-linux-arm64.yml
new file mode 100644
index 000000000000..ddcd198034d2
--- /dev/null
+++ b/orbit/goreleaser-linux-arm64.yml
@@ -0,0 +1,37 @@
+project_name: orbit
+
+#################################################################################################
+# If this is updated make sure to update the "How to build from source" section in the README.md.
+#################################################################################################
+
+builds:
+  - id: orbit
+    dir: ./orbit/cmd/orbit/
+    binary: orbit
+    # NOTE: We tried building with CGO_ENABLED=1 but it caused failures
+    # in CI so for now we'll stick to building linux arm64 without cgo enabled.
+    goos:
+      - linux
+    goarch:
+      - arm64
+    flags:
+      - -trimpath
+    ldflags:
+      - -X github.com/fleetdm/fleet/v4/orbit/pkg/build.Version={{.Version}}
+      - -X github.com/fleetdm/fleet/v4/orbit/pkg/build.Commit={{.Commit}}
+      - -X github.com/fleetdm/fleet/v4/orbit/pkg/build.Date={{.Date}}
+
+archives:
+  - id: orbit
+    builds:
+      - orbit
+    name_template: orbit_{{.Version}}_{{.Os}}
+
+checksum:
+  name_template: 'checksums.txt'
+
+snapshot:
+  name_template: "{{ .Tag }}-untagged"
+
+changelog:
+  skip: true
diff --git a/orbit/pkg/bitlocker/bitlocker_management_windows.go b/orbit/pkg/bitlocker/bitlocker_management_windows.go
index 79a5791a49a2..4fe472d19f1f 100644
--- a/orbit/pkg/bitlocker/bitlocker_management_windows.go
+++ b/orbit/pkg/bitlocker/bitlocker_management_windows.go
@@ -85,7 +85,7 @@ func encryptErrHandler(val int32) error {
 	case ErrorCodeProtectorExists:
 		msg = "key protector cannot be added; only one key protector of this type is allowed for this drive"
 	default:
-		msg = "error code returned during encryption: %d"
+		msg = fmt.Sprintf("error code returned during encryption: %d", val)
 	}
 
 	return &EncryptionError{msg, val}
diff --git a/orbit/pkg/constant/constant.go b/orbit/pkg/constant/constant.go
index 8a11160e5b61..8f8e7e91e512 100644
--- a/orbit/pkg/constant/constant.go
+++ b/orbit/pkg/constant/constant.go
@@ -55,4 +55,17 @@ const (
 	// ServerOverridesFileName is the name of the file in the root directory
 	// that specifies the override configuration fetched from the server.
 	ServerOverridesFileName = "server-overrides.json"
+	// MigrationFileName is the name of the file used by fleetd to determine if the host is
+	// partially through an MDM migration.
+	MigrationFileName = "mdm_migration.txt"
+	// MDMMigrationTypeManual indicates that the MDM migration is for a manually enrolled host.
+	MDMMigrationTypeManual = "manual"
+	// MDMMigrationTypeADE indicates that the MDM migration is for an ADE enrolled host.
+	MDMMigrationTypeADE = "ade"
+	// MDMMigrationTypePreSonoma indicates that the MDM migration is for a host on a macOS version < 14.
+	MDMMigrationTypePreSonoma = "pre-sonoma"
+	// MDMMigrationOfflineWatcherInterval is the interval at which the offline watcher checks for
+	// the presence of the migration file.
+	MDMMigrationOfflineWatcherInterval = 3 * time.Minute
+	SonomaMajorVersion                 = 14
 )
diff --git a/orbit/pkg/migration/readwriter.go b/orbit/pkg/migration/readwriter.go
new file mode 100644
index 000000000000..08c7d3653757
--- /dev/null
+++ b/orbit/pkg/migration/readwriter.go
@@ -0,0 +1,157 @@
+package migration
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/fleetdm/fleet/v4/orbit/pkg/constant"
+)
+
+type ReadWriter struct {
+	Path     string
+	FileName string
+}
+
+func NewReadWriter(path, filename string) *ReadWriter {
+	return &ReadWriter{
+		Path:     path,
+		FileName: filepath.Join(path, filename),
+	}
+}
+
+// SetMigrationFile sets `typ` in the file used to track MDM migration type. This overwrites the
+// file if it exists.
+func (rw *ReadWriter) SetMigrationFile(typ string) error {
+	_, err := rw.read()
+	switch {
+	case err == nil:
+		// ensure the file is readable by other processes
+		if err := rw.setChmod(); err != nil {
+			return fmt.Errorf("loading migration file, chmod %q: %w", rw.Path, err)
+		}
+	case errors.Is(err, os.ErrNotExist):
+		if err := os.MkdirAll(rw.Path, constant.DefaultDirMode); err != nil {
+			return fmt.Errorf("creating directory for migration file: %w", err)
+		}
+		if err := os.WriteFile(rw.FileName, []byte(typ), constant.DefaultWorldReadableFileMode); err != nil {
+			return fmt.Errorf("writing migration file: %w", err)
+		}
+
+	default:
+		return fmt.Errorf("load migration file %q: %w", rw.Path, err)
+	}
+	return nil
+}
+
+// RemoveFile removes the file used for tracking the MDM migration type.
+func (rw *ReadWriter) RemoveFile() error {
+	if err := os.Remove(rw.FileName); err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			// that's ok, noop
+			return nil
+		}
+
+		return fmt.Errorf("removing migration file: %w", err)
+	}
+
+	return nil
+}
+
+// GetMigrationType returns the contents of the MDM migration file. The contents say what type of
+// migration it is.
+func (rw *ReadWriter) GetMigrationType() (string, error) {
+	data, err := rw.read()
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return "", nil
+		}
+
+		return "", err
+	}
+
+	return data, nil
+}
+
+// FileExists returns whether or not the MDM migration file exists on this host.
+func (rw *ReadWriter) FileExists() (bool, error) {
+	_, err := os.Stat(rw.FileName)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return false, nil
+		}
+
+		return false, err
+	}
+
+	return true, nil
+}
+
+// DirExists returns whether or not the directory where the MDM migration file is stored exists.
+func (rw *ReadWriter) DirExists() (bool, error) {
+	_, err := os.Stat(rw.FileName)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return false, nil
+		}
+
+		return false, err
+	}
+
+	return true, nil
+}
+
+func (rw *ReadWriter) read() (string, error) {
+	data, err := os.ReadFile(rw.FileName)
+	if err != nil {
+		return "", err
+	}
+
+	return string(data), nil
+}
+
+func (rw *ReadWriter) setChmod() error {
+	return os.Chmod(rw.FileName, constant.DefaultWorldReadableFileMode)
+}
+
+func (rw *ReadWriter) NewFileWatcher() FileWatcher {
+	return &fileWatcher{rw: rw}
+}
+
+type FileWatcher interface {
+	GetMigrationType() (string, error)
+	FileExists() (bool, error)
+	DirExists() (bool, error)
+}
+
+type fileWatcher struct {
+	rw *ReadWriter
+}
+
+// GetMigrationType returns the contents of the MDM migration file which indicate what type of
+// migration it is.
+func (r *fileWatcher) GetMigrationType() (string, error) {
+	return r.rw.GetMigrationType()
+}
+
+// FileExists returns whether or not the MDM migration file exists on this host.
+func (r *fileWatcher) FileExists() (bool, error) {
+	return r.rw.FileExists()
+}
+
+// DirExists returns whether or not the directory where the MDM migration file is stored exists.
+func (r *fileWatcher) DirExists() (bool, error) {
+	return r.rw.DirExists()
+}
+
+// Dir returns the path to the directory where the MDM migration file is stored. This path should be
+// ~/Library/Caches/com.fleetdm.orbit
+func Dir() (string, error) {
+	homedir, err := os.UserHomeDir()
+	if err != nil {
+		return "", fmt.Errorf("failed to get user's home directory: %w", err)
+	}
+
+	return filepath.Join(homedir, "Library/Caches/com.fleetdm.orbit"), nil
+}
diff --git a/orbit/pkg/osquery/osquery.go b/orbit/pkg/osquery/osquery.go
index 75340d4393b6..8b003d5bc8ec 100644
--- a/orbit/pkg/osquery/osquery.go
+++ b/orbit/pkg/osquery/osquery.go
@@ -25,9 +25,11 @@ type Runner struct {
 	proc        *process.Process
 	cmd         *exec.Cmd
 	dataPath    string
-	cancelMu    sync.Mutex
-	cancel      func()
 	singleQuery bool
+
+	ctxMu  sync.Mutex // protects the ctx and cancel
+	ctx    context.Context
+	cancel func()
 }
 
 type Option func(*Runner) error
@@ -164,9 +166,7 @@ func (r *Runner) Execute() error {
 			return fmt.Errorf("start osqueryd shell: %w", err)
 		}
 	} else {
-		ctx, cancel := context.WithCancel(context.Background())
-		defer cancel()
-		r.setCancel(cancel)
+		ctx, _ := r.getContextAndCancel()
 
 		if err := r.proc.Start(); err != nil {
 			return fmt.Errorf("start osqueryd: %w", err)
@@ -182,8 +182,7 @@ func (r *Runner) Execute() error {
 
 // Runner interrupts the running osquery process.
 func (r *Runner) Interrupt(err error) {
-	log.Error().Err(err).Msg("interrupt osquery")
-	if cancel := r.getCancel(); cancel != nil {
+	if _, cancel := r.getContextAndCancel(); cancel != nil {
 		cancel()
 	}
 }
@@ -199,16 +198,15 @@ func (r *Runner) ExtensionSocketPath() string {
 	return filepath.Join(r.dataPath, extensionSocketName)
 }
 
-func (r *Runner) setCancel(c func()) {
-	r.cancelMu.Lock()
-	defer r.cancelMu.Unlock()
-
-	r.cancel = c
-}
+func (r *Runner) getContextAndCancel() (context.Context, func()) {
+	r.ctxMu.Lock()
+	defer r.ctxMu.Unlock()
 
-func (r *Runner) getCancel() func() {
-	r.cancelMu.Lock()
-	defer r.cancelMu.Unlock()
-
-	return r.cancel
+	if r.ctx != nil {
+		return r.ctx, r.cancel
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	r.ctx = ctx
+	r.cancel = cancel
+	return r.ctx, r.cancel
 }
diff --git a/orbit/pkg/packaging/linux_shared.go b/orbit/pkg/packaging/linux_shared.go
index 8a1472a7f8e8..fd273f74c70a 100644
--- a/orbit/pkg/packaging/linux_shared.go
+++ b/orbit/pkg/packaging/linux_shared.go
@@ -36,11 +36,19 @@ func buildNFPM(opt Options, pkger nfpm.Packager) (string, error) {
 		return "", fmt.Errorf("create orbit dir: %w", err)
 	}
 
+	if opt.Architecture != ArchAmd64 && opt.Architecture != ArchArm64 {
+		return "", fmt.Errorf("Invalid architecture: %s", opt.Architecture)
+	}
+
 	// Initialize autoupdate metadata
 	updateOpt := update.DefaultOptions
 
 	updateOpt.RootDirectory = orbitRoot
-	updateOpt.Targets = update.LinuxTargets
+	if opt.Architecture == ArchArm64 {
+		updateOpt.Targets = update.LinuxArm64Targets
+	} else {
+		updateOpt.Targets = update.LinuxTargets
+	}
 	updateOpt.ServerCertificatePath = opt.UpdateTLSServerCertificate
 
 	if opt.UpdateTLSClientCertificate != "" {
@@ -52,7 +60,11 @@ func buildNFPM(opt Options, pkger nfpm.Packager) (string, error) {
 	}
 
 	if opt.Desktop {
-		updateOpt.Targets["desktop"] = update.DesktopLinuxTarget
+		if opt.Architecture == ArchArm64 {
+			updateOpt.Targets["desktop"] = update.DesktopLinuxArm64Target
+		} else {
+			updateOpt.Targets["desktop"] = update.DesktopLinuxTarget
+		}
 		// Override default channel with the provided value.
 		updateOpt.Targets.SetTargetChannel("desktop", opt.DesktopChannel)
 	}
@@ -157,7 +169,7 @@ func buildNFPM(opt Options, pkger nfpm.Packager) (string, error) {
 		},
 		// Symlink current into /opt/orbit/bin/orbit/orbit
 		&files.Content{
-			Source:      "/opt/orbit/bin/orbit/linux/" + opt.OrbitChannel + "/orbit",
+			Source:      "/opt/orbit/bin/orbit/" + updateOpt.Targets["orbit"].Platform + "/" + opt.OrbitChannel + "/orbit",
 			Destination: "/opt/orbit/bin/orbit/orbit",
 			Type:        "symlink",
 			FileInfo: &files.ContentFileInfo{
@@ -214,7 +226,7 @@ func buildNFPM(opt Options, pkger nfpm.Packager) (string, error) {
 		Name:        "fleet-osquery",
 		Version:     opt.Version,
 		Description: "Fleet osquery -- runtime and autoupdater",
-		Arch:        "amd64",
+		Arch:        opt.Architecture,
 		Maintainer:  "Fleet Device Management",
 		Vendor:      "Fleet Device Management",
 		License:     "https://github.com/fleetdm/fleet/blob/main/LICENSE",
diff --git a/orbit/pkg/packaging/packaging.go b/orbit/pkg/packaging/packaging.go
index fe3b576203d3..781c1c07cb5e 100644
--- a/orbit/pkg/packaging/packaging.go
+++ b/orbit/pkg/packaging/packaging.go
@@ -127,8 +127,15 @@ type Options struct {
 	// OsqueryDB is the directory to use for the osquery database.
 	// If not set, then the default is `$ORBIT_ROOT_DIR/osquery.db`.
 	OsqueryDB string
+	// Architecture that the package is being built for. (amd64, arm64)
+	Architecture string
 }
 
+const (
+	ArchAmd64 string = "amd64"
+	ArchArm64 string = "arm64"
+)
+
 func initializeTempDir() (string, error) {
 	// Initialize directories
 	tmpDir, err := os.MkdirTemp("", "orbit-package")
diff --git a/orbit/pkg/profiles/profiles_darwin.go b/orbit/pkg/profiles/profiles_darwin.go
index 93d197a5875b..8f4dd296f74f 100644
--- a/orbit/pkg/profiles/profiles_darwin.go
+++ b/orbit/pkg/profiles/profiles_darwin.go
@@ -127,6 +127,37 @@ func IsEnrolledInMDM() (bool, string, error) {
 	return true, enrollmentURL, nil
 }
 
+func IsManuallyEnrolledInMDM() (bool, error) {
+	out, err := getMDMInfoFromProfilesCmd()
+	if err != nil {
+		return false, fmt.Errorf("calling /usr/bin/profiles: %w", err)
+	}
+
+	// The output of the command is in the form:
+	//
+	// ```
+	// Enrolled via DEP: No
+	// MDM enrollment: Yes (User Approved)
+	// MDM server: https://test.example.com/mdm/apple/mdm
+	// ```
+	//
+	// If the host is not enrolled into an MDM, the last line is ommitted,
+	// so we need to check that:
+	//
+	// 1. We've got three rows
+	// 2. Whether the first line contains "Yes" or "No"
+	lines := bytes.Split(bytes.TrimSpace(out), []byte("\n"))
+	if len(lines) < 3 {
+		return false, nil
+	}
+
+	if strings.Contains(string(lines[0]), "Yes") {
+		return false, nil
+	}
+
+	return true, nil
+}
+
 // getMDMInfoFromProfilesCmd is declared as a variable so it can be overwritten by tests.
 var getMDMInfoFromProfilesCmd = func() ([]byte, error) {
 	cmd := exec.Command("/usr/bin/profiles", "status", "-type", "enrollment")
diff --git a/orbit/pkg/scripts/scripts.go b/orbit/pkg/scripts/scripts.go
index 08207c16ae56..d606efb49621 100644
--- a/orbit/pkg/scripts/scripts.go
+++ b/orbit/pkg/scripts/scripts.go
@@ -13,7 +13,6 @@ import (
 	"unicode/utf8"
 
 	"github.com/fleetdm/fleet/v4/orbit/pkg/constant"
-	"github.com/fleetdm/fleet/v4/pkg/scripts"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/rs/zerolog/log"
 )
@@ -31,6 +30,7 @@ type Client interface {
 type Runner struct {
 	Client                 Client
 	ScriptExecutionEnabled bool
+	ScriptExecutionTimeout time.Duration
 
 	// tempDirFn is the function to call to get the temporary directory to use,
 	// inside of which the script-specific subdirectories will be created. If nil,
@@ -114,7 +114,7 @@ func (r *Runner) runOne(script *fleet.HostScriptResult) (finalErr error) {
 		return fmt.Errorf("write script file: %w", err)
 	}
 
-	ctx, cancel := context.WithTimeout(context.Background(), scripts.MaxHostExecutionTime)
+	ctx, cancel := context.WithTimeout(context.Background(), r.ScriptExecutionTimeout)
 	defer cancel()
 
 	execCmdFn := r.execCmdFn
@@ -122,7 +122,7 @@ func (r *Runner) runOne(script *fleet.HostScriptResult) (finalErr error) {
 		execCmdFn = ExecCmd
 	}
 	start := time.Now()
-	log.Debug().Msgf("starting script execution of %v", script.ExecutionID)
+	log.Debug().Msgf("starting script execution of %v with timeout of %v", script.ExecutionID, r.ScriptExecutionTimeout)
 	output, exitCode, execErr := execCmdFn(ctx, scriptFile, nil)
 	log.Debug().Msgf("after script execution of %v", script.ExecutionID)
 	duration := time.Since(start)
@@ -144,6 +144,7 @@ func (r *Runner) runOne(script *fleet.HostScriptResult) (finalErr error) {
 		Output:      string(output),
 		Runtime:     int(duration.Seconds()),
 		ExitCode:    exitCode,
+		Timeout:     int(r.ScriptExecutionTimeout.Seconds()),
 	})
 	if err != nil {
 		return fmt.Errorf("save script result: %w", err)
diff --git a/orbit/pkg/table/extension.go b/orbit/pkg/table/extension.go
index cc7ddaccb36b..45f0c71255b0 100644
--- a/orbit/pkg/table/extension.go
+++ b/orbit/pkg/table/extension.go
@@ -25,10 +25,12 @@ import (
 type Runner struct {
 	socket          string
 	tableExtensions []Extension
+	executeDone     chan struct{}
 
-	// mu protects access to srv and cancel in Execute and Interrupt.
+	// mu protects access to srv, ctx and cancel in Execute and Interrupt.
 	mu     sync.Mutex
 	srv    *osquery.ExtensionManagerServer
+	ctx    context.Context
 	cancel func()
 }
 
@@ -59,7 +61,10 @@ func WithExtension(t Extension) Opt {
 
 // NewRunner creates an extension runner.
 func NewRunner(socket string, opts ...Opt) *Runner {
-	r := &Runner{socket: socket}
+	r := &Runner{
+		socket:      socket,
+		executeDone: make(chan struct{}),
+	}
 	for _, fn := range opts {
 		fn(r)
 	}
@@ -68,14 +73,13 @@ func NewRunner(socket string, opts ...Opt) *Runner {
 
 // Execute creates an osquery extension manager server and registers osquery plugins.
 func (r *Runner) Execute() error {
-	log.Debug().Msg("start osquery extension")
+	defer close(r.executeDone)
 
 	if err := waitExtensionSocket(r.socket, 1*time.Minute); err != nil {
 		return err
 	}
 
-	ctx, cancel := context.WithCancel(context.Background())
-	r.setCancel(cancel)
+	ctx, _ := r.getContextAndCancel()
 
 	ticker := time.NewTicker(200 * time.Millisecond)
 	for {
@@ -159,10 +163,10 @@ func OrbitDefaultTables() []osquery.OsqueryPlugin {
 
 // Interrupt shuts down the osquery manager server.
 func (r *Runner) Interrupt(err error) {
-	log.Error().Err(err).Msg("interrupt osquery extension")
-	if cancel := r.getCancel(); cancel != nil {
+	if _, cancel := r.getContextAndCancel(); cancel != nil {
 		cancel()
 	}
+	<-r.executeDone
 	if srv := r.getSrv(); srv != nil {
 		if err := srv.Shutdown(context.Background()); err != nil {
 			log.Debug().Err(err).Msg("shutdown extension")
@@ -250,13 +254,6 @@ func (r *Runner) setSrv(s *osquery.ExtensionManagerServer) {
 	r.srv = s
 }
 
-func (r *Runner) setCancel(c func()) {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-
-	r.cancel = c
-}
-
 func (r *Runner) getSrv() *osquery.ExtensionManagerServer {
 	r.mu.Lock()
 	defer r.mu.Unlock()
@@ -264,9 +261,15 @@ func (r *Runner) getSrv() *osquery.ExtensionManagerServer {
 	return r.srv
 }
 
-func (r *Runner) getCancel() func() {
+func (r *Runner) getContextAndCancel() (context.Context, func()) {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 
-	return r.cancel
+	if r.ctx != nil {
+		return r.ctx, r.cancel
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	r.ctx = ctx
+	r.cancel = cancel
+	return r.ctx, r.cancel
 }
diff --git a/orbit/pkg/table/fleetd_logs/fleetd_logs.go b/orbit/pkg/table/fleetd_logs/fleetd_logs.go
index 803f0027db0a..cdb5a84f6923 100644
--- a/orbit/pkg/table/fleetd_logs/fleetd_logs.go
+++ b/orbit/pkg/table/fleetd_logs/fleetd_logs.go
@@ -134,7 +134,7 @@ func processLogEntry(event []byte) ([]Event, error) {
 		var sqliteTime string
 		evtTime, ok := evt["time"].(string)
 		if ok {
-			goTime, err := time.Parse("2006-01-02T15:04:05-07:00", evtTime)
+			goTime, err := time.Parse(time.RFC3339, evtTime)
 			if err != nil {
 				return nil, fmt.Errorf("processLogEntry parsing time: %w", err)
 			}
diff --git a/orbit/pkg/update/disk_encryption.go b/orbit/pkg/update/disk_encryption.go
index ae09f386d6f0..1f6497265dab 100644
--- a/orbit/pkg/update/disk_encryption.go
+++ b/orbit/pkg/update/disk_encryption.go
@@ -1,6 +1,7 @@
 package update
 
 import (
+	"errors"
 	"sync/atomic"
 
 	"github.com/fleetdm/fleet/v4/orbit/pkg/useraction"
@@ -11,16 +12,37 @@ import (
 const maxRetries = 2
 
 type DiskEncryptionRunner struct {
-	isRunning atomic.Bool
+	isRunning           atomic.Bool
+	capabilitiesFetcher func() fleet.CapabilityMap
+	triggerOrbitRestart func(reason string)
 }
 
-func ApplyDiskEncryptionRunnerMiddleware() fleet.OrbitConfigReceiver {
-	return &DiskEncryptionRunner{}
+func ApplyDiskEncryptionRunnerMiddleware(
+	capabilitiesFetcher func() fleet.CapabilityMap,
+	triggerOrbitRestart func(reason string),
+) fleet.OrbitConfigReceiver {
+	return &DiskEncryptionRunner{
+		capabilitiesFetcher: capabilitiesFetcher,
+		triggerOrbitRestart: triggerOrbitRestart,
+	}
 }
 
 func (d *DiskEncryptionRunner) Run(cfg *fleet.OrbitConfig) error {
 	log.Debug().Msgf("running disk encryption fetcher middleware, notification: %v, isIdle: %v", cfg.Notifications.RotateDiskEncryptionKey, d.isRunning.Load())
 
+	if d.capabilitiesFetcher == nil {
+		return errors.New("disk encryption runner needs a capabilitites fetcher configured")
+	}
+
+	if d.triggerOrbitRestart == nil {
+		return errors.New("disk encryption runner needs a function to trigger orbit restarts configured")
+	}
+
+	if d.capabilitiesFetcher().Has(fleet.CapabilityEscrowBuddy) {
+		d.triggerOrbitRestart("server has Escrow Buddy capability but old disk encryption fetcher was running")
+		return nil
+	}
+
 	if cfg.Notifications.RotateDiskEncryptionKey && !d.isRunning.Swap(true) {
 		go func() {
 			defer d.isRunning.Store(false)
diff --git a/orbit/pkg/update/escrow_buddy.go b/orbit/pkg/update/escrow_buddy.go
new file mode 100644
index 000000000000..e1f6fdf1160d
--- /dev/null
+++ b/orbit/pkg/update/escrow_buddy.go
@@ -0,0 +1,120 @@
+package update
+
+import (
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/rs/zerolog/log"
+)
+
+// EscrowBuddyRunner sets up [Escrow Buddy][1] to rotate FileVault keys on
+// macOS without user interaction. This runner:
+//
+// - Ensures Escrow Buddy is added as a target for the update runner, so the
+// authorization plugin is downloaded and installed.
+// - Shells out to call `defaults` to configure Escrow Buddy according to
+// server instructions provided via notifications.
+//
+// [1]: https://github.com/macadmins/escrow-buddy
+type EscrowBuddyRunner struct {
+	// updateRunner is the wrapped Runner where Escrow Buddy will be set as
+	// a target.
+	updateRunner *Runner
+	// runCmdFunc can be set in tests to mock the command executed to
+	// configure Escrow Buddy
+	runCmdFunc func(cmd string, args ...string) error
+	// runMu guards runs to prevent multiple Run calls happening at the
+	// same time.
+	runMu sync.Mutex
+	// lastRun is used to guarantee that the run interval is enforced
+	lastRun time.Time
+	// interval defines how often Run is allowed to perform work
+	interval time.Duration
+}
+
+// NewEscrowBuddyRunner returns a new instance configured with the provided values
+func NewEscrowBuddyRunner(runner *Runner, interval time.Duration) fleet.OrbitConfigReceiver {
+	return &EscrowBuddyRunner{updateRunner: runner, interval: interval}
+}
+
+func (e *EscrowBuddyRunner) Run(cfg *fleet.OrbitConfig) error {
+	log.Debug().Msgf("EscrowBuddyRunner: notification: %t", cfg.Notifications.RotateDiskEncryptionKey)
+
+	if e.updateRunner == nil {
+		log.Info().Msg("EscrowBuddyRunner: received nil UpdateRunner, this probably indicates that updates are turned off. Skipping any actions related to Disk encryption")
+		return nil
+	}
+
+	if !e.runMu.TryLock() {
+		log.Debug().Msg("EscrowBuddyRunner: a previous instance is currently running, returning early")
+		return nil
+	}
+
+	defer e.runMu.Unlock()
+	if time.Since(e.lastRun) < e.interval {
+		log.Debug().Msgf("EscrowBuddyRunner: last run (%v) is less than the configured interval (%v), returning early", e.lastRun, e.interval)
+		return nil
+	}
+
+	updaterHasTarget := e.updateRunner.HasRunnerOptTarget("escrowBuddy")
+	// if the notification is false, it could mean that we shouldn't do
+	// anything at all (eg: MDM is not configured) or that this host
+	// doesn't need to rotate the key.
+	//
+	// if Escrow Buddy is a TUF target, it means that we tried to rotate
+	// the key before, and we must disable it to keep the local state as
+	// instructed by the server.
+	if !cfg.Notifications.RotateDiskEncryptionKey {
+		if updaterHasTarget {
+			log.Debug().Msg("EscrowBuddyRunner: disabling disk encryption rotation")
+			e.lastRun = time.Now()
+			return e.setGenerateNewKeyTo(false)
+		}
+
+		log.Debug().Msg("EscrowBuddyRunner: skipping any actions related to disk encryption")
+		return nil
+	}
+
+	runnerHasLocalHash := e.updateRunner.HasLocalHash("escrowBuddy")
+	if !updaterHasTarget || !runnerHasLocalHash {
+		log.Info().Msg("refreshing the update runner config with Escrow Buddy targets and hashes")
+		log.Debug().Msgf("updater has target: %t, runner has local hash: %t", updaterHasTarget, runnerHasLocalHash)
+		if err := e.setTargetsAndHashes(); err != nil {
+			return fmt.Errorf("setting Escrow Buddy targets and hashes: %w", err)
+		}
+	}
+
+	log.Debug().Msg("EscrowBuddyRunner: enabling disk encryption rotation")
+	if err := e.setGenerateNewKeyTo(true); err != nil {
+		return fmt.Errorf("enabling disk encryption rotation: %w", err)
+	}
+
+	e.lastRun = time.Now()
+	return nil
+}
+
+func (e *EscrowBuddyRunner) setTargetsAndHashes() error {
+	e.updateRunner.AddRunnerOptTarget("escrowBuddy")
+	e.updateRunner.updater.SetTargetInfo("escrowBuddy", EscrowBuddyMacOSTarget)
+	// we don't want to keep escrowBuddy as a target if we failed to update the
+	// cached hashes in the runner.
+	if err := e.updateRunner.StoreLocalHash("escrowBuddy"); err != nil {
+		log.Debug().Msgf("removing escrowBuddy from target options, error updating local hashes: %s", err)
+		e.updateRunner.RemoveRunnerOptTarget("escrowBuddy")
+		e.updateRunner.updater.RemoveTargetInfo("escrowBuddy")
+		return err
+	}
+	return nil
+}
+
+func (e *EscrowBuddyRunner) setGenerateNewKeyTo(enabled bool) error {
+	log.Debug().Msgf("running defaults write to configure Escrow Buddy with value %t", enabled)
+	cmd := fmt.Sprintf("defaults write /Library/Preferences/com.netflix.Escrow-Buddy.plist GenerateNewKey -bool %t", enabled)
+	fn := e.runCmdFunc
+	if fn == nil {
+		fn = runCmdCollectErr
+	}
+	return fn("sh", "-c", cmd)
+}
diff --git a/orbit/pkg/update/escrow_buddy_test.go b/orbit/pkg/update/escrow_buddy_test.go
new file mode 100644
index 000000000000..0ed61883b03f
--- /dev/null
+++ b/orbit/pkg/update/escrow_buddy_test.go
@@ -0,0 +1,86 @@
+package update
+
+import (
+	"testing"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+)
+
+func TestEscrowBuddy(t *testing.T) {
+	testingSuite := new(escrowBuddyTestSuite)
+	testingSuite.s = &testingSuite.Suite
+	suite.Run(t, testingSuite)
+}
+
+type escrowBuddyTestSuite struct {
+	suite.Suite
+	withTUF
+}
+
+func (s *escrowBuddyTestSuite) TestUpdatesDisabled() {
+	t := s.T()
+	cfg := &fleet.OrbitConfig{}
+	cfg.Notifications.RotateDiskEncryptionKey = true
+	r := NewEscrowBuddyRunner(nil, time.Second)
+	err := r.Run(cfg)
+	require.NoError(t, err)
+}
+
+func (s *escrowBuddyTestSuite) TestEscrowBuddyRotatesKey() {
+	t := s.T()
+	updater := &Updater{
+		client: s.client,
+		opt:    Options{Targets: make(map[string]TargetInfo), RootDirectory: t.TempDir()},
+	}
+	runner := &Runner{updater: updater, localHashes: make(map[string][]byte)}
+	escrowBuddyPath := "escrowBuddy/macos/stable/escrowBuddy.pkg"
+
+	cfg := &fleet.OrbitConfig{}
+	r := &EscrowBuddyRunner{updateRunner: runner, interval: time.Millisecond}
+	// mock the command to run the defaults cli
+	cmdCalls := []map[string]any{}
+	r.runCmdFunc = func(cmd string, args ...string) error {
+		cmdCalls = append(cmdCalls, map[string]any{"cmd": cmd, "args": args})
+		return nil
+	}
+
+	// no new target added if the notification is not set
+	err := r.Run(cfg)
+	require.NoError(t, err)
+	targets := runner.updater.opt.Targets
+	require.Len(t, targets, 0)
+	require.Empty(t, cmdCalls)
+
+	// there's an error when the remote repo doesn't have the target yet
+	cfg.Notifications.RotateDiskEncryptionKey = true
+	err = r.Run(cfg)
+	require.ErrorContains(t, err, "tuf: file not found")
+	require.Empty(t, cmdCalls)
+
+	// add escrow buddy to the remote
+	s.addRemoteTarget(escrowBuddyPath)
+
+	err = r.Run(cfg)
+	require.NoError(t, err)
+	require.Len(t, cmdCalls, 1)
+	require.Equal(t, cmdCalls[0]["cmd"], "sh")
+	require.Equal(t, cmdCalls[0]["args"], []string{"-c", "defaults write /Library/Preferences/com.netflix.Escrow-Buddy.plist GenerateNewKey -bool true"})
+
+	targets = runner.updater.opt.Targets
+	require.Len(t, targets, 1)
+	ti, ok := targets["escrowBuddy"]
+	require.True(t, ok)
+	require.EqualValues(t, EscrowBuddyMacOSTarget, ti)
+
+	time.Sleep(3 * time.Millisecond)
+	cfg.Notifications.RotateDiskEncryptionKey = false
+	err = r.Run(cfg)
+	require.NoError(t, err)
+	require.Len(t, cmdCalls, 2)
+	require.Equal(t, cmdCalls[1]["cmd"], "sh")
+	require.Equal(t, cmdCalls[1]["args"], []string{"-c", "defaults write /Library/Preferences/com.netflix.Escrow-Buddy.plist GenerateNewKey -bool false"})
+
+}
diff --git a/orbit/pkg/update/flag_runner.go b/orbit/pkg/update/flag_runner.go
index 19acdccfe88b..f8b3db8bf1c8 100644
--- a/orbit/pkg/update/flag_runner.go
+++ b/orbit/pkg/update/flag_runner.go
@@ -1,7 +1,6 @@
 package update
 
 import (
-	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -23,8 +22,8 @@ import (
 // It uses an OrbitConfigFetcher (which may be the OrbitClient with additional middleware), along
 // with FlagUpdateOptions to connect to Fleet
 type FlagRunner struct {
-	queueOrbitRestart context.CancelFunc
-	opt               FlagUpdateOptions
+	triggerOrbitRestart func(reason string)
+	opt                 FlagUpdateOptions
 }
 
 // FlagUpdateOptions is options provided for the flag update runner
@@ -35,10 +34,10 @@ type FlagUpdateOptions struct {
 
 // NewFlagRunner creates a new runner with provided options
 // The runner must be started with Execute
-func NewFlagReceiver(queueOrbitRestart context.CancelFunc, opt FlagUpdateOptions) *FlagRunner {
+func NewFlagReceiver(triggerOrbitRestart func(reason string), opt FlagUpdateOptions) *FlagRunner {
 	return &FlagRunner{
-		queueOrbitRestart: queueOrbitRestart,
-		opt:               opt,
+		triggerOrbitRestart: triggerOrbitRestart,
+		opt:                 opt,
 	}
 }
 
@@ -79,7 +78,7 @@ func (r *FlagRunner) Run(config *fleet.OrbitConfig) error {
 		return fmt.Errorf("error writing flags to disk: %w", err)
 	}
 
-	r.queueOrbitRestart()
+	r.triggerOrbitRestart("osquery flags updated")
 	return nil
 }
 
@@ -89,9 +88,9 @@ func (r *FlagRunner) Run(config *fleet.OrbitConfig) error {
 // It uses an an OrbitConfigFetcher (which may be the OrbitClient with additional middleware), along
 // with ExtensionUpdateOptions and updateRunner to connect to Fleet.
 type ExtensionRunner struct {
-	opt               ExtensionUpdateOptions
-	updateRunner      *Runner
-	queueOrbitRestart context.CancelFunc
+	opt                 ExtensionUpdateOptions
+	updateRunner        *Runner
+	triggerOrbitRestart func(reason string)
 }
 
 // ExtensionUpdateOptions is options provided for the extensions fetch/update runner
@@ -102,19 +101,18 @@ type ExtensionUpdateOptions struct {
 
 // NewExtensionConfigUpdateRunner creates a new runner with provided options
 // The runner must be started with Execute
-func NewExtensionConfigUpdateRunner(opt ExtensionUpdateOptions, updateRunner *Runner, queueOrbitRestart context.CancelFunc) *ExtensionRunner {
+func NewExtensionConfigUpdateRunner(opt ExtensionUpdateOptions, updateRunner *Runner, triggerOrbitRestart func(reason string)) *ExtensionRunner {
 	return &ExtensionRunner{
-		opt:               opt,
-		updateRunner:      updateRunner,
-		queueOrbitRestart: queueOrbitRestart,
+		opt:                 opt,
+		updateRunner:        updateRunner,
+		triggerOrbitRestart: triggerOrbitRestart,
 	}
 }
 
 // DoExtensionConfigUpdate calls the /config API endpoint to grab extensions from Fleet
 // It parses the extensions, computes the local hash, and writes the binary path to extension.load file
 //
-// It returns a (bool, error), where bool indicates whether orbit should restart
-// It only returns (true, nil) when extensions were previously configured and now are cleared
+// It will only trigger a orbit restart when extensions were previously configured and now are cleared.
 func (r *ExtensionRunner) Run(config *fleet.OrbitConfig) error {
 	extensionAutoLoadFile := filepath.Join(r.opt.RootDir, "extensions.load")
 	if len(config.Extensions) == 0 {
@@ -126,7 +124,6 @@ func (r *ExtensionRunner) Run(config *fleet.OrbitConfig) error {
 		// Handle case 1, where our autoload file does not exist, so there is nothing to update and no error
 		case errors.Is(err, os.ErrNotExist):
 			log.Debug().Msg(extensionAutoLoadFile + " not found, nothing to update")
-			// we do not want orbit to restart
 			return nil
 		case err == nil:
 			// handle case 2: create/truncate the extensions.load file and let the runner interrupt, so that
@@ -135,19 +132,14 @@ func (r *ExtensionRunner) Run(config *fleet.OrbitConfig) error {
 			if stat.Size() > 0 {
 				err := os.WriteFile(extensionAutoLoadFile, []byte(""), constant.DefaultFileMode)
 				if err != nil {
-					// we do not want orbit to restart
 					return fmt.Errorf("extensionsUpdate: error creating file %s, %w", extensionAutoLoadFile, err)
 				}
-				// we want to return true here, and restart with the empty extensions.load file
-				// so that we "unload" the previously loaded
-				// extensions
-				r.queueOrbitRestart()
+				// Restart with the empty extensions.load file so that we "unload" the previously loaded extensions.
+				r.triggerOrbitRestart("unloading extensions")
 				return nil
 			}
-			// we do not want orbit to restart
 			return nil
 		default:
-			// we do not want orbit to restart, just log the error
 			return fmt.Errorf("stat file: %s", extensionAutoLoadFile)
 		}
 	}
@@ -157,7 +149,6 @@ func (r *ExtensionRunner) Run(config *fleet.OrbitConfig) error {
 	var extensions fleet.Extensions
 	err := json.Unmarshal(config.Extensions, &extensions)
 	if err != nil {
-		// we do not want orbit to restart
 		return fmt.Errorf("error unmarshing json extensions config from fleet: %w", err)
 	}
 
@@ -205,7 +196,6 @@ func (r *ExtensionRunner) Run(config *fleet.OrbitConfig) error {
 		}
 
 		if err := r.updateRunner.StoreLocalHash(targetName); err != nil {
-			// we do not want orbit to restart
 			return fmt.Errorf("unable to lookup metadata for target: %s, %w", targetName, err)
 		}
 
@@ -215,8 +205,6 @@ func (r *ExtensionRunner) Run(config *fleet.OrbitConfig) error {
 		return fmt.Errorf("error writing extensions autoload file: %w", err)
 	}
 
-	// we do not want orbit to restart
-	// runner.UpdateAction() will fetch the new targets and restart for us if needed
 	return nil
 }
 
diff --git a/orbit/pkg/update/flag_runner_test.go b/orbit/pkg/update/flag_runner_test.go
index d5e366ab6b69..90ff2b555871 100644
--- a/orbit/pkg/update/flag_runner_test.go
+++ b/orbit/pkg/update/flag_runner_test.go
@@ -90,7 +90,7 @@ func TestDoFlagsUpdateWithEmptyFlags(t *testing.T) {
 	}
 
 	var restartQueued bool
-	queueOrbitRestart := func() { restartQueued = true }
+	queueOrbitRestart := func(string) { restartQueued = true }
 
 	fr := NewFlagReceiver(queueOrbitRestart, FlagUpdateOptions{
 		RootDir: rootDir,
diff --git a/orbit/pkg/update/notifications.go b/orbit/pkg/update/notifications.go
index 63224ac85916..fa5b6b993c6f 100644
--- a/orbit/pkg/update/notifications.go
+++ b/orbit/pkg/update/notifications.go
@@ -10,6 +10,7 @@ import (
 	"github.com/fleetdm/fleet/v4/orbit/pkg/bitlocker"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/profiles"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/scripts"
+	fleetscripts "github.com/fleetdm/fleet/v4/pkg/scripts"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/rs/zerolog/log"
 )
@@ -65,7 +66,7 @@ func (h *renewEnrollmentProfileConfigReceiver) Run(config *fleet.OrbitConfig) er
 			// enrolled (after the user's manual steps, and osquery reporting the
 			// updated mdm enrollment).
 			// See https://github.com/fleetdm/fleet/pull/9409#discussion_r1084382455
-			if time.Since(h.lastRun) > h.Frequency {
+			if time.Since(h.lastRun) >= h.Frequency {
 				// we perform this check locally on the client too to avoid showing the
 				// dialog if the client is enrolled to an MDM server.
 				enrollFn := h.checkEnrollmentFn
@@ -346,6 +347,11 @@ func (h *runScriptsConfigReceiver) runDynamicScriptsEnabledCheck() {
 // server sent a list of scripts to execute, starts a goroutine to execute
 // them.
 func (h *runScriptsConfigReceiver) Run(cfg *fleet.OrbitConfig) error {
+	timeout := fleetscripts.MaxHostExecutionTime
+	if cfg.ScriptExeTimeout > 0 {
+		timeout = time.Duration(cfg.ScriptExeTimeout) * time.Second
+	}
+
 	if len(cfg.Notifications.PendingScriptExecutionIDs) > 0 {
 		if h.mu.TryLock() {
 			log.Debug().Msgf("received request to run scripts %v", cfg.Notifications.PendingScriptExecutionIDs)
@@ -353,6 +359,7 @@ func (h *runScriptsConfigReceiver) Run(cfg *fleet.OrbitConfig) error {
 			runner := &scripts.Runner{
 				ScriptExecutionEnabled: h.scriptsEnabled(),
 				Client:                 h.ScriptsClient,
+				ScriptExecutionTimeout: timeout,
 			}
 			fn := runner.Run
 			if h.runScriptsFn != nil {
diff --git a/orbit/pkg/update/nudge_test.go b/orbit/pkg/update/nudge_test.go
index 05d02686c18b..987e9dd44a4c 100644
--- a/orbit/pkg/update/nudge_test.go
+++ b/orbit/pkg/update/nudge_test.go
@@ -33,7 +33,7 @@ func (s *nudgeTestSuite) TestUpdatesDisabled() {
 	t := s.T()
 	var err error
 	cfg := &fleet.OrbitConfig{}
-	cfg.NudgeConfig, err = fleet.NewNudgeConfig(fleet.MacOSUpdates{MinimumVersion: optjson.SetString("11"), Deadline: optjson.SetString("2022-01-04")})
+	cfg.NudgeConfig, err = fleet.NewNudgeConfig(fleet.AppleOSUpdateSettings{MinimumVersion: optjson.SetString("11"), Deadline: optjson.SetString("2022-01-04")})
 	require.NoError(t, err)
 	runNudgeFn := func(execPath, configPath string) error {
 		return nil
@@ -96,7 +96,7 @@ func (s *nudgeTestSuite) TestNudgeConfigFetcherAddNudge() {
 	require.Len(t, targets, 0)
 
 	// set the config
-	cfg.NudgeConfig, err = fleet.NewNudgeConfig(fleet.MacOSUpdates{MinimumVersion: optjson.SetString("11"), Deadline: optjson.SetString("2022-01-04")})
+	cfg.NudgeConfig, err = fleet.NewNudgeConfig(fleet.AppleOSUpdateSettings{MinimumVersion: optjson.SetString("11"), Deadline: optjson.SetString("2022-01-04")})
 	require.NoError(t, err)
 
 	// there's an error when the remote repo doesn't have the target yet
diff --git a/orbit/pkg/update/options.go b/orbit/pkg/update/options.go
index a12e3c72fb65..ed04f5a10bce 100644
--- a/orbit/pkg/update/options.go
+++ b/orbit/pkg/update/options.go
@@ -41,6 +41,19 @@ var (
 		},
 	}
 
+	LinuxArm64Targets = Targets{
+		"orbit": TargetInfo{
+			Platform:   "linux-arm64",
+			Channel:    "stable",
+			TargetFile: "orbit",
+		},
+		"osqueryd": TargetInfo{
+			Platform:   "linux-arm64",
+			Channel:    "stable",
+			TargetFile: "osqueryd",
+		},
+	}
+
 	WindowsTargets = Targets{
 		"orbit": TargetInfo{
 			Platform:   "windows",
@@ -82,6 +95,20 @@ var (
 		},
 	}
 
+	DesktopLinuxArm64Target = TargetInfo{
+		Platform:             "linux-arm64",
+		Channel:              "stable",
+		TargetFile:           "desktop.tar.gz",
+		ExtractedExecSubPath: []string{"fleet-desktop", constant.DesktopAppExecName},
+		CustomCheckExec: func(execPath string) error {
+			cmd := exec.Command(execPath, "--help")
+			if out, err := cmd.CombinedOutput(); err != nil {
+				return fmt.Errorf("exec new version: %s: %w", string(out), err)
+			}
+			return nil
+		},
+	}
+
 	NudgeMacOSTarget = TargetInfo{
 		Platform:             "macos",
 		Channel:              "stable",
@@ -95,4 +122,10 @@ var (
 		TargetFile:           "swiftDialog.app.tar.gz",
 		ExtractedExecSubPath: []string{"Dialog.app", "Contents", "MacOS", "Dialog"},
 	}
+
+	EscrowBuddyMacOSTarget = TargetInfo{
+		Platform:   "macos",
+		Channel:    "stable",
+		TargetFile: "escrowBuddy.pkg",
+	}
 )
diff --git a/orbit/pkg/update/options_linux.go b/orbit/pkg/update/options_linux_amd64.go
similarity index 100%
rename from orbit/pkg/update/options_linux.go
rename to orbit/pkg/update/options_linux_amd64.go
diff --git a/orbit/pkg/update/options_linux_arm64.go b/orbit/pkg/update/options_linux_arm64.go
new file mode 100644
index 000000000000..5ed37667ddcc
--- /dev/null
+++ b/orbit/pkg/update/options_linux_arm64.go
@@ -0,0 +1,14 @@
+package update
+
+import (
+	"github.com/theupdateframework/go-tuf/client"
+)
+
+var defaultOptions = Options{
+	RootDirectory:     "/opt/orbit",
+	ServerURL:         defaultURL,
+	RootKeys:          defaultRootKeys,
+	LocalStore:        client.MemoryLocalStore(),
+	InsecureTransport: false,
+	Targets:           LinuxArm64Targets,
+}
diff --git a/orbit/pkg/update/runner.go b/orbit/pkg/update/runner.go
index d1551ac4190d..361d69278b5c 100644
--- a/orbit/pkg/update/runner.go
+++ b/orbit/pkg/update/runner.go
@@ -165,8 +165,6 @@ func randomizeDuration(max time.Duration) (time.Duration, error) {
 
 // Execute begins a loop checking for updates.
 func (r *Runner) Execute() error {
-	log.Debug().Msg("start updater")
-
 	// Randomize the initial interval so that all agents don't synchronize their updates
 	initialInterval := r.opt.CheckInterval
 	// Developers use a shorter update interval (10s), so they need a faster first update check
@@ -322,7 +320,6 @@ func (r *Runner) updateTarget(target string) error {
 
 func (r *Runner) Interrupt(err error) {
 	r.cancel <- struct{}{}
-	log.Error().Err(err).Msg("interrupt updater")
 }
 
 // compareVersion compares the old and new versions of a binary and prints the appropriate message.
diff --git a/orbit/pkg/update/swift_dialog.go b/orbit/pkg/update/swift_dialog.go
index eebd68477bc1..bdbfde5e3ee3 100644
--- a/orbit/pkg/update/swift_dialog.go
+++ b/orbit/pkg/update/swift_dialog.go
@@ -34,7 +34,10 @@ func (s *SwiftDialogDownloader) Run(cfg *fleet.OrbitConfig) error {
 		return nil
 	}
 
+	// TODO: we probably want to ensure that swiftDialog is always installed if we're going to be
+	// using it offline.
 	if !cfg.Notifications.NeedsMDMMigration && !cfg.Notifications.RenewEnrollmentProfile {
+		log.Debug().Msg("got false needs migration and false renew enrollment")
 		return nil
 	}
 
diff --git a/orbit/pkg/update/testing_utils.go b/orbit/pkg/update/testing_utils.go
index 53c943f2c814..83698e240efc 100644
--- a/orbit/pkg/update/testing_utils.go
+++ b/orbit/pkg/update/testing_utils.go
@@ -85,6 +85,7 @@ func (ts *withTUF) SetupSuite() {
 	ts.mockFiles = map[string][]byte{
 		"nudge/macos/stable/nudge.app.tar.gz":       ts.memTarGz("/Nudge.app/Contents/MacOS/Nudge", "nudge"),
 		"osqueryd/macos/stable/osqueryd.app.tar.gz": ts.memTarGz("osqueryd", "osqueryd"),
+		"escrowBuddy/macos/stable/escrowBuddy.pkg":  {},
 	}
 	ts.store = tuf.MemoryStore(nil, ts.mockFiles)
 
diff --git a/orbit/pkg/update/update.go b/orbit/pkg/update/update.go
index 858d60b88d5d..56e4a79b7f4e 100644
--- a/orbit/pkg/update/update.go
+++ b/orbit/pkg/update/update.go
@@ -384,6 +384,11 @@ func (u *Updater) get(target string) (*LocalTarget, error) {
 					return nil, fmt.Errorf("failed to remove old extracted dir: %q: %w", localTarget.DirPath, err)
 				}
 			}
+			if strings.HasSuffix(localTarget.Path, ".pkg") && runtime.GOOS == "darwin" {
+				if err := installPKG(localTarget.Path); err != nil {
+					return nil, fmt.Errorf("updating pkg: %w", err)
+				}
+			}
 		} else {
 			log.Debug().Str("path", localTarget.Path).Str("target", target).Msg("found expected target locally")
 		}
@@ -392,6 +397,11 @@ func (u *Updater) get(target string) (*LocalTarget, error) {
 		if err := u.download(target, repoPath, localTarget.Path, localTarget.Info.CustomCheckExec); err != nil {
 			return nil, fmt.Errorf("download %q: %w", repoPath, err)
 		}
+		if strings.HasSuffix(localTarget.Path, ".pkg") && runtime.GOOS == "darwin" {
+			if err := installPKG(localTarget.Path); err != nil {
+				return nil, fmt.Errorf("installing pkg for the first time: %w", err)
+			}
+		}
 	default:
 		return nil, fmt.Errorf("stat %q: %w", localTarget.Path, err)
 	}
@@ -493,11 +503,28 @@ func goosFromPlatform(platform string) (string, error) {
 		return "darwin", nil
 	case "windows", "linux":
 		return platform, nil
+	case "linux-arm64":
+		return "linux", nil
 	default:
 		return "", fmt.Errorf("unknown platform: %s", platform)
 	}
 }
 
+func goarchFromPlatform(platform string) ([]string, error) {
+	switch platform {
+	case "macos", "macos-app":
+		return []string{"amd64", "arm64"}, nil
+	case "windows":
+		return []string{"amd64"}, nil
+	case "linux":
+		return []string{"amd64"}, nil
+	case "linux-arm64":
+		return []string{"arm64"}, nil
+	default:
+		return nil, fmt.Errorf("unknown platform: %s", platform)
+	}
+}
+
 // checkExec checks/verifies a downloaded executable target by executing it.
 func (u *Updater) checkExec(target, tmpPath string, customCheckExec func(execPath string) error) error {
 	localTarget, err := u.localTarget(target)
@@ -515,6 +542,23 @@ func (u *Updater) checkExec(target, tmpPath string, customCheckExec func(execPat
 		return nil
 	}
 
+	platformGOARCH, err := goarchFromPlatform(localTarget.Info.Platform)
+	if err != nil {
+		return err
+	}
+	var containsArch bool
+	for _, arch := range platformGOARCH {
+		if arch == runtime.GOARCH {
+			containsArch = true
+		}
+	}
+	if !containsArch && strings.HasSuffix(os.Args[0], "fleetctl") {
+		// Nothing to do, we can't reliably execute a
+		// cross-architecture binary. This happens when cross-building
+		// packages
+		return nil
+	}
+
 	if strings.HasSuffix(tmpPath, ".tar.gz") {
 		if err := extractTarGz(tmpPath); err != nil {
 			return fmt.Errorf("extract %q: %w", tmpPath, err)
@@ -524,6 +568,14 @@ func (u *Updater) checkExec(target, tmpPath string, customCheckExec func(execPat
 		tmpPath = filepath.Join(append([]string{filepath.Dir(tmpPath)}, localTarget.Info.ExtractedExecSubPath...)...)
 	}
 
+	if strings.HasSuffix(tmpPath, ".pkg") && runtime.GOOS == "darwin" {
+		cmd := exec.Command("pkgutil", "--payload-files", tmpPath)
+		if out, err := cmd.CombinedOutput(); err != nil {
+			return fmt.Errorf("running pkgutil to verify %s: %s: %w", tmpPath, string(out), err)
+		}
+		return nil
+	}
+
 	if customCheckExec != nil {
 		if err := customCheckExec(tmpPath); err != nil {
 			return fmt.Errorf("custom exec new version failed: %w", err)
@@ -599,6 +651,14 @@ func extractTarGz(path string) error {
 	}
 }
 
+func installPKG(path string) error {
+	cmd := exec.Command("installer", "-pkg", path, "-target", "/")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("running pkgutil to install %s: %s: %w", path, string(out), err)
+	}
+	return nil
+}
+
 func (u *Updater) initializeDirectories() error {
 	for _, dir := range []string{
 		filepath.Join(u.opt.RootDirectory, binDir),
diff --git a/orbit/pkg/update/update_test.go b/orbit/pkg/update/update_test.go
index 9a9b9c4fae6d..c756e043c3ee 100644
--- a/orbit/pkg/update/update_test.go
+++ b/orbit/pkg/update/update_test.go
@@ -39,6 +39,7 @@ func TestMakeRepoPath(t *testing.T) {
 	}{
 		{platform: "linux", name: "osqueryd", version: "4.6.0", expected: "osqueryd/linux/4.6.0/osqueryd"},
 		{platform: "linux", name: "osqueryd", version: "3.3.2", expected: "osqueryd/linux/3.3.2/osqueryd"},
+		{platform: "linux-arm64", name: "osqueryd", version: "3.3.2", expected: "osqueryd/linux-arm64/3.3.2/osqueryd"},
 		{platform: "macos", name: "osqueryd", version: "4.6.0", expected: "osqueryd/macos/4.6.0/osqueryd"},
 		{platform: "macos", name: "osqueryd", version: "3.3.2", expected: "osqueryd/macos/3.3.2/osqueryd"},
 		{platform: "macos-app", name: "osqueryd", version: "3.3.2", expected: "osqueryd/macos-app/3.3.2/osqueryd.app.tar.gz"},
@@ -89,6 +90,12 @@ func TestLocalTargetPaths(t *testing.T) {
 			"root/bin/target/linux/stable/fleet-desktop/fleet-desktop",
 			"root/bin/target/linux/stable/fleet-desktop",
 		},
+		{
+			DesktopLinuxArm64Target,
+			"root/bin/target/linux-arm64/stable/desktop.tar.gz",
+			"root/bin/target/linux-arm64/stable/fleet-desktop/fleet-desktop",
+			"root/bin/target/linux-arm64/stable/fleet-desktop",
+		},
 		{
 			SwiftDialogMacOSTarget,
 			"root/bin/target/macos/stable/swiftDialog.app.tar.gz",
diff --git a/orbit/pkg/useraction/mdm_migration.go b/orbit/pkg/useraction/mdm_migration.go
index 27480b6ab667..228a39666489 100644
--- a/orbit/pkg/useraction/mdm_migration.go
+++ b/orbit/pkg/useraction/mdm_migration.go
@@ -1,6 +1,10 @@
 package useraction
 
-import "github.com/fleetdm/fleet/v4/server/fleet"
+import (
+	"context"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+)
 
 // MDMMigrator represents the minimum set of methods a migration must implement
 // in order to be used by Fleet Desktop.
@@ -19,6 +23,12 @@ type MDMMigrator interface {
 	ShowInterval() error
 	// Exit tries to stop any processes started by the migrator.
 	Exit()
+	// MigrationInProgress checks if the MDM migration is still in progress (i.e. the host is not
+	// yet fully enrolled in Fleet MDM). It returns the type of migration that is in progress, if any.
+	MigrationInProgress() (string, error)
+	// MarkMigrationCompleted marks the migration as completed. This is currently done by removing
+	// the migration file.
+	MarkMigrationCompleted() error
 }
 
 // MDMMigratorProps are props required to display the dialog. It's akin to the
@@ -26,6 +36,8 @@ type MDMMigrator interface {
 type MDMMigratorProps struct {
 	OrgInfo     fleet.DesktopOrgInfo
 	IsUnmanaged bool
+	// DisableTakeover is used to disable the blur and always on top features of the dialog.
+	DisableTakeover bool
 }
 
 // MDMMigratorHandler handles remote actions/callbacks that the migrator calls.
@@ -33,3 +45,7 @@ type MDMMigratorHandler interface {
 	NotifyRemote() error
 	ShowInstructions() error
 }
+
+type MDMOfflineWatcher interface {
+	ShowIfOffline(ctx context.Context) bool
+}
diff --git a/orbit/pkg/useraction/mdm_migration_darwin.go b/orbit/pkg/useraction/mdm_migration_darwin.go
index ba4c574d6ec5..e4daeab99737 100644
--- a/orbit/pkg/useraction/mdm_migration_darwin.go
+++ b/orbit/pkg/useraction/mdm_migration_darwin.go
@@ -4,6 +4,7 @@ package useraction
 
 import (
 	"bytes"
+	"context"
 	"errors"
 	"fmt"
 	"os"
@@ -14,9 +15,13 @@ import (
 	"text/template"
 	"time"
 
+	"github.com/fleetdm/fleet/v4/orbit/pkg/constant"
+	"github.com/fleetdm/fleet/v4/orbit/pkg/migration"
+
 	"github.com/fleetdm/fleet/v4/orbit/pkg/profiles"
 	"github.com/fleetdm/fleet/v4/pkg/file"
 	"github.com/fleetdm/fleet/v4/pkg/retry"
+	"github.com/fleetdm/fleet/v4/server/service"
 	"github.com/rs/zerolog/log"
 )
 
@@ -56,15 +61,23 @@ var mdmMigrationTemplatePreSonoma = template.Must(template.New("mdmMigrationTemp
 
 Select **Start** and look for this notification in your notification center:` +
 	"\n\n![Image showing MDM migration notification](https://fleetdm.com/images/permanent/mdm-migration-screenshot-notification-2048x480.png)\n\n" +
-	"After you start, this window will popup every 15-20 minutes until you finish.",
+	"After you start, this window will popup every 3 minutes until you finish.",
+))
+
+var mdmManualMigrationTemplate = template.Must(template.New("").Parse(`
+## Migrate to Fleet
+
+Select **Start** and My device page will appear soon:` +
+	"\n\n![Image showing MDM migration notification](https://fleetdm.com/images/permanent/mdm-manual-migration-1024x500.png)\n\n" +
+	"After you start, this dialog will popup every 3 minutes until you finish.",
 ))
 
-var mdmMigrationTemplate = template.Must(template.New("mdmMigrationTemplate").Parse(`
+var mdmADEMigrationTemplate = template.Must(template.New("").Parse(`
 ## Migrate to Fleet
 
 Select **Start** and Remote Management window will appear soon:` +
-	"\n\n![Image showing MDM migration notification](https://fleetdm.com/images/permanent/mdm-migration-sonoma-1500x938.png)\n\n" +
-	"After you start, this window will popup every 15-20 minutes until you finish.",
+	"\n\n![Image showing MDM migration notification](https://fleetdm.com/images/permanent/mdm-ade-migration-1024x500.png)\n\n" +
+	"After you start, **Remote Management** will popup every minute until you finish.",
 ))
 
 var errorTemplate = template.Must(template.New("").Parse(`
@@ -73,6 +86,14 @@ var errorTemplate = template.Must(template.New("").Parse(`
 Please contact your IT admin [here]({{ .ContactURL }}).
 `))
 
+var unenrollBody = "## Migrate to Fleet\nUnenrolling you from your old MDM. This could take 90 seconds...\n\n%s"
+
+var mdmMigrationTemplateOffline = template.Must(template.New("").Parse(`
+## Migrate to Fleet
+
+🛜🚫 No internet connection. Please connect to internet to continue.`,
+))
+
 // baseDialog implements the basic building blocks to render dialogs using
 // swiftDialog.
 type baseDialog struct {
@@ -110,11 +131,9 @@ func (b *baseDialog) render(flags ...string) (chan swiftDialogExitCode, chan err
 	exitCodeCh := make(chan swiftDialogExitCode, 1)
 	errCh := make(chan error, 1)
 	go func() {
-		// all dialogs should always be blurred and on top
+		// all dialogs should always be centered
 		flags = append(
 			flags,
-			"--blurscreen",
-			"--ontop",
 			"--messageposition", "center",
 		)
 		cmd := exec.Command(b.path, flags...) //nolint:gosec
@@ -166,14 +185,18 @@ func (b *baseDialog) render(flags ...string) (chan swiftDialogExitCode, chan err
 }
 
 // NewMDMMigrator creates a new  swiftDialogMDMMigrator with the right internal state.
-func NewMDMMigrator(path string, frequency time.Duration, handler MDMMigratorHandler) MDMMigrator {
+func NewMDMMigrator(path string, frequency time.Duration, handler MDMMigratorHandler, mrw *migration.ReadWriter, fleetURL string, showCh chan struct{}) MDMMigrator {
+	if cap(showCh) != 1 {
+		log.Fatal().Msg("swift dialog channel must have a buffer size of 1")
+	}
 	return &swiftDialogMDMMigrator{
 		handler:                   handler,
 		baseDialog:                newBaseDialog(path),
 		frequency:                 frequency,
 		unenrollmentRetryInterval: defaultUnenrollmentRetryInterval,
-		// set a buffer size of 1 to allow one Show without blocking
-		showCh: make(chan struct{}, 1),
+		mrw:                       mrw,
+		fleetURL:                  fleetURL,
+		showCh:                    showCh,
 	}
 }
 
@@ -189,7 +212,8 @@ type swiftDialogMDMMigrator struct {
 	// lastShown
 	lastShown   time.Time
 	lastShownMu sync.RWMutex
-	showCh      chan struct{}
+	// showCh is shared with the offline watcher and used to ensure only one dialog is open at a time
+	showCh chan struct{}
 
 	// testEnrollmentCheckFileFn is used in tests to mock the call to verify
 	// the enrollment status of the host
@@ -198,6 +222,8 @@ type swiftDialogMDMMigrator struct {
 	// the enrollment status of the host
 	testEnrollmentCheckStatusFn func() (bool, string, error)
 	unenrollmentRetryInterval   time.Duration
+	mrw                         *migration.ReadWriter
+	fleetURL                    string
 }
 
 /**
@@ -248,12 +274,23 @@ func (m *swiftDialogMDMMigrator) render(message string, flags ...string) (chan s
 	return m.baseDialog.render(flags...)
 }
 
-func (m *swiftDialogMDMMigrator) renderLoadingSpinner() (chan swiftDialogExitCode, chan error) {
-	return m.render("## Migrate to Fleet\nUnenrolling you from your old MDM. This could take 90 seconds...",
+func (m *swiftDialogMDMMigrator) renderLoadingSpinner(preSonoma, isManual bool) (chan swiftDialogExitCode, chan error) {
+	var body string
+	switch true {
+	case preSonoma:
+		body = fmt.Sprintf(unenrollBody, "![Image showing MDM migration notification](https://fleetdm.com/images/permanent/mdm-migration-pre-sonoma-unenroll-1024x500.png)")
+	case isManual:
+		body = fmt.Sprintf(unenrollBody, "![Image showing MDM migration notification](https://fleetdm.com/images/permanent/mdm-manual-migration-1024x500.png)")
+	default:
+		// ADE migration, macOS > 14
+		body = fmt.Sprintf(unenrollBody, "![Image showing MDM migration notification](https://fleetdm.com/images/permanent/mdm-ade-migration-1024x500.png)")
+	}
+
+	return m.render(body,
 		"--button1text", "Start",
 		"--button1disabled",
 		"--quitkey", "x",
-		"--height", "220",
+		"--height", "669",
 	)
 }
 
@@ -275,7 +312,7 @@ func (m *swiftDialogMDMMigrator) renderError() (chan swiftDialogExitCode, chan e
 // waitForUnenrollment waits 90 seconds (value determined by product) for the
 // device to unenroll from the current MDM solution. If the device doesn't
 // unenroll, an error is returned.
-func (m *swiftDialogMDMMigrator) waitForUnenrollment() error {
+func (m *swiftDialogMDMMigrator) waitForUnenrollment(isADEMigration bool) error {
 	maxRetries := int(mdmUnenrollmentTotalWaitTime.Seconds() / m.unenrollmentRetryInterval.Seconds())
 	checkFileFn := m.testEnrollmentCheckFileFn
 	if checkFileFn == nil {
@@ -292,14 +329,16 @@ func (m *swiftDialogMDMMigrator) waitForUnenrollment() error {
 	return retry.Do(func() error {
 		var unenrolled bool
 
-		fileExists, fileErr := checkFileFn()
-		if fileErr != nil {
-			log.Error().Err(fileErr).Msg("checking for existence of cloudConfigProfileInstalled in migration modal")
-		} else if fileExists {
-			log.Info().Msg("checking for existence of cloudConfigProfileInstalled in migration modal: found")
-		} else {
-			log.Info().Msg("checking for existence of cloudConfigProfileInstalled in migration modal: not found")
-			unenrolled = true
+		if isADEMigration {
+			fileExists, fileErr := checkFileFn()
+			if fileErr != nil {
+				log.Error().Err(fileErr).Msg("checking for existence of cloudConfigProfileInstalled in migration modal")
+			} else if fileExists {
+				log.Info().Msg("checking for existence of cloudConfigProfileInstalled in migration modal: found")
+			} else {
+				log.Info().Msg("checking for existence of cloudConfigProfileInstalled in migration modal: not found")
+				unenrolled = true
+			}
 		}
 
 		statusEnrolled, serverURL, statusErr := checkStatusFn()
@@ -326,7 +365,33 @@ func (m *swiftDialogMDMMigrator) waitForUnenrollment() error {
 }
 
 func (m *swiftDialogMDMMigrator) renderMigration() error {
-	message, flags, err := m.getMessageAndFlags()
+	log.Debug().Msg("checking current enrollment status")
+	isCurrentlyManuallyEnrolled, err := profiles.IsManuallyEnrolledInMDM()
+	if err != nil {
+		return err
+	}
+
+	// Check what kind of migration was in progress, if any.
+	previousMigrationType, err := m.mrw.GetMigrationType()
+	if err != nil {
+		log.Error().Err(err).Msg("getting migration type")
+		return fmt.Errorf("getting migration type: %w", err)
+	}
+
+	isManualMigration := isCurrentlyManuallyEnrolled || previousMigrationType == constant.MDMMigrationTypeManual
+	isADEMigration := previousMigrationType == constant.MDMMigrationTypeADE
+
+	log.Debug().Bool("isManualMigration", isManualMigration).Bool("isADEMigration", isADEMigration).Bool("isCurrentlyManuallyEnrolled", isCurrentlyManuallyEnrolled).Str("previousMigrationType", previousMigrationType).Msg("props after assigning")
+
+	vers, err := m.getMacOSMajorVersion()
+	if err != nil {
+		// log error for debugging and continue with default template
+		log.Error().Err(err).Msg("getting macOS major version failed: using default migration template")
+	}
+
+	isPreSonoma := vers < constant.SonomaMajorVersion
+
+	message, flags, err := m.getMessageAndFlags(vers, isManualMigration)
 	if err != nil {
 		return fmt.Errorf("getting mdm migrator message: %w", err)
 	}
@@ -342,9 +407,24 @@ func (m *swiftDialogMDMMigrator) renderMigration() error {
 			return nil
 		}
 
+		if previousMigrationType == constant.MDMMigrationTypeADE {
+			// Do nothing; the Remote Management modal will be launched by Orbit every minute.
+			return nil
+		}
+
+		if previousMigrationType == constant.MDMMigrationTypeManual || previousMigrationType == constant.MDMMigrationTypePreSonoma {
+			// Launch the "My device" page.
+			log.Info().Msg("showing instructions")
+
+			if err := m.handler.ShowInstructions(); err != nil {
+				return err
+			}
+			return nil
+		}
+
 		if !m.props.IsUnmanaged {
 			// show the loading spinner
-			m.renderLoadingSpinner()
+			m.renderLoadingSpinner(isPreSonoma, isCurrentlyManuallyEnrolled)
 
 			// send the API call
 			if notifyErr := m.handler.NotifyRemote(); notifyErr != nil {
@@ -361,7 +441,7 @@ func (m *swiftDialogMDMMigrator) renderMigration() error {
 			}
 
 			log.Info().Msg("webhook sent, checking for unenrollment")
-			if err := m.waitForUnenrollment(); err != nil {
+			if err := m.waitForUnenrollment(isADEMigration); err != nil {
 				m.baseDialog.Exit()
 				errDialogExitChan, errDialogErrChan := m.renderError()
 				select {
@@ -374,6 +454,35 @@ func (m *swiftDialogMDMMigrator) renderMigration() error {
 				}
 			}
 
+			switch {
+			case isPreSonoma:
+				if err := m.mrw.SetMigrationFile(constant.MDMMigrationTypePreSonoma); err != nil {
+					log.Error().Str("migration_type", constant.MDMMigrationTypeADE).Err(err).Msg("set migration file")
+				}
+
+				log.Info().Msg("showing instructions after pre-sonoma unenrollment")
+				if err := m.handler.ShowInstructions(); err != nil {
+					return err
+				}
+
+			case isManualMigration:
+				if err := m.mrw.SetMigrationFile(constant.MDMMigrationTypeManual); err != nil {
+					log.Error().Str("migration_type", constant.MDMMigrationTypeManual).Err(err).Msg("set migration file")
+				}
+
+				log.Info().Msg("showing instructions after manual unenrollment")
+				if err := m.handler.ShowInstructions(); err != nil {
+					return err
+				}
+
+				m.frequency = 3 * time.Minute
+
+			default:
+				if err := m.mrw.SetMigrationFile(constant.MDMMigrationTypeADE); err != nil {
+					log.Error().Str("migration_type", constant.MDMMigrationTypeADE).Err(err).Msg("set migration file")
+				}
+			}
+
 			// close the spinner
 			// TODO: maybe it's better to use
 			// https://github.com/bartreardon/swiftDialog/wiki/Updating-Dialog-with-new-content
@@ -381,10 +490,6 @@ func (m *swiftDialogMDMMigrator) renderMigration() error {
 			m.baseDialog.Exit()
 		}
 
-		log.Info().Msg("showing instructions")
-		if err := m.handler.ShowInstructions(); err != nil {
-			return err
-		}
 	}
 
 	return nil
@@ -435,16 +540,14 @@ func (m *swiftDialogMDMMigrator) SetProps(props MDMMigratorProps) {
 	m.props = props
 }
 
-func (m *swiftDialogMDMMigrator) getMessageAndFlags() (*bytes.Buffer, []string, error) {
-	vers, err := m.getMacOSMajorVersion()
-	if err != nil {
-		// log error for debugging and continue with default template
-		log.Error().Err(err).Msg("getting macOS major version failed: using default migration template")
+func (m *swiftDialogMDMMigrator) getMessageAndFlags(version int, isManualMigration bool) (*bytes.Buffer, []string, error) {
+	tmpl := mdmADEMigrationTemplate
+	if isManualMigration {
+		tmpl = mdmManualMigrationTemplate
 	}
 
-	tmpl := mdmMigrationTemplate
 	height := "669"
-	if vers != 0 && vers < 14 {
+	if version != 0 && version < constant.SonomaMajorVersion {
 		height = "440"
 		tmpl = mdmMigrationTemplatePreSonoma
 	}
@@ -454,7 +557,7 @@ func (m *swiftDialogMDMMigrator) getMessageAndFlags() (*bytes.Buffer, []string,
 		&message,
 		m.props,
 	); err != nil {
-		return nil, nil, fmt.Errorf("executing migrqation template: %w", err)
+		return nil, nil, fmt.Errorf("executing migration template: %w", err)
 	}
 
 	flags := []string{
@@ -465,6 +568,13 @@ func (m *swiftDialogMDMMigrator) getMessageAndFlags() (*bytes.Buffer, []string,
 		"--height", height,
 	}
 
+	if !m.props.DisableTakeover {
+		flags = append(flags,
+			"--blurscreen",
+			"--ontop",
+		)
+	}
+
 	if m.props.OrgInfo.ContactURL != "" {
 		flags = append(flags,
 			// info button
@@ -502,3 +612,236 @@ func (m *swiftDialogMDMMigrator) getMacOSMajorVersion() (int, error) {
 	}
 	return major, nil
 }
+
+func (m *swiftDialogMDMMigrator) MigrationInProgress() (string, error) {
+	return m.mrw.GetMigrationType()
+}
+
+func (m *swiftDialogMDMMigrator) MarkMigrationCompleted() error {
+	// Reset this to the original frequency.
+	m.frequency = 15 * time.Minute
+	return m.mrw.RemoveFile()
+}
+
+type offlineWatcher struct {
+	client          *service.DeviceClient
+	swiftDialogPath string
+	// swiftDialogCh is shared with the migrator and used to ensure only one dialog is open at a time
+	swiftDialogCh chan struct{}
+	fileWatcher   migration.FileWatcher
+}
+
+// StartMDMMigrationOfflineWatcher starts a watcher running on a 3-minute loop that checks if the
+// device goes offline in the process of migrating to Fleet's MDM and offline. If so, it shows a
+// dialog to prompt the user to connect to the internet.
+func StartMDMMigrationOfflineWatcher(ctx context.Context, client *service.DeviceClient, swiftDialogPath string, swiftDialogCh chan struct{}, fileWatcher migration.FileWatcher) MDMOfflineWatcher {
+	if cap(swiftDialogCh) != 1 {
+		log.Fatal().Msg("swift dialog channel must have a buffer size of 1")
+	}
+
+	watcher := &offlineWatcher{
+		client:          client,
+		swiftDialogPath: swiftDialogPath,
+		swiftDialogCh:   swiftDialogCh,
+		fileWatcher:     fileWatcher,
+	}
+
+	// start loop with 3-minute interval to ping server and show dialog if offline
+	go func() {
+		ticker := time.NewTicker(constant.MDMMigrationOfflineWatcherInterval)
+		defer ticker.Stop()
+
+		log.Info().Msg("starting watcher loop")
+		for {
+			select {
+			case <-ctx.Done():
+				log.Debug().Msg("stopping offline dialog loop")
+				return
+			case <-ticker.C:
+				log.Debug().Msg("offline dialog, got tick")
+				go watcher.ShowIfOffline(ctx)
+			}
+		}
+	}()
+
+	return watcher
+}
+
+// ShowIfOffline shows the offline dialog if the host is offline.
+// It returns true if the host is offline, and false otherwise.
+func (o *offlineWatcher) ShowIfOffline(ctx context.Context) bool {
+	// try the dialog channel
+	select {
+	case o.swiftDialogCh <- struct{}{}:
+		log.Debug().Msg("occupying dialog channel")
+	default:
+		log.Debug().Msg("dialog channel already occupied")
+		return false
+	}
+
+	defer func() {
+		// non-blocking release of dialog channel
+		select {
+		case <-o.swiftDialogCh:
+			log.Debug().Msg("releasing dialog channel")
+		default:
+			// this shouldn't happen so log for debugging
+			log.Debug().Msg("dialog channel already released")
+		}
+	}()
+
+	if !o.isUnmanaged() || !o.isOffline() {
+		return false
+	}
+
+	log.Info().Msg("showing offline dialog")
+	if err := o.showSwiftDialogMDMMigrationOffline(ctx); err != nil {
+		log.Error().Err(err).Msg("error showing offline dialog")
+	} else {
+		log.Info().Msg("done showing offline dialog")
+	}
+
+	return true
+}
+
+func (o *offlineWatcher) isUnmanaged() bool {
+	mt, err := o.fileWatcher.GetMigrationType()
+	if err != nil {
+		log.Error().Err(err).Msg("getting migration type")
+	}
+
+	if mt == "" {
+		log.Debug().Msg("offline dialog, no migration type found, do nothing")
+		return false
+	}
+
+	log.Debug().Msgf("offline dialog, device is unmanaged, migration type %s", mt)
+
+	return true
+}
+
+func (o *offlineWatcher) isOffline() bool {
+	err := o.client.Ping()
+	if err == nil {
+		log.Debug().Msg("offline dialog, ping ok, device is online")
+		return false
+	}
+	if !isOfflineError(err) {
+		log.Error().Err(err).Msg("offline dialog, error pinging server does not contain dial tcp or no such host, assuming device is online")
+		return false
+	}
+	log.Debug().Err(err).Msg("offline dialog, error pinging server, assuming device is offline")
+
+	return true
+}
+
+func isOfflineError(err error) bool {
+	if err == nil {
+		return false
+	}
+	offlineMsgs := []string{"no such host", "dial tcp", "no route to host"}
+	for _, msg := range offlineMsgs {
+		if strings.Contains(err.Error(), msg) {
+			return true
+		}
+	}
+
+	//  //  NOTE: We're starting with basic string matching and planning to improve error matching
+	//  // in future iterations. Here's some ideas for stuff to add in addition to strings.Contains:
+	// 	if urlErr, ok := err.(*url.Error); ok {
+	// 		log.Info().Msg("is url error")
+	// 		if urlErr.Timeout() {
+	// 			log.Info().Msg("is timeout")
+	// 			return true
+	// 		}
+	// 		// Check for no such host error
+	// 		if opErr, ok := urlErr.Err.(*net.OpError); ok {
+	// 			log.Info().Msg("is net op error")
+	// 			if dnsErr, ok := opErr.Err.(*net.DNSError); ok {
+	// 				log.Info().Msg("is dns error")
+	// 				if dnsErr.Err == "no such host" {
+	// 					log.Info().Msg("is dns no such host")
+	// 					return true
+	// 				}
+	// 			}
+	// 		}
+	// 	}
+
+	return false
+}
+
+// ShowDialogMDMMigrationOffline displays the dialog every time is called
+func (o *offlineWatcher) showSwiftDialogMDMMigrationOffline(ctx context.Context) error {
+	props := MDMMigratorProps{
+		DisableTakeover: true,
+	}
+	m := swiftDialogMDMMigrationOffline{
+		baseDialog: newBaseDialog(o.swiftDialogPath),
+		props:      props,
+	}
+
+	flags, err := m.getFlags()
+	if err != nil {
+		return fmt.Errorf("getting flags for offline dialog: %w", err)
+	}
+
+	exitCodeCh, errCh := m.render(flags...)
+
+	select {
+	case <-ctx.Done():
+		log.Debug().Msg("dialog context canceled")
+		m.baseDialog.Exit()
+		return nil
+	case err := <-errCh:
+		return fmt.Errorf("showing offline dialog: %w", err)
+	case <-exitCodeCh:
+		// there's only one button, so we don't need to check the exit code
+		log.Info().Msg("closing offline dialog")
+		return nil
+	}
+}
+
+type swiftDialogMDMMigrationOffline struct {
+	*baseDialog
+	props MDMMigratorProps
+}
+
+func (m *swiftDialogMDMMigrationOffline) render(flags ...string) (chan swiftDialogExitCode, chan error) {
+	return m.baseDialog.render(flags...)
+}
+
+func (m *swiftDialogMDMMigrationOffline) getFlags() ([]string, error) {
+	tmpl := mdmMigrationTemplateOffline
+	var message bytes.Buffer
+	if err := tmpl.Execute(
+		&message,
+		nil,
+	); err != nil {
+		return nil, fmt.Errorf("executing migration template: %w", err)
+	}
+
+	// disable the built-in title and icon so we have full control over content
+	title := "none"
+	icon := "none"
+
+	flags := []string{
+		"--height", "124",
+		"--alignment", "center",
+		"--title", title,
+		"--icon", icon,
+		// modal content
+		"--message", message.String(),
+		"--messagefont", "size=16",
+		// main button
+		"--button1text", "Close",
+	}
+
+	if !m.props.DisableTakeover {
+		flags = append(flags,
+			"--blurscreen",
+			"--ontop",
+		)
+	}
+
+	return flags, nil
+}
diff --git a/orbit/pkg/useraction/mdm_migration_darwin_test.go b/orbit/pkg/useraction/mdm_migration_darwin_test.go
index 76be50f9644e..d71cb6fbb661 100644
--- a/orbit/pkg/useraction/mdm_migration_darwin_test.go
+++ b/orbit/pkg/useraction/mdm_migration_darwin_test.go
@@ -17,6 +17,7 @@ func (d dummyHandler) NotifyRemote() error {
 func (d dummyHandler) ShowInstructions() error { return nil }
 
 func TestWaitForUnenrollment(t *testing.T) {
+	t.Parallel()
 	m := &swiftDialogMDMMigrator{
 		handler:                   dummyHandler{},
 		baseDialog:                newBaseDialog("foo/bar"),
@@ -51,7 +52,7 @@ func TestWaitForUnenrollment(t *testing.T) {
 				return true, "example.com", nil
 			}
 
-			outErr := m.waitForUnenrollment()
+			outErr := m.waitForUnenrollment(true)
 			if c.wantErr {
 				require.Error(t, outErr)
 			} else {
@@ -70,7 +71,27 @@ func TestWaitForUnenrollment(t *testing.T) {
 			return false, "", nil
 		}
 
-		outErr := m.waitForUnenrollment()
+		outErr := m.waitForUnenrollment(true)
 		require.NoError(t, outErr)
 	})
+
+	t.Run("only check file during ADE enrollment", func(t *testing.T) {
+		var fileWasChecked bool
+		m.testEnrollmentCheckFileFn = func() (bool, error) {
+			fileWasChecked = true
+			return true, nil
+		}
+
+		m.testEnrollmentCheckStatusFn = func() (bool, string, error) {
+			return false, "", nil
+		}
+
+		err := m.waitForUnenrollment(false)
+		require.NoError(t, err)
+		require.False(t, fileWasChecked)
+
+		err = m.waitForUnenrollment(true)
+		require.NoError(t, err)
+		require.True(t, fileWasChecked)
+	})
 }
diff --git a/orbit/pkg/useraction/mdm_migration_notdarwin.go b/orbit/pkg/useraction/mdm_migration_notdarwin.go
index 98615a193c18..5b16b395e0fe 100644
--- a/orbit/pkg/useraction/mdm_migration_notdarwin.go
+++ b/orbit/pkg/useraction/mdm_migration_notdarwin.go
@@ -2,16 +2,32 @@
 
 package useraction
 
-import "time"
+import (
+	"context"
+	"time"
 
-func NewMDMMigrator(path string, frequency time.Duration, handler MDMMigratorHandler) MDMMigrator {
+	"github.com/fleetdm/fleet/v4/orbit/pkg/migration"
+	"github.com/fleetdm/fleet/v4/server/service"
+)
+
+func NewMDMMigrator(path string, frequency time.Duration, handler MDMMigratorHandler, mrw *migration.ReadWriter, fleetURL string, showCh chan struct{}) MDMMigrator {
 	return &NoopMDMMigrator{}
 }
 
+func StartMDMMigrationOfflineWatcher(ctx context.Context, client *service.DeviceClient, swiftDialogPath string, swiftDialogCh chan struct{}, fileWatcher migration.FileWatcher) MDMOfflineWatcher {
+	return &NoopOfflineWatcher{}
+}
+
+type NoopOfflineWatcher struct{}
+
+func (o *NoopOfflineWatcher) ShowIfOffline(ctx context.Context) bool { return false }
+
 type NoopMDMMigrator struct{}
 
-func (m *NoopMDMMigrator) CanRun() bool              { return false }
-func (m *NoopMDMMigrator) SetProps(MDMMigratorProps) {}
-func (m *NoopMDMMigrator) Show() error               { return nil }
-func (m *NoopMDMMigrator) ShowInterval() error       { return nil }
-func (m *NoopMDMMigrator) Exit()                     {}
+func (m *NoopMDMMigrator) CanRun() bool                         { return false }
+func (m *NoopMDMMigrator) SetProps(MDMMigratorProps)            {}
+func (m *NoopMDMMigrator) Show() error                          { return nil }
+func (m *NoopMDMMigrator) ShowInterval() error                  { return nil }
+func (m *NoopMDMMigrator) Exit()                                {}
+func (m *NoopMDMMigrator) MigrationInProgress() (string, error) { return "", nil }
+func (m *NoopMDMMigrator) MarkMigrationCompleted() error        { return nil }
diff --git a/orbit/tools/cleanup/cleanup_macos.sh b/orbit/tools/cleanup/cleanup_macos.sh
index 4a9c3b2283fb..2d66e72b0264 100755
--- a/orbit/tools/cleanup/cleanup_macos.sh
+++ b/orbit/tools/cleanup/cleanup_macos.sh
@@ -23,7 +23,13 @@ if [ "$1" = "remove" ]; then
     # Give the parent process time to report the success before removing
     echo "inside remove process" >>/tmp/fleet_remove_log.txt
     sleep 15
-    remove_fleet >>/tmp/fleet_remove_log.txt 2>&1
+    if [ -z "$GITHUB_ACTIONS" ]; then
+        # We are root
+        remove_fleet >>/tmp/fleet_remove_log.txt 2>&1
+    else
+        # Inside a github action, sudo is passwordless
+        sudo remove_fleet >>/tmp/fleet_remove_log.txt 2>&1
+    fi
 else
     # We are in the parent shell, start the detached child and return success
     echo "Removing fleet, system will be unenrolled in 15 seconds..."
diff --git a/package.json b/package.json
index 7171ac7fbf6e..a223664f6703 100644
--- a/package.json
+++ b/package.json
@@ -18,7 +18,8 @@
   "dependencies": {
     "@types/dompurify": "3.0.2",
     "ace-builds": "1.4.12",
-    "axios": "1.6.0",
+    "axios": "1.7.4",
+    "content-disposition": "0.5.4",
     "core-js": "3.25.1",
     "date-fns": "3.6.0",
     "date-fns-tz": "3.1.3",
@@ -99,6 +100,7 @@
     "@tsconfig/recommended": "1.0.1",
     "@types/chrome": "0.0.237",
     "@types/classnames": "0.0.32",
+    "@types/content-disposition": "0.5.4",
     "@types/expect": "1.20.3",
     "@types/file-saver": "2.0.5",
     "@types/jest": "29.5.12",
diff --git a/pkg/download/download.go b/pkg/download/download.go
index 89fbea8c3ed1..23c0f5c152ea 100644
--- a/pkg/download/download.go
+++ b/pkg/download/download.go
@@ -79,6 +79,10 @@ func download(client *http.Client, u *url.URL, path string, extract bool) error
 		}
 		defer resp.Body.Close()
 
+		if resp.StatusCode != http.StatusOK {
+			return fmt.Errorf("unexpected status code %d", resp.StatusCode)
+		}
+
 		r := io.Reader(resp.Body)
 
 		// extract (optional)
diff --git a/pkg/file/file_test.go b/pkg/file/file_test.go
index ceccdc9f6cef..73d1ad557388 100644
--- a/pkg/file/file_test.go
+++ b/pkg/file/file_test.go
@@ -104,10 +104,11 @@ func TestExists(t *testing.T) {
 //
 // That is, it breaks the file name at the dollar sign and the first part is
 // the expected name, the second is the expected version, the third is the
-// hex-encoded hash. Note that by default, files in testdata/installers are NOT
-// included in git, so the test files must be added manually (for size and
-// licenses considerations). Why the dollar sign? Because dots, dashes and
-// underlines are more likely to be part of the name or version.
+// hex-encoded hash and the fourth is the bundle identifier. Note that by
+// default, files in testdata/installers are NOT included in git, so the test
+// files must be added manually (for size and licenses considerations). Why the
+// dollar sign? Because dots, dashes and underlines are more likely to be part
+// of the name or version.
 func TestExtractInstallerMetadata(t *testing.T) {
 	dents, err := os.ReadDir(filepath.Join("testdata", "installers"))
 	if err != nil {
@@ -120,8 +121,8 @@ func TestExtractInstallerMetadata(t *testing.T) {
 		}
 		t.Run(dent.Name(), func(t *testing.T) {
 			parts := strings.Split(strings.TrimSuffix(dent.Name(), filepath.Ext(dent.Name())), "$")
-			if len(parts) < 3 {
-				t.Fatalf("invalid filename, expected at least 3 sections, got %d: %s", len(parts), dent.Name())
+			if len(parts) < 4 {
+				t.Fatalf("invalid filename, expected at least 4 sections, got %d: %s", len(parts), dent.Name())
 			}
 			wantName, wantVersion, wantHash, wantBundleIdentifier := parts[0], parts[1], parts[2], parts[3]
 			wantExtension := strings.TrimPrefix(filepath.Ext(dent.Name()), ".")
diff --git a/pkg/file/pe.go b/pkg/file/pe.go
index 1a436665e933..1b0e053c09e7 100644
--- a/pkg/file/pe.go
+++ b/pkg/file/pe.go
@@ -50,9 +50,37 @@ func ExtractPEMetadata(r io.Reader) (*InstallerMetadata, error) {
 	if err != nil {
 		return nil, fmt.Errorf("error parsing PE version resources: %w", err)
 	}
-	return &InstallerMetadata{
+	return applySpecialCases(&InstallerMetadata{
 		Name:    strings.TrimSpace(v["ProductName"]),
 		Version: strings.TrimSpace(v["ProductVersion"]),
 		SHASum:  h.Sum(nil),
-	}, nil
+	}, v), nil
+}
+
+var exeSpecialCases = map[string]func(*InstallerMetadata, map[string]string) *InstallerMetadata{
+	"Notion": func(meta *InstallerMetadata, resources map[string]string) *InstallerMetadata {
+		if meta.Version != "" {
+			meta.Name = meta.Name + " " + meta.Version
+		}
+		return meta
+	},
+}
+
+// Unlike .exe files that are the software itself (and just need to be copied
+// over to the host), and unlike standard installer formats like .msi where the
+// metadata defines the name under which the software will be installed, .exe
+// installers may do pretty much anything they want when installing the
+// software, regardless of what the .exe metadata contains.
+//
+// For example, the Notion .exe installer installs the app under a name like
+// "Notion 3.11.1", and not just "Notion". There's no way to detect that by
+// parsing the installer's metadata, so we need to apply some special cases at
+// least for the most popular apps that use unusual naming.
+//
+// See https://github.com/fleetdm/fleet/issues/20440#issuecomment-2260500661
+func applySpecialCases(meta *InstallerMetadata, resources map[string]string) *InstallerMetadata {
+	if fn := exeSpecialCases[meta.Name]; fn != nil {
+		return fn(meta, resources)
+	}
+	return meta
 }
diff --git a/pkg/file/testdata/distribution/distribution-zoom-full.xml b/pkg/file/testdata/distribution/distribution-zoom-full.xml
new file mode 100644
index 000000000000..760c52206ebe
--- /dev/null
+++ b/pkg/file/testdata/distribution/distribution-zoom-full.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<installer-gui-script minSpecVersion="1">
+  <pkg-ref id="us.zoom.pkg.videomeeting"/>
+  <title>Zoom Workplace</title>
+  <options hostArchitectures="x86_64,arm64"/>
+  <options customize="never"/>
+  <domains enable_currentUserHome="true" enable_localSystem="true"/>
+  <options customLocation="Applications" customLocationAllowAlternateVolumes="true"/>
+  <options allow-external-scripts="false"/>
+  <welcome file="Welcome.rtf"/>
+  <!--    
+    <readme file="ReadMe.rtf"/>
+-->
+  <background file="background.png" scaling="proportional" alignment="bottomleft"/>
+  <allowed-os-versions>
+    <os-version min="10.13"/>
+  </allowed-os-versions>
+  <pkg-ref id="us.zoom.pkg.videomeeting">
+    <must-close>
+      <app id="us.zoom.xos"/>
+    </must-close>
+    <bundle-version/>
+  </pkg-ref>
+  <choices-outline>
+    <line choice="default">
+      <line choice="us.zoom.pkg.videomeeting"/>
+    </line>
+  </choices-outline>
+  <choice id="default"/>
+  <choice id="us.zoom.pkg.videomeeting" visible="false">
+    <pkg-ref id="us.zoom.pkg.videomeeting"/>
+  </choice>
+  <pkg-ref id="us.zoom.pkg.videomeeting" version="6.1.1.36333" onConclusion="none" installKBytes="308054">#zoomus.pkg</pkg-ref>
+  <product version="6.1.1.36333"/>
+</installer-gui-script>
diff --git a/pkg/file/xar.go b/pkg/file/xar.go
index 917f5e2a6204..e4d75f9b5c8f 100644
--- a/pkg/file/xar.go
+++ b/pkg/file/xar.go
@@ -262,7 +262,11 @@ out:
 				identifier = pkg.MustClose.Apps[0].ID
 				break
 			}
+		}
+	}
 
+	if identifier == "" {
+		for _, pkg := range d.PkgRefs {
 			if pkg.PackageIdentifier != "" {
 				identifier = pkg.PackageIdentifier
 				break
diff --git a/pkg/file/xar_test.go b/pkg/file/xar_test.go
index deed6c4397ac..cef5230fb9dd 100644
--- a/pkg/file/xar_test.go
+++ b/pkg/file/xar_test.go
@@ -154,6 +154,12 @@ func TestParseRealDistributionFiles(t *testing.T) {
 			expectedVersion:  "24.1.32.9774",
 			expectedBundleID: "com.ringcentral.glip",
 		},
+		{
+			file:             "distribution-zoom-full.xml",
+			expectedName:     "Zoom Workplace",
+			expectedVersion:  "6.1.1.36333",
+			expectedBundleID: "us.zoom.xos",
+		},
 	}
 
 	for _, tt := range tests {
diff --git a/pkg/mdm/mdmtest/apple.go b/pkg/mdm/mdmtest/apple.go
index 52bfdd17549c..326d40be601b 100644
--- a/pkg/mdm/mdmtest/apple.go
+++ b/pkg/mdm/mdmtest/apple.go
@@ -500,6 +500,26 @@ func (c *TestAppleMDMClient) AcknowledgeDeviceInformation(udid, cmdUUID, deviceN
 	return c.sendAndDecodeCommandResponse(payload)
 }
 
+func (c *TestAppleMDMClient) AcknowledgeInstalledApplicationList(udid, cmdUUID string, software []fleet.Software) (*mdm.Command, error) {
+	mdmSoftware := make([]map[string]interface{}, 0, len(software))
+	for _, s := range software {
+		mdmSoftware = append(mdmSoftware, map[string]interface{}{
+			"Name":         s.Name,
+			"ShortVersion": s.Version,
+			"Identifier":   s.BundleIdentifier,
+		})
+	}
+
+	payload := map[string]any{
+		"Status":                   "Acknowledged",
+		"UDID":                     udid,
+		"CommandUUID":              cmdUUID,
+		"InstalledApplicationList": mdmSoftware,
+	}
+
+	return c.sendAndDecodeCommandResponse(payload)
+}
+
 func (c *TestAppleMDMClient) GetBootstrapToken() ([]byte, error) {
 	payload := map[string]any{
 		"MessageType":  "GetBootstrapToken",
diff --git a/pkg/spec/gitops.go b/pkg/spec/gitops.go
index a416c3378747..558d7a1f06c6 100644
--- a/pkg/spec/gitops.go
+++ b/pkg/spec/gitops.go
@@ -10,6 +10,7 @@ import (
 	"unicode"
 
 	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/ghodss/yaml"
 	"github.com/hashicorp/go-multierror"
 	"golang.org/x/text/unicode/norm"
@@ -22,6 +23,8 @@ type BaseItem struct {
 type Controls struct {
 	BaseItem
 	MacOSUpdates   interface{} `json:"macos_updates"`
+	IOSUpdates     interface{} `json:"ios_updates"`
+	IPadOSUpdates  interface{} `json:"ipados_updates"`
 	MacOSSettings  interface{} `json:"macos_settings"`
 	MacOSSetup     interface{} `json:"macos_setup"`
 	MacOSMigration interface{} `json:"macos_migration"`
@@ -37,7 +40,19 @@ type Controls struct {
 
 type Policy struct {
 	BaseItem
+	GitOpsPolicySpec
+}
+
+type GitOpsPolicySpec struct {
 	fleet.PolicySpec
+	InstallSoftware *PolicyInstallSoftware `json:"install_software"`
+	// InstallSoftwareURL is populated after parsing the software installer yaml
+	// referenced by InstallSoftware.PackagePath.
+	InstallSoftwareURL string `json:"-"`
+}
+
+type PolicyInstallSoftware struct {
+	PackagePath string `json:"package_path"`
 }
 
 type Query struct {
@@ -45,6 +60,16 @@ type Query struct {
 	fleet.QuerySpec
 }
 
+type SoftwarePackage struct {
+	BaseItem
+	fleet.SoftwarePackageSpec
+}
+
+type Software struct {
+	Packages     []SoftwarePackage           `json:"packages"`
+	AppStoreApps []fleet.TeamSpecAppStoreApp `json:"app_store_apps"`
+}
+
 type GitOps struct {
 	TeamID       *uint
 	TeamName     *string
@@ -52,14 +77,19 @@ type GitOps struct {
 	OrgSettings  map[string]interface{}
 	AgentOptions *json.RawMessage
 	Controls     Controls
-	Policies     []*fleet.PolicySpec
+	Policies     []*GitOpsPolicySpec
 	Queries      []*fleet.QuerySpec
 	// Software is only allowed on teams, not on global config.
-	Software []*fleet.TeamSpecSoftware
+	Software GitOpsSoftware
+}
+
+type GitOpsSoftware struct {
+	Packages     []*fleet.SoftwarePackageSpec
+	AppStoreApps []*fleet.TeamSpecAppStoreApp
 }
 
 // GitOpsFromFile parses a GitOps yaml file.
-func GitOpsFromFile(filePath, baseDir string) (*GitOps, error) {
+func GitOpsFromFile(filePath, baseDir string, appConfig *fleet.EnrichedAppConfig) (*GitOps, error) {
 	b, err := os.ReadFile(filePath)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read file: %s: %w", filePath, err)
@@ -89,18 +119,16 @@ func GitOpsFromFile(filePath, baseDir string) (*GitOps, error) {
 	// Figure out if this is an org or team settings file
 	teamRaw, teamOk := top["name"]
 	teamSettingsRaw, teamSettingsOk := top["team_settings"]
-	teamSoftware, teamSoftwareOk := top["software"]
 	orgSettingsRaw, orgOk := top["org_settings"]
 	if orgOk {
-		if teamOk || teamSettingsOk || teamSoftwareOk {
-			multiError = multierror.Append(multiError, errors.New("'org_settings' cannot be used with 'name', 'team_settings' or 'software'"))
+		if teamOk || teamSettingsOk {
+			multiError = multierror.Append(multiError, errors.New("'org_settings' cannot be used with 'name', 'team_settings'"))
 		} else {
 			multiError = parseOrgSettings(orgSettingsRaw, result, baseDir, multiError)
 		}
 	} else if teamOk && teamSettingsOk {
 		multiError = parseName(teamRaw, result, multiError)
 		multiError = parseTeamSettings(teamSettingsRaw, result, baseDir, multiError)
-		multiError = parseSoftware(teamSoftware, result, baseDir, multiError)
 	} else {
 		multiError = multierror.Append(multiError, errors.New("either 'org_settings' or 'name' and 'team_settings' is required"))
 	}
@@ -108,9 +136,15 @@ func GitOpsFromFile(filePath, baseDir string) (*GitOps, error) {
 	// Validate the required top level options
 	multiError = parseControls(top, result, baseDir, multiError)
 	multiError = parseAgentOptions(top, result, baseDir, multiError)
-	multiError = parsePolicies(top, result, baseDir, multiError)
 	multiError = parseQueries(top, result, baseDir, multiError)
 
+	if appConfig != nil && appConfig.License.IsPremium() {
+		multiError = parseSoftware(top, result, baseDir, multiError)
+	}
+
+	// Policies can reference software installers, thus we parse them after parseSoftware.
+	multiError = parsePolicies(top, result, baseDir, multiError)
+
 	return result, multiError.ErrorOrNil()
 }
 
@@ -380,7 +414,11 @@ func parsePolicies(top map[string]json.RawMessage, result *GitOps, baseDir strin
 	for _, item := range policies {
 		item := item
 		if item.Path == nil {
-			result.Policies = append(result.Policies, &item.PolicySpec)
+			if err := parsePolicyInstallSoftware(baseDir, result.TeamName, &item, result.Software.Packages); err != nil {
+				multiError = multierror.Append(multiError, fmt.Errorf("failed to parse policy install_software %q: %v", item.Name, err))
+				continue
+			}
+			result.Policies = append(result.Policies, &item.GitOpsPolicySpec)
 		} else {
 			fileBytes, err := os.ReadFile(resolveApplyRelativePath(baseDir, *item.Path))
 			if err != nil {
@@ -407,7 +445,11 @@ func parsePolicies(top map[string]json.RawMessage, result *GitOps, baseDir strin
 								multiError, fmt.Errorf("nested paths are not supported: %s in %s", *pp.Path, *item.Path),
 							)
 						} else {
-							result.Policies = append(result.Policies, &pp.PolicySpec)
+							if err := parsePolicyInstallSoftware(baseDir, result.TeamName, pp, result.Software.Packages); err != nil {
+								multiError = multierror.Append(multiError, fmt.Errorf("failed to parse policy install_software %q: %v", pp.Name, err))
+								continue
+							}
+							result.Policies = append(result.Policies, &pp.GitOpsPolicySpec)
 						}
 					}
 				}
@@ -431,7 +473,7 @@ func parsePolicies(top map[string]json.RawMessage, result *GitOps, baseDir strin
 		}
 	}
 	duplicates := getDuplicateNames(
-		result.Policies, func(p *fleet.PolicySpec) string {
+		result.Policies, func(p *GitOpsPolicySpec) string {
 			return p.Name
 		},
 	)
@@ -441,6 +483,39 @@ func parsePolicies(top map[string]json.RawMessage, result *GitOps, baseDir strin
 	return multiError
 }
 
+func parsePolicyInstallSoftware(baseDir string, teamName *string, policy *Policy, packages []*fleet.SoftwarePackageSpec) error {
+	if policy.InstallSoftware == nil {
+		policy.SoftwareTitleID = ptr.Uint(0) // unset the installer
+		return nil
+	}
+	if policy.InstallSoftware != nil && policy.InstallSoftware.PackagePath != "" && teamName == nil {
+		return errors.New("install_software can only be set on team policies")
+	}
+	if policy.InstallSoftware.PackagePath == "" {
+		return errors.New("empty package_path")
+	}
+	fileBytes, err := os.ReadFile(resolveApplyRelativePath(baseDir, policy.InstallSoftware.PackagePath))
+	if err != nil {
+		return fmt.Errorf("failed to read install_software.package_path file %q: %v", policy.InstallSoftware.PackagePath, err)
+	}
+	var policyInstallSoftwareSpec fleet.SoftwarePackageSpec
+	if err := yaml.Unmarshal(fileBytes, &policyInstallSoftwareSpec); err != nil {
+		return fmt.Errorf("failed to unmarshal install_software.package_path file %s: %v", policy.InstallSoftware.PackagePath, err)
+	}
+	installerOnTeamFound := false
+	for _, pkg := range packages {
+		if pkg.URL == policyInstallSoftwareSpec.URL {
+			installerOnTeamFound = true
+			break
+		}
+	}
+	if !installerOnTeamFound {
+		return fmt.Errorf("install_software.package_path URL %s not found on team: %s", policyInstallSoftwareSpec.URL, policy.InstallSoftware.PackagePath)
+	}
+	policy.InstallSoftwareURL = policyInstallSoftwareSpec.URL
+	return nil
+}
+
 func parseQueries(top map[string]json.RawMessage, result *GitOps, baseDir string, multiError *multierror.Error) *multierror.Error {
 	queriesRaw, ok := top["queries"]
 	if !ok {
@@ -516,21 +591,55 @@ func parseQueries(top map[string]json.RawMessage, result *GitOps, baseDir string
 	return multiError
 }
 
-func parseSoftware(softwareRaw json.RawMessage, result *GitOps, baseDir string, multiError *multierror.Error) *multierror.Error {
-	var softwareInstallers []fleet.TeamSpecSoftware
+func parseSoftware(top map[string]json.RawMessage, result *GitOps, baseDir string, multiError *multierror.Error) *multierror.Error {
+	softwareRaw, ok := top["software"]
+	if !ok {
+		return multierror.Append(multiError, errors.New("'software' is required"))
+	}
+	var software Software
 	if len(softwareRaw) > 0 {
-		if err := json.Unmarshal(softwareRaw, &softwareInstallers); err != nil {
-			return multierror.Append(multiError, fmt.Errorf("failed to unmarshal software: %v", err))
+		if err := json.Unmarshal(softwareRaw, &software); err != nil {
+			var typeErr *json.UnmarshalTypeError
+			if errors.As(err, &typeErr) {
+				return multierror.Append(multiError, fmt.Errorf("Couldn't edit software. %q must be a %s, found %s", typeErr.Field, typeErr.Type.String(), typeErr.Value))
+			}
+			return multierror.Append(multiError, fmt.Errorf("failed to unmarshall softwarespec: %v", err))
 		}
 	}
-	for _, item := range softwareInstallers {
+	for _, item := range software.AppStoreApps {
 		item := item
-		if item.URL == "" {
+		if item.AppStoreID == "" {
+			multiError = multierror.Append(multiError, errors.New("software app store id required"))
+			continue
+		}
+		result.Software.AppStoreApps = append(result.Software.AppStoreApps, &item)
+	}
+	for _, item := range software.Packages {
+		var softwarePackageSpec fleet.SoftwarePackageSpec
+		if item.Path != nil {
+			fileBytes, err := os.ReadFile(resolveApplyRelativePath(baseDir, *item.Path))
+			if err != nil {
+				multiError = multierror.Append(multiError, fmt.Errorf("failed to read policies file %s: %v", *item.Path, err))
+				continue
+			}
+			if err := yaml.Unmarshal(fileBytes, &softwarePackageSpec); err != nil {
+				multiError = multierror.Append(multiError, fmt.Errorf("failed to unmarshal software package file %s: %v", *item.Path, err))
+				continue
+			}
+		} else {
+			softwarePackageSpec = item.SoftwarePackageSpec
+		}
+		if softwarePackageSpec.URL == "" {
 			multiError = multierror.Append(multiError, errors.New("software URL is required"))
 			continue
 		}
-		result.Software = append(result.Software, &item)
+		if len(softwarePackageSpec.URL) > fleet.SoftwareInstallerURLMaxLength {
+			multiError = multierror.Append(multiError, fmt.Errorf("software URL %q is too long, must be less than 256 characters", softwarePackageSpec.URL))
+			continue
+		}
+		result.Software.Packages = append(result.Software.Packages, &softwarePackageSpec)
 	}
+
 	return multiError
 }
 
diff --git a/pkg/spec/gitops_test.go b/pkg/spec/gitops_test.go
index 8d9b00bffc40..ea01fcf1dc0e 100644
--- a/pkg/spec/gitops_test.go
+++ b/pkg/spec/gitops_test.go
@@ -5,8 +5,10 @@ import (
 	"os"
 	"path/filepath"
 	"slices"
+	"strings"
 	"testing"
 
+	"github.com/fleetdm/fleet/v4/pkg/file"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -53,7 +55,7 @@ func createTempFile(t *testing.T, pattern, contents string) (filePath string, ba
 
 func gitOpsFromString(t *testing.T, s string) (*GitOps, error) {
 	path, basePath := createTempFile(t, "", s)
-	return GitOpsFromFile(path, basePath)
+	return GitOpsFromFile(path, basePath, nil)
 }
 
 func TestValidGitOpsYaml(t *testing.T) {
@@ -108,7 +110,15 @@ func TestValidGitOpsYaml(t *testing.T) {
 					t.Parallel()
 				}
 
-				gitops, err := GitOpsFromFile(test.filePath, "./testdata")
+				var appConfig *fleet.EnrichedAppConfig
+				if test.isTeam {
+					appConfig = &fleet.EnrichedAppConfig{}
+					appConfig.License = &fleet.LicenseInfo{
+						Tier: fleet.TierPremium,
+					}
+				}
+
+				gitops, err := GitOpsFromFile(test.filePath, "./testdata", appConfig)
 				require.NoError(t, err)
 
 				if test.isTeam {
@@ -181,6 +191,10 @@ func TestValidGitOpsYaml(t *testing.T) {
 				assert.True(t, ok, "macos_setup not found")
 				_, ok = gitops.Controls.MacOSUpdates.(map[string]interface{})
 				assert.True(t, ok, "macos_updates not found")
+				_, ok = gitops.Controls.IOSUpdates.(map[string]interface{})
+				assert.True(t, ok, "ios_updates not found")
+				_, ok = gitops.Controls.IPadOSUpdates.(map[string]interface{})
+				assert.True(t, ok, "ipados_updates not found")
 				_, ok = gitops.Controls.WindowsEnabledAndConfigured.(bool)
 				assert.True(t, ok, "windows_enabled_and_configured not found")
 				_, ok = gitops.Controls.WindowsUpdates.(map[string]interface{})
@@ -197,14 +211,32 @@ func TestValidGitOpsYaml(t *testing.T) {
 				assert.Equal(t, "darwin,linux,windows", gitops.Queries[1].Platform)
 				assert.Equal(t, "osquery_info", gitops.Queries[2].Name)
 
+				// Check software
+				if test.isTeam {
+					require.Len(t, gitops.Software.Packages, 2)
+					require.Equal(t, "https://statics.teams.cdn.office.net/production-osx/enterprise/webview2/lkg/MicrosoftTeams.pkg", gitops.Software.Packages[0].URL)
+					require.False(t, gitops.Software.Packages[0].SelfService)
+					require.Equal(t, "https://ftp.mozilla.org/pub/firefox/releases/129.0.2/mac/en-US/Firefox%20129.0.2.pkg", gitops.Software.Packages[1].URL)
+					require.True(t, gitops.Software.Packages[1].SelfService)
+				}
+
 				// Check policies
-				require.Len(t, gitops.Policies, 5)
+				expectedPoliciesCount := 5
+				if test.isTeam {
+					expectedPoliciesCount = 6
+				}
+				require.Len(t, gitops.Policies, expectedPoliciesCount)
 				assert.Equal(t, "😊 Failing policy", gitops.Policies[0].Name)
 				assert.Equal(t, "Passing policy", gitops.Policies[1].Name)
 				assert.Equal(t, "No root logins (macOS, Linux)", gitops.Policies[2].Name)
 				assert.Equal(t, "🔥 Failing policy", gitops.Policies[3].Name)
 				assert.Equal(t, "linux", gitops.Policies[3].Platform)
 				assert.Equal(t, "😊😊 Failing policy", gitops.Policies[4].Name)
+				if test.isTeam {
+					assert.Equal(t, "Microsoft Teams on macOS installed and up to date", gitops.Policies[5].Name)
+					assert.NotNil(t, gitops.Policies[5].InstallSoftware)
+					assert.Equal(t, "./microsoft-teams.pkg.software.yml", gitops.Policies[5].InstallSoftware.PackagePath)
+				}
 			},
 		)
 	}
@@ -332,20 +364,20 @@ func TestMixingGlobalAndTeamConfig(t *testing.T) {
 	config := getGlobalConfig(nil)
 	config += "name: TeamName\n"
 	_, err := gitOpsFromString(t, config)
-	assert.ErrorContains(t, err, "'org_settings' cannot be used with 'name', 'team_settings' or 'software'")
+	assert.ErrorContains(t, err, "'org_settings' cannot be used with 'name', 'team_settings'")
 
 	// Mixing org_settings and team_settings
 	config = getGlobalConfig(nil)
 	config += "team_settings:\n  secrets: []\n"
 	_, err = gitOpsFromString(t, config)
-	assert.ErrorContains(t, err, "'org_settings' cannot be used with 'name', 'team_settings' or 'software'")
+	assert.ErrorContains(t, err, "'org_settings' cannot be used with 'name', 'team_settings'")
 
 	// Mixing org_settings and team name and team_settings
 	config = getGlobalConfig(nil)
 	config += "name: TeamName\n"
 	config += "team_settings:\n  secrets: []\n"
 	_, err = gitOpsFromString(t, config)
-	assert.ErrorContains(t, err, "'org_settings' cannot be used with 'name', 'team_settings' or 'software'")
+	assert.ErrorContains(t, err, "'org_settings' cannot be used with 'name', 'team_settings'")
 }
 
 func TestInvalidGitOpsYaml(t *testing.T) {
@@ -692,7 +724,7 @@ func TestGitOpsPaths(t *testing.T) {
 				err = os.WriteFile(mainTmpFile.Name(), []byte(config), 0o644)
 				require.NoError(t, err)
 
-				_, err = GitOpsFromFile(mainTmpFile.Name(), dir)
+				_, err = GitOpsFromFile(mainTmpFile.Name(), dir, nil)
 				assert.NoError(t, err)
 
 				// Test a bad path
@@ -705,7 +737,7 @@ func TestGitOpsPaths(t *testing.T) {
 				err = os.WriteFile(mainTmpFile.Name(), []byte(config), 0o644)
 				require.NoError(t, err)
 
-				_, err = GitOpsFromFile(mainTmpFile.Name(), dir)
+				_, err = GitOpsFromFile(mainTmpFile.Name(), dir, nil)
 				assert.ErrorContains(t, err, "no such file or directory")
 
 				// Test a bad file -- cannot be unmarshalled
@@ -740,13 +772,127 @@ func TestGitOpsPaths(t *testing.T) {
 				}
 				err = os.WriteFile(mainTmpFile.Name(), []byte(config), 0o644)
 				require.NoError(t, err)
-				_, err = GitOpsFromFile(mainTmpFile.Name(), dir)
+				_, err = GitOpsFromFile(mainTmpFile.Name(), dir, nil)
 				assert.ErrorContains(t, err, "nested paths are not supported")
 			},
 		)
 	}
 }
 
+func TestGitOpsGlobalPolicyWithInstallSoftware(t *testing.T) {
+	t.Parallel()
+	config := getGlobalConfig([]string{"policies"})
+	config += `
+policies:
+- name: Some policy
+  query: SELECT 1;
+  install_software:
+    package_path: ./some_path.yml
+`
+	_, err := gitOpsFromString(t, config)
+	assert.ErrorContains(t, err, "install_software can only be set on team policies")
+}
+
+func TestGitOpsTeamPolicyWithInvalidInstallSoftware(t *testing.T) {
+	t.Parallel()
+	config := getTeamConfig([]string{"policies"})
+	config += `
+policies:
+- name: Some policy
+  query: SELECT 1;
+  install_software:
+    package_path: ./some_path.yml
+`
+	_, err := gitOpsFromString(t, config)
+	assert.ErrorContains(t, err, "failed to read install_software.package_path file")
+
+	config = getTeamConfig([]string{"policies"})
+	config += `
+policies:
+- name: Some policy
+  query: SELECT 1;
+  install_software:
+    package_path:
+`
+	_, err = gitOpsFromString(t, config)
+	assert.ErrorContains(t, err, "empty package_path")
+
+	// Software has a URL that's too big
+	tooBigURL := fmt.Sprintf("https://ftp.mozilla.org/%s", strings.Repeat("a", 232))
+	config = getTeamConfig([]string{"software"})
+	config += fmt.Sprintf(`
+software:
+  packages:
+    - url: %s
+`, tooBigURL)
+	appConfig := fleet.EnrichedAppConfig{}
+	appConfig.License = &fleet.LicenseInfo{
+		Tier: fleet.TierPremium,
+	}
+	path, basePath := createTempFile(t, "", config)
+	_, err = GitOpsFromFile(path, basePath, &appConfig)
+	assert.ErrorContains(t, err, fmt.Sprintf("software URL \"%s\" is too long, must be less than 256 characters", tooBigURL))
+
+	// Policy references a software installer not present in the team.
+	config = getTeamConfig([]string{"policies"})
+	config += `
+policies:
+  - path: ./team_install_software.policies.yml
+software:
+  packages:
+    - url: https://ftp.mozilla.org/pub/firefox/releases/129.0.2/mac/en-US/Firefox%20129.0.2.pkg
+      self_service: true
+
+`
+	path, basePath = createTempFile(t, "", config)
+	err = file.Copy(
+		filepath.Join("testdata", "team_install_software.policies.yml"),
+		filepath.Join(basePath, "team_install_software.policies.yml"),
+		0o755,
+	)
+	require.NoError(t, err)
+	err = file.Copy(
+		filepath.Join("testdata", "microsoft-teams.pkg.software.yml"),
+		filepath.Join(basePath, "microsoft-teams.pkg.software.yml"),
+		0o755,
+	)
+	require.NoError(t, err)
+	_, err = GitOpsFromFile(path, basePath, &appConfig)
+	assert.ErrorContains(t, err,
+		"install_software.package_path URL https://statics.teams.cdn.office.net/production-osx/enterprise/webview2/lkg/MicrosoftTeams.pkg not found on team",
+	)
+
+	// Policy references a software installer file that has an invalid yaml.
+	config = getTeamConfig([]string{"policies"})
+	config += `
+policies:
+  - path: ./team_install_software.policies.yml
+software:
+  packages:
+    - url: https://ftp.mozilla.org/pub/firefox/releases/129.0.2/mac/en-US/Firefox%20129.0.2.pkg
+      self_service: true
+`
+	path, basePath = createTempFile(t, "", config)
+	err = file.Copy(
+		filepath.Join("testdata", "team_install_software.policies.yml"),
+		filepath.Join(basePath, "team_install_software.policies.yml"),
+		0o755,
+	)
+	require.NoError(t, err)
+	err = os.WriteFile( // nolint:gosec
+		filepath.Join(basePath, "microsoft-teams.pkg.software.yml"),
+		[]byte("invalid yaml"),
+		0o755,
+	)
+	require.NoError(t, err)
+	appConfig = fleet.EnrichedAppConfig{}
+	appConfig.License = &fleet.LicenseInfo{
+		Tier: fleet.TierPremium,
+	}
+	_, err = GitOpsFromFile(path, basePath, &appConfig)
+	assert.ErrorContains(t, err, "failed to unmarshal install_software.package_path file")
+}
+
 func getGlobalConfig(optsToExclude []string) string {
 	return getBaseConfig(topLevelOptions, optsToExclude)
 }
diff --git a/pkg/spec/spec.go b/pkg/spec/spec.go
index d760f8b1d3c2..10bafd76daab 100644
--- a/pkg/spec/spec.go
+++ b/pkg/spec/spec.go
@@ -26,6 +26,7 @@ type Group struct {
 	Packs    []*fleet.PackSpec
 	Labels   []*fleet.LabelSpec
 	Policies []*fleet.PolicySpec
+	Software []*fleet.SoftwarePackageSpec
 	// This needs to be interface{} to allow for the patch logic. Otherwise we send a request that looks to the
 	// server like the user explicitly set the zero values.
 	AppConfig              interface{}
diff --git a/pkg/spec/testdata/controls.yml b/pkg/spec/testdata/controls.yml
index 2adff74031a5..5da356792168 100644
--- a/pkg/spec/testdata/controls.yml
+++ b/pkg/spec/testdata/controls.yml
@@ -18,6 +18,12 @@ macos_setup:
 macos_updates:
   deadline: null
   minimum_version: null
+ios_updates:
+  deadline: null
+  minimum_version: null
+ipados_updates:
+  deadline: null
+  minimum_version: null
 windows_enabled_and_configured: true
 windows_updates:
   deadline_days: null
diff --git a/pkg/spec/testdata/global_config_no_paths.yml b/pkg/spec/testdata/global_config_no_paths.yml
index 7fabc5119ad9..c8d68f946237 100644
--- a/pkg/spec/testdata/global_config_no_paths.yml
+++ b/pkg/spec/testdata/global_config_no_paths.yml
@@ -20,6 +20,12 @@ controls: # Controls added to "No team"
   macos_updates:
     deadline: null
     minimum_version: null
+  ios_updates:
+    deadline: null
+    minimum_version: null
+  ipados_updates:
+    deadline: null
+    minimum_version: null
   windows_enabled_and_configured: true
   windows_updates:
     deadline_days: null
diff --git a/pkg/spec/testdata/microsoft-teams.pkg.software.yml b/pkg/spec/testdata/microsoft-teams.pkg.software.yml
new file mode 100644
index 000000000000..1aa50514d39a
--- /dev/null
+++ b/pkg/spec/testdata/microsoft-teams.pkg.software.yml
@@ -0,0 +1,2 @@
+url: https://statics.teams.cdn.office.net/production-osx/enterprise/webview2/lkg/MicrosoftTeams.pkg
+self_service: false
diff --git a/pkg/spec/testdata/team_config.yml b/pkg/spec/testdata/team_config.yml
index 127ed82bcfc0..8d593283a09b 100644
--- a/pkg/spec/testdata/team_config.yml
+++ b/pkg/spec/testdata/team_config.yml
@@ -25,3 +25,9 @@ policies:
     description: This policy should always fail.
     resolution: There is no resolution for this policy.
     query: SELECT 1 FROM osquery_info WHERE start_time < 0;
+  - path: ./team_install_software.policies.yml
+software:
+  packages:
+    - path: ./microsoft-teams.pkg.software.yml
+    - url: https://ftp.mozilla.org/pub/firefox/releases/129.0.2/mac/en-US/Firefox%20129.0.2.pkg
+      self_service: true
diff --git a/pkg/spec/testdata/team_config_no_paths.yml b/pkg/spec/testdata/team_config_no_paths.yml
index 207317e6405e..c0c0742d72fa 100644
--- a/pkg/spec/testdata/team_config_no_paths.yml
+++ b/pkg/spec/testdata/team_config_no_paths.yml
@@ -7,7 +7,7 @@ team_settings:
     failing_policies_webhook:
       enable_failing_policies_webhook: true
       destination_url: https://example.tines.com/webhook
-      policy_ids: [1, 2, 3, 4, 5, 6 ,7, 8, 9]
+      policy_ids: [1, 2, 3, 4, 5, 6, 7, 8, 9]
   features:
     enable_host_users: true
     enable_software_inventory: true
@@ -46,6 +46,12 @@ controls:
   macos_updates:
     deadline: null
     minimum_version: null
+  ios_updates:
+    deadline: null
+    minimum_version: null
+  ipados_updates:
+    deadline: null
+    minimum_version: null
   windows_updates:
     deadline_days: null
     grace_period_days: null
@@ -109,3 +115,13 @@ policies:
     description: This policy should always fail.
     resolution: There is no resolution for this policy.
     query: SELECT 1 FROM osquery_info WHERE start_time < 0;
+  - name: Microsoft Teams on macOS installed and up to date
+    platform: darwin
+    query: SELECT 1 FROM apps WHERE name = 'Microsoft Teams.app' AND version_compare(bundle_short_version, '24193.1707.3028.4282') >= 0;
+    install_software:
+      package_path: ./microsoft-teams.pkg.software.yml
+software:
+  packages:
+    - path: ./microsoft-teams.pkg.software.yml
+    - url: https://ftp.mozilla.org/pub/firefox/releases/129.0.2/mac/en-US/Firefox%20129.0.2.pkg
+      self_service: true
diff --git a/pkg/spec/testdata/team_install_software.policies.yml b/pkg/spec/testdata/team_install_software.policies.yml
new file mode 100644
index 000000000000..1811340788d8
--- /dev/null
+++ b/pkg/spec/testdata/team_install_software.policies.yml
@@ -0,0 +1,5 @@
+- name: Microsoft Teams on macOS installed and up to date
+  platform: darwin
+  query: SELECT 1 FROM apps WHERE name = 'Microsoft Teams.app' AND version_compare(bundle_short_version, '24193.1707.3028.4282') >= 0;
+  install_software:
+    package_path: ./microsoft-teams.pkg.software.yml
diff --git a/schema/osquery_fleet_schema.json b/schema/osquery_fleet_schema.json
index 757a3f621827..097534dbd1d8 100644
--- a/schema/osquery_fleet_schema.json
+++ b/schema/osquery_fleet_schema.json
@@ -8,7 +8,7 @@
     ],
     "evented": false,
     "cacheable": false,
-    "notes": "- The values in this OpenDirectory table are related to account creation.  In the past, it was fairly common to use OpenDirectory to have a home folder (`~`) on a server, and then log in and get that folder wherever they are.  (These days, this use case is more uncommon.)\n- To determine who is logged in to the Mac, or for example, to check the record name versus the computer's \"short name\", consider using the data in [the DSCL table](https://fleetdm.com/tables/dscl).",
+    "notes": "- The values in this OpenDirectory table are related to account creation.  In the past, it was fairly common to use OpenDirectory to have a home folder (`~`) on a server, and then log in and get that folder wherever they are.  (These days, this use case is more uncommon.)\n- To determine who is logged in to the Mac, or for example, to check the record name versus the computer's \"short name\", consider using the data in [the DSCL table](https://fleetdm.com/tables/dscl).\n- Many installers incorporate scripts due to actions that are handled by pre or post-scripts vs installer package payloads. These script actions aren't tracked in the \"bill of materials\" (.bom) file. So, don't blindly trust the \"bill of materials\" (.bom) file as the source of truth on what has or hasn't been installed.",
     "examples": "Query the creation date of user accounts. You could also query the date of the last failed login attempt or password change.\n\n```\nSELECT strftime('%Y-%m-%d %H:%M:%S',creation_time,'unixepoch') AS creationdate FROM account_policy_data;\n```\n\nSee each user's last password set date and number of failed logins since last successful login to detect any intrusion attempts.\n\n```\nSELECT u.username u.uid, strftime('%Y-%m-%dT%H:%M:%S', a.password_last_set_time, 'unixepoch') AS password_last_set_time, a.failed_login_count, strftime('%Y-%m-%dT%H:%M:%S', a.failed_login_timestamp, 'unixepoch') AS failed_login_timestamp FROM account_policy_data AS a CROSS JOIN users AS u USING (uid) ORDER BY password_last_set_time ASC;\n```",
     "columns": [
       {
@@ -5349,7 +5349,7 @@
   },
   {
     "name": "cryptoinfo",
-    "description": "Get info about the a certificate on the host.",
+    "description": "Get info about a certificate on the host.",
     "evented": false,
     "notes": "This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by [Kolide](https://github.com/kolide/launcher).",
     "platforms": [
diff --git a/schema/tables/account_policy_data.yml b/schema/tables/account_policy_data.yml
index 41c414674743..4daacd79c5e1 100644
--- a/schema/tables/account_policy_data.yml
+++ b/schema/tables/account_policy_data.yml
@@ -8,6 +8,7 @@ columns:
 notes: |-
   - The values in this OpenDirectory table are related to account creation.  In the past, it was fairly common to use OpenDirectory to have a home folder (`~`) on a server, and then log in and get that folder wherever they are.  (These days, this use case is more uncommon.)
   - To determine who is logged in to the Mac, or for example, to check the record name versus the computer's "short name", consider using the data in [the DSCL table](https://fleetdm.com/tables/dscl).
+  - Many installers incorporate scripts due to actions that are handled by pre or post-scripts vs installer package payloads. These script actions aren't tracked in the "bill of materials" (.bom) file. So, don't blindly trust the "bill of materials" (.bom) file as the source of truth on what has or hasn't been installed.
 examples: |-
   Query the creation date of user accounts. You could also query the date of the last failed login attempt or password change.
 
diff --git a/schema/tables/cryptoinfo.yml b/schema/tables/cryptoinfo.yml
index 4fd8d5da374e..38055381b7db 100644
--- a/schema/tables/cryptoinfo.yml
+++ b/schema/tables/cryptoinfo.yml
@@ -1,5 +1,5 @@
 name: cryptoinfo
-description: Get info about the a certificate on the host.
+description: Get info about a certificate on the host.
 evented: false
 notes: This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by [Kolide](https://github.com/kolide/launcher).
 platforms:
diff --git a/scripts/macos-install-wine.sh b/scripts/macos-install-wine.sh
index fc89c8398cac..0b7b0752cc87 100755
--- a/scripts/macos-install-wine.sh
+++ b/scripts/macos-install-wine.sh
@@ -7,7 +7,8 @@ set -eo pipefail
 brew_wine(){
 # Wine reference: https://wiki.winehq.org/MacOS
 # Wine can be installed without brew via a distribution such as https://github.com/Gcenx/macOS_Wine_builds/releases/tag/9.0 or by building from source.
-brew install --cask --no-quarantine https://raw.githubusercontent.com/Homebrew/homebrew-cask/1ecfe82f84e0f3c3c6b741d3ddc19a164c2cb18d/Casks/w/wine-stable.rb; exit 0
+curl -O https://raw.githubusercontent.com/Homebrew/homebrew-cask/1ecfe82f84e0f3c3c6b741d3ddc19a164c2cb18d/Casks/w/wine-stable.rb
+brew install --cask --no-quarantine wine-stable.rb; exit 0
 }
 
 
diff --git a/scripts/mdm/linux/linux-lock.sh b/scripts/mdm/linux/linux-lock.sh
index 6c7e3172409b..227b05fd7371 100644
--- a/scripts/mdm/linux/linux-lock.sh
+++ b/scripts/mdm/linux/linux-lock.sh
@@ -29,4 +29,21 @@ do
     fi
 done
 
+# Logout any non-passwd users
+logged_in=$(users | tr ' ' '\n' | sort  | uniq)
+for user in $logged_in; do
+    [ "$user" = "root" ] && continue
+    echo "Logging out $user"
+    pkill -KILL -u "$user"
+done
+
+# Create the pam_nologin file
+echo "Locked by administrator" > /etc/nologin
+
+# Disable systemd-user-sessions, a service that deletes /etc/nologin
+if [ -f /usr/lib/systemd/system/systemd-user-sessions.service ]; then
+    systemctl mask systemd-user-sessions
+    systemctl daemon-reload
+fi
+
 echo "All non-root users have been logged out and their accounts locked."
diff --git a/scripts/mdm/linux/linux-unlock.sh b/scripts/mdm/linux/linux-unlock.sh
index e981d4ce4469..6e6880c54225 100644
--- a/scripts/mdm/linux/linux-unlock.sh
+++ b/scripts/mdm/linux/linux-unlock.sh
@@ -19,3 +19,13 @@ do
         fi
     fi
 done
+
+# Remove the pam_nologin file
+[ -f /etc/nologin ] && rm /etc/nologin
+
+# Enable systemd-user-sessions, a service that deletes /etc/nologin
+if [ -f /usr/lib/systemd/system/systemd-user-sessions.service ]; then
+    systemctl unmask systemd-user-sessions
+    systemctl daemon-reload
+    /usr/lib/systemd/systemd-user-sessions start
+fi
diff --git a/scripts/mdm/windows/windows-lock.ps1 b/scripts/mdm/windows/windows-lock.ps1
index 4774d1abd3f7..98f3e785cfaa 100644
--- a/scripts/mdm/windows/windows-lock.ps1
+++ b/scripts/mdm/windows/windows-lock.ps1
@@ -42,6 +42,6 @@ Write-Host "All local non-administrative users have been logged out and their ac
 Write-Host "Logging in with other Microsoft accounts has been disabled"
 Write-Host "Cached Logins have been disabled, disable the MDM-Enroled account to prevent further logins"
 
-# Shutdown computer in 10 seconds, after command has returned to fleet
+# Shutdown computer in 15 seconds, after command has returned to fleet
 Write-Host "Shutting down in 15 seconds"
 shutdown /s /f /t 15
diff --git a/scripts/mdm/windows/windows-unlock.ps1 b/scripts/mdm/windows/windows-unlock.ps1
index 6a10c00fb39c..21951cfffb00 100644
--- a/scripts/mdm/windows/windows-unlock.ps1
+++ b/scripts/mdm/windows/windows-unlock.ps1
@@ -12,3 +12,9 @@ foreach ($user in $localUsers) {
 }
 
 Write-Host "All disabled user accounts have been enabled."
+
+# Re-enable additional AD logins
+New-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\Settings\AllowSignInOptions" -Name 'value' -Value 0 -PropertyType DWORD -Force
+
+# Re-enable cached logins for AD/Azure/Entra accounts
+New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name 'CachedLogonsCount' -Value 10 -PropertyType String -Force
diff --git a/server/authz/policy.rego b/server/authz/policy.rego
index 639b1510ff54..a5455c2e8ba1 100644
--- a/server/authz/policy.rego
+++ b/server/authz/policy.rego
@@ -643,32 +643,32 @@ allow {
   action == read
 }
 
-# Global admins and maintainers can read any software installer.
+# Global admins and maintainers can read any installable entity (software installer or VPP app)
 allow {
-  object.type == "software_installer"
+  object.type == "installable_entity"
   subject.global_role == [admin, maintainer][_]
   action == read
 }
 
-# Global admins, maintainers, and gitops can write any software installer.
+# Global admins, maintainers, and gitops can write any installable entity (software installer or VPP app)
 allow {
-  object.type == "software_installer"
+  object.type == "installable_entity"
   subject.global_role == [admin, maintainer, gitops][_]
   action == write
 }
 
-# Team admins and maintainers can read any software installer in their teams.
+# Team admins and maintainers can read any installable entity (software installer or VPP app) in their teams.
 allow {
   not is_null(object.team_id)
-  object.type == "software_installer"
+  object.type == "installable_entity"
   team_role(subject, object.team_id) == [admin, maintainer][_]
   action == read
 }
 
-# Team admins, maintainers, and gitops can write any software installer in their teams.
+# Team admins, maintainers, and gitops can write any installable entity (software installer or VPP app) in their teams.
 allow {
   not is_null(object.team_id)
-  object.type == "software_installer"
+  object.type == "installable_entity"
   team_role(subject, object.team_id) == [admin, maintainer, gitops][_]
   action == write
 }
@@ -733,11 +733,11 @@ allow {
   action == [read, write][_]
 }
 
-# Global admins can read and write MDM apple information.
+# Global admins can read, write, and list MDM apple information.
 allow {
   object.type == "mdm_apple"
   subject.global_role == admin
-  action == [read, write][_]
+  action == [read, write, list][_]
 }
 
 # Global admins can read and write Apple MDM enrollments.
diff --git a/server/contexts/apple_bm/apple_bm.go b/server/contexts/apple_bm/apple_bm.go
new file mode 100644
index 000000000000..e6024a9a7880
--- /dev/null
+++ b/server/contexts/apple_bm/apple_bm.go
@@ -0,0 +1,20 @@
+package apple_bm
+
+import (
+	"context"
+
+	depclient "github.com/fleetdm/fleet/v4/server/mdm/nanodep/client"
+)
+
+type key int
+
+const abmKey key = 0
+
+func NewContext(ctx context.Context, decryptedToken *depclient.OAuth1Tokens) context.Context {
+	return context.WithValue(ctx, abmKey, decryptedToken)
+}
+
+func FromContext(ctx context.Context) (*depclient.OAuth1Tokens, bool) {
+	tok, ok := ctx.Value(abmKey).(*depclient.OAuth1Tokens)
+	return tok, ok
+}
diff --git a/server/cron/calendar_cron.go b/server/cron/calendar_cron.go
index c1aaab2217be..72b1498af214 100644
--- a/server/cron/calendar_cron.go
+++ b/server/cron/calendar_cron.go
@@ -2,9 +2,12 @@ package cron
 
 import (
 	"context"
+	"crypto/sha256"
 	"errors"
 	"fmt"
 	"slices"
+	"strconv"
+	"strings"
 	"sync"
 	"time"
 
@@ -16,17 +19,19 @@ import (
 	"github.com/go-kit/log"
 	kitlog "github.com/go-kit/log"
 	"github.com/go-kit/log/level"
+	"github.com/google/uuid"
 )
 
 const (
 	calendarConsumers = 18
-	reloadFrequency   = 12 * time.Hour
+	reloadFrequency   = 30 * time.Minute
 )
 
 func NewCalendarSchedule(
 	ctx context.Context,
 	instanceID string,
 	ds fleet.Datastore,
+	distributedLock fleet.Lock,
 	serverConfig config.CalendarConfig,
 	logger kitlog.Logger,
 ) (*schedule.Schedule, error) {
@@ -47,7 +52,7 @@ func NewCalendarSchedule(
 		schedule.WithJob(
 			"calendar_events",
 			func(ctx context.Context) error {
-				return cronCalendarEvents(ctx, ds, serverConfig, logger)
+				return cronCalendarEvents(ctx, ds, distributedLock, serverConfig, logger)
 			},
 		),
 	)
@@ -55,7 +60,8 @@ func NewCalendarSchedule(
 	return s, nil
 }
 
-func cronCalendarEvents(ctx context.Context, ds fleet.Datastore, serverConfig config.CalendarConfig, logger kitlog.Logger) error {
+func cronCalendarEvents(ctx context.Context, ds fleet.Datastore, distributedLock fleet.Lock, serverConfig config.CalendarConfig,
+	logger kitlog.Logger) error {
 	appConfig, err := ds.AppConfig(ctx)
 	if err != nil {
 		return fmt.Errorf("load app config: %w", err)
@@ -78,14 +84,14 @@ func cronCalendarEvents(ctx context.Context, ds fleet.Datastore, serverConfig co
 		return fmt.Errorf("list teams: %w", err)
 	}
 
-	localConfig := &calendar.CalendarConfig{
+	localConfig := &calendar.Config{
 		CalendarConfig:            serverConfig,
 		GoogleCalendarIntegration: *googleCalendarIntegrationConfig,
 		ServerURL:                 appConfig.ServerSettings.ServerURL,
 	}
 	for _, team := range teams {
 		if err := cronCalendarEventsForTeam(
-			ctx, ds, localConfig, *team, appConfig.OrgInfo.OrgName, domain, logger,
+			ctx, ds, distributedLock, localConfig, *team, appConfig.OrgInfo.OrgName, domain, logger,
 		); err != nil {
 			level.Info(logger).Log("msg", "events calendar cron", "team_id", team.ID, "err", err)
 		}
@@ -97,7 +103,8 @@ func cronCalendarEvents(ctx context.Context, ds fleet.Datastore, serverConfig co
 func cronCalendarEventsForTeam(
 	ctx context.Context,
 	ds fleet.Datastore,
-	calendarConfig *calendar.CalendarConfig,
+	distributedLock fleet.Lock,
+	calendarConfig *calendar.Config,
 	team fleet.Team,
 	orgName string,
 	domain string,
@@ -179,7 +186,7 @@ func cronCalendarEventsForTeam(
 
 	// Process hosts that are failing calendar policies.
 	start = time.Now()
-	processCalendarFailingHosts(ctx, ds, calendarConfig, orgName, failingHosts, logger)
+	processCalendarFailingHosts(ctx, ds, distributedLock, calendarConfig, orgName, failingHosts, logger)
 	level.Debug(logger).Log(
 		"msg", "failing_hosts", "took", time.Since(start),
 	)
@@ -197,7 +204,8 @@ func cronCalendarEventsForTeam(
 func processCalendarFailingHosts(
 	ctx context.Context,
 	ds fleet.Datastore,
-	calendarConfig *calendar.CalendarConfig,
+	distributedLock fleet.Lock,
+	calendarConfig *calendar.Config,
 	orgName string,
 	hosts []fleet.HostPolicyMembershipData,
 	logger kitlog.Logger,
@@ -253,7 +261,8 @@ func processCalendarFailingHosts(
 				switch {
 				case err == nil && !expiredEvent:
 					if err := processFailingHostExistingCalendarEvent(
-						ctx, ds, userCalendar, orgName, hostCalendarEvent, calendarEvent, host, &policyIDtoPolicy, calendarConfig, logger,
+						ctx, ds, distributedLock, userCalendar, orgName, hostCalendarEvent, calendarEvent, host, &policyIDtoPolicy,
+						calendarConfig, logger,
 					); err != nil {
 						level.Info(logger).Log("msg", "process failing host existing calendar event", "err", err)
 						continue // continue with next host
@@ -303,26 +312,127 @@ func filterHostsWithSameEmail(hosts []fleet.HostPolicyMembershipData) []fleet.Ho
 func processFailingHostExistingCalendarEvent(
 	ctx context.Context,
 	ds fleet.Datastore,
+	distributedLock fleet.Lock,
 	userCalendar fleet.UserCalendar,
 	orgName string,
 	hostCalendarEvent *fleet.HostCalendarEvent,
 	calendarEvent *fleet.CalendarEvent,
 	host fleet.HostPolicyMembershipData,
 	policyIDtoPolicy *sync.Map,
-	calendarConfig *calendar.CalendarConfig,
+	calendarConfig *calendar.Config,
 	logger kitlog.Logger,
 ) error {
+
+	// Try to acquire the lock. Lock is needed to ensure calendar callback is not processed for this event at the same time.
+	eventUUID := calendarEvent.UUID
+	lockValue := uuid.New().String()
+	lockAcquired, err := distributedLock.SetIfNotExist(ctx, calendar.LockKeyPrefix+eventUUID, lockValue, calendar.DistributedLockExpireMs)
+	if err != nil {
+		return fmt.Errorf("acquire calendar lock: %w", err)
+	}
+
+	lockReserved := false
+	if !lockAcquired {
+		// Lock was not acquired. We reserve the lock and try to acquire it until we do.
+		lockAcquired, err = distributedLock.SetIfNotExist(ctx, calendar.ReservedLockKeyPrefix+eventUUID, lockValue,
+			calendar.ReserveLockExpireMs)
+		if err != nil {
+			return fmt.Errorf("reserve calendar lock: %w", err)
+		}
+		if !lockAcquired {
+			// Lock was not reserved. Another cron job is processing this event. This is not expected.
+			return errors.New("could not reserve calendar lock")
+		}
+		lockReserved = true
+		done := make(chan struct{})
+		go func() {
+			for {
+				// Keep trying to get the lock.
+				lockAcquired, err = distributedLock.SetIfNotExist(ctx, calendar.LockKeyPrefix+eventUUID, lockValue,
+					calendar.DistributedLockExpireMs)
+				if err != nil || lockAcquired {
+					done <- struct{}{}
+					return
+				}
+				time.Sleep(200 * time.Millisecond)
+			}
+		}()
+		select {
+		case <-done:
+			// Lock was acquired.
+			if err != nil {
+				return fmt.Errorf("try to acquire calendar lock: %w", err)
+			}
+		case <-time.After(time.Duration(calendar.ReserveLockExpireMs) * time.Millisecond):
+			// We couldn't acquire the lock in time.
+			return errors.New("could not acquire calendar lock in time")
+		}
+	}
+	defer func() {
+		// Release locks.
+		if lockReserved {
+			ok, err := distributedLock.ReleaseLock(ctx, calendar.ReservedLockKeyPrefix+eventUUID, lockValue)
+			if err != nil {
+				level.Error(logger).Log("msg", "Failed to release calendar reserve lock", "err", err)
+			}
+			if !ok {
+				// If the lock was not released, it will expire on its own.
+				level.Error(logger).Log("msg", "Failed to release calendar reserve lock", "event uuid", eventUUID, "lockValue", lockValue)
+			}
+		}
+		ok, err := distributedLock.ReleaseLock(ctx, calendar.LockKeyPrefix+eventUUID, lockValue)
+		if err != nil {
+			level.Error(logger).Log("msg", "Failed to release calendar lock", "err", err)
+		}
+		if !ok {
+			// If the lock was not released, it will expire on its own. However, we should adjust expiration time or something else to make sure we don't get here.
+			level.Error(logger).Log("msg", "Failed to release calendar lock", "event uuid", eventUUID, "lockValue", lockValue)
+		}
+	}()
+
 	updatedEvent := calendarEvent
 	updated := false
 	now := time.Now()
 
+	// Function to generate calendar event body.
+	var generatedTag string
+	var newETag string
+	var genBodyFn fleet.CalendarGenBodyFn = func(conflict bool) (string, bool, error) {
+		var body string
+		body, generatedTag = calendar.GenerateCalendarEventBody(ctx, ds, orgName, host, policyIDtoPolicy, conflict, logger)
+		return body, true, nil
+	}
+
+	// Check if event body needs to be updated.
+	currentBodyTag := calendarEvent.GetBodyTag()
+	// But don't update events created before we introduced body tags.
+	if currentBodyTag != "" {
+		updatedBodyTag := getBodyTag(ctx, ds, host, policyIDtoPolicy, logger)
+
+		if currentBodyTag != updatedBodyTag && updatedBodyTag != "" {
+			newETag, err = userCalendar.UpdateEventBody(calendarEvent, genBodyFn)
+			if err != nil {
+				return fmt.Errorf("update event body: %w", err)
+			}
+			updated = true
+		}
+	}
+
 	if calendarConfig.AlwaysReloadEvent() || shouldReloadCalendarEvent(now, calendarEvent, hostCalendarEvent) {
-		var err error
-		updatedEvent, _, err = userCalendar.GetAndUpdateEvent(
-			calendarEvent, func(conflict bool) (string, bool, error) {
-				return calendar.GenerateCalendarEventBody(ctx, ds, orgName, host, policyIDtoPolicy, conflict, logger), true, nil
-			},
-		)
+		// Refetch the event since it may have updated since we got the lock.
+		// We need the latest event data (ETag) to make sure that we get correct data from the calendar service.
+		calendarEvent, err = ds.GetCalendarEvent(ctx, calendarEvent.Email)
+		if err != nil {
+			if fleet.IsNotFound(err) {
+				// Event was deleted while we were processing it. It will be recreated if needed on the next cron run
+				return nil
+			}
+			return fmt.Errorf("get calendar event from db: %w", err)
+		}
+		// We could check the updated_at timestamp and avoid updating the event if it was updated recently.
+
+		updatedEvent, _, err = userCalendar.GetAndUpdateEvent(calendarEvent, genBodyFn,
+			fleet.CalendarGetAndUpdateEventOpts{UpdateTimezone: true})
 		if err != nil {
 			return fmt.Errorf("get event calendar on db: %w", err)
 		}
@@ -331,6 +441,12 @@ func processFailingHostExistingCalendarEvent(
 	}
 
 	if updated {
+		if generatedTag != "" && newETag != "" {
+			err = updatedEvent.SaveDataItems("body_tag", generatedTag, "etag", newETag)
+			if err != nil {
+				return fmt.Errorf("save calendar event body tag: %w", err)
+			}
+		}
 		if err := ds.UpdateCalendarEvent(
 			ctx,
 			calendarEvent.ID,
@@ -342,6 +458,13 @@ func processFailingHostExistingCalendarEvent(
 		); err != nil {
 			return fmt.Errorf("updating event calendar on db: %w", err)
 		}
+
+		// Remove event from the queue so that we don't process this event again.
+		// If we just modified the event in the calendar, calendar will send a callback, and we don't need to process that callback.
+		err = distributedLock.RemoveFromSet(ctx, calendar.QueueKey, eventUUID)
+		if err != nil {
+			return fmt.Errorf("remove calendar event from queue: %w", err)
+		}
 	}
 
 	eventInFuture := now.Before(updatedEvent.StartTime)
@@ -351,7 +474,7 @@ func processFailingHostExistingCalendarEvent(
 	}
 	if now.After(updatedEvent.EndTime) {
 		return fmt.Errorf(
-			"unexpected event in the past: now=%s, start_time=%s, end_time=%s",
+			"unexpected event in the past: now=%s, start_time=%s, end_time=%s -- check calendar API quota usage and infrastructure load",
 			now, updatedEvent.StartTime, updatedEvent.EndTime,
 		)
 	}
@@ -388,6 +511,50 @@ func processFailingHostExistingCalendarEvent(
 	return nil
 }
 
+func getBodyTag(ctx context.Context, ds fleet.Datastore, host fleet.HostPolicyMembershipData, policyIDtoPolicy *sync.Map,
+	logger kitlog.Logger) string {
+	var updatedBodyTag string
+	policyIDs := strings.Split(host.FailingPolicyIDs, ",")
+	if len(policyIDs) == 1 && policyIDs[0] != "" {
+		var policy *calendar.PolicyLiteWithMeta
+		policyAny, ok := policyIDtoPolicy.Load(policyIDs[0])
+		if !ok {
+			id, err := strconv.ParseUint(policyIDs[0], 10, 64)
+			if err != nil {
+				level.Error(logger).Log("msg", "parse policy id", "err", err)
+				// Do nothing
+				return ""
+			}
+			policyLite, err := ds.PolicyLite(ctx, uint(id))
+			if err != nil {
+				level.Error(logger).Log("msg", "get policy", "err", err)
+				// Do nothing
+				return ""
+			}
+			policy = new(calendar.PolicyLiteWithMeta)
+			policy.PolicyLite = *policyLite
+			policyIDtoPolicy.Store(policyIDs[0], policy)
+		} else {
+			policy = policyAny.(*calendar.PolicyLiteWithMeta)
+		}
+		if policy.Tag != "" {
+			updatedBodyTag = policy.Tag
+			return updatedBodyTag
+		}
+		// If body tag wasn't cached, we calculate it.
+		policyDescription := strings.TrimSpace(policy.Description)
+		if policyDescription == "" || policy.Resolution == nil || strings.TrimSpace(*policy.Resolution) == "" {
+			updatedBodyTag = calendar.DefaultEventBodyTag
+		} else {
+			// Calculate a unique signature for the event body, which we will use to check if the event body has changed.
+			updatedBodyTag = fmt.Sprintf("%x", sha256.Sum256([]byte(policy.Description+*policy.Resolution)))
+		}
+	} else {
+		updatedBodyTag = calendar.DefaultEventBodyTag
+	}
+	return updatedBodyTag
+}
+
 func shouldReloadCalendarEvent(now time.Time, calendarEvent *fleet.CalendarEvent, hostCalendarEvent *fleet.HostCalendarEvent) bool {
 	// Check the user calendar regularly (but not every cron run)
 	// to reduce load on both Fleet and the calendar service.
@@ -446,14 +613,21 @@ func attemptCreatingEventOnUserCalendar(
 	year, month, today := time.Now().Date()
 	preferredDate := getPreferredCalendarEventDate(year, month, today)
 	for {
+		var generatedTag string
 		calendarEvent, err := userCalendar.CreateEvent(
 			preferredDate, func(conflict bool) (string, bool, error) {
-				return calendar.GenerateCalendarEventBody(ctx, ds, orgName, host, policyIDtoPolicy, conflict, logger), true, nil
-			},
+				var body string
+				body, generatedTag = calendar.GenerateCalendarEventBody(ctx, ds, orgName, host, policyIDtoPolicy, conflict, logger)
+				return body, true, nil
+			}, fleet.CalendarCreateEventOpts{},
 		)
 		var dee fleet.DayEndedError
 		switch {
 		case err == nil:
+			err = calendarEvent.SaveDataItems("body_tag", generatedTag)
+			if err != nil {
+				return nil, err
+			}
 			return calendarEvent, nil
 		case errors.As(err, &dee):
 			preferredDate = addBusinessDay(preferredDate)
@@ -492,7 +666,7 @@ func addBusinessDay(date time.Time) time.Time {
 func removeCalendarEventsFromPassingHosts(
 	ctx context.Context,
 	ds fleet.Datastore,
-	calendarConfig *calendar.CalendarConfig,
+	calendarConfig *calendar.Config,
 	hosts []fleet.HostPolicyMembershipData,
 	logger kitlog.Logger,
 ) {
@@ -601,9 +775,9 @@ func cronCalendarEventsCleanup(ctx context.Context, ds fleet.Datastore, logger k
 	}
 
 	var userCalendar fleet.UserCalendar
-	var calConfig *calendar.CalendarConfig
+	var calConfig *calendar.Config
 	if len(appConfig.Integrations.GoogleCalendar) > 0 {
-		calConfig = &calendar.CalendarConfig{
+		calConfig = &calendar.Config{
 			GoogleCalendarIntegration: *appConfig.Integrations.GoogleCalendar[0],
 			ServerURL:                 appConfig.ServerSettings.ServerURL,
 		}
@@ -657,7 +831,7 @@ func cronCalendarEventsCleanup(ctx context.Context, ds fleet.Datastore, logger k
 func deleteAllCalendarEvents(
 	ctx context.Context,
 	ds fleet.Datastore,
-	calendarConfig *calendar.CalendarConfig,
+	calendarConfig *calendar.Config,
 	teamID *uint,
 	logger kitlog.Logger,
 ) error {
@@ -670,7 +844,7 @@ func deleteAllCalendarEvents(
 }
 
 func deleteCalendarEventsInParallel(
-	ctx context.Context, ds fleet.Datastore, calendarConfig *calendar.CalendarConfig, calendarEvents []*fleet.CalendarEvent,
+	ctx context.Context, ds fleet.Datastore, calendarConfig *calendar.Config, calendarEvents []*fleet.CalendarEvent,
 	logger kitlog.Logger,
 ) {
 	if len(calendarEvents) > 0 {
@@ -703,7 +877,7 @@ func deleteCalendarEventsInParallel(
 func cleanupTeamCalendarEvents(
 	ctx context.Context,
 	ds fleet.Datastore,
-	calendarConfig *calendar.CalendarConfig,
+	calendarConfig *calendar.Config,
 	team fleet.Team,
 	logger kitlog.Logger,
 ) error {
@@ -738,6 +912,10 @@ func deleteCalendarEvent(
 				return fmt.Errorf("delete calendar event: %w", err)
 			}
 		}
+		// Stop watching for calendar changes
+		if err := userCalendar.StopEventChannel(calendarEvent); err != nil {
+			return fmt.Errorf("stop event channel: %w", err)
+		}
 	}
 	if err := ds.DeleteCalendarEvent(ctx, calendarEvent.ID); err != nil {
 		return fmt.Errorf("delete db calendar event: %w", err)
diff --git a/server/cron/calendar_cron_test.go b/server/cron/calendar_cron_test.go
index bafb93742222..3e780ee515e6 100644
--- a/server/cron/calendar_cron_test.go
+++ b/server/cron/calendar_cron_test.go
@@ -11,14 +11,15 @@ import (
 	"testing"
 	"time"
 
-	"github.com/fleetdm/fleet/v4/server/config"
-	"github.com/fleetdm/fleet/v4/server/ptr"
-	"github.com/stretchr/testify/assert"
-
 	"github.com/fleetdm/fleet/v4/ee/server/calendar"
+	"github.com/fleetdm/fleet/v4/server/config"
+	"github.com/fleetdm/fleet/v4/server/datastore/redis/redistest"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/mock"
+	"github.com/fleetdm/fleet/v4/server/ptr"
+	"github.com/fleetdm/fleet/v4/server/service/redis_lock"
 	kitlog "github.com/go-kit/log"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -199,7 +200,8 @@ func TestEventForDifferentHost(t *testing.T) {
 		return hcEvent, calEvent, nil
 	}
 
-	err := cronCalendarEvents(ctx, ds, defaultCalendarConfig, logger)
+	pool := redistest.SetupRedis(t, t.Name(), false, false, false)
+	err := cronCalendarEvents(ctx, ds, redis_lock.NewLock(pool), defaultCalendarConfig, logger)
 	require.NoError(t, err)
 }
 
@@ -341,7 +343,7 @@ func TestCalendarEventsMultipleHosts(t *testing.T) {
 		email string,
 		startTime, endTime time.Time,
 		data []byte,
-		timeZone string,
+		timeZone *string,
 		hostID uint,
 		webhookStatus fleet.CalendarWebhookStatus,
 	) (*fleet.CalendarEvent, error) {
@@ -373,7 +375,8 @@ func TestCalendarEventsMultipleHosts(t *testing.T) {
 		return nil, nil
 	}
 
-	err := cronCalendarEvents(ctx, ds, defaultCalendarConfig, logger)
+	pool := redistest.SetupRedis(t, t.Name(), false, false, false)
+	err := cronCalendarEvents(ctx, ds, redis_lock.NewLock(pool), defaultCalendarConfig, logger)
 	require.NoError(t, err)
 
 	eventsMu.Lock()
@@ -398,6 +401,7 @@ func (n notFoundErr) Error() string {
 }
 
 func TestCalendarEvents1KHosts(t *testing.T) {
+	t.Parallel()
 	ds := new(mock.Store)
 	ctx := context.Background()
 	var logger kitlog.Logger
@@ -630,7 +634,7 @@ func TestCalendarEvents1KHosts(t *testing.T) {
 		email string,
 		startTime, endTime time.Time,
 		data []byte,
-		timeZone string,
+		timeZone *string,
 		hostID uint,
 		webhookStatus fleet.CalendarWebhookStatus,
 	) (*fleet.CalendarEvent, error) {
@@ -662,7 +666,9 @@ func TestCalendarEvents1KHosts(t *testing.T) {
 		return nil, nil
 	}
 
-	err := cronCalendarEvents(ctx, ds, defaultCalendarConfig, logger)
+	pool := redistest.SetupRedis(t, t.Name(), false, false, false)
+	distributedLock := redis_lock.NewLock(pool)
+	err := cronCalendarEvents(ctx, ds, distributedLock, defaultCalendarConfig, logger)
 	require.NoError(t, err)
 
 	createdCalendarEvents := calendar.ListGoogleMockEvents()
@@ -699,7 +705,7 @@ func TestCalendarEvents1KHosts(t *testing.T) {
 		return nil
 	}
 
-	err = cronCalendarEvents(ctx, ds, defaultCalendarConfig, logger)
+	err = cronCalendarEvents(ctx, ds, distributedLock, defaultCalendarConfig, logger)
 	require.NoError(t, err)
 
 	createdCalendarEvents = calendar.ListGoogleMockEvents()
@@ -918,7 +924,7 @@ func TestEventBody(t *testing.T) {
 		email string,
 		startTime, endTime time.Time,
 		data []byte,
-		timeZone string,
+		timeZone *string,
 		hostID uint,
 		webhookStatus fleet.CalendarWebhookStatus,
 	) (*fleet.CalendarEvent, error) {
@@ -948,7 +954,8 @@ func TestEventBody(t *testing.T) {
 		return nil, nil
 	}
 
-	err := cronCalendarEvents(ctx, ds, defaultCalendarConfig, logger)
+	pool := redistest.SetupRedis(t, t.Name(), false, false, false)
+	err := cronCalendarEvents(ctx, ds, redis_lock.NewLock(pool), defaultCalendarConfig, logger)
 	require.NoError(t, err)
 
 	numberOfEvents := 7
diff --git a/server/datastore/cached_mysql/cached_mysql_test.go b/server/datastore/cached_mysql/cached_mysql_test.go
index ef628f9650e8..004f3360bfb2 100644
--- a/server/datastore/cached_mysql/cached_mysql_test.go
+++ b/server/datastore/cached_mysql/cached_mysql_test.go
@@ -559,7 +559,7 @@ func TestCachedTeamMDMConfig(t *testing.T) {
 
 	testMDMConfig := fleet.TeamMDM{
 		EnableDiskEncryption: true,
-		MacOSUpdates: fleet.MacOSUpdates{
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("10.10.10"),
 			Deadline:       optjson.SetString("1992-03-01"),
 		},
@@ -618,7 +618,7 @@ func TestCachedTeamMDMConfig(t *testing.T) {
 
 	// saving a team updates config in cache
 	updateMDMConfig := fleet.TeamMDM{
-		MacOSUpdates: fleet.MacOSUpdates{
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("13.13.13"),
 			Deadline:       optjson.SetString("2022-03-01"),
 		},
diff --git a/server/datastore/filesystem/software_installer.go b/server/datastore/filesystem/software_installer.go
index 7bb68a87cca3..e9a1eb891e3f 100644
--- a/server/datastore/filesystem/software_installer.go
+++ b/server/datastore/filesystem/software_installer.go
@@ -6,6 +6,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"time"
 
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -93,7 +94,7 @@ func (i *SoftwareInstallerStore) Exists(ctx context.Context, installerID string)
 	return true, nil
 }
 
-func (i *SoftwareInstallerStore) Cleanup(ctx context.Context, usedInstallerIDs []string) (int, error) {
+func (i *SoftwareInstallerStore) Cleanup(ctx context.Context, usedInstallerIDs []string, removeCreatedBefore time.Time) (int, error) {
 	usedSet := make(map[string]struct{}, len(usedInstallerIDs))
 	for _, id := range usedInstallerIDs {
 		usedSet[id] = struct{}{}
@@ -115,6 +116,14 @@ func (i *SoftwareInstallerStore) Cleanup(ctx context.Context, usedInstallerIDs [
 		if _, isUsed := usedSet[de.Name()]; isUsed {
 			continue
 		}
+
+		info, err := de.Info()
+		if err != nil {
+			return 0, ctxerr.Wrap(ctx, err, "get software installer modtime in filesystem store")
+		}
+		if info.ModTime().After(removeCreatedBefore) {
+			continue
+		}
 		if err := os.Remove(filepath.Join(baseDir, de.Name())); err != nil {
 			errs = append(errs, err)
 		} else {
diff --git a/server/datastore/filesystem/software_installer_test.go b/server/datastore/filesystem/software_installer_test.go
index 3b942df885f6..6e7b0e454af1 100644
--- a/server/datastore/filesystem/software_installer_test.go
+++ b/server/datastore/filesystem/software_installer_test.go
@@ -11,6 +11,7 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/google/uuid"
@@ -107,7 +108,7 @@ func TestSoftwareInstallerCleanup(t *testing.T) {
 	}
 
 	// cleanup an empty store
-	n, err := store.Cleanup(ctx, nil)
+	n, err := store.Cleanup(ctx, nil, time.Now())
 	require.NoError(t, err)
 	require.Equal(t, 0, n)
 
@@ -117,14 +118,14 @@ func TestSoftwareInstallerCleanup(t *testing.T) {
 	require.NoError(t, err)
 
 	// cleanup but mark it as used
-	n, err = store.Cleanup(ctx, []string{ins0})
+	n, err = store.Cleanup(ctx, []string{ins0}, time.Now())
 	require.NoError(t, err)
 	require.Equal(t, 0, n)
 
 	assertExisting([]string{ins0})
 
 	// cleanup but mark it as unused
-	n, err = store.Cleanup(ctx, []string{})
+	n, err = store.Cleanup(ctx, []string{}, time.Now())
 	require.NoError(t, err)
 	require.Equal(t, 1, n)
 
@@ -137,9 +138,15 @@ func TestSoftwareInstallerCleanup(t *testing.T) {
 		require.NoError(t, err)
 	}
 
-	n, err = store.Cleanup(ctx, []string{installers[0], installers[2]})
+	// cleanup with a time in the past, nothing gets removed
+	n, err = store.Cleanup(ctx, []string{}, time.Now().Add(-time.Minute))
 	require.NoError(t, err)
-	require.Equal(t, 2, n)
+	require.Equal(t, 0, n)
+	assertExisting([]string{installers[0], installers[1], installers[2], installers[3]})
 
+	// cleanup in the future, all unused get removed
+	n, err = store.Cleanup(ctx, []string{installers[0], installers[2]}, time.Now().Add(time.Minute))
+	require.NoError(t, err)
+	require.Equal(t, 2, n)
 	assertExisting([]string{installers[0], installers[2]})
 }
diff --git a/server/datastore/mysql/activities.go b/server/datastore/mysql/activities.go
index f7267c36baed..09a71a6f22fd 100644
--- a/server/datastore/mysql/activities.go
+++ b/server/datastore/mysql/activities.go
@@ -31,7 +31,12 @@ func (ds *Datastore) NewActivity(
 	var userName *string
 	var userEmail *string
 	if user != nil {
-		userID = &user.ID
+		// To support creating activities with users that were deleted. This can happen
+		// for automatically installed software which uses the author of the upload as the author of
+		// the installation.
+		if user.ID != 0 {
+			userID = &user.ID
+		}
 		userName = &user.Name
 		userEmail = &user.Email
 	}
@@ -236,16 +241,23 @@ func (ds *Datastore) ListHostUpcomingActivities(ctx context.Context, hostID uint
 	countStmts := []string{
 		`SELECT
 			COUNT(*) c
-			FROM host_script_results
-			WHERE host_id = :host_id AND
+			FROM host_script_results hsr
+			WHERE hsr.host_id = :host_id AND
 						exit_code IS NULL AND
 						(sync_request = 0 OR created_at >= DATE_SUB(NOW(), INTERVAL :max_wait_time SECOND))`,
 		`SELECT
 			COUNT(*) c
-			FROM host_software_installs
-			WHERE host_id = :host_id AND
+			FROM host_software_installs hsi
+			WHERE hsi.host_id = :host_id AND
 						pre_install_query_output IS NULL AND
 						install_script_exit_code IS NULL`,
+		`
+		SELECT
+			COUNT(*) c
+			FROM nano_view_queue nvq
+			JOIN host_vpp_software_installs hvsi ON nvq.command_uuid = hvsi.command_uuid
+			WHERE hvsi.host_id = :host_id AND nvq.status IS NULL
+		`,
 	}
 
 	var count uint
@@ -304,10 +316,12 @@ func (ds *Datastore) ListHostUpcomingActivities(ctx context.Context, hostID uint
 		// list pending software installs
 		fmt.Sprintf(`SELECT
 			hsi.execution_id as uuid,
-			u.name as name,
-			u.id as user_id,
-			u.gravatar_url as gravatar_url,
-			u.email as user_email,
+			-- policies with automatic installers generate a host_software_installs with (user_id=NULL,self_service=0),
+			-- thus the user_id for the upcoming activity needs to be the user that uploaded the software installer.
+			IF(hsi.user_id IS NULL AND NOT hsi.self_service, u2.name, u.name) AS name,
+			IF(hsi.user_id IS NULL AND NOT hsi.self_service, u2.id, u.id) as user_id,
+			IF(hsi.user_id IS NULL AND NOT hsi.self_service, u2.gravatar_url, u.gravatar_url) as gravatar_url,
+			IF(hsi.user_id IS NULL AND NOT hsi.self_service, u2.email, u.email) AS user_email,
 			:installed_software_type as activity_type,
 			hsi.created_at as created_at,
 			JSON_OBJECT(
@@ -327,6 +341,8 @@ func (ds *Datastore) ListHostUpcomingActivities(ctx context.Context, hostID uint
 			software_titles st ON st.id = si.title_id
 		LEFT OUTER JOIN
 			users u ON u.id = hsi.user_id
+		LEFT OUTER JOIN
+			users u2 ON u2.id = si.user_id
 		LEFT OUTER JOIN
 			host_display_names hdn ON hdn.host_id = hsi.host_id
 		WHERE
@@ -334,6 +350,41 @@ func (ds *Datastore) ListHostUpcomingActivities(ctx context.Context, hostID uint
 			hsi.pre_install_query_output IS NULL AND
 			hsi.install_script_exit_code IS NULL
 		`, softwareInstallerHostStatusNamedQuery("hsi", "")),
+		`
+SELECT
+	hvsi.command_uuid AS uuid,
+	u.name AS name,
+	u.id AS user_id,
+	u.gravatar_url as gravatar_url,
+	u.email as user_email,
+	:installed_app_store_app_type AS activity_type,
+	hvsi.created_at AS created_at,
+	JSON_OBJECT(
+		'host_id', hvsi.host_id,
+		'host_display_name', hdn.display_name,
+		'software_title', st.name,
+		'app_store_id', hvsi.adam_id,
+		'command_uuid', hvsi.command_uuid,
+		'self_service', hvsi.self_service IS TRUE,
+		-- status is always pending because only pending MDM commands are upcoming.
+		'status', :software_status_pending
+	) AS details
+FROM
+	host_vpp_software_installs hvsi
+INNER JOIN 
+	nano_view_queue nvq ON nvq.command_uuid = hvsi.command_uuid
+LEFT OUTER JOIN 
+	users u ON hvsi.user_id = u.id
+LEFT OUTER JOIN 
+	host_display_names hdn ON hdn.host_id = hvsi.host_id
+LEFT OUTER JOIN 
+	vpp_apps vpa ON hvsi.adam_id = vpa.adam_id AND hvsi.platform = vpa.platform
+LEFT OUTER JOIN 
+	software_titles st ON st.id = vpa.title_id
+WHERE
+	nvq.status IS NULL
+	AND hvsi.host_id = :host_id
+`,
 	}
 
 	listStmt := `
@@ -348,13 +399,14 @@ func (ds *Datastore) ListHostUpcomingActivities(ctx context.Context, hostID uint
 			details
 		FROM ( ` + strings.Join(listStmts, " UNION ALL ") + ` ) AS upcoming `
 	listStmt, args, err = sqlx.Named(listStmt, map[string]any{
-		"host_id":                   hostID,
-		"ran_script_type":           fleet.ActivityTypeRanScript{}.ActivityName(),
-		"installed_software_type":   fleet.ActivityTypeInstalledSoftware{}.ActivityName(),
-		"max_wait_time":             seconds,
-		"software_status_failed":    string(fleet.SoftwareInstallerFailed),
-		"software_status_installed": string(fleet.SoftwareInstallerInstalled),
-		"software_status_pending":   string(fleet.SoftwareInstallerPending),
+		"host_id":                      hostID,
+		"ran_script_type":              fleet.ActivityTypeRanScript{}.ActivityName(),
+		"installed_software_type":      fleet.ActivityTypeInstalledSoftware{}.ActivityName(),
+		"installed_app_store_app_type": fleet.ActivityInstalledAppStoreApp{}.ActivityName(),
+		"max_wait_time":                seconds,
+		"software_status_failed":       string(fleet.SoftwareInstallerFailed),
+		"software_status_installed":    string(fleet.SoftwareInstallerInstalled),
+		"software_status_pending":      string(fleet.SoftwareInstallerPending),
 	})
 	if err != nil {
 		return nil, nil, ctxerr.Wrap(ctx, err, "build list query from named args")
diff --git a/server/datastore/mysql/activities_test.go b/server/datastore/mysql/activities_test.go
index e91a82522704..e56f5b073745 100644
--- a/server/datastore/mysql/activities_test.go
+++ b/server/datastore/mysql/activities_test.go
@@ -371,10 +371,15 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 	u2 := test.NewUser(t, ds, "user2", "user2@example.com", false)
 	ctx := viewer.NewContext(noUserCtx, viewer.Viewer{User: u2})
 
+	test.CreateInsertGlobalVPPToken(t, ds)
+
 	// create three hosts
 	h1 := test.NewHost(t, ds, "h1.local", "10.10.10.1", "1", "1", time.Now())
+	nanoEnrollAndSetHostMDMData(t, ds, h1, false)
 	h2 := test.NewHost(t, ds, "h2.local", "10.10.10.2", "2", "2", time.Now())
+	nanoEnrollAndSetHostMDMData(t, ds, h2, false)
 	h3 := test.NewHost(t, ds, "h3.local", "10.10.10.3", "3", "3", time.Now())
+	nanoEnrollAndSetHostMDMData(t, ds, h3, false)
 
 	// create a couple of named scripts
 	scr1, err := ds.NewScript(ctx, &fleet.Script{
@@ -398,6 +403,7 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 		Title:         "foo",
 		Source:        "apps",
 		Version:       "0.0.1",
+		UserID:        u.ID,
 	})
 	require.NoError(t, err)
 	sw2, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
@@ -408,6 +414,7 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 		Title:         "bar",
 		Source:        "apps",
 		Version:       "0.0.2",
+		UserID:        u.ID,
 	})
 	require.NoError(t, err)
 	sw1Meta, err := ds.GetSoftwareInstallerMetadataByID(ctx, sw1)
@@ -415,6 +422,35 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 	sw2Meta, err := ds.GetSoftwareInstallerMetadataByID(ctx, sw2)
 	require.NoError(t, err)
 
+	// insert a VPP app
+	vppCommand1, vppCommand2 := "vpp-command-1", "vpp-command-2"
+	vppApp := &fleet.VPPApp{
+		Name: "vpp_no_team_app_1", VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "3", Platform: fleet.MacOSPlatform}},
+		BundleIdentifier: "b3",
+	}
+	_, err = ds.InsertVPPAppWithTeam(ctx, vppApp, nil)
+	require.NoError(t, err)
+
+	// install the VPP app on h1
+	commander, _ := createMDMAppleCommanderAndStorage(t, ds)
+	err = ds.InsertHostVPPSoftwareInstall(ctx, h1.ID, vppApp.VPPAppID, vppCommand1, "event-id-1", false)
+	require.NoError(t, err)
+	err = commander.EnqueueCommand(
+		ctx,
+		[]string{h1.UUID},
+		createRawAppleCmd("InstallApplication", vppCommand1),
+	)
+	require.NoError(t, err)
+	// install the VPP app on h2, self-service
+	err = ds.InsertHostVPPSoftwareInstall(noUserCtx, h2.ID, vppApp.VPPAppID, vppCommand2, "event-id-2", true)
+	require.NoError(t, err)
+	err = commander.EnqueueCommand(
+		ctx,
+		[]string{h1.UUID},
+		createRawAppleCmd("InstallApplication", vppCommand2),
+	)
+	require.NoError(t, err)
+
 	// create a sync script request for h1 that has been pending for > MaxWaitTime, will not show up
 	hsr, err := ds.NewHostScriptExecutionRequest(ctx, &fleet.HostScriptRequestPayload{HostID: h1.ID, ScriptContents: "sync", UserID: &u.ID, SyncRequest: true})
 	require.NoError(t, err)
@@ -460,7 +496,10 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 		InstallScriptExitCode:     ptr.Int(0),
 	})
 	require.NoError(t, err)
-	h1Foo, err := ds.InsertSoftwareInstallRequest(noUserCtx, h1.ID, sw1Meta.InstallerID, false) // no user for this one
+
+	// No user for this one and not Self-service, means it was installed by Fleet thus the author was decided to be the admin
+	// that uploaded the installer.
+	h1Foo, err := ds.InsertSoftwareInstallRequest(noUserCtx, h1.ID, sw1Meta.InstallerID, false)
 	require.NoError(t, err)
 
 	// create a single pending request for h2, as well as a non-pending one
@@ -475,6 +514,9 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 	// add a pending software install request for h2
 	h2Bar, err := ds.InsertSoftwareInstallRequest(ctx, h2.ID, sw2Meta.InstallerID, false)
 	require.NoError(t, err)
+	// No user for this one and Self-service, means it was installed by the end user, so the user_id should be null/nil.
+	h2Foo, err := ds.InsertSoftwareInstallRequest(noUserCtx, h2.ID, sw1Meta.InstallerID, true)
+	require.NoError(t, err)
 
 	// nothing for h3
 
@@ -483,20 +525,26 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 	endTime = SetOrderedCreatedAtTimestamps(t, ds, endTime, "host_software_installs", "execution_id", h1FooFailed, h1Bar)
 	endTime = SetOrderedCreatedAtTimestamps(t, ds, endTime, "host_script_results", "execution_id", h1C, h1D, h1E)
 	endTime = SetOrderedCreatedAtTimestamps(t, ds, endTime, "host_software_installs", "execution_id", h1FooInstalled, h1Foo)
+	endTime = SetOrderedCreatedAtTimestamps(t, ds, endTime, "host_software_installs", "execution_id", h1Foo)
+	endTime = SetOrderedCreatedAtTimestamps(t, ds, endTime, "host_software_installs", "execution_id", h2Foo)
 	endTime = SetOrderedCreatedAtTimestamps(t, ds, endTime, "host_software_installs", "execution_id", h2Bar)
-	SetOrderedCreatedAtTimestamps(t, ds, endTime, "host_script_results", "execution_id", h2A, h2F)
+	endTime = SetOrderedCreatedAtTimestamps(t, ds, endTime, "host_script_results", "execution_id", h2A, h2F)
+	SetOrderedCreatedAtTimestamps(t, ds, endTime, "host_vpp_software_installs", "command_uuid", vppCommand1, vppCommand2)
 
 	execIDsWithUser := map[string]bool{
-		h1A:   true,
-		h1B:   true,
-		h1C:   true,
-		h1D:   false,
-		h1E:   false,
-		h2A:   true,
-		h2F:   true,
-		h1Foo: false,
-		h1Bar: true,
-		h2Bar: true,
+		h1A:         true,
+		h1B:         true,
+		h1C:         true,
+		h1D:         false,
+		h1E:         false,
+		h2A:         true,
+		h2F:         true,
+		h1Foo:       true,
+		h2Foo:       false,
+		h1Bar:       true,
+		h2Bar:       true,
+		vppCommand1: true,
+		vppCommand2: false,
 	}
 	execIDsScriptName := map[string]string{
 		h1A: scr1.Name,
@@ -507,6 +555,10 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 		h1Foo: "foo",
 		h1Bar: "bar",
 		h2Bar: "bar",
+		h2Foo: "foo",
+	}
+	execIDsWithUserAdminID := map[string]struct{}{
+		h1Foo: {},
 	}
 
 	cases := []struct {
@@ -519,49 +571,49 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 			opts:      fleet.ListOptions{PerPage: 2},
 			hostID:    h1.ID,
 			wantExecs: []string{h1A, h1B},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: false, TotalResults: 7},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: false, TotalResults: 8},
 		},
 		{
 			opts:      fleet.ListOptions{Page: 1, PerPage: 2},
 			hostID:    h1.ID,
 			wantExecs: []string{h1Bar, h1C},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: true, TotalResults: 7},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: true, TotalResults: 8},
 		},
 		{
 			opts:      fleet.ListOptions{Page: 2, PerPage: 2},
 			hostID:    h1.ID,
 			wantExecs: []string{h1D, h1E},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: true, TotalResults: 7},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: true, TotalResults: 8},
 		},
 		{
 			opts:      fleet.ListOptions{Page: 3, PerPage: 2},
 			hostID:    h1.ID,
-			wantExecs: []string{h1Foo},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 7},
+			wantExecs: []string{h1Foo, vppCommand1},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 8},
 		},
 		{
 			opts:      fleet.ListOptions{PerPage: 4},
 			hostID:    h1.ID,
 			wantExecs: []string{h1A, h1B, h1Bar, h1C},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: false, TotalResults: 7},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: false, TotalResults: 8},
 		},
 		{
 			opts:      fleet.ListOptions{Page: 1, PerPage: 4},
 			hostID:    h1.ID,
-			wantExecs: []string{h1D, h1E, h1Foo},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 7},
+			wantExecs: []string{h1D, h1E, h1Foo, vppCommand1},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 8},
 		},
 		{
 			opts:      fleet.ListOptions{Page: 2, PerPage: 4},
 			hostID:    h1.ID,
 			wantExecs: []string{},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 7},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 8},
 		},
 		{
-			opts:      fleet.ListOptions{PerPage: 3},
+			opts:      fleet.ListOptions{PerPage: 4},
 			hostID:    h2.ID,
-			wantExecs: []string{h2Bar, h2A},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: false, TotalResults: 2},
+			wantExecs: []string{h2Foo, h2Bar, h2A, vppCommand2},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: false, TotalResults: 4},
 		},
 		{
 			opts:      fleet.ListOptions{},
@@ -602,6 +654,16 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 				case fleet.ActivityTypeInstalledSoftware{}.ActivityName():
 					require.Equal(t, wantExec, details["install_uuid"], "result %d", i)
 					require.Equal(t, execIDsSoftwareTitle[wantExec], details["software_title"], "result %d", i)
+					if _, ok := execIDsWithUserAdminID[details["install_uuid"].(string)]; ok {
+						wantUser = u
+					} else {
+						wantUser = u2
+					}
+
+				case fleet.ActivityInstalledAppStoreApp{}.ActivityName():
+					require.Equal(t, wantExec, details["command_uuid"], "result %d", i)
+					require.Equal(t, "vpp_no_team_app_1", details["software_title"], "result %d", i)
+					require.Equal(t, !execIDsWithUser[wantExec], details["self_service"], "result %d", i)
 					wantUser = u2
 
 				default:
diff --git a/server/datastore/mysql/apple_mdm.go b/server/datastore/mysql/apple_mdm.go
index 1ec94188b144..e93c2fe9c0e8 100644
--- a/server/datastore/mysql/apple_mdm.go
+++ b/server/datastore/mysql/apple_mdm.go
@@ -7,10 +7,12 @@ import (
 	"crypto/cipher"
 	"crypto/rand"
 	"database/sql"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
+	"math"
 	"os"
 	"strings"
 	"time"
@@ -25,10 +27,14 @@ import (
 	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/go-kit/log"
 	"github.com/go-kit/log/level"
+	"github.com/google/go-cmp/cmp"
 	"github.com/google/uuid"
 	"github.com/jmoiron/sqlx"
 )
 
+// addHostMDMCommandsBatchSize is the number of host MDM commands to add in a single batch. This is a var so that it can be modified in tests.
+var addHostMDMCommandsBatchSize = 10000
+
 func (ds *Datastore) NewMDMAppleConfigProfile(ctx context.Context, cp fleet.MDMAppleConfigProfile) (*fleet.MDMAppleConfigProfile, error) {
 	profUUID := "a" + uuid.New().String()
 	stmt := `
@@ -83,7 +89,7 @@ INSERT INTO
 			cp.LabelsExcludeAny[i].Exclude = true
 			labels = append(labels, cp.LabelsExcludeAny[i])
 		}
-		if err := batchSetProfileLabelAssociationsDB(ctx, tx, labels, "darwin"); err != nil {
+		if _, err := batchSetProfileLabelAssociationsDB(ctx, tx, labels, "darwin"); err != nil {
 			return ctxerr.Wrap(ctx, err, "inserting darwin profile label associations")
 		}
 
@@ -784,30 +790,37 @@ func updateMDMAppleHostDB(
 ) error {
 	refetchRequested, lastEnrolledAt := mdmHostEnrollFields(mdmHost)
 
-	updateStmt := `
-		UPDATE hosts SET
-			hardware_serial = ?,
-			uuid = ?,
-			hardware_model = ?,
-			platform =  ?,
-			refetch_requested = ?,
-			last_enrolled_at = ?,
-			osquery_host_id = COALESCE(NULLIF(osquery_host_id, ''), ?)
-		WHERE id = ?`
-
-	if _, err := tx.ExecContext(
-		ctx,
-		updateStmt,
+	args := []interface{}{
 		mdmHost.HardwareSerial,
 		mdmHost.UUID,
 		mdmHost.HardwareModel,
 		mdmHost.Platform,
 		refetchRequested,
-		lastEnrolledAt,
 		// Set osquery_host_id to the device UUID only if it is not already set.
 		mdmHost.UUID,
 		hostID,
-	); err != nil {
+	}
+
+	// Only update last_enrolled_at if this is a iOS/iPadOS device.
+	// macOS should not update last_enrolled_at as it is set when osquery enrolls.
+	lastEnrolledAtColumn := ""
+	if mdmHost.Platform == "ios" || mdmHost.Platform == "ipados" {
+		lastEnrolledAtColumn = "last_enrolled_at = ?,"
+		args = append([]interface{}{lastEnrolledAt}, args...)
+	}
+
+	updateStmt := fmt.Sprintf(`
+		UPDATE hosts SET
+			%s
+			hardware_serial = ?,
+			uuid = ?,
+			hardware_model = ?,
+			platform =  ?,
+			refetch_requested = ?,
+			osquery_host_id = COALESCE(NULLIF(osquery_host_id, ''), ?)
+		WHERE id = ?`, lastEnrolledAtColumn)
+
+	if _, err := tx.ExecContext(ctx, updateStmt, args...); err != nil {
 		return ctxerr.Wrap(ctx, err, "update mdm apple host")
 	}
 
@@ -888,36 +901,49 @@ type hostWithEnrolled struct {
 	Enrolled *bool `db:"enrolled"`
 }
 
-func (ds *Datastore) IngestMDMAppleDevicesFromDEPSync(ctx context.Context, devices []godep.Device) (createdCount int64, teamID *uint, err error) {
+func (ds *Datastore) IngestMDMAppleDevicesFromDEPSync(
+	ctx context.Context,
+	devices []godep.Device,
+	abmTokenID uint,
+	macOSTeam, iosTeam, ipadTeam *fleet.Team,
+) (createdCount int64, err error) {
 	if len(devices) < 1 {
 		level.Debug(ds.logger).Log("msg", "ingesting devices from DEP received < 1 device, skipping", "len(devices)", len(devices))
-		return 0, nil, nil
+		return 0, nil
 	}
 
 	appCfg, err := ds.AppConfig(ctx)
 	if err != nil {
-		return 0, nil, ctxerr.Wrap(ctx, err, "ingest mdm apple host get app config")
-	}
-
-	args := []interface{}{nil}
-	if name := appCfg.MDM.AppleBMDefaultTeam; name != "" {
-		team, err := ds.TeamByName(ctx, name)
-		switch {
-		case fleet.IsNotFound(err):
-			level.Debug(ds.logger).Log(
-				"msg",
-				"ingesting devices from DEP: unable to find default team assigned in config, the devices won't be assigned to a team",
-				"team_name",
-				name,
-			)
-			// If the team doesn't exist, we still ingest the device, but it won't
-			// belong to any team.
-		case err != nil:
-			return 0, nil, ctxerr.Wrap(ctx, err, "ingest mdm apple host get team by name")
-		default:
-			args[0] = team.ID
-			teamID = &team.ID
+		return 0, ctxerr.Wrap(ctx, err, "ingest mdm apple host get app config")
+	}
+
+	var args []any
+	teams := []*fleet.Team{iosTeam, ipadTeam, macOSTeam}
+	for _, team := range teams {
+		if team == nil {
+			args = append(args, nil)
+			continue
+		}
+
+		exists, err := ds.TeamExists(ctx, team.ID)
+		if err != nil {
+			return 0, ctxerr.Wrap(ctx, err, "ingest mdm apple host get team by name")
+		}
+
+		if exists {
+			args = append(args, team.ID)
+			continue
 		}
+
+		// If the team doesn't exist, we still ingest the device, but it won't
+		// belong to any team.
+		level.Debug(ds.logger).Log(
+			"msg",
+			"ingesting devices from ABM: unable to find default team assigned in config, the devices won't be assigned to a team",
+			"team_id",
+			team,
+		)
+		args = append(args, nil)
 	}
 
 	err = ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
@@ -943,7 +969,11 @@ func (ds *Datastore) IngestMDMAppleDevicesFromDEPSync(ctx context.Context, devic
 				'2000-01-01 00:00:00' AS detail_updated_at,
 				NULL AS osquery_host_id,
 				IF(us.platform = 'ios' OR us.platform = 'ipados', 0, 1) AS refetch_requested,
-				? AS team_id
+				CASE
+					WHEN us.platform = 'ios' THEN ?
+					WHEN us.platform = 'ipados' THEN ?
+					ELSE ?
+				END AS team_id
 			FROM (%s) us
 			LEFT JOIN hosts h ON us.hardware_serial = h.hardware_serial
 		WHERE
@@ -1004,7 +1034,7 @@ func (ds *Datastore) IngestMDMAppleDevicesFromDEPSync(ctx context.Context, devic
 		if err := upsertMDMAppleHostLabelMembershipDB(ctx, tx, ds.logger, hosts...); err != nil {
 			return ctxerr.Wrap(ctx, err, "ingest mdm apple host upsert label membership")
 		}
-		if err := upsertHostDEPAssignmentsDB(ctx, tx, hosts); err != nil {
+		if err := upsertHostDEPAssignmentsDB(ctx, tx, hosts, abmTokenID); err != nil {
 			return ctxerr.Wrap(ctx, err, "ingest mdm apple host upsert DEP assignments")
 		}
 
@@ -1028,12 +1058,12 @@ func (ds *Datastore) IngestMDMAppleDevicesFromDEPSync(ctx context.Context, devic
 		return nil
 	})
 
-	return createdCount, teamID, err
+	return createdCount, err
 }
 
-func (ds *Datastore) UpsertMDMAppleHostDEPAssignments(ctx context.Context, hosts []fleet.Host) error {
+func (ds *Datastore) UpsertMDMAppleHostDEPAssignments(ctx context.Context, hosts []fleet.Host, abmTokenID uint) error {
 	return ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-		if err := upsertHostDEPAssignmentsDB(ctx, tx, hosts); err != nil {
+		if err := upsertHostDEPAssignmentsDB(ctx, tx, hosts, abmTokenID); err != nil {
 			return ctxerr.Wrap(ctx, err, "upsert host DEP assignments")
 		}
 
@@ -1041,13 +1071,13 @@ func (ds *Datastore) UpsertMDMAppleHostDEPAssignments(ctx context.Context, hosts
 	})
 }
 
-func upsertHostDEPAssignmentsDB(ctx context.Context, tx sqlx.ExtContext, hosts []fleet.Host) error {
+func upsertHostDEPAssignmentsDB(ctx context.Context, tx sqlx.ExtContext, hosts []fleet.Host, abmTokenID uint) error {
 	if len(hosts) == 0 {
 		return nil
 	}
 
 	stmt := `
-		INSERT INTO host_dep_assignments (host_id)
+		INSERT INTO host_dep_assignments (host_id, abm_token_id)
 		VALUES %s
 		ON DUPLICATE KEY UPDATE
 		  added_at = CURRENT_TIMESTAMP,
@@ -1056,8 +1086,8 @@ func upsertHostDEPAssignmentsDB(ctx context.Context, tx sqlx.ExtContext, hosts [
 	args := []interface{}{}
 	values := []string{}
 	for _, host := range hosts {
-		args = append(args, host.ID)
-		values = append(values, "(?)")
+		args = append(args, host.ID, abmTokenID)
+		values = append(values, "(?, ?)")
 	}
 
 	_, err := tx.ExecContext(ctx, fmt.Sprintf(stmt, strings.Join(values, ",")), args...)
@@ -1106,7 +1136,7 @@ func upsertMDMAppleHostMDMInfoDB(ctx context.Context, tx sqlx.ExtContext, server
 	}
 
 	var mdmID int64
-	if insertOnDuplicateDidInsert(result) {
+	if insertOnDuplicateDidInsertOrUpdate(result) {
 		mdmID, _ = result.LastInsertId()
 	} else {
 		stmt := `SELECT id FROM mobile_device_management_solutions WHERE name = ? AND server_url = ?`
@@ -1304,7 +1334,7 @@ func unionSelectDevices(devices []godep.Device) (stmt string, args []interface{}
 func (ds *Datastore) GetHostDEPAssignment(ctx context.Context, hostID uint) (*fleet.HostDEPAssignment, error) {
 	var res fleet.HostDEPAssignment
 	err := sqlx.GetContext(ctx, ds.reader(ctx), &res, `
-		SELECT host_id, added_at, deleted_at FROM host_dep_assignments hdep WHERE hdep.host_id = ?`, hostID)
+		SELECT host_id, added_at, deleted_at, abm_token_id FROM host_dep_assignments hdep WHERE hdep.host_id = ?`, hostID)
 	if err != nil {
 		if err == sql.ErrNoRows {
 			return nil, ctxerr.Wrap(ctx, notFound("HostDEPAssignment").WithID(hostID))
@@ -1415,7 +1445,8 @@ func (ds *Datastore) GetNanoMDMEnrollment(ctx context.Context, id string) (*flee
 
 func (ds *Datastore) BatchSetMDMAppleProfiles(ctx context.Context, tmID *uint, profiles []*fleet.MDMAppleConfigProfile) error {
 	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
-		return ds.batchSetMDMAppleProfilesDB(ctx, tx, tmID, profiles)
+		_, err := ds.batchSetMDMAppleProfilesDB(ctx, tx, tmID, profiles)
+		return err
 	})
 }
 
@@ -1425,7 +1456,7 @@ func (ds *Datastore) batchSetMDMAppleProfilesDB(
 	tx sqlx.ExtContext,
 	tmID *uint,
 	profiles []*fleet.MDMAppleConfigProfile,
-) error {
+) (updatedDB bool, err error) {
 	const loadExistingProfiles = `
 SELECT
   identifier,
@@ -1487,13 +1518,13 @@ ON DUPLICATE KEY UPDATE
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "build query to load existing profiles")
+			return false, ctxerr.Wrap(ctx, err, "build query to load existing profiles")
 		}
 		if err := sqlx.SelectContext(ctx, tx, &existingProfiles, stmt, args...); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "select") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "load existing profiles")
+			return false, ctxerr.Wrap(ctx, err, "load existing profiles")
 		}
 	}
 
@@ -1514,31 +1545,37 @@ ON DUPLICATE KEY UPDATE
 	var (
 		stmt string
 		args []interface{}
-		err  error
 	)
 	// delete the obsolete profiles (all those that are not in keepIdents or delivered by Fleet)
+	var result sql.Result
 	stmt, args, err = sqlx.In(deleteProfilesNotInList, profTeamID, append(keepIdents, fleetIdents...))
 	if err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "indelete") {
 		if err == nil {
 			err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 		}
-		return ctxerr.Wrap(ctx, err, "build statement to delete obsolete profiles")
+		return false, ctxerr.Wrap(ctx, err, "build statement to delete obsolete profiles")
 	}
-	if _, err := tx.ExecContext(ctx, stmt, args...); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "delete") {
+	if result, err = tx.ExecContext(ctx, stmt, args...); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "delete") {
 		if err == nil {
 			err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 		}
-		return ctxerr.Wrap(ctx, err, "delete obsolete profiles")
+		return false, ctxerr.Wrap(ctx, err, "delete obsolete profiles")
+	}
+	if result != nil {
+		rows, _ := result.RowsAffected()
+		updatedDB = rows > 0
 	}
 
 	// insert the new profiles and the ones that have changed
 	for _, p := range incomingProfs {
-		if _, err := tx.ExecContext(ctx, insertNewOrEditedProfile, profTeamID, p.Identifier, p.Name, p.Mobileconfig); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "insert") {
+		if result, err = tx.ExecContext(ctx, insertNewOrEditedProfile, profTeamID, p.Identifier, p.Name,
+			p.Mobileconfig); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "insert") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 			}
-			return ctxerr.Wrapf(ctx, err, "insert new/edited profile with identifier %q", p.Identifier)
+			return false, ctxerr.Wrapf(ctx, err, "insert new/edited profile with identifier %q", p.Identifier)
 		}
+		updatedDB = updatedDB || insertOnDuplicateDidInsertOrUpdate(result)
 	}
 
 	// build a list of labels so the associations can be batch-set all at once
@@ -1554,19 +1591,19 @@ ON DUPLICATE KEY UPDATE
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "build query to load newly inserted profiles")
+			return false, ctxerr.Wrap(ctx, err, "build query to load newly inserted profiles")
 		}
 		if err := sqlx.SelectContext(ctx, tx, &newlyInsertedProfs, stmt, args...); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "reselect") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "load newly inserted profiles")
+			return false, ctxerr.Wrap(ctx, err, "load newly inserted profiles")
 		}
 
 		for _, newlyInsertedProf := range newlyInsertedProfs {
 			incomingProf, ok := incomingProfs[newlyInsertedProf.Identifier]
 			if !ok {
-				return ctxerr.Wrapf(ctx, err, "profile %q is in the database but was not incoming", newlyInsertedProf.Identifier)
+				return false, ctxerr.Wrapf(ctx, err, "profile %q is in the database but was not incoming", newlyInsertedProf.Identifier)
 			}
 
 			for _, label := range incomingProf.LabelsIncludeAll {
@@ -1582,13 +1619,15 @@ ON DUPLICATE KEY UPDATE
 	}
 
 	// insert label associations
-	if err := batchSetProfileLabelAssociationsDB(ctx, tx, incomingLabels, "darwin"); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "labels") {
+	var updatedLabels bool
+	if updatedLabels, err = batchSetProfileLabelAssociationsDB(ctx, tx, incomingLabels,
+		"darwin"); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "labels") {
 		if err == nil {
 			err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 		}
-		return ctxerr.Wrap(ctx, err, "inserting apple profile label associations")
+		return false, ctxerr.Wrap(ctx, err, "inserting apple profile label associations")
 	}
-	return nil
+	return updatedDB || updatedLabels, nil
 }
 
 func (ds *Datastore) BulkDeleteMDMAppleHostsConfigProfiles(ctx context.Context, profs []*fleet.MDMAppleProfilePayload) error {
@@ -1653,9 +1692,9 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 	ctx context.Context,
 	tx sqlx.ExtContext,
 	uuids []string,
-) error {
+) (updatedDB bool, err error) {
 	if len(uuids) == 0 {
-		return nil
+		return false, nil
 	}
 
 	appleMDMProfilesDesiredStateQuery := generateDesiredStateQuery("profile")
@@ -1701,18 +1740,39 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 		( hmap.host_uuid IS NOT NULL AND ( hmap.operation_type = ? OR hmap.operation_type IS NULL ) )
 `, fmt.Sprintf(appleMDMProfilesDesiredStateQuery, "h.uuid IN (?)", "h.uuid IN (?)", "h.uuid IN (?)"))
 
-	// TODO: if a very large number (~65K) of host uuids was matched (via
-	// uuids, teams or profile IDs), could result in too many placeholders (not
-	// an immediate concern).
-	stmt, args, err := sqlx.In(toInstallStmt, uuids, uuids, uuids, fleet.MDMOperationTypeRemove)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "building profiles to install statement")
+	// batches of 10K hosts because h.uuid appears three times in the
+	// query, and the max number of prepared statements is 65K, this was
+	// good enough during a load test and gives us wiggle room if we add
+	// more arguments and we forget to update the batch size.
+	selectProfilesBatchSize := 10_000
+	if ds.testSelectMDMProfilesBatchSize > 0 {
+		selectProfilesBatchSize = ds.testSelectMDMProfilesBatchSize
 	}
+	selectProfilesTotalBatches := int(math.Ceil(float64(len(uuids)) / float64(selectProfilesBatchSize)))
 
 	var wantedProfiles []*fleet.MDMAppleProfilePayload
-	err = sqlx.SelectContext(ctx, tx, &wantedProfiles, stmt, args...)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "bulk set pending profile status execute")
+	for i := 0; i < selectProfilesTotalBatches; i++ {
+		start := i * selectProfilesBatchSize
+		end := start + selectProfilesBatchSize
+		if end > len(uuids) {
+			end = len(uuids)
+		}
+
+		batchUUIDs := uuids[start:end]
+
+		stmt, args, err := sqlx.In(toInstallStmt, batchUUIDs, batchUUIDs, batchUUIDs, fleet.MDMOperationTypeRemove)
+		if err != nil {
+			return false, ctxerr.Wrapf(ctx, err, "building statement to select profiles to install, batch %d of %d", i,
+				selectProfilesTotalBatches)
+		}
+
+		var partialResult []*fleet.MDMAppleProfilePayload
+		err = sqlx.SelectContext(ctx, tx, &partialResult, stmt, args...)
+		if err != nil {
+			return false, ctxerr.Wrapf(ctx, err, "selecting profiles to install, batch %d of %d", i, selectProfilesTotalBatches)
+		}
+
+		wantedProfiles = append(wantedProfiles, partialResult...)
 	}
 
 	// Exclude macOS only profiles from iPhones/iPads.
@@ -1749,28 +1809,44 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 		)
 `, fmt.Sprintf(appleMDMProfilesDesiredStateQuery, "h.uuid IN (?)", "h.uuid IN (?)", "h.uuid IN (?)"))
 
-	// TODO: if a very large number (~65K) of host uuids was matched (via
-	// uuids, teams or profile IDs), could result in too many placeholders (not
-	// an immediate concern). Note that uuids are provided twice.
-	stmt, args, err = sqlx.In(toRemoveStmt, uuids, uuids, uuids, uuids, fleet.MDMOperationTypeRemove)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "building profiles to remove statement")
-	}
 	var currentProfiles []*fleet.MDMAppleProfilePayload
-	err = sqlx.SelectContext(ctx, tx, &currentProfiles, stmt, args...)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "fetching profiles to remove")
+	for i := 0; i < selectProfilesTotalBatches; i++ {
+		start := i * selectProfilesBatchSize
+		end := start + selectProfilesBatchSize
+		if end > len(uuids) {
+			end = len(uuids)
+		}
+
+		batchUUIDs := uuids[start:end]
+
+		stmt, args, err := sqlx.In(toRemoveStmt, batchUUIDs, batchUUIDs, batchUUIDs, batchUUIDs, fleet.MDMOperationTypeRemove)
+		if err != nil {
+			return false, ctxerr.Wrap(ctx, err, "building profiles to remove statement")
+		}
+		var partialResult []*fleet.MDMAppleProfilePayload
+		err = sqlx.SelectContext(ctx, tx, &partialResult, stmt, args...)
+		if err != nil {
+			return false, ctxerr.Wrap(ctx, err, "fetching profiles to remove")
+		}
+
+		currentProfiles = append(currentProfiles, partialResult...)
 	}
 
 	if len(wantedProfiles) == 0 && len(currentProfiles) == 0 {
-		return nil
+		return false, nil
 	}
 
 	// delete all host profiles to start from a clean slate, new entries will be added next
 	// TODO(roberto): is this really necessary? this was pre-existing
 	// behavior but I think it can be refactored. For now leaving it as-is.
-	if err := ds.bulkDeleteMDMAppleHostsConfigProfilesDB(ctx, tx, wantedProfiles); err != nil {
-		return ctxerr.Wrap(ctx, err, "bulk delete all profiles")
+	//
+	// TODO part II(roberto): we found this call to be a major bottleneck during load testing
+	// https://github.com/fleetdm/fleet/issues/21338
+	if len(wantedProfiles) > 0 {
+		if err := ds.bulkDeleteMDMAppleHostsConfigProfilesDB(ctx, tx, wantedProfiles); err != nil {
+			return false, ctxerr.Wrap(ctx, err, "bulk delete all profiles")
+		}
+		updatedDB = true
 	}
 
 	// profileIntersection tracks profilesToAdd ∩ profilesToRemove, this is used to avoid:
@@ -1791,11 +1867,57 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 			hostProfilesToClean = append(hostProfilesToClean, p)
 		}
 	}
-	if err := ds.bulkDeleteMDMAppleHostsConfigProfilesDB(ctx, tx, hostProfilesToClean); err != nil {
-		return ctxerr.Wrap(ctx, err, "bulk delete profiles to clean")
+	if len(hostProfilesToClean) > 0 {
+		if err := ds.bulkDeleteMDMAppleHostsConfigProfilesDB(ctx, tx, hostProfilesToClean); err != nil {
+			return false, ctxerr.Wrap(ctx, err, "bulk delete profiles to clean")
+		}
+		updatedDB = true
 	}
 
+	profilesToInsert := make(map[string]*fleet.MDMAppleProfilePayload)
+
 	executeUpsertBatch := func(valuePart string, args []any) error {
+		// Check if the update needs to be done at all.
+		selectStmt := fmt.Sprintf(`
+			SELECT 
+				host_uuid,
+				profile_uuid,
+				profile_identifier,
+				status,
+				COALESCE(operation_type, '') AS operation_type,
+				COALESCE(detail, '') AS detail,
+				command_uuid,
+				profile_name,
+				checksum,
+				profile_uuid
+			FROM host_mdm_apple_profiles WHERE (host_uuid, profile_uuid) IN (%s)`,
+			strings.TrimSuffix(strings.Repeat("(?,?),", len(profilesToInsert)), ","))
+		var selectArgs []any
+		for _, p := range profilesToInsert {
+			selectArgs = append(selectArgs, p.HostUUID, p.ProfileUUID)
+		}
+		var existingProfiles []fleet.MDMAppleProfilePayload
+		if err := sqlx.SelectContext(ctx, tx, &existingProfiles, selectStmt, selectArgs...); err != nil {
+			return ctxerr.Wrap(ctx, err, "bulk set pending profile status select existing")
+		}
+		var updateNeeded bool
+		if len(existingProfiles) == len(profilesToInsert) {
+			for _, exist := range existingProfiles {
+				insert, ok := profilesToInsert[fmt.Sprintf("%s\n%s", exist.HostUUID, exist.ProfileUUID)]
+				if !ok || !exist.Equal(*insert) {
+					updateNeeded = true
+					break
+				}
+			}
+		} else {
+			updateNeeded = true
+		}
+		if !updateNeeded {
+			// All profiles are already in the database, no need to update.
+			return nil
+		}
+
+		updatedDB = true
 		baseStmt := fmt.Sprintf(`
 				INSERT INTO host_mdm_apple_profiles (
 					profile_uuid,
@@ -1835,6 +1957,7 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 
 	resetBatch := func() {
 		batchCount = 0
+		clear(profilesToInsert)
 		pargs = pargs[:0]
 		psb.Reset()
 	}
@@ -1842,6 +1965,18 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 	for _, p := range wantedProfiles {
 		if pp, ok := profileIntersection.GetMatchingProfileInCurrentState(p); ok {
 			if pp.Status != &fleet.MDMDeliveryFailed && bytes.Equal(pp.Checksum, p.Checksum) {
+				profilesToInsert[fmt.Sprintf("%s\n%s", p.HostUUID, p.ProfileUUID)] = &fleet.MDMAppleProfilePayload{
+					ProfileUUID:       p.ProfileUUID,
+					ProfileIdentifier: p.ProfileIdentifier,
+					ProfileName:       p.ProfileName,
+					HostUUID:          p.HostUUID,
+					HostPlatform:      p.HostPlatform,
+					Checksum:          p.Checksum,
+					Status:            pp.Status,
+					OperationType:     pp.OperationType,
+					Detail:            pp.Detail,
+					CommandUUID:       pp.CommandUUID,
+				}
 				pargs = append(pargs, p.ProfileUUID, p.HostUUID, p.ProfileIdentifier, p.ProfileName, p.Checksum,
 					pp.OperationType, pp.Status, pp.CommandUUID, pp.Detail)
 				psb.WriteString("(?, ?, ?, ?, ?, ?, ?, ?, ?),")
@@ -1849,7 +1984,7 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 
 				if batchCount >= batchSize {
 					if err := executeUpsertBatch(psb.String(), pargs); err != nil {
-						return err
+						return false, err
 					}
 					resetBatch()
 				}
@@ -1857,6 +1992,18 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 			}
 		}
 
+		profilesToInsert[fmt.Sprintf("%s\n%s", p.HostUUID, p.ProfileUUID)] = &fleet.MDMAppleProfilePayload{
+			ProfileUUID:       p.ProfileUUID,
+			ProfileIdentifier: p.ProfileIdentifier,
+			ProfileName:       p.ProfileName,
+			HostUUID:          p.HostUUID,
+			HostPlatform:      p.HostPlatform,
+			Checksum:          p.Checksum,
+			OperationType:     fleet.MDMOperationTypeInstall,
+			Status:            nil,
+			CommandUUID:       "",
+			Detail:            "",
+		}
 		pargs = append(pargs, p.ProfileUUID, p.HostUUID, p.ProfileIdentifier, p.ProfileName, p.Checksum,
 			fleet.MDMOperationTypeInstall, nil, "", "")
 		psb.WriteString("(?, ?, ?, ?, ?, ?, ?, ?, ?),")
@@ -1864,7 +2011,7 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 
 		if batchCount >= batchSize {
 			if err := executeUpsertBatch(psb.String(), pargs); err != nil {
-				return err
+				return false, err
 			}
 			resetBatch()
 		}
@@ -1881,6 +2028,18 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 		if p.FailedToInstallOnHost() {
 			continue
 		}
+		profilesToInsert[fmt.Sprintf("%s\n%s", p.HostUUID, p.ProfileUUID)] = &fleet.MDMAppleProfilePayload{
+			ProfileUUID:       p.ProfileUUID,
+			ProfileIdentifier: p.ProfileIdentifier,
+			ProfileName:       p.ProfileName,
+			HostUUID:          p.HostUUID,
+			HostPlatform:      p.HostPlatform,
+			Checksum:          p.Checksum,
+			OperationType:     fleet.MDMOperationTypeRemove,
+			Status:            nil,
+			CommandUUID:       "",
+			Detail:            "",
+		}
 		pargs = append(pargs, p.ProfileUUID, p.HostUUID, p.ProfileIdentifier, p.ProfileName, p.Checksum,
 			fleet.MDMOperationTypeRemove, nil, "", "")
 		psb.WriteString("(?, ?, ?, ?, ?, ?, ?, ?, ?),")
@@ -1888,7 +2047,7 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 
 		if batchCount >= batchSize {
 			if err := executeUpsertBatch(psb.String(), pargs); err != nil {
-				return err
+				return false, err
 			}
 			resetBatch()
 		}
@@ -1896,10 +2055,10 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 
 	if batchCount > 0 {
 		if err := executeUpsertBatch(psb.String(), pargs); err != nil {
-			return err
+			return false, err
 		}
 	}
-	return nil
+	return updatedDB, nil
 }
 
 // mdmEntityTypeToDynamicNames tracks what names should be used in the
@@ -2953,21 +3112,74 @@ func (ds *Datastore) BulkUpsertMDMAppleConfigProfiles(ctx context.Context, paylo
 	return nil
 }
 
-func (ds *Datastore) InsertMDMAppleBootstrapPackage(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage) error {
-	stmt := `
-          INSERT INTO mdm_apple_bootstrap_packages (team_id, name, sha256, bytes, token)
-	  VALUES (?, ?, ?, ?, ?)
-	`
+func isMDMAppleBootstrapPackageInDB(ctx context.Context, q sqlx.QueryerContext, teamID uint) (isInDB, existsForTeam bool, err error) {
+	const stmt = `SELECT COALESCE(LENGTH(bytes), 0) FROM mdm_apple_bootstrap_packages WHERE team_id = ?`
+	var pkgLen int
+	if err := sqlx.GetContext(ctx, q, &pkgLen, stmt, teamID); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return false, false, nil
+		}
+		return false, false, ctxerr.Wrapf(ctx, err, "check for bootstrap package content in database for team %d", teamID)
+	}
+	return pkgLen > 0, true, nil
+}
+
+func (ds *Datastore) InsertMDMAppleBootstrapPackage(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage, pkgStore fleet.MDMBootstrapPackageStore) error {
+	const insStmt = `INSERT INTO mdm_apple_bootstrap_packages (team_id, name, sha256, bytes, token) VALUES (?, ?, ?, ?, ?)`
+	execInsert := func(args ...any) error {
+		if _, err := ds.writer(ctx).ExecContext(ctx, insStmt, args...); err != nil {
+			if IsDuplicate(err) {
+				return ctxerr.Wrap(ctx, alreadyExists("BootstrapPackage", fmt.Sprintf("for team %d", bp.TeamID)))
+			}
+			return ctxerr.Wrap(ctx, err, "create bootstrap package")
+		}
+		return nil
+	}
+
+	if pkgStore == nil {
+		// no S3 storage configured, insert the metadata and the content in the DB
+		return execInsert(bp.TeamID, bp.Name, bp.Sha256, bp.Bytes, bp.Token)
+	}
+
+	// using distinct storages for content and metadata introduces an
+	// intractable problem: the operation cannot be atomic (all succeed or all
+	// fail together), so what we do instead is to minimize the risk of data
+	// inconsistency:
+	//
+	//   1. check if the row exists in the DB, if so fail immediately with a
+	//   duplicate error (which would happen at the INSERT stage anyway
+	//   otherwise).
+	//   2. if it does not exist in the DB, check if the package is already on
+	//   S3, to avoid a costly upload if it is.
+	//   3. if it is not already on S3, upload the package - if this fails,
+	//   return and the DB was not touched and data is still consistent.
+	//   4. after upload, insert the metadata in the DB - if this fails, the
+	//   only possible inconsistency is an unused package stored on S3, which a
+	//   cron job will eventually cleanup.
+	//   5. if everything succeeds, data is consistent and the S3 package
+	//   cannot be used before it is uploaded (since the DB row is inserted
+	//   after upload).
+	_, existsInDB, err := isMDMAppleBootstrapPackageInDB(ctx, ds.writer(ctx), bp.TeamID)
+	if err != nil {
+		return err
+	}
+	if existsInDB {
+		return ctxerr.Wrap(ctx, alreadyExists("BootstrapPackage", fmt.Sprintf("for team %d", bp.TeamID)))
+	}
 
-	_, err := ds.writer(ctx).ExecContext(ctx, stmt, bp.TeamID, bp.Name, bp.Sha256, bp.Bytes, bp.Token)
+	pkgID := hex.EncodeToString(bp.Sha256)
+	ok, err := pkgStore.Exists(ctx, pkgID)
 	if err != nil {
-		if IsDuplicate(err) {
-			return ctxerr.Wrap(ctx, alreadyExists("BootstrapPackage", fmt.Sprintf("for team %d", bp.TeamID)))
+		return ctxerr.Wrapf(ctx, err, "check if bootstrap package %s already exists", pkgID)
+	}
+	if !ok {
+		if err := pkgStore.Put(ctx, pkgID, bytes.NewReader(bp.Bytes)); err != nil {
+			return ctxerr.Wrapf(ctx, err, "upload bootstrap package %s to S3", pkgID)
 		}
-		return ctxerr.Wrap(ctx, err, "create bootstrap package")
 	}
 
-	return nil
+	// insert in the DB with a NULL bytes content (to indicate it is on S3)
+	return execInsert(bp.TeamID, bp.Name, bp.Sha256, nil, bp.Token)
 }
 
 func (ds *Datastore) CopyDefaultMDMAppleBootstrapPackage(ctx context.Context, ac *fleet.AppConfig, toTeamID uint) error {
@@ -2978,6 +3190,9 @@ func (ds *Datastore) CopyDefaultMDMAppleBootstrapPackage(ctx context.Context, ac
 		return ctxerr.New(ctx, "team id must not be zero")
 	}
 
+	// NOTE: if the bootstrap package is stored in S3, nothing needs to happen on
+	// S3 for a copy of it since the bytes are the same and the stored contents
+	// is the same (the sha256 is copied, so it points to the same file on S3).
 	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
 		// Copy the bytes for the default bootstrap package to the specified team
 		insertStmt := `
@@ -3022,6 +3237,12 @@ WHERE id = ?
 }
 
 func (ds *Datastore) DeleteMDMAppleBootstrapPackage(ctx context.Context, teamID uint) error {
+	// NOTE: if S3 storage is used for the bootstrap package, we don't delete it
+	// here. The reason for this is that other teams may be using the same
+	// package, so it would use the same S3 key (based on its hash). Instead we
+	// rely on the cron job to clear unused packages from S3. Outside of using up
+	// space in the bucket, an unused package on S3 is not a problem.
+
 	stmt := "DELETE FROM mdm_apple_bootstrap_packages WHERE team_id = ?"
 	res, err := ds.writer(ctx).ExecContext(ctx, stmt, teamID)
 	if err != nil {
@@ -3035,8 +3256,9 @@ func (ds *Datastore) DeleteMDMAppleBootstrapPackage(ctx context.Context, teamID
 	return nil
 }
 
-func (ds *Datastore) GetMDMAppleBootstrapPackageBytes(ctx context.Context, token string) (*fleet.MDMAppleBootstrapPackage, error) {
-	stmt := "SELECT name, bytes FROM mdm_apple_bootstrap_packages WHERE token = ?"
+func (ds *Datastore) GetMDMAppleBootstrapPackageBytes(ctx context.Context, token string, pkgStore fleet.MDMBootstrapPackageStore) (*fleet.MDMAppleBootstrapPackage, error) {
+	const stmt = `SELECT name, bytes, sha256 FROM mdm_apple_bootstrap_packages WHERE token = ?`
+
 	var bp fleet.MDMAppleBootstrapPackage
 	if err := sqlx.GetContext(ctx, ds.reader(ctx), &bp, stmt, token); err != nil {
 		if err == sql.ErrNoRows {
@@ -3044,6 +3266,24 @@ func (ds *Datastore) GetMDMAppleBootstrapPackageBytes(ctx context.Context, token
 		}
 		return nil, ctxerr.Wrap(ctx, err, "get bootstrap package bytes")
 	}
+
+	if pkgStore != nil && len(bp.Bytes) == 0 {
+		// bootstrap package is stored on S3, retrieve it
+		pkgID := hex.EncodeToString(bp.Sha256)
+		rc, _, err := pkgStore.Get(ctx, pkgID)
+		if err != nil {
+			return nil, ctxerr.Wrapf(ctx, err, "get bootstrap package %s from S3", pkgID)
+		}
+		defer rc.Close()
+
+		// TODO: optimize memory usage by supporting a streaming approach
+		// throughout the API (we have a similar issue with software installers).
+		// Currently we load everything in memory and those can be quite big.
+		bp.Bytes, err = io.ReadAll(rc)
+		if err != nil {
+			return nil, ctxerr.Wrapf(ctx, err, "reading bootstrap package %s from S3", pkgID)
+		}
+	}
 	return &bp, nil
 }
 
@@ -3146,6 +3386,27 @@ func (ds *Datastore) GetMDMAppleBootstrapPackageMeta(ctx context.Context, teamID
 	return &bp, nil
 }
 
+func (ds *Datastore) CleanupUnusedBootstrapPackages(ctx context.Context, pkgStore fleet.MDMBootstrapPackageStore, removeCreatedBefore time.Time) error {
+	if pkgStore == nil {
+		// no-op in this case, possible if not running with a Premium license or
+		// configured S3 storage
+		return nil
+	}
+
+	// get the list of bootstrap package hashes that are in use
+	var shaIDs [][]byte
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &shaIDs, `SELECT DISTINCT sha256 FROM mdm_apple_bootstrap_packages`); err != nil {
+		return ctxerr.Wrap(ctx, err, "get list of bootstrap packages in use")
+	}
+	var pkgIDs []string
+	for _, sha := range shaIDs {
+		pkgIDs = append(pkgIDs, hex.EncodeToString(sha))
+	}
+
+	_, err := pkgStore.Cleanup(ctx, pkgIDs, removeCreatedBefore)
+	return ctxerr.Wrap(ctx, err, "cleanup unused bootstrap packages")
+}
+
 func (ds *Datastore) CleanupDiskEncryptionKeysOnTeamChange(ctx context.Context, hostIDs []uint, newTeamID *uint) error {
 	return ds.withTx(ctx, func(tx sqlx.ExtContext) error {
 		return cleanupDiskEncryptionKeysOnTeamChangeDB(ctx, tx, hostIDs, newTeamID)
@@ -3223,7 +3484,6 @@ func (ds *Datastore) SetOrUpdateMDMAppleSetupAssistant(ctx context.Context, asst
 			(?, ?, ?, ?)
 		ON DUPLICATE KEY UPDATE
 			updated_at = IF(profile = VALUES(profile) AND name = VALUES(name), updated_at, CURRENT_TIMESTAMP),
-			profile_uuid = IF(profile = VALUES(profile) AND name = VALUES(name), profile_uuid, ''),
 			name = VALUES(name),
 			profile = VALUES(profile)
 `
@@ -3231,41 +3491,116 @@ func (ds *Datastore) SetOrUpdateMDMAppleSetupAssistant(ctx context.Context, asst
 	if asst.TeamID != nil {
 		globalOrTmID = *asst.TeamID
 	}
-	_, err := ds.writer(ctx).ExecContext(ctx, stmt, asst.TeamID, globalOrTmID, asst.Name, asst.Profile)
+	res, err := ds.writer(ctx).ExecContext(ctx, stmt, asst.TeamID, globalOrTmID, asst.Name, asst.Profile)
 	if err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "upsert mdm apple setup assistant")
 	}
 
+	// TODO(mna): to improve, previously we only cleared the profile UUIDs if the
+	// profile/name did change, but from tests it seems we can't rely on
+	// insertOnDuplicateDidUpdate to handle this case properly (presumably
+	// because the updated_at update condition is too complex?), so at the moment
+	// this clears the profile uuids at all times, even if the profile did not
+	// change.
+	if insertOnDuplicateDidInsertOrUpdate(res) {
+		// profile was updated, need to clear the profile uuids
+		if err := ds.SetMDMAppleSetupAssistantProfileUUID(ctx, asst.TeamID, "", ""); err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "clear mdm apple setup assistant profiles")
+		}
+	}
+
 	// reload to return the proper timestamp and id
 	return ds.getMDMAppleSetupAssistant(ctx, ds.writer(ctx), asst.TeamID)
 }
 
-func (ds *Datastore) SetMDMAppleSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID string) error {
-	const stmt = `
-	UPDATE
-		mdm_apple_setup_assistants
-	SET
-		profile_uuid = ?,
-		-- ensure updated_at does not change, as it is used to reflect the time
-		-- the setup assistant was uploaded, not when its profile was defined
-		-- with Apple's API.
-		updated_at = updated_at
-	WHERE global_or_team_id = ?`
+func (ds *Datastore) SetMDMAppleSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID, abmTokenOrgName string) error {
+	const clearStmt = `
+		DELETE FROM mdm_apple_setup_assistant_profiles
+			WHERE setup_assistant_id = (
+				SELECT
+					id
+				FROM
+					mdm_apple_setup_assistants
+				WHERE
+					global_or_team_id = ?
+			)`
+
+	const upsertStmt = `
+	INSERT INTO mdm_apple_setup_assistant_profiles (
+		setup_assistant_id, abm_token_id, profile_uuid
+	) (
+		SELECT
+			mas.id, abt.id, ?
+		FROM
+			mdm_apple_setup_assistants mas,
+			abm_tokens abt
+		WHERE
+			mas.global_or_team_id = ? AND
+			abt.organization_name = ? AND
+			mas.id IS NOT NULL AND
+			abt.id IS NOT NULL
+	)
+	ON DUPLICATE KEY UPDATE
+		profile_uuid = VALUES(profile_uuid)
+	`
 
 	var globalOrTmID uint
 	if teamID != nil {
 		globalOrTmID = *teamID
 	}
-	res, err := ds.writer(ctx).ExecContext(ctx, stmt, profileUUID, globalOrTmID)
+
+	if profileUUID == "" && abmTokenOrgName == "" {
+		// delete all profile uuids for that team, regardless of ABM token
+		_, err := ds.writer(ctx).ExecContext(ctx, clearStmt, globalOrTmID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "delete mdm apple setup assistant profiles")
+		}
+		return nil
+	}
+
+	_, err := ds.writer(ctx).ExecContext(ctx, upsertStmt, profileUUID, globalOrTmID, abmTokenOrgName)
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "set mdm apple setup assistant profile uuid")
 	}
-	if n, _ := res.RowsAffected(); n == 0 {
-		return ctxerr.Wrap(ctx, notFound("MDMAppleSetupAssistant").WithID(globalOrTmID))
-	}
 	return nil
 }
 
+func (ds *Datastore) GetMDMAppleSetupAssistantProfileForABMToken(ctx context.Context, teamID *uint, abmTokenOrgName string) (string, time.Time, error) {
+	// to preserve previous behavior, the updated_at we use is the one of the
+	// setup assistant (what we refer to as "uploaded_at" in the API responses),
+	// as the important signal is when the content of the setup assistant
+	// changes.
+	const stmt = `
+	SELECT
+		msap.profile_uuid,
+		mas.updated_at
+	FROM
+		mdm_apple_setup_assistants mas
+	INNER JOIN
+		mdm_apple_setup_assistant_profiles msap ON mas.id = msap.setup_assistant_id
+	INNER JOIN
+		abm_tokens abt ON abt.id = msap.abm_token_id
+	WHERE
+		mas.global_or_team_id = ? AND
+		abt.organization_name = ?
+`
+	var globalOrTmID uint
+	if teamID != nil {
+		globalOrTmID = *teamID
+	}
+	var asstProf struct {
+		ProfileUUID string    `db:"profile_uuid"`
+		UpdatedAt   time.Time `db:"updated_at"`
+	}
+	if err := sqlx.GetContext(ctx, ds.writer(ctx) /* needs to read recent writes */, &asstProf, stmt, globalOrTmID, abmTokenOrgName); err != nil {
+		if err == sql.ErrNoRows {
+			return "", time.Time{}, ctxerr.Wrap(ctx, notFound("MDMAppleSetupAssistant").WithID(globalOrTmID))
+		}
+		return "", time.Time{}, ctxerr.Wrap(ctx, err, "get mdm apple setup assistant")
+	}
+	return asstProf.ProfileUUID, asstProf.UpdatedAt, nil
+}
+
 func (ds *Datastore) GetMDMAppleSetupAssistant(ctx context.Context, teamID *uint) (*fleet.MDMAppleSetupAssistant, error) {
 	return ds.getMDMAppleSetupAssistant(ctx, ds.reader(ctx), teamID)
 }
@@ -3277,7 +3612,6 @@ func (ds *Datastore) getMDMAppleSetupAssistant(ctx context.Context, q sqlx.Query
 		team_id,
 		name,
 		profile,
-		profile_uuid,
 		updated_at as uploaded_at
 	FROM
 		mdm_apple_setup_assistants
@@ -3298,6 +3632,8 @@ func (ds *Datastore) getMDMAppleSetupAssistant(ctx context.Context, q sqlx.Query
 }
 
 func (ds *Datastore) DeleteMDMAppleSetupAssistant(ctx context.Context, teamID *uint) error {
+	// this deletes the setup assistant for that team, and via foreign key
+	// cascade also the profiles associated with it.
 	const stmt = `
 		DELETE FROM mdm_apple_setup_assistants
 		WHERE global_or_team_id = ?`
@@ -3370,12 +3706,20 @@ WHERE
 	return serials, nil
 }
 
-func (ds *Datastore) SetMDMAppleDefaultSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID string) error {
-	const stmt = `
+func (ds *Datastore) SetMDMAppleDefaultSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID, abmTokenOrgName string) error {
+	const clearStmt = `
+		DELETE FROM mdm_apple_default_setup_assistants
+			WHERE global_or_team_id = ?`
+
+	const upsertStmt = `
 		INSERT INTO
-			mdm_apple_default_setup_assistants (team_id, global_or_team_id, profile_uuid)
-		VALUES
-			(?, ?, ?)
+			mdm_apple_default_setup_assistants (team_id, global_or_team_id, profile_uuid, abm_token_id)
+		SELECT
+			?, ?, ?, abt.id
+		FROM
+			abm_tokens abt
+		WHERE
+			abt.organization_name = ?
 		ON DUPLICATE KEY UPDATE
 			profile_uuid = VALUES(profile_uuid)
 `
@@ -3383,34 +3727,53 @@ func (ds *Datastore) SetMDMAppleDefaultSetupAssistantProfileUUID(ctx context.Con
 	if teamID != nil {
 		globalOrTmID = *teamID
 	}
-	_, err := ds.writer(ctx).ExecContext(ctx, stmt, teamID, globalOrTmID, profileUUID)
+
+	if profileUUID == "" && abmTokenOrgName == "" {
+		// delete all profile uuids for that team, regardless of ABM token
+		_, err := ds.writer(ctx).ExecContext(ctx, clearStmt, globalOrTmID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "delete mdm apple default setup assistant")
+		}
+		return nil
+	}
+
+	// upsert the profile uuid for the provided token
+	_, err := ds.writer(ctx).ExecContext(ctx, upsertStmt, teamID, globalOrTmID, profileUUID, abmTokenOrgName)
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "upsert mdm apple default setup assistant")
 	}
 	return nil
 }
 
-func (ds *Datastore) GetMDMAppleDefaultSetupAssistant(ctx context.Context, teamID *uint) (profileUUID string, updatedAt time.Time, err error) {
+func (ds *Datastore) GetMDMAppleDefaultSetupAssistant(ctx context.Context, teamID *uint, abmTokenOrgName string) (profileUUID string, updatedAt time.Time, err error) {
 	const stmt = `
 	SELECT
-		profile_uuid,
-		updated_at as uploaded_at
+		mad.profile_uuid,
+		mad.updated_at
 	FROM
-		mdm_apple_default_setup_assistants
-	WHERE global_or_team_id = ?`
+		mdm_apple_default_setup_assistants mad
+	INNER JOIN
+		abm_tokens abt ON mad.abm_token_id = abt.id
+	WHERE
+		mad.global_or_team_id = ? AND
+		abt.organization_name = ?
+	`
 
 	var globalOrTmID uint
 	if teamID != nil {
 		globalOrTmID = *teamID
 	}
-	var asst fleet.MDMAppleSetupAssistant
-	if err := sqlx.GetContext(ctx, ds.writer(ctx) /* needs to read recent writes */, &asst, stmt, globalOrTmID); err != nil {
+	var asstProf struct {
+		ProfileUUID string    `db:"profile_uuid"`
+		UpdatedAt   time.Time `db:"updated_at"`
+	}
+	if err := sqlx.GetContext(ctx, ds.writer(ctx) /* needs to read recent writes */, &asstProf, stmt, globalOrTmID, abmTokenOrgName); err != nil {
 		if err == sql.ErrNoRows {
 			return "", time.Time{}, ctxerr.Wrap(ctx, notFound("MDMAppleDefaultSetupAssistant").WithID(globalOrTmID))
 		}
 		return "", time.Time{}, ctxerr.Wrap(ctx, err, "get mdm apple default setup assistant")
 	}
-	return asst.ProfileUUID, asst.UploadedAt, nil
+	return asstProf.ProfileUUID, asstProf.UpdatedAt, nil
 }
 
 func (ds *Datastore) UpdateHostDEPAssignProfileResponses(ctx context.Context, payload *godep.ProfileResponse) error {
@@ -3492,9 +3855,9 @@ WHERE
 // depCooldownPeriod is the waiting period following a failed DEP assign profile request for a host.
 const depCooldownPeriod = 1 * time.Hour // TODO: Make this a test config option?
 
-func (ds *Datastore) ScreenDEPAssignProfileSerialsForCooldown(ctx context.Context, serials []string) (skipSerials []string, assignSerials []string, err error) {
+func (ds *Datastore) ScreenDEPAssignProfileSerialsForCooldown(ctx context.Context, serials []string) (skipSerialsByOrgName map[string][]string, serialsByOrgName map[string][]string, err error) {
 	if len(serials) == 0 {
-		return skipSerials, assignSerials, nil
+		return skipSerialsByOrgName, serialsByOrgName, nil
 	}
 
 	stmt := `
@@ -3504,12 +3867,14 @@ SELECT
 	ELSE
 		'assign'
 	END AS status,
-	hardware_serial
+	h.hardware_serial,
+	abm.organization_name
 FROM
-	host_dep_assignments
-	JOIN hosts ON id = host_id
+	host_dep_assignments hda
+	JOIN hosts h ON h.id = hda.host_id
+	JOIN abm_tokens abm ON abm.id = hda.abm_token_id
 WHERE
-	hardware_serial IN (?)
+	h.hardware_serial IN (?)
 `
 
 	stmt, args, err := sqlx.In(stmt, string(fleet.DEPAssignProfileResponseFailed), depCooldownPeriod.Seconds(), serials)
@@ -3520,23 +3885,27 @@ WHERE
 	var rows []struct {
 		Status         string `db:"status"`
 		HardwareSerial string `db:"hardware_serial"`
+		ABMOrgName     string `db:"organization_name"`
 	}
 	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &rows, stmt, args...); err != nil {
 		return nil, nil, ctxerr.Wrap(ctx, err, "screen dep serials: get rows")
 	}
 
+	serialsByOrgName = make(map[string][]string)
+	skipSerialsByOrgName = make(map[string][]string)
+
 	for _, r := range rows {
 		switch r.Status {
 		case "assign":
-			assignSerials = append(assignSerials, r.HardwareSerial)
+			serialsByOrgName[r.ABMOrgName] = append(serialsByOrgName[r.ABMOrgName], r.HardwareSerial)
 		case "skip":
-			skipSerials = append(skipSerials, r.HardwareSerial)
+			skipSerialsByOrgName[r.ABMOrgName] = append(skipSerialsByOrgName[r.ABMOrgName], r.HardwareSerial)
 		default:
 			return nil, nil, ctxerr.New(ctx, fmt.Sprintf("screen dep serials: %s unrecognized status: %s", r.HardwareSerial, r.Status))
 		}
 	}
 
-	return skipSerials, assignSerials, nil
+	return skipSerialsByOrgName, serialsByOrgName, nil
 }
 
 func (ds *Datastore) GetDEPAssignProfileExpiredCooldowns(ctx context.Context) (map[uint][]string, error) {
@@ -3683,7 +4052,9 @@ WHERE h.uuid = ?
 	return nil
 }
 
-func (ds *Datastore) batchSetMDMAppleDeclarations(ctx context.Context, tx sqlx.ExtContext, tmID *uint, incomingDeclarations []*fleet.MDMAppleDeclaration) ([]*fleet.MDMAppleDeclaration, error) {
+func (ds *Datastore) batchSetMDMAppleDeclarations(ctx context.Context, tx sqlx.ExtContext, tmID *uint,
+	incomingDeclarations []*fleet.MDMAppleDeclaration,
+) (declarations []*fleet.MDMAppleDeclaration, updatedDB bool, err error) {
 	const insertStmt = `
 INSERT INTO mdm_apple_declarations (
 	declaration_uuid,
@@ -3750,13 +4121,13 @@ WHERE
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 			}
-			return nil, ctxerr.Wrap(ctx, err, "build query to load existing declarations")
+			return nil, false, ctxerr.Wrap(ctx, err, "build query to load existing declarations")
 		}
 		if err := sqlx.SelectContext(ctx, tx, &existingDecls, stmt, args...); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "select") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 			}
-			return nil, ctxerr.Wrap(ctx, err, "load existing declarations")
+			return nil, false, ctxerr.Wrap(ctx, err, "load existing declarations")
 		}
 	}
 
@@ -3779,23 +4150,29 @@ WHERE
 		// delete the obsolete declarations (all those that are not in keepNames)
 		stmt, args, err := sqlx.In(fmt.Sprintf(fmtDeleteStmt, andNameNotInList), declTeamID, keepNames)
 		if err != nil {
-			return nil, ctxerr.Wrap(ctx, err, "build query to delete obsolete profiles")
+			return nil, false, ctxerr.Wrap(ctx, err, "build query to delete obsolete profiles")
 		}
 		delStmt = stmt
 		delArgs = args
 	}
 
-	if _, err := tx.ExecContext(ctx, delStmt, delArgs...); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "delete") {
+	var result sql.Result
+	if result, err = tx.ExecContext(ctx, delStmt, delArgs...); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr,
+		"delete") {
 		if err == nil {
 			err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 		}
-		return nil, ctxerr.Wrap(ctx, err, "delete obsolete declarations")
+		return nil, false, ctxerr.Wrap(ctx, err, "delete obsolete declarations")
+	}
+	if result != nil {
+		rows, _ := result.RowsAffected()
+		updatedDB = rows > 0
 	}
 
 	for _, d := range incomingDeclarations {
 		checksum := md5ChecksumScriptContent(string(d.RawJSON))
 		declUUID := fleet.MDMAppleDeclarationUUIDPrefix + uuid.NewString()
-		if _, err := tx.ExecContext(ctx, insertStmt,
+		if result, err = tx.ExecContext(ctx, insertStmt,
 			declUUID,
 			d.Identifier,
 			d.Name,
@@ -3805,8 +4182,9 @@ WHERE
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 			}
-			return nil, ctxerr.Wrapf(ctx, err, "insert new/edited declaration with identifier %q", d.Identifier)
+			return nil, false, ctxerr.Wrapf(ctx, err, "insert new/edited declaration with identifier %q", d.Identifier)
 		}
+		updatedDB = updatedDB || insertOnDuplicateDidInsertOrUpdate(result)
 	}
 
 	incomingLabels := []fleet.ConfigurationProfileLabel{}
@@ -3821,16 +4199,16 @@ WHERE
 		// optimization for a later iteration.
 		stmt, args, err := sqlx.In(loadExistingDecls, declTeamID, incomingNames)
 		if err != nil {
-			return nil, ctxerr.Wrap(ctx, err, "build query to load newly inserted declarations")
+			return nil, false, ctxerr.Wrap(ctx, err, "build query to load newly inserted declarations")
 		}
 		if err := sqlx.SelectContext(ctx, tx, &newlyInsertedDecls, stmt, args...); err != nil {
-			return nil, ctxerr.Wrap(ctx, err, "load newly inserted declarations")
+			return nil, false, ctxerr.Wrap(ctx, err, "load newly inserted declarations")
 		}
 
 		for _, newlyInsertedDecl := range newlyInsertedDecls {
 			incomingDecl, ok := incomingDecls[newlyInsertedDecl.Name]
 			if !ok {
-				return nil, ctxerr.Wrapf(ctx, err, "declaration %q is in the database but was not incoming", newlyInsertedDecl.Name)
+				return nil, false, ctxerr.Wrapf(ctx, err, "declaration %q is in the database but was not incoming", newlyInsertedDecl.Name)
 			}
 
 			for _, label := range incomingDecl.LabelsIncludeAll {
@@ -3845,14 +4223,16 @@ WHERE
 		}
 	}
 
-	if err := batchSetDeclarationLabelAssociationsDB(ctx, tx, incomingLabels); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "labels") {
+	var updatedLabels bool
+	if updatedLabels, err = batchSetDeclarationLabelAssociationsDB(ctx, tx,
+		incomingLabels); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "labels") {
 		if err == nil {
 			err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 		}
-		return nil, ctxerr.Wrap(ctx, err, "inserting apple declaration label associations")
+		return nil, false, ctxerr.Wrap(ctx, err, "inserting apple declaration label associations")
 	}
 
-	return incomingDeclarations, nil
+	return incomingDeclarations, updatedDB || updatedLabels, nil
 }
 
 func (ds *Datastore) NewMDMAppleDeclaration(ctx context.Context, declaration *fleet.MDMAppleDeclaration) (*fleet.MDMAppleDeclaration, error) {
@@ -3949,7 +4329,7 @@ func (ds *Datastore) insertOrUpsertMDMAppleDeclaration(ctx context.Context, insO
 			declaration.LabelsExcludeAny[i].Exclude = true
 			labels = append(labels, declaration.LabelsExcludeAny[i])
 		}
-		if err := batchSetDeclarationLabelAssociationsDB(ctx, tx, labels); err != nil {
+		if _, err := batchSetDeclarationLabelAssociationsDB(ctx, tx, labels); err != nil {
 			return ctxerr.Wrap(ctx, err, "inserting mdm declaration label associations")
 		}
 
@@ -3963,9 +4343,10 @@ func (ds *Datastore) insertOrUpsertMDMAppleDeclaration(ctx context.Context, insO
 	return declaration, nil
 }
 
-func batchSetDeclarationLabelAssociationsDB(ctx context.Context, tx sqlx.ExtContext, declarationLabels []fleet.ConfigurationProfileLabel) error {
+func batchSetDeclarationLabelAssociationsDB(ctx context.Context, tx sqlx.ExtContext,
+	declarationLabels []fleet.ConfigurationProfileLabel) (updatedDB bool, err error) {
 	if len(declarationLabels) == 0 {
-		return nil
+		return false, nil
 	}
 
 	// delete any profile+label tuple that is NOT in the list of provided tuples
@@ -3987,38 +4368,72 @@ func batchSetDeclarationLabelAssociationsDB(ctx context.Context, tx sqlx.ExtCont
               exclude = VALUES(exclude)
 	`
 
+	selectStmt := `
+		SELECT apple_declaration_uuid as profile_uuid, label_name, label_id, exclude FROM mdm_declaration_labels
+		WHERE (apple_declaration_uuid, label_name) IN (%s)
+	`
+
 	var (
-		insertBuilder strings.Builder
-		deleteBuilder strings.Builder
-		insertParams  []any
-		deleteParams  []any
+		insertBuilder         strings.Builder
+		selectOrDeleteBuilder strings.Builder
+		selectParams          []any
+		insertParams          []any
+		deleteParams          []any
 
 		setProfileUUIDs = make(map[string]struct{})
+		labelsToInsert  = make(map[string]*fleet.ConfigurationProfileLabel, len(declarationLabels))
 	)
 	for i, pl := range declarationLabels {
+		labelsToInsert[fmt.Sprintf("%s\n%s", pl.ProfileUUID, pl.LabelName)] = &declarationLabels[i]
 		if i > 0 {
 			insertBuilder.WriteString(",")
-			deleteBuilder.WriteString(",")
+			selectOrDeleteBuilder.WriteString(",")
 		}
 		insertBuilder.WriteString("(?, ?, ?, ?)")
-		deleteBuilder.WriteString("(?, ?)")
+		selectOrDeleteBuilder.WriteString("(?, ?)")
+		selectParams = append(selectParams, pl.ProfileUUID, pl.LabelName)
 		insertParams = append(insertParams, pl.ProfileUUID, pl.LabelID, pl.LabelName, pl.Exclude)
 		deleteParams = append(deleteParams, pl.ProfileUUID, pl.LabelID)
 
 		setProfileUUIDs[pl.ProfileUUID] = struct{}{}
 	}
 
-	_, err := tx.ExecContext(ctx, fmt.Sprintf(upsertStmt, insertBuilder.String()), insertParams...)
+	// Determine if we need to update the database
+	var existingProfileLabels []fleet.ConfigurationProfileLabel
+	err = sqlx.SelectContext(ctx, tx, &existingProfileLabels,
+		fmt.Sprintf(selectStmt, selectOrDeleteBuilder.String()), selectParams...)
 	if err != nil {
-		if isChildForeignKeyError(err) {
-			// one of the provided labels doesn't exist
-			return foreignKey("mdm_declaration_labels", fmt.Sprintf("(declaration, label)=(%v)", insertParams))
+		return false, ctxerr.Wrap(ctx, err, "selecting existing profile labels")
+	}
+
+	updateNeeded := false
+	if len(existingProfileLabels) == len(labelsToInsert) {
+		for _, existing := range existingProfileLabels {
+			toInsert, ok := labelsToInsert[fmt.Sprintf("%s\n%s", existing.ProfileUUID, existing.LabelName)]
+			// The fleet.ConfigurationProfileLabel struct has no pointers, so we can use standard cmp.Equal
+			if !ok || !cmp.Equal(existing, *toInsert) {
+				updateNeeded = true
+				break
+			}
 		}
+	} else {
+		updateNeeded = true
+	}
+
+	if updateNeeded {
+		_, err = tx.ExecContext(ctx, fmt.Sprintf(upsertStmt, insertBuilder.String()), insertParams...)
+		if err != nil {
+			if isChildForeignKeyError(err) {
+				// one of the provided labels doesn't exist
+				return false, foreignKey("mdm_declaration_labels", fmt.Sprintf("(declaration, label)=(%v)", insertParams))
+			}
 
-		return ctxerr.Wrap(ctx, err, "setting label associations for declarations")
+			return false, ctxerr.Wrap(ctx, err, "setting label associations for declarations")
+		}
+		updatedDB = true
 	}
 
-	deleteStmt = fmt.Sprintf(deleteStmt, deleteBuilder.String())
+	deleteStmt = fmt.Sprintf(deleteStmt, selectOrDeleteBuilder.String())
 
 	profUUIDs := make([]string, 0, len(setProfileUUIDs))
 	for k := range setProfileUUIDs {
@@ -4028,13 +4443,21 @@ func batchSetDeclarationLabelAssociationsDB(ctx context.Context, tx sqlx.ExtCont
 
 	deleteStmt, args, err := sqlx.In(deleteStmt, deleteArgs...)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "sqlx.In delete labels for declarations")
+		return false, ctxerr.Wrap(ctx, err, "sqlx.In delete labels for declarations")
+	}
+	var result sql.Result
+	if result, err = tx.ExecContext(ctx, deleteStmt, args...); err != nil {
+		return false, ctxerr.Wrap(ctx, err, "deleting labels for declarations")
 	}
-	if _, err := tx.ExecContext(ctx, deleteStmt, args...); err != nil {
-		return ctxerr.Wrap(ctx, err, "deleting labels for declarations")
+	if result != nil {
+		rows, err := result.RowsAffected()
+		if err != nil {
+			return false, ctxerr.Wrap(ctx, err, "count rows affected by insert")
+		}
+		updatedDB = updatedDB || rows > 0
 	}
 
-	return nil
+	return updatedDB, nil
 }
 
 func (ds *Datastore) MDMAppleDDMDeclarationsToken(ctx context.Context, hostUUID string) (*fleet.MDMAppleDDMDeclarationsToken, error) {
@@ -4121,23 +4544,24 @@ func (ds *Datastore) MDMAppleBatchSetHostDeclarationState(ctx context.Context) (
 
 	err := ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
 		var err error
-		uuids, err = mdmAppleBatchSetHostDeclarationStateDB(ctx, tx, batchSize, &fleet.MDMDeliveryPending)
+		uuids, _, err = mdmAppleBatchSetHostDeclarationStateDB(ctx, tx, batchSize, &fleet.MDMDeliveryPending)
 		return err
 	})
 
 	return uuids, ctxerr.Wrap(ctx, err, "upserting host declaration state")
 }
 
-func mdmAppleBatchSetHostDeclarationStateDB(ctx context.Context, tx sqlx.ExtContext, batchSize int, status *fleet.MDMDeliveryStatus) ([]string, error) {
+func mdmAppleBatchSetHostDeclarationStateDB(ctx context.Context, tx sqlx.ExtContext, batchSize int,
+	status *fleet.MDMDeliveryStatus) ([]string, bool, error) {
 	// once all the declarations are in place, compute the desired state
 	// and find which hosts need a DDM sync.
 	changedDeclarations, err := mdmAppleGetHostsWithChangedDeclarationsDB(ctx, tx)
 	if err != nil {
-		return nil, ctxerr.Wrap(ctx, err, "find hosts with changed declarations")
+		return nil, false, ctxerr.Wrap(ctx, err, "find hosts with changed declarations")
 	}
 
 	if len(changedDeclarations) == 0 {
-		return []string{}, nil
+		return []string{}, false, nil
 	}
 
 	// a host might have more than one declaration to sync, we do this to
@@ -4159,11 +4583,12 @@ func mdmAppleBatchSetHostDeclarationStateDB(ctx context.Context, tx sqlx.ExtCont
 	// - support the DDM endpoints, which use data from the
 	//   `host_mdm_apple_declarations` table to compute which declarations to
 	//   serve
-	if err := mdmAppleBatchSetPendingHostDeclarationsDB(ctx, tx, batchSize, changedDeclarations, status); err != nil {
-		return nil, ctxerr.Wrap(ctx, err, "batch insert mdm apple host declarations")
+	var updatedDB bool
+	if updatedDB, err = mdmAppleBatchSetPendingHostDeclarationsDB(ctx, tx, batchSize, changedDeclarations, status); err != nil {
+		return nil, false, ctxerr.Wrap(ctx, err, "batch insert mdm apple host declarations")
 	}
 
-	return uuids, nil
+	return uuids, updatedDB, nil
 }
 
 // mdmAppleBatchSetPendingHostDeclarationsDB tracks the current status of all
@@ -4174,7 +4599,7 @@ func mdmAppleBatchSetPendingHostDeclarationsDB(
 	batchSize int,
 	changedDeclarations []*fleet.MDMAppleHostDeclaration,
 	status *fleet.MDMDeliveryStatus,
-) error {
+) (updatedDB bool, err error) {
 	baseStmt := `
 	  INSERT INTO host_mdm_apple_declarations
 	    (host_uuid, status, operation_type, checksum, declaration_uuid, declaration_identifier, declaration_name)
@@ -4186,7 +4611,50 @@ func mdmAppleBatchSetPendingHostDeclarationsDB(
 	    checksum = VALUES(checksum)
 	  `
 
+	profilesToInsert := make(map[string]*fleet.MDMAppleHostDeclaration)
+
 	executeUpsertBatch := func(valuePart string, args []any) error {
+		// Check if the update needs to be done at all.
+		selectStmt := fmt.Sprintf(`
+			SELECT 
+				host_uuid,
+				declaration_uuid,
+				status,
+				COALESCE(operation_type, '') AS operation_type,
+				COALESCE(detail, '') AS detail,
+				checksum,
+				declaration_uuid,
+				declaration_identifier,
+				declaration_name
+			FROM host_mdm_apple_declarations WHERE (host_uuid, declaration_uuid) IN (%s)`,
+			strings.TrimSuffix(strings.Repeat("(?,?),", len(profilesToInsert)), ","))
+		var selectArgs []any
+		for _, p := range profilesToInsert {
+			selectArgs = append(selectArgs, p.HostUUID, p.DeclarationUUID)
+		}
+		var existingProfiles []fleet.MDMAppleHostDeclaration
+		if err := sqlx.SelectContext(ctx, tx, &existingProfiles, selectStmt, selectArgs...); err != nil {
+			return ctxerr.Wrap(ctx, err, "bulk set pending declarations select existing")
+		}
+		var updateNeeded bool
+		if len(existingProfiles) == len(profilesToInsert) {
+			for _, exist := range existingProfiles {
+				insert, ok := profilesToInsert[fmt.Sprintf("%s\n%s", exist.HostUUID, exist.DeclarationUUID)]
+				if !ok || !exist.Equal(*insert) {
+					updateNeeded = true
+					break
+				}
+			}
+		} else {
+			updateNeeded = true
+		}
+		clear(profilesToInsert)
+		if !updateNeeded {
+			// All profiles are already in the database, no need to update.
+			return nil
+		}
+
+		updatedDB = true
 		_, err := tx.ExecContext(
 			ctx,
 			fmt.Sprintf(baseStmt, strings.TrimSuffix(valuePart, ",")),
@@ -4196,13 +4664,23 @@ func mdmAppleBatchSetPendingHostDeclarationsDB(
 	}
 
 	generateValueArgs := func(d *fleet.MDMAppleHostDeclaration) (string, []any) {
+		profilesToInsert[fmt.Sprintf("%s\n%s", d.HostUUID, d.DeclarationUUID)] = &fleet.MDMAppleHostDeclaration{
+			HostUUID:        d.HostUUID,
+			DeclarationUUID: d.DeclarationUUID,
+			Name:            d.Name,
+			Identifier:      d.Identifier,
+			Status:          status,
+			OperationType:   d.OperationType,
+			Detail:          d.Detail,
+			Checksum:        d.Checksum,
+		}
 		valuePart := "(?, ?, ?, ?, ?, ?, ?),"
 		args := []any{d.HostUUID, status, d.OperationType, d.Checksum, d.DeclarationUUID, d.Identifier, d.Name}
 		return valuePart, args
 	}
 
-	err := batchProcessDB(changedDeclarations, batchSize, generateValueArgs, executeUpsertBatch)
-	return ctxerr.Wrap(ctx, err, "inserting changed host declaration state")
+	err = batchProcessDB(changedDeclarations, batchSize, generateValueArgs, executeUpsertBatch)
+	return updatedDB, ctxerr.Wrap(ctx, err, "inserting changed host declaration state")
 }
 
 // mdmAppleGetHostsWithChangedDeclarationsDB returns a
@@ -4385,41 +4863,20 @@ func decrypt(encrypted []byte, privateKey string) ([]byte, error) {
 
 	decrypted, err := aesGCM.Open(nil, nonce, ciphertext, nil)
 	if err != nil {
-		return nil, fmt.Errorf("generate nonce: %w", err)
+		return nil, fmt.Errorf("decrypting: %w", err)
 	}
 
 	return decrypted, nil
 }
 
 func (ds *Datastore) InsertMDMConfigAssets(ctx context.Context, assets []fleet.MDMConfigAsset) error {
-	stmt := `
-INSERT INTO mdm_config_assets
-  (name, value, md5_checksum)
-VALUES
-  %s`
-
-	var args []any
-	var insertVals strings.Builder
-
-	for _, a := range assets {
-		encryptedVal, err := encrypt(a.Value, ds.serverPrivateKey)
-		if err != nil {
-			return ctxerr.Wrap(ctx, err, fmt.Sprintf("encrypting mdm config asset %s", a.Name))
+	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
+		if err := insertMDMConfigAssets(ctx, tx, assets, ds.serverPrivateKey); err != nil {
+			return ctxerr.Wrap(ctx, err, "insert mdm config assets")
 		}
 
-		hexChecksum := md5ChecksumBytes(encryptedVal)
-		insertVals.WriteString(`(?, ?, UNHEX(?)),`)
-		args = append(args, a.Name, encryptedVal, hexChecksum)
-	}
-
-	stmt = fmt.Sprintf(stmt, strings.TrimSuffix(insertVals.String(), ","))
-
-	err := ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
-		_, err := tx.ExecContext(ctx, stmt, args...)
-		return err
+		return nil
 	})
-
-	return ctxerr.Wrap(ctx, err, "writing mdm config assets to db")
 }
 
 func (ds *Datastore) GetAllMDMConfigAssetsByName(ctx context.Context, assetNames []fleet.MDMAssetName) (map[fleet.MDMAssetName]fleet.MDMConfigAsset, error) {
@@ -4505,6 +4962,16 @@ WHERE name IN (?) AND deletion_uuid = ''`
 }
 
 func (ds *Datastore) DeleteMDMConfigAssetsByName(ctx context.Context, assetNames []fleet.MDMAssetName) error {
+	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
+		if err := softDeleteMDMConfigAssetsByName(ctx, tx, assetNames); err != nil {
+			return ctxerr.Wrap(ctx, err, "delete mdm config assets by name")
+		}
+
+		return nil
+	})
+}
+
+func softDeleteMDMConfigAssetsByName(ctx context.Context, tx sqlx.ExtContext, assetNames []fleet.MDMAssetName) error {
 	stmt := `
 UPDATE
     mdm_config_assets
@@ -4519,26 +4986,581 @@ WHERE
 
 	stmt, args, err := sqlx.In(stmt, deletionUUID, assetNames)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "sqlx.In DeleteMDMConfigAssetsByName")
+		return ctxerr.Wrap(ctx, err, "sqlx.In softDeleteMDMConfigAssetsByName")
 	}
 
-	_, err = ds.writer(ctx).ExecContext(ctx, stmt, args...)
+	_, err = tx.ExecContext(ctx, stmt, args...)
 	return ctxerr.Wrap(ctx, err, "deleting mdm config assets")
 }
 
+func insertMDMConfigAssets(ctx context.Context, tx sqlx.ExtContext, assets []fleet.MDMConfigAsset, privateKey string) error {
+	stmt := `
+INSERT INTO mdm_config_assets
+  (name, value, md5_checksum)
+VALUES
+  %s`
+
+	var args []any
+	var insertVals strings.Builder
+
+	for _, a := range assets {
+		encryptedVal, err := encrypt(a.Value, privateKey)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, fmt.Sprintf("encrypting mdm config asset %s", a.Name))
+		}
+
+		hexChecksum := md5ChecksumBytes(encryptedVal)
+		insertVals.WriteString(`(?, ?, UNHEX(?)),`)
+		args = append(args, a.Name, encryptedVal, hexChecksum)
+	}
+
+	stmt = fmt.Sprintf(stmt, strings.TrimSuffix(insertVals.String(), ","))
+
+	_, err := tx.ExecContext(ctx, stmt, args...)
+
+	return ctxerr.Wrap(ctx, err, "writing mdm config assets to db")
+}
+
+func (ds *Datastore) ReplaceMDMConfigAssets(ctx context.Context, assets []fleet.MDMConfigAsset) error {
+	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
+		var names []fleet.MDMAssetName
+		for _, a := range assets {
+			names = append(names, a.Name)
+		}
+
+		if err := softDeleteMDMConfigAssetsByName(ctx, tx, names); err != nil {
+			return ctxerr.Wrap(ctx, err, "upsert mdm config assets soft delete")
+		}
+
+		if err := insertMDMConfigAssets(ctx, tx, assets, ds.serverPrivateKey); err != nil {
+			return ctxerr.Wrap(ctx, err, "upsert mdm config assets insert")
+		}
+
+		return nil
+	})
+}
+
 // ListIOSAndIPadOSToRefetch returns the UUIDs of iPhones/iPads that should be refetched
 // (their details haven't been updated in the given `interval`).
-func (ds *Datastore) ListIOSAndIPadOSToRefetch(ctx context.Context, interval time.Duration) (uuids []string, err error) {
-	var deviceUUIDs []string
+func (ds *Datastore) ListIOSAndIPadOSToRefetch(ctx context.Context, interval time.Duration) (devices []fleet.AppleDevicesToRefetch,
+	err error,
+) {
 	hostsStmt := fmt.Sprintf(`
-SELECT h.uuid FROM hosts h
-JOIN host_mdm hmdm ON hmdm.host_id = h.id
+SELECT h.id as host_id, h.uuid as uuid, JSON_ARRAYAGG(hmc.command_type) as commands_already_sent FROM hosts h
+INNER JOIN host_mdm hmdm ON hmdm.host_id = h.id
+LEFT JOIN host_mdm_commands hmc ON hmc.host_id = h.id
 WHERE (h.platform = 'ios' OR h.platform = 'ipados')
-AND hmdm.enrolled
-AND TIMESTAMPDIFF(SECOND, h.detail_updated_at, NOW()) > ?;`)
-	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &deviceUUIDs, hostsStmt, interval.Seconds()); err != nil {
+AND TRIM(h.uuid) != ''
+AND TIMESTAMPDIFF(SECOND, h.detail_updated_at, NOW()) > ?
+GROUP BY h.id`)
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &devices, hostsStmt, interval.Seconds()); err != nil {
+		return nil, err
+	}
+
+	return devices, nil
+}
+
+func (ds *Datastore) GetHostUUIDsWithPendingMDMAppleCommands(ctx context.Context) (uuids []string, err error) {
+	const stmt = `
+SELECT DISTINCT neq.id
+FROM nano_enrollment_queue neq
+LEFT JOIN nano_command_results ncr ON ncr.command_uuid = neq.command_uuid AND ncr.id = neq.id
+WHERE neq.active = 1 AND ncr.status IS NULL
+AND neq.created_at >= NOW() - INTERVAL 7 DAY
+LIMIT 500
+`
+
+	var deviceUUIDs []string
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &deviceUUIDs, stmt); err != nil {
 		return nil, err
 	}
 
 	return deviceUUIDs, nil
 }
+
+func (ds *Datastore) GetABMTokenByOrgName(ctx context.Context, orgName string) (*fleet.ABMToken, error) {
+	tok, err := ds.getABMToken(ctx, 0, orgName)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get ABM token by org name")
+	}
+
+	return tok, nil
+}
+
+func (ds *Datastore) SaveABMToken(ctx context.Context, tok *fleet.ABMToken) error {
+	const stmt = `
+UPDATE
+	abm_tokens
+SET
+	organization_name = ?,
+	apple_id = ?,
+	terms_expired = ?,
+	renew_at = ?,
+	token = ?,
+	macos_default_team_id = ?,
+	ios_default_team_id = ?,
+	ipados_default_team_id = ?
+WHERE
+	id = ?`
+
+	doubleEncTok, err := encrypt(tok.EncryptedToken, ds.serverPrivateKey)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "encrypt with datastore.serverPrivateKey")
+	}
+
+	_, err = ds.writer(ctx).ExecContext(
+		ctx,
+		stmt,
+		tok.OrganizationName,
+		tok.AppleID,
+		tok.TermsExpired,
+		tok.RenewAt.UTC(),
+		doubleEncTok,
+		tok.MacOSDefaultTeamID,
+		tok.IOSDefaultTeamID,
+		tok.IPadOSDefaultTeamID,
+		tok.ID)
+	return ctxerr.Wrap(ctx, err, "updating abm_token")
+}
+
+func (ds *Datastore) InsertABMToken(ctx context.Context, tok *fleet.ABMToken) (*fleet.ABMToken, error) {
+	const stmt = `
+INSERT INTO
+	abm_tokens
+	(organization_name, apple_id, terms_expired, renew_at, token, macos_default_team_id, ios_default_team_id, ipados_default_team_id)
+VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+`
+	doubleEncTok, err := encrypt(tok.EncryptedToken, ds.serverPrivateKey)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "encrypt abm_token with datastore.serverPrivateKey")
+	}
+
+	res, err := ds.writer(ctx).ExecContext(
+		ctx,
+		stmt,
+		tok.OrganizationName,
+		tok.AppleID,
+		tok.TermsExpired,
+		tok.RenewAt,
+		doubleEncTok,
+		tok.MacOSDefaultTeamID,
+		tok.IOSDefaultTeamID,
+		tok.IPadOSDefaultTeamID,
+	)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "inserting abm_token")
+	}
+
+	tokenID, _ := res.LastInsertId()
+
+	tok.ID = uint(tokenID)
+
+	cfg, err := ds.AppConfig(ctx)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get app config")
+	}
+
+	url, err := apple_mdm.ResolveAppleMDMURL(cfg.ServerSettings.ServerURL)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting ABM token MDM server url")
+	}
+
+	tok.MDMServerURL = url
+
+	return tok, nil
+}
+
+func (ds *Datastore) ListABMTokens(ctx context.Context) ([]*fleet.ABMToken, error) {
+	stmt := `
+SELECT
+	abt.id,
+	abt.organization_name,
+	abt.apple_id,
+	abt.terms_expired,
+	abt.renew_at,
+	abt.token,
+	abt.macos_default_team_id,
+	abt.ios_default_team_id,
+	abt.ipados_default_team_id,
+	COALESCE(t1.name, :no_team) as macos_team,
+	COALESCE(t2.name, :no_team) as ios_team,
+	COALESCE(t3.name, :no_team) as ipados_team
+FROM
+	abm_tokens abt
+LEFT OUTER JOIN
+	teams t1 ON t1.id = abt.macos_default_team_id
+LEFT OUTER JOIN
+	teams t2 ON t2.id = abt.ios_default_team_id
+LEFT OUTER JOIN
+	teams t3 ON t3.id = abt.ipados_default_team_id
+
+	`
+
+	stmt, args, err := sqlx.Named(stmt, map[string]any{"no_team": fleet.TeamNameNoTeam})
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "build list ABM tokens query from named args")
+	}
+
+	var tokens []*fleet.ABMToken
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &tokens, stmt, args...); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "list ABM tokens")
+	}
+
+	cfg, err := ds.AppConfig(ctx)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get app config")
+	}
+
+	url, err := apple_mdm.ResolveAppleMDMURL(cfg.ServerSettings.ServerURL)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting ABM token MDM server url")
+	}
+
+	for _, tok := range tokens {
+		tok.MDMServerURL = url
+
+		// Promote DB fields into respective objects
+		var macOSTeamID, iOSTeamID, iPadIOSTeamID uint
+		if tok.MacOSDefaultTeamID != nil {
+			macOSTeamID = *tok.MacOSDefaultTeamID
+		}
+		if tok.IOSDefaultTeamID != nil {
+			iOSTeamID = *tok.IOSDefaultTeamID
+		}
+		if tok.IPadOSDefaultTeamID != nil {
+			iPadIOSTeamID = *tok.IPadOSDefaultTeamID
+		}
+
+		tok.MacOSTeam = fleet.ABMTokenTeam{Name: tok.MacOSTeamName, ID: macOSTeamID}
+		tok.IOSTeam = fleet.ABMTokenTeam{Name: tok.IOSTeamName, ID: iOSTeamID}
+		tok.IPadOSTeam = fleet.ABMTokenTeam{Name: tok.IPadOSTeamName, ID: iPadIOSTeamID}
+
+		// decrypt the token with the serverPrivateKey, the resulting value will be
+		// the token still encrypted, but just with the ABM cert and key (it is that
+		// encrypted value that is stored with another layer of encryption with the
+		// serverPrivateKey).
+		decrypted, err := decrypt(tok.EncryptedToken, ds.serverPrivateKey)
+		if err != nil {
+			return nil, ctxerr.Wrapf(ctx, err, "decrypting abm token with datastore.serverPrivateKey")
+		}
+		tok.EncryptedToken = decrypted
+	}
+
+	return tokens, nil
+}
+
+func (ds *Datastore) DeleteABMToken(ctx context.Context, tokenID uint) error {
+	const stmt = `
+DELETE FROM
+	abm_tokens
+WHERE ID = ?
+		`
+
+	_, err := ds.writer(ctx).ExecContext(ctx, stmt, tokenID)
+
+	return ctxerr.Wrap(ctx, err, "deleting ABM token")
+}
+
+func (ds *Datastore) GetABMTokenByID(ctx context.Context, tokenID uint) (*fleet.ABMToken, error) {
+	tok, err := ds.getABMToken(ctx, tokenID, "")
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get ABM token by id")
+	}
+
+	return tok, nil
+}
+
+func (ds *Datastore) getABMToken(ctx context.Context, tokenID uint, orgName string) (*fleet.ABMToken, error) {
+	stmt := `
+SELECT
+	abt.id,
+	abt.organization_name,
+	abt.apple_id,
+	abt.terms_expired,
+	abt.renew_at,
+	abt.token,
+	abt.macos_default_team_id,
+	abt.ios_default_team_id,
+	abt.ipados_default_team_id,
+	COALESCE(t1.name, :no_team) as macos_team,
+	COALESCE(t2.name, :no_team) as ios_team,
+	COALESCE(t3.name, :no_team) as ipados_team
+FROM
+	abm_tokens abt
+LEFT OUTER JOIN
+	teams t1 ON t1.id = abt.macos_default_team_id
+LEFT OUTER JOIN
+	teams t2 ON t2.id = abt.ios_default_team_id
+LEFT OUTER JOIN
+	teams t3 ON t3.id = abt.ipados_default_team_id
+%s
+	`
+
+	stmt, args, err := sqlx.Named(stmt, map[string]any{"no_team": fleet.TeamNameNoTeam})
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "build list ABM tokens query from named args")
+	}
+
+	var ident any = orgName
+	clause := "WHERE abt.organization_name = ?"
+	if tokenID != 0 {
+		clause = "WHERE abt.id = ?"
+		ident = tokenID
+	}
+
+	stmt = fmt.Sprintf(stmt, clause)
+
+	args = append(args, ident)
+
+	var tok fleet.ABMToken
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &tok, stmt, args...); err != nil {
+		if err == sql.ErrNoRows {
+			return nil, ctxerr.Wrap(ctx, notFound("ABMToken"))
+		}
+
+		return nil, ctxerr.Wrap(ctx, err, "get ABM token")
+	}
+
+	// decrypt the token with the serverPrivateKey, the resulting value will be
+	// the token still encrypted, but just with the ABM cert and key (it is that
+	// encrypted value that is stored with another layer of encryption with the
+	// serverPrivateKey).
+	decrypted, err := decrypt(tok.EncryptedToken, ds.serverPrivateKey)
+	if err != nil {
+		return nil, ctxerr.Wrapf(ctx, err, "decrypting abm token with datastore.serverPrivateKey")
+	}
+	tok.EncryptedToken = decrypted
+
+	cfg, err := ds.AppConfig(ctx)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get app config")
+	}
+
+	url, err := apple_mdm.ResolveAppleMDMURL(cfg.ServerSettings.ServerURL)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting ABM token MDM server url")
+	}
+
+	tok.MDMServerURL = url
+
+	// Promote DB fields into respective objects
+	var macOSTeamID, iOSTeamID, iPadIOSTeamID uint
+	if tok.MacOSDefaultTeamID != nil {
+		macOSTeamID = *tok.MacOSDefaultTeamID
+	}
+	if tok.IOSDefaultTeamID != nil {
+		iOSTeamID = *tok.IOSDefaultTeamID
+	}
+	if tok.IPadOSDefaultTeamID != nil {
+		iPadIOSTeamID = *tok.IPadOSDefaultTeamID
+	}
+
+	tok.MacOSTeam = fleet.ABMTokenTeam{Name: tok.MacOSTeamName, ID: macOSTeamID}
+	tok.IOSTeam = fleet.ABMTokenTeam{Name: tok.IOSTeamName, ID: iOSTeamID}
+	tok.IPadOSTeam = fleet.ABMTokenTeam{Name: tok.IPadOSTeamName, ID: iPadIOSTeamID}
+
+	return &tok, nil
+}
+
+func (ds *Datastore) GetABMTokenCount(ctx context.Context) (int, error) {
+	var count int
+	const countStmt = `SELECT COUNT(*) FROM abm_tokens`
+
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &count, countStmt); err != nil {
+		return 0, ctxerr.Wrap(ctx, err, "counting existing ABM tokens")
+	}
+
+	return count, nil
+}
+
+func (ds *Datastore) SetABMTokenTermsExpiredForOrgName(ctx context.Context, orgName string, expired bool) (wasSet bool, err error) {
+	const stmt = `UPDATE abm_tokens SET terms_expired = ? WHERE organization_name = ? AND terms_expired != ?`
+	res, err := ds.writer(ctx).ExecContext(ctx, stmt, expired, orgName, expired)
+	if err != nil {
+		return false, ctxerr.Wrap(ctx, err, "update abm_tokens terms_expired")
+	}
+	affRows, _ := res.RowsAffected()
+
+	if affRows > 0 {
+		// if it did update the row, then the previous value was the opposite of
+		// expired
+		wasSet = !expired
+	} else {
+		// if it did not update any row, then the previous value was the same
+		wasSet = expired
+	}
+	return wasSet, nil
+}
+
+func (ds *Datastore) CountABMTokensWithTermsExpired(ctx context.Context) (int, error) {
+	// The expectation is that abm_tokens will have few rows (we don't even
+	// support pagination on the "list ABM tokens" endpoint), so this query
+	// should be very fast even without index on terms_expired.
+	const stmt = `SELECT COUNT(*) FROM abm_tokens WHERE terms_expired = 1`
+
+	var count int
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &count, stmt); err != nil {
+		return 0, ctxerr.Wrap(ctx, err, "count ABM tokens with terms expired")
+	}
+	return count, nil
+}
+
+func (ds *Datastore) GetABMTokenOrgNamesAssociatedWithTeam(ctx context.Context, teamID *uint) ([]string, error) {
+	stmt := `
+SELECT DISTINCT
+	abmt.organization_name
+FROM
+	abm_tokens abmt
+	JOIN host_dep_assignments hda ON hda.abm_token_id = abmt.id
+	JOIN hosts h ON hda.host_id = h.id
+WHERE
+	%s
+UNION
+SELECT DISTINCT
+	abmt.organization_name
+FROM
+	abm_tokens abmt
+WHERE
+	%s
+`
+	var args []any
+	teamFilter := `h.team_id IS NULL`
+	abmtFilter := `abmt.macos_default_team_id IS NULL OR abmt.ios_default_team_id IS NULL OR abmt.ipados_default_team_id IS NULL`
+	if teamID != nil {
+		teamFilter = `h.team_id = ?`
+		abmtFilter = `abmt.macos_default_team_id = ? OR abmt.ios_default_team_id = ? OR abmt.ipados_default_team_id = ?`
+		args = append(args, *teamID, *teamID, *teamID, *teamID)
+	}
+
+	stmt = fmt.Sprintf(stmt, teamFilter, abmtFilter)
+
+	var orgNames []string
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &orgNames, stmt, args...); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting org names for team from db")
+	}
+
+	return orgNames, nil
+}
+
+func (ds *Datastore) AddHostMDMCommands(ctx context.Context, commands []fleet.HostMDMCommand) error {
+	const baseStmt = `
+		INSERT INTO host_mdm_commands (host_id, command_type)
+		VALUES %s
+		ON DUPLICATE KEY UPDATE
+		command_type = VALUES(command_type)`
+
+	for i := 0; i < len(commands); i += addHostMDMCommandsBatchSize {
+		start := i
+		end := i + hostIssuesInsertBatchSize
+		if end > len(commands) {
+			end = len(commands)
+		}
+		totalToProcess := end - start
+		const numberOfArgsPerInsert = 2 // number of ? in each VALUES clause
+		values := strings.TrimSuffix(
+			strings.Repeat("(?,?),", totalToProcess), ",",
+		)
+		stmt := fmt.Sprintf(baseStmt, values)
+		args := make([]interface{}, 0, totalToProcess*numberOfArgsPerInsert)
+		for j := start; j < end; j++ {
+			item := commands[j]
+			args = append(
+				args, item.HostID, item.CommandType,
+			)
+		}
+		if _, err := ds.writer(ctx).ExecContext(ctx, stmt, args...); err != nil {
+			return ctxerr.Wrap(ctx, err, "insert into host_mdm_commands")
+		}
+	}
+
+	return nil
+}
+
+func (ds *Datastore) GetHostMDMCommands(ctx context.Context, hostID uint) (commands []fleet.HostMDMCommand, err error) {
+	const stmt = `SELECT host_id, command_type FROM host_mdm_commands WHERE host_id = ?`
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &commands, stmt, hostID); err != nil {
+		return nil, err
+	}
+	return commands, nil
+}
+
+func (ds *Datastore) RemoveHostMDMCommand(ctx context.Context, command fleet.HostMDMCommand) error {
+	const stmt = `
+		DELETE FROM host_mdm_commands
+		WHERE host_id = ? AND command_type = ?`
+	if _, err := ds.writer(ctx).ExecContext(ctx, stmt, command.HostID, command.CommandType); err != nil {
+		return ctxerr.Wrap(ctx, err, "delete from host_mdm_commands")
+	}
+	return nil
+}
+
+func (ds *Datastore) CleanupHostMDMCommands(ctx context.Context) error {
+	// Delete commands that don't have a corresponding host or have been sent over 1 day ago.
+	// We are using 1 day instead of 7 days in case MDM commands fail to be sent or fail to process. They can be resent the next day.
+	const stmt = `
+		DELETE hmc FROM host_mdm_commands AS hmc
+		LEFT JOIN hosts h ON h.id = hmc.host_id
+		WHERE h.id IS NULL OR hmc.updated_at < NOW() - INTERVAL 1 DAY`
+	if _, err := ds.writer(ctx).ExecContext(ctx, stmt); err != nil {
+		return ctxerr.Wrap(ctx, err, "delete from host_mdm_commands")
+	}
+	return nil
+}
+
+func (ds *Datastore) GetMDMAppleOSUpdatesSettingsByHostSerial(ctx context.Context, serial string) (*fleet.AppleOSUpdateSettings, error) {
+	stmt := `
+SELECT 
+	team_id, platform 
+FROM 
+	hosts h 
+JOIN 
+	host_dep_assignments hdep ON h.id = host_id 
+WHERE 
+	hardware_serial = ? AND deleted_at IS NULL 
+LIMIT 1`
+
+	var dest struct {
+		TeamID   *uint  `db:"team_id"`
+		Platform string `db:"platform"`
+	}
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &dest, stmt, serial); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting team id for host")
+	}
+
+	var settings fleet.AppleOSUpdateSettings
+	if dest.TeamID == nil {
+		// use the global settings
+		ac, err := ds.AppConfig(ctx)
+		if err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "getting app config for os update settings")
+		}
+		switch dest.Platform {
+		case "ios":
+			settings = ac.MDM.IOSUpdates
+		case "ipados":
+			settings = ac.MDM.IPadOSUpdates
+		case "darwin":
+			settings = ac.MDM.MacOSUpdates
+		default:
+			return nil, ctxerr.New(ctx, fmt.Sprintf("unsupported platform %s", dest.Platform))
+		}
+	} else {
+		// use the team settings
+		tm, err := ds.TeamWithoutExtras(ctx, *dest.TeamID)
+		if err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "getting team os update settings")
+		}
+		switch dest.Platform {
+		case "ios":
+			settings = tm.Config.MDM.IOSUpdates
+		case "ipados":
+			settings = tm.Config.MDM.IPadOSUpdates
+		case "darwin":
+			settings = tm.Config.MDM.MacOSUpdates
+		default:
+			return nil, ctxerr.New(ctx, fmt.Sprintf("unsupported platform %s", dest.Platform))
+		}
+	}
+
+	return &settings, nil
+}
diff --git a/server/datastore/mysql/apple_mdm_test.go b/server/datastore/mysql/apple_mdm_test.go
index fb2bea2807a4..aba31a3c8ebf 100644
--- a/server/datastore/mysql/apple_mdm_test.go
+++ b/server/datastore/mysql/apple_mdm_test.go
@@ -6,6 +6,7 @@ import (
 	"crypto/md5" // nolint:gosec // used only to hash for efficient comparisons
 	"crypto/sha256"
 	"database/sql"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -16,6 +17,7 @@ import (
 
 	"github.com/VividCortex/mysqlerr"
 	"github.com/fleetdm/fleet/v4/pkg/optjson"
+	"github.com/fleetdm/fleet/v4/server/datastore/s3"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	fleetmdm "github.com/fleetdm/fleet/v4/server/mdm"
 	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
@@ -80,9 +82,16 @@ func TestMDMApple(t *testing.T) {
 		{"MDMAppleUpsertHostIOSiPadOS", testMDMAppleUpsertHostIOSIPadOS},
 		{"IngestMDMAppleDevicesFromDEPSyncIOSIPadOS", testIngestMDMAppleDevicesFromDEPSyncIOSIPadOS},
 		{"MDMAppleProfilesOnIOSIPadOS", testMDMAppleProfilesOnIOSIPadOS},
+		{"GetHostUUIDsWithPendingMDMAppleCommands", testGetHostUUIDsWithPendingMDMAppleCommands},
+		{"MDMAppleBootstrapPackageWithS3", testMDMAppleBootstrapPackageWithS3},
+		{"GetAndUpdateABMToken", testMDMAppleGetAndUpdateABMToken},
+		{"ABMTokensTermsExpired", testMDMAppleABMTokensTermsExpired},
+		{"TestMDMGetABMTokenOrgNamesAssociatedWithTeam", testMDMGetABMTokenOrgNamesAssociatedWithTeam},
+		{"HostMDMCommands", testHostMDMCommands},
 	}
 
 	for _, c := range cases {
+		t.Helper()
 		t.Run(c.name, func(t *testing.T) {
 			defer TruncateTables(t, ds)
 
@@ -616,10 +625,14 @@ func TestIngestMDMAppleDevicesFromDEPSync(t *testing.T) {
 	}
 	wantSerials = append(wantSerials, "abc", "xyz", "ijk", "tuv")
 
-	n, tmID, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices)
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
+	n, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices, abmToken.ID, nil, nil, nil)
 	require.NoError(t, err)
 	require.EqualValues(t, 4, n) // 4 new hosts ("abc", "xyz", "ijk", "tuv")
-	require.Nil(t, tmID)
 
 	hosts = listHostsCheckCount(t, ds, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{}, len(wantSerials))
 	gotSerials := []string{}
@@ -642,9 +655,13 @@ func TestDEPSyncTeamAssignment(t *testing.T) {
 		{SerialNumber: "def", Model: "MacBook Pro", OS: "OSX", OpType: "added"},
 	}
 
-	n, tmID, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices)
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
+	n, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices, abmToken.ID, nil, nil, nil)
 	require.NoError(t, err)
-	require.Nil(t, tmID)
 	require.Equal(t, int64(2), n)
 
 	hosts := listHostsCheckCount(t, ds, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{}, 2)
@@ -659,7 +676,7 @@ func TestDEPSyncTeamAssignment(t *testing.T) {
 	// assign the team as the default team for DEP devices
 	ac, err := ds.AppConfig(context.Background())
 	require.NoError(t, err)
-	ac.MDM.AppleBMDefaultTeam = team.Name
+	ac.MDM.DeprecatedAppleBMDefaultTeam = team.Name
 	err = ds.SaveAppConfig(context.Background(), ac)
 	require.NoError(t, err)
 
@@ -668,11 +685,9 @@ func TestDEPSyncTeamAssignment(t *testing.T) {
 		{SerialNumber: "xyz", Model: "MacBook Pro", OS: "OSX", OpType: "added"},
 	}
 
-	n, tmID, err = ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices)
+	n, err = ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices, abmToken.ID, team, team, team)
 	require.NoError(t, err)
 	require.Equal(t, int64(1), n)
-	require.NotNil(t, tmID)
-	require.Equal(t, team.ID, *tmID)
 
 	hosts = listHostsCheckCount(t, ds, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{}, 3)
 	for _, h := range hosts {
@@ -683,18 +698,14 @@ func TestDEPSyncTeamAssignment(t *testing.T) {
 		}
 	}
 
-	ac.MDM.AppleBMDefaultTeam = "non-existent"
-	err = ds.SaveAppConfig(context.Background(), ac)
-	require.NoError(t, err)
-
+	nonExistentTeam := &fleet.Team{ID: 8888}
 	depDevices = []godep.Device{
 		{SerialNumber: "jqk", Model: "MacBook Pro", OS: "OSX", OpType: "added"},
 	}
 
-	n, tmID, err = ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices)
+	n, err = ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices, abmToken.ID, nonExistentTeam, nonExistentTeam, nonExistentTeam)
 	require.NoError(t, err)
 	require.EqualValues(t, n, 1)
-	require.Nil(t, tmID)
 
 	hosts = listHostsCheckCount(t, ds, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{}, 4)
 	for _, h := range hosts {
@@ -816,13 +827,17 @@ func testIngestMDMAppleIngestAfterDEPSync(t *testing.T, ds *Datastore) {
 	testUUID := "test-uuid"
 	testModel := "MacBook Pro"
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	// simulate a host that is first ingested via DEP (e.g., the device was added via Apple Business Manager)
-	n, tmID, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{
+	n, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{
 		{SerialNumber: testSerial, Model: testModel, OS: "OSX", OpType: "added"},
-	})
+	}, abmToken.ID, nil, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, int64(1), n)
-	require.Nil(t, tmID)
 
 	hosts := listHostsCheckCount(t, ds, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{}, 1)
 	// hosts that are first ingested via DEP will have a serial number but not a UUID because UUID
@@ -863,13 +878,17 @@ func testIngestMDMAppleCheckinBeforeDEPSync(t *testing.T, ds *Datastore) {
 	require.Equal(t, testUUID, hosts[0].UUID)
 	checkMDMHostRelatedTables(t, ds, hosts[0].ID, testSerial, testModel)
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	// no effect if same host appears in DEP sync
-	n, tmID, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{
+	n, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{
 		{SerialNumber: testSerial, Model: testModel, OS: "OSX", OpType: "added"},
-	})
+	}, abmToken.ID, nil, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, int64(0), n)
-	require.Nil(t, tmID)
 
 	hosts = listHostsCheckCount(t, ds, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{}, 1)
 	require.Equal(t, testSerial, hosts[0].HardwareSerial)
@@ -1039,7 +1058,9 @@ func expectAppleDeclarations(
 	var got []*fleet.MDMAppleDeclaration
 	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
 		ctx := context.Background()
-		return sqlx.SelectContext(ctx, q, &got, `SELECT * FROM mdm_apple_declarations WHERE team_id = ?`, tmID)
+		return sqlx.SelectContext(ctx, q, &got,
+			`SELECT declaration_uuid, team_id, identifier, name, raw_json, checksum, created_at, uploaded_at FROM mdm_apple_declarations WHERE team_id = ?`,
+			tmID)
 	})
 
 	// create map of expected declarations keyed by identifier
@@ -1324,16 +1345,20 @@ func teamConfigProfileForTest(t *testing.T, name, identifier, uuid string, teamI
 }
 
 func testMDMAppleProfileManagementBatch2(t *testing.T, ds *Datastore) {
+	ds.testSelectMDMProfilesBatchSize = 2
 	ds.testUpsertMDMDesiredProfilesBatchSize = 2
 	t.Cleanup(func() {
+		ds.testSelectMDMProfilesBatchSize = 0
 		ds.testUpsertMDMDesiredProfilesBatchSize = 0
 	})
 	testMDMAppleProfileManagement(t, ds)
 }
 
 func testMDMAppleProfileManagementBatch3(t *testing.T, ds *Datastore) {
+	ds.testSelectMDMProfilesBatchSize = 3
 	ds.testUpsertMDMDesiredProfilesBatchSize = 3
 	t.Cleanup(func() {
+		ds.testSelectMDMProfilesBatchSize = 0
 		ds.testUpsertMDMDesiredProfilesBatchSize = 0
 	})
 	testMDMAppleProfileManagement(t, ds)
@@ -3139,7 +3164,7 @@ func testMDMAppleBootstrapPackageCRUD(t *testing.T, ds *Datastore) {
 	var nfe fleet.NotFoundError
 	var aerr fleet.AlreadyExistsError
 
-	err := ds.InsertMDMAppleBootstrapPackage(ctx, &fleet.MDMAppleBootstrapPackage{})
+	err := ds.InsertMDMAppleBootstrapPackage(ctx, &fleet.MDMAppleBootstrapPackage{}, nil)
 	require.Error(t, err)
 
 	bp1 := &fleet.MDMAppleBootstrapPackage{
@@ -3149,10 +3174,10 @@ func testMDMAppleBootstrapPackageCRUD(t *testing.T, ds *Datastore) {
 		Bytes:  []byte("content"),
 		Token:  uuid.New().String(),
 	}
-	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp1)
+	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp1, nil)
 	require.NoError(t, err)
 
-	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp1)
+	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp1, nil)
 	require.ErrorAs(t, err, &aerr)
 
 	bp2 := &fleet.MDMAppleBootstrapPackage{
@@ -3162,7 +3187,7 @@ func testMDMAppleBootstrapPackageCRUD(t *testing.T, ds *Datastore) {
 		Bytes:  []byte("content"),
 		Token:  uuid.New().String(),
 	}
-	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp2)
+	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp2, nil)
 	require.NoError(t, err)
 
 	meta, err := ds.GetMDMAppleBootstrapPackageMeta(ctx, 0)
@@ -3176,11 +3201,11 @@ func testMDMAppleBootstrapPackageCRUD(t *testing.T, ds *Datastore) {
 	require.ErrorAs(t, err, &nfe)
 	require.Nil(t, meta)
 
-	bytes, err := ds.GetMDMAppleBootstrapPackageBytes(ctx, bp1.Token)
+	bytes, err := ds.GetMDMAppleBootstrapPackageBytes(ctx, bp1.Token, nil)
 	require.NoError(t, err)
 	require.Equal(t, bp1.Bytes, bytes.Bytes)
 
-	bytes, err = ds.GetMDMAppleBootstrapPackageBytes(ctx, "fake")
+	bytes, err = ds.GetMDMAppleBootstrapPackageBytes(ctx, "fake", nil)
 	require.ErrorAs(t, err, &nfe)
 	require.Nil(t, bytes)
 
@@ -3452,6 +3477,10 @@ func testMDMAppleSetupAssistant(t *testing.T, ds *Datastore) {
 	require.Error(t, err)
 	require.ErrorIs(t, err, sql.ErrNoRows)
 	require.True(t, fleet.IsNotFound(err))
+	_, _, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, nil, "no-such-token")
+	require.Error(t, err)
+	require.ErrorIs(t, err, sql.ErrNoRows)
+	require.True(t, fleet.IsNotFound(err))
 
 	// create for no team
 	noTeamAsst, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{Name: "test", Profile: json.RawMessage("{}")})
@@ -3491,7 +3520,59 @@ func testMDMAppleSetupAssistant(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	require.Equal(t, tmAsst, getAsst)
 
-	// upsert team
+	// create an ABM token and set a profile uuid for no team
+	tok1, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "o1", EncryptedToken: []byte(uuid.NewString())})
+	require.NoError(t, err)
+	require.NotZero(t, tok1.ID)
+	profUUID1 := uuid.NewString()
+	err = ds.SetMDMAppleSetupAssistantProfileUUID(ctx, nil, profUUID1, "o1")
+	require.NoError(t, err)
+	gotProf, gotTs, err := ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, nil, "o1")
+	require.NoError(t, err)
+	require.Equal(t, profUUID1, gotProf)
+	require.NotZero(t, gotTs)
+
+	// set a profile uuid for an unknown token, no error but nothing inserted
+	err = ds.SetMDMAppleSetupAssistantProfileUUID(ctx, nil, profUUID1, "no-such-token")
+	require.NoError(t, err)
+	_, _, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, nil, "no-such-token")
+	require.Error(t, err)
+	require.ErrorIs(t, err, sql.ErrNoRows)
+	require.True(t, fleet.IsNotFound(err))
+
+	// create another ABM token and set a profile uuid for the team assistant
+	// with both tokens
+	tok2, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "o2", EncryptedToken: []byte(uuid.NewString())})
+	require.NoError(t, err)
+	require.NotZero(t, tok2.ID)
+	profUUID2 := uuid.NewString()
+	err = ds.SetMDMAppleSetupAssistantProfileUUID(ctx, &tm.ID, profUUID1, "o1")
+	require.NoError(t, err)
+	err = ds.SetMDMAppleSetupAssistantProfileUUID(ctx, &tm.ID, profUUID2, "o2")
+	require.NoError(t, err)
+	gotProf, gotTs, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm.ID, "o1")
+	require.NoError(t, err)
+	require.Equal(t, profUUID1, gotProf)
+	require.NotZero(t, gotTs)
+	gotProf, gotTs, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm.ID, "o2")
+	require.NoError(t, err)
+	require.Equal(t, profUUID2, gotProf)
+	require.NotZero(t, gotTs)
+
+	// update the profile uuid for o2 only
+	profUUID3 := uuid.NewString()
+	err = ds.SetMDMAppleSetupAssistantProfileUUID(ctx, &tm.ID, profUUID3, "o2")
+	require.NoError(t, err)
+	gotProf, gotTs, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm.ID, "o1")
+	require.NoError(t, err)
+	require.Equal(t, profUUID1, gotProf)
+	require.NotZero(t, gotTs)
+	gotProf, gotTs, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm.ID, "o2")
+	require.NoError(t, err)
+	require.Equal(t, profUUID3, gotProf)
+	require.NotZero(t, gotTs)
+
+	// upsert team assistant
 	tmAsst2, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{TeamID: &tm.ID, Name: "test2", Profile: json.RawMessage(`{"x":2}`)})
 	require.NoError(t, err)
 	require.Equal(t, tmAsst2.ID, tmAsst.ID)
@@ -3500,7 +3581,13 @@ func testMDMAppleSetupAssistant(t *testing.T, ds *Datastore) {
 	require.Equal(t, "test2", tmAsst2.Name)
 	require.JSONEq(t, `{"x": 2}`, string(tmAsst2.Profile))
 
-	// upsert no team
+	// profile uuids have been cleared
+	_, _, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm.ID, "o1")
+	require.ErrorIs(t, err, sql.ErrNoRows)
+	_, _, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm.ID, "o2")
+	require.ErrorIs(t, err, sql.ErrNoRows)
+
+	// upsert no team assistant
 	noTeamAsst2, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{Name: "test3", Profile: json.RawMessage(`{"x": 3}`)})
 	require.NoError(t, err)
 	require.Equal(t, noTeamAsst2.ID, noTeamAsst.ID)
@@ -3509,74 +3596,52 @@ func testMDMAppleSetupAssistant(t *testing.T, ds *Datastore) {
 	require.Equal(t, "test3", noTeamAsst2.Name)
 	require.JSONEq(t, `{"x": 3}`, string(noTeamAsst2.Profile))
 
+	// profile uuid has been cleared
+	_, _, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, nil, "o1")
+	require.ErrorIs(t, err, sql.ErrNoRows)
+
 	time.Sleep(time.Second) // ensures the timestamp checks are not by chance
 
-	// upsert team no change, uploaded at timestamp does not change
-	tmAsst3, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{TeamID: &tm.ID, Name: "test2", Profile: json.RawMessage(`{"x":2}`)})
+	// set profile uuids for team and no team (one each)
+	err = ds.SetMDMAppleSetupAssistantProfileUUID(ctx, nil, profUUID1, "o1")
 	require.NoError(t, err)
-	require.Equal(t, tmAsst2, tmAsst3)
-
-	// set a profile uuid for the team assistant
-	err = ds.SetMDMAppleSetupAssistantProfileUUID(ctx, &tm.ID, "abcd")
+	err = ds.SetMDMAppleSetupAssistantProfileUUID(ctx, &tm.ID, profUUID2, "o2")
 	require.NoError(t, err)
 
-	// get for team returns the same data, but now with a profile uuid
-	getAsst, err = ds.GetMDMAppleSetupAssistant(ctx, &tm.ID)
+	// upsert team no change, uploaded at timestamp does not change
+	tmAsst3, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{TeamID: &tm.ID, Name: "test2", Profile: json.RawMessage(`{"x":2}`)})
 	require.NoError(t, err)
-	require.Equal(t, "abcd", getAsst.ProfileUUID)
-	getAsst.ProfileUUID = ""
-	require.Equal(t, tmAsst3, getAsst)
-
-	time.Sleep(time.Second) // ensures the timestamp checks are not by chance
+	require.Equal(t, tmAsst2, tmAsst3)
 
-	// upsert again the team with no change, uploaded at timestamp does not change nor does the profile uuid
-	tmAsst4, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{TeamID: &tm.ID, Name: "test2", Profile: json.RawMessage(`{"x":2}`)})
-	require.NoError(t, err)
-	require.Equal(t, "abcd", tmAsst4.ProfileUUID)
-	tmAsst4.ProfileUUID = ""
-	require.Equal(t, tmAsst3, tmAsst4)
+	// TODO(mna): ideally the profiles would not be cleared when the profile
+	// stayed the same, but does not work at the moment and we're pressed by
+	// time.
+	// gotProf, gotTs, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm.ID, "o2")
+	// require.NoError(t, err)
+	// require.Equal(t, profUUID2, gotProf)
+	// require.Equal(t, tmAsst3.UploadedAt, gotTs)
 
 	time.Sleep(time.Second) // ensures the timestamp checks are not by chance
 
 	// upsert team with a change, clears the profile uuid and updates the uploaded at timestamp
-	tmAsst5, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{TeamID: &tm.ID, Name: "test2", Profile: json.RawMessage(`{"x":3}`)})
-	require.NoError(t, err)
-	require.Equal(t, tmAsst4.ID, tmAsst5.ID)
-	require.True(t, tmAsst5.UploadedAt.After(tmAsst4.UploadedAt))
-	require.Equal(t, tmAsst4.TeamID, tmAsst5.TeamID)
-	require.Equal(t, "test2", tmAsst5.Name)
-	require.Empty(t, tmAsst5.ProfileUUID)
-	require.JSONEq(t, `{"x": 3}`, string(tmAsst5.Profile))
-
-	// set a profile uuid for the team assistant
-	err = ds.SetMDMAppleSetupAssistantProfileUUID(ctx, &tm.ID, "efgh")
-	require.NoError(t, err)
-
-	time.Sleep(time.Second) // ensures the timestamp checks are not by chance
-
-	// upsert again the team with no change
-	tmAsst6, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{TeamID: &tm.ID, Name: "test2", Profile: json.RawMessage(`{"x":3}`)})
+	tmAsst4, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{TeamID: &tm.ID, Name: "test2", Profile: json.RawMessage(`{"x":3}`)})
 	require.NoError(t, err)
-	require.Equal(t, "efgh", tmAsst6.ProfileUUID)
-	tmAsst6.ProfileUUID = ""
-	require.Equal(t, tmAsst5, tmAsst6)
+	require.Equal(t, tmAsst3.ID, tmAsst4.ID)
+	require.True(t, tmAsst4.UploadedAt.After(tmAsst3.UploadedAt))
+	require.Equal(t, tmAsst3.TeamID, tmAsst4.TeamID)
+	require.Equal(t, "test2", tmAsst4.Name)
+	require.JSONEq(t, `{"x": 3}`, string(tmAsst4.Profile))
 
-	time.Sleep(time.Second) // ensures the timestamp checks are not by chance
-
-	// upsert team with a name change
-	tmAsst7, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{TeamID: &tm.ID, Name: "test3", Profile: json.RawMessage(`{"x":3}`)})
-	require.NoError(t, err)
-	require.Equal(t, tmAsst6.ID, tmAsst7.ID)
-	require.True(t, tmAsst7.UploadedAt.After(tmAsst6.UploadedAt))
-	require.Equal(t, tmAsst6.TeamID, tmAsst7.TeamID)
-	require.Equal(t, "test3", tmAsst7.Name)
-	require.Empty(t, tmAsst7.ProfileUUID)
-	require.JSONEq(t, `{"x": 3}`, string(tmAsst7.Profile))
+	_, _, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm.ID, "o2")
+	require.ErrorIs(t, err, sql.ErrNoRows)
 
 	// delete no team
 	err = ds.DeleteMDMAppleSetupAssistant(ctx, nil)
 	require.NoError(t, err)
 
+	_, _, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, nil, "o1")
+	require.ErrorIs(t, err, sql.ErrNoRows)
+
 	// delete the team, which will cascade delete the setup assistant
 	err = ds.DeleteTeam(ctx, tm.ID)
 	require.NoError(t, err)
@@ -3647,6 +3712,11 @@ func testMDMAppleEnrollmentProfile(t *testing.T, ds *Datastore) {
 func testListMDMAppleSerials(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	// create a mix of DEP-enrolled hosts, non-Fleet-MDM, pending DEP-enrollment
 	hosts := make([]*fleet.Host, 7)
 	for i := 0; i < len(hosts); i++ {
@@ -3666,19 +3736,19 @@ func testListMDMAppleSerials(t *testing.T, ds *Datastore) {
 		switch {
 		case i <= 3:
 			// assigned in ABM to Fleet
-			err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h})
+			err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h}, abmToken.ID)
 			require.NoError(t, err)
 		case i == 4:
 			// not ABM assigned
 		case i == 5:
 			// ABM assignment was deleted
-			err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h})
+			err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h}, abmToken.ID)
 			require.NoError(t, err)
 			err = ds.DeleteHostDEPAssignments(ctx, []string{h.HardwareSerial})
 			require.NoError(t, err)
 		case i == 6:
 			// assigned in ABM, but we don't have a serial
-			err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h})
+			err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h}, abmToken.ID)
 			require.NoError(t, err)
 		}
 		hosts[i] = h
@@ -3737,28 +3807,36 @@ func testListMDMAppleSerials(t *testing.T, ds *Datastore) {
 func testMDMAppleDefaultSetupAssistant(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 
+	// create a couple ABM tokens
+	tok1, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "o1", EncryptedToken: []byte(uuid.NewString())})
+	require.NoError(t, err)
+	require.NotEmpty(t, tok1.ID)
+	tok2, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "o2", EncryptedToken: []byte(uuid.NewString())})
+	require.NoError(t, err)
+	require.NotEmpty(t, tok2.ID)
+
 	// get non-existing
-	_, _, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, nil)
+	_, _, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, nil, "no-such-token")
 	require.ErrorIs(t, err, sql.ErrNoRows)
 	require.True(t, fleet.IsNotFound(err))
 
 	// set for no team
-	err = ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, nil, "no-team")
+	err = ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, nil, "no-team", "o1")
 	require.NoError(t, err)
 
 	// get for no team returns the same data
-	uuid, ts, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, nil)
+	uuid, ts, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, nil, "o1")
 	require.NoError(t, err)
 	require.Equal(t, "no-team", uuid)
 	require.NotZero(t, ts)
 
 	// set for non-existing team fails
-	err = ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, ptr.Uint(123), "xyz")
+	err = ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, ptr.Uint(123), "xyz", "o2")
 	require.Error(t, err)
 	require.ErrorContains(t, err, "foreign key constraint fails")
 
 	// get for non-existing team fails
-	_, _, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, ptr.Uint(123))
+	_, _, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, ptr.Uint(123), "o2")
 	require.ErrorIs(t, err, sql.ErrNoRows)
 	require.True(t, fleet.IsNotFound(err))
 
@@ -3766,15 +3844,35 @@ func testMDMAppleDefaultSetupAssistant(t *testing.T, ds *Datastore) {
 	tm, err := ds.NewTeam(ctx, &fleet.Team{Name: "tm"})
 	require.NoError(t, err)
 
-	// set for existing team
-	err = ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, &tm.ID, "tm")
+	// set a couple profiles for existing team
+	err = ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, &tm.ID, "tm1", "o1")
+	require.NoError(t, err)
+	err = ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, &tm.ID, "tm2", "o2")
 	require.NoError(t, err)
 
 	// get for existing team
-	uuid, ts, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, &tm.ID)
+	uuid, ts, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, &tm.ID, "o1")
+	require.NoError(t, err)
+	require.Equal(t, "tm1", uuid)
+	require.NotZero(t, ts)
+	uuid, ts, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, &tm.ID, "o2")
 	require.NoError(t, err)
-	require.Equal(t, "tm", uuid)
+	require.Equal(t, "tm2", uuid)
 	require.NotZero(t, ts)
+	// get for unknown abm token
+	_, _, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, &tm.ID, "no-such-token")
+	require.ErrorIs(t, err, sql.ErrNoRows)
+	require.True(t, fleet.IsNotFound(err))
+
+	// clear all profiles for team
+	err = ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, &tm.ID, "", "")
+	require.NoError(t, err)
+	_, _, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, &tm.ID, "o1")
+	require.ErrorIs(t, err, sql.ErrNoRows)
+	require.True(t, fleet.IsNotFound(err))
+	_, _, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, &tm.ID, "o2")
+	require.ErrorIs(t, err, sql.ErrNoRows)
+	require.True(t, fleet.IsNotFound(err))
 }
 
 func testSetVerifiedMacOSProfiles(t *testing.T, ds *Datastore) {
@@ -4060,7 +4158,7 @@ func TestCopyDefaultMDMAppleBootstrapPackage(t *testing.T) {
 		Bytes:  []byte("content"),
 		Token:  uuid.New().String(),
 	}
-	err = ds.InsertMDMAppleBootstrapPackage(ctx, defaultBP)
+	err = ds.InsertMDMAppleBootstrapPackage(ctx, defaultBP, nil)
 	require.NoError(t, err)
 	checkStoredBP(noTeamID, nil, false, defaultBP)   // default bootstrap package is stored
 	checkStoredBP(teamID, sql.ErrNoRows, false, nil) // no bootstrap package yet for team
@@ -4090,7 +4188,7 @@ func TestCopyDefaultMDMAppleBootstrapPackage(t *testing.T) {
 		Bytes:  []byte("new content"),
 		Token:  uuid.New().String(),
 	}
-	err = ds.InsertMDMAppleBootstrapPackage(ctx, defaultBP2)
+	err = ds.InsertMDMAppleBootstrapPackage(ctx, defaultBP2, nil)
 	require.NoError(t, err)
 	checkStoredBP(noTeamID, nil, false, defaultBP2)
 	// set bootstrap package url in app config
@@ -4184,13 +4282,18 @@ func TestHostDEPAssignments(t *testing.T) {
 	expectedMDMServerURL, err := apple_mdm.ResolveAppleEnrollMDMURL(ac.ServerSettings.ServerURL)
 	require.NoError(t, err)
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	t.Run("DEP enrollment", func(t *testing.T) {
 		depSerial := "dep-serial"
 		depUUID := "dep-uuid"
 		depOrbitNodeKey := "dep-orbit-node-key"
 		depDeviceTok := "dep-device-token"
 
-		n, _, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{{SerialNumber: depSerial}})
+		n, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{{SerialNumber: depSerial}}, abmToken.ID, nil, nil, nil)
 		require.NoError(t, err)
 		require.Equal(t, int64(1), n)
 
@@ -4213,6 +4316,8 @@ func TestHostDEPAssignments(t *testing.T) {
 		require.Equal(t, depHostID, depAssignment.HostID)
 		require.Nil(t, depAssignment.DeletedAt)
 		require.WithinDuration(t, time.Now(), depAssignment.AddedAt, 5*time.Second)
+		require.NotNil(t, depAssignment.ABMTokenID)
+		require.Equal(t, *depAssignment.ABMTokenID, abmToken.ID)
 
 		// simulate initial osquery enrollment via Orbit
 		testHost, err := ds.EnrollOrbit(ctx, true, fleet.OrbitHostInfo{HardwareSerial: depSerial, Platform: "darwin", HardwareUUID: depUUID, Hostname: "dep-host"}, depOrbitNodeKey, nil)
@@ -4510,7 +4615,7 @@ func testMDMAppleResetEnrollment(t *testing.T, ds *Datastore) {
 		Sha256: sha256.New().Sum(nil),
 		Bytes:  []byte("content"),
 		Token:  uuid.New().String(),
-	})
+	}, nil)
 	require.NoError(t, err)
 	err = ds.RecordHostBootstrapPackage(ctx, "command-uuid", host.UUID)
 	require.NoError(t, err)
@@ -4548,6 +4653,11 @@ func testMDMAppleResetEnrollment(t *testing.T, ds *Datastore) {
 func testMDMAppleDeleteHostDEPAssignments(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	cases := []struct {
 		name string
 		in   []string
@@ -4567,7 +4677,7 @@ func testMDMAppleDeleteHostDEPAssignments(t *testing.T, ds *Datastore) {
 				{SerialNumber: "bar"},
 				{SerialNumber: "baz"},
 			}
-			_, _, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, devices)
+			_, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, devices, abmToken.ID, nil, nil, nil)
 			require.NoError(t, err)
 
 			err = ds.DeleteHostDEPAssignments(ctx, tt.in)
@@ -4754,8 +4864,11 @@ func testMDMAppleDDMDeclarationsToken(t *testing.T, ds *Datastore) {
 		Name:       "decl-1",
 	})
 	require.NoError(t, err)
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl.DeclarationUUID}, nil)
+	updates, err := ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl.DeclarationUUID}, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
+	assert.False(t, updates.WindowsConfigProfile)
 
 	toks, err = ds.MDMAppleDDMDeclarationsToken(ctx, "not-exists")
 	require.NoError(t, err)
@@ -4772,8 +4885,11 @@ func testMDMAppleDDMDeclarationsToken(t *testing.T, ds *Datastore) {
 	})
 	require.NoError(t, err)
 	nanoEnroll(t, ds, host1, true)
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl.DeclarationUUID}, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl.DeclarationUUID}, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
+	assert.False(t, updates.WindowsConfigProfile)
 
 	toks, err = ds.MDMAppleDDMDeclarationsToken(ctx, host1.UUID)
 	require.NoError(t, err)
@@ -4786,8 +4902,11 @@ func testMDMAppleDDMDeclarationsToken(t *testing.T, ds *Datastore) {
 		Name:       "decl-2",
 	})
 	require.NoError(t, err)
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl2.DeclarationUUID}, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl2.DeclarationUUID}, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
+	assert.False(t, updates.WindowsConfigProfile)
 
 	toks, err = ds.MDMAppleDDMDeclarationsToken(ctx, host1.UUID)
 	require.NoError(t, err)
@@ -4798,8 +4917,11 @@ func testMDMAppleDDMDeclarationsToken(t *testing.T, ds *Datastore) {
 
 	err = ds.DeleteMDMAppleConfigProfile(ctx, decl.DeclarationUUID)
 	require.NoError(t, err)
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl2.DeclarationUUID}, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl2.DeclarationUUID}, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
+	assert.False(t, updates.WindowsConfigProfile)
 
 	toks, err = ds.MDMAppleDDMDeclarationsToken(ctx, host1.UUID)
 	require.NoError(t, err)
@@ -5367,6 +5489,11 @@ func TestRestorePendingDEPHost(t *testing.T) {
 	expectedMDMServerURL, err := apple_mdm.ResolveAppleEnrollMDMURL(ac.ServerSettings.ServerURL)
 	require.NoError(t, err)
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	t.Run("DEP enrollment", func(t *testing.T) {
 		checkHostExistsInTable := func(t *testing.T, tableName string, hostID uint, expected bool, where ...string) {
 			stmt := "SELECT 1 FROM " + tableName + " WHERE host_id = ?"
@@ -5418,7 +5545,7 @@ func TestRestorePendingDEPHost(t *testing.T) {
 			depUUID := "dep-uuid"
 			depOrbitNodeKey := "dep-orbit-node-key"
 
-			n, _, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{{SerialNumber: depSerial}})
+			n, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{{SerialNumber: depSerial}}, abmToken.ID, nil, nil, nil)
 			require.NoError(t, err)
 			require.Equal(t, int64(1), n)
 
@@ -5500,10 +5627,15 @@ func testMDMAppleDEPAssignmentUpdates(t *testing.T, ds *Datastore) {
 	})
 	require.NoError(t, err)
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	_, err = ds.GetHostDEPAssignment(ctx, h.ID)
 	require.ErrorIs(t, err, sql.ErrNoRows)
 
-	err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h})
+	err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h}, abmToken.ID)
 	require.NoError(t, err)
 
 	assignment, err := ds.GetHostDEPAssignment(ctx, h.ID)
@@ -5519,7 +5651,7 @@ func testMDMAppleDEPAssignmentUpdates(t *testing.T, ds *Datastore) {
 	require.Equal(t, h.ID, assignment.HostID)
 	require.NotNil(t, assignment.DeletedAt)
 
-	err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h})
+	err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h}, abmToken.ID)
 	require.NoError(t, err)
 	assignment, err = ds.GetHostDEPAssignment(ctx, h.ID)
 	require.NoError(t, err)
@@ -5550,11 +5682,11 @@ func testMDMConfigAsset(t *testing.T, ds *Datastore) {
 	assets := []fleet.MDMConfigAsset{
 		{
 			Name:  fleet.MDMAssetCACert,
-			Value: []byte("some bytes"),
+			Value: []byte("a"),
 		},
 		{
 			Name:  fleet.MDMAssetCAKey,
-			Value: []byte("some other bytes"),
+			Value: []byte("b"),
 		},
 	}
 	wantAssets := map[fleet.MDMAssetName]fleet.MDMConfigAsset{}
@@ -5594,6 +5726,37 @@ func testMDMConfigAsset(t *testing.T, ds *Datastore) {
 	require.Len(t, h, 1)
 	require.NotEmpty(t, h[fleet.MDMAssetCACert])
 
+	// Replace the assets
+
+	newAssets := []fleet.MDMConfigAsset{
+		{
+			Name:  fleet.MDMAssetCACert,
+			Value: []byte("c"),
+		},
+		{
+			Name:  fleet.MDMAssetCAKey,
+			Value: []byte("d"),
+		},
+	}
+
+	wantNewAssets := map[fleet.MDMAssetName]fleet.MDMConfigAsset{}
+	for _, a := range newAssets {
+		wantNewAssets[a.Name] = a
+	}
+
+	err = ds.ReplaceMDMConfigAssets(ctx, newAssets)
+	require.NoError(t, err)
+
+	a, err = ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{fleet.MDMAssetCACert, fleet.MDMAssetCAKey})
+	require.NoError(t, err)
+	require.Equal(t, wantNewAssets, a)
+
+	h, err = ds.GetAllMDMConfigAssetsHashes(ctx, []fleet.MDMAssetName{fleet.MDMAssetCACert, fleet.MDMAssetCAKey})
+	require.NoError(t, err)
+	require.Len(t, h, 2)
+	require.NotEmpty(t, h[fleet.MDMAssetCACert])
+	require.NotEmpty(t, h[fleet.MDMAssetCAKey])
+
 	// Soft delete the assets
 
 	err = ds.DeleteMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{fleet.MDMAssetCACert, fleet.MDMAssetCAKey})
@@ -5618,19 +5781,25 @@ func testMDMConfigAsset(t *testing.T, ds *Datastore) {
 
 	var ar []assetRow
 
-	err = sqlx.SelectContext(ctx, ds.reader(ctx), &ar, "SELECT name, value, deletion_uuid, deleted_at FROM mdm_config_assets WHERE name IN (?, ?) ORDER BY name", fleet.MDMAssetCACert, fleet.MDMAssetCAKey)
+	err = sqlx.SelectContext(ctx, ds.reader(ctx), &ar, "SELECT name, value, deletion_uuid, deleted_at FROM mdm_config_assets")
 	require.NoError(t, err)
 
-	require.Len(t, ar, 2)
+	require.Len(t, ar, 4)
+
+	expected := make(map[string]fleet.MDMConfigAsset)
+
+	for _, a := range append(assets, newAssets...) {
+		expected[string(a.Value)] = a
+	}
 
-	for i, a := range ar {
-		require.Equal(t, assets[i].Name, fleet.MDMAssetName(a.Name))
-		require.NotEmpty(t, a.Value)
-		d, err := decrypt(a.Value, ds.serverPrivateKey)
+	for _, got := range ar {
+		d, err := decrypt(got.Value, ds.serverPrivateKey)
 		require.NoError(t, err)
-		require.Equal(t, assets[i].Value, d)
-		require.NotEmpty(t, a.DeletionUUID)
-		require.NotEmpty(t, a.DeletedAt)
+		require.Equal(t, expected[string(d)].Name, fleet.MDMAssetName(got.Name))
+		require.NotEmpty(t, got.Value)
+		require.Equal(t, expected[string(d)].Value, d)
+		require.NotEmpty(t, got.DeletionUUID)
+		require.NotEmpty(t, got.DeletedAt)
 	}
 }
 
@@ -5653,10 +5822,15 @@ func testListIOSAndIPadOSToRefetch(t *testing.T, ds *Datastore) {
 		return h
 	}
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	// Test with no hosts.
-	uuids, err := ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
+	devices, err := ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
 	require.NoError(t, err)
-	require.Empty(t, uuids)
+	require.Empty(t, devices)
 
 	// Create a placeholder macOS host.
 	_ = newHost("darwin")
@@ -5666,14 +5840,14 @@ func testListIOSAndIPadOSToRefetch(t *testing.T, ds *Datastore) {
 		{SerialNumber: "iOS0_SERIAL", DeviceFamily: "iPhone", OpType: "added"},
 		{SerialNumber: "iPadOS0_SERIAL", DeviceFamily: "iPad", OpType: "added"},
 	}
-	n, _, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices)
+	n, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices, abmToken.ID, nil, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, int64(2), n)
 
 	// Hosts are not enrolled yet (e.g. DEP enrolled)
-	uuids, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
+	devices, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
 	require.NoError(t, err)
-	require.Empty(t, uuids)
+	require.Empty(t, devices)
 
 	// Now simulate the initial MDM checkin of the devices.
 	err = ds.MDMAppleUpsertHost(ctx, &fleet.Host{
@@ -5700,13 +5874,16 @@ func testListIOSAndIPadOSToRefetch(t *testing.T, ds *Datastore) {
 	nanoEnroll(t, ds, iPadOS0, false)
 
 	// Test with hosts but empty state in nanomdm command tables.
-	uuids, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
+	devices, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
 	require.NoError(t, err)
-	require.Len(t, uuids, 2)
+	require.Len(t, devices, 2)
+	uuids := []string{devices[0].UUID, devices[1].UUID}
 	sort.Slice(uuids, func(i, j int) bool {
 		return uuids[i] < uuids[j]
 	})
-	require.Equal(t, uuids, []string{"iOS0_UUID", "iPadOS0_UUID"})
+	assert.Equal(t, uuids, []string{"iOS0_UUID", "iPadOS0_UUID"})
+	assert.Empty(t, devices[0].CommandsAlreadySent)
+	assert.Empty(t, devices[1].CommandsAlreadySent)
 
 	// Set iOS detail_updated_at as 30 minutes in the past.
 	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -5715,10 +5892,10 @@ func testListIOSAndIPadOSToRefetch(t *testing.T, ds *Datastore) {
 	})
 
 	// iOS device should not be returned because it was refetched recently
-	uuids, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
+	devices, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
 	require.NoError(t, err)
-	require.Len(t, uuids, 1)
-	require.Equal(t, uuids[0], "iPadOS0_UUID")
+	require.Len(t, devices, 1)
+	require.Equal(t, devices[0].UUID, "iPadOS0_UUID")
 
 	// Set iPadOS detail_updated_at as 30 minutes in the past.
 	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -5727,9 +5904,9 @@ func testListIOSAndIPadOSToRefetch(t *testing.T, ds *Datastore) {
 	})
 
 	// Both devices are up-to-date thus none should be returned.
-	uuids, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
+	devices, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
 	require.NoError(t, err)
-	require.Empty(t, uuids)
+	require.Empty(t, devices)
 
 	// Set iOS detail_updated_at as 2 hours in the past.
 	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -5738,10 +5915,23 @@ func testListIOSAndIPadOSToRefetch(t *testing.T, ds *Datastore) {
 	})
 
 	// iOS device be returned because it is out of date.
-	uuids, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
+	devices, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
+	require.NoError(t, err)
+	require.Len(t, devices, 1)
+	require.Equal(t, devices[0].UUID, "iOS0_UUID")
+	assert.Empty(t, devices[0].CommandsAlreadySent)
+
+	// Update commands already sent to the devices and check that they are returned.
+	require.NoError(t, ds.AddHostMDMCommands(ctx, []fleet.HostMDMCommand{{
+		HostID:      iOS0.ID,
+		CommandType: "my-command",
+	}}))
+	devices, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
 	require.NoError(t, err)
-	require.Len(t, uuids, 1)
-	require.Equal(t, uuids[0], "iOS0_UUID")
+	require.Len(t, devices, 1)
+	require.Equal(t, devices[0].UUID, "iOS0_UUID")
+	require.Len(t, devices[0].CommandsAlreadySent, 1)
+	assert.Equal(t, "my-command", devices[0].CommandsAlreadySent[0])
 }
 
 func testMDMAppleUpsertHostIOSIPadOS(t *testing.T, ds *Datastore) {
@@ -5831,7 +6021,12 @@ func testIngestMDMAppleDevicesFromDEPSyncIOSIPadOS(t *testing.T, ds *Datastore)
 		{SerialNumber: "iPadOS0_SERIAL", DeviceFamily: "iPad", OpType: "added"},
 	}
 
-	n, _, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices)
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
+	n, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices, abmToken.ID, nil, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, int64(2), n)
 
@@ -5904,8 +6099,11 @@ func testMDMAppleProfilesOnIOSIPadOS(t *testing.T, ds *Datastore) {
 	someProfile, err := ds.NewMDMAppleConfigProfile(ctx, *generateCP("a", "a", 0))
 	require.NoError(t, err)
 
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{0}, nil, nil)
+	updates, err := ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{0}, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
+	assert.False(t, updates.WindowsConfigProfile)
 
 	profiles, err := ds.GetHostMDMAppleProfiles(ctx, "iOS0_UUID")
 	require.NoError(t, err)
@@ -5917,6 +6115,53 @@ func testMDMAppleProfilesOnIOSIPadOS(t *testing.T, ds *Datastore) {
 	require.Equal(t, someProfile.Name, profiles[0].Name)
 }
 
+func testGetHostUUIDsWithPendingMDMAppleCommands(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	uuids, err := ds.GetHostUUIDsWithPendingMDMAppleCommands(ctx)
+	require.NoError(t, err)
+	require.Empty(t, uuids)
+
+	var hosts []*fleet.Host
+	for i := 0; i < 10; i++ {
+		h := test.NewHost(t, ds, fmt.Sprintf("foo.local.%d", i), "1.1.1.1",
+			fmt.Sprintf("%d", i), fmt.Sprintf("%d", i), time.Now())
+		hosts = append(hosts, h)
+		nanoEnroll(t, ds, h, false)
+	}
+
+	uuids, err = ds.GetHostUUIDsWithPendingMDMAppleCommands(ctx)
+	require.NoError(t, err)
+	require.Empty(t, uuids)
+
+	commander, storage := createMDMAppleCommanderAndStorage(t, ds)
+	// insert a command for three hosts
+	uuid1 := uuid.New().String()
+	rawCmd1 := createRawAppleCmd("ListApps", uuid1)
+	err = commander.EnqueueCommand(ctx, []string{hosts[0].UUID, hosts[1].UUID, hosts[2].UUID}, rawCmd1)
+	require.NoError(t, err)
+
+	uuids, err = ds.GetHostUUIDsWithPendingMDMAppleCommands(ctx)
+	require.NoError(t, err)
+	require.ElementsMatch(t, []string{hosts[0].UUID, hosts[1].UUID, hosts[2].UUID}, uuids)
+
+	err = storage.StoreCommandReport(&mdm.Request{
+		EnrollID: &mdm.EnrollID{ID: hosts[0].UUID},
+		Context:  ctx,
+	}, &mdm.CommandResults{
+		CommandUUID: uuid1,
+		Status:      "Acknowledged",
+		RequestType: "ProfileList",
+		Raw:         []byte(rawCmd1),
+	})
+	require.NoError(t, err)
+
+	// only hosts[1] and hosts[2] are returned now
+	uuids, err = ds.GetHostUUIDsWithPendingMDMAppleCommands(ctx)
+	require.NoError(t, err)
+	require.ElementsMatch(t, []string{hosts[1].UUID, hosts[2].UUID}, uuids)
+}
+
 func testHostDetailsMDMProfilesIOSIPadOS(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 
@@ -6059,3 +6304,734 @@ func testHostDetailsMDMProfilesIOSIPadOS(t *testing.T, ds *Datastore) {
 		require.Equal(t, fleet.MDMDeliveryVerified, *gotProfs[0].Status)
 	}
 }
+
+func testMDMAppleBootstrapPackageWithS3(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+	var nfe fleet.NotFoundError
+	var aerr fleet.AlreadyExistsError
+
+	hashContent := func(content string) []byte {
+		h := sha256.New()
+		_, err := h.Write([]byte(content))
+		require.NoError(t, err)
+		return h.Sum(nil)
+	}
+
+	bpMatchesWithoutContent := func(want, got *fleet.MDMAppleBootstrapPackage) {
+		// make local copies so we don't alter the caller's structs
+		w, g := *want, *got
+		w.Bytes, g.Bytes = nil, nil
+		w.CreatedAt, g.CreatedAt = time.Time{}, time.Time{}
+		w.UpdatedAt, g.UpdatedAt = time.Time{}, time.Time{}
+		require.Equal(t, w, g)
+	}
+
+	pkgStore := s3.SetupTestBootstrapPackageStore(t, "mdm-apple-bootstrap-package-test", "")
+
+	err := ds.InsertMDMAppleBootstrapPackage(ctx, &fleet.MDMAppleBootstrapPackage{}, pkgStore)
+	require.Error(t, err)
+
+	// associate bp1 with no team
+	bp1 := &fleet.MDMAppleBootstrapPackage{
+		TeamID: uint(0),
+		Name:   "bp1",
+		Sha256: hashContent("bp1"),
+		Bytes:  []byte("bp1"),
+		Token:  uuid.New().String(),
+	}
+	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp1, pkgStore)
+	require.NoError(t, err)
+
+	// try to store bp1 again, fails as it already exists
+	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp1, pkgStore)
+	require.ErrorAs(t, err, &aerr)
+
+	// associate bp2 with team id 2
+	bp2 := &fleet.MDMAppleBootstrapPackage{
+		TeamID: uint(2),
+		Name:   "bp2",
+		Sha256: hashContent("bp2"),
+		Bytes:  []byte("bp2"),
+		Token:  uuid.New().String(),
+	}
+	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp2, pkgStore)
+	require.NoError(t, err)
+
+	// associate the same content as bp1 with team id 1, via a copy
+	err = ds.CopyDefaultMDMAppleBootstrapPackage(ctx, &fleet.AppConfig{}, 1)
+	require.NoError(t, err)
+
+	// get bp for no team
+	meta, err := ds.GetMDMAppleBootstrapPackageMeta(ctx, 0)
+	require.NoError(t, err)
+	bpMatchesWithoutContent(bp1, meta)
+
+	// get for team 1, token differs due to the copy, rest is the same
+	meta, err = ds.GetMDMAppleBootstrapPackageMeta(ctx, 1)
+	require.NoError(t, err)
+	require.NotEqual(t, bp1.Token, meta.Token)
+	bp1b := *bp1
+	bp1b.Token = meta.Token
+	bp1b.TeamID = 1
+	bpMatchesWithoutContent(&bp1b, meta)
+
+	// get for team 2
+	meta, err = ds.GetMDMAppleBootstrapPackageMeta(ctx, 2)
+	require.NoError(t, err)
+	bpMatchesWithoutContent(bp2, meta)
+
+	// get for team 3, does not exist
+	meta, err = ds.GetMDMAppleBootstrapPackageMeta(ctx, 3)
+	require.ErrorAs(t, err, &nfe)
+	require.Nil(t, meta)
+
+	// get content for no team
+	bpContent, err := ds.GetMDMAppleBootstrapPackageBytes(ctx, bp1.Token, pkgStore)
+	require.NoError(t, err)
+	require.Equal(t, bp1.Bytes, bpContent.Bytes)
+
+	// get content for team 1 (copy of no team)
+	bpContent, err = ds.GetMDMAppleBootstrapPackageBytes(ctx, bp1b.Token, pkgStore)
+	require.NoError(t, err)
+	require.Equal(t, bp1b.Bytes, bpContent.Bytes)
+	require.Equal(t, bp1.Bytes, bpContent.Bytes)
+
+	// get content for team 2
+	bpContent, err = ds.GetMDMAppleBootstrapPackageBytes(ctx, bp2.Token, pkgStore)
+	require.NoError(t, err)
+	require.Equal(t, bp2.Bytes, bpContent.Bytes)
+
+	// get content with invalid token
+	bpContent, err = ds.GetMDMAppleBootstrapPackageBytes(ctx, "no-such-token", pkgStore)
+	require.ErrorAs(t, err, &nfe)
+	require.Nil(t, bpContent)
+
+	// delete bp for no team and team 2
+	err = ds.DeleteMDMAppleBootstrapPackage(ctx, 0)
+	require.NoError(t, err)
+	err = ds.DeleteMDMAppleBootstrapPackage(ctx, 2)
+	require.NoError(t, err)
+
+	// run the cleanup job
+	err = ds.CleanupUnusedBootstrapPackages(ctx, pkgStore, time.Now())
+	require.NoError(t, err)
+
+	// team 1 can still be retrieved (it shares the same contents)
+	bpContent, err = ds.GetMDMAppleBootstrapPackageBytes(ctx, bp1b.Token, pkgStore)
+	require.NoError(t, err)
+	require.Equal(t, bp1b.Bytes, bpContent.Bytes)
+
+	// team 0 and 2 don't exist anymore
+	meta, err = ds.GetMDMAppleBootstrapPackageMeta(ctx, 0)
+	require.ErrorAs(t, err, &nfe)
+	require.Nil(t, meta)
+	meta, err = ds.GetMDMAppleBootstrapPackageMeta(ctx, 2)
+	require.ErrorAs(t, err, &nfe)
+	require.Nil(t, meta)
+
+	ok, err := pkgStore.Exists(ctx, hex.EncodeToString(bp1.Sha256))
+	require.NoError(t, err)
+	require.True(t, ok)
+	ok, err = pkgStore.Exists(ctx, hex.EncodeToString(bp2.Sha256))
+	require.NoError(t, err)
+	require.False(t, ok)
+
+	// delete team 1
+	err = ds.DeleteMDMAppleBootstrapPackage(ctx, 1)
+	require.NoError(t, err)
+
+	// force a team 3 bp to be saved in the DB (simulates upgrading to the new
+	// S3-based storage with already-saved bps in the DB)
+	bp3 := &fleet.MDMAppleBootstrapPackage{
+		TeamID: uint(3),
+		Name:   "bp3",
+		Sha256: hashContent("bp3"),
+		Bytes:  []byte("bp3"),
+		Token:  uuid.New().String(),
+	}
+	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp3, nil) // passing a nil pkgStore to force save in the DB
+	require.NoError(t, err)
+
+	// metadata can be read
+	meta, err = ds.GetMDMAppleBootstrapPackageMeta(ctx, 3)
+	require.NoError(t, err)
+	bpMatchesWithoutContent(bp3, meta)
+
+	// content will be retrieved correctly from the DB even if we pass a pkgStore
+	bpContent, err = ds.GetMDMAppleBootstrapPackageBytes(ctx, bp3.Token, pkgStore)
+	require.NoError(t, err)
+	require.Equal(t, bp3.Bytes, bpContent.Bytes)
+
+	// run the cleanup job
+	err = ds.CleanupUnusedBootstrapPackages(ctx, pkgStore, time.Now())
+	require.NoError(t, err)
+
+	ok, err = pkgStore.Exists(ctx, hex.EncodeToString(bp1.Sha256))
+	require.NoError(t, err)
+	require.False(t, ok)
+	ok, err = pkgStore.Exists(ctx, hex.EncodeToString(bp2.Sha256))
+	require.NoError(t, err)
+	require.False(t, ok)
+	// bp3 does not exist in the S3 store
+	ok, err = pkgStore.Exists(ctx, hex.EncodeToString(bp3.Sha256))
+	require.NoError(t, err)
+	require.False(t, ok)
+
+	// so it can still be retrieved from the DB
+	bpContent, err = ds.GetMDMAppleBootstrapPackageBytes(ctx, bp3.Token, pkgStore)
+	require.NoError(t, err)
+	require.Equal(t, bp3.Bytes, bpContent.Bytes)
+
+	// it can be deleted without problem
+	err = ds.DeleteMDMAppleBootstrapPackage(ctx, 3)
+	require.NoError(t, err)
+
+	bpContent, err = ds.GetMDMAppleBootstrapPackageBytes(ctx, bp3.Token, pkgStore)
+	require.ErrorAs(t, err, &nfe)
+	require.Nil(t, bpContent)
+}
+
+func testMDMAppleGetAndUpdateABMToken(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	// get a non-existing token
+	tok, err := ds.GetABMTokenByOrgName(ctx, "no-such-token")
+	var nfe fleet.NotFoundError
+	require.ErrorAs(t, err, &nfe)
+	require.Nil(t, tok)
+
+	// create some teams
+	tm1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+	tm2, err := ds.NewTeam(ctx, &fleet.Team{Name: "team2"})
+	require.NoError(t, err)
+	tm3, err := ds.NewTeam(ctx, &fleet.Team{Name: "team3"})
+	require.NoError(t, err)
+
+	// create a token with an empty name and no team set, and another that will be unused
+	encTok := uuid.NewString()
+
+	t1, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, t1.ID)
+	t2, err := ds.InsertABMToken(ctx, &fleet.ABMToken{EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, t2.ID)
+
+	toks, err := ds.ListABMTokens(ctx)
+	require.NoError(t, err)
+	require.Len(t, toks, 2)
+
+	// get that token
+	tok, err = ds.GetABMTokenByOrgName(ctx, "")
+	require.NoError(t, err)
+	require.NotZero(t, tok.ID)
+	require.Equal(t, encTok, string(tok.EncryptedToken))
+	require.Empty(t, tok.OrganizationName)
+	require.Empty(t, tok.AppleID)
+	require.Equal(t, fleet.TeamNameNoTeam, tok.MacOSTeamName)
+	require.Equal(t, fleet.TeamNameNoTeam, tok.IOSTeamName)
+	require.Equal(t, fleet.TeamNameNoTeam, tok.IPadOSTeamName)
+
+	// update the token with a name and teams
+	tok.OrganizationName = "org-name"
+	tok.AppleID = "name@example.com"
+	tok.MacOSDefaultTeamID = &tm1.ID
+	tok.IOSDefaultTeamID = &tm2.ID
+	err = ds.SaveABMToken(ctx, tok)
+	require.NoError(t, err)
+
+	// reload that token
+	tokReload, err := ds.GetABMTokenByOrgName(ctx, "org-name")
+	require.NoError(t, err)
+	require.Equal(t, tok.ID, tokReload.ID)
+	require.Equal(t, encTok, string(tokReload.EncryptedToken))
+	require.Equal(t, "org-name", tokReload.OrganizationName)
+	require.Equal(t, "name@example.com", tokReload.AppleID)
+	require.Equal(t, tm1.Name, tokReload.MacOSTeamName)
+	require.Equal(t, tm1.Name, tokReload.MacOSTeam.Name)
+	require.Equal(t, tm1.ID, tokReload.MacOSTeam.ID)
+	require.Equal(t, tm2.Name, tokReload.IOSTeamName)
+	require.Equal(t, tm2.Name, tokReload.IOSTeam.Name)
+	require.Equal(t, tm2.ID, tokReload.IOSTeam.ID)
+	require.Equal(t, fleet.TeamNameNoTeam, tokReload.IPadOSTeamName)
+	require.Equal(t, fleet.TeamNameNoTeam, tokReload.IPadOSTeam.Name)
+	require.Equal(t, uint(0), tokReload.IPadOSTeam.ID)
+
+	// empty name token now doesn't exist
+	_, err = ds.GetABMTokenByOrgName(ctx, "")
+	require.ErrorAs(t, err, &nfe)
+
+	// update some teams
+	tok.MacOSDefaultTeamID = nil
+	tok.IPadOSDefaultTeamID = &tm3.ID
+	err = ds.SaveABMToken(ctx, tok)
+	require.NoError(t, err)
+
+	// reload that token
+	tokReload, err = ds.GetABMTokenByOrgName(ctx, "org-name")
+	require.NoError(t, err)
+	require.Equal(t, tok.ID, tokReload.ID)
+	require.Equal(t, encTok, string(tokReload.EncryptedToken))
+	require.Equal(t, "org-name", tokReload.OrganizationName)
+	require.Equal(t, "name@example.com", tokReload.AppleID)
+	require.Equal(t, fleet.TeamNameNoTeam, tokReload.MacOSTeamName)
+	require.Equal(t, fleet.TeamNameNoTeam, tokReload.MacOSTeam.Name)
+	require.Equal(t, uint(0), tokReload.MacOSTeam.ID)
+	require.Equal(t, tm2.Name, tokReload.IOSTeamName)
+	require.Equal(t, tm3.Name, tokReload.IPadOSTeamName)
+
+	// change just the encrypted token
+	encTok2 := uuid.NewString()
+	tok.EncryptedToken = []byte(encTok2)
+	err = ds.SaveABMToken(ctx, tok)
+	require.NoError(t, err)
+
+	tokReload, err = ds.GetABMTokenByOrgName(ctx, "org-name")
+	require.NoError(t, err)
+	require.Equal(t, tok.ID, tokReload.ID)
+	require.Equal(t, encTok2, string(tokReload.EncryptedToken))
+	require.Equal(t, "org-name", tokReload.OrganizationName)
+	require.Equal(t, "name@example.com", tokReload.AppleID)
+	require.Equal(t, fleet.TeamNameNoTeam, tokReload.MacOSTeamName)
+	require.Equal(t, fleet.TeamNameNoTeam, tokReload.MacOSTeam.Name)
+	require.Equal(t, uint(0), tokReload.MacOSTeam.ID)
+	require.Equal(t, tm2.Name, tokReload.IOSTeamName)
+	require.Equal(t, tm2.Name, tokReload.IOSTeam.Name)
+	require.Equal(t, tm2.ID, tokReload.IOSTeam.ID)
+	require.Equal(t, tm3.Name, tokReload.IPadOSTeamName)
+	require.Equal(t, tm3.Name, tokReload.IPadOSTeam.Name)
+	require.Equal(t, tm3.ID, tokReload.IPadOSTeam.ID)
+
+	// Remove unused token
+	require.NoError(t, ds.DeleteABMToken(ctx, t1.ID))
+
+	toks, err = ds.ListABMTokens(ctx)
+	require.NoError(t, err)
+	require.Len(t, toks, 1)
+	expTok := toks[0]
+	require.Equal(t, "org-name", expTok.OrganizationName)
+	require.Equal(t, "name@example.com", expTok.AppleID)
+	require.Equal(t, fleet.TeamNameNoTeam, expTok.MacOSTeamName)
+	require.Equal(t, fleet.TeamNameNoTeam, expTok.MacOSTeam.Name)
+	require.Equal(t, uint(0), expTok.MacOSTeam.ID)
+	require.Equal(t, tm2.Name, expTok.IOSTeamName)
+	require.Equal(t, tm3.Name, expTok.IPadOSTeamName)
+}
+
+func testMDMAppleABMTokensTermsExpired(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	// count works with no token
+	count, err := ds.CountABMTokensWithTermsExpired(ctx)
+	require.NoError(t, err)
+	require.Zero(t, count)
+
+	// create a few tokens
+	encTok1 := uuid.NewString()
+	t1, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "abm1", EncryptedToken: []byte(encTok1)})
+	require.NoError(t, err)
+	require.NotEmpty(t, t1.ID)
+	encTok2 := uuid.NewString()
+	t2, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "abm2", EncryptedToken: []byte(encTok2)})
+	require.NoError(t, err)
+	require.NotEmpty(t, t2.ID)
+	// this one simulates a mirated token - empty name
+	encTok3 := uuid.NewString()
+	t3, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "", EncryptedToken: []byte(encTok3)})
+	require.NoError(t, err)
+	require.NotEmpty(t, t3.ID)
+
+	// none have terms expired yet
+	count, err = ds.CountABMTokensWithTermsExpired(ctx)
+	require.NoError(t, err)
+	require.Zero(t, count)
+
+	// set t1 terms expired
+	was, err := ds.SetABMTokenTermsExpiredForOrgName(ctx, t1.OrganizationName, true)
+	require.NoError(t, err)
+	require.False(t, was)
+
+	// set t2 terms not expired, no-op
+	was, err = ds.SetABMTokenTermsExpiredForOrgName(ctx, t2.OrganizationName, false)
+	require.NoError(t, err)
+	require.False(t, was)
+
+	// set t3 terms expired
+	was, err = ds.SetABMTokenTermsExpiredForOrgName(ctx, t3.OrganizationName, true)
+	require.NoError(t, err)
+	require.False(t, was)
+
+	// count is now 2
+	count, err = ds.CountABMTokensWithTermsExpired(ctx)
+	require.NoError(t, err)
+	require.EqualValues(t, 2, count)
+
+	// set t1 terms not expired
+	was, err = ds.SetABMTokenTermsExpiredForOrgName(ctx, t1.OrganizationName, false)
+	require.NoError(t, err)
+	require.True(t, was)
+
+	// set t3 terms still expired
+	was, err = ds.SetABMTokenTermsExpiredForOrgName(ctx, t3.OrganizationName, true)
+	require.NoError(t, err)
+	require.True(t, was)
+
+	// count is now 1
+	count, err = ds.CountABMTokensWithTermsExpired(ctx)
+	require.NoError(t, err)
+	require.EqualValues(t, 1, count)
+
+	// setting the expired flag of a non-existing token always returns as if it
+	// did not update (which is fine, it will only be called after a DEP API call
+	// that used this token, so if the token does not exist it would fail the
+	// call).
+	was, err = ds.SetABMTokenTermsExpiredForOrgName(ctx, "no-such-token", false)
+	require.NoError(t, err)
+	require.False(t, was)
+	was, err = ds.SetABMTokenTermsExpiredForOrgName(ctx, "no-such-token", true)
+	require.NoError(t, err)
+	require.True(t, was)
+
+	// count is unaffected
+	count, err = ds.CountABMTokensWithTermsExpired(ctx)
+	require.NoError(t, err)
+	require.EqualValues(t, 1, count)
+}
+
+func testMDMGetABMTokenOrgNamesAssociatedWithTeam(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	// Create some teams
+	tm1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+
+	tm2, err := ds.NewTeam(ctx, &fleet.Team{Name: "team2"})
+	require.NoError(t, err)
+
+	encTok := uuid.NewString()
+
+	tok1, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "org1", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, tok1.ID)
+
+	tok2, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "org2", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, tok1.ID)
+
+	tok3, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "org3", EncryptedToken: []byte(encTok), MacOSDefaultTeamID: &tm2.ID})
+	require.NoError(t, err)
+	require.NotEmpty(t, tok1.ID)
+
+	// Create some hosts and add to teams (and one for no team)
+	h1, err := ds.NewHost(ctx, &fleet.Host{
+		Hostname:      "test-host1-name",
+		OsqueryHostID: ptr.String("1"),
+		NodeKey:       ptr.String("1"),
+		UUID:          "test-uuid-1",
+		TeamID:        &tm1.ID,
+		Platform:      "darwin",
+	})
+	require.NoError(t, err)
+
+	h2, err := ds.NewHost(ctx, &fleet.Host{
+		Hostname:      "test-host2-name",
+		OsqueryHostID: ptr.String("2"),
+		NodeKey:       ptr.String("2"),
+		UUID:          "test-uuid-2",
+		TeamID:        &tm1.ID,
+		Platform:      "darwin",
+	})
+	require.NoError(t, err)
+
+	h3, err := ds.NewHost(ctx, &fleet.Host{
+		Hostname:      "test-host3-name",
+		OsqueryHostID: ptr.String("3"),
+		NodeKey:       ptr.String("3"),
+		UUID:          "test-uuid-3",
+		TeamID:        nil,
+		Platform:      "darwin",
+	})
+	require.NoError(t, err)
+
+	h4, err := ds.NewHost(ctx, &fleet.Host{
+		Hostname:      "test-host4-name",
+		OsqueryHostID: ptr.String("4"),
+		NodeKey:       ptr.String("4"),
+		UUID:          "test-uuid-4",
+		TeamID:        &tm1.ID,
+		Platform:      "darwin",
+	})
+	require.NoError(t, err)
+
+	// Insert host DEP assignment
+	require.NoError(t, ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h1, *h4}, tok1.ID))
+	require.NoError(t, ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h2}, tok3.ID))
+	require.NoError(t, ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h3}, tok2.ID))
+
+	// Should return the 2 unique org names [org1, org3]
+	orgNames, err := ds.GetABMTokenOrgNamesAssociatedWithTeam(ctx, &tm1.ID)
+	require.NoError(t, err)
+	sort.Strings(orgNames)
+	require.Len(t, orgNames, 2)
+	require.Equal(t, orgNames[0], "org1")
+	require.Equal(t, orgNames[1], "org3")
+
+	// all tokens default to no team in one way or another
+	orgNames, err = ds.GetABMTokenOrgNamesAssociatedWithTeam(ctx, nil)
+	require.NoError(t, err)
+	sort.Strings(orgNames)
+	require.Len(t, orgNames, 3)
+	require.Equal(t, orgNames[0], "org1")
+	require.Equal(t, orgNames[1], "org2")
+	require.Equal(t, orgNames[2], "org3")
+
+	// No orgs for this team except org3 which uses it as a default team
+	orgNames, err = ds.GetABMTokenOrgNamesAssociatedWithTeam(ctx, &tm2.ID)
+	require.NoError(t, err)
+	sort.Strings(orgNames)
+	require.Len(t, orgNames, 1)
+	require.Equal(t, orgNames[0], "org3")
+}
+func testHostMDMCommands(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	addHostMDMCommandsBatchSizeOrig := addHostMDMCommandsBatchSize
+	addHostMDMCommandsBatchSize = 2
+	t.Cleanup(func() {
+		addHostMDMCommandsBatchSize = addHostMDMCommandsBatchSizeOrig
+	})
+
+	// create a host
+	h, err := ds.NewHost(ctx, &fleet.Host{
+		DetailUpdatedAt: time.Now(),
+		LabelUpdatedAt:  time.Now(),
+		PolicyUpdatedAt: time.Now(),
+		SeenTime:        time.Now(),
+		OsqueryHostID:   ptr.String("host0-osquery-id"),
+		NodeKey:         ptr.String("host0-node-key"),
+		UUID:            "host0-test-mdm-profiles",
+		Hostname:        "hostname0",
+	})
+	require.NoError(t, err)
+
+	hostCommands := []fleet.HostMDMCommand{
+		{
+			HostID:      h.ID,
+			CommandType: "command-1",
+		},
+		{
+			HostID:      h.ID,
+			CommandType: "command-2",
+		},
+		{
+			HostID:      h.ID,
+			CommandType: "command-3",
+		},
+	}
+
+	badHostID := h.ID + 1
+	allCommands := append(hostCommands, fleet.HostMDMCommand{
+		HostID:      badHostID,
+		CommandType: "command-1",
+	})
+	err = ds.AddHostMDMCommands(ctx, allCommands)
+	require.NoError(t, err)
+
+	commands, err := ds.GetHostMDMCommands(ctx, h.ID)
+	require.NoError(t, err)
+	assert.ElementsMatch(t, hostCommands, commands)
+
+	// Remove a command
+	require.NoError(t, ds.RemoveHostMDMCommand(ctx, hostCommands[0]))
+
+	commands, err = ds.GetHostMDMCommands(ctx, h.ID)
+	require.NoError(t, err)
+	assert.ElementsMatch(t, hostCommands[1:], commands)
+
+	// Clean up commands, and make sure badHost commands have been removed, but others remain.
+	commands, err = ds.GetHostMDMCommands(ctx, badHostID)
+	require.NoError(t, err)
+	assert.Len(t, commands, 1)
+
+	require.NoError(t, ds.CleanupHostMDMCommands(ctx))
+	commands, err = ds.GetHostMDMCommands(ctx, badHostID)
+	require.NoError(t, err)
+	assert.Empty(t, commands)
+
+	commands, err = ds.GetHostMDMCommands(ctx, h.ID)
+	require.NoError(t, err)
+	assert.ElementsMatch(t, hostCommands[1:], commands)
+}
+
+func TestGetMDMAppleOSUpdatesSettingsByHostSerial(t *testing.T) {
+	ds := CreateMySQLDS(t)
+	defer ds.Close()
+
+	keys := []string{"ios", "ipados", "macos"}
+	devicesByKey := map[string]godep.Device{
+		"ios":    {SerialNumber: "dep-serial-ios-updates", DeviceFamily: "iPhone"},
+		"ipados": {SerialNumber: "dep-serial-ipados-updates", DeviceFamily: "iPad"},
+		"macos":  {SerialNumber: "dep-serial-macos-updates", DeviceFamily: "Mac"},
+	}
+
+	getConfigSettings := func(teamID uint, key string) *fleet.AppleOSUpdateSettings {
+		var settings fleet.AppleOSUpdateSettings
+		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+			stmt := fmt.Sprintf(`SELECT json_value->'$.mdm.%s_updates' FROM app_config_json`, key)
+			if teamID > 0 {
+				stmt = fmt.Sprintf(`SELECT config->'$.mdm.%s_updates' FROM teams WHERE id = %d`, key, teamID)
+			}
+			var raw json.RawMessage
+			if err := sqlx.GetContext(context.Background(), q, &raw, stmt); err != nil {
+				return err
+			}
+			if err := json.Unmarshal(raw, &settings); err != nil {
+				return err
+			}
+			return nil
+		})
+		return &settings
+	}
+
+	setConfigSettings := func(teamID uint, key string, minVersion string) {
+		var mv *string
+		if minVersion != "" {
+			mv = &minVersion
+		}
+		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+			stmt := fmt.Sprintf(`UPDATE app_config_json SET json_value = JSON_SET(json_value, '$.mdm.%s_updates.minimum_version', ?)`, key)
+			if teamID > 0 {
+				stmt = fmt.Sprintf(`UPDATE teams SET config = JSON_SET(config, '$.mdm.%s_updates.minimum_version', ?) WHERE id = %d`, key, teamID)
+			}
+			if _, err := q.ExecContext(context.Background(), stmt, mv); err != nil {
+				return err
+			}
+			return nil
+		})
+	}
+
+	checkExpectedVersion := func(t *testing.T, gotSettings *fleet.AppleOSUpdateSettings, expectedVersion string) {
+		if expectedVersion == "" {
+			require.True(t, gotSettings.MinimumVersion.Set)
+			require.False(t, gotSettings.MinimumVersion.Valid)
+			require.Empty(t, gotSettings.MinimumVersion.Value)
+		} else {
+			require.True(t, gotSettings.MinimumVersion.Set)
+			require.True(t, gotSettings.MinimumVersion.Valid)
+			require.Equal(t, expectedVersion, gotSettings.MinimumVersion.Value)
+		}
+	}
+
+	checkDevice := func(t *testing.T, teamID uint, key string, wantVersion string) {
+		checkExpectedVersion(t, getConfigSettings(teamID, key), wantVersion)
+		gotSettings, err := ds.GetMDMAppleOSUpdatesSettingsByHostSerial(context.Background(), devicesByKey[key].SerialNumber)
+		require.NoError(t, err)
+		checkExpectedVersion(t, gotSettings, wantVersion)
+	}
+
+	// empty global settings to start
+	for _, key := range keys {
+		checkExpectedVersion(t, getConfigSettings(0, key), "")
+	}
+
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(context.Background(), &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
+	// ingest some test devices
+	n, err := ds.IngestMDMAppleDevicesFromDEPSync(context.Background(), []godep.Device{devicesByKey["ios"], devicesByKey["ipados"], devicesByKey["macos"]}, abmToken.ID, nil, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, int64(3), n)
+	hostIDsByKey := map[string]uint{}
+	for key, device := range devicesByKey {
+		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+			var hid uint
+			err = sqlx.GetContext(context.Background(), q, &hid, "SELECT id FROM hosts WHERE hardware_serial = ?", device.SerialNumber)
+			require.NoError(t, err)
+			hostIDsByKey[key] = hid
+			return nil
+		})
+	}
+
+	// not set in global config, so devics should return empty
+	checkDevice(t, 0, "ios", "")
+	checkDevice(t, 0, "ipados", "")
+	checkDevice(t, 0, "macos", "")
+
+	// set the minimum version for ios
+	setConfigSettings(0, "ios", "17.1")
+	checkDevice(t, 0, "ios", "17.1")
+	checkDevice(t, 0, "ipados", "") // no change
+	checkDevice(t, 0, "macos", "")  // no change
+
+	// set the minimum version for ipados
+	setConfigSettings(0, "ipados", "17.2")
+	checkDevice(t, 0, "ios", "17.1") // no change
+	checkDevice(t, 0, "ipados", "17.2")
+	checkDevice(t, 0, "macos", "") // no change
+
+	// set the minimum version for macos
+	setConfigSettings(0, "macos", "14.5")
+	checkDevice(t, 0, "ios", "17.1")    // no change
+	checkDevice(t, 0, "ipados", "17.2") // no change
+	checkDevice(t, 0, "macos", "14.5")
+
+	// create a team
+	team, err := ds.NewTeam(context.Background(), &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+
+	// empty team settings to start
+	for _, key := range keys {
+		checkExpectedVersion(t, getConfigSettings(team.ID, key), "")
+	}
+
+	// transfer ios and ipados to the team
+	err = ds.AddHostsToTeam(context.Background(), &team.ID, []uint{hostIDsByKey["ios"], hostIDsByKey["ipados"]})
+	require.NoError(t, err)
+
+	checkDevice(t, team.ID, "ios", "")    // team settings are empty to start
+	checkDevice(t, team.ID, "ipados", "") // team settings are empty to start
+	checkDevice(t, 0, "macos", "14.5")    // no change, still global
+
+	setConfigSettings(team.ID, "ios", "17.3")
+	checkDevice(t, team.ID, "ios", "17.3") // team settings are set for ios
+	checkDevice(t, team.ID, "ipados", "")  // team settings are empty for ipados
+	checkDevice(t, 0, "macos", "14.5")     // no change, still global
+
+	setConfigSettings(team.ID, "ipados", "17.4")
+	checkDevice(t, team.ID, "ios", "17.3")    // no change in team settings for ios
+	checkDevice(t, team.ID, "ipados", "17.4") // team settings are set for ipados
+	checkDevice(t, 0, "macos", "14.5")        // no change, still global
+
+	// transfer macos to the team
+	err = ds.AddHostsToTeam(context.Background(), &team.ID, []uint{hostIDsByKey["macos"]})
+	require.NoError(t, err)
+	checkDevice(t, team.ID, "macos", "") // team settings are empty for macos
+
+	setConfigSettings(team.ID, "macos", "14.6")
+	checkDevice(t, team.ID, "macos", "14.6") // team settings are set for macos
+
+	// create a non-DEP host
+	_, err = ds.NewHost(context.Background(), &fleet.Host{
+		OsqueryHostID:  ptr.String("non-dep-osquery-id"),
+		NodeKey:        ptr.String("non-dep-node-key"),
+		UUID:           "non-dep-uuid",
+		Hostname:       "non-dep-hostname",
+		Platform:       "macos",
+		HardwareSerial: "non-dep-serial",
+	})
+
+	// non-DEP host should return not found
+	_, err = ds.GetMDMAppleOSUpdatesSettingsByHostSerial(context.Background(), "non-dep-serial")
+	require.ErrorIs(t, err, sql.ErrNoRows)
+
+	// deleted DEP host should return not found
+	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(context.Background(), "UPDATE host_dep_assignments SET deleted_at = NOW() WHERE host_id = ?", hostIDsByKey["macos"])
+		return err
+	})
+	_, err = ds.GetMDMAppleOSUpdatesSettingsByHostSerial(context.Background(), devicesByKey["macos"].SerialNumber)
+	require.ErrorIs(t, err, sql.ErrNoRows)
+}
diff --git a/server/datastore/mysql/calendar_events.go b/server/datastore/mysql/calendar_events.go
index fa58b8f3af9a..21004cf83a08 100644
--- a/server/datastore/mysql/calendar_events.go
+++ b/server/datastore/mysql/calendar_events.go
@@ -7,27 +7,35 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/google/uuid"
+
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/jmoiron/sqlx"
 )
 
+const calendarEventCols = `ce.id, ce.uuid, ce.email, ce.start_time, ce.end_time, ce.event, ce.timezone, ce.created_at, ce.updated_at`
+
 func (ds *Datastore) CreateOrUpdateCalendarEvent(
 	ctx context.Context,
-	uuid string,
+	uuidStr string,
 	email string,
 	startTime time.Time,
 	endTime time.Time,
 	data []byte,
-	timeZone string,
+	timeZone *string,
 	hostID uint,
 	webhookStatus fleet.CalendarWebhookStatus,
 ) (*fleet.CalendarEvent, error) {
+	UUID, err := uuid.Parse(uuidStr)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "invalid uuid")
+	}
 	var id int64
 	if err := ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
 		const calendarEventsQuery = `
 			INSERT INTO calendar_events (
-				uuid,
+				uuid_bin,
 				email,
 				start_time,
 				end_time,
@@ -35,7 +43,7 @@ func (ds *Datastore) CreateOrUpdateCalendarEvent(
 				timezone
 			) VALUES (?, ?, ?, ?, ?, ?)
 			ON DUPLICATE KEY UPDATE
-				uuid = VALUES(uuid),
+				uuid_bin = VALUES(uuid_bin),
 				start_time = VALUES(start_time),
 				end_time = VALUES(end_time),
 				event = VALUES(event),
@@ -45,7 +53,7 @@ func (ds *Datastore) CreateOrUpdateCalendarEvent(
 		result, err := tx.ExecContext(
 			ctx,
 			calendarEventsQuery,
-			uuid,
+			UUID[:],
 			email,
 			startTime,
 			endTime,
@@ -56,7 +64,7 @@ func (ds *Datastore) CreateOrUpdateCalendarEvent(
 			return ctxerr.Wrap(ctx, err, "insert calendar event")
 		}
 
-		if insertOnDuplicateDidInsert(result) {
+		if insertOnDuplicateDidInsertOrUpdate(result) {
 			id, _ = result.LastInsertId()
 		} else {
 			stmt := `SELECT id FROM calendar_events WHERE email = ?`
@@ -98,9 +106,7 @@ func (ds *Datastore) CreateOrUpdateCalendarEvent(
 }
 
 func getCalendarEventByID(ctx context.Context, q sqlx.QueryerContext, id uint) (*fleet.CalendarEvent, error) {
-	const calendarEventsQuery = `
-		SELECT * FROM calendar_events WHERE id = ?;
-	`
+	const calendarEventsQuery = "SELECT " + calendarEventCols + " FROM calendar_events ce WHERE id = ?"
 	var calendarEvent fleet.CalendarEvent
 	err := sqlx.GetContext(ctx, q, &calendarEvent, calendarEventsQuery, id)
 	if err != nil {
@@ -113,9 +119,7 @@ func getCalendarEventByID(ctx context.Context, q sqlx.QueryerContext, id uint) (
 }
 
 func (ds *Datastore) GetCalendarEvent(ctx context.Context, email string) (*fleet.CalendarEvent, error) {
-	const calendarEventsQuery = `
-		SELECT * FROM calendar_events WHERE email = ?;
-	`
+	const calendarEventsQuery = "SELECT " + calendarEventCols + " FROM calendar_events ce WHERE email = ?"
 	var calendarEvent fleet.CalendarEvent
 	err := sqlx.GetContext(ctx, ds.reader(ctx), &calendarEvent, calendarEventsQuery, email)
 	if err != nil {
@@ -127,29 +131,37 @@ func (ds *Datastore) GetCalendarEvent(ctx context.Context, email string) (*fleet
 	return &calendarEvent, nil
 }
 
-func (ds *Datastore) GetCalendarEventDetailsByUUID(ctx context.Context, uuid string) (*fleet.CalendarEventDetails, error) {
+func (ds *Datastore) GetCalendarEventDetailsByUUID(ctx context.Context, uuidStr string) (*fleet.CalendarEventDetails, error) {
+	UUID, err := uuid.Parse(uuidStr)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "invalid uuid")
+	}
 	const calendarEventsByUUIDQuery = `
-		SELECT ce.*, h.team_id as team_id, h.id as host_id FROM calendar_events ce
+		SELECT ` + calendarEventCols + `, h.team_id as team_id, h.id as host_id FROM calendar_events ce
 		LEFT JOIN host_calendar_events hce ON hce.calendar_event_id = ce.id
 		LEFT JOIN hosts h ON h.id = hce.host_id
-		WHERE ce.uuid = ?;
+		WHERE ce.uuid_bin = ?;
 	`
 	var calendarEvent fleet.CalendarEventDetails
-	err := sqlx.GetContext(ctx, ds.reader(ctx), &calendarEvent, calendarEventsByUUIDQuery, uuid)
+	err = sqlx.GetContext(ctx, ds.reader(ctx), &calendarEvent, calendarEventsByUUIDQuery, UUID[:])
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
-			return nil, ctxerr.Wrap(ctx, notFound("CalendarEvent").WithMessage(fmt.Sprintf("uuid: %s", uuid)))
+			return nil, ctxerr.Wrap(ctx, notFound("CalendarEvent").WithMessage(fmt.Sprintf("uuid: %s", UUID.String())))
 		}
 		return nil, ctxerr.Wrap(ctx, err, "get calendar event")
 	}
 	return &calendarEvent, nil
 }
 
-func (ds *Datastore) UpdateCalendarEvent(ctx context.Context, calendarEventID uint, uuid string, startTime time.Time, endTime time.Time,
-	data []byte, timeZone string) error {
+func (ds *Datastore) UpdateCalendarEvent(ctx context.Context, calendarEventID uint, uuidStr string, startTime time.Time, endTime time.Time,
+	data []byte, timeZone *string) error {
+	UUID, err := uuid.Parse(uuidStr)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "invalid uuid")
+	}
 	const calendarEventsQuery = `
 		UPDATE calendar_events SET
-			uuid = ?,
+			uuid_bin = ?,
 			start_time = ?,
 			end_time = ?,
 			event = ?,
@@ -157,7 +169,7 @@ func (ds *Datastore) UpdateCalendarEvent(ctx context.Context, calendarEventID ui
 			updated_at = CURRENT_TIMESTAMP
 		WHERE id = ?;
 	`
-	if _, err := ds.writer(ctx).ExecContext(ctx, calendarEventsQuery, uuid, startTime, endTime, data, timeZone,
+	if _, err := ds.writer(ctx).ExecContext(ctx, calendarEventsQuery, UUID[:], startTime, endTime, data, timeZone,
 		calendarEventID); err != nil {
 		return ctxerr.Wrap(ctx, err, "update calendar event")
 	}
@@ -186,7 +198,7 @@ func (ds *Datastore) GetHostCalendarEvent(ctx context.Context, hostID uint) (*fl
 		return nil, nil, ctxerr.Wrap(ctx, err, "get host calendar event")
 	}
 	const calendarEventsQuery = `
-		SELECT * FROM calendar_events WHERE id = ?
+		SELECT ` + calendarEventCols + ` FROM calendar_events ce WHERE id = ?
 	`
 	var calendarEvent fleet.CalendarEvent
 	if err := sqlx.GetContext(ctx, ds.reader(ctx), &calendarEvent, calendarEventsQuery, hostCalendarEvent.CalendarEventID); err != nil {
@@ -200,7 +212,7 @@ func (ds *Datastore) GetHostCalendarEvent(ctx context.Context, hostID uint) (*fl
 
 func (ds *Datastore) GetHostCalendarEventByEmail(ctx context.Context, email string) (*fleet.HostCalendarEvent, *fleet.CalendarEvent, error) {
 	const calendarEventsQuery = `
-		SELECT * FROM calendar_events WHERE email = ?
+		SELECT ` + calendarEventCols + ` FROM calendar_events ce WHERE email = ?
 	`
 	var calendarEvent fleet.CalendarEvent
 	if err := sqlx.GetContext(ctx, ds.reader(ctx), &calendarEvent, calendarEventsQuery, email); err != nil {
@@ -236,7 +248,7 @@ func (ds *Datastore) UpdateHostCalendarWebhookStatus(ctx context.Context, hostID
 
 func (ds *Datastore) ListCalendarEvents(ctx context.Context, teamID *uint) ([]*fleet.CalendarEvent, error) {
 	calendarEventsQuery := `
-		SELECT ce.* FROM calendar_events ce
+		SELECT ` + calendarEventCols + ` FROM calendar_events ce
 	`
 
 	var args []interface{}
@@ -258,7 +270,7 @@ func (ds *Datastore) ListCalendarEvents(ctx context.Context, teamID *uint) ([]*f
 
 func (ds *Datastore) ListOutOfDateCalendarEvents(ctx context.Context, t time.Time) ([]*fleet.CalendarEvent, error) {
 	calendarEventsQuery := `
-		SELECT ce.* FROM calendar_events ce WHERE updated_at < ?
+		SELECT ` + calendarEventCols + ` FROM calendar_events ce WHERE updated_at < ?
 	`
 	var calendarEvents []*fleet.CalendarEvent
 	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &calendarEvents, calendarEventsQuery, t); err != nil {
diff --git a/server/datastore/mysql/calendar_events_test.go b/server/datastore/mysql/calendar_events_test.go
index b4ec9d510a74..3003692a98f9 100644
--- a/server/datastore/mysql/calendar_events_test.go
+++ b/server/datastore/mysql/calendar_events_test.go
@@ -2,11 +2,13 @@ package mysql
 
 import (
 	"context"
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/assert"
+	"strings"
 	"testing"
 	"time"
 
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/stretchr/testify/require"
@@ -59,14 +61,14 @@ func testUpdateCalendarEvent(t *testing.T, ds *Datastore) {
 	endTime1 := startTime1.Add(30 * time.Minute)
 	timeZone := "America/Argentina/Buenos_Aires"
 	eventUUID := uuid.New().String()
-	calendarEvent, err := ds.CreateOrUpdateCalendarEvent(ctx, eventUUID, "foo@example.com", startTime1, endTime1, []byte(`{}`), timeZone,
+	calendarEvent, err := ds.CreateOrUpdateCalendarEvent(ctx, eventUUID, "foo@example.com", startTime1, endTime1, []byte(`{}`), &timeZone,
 		host.ID, fleet.CalendarWebhookStatusNone)
 	require.NoError(t, err)
 
 	time.Sleep(1 * time.Second)
 
 	eventUUIDNew := uuid.New().String()
-	err = ds.UpdateCalendarEvent(ctx, calendarEvent.ID, eventUUIDNew, startTime1, endTime1, []byte(`{}`), timeZone)
+	err = ds.UpdateCalendarEvent(ctx, calendarEvent.ID, eventUUIDNew, startTime1, endTime1, []byte(`{}`), &timeZone)
 	require.NoError(t, err)
 
 	calendarEvent2, err := ds.GetCalendarEvent(ctx, "foo@example.com")
@@ -79,7 +81,7 @@ func testUpdateCalendarEvent(t *testing.T, ds *Datastore) {
 
 	eventDetails, err := ds.GetCalendarEventDetailsByUUID(ctx, eventUUIDNew)
 	require.NoError(t, err)
-	assert.Equal(t, eventUUIDNew, eventDetails.UUID)
+	assert.Equal(t, strings.ToUpper(eventUUIDNew), eventDetails.UUID)
 	assert.Equal(t, *calendarEvent, eventDetails.CalendarEvent)
 	assert.Equal(t, host.ID, eventDetails.HostID)
 	assert.Nil(t, eventDetails.TeamID)
@@ -116,15 +118,15 @@ func testCreateOrUpdateCalendarEvent(t *testing.T, ds *Datastore) {
 	startTime1 := time.Now()
 	endTime1 := startTime1.Add(30 * time.Minute)
 	eventUUID := uuid.New().String()
-	calendarEvent, err := ds.CreateOrUpdateCalendarEvent(ctx, eventUUID, "foo@example.com", startTime1, endTime1, []byte(`{}`), timeZone,
+	calendarEvent, err := ds.CreateOrUpdateCalendarEvent(ctx, eventUUID, "foo@example.com", startTime1, endTime1, []byte(`{}`), &timeZone,
 		host.ID, fleet.CalendarWebhookStatusNone)
 	require.NoError(t, err)
-	require.Equal(t, calendarEvent.TimeZone, timeZone)
+	require.Equal(t, *calendarEvent.TimeZone, timeZone)
 
 	time.Sleep(1 * time.Second)
 
 	eventUUID2 := uuid.New().String()
-	calendarEvent2, err := ds.CreateOrUpdateCalendarEvent(ctx, eventUUID2, "foo@example.com", startTime1, endTime1, []byte(`{}`), timeZone,
+	calendarEvent2, err := ds.CreateOrUpdateCalendarEvent(ctx, eventUUID2, "foo@example.com", startTime1, endTime1, []byte(`{}`), &timeZone,
 		host.ID, fleet.CalendarWebhookStatusNone)
 	require.NoError(t, err)
 	require.Greater(t, calendarEvent2.UpdatedAt, calendarEvent.UpdatedAt)
@@ -138,7 +140,7 @@ func testCreateOrUpdateCalendarEvent(t *testing.T, ds *Datastore) {
 	startTime2 := startTime1.Add(1 * time.Hour)
 	endTime2 := startTime1.Add(30 * time.Minute)
 	calendarEvent3, err := ds.CreateOrUpdateCalendarEvent(ctx, eventUUID2, "foo@example.com", startTime2, endTime2,
-		[]byte(`{"foo": "bar"}`), timeZone, host.ID, fleet.CalendarWebhookStatusPending)
+		[]byte(`{"foo": "bar"}`), &timeZone, host.ID, fleet.CalendarWebhookStatusPending)
 	require.NoError(t, err)
 	require.Greater(t, calendarEvent3.UpdatedAt, calendarEvent2.UpdatedAt)
 	require.WithinDuration(t, startTime2, calendarEvent3.StartTime, 1*time.Second)
diff --git a/server/datastore/mysql/errors.go b/server/datastore/mysql/errors.go
index 673a4701fc0c..fa9bbac282c5 100644
--- a/server/datastore/mysql/errors.go
+++ b/server/datastore/mysql/errors.go
@@ -191,6 +191,12 @@ func isMySQLAccessDenied(err error) bool {
 	return false
 }
 
+func isMySQLUnknownStatement(err error) bool {
+	err = ctxerr.Cause(err)
+	var mySQLErr *mysql.MySQLError
+	return errors.As(err, &mySQLErr) && (mySQLErr.Number == mysqlerr.ER_UNKNOWN_STMT_HANDLER)
+}
+
 // ErrPartialResult indicates that a batch operation was completed,
 // but some of the results are missing or incomplete.
 var ErrPartialResult = errors.New("batch operation completed with partial results")
diff --git a/server/datastore/mysql/hosts.go b/server/datastore/mysql/hosts.go
index 8ff25625b85e..73f19ead9c01 100644
--- a/server/datastore/mysql/hosts.go
+++ b/server/datastore/mysql/hosts.go
@@ -541,7 +541,8 @@ var additionalHostRefsByUUID = map[string]string{
 // the rows are not deleted when the host is deleted, only a soft delete is
 // performed by setting a timestamp column to the current time.
 var additionalHostRefsSoftDelete = map[string]string{
-	"host_script_results": "host_deleted_at",
+	"host_script_results":    "host_deleted_at",
+	"host_software_installs": "host_deleted_at",
 }
 
 func (ds *Datastore) DeleteHost(ctx context.Context, hid uint) error {
@@ -1038,17 +1039,31 @@ func (ds *Datastore) applyHostFilters(
 		// software (version) ID filter is mutually exclusive with software title ID
 		// so we're reusing the same filter to avoid adding unnecessary conditions.
 		if opt.SoftwareStatusFilter != nil {
-			// get the installer id
 			meta, err := ds.GetSoftwareInstallerMetadataByTeamAndTitleID(ctx, opt.TeamFilter, *opt.SoftwareTitleIDFilter, false)
-			if err != nil {
+			switch {
+			case fleet.IsNotFound(err):
+				vppApp, err := ds.GetVPPAppByTeamAndTitleID(ctx, opt.TeamFilter, *opt.SoftwareTitleIDFilter)
+				if err != nil {
+					return "", nil, ctxerr.Wrap(ctx, err, "get vpp app by team and title id")
+				}
+				vppAppJoin, vppAppParams, err := ds.vppAppJoin(vppApp.VPPAppID, *opt.SoftwareStatusFilter)
+				if err != nil {
+					return "", nil, ctxerr.Wrap(ctx, err, "vpp app join")
+				}
+				softwareStatusJoin = vppAppJoin
+				joinParams = append(joinParams, vppAppParams...)
+
+			case err != nil:
 				return "", nil, ctxerr.Wrap(ctx, err, "get software installer metadata by team and title id")
+			default:
+				installerJoin, installerParams, err := ds.softwareInstallerJoin(meta.InstallerID, *opt.SoftwareStatusFilter)
+				if err != nil {
+					return "", nil, ctxerr.Wrap(ctx, err, "software installer join")
+				}
+				softwareStatusJoin = installerJoin
+				joinParams = append(joinParams, installerParams...)
+
 			}
-			installerJoin, installerParams, err := ds.softwareInstallerJoin(meta.InstallerID, *opt.SoftwareStatusFilter)
-			if err != nil {
-				return "", nil, ctxerr.Wrap(ctx, err, "software installer join")
-			}
-			softwareStatusJoin = installerJoin
-			joinParams = append(joinParams, installerParams...)
 		} else {
 			softwareFilter = "EXISTS (SELECT 1 FROM host_software hs INNER JOIN software sw ON hs.software_id = sw.id WHERE hs.host_id = h.id AND sw.title_id = ?)"
 			whereParams = append(whereParams, *opt.SoftwareTitleIDFilter)
@@ -1874,7 +1889,6 @@ func (ds *Datastore) EnrollOrbit(ctx context.Context, isMDMEnabled bool, hostInf
         uuid = COALESCE(NULLIF(uuid, ''), ?),
         osquery_host_id = COALESCE(NULLIF(osquery_host_id, ''), ?),
         hardware_serial = COALESCE(NULLIF(hardware_serial, ''), ?),
-		last_enrolled_at = NOW(),
         team_id = ?
       WHERE id = ?`
 			_, err := tx.ExecContext(ctx, sqlUpdate,
@@ -2133,14 +2147,27 @@ func (ds *Datastore) EnrollHost(ctx context.Context, isMDMEnabled bool, osqueryH
 // to update their MySQL configurations when additional prepare statements are added.
 // For more detail, see: https://github.com/fleetdm/fleet/issues/15476
 func (ds *Datastore) getContextTryStmt(ctx context.Context, dest interface{}, query string, args ...interface{}) error {
-	var err error
 	// nolint the statements are closed in Datastore.Close.
 	if stmt := ds.loadOrPrepareStmt(ctx, query); stmt != nil {
-		err = stmt.GetContext(ctx, dest, args...)
-	} else {
-		err = sqlx.GetContext(ctx, ds.reader(ctx), dest, query, args...)
+		err := stmt.GetContext(ctx, dest, args...)
+		if err == nil || !isMySQLUnknownStatement(err) {
+			return err
+		}
+
+		// if the statement is unknown to the MySQL server, delete it
+		// from the cache and fallback to the regular statement call
+		// bellow. This function will get called again eventually and
+		// we will store a new prepared statement in the cache.
+		//
+		// - see https://github.com/fleetdm/fleet/issues/20781 for an
+		// example of when this can happen.
+		//
+		// - see https://github.com/go-sql-driver/mysql/issues/1555 for
+		// a related open bug in the driver
+		ds.deleteCachedStmt(query)
 	}
-	return err
+
+	return sqlx.GetContext(ctx, ds.reader(ctx), dest, query, args...)
 }
 
 // LoadHostByNodeKey loads the whole host identified by the node key.
@@ -2258,7 +2285,6 @@ func (ds *Datastore) LoadHostByOrbitNodeKey(ctx context.Context, nodeKey string)
       h.policy_updated_at,
       h.public_ip,
       h.orbit_node_key,
-      COALESCE(hdek.reset_requested, false) AS disk_encryption_reset_requested,
       IF(hdep.host_id AND ISNULL(hdep.deleted_at), true, false) AS dep_assigned_to_fleet,
       hd.encrypted as disk_encryption_enabled,
       COALESCE(hdek.decryptable, false) as encryption_key_available,
@@ -3629,6 +3655,18 @@ func (ds *Datastore) SetOrUpdateMDMData(
 	)
 }
 
+func (ds *Datastore) UpdateMDMData(
+	ctx context.Context,
+	hostID uint,
+	enrolled bool,
+) error {
+	_, err := ds.writer(ctx).ExecContext(ctx, `UPDATE host_mdm SET enrolled = ? WHERE host_id = ?`, enrolled, hostID)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "update host_mdm.enrolled")
+	}
+	return nil
+}
+
 func (ds *Datastore) SetOrUpdateHostEmailsFromMdmIdpAccounts(
 	ctx context.Context,
 	hostID uint,
@@ -4665,6 +4703,8 @@ func (ds *Datastore) executeOSVersionQuery(ctx context.Context, teamFilter *flee
 	args := []interface{}{aggregatedStatsTypeOSVersions}
 	switch {
 	case teamFilter != nil && teamFilter.TeamID != nil:
+		// Aggregated stats for os versions are stored by team id with 0 representing
+		// no team or the all teams if global_stats is true.
 		query += " AND id = ? AND global_stats = ?"
 		args = append(args, *teamFilter.TeamID, false)
 	case teamFilter != nil:
@@ -4929,7 +4969,7 @@ func (ds *Datastore) ListUpcomingHostMaintenanceWindows(ctx context.Context, hid
 		WHERE
 			hce.host_id = ?
 			AND
-			ce.start_time > NOW()	
+			ce.start_time > NOW()
 		ORDER BY ce.start_time
 	`
 
@@ -4940,20 +4980,6 @@ func (ds *Datastore) ListUpcomingHostMaintenanceWindows(ctx context.Context, hid
 	return mws, nil
 }
 
-func (ds *Datastore) SetDiskEncryptionResetStatus(ctx context.Context, hostID uint, status bool) error {
-	const stmt = `
-          INSERT INTO host_disk_encryption_keys (host_id, reset_requested, base64_encrypted)
-            VALUES (?, ?, '')
-          ON DUPLICATE KEY UPDATE
-            reset_requested = VALUES(reset_requested)`
-
-	_, err := ds.writer(ctx).ExecContext(ctx, stmt, hostID, status)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "upsert disk encryption reset status")
-	}
-	return nil
-}
-
 // countHostNotResponding counts the hosts that haven't been submitting results for sent queries.
 //
 // Notes:
@@ -5021,6 +5047,18 @@ func amountHostsByOsqueryVersionDB(ctx context.Context, db sqlx.QueryerContext)
 	return counts, nil
 }
 
+func numHostsFleetDesktopEnabledDB(ctx context.Context, db sqlx.QueryerContext) (int, error) {
+	var count int
+	const stmt = `
+		SELECT count(*) FROM host_orbit_info WHERE desktop_version IS NOT NULL
+  	`
+	if err := sqlx.GetContext(ctx, db, &count, stmt); err != nil {
+		return 0, err
+	}
+
+	return count, nil
+}
+
 func (ds *Datastore) GetMatchingHostSerials(ctx context.Context, serials []string) (map[string]*fleet.Host, error) {
 	result := map[string]*fleet.Host{}
 	if len(serials) == 0 {
diff --git a/server/datastore/mysql/hosts_test.go b/server/datastore/mysql/hosts_test.go
index 9e36aba7674e..2edc5ab39353 100644
--- a/server/datastore/mysql/hosts_test.go
+++ b/server/datastore/mysql/hosts_test.go
@@ -1245,13 +1245,17 @@ func testHostsListMDM(t *testing.T, ds *Datastore) {
 		hostIDs = append(hostIDs, h.ID)
 	}
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	// enrollment: pending (with Fleet mdm)
-	n, tmID, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{
+	n, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{
 		{SerialNumber: "532141num832", Model: "MacBook Pro", OS: "OSX", OpType: "added"},
-	})
+	}, abmToken.ID, nil, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, int64(1), n)
-	require.Nil(t, tmID)
 
 	const simpleMDM, kandji, unknown = "https://simplemdm.com", "https://kandji.io", "https://url.com"
 	err = ds.SetOrUpdateMDMData(ctx, hostIDs[0], false, true, simpleMDM, true, fleet.WellKnownMDMSimpleMDM, "") // enrollment: automatic
@@ -6683,7 +6687,7 @@ func testHostsDeleteHosts(t *testing.T, ds *Datastore) {
 		Sha256: sha256.New().Sum(nil),
 		Bytes:  []byte("content"),
 		Token:  uuid.New().String(),
-	})
+	}, nil)
 	require.NoError(t, err)
 	err = ds.RecordHostBootstrapPackage(context.Background(), "command-uuid", host.UUID)
 	require.NoError(t, err)
@@ -6743,6 +6747,16 @@ func testHostsDeleteHosts(t *testing.T, ds *Datastore) {
 			`, host.ID, calendarEventID)
 	require.NoError(t, err)
 
+	softwareInstaller, err := ds.MatchOrCreateSoftwareInstaller(context.Background(), &fleet.UploadSoftwareInstallerPayload{
+		InstallScript:   "",
+		PreInstallQuery: "",
+		Title:           "ChocolateRain",
+		UserID:          user1.ID,
+	})
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareInstallRequest(context.Background(), host.ID, softwareInstaller, false)
+	require.NoError(t, err)
+
 	// Check there's an entry for the host in all the associated tables.
 	for _, hostRef := range hostRefs {
 		var ok bool
@@ -7546,6 +7560,11 @@ func testHostsGetHostMDMCheckinInfo(t *testing.T, ds *Datastore) {
 	})
 	require.NoError(t, err)
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	host, err := ds.NewHost(context.Background(), &fleet.Host{
 		DetailUpdatedAt: time.Now(),
 		LabelUpdatedAt:  time.Now(),
@@ -7574,7 +7593,7 @@ func testHostsGetHostMDMCheckinInfo(t *testing.T, ds *Datastore) {
 	require.True(t, info.OsqueryEnrolled)
 	require.Equal(t, "darwin", info.Platform)
 
-	err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*host})
+	err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*host}, abmToken.ID)
 	require.NoError(t, err)
 	info, err = ds.GetHostMDMCheckinInfo(ctx, host.UUID)
 	require.NoError(t, err)
@@ -7601,6 +7620,11 @@ func testHostsGetHostMDMCheckinInfo(t *testing.T, ds *Datastore) {
 func testHostsLoadHostByOrbitNodeKey(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	for _, tt := range enrollTests {
 		h, err := ds.EnrollHost(ctx, false, tt.uuid, tt.uuid, "", tt.nodeKey, nil, 0)
 		require.NoError(t, err)
@@ -7616,7 +7640,6 @@ func testHostsLoadHostByOrbitNodeKey(t *testing.T, ds *Datastore) {
 
 		// the returned host by LoadHostByOrbitNodeKey will have the orbit key stored
 		h.OrbitNodeKey = &orbitKey
-		h.DiskEncryptionResetRequested = ptr.Bool(false)
 		returned, err := ds.LoadHostByOrbitNodeKey(ctx, orbitKey)
 		require.NoError(t, err)
 
@@ -7628,7 +7651,7 @@ func testHostsLoadHostByOrbitNodeKey(t *testing.T, ds *Datastore) {
 	}
 
 	// test loading an unknown orbit key
-	_, err := ds.LoadHostByOrbitNodeKey(ctx, uuid.New().String())
+	_, err = ds.LoadHostByOrbitNodeKey(ctx, uuid.New().String())
 	require.Error(t, err)
 	require.True(t, fleet.IsNotFound(err))
 
@@ -7696,13 +7719,13 @@ func testHostsLoadHostByOrbitNodeKey(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	loadFleet, err = ds.LoadHostByOrbitNodeKey(ctx, *hFleet.OrbitNodeKey)
 	require.NoError(t, err)
-	require.True(t, loadFleet.MDM.EncryptionKeyAvailable)
 	require.NoError(t, err)
+	require.True(t, loadFleet.MDM.EncryptionKeyAvailable)
 	require.NotNil(t, loadFleet.DiskEncryptionEnabled)
 	require.True(t, *loadFleet.DiskEncryptionEnabled)
 
 	// simulate the device being assigned to Fleet in ABM
-	err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*hFleet})
+	err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*hFleet}, abmToken.ID)
 	require.NoError(t, err)
 	loadFleet, err = ds.LoadHostByOrbitNodeKey(ctx, *hFleet.OrbitNodeKey)
 	require.NoError(t, err)
@@ -8258,7 +8281,9 @@ func testHostsEnrollOrbit(t *testing.T, ds *Datastore) {
 		require.NoError(t, err)
 		h2OrbitFetched, err := ds.Host(ctx, h2Orbit.ID)
 		require.NoError(t, err)
-		require.NotEqual(t, h1OsqueryFetched.LastEnrolledAt, h2OrbitFetched.LastEnrolledAt)
+		// orbit should not update last_enrolled_at if re-enrolling (because last_enrolled_at
+		// is to be set by osquery only).
+		require.Equal(t, h1OsqueryFetched.LastEnrolledAt, h2OrbitFetched.LastEnrolledAt)
 		time.Sleep(1 * time.Second) // to test the update of last_enrolled_at
 		h2Osquery, err := ds.EnrollHost(ctx, false, dupUUID, dupUUID, dupHWSerial, uuid.New().String(), nil, 0)
 		require.NoError(t, err)
@@ -8359,8 +8384,8 @@ func testHostsEncryptionKeyRawDecryption(t *testing.T, ds *Datastore) {
 	// no disk encryption key information
 	got, err := ds.Host(ctx, host.ID)
 	require.NoError(t, err)
-	require.False(t, got.MDM.EncryptionKeyAvailable)
 	require.NotNil(t, got.MDM.TestGetRawDecryptable())
+	require.False(t, got.MDM.EncryptionKeyAvailable)
 	require.Equal(t, -1, *got.MDM.TestGetRawDecryptable())
 
 	// create the encryption key row, but unknown decryptable
@@ -8378,8 +8403,8 @@ func testHostsEncryptionKeyRawDecryption(t *testing.T, ds *Datastore) {
 
 	got, err = ds.Host(ctx, host.ID)
 	require.NoError(t, err)
-	require.False(t, got.MDM.EncryptionKeyAvailable)
 	require.NotNil(t, got.MDM.TestGetRawDecryptable())
+	require.False(t, got.MDM.EncryptionKeyAvailable)
 	require.Equal(t, 0, *got.MDM.TestGetRawDecryptable())
 
 	// mark the key as decryptable
@@ -8388,8 +8413,8 @@ func testHostsEncryptionKeyRawDecryption(t *testing.T, ds *Datastore) {
 
 	got, err = ds.Host(ctx, host.ID)
 	require.NoError(t, err)
-	require.True(t, got.MDM.EncryptionKeyAvailable)
 	require.NotNil(t, got.MDM.TestGetRawDecryptable())
+	require.True(t, got.MDM.EncryptionKeyAvailable)
 	require.Equal(t, 1, *got.MDM.TestGetRawDecryptable())
 }
 
@@ -9617,9 +9642,9 @@ func testListUpcomingHostMaintenanceWindows(t *testing.T, ds *Datastore) {
 	startTime := time.Now().UTC().Add(30 * time.Minute)
 	endTime := startTime.Add(30 * time.Minute)
 	calendarEvent, err := ds.CreateOrUpdateCalendarEvent(ctx, uuid.New().String(), "foo@example.com", startTime, endTime, []byte(`{}`),
-		timeZone, host.ID, fleet.CalendarWebhookStatusNone)
+		&timeZone, host.ID, fleet.CalendarWebhookStatusNone)
 	require.NoError(t, err)
-	require.Equal(t, calendarEvent.TimeZone, timeZone)
+	require.Equal(t, *calendarEvent.TimeZone, timeZone)
 
 	mWs, err = ds.ListUpcomingHostMaintenanceWindows(ctx, host.ID)
 	require.NoError(t, err)
diff --git a/server/datastore/mysql/labels.go b/server/datastore/mysql/labels.go
index 2f654ebe336f..d604b286a4aa 100644
--- a/server/datastore/mysql/labels.go
+++ b/server/datastore/mysql/labels.go
@@ -227,6 +227,14 @@ func (ds *Datastore) SaveLabel(ctx context.Context, label *fleet.Label, teamFilt
 	if err != nil {
 		return nil, nil, ctxerr.Wrap(ctx, err, "saving label")
 	}
+
+	// Update the label name in mdm_configuration_profile_labels
+	query = `UPDATE mdm_configuration_profile_labels SET label_name = ? WHERE label_id = ?`
+	_, err = ds.writer(ctx).ExecContext(ctx, query, label.Name, label.ID)
+	if err != nil {
+		return nil, nil, ctxerr.Wrap(ctx, err, "updating mdm configuration profile label")
+	}
+
 	return ds.labelDB(ctx, label.ID, teamFilter, ds.writer(ctx))
 }
 
diff --git a/server/datastore/mysql/labels_test.go b/server/datastore/mysql/labels_test.go
index 17d97278cd07..ca01edfdda46 100644
--- a/server/datastore/mysql/labels_test.go
+++ b/server/datastore/mysql/labels_test.go
@@ -673,6 +673,31 @@ func testLabelsChangeDetails(t *testing.T, db *Datastore) {
 	saved, _, err := db.Label(context.Background(), label.ID, filter)
 	require.Nil(t, err)
 	assert.Equal(t, label.Name, saved.Name)
+	assert.Equal(t, label.Description, saved.Description)
+
+	// Create an Apple config profile, which should reflect a change in label's name
+	profA, err := db.NewMDMAppleConfigProfile(context.Background(), *generateCP("a", "a", 0))
+	require.NoError(t, err)
+	ExecAdhocSQL(t, db, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(context.Background(),
+			"INSERT INTO mdm_configuration_profile_labels (apple_profile_uuid, label_name, label_id) VALUES (?, ?, ?)",
+			profA.ProfileUUID, label.Name, label.ID)
+		return err
+	})
+	label.Name = "changed name"
+	// ApplyLabelSpecs can't update the name -- it simply creates a new label, so we need to call SaveLabel.
+	saved.Name = label.Name
+	saved2, _, err := db.SaveLabel(context.Background(), saved, filter)
+	require.NoError(t, err)
+	assert.Equal(t, label.Name, saved2.Name)
+	assert.Equal(t, label.Description, saved2.Description)
+
+	var configProfileLabelName string
+	ExecAdhocSQL(t, db, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(context.Background(), q, &configProfileLabelName,
+			"SELECT label_name FROM mdm_configuration_profile_labels WHERE label_id = ?", label.ID)
+	})
+	assert.Equal(t, label.Name, configProfileLabelName)
 }
 
 func setupLabelSpecsTest(t *testing.T, ds fleet.Datastore) []*fleet.LabelSpec {
@@ -806,6 +831,17 @@ func testLabelsSave(t *testing.T, db *Datastore) {
 	}
 	label, err = db.NewLabel(context.Background(), label)
 	require.NoError(t, err)
+
+	// Create an Apple config profile
+	profA, err := db.NewMDMAppleConfigProfile(context.Background(), *generateCP("a", "a", 0))
+	require.NoError(t, err)
+	ExecAdhocSQL(t, db, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(context.Background(),
+			"INSERT INTO mdm_configuration_profile_labels (apple_profile_uuid, label_name, label_id) VALUES (?, ?, ?)",
+			profA.ProfileUUID, label.Name, label.ID)
+		return err
+	})
+
 	label.Name = "changed name"
 	label.Description = "changed description"
 
@@ -819,6 +855,13 @@ func testLabelsSave(t *testing.T, db *Datastore) {
 	assert.Equal(t, label.Name, saved.Name)
 	assert.Equal(t, label.Description, saved.Description)
 	assert.Equal(t, 1, saved.HostCount)
+
+	var configProfileLabelName string
+	ExecAdhocSQL(t, db, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(context.Background(), q, &configProfileLabelName,
+			"SELECT label_name FROM mdm_configuration_profile_labels WHERE label_id = ?", label.ID)
+	})
+	assert.Equal(t, label.Name, configProfileLabelName)
 }
 
 func testLabelsQueriesForCentOSHost(t *testing.T, db *Datastore) {
diff --git a/server/datastore/mysql/mdm.go b/server/datastore/mysql/mdm.go
index eefce6091dd5..d3bbba82de31 100644
--- a/server/datastore/mysql/mdm.go
+++ b/server/datastore/mysql/mdm.go
@@ -13,6 +13,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/mdm/apple/mobileconfig"
 	microsoft_mdm "github.com/fleetdm/fleet/v4/server/mdm/microsoft"
 	"github.com/go-kit/log/level"
+	"github.com/google/go-cmp/cmp"
 	"github.com/jmoiron/sqlx"
 )
 
@@ -121,22 +122,26 @@ func (ds *Datastore) getMDMCommand(ctx context.Context, q sqlx.QueryerContext, c
 	return &cmd, nil
 }
 
-func (ds *Datastore) BatchSetMDMProfiles(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDeclarations []*fleet.MDMAppleDeclaration) error {
-	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
-		if err := ds.batchSetMDMWindowsProfilesDB(ctx, tx, tmID, winProfiles); err != nil {
+func (ds *Datastore) BatchSetMDMProfiles(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile,
+	winProfiles []*fleet.MDMWindowsConfigProfile, macDeclarations []*fleet.MDMAppleDeclaration) (updates fleet.MDMProfilesUpdates,
+	err error) {
+	err = ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
+		var err error
+		if updates.WindowsConfigProfile, err = ds.batchSetMDMWindowsProfilesDB(ctx, tx, tmID, winProfiles); err != nil {
 			return ctxerr.Wrap(ctx, err, "batch set windows profiles")
 		}
 
-		if err := ds.batchSetMDMAppleProfilesDB(ctx, tx, tmID, macProfiles); err != nil {
+		if updates.AppleConfigProfile, err = ds.batchSetMDMAppleProfilesDB(ctx, tx, tmID, macProfiles); err != nil {
 			return ctxerr.Wrap(ctx, err, "batch set apple profiles")
 		}
 
-		if _, err := ds.batchSetMDMAppleDeclarations(ctx, tx, tmID, macDeclarations); err != nil {
+		if _, updates.AppleDeclaration, err = ds.batchSetMDMAppleDeclarations(ctx, tx, tmID, macDeclarations); err != nil {
 			return ctxerr.Wrap(ctx, err, "batch set apple declarations")
 		}
 
 		return nil
 	})
+	return updates, err
 }
 
 func (ds *Datastore) ListMDMConfigProfiles(ctx context.Context, teamID *uint, opt fleet.ListOptions) ([]*fleet.MDMConfigProfilePayload, *fleet.PaginationMetadata, error) {
@@ -335,10 +340,12 @@ func (ds *Datastore) BulkSetPendingMDMHostProfiles(
 	ctx context.Context,
 	hostIDs, teamIDs []uint,
 	profileUUIDs, hostUUIDs []string,
-) error {
-	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
-		return ds.bulkSetPendingMDMHostProfilesDB(ctx, tx, hostIDs, teamIDs, profileUUIDs, hostUUIDs)
+) (updates fleet.MDMProfilesUpdates, err error) {
+	err = ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
+		updates, err = ds.bulkSetPendingMDMHostProfilesDB(ctx, tx, hostIDs, teamIDs, profileUUIDs, hostUUIDs)
+		return err
 	})
+	return updates, err
 }
 
 // Note that team ID 0 is used for profiles that apply to hosts in no team
@@ -349,7 +356,7 @@ func (ds *Datastore) bulkSetPendingMDMHostProfilesDB(
 	tx sqlx.ExtContext,
 	hostIDs, teamIDs []uint,
 	profileUUIDs, hostUUIDs []string,
-) error {
+) (updates fleet.MDMProfilesUpdates, err error) {
 	var (
 		countArgs     int
 		macProfUUIDs  []string
@@ -384,10 +391,10 @@ func (ds *Datastore) bulkSetPendingMDMHostProfilesDB(
 		countArgs++
 	}
 	if countArgs > 1 {
-		return errors.New("only one of hostIDs, teamIDs, profileUUIDs or hostUUIDs can be provided")
+		return updates, errors.New("only one of hostIDs, teamIDs, profileUUIDs or hostUUIDs can be provided")
 	}
 	if countArgs == 0 {
-		return nil
+		return updates, nil
 	}
 
 	var countProfUUIDs int
@@ -401,7 +408,7 @@ func (ds *Datastore) bulkSetPendingMDMHostProfilesDB(
 		countProfUUIDs++
 	}
 	if countProfUUIDs > 1 {
-		return errors.New("profile uuids must be all Apple profiles, all Apple declarations, or all Windows profiles")
+		return updates, errors.New("profile uuids must be all Apple profiles, all Apple declarations, or all Windows profiles")
 	}
 
 	var (
@@ -471,10 +478,10 @@ WHERE
 	if len(hosts) == 0 && !hasAppleDecls {
 		uuidStmt, args, err := sqlx.In(uuidStmt, args...)
 		if err != nil {
-			return ctxerr.Wrap(ctx, err, "prepare query to load host UUIDs")
+			return updates, ctxerr.Wrap(ctx, err, "prepare query to load host UUIDs")
 		}
 		if err := sqlx.SelectContext(ctx, tx, &hosts, uuidStmt, args...); err != nil {
-			return ctxerr.Wrap(ctx, err, "execute query to load host UUIDs")
+			return updates, ctxerr.Wrap(ctx, err, "execute query to load host UUIDs")
 		}
 	}
 
@@ -495,12 +502,14 @@ WHERE
 		}
 	}
 
-	if err := ds.bulkSetPendingMDMAppleHostProfilesDB(ctx, tx, appleHosts); err != nil {
-		return ctxerr.Wrap(ctx, err, "bulk set pending apple host profiles")
+	updates.AppleConfigProfile, err = ds.bulkSetPendingMDMAppleHostProfilesDB(ctx, tx, appleHosts)
+	if err != nil {
+		return updates, ctxerr.Wrap(ctx, err, "bulk set pending apple host profiles")
 	}
 
-	if err := ds.bulkSetPendingMDMWindowsHostProfilesDB(ctx, tx, winHosts); err != nil {
-		return ctxerr.Wrap(ctx, err, "bulk set pending windows host profiles")
+	updates.WindowsConfigProfile, err = ds.bulkSetPendingMDMWindowsHostProfilesDB(ctx, tx, winHosts)
+	if err != nil {
+		return updates, ctxerr.Wrap(ctx, err, "bulk set pending windows host profiles")
 	}
 
 	const defaultBatchSize = 1000
@@ -513,11 +522,12 @@ WHERE
 	// (and my hunch is that we could even do the same for
 	// profiles) but this could be optimized to use only a provided
 	// set of host uuids.
-	if _, err := mdmAppleBatchSetHostDeclarationStateDB(ctx, tx, batchSize, nil); err != nil {
-		return ctxerr.Wrap(ctx, err, "bulk set pending apple declarations")
+	_, updates.AppleDeclaration, err = mdmAppleBatchSetHostDeclarationStateDB(ctx, tx, batchSize, nil)
+	if err != nil {
+		return updates, ctxerr.Wrap(ctx, err, "bulk set pending apple declarations")
 	}
 
-	return nil
+	return updates, nil
 }
 
 func (ds *Datastore) UpdateHostMDMProfilesVerification(ctx context.Context, host *fleet.Host, toVerify, toFail, toRetry []string) error {
@@ -984,9 +994,9 @@ func batchSetProfileLabelAssociationsDB(
 	tx sqlx.ExtContext,
 	profileLabels []fleet.ConfigurationProfileLabel,
 	platform string,
-) error {
+) (updatedDB bool, err error) {
 	if len(profileLabels) == 0 {
-		return nil
+		return false, nil
 	}
 
 	var platformPrefix string
@@ -1001,7 +1011,7 @@ func batchSetProfileLabelAssociationsDB(
 	case "windows":
 		platformPrefix = "windows"
 	default:
-		return fmt.Errorf("unsupported platform %s", platform)
+		return false, fmt.Errorf("unsupported platform %s", platform)
 	}
 
 	// delete any profile+label tuple that is NOT in the list of provided tuples
@@ -1023,38 +1033,72 @@ func batchSetProfileLabelAssociationsDB(
               exclude = VALUES(exclude)
 	`
 
+	selectStmt := `
+		SELECT %s_profile_uuid as profile_uuid, label_id, label_name, exclude FROM mdm_configuration_profile_labels
+		WHERE (%s_profile_uuid, label_name) IN (%s)
+	`
+
 	var (
-		insertBuilder strings.Builder
-		deleteBuilder strings.Builder
-		insertParams  []any
-		deleteParams  []any
+		insertBuilder         strings.Builder
+		selectOrDeleteBuilder strings.Builder
+		selectParams          []any
+		insertParams          []any
+		deleteParams          []any
 
 		setProfileUUIDs = make(map[string]struct{})
 	)
+	labelsToInsert := make(map[string]*fleet.ConfigurationProfileLabel, len(profileLabels))
 	for i, pl := range profileLabels {
+		labelsToInsert[fmt.Sprintf("%s\n%s", pl.ProfileUUID, pl.LabelName)] = &profileLabels[i]
 		if i > 0 {
 			insertBuilder.WriteString(",")
-			deleteBuilder.WriteString(",")
+			selectOrDeleteBuilder.WriteString(",")
 		}
 		insertBuilder.WriteString("(?, ?, ?, ?)")
-		deleteBuilder.WriteString("(?, ?)")
+		selectOrDeleteBuilder.WriteString("(?, ?)")
+		selectParams = append(selectParams, pl.ProfileUUID, pl.LabelName)
 		insertParams = append(insertParams, pl.ProfileUUID, pl.LabelID, pl.LabelName, pl.Exclude)
 		deleteParams = append(deleteParams, pl.ProfileUUID, pl.LabelID)
 
 		setProfileUUIDs[pl.ProfileUUID] = struct{}{}
 	}
 
-	_, err := tx.ExecContext(ctx, fmt.Sprintf(upsertStmt, platformPrefix, insertBuilder.String()), insertParams...)
+	// Determine if we need to update the database
+	var existingProfileLabels []fleet.ConfigurationProfileLabel
+	err = sqlx.SelectContext(ctx, tx, &existingProfileLabels,
+		fmt.Sprintf(selectStmt, platformPrefix, platformPrefix, selectOrDeleteBuilder.String()), selectParams...)
 	if err != nil {
-		if isChildForeignKeyError(err) {
-			// one of the provided labels doesn't exist
-			return foreignKey("mdm_configuration_profile_labels", fmt.Sprintf("(profile, label)=(%v)", insertParams))
+		return false, ctxerr.Wrap(ctx, err, "selecting existing profile labels")
+	}
+
+	updateNeeded := false
+	if len(existingProfileLabels) == len(labelsToInsert) {
+		for _, existing := range existingProfileLabels {
+			toInsert, ok := labelsToInsert[fmt.Sprintf("%s\n%s", existing.ProfileUUID, existing.LabelName)]
+			// The fleet.ConfigurationProfileLabel struct has no pointers, so we can use standard cmp.Equal
+			if !ok || !cmp.Equal(existing, *toInsert) {
+				updateNeeded = true
+				break
+			}
 		}
+	} else {
+		updateNeeded = true
+	}
+
+	if updateNeeded {
+		_, err := tx.ExecContext(ctx, fmt.Sprintf(upsertStmt, platformPrefix, insertBuilder.String()), insertParams...)
+		if err != nil {
+			if isChildForeignKeyError(err) {
+				// one of the provided labels doesn't exist
+				return false, foreignKey("mdm_configuration_profile_labels", fmt.Sprintf("(profile, label)=(%v)", insertParams))
+			}
 
-		return ctxerr.Wrap(ctx, err, "setting label associations for profile")
+			return false, ctxerr.Wrap(ctx, err, "setting label associations for profile")
+		}
+		updatedDB = true
 	}
 
-	deleteStmt = fmt.Sprintf(deleteStmt, platformPrefix, deleteBuilder.String(), platformPrefix)
+	deleteStmt = fmt.Sprintf(deleteStmt, platformPrefix, selectOrDeleteBuilder.String(), platformPrefix)
 
 	profUUIDs := make([]string, 0, len(setProfileUUIDs))
 	for k := range setProfileUUIDs {
@@ -1064,13 +1108,18 @@ func batchSetProfileLabelAssociationsDB(
 
 	deleteStmt, args, err := sqlx.In(deleteStmt, deleteArgs...)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "sqlx.In delete labels for profiles")
+		return false, ctxerr.Wrap(ctx, err, "sqlx.In delete labels for profiles")
 	}
-	if _, err := tx.ExecContext(ctx, deleteStmt, args...); err != nil {
-		return ctxerr.Wrap(ctx, err, "deleting labels for profiles")
+	var result sql.Result
+	if result, err = tx.ExecContext(ctx, deleteStmt, args...); err != nil {
+		return false, ctxerr.Wrap(ctx, err, "deleting labels for profiles")
+	}
+	if result != nil {
+		rows, _ := result.RowsAffected()
+		updatedDB = updatedDB || rows > 0
 	}
 
-	return nil
+	return updatedDB, nil
 }
 
 func (ds *Datastore) MDMGetEULAMetadata(ctx context.Context) (*fleet.MDMEULA, error) {
diff --git a/server/datastore/mysql/mdm_test.go b/server/datastore/mysql/mdm_test.go
index 2f0d29412114..a8d765bacaa4 100644
--- a/server/datastore/mysql/mdm_test.go
+++ b/server/datastore/mysql/mdm_test.go
@@ -21,6 +21,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/test"
 	"github.com/google/uuid"
 	"github.com/jmoiron/sqlx"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -358,13 +359,15 @@ func testBatchSetMDMProfiles(t *testing.T, ds *Datastore) {
 		wantApple []*fleet.MDMAppleConfigProfile,
 		wantWindows []*fleet.MDMWindowsConfigProfile,
 		wantAppleDecl []*fleet.MDMAppleDeclaration,
+		wantUpdates fleet.MDMProfilesUpdates,
 	) {
 		ctx := context.Background()
-		err := ds.BatchSetMDMProfiles(ctx, tmID, newAppleSet, newWindowsSet, newAppleDeclSet)
+		updates, err := ds.BatchSetMDMProfiles(ctx, tmID, newAppleSet, newWindowsSet, newAppleDeclSet)
 		require.NoError(t, err)
 		expectAppleProfiles(t, ds, tmID, wantApple)
 		expectWindowsProfiles(t, ds, tmID, wantWindows)
 		expectAppleDeclarations(t, ds, tmID, wantAppleDecl)
+		assert.Equal(t, wantUpdates, updates)
 	}
 
 	withTeamIDApple := func(p *fleet.MDMAppleConfigProfile, tmID uint) *fleet.MDMAppleConfigProfile {
@@ -383,7 +386,7 @@ func testBatchSetMDMProfiles(t *testing.T, ds *Datastore) {
 	}
 
 	// empty set for no team (both Apple and Windows)
-	applyAndExpect(nil, nil, nil, nil, nil, nil, nil)
+	applyAndExpect(nil, nil, nil, nil, nil, nil, nil, fleet.MDMProfilesUpdates{})
 
 	// single Apple and Windows profile set for a specific team
 	applyAndExpect(
@@ -398,6 +401,7 @@ func testBatchSetMDMProfiles(t *testing.T, ds *Datastore) {
 			withTeamIDWindows(windowsConfigProfileForTest(t, "W1", "l1"), 1),
 		},
 		[]*fleet.MDMAppleDeclaration{withTeamIDDecl(declForTest("D1", "D1", "foo"), 1)},
+		fleet.MDMProfilesUpdates{AppleConfigProfile: true, WindowsConfigProfile: true, AppleDeclaration: true},
 	)
 
 	// single Apple and Windows profile set for no team
@@ -409,6 +413,7 @@ func testBatchSetMDMProfiles(t *testing.T, ds *Datastore) {
 		[]*fleet.MDMAppleConfigProfile{configProfileForTest(t, "N1", "I1", "a")},
 		[]*fleet.MDMWindowsConfigProfile{windowsConfigProfileForTest(t, "W1", "l1")},
 		[]*fleet.MDMAppleDeclaration{declForTest("D1", "D1", "foo")},
+		fleet.MDMProfilesUpdates{AppleConfigProfile: true, WindowsConfigProfile: true, AppleDeclaration: true},
 	)
 
 	// new Apple and Windows profile sets for a specific team
@@ -438,6 +443,7 @@ func testBatchSetMDMProfiles(t *testing.T, ds *Datastore) {
 			withTeamIDDecl(declForTest("D1", "D1", "foo"), 1),
 			withTeamIDDecl(declForTest("D2", "D2", "foo"), 1),
 		},
+		fleet.MDMProfilesUpdates{AppleConfigProfile: true, WindowsConfigProfile: true, AppleDeclaration: true},
 	)
 
 	// edited profiles, unchanged profiles, and new profiles for a specific team
@@ -473,6 +479,7 @@ func testBatchSetMDMProfiles(t *testing.T, ds *Datastore) {
 			withTeamIDDecl(declForTest("D2", "D2", "foo"), 1),
 			withTeamIDDecl(declForTest("D3", "D3", "bar"), 1),
 		},
+		fleet.MDMProfilesUpdates{AppleConfigProfile: true, WindowsConfigProfile: true, AppleDeclaration: true},
 	)
 
 	// new Apple and Windows profiles to no team
@@ -502,10 +509,43 @@ func testBatchSetMDMProfiles(t *testing.T, ds *Datastore) {
 			declForTest("D5", "D4", "foo"),
 			declForTest("D4", "D5", "foo"),
 		},
+		fleet.MDMProfilesUpdates{AppleConfigProfile: true, WindowsConfigProfile: true, AppleDeclaration: true},
+	)
+
+	// Apply the same profiles again -- no update should be detected
+	applyAndExpect(
+		[]*fleet.MDMAppleConfigProfile{
+			configProfileForTest(t, "N4", "I4", "d"),
+			configProfileForTest(t, "N5", "I5", "e"),
+		},
+		[]*fleet.MDMWindowsConfigProfile{
+			windowsConfigProfileForTest(t, "W4", "l4"),
+			windowsConfigProfileForTest(t, "W5", "l5"),
+		},
+		[]*fleet.MDMAppleDeclaration{
+			declForTest("D5", "D4", "foo"),
+			declForTest("D4", "D5", "foo"),
+		},
+		nil,
+		[]*fleet.MDMAppleConfigProfile{
+			configProfileForTest(t, "N4", "I4", "d"),
+			configProfileForTest(t, "N5", "I5", "e"),
+		},
+		[]*fleet.MDMWindowsConfigProfile{
+			windowsConfigProfileForTest(t, "W4", "l4"),
+			windowsConfigProfileForTest(t, "W5", "l5"),
+		},
+		[]*fleet.MDMAppleDeclaration{
+			declForTest("D5", "D4", "foo"),
+			declForTest("D4", "D5", "foo"),
+		},
+		fleet.MDMProfilesUpdates{AppleConfigProfile: false, WindowsConfigProfile: false, AppleDeclaration: false},
 	)
 
 	// Test Case 8: Clear profiles for a specific team
-	applyAndExpect(nil, nil, nil, ptr.Uint(1), nil, nil, nil)
+	applyAndExpect(nil, nil, nil, ptr.Uint(1), nil, nil, nil,
+		fleet.MDMProfilesUpdates{AppleConfigProfile: true, WindowsConfigProfile: true, AppleDeclaration: true},
+	)
 }
 
 func testListMDMConfigProfiles(t *testing.T, ds *Datastore) {
@@ -1063,17 +1103,24 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	}
 
 	// bulk set for no target ids, does nothing
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, nil, nil)
+	updates, err := ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, nil, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
+	assert.False(t, updates.WindowsConfigProfile)
+
 	// bulk set for combination of target ids, not allowed
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{1}, []uint{2}, nil, nil)
+	_, err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{1}, []uint{2}, nil, nil)
 	require.Error(t, err)
 
 	// bulk set for all created hosts, no profiles yet so nothing changed
 	allHosts := append(darwinHosts, unenrolledHost, linuxHost)
 	allHosts = append(allHosts, windowsHosts...)
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, hostIDsFromHosts(allHosts...), nil, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, hostIDsFromHosts(allHosts...), nil, nil, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
+	assert.False(t, updates.WindowsConfigProfile)
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]:  {},
 		darwinHosts[1]:  {},
@@ -1100,7 +1147,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		windowsConfigProfileForTest(t, "G2w", "L2"),
 		windowsConfigProfileForTest(t, "G3w", "L3"),
 	}
-	err = ds.BatchSetMDMProfiles(
+	updates, err = ds.BatchSetMDMProfiles(
 		ctx,
 		nil,
 		macGlobalProfiles,
@@ -1113,6 +1160,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	require.Len(t, macGlobalProfiles, 3)
 	globalProfiles := getProfs(nil)
 	require.Len(t, globalProfiles, 8)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
+	assert.True(t, updates.WindowsConfigProfile)
 
 	// list profiles to install, should result in the global profiles for all
 	// enrolled hosts
@@ -1132,8 +1182,11 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	require.Len(t, toRemoveWindows, 0)
 
 	// bulk set for all created hosts, enrolled hosts get the no-team profiles
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, hostIDsFromHosts(allHosts...), nil, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, hostIDsFromHosts(allHosts...), nil, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
+	assert.True(t, updates.WindowsConfigProfile)
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
 			{
@@ -1311,7 +1364,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	require.Len(t, toRemoveWindows, 3)
 
 	// update status of the moved host (team has no profiles)
-	err = ds.BulkSetPendingMDMHostProfiles(
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		hostIDsFromHosts(darwinHosts[0], windowsHosts[0]),
 		nil,
@@ -1319,6 +1372,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
+	assert.True(t, updates.WindowsConfigProfile)
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
 			{
@@ -1482,7 +1538,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	require.Len(t, toRemoveWindows, 3)
 
 	// update status of the moved host via its uuid (team has no profiles)
-	err = ds.BulkSetPendingMDMHostProfiles(
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		nil,
 		nil,
@@ -1490,6 +1546,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		[]string{darwinHosts[1].UUID, windowsHosts[1].UUID},
 	)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
+	assert.True(t, updates.WindowsConfigProfile)
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
 			{
@@ -1620,8 +1679,11 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		windowsConfigProfileForTest(t, "T1.1w", "T1.1"),
 		windowsConfigProfileForTest(t, "T1.2w", "T1.2"),
 	}
-	err = ds.BatchSetMDMProfiles(ctx, &team1.ID, tm1DarwinProfiles, tm1WindowsProfiles, nil)
+	updates, err = ds.BatchSetMDMProfiles(ctx, &team1.ID, tm1DarwinProfiles, tm1WindowsProfiles, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
+	assert.True(t, updates.WindowsConfigProfile)
 
 	tm1Profiles := getProfs(&team1.ID)
 	require.Len(t, tm1Profiles, 4)
@@ -1644,8 +1706,11 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	require.Len(t, toRemoveWindows, 0)
 
 	// update status of the affected team
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team1.ID}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team1.ID}, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
+	assert.True(t, updates.WindowsConfigProfile)
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
 			{
@@ -1827,15 +1892,21 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		windowsConfigProfileForTest(t, "T1.3w", "T1.3"),
 	}
 
-	err = ds.BatchSetMDMProfiles(ctx, &team1.ID, newTm1DarwinProfiles, newTm1WindowsProfiles, nil)
+	updates, err = ds.BatchSetMDMProfiles(ctx, &team1.ID, newTm1DarwinProfiles, newTm1WindowsProfiles, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	newTm1Profiles := getProfs(&team1.ID)
 	require.Len(t, newTm1Profiles, 4)
 
 	// update status of the affected team
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team1.ID}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team1.ID}, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -1974,6 +2045,13 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		},
 	})
 
+	// update again -- nothing should change
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team1.ID}, nil, nil)
+	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
+
 	// re-add tm1Profiles[0] to list of team1 profiles (T1.1 on Apple, T1.2 on Windows)
 	// NOTE: even though it is the same profile, it's unique DB ID is different because
 	// it got deleted and re-inserted from the team's profiles, so this is reflected in
@@ -1989,14 +2067,20 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		windowsConfigProfileForTest(t, "T1.3w", "T1.3"),
 	}
 
-	err = ds.BatchSetMDMProfiles(ctx, &team1.ID, newTm1DarwinProfiles, newTm1WindowsProfiles, nil)
+	updates, err = ds.BatchSetMDMProfiles(ctx, &team1.ID, newTm1DarwinProfiles, newTm1WindowsProfiles, nil)
 	require.NoError(t, err)
 	newTm1Profiles = getProfs(&team1.ID)
 	require.Len(t, newTm1Profiles, 6)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	// update status of the affected team
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team1.ID}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team1.ID}, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -2154,15 +2238,21 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	}
 
 	// TODO(roberto): add new darwin declarations for this and all subsequent assertions
-	err = ds.BatchSetMDMProfiles(ctx, nil, newDarwinGlobalProfiles, newWindowsGlobalProfiles, nil)
+	updates, err = ds.BatchSetMDMProfiles(ctx, nil, newDarwinGlobalProfiles, newWindowsGlobalProfiles, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
 
 	newGlobalProfiles := getProfs(nil)
 	require.Len(t, newGlobalProfiles, 6)
 
 	// update status of the affected "no-team"
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{0}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{0}, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
 
 	require.NoError(t, ds.MDMAppleStoreDDMStatusReport(ctx, darwinHosts[0].UUID, nil))
 	require.NoError(t, ds.MDMAppleStoreDDMStatusReport(ctx, darwinHosts[1].UUID, nil))
@@ -2289,15 +2379,21 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		windowsConfigProfileForTest(t, "G5w", "G5"),
 	}
 
-	err = ds.BatchSetMDMProfiles(ctx, nil, newDarwinGlobalProfiles, newWindowsGlobalProfiles, nil)
+	updates, err = ds.BatchSetMDMProfiles(ctx, nil, newDarwinGlobalProfiles, newWindowsGlobalProfiles, nil)
 	require.NoError(t, err)
 	newGlobalProfiles = getProfs(nil)
 	require.Len(t, newGlobalProfiles, 8)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	// bulk-set only those affected by the new Apple global profile
 	newDarwinProfileUUID := newGlobalProfiles[3].ProfileUUID
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{newDarwinProfileUUID}, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{newDarwinProfileUUID}, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -2407,8 +2503,11 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 
 	// bulk-set only those affected by the new Apple global profile
 	newWindowsProfileUUID := newGlobalProfiles[7].ProfileUUID
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{newWindowsProfileUUID}, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{newWindowsProfileUUID}, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -2531,14 +2630,20 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		windowsConfigProfileForTest(t, "T2.1w", "T2.1"),
 	}
 
-	err = ds.BatchSetMDMProfiles(ctx, &team2.ID, tm2DarwinProfiles, tm2WindowsProfiles, nil)
+	updates, err = ds.BatchSetMDMProfiles(ctx, &team2.ID, tm2DarwinProfiles, tm2WindowsProfiles, nil)
 	require.NoError(t, err)
 	tm2Profiles := getProfs(&team2.ID)
 	require.Len(t, tm2Profiles, 2)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	// update status via tm2 id and the global 0 id to test that custom sql statement
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID, 0}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID, 0}, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -2714,7 +2819,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		windowsConfigProfileForTest(t, "G7w", "G7", labels[5]),
 	}
 
-	err = ds.BatchSetMDMProfiles(ctx, nil, newDarwinGlobalProfiles, newWindowsGlobalProfiles, nil)
+	updates, err = ds.BatchSetMDMProfiles(ctx, nil, newDarwinGlobalProfiles, newWindowsGlobalProfiles, nil)
 	require.NoError(t, err)
 	newGlobalProfiles = getProfs(nil)
 	require.Len(t, newGlobalProfiles, 12)
@@ -2723,6 +2828,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	setProfileLabels(t, newGlobalProfiles[5], labels[2])
 	setProfileLabels(t, newGlobalProfiles[10], labels[3], labels[4])
 	setProfileLabels(t, newGlobalProfiles[11], labels[5])
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	// simulate an entry with some values set to NULL
 	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -2737,7 +2845,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	// do a sync of all hosts, should not change anything as no host is a member
 	// of the new label-based profiles (indices change due to new Apple and
 	// Windows profiles)
-	err = ds.BulkSetPendingMDMHostProfiles(
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		hostIDsFromHosts(
 			append(darwinHosts, append(windowsHosts, unenrolledHost, linuxHost)...)...),
@@ -2746,6 +2854,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -2912,7 +3023,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 
 	// do a full sync, the new global hosts get the standard global profiles and
 	// also the label-based profile that they are a member of
-	err = ds.BulkSetPendingMDMHostProfiles(
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		hostIDsFromHosts(
 			append(darwinHosts, append(windowsHosts, unenrolledHost, linuxHost)...)...),
@@ -2921,6 +3032,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -3117,7 +3231,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 
 	// do a sync of those hosts, they will get the two label-based profiles of their platform
-	err = ds.BulkSetPendingMDMHostProfiles(
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		hostIDsFromHosts(darwinHosts[2], windowsHosts[2]),
 		nil,
@@ -3125,6 +3239,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -3327,7 +3444,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	require.NoError(t, ds.DeleteLabel(ctx, labels[3].Name))
 
 	// sync the affected profiles
-	err = ds.BulkSetPendingMDMHostProfiles(
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		nil,
 		nil,
@@ -3335,7 +3452,10 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
-	err = ds.BulkSetPendingMDMHostProfiles(
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		nil,
 		nil,
@@ -3343,6 +3463,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	// nothing changes - broken label-based profiles are simply ignored
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
@@ -3551,7 +3674,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	})
 	require.NoError(t, err)
 
-	err = ds.BulkSetPendingMDMHostProfiles(
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		hostIDsFromHosts(darwinHosts[2], windowsHosts[2]),
 		nil,
@@ -3559,6 +3682,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -3756,7 +3882,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	setProfileLabels(t, newGlobalProfiles[4], labels[1])
 	setProfileLabels(t, newGlobalProfiles[10], labels[4])
 
-	err = ds.BulkSetPendingMDMHostProfiles(
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		nil,
 		nil,
@@ -3764,7 +3890,10 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
-	err = ds.BulkSetPendingMDMHostProfiles(
+	assert.True(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		nil,
 		nil,
@@ -3772,6 +3901,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -3969,18 +4101,24 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		windowsConfigProfileForTest(t, "T2.2w", "T2.2", labels[4], labels[5]),
 	}
 
-	err = ds.BatchSetMDMProfiles(ctx, &team2.ID, tm2DarwinProfiles, tm2WindowsProfiles, nil)
+	updates, err = ds.BatchSetMDMProfiles(ctx, &team2.ID, tm2DarwinProfiles, tm2WindowsProfiles, nil)
 	require.NoError(t, err)
 	tm2Profiles = getProfs(&team2.ID)
 	require.Len(t, tm2Profiles, 4)
 	// TODO(mna): temporary until BatchSetMDMProfiles supports labels
 	setProfileLabels(t, tm2Profiles[1], labels[1], labels[2])
 	setProfileLabels(t, tm2Profiles[3], labels[4], labels[5])
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	// sync team 2, no changes because no host is a member of the labels (except
 	// index change due to new profiles)
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -4178,8 +4316,11 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 
 	// sync team 2, the label-based profile of team2 is now pending install
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -4388,8 +4529,11 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 
 	// sync team 2, the label-based profile of team2 is left untouched (broken
 	// profiles are ignored)
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -4603,8 +4747,11 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 
 	// sync team 2, the label-based profile of team2 is still left untouched
 	// because even if the hosts are not members anymore, the profile is broken
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -4808,8 +4955,11 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 
 	// sync team 2, now it sees that the hosts are not members and the profile
 	// gets removed
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -5003,7 +5153,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	})
 
 	// sanity-check, a full sync does not change anything
-	err = ds.BulkSetPendingMDMHostProfiles(
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		hostIDsFromHosts(
 			append(darwinHosts, append(windowsHosts, unenrolledHost, linuxHost)...)...),
@@ -5012,6 +5162,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -5237,8 +5390,11 @@ func testGetHostMDMProfilesExpectedForVerification(t *testing.T, ds *Datastore)
 			configProfileForTest(t, "T1.2", "T1.2", "e"),
 		}
 
-		err = ds.BatchSetMDMProfiles(ctx, &team.ID, profiles, nil, nil)
+		updates, err := ds.BatchSetMDMProfiles(ctx, &team.ID, profiles, nil, nil)
 		require.NoError(t, err)
+		assert.True(t, updates.AppleConfigProfile)
+		assert.False(t, updates.WindowsConfigProfile)
+		assert.False(t, updates.AppleDeclaration)
 
 		profs, _, err := ds.ListMDMConfigProfiles(ctx, &team.ID, fleet.ListOptions{})
 		require.NoError(t, err)
@@ -5275,8 +5431,11 @@ func testGetHostMDMProfilesExpectedForVerification(t *testing.T, ds *Datastore)
 		label, err := ds.NewLabel(ctx, &fleet.Label{Name: "test_label_1"})
 		require.NoError(t, err)
 
-		err = ds.BatchSetMDMProfiles(ctx, &team.ID, profiles, nil, nil)
+		updates, err := ds.BatchSetMDMProfiles(ctx, &team.ID, profiles, nil, nil)
 		require.NoError(t, err)
+		assert.True(t, updates.AppleConfigProfile)
+		assert.False(t, updates.WindowsConfigProfile)
+		assert.False(t, updates.AppleDeclaration)
 
 		var uid string
 		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -5354,8 +5513,11 @@ func testGetHostMDMProfilesExpectedForVerification(t *testing.T, ds *Datastore)
 		testLabel3, err := ds.NewLabel(ctx, &fleet.Label{Name: "test_label_3"})
 		require.NoError(t, err)
 
-		err = ds.BatchSetMDMProfiles(ctx, &team.ID, profiles, nil, nil)
+		updates, err := ds.BatchSetMDMProfiles(ctx, &team.ID, profiles, nil, nil)
 		require.NoError(t, err)
+		assert.True(t, updates.AppleConfigProfile)
+		assert.False(t, updates.WindowsConfigProfile)
+		assert.False(t, updates.AppleDeclaration)
 
 		var uid string
 		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -5444,8 +5606,11 @@ func testGetHostMDMProfilesExpectedForVerification(t *testing.T, ds *Datastore)
 		testLabel4, err := ds.NewLabel(ctx, &fleet.Label{Name: "test_label_4"})
 		require.NoError(t, err)
 
-		err = ds.BatchSetMDMProfiles(ctx, &team.ID, profiles, nil, nil)
+		updates, err := ds.BatchSetMDMProfiles(ctx, &team.ID, profiles, nil, nil)
 		require.NoError(t, err)
+		assert.True(t, updates.AppleConfigProfile)
+		assert.False(t, updates.WindowsConfigProfile)
+		assert.False(t, updates.AppleDeclaration)
 
 		var uid string
 		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -5524,8 +5689,11 @@ func testGetHostMDMProfilesExpectedForVerification(t *testing.T, ds *Datastore)
 			windowsConfigProfileForTest(t, "T5.2", "T5.2"),
 		}
 
-		err = ds.BatchSetMDMProfiles(ctx, &team.ID, nil, profiles, nil)
+		updates, err := ds.BatchSetMDMProfiles(ctx, &team.ID, nil, profiles, nil)
 		require.NoError(t, err)
+		assert.False(t, updates.AppleConfigProfile)
+		assert.True(t, updates.WindowsConfigProfile)
+		assert.False(t, updates.AppleDeclaration)
 
 		profs, _, err := ds.ListMDMConfigProfiles(ctx, &team.ID, fleet.ListOptions{})
 		require.NoError(t, err)
@@ -5562,8 +5730,11 @@ func testGetHostMDMProfilesExpectedForVerification(t *testing.T, ds *Datastore)
 		label, err := ds.NewLabel(ctx, &fleet.Label{Name: "test_label_6"})
 		require.NoError(t, err)
 
-		err = ds.BatchSetMDMProfiles(ctx, &team.ID, nil, profiles, nil)
+		updates, err := ds.BatchSetMDMProfiles(ctx, &team.ID, nil, profiles, nil)
 		require.NoError(t, err)
+		assert.False(t, updates.AppleConfigProfile)
+		assert.True(t, updates.WindowsConfigProfile)
+		assert.False(t, updates.AppleDeclaration)
 
 		var uid string
 		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -5641,8 +5812,11 @@ func testGetHostMDMProfilesExpectedForVerification(t *testing.T, ds *Datastore)
 		testLabel3, err := ds.NewLabel(ctx, &fleet.Label{Name: uuid.NewString()})
 		require.NoError(t, err)
 
-		err = ds.BatchSetMDMProfiles(ctx, &team.ID, nil, profiles, nil)
+		updates, err := ds.BatchSetMDMProfiles(ctx, &team.ID, nil, profiles, nil)
 		require.NoError(t, err)
+		assert.False(t, updates.AppleConfigProfile)
+		assert.True(t, updates.WindowsConfigProfile)
+		assert.False(t, updates.AppleDeclaration)
 
 		var uid string
 		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -5731,8 +5905,11 @@ func testGetHostMDMProfilesExpectedForVerification(t *testing.T, ds *Datastore)
 		label, err := ds.NewLabel(ctx, &fleet.Label{Name: uuid.NewString()})
 		require.NoError(t, err)
 
-		err = ds.BatchSetMDMProfiles(ctx, &team.ID, nil, profiles, nil)
+		updates, err := ds.BatchSetMDMProfiles(ctx, &team.ID, nil, profiles, nil)
 		require.NoError(t, err)
+		assert.False(t, updates.AppleConfigProfile)
+		assert.True(t, updates.WindowsConfigProfile)
+		assert.False(t, updates.AppleDeclaration)
 
 		var uid string
 		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -5947,18 +6124,16 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 	wantOtherWin := []fleet.ConfigurationProfileLabel{
 		{ProfileUUID: otherWinProfile.ProfileUUID, LabelName: label.Name, LabelID: label.ID},
 	}
-	require.NoError(
-		t,
-		batchSetProfileLabelAssociationsDB(ctx, ds.writer(ctx), wantOtherWin, "windows"),
-	)
+	updatedDB, err := batchSetProfileLabelAssociationsDB(ctx, ds.writer(ctx), wantOtherWin, "windows")
+	require.NoError(t, err)
+	assert.True(t, updatedDB)
 	// make it an "exclude" label on the other macos profile
 	wantOtherMac := []fleet.ConfigurationProfileLabel{
 		{ProfileUUID: otherMacProfile.ProfileUUID, LabelName: label.Name, LabelID: label.ID, Exclude: true},
 	}
-	require.NoError(
-		t,
-		batchSetProfileLabelAssociationsDB(ctx, ds.writer(ctx), wantOtherMac, "darwin"),
-	)
+	updatedDB, err = batchSetProfileLabelAssociationsDB(ctx, ds.writer(ctx), wantOtherMac, "darwin")
+	require.NoError(t, err)
+	assert.True(t, updatedDB)
 
 	platforms := map[string]string{
 		"darwin":  macOSProfile.ProfileUUID,
@@ -5991,7 +6166,10 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 		t.Run("empty input "+platform, func(t *testing.T) {
 			want := []fleet.ConfigurationProfileLabel{}
 			err := ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-				return batchSetProfileLabelAssociationsDB(ctx, tx, want, platform)
+				updatedDB, err := batchSetProfileLabelAssociationsDB(ctx, tx, want, platform)
+				require.NoError(t, err)
+				assert.False(t, updatedDB)
+				return err
 			})
 			require.NoError(t, err)
 			expectLabels(t, uuid, platform, want)
@@ -6005,7 +6183,10 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 				{ProfileUUID: uuid, LabelName: label.Name, LabelID: label.ID},
 			}
 			err := ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-				return batchSetProfileLabelAssociationsDB(ctx, tx, profileLabels, platform)
+				updatedDB, err := batchSetProfileLabelAssociationsDB(ctx, tx, profileLabels, platform)
+				require.NoError(t, err)
+				assert.True(t, updatedDB)
+				return err
 			})
 			require.NoError(t, err)
 			expectLabels(t, uuid, platform, profileLabels)
@@ -6018,7 +6199,10 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 				{ProfileUUID: uuid, LabelName: label.Name, LabelID: label.ID, Exclude: true},
 			}
 			err = ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-				return batchSetProfileLabelAssociationsDB(ctx, tx, profileLabels, platform)
+				updatedDB, err := batchSetProfileLabelAssociationsDB(ctx, tx, profileLabels, platform)
+				require.NoError(t, err)
+				assert.True(t, updatedDB)
+				return err
 			})
 			require.NoError(t, err)
 			expectLabels(t, uuid, platform, profileLabels)
@@ -6033,7 +6217,8 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 			}
 
 			err := ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-				return batchSetProfileLabelAssociationsDB(ctx, tx, invalidProfileLabels, platform)
+				_, err := batchSetProfileLabelAssociationsDB(ctx, tx, invalidProfileLabels, platform)
+				return err
 			})
 			require.Error(t, err)
 		})
@@ -6044,7 +6229,8 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 				{ProfileUUID: uuid, LabelName: label.Name, LabelID: 12345},
 			}
 			err := ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-				return batchSetProfileLabelAssociationsDB(ctx, tx, invalidProfileLabels, platform)
+				_, err := batchSetProfileLabelAssociationsDB(ctx, tx, invalidProfileLabels, platform)
+				return err
 			})
 			require.Error(t, err)
 
@@ -6053,7 +6239,8 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 				{ProfileUUID: uuid, LabelName: "xyz", LabelID: 1235},
 			}
 			err = ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-				return batchSetProfileLabelAssociationsDB(ctx, tx, invalidProfileLabels, platform)
+				_, err := batchSetProfileLabelAssociationsDB(ctx, tx, invalidProfileLabels, platform)
+				return err
 			})
 			require.Error(t, err)
 		})
@@ -6074,7 +6261,10 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 				{ProfileUUID: uuid, LabelName: newLabel.Name, LabelID: newLabel.ID, Exclude: true},
 			}
 			err = ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-				return batchSetProfileLabelAssociationsDB(ctx, tx, profileLabels, platform)
+				updatedDB, err := batchSetProfileLabelAssociationsDB(ctx, tx, profileLabels, platform)
+				require.NoError(t, err)
+				assert.True(t, updatedDB)
+				return err
 			})
 			require.NoError(t, err)
 			// both are stored in the DB
@@ -6085,7 +6275,10 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 				{ProfileUUID: uuid, LabelName: label.Name, LabelID: label.ID},
 			}
 			err = ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-				return batchSetProfileLabelAssociationsDB(ctx, tx, profileLabels, platform)
+				updatedDB, err := batchSetProfileLabelAssociationsDB(ctx, tx, profileLabels, platform)
+				require.NoError(t, err)
+				assert.True(t, updatedDB)
+				return err
 			})
 			require.NoError(t, err)
 			expectLabels(t, uuid, platform, profileLabels)
@@ -6098,12 +6291,13 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 
 	t.Run("unsupported platform", func(t *testing.T) {
 		err := ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-			return batchSetProfileLabelAssociationsDB(
+			_, err := batchSetProfileLabelAssociationsDB(
 				ctx,
 				tx,
 				[]fleet.ConfigurationProfileLabel{{}},
 				"unsupported",
 			)
+			return err
 		})
 		require.Error(t, err)
 	})
@@ -6185,7 +6379,7 @@ func testBatchSetMDMProfilesTransactionError(t *testing.T, ds *Datastore) {
 				windowsConfigProfileForTest(t, "W2", "l2"),
 			}
 			// set the initial profiles without error
-			err := ds.BatchSetMDMProfiles(ctx, nil, appleProfs, winProfs, nil)
+			_, err := ds.BatchSetMDMProfiles(ctx, nil, appleProfs, winProfs, nil)
 			require.NoError(t, err)
 
 			// now ensure all steps are required (add a profile, delete a profile, set labels)
@@ -6201,7 +6395,7 @@ func testBatchSetMDMProfilesTransactionError(t *testing.T, ds *Datastore) {
 			ds.testBatchSetMDMAppleProfilesErr = c.appleErr
 			ds.testBatchSetMDMWindowsProfilesErr = c.windowsErr
 
-			err = ds.BatchSetMDMProfiles(ctx, nil, appleProfs, winProfs, nil)
+			_, err = ds.BatchSetMDMProfiles(ctx, nil, appleProfs, winProfs, nil)
 			require.ErrorContains(t, err, c.wantErr)
 		})
 	}
@@ -7139,8 +7333,11 @@ func testBulkSetPendingMDMHostProfilesExcludeAny(t *testing.T, ds *Datastore) {
 		declForTest("D1", "D1", "{}", labels[3], labels[4], labels[5]),
 	}
 
-	err := ds.BatchSetMDMProfiles(ctx, nil, appleProfs, windowsProfs, appleDecls)
+	updates, err := ds.BatchSetMDMProfiles(ctx, nil, appleProfs, windowsProfs, appleDecls)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
 
 	// must reload them to get the profile/declaration uuid
 	getProfs := func(teamID *uint) []*fleet.MDMConfigProfilePayload {
@@ -7185,8 +7382,11 @@ func testBulkSetPendingMDMHostProfilesExcludeAny(t *testing.T, ds *Datastore) {
 
 	// do a sync, they get all platform-specific profiles since they are not part
 	// of any label
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID}, nil, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID}, nil, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		appleHost: {
@@ -7225,8 +7425,11 @@ func testBulkSetPendingMDMHostProfilesExcludeAny(t *testing.T, ds *Datastore) {
 	})
 	require.NoError(t, err)
 
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID}, nil, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID}, nil, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		appleHost: {
@@ -7257,8 +7460,11 @@ func testBulkSetPendingMDMHostProfilesExcludeAny(t *testing.T, ds *Datastore) {
 	})
 	require.NoError(t, err)
 
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID}, nil, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID}, nil, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		appleHost: {
@@ -7293,8 +7499,11 @@ func testBulkSetPendingMDMHostProfilesExcludeAny(t *testing.T, ds *Datastore) {
 	err = ds.DeleteLabel(ctx, labels[3].Name)
 	require.NoError(t, err)
 
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID}, nil, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID}, nil, nil, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	// broken profiles do not get reported as "to remove"
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
@@ -7345,8 +7554,11 @@ func testBulkSetPendingMDMHostProfilesExcludeAny(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	nanoEnroll(t, ds, appleHost2, false)
 
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID, winHost2.ID, appleHost2.ID}, nil, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID, winHost2.ID, appleHost2.ID}, nil, nil, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	// broken profiles do not get reported as "to install"
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
diff --git a/server/datastore/mysql/microsoft_mdm.go b/server/datastore/mysql/microsoft_mdm.go
index b7426bff009a..ce4d73a9da4f 100644
--- a/server/datastore/mysql/microsoft_mdm.go
+++ b/server/datastore/mysql/microsoft_mdm.go
@@ -1581,7 +1581,7 @@ INSERT INTO
 			cp.LabelsExcludeAny[i].Exclude = true
 			labels = append(labels, cp.LabelsExcludeAny[i])
 		}
-		if err := batchSetProfileLabelAssociationsDB(ctx, tx, labels, "windows"); err != nil {
+		if _, err := batchSetProfileLabelAssociationsDB(ctx, tx, labels, "windows"); err != nil {
 			return ctxerr.Wrap(ctx, err, "inserting windows profile label associations")
 		}
 
@@ -1653,7 +1653,7 @@ func (ds *Datastore) batchSetMDMWindowsProfilesDB(
 	tx sqlx.ExtContext,
 	tmID *uint,
 	profiles []*fleet.MDMWindowsConfigProfile,
-) error {
+) (updatedDB bool, err error) {
 	const loadExistingProfiles = `
 SELECT
   name,
@@ -1721,13 +1721,13 @@ ON DUPLICATE KEY UPDATE
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMWindowsProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "build query to load existing profiles")
+			return false, ctxerr.Wrap(ctx, err, "build query to load existing profiles")
 		}
 		if err := sqlx.SelectContext(ctx, tx, &existingProfiles, stmt, args...); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "select") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMWindowsProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "load existing profiles")
+			return false, ctxerr.Wrap(ctx, err, "load existing profiles")
 		}
 	}
 
@@ -1748,40 +1748,48 @@ ON DUPLICATE KEY UPDATE
 	var (
 		stmt string
 		args []interface{}
-		err  error
 	)
 	// delete the obsolete profiles (all those that are not in keepNames)
+	var result sql.Result
 	if len(keepNames) > 0 {
 		stmt, args, err = sqlx.In(deleteProfilesNotInList, profTeamID, keepNames)
 		if err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "indelete") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMWindowsProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "build statement to delete obsolete profiles")
+			return false, ctxerr.Wrap(ctx, err, "build statement to delete obsolete profiles")
 		}
-		if _, err := tx.ExecContext(ctx, stmt, args...); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "delete") {
+		if result, err = tx.ExecContext(ctx, stmt, args...); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr,
+			"delete") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMWindowsProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "delete obsolete profiles")
+			return false, ctxerr.Wrap(ctx, err, "delete obsolete profiles")
 		}
 	} else {
-		if _, err := tx.ExecContext(ctx, deleteAllProfilesForTeam, profTeamID); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "delete") {
+		if result, err = tx.ExecContext(ctx, deleteAllProfilesForTeam,
+			profTeamID); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "delete") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMWindowsProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "delete all profiles for team")
+			return false, ctxerr.Wrap(ctx, err, "delete all profiles for team")
 		}
 	}
+	if result != nil {
+		rows, _ := result.RowsAffected()
+		updatedDB = rows > 0
+	}
 
 	// insert the new profiles and the ones that have changed
 	for _, p := range incomingProfs {
-		if _, err := tx.ExecContext(ctx, insertNewOrEditedProfile, profTeamID, p.Name, p.SyncML); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "insert") {
+		if result, err = tx.ExecContext(ctx, insertNewOrEditedProfile, profTeamID, p.Name,
+			p.SyncML); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "insert") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMWindowsProfilesErr)
 			}
-			return ctxerr.Wrapf(ctx, err, "insert new/edited profile with name %q", p.Name)
+			return false, ctxerr.Wrapf(ctx, err, "insert new/edited profile with name %q", p.Name)
 		}
+		updatedDB = updatedDB || insertOnDuplicateDidInsertOrUpdate(result)
 	}
 
 	// build a list of labels so the associations can be batch-set all at once
@@ -1797,19 +1805,19 @@ ON DUPLICATE KEY UPDATE
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMWindowsProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "build query to load newly inserted profiles")
+			return false, ctxerr.Wrap(ctx, err, "build query to load newly inserted profiles")
 		}
 		if err := sqlx.SelectContext(ctx, tx, &newlyInsertedProfs, stmt, args...); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "reselect") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMWindowsProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "load newly inserted profiles")
+			return false, ctxerr.Wrap(ctx, err, "load newly inserted profiles")
 		}
 
 		for _, newlyInsertedProf := range newlyInsertedProfs {
 			incomingProf, ok := incomingProfs[newlyInsertedProf.Name]
 			if !ok {
-				return ctxerr.Wrapf(ctx, err, "profile %q is in the database but was not incoming", newlyInsertedProf.Name)
+				return false, ctxerr.Wrapf(ctx, err, "profile %q is in the database but was not incoming", newlyInsertedProf.Name)
 			}
 
 			for _, label := range incomingProf.LabelsIncludeAll {
@@ -1825,47 +1833,56 @@ ON DUPLICATE KEY UPDATE
 	}
 
 	// insert/delete the label associations
-	if err := batchSetProfileLabelAssociationsDB(ctx, tx, incomingLabels, "windows"); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "labels") {
+	var updatedLabels bool
+	if updatedLabels, err = batchSetProfileLabelAssociationsDB(ctx, tx, incomingLabels,
+		"windows"); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "labels") {
 		if err == nil {
 			err = errors.New(ds.testBatchSetMDMWindowsProfilesErr)
 		}
-		return ctxerr.Wrap(ctx, err, "inserting windows profile label associations")
+		return false, ctxerr.Wrap(ctx, err, "inserting windows profile label associations")
 	}
 
-	return nil
+	return updatedDB || updatedLabels, nil
 }
 
 func (ds *Datastore) bulkSetPendingMDMWindowsHostProfilesDB(
 	ctx context.Context,
 	tx sqlx.ExtContext,
 	uuids []string,
-) error {
+) (updatedDB bool, err error) {
 	if len(uuids) == 0 {
-		return nil
+		return false, nil
 	}
 
 	profilesToInstall, err := listMDMWindowsProfilesToInstallDB(ctx, tx, uuids)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "list profiles to install")
+		return false, ctxerr.Wrap(ctx, err, "list profiles to install")
 	}
 
 	profilesToRemove, err := listMDMWindowsProfilesToRemoveDB(ctx, tx, uuids)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "list profiles to remove")
+		return false, ctxerr.Wrap(ctx, err, "list profiles to remove")
 	}
 
 	if len(profilesToInstall) == 0 && len(profilesToRemove) == 0 {
-		return nil
+		return false, nil
 	}
 
-	if err := ds.bulkDeleteMDMWindowsHostsConfigProfilesDB(ctx, tx, profilesToRemove); err != nil {
-		return ctxerr.Wrap(ctx, err, "bulk delete profiles to remove")
+	if len(profilesToRemove) > 0 {
+		if err := ds.bulkDeleteMDMWindowsHostsConfigProfilesDB(ctx, tx, profilesToRemove); err != nil {
+			return false, ctxerr.Wrap(ctx, err, "bulk delete profiles to remove")
+		}
+		updatedDB = true
+	}
+	if len(profilesToInstall) == 0 {
+		return updatedDB, nil
 	}
 
 	var (
-		pargs      []any
-		psb        strings.Builder
-		batchCount int
+		pargs            []any
+		profilesToInsert = make(map[string]*fleet.MDMWindowsProfilePayload)
+		psb              strings.Builder
+		batchCount       int
 	)
 
 	const defaultBatchSize = 1000
@@ -1877,10 +1894,48 @@ func (ds *Datastore) bulkSetPendingMDMWindowsHostProfilesDB(
 	resetBatch := func() {
 		batchCount = 0
 		pargs = pargs[:0]
+		clear(profilesToInsert)
 		psb.Reset()
 	}
 
 	executeUpsertBatch := func(valuePart string, args []any) error {
+		// Check if the update needs to be done at all.
+		selectStmt := fmt.Sprintf(`
+			SELECT 
+				profile_uuid,
+				host_uuid,
+				status,
+				COALESCE(operation_type, '') AS operation_type,
+				COALESCE(detail, '') AS detail,
+				COALESCE(command_uuid, '') AS command_uuid,
+				COALESCE(profile_name, '') AS profile_name
+			FROM host_mdm_windows_profiles WHERE (profile_uuid, host_uuid) IN (%s)`,
+			strings.TrimSuffix(strings.Repeat("(?,?),", len(profilesToInsert)), ","))
+		var selectArgs []any
+		for _, p := range profilesToInsert {
+			selectArgs = append(selectArgs, p.ProfileUUID, p.HostUUID)
+		}
+		var existingProfiles []fleet.MDMWindowsProfilePayload
+		if err := sqlx.SelectContext(ctx, tx, &existingProfiles, selectStmt, selectArgs...); err != nil {
+			return ctxerr.Wrap(ctx, err, "bulk set pending profile status select existing")
+		}
+		var updateNeeded bool
+		if len(existingProfiles) == len(profilesToInsert) {
+			for _, exist := range existingProfiles {
+				insert, ok := profilesToInsert[fmt.Sprintf("%s\n%s", exist.ProfileUUID, exist.HostUUID)]
+				if !ok || !exist.Equal(*insert) {
+					updateNeeded = true
+					break
+				}
+			}
+		} else {
+			updateNeeded = true
+		}
+		if !updateNeeded {
+			// All profiles are already in the database, no need to update.
+			return nil
+		}
+
 		baseStmt := fmt.Sprintf(`
 				INSERT INTO host_mdm_windows_profiles (
 					profile_uuid,
@@ -1898,11 +1953,25 @@ func (ds *Datastore) bulkSetPendingMDMWindowsHostProfilesDB(
 					detail = ''
 			`, strings.TrimSuffix(valuePart, ","))
 
-		_, err = tx.ExecContext(ctx, baseStmt, args...)
-		return ctxerr.Wrap(ctx, err, "bulk set pending profile status execute batch")
+		_, err := tx.ExecContext(ctx, baseStmt, args...)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "bulk set pending profile status execute batch")
+		}
+		updatedDB = true
+		return nil
 	}
 
 	for _, p := range profilesToInstall {
+		profilesToInsert[fmt.Sprintf("%s\n%s", p.ProfileUUID, p.HostUUID)] = &fleet.MDMWindowsProfilePayload{
+			ProfileUUID:   p.ProfileUUID,
+			ProfileName:   p.ProfileName,
+			HostUUID:      p.HostUUID,
+			Status:        nil,
+			OperationType: fleet.MDMOperationTypeInstall,
+			Detail:        p.Detail,
+			CommandUUID:   p.CommandUUID,
+			Retries:       p.Retries,
+		}
 		pargs = append(
 			pargs, p.ProfileUUID, p.HostUUID, p.ProfileName,
 			fleet.MDMOperationTypeInstall)
@@ -1910,7 +1979,7 @@ func (ds *Datastore) bulkSetPendingMDMWindowsHostProfilesDB(
 		batchCount++
 		if batchCount >= batchSize {
 			if err := executeUpsertBatch(psb.String(), pargs); err != nil {
-				return err
+				return false, err
 			}
 			resetBatch()
 		}
@@ -1918,11 +1987,11 @@ func (ds *Datastore) bulkSetPendingMDMWindowsHostProfilesDB(
 
 	if batchCount > 0 {
 		if err := executeUpsertBatch(psb.String(), pargs); err != nil {
-			return err
+			return false, err
 		}
 	}
 
-	return nil
+	return updatedDB, nil
 }
 
 func (ds *Datastore) GetHostMDMWindowsProfiles(ctx context.Context, hostUUID string) ([]fleet.HostMDMWindowsProfile, error) {
diff --git a/server/datastore/mysql/microsoft_mdm_test.go b/server/datastore/mysql/microsoft_mdm_test.go
index 02a4c9d149d6..263a6e549102 100644
--- a/server/datastore/mysql/microsoft_mdm_test.go
+++ b/server/datastore/mysql/microsoft_mdm_test.go
@@ -15,6 +15,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/test"
 	"github.com/google/uuid"
 	"github.com/jmoiron/sqlx"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -1885,7 +1886,7 @@ func testSetOrReplaceMDMWindowsConfigProfile(t *testing.T, ds *Datastore) {
 		}
 		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
 			return sqlx.GetContext(ctx, q, &prof,
-				`SELECT * FROM mdm_windows_configuration_profiles WHERE team_id = ? AND name = ?`,
+				`SELECT profile_uuid, team_id, name, syncml, created_at, uploaded_at FROM mdm_windows_configuration_profiles WHERE team_id = ? AND name = ?`,
 				teamID, name)
 		})
 		return &prof
@@ -1983,7 +1984,9 @@ func expectWindowsProfiles(
 	var got []*fleet.MDMWindowsConfigProfile
 	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
 		ctx := context.Background()
-		return sqlx.SelectContext(ctx, q, &got, `SELECT * FROM mdm_windows_configuration_profiles WHERE team_id = ?`, tmID)
+		return sqlx.SelectContext(ctx, q, &got,
+			`SELECT profile_uuid, team_id, name, syncml, created_at, uploaded_at FROM mdm_windows_configuration_profiles WHERE team_id = ?`,
+			tmID)
 	})
 
 	// create map of expected profiles keyed by name
@@ -2025,9 +2028,13 @@ func expectWindowsProfiles(
 func testBatchSetMDMWindowsProfiles(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 
-	applyAndExpect := func(newSet []*fleet.MDMWindowsConfigProfile, tmID *uint, want []*fleet.MDMWindowsConfigProfile) map[string]string {
+	applyAndExpect := func(newSet []*fleet.MDMWindowsConfigProfile, tmID *uint, want []*fleet.MDMWindowsConfigProfile,
+		wantUpdated bool) map[string]string {
 		err := ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
-			return ds.batchSetMDMWindowsProfilesDB(ctx, tx, tmID, newSet)
+			updatedDB, err := ds.batchSetMDMWindowsProfilesDB(ctx, tx, tmID, newSet)
+			require.NoError(t, err)
+			assert.Equal(t, wantUpdated, updatedDB)
+			return err
 		})
 		require.NoError(t, err)
 		return expectWindowsProfiles(t, ds, tmID, want)
@@ -2041,7 +2048,7 @@ func testBatchSetMDMWindowsProfiles(t *testing.T, ds *Datastore) {
 		}
 		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
 			return sqlx.GetContext(ctx, q, &prof,
-				`SELECT * FROM mdm_windows_configuration_profiles WHERE team_id = ? AND name = ?`,
+				`SELECT profile_uuid, team_id, name, syncml, created_at, uploaded_at FROM mdm_windows_configuration_profiles WHERE team_id = ? AND name = ?`,
 				teamID, name)
 		})
 		return &prof
@@ -2057,14 +2064,14 @@ func testBatchSetMDMWindowsProfiles(t *testing.T, ds *Datastore) {
 	}
 
 	// apply empty set for no-team
-	applyAndExpect(nil, nil, nil)
+	applyAndExpect(nil, nil, nil, false)
 
 	// apply single profile set for tm1
 	mTm1 := applyAndExpect([]*fleet.MDMWindowsConfigProfile{
 		windowsConfigProfileForTest(t, "N1", "l1"),
 	}, ptr.Uint(1), []*fleet.MDMWindowsConfigProfile{
 		withTeamID(windowsConfigProfileForTest(t, "N1", "l1"), 1),
-	})
+	}, true)
 	profTm1N1 := getProfileByTeamAndName(ptr.Uint(1), "N1")
 
 	// apply single profile set for no-team
@@ -2072,7 +2079,7 @@ func testBatchSetMDMWindowsProfiles(t *testing.T, ds *Datastore) {
 		windowsConfigProfileForTest(t, "N1", "l1"),
 	}, nil, []*fleet.MDMWindowsConfigProfile{
 		windowsConfigProfileForTest(t, "N1", "l1"),
-	})
+	}, true)
 
 	// wait a second to ensure timestamps in the DB change
 	time.Sleep(time.Second)
@@ -2084,7 +2091,7 @@ func testBatchSetMDMWindowsProfiles(t *testing.T, ds *Datastore) {
 	}, ptr.Uint(1), []*fleet.MDMWindowsConfigProfile{
 		withUploadedAt(withTeamID(windowsConfigProfileForTest(t, "N1", "l1"), 1), profTm1N1.UploadedAt),
 		withTeamID(windowsConfigProfileForTest(t, "N2", "l2"), 1),
-	})
+	}, true)
 	// uuid for N1-I1 is unchanged
 	require.Equal(t, mTm1["I1"], mTm1b["I1"])
 	profTm1N2 := getProfileByTeamAndName(ptr.Uint(1), "N2")
@@ -2102,7 +2109,7 @@ func testBatchSetMDMWindowsProfiles(t *testing.T, ds *Datastore) {
 		withTeamID(windowsConfigProfileForTest(t, "N1", "l1b"), 1),
 		withUploadedAt(withTeamID(windowsConfigProfileForTest(t, "N2", "l2"), 1), profTm1N2.UploadedAt),
 		withTeamID(windowsConfigProfileForTest(t, "N3", "l3"), 1),
-	})
+	}, true)
 	// uuid for N1-I1 is unchanged
 	require.Equal(t, mTm1b["I1"], mTm1c["I1"])
 	// uuid for N2-I2 is unchanged
@@ -2119,10 +2126,19 @@ func testBatchSetMDMWindowsProfiles(t *testing.T, ds *Datastore) {
 	}, nil, []*fleet.MDMWindowsConfigProfile{
 		windowsConfigProfileForTest(t, "N4", "l4"),
 		windowsConfigProfileForTest(t, "N5", "l5"),
-	})
+	}, true)
+
+	// apply the same thing again -- nothing updated
+	applyAndExpect([]*fleet.MDMWindowsConfigProfile{
+		windowsConfigProfileForTest(t, "N4", "l4"),
+		windowsConfigProfileForTest(t, "N5", "l5"),
+	}, nil, []*fleet.MDMWindowsConfigProfile{
+		windowsConfigProfileForTest(t, "N4", "l4"),
+		windowsConfigProfileForTest(t, "N5", "l5"),
+	}, false)
 
 	// clear profiles for tm1
-	applyAndExpect(nil, ptr.Uint(1), nil)
+	applyAndExpect(nil, ptr.Uint(1), nil, true)
 }
 
 // if the label name starts with "exclude-", the label is considered an "exclude-any", otherwise
diff --git a/server/datastore/mysql/migrations/tables/20220915165115_AppleMDMTables.go b/server/datastore/mysql/migrations/tables/20220915165115_AppleMDMTables.go
index 6c4916ab5bc4..cc8ecaedda91 100644
--- a/server/datastore/mysql/migrations/tables/20220915165115_AppleMDMTables.go
+++ b/server/datastore/mysql/migrations/tables/20220915165115_AppleMDMTables.go
@@ -29,13 +29,13 @@ func Up_20220915165115(tx *sql.Tx) error {
 	// Apply MDM Core schema.
 	_, err = tx.Exec(nanoSchema)
 	if err != nil {
-		return fmt.Errorf("failed to apply nanomdm schema: %w", err)
+		return fmt.Errorf("failed to apply nanomdm core schema: %w", err)
 	}
 
 	// Apply MDM DEP schema.
 	_, err = tx.Exec(depSchema)
 	if err != nil {
-		return fmt.Errorf("failed to apply nanomdm schema: %w", err)
+		return fmt.Errorf("failed to apply nanomdm dep schema: %w", err)
 	}
 
 	// Add Fleet domain tables.
diff --git a/server/datastore/mysql/migrations/tables/20220915165115_AppleMDMTables_nanomdm.sql b/server/datastore/mysql/migrations/tables/20220915165115_AppleMDMTables_nanomdm.sql
index 1b058459fb83..d446aa5e7da0 100644
--- a/server/datastore/mysql/migrations/tables/20220915165115_AppleMDMTables_nanomdm.sql
+++ b/server/datastore/mysql/migrations/tables/20220915165115_AppleMDMTables_nanomdm.sql
@@ -79,6 +79,7 @@ CREATE TABLE nano_users (
     CHECK (user_authenticate_digest IS NULL OR user_authenticate_digest != '')
 );
 
+ALTER TABLE nano_users ADD CONSTRAINT idx_unique_id UNIQUE (id);
 
 /* This table represents enrollments which are an amalgamation of
  * both device and user enrollments.
diff --git a/server/datastore/mysql/migrations/tables/20240707134035_AddUUIDToCalendarEvents_test.go b/server/datastore/mysql/migrations/tables/20240707134035_AddUUIDToCalendarEvents_test.go
index 851997f25107..4372053c53c5 100644
--- a/server/datastore/mysql/migrations/tables/20240707134035_AddUUIDToCalendarEvents_test.go
+++ b/server/datastore/mysql/migrations/tables/20240707134035_AddUUIDToCalendarEvents_test.go
@@ -21,7 +21,7 @@ func TestUp_20240707134035(t *testing.T) {
 	// Apply current migration.
 	applyNext(t, db)
 
-	// check that it's NULL
+	// check that UUID is not NULL
 	const selectUUIDStmt = `SELECT uuid FROM calendar_events WHERE id = ?`
 	var uuid1, uuid2 string
 	err := db.Get(&uuid1, selectUUIDStmt, event1ID)
diff --git a/server/datastore/mysql/migrations/tables/20240709132642_StoreCalendarEventsUUIDAsBinary.go b/server/datastore/mysql/migrations/tables/20240709132642_StoreCalendarEventsUUIDAsBinary.go
new file mode 100644
index 000000000000..185fcf35461d
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240709132642_StoreCalendarEventsUUIDAsBinary.go
@@ -0,0 +1,53 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240709132642, Down_20240709132642)
+}
+
+func Up_20240709132642(tx *sql.Tx) error {
+	// Implementation based on: https://dev.mysql.com/blog-archive/storing-uuid-values-in-mysql-tables/
+
+	if _, err := tx.Exec(`ALTER TABLE calendar_events ADD COLUMN uuid_bin BINARY(16) NOT NULL`); err != nil {
+		return fmt.Errorf("failed to add `uuid_bin` column to `calendar_events` table: %w", err)
+	}
+
+	// Convert existing UUIDs to binary format
+	if _, err := tx.Exec(`UPDATE calendar_events SET uuid_bin = UNHEX(REPLACE(uuid,'-','')), updated_at = updated_at`); err != nil {
+		return fmt.Errorf("failed to convert UUIDs to binary form for existing calendar events: %w", err)
+	}
+
+	// Add unique constraint to uuid_bin column
+	if _, err := tx.Exec(`ALTER TABLE calendar_events ADD CONSTRAINT idx_calendar_events_uuid_bin_unique UNIQUE (uuid_bin)`); err != nil {
+		return fmt.Errorf("failed to add unique constraint to `uuid_bin` column in `calendar_events` table: %w", err)
+	}
+
+	// Drop existing uuid column
+	if _, err := tx.Exec(`ALTER TABLE calendar_events DROP COLUMN uuid`); err != nil {
+		return fmt.Errorf("failed to drop `uuid` column from `calendar_events` table: %w", err)
+	}
+
+	// Add a new GENERATED uuid column
+	if _, err := tx.Exec(
+		`ALTER TABLE calendar_events ADD COLUMN uuid VARCHAR(36) COLLATE utf8mb4_unicode_ci GENERATED ALWAYS AS (
+			(INSERT(
+			    INSERT(
+				  INSERT(
+					INSERT(hex(uuid_bin),9,0,'-'),
+					14,0,'-'),
+				  19,0,'-'),
+				24,0,'-')
+			 )) VIRTUAL`); err != nil {
+		return fmt.Errorf("failed to add `uuid` column to `calendar_events` table: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240709132642(_ *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240709132642_StoreCalendarEventsUUIDAsBinary_test.go b/server/datastore/mysql/migrations/tables/20240709132642_StoreCalendarEventsUUIDAsBinary_test.go
new file mode 100644
index 000000000000..5257df21fbd8
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240709132642_StoreCalendarEventsUUIDAsBinary_test.go
@@ -0,0 +1,49 @@
+package tables
+
+import (
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestUp_20240709132642(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	testUUID := strings.ToUpper(uuid.New().String())
+	startTime := time.Now().UTC()
+	endTime := time.Now().UTC().Add(30 * time.Minute)
+	data := []byte("{\"foo\": \"bar\"}")
+	const insertStmtUUID = `INSERT INTO calendar_events (email, start_time, end_time, event, uuid) VALUES (?, ?, ?, ?, ?)`
+	eventID := execNoErrLastID(t, db, insertStmtUUID, "bob@example.com", startTime, endTime, data, testUUID)
+
+	applyNext(t, db)
+	// Check that uuid and uuid_bin are correct
+	const selectUUIDStmt = `SELECT uuid, uuid_bin FROM calendar_events WHERE id = ?`
+	type event struct {
+		UUID    string `db:"uuid"`
+		UUIDBin []byte `db:"uuid_bin"`
+	}
+	var e event
+	err := db.Get(&e, selectUUIDStmt, eventID)
+	require.NoError(t, err)
+	assert.Equal(t, testUUID, e.UUID)
+	uuidFromBytes, err := uuid.FromBytes(e.UUIDBin)
+	require.NoError(t, err)
+	assert.Equal(t, uuid.MustParse(testUUID), uuidFromBytes)
+
+	// Try to use the same uuid again
+	const insertStmtUUIDBin = `INSERT INTO calendar_events (email, start_time, end_time, event, uuid_bin) VALUES (?, ?, ?, ?, ?)`
+	_, err = db.Exec(insertStmtUUIDBin, "alice@example.com", startTime, endTime, data, e.UUIDBin)
+	assert.Error(t, err)
+
+	// Insert a new event with a new UUID
+	uuidBin := uuid.New()
+	eventID = execNoErrLastID(t, db, insertStmtUUIDBin, "jane@example.com", startTime, endTime, data, uuidBin[:])
+	err = db.Get(&e, selectUUIDStmt, eventID)
+	require.NoError(t, err)
+	assert.Equal(t, uuidBin[:], e.UUIDBin)
+	assert.Equal(t, strings.ToUpper(uuidBin.String()), e.UUID)
+}
diff --git a/server/datastore/mysql/migrations/tables/20240709183940_AddTimeoutColumnToScriptResults.go b/server/datastore/mysql/migrations/tables/20240709183940_AddTimeoutColumnToScriptResults.go
new file mode 100644
index 000000000000..115972a7b046
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240709183940_AddTimeoutColumnToScriptResults.go
@@ -0,0 +1,38 @@
+package tables
+
+import (
+	"database/sql"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240709183940, Down_20240709183940)
+}
+
+// At the time of this migration, all script timeouts are
+// hardcoded to 300 seconds. This migration adds a timeout
+// column to the host_script_results table to allow for
+// custom timeouts.
+func Up_20240709183940(tx *sql.Tx) error {
+	stmt := `
+	ALTER TABLE host_script_results
+	ADD COLUMN timeout INT DEFAULT NULL;
+	`
+	if _, err := tx.Exec(stmt); err != nil {
+		return err
+	}
+
+	stmt = `
+	UPDATE host_script_results
+	SET timeout = 300
+	WHERE timeout IS NULL;
+	`
+	if _, err := tx.Exec(stmt); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func Down_20240709183940(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240709183940_AddTimeoutColumnToScriptResults_test.go b/server/datastore/mysql/migrations/tables/20240709183940_AddTimeoutColumnToScriptResults_test.go
new file mode 100644
index 000000000000..d27fff54f5aa
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240709183940_AddTimeoutColumnToScriptResults_test.go
@@ -0,0 +1,34 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240709183940(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	insertStmt := `
+		INSERT INTO host_script_results 
+		(host_id, execution_id, output)
+		VALUES (?, ?, ?)
+		`
+	_, err := db.Exec(insertStmt, 1, 1, "output")
+	require.NoError(t, err)
+
+	applyNext(t, db)
+
+	selectStmt := `
+		SELECT timeout FROM host_script_results
+		WHERE host_id = ?
+		`
+	var timeout int
+	err = db.QueryRow(selectStmt, 1).Scan(&timeout)
+	require.NoError(t, err)
+	require.Equal(t, 300, timeout)
+
+	// inserting no timeout succeeds
+	_, err = db.Exec(insertStmt, 2, 2, "output")
+	require.NoError(t, err)
+}
diff --git a/server/datastore/mysql/migrations/tables/20240710155623_FixResetLastEnrolledAt.go b/server/datastore/mysql/migrations/tables/20240710155623_FixResetLastEnrolledAt.go
new file mode 100644
index 000000000000..5f494e637926
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240710155623_FixResetLastEnrolledAt.go
@@ -0,0 +1,36 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240710155623, Down_20240710155623)
+}
+
+func Up_20240710155623(tx *sql.Tx) error {
+	// `hosts.last_enrolled_at` contains the date the osquery agent enrolled.
+	//
+	// A bug in v4.51.0 caused the `last_enrolled_at` column to be set to
+	// '2000-01-01 00:00:00' (aka the "Never" date) when macOS hosts perform a
+	// MDM re-enrollment (see https://github.com/fleetdm/fleet/issues/20059
+	// for more details).
+	//
+	// We cannot restore the exact date of the osquery enrollment but
+	// `host_disks.created_at` is a good approximation.
+	if _, err := tx.Exec(`
+		UPDATE hosts h
+		JOIN host_disks hd ON h.id=hd.host_id
+		SET h.last_enrolled_at = hd.created_at, h.updated_at = h.updated_at
+		WHERE h.platform = 'darwin' AND h.last_enrolled_at = '2000-01-01 00:00:00';`,
+	); err != nil {
+		return fmt.Errorf("failed to update hosts.last_enrolled_at: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240710155623(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240710155623_FixResetLastEnrolledAt_test.go b/server/datastore/mysql/migrations/tables/20240710155623_FixResetLastEnrolledAt_test.go
new file mode 100644
index 000000000000..275933b033c4
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240710155623_FixResetLastEnrolledAt_test.go
@@ -0,0 +1,94 @@
+package tables
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240710155623(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	i := uint(1)
+	newHost := func(platform, lastEnrolledAt string, hostDisk bool) uint {
+		id := fmt.Sprintf("%d", i)
+		i++
+		hostID := uint(execNoErrLastID(t, db,
+			`INSERT INTO hosts (osquery_host_id, node_key, uuid, platform, last_enrolled_at) VALUES (?, ?, ?, ?, ?);`,
+			id, id, id, platform, lastEnrolledAt,
+		))
+		if hostDisk {
+			execNoErr(t, db,
+				`INSERT INTO host_disks (host_id) VALUES (?);`,
+				hostID,
+			)
+		}
+		return hostID
+	}
+	neverDate := "2000-01-01 00:00:00"
+	ubuntuHostID := newHost("ubuntu", neverDate, true)                 // non-darwin hosts should not be updated.
+	validMacOSHostID := newHost("darwin", "2024-07-08 18:00:53", true) // host without the issue, should not be updated.
+	pendingMacOSDEPHostID := newHost("darwin", neverDate, false)       // host without the issue (e.g. DEP pending, not enrolled), should not be updated.
+	invalidMacOSHostID := newHost("darwin", neverDate, true)           // host with the issue, should be updated.
+
+	const getColumnsQuery = `
+		SELECT h.last_enrolled_at, h.updated_at, hd.created_at AS host_disks_created_at
+		FROM hosts h LEFT JOIN host_disks hd ON h.id=hd.host_id WHERE h.id = ?;`
+	type hostTimestamps struct {
+		LastEnrolledAt     time.Time  `db:"last_enrolled_at"`
+		UpdatedAt          time.Time  `db:"updated_at"`
+		HostDisksCreatedAt *time.Time `db:"host_disks_created_at"`
+	}
+	var ubuntuTimestampsBefore hostTimestamps
+	err := db.Get(&ubuntuTimestampsBefore, getColumnsQuery, ubuntuHostID)
+	require.NoError(t, err)
+	require.NotZero(t, ubuntuTimestampsBefore.UpdatedAt)
+	require.Equal(t, ubuntuTimestampsBefore.LastEnrolledAt.Format("2006-01-02 15:04:05"), neverDate)
+	require.NotNil(t, ubuntuTimestampsBefore.HostDisksCreatedAt)
+	require.NotZero(t, *ubuntuTimestampsBefore.HostDisksCreatedAt)
+	var validMacOSTimestampsBefore hostTimestamps
+	err = db.Get(&validMacOSTimestampsBefore, getColumnsQuery, validMacOSHostID)
+	require.NoError(t, err)
+	require.NotZero(t, validMacOSTimestampsBefore.UpdatedAt)
+	require.Equal(t, validMacOSTimestampsBefore.LastEnrolledAt.Format("2006-01-02 15:04:05"), "2024-07-08 18:00:53")
+	require.NotNil(t, validMacOSTimestampsBefore.HostDisksCreatedAt)
+	require.NotZero(t, *validMacOSTimestampsBefore.HostDisksCreatedAt)
+	var pendingMacOSDEPTimestampsBefore hostTimestamps
+	err = db.Get(&pendingMacOSDEPTimestampsBefore, getColumnsQuery, pendingMacOSDEPHostID)
+	require.NoError(t, err)
+	require.NotZero(t, pendingMacOSDEPTimestampsBefore.UpdatedAt)
+	require.Equal(t, pendingMacOSDEPTimestampsBefore.LastEnrolledAt.Format("2006-01-02 15:04:05"), neverDate)
+	require.Nil(t, pendingMacOSDEPTimestampsBefore.HostDisksCreatedAt)
+	var invalidMacOSTimestampsBefore hostTimestamps
+	err = db.Get(&invalidMacOSTimestampsBefore, getColumnsQuery, invalidMacOSHostID)
+	require.NoError(t, err)
+	require.NotZero(t, invalidMacOSTimestampsBefore.UpdatedAt)
+	require.Equal(t, invalidMacOSTimestampsBefore.LastEnrolledAt.Format("2006-01-02 15:04:05"), neverDate)
+	require.NotNil(t, invalidMacOSTimestampsBefore.HostDisksCreatedAt)
+	require.NotZero(t, *invalidMacOSTimestampsBefore.HostDisksCreatedAt)
+
+	// Apply current migration.
+	applyNext(t, db)
+
+	var ubuntuTimestampsAfter hostTimestamps
+	err = db.Get(&ubuntuTimestampsAfter, getColumnsQuery, ubuntuHostID)
+	require.NoError(t, err)
+	require.Equal(t, ubuntuTimestampsBefore, ubuntuTimestampsAfter)
+	var validMacOSTimestampsAfter hostTimestamps
+	err = db.Get(&validMacOSTimestampsAfter, getColumnsQuery, validMacOSHostID)
+	require.NoError(t, err)
+	require.Equal(t, validMacOSTimestampsBefore, validMacOSTimestampsAfter)
+	var pendingMacOSDEPTimestampsAfter hostTimestamps
+	err = db.Get(&pendingMacOSDEPTimestampsAfter, getColumnsQuery, pendingMacOSDEPHostID)
+	require.NoError(t, err)
+	require.Equal(t, pendingMacOSDEPTimestampsBefore.UpdatedAt, pendingMacOSDEPTimestampsAfter.UpdatedAt)    // updated_at is unmodified
+	require.Equal(t, neverDate, pendingMacOSDEPTimestampsAfter.LastEnrolledAt.Format("2006-01-02 15:04:05")) // last_enrolled_at was not modified
+	var invalidMacOSTimestampsAfter hostTimestamps
+	err = db.Get(&invalidMacOSTimestampsAfter, getColumnsQuery, invalidMacOSHostID)
+	require.NoError(t, err)
+	require.Equal(t, invalidMacOSTimestampsBefore.UpdatedAt, invalidMacOSTimestampsAfter.UpdatedAt) // updated_at is unmodified
+	require.NotNil(t, invalidMacOSTimestampsAfter.HostDisksCreatedAt)
+	require.Equal(t, *invalidMacOSTimestampsAfter.HostDisksCreatedAt, invalidMacOSTimestampsAfter.LastEnrolledAt) // last_enrolled_at was updated to host_disks date
+}
diff --git a/server/datastore/mysql/migrations/tables/20240723102712_VPPDBUpdates.go b/server/datastore/mysql/migrations/tables/20240723102712_VPPDBUpdates.go
new file mode 100644
index 000000000000..a948cee71f57
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240723102712_VPPDBUpdates.go
@@ -0,0 +1,104 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240723102712, Down_20240723102712)
+}
+
+func Up_20240723102712(tx *sql.Tx) error {
+	_, err := tx.Exec(`
+-- This table is the VPP equivalent of the "software_installers" table.
+-- This table is also used as a cache of the response from the "Get Assets"
+-- Apple endpoint as well as the FleetDM website endpoint which will return
+-- the app metadata.
+-- If an asset has an entry here and an entry in vpp_apps_teams, then it has
+-- been added to Fleet.
+CREATE TABLE vpp_apps (
+	adam_id VARCHAR(16) NOT NULL,
+
+	-- FK to the "software title" this app matches
+	title_id int(10) unsigned DEFAULT NULL,
+
+	bundle_identifier VARCHAR(255) NOT NULL DEFAULT '',
+	icon_url VARCHAR(255) NOT NULL DEFAULT '',
+	name VARCHAR(255) NOT NULL DEFAULT '',
+	latest_version VARCHAR(255) NOT NULL DEFAULT '',
+	created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+	updated_at TIMESTAMP NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+
+	PRIMARY KEY (adam_id),
+
+
+	CONSTRAINT fk_vpp_apps_title
+	  FOREIGN KEY (title_id)
+	  REFERENCES software_titles (id)
+	  ON DELETE SET NULL
+	  ON UPDATE CASCADE
+)`)
+	if err != nil {
+		return fmt.Errorf("failed to create table vpp_apps: %w", err)
+	}
+
+	_, err = tx.Exec(`
+CREATE TABLE vpp_apps_teams (
+	id int(10) unsigned NOT NULL AUTO_INCREMENT PRIMARY KEY,
+	adam_id VARCHAR(16) NOT NULL,
+	-- team_id NULL is for no team (cannot use 0 with foreign key)
+	team_id INT(10) UNSIGNED NULL,
+
+	-- this field is 0 for global, and the team_id otherwise, and is
+	-- used for the unique index/constraint (team_id cannot be used
+	-- as it allows NULL).
+	global_or_team_id INT(10) NOT NULL DEFAULT 0,
+
+	FOREIGN KEY (adam_id) REFERENCES vpp_apps (adam_id) ON DELETE CASCADE,
+	FOREIGN KEY (team_id) REFERENCES teams (id) ON DELETE CASCADE,
+	UNIQUE KEY idx_global_or_team_id_adam_id (global_or_team_id, adam_id)
+)`)
+	if err != nil {
+		return fmt.Errorf("failed to create table vpp_apps_teams: %w", err)
+	}
+
+	_, err = tx.Exec(`
+-- This table is the VPP equivalent of the host_software_installs table.
+-- It tracks the installation of VPP software on particular hosts.
+CREATE TABLE host_vpp_software_installs (
+	id int(10) unsigned NOT NULL AUTO_INCREMENT,
+	host_id INT(10) UNSIGNED NOT NULL,
+
+	-- This is the adam_id of the VPP software that's being installed
+	adam_id VARCHAR(16) NOT NULL,
+
+	-- This is the UUID of the MDM command issued to install the software
+	command_uuid VARCHAR(127) NOT NULL,
+	user_id INT(10) UNSIGNED NULL,
+
+	-- This indicates whether or not this was a self-service install
+	self_service TINYINT(1) NOT NULL DEFAULT FALSE,
+
+	-- This is an ID for the event of "associating" the software with a host.
+	-- This value comes from the "eventId" field in the response here:
+	-- https://developer.apple.com/documentation/devicemanagement/associate_assets
+	associated_event_id VARCHAR(36),
+
+	created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+	updated_at TIMESTAMP NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+	PRIMARY KEY(id),
+	FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE SET NULL,
+	FOREIGN KEY (adam_id) REFERENCES vpp_apps (adam_id) ON DELETE CASCADE,
+	UNIQUE INDEX idx_host_vpp_software_installs_command_uuid (command_uuid)
+)`)
+	if err != nil {
+		return fmt.Errorf("failed to create table host_vpp_software_installs: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240723102712(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240725152735_EnforceFileVaultSetupAssistant.go b/server/datastore/mysql/migrations/tables/20240725152735_EnforceFileVaultSetupAssistant.go
new file mode 100644
index 000000000000..f27d50c9465e
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240725152735_EnforceFileVaultSetupAssistant.go
@@ -0,0 +1,85 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+
+	"github.com/jmoiron/sqlx"
+	"github.com/jmoiron/sqlx/reflectx"
+	"github.com/pkg/errors"
+	"howett.net/plist"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240725152735, Down_20240725152735)
+}
+
+func setKeyInPayloadContent(original []byte, destType, key string, value any) ([]byte, error) {
+	var configuration map[string]interface{}
+	if _, err := plist.Unmarshal(original, &configuration); err != nil {
+		return nil, fmt.Errorf("unmarshalling configuration profile: %w", err)
+	}
+
+	payloadContent, ok := configuration["PayloadContent"].([]interface{})
+	if !ok {
+		return nil, errors.New("failed to access PayloadContent element")
+	}
+
+	for _, c := range payloadContent {
+		payload, ok := c.(map[string]interface{})
+		if !ok {
+			return nil, errors.New("failed to access element in Payload array")
+		}
+
+		if payload["PayloadType"] == destType {
+			payload[key] = value
+		}
+	}
+
+	out, err := plist.Marshal(configuration, plist.XMLFormat)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal new payload: %w", err)
+	}
+
+	return out, nil
+}
+
+func Up_20240725152735(tx *sql.Tx) error {
+	txx := sqlx.Tx{Tx: tx, Mapper: reflectx.NewMapperFunc("db", sqlx.NameMapper)}
+
+	fvProfiles := []struct {
+		ID           uint   `db:"profile_id"`
+		Mobileconfig []byte `db:"mobileconfig"`
+	}{}
+	query := `
+		SELECT profile_id, mobileconfig FROM mdm_apple_configuration_profiles macp WHERE identifier = 'com.fleetdm.fleet.mdm.filevault'
+	`
+	if err := txx.Select(&fvProfiles, query); err != nil {
+		return fmt.Errorf("getting existing FileVault profiles: %w", err)
+	}
+
+	if len(fvProfiles) == 0 {
+		return nil
+	}
+
+	for _, prof := range fvProfiles {
+		newProf, err := setKeyInPayloadContent(prof.Mobileconfig, "com.apple.MCX.FileVault2", "ForceEnableInSetupAssistant", true)
+		if err != nil {
+			return fmt.Errorf("adding new key to profile with ID %d: %w", prof.ID, err)
+		}
+
+		if _, err = txx.Exec(`
+			UPDATE mdm_apple_configuration_profiles
+			SET mobileconfig = ?, checksum = UNHEX(MD5(mobileconfig))
+			WHERE profile_id = ?
+		`, newProf, prof.ID); err != nil {
+			return fmt.Errorf("setting ForceEnableInSetupAssistant in FileVault profile with ID %d: %w", prof.ID, err)
+		}
+	}
+
+	return nil
+}
+
+func Down_20240725152735(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240725152735_EnforceFileVaultSetupAssistant_test.go b/server/datastore/mysql/migrations/tables/20240725152735_EnforceFileVaultSetupAssistant_test.go
new file mode 100644
index 000000000000..f299fd673f6b
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240725152735_EnforceFileVaultSetupAssistant_test.go
@@ -0,0 +1,166 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/fleetdm/fleet/v4/server/mdm/apple/mobileconfig"
+	"github.com/stretchr/testify/require"
+	"howett.net/plist"
+)
+
+func TestUp_20240725152735(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	insertStmt := `
+INSERT INTO mdm_apple_configuration_profiles (team_id, identifier, name, mobileconfig, checksum, profile_uuid)
+VALUES (?, ?, ?, ?, UNHEX(MD5(mobileconfig)), UUID())
+	`
+
+	profileBytes := []byte(`<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>PayloadContent</key>
+	<array>
+		<dict>
+			<key>Defer</key>
+			<true/>
+			<key>Enable</key>
+			<string>On</string>
+			<key>PayloadDisplayName</key>
+			<string>FileVault 2</string>
+			<key>PayloadIdentifier</key>
+			<string>com.apple.MCX.FileVault2.3548D750-6357-4910-8DEA-D80ADCE2C787</string>
+			<key>PayloadType</key>
+			<string>com.apple.MCX.FileVault2</string>
+			<key>PayloadUUID</key>
+			<string>3548D750-6357-4910-8DEA-D80ADCE2C787</string>
+			<key>PayloadVersion</key>
+			<integer>1</integer>
+			<key>ShowRecoveryKey</key>
+			<false/>
+			<key>DeferForceAtUserLoginMaxBypassAttempts</key>
+			<integer>1</integer>
+		</dict>
+		<dict>
+			<key>EncryptCertPayloadUUID</key>
+			<string>A326B71F-EB80-41A5-A8CD-A6F932544281</string>
+			<key>Location</key>
+			<string>Fleet</string>
+			<key>PayloadDisplayName</key>
+			<string>FileVault Recovery Key Escrow</string>
+			<key>PayloadIdentifier</key>
+			<string>com.apple.security.FDERecoveryKeyEscrow.3690D771-DCB8-4D5D-97D6-209A138DF03E</string>
+			<key>PayloadType</key>
+			<string>com.apple.security.FDERecoveryKeyEscrow</string>
+			<key>PayloadUUID</key>
+			<string>3C329F2B-3D47-4141-A2B5-5C52A2FD74F8</string>
+			<key>PayloadVersion</key>
+			<integer>1</integer>
+		</dict>
+		<dict>
+			<key>PayloadCertificateFileName</key>
+			<string>Fleet certificate</string>
+			<key>PayloadContent</key>
+			<data>dGVzdAo=</data>
+			<key>PayloadDisplayName</key>
+			<string>Certificate Root</string>
+			<key>PayloadIdentifier</key>
+			<string>com.apple.security.root.A326B71F-EB80-41A5-A8CD-A6F932544281</string>
+			<key>PayloadType</key>
+			<string>com.apple.security.pkcs1</string>
+			<key>PayloadUUID</key>
+			<string>A326B71F-EB80-41A5-A8CD-A6F932544281</string>
+			<key>PayloadVersion</key>
+			<integer>1</integer>
+		</dict>
+		<dict>
+			<key>dontAllowFDEDisable</key>
+			<true/>
+			<key>PayloadIdentifier</key>
+			<string>com.apple.MCX.62024f29-105E-497A-A724-1D5BA4D9E854</string>
+			<key>PayloadType</key>
+			<string>com.apple.MCX</string>
+			<key>PayloadUUID</key>
+			<string>62024f29-105E-497A-A724-1D5BA4D9E854</string>
+			<key>PayloadVersion</key>
+			<integer>1</integer>
+		</dict>
+	</array>
+	<key>PayloadDisplayName</key>
+	<string>Disk encryption</string>
+	<key>PayloadIdentifier</key>
+	<string>com.fleetdm.fleet.mdm.filevault</string>
+	<key>PayloadType</key>
+	<string>Configuration</string>
+	<key>PayloadUUID</key>
+	<string>74FEAC88-B614-468E-A4B4-B4B0C93B5D52</string>
+	<key>PayloadVersion</key>
+	<integer>1</integer>
+</dict>
+</plist>`)
+
+	// add a global FV profile
+	r, err := db.Exec(insertStmt, 0, mobileconfig.FleetFileVaultPayloadIdentifier, "Disk encryption", profileBytes)
+	require.NoError(t, err)
+	globalProfileID, _ := r.LastInsertId()
+
+	// create a team
+	r, err = db.Exec(`INSERT INTO teams (name) VALUES (?)`, "Test Team")
+	require.NoError(t, err)
+	teamID, _ := r.LastInsertId()
+
+	// add the FV profile to the team
+	r, err = db.Exec(insertStmt, teamID, mobileconfig.FleetFileVaultPayloadIdentifier, "Disk encryption", profileBytes)
+	require.NoError(t, err)
+	teamProfileID, _ := r.LastInsertId()
+
+	var (
+		identifier string
+		gotConfig  []byte
+	)
+
+	checkProfsStmt := "SELECT identifier, mobileconfig FROM mdm_apple_configuration_profiles WHERE name = ? AND team_id = ?"
+	err = db.QueryRow(checkProfsStmt, "Disk encryption", 0).Scan(&identifier, &gotConfig)
+	require.NoError(t, err)
+	require.Equal(t, mobileconfig.FleetFileVaultPayloadIdentifier, identifier)
+	require.Equal(t, profileBytes, gotConfig)
+
+	err = db.QueryRow(checkProfsStmt, "Disk encryption", teamID).Scan(&identifier, &gotConfig)
+	require.NoError(t, err)
+	require.Equal(t, mobileconfig.FleetFileVaultPayloadIdentifier, identifier)
+	require.Equal(t, profileBytes, gotConfig)
+
+	// Apply current migration.
+	applyNext(t, db)
+
+	verifyNewPayload := func(profileID int64) {
+		var mc []byte
+		stmt := "SELECT mobileconfig FROM mdm_apple_configuration_profiles WHERE profile_id = ?"
+		err = db.QueryRow(stmt, profileID).Scan(&mc)
+		require.NoError(t, err)
+
+		// unmarshal only the fields we want to test
+		var payload struct {
+			PayloadContent []map[string]interface{}
+		}
+		_, err = plist.Unmarshal(mc, &payload)
+		require.NoError(t, err)
+		require.Len(t, payload.PayloadContent, 4)
+
+		// find the right payload
+		var found map[string]interface{}
+		for _, p := range payload.PayloadContent {
+			if p["PayloadType"] == "com.apple.MCX.FileVault2" {
+				found = p
+				break
+			}
+		}
+
+		require.NotNil(t, found)
+		require.EqualValues(t, true, found["ForceEnableInSetupAssistant"])
+	}
+
+	verifyNewPayload(globalProfileID)
+	verifyNewPayload(teamProfileID)
+}
diff --git a/server/datastore/mysql/migrations/tables/20240725182118_AddAdditionalIdentifierToSoftwareTitles.go b/server/datastore/mysql/migrations/tables/20240725182118_AddAdditionalIdentifierToSoftwareTitles.go
new file mode 100644
index 000000000000..10e1f478562c
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240725182118_AddAdditionalIdentifierToSoftwareTitles.go
@@ -0,0 +1,45 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240725182118, Down_20240725182118)
+}
+
+func Up_20240725182118(tx *sql.Tx) error {
+	if columnExists(tx, "software_titles", "additional_identifier") {
+		return nil
+	}
+
+	_, err := tx.Exec(`
+		ALTER TABLE software_titles 
+		ADD COLUMN additional_identifier TINYINT UNSIGNED GENERATED ALWAYS AS 
+			(CASE
+				WHEN source = 'ios_apps' then 1
+				WHEN source = 'ipados_apps' then 2
+				WHEN bundle_identifier IS NOT NULL THEN 0
+				ELSE NULL
+			END) VIRTUAL`)
+	if err != nil {
+		return fmt.Errorf("adding additional_identifier to software_titles: %w", err)
+	}
+
+	_, err = tx.Exec(`ALTER TABLE software_titles DROP INDEX idx_software_titles_bundle_identifier`)
+	if err != nil {
+		return fmt.Errorf("dropping unique key for bundle_identifier in software_titles: %w", err)
+	}
+
+	_, err = tx.Exec(`ALTER TABLE software_titles ADD UNIQUE KEY idx_software_titles_bundle_identifier (bundle_identifier, additional_identifier)`)
+	if err != nil {
+		return fmt.Errorf("adding unique key for identifiers in software_titles: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240725182118(_ *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240725182118_AddAdditionalIdentifierToSoftwareTitles_test.go b/server/datastore/mysql/migrations/tables/20240725182118_AddAdditionalIdentifierToSoftwareTitles_test.go
new file mode 100644
index 000000000000..2404be53d4be
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240725182118_AddAdditionalIdentifierToSoftwareTitles_test.go
@@ -0,0 +1,86 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/fleetdm/fleet/v4/server/ptr"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240725182118(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	// Data before ios and ipados apps were added
+	dataStmt := `
+	  INSERT INTO software_titles (id, name, source, browser, bundle_identifier) VALUES
+	    (1, 'Foo.app', 'apps', '', 'com.example.foo'),
+	    (2, 'Foo2.app', 'apps', '', 'com.example.foo2'),
+	    (3, 'Chrome Extension', 'chrome_extensions', 'chrome', NULL),
+	    (4, 'Microsoft Teams.exe', 'programs', '', NULL);
+	`
+
+	_, err := db.Exec(dataStmt)
+	require.NoError(t, err)
+	applyNext(t, db)
+
+	type softwareTitle struct {
+		Name                 string  `db:"name"`
+		Source               string  `db:"source"`
+		Browser              string  `db:"browser"`
+		BundleIdentifier     *string `db:"bundle_identifier"`
+		AdditionalIdentifier *uint32 `db:"additional_identifier"`
+	}
+
+	var titles []softwareTitle
+	err = db.Select(&titles, `SELECT name, source, browser, bundle_identifier, additional_identifier FROM software_titles`)
+	require.NoError(t, err)
+	zero := uint32(0)
+	expectedTitles := []softwareTitle{
+		{"Foo.app", "apps", "", ptr.String("com.example.foo"), &zero},
+		{"Foo2.app", "apps", "", ptr.String("com.example.foo2"), &zero},
+		{"Chrome Extension", "chrome_extensions", "chrome", nil, nil},
+		{"Microsoft Teams.exe", "programs", "", nil, nil},
+	}
+	assert.ElementsMatch(t, expectedTitles, titles)
+
+	// Ensure that the unique key is enforced
+	dataStmt = `
+	  INSERT INTO software_titles (id, name, source, browser, bundle_identifier) VALUES
+	    (100, 'Foo3', 'foo', '', 'com.example.foo');
+	`
+	_, err = db.Exec(dataStmt)
+	assert.ErrorContains(t, err, "Duplicate entry")
+
+	// Add ios and ipados apps
+	dataStmt = `
+	  INSERT INTO software_titles (id, name, source, browser, bundle_identifier) VALUES
+	    (5, 'Foo', 'ios_apps', '', 'com.example.foo'),
+	    (6, 'Foo', 'ipados_apps', '', 'com.example.foo'),
+	    (7, 'Bar-Pocket', 'ios_apps', '', 'com.example.bar-pocket'),
+	    (8, 'Bar', 'ipados_apps', '', 'com.example.bar');
+	`
+	_, err = db.Exec(dataStmt)
+	require.NoError(t, err)
+
+	err = db.Select(&titles, `SELECT name, source, browser, bundle_identifier, additional_identifier FROM software_titles`)
+	require.NoError(t, err)
+	one := uint32(1)
+	two := uint32(2)
+	expectedTitles = append(expectedTitles, []softwareTitle{
+		{"Foo", "ios_apps", "", ptr.String("com.example.foo"), &one},
+		{"Foo", "ipados_apps", "", ptr.String("com.example.foo"), &two},
+		{"Bar-Pocket", "ios_apps", "", ptr.String("com.example.bar-pocket"), &one},
+		{"Bar", "ipados_apps", "", ptr.String("com.example.bar"), &two},
+	}...)
+	assert.ElementsMatch(t, expectedTitles, titles)
+
+	// Ensure that the unique key is enforced
+	dataStmt = `
+	  INSERT INTO software_titles (id, name, source, browser, bundle_identifier) VALUES
+	    (200, 'Foo-Pocket', 'ipados_apps', '', 'com.example.foo');
+	`
+	_, err = db.Exec(dataStmt)
+	assert.ErrorContains(t, err, "Duplicate entry")
+
+}
diff --git a/server/datastore/mysql/migrations/tables/20240726100517_NanoQueueTimestampPrecision.go b/server/datastore/mysql/migrations/tables/20240726100517_NanoQueueTimestampPrecision.go
new file mode 100644
index 000000000000..6a587c3fb7e9
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240726100517_NanoQueueTimestampPrecision.go
@@ -0,0 +1,30 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240726100517, Down_20240726100517)
+}
+
+func Up_20240726100517(tx *sql.Tx) error {
+	_, err := tx.Exec(`ALTER TABLE nano_commands
+		MODIFY COLUMN created_at TIMESTAMP(6) NULL DEFAULT CURRENT_TIMESTAMP(6),
+		MODIFY COLUMN updated_at TIMESTAMP(6) NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6)`)
+	if err != nil {
+		return fmt.Errorf("failed to modify columns created_at, updated_at in nano_commands table: %w", err)
+	}
+	_, err = tx.Exec(`ALTER TABLE nano_enrollment_queue
+		MODIFY COLUMN created_at TIMESTAMP(6) NULL DEFAULT CURRENT_TIMESTAMP(6),
+		MODIFY COLUMN updated_at TIMESTAMP(6) NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6)`)
+	if err != nil {
+		return fmt.Errorf("failed to modify columns created_at, updated_at in nano_enrollment_queue table: %w", err)
+	}
+	return nil
+}
+
+func Down_20240726100517(_ *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240726100517_NanoQueueTimestampPrecision_test.go b/server/datastore/mysql/migrations/tables/20240726100517_NanoQueueTimestampPrecision_test.go
new file mode 100644
index 000000000000..928c093ab5ce
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240726100517_NanoQueueTimestampPrecision_test.go
@@ -0,0 +1,35 @@
+package tables
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240726100517(t *testing.T) {
+	db := applyUpToPrev(t)
+	applyNext(t, db)
+
+	// Create new commands
+	execNoErr(
+		t, db, `INSERT INTO nano_commands (command_uuid, request_type, command) VALUES (?, ?, ?)`, "a", "a", "<?xmla",
+	)
+	execNoErr(
+		t, db, `INSERT INTO nano_commands (command_uuid, request_type, command) VALUES (?, ?, ?)`, "b", "b", "<?xmlb",
+	)
+	execNoErr(
+		t, db, `INSERT INTO nano_commands (command_uuid, request_type, command) VALUES (?, ?, ?)`, "c", "c", "<?xmlc",
+	)
+
+	selectStmt := `SELECT created_at from nano_commands WHERE command_uuid = ? AND created_at = updated_at`
+	var item1CreatedAt, item2CreatedAt, item3CreatedAt time.Time
+	require.NoError(t, db.Get(&item1CreatedAt, selectStmt, "a"))
+	require.NoError(t, db.Get(&item2CreatedAt, selectStmt, "b"))
+	require.NoError(t, db.Get(&item3CreatedAt, selectStmt, "c"))
+	assert.NotZero(t, item1CreatedAt)
+	assert.True(t, item1CreatedAt.Before(item2CreatedAt), "item1CreatedAt: %v, item2CreatedAt: %v", item1CreatedAt, item2CreatedAt)
+	assert.True(t, item2CreatedAt.Before(item3CreatedAt), "item2CreatedAt: %v, item3CreatedAt: %v", item2CreatedAt, item3CreatedAt)
+
+}
diff --git a/server/datastore/mysql/migrations/tables/20240730171504_AddGlobalStatToVulnHostCounts.go b/server/datastore/mysql/migrations/tables/20240730171504_AddGlobalStatToVulnHostCounts.go
new file mode 100644
index 000000000000..51051a5577bf
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240730171504_AddGlobalStatToVulnHostCounts.go
@@ -0,0 +1,77 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240730171504, Down_20240730171504)
+}
+
+func Up_20240730171504(tx *sql.Tx) error {
+	stmt := `
+	ALTER TABLE vulnerability_host_counts
+	ADD COLUMN global_stats tinyint(1) NOT NULL DEFAULT 0
+	`
+	_, err := tx.Exec(stmt)
+	if err != nil {
+		return fmt.Errorf("failed to add global_stats column: %w", err)
+	}
+
+	stmt = `
+	ALTER TABLE vulnerability_host_counts
+	DROP INDEX cve_team_id
+	`
+	_, err = tx.Exec(stmt)
+	if err != nil {
+		return fmt.Errorf("failed to drop index cve_team_id: %w", err)
+	}
+
+	stmt = `
+	CREATE UNIQUE INDEX cve_team_id_global_stats
+	ON vulnerability_host_counts (cve, team_id, global_stats)
+	`
+	_, err = tx.Exec(stmt)
+	if err != nil {
+		return fmt.Errorf("failed to create index cve_team_id_global_stats: %w", err)
+	}
+
+	stmt = `
+	UPDATE vulnerability_host_counts
+	SET global_stats = 1
+	WHERE team_id = 0
+	`
+	_, err = tx.Exec(stmt)
+	if err != nil {
+		return fmt.Errorf("failed to update global_stats for team_id = 0: %w", err)
+	}
+
+	// Insert "no team" counts
+	stmt = `
+	INSERT INTO vulnerability_host_counts (cve, team_id, host_count, global_stats)
+	SELECT
+		vhc1.cve,
+		0 AS team_id,
+		GREATEST(vhc1.host_count - COALESCE(SUM(vhc2.host_count), 0), 0) AS host_count,
+		0 AS global_stats
+	FROM
+		vulnerability_host_counts vhc1
+	LEFT JOIN
+		vulnerability_host_counts vhc2 ON vhc1.cve = vhc2.cve AND vhc2.team_id != 0 AND vhc2.global_stats = 0
+	WHERE
+		vhc1.team_id = 0 AND vhc1.global_stats = 1
+	GROUP BY
+		vhc1.cve, vhc1.host_count
+	`
+	_, err = tx.Exec(stmt)
+	if err != nil {
+		return fmt.Errorf("failed to insert no team counts: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240730171504(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240730171504_AddGlobalStatToVulnHostCounts_test.go b/server/datastore/mysql/migrations/tables/20240730171504_AddGlobalStatToVulnHostCounts_test.go
new file mode 100644
index 000000000000..897c1b1525c2
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240730171504_AddGlobalStatToVulnHostCounts_test.go
@@ -0,0 +1,80 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240730171504(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	stmt := `
+	INSERT INTO vulnerability_host_counts
+	(cve, team_id, host_count)
+	VALUES (?, ?, ?)
+	`
+
+	// Insert team 1 counts
+	_, err := db.Exec(stmt, "CVE-2024-1000", 1, 5)
+	require.NoError(t, err)
+	_, err = db.Exec(stmt, "CVE-2024-2000", 1, 10)
+	require.NoError(t, err)
+	_, err = db.Exec(stmt, "CVE-2024-3000", 1, 1)
+	require.NoError(t, err)
+
+	// Insert team 2 count
+	_, err = db.Exec(stmt, "CVE-2024-1000", 2, 2)
+	require.NoError(t, err)
+	_, err = db.Exec(stmt, "CVE-2024-2000", 2, 0) // 0 count
+	require.NoError(t, err)
+	_, err = db.Exec(stmt, "CVE-2024-3000", 2, 2)
+	require.NoError(t, err)
+
+	// Insert global count
+	_, err = db.Exec(stmt, "CVE-2024-1000", 0, 10)
+	require.NoError(t, err)
+	_, err = db.Exec(stmt, "CVE-2024-2000", 0, 90)
+	require.NoError(t, err)
+	_, err = db.Exec(stmt, "CVE-2024-3000", 0, 0) // edge case, wrong count
+	require.NoError(t, err)
+
+	applyNext(t, db)
+
+	assertHostCount := func(cve string, teamID, expectedCount int, globalStat bool) {
+		t.Helper()
+		selectStmt := `
+	SELECT host_count FROM vulnerability_host_counts
+	WHERE cve = ? and team_id = ? and global_stats = ?
+	`
+
+		var count int
+		err = db.QueryRow(selectStmt, cve, teamID, globalStat).Scan(&count)
+		require.NoError(t, err)
+		require.Equal(t, expectedCount, count)
+	}
+
+	// Check team 1 counts
+	assertHostCount("CVE-2024-1000", 1, 5, false)
+	assertHostCount("CVE-2024-2000", 1, 10, false)
+	assertHostCount("CVE-2024-3000", 1, 1, false)
+
+	// Check team 2 counts
+	assertHostCount("CVE-2024-1000", 2, 2, false)
+	assertHostCount("CVE-2024-2000", 2, 0, false)
+	assertHostCount("CVE-2024-3000", 2, 2, false)
+
+	// Check global counts
+	assertHostCount("CVE-2024-1000", 0, 10, true)
+	assertHostCount("CVE-2024-2000", 0, 90, true)
+	assertHostCount("CVE-2024-3000", 0, 0, true)
+
+	// Check no team counts
+	assertHostCount("CVE-2024-1000", 0, 3, false)
+	assertHostCount("CVE-2024-2000", 0, 80, false)
+	assertHostCount("CVE-2024-3000", 0, 0, false) // edge case, wrong count should not result in negative count
+
+	// Check unique constraint violation
+	_, err = db.Exec(stmt, "CVE-2024-0717", 1, 1, 1)
+	require.Error(t, err)
+}
diff --git a/server/datastore/mysql/migrations/tables/20240730174056_AddGlobalStatToSoftwareHostCounts.go b/server/datastore/mysql/migrations/tables/20240730174056_AddGlobalStatToSoftwareHostCounts.go
new file mode 100644
index 000000000000..892dc4a4f444
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240730174056_AddGlobalStatToSoftwareHostCounts.go
@@ -0,0 +1,60 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240730174056, Down_20240730174056)
+}
+
+func Up_20240730174056(tx *sql.Tx) error {
+	stmt := `
+		ALTER TABLE software_host_counts
+		ADD COLUMN global_stats tinyint unsigned NOT NULL DEFAULT '0',
+		DROP PRIMARY KEY,
+		ADD PRIMARY KEY (software_id, team_id, global_stats)
+	`
+
+	if _, err := tx.Exec(stmt); err != nil {
+		return fmt.Errorf("add global_stats column to software_host_counts: %w", err)
+	}
+
+	// update team counts to have global_stats = 0
+	stmt = `
+		UPDATE software_host_counts
+		SET global_stats = 1
+		WHERE team_id = 0
+	`
+	if _, err := tx.Exec(stmt); err != nil {
+		return fmt.Errorf("update global_stats for team_id = 0: %w", err)
+	}
+
+	// Insert "no team" counts
+	stmt = `
+		INSERT INTO software_host_counts (software_id, hosts_count, team_id, global_stats)
+		SELECT
+			sthc1.software_id,
+			GREATEST(sthc1.hosts_count - COALESCE(SUM(sthc2.hosts_count), 0),0) AS hosts_count,
+			0 AS team_id,
+			0 AS global_stats
+		FROM
+			software_host_counts sthc1
+		LEFT JOIN
+			software_host_counts sthc2 ON sthc1.software_id = sthc2.software_id AND sthc2.team_id != 0 AND sthc2.global_stats = 0
+		WHERE
+			sthc1.team_id = 0 AND sthc1.global_stats = 1
+		GROUP BY
+			sthc1.software_id, sthc1.hosts_count
+	`
+	if _, err := tx.Exec(stmt); err != nil {
+		return fmt.Errorf("insert no team counts: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240730174056(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240730174056_AddGlobalStatToSoftwareHostCounts_test.go b/server/datastore/mysql/migrations/tables/20240730174056_AddGlobalStatToSoftwareHostCounts_test.go
new file mode 100644
index 000000000000..61c0e9d386c1
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240730174056_AddGlobalStatToSoftwareHostCounts_test.go
@@ -0,0 +1,82 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240730174056(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	stmt := "INSERT INTO `software_host_counts` (`software_id`, `hosts_count`, `team_id`) VALUES (?, ?, ?)"
+
+	s1t1 := 10
+	s2t1 := 1
+	s1t2 := 15
+	s2t2 := 3
+	s1g := 40
+	s2g := 0 // edge case where global count is incorrectly 0
+
+	// insert software 1 team 1 counts
+	_, err := db.Exec(stmt, 1, s1t1, 1)
+	require.NoError(t, err)
+
+	// insert software 2 team 1 counts
+	_, err = db.Exec(stmt, 2, s2t1, 1)
+	require.NoError(t, err)
+
+	// insert software 1 team 2 counts
+	_, err = db.Exec(stmt, 1, s1t2, 2)
+	require.NoError(t, err)
+
+	// insert software 2 team 2 counts
+	_, err = db.Exec(stmt, 2, s2t2, 2)
+	require.NoError(t, err)
+
+	// insert software 1 global counts (team_id = 0)
+	_, err = db.Exec(stmt, 1, s1g, 0)
+	require.NoError(t, err)
+
+	// insert software 2 global counts (team_id = 0)
+	_, err = db.Exec(stmt, 2, s2g, 0)
+	require.NoError(t, err)
+
+	applyNext(t, db)
+
+	// Ensure the data is still there
+	var result struct {
+		SoftwareID  uint `db:"software_id"`
+		HostsCount  int  `db:"hosts_count"`
+		TeamID      uint `db:"team_id"`
+		GlobalStats bool `db:"global_stats"`
+	}
+	assertHostCount := func(softwareID, hostsCount int, teamID uint, globalStats bool) {
+		t.Helper()
+		res := db.QueryRow("SELECT `software_id`, `hosts_count`, `team_id`, `global_stats` FROM `software_host_counts` WHERE `software_id` = ? AND `team_id` = ? AND global_stats = ?", softwareID, teamID, globalStats)
+		err = res.Scan(&result.SoftwareID, &result.HostsCount, &result.TeamID, &result.GlobalStats)
+		require.NoError(t, err)
+		require.Equal(t, softwareID, int(result.SoftwareID))
+		require.Equal(t, hostsCount, result.HostsCount)
+		require.Equal(t, teamID, result.TeamID)
+		require.Equal(t, globalStats, result.GlobalStats)
+	}
+
+	// software 1 team 1
+	assertHostCount(1, s1t1, 1, false)
+	// software 1 team 2
+	assertHostCount(1, s1t2, 2, false)
+	// software 1 global
+	assertHostCount(1, s1g, 0, true)
+	// software 1 no team
+	assertHostCount(1, s1g-s1t1-s1t2, 0, false)
+
+	// software 2 team 1
+	assertHostCount(2, s2t1, 1, false)
+	// software 2 team 2
+	assertHostCount(2, s2t2, 2, false)
+	// software 2 global
+	assertHostCount(2, s2g, 0, true)
+	// software 2 no team
+	assertHostCount(2, 0, 0, false) // edge case where there should be no negative counts
+}
diff --git a/server/datastore/mysql/migrations/tables/20240730215453_AddGlobalStatToSoftwareTitleHostCounts.go b/server/datastore/mysql/migrations/tables/20240730215453_AddGlobalStatToSoftwareTitleHostCounts.go
new file mode 100644
index 000000000000..f20c39e94ba3
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240730215453_AddGlobalStatToSoftwareTitleHostCounts.go
@@ -0,0 +1,60 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240730215453, Down_20240730215453)
+}
+
+func Up_20240730215453(tx *sql.Tx) error {
+	stmt := `
+		ALTER TABLE software_titles_host_counts
+		ADD COLUMN global_stats tinyint unsigned NOT NULL DEFAULT '0',
+		DROP PRIMARY KEY,
+		ADD PRIMARY KEY (software_title_id, team_id, global_stats)
+	`
+
+	if _, err := tx.Exec(stmt); err != nil {
+		return fmt.Errorf("add global_stats column to software_titles_host_counts: %w", err)
+	}
+
+	// update team counts to have global_stats = 0
+	stmt = `
+		UPDATE software_titles_host_counts
+		SET global_stats = 1
+		WHERE team_id = 0
+	`
+	if _, err := tx.Exec(stmt); err != nil {
+		return fmt.Errorf("update global_stats for team_id = 0: %w", err)
+	}
+
+	// Insert "no team" counts
+	stmt = `
+		INSERT INTO software_titles_host_counts (software_title_id, hosts_count, team_id, global_stats)
+		SELECT
+			sthc1.software_title_id,
+			GREATEST(sthc1.hosts_count - COALESCE(SUM(sthc2.hosts_count), 0),0) AS hosts_count,
+			0 AS team_id,
+			0 AS global_stats
+		FROM
+			software_titles_host_counts sthc1
+		LEFT JOIN
+			software_titles_host_counts sthc2 ON sthc1.software_title_id = sthc2.software_title_id AND sthc2.team_id != 0 AND sthc2.global_stats = 0
+		WHERE
+			sthc1.team_id = 0 AND sthc1.global_stats = 1
+		GROUP BY
+			sthc1.software_title_id, sthc1.hosts_count
+	`
+	if _, err := tx.Exec(stmt); err != nil {
+		return fmt.Errorf("insert no team counts: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240730215453(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240730215453_AddGlobalStatToSoftwareTitleHostCounts_test.go b/server/datastore/mysql/migrations/tables/20240730215453_AddGlobalStatToSoftwareTitleHostCounts_test.go
new file mode 100644
index 000000000000..050f5a82e6d6
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240730215453_AddGlobalStatToSoftwareTitleHostCounts_test.go
@@ -0,0 +1,82 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240730215453(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	stmt := "INSERT INTO `software_titles_host_counts` (`software_title_id`, `hosts_count`, `team_id`) VALUES (?, ?, ?)"
+
+	s1t1 := 10
+	s2t1 := 1
+	s1t2 := 15
+	s2t2 := 3
+	s1g := 40
+	s2g := 0 // edge case where global count is incorrectly 0
+
+	// insert software 1 team 1 counts
+	_, err := db.Exec(stmt, 1, s1t1, 1)
+	require.NoError(t, err)
+
+	// insert software 2 team 1 counts
+	_, err = db.Exec(stmt, 2, s2t1, 1)
+	require.NoError(t, err)
+
+	// insert software 1 team 2 counts
+	_, err = db.Exec(stmt, 1, s1t2, 2)
+	require.NoError(t, err)
+
+	// insert software 2 team 2 counts
+	_, err = db.Exec(stmt, 2, s2t2, 2)
+	require.NoError(t, err)
+
+	// insert software 1 global counts (team_id = 0)
+	_, err = db.Exec(stmt, 1, s1g, 0)
+	require.NoError(t, err)
+
+	// insert software 2 global counts (team_id = 0)
+	_, err = db.Exec(stmt, 2, s2g, 0)
+	require.NoError(t, err)
+
+	applyNext(t, db)
+
+	// Ensure the data is still there
+	var result struct {
+		SoftwareID  uint `db:"software_title_id"`
+		HostsCount  int  `db:"hosts_count"`
+		TeamID      uint `db:"team_id"`
+		GlobalStats bool `db:"global_stats"`
+	}
+	assertHostCount := func(softwareID, hostsCount int, teamID uint, globalStats bool) {
+		t.Helper()
+		res := db.QueryRow("SELECT `software_title_id`, `hosts_count`, `team_id`, `global_stats` FROM `software_titles_host_counts` WHERE `software_title_id` = ? AND `team_id` = ? AND global_stats = ?", softwareID, teamID, globalStats)
+		err = res.Scan(&result.SoftwareID, &result.HostsCount, &result.TeamID, &result.GlobalStats)
+		require.NoError(t, err)
+		require.Equal(t, softwareID, int(result.SoftwareID))
+		require.Equal(t, hostsCount, result.HostsCount)
+		require.Equal(t, teamID, result.TeamID)
+		require.Equal(t, globalStats, result.GlobalStats)
+	}
+
+	// software 1 team 1
+	assertHostCount(1, s1t1, 1, false)
+	// software 1 team 2
+	assertHostCount(1, s1t2, 2, false)
+	// software 1 global
+	assertHostCount(1, s1g, 0, true)
+	// software 1 no team
+	assertHostCount(1, s1g-s1t1-s1t2, 0, false)
+
+	// software 2 team 1
+	assertHostCount(2, s2t1, 1, false)
+	// software 2 team 2
+	assertHostCount(2, s2t2, 2, false)
+	// software 2 global
+	assertHostCount(2, s2g, 0, true)
+	// software 2 no team
+	assertHostCount(2, 0, 0, false) // edge case where global count should not be negative
+}
diff --git a/server/datastore/mysql/migrations/tables/20240730374423_AddPlatformToVPPApps.go b/server/datastore/mysql/migrations/tables/20240730374423_AddPlatformToVPPApps.go
new file mode 100644
index 000000000000..71bb7fa12935
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240730374423_AddPlatformToVPPApps.go
@@ -0,0 +1,83 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240730374423, Down_20240730374423)
+}
+
+func Up_20240730374423(tx *sql.Tx) error {
+	if columnExists(tx, "vpp_apps", "platform") && columnExists(tx, "vpp_apps_teams", "platform") {
+		return nil
+	}
+
+	_, err := tx.Exec(`
+		ALTER TABLE vpp_apps
+		ADD COLUMN platform VARCHAR(10) COLLATE utf8mb4_unicode_ci NOT NULL`)
+	if err != nil {
+		return fmt.Errorf("adding platform to vpp_apps: %w", err)
+	}
+
+	_, err = tx.Exec(`UPDATE vpp_apps SET platform = ?, updated_at = updated_at`, fleet.MacOSPlatform)
+	if err != nil {
+		return fmt.Errorf("updating platform in vpp_apps: %w", err)
+	}
+
+	// Drop foreign keys first so they don't interfere with updating primary key.
+	_, err = tx.Exec(`ALTER TABLE vpp_apps_teams DROP FOREIGN KEY vpp_apps_teams_ibfk_1`)
+	if err != nil {
+		return fmt.Errorf("updating foreign key in vpp_apps: %w", err)
+	}
+
+	// We drop this foreign key in this migration (for MySQL 8.4). It will be added back in the next migration.
+	_, err = tx.Exec(`
+		ALTER TABLE host_vpp_software_installs DROP FOREIGN KEY host_vpp_software_installs_ibfk_2`)
+	if err != nil {
+		return fmt.Errorf("drop foreign key in host_vpp_software_installs: %w", err)
+	}
+
+	_, err = tx.Exec(`ALTER TABLE vpp_apps DROP PRIMARY KEY, ADD PRIMARY KEY (adam_id, platform)`)
+	if err != nil {
+		return fmt.Errorf("updating primary key in vpp_apps: %w", err)
+	}
+
+	_, err = tx.Exec(`
+		ALTER TABLE vpp_apps_teams
+		ADD COLUMN platform VARCHAR(10) COLLATE utf8mb4_unicode_ci NOT NULL`)
+	if err != nil {
+		return fmt.Errorf("adding platform to vpp_apps_teams: %w", err)
+	}
+
+	_, err = tx.Exec(`UPDATE vpp_apps_teams SET platform = ?`, fleet.MacOSPlatform)
+	if err != nil {
+		return fmt.Errorf("updating platform in vpp_apps_teams: %w", err)
+	}
+
+	_, err = tx.Exec(`ALTER TABLE vpp_apps_teams DROP INDEX idx_global_or_team_id_adam_id`)
+	if err != nil {
+		return fmt.Errorf("dropping unique key in vpp_apps: %w", err)
+	}
+	_, err = tx.Exec(`ALTER TABLE vpp_apps_teams ADD UNIQUE KEY idx_global_or_team_id_adam_id (global_or_team_id, adam_id, platform)`)
+	if err != nil {
+		return fmt.Errorf("adding unique key in vpp_apps: %w", err)
+	}
+	_, err = tx.Exec(`ALTER TABLE vpp_apps_teams DROP INDEX adam_id, ADD INDEX (adam_id, platform)`)
+	if err != nil {
+		return fmt.Errorf("updating key in vpp_apps: %w", err)
+	}
+	_, err = tx.Exec(`ALTER TABLE vpp_apps_teams ADD FOREIGN KEY vpp_apps_teams_ibfk_3 (adam_id, platform) REFERENCES vpp_apps (adam_id, platform) ON DELETE CASCADE`)
+	if err != nil {
+		return fmt.Errorf("updating foreign key in vpp_apps: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240730374423(_ *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240730374423_AddPlatformToVPPApps_test.go b/server/datastore/mysql/migrations/tables/20240730374423_AddPlatformToVPPApps_test.go
new file mode 100644
index 000000000000..046bbbeccd41
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240730374423_AddPlatformToVPPApps_test.go
@@ -0,0 +1,42 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240730374423(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	adamID := "a"
+	execNoErr(
+		t, db, `INSERT INTO vpp_apps (adam_id) VALUES (?)`, adamID,
+	)
+
+	vppAppsID := 1
+	execNoErr(
+		t, db, `INSERT INTO vpp_apps_teams (id, adam_id) VALUES (?,?)`, vppAppsID, adamID,
+	)
+
+	// Apply current migration.
+	applyNext(t, db)
+
+	var platform fleet.AppleDevicePlatform
+	require.NoError(t, db.Get(&platform, `SELECT platform FROM vpp_apps WHERE adam_id = ?`, adamID))
+	assert.Equal(t, fleet.MacOSPlatform, platform)
+
+	require.NoError(t, db.Get(&platform, `SELECT platform FROM vpp_apps_teams WHERE adam_id = ?`, adamID))
+	assert.Equal(t, fleet.MacOSPlatform, platform)
+
+	// Try to insert the same adam_id again but for a different platform.
+	execNoErr(
+		t, db, `INSERT INTO vpp_apps (adam_id, platform) VALUES (?,?)`, adamID, fleet.IOSPlatform,
+	)
+	execNoErr(
+		t, db, `INSERT INTO vpp_apps_teams (id, adam_id, platform) VALUES (?,?,?)`, vppAppsID+1, adamID, fleet.IOSPlatform,
+	)
+
+}
diff --git a/server/datastore/mysql/migrations/tables/20240801115359_AddPlatformToHostVPPSoftwareInstalls.go b/server/datastore/mysql/migrations/tables/20240801115359_AddPlatformToHostVPPSoftwareInstalls.go
new file mode 100644
index 000000000000..aadd49fe80b6
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240801115359_AddPlatformToHostVPPSoftwareInstalls.go
@@ -0,0 +1,67 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240801115359, Down_20240801115359)
+}
+
+func Up_20240801115359(tx *sql.Tx) error {
+	if columnExists(tx, "host_vpp_software_installs", "platform") {
+		return nil
+	}
+
+	_, err := tx.Exec(`
+		ALTER TABLE host_vpp_software_installs
+		ADD COLUMN platform VARCHAR(10) COLLATE utf8mb4_unicode_ci NOT NULL`)
+	if err != nil {
+		return fmt.Errorf("adding platform to host_vpp_software_installs: %w", err)
+	}
+
+	updateStmt := `
+		UPDATE host_vpp_software_installs hvsi INNER JOIN hosts h ON h.id = hvsi.host_id
+		SET hvsi.platform = h.platform, hvsi.updated_at = hvsi.updated_at`
+
+	_, err = tx.Exec(updateStmt)
+	if err != nil {
+		return fmt.Errorf("updating platform in host_vpp_software_installs: %w", err)
+	}
+
+	// Since hosts may be missing, we need to update the platform for records that were not updated
+	updateStmt2 := `
+		UPDATE host_vpp_software_installs hvsi INNER JOIN vpp_apps vap ON vap.adam_id = hvsi.adam_id
+		SET hvsi.platform = vap.platform, hvsi.updated_at = hvsi.updated_at
+		WHERE hvsi.platform = ''`
+
+	_, err = tx.Exec(updateStmt2)
+	if err != nil {
+		return fmt.Errorf("updating platform in host_vpp_software_installs part 2: %w", err)
+	}
+
+	_, err = tx.Exec(`ALTER TABLE host_vpp_software_installs DROP INDEX adam_id, ADD INDEX (adam_id, platform)`)
+	if err != nil {
+		return fmt.Errorf("updating key in host_vpp_software_installs: %w", err)
+	}
+	if indexExistsTx(tx, "host_vpp_software_installs", "host_vpp_software_installs_ibfk_2") {
+		_, err = tx.Exec(`
+		ALTER TABLE host_vpp_software_installs DROP FOREIGN KEY host_vpp_software_installs_ibfk_2`)
+		if err != nil {
+			return fmt.Errorf("updating foreign key in host_vpp_software_installs: %w", err)
+		}
+	}
+	_, err = tx.Exec(`
+		ALTER TABLE host_vpp_software_installs
+			ADD CONSTRAINT host_vpp_software_installs_ibfk_3 FOREIGN KEY (adam_id, platform) REFERENCES vpp_apps (adam_id, platform) ON DELETE CASCADE`)
+	if err != nil {
+		return fmt.Errorf("updating foreign key in host_vpp_software_installs: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240801115359(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240801115359_AddPlatformToHostVPPSoftwareInstalls_test.go b/server/datastore/mysql/migrations/tables/20240801115359_AddPlatformToHostVPPSoftwareInstalls_test.go
new file mode 100644
index 000000000000..98a5a19f26cc
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240801115359_AddPlatformToHostVPPSoftwareInstalls_test.go
@@ -0,0 +1,68 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240801115359(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	// Create user
+	u1 := execNoErrLastID(t, db, `INSERT INTO users (name, email, password, salt) VALUES (?, ?, ?, ?)`, "u1", "u1@b.c", "1234", "salt")
+	// Create host
+	insertHostStmt := `
+		INSERT INTO hosts (
+			hostname, uuid, platform, osquery_version, os_version, build, platform_like, code_name,
+			cpu_type, cpu_subtype, cpu_brand, hardware_vendor, hardware_model, hardware_version,
+			hardware_serial, computer_name, team_id
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`
+	hostName := "Dummy Hostname"
+	hostUUID := "12345678-1234-1234-1234-123456789012"
+	hostPlatform := "ios"
+	osqueryVer := "5.9.1"
+	osVersion := "Windows 10"
+	buildVersion := "10.0.19042.1234"
+	platformLike := "apple"
+	codeName := "20H2"
+	cpuType := "x86_64"
+	cpuSubtype := "x86_64"
+	cpuBrand := "Intel"
+	hwVendor := "Dell Inc."
+	hwModel := "OptiPlex 7090"
+	hwVersion := "1.0"
+	hwSerial := "ABCDEFGHIJ"
+	computerName := "DESKTOP-TEST"
+
+	hostID := execNoErrLastID(t, db, insertHostStmt, hostName, hostUUID, hostPlatform, osqueryVer,
+		osVersion, buildVersion, platformLike, codeName, cpuType, cpuSubtype, cpuBrand, hwVendor, hwModel, hwVersion, hwSerial, computerName, nil)
+	hostIDMissing := hostID + 1
+
+	// Create VPP app
+	adamID := "a"
+	execNoErr(
+		t, db, `INSERT INTO vpp_apps (adam_id, platform) VALUES (?,?)`, adamID, hostPlatform,
+	)
+	// Create another VPP app for a different platform
+	execNoErr(
+		t, db, `INSERT INTO vpp_apps (adam_id, platform) VALUES (?,?)`, adamID, "unused",
+	)
+
+	// create an install on a known host
+	hvsi1 := execNoErrLastID(t, db, `INSERT INTO host_vpp_software_installs (host_id, adam_id, command_uuid, user_id) VALUES (?,?,?,?)`, hostID, adamID, "command_uuid", u1)
+	// create an install on a missing host
+	hvsi2 := execNoErrLastID(t, db, `INSERT INTO host_vpp_software_installs (host_id, adam_id, command_uuid, user_id) VALUES (?,?,?,?)`, hostIDMissing, adamID, "command_uuid2", u1)
+
+	// Apply current migration.
+	applyNext(t, db)
+
+	// Check that the platform column was updated.
+	var platformResp string
+	require.NoError(t, db.Get(&platformResp, `SELECT platform FROM host_vpp_software_installs WHERE id = ?`, hvsi1))
+	assert.Equal(t, hostPlatform, platformResp)
+	require.NoError(t, db.Get(&platformResp, `SELECT platform FROM host_vpp_software_installs WHERE id = ?`, hvsi2))
+	assert.Equal(t, hostPlatform, platformResp)
+}
diff --git a/server/datastore/mysql/migrations/tables/20240802101043_AddSoftwareInstallResultDeletedAt.go b/server/datastore/mysql/migrations/tables/20240802101043_AddSoftwareInstallResultDeletedAt.go
new file mode 100644
index 000000000000..b5f7e792139d
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240802101043_AddSoftwareInstallResultDeletedAt.go
@@ -0,0 +1,39 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240802101043, Down_20240802101043)
+}
+
+// This is a new copy of a previous out-of-order migration
+func Up_20240802101043(tx *sql.Tx) error {
+	_, err := tx.Exec("ALTER TABLE host_software_installs ADD COLUMN host_deleted_at timestamp NULL DEFAULT NULL")
+	if err != nil {
+		return fmt.Errorf("failed to create host_deleted_at column on host_software_installs table: %w", err)
+	}
+	_, err = tx.Exec(`
+UPDATE
+    host_software_installs i
+LEFT JOIN
+    hosts h
+    ON i.host_id = h.id
+SET
+    i.host_deleted_at = NOW()
+WHERE
+    i.host_deleted_at IS NULL
+AND
+    h.id IS NULL
+`)
+	if err != nil {
+		return fmt.Errorf("failed to update host_software_installs.host_deleted_at for hosts that no longer exist: %w", err)
+	}
+	return nil
+}
+
+func Down_20240802101043(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240802113716_UpdateSoftwareGitopsConfig.go b/server/datastore/mysql/migrations/tables/20240802113716_UpdateSoftwareGitopsConfig.go
new file mode 100644
index 000000000000..c91e99099ec4
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240802113716_UpdateSoftwareGitopsConfig.go
@@ -0,0 +1,67 @@
+package tables
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"reflect"
+
+	"github.com/jmoiron/sqlx"
+	"github.com/jmoiron/sqlx/reflectx"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240802113716, Down_20240802113716)
+}
+
+func Up_20240802113716(tx *sql.Tx) error {
+	txx := sqlx.Tx{Tx: tx, Mapper: reflectx.NewMapperFunc("db", sqlx.NameMapper)}
+
+	type row struct {
+		Config json.RawMessage `db:"config"`
+		ID     uint            `db:"id"`
+	}
+
+	var rows []row
+	if err := txx.Select(&rows, "SELECT config, id FROM teams"); err != nil {
+		return fmt.Errorf("selecting team configs: %w", err)
+	}
+
+	for _, r := range rows {
+
+		config := make(map[string]any)
+		if err := json.Unmarshal(r.Config, &config); err != nil {
+			return fmt.Errorf("unmarshal team config: %w", err)
+		}
+		softwareData, ok := config["software"]
+		if !ok {
+			continue
+		}
+
+		rt := reflect.TypeOf(config["software"])
+		if rt == nil {
+			continue
+		}
+
+		if rt.Kind() == reflect.Slice {
+			// then we have an older config without the new fields
+			// Note: we are setting the new key to be whatever the old key was (if it was null, then
+			// it's set to null, if it was empty array, then it's set to empty array)
+			config["software"] = map[string]any{"packages": softwareData}
+			b, err := json.Marshal(config)
+			if err != nil {
+				return fmt.Errorf("marshal updated team config: %w", err)
+			}
+			if _, err := tx.Exec(`UPDATE teams SET config = ? WHERE id = ?`, b, r.ID); err != nil {
+				return fmt.Errorf("updating config for team %d: %w", r.ID, err)
+			}
+		}
+
+	}
+
+	return nil
+}
+
+func Down_20240802113716(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240802113716_UpdateSoftwareGitopsConfig_test.go b/server/datastore/mysql/migrations/tables/20240802113716_UpdateSoftwareGitopsConfig_test.go
new file mode 100644
index 000000000000..0bd2edcab403
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240802113716_UpdateSoftwareGitopsConfig_test.go
@@ -0,0 +1,268 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240802113716(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	badCfg := `
+{
+  "mdm": {
+    "ios_updates": {
+      "deadline": "",
+      "minimum_version": ""
+    },
+    "macos_setup": {
+      "bootstrap_package": "",
+      "macos_setup_assistant": "",
+      "enable_end_user_authentication": false,
+      "enable_release_device_manually": false
+    },
+    "macos_updates": {
+      "deadline": "",
+      "minimum_version": ""
+    },
+    "ipados_updates": {
+      "deadline": "",
+      "minimum_version": ""
+    },
+    "macos_settings": {
+      "custom_settings": []
+    },
+    "windows_updates": {
+      "deadline_days": null,
+      "grace_period_days": null
+    },
+    "windows_settings": {
+      "custom_settings": []
+    },
+    "enable_disk_encryption": false
+  },
+  "scripts": [],
+  "features": {
+    "enable_host_users": true,
+    "enable_software_inventory": true
+  },
+  "software": [
+      {
+        "url": "http://localhost:8100/1Password.pkg",
+        "self_service": true,
+        "install_script": {
+          "path": ""
+        },
+        "pre_install_query": {
+          "path": ""
+        },
+        "post_install_script": {
+          "path": ""
+        }
+      }
+    ],
+  "integrations": {
+    "jira": null,
+    "zendesk": null,
+    "google_calendar": {
+      "webhook_url": "",
+      "enable_calendar_events": false
+    }
+  },
+  "webhook_settings": {
+    "host_status_webhook": {
+      "days_count": 0,
+      "destination_url": "",
+      "host_percentage": 0,
+      "enable_host_status_webhook": false
+    },
+    "failing_policies_webhook": {
+      "policy_ids": null,
+      "destination_url": "",
+      "host_batch_size": 0,
+      "enable_failing_policies_webhook": false
+    }
+  },
+  "host_expiry_settings": {
+    "host_expiry_window": 30,
+    "host_expiry_enabled": true
+  }
+}
+
+`
+
+	badCfgEmptyArr := `
+{
+  "mdm": {
+    "ios_updates": {
+      "deadline": "",
+      "minimum_version": ""
+    },
+    "macos_setup": {
+      "bootstrap_package": "",
+      "macos_setup_assistant": "",
+      "enable_end_user_authentication": false,
+      "enable_release_device_manually": false
+    },
+    "macos_updates": {
+      "deadline": "",
+      "minimum_version": ""
+    },
+    "ipados_updates": {
+      "deadline": "",
+      "minimum_version": ""
+    },
+    "macos_settings": {
+      "custom_settings": []
+    },
+    "windows_updates": {
+      "deadline_days": null,
+      "grace_period_days": null
+    },
+    "windows_settings": {
+      "custom_settings": []
+    },
+    "enable_disk_encryption": false
+  },
+  "scripts": [],
+  "features": {
+    "enable_host_users": true,
+    "enable_software_inventory": true
+  },
+  "software": [],
+  "integrations": {
+    "jira": null,
+    "zendesk": null,
+    "google_calendar": {
+      "webhook_url": "",
+      "enable_calendar_events": false
+    }
+  },
+  "webhook_settings": {
+    "host_status_webhook": {
+      "days_count": 0,
+      "destination_url": "",
+      "host_percentage": 0,
+      "enable_host_status_webhook": false
+    },
+    "failing_policies_webhook": {
+      "policy_ids": null,
+      "destination_url": "",
+      "host_batch_size": 0,
+      "enable_failing_policies_webhook": false
+    }
+  },
+  "host_expiry_settings": {
+    "host_expiry_window": 30,
+    "host_expiry_enabled": true
+  }
+}
+`
+
+	badCfgNoSoftwareField := `
+{
+  "mdm": {
+    "ios_updates": {
+      "deadline": "",
+      "minimum_version": ""
+    },
+    "macos_setup": {
+      "bootstrap_package": "",
+      "macos_setup_assistant": "",
+      "enable_end_user_authentication": false,
+      "enable_release_device_manually": false
+    },
+    "macos_updates": {
+      "deadline": "",
+      "minimum_version": ""
+    },
+    "ipados_updates": {
+      "deadline": "",
+      "minimum_version": ""
+    },
+    "macos_settings": {
+      "custom_settings": []
+    },
+    "windows_updates": {
+      "deadline_days": null,
+      "grace_period_days": null
+    },
+    "windows_settings": {
+      "custom_settings": []
+    },
+    "enable_disk_encryption": false
+  },
+  "scripts": [],
+  "features": {
+    "enable_host_users": true,
+    "enable_software_inventory": true
+  },
+  "integrations": {
+    "jira": null,
+    "zendesk": null,
+    "google_calendar": {
+      "webhook_url": "",
+      "enable_calendar_events": false
+    }
+  },
+  "webhook_settings": {
+    "host_status_webhook": {
+      "days_count": 0,
+      "destination_url": "",
+      "host_percentage": 0,
+      "enable_host_status_webhook": false
+    },
+    "failing_policies_webhook": {
+      "policy_ids": null,
+      "destination_url": "",
+      "host_batch_size": 0,
+      "enable_failing_policies_webhook": false
+    }
+  },
+  "host_expiry_settings": {
+    "host_expiry_window": 30,
+    "host_expiry_enabled": true
+  }
+}
+`
+
+	tid1 := execNoErrLastID(t, db, `INSERT INTO teams (name, config) VALUES (?,?)`, "team 1", badCfg)
+	tid2 := execNoErrLastID(t, db, `INSERT INTO teams (name, config) VALUES (?,?)`, "team 2", badCfgEmptyArr)
+	tid3 := execNoErrLastID(t, db, `INSERT INTO teams (name, config) VALUES (?,?)`, "team 3", badCfgNoSoftwareField)
+
+	// Apply current migration.
+	applyNext(t, db)
+
+	var team fleet.Team
+	require.NoError(t, db.Get(&team, "SELECT id, config FROM teams WHERE id = ?", tid1))
+
+	// Team with a package should see it in the new field
+	require.NotNil(t, team.Config.Software)
+	require.True(t, team.Config.Software.Packages.Set)
+	require.True(t, team.Config.Software.Packages.Valid)
+	require.Len(t, team.Config.Software.Packages.Value, 1)
+
+	require.False(t, team.Config.Software.AppStoreApps.Set)
+	require.False(t, team.Config.Software.AppStoreApps.Valid)
+	require.Len(t, team.Config.Software.AppStoreApps.Value, 0)
+
+	team = fleet.Team{}
+	require.NoError(t, db.Get(&team, "SELECT id, config FROM teams WHERE id = ?", tid2))
+
+	// Team with an empty array originally should have JSON null set for packages
+	require.NotNil(t, team.Config.Software)
+	require.True(t, team.Config.Software.Packages.Set)
+	require.True(t, team.Config.Software.Packages.Valid)
+	require.Len(t, team.Config.Software.Packages.Value, 0)
+
+	require.False(t, team.Config.Software.AppStoreApps.Set)
+	require.False(t, team.Config.Software.AppStoreApps.Valid)
+	require.Len(t, team.Config.Software.AppStoreApps.Value, 0)
+
+	team = fleet.Team{}
+	require.NoError(t, db.Get(&team, "SELECT id, config FROM teams WHERE id = ?", tid3))
+
+	require.Nil(t, team.Config.Software)
+}
diff --git a/server/datastore/mysql/migrations/tables/20240814135330_AddIndexToQueryResults.go b/server/datastore/mysql/migrations/tables/20240814135330_AddIndexToQueryResults.go
new file mode 100644
index 000000000000..6a2101380640
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240814135330_AddIndexToQueryResults.go
@@ -0,0 +1,22 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240814135330, Down_20240814135330)
+}
+
+func Up_20240814135330(tx *sql.Tx) error {
+	// This index optimizes finding the most recent query result for a given query and host
+	if _, err := tx.Exec(`ALTER TABLE query_results ADD INDEX idx_query_id_host_id_last_fetched (query_id, host_id, last_fetched)`); err != nil {
+		return fmt.Errorf("creating query_results index: %w", err)
+	}
+	return nil
+}
+
+func Down_20240814135330(_ *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240814135330_AddIndexToQueryResults_test.go b/server/datastore/mysql/migrations/tables/20240814135330_AddIndexToQueryResults_test.go
new file mode 100644
index 000000000000..74afe0c49b8a
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240814135330_AddIndexToQueryResults_test.go
@@ -0,0 +1,27 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240814135330(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	// Apply current migration
+	applyNext(t, db)
+
+	// Check if the index exists
+	var indexExists bool
+	err := db.QueryRow(`
+		SELECT 1 FROM information_schema.statistics
+		WHERE table_schema = DATABASE()
+		AND table_name = 'query_results'
+		AND index_name = 'idx_query_id_host_id_last_fetched'
+	`).Scan(&indexExists)
+
+	require.NoError(t, err)
+	require.True(t, indexExists, "Index idx_query_id_host_id_last_fetched should exist")
+
+}
diff --git a/server/datastore/mysql/migrations/tables/20240815000000_AddJobsIndex.go b/server/datastore/mysql/migrations/tables/20240815000000_AddJobsIndex.go
new file mode 100644
index 000000000000..5af70f0154a7
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240815000000_AddJobsIndex.go
@@ -0,0 +1,21 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240815000000, Down_20240815000000)
+}
+
+func Up_20240815000000(tx *sql.Tx) error {
+	if _, err := tx.Exec(`CREATE INDEX idx_jobs_state_not_before_updated_at ON jobs (state, not_before, updated_at);`); err != nil {
+		return fmt.Errorf("creating jobs index: %w", err)
+	}
+	return nil
+}
+
+func Down_20240815000000(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240815000000_AddJobsIndex_test.go b/server/datastore/mysql/migrations/tables/20240815000000_AddJobsIndex_test.go
new file mode 100644
index 000000000000..bc923ad3a659
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240815000000_AddJobsIndex_test.go
@@ -0,0 +1,27 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240815000000(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	// Apply current migration
+	applyNext(t, db)
+
+	// Check if the index exists
+	var indexExists bool
+	err := db.QueryRow(`
+		SELECT 1 FROM information_schema.statistics
+		WHERE table_schema = DATABASE()
+		AND table_name = 'jobs'
+		AND index_name = 'idx_jobs_state_not_before_updated_at'
+	`).Scan(&indexExists)
+
+	require.NoError(t, err)
+	require.True(t, indexExists, "Index idx_jobs_state_not_before_updated_at should exist")
+
+}
diff --git a/server/datastore/mysql/migrations/tables/20240815000001_AddSelfServiceToVPPAppsTeams.go b/server/datastore/mysql/migrations/tables/20240815000001_AddSelfServiceToVPPAppsTeams.go
new file mode 100644
index 000000000000..83333db387ef
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240815000001_AddSelfServiceToVPPAppsTeams.go
@@ -0,0 +1,21 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240815000001, Down_20240815000001)
+}
+
+func Up_20240815000001(tx *sql.Tx) error {
+	if _, err := tx.Exec("ALTER TABLE vpp_apps_teams ADD COLUMN self_service bool NOT NULL DEFAULT false"); err != nil {
+		return fmt.Errorf("Failed to add self_service to vpp_apps_teams: %w", err)
+	}
+	return nil
+}
+
+func Down_20240815000001(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240816103247_AddIndexToNanoUsers.go b/server/datastore/mysql/migrations/tables/20240816103247_AddIndexToNanoUsers.go
new file mode 100644
index 000000000000..28ffb331ec55
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240816103247_AddIndexToNanoUsers.go
@@ -0,0 +1,27 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240816103247, Down_20240816103247)
+}
+
+func Up_20240816103247(tx *sql.Tx) error {
+
+	// This constraint is required for MySQL 8.4.2 because nano_enrollments foreign key expects nano_users.id to be unique.
+	if !indexExistsTx(tx, "nano_users", "idx_unique_id") {
+		_, err := tx.Exec(`ALTER TABLE nano_users ADD CONSTRAINT idx_unique_id UNIQUE (id)`)
+		if err != nil {
+			return fmt.Errorf("adding unique index to nano_users: %w", err)
+		}
+	}
+
+	return nil
+}
+
+func Down_20240816103247(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240816103247_AddIndexToNanoUsers_test.go b/server/datastore/mysql/migrations/tables/20240816103247_AddIndexToNanoUsers_test.go
new file mode 100644
index 000000000000..f63bcf2995f6
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240816103247_AddIndexToNanoUsers_test.go
@@ -0,0 +1,26 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240816103247(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	// Apply current migration
+	applyNext(t, db)
+
+	// Check if the index exists
+	var indexExists bool
+	err := db.QueryRow(`
+		SELECT 1 FROM information_schema.statistics
+		WHERE table_schema = DATABASE()
+		AND table_name = 'nano_users'
+		AND index_name = 'idx_unique_id'
+	`).Scan(&indexExists)
+
+	require.NoError(t, err)
+	require.True(t, indexExists, "Index idx_unique_id should exist")
+}
diff --git a/server/datastore/mysql/migrations/tables/20240820091218_AddHostMDMCommands.go b/server/datastore/mysql/migrations/tables/20240820091218_AddHostMDMCommands.go
new file mode 100644
index 000000000000..5ab9a7e79178
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240820091218_AddHostMDMCommands.go
@@ -0,0 +1,37 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240820091218, Down_20240820091218)
+}
+
+func Up_20240820091218(tx *sql.Tx) error {
+	if tableExists(tx, "host_mdm_commands") {
+		return nil
+	}
+
+	_, err := tx.Exec(`
+-- This table is used to track the MDM commands that have been sent to a host.
+-- For example, if 'refetch apps' command was already sent to a host, we don't want
+-- to send it again.
+CREATE TABLE host_mdm_commands (
+	host_id int unsigned NOT NULL,
+	command_type VARCHAR(31) COLLATE utf8mb4_unicode_ci NOT NULL,
+	created_at TIMESTAMP(6) DEFAULT CURRENT_TIMESTAMP(6),
+	updated_at TIMESTAMP(6) NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+	PRIMARY KEY (host_id, command_type)
+)`)
+	if err != nil {
+		return fmt.Errorf("failed to create table host_mdm_commands: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240820091218(_ *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240826111228_AdjustHostIndexes.go b/server/datastore/mysql/migrations/tables/20240826111228_AdjustHostIndexes.go
new file mode 100644
index 000000000000..e6ceeae9d1fa
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240826111228_AdjustHostIndexes.go
@@ -0,0 +1,41 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240826111228, Down_20240826111228)
+}
+
+func Up_20240826111228(tx *sql.Tx) error {
+	_, err := tx.Exec(`
+	    ALTER TABLE hosts
+	    DROP INDEX host_ip_mac_search
+	`)
+	if err != nil {
+		return fmt.Errorf("dropping host_ip_mac_search index: %w", err)
+	}
+
+	_, err = tx.Exec(`
+	    ALTER TABLE hosts
+	    DROP INDEX hosts_search
+	`)
+	if err != nil {
+		return fmt.Errorf("dropping hosts_search index: %w", err)
+	}
+
+	_, err = tx.Exec(`
+	    ALTER TABLE hosts
+	    ADD INDEX idx_hosts_uuid (uuid);
+	`)
+	if err != nil {
+		return fmt.Errorf("adding hosts_uuid index: %w", err)
+	}
+	return nil
+}
+
+func Down_20240826111228(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240826160025_AddRemovedToInstalls.go b/server/datastore/mysql/migrations/tables/20240826160025_AddRemovedToInstalls.go
new file mode 100644
index 000000000000..6a99216cac51
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240826160025_AddRemovedToInstalls.go
@@ -0,0 +1,103 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+
+	"github.com/jmoiron/sqlx"
+	"github.com/jmoiron/sqlx/reflectx"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240826160025, Down_20240826160025)
+}
+
+func Up_20240826160025(tx *sql.Tx) error {
+	if !columnExists(tx, "host_software_installs", "removed") {
+		if _, err := tx.Exec("ALTER TABLE host_software_installs ADD COLUMN removed TINYINT NOT NULL DEFAULT 0"); err != nil {
+			return fmt.Errorf("failed to add removed to host_software_installs: %w", err)
+		}
+	}
+
+	if !columnExists(tx, "host_vpp_software_installs", "removed") {
+		if _, err := tx.Exec("ALTER TABLE host_vpp_software_installs ADD COLUMN removed TINYINT NOT NULL DEFAULT 0"); err != nil {
+			return fmt.Errorf("failed to add removed to host_vpp_software_installs: %w", err)
+		}
+	}
+
+	// Mark software installs as removed if the software is no longer installed on the host.
+	// Note that some software never shows up in software table after being installed (because software detail query can't find it).
+	// So, we will only mark software as removed if it shows up in the software table (for another host).
+	getPackagesRemovedStmt := `
+	SELECT DISTINCT hsi.id
+	FROM host_software_installs hsi
+	INNER JOIN software_installers si ON hsi.software_installer_id = si.id
+	INNER JOIN software_titles st ON si.title_id = st.id
+	-- software is installed on some host
+	INNER JOIN software s ON s.title_id = st.id
+	INNER JOIN hosts h ON hsi.host_id = h.id
+	WHERE NOT EXISTS (
+		-- software is not installed on this specific host
+		SELECT 1 FROM host_software hs
+		INNER JOIN software s2 ON hs.software_id = s2.id AND s2.title_id = st.id
+		WHERE hs.host_id = hsi.host_id
+	) AND (
+		-- software status is: Installed
+		(hsi.post_install_script_exit_code IS NOT NULL AND hsi.post_install_script_exit_code = 0) OR
+		(hsi.post_install_script_exit_code IS NULL AND hsi.install_script_exit_code IS NOT NULL AND hsi.install_script_exit_code = 0)
+	) AND
+		-- software was refetched after it was installed
+		hsi.updated_at < h.detail_updated_at
+`
+	var ids []uint
+	txx := sqlx.Tx{Tx: tx, Mapper: reflectx.NewMapperFunc("db", sqlx.NameMapper)}
+	if err := txx.Select(&ids, getPackagesRemovedStmt); err != nil {
+		return fmt.Errorf("failed to find host_software_installs to remove: %w", err)
+	}
+	if len(ids) > 0 {
+		stmt, args, err := sqlx.In("UPDATE host_software_installs SET removed = 1	WHERE id IN (?)", ids)
+		if err != nil {
+			return fmt.Errorf("failed to expand slice value for host_software_installs: %w", err)
+		}
+		if _, err := tx.Exec(stmt, args...); err != nil {
+			return fmt.Errorf("failed to mark host_software_installs as removed: %w", err)
+		}
+	}
+
+	// Mark VPP installs as removed if the software is no longer installed on the host.
+	getVppRemovedStmt := `
+	SELECT DISTINCT hvsi.id
+	FROM host_vpp_software_installs hvsi
+	INNER JOIN vpp_apps vap ON hvsi.adam_id = vap.adam_id AND hvsi.platform = vap.platform
+	INNER JOIN software_titles st ON vap.title_id = st.id
+	INNER JOIN hosts h ON hvsi.host_id = h.id
+	WHERE NOT EXISTS (
+		-- software is not installed on this specific host
+		SELECT 1 FROM host_software hs
+		INNER JOIN software s2 ON hs.software_id = s2.id AND s2.title_id = st.id
+		WHERE hs.host_id = hvsi.host_id
+	) AND
+		-- software was refetched after it was installed
+		hvsi.updated_at < h.detail_updated_at
+`
+
+	var vppIDs []uint
+	if err := txx.Select(&vppIDs, getVppRemovedStmt); err != nil {
+		return fmt.Errorf("failed to find host_vpp_software_installs to remove: %w", err)
+	}
+	if len(vppIDs) > 0 {
+		stmt, args, err := sqlx.In("UPDATE host_vpp_software_installs SET removed = 1	WHERE id IN (?)", vppIDs)
+		if err != nil {
+			return fmt.Errorf("failed to expand slice value for host_vpp_software_installs: %w", err)
+		}
+		if _, err := tx.Exec(stmt, args...); err != nil {
+			return fmt.Errorf("failed to mark host_vpp_software_installs as removed: %w", err)
+		}
+	}
+
+	return nil
+}
+
+func Down_20240826160025(_ *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240826160025_AddRemovedToInstalls_test.go b/server/datastore/mysql/migrations/tables/20240826160025_AddRemovedToInstalls_test.go
new file mode 100644
index 000000000000..10771839175b
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240826160025_AddRemovedToInstalls_test.go
@@ -0,0 +1,142 @@
+package tables
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240826160025(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	// Create user
+	u1 := execNoErrLastID(t, db, `INSERT INTO users (name, email, password, salt) VALUES (?, ?, ?, ?)`, "u1", "u1@b.c", "1234", "salt")
+	// Create host
+	insertHostStmt := `
+		INSERT INTO hosts (
+			hostname, uuid, platform, osquery_version, os_version, build, platform_like, code_name,
+			cpu_type, cpu_subtype, cpu_brand, hardware_vendor, hardware_model, hardware_version,
+			hardware_serial, computer_name, team_id
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`
+	hostName := "Dummy Hostname"
+	hostUUID := "12345678-1234-1234-1234-123456789012"
+	hostPlatform := "ios"
+	osqueryVer := "5.9.1"
+	osVersion := "Windows 10"
+	buildVersion := "10.0.19042.1234"
+	platformLike := "apple"
+	codeName := "20H2"
+	cpuType := "x86_64"
+	cpuSubtype := "x86_64"
+	cpuBrand := "Intel"
+	hwVendor := "Dell Inc."
+	hwModel := "OptiPlex 7090"
+	hwVersion := "1.0"
+	hwSerial := "ABCDEFGHIJ"
+	computerName := "DESKTOP-TEST"
+
+	hostID1 := execNoErrLastID(t, db, insertHostStmt, hostName, hostUUID, hostPlatform, osqueryVer,
+		osVersion, buildVersion, platformLike, codeName, cpuType, cpuSubtype, cpuBrand, hwVendor, hwModel, hwVersion, hwSerial,
+		computerName, nil)
+	hostID2 := execNoErrLastID(t, db, insertHostStmt, hostName, hostUUID, hostPlatform, osqueryVer,
+		osVersion, buildVersion, platformLike, codeName, cpuType, cpuSubtype, cpuBrand, hwVendor, hwModel, hwVersion, hwSerial,
+		computerName, nil)
+
+	// Insert data into software_titles
+	title1 := execNoErrLastID(t, db, "INSERT INTO software_titles (name, source, browser) VALUES (?, ?, ?)", "sw1", "src1", "")
+	title2 := execNoErrLastID(t, db, "INSERT INTO software_titles (name, source, browser) VALUES (?, ?, ?)", "sw2", "src2", "")
+	title3 := execNoErrLastID(t, db, "INSERT INTO software_titles (name, source, browser) VALUES (?, ?, ?)", "sw3", "src3", "")
+	title4 := execNoErrLastID(t, db, "INSERT INTO software_titles (name, source, browser) VALUES (?, ?, ?)", "sw4", "src4", "")
+
+	// Insert software
+	const insertStmt = `INSERT INTO software
+		(name, version, source, browser, checksum, title_id)
+	VALUES
+		(?, ?, ?, ?, ?, ?)`
+	execNoErr(t, db, insertStmt, "sw1", "1.0", "src1", "", "1", title1)
+	sw2 := execNoErrLastID(t, db, insertStmt, "sw2", "2.0", "src2", "", "2", title2)
+	sw3 := execNoErrLastID(t, db, insertStmt, "sw3", "3.0", "src3", "", "3", title3)
+	// sw4 is not in software table
+
+	// Insert host_software
+	execNoErr(t, db, "INSERT INTO host_software (host_id, software_id) VALUES (?, ?)", hostID2, sw2)
+	execNoErr(t, db, "INSERT INTO host_software (host_id, software_id) VALUES (?, ?)", hostID2, sw3)
+
+	// Create package apps
+	// 1 app will remain because it is not in the software table (sw1)
+	// 1 app will remain because it is still installed
+	// 1 app will be removed on host 1 but remain on host 2
+	execNoErr(t, db, `INSERT INTO script_contents (id, md5_checksum, contents) VALUES (1, 'checksum', 'script content')`)
+	siStmt := `INSERT INTO software_installers
+	    (title_id, filename, version, platform, install_script_content_id, storage_id)
+	  VALUES
+		(?,?,?,?,?,?)`
+	si1 := execNoErrLastID(t, db, siStmt, title1, "sw1-installer.pkg", "1.2", hostPlatform, 1, "storage-id1")
+	si2 := execNoErrLastID(t, db, siStmt, title2, "sw2-installer.pkg", "2.2", hostPlatform, 1, "storage-id2")
+	si3 := execNoErrLastID(t, db, siStmt, title3, "sw3-installer.pkg", "3.2", hostPlatform, 1, "storage-id3")
+	si4 := execNoErrLastID(t, db, siStmt, title4, "sw3-installer.pkg", "4.2", hostPlatform, 1, "storage-id4")
+
+	hsiStmt := `
+	INSERT INTO host_software_installs (
+		host_id,
+		execution_id,
+		software_installer_id,
+		install_script_exit_code,
+		post_install_script_exit_code
+	) VALUES (?, ?, ?, ?, ?)`
+	hsi1 := execNoErrLastID(t, db, hsiStmt, hostID1, "execution-id1", si1, 0, nil)       // will be removed
+	hsi2_1 := execNoErrLastID(t, db, hsiStmt, hostID2, "execution-id2_1", si2, nil, nil) // remains because it is still being installed
+	hsi2_2 := execNoErrLastID(t, db, hsiStmt, hostID2, "execution-id2_2", si2, 0, nil)
+	hsi3_1 := execNoErrLastID(t, db, hsiStmt, hostID1, "execution-id3_1", si3, 0, 0) // will be removed because it is not in host_software
+	hsi3_2 := execNoErrLastID(t, db, hsiStmt, hostID2, "execution-id3_2", si3, 0, 0)
+	hsi4 := execNoErrLastID(t, db, hsiStmt, hostID1, "execution-id4", si4, 0, 0) // remains because it is not in software table
+
+	// Create VPP apps -- 1 VPP app will be removed, 1 will remain
+	adamID1 := "removed"
+	execNoErr(
+		t, db, `INSERT INTO vpp_apps (adam_id, platform, title_id) VALUES (?,?,?)`, adamID1, hostPlatform, title1,
+	)
+	adamID2 := "kept"
+	execNoErr(
+		t, db, `INSERT INTO vpp_apps (adam_id, platform, title_id) VALUES (?,?,?)`, adamID2, hostPlatform, title2,
+	)
+
+	// create VPP installs
+	hvsi1 := execNoErrLastID(t, db,
+		`INSERT INTO host_vpp_software_installs (host_id, adam_id, platform, command_uuid, user_id) VALUES (?,?,?,?,?)`,
+		hostID1, adamID1, hostPlatform, "command_uuid", u1)
+	hvsi2 := execNoErrLastID(t, db,
+		`INSERT INTO host_vpp_software_installs (host_id, adam_id, platform, command_uuid, user_id) VALUES (?,?,?,?,?)`,
+		hostID2, adamID2, hostPlatform, "command_uuid2", u1)
+
+	time.Sleep(1 * time.Second) // because we are not using max timestamp precision
+	execNoErr(t, db, `UPDATE hosts SET detail_updated_at = NOW()`)
+
+	// Apply current migration.
+	applyNext(t, db)
+	var removed bool
+
+	// Check packages
+	require.NoError(t, db.Get(&removed, `SELECT removed from host_software_installs WHERE id = ?`, hsi1))
+	assert.True(t, removed)
+	require.NoError(t, db.Get(&removed, `SELECT removed from host_software_installs WHERE id = ?`, hsi2_1))
+	assert.False(t, removed)
+	require.NoError(t, db.Get(&removed, `SELECT removed from host_software_installs WHERE id = ?`, hsi2_2))
+	assert.False(t, removed)
+	require.NoError(t, db.Get(&removed, `SELECT removed from host_software_installs WHERE id = ?`, hsi3_1))
+	assert.True(t, removed)
+	require.NoError(t, db.Get(&removed, `SELECT removed from host_software_installs WHERE id = ?`, hsi3_2))
+	assert.False(t, removed)
+	require.NoError(t, db.Get(&removed, `SELECT removed from host_software_installs WHERE id = ?`, hsi4))
+	assert.False(t, removed)
+
+	// Check VPP
+	require.NoError(t, db.Get(&removed, `SELECT removed from host_vpp_software_installs WHERE id = ?`, hvsi1))
+	assert.True(t, removed)
+	require.NoError(t, db.Get(&removed, `SELECT removed from host_vpp_software_installs WHERE id = ?`, hvsi2))
+	assert.False(t, removed)
+
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829165448_SupportMultipleABMTokens.go b/server/datastore/mysql/migrations/tables/20240829165448_SupportMultipleABMTokens.go
new file mode 100644
index 000000000000..f7b010210b8d
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829165448_SupportMultipleABMTokens.go
@@ -0,0 +1,196 @@
+package tables
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/google/uuid"
+	"github.com/jmoiron/sqlx"
+	"github.com/jmoiron/sqlx/reflectx"
+	"github.com/pkg/errors"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240829165448, Down_20240829165448)
+}
+
+func Up_20240829165448(tx *sql.Tx) error {
+	_, err := tx.Exec(`
+CREATE TABLE abm_tokens (
+	id                     int(10) UNSIGNED NOT NULL AUTO_INCREMENT,
+	organization_name      varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
+	apple_id               varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
+	terms_expired          tinyint(1) NOT NULL DEFAULT '0',
+	renew_at               timestamp NOT NULL,
+	-- encrypted token, encrypted with the ABM cert and key and encrypted again
+	-- with the FleetConfig.Server.PrivateKey
+	token                  blob NOT NULL,
+
+	-- those team_id fields are the default teams where devices from this ABM
+	-- will be enrolled during the DEP process, based on the device's platform
+	-- (NULL means "no team").
+	macos_default_team_id  int(10) UNSIGNED DEFAULT NULL,
+	ios_default_team_id    int(10) UNSIGNED DEFAULT NULL,
+	ipados_default_team_id int(10) UNSIGNED DEFAULT NULL,
+
+	created_at             TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+	updated_at             TIMESTAMP NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+
+	PRIMARY KEY (id),
+
+	UNIQUE KEY idx_abm_tokens_organization_name (organization_name),
+
+	CONSTRAINT fk_abm_tokens_macos_default_team_id
+		FOREIGN KEY (macos_default_team_id) REFERENCES teams (id) ON DELETE SET NULL,
+	CONSTRAINT fk_abm_tokens_ios_default_team_id
+		FOREIGN KEY (ios_default_team_id) REFERENCES teams (id) ON DELETE SET NULL,
+	CONSTRAINT fk_abm_tokens_ipados_default_team_id
+		FOREIGN KEY (ipados_default_team_id) REFERENCES teams (id) ON DELETE SET NULL
+)`)
+	if err != nil {
+		return fmt.Errorf("failed to create table abm_tokens: %w", err)
+	}
+
+	_, err = tx.Exec(`
+ALTER TABLE host_dep_assignments
+	ADD COLUMN abm_token_id int(10) UNSIGNED NULL,
+	ADD CONSTRAINT fk_host_dep_assignments_abm_token_id
+		FOREIGN KEY (abm_token_id) REFERENCES abm_tokens(id) ON DELETE SET NULL
+`)
+	if err != nil {
+		return fmt.Errorf("failed to alter table host_dep_assignments: %w", err)
+	}
+
+	// migrate the existing ABM token (if any) to the new abm_tokens table
+	const getABM = `
+SELECT
+	value
+FROM
+	mdm_config_assets
+WHERE
+	name = ? AND deletion_uuid = ''
+`
+	txx := sqlx.Tx{Tx: tx, Mapper: reflectx.NewMapperFunc("db", sqlx.NameMapper)}
+	var token []byte
+	if err := txx.Get(&token, getABM, fleet.MDMAssetABMTokenDeprecated); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			// nothing to migrate, exit early
+			return nil
+		}
+		return fmt.Errorf("selecting existing ABM token: %w", err)
+	}
+
+	// get the current ABM configuration from the app config
+	const getABMCfg = `
+SELECT
+	json_value->"$.mdm"
+FROM
+	app_config_json
+LIMIT 1
+`
+	var raw sql.Null[json.RawMessage]
+	if err := txx.Get(&raw, getABMCfg); err != nil {
+		return fmt.Errorf("select MDM config from app_config_json: %w", err)
+	}
+
+	var (
+		abmTermsExpired bool
+		abmDefaultTeam  string
+	)
+	// decode if we did get an object
+	if raw.Valid && len(raw.V) > 0 && raw.V[0] == '{' {
+		var config map[string]interface{}
+		if err := json.Unmarshal(raw.V, &config); err != nil {
+			return fmt.Errorf("unmarshal appconfig: %w", err)
+		}
+
+		if s, ok := config["apple_bm_default_team"].(string); ok {
+			abmDefaultTeam = s
+		}
+		if b, ok := config["apple_bm_terms_expired"].(bool); ok {
+			abmTermsExpired = b
+		}
+	}
+
+	var defaultTeamID *uint
+	if abmDefaultTeam != "" {
+		// get the default team id
+		var id uint
+		if err := txx.Get(&id, "SELECT id FROM teams WHERE name = ?", abmDefaultTeam); err != nil {
+			if !errors.Is(err, sql.ErrNoRows) {
+				return fmt.Errorf("select default ABM team id: %w", err)
+			}
+		}
+		// only use it if the team exists
+		if id > 0 {
+			defaultTeamID = &id
+		}
+	}
+
+	// NOTE: we don't know the organization_name, apple_id and renew_at of the
+	// existing token - the only way to know is to make an Apple API call and to
+	// decrypt the token, two operations that are not safe to do in a DB
+	// migration. Instead, insert with empty values and we have a check in the
+	// cron job ("apple_mdm_dep_profile_assigner") that runs regularly (and
+	// ~immediately at Fleet startup) to ensure the token's information is
+	// filled.
+	// https://github.com/fleetdm/fleet/pull/21287#discussion_r1715891448
+
+	// insert the token in the new table
+	const insABM = `
+INSERT INTO abm_tokens
+	(
+		organization_name,
+		apple_id,
+		terms_expired,
+		renew_at,
+		token,
+		macos_default_team_id,
+		ios_default_team_id,
+		ipados_default_team_id
+	)
+VALUES
+	('', '', ?, DATE('2000-01-01'), ?, ?, ?, ?)
+`
+	res, err := tx.Exec(insABM, abmTermsExpired, token, defaultTeamID, defaultTeamID, defaultTeamID)
+	if err != nil {
+		return fmt.Errorf("insert existing ABM token into abm_tokens: %w", err)
+	}
+	tokenID, _ := res.LastInsertId()
+
+	// soft-delete the token from the deprecated storage
+	const delABM = `
+UPDATE
+	mdm_config_assets
+SET
+	deleted_at = CURRENT_TIMESTAMP(),
+	deletion_uuid = ?
+WHERE
+	name = ? AND deletion_uuid = ''
+`
+	deletionUUID := uuid.New().String()
+	if _, err = tx.Exec(delABM, deletionUUID, fleet.MDMAssetABMTokenDeprecated); err != nil {
+		return fmt.Errorf("delete ABM token from mdm_config_assets: %w", err)
+	}
+
+	// associate all existing host DEP enrollments with the existing token
+	const updDEP = `
+UPDATE
+	host_dep_assignments
+SET
+	abm_token_id = ?
+WHERE
+	deleted_at IS NULL
+`
+	if _, err = tx.Exec(updDEP, tokenID); err != nil {
+		return fmt.Errorf("update ABM token link in host_dep_assignments: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240829165448(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829165448_SupportMultipleABMTokens_test.go b/server/datastore/mysql/migrations/tables/20240829165448_SupportMultipleABMTokens_test.go
new file mode 100644
index 000000000000..07804074fdf0
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829165448_SupportMultipleABMTokens_test.go
@@ -0,0 +1,272 @@
+package tables
+
+import (
+	"crypto/md5" //nolint:gosec
+	"database/sql"
+	"testing"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/ptr"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240829165448(t *testing.T) {
+	createTokenAndHash := func() (string, []byte) {
+		tok := uuid.NewString()
+		h := md5.New() //nolint:gosec
+		_, _ = h.Write([]byte(tok))
+		md5Checksum := h.Sum(nil)
+		return tok, md5Checksum
+	}
+
+	type abmToken struct {
+		ID                  uint      `db:"id"`
+		OrganizationName    string    `db:"organization_name"`
+		AppleID             string    `db:"apple_id"`
+		TermsExpired        bool      `db:"terms_expired"`
+		RenewAt             time.Time `db:"renew_at"`
+		Token               []byte    `db:"token"`
+		MacOSDefaultTeamID  *uint     `db:"macos_default_team_id"`
+		IOSDefaultTeamID    *uint     `db:"ios_default_team_id"`
+		IPadOSDefaultTeamID *uint     `db:"ipados_default_team_id"`
+	}
+
+	t.Run("NoExistingToken", func(t *testing.T) {
+		db := applyUpToPrev(t)
+
+		// create a host with a DEP assignment (should not exist when there is no
+		// ABM, but maybe ABM was setup then removed)
+		hostID := insertHost(t, db, nil)
+		execNoErr(t, db, `INSERT INTO host_dep_assignments (host_id) VALUES (?)`, hostID)
+
+		// Apply current migration.
+		applyNext(t, db)
+
+		var exists int
+		// no ABM token in the old storage
+		err := db.Get(&exists, `SELECT 1 FROM mdm_config_assets WHERE name = 'abm_token'`)
+		require.ErrorIs(t, err, sql.ErrNoRows)
+		// no ABM token in the new storage
+		err = db.Get(&exists, `SELECT 1 FROM abm_tokens`)
+		require.ErrorIs(t, err, sql.ErrNoRows)
+
+		// the existing host DEP assignment is still not linked to any token
+		var hostTokenID *uint
+		err = db.Get(&hostTokenID, `SELECT abm_token_id FROM host_dep_assignments WHERE host_id = ?`, hostID)
+		require.NoError(t, err)
+		require.Nil(t, hostTokenID)
+	})
+
+	t.Run("ExistingTokenWithTeamTermsFalse", func(t *testing.T) {
+		db := applyUpToPrev(t)
+
+		// create an existing ABM token
+		existingToken, md5Checksum := createTokenAndHash()
+		execNoErr(t, db, `INSERT INTO mdm_config_assets (name, value, md5_checksum) VALUES ('abm_token', ?, ?)`, existingToken, md5Checksum)
+
+		// set a config for ABM
+		execNoErr(t, db, `UPDATE app_config_json SET json_value = JSON_SET(json_value, '$.mdm', JSON_OBJECT('apple_bm_default_team', 'team1'))`)
+
+		// create the corresponding team
+		tmID := execNoErrLastID(t, db, `INSERT INTO teams (name) VALUES (?)`, "team1")
+
+		// create a host with a DEP assignment
+		hostID := insertHost(t, db, ptr.Uint(uint(tmID)))
+		execNoErr(t, db, `INSERT INTO host_dep_assignments (host_id) VALUES (?)`, hostID)
+
+		// Apply current migration.
+		applyNext(t, db)
+
+		// ABM token is now soft-deleted in the old storage
+		var assetDeletedUUID string
+		err := db.Get(&assetDeletedUUID, `SELECT deletion_uuid FROM mdm_config_assets WHERE name = 'abm_token'`)
+		require.NoError(t, err)
+		require.NotEmpty(t, assetDeletedUUID)
+
+		// ABM token is stored in the new storage, with the expected config
+		var storedToken abmToken
+		err = db.Get(&storedToken, `
+SELECT
+	id, organization_name, apple_id, terms_expired, renew_at, token, macos_default_team_id, ios_default_team_id, ipados_default_team_id
+FROM
+	abm_tokens
+LIMIT 1`)
+		require.NoError(t, err)
+
+		// we don't have those fields during DB migration
+		require.Empty(t, storedToken.OrganizationName)
+		require.Empty(t, storedToken.AppleID)
+		require.Equal(t, time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC), storedToken.RenewAt)
+		// terms were not set as expired in appconfig
+		require.False(t, storedToken.TermsExpired)
+		// token matches
+		require.Equal(t, existingToken, string(storedToken.Token))
+		// all platform default teams are set to the configured team
+		require.NotNil(t, storedToken.MacOSDefaultTeamID)
+		require.EqualValues(t, tmID, *storedToken.MacOSDefaultTeamID)
+		require.NotNil(t, storedToken.IOSDefaultTeamID)
+		require.EqualValues(t, tmID, *storedToken.IOSDefaultTeamID)
+		require.NotNil(t, storedToken.IPadOSDefaultTeamID)
+		require.EqualValues(t, tmID, *storedToken.IPadOSDefaultTeamID)
+
+		// the existing host DEP assignment is linked to the token
+		var hostTokenID *uint
+		err = db.Get(&hostTokenID, `SELECT abm_token_id FROM host_dep_assignments WHERE host_id = ?`, hostID)
+		require.NoError(t, err)
+		require.NotNil(t, hostTokenID)
+		require.EqualValues(t, storedToken.ID, *hostTokenID)
+	})
+
+	t.Run("ExistingTokenWithInvalidTeamTermsTrue", func(t *testing.T) {
+		db := applyUpToPrev(t)
+
+		// create an existing ABM token
+		existingToken, md5Checksum := createTokenAndHash()
+		execNoErr(t, db, `INSERT INTO mdm_config_assets (name, value, md5_checksum) VALUES ('abm_token', ?, ?)`, existingToken, md5Checksum)
+
+		// set a config for ABM
+		execNoErr(t, db, `UPDATE app_config_json SET json_value = JSON_SET(json_value, '$.mdm', JSON_OBJECT('apple_bm_default_team', 'no-such-team', 'apple_bm_terms_expired', true))`)
+
+		// create a team, but not one matching the default team name
+		tmID := execNoErrLastID(t, db, `INSERT INTO teams (name) VALUES (?)`, "team1")
+
+		// create a host with a DEP assignment
+		hostID := insertHost(t, db, ptr.Uint(uint(tmID)))
+		execNoErr(t, db, `INSERT INTO host_dep_assignments (host_id) VALUES (?)`, hostID)
+
+		// Apply current migration.
+		applyNext(t, db)
+
+		// ABM token is now soft-deleted in the old storage
+		var assetDeletedUUID string
+		err := db.Get(&assetDeletedUUID, `SELECT deletion_uuid FROM mdm_config_assets WHERE name = 'abm_token'`)
+		require.NoError(t, err)
+		require.NotEmpty(t, assetDeletedUUID)
+
+		// ABM token is stored in the new storage, with the expected config
+		var storedToken abmToken
+		err = db.Get(&storedToken, `
+SELECT
+	id, organization_name, apple_id, terms_expired, renew_at, token, macos_default_team_id, ios_default_team_id, ipados_default_team_id
+FROM
+	abm_tokens
+LIMIT 1`)
+		require.NoError(t, err)
+
+		// we don't have those fields during DB migration
+		require.Empty(t, storedToken.OrganizationName)
+		require.Empty(t, storedToken.AppleID)
+		require.Equal(t, time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC), storedToken.RenewAt)
+		// terms were set as expired in appconfig
+		require.True(t, storedToken.TermsExpired)
+		// token matches
+		require.Equal(t, existingToken, string(storedToken.Token))
+		// all platform default teams are set to nil as the team did not exist
+		require.Nil(t, storedToken.MacOSDefaultTeamID)
+		require.Nil(t, storedToken.IOSDefaultTeamID)
+		require.Nil(t, storedToken.IPadOSDefaultTeamID)
+
+		// the existing host DEP assignment is linked to the token
+		var hostTokenID *uint
+		err = db.Get(&hostTokenID, `SELECT abm_token_id FROM host_dep_assignments WHERE host_id = ?`, hostID)
+		require.NoError(t, err)
+		require.NotNil(t, hostTokenID)
+		require.EqualValues(t, storedToken.ID, *hostTokenID)
+	})
+
+	t.Run("ExistingTokenNoMDMConfig", func(t *testing.T) {
+		db := applyUpToPrev(t)
+
+		// create an existing ABM token
+		existingToken, md5Checksum := createTokenAndHash()
+		execNoErr(t, db, `INSERT INTO mdm_config_assets (name, value, md5_checksum) VALUES ('abm_token', ?, ?)`, existingToken, md5Checksum)
+
+		// app config does not have the MDM object
+		execNoErr(t, db, `UPDATE app_config_json SET json_value = JSON_REMOVE(json_value, '$.mdm')`)
+
+		// create a host with a DEP assignment
+		hostID := insertHost(t, db, nil)
+		execNoErr(t, db, `INSERT INTO host_dep_assignments (host_id) VALUES (?)`, hostID)
+
+		// Apply current migration.
+		applyNext(t, db)
+
+		// ABM token is now soft-deleted in the old storage
+		var assetDeletedUUID string
+		err := db.Get(&assetDeletedUUID, `SELECT deletion_uuid FROM mdm_config_assets WHERE name = 'abm_token'`)
+		require.NoError(t, err)
+		require.NotEmpty(t, assetDeletedUUID)
+
+		// ABM token is stored in the new storage, with the default config
+		var storedToken abmToken
+		err = db.Get(&storedToken, `
+SELECT
+	id, organization_name, apple_id, terms_expired, renew_at, token, macos_default_team_id, ios_default_team_id, ipados_default_team_id
+FROM
+	abm_tokens
+LIMIT 1`)
+		require.NoError(t, err)
+
+		// we don't have those fields during DB migration
+		require.Empty(t, storedToken.OrganizationName)
+		require.Empty(t, storedToken.AppleID)
+		require.Equal(t, time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC), storedToken.RenewAt)
+		require.False(t, storedToken.TermsExpired)
+		// token matches
+		require.Equal(t, existingToken, string(storedToken.Token))
+		// all platform default teams are set to nil
+		require.Nil(t, storedToken.MacOSDefaultTeamID)
+		require.Nil(t, storedToken.IOSDefaultTeamID)
+		require.Nil(t, storedToken.IPadOSDefaultTeamID)
+
+		// the existing host DEP assignment is linked to the token
+		var hostTokenID *uint
+		err = db.Get(&hostTokenID, `SELECT abm_token_id FROM host_dep_assignments WHERE host_id = ?`, hostID)
+		require.NoError(t, err)
+		require.NotNil(t, hostTokenID)
+		require.EqualValues(t, storedToken.ID, *hostTokenID)
+	})
+
+	t.Run("ExistingTokenCorruptedJSONConfig", func(t *testing.T) {
+		db := applyUpToPrev(t)
+
+		// create an existing ABM token
+		existingToken, md5Checksum := createTokenAndHash()
+		execNoErr(t, db, `INSERT INTO mdm_config_assets (name, value, md5_checksum) VALUES ('abm_token', ?, ?)`, existingToken, md5Checksum)
+
+		// set a corrupted JSON config for ABM
+		execNoErr(t, db, `UPDATE app_config_json SET json_value = JSON_SET(json_value, '$.mdm', JSON_OBJECT('apple_bm_default_team', 123, 'apple_bm_terms_expired', 'abc'))`)
+
+		// Apply current migration.
+		applyNext(t, db)
+
+		// ABM token is now soft-deleted in the old storage
+		var assetDeletedUUID string
+		err := db.Get(&assetDeletedUUID, `SELECT deletion_uuid FROM mdm_config_assets WHERE name = 'abm_token'`)
+		require.NoError(t, err)
+		require.NotEmpty(t, assetDeletedUUID)
+
+		// ABM token is stored in the new storage, with the default config (as the existing one was invalid)
+		var storedToken abmToken
+		err = db.Get(&storedToken, `
+SELECT
+	id, organization_name, apple_id, terms_expired, renew_at, token, macos_default_team_id, ios_default_team_id, ipados_default_team_id
+FROM
+	abm_tokens
+LIMIT 1`)
+		require.NoError(t, err)
+
+		// we don't have those fields during DB migration
+		require.Empty(t, storedToken.OrganizationName)
+		require.Empty(t, storedToken.AppleID)
+		require.Equal(t, time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC), storedToken.RenewAt)
+		require.False(t, storedToken.TermsExpired)
+		// token matches
+		require.Equal(t, existingToken, string(storedToken.Token))
+		// all platform default teams are set to nil
+		require.Nil(t, storedToken.MacOSDefaultTeamID)
+		require.Nil(t, storedToken.IOSDefaultTeamID)
+		require.Nil(t, storedToken.IPadOSDefaultTeamID)
+	})
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829165605_SupportMultipleVPPTokens.go b/server/datastore/mysql/migrations/tables/20240829165605_SupportMultipleVPPTokens.go
new file mode 100644
index 000000000000..de2fb9157b64
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829165605_SupportMultipleVPPTokens.go
@@ -0,0 +1,181 @@
+package tables
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/google/uuid"
+	"github.com/jmoiron/sqlx"
+	"github.com/jmoiron/sqlx/reflectx"
+	"github.com/pkg/errors"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240829165605, Down_20240829165605)
+}
+
+func Up_20240829165605(tx *sql.Tx) error {
+	_, err := tx.Exec(`
+CREATE TABLE vpp_tokens (
+	id                     int(10) UNSIGNED NOT NULL AUTO_INCREMENT,
+	organization_name      varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
+	location               varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
+	renew_at               timestamp NOT NULL,
+	-- encrypted token, encrypted with the FleetConfig.Server.PrivateKey value
+	token                  blob NOT NULL,
+
+	-- Note that as per a Slack discussion [1], we opted not to enforce the constraint
+	-- of team uniqueness in the DB as it quickly got hairy - we'd need a distinct
+	-- global_or_team_id NOT NULL to be able to enforce it along with the enum, and even
+	-- then we want to allow multiple entries for a NULL team id with the enum set to 'none'
+	-- (inactive tokens), and we need to handle the team deletion which only sets team_id
+	-- automatically via the FK ON DELETE clause. We thought about using a trigger but
+	-- decided against it given the impacts [2]. We'll instead enforce the constraint in
+	-- the Go code.
+	-- [1]: https://fleetdm.slack.com/archives/C03C41L5YEL/p1724073772972669
+	-- [2]: https://www.percona.com/blog/how-triggers-may-significantly-affect-the-amount-of-memory-allocated-to-your-mysql-server/
+	team_id                int(10) UNSIGNED DEFAULT NULL,
+
+	-- null_team_type indicates the special team represented when team_id is NULL,
+	-- which can be none (VPP token is inactive), "all teams" or the "no team" team.
+	-- It is important, when setting a non-NULL team_id, to always update this field
+	-- to "none" so that if the team is deleted, via the ON DELETE SET NULL constraint,
+	-- the VPP token automatically becomes inactive (and not, e.g. "all teams" which
+	-- would introduce data inconsistency).
+	null_team_type         ENUM('none', 'allteams', 'noteam') DEFAULT 'none',
+
+	created_at             TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+	updated_at             TIMESTAMP NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+
+	PRIMARY KEY (id),
+
+	UNIQUE KEY idx_vpp_tokens_location (location),
+
+	CONSTRAINT fk_vpp_tokens_team_id
+		FOREIGN KEY (team_id) REFERENCES teams (id) ON DELETE SET NULL
+)`)
+	if err != nil {
+		return fmt.Errorf("failed to create table vpp_tokens: %w", err)
+	}
+
+	_, err = tx.Exec(`
+ALTER TABLE host_vpp_software_installs
+	ADD COLUMN vpp_token_id int(10) UNSIGNED NULL,
+	ADD CONSTRAINT fk_host_vpp_software_installs_vpp_token_id
+		FOREIGN KEY (vpp_token_id) REFERENCES vpp_tokens(id) ON DELETE SET NULL
+`)
+	if err != nil {
+		return fmt.Errorf("failed to alter table host_vpp_software_installs: %w", err)
+	}
+
+	// migrate the existing VPP token (if any) to the new vpp_tokens table
+	const getVPP = `
+SELECT
+	value
+FROM
+	mdm_config_assets
+WHERE
+	name = ? AND deletion_uuid = ''
+`
+	txx := sqlx.Tx{Tx: tx, Mapper: reflectx.NewMapperFunc("db", sqlx.NameMapper)}
+	var token []byte
+	if err := txx.Get(&token, getVPP, fleet.MDMAssetVPPTokenDeprecated); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			// nothing to migrate, exit early
+			return nil
+		}
+		return fmt.Errorf("selecting existing VPP token: %w", err)
+	}
+
+	// insert the token in the new table, defaulting to "all teams"
+	const insVPP = `
+INSERT INTO vpp_tokens
+	(
+		organization_name,
+		location,
+		renew_at,
+		token,
+		team_id,
+		null_team_type
+	)
+VALUES
+	('', '', DATE('2000-01-01'), ?, NULL, 'allteams')
+`
+	res, err := tx.Exec(insVPP, token)
+	if err != nil {
+		return fmt.Errorf("insert existing VPP token into vpp_tokens: %w", err)
+	}
+	tokenID, _ := res.LastInsertId()
+
+	// soft-delete the token from the deprecated storage
+	const delVPP = `
+UPDATE
+	mdm_config_assets
+SET
+	deleted_at = CURRENT_TIMESTAMP(),
+	deletion_uuid = ?
+WHERE
+	name = ? AND deletion_uuid = ''
+`
+	deletionUUID := uuid.New().String()
+	if _, err = tx.Exec(delVPP, deletionUUID, fleet.MDMAssetVPPTokenDeprecated); err != nil {
+		return fmt.Errorf("delete VPP token from mdm_config_assets: %w", err)
+	}
+
+	// associate all existing host VPP install requests with the existing token
+	const updHost = `
+UPDATE
+	host_vpp_software_installs
+SET
+	vpp_token_id = ?,
+	updated_at = updated_at
+`
+	if _, err = tx.Exec(updHost, tokenID); err != nil {
+		return fmt.Errorf("update VPP token link in host_vpp_software_installs: %w", err)
+	}
+
+	// NOTE: we can't add the token's metadata during migration because we don't
+	// have the Server.PrivateKey value to decrypt the data from
+	// mdm_config_assets (the VPP token, once decrypted, contains the metadata we
+	// need). Enqueue a worker job to complete the migration, back-filling the
+	// metadata for the migrated token.
+	const (
+		jobName        = "db_migration"
+		taskName       = "migrate_vpp_token"
+		jobStateQueued = "queued"
+	)
+
+	type migrateArgs struct {
+		Task string `json:"task"`
+	}
+	argsJSON, err := json.Marshal(migrateArgs{Task: taskName})
+	if err != nil {
+		return fmt.Errorf("failed to JSON marshal the job arguments: %w", err)
+	}
+
+	// hard-coded timestamps are used so that schema.sql is stable
+	const query = `
+INSERT INTO jobs (
+    name,
+    args,
+    state,
+		error,
+    not_before,
+		created_at,
+		updated_at
+)
+VALUES (?, ?, ?, '', ?, ?, ?)
+`
+	ts := time.Date(2024, 8, 19, 0, 0, 0, 0, time.UTC)
+	if _, err := tx.Exec(query, jobName, argsJSON, jobStateQueued, ts, ts, ts); err != nil {
+		return fmt.Errorf("failed to insert worker job: %w", err)
+	}
+	return nil
+}
+
+func Down_20240829165605(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829165605_SupportMultipleVPPTokens_test.go b/server/datastore/mysql/migrations/tables/20240829165605_SupportMultipleVPPTokens_test.go
new file mode 100644
index 000000000000..42ef63fdba6a
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829165605_SupportMultipleVPPTokens_test.go
@@ -0,0 +1,163 @@
+package tables
+
+import (
+	"crypto/md5" //nolint:gosec
+	"database/sql"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240829165605(t *testing.T) {
+	createTokenAndHash := func() (string, []byte) {
+		tok := uuid.NewString()
+		h := md5.New() //nolint:gosec
+		_, _ = h.Write([]byte(tok))
+		md5Checksum := h.Sum(nil)
+		return tok, md5Checksum
+	}
+
+	type job struct {
+		ID        uint             `json:"id" db:"id"`
+		CreatedAt time.Time        `json:"created_at" db:"created_at"`
+		UpdatedAt *time.Time       `json:"updated_at" db:"updated_at"`
+		Name      string           `json:"name" db:"name"`
+		Args      *json.RawMessage `json:"args" db:"args"`
+		State     string           `json:"state" db:"state"`
+		Retries   int              `json:"retries" db:"retries"`
+		Error     string           `json:"error" db:"error"`
+		NotBefore time.Time        `json:"not_before" db:"not_before"`
+	}
+
+	type vppToken struct {
+		ID               uint      `db:"id"`
+		OrganizationName string    `db:"organization_name"`
+		Location         string    `db:"location"`
+		RenewAt          time.Time `db:"renew_at"`
+		Token            []byte    `db:"token"`
+		TeamID           *uint     `db:"team_id"`
+		NullTeamType     string    `db:"null_team_type"`
+	}
+
+	type jobArgs struct {
+		Task string `json:"task"`
+	}
+
+	t.Run("NoExistingToken", func(t *testing.T) {
+		db := applyUpToPrev(t)
+
+		// create a vpp app
+		adamID := "abcdEFGH"
+		execNoErr(t, db, `INSERT INTO vpp_apps (adam_id, platform) VALUES (?, ?)`, adamID, "darwin")
+		execNoErr(t, db, `INSERT INTO vpp_apps_teams (adam_id, platform) VALUES (?, ?)`, adamID, "darwin")
+
+		// create a host with a VPP install request
+		hostID := insertHost(t, db, nil)
+		execNoErr(t, db, `INSERT INTO host_vpp_software_installs (host_id, adam_id, command_uuid, platform) VALUES (?, ?, ?, ?)`, hostID, adamID, uuid.NewString(), "darwin")
+
+		// there is no pending job of that type at the moment
+		var jobs []*job
+		err := db.Select(&jobs, `SELECT id, name, args, state, retries, error, not_before FROM jobs WHERE name = 'db_migration'`)
+		require.NoError(t, err)
+		require.Empty(t, jobs)
+
+		// Apply current migration.
+		applyNext(t, db)
+
+		var exists int
+		// no VPP token in the old storage
+		err = db.Get(&exists, `SELECT 1 FROM mdm_config_assets WHERE name = 'vpp_token'`)
+		require.ErrorIs(t, err, sql.ErrNoRows)
+		// no VPP token in the new storage
+		err = db.Get(&exists, `SELECT 1 FROM vpp_tokens`)
+		require.ErrorIs(t, err, sql.ErrNoRows)
+
+		// the existing host install request is not linked
+		var hostTokenID *uint
+		err = db.Get(&hostTokenID, `SELECT vpp_token_id FROM host_vpp_software_installs WHERE host_id = ?`, hostID)
+		require.NoError(t, err)
+		require.Nil(t, hostTokenID)
+
+		// there is still no pending job of that type
+		err = db.Select(&jobs, `SELECT id, name, args, state, retries, error, not_before FROM jobs WHERE name = 'db_migration'`)
+		require.NoError(t, err)
+		require.Empty(t, jobs)
+	})
+
+	t.Run("ExistingTokenAndInstallRequest", func(t *testing.T) {
+		db := applyUpToPrev(t)
+
+		// create an existing VPP token
+		existingToken, md5Checksum := createTokenAndHash()
+		execNoErr(t, db, `INSERT INTO mdm_config_assets (name, value, md5_checksum) VALUES ('vpp_token', ?, ?)`, existingToken, md5Checksum)
+
+		// create a vpp app
+		adamID := "abcdEFGH"
+		execNoErr(t, db, `INSERT INTO vpp_apps (adam_id, platform) VALUES (?, ?)`, adamID, "darwin")
+		execNoErr(t, db, `INSERT INTO vpp_apps_teams (adam_id, platform) VALUES (?, ?)`, adamID, "darwin")
+
+		// create a host with a VPP install request
+		hostID := insertHost(t, db, nil)
+		execNoErr(t, db, `INSERT INTO host_vpp_software_installs (host_id, adam_id, command_uuid, platform) VALUES (?, ?, ?, ?)`, hostID, adamID, uuid.NewString(), "darwin")
+
+		// there is no pending job of that type at the moment
+		var jobs []*job
+		err := db.Select(&jobs, `SELECT id, name, args, state, retries, error, not_before FROM jobs WHERE name = 'db_migration'`)
+		require.NoError(t, err)
+		require.Empty(t, jobs)
+
+		// Apply current migration.
+		applyNext(t, db)
+
+		// VPP token is now soft-deleted in the old storage
+		var assetDeletedUUID string
+		err = db.Get(&assetDeletedUUID, `SELECT deletion_uuid FROM mdm_config_assets WHERE name = 'vpp_token'`)
+		require.NoError(t, err)
+		require.NotEmpty(t, assetDeletedUUID)
+
+		// VPP token is stored in the new storage, with the expected config
+		var storedToken vppToken
+		err = db.Get(&storedToken, `
+SELECT
+	id, organization_name, location, renew_at, token, team_id, null_team_type
+FROM
+	vpp_tokens
+LIMIT 1`)
+		require.NoError(t, err)
+
+		// we don't have those fields during DB migration
+		require.NotZero(t, storedToken.ID)
+		require.Empty(t, storedToken.OrganizationName)
+		require.Empty(t, storedToken.Location)
+		require.Equal(t, time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC), storedToken.RenewAt)
+		// token matches
+		require.Equal(t, existingToken, string(storedToken.Token))
+		require.Nil(t, storedToken.TeamID)
+		require.Equal(t, "allteams", storedToken.NullTeamType)
+
+		// the existing host install request is linked to the token
+		var hostTokenID *uint
+		err = db.Get(&hostTokenID, `SELECT vpp_token_id FROM host_vpp_software_installs WHERE host_id = ?`, hostID)
+		require.NoError(t, err)
+		require.NotNil(t, hostTokenID)
+		require.EqualValues(t, storedToken.ID, *hostTokenID)
+
+		// the job was enqueued to finish migrating the token
+		err = db.Select(&jobs, `SELECT id, name, args, state, retries, error, not_before FROM jobs WHERE name = 'db_migration'`)
+		require.NoError(t, err)
+		require.Len(t, jobs, 1)
+
+		require.Equal(t, "db_migration", jobs[0].Name)
+		require.Equal(t, 0, jobs[0].Retries)
+		require.LessOrEqual(t, jobs[0].NotBefore, time.Now().UTC())
+		require.NotNil(t, jobs[0].Args)
+
+		var args jobArgs
+		err = json.Unmarshal(*jobs[0].Args, &args)
+		require.NoError(t, err)
+		require.Equal(t, "migrate_vpp_token", args.Task)
+	})
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829165715_AddUniqueTeamIDToVPPTokens.go b/server/datastore/mysql/migrations/tables/20240829165715_AddUniqueTeamIDToVPPTokens.go
new file mode 100644
index 000000000000..3eb82145308d
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829165715_AddUniqueTeamIDToVPPTokens.go
@@ -0,0 +1,22 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240829165715, Down_20240829165715)
+}
+
+func Up_20240829165715(tx *sql.Tx) error {
+	stmt := `ALTER TABLE vpp_tokens ADD UNIQUE KEY idx_vpp_tokens_team_id (team_id)`
+	if _, err := tx.Exec(stmt); err != nil {
+		return fmt.Errorf("adding unique constraint to team_id on vpp_tokens: %w", err)
+	}
+	return nil
+}
+
+func Down_20240829165715(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829165930_SupportMultipleTokensForSetupAssistants.go b/server/datastore/mysql/migrations/tables/20240829165930_SupportMultipleTokensForSetupAssistants.go
new file mode 100644
index 000000000000..7ccb27b06b97
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829165930_SupportMultipleTokensForSetupAssistants.go
@@ -0,0 +1,117 @@
+package tables
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240829165930, Down_20240829165930)
+}
+
+func Up_20240829165930(tx *sql.Tx) error {
+	// mdm_apple_default_setup_assistants will now track profile_uuids per team
+	// AND ABM token.
+	const alterDefaultStmt = `
+	ALTER TABLE mdm_apple_default_setup_assistants
+		ADD COLUMN abm_token_id int unsigned DEFAULT NULL,
+		DROP KEY idx_mdm_default_setup_assistant_global_or_team_id,
+		ADD CONSTRAINT idx_mdm_default_setup_assistant_global_or_team_id_abm_token_id
+			UNIQUE (global_or_team_id, abm_token_id),
+		ADD CONSTRAINT fk_mdm_default_setup_assistant_abm_token_id
+			FOREIGN KEY (abm_token_id) REFERENCES abm_tokens(id) ON DELETE CASCADE
+`
+	if _, err := tx.Exec(alterDefaultStmt); err != nil {
+		return fmt.Errorf("alter mdm_apple_default_setup_assistants to track per ABM token: %w", err)
+	}
+
+	var abmTokenID uint
+	if err := tx.QueryRow("SELECT id FROM abm_tokens LIMIT 1").Scan(&abmTokenID); err != nil {
+		if !errors.Is(err, sql.ErrNoRows) {
+			return fmt.Errorf("get existing ABM token ID: %w", err)
+		}
+	}
+
+	if abmTokenID > 0 {
+		// there should only be one ABM token (or none) when this migration runs.
+		// Timestamp is important in the code logic (it triggers a full DEP sync if
+		// recently changed), so we ensure it stays the same.
+		const updateDefaultStmt = `
+	UPDATE mdm_apple_default_setup_assistants SET
+		abm_token_id = ?,
+		updated_at = updated_at
+`
+		if _, err := tx.Exec(updateDefaultStmt, abmTokenID); err != nil {
+			return fmt.Errorf("update mdm_apple_default_setup_assistants to set abm token id: %w", err)
+		}
+	}
+	// TODO: should we delete entries without an ABM token ID at this point? And
+	// make the column NOT NULL?
+
+	const createCustomStmt = `
+CREATE TABLE mdm_apple_setup_assistant_profiles (
+	id int unsigned NOT NULL AUTO_INCREMENT,
+
+	-- the corresponding custom setup assistant in mdm_apple_setup_assistants,
+	-- which is already associated with a team.
+	setup_assistant_id int unsigned NOT NULL,
+
+	-- the ABM token used to define this profile in the Apple API.
+	abm_token_id int unsigned NOT NULL,
+
+	-- the profile UUID returned by the Apple API when defined with this ABM
+	-- token.
+	profile_uuid varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+
+	created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+
+	PRIMARY KEY (id),
+	UNIQUE KEY idx_mdm_apple_setup_assistant_profiles_asst_id_tok_id (setup_assistant_id, abm_token_id),
+	CONSTRAINT fk_mdm_apple_setup_assistant_profiles_setup_assistant_id
+		FOREIGN KEY (setup_assistant_id) REFERENCES mdm_apple_setup_assistants (id) ON DELETE CASCADE,
+	CONSTRAINT fk_mdm_apple_setup_assistant_profiles_abm_token_id
+		FOREIGN KEY (abm_token_id) REFERENCES abm_tokens (id) ON DELETE CASCADE
+)
+`
+	if _, err := tx.Exec(createCustomStmt); err != nil {
+		return fmt.Errorf("create mdm_apple_setup_assistant_profiles table: %w", err)
+	}
+
+	if abmTokenID > 0 {
+		// migrate any existing profile_uuid to the new table
+		const insertCustomStmt = `
+		INSERT INTO mdm_apple_setup_assistant_profiles (
+			setup_assistant_id,
+			abm_token_id,
+			profile_uuid,
+			updated_at
+		)
+		SELECT
+			mas.id,
+			?,
+			mas.profile_uuid,
+			mas.updated_at
+		FROM
+			mdm_apple_setup_assistants mas
+`
+		if _, err := tx.Exec(insertCustomStmt, abmTokenID); err != nil {
+			return fmt.Errorf("create mdm_apple_setup_assistant_profiles table: %w", err)
+		}
+	}
+
+	const alterCustomStmt = `
+	ALTER TABLE mdm_apple_setup_assistants
+		DROP COLUMN profile_uuid
+`
+	if _, err := tx.Exec(alterCustomStmt); err != nil {
+		return fmt.Errorf("alter mdm_apple_setup_assistants to drop profile_uuid: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240829165930(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829165930_SupportMultipleTokensForSetupAssistants_test.go b/server/datastore/mysql/migrations/tables/20240829165930_SupportMultipleTokensForSetupAssistants_test.go
new file mode 100644
index 000000000000..f496d918f795
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829165930_SupportMultipleTokensForSetupAssistants_test.go
@@ -0,0 +1,101 @@
+package tables
+
+import (
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jmoiron/sqlx"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240829165930_None(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	// Apply current migration.
+	applyNext(t, db)
+
+	// nothing in the default setup assistant
+	var count int
+	err := sqlx.Get(db, &count, `SELECT COUNT(*) FROM mdm_apple_default_setup_assistants`)
+	require.NoError(t, err)
+	require.Zero(t, count)
+
+	// nothing in the custom setup assistants
+	err = sqlx.Get(db, &count, `SELECT COUNT(*) FROM mdm_apple_setup_assistants`)
+	require.NoError(t, err)
+	require.Zero(t, count)
+
+	// nothing in the new custom setup table
+	err = sqlx.Get(db, &count, `SELECT COUNT(*) FROM mdm_apple_setup_assistant_profiles`)
+	require.NoError(t, err)
+	require.Zero(t, count)
+}
+
+func TestUp_20240829165930_Existing(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	// create the single ABM token (can only have 1 when this migration runs)
+	abmTokID := execNoErrLastID(t, db, "INSERT INTO abm_tokens (organization_name, apple_id, renew_at, token) VALUES (?, ?, ?, ?)", "org", "apple", time.Now(), uuid.NewString())
+
+	// create a couple teams
+	tm1 := execNoErrLastID(t, db, "INSERT INTO teams (name) VALUES ('team1')")
+	tm2 := execNoErrLastID(t, db, "INSERT INTO teams (name) VALUES ('team2')")
+
+	// setup the default assistant
+	execNoErr(t, db, `INSERT INTO mdm_apple_enrollment_profiles (token, type, dep_profile) VALUES (?, ?, ?)`, uuid.NewString(), "automatic", "{}")
+	defProfUUID := uuid.NewString()
+	execNoErr(t, db, `INSERT INTO mdm_apple_default_setup_assistants (team_id, global_or_team_id, profile_uuid) VALUES (?, ?, ?)`, nil, 0, defProfUUID)
+	execNoErr(t, db, `INSERT INTO mdm_apple_default_setup_assistants (team_id, global_or_team_id, profile_uuid) VALUES (?, ?, ?)`, tm1, tm1, defProfUUID)
+	// no profile registered for team 2
+	execNoErr(t, db, `INSERT INTO mdm_apple_default_setup_assistants (team_id, global_or_team_id, profile_uuid) VALUES (?, ?, ?)`, tm2, tm2, "")
+
+	// load the default assistant timestamps (ordered by global or team id)
+	var defTs []time.Time
+	err := sqlx.Select(db, &defTs, `SELECT updated_at FROM mdm_apple_default_setup_assistants ORDER BY global_or_team_id`)
+	require.NoError(t, err)
+
+	// create a custom setup assistant for tm1
+	asst1ProfUUID := uuid.NewString()
+	asst1 := execNoErrLastID(t, db, `INSERT INTO mdm_apple_setup_assistants (team_id, global_or_team_id, name, profile, profile_uuid) VALUES (?, ?, ?, ?, ?)`, tm1, tm1, "asst1", "{}", asst1ProfUUID)
+
+	// load the custom assistant timestamp
+	var asst1Ts time.Time
+	err = sqlx.Get(db, &asst1Ts, `SELECT updated_at FROM mdm_apple_setup_assistants WHERE id = ?`, asst1)
+	require.NoError(t, err)
+
+	// Apply current migration.
+	applyNext(t, db)
+
+	// the default assistants have the ABM token stored, otherwise unchanged
+	var postDefTs []time.Time
+	err = sqlx.Select(db, &postDefTs, `SELECT updated_at FROM mdm_apple_default_setup_assistants ORDER BY global_or_team_id`)
+	require.NoError(t, err)
+	require.ElementsMatch(t, defTs, postDefTs)
+
+	var count int
+	err = sqlx.Get(db, &count, `SELECT COUNT(*) FROM mdm_apple_default_setup_assistants WHERE abm_token_id = ?`, abmTokID)
+	require.NoError(t, err)
+	require.Equal(t, len(postDefTs), count)
+	require.Equal(t, 3, count)
+
+	// inserting another default assistant with an existing team+token fails (new unique constraint)
+	_, err = db.Exec(`INSERT INTO mdm_apple_default_setup_assistants (team_id, global_or_team_id, abm_token_id) VALUES (?, ?, ?)`, nil, 0, abmTokID)
+	require.Error(t, err)
+	require.ErrorContains(t, err, "Duplicate entry")
+
+	// the custom assistant entry has been created in the new table with the same timestamp and correct token ID
+	var customAssts []struct {
+		SetupAssistantID uint      `db:"setup_assistant_id"`
+		ABMTokenID       uint      `db:"abm_token_id"`
+		ProfileUUID      string    `db:"profile_uuid"`
+		UpdatedAt        time.Time `db:"updated_at"`
+	}
+	err = sqlx.Select(db, &customAssts, `SELECT setup_assistant_id, abm_token_id, profile_uuid, updated_at FROM mdm_apple_setup_assistant_profiles`)
+	require.NoError(t, err)
+	require.Len(t, customAssts, 1)
+	require.EqualValues(t, asst1, customAssts[0].SetupAssistantID)
+	require.EqualValues(t, abmTokID, customAssts[0].ABMTokenID)
+	require.Equal(t, asst1ProfUUID, customAssts[0].ProfileUUID)
+	require.Equal(t, asst1Ts, customAssts[0].UpdatedAt)
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829170023_CreateVPPTokenTeamsJoinTable.go b/server/datastore/mysql/migrations/tables/20240829170023_CreateVPPTokenTeamsJoinTable.go
new file mode 100644
index 000000000000..c4c92b203be8
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829170023_CreateVPPTokenTeamsJoinTable.go
@@ -0,0 +1,51 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240829170023, Down_20240829170023)
+}
+
+func Up_20240829170023(tx *sql.Tx) error {
+	_, err := tx.Exec(`
+CREATE TABLE vpp_token_teams (
+	id int unsigned NOT NULL PRIMARY KEY AUTO_INCREMENT,
+    vpp_token_id int unsigned NOT NULL,
+	team_id int unsigned,
+	null_team_type enum('none','allteams','noteam') COLLATE utf8mb4_unicode_ci DEFAULT 'none',
+	UNIQUE KEY idx_vpp_token_teams_team_id (team_id),
+	-- Note that this is only a partial constraint. There can be only
+	-- one token per team, but the team "No team" and "all teams" have
+	-- to be checked manually in go code
+	CONSTRAINT fk_vpp_token_teams_team_id FOREIGN KEY (team_id) REFERENCES teams (id) ON DELETE CASCADE,
+	CONSTRAINT fk_vpp_token_teams_vpp_token_id FOREIGN KEY (vpp_token_id) REFERENCES vpp_tokens (id) ON DELETE CASCADE
+);
+
+INSERT INTO vpp_token_teams (
+	vpp_token_id,
+	team_id,
+	null_team_type
+) SELECT
+	id,
+	team_id,
+	null_team_type
+FROM vpp_tokens;
+
+ALTER TABLE vpp_tokens DROP FOREIGN KEY fk_vpp_tokens_team_id;
+ALTER TABLE vpp_tokens DROP CONSTRAINT idx_vpp_tokens_team_id;
+ALTER TABLE vpp_tokens DROP COLUMN team_id;
+ALTER TABLE vpp_tokens DROP COLUMN null_team_type;
+`)
+	if err != nil {
+		return fmt.Errorf("migrating vpp_tokens associations to join table: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240829170023(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829170023_CreateVPPTokenTeamsJoinTable_test.go b/server/datastore/mysql/migrations/tables/20240829170023_CreateVPPTokenTeamsJoinTable_test.go
new file mode 100644
index 000000000000..8d4d65e54424
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829170023_CreateVPPTokenTeamsJoinTable_test.go
@@ -0,0 +1,118 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/fleetdm/fleet/v4/server/ptr"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240829170023(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	_, err := db.Exec("INSERT INTO teams (name) VALUES (?)", "team1")
+	require.NoError(t, err)
+
+	_, err = db.Exec(`
+	INSERT INTO vpp_tokens (
+		organization_name,
+		location,
+		renew_at,
+		token,
+		team_id,
+		null_team_type
+	) VALUES
+		(?, ?, ?, ?, ?, ?),
+		(?, ?, ?, ?, ?, ?),
+		(?, ?, ?, ?, ?, ?)
+	`,
+		"org1", "loc1", "2030-01-01 10:10:10", "blob1", 1, "none",
+		"org2", "loc2", "2030-02-01 10:10:10", "blob2", nil, "noteam",
+		"org3", "loc3", "2030-03-01 10:10:10", "blob3", nil, "allteams",
+	)
+	require.NoError(t, err)
+
+	var count []int
+	err = db.Select(&count, "SELECT COUNT(*) FROM vpp_tokens")
+	require.NoError(t, err)
+	require.Equal(t, 3, count[0])
+
+	// Apply current migration.
+	applyNext(t, db)
+
+	var sel []selresult
+
+	err = db.Select(&sel, `
+	SELECT
+		v.organization_name,
+		v.token,
+		j.vpp_token_id,
+		j.team_id,
+		j.null_team_type
+	FROM
+		vpp_tokens v
+	LEFT OUTER JOIN
+		vpp_token_teams j
+	ON
+		v.id = j.vpp_token_id
+	`)
+	require.NoError(t, err)
+	require.Len(t, sel, 3)
+
+	expected := []selresult{
+		{
+			// Make assumptions about autoincrement IDs
+			TokenID:  1,
+			Org:      "org1",
+			Token:    "blob1",
+			TeamID:   ptr.Int(1),
+			NullTeam: "none",
+		},
+		{
+			TokenID:  2,
+			Org:      "org2",
+			Token:    "blob2",
+			TeamID:   nil,
+			NullTeam: "noteam",
+		},
+		{
+			TokenID:  3,
+			Org:      "org3",
+			Token:    "blob3",
+			TeamID:   nil,
+			NullTeam: "allteams",
+		},
+	}
+
+	for _, exp := range expected {
+		actual := find(t, sel, exp.TokenID)
+		assert.Equal(t, exp.Org, actual.Org)
+		assert.Equal(t, exp.Token, actual.Token)
+		if exp.TeamID == nil {
+			assert.Nil(t, actual.TeamID)
+		} else {
+			assert.Equal(t, *exp.TeamID, *actual.TeamID)
+		}
+		assert.Equal(t, exp.NullTeam, actual.NullTeam)
+	}
+}
+
+type selresult struct {
+	TokenID  int    `db:"vpp_token_id"`
+	Org      string `db:"organization_name"`
+	Token    string `db:"token"`
+	TeamID   *int   `db:"team_id"`
+	NullTeam string `db:"null_team_type"`
+}
+
+func find(t *testing.T, arr []selresult, tokenID int) selresult {
+	for _, thing := range arr {
+		if thing.TokenID == tokenID {
+			return thing
+		}
+	}
+
+	t.Errorf("failed to find result with tokenID %d", tokenID)
+	return selresult{}
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829170033_AddVPPTokenIDToVppAppsTeams.go b/server/datastore/mysql/migrations/tables/20240829170033_AddVPPTokenIDToVppAppsTeams.go
new file mode 100644
index 000000000000..ea367f59ea69
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829170033_AddVPPTokenIDToVppAppsTeams.go
@@ -0,0 +1,43 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240829170033, Down_20240829170033)
+}
+
+func Up_20240829170033(tx *sql.Tx) error {
+	stmtAddColumn := `
+ALTER TABLE vpp_apps_teams
+	ADD COLUMN vpp_token_id int(10) UNSIGNED NOT NULL`
+
+	stmtAssociate := `UPDATE vpp_apps_teams SET vpp_token_id = (SELECT id FROM vpp_tokens LIMIT 1)`
+
+	stmtAddConstraint := `
+ALTER TABLE vpp_apps_teams
+	ADD CONSTRAINT fk_vpp_apps_teams_vpp_token_id
+		FOREIGN KEY (vpp_token_id) REFERENCES vpp_tokens(id) ON DELETE CASCADE`
+
+	if _, err := tx.Exec(stmtAddColumn); err != nil {
+		return fmt.Errorf("failed to add vpp_token_id column to table: %w", err)
+	}
+
+	// Associate apps with the first token available. If we're
+	// migrating from single-token VPP this should be correct.
+	if _, err := tx.Exec(stmtAssociate); err != nil {
+		return fmt.Errorf("failed to associate vpp apps with first token: %w", err)
+	}
+
+	if _, err := tx.Exec(stmtAddConstraint); err != nil {
+		return fmt.Errorf("failed to add vpp token id constraint: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240829170033(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829170044_PolicyAutomaticInstallSoftware.go b/server/datastore/mysql/migrations/tables/20240829170044_PolicyAutomaticInstallSoftware.go
new file mode 100644
index 000000000000..ac1fd4180289
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829170044_PolicyAutomaticInstallSoftware.go
@@ -0,0 +1,37 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240829170044, Down_20240829170044)
+}
+
+func Up_20240829170044(tx *sql.Tx) error {
+	if _, err := tx.Exec(`
+		ALTER TABLE policies
+		ADD COLUMN software_installer_id INT UNSIGNED DEFAULT NULL,
+		ADD FOREIGN KEY fk_policies_software_installer_id (software_installer_id) REFERENCES software_installers (id);
+	`); err != nil {
+		return fmt.Errorf("failed to add software_installer_id to policies: %w", err)
+	}
+
+	// We store `user_name` and `user_email` in case the user is deleted from Fleet (`user_id` set to NULL).
+	if _, err := tx.Exec(`
+		ALTER TABLE software_installers
+		ADD COLUMN user_id INT(10) UNSIGNED DEFAULT NULL,
+		ADD COLUMN user_name VARCHAR(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+		ADD COLUMN user_email VARCHAR(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+		ADD CONSTRAINT fk_software_installers_user_id FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE SET NULL;
+	`); err != nil {
+		return fmt.Errorf("failed to add user_id to software_installers: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240829170044(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240905105135_AddAutoIncrementColumnToProfiles.go b/server/datastore/mysql/migrations/tables/20240905105135_AddAutoIncrementColumnToProfiles.go
new file mode 100644
index 000000000000..19eed6bee79b
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240905105135_AddAutoIncrementColumnToProfiles.go
@@ -0,0 +1,40 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240905105135, Down_20240905105135)
+}
+
+func Up_20240905105135(tx *sql.Tx) error {
+	// The AUTO_INCREMENT columns are used to determine if a row was updated by an INSERT ... ON DUPLICATE KEY UPDATE statement.
+	// This is needed because we are currently using CLIENT_FOUND_ROWS option to determine if a row was found.
+	// And in order to find if the row was updated, we need to check LAST_INSERT_ID().
+	// MySQL docs: https://dev.mysql.com/doc/refman/8.4/en/insert-on-duplicate.html
+
+	if !columnExists(tx, "mdm_windows_configuration_profiles", "auto_increment") {
+		if _, err := tx.Exec(`
+ALTER TABLE mdm_windows_configuration_profiles
+ADD COLUMN auto_increment BIGINT NOT NULL AUTO_INCREMENT UNIQUE
+`); err != nil {
+			return fmt.Errorf("failed to add auto_increment to mdm_windows_configuration_profiles: %w", err)
+		}
+	}
+
+	if !columnExists(tx, "mdm_apple_declarations", "auto_increment") {
+		if _, err := tx.Exec(`
+ALTER TABLE mdm_apple_declarations
+ADD COLUMN auto_increment BIGINT NOT NULL AUTO_INCREMENT UNIQUE
+`); err != nil {
+			return fmt.Errorf("failed to add auto_increment to mdm_apple_declarations: %w", err)
+		}
+	}
+	return nil
+}
+
+func Down_20240905105135(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240905140514_AddURLToSoftwareInstallers.go b/server/datastore/mysql/migrations/tables/20240905140514_AddURLToSoftwareInstallers.go
new file mode 100644
index 000000000000..2da6ca5bdbed
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240905140514_AddURLToSoftwareInstallers.go
@@ -0,0 +1,25 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240905140514, Down_20240905140514)
+}
+
+func Up_20240905140514(tx *sql.Tx) error {
+	// The new 'url' column will only be set for software uploaded in batch via GitOps.
+	if _, err := tx.Exec(`
+		ALTER TABLE software_installers
+		ADD COLUMN url VARCHAR(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '';
+	`); err != nil {
+		return fmt.Errorf("failed to add url to software_installers: %w", err)
+	}
+	return nil
+}
+
+func Down_20240905140514(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/migration.go b/server/datastore/mysql/migrations/tables/migration.go
index a7872b5f7b1d..ca62d5cd9ba8 100644
--- a/server/datastore/mysql/migrations/tables/migration.go
+++ b/server/datastore/mysql/migrations/tables/migration.go
@@ -50,6 +50,27 @@ WHERE
 	return count > 0
 }
 
+func tableExists(tx *sql.Tx, table string) bool {
+	var count int
+	err := tx.QueryRow(
+		`
+SELECT
+    count(*)
+FROM
+    information_schema.columns
+WHERE
+    TABLE_SCHEMA = DATABASE()
+    AND TABLE_NAME = ?
+`,
+		table,
+	).Scan(&count)
+	if err != nil {
+		return false
+	}
+
+	return count > 0
+}
+
 func indexExists(tx *sqlx.DB, table, index string) bool {
 	var count int
 	err := tx.QueryRow(`
@@ -66,6 +87,22 @@ AND index_name = ?
 	return count > 0
 }
 
+func indexExistsTx(tx *sql.Tx, table, index string) bool {
+	var count int
+	err := tx.QueryRow(`
+SELECT COUNT(1)
+FROM INFORMATION_SCHEMA.STATISTICS
+WHERE table_schema = DATABASE()
+AND table_name = ?
+AND index_name = ?
+`, table, index).Scan(&count)
+	if err != nil {
+		return false
+	}
+
+	return count > 0
+}
+
 // updateAppConfigJSON updates the `json_value` stored in the `app_config_json` after applying the
 // supplied callback to the current config object.
 func updateAppConfigJSON(tx *sql.Tx, fn func(config *fleet.AppConfig) error) error {
diff --git a/server/datastore/mysql/migrations/tables/migration_test.go b/server/datastore/mysql/migrations/tables/migration_test.go
index ffe2d1686635..6ea84ec50c71 100644
--- a/server/datastore/mysql/migrations/tables/migration_test.go
+++ b/server/datastore/mysql/migrations/tables/migration_test.go
@@ -48,7 +48,9 @@ func newDBConnForTests(t *testing.T) *sqlx.DB {
 		fmt.Sprintf("%s:%s@tcp(%s)/?charset=utf8mb4&parseTime=true&loc=UTC&multiStatements=true", testUsername, testPassword, testAddress),
 	)
 	require.NoError(t, err)
-	_, err = db.Exec(fmt.Sprintf("DROP DATABASE IF EXISTS %s; CREATE DATABASE %s; USE %s;", t.Name(), t.Name(), t.Name()))
+
+	name := strings.ReplaceAll(strings.ReplaceAll(t.Name(), "/", "_"), " ", "_")
+	_, err = db.Exec(fmt.Sprintf("DROP DATABASE IF EXISTS %s; CREATE DATABASE %s; USE %s;", name, name, name))
 	require.NoError(t, err)
 	return db
 }
@@ -56,8 +58,25 @@ func newDBConnForTests(t *testing.T) *sqlx.DB {
 func getMigrationVersion(t *testing.T) int64 {
 	// Migration test functions look like this:
 	//   func TestUp_20231109115838(t *testing.T)
-	// so this extracts the timestamp part only.
-	v, err := strconv.Atoi(strings.TrimPrefix(t.Name(), "TestUp_"))
+	//
+	// and multiple unit tests for the same migration version can be done by
+	// following this naming pattern:
+	//   func TestUp_20231109115838_scenario1(t *testing.T)
+	//   func TestUp_20231109115838_scenario2(t *testing.T)
+	//
+	// Note that sub-tests can also be used, so:
+	//   func TestUp_20231109115838(t *testing.T) {
+	//     t.Run("scenario1", func(t *testing.T) {...}
+	//   }
+	// also works (calling applyUpToPrev in each sub-test to create a new test
+	// database).
+	//
+	// This extracts the migration version (timestamp) from the test name.
+
+	baseName, _, _ := strings.Cut(t.Name(), "/")
+	withoutPrefix := strings.TrimPrefix(baseName, "TestUp_")
+	timestampPart, _, _ := strings.Cut(withoutPrefix, "_")
+	v, err := strconv.Atoi(timestampPart)
 	require.NoError(t, err)
 	return int64(v)
 }
diff --git a/server/datastore/mysql/migrations_test.go b/server/datastore/mysql/migrations_test.go
index a8a010dc8fcc..e782e0d2b2dc 100644
--- a/server/datastore/mysql/migrations_test.go
+++ b/server/datastore/mysql/migrations_test.go
@@ -64,7 +64,7 @@ func TestMigrations(t *testing.T) {
 
 	// Dump schema to dumpfile
 	cmd := exec.Command(
-		"docker-compose", "exec", "-T", "mysql_test",
+		"docker", "compose", "exec", "-T", "mysql_test",
 		// Command run inside container
 		"mysqldump", "-u"+testUsername, "-p"+testPassword, "TestMigrations", "--compact", "--skip-comments",
 	)
diff --git a/server/datastore/mysql/mysql.go b/server/datastore/mysql/mysql.go
index 66dd38483622..3acfa46f638e 100644
--- a/server/datastore/mysql/mysql.go
+++ b/server/datastore/mysql/mysql.go
@@ -82,6 +82,8 @@ type Datastore struct {
 	testDeleteMDMProfilesBatchSize int
 	// for tests, set to override the default batch size.
 	testUpsertMDMDesiredProfilesBatchSize int
+	// for tests set to override the default batch size.
+	testSelectMDMProfilesBatchSize int
 
 	// set this in tests to simulate an error at various stages in the
 	// batchSetMDMAppleProfilesDB execution: if the string starts with "insert", it
@@ -160,6 +162,22 @@ func (ds *Datastore) loadOrPrepareStmt(ctx context.Context, query string) *sqlx.
 	return stmt
 }
 
+func (ds *Datastore) deleteCachedStmt(query string) {
+	ds.stmtCacheMu.Lock()
+	defer ds.stmtCacheMu.Unlock()
+	stmt, ok := ds.stmtCache[query]
+	if ok {
+		if err := stmt.Close(); err != nil {
+			level.Error(ds.logger).Log(
+				"msg", "failed to close prepared statement before deleting it",
+				"query", query,
+				"err", err,
+			)
+		}
+		delete(ds.stmtCache, query)
+	}
+}
+
 // NewMDMAppleSCEPDepot returns a scep_depot.Depot that uses the Datastore
 // underlying MySQL writer *sql.DB.
 func (ds *Datastore) NewSCEPDepot() (scep_depot.Depot, error) {
@@ -901,7 +919,7 @@ func (ds *Datastore) whereFilterHostsByTeams(filter fleet.TeamFilter, hostKey st
 // filterTableAlias is the name/alias of the table to use in generating the
 // SQL.
 func (ds *Datastore) whereFilterGlobalOrTeamIDByTeams(filter fleet.TeamFilter, filterTableAlias string) string {
-	globalFilter := fmt.Sprintf("%s.team_id = 0", filterTableAlias)
+	globalFilter := fmt.Sprintf("%s.team_id = 0 AND %[1]s.global_stats = 1", filterTableAlias)
 	teamIDFilter := fmt.Sprintf("%s.team_id", filterTableAlias)
 	return ds.whereFilterGlobalOrTeamIDByTeamsWithSqlFilter(filter, globalFilter, teamIDFilter)
 }
@@ -1224,21 +1242,7 @@ func (ds *Datastore) ProcessList(ctx context.Context) ([]fleet.MySQLProcess, err
 	return processList, nil
 }
 
-func insertOnDuplicateDidInsert(res sql.Result) bool {
-	// Note that connection string sets CLIENT_FOUND_ROWS (see
-	// generateMysqlConnectionString in this package), so LastInsertId is 0
-	// and RowsAffected 1 when a row is set to its current values.
-	//
-	// See [the docs][1] or @mna's comment in `insertOnDuplicateDidUpdate`
-	// below for more details
-	//
-	// [1]: https://dev.mysql.com/doc/refman/5.7/en/insert-on-duplicate.html
-	lastID, _ := res.LastInsertId()
-	affected, _ := res.RowsAffected()
-	return lastID != 0 && affected == 1
-}
-
-func insertOnDuplicateDidUpdate(res sql.Result) bool {
+func insertOnDuplicateDidInsertOrUpdate(res sql.Result) bool {
 	// From mysql's documentation:
 	//
 	// With ON DUPLICATE KEY UPDATE, the affected-rows value per row is 1 if
@@ -1248,7 +1252,10 @@ func insertOnDuplicateDidUpdate(res sql.Result) bool {
 	// connecting to mysqld, the affected-rows value is 1 (not 0) if an
 	// existing row is set to its current values.
 	//
-	// https://dev.mysql.com/doc/refman/5.7/en/insert-on-duplicate.html
+	// If a table contains an AUTO_INCREMENT column and INSERT ... ON DUPLICATE KEY UPDATE
+	// inserts or updates a row, the LAST_INSERT_ID() function returns the AUTO_INCREMENT value.
+	//
+	// https://dev.mysql.com/doc/refman/8.4/en/insert-on-duplicate.html
 	//
 	// Note that connection string sets CLIENT_FOUND_ROWS (see
 	// generateMysqlConnectionString in this package), so it does return 1 when
@@ -1263,7 +1270,8 @@ func insertOnDuplicateDidUpdate(res sql.Result) bool {
 
 	lastID, _ := res.LastInsertId()
 	aff, _ := res.RowsAffected()
-	return lastID == 0 || aff != 1
+	// something was updated (lastID != 0) AND row was found (aff == 1 or higher if more rows were found)
+	return lastID != 0 && aff > 0
 }
 
 type parameterizedStmt struct {
@@ -1282,6 +1290,13 @@ type parameterizedStmt struct {
 //
 // The read statement must only SELECT the id column.
 func (ds *Datastore) optimisticGetOrInsert(ctx context.Context, readStmt, insertStmt *parameterizedStmt) (id uint, err error) {
+	return ds.optimisticGetOrInsertWithWriter(ctx, ds.writer(ctx), readStmt, insertStmt)
+}
+
+// optimisticGetOrInsertWithWriter is the same as optimisticGetOrInsert but it
+// uses the provided writer to perform the insert or second read operations.
+// This makes it possible to use this from inside a transaction.
+func (ds *Datastore) optimisticGetOrInsertWithWriter(ctx context.Context, writer sqlx.ExtContext, readStmt, insertStmt *parameterizedStmt) (id uint, err error) { //nolint: gocritic // it's ok in this case to use ds.reader even if we receive an ExtContext
 	readID := func(q sqlx.QueryerContext) (uint, error) {
 		var id uint
 		err := sqlx.GetContext(ctx, q, &id, readStmt.Statement, readStmt.Args...)
@@ -1293,12 +1308,12 @@ func (ds *Datastore) optimisticGetOrInsert(ctx context.Context, readStmt, insert
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
 			// this does not exist yet, try to insert it
-			res, err := ds.writer(ctx).ExecContext(ctx, insertStmt.Statement, insertStmt.Args...)
+			res, err := writer.ExecContext(ctx, insertStmt.Statement, insertStmt.Args...)
 			if err != nil {
 				if IsDuplicate(err) {
 					// it might've been created between the select and the insert, read
 					// again this time from the primary database connection.
-					id, err := readID(ds.writer(ctx))
+					id, err := readID(writer)
 					if err != nil {
 						return 0, ctxerr.Wrap(ctx, err, "get id from writer")
 					}
diff --git a/server/datastore/mysql/mysql_test.go b/server/datastore/mysql/mysql_test.go
index e28ae949ee89..228715fffff8 100644
--- a/server/datastore/mysql/mysql_test.go
+++ b/server/datastore/mysql/mysql_test.go
@@ -1037,17 +1037,20 @@ func TestWhereFilterGlobalOrTeamIDByTeams(t *testing.T) {
 	t.Parallel()
 
 	testCases := []struct {
+		name     string
 		filter   fleet.TeamFilter
 		expected string
 	}{
 		// No teams or global role
 		{
+			name: "empty user",
 			filter: fleet.TeamFilter{
 				User: &fleet.User{},
 			},
 			expected: "FALSE",
 		},
 		{
+			name: "empty user teams",
 			filter: fleet.TeamFilter{
 				User: &fleet.User{Teams: []fleet.UserTeam{}},
 			},
@@ -1056,33 +1059,38 @@ func TestWhereFilterGlobalOrTeamIDByTeams(t *testing.T) {
 
 		// Global role
 		{
+			name: "global admin",
 			filter: fleet.TeamFilter{
 				User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)},
 			},
-			expected: "hosts.team_id = 0",
+			expected: "hosts.team_id = 0 AND hosts.global_stats = 1",
 		},
 		{
+			name: "global maintainer",
 			filter: fleet.TeamFilter{
 				User: &fleet.User{GlobalRole: ptr.String(fleet.RoleMaintainer)},
 			},
-			expected: "hosts.team_id = 0",
+			expected: "hosts.team_id = 0 AND hosts.global_stats = 1",
 		},
 		{
+			name: "global observer",
 			filter: fleet.TeamFilter{
 				User: &fleet.User{GlobalRole: ptr.String(fleet.RoleObserver)},
 			},
 			expected: "FALSE",
 		},
 		{
+			name: "global observer include",
 			filter: fleet.TeamFilter{
 				User:            &fleet.User{GlobalRole: ptr.String(fleet.RoleObserver)},
 				IncludeObserver: true,
 			},
-			expected: "hosts.team_id = 0",
+			expected: "hosts.team_id = 0 AND hosts.global_stats = 1",
 		},
 
 		// Team roles
 		{
+			name: "team observer",
 			filter: fleet.TeamFilter{
 				User: &fleet.User{
 					Teams: []fleet.UserTeam{
@@ -1093,6 +1101,7 @@ func TestWhereFilterGlobalOrTeamIDByTeams(t *testing.T) {
 			expected: "FALSE",
 		},
 		{
+			name: "team observer include",
 			filter: fleet.TeamFilter{
 				User: &fleet.User{
 					Teams: []fleet.UserTeam{
@@ -1104,6 +1113,7 @@ func TestWhereFilterGlobalOrTeamIDByTeams(t *testing.T) {
 			expected: "hosts.team_id IN (1)",
 		},
 		{
+			name: "multi team observer",
 			filter: fleet.TeamFilter{
 				User: &fleet.User{
 					Teams: []fleet.UserTeam{
@@ -1115,6 +1125,7 @@ func TestWhereFilterGlobalOrTeamIDByTeams(t *testing.T) {
 			expected: "FALSE",
 		},
 		{
+			name: "multi team maintainer and observer",
 			filter: fleet.TeamFilter{
 				User: &fleet.User{
 					Teams: []fleet.UserTeam{
@@ -1126,6 +1137,7 @@ func TestWhereFilterGlobalOrTeamIDByTeams(t *testing.T) {
 			expected: "hosts.team_id IN (2)",
 		},
 		{
+			name: "multi team maintainer and observer include",
 			filter: fleet.TeamFilter{
 				User: &fleet.User{
 					Teams: []fleet.UserTeam{
@@ -1138,6 +1150,7 @@ func TestWhereFilterGlobalOrTeamIDByTeams(t *testing.T) {
 			expected: "hosts.team_id IN (1,2)",
 		},
 		{
+			name: "multi team maintainer and observer with invalid role",
 			filter: fleet.TeamFilter{
 				User: &fleet.User{
 					Teams: []fleet.UserTeam{
@@ -1151,6 +1164,7 @@ func TestWhereFilterGlobalOrTeamIDByTeams(t *testing.T) {
 			expected: "hosts.team_id IN (2)",
 		},
 		{
+			name: "multi team maintainer and observer and admin",
 			filter: fleet.TeamFilter{
 				User: &fleet.User{
 					Teams: []fleet.UserTeam{
@@ -1164,12 +1178,14 @@ func TestWhereFilterGlobalOrTeamIDByTeams(t *testing.T) {
 			expected: "hosts.team_id IN (2,3)",
 		},
 		{
+			name: "team id only",
 			filter: fleet.TeamFilter{
 				TeamID: ptr.Uint(1),
 			},
 			expected: "FALSE",
 		},
 		{
+			name: "team id with observer include",
 			filter: fleet.TeamFilter{
 				User:            &fleet.User{GlobalRole: ptr.String(fleet.RoleObserver)},
 				IncludeObserver: true,
@@ -1178,6 +1194,7 @@ func TestWhereFilterGlobalOrTeamIDByTeams(t *testing.T) {
 			expected: "hosts.team_id = 1",
 		},
 		{
+			name: "team id with observer exclude",
 			filter: fleet.TeamFilter{
 				User:            &fleet.User{GlobalRole: ptr.String(fleet.RoleObserver)},
 				IncludeObserver: false,
@@ -1186,6 +1203,7 @@ func TestWhereFilterGlobalOrTeamIDByTeams(t *testing.T) {
 			expected: "FALSE",
 		},
 		{
+			name: "team id with admin exclude observer",
 			filter: fleet.TeamFilter{
 				User:            &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)},
 				IncludeObserver: false,
@@ -1194,6 +1212,7 @@ func TestWhereFilterGlobalOrTeamIDByTeams(t *testing.T) {
 			expected: "hosts.team_id = 1",
 		},
 		{
+			name: "team id not in multiple team roles",
 			filter: fleet.TeamFilter{
 				User: &fleet.User{
 					Teams: []fleet.UserTeam{
@@ -1206,6 +1225,7 @@ func TestWhereFilterGlobalOrTeamIDByTeams(t *testing.T) {
 			expected: "FALSE",
 		},
 		{
+			name: "team id in multiple team roles",
 			filter: fleet.TeamFilter{
 				User: &fleet.User{
 					Teams: []fleet.UserTeam{
@@ -1221,7 +1241,7 @@ func TestWhereFilterGlobalOrTeamIDByTeams(t *testing.T) {
 
 	for _, tt := range testCases {
 		tt := tt
-		t.Run("", func(t *testing.T) {
+		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			ds := &Datastore{logger: log.NewNopLogger()}
 			sql := ds.whereFilterGlobalOrTeamIDByTeams(tt.filter, "hosts")
@@ -1281,3 +1301,85 @@ func TestBatchProcessDB(t *testing.T) {
 		require.Equal(t, 2, callCount)
 	})
 }
+
+func TestGetContextTryStmt(t *testing.T) {
+	ctx := context.Background()
+
+	dbMock, ds := mockDatastore(t)
+	ds.stmtCache = map[string]*sqlx.Stmt{}
+
+	t.Run("get with unknown statement error", func(t *testing.T) {
+		count := 0
+		query := "SELECT 1"
+
+		// first call to cache the statement
+		dbMock.ExpectPrepare(query)
+		mockResult := sqlmock.NewRows([]string{query})
+		mockResult.AddRow("1")
+		dbMock.ExpectQuery(query).WillReturnRows(mockResult)
+		err := ds.getContextTryStmt(ctx, &count, query)
+		require.NoError(t, err)
+		require.NoError(t, dbMock.ExpectationsWereMet())
+
+		// verify that the statement was cached
+		stmt := ds.loadOrPrepareStmt(ctx, query)
+		require.NotNil(t, stmt)
+
+		// call again to trigger the unknown statement error and ensure it retries
+		// first query, make it fail
+		queryMock := dbMock.ExpectQuery(query)
+		mySQLErr := &mysql.MySQLError{
+			Number: mysqlerr.ER_UNKNOWN_STMT_HANDLER,
+		}
+		queryMock.WillReturnError(mySQLErr)
+
+		// after the failure, a second call is made, this time without
+		// the prepared statement
+		mockResult = sqlmock.NewRows([]string{query})
+		mockResult.AddRow("1")
+		dbMock.ExpectQuery(query).WillReturnRows(mockResult)
+
+		// make the call and verify we removed the prepared statement
+		err = ds.getContextTryStmt(ctx, &count, query)
+		require.NoError(t, err)
+		require.NoError(t, dbMock.ExpectationsWereMet())
+		stmt = ds.loadOrPrepareStmt(ctx, query)
+		require.Nil(t, stmt)
+	})
+
+	t.Run("get with other error", func(t *testing.T) {
+		dbMock, ds := mockDatastore(t)
+		ds.stmtCache = map[string]*sqlx.Stmt{}
+		count := 0
+		query := "SELECT 1"
+
+		// first call to cache the statement
+		dbMock.ExpectPrepare(query)
+		mockResult := sqlmock.NewRows([]string{query})
+		mockResult.AddRow("1")
+		dbMock.ExpectQuery(query).WillReturnRows(mockResult)
+		err := ds.getContextTryStmt(ctx, &count, query)
+		require.NoError(t, err)
+		require.Equal(t, 1, count)
+		require.NoError(t, dbMock.ExpectationsWereMet())
+
+		// verify that the statement was cached
+		stmt := ds.loadOrPrepareStmt(ctx, query)
+		require.NotNil(t, stmt)
+
+		// return a duplicate error
+		queryMock := dbMock.ExpectQuery(query)
+		mySQLErr := &mysql.MySQLError{
+			Number: mysqlerr.ER_DUP_ENTRY,
+		}
+		queryMock.WillReturnError(mySQLErr)
+
+		count = 0
+		err = ds.getContextTryStmt(ctx, &count, query)
+		require.ErrorIs(t, mySQLErr, err)
+		require.NoError(t, dbMock.ExpectationsWereMet())
+		stmt = ds.loadOrPrepareStmt(ctx, query)
+		require.NotNil(t, stmt)
+	})
+
+}
diff --git a/server/datastore/mysql/nanomdm_storage.go b/server/datastore/mysql/nanomdm_storage.go
index 2d89ac3f1c69..e032cab539ed 100644
--- a/server/datastore/mysql/nanomdm_storage.go
+++ b/server/datastore/mysql/nanomdm_storage.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"strings"
 
+	abmctx "github.com/fleetdm/fleet/v4/server/contexts/apple_bm"
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/mdm/assets"
@@ -135,6 +136,10 @@ func (s *NanoMDMStorage) GetAllMDMConfigAssetsByName(ctx context.Context, assetN
 	return s.ds.GetAllMDMConfigAssetsByName(ctx, assetNames)
 }
 
+func (s *NanoMDMStorage) GetABMTokenByOrgName(ctx context.Context, orgName string) (*fleet.ABMToken, error) {
+	return s.ds.GetABMTokenByOrgName(ctx, orgName)
+}
+
 // NewMDMAppleDEPStorage returns a MySQL nanodep storage that uses the Datastore
 // underlying MySQL writer *sql.DB.
 func (ds *Datastore) NewMDMAppleDEPStorage() (*NanoDEPStorage, error) {
@@ -156,9 +161,16 @@ type NanoDEPStorage struct {
 	ds fleet.Datastore
 }
 
-// RetrieveAuthTokens partially implements nanodep.AuthTokensRetriever.
+// RetrieveAuthTokens partially implements nanodep.AuthTokensRetriever. NOTE: this method will first
+// check the context for an ABM token; if it doesn't find one, it will fall back to checking the DB.
+// This is so we can use the existing DEP client machinery without major changes. See
+// https://github.com/fleetdm/fleet/issues/21177 for more details.
 func (s *NanoDEPStorage) RetrieveAuthTokens(ctx context.Context, name string) (*nanodep_client.OAuth1Tokens, error) {
-	token, err := assets.ABMToken(ctx, s.ds)
+	if ctxTok, ok := abmctx.FromContext(ctx); ok {
+		return ctxTok, nil
+	}
+
+	token, err := assets.ABMToken(ctx, s.ds, name)
 	if err != nil {
 		return nil, fmt.Errorf("retrieving token in nano dep storage: %w", err)
 	}
diff --git a/server/datastore/mysql/operating_system_vulnerabilities.go b/server/datastore/mysql/operating_system_vulnerabilities.go
index c7598e0464f2..8a6a30dec00c 100644
--- a/server/datastore/mysql/operating_system_vulnerabilities.go
+++ b/server/datastore/mysql/operating_system_vulnerabilities.go
@@ -123,7 +123,7 @@ func (ds *Datastore) InsertOSVulnerability(ctx context.Context, v fleet.OSVulner
 		return false, ctxerr.Wrap(ctx, err, "insert operating system vulnerability")
 	}
 
-	return insertOnDuplicateDidInsert(res), nil
+	return insertOnDuplicateDidInsertOrUpdate(res), nil
 }
 
 func (ds *Datastore) DeleteOSVulnerabilities(ctx context.Context, vulnerabilities []fleet.OSVulnerability) error {
diff --git a/server/datastore/mysql/operating_system_vulnerabilities_test.go b/server/datastore/mysql/operating_system_vulnerabilities_test.go
index 715d8eada3eb..0b477091cbd7 100644
--- a/server/datastore/mysql/operating_system_vulnerabilities_test.go
+++ b/server/datastore/mysql/operating_system_vulnerabilities_test.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/ptr"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -233,10 +234,15 @@ func testInsertOSVulnerability(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	require.True(t, didInsert)
 
-	// Inserting the same vulnerability should not insert
-	didInsert, err = ds.InsertOSVulnerability(ctx, vulnsUpdate, fleet.MSRCSource)
+	// Inserting the same vulnerability should not insert, but update
+	didInsertOrUpdate, err := ds.InsertOSVulnerability(ctx, vulnsUpdate, fleet.MSRCSource)
 	require.NoError(t, err)
-	require.Equal(t, false, didInsert)
+	assert.True(t, didInsertOrUpdate)
+
+	// Inserting the exact same vulnerability again should not insert and not update
+	didInsertOrUpdate, err = ds.InsertOSVulnerability(ctx, vulnsUpdate, fleet.MSRCSource)
+	require.NoError(t, err)
+	assert.False(t, didInsertOrUpdate)
 
 	expected := vulnsUpdate
 	expected.Source = fleet.MSRCSource
diff --git a/server/datastore/mysql/policies.go b/server/datastore/mysql/policies.go
index 4df1f9324a72..1c3cc024114c 100644
--- a/server/datastore/mysql/policies.go
+++ b/server/datastore/mysql/policies.go
@@ -22,12 +22,18 @@ import (
 
 const policyCols = `
 	p.id, p.team_id, p.resolution, p.name, p.query, p.description,
-	p.author_id, p.platforms, p.created_at, p.updated_at, p.critical, p.calendar_events_enabled
+	p.author_id, p.platforms, p.created_at, p.updated_at, p.critical,
+	p.calendar_events_enabled, p.software_installer_id
 `
 
+var errSoftwareTitleIDOnGlobalPolicy = errors.New("install software title id can be set on team policies only")
+
 var policySearchColumns = []string{"p.name"}
 
 func (ds *Datastore) NewGlobalPolicy(ctx context.Context, authorID *uint, args fleet.PolicyPayload) (*fleet.Policy, error) {
+	if args.SoftwareInstallerID != nil {
+		return nil, ctxerr.Wrap(ctx, errSoftwareTitleIDOnGlobalPolicy, "create policy")
+	}
 	if args.QueryID != nil {
 		q, err := ds.Query(ctx, *args.QueryID)
 		if err != nil {
@@ -129,15 +135,18 @@ func (ds *Datastore) PolicyLite(ctx context.Context, id uint) (*fleet.PolicyLite
 //
 // Currently, SavePolicy does not allow updating the team of an existing policy.
 func (ds *Datastore) SavePolicy(ctx context.Context, p *fleet.Policy, shouldRemoveAllPolicyMemberships bool, removePolicyStats bool) error {
+	if p.TeamID == nil && p.SoftwareInstallerID != nil {
+		return ctxerr.Wrap(ctx, errSoftwareTitleIDOnGlobalPolicy, "save policy")
+	}
 	// We must normalize the name for full Unicode support (Unicode equivalence).
 	p.Name = norm.NFC.String(p.Name)
 	sql := `
 		UPDATE policies
-			SET name = ?, query = ?, description = ?, resolution = ?, platforms = ?, critical = ?, calendar_events_enabled = ?, checksum = ` + policiesChecksumComputedColumn() + `
+			SET name = ?, query = ?, description = ?, resolution = ?, platforms = ?, critical = ?, calendar_events_enabled = ?, software_installer_id = ?, checksum = ` + policiesChecksumComputedColumn() + `
 			WHERE id = ?
 	`
 	result, err := ds.writer(ctx).ExecContext(
-		ctx, sql, p.Name, p.Query, p.Description, p.Resolution, p.Platform, p.Critical, p.CalendarEventsEnabled, p.ID,
+		ctx, sql, p.Name, p.Query, p.Description, p.Resolution, p.Platform, p.Critical, p.CalendarEventsEnabled, p.SoftwareInstallerID, p.ID,
 	)
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "updating policy")
@@ -484,7 +493,8 @@ func (ds *Datastore) PoliciesByID(ctx context.Context, ids []uint) (map[uint]*fl
 	  COALESCE(u.email, '') AS author_email,
 	  ps.updated_at as host_count_updated_at,
 	  COALESCE(ps.passing_host_count, 0) as passing_host_count,
-	  COALESCE(ps.failing_host_count, 0) as failing_host_count
+	  COALESCE(ps.failing_host_count, 0) as failing_host_count,
+	  p.software_installer_id
 	  FROM policies p
 	  LEFT JOIN users u ON p.author_id = u.id
 	  LEFT JOIN policy_stats ps ON p.id = ps.policy_id
@@ -601,11 +611,11 @@ func (ds *Datastore) NewTeamPolicy(ctx context.Context, teamID uint, authorID *u
 	nameUnicode := norm.NFC.String(args.Name)
 	res, err := ds.writer(ctx).ExecContext(ctx,
 		fmt.Sprintf(
-			`INSERT INTO policies (name, query, description, team_id, resolution, author_id, platforms, critical, calendar_events_enabled, checksum) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, %s)`,
+			`INSERT INTO policies (name, query, description, team_id, resolution, author_id, platforms, critical, calendar_events_enabled, software_installer_id, checksum) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, %s)`,
 			policiesChecksumComputedColumn(),
 		),
 		nameUnicode, args.Query, args.Description, teamID, args.Resolution, authorID, args.Platform, args.Critical,
-		args.CalendarEventsEnabled,
+		args.CalendarEventsEnabled, args.SoftwareInstallerID,
 	)
 	switch {
 	case err == nil:
@@ -691,6 +701,7 @@ func (ds *Datastore) ApplyPolicySpecs(ctx context.Context, authorID uint, specs
 	// Preprocess specs and group them by team
 	teamNameToID := make(map[string]uint, 1)
 	teamIDToPolicies := make(map[uint][]*fleet.PolicySpec, 1)
+	softwareInstallerIDs := make(map[uint]map[uint]*uint) // teamID -> titleID -> softwareInstallerID
 
 	// Get the team IDs
 	for _, spec := range specs {
@@ -714,6 +725,30 @@ func (ds *Datastore) ApplyPolicySpecs(ctx context.Context, authorID uint, specs
 		teamIDToPolicies[teamID] = append(teamIDToPolicies[teamID], spec)
 	}
 
+	// Get software installer ids from software title ids.
+	for _, spec := range specs {
+		if spec.SoftwareTitleID == nil || *spec.SoftwareTitleID == 0 {
+			continue
+		}
+		if spec.Team == "" {
+			return ctxerr.Wrap(ctx, errSoftwareTitleIDOnGlobalPolicy, "create policy from spec")
+		}
+		var softwareInstallerID uint
+		err := sqlx.GetContext(ctx, queryerContext, &softwareInstallerID,
+			`SELECT id FROM software_installers WHERE global_or_team_id = ? AND title_id = ?`,
+			teamNameToID[spec.Team], spec.SoftwareTitleID)
+		if err != nil {
+			if errors.Is(err, sql.ErrNoRows) {
+				return ctxerr.Wrap(ctx, notFound("SoftwareInstaller").WithID(*spec.SoftwareTitleID), "get software installer id")
+			}
+			return ctxerr.Wrap(ctx, err, "get software installer id")
+		}
+		if len(softwareInstallerIDs[teamNameToID[spec.Team]]) == 0 {
+			softwareInstallerIDs[teamNameToID[spec.Team]] = make(map[uint]*uint)
+		}
+		softwareInstallerIDs[teamNameToID[spec.Team]][*spec.SoftwareTitleID] = &softwareInstallerID
+	}
+
 	// Get the query and platforms of the current policies so that we can check if query or platform changed later, if needed
 	type policyLite struct {
 		Name      string `db:"name"`
@@ -764,8 +799,9 @@ func (ds *Datastore) ApplyPolicySpecs(ctx context.Context, authorID uint, specs
 			platforms,
 			critical,
 			calendar_events_enabled,
+			software_installer_id,
 			checksum
-		) VALUES ( ?, ?, ?, ?, ?, ?, ?, ?, ?, %s)
+		) VALUES ( ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, %s)
 		ON DUPLICATE KEY UPDATE
 			query = VALUES(query),
 			description = VALUES(description),
@@ -773,7 +809,8 @@ func (ds *Datastore) ApplyPolicySpecs(ctx context.Context, authorID uint, specs
 			resolution = VALUES(resolution),
 			platforms = VALUES(platforms),
 			critical = VALUES(critical),
-			calendar_events_enabled = VALUES(calendar_events_enabled)
+			calendar_events_enabled = VALUES(calendar_events_enabled),
+			software_installer_id = VALUES(software_installer_id)
 		`, policiesChecksumComputedColumn(),
 		)
 		for teamID, teamPolicySpecs := range teamIDToPolicies {
@@ -782,17 +819,20 @@ func (ds *Datastore) ApplyPolicySpecs(ctx context.Context, authorID uint, specs
 				teamIDPtr = &teamID
 			}
 			for _, spec := range teamPolicySpecs {
-
+				var softwareInstallerID *uint
+				if spec.SoftwareTitleID != nil {
+					softwareInstallerID = softwareInstallerIDs[teamNameToID[spec.Team]][*spec.SoftwareTitleID]
+				}
 				res, err := tx.ExecContext(
 					ctx,
 					query, spec.Name, spec.Query, spec.Description, authorID, spec.Resolution, teamIDPtr, spec.Platform, spec.Critical,
-					spec.CalendarEventsEnabled,
+					spec.CalendarEventsEnabled, softwareInstallerID,
 				)
 				if err != nil {
 					return ctxerr.Wrap(ctx, err, "exec ApplyPolicySpecs insert")
 				}
 
-				if insertOnDuplicateDidUpdate(res) {
+				if insertOnDuplicateDidInsertOrUpdate(res) {
 					// when the upsert results in an UPDATE that *did* change some values,
 					// it returns the updated ID as last inserted id.
 					if lastID, _ := res.LastInsertId(); lastID > 0 {
@@ -1429,6 +1469,22 @@ func (ds *Datastore) GetCalendarPolicies(ctx context.Context, teamID uint) ([]fl
 	return policies, nil
 }
 
+func (ds *Datastore) GetPoliciesWithAssociatedInstaller(ctx context.Context, teamID uint, policyIDs []uint) ([]fleet.PolicySoftwareInstallerData, error) {
+	if len(policyIDs) == 0 {
+		return nil, nil
+	}
+	query := `SELECT id, software_installer_id FROM policies WHERE team_id = ? AND software_installer_id IS NOT NULL AND id IN (?);`
+	query, args, err := sqlx.In(query, teamID, policyIDs)
+	if err != nil {
+		return nil, ctxerr.Wrapf(ctx, err, "build sqlx.In for get policies with associated installer")
+	}
+	var policies []fleet.PolicySoftwareInstallerData
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &policies, query, args...); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get policies with associated installer")
+	}
+	return policies, nil
+}
+
 func (ds *Datastore) GetTeamHostsPolicyMemberships(
 	ctx context.Context,
 	domain string,
diff --git a/server/datastore/mysql/policies_test.go b/server/datastore/mysql/policies_test.go
index f505ebc3bb28..aee58797ff64 100644
--- a/server/datastore/mysql/policies_test.go
+++ b/server/datastore/mysql/policies_test.go
@@ -1,6 +1,7 @@
 package mysql
 
 import (
+	"bytes"
 	"context"
 	"crypto/md5" //nolint:gosec // (only used for tests)
 	"encoding/hex"
@@ -63,6 +64,9 @@ func TestPolicies(t *testing.T) {
 		{"TestPoliciesNameSort", testPoliciesNameSort},
 		{"TestGetCalendarPolicies", testGetCalendarPolicies},
 		{"GetTeamHostsPolicyMemberships", testGetTeamHostsPolicyMemberships},
+		{"TestPoliciesNewGlobalPolicyWithInstaller", testNewGlobalPolicyWithInstaller},
+		{"TestPoliciesTeamPoliciesWithInstaller", testTeamPoliciesWithInstaller},
+		{"ApplyPolicySpecWithInstallers", testApplyPolicySpecWithInstallers},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
@@ -1219,9 +1223,29 @@ func testPolicyQueriesForHost(t *testing.T, ds *Datastore) {
 func testPoliciesByID(t *testing.T, ds *Datastore) {
 	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
 	policy1 := newTestPolicy(t, ds, user1, "policy1", "darwin", nil)
-	_ = newTestPolicy(t, ds, user1, "policy2", "darwin", nil)
+	team1, err := ds.NewTeam(context.Background(), &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+	policy2 := newTestPolicy(t, ds, user1, "policy2", "darwin", &team1.ID)
 	host1 := newTestHostWithPlatform(t, ds, "host1", "darwin", nil)
 
+	// Associate an installer to policy2
+	installerID, err := ds.MatchOrCreateSoftwareInstaller(context.Background(), &fleet.UploadSoftwareInstallerPayload{
+		InstallScript:     "hello",
+		PreInstallQuery:   "SELECT 1",
+		PostInstallScript: "world",
+		InstallerFile:     bytes.NewReader([]byte("hello")),
+		StorageID:         "storage1",
+		Filename:          "file1",
+		Title:             "file1",
+		Version:           "1.0",
+		Source:            "apps",
+		UserID:            user1.ID,
+	})
+	require.NoError(t, err)
+	policy2.SoftwareInstallerID = ptr.Uint(installerID)
+	err = ds.SavePolicy(context.Background(), policy2, false, false)
+	require.NoError(t, err)
+
 	require.NoError(t, ds.RecordPolicyQueryExecutions(context.Background(), host1, map[uint]*bool{policy1.ID: ptr.Bool(true)}, time.Now(), false))
 	require.NoError(t, ds.UpdateHostPolicyCounts(context.Background()))
 
@@ -1230,9 +1254,12 @@ func testPoliciesByID(t *testing.T, ds *Datastore) {
 	assert.Equal(t, len(policiesByID), 2)
 	assert.Equal(t, policiesByID[1].ID, policy1.ID)
 	assert.Equal(t, policiesByID[1].Name, policy1.Name)
+	assert.Nil(t, policiesByID[1].SoftwareInstallerID)
+	assert.Equal(t, uint(1), policiesByID[1].PassingHostCount)
 	assert.Equal(t, policiesByID[2].ID, uint(2))
 	assert.Equal(t, policiesByID[2].Name, "policy2")
-	assert.Equal(t, uint(1), policiesByID[1].PassingHostCount)
+	assert.NotNil(t, policiesByID[2].SoftwareInstallerID)
+	assert.Equal(t, uint(1), *policiesByID[2].SoftwareInstallerID)
 
 	_, err = ds.PoliciesByID(context.Background(), []uint{1, 2, 3})
 	require.Error(t, err)
@@ -3650,12 +3677,12 @@ func testGetTeamHostsPolicyMemberships(t *testing.T, ds *Datastore) {
 	//
 	tZ := "America/Argentina/Buenos_Aires"
 	now := time.Now()
-	eventUUID1 := "event-uuid"
-	_, err = ds.CreateOrUpdateCalendarEvent(ctx, eventUUID1, "foo@example.com", now, now.Add(30*time.Minute), []byte(`{"foo": "bar"}`), tZ,
+	eventUUID1 := uuid.New().String()
+	_, err = ds.CreateOrUpdateCalendarEvent(ctx, eventUUID1, "foo@example.com", now, now.Add(30*time.Minute), []byte(`{"foo": "bar"}`), &tZ,
 		host1.ID, fleet.CalendarWebhookStatusPending)
 	require.NoError(t, err)
-	eventUUID2 := "event-uuid2"
-	_, err = ds.CreateOrUpdateCalendarEvent(ctx, eventUUID2, "bar@example.com", now, now.Add(30*time.Minute), []byte(`{"foo": "bar"}`), tZ,
+	eventUUID2 := uuid.New().String()
+	_, err = ds.CreateOrUpdateCalendarEvent(ctx, eventUUID2, "bar@example.com", now, now.Add(30*time.Minute), []byte(`{"foo": "bar"}`), &tZ,
 		host6.ID, fleet.CalendarWebhookStatusPending)
 	require.NoError(t, err)
 
@@ -3737,12 +3764,12 @@ func testGetTeamHostsPolicyMemberships(t *testing.T, ds *Datastore) {
 	// Create a calendar event on host2 and host3.
 	//
 	now = time.Now()
-	_, err = ds.CreateOrUpdateCalendarEvent(ctx, eventUUID1, "foo@example.com", now, now.Add(30*time.Minute), []byte(`{"foo": "bar"}`), tZ,
+	_, err = ds.CreateOrUpdateCalendarEvent(ctx, eventUUID1, "foo@example.com", now, now.Add(30*time.Minute), []byte(`{"foo": "bar"}`), &tZ,
 		host2.ID, fleet.CalendarWebhookStatusPending)
 	require.NoError(t, err)
-	eventUUID3 := "event-uuid3"
+	eventUUID3 := uuid.New().String()
 	calendarEventHost3, err := ds.CreateOrUpdateCalendarEvent(ctx, eventUUID3, "zoo@example.com", now, now.Add(30*time.Minute),
-		[]byte(`{"foo": "bar"}`), tZ, host3.ID, fleet.CalendarWebhookStatusPending)
+		[]byte(`{"foo": "bar"}`), &tZ, host3.ID, fleet.CalendarWebhookStatusPending)
 	require.NoError(t, err)
 
 	//
@@ -3875,3 +3902,315 @@ func testGetTeamHostsPolicyMemberships(t *testing.T, ds *Datastore) {
 	require.Equal(t, "serial2", hostsTeam2[0].HostHardwareSerial)
 	require.Equal(t, "display_name2", hostsTeam2[0].HostDisplayName)
 }
+
+func testNewGlobalPolicyWithInstaller(t *testing.T, ds *Datastore) {
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+	_, err := ds.NewGlobalPolicy(context.Background(), &user1.ID, fleet.PolicyPayload{
+		Query:               "SELECT 1;",
+		SoftwareInstallerID: ptr.Uint(1),
+	})
+	require.Error(t, err)
+	require.ErrorIs(t, err, errSoftwareTitleIDOnGlobalPolicy)
+}
+
+func testTeamPoliciesWithInstaller(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+	team2, err := ds.NewTeam(ctx, &fleet.Team{Name: "team2"}) // team2 has no policies
+	require.NoError(t, err)
+
+	// Policy p1 has no associated installer.
+	p1, err := ds.NewTeamPolicy(ctx, team1.ID, &user1.ID, fleet.PolicyPayload{
+		Name:                "p1",
+		Query:               "SELECT 1;",
+		SoftwareInstallerID: nil,
+	})
+	require.NoError(t, err)
+	// Create and associate an installer to p2.
+	installerID, err := ds.MatchOrCreateSoftwareInstaller(context.Background(), &fleet.UploadSoftwareInstallerPayload{
+		InstallScript:     "hello",
+		PreInstallQuery:   "SELECT 1",
+		PostInstallScript: "world",
+		InstallerFile:     bytes.NewReader([]byte("hello")),
+		StorageID:         "storage1",
+		Filename:          "file1",
+		Title:             "file1",
+		Version:           "1.0",
+		Source:            "apps",
+		UserID:            user1.ID,
+	})
+	require.NoError(t, err)
+	require.Nil(t, p1.SoftwareInstallerID)
+	p2, err := ds.NewTeamPolicy(ctx, team1.ID, &user1.ID, fleet.PolicyPayload{
+		Name:                "p2",
+		Query:               "SELECT 1;",
+		SoftwareInstallerID: ptr.Uint(installerID),
+	})
+	require.NoError(t, err)
+	require.NotNil(t, p2.SoftwareInstallerID)
+	require.Equal(t, installerID, *p2.SoftwareInstallerID)
+	// Create p3 as global policy.
+	_, err = ds.NewGlobalPolicy(ctx, &user1.ID, fleet.PolicyPayload{
+		Name:  "p3",
+		Query: "SELECT 1;",
+	})
+	require.NoError(t, err)
+
+	p2, err = ds.Policy(ctx, p2.ID)
+	require.NoError(t, err)
+	require.NotNil(t, p2.SoftwareInstallerID)
+	require.Equal(t, installerID, *p2.SoftwareInstallerID)
+
+	policiesWithInstallers, err := ds.GetPoliciesWithAssociatedInstaller(ctx, team1.ID, []uint{})
+	require.NoError(t, err)
+	require.Empty(t, policiesWithInstallers)
+
+	// p1 has no associated installers.
+	policiesWithInstallers, err = ds.GetPoliciesWithAssociatedInstaller(ctx, team1.ID, []uint{p1.ID})
+	require.NoError(t, err)
+	require.Empty(t, policiesWithInstallers)
+
+	policiesWithInstallers, err = ds.GetPoliciesWithAssociatedInstaller(ctx, team1.ID, []uint{p2.ID})
+	require.NoError(t, err)
+	require.Len(t, policiesWithInstallers, 1)
+	require.Equal(t, p2.ID, policiesWithInstallers[0].ID)
+	require.Equal(t, installerID, policiesWithInstallers[0].InstallerID)
+
+	// p2 has associated installer but belongs to team1.
+	policiesWithInstallers, err = ds.GetPoliciesWithAssociatedInstaller(ctx, team2.ID, []uint{p2.ID})
+	require.NoError(t, err)
+	require.Empty(t, policiesWithInstallers)
+
+	p1.SoftwareInstallerID = ptr.Uint(installerID)
+	err = ds.SavePolicy(ctx, p1, false, false)
+	require.NoError(t, err)
+
+	p2, err = ds.Policy(ctx, p2.ID)
+	require.NoError(t, err)
+	require.NotNil(t, p2.SoftwareInstallerID)
+	require.Equal(t, installerID, *p2.SoftwareInstallerID)
+
+	policiesWithInstallers, err = ds.GetPoliciesWithAssociatedInstaller(ctx, team1.ID, []uint{p1.ID, p2.ID})
+	require.NoError(t, err)
+	require.Len(t, policiesWithInstallers, 2)
+	require.Equal(t, p1.ID, policiesWithInstallers[0].ID)
+	require.Equal(t, installerID, policiesWithInstallers[0].InstallerID)
+	require.Equal(t, p2.ID, policiesWithInstallers[1].ID)
+	require.Equal(t, installerID, policiesWithInstallers[1].InstallerID)
+
+	policiesWithInstallers, err = ds.GetPoliciesWithAssociatedInstaller(ctx, team2.ID, []uint{p1.ID, p2.ID})
+	require.NoError(t, err)
+	require.Empty(t, policiesWithInstallers)
+}
+
+func testApplyPolicySpecWithInstallers(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	user1 := test.NewUser(t, ds, "User1", "user1@example.com", true)
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+	team2, err := ds.NewTeam(ctx, &fleet.Team{Name: "team2"})
+	require.NoError(t, err)
+	installer1ID, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallScript:     "hello",
+		PreInstallQuery:   "SELECT 1;",
+		PostInstallScript: "world1",
+		InstallerFile:     bytes.NewReader([]byte("hello1")),
+		StorageID:         "storage1",
+		Filename:          "file1",
+		Title:             "file1",
+		Version:           "1.0",
+		Source:            "apps",
+		UserID:            user1.ID,
+		TeamID:            &team1.ID,
+	})
+	require.NoError(t, err)
+	installer1, err := ds.GetSoftwareInstallerMetadataByID(ctx, installer1ID)
+	require.NoError(t, err)
+	require.NotNil(t, installer1.TitleID)
+	installer2ID, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallScript:     "hello2",
+		PreInstallQuery:   "SELECT 2;",
+		PostInstallScript: "world2",
+		InstallerFile:     bytes.NewReader([]byte("hello2")),
+		StorageID:         "storage2",
+		Filename:          "file2",
+		Title:             "file2",
+		Version:           "1.0",
+		Source:            "deb_packages",
+		UserID:            user1.ID,
+		TeamID:            &team2.ID,
+	})
+	require.NoError(t, err)
+	installer2, err := ds.GetSoftwareInstallerMetadataByID(ctx, installer2ID)
+	require.NoError(t, err)
+	require.NotNil(t, installer2.TitleID)
+
+	// Installers cannot be assigned to global policies.
+	err = ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
+		{
+			Name:            "Global policy",
+			Query:           "SELECT 1;",
+			Description:     "Description",
+			Resolution:      "Resolution",
+			Team:            "",
+			Platform:        "darwin",
+			SoftwareTitleID: installer1.TitleID,
+		},
+	})
+	require.Error(t, err)
+	require.ErrorIs(t, err, errSoftwareTitleIDOnGlobalPolicy)
+
+	// Apply two team policies associated to two installers.
+	err = ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
+		{
+			Name:            "Team policy 1",
+			Query:           "SELECT 1;",
+			Description:     "Description 1",
+			Resolution:      "Resolution 1",
+			Team:            "team1",
+			Platform:        "darwin",
+			SoftwareTitleID: installer1.TitleID,
+		},
+		{
+			Name:            "Team policy 2",
+			Query:           "SELECT 2;",
+			Description:     "Description 2",
+			Resolution:      "Resolution 2",
+			Team:            "team2",
+			Platform:        "linux",
+			SoftwareTitleID: installer2.TitleID,
+		},
+	})
+	require.NoError(t, err)
+	team1Policies, _, err := ds.ListTeamPolicies(ctx, team1.ID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, team1Policies, 1)
+	require.NotNil(t, team1Policies[0].SoftwareInstallerID)
+	require.Equal(t, installer1.InstallerID, *team1Policies[0].SoftwareInstallerID)
+	team2Policies, _, err := ds.ListTeamPolicies(ctx, team2.ID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, team2Policies, 1)
+	require.NotNil(t, team2Policies[0].SoftwareInstallerID)
+	require.Equal(t, installer2.InstallerID, *team2Policies[0].SoftwareInstallerID)
+
+	// Unset software installer from "Team policy 1".
+	err = ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
+		{
+			Name:            "Team policy 1",
+			Query:           "SELECT 1;",
+			Description:     "Description 1",
+			Resolution:      "Resolution 1",
+			Team:            "team1",
+			Platform:        "darwin",
+			SoftwareTitleID: nil,
+		},
+	})
+	require.NoError(t, err)
+	team1Policies, _, err = ds.ListTeamPolicies(ctx, team1.ID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, team1Policies, 1)
+	require.Nil(t, team1Policies[0].SoftwareInstallerID)
+
+	// Set software installer "Team policy 1" to a software installer on team2.
+	err = ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
+		{
+			Name:            "Team policy 1",
+			Query:           "SELECT 1;",
+			Description:     "Description 1",
+			Resolution:      "Resolution 1",
+			Team:            "team1",
+			Platform:        "darwin",
+			SoftwareTitleID: installer2.TitleID,
+		},
+	})
+	require.Error(t, err)
+	var notFoundErr *notFoundError
+	require.ErrorAs(t, err, &notFoundErr)
+
+	// Set software installer "Team policy 1" to a software title that doesn't exist.
+	err = ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
+		{
+			Name:            "Team policy 1",
+			Query:           "SELECT 1;",
+			Description:     "Description 1",
+			Resolution:      "Resolution 1",
+			Team:            "team1",
+			Platform:        "darwin",
+			SoftwareTitleID: ptr.Uint(999_999),
+		},
+	})
+	require.Error(t, err)
+	require.ErrorAs(t, err, &notFoundErr)
+
+	// Unset software installer from "Team policy 2" using 0.
+	err = ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
+		{
+			Name:            "Team policy 2",
+			Query:           "SELECT 2;",
+			Description:     "Description 2",
+			Resolution:      "Resolution 2",
+			Team:            "team2",
+			Platform:        "linux",
+			SoftwareTitleID: ptr.Uint(0),
+		},
+	})
+	require.NoError(t, err)
+	team2Policies, _, err = ds.ListTeamPolicies(ctx, team2.ID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, team2Policies, 1)
+	require.Nil(t, team2Policies[0].SoftwareInstallerID)
+
+	// Apply team policies associated to two installers (again, with two installers with the same title).
+	installer3ID, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallScript:     "hello3",
+		PreInstallQuery:   "SELECT 3;",
+		PostInstallScript: "world3",
+		InstallerFile:     bytes.NewReader([]byte("hello3")),
+		StorageID:         "storage3",
+		Filename:          "file1",
+		Title:             "file1", // same title as installer1.
+		Version:           "1.0",
+		Source:            "apps",
+		UserID:            user1.ID,
+		TeamID:            &team2.ID,
+	})
+	require.NoError(t, err)
+	installer3, err := ds.GetSoftwareInstallerMetadataByID(ctx, installer3ID)
+	require.NoError(t, err)
+	require.NotNil(t, installer2.TitleID)
+	err = ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
+		{
+			Name:            "Team policy 1",
+			Query:           "SELECT 1;",
+			Description:     "Description 1",
+			Resolution:      "Resolution 1",
+			Team:            "team1",
+			Platform:        "darwin",
+			SoftwareTitleID: installer1.TitleID,
+		},
+		{
+			Name:            "Team policy 2",
+			Query:           "SELECT 2;",
+			Description:     "Description 2",
+			Resolution:      "Resolution 2",
+			Team:            "team2",
+			Platform:        "linux",
+			SoftwareTitleID: installer3.TitleID,
+		},
+	})
+	require.NoError(t, err)
+	team1Policies, _, err = ds.ListTeamPolicies(ctx, team1.ID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, team1Policies, 1)
+	require.NotNil(t, team1Policies[0].SoftwareInstallerID)
+	require.Equal(t, installer1.InstallerID, *team1Policies[0].SoftwareInstallerID)
+	team2Policies, _, err = ds.ListTeamPolicies(ctx, team2.ID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, team2Policies, 1)
+	require.NotNil(t, team2Policies[0].SoftwareInstallerID)
+	require.Equal(t, installer3.InstallerID, *team2Policies[0].SoftwareInstallerID)
+}
diff --git a/server/datastore/mysql/schema.sql b/server/datastore/mysql/schema.sql
index b4cf5151e7ce..595878a83909 100644
--- a/server/datastore/mysql/schema.sql
+++ b/server/datastore/mysql/schema.sql
@@ -1,9 +1,33 @@
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
+CREATE TABLE `abm_tokens` (
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `organization_name` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `apple_id` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `terms_expired` tinyint(1) NOT NULL DEFAULT '0',
+  `renew_at` timestamp NOT NULL,
+  `token` blob NOT NULL,
+  `macos_default_team_id` int unsigned DEFAULT NULL,
+  `ios_default_team_id` int unsigned DEFAULT NULL,
+  `ipados_default_team_id` int unsigned DEFAULT NULL,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `idx_abm_tokens_organization_name` (`organization_name`),
+  KEY `fk_abm_tokens_macos_default_team_id` (`macos_default_team_id`),
+  KEY `fk_abm_tokens_ios_default_team_id` (`ios_default_team_id`),
+  KEY `fk_abm_tokens_ipados_default_team_id` (`ipados_default_team_id`),
+  CONSTRAINT `fk_abm_tokens_ios_default_team_id` FOREIGN KEY (`ios_default_team_id`) REFERENCES `teams` (`id`) ON DELETE SET NULL,
+  CONSTRAINT `fk_abm_tokens_ipados_default_team_id` FOREIGN KEY (`ipados_default_team_id`) REFERENCES `teams` (`id`) ON DELETE SET NULL,
+  CONSTRAINT `fk_abm_tokens_macos_default_team_id` FOREIGN KEY (`macos_default_team_id`) REFERENCES `teams` (`id`) ON DELETE SET NULL
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+/*!40101 SET character_set_client = @saved_cs_client */;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `activities` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
   `created_at` timestamp(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
-  `user_id` int(10) unsigned DEFAULT NULL,
+  `user_id` int unsigned DEFAULT NULL,
   `user_name` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `activity_type` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `details` json DEFAULT NULL,
@@ -14,88 +38,89 @@ CREATE TABLE `activities` (
   KEY `activities_streamed_idx` (`streamed`),
   KEY `activities_created_at_idx` (`created_at`),
   CONSTRAINT `activities_ibfk_1` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE SET NULL
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `aggregated_stats` (
-  `id` bigint(20) unsigned NOT NULL,
+  `id` bigint unsigned NOT NULL,
   `type` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `json_value` json NOT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   `global_stats` tinyint(1) NOT NULL DEFAULT '0',
   PRIMARY KEY (`id`,`type`,`global_stats`),
   KEY `idx_aggregated_stats_updated_at` (`updated_at`),
   KEY `aggregated_stats_type_idx` (`type`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `app_config_json` (
-  `id` int(10) unsigned NOT NULL DEFAULT '1',
+  `id` int unsigned NOT NULL DEFAULT '1',
   `json_value` json NOT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`),
   UNIQUE KEY `id` (`id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
-INSERT INTO `app_config_json` VALUES (1,'{\"mdm\": {\"macos_setup\": {\"bootstrap_package\": null, \"macos_setup_assistant\": null, \"enable_end_user_authentication\": false, \"enable_release_device_manually\": false}, \"macos_updates\": {\"deadline\": null, \"minimum_version\": null}, \"macos_settings\": {\"custom_settings\": null}, \"macos_migration\": {\"mode\": \"\", \"enable\": false, \"webhook_url\": \"\"}, \"windows_updates\": {\"deadline_days\": null, \"grace_period_days\": null}, \"windows_settings\": {\"custom_settings\": null}, \"apple_bm_default_team\": \"\", \"apple_bm_terms_expired\": false, \"enable_disk_encryption\": false, \"enabled_and_configured\": false, \"end_user_authentication\": {\"idp_name\": \"\", \"metadata\": \"\", \"entity_id\": \"\", \"issuer_uri\": \"\", \"metadata_url\": \"\"}, \"windows_enabled_and_configured\": false, \"apple_bm_enabled_and_configured\": false}, \"scripts\": null, \"features\": {\"enable_host_users\": true, \"enable_software_inventory\": false}, \"org_info\": {\"org_name\": \"\", \"contact_url\": \"\", \"org_logo_url\": \"\", \"org_logo_url_light_background\": \"\"}, \"integrations\": {\"jira\": null, \"zendesk\": null, \"google_calendar\": null}, \"sso_settings\": {\"idp_name\": \"\", \"metadata\": \"\", \"entity_id\": \"\", \"enable_sso\": false, \"issuer_uri\": \"\", \"metadata_url\": \"\", \"idp_image_url\": \"\", \"enable_jit_role_sync\": false, \"enable_sso_idp_login\": false, \"enable_jit_provisioning\": false}, \"agent_options\": {\"config\": {\"options\": {\"logger_plugin\": \"tls\", \"pack_delimiter\": \"/\", \"logger_tls_period\": 10, \"distributed_plugin\": \"tls\", \"disable_distributed\": false, \"logger_tls_endpoint\": \"/api/osquery/log\", \"distributed_interval\": 10, \"distributed_tls_max_attempts\": 3}, \"decorators\": {\"load\": [\"SELECT uuid AS host_uuid FROM system_info;\", \"SELECT hostname AS hostname FROM system_info;\"]}}, \"overrides\": {}}, \"fleet_desktop\": {\"transparency_url\": \"\"}, \"smtp_settings\": {\"port\": 587, \"domain\": \"\", \"server\": \"\", \"password\": \"\", \"user_name\": \"\", \"configured\": false, \"enable_smtp\": false, \"enable_ssl_tls\": true, \"sender_address\": \"\", \"enable_start_tls\": true, \"verify_ssl_certs\": true, \"authentication_type\": \"0\", \"authentication_method\": \"0\"}, \"server_settings\": {\"server_url\": \"\", \"enable_analytics\": false, \"query_report_cap\": 0, \"scripts_disabled\": false, \"deferred_save_host\": false, \"live_query_disabled\": false, \"ai_features_disabled\": false, \"query_reports_disabled\": false}, \"webhook_settings\": {\"interval\": \"0s\", \"activities_webhook\": {\"destination_url\": \"\", \"enable_activities_webhook\": false}, \"host_status_webhook\": {\"days_count\": 0, \"destination_url\": \"\", \"host_percentage\": 0, \"enable_host_status_webhook\": false}, \"vulnerabilities_webhook\": {\"destination_url\": \"\", \"host_batch_size\": 0, \"enable_vulnerabilities_webhook\": false}, \"failing_policies_webhook\": {\"policy_ids\": null, \"destination_url\": \"\", \"host_batch_size\": 0, \"enable_failing_policies_webhook\": false}}, \"host_expiry_settings\": {\"host_expiry_window\": 0, \"host_expiry_enabled\": false}, \"vulnerability_settings\": {\"databases_path\": \"\"}, \"activity_expiry_settings\": {\"activity_expiry_window\": 0, \"activity_expiry_enabled\": false}}','2020-01-01 01:01:01','2020-01-01 01:01:01');
+INSERT INTO `app_config_json` VALUES (1,'{\"mdm\": {\"ios_updates\": {\"deadline\": null, \"minimum_version\": null}, \"macos_setup\": {\"bootstrap_package\": null, \"macos_setup_assistant\": null, \"enable_end_user_authentication\": false, \"enable_release_device_manually\": false}, \"macos_updates\": {\"deadline\": null, \"minimum_version\": null}, \"ipados_updates\": {\"deadline\": null, \"minimum_version\": null}, \"macos_settings\": {\"custom_settings\": null}, \"macos_migration\": {\"mode\": \"\", \"enable\": false, \"webhook_url\": \"\"}, \"windows_updates\": {\"deadline_days\": null, \"grace_period_days\": null}, \"windows_settings\": {\"custom_settings\": null}, \"apple_bm_terms_expired\": false, \"apple_business_manager\": null, \"enable_disk_encryption\": false, \"enabled_and_configured\": false, \"end_user_authentication\": {\"idp_name\": \"\", \"metadata\": \"\", \"entity_id\": \"\", \"issuer_uri\": \"\", \"metadata_url\": \"\"}, \"volume_purchasing_program\": null, \"windows_enabled_and_configured\": false, \"apple_bm_enabled_and_configured\": false}, \"scripts\": null, \"features\": {\"enable_host_users\": true, \"enable_software_inventory\": false}, \"org_info\": {\"org_name\": \"\", \"contact_url\": \"\", \"org_logo_url\": \"\", \"org_logo_url_light_background\": \"\"}, \"integrations\": {\"jira\": null, \"zendesk\": null, \"google_calendar\": null}, \"sso_settings\": {\"idp_name\": \"\", \"metadata\": \"\", \"entity_id\": \"\", \"enable_sso\": false, \"issuer_uri\": \"\", \"metadata_url\": \"\", \"idp_image_url\": \"\", \"enable_jit_role_sync\": false, \"enable_sso_idp_login\": false, \"enable_jit_provisioning\": false}, \"agent_options\": {\"config\": {\"options\": {\"logger_plugin\": \"tls\", \"pack_delimiter\": \"/\", \"logger_tls_period\": 10, \"distributed_plugin\": \"tls\", \"disable_distributed\": false, \"logger_tls_endpoint\": \"/api/osquery/log\", \"distributed_interval\": 10, \"distributed_tls_max_attempts\": 3}, \"decorators\": {\"load\": [\"SELECT uuid AS host_uuid FROM system_info;\", \"SELECT hostname AS hostname FROM system_info;\"]}}, \"overrides\": {}}, \"fleet_desktop\": {\"transparency_url\": \"\"}, \"smtp_settings\": {\"port\": 587, \"domain\": \"\", \"server\": \"\", \"password\": \"\", \"user_name\": \"\", \"configured\": false, \"enable_smtp\": false, \"enable_ssl_tls\": true, \"sender_address\": \"\", \"enable_start_tls\": true, \"verify_ssl_certs\": true, \"authentication_type\": \"0\", \"authentication_method\": \"0\"}, \"server_settings\": {\"server_url\": \"\", \"enable_analytics\": false, \"query_report_cap\": 0, \"scripts_disabled\": false, \"deferred_save_host\": false, \"live_query_disabled\": false, \"ai_features_disabled\": false, \"query_reports_disabled\": false}, \"webhook_settings\": {\"interval\": \"0s\", \"activities_webhook\": {\"destination_url\": \"\", \"enable_activities_webhook\": false}, \"host_status_webhook\": {\"days_count\": 0, \"destination_url\": \"\", \"host_percentage\": 0, \"enable_host_status_webhook\": false}, \"vulnerabilities_webhook\": {\"destination_url\": \"\", \"host_batch_size\": 0, \"enable_vulnerabilities_webhook\": false}, \"failing_policies_webhook\": {\"policy_ids\": null, \"destination_url\": \"\", \"host_batch_size\": 0, \"enable_failing_policies_webhook\": false}}, \"host_expiry_settings\": {\"host_expiry_window\": 0, \"host_expiry_enabled\": false}, \"vulnerability_settings\": {\"databases_path\": \"\"}, \"activity_expiry_settings\": {\"activity_expiry_window\": 0, \"activity_expiry_enabled\": false}}','2020-01-01 01:01:01','2020-01-01 01:01:01');
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `calendar_events` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
   `email` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `start_time` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `end_time` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `event` json NOT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `timezone` varchar(64) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
-  `uuid` varchar(36) COLLATE utf8mb4_unicode_ci NOT NULL,
+  `timezone` varchar(64) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `uuid_bin` binary(16) NOT NULL,
+  `uuid` varchar(36) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci GENERATED ALWAYS AS (insert(insert(insert(insert(hex(`uuid_bin`),9,0,_utf8mb4'-'),14,0,_utf8mb4'-'),19,0,_utf8mb4'-'),24,0,_utf8mb4'-')) VIRTUAL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_one_calendar_event_per_email` (`email`),
-  UNIQUE KEY `idx_calendar_events_uuid_unique` (`uuid`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  UNIQUE KEY `idx_calendar_events_uuid_bin_unique` (`uuid_bin`)
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `carve_blocks` (
-  `metadata_id` int(10) unsigned NOT NULL,
-  `block_id` int(11) NOT NULL,
+  `metadata_id` int unsigned NOT NULL,
+  `block_id` int NOT NULL,
   `data` longblob,
   PRIMARY KEY (`metadata_id`,`block_id`),
   CONSTRAINT `carve_blocks_ibfk_1` FOREIGN KEY (`metadata_id`) REFERENCES `carve_metadata` (`id`) ON DELETE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `carve_metadata` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `host_id` int(10) unsigned NOT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `host_id` int unsigned NOT NULL,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `name` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
-  `block_count` int(10) unsigned NOT NULL,
-  `block_size` int(10) unsigned NOT NULL,
-  `carve_size` bigint(20) unsigned NOT NULL,
+  `block_count` int unsigned NOT NULL,
+  `block_size` int unsigned NOT NULL,
+  `carve_size` bigint unsigned NOT NULL,
   `carve_id` varchar(64) COLLATE utf8mb4_unicode_ci NOT NULL,
   `request_id` varchar(64) COLLATE utf8mb4_unicode_ci NOT NULL,
   `session_id` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `expired` tinyint(4) DEFAULT '0',
-  `max_block` int(11) DEFAULT '-1',
+  `expired` tinyint DEFAULT '0',
+  `max_block` int DEFAULT '-1',
   `error` text COLLATE utf8mb4_unicode_ci,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_session_id` (`session_id`),
   UNIQUE KEY `idx_name` (`name`),
   KEY `host_id` (`host_id`),
   CONSTRAINT `carve_metadata_ibfk_1` FOREIGN KEY (`host_id`) REFERENCES `hosts` (`id`) ON DELETE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `cron_stats` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
   `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `instance` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `stats_type` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
@@ -104,70 +129,70 @@ CREATE TABLE `cron_stats` (
   `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`),
   KEY `idx_cron_stats_name_created_at` (`name`,`created_at`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `cve_meta` (
   `cve` varchar(20) COLLATE utf8mb4_unicode_ci NOT NULL,
   `cvss_score` double DEFAULT NULL,
   `epss_probability` double DEFAULT NULL,
   `cisa_known_exploit` tinyint(1) DEFAULT NULL,
   `published` timestamp NULL DEFAULT NULL,
-  `description` text COLLATE utf8mb4_unicode_ci,
+  `description` text CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci,
   PRIMARY KEY (`cve`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `distributed_query_campaign_targets` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `type` int(11) DEFAULT NULL,
-  `distributed_query_campaign_id` int(10) unsigned DEFAULT NULL,
-  `target_id` int(10) unsigned DEFAULT NULL,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `type` int DEFAULT NULL,
+  `distributed_query_campaign_id` int unsigned DEFAULT NULL,
+  `target_id` int unsigned DEFAULT NULL,
   PRIMARY KEY (`id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `distributed_query_campaigns` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `query_id` int(10) unsigned DEFAULT NULL,
-  `status` int(11) DEFAULT NULL,
-  `user_id` int(10) unsigned DEFAULT NULL,
+  `query_id` int unsigned DEFAULT NULL,
+  `status` int DEFAULT NULL,
+  `user_id` int unsigned DEFAULT NULL,
   PRIMARY KEY (`id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `email_changes` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `user_id` int(10) unsigned NOT NULL,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `user_id` int unsigned NOT NULL,
   `token` varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL,
   `new_email` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_unique_email_changes_token` (`token`) USING BTREE,
   KEY `fk_email_changes_users` (`user_id`),
   CONSTRAINT `fk_email_changes_users` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `enroll_secrets` (
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `secret` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_bin NOT NULL,
-  `team_id` int(10) unsigned DEFAULT NULL,
+  `team_id` int unsigned DEFAULT NULL,
   PRIMARY KEY (`secret`),
   KEY `fk_enroll_secrets_team_id` (`team_id`),
   CONSTRAINT `enroll_secrets_ibfk_1` FOREIGN KEY (`team_id`) REFERENCES `teams` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `eulas` (
-  `id` int(10) unsigned NOT NULL,
+  `id` int unsigned NOT NULL,
   `token` varchar(36) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `name` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `bytes` longblob,
@@ -176,44 +201,44 @@ CREATE TABLE `eulas` (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_activities` (
-  `host_id` int(10) unsigned NOT NULL,
-  `activity_id` int(10) unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
+  `activity_id` int unsigned NOT NULL,
   PRIMARY KEY (`host_id`,`activity_id`),
   KEY `fk_host_activities_activity_id` (`activity_id`),
   CONSTRAINT `host_activities_ibfk_1` FOREIGN KEY (`activity_id`) REFERENCES `activities` (`id`) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_additional` (
-  `host_id` int(10) unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
   `additional` json DEFAULT NULL,
   PRIMARY KEY (`host_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_batteries` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `host_id` int(10) unsigned NOT NULL,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `host_id` int unsigned NOT NULL,
   `serial_number` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `cycle_count` int(10) NOT NULL,
+  `cycle_count` int NOT NULL,
   `health` varchar(40) COLLATE utf8mb4_unicode_ci NOT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_host_batteries_host_id_serial_number` (`host_id`,`serial_number`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_calendar_events` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `host_id` int(10) unsigned NOT NULL,
-  `calendar_event_id` int(10) unsigned NOT NULL,
-  `webhook_status` tinyint(4) NOT NULL,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `host_id` int unsigned NOT NULL,
+  `calendar_event_id` int unsigned NOT NULL,
+  `webhook_status` tinyint NOT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`),
@@ -223,48 +248,51 @@ CREATE TABLE `host_calendar_events` (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_dep_assignments` (
-  `host_id` int(10) unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
   `added_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `deleted_at` timestamp NULL DEFAULT NULL,
-  `profile_uuid` varchar(37) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
-  `assign_profile_response` varchar(15) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `profile_uuid` varchar(37) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `assign_profile_response` varchar(15) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `response_updated_at` timestamp NULL DEFAULT NULL,
-  `retry_job_id` int(10) unsigned NOT NULL DEFAULT '0',
+  `retry_job_id` int unsigned NOT NULL DEFAULT '0',
+  `abm_token_id` int unsigned DEFAULT NULL,
   PRIMARY KEY (`host_id`),
-  KEY `idx_hdep_response` (`assign_profile_response`,`response_updated_at`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  KEY `idx_hdep_response` (`assign_profile_response`,`response_updated_at`),
+  KEY `fk_host_dep_assignments_abm_token_id` (`abm_token_id`),
+  CONSTRAINT `fk_host_dep_assignments_abm_token_id` FOREIGN KEY (`abm_token_id`) REFERENCES `abm_tokens` (`id`) ON DELETE SET NULL
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_device_auth` (
-  `host_id` int(10) unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
   `token` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`host_id`),
   UNIQUE KEY `idx_host_device_auth_token` (`token`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_disk_encryption_keys` (
-  `host_id` int(10) unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
   `base64_encrypted` text COLLATE utf8mb4_unicode_ci NOT NULL,
   `decryptable` tinyint(1) DEFAULT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   `reset_requested` tinyint(1) NOT NULL DEFAULT '0',
-  `client_error` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `client_error` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   PRIMARY KEY (`host_id`),
   KEY `idx_host_disk_encryption_keys_decryptable` (`decryptable`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_disks` (
-  `host_id` int(10) unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
   `gigs_disk_space_available` decimal(10,2) NOT NULL DEFAULT '0.00',
   `percent_disk_space_available` decimal(10,2) NOT NULL DEFAULT '0.00',
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
@@ -273,22 +301,22 @@ CREATE TABLE `host_disks` (
   `gigs_total_disk_space` decimal(10,2) NOT NULL DEFAULT '0.00',
   PRIMARY KEY (`host_id`),
   KEY `idx_host_disks_gigs_disk_space_available` (`gigs_disk_space_available`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_display_names` (
-  `host_id` int(10) unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
   `display_name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   PRIMARY KEY (`host_id`),
   KEY `display_name` (`display_name`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_emails` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `host_id` int(10) unsigned NOT NULL,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `host_id` int unsigned NOT NULL,
   `email` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `source` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
@@ -296,15 +324,15 @@ CREATE TABLE `host_emails` (
   PRIMARY KEY (`id`),
   KEY `idx_host_emails_host_id_email` (`host_id`,`email`),
   KEY `idx_host_emails_email` (`email`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_issues` (
-  `host_id` int(10) unsigned NOT NULL,
-  `failing_policies_count` int(10) unsigned NOT NULL DEFAULT '0',
-  `critical_vulnerabilities_count` int(10) unsigned NOT NULL DEFAULT '0',
-  `total_issues_count` int(10) unsigned NOT NULL DEFAULT '0',
+  `host_id` int unsigned NOT NULL,
+  `failing_policies_count` int unsigned NOT NULL DEFAULT '0',
+  `critical_vulnerabilities_count` int unsigned NOT NULL DEFAULT '0',
+  `total_issues_count` int unsigned NOT NULL DEFAULT '0',
   `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
   `updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
   PRIMARY KEY (`host_id`),
@@ -312,34 +340,34 @@ CREATE TABLE `host_issues` (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_mdm` (
-  `host_id` int(10) unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
   `enrolled` tinyint(1) NOT NULL DEFAULT '0',
   `server_url` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `installed_from_dep` tinyint(1) NOT NULL DEFAULT '0',
-  `mdm_id` int(10) unsigned DEFAULT NULL,
+  `mdm_id` int unsigned DEFAULT NULL,
   `is_server` tinyint(1) DEFAULT NULL,
-  `fleet_enroll_ref` varchar(36) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `fleet_enroll_ref` varchar(36) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   PRIMARY KEY (`host_id`),
   KEY `host_mdm_mdm_id_idx` (`mdm_id`),
   KEY `host_mdm_enrolled_installed_from_dep_idx` (`enrolled`,`installed_from_dep`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_mdm_actions` (
-  `host_id` int(10) unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
   `lock_ref` varchar(36) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `wipe_ref` varchar(36) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `unlock_pin` varchar(6) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `unlock_ref` varchar(36) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
-  `fleet_platform` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `fleet_platform` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   PRIMARY KEY (`host_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_mdm_apple_bootstrap_packages` (
   `host_uuid` varchar(127) COLLATE utf8mb4_unicode_ci NOT NULL,
   `command_uuid` varchar(127) COLLATE utf8mb4_unicode_ci NOT NULL,
@@ -349,16 +377,16 @@ CREATE TABLE `host_mdm_apple_bootstrap_packages` (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_mdm_apple_declarations` (
-  `host_uuid` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `status` varchar(20) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
-  `operation_type` varchar(20) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
-  `detail` text COLLATE utf8mb4_unicode_ci,
+  `host_uuid` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `status` varchar(20) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `operation_type` varchar(20) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `detail` text CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci,
   `checksum` binary(16) NOT NULL,
-  `declaration_uuid` varchar(37) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `declaration_identifier` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `declaration_name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `declaration_uuid` varchar(37) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `declaration_identifier` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `declaration_name` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   PRIMARY KEY (`host_uuid`,`declaration_uuid`),
   KEY `status` (`status`),
   KEY `operation_type` (`operation_type`),
@@ -367,7 +395,7 @@ CREATE TABLE `host_mdm_apple_declarations` (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_mdm_apple_profiles` (
   `profile_identifier` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `host_uuid` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
@@ -377,17 +405,27 @@ CREATE TABLE `host_mdm_apple_profiles` (
   `command_uuid` varchar(127) COLLATE utf8mb4_unicode_ci NOT NULL,
   `profile_name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `checksum` binary(16) NOT NULL,
-  `retries` tinyint(3) unsigned NOT NULL DEFAULT '0',
-  `profile_uuid` varchar(37) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `retries` tinyint unsigned NOT NULL DEFAULT '0',
+  `profile_uuid` varchar(37) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   PRIMARY KEY (`host_uuid`,`profile_uuid`),
   KEY `status` (`status`),
   KEY `operation_type` (`operation_type`),
   CONSTRAINT `host_mdm_apple_profiles_ibfk_1` FOREIGN KEY (`status`) REFERENCES `mdm_delivery_status` (`status`) ON UPDATE CASCADE,
   CONSTRAINT `host_mdm_apple_profiles_ibfk_2` FOREIGN KEY (`operation_type`) REFERENCES `mdm_operation_types` (`operation_type`) ON UPDATE CASCADE
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+/*!40101 SET character_set_client = @saved_cs_client */;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!50503 SET character_set_client = utf8mb4 */;
+CREATE TABLE `host_mdm_commands` (
+  `host_id` int unsigned NOT NULL,
+  `command_type` varchar(31) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `created_at` timestamp(6) NULL DEFAULT CURRENT_TIMESTAMP(6),
+  `updated_at` timestamp(6) NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+  PRIMARY KEY (`host_id`,`command_type`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_mdm_windows_profiles` (
   `host_uuid` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `status` varchar(20) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
@@ -395,70 +433,71 @@ CREATE TABLE `host_mdm_windows_profiles` (
   `detail` text COLLATE utf8mb4_unicode_ci,
   `command_uuid` varchar(127) COLLATE utf8mb4_unicode_ci NOT NULL,
   `profile_name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `retries` tinyint(3) unsigned NOT NULL DEFAULT '0',
-  `profile_uuid` varchar(37) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `retries` tinyint unsigned NOT NULL DEFAULT '0',
+  `profile_uuid` varchar(37) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   PRIMARY KEY (`host_uuid`,`profile_uuid`),
   KEY `status` (`status`),
   KEY `operation_type` (`operation_type`),
   CONSTRAINT `host_mdm_windows_profiles_ibfk_1` FOREIGN KEY (`status`) REFERENCES `mdm_delivery_status` (`status`) ON UPDATE CASCADE,
   CONSTRAINT `host_mdm_windows_profiles_ibfk_2` FOREIGN KEY (`operation_type`) REFERENCES `mdm_operation_types` (`operation_type`) ON UPDATE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_munki_info` (
-  `host_id` int(10) unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
   `version` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `deleted_at` timestamp NULL DEFAULT NULL,
   PRIMARY KEY (`host_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_munki_issues` (
-  `host_id` int(10) unsigned NOT NULL,
-  `munki_issue_id` int(10) unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
+  `munki_issue_id` int unsigned NOT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   PRIMARY KEY (`host_id`,`munki_issue_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_operating_system` (
-  `host_id` int(10) unsigned NOT NULL,
-  `os_id` int(10) unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
+  `os_id` int unsigned NOT NULL,
   PRIMARY KEY (`host_id`),
   KEY `idx_host_operating_system_id` (`os_id`),
   CONSTRAINT `host_operating_system_ibfk_1` FOREIGN KEY (`os_id`) REFERENCES `operating_systems` (`id`) ON DELETE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_orbit_info` (
-  `host_id` int(10) unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
   `version` varchar(50) COLLATE utf8mb4_unicode_ci NOT NULL,
   `desktop_version` varchar(50) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `scripts_enabled` tinyint(1) DEFAULT NULL,
   PRIMARY KEY (`host_id`),
   KEY `idx_host_orbit_info_version` (`version`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_script_results` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `host_id` int(10) unsigned NOT NULL,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `host_id` int unsigned NOT NULL,
   `execution_id` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `output` text COLLATE utf8mb4_unicode_ci NOT NULL,
-  `runtime` int(10) unsigned NOT NULL DEFAULT '0',
-  `exit_code` int(10) DEFAULT NULL,
+  `runtime` int unsigned NOT NULL DEFAULT '0',
+  `exit_code` int DEFAULT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `script_id` int(10) unsigned DEFAULT NULL,
-  `user_id` int(10) unsigned DEFAULT NULL,
+  `script_id` int unsigned DEFAULT NULL,
+  `user_id` int unsigned DEFAULT NULL,
   `sync_request` tinyint(1) NOT NULL DEFAULT '0',
-  `script_content_id` int(10) unsigned DEFAULT NULL,
+  `script_content_id` int unsigned DEFAULT NULL,
   `host_deleted_at` timestamp NULL DEFAULT NULL,
+  `timeout` int DEFAULT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_host_script_results_execution_id` (`execution_id`),
   KEY `idx_host_script_results_host_exit_created` (`host_id`,`exit_code`,`created_at`),
@@ -469,54 +508,56 @@ CREATE TABLE `host_script_results` (
   CONSTRAINT `fk_host_script_results_script_id` FOREIGN KEY (`script_id`) REFERENCES `scripts` (`id`) ON DELETE SET NULL,
   CONSTRAINT `fk_host_script_results_user_id` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE SET NULL,
   CONSTRAINT `host_script_results_ibfk_1` FOREIGN KEY (`script_content_id`) REFERENCES `script_contents` (`id`) ON DELETE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_seen_times` (
-  `host_id` int(10) unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
   `seen_time` timestamp NULL DEFAULT NULL,
   PRIMARY KEY (`host_id`),
   KEY `idx_host_seen_times_seen_time` (`seen_time`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_software` (
-  `host_id` int(10) unsigned NOT NULL,
-  `software_id` bigint(20) unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
+  `software_id` bigint unsigned NOT NULL,
   `last_opened_at` timestamp NULL DEFAULT NULL,
   PRIMARY KEY (`host_id`,`software_id`),
   KEY `host_software_software_fk` (`software_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_software_installed_paths` (
-  `id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
-  `host_id` int(10) unsigned NOT NULL,
-  `software_id` bigint(20) unsigned NOT NULL,
+  `id` bigint unsigned NOT NULL AUTO_INCREMENT,
+  `host_id` int unsigned NOT NULL,
+  `software_id` bigint unsigned NOT NULL,
   `installed_path` text COLLATE utf8mb4_unicode_ci NOT NULL,
   PRIMARY KEY (`id`),
   KEY `host_id_software_id_idx` (`host_id`,`software_id`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_software_installs` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `execution_id` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `host_id` int(10) unsigned NOT NULL,
-  `software_installer_id` int(10) unsigned NOT NULL,
-  `pre_install_query_output` text COLLATE utf8mb4_unicode_ci,
-  `install_script_output` text COLLATE utf8mb4_unicode_ci,
-  `install_script_exit_code` int(10) DEFAULT NULL,
-  `post_install_script_output` text COLLATE utf8mb4_unicode_ci,
-  `post_install_script_exit_code` int(10) DEFAULT NULL,
-  `user_id` int(10) unsigned DEFAULT NULL,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `execution_id` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `host_id` int unsigned NOT NULL,
+  `software_installer_id` int unsigned NOT NULL,
+  `pre_install_query_output` text CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci,
+  `install_script_output` text CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci,
+  `install_script_exit_code` int DEFAULT NULL,
+  `post_install_script_output` text CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci,
+  `post_install_script_exit_code` int DEFAULT NULL,
+  `user_id` int unsigned DEFAULT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   `self_service` tinyint(1) NOT NULL DEFAULT '0',
+  `host_deleted_at` timestamp NULL DEFAULT NULL,
+  `removed` tinyint NOT NULL DEFAULT '0',
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_host_software_installs_execution_id` (`execution_id`),
   KEY `fk_host_software_installs_installer_id` (`software_installer_id`),
@@ -524,72 +565,97 @@ CREATE TABLE `host_software_installs` (
   KEY `idx_host_software_installs_host_installer` (`host_id`,`software_installer_id`),
   CONSTRAINT `fk_host_software_installs_installer_id` FOREIGN KEY (`software_installer_id`) REFERENCES `software_installers` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
   CONSTRAINT `fk_host_software_installs_user_id` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE SET NULL
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_updates` (
-  `host_id` int(10) unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
   `software_updated_at` timestamp NULL DEFAULT NULL,
   PRIMARY KEY (`host_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_users` (
-  `host_id` int(10) unsigned NOT NULL,
-  `uid` int(10) unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
+  `uid` int unsigned NOT NULL,
   `username` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `groupname` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `removed_at` timestamp NULL DEFAULT NULL,
   `user_type` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `shell` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT '',
   PRIMARY KEY (`host_id`,`uid`,`username`),
   UNIQUE KEY `idx_uid_username` (`host_id`,`uid`,`username`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
+CREATE TABLE `host_vpp_software_installs` (
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `host_id` int unsigned NOT NULL,
+  `adam_id` varchar(16) COLLATE utf8mb4_unicode_ci NOT NULL,
+  `command_uuid` varchar(127) COLLATE utf8mb4_unicode_ci NOT NULL,
+  `user_id` int unsigned DEFAULT NULL,
+  `self_service` tinyint(1) NOT NULL DEFAULT '0',
+  `associated_event_id` varchar(36) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `platform` varchar(10) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `removed` tinyint NOT NULL DEFAULT '0',
+  `vpp_token_id` int unsigned DEFAULT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `idx_host_vpp_software_installs_command_uuid` (`command_uuid`),
+  KEY `user_id` (`user_id`),
+  KEY `adam_id` (`adam_id`,`platform`),
+  KEY `fk_host_vpp_software_installs_vpp_token_id` (`vpp_token_id`),
+  CONSTRAINT `fk_host_vpp_software_installs_vpp_token_id` FOREIGN KEY (`vpp_token_id`) REFERENCES `vpp_tokens` (`id`) ON DELETE SET NULL,
+  CONSTRAINT `host_vpp_software_installs_ibfk_1` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE SET NULL,
+  CONSTRAINT `host_vpp_software_installs_ibfk_3` FOREIGN KEY (`adam_id`, `platform`) REFERENCES `vpp_apps` (`adam_id`, `platform`) ON DELETE CASCADE
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+/*!40101 SET character_set_client = @saved_cs_client */;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `hosts` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `osquery_host_id` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `osquery_host_id` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   `detail_updated_at` timestamp NULL DEFAULT NULL,
   `node_key` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
-  `hostname` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `uuid` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `platform` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `osquery_version` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `os_version` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `build` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `platform_like` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `code_name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `uptime` bigint(20) NOT NULL DEFAULT '0',
-  `memory` bigint(20) NOT NULL DEFAULT '0',
-  `cpu_type` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `cpu_subtype` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `cpu_brand` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `cpu_physical_cores` int(11) NOT NULL DEFAULT '0',
-  `cpu_logical_cores` int(11) NOT NULL DEFAULT '0',
-  `hardware_vendor` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `hardware_model` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `hardware_version` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `hardware_serial` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `computer_name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `primary_ip_id` int(10) unsigned DEFAULT NULL,
-  `distributed_interval` int(11) DEFAULT '0',
-  `logger_tls_period` int(11) DEFAULT '0',
-  `config_tls_refresh` int(11) DEFAULT '0',
-  `primary_ip` varchar(45) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `primary_mac` varchar(17) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `hostname` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `uuid` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `platform` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `osquery_version` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `os_version` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `build` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `platform_like` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `code_name` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `uptime` bigint NOT NULL DEFAULT '0',
+  `memory` bigint NOT NULL DEFAULT '0',
+  `cpu_type` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `cpu_subtype` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `cpu_brand` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `cpu_physical_cores` int NOT NULL DEFAULT '0',
+  `cpu_logical_cores` int NOT NULL DEFAULT '0',
+  `hardware_vendor` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `hardware_model` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `hardware_version` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `hardware_serial` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `computer_name` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `primary_ip_id` int unsigned DEFAULT NULL,
+  `distributed_interval` int DEFAULT '0',
+  `logger_tls_period` int DEFAULT '0',
+  `config_tls_refresh` int DEFAULT '0',
+  `primary_ip` varchar(45) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `primary_mac` varchar(17) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `label_updated_at` timestamp NOT NULL DEFAULT '2000-01-01 00:00:00',
   `last_enrolled_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `refetch_requested` tinyint(1) NOT NULL DEFAULT '0',
-  `team_id` int(10) unsigned DEFAULT NULL,
+  `team_id` int unsigned DEFAULT NULL,
   `policy_updated_at` timestamp NOT NULL DEFAULT '2000-01-01 00:00:00',
-  `public_ip` varchar(45) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `public_ip` varchar(45) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `orbit_node_key` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
   `refetch_critical_queries_until` timestamp NULL DEFAULT NULL,
   PRIMARY KEY (`id`),
@@ -599,30 +665,29 @@ CREATE TABLE `hosts` (
   KEY `fk_hosts_team_id` (`team_id`),
   KEY `hosts_platform_idx` (`platform`),
   KEY `idx_hosts_hardware_serial` (`hardware_serial`),
-  FULLTEXT KEY `host_ip_mac_search` (`primary_ip`,`primary_mac`),
-  FULLTEXT KEY `hosts_search` (`hostname`,`uuid`,`computer_name`),
+  KEY `idx_hosts_uuid` (`uuid`),
   CONSTRAINT `hosts_ibfk_1` FOREIGN KEY (`team_id`) REFERENCES `teams` (`id`) ON DELETE SET NULL
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `invite_teams` (
-  `invite_id` int(10) unsigned NOT NULL,
-  `team_id` int(10) unsigned NOT NULL,
+  `invite_id` int unsigned NOT NULL,
+  `team_id` int unsigned NOT NULL,
   `role` varchar(64) COLLATE utf8mb4_unicode_ci NOT NULL,
   PRIMARY KEY (`invite_id`,`team_id`),
   KEY `fk_team_id` (`team_id`),
   CONSTRAINT `invite_teams_ibfk_1` FOREIGN KEY (`invite_id`) REFERENCES `invites` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
   CONSTRAINT `invite_teams_ibfk_2` FOREIGN KEY (`team_id`) REFERENCES `teams` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `invites` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `invited_by` int(10) unsigned NOT NULL,
+  `invited_by` int unsigned NOT NULL,
   `email` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `name` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `position` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
@@ -632,68 +697,69 @@ CREATE TABLE `invites` (
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_invite_unique_email` (`email`),
   UNIQUE KEY `idx_invite_unique_key` (`token`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `jobs` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `args` json DEFAULT NULL,
   `state` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `retries` int(11) NOT NULL DEFAULT '0',
+  `retries` int NOT NULL DEFAULT '0',
   `error` text COLLATE utf8mb4_unicode_ci,
   `not_before` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  PRIMARY KEY (`id`)
-) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  PRIMARY KEY (`id`),
+  KEY `idx_jobs_state_not_before_updated_at` (`state`,`not_before`,`updated_at`)
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 INSERT INTO `jobs` VALUES (1,'2024-03-20 00:00:00','2024-03-20 00:00:00','macos_setup_assistant','{\"task\": \"update_all_profiles\"}','queued',0,'','2024-03-20 00:00:00');
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `label_membership` (
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `label_id` int(10) unsigned NOT NULL,
-  `host_id` int(10) unsigned NOT NULL,
+  `label_id` int unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
   PRIMARY KEY (`host_id`,`label_id`),
   KEY `idx_lm_label_id` (`label_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `labels` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `description` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `query` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,
   `platform` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
-  `label_type` int(10) unsigned NOT NULL DEFAULT '1',
-  `label_membership_type` int(10) unsigned NOT NULL DEFAULT '0',
+  `label_type` int unsigned NOT NULL DEFAULT '1',
+  `label_membership_type` int unsigned NOT NULL DEFAULT '0',
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_label_unique_name` (`name`),
   FULLTEXT KEY `labels_search` (`name`)
-) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 INSERT INTO `labels` VALUES (1,'2024-04-03 00:00:00','2024-04-03 00:00:00','macOS 14+ (Sonoma+)','macOS hosts with version 14 and above','select 1 from os_version where platform = \'darwin\' and major >= 14;','darwin',1,0),(2,'2024-06-28 00:00:00','2024-06-28 00:00:00','iOS','All iOS hosts','','ios',1,1),(3,'2024-06-28 00:00:00','2024-06-28 00:00:00','iPadOS','All iPadOS hosts','','ipados',1,1);
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `locks` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
   `name` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `owner` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
-  `expires_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `expires_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_name` (`name`)
-) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mdm_apple_bootstrap_packages` (
-  `team_id` int(10) unsigned NOT NULL,
+  `team_id` int unsigned NOT NULL,
   `name` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `sha256` binary(32) NOT NULL,
   `bytes` longblob,
@@ -702,31 +768,31 @@ CREATE TABLE `mdm_apple_bootstrap_packages` (
   `updated_at` datetime NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`team_id`),
   UNIQUE KEY `idx_token` (`token`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mdm_apple_configuration_profiles` (
-  `profile_id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `team_id` int(10) unsigned NOT NULL DEFAULT '0',
+  `profile_id` int unsigned NOT NULL AUTO_INCREMENT,
+  `team_id` int unsigned NOT NULL DEFAULT '0',
   `identifier` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `mobileconfig` mediumblob NOT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `uploaded_at` timestamp NULL DEFAULT NULL,
   `checksum` binary(16) NOT NULL,
-  `profile_uuid` varchar(37) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `profile_uuid` varchar(37) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   PRIMARY KEY (`profile_uuid`),
   UNIQUE KEY `idx_mdm_apple_config_prof_team_identifier` (`team_id`,`identifier`),
   UNIQUE KEY `idx_mdm_apple_config_prof_team_name` (`team_id`,`name`),
   UNIQUE KEY `idx_mdm_apple_config_prof_id` (`profile_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mdm_apple_declaration_activation_references` (
-  `declaration_uuid` varchar(37) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `reference` varchar(37) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `declaration_uuid` varchar(37) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `reference` varchar(37) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   PRIMARY KEY (`declaration_uuid`,`reference`),
   KEY `reference` (`reference`),
   CONSTRAINT `mdm_apple_declaration_activation_references_ibfk_1` FOREIGN KEY (`declaration_uuid`) REFERENCES `mdm_apple_declarations` (`declaration_uuid`) ON UPDATE CASCADE,
@@ -734,28 +800,30 @@ CREATE TABLE `mdm_apple_declaration_activation_references` (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mdm_apple_declarations` (
-  `declaration_uuid` varchar(37) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `team_id` int(10) unsigned NOT NULL DEFAULT '0',
-  `identifier` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
+  `declaration_uuid` varchar(37) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `team_id` int unsigned NOT NULL DEFAULT '0',
+  `identifier` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `name` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
   `raw_json` json NOT NULL,
   `checksum` binary(16) NOT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `uploaded_at` timestamp NULL DEFAULT NULL,
+  `auto_increment` bigint NOT NULL AUTO_INCREMENT,
   PRIMARY KEY (`declaration_uuid`),
   UNIQUE KEY `idx_mdm_apple_declaration_team_identifier` (`team_id`,`identifier`),
-  UNIQUE KEY `idx_mdm_apple_declaration_team_name` (`team_id`,`name`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  UNIQUE KEY `idx_mdm_apple_declaration_team_name` (`team_id`,`name`),
+  UNIQUE KEY `auto_increment` (`auto_increment`)
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mdm_apple_declarative_requests` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  `enrollment_id` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `message_type` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `enrollment_id` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `message_type` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
   `raw_json` text COLLATE utf8mb4_unicode_ci,
   PRIMARY KEY (`id`),
   KEY `mdm_apple_declarative_requests_enrollment_id` (`enrollment_id`),
@@ -763,71 +831,89 @@ CREATE TABLE `mdm_apple_declarative_requests` (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mdm_apple_default_setup_assistants` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `team_id` int(10) unsigned DEFAULT NULL,
-  `global_or_team_id` int(10) unsigned NOT NULL DEFAULT '0',
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `team_id` int unsigned DEFAULT NULL,
+  `global_or_team_id` int unsigned NOT NULL DEFAULT '0',
   `profile_uuid` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `abm_token_id` int unsigned DEFAULT NULL,
   PRIMARY KEY (`id`),
-  UNIQUE KEY `idx_mdm_default_setup_assistant_global_or_team_id` (`global_or_team_id`),
+  UNIQUE KEY `idx_mdm_default_setup_assistant_global_or_team_id_abm_token_id` (`global_or_team_id`,`abm_token_id`),
   KEY `fk_mdm_default_setup_assistant_team_id` (`team_id`),
+  KEY `fk_mdm_default_setup_assistant_abm_token_id` (`abm_token_id`),
+  CONSTRAINT `fk_mdm_default_setup_assistant_abm_token_id` FOREIGN KEY (`abm_token_id`) REFERENCES `abm_tokens` (`id`) ON DELETE CASCADE,
   CONSTRAINT `mdm_apple_default_setup_assistants_ibfk_1` FOREIGN KEY (`team_id`) REFERENCES `teams` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mdm_apple_enrollment_profiles` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
   `token` varchar(36) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `type` varchar(10) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT 'automatic',
   `dep_profile` json DEFAULT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_type` (`type`),
   UNIQUE KEY `idx_token` (`token`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mdm_apple_installers` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
   `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `size` bigint(20) NOT NULL,
+  `size` bigint NOT NULL,
   `manifest` text COLLATE utf8mb4_unicode_ci NOT NULL,
   `installer` longblob,
   `url_token` varchar(36) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   PRIMARY KEY (`id`)
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+/*!40101 SET character_set_client = @saved_cs_client */;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!50503 SET character_set_client = utf8mb4 */;
+CREATE TABLE `mdm_apple_setup_assistant_profiles` (
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `setup_assistant_id` int unsigned NOT NULL,
+  `abm_token_id` int unsigned NOT NULL,
+  `profile_uuid` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `idx_mdm_apple_setup_assistant_profiles_asst_id_tok_id` (`setup_assistant_id`,`abm_token_id`),
+  KEY `fk_mdm_apple_setup_assistant_profiles_abm_token_id` (`abm_token_id`),
+  CONSTRAINT `fk_mdm_apple_setup_assistant_profiles_abm_token_id` FOREIGN KEY (`abm_token_id`) REFERENCES `abm_tokens` (`id`) ON DELETE CASCADE,
+  CONSTRAINT `fk_mdm_apple_setup_assistant_profiles_setup_assistant_id` FOREIGN KEY (`setup_assistant_id`) REFERENCES `mdm_apple_setup_assistants` (`id`) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mdm_apple_setup_assistants` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `team_id` int(10) unsigned DEFAULT NULL,
-  `global_or_team_id` int(10) unsigned NOT NULL DEFAULT '0',
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `team_id` int unsigned DEFAULT NULL,
+  `global_or_team_id` int unsigned NOT NULL DEFAULT '0',
   `name` text COLLATE utf8mb4_unicode_ci NOT NULL,
   `profile` json NOT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `profile_uuid` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_mdm_setup_assistant_global_or_team_id` (`global_or_team_id`),
   KEY `fk_mdm_setup_assistant_team_id` (`team_id`),
   CONSTRAINT `mdm_apple_setup_assistants_ibfk_1` FOREIGN KEY (`team_id`) REFERENCES `teams` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mdm_config_assets` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `name` varchar(256) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `name` varchar(256) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `value` longblob NOT NULL,
   `deleted_at` timestamp NULL DEFAULT NULL,
-  `deletion_uuid` varchar(127) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `deletion_uuid` varchar(127) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `md5_checksum` binary(16) NOT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`),
@@ -835,13 +921,13 @@ CREATE TABLE `mdm_config_assets` (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mdm_configuration_profile_labels` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
   `apple_profile_uuid` varchar(37) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `windows_profile_uuid` varchar(37) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `label_name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `label_id` int(10) unsigned DEFAULT NULL,
+  `label_id` int unsigned DEFAULT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   `exclude` tinyint(1) NOT NULL DEFAULT '0',
@@ -851,16 +937,17 @@ CREATE TABLE `mdm_configuration_profile_labels` (
   KEY `label_id` (`label_id`),
   CONSTRAINT `mdm_configuration_profile_labels_ibfk_1` FOREIGN KEY (`apple_profile_uuid`) REFERENCES `mdm_apple_configuration_profiles` (`profile_uuid`) ON DELETE CASCADE,
   CONSTRAINT `mdm_configuration_profile_labels_ibfk_2` FOREIGN KEY (`windows_profile_uuid`) REFERENCES `mdm_windows_configuration_profiles` (`profile_uuid`) ON DELETE CASCADE,
-  CONSTRAINT `mdm_configuration_profile_labels_ibfk_3` FOREIGN KEY (`label_id`) REFERENCES `labels` (`id`) ON DELETE SET NULL
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  CONSTRAINT `mdm_configuration_profile_labels_ibfk_3` FOREIGN KEY (`label_id`) REFERENCES `labels` (`id`) ON DELETE SET NULL,
+  CONSTRAINT `ck_mdm_configuration_profile_labels_apple_or_windows` CHECK (((`apple_profile_uuid` is null) <> (`windows_profile_uuid` is null)))
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mdm_declaration_labels` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `apple_declaration_uuid` varchar(37) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `label_name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `label_id` int(10) unsigned DEFAULT NULL,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `apple_declaration_uuid` varchar(37) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `label_name` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `label_id` int unsigned DEFAULT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `uploaded_at` timestamp NULL DEFAULT NULL,
   `exclude` tinyint(1) NOT NULL DEFAULT '0',
@@ -869,54 +956,56 @@ CREATE TABLE `mdm_declaration_labels` (
   KEY `label_id` (`label_id`),
   CONSTRAINT `mdm_declaration_labels_ibfk_1` FOREIGN KEY (`apple_declaration_uuid`) REFERENCES `mdm_apple_declarations` (`declaration_uuid`) ON DELETE CASCADE,
   CONSTRAINT `mdm_declaration_labels_ibfk_3` FOREIGN KEY (`label_id`) REFERENCES `labels` (`id`) ON DELETE SET NULL
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mdm_delivery_status` (
   `status` varchar(20) COLLATE utf8mb4_unicode_ci NOT NULL,
   PRIMARY KEY (`status`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 INSERT INTO `mdm_delivery_status` VALUES ('failed'),('pending'),('verified'),('verifying');
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mdm_idp_accounts` (
   `uuid` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `username` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `fullname` varchar(256) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `email` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `email` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`uuid`),
   UNIQUE KEY `unique_idp_email` (`email`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mdm_operation_types` (
   `operation_type` varchar(20) COLLATE utf8mb4_unicode_ci NOT NULL,
   PRIMARY KEY (`operation_type`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 INSERT INTO `mdm_operation_types` VALUES ('install'),('remove');
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mdm_windows_configuration_profiles` (
-  `team_id` int(10) unsigned NOT NULL DEFAULT '0',
+  `team_id` int unsigned NOT NULL DEFAULT '0',
   `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `syncml` mediumblob NOT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `uploaded_at` timestamp NULL DEFAULT NULL,
-  `profile_uuid` varchar(37) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `profile_uuid` varchar(37) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `auto_increment` bigint NOT NULL AUTO_INCREMENT,
   PRIMARY KEY (`profile_uuid`),
-  UNIQUE KEY `idx_mdm_windows_configuration_profiles_team_id_name` (`team_id`,`name`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  UNIQUE KEY `idx_mdm_windows_configuration_profiles_team_id_name` (`team_id`,`name`),
+  UNIQUE KEY `auto_increment` (`auto_increment`)
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mdm_windows_enrollments` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
   `mdm_device_id` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `mdm_hardware_id` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `device_state` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
@@ -929,93 +1018,100 @@ CREATE TABLE `mdm_windows_enrollments` (
   `not_in_oobe` tinyint(1) NOT NULL DEFAULT '0',
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `host_uuid` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `host_uuid` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_type` (`mdm_hardware_id`),
   KEY `idx_mdm_windows_enrollments_mdm_device_id` (`mdm_device_id`),
   KEY `idx_mdm_windows_enrollments_host_uuid` (`host_uuid`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `migration_status_tables` (
-  `id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
-  `version_id` bigint(20) NOT NULL,
+  `id` bigint unsigned NOT NULL AUTO_INCREMENT,
+  `version_id` bigint NOT NULL,
   `is_applied` tinyint(1) NOT NULL,
   `tstamp` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`),
   UNIQUE KEY `id` (`id`)
-) ENGINE=InnoDB AUTO_INCREMENT=281 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB AUTO_INCREMENT=311 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
-INSERT INTO `migration_status_tables` VALUES (1,0,1,'2020-01-01 01:01:01'),(2,20161118193812,1,'2020-01-01 01:01:01'),(3,20161118211713,1,'2020-01-01 01:01:01'),(4,20161118212436,1,'2020-01-01 01:01:01'),(5,20161118212515,1,'2020-01-01 01:01:01'),(6,20161118212528,1,'2020-01-01 01:01:01'),(7,20161118212538,1,'2020-01-01 01:01:01'),(8,20161118212549,1,'2020-01-01 01:01:01'),(9,20161118212557,1,'2020-01-01 01:01:01'),(10,20161118212604,1,'2020-01-01 01:01:01'),(11,20161118212613,1,'2020-01-01 01:01:01'),(12,20161118212621,1,'2020-01-01 01:01:01'),(13,20161118212630,1,'2020-01-01 01:01:01'),(14,20161118212641,1,'2020-01-01 01:01:01'),(15,20161118212649,1,'2020-01-01 01:01:01'),(16,20161118212656,1,'2020-01-01 01:01:01'),(17,20161118212758,1,'2020-01-01 01:01:01'),(18,20161128234849,1,'2020-01-01 01:01:01'),(19,20161230162221,1,'2020-01-01 01:01:01'),(20,20170104113816,1,'2020-01-01 01:01:01'),(21,20170105151732,1,'2020-01-01 01:01:01'),(22,20170108191242,1,'2020-01-01 01:01:01'),(23,20170109094020,1,'2020-01-01 01:01:01'),(24,20170109130438,1,'2020-01-01 01:01:01'),(25,20170110202752,1,'2020-01-01 01:01:01'),(26,20170111133013,1,'2020-01-01 01:01:01'),(27,20170117025759,1,'2020-01-01 01:01:01'),(28,20170118191001,1,'2020-01-01 01:01:01'),(29,20170119234632,1,'2020-01-01 01:01:01'),(30,20170124230432,1,'2020-01-01 01:01:01'),(31,20170127014618,1,'2020-01-01 01:01:01'),(32,20170131232841,1,'2020-01-01 01:01:01'),(33,20170223094154,1,'2020-01-01 01:01:01'),(34,20170306075207,1,'2020-01-01 01:01:01'),(35,20170309100733,1,'2020-01-01 01:01:01'),(36,20170331111922,1,'2020-01-01 01:01:01'),(37,20170502143928,1,'2020-01-01 01:01:01'),(38,20170504130602,1,'2020-01-01 01:01:01'),(39,20170509132100,1,'2020-01-01 01:01:01'),(40,20170519105647,1,'2020-01-01 01:01:01'),(41,20170519105648,1,'2020-01-01 01:01:01'),(42,20170831234300,1,'2020-01-01 01:01:01'),(43,20170831234301,1,'2020-01-01 01:01:01'),(44,20170831234303,1,'2020-01-01 01:01:01'),(45,20171116163618,1,'2020-01-01 01:01:01'),(46,20171219164727,1,'2020-01-01 01:01:01'),(47,20180620164811,1,'2020-01-01 01:01:01'),(48,20180620175054,1,'2020-01-01 01:01:01'),(49,20180620175055,1,'2020-01-01 01:01:01'),(50,20191010101639,1,'2020-01-01 01:01:01'),(51,20191010155147,1,'2020-01-01 01:01:01'),(52,20191220130734,1,'2020-01-01 01:01:01'),(53,20200311140000,1,'2020-01-01 01:01:01'),(54,20200405120000,1,'2020-01-01 01:01:01'),(55,20200407120000,1,'2020-01-01 01:01:01'),(56,20200420120000,1,'2020-01-01 01:01:01'),(57,20200504120000,1,'2020-01-01 01:01:01'),(58,20200512120000,1,'2020-01-01 01:01:01'),(59,20200707120000,1,'2020-01-01 01:01:01'),(60,20201011162341,1,'2020-01-01 01:01:01'),(61,20201021104586,1,'2020-01-01 01:01:01'),(62,20201102112520,1,'2020-01-01 01:01:01'),(63,20201208121729,1,'2020-01-01 01:01:01'),(64,20201215091637,1,'2020-01-01 01:01:01'),(65,20210119174155,1,'2020-01-01 01:01:01'),(66,20210326182902,1,'2020-01-01 01:01:01'),(67,20210421112652,1,'2020-01-01 01:01:01'),(68,20210506095025,1,'2020-01-01 01:01:01'),(69,20210513115729,1,'2020-01-01 01:01:01'),(70,20210526113559,1,'2020-01-01 01:01:01'),(71,20210601000001,1,'2020-01-01 01:01:01'),(72,20210601000002,1,'2020-01-01 01:01:01'),(73,20210601000003,1,'2020-01-01 01:01:01'),(74,20210601000004,1,'2020-01-01 01:01:01'),(75,20210601000005,1,'2020-01-01 01:01:01'),(76,20210601000006,1,'2020-01-01 01:01:01'),(77,20210601000007,1,'2020-01-01 01:01:01'),(78,20210601000008,1,'2020-01-01 01:01:01'),(79,20210606151329,1,'2020-01-01 01:01:01'),(80,20210616163757,1,'2020-01-01 01:01:01'),(81,20210617174723,1,'2020-01-01 01:01:01'),(82,20210622160235,1,'2020-01-01 01:01:01'),(83,20210623100031,1,'2020-01-01 01:01:01'),(84,20210623133615,1,'2020-01-01 01:01:01'),(85,20210708143152,1,'2020-01-01 01:01:01'),(86,20210709124443,1,'2020-01-01 01:01:01'),(87,20210712155608,1,'2020-01-01 01:01:01'),(88,20210714102108,1,'2020-01-01 01:01:01'),(89,20210719153709,1,'2020-01-01 01:01:01'),(90,20210721171531,1,'2020-01-01 01:01:01'),(91,20210723135713,1,'2020-01-01 01:01:01'),(92,20210802135933,1,'2020-01-01 01:01:01'),(93,20210806112844,1,'2020-01-01 01:01:01'),(94,20210810095603,1,'2020-01-01 01:01:01'),(95,20210811150223,1,'2020-01-01 01:01:01'),(96,20210818151827,1,'2020-01-01 01:01:01'),(97,20210818151828,1,'2020-01-01 01:01:01'),(98,20210818182258,1,'2020-01-01 01:01:01'),(99,20210819131107,1,'2020-01-01 01:01:01'),(100,20210819143446,1,'2020-01-01 01:01:01'),(101,20210903132338,1,'2020-01-01 01:01:01'),(102,20210915144307,1,'2020-01-01 01:01:01'),(103,20210920155130,1,'2020-01-01 01:01:01'),(104,20210927143115,1,'2020-01-01 01:01:01'),(105,20210927143116,1,'2020-01-01 01:01:01'),(106,20211013133706,1,'2020-01-01 01:01:01'),(107,20211013133707,1,'2020-01-01 01:01:01'),(108,20211102135149,1,'2020-01-01 01:01:01'),(109,20211109121546,1,'2020-01-01 01:01:01'),(110,20211110163320,1,'2020-01-01 01:01:01'),(111,20211116184029,1,'2020-01-01 01:01:01'),(112,20211116184030,1,'2020-01-01 01:01:01'),(113,20211202092042,1,'2020-01-01 01:01:01'),(114,20211202181033,1,'2020-01-01 01:01:01'),(115,20211207161856,1,'2020-01-01 01:01:01'),(116,20211216131203,1,'2020-01-01 01:01:01'),(117,20211221110132,1,'2020-01-01 01:01:01'),(118,20220107155700,1,'2020-01-01 01:01:01'),(119,20220125105650,1,'2020-01-01 01:01:01'),(120,20220201084510,1,'2020-01-01 01:01:01'),(121,20220208144830,1,'2020-01-01 01:01:01'),(122,20220208144831,1,'2020-01-01 01:01:01'),(123,20220215152203,1,'2020-01-01 01:01:01'),(124,20220223113157,1,'2020-01-01 01:01:01'),(125,20220307104655,1,'2020-01-01 01:01:01'),(126,20220309133956,1,'2020-01-01 01:01:01'),(127,20220316155700,1,'2020-01-01 01:01:01'),(128,20220323152301,1,'2020-01-01 01:01:01'),(129,20220330100659,1,'2020-01-01 01:01:01'),(130,20220404091216,1,'2020-01-01 01:01:01'),(131,20220419140750,1,'2020-01-01 01:01:01'),(132,20220428140039,1,'2020-01-01 01:01:01'),(133,20220503134048,1,'2020-01-01 01:01:01'),(134,20220524102918,1,'2020-01-01 01:01:01'),(135,20220526123327,1,'2020-01-01 01:01:01'),(136,20220526123328,1,'2020-01-01 01:01:01'),(137,20220526123329,1,'2020-01-01 01:01:01'),(138,20220608113128,1,'2020-01-01 01:01:01'),(139,20220627104817,1,'2020-01-01 01:01:01'),(140,20220704101843,1,'2020-01-01 01:01:01'),(141,20220708095046,1,'2020-01-01 01:01:01'),(142,20220713091130,1,'2020-01-01 01:01:01'),(143,20220802135510,1,'2020-01-01 01:01:01'),(144,20220818101352,1,'2020-01-01 01:01:01'),(145,20220822161445,1,'2020-01-01 01:01:01'),(146,20220831100036,1,'2020-01-01 01:01:01'),(147,20220831100151,1,'2020-01-01 01:01:01'),(148,20220908181826,1,'2020-01-01 01:01:01'),(149,20220914154915,1,'2020-01-01 01:01:01'),(150,20220915165115,1,'2020-01-01 01:01:01'),(151,20220915165116,1,'2020-01-01 01:01:01'),(152,20220928100158,1,'2020-01-01 01:01:01'),(153,20221014084130,1,'2020-01-01 01:01:01'),(154,20221027085019,1,'2020-01-01 01:01:01'),(155,20221101103952,1,'2020-01-01 01:01:01'),(156,20221104144401,1,'2020-01-01 01:01:01'),(157,20221109100749,1,'2020-01-01 01:01:01'),(158,20221115104546,1,'2020-01-01 01:01:01'),(159,20221130114928,1,'2020-01-01 01:01:01'),(160,20221205112142,1,'2020-01-01 01:01:01'),(161,20221216115820,1,'2020-01-01 01:01:01'),(162,20221220195934,1,'2020-01-01 01:01:01'),(163,20221220195935,1,'2020-01-01 01:01:01'),(164,20221223174807,1,'2020-01-01 01:01:01'),(165,20221227163855,1,'2020-01-01 01:01:01'),(166,20221227163856,1,'2020-01-01 01:01:01'),(167,20230202224725,1,'2020-01-01 01:01:01'),(168,20230206163608,1,'2020-01-01 01:01:01'),(169,20230214131519,1,'2020-01-01 01:01:01'),(170,20230303135738,1,'2020-01-01 01:01:01'),(171,20230313135301,1,'2020-01-01 01:01:01'),(172,20230313141819,1,'2020-01-01 01:01:01'),(173,20230315104937,1,'2020-01-01 01:01:01'),(174,20230317173844,1,'2020-01-01 01:01:01'),(175,20230320133602,1,'2020-01-01 01:01:01'),(176,20230330100011,1,'2020-01-01 01:01:01'),(177,20230330134823,1,'2020-01-01 01:01:01'),(178,20230405232025,1,'2020-01-01 01:01:01'),(179,20230408084104,1,'2020-01-01 01:01:01'),(180,20230411102858,1,'2020-01-01 01:01:01'),(181,20230421155932,1,'2020-01-01 01:01:01'),(182,20230425082126,1,'2020-01-01 01:01:01'),(183,20230425105727,1,'2020-01-01 01:01:01'),(184,20230501154913,1,'2020-01-01 01:01:01'),(185,20230503101418,1,'2020-01-01 01:01:01'),(186,20230515144206,1,'2020-01-01 01:01:01'),(187,20230517140952,1,'2020-01-01 01:01:01'),(188,20230517152807,1,'2020-01-01 01:01:01'),(189,20230518114155,1,'2020-01-01 01:01:01'),(190,20230520153236,1,'2020-01-01 01:01:01'),(191,20230525151159,1,'2020-01-01 01:01:01'),(192,20230530122103,1,'2020-01-01 01:01:01'),(193,20230602111827,1,'2020-01-01 01:01:01'),(194,20230608103123,1,'2020-01-01 01:01:01'),(195,20230629140529,1,'2020-01-01 01:01:01'),(196,20230629140530,1,'2020-01-01 01:01:01'),(197,20230711144622,1,'2020-01-01 01:01:01'),(198,20230721135421,1,'2020-01-01 01:01:01'),(199,20230721161508,1,'2020-01-01 01:01:01'),(200,20230726115701,1,'2020-01-01 01:01:01'),(201,20230807100822,1,'2020-01-01 01:01:01'),(202,20230814150442,1,'2020-01-01 01:01:01'),(203,20230823122728,1,'2020-01-01 01:01:01'),(204,20230906152143,1,'2020-01-01 01:01:01'),(205,20230911163618,1,'2020-01-01 01:01:01'),(206,20230912101759,1,'2020-01-01 01:01:01'),(207,20230915101341,1,'2020-01-01 01:01:01'),(208,20230918132351,1,'2020-01-01 01:01:01'),(209,20231004144339,1,'2020-01-01 01:01:01'),(210,20231009094541,1,'2020-01-01 01:01:01'),(211,20231009094542,1,'2020-01-01 01:01:01'),(212,20231009094543,1,'2020-01-01 01:01:01'),(213,20231009094544,1,'2020-01-01 01:01:01'),(214,20231016091915,1,'2020-01-01 01:01:01'),(215,20231024174135,1,'2020-01-01 01:01:01'),(216,20231025120016,1,'2020-01-01 01:01:01'),(217,20231025160156,1,'2020-01-01 01:01:01'),(218,20231031165350,1,'2020-01-01 01:01:01'),(219,20231106144110,1,'2020-01-01 01:01:01'),(220,20231107130934,1,'2020-01-01 01:01:01'),(221,20231109115838,1,'2020-01-01 01:01:01'),(222,20231121054530,1,'2020-01-01 01:01:01'),(223,20231122101320,1,'2020-01-01 01:01:01'),(224,20231130132828,1,'2020-01-01 01:01:01'),(225,20231130132931,1,'2020-01-01 01:01:01'),(226,20231204155427,1,'2020-01-01 01:01:01'),(227,20231206142340,1,'2020-01-01 01:01:01'),(228,20231207102320,1,'2020-01-01 01:01:01'),(229,20231207102321,1,'2020-01-01 01:01:01'),(230,20231207133731,1,'2020-01-01 01:01:01'),(231,20231212094238,1,'2020-01-01 01:01:01'),(232,20231212095734,1,'2020-01-01 01:01:01'),(233,20231212161121,1,'2020-01-01 01:01:01'),(234,20231215122713,1,'2020-01-01 01:01:01'),(235,20231219143041,1,'2020-01-01 01:01:01'),(236,20231224070653,1,'2020-01-01 01:01:01'),(237,20240110134315,1,'2020-01-01 01:01:01'),(238,20240119091637,1,'2020-01-01 01:01:01'),(239,20240126020642,1,'2020-01-01 01:01:01'),(240,20240126020643,1,'2020-01-01 01:01:01'),(241,20240129162819,1,'2020-01-01 01:01:01'),(242,20240130115133,1,'2020-01-01 01:01:01'),(243,20240131083822,1,'2020-01-01 01:01:01'),(244,20240205095928,1,'2020-01-01 01:01:01'),(245,20240205121956,1,'2020-01-01 01:01:01'),(246,20240209110212,1,'2020-01-01 01:01:01'),(247,20240212111533,1,'2020-01-01 01:01:01'),(248,20240221112844,1,'2020-01-01 01:01:01'),(249,20240222073518,1,'2020-01-01 01:01:01'),(250,20240222135115,1,'2020-01-01 01:01:01'),(251,20240226082255,1,'2020-01-01 01:01:01'),(252,20240228082706,1,'2020-01-01 01:01:01'),(253,20240301173035,1,'2020-01-01 01:01:01'),(254,20240302111134,1,'2020-01-01 01:01:01'),(255,20240312103753,1,'2020-01-01 01:01:01'),(256,20240313143416,1,'2020-01-01 01:01:01'),(257,20240314085226,1,'2020-01-01 01:01:01'),(258,20240314151747,1,'2020-01-01 01:01:01'),(259,20240320145650,1,'2020-01-01 01:01:01'),(260,20240327115530,1,'2020-01-01 01:01:01'),(261,20240327115617,1,'2020-01-01 01:01:01'),(262,20240408085837,1,'2020-01-01 01:01:01'),(263,20240415104633,1,'2020-01-01 01:01:01'),(264,20240430111727,1,'2020-01-01 01:01:01'),(265,20240515200020,1,'2020-01-01 01:01:01'),(266,20240521143023,1,'2020-01-01 01:01:01'),(267,20240521143024,1,'2020-01-01 01:01:01'),(268,20240601174138,1,'2020-01-01 01:01:01'),(269,20240607133721,1,'2020-01-01 01:01:01'),(270,20240612150059,1,'2020-01-01 01:01:01'),(271,20240613162201,1,'2020-01-01 01:01:01'),(272,20240613172616,1,'2020-01-01 01:01:01'),(273,20240618142419,1,'2020-01-01 01:01:01'),(274,20240625093543,1,'2020-01-01 01:01:01'),(275,20240626195531,1,'2020-01-01 01:01:01'),(276,20240702123921,1,'2020-01-01 01:01:01'),(277,20240703154849,1,'2020-01-01 01:01:01'),(278,20240707134035,1,'2020-01-01 01:01:01'),(279,20240707134036,1,'2020-01-01 01:01:01'),(280,20240709124958,1,'2020-01-01 01:01:01');
+INSERT INTO `migration_status_tables` VALUES (1,0,1,'2020-01-01 01:01:01'),(2,20161118193812,1,'2020-01-01 01:01:01'),(3,20161118211713,1,'2020-01-01 01:01:01'),(4,20161118212436,1,'2020-01-01 01:01:01'),(5,20161118212515,1,'2020-01-01 01:01:01'),(6,20161118212528,1,'2020-01-01 01:01:01'),(7,20161118212538,1,'2020-01-01 01:01:01'),(8,20161118212549,1,'2020-01-01 01:01:01'),(9,20161118212557,1,'2020-01-01 01:01:01'),(10,20161118212604,1,'2020-01-01 01:01:01'),(11,20161118212613,1,'2020-01-01 01:01:01'),(12,20161118212621,1,'2020-01-01 01:01:01'),(13,20161118212630,1,'2020-01-01 01:01:01'),(14,20161118212641,1,'2020-01-01 01:01:01'),(15,20161118212649,1,'2020-01-01 01:01:01'),(16,20161118212656,1,'2020-01-01 01:01:01'),(17,20161118212758,1,'2020-01-01 01:01:01'),(18,20161128234849,1,'2020-01-01 01:01:01'),(19,20161230162221,1,'2020-01-01 01:01:01'),(20,20170104113816,1,'2020-01-01 01:01:01'),(21,20170105151732,1,'2020-01-01 01:01:01'),(22,20170108191242,1,'2020-01-01 01:01:01'),(23,20170109094020,1,'2020-01-01 01:01:01'),(24,20170109130438,1,'2020-01-01 01:01:01'),(25,20170110202752,1,'2020-01-01 01:01:01'),(26,20170111133013,1,'2020-01-01 01:01:01'),(27,20170117025759,1,'2020-01-01 01:01:01'),(28,20170118191001,1,'2020-01-01 01:01:01'),(29,20170119234632,1,'2020-01-01 01:01:01'),(30,20170124230432,1,'2020-01-01 01:01:01'),(31,20170127014618,1,'2020-01-01 01:01:01'),(32,20170131232841,1,'2020-01-01 01:01:01'),(33,20170223094154,1,'2020-01-01 01:01:01'),(34,20170306075207,1,'2020-01-01 01:01:01'),(35,20170309100733,1,'2020-01-01 01:01:01'),(36,20170331111922,1,'2020-01-01 01:01:01'),(37,20170502143928,1,'2020-01-01 01:01:01'),(38,20170504130602,1,'2020-01-01 01:01:01'),(39,20170509132100,1,'2020-01-01 01:01:01'),(40,20170519105647,1,'2020-01-01 01:01:01'),(41,20170519105648,1,'2020-01-01 01:01:01'),(42,20170831234300,1,'2020-01-01 01:01:01'),(43,20170831234301,1,'2020-01-01 01:01:01'),(44,20170831234303,1,'2020-01-01 01:01:01'),(45,20171116163618,1,'2020-01-01 01:01:01'),(46,20171219164727,1,'2020-01-01 01:01:01'),(47,20180620164811,1,'2020-01-01 01:01:01'),(48,20180620175054,1,'2020-01-01 01:01:01'),(49,20180620175055,1,'2020-01-01 01:01:01'),(50,20191010101639,1,'2020-01-01 01:01:01'),(51,20191010155147,1,'2020-01-01 01:01:01'),(52,20191220130734,1,'2020-01-01 01:01:01'),(53,20200311140000,1,'2020-01-01 01:01:01'),(54,20200405120000,1,'2020-01-01 01:01:01'),(55,20200407120000,1,'2020-01-01 01:01:01'),(56,20200420120000,1,'2020-01-01 01:01:01'),(57,20200504120000,1,'2020-01-01 01:01:01'),(58,20200512120000,1,'2020-01-01 01:01:01'),(59,20200707120000,1,'2020-01-01 01:01:01'),(60,20201011162341,1,'2020-01-01 01:01:01'),(61,20201021104586,1,'2020-01-01 01:01:01'),(62,20201102112520,1,'2020-01-01 01:01:01'),(63,20201208121729,1,'2020-01-01 01:01:01'),(64,20201215091637,1,'2020-01-01 01:01:01'),(65,20210119174155,1,'2020-01-01 01:01:01'),(66,20210326182902,1,'2020-01-01 01:01:01'),(67,20210421112652,1,'2020-01-01 01:01:01'),(68,20210506095025,1,'2020-01-01 01:01:01'),(69,20210513115729,1,'2020-01-01 01:01:01'),(70,20210526113559,1,'2020-01-01 01:01:01'),(71,20210601000001,1,'2020-01-01 01:01:01'),(72,20210601000002,1,'2020-01-01 01:01:01'),(73,20210601000003,1,'2020-01-01 01:01:01'),(74,20210601000004,1,'2020-01-01 01:01:01'),(75,20210601000005,1,'2020-01-01 01:01:01'),(76,20210601000006,1,'2020-01-01 01:01:01'),(77,20210601000007,1,'2020-01-01 01:01:01'),(78,20210601000008,1,'2020-01-01 01:01:01'),(79,20210606151329,1,'2020-01-01 01:01:01'),(80,20210616163757,1,'2020-01-01 01:01:01'),(81,20210617174723,1,'2020-01-01 01:01:01'),(82,20210622160235,1,'2020-01-01 01:01:01'),(83,20210623100031,1,'2020-01-01 01:01:01'),(84,20210623133615,1,'2020-01-01 01:01:01'),(85,20210708143152,1,'2020-01-01 01:01:01'),(86,20210709124443,1,'2020-01-01 01:01:01'),(87,20210712155608,1,'2020-01-01 01:01:01'),(88,20210714102108,1,'2020-01-01 01:01:01'),(89,20210719153709,1,'2020-01-01 01:01:01'),(90,20210721171531,1,'2020-01-01 01:01:01'),(91,20210723135713,1,'2020-01-01 01:01:01'),(92,20210802135933,1,'2020-01-01 01:01:01'),(93,20210806112844,1,'2020-01-01 01:01:01'),(94,20210810095603,1,'2020-01-01 01:01:01'),(95,20210811150223,1,'2020-01-01 01:01:01'),(96,20210818151827,1,'2020-01-01 01:01:01'),(97,20210818151828,1,'2020-01-01 01:01:01'),(98,20210818182258,1,'2020-01-01 01:01:01'),(99,20210819131107,1,'2020-01-01 01:01:01'),(100,20210819143446,1,'2020-01-01 01:01:01'),(101,20210903132338,1,'2020-01-01 01:01:01'),(102,20210915144307,1,'2020-01-01 01:01:01'),(103,20210920155130,1,'2020-01-01 01:01:01'),(104,20210927143115,1,'2020-01-01 01:01:01'),(105,20210927143116,1,'2020-01-01 01:01:01'),(106,20211013133706,1,'2020-01-01 01:01:01'),(107,20211013133707,1,'2020-01-01 01:01:01'),(108,20211102135149,1,'2020-01-01 01:01:01'),(109,20211109121546,1,'2020-01-01 01:01:01'),(110,20211110163320,1,'2020-01-01 01:01:01'),(111,20211116184029,1,'2020-01-01 01:01:01'),(112,20211116184030,1,'2020-01-01 01:01:01'),(113,20211202092042,1,'2020-01-01 01:01:01'),(114,20211202181033,1,'2020-01-01 01:01:01'),(115,20211207161856,1,'2020-01-01 01:01:01'),(116,20211216131203,1,'2020-01-01 01:01:01'),(117,20211221110132,1,'2020-01-01 01:01:01'),(118,20220107155700,1,'2020-01-01 01:01:01'),(119,20220125105650,1,'2020-01-01 01:01:01'),(120,20220201084510,1,'2020-01-01 01:01:01'),(121,20220208144830,1,'2020-01-01 01:01:01'),(122,20220208144831,1,'2020-01-01 01:01:01'),(123,20220215152203,1,'2020-01-01 01:01:01'),(124,20220223113157,1,'2020-01-01 01:01:01'),(125,20220307104655,1,'2020-01-01 01:01:01'),(126,20220309133956,1,'2020-01-01 01:01:01'),(127,20220316155700,1,'2020-01-01 01:01:01'),(128,20220323152301,1,'2020-01-01 01:01:01'),(129,20220330100659,1,'2020-01-01 01:01:01'),(130,20220404091216,1,'2020-01-01 01:01:01'),(131,20220419140750,1,'2020-01-01 01:01:01'),(132,20220428140039,1,'2020-01-01 01:01:01'),(133,20220503134048,1,'2020-01-01 01:01:01'),(134,20220524102918,1,'2020-01-01 01:01:01'),(135,20220526123327,1,'2020-01-01 01:01:01'),(136,20220526123328,1,'2020-01-01 01:01:01'),(137,20220526123329,1,'2020-01-01 01:01:01'),(138,20220608113128,1,'2020-01-01 01:01:01'),(139,20220627104817,1,'2020-01-01 01:01:01'),(140,20220704101843,1,'2020-01-01 01:01:01'),(141,20220708095046,1,'2020-01-01 01:01:01'),(142,20220713091130,1,'2020-01-01 01:01:01'),(143,20220802135510,1,'2020-01-01 01:01:01'),(144,20220818101352,1,'2020-01-01 01:01:01'),(145,20220822161445,1,'2020-01-01 01:01:01'),(146,20220831100036,1,'2020-01-01 01:01:01'),(147,20220831100151,1,'2020-01-01 01:01:01'),(148,20220908181826,1,'2020-01-01 01:01:01'),(149,20220914154915,1,'2020-01-01 01:01:01'),(150,20220915165115,1,'2020-01-01 01:01:01'),(151,20220915165116,1,'2020-01-01 01:01:01'),(152,20220928100158,1,'2020-01-01 01:01:01'),(153,20221014084130,1,'2020-01-01 01:01:01'),(154,20221027085019,1,'2020-01-01 01:01:01'),(155,20221101103952,1,'2020-01-01 01:01:01'),(156,20221104144401,1,'2020-01-01 01:01:01'),(157,20221109100749,1,'2020-01-01 01:01:01'),(158,20221115104546,1,'2020-01-01 01:01:01'),(159,20221130114928,1,'2020-01-01 01:01:01'),(160,20221205112142,1,'2020-01-01 01:01:01'),(161,20221216115820,1,'2020-01-01 01:01:01'),(162,20221220195934,1,'2020-01-01 01:01:01'),(163,20221220195935,1,'2020-01-01 01:01:01'),(164,20221223174807,1,'2020-01-01 01:01:01'),(165,20221227163855,1,'2020-01-01 01:01:01'),(166,20221227163856,1,'2020-01-01 01:01:01'),(167,20230202224725,1,'2020-01-01 01:01:01'),(168,20230206163608,1,'2020-01-01 01:01:01'),(169,20230214131519,1,'2020-01-01 01:01:01'),(170,20230303135738,1,'2020-01-01 01:01:01'),(171,20230313135301,1,'2020-01-01 01:01:01'),(172,20230313141819,1,'2020-01-01 01:01:01'),(173,20230315104937,1,'2020-01-01 01:01:01'),(174,20230317173844,1,'2020-01-01 01:01:01'),(175,20230320133602,1,'2020-01-01 01:01:01'),(176,20230330100011,1,'2020-01-01 01:01:01'),(177,20230330134823,1,'2020-01-01 01:01:01'),(178,20230405232025,1,'2020-01-01 01:01:01'),(179,20230408084104,1,'2020-01-01 01:01:01'),(180,20230411102858,1,'2020-01-01 01:01:01'),(181,20230421155932,1,'2020-01-01 01:01:01'),(182,20230425082126,1,'2020-01-01 01:01:01'),(183,20230425105727,1,'2020-01-01 01:01:01'),(184,20230501154913,1,'2020-01-01 01:01:01'),(185,20230503101418,1,'2020-01-01 01:01:01'),(186,20230515144206,1,'2020-01-01 01:01:01'),(187,20230517140952,1,'2020-01-01 01:01:01'),(188,20230517152807,1,'2020-01-01 01:01:01'),(189,20230518114155,1,'2020-01-01 01:01:01'),(190,20230520153236,1,'2020-01-01 01:01:01'),(191,20230525151159,1,'2020-01-01 01:01:01'),(192,20230530122103,1,'2020-01-01 01:01:01'),(193,20230602111827,1,'2020-01-01 01:01:01'),(194,20230608103123,1,'2020-01-01 01:01:01'),(195,20230629140529,1,'2020-01-01 01:01:01'),(196,20230629140530,1,'2020-01-01 01:01:01'),(197,20230711144622,1,'2020-01-01 01:01:01'),(198,20230721135421,1,'2020-01-01 01:01:01'),(199,20230721161508,1,'2020-01-01 01:01:01'),(200,20230726115701,1,'2020-01-01 01:01:01'),(201,20230807100822,1,'2020-01-01 01:01:01'),(202,20230814150442,1,'2020-01-01 01:01:01'),(203,20230823122728,1,'2020-01-01 01:01:01'),(204,20230906152143,1,'2020-01-01 01:01:01'),(205,20230911163618,1,'2020-01-01 01:01:01'),(206,20230912101759,1,'2020-01-01 01:01:01'),(207,20230915101341,1,'2020-01-01 01:01:01'),(208,20230918132351,1,'2020-01-01 01:01:01'),(209,20231004144339,1,'2020-01-01 01:01:01'),(210,20231009094541,1,'2020-01-01 01:01:01'),(211,20231009094542,1,'2020-01-01 01:01:01'),(212,20231009094543,1,'2020-01-01 01:01:01'),(213,20231009094544,1,'2020-01-01 01:01:01'),(214,20231016091915,1,'2020-01-01 01:01:01'),(215,20231024174135,1,'2020-01-01 01:01:01'),(216,20231025120016,1,'2020-01-01 01:01:01'),(217,20231025160156,1,'2020-01-01 01:01:01'),(218,20231031165350,1,'2020-01-01 01:01:01'),(219,20231106144110,1,'2020-01-01 01:01:01'),(220,20231107130934,1,'2020-01-01 01:01:01'),(221,20231109115838,1,'2020-01-01 01:01:01'),(222,20231121054530,1,'2020-01-01 01:01:01'),(223,20231122101320,1,'2020-01-01 01:01:01'),(224,20231130132828,1,'2020-01-01 01:01:01'),(225,20231130132931,1,'2020-01-01 01:01:01'),(226,20231204155427,1,'2020-01-01 01:01:01'),(227,20231206142340,1,'2020-01-01 01:01:01'),(228,20231207102320,1,'2020-01-01 01:01:01'),(229,20231207102321,1,'2020-01-01 01:01:01'),(230,20231207133731,1,'2020-01-01 01:01:01'),(231,20231212094238,1,'2020-01-01 01:01:01'),(232,20231212095734,1,'2020-01-01 01:01:01'),(233,20231212161121,1,'2020-01-01 01:01:01'),(234,20231215122713,1,'2020-01-01 01:01:01'),(235,20231219143041,1,'2020-01-01 01:01:01'),(236,20231224070653,1,'2020-01-01 01:01:01'),(237,20240110134315,1,'2020-01-01 01:01:01'),(238,20240119091637,1,'2020-01-01 01:01:01'),(239,20240126020642,1,'2020-01-01 01:01:01'),(240,20240126020643,1,'2020-01-01 01:01:01'),(241,20240129162819,1,'2020-01-01 01:01:01'),(242,20240130115133,1,'2020-01-01 01:01:01'),(243,20240131083822,1,'2020-01-01 01:01:01'),(244,20240205095928,1,'2020-01-01 01:01:01'),(245,20240205121956,1,'2020-01-01 01:01:01'),(246,20240209110212,1,'2020-01-01 01:01:01'),(247,20240212111533,1,'2020-01-01 01:01:01'),(248,20240221112844,1,'2020-01-01 01:01:01'),(249,20240222073518,1,'2020-01-01 01:01:01'),(250,20240222135115,1,'2020-01-01 01:01:01'),(251,20240226082255,1,'2020-01-01 01:01:01'),(252,20240228082706,1,'2020-01-01 01:01:01'),(253,20240301173035,1,'2020-01-01 01:01:01'),(254,20240302111134,1,'2020-01-01 01:01:01'),(255,20240312103753,1,'2020-01-01 01:01:01'),(256,20240313143416,1,'2020-01-01 01:01:01'),(257,20240314085226,1,'2020-01-01 01:01:01'),(258,20240314151747,1,'2020-01-01 01:01:01'),(259,20240320145650,1,'2020-01-01 01:01:01'),(260,20240327115530,1,'2020-01-01 01:01:01'),(261,20240327115617,1,'2020-01-01 01:01:01'),(262,20240408085837,1,'2020-01-01 01:01:01'),(263,20240415104633,1,'2020-01-01 01:01:01'),(264,20240430111727,1,'2020-01-01 01:01:01'),(265,20240515200020,1,'2020-01-01 01:01:01'),(266,20240521143023,1,'2020-01-01 01:01:01'),(267,20240521143024,1,'2020-01-01 01:01:01'),(268,20240601174138,1,'2020-01-01 01:01:01'),(269,20240607133721,1,'2020-01-01 01:01:01'),(270,20240612150059,1,'2020-01-01 01:01:01'),(271,20240613162201,1,'2020-01-01 01:01:01'),(272,20240613172616,1,'2020-01-01 01:01:01'),(273,20240618142419,1,'2020-01-01 01:01:01'),(274,20240625093543,1,'2020-01-01 01:01:01'),(275,20240626195531,1,'2020-01-01 01:01:01'),(276,20240702123921,1,'2020-01-01 01:01:01'),(277,20240703154849,1,'2020-01-01 01:01:01'),(278,20240707134035,1,'2020-01-01 01:01:01'),(279,20240707134036,1,'2020-01-01 01:01:01'),(280,20240709124958,1,'2020-01-01 01:01:01'),(281,20240709132642,1,'2020-01-01 01:01:01'),(282,20240709183940,1,'2020-01-01 01:01:01'),(283,20240710155623,1,'2020-01-01 01:01:01'),(284,20240723102712,1,'2020-01-01 01:01:01'),(285,20240725152735,1,'2020-01-01 01:01:01'),(286,20240725182118,1,'2020-01-01 01:01:01'),(287,20240726100517,1,'2020-01-01 01:01:01'),(288,20240730171504,1,'2020-01-01 01:01:01'),(289,20240730174056,1,'2020-01-01 01:01:01'),(290,20240730215453,1,'2020-01-01 01:01:01'),(291,20240730374423,1,'2020-01-01 01:01:01'),(292,20240801115359,1,'2020-01-01 01:01:01'),(293,20240802101043,1,'2020-01-01 01:01:01'),(294,20240802113716,1,'2020-01-01 01:01:01'),(295,20240814135330,1,'2020-01-01 01:01:01'),(296,20240815000000,1,'2020-01-01 01:01:01'),(297,20240815000001,1,'2020-01-01 01:01:01'),(298,20240816103247,1,'2020-01-01 01:01:01'),(299,20240820091218,1,'2020-01-01 01:01:01'),(300,20240826111228,1,'2020-01-01 01:01:01'),(301,20240826160025,1,'2020-01-01 01:01:01'),(302,20240829165448,1,'2020-01-01 01:01:01'),(303,20240829165605,1,'2020-01-01 01:01:01'),(304,20240829165715,1,'2020-01-01 01:01:01'),(305,20240829165930,1,'2020-01-01 01:01:01'),(306,20240829170023,1,'2020-01-01 01:01:01'),(307,20240829170033,1,'2020-01-01 01:01:01'),(308,20240829170044,1,'2020-01-01 01:01:01'),(309,20240905105135,1,'2020-01-01 01:01:01'),(310,20240905140514,1,'2020-01-01 01:01:01');
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mobile_device_management_solutions` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
   `name` varchar(100) COLLATE utf8mb4_unicode_ci NOT NULL,
   `server_url` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_mobile_device_management_solutions_name` (`name`,`server_url`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `munki_issues` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
   `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `issue_type` varchar(10) COLLATE utf8mb4_unicode_ci NOT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_munki_issues_name` (`name`,`issue_type`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `nano_cert_auth_associations` (
   `id` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `sha256` char(64) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   `cert_not_valid_after` timestamp NULL DEFAULT NULL,
-  `renew_command_uuid` varchar(127) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `renew_command_uuid` varchar(127) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   PRIMARY KEY (`id`,`sha256`),
   KEY `renew_command_uuid_fk` (`renew_command_uuid`),
-  CONSTRAINT `renew_command_uuid_fk` FOREIGN KEY (`renew_command_uuid`) REFERENCES `nano_commands` (`command_uuid`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  CONSTRAINT `renew_command_uuid_fk` FOREIGN KEY (`renew_command_uuid`) REFERENCES `nano_commands` (`command_uuid`),
+  CONSTRAINT `nano_cert_auth_associations_chk_1` CHECK ((`id` <> _utf8mb4'')),
+  CONSTRAINT `nano_cert_auth_associations_chk_2` CHECK ((`sha256` <> _utf8mb4''))
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `nano_command_results` (
   `id` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `command_uuid` varchar(127) COLLATE utf8mb4_unicode_ci NOT NULL,
   `status` varchar(31) COLLATE utf8mb4_unicode_ci NOT NULL,
   `result` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,
   `not_now_at` timestamp NULL DEFAULT NULL,
-  `not_now_tally` int(11) NOT NULL DEFAULT '0',
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `not_now_tally` int NOT NULL DEFAULT '0',
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`,`command_uuid`),
   KEY `command_uuid` (`command_uuid`),
   KEY `status` (`status`),
   CONSTRAINT `nano_command_results_ibfk_1` FOREIGN KEY (`id`) REFERENCES `nano_enrollments` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
-  CONSTRAINT `nano_command_results_ibfk_2` FOREIGN KEY (`command_uuid`) REFERENCES `nano_commands` (`command_uuid`) ON DELETE CASCADE ON UPDATE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  CONSTRAINT `nano_command_results_ibfk_2` FOREIGN KEY (`command_uuid`) REFERENCES `nano_commands` (`command_uuid`) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT `nano_command_results_chk_1` CHECK ((`status` <> _utf8mb4'')),
+  CONSTRAINT `nano_command_results_chk_2` CHECK ((substr(`result`,1,5) = _utf8mb4'<?xml'))
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `nano_commands` (
   `command_uuid` varchar(127) COLLATE utf8mb4_unicode_ci NOT NULL,
   `request_type` varchar(63) COLLATE utf8mb4_unicode_ci NOT NULL,
   `command` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  PRIMARY KEY (`command_uuid`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  `created_at` timestamp(6) NULL DEFAULT CURRENT_TIMESTAMP(6),
+  `updated_at` timestamp(6) NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+  PRIMARY KEY (`command_uuid`),
+  CONSTRAINT `nano_commands_chk_1` CHECK ((`command_uuid` <> _utf8mb4'')),
+  CONSTRAINT `nano_commands_chk_2` CHECK ((`request_type` <> _utf8mb4'')),
+  CONSTRAINT `nano_commands_chk_3` CHECK ((substr(`command`,1,5) = _utf8mb4'<?xml'))
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `nano_dep_names` (
   `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `consumer_key` text COLLATE utf8mb4_unicode_ci,
@@ -1030,13 +1126,15 @@ CREATE TABLE `nano_dep_names` (
   `syncer_cursor_at` timestamp NULL DEFAULT NULL,
   `assigner_profile_uuid` text COLLATE utf8mb4_unicode_ci,
   `assigner_profile_uuid_at` timestamp NULL DEFAULT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  PRIMARY KEY (`name`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  PRIMARY KEY (`name`),
+  CONSTRAINT `nano_dep_names_chk_1` CHECK (((`tokenpki_cert_pem` is null) or (substr(`tokenpki_cert_pem`,1,27) = _utf8mb4'-----BEGIN CERTIFICATE-----'))),
+  CONSTRAINT `nano_dep_names_chk_2` CHECK (((`tokenpki_key_pem` is null) or (substr(`tokenpki_key_pem`,1,5) = _utf8mb4'-----')))
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `nano_devices` (
   `id` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `identity_cert` text COLLATE utf8mb4_unicode_ci,
@@ -1049,30 +1147,36 @@ CREATE TABLE `nano_devices` (
   `token_update_at` timestamp NULL DEFAULT NULL,
   `bootstrap_token_b64` text COLLATE utf8mb4_unicode_ci,
   `bootstrap_token_at` timestamp NULL DEFAULT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`),
-  KEY `serial_number` (`serial_number`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  KEY `serial_number` (`serial_number`),
+  CONSTRAINT `nano_devices_chk_1` CHECK (((`identity_cert` is null) or (substr(`identity_cert`,1,27) = _utf8mb4'-----BEGIN CERTIFICATE-----'))),
+  CONSTRAINT `nano_devices_chk_2` CHECK (((`serial_number` is null) or (`serial_number` <> _utf8mb4''))),
+  CONSTRAINT `nano_devices_chk_3` CHECK (((`unlock_token` is null) or (length(`unlock_token`) > 0))),
+  CONSTRAINT `nano_devices_chk_4` CHECK ((`authenticate` <> _utf8mb4'')),
+  CONSTRAINT `nano_devices_chk_5` CHECK (((`token_update` is null) or (`token_update` <> _utf8mb4''))),
+  CONSTRAINT `nano_devices_chk_6` CHECK (((`bootstrap_token_b64` is null) or (`bootstrap_token_b64` <> _utf8mb4'')))
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `nano_enrollment_queue` (
   `id` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `command_uuid` varchar(127) COLLATE utf8mb4_unicode_ci NOT NULL,
   `active` tinyint(1) NOT NULL DEFAULT '1',
-  `priority` tinyint(4) NOT NULL DEFAULT '0',
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `priority` tinyint NOT NULL DEFAULT '0',
+  `created_at` timestamp(6) NULL DEFAULT CURRENT_TIMESTAMP(6),
+  `updated_at` timestamp(6) NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
   PRIMARY KEY (`id`,`command_uuid`),
   KEY `command_uuid` (`command_uuid`),
-  KEY `priority` (`priority`,`created_at`),
+  KEY `priority` (`priority` DESC,`created_at`),
   CONSTRAINT `nano_enrollment_queue_ibfk_1` FOREIGN KEY (`id`) REFERENCES `nano_enrollments` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
   CONSTRAINT `nano_enrollment_queue_ibfk_2` FOREIGN KEY (`command_uuid`) REFERENCES `nano_commands` (`command_uuid`) ON DELETE CASCADE ON UPDATE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `nano_enrollments` (
   `id` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `device_id` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
@@ -1082,33 +1186,41 @@ CREATE TABLE `nano_enrollments` (
   `push_magic` varchar(127) COLLATE utf8mb4_unicode_ci NOT NULL,
   `token_hex` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `enabled` tinyint(1) NOT NULL DEFAULT '1',
-  `token_update_tally` int(11) NOT NULL DEFAULT '1',
-  `last_seen_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `enrolled_from_migration` tinyint(1) unsigned NOT NULL DEFAULT '0',
+  `token_update_tally` int NOT NULL DEFAULT '1',
+  `last_seen_at` timestamp NOT NULL,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `enrolled_from_migration` tinyint unsigned NOT NULL DEFAULT '0',
   PRIMARY KEY (`id`),
   UNIQUE KEY `user_id` (`user_id`),
   KEY `device_id` (`device_id`),
   KEY `type` (`type`),
   CONSTRAINT `nano_enrollments_ibfk_1` FOREIGN KEY (`device_id`) REFERENCES `nano_devices` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
-  CONSTRAINT `nano_enrollments_ibfk_2` FOREIGN KEY (`user_id`) REFERENCES `nano_users` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  CONSTRAINT `nano_enrollments_ibfk_2` FOREIGN KEY (`user_id`) REFERENCES `nano_users` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT `nano_enrollments_chk_1` CHECK ((`id` <> _utf8mb4'')),
+  CONSTRAINT `nano_enrollments_chk_2` CHECK ((`type` <> _utf8mb4'')),
+  CONSTRAINT `nano_enrollments_chk_3` CHECK ((`topic` <> _utf8mb4'')),
+  CONSTRAINT `nano_enrollments_chk_4` CHECK ((`push_magic` <> _utf8mb4'')),
+  CONSTRAINT `nano_enrollments_chk_5` CHECK ((`token_hex` <> _utf8mb4''))
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `nano_push_certs` (
   `topic` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `cert_pem` text COLLATE utf8mb4_unicode_ci NOT NULL,
   `key_pem` text COLLATE utf8mb4_unicode_ci NOT NULL,
-  `stale_token` int(11) NOT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  PRIMARY KEY (`topic`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  `stale_token` int NOT NULL,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  PRIMARY KEY (`topic`),
+  CONSTRAINT `nano_push_certs_chk_1` CHECK ((`topic` <> _utf8mb4'')),
+  CONSTRAINT `nano_push_certs_chk_2` CHECK ((substr(`cert_pem`,1,27) = _utf8mb4'-----BEGIN CERTIFICATE-----')),
+  CONSTRAINT `nano_push_certs_chk_3` CHECK ((substr(`key_pem`,1,5) = _utf8mb4'-----'))
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `nano_users` (
   `id` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `device_id` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
@@ -1120,15 +1232,21 @@ CREATE TABLE `nano_users` (
   `user_authenticate_at` timestamp NULL DEFAULT NULL,
   `user_authenticate_digest` text COLLATE utf8mb4_unicode_ci,
   `user_authenticate_digest_at` timestamp NULL DEFAULT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`,`device_id`),
+  UNIQUE KEY `idx_unique_id` (`id`),
   KEY `device_id` (`device_id`),
-  CONSTRAINT `nano_users_ibfk_1` FOREIGN KEY (`device_id`) REFERENCES `nano_devices` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  CONSTRAINT `nano_users_ibfk_1` FOREIGN KEY (`device_id`) REFERENCES `nano_devices` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT `nano_users_chk_1` CHECK (((`user_short_name` is null) or (`user_short_name` <> _utf8mb4''))),
+  CONSTRAINT `nano_users_chk_2` CHECK (((`user_long_name` is null) or (`user_long_name` <> _utf8mb4''))),
+  CONSTRAINT `nano_users_chk_3` CHECK (((`token_update` is null) or (`token_update` <> _utf8mb4''))),
+  CONSTRAINT `nano_users_chk_4` CHECK (((`user_authenticate` is null) or (`user_authenticate` <> _utf8mb4''))),
+  CONSTRAINT `nano_users_chk_5` CHECK (((`user_authenticate_digest` is null) or (`user_authenticate_digest` <> _utf8mb4'')))
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 SET @saved_cs_client     = @@character_set_client;
-SET character_set_client = utf8;
+/*!50503 SET character_set_client = utf8mb4 */;
 /*!50001 CREATE VIEW `nano_view_queue` AS SELECT 
  1 AS `id`,
  1 AS `created_at`,
@@ -1142,92 +1260,92 @@ SET character_set_client = utf8;
  1 AS `result`*/;
 SET character_set_client = @saved_cs_client;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `network_interfaces` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `host_id` int(10) unsigned NOT NULL,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `host_id` int unsigned NOT NULL,
   `mac` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `ip_address` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `broadcast` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `ibytes` bigint(20) NOT NULL DEFAULT '0',
+  `ibytes` bigint NOT NULL DEFAULT '0',
   `interface` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `ipackets` bigint(20) NOT NULL DEFAULT '0',
-  `last_change` bigint(20) NOT NULL DEFAULT '0',
+  `ipackets` bigint NOT NULL DEFAULT '0',
+  `last_change` bigint NOT NULL DEFAULT '0',
   `mask` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `metric` int(11) NOT NULL DEFAULT '0',
-  `mtu` int(11) NOT NULL DEFAULT '0',
-  `obytes` bigint(20) NOT NULL DEFAULT '0',
-  `ierrors` bigint(20) NOT NULL DEFAULT '0',
-  `oerrors` bigint(20) NOT NULL DEFAULT '0',
-  `opackets` bigint(20) NOT NULL DEFAULT '0',
+  `metric` int NOT NULL DEFAULT '0',
+  `mtu` int NOT NULL DEFAULT '0',
+  `obytes` bigint NOT NULL DEFAULT '0',
+  `ierrors` bigint NOT NULL DEFAULT '0',
+  `oerrors` bigint NOT NULL DEFAULT '0',
+  `opackets` bigint NOT NULL DEFAULT '0',
   `point_to_point` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `type` int(11) NOT NULL DEFAULT '0',
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `type` int NOT NULL DEFAULT '0',
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_network_interfaces_unique_ip_host_intf` (`ip_address`,`host_id`,`interface`),
   KEY `idx_network_interfaces_hosts_fk` (`host_id`),
   FULLTEXT KEY `ip_address_search` (`ip_address`),
   CONSTRAINT `network_interfaces_ibfk_1` FOREIGN KEY (`host_id`) REFERENCES `hosts` (`id`) ON DELETE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `operating_system_vulnerabilities` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `operating_system_id` int(10) unsigned NOT NULL,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `operating_system_id` int unsigned NOT NULL,
   `cve` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `source` smallint(6) DEFAULT '0',
+  `source` smallint DEFAULT '0',
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  `resolved_in_version` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `resolved_in_version` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_os_vulnerabilities_unq_os_id_cve` (`operating_system_id`,`cve`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `operating_systems` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
   `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `version` varchar(150) COLLATE utf8mb4_unicode_ci NOT NULL,
   `arch` varchar(150) COLLATE utf8mb4_unicode_ci NOT NULL,
   `kernel_version` varchar(150) COLLATE utf8mb4_unicode_ci NOT NULL,
   `platform` varchar(50) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `display_version` varchar(10) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `os_version_id` int(10) unsigned DEFAULT NULL,
+  `display_version` varchar(10) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `os_version_id` int unsigned DEFAULT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_unique_os` (`name`,`version`,`arch`,`kernel_version`,`platform`,`display_version`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `osquery_options` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `override_type` int(1) NOT NULL,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `override_type` int NOT NULL,
   `override_identifier` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `options` json NOT NULL,
   PRIMARY KEY (`id`)
-) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 INSERT INTO `osquery_options` VALUES (1,0,'','{\"options\": {\"logger_plugin\": \"tls\", \"pack_delimiter\": \"/\", \"logger_tls_period\": 10, \"distributed_plugin\": \"tls\", \"disable_distributed\": false, \"logger_tls_endpoint\": \"/api/v1/osquery/log\", \"distributed_interval\": 10, \"distributed_tls_max_attempts\": 3}, \"decorators\": {\"load\": [\"SELECT uuid AS host_uuid FROM system_info;\", \"SELECT hostname AS hostname FROM system_info;\"]}}');
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `pack_targets` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `pack_id` int(10) unsigned DEFAULT NULL,
-  `type` int(11) DEFAULT NULL,
-  `target_id` int(10) unsigned NOT NULL,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `pack_id` int unsigned DEFAULT NULL,
+  `type` int DEFAULT NULL,
+  `target_id` int unsigned NOT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `constraint_pack_target_unique` (`pack_id`,`target_id`,`type`),
   CONSTRAINT `pack_targets_ibfk_1` FOREIGN KEY (`pack_id`) REFERENCES `packs` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `packs` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   `disabled` tinyint(1) NOT NULL DEFAULT '0',
   `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
@@ -1236,77 +1354,80 @@ CREATE TABLE `packs` (
   `pack_type` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_pack_unique_name` (`name`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `password_reset_requests` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `expires_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `expires_at` timestamp NOT NULL,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `user_id` int(10) unsigned NOT NULL,
+  `user_id` int unsigned NOT NULL,
   `token` varchar(1024) COLLATE utf8mb4_unicode_ci NOT NULL,
   PRIMARY KEY (`id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `policies` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `team_id` int(10) unsigned DEFAULT NULL,
+  `team_id` int unsigned DEFAULT NULL,
   `resolution` text COLLATE utf8mb4_unicode_ci,
   `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `query` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,
   `description` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,
-  `author_id` int(10) unsigned DEFAULT NULL,
+  `author_id` int unsigned DEFAULT NULL,
   `platforms` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `critical` tinyint(1) NOT NULL DEFAULT '0',
   `checksum` binary(16) NOT NULL,
-  `calendar_events_enabled` tinyint(1) unsigned NOT NULL DEFAULT '0',
+  `calendar_events_enabled` tinyint unsigned NOT NULL DEFAULT '0',
+  `software_installer_id` int unsigned DEFAULT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_policies_checksum` (`checksum`),
   KEY `idx_policies_author_id` (`author_id`),
   KEY `idx_policies_team_id` (`team_id`),
+  KEY `fk_policies_software_installer_id` (`software_installer_id`),
   CONSTRAINT `policies_ibfk_2` FOREIGN KEY (`team_id`) REFERENCES `teams` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT `policies_ibfk_3` FOREIGN KEY (`software_installer_id`) REFERENCES `software_installers` (`id`),
   CONSTRAINT `policies_queries_ibfk_1` FOREIGN KEY (`author_id`) REFERENCES `users` (`id`) ON DELETE SET NULL
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `policy_automation_iterations` (
-  `policy_id` int(10) unsigned NOT NULL,
-  `iteration` int(11) NOT NULL,
+  `policy_id` int unsigned NOT NULL,
+  `iteration` int NOT NULL,
   PRIMARY KEY (`policy_id`),
   CONSTRAINT `policy_automation_iterations_ibfk_1` FOREIGN KEY (`policy_id`) REFERENCES `policies` (`id`) ON DELETE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `policy_membership` (
-  `policy_id` int(10) unsigned NOT NULL,
-  `host_id` int(10) unsigned NOT NULL,
+  `policy_id` int unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
   `passes` tinyint(1) DEFAULT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `automation_iteration` int(11) DEFAULT NULL,
+  `automation_iteration` int DEFAULT NULL,
   PRIMARY KEY (`policy_id`,`host_id`),
   KEY `idx_policy_membership_passes` (`passes`),
   KEY `idx_policy_membership_policy_id` (`policy_id`),
   KEY `idx_policy_membership_host_id_passes` (`host_id`,`passes`),
   CONSTRAINT `policy_membership_ibfk_1` FOREIGN KEY (`policy_id`) REFERENCES `policies` (`id`) ON DELETE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `policy_stats` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `policy_id` int(10) unsigned NOT NULL,
-  `inherited_team_id` int(10) unsigned NOT NULL DEFAULT '0',
-  `passing_host_count` mediumint(8) unsigned NOT NULL DEFAULT '0',
-  `failing_host_count` mediumint(8) unsigned NOT NULL DEFAULT '0',
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `policy_id` int unsigned NOT NULL,
+  `inherited_team_id` int unsigned NOT NULL DEFAULT '0',
+  `passing_host_count` mediumint unsigned NOT NULL DEFAULT '0',
+  `failing_host_count` mediumint unsigned NOT NULL DEFAULT '0',
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`),
@@ -1315,23 +1436,23 @@ CREATE TABLE `policy_stats` (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `queries` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   `saved` tinyint(1) NOT NULL DEFAULT '0',
   `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `description` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,
   `query` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,
-  `author_id` int(10) unsigned DEFAULT NULL,
+  `author_id` int unsigned DEFAULT NULL,
   `observer_can_run` tinyint(1) NOT NULL DEFAULT '0',
-  `team_id` int(10) unsigned DEFAULT NULL,
+  `team_id` int unsigned DEFAULT NULL,
   `team_id_char` char(10) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `platform` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `min_osquery_version` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `schedule_interval` int(10) unsigned NOT NULL DEFAULT '0',
-  `automations_enabled` tinyint(1) unsigned NOT NULL DEFAULT '0',
+  `schedule_interval` int unsigned NOT NULL DEFAULT '0',
+  `automations_enabled` tinyint unsigned NOT NULL DEFAULT '0',
   `logging_type` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT 'snapshot',
   `discard_data` tinyint(1) NOT NULL DEFAULT '1',
   PRIMARY KEY (`id`),
@@ -1341,59 +1462,61 @@ CREATE TABLE `queries` (
   KEY `idx_team_id_saved_auto_interval` (`team_id`,`saved`,`automations_enabled`,`schedule_interval`),
   CONSTRAINT `queries_ibfk_1` FOREIGN KEY (`author_id`) REFERENCES `users` (`id`) ON DELETE SET NULL,
   CONSTRAINT `queries_ibfk_2` FOREIGN KEY (`team_id`) REFERENCES `teams` (`id`) ON DELETE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `query_results` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `query_id` int(10) unsigned NOT NULL,
-  `host_id` int(10) unsigned NOT NULL,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `query_id` int unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
   `osquery_version` varchar(50) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
-  `error` text COLLATE utf8mb4_unicode_ci,
-  `last_fetched` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `error` text CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci,
+  `last_fetched` timestamp NOT NULL,
   `data` json DEFAULT NULL,
   PRIMARY KEY (`id`),
-  KEY `query_id` (`query_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  KEY `idx_query_id_host_id_last_fetched` (`query_id`,`host_id`,`last_fetched`)
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `scep_certificates` (
-  `serial` bigint(20) NOT NULL,
+  `serial` bigint NOT NULL,
   `name` varchar(1024) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `not_valid_before` datetime NOT NULL,
   `not_valid_after` datetime NOT NULL,
   `certificate_pem` text COLLATE utf8mb4_unicode_ci NOT NULL,
   `revoked` tinyint(1) NOT NULL DEFAULT '0',
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`serial`),
-  CONSTRAINT `scep_certificates_ibfk_1` FOREIGN KEY (`serial`) REFERENCES `scep_serials` (`serial`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  CONSTRAINT `scep_certificates_ibfk_1` FOREIGN KEY (`serial`) REFERENCES `scep_serials` (`serial`),
+  CONSTRAINT `scep_certificates_chk_1` CHECK ((substr(`certificate_pem`,1,27) = _utf8mb4'-----BEGIN CERTIFICATE-----')),
+  CONSTRAINT `scep_certificates_chk_2` CHECK (((`name` is null) or (`name` <> _utf8mb4'')))
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `scep_serials` (
-  `serial` bigint(20) NOT NULL AUTO_INCREMENT,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `serial` bigint NOT NULL AUTO_INCREMENT,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   PRIMARY KEY (`serial`)
-) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `scheduled_queries` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `pack_id` int(10) unsigned DEFAULT NULL,
-  `query_id` int(10) unsigned DEFAULT NULL,
-  `interval` int(10) unsigned DEFAULT NULL,
+  `pack_id` int unsigned DEFAULT NULL,
+  `query_id` int unsigned DEFAULT NULL,
+  `interval` int unsigned DEFAULT NULL,
   `snapshot` tinyint(1) DEFAULT NULL,
   `removed` tinyint(1) DEFAULT NULL,
   `platform` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT '',
   `version` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT '',
-  `shard` int(10) unsigned DEFAULT NULL,
+  `shard` int unsigned DEFAULT NULL,
   `query_name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `description` varchar(1023) COLLATE utf8mb4_unicode_ci DEFAULT '',
@@ -1406,72 +1529,72 @@ CREATE TABLE `scheduled_queries` (
   KEY `fk_scheduled_queries_queries` (`team_id_char`,`query_name`),
   CONSTRAINT `scheduled_queries_ibfk_1` FOREIGN KEY (`team_id_char`, `query_name`) REFERENCES `queries` (`team_id_char`, `name`) ON DELETE CASCADE ON UPDATE CASCADE,
   CONSTRAINT `scheduled_queries_pack_id` FOREIGN KEY (`pack_id`) REFERENCES `packs` (`id`) ON DELETE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `scheduled_query_stats` (
-  `host_id` int(10) unsigned NOT NULL,
-  `scheduled_query_id` int(10) unsigned NOT NULL,
-  `average_memory` bigint(20) unsigned NOT NULL,
+  `host_id` int unsigned NOT NULL,
+  `scheduled_query_id` int unsigned NOT NULL,
+  `average_memory` bigint unsigned NOT NULL,
   `denylisted` tinyint(1) DEFAULT NULL,
-  `executions` bigint(20) unsigned NOT NULL,
-  `schedule_interval` int(11) DEFAULT NULL,
-  `last_executed` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `output_size` bigint(20) unsigned NOT NULL,
-  `system_time` bigint(20) unsigned NOT NULL,
-  `user_time` bigint(20) unsigned NOT NULL,
-  `wall_time` bigint(20) unsigned NOT NULL,
-  `query_type` tinyint(4) NOT NULL DEFAULT '0',
+  `executions` bigint unsigned NOT NULL,
+  `schedule_interval` int DEFAULT NULL,
+  `last_executed` timestamp NULL DEFAULT NULL,
+  `output_size` bigint unsigned NOT NULL,
+  `system_time` bigint unsigned NOT NULL,
+  `user_time` bigint unsigned NOT NULL,
+  `wall_time` bigint unsigned NOT NULL,
+  `query_type` tinyint NOT NULL DEFAULT '0',
   PRIMARY KEY (`host_id`,`scheduled_query_id`,`query_type`),
   KEY `scheduled_query_id` (`scheduled_query_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `script_contents` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
   `md5_checksum` binary(16) NOT NULL,
-  `contents` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,
+  `contents` mediumtext CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_script_contents_md5_checksum` (`md5_checksum`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `scripts` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `team_id` int(10) unsigned DEFAULT NULL,
-  `global_or_team_id` int(10) unsigned NOT NULL DEFAULT '0',
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `team_id` int unsigned DEFAULT NULL,
+  `global_or_team_id` int unsigned NOT NULL DEFAULT '0',
   `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `script_content_id` int(10) unsigned DEFAULT NULL,
+  `script_content_id` int unsigned DEFAULT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_scripts_global_or_team_id_name` (`global_or_team_id`,`name`),
   UNIQUE KEY `idx_scripts_team_name` (`team_id`,`name`),
   KEY `script_content_id` (`script_content_id`),
   CONSTRAINT `scripts_ibfk_1` FOREIGN KEY (`team_id`) REFERENCES `teams` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
   CONSTRAINT `scripts_ibfk_2` FOREIGN KEY (`script_content_id`) REFERENCES `script_contents` (`id`) ON DELETE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `sessions` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `accessed_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `user_id` int(10) unsigned NOT NULL,
+  `user_id` int unsigned NOT NULL,
   `key` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_session_unique_key` (`key`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `software` (
-  `id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
+  `id` bigint unsigned NOT NULL AUTO_INCREMENT,
   `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `version` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `source` varchar(64) COLLATE utf8mb4_unicode_ci NOT NULL,
@@ -1482,7 +1605,7 @@ CREATE TABLE `software` (
   `vendor` varchar(114) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `browser` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `extension_id` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `title_id` int(10) unsigned DEFAULT NULL,
+  `title_id` int unsigned DEFAULT NULL,
   `checksum` binary(16) NOT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_software_checksum` (`checksum`),
@@ -1490,66 +1613,71 @@ CREATE TABLE `software` (
   KEY `software_source_vendor_idx` (`source`,`vendor_old`),
   KEY `title_id` (`title_id`),
   KEY `idx_sw_name_source_browser` (`name`,`source`,`browser`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `software_cpe` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `software_id` bigint(20) unsigned DEFAULT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `software_id` bigint unsigned DEFAULT NULL,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   `cpe` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `unq_software_id` (`software_id`),
   KEY `software_cpe_cpe_idx` (`cpe`),
   CONSTRAINT `software_cpe_ibfk_1` FOREIGN KEY (`software_id`) REFERENCES `software` (`id`) ON DELETE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `software_cve` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
   `cve` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `source` int(11) DEFAULT '0',
-  `software_id` bigint(20) unsigned DEFAULT NULL,
-  `resolved_in_version` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `source` int DEFAULT '0',
+  `software_id` bigint unsigned DEFAULT NULL,
+  `resolved_in_version` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `unq_software_id_cve` (`software_id`,`cve`),
   KEY `software_cve_software_id` (`software_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `software_host_counts` (
-  `software_id` bigint(20) unsigned NOT NULL,
-  `hosts_count` int(10) unsigned NOT NULL,
+  `software_id` bigint unsigned NOT NULL,
+  `hosts_count` int unsigned NOT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `team_id` int(10) unsigned NOT NULL DEFAULT '0',
-  PRIMARY KEY (`software_id`,`team_id`),
+  `team_id` int unsigned NOT NULL DEFAULT '0',
+  `global_stats` tinyint unsigned NOT NULL DEFAULT '0',
+  PRIMARY KEY (`software_id`,`team_id`,`global_stats`),
   KEY `idx_software_host_counts_updated_at_software_id` (`updated_at`,`software_id`),
   KEY `idx_software_host_counts_team_id_hosts_count_software_id` (`team_id`,`hosts_count`,`software_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `software_installers` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `team_id` int(10) unsigned DEFAULT NULL,
-  `global_or_team_id` int(10) unsigned NOT NULL DEFAULT '0',
-  `title_id` int(10) unsigned DEFAULT NULL,
-  `filename` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `version` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `platform` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `pre_install_query` text COLLATE utf8mb4_unicode_ci,
-  `install_script_content_id` int(10) unsigned NOT NULL,
-  `post_install_script_content_id` int(10) unsigned DEFAULT NULL,
-  `storage_id` varchar(64) COLLATE utf8mb4_unicode_ci NOT NULL,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `team_id` int unsigned DEFAULT NULL,
+  `global_or_team_id` int unsigned NOT NULL DEFAULT '0',
+  `title_id` int unsigned DEFAULT NULL,
+  `filename` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `version` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `platform` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `pre_install_query` text CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci,
+  `install_script_content_id` int unsigned NOT NULL,
+  `post_install_script_content_id` int unsigned DEFAULT NULL,
+  `storage_id` varchar(64) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
   `uploaded_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `self_service` tinyint(1) NOT NULL DEFAULT '0',
+  `user_id` int unsigned DEFAULT NULL,
+  `user_name` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `user_email` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `url` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_software_installers_team_id_title_id` (`global_or_team_id`,`title_id`),
   KEY `fk_software_installers_title` (`title_id`),
@@ -1557,80 +1685,84 @@ CREATE TABLE `software_installers` (
   KEY `fk_software_installers_post_install_script_content_id` (`post_install_script_content_id`),
   KEY `fk_software_installers_team_id` (`team_id`),
   KEY `idx_software_installers_platform_title_id` (`platform`,`title_id`),
-  CONSTRAINT `fk_software_installers_install_script_content_id` FOREIGN KEY (`install_script_content_id`) REFERENCES `script_contents` (`id`) ON UPDATE CASCADE,
-  CONSTRAINT `fk_software_installers_post_install_script_content_id` FOREIGN KEY (`post_install_script_content_id`) REFERENCES `script_contents` (`id`) ON UPDATE CASCADE,
+  KEY `fk_software_installers_user_id` (`user_id`),
+  CONSTRAINT `fk_software_installers_install_script_content_id` FOREIGN KEY (`install_script_content_id`) REFERENCES `script_contents` (`id`) ON DELETE RESTRICT ON UPDATE CASCADE,
+  CONSTRAINT `fk_software_installers_post_install_script_content_id` FOREIGN KEY (`post_install_script_content_id`) REFERENCES `script_contents` (`id`) ON DELETE RESTRICT ON UPDATE CASCADE,
   CONSTRAINT `fk_software_installers_team_id` FOREIGN KEY (`team_id`) REFERENCES `teams` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
-  CONSTRAINT `fk_software_installers_title` FOREIGN KEY (`title_id`) REFERENCES `software_titles` (`id`) ON DELETE SET NULL ON UPDATE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  CONSTRAINT `fk_software_installers_title` FOREIGN KEY (`title_id`) REFERENCES `software_titles` (`id`) ON DELETE SET NULL ON UPDATE CASCADE,
+  CONSTRAINT `fk_software_installers_user_id` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE SET NULL
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `software_titles` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
   `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `source` varchar(64) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `browser` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `bundle_identifier` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `browser` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `bundle_identifier` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `additional_identifier` tinyint unsigned GENERATED ALWAYS AS ((case when (`source` = _utf8mb4'ios_apps') then 1 when (`source` = _utf8mb4'ipados_apps') then 2 when (`bundle_identifier` is not null) then 0 else NULL end)) VIRTUAL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_sw_titles` (`name`,`source`,`browser`),
-  UNIQUE KEY `idx_software_titles_bundle_identifier` (`bundle_identifier`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  UNIQUE KEY `idx_software_titles_bundle_identifier` (`bundle_identifier`,`additional_identifier`)
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `software_titles_host_counts` (
-  `software_title_id` int(10) unsigned NOT NULL,
-  `hosts_count` int(10) unsigned NOT NULL,
-  `team_id` int(10) unsigned NOT NULL DEFAULT '0',
+  `software_title_id` int unsigned NOT NULL,
+  `hosts_count` int unsigned NOT NULL,
+  `team_id` int unsigned NOT NULL DEFAULT '0',
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  PRIMARY KEY (`software_title_id`,`team_id`),
+  `global_stats` tinyint unsigned NOT NULL DEFAULT '0',
+  PRIMARY KEY (`software_title_id`,`team_id`,`global_stats`),
   KEY `idx_software_titles_host_counts_team_counts_title` (`team_id`,`hosts_count`,`software_title_id`),
   KEY `idx_software_titles_host_counts_updated_at_software_title_id` (`updated_at`,`software_title_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `statistics` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   `anonymous_identifier` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   PRIMARY KEY (`id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `teams` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `description` varchar(1023) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `config` json DEFAULT NULL,
   `name_bin` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_bin GENERATED ALWAYS AS (`name`) VIRTUAL,
-  `filename` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `filename` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_teams_filename` (`filename`),
   UNIQUE KEY `idx_name_bin` (`name_bin`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `user_teams` (
-  `user_id` int(10) unsigned NOT NULL,
-  `team_id` int(10) unsigned NOT NULL,
+  `user_id` int unsigned NOT NULL,
+  `team_id` int unsigned NOT NULL,
   `role` varchar(64) COLLATE utf8mb4_unicode_ci NOT NULL,
   PRIMARY KEY (`user_id`,`team_id`),
   KEY `fk_user_teams_team_id` (`team_id`),
   CONSTRAINT `user_teams_ibfk_1` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
   CONSTRAINT `user_teams_ibfk_2` FOREIGN KEY (`team_id`) REFERENCES `teams` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `users` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   `password` varbinary(255) NOT NULL,
   `salt` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
@@ -1639,31 +1771,97 @@ CREATE TABLE `users` (
   `admin_forced_password_reset` tinyint(1) NOT NULL DEFAULT '0',
   `gravatar_url` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `position` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
-  `sso_enabled` tinyint(4) NOT NULL DEFAULT '0',
+  `sso_enabled` tinyint NOT NULL DEFAULT '0',
   `global_role` varchar(64) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `api_only` tinyint(1) NOT NULL DEFAULT '0',
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_user_unique_email` (`email`)
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+/*!40101 SET character_set_client = @saved_cs_client */;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!50503 SET character_set_client = utf8mb4 */;
+CREATE TABLE `vpp_apps` (
+  `adam_id` varchar(16) COLLATE utf8mb4_unicode_ci NOT NULL,
+  `title_id` int unsigned DEFAULT NULL,
+  `bundle_identifier` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `icon_url` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `latest_version` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `platform` varchar(10) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  PRIMARY KEY (`adam_id`,`platform`),
+  KEY `fk_vpp_apps_title` (`title_id`),
+  CONSTRAINT `fk_vpp_apps_title` FOREIGN KEY (`title_id`) REFERENCES `software_titles` (`id`) ON DELETE SET NULL ON UPDATE CASCADE
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+/*!40101 SET character_set_client = @saved_cs_client */;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!50503 SET character_set_client = utf8mb4 */;
+CREATE TABLE `vpp_apps_teams` (
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `adam_id` varchar(16) COLLATE utf8mb4_unicode_ci NOT NULL,
+  `team_id` int unsigned DEFAULT NULL,
+  `global_or_team_id` int NOT NULL DEFAULT '0',
+  `platform` varchar(10) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `self_service` tinyint(1) NOT NULL DEFAULT '0',
+  `vpp_token_id` int unsigned NOT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `idx_global_or_team_id_adam_id` (`global_or_team_id`,`adam_id`,`platform`),
+  KEY `team_id` (`team_id`),
+  KEY `adam_id` (`adam_id`,`platform`),
+  KEY `fk_vpp_apps_teams_vpp_token_id` (`vpp_token_id`),
+  CONSTRAINT `fk_vpp_apps_teams_vpp_token_id` FOREIGN KEY (`vpp_token_id`) REFERENCES `vpp_tokens` (`id`) ON DELETE CASCADE,
+  CONSTRAINT `vpp_apps_teams_ibfk_2` FOREIGN KEY (`team_id`) REFERENCES `teams` (`id`) ON DELETE CASCADE,
+  CONSTRAINT `vpp_apps_teams_ibfk_3` FOREIGN KEY (`adam_id`, `platform`) REFERENCES `vpp_apps` (`adam_id`, `platform`) ON DELETE CASCADE
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+/*!40101 SET character_set_client = @saved_cs_client */;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!50503 SET character_set_client = utf8mb4 */;
+CREATE TABLE `vpp_token_teams` (
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `vpp_token_id` int unsigned NOT NULL,
+  `team_id` int unsigned DEFAULT NULL,
+  `null_team_type` enum('none','allteams','noteam') CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT 'none',
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `idx_vpp_token_teams_team_id` (`team_id`),
+  KEY `fk_vpp_token_teams_vpp_token_id` (`vpp_token_id`),
+  CONSTRAINT `fk_vpp_token_teams_team_id` FOREIGN KEY (`team_id`) REFERENCES `teams` (`id`) ON DELETE CASCADE,
+  CONSTRAINT `fk_vpp_token_teams_vpp_token_id` FOREIGN KEY (`vpp_token_id`) REFERENCES `vpp_tokens` (`id`) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
+CREATE TABLE `vpp_tokens` (
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `organization_name` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `location` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `renew_at` timestamp NOT NULL,
+  `token` blob NOT NULL,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `idx_vpp_tokens_location` (`location`)
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+/*!40101 SET character_set_client = @saved_cs_client */;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `vulnerability_host_counts` (
   `cve` varchar(20) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `team_id` int(10) unsigned NOT NULL DEFAULT '0',
-  `host_count` int(10) unsigned NOT NULL DEFAULT '0',
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  UNIQUE KEY `cve_team_id` (`cve`,`team_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  `team_id` int unsigned NOT NULL DEFAULT '0',
+  `host_count` int unsigned NOT NULL DEFAULT '0',
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `global_stats` tinyint(1) NOT NULL DEFAULT '0',
+  UNIQUE KEY `cve_team_id_global_stats` (`cve`,`team_id`,`global_stats`)
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `windows_mdm_command_queue` (
-  `enrollment_id` int(10) unsigned NOT NULL,
+  `enrollment_id` int unsigned NOT NULL,
   `command_uuid` varchar(127) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`enrollment_id`,`command_uuid`),
   KEY `command_uuid` (`command_uuid`),
   CONSTRAINT `windows_mdm_command_queue_ibfk_1` FOREIGN KEY (`enrollment_id`) REFERENCES `mdm_windows_enrollments` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
@@ -1671,15 +1869,15 @@ CREATE TABLE `windows_mdm_command_queue` (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `windows_mdm_command_results` (
-  `enrollment_id` int(10) unsigned NOT NULL,
+  `enrollment_id` int unsigned NOT NULL,
   `command_uuid` varchar(127) COLLATE utf8mb4_unicode_ci NOT NULL,
   `raw_result` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,
-  `response_id` int(10) unsigned NOT NULL,
+  `response_id` int unsigned NOT NULL,
   `status_code` varchar(31) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`enrollment_id`,`command_uuid`),
   KEY `command_uuid` (`command_uuid`),
   KEY `response_id` (`response_id`),
@@ -1689,43 +1887,43 @@ CREATE TABLE `windows_mdm_command_results` (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `windows_mdm_commands` (
   `command_uuid` varchar(127) COLLATE utf8mb4_unicode_ci NOT NULL,
   `raw_command` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,
   `target_loc_uri` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`command_uuid`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `windows_mdm_responses` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `enrollment_id` int(10) unsigned NOT NULL,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `enrollment_id` int unsigned NOT NULL,
   `raw_response` mediumtext COLLATE utf8mb4_unicode_ci NOT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`),
   KEY `enrollment_id` (`enrollment_id`),
   CONSTRAINT `windows_mdm_responses_ibfk_1` FOREIGN KEY (`enrollment_id`) REFERENCES `mdm_windows_enrollments` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `windows_updates` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `host_id` int(10) unsigned NOT NULL,
-  `date_epoch` int(10) unsigned NOT NULL,
-  `kb_id` int(10) unsigned NOT NULL,
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `host_id` int unsigned NOT NULL,
+  `date_epoch` int unsigned NOT NULL,
+  `kb_id` int unsigned NOT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_unique_windows_updates` (`host_id`,`kb_id`),
   KEY `idx_update_date` (`host_id`,`date_epoch`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `wstep_cert_auth_associations` (
   `id` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `sha256` char(64) COLLATE utf8mb4_unicode_ci NOT NULL,
@@ -1735,9 +1933,9 @@ CREATE TABLE `wstep_cert_auth_associations` (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `wstep_certificates` (
-  `serial` bigint(20) unsigned NOT NULL,
+  `serial` bigint unsigned NOT NULL,
   `name` varchar(1024) COLLATE utf8mb4_unicode_ci NOT NULL,
   `not_valid_before` datetime NOT NULL,
   `not_valid_after` datetime NOT NULL,
@@ -1750,12 +1948,12 @@ CREATE TABLE `wstep_certificates` (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
-/*!40101 SET character_set_client = utf8 */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `wstep_serials` (
-  `serial` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
+  `serial` bigint unsigned NOT NULL AUTO_INCREMENT,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   PRIMARY KEY (`serial`)
-) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!50001 DROP VIEW IF EXISTS `nano_view_queue`*/;
 /*!50001 SET @saved_cs_client          = @@character_set_client */;
diff --git a/server/datastore/mysql/scripts.go b/server/datastore/mysql/scripts.go
index 67c223f01f9a..e9acb25254c9 100644
--- a/server/datastore/mysql/scripts.go
+++ b/server/datastore/mysql/scripts.go
@@ -24,7 +24,7 @@ func (ds *Datastore) NewHostScriptExecutionRequest(ctx context.Context, request
 		var err error
 		if request.ScriptContentID == 0 {
 			// then we are doing a sync execution, so create the contents first
-			scRes, err := insertScriptContents(ctx, request.ScriptContents, tx)
+			scRes, err := insertScriptContents(ctx, tx, request.ScriptContents)
 			if err != nil {
 				return err
 			}
@@ -32,12 +32,12 @@ func (ds *Datastore) NewHostScriptExecutionRequest(ctx context.Context, request
 			id, _ := scRes.LastInsertId()
 			request.ScriptContentID = uint(id)
 		}
-		res, err = newHostScriptExecutionRequest(ctx, request, tx)
+		res, err = newHostScriptExecutionRequest(ctx, tx, request)
 		return err
 	})
 }
 
-func newHostScriptExecutionRequest(ctx context.Context, request *fleet.HostScriptRequestPayload, tx sqlx.ExtContext) (*fleet.HostScriptResult, error) {
+func newHostScriptExecutionRequest(ctx context.Context, tx sqlx.ExtContext, request *fleet.HostScriptRequestPayload) (*fleet.HostScriptResult, error) {
 	const (
 		insStmt = `INSERT INTO host_script_results (host_id, execution_id, script_content_id, output, script_id, user_id, sync_request) VALUES (?, ?, ?, '', ?, ?, ?)`
 		getStmt = `SELECT hsr.id, hsr.host_id, hsr.execution_id, hsr.created_at, hsr.script_id, hsr.user_id, hsr.sync_request, sc.contents as script_contents FROM host_script_results hsr JOIN script_contents sc WHERE sc.id = hsr.script_content_id AND hsr.id = ?`
@@ -96,7 +96,8 @@ func (ds *Datastore) SetHostScriptExecutionResult(ctx context.Context, result *f
   UPDATE host_script_results SET
     output = ?,
     runtime = ?,
-    exit_code = ?
+    exit_code = ?,
+    timeout = ?
   WHERE
     host_id = ? AND
     execution_id = ?`
@@ -138,6 +139,7 @@ func (ds *Datastore) SetHostScriptExecutionResult(ctx context.Context, result *f
 			// it to a 32-bit signed integer.
 			// See /orbit/pkg/scripts/exec_windows.go
 			int32(result.ExitCode),
+			result.Timeout,
 			result.HostID,
 			result.ExecutionID,
 		)
@@ -236,6 +238,7 @@ func (ds *Datastore) getHostScriptExecutionResultDB(ctx context.Context, q sqlx.
     hsr.output,
     hsr.runtime,
     hsr.exit_code,
+    hsr.timeout,
     hsr.created_at,
     hsr.user_id,
     hsr.sync_request,
@@ -266,14 +269,14 @@ func (ds *Datastore) NewScript(ctx context.Context, script *fleet.Script) (*flee
 		var err error
 
 		// first insert script contents
-		scRes, err := insertScriptContents(ctx, script.ScriptContents, tx)
+		scRes, err := insertScriptContents(ctx, tx, script.ScriptContents)
 		if err != nil {
 			return err
 		}
 		id, _ := scRes.LastInsertId()
 
 		// then create the script entity
-		res, err = insertScript(ctx, script, uint(id), tx)
+		res, err = insertScript(ctx, tx, script, uint(id))
 		return err
 	})
 	if err != nil {
@@ -283,7 +286,7 @@ func (ds *Datastore) NewScript(ctx context.Context, script *fleet.Script) (*flee
 	return ds.getScriptDB(ctx, ds.writer(ctx), uint(id))
 }
 
-func insertScript(ctx context.Context, script *fleet.Script, scriptContentsID uint, tx sqlx.ExtContext) (sql.Result, error) {
+func insertScript(ctx context.Context, tx sqlx.ExtContext, script *fleet.Script, scriptContentsID uint) (sql.Result, error) {
 	const insertStmt = `
 INSERT INTO
   scripts (
@@ -311,7 +314,7 @@ VALUES
 	return res, nil
 }
 
-func insertScriptContents(ctx context.Context, contents string, tx sqlx.ExtContext) (sql.Result, error) {
+func insertScriptContents(ctx context.Context, tx sqlx.ExtContext, contents string) (sql.Result, error) {
 	const insertStmt = `
 INSERT INTO
   script_contents (
@@ -654,7 +657,7 @@ ON DUPLICATE KEY UPDATE
 
 		// insert the new scripts and the ones that have changed
 		for _, s := range incomingScripts {
-			scRes, err := insertScriptContents(ctx, s.ScriptContents, tx)
+			scRes, err := insertScriptContents(ctx, tx, s.ScriptContents)
 			if err != nil {
 				return ctxerr.Wrapf(ctx, err, "inserting script contents for script with name %q", s.Name)
 			}
@@ -854,7 +857,7 @@ func (ds *Datastore) LockHostViaScript(ctx context.Context, request *fleet.HostS
 	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
 		var err error
 
-		scRes, err := insertScriptContents(ctx, request.ScriptContents, tx)
+		scRes, err := insertScriptContents(ctx, tx, request.ScriptContents)
 		if err != nil {
 			return err
 		}
@@ -862,7 +865,7 @@ func (ds *Datastore) LockHostViaScript(ctx context.Context, request *fleet.HostS
 		id, _ := scRes.LastInsertId()
 		request.ScriptContentID = uint(id)
 
-		res, err = newHostScriptExecutionRequest(ctx, request, tx)
+		res, err = newHostScriptExecutionRequest(ctx, tx, request)
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "lock host via script create execution")
 		}
@@ -904,7 +907,7 @@ func (ds *Datastore) UnlockHostViaScript(ctx context.Context, request *fleet.Hos
 	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
 		var err error
 
-		scRes, err := insertScriptContents(ctx, request.ScriptContents, tx)
+		scRes, err := insertScriptContents(ctx, tx, request.ScriptContents)
 		if err != nil {
 			return err
 		}
@@ -912,7 +915,7 @@ func (ds *Datastore) UnlockHostViaScript(ctx context.Context, request *fleet.Hos
 		id, _ := scRes.LastInsertId()
 		request.ScriptContentID = uint(id)
 
-		res, err = newHostScriptExecutionRequest(ctx, request, tx)
+		res, err = newHostScriptExecutionRequest(ctx, tx, request)
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "unlock host via script create execution")
 		}
@@ -955,7 +958,7 @@ func (ds *Datastore) WipeHostViaScript(ctx context.Context, request *fleet.HostS
 	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
 		var err error
 
-		scRes, err := insertScriptContents(ctx, request.ScriptContents, tx)
+		scRes, err := insertScriptContents(ctx, tx, request.ScriptContents)
 		if err != nil {
 			return err
 		}
@@ -963,7 +966,7 @@ func (ds *Datastore) WipeHostViaScript(ctx context.Context, request *fleet.HostS
 		id, _ := scRes.LastInsertId()
 		request.ScriptContentID = uint(id)
 
-		res, err = newHostScriptExecutionRequest(ctx, request, tx)
+		res, err = newHostScriptExecutionRequest(ctx, tx, request)
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "wipe host via script create execution")
 		}
diff --git a/server/datastore/mysql/scripts_test.go b/server/datastore/mysql/scripts_test.go
index 0dbb22e1f4d3..5543a7661d2e 100644
--- a/server/datastore/mysql/scripts_test.go
+++ b/server/datastore/mysql/scripts_test.go
@@ -93,6 +93,7 @@ func testHostScriptResult(t *testing.T, ds *Datastore) {
 		Output:      "foo",
 		Runtime:     2,
 		ExitCode:    0,
+		Timeout:     300,
 	})
 	require.NoError(t, err)
 
@@ -103,6 +104,7 @@ func testHostScriptResult(t *testing.T, ds *Datastore) {
 		Output:      "foobarbaz",
 		Runtime:     22,
 		ExitCode:    1,
+		Timeout:     360,
 	})
 	require.NoError(t, err)
 	require.Nil(t, hsr)
@@ -119,6 +121,7 @@ func testHostScriptResult(t *testing.T, ds *Datastore) {
 	expectScript.Output = "foo"
 	expectScript.Runtime = 2
 	expectScript.ExitCode = ptr.Int64(0)
+	expectScript.Timeout = ptr.Int(300)
 	require.Equal(t, &expectScript, script)
 
 	// create another script execution request (null user id this time)
@@ -166,6 +169,7 @@ func testHostScriptResult(t *testing.T, ds *Datastore) {
 		Output:      largeOutput,
 		Runtime:     10,
 		ExitCode:    1,
+		Timeout:     300,
 	})
 	require.NoError(t, err)
 
@@ -240,6 +244,7 @@ func testHostScriptResult(t *testing.T, ds *Datastore) {
 		Output:      "foo",
 		Runtime:     1,
 		ExitCode:    math.MaxUint32,
+		Timeout:     300,
 	})
 	require.NoError(t, err)
 	require.EqualValues(t, -1, *unsignedScriptResult.ExitCode)
@@ -1097,14 +1102,14 @@ type scriptContents struct {
 func testInsertScriptContents(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 	contents := `echo foobar;`
-	res, err := insertScriptContents(ctx, contents, ds.writer(ctx))
+	res, err := insertScriptContents(ctx, ds.writer(ctx), contents)
 	require.NoError(t, err)
 	id, _ := res.LastInsertId()
 	require.Equal(t, int64(1), id)
 	expectedCS := md5ChecksumScriptContent(contents)
 
 	// insert same contents again, verify that the checksum and ID stayed the same
-	res, err = insertScriptContents(ctx, contents, ds.writer(ctx))
+	res, err = insertScriptContents(ctx, ds.writer(ctx), contents)
 	require.NoError(t, err)
 	id, _ = res.LastInsertId()
 	require.Equal(t, int64(1), id)
@@ -1133,6 +1138,8 @@ func testCleanupUnusedScriptContents(t *testing.T, ds *Datastore) {
 	s, err := ds.NewScript(ctx, s)
 	require.NoError(t, err)
 
+	user1 := test.NewUser(t, ds, "Bob", "bob@example.com", true)
+
 	// create a sync script execution
 	res, err := ds.NewHostScriptExecutionRequest(ctx, &fleet.HostScriptRequestPayload{ScriptContents: "echo something_else", SyncRequest: true})
 	require.NoError(t, err)
@@ -1148,6 +1155,7 @@ func testCleanupUnusedScriptContents(t *testing.T, ds *Datastore) {
 		Title:             "file1",
 		Version:           "1.0",
 		Source:            "apps",
+		UserID:            user1.ID,
 	})
 	require.NoError(t, err)
 
@@ -1202,6 +1210,7 @@ func testCleanupUnusedScriptContents(t *testing.T, ds *Datastore) {
 		Title:           "file1",
 		Version:         "1.0",
 		Source:          "apps",
+		UserID:          user1.ID,
 	})
 	require.NoError(t, err)
 
diff --git a/server/datastore/mysql/software.go b/server/datastore/mysql/software.go
index b3c89b903d9f..4826e0cebaeb 100644
--- a/server/datastore/mysql/software.go
+++ b/server/datastore/mysql/software.go
@@ -3,7 +3,6 @@ package mysql
 import (
 	"context"
 	"crypto/md5" //nolint:gosec // This hash is used as a DB optimization for software row lookup, not security
-	"database/sql"
 	"encoding/hex"
 	"fmt"
 	"sort"
@@ -368,6 +367,10 @@ func (ds *Datastore) applyChangesForNewSoftwareDB(
 			}
 			r.Inserted = inserted
 
+			if err = checkForDeletedInstalledSoftware(ctx, tx, deleted, inserted, hostID); err != nil {
+				return err
+			}
+
 			if err = updateModifiedHostSoftwareDB(ctx, tx, hostID, current, incoming, ds.minLastOpenedAtDiff); err != nil {
 				return err
 			}
@@ -384,6 +387,75 @@ func (ds *Datastore) applyChangesForNewSoftwareDB(
 	return r, err
 }
 
+func checkForDeletedInstalledSoftware(ctx context.Context, tx sqlx.ExtContext, deleted []fleet.Software, inserted []fleet.Software,
+	hostID uint) error {
+	// Between deleted and inserted software, check which software titles were deleted.
+	// If software titles were deleted, get the software titles of the installed software.
+	// See if deleted titles match installed software titles.
+	// If so, mark the installed software as removed.
+	var deletedTitles map[string]struct{}
+	if len(deleted) > 0 {
+		deletedTitles = make(map[string]struct{}, len(deleted))
+		for _, d := range deleted {
+			// We don't support installing browser plugins as of 2024/08/22
+			if d.Browser == "" {
+				deletedTitles[UniqueSoftwareTitleStr(d.Name, d.Source, d.BundleIdentifier)] = struct{}{}
+			}
+		}
+		for _, i := range inserted {
+			// We don't support installing browser plugins as of 2024/08/22
+			if i.Browser == "" {
+				key := UniqueSoftwareTitleStr(i.Name, i.Source, i.BundleIdentifier)
+				if _, ok := deletedTitles[key]; ok {
+					delete(deletedTitles, key)
+				}
+			}
+		}
+	}
+	if len(deletedTitles) > 0 {
+		installedTitles, err := getInstalledByFleetSoftwareTitles(ctx, tx, hostID)
+		if err != nil {
+			return err
+		}
+		type deletedValue struct {
+			vpp bool
+		}
+		deletedTitleIDs := make(map[uint]deletedValue, 0)
+		for _, title := range installedTitles {
+			bundleIdentifier := ""
+			if title.BundleIdentifier != nil {
+				bundleIdentifier = *title.BundleIdentifier
+			}
+			key := UniqueSoftwareTitleStr(title.Name, title.Source, bundleIdentifier)
+			if _, ok := deletedTitles[key]; ok {
+				deletedTitleIDs[title.ID] = deletedValue{vpp: title.VPPAppsCount > 0}
+			}
+		}
+		if len(deletedTitleIDs) > 0 {
+			IDs := make([]uint, 0, len(deletedTitleIDs))
+			vppIDs := make([]uint, 0, len(deletedTitleIDs))
+			for id, value := range deletedTitleIDs {
+				if value.vpp {
+					vppIDs = append(vppIDs, id)
+				} else {
+					IDs = append(IDs, id)
+				}
+			}
+			if len(IDs) > 0 {
+				if err = markHostSoftwareInstallsRemoved(ctx, tx, hostID, IDs); err != nil {
+					return err
+				}
+			}
+			if len(vppIDs) > 0 {
+				if err = markHostVPPSoftwareInstallsRemoved(ctx, tx, hostID, vppIDs); err != nil {
+					return err
+				}
+			}
+		}
+	}
+	return nil
+}
+
 func (ds *Datastore) getExistingSoftware(
 	ctx context.Context, current map[string]fleet.Software, incoming map[string]fleet.Software,
 ) (
@@ -619,25 +691,39 @@ func (ds *Datastore) insertNewInstalledHostSoftwareDB(
 					return nil, ctxerr.Wrap(ctx, err, "insert software_titles")
 				}
 
+				updateSoftwareWithoutIdentifierStmt := `
+				    UPDATE software s
+				    JOIN software_titles st
+				    ON COALESCE(s.bundle_identifier, '') = '' AND s.name = st.name AND s.source = st.source AND s.browser = st.browser
+				    SET s.title_id = st.id
+				    WHERE (s.title_id IS NULL OR s.title_id != st.id)
+				    AND COALESCE(s.bundle_identifier, '') = ''
+				    AND s.checksum IN (?)
+				    `
+				updateSoftwareWithoutIdentifierStmt, updateArgs, err := sqlx.In(updateSoftwareWithoutIdentifierStmt, titleChecksums)
+				if err != nil {
+					return nil, ctxerr.Wrap(ctx, err, "build update software title_id without identifier")
+				}
+				if _, err = tx.ExecContext(ctx, updateSoftwareWithoutIdentifierStmt, updateArgs...); err != nil {
+					return nil, ctxerr.Wrap(ctx, err, "update software title_id without identifier")
+				}
+
 				// update new title ids for new software table entries
 				updateSoftwareStmt := `
-				UPDATE
-					software s,
-					software_titles st
-				SET
-					s.title_id = st.id
-				WHERE
-				         s.bundle_identifier = st.bundle_identifier OR (
-					   s.bundle_identifier = '' AND
-					   (s.name, s.source, s.browser) = (st.name, st.source, st.browser)
-					 )
-					AND s.checksum IN (?)`
-				updateSoftwareStmt, updateArgs, err := sqlx.In(updateSoftwareStmt, titleChecksums)
+				      UPDATE software s
+				      JOIN software_titles st
+				      ON s.bundle_identifier = st.bundle_identifier AND
+				          IF(s.source IN ('apps', 'ios_apps', 'ipados_apps'), s.source = st.source, 1)
+				      SET s.title_id = st.id
+				      WHERE s.title_id IS NULL
+				      OR s.title_id != st.id
+				      AND s.checksum IN (?)`
+				updateSoftwareStmt, updateArgs, err = sqlx.In(updateSoftwareStmt, titleChecksums)
 				if err != nil {
-					return nil, ctxerr.Wrap(ctx, err, "build update software title_id")
+					return nil, ctxerr.Wrap(ctx, err, "build update software title_id with identifier")
 				}
 				if _, err = tx.ExecContext(ctx, updateSoftwareStmt, updateArgs...); err != nil {
-					return nil, ctxerr.Wrap(ctx, err, "update software title_id")
+					return nil, ctxerr.Wrap(ctx, err, "update software title_id with identifier")
 				}
 			}
 		}
@@ -725,7 +811,7 @@ func updateModifiedHostSoftwareDB(
 			continue
 		}
 
-		if curSw.LastOpenedAt == nil || (*newSw.LastOpenedAt).Sub(*curSw.LastOpenedAt) >= minLastOpenedAtDiff {
+		if curSw.LastOpenedAt == nil || newSw.LastOpenedAt.Sub(*curSw.LastOpenedAt) >= minLastOpenedAtDiff {
 			keysToUpdate = append(keysToUpdate, key)
 		}
 	}
@@ -923,12 +1009,31 @@ func selectSoftwareSQL(opts fleet.SoftwareListOptions) (string, []interface{}, e
 			GroupByAppend(
 				"shc.hosts_count",
 				"shc.updated_at",
+				"shc.global_stats",
+				"shc.team_id",
 			)
 
-		if opts.TeamID != nil {
-			ds = ds.Where(goqu.I("shc.team_id").Eq(opts.TeamID))
+		if opts.TeamID == nil {
+			ds = ds.Where(
+				goqu.And(
+					goqu.I("shc.team_id").Eq(0),
+					goqu.I("shc.global_stats").Eq(1),
+				),
+			)
+		} else if *opts.TeamID == 0 {
+			ds = ds.Where(
+				goqu.And(
+					goqu.I("shc.team_id").Eq(0),
+					goqu.I("shc.global_stats").Eq(0),
+				),
+			)
 		} else {
-			ds = ds.Where(goqu.I("shc.team_id").Eq(0))
+			ds = ds.Where(
+				goqu.And(
+					goqu.I("shc.team_id").Eq(*opts.TeamID),
+					goqu.I("shc.global_stats").Eq(0),
+				),
+			)
 		}
 	}
 
@@ -947,19 +1052,46 @@ func selectSoftwareSQL(opts fleet.SoftwareListOptions) (string, []interface{}, e
 	}
 
 	if opts.IncludeCVEScores {
-		ds = ds.
-			LeftJoin(
+
+		baseJoinConditions := goqu.Ex{
+			"c.cve": goqu.I("scv.cve"),
+		}
+
+		if opts.KnownExploit || opts.MinimumCVSS > 0 || opts.MaximumCVSS > 0 {
+
+			if opts.KnownExploit {
+				baseJoinConditions["c.cisa_known_exploit"] = true
+			}
+
+			if opts.MinimumCVSS > 0 {
+				baseJoinConditions["c.cvss_score"] = goqu.Op{"gte": opts.MinimumCVSS}
+			}
+
+			if opts.MaximumCVSS > 0 {
+				baseJoinConditions["c.cvss_score"] = goqu.Op{"lte": opts.MaximumCVSS}
+			}
+
+			ds = ds.InnerJoin(
 				goqu.I("cve_meta").As("c"),
-				goqu.On(goqu.I("c.cve").Eq(goqu.I("scv.cve"))),
-			).
-			SelectAppend(
-				goqu.MAX("c.cvss_score").As("cvss_score"),                     // for ordering
-				goqu.MAX("c.epss_probability").As("epss_probability"),         // for ordering
-				goqu.MAX("c.cisa_known_exploit").As("cisa_known_exploit"),     // for ordering
-				goqu.MAX("c.published").As("cve_published"),                   // for ordering
-				goqu.MAX("c.description").As("description"),                   // for ordering
-				goqu.MAX("scv.resolved_in_version").As("resolved_in_version"), // for ordering
+				goqu.On(baseJoinConditions),
 			)
+
+		} else {
+			ds = ds.
+				LeftJoin(
+					goqu.I("cve_meta").As("c"),
+					goqu.On(baseJoinConditions),
+				)
+		}
+
+		ds = ds.SelectAppend(
+			goqu.MAX("c.cvss_score").As("cvss_score"),                     // for ordering
+			goqu.MAX("c.epss_probability").As("epss_probability"),         // for ordering
+			goqu.MAX("c.cisa_known_exploit").As("cisa_known_exploit"),     // for ordering
+			goqu.MAX("c.published").As("cve_published"),                   // for ordering
+			goqu.MAX("c.description").As("description"),                   // for ordering
+			goqu.MAX("scv.resolved_in_version").As("resolved_in_version"), // for ordering
+		)
 	}
 
 	if match := opts.ListOptions.MatchQuery; match != "" {
@@ -1262,6 +1394,12 @@ func (ds *Datastore) ListSoftwareCPEs(ctx context.Context) ([]fleet.SoftwareCPE,
 }
 
 func (ds *Datastore) ListSoftware(ctx context.Context, opt fleet.SoftwareListOptions) ([]fleet.Software, *fleet.PaginationMetadata, error) {
+	if !opt.VulnerableOnly && (opt.MinimumCVSS > 0 || opt.MaximumCVSS > 0 || opt.KnownExploit) {
+		return nil, nil, fleet.NewInvalidArgumentError(
+			"query", "min_cvss_score, max_cvss_score, and exploit can only be provided with vulnerable=true",
+		)
+	}
+
 	software, err := listSoftwareDB(ctx, ds.reader(ctx), opt)
 	if err != nil {
 		return nil, nil, err
@@ -1348,6 +1486,8 @@ func (ds *Datastore) SoftwareByID(ctx context.Context, id uint, teamID *uint, in
 			goqu.On(goqu.I("s.id").Eq(goqu.I("scv.software_id"))),
 		)
 
+	// join only on software_id as we'll need counts for all teams
+	// to filter down to the team's the user has access to
 	if tmFilter != nil {
 		q = q.LeftJoin(
 			goqu.I("software_host_counts").As("shc"),
@@ -1380,7 +1520,7 @@ func (ds *Datastore) SoftwareByID(ctx context.Context, id uint, teamID *uint, in
 		// However, it is possible that the software was deleted from all hosts after the last host count update.
 		q = q.Where(
 			goqu.L(
-				"EXISTS (SELECT 1 FROM software_host_counts WHERE software_id = ? AND team_id = ? AND hosts_count > 0)", id, *teamID,
+				"EXISTS (SELECT 1 FROM software_host_counts WHERE software_id = ? AND team_id = ? AND hosts_count > 0 AND global_stats = 0)", id, *teamID,
 			),
 		)
 	}
@@ -1449,29 +1589,37 @@ func (ds *Datastore) SyncHostsSoftware(ctx context.Context, updatedAt time.Time)
 		// team_id is added to the select list to have the same structure as
 		// the teamCountsStmt, making it easier to use a common implementation
 		globalCountsStmt = `
-      SELECT count(*), 0 as team_id, software_id
+      SELECT count(*), 0 as team_id, software_id, 1 as global_stats
       FROM host_software
       WHERE software_id > ? AND software_id <= ?
       GROUP BY software_id`
 
 		teamCountsStmt = `
-      SELECT count(*), h.team_id, hs.software_id
+      SELECT count(*), h.team_id, hs.software_id, 0 as global_stats
       FROM host_software hs
       INNER JOIN hosts h
       ON hs.host_id = h.id
       WHERE h.team_id IS NOT NULL AND hs.software_id > ? AND hs.software_id <= ?
       GROUP BY hs.software_id, h.team_id`
 
+		noTeamCountsStmt = `
+      SELECT count(*), 0 as team_id, software_id, 0 as global_stats
+      FROM host_software hs
+      INNER JOIN hosts h
+      ON hs.host_id = h.id
+      WHERE h.team_id IS NULL AND hs.software_id > ? AND hs.software_id <= ?
+      GROUP BY hs.software_id`
+
 		insertStmt = `
       INSERT INTO software_host_counts
-        (software_id, hosts_count, team_id, updated_at)
+        (software_id, hosts_count, team_id, global_stats, updated_at)
       VALUES
         %s
       ON DUPLICATE KEY UPDATE
         hosts_count = VALUES(hosts_count),
         updated_at = VALUES(updated_at)`
 
-		valuesPart = `(?, ?, ?, ?),`
+		valuesPart = `(?, ?, ?, ?, ?),`
 
 		// We must ensure that software is not in host_software table before deleting it.
 		// This prevents a race condition where a host just added the software, but it is not part of software_host_counts yet.
@@ -1529,8 +1677,8 @@ func (ds *Datastore) SyncHostsSoftware(ctx context.Context, updatedAt time.Time)
 	for minSoftwareID, maxSoftwareID := minMax.Min-1, minMax.Min-1+countHostSoftwareBatchSize; minSoftwareID < minMax.Max; minSoftwareID, maxSoftwareID = maxSoftwareID, maxSoftwareID+countHostSoftwareBatchSize {
 
 		// next get a cursor for the global and team counts for each software
-		stmtLabel := []string{"global", "team"}
-		for i, countStmt := range []string{globalCountsStmt, teamCountsStmt} {
+		stmtLabel := []string{"global", "team", "noteam"}
+		for i, countStmt := range []string{globalCountsStmt, teamCountsStmt, noTeamCountsStmt} {
 			rows, err := db.QueryContext(ctx, countStmt, minSoftwareID, maxSoftwareID)
 			if err != nil {
 				return ctxerr.Wrapf(ctx, err, "read %s counts from host_software", stmtLabel[i])
@@ -1545,16 +1693,17 @@ func (ds *Datastore) SyncHostsSoftware(ctx context.Context, updatedAt time.Time)
 			args := make([]interface{}, 0, batchSize*4)
 			for rows.Next() {
 				var (
-					count  int
-					teamID uint
-					sid    uint
+					count        int
+					teamID       uint
+					sid          uint
+					global_stats bool
 				)
 
-				if err := rows.Scan(&count, &teamID, &sid); err != nil {
+				if err := rows.Scan(&count, &teamID, &sid, &global_stats); err != nil {
 					return ctxerr.Wrapf(ctx, err, "scan %s row into variables", stmtLabel[i])
 				}
 
-				args = append(args, sid, count, teamID, updatedAt)
+				args = append(args, sid, count, teamID, global_stats, updatedAt)
 				batchCount++
 
 				if batchCount == batchSize {
@@ -1621,7 +1770,8 @@ FROM (
     WHERE
         NOT EXISTS (
             SELECT 1 FROM software_titles st
-            WHERE s.bundle_identifier = st.bundle_identifier
+            WHERE s.bundle_identifier = st.bundle_identifier AND
+				IF(s.source IN ('apps', 'ios_apps', 'ipados_apps'), s.source = st.source, 1)
         )
         AND COALESCE(bundle_identifier, '') != ''
 
@@ -1652,30 +1802,46 @@ ON DUPLICATE KEY UPDATE
 		level.Debug(ds.logger).Log("msg", "upsert software titles", "rows_affected", n)
 
 		// update title ids for software table entries
-		updateSoftwareStmt := `
+		updateSoftwareWithoutIdentifierStmt := `
 UPDATE software s
 JOIN software_titles st
-ON (
-    s.bundle_identifier = st.bundle_identifier
-    OR (COALESCE(s.bundle_identifier, '') = '' AND (s.name, s.source, s.browser) = (st.name, st.source, st.browser))
-)
+ON COALESCE(s.bundle_identifier, '') = '' AND s.name = st.name AND s.source = st.source AND s.browser = st.browser
+SET s.title_id = st.id
+WHERE (s.title_id IS NULL OR s.title_id != st.id)
+AND COALESCE(s.bundle_identifier, '') = '';
+`
+
+		res, err = tx.ExecContext(ctx, updateSoftwareWithoutIdentifierStmt)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "update software title_id without bundle identifier")
+		}
+		n, _ = res.RowsAffected()
+		level.Debug(ds.logger).Log("msg", "update software title_id without bundle identifier", "rows_affected", n)
+
+		updateSoftwareWithIdentifierStmt := `
+UPDATE software s
+JOIN software_titles st
+ON s.bundle_identifier = st.bundle_identifier AND
+    IF(s.source IN ('apps', 'ios_apps', 'ipados_apps'), s.source = st.source, 1)
 SET s.title_id = st.id
 WHERE s.title_id IS NULL
 OR s.title_id != st.id;
 `
 
-		res, err = tx.ExecContext(ctx, updateSoftwareStmt)
+		res, err = tx.ExecContext(ctx, updateSoftwareWithIdentifierStmt)
 		if err != nil {
-			return ctxerr.Wrap(ctx, err, "update software title_id")
+			return ctxerr.Wrap(ctx, err, "update software title_id with bundle identifier")
 		}
 		n, _ = res.RowsAffected()
-		level.Debug(ds.logger).Log("msg", "update software title_id", "rows_affected", n)
+		level.Debug(ds.logger).Log("msg", "update software title_id with bundle identifier", "rows_affected", n)
 
 		// clean up orphaned software titles
 		cleanupStmt := `
 DELETE st FROM software_titles st
 	LEFT JOIN software s ON s.title_id = st.id
-	WHERE s.title_id IS NULL AND NOT EXISTS (SELECT 1 FROM software_installers si WHERE si.title_id = st.id)`
+	WHERE s.title_id IS NULL AND
+		NOT EXISTS (SELECT 1 FROM software_installers si WHERE si.title_id = st.id) AND
+		NOT EXISTS (SELECT 1 FROM vpp_apps vap WHERE vap.title_id = st.id)`
 
 		res, err = tx.ExecContext(ctx, cleanupStmt)
 		if err != nil {
@@ -1854,7 +2020,7 @@ func (ds *Datastore) InsertSoftwareVulnerability(
 		return false, ctxerr.Wrap(ctx, err, "insert software vulnerability")
 	}
 
-	return insertOnDuplicateDidInsert(res), nil
+	return insertOnDuplicateDidInsertOrUpdate(res), nil
 }
 
 func (ds *Datastore) ListSoftwareVulnerabilitiesByHostIDsSource(
@@ -1914,16 +2080,16 @@ func (ds *Datastore) ListSoftwareForVulnDetection(
 	var args []interface{}
 
 	baseSQL := `
-		SELECT 
+		SELECT
 			s.id,
 			s.name,
 			s.version,
 			s.release,
 			s.arch,
 			COALESCE(cpe.cpe, '') AS generated_cpe
-		FROM 
+		FROM
 			software s
-		LEFT JOIN 
+		LEFT JOIN
 			software_cpe cpe ON s.id = cpe.software_id
 	`
 
@@ -1989,7 +2155,7 @@ func (ds *Datastore) ListCVEs(ctx context.Context, maxAge time.Duration) ([]flee
 	return result, nil
 }
 
-// tblAlias is the table alias to use as prefix for the host_script_installs
+// tblAlias is the table alias to use as prefix for the host_software_installs
 // column names, no prefix used if empty.
 // colAlias is the name to be assigned to the computed status column, pass
 // empty to have the value only, no column alias set.
@@ -2005,6 +2171,8 @@ func softwareInstallerHostStatusNamedQuery(tblAlias, colAlias string) string {
 	// and none for the post-install, it is because there is no post-install.
 	return fmt.Sprintf(`
 			CASE
+				WHEN %[1]sremoved = 1 THEN NULL
+
 				WHEN %[1]spost_install_script_exit_code IS NOT NULL AND
 					%[1]spost_install_script_exit_code = 0 THEN :software_status_installed
 
@@ -2029,7 +2197,7 @@ func softwareInstallerHostStatusNamedQuery(tblAlias, colAlias string) string {
 func (ds *Datastore) ListHostSoftware(ctx context.Context, host *fleet.Host, opts fleet.HostSoftwareTitleListOptions) ([]*fleet.HostSoftwareWithInstaller, *fleet.PaginationMetadata, error) {
 	var onlySelfServiceClause string
 	if opts.SelfServiceOnly {
-		onlySelfServiceClause = ` AND si.self_service = 1 `
+		onlySelfServiceClause = ` AND ( si.self_service = 1 OR vat.self_service = 1 ) `
 	}
 
 	var onlyVulnerableClause string
@@ -2039,68 +2207,108 @@ AND EXISTS (SELECT 1 FROM software s JOIN software_cve scve ON scve.software_id
 		`
 	}
 
+	softwareIsInstalledOnHostClause := `
+			EXISTS (
+				SELECT 1
+				FROM
+					host_software hs
+				INNER JOIN
+					software s ON hs.software_id = s.id
+				WHERE
+					hs.host_id = :host_id AND
+					s.title_id = st.id
+			) OR `
+	if opts.OnlyAvailableForInstall {
+		// Get software that has a package/VPP installer but was not installed with Fleet
+		softwareIsInstalledOnHostClause = ` status IS NULL AND (si.id IS NOT NULL OR vat.adam_id IS NOT NULL) AND ` + softwareIsInstalledOnHostClause
+	}
+
+	// this statement lists only the software that is reported as installed on
+	// the host or has been attempted to be installed on the host.
 	stmtInstalled := fmt.Sprintf(`
 		SELECT
 			st.id,
 			st.name,
 			st.source,
-			si.self_service as self_service,
-			si.filename as package_available_for_install,
+			si.self_service as package_self_service,
+			si.filename as package_name,
 			si.version as package_version,
-			hsi.created_at as last_install_installed_at,
-			hsi.execution_id as last_install_install_uuid,
-			%s,
-			si.id AS installer_id -- NULL if no Fleet installer
+			vat.self_service as vpp_app_self_service,
+			vat.adam_id as vpp_app_adam_id,
+			vap.latest_version as vpp_app_version,
+			NULLIF(vap.icon_url, '') as vpp_app_icon_url,
+			COALESCE(hsi.created_at, hvsi.created_at) as last_install_installed_at,
+			COALESCE(hsi.execution_id, hvsi.command_uuid) as last_install_install_uuid,
+			-- get either the softare installer status or the vpp app status
+			COALESCE(%s, %s) as status
 		FROM
 			software_titles st
 		LEFT OUTER JOIN
-			software_installers si ON st.id = si.title_id
+			software_installers si ON st.id = si.title_id AND si.global_or_team_id = :global_or_team_id
 		LEFT OUTER JOIN
-			host_software_installs hsi ON si.id = hsi.software_installer_id AND hsi.host_id = :host_id
+			host_software_installs hsi ON si.id = hsi.software_installer_id AND hsi.host_id = :host_id AND hsi.removed = 0
+		LEFT OUTER JOIN
+			vpp_apps vap ON st.id = vap.title_id AND vap.platform = :host_platform
+		LEFT OUTER JOIN
+			vpp_apps_teams vat ON vap.adam_id = vat.adam_id AND vap.platform = vat.platform AND vat.global_or_team_id = :global_or_team_id
+		LEFT OUTER JOIN
+			host_vpp_software_installs hvsi ON vat.adam_id = hvsi.adam_id AND hvsi.host_id = :host_id AND hvsi.removed = 0
+		LEFT OUTER JOIN
+			nano_command_results ncr ON ncr.command_uuid = hvsi.command_uuid
 		WHERE
-			-- use the latest install only
+			-- use the latest install attempt only
 			( hsi.id IS NULL OR hsi.id = (
 				SELECT hsi2.id
 				FROM host_software_installs hsi2
-				WHERE hsi2.host_id = hsi.host_id AND hsi2.software_installer_id = hsi.software_installer_id
+				WHERE hsi2.host_id = hsi.host_id AND hsi2.software_installer_id = hsi.software_installer_id AND hsi2.removed = 0
 				ORDER BY hsi2.created_at DESC
 				LIMIT 1 ) ) AND
-			-- software is installed on host
-			( EXISTS (
-				SELECT 1
-				FROM
-					host_software hs
-				INNER JOIN
-					software s ON hs.software_id = s.id
-				WHERE
-					hs.host_id = :host_id AND
-					s.title_id = st.id
-			) OR
-			-- or software install has been attempted on host
-			hsi.host_id IS NOT NULL )
+			( hvsi.id IS NULL OR hvsi.id = (
+				SELECT hvsi2.id
+				FROM host_vpp_software_installs hvsi2
+				WHERE hvsi2.host_id = hvsi.host_id AND hvsi2.adam_id = hvsi.adam_id AND hvsi2.platform = hvsi.platform AND hvsi2.removed = 0
+				ORDER BY hvsi2.created_at DESC
+				LIMIT 1 ) ) AND
+
+			-- software is installed on host or software install has been attempted
+			-- on host (via installer or VPP app). If only available for install is
+			-- requested, then the software installed on host clause is empty.
+			( %s hsi.host_id IS NOT NULL OR hvsi.host_id IS NOT NULL )
 			%s
 			%s
-`, softwareInstallerHostStatusNamedQuery("hsi", "status"), onlySelfServiceClause, onlyVulnerableClause)
+`, softwareInstallerHostStatusNamedQuery("hsi", ""), vppAppHostStatusNamedQuery("hvsi", "ncr", ""),
+		softwareIsInstalledOnHostClause, onlySelfServiceClause, onlyVulnerableClause)
 
-	const stmtAvailable = `
+	// this statement lists only the software that has never been installed nor
+	// attempted to be installed on the host, but that is available to be
+	// installed on the host's platform.
+	stmtAvailable := fmt.Sprintf(`
 		SELECT
 			st.id,
 			st.name,
 			st.source,
-			si.self_service as self_service,
-			si.filename as package_available_for_install,
+			si.self_service as package_self_service,
+			si.filename as package_name,
 			si.version as package_version,
+			vat.self_service as vpp_app_self_service,
+			vat.adam_id as vpp_app_adam_id,
+			vap.latest_version as vpp_app_version,
+			NULLIF(vap.icon_url, '') as vpp_app_icon_url,
 			NULL as last_install_installed_at,
 			NULL as last_install_install_uuid,
-			NULL as status,
-			si.id as installer_id
+			NULL as status
 		FROM
 			software_titles st
-		INNER JOIN
+		LEFT OUTER JOIN
 			-- filter out software that is not available for install on the host's platform
-			software_installers si ON st.id = si.title_id AND si.platform IN(%s)
+			software_installers si ON st.id = si.title_id AND si.platform IN (:host_compatible_platforms) AND si.global_or_team_id = :global_or_team_id
+		LEFT OUTER JOIN
+			-- include VPP apps only if the host is on a supported platform
+			vpp_apps vap ON st.id = vap.title_id AND :host_platform IN (:vpp_apps_platforms)
+		LEFT OUTER JOIN
+			vpp_apps_teams vat ON vap.adam_id = vat.adam_id AND vap.platform = vat.platform AND vat.global_or_team_id = :global_or_team_id
 		WHERE
-			-- software is not installed on host, but is available in host's team
+			-- software is not installed on host (but is available in host's team)
 			NOT EXISTS (
 				SELECT 1
 				FROM
@@ -2108,7 +2316,7 @@ AND EXISTS (SELECT 1 FROM software s JOIN software_cve scve ON scve.software_id
 				INNER JOIN
 					software s ON hs.software_id = s.id
 				WHERE
-					hs.host_id = ? AND
+					hs.host_id = :host_id AND
 					s.title_id = st.id
 			) AND
 			-- sofware install has not been attempted on host
@@ -2117,50 +2325,79 @@ AND EXISTS (SELECT 1 FROM software s JOIN software_cve scve ON scve.software_id
 				FROM
 					host_software_installs hsi
 				WHERE
-					hsi.host_id = ? AND
-					hsi.software_installer_id = si.id
+					hsi.host_id = :host_id AND
+					hsi.software_installer_id = si.id AND
+					hsi.removed = 0
 			) AND
-			si.global_or_team_id = (SELECT COALESCE(h.team_id, 0) FROM hosts h WHERE h.id = ?)
+			NOT EXISTS (
+				SELECT 1
+				FROM
+					host_vpp_software_installs hvsi
+				WHERE
+					hvsi.host_id = :host_id AND
+					hvsi.adam_id = vat.adam_id AND
+					hvsi.removed = 0
+			) AND
+			-- either the software installer or the vpp app exists for the host's team
+			( si.id IS NOT NULL OR vat.platform = :host_platform )
 			%s
-`
+`, onlySelfServiceClause)
 
+	// this is the top-level SELECT of fields from the UNION of the sub-selects
+	// (stmtAvailable and stmtInstalled).
 	const selectColNames = `
 	SELECT
 		id,
 		name,
 		source,
-		self_service,
-		package_available_for_install,
+		package_self_service,
+		package_name,
 		package_version,
+		vpp_app_self_service,
+		vpp_app_adam_id,
+		vpp_app_version,
+		vpp_app_icon_url,
 		last_install_installed_at,
 		last_install_install_uuid,
 		status
 `
 
-	// must resolve the named bindings here, before adding the stmtAvailable and searchLike which
-	// uses standard placeholders.
-	stmt, args, err := sqlx.Named(stmtInstalled, map[string]any{
+	var globalOrTeamID uint
+	if host.TeamID != nil {
+		globalOrTeamID = *host.TeamID
+	}
+	namedArgs := map[string]any{
 		"host_id":                   host.ID,
+		"host_platform":             host.FleetPlatform(),
 		"software_status_failed":    fleet.SoftwareInstallerFailed,
 		"software_status_pending":   fleet.SoftwareInstallerPending,
 		"software_status_installed": fleet.SoftwareInstallerInstalled,
-	})
-	if err != nil {
-		return nil, nil, ctxerr.Wrap(ctx, err, "build named query for list host software")
+		"mdm_status_acknowledged":   fleet.MDMAppleStatusAcknowledged,
+		"mdm_status_error":          fleet.MDMAppleStatusError,
+		"mdm_status_format_error":   fleet.MDMAppleStatusCommandFormatError,
+		"global_or_team_id":         globalOrTeamID,
 	}
 
-	if opts.IncludeAvailableForInstall && !opts.VulnerableOnly {
-		platformArgs := []string{host.Platform}
+	stmt := stmtInstalled
+	if opts.OnlyAvailableForInstall || (opts.IncludeAvailableForInstall && !opts.VulnerableOnly) {
+		namedArgs["vpp_apps_platforms"] = fleet.VPPAppsPlatforms
 		if fleet.IsLinux(host.Platform) {
-			platformArgs = fleet.HostLinuxOSs
-		}
-		placeholders := ""
-		for _, p := range platformArgs {
-			placeholders += "?,"
-			args = append(args, p)
+			namedArgs["host_compatible_platforms"] = fleet.HostLinuxOSs
+		} else {
+			namedArgs["host_compatible_platforms"] = []string{host.FleetPlatform()}
 		}
-		stmt += ` UNION ` + fmt.Sprintf(stmtAvailable, strings.TrimSuffix(placeholders, ","), onlySelfServiceClause)
-		args = append(args, host.ID, host.ID, host.ID)
+		stmt += ` UNION ` + stmtAvailable
+	}
+
+	// must resolve the named bindings here, before adding the searchLike which
+	// uses standard placeholders.
+	stmt, args, err := sqlx.Named(stmt, namedArgs)
+	if err != nil {
+		return nil, nil, ctxerr.Wrap(ctx, err, "build named query for list host software")
+	}
+	stmt, args, err = sqlx.In(stmt, args...)
+	if err != nil {
+		return nil, nil, ctxerr.Wrap(ctx, err, "expand IN query for list host software")
 	}
 
 	stmt = selectColNames + ` FROM ( ` + stmt + ` ) AS tbl `
@@ -2182,10 +2419,15 @@ AND EXISTS (SELECT 1 FROM software s JOIN software_cve scve ON scve.software_id
 
 	type hostSoftware struct {
 		fleet.HostSoftwareWithInstaller
-		LastInstallInstalledAt *time.Time    `db:"last_install_installed_at"`
-		LastInstallInstallUUID *string       `db:"last_install_install_uuid"`
-		StatusSort             sql.NullInt32 `db:"status_sort"`
-		PackageVersion         *string       `db:"package_version"`
+		LastInstallInstalledAt *time.Time `db:"last_install_installed_at"`
+		LastInstallInstallUUID *string    `db:"last_install_install_uuid"`
+		PackageSelfService     *bool      `db:"package_self_service"`
+		PackageName            *string    `db:"package_name"`
+		PackageVersion         *string    `db:"package_version"`
+		VPPAppSelfService      *bool      `db:"vpp_app_self_service"`
+		VPPAppAdamID           *string    `db:"vpp_app_adam_id"`
+		VPPAppVersion          *string    `db:"vpp_app_version"`
+		VPPAppIconURL          *string    `db:"vpp_app_icon_url"`
 	}
 	var hostSoftwareList []*hostSoftware
 	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &hostSoftwareList, stmt, args...); err != nil {
@@ -2197,27 +2439,51 @@ AND EXISTS (SELECT 1 FROM software s JOIN software_cve scve ON scve.software_id
 	titleIDs := make([]uint, 0, len(hostSoftwareList))
 	byTitleID := make(map[uint]*hostSoftware, len(hostSoftwareList))
 	for _, hs := range hostSoftwareList {
-		// promote the last install info to the proper destination fields
-		if hs.LastInstallInstallUUID != nil && *hs.LastInstallInstallUUID != "" {
-			hs.LastInstall = &fleet.HostSoftwareInstall{
-				InstallUUID: *hs.LastInstallInstallUUID,
-			}
-			if hs.LastInstallInstalledAt != nil {
-				hs.LastInstall.InstalledAt = *hs.LastInstallInstalledAt
-			}
-		}
 
 		// promote the package name and version to the proper destination fields
-		// (the service layer will arbitrate whether package_available_for_install
-		// or package fields are returned).
-		if hs.PackageAvailableForInstall != nil {
+		if hs.PackageName != nil {
 			var version string
 			if hs.PackageVersion != nil {
 				version = *hs.PackageVersion
 			}
-			hs.Package = &fleet.DeviceSoftwarePackage{
-				Name:    *hs.PackageAvailableForInstall,
-				Version: version,
+			hs.SoftwarePackage = &fleet.SoftwarePackageOrApp{
+				Name:        *hs.PackageName,
+				Version:     version,
+				SelfService: hs.PackageSelfService,
+			}
+
+			// promote the last install info to the proper destination fields
+			if hs.LastInstallInstallUUID != nil && *hs.LastInstallInstallUUID != "" {
+				hs.SoftwarePackage.LastInstall = &fleet.HostSoftwareInstall{
+					InstallUUID: *hs.LastInstallInstallUUID,
+				}
+				if hs.LastInstallInstalledAt != nil {
+					hs.SoftwarePackage.LastInstall.InstalledAt = *hs.LastInstallInstalledAt
+				}
+			}
+		}
+
+		// promote the VPP app id and version to the proper destination fields
+		if hs.VPPAppAdamID != nil {
+			var version string
+			if hs.VPPAppVersion != nil {
+				version = *hs.VPPAppVersion
+			}
+			hs.AppStoreApp = &fleet.SoftwarePackageOrApp{
+				AppStoreID:  *hs.VPPAppAdamID,
+				Version:     version,
+				SelfService: hs.VPPAppSelfService,
+				IconURL:     hs.VPPAppIconURL,
+			}
+
+			// promote the last install info to the proper destination fields
+			if hs.LastInstallInstallUUID != nil && *hs.LastInstallInstallUUID != "" {
+				hs.AppStoreApp.LastInstall = &fleet.HostSoftwareInstall{
+					CommandUUID: *hs.LastInstallInstallUUID,
+				}
+				if hs.LastInstallInstalledAt != nil {
+					hs.AppStoreApp.LastInstall.InstalledAt = *hs.LastInstallInstalledAt
+				}
 			}
 		}
 
@@ -2389,3 +2655,79 @@ func (ds *Datastore) SetHostSoftwareInstallResult(ctx context.Context, result *f
 	}
 	return nil
 }
+
+func getInstalledByFleetSoftwareTitles(ctx context.Context, qc sqlx.QueryerContext, hostID uint) ([]fleet.SoftwareTitle, error) {
+	// We are overloading vpp_apps_count to indicate whether installed title is a VPP app or not.
+	const stmt = `
+SELECT
+	st.id,
+	st.name,
+	st.source,
+	st.browser,
+	st.bundle_identifier,
+	0 as vpp_apps_count
+FROM software_titles st
+INNER JOIN software_installers si ON si.title_id = st.id
+INNER JOIN host_software_installs hsi ON hsi.host_id = ? AND hsi.software_installer_id = si.id
+WHERE hsi.removed = 0 AND 
+	-- :software_status_installed
+	((hsi.post_install_script_exit_code IS NOT NULL AND hsi.post_install_script_exit_code = 0) OR
+	(hsi.install_script_exit_code IS NOT NULL AND hsi.install_script_exit_code = 0))
+
+UNION
+
+SELECT
+	st.id,
+	st.name,
+	st.source,
+	st.browser,
+	st.bundle_identifier,
+	1 as vpp_apps_count
+FROM software_titles st
+INNER JOIN vpp_apps vap ON vap.title_id = st.id
+INNER JOIN host_vpp_software_installs hvsi ON hvsi.host_id = ? AND hvsi.adam_id = vap.adam_id AND hvsi.platform = vap.platform
+INNER JOIN nano_command_results ncr ON ncr.command_uuid = hvsi.command_uuid
+WHERE hvsi.removed = 0 AND ncr.status = ?
+`
+	var titles []fleet.SoftwareTitle
+	if err := sqlx.SelectContext(ctx, qc, &titles, stmt, hostID, hostID, fleet.MDMAppleStatusAcknowledged); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get installed software titles")
+	}
+	return titles, nil
+}
+
+func markHostSoftwareInstallsRemoved(ctx context.Context, ex sqlx.ExtContext, hostID uint, titleIDs []uint) error {
+	const stmt = `
+UPDATE host_software_installs hsi
+INNER JOIN software_installers si ON hsi.software_installer_id = si.id
+INNER JOIN software_titles st ON si.title_id = st.id
+SET hsi.removed = 1
+WHERE hsi.host_id = ? AND st.id IN (?)
+`
+	stmtExpanded, args, err := sqlx.In(stmt, hostID, titleIDs)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "build query args to mark host software install removed")
+	}
+	if _, err := ex.ExecContext(ctx, stmtExpanded, args...); err != nil {
+		return ctxerr.Wrap(ctx, err, "mark host software install removed")
+	}
+	return nil
+}
+
+func markHostVPPSoftwareInstallsRemoved(ctx context.Context, ex sqlx.ExtContext, hostID uint, titleIDs []uint) error {
+	const stmt = `
+UPDATE host_vpp_software_installs hvsi
+INNER JOIN vpp_apps vap ON hvsi.adam_id = vap.adam_id AND hvsi.platform = vap.platform
+INNER JOIN software_titles st ON vap.title_id = st.id
+SET hvsi.removed = 1
+WHERE hvsi.host_id = ? AND st.id IN (?)
+`
+	stmtExpanded, args, err := sqlx.In(stmt, hostID, titleIDs)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "build query args to mark host vpp software install removed")
+	}
+	if _, err := ex.ExecContext(ctx, stmtExpanded, args...); err != nil {
+		return ctxerr.Wrap(ctx, err, "mark host vpp software install removed")
+	}
+	return nil
+}
diff --git a/server/datastore/mysql/software_installers.go b/server/datastore/mysql/software_installers.go
index 9f0e91040520..21d5a0aa9538 100644
--- a/server/datastore/mysql/software_installers.go
+++ b/server/datastore/mysql/software_installers.go
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+	"time"
 
 	"github.com/fleetdm/fleet/v4/server/authz"
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
@@ -73,30 +74,35 @@ func (ds *Datastore) GetSoftwareInstallDetails(ctx context.Context, executionId
 func (ds *Datastore) MatchOrCreateSoftwareInstaller(ctx context.Context, payload *fleet.UploadSoftwareInstallerPayload) (uint, error) {
 	titleID, err := ds.getOrGenerateSoftwareInstallerTitleID(ctx, payload)
 	if err != nil {
-		return 0, err
+		return 0, ctxerr.Wrap(ctx, err, "get or generate software installer title ID")
 	}
 
 	if err := ds.addSoftwareTitleToMatchingSoftware(ctx, titleID, payload); err != nil {
-		return 0, err
+		return 0, ctxerr.Wrap(ctx, err, "add software title to matching software")
 	}
 
 	installScriptID, err := ds.getOrGenerateScriptContentsID(ctx, payload.InstallScript)
 	if err != nil {
-		return 0, err
+		return 0, ctxerr.Wrap(ctx, err, "get or generate install script contents ID")
 	}
 
 	var postInstallScriptID *uint
 	if payload.PostInstallScript != "" {
 		sid, err := ds.getOrGenerateScriptContentsID(ctx, payload.PostInstallScript)
 		if err != nil {
-			return 0, err
+			return 0, ctxerr.Wrap(ctx, err, "get or generate post-install script contents ID")
 		}
 		postInstallScriptID = &sid
 	}
 
-	var tid uint
+	var tid *uint
+	var globalOrTeamID uint
 	if payload.TeamID != nil {
-		tid = *payload.TeamID
+		globalOrTeamID = *payload.TeamID
+
+		if *payload.TeamID > 0 {
+			tid = payload.TeamID
+		}
 	}
 
 	stmt := `
@@ -111,12 +117,15 @@ INSERT INTO software_installers (
 	pre_install_query,
 	post_install_script_content_id,
 	platform,
-    self_service
-) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    self_service,
+	user_id,
+	user_name,
+	user_email
+) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, (SELECT name FROM users WHERE id = ?), (SELECT email FROM users WHERE id = ?))`
 
 	args := []interface{}{
-		payload.TeamID,
 		tid,
+		globalOrTeamID,
 		titleID,
 		payload.StorageID,
 		payload.Filename,
@@ -126,6 +135,9 @@ INSERT INTO software_installers (
 		postInstallScriptID,
 		payload.Platform,
 		payload.SelfService,
+		payload.UserID,
+		payload.UserID,
+		payload.UserID,
 	}
 
 	res, err := ds.writer(ctx).ExecContext(ctx, stmt, args...)
@@ -204,7 +216,8 @@ SELECT
 	si.pre_install_query,
 	si.post_install_script_content_id,
 	si.uploaded_at,
-	COALESCE(st.name, '') AS software_title
+	COALESCE(st.name, '') AS software_title,
+	si.platform
 FROM
 	software_installers si
 	LEFT OUTER JOIN software_titles st ON st.id = si.title_id
@@ -248,7 +261,7 @@ SELECT
   %s
 FROM
   software_installers si
-  LEFT OUTER JOIN software_titles st ON st.id = si.title_id
+  JOIN software_titles st ON st.id = si.title_id
   %s
 WHERE
   si.title_id = ? AND si.global_or_team_id = ?`,
@@ -271,9 +284,21 @@ WHERE
 	return &dest, nil
 }
 
+var errDeleteInstallerWithAssociatedPolicy = errors.New("Couldn't delete. Policy automation uses this software. Please disable policy automation for this software and try again.")
+
 func (ds *Datastore) DeleteSoftwareInstaller(ctx context.Context, id uint) error {
 	res, err := ds.writer(ctx).ExecContext(ctx, `DELETE FROM software_installers WHERE id = ?`, id)
 	if err != nil {
+		if isMySQLForeignKey(err) {
+			// Check if the software installer is referenced by a policy automation.
+			var count int
+			if err := sqlx.GetContext(ctx, ds.reader(ctx), &count, `SELECT COUNT(*) FROM policies WHERE software_installer_id = ?`, id); err != nil {
+				return ctxerr.Wrapf(ctx, err, "getting reference from policies")
+			}
+			if count > 0 {
+				return ctxerr.Wrap(ctx, errDeleteInstallerWithAssociatedPolicy, "delete software installer")
+			}
+		}
 		return ctxerr.Wrap(ctx, err, "delete software installer")
 	}
 
@@ -332,19 +357,20 @@ SELECT
 	hsi.post_install_script_output,
 	hsi.install_script_output,
 	hsi.host_id AS host_id,
-	h.computer_name AS host_display_name,
 	st.name AS software_title,
 	st.id AS software_title_id,
 	COALESCE(%s, '') AS status,
 	si.filename AS software_package,
-	h.team_id AS host_team_id,
 	hsi.user_id AS user_id,
 	hsi.post_install_script_exit_code,
 	hsi.install_script_exit_code,
-    hsi.self_service
+	hsi.self_service,
+	hsi.host_deleted_at,
+	si.user_id AS software_installer_user_id,
+	si.user_name AS software_installer_user_name,
+	si.user_email AS software_installer_user_email
 FROM
 	host_software_installs hsi
-	JOIN hosts h ON h.id = hsi.host_id
 	JOIN software_installers si ON si.id = hsi.software_installer_id
 	JOIN software_titles st ON si.title_id = st.id
 WHERE
@@ -395,6 +421,8 @@ WHERE
 			FROM host_software_installs
 		WHERE
 			software_installer_id = :installer_id
+			AND host_deleted_at IS NULL
+			AND removed = 0
 		GROUP BY
 			host_id)) s`, softwareInstallerHostStatusNamedQuery("hsi", "status"))
 
@@ -416,6 +444,40 @@ WHERE
 	return &dest, nil
 }
 
+func (ds *Datastore) vppAppJoin(appID fleet.VPPAppID, status fleet.SoftwareInstallerStatus) (string, []interface{}, error) {
+	stmt := fmt.Sprintf(`JOIN (
+SELECT
+	host_id
+FROM
+	host_vpp_software_installs hvsi
+LEFT OUTER JOIN
+	nano_command_results ncr ON ncr.command_uuid = hvsi.command_uuid
+WHERE
+	adam_id = :adam_id AND platform = :platform
+	AND hvsi.id IN(
+		SELECT
+			max(id) -- ensure we use only the most recent install attempt for each host
+			FROM host_vpp_software_installs
+		WHERE
+			adam_id = :adam_id AND platform = :platform
+		GROUP BY
+			host_id, adam_id)
+	AND (%s) = :status) hss ON hss.host_id = h.id
+`, vppAppHostStatusNamedQuery("hvsi", "ncr", ""))
+
+	return sqlx.Named(stmt, map[string]interface{}{
+		"status":                    status,
+		"adam_id":                   appID.AdamID,
+		"platform":                  appID.Platform,
+		"software_status_installed": fleet.SoftwareInstallerInstalled,
+		"software_status_failed":    fleet.SoftwareInstallerFailed,
+		"software_status_pending":   fleet.SoftwareInstallerPending,
+		"mdm_status_acknowledged":   fleet.MDMAppleStatusAcknowledged,
+		"mdm_status_error":          fleet.MDMAppleStatusError,
+		"mdm_status_format_error":   fleet.MDMAppleStatusCommandFormatError,
+	})
+}
+
 func (ds *Datastore) softwareInstallerJoin(installerID uint, status fleet.SoftwareInstallerStatus) (string, []interface{}, error) {
 	stmt := fmt.Sprintf(`JOIN (
 SELECT
@@ -430,6 +492,7 @@ WHERE
 			FROM host_software_installs
 		WHERE
 			software_installer_id = :installer_id
+			AND removed = 0
 		GROUP BY
 			host_id, software_installer_id)
 	AND (%s) = :status) hss ON hss.host_id = h.id
@@ -444,7 +507,42 @@ WHERE
 	})
 }
 
-func (ds *Datastore) CleanupUnusedSoftwareInstallers(ctx context.Context, softwareInstallStore fleet.SoftwareInstallerStore) error {
+func (ds *Datastore) GetHostLastInstallData(ctx context.Context, hostID, installerID uint) (*fleet.HostLastInstallData, error) {
+	stmt := fmt.Sprintf(`
+		SELECT execution_id, %s AS status
+		FROM host_software_installs hsi
+		WHERE hsi.id = (
+			SELECT
+				MAX(id)
+			FROM host_software_installs
+			WHERE
+				software_installer_id = :installer_id AND host_id = :host_id
+			GROUP BY
+				host_id, software_installer_id)
+`, softwareInstallerHostStatusNamedQuery("hsi", ""))
+
+	stmt, args, err := sqlx.Named(stmt, map[string]interface{}{
+		"host_id":                   hostID,
+		"installer_id":              installerID,
+		"software_status_installed": fleet.SoftwareInstallerInstalled,
+		"software_status_failed":    fleet.SoftwareInstallerFailed,
+		"software_status_pending":   fleet.SoftwareInstallerPending,
+	})
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "build named query to get host last install data")
+	}
+
+	var hostLastInstall fleet.HostLastInstallData
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &hostLastInstall, stmt, args...); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, ctxerr.Wrap(ctx, err, "get host last install data")
+	}
+	return &hostLastInstall, nil
+}
+
+func (ds *Datastore) CleanupUnusedSoftwareInstallers(ctx context.Context, softwareInstallStore fleet.SoftwareInstallerStore, removeCreatedBefore time.Time) error {
 	if softwareInstallStore == nil {
 		// no-op in this case, possible if not running with a Premium license
 		return nil
@@ -456,11 +554,11 @@ func (ds *Datastore) CleanupUnusedSoftwareInstallers(ctx context.Context, softwa
 		return ctxerr.Wrap(ctx, err, "get list of software installers in use")
 	}
 
-	_, err := softwareInstallStore.Cleanup(ctx, storageIDs)
+	_, err := softwareInstallStore.Cleanup(ctx, storageIDs, removeCreatedBefore)
 	return ctxerr.Wrap(ctx, err, "cleanup unused software installers")
 }
 
-func (ds *Datastore) BatchSetSoftwareInstallers(ctx context.Context, tmID *uint, installers []*fleet.UploadSoftwareInstallerPayload) error {
+func (ds *Datastore) BatchSetSoftwareInstallers(ctx context.Context, tmID *uint, installers []*fleet.UploadSoftwareInstallerPayload) ([]fleet.SoftwareInstaller, error) {
 	const upsertSoftwareTitles = `
 INSERT INTO software_titles
   (name, source, browser)
@@ -479,6 +577,16 @@ FROM
   software_titles
 WHERE (name, source, browser) IN (%s)
 `
+
+	const unsetAllInstallersFromPolicies = `
+UPDATE
+  policies
+SET
+  software_installer_id = NULL
+WHERE
+  team_id = ?
+`
+
 	const deleteAllInstallersInTeam = `
 DELETE FROM
   software_installers
@@ -486,6 +594,19 @@ WHERE
   global_or_team_id = ?
 `
 
+	const unsetInstallersNotInListFromPolicies = `
+UPDATE
+  policies
+SET
+  software_installer_id = NULL
+WHERE
+  software_installer_id IN (
+    SELECT id FROM software_installers
+    WHERE global_or_team_id = ? AND
+    title_id NOT IN (?)
+  )
+`
+
 	const deleteInstallersNotInList = `
 DELETE FROM
   software_installers
@@ -506,10 +627,15 @@ INSERT INTO software_installers (
 	post_install_script_content_id,
 	platform,
 	self_service,
-	title_id
+	title_id,
+	user_id,
+	user_name,
+	user_email,
+	url
 ) VALUES (
   ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
-  (SELECT id FROM software_titles WHERE name = ? AND source = ? AND browser = '')
+  (SELECT id FROM software_titles WHERE name = ? AND source = ? AND browser = ''),
+  ?, (SELECT name FROM users WHERE id = ?), (SELECT email FROM users WHERE id = ?), ?
 )
 ON DUPLICATE KEY UPDATE
   install_script_content_id = VALUES(install_script_content_id),
@@ -519,7 +645,30 @@ ON DUPLICATE KEY UPDATE
   version = VALUES(version),
   pre_install_query = VALUES(pre_install_query),
   platform = VALUES(platform),
-  self_service = VALUES(self_service)
+  self_service = VALUES(self_service),
+  user_id = VALUES(user_id),
+  user_name = VALUES(user_name),
+  user_email = VALUES(user_email),
+  url = VALUES(url)
+`
+
+	const loadInsertedSoftwareInstallers = `
+SELECT
+  id,
+  team_id,
+  storage_id,
+  filename,
+  version,
+  install_script_content_id,
+  pre_install_query,
+  post_install_script_content_id,
+  platform,
+  self_service,
+  title_id,
+  url
+FROM
+  software_installers
+WHERE global_or_team_id = ?
 `
 
 	// use a team id of 0 if no-team
@@ -528,12 +677,18 @@ ON DUPLICATE KEY UPDATE
 		globalOrTeamID = *tmID
 	}
 
-	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
+	var insertedSoftwareInstallers []fleet.SoftwareInstaller
+	if err := ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
 		// if no installers are provided, just delete whatever was in
 		// the table
 		if len(installers) == 0 {
-			_, err := tx.ExecContext(ctx, deleteAllInstallersInTeam, globalOrTeamID)
-			return ctxerr.Wrap(ctx, err, "delete obsolete software installers")
+			if _, err := tx.ExecContext(ctx, unsetAllInstallersFromPolicies, globalOrTeamID); err != nil {
+				return ctxerr.Wrap(ctx, err, "unset all obsolete installers in policies")
+			}
+			if _, err := tx.ExecContext(ctx, deleteAllInstallersInTeam, globalOrTeamID); err != nil {
+				return ctxerr.Wrap(ctx, err, "delete obsolete software installers")
+			}
+			return nil
 		}
 
 		var args []any
@@ -554,7 +709,15 @@ ON DUPLICATE KEY UPDATE
 			return ctxerr.Wrap(ctx, err, "load existing titles")
 		}
 
-		stmt, args, err := sqlx.In(deleteInstallersNotInList, globalOrTeamID, titleIDs)
+		stmt, args, err := sqlx.In(unsetInstallersNotInListFromPolicies, globalOrTeamID, titleIDs)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "build statement to unset obsolete installers from policies")
+		}
+		if _, err := tx.ExecContext(ctx, stmt, args...); err != nil {
+			return ctxerr.Wrap(ctx, err, "unset obsolete software installers from policies")
+		}
+
+		stmt, args, err = sqlx.In(deleteInstallersNotInList, globalOrTeamID, titleIDs)
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "build statement to delete obsolete installers")
 		}
@@ -563,7 +726,7 @@ ON DUPLICATE KEY UPDATE
 		}
 
 		for _, installer := range installers {
-			isRes, err := insertScriptContents(ctx, installer.InstallScript, tx)
+			isRes, err := insertScriptContents(ctx, tx, installer.InstallScript)
 			if err != nil {
 				return ctxerr.Wrapf(ctx, err, "inserting install script contents for software installer with name %q", installer.Filename)
 			}
@@ -571,7 +734,7 @@ ON DUPLICATE KEY UPDATE
 
 			var postInstallScriptID *int64
 			if installer.PostInstallScript != "" {
-				pisRes, err := insertScriptContents(ctx, installer.PostInstallScript, tx)
+				pisRes, err := insertScriptContents(ctx, tx, installer.PostInstallScript)
 				if err != nil {
 					return ctxerr.Wrapf(ctx, err, "inserting post-install script contents for software installer with name %q", installer.Filename)
 				}
@@ -593,26 +756,48 @@ ON DUPLICATE KEY UPDATE
 				installer.SelfService,
 				installer.Title,
 				installer.Source,
+				installer.UserID,
+				installer.UserID,
+				installer.UserID,
+				installer.URL,
 			}
 
 			if _, err := tx.ExecContext(ctx, insertNewOrEditedInstaller, args...); err != nil {
 				return ctxerr.Wrapf(ctx, err, "insert new/edited installer with name %q", installer.Filename)
 			}
+
 		}
+
+		if err := sqlx.SelectContext(ctx, tx, &insertedSoftwareInstallers, loadInsertedSoftwareInstallers, globalOrTeamID); err != nil {
+			return ctxerr.Wrap(ctx, err, "load inserted software installers")
+		}
+
 		return nil
-	})
+	}); err != nil {
+		return nil, err
+	}
+	return insertedSoftwareInstallers, nil
 }
 
 func (ds *Datastore) HasSelfServiceSoftwareInstallers(ctx context.Context, hostPlatform string, hostTeamID *uint) (bool, error) {
 	if fleet.IsLinux(hostPlatform) {
 		hostPlatform = "linux"
 	}
-	stmt := `SELECT 1 FROM software_installers WHERE self_service = 1 AND platform = ? AND global_or_team_id = ?`
+	stmt := `SELECT 1
+		WHERE EXISTS (
+			SELECT 1
+			FROM software_installers
+			WHERE self_service = 1 AND platform = ? AND global_or_team_id = ?
+		) OR EXISTS (
+			SELECT 1
+			FROM vpp_apps_teams
+			WHERE self_service = 1 AND platform = ? AND global_or_team_id = ?
+		)`
 	var globalOrTeamID uint
 	if hostTeamID != nil {
 		globalOrTeamID = *hostTeamID
 	}
-	args := []interface{}{hostPlatform, globalOrTeamID}
+	args := []interface{}{hostPlatform, globalOrTeamID, hostPlatform, globalOrTeamID}
 	var hasInstallers bool
 	err := sqlx.GetContext(ctx, ds.reader(ctx), &hasInstallers, stmt, args...)
 	if err != nil && !errors.Is(err, sql.ErrNoRows) {
diff --git a/server/datastore/mysql/software_installers_test.go b/server/datastore/mysql/software_installers_test.go
index 70505c693ead..0da31b41eeec 100644
--- a/server/datastore/mysql/software_installers_test.go
+++ b/server/datastore/mysql/software_installers_test.go
@@ -31,6 +31,8 @@ func TestSoftwareInstallers(t *testing.T) {
 		{"BatchSetSoftwareInstallers", testBatchSetSoftwareInstallers},
 		{"GetSoftwareInstallerMetadataByTeamAndTitleID", testGetSoftwareInstallerMetadataByTeamAndTitleID},
 		{"HasSelfServiceSoftwareInstallers", testHasSelfServiceSoftwareInstallers},
+		{"DeleteSoftwareInstallersAssignedToPolicy", testDeleteSoftwareInstallersAssignedToPolicy},
+		{"GetHostLastInstallData", testGetHostLastInstallData},
 	}
 
 	for _, c := range cases {
@@ -46,6 +48,7 @@ func testListPendingSoftwareInstalls(t *testing.T, ds *Datastore) {
 
 	host1 := test.NewHost(t, ds, "host1", "1", "host1key", "host1uuid", time.Now())
 	host2 := test.NewHost(t, ds, "host2", "2", "host2key", "host2uuid", time.Now())
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
 
 	installerID1, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
 		InstallScript:     "hello",
@@ -57,6 +60,7 @@ func testListPendingSoftwareInstalls(t *testing.T, ds *Datastore) {
 		Title:             "file1",
 		Version:           "1.0",
 		Source:            "apps",
+		UserID:            user1.ID,
 	})
 	require.NoError(t, err)
 
@@ -70,6 +74,7 @@ func testListPendingSoftwareInstalls(t *testing.T, ds *Datastore) {
 		Title:             "file2",
 		Version:           "2.0",
 		Source:            "apps",
+		UserID:            user1.ID,
 	})
 	require.NoError(t, err)
 
@@ -84,6 +89,7 @@ func testListPendingSoftwareInstalls(t *testing.T, ds *Datastore) {
 		Version:           "3.0",
 		Source:            "apps",
 		SelfService:       true,
+		UserID:            user1.ID,
 	})
 	require.NoError(t, err)
 
@@ -160,7 +166,6 @@ func testListPendingSoftwareInstalls(t *testing.T, ds *Datastore) {
 	require.Equal(t, installerID3, exec2.InstallerID)
 	require.Equal(t, "SELECT 3", exec2.PreInstallCondition)
 	require.True(t, exec2.SelfService)
-
 }
 
 func testSoftwareInstallRequests(t *testing.T, ds *Datastore) {
@@ -170,6 +175,8 @@ func testSoftwareInstallRequests(t *testing.T, ds *Datastore) {
 	team, err := ds.NewTeam(ctx, &fleet.Team{Name: "team 2"})
 	require.NoError(t, err)
 
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
 	cases := map[string]*uint{
 		"no team": nil,
 		"team":    &team.ID,
@@ -189,6 +196,7 @@ func testSoftwareInstallRequests(t *testing.T, ds *Datastore) {
 				InstallScript: "echo",
 				TeamID:        teamID,
 				Filename:      "foo.pkg",
+				UserID:        user1.ID,
 			})
 			require.NoError(t, err)
 			installerMeta, err := ds.GetSoftwareInstallerMetadataByID(ctx, installerID)
@@ -250,6 +258,8 @@ func testGetSoftwareInstallResult(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	teamID := team.ID
 
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
 	for _, tc := range []struct {
 		name                    string
 		expectedStatus          fleet.SoftwareInstallerStatus
@@ -296,6 +306,7 @@ func testGetSoftwareInstallResult(t *testing.T, ds *Datastore) {
 				InstallScript: "echo " + tc.name,
 				TeamID:        &teamID,
 				Filename:      swFilename,
+				UserID:        user1.ID,
 			})
 			require.NoError(t, err)
 			host, err := ds.NewHost(ctx, &fleet.Host{
@@ -329,7 +340,6 @@ func testGetSoftwareInstallResult(t *testing.T, ds *Datastore) {
 			require.Equal(t, tc.expectedStatus, res.Status)
 			require.Equal(t, swFilename, res.SoftwarePackage)
 			require.Equal(t, host.ID, res.HostID)
-			require.Equal(t, host.DisplayName(), res.HostDisplayName)
 			require.Equal(t, tc.preInstallQueryOutput, res.PreInstallQueryOutput)
 			require.Equal(t, tc.postInstallScriptOutput, res.PostInstallScriptOutput)
 			require.Equal(t, tc.installScriptOutput, res.Output)
@@ -344,6 +354,8 @@ func testCleanupUnusedSoftwareInstallers(t *testing.T, ds *Datastore) {
 	store, err := filesystem.NewSoftwareInstallerStore(dir)
 	require.NoError(t, err)
 
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
 	assertExisting := func(want []string) {
 		dirEnts, err := os.ReadDir(filepath.Join(dir, "software-installers"))
 		require.NoError(t, err)
@@ -357,7 +369,7 @@ func testCleanupUnusedSoftwareInstallers(t *testing.T, ds *Datastore) {
 	}
 
 	// cleanup an empty store
-	err = ds.CleanupUnusedSoftwareInstallers(ctx, store)
+	err = ds.CleanupUnusedSoftwareInstallers(ctx, store, time.Now())
 	require.NoError(t, err)
 	assertExisting(nil)
 
@@ -375,11 +387,12 @@ func testCleanupUnusedSoftwareInstallers(t *testing.T, ds *Datastore) {
 		Filename:      "installer0",
 		Title:         "ins0",
 		Source:        "apps",
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 
 	assertExisting([]string{ins0})
-	err = ds.CleanupUnusedSoftwareInstallers(ctx, store)
+	err = ds.CleanupUnusedSoftwareInstallers(ctx, store, time.Now())
 	require.NoError(t, err)
 	assertExisting([]string{ins0})
 
@@ -387,7 +400,13 @@ func testCleanupUnusedSoftwareInstallers(t *testing.T, ds *Datastore) {
 	err = ds.DeleteSoftwareInstaller(ctx, swi)
 	require.NoError(t, err)
 
-	err = ds.CleanupUnusedSoftwareInstallers(ctx, store)
+	// would clean up, but not created before 1m ago
+	err = ds.CleanupUnusedSoftwareInstallers(ctx, store, time.Now().Add(-time.Minute))
+	require.NoError(t, err)
+	assertExisting([]string{ins0})
+
+	// do actual cleanup
+	err = ds.CleanupUnusedSoftwareInstallers(ctx, store, time.Now().Add(time.Minute))
 	require.NoError(t, err)
 	assertExisting(nil)
 }
@@ -399,6 +418,8 @@ func testBatchSetSoftwareInstallers(t *testing.T, ds *Datastore) {
 	team, err := ds.NewTeam(ctx, &fleet.Team{Name: t.Name()})
 	require.NoError(t, err)
 
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
 	// TODO(roberto): perform better assertions, we should have evertything
 	// to check that the actual values of everything match.
 	assertSoftware := func(wantTitles []fleet.SoftwareTitle) {
@@ -419,17 +440,19 @@ func testBatchSetSoftwareInstallers(t *testing.T, ds *Datastore) {
 	}
 
 	// batch set with everything empty
-	err = ds.BatchSetSoftwareInstallers(ctx, &team.ID, nil)
+	softwareInstallers, err := ds.BatchSetSoftwareInstallers(ctx, &team.ID, nil)
 	require.NoError(t, err)
+	require.Empty(t, softwareInstallers)
 	assertSoftware(nil)
-	err = ds.BatchSetSoftwareInstallers(ctx, &team.ID, []*fleet.UploadSoftwareInstallerPayload{})
+	softwareInstallers, err = ds.BatchSetSoftwareInstallers(ctx, &team.ID, []*fleet.UploadSoftwareInstallerPayload{})
 	require.NoError(t, err)
+	require.Empty(t, softwareInstallers)
 	assertSoftware(nil)
 
 	// add a single installer
 	ins0 := "installer0"
 	ins0File := bytes.NewReader([]byte("installer0"))
-	err = ds.BatchSetSoftwareInstallers(ctx, &team.ID, []*fleet.UploadSoftwareInstallerPayload{{
+	softwareInstallers, err = ds.BatchSetSoftwareInstallers(ctx, &team.ID, []*fleet.UploadSoftwareInstallerPayload{{
 		InstallScript:   "install",
 		InstallerFile:   ins0File,
 		StorageID:       ins0,
@@ -438,8 +461,14 @@ func testBatchSetSoftwareInstallers(t *testing.T, ds *Datastore) {
 		Source:          "apps",
 		Version:         "1",
 		PreInstallQuery: "foo",
+		UserID:          user1.ID,
+		Platform:        "darwin",
 	}})
 	require.NoError(t, err)
+	require.Len(t, softwareInstallers, 1)
+	require.Equal(t, ins0, softwareInstallers[0].Name)
+	require.NotNil(t, softwareInstallers[0].TitleID)
+	require.Equal(t, "darwin", softwareInstallers[0].Platform)
 	assertSoftware([]fleet.SoftwareTitle{
 		{Name: ins0, Source: "apps", Browser: ""},
 	})
@@ -447,7 +476,7 @@ func testBatchSetSoftwareInstallers(t *testing.T, ds *Datastore) {
 	// add a new installer + ins0 installer
 	ins1 := "installer1"
 	ins1File := bytes.NewReader([]byte("installer1"))
-	err = ds.BatchSetSoftwareInstallers(ctx, &team.ID, []*fleet.UploadSoftwareInstallerPayload{
+	softwareInstallers, err = ds.BatchSetSoftwareInstallers(ctx, &team.ID, []*fleet.UploadSoftwareInstallerPayload{
 		{
 			InstallScript:   "install",
 			InstallerFile:   ins0File,
@@ -457,6 +486,8 @@ func testBatchSetSoftwareInstallers(t *testing.T, ds *Datastore) {
 			Source:          "apps",
 			Version:         "1",
 			PreInstallQuery: "select 0 from foo;",
+			UserID:          user1.ID,
+			Platform:        "darwin",
 		},
 		{
 			InstallScript:     "install",
@@ -468,16 +499,25 @@ func testBatchSetSoftwareInstallers(t *testing.T, ds *Datastore) {
 			Source:            "apps",
 			Version:           "2",
 			PreInstallQuery:   "select 1 from bar;",
+			UserID:            user1.ID,
+			Platform:          "darwin",
 		},
 	})
 	require.NoError(t, err)
+	require.Len(t, softwareInstallers, 2)
+	require.Equal(t, ins0, softwareInstallers[0].Name)
+	require.NotNil(t, softwareInstallers[0].TitleID)
+	require.Equal(t, "darwin", softwareInstallers[0].Platform)
+	require.Equal(t, ins1, softwareInstallers[1].Name)
+	require.NotNil(t, softwareInstallers[1].TitleID)
+	require.Equal(t, "darwin", softwareInstallers[1].Platform)
 	assertSoftware([]fleet.SoftwareTitle{
 		{Name: ins0, Source: "apps", Browser: ""},
 		{Name: ins1, Source: "apps", Browser: ""},
 	})
 
 	// remove ins0
-	err = ds.BatchSetSoftwareInstallers(ctx, &team.ID, []*fleet.UploadSoftwareInstallerPayload{
+	softwareInstallers, err = ds.BatchSetSoftwareInstallers(ctx, &team.ID, []*fleet.UploadSoftwareInstallerPayload{
 		{
 			InstallScript:     "install",
 			PostInstallScript: "post-install",
@@ -488,16 +528,21 @@ func testBatchSetSoftwareInstallers(t *testing.T, ds *Datastore) {
 			Source:            "apps",
 			Version:           "2",
 			PreInstallQuery:   "select 1 from bar;",
+			UserID:            user1.ID,
 		},
 	})
 	require.NoError(t, err)
+	require.Len(t, softwareInstallers, 1)
+	require.Equal(t, ins1, softwareInstallers[0].Name)
+	require.NotNil(t, softwareInstallers[0].TitleID)
 	assertSoftware([]fleet.SoftwareTitle{
 		{Name: ins1, Source: "apps", Browser: ""},
 	})
 
 	// remove everything
-	err = ds.BatchSetSoftwareInstallers(ctx, &team.ID, []*fleet.UploadSoftwareInstallerPayload{})
+	softwareInstallers, err = ds.BatchSetSoftwareInstallers(ctx, &team.ID, []*fleet.UploadSoftwareInstallerPayload{})
 	require.NoError(t, err)
+	require.Empty(t, softwareInstallers)
 	assertSoftware([]fleet.SoftwareTitle{})
 }
 
@@ -505,6 +550,7 @@ func testGetSoftwareInstallerMetadataByTeamAndTitleID(t *testing.T, ds *Datastor
 	ctx := context.Background()
 	team, err := ds.NewTeam(ctx, &fleet.Team{Name: "team 2"})
 	require.NoError(t, err)
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
 
 	installerID, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
 		Title:             "foo",
@@ -514,10 +560,13 @@ func testGetSoftwareInstallerMetadataByTeamAndTitleID(t *testing.T, ds *Datastor
 		PreInstallQuery:   "SELECT 1",
 		TeamID:            &team.ID,
 		Filename:          "foo.pkg",
+		Platform:          "darwin",
+		UserID:            user1.ID,
 	})
 	require.NoError(t, err)
 	installerMeta, err := ds.GetSoftwareInstallerMetadataByID(ctx, installerID)
 	require.NoError(t, err)
+	require.Equal(t, "darwin", installerMeta.Platform)
 
 	metaByTeamAndTitle, err := ds.GetSoftwareInstallerMetadataByTeamAndTitleID(ctx, &team.ID, *installerMeta.TitleID, true)
 	require.NoError(t, err)
@@ -532,6 +581,7 @@ func testGetSoftwareInstallerMetadataByTeamAndTitleID(t *testing.T, ds *Datastor
 		InstallScript: "echo install",
 		TeamID:        &team.ID,
 		Filename:      "foo.pkg",
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	installerMeta, err = ds.GetSoftwareInstallerMetadataByID(ctx, installerID)
@@ -550,6 +600,9 @@ func testHasSelfServiceSoftwareInstallers(t *testing.T, ds *Datastore) {
 
 	team, err := ds.NewTeam(ctx, &fleet.Team{Name: "team 2"})
 	require.NoError(t, err)
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
+	test.CreateInsertGlobalVPPToken(t, ds)
 
 	const platform = "linux"
 	// No installers
@@ -569,6 +622,7 @@ func testHasSelfServiceSoftwareInstallers(t *testing.T, ds *Datastore) {
 		Filename:      "foo.pkg",
 		Platform:      platform,
 		SelfService:   false,
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	hasSelfService, err = ds.HasSelfServiceSoftwareInstallers(ctx, platform, nil)
@@ -587,6 +641,7 @@ func testHasSelfServiceSoftwareInstallers(t *testing.T, ds *Datastore) {
 		Filename:      "foo2.pkg",
 		Platform:      platform,
 		SelfService:   true,
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	hasSelfService, err = ds.HasSelfServiceSoftwareInstallers(ctx, platform, nil)
@@ -596,6 +651,26 @@ func testHasSelfServiceSoftwareInstallers(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	assert.True(t, hasSelfService)
 
+	// Create a non self-service VPP for global/linux (not truly possible as VPP is Apple but for testing)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: platform}}, Name: "vpp1", BundleIdentifier: "com.app.vpp1"}, nil)
+	require.NoError(t, err)
+	hasSelfService, err = ds.HasSelfServiceSoftwareInstallers(ctx, platform, nil)
+	require.NoError(t, err)
+	assert.False(t, hasSelfService)
+	hasSelfService, err = ds.HasSelfServiceSoftwareInstallers(ctx, platform, &team.ID)
+	require.NoError(t, err)
+	assert.True(t, hasSelfService)
+
+	// Create a self-service VPP for global/linux (not truly possible as VPP is Apple but for testing)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_2", Platform: platform}, SelfService: true}, Name: "vpp2", BundleIdentifier: "com.app.vpp2"}, nil)
+	require.NoError(t, err)
+	hasSelfService, err = ds.HasSelfServiceSoftwareInstallers(ctx, platform, nil)
+	require.NoError(t, err)
+	assert.True(t, hasSelfService)
+	hasSelfService, err = ds.HasSelfServiceSoftwareInstallers(ctx, platform, &team.ID)
+	require.NoError(t, err)
+	assert.True(t, hasSelfService)
+
 	// Create a global self-service installer
 	_, err = ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
 		Title:         "foo global",
@@ -605,6 +680,7 @@ func testHasSelfServiceSoftwareInstallers(t *testing.T, ds *Datastore) {
 		Filename:      "foo global.pkg",
 		Platform:      platform,
 		SelfService:   true,
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	hasSelfService, err = ds.HasSelfServiceSoftwareInstallers(ctx, "ubuntu", nil)
@@ -614,11 +690,202 @@ func testHasSelfServiceSoftwareInstallers(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	assert.True(t, hasSelfService)
 
-	// Check another platform
+	// Create a self-service VPP for team/darwin
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_3", Platform: fleet.MacOSPlatform}, SelfService: true}, Name: "vpp3", BundleIdentifier: "com.app.vpp3"}, &team.ID)
+	require.NoError(t, err)
+	// Check darwin
 	hasSelfService, err = ds.HasSelfServiceSoftwareInstallers(ctx, "darwin", nil)
 	require.NoError(t, err)
 	assert.False(t, hasSelfService)
 	hasSelfService, err = ds.HasSelfServiceSoftwareInstallers(ctx, "darwin", &team.ID)
 	require.NoError(t, err)
-	assert.False(t, hasSelfService)
+	assert.True(t, hasSelfService)
+}
+
+func testDeleteSoftwareInstallersAssignedToPolicy(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	dir := t.TempDir()
+	store, err := filesystem.NewSoftwareInstallerStore(dir)
+	require.NoError(t, err)
+
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
+	// put an installer and save it in the DB
+	ins0 := "installer.pkg"
+	ins0File := bytes.NewReader([]byte("installer0"))
+	err = store.Put(ctx, ins0, ins0File)
+	require.NoError(t, err)
+
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+
+	softwareInstallerID, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "install",
+		InstallerFile: ins0File,
+		StorageID:     ins0,
+		Filename:      "installer.pkg",
+		Title:         "ins0",
+		Source:        "apps",
+		Platform:      "darwin",
+		TeamID:        &team1.ID,
+		UserID:        user1.ID,
+	})
+	require.NoError(t, err)
+
+	p1, err := ds.NewTeamPolicy(ctx, team1.ID, &user1.ID, fleet.PolicyPayload{
+		Name:                "p1",
+		Query:               "SELECT 1;",
+		SoftwareInstallerID: &softwareInstallerID,
+	})
+	require.NoError(t, err)
+
+	err = ds.DeleteSoftwareInstaller(ctx, softwareInstallerID)
+	require.Error(t, err)
+	require.ErrorIs(t, err, errDeleteInstallerWithAssociatedPolicy)
+
+	_, err = ds.DeleteTeamPolicies(ctx, team1.ID, []uint{p1.ID})
+	require.NoError(t, err)
+
+	err = ds.DeleteSoftwareInstaller(ctx, softwareInstallerID)
+	require.NoError(t, err)
+}
+
+func testGetHostLastInstallData(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
+	host1 := test.NewHost(t, ds, "host1", "1", "host1key", "host1uuid", time.Now(), test.WithTeamID(team1.ID))
+	host2 := test.NewHost(t, ds, "host2", "2", "host2key", "host2uuid", time.Now(), test.WithTeamID(team1.ID))
+
+	dir := t.TempDir()
+	store, err := filesystem.NewSoftwareInstallerStore(dir)
+	require.NoError(t, err)
+
+	// put an installer and save it in the DB
+	ins0 := "installer.pkg"
+	ins0File := bytes.NewReader([]byte("installer0"))
+	err = store.Put(ctx, ins0, ins0File)
+	require.NoError(t, err)
+
+	softwareInstallerID1, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "install",
+		InstallerFile: ins0File,
+		StorageID:     ins0,
+		Filename:      "installer.pkg",
+		Title:         "ins1",
+		Source:        "apps",
+		Platform:      "darwin",
+		TeamID:        &team1.ID,
+		UserID:        user1.ID,
+	})
+	require.NoError(t, err)
+	softwareInstallerID2, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "install2",
+		InstallerFile: ins0File,
+		StorageID:     ins0,
+		Filename:      "installer2.pkg",
+		Title:         "ins2",
+		Source:        "apps",
+		Platform:      "darwin",
+		TeamID:        &team1.ID,
+		UserID:        user1.ID,
+	})
+	require.NoError(t, err)
+
+	// No installations on host1 yet.
+	host1LastInstall, err := ds.GetHostLastInstallData(ctx, host1.ID, softwareInstallerID1)
+	require.NoError(t, err)
+	require.Nil(t, host1LastInstall)
+
+	// Install installer.pkg on host1.
+	installUUID1, err := ds.InsertSoftwareInstallRequest(ctx, host1.ID, softwareInstallerID1, false)
+	require.NoError(t, err)
+	require.NotEmpty(t, installUUID1)
+
+	// Last installation should be pending.
+	host1LastInstall, err = ds.GetHostLastInstallData(ctx, host1.ID, softwareInstallerID1)
+	require.NoError(t, err)
+	require.NotNil(t, host1LastInstall)
+	require.Equal(t, installUUID1, host1LastInstall.ExecutionID)
+	require.NotNil(t, host1LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallerPending, *host1LastInstall.Status)
+
+	// Set result of last installation.
+	err = ds.SetHostSoftwareInstallResult(ctx, &fleet.HostSoftwareInstallResultPayload{
+		HostID:      host1.ID,
+		InstallUUID: installUUID1,
+
+		InstallScriptExitCode: ptr.Int(0),
+	})
+	require.NoError(t, err)
+
+	// Last installation should be "installed".
+	host1LastInstall, err = ds.GetHostLastInstallData(ctx, host1.ID, softwareInstallerID1)
+	require.NoError(t, err)
+	require.NotNil(t, host1LastInstall)
+	require.Equal(t, installUUID1, host1LastInstall.ExecutionID)
+	require.NotNil(t, host1LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallerInstalled, *host1LastInstall.Status)
+
+	// Install installer2.pkg on host1.
+	installUUID2, err := ds.InsertSoftwareInstallRequest(ctx, host1.ID, softwareInstallerID2, false)
+	require.NoError(t, err)
+	require.NotEmpty(t, installUUID2)
+
+	// Last installation for installer1.pkg should be "installed".
+	host1LastInstall, err = ds.GetHostLastInstallData(ctx, host1.ID, softwareInstallerID1)
+	require.NoError(t, err)
+	require.NotNil(t, host1LastInstall)
+	require.Equal(t, installUUID1, host1LastInstall.ExecutionID)
+	require.NotNil(t, host1LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallerInstalled, *host1LastInstall.Status)
+	// Last installation for installer2.pkg should be "pending".
+	host1LastInstall, err = ds.GetHostLastInstallData(ctx, host1.ID, softwareInstallerID2)
+	require.NoError(t, err)
+	require.NotNil(t, host1LastInstall)
+	require.Equal(t, installUUID2, host1LastInstall.ExecutionID)
+	require.NotNil(t, host1LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallerPending, *host1LastInstall.Status)
+
+	// Perform another installation of installer1.pkg.
+	installUUID3, err := ds.InsertSoftwareInstallRequest(ctx, host1.ID, softwareInstallerID1, false)
+	require.NoError(t, err)
+	require.NotEmpty(t, installUUID3)
+
+	// Last installation for installer1.pkg should be "pending" again.
+	host1LastInstall, err = ds.GetHostLastInstallData(ctx, host1.ID, softwareInstallerID1)
+	require.NoError(t, err)
+	require.NotNil(t, host1LastInstall)
+	require.Equal(t, installUUID3, host1LastInstall.ExecutionID)
+	require.NotNil(t, host1LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallerPending, *host1LastInstall.Status)
+
+	// Set result of last installer1.pkg installation.
+	err = ds.SetHostSoftwareInstallResult(ctx, &fleet.HostSoftwareInstallResultPayload{
+		HostID:      host1.ID,
+		InstallUUID: installUUID3,
+
+		InstallScriptExitCode: ptr.Int(1),
+	})
+	require.NoError(t, err)
+
+	// Last installation for installer1.pkg should be "failed".
+	host1LastInstall, err = ds.GetHostLastInstallData(ctx, host1.ID, softwareInstallerID1)
+	require.NoError(t, err)
+	require.NotNil(t, host1LastInstall)
+	require.Equal(t, installUUID3, host1LastInstall.ExecutionID)
+	require.NotNil(t, host1LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallerFailed, *host1LastInstall.Status)
+
+	// No installations on host2.
+	host2LastInstall, err := ds.GetHostLastInstallData(ctx, host2.ID, softwareInstallerID1)
+	require.NoError(t, err)
+	require.Nil(t, host2LastInstall)
+	host2LastInstall, err = ds.GetHostLastInstallData(ctx, host2.ID, softwareInstallerID2)
+	require.NoError(t, err)
+	require.Nil(t, host2LastInstall)
 }
diff --git a/server/datastore/mysql/software_test.go b/server/datastore/mysql/software_test.go
index 21ef4e5517c1..75dfc8d2d04a 100644
--- a/server/datastore/mysql/software_test.go
+++ b/server/datastore/mysql/software_test.go
@@ -1,6 +1,7 @@
 package mysql
 
 import (
+	"bytes"
 	"context"
 	"database/sql"
 	"encoding/hex"
@@ -64,10 +65,15 @@ func TestSoftware(t *testing.T) {
 		{"insertHostSoftwareInstalledPaths", testInsertHostSoftwareInstalledPaths},
 		{"VerifySoftwareChecksum", testVerifySoftwareChecksum},
 		{"ListHostSoftware", testListHostSoftware},
+		{"ListIOSHostSoftware", testListIOSHostSoftware},
 		{"SetHostSoftwareInstallResult", testSetHostSoftwareInstallResult},
+		{"ListHostSoftwareInstallThenTransferTeam", testListHostSoftwareInstallThenTransferTeam},
+		{"ListHostSoftwareInstallThenDeleteInstallers", testListHostSoftwareInstallThenDeleteInstallers},
+		{"ListSoftwareVersionsVulnerabilityFilters", testListSoftwareVersionsVulnerabilityFilters},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
+			t.Helper()
 			defer TruncateTables(t, ds)
 			c.fn(t, ds)
 		})
@@ -763,6 +769,17 @@ func testSoftwareList(t *testing.T, ds *Datastore) {
 		test.ElementsMatchSkipID(t, software, expected)
 	})
 
+	t.Run("filters by no team (team 0)", func(t *testing.T) {
+		opts := fleet.SoftwareListOptions{
+			TeamID:           ptr.Uint(0),
+			IncludeCVEScores: true,
+		}
+
+		software := listSoftwareCheckCount(t, ds, 4, 4, opts, true)
+		expected := []fleet.Software{bar003, baz001, foo002, foo003}
+		test.ElementsMatchSkipID(t, software, expected)
+	})
+
 	t.Run("filters vulnerable software", func(t *testing.T) {
 		opts := fleet.SoftwareListOptions{
 			ListOptions: fleet.ListOptions{
@@ -930,6 +947,7 @@ func testSoftwareList(t *testing.T, ds *Datastore) {
 }
 
 func listSoftwareCheckCount(t *testing.T, ds *Datastore, expectedListCount int, expectedFullCount int, opts fleet.SoftwareListOptions, returnSorted bool) []fleet.Software {
+	t.Helper()
 	software, meta, err := ds.ListSoftware(context.Background(), opts)
 	require.NoError(t, err)
 	require.Len(t, software, expectedListCount)
@@ -1047,7 +1065,7 @@ func testSoftwareSyncHostsSoftware(t *testing.T, ds *Datastore) {
 	require.NoError(t, ds.SyncHostsSoftware(ctx, time.Now()))
 
 	_ = listSoftwareCheckCount(t, ds, 16, 16, globalOpts, false)
-	checkTableTotalCount(16)
+	checkTableTotalCount(32)
 
 	// Now, delete 2 hosts. Software with the lowest ID is removed, and there should be a chunk with missing software IDs from the deleted hostTemp software.
 	require.NoError(t, ds.DeleteHost(ctx, host0.ID))
@@ -1062,7 +1080,7 @@ func testSoftwareSyncHostsSoftware(t *testing.T, ds *Datastore) {
 		{Name: "bar", Version: "0.0.3", HostsCount: 1},
 	}
 	cmpNameVersionCount(want, globalCounts)
-	checkTableTotalCount(4)
+	checkTableTotalCount(8)
 
 	// update host2, remove "bar" software
 	software2 = []fleet.Software{
@@ -1080,7 +1098,7 @@ func testSoftwareSyncHostsSoftware(t *testing.T, ds *Datastore) {
 		{Name: "foo", Version: "v0.0.2", HostsCount: 1},
 	}
 	cmpNameVersionCount(want, globalCounts)
-	checkTableTotalCount(3)
+	checkTableTotalCount(6)
 
 	// create a software entry without any host and any counts
 	_, err = ds.writer(ctx).ExecContext(ctx, fmt.Sprintf(`INSERT INTO software (name, version, source, checksum) VALUES ('baz', '0.0.1', 'testing', %s)`, softwareChecksumComputedColumn("")))
@@ -1129,13 +1147,13 @@ func testSoftwareSyncHostsSoftware(t *testing.T, ds *Datastore) {
 		{Name: "foo", Version: "v0.0.2", HostsCount: 1},
 	}
 	cmpNameVersionCount(want, globalCounts)
-	checkTableTotalCount(3)
+	checkTableTotalCount(6)
 
 	team1Opts := fleet.SoftwareListOptions{WithHostCounts: true, TeamID: ptr.Uint(team1.ID), ListOptions: fleet.ListOptions{OrderKey: "hosts_count", OrderDirection: fleet.OrderDescending}}
 	team1Counts := listSoftwareCheckCount(t, ds, 0, 0, team1Opts, false)
 	want = []fleet.Software{}
 	cmpNameVersionCount(want, team1Counts)
-	checkTableTotalCount(3)
+	checkTableTotalCount(6)
 	require.NoError(t, ds.LoadHostSoftware(context.Background(), host1, false))
 	nilSoftware, err := ds.SoftwareByID(context.Background(), host1.HostSoftware.Software[0].ID, &team1.ID, false, nil)
 	assert.Nil(t, nilSoftware)
@@ -1160,8 +1178,8 @@ func testSoftwareSyncHostsSoftware(t *testing.T, ds *Datastore) {
 	}
 	cmpNameVersionCount(want, team1Counts)
 
-	// composite pk (software_id, team_id), so we expect more rows
-	checkTableTotalCount(8)
+	// composite pk (software_id, team_id, global_stats), so we expect more rows
+	checkTableTotalCount(11)
 
 	soft1ByID, err := ds.SoftwareByID(context.Background(), host1.HostSoftware.Software[0].ID, &team1.ID, false, nil)
 	require.NoError(t, err)
@@ -1207,7 +1225,7 @@ func testSoftwareSyncHostsSoftware(t *testing.T, ds *Datastore) {
 	}
 	cmpNameVersionCount(want, team2Counts)
 
-	checkTableTotalCount(6)
+	checkTableTotalCount(9)
 
 	// update host4 (team2), remove all software and delete team
 	software4 = []fleet.Software{}
@@ -1234,7 +1252,7 @@ func testSoftwareSyncHostsSoftware(t *testing.T, ds *Datastore) {
 	cmpNameVersionCount(want, team1Counts)
 
 	listSoftwareCheckCount(t, ds, 0, 0, team2Opts, false)
-	checkTableTotalCount(5)
+	checkTableTotalCount(8)
 }
 
 // softwareChecksumComputedColumn computes the checksum for a software entry
@@ -1940,11 +1958,14 @@ func testInsertSoftwareVulnerability(t *testing.T, ds *Datastore) {
 		require.NoError(t, err)
 		require.True(t, inserted)
 
-		inserted, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		// Sleep so that the updated_at timestamp is guaranteed to be updated.
+		time.Sleep(1 * time.Second)
+		insertedOrUpdated, err := ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
 			SoftwareID: host.Software[0].ID, CVE: "cve-1",
 		}, fleet.UbuntuOVALSource)
 		require.NoError(t, err)
-		require.False(t, inserted)
+		// This will always return true because we always update the timestamp
+		assert.True(t, insertedOrUpdated)
 
 		storedVulns, err := ds.ListSoftwareVulnerabilitiesByHostIDsSource(ctx, []uint{host.ID}, fleet.UbuntuOVALSource)
 		require.NoError(t, err)
@@ -1983,9 +2004,12 @@ func testInsertSoftwareVulnerability(t *testing.T, ds *Datastore) {
 		require.NoError(t, err)
 		require.True(t, inserted)
 
-		inserted, err = ds.InsertSoftwareVulnerability(ctx, vulns[0], fleet.UbuntuOVALSource)
+		// Sleep so that the updated_at timestamp is guaranteed to be updated.
+		time.Sleep(1 * time.Second)
+		insertedOrUpdated, err := ds.InsertSoftwareVulnerability(ctx, vulns[0], fleet.UbuntuOVALSource)
 		require.NoError(t, err)
-		require.False(t, inserted)
+		// This will always return true because we always update the timestamp
+		assert.True(t, insertedOrUpdated)
 
 		storedVulns, err := ds.ListSoftwareVulnerabilitiesByHostIDsSource(ctx, []uint{host.ID}, fleet.UbuntuOVALSource)
 		require.NoError(t, err)
@@ -2549,9 +2573,9 @@ func testDeleteOutOfDateVulnerabilities(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 
 	// This should update the 'updated_at' timestamp.
-	inserted, err = ds.InsertSoftwareVulnerability(ctx, vulns[0], fleet.NVDSource)
+	insertedOrUpdated, err := ds.InsertSoftwareVulnerability(ctx, vulns[0], fleet.NVDSource)
 	require.NoError(t, err)
-	require.False(t, inserted)
+	assert.True(t, insertedOrUpdated)
 
 	err = ds.DeleteOutOfDateVulnerabilities(ctx, fleet.NVDSource, 2*time.Hour)
 	require.NoError(t, err)
@@ -3140,10 +3164,21 @@ func testVerifySoftwareChecksum(t *testing.T, ds *Datastore) {
 
 func testListHostSoftware(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
-	host := test.NewHost(t, ds, "host1", "", "host1key", "host1uuid", time.Now(), test.WithPlatform("linux"))
-	otherHost := test.NewHost(t, ds, "host2", "", "host2key", "host2uuid", time.Now())
+	host := test.NewHost(t, ds, "host1", "", "host1key", "host1uuid", time.Now(), test.WithPlatform("darwin"))
+	nanoEnroll(t, ds, host, false)
+	otherHost := test.NewHost(t, ds, "host2", "", "host2key", "host2uuid", time.Now(), test.WithPlatform("linux"))
 	opts := fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{PerPage: 10, IncludeMetadata: true, OrderKey: "name", TestSecondaryOrderKey: "source"}}
 
+	user, err := ds.NewUser(ctx, &fleet.User{
+		Password:   []byte("p4ssw0rd.123"),
+		Name:       "user1",
+		Email:      "user1@example.com",
+		GlobalRole: ptr.String(fleet.RoleAdmin),
+	})
+	require.NoError(t, err)
+
+	test.CreateInsertGlobalVPPToken(t, ds)
+
 	expectStatus := func(s fleet.SoftwareInstallerStatus) *fleet.SoftwareInstallerStatus {
 		return &s
 	}
@@ -3161,7 +3196,15 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	require.Empty(t, sw)
 	require.Equal(t, &fleet.PaginationMetadata{}, meta)
 
+	// available for install only works too
+	opts.OnlyAvailableForInstall = true
+	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
+	require.NoError(t, err)
+	assert.Empty(t, sw)
+	assert.Equal(t, &fleet.PaginationMetadata{}, meta)
+
 	// self-service only works too
+	opts.OnlyAvailableForInstall = false
 	opts.SelfServiceOnly = true
 	opts.IncludeAvailableForInstall = true
 	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
@@ -3287,15 +3330,33 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 			require.True(t, ok)
 			require.Equal(t, e.Name, g.Name)
 			require.Equal(t, e.Source, g.Source)
-			if e.SelfService != nil {
-				// there is a software installer, so package information should be present
-				require.Equal(t, e.SelfService, g.SelfService)
-				require.NotNil(t, g.Package)
-				require.NotNil(t, g.PackageAvailableForInstall)
-				require.Equal(t, e.PackageAvailableForInstall, g.PackageAvailableForInstall)
-				require.Equal(t, *e.PackageAvailableForInstall, g.Package.Name)
-				require.NotEmpty(t, g.Package.Version)
+			if e.SoftwarePackage != nil {
+				require.Equal(t, e.SoftwarePackage.SelfService, g.SoftwarePackage.SelfService)
+				require.Equal(t, e.SoftwarePackage.IconURL, g.SoftwarePackage.IconURL)
+				require.Equal(t, e.SoftwarePackage.AppStoreID, g.SoftwarePackage.AppStoreID)
+				require.Equal(t, e.SoftwarePackage.Name, g.SoftwarePackage.Name)
+				require.Equal(t, e.SoftwarePackage.Version, g.SoftwarePackage.Version)
+				if e.SoftwarePackage.LastInstall != nil {
+					require.Equal(t, e.SoftwarePackage.LastInstall.CommandUUID, g.SoftwarePackage.LastInstall.CommandUUID)
+					require.Equal(t, e.SoftwarePackage.LastInstall.InstallUUID, g.SoftwarePackage.LastInstall.InstallUUID)
+					require.NotNil(t, g.SoftwarePackage.LastInstall.InstalledAt)
+				}
 			}
+
+			if e.AppStoreApp != nil {
+				require.Equal(t, e.AppStoreApp.SelfService, g.AppStoreApp.SelfService)
+				require.Equal(t, e.AppStoreApp.IconURL, g.AppStoreApp.IconURL)
+				require.Equal(t, e.AppStoreApp.AppStoreID, g.AppStoreApp.AppStoreID)
+				require.Equal(t, e.AppStoreApp.Name, g.AppStoreApp.Name)
+				require.Equal(t, e.AppStoreApp.Version, g.AppStoreApp.Version)
+				if e.AppStoreApp.LastInstall != nil {
+					require.Equal(t, e.AppStoreApp.LastInstall.InstallUUID, g.AppStoreApp.LastInstall.InstallUUID)
+					require.Equal(t, e.AppStoreApp.LastInstall.CommandUUID, g.AppStoreApp.LastInstall.CommandUUID)
+					require.NotNil(t, g.AppStoreApp.LastInstall.InstalledAt)
+				}
+			}
+			// require.Equal(t, e.SoftwarePackage, g.SoftwarePackage)
+			// require.Equal(t, e.AppStoreApp, g.AppStoreApp)
 			require.Len(t, g.InstalledVersions, len(e.InstalledVersions))
 			if len(e.InstalledVersions) > 0 {
 				byVers := make(map[string]fleet.HostSoftwareInstalledVersion, len(e.InstalledVersions))
@@ -3336,12 +3397,21 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	compareResults(expected, sw, true, byNSV[a2].Name+byNSV[a2].Source, byNSV[c1].Name+byNSV[c1].Source, byNSV[d].Name+byNSV[d].Source)
 	opts.VulnerableOnly = false
 
+	// No software that is available for install
+	opts.OnlyAvailableForInstall = true
+	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
+	require.NoError(t, err)
+	assert.Empty(t, sw)
+	assert.Equal(t, &fleet.PaginationMetadata{}, meta)
+	opts.OnlyAvailableForInstall = false
+
 	// create some Fleet installers and map them to a software title,
 	// including one for a team
 	tm, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
 	require.NoError(t, err)
 
 	var swi1Pending, swi2Installed, swi3Failed, swi4Available, swi5Tm uint
+	var otherHostI1UUID, otherHostI2UUID string
 	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
 		// keep title id of software B, will use it to associate an installer with it
 		var swbTitleID uint
@@ -3387,11 +3457,11 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 				globalOrTeamID = tm.ID
 			}
 			res, err := q.ExecContext(ctx, `
-				INSERT INTO software_installers
-					(team_id, global_or_team_id, title_id, filename, version, install_script_content_id, storage_id, platform, self_service)
-				VALUES
-					(?, ?, ?, ?, ?, ?, unhex(?), ?, ?)`,
-				teamID, globalOrTeamID, titleID, fmt.Sprintf("installer-%d.pkg", i), fmt.Sprintf("v%d.0.0", i), scriptContentID, hex.EncodeToString([]byte("test")), "linux", i < 2)
+						INSERT INTO software_installers
+							(team_id, global_or_team_id, title_id, filename, version, install_script_content_id, storage_id, platform, self_service)
+						VALUES
+							(?, ?, ?, ?, ?, ?, unhex(?), ?, ?)`,
+				teamID, globalOrTeamID, titleID, fmt.Sprintf("installer-%d.pkg", i), fmt.Sprintf("v%d.0.0", i), scriptContentID, hex.EncodeToString([]byte("test")), "darwin", i < 2)
 			if err != nil {
 				return err
 			}
@@ -3405,7 +3475,7 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 
 		// swi1 is pending (all results are NULL)
 		_, err = q.ExecContext(ctx, `
-					INSERT INTO host_software_installs (execution_id, host_id, software_installer_id) VALUES (?, ?, ?)`,
+							INSERT INTO host_software_installs (execution_id, host_id, software_installer_id) VALUES (?, ?, ?)`,
 			"uuid1", host.ID, swi1Pending)
 		if err != nil {
 			return err
@@ -3413,8 +3483,8 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 
 		// swi2 is installed
 		_, err = q.ExecContext(ctx, `
-					INSERT INTO host_software_installs (execution_id, host_id, software_installer_id, pre_install_query_output, install_script_exit_code, post_install_script_exit_code)
-					VALUES (?, ?, ?, ?, ?, ?)`,
+							INSERT INTO host_software_installs (execution_id, host_id, software_installer_id, pre_install_query_output, install_script_exit_code, post_install_script_exit_code)
+							VALUES (?, ?, ?, ?, ?, ?)`,
 			"uuid2", host.ID, swi2Installed, "ok", 0, 0)
 		if err != nil {
 			return err
@@ -3422,23 +3492,25 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 
 		// swi3 is failed, also add an install request on the other host
 		_, err = q.ExecContext(ctx, `
-					INSERT INTO host_software_installs (execution_id, host_id, software_installer_id, pre_install_query_output, install_script_exit_code)
-					VALUES (?, ?, ?, ?, ?)`,
+							INSERT INTO host_software_installs (execution_id, host_id, software_installer_id, pre_install_query_output, install_script_exit_code)
+							VALUES (?, ?, ?, ?, ?)`,
 			"uuid3", host.ID, swi3Failed, "ok", 1)
 		if err != nil {
 			return err
 		}
+		otherHostI1UUID = uuid.NewString()
 		_, err = q.ExecContext(ctx, `
-					INSERT INTO host_software_installs (execution_id, host_id, software_installer_id) VALUES (?, ?, ?)`,
-			uuid.NewString(), otherHost.ID, swi3Failed)
+							INSERT INTO host_software_installs (execution_id, host_id, software_installer_id) VALUES (?, ?, ?)`,
+			otherHostI1UUID, otherHost.ID, swi3Failed)
 		if err != nil {
 			return err
 		}
 
 		// swi4 is available (no install request), but add a pending request on the other host
+		otherHostI2UUID = uuid.NewString()
 		_, err = q.ExecContext(ctx, `
-					INSERT INTO host_software_installs (execution_id, host_id, software_installer_id) VALUES (?, ?, ?)`,
-			uuid.NewString(), otherHost.ID, swi4Available)
+							INSERT INTO host_software_installs (execution_id, host_id, software_installer_id) VALUES (?, ?, ?)`,
+			otherHostI2UUID, otherHost.ID, swi4Available)
 		if err != nil {
 			return err
 		}
@@ -3453,10 +3525,10 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 		}
 		lid, _ := res.LastInsertId()
 		_, err = q.ExecContext(ctx, `
-				INSERT INTO software_installers
-					(team_id, global_or_team_id, title_id, filename, version, install_script_content_id, storage_id, platform)
-				VALUES
-					(?, ?, ?, ?, ?, ?, unhex(?), ?)`,
+						INSERT INTO software_installers
+							(team_id, global_or_team_id, title_id, filename, version, install_script_content_id, storage_id, platform)
+						VALUES
+							(?, ?, ?, ?, ?, ?, unhex(?), ?)`,
 			nil, 0, lid, "windows-installer-6.msi", "v6.0.0", scriptContentID, hex.EncodeToString([]byte("test")), "windows")
 		if err != nil {
 			return err
@@ -3467,33 +3539,27 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 
 	// swi1Pending uses software title id of "b"
 	expected[byNSV[b].Name+byNSV[b].Source] = fleet.HostSoftwareWithInstaller{
-		Name:                       "b",
-		Source:                     "apps",
-		Status:                     expectStatus(fleet.SoftwareInstallerPending),
-		LastInstall:                &fleet.HostSoftwareInstall{InstallUUID: "uuid1"},
-		PackageAvailableForInstall: ptr.String("installer-0.pkg"),
-		SelfService:                ptr.Bool(true),
+		Name:            "b",
+		Source:          "apps",
+		Status:          expectStatus(fleet.SoftwareInstallerPending),
+		SoftwarePackage: &fleet.SoftwarePackageOrApp{Name: "installer-0.pkg", Version: "v0.0.0", SelfService: ptr.Bool(true), LastInstall: &fleet.HostSoftwareInstall{InstallUUID: "uuid1"}},
 		InstalledVersions: []*fleet.HostSoftwareInstalledVersion{
 			{Version: byNSV[b].Version, Vulnerabilities: []string{vulns[3].CVE}, InstalledPaths: []string{installPaths[2]}},
 		},
 	}
 	i0 := fleet.HostSoftwareWithInstaller{
-		Name:                       "i0",
-		Source:                     "apps",
-		Status:                     expectStatus(fleet.SoftwareInstallerInstalled),
-		LastInstall:                &fleet.HostSoftwareInstall{InstallUUID: "uuid2"},
-		SelfService:                ptr.Bool(true),
-		PackageAvailableForInstall: ptr.String("installer-1.pkg"),
+		Name:            "i0",
+		Source:          "apps",
+		Status:          expectStatus(fleet.SoftwareInstallerInstalled),
+		SoftwarePackage: &fleet.SoftwarePackageOrApp{Name: "installer-1.pkg", Version: "v1.0.0", SelfService: ptr.Bool(true), LastInstall: &fleet.HostSoftwareInstall{InstallUUID: "uuid2"}},
 	}
 	expected[i0.Name+i0.Source] = i0
 
 	i1 := fleet.HostSoftwareWithInstaller{
-		Name:                       "i1",
-		Source:                     "apps",
-		Status:                     expectStatus(fleet.SoftwareInstallerFailed),
-		LastInstall:                &fleet.HostSoftwareInstall{InstallUUID: "uuid3"},
-		SelfService:                ptr.Bool(false),
-		PackageAvailableForInstall: ptr.String("installer-2.pkg"),
+		Name:            "i1",
+		Source:          "apps",
+		Status:          expectStatus(fleet.SoftwareInstallerFailed),
+		SoftwarePackage: &fleet.SoftwarePackageOrApp{Name: "installer-2.pkg", Version: "v2.0.0", SelfService: ptr.Bool(false), LastInstall: &fleet.HostSoftwareInstall{InstallUUID: "uuid3"}},
 	}
 	expected[i1.Name+i1.Source] = i1
 
@@ -3506,31 +3572,41 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 
 	// request with available software
 	i2 := fleet.HostSoftwareWithInstaller{
-		Name:                       "i2",
-		Source:                     "apps",
-		Status:                     nil,
-		LastInstall:                nil,
-		PackageAvailableForInstall: ptr.String("installer-3.pkg"),
-		SelfService:                ptr.Bool(false),
+		Name:            "i2",
+		Source:          "apps",
+		Status:          nil,
+		SoftwarePackage: &fleet.SoftwarePackageOrApp{Name: "installer-3.pkg", Version: "v3.0.0", SelfService: ptr.Bool(false)},
 	}
 	expected[i2.Name+i2.Source] = i2
 
 	i3 := fleet.HostSoftwareWithInstaller{
-		Name:                       "i3",
-		Source:                     "apps",
-		Status:                     nil,
-		LastInstall:                nil,
-		PackageAvailableForInstall: ptr.String("installer-4.pkg"),
-		SelfService:                ptr.Bool(false),
+		Name:            "i3",
+		Source:          "apps",
+		Status:          nil,
+		SoftwarePackage: &fleet.SoftwarePackageOrApp{Name: "installer-4.pkg", Version: "v4.0.0", SelfService: ptr.Bool(false)},
 	}
 	expected[i3.Name+i3.Source] = i3
 
 	opts.IncludeAvailableForInstall = true
+	opts.ListOptions.PerPage = 20
 	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
 	require.NoError(t, err)
 	require.Equal(t, &fleet.PaginationMetadata{TotalResults: 8}, meta)
 	compareResults(expected, sw, true, i3.Name+i3.Source)
 
+	// request with available software only (attempted to install and never attempted to install)
+	expectedAvailableOnly := map[string]fleet.HostSoftwareWithInstaller{}
+	expectedAvailableOnly[byNSV[b].Name+byNSV[b].Source] = expected[byNSV[b].Name+byNSV[b].Source]
+	expectedAvailableOnly[i0.Name+i0.Source] = i0
+	expectedAvailableOnly[i1.Name+i1.Source] = i1
+	expectedAvailableOnly[i2.Name+i2.Source] = i2
+	opts.OnlyAvailableForInstall = true
+	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
+	require.NoError(t, err)
+	assert.Equal(t, &fleet.PaginationMetadata{TotalResults: uint(len(expectedAvailableOnly))}, meta)
+	compareResults(expectedAvailableOnly, sw, true)
+	opts.OnlyAvailableForInstall = false
+
 	// request in descending order
 	opts.ListOptions.OrderDirection = fleet.OrderDescending
 	opts.ListOptions.TestSecondaryOrderDirection = fleet.OrderDescending
@@ -3554,8 +3630,8 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
 		// swi3 has a new install request pending
 		_, err = q.ExecContext(ctx, `
-					INSERT INTO host_software_installs (execution_id, host_id, software_installer_id)
-					VALUES (?, ?, ?)`,
+							INSERT INTO host_software_installs (execution_id, host_id, software_installer_id)
+							VALUES (?, ?, ?)`,
 			"uuid4", host.ID, swi3Failed)
 		if err != nil {
 			return err
@@ -3564,24 +3640,22 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	})
 
 	expected[byNSV[b].Name+byNSV[b].Source] = fleet.HostSoftwareWithInstaller{
-		Name:                       "b",
-		Source:                     "apps",
-		Status:                     expectStatus(fleet.SoftwareInstallerFailed),
-		LastInstall:                &fleet.HostSoftwareInstall{InstallUUID: "uuid1"},
-		PackageAvailableForInstall: ptr.String("installer-0.pkg"),
-		SelfService:                ptr.Bool(true),
+		Name:            "b",
+		Source:          "apps",
+		Status:          expectStatus(fleet.SoftwareInstallerFailed),
+		SoftwarePackage: &fleet.SoftwarePackageOrApp{Name: "installer-0.pkg", Version: "v0.0.0", SelfService: ptr.Bool(true), LastInstall: &fleet.HostSoftwareInstall{InstallUUID: "uuid1"}},
 		InstalledVersions: []*fleet.HostSoftwareInstalledVersion{
 			{Version: byNSV[b].Version, Vulnerabilities: []string{vulns[3].CVE}, InstalledPaths: []string{installPaths[2]}},
 		},
 	}
 	expected[i1.Name+i1.Source] = fleet.HostSoftwareWithInstaller{
-		Name:                       "i1",
-		Source:                     "apps",
-		Status:                     expectStatus(fleet.SoftwareInstallerPending),
-		LastInstall:                &fleet.HostSoftwareInstall{InstallUUID: "uuid4"},
-		SelfService:                ptr.Bool(false),
-		PackageAvailableForInstall: ptr.String("installer-2.pkg"),
+		Name:            "i1",
+		Source:          "apps",
+		Status:          expectStatus(fleet.SoftwareInstallerPending),
+		SoftwarePackage: &fleet.SoftwarePackageOrApp{Name: "installer-2.pkg", Version: "v2.0.0", SelfService: ptr.Bool(false), LastInstall: &fleet.HostSoftwareInstall{InstallUUID: "uuid4"}},
 	}
+	expectedAvailableOnly[byNSV[b].Name+byNSV[b].Source] = expected[byNSV[b].Name+byNSV[b].Source]
+	expectedAvailableOnly[i1.Name+i1.Source] = expected[i1.Name+i1.Source]
 
 	// request without available software
 	opts.IncludeAvailableForInstall = false
@@ -3598,9 +3672,11 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	compareResults(expected, sw, true, i3.Name+i3.Source)
 
 	// create a new host in the team, with no software
-	tmHost := test.NewHost(t, ds, "host3", "", "host3key", "host3uuid", time.Now(), test.WithPlatform("linux"))
+	tmHost := test.NewHost(t, ds, "host3", "", "host3key", "host3uuid", time.Now(), test.WithPlatform("darwin"))
+	nanoEnroll(t, ds, tmHost, false)
 	err = ds.AddHostsToTeam(ctx, &tm.ID, []uint{tmHost.ID})
 	require.NoError(t, err)
+	tmHost.TeamID = &tm.ID
 
 	// no installed software for this host
 	opts.IncludeAvailableForInstall = false
@@ -3645,6 +3721,144 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	require.Empty(t, sw)
 
+	// add VPP apps, one for both no team and team, and two for no-team only.
+	va1, err := ds.InsertVPPAppWithTeam(ctx,
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.MacOSPlatform}}, Name: "vpp1",
+			BundleIdentifier: "com.app.vpp1",
+		}, nil)
+	require.NoError(t, err)
+	_, err = ds.InsertVPPAppWithTeam(ctx,
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.IOSPlatform}}, Name: "vpp1",
+			BundleIdentifier: "com.app.vpp1",
+		}, nil)
+	require.NoError(t, err)
+	_, err = ds.InsertVPPAppWithTeam(ctx,
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.MacOSPlatform}}, Name: "vpp1",
+			BundleIdentifier: "com.app.vpp1",
+		}, &tm.ID)
+	require.NoError(t, err)
+	vpp1 := va1.AdamID
+	va2, err := ds.InsertVPPAppWithTeam(ctx,
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_2", Platform: fleet.MacOSPlatform}}, Name: "vpp2",
+			BundleIdentifier: "com.app.vpp2",
+		}, nil)
+	require.NoError(t, err)
+	// create vpp3 app that allows self-service
+	va3, err := ds.InsertVPPAppWithTeam(ctx,
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_3", Platform: fleet.MacOSPlatform}, SelfService: true}, Name: "vpp3",
+			BundleIdentifier: "com.app.vpp3",
+		}, nil)
+	require.NoError(t, err)
+	vpp2, vpp3 := va2.AdamID, va3.AdamID
+
+	// create an installation request for vpp1 and vpp2, leaving vpp3 as
+	// available only
+	vpp1CmdUUID := createVPPAppInstallRequest(t, ds, host, vpp1, user.ID)
+	vpp2CmdUUID := createVPPAppInstallRequest(t, ds, host, vpp2, user.ID)
+	// make vpp1 install a success, while vpp2 has its initial request as failed
+	// and a subsequent request as pending.
+	createVPPAppInstallResult(t, ds, host, vpp1CmdUUID, fleet.MDMAppleStatusAcknowledged)
+	createVPPAppInstallResult(t, ds, host, vpp2CmdUUID, fleet.MDMAppleStatusError)
+	time.Sleep(time.Second) // ensure a different created_at timestamp
+	vpp2bCmdUUID := createVPPAppInstallRequest(t, ds, host, vpp2, user.ID)
+	require.NotEmpty(t, vpp2bCmdUUID)
+	// add an install request for the team host on vpp1, should not impact
+	// main host
+	vpp1TmCmdUUID := createVPPAppInstallRequest(t, ds, tmHost, vpp1, user.ID)
+	require.NotEmpty(t, vpp1TmCmdUUID)
+
+	expected["vpp1apps"] = fleet.HostSoftwareWithInstaller{
+		Name:        "vpp1",
+		Source:      "apps",
+		Status:      expectStatus(fleet.SoftwareInstallerInstalled),
+		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp1, SelfService: ptr.Bool(false), LastInstall: &fleet.HostSoftwareInstall{CommandUUID: vpp1CmdUUID}},
+	}
+	expected["vpp2apps"] = fleet.HostSoftwareWithInstaller{
+		Name:        "vpp2",
+		Source:      "apps",
+		Status:      expectStatus(fleet.SoftwareInstallerPending),
+		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp2, SelfService: ptr.Bool(false), LastInstall: &fleet.HostSoftwareInstall{CommandUUID: vpp2bCmdUUID}},
+	}
+
+	opts.IncludeAvailableForInstall = false
+	opts.ListOptions.MatchQuery = ""
+	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.PaginationMetadata{TotalResults: 9}, meta)
+	compareResults(expected, sw, true, i3.Name+i3.Source, i2.Name+i2.Source) // i3 is for team, i2 is available (excluded)
+
+	expected["vpp3apps"] = fleet.HostSoftwareWithInstaller{
+		Name:        "vpp3",
+		Source:      "apps",
+		Status:      nil,
+		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp3, SelfService: ptr.Bool(true)},
+	}
+	expectedAvailableOnly["vpp1apps"] = expected["vpp1apps"]
+	expectedAvailableOnly["vpp2apps"] = expected["vpp2apps"]
+	expectedAvailableOnly["vpp3apps"] = expected["vpp3apps"]
+	opts.IncludeAvailableForInstall = true
+	opts.ListOptions.PerPage = 20
+	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.PaginationMetadata{TotalResults: 11}, meta)
+	compareResults(expected, sw, true, i3.Name+i3.Source) // i3 is for team
+
+	// Available for install only
+	opts.OnlyAvailableForInstall = true
+	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
+	require.NoError(t, err)
+	assert.Equal(t, &fleet.PaginationMetadata{TotalResults: uint(len(expectedAvailableOnly))}, meta)
+	compareResults(expectedAvailableOnly, sw, true)
+	opts.OnlyAvailableForInstall = false
+
+	// team host sees available i3 and pending vpp1
+	opts.IncludeAvailableForInstall = true
+	sw, meta, err = ds.ListHostSoftware(ctx, tmHost, opts)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.PaginationMetadata{TotalResults: 2}, meta)
+	compareResults(map[string]fleet.HostSoftwareWithInstaller{
+		i3.Name + i3.Source: expected[i3.Name+i3.Source],
+		"vpp1apps": {
+			Name:        "vpp1",
+			Source:      "apps",
+			Status:      expectStatus(fleet.SoftwareInstallerPending),
+			AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp1, SelfService: ptr.Bool(false), LastInstall: &fleet.HostSoftwareInstall{CommandUUID: vpp1TmCmdUUID}},
+		},
+	}, sw, true)
+
+	// other host does not see available VPP apps because it is a linux host
+	opts.IncludeAvailableForInstall = true
+	sw, meta, err = ds.ListHostSoftware(ctx, otherHost, opts)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.PaginationMetadata{TotalResults: 4}, meta)
+
+	expectedOther := map[string]fleet.HostSoftwareWithInstaller{
+		otherSoftware[0].Name + otherSoftware[0].Source: {Name: otherSoftware[0].Name, Source: otherSoftware[0].Source, InstalledVersions: []*fleet.HostSoftwareInstalledVersion{
+			{Version: otherSoftware[0].Version},
+		}},
+		otherSoftware[1].Name + otherSoftware[1].Source: {Name: otherSoftware[1].Name, Source: otherSoftware[1].Source, InstalledVersions: []*fleet.HostSoftwareInstalledVersion{
+			{Version: otherSoftware[1].Version},
+		}},
+		"i1apps": {
+			Name:            "i1",
+			Source:          "apps",
+			Status:          expectStatus(fleet.SoftwareInstallerPending),
+			SoftwarePackage: &fleet.SoftwarePackageOrApp{Name: "installer-2.pkg", Version: "v2.0.0", SelfService: ptr.Bool(false), LastInstall: &fleet.HostSoftwareInstall{InstallUUID: otherHostI1UUID}},
+		},
+		"i2apps": {
+			Name:            "i2",
+			Source:          "apps",
+			Status:          expectStatus(fleet.SoftwareInstallerPending),
+			SoftwarePackage: &fleet.SoftwarePackageOrApp{Name: "installer-3.pkg", Version: "v3.0.0", SelfService: ptr.Bool(false), LastInstall: &fleet.HostSoftwareInstall{InstallUUID: otherHostI2UUID}},
+		},
+	}
+	compareResults(expectedOther, sw, true)
+
 	// test the pagination
 	cases := []struct {
 		opts      fleet.HostSoftwareTitleListOptions
@@ -3654,47 +3868,57 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 		{
 			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{PerPage: 3}, IncludeAvailableForInstall: false},
 			wantNames: []string{byNSV[a1].Name, byNSV[a2].Name, byNSV[b].Name},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: false, TotalResults: 7},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: false, TotalResults: 9},
 		},
 		{
 			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 1, PerPage: 3}, IncludeAvailableForInstall: false},
 			wantNames: []string{byNSV[c1].Name, byNSV[d].Name, i0.Name},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: true, TotalResults: 7},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: true, TotalResults: 9},
 		},
 		{
 			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 2, PerPage: 3}, IncludeAvailableForInstall: false},
-			wantNames: []string{i1.Name},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 7},
+			wantNames: []string{i1.Name, "vpp1", "vpp2"},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 9},
 		},
 		{
 			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 3, PerPage: 3}, IncludeAvailableForInstall: false},
 			wantNames: []string{},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 7},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 9},
 		},
 		{
 			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{PerPage: 4}, IncludeAvailableForInstall: true},
 			wantNames: []string{byNSV[a1].Name, byNSV[a2].Name, byNSV[b].Name, byNSV[c1].Name},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: false, TotalResults: 8},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: false, TotalResults: 11},
 		},
 		{
 			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 1, PerPage: 4}, IncludeAvailableForInstall: true},
 			wantNames: []string{byNSV[d].Name, i0.Name, i1.Name, i2.Name},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 8},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: true, TotalResults: 11},
 		},
 		{
 			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 2, PerPage: 4}, IncludeAvailableForInstall: true},
-			wantNames: []string{},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 8},
+			wantNames: []string{"vpp1", "vpp2", "vpp3"},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 11},
 		},
 		{
-			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{PerPage: 2}, IncludeAvailableForInstall: true, SelfServiceOnly: true},
-			wantNames: []string{byNSV[b].Name, i0.Name},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: false, TotalResults: 2},
+			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{PerPage: 3}, IncludeAvailableForInstall: true, SelfServiceOnly: true},
+			wantNames: []string{byNSV[b].Name, i0.Name, "vpp3"},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: false, TotalResults: 3},
 		},
 		{
-			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 1, PerPage: 2}, IncludeAvailableForInstall: true, SelfServiceOnly: true},
+			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 1, PerPage: 3}, IncludeAvailableForInstall: true, SelfServiceOnly: true},
 			wantNames: []string{},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 2},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 3},
+		},
+		{
+			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 0, PerPage: 4}, OnlyAvailableForInstall: true},
+			wantNames: []string{byNSV[b].Name, "i0", "i1", "i2"},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: false, TotalResults: 7},
+		},
+		{
+			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 1, PerPage: 4}, OnlyAvailableForInstall: true},
+			wantNames: []string{"vpp1", "vpp2", "vpp3"},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 7},
 		},
 	}
 	for _, c := range cases {
@@ -3707,18 +3931,329 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 			sw, meta, err := ds.ListHostSoftware(ctx, host, c.opts)
 			require.NoError(t, err)
 
-			require.Equal(t, len(c.wantNames), len(sw))
-			require.Equal(t, c.wantMeta, meta)
-
 			names := make([]string, 0, len(sw))
 			for _, s := range sw {
 				names = append(names, s.Name)
 			}
-			require.Equal(t, c.wantNames, names)
+			assert.Equal(t, c.wantNames, names)
+			assert.Equal(t, c.wantMeta, meta)
 		})
 	}
 }
 
+func testListIOSHostSoftware(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+	host := test.NewHost(t, ds, "host1", "", "host1key", "host1uuid", time.Now(), test.WithPlatform("ios"))
+	nanoEnroll(t, ds, host, false)
+	opts := fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{
+		PerPage: 10, IncludeMetadata: true, OrderKey: "name",
+		TestSecondaryOrderKey: "source",
+	}}
+
+	test.CreateInsertGlobalVPPToken(t, ds)
+
+	user, err := ds.NewUser(ctx, &fleet.User{
+		Password:   []byte("p4ssw0rd.123"),
+		Name:       "userIOS",
+		Email:      "userIOS@example.com",
+		GlobalRole: ptr.String(fleet.RoleAdmin),
+	})
+	require.NoError(t, err)
+
+	expectStatus := func(s fleet.SoftwareInstallerStatus) *fleet.SoftwareInstallerStatus {
+		return &s
+	}
+
+	// no software yet
+	sw, meta, err := ds.ListHostSoftware(ctx, host, opts)
+	require.NoError(t, err)
+	assert.Empty(t, sw)
+	assert.Equal(t, &fleet.PaginationMetadata{}, meta)
+
+	// add software to the host
+	software := []fleet.Software{
+		{Name: "a", Version: "0.0.1", Source: "ios_apps"},
+		{Name: "b", Version: "0.0.2", Source: "ios_apps"},
+		{Name: "c", Version: "0.0.3", Source: "ios_apps"},
+		{Name: "c", Version: "0.0.4", Source: "ios_apps"},
+	}
+	byNSV := map[string]fleet.Software{}
+	for _, s := range software {
+		byNSV[s.Name+s.Source+s.Version] = s
+	}
+
+	mutationResults, err := ds.UpdateHostSoftware(ctx, host.ID, software)
+	require.NoError(t, err)
+	assert.Len(t, mutationResults.Inserted, len(software))
+	for _, m := range mutationResults.Inserted {
+		s, ok := byNSV[m.Name+m.Source+m.Version]
+		assert.True(t, ok)
+		assert.Equal(t, m.Name, s.Name, "name")
+		assert.Equal(t, m.Version, s.Version, "version")
+		assert.Equal(t, m.Source, s.Source, "source")
+		assert.Zero(t, s.ID) // not set in the map yet
+		assert.NotZero(t, m.ID)
+		s.ID = m.ID
+		byNSV[s.Name+s.Source+s.Version] = s
+
+	}
+
+	assert.NoError(t, ds.LoadHostSoftware(ctx, host, false))
+	assert.Equal(t, len(host.Software), len(software))
+	for _, hs := range host.Software {
+		s, ok := byNSV[hs.Name+hs.Source+hs.Version]
+		assert.True(t, ok)
+		assert.Equal(t, hs.Name, s.Name, "name")
+		assert.Equal(t, hs.Version, s.Version, "version")
+		assert.Equal(t, hs.Source, s.Source, "source")
+		assert.Equal(t, hs.ID, s.ID)
+	}
+
+	// shorthand keys for expected software
+	getKey := func(i int) string {
+		return software[i].Name + software[i].Source + software[i].Version
+	}
+	a1 := getKey(0)
+	b := getKey(1)
+	c1 := getKey(2)
+	c2 := getKey(3)
+
+	// add some vulnerabilities
+	vulns := []fleet.SoftwareVulnerability{
+		{SoftwareID: byNSV[a1].ID, CVE: "CVE-a-0001"},
+		{SoftwareID: byNSV[a1].ID, CVE: "CVE-a-0002"},
+		{SoftwareID: byNSV[a1].ID, CVE: "CVE-a-0003"},
+		{SoftwareID: byNSV[b].ID, CVE: "CVE-b-0001"},
+	}
+	for _, v := range vulns {
+		_, err = ds.InsertSoftwareVulnerability(ctx, v, fleet.NVDSource)
+		require.NoError(t, err)
+	}
+
+	err = ds.ReconcileSoftwareTitles(ctx)
+	require.NoError(t, err)
+
+	expected := map[string]fleet.HostSoftwareWithInstaller{
+		byNSV[a1].Name + byNSV[a1].Source: {
+			Name: byNSV[a1].Name, Source: byNSV[a1].Source,
+			InstalledVersions: []*fleet.HostSoftwareInstalledVersion{
+				{Version: byNSV[a1].Version, Vulnerabilities: []string{vulns[0].CVE, vulns[1].CVE, vulns[2].CVE}},
+			},
+		},
+		byNSV[b].Name + byNSV[b].Source: {
+			Name: byNSV[b].Name, Source: byNSV[b].Source,
+			InstalledVersions: []*fleet.HostSoftwareInstalledVersion{
+				{Version: byNSV[b].Version, Vulnerabilities: []string{vulns[3].CVE}},
+			},
+		},
+		// c1 and c2 are the same software title because they have the same name and source
+		byNSV[c1].Name + byNSV[c1].Source: {
+			Name: byNSV[c1].Name, Source: byNSV[c1].Source,
+			InstalledVersions: []*fleet.HostSoftwareInstalledVersion{
+				{Version: byNSV[c1].Version},
+				{Version: byNSV[c2].Version},
+			},
+		},
+	}
+
+	compareResults := func(expected map[string]fleet.HostSoftwareWithInstaller, got []*fleet.HostSoftwareWithInstaller, expectAsc bool,
+		expectOmitted ...string,
+	) {
+		require.Len(t, got, len(expected)-len(expectOmitted))
+		prev := ""
+		for _, g := range got {
+			e, ok := expected[g.Name+g.Source]
+			require.True(t, ok, "unexpected software name:%s source:%s", g.Name, g.Source)
+			require.Equal(t, e.Name, g.Name)
+			require.Equal(t, e.Source, g.Source)
+			if e.SoftwarePackage != nil {
+				require.Equal(t, e.SoftwarePackage.SelfService, g.SoftwarePackage.SelfService)
+				require.Equal(t, e.SoftwarePackage.IconURL, g.SoftwarePackage.IconURL)
+				require.Equal(t, e.SoftwarePackage.AppStoreID, g.SoftwarePackage.AppStoreID)
+				require.Equal(t, e.SoftwarePackage.Name, g.SoftwarePackage.Name)
+				require.Equal(t, e.SoftwarePackage.Version, g.SoftwarePackage.Version)
+				if e.SoftwarePackage.LastInstall != nil {
+					require.Equal(t, e.SoftwarePackage.LastInstall.CommandUUID, g.SoftwarePackage.LastInstall.CommandUUID)
+					require.Equal(t, e.SoftwarePackage.LastInstall.InstallUUID, g.SoftwarePackage.LastInstall.InstallUUID)
+					require.NotNil(t, g.SoftwarePackage.LastInstall.InstalledAt)
+				}
+			}
+
+			if e.AppStoreApp != nil {
+				require.Equal(t, e.AppStoreApp.SelfService, g.AppStoreApp.SelfService)
+				require.Equal(t, e.AppStoreApp.IconURL, g.AppStoreApp.IconURL)
+				require.Equal(t, e.AppStoreApp.AppStoreID, g.AppStoreApp.AppStoreID)
+				require.Equal(t, e.AppStoreApp.Name, g.AppStoreApp.Name)
+				require.Equal(t, e.AppStoreApp.Version, g.AppStoreApp.Version)
+				if e.AppStoreApp.LastInstall != nil {
+					require.Equal(t, e.AppStoreApp.LastInstall.InstallUUID, g.AppStoreApp.LastInstall.InstallUUID)
+					require.Equal(t, e.AppStoreApp.LastInstall.CommandUUID, g.AppStoreApp.LastInstall.CommandUUID)
+					require.NotNil(t, g.AppStoreApp.LastInstall.InstalledAt)
+				}
+			}
+			require.Len(t, g.InstalledVersions, len(e.InstalledVersions))
+			if len(e.InstalledVersions) > 0 {
+				byVers := make(map[string]fleet.HostSoftwareInstalledVersion, len(e.InstalledVersions))
+				for _, v := range e.InstalledVersions {
+					byVers[v.Version] = *v
+				}
+				for _, v := range g.InstalledVersions {
+					ev, ok := byVers[v.Version]
+					require.True(t, ok)
+					require.Equal(t, ev.Version, v.Version)
+					require.ElementsMatch(t, ev.InstalledPaths, v.InstalledPaths)
+					require.ElementsMatch(t, ev.Vulnerabilities, v.Vulnerabilities)
+				}
+			}
+			if prev != "" {
+				if expectAsc {
+					require.Greater(t, g.Name+g.Source, prev)
+				} else {
+					require.Less(t, g.Name+g.Source, prev)
+				}
+			}
+			prev = g.Name + g.Source
+		}
+	}
+
+	// it now returns the software with vulnerabilities and installed paths
+	opts.SelfServiceOnly = false
+	opts.IncludeAvailableForInstall = false
+	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
+	require.NoError(t, err)
+	assert.Equal(t, &fleet.PaginationMetadata{TotalResults: uint(len(expected))}, meta)
+	compareResults(expected, sw, true)
+
+	opts.VulnerableOnly = true
+	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
+	require.NoError(t, err)
+	assert.Equal(t, &fleet.PaginationMetadata{TotalResults: uint(len(expected) - 1)}, meta)
+	compareResults(expected, sw, true, byNSV[c1].Name+byNSV[c1].Source)
+	opts.VulnerableOnly = false
+
+	// No software that is available for install
+	opts.OnlyAvailableForInstall = true
+	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
+	require.NoError(t, err)
+	assert.Empty(t, sw)
+	assert.Equal(t, &fleet.PaginationMetadata{}, meta)
+	opts.OnlyAvailableForInstall = false
+
+	// Create a team
+	tm, err := ds.NewTeam(ctx, &fleet.Team{Name: "mobile team"})
+	require.NoError(t, err)
+
+	// add VPP apps, one for both no team and team, and three for no-team only.
+	va1, err := ds.InsertVPPAppWithTeam(ctx,
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.IOSPlatform}}, Name: "vpp1",
+			BundleIdentifier: "com.app.vpp1",
+		}, nil)
+	require.NoError(t, err)
+	_, err = ds.InsertVPPAppWithTeam(ctx,
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.MacOSPlatform}}, Name: "vpp1",
+			BundleIdentifier: "com.app.vpp1",
+		}, nil)
+	require.NoError(t, err)
+	_, err = ds.InsertVPPAppWithTeam(ctx,
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.IPadOSPlatform}}, Name: "vpp1",
+			BundleIdentifier: "com.app.vpp1",
+		}, nil)
+	require.NoError(t, err)
+	_, err = ds.InsertVPPAppWithTeam(ctx,
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.IPadOSPlatform}}, Name: "vpp1",
+			BundleIdentifier: "com.app.vpp1",
+		}, &tm.ID)
+	require.NoError(t, err)
+	vpp1 := va1.AdamID
+	va2, err := ds.InsertVPPAppWithTeam(ctx,
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_2", Platform: fleet.IOSPlatform}}, Name: "vpp2",
+			BundleIdentifier: "com.app.vpp2",
+		}, nil)
+	require.NoError(t, err)
+	va3, err := ds.InsertVPPAppWithTeam(ctx,
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_3", Platform: fleet.IOSPlatform}}, Name: "vpp3",
+			BundleIdentifier: "com.app.vpp3",
+		}, nil)
+	require.NoError(t, err)
+	va4, err := ds.InsertVPPAppWithTeam(ctx,
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_4", Platform: fleet.IOSPlatform}}, Name: "vpp4",
+			BundleIdentifier: "com.app.vpp4",
+		}, nil)
+	require.NoError(t, err)
+	vpp2, vpp3, vpp4 := va2.AdamID, va3.AdamID, va4.AdamID
+
+	// create an installation request for vpp1 and vpp2, leaving vpp3 and vpp4 as
+	// available only
+	vpp1CmdUUID := createVPPAppInstallRequest(t, ds, host, vpp1, user.ID)
+	vpp2CmdUUID := createVPPAppInstallRequest(t, ds, host, vpp2, user.ID)
+	// make vpp1 install a success, while vpp2 has its initial request as failed
+	// and a subsequent request as pending.
+	createVPPAppInstallResult(t, ds, host, vpp1CmdUUID, fleet.MDMAppleStatusAcknowledged)
+	createVPPAppInstallResult(t, ds, host, vpp2CmdUUID, fleet.MDMAppleStatusError)
+	time.Sleep(time.Second) // ensure a different created_at timestamp
+	vpp2bCmdUUID := createVPPAppInstallRequest(t, ds, host, vpp2, user.ID)
+	require.NotEmpty(t, vpp2bCmdUUID)
+
+	expected["vpp1ios_apps"] = fleet.HostSoftwareWithInstaller{
+		Name:        "vpp1",
+		Source:      "ios_apps",
+		Status:      expectStatus(fleet.SoftwareInstallerInstalled),
+		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp1, SelfService: ptr.Bool(false), LastInstall: &fleet.HostSoftwareInstall{CommandUUID: vpp1CmdUUID}},
+	}
+	expected["vpp2ios_apps"] = fleet.HostSoftwareWithInstaller{
+		Name:        "vpp2",
+		Source:      "ios_apps",
+		Status:      expectStatus(fleet.SoftwareInstallerPending),
+		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp2, SelfService: ptr.Bool(false), LastInstall: &fleet.HostSoftwareInstall{CommandUUID: vpp2bCmdUUID}},
+	}
+
+	opts.IncludeAvailableForInstall = false
+	opts.ListOptions.MatchQuery = ""
+	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
+	require.NoError(t, err)
+	assert.Equal(t, &fleet.PaginationMetadata{TotalResults: uint(len(expected))}, meta)
+	compareResults(expected, sw, true) // i3 is for team, i2 is available (excluded)
+
+	expected["vpp3ios_apps"] = fleet.HostSoftwareWithInstaller{
+		Name:        "vpp3",
+		Source:      "ios_apps",
+		Status:      nil,
+		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp3, SelfService: ptr.Bool(false)},
+	}
+	expected["vpp4ios_apps"] = fleet.HostSoftwareWithInstaller{
+		Name:        "vpp4",
+		Source:      "ios_apps",
+		Status:      nil,
+		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp4, SelfService: ptr.Bool(false)},
+	}
+	expectedAvailableOnly := map[string]fleet.HostSoftwareWithInstaller{}
+	expectedAvailableOnly["vpp1ios_apps"] = expected["vpp1ios_apps"]
+	expectedAvailableOnly["vpp2ios_apps"] = expected["vpp2ios_apps"]
+	expectedAvailableOnly["vpp3ios_apps"] = expected["vpp3ios_apps"]
+	expectedAvailableOnly["vpp4ios_apps"] = expected["vpp4ios_apps"]
+	opts.IncludeAvailableForInstall = true
+	opts.ListOptions.PerPage = 20
+	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
+	require.NoError(t, err)
+	assert.Equal(t, &fleet.PaginationMetadata{TotalResults: uint(len(expected))}, meta)
+	compareResults(expected, sw, true)
+
+	// Available for install only
+	opts.OnlyAvailableForInstall = true
+	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
+	require.NoError(t, err)
+	assert.Equal(t, &fleet.PaginationMetadata{TotalResults: uint(len(expectedAvailableOnly))}, meta)
+	compareResults(expectedAvailableOnly, sw, true)
+	opts.OnlyAvailableForInstall = false
+}
+
 func testSetHostSoftwareInstallResult(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 	host := test.NewHost(t, ds, "host1", "", "host1key", "host1uuid", time.Now())
@@ -3855,3 +4390,663 @@ func testSetHostSoftwareInstallResult(t *testing.T, ds *Datastore) {
 	require.Error(t, err)
 	require.True(t, fleet.IsNotFound(err))
 }
+
+func testListHostSoftwareInstallThenTransferTeam(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+	user := test.NewUser(t, ds, "user1", "user1@example.com", false)
+	host := test.NewHost(t, ds, "host1", "", "host1key", "host1uuid", time.Now(), test.WithPlatform("darwin"))
+	nanoEnroll(t, ds, host, false)
+	opts := fleet.HostSoftwareTitleListOptions{
+		ListOptions:                fleet.ListOptions{PerPage: 10, IncludeMetadata: true, OrderKey: "name", TestSecondaryOrderKey: "source"},
+		IncludeAvailableForInstall: true,
+	}
+
+	test.CreateInsertGlobalVPPToken(t, ds)
+
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team 1"})
+	require.NoError(t, err)
+	team2, err := ds.NewTeam(ctx, &fleet.Team{Name: "team 2"})
+	require.NoError(t, err)
+
+	err = ds.AddHostsToTeam(ctx, &team1.ID, []uint{host.ID})
+	require.NoError(t, err)
+	host.TeamID = &team1.ID
+
+	// add a single "externally-installed" software for that host
+	software := []fleet.Software{
+		{Name: "a", Version: "0.0.1", Source: "chrome_extensions"},
+	}
+	_, err = ds.UpdateHostSoftware(ctx, host.ID, software)
+	require.NoError(t, err)
+
+	// create a software installer for team 1
+	installerTm1, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "hello",
+		InstallerFile: bytes.NewReader([]byte("hello")),
+		StorageID:     "storage1",
+		Filename:      "file1",
+		Title:         "file1",
+		Version:       "1.0",
+		Source:        "apps",
+		TeamID:        &team1.ID,
+		UserID:        user.ID,
+	})
+	require.NoError(t, err)
+
+	// install it on the host
+	hostInstall1, err := ds.InsertSoftwareInstallRequest(ctx, host.ID, installerTm1, false)
+	require.NoError(t, err)
+	err = ds.SetHostSoftwareInstallResult(ctx, &fleet.HostSoftwareInstallResultPayload{
+		HostID:                host.ID,
+		InstallUUID:           hostInstall1,
+		InstallScriptExitCode: ptr.Int(0),
+	})
+	require.NoError(t, err)
+
+	// add a VPP app for team 1
+	vppTm1, err := ds.InsertVPPAppWithTeam(ctx,
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.MacOSPlatform}}, Name: "vpp1",
+			BundleIdentifier: "com.app.vpp1",
+		}, &team1.ID)
+	require.NoError(t, err)
+
+	// fail to install it on the host
+	vpp1CmdUUID := createVPPAppInstallRequest(t, ds, host, vppTm1.AdamID, user.ID)
+	createVPPAppInstallResult(t, ds, host, vpp1CmdUUID, fleet.MDMAppleStatusError)
+
+	// add the successful installer to the reported installed software
+	software = []fleet.Software{
+		{Name: "a", Version: "0.0.1", Source: "chrome_extensions"},
+		{Name: "file1", Version: "1.0", Source: "apps"},
+	}
+	_, err = ds.UpdateHostSoftware(ctx, host.ID, software)
+	require.NoError(t, err)
+
+	// listing the host's software (including available for install) at this
+	// point lists "a", "file1" and "vpp1" (because of the install attempt)
+	sw, meta, err := ds.ListHostSoftware(ctx, host, opts)
+	require.NoError(t, err)
+	require.Len(t, sw, 3)
+	require.EqualValues(t, 3, meta.TotalResults)
+	require.Equal(t, sw[0].Name, "a")
+	require.Nil(t, sw[0].AppStoreApp)
+	require.Nil(t, sw[0].SoftwarePackage)
+	require.Equal(t, sw[1].Name, "file1")
+	require.Nil(t, sw[1].AppStoreApp)
+	require.NotNil(t, sw[1].SoftwarePackage)
+	require.Equal(t, sw[2].Name, "vpp1")
+	require.NotNil(t, sw[2].AppStoreApp)
+	require.Nil(t, sw[2].SoftwarePackage)
+
+	// move host to team 2
+	err = ds.AddHostsToTeam(ctx, &team2.ID, []uint{host.ID})
+	require.NoError(t, err)
+	host.TeamID = &team2.ID
+
+	// listing the host's software (including available for install) should now
+	// only list "a" and "file1" (because they are actually installed) and not
+	// link them to the installer/VPP app. With and without available software
+	// should result in the same rows (no available software in that new team).
+	for _, b := range []bool{true, false} {
+		opts.IncludeAvailableForInstall = b
+		sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
+		require.NoError(t, err)
+		require.Len(t, sw, 2)
+		require.EqualValues(t, 2, meta.TotalResults)
+		require.Equal(t, sw[0].Name, "a")
+		require.Nil(t, sw[0].AppStoreApp)
+		require.Nil(t, sw[0].SoftwarePackage)
+		require.Equal(t, sw[1].Name, "file1")
+		require.Nil(t, sw[1].AppStoreApp)
+		require.Nil(t, sw[1].SoftwarePackage)
+	}
+}
+
+func testListHostSoftwareInstallThenDeleteInstallers(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+	user := test.NewUser(t, ds, "user1", "user1@example.com", false)
+	host := test.NewHost(t, ds, "host1", "", "host1key", "host1uuid", time.Now(), test.WithPlatform("darwin"))
+	nanoEnroll(t, ds, host, false)
+	opts := fleet.HostSoftwareTitleListOptions{
+		ListOptions:                fleet.ListOptions{PerPage: 10, IncludeMetadata: true, OrderKey: "name", TestSecondaryOrderKey: "source"},
+		IncludeAvailableForInstall: true,
+	}
+
+	test.CreateInsertGlobalVPPToken(t, ds)
+
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team 1"})
+	require.NoError(t, err)
+
+	err = ds.AddHostsToTeam(ctx, &team1.ID, []uint{host.ID})
+	require.NoError(t, err)
+	host.TeamID = &team1.ID
+
+	// add a single "externally-installed" software for that host
+	software := []fleet.Software{
+		{Name: "a", Version: "0.0.1", Source: "chrome_extensions"},
+	}
+	_, err = ds.UpdateHostSoftware(ctx, host.ID, software)
+	require.NoError(t, err)
+
+	// create a software installer for team 1
+	installerTm1, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "hello",
+		InstallerFile: bytes.NewReader([]byte("hello")),
+		StorageID:     "storage1",
+		Filename:      "file1",
+		Title:         "file1",
+		Version:       "1.0",
+		Source:        "apps",
+		TeamID:        &team1.ID,
+		UserID:        user.ID,
+	})
+	require.NoError(t, err)
+
+	// fail to install it on the host
+	hostInstall1, err := ds.InsertSoftwareInstallRequest(ctx, host.ID, installerTm1, false)
+	require.NoError(t, err)
+	err = ds.SetHostSoftwareInstallResult(ctx, &fleet.HostSoftwareInstallResultPayload{
+		HostID:                host.ID,
+		InstallUUID:           hostInstall1,
+		InstallScriptExitCode: ptr.Int(1),
+	})
+	require.NoError(t, err)
+
+	// add a VPP app for team 1
+	vppTm1, err := ds.InsertVPPAppWithTeam(ctx,
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.MacOSPlatform}}, Name: "vpp1",
+			BundleIdentifier: "com.app.vpp1", LatestVersion: "1.0",
+		}, &team1.ID)
+	require.NoError(t, err)
+
+	// install it on the host
+	vpp1CmdUUID := createVPPAppInstallRequest(t, ds, host, vppTm1.AdamID, user.ID)
+	createVPPAppInstallResult(t, ds, host, vpp1CmdUUID, fleet.MDMAppleStatusAcknowledged)
+
+	// add the successful VPP app to the reported installed software
+	software = []fleet.Software{
+		{Name: "a", Version: "0.0.1", Source: "chrome_extensions"},
+		{Name: "vpp1", Version: "1.0", Source: "apps", BundleIdentifier: "com.app.vpp1"},
+	}
+	_, err = ds.UpdateHostSoftware(ctx, host.ID, software)
+	require.NoError(t, err)
+
+	// listing the host's software (including available for install) at this
+	// point lists "a", "file1" and "vpp1" (because of the install attempt)
+	sw, meta, err := ds.ListHostSoftware(ctx, host, opts)
+	require.NoError(t, err)
+	require.Len(t, sw, 3)
+	require.EqualValues(t, 3, meta.TotalResults)
+	require.Equal(t, sw[0].Name, "a")
+	require.Nil(t, sw[0].AppStoreApp)
+	require.Nil(t, sw[0].SoftwarePackage)
+	require.Equal(t, sw[1].Name, "file1")
+	require.Nil(t, sw[1].AppStoreApp)
+	require.NotNil(t, sw[1].SoftwarePackage)
+	require.Equal(t, sw[2].Name, "vpp1")
+	require.NotNil(t, sw[2].AppStoreApp)
+	require.Nil(t, sw[2].SoftwarePackage)
+
+	// delete both installers
+	err = ds.DeleteSoftwareInstaller(ctx, installerTm1)
+	require.NoError(t, err)
+	err = ds.DeleteVPPAppFromTeam(ctx, &team1.ID, vppTm1.VPPAppID)
+	require.NoError(t, err)
+
+	// listing the host's software (including available for install) should now
+	// only list "a" and "vpp1" (because they are actually installed) and not
+	// link them to the installer/VPP app. With and without available software
+	// should result in the same rows (no available software anymore).
+	for _, b := range []bool{true, false} {
+		opts.IncludeAvailableForInstall = b
+		sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
+		require.NoError(t, err)
+		require.Len(t, sw, 2)
+		require.EqualValues(t, 2, meta.TotalResults)
+		require.Equal(t, sw[0].Name, "a")
+		require.Nil(t, sw[0].AppStoreApp)
+		require.Nil(t, sw[0].SoftwarePackage)
+		require.Equal(t, sw[1].Name, "vpp1")
+		require.Nil(t, sw[1].AppStoreApp)
+		require.Nil(t, sw[1].SoftwarePackage)
+	}
+}
+
+func testListSoftwareVersionsVulnerabilityFilters(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+	host := test.NewHost(t, ds, "host", "", "hostkey", "hostuuid", time.Now())
+
+	software := []fleet.Software{
+		{Name: "chrome", Version: "0.0.1", Source: "apps"},
+		{Name: "chrome", Version: "0.0.3", Source: "apps"},
+		{Name: "safari", Version: "0.0.3", Source: "apps"},
+		{Name: "safari", Version: "0.0.1", Source: "apps"},
+		{Name: "firefox", Version: "0.0.3", Source: "apps"},
+		{Name: "edge", Version: "0.0.3", Source: "apps"},
+		{Name: "brave", Version: "0.0.3", Source: "apps"},
+		{Name: "opera", Version: "0.0.3", Source: "apps"},
+		{Name: "internet explorer", Version: "0.0.3", Source: "apps"},
+		{Name: "netscape", Version: "0.0.3", Source: "apps"},
+	}
+
+	sw, err := ds.UpdateHostSoftware(ctx, host.ID, software)
+	require.NoError(t, err)
+
+	var chrome001 uint
+	var safari001 uint
+	var firefox003 uint
+	var edge003 uint
+	var brave003 uint
+	var opera003 uint
+	var ie003 uint
+	for s := range sw.Inserted {
+		switch {
+		case sw.Inserted[s].Name == "chrome" && sw.Inserted[s].Version == "0.0.1":
+			chrome001 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "safari" && sw.Inserted[s].Version == "0.0.1":
+			safari001 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "firefox" && sw.Inserted[s].Version == "0.0.3":
+			firefox003 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "edge" && sw.Inserted[s].Version == "0.0.3":
+			edge003 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "brave" && sw.Inserted[s].Version == "0.0.3":
+			brave003 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "opera" && sw.Inserted[s].Version == "0.0.3":
+			opera003 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "internet explorer" && sw.Inserted[s].Version == "0.0.3":
+			ie003 = sw.Inserted[s].ID
+		}
+	}
+
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: chrome001,
+		CVE:        "CVE-2024-1234",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: safari001,
+		CVE:        "CVE-2024-1235",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: firefox003,
+		CVE:        "CVE-2024-1236",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: edge003,
+		CVE:        "CVE-2024-1237",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: brave003,
+		CVE:        "CVE-2024-1238",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: opera003,
+		CVE:        "CVE-2024-1239",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: ie003,
+		CVE:        "CVE-2024-1240",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+
+	err = ds.InsertCVEMeta(ctx, []fleet.CVEMeta{
+		{
+			// chrome
+			CVE:              "CVE-2024-1234",
+			CVSSScore:        ptr.Float64(7.5),
+			CISAKnownExploit: ptr.Bool(true),
+		},
+		{
+			// safari
+			CVE:              "CVE-2024-1235",
+			CVSSScore:        ptr.Float64(7.5),
+			CISAKnownExploit: ptr.Bool(false),
+		},
+		{
+			// firefox
+			CVE:              "CVE-2024-1236",
+			CVSSScore:        ptr.Float64(8.0),
+			CISAKnownExploit: ptr.Bool(true),
+		},
+		{
+			// edge
+			CVE:              "CVE-2024-1237",
+			CVSSScore:        ptr.Float64(8.0),
+			CISAKnownExploit: ptr.Bool(false),
+		},
+		{
+			// brave
+			CVE:              "CVE-2024-1238",
+			CVSSScore:        ptr.Float64(9.0),
+			CISAKnownExploit: ptr.Bool(true),
+		},
+		// CVE-2024-1239 for opera has no CVE Meta
+		{
+			// internet explorer
+			CVE:              "CVE-2024-1240",
+			CVSSScore:        nil,
+			CISAKnownExploit: nil,
+		},
+	})
+	require.NoError(t, err)
+
+	require.NoError(t, ds.SyncHostsSoftware(ctx, time.Now()))
+	require.NoError(t, ds.ReconcileSoftwareTitles(ctx))
+	require.NoError(t, ds.SyncHostsSoftwareTitles(ctx, time.Now()))
+
+	type swVersion struct {
+		Name    string
+		Version string
+	}
+
+	tc := []struct {
+		name     string
+		opts     fleet.SoftwareListOptions
+		expected []swVersion
+		err      error
+	}{
+		{
+			name: "vulnerable only",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:    fleet.ListOptions{OrderKey: "name"},
+				VulnerableOnly: true,
+			},
+			expected: []swVersion{
+				{
+					Name:    "brave",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "chrome",
+					Version: "0.0.1",
+				},
+				{
+					Name:    "edge",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "firefox",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "internet explorer",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "opera",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "safari",
+					Version: "0.0.1",
+				},
+			},
+		},
+		{
+			name: "known exploit true",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				KnownExploit:     true,
+			},
+			expected: []swVersion{
+				{
+					Name:    "brave",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "chrome",
+					Version: "0.0.1",
+				},
+				{
+					Name:    "firefox",
+					Version: "0.0.3",
+				},
+			},
+		},
+		{
+			name: "minimum cvss 8.0",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				MinimumCVSS:      8.0,
+			},
+			expected: []swVersion{
+				{
+					Name:    "brave",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "edge",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "firefox",
+					Version: "0.0.3",
+				},
+			},
+		},
+		{
+			name: "minimum cvss 7.9",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				MinimumCVSS:      7.9,
+			},
+			expected: []swVersion{
+				{
+					Name:    "brave",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "edge",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "firefox",
+					Version: "0.0.3",
+				},
+			},
+		},
+		{
+			name: "minimum cvss 8.0 and known exploit",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				MinimumCVSS:      8.0,
+				KnownExploit:     true,
+			},
+			expected: []swVersion{
+				{
+					Name:    "brave",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "firefox",
+					Version: "0.0.3",
+				},
+			},
+		},
+		{
+			name: "minimum cvss 7.5 and known exploit",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				MinimumCVSS:      7.5,
+				KnownExploit:     true,
+			},
+			expected: []swVersion{
+				{
+					Name:    "brave",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "chrome",
+					Version: "0.0.1",
+				},
+				{
+					Name:    "firefox",
+					Version: "0.0.3",
+				},
+			},
+		},
+		{
+			name: "maximum cvss 7.5",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				MaximumCVSS:      7.5,
+			},
+			expected: []swVersion{
+				{
+					Name:    "chrome",
+					Version: "0.0.1",
+				},
+				{
+					Name:    "safari",
+					Version: "0.0.1",
+				},
+			},
+		},
+		{
+			name: "maximum cvss 7.6",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				MaximumCVSS:      7.6,
+			},
+			expected: []swVersion{
+				{
+					Name:    "chrome",
+					Version: "0.0.1",
+				},
+				{
+					Name:    "safari",
+					Version: "0.0.1",
+				},
+			},
+		},
+		{
+			name: "maximum cvss 7.5 and known exploit",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				MaximumCVSS:      7.5,
+				KnownExploit:     true,
+			},
+			expected: []swVersion{
+				{
+					Name:    "chrome",
+					Version: "0.0.1",
+				},
+			},
+		},
+		{
+			name: "minimum cvss 7.5 and maximum cvss 8.0",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				MinimumCVSS:      7.5,
+				MaximumCVSS:      8.0,
+			},
+			expected: []swVersion{
+				{
+					Name:    "chrome",
+					Version: "0.0.1",
+				},
+				{
+					Name:    "edge",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "firefox",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "safari",
+					Version: "0.0.1",
+				},
+			},
+		},
+		{
+			name: "minimum cvss 7.5 and maximum cvss 8.0 and known exploit",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				MinimumCVSS:      7.5,
+				MaximumCVSS:      8.0,
+				KnownExploit:     true,
+			},
+			expected: []swVersion{
+				{
+					Name:    "chrome",
+					Version: "0.0.1",
+				},
+				{
+					Name:    "firefox",
+					Version: "0.0.3",
+				},
+			},
+		},
+		{
+			name: "err if vulnerableOnly is not set with MinimumCVSS",
+			opts: fleet.SoftwareListOptions{
+				ListOptions: fleet.ListOptions{},
+				MinimumCVSS: 7.5,
+			},
+			err: fleet.NewInvalidArgumentError("query", "min_cvss_score, max_cvss_score, and exploit can only be provided with vulnerable=true"),
+		},
+		{
+			name: "err if vulnerableOnly is not set with MaximumCVSS",
+			opts: fleet.SoftwareListOptions{
+				ListOptions: fleet.ListOptions{},
+				MaximumCVSS: 7.5,
+			},
+			err: fleet.NewInvalidArgumentError("query", "min_cvss_score, max_cvss_score, and exploit can only be provided with vulnerable=true"),
+		},
+		{
+			name: "err if vulnerableOnly is not set with KnownExploit",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:  fleet.ListOptions{},
+				KnownExploit: true,
+			},
+			err: fleet.NewInvalidArgumentError("query", "min_cvss_score, max_cvss_score, and exploit can only be provided with vulnerable=true"),
+		},
+	}
+
+	for _, tt := range tc {
+		t.Run(tt.name, func(t *testing.T) {
+			sw, _, err := ds.ListSoftware(ctx, tt.opts)
+			if tt.err != nil {
+				require.Error(t, err)
+				require.Equal(t, tt.err, err)
+				return
+			}
+			require.Len(t, sw, len(tt.expected))
+			for i, s := range sw {
+				require.Equal(t, tt.expected[i].Name, s.Name)
+				require.Equal(t, tt.expected[i].Version, s.Version)
+			}
+			count, err := ds.CountSoftware(ctx, tt.opts)
+			require.NoError(t, err)
+			require.Equal(t, len(tt.expected), count)
+		})
+	}
+}
diff --git a/server/datastore/mysql/software_titles.go b/server/datastore/mysql/software_titles.go
index 2364614534d7..b4e2bb6e60d3 100644
--- a/server/datastore/mysql/software_titles.go
+++ b/server/datastore/mysql/software_titles.go
@@ -13,39 +13,52 @@ import (
 )
 
 func (ds *Datastore) SoftwareTitleByID(ctx context.Context, id uint, teamID *uint, tmFilter fleet.TeamFilter) (*fleet.SoftwareTitle, error) {
-	var teamFilter string // used to filter software titles host counts by team
+	var (
+		teamFilter                            string // used to filter software titles host counts by team
+		softwareInstallerGlobalOrTeamIDFilter string
+		vppAppsTeamsGlobalOrTeamIDFilter      string
+	)
+
 	if teamID != nil {
-		teamFilter = fmt.Sprintf("sthc.team_id = %d", *teamID)
+		teamFilter = fmt.Sprintf("sthc.team_id = %d AND sthc.global_stats = 0", *teamID)
+		softwareInstallerGlobalOrTeamIDFilter = fmt.Sprintf("si.global_or_team_id = %d", *teamID)
+		vppAppsTeamsGlobalOrTeamIDFilter = fmt.Sprintf("vat.global_or_team_id = %d", *teamID)
 	} else {
 		teamFilter = ds.whereFilterGlobalOrTeamIDByTeams(tmFilter, "sthc")
+		softwareInstallerGlobalOrTeamIDFilter = "TRUE"
+		vppAppsTeamsGlobalOrTeamIDFilter = "TRUE"
 	}
 
-	var tmID uint // used to filter software installers by team
-	if teamID != nil {
-		tmID = *teamID
-	}
-
+	// Select software title but filter out if the software has zero host counts
+	// and it's not an installer or VPP app.
 	selectSoftwareTitleStmt := fmt.Sprintf(`
 SELECT
 	st.id,
 	st.name,
 	st.source,
 	st.browser,
-	COALESCE(SUM(sthc.hosts_count), 0) as hosts_count,
-	MAX(sthc.updated_at)  as counts_updated_at
+	st.bundle_identifier,
+	COALESCE(SUM(sthc.hosts_count), 0) AS hosts_count,
+	MAX(sthc.updated_at) AS counts_updated_at,
+	COUNT(si.id) as software_installers_count,
+	COUNT(vat.adam_id) AS vpp_apps_count
 FROM software_titles st
-LEFT JOIN software_titles_host_counts sthc ON sthc.software_title_id = st.id AND %s
-WHERE st.id = ?
-AND (sthc.hosts_count > 0 OR EXISTS (SELECT 1 FROM software_installers si WHERE si.title_id = st.id AND si.global_or_team_id = ?))
+LEFT JOIN software_titles_host_counts sthc ON sthc.software_title_id = st.id AND sthc.hosts_count > 0 AND (%s)
+LEFT JOIN software_installers si ON si.title_id = st.id AND %s
+LEFT JOIN vpp_apps vap ON vap.title_id = st.id
+LEFT JOIN vpp_apps_teams vat ON vat.adam_id = vap.adam_id AND vat.platform = vap.platform AND %s
+WHERE st.id = ? AND
+	(sthc.hosts_count > 0 OR vat.adam_id IS NOT NULL OR si.id IS NOT NULL)
 GROUP BY
 	st.id,
 	st.name,
 	st.source,
-	st.browser
-	`, teamFilter,
+	st.browser,
+	st.bundle_identifier
+	`, teamFilter, softwareInstallerGlobalOrTeamIDFilter, vppAppsTeamsGlobalOrTeamIDFilter,
 	)
 	var title fleet.SoftwareTitle
-	if err := sqlx.GetContext(ctx, ds.reader(ctx), &title, selectSoftwareTitleStmt, id, tmID); err != nil {
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &title, selectSoftwareTitleStmt, id); err != nil {
 		if err == sql.ErrNoRows {
 			return nil, notFound("SoftwareTitle").WithID(id)
 		}
@@ -83,8 +96,8 @@ func (ds *Datastore) ListSoftwareTitles(
 		opt.ListOptions.OrderDirection = fleet.OrderDescending
 	}
 
-	if opt.AvailableForInstall && opt.VulnerableOnly {
-		return nil, 0, nil, fleet.NewInvalidArgumentError("query", "available_for_install and vulnerable can't be provided together")
+	if (opt.MinimumCVSS > 0 || opt.MaximumCVSS > 0 || opt.KnownExploit) && !opt.VulnerableOnly {
+		return nil, 0, nil, fleet.NewInvalidArgumentError("query", "min_cvss_score, max_cvss_score, and exploit can only be provided with vulnerable=true")
 	}
 
 	dbReader := ds.reader(ctx)
@@ -93,12 +106,23 @@ func (ds *Datastore) ListSoftwareTitles(
 	getTitlesCountStmt := fmt.Sprintf(`SELECT COUNT(DISTINCT s.id) FROM (%s) AS s`, getTitlesStmt)
 
 	// grab titles that match the list options
-	var titles []fleet.SoftwareTitleListResult
+	type softwareTitle struct {
+		fleet.SoftwareTitleListResult
+		PackageSelfService *bool   `db:"package_self_service"`
+		PackageName        *string `db:"package_name"`
+		PackageVersion     *string `db:"package_version"`
+		PackageURL         *string `db:"package_url"`
+		VPPAppSelfService  *bool   `db:"vpp_app_self_service"`
+		VPPAppAdamID       *string `db:"vpp_app_adam_id"`
+		VPPAppVersion      *string `db:"vpp_app_version"`
+		VPPAppIconURL      *string `db:"vpp_app_icon_url"`
+	}
+	var softwareList []*softwareTitle
 	getTitlesStmt, args = appendListOptionsWithCursorToSQL(getTitlesStmt, args, &opt.ListOptions)
 	// appendListOptionsWithCursorToSQL doesn't support multicolumn sort, so
 	// we need to add it here
 	getTitlesStmt = spliceSecondaryOrderBySoftwareTitlesSQL(getTitlesStmt, opt.ListOptions)
-	if err := sqlx.SelectContext(ctx, dbReader, &titles, getTitlesStmt, args...); err != nil {
+	if err := sqlx.SelectContext(ctx, dbReader, &softwareList, getTitlesStmt, args...); err != nil {
 		return nil, 0, nil, ctxerr.Wrap(ctx, err, "select software titles")
 	}
 
@@ -110,15 +134,43 @@ func (ds *Datastore) ListSoftwareTitles(
 
 	// if we don't have any matching titles, there's no point trying to
 	// find matching versions. Early return
-	if len(titles) == 0 {
-		return titles, counts, &fleet.PaginationMetadata{}, nil
+	if len(softwareList) == 0 {
+		return nil, counts, &fleet.PaginationMetadata{}, nil
 	}
 
 	// grab all the IDs to find matching versions below
-	titleIDs := make([]uint, len(titles))
+	titleIDs := make([]uint, len(softwareList))
 	// build an index to quickly access a title by it's ID
-	titleIndex := make(map[uint]int, len(titles))
-	for i, title := range titles {
+	titleIndex := make(map[uint]int, len(softwareList))
+	for i, title := range softwareList {
+		// promote the package name and version to the proper destination fields
+		if title.PackageName != nil {
+			var version string
+			if title.PackageVersion != nil {
+				version = *title.PackageVersion
+			}
+			title.SoftwarePackage = &fleet.SoftwarePackageOrApp{
+				Name:        *title.PackageName,
+				Version:     version,
+				SelfService: title.PackageSelfService,
+				PackageURL:  title.PackageURL,
+			}
+		}
+
+		// promote the VPP app id and version to the proper destination fields
+		if title.VPPAppAdamID != nil {
+			var version string
+			if title.VPPAppVersion != nil {
+				version = *title.VPPAppVersion
+			}
+			title.AppStoreApp = &fleet.SoftwarePackageOrApp{
+				AppStoreID:  *title.VPPAppAdamID,
+				Version:     version,
+				SelfService: title.VPPAppSelfService,
+				IconURL:     title.VPPAppIconURL,
+			}
+		}
+
 		titleIDs[i] = title.ID
 		titleIndex[title.ID] = i
 	}
@@ -129,7 +181,7 @@ func (ds *Datastore) ListSoftwareTitles(
 	// (like a JSON) object for nested arrays.
 	getVersionsStmt, args, err := ds.selectSoftwareVersionsSQL(
 		titleIDs,
-		nil,
+		opt.TeamID,
 		tmFilter,
 		false,
 	)
@@ -144,20 +196,26 @@ func (ds *Datastore) ListSoftwareTitles(
 	// append matching versions to titles
 	for _, version := range versions {
 		if i, ok := titleIndex[version.TitleID]; ok {
-			titles[i].VersionsCount++
-			titles[i].Versions = append(titles[i].Versions, version)
+			softwareList[i].VersionsCount++
+			softwareList[i].Versions = append(softwareList[i].Versions, version)
 		}
 	}
 
 	var metaData *fleet.PaginationMetadata
 	if opt.ListOptions.IncludeMetadata {
 		metaData = &fleet.PaginationMetadata{HasPreviousResults: opt.ListOptions.Page > 0}
-		if len(titles) > int(opt.ListOptions.PerPage) {
+		if len(softwareList) > int(opt.ListOptions.PerPage) {
 			metaData.HasNextResults = true
-			titles = titles[:len(titles)-1]
+			softwareList = softwareList[:len(softwareList)-1]
 		}
 	}
 
+	titles := make([]fleet.SoftwareTitleListResult, 0, len(softwareList))
+	for _, st := range softwareList {
+		st := st
+		titles = append(titles, st.SoftwareTitleListResult)
+	}
+
 	return titles, counts, metaData, nil
 }
 
@@ -200,29 +258,59 @@ SELECT
 	st.name,
 	st.source,
 	st.browser,
+	st.bundle_identifier,
 	MAX(COALESCE(sthc.hosts_count, 0)) as hosts_count,
 	MAX(COALESCE(sthc.updated_at, date('0001-01-01 00:00:00'))) as counts_updated_at,
-	si.filename as software_package,
-	COALESCE(si.self_service, false) as self_service
+	si.self_service as package_self_service,
+	si.filename as package_name,
+	si.version as package_version,
+	si.url AS package_url,
+	vat.self_service as vpp_app_self_service,
+	vat.adam_id as vpp_app_adam_id,
+	vap.latest_version as vpp_app_version,
+	vap.icon_url as vpp_app_icon_url
 FROM software_titles st
-LEFT JOIN software_installers si ON si.title_id = st.id AND si.global_or_team_id = ?
-LEFT JOIN software_titles_host_counts sthc ON sthc.software_title_id = st.id AND sthc.team_id = ?
+LEFT JOIN software_installers si ON si.title_id = st.id AND %s
+LEFT JOIN vpp_apps vap ON vap.title_id = st.id AND %s
+LEFT JOIN vpp_apps_teams vat ON vat.adam_id = vap.adam_id AND vat.platform = vap.platform AND %s
+LEFT JOIN software_titles_host_counts sthc ON sthc.software_title_id = st.id AND (%s)
 -- placeholder for JOIN on software/software_cve
 %s
 -- placeholder for optional extra WHERE filter
 WHERE %s
 -- placeholder for filter based on software installed on hosts + software installers
 AND (%s)
-GROUP BY st.id, software_package, self_service`
+GROUP BY st.id, package_self_service, package_name, package_version, package_url, vpp_app_self_service, vpp_app_adam_id, vpp_app_version, vpp_app_icon_url`
 
 	cveJoinType := "LEFT"
 	if opt.VulnerableOnly {
 		cveJoinType = "INNER"
 	}
 
-	args := []any{0, 0}
-	if opt.TeamID != nil {
-		args[0], args[1] = *opt.TeamID, *opt.TeamID
+	countsJoin := "TRUE"
+	softwareInstallersJoinCond := "TRUE"
+	vppAppsJoinCond := "TRUE"
+	vppAppsTeamsJoinCond := "TRUE"
+	includeVPPAppsAndSoftwareInstallers := "TRUE"
+	switch {
+	case opt.TeamID == nil:
+		countsJoin = "sthc.team_id = 0 AND sthc.global_stats = 1"
+		// When opt.TeamID is nil (aka "All teams") we do not include VPP-apps/installers
+		// that are not installed on any host.
+		includeVPPAppsAndSoftwareInstallers = "FALSE"
+	case *opt.TeamID == 0:
+		countsJoin = "sthc.team_id = 0 AND sthc.global_stats = 0"
+		softwareInstallersJoinCond = fmt.Sprintf("si.global_or_team_id = %d", *opt.TeamID)
+		vppAppsTeamsJoinCond = fmt.Sprintf("vat.global_or_team_id = %d", *opt.TeamID)
+	case *opt.TeamID > 0:
+		countsJoin = fmt.Sprintf("sthc.team_id = %d AND sthc.global_stats = 0", *opt.TeamID)
+		softwareInstallersJoinCond = fmt.Sprintf("si.global_or_team_id = %d", *opt.TeamID)
+		vppAppsTeamsJoinCond = fmt.Sprintf("vat.global_or_team_id = %d", *opt.TeamID)
+	}
+
+	if opt.PackagesOnly {
+		vppAppsJoinCond = "FALSE"
+		vppAppsTeamsJoinCond = "FALSE"
 	}
 
 	additionalWhere := "TRUE"
@@ -240,29 +328,51 @@ GROUP BY st.id, software_package, self_service`
 		`, cveJoinType)
 	}
 
+	var args []any
+	if opt.VulnerableOnly && (opt.KnownExploit || opt.MinimumCVSS > 0 || opt.MaximumCVSS > 0) {
+		softwareJoin += `
+			INNER JOIN cve_meta cm ON scve.cve = cm.cve
+		`
+		if opt.KnownExploit {
+			softwareJoin += `
+				AND cm.cisa_known_exploit = 1
+			`
+		}
+		if opt.MinimumCVSS > 0 {
+			softwareJoin += `
+				AND cm.cvss_score >= ?
+			`
+			args = append(args, opt.MinimumCVSS)
+		}
+
+		if opt.MaximumCVSS > 0 {
+			softwareJoin += `
+				AND cm.cvss_score <= ?
+			`
+			args = append(args, opt.MaximumCVSS)
+		}
+	}
+
 	if match != "" {
 		additionalWhere = " (st.name LIKE ? OR scve.cve LIKE ?)"
 		match = likePattern(match)
 		args = append(args, match, match)
 	}
 
-	// default to "a software installer exists", and see next condition.
-	defaultFilter := `
-		si.id IS NOT NULL
-	`
+	// default to "a software installer or VPP app exists", and see next condition.
+	defaultFilter := fmt.Sprintf(`
+		((si.id IS NOT NULL OR vat.adam_id IS NOT NULL) AND %s)
+	`, includeVPPAppsAndSoftwareInstallers)
 
-	// add software installed for hosts if any of this is true:
-	//
-	// - we're not filtering for "available for install" only
-	// - we're filtering by vulnerable only
-	if !opt.AvailableForInstall || opt.VulnerableOnly {
+	// add software installed for hosts if we're not filtering for "available for install" only
+	if !opt.AvailableForInstall {
 		defaultFilter = ` ( ` + defaultFilter + ` OR sthc.hosts_count > 0 ) `
 	}
 	if opt.SelfServiceOnly {
-		defaultFilter += ` AND si.self_service = 1 `
+		defaultFilter += ` AND ( si.self_service = 1 OR vat.self_service = 1 ) `
 	}
 
-	stmt = fmt.Sprintf(stmt, softwareJoin, additionalWhere, defaultFilter)
+	stmt = fmt.Sprintf(stmt, softwareInstallersJoinCond, vppAppsJoinCond, vppAppsTeamsJoinCond, countsJoin, softwareJoin, additionalWhere, defaultFilter)
 	return stmt, args
 }
 
@@ -283,7 +393,7 @@ SELECT
 	%s -- placeholder for optional host_counts
 	CONCAT('[', GROUP_CONCAT(JSON_QUOTE(scve.cve) SEPARATOR ','), ']') as vulnerabilities
 FROM software s
-LEFT JOIN software_host_counts shc ON shc.software_id = s.id
+LEFT JOIN software_host_counts shc ON shc.software_id = s.id AND %s
 LEFT JOIN software_cve scve ON shc.software_id = scve.software_id
 WHERE s.title_id IN (?)
 AND %s
@@ -295,7 +405,17 @@ GROUP BY s.id`
 		extraSelect = "MAX(shc.hosts_count) AS hosts_count,"
 	}
 
-	selectVersionsStmt = fmt.Sprintf(selectVersionsStmt, extraSelect, teamFilter)
+	countsJoin := "TRUE"
+	switch {
+	case teamID == nil:
+		countsJoin = "shc.team_id = 0 AND shc.global_stats = 1"
+	case *teamID == 0:
+		countsJoin = "shc.team_id = 0 AND shc.global_stats = 0"
+	case *teamID > 0:
+		countsJoin = fmt.Sprintf("shc.team_id = %d AND shc.global_stats = 0", *teamID)
+	}
+
+	selectVersionsStmt = fmt.Sprintf(selectVersionsStmt, extraSelect, countsJoin, teamFilter)
 
 	selectVersionsStmt, args, err := sqlx.In(selectVersionsStmt, titleIDs)
 	if err != nil {
@@ -317,6 +437,7 @@ func (ds *Datastore) SyncHostsSoftwareTitles(ctx context.Context, updatedAt time
             SELECT
                 COUNT(DISTINCT hs.host_id),
                 0 as team_id,
+				1 as global_stats,
                 st.id as software_title_id
             FROM software_titles st
             JOIN software s ON s.title_id = st.id
@@ -327,6 +448,7 @@ func (ds *Datastore) SyncHostsSoftwareTitles(ctx context.Context, updatedAt time
             SELECT
                 COUNT(DISTINCT hs.host_id),
                 h.team_id,
+				0 as global_stats,
                 st.id as software_title_id
             FROM software_titles st
             JOIN software s ON s.title_id = st.id
@@ -335,16 +457,29 @@ func (ds *Datastore) SyncHostsSoftwareTitles(ctx context.Context, updatedAt time
             WHERE h.team_id IS NOT NULL AND hs.software_id > 0
             GROUP BY st.id, h.team_id`
 
+		noTeamCountsStmt = `
+			SELECT
+				COUNT(DISTINCT hs.host_id),
+				0 as team_id,
+				0 as global_stats,
+				st.id as software_title_id
+			FROM software_titles st
+			JOIN software s ON s.title_id = st.id
+			JOIN host_software hs ON hs.software_id = s.id
+			INNER JOIN hosts h ON hs.host_id = h.id
+			WHERE h.team_id IS NULL AND hs.software_id > 0
+			GROUP BY st.id`
+
 		insertStmt = `
             INSERT INTO software_titles_host_counts
-                (software_title_id, hosts_count, team_id, updated_at)
+                (software_title_id, hosts_count, team_id, global_stats, updated_at)
             VALUES
                 %s
             ON DUPLICATE KEY UPDATE
                 hosts_count = VALUES(hosts_count),
                 updated_at = VALUES(updated_at)`
 
-		valuesPart = `(?, ?, ?, ?),`
+		valuesPart = `(?, ?, ?, ?, ?),`
 
 		cleanupOrphanedStmt = `
             DELETE sthc
@@ -369,8 +504,8 @@ func (ds *Datastore) SyncHostsSoftwareTitles(ctx context.Context, updatedAt time
 	}
 
 	// next get a cursor for the global and team counts for each software
-	stmtLabel := []string{"global", "team"}
-	for i, countStmt := range []string{globalCountsStmt, teamCountsStmt} {
+	stmtLabel := []string{"global", "team", "no_team"}
+	for i, countStmt := range []string{globalCountsStmt, teamCountsStmt, noTeamCountsStmt} {
 		rows, err := ds.reader(ctx).QueryContext(ctx, countStmt)
 		if err != nil {
 			return ctxerr.Wrapf(ctx, err, "read %s counts from host_software", stmtLabel[i])
@@ -387,14 +522,15 @@ func (ds *Datastore) SyncHostsSoftwareTitles(ctx context.Context, updatedAt time
 			var (
 				count  int
 				teamID uint
+				gstats bool
 				sid    uint
 			)
 
-			if err := rows.Scan(&count, &teamID, &sid); err != nil {
+			if err := rows.Scan(&count, &teamID, &gstats, &sid); err != nil {
 				return ctxerr.Wrapf(ctx, err, "scan %s row into variables", stmtLabel[i])
 			}
 
-			args = append(args, sid, count, teamID, updatedAt)
+			args = append(args, sid, count, teamID, gstats, updatedAt)
 			batchCount++
 
 			if batchCount == batchSize {
@@ -430,3 +566,29 @@ func (ds *Datastore) SyncHostsSoftwareTitles(ctx context.Context, updatedAt time
 	}
 	return nil
 }
+
+func (ds *Datastore) UploadedSoftwareExists(ctx context.Context, bundleIdentifier string, teamID *uint) (bool, error) {
+	stmt := `
+SELECT
+	1
+FROM
+	software_titles st JOIN software_installers si ON si.title_id = st.id
+WHERE
+	st.bundle_identifier = ? AND si.global_or_team_id = ?
+	`
+	var tmID uint
+	if teamID != nil {
+		tmID = *teamID
+	}
+
+	var titleExists bool
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &titleExists, stmt, bundleIdentifier, tmID); err != nil {
+		if err == sql.ErrNoRows {
+			return false, nil
+		}
+
+		return false, ctxerr.Wrap(ctx, err, "checking if software installer exists")
+	}
+
+	return titleExists, nil
+}
diff --git a/server/datastore/mysql/software_titles_test.go b/server/datastore/mysql/software_titles_test.go
index cb837cb0a5ba..c0cfa2020fab 100644
--- a/server/datastore/mysql/software_titles_test.go
+++ b/server/datastore/mysql/software_titles_test.go
@@ -28,6 +28,9 @@ func TestSoftwareTitles(t *testing.T) {
 		{"TeamFilterSoftwareTitles", testTeamFilterSoftwareTitles},
 		{"ListSoftwareTitlesInstallersOnly", testListSoftwareTitlesInstallersOnly},
 		{"ListSoftwareTitlesAvailableForInstallFilter", testListSoftwareTitlesAvailableForInstallFilter},
+		{"ListSoftwareTitlesAllTeams", testListSoftwareTitlesAllTeams},
+		{"UploadedSoftwareExists", testUploadedSoftwareExists},
+		{"ListSoftwareTitlesVulnerabilityFilters", testListSoftwareTitlesVulnerabilityFilters},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
@@ -51,6 +54,7 @@ func testSoftwareSyncHostsSoftwareTitles(t *testing.T, ds *Datastore) {
 	// this check ensures that the total number of rows in
 	// software_title_host_counts matches the expected value.
 	checkTableTotalCount := func(want int) {
+		t.Helper()
 		var tableCount int
 		err := ds.writer(context.Background()).Get(&tableCount, "SELECT COUNT(*) FROM software_titles_host_counts")
 		require.NoError(t, err)
@@ -86,7 +90,7 @@ func testSoftwareSyncHostsSoftwareTitles(t *testing.T, ds *Datastore) {
 		{Name: "bar", HostsCount: 1},
 	}
 	cmpNameVersionCount(want, globalCounts)
-	checkTableTotalCount(2)
+	checkTableTotalCount(4)
 
 	// update host2, remove "bar" software
 	software2 = []fleet.Software{
@@ -104,7 +108,7 @@ func testSoftwareSyncHostsSoftwareTitles(t *testing.T, ds *Datastore) {
 		{Name: "foo", HostsCount: 2},
 	}
 	cmpNameVersionCount(want, globalCounts)
-	checkTableTotalCount(1)
+	checkTableTotalCount(2)
 
 	// create a software title entry without any host and any counts
 	_, err = ds.writer(ctx).ExecContext(ctx, `INSERT INTO software_titles (name, source) VALUES ('baz', 'testing')`)
@@ -149,7 +153,7 @@ func testSoftwareSyncHostsSoftwareTitles(t *testing.T, ds *Datastore) {
 		{Name: "foo", HostsCount: 2},
 	}
 	cmpNameVersionCount(want, globalCounts)
-	checkTableTotalCount(1)
+	checkTableTotalCount(2)
 
 	team1Opts := fleet.SoftwareTitleListOptions{
 		TeamID:      ptr.Uint(team1.ID),
@@ -158,7 +162,7 @@ func testSoftwareSyncHostsSoftwareTitles(t *testing.T, ds *Datastore) {
 	team1Counts := listSoftwareTitlesCheckCount(t, ds, 0, 0, team1Opts)
 	want = []fleet.SoftwareTitleListResult{}
 	cmpNameVersionCount(want, team1Counts)
-	checkTableTotalCount(1)
+	checkTableTotalCount(2)
 
 	// after a call to Calculate, the global counts are updated and the team counts appear
 	require.NoError(t, ds.SyncHostsSoftware(ctx, time.Now()))
@@ -179,7 +183,7 @@ func testSoftwareSyncHostsSoftwareTitles(t *testing.T, ds *Datastore) {
 	cmpNameVersionCount(want, team1Counts)
 
 	// composite pk (software_title_id, team_id), so we expect more rows
-	checkTableTotalCount(5)
+	checkTableTotalCount(6)
 
 	team2Opts := fleet.SoftwareTitleListOptions{
 		TeamID:      ptr.Uint(team2.ID),
@@ -221,7 +225,7 @@ func testSoftwareSyncHostsSoftwareTitles(t *testing.T, ds *Datastore) {
 	}
 	cmpNameVersionCount(want, team2Counts)
 
-	checkTableTotalCount(3)
+	checkTableTotalCount(4)
 
 	// update host4 (team2), remove all software
 	software4 = []fleet.Software{}
@@ -253,16 +257,22 @@ func testSoftwareSyncHostsSoftwareTitles(t *testing.T, ds *Datastore) {
 	cmpNameVersionCount(want, team1Counts)
 
 	listSoftwareTitlesCheckCount(t, ds, 0, 0, team2Opts)
-	checkTableTotalCount(2)
+	checkTableTotalCount(3)
 }
 
 func testOrderSoftwareTitles(t *testing.T, ds *Datastore) {
+	//
+	// All tests below are in hosts in "No team".
+	//
+
 	ctx := context.Background()
 
 	host1 := test.NewHost(t, ds, "host1", "", "host1key", "host1uuid", time.Now())
 	host2 := test.NewHost(t, ds, "host2", "", "host2key", "host2uuid", time.Now())
 	host3 := test.NewHost(t, ds, "host3", "", "host3key", "host3uuid", time.Now())
 
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
 	software1 := []fleet.Software{
 		{Name: "foo", Version: "0.0.1", Source: "chrome_extensions", Browser: "chrome"},
 		{Name: "foo", Version: "0.0.3", Source: "chrome_extensions", Browser: "chrome"},
@@ -295,6 +305,7 @@ func testOrderSoftwareTitles(t *testing.T, ds *Datastore) {
 		Source:        "apps",
 		InstallScript: "echo",
 		Filename:      "installer1.pkg",
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	require.NotZero(t, installer1)
@@ -309,133 +320,226 @@ func testOrderSoftwareTitles(t *testing.T, ds *Datastore) {
 		Source:        "apps",
 		InstallScript: "echo",
 		Filename:      "installer2.pkg",
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	_, err = ds.InsertSoftwareInstallRequest(ctx, host1.ID, installer2, false)
 	require.NoError(t, err)
 
+	test.CreateInsertGlobalVPPToken(t, ds)
+
+	// create a VPP app not installed anywhere
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp1", BundleIdentifier: "com.app.vpp1",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_1", Platform: fleet.IPadOSPlatform}},
+	}, nil)
+	require.NoError(t, err)
+
 	require.NoError(t, ds.SyncHostsSoftware(ctx, time.Now()))
 	require.NoError(t, ds.ReconcileSoftwareTitles(ctx))
 	require.NoError(t, ds.SyncHostsSoftwareTitles(ctx, time.Now()))
 
 	// primary sort is "hosts_count DESC", followed by "name ASC, source ASC, browser ASC"
-	titles, _, _, err := ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "hosts_count",
-		OrderDirection: fleet.OrderDescending,
-	}}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, _, _, err := ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "hosts_count",
+			OrderDirection: fleet.OrderDescending,
+		},
+		TeamID: ptr.Uint(0),
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
-	require.Len(t, titles, 9)
-	require.Equal(t, "bar", titles[0].Name)
-	require.Equal(t, "deb_packages", titles[0].Source)
-	require.Equal(t, "foo", titles[1].Name)
-	require.Equal(t, "chrome_extensions", titles[1].Source)
-	require.Equal(t, "foo", titles[2].Name)
-	require.Equal(t, "deb_packages", titles[2].Source)
-	require.Equal(t, "bar", titles[3].Name)
-	require.Equal(t, "apps", titles[3].Source)
-	require.Equal(t, "baz", titles[4].Name)
-	require.Equal(t, "chrome_extensions", titles[4].Source)
-	require.Equal(t, "chrome", titles[4].Browser)
-	require.Equal(t, "baz", titles[5].Name)
-	require.Equal(t, "chrome_extensions", titles[5].Source)
-	require.Equal(t, "edge", titles[5].Browser)
-	require.Equal(t, "foo", titles[6].Name)
-	require.Equal(t, "rpm_packages", titles[6].Source)
-	require.Equal(t, "installer1", titles[7].Name)
-	require.Equal(t, "apps", titles[7].Source)
-	require.Equal(t, "installer2", titles[8].Name)
-	require.Equal(t, "apps", titles[8].Source)
+	require.Len(t, titles, 10)
+	i := 0
+	require.Equal(t, "bar", titles[i].Name)
+	require.Equal(t, "deb_packages", titles[i].Source)
+	require.Nil(t, titles[i].SoftwarePackage)
+	require.Nil(t, titles[i].AppStoreApp)
+	i++
+	require.Equal(t, "foo", titles[i].Name)
+	require.Equal(t, "chrome_extensions", titles[i].Source)
+	require.Nil(t, titles[i].SoftwarePackage)
+	require.Nil(t, titles[i].AppStoreApp)
+	i++
+	require.Equal(t, "foo", titles[i].Name)
+	require.Equal(t, "deb_packages", titles[i].Source)
+	require.Nil(t, titles[i].SoftwarePackage)
+	require.Nil(t, titles[i].AppStoreApp)
+	i++
+	require.Equal(t, "bar", titles[i].Name)
+	require.Equal(t, "apps", titles[i].Source)
+	require.Nil(t, titles[i].SoftwarePackage)
+	require.Nil(t, titles[i].AppStoreApp)
+	i++
+	require.Equal(t, "baz", titles[i].Name)
+	require.Equal(t, "chrome_extensions", titles[i].Source)
+	require.Equal(t, "chrome", titles[i].Browser)
+	require.Nil(t, titles[i].SoftwarePackage)
+	require.Nil(t, titles[i].AppStoreApp)
+	i++
+	require.Equal(t, "baz", titles[i].Name)
+	require.Equal(t, "chrome_extensions", titles[i].Source)
+	require.Equal(t, "edge", titles[i].Browser)
+	require.Nil(t, titles[i].SoftwarePackage)
+	require.Nil(t, titles[i].AppStoreApp)
+	i++
+	require.Equal(t, "foo", titles[i].Name)
+	require.Equal(t, "rpm_packages", titles[i].Source)
+	require.Nil(t, titles[i].SoftwarePackage)
+	require.Nil(t, titles[i].AppStoreApp)
+	i++
+	require.Equal(t, "installer1", titles[i].Name)
+	require.Equal(t, "apps", titles[i].Source)
+	require.NotNil(t, titles[i].SoftwarePackage)
+	require.Nil(t, titles[i].AppStoreApp)
+	i++
+	require.Equal(t, "installer2", titles[i].Name)
+	require.Equal(t, "apps", titles[i].Source)
+	require.NotNil(t, titles[i].SoftwarePackage)
+	require.Nil(t, titles[i].AppStoreApp)
+	i++
+	require.Equal(t, "vpp1", titles[i].Name)
+	assert.Equal(t, "ipados_apps", titles[i].Source)
+	require.Nil(t, titles[i].SoftwarePackage)
+	require.NotNil(t, titles[i].AppStoreApp)
 
 	// primary sort is "hosts_count ASC", followed by "name ASC, source ASC, browser ASC"
-	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "hosts_count",
-		OrderDirection: fleet.OrderAscending,
-	}}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "hosts_count",
+			OrderDirection: fleet.OrderAscending,
+		},
+		TeamID: ptr.Uint(0),
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
-	require.Len(t, titles, 9)
-	require.Equal(t, "installer1", titles[0].Name)
-	require.Equal(t, "apps", titles[0].Source)
-	require.Equal(t, "installer2", titles[1].Name)
-	require.Equal(t, "apps", titles[1].Source)
-	require.Equal(t, "bar", titles[2].Name)
-	require.Equal(t, "apps", titles[2].Source)
-	require.Equal(t, "baz", titles[3].Name)
-	require.Equal(t, "chrome_extensions", titles[3].Source)
-	require.Equal(t, "chrome", titles[3].Browser)
-	require.Equal(t, "baz", titles[4].Name)
-	require.Equal(t, "chrome_extensions", titles[4].Source)
-	require.Equal(t, "edge", titles[4].Browser)
-	require.Equal(t, "foo", titles[5].Name)
-	require.Equal(t, "rpm_packages", titles[5].Source)
-	require.Equal(t, "bar", titles[6].Name)
-	require.Equal(t, "deb_packages", titles[6].Source)
-	require.Equal(t, "foo", titles[7].Name)
-	require.Equal(t, "chrome_extensions", titles[7].Source)
-	require.Equal(t, "foo", titles[8].Name)
-	require.Equal(t, "deb_packages", titles[8].Source)
+	require.Len(t, titles, 10)
+	i = 0
+	require.Equal(t, "installer1", titles[i].Name)
+	require.Equal(t, "apps", titles[i].Source)
+	i++
+	require.Equal(t, "installer2", titles[i].Name)
+	require.Equal(t, "apps", titles[i].Source)
+	i++
+	require.Equal(t, "vpp1", titles[i].Name)
+	assert.Equal(t, "ipados_apps", titles[i].Source)
+	i++
+	require.Equal(t, "bar", titles[i].Name)
+	require.Equal(t, "apps", titles[i].Source)
+	i++
+	require.Equal(t, "baz", titles[i].Name)
+	require.Equal(t, "chrome_extensions", titles[i].Source)
+	require.Equal(t, "chrome", titles[i].Browser)
+	i++
+	require.Equal(t, "baz", titles[i].Name)
+	require.Equal(t, "chrome_extensions", titles[i].Source)
+	require.Equal(t, "edge", titles[i].Browser)
+	i++
+	require.Equal(t, "foo", titles[i].Name)
+	require.Equal(t, "rpm_packages", titles[i].Source)
+	i++
+	require.Equal(t, "bar", titles[i].Name)
+	require.Equal(t, "deb_packages", titles[i].Source)
+	i++
+	require.Equal(t, "foo", titles[i].Name)
+	require.Equal(t, "chrome_extensions", titles[i].Source)
+	i++
+	require.Equal(t, "foo", titles[i].Name)
+	require.Equal(t, "deb_packages", titles[i].Source)
 
 	// primary sort is "name ASC", followed by "host_count DESC, source ASC, browser ASC"
-	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "name",
-		OrderDirection: fleet.OrderAscending,
-	}}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "name",
+			OrderDirection: fleet.OrderAscending,
+		},
+		TeamID: ptr.Uint(0),
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
-	require.Len(t, titles, 9)
-	require.Equal(t, "bar", titles[0].Name)
-	require.Equal(t, "deb_packages", titles[0].Source)
-	require.Equal(t, "bar", titles[1].Name)
-	require.Equal(t, "apps", titles[1].Source)
-	require.Equal(t, "baz", titles[2].Name)
-	require.Equal(t, "chrome_extensions", titles[2].Source)
-	require.Equal(t, "chrome", titles[2].Browser)
-	require.Equal(t, "baz", titles[3].Name)
-	require.Equal(t, "chrome_extensions", titles[3].Source)
-	require.Equal(t, "edge", titles[3].Browser)
-	require.Equal(t, "foo", titles[4].Name)
-	require.Equal(t, "chrome_extensions", titles[4].Source)
-	require.Equal(t, "foo", titles[5].Name)
-	require.Equal(t, "deb_packages", titles[5].Source)
-	require.Equal(t, "foo", titles[6].Name)
-	require.Equal(t, "rpm_packages", titles[6].Source)
-	require.Equal(t, "installer1", titles[7].Name)
-	require.Equal(t, "apps", titles[7].Source)
-	require.Equal(t, "installer2", titles[8].Name)
-	require.Equal(t, "apps", titles[8].Source)
+	require.Len(t, titles, 10)
+	i = 0
+	require.Equal(t, "bar", titles[i].Name)
+	require.Equal(t, "deb_packages", titles[i].Source)
+	i++
+	require.Equal(t, "bar", titles[i].Name)
+	require.Equal(t, "apps", titles[i].Source)
+	i++
+	require.Equal(t, "baz", titles[i].Name)
+	require.Equal(t, "chrome_extensions", titles[i].Source)
+	require.Equal(t, "chrome", titles[i].Browser)
+	i++
+	require.Equal(t, "baz", titles[i].Name)
+	require.Equal(t, "chrome_extensions", titles[i].Source)
+	require.Equal(t, "edge", titles[i].Browser)
+	i++
+	require.Equal(t, "foo", titles[i].Name)
+	require.Equal(t, "chrome_extensions", titles[i].Source)
+	i++
+	require.Equal(t, "foo", titles[i].Name)
+	require.Equal(t, "deb_packages", titles[i].Source)
+	i++
+	require.Equal(t, "foo", titles[i].Name)
+	require.Equal(t, "rpm_packages", titles[i].Source)
+	i++
+	require.Equal(t, "installer1", titles[i].Name)
+	require.Equal(t, "apps", titles[i].Source)
+	i++
+	require.Equal(t, "installer2", titles[i].Name)
+	require.Equal(t, "apps", titles[i].Source)
+	i++
+	require.Equal(t, "vpp1", titles[i].Name)
+	assert.Equal(t, "ipados_apps", titles[i].Source)
 
 	// primary sort is "name DESC", followed by "host_count DESC, source ASC, browser ASC"
-	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "name",
-		OrderDirection: fleet.OrderDescending,
-	}}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "name",
+			OrderDirection: fleet.OrderDescending,
+		},
+		TeamID: ptr.Uint(0),
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
-	require.Len(t, titles, 9)
-	require.Equal(t, "installer2", titles[0].Name)
-	require.Equal(t, "apps", titles[0].Source)
-	require.Equal(t, "installer1", titles[1].Name)
-	require.Equal(t, "apps", titles[1].Source)
-	require.Equal(t, "foo", titles[2].Name)
-	require.Equal(t, "chrome_extensions", titles[2].Source)
-	require.Equal(t, "foo", titles[3].Name)
-	require.Equal(t, "deb_packages", titles[3].Source)
-	require.Equal(t, "foo", titles[4].Name)
-	require.Equal(t, "rpm_packages", titles[4].Source)
-	require.Equal(t, "baz", titles[5].Name)
-	require.Equal(t, "chrome_extensions", titles[5].Source)
-	require.Equal(t, "chrome", titles[5].Browser)
-	require.Equal(t, "baz", titles[6].Name)
-	require.Equal(t, "chrome_extensions", titles[6].Source)
-	require.Equal(t, "edge", titles[6].Browser)
-	require.Equal(t, "bar", titles[7].Name)
-	require.Equal(t, "deb_packages", titles[7].Source)
-	require.Equal(t, "bar", titles[8].Name)
-	require.Equal(t, "apps", titles[8].Source)
+	require.Len(t, titles, 10)
+	i = 0
+	require.Equal(t, "vpp1", titles[i].Name)
+	assert.Equal(t, "ipados_apps", titles[i].Source)
+	i++
+	require.Equal(t, "installer2", titles[i].Name)
+	require.Equal(t, "apps", titles[i].Source)
+	i++
+	require.Equal(t, "installer1", titles[i].Name)
+	require.Equal(t, "apps", titles[i].Source)
+	i++
+	require.Equal(t, "foo", titles[i].Name)
+	require.Equal(t, "chrome_extensions", titles[i].Source)
+	i++
+	require.Equal(t, "foo", titles[i].Name)
+	require.Equal(t, "deb_packages", titles[i].Source)
+	i++
+	require.Equal(t, "foo", titles[i].Name)
+	require.Equal(t, "rpm_packages", titles[i].Source)
+	i++
+	require.Equal(t, "baz", titles[i].Name)
+	require.Equal(t, "chrome_extensions", titles[i].Source)
+	require.Equal(t, "chrome", titles[i].Browser)
+	i++
+	require.Equal(t, "baz", titles[i].Name)
+	require.Equal(t, "chrome_extensions", titles[i].Source)
+	require.Equal(t, "edge", titles[i].Browser)
+	i++
+	require.Equal(t, "bar", titles[i].Name)
+	require.Equal(t, "deb_packages", titles[i].Source)
+	i++
+	require.Equal(t, "bar", titles[i].Name)
+	require.Equal(t, "apps", titles[i].Source)
 
 	// using a match query
-	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "name",
-		OrderDirection: fleet.OrderDescending,
-		MatchQuery:     "ba",
-	}}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "name",
+			OrderDirection: fleet.OrderDescending,
+			MatchQuery:     "ba",
+		},
+		TeamID: ptr.Uint(0),
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
 	require.Len(t, titles, 4)
 	require.Equal(t, "baz", titles[0].Name)
@@ -450,11 +554,14 @@ func testOrderSoftwareTitles(t *testing.T, ds *Datastore) {
 	require.Equal(t, "apps", titles[3].Source)
 
 	// using another (installer-only) match query
-	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "name",
-		OrderDirection: fleet.OrderDescending,
-		MatchQuery:     "insta",
-	}}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "name",
+			OrderDirection: fleet.OrderDescending,
+			MatchQuery:     "insta",
+		},
+		TeamID: ptr.Uint(0),
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
 	require.Len(t, titles, 2)
 	require.Equal(t, "installer2", titles[0].Name)
@@ -463,10 +570,14 @@ func testOrderSoftwareTitles(t *testing.T, ds *Datastore) {
 	require.Equal(t, "apps", titles[1].Source)
 
 	// filter on self-service only
-	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "name",
-		OrderDirection: fleet.OrderDescending,
-	}, SelfServiceOnly: true}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "name",
+			OrderDirection: fleet.OrderDescending,
+		},
+		TeamID:          ptr.Uint(0),
+		SelfServiceOnly: true,
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
 	require.Len(t, titles, 1)
 	require.Equal(t, "installer1", titles[0].Name)
@@ -490,6 +601,10 @@ func testTeamFilterSoftwareTitles(t *testing.T, ds *Datastore) {
 	team2, err := ds.NewTeam(ctx, &fleet.Team{Name: "team2"})
 	require.NoError(t, err)
 
+	test.CreateInsertGlobalVPPToken(t, ds)
+
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
 	host1 := test.NewHost(t, ds, "host1", "", "host1key", "host1uuid", time.Now())
 	require.NoError(t, ds.AddHostsToTeam(ctx, &team1.ID, []uint{host1.ID}))
 	host2 := test.NewHost(t, ds, "host2", "", "host2key", "host2uuid", time.Now())
@@ -517,11 +632,13 @@ func testTeamFilterSoftwareTitles(t *testing.T, ds *Datastore) {
 
 	// create a software installer for team1
 	installer1, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
-		Title:         "installer1",
-		Source:        "apps",
-		InstallScript: "echo",
-		Filename:      "installer1.pkg",
-		TeamID:        &team1.ID,
+		Title:            "installer1",
+		Source:           "apps",
+		InstallScript:    "echo",
+		Filename:         "installer1.pkg",
+		BundleIdentifier: "foo.bar",
+		TeamID:           &team1.ID,
+		UserID:           user1.ID,
 	})
 	require.NoError(t, err)
 	require.NotZero(t, installer1)
@@ -537,48 +654,109 @@ func testTeamFilterSoftwareTitles(t *testing.T, ds *Datastore) {
 		InstallScript: "echo",
 		Filename:      "installer2.pkg",
 		TeamID:        &team2.ID,
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	require.NotZero(t, installer2)
 
+	// create a VPP app for team2
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp2", BundleIdentifier: "com.app.vpp2",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.IOSPlatform}},
+	}, &team2.ID)
+	require.NoError(t, err)
+
+	// create a VPP app for "No team", allowing self-service
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp3", BundleIdentifier: "com.app.vpp3",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_3", Platform: fleet.MacOSPlatform}, SelfService: true},
+	}, ptr.Uint(0))
+	require.NoError(t, err)
+
 	require.NoError(t, ds.SyncHostsSoftware(ctx, time.Now()))
 	require.NoError(t, ds.ReconcileSoftwareTitles(ctx))
 	require.NoError(t, ds.SyncHostsSoftwareTitles(ctx, time.Now()))
 
-	// Testing the global user (for no team)
+	// Testing the global user (for "All teams")
+	// Should not return VPP apps or software installers (because they are not installed yet).
 	globalTeamFilter := fleet.TeamFilter{User: userGlobalAdmin, IncludeObserver: true}
 	titles, count, _, err := ds.ListSoftwareTitles(
-		context.Background(), fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{}}, globalTeamFilter,
+		context.Background(), fleet.SoftwareTitleListOptions{
+			ListOptions: fleet.ListOptions{},
+			TeamID:      nil,
+		}, globalTeamFilter,
 	)
 	sortTitlesByName(titles)
-	// software installers are associated with a team, so they don't show up in
-	// this request for no team, but other titles do because software titles are
-	// not associated with a team.
 	require.NoError(t, err)
 	require.Len(t, titles, 2)
 	require.Equal(t, 2, count)
+
 	require.Equal(t, "bar", titles[0].Name)
 	require.Equal(t, "deb_packages", titles[0].Source)
 	require.Equal(t, "foo", titles[1].Name)
 	require.Equal(t, "chrome_extensions", titles[1].Source)
 	require.Equal(t, uint(1), titles[0].VersionsCount)
 	assert.Equal(t, uint(1), titles[0].HostsCount)
+	require.Nil(t, titles[0].SoftwarePackage)
+	require.Nil(t, titles[0].AppStoreApp)
 	require.Equal(t, uint(2), titles[1].VersionsCount)
 	assert.Equal(t, uint(2), titles[1].HostsCount)
+	require.Nil(t, titles[1].SoftwarePackage)
+	require.Nil(t, titles[1].AppStoreApp)
+	barTitle := titles[0]
+	fooTitle := titles[1]
 
-	title, err := ds.SoftwareTitleByID(context.Background(), titles[0].ID, nil, globalTeamFilter)
+	// Testing the global user (for "No team")
+	// should only return vpp3 because it's the only app in the "No team".
+	titles, count, _, err = ds.ListSoftwareTitles(
+		context.Background(), fleet.SoftwareTitleListOptions{
+			ListOptions: fleet.ListOptions{},
+			TeamID:      ptr.Uint(0),
+		}, globalTeamFilter,
+	)
+	sortTitlesByName(titles)
+	require.NoError(t, err)
+	require.Len(t, titles, 1)
+	require.Equal(t, 1, count)
+	require.Equal(t, uint(0), titles[0].VersionsCount)
+	require.Nil(t, titles[0].SoftwarePackage)
+	require.Equal(t, "vpp3", titles[0].Name)
+	require.NotNil(t, titles[0].AppStoreApp)
+	require.NotNil(t, titles[0].AppStoreApp.SelfService)
+	require.True(t, *titles[0].AppStoreApp.SelfService)
+
+	// Get title of bar software.
+	title, err := ds.SoftwareTitleByID(context.Background(), barTitle.ID, nil, globalTeamFilter)
 	require.NoError(t, err)
+	require.Zero(t, title.SoftwareInstallersCount)
+	require.Zero(t, title.VPPAppsCount)
+
 	// ListSoftwareTitles does not populate version host counts, so we do that manually
-	titles[0].Versions[0].HostsCount = ptr.Uint(1)
-	assert.Equal(t, titles[0], fleet.SoftwareTitleListResult{ID: title.ID, Name: title.Name, Source: title.Source, Browser: title.Browser, HostsCount: title.HostsCount, VersionsCount: title.VersionsCount, Versions: title.Versions, CountsUpdatedAt: title.CountsUpdatedAt})
+	barTitle.Versions[0].HostsCount = ptr.Uint(1)
+	assert.Equal(
+		t,
+		barTitle,
+		fleet.SoftwareTitleListResult{
+			ID:              title.ID,
+			Name:            title.Name,
+			Source:          title.Source,
+			Browser:         title.Browser,
+			HostsCount:      title.HostsCount,
+			VersionsCount:   title.VersionsCount,
+			Versions:        title.Versions,
+			CountsUpdatedAt: title.CountsUpdatedAt,
+		},
+	)
 
 	// Testing with team filter -- this team does not contain this software title
-	_, err = ds.SoftwareTitleByID(context.Background(), titles[0].ID, &team1.ID, globalTeamFilter)
+	_, err = ds.SoftwareTitleByID(context.Background(), barTitle.ID, &team1.ID, globalTeamFilter)
 	assert.ErrorIs(t, err, sql.ErrNoRows)
 
 	// Testing with team filter -- this team does contain this software title
-	title, err = ds.SoftwareTitleByID(context.Background(), titles[1].ID, &team1.ID, globalTeamFilter)
+	title, err = ds.SoftwareTitleByID(context.Background(), fooTitle.ID, &team1.ID, globalTeamFilter)
 	require.NoError(t, err)
+	require.Zero(t, title.SoftwareInstallersCount)
+	require.Zero(t, title.VPPAppsCount)
 	assert.Equal(t, uint(1), title.HostsCount)
 	assert.Equal(t, uint(1), title.VersionsCount)
 	require.Len(t, title.Versions, 1)
@@ -598,8 +776,21 @@ func testTeamFilterSoftwareTitles(t *testing.T, ds *Datastore) {
 	require.Equal(t, "chrome_extensions", titles[0].Source)
 	require.Equal(t, "installer1", titles[1].Name)
 	require.Equal(t, "apps", titles[1].Source)
+	require.NotNil(t, titles[1].BundleIdentifier)
+	require.Equal(t, "foo.bar", *titles[1].BundleIdentifier)
 	require.Equal(t, uint(1), titles[0].VersionsCount)
+	require.Nil(t, titles[0].SoftwarePackage)
+	require.Nil(t, titles[0].AppStoreApp)
 	require.Equal(t, uint(0), titles[1].VersionsCount)
+	require.NotNil(t, titles[1].SoftwarePackage)
+	require.Nil(t, titles[1].AppStoreApp)
+
+	title, err = ds.SoftwareTitleByID(context.Background(), titles[1].ID, &team1.ID, team1TeamFilter)
+	require.NoError(t, err)
+	require.Equal(t, "installer1", title.Name)
+	require.Equal(t, "apps", title.Source)
+	require.NotNil(t, title.BundleIdentifier)
+	require.Equal(t, "foo.bar", *title.BundleIdentifier)
 
 	// Testing with team filter -- this team does contain this software title
 	title, err = ds.SoftwareTitleByID(context.Background(), titles[0].ID, &team1.ID, team1TeamFilter)
@@ -613,19 +804,30 @@ func testTeamFilterSoftwareTitles(t *testing.T, ds *Datastore) {
 		User:            userTeam2Admin,
 		IncludeObserver: true,
 	})
-	// installer2 is associated with team 2
+	// installer2 and vpp2 is associated with team 2
 	require.NoError(t, err)
-	require.Len(t, titles, 3)
-	require.Equal(t, 3, count)
+	require.Len(t, titles, 4)
+	require.Equal(t, 4, count)
 	require.Equal(t, "bar", titles[0].Name)
 	require.Equal(t, "deb_packages", titles[0].Source)
 	require.Equal(t, "foo", titles[1].Name)
 	require.Equal(t, "chrome_extensions", titles[1].Source)
 	require.Equal(t, "installer2", titles[2].Name)
 	require.Equal(t, "apps", titles[2].Source)
+	require.Equal(t, "vpp2", titles[3].Name)
+	assert.Equal(t, "ios_apps", titles[3].Source)
 	require.Equal(t, uint(1), titles[0].VersionsCount)
 	require.Equal(t, uint(1), titles[1].VersionsCount)
 	require.Equal(t, uint(0), titles[2].VersionsCount)
+	require.Equal(t, uint(0), titles[3].VersionsCount)
+	require.Nil(t, titles[0].SoftwarePackage)
+	require.Nil(t, titles[0].AppStoreApp)
+	require.Nil(t, titles[1].SoftwarePackage)
+	require.Nil(t, titles[1].AppStoreApp)
+	require.NotNil(t, titles[2].SoftwarePackage)
+	require.Nil(t, titles[2].AppStoreApp)
+	require.Nil(t, titles[3].SoftwarePackage)
+	require.NotNil(t, titles[3].AppStoreApp)
 
 	// Testing the team 1 user with self-service only
 	titles, _, _, err = ds.ListSoftwareTitles(
@@ -637,6 +839,11 @@ func testTeamFilterSoftwareTitles(t *testing.T, ds *Datastore) {
 	require.Equal(t, "installer1", titles[0].Name)
 	require.Equal(t, "apps", titles[0].Source)
 
+	title, err = ds.SoftwareTitleByID(context.Background(), titles[0].ID, &team1.ID, team1TeamFilter)
+	require.NoError(t, err)
+	require.Equal(t, 1, title.SoftwareInstallersCount)
+	require.Zero(t, title.VPPAppsCount)
+
 	// Testing the team 2 user with self-service only
 	titles, _, _, err = ds.ListSoftwareTitles(context.Background(), fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{}, SelfServiceOnly: true, TeamID: &team2.ID}, fleet.TeamFilter{
 		User:            userTeam2Admin,
@@ -644,6 +851,15 @@ func testTeamFilterSoftwareTitles(t *testing.T, ds *Datastore) {
 	})
 	require.NoError(t, err)
 	require.Len(t, titles, 0)
+
+	// Testing the no-team filter with self-service only
+	titles, _, _, err = ds.ListSoftwareTitles(context.Background(), fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{}, SelfServiceOnly: true, TeamID: ptr.Uint(0)}, fleet.TeamFilter{
+		User:            userGlobalAdmin,
+		IncludeObserver: true,
+	})
+	require.NoError(t, err)
+	require.Len(t, titles, 1)
+	require.Equal(t, "vpp3", titles[0].Name)
 }
 
 func sortTitlesByName(titles []fleet.SoftwareTitleListResult) {
@@ -653,12 +869,17 @@ func sortTitlesByName(titles []fleet.SoftwareTitleListResult) {
 func testListSoftwareTitlesInstallersOnly(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
+	test.CreateInsertGlobalVPPToken(t, ds)
+
 	// create a couple software installers not installed on any host
 	installer1, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
 		Title:         "installer1",
 		Source:        "apps",
 		InstallScript: "echo",
 		Filename:      "installer1.pkg",
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	require.NotZero(t, installer1)
@@ -667,37 +888,50 @@ func testListSoftwareTitlesInstallersOnly(t *testing.T, ds *Datastore) {
 		Source:        "apps",
 		InstallScript: "echo",
 		Filename:      "installer2.pkg",
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	require.NotZero(t, installer2)
+	// create a VPP app not installed on a host
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp1", BundleIdentifier: "com.app,vpp1",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_1", Platform: fleet.MacOSPlatform}},
+	}, nil)
+	require.NoError(t, err)
 
-	titles, counts, _, err := ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "name",
-		OrderDirection: fleet.OrderAscending,
-	}}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, counts, _, err := ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "name",
+			OrderDirection: fleet.OrderAscending,
+		},
+		TeamID: ptr.Uint(0),
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
-	require.EqualValues(t, 2, counts)
-	require.Len(t, titles, 2)
+	require.EqualValues(t, 3, counts)
+	require.Len(t, titles, 3)
 	require.Equal(t, "installer1", titles[0].Name)
 	require.Equal(t, "apps", titles[0].Source)
 	require.Equal(t, "installer2", titles[1].Name)
 	require.Equal(t, "apps", titles[1].Source)
+	require.Equal(t, "vpp1", titles[2].Name)
+	require.Equal(t, "apps", titles[2].Source)
 	require.True(t, titles[0].CountsUpdatedAt.IsZero())
 	require.True(t, titles[1].CountsUpdatedAt.IsZero())
-	require.NotNil(t, titles[0].SoftwarePackage)
-	require.Equal(t, "installer1.pkg", *titles[0].SoftwarePackage)
-	require.NotNil(t, titles[1].SoftwarePackage)
-	require.Equal(t, "installer2.pkg", *titles[1].SoftwarePackage)
+	require.True(t, titles[2].CountsUpdatedAt.IsZero())
 
 	require.NoError(t, ds.SyncHostsSoftware(ctx, time.Now()))
 	require.NoError(t, ds.ReconcileSoftwareTitles(ctx))
 	require.NoError(t, ds.SyncHostsSoftwareTitles(ctx, time.Now()))
 
-	titles, counts, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "name",
-		OrderDirection: fleet.OrderAscending,
-		MatchQuery:     "installer1",
-	}}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	// match installer1 name
+	titles, counts, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "name",
+			OrderDirection: fleet.OrderAscending,
+			MatchQuery:     "installer1",
+		},
+		TeamID: ptr.Uint(0),
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
 	require.EqualValues(t, 1, counts)
 	require.Len(t, titles, 1)
@@ -706,11 +940,15 @@ func testListSoftwareTitlesInstallersOnly(t *testing.T, ds *Datastore) {
 	require.True(t, titles[0].CountsUpdatedAt.IsZero())
 
 	// vulnerable only returns nothing
-	titles, counts, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "name",
-		OrderDirection: fleet.OrderAscending,
-		MatchQuery:     "installer1",
-	}, VulnerableOnly: true}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, counts, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "name",
+			OrderDirection: fleet.OrderAscending,
+			MatchQuery:     "installer1",
+		},
+		TeamID:         ptr.Uint(0),
+		VulnerableOnly: true,
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
 	require.EqualValues(t, 0, counts)
 	require.Len(t, titles, 0)
@@ -724,23 +962,29 @@ func testListSoftwareTitlesInstallersOnly(t *testing.T, ds *Datastore) {
 				OrderDirection: fleet.OrderAscending,
 			},
 			AvailableForInstall: true,
+			TeamID:              ptr.Uint(0),
 		},
 		fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}},
 	)
 	require.NoError(t, err)
-	require.EqualValues(t, 2, counts)
-	require.Len(t, titles, 2)
+	require.EqualValues(t, 3, counts)
+	require.Len(t, titles, 3)
 	require.True(t, titles[0].CountsUpdatedAt.IsZero())
 }
 
 func testListSoftwareTitlesAvailableForInstallFilter(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
 
+	test.CreateInsertGlobalVPPToken(t, ds)
+
+	// create 2 software installers
 	installer1, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
 		Title:         "installer1",
 		Source:        "apps",
 		InstallScript: "echo",
 		Filename:      "installer1.pkg",
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	require.NotZero(t, installer1)
@@ -749,15 +993,40 @@ func testListSoftwareTitlesAvailableForInstallFilter(t *testing.T, ds *Datastore
 		Source:        "apps",
 		InstallScript: "echo",
 		Filename:      "installer2.pkg",
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	require.NotZero(t, installer2)
 
+	// create a 4 VPP apps
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp1", BundleIdentifier: "com.example.vpp1",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_1", Platform: fleet.MacOSPlatform}},
+	}, nil)
+	require.NoError(t, err)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp2", BundleIdentifier: "com.example.vpp2",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.IPadOSPlatform}},
+	}, nil)
+	require.NoError(t, err)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp2", BundleIdentifier: "com.example.vpp2",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.MacOSPlatform}},
+	}, nil)
+	require.NoError(t, err)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp2", BundleIdentifier: "com.example.vpp2",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.IOSPlatform}},
+	}, nil)
+	require.NoError(t, err)
+
 	host := test.NewHost(t, ds, "host", "", "hostkey", "hostuuid", time.Now())
 	software := []fleet.Software{
 		{Name: "foo", Version: "0.0.1", Source: "chrome_extensions"},
 		{Name: "foo", Version: "0.0.3", Source: "chrome_extensions"},
 		{Name: "bar", Version: "0.0.3", Source: "deb_packages"},
+		{Name: "vpp1", Version: "0.0.1", Source: "apps"},
+		{Name: "installer1", Version: "0.0.1", Source: "apps"},
 	}
 	_, err = ds.UpdateHostSoftware(ctx, host.ID, software)
 	require.NoError(t, err)
@@ -773,14 +1042,64 @@ func testListSoftwareTitlesAvailableForInstallFilter(t *testing.T, ds *Datastore
 				OrderKey:       "name",
 				OrderDirection: fleet.OrderAscending,
 			},
+			TeamID: ptr.Uint(0),
 		},
 		fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}},
 	)
 	require.NoError(t, err)
-	require.EqualValues(t, 4, counts)
-	require.Len(t, titles, 4)
+	assert.EqualValues(t, 8, counts)
+	assert.Len(t, titles, 8)
+	type nameSource struct {
+		name   string
+		source string
+	}
+	names := make([]nameSource, 0, len(titles))
+	for _, title := range titles {
+		names = append(names, nameSource{name: title.Name, source: title.Source})
+	}
+	assert.ElementsMatch(t, []nameSource{
+		{name: "bar", source: "deb_packages"},
+		{name: "foo", source: "chrome_extensions"},
+		{name: "installer1", source: "apps"},
+		{name: "installer2", source: "apps"},
+		{name: "vpp1", source: "apps"},
+		{name: "vpp2", source: "ios_apps"},
+		{name: "vpp2", source: "ipados_apps"},
+		{name: "vpp2", source: "apps"},
+	}, names)
+
+	var vppVersionID uint
+	var installer1ID uint
+	var fooID uint
+	for _, title := range titles {
+		switch title.Name {
+		case "vpp1":
+			vppVersionID = title.Versions[0].ID
+		case "installer1":
+			installer1ID = title.Versions[0].ID
+		case "foo":
+			fooID = title.Versions[0].ID
+		}
+	}
+
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: vppVersionID,
+		CVE:        "CVE-2021-1234",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: installer1ID,
+		CVE:        "CVE-2021-1234",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: fooID,
+		CVE:        "CVE-2021-1234",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
 
-	// with filter returns only available for install
 	titles, counts, _, err = ds.ListSoftwareTitles(
 		ctx,
 		fleet.SoftwareTitleListOptions{
@@ -788,11 +1107,569 @@ func testListSoftwareTitlesAvailableForInstallFilter(t *testing.T, ds *Datastore
 				OrderKey:       "name",
 				OrderDirection: fleet.OrderAscending,
 			},
+			TeamID:              ptr.Uint(0),
 			AvailableForInstall: true,
+			VulnerableOnly:      true,
 		},
 		fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}},
 	)
 	require.NoError(t, err)
 	require.EqualValues(t, 2, counts)
 	require.Len(t, titles, 2)
+	names = make([]nameSource, 0, len(titles))
+	for _, title := range titles {
+		names = append(names, nameSource{name: title.Name, source: title.Source})
+	}
+	assert.ElementsMatch(t, []nameSource{
+		{name: "installer1", source: "apps"},
+		{name: "vpp1", source: "apps"},
+	}, names)
+
+	// with filter returns only available for install
+	titles, counts, _, err = ds.ListSoftwareTitles(
+		ctx,
+		fleet.SoftwareTitleListOptions{
+			ListOptions: fleet.ListOptions{
+				OrderKey:       "name",
+				OrderDirection: fleet.OrderAscending,
+			},
+			AvailableForInstall: true,
+			TeamID:              ptr.Uint(0),
+		},
+		fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}},
+	)
+	require.NoError(t, err)
+	require.EqualValues(t, 6, counts)
+	require.Len(t, titles, 6)
+
+	names = make([]nameSource, 0, len(titles))
+	for _, title := range titles {
+		names = append(names, nameSource{name: title.Name, source: title.Source})
+	}
+	assert.ElementsMatch(t, []nameSource{
+		{name: "installer1", source: "apps"},
+		{name: "installer2", source: "apps"},
+		{name: "vpp1", source: "apps"},
+		{name: "vpp2", source: "ios_apps"},
+		{name: "vpp2", source: "ipados_apps"},
+		{name: "vpp2", source: "apps"},
+	}, names)
+}
+
+func testListSoftwareTitlesAllTeams(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	test.CreateInsertGlobalVPPToken(t, ds)
+
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+	team2, err := ds.NewTeam(ctx, &fleet.Team{Name: "team2"})
+	require.NoError(t, err)
+
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
+	// Create a macOS software foobar installer on "No team".
+	macOSInstallerNoTeam, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		Title:            "foobar",
+		BundleIdentifier: "com.foo.bar",
+		Source:           "apps",
+		InstallScript:    "echo",
+		Filename:         "foobar.pkg",
+		TeamID:           nil,
+		UserID:           user1.ID,
+	})
+	require.NoError(t, err)
+
+	// Create an iOS Canva installer on "team1".
+	require.NotZero(t, macOSInstallerNoTeam)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "Canva", BundleIdentifier: "com.example.canva",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_canva", Platform: fleet.IOSPlatform}},
+	}, &team1.ID)
+	require.NoError(t, err)
+
+	// Create a macOS Canva installer on "team1".
+	require.NotZero(t, macOSInstallerNoTeam)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "Canva", BundleIdentifier: "com.example.canva",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_canva", Platform: fleet.MacOSPlatform}},
+	}, &team1.ID)
+	require.NoError(t, err)
+
+	// Create an iPadOS Canva installer on "team2".
+	require.NotZero(t, macOSInstallerNoTeam)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "Canva", BundleIdentifier: "com.example.canva",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_canva", Platform: fleet.IPadOSPlatform}},
+	}, &team2.ID)
+	require.NoError(t, err)
+
+	// Add a macOS host on "No team" with some software.
+	host := test.NewHost(t, ds, "host", "", "hostkey", "hostuuid", time.Now())
+	software := []fleet.Software{
+		{Name: "foo", Version: "0.0.1", Source: "chrome_extensions"},
+		{Name: "foo", Version: "0.0.3", Source: "chrome_extensions"},
+		{Name: "bar", Version: "0.0.3", Source: "deb_packages"},
+	}
+	_, err = ds.UpdateHostSoftware(ctx, host.ID, software)
+	require.NoError(t, err)
+
+	// Simulate vulnerabilities cron
+	require.NoError(t, ds.SyncHostsSoftware(ctx, time.Now()))
+	require.NoError(t, ds.ReconcileSoftwareTitles(ctx))
+	require.NoError(t, ds.SyncHostsSoftwareTitles(ctx, time.Now()))
+
+	// List software titles for "All teams", should only return the host software titles
+	// and no installers/VPP-apps because none is installed yet.
+	titles, counts, _, err := ds.ListSoftwareTitles(
+		ctx,
+		fleet.SoftwareTitleListOptions{
+			ListOptions: fleet.ListOptions{
+				OrderKey:       "name",
+				OrderDirection: fleet.OrderAscending,
+			},
+			TeamID: nil,
+		},
+		fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}},
+	)
+	require.NoError(t, err)
+	assert.EqualValues(t, 2, counts)
+	assert.Len(t, titles, 2)
+	type nameSource struct {
+		name   string
+		source string
+	}
+	names := make([]nameSource, 0, len(titles))
+	for _, title := range titles {
+		names = append(names, nameSource{name: title.Name, source: title.Source})
+	}
+	assert.ElementsMatch(t, []nameSource{
+		{name: "bar", source: "deb_packages"},
+		{name: "foo", source: "chrome_extensions"},
+	}, names)
+
+	// List software for "No team". Should list the host's software + the macOS installer.
+	titles, counts, _, err = ds.ListSoftwareTitles(
+		ctx,
+		fleet.SoftwareTitleListOptions{
+			ListOptions: fleet.ListOptions{
+				OrderKey:       "name",
+				OrderDirection: fleet.OrderAscending,
+			},
+			TeamID: ptr.Uint(0),
+		},
+		fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}},
+	)
+	require.NoError(t, err)
+	assert.EqualValues(t, 3, counts)
+	assert.Len(t, titles, 3)
+	names = make([]nameSource, 0, len(titles))
+	for _, title := range titles {
+		names = append(names, nameSource{name: title.Name, source: title.Source})
+	}
+	assert.ElementsMatch(t, []nameSource{
+		{name: "bar", source: "deb_packages"},
+		{name: "foo", source: "chrome_extensions"},
+		{name: "foobar", source: "apps"},
+	}, names)
+
+	// List software for "team1". Should list Canva for iOS and macOS.
+	titles, counts, _, err = ds.ListSoftwareTitles(
+		ctx,
+		fleet.SoftwareTitleListOptions{
+			ListOptions: fleet.ListOptions{
+				OrderKey:       "name",
+				OrderDirection: fleet.OrderAscending,
+			},
+			TeamID: &team1.ID,
+		},
+		fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}},
+	)
+	require.NoError(t, err)
+	assert.EqualValues(t, 2, counts)
+	assert.Len(t, titles, 2)
+	names = make([]nameSource, 0, len(titles))
+	for _, title := range titles {
+		names = append(names, nameSource{name: title.Name, source: title.Source})
+	}
+	assert.ElementsMatch(t, []nameSource{
+		{name: "Canva", source: "ios_apps"},
+		{name: "Canva", source: "apps"},
+	}, names)
+
+	// List software for "team2". Should list Canva for iPadOS.
+	titles, counts, _, err = ds.ListSoftwareTitles(
+		ctx,
+		fleet.SoftwareTitleListOptions{
+			ListOptions: fleet.ListOptions{
+				OrderKey:       "name",
+				OrderDirection: fleet.OrderAscending,
+			},
+			TeamID: &team2.ID,
+		},
+		fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}},
+	)
+	require.NoError(t, err)
+	assert.EqualValues(t, 1, counts)
+	assert.Len(t, titles, 1)
+	names = make([]nameSource, 0, len(titles))
+	for _, title := range titles {
+		names = append(names, nameSource{name: title.Name, source: title.Source})
+	}
+	assert.ElementsMatch(t, []nameSource{
+		{name: "Canva", source: "ipados_apps"},
+	}, names)
+
+	// List software available for install on "No team". Should list "foobar" package only.
+	titles, counts, _, err = ds.ListSoftwareTitles(
+		ctx,
+		fleet.SoftwareTitleListOptions{
+			ListOptions: fleet.ListOptions{
+				OrderKey:       "name",
+				OrderDirection: fleet.OrderAscending,
+			},
+			AvailableForInstall: true,
+			TeamID:              ptr.Uint(0),
+		},
+		fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}},
+	)
+	require.NoError(t, err)
+	require.EqualValues(t, 1, counts)
+	require.Len(t, titles, 1)
+
+	names = make([]nameSource, 0, len(titles))
+	for _, title := range titles {
+		names = append(names, nameSource{name: title.Name, source: title.Source})
+	}
+	assert.ElementsMatch(t, []nameSource{
+		{name: "foobar", source: "apps"},
+	}, names)
+}
+
+func testUploadedSoftwareExists(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	tm, err := ds.NewTeam(ctx, &fleet.Team{Name: "Team Foo"})
+	require.NoError(t, err)
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
+	installer1, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		Title:            "installer1",
+		Source:           "apps",
+		InstallScript:    "echo",
+		Filename:         "installer1.pkg",
+		BundleIdentifier: "com.foo.installer1",
+		UserID:           user1.ID,
+	})
+	require.NoError(t, err)
+	require.NotZero(t, installer1)
+	installer2, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		Title:            "installer2",
+		Source:           "apps",
+		InstallScript:    "echo",
+		Filename:         "installer2.pkg",
+		TeamID:           &tm.ID,
+		BundleIdentifier: "com.foo.installer2",
+		UserID:           user1.ID,
+	})
+	require.NoError(t, err)
+	require.NotZero(t, installer2)
+
+	exists, err := ds.UploadedSoftwareExists(ctx, "com.foo.installer1", nil)
+	require.NoError(t, err)
+	require.True(t, exists)
+
+	exists, err = ds.UploadedSoftwareExists(ctx, "com.foo.installer2", nil)
+	require.NoError(t, err)
+	require.False(t, exists)
+
+	exists, err = ds.UploadedSoftwareExists(ctx, "com.foo.installer2", &tm.ID)
+	require.NoError(t, err)
+	require.True(t, exists)
+}
+
+func testListSoftwareTitlesVulnerabilityFilters(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+	host := test.NewHost(t, ds, "host", "", "hostkey", "hostuuid", time.Now())
+
+	software := []fleet.Software{
+		{Name: "chrome", Version: "0.0.1", Source: "apps"},
+		{Name: "chrome", Version: "0.0.3", Source: "apps"},
+		{Name: "safari", Version: "0.0.3", Source: "apps"},
+		{Name: "safari", Version: "0.0.1", Source: "apps"},
+		{Name: "firefox", Version: "0.0.3", Source: "apps"},
+		{Name: "edge", Version: "0.0.3", Source: "apps"},
+		{Name: "brave", Version: "0.0.3", Source: "apps"},
+		{Name: "opera", Version: "0.0.3", Source: "apps"},
+		{Name: "internet explorer", Version: "0.0.3", Source: "apps"},
+		{Name: "netscape", Version: "0.0.3", Source: "apps"},
+	}
+
+	sw, err := ds.UpdateHostSoftware(ctx, host.ID, software)
+	require.NoError(t, err)
+
+	var chrome001 uint
+	var safari001 uint
+	var firefox003 uint
+	var edge003 uint
+	var brave003 uint
+	var opera003 uint
+	var ie003 uint
+	for s := range sw.Inserted {
+		switch {
+		case sw.Inserted[s].Name == "chrome" && sw.Inserted[s].Version == "0.0.1":
+			chrome001 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "safari" && sw.Inserted[s].Version == "0.0.1":
+			safari001 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "firefox" && sw.Inserted[s].Version == "0.0.3":
+			firefox003 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "edge" && sw.Inserted[s].Version == "0.0.3":
+			edge003 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "brave" && sw.Inserted[s].Version == "0.0.3":
+			brave003 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "opera" && sw.Inserted[s].Version == "0.0.3":
+			opera003 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "internet explorer" && sw.Inserted[s].Version == "0.0.3":
+			ie003 = sw.Inserted[s].ID
+		}
+	}
+
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: chrome001,
+		CVE:        "CVE-2024-1234",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: safari001,
+		CVE:        "CVE-2024-1235",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: firefox003,
+		CVE:        "CVE-2024-1236",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: edge003,
+		CVE:        "CVE-2024-1237",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: brave003,
+		CVE:        "CVE-2024-1238",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: opera003,
+		CVE:        "CVE-2024-1239",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: ie003,
+		CVE:        "CVE-2024-1240",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+
+	err = ds.InsertCVEMeta(ctx, []fleet.CVEMeta{
+		{
+			// chrome
+			CVE:              "CVE-2024-1234",
+			CVSSScore:        ptr.Float64(7.5),
+			CISAKnownExploit: ptr.Bool(true),
+		},
+		{
+			// safari
+			CVE:              "CVE-2024-1235",
+			CVSSScore:        ptr.Float64(7.5),
+			CISAKnownExploit: ptr.Bool(false),
+		},
+		{
+			// firefox
+			CVE:              "CVE-2024-1236",
+			CVSSScore:        ptr.Float64(8.0),
+			CISAKnownExploit: ptr.Bool(true),
+		},
+		{
+			// edge
+			CVE:              "CVE-2024-1237",
+			CVSSScore:        ptr.Float64(8.0),
+			CISAKnownExploit: ptr.Bool(false),
+		},
+		{
+			// brave
+			CVE:              "CVE-2024-1238",
+			CVSSScore:        ptr.Float64(9.0),
+			CISAKnownExploit: ptr.Bool(true),
+		},
+		// CVE-2024-1239 for opera has no CVE Meta
+		{
+			// internet explorer
+			CVE:              "CVE-2024-1240",
+			CVSSScore:        nil,
+			CISAKnownExploit: nil,
+		},
+	})
+	require.NoError(t, err)
+
+	require.NoError(t, ds.SyncHostsSoftware(ctx, time.Now()))
+	require.NoError(t, ds.ReconcileSoftwareTitles(ctx))
+	require.NoError(t, ds.SyncHostsSoftwareTitles(ctx, time.Now()))
+
+	globalUser := &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}
+
+	tc := []struct {
+		name           string
+		opts           fleet.SoftwareTitleListOptions
+		expectedTitles []string
+		err            error
+	}{
+		{
+			name: "vulnerable only",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+			},
+			expectedTitles: []string{"chrome", "safari", "firefox", "edge", "brave", "opera", "internet explorer"},
+		},
+		{
+			name: "known exploit true",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				KnownExploit:   true,
+			},
+			expectedTitles: []string{"chrome", "firefox", "brave"},
+		},
+		{
+			name: "minimum cvss 8.0",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				MinimumCVSS:    8.0,
+			},
+			expectedTitles: []string{"edge", "firefox", "brave"},
+		},
+		{
+			name: "minimum cvss 7.9",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				MinimumCVSS:    7.9,
+			},
+			expectedTitles: []string{"edge", "firefox", "brave"},
+		},
+		{
+			name: "minimum cvss 8.0 and known exploit",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				MinimumCVSS:    8.0,
+				KnownExploit:   true,
+			},
+			expectedTitles: []string{"firefox", "brave"},
+		},
+		{
+			name: "minimum cvss 7.5 and known exploit",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				MinimumCVSS:    7.5,
+				KnownExploit:   true,
+			},
+			expectedTitles: []string{"chrome", "firefox", "brave"},
+		},
+		{
+			name: "maximum cvss 7.5",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				MaximumCVSS:    7.5,
+			},
+			expectedTitles: []string{"chrome", "safari"},
+		},
+		{
+			name: "maximum cvss 7.6",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				MaximumCVSS:    7.6,
+			},
+			expectedTitles: []string{"chrome", "safari"},
+		},
+		{
+			name: "maximum cvss 7.5 and known exploit",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				MaximumCVSS:    7.5,
+				KnownExploit:   true,
+			},
+			expectedTitles: []string{"chrome"},
+		},
+		{
+			name: "minimum cvss 7.5 and maximum cvss 8.0",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				MinimumCVSS:    7.5,
+				MaximumCVSS:    8.0,
+			},
+			expectedTitles: []string{"chrome", "safari", "firefox", "edge"},
+		},
+		{
+			name: "minimum cvss 7.5 and maximum cvss 8.0 and known exploit",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				MinimumCVSS:    7.5,
+				MaximumCVSS:    8.0,
+				KnownExploit:   true,
+			},
+			expectedTitles: []string{"chrome", "firefox"},
+		},
+		{
+			name: "err if vulnerableOnly is not set with MinimumCVSS",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions: fleet.ListOptions{},
+				MinimumCVSS: 7.5,
+			},
+			err: fleet.NewInvalidArgumentError("query", "min_cvss_score, max_cvss_score, and exploit can only be provided with vulnerable=true"),
+		},
+		{
+			name: "err if vulnerableOnly is not set with MaximumCVSS",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions: fleet.ListOptions{},
+				MaximumCVSS: 7.5,
+			},
+			err: fleet.NewInvalidArgumentError("query", "min_cvss_score, max_cvss_score, and exploit can only be provided with vulnerable=true"),
+		},
+		{
+			name: "err if vulnerableOnly is not set with KnownExploit",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:  fleet.ListOptions{},
+				KnownExploit: true,
+			},
+			err: fleet.NewInvalidArgumentError("query", "min_cvss_score, max_cvss_score, and exploit can only be provided with vulnerable=true"),
+		},
+	}
+
+	assertTitles := func(t *testing.T, titles []fleet.SoftwareTitleListResult, expectedTitles []string) {
+		t.Helper()
+		require.Len(t, titles, len(expectedTitles))
+		for _, title := range titles {
+			require.Contains(t, expectedTitles, title.Name)
+		}
+	}
+
+	for _, tt := range tc {
+		t.Run(tt.name, func(t *testing.T) {
+			titles, _, _, err := ds.ListSoftwareTitles(ctx, tt.opts, fleet.TeamFilter{User: globalUser})
+			if tt.err != nil {
+				require.Error(t, err)
+				require.Equal(t, tt.err, err)
+				return
+			}
+			assertTitles(t, titles, tt.expectedTitles)
+		})
+	}
 }
diff --git a/server/datastore/mysql/statistics.go b/server/datastore/mysql/statistics.go
index 55e9b9e4eeb5..31b65429fecd 100644
--- a/server/datastore/mysql/statistics.go
+++ b/server/datastore/mysql/statistics.go
@@ -10,6 +10,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/contexts/license"
 	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/fleetdm/fleet/v4/server/version"
 	"github.com/go-kit/log/level"
 	"github.com/jmoiron/sqlx"
@@ -98,6 +99,10 @@ func (ds *Datastore) ShouldSendStatistics(ctx context.Context, frequency time.Du
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "amount hosts by osquery version")
 		}
+		numHostsFleetDesktopEnabled, err := numHostsFleetDesktopEnabledDB(ctx, ds.reader(ctx))
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "number of hosts with Fleet desktop installed")
+		}
 
 		stats.NumHostsEnrolled = amountEnrolledHosts
 		stats.NumUsers = amountUsers
@@ -130,6 +135,23 @@ func (ds *Datastore) ShouldSendStatistics(ctx context.Context, frequency time.Du
 		if lic != nil && lic.IsPremium() {
 			stats.Organization = lic.Organization
 		}
+		stats.AIFeaturesDisabled = appConfig.ServerSettings.AIFeaturesDisabled
+		stats.MaintenanceWindowsConfigured = len(appConfig.Integrations.GoogleCalendar) > 0 && appConfig.Integrations.GoogleCalendar[0].Domain != "" && len(appConfig.Integrations.GoogleCalendar[0].ApiKey) > 0
+
+		stats.MaintenanceWindowsEnabled = false
+		teams, err := ds.ListTeams(ctx, fleet.TeamFilter{User: &fleet.User{
+			GlobalRole: ptr.String(fleet.RoleAdmin),
+		}}, fleet.ListOptions{})
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "list teams")
+		}
+		for _, team := range teams {
+			if team.Config.Integrations.GoogleCalendar != nil && team.Config.Integrations.GoogleCalendar.Enable {
+				stats.MaintenanceWindowsEnabled = true
+				break
+			}
+		}
+		stats.NumHostsFleetDesktopEnabled = numHostsFleetDesktopEnabled
 		return nil
 	}
 
diff --git a/server/datastore/mysql/statistics_test.go b/server/datastore/mysql/statistics_test.go
index 0f8e5b426ab7..c152e0342905 100644
--- a/server/datastore/mysql/statistics_test.go
+++ b/server/datastore/mysql/statistics_test.go
@@ -87,6 +87,10 @@ func testStatisticsShouldSend(t *testing.T, ds *Datastore) {
 	assert.Equal(t, false, stats.HostExpiryEnabled)
 	assert.Equal(t, false, stats.MDMWindowsEnabled)
 	assert.Equal(t, false, stats.LiveQueryDisabled)
+	assert.Equal(t, false, stats.AIFeaturesDisabled)
+	assert.Equal(t, false, stats.MaintenanceWindowsEnabled)
+	assert.Equal(t, false, stats.MaintenanceWindowsConfigured)
+	assert.Equal(t, 0, stats.NumHostsFleetDesktopEnabled)
 
 	firstIdentifier := stats.AnonymousIdentifier
 
@@ -227,6 +231,10 @@ func testStatisticsShouldSend(t *testing.T, ds *Datastore) {
 	assert.Equal(t, `[{"count":10,"loc":["a","b","c"]}]`, string(stats.StoredErrors))
 	assert.Equal(t, []fleet.HostsCountByOsqueryVersion{{OsqueryVersion: "4.9.0", NumHosts: 1}}, stats.HostsEnrolledByOsqueryVersion)
 	assert.Equal(t, []fleet.HostsCountByOrbitVersion{{OrbitVersion: "1.1.0", NumHosts: 1}}, stats.HostsEnrolledByOrbitVersion)
+	assert.Equal(t, false, stats.AIFeaturesDisabled)
+	assert.Equal(t, false, stats.MaintenanceWindowsEnabled)
+	assert.Equal(t, false, stats.MaintenanceWindowsConfigured)
+	assert.Equal(t, 1, stats.NumHostsFleetDesktopEnabled)
 
 	err = ds.RecordStatisticsSent(ctx)
 	require.NoError(t, err)
@@ -332,6 +340,10 @@ func testStatisticsShouldSend(t *testing.T, ds *Datastore) {
 		{Version: "", NumEnrolled: 1},
 	}, stats.HostsEnrolledByOperatingSystem[""])
 	assert.Equal(t, `[{"count":10,"loc":["a","b","c"]}]`, string(stats.StoredErrors))
+	assert.Equal(t, false, stats.AIFeaturesDisabled)
+	assert.Equal(t, false, stats.MaintenanceWindowsEnabled)
+	assert.Equal(t, false, stats.MaintenanceWindowsConfigured)
+	assert.Equal(t, 1, stats.NumHostsFleetDesktopEnabled)
 
 	// Create multiple new sessions for a single user
 	_, err = ds.NewSession(ctx, u1.ID, "session_key2")
@@ -366,6 +378,10 @@ func testStatisticsShouldSend(t *testing.T, ds *Datastore) {
 	assert.Equal(t, 0, stats.NumWeeklyPolicyViolationDaysActual)
 	assert.Equal(t, 0, stats.NumWeeklyPolicyViolationDaysPossible)
 	assert.Equal(t, `[{"count":10,"loc":["a","b","c"]}]`, string(stats.StoredErrors))
+	assert.Equal(t, false, stats.AIFeaturesDisabled)
+	assert.Equal(t, false, stats.MaintenanceWindowsEnabled)
+	assert.Equal(t, false, stats.MaintenanceWindowsConfigured)
+	assert.Equal(t, 1, stats.NumHostsFleetDesktopEnabled)
 
 	// Add host to test hosts not responding stats
 	_, err = ds.NewHost(ctx, &fleet.Host{
diff --git a/server/datastore/mysql/teams.go b/server/datastore/mysql/teams.go
index c25b4a791c38..c0d1b8b61b17 100644
--- a/server/datastore/mysql/teams.go
+++ b/server/datastore/mysql/teams.go
@@ -106,7 +106,14 @@ func saveTeamSecretsDB(ctx context.Context, q sqlx.ExtContext, team *fleet.Team)
 
 func (ds *Datastore) DeleteTeam(ctx context.Context, tid uint) error {
 	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
-		_, err := tx.ExecContext(ctx, `DELETE FROM teams WHERE id = ?`, tid)
+		// Delete team policies first, because policies can have associated installers which may be deleted on cascade
+		// before deleting the policies (which are also deleted on cascade).
+		_, err := tx.ExecContext(ctx, `DELETE FROM policies WHERE team_id = ?`, tid)
+		if err != nil {
+			return ctxerr.Wrapf(ctx, err, "deleting policies for team %d", tid)
+		}
+
+		_, err = tx.ExecContext(ctx, `DELETE FROM teams WHERE id = ?`, tid)
 		if err != nil {
 			return ctxerr.Wrapf(ctx, err, "delete team %d", tid)
 		}
diff --git a/server/datastore/mysql/teams_test.go b/server/datastore/mysql/teams_test.go
index 19c452081a9c..175d49f8eed7 100644
--- a/server/datastore/mysql/teams_test.go
+++ b/server/datastore/mysql/teams_test.go
@@ -591,10 +591,18 @@ func testTeamsMDMConfig(t *testing.T, ds *Datastore) {
 			Name: "team1",
 			Config: fleet.TeamConfig{
 				MDM: fleet.TeamMDM{
-					MacOSUpdates: fleet.MacOSUpdates{
+					MacOSUpdates: fleet.AppleOSUpdateSettings{
 						MinimumVersion: optjson.SetString("10.15.0"),
 						Deadline:       optjson.SetString("2025-10-01"),
 					},
+					IOSUpdates: fleet.AppleOSUpdateSettings{
+						MinimumVersion: optjson.SetString("11.11.11"),
+						Deadline:       optjson.SetString("2024-04-04"),
+					},
+					IPadOSUpdates: fleet.AppleOSUpdateSettings{
+						MinimumVersion: optjson.SetString("12.12.12"),
+						Deadline:       optjson.SetString("2023-03-03"),
+					},
 					WindowsUpdates: fleet.WindowsUpdates{
 						DeadlineDays:    optjson.SetInt(7),
 						GracePeriodDays: optjson.SetInt(3),
@@ -614,10 +622,18 @@ func testTeamsMDMConfig(t *testing.T, ds *Datastore) {
 		require.NoError(t, err)
 
 		assert.Equal(t, &fleet.TeamMDM{
-			MacOSUpdates: fleet.MacOSUpdates{
+			MacOSUpdates: fleet.AppleOSUpdateSettings{
 				MinimumVersion: optjson.SetString("10.15.0"),
 				Deadline:       optjson.SetString("2025-10-01"),
 			},
+			IOSUpdates: fleet.AppleOSUpdateSettings{
+				MinimumVersion: optjson.SetString("11.11.11"),
+				Deadline:       optjson.SetString("2024-04-04"),
+			},
+			IPadOSUpdates: fleet.AppleOSUpdateSettings{
+				MinimumVersion: optjson.SetString("12.12.12"),
+				Deadline:       optjson.SetString("2023-03-03"),
+			},
 			WindowsUpdates: fleet.WindowsUpdates{
 				DeadlineDays:    optjson.SetInt(7),
 				GracePeriodDays: optjson.SetInt(3),
@@ -695,7 +711,6 @@ func testTeamsNameEmoji(t *testing.T, ds *Datastore) {
 	assert.NoError(t, err)
 	require.Len(t, results, 1)
 	assert.Equal(t, emoji1, results[0].Name)
-
 }
 
 // Ensure case-insensitive sort order for ames
@@ -717,5 +732,4 @@ func testTeamsNameSort(t *testing.T, ds *Datastore) {
 	for i, item := range teams {
 		assert.Equal(t, item.Name, results[i].Name)
 	}
-
 }
diff --git a/server/datastore/mysql/testing_utils.go b/server/datastore/mysql/testing_utils.go
index b54040fd3d7f..99b598919421 100644
--- a/server/datastore/mysql/testing_utils.go
+++ b/server/datastore/mysql/testing_utils.go
@@ -223,8 +223,10 @@ func setupDummyReplica(t testing.TB, testName string, ds *Datastore, opts *Datas
 // this happens because we create a database and import our test dump on the
 // leader each time `connectMySQL` is called, but we only do the same on the
 // replica when it's enabled via options.
-var mu sync.Mutex
-var databasesToReplicate string
+var (
+	mu                   sync.Mutex
+	databasesToReplicate string
+)
 
 func setupRealReplica(t testing.TB, testName string, ds *Datastore, options *dbOptions) {
 	t.Helper()
@@ -233,14 +235,14 @@ func setupRealReplica(t testing.TB, testName string, ds *Datastore, options *dbO
 
 	t.Cleanup(
 		func() {
-			// Stop slave
+			// Stop replica
 			if out, err := exec.Command(
-				"docker-compose", "exec", "-T", "mysql_replica_test",
+				"docker", "compose", "exec", "-T", "mysql_replica_test",
 				// Command run inside container
 				"mysql",
 				"-u"+testUsername, "-p"+testPassword,
 				"-e",
-				"STOP SLAVE; RESET SLAVE ALL;",
+				"STOP REPLICA; RESET REPLICA ALL;",
 			).CombinedOutput(); err != nil {
 				t.Log(err)
 				t.Log(string(out))
@@ -260,45 +262,54 @@ func setupRealReplica(t testing.TB, testName string, ds *Datastore, options *dbO
 	_, err = ds.primary.ExecContext(ctx, "FLUSH PRIVILEGES")
 	require.NoError(t, err)
 
-	// Retrieve master binary log coordinates
-	ms, err := ds.MasterStatus(ctx)
-	require.NoError(t, err)
-
-	// Get MySQL version
 	var version string
 	err = ds.primary.GetContext(ctx, &version, "SELECT VERSION()")
 	require.NoError(t, err)
-	using57 := strings.HasPrefix(version, "5.7")
-	extraMasterOptions := ""
-	if !using57 {
-		extraMasterOptions = "GET_MASTER_PUBLIC_KEY=1," // needed for MySQL 8.0 caching_sha2_password authentication
-	}
+
+	// Retrieve master binary log coordinates
+	ms, err := ds.MasterStatus(ctx, version)
+	require.NoError(t, err)
 
 	mu.Lock()
 	databasesToReplicate = strings.TrimPrefix(databasesToReplicate+fmt.Sprintf(", `%s`", testName), ",")
 	mu.Unlock()
 
-	// Configure slave and start replication
+	setSourceStmt := fmt.Sprintf(`
+			CHANGE REPLICATION SOURCE TO
+				GET_SOURCE_PUBLIC_KEY=1,
+				SOURCE_HOST='mysql_test',
+				SOURCE_USER='%s',
+				SOURCE_PASSWORD='%s',
+				SOURCE_LOG_FILE='%s',
+				SOURCE_LOG_POS=%d
+		`, replicaUser, replicaPassword, ms.File, ms.Position)
+	if strings.HasPrefix(version, "8.0") {
+		setSourceStmt = fmt.Sprintf(`
+			CHANGE MASTER TO
+				GET_MASTER_PUBLIC_KEY=1,
+				MASTER_HOST='mysql_test',
+				MASTER_USER='%s',
+				MASTER_PASSWORD='%s',
+				MASTER_LOG_FILE='%s',
+				MASTER_LOG_POS=%d
+		`, replicaUser, replicaPassword, ms.File, ms.Position)
+	}
+
+	// Configure replica and start replication
 	if out, err := exec.Command(
-		"docker-compose", "exec", "-T", "mysql_replica_test",
+		"docker", "compose", "exec", "-T", "mysql_replica_test",
 		// Command run inside container
 		"mysql",
 		"-u"+testUsername, "-p"+testPassword,
 		"-e",
 		fmt.Sprintf(
 			`
-			STOP SLAVE;
-			RESET SLAVE ALL;
+			STOP REPLICA;
+			RESET REPLICA ALL;
 			CHANGE REPLICATION FILTER REPLICATE_DO_DB = ( %s );
-			CHANGE MASTER TO
-				%s
-				MASTER_HOST='mysql_test',
-				MASTER_USER='%s',
-				MASTER_PASSWORD='%s',
-				MASTER_LOG_FILE='%s',
-				MASTER_LOG_POS=%d;
-			START SLAVE;
-			`, databasesToReplicate, extraMasterOptions, replicaUser, replicaPassword, ms.File, ms.Position,
+			%s;
+			START REPLICA;
+			`, databasesToReplicate, setSourceStmt,
 		),
 	).CombinedOutput(); err != nil {
 		t.Error(err)
@@ -318,7 +329,6 @@ func setupRealReplica(t testing.TB, testName string, ds *Datastore, options *dbO
 	require.NoError(t, err)
 	ds.replica = replica
 	ds.readReplicaConfig = &replicaConfig
-
 }
 
 // initializeDatabase loads the dumped schema into a newly created database in
@@ -341,17 +351,20 @@ func initializeDatabase(t testing.TB, testName string, opts *DatastoreTestOption
 	}
 	for _, dbName := range dbs {
 		// Load schema from dumpfile
-		if out, err := exec.Command(
-			"docker-compose", "exec", "-T", "mysql_test",
+		sqlCommands := fmt.Sprintf(
+			"DROP DATABASE IF EXISTS %s; CREATE DATABASE %s; USE %s; SET FOREIGN_KEY_CHECKS=0; %s;",
+			dbName, dbName, dbName, schema,
+		)
+
+		cmd := exec.Command(
+			"docker", "compose", "exec", "-T", "mysql_test",
 			// Command run inside container
 			"mysql",
 			"-u"+testUsername, "-p"+testPassword,
-			"-e",
-			fmt.Sprintf(
-				"DROP DATABASE IF EXISTS %s; CREATE DATABASE %s; USE %s; SET FOREIGN_KEY_CHECKS=0; %s;",
-				dbName, dbName, dbName, schema,
-			),
-		).CombinedOutput(); err != nil {
+		)
+		cmd.Stdin = strings.NewReader(sqlCommands)
+		out, err := cmd.CombinedOutput()
+		if err != nil {
 			t.Error(err)
 			t.Error(string(out))
 			t.FailNow()
@@ -359,17 +372,20 @@ func initializeDatabase(t testing.TB, testName string, opts *DatastoreTestOption
 	}
 	if opts.RealReplica {
 		// Load schema from dumpfile
-		if out, err := exec.Command(
-			"docker-compose", "exec", "-T", "mysql_replica_test",
+		sqlCommands := fmt.Sprintf(
+			"DROP DATABASE IF EXISTS %s; CREATE DATABASE %s; USE %s; SET FOREIGN_KEY_CHECKS=0; %s;",
+			testName, testName, testName, schema,
+		)
+
+		cmd := exec.Command(
+			"docker", "compose", "exec", "-T", "mysql_replica_test",
 			// Command run inside container
 			"mysql",
 			"-u"+testUsername, "-p"+testPassword,
-			"-e",
-			fmt.Sprintf(
-				"DROP DATABASE IF EXISTS %s; CREATE DATABASE %s; USE %s; SET FOREIGN_KEY_CHECKS=0; %s;",
-				testName, testName, testName, schema,
-			),
-		).CombinedOutput(); err != nil {
+		)
+		cmd.Stdin = strings.NewReader(sqlCommands)
+		out, err := cmd.CombinedOutput()
+		if err != nil {
 			t.Error(err)
 			t.Error(string(out))
 			t.FailNow()
@@ -447,7 +463,7 @@ func CreateMySQLDSWithReplica(t *testing.T, opts *DatastoreTestOptions) *Datasto
 		ds = createMySQLDSWithOptions(t, opts)
 		status, err := ds.ReplicaStatus(context.Background())
 		require.NoError(t, err)
-		if status["Replica_SQL_Running"] != "Yes" && status["Slave_SQL_Running"] != "Yes" {
+		if status["Replica_SQL_Running"] != "Yes" {
 			t.Logf("create replica attempt: %d replica status: %+v", attempt, status)
 			if lastErr, ok := status["Last_Error"]; ok && lastErr != "" {
 				t.Logf("replica not running after attempt %d; Last_Error: %s", attempt, lastErr)
@@ -487,6 +503,12 @@ func ExecAdhocSQLWithError(ds *Datastore, fn func(q sqlx.ExtContext) error) erro
 	return fn(ds.primary)
 }
 
+// EncryptWithPrivateKey encrypts data with the server private key associated
+// with the Datastore.
+func EncryptWithPrivateKey(tb testing.TB, ds *Datastore, data []byte) ([]byte, error) {
+	return encrypt(data, ds.serverPrivateKey)
+}
+
 // TruncateTables truncates the specified tables, in order, using ds.writer.
 // Note that the order is typically not important because FK checks are
 // disabled while truncating. If no table is provided, all tables (except
@@ -667,7 +689,7 @@ func GetAggregatedStats(ctx context.Context, ds *Datastore, aggregate fleet.Aggr
 func SetOrderedCreatedAtTimestamps(t testing.TB, ds *Datastore, afterTime time.Time, table, keyCol string, keys ...any) time.Time {
 	now := afterTime
 	for i := 0; i < len(keys); i++ {
-		now = afterTime.Add(time.Second)
+		now = now.Add(time.Second)
 		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
 			_, err := q.ExecContext(context.Background(),
 				fmt.Sprintf(`UPDATE %s SET created_at=? WHERE %s=?`, table, keyCol), now, keys[i])
@@ -677,7 +699,55 @@ func SetOrderedCreatedAtTimestamps(t testing.TB, ds *Datastore, afterTime time.T
 	return now
 }
 
-func SetTestABMAssets(t testing.TB, ds *Datastore) {
+// CreateAndSetABMToken creates a new ABM token (using an existing ABM key/cert) and stores it in the DB.
+func CreateAndSetABMToken(t testing.TB, ds *Datastore, orgName string) *fleet.ABMToken {
+	assets, err := ds.GetAllMDMConfigAssetsByName(context.Background(), []fleet.MDMAssetName{
+		fleet.MDMAssetABMKey,
+		fleet.MDMAssetABMCert,
+	})
+	require.NoError(t, err)
+
+	certPEM := assets[fleet.MDMAssetABMCert].Value
+
+	testBMToken := &nanodep_client.OAuth1Tokens{
+		ConsumerKey:       "test_consumer",
+		ConsumerSecret:    "test_secret",
+		AccessToken:       "test_access_token",
+		AccessSecret:      "test_access_secret",
+		AccessTokenExpiry: time.Date(2999, 1, 1, 0, 0, 0, 0, time.UTC),
+	}
+
+	rawToken, err := json.Marshal(testBMToken)
+	require.NoError(t, err)
+
+	smimeToken := fmt.Sprintf(
+		"Content-Type: text/plain;charset=UTF-8\r\n"+
+			"Content-Transfer-Encoding: 7bit\r\n"+
+			"\r\n%s", rawToken,
+	)
+
+	block, _ := pem.Decode(certPEM)
+	require.NotNil(t, block)
+	require.Equal(t, "CERTIFICATE", block.Type)
+	cert, err := x509.ParseCertificate(block.Bytes)
+	require.NoError(t, err)
+
+	encryptedToken, err := pkcs7.Encrypt([]byte(smimeToken), []*x509.Certificate{cert})
+	require.NoError(t, err)
+
+	tokenBytes := fmt.Sprintf(
+		"Content-Type: application/pkcs7-mime; name=\"smime.p7m\"; smime-type=enveloped-data\r\n"+
+			"Content-Transfer-Encoding: base64\r\n"+
+			"Content-Disposition: attachment; filename=\"smime.p7m\"\r\n"+
+			"Content-Description: S/MIME Encrypted Message\r\n"+
+			"\r\n%s", base64.StdEncoding.EncodeToString(encryptedToken))
+
+	tok, err := ds.InsertABMToken(context.Background(), &fleet.ABMToken{EncryptedToken: []byte(tokenBytes), OrganizationName: orgName})
+	require.NoError(t, err)
+	return tok
+}
+
+func SetTestABMAssets(t testing.TB, ds *Datastore, orgName string) *fleet.ABMToken {
 	apnsCert, apnsKey, err := GenerateTestCertBytes()
 	require.NoError(t, err)
 
@@ -686,7 +756,6 @@ func SetTestABMAssets(t testing.TB, ds *Datastore) {
 	assets := []fleet.MDMConfigAsset{
 		{Name: fleet.MDMAssetABMCert, Value: certPEM},
 		{Name: fleet.MDMAssetABMKey, Value: keyPEM},
-		{Name: fleet.MDMAssetABMToken, Value: tokenBytes},
 		{Name: fleet.MDMAssetAPNSCert, Value: apnsCert},
 		{Name: fleet.MDMAssetAPNSKey, Value: apnsKey},
 		{Name: fleet.MDMAssetCACert, Value: certPEM},
@@ -696,12 +765,17 @@ func SetTestABMAssets(t testing.TB, ds *Datastore) {
 	err = ds.InsertMDMConfigAssets(context.Background(), assets)
 	require.NoError(t, err)
 
+	tok, err := ds.InsertABMToken(context.Background(), &fleet.ABMToken{EncryptedToken: tokenBytes, OrganizationName: orgName})
+	require.NoError(t, err)
+
 	appCfg, err := ds.AppConfig(context.Background())
 	require.NoError(t, err)
 	appCfg.MDM.EnabledAndConfigured = true
 	appCfg.MDM.AppleBMEnabledAndConfigured = true
 	err = ds.SaveAppConfig(context.Background(), appCfg)
 	require.NoError(t, err)
+
+	return tok
 }
 
 func GenerateTestABMAssets(t testing.TB) ([]byte, []byte, []byte, error) {
@@ -786,11 +860,15 @@ type MasterStatus struct {
 	Position uint64
 }
 
-func (ds *Datastore) MasterStatus(ctx context.Context) (MasterStatus, error) {
+func (ds *Datastore) MasterStatus(ctx context.Context, mysqlVersion string) (MasterStatus, error) {
+	stmt := "SHOW BINARY LOG STATUS"
+	if strings.HasPrefix(mysqlVersion, "8.0") {
+		stmt = "SHOW MASTER STATUS"
+	}
 
-	rows, err := ds.writer(ctx).Query("SHOW MASTER STATUS")
+	rows, err := ds.writer(ctx).Query(stmt)
 	if err != nil {
-		return MasterStatus{}, ctxerr.Wrap(ctx, err, "show master status")
+		return MasterStatus{}, ctxerr.Wrap(ctx, err, stmt)
 	}
 	defer rows.Close()
 
@@ -835,8 +913,7 @@ func (ds *Datastore) MasterStatus(ctx context.Context) (MasterStatus, error) {
 }
 
 func (ds *Datastore) ReplicaStatus(ctx context.Context) (map[string]interface{}, error) {
-
-	rows, err := ds.reader(ctx).QueryContext(ctx, "SHOW SLAVE STATUS")
+	rows, err := ds.reader(ctx).QueryContext(ctx, "SHOW REPLICA STATUS")
 	if err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "show replica status")
 	}
diff --git a/server/datastore/mysql/vpp.go b/server/datastore/mysql/vpp.go
new file mode 100644
index 000000000000..a40416697af0
--- /dev/null
+++ b/server/datastore/mysql/vpp.go
@@ -0,0 +1,1147 @@
+package mysql
+
+import (
+	"cmp"
+	"context"
+	"database/sql"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/authz"
+	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/mdm/nanomdm/mdm"
+	"github.com/jmoiron/sqlx"
+)
+
+func (ds *Datastore) GetVPPAppMetadataByTeamAndTitleID(ctx context.Context, teamID *uint, titleID uint) (*fleet.VPPAppStoreApp, error) {
+	const query = `
+SELECT
+	vap.adam_id,
+	vap.platform,
+	vap.name,
+	vap.latest_version,
+	vat.self_service,
+	NULLIF(vap.icon_url, '') AS icon_url
+FROM
+	vpp_apps vap
+	INNER JOIN vpp_apps_teams vat ON vat.adam_id = vap.adam_id AND vat.platform = vap.platform
+WHERE
+	vap.title_id = ? %s`
+
+	// when team id is not nil, we need to filter by the global or team id given.
+	args := []any{titleID}
+	teamFilter := ""
+	if teamID != nil {
+		args = append(args, *teamID)
+		teamFilter = "AND vat.global_or_team_id = ?"
+	}
+
+	var app fleet.VPPAppStoreApp
+	err := sqlx.GetContext(ctx, ds.reader(ctx), &app, fmt.Sprintf(query, teamFilter), args...)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, ctxerr.Wrap(ctx, notFound("VPPApp"), "get VPP app metadata")
+		}
+		return nil, ctxerr.Wrap(ctx, err, "get VPP app metadata")
+	}
+
+	return &app, nil
+}
+
+func (ds *Datastore) GetSummaryHostVPPAppInstalls(ctx context.Context, teamID *uint, appID fleet.VPPAppID) (*fleet.VPPAppStatusSummary,
+	error,
+) {
+	var dest fleet.VPPAppStatusSummary
+
+	stmt := fmt.Sprintf(`
+SELECT
+	COALESCE(SUM( IF(status = :software_status_pending, 1, 0)), 0) AS pending,
+	COALESCE(SUM( IF(status = :software_status_failed, 1, 0)), 0) AS failed,
+	COALESCE(SUM( IF(status = :software_status_installed, 1, 0)), 0) AS installed
+FROM (
+SELECT
+	%s
+FROM
+	host_vpp_software_installs hvsi
+INNER JOIN
+	hosts h ON hvsi.host_id = h.id
+LEFT OUTER JOIN
+	nano_command_results ncr ON ncr.id = h.uuid AND ncr.command_uuid = hvsi.command_uuid
+WHERE
+	hvsi.adam_id = :adam_id AND hvsi.platform = :platform AND
+	(h.team_id = :team_id OR (h.team_id IS NULL AND :team_id = 0)) AND
+	hvsi.id IN (
+		SELECT
+			max(hvsi2.id) -- ensure we use only the most recently created install attempt for each host
+		FROM
+			host_vpp_software_installs hvsi2
+		WHERE
+			hvsi2.adam_id = :adam_id AND hvsi2.platform = :platform
+		GROUP BY
+			hvsi2.host_id
+	)
+) s`, vppAppHostStatusNamedQuery("hvsi", "ncr", "status"))
+
+	var tmID uint
+	if teamID != nil {
+		tmID = *teamID
+	}
+
+	query, args, err := sqlx.Named(stmt, map[string]interface{}{
+		"adam_id":                   appID.AdamID,
+		"platform":                  appID.Platform,
+		"team_id":                   tmID,
+		"mdm_status_acknowledged":   fleet.MDMAppleStatusAcknowledged,
+		"mdm_status_error":          fleet.MDMAppleStatusError,
+		"mdm_status_format_error":   fleet.MDMAppleStatusCommandFormatError,
+		"software_status_pending":   fleet.SoftwareInstallerPending,
+		"software_status_failed":    fleet.SoftwareInstallerFailed,
+		"software_status_installed": fleet.SoftwareInstallerInstalled,
+	})
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get summary host vpp installs: named query")
+	}
+
+	err = sqlx.GetContext(ctx, ds.reader(ctx), &dest, query, args...)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get summary host vpp install status")
+	}
+	return &dest, nil
+}
+
+// hvsiAlias is the table alias to use as prefix for the
+// host_vpp_software_installs column names, no prefix used if empty.
+// ncrAlias is the table alias to use as prefix for the nano_command_results
+// column names, no prefix used if empty.
+// colAlias is the name to be assigned to the computed status column, pass
+// empty to have the value only, no column alias set.
+func vppAppHostStatusNamedQuery(hvsiAlias, ncrAlias, colAlias string) string {
+	if hvsiAlias != "" {
+		hvsiAlias += "."
+	}
+	if ncrAlias != "" {
+		ncrAlias += "."
+	}
+	if colAlias != "" {
+		colAlias = " AS " + colAlias
+	}
+	return fmt.Sprintf(`
+			CASE
+				WHEN %[1]sstatus = :mdm_status_acknowledged THEN
+					:software_status_installed
+				WHEN %[1]sstatus = :mdm_status_error OR %[1]sstatus = :mdm_status_format_error THEN
+					:software_status_failed
+				WHEN %[2]sid IS NOT NULL THEN
+					:software_status_pending
+				ELSE
+					NULL -- not installed via VPP App
+			END %[3]s `, ncrAlias, hvsiAlias, colAlias)
+}
+
+func (ds *Datastore) BatchInsertVPPApps(ctx context.Context, apps []*fleet.VPPApp) error {
+	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
+		for _, app := range apps {
+			titleID, err := ds.getOrInsertSoftwareTitleForVPPApp(ctx, tx, app)
+			if err != nil {
+				return err
+			}
+
+			app.TitleID = titleID
+
+			if err := insertVPPApps(ctx, tx, []*fleet.VPPApp{app}); err != nil {
+				return ctxerr.Wrap(ctx, err, "BatchInsertVPPApps insertVPPApps transaction")
+			}
+		}
+		return nil
+	})
+}
+
+func (ds *Datastore) SetTeamVPPApps(ctx context.Context, teamID *uint, appFleets []fleet.VPPAppTeam) error {
+	existingApps, err := ds.GetAssignedVPPApps(ctx, teamID)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "SetTeamVPPApps getting list of existing apps")
+	}
+
+	var toAddApps []fleet.VPPAppTeam
+	var toRemoveApps []fleet.VPPAppID
+
+	for existingApp := range existingApps {
+		var found bool
+		for _, appFleet := range appFleets {
+			// Self service value doesn't matter for removing app from team
+			if existingApp == appFleet.VPPAppID {
+				found = true
+			}
+		}
+		if !found {
+			toRemoveApps = append(toRemoveApps, existingApp)
+		}
+	}
+
+	for _, appFleet := range appFleets {
+		if existingFleet, ok := existingApps[appFleet.VPPAppID]; !ok || existingFleet.SelfService != appFleet.SelfService {
+			toAddApps = append(toAddApps, appFleet)
+		}
+	}
+
+	vppToken, err := ds.GetVPPTokenByTeamID(ctx, teamID)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "SetTeamVPPApps retrieve VPP token ID")
+	}
+
+	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
+		for _, toAdd := range toAddApps {
+			if err := insertVPPAppTeams(ctx, tx, toAdd, teamID, vppToken.ID); err != nil {
+				return ctxerr.Wrap(ctx, err, "SetTeamVPPApps inserting vpp app into team")
+			}
+		}
+
+		for _, toRemove := range toRemoveApps {
+			if err := removeVPPAppTeams(ctx, tx, toRemove, teamID); err != nil {
+				return ctxerr.Wrap(ctx, err, "SetTeamVPPApps removing vpp app from team")
+			}
+		}
+
+		return nil
+	})
+}
+
+func (ds *Datastore) InsertVPPAppWithTeam(ctx context.Context, app *fleet.VPPApp, teamID *uint) (*fleet.VPPApp, error) {
+	vppToken, err := ds.GetVPPTokenByTeamID(ctx, teamID)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "InsertVPPAppWithTeam unable to get VPP Token ID")
+	}
+
+	err = ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
+		titleID, err := ds.getOrInsertSoftwareTitleForVPPApp(ctx, tx, app)
+		if err != nil {
+			return err
+		}
+
+		app.TitleID = titleID
+
+		if err := insertVPPApps(ctx, tx, []*fleet.VPPApp{app}); err != nil {
+			return ctxerr.Wrap(ctx, err, "InsertVPPAppWithTeam insertVPPApps transaction")
+		}
+
+		if err := insertVPPAppTeams(ctx, tx, app.VPPAppTeam, teamID, vppToken.ID); err != nil {
+			return ctxerr.Wrap(ctx, err, "InsertVPPAppWithTeam insertVPPAppTeams transaction")
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "InsertVPPAppWithTeam")
+	}
+
+	return app, nil
+}
+
+func (ds *Datastore) GetAssignedVPPApps(ctx context.Context, teamID *uint) (map[fleet.VPPAppID]fleet.VPPAppTeam, error) {
+	stmt := `
+SELECT
+	adam_id, platform, self_service
+FROM
+	vpp_apps_teams vat
+WHERE
+	vat.global_or_team_id = ?
+	`
+	var tmID uint
+	if teamID != nil {
+		tmID = *teamID
+	}
+
+	var results []fleet.VPPAppTeam
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &results, stmt, tmID); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get assigned VPP apps")
+	}
+
+	appSet := make(map[fleet.VPPAppID]fleet.VPPAppTeam)
+	for _, r := range results {
+		appSet[r.VPPAppID] = r
+	}
+
+	return appSet, nil
+}
+
+func insertVPPApps(ctx context.Context, tx sqlx.ExtContext, apps []*fleet.VPPApp) error {
+	stmt := `
+INSERT INTO vpp_apps
+	(adam_id, bundle_identifier, icon_url, name, latest_version, title_id, platform)
+VALUES
+%s
+ON DUPLICATE KEY UPDATE
+	updated_at = CURRENT_TIMESTAMP,
+	latest_version = VALUES(latest_version),
+	icon_url = VALUES(icon_url),
+	name = VALUES(name),
+	title_id = VALUES(title_id)
+	`
+	var args []any
+	var insertVals strings.Builder
+
+	for _, a := range apps {
+		insertVals.WriteString(`(?, ?, ?, ?, ?, ?, ?),`)
+		args = append(args, a.AdamID, a.BundleIdentifier, a.IconURL, a.Name, a.LatestVersion, a.TitleID, a.Platform)
+	}
+
+	stmt = fmt.Sprintf(stmt, strings.TrimSuffix(insertVals.String(), ","))
+
+	_, err := tx.ExecContext(ctx, stmt, args...)
+
+	return ctxerr.Wrap(ctx, err, "insert VPP apps")
+}
+
+func insertVPPAppTeams(ctx context.Context, tx sqlx.ExtContext, appID fleet.VPPAppTeam, teamID *uint, vppTokenID uint) error {
+	stmt := `
+INSERT INTO vpp_apps_teams
+	(adam_id, global_or_team_id, team_id, platform, self_service, vpp_token_id)
+VALUES
+	(?, ?, ?, ?, ?, ?)
+ON DUPLICATE KEY UPDATE self_service = VALUES(self_service)
+	`
+
+	var globalOrTmID uint
+	if teamID != nil {
+		globalOrTmID = *teamID
+
+		if *teamID == 0 {
+			teamID = nil
+		}
+	}
+
+	_, err := tx.ExecContext(ctx, stmt, appID.AdamID, globalOrTmID, teamID, appID.Platform, appID.SelfService, vppTokenID)
+	if IsDuplicate(err) {
+		err = &existsError{
+			Identifier:   fmt.Sprintf("%s %s self_service: %v", appID.AdamID, appID.Platform, appID.SelfService),
+			TeamID:       teamID,
+			ResourceType: "VPPAppID",
+		}
+	}
+
+	return ctxerr.Wrap(ctx, err, "writing vpp app team mapping to db")
+}
+
+func removeVPPAppTeams(ctx context.Context, tx sqlx.ExtContext, appID fleet.VPPAppID, teamID *uint) error {
+	stmt := `
+DELETE FROM
+  vpp_apps_teams
+WHERE
+  adam_id = ?
+AND
+  team_id = ?
+AND
+  platform = ?
+`
+	_, err := tx.ExecContext(ctx, stmt, appID.AdamID, teamID, appID.Platform)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "deleting vpp app from team")
+	}
+
+	return nil
+}
+
+func (ds *Datastore) getOrInsertSoftwareTitleForVPPApp(ctx context.Context, tx sqlx.ExtContext, app *fleet.VPPApp) (uint, error) {
+	// NOTE: it was decided to populate "apps" as the source for VPP apps for now, TBD
+	// if this needs to change to better map to how software titles are reported
+	// back by osquery. Since it may change, we're using a variable for the source.
+	var source string
+	switch app.Platform {
+	case fleet.IOSPlatform:
+		source = "ios_apps"
+	case fleet.IPadOSPlatform:
+		source = "ipados_apps"
+	default:
+		source = "apps"
+	}
+
+	selectStmt := `SELECT id FROM software_titles WHERE name = ? AND source = ? AND browser = ''`
+	selectArgs := []any{app.Name, source}
+	insertStmt := `INSERT INTO software_titles (name, source, browser) VALUES (?, ?, '')`
+	insertArgs := []any{app.Name, source}
+
+	if app.BundleIdentifier != "" {
+		// NOTE: The index `idx_sw_titles` doesn't include the bundle
+		// identifier. It's possible for the select to return nothing
+		// but for the insert to fail if an app with the same name but
+		// no bundle identifier exists in the DB.
+		switch source {
+		case "ios_apps", "ipados_apps":
+			selectStmt = `SELECT id FROM software_titles WHERE bundle_identifier = ? AND source = ?`
+			selectArgs = []any{app.BundleIdentifier, source}
+		default:
+			selectStmt = `SELECT id FROM software_titles WHERE bundle_identifier = ? AND source NOT IN ('ios_apps', 'ipados_apps')`
+			selectArgs = []any{app.BundleIdentifier}
+		}
+		insertStmt = `INSERT INTO software_titles (name, source, bundle_identifier, browser) VALUES (?, ?, ?, '')`
+		insertArgs = append(insertArgs, app.BundleIdentifier)
+	}
+
+	titleID, err := ds.optimisticGetOrInsertWithWriter(ctx,
+		tx,
+		&parameterizedStmt{
+			Statement: selectStmt,
+			Args:      selectArgs,
+		},
+		&parameterizedStmt{
+			Statement: insertStmt,
+			Args:      insertArgs,
+		},
+	)
+	if err != nil {
+		return 0, ctxerr.Wrap(ctx, err, "optimistic get or insert VPP app")
+	}
+
+	return titleID, nil
+}
+
+func (ds *Datastore) DeleteVPPAppFromTeam(ctx context.Context, teamID *uint, appID fleet.VPPAppID) error {
+	const stmt = `DELETE FROM vpp_apps_teams WHERE global_or_team_id = ? AND adam_id = ? AND platform = ?`
+
+	var globalOrTeamID uint
+	if teamID != nil {
+		globalOrTeamID = *teamID
+	}
+	res, err := ds.writer(ctx).ExecContext(ctx, stmt, globalOrTeamID, appID.AdamID, appID.Platform)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "delete VPP app from team")
+	}
+
+	rows, _ := res.RowsAffected()
+	if rows == 0 {
+		return notFound("VPPApp").WithMessage(fmt.Sprintf("adam id %s platform %s for team id %d", appID.AdamID, appID.Platform,
+			globalOrTeamID))
+	}
+	return nil
+}
+
+func (ds *Datastore) GetVPPAppByTeamAndTitleID(ctx context.Context, teamID *uint, titleID uint) (*fleet.VPPApp, error) {
+	stmt := `
+SELECT
+  va.adam_id,
+  va.bundle_identifier,
+  va.icon_url,
+  va.name,
+  va.title_id,
+  va.platform,
+  va.created_at,
+  va.updated_at,
+  vat.self_service
+FROM vpp_apps va
+JOIN vpp_apps_teams vat ON va.adam_id = vat.adam_id AND va.platform = vat.platform
+WHERE vat.global_or_team_id = ? AND va.title_id = ?
+  `
+
+	var tmID uint
+	if teamID != nil {
+		tmID = *teamID
+	}
+
+	var dest fleet.VPPApp
+	err := sqlx.GetContext(ctx, ds.reader(ctx), &dest, stmt, tmID, titleID)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, ctxerr.Wrap(ctx, notFound("VPPApp"), "get VPP app")
+		}
+		return nil, ctxerr.Wrap(ctx, err, "get VPP app")
+	}
+
+	return &dest, nil
+}
+
+func (ds *Datastore) InsertHostVPPSoftwareInstall(ctx context.Context, hostID uint, appID fleet.VPPAppID,
+	commandUUID, associatedEventID string, selfService bool,
+) error {
+	stmt := `
+INSERT INTO host_vpp_software_installs
+  (host_id, adam_id, platform, command_uuid, user_id, associated_event_id, self_service)
+VALUES
+  (?,?,?,?,?,?,?)
+	`
+
+	var userID *uint
+	if ctxUser := authz.UserFromContext(ctx); ctxUser != nil {
+		userID = &ctxUser.ID
+	}
+
+	if _, err := ds.writer(ctx).ExecContext(ctx, stmt, hostID, appID.AdamID, appID.Platform, commandUUID, userID,
+		associatedEventID, selfService); err != nil {
+		return ctxerr.Wrap(ctx, err, "insert into host_vpp_software_installs")
+	}
+
+	return nil
+}
+
+func (ds *Datastore) GetPastActivityDataForVPPAppInstall(ctx context.Context, commandResults *mdm.CommandResults) (*fleet.User, *fleet.ActivityInstalledAppStoreApp, error) {
+	if commandResults == nil {
+		return nil, nil, nil
+	}
+
+	stmt := `
+SELECT
+	u.name AS user_name,
+	u.id AS user_id,
+	u.email as user_email,
+	hvsi.host_id AS host_id,
+	hdn.display_name AS host_display_name,
+	st.name AS software_title,
+	hvsi.adam_id AS app_store_id,
+	hvsi.command_uuid AS command_uuid,
+	hvsi.self_service AS self_service
+FROM
+	host_vpp_software_installs hvsi
+	LEFT OUTER JOIN users u ON hvsi.user_id = u.id
+	LEFT OUTER JOIN host_display_names hdn ON hdn.host_id = hvsi.host_id
+	LEFT OUTER JOIN vpp_apps vpa ON hvsi.adam_id = vpa.adam_id
+	LEFT OUTER JOIN software_titles st ON st.id = vpa.title_id
+WHERE
+	hvsi.command_uuid = :command_uuid
+	`
+
+	type result struct {
+		HostID          uint    `db:"host_id"`
+		HostDisplayName string  `db:"host_display_name"`
+		SoftwareTitle   string  `db:"software_title"`
+		AppStoreID      string  `db:"app_store_id"`
+		CommandUUID     string  `db:"command_uuid"`
+		UserName        *string `db:"user_name"`
+		UserID          *uint   `db:"user_id"`
+		UserEmail       *string `db:"user_email"`
+		SelfService     bool    `db:"self_service"`
+	}
+
+	listStmt, args, err := sqlx.Named(stmt, map[string]any{
+		"command_uuid":              commandResults.CommandUUID,
+		"software_status_failed":    string(fleet.SoftwareInstallerFailed),
+		"software_status_installed": string(fleet.SoftwareInstallerInstalled),
+	})
+	if err != nil {
+		return nil, nil, ctxerr.Wrap(ctx, err, "build list query from named args")
+	}
+
+	var res result
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &res, listStmt, args...); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, nil, notFound("install_command")
+		}
+
+		return nil, nil, ctxerr.Wrap(ctx, err, "select past activity data for VPP app install")
+	}
+
+	var user *fleet.User
+	if res.UserID != nil {
+		user = &fleet.User{
+			ID:    *res.UserID,
+			Name:  *res.UserName,
+			Email: *res.UserEmail,
+		}
+	}
+
+	var status string
+	switch commandResults.Status {
+	case fleet.MDMAppleStatusAcknowledged:
+		status = string(fleet.SoftwareInstallerInstalled)
+	case fleet.MDMAppleStatusCommandFormatError:
+	case fleet.MDMAppleStatusError:
+		status = string(fleet.SoftwareInstallerFailed)
+	default:
+		// This case shouldn't happen (we should only be doing this check if the command is in a
+		// "terminal" state, but adding it so we have a default
+		status = string(fleet.SoftwareInstallerPending)
+	}
+
+	act := &fleet.ActivityInstalledAppStoreApp{
+		HostID:          res.HostID,
+		HostDisplayName: res.HostDisplayName,
+		SoftwareTitle:   res.SoftwareTitle,
+		AppStoreID:      res.AppStoreID,
+		CommandUUID:     res.CommandUUID,
+		SelfService:     res.SelfService,
+		Status:          status,
+	}
+
+	return user, act, nil
+}
+
+func (ds *Datastore) GetVPPTokenByLocation(ctx context.Context, loc string) (*fleet.VPPTokenDB, error) {
+	stmt := `SELECT id FROM vpp_tokens WHERE location = ?`
+	var tokenID uint
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &tokenID, stmt, loc); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, ctxerr.Wrap(ctx, notFound("VPPToken"), "retrieve vpp token by location")
+		}
+		return nil, ctxerr.Wrap(ctx, err, "retrieve vpp token by location")
+	}
+	return ds.GetVPPToken(ctx, tokenID)
+}
+
+func (ds *Datastore) InsertVPPToken(ctx context.Context, tok *fleet.VPPTokenData) (*fleet.VPPTokenDB, error) {
+	insertStmt := `
+	INSERT INTO
+		vpp_tokens (
+			organization_name,
+			location,
+			renew_at,
+			token
+		)
+	VALUES (?, ?, ?, ?)
+`
+
+	vppTokenDB, err := vppTokenDataToVppTokenDB(ctx, tok)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "translating vpp token to db representation")
+	}
+
+	tokEnc, err := encrypt([]byte(vppTokenDB.Token), ds.serverPrivateKey)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "encrypt token with datastore.serverPrivateKey")
+	}
+
+	res, err := ds.writer(ctx).ExecContext(
+		ctx,
+		insertStmt,
+		vppTokenDB.OrgName,
+		vppTokenDB.Location,
+		vppTokenDB.RenewDate,
+		tokEnc,
+	)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "inserting vpp token")
+	}
+
+	id, _ := res.LastInsertId()
+
+	vppTokenDB.ID = uint(id)
+
+	return vppTokenDB, nil
+}
+
+func (ds *Datastore) UpdateVPPToken(ctx context.Context, tokenID uint, tok *fleet.VPPTokenData) (*fleet.VPPTokenDB, error) {
+	stmt := `
+	UPDATE vpp_tokens
+	SET
+		organization_name = ?,
+		location = ?,
+		renew_at = ?,
+		token = ?
+	WHERE
+		id = ?
+`
+
+	vppTokenDB, err := vppTokenDataToVppTokenDB(ctx, tok)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "translating vpp token to db representation")
+	}
+
+	tokEnc, err := encrypt([]byte(vppTokenDB.Token), ds.serverPrivateKey)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "encrypt token with datastore.serverPrivateKey")
+	}
+
+	_, err = ds.writer(ctx).ExecContext(
+		ctx,
+		stmt,
+		vppTokenDB.OrgName,
+		vppTokenDB.Location,
+		vppTokenDB.RenewDate,
+		tokEnc,
+		tokenID,
+	)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "inserting vpp token")
+	}
+
+	return ds.GetVPPToken(ctx, tokenID)
+}
+
+func vppTokenDataToVppTokenDB(ctx context.Context, tok *fleet.VPPTokenData) (*fleet.VPPTokenDB, error) {
+	tokRawBytes, err := base64.StdEncoding.DecodeString(tok.Token)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "decoding raw vpp token data")
+	}
+
+	var tokRaw fleet.VPPTokenRaw
+	if err := json.Unmarshal(tokRawBytes, &tokRaw); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "unmarshalling raw vpp token")
+	}
+
+	exp, err := time.Parse(fleet.VPPTimeFormat, tokRaw.ExpDate)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "parsing vpp token expiration date")
+	}
+	exp = exp.UTC()
+
+	vppTokenDB := &fleet.VPPTokenDB{
+		OrgName:   tokRaw.OrgName,
+		Location:  tok.Location,
+		RenewDate: exp,
+		Token:     tok.Token,
+	}
+
+	return vppTokenDB, nil
+}
+
+func (ds *Datastore) GetVPPToken(ctx context.Context, tokenID uint) (*fleet.VPPTokenDB, error) {
+	stmt := `
+	SELECT
+		id,
+		organization_name,
+		location,
+		renew_at,
+		token
+	FROM
+		vpp_tokens v
+	WHERE
+		id = ?
+`
+	stmtTeams := `
+	SELECT
+		vt.team_id,
+		vt.null_team_type,
+		COALESCE(t.name, '') AS name
+	FROM
+		vpp_token_teams vt
+	LEFT OUTER JOIN
+		teams t
+	ON t.id = vt.team_id
+	WHERE
+		vpp_token_id = ?
+`
+
+	var tokEnc fleet.VPPTokenDB
+
+	var tokTeams []struct {
+		TeamID   *uint              `db:"team_id"`
+		NullTeam fleet.NullTeamType `db:"null_team_type"`
+		Name     string             `db:"name"`
+	}
+
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &tokEnc, stmt, tokenID); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, ctxerr.Wrap(ctx, notFound("VPPToken"), "selecting vpp token from db")
+		}
+		return nil, ctxerr.Wrap(ctx, err, "selecting vpp token from db")
+	}
+
+	tokDec, err := decrypt([]byte(tokEnc.Token), ds.serverPrivateKey)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "decrypting vpp token with serverPrivateKey")
+	}
+
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &tokTeams, stmtTeams, tokenID); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "selecting vpp token teams from db")
+	}
+
+	tok := &fleet.VPPTokenDB{
+		ID:        tokEnc.ID,
+		OrgName:   tokEnc.OrgName,
+		Location:  tokEnc.Location,
+		RenewDate: tokEnc.RenewDate,
+		Token:     string(tokDec),
+	}
+
+	if tokTeams == nil {
+		// Not assigned, no need to loop over teams
+		return tok, nil
+	}
+
+TEAMLOOP:
+	for _, team := range tokTeams {
+		switch team.NullTeam {
+		case fleet.NullTeamAllTeams:
+			// This should only be possible if there are no other teams
+			// Make sure something array is non-nil
+			if len(tokTeams) != 1 {
+				return nil, ctxerr.Errorf(ctx, "team \"%s\" belongs to All teams, and %d other team(s)", tok.OrgName, len(tokTeams)-1)
+			}
+			tok.Teams = []fleet.TeamTuple{}
+			break TEAMLOOP
+		case fleet.NullTeamNoTeam:
+			tok.Teams = append(tok.Teams, fleet.TeamTuple{
+				ID:   0,
+				Name: fleet.TeamNameNoTeam,
+			})
+		case fleet.NullTeamNone:
+			// Regular team
+			tok.Teams = append(tok.Teams, fleet.TeamTuple{
+				ID:   *team.TeamID,
+				Name: team.Name,
+			})
+		}
+	}
+
+	return tok, nil
+}
+
+func (ds *Datastore) UpdateVPPTokenTeams(ctx context.Context, id uint, teams []uint) (*fleet.VPPTokenDB, error) {
+	stmtRemove := `DELETE FROM vpp_token_teams WHERE vpp_token_id = ?`
+	stmtInsert := `
+	INSERT INTO
+		vpp_token_teams (
+			vpp_token_id,
+			team_id,
+			null_team_type
+	) VALUES `
+	stmtValues := `(?, ?, ?)`
+	// Delete all apps associated with a token if we change its team
+	stmtDeleteApps := `DELETE FROM vpp_apps_teams WHERE vpp_token_id = ?`
+	deleteArgs := []any{id}
+
+	var values string
+	var args []any
+	// No DB constraint for null_team_type, if no team or all teams
+	// comes up we have to check it in go
+	var nullTeamCheck fleet.NullTeamType
+
+	if len(teams) > 0 {
+		for _, team := range teams {
+			team := team
+			if values == "" {
+				values = stmtValues
+			} else {
+				values = strings.Join([]string{values, stmtValues}, ",")
+			}
+			var teamptr *uint
+			nullTeam := fleet.NullTeamNone
+			if team != 0 {
+				// Regular team
+				teamptr = &team
+			} else {
+				// NoTeam team
+				nullTeam = fleet.NullTeamNoTeam
+				nullTeamCheck = fleet.NullTeamNoTeam
+			}
+			args = append(args, id, teamptr, nullTeam)
+		}
+	} else if teams != nil {
+		// Empty but not nil, All Teams!
+		values = stmtValues
+		args = append(args, id, nil, fleet.NullTeamAllTeams)
+		nullTeamCheck = fleet.NullTeamAllTeams
+	}
+
+	stmtInsertFull := stmtInsert + values
+
+	err := ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
+		// NOTE This is not optimal, and has the potential to
+		// introduce race conditions. Ideally we would insert and
+		// check the constraints in a single query.
+		if err := checkVPPNullTeam(ctx, tx, &id, nullTeamCheck); err != nil {
+			return ctxerr.Wrap(ctx, err, "vpp token null team check")
+		}
+
+		if _, err := tx.ExecContext(ctx, stmtDeleteApps, deleteArgs...); err != nil {
+			return ctxerr.Wrap(ctx, err, "deleting old vpp team apps associations")
+		}
+
+		if _, err := tx.ExecContext(ctx, stmtRemove, id); err != nil {
+			return ctxerr.Wrap(ctx, err, "removing old vpp team associations")
+		}
+
+		if len(args) > 0 {
+			if _, err := tx.ExecContext(ctx, stmtInsertFull, args...); err != nil {
+				if isChildForeignKeyError(err) {
+					return foreignKey("team", fmt.Sprintf("(team_id)=(%v)", values))
+				}
+
+				return ctxerr.Wrap(ctx, err, "updating vpp token team")
+			}
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "modifying vpp token team associations")
+	}
+
+	return ds.GetVPPToken(ctx, id)
+}
+
+func (ds *Datastore) DeleteVPPToken(ctx context.Context, tokenID uint) error {
+	_, err := ds.writer(ctx).ExecContext(ctx, `DELETE FROM vpp_tokens WHERE id = ?`, tokenID)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "deleting vpp token")
+	}
+
+	return nil
+}
+
+func (ds *Datastore) ListVPPTokens(ctx context.Context) ([]*fleet.VPPTokenDB, error) {
+	// linter false positive on the word "token" (gosec G101)
+	//nolint:gosec
+	stmtTokens := `
+	SELECT
+		id,
+		organization_name,
+		location,
+		renew_at,
+		token
+	FROM
+		vpp_tokens v
+`
+
+	stmtTeams := `
+	SELECT
+		vt.id,
+		vt.vpp_token_id,
+		vt.team_id,
+		vt.null_team_type,
+		COALESCE(t.name, '') AS name
+	FROM
+		vpp_token_teams vt
+	LEFT OUTER JOIN
+		teams t
+	ON vt.team_id = t.id
+`
+	var tokEncs []fleet.VPPTokenDB
+
+	var teams []struct {
+		ID         string             `db:"id"`
+		VPPTokenID uint               `db:"vpp_token_id"`
+		TeamID     *uint              `db:"team_id"`
+		TeamName   string             `db:"name"`
+		NullTeam   fleet.NullTeamType `db:"null_team_type"`
+	}
+
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &tokEncs, stmtTokens); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "selecting vpp tokens from db")
+	}
+
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &teams, stmtTeams); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "selecting vpp token teams from db")
+	}
+
+	tokens := map[uint]*fleet.VPPTokenDB{}
+
+	for _, tokEnc := range tokEncs {
+		tokDec, err := decrypt([]byte(tokEnc.Token), ds.serverPrivateKey)
+		if err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "decrypting vpp token with serverPrivateKey")
+		}
+
+		tokens[tokEnc.ID] = &fleet.VPPTokenDB{
+			ID:        tokEnc.ID,
+			OrgName:   tokEnc.OrgName,
+			Location:  tokEnc.Location,
+			RenewDate: tokEnc.RenewDate,
+			Token:     string(tokDec),
+		}
+	}
+
+	for _, team := range teams {
+		token := tokens[team.VPPTokenID]
+		if token.Teams != nil && len(token.Teams) == 0 {
+			// Token was already assigned to All Teams, we should not
+			// see it again in a loop
+			return nil, fmt.Errorf("vpp token \"%s\" has been assigned to All teams, and another team", token.OrgName)
+		}
+		switch team.NullTeam {
+		case fleet.NullTeamAllTeams:
+			// All teams, there should be no other teams.
+			// Make sure array is non-nil
+			if token.Teams != nil {
+				// This team has already been assigned something, this
+				// should not happen
+				return nil, fmt.Errorf("vpp token \"%s\" has been asssigned to All teams, and another team", token.OrgName)
+			}
+			token.Teams = []fleet.TeamTuple{}
+		case fleet.NullTeamNoTeam:
+			token.Teams = append(token.Teams, fleet.TeamTuple{ID: 0, Name: fleet.TeamNameNoTeam})
+		case fleet.NullTeamNone:
+			// Regular team
+			token.Teams = append(token.Teams, fleet.TeamTuple{ID: *team.TeamID, Name: team.TeamName})
+		}
+	}
+
+	var outTokens []*fleet.VPPTokenDB
+	for _, token := range tokens {
+		outTokens = append(outTokens, token)
+	}
+
+	slices.SortFunc(outTokens, func(a, b *fleet.VPPTokenDB) int {
+		return cmp.Compare(a.OrgName, b.OrgName)
+	})
+
+	return outTokens, nil
+}
+
+func (ds *Datastore) GetVPPTokenByTeamID(ctx context.Context, teamID *uint) (*fleet.VPPTokenDB, error) {
+	stmtTeam := `
+	SELECT
+		v.id,
+		v.organization_name,
+		v.location,
+		v.renew_at,
+		v.token
+	FROM
+		vpp_token_teams vt
+	INNER JOIN
+		vpp_tokens v
+	ON vt.vpp_token_id = v.id
+	WHERE
+		vt.team_id = ?
+`
+	stmtTeamNames := `
+	SELECT
+		vt.team_id,
+		vt.null_team_type,
+		COALESCE(t.name, '') AS name
+	FROM
+		vpp_token_teams vt
+	LEFT OUTER JOIN
+		teams t
+	ON t.id = vt.team_id
+	WHERE
+		vt.vpp_token_id = ?
+`
+	stmtNullTeam := `
+	SELECT
+		v.id,
+		v.organization_name,
+		v.location,
+		v.renew_at,
+		v.token
+	FROM
+		vpp_tokens v
+	INNER JOIN
+		vpp_token_teams vt
+	ON v.id = vt.vpp_token_id
+	WHERE
+		vt.team_id IS NULL
+	AND
+		vt.null_team_type = ?
+`
+
+	var tokEnc fleet.VPPTokenDB
+
+	var tokTeams []struct {
+		TeamID   *uint              `db:"team_id"`
+		NullTeam fleet.NullTeamType `db:"null_team_type"`
+		Name     string             `db:"name"`
+	}
+
+	var err error
+	if teamID != nil && *teamID != 0 {
+		err = sqlx.GetContext(ctx, ds.reader(ctx), &tokEnc, stmtTeam, teamID)
+	} else {
+		err = sqlx.GetContext(ctx, ds.reader(ctx), &tokEnc, stmtNullTeam, fleet.NullTeamNoTeam)
+	}
+	if err != nil {
+		if errors.Is(sql.ErrNoRows, err) {
+			if err := sqlx.GetContext(ctx, ds.reader(ctx), &tokEnc, stmtNullTeam, fleet.NullTeamAllTeams); err != nil {
+				if errors.Is(err, sql.ErrNoRows) {
+					return nil, ctxerr.Wrap(ctx, notFound("VPPToken"), "retrieving vpp token by team")
+				}
+				return nil, ctxerr.Wrap(ctx, err, "retrieving vpp token by team")
+			}
+		} else {
+			return nil, ctxerr.Wrap(ctx, err, "retrieving vpp token by team")
+		}
+	}
+
+	tokDec, err := decrypt([]byte(tokEnc.Token), ds.serverPrivateKey)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "decrypting vpp token with serverPrivateKey")
+	}
+
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &tokTeams, stmtTeamNames, tokEnc.ID); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "retrieving vpp token team information")
+	}
+
+	tok := &fleet.VPPTokenDB{
+		ID:        tokEnc.ID,
+		OrgName:   tokEnc.OrgName,
+		Location:  tokEnc.Location,
+		RenewDate: tokEnc.RenewDate,
+		Token:     string(tokDec),
+	}
+
+	if tokTeams == nil {
+		// Not assigned, no need to loop over teams
+		return tok, nil
+	}
+
+TEAMLOOP:
+	for _, team := range tokTeams {
+		switch team.NullTeam {
+		case fleet.NullTeamAllTeams:
+			// This should only be possible if there are no other teams
+			// Make sure something array is non-nil
+			if len(tokTeams) != 1 {
+				return nil, ctxerr.Errorf(ctx, "team \"%s\" belongs to All teams, and %d other team(s)", tok.OrgName, len(tokTeams)-1)
+			}
+			tok.Teams = []fleet.TeamTuple{}
+			break TEAMLOOP
+		case fleet.NullTeamNoTeam:
+			tok.Teams = append(tok.Teams, fleet.TeamTuple{
+				ID:   0,
+				Name: fleet.TeamNameNoTeam,
+			})
+		case fleet.NullTeamNone:
+			// Regular team
+			tok.Teams = append(tok.Teams, fleet.TeamTuple{
+				ID:   *team.TeamID,
+				Name: team.Name,
+			})
+		}
+	}
+
+	return tok, nil
+}
+
+func checkVPPNullTeam(ctx context.Context, tx sqlx.ExtContext, currentID *uint, nullTeam fleet.NullTeamType) error {
+	nullTeamStmt := `SELECT vpp_token_id FROM vpp_token_teams WHERE null_team_type = ?`
+	anyTeamStmt := `SELECT vpp_token_id FROM vpp_token_teams WHERE null_team_type = 'allteams' OR null_team_type = 'noteam' OR team_id IS NOT NULL`
+
+	if nullTeam == fleet.NullTeamAllTeams {
+		var ids []uint
+		if err := sqlx.SelectContext(ctx, tx, &ids, anyTeamStmt); err != nil {
+			return ctxerr.Wrap(ctx, err, "scanning row in check vpp token null team")
+		}
+
+		if len(ids) > 0 {
+			if len(ids) > 1 {
+				return ctxerr.Wrap(ctx, errors.New("Cannot assign token to All teams, other teams have tokens"))
+			}
+			if currentID == nil || ids[0] != *currentID {
+				return ctxerr.Wrap(ctx, errors.New("Cannot assign token to All teams, other teams have tokens"))
+			}
+		}
+	}
+
+	var id uint
+	allTeamsFound := true
+	if err := sqlx.GetContext(ctx, tx, &id, nullTeamStmt, fleet.NullTeamAllTeams); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			allTeamsFound = false
+		} else {
+			return ctxerr.Wrap(ctx, err, "scanning row in check vpp token null team")
+		}
+	}
+
+	if allTeamsFound && currentID != nil && *currentID != id {
+		return ctxerr.Wrap(ctx, errors.New("All teams token already exists"))
+	}
+
+	if nullTeam != fleet.NullTeamNone {
+		var id uint
+		if err := sqlx.GetContext(ctx, tx, &id, nullTeamStmt, nullTeam); err != nil {
+			if errors.Is(err, sql.ErrNoRows) {
+				return nil
+			}
+			return ctxerr.Wrap(ctx, err, "scanning row in check vpp token null team")
+		}
+		if currentID == nil || *currentID != id {
+			return ctxerr.Errorf(ctx, "vpp token for team %s already exists", nullTeam)
+		}
+	}
+
+	return nil
+}
diff --git a/server/datastore/mysql/vpp_test.go b/server/datastore/mysql/vpp_test.go
new file mode 100644
index 000000000000..b9bfb8dfe317
--- /dev/null
+++ b/server/datastore/mysql/vpp_test.go
@@ -0,0 +1,1201 @@
+package mysql
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/contexts/viewer"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/mdm/nanomdm/mdm"
+	"github.com/fleetdm/fleet/v4/server/ptr"
+	"github.com/fleetdm/fleet/v4/server/test"
+	"github.com/google/uuid"
+	"github.com/jmoiron/sqlx"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestVPP(t *testing.T) {
+	ds := CreateMySQLDS(t)
+
+	cases := []struct {
+		name string
+		fn   func(t *testing.T, ds *Datastore)
+	}{
+		{"SetTeamVPPApps", testSetTeamVPPApps},
+		{"VPPAppMetadata", testVPPAppMetadata},
+		{"VPPAppStatus", testVPPAppStatus},
+		{"VPPApps", testVPPApps},
+		{"GetVPPAppByTeamAndTitleID", testGetVPPAppByTeamAndTitleID},
+		{"VPPTokensCRUD", testVPPTokensCRUD},
+		{"VPPTokenAppTeamAssociations", testVPPTokenAppTeamAssociations},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			t.Helper()
+			defer TruncateTables(t, ds)
+			c.fn(t, ds)
+		})
+	}
+}
+
+func testVPPAppMetadata(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	// create teams
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team 1"})
+	require.NoError(t, err)
+	require.NotNil(t, team1)
+	team2, err := ds.NewTeam(ctx, &fleet.Team{Name: "team 2"})
+	require.NoError(t, err)
+	require.NotNil(t, team2)
+
+	test.CreateInsertGlobalVPPToken(t, ds)
+
+	// get for non-existing title
+	meta, err := ds.GetVPPAppMetadataByTeamAndTitleID(ctx, nil, 1)
+	require.Error(t, err)
+	var nfe fleet.NotFoundError
+	require.ErrorAs(t, err, &nfe)
+	require.Nil(t, meta)
+
+	// create no-team app
+	va1, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp1", BundleIdentifier: "com.app.vpp1",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_1", Platform: fleet.MacOSPlatform}},
+	}, nil)
+	require.NoError(t, err)
+	vpp1, titleID1 := va1.VPPAppID, va1.TitleID
+
+	// get no-team app
+	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, nil, titleID1)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStoreApp{Name: "vpp1", VPPAppID: vpp1}, meta)
+
+	// try to add the same app again, update self_service field
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp1", BundleIdentifier: "com.app.vpp1",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_1", Platform: fleet.MacOSPlatform}, SelfService: true},
+	}, nil)
+	require.NoError(t, err)
+
+	// get no-team app
+	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, nil, titleID1)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStoreApp{Name: "vpp1", VPPAppID: vpp1, SelfService: true}, meta)
+
+	// create team1 app
+	va2, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp2", BundleIdentifier: "com.app.vpp2",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.MacOSPlatform}},
+	}, &team1.ID)
+	require.NoError(t, err)
+	vpp2, titleID2 := va2.VPPAppID, va2.TitleID
+
+	// get it for team 1
+	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, &team1.ID, titleID2)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStoreApp{Name: "vpp2", VPPAppID: vpp2}, meta)
+
+	// get it for all teams
+	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, nil, titleID2)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStoreApp{Name: "vpp2", VPPAppID: vpp2}, meta)
+
+	// try to add the same app again, fails
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp2", BundleIdentifier: "com.app.vpp2",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.MacOSPlatform}, SelfService: true},
+	}, &team1.ID)
+	require.NoError(t, err)
+
+	// get it for team 1
+	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, &team1.ID, titleID2)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStoreApp{Name: "vpp2", VPPAppID: vpp2, SelfService: true}, meta)
+
+	// get it for team 2, does not exist
+	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, &team2.ID, titleID2)
+	require.Error(t, err)
+	require.ErrorAs(t, err, &nfe)
+	require.Nil(t, meta)
+
+	// create the same app for team2
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp2", BundleIdentifier: "com.app.vpp2",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.MacOSPlatform}},
+	}, &team2.ID)
+	require.NoError(t, err)
+
+	// get it for team 1 and team 2, both work
+	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, &team1.ID, titleID2)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStoreApp{Name: "vpp2", VPPAppID: vpp2, SelfService: true}, meta)
+	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, &team2.ID, titleID2)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStoreApp{Name: "vpp2", VPPAppID: vpp2}, meta)
+
+	// create another no-team app
+	va3, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp3", BundleIdentifier: "com.app.vpp3",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_3", Platform: fleet.MacOSPlatform}},
+	}, nil)
+	require.NoError(t, err)
+	vpp3, titleID3 := va3.VPPAppID, va3.TitleID
+
+	// get it for team 2, does not exist
+	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, &team2.ID, titleID3)
+	require.Error(t, err)
+	require.ErrorAs(t, err, &nfe)
+	require.Nil(t, meta)
+
+	// get it for no-team
+	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, nil, titleID3)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStoreApp{Name: "vpp3", VPPAppID: vpp3}, meta)
+
+	// delete vpp1
+	err = ds.DeleteVPPAppFromTeam(ctx, nil, vpp1)
+	require.NoError(t, err)
+	// it is now not found
+	_, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, nil, titleID1)
+	require.Error(t, err)
+	require.ErrorAs(t, err, &nfe)
+	// vpp3 (also in no team) is left untouched
+	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, nil, titleID3)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStoreApp{Name: "vpp3", VPPAppID: vpp3}, meta)
+
+	// delete vpp2 for team1
+	err = ds.DeleteVPPAppFromTeam(ctx, &team1.ID, vpp2)
+	require.NoError(t, err)
+	// it is now not found for team1
+	_, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, &team1.ID, titleID2)
+	require.Error(t, err)
+	require.ErrorAs(t, err, &nfe)
+	// but still found for team2
+	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, &team2.ID, titleID2)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStoreApp{Name: "vpp2", VPPAppID: vpp2}, meta)
+
+	// delete vpp1 again fails, not found
+	err = ds.DeleteVPPAppFromTeam(ctx, nil, vpp1)
+	require.Error(t, err)
+	require.ErrorAs(t, err, &nfe)
+
+	// delete the software title
+	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(ctx, "DELETE FROM software_titles WHERE id = ?", titleID3)
+		return err
+	})
+
+	// cannot be returned anymore (deleting the title breaks the relationship)
+	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, nil, titleID3)
+	require.Error(t, err)
+	require.ErrorAs(t, err, &nfe)
+	require.Nil(t, meta)
+}
+
+func testVPPAppStatus(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	// create a user
+	user, err := ds.NewUser(ctx, &fleet.User{
+		Password:   []byte("p4ssw0rd.123"),
+		Name:       "user1",
+		Email:      "user1@example.com",
+		GlobalRole: ptr.String(fleet.RoleAdmin),
+	})
+	require.NoError(t, err)
+
+	// create a team
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team 1"})
+	require.NoError(t, err)
+	require.NotNil(t, team1)
+
+	test.CreateInsertGlobalVPPToken(t, ds)
+
+	// create some apps, one for no-team, one for team1, and one in both
+	va1, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp1", BundleIdentifier: "com.app.vpp1",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_1", Platform: fleet.MacOSPlatform}},
+	}, nil)
+	require.NoError(t, err)
+	vpp1 := va1.VPPAppID
+	va2, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp2", BundleIdentifier: "com.app.vpp2",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.MacOSPlatform}},
+	}, &team1.ID)
+	require.NoError(t, err)
+	vpp2 := va2.VPPAppID
+	va3, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp3", BundleIdentifier: "com.app.vpp3",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_3", Platform: fleet.MacOSPlatform}},
+	}, nil)
+	require.NoError(t, err)
+	vpp3 := va3.VPPAppID
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp3", BundleIdentifier: "com.app.vpp3",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_3", Platform: fleet.MacOSPlatform}},
+	}, &team1.ID)
+	require.NoError(t, err)
+
+	// for now they all return zeroes
+	summary, err := ds.GetSummaryHostVPPAppInstalls(ctx, nil, vpp1)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStatusSummary{Pending: 0, Failed: 0, Installed: 0}, summary)
+	summary, err = ds.GetSummaryHostVPPAppInstalls(ctx, &team1.ID, vpp2)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStatusSummary{Pending: 0, Failed: 0, Installed: 0}, summary)
+	summary, err = ds.GetSummaryHostVPPAppInstalls(ctx, nil, vpp3)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStatusSummary{Pending: 0, Failed: 0, Installed: 0}, summary)
+
+	// create a few enrolled hosts
+	h1, err := ds.NewHost(ctx, &fleet.Host{
+		Hostname:       "macos-test-1",
+		OsqueryHostID:  ptr.String("osquery-macos-1"),
+		NodeKey:        ptr.String("node-key-macos-1"),
+		UUID:           uuid.NewString(),
+		Platform:       "darwin",
+		HardwareSerial: "654321a",
+	})
+	require.NoError(t, err)
+	nanoEnroll(t, ds, h1, false)
+
+	h2, err := ds.NewHost(ctx, &fleet.Host{
+		Hostname:       "macos-test-2",
+		OsqueryHostID:  ptr.String("osquery-macos-2"),
+		NodeKey:        ptr.String("node-key-macos-2"),
+		UUID:           uuid.NewString(),
+		Platform:       "darwin",
+		HardwareSerial: "654321b",
+	})
+	require.NoError(t, err)
+	nanoEnroll(t, ds, h2, false)
+
+	h3, err := ds.NewHost(ctx, &fleet.Host{
+		Hostname:       "macos-test-3",
+		OsqueryHostID:  ptr.String("osquery-macos-3"),
+		NodeKey:        ptr.String("node-key-macos-3"),
+		UUID:           uuid.NewString(),
+		Platform:       "darwin",
+		HardwareSerial: "654321c",
+	})
+	require.NoError(t, err)
+	nanoEnroll(t, ds, h3, false)
+
+	// move h3 to team1
+	err = ds.AddHostsToTeam(ctx, &team1.ID, []uint{h3.ID})
+	require.NoError(t, err)
+
+	// simulate an install request of vpp1 on h1
+	cmd1 := createVPPAppInstallRequest(t, ds, h1, vpp1.AdamID, user.ID)
+
+	summary, err = ds.GetSummaryHostVPPAppInstalls(ctx, nil, vpp1)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStatusSummary{Pending: 1, Failed: 0, Installed: 0}, summary)
+
+	// record a failed result
+	createVPPAppInstallResult(t, ds, h1, cmd1, fleet.MDMAppleStatusError)
+
+	summary, err = ds.GetSummaryHostVPPAppInstalls(ctx, nil, vpp1)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStatusSummary{Pending: 0, Failed: 1, Installed: 0}, summary)
+
+	// create a new request for h1 that supercedes the failed on, and a request
+	// for h2 with a successful result.
+	cmd2 := createVPPAppInstallRequest(t, ds, h1, vpp1.AdamID, user.ID)
+	cmd3 := createVPPAppInstallRequest(t, ds, h2, vpp1.AdamID, user.ID)
+	createVPPAppInstallResult(t, ds, h2, cmd3, fleet.MDMAppleStatusAcknowledged)
+
+	actUser, act, err := ds.GetPastActivityDataForVPPAppInstall(ctx, &mdm.CommandResults{CommandUUID: cmd3})
+	require.NoError(t, err)
+	require.Equal(t, user.ID, actUser.ID)
+	require.Equal(t, user.Name, actUser.Name)
+	require.Equal(t, cmd3, act.CommandUUID)
+	require.False(t, act.SelfService)
+
+	summary, err = ds.GetSummaryHostVPPAppInstalls(ctx, nil, vpp1)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStatusSummary{Pending: 1, Failed: 0, Installed: 1}, summary)
+
+	// mark the pending request as successful too
+	createVPPAppInstallResult(t, ds, h1, cmd2, fleet.MDMAppleStatusAcknowledged)
+
+	summary, err = ds.GetSummaryHostVPPAppInstalls(ctx, nil, vpp1)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStatusSummary{Pending: 0, Failed: 0, Installed: 2}, summary)
+
+	// requesting for a team (the VPP app is not on any team) returns all zeroes
+	summary, err = ds.GetSummaryHostVPPAppInstalls(ctx, &team1.ID, vpp1)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStatusSummary{Pending: 0, Failed: 0, Installed: 0}, summary)
+
+	// simulate a successful request for team app vpp2 on h3
+	cmd4 := createVPPAppInstallRequest(t, ds, h3, vpp2.AdamID, user.ID)
+	createVPPAppInstallResult(t, ds, h3, cmd4, fleet.MDMAppleStatusAcknowledged)
+
+	summary, err = ds.GetSummaryHostVPPAppInstalls(ctx, &team1.ID, vpp2)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStatusSummary{Pending: 0, Failed: 0, Installed: 1}, summary)
+
+	// simulate a successful, failed and pending request for app vpp3 on team
+	// (h3) and no team (h1, h2)
+	cmd5 := createVPPAppInstallRequest(t, ds, h3, vpp3.AdamID, user.ID)
+	createVPPAppInstallResult(t, ds, h3, cmd5, fleet.MDMAppleStatusAcknowledged)
+	cmd6 := createVPPAppInstallRequest(t, ds, h1, vpp3.AdamID, user.ID)
+	createVPPAppInstallResult(t, ds, h1, cmd6, fleet.MDMAppleStatusCommandFormatError)
+	createVPPAppInstallRequest(t, ds, h2, vpp3.AdamID, user.ID)
+
+	// for no team, it sees the failed and pending counts
+	summary, err = ds.GetSummaryHostVPPAppInstalls(ctx, nil, vpp3)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStatusSummary{Pending: 1, Failed: 1, Installed: 0}, summary)
+
+	// for the team, it sees the successful count
+	summary, err = ds.GetSummaryHostVPPAppInstalls(ctx, &team1.ID, vpp3)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStatusSummary{Pending: 0, Failed: 0, Installed: 1}, summary)
+
+	// simulate a self-service request
+	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(ctx,
+			`UPDATE host_vpp_software_installs SET self_service = true, user_id = NULL WHERE command_uuid = ?`,
+			cmd3)
+		return err
+	})
+	actUser, act, err = ds.GetPastActivityDataForVPPAppInstall(ctx, &mdm.CommandResults{CommandUUID: cmd3})
+	require.NoError(t, err)
+	require.Nil(t, actUser)
+	require.Equal(t, cmd3, act.CommandUUID)
+	require.True(t, act.SelfService)
+}
+
+// simulates creating the VPP app install request on the host, returns the command UUID.
+func createVPPAppInstallRequest(t *testing.T, ds *Datastore, host *fleet.Host, adamID string, userID uint) string {
+	ctx := context.Background()
+
+	cmdUUID := uuid.NewString()
+	appleCmd := createRawAppleCmd("ProfileList", cmdUUID)
+	commander, _ := createMDMAppleCommanderAndStorage(t, ds)
+	err := commander.EnqueueCommand(ctx, []string{host.UUID}, appleCmd)
+	require.NoError(t, err)
+
+	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(ctx,
+			`INSERT INTO host_vpp_software_installs (host_id, adam_id, platform, command_uuid, user_id) VALUES (?, ?, ?, ?, ?)`,
+			host.ID, adamID, host.Platform, cmdUUID, userID)
+		return err
+	})
+	return cmdUUID
+}
+
+func createVPPAppInstallResult(t *testing.T, ds *Datastore, host *fleet.Host, cmdUUID string, status string) {
+	ctx := context.Background()
+
+	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(ctx, `INSERT INTO nano_command_results (id, command_uuid, status, result) VALUES (?, ?, ?, '<?xml')`,
+			host.UUID, cmdUUID, status)
+		return err
+	})
+}
+
+func testVPPApps(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	// Create a team
+	team, err := ds.NewTeam(ctx, &fleet.Team{Name: "foobar"})
+	require.NoError(t, err)
+
+	test.CreateInsertGlobalVPPToken(t, ds)
+
+	// create a host with some non-VPP software
+	h1, err := ds.NewHost(ctx, &fleet.Host{
+		Hostname:       "macos-test-1",
+		OsqueryHostID:  ptr.String("osquery-macos-1"),
+		NodeKey:        ptr.String("node-key-macos-1"),
+		UUID:           uuid.NewString(),
+		Platform:       "darwin",
+		HardwareSerial: "654321a",
+	})
+	require.NoError(t, err)
+	software := []fleet.Software{
+		{Name: "foo", Version: "0.0.1", BundleIdentifier: "b1"},
+		{Name: "foo", Version: "0.0.2", BundleIdentifier: "b1"},
+		{Name: "bar", Version: "0.0.3", BundleIdentifier: "bar"},
+	}
+	_, err = ds.UpdateHostSoftware(ctx, h1.ID, software)
+	require.NoError(t, err)
+	err = ds.ReconcileSoftwareTitles(ctx)
+	require.NoError(t, err)
+
+	// Insert some VPP apps for the team, "vpp_app_1" should match the existing "foo" title
+	app1 := &fleet.VPPApp{Name: "vpp_app_1", VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "1", Platform: fleet.MacOSPlatform}}, BundleIdentifier: "b1"}
+	app2 := &fleet.VPPApp{Name: "vpp_app_2", VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "2", Platform: fleet.MacOSPlatform}}, BundleIdentifier: "b2"}
+	_, err = ds.InsertVPPAppWithTeam(ctx, app1, &team.ID)
+	require.NoError(t, err)
+
+	_, err = ds.InsertVPPAppWithTeam(ctx, app2, &team.ID)
+	require.NoError(t, err)
+
+	// Insert some VPP apps for no team
+	appNoTeam1 := &fleet.VPPApp{
+		Name: "vpp_no_team_app_1", VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "3", Platform: fleet.MacOSPlatform}},
+		BundleIdentifier: "b3",
+	}
+	appNoTeam2 := &fleet.VPPApp{
+		Name: "vpp_no_team_app_2", VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "4", Platform: fleet.MacOSPlatform}},
+		BundleIdentifier: "b4",
+	}
+	_, err = ds.InsertVPPAppWithTeam(ctx, appNoTeam1, nil)
+	require.NoError(t, err)
+	_, err = ds.InsertVPPAppWithTeam(ctx, appNoTeam2, nil)
+	require.NoError(t, err)
+
+	// Check that host_vpp_software_installs works
+	u, err := ds.NewUser(ctx, &fleet.User{
+		Password:   []byte("p4ssw0rd.123"),
+		Name:       "user1",
+		Email:      "user1@example.com",
+		GlobalRole: ptr.String(fleet.RoleAdmin),
+	})
+	require.NoError(t, err)
+	ctx = viewer.NewContext(ctx, viewer.Viewer{User: u})
+	err = ds.InsertHostVPPSoftwareInstall(ctx, 1, app1.VPPAppID, "a", "b", false)
+	require.NoError(t, err)
+
+	err = ds.InsertHostVPPSoftwareInstall(ctx, 2, app2.VPPAppID, "c", "d", true)
+	require.NoError(t, err)
+
+	var results []struct {
+		HostID            uint   `db:"host_id"`
+		UserID            *uint  `db:"user_id"`
+		AdamID            string `db:"adam_id"`
+		CommandUUID       string `db:"command_uuid"`
+		AssociatedEventID string `db:"associated_event_id"`
+		SelfService       bool   `db:"self_service"`
+	}
+	err = sqlx.SelectContext(ctx, ds.reader(ctx), &results, `SELECT host_id, user_id, adam_id, command_uuid, associated_event_id, self_service FROM host_vpp_software_installs ORDER BY adam_id`)
+	require.NoError(t, err)
+	require.Len(t, results, 2)
+	a1 := results[0]
+	a2 := results[1]
+	require.Equal(t, a1.HostID, uint(1))
+	require.Equal(t, a1.UserID, ptr.Uint(u.ID))
+	require.Equal(t, a1.AdamID, app1.AdamID)
+	require.Equal(t, a1.CommandUUID, "a")
+	require.Equal(t, a1.AssociatedEventID, "b")
+	require.False(t, a1.SelfService)
+	require.Equal(t, a2.HostID, uint(2))
+	require.Equal(t, a2.UserID, ptr.Uint(u.ID))
+	require.Equal(t, a2.AdamID, app2.AdamID)
+	require.Equal(t, a2.CommandUUID, "c")
+	require.Equal(t, a2.AssociatedEventID, "d")
+	require.True(t, a2.SelfService)
+
+	// Check that getting the assigned apps works
+	appSet, err := ds.GetAssignedVPPApps(ctx, &team.ID)
+	require.NoError(t, err)
+	assert.Equal(t, map[fleet.VPPAppID]fleet.VPPAppTeam{app1.VPPAppID: {VPPAppID: app1.VPPAppID}, app2.VPPAppID: {VPPAppID: app2.VPPAppID}}, appSet)
+
+	appSet, err = ds.GetAssignedVPPApps(ctx, nil)
+	require.NoError(t, err)
+	assert.Equal(t, map[fleet.VPPAppID]fleet.VPPAppTeam{appNoTeam1.VPPAppID: {VPPAppID: appNoTeam1.VPPAppID}, appNoTeam2.VPPAppID: {VPPAppID: appNoTeam2.VPPAppID}}, appSet)
+
+	var appTitles []fleet.SoftwareTitle
+	err = sqlx.SelectContext(ctx, ds.reader(ctx), &appTitles, `SELECT name, bundle_identifier FROM software_titles WHERE bundle_identifier IN (?,?) ORDER BY bundle_identifier`, app1.BundleIdentifier, app2.BundleIdentifier)
+	require.NoError(t, err)
+	require.Len(t, appTitles, 2)
+	require.Equal(t, app1.BundleIdentifier, *appTitles[0].BundleIdentifier)
+	require.Equal(t, app2.BundleIdentifier, *appTitles[1].BundleIdentifier)
+	require.Equal(t, "foo", appTitles[0].Name)
+	require.Equal(t, app2.Name, appTitles[1].Name)
+}
+
+func testSetTeamVPPApps(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	// Create a team
+	team, err := ds.NewTeam(ctx, &fleet.Team{Name: "vpp gang"})
+	require.NoError(t, err)
+
+	dataToken, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), "Donkey Kong", "Jungle")
+	require.NoError(t, err)
+	tok1, err := ds.InsertVPPToken(ctx, dataToken)
+	assert.NoError(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tok1.ID, []uint{})
+	assert.NoError(t, err)
+
+	// Insert some VPP apps for the team
+	app1 := &fleet.VPPApp{Name: "vpp_app_1", VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "1", Platform: fleet.MacOSPlatform}}, BundleIdentifier: "b1"}
+	_, err = ds.InsertVPPAppWithTeam(ctx, app1, nil)
+	require.NoError(t, err)
+	app2 := &fleet.VPPApp{Name: "vpp_app_2", VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "2", Platform: fleet.MacOSPlatform}}, BundleIdentifier: "b2"}
+	_, err = ds.InsertVPPAppWithTeam(ctx, app2, nil)
+	require.NoError(t, err)
+	app3 := &fleet.VPPApp{Name: "vpp_app_3", VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "3", Platform: fleet.MacOSPlatform}}, BundleIdentifier: "b3"}
+	_, err = ds.InsertVPPAppWithTeam(ctx, app3, nil)
+	require.NoError(t, err)
+	app4 := &fleet.VPPApp{Name: "vpp_app_4", VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "4", Platform: fleet.MacOSPlatform}}, BundleIdentifier: "b4"}
+	_, err = ds.InsertVPPAppWithTeam(ctx, app4, nil)
+	require.NoError(t, err)
+
+	assigned, err := ds.GetAssignedVPPApps(ctx, &team.ID)
+	require.NoError(t, err)
+	require.Len(t, assigned, 0)
+
+	// Assign 2 apps
+	err = ds.SetTeamVPPApps(ctx, &team.ID, []fleet.VPPAppTeam{
+		{VPPAppID: app1.VPPAppID},
+		{VPPAppID: app2.VPPAppID, SelfService: true},
+	})
+	require.NoError(t, err)
+
+	assigned, err = ds.GetAssignedVPPApps(ctx, &team.ID)
+	require.NoError(t, err)
+	require.Len(t, assigned, 2)
+	assert.Contains(t, assigned, app1.VPPAppID)
+	assert.Contains(t, assigned, app2.VPPAppID)
+	assert.True(t, assigned[app2.VPPAppID].SelfService)
+
+	// Assign an additional app
+	err = ds.SetTeamVPPApps(ctx, &team.ID, []fleet.VPPAppTeam{
+		{VPPAppID: app1.VPPAppID},
+		{VPPAppID: app2.VPPAppID},
+		{VPPAppID: app3.VPPAppID},
+	})
+	require.NoError(t, err)
+
+	assigned, err = ds.GetAssignedVPPApps(ctx, &team.ID)
+	require.NoError(t, err)
+	require.Len(t, assigned, 3)
+	require.Contains(t, assigned, app1.VPPAppID)
+	require.Contains(t, assigned, app2.VPPAppID)
+	require.Contains(t, assigned, app3.VPPAppID)
+	assert.False(t, assigned[app2.VPPAppID].SelfService)
+
+	// Swap one app out for another
+	err = ds.SetTeamVPPApps(ctx, &team.ID, []fleet.VPPAppTeam{
+		{VPPAppID: app1.VPPAppID},
+		{VPPAppID: app2.VPPAppID, SelfService: true},
+		{VPPAppID: app4.VPPAppID},
+	})
+	require.NoError(t, err)
+
+	assigned, err = ds.GetAssignedVPPApps(ctx, &team.ID)
+	require.NoError(t, err)
+	require.Len(t, assigned, 3)
+	require.Contains(t, assigned, app1.VPPAppID)
+	require.Contains(t, assigned, app2.VPPAppID)
+	require.Contains(t, assigned, app4.VPPAppID)
+	assert.True(t, assigned[app2.VPPAppID].SelfService)
+
+	// Remove all apps
+	err = ds.SetTeamVPPApps(ctx, &team.ID, []fleet.VPPAppTeam{})
+	require.NoError(t, err)
+
+	assigned, err = ds.GetAssignedVPPApps(ctx, &team.ID)
+	require.NoError(t, err)
+	require.Len(t, assigned, 0)
+}
+
+func testGetVPPAppByTeamAndTitleID(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+	team, err := ds.NewTeam(ctx, &fleet.Team{Name: "team 2"})
+	require.NoError(t, err)
+
+	test.CreateInsertGlobalVPPToken(t, ds)
+
+	var nfe fleet.NotFoundError
+
+	fooApp, err := ds.InsertVPPAppWithTeam(ctx,
+		&fleet.VPPApp{VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "foo", Platform: fleet.MacOSPlatform}}, BundleIdentifier: "b1", Name: "Foo"},
+		&team.ID)
+	require.NoError(t, err)
+
+	fooTitleID := fooApp.TitleID
+	gotVPPApp, err := ds.GetVPPAppByTeamAndTitleID(ctx, &team.ID, fooTitleID)
+	require.NoError(t, err)
+	require.Equal(t, "foo", gotVPPApp.AdamID)
+	require.Equal(t, fooTitleID, gotVPPApp.TitleID)
+	// title that doesn't exist
+	gotVPPApp, err = ds.GetVPPAppByTeamAndTitleID(ctx, &team.ID, 999)
+	require.ErrorAs(t, err, &nfe)
+
+	// create an entry for the global team
+	barApp, err := ds.InsertVPPAppWithTeam(ctx,
+		&fleet.VPPApp{VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "bar", Platform: fleet.MacOSPlatform}}, BundleIdentifier: "b2", Name: "Bar"}, nil)
+	require.NoError(t, err)
+	barTitleID := barApp.TitleID
+	// not found providing the team id
+	gotVPPApp, err = ds.GetVPPAppByTeamAndTitleID(ctx, &team.ID, barTitleID)
+	require.ErrorAs(t, err, &nfe)
+	// found for the global team
+	gotVPPApp, err = ds.GetVPPAppByTeamAndTitleID(ctx, nil, barTitleID)
+	require.NoError(t, err)
+	require.Equal(t, "bar", gotVPPApp.AdamID)
+	require.Equal(t, barTitleID, gotVPPApp.TitleID)
+}
+
+func testVPPTokensCRUD(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	team, err := ds.NewTeam(ctx, &fleet.Team{Name: "Kritters"})
+	assert.NoError(t, err)
+
+	team2, err := ds.NewTeam(ctx, &fleet.Team{Name: "Zingers"})
+	assert.NoError(t, err)
+
+	tokens, err := ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, tokens, 0)
+
+	orgName := "Donkey Kong"
+	location := "Jungle"
+	dataToken, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), orgName, location)
+	require.NoError(t, err)
+
+	orgName2 := "Diddy Kong"
+	location2 := "Mines"
+	dataToken2, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), orgName2, location2)
+	require.NoError(t, err)
+
+	orgName3 := "Cranky Cong"
+	location3 := "Cranky's Cabin"
+	dataToken3, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), orgName3, location3)
+	require.NoError(t, err)
+
+	orgName4 := "Funky Kong"
+	location4 := "Funky's Fishing Shack"
+	dataToken4, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), orgName4, location4)
+	require.NoError(t, err)
+
+	orgName5 := "Lanky Kong"
+	location5 := "Lanky Kong's Pool"
+	dataToken5, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), orgName5, location5)
+	require.NoError(t, err)
+
+	orgName6 := "Dixie Kong"
+	location6 := "Dixie's Island"
+	dataToken6, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), orgName6, location6)
+	require.NoError(t, err)
+
+	// No assignments / disabled token
+	tok, err := ds.InsertVPPToken(ctx, dataToken)
+	tokID := tok.ID
+	assert.NoError(t, err)
+	assert.Equal(t, dataToken.Location, tok.Location)
+	assert.Equal(t, dataToken.Token, tok.Token)
+	assert.Equal(t, orgName, tok.OrgName)
+	assert.Equal(t, location, tok.Location)
+	assert.Nil(t, tok.Teams) // No team assigned
+
+	tok, err = ds.GetVPPToken(ctx, tokID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokID, tok.ID)
+	assert.Equal(t, dataToken.Location, tok.Location)
+	assert.Equal(t, dataToken.Token, tok.Token)
+	assert.Equal(t, orgName, tok.OrgName)
+	assert.Equal(t, location, tok.Location)
+	assert.Nil(t, tok.Teams)
+
+	toks, err := ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 1)
+	assert.Equal(t, tokID, toks[0].ID)
+	assert.Equal(t, dataToken.Location, toks[0].Location)
+	assert.Equal(t, dataToken.Token, toks[0].Token)
+	assert.Equal(t, orgName, toks[0].OrgName)
+	assert.Equal(t, location, toks[0].Location)
+	assert.Nil(t, toks[0].Teams)
+
+	teamTok, err := ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.Error(t, err)
+	assert.True(t, fleet.IsNotFound(err))
+	assert.Nil(t, teamTok)
+
+	teamTok, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.Error(t, err)
+	assert.True(t, fleet.IsNotFound(err))
+	assert.Nil(t, teamTok)
+
+	// Assign to all teams
+	upTok, err := ds.UpdateVPPTokenTeams(ctx, tok.ID, []uint{})
+	assert.NoError(t, err)
+	assert.Equal(t, tokID, upTok.ID)
+	assert.Equal(t, dataToken.Location, upTok.Location)
+	assert.Equal(t, dataToken.Token, upTok.Token)
+	assert.Equal(t, orgName, upTok.OrgName)
+	assert.Equal(t, location, upTok.Location)
+	assert.NotNil(t, upTok.Teams) // "All Teams" teamm array is non-nil but empty
+	assert.Len(t, upTok.Teams, 0)
+
+	tok, err = ds.GetVPPToken(ctx, tok.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokID, tok.ID)
+	assert.Equal(t, dataToken.Location, tok.Location)
+	assert.Equal(t, dataToken.Token, tok.Token)
+	assert.Equal(t, orgName, tok.OrgName)
+	assert.Equal(t, location, tok.Location)
+	assert.NotNil(t, tok.Teams) // "All Teams" teams array is non-nil but empty
+	assert.Len(t, tok.Teams, 0)
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 1)
+	assert.Equal(t, dataToken.Location, toks[0].Location)
+	assert.Equal(t, dataToken.Token, toks[0].Token)
+	assert.Equal(t, orgName, toks[0].OrgName)
+	assert.Equal(t, location, toks[0].Location)
+	assert.NotNil(t, toks[0].Teams)
+	assert.Len(t, toks[0].Teams, 0)
+
+	teamTok, err = ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, tokID, teamTok.ID)
+	assert.Equal(t, dataToken.Location, teamTok.Location)
+	assert.Equal(t, dataToken.Token, teamTok.Token)
+	assert.Equal(t, orgName, teamTok.OrgName)
+	assert.Equal(t, location, teamTok.Location)
+	assert.NotNil(t, teamTok.Teams)
+	assert.Len(t, teamTok.Teams, 0)
+
+	teamTok, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokID, teamTok.ID)
+	assert.Equal(t, dataToken.Location, teamTok.Location)
+	assert.Equal(t, dataToken.Token, teamTok.Token)
+	assert.Equal(t, orgName, teamTok.OrgName)
+	assert.Equal(t, location, teamTok.Location)
+	assert.NotNil(t, teamTok.Teams)
+	assert.Len(t, teamTok.Teams, 0)
+
+	// Assign to team "No Team"
+	upTok, err = ds.UpdateVPPTokenTeams(ctx, tok.ID, []uint{0})
+	require.NoError(t, err)
+	assert.Len(t, upTok.Teams, 1)
+	assert.Equal(t, tokID, upTok.ID)
+	assert.Equal(t, uint(0), upTok.Teams[0].ID)
+	assert.Equal(t, fleet.TeamNameNoTeam, upTok.Teams[0].Name)
+
+	tok, err = ds.GetVPPToken(ctx, tok.ID)
+	assert.NoError(t, err)
+	assert.Len(t, tok.Teams, 1)
+	assert.Equal(t, tokID, tok.ID)
+	assert.Equal(t, uint(0), tok.Teams[0].ID)
+	assert.Equal(t, fleet.TeamNameNoTeam, tok.Teams[0].Name)
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 1)
+	assert.Len(t, toks[0].Teams, 1)
+	assert.Equal(t, tokID, toks[0].ID)
+	assert.Equal(t, uint(0), toks[0].Teams[0].ID)
+	assert.Equal(t, fleet.TeamNameNoTeam, toks[0].Teams[0].Name)
+
+	teamTok, err = ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, tokID, teamTok.ID)
+	assert.Equal(t, dataToken.Location, teamTok.Location)
+	assert.Equal(t, dataToken.Token, teamTok.Token)
+	assert.Equal(t, orgName, teamTok.OrgName)
+	assert.Equal(t, location, teamTok.Location)
+	assert.Len(t, teamTok.Teams, 1)
+	assert.Equal(t, uint(0), teamTok.Teams[0].ID)
+	assert.Equal(t, fleet.TeamNameNoTeam, teamTok.Teams[0].Name)
+
+	teamTok, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.Error(t, err)
+	assert.True(t, fleet.IsNotFound(err))
+
+	// Assign to normal team
+	upTok, err = ds.UpdateVPPTokenTeams(ctx, tok.ID, []uint{team.ID})
+	assert.NoError(t, err)
+	assert.Len(t, upTok.Teams, 1)
+	assert.Equal(t, team.ID, upTok.Teams[0].ID)
+	assert.Equal(t, team.Name, upTok.Teams[0].Name)
+
+	tok, err = ds.GetVPPToken(ctx, tok.ID)
+	assert.NoError(t, err)
+	assert.Len(t, tok.Teams, 1)
+	assert.Equal(t, team.ID, tok.Teams[0].ID)
+	assert.Equal(t, team.Name, tok.Teams[0].Name)
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 1)
+	assert.Len(t, toks[0].Teams, 1)
+	assert.Equal(t, team.ID, toks[0].Teams[0].ID)
+	assert.Equal(t, team.Name, toks[0].Teams[0].Name)
+
+	teamTok, err = ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.Error(t, err)
+	assert.True(t, fleet.IsNotFound(err))
+
+	teamTok, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokID, teamTok.ID)
+	assert.Equal(t, dataToken.Location, teamTok.Location)
+	assert.Equal(t, dataToken.Token, teamTok.Token)
+	assert.Equal(t, orgName, teamTok.OrgName)
+	assert.Equal(t, location, teamTok.Location)
+	assert.NotNil(t, teamTok.Teams)
+	assert.Len(t, teamTok.Teams, 1)
+	assert.Equal(t, team.ID, teamTok.Teams[0].ID)
+	assert.Equal(t, team.Name, teamTok.Teams[0].Name)
+
+	// Renew flow
+	upTok, err = ds.UpdateVPPToken(ctx, tokID, dataToken6)
+	assert.NoError(t, err)
+	assert.Equal(t, tokID, upTok.ID)
+	assert.Equal(t, dataToken6.Location, upTok.Location)
+	assert.Equal(t, dataToken6.Token, upTok.Token)
+	assert.Equal(t, orgName6, upTok.OrgName)
+	assert.Equal(t, location6, upTok.Location)
+	assert.NotNil(t, upTok.Teams)
+	assert.Len(t, upTok.Teams, 1)
+	assert.Equal(t, team.ID, upTok.Teams[0].ID)
+	assert.Equal(t, team.Name, upTok.Teams[0].Name)
+
+	tok, err = ds.GetVPPToken(ctx, tok.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokID, tok.ID)
+	assert.Equal(t, dataToken6.Location, tok.Location)
+	assert.Equal(t, dataToken6.Token, tok.Token)
+	assert.Equal(t, orgName6, tok.OrgName)
+	assert.Equal(t, location6, tok.Location)
+	assert.NotNil(t, tok.Teams)
+	assert.Len(t, tok.Teams, 1)
+	assert.Equal(t, team.ID, tok.Teams[0].ID)
+	assert.Equal(t, team.Name, tok.Teams[0].Name)
+
+	// Assign back to no team / disabled
+	upTok, err = ds.UpdateVPPTokenTeams(ctx, tokID, nil)
+	assert.NoError(t, err)
+	assert.Nil(t, upTok.Teams)
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 1)
+
+	teamTok, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.Error(t, err)
+	assert.True(t, fleet.IsNotFound(err))
+
+	teamTok, err = ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.Error(t, err)
+	assert.True(t, fleet.IsNotFound(err))
+
+	// Delete
+	err = ds.DeleteVPPToken(ctx, tokID)
+	assert.NoError(t, err)
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 0)
+
+	// Multiple tokens and constraints tests
+	tokNone, err := ds.InsertVPPToken(ctx, dataToken)
+	assert.NoError(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokNone.ID, nil)
+	assert.NoError(t, err)
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 1)
+
+	_, err = ds.InsertVPPToken(ctx, dataToken)
+	assert.Error(t, err)
+
+	tokAll, err := ds.InsertVPPToken(ctx, dataToken2)
+	assert.NoError(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokAll.ID, []uint{})
+	assert.NoError(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokAll.ID, []uint{})
+	assert.NoError(t, err)
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 2)
+
+	// Remove tokAll from All teams
+	tokAll, err = ds.UpdateVPPTokenTeams(ctx, tokAll.ID, nil)
+	assert.NoError(t, err)
+
+	tokTeam, err := ds.InsertVPPToken(ctx, dataToken3)
+	assert.NoError(t, err)
+
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokTeam.ID, []uint{team.ID})
+	assert.NoError(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokTeam.ID, []uint{team.ID, team.ID})
+	assert.Error(t, err)
+
+	// Cannot move tokAll to all teams now
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokAll.ID, []uint{})
+	assert.Error(t, err)
+
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokTeam.ID, []uint{0})
+	assert.NoError(t, err)
+
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokAll.ID, []uint{})
+	assert.Error(t, err)
+
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokTeam.ID, []uint{team.ID})
+	assert.NoError(t, err)
+
+	///
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 3)
+
+	tokTeams, err := ds.InsertVPPToken(ctx, dataToken4)
+	assert.NoError(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokTeams.ID, []uint{team.ID, team2.ID})
+	assert.Error(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokTeams.ID, []uint{team2.ID})
+	assert.NoError(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokTeams.ID, []uint{team.ID, team2.ID})
+	assert.Error(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokTeams.ID, []uint{team.ID, 0})
+	assert.Error(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokTeams.ID, []uint{team2.ID, 0})
+	assert.NoError(t, err)
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 4)
+
+	tokTeams, err = ds.GetVPPToken(ctx, tokTeams.ID)
+	assert.NoError(t, err)
+	assert.Len(t, tokTeams.Teams, 2)
+	assert.Contains(t, tokTeams.Teams, fleet.TeamTuple{ID: team2.ID, Name: team2.Name})
+	assert.Contains(t, tokTeams.Teams, fleet.TeamTuple{ID: 0, Name: fleet.TeamNameNoTeam})
+
+	tokBadConstraint, err := ds.InsertVPPToken(ctx, dataToken5)
+	assert.NoError(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokBadConstraint.ID, []uint{})
+	assert.Error(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokBadConstraint.ID, []uint{team.ID})
+	assert.Error(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokBadConstraint.ID, []uint{0})
+	assert.Error(t, err)
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 5)
+
+	///
+	tokNil, err := ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, tokTeams.ID, tokNil.ID)
+
+	tokTeam1, err := ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokTeam.ID, tokTeam1.ID)
+
+	tokTeam2, err := ds.GetVPPTokenByTeamID(ctx, &team2.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokTeam2.ID, tokTeam2.ID)
+	assert.Len(t, tokTeam2.Teams, 2)
+	assert.Contains(t, tokTeam2.Teams, fleet.TeamTuple{ID: team2.ID, Name: team2.Name})
+	assert.Contains(t, tokTeam2.Teams, fleet.TeamTuple{ID: 0, Name: fleet.TeamNameNoTeam})
+
+	////
+	err = ds.DeleteVPPToken(ctx, tokTeam.ID)
+	assert.NoError(t, err)
+
+	tokNil, err = ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, tokTeams.ID, tokNil.ID)
+
+	tokTeam1, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.Error(t, err)
+
+	tokTeam2, err = ds.GetVPPTokenByTeamID(ctx, &team2.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokTeams.ID, tokTeam2.ID)
+
+	////
+	err = ds.DeleteVPPToken(ctx, tokTeams.ID)
+	assert.NoError(t, err)
+
+	tokNil, err = ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.Error(t, err)
+	assert.True(t, fleet.IsNotFound(err))
+
+	tokTeam1, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.Error(t, err)
+	assert.True(t, fleet.IsNotFound(err))
+
+	tokTeam2, err = ds.GetVPPTokenByTeamID(ctx, &team2.ID)
+	assert.Error(t, err)
+	assert.True(t, fleet.IsNotFound(err))
+
+	////
+	tokAll, err = ds.UpdateVPPTokenTeams(ctx, tokAll.ID, []uint{})
+	assert.NoError(t, err)
+
+	tokNil, err = ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, tokAll.ID, tokNil.ID)
+
+	tokTeam1, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokAll.ID, tokTeam1.ID)
+
+	tokTeam2, err = ds.GetVPPTokenByTeamID(ctx, &team2.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokAll.ID, tokTeam2.ID)
+
+	err = ds.DeleteVPPToken(ctx, tokAll.ID)
+	assert.NoError(t, err)
+
+	////
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokNone.ID, []uint{0, team.ID, team2.ID})
+	assert.NoError(t, err)
+
+	tokNil, err = ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, tokNone.ID, tokNil.ID)
+
+	tokTeam1, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokNone.ID, tokTeam1.ID)
+
+	tokTeam2, err = ds.GetVPPTokenByTeamID(ctx, &team2.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokNone.ID, tokTeam2.ID)
+
+	////
+	err = ds.DeleteVPPToken(ctx, tokNone.ID)
+	assert.NoError(t, err)
+
+}
+
+func testVPPTokenAppTeamAssociations(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "Kritters"})
+	assert.NoError(t, err)
+
+	team2, err := ds.NewTeam(ctx, &fleet.Team{Name: "Zingers"})
+	assert.NoError(t, err)
+
+	dataToken, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), "Donkey Kong", "Jungle")
+	require.NoError(t, err)
+
+	dataToken2, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), "Diddy Kong", "Mines")
+	require.NoError(t, err)
+
+	tok1, err := ds.InsertVPPToken(ctx, dataToken)
+	assert.NoError(t, err)
+
+	tok2, err := ds.InsertVPPToken(ctx, dataToken2)
+	assert.NoError(t, err)
+
+	_, err = ds.UpdateVPPTokenTeams(ctx, tok1.ID, []uint{team1.ID})
+	assert.NoError(t, err)
+
+	_, err = ds.UpdateVPPTokenTeams(ctx, tok2.ID, []uint{team2.ID})
+	assert.NoError(t, err)
+
+	app1 := &fleet.VPPApp{
+		Name: "app1",
+		VPPAppTeam: fleet.VPPAppTeam{
+			VPPAppID: fleet.VPPAppID{
+				AdamID:   "1",
+				Platform: fleet.MacOSPlatform,
+			},
+		},
+		BundleIdentifier: "app1",
+	}
+	_, err = ds.InsertVPPAppWithTeam(ctx, app1, &team1.ID)
+	assert.NoError(t, err)
+	_, err = ds.InsertVPPAppWithTeam(ctx, app1, &team2.ID)
+	assert.NoError(t, err)
+
+	app2 := &fleet.VPPApp{
+		Name: "app2",
+		VPPAppTeam: fleet.VPPAppTeam{
+			VPPAppID: fleet.VPPAppID{
+				AdamID:   "2",
+				Platform: fleet.MacOSPlatform,
+			},
+		},
+		BundleIdentifier: "app2",
+	}
+	vppApp2, err := ds.InsertVPPAppWithTeam(ctx, app2, &team1.ID)
+	_ = vppApp2
+	assert.NoError(t, err)
+
+	// team1: token 1, app1, app2
+	// team2: token 2, app 1
+
+	apps, err := ds.GetAssignedVPPApps(ctx, &team1.ID)
+	assert.NoError(t, err)
+	assert.Len(t, apps, 2)
+	assert.Contains(t, apps, app1.VPPAppID)
+	assert.Contains(t, apps, app2.VPPAppID)
+
+	apps, err = ds.GetAssignedVPPApps(ctx, &team2.ID)
+	assert.NoError(t, err)
+	assert.Len(t, apps, 1)
+	assert.Contains(t, apps, app1.VPPAppID)
+
+	/// Try to move team 1 token to team 2
+
+	_, err = ds.UpdateVPPTokenTeams(ctx, tok1.ID, []uint{team2.ID})
+	assert.Error(t, err)
+
+	// team1: token 1, app1, app2
+	// team2: token 2, app 1
+
+	apps, err = ds.GetAssignedVPPApps(ctx, &team1.ID)
+	assert.NoError(t, err)
+	assert.Len(t, apps, 2)
+
+	apps, err = ds.GetAssignedVPPApps(ctx, &team2.ID)
+	assert.NoError(t, err)
+	assert.Len(t, apps, 1)
+	assert.Contains(t, apps, app1.VPPAppID)
+
+	_, err = ds.UpdateVPPTokenTeams(ctx, tok1.ID, nil)
+	assert.NoError(t, err)
+
+	// team1: no token, no apps
+	// team2: token 2, app 1
+
+	apps, err = ds.GetAssignedVPPApps(ctx, &team1.ID)
+	assert.NoError(t, err)
+	assert.Len(t, apps, 0)
+
+	apps, err = ds.GetAssignedVPPApps(ctx, &team2.ID)
+	assert.NoError(t, err)
+	assert.Len(t, apps, 1)
+	assert.Contains(t, apps, app1.VPPAppID)
+
+	// Move team 2 token to team 1
+
+	_, err = ds.UpdateVPPTokenTeams(ctx, tok2.ID, []uint{team1.ID})
+	assert.NoError(t, err)
+
+	// team1: token 2, app 1
+	// team2: no token, no apps
+
+	apps, err = ds.GetAssignedVPPApps(ctx, &team1.ID)
+	assert.NoError(t, err)
+	assert.Len(t, apps, 0)
+
+	apps, err = ds.GetAssignedVPPApps(ctx, &team2.ID)
+	assert.NoError(t, err)
+	assert.Len(t, apps, 0)
+
+	/// Can't assaign apps with no token
+
+	_, err = ds.InsertVPPAppWithTeam(ctx, app1, &team2.ID)
+	assert.Error(t, err)
+}
diff --git a/server/datastore/mysql/vulnerabilities.go b/server/datastore/mysql/vulnerabilities.go
index 6208fd6d926c..81a26ea58b0e 100644
--- a/server/datastore/mysql/vulnerabilities.go
+++ b/server/datastore/mysql/vulnerabilities.go
@@ -3,6 +3,7 @@ package mysql
 import (
 	"context"
 	"database/sql"
+	"errors"
 	"fmt"
 	"strings"
 	"time"
@@ -71,12 +72,12 @@ func (ds *Datastore) Vulnerability(ctx context.Context, cve string, teamID *uint
 	args = append(args, cve, cve)
 
 	if teamID != nil {
-		eeSelectStmt += " AND vhc.team_id = ?"
-		freeSelectStmt += " AND vhc.team_id = ?"
+		eeSelectStmt += " AND vhc.team_id = ? AND vhc.global_stats = 0"
+		freeSelectStmt += " AND vhc.team_id = ? AND vhc.global_stats = 0"
 		args = append(args, *teamID)
 	} else {
-		eeSelectStmt += " AND vhc.team_id = 0"
-		freeSelectStmt += " AND vhc.team_id = 0"
+		eeSelectStmt += " AND vhc.team_id = 0 AND vhc.global_stats = 1"
+		freeSelectStmt += " AND vhc.team_id = 0 AND vhc.global_stats = 1"
 	}
 
 	var selectStmt string
@@ -192,11 +193,14 @@ func (ds *Datastore) SoftwareByCVE(ctx context.Context, cve string, teamID *uint
 		`
 	args = append(args, cve)
 
-	if teamID != nil {
-		selectStmt += " AND shc.team_id = ?"
+	switch {
+	case teamID != nil && *teamID > 0:
+		selectStmt += " AND shc.team_id = ? AND shc.global_stats = 0"
 		args = append(args, *teamID)
-	} else {
-		selectStmt += " AND shc.team_id = 0"
+	case teamID != nil && *teamID == 0:
+		selectStmt += " AND shc.team_id = 0 AND shc.global_stats = 0"
+	case teamID == nil:
+		selectStmt += " AND shc.team_id = 0 AND shc.global_stats = 1"
 	}
 
 	err = sqlx.SelectContext(ctx, ds.reader(ctx), &vs, selectStmt, args...)
@@ -259,11 +263,11 @@ func (ds *Datastore) ListVulnerabilities(ctx context.Context, opt fleet.VulnList
 
 	// Prepare arguments for the query
 	var args []interface{}
-	if opt.TeamID == 0 {
-		selectStmt += " AND vhc.team_id = 0"
+	if opt.TeamID == nil {
+		selectStmt += " AND vhc.global_stats = 1"
 	} else {
-		selectStmt += " AND vhc.team_id = ?"
-		args = append(args, opt.TeamID)
+		selectStmt += " AND vhc.global_stats = 0 AND vhc.team_id = ?"
+		args = append(args, *opt.TeamID)
 	}
 
 	if opt.KnownExploit {
@@ -313,10 +317,10 @@ func (ds *Datastore) CountVulnerabilities(ctx context.Context, opt fleet.VulnLis
 		WHERE vhc.host_count > 0
 	`
 	var args []interface{}
-	if opt.TeamID == 0 {
-		selectStmt = selectStmt + " AND vhc.team_id = 0"
+	if opt.TeamID == nil {
+		selectStmt = selectStmt + " AND global_stats = 1"
 	} else {
-		selectStmt = selectStmt + " AND vhc.team_id = ?"
+		selectStmt = selectStmt + " AND global_stats = 0 AND vhc.team_id = ?"
 		args = append(args, opt.TeamID)
 	}
 
@@ -344,7 +348,7 @@ func (ds *Datastore) UpdateVulnerabilityHostCounts(ctx context.Context) error {
 	}
 
 	globalSelectStmt := `
-		SELECT 0 as team_id, cve, COUNT(*) AS host_count
+		SELECT 0 as team_id, 1 as global_stats, cve, COUNT(*) AS host_count
 		FROM (
 			SELECT sc.cve, hs.host_id
 			FROM software_cve sc
@@ -370,7 +374,7 @@ func (ds *Datastore) UpdateVulnerabilityHostCounts(ctx context.Context) error {
 	}
 
 	teamSelectStmt := `
-		SELECT h.team_id, combined_results.cve, COUNT(*) AS host_count
+		SELECT h.team_id, 0 as global_stats, combined_results.cve, COUNT(*) AS host_count
 		FROM (
 			SELECT hs.host_id, sc.cve
 			FROM software_cve sc
@@ -397,6 +401,34 @@ func (ds *Datastore) UpdateVulnerabilityHostCounts(ctx context.Context) error {
 		return ctxerr.Wrap(ctx, err, "inserting team vulnerability host counts")
 	}
 
+	noTeamSelectStmt := `
+		SELECT 0 as team_id, 0 as global_stats, cve, COUNT(*) AS host_count
+		FROM (
+			SELECT hs.host_id, sc.cve
+			FROM software_cve sc
+			INNER JOIN host_software hs ON sc.software_id = hs.software_id
+
+			UNION
+
+			SELECT hos.host_id, osv.cve
+			FROM operating_system_vulnerabilities osv
+			INNER JOIN host_operating_system hos ON hos.os_id = osv.operating_system_id
+		) AS combined_results
+		INNER JOIN hosts h ON combined_results.host_id = h.id
+		WHERE h.team_id IS NULL
+		GROUP BY cve
+	`
+
+	noTeamHostCounts, err := ds.fetchHostCounts(ctx, noTeamSelectStmt)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "fetching team vulnerability host counts")
+	}
+
+	err = ds.batchInsertHostCounts(ctx, noTeamHostCounts)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "inserting team vulnerability host counts")
+	}
+
 	err = ds.cleanupVulnerabilityHostCounts(ctx)
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "cleaning up vulnerability host counts")
@@ -406,9 +438,10 @@ func (ds *Datastore) UpdateVulnerabilityHostCounts(ctx context.Context) error {
 }
 
 type hostCount struct {
-	TeamID    uint   `db:"team_id"`
-	CVE       string `db:"cve"`
-	HostCount uint   `db:"host_count"`
+	TeamID      uint   `db:"team_id"`
+	CVE         string `db:"cve"`
+	HostCount   uint   `db:"host_count"`
+	GlobalStats bool   `db:"global_stats"`
 }
 
 func (ds *Datastore) cleanupVulnerabilityHostCounts(ctx context.Context) error {
@@ -434,7 +467,7 @@ func (ds *Datastore) batchInsertHostCounts(ctx context.Context, counts []hostCou
 		return nil
 	}
 
-	insertStmt := "INSERT INTO vulnerability_host_counts (team_id, cve, host_count) VALUES "
+	insertStmt := "INSERT INTO vulnerability_host_counts (team_id, cve, host_count, global_stats) VALUES "
 	var insertArgs []interface{}
 
 	chunkSize := 100
@@ -446,8 +479,8 @@ func (ds *Datastore) batchInsertHostCounts(ctx context.Context, counts []hostCou
 
 		valueStrings := make([]string, 0, chunkSize)
 		for _, count := range counts[i:end] {
-			valueStrings = append(valueStrings, "(?, ?, ?)")
-			insertArgs = append(insertArgs, count.TeamID, count.CVE, count.HostCount)
+			valueStrings = append(valueStrings, "(?, ?, ?, ?)")
+			insertArgs = append(insertArgs, count.TeamID, count.CVE, count.HostCount, count.GlobalStats)
 		}
 
 		insertStmt += strings.Join(valueStrings, ", ")
@@ -458,9 +491,18 @@ func (ds *Datastore) batchInsertHostCounts(ctx context.Context, counts []hostCou
 			return fmt.Errorf("inserting host counts: %w", err)
 		}
 
-		insertStmt = "INSERT INTO vulnerability_host_counts (team_id, cve, host_count) VALUES "
+		insertStmt = "INSERT INTO vulnerability_host_counts (team_id, cve, host_count, global_stats) VALUES "
 		insertArgs = nil
 	}
 
 	return nil
 }
+
+func (ds *Datastore) IsCVEKnownToFleet(ctx context.Context, cve string) (bool, error) {
+	var count uint
+	err := sqlx.GetContext(ctx, ds.reader(ctx), &count, "SELECT 1 FROM cve_meta WHERE cve = ?", cve)
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return false, err
+	}
+	return count > 0, nil
+}
diff --git a/server/datastore/mysql/vulnerabilities_test.go b/server/datastore/mysql/vulnerabilities_test.go
index e4571b28a785..f989951488b6 100644
--- a/server/datastore/mysql/vulnerabilities_test.go
+++ b/server/datastore/mysql/vulnerabilities_test.go
@@ -35,6 +35,7 @@ func TestVulnerabilities(t *testing.T) {
 
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
+			t.Helper()
 			defer TruncateTables(t, ds)
 			c.fn(t, ds)
 		})
@@ -50,14 +51,14 @@ func testListVulnerabilities(t *testing.T, ds *Datastore) {
 
 	// Insert Host Count
 	insertStmt := `
-		INSERT INTO vulnerability_host_counts (cve, team_id, host_count)
-		VALUES (?, ?, ?)
+		INSERT INTO vulnerability_host_counts (cve, team_id, host_count, global_stats)
+		VALUES (?, ?, ?, ?)
 	`
-	_, err = ds.writer(context.Background()).Exec(insertStmt, "CVE-2020-1234", 0, 10)
+	_, err = ds.writer(context.Background()).Exec(insertStmt, "CVE-2020-1234", 0, 10, 1)
 	require.NoError(t, err)
-	_, err = ds.writer(context.Background()).Exec(insertStmt, "CVE-2020-1235", 0, 15)
+	_, err = ds.writer(context.Background()).Exec(insertStmt, "CVE-2020-1235", 0, 15, 1)
 	require.NoError(t, err)
-	_, err = ds.writer(context.Background()).Exec(insertStmt, "CVE-2020-1236", 0, 20)
+	_, err = ds.writer(context.Background()).Exec(insertStmt, "CVE-2020-1236", 0, 20, 1)
 	require.NoError(t, err)
 
 	// No Vulns unless OS or Software Vulns are inserted
@@ -174,12 +175,13 @@ func testVulnerabilityWithOS(t *testing.T, ds *Datastore) {
 
 	// Insert Host Count
 	insertStmt := `
-		INSERT INTO vulnerability_host_counts (cve, team_id, host_count)
-		VALUES (?, ?, ?), (?, ?, ?)
+		INSERT INTO vulnerability_host_counts (cve, team_id, host_count, global_stats)
+		VALUES (?, ?, ?, ?), (?, ?, ?, ?), (?, ?, ?, ?)
 	`
 	_, err = ds.writer(context.Background()).Exec(insertStmt,
-		"CVE-2020-1234", 0, 10,
-		"CVE-2020-1234", 1, 4,
+		"CVE-2020-1234", 0, 10, 1, // global
+		"CVE-2020-1234", 1, 4, 0, // team 1
+		"CVE-2020-1234", 0, 6, 0, // no team
 	)
 	require.NoError(t, err)
 
@@ -229,6 +231,14 @@ func testVulnerabilityWithOS(t *testing.T, ds *Datastore) {
 	require.Equal(t, expected.HostsCount, v.HostsCount)
 	require.Equal(t, expected.Source, v.Source)
 
+	// No Team
+	expected.HostsCount = 6
+	v, err = ds.Vulnerability(ctx, "CVE-2020-1234", ptr.Uint(0), false)
+	require.NoError(t, err)
+	require.Equal(t, expected.CVE, v.CVE)
+	require.Equal(t, expected.HostsCount, v.HostsCount)
+	require.Equal(t, expected.Source, v.Source)
+
 	expected = fleet.VulnerabilityWithMetadata{
 		CVE: fleet.CVE{
 			CVE:              "CVE-2020-1234",
@@ -262,11 +272,15 @@ func testVulnerabilityWithSoftware(t *testing.T, ds *Datastore) {
 
 	// Insert Host Count
 	insertStmt := `
-		INSERT INTO vulnerability_host_counts (cve, team_id, host_count)
-		VALUES (?, ?, ?)
+		INSERT INTO vulnerability_host_counts (cve, team_id, host_count, global_stats)
+		VALUES (?, ?, ?, ?)
 	`
 
-	_, err = ds.writer(context.Background()).Exec(insertStmt, "CVE-2020-1234", 0, 10)
+	_, err = ds.writer(context.Background()).Exec(insertStmt, "CVE-2020-1234", 0, 10, 1)
+	require.NoError(t, err)
+	_, err = ds.writer(context.Background()).Exec(insertStmt, "CVE-2020-1234", 1, 4, 0)
+	require.NoError(t, err)
+	_, err = ds.writer(context.Background()).Exec(insertStmt, "CVE-2020-1234", 0, 6, 0)
 	require.NoError(t, err)
 
 	// insert Software Vuln
@@ -298,12 +312,29 @@ func testVulnerabilityWithSoftware(t *testing.T, ds *Datastore) {
 		Source:     fleet.NVDSource,
 	}
 
+	// Global (all teams)
 	v, err = ds.Vulnerability(ctx, "CVE-2020-1234", nil, false)
 	require.NoError(t, err)
 	require.Equal(t, expected.CVE, v.CVE)
 	require.Equal(t, expected.HostsCount, v.HostsCount)
 	require.Equal(t, expected.Source, v.Source)
 
+	// Team 1
+	expected.HostsCount = 4
+	v, err = ds.Vulnerability(ctx, "CVE-2020-1234", ptr.Uint(1), false)
+	require.NoError(t, err)
+	require.Equal(t, expected.CVE, v.CVE)
+	require.Equal(t, expected.HostsCount, v.HostsCount)
+	require.Equal(t, expected.Source, v.Source)
+
+	// No Team
+	expected.HostsCount = 6
+	v, err = ds.Vulnerability(ctx, "CVE-2020-1234", ptr.Uint(0), false)
+	require.NoError(t, err)
+	require.Equal(t, expected.CVE, v.CVE)
+	require.Equal(t, expected.HostsCount, v.HostsCount)
+	require.Equal(t, expected.Source, v.Source)
+
 	// With CVSSScores
 	expected = fleet.VulnerabilityWithMetadata{
 		CVE: fleet.CVE{
@@ -354,8 +385,11 @@ func testVulnerabilitiesPagination(t *testing.T, ds *Datastore) {
 func testVulnerabilitiesTeamFilter(t *testing.T, ds *Datastore) {
 	seedVulnerabilities(t, ds)
 
+	//
+	// Team 1
+	//
 	opts := fleet.VulnListOptions{
-		TeamID: 1,
+		TeamID: ptr.Uint(1),
 	}
 
 	list, _, err := ds.ListVulnerabilities(context.Background(), opts)
@@ -375,6 +409,55 @@ func testVulnerabilitiesTeamFilter(t *testing.T, ds *Datastore) {
 	for _, vuln := range list {
 		require.Equal(t, checkCounts[vuln.CVE.CVE], int(vuln.HostsCount), vuln.CVE)
 	}
+
+	//
+	// Team 0 (no team)
+	//
+	opts = fleet.VulnListOptions{
+		TeamID: ptr.Uint(0),
+	}
+
+	list, _, err = ds.ListVulnerabilities(context.Background(), opts)
+	require.NoError(t, err)
+	require.Len(t, list, 6)
+
+	checkCounts = map[string]int{
+		"CVE-2020-1234": 80,
+		"CVE-2020-1235": 71,
+		"CVE-2020-1236": 62,
+		"CVE-2020-1238": 44,
+		"CVE-2020-1239": 35,
+		// No team host counts for CVE-2020-1240
+		"CVE-2020-1241": 26,
+	}
+
+	for _, vuln := range list {
+		require.Equal(t, checkCounts[vuln.CVE.CVE], int(vuln.HostsCount), vuln.CVE)
+	}
+
+	//
+	// Global (all teams)
+	//
+	opts = fleet.VulnListOptions{}
+
+	list, _, err = ds.ListVulnerabilities(context.Background(), opts)
+	require.NoError(t, err)
+	require.Len(t, list, 7)
+
+	checkCounts = map[string]int{
+		"CVE-2020-1234": 100,
+		"CVE-2020-1235": 90,
+		"CVE-2020-1236": 80,
+		"CVE-2020-1237": 70,
+		"CVE-2020-1238": 60,
+		"CVE-2020-1239": 50,
+		// No team host counts for CVE-2020-1240
+		"CVE-2020-1241": 40,
+	}
+
+	for _, vuln := range list {
+		require.Equal(t, checkCounts[vuln.CVE.CVE], int(vuln.HostsCount), vuln.CVE)
+	}
 }
 
 func testListVulnerabilitiesSort(t *testing.T, ds *Datastore) {
@@ -459,22 +542,22 @@ func testCountVulnerabilities(t *testing.T, ds *Datastore) {
 	require.Equal(t, uint(1), count)
 
 	// team count
-	count, err = ds.CountVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: 1})
+	count, err = ds.CountVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: ptr.Uint(1)})
 	require.NoError(t, err)
 	require.Equal(t, uint(6), count)
 
 	// team count with exploit filter
-	count, err = ds.CountVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: 1, KnownExploit: true})
+	count, err = ds.CountVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: ptr.Uint(1), KnownExploit: true})
 	require.NoError(t, err)
 	require.Equal(t, uint(3), count)
 
 	// team count with match query
-	count, err = ds.CountVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: 1, ListOptions: fleet.ListOptions{MatchQuery: "2020-1234"}})
+	count, err = ds.CountVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: ptr.Uint(1), ListOptions: fleet.ListOptions{MatchQuery: "2020-1234"}})
 	require.NoError(t, err)
 	require.Equal(t, uint(1), count)
 
 	// team count with exploit filter and match query
-	count, err = ds.CountVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: 1, KnownExploit: true, ListOptions: fleet.ListOptions{MatchQuery: "2020-1234"}})
+	count, err = ds.CountVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: ptr.Uint(1), KnownExploit: true, ListOptions: fleet.ListOptions{MatchQuery: "2020-1234"}})
 	require.NoError(t, err)
 	require.Equal(t, uint(1), count)
 }
@@ -608,8 +691,8 @@ func testInsertVulnerabilityCounts(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	assertHostCounts(t, globalExpected, list)
 
-	// assert team counts
-	list, _, err = ds.ListVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: team1.ID})
+	// assert team 1 counts
+	list, _, err = ds.ListVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: ptr.Uint(team1.ID)})
 	require.NoError(t, err)
 	team1expected := []hostCount{
 		{CVE: "CVE-2020-1234", HostCount: 1}, // windows vuln
@@ -617,6 +700,15 @@ func testInsertVulnerabilityCounts(t *testing.T, ds *Datastore) {
 	}
 	assertHostCounts(t, team1expected, list)
 
+	// assert no team (team 0) counts
+	list, _, err = ds.ListVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: ptr.Uint(0)})
+	require.NoError(t, err)
+	team0expected := []hostCount{
+		{CVE: "CVE-2020-1234", HostCount: 1}, // windows vuln
+		{CVE: "CVE-2020-1235", HostCount: 1}, // macos vuln
+	}
+	assertHostCounts(t, team0expected, list)
+
 	// add 5 macos hosts (4-9) to team2
 	team2, err := ds.NewTeam(context.Background(), &fleet.Team{Name: "team2"})
 	require.NoError(t, err)
@@ -642,12 +734,17 @@ func testInsertVulnerabilityCounts(t *testing.T, ds *Datastore) {
 	assertHostCounts(t, globalExpected, list)
 
 	// team1 counts should not change
-	list, _, err = ds.ListVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: team1.ID})
+	list, _, err = ds.ListVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: ptr.Uint(team1.ID)})
 	require.NoError(t, err)
 	assertHostCounts(t, team1expected, list)
 
+	// team0 counts should not change
+	list, _, err = ds.ListVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: ptr.Uint(0)})
+	require.NoError(t, err)
+	assertHostCounts(t, team0expected, list)
+
 	// team2 counts
-	list, _, err = ds.ListVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: team2.ID})
+	list, _, err = ds.ListVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: ptr.Uint(team2.ID)})
 	require.NoError(t, err)
 	team2expected := []hostCount{
 		{CVE: "CVE-2020-1235", HostCount: 5}, // macos vuln
@@ -670,12 +767,17 @@ func testInsertVulnerabilityCounts(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 
 	// no change to team1 counts
-	list, _, err = ds.ListVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: team1.ID})
+	list, _, err = ds.ListVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: ptr.Uint(team1.ID)})
 	require.NoError(t, err)
 	assertHostCounts(t, team1expected, list)
 
+	// no change to team0 counts
+	list, _, err = ds.ListVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: ptr.Uint(0)})
+	require.NoError(t, err)
+	assertHostCounts(t, team0expected, list)
+
 	// no vulns in team2
-	list, _, err = ds.ListVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: team2.ID})
+	list, _, err = ds.ListVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: ptr.Uint(team2.ID)})
 	require.NoError(t, err)
 	require.Len(t, list, 0)
 
@@ -789,7 +891,7 @@ func testVulnerabilityHostCountBatchInserts(t *testing.T, ds *Datastore) {
 	}
 
 	// assert team counts
-	list, _, err = ds.ListVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: team1.ID})
+	list, _, err = ds.ListVulnerabilities(context.Background(), fleet.VulnListOptions{TeamID: ptr.Uint(team1.ID)})
 	require.NoError(t, err)
 	require.Len(t, list, 400)
 	for _, vuln := range list {
@@ -848,7 +950,7 @@ func testSoftwareByCVE(t *testing.T, ds *Datastore) {
 		Name:              "Chrome",
 		Version:           "1.0.0",
 		Source:            "programs",
-		HostsCount:        5,
+		HostsCount:        6,
 		GenerateCPE:       "cpe:2.3:a:google:chrome:1.0.0:*:*:*:*:*:*:*:*",
 		ResolvedInVersion: ptr.String("1.0.0"),
 	}
@@ -869,6 +971,13 @@ func testSoftwareByCVE(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	require.Len(t, software, 1)
 	require.Equal(t, expected, software[0])
+
+	// team 0
+	expected.HostsCount = 1
+	software, _, err = ds.SoftwareByCVE(context.Background(), "CVE-2020-1234", ptr.Uint(0))
+	require.NoError(t, err)
+	require.Len(t, software, 1)
+	require.Equal(t, expected, software[0])
 }
 
 func assertHostCounts(t *testing.T, expected []hostCount, actual []fleet.VulnerabilityWithMetadata) {
@@ -890,7 +999,7 @@ func seedVulnerabilities(t *testing.T, ds *Datastore) {
 		hostids = append(hostids, host.ID)
 	}
 
-	// update 15 hosts to windows
+	// update 10 hosts to windows
 	for i := 0; i < 10; i++ {
 		arch := "arm64"
 		if i%2 == 0 {
@@ -942,15 +1051,19 @@ func seedVulnerabilities(t *testing.T, ds *Datastore) {
 	// State:
 	// 10 global windows hosts
 	// 5 global macOS hosts
+	// 3 windows hosts in no team
 	// 4 windows hosts in team 1
 	// 3 windows hosts in team 2
+	// 4 macOS hosts in no team
 	// 1 macOS host in team 2
 
-	// add software to 5 windows hosts
+	// add software to 6 windows hosts
 	// affects:
 	// 5 global windows hosts
 	// 4 windows hosts in team 1
 	// 1 windows host in team 2
+	// 1 host in no team
+
 	for i := 0; i < 5; i++ {
 		_, err = ds.UpdateHostSoftware(context.Background(), hostids[i], []fleet.Software{
 			{
@@ -962,6 +1075,16 @@ func seedVulnerabilities(t *testing.T, ds *Datastore) {
 		require.NoError(t, err)
 	}
 
+	// add software to 1 windows host in no team
+	_, err = ds.UpdateHostSoftware(context.Background(), hostids[7], []fleet.Software{
+		{
+			Name:    "Chrome",
+			Version: "1.0.0",
+			Source:  "programs",
+		},
+	})
+	require.NoError(t, err)
+
 	_, err = ds.UpsertSoftwareCPEs(context.Background(), []fleet.SoftwareCPE{
 		{
 			SoftwareID: 1,
@@ -1095,14 +1218,16 @@ func seedVulnerabilities(t *testing.T, ds *Datastore) {
 	}
 
 	vulnHostCount := []struct {
-		cve       string
-		teamID    uint
-		hostCount int
+		cve         string
+		teamID      uint
+		globalstats bool
+		hostCount   int
 	}{
 		{
-			cve:       "CVE-2020-1234",
-			teamID:    0,
-			hostCount: 100,
+			cve:         "CVE-2020-1234",
+			teamID:      0,
+			globalstats: true,
+			hostCount:   100,
 		},
 		{
 			cve:       "CVE-2020-1234",
@@ -1110,9 +1235,16 @@ func seedVulnerabilities(t *testing.T, ds *Datastore) {
 			hostCount: 20,
 		},
 		{
-			cve:       "CVE-2020-1235",
+			// no team
+			cve:       "CVE-2020-1234",
 			teamID:    0,
-			hostCount: 90,
+			hostCount: 80,
+		},
+		{
+			cve:         "CVE-2020-1235",
+			teamID:      0,
+			globalstats: true,
+			hostCount:   90,
 		},
 		{
 			cve:       "CVE-2020-1235",
@@ -1120,9 +1252,16 @@ func seedVulnerabilities(t *testing.T, ds *Datastore) {
 			hostCount: 19,
 		},
 		{
-			cve:       "CVE-2020-1236",
+			// no team
+			cve:       "CVE-2020-1235",
 			teamID:    0,
-			hostCount: 80,
+			hostCount: 71,
+		},
+		{
+			cve:         "CVE-2020-1236",
+			teamID:      0,
+			globalstats: true,
+			hostCount:   80,
 		},
 		{
 			cve:       "CVE-2020-1236",
@@ -1130,15 +1269,23 @@ func seedVulnerabilities(t *testing.T, ds *Datastore) {
 			hostCount: 18,
 		},
 		{
-			cve:       "CVE-2020-1237",
+			// no team
+			cve:       "CVE-2020-1236",
 			teamID:    0,
-			hostCount: 70,
+			hostCount: 62,
+		},
+		{
+			cve:         "CVE-2020-1237",
+			teamID:      0,
+			globalstats: true,
+			hostCount:   70,
 		},
 		// no team 1 host count for CVE-2020-1237
 		{
-			cve:       "CVE-2020-1238",
-			teamID:    0,
-			hostCount: 60,
+			cve:         "CVE-2020-1238",
+			teamID:      0,
+			globalstats: true,
+			hostCount:   60,
 		},
 		{
 			cve:       "CVE-2020-1238",
@@ -1146,26 +1293,46 @@ func seedVulnerabilities(t *testing.T, ds *Datastore) {
 			hostCount: 16,
 		},
 		{
-			cve:       "CVE-2020-1239",
+			// no team
+			cve:       "CVE-2020-1238",
 			teamID:    0,
-			hostCount: 50,
+			hostCount: 44,
+		},
+		{
+			cve:         "CVE-2020-1239",
+			teamID:      0,
+			globalstats: true,
+			hostCount:   50,
 		},
 		{
 			cve:       "CVE-2020-1239",
 			teamID:    1,
 			hostCount: 15,
 		},
-		// no host counts for CVE-2020-1240
 		{
-			cve:       "CVE-2020-1241",
+			// no team
+			cve:       "CVE-2020-1239",
 			teamID:    0,
-			hostCount: 40,
+			hostCount: 35,
+		},
+		// no host counts for CVE-2020-1240
+		{
+			cve:         "CVE-2020-1241",
+			teamID:      0,
+			globalstats: true,
+			hostCount:   40,
 		},
 		{
 			cve:       "CVE-2020-1241",
 			teamID:    1,
 			hostCount: 14,
 		},
+		{
+			// no team
+			cve:       "CVE-2020-1241",
+			teamID:    0,
+			hostCount: 26,
+		},
 	}
 
 	// Insert OS Vuln
@@ -1184,11 +1351,11 @@ func seedVulnerabilities(t *testing.T, ds *Datastore) {
 
 	// Insert Host Count
 	insertStmt := `
-		INSERT INTO vulnerability_host_counts (cve, team_id, host_count)
-		VALUES (?, ?, ?)
+		INSERT INTO vulnerability_host_counts (cve, team_id, host_count, global_stats)
+		VALUES (?, ?, ?, ?)
 	`
 	for _, vuln := range vulnHostCount {
-		_, err = ds.writer(context.Background()).Exec(insertStmt, vuln.cve, vuln.teamID, vuln.hostCount)
+		_, err = ds.writer(context.Background()).Exec(insertStmt, vuln.cve, vuln.teamID, vuln.hostCount, vuln.globalstats)
 		require.NoError(t, err)
 	}
 }
diff --git a/server/datastore/s3/bootstrap_package.go b/server/datastore/s3/bootstrap_package.go
new file mode 100644
index 000000000000..28a41f51efd9
--- /dev/null
+++ b/server/datastore/s3/bootstrap_package.go
@@ -0,0 +1,25 @@
+package s3
+
+import "github.com/fleetdm/fleet/v4/server/config"
+
+const bootstrapPackagePrefix = "bootstrap-packages"
+
+type BootstrapPackageStore struct {
+	*commonFileStore
+}
+
+// NewBootstrapPackageStore creates a new instance with the given S3 config.
+func NewBootstrapPackageStore(config config.S3Config) (*BootstrapPackageStore, error) {
+	// bootstrap packages use the same S3 config as software installers
+	s3store, err := newS3store(config.SoftwareInstallersToInternalCfg())
+	if err != nil {
+		return nil, err
+	}
+	return &BootstrapPackageStore{
+		&commonFileStore{
+			s3store:    s3store,
+			pathPrefix: bootstrapPackagePrefix,
+			fileLabel:  "bootstrap package",
+		},
+	}, nil
+}
diff --git a/server/datastore/s3/bootstrap_package_test.go b/server/datastore/s3/bootstrap_package_test.go
new file mode 100644
index 000000000000..11c4b1fe61ee
--- /dev/null
+++ b/server/datastore/s3/bootstrap_package_test.go
@@ -0,0 +1,149 @@
+package s3
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"path"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBootstrapPackage(t *testing.T) {
+	ctx := context.Background()
+	store := SetupTestBootstrapPackageStore(t, "bootstrap-packages-unit-test", "prefix")
+
+	// get a non-existing package
+	blob, length, err := store.Get(ctx, "no-such-package")
+	require.Error(t, err)
+	require.True(t, fleet.IsNotFound(err))
+	require.Nil(t, blob)
+	require.Zero(t, length)
+
+	exists, err := store.Exists(ctx, "no-such-package")
+	require.NoError(t, err)
+	require.False(t, exists)
+
+	createPackageAndHash := func() ([]byte, string) {
+		b := make([]byte, 1024)
+		_, err = rand.Read(b)
+		require.NoError(t, err)
+
+		h := sha256.New()
+		_, err = h.Write(b)
+		require.NoError(t, err)
+		fileID := hex.EncodeToString(h.Sum(nil))
+
+		return b, fileID
+	}
+
+	getAndCheck := func(fileID string, expected []byte) {
+		rc, sz, err := store.Get(ctx, fileID)
+		require.NoError(t, err)
+		require.EqualValues(t, len(expected), sz)
+		defer rc.Close()
+
+		got, err := io.ReadAll(rc)
+		require.NoError(t, err)
+		require.Equal(t, expected, got)
+
+		exists, err := store.Exists(ctx, fileID)
+		require.NoError(t, err)
+		require.True(t, exists)
+	}
+
+	// store a package
+	b0, id0 := createPackageAndHash()
+	err = store.Put(ctx, id0, bytes.NewReader(b0))
+	require.NoError(t, err)
+
+	// read it back, it should match
+	getAndCheck(id0, b0)
+
+	// store another one
+	b1, id1 := createPackageAndHash()
+	err = store.Put(ctx, id1, bytes.NewReader(b1))
+	require.NoError(t, err)
+
+	// read it back, it should match
+	getAndCheck(id1, b1)
+
+	// replace the first one
+	err = store.Put(ctx, id0, bytes.NewReader(b0))
+	require.NoError(t, err)
+
+	// read it back, it should still match
+	getAndCheck(id0, b0)
+}
+
+func TestBootstrapPackageCleanup(t *testing.T) {
+	ctx := context.Background()
+	store := SetupTestBootstrapPackageStore(t, "bootstrap-packages-unit-test", "prefix")
+
+	assertExisting := func(want []string) {
+		prefix := path.Join(store.prefix, bootstrapPackagePrefix)
+		page, err := store.s3client.ListObjectsV2(&s3.ListObjectsV2Input{
+			Bucket: &store.bucket,
+			Prefix: &prefix,
+		})
+		require.NoError(t, err)
+
+		got := make([]string, 0, len(page.Contents))
+		for _, item := range page.Contents {
+			got = append(got, path.Base(*item.Key))
+		}
+		require.ElementsMatch(t, want, got)
+	}
+
+	// cleanup an empty store
+	n, err := store.Cleanup(ctx, nil, time.Now())
+	require.NoError(t, err)
+	require.Equal(t, 0, n)
+
+	// put a package
+	ins0 := uuid.NewString()
+	err = store.Put(ctx, ins0, bytes.NewReader([]byte("package0")))
+	require.NoError(t, err)
+
+	// cleanup but mark it as used
+	n, err = store.Cleanup(ctx, []string{ins0}, time.Now())
+	require.NoError(t, err)
+	require.Equal(t, 0, n)
+
+	assertExisting([]string{ins0})
+
+	// cleanup but mark it as unused
+	n, err = store.Cleanup(ctx, []string{}, time.Now())
+	require.NoError(t, err)
+	require.Equal(t, 1, n)
+
+	assertExisting(nil)
+
+	// put a few packages
+	packages := []string{uuid.NewString(), uuid.NewString(), uuid.NewString(), uuid.NewString()}
+	for i, ins := range packages {
+		err = store.Put(ctx, ins, bytes.NewReader([]byte("package"+fmt.Sprint(i))))
+		require.NoError(t, err)
+	}
+
+	// cleanup with a time in the past, nothing gets removed
+	n, err = store.Cleanup(ctx, []string{}, time.Now().Add(-time.Minute))
+	require.NoError(t, err)
+	require.Equal(t, 0, n)
+	assertExisting([]string{packages[0], packages[1], packages[2], packages[3]})
+
+	// cleanup in the future, all unused get removed
+	n, err = store.Cleanup(ctx, []string{packages[0], packages[2]}, time.Now().Add(time.Minute))
+	require.NoError(t, err)
+	require.Equal(t, 2, n)
+	assertExisting([]string{packages[0], packages[2]})
+}
diff --git a/server/datastore/s3/common_file_store.go b/server/datastore/s3/common_file_store.go
new file mode 100644
index 000000000000..2a37c741a35b
--- /dev/null
+++ b/server/datastore/s3/common_file_store.go
@@ -0,0 +1,140 @@
+package s3
+
+import (
+	"context"
+	"errors"
+	"io"
+	"path"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
+)
+
+// commonFileStore implements the common Get, Put, Exists and Cleanup
+// operations typical for storage of files in the SoftwareInstallers S3 bucket
+// configuration. It is used by the SoftwareInstallerStore and the
+// BootstrapPackageStore. The only variable thing is the path prefix inside
+// the configured bucket, e.g. for software installers it is:
+//
+//	<bucket>/<prefix>/software-installers/<fileID>
+//
+// and for the bootstrap packages it is:
+//
+//	<bucket>/<prefix>/bootstrap-packages/<fileID>
+type commonFileStore struct {
+	*s3store
+	pathPrefix string
+	fileLabel  string // how to call the file in error messages
+}
+
+// Get retrieves the requested file from S3.
+// It is important that the caller closes the reader when done.
+func (s *commonFileStore) Get(ctx context.Context, fileID string) (io.ReadCloser, int64, error) {
+	key := s.keyForFile(fileID)
+
+	req, err := s.s3client.GetObject(&s3.GetObjectInput{Bucket: &s.bucket, Key: &key})
+	if err != nil {
+		if aerr, ok := err.(awserr.Error); ok {
+			switch aerr.Code() {
+			case s3.ErrCodeNoSuchKey, s3.ErrCodeNoSuchBucket, "NotFound":
+				return nil, int64(0), installerNotFoundError{}
+			}
+		}
+		return nil, int64(0), ctxerr.Wrapf(ctx, err, "retrieving %s from S3 store", s.fileLabel)
+	}
+	return req.Body, *req.ContentLength, nil
+}
+
+// Put uploads a file to S3.
+func (s *commonFileStore) Put(ctx context.Context, fileID string, content io.ReadSeeker) error {
+	if fileID == "" {
+		return errors.New("S3 file identifier is empty")
+	}
+
+	key := s.keyForFile(fileID)
+	_, err := s.s3client.PutObject(&s3.PutObjectInput{
+		Bucket: &s.bucket,
+		Body:   content,
+		Key:    &key,
+	})
+	return err
+}
+
+// Exists checks if a file exists in the S3 bucket for the ID.
+func (s *commonFileStore) Exists(ctx context.Context, fileID string) (bool, error) {
+	key := s.keyForFile(fileID)
+
+	_, err := s.s3client.HeadObject(&s3.HeadObjectInput{Bucket: &s.bucket, Key: &key})
+	if err != nil {
+		if aerr, ok := err.(awserr.Error); ok {
+			switch aerr.Code() {
+			case s3.ErrCodeNoSuchKey, s3.ErrCodeNoSuchBucket, "NotFound":
+				return false, nil
+			}
+		}
+		return false, ctxerr.Wrapf(ctx, err, "checking existence of %s in S3 store", s.fileLabel)
+	}
+	return true, nil
+}
+
+func (s *commonFileStore) Cleanup(ctx context.Context, usedFileIDs []string, removeCreatedBefore time.Time) (int, error) {
+	removeCreatedBefore = removeCreatedBefore.UTC()
+
+	usedSet := make(map[string]struct{}, len(usedFileIDs))
+	for _, id := range usedFileIDs {
+		usedSet[id] = struct{}{}
+	}
+
+	// ListObjectsV2 defaults to a max of 1000 keys, which is sufficient for the
+	// cleanup task - if more files are present, the next run will get another
+	// 1000 and will periodically complete the cleanups.
+	//
+	// Iterating over all pages would potentially take a long time and would make
+	// it more likely that a conflict arises, where an unused file becomes used
+	// again. This approach makes it only two API requests between the read of
+	// used files and the deletions.
+	prefix := path.Join(s.prefix, s.pathPrefix)
+	page, err := s.s3client.ListObjectsV2(&s3.ListObjectsV2Input{
+		Bucket: &s.bucket,
+		Prefix: &prefix,
+	})
+	if err != nil {
+		return 0, ctxerr.Wrapf(ctx, err, "listing %s in S3 store", s.fileLabel)
+	}
+
+	// NOTE: there is an inherent risk that we could delete files that were added
+	// between the query to list used IDs and now. We minimize that risk by
+	// checking that the S3 file was created before removeCreatedBefore.
+	var toDeleteKeys []*s3.ObjectIdentifier
+	for _, item := range page.Contents {
+		if item.Key == nil {
+			continue
+		}
+		if _, ok := usedSet[path.Base(*item.Key)]; ok {
+			continue
+		}
+		if item.LastModified == nil || !item.LastModified.UTC().After(removeCreatedBefore) {
+			// default to doing the cleanup if we don't have the timestamp information
+			toDeleteKeys = append(toDeleteKeys, &s3.ObjectIdentifier{Key: item.Key})
+		}
+	}
+
+	if len(toDeleteKeys) == 0 {
+		return 0, nil
+	}
+
+	res, err := s.s3client.DeleteObjects(&s3.DeleteObjectsInput{
+		Bucket: &s.bucket,
+		Delete: &s3.Delete{
+			Objects: toDeleteKeys,
+		},
+	})
+	return len(res.Deleted), ctxerr.Wrapf(ctx, err, "deleting %s in S3 store", s.fileLabel)
+}
+
+// keyForFile builds an S3 key to identify the file.
+func (s *commonFileStore) keyForFile(fileID string) string {
+	return path.Join(s.prefix, s.pathPrefix, fileID)
+}
diff --git a/server/datastore/s3/software_installer.go b/server/datastore/s3/software_installer.go
index 5b33d10127ae..03b390a5c1c5 100644
--- a/server/datastore/s3/software_installer.go
+++ b/server/datastore/s3/software_installer.go
@@ -1,22 +1,13 @@
 package s3
 
 import (
-	"context"
-	"io"
-	"path"
-
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/fleetdm/fleet/v4/server/config"
-	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 )
 
 const softwareInstallersPrefix = "software-installers"
 
-// SoftwareInstallerStore implements the fleet.SoftwareInstallerStore to store
-// and retrieve software installers from S3.
 type SoftwareInstallerStore struct {
-	*s3store
+	*commonFileStore
 }
 
 // NewSoftwareInstallerStore creates a new instance with the given S3 config.
@@ -25,103 +16,11 @@ func NewSoftwareInstallerStore(config config.S3Config) (*SoftwareInstallerStore,
 	if err != nil {
 		return nil, err
 	}
-	return &SoftwareInstallerStore{s3store}, nil
-}
-
-// Get retrieves the requested software installer from S3.
-// It is important that the caller closes the reader when done.
-func (i *SoftwareInstallerStore) Get(ctx context.Context, installerID string) (io.ReadCloser, int64, error) {
-	key := i.keyForInstaller(installerID)
-
-	req, err := i.s3client.GetObject(&s3.GetObjectInput{Bucket: &i.bucket, Key: &key})
-	if err != nil {
-		if aerr, ok := err.(awserr.Error); ok {
-			switch aerr.Code() {
-			case s3.ErrCodeNoSuchKey, s3.ErrCodeNoSuchBucket, "NotFound":
-				return nil, int64(0), installerNotFoundError{}
-			}
-		}
-		return nil, int64(0), ctxerr.Wrap(ctx, err, "retrieving software installer from S3 store")
-	}
-	return req.Body, *req.ContentLength, nil
-}
-
-// Put uploads a software installer to S3.
-func (i *SoftwareInstallerStore) Put(ctx context.Context, installerID string, content io.ReadSeeker) error {
-	key := i.keyForInstaller(installerID)
-	_, err := i.s3client.PutObject(&s3.PutObjectInput{
-		Bucket: &i.bucket,
-		Body:   content,
-		Key:    &key,
-	})
-	return err
-}
-
-// Exists checks if a software installer exists in the S3 bucket for the ID.
-func (i *SoftwareInstallerStore) Exists(ctx context.Context, installerID string) (bool, error) {
-	key := i.keyForInstaller(installerID)
-
-	_, err := i.s3client.HeadObject(&s3.HeadObjectInput{Bucket: &i.bucket, Key: &key})
-	if err != nil {
-		if aerr, ok := err.(awserr.Error); ok {
-			switch aerr.Code() {
-			case s3.ErrCodeNoSuchKey, s3.ErrCodeNoSuchBucket, "NotFound":
-				return false, nil
-			}
-		}
-		return false, ctxerr.Wrap(ctx, err, "checking existence of software installer in S3 store")
-	}
-	return true, nil
-}
-
-func (i *SoftwareInstallerStore) Cleanup(ctx context.Context, usedInstallerIDs []string) (int, error) {
-	usedSet := make(map[string]struct{}, len(usedInstallerIDs))
-	for _, id := range usedInstallerIDs {
-		usedSet[id] = struct{}{}
-	}
-
-	// ListObjectsV2 defaults to a max of 1000 keys, which is sufficient for the
-	// cleanup task - if more software installers are present, the next run will
-	// get another 1000 and will periodically complete the cleanups.
-	//
-	// Iterating over all pages would potentially take a long time and would make
-	// it more likely that a conflict arises, where an unused software installer
-	// becomes used again. This approach makes it only two API requests between
-	// the read of used installers and the deletions.
-	prefix := path.Join(i.prefix, softwareInstallersPrefix)
-	page, err := i.s3client.ListObjectsV2(&s3.ListObjectsV2Input{
-		Bucket: &i.bucket,
-		Prefix: &prefix,
-	})
-	if err != nil {
-		return 0, ctxerr.Wrap(ctx, err, "listing software installers in S3 store")
-	}
-
-	var toDeleteKeys []*s3.ObjectIdentifier
-	for _, item := range page.Contents {
-		if item.Key == nil {
-			continue
-		}
-		if _, ok := usedSet[path.Base(*item.Key)]; ok {
-			continue
-		}
-		toDeleteKeys = append(toDeleteKeys, &s3.ObjectIdentifier{Key: item.Key})
-	}
-
-	if len(toDeleteKeys) == 0 {
-		return 0, nil
-	}
-
-	res, err := i.s3client.DeleteObjects(&s3.DeleteObjectsInput{
-		Bucket: &i.bucket,
-		Delete: &s3.Delete{
-			Objects: toDeleteKeys,
+	return &SoftwareInstallerStore{
+		&commonFileStore{
+			s3store:    s3store,
+			pathPrefix: softwareInstallersPrefix,
+			fileLabel:  "software installer",
 		},
-	})
-	return len(res.Deleted), ctxerr.Wrap(ctx, err, "deleting software installers in S3 store")
-}
-
-// keyForInstaller builds an S3 key to identify the software installer.
-func (i *SoftwareInstallerStore) keyForInstaller(installerID string) string {
-	return path.Join(i.prefix, softwareInstallersPrefix, installerID)
+	}, nil
 }
diff --git a/server/datastore/s3/software_installer_test.go b/server/datastore/s3/software_installer_test.go
index 9292a6ed7ab8..f04912146899 100644
--- a/server/datastore/s3/software_installer_test.go
+++ b/server/datastore/s3/software_installer_test.go
@@ -10,6 +10,7 @@ import (
 	"io"
 	"path"
 	"testing"
+	"time"
 
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -104,7 +105,7 @@ func TestSoftwareInstallerCleanup(t *testing.T) {
 	}
 
 	// cleanup an empty store
-	n, err := store.Cleanup(ctx, nil)
+	n, err := store.Cleanup(ctx, nil, time.Now())
 	require.NoError(t, err)
 	require.Equal(t, 0, n)
 
@@ -114,14 +115,14 @@ func TestSoftwareInstallerCleanup(t *testing.T) {
 	require.NoError(t, err)
 
 	// cleanup but mark it as used
-	n, err = store.Cleanup(ctx, []string{ins0})
+	n, err = store.Cleanup(ctx, []string{ins0}, time.Now())
 	require.NoError(t, err)
 	require.Equal(t, 0, n)
 
 	assertExisting([]string{ins0})
 
 	// cleanup but mark it as unused
-	n, err = store.Cleanup(ctx, []string{})
+	n, err = store.Cleanup(ctx, []string{}, time.Now())
 	require.NoError(t, err)
 	require.Equal(t, 1, n)
 
@@ -134,9 +135,15 @@ func TestSoftwareInstallerCleanup(t *testing.T) {
 		require.NoError(t, err)
 	}
 
-	n, err = store.Cleanup(ctx, []string{installers[0], installers[2]})
+	// cleanup with a time in the past, nothing gets removed
+	n, err = store.Cleanup(ctx, []string{}, time.Now().Add(-time.Minute))
 	require.NoError(t, err)
-	require.Equal(t, 2, n)
+	require.Equal(t, 0, n)
+	assertExisting([]string{installers[0], installers[1], installers[2], installers[3]})
 
+	// cleanup in the future, all unused get removed
+	n, err = store.Cleanup(ctx, []string{installers[0], installers[2]}, time.Now().Add(time.Minute))
+	require.NoError(t, err)
+	require.Equal(t, 2, n)
 	assertExisting([]string{installers[0], installers[2]})
 }
diff --git a/server/datastore/s3/testing_utils.go b/server/datastore/s3/testing_utils.go
index 7854d3b34ff5..76366031a0e0 100644
--- a/server/datastore/s3/testing_utils.go
+++ b/server/datastore/s3/testing_utils.go
@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/fleetdm/fleet/v4/server/config"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -26,6 +27,12 @@ func SetupTestSoftwareInstallerStore(tb testing.TB, bucket, prefix string) *Soft
 	return store
 }
 
+func SetupTestBootstrapPackageStore(tb testing.TB, bucket, prefix string) *BootstrapPackageStore {
+	store := setupTestStore(tb, bucket, prefix, NewBootstrapPackageStore)
+	tb.Cleanup(func() { cleanupStore(tb, store.s3store) })
+	return store
+}
+
 // SetupTestInstallerStore creates a new store with minio as a back-end
 // for local testing
 func SetupTestInstallerStore(tb testing.TB, bucket, prefix string) *InstallerStore {
@@ -105,6 +112,12 @@ func cleanupStore(tb testing.TB, store *s3store) {
 	resp, err := store.s3client.ListObjects(&s3.ListObjectsInput{
 		Bucket: &store.bucket,
 	})
+	if aerr, ok := err.(awserr.Error); ok {
+		if aerr.Code() == s3.ErrCodeNoSuchBucket {
+			// fine, nothing to clean-up if the bucket no longer exists, no error
+			return
+		}
+	}
 	require.NoError(tb, err)
 
 	var objs []*s3.ObjectIdentifier
diff --git a/server/docs/patterns.md b/server/docs/patterns.md
new file mode 100644
index 000000000000..49b97c6ac0ca
--- /dev/null
+++ b/server/docs/patterns.md
@@ -0,0 +1,26 @@
+# Backend patterns
+
+The backend software patterns that we follow in Fleet.
+
+> NOTE: There are always exceptions to the rules, but we try to follow these patterns as much as possible unless a specific use case calls
+> for something else. These should be discussed within the team and documented before merging.
+
+## MySQL
+
+Use high precision for all time fields. Precise timestamps make sure that we can accurately track when records were created and updated,
+keep records in order with a reliable sort, and speed up testing by not having to wait for the time to
+update. [MySQL reference](https://dev.mysql.com/doc/refman/8.4/en/date-and-time-type-syntax.html). [Backend sync where discussed](https://us-65885.app.gong.io/call?id=8041045095900447703).
+Example:
+
+```sql
+CREATE TABLE `sample` (
+  `id` INT UNSIGNED NOT NULL AUTO_INCREMENT,
+  `created_at` TIMESTAMP(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+  `updated_at` TIMESTAMP(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+  PRIMARY KEY (`id`)
+);
+```
+
+Do not use [goqu](https://github.com/doug-martin/goqu); use MySQL queries directly. Searching for, understanding, and debugging direct MySQL
+queries is easier. If needing to modify an existing `goqu` query, try to rewrite it in
+MySQL. [Backend sync where discussed](https://us-65885.app.gong.io/call?id=8041045095900447703).
diff --git a/server/fleet/activities.go b/server/fleet/activities.go
index 56d312faac79..dca9c6ba6022 100644
--- a/server/fleet/activities.go
+++ b/server/fleet/activities.go
@@ -5,7 +5,7 @@ import (
 	"encoding/json"
 )
 
-//go:generate go run gen_activity_doc.go "../../docs/Using Fleet/Audit-logs.md"
+//go:generate go run gen_activity_doc.go "../../docs/Contributing/Audit-logs.md"
 
 type ContextKey string
 
@@ -54,6 +54,8 @@ var ActivityDetailsList = []ActivityDetails{
 	ActivityTypeMDMUnenrolled{},
 
 	ActivityTypeEditedMacOSMinVersion{},
+	ActivityTypeEditedIOSMinVersion{},
+	ActivityTypeEditedIPadOSMinVersion{},
 	ActivityTypeEditedWindowsUpdates{},
 
 	ActivityTypeReadHostDiskEncryptionKey{},
@@ -99,6 +101,11 @@ var ActivityDetailsList = []ActivityDetails{
 	ActivityTypeInstalledSoftware{},
 	ActivityTypeAddedSoftware{},
 	ActivityTypeDeletedSoftware{},
+	ActivityEnabledVPP{},
+	ActivityDisabledVPP{},
+	ActivityAddedAppStoreApp{},
+	ActivityDeletedAppStoreApp{},
+	ActivityInstalledAppStoreApp{},
 }
 
 type ActivityDetails interface {
@@ -832,6 +839,56 @@ func (a ActivityTypeEditedWindowsUpdates) Documentation() (activity string, deta
 }`
 }
 
+type ActivityTypeEditedIOSMinVersion struct {
+	TeamID         *uint   `json:"team_id"`
+	TeamName       *string `json:"team_name"`
+	MinimumVersion string  `json:"minimum_version"`
+	Deadline       string  `json:"deadline"`
+}
+
+func (a ActivityTypeEditedIOSMinVersion) ActivityName() string {
+	return "edited_ios_min_version"
+}
+
+func (a ActivityTypeEditedIOSMinVersion) Documentation() (activity string, details string, detailsExample string) {
+	return `Generated when the minimum required iOS version or deadline is modified.`,
+		`This activity contains the following fields:
+- "team_id": The ID of the team that the minimum iOS version applies to, ` + "`null`" + ` if it applies to devices that are not in a team.
+- "team_name": The name of the team that the minimum iOS version applies to, ` + "`null`" + ` if it applies to devices that are not in a team.
+- "minimum_version": The minimum iOS version required, empty if the requirement was removed.
+- "deadline": The deadline by which the minimum version requirement must be applied, empty if the requirement was removed.`, `{
+  "team_id": 3,
+  "team_name": "iPhones",
+  "minimum_version": "17.5.1",
+  "deadline": "2023-06-01"
+}`
+}
+
+type ActivityTypeEditedIPadOSMinVersion struct {
+	TeamID         *uint   `json:"team_id"`
+	TeamName       *string `json:"team_name"`
+	MinimumVersion string  `json:"minimum_version"`
+	Deadline       string  `json:"deadline"`
+}
+
+func (a ActivityTypeEditedIPadOSMinVersion) ActivityName() string {
+	return "edited_ipados_min_version"
+}
+
+func (a ActivityTypeEditedIPadOSMinVersion) Documentation() (activity string, details string, detailsExample string) {
+	return `Generated when the minimum required iPadOS version or deadline is modified.`,
+		`This activity contains the following fields:
+- "team_id": The ID of the team that the minimum iPadOS version applies to, ` + "`null`" + ` if it applies to devices that are not in a team.
+- "team_name": The name of the team that the minimum iPadOS version applies to, ` + "`null`" + ` if it applies to devices that are not in a team.
+- "minimum_version": The minimum iPadOS version required, empty if the requirement was removed.
+- "deadline": The deadline by which the minimum version requirement must be applied, empty if the requirement was removed.`, `{
+  "team_id": 3,
+  "team_name": "iPads",
+  "minimum_version": "17.5.1",
+  "deadline": "2023-06-01"
+}`
+}
+
 type ActivityTypeReadHostDiskEncryptionKey struct {
 	HostID          uint   `json:"host_id"`
 	HostDisplayName string `json:"host_display_name"`
@@ -1507,7 +1564,7 @@ func (a ActivityTypeDeletedSoftware) Documentation() (string, string, string) {
 	return `Generated when a software installer is deleted from Fleet.`, `This activity contains the following fields:
 - "software_title": Name of the software.
 - "software_package": Filename of the installer.
-- "team_name": Name of the team to which this software was added.` + " `null " + `if it was added to no team.
+- "team_name": Name of the team to which this software was added.` + " `null` " + `if it was added to no team.
 - "team_id": The ID of the team to which this software was added.` + " `null` " + `if it was added to no team.
 - "self_service": Whether the software was available for installation by the end user.`, `{
   "software_title": "Falcon.app",
@@ -1598,3 +1655,125 @@ func LogRoleChangeActivities(
 	}
 	return nil
 }
+
+type ActivityEnabledVPP struct {
+	Location string `json:"location"`
+}
+
+func (a ActivityEnabledVPP) ActivityName() string {
+	return "enabled_vpp"
+}
+
+func (a ActivityEnabledVPP) Documentation() (activity string, details string, detailsExample string) {
+	return "Generated when VPP features are enabled in Fleet.", `This activity contains the following fields:
+- "location": Location associated with the VPP content token for the enabled VPP features.`, `{
+  "location": "Acme Inc."
+}`
+}
+
+type ActivityDisabledVPP struct {
+	Location string `json:"location"`
+}
+
+func (a ActivityDisabledVPP) ActivityName() string {
+	return "disabled_vpp"
+}
+
+func (a ActivityDisabledVPP) Documentation() (activity string, details string, detailsExample string) {
+	return "Generated when VPP features are disabled in Fleet.", `This activity contains the following fields:
+- "location": Location associated with the VPP content token for the disabled VPP features.`, `{
+  "location": "Acme Inc."
+}`
+}
+
+type ActivityAddedAppStoreApp struct {
+	SoftwareTitle string              `json:"software_title"`
+	AppStoreID    string              `json:"app_store_id"`
+	TeamName      *string             `json:"team_name"`
+	TeamID        *uint               `json:"team_id"`
+	Platform      AppleDevicePlatform `json:"platform"`
+	SelfService   bool                `json:"self_service"`
+}
+
+func (a ActivityAddedAppStoreApp) ActivityName() string {
+	return "added_app_store_app"
+}
+
+func (a ActivityAddedAppStoreApp) Documentation() (activity string, details string, detailsExample string) {
+	return "Generated when an App Store app is added to Fleet.", `This activity contains the following fields:
+- "software_title": Name of the App Store app.
+- "app_store_id": ID of the app on the Apple App Store.
+- "platform": Platform of the app (` + "`darwin`, `ios`, or `ipados`" + `).
+- "self_service": App installation can be initiated by device owner.
+- "team_name": Name of the team to which this App Store app was added, or ` + "`null`" + ` if it was added to no team.
+- "team_id": ID of the team to which this App Store app was added, or ` + "`null`" + `if it was added to no team.`, `{
+  "software_title": "Logic Pro",
+  "app_store_id": "1234567",
+  "platform": "darwin",
+  "self_service": false,
+  "team_name": "Workstations",
+  "team_id": 1
+}`
+}
+
+type ActivityDeletedAppStoreApp struct {
+	SoftwareTitle string              `json:"software_title"`
+	AppStoreID    string              `json:"app_store_id"`
+	TeamName      *string             `json:"team_name"`
+	TeamID        *uint               `json:"team_id"`
+	Platform      AppleDevicePlatform `json:"platform"`
+}
+
+func (a ActivityDeletedAppStoreApp) ActivityName() string {
+	return "deleted_app_store_app"
+}
+
+func (a ActivityDeletedAppStoreApp) Documentation() (activity string, details string, detailsExample string) {
+	return "Generated when an App Store app is deleted from Fleet.", `This activity contains the following fields:
+- "software_title": Name of the App Store app.
+- "app_store_id": ID of the app on the Apple App Store.
+- "platform": Platform of the app (` + "`darwin`, `ios`, or `ipados`" + `).
+- "team_name": Name of the team from which this App Store app was deleted, or ` + "`null`" + ` if it was deleted from no team.
+- "team_id": ID of the team from which this App Store app was deleted, or ` + "`null`" + `if it was deleted from no team.`, `{
+  "software_title": "Logic Pro",
+  "app_store_id": "1234567",
+  "platform": "darwin",
+  "team_name": "Workstations",
+  "team_id": 1
+}`
+}
+
+type ActivityInstalledAppStoreApp struct {
+	HostID          uint   `json:"host_id"`
+	HostDisplayName string `json:"host_display_name"`
+	SoftwareTitle   string `json:"software_title"`
+	AppStoreID      string `json:"app_store_id"`
+	CommandUUID     string `json:"command_uuid"`
+	Status          string `json:"status,omitempty"`
+	SelfService     bool   `json:"self_service"`
+}
+
+func (a ActivityInstalledAppStoreApp) HostIDs() []uint {
+	return []uint{a.HostID}
+}
+
+func (a ActivityInstalledAppStoreApp) ActivityName() string {
+	return "installed_app_store_app"
+}
+
+func (a ActivityInstalledAppStoreApp) Documentation() (string, string, string) {
+	return "Generated when an App Store app is installed on a device.", `This activity contains the following fields:
+- host_id: ID of the host on which the app was installed.
+- self_service: App installation was initiated by device owner.
+- host_display_name: Display name of the host.
+- software_title: Name of the App Store app.
+- app_store_id: ID of the app on the Apple App Store.
+- command_uuid: UUID of the MDM command used to install the app.`, `{
+  "host_id": 42,
+  "self_service": true,
+  "host_display_name": "Anna's MacBook Pro",
+  "software_title": "Logic Pro",
+  "app_store_id": "1234567",
+  "command_uuid": "98765432-1234-1234-1234-1234567890ab"
+}`
+}
diff --git a/server/fleet/agent_options.go b/server/fleet/agent_options.go
index 53e2d4674a14..0e185a3fee2e 100644
--- a/server/fleet/agent_options.go
+++ b/server/fleet/agent_options.go
@@ -11,7 +11,11 @@ import (
 
 //go:generate go run ../../tools/osquery-agent-options agent_options_generated.go
 
+const maxAgentScriptExecutionTimeout = 3600
+
 type AgentOptions struct {
+	// ScriptExecutionTimeout is the maximum time in seconds that a script can run.
+	ScriptExecutionTimeout int `json:"script_execution_timeout,omitempty"`
 	// Config is the base config options.
 	Config json.RawMessage `json:"config"`
 	// Overrides includes any platform-based overrides.
@@ -49,6 +53,10 @@ func ValidateJSONAgentOptions(ctx context.Context, ds Datastore, rawJSON json.Ra
 		return err
 	}
 
+	if opts.ScriptExecutionTimeout > maxAgentScriptExecutionTimeout {
+		return fmt.Errorf("'script_execution_timeout' value exceeds limit. Maximum value is %d", maxAgentScriptExecutionTimeout)
+	}
+
 	if len(opts.CommandLineStartUpFlags) > 0 {
 		var flags osqueryCommandLineFlags
 		if err := JSONStrictDecode(bytes.NewReader(opts.CommandLineStartUpFlags), &flags); err != nil {
diff --git a/server/fleet/agent_options_test.go b/server/fleet/agent_options_test.go
index 0e199298b6ae..3e91fa64af95 100644
--- a/server/fleet/agent_options_test.go
+++ b/server/fleet/agent_options_test.go
@@ -28,6 +28,10 @@ func TestValidateAgentOptions(t *testing.T) {
 			}
 		}}`, true, `unknown field "foo"`},
 
+		{"valid script timeout", `{"script_execution_timeout": 600}`, true, ""},
+
+		{"invalid script timeout", `{"script_execution_timeout": 3601}`, true, `script_execution_timeout' value exceeds limit. Maximum value is 3600`},
+
 		{"overrides.platform is null", `{"overrides": {
 			"platforms": {
 				"darwin": null
diff --git a/server/fleet/app.go b/server/fleet/app.go
index f0755add595c..603ba2e0ab88 100644
--- a/server/fleet/app.go
+++ b/server/fleet/app.go
@@ -120,9 +120,31 @@ type VulnerabilitySettings struct {
 	DatabasesPath string `json:"databases_path"`
 }
 
+// MDMAppleABMAssignmentInfo represents an user definition of the association
+// between an ABM token (via organization name) and the teams used to associate
+// hosts when they're ingested during the ABM sync.
+type MDMAppleABMAssignmentInfo struct {
+	OrganizationName string `json:"organization_name"`
+	MacOSTeam        string `json:"macos_team"`
+	IOSTeam          string `json:"ios_team"`
+	IpadOSTeam       string `json:"ipados_team"`
+}
+
+// MDMAppleVolumePurchasingProgramInfo represents an user definition of the association
+// between a VPP token (via location) and the team associations.
+type MDMAppleVolumePurchasingProgramInfo struct {
+	Location string   `json:"location"`
+	Teams    []string `json:"teams"`
+}
+
 // MDM is part of AppConfig and defines the mdm settings.
 type MDM struct {
-	AppleBMDefaultTeam string `json:"apple_bm_default_team"`
+	// Deprecated: use AppleBussinessManager instead
+	DeprecatedAppleBMDefaultTeam string `json:"apple_bm_default_team,omitempty"`
+
+	// AppleBusinessManager defines the associations between ABM tokens
+	// and the teams used to assign hosts when they're ingested from ABM.
+	AppleBusinessManager optjson.Slice[MDMAppleABMAssignmentInfo] `json:"apple_business_manager"`
 
 	// AppleBMEnabledAndConfigured is set to true if Fleet has been
 	// configured with the required Apple BM key pair or token. It can't be set
@@ -136,6 +158,10 @@ type MDM struct {
 	// PATCH /config API, it is only set automatically, internally, by detecting
 	// the 403 Forbidden error with body T_C_NOT_SIGNED returned by the Apple BM
 	// API.
+	//
+	// It is set to true as soon as one of the ABM tokens receives this error
+	// code, and is set to false only once all ABM tokens have agreed to the new
+	// terms.
 	AppleBMTermsExpired bool `json:"apple_bm_terms_expired"`
 
 	// EnabledAndConfigured is set to true if Fleet has been
@@ -148,7 +174,13 @@ type MDM struct {
 	// backend, should be done only after careful analysis.
 	EnabledAndConfigured bool `json:"enabled_and_configured"`
 
-	MacOSUpdates   MacOSUpdates   `json:"macos_updates"`
+	// MacOSUpdates defines the OS update settings for macOS devices.
+	MacOSUpdates AppleOSUpdateSettings `json:"macos_updates"`
+	// IOSUpdates defines the OS update settings for iOS devices.
+	IOSUpdates AppleOSUpdateSettings `json:"ios_updates"`
+	// IPadOSUpdates defines the OS update settings for iPadOS devices.
+	IPadOSUpdates AppleOSUpdateSettings `json:"ipados_updates"`
+	// WindowsUpdates defines the OS update settings for Windows devices.
 	WindowsUpdates WindowsUpdates `json:"windows_updates"`
 
 	MacOSSettings         MacOSSettings            `json:"macos_settings"`
@@ -166,6 +198,8 @@ type MDM struct {
 
 	WindowsSettings WindowsSettings `json:"windows_settings"`
 
+	VolumePurchasingProgram optjson.Slice[MDMAppleVolumePurchasingProgramInfo] `json:"volume_purchasing_program"`
+
 	/////////////////////////////////////////////////////////////////
 	// WARNING: If you add to this struct make sure it's taken into
 	// account in the AppConfig Clone implementation!
@@ -182,8 +216,9 @@ func (m MDM) AtLeastOnePlatformEnabledAndConfigured() bool {
 // format only (no prerelease or build metadata).
 var versionStringRegex = regexp.MustCompile(`^\d+(\.\d+)?(\.\d+)?$`)
 
-// MacOSUpdates is part of AppConfig and defines the macOS update settings.
-type MacOSUpdates struct {
+// AppleOSUpdateSettings is the common type that contains the settings
+// for OS updates on Apple devices.
+type AppleOSUpdateSettings struct {
 	// MinimumVersion is the required minimum operating system version.
 	MinimumVersion optjson.String `json:"minimum_version"`
 	// Deadline the required installation date for Nudge to enforce the required
@@ -192,12 +227,12 @@ type MacOSUpdates struct {
 }
 
 // Configured returns a boolean indicating if updates are configured
-func (m MacOSUpdates) Configured() bool {
+func (m AppleOSUpdateSettings) Configured() bool {
 	return m.Deadline.Value != "" &&
 		m.MinimumVersion.Value != ""
 }
 
-func (m MacOSUpdates) Validate() error {
+func (m AppleOSUpdateSettings) Validate() error {
 	// if no settings are provided it's okay to skip further validation
 	if m.MinimumVersion.Value == "" && m.Deadline.Value == "" {
 		// if one is set and empty, the other must be set and empty too, otherwise
@@ -600,6 +635,25 @@ func (c *AppConfig) Copy() *AppConfig {
 		clone.MDM.WindowsSettings.CustomSettings = optjson.SetSlice(windowsSettings)
 	}
 
+	if c.MDM.AppleBusinessManager.Set {
+		abm := make([]MDMAppleABMAssignmentInfo, len(c.MDM.AppleBusinessManager.Value))
+		for i, s := range c.MDM.AppleBusinessManager.Value {
+			abm[i] = s
+		}
+		clone.MDM.AppleBusinessManager = optjson.SetSlice(abm)
+
+	}
+
+	if c.MDM.VolumePurchasingProgram.Set {
+		vpp := make([]MDMAppleVolumePurchasingProgramInfo, len(c.MDM.VolumePurchasingProgram.Value))
+		for i, s := range c.MDM.VolumePurchasingProgram.Value {
+			vpp[i].Location = s.Location
+			vpp[i].Teams = make([]string, len(s.Teams))
+			copy(vpp[i].Teams, s.Teams)
+		}
+		clone.MDM.VolumePurchasingProgram = optjson.SetSlice(vpp)
+	}
+
 	return &clone
 }
 
@@ -824,7 +878,6 @@ func (c AppConfig) MarshalJSON() ([]byte, error) {
 	if !c.MDM.MacOSSetup.EnableReleaseDeviceManually.Valid {
 		c.MDM.MacOSSetup.EnableReleaseDeviceManually = optjson.SetBool(false)
 	}
-
 	type aliasConfig AppConfig
 	aa := aliasConfig(c)
 	return json.Marshal(aa)
diff --git a/server/fleet/app_test.go b/server/fleet/app_test.go
index 46c93c0982f9..bec5c458e55f 100644
--- a/server/fleet/app_test.go
+++ b/server/fleet/app_test.go
@@ -13,26 +13,26 @@ func TestMacOSUpdatesValidate(t *testing.T) {
 	t.Run("valid", func(t *testing.T) {
 		cases := []struct {
 			name string
-			m    MacOSUpdates
+			m    AppleOSUpdateSettings
 		}{
-			{"empty", MacOSUpdates{}},
+			{"empty", AppleOSUpdateSettings{}},
 			{
 				"with full version",
-				MacOSUpdates{
+				AppleOSUpdateSettings{
 					MinimumVersion: optjson.SetString("10.15.0"),
 					Deadline:       optjson.SetString("2020-01-01"),
 				},
 			},
 			{
 				"without patch version",
-				MacOSUpdates{
+				AppleOSUpdateSettings{
 					MinimumVersion: optjson.SetString("10.15"),
 					Deadline:       optjson.SetString("2020-01-01"),
 				},
 			},
 			{
 				"only major version",
-				MacOSUpdates{
+				AppleOSUpdateSettings{
 					MinimumVersion: optjson.SetString("10"),
 					Deadline:       optjson.SetString("2020-01-01"),
 				},
@@ -49,25 +49,25 @@ func TestMacOSUpdatesValidate(t *testing.T) {
 	t.Run("invalid deadline", func(t *testing.T) {
 		cases := []struct {
 			name string
-			m    MacOSUpdates
+			m    AppleOSUpdateSettings
 		}{
 			{
 				"version but no deadline",
-				MacOSUpdates{
+				AppleOSUpdateSettings{
 					MinimumVersion: optjson.SetString("10.15.0"),
 					Deadline:       optjson.SetString(""),
 				},
 			},
 			{
 				"deadline with timestamp",
-				MacOSUpdates{
+				AppleOSUpdateSettings{
 					MinimumVersion: optjson.SetString("10.15.0"),
 					Deadline:       optjson.SetString("2020-01-01T00:00:00Z"),
 				},
 			},
 			{
 				"incomplete date",
-				MacOSUpdates{
+				AppleOSUpdateSettings{
 					MinimumVersion: optjson.SetString("10.15.0"),
 					Deadline:       optjson.SetString("2020-01"),
 				},
@@ -84,25 +84,25 @@ func TestMacOSUpdatesValidate(t *testing.T) {
 	t.Run("invalid version", func(t *testing.T) {
 		cases := []struct {
 			name string
-			m    MacOSUpdates
+			m    AppleOSUpdateSettings
 		}{
 			{
 				"deadline but no version",
-				MacOSUpdates{
+				AppleOSUpdateSettings{
 					MinimumVersion: optjson.SetString(""),
 					Deadline:       optjson.SetString("2020-01-01"),
 				},
 			},
 			{
 				"version with build info",
-				MacOSUpdates{
+				AppleOSUpdateSettings{
 					MinimumVersion: optjson.SetString("10.15.0 (19A583)"),
 					Deadline:       optjson.SetString("2020-01-01"),
 				},
 			},
 			{
 				"version with patch info",
-				MacOSUpdates{
+				AppleOSUpdateSettings{
 					MinimumVersion: optjson.SetString("10.15.0-patch1"),
 					Deadline:       optjson.SetString("2020-01-01"),
 				},
@@ -185,7 +185,7 @@ func TestMacOSUpdatesConfigured(t *testing.T) {
 	}
 
 	for _, tc := range cases {
-		m := MacOSUpdates{
+		m := AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString(tc.version),
 			Deadline:       optjson.SetString(tc.deadline),
 		}
@@ -266,10 +266,8 @@ func TestAppConfigDeprecatedFields(t *testing.T) {
 			diskEncryption, exists := mdm["enable_disk_encryption"]
 			require.True(t, exists)
 			require.EqualValues(t, c.wantDiskEncryption, diskEncryption)
-
 		})
 	}
-
 }
 
 func TestAtLeastOnePlatformEnabledAndConfigured(t *testing.T) {
diff --git a/server/fleet/apple_mdm.go b/server/fleet/apple_mdm.go
index 7d8d6ebb2661..9a3bb005f8d3 100644
--- a/server/fleet/apple_mdm.go
+++ b/server/fleet/apple_mdm.go
@@ -1,11 +1,13 @@
 package fleet
 
 import (
+	"bytes"
 	"context"
 	"crypto/md5" // nolint: gosec
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
+	"io"
 	"net/http"
 	"strings"
 	"time"
@@ -21,6 +23,7 @@ type MDMAppleCommandIssuer interface {
 	DeviceLock(ctx context.Context, host *Host, uuid string) (unlockPIN string, err error)
 	EraseDevice(ctx context.Context, host *Host, uuid string) error
 	InstallEnterpriseApplication(ctx context.Context, hostUUIDs []string, uuid string, manifestURL string) error
+	InstallApplication(ctx context.Context, hostUUIDs []string, uuid string, adamID string) error
 }
 
 // MDMAppleEnrollmentType is the type for Apple MDM enrollments.
@@ -202,6 +205,13 @@ type MDMAppleConfigProfile struct {
 	UploadedAt       time.Time                   `db:"uploaded_at" json:"updated_at"` // NOTE: JSON field is still `updated_at` for historical reasons, would be an API breaking change
 }
 
+// MDMProfilesUpdates flags updates that were done during batch processing of profiles.
+type MDMProfilesUpdates struct {
+	AppleConfigProfile   bool
+	WindowsConfigProfile bool
+	AppleDeclaration     bool
+}
+
 // ConfigurationProfileLabel represents the many-to-many relationship between
 // profiles and labels.
 //
@@ -307,6 +317,20 @@ func (p *MDMAppleProfilePayload) FailedToInstallOnHost() bool {
 	return p.Status != nil && *p.Status == MDMDeliveryFailed && p.OperationType == MDMOperationTypeInstall
 }
 
+func (p MDMAppleProfilePayload) Equal(other MDMAppleProfilePayload) bool {
+	statusEqual := p.Status == nil && other.Status == nil || p.Status != nil && other.Status != nil && *p.Status == *other.Status
+	return p.ProfileUUID == other.ProfileUUID &&
+		p.ProfileIdentifier == other.ProfileIdentifier &&
+		p.ProfileName == other.ProfileName &&
+		p.HostUUID == other.HostUUID &&
+		p.HostPlatform == other.HostPlatform &&
+		bytes.Equal(p.Checksum, other.Checksum) &&
+		statusEqual &&
+		p.OperationType == other.OperationType &&
+		p.Detail == other.Detail &&
+		p.CommandUUID == other.CommandUUID
+}
+
 type MDMAppleBulkUpsertHostProfilePayload struct {
 	ProfileUUID       string
 	ProfileIdentifier string
@@ -433,6 +457,8 @@ type HostDEPAssignment struct {
 	// DeletedAt is the timestamp  when Fleet was notified that device was deleted from the Fleet
 	// MDM server in Apple Busines Manager (ABM).
 	DeletedAt *time.Time `db:"deleted_at"`
+	// ABMTokenID is the ID of the ABM token that was used to make this DEP assignment.
+	ABMTokenID *uint `db:"abm_token_id"`
 }
 
 func (h *HostDEPAssignment) IsDEPAssignedToFleet() bool {
@@ -495,12 +521,11 @@ type MDMAppleCommand struct {
 // MDMAppleSetupAssistant represents the setup assistant set for a given team
 // or no team.
 type MDMAppleSetupAssistant struct {
-	ID          uint            `json:"-" db:"id"`
-	TeamID      *uint           `json:"team_id" db:"team_id"`
-	Name        string          `json:"name" db:"name"`
-	Profile     json.RawMessage `json:"enrollment_profile" db:"profile"`
-	ProfileUUID string          `json:"-" db:"profile_uuid"`
-	UploadedAt  time.Time       `json:"uploaded_at" db:"uploaded_at"`
+	ID         uint            `json:"-" db:"id"`
+	TeamID     *uint           `json:"team_id" db:"team_id"`
+	Name       string          `json:"name" db:"name"`
+	Profile    json.RawMessage `json:"enrollment_profile" db:"profile"`
+	UploadedAt time.Time       `json:"uploaded_at" db:"uploaded_at"`
 }
 
 // AuthzType implements authz.AuthzTyper.
@@ -657,6 +682,18 @@ type MDMAppleHostDeclaration struct {
 	Checksum string `db:"checksum" json:"-"`
 }
 
+func (p MDMAppleHostDeclaration) Equal(other MDMAppleHostDeclaration) bool {
+	statusEqual := p.Status == nil && other.Status == nil || p.Status != nil && other.Status != nil && *p.Status == *other.Status
+	return statusEqual &&
+		p.HostUUID == other.HostUUID &&
+		p.DeclarationUUID == other.DeclarationUUID &&
+		p.Name == other.Name &&
+		p.Identifier == other.Identifier &&
+		p.OperationType == other.OperationType &&
+		p.Detail == other.Detail &&
+		p.Checksum == other.Checksum
+}
+
 func NewMDMAppleDeclaration(raw []byte, teamID *uint, name string, declType, ident string) *MDMAppleDeclaration {
 	var decl MDMAppleDeclaration
 
@@ -840,3 +877,67 @@ type MDMAppleDDMActivation struct {
 	ServerToken string                       `json:"ServerToken"`
 	Type        string                       `json:"Type"` // "com.apple.activation.simple"
 }
+
+// MDMBootstrapPackageStore is the interface to store and retrieve bootstrap
+// package files. Fleet supports storing to the database and to an S3 bucket.
+type MDMBootstrapPackageStore interface {
+	Get(ctx context.Context, packageID string) (io.ReadCloser, int64, error)
+	Put(ctx context.Context, packageID string, content io.ReadSeeker) error
+	Exists(ctx context.Context, packageID string) (bool, error)
+	Cleanup(ctx context.Context, usedPackageIDs []string, removeCreatedBefore time.Time) (int, error)
+}
+
+// MDMAppleMachineInfo is a [device's information][1] sent as part of an MDM enrollment profile request
+//
+// [1]: https://developer.apple.com/documentation/devicemanagement/machineinfo
+type MDMAppleMachineInfo struct {
+	IMEI                        string `plist:"IMEI,omitempty"`
+	Language                    string `plist:"LANGUAGE,omitempty"`
+	MDMCanRequestSoftwareUpdate bool   `plist:"MDM_CAN_REQUEST_SOFTWARE_UPDATE"`
+	MEID                        string `plist:"MEID,omitempty"`
+	OSVersion                   string `plist:"OS_VERSION"`
+	PairingToken                string `plist:"PAIRING_TOKEN,omitempty"`
+	Product                     string `plist:"PRODUCT"`
+	Serial                      string `plist:"SERIAL"`
+	SoftwareUpdateDeviceID      string `plist:"SOFTWARE_UPDATE_DEVICE_ID,omitempty"`
+	SupplementalBuildVersion    string `plist:"SUPPLEMENTAL_BUILD_VERSION,omitempty"`
+	SupplementalOSVersionExtra  string `plist:"SUPPLEMENTAL_OS_VERSION_EXTRA,omitempty"`
+	UDID                        string `plist:"UDID"`
+	Version                     string `plist:"VERSION"`
+}
+
+// MDMAppleSoftwareUpdateRequiredCode is the [code][1] specified by Apple to indicate that the device
+// needs to perform a software update before enrollment and setup can proceed.
+//
+// [1]: https://developer.apple.com/documentation/devicemanagement/errorcodesoftwareupdaterequired
+const MDMAppleSoftwareUpdateRequiredCode = "com.apple.softwareupdate.required"
+
+// MDMAppleSoftwareUpdateRequiredDetails is the [details][1] specified by Apple for the
+// required software update.
+//
+// [1]: https://developer.apple.com/documentation/devicemanagement/errorcodesoftwareupdaterequired/details
+type MDMAppleSoftwareUpdateRequiredDetails struct {
+	OSVersion    string `json:"OSVersion"`
+	BuildVersion string `json:"BuildVersion"`
+}
+
+// MDMAppleSoftwareUpdateRequired is the [error response][1] specified by Apple to indicate that the device
+// needs to perform a software update before enrollment and setup can proceed.
+//
+// [1]: https://developer.apple.com/documentation/devicemanagement/errorcodesoftwareupdaterequired
+type MDMAppleSoftwareUpdateRequired struct {
+	Code    string                                `json:"code"` // "com.apple.softwareupdate.required"
+	Details MDMAppleSoftwareUpdateRequiredDetails `json:"details"`
+}
+
+func NewMDMAppleSoftwareUpdateRequired(asset MDMAppleSoftwareUpdateAsset) *MDMAppleSoftwareUpdateRequired {
+	return &MDMAppleSoftwareUpdateRequired{
+		Code:    MDMAppleSoftwareUpdateRequiredCode,
+		Details: MDMAppleSoftwareUpdateRequiredDetails{OSVersion: asset.ProductVersion, BuildVersion: asset.Build},
+	}
+}
+
+type MDMAppleSoftwareUpdateAsset struct {
+	ProductVersion string `json:"ProductVersion"`
+	Build          string `json:"Build"`
+}
diff --git a/server/fleet/apple_mdm_test.go b/server/fleet/apple_mdm_test.go
index 16799f6cc3be..f31796d4a4f0 100644
--- a/server/fleet/apple_mdm_test.go
+++ b/server/fleet/apple_mdm_test.go
@@ -7,18 +7,20 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
+	"reflect"
 	"strings"
 	"testing"
 	"time"
 
 	"github.com/fleetdm/fleet/v4/server/mdm"
 	"github.com/fleetdm/fleet/v4/server/mdm/apple/mobileconfig"
+	"github.com/fleetdm/fleet/v4/server/mdm/scep/depot"
 	"github.com/fleetdm/fleet/v4/server/ptr"
+	"github.com/google/go-cmp/cmp"
 	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.mozilla.org/pkcs7"
-
-	"github.com/fleetdm/fleet/v4/server/mdm/scep/depot"
 )
 
 func TestMDMAppleConfigProfile(t *testing.T) {
@@ -416,3 +418,199 @@ func TestMDMProfileIsWithinGracePeriod(t *testing.T) {
 		})
 	}
 }
+
+func TestMDMAppleHostDeclarationEqual(t *testing.T) {
+	t.Parallel()
+
+	// This test is intended to ensure that the Equal method on MDMAppleHostDeclaration is updated when new fields are added.
+	// The Equal method is used to identify whether database update is needed.
+
+	items := [...]MDMAppleHostDeclaration{{}, {}}
+
+	numberOfFields := 0
+	for i := 0; i < len(items); i++ {
+		rValue := reflect.ValueOf(&items[i]).Elem()
+		numberOfFields = rValue.NumField()
+		for j := 0; j < numberOfFields; j++ {
+			field := rValue.Field(j)
+			switch field.Kind() {
+			case reflect.String:
+				valueToSet := fmt.Sprintf("test %d", i)
+				field.SetString(valueToSet)
+			case reflect.Int:
+				field.SetInt(int64(i))
+			case reflect.Bool:
+				field.SetBool(i%2 == 0)
+			case reflect.Pointer:
+				field.Set(reflect.New(field.Type().Elem()))
+			default:
+				t.Fatalf("unhandled field type %s", field.Kind())
+			}
+		}
+	}
+
+	status0 := MDMDeliveryStatus("status")
+	status1 := MDMDeliveryStatus("status")
+	items[0].Status = &status0
+	assert.False(t, items[0].Equal(items[1]))
+
+	// Set known fields to be equal
+	fieldsInEqualMethod := 0
+	items[1].HostUUID = items[0].HostUUID
+	fieldsInEqualMethod++
+	items[1].DeclarationUUID = items[0].DeclarationUUID
+	fieldsInEqualMethod++
+	items[1].Name = items[0].Name
+	fieldsInEqualMethod++
+	items[1].Identifier = items[0].Identifier
+	fieldsInEqualMethod++
+	items[1].OperationType = items[0].OperationType
+	fieldsInEqualMethod++
+	items[1].Detail = items[0].Detail
+	fieldsInEqualMethod++
+	items[1].Checksum = items[0].Checksum
+	fieldsInEqualMethod++
+	items[1].Status = &status1
+	fieldsInEqualMethod++
+	assert.Equal(t, fieldsInEqualMethod, numberOfFields, "MDMAppleHostDeclaration.Equal needs to be updated for new/updated field(s)")
+	assert.True(t, items[0].Equal(items[1]))
+
+	// Set pointers to nil
+	items[0].Status = nil
+	items[1].Status = nil
+	assert.True(t, items[0].Equal(items[1]))
+
+}
+
+func TestMDMAppleProfilePayloadEqual(t *testing.T) {
+	t.Parallel()
+
+	// This test is intended to ensure that the Equal method on MDMAppleProfilePayload is updated when new fields are added.
+	// The Equal method is used to identify whether database update is needed.
+
+	items := [...]MDMAppleProfilePayload{{}, {}}
+
+	numberOfFields := 0
+	for i := 0; i < len(items); i++ {
+		rValue := reflect.ValueOf(&items[i]).Elem()
+		numberOfFields = rValue.NumField()
+		for j := 0; j < numberOfFields; j++ {
+			field := rValue.Field(j)
+			switch field.Kind() {
+			case reflect.String:
+				valueToSet := fmt.Sprintf("test %d", i)
+				field.SetString(valueToSet)
+			case reflect.Int:
+				field.SetInt(int64(i))
+			case reflect.Bool:
+				field.SetBool(i%2 == 0)
+			case reflect.Pointer:
+				field.Set(reflect.New(field.Type().Elem()))
+			case reflect.Slice:
+				switch field.Type().Elem().Kind() {
+				case reflect.Uint8:
+					valueToSet := []byte("test")
+					field.Set(reflect.ValueOf(valueToSet))
+				default:
+					t.Fatalf("unhandled slice type %s", field.Type().Elem().Kind())
+				}
+			default:
+				t.Fatalf("unhandled field type %s", field.Kind())
+			}
+		}
+	}
+
+	status0 := MDMDeliveryStatus("status")
+	status1 := MDMDeliveryStatus("status")
+	items[0].Status = &status0
+	checksum0 := []byte("checksum")
+	checksum1 := []byte("checksum")
+	items[0].Checksum = checksum0
+	assert.False(t, items[0].Equal(items[1]))
+
+	// Set known fields to be equal
+	fieldsInEqualMethod := 0
+	items[1].ProfileUUID = items[0].ProfileUUID
+	fieldsInEqualMethod++
+	items[1].ProfileIdentifier = items[0].ProfileIdentifier
+	fieldsInEqualMethod++
+	items[1].ProfileName = items[0].ProfileName
+	fieldsInEqualMethod++
+	items[1].HostUUID = items[0].HostUUID
+	fieldsInEqualMethod++
+	items[1].HostPlatform = items[0].HostPlatform
+	fieldsInEqualMethod++
+	items[1].Checksum = checksum1
+	fieldsInEqualMethod++
+	items[1].Status = &status1
+	fieldsInEqualMethod++
+	items[1].OperationType = items[0].OperationType
+	fieldsInEqualMethod++
+	items[1].Detail = items[0].Detail
+	fieldsInEqualMethod++
+	items[1].CommandUUID = items[0].CommandUUID
+	fieldsInEqualMethod++
+	assert.Equal(t, fieldsInEqualMethod, numberOfFields, "MDMAppleProfilePayload.Equal needs to be updated for new/updated field(s)")
+	assert.True(t, items[0].Equal(items[1]))
+
+	// Set pointers and slices to nil
+	items[0].Status = nil
+	items[1].Status = nil
+	items[0].Checksum = nil
+	items[1].Checksum = nil
+	assert.True(t, items[0].Equal(items[1]))
+
+}
+
+func TestConfigurationProfileLabelEqual(t *testing.T) {
+	t.Parallel()
+
+	// This test is intended to ensure that the cmp.Equal method on ConfigurationProfileLabel is updated when new fields are added.
+	// The cmp.Equal method is used to identify whether database update is needed.
+
+	items := [...]ConfigurationProfileLabel{{}, {}}
+
+	numberOfFields := 0
+	for i := 0; i < len(items); i++ {
+		rValue := reflect.ValueOf(&items[i]).Elem()
+		numberOfFields = rValue.NumField()
+		for j := 0; j < numberOfFields; j++ {
+			field := rValue.Field(j)
+			switch field.Kind() {
+			case reflect.String:
+				valueToSet := fmt.Sprintf("test %d", i)
+				field.SetString(valueToSet)
+			case reflect.Int:
+				field.SetInt(int64(i))
+			case reflect.Uint:
+				field.SetUint(uint64(i))
+			case reflect.Bool:
+				field.SetBool(i%2 == 0)
+			case reflect.Pointer:
+				field.Set(reflect.New(field.Type().Elem()))
+			default:
+				t.Fatalf("unhandled field type %s", field.Kind())
+			}
+		}
+	}
+
+	assert.False(t, cmp.Equal(items[0], items[1]))
+
+	// Set known fields to be equal
+	fieldsInEqualMethod := 0
+	items[1].ProfileUUID = items[0].ProfileUUID
+	fieldsInEqualMethod++
+	items[1].LabelName = items[0].LabelName
+	fieldsInEqualMethod++
+	items[1].LabelID = items[0].LabelID
+	fieldsInEqualMethod++
+	items[1].Broken = items[0].Broken
+	fieldsInEqualMethod++
+	items[1].Exclude = items[0].Exclude
+	fieldsInEqualMethod++
+
+	assert.Equal(t, fieldsInEqualMethod, numberOfFields,
+		"Does cmp.Equal for ConfigurationProfileLabel needs to be updated for new/updated field(s)?")
+	assert.True(t, cmp.Equal(items[0], items[1]))
+
+}
diff --git a/server/fleet/calendar.go b/server/fleet/calendar.go
index 6f34b20051cd..b5edacc67634 100644
--- a/server/fleet/calendar.go
+++ b/server/fleet/calendar.go
@@ -11,6 +11,7 @@ import (
 
 const (
 	CalendarBodyStaticHeader   = "reserved this time to make some changes to your work computer"
+	CalendarEventConflictText  = "because there was no remaining availability "
 	CalendarDefaultDescription = "needs to make sure your device meets the organization's requirements."
 	CalendarDefaultResolution  = "During this maintenance window, you can expect updates to be applied automatically. Your device may be unavailable during this time."
 )
@@ -23,17 +24,26 @@ func (e DayEndedError) Error() string {
 	return e.Msg
 }
 
+type CalendarGenBodyFn func(conflict bool) (body string, ok bool, err error)
+
 type UserCalendar interface {
 	// Configure configures the connection to a user's calendar. Once configured,
 	// CreateEvent, GetAndUpdateEvent and DeleteEvent reference the user's calendar.
 	Configure(userEmail string) error
 	// CreateEvent creates a new event on the calendar on the given date. DayEndedError is returned if there is no time left on the given date to schedule event.
-	CreateEvent(dateOfEvent time.Time, genBodyFn func(conflict bool) (body string, ok bool, err error)) (event *CalendarEvent, err error)
+	CreateEvent(
+		dateOfEvent time.Time,
+		genBodyFn CalendarGenBodyFn,
+		opts CalendarCreateEventOpts,
+	) (event *CalendarEvent, err error)
 	// GetAndUpdateEvent retrieves the event from the calendar.
 	// If the event has been modified, it returns the updated event.
 	// If the event has been deleted, it schedules a new event with given body callback and returns the new event.
-	GetAndUpdateEvent(event *CalendarEvent, genBodyFn func(conflict bool) (body string, ok bool, err error)) (updatedEvent *CalendarEvent,
+	GetAndUpdateEvent(event *CalendarEvent, genBodyFn CalendarGenBodyFn,
+		opts CalendarGetAndUpdateEventOpts) (updatedEvent *CalendarEvent,
 		updated bool, err error)
+	// UpdateEventBody updates the body of the calendar event and returns new ETag
+	UpdateEventBody(event *CalendarEvent, genBodyFn CalendarGenBodyFn) (string, error)
 	// DeleteEvent deletes the event with the given ID.
 	DeleteEvent(event *CalendarEvent) error
 	// StopEventChannel stops the event's callback channel.
@@ -42,6 +52,37 @@ type UserCalendar interface {
 	Get(event *CalendarEvent, key string) (interface{}, error)
 }
 
+// Lock interface for managing distributed locks.
+type Lock interface {
+	// SetIfNotExist attempts to set an item with the given key. value is the value to set for the key, which is used to release the lock.
+	// expireMs is the time in milliseconds after which the lock is automatically released. expireMs=0 means a default expiration time is used.
+	// Returns true if the lock was acquired, false otherwise.
+	SetIfNotExist(ctx context.Context, key string, value string, expireMs uint64) (ok bool, err error)
+	// ReleaseLock attempts to release a lock with the given key and value. If key does not exist or value does not match, the lock is not released.
+	// Returns true if the lock was released, false otherwise.
+	ReleaseLock(ctx context.Context, key string, value string) (ok bool, err error)
+	// Get retrieves the value of the given key. If the key does not exist, nil is returned.
+	Get(ctx context.Context, key string) (*string, error)
+	// GetAndDelete retrieves the value of the given key and deletes the key. If the key does not exist, nil is returned.
+	GetAndDelete(ctx context.Context, key string) (*string, error)
+	// AddToSet adds the value to the set identified by the given key.
+	AddToSet(ctx context.Context, key string, value string) error
+	// RemoveFromSet removes the value from the set identified by the given key.
+	RemoveFromSet(ctx context.Context, key string, value string) error
+	// GetSet retrieves a slice of string values from the set identified by the given key.
+	GetSet(ctx context.Context, key string) ([]string, error)
+}
+
+type CalendarCreateEventOpts struct {
+	EventUUID  string
+	ChannelID  string
+	ResourceID string
+}
+
+type CalendarGetAndUpdateEventOpts struct {
+	UpdateTimezone bool
+}
+
 type CalendarWebhookPayload struct {
 	Timestamp        time.Time            `json:"timestamp"`
 	HostID           uint                 `json:"host_id"`
diff --git a/server/fleet/calendar_events.go b/server/fleet/calendar_events.go
index 96d5a9a93fc8..5e730e283b1f 100644
--- a/server/fleet/calendar_events.go
+++ b/server/fleet/calendar_events.go
@@ -1,6 +1,11 @@
 package fleet
 
-import "time"
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"time"
+)
 
 type CalendarEvent struct {
 	ID        uint      `db:"id"`
@@ -9,11 +14,49 @@ type CalendarEvent struct {
 	StartTime time.Time `db:"start_time"`
 	EndTime   time.Time `db:"end_time"`
 	Data      []byte    `db:"event"`
-	TimeZone  string    `db:"timezone"`
+	TimeZone  *string   `db:"timezone"` // Only nil when event existed before addition of timezone column
 
 	UpdateCreateTimestamps
 }
 
+func (ce *CalendarEvent) GetBodyTag() string {
+	type details struct {
+		BodyTag string `json:"body_tag"`
+	}
+	var d details
+	err := json.Unmarshal(ce.Data, &d)
+	if err != nil {
+		return ""
+	}
+	return d.BodyTag
+}
+
+func (ce *CalendarEvent) SaveDataItems(keysAndValues ...string) error {
+	if len(keysAndValues)%2 != 0 {
+		return errors.New("SaveDataItem requires an even number of arguments")
+	}
+	var result map[string]any
+	if len(ce.Data) > 0 {
+		err := json.Unmarshal(ce.Data, &result)
+		if err != nil {
+			return fmt.Errorf("could not unmarshal event data: %w", err)
+		}
+	} else {
+		result = make(map[string]any, 1)
+	}
+	for i := 0; i < len(keysAndValues); i += 2 {
+		key := keysAndValues[i]
+		value := keysAndValues[i+1]
+		result[key] = value
+	}
+	data, err := json.Marshal(result)
+	if err != nil {
+		return fmt.Errorf("could not marshal event data: %w", err)
+	}
+	ce.Data = data
+	return nil
+}
+
 type CalendarEventDetails struct {
 	CalendarEvent
 	TeamID *uint `db:"team_id"` // Should not be nil, but is nullable in the database
diff --git a/server/fleet/calendar_events_test.go b/server/fleet/calendar_events_test.go
new file mode 100644
index 000000000000..931cd3889fd1
--- /dev/null
+++ b/server/fleet/calendar_events_test.go
@@ -0,0 +1,40 @@
+package fleet
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSaveDataItems(t *testing.T) {
+	t.Parallel()
+
+	var event CalendarEvent
+
+	assert.Equal(t, "", event.GetBodyTag())
+
+	bodyTag := "bodyTag"
+	require.NoError(t, event.SaveDataItems("body_tag", bodyTag))
+	assert.Equal(t, bodyTag, event.GetBodyTag())
+
+	testMap := make(map[string]any, 5)
+	oldBodyTag := "oldBodyTag"
+	testMap["body_tag"] = oldBodyTag
+	testMap["key1"] = 1.2 // All JSON values are float type
+	testMap["key2"] = "abc"
+	data, err := json.Marshal(testMap)
+	require.NoError(t, err)
+	event.Data = data
+	assert.Equal(t, oldBodyTag, event.GetBodyTag())
+
+	require.NoError(t, event.SaveDataItems("body_tag", bodyTag))
+	assert.Equal(t, bodyTag, event.GetBodyTag())
+
+	// Make sure data was not modified
+	require.NoError(t, event.SaveDataItems("body_tag", oldBodyTag))
+	var result map[string]any
+	require.NoError(t, json.Unmarshal(event.Data, &result))
+	assert.Equal(t, testMap, result)
+}
diff --git a/server/fleet/capabilities.go b/server/fleet/capabilities.go
index b1bfff11397e..2e12810be8ff 100644
--- a/server/fleet/capabilities.go
+++ b/server/fleet/capabilities.go
@@ -78,6 +78,8 @@ const (
 	// CapabilityEndUserEmail denotes the ability of the server to support
 	// receiving the end-user email from orbit.
 	CapabilityEndUserEmail Capability = "end_user_email"
+	// CapabilityEscrowBuddy allows to use Escrow Buddy to rotate FileVault keys
+	CapabilityEscrowBuddy Capability = "escrow_buddy"
 )
 
 func GetServerOrbitCapabilities() CapabilityMap {
@@ -85,6 +87,7 @@ func GetServerOrbitCapabilities() CapabilityMap {
 		CapabilityOrbitEndpoints: {},
 		CapabilityTokenRotation:  {},
 		CapabilityEndUserEmail:   {},
+		CapabilityEscrowBuddy:    {},
 	}
 }
 
@@ -96,5 +99,11 @@ func GetServerDeviceCapabilities() CapabilityMap {
 	return capabilities
 }
 
+func GetOrbitClientCapabilities() CapabilityMap {
+	return CapabilityMap{
+		CapabilityEscrowBuddy: {},
+	}
+}
+
 // CapabilitiesHeader is the header name used to communicate the capabilities.
 const CapabilitiesHeader = "X-Fleet-Capabilities"
diff --git a/server/fleet/cron_schedules.go b/server/fleet/cron_schedules.go
index f6d7173ebe23..250a8dc3b5eb 100644
--- a/server/fleet/cron_schedules.go
+++ b/server/fleet/cron_schedules.go
@@ -22,6 +22,7 @@ const (
 	CronActivitiesStreaming         CronScheduleName = "activities_streaming"
 	CronMDMAppleProfileManager      CronScheduleName = "mdm_apple_profile_manager"
 	CronAppleMDMIPhoneIPadRefetcher CronScheduleName = "apple_mdm_iphone_ipad_refetcher"
+	CronAppleMDMAPNsPusher          CronScheduleName = "apple_mdm_apns_pusher"
 	CronCalendar                    CronScheduleName = "calendar"
 )
 
diff --git a/server/fleet/datastore.go b/server/fleet/datastore.go
index 664b2c919b70..2689b1114c55 100644
--- a/server/fleet/datastore.go
+++ b/server/fleet/datastore.go
@@ -195,6 +195,8 @@ type Datastore interface {
 	ListLabels(ctx context.Context, filter TeamFilter, opt ListOptions) ([]*Label, error)
 	LabelsSummary(ctx context.Context) ([]*LabelSummary, error)
 
+	GetHostUUIDsWithPendingMDMAppleCommands(ctx context.Context) ([]string, error)
+
 	// LabelQueriesForHost returns the label queries that should be executed for the given host.
 	// Results are returned in a map of label id -> query
 	LabelQueriesForHost(ctx context.Context, host *Host) (map[string]string, error)
@@ -334,7 +336,15 @@ type Datastore interface {
 
 	// ListIOSAndIPadOSToRefetch returns the UUIDs of iPhones/iPads that should be refetched (their details haven't been
 	// updated in the given `interval`).
-	ListIOSAndIPadOSToRefetch(ctx context.Context, refetchInterval time.Duration) (uuids []string, err error)
+	ListIOSAndIPadOSToRefetch(ctx context.Context, refetchInterval time.Duration) (devices []AppleDevicesToRefetch, err error)
+	// AddHostMDMCommands adds the provided MDM commands to the host to track which commands have been sent.
+	AddHostMDMCommands(ctx context.Context, commands []HostMDMCommand) error
+	// GetHostMDMCommands returns the MDM commands that have been sent to the host.
+	GetHostMDMCommands(ctx context.Context, hostID uint) (commands []HostMDMCommand, err error)
+	// RemoveHostMDMCommand removes the provided MDM command from the host, indicating that it has been processed.
+	RemoveHostMDMCommand(ctx context.Context, command HostMDMCommand) error
+	// CleanupHostMDMCommands removes invalid and stale MDM commands sent to hosts.
+	CleanupHostMDMCommands(ctx context.Context) error
 
 	// IsHostConnectedToFleetMDM verifies if the host has an active Fleet MDM enrollment with this server
 	IsHostConnectedToFleetMDM(ctx context.Context, host *Host) (bool, error)
@@ -521,7 +531,7 @@ type Datastore interface {
 	// InsertSoftwareInstallRequest tracks a new request to install the provided
 	// software installer in the host. It returns the auto-generated installation
 	// uuid.
-	InsertSoftwareInstallRequest(ctx context.Context, hostID uint, softwareTitleID uint, selfService bool) (string, error)
+	InsertSoftwareInstallRequest(ctx context.Context, hostID uint, softwareInstallerID uint, selfService bool) (string, error)
 
 	///////////////////////////////////////////////////////////////////////////////
 	// SoftwareStore
@@ -583,6 +593,10 @@ type Datastore interface {
 	// attempt on the host.
 	SetHostSoftwareInstallResult(ctx context.Context, result *HostSoftwareInstallResultPayload) error
 
+	// UploadedSoftwareExists checks if a software title with the given bundle identifier exists in
+	// the given team.
+	UploadedSoftwareExists(ctx context.Context, bundleIdentifier string, teamID *uint) (bool, error)
+
 	///////////////////////////////////////////////////////////////////////////////
 	// OperatingSystemsStore
 
@@ -665,6 +679,8 @@ type Datastore interface {
 	//	  and have a calendar event scheduled.
 	GetTeamHostsPolicyMemberships(ctx context.Context, domain string, teamID uint, policyIDs []uint,
 		hostID *uint) ([]HostPolicyMembershipData, error)
+	// GetPoliciesWithAssociatedInstaller returns team policies that have an associated installer.
+	GetPoliciesWithAssociatedInstaller(ctx context.Context, teamID uint, policyIDs []uint) ([]PolicySoftwareInstallerData, error)
 	GetCalendarPolicies(ctx context.Context, teamID uint) ([]PolicyCalendarData, error)
 
 	// Methods used for async processing of host policy query results.
@@ -690,12 +706,12 @@ type Datastore interface {
 	// Calendar events
 
 	CreateOrUpdateCalendarEvent(ctx context.Context, uuid string, email string, startTime time.Time, endTime time.Time, data []byte,
-		timeZone string, hostID uint, webhookStatus CalendarWebhookStatus) (*CalendarEvent, error)
+		timeZone *string, hostID uint, webhookStatus CalendarWebhookStatus) (*CalendarEvent, error)
 	GetCalendarEvent(ctx context.Context, email string) (*CalendarEvent, error)
 	GetCalendarEventDetailsByUUID(ctx context.Context, uuid string) (*CalendarEventDetails, error)
 	DeleteCalendarEvent(ctx context.Context, calendarEventID uint) error
 	UpdateCalendarEvent(ctx context.Context, calendarEventID uint, uuid string, startTime time.Time, endTime time.Time, data []byte,
-		timeZone string) error
+		timeZone *string) error
 	GetHostCalendarEvent(ctx context.Context, hostID uint) (*HostCalendarEvent, *CalendarEvent, error)
 	GetHostCalendarEventByEmail(ctx context.Context, email string) (*HostCalendarEvent, *CalendarEvent, error)
 	UpdateHostCalendarWebhookStatus(ctx context.Context, hostID uint, status CalendarWebhookStatus) error
@@ -859,6 +875,8 @@ type Datastore interface {
 
 	SetOrUpdateMunkiInfo(ctx context.Context, hostID uint, version string, errors, warnings []string) error
 	SetOrUpdateMDMData(ctx context.Context, hostID uint, isServer, enrolled bool, serverURL string, installedFromDep bool, name string, fleetEnrollRef string) error
+	// UpdateMDMData updates the `enrolled` field of the host with the given ID.
+	UpdateMDMData(ctx context.Context, hostID uint, enrolled bool) error
 	// SetOrUpdateHostEmailsFromMdmIdpAccounts sets or updates the host emails associated with the provided
 	// host based on the MDM IdP account information associated with the provided fleet enrollment reference.
 	SetOrUpdateHostEmailsFromMdmIdpAccounts(ctx context.Context, hostID uint, fleetEnrollmentRef string) error
@@ -877,8 +895,6 @@ type Datastore interface {
 	// GetHostDiskEncryptionKey returns the encryption key information for a given host
 	GetHostDiskEncryptionKey(ctx context.Context, hostID uint) (*HostDiskEncryptionKey, error)
 
-	SetDiskEncryptionResetStatus(ctx context.Context, hostID uint, status bool) error
-
 	// GetHostCertAssociationsToExpire retrieves host certificate
 	// associations that are close to expire and don't have a renewal in
 	// progress based on the provided arguments.
@@ -985,6 +1001,8 @@ type Datastore interface {
 	CountVulnerabilities(ctx context.Context, opt VulnListOptions) (uint, error)
 	// UpdateVulnerabilityHostCounts updates hosts counts for all vulnerabilities.
 	UpdateVulnerabilityHostCounts(ctx context.Context) error
+	// IsCVEKnownToFleet checks if the provided CVE is known to Fleet.
+	IsCVEKnownToFleet(ctx context.Context, cve string) (bool, error)
 
 	///////////////////////////////////////////////////////////////////////////////
 	// Apple MDM
@@ -1088,12 +1106,11 @@ type Datastore interface {
 
 	// UpsertMDMAppleHostDEPAssignments ensures there's an entry in
 	// `host_dep_assignments` for all the provided hosts.
-	UpsertMDMAppleHostDEPAssignments(ctx context.Context, hosts []Host) error
+	UpsertMDMAppleHostDEPAssignments(ctx context.Context, hosts []Host, abmTokenID uint) error
 
 	// IngestMDMAppleDevicesFromDEPSync creates new Fleet host records for MDM-enrolled devices that are
-	// not already enrolled in Fleet. It returns the number of hosts created, the team id that they
-	// joined (nil for no team), and an error.
-	IngestMDMAppleDevicesFromDEPSync(ctx context.Context, devices []godep.Device) (int64, *uint, error)
+	// not already enrolled in Fleet. It returns the number of hosts created, and an error.
+	IngestMDMAppleDevicesFromDEPSync(ctx context.Context, devices []godep.Device, abmTokenID uint, macOSTeam, iosTeam, ipadTeam *Team) (int64, error)
 
 	// MDMAppleUpsertHost creates or matches a Fleet host record for an
 	// MDM-enrolled device.
@@ -1146,7 +1163,9 @@ type Datastore interface {
 	// remove for each affected host to pending for the provided criteria, which
 	// may be either a list of hostIDs, teamIDs, profileUUIDs or hostUUIDs (only
 	// one of those ID types can be provided).
-	BulkSetPendingMDMHostProfiles(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string) error
+	BulkSetPendingMDMHostProfiles(ctx context.Context, hostIDs, teamIDs []uint,
+		profileUUIDs, hostUUIDs []string) (updates MDMProfilesUpdates,
+		err error)
 
 	// GetMDMAppleProfilesContents retrieves the XML contents of the
 	// profiles requested.
@@ -1179,25 +1198,32 @@ type Datastore interface {
 	// to any team).
 	GetMDMAppleFileVaultSummary(ctx context.Context, teamID *uint) (*MDMAppleFileVaultSummary, error)
 
-	// InsertMDMAppleBootstrapPackage insterts a new bootstrap package in the database
-	InsertMDMAppleBootstrapPackage(ctx context.Context, bp *MDMAppleBootstrapPackage) error
+	// InsertMDMAppleBootstrapPackage insterts a new bootstrap package in the
+	// database (or S3 if configured).
+	InsertMDMAppleBootstrapPackage(ctx context.Context, bp *MDMAppleBootstrapPackage, pkgStore MDMBootstrapPackageStore) error
 	// CopyMDMAppleBootstrapPackage copies the bootstrap package specified in the app config (if any)
 	// specified team (and a new token is assigned). It also updates the team config with the default bootstrap package URL.
 	CopyDefaultMDMAppleBootstrapPackage(ctx context.Context, ac *AppConfig, toTeamID uint) error
-	// DeleteMDMAppleBootstrapPackage deletes the bootstrap package for the given team id
+	// DeleteMDMAppleBootstrapPackage deletes the bootstrap package for the given team id.
 	DeleteMDMAppleBootstrapPackage(ctx context.Context, teamID uint) error
-	// GetMDMAppleBootstrapPackageMeta returns metadata about the bootstrap package for a team
+	// GetMDMAppleBootstrapPackageMeta returns metadata about the bootstrap
+	// package for a team.
 	GetMDMAppleBootstrapPackageMeta(ctx context.Context, teamID uint) (*MDMAppleBootstrapPackage, error)
-	// GetMDMAppleBootstrapPackageBytes returns the bytes of a bootstrap package with the given token
-	GetMDMAppleBootstrapPackageBytes(ctx context.Context, token string) (*MDMAppleBootstrapPackage, error)
-	// GetMDMAppleBootstrapPackageSummary returns an aggregated summary of
-	// the status of the bootstrap package for hosts in a team.
+	// GetMDMAppleBootstrapPackageBytes returns the bytes of a bootstrap package
+	// with the given token.
+	GetMDMAppleBootstrapPackageBytes(ctx context.Context, token string, pkgStore MDMBootstrapPackageStore) (*MDMAppleBootstrapPackage, error)
+	// GetMDMAppleBootstrapPackageSummary returns an aggregated summary of the
+	// status of the bootstrap package for hosts in a team.
 	GetMDMAppleBootstrapPackageSummary(ctx context.Context, teamID uint) (*MDMAppleBootstrapPackageSummary, error)
 
 	// RecordHostBootstrapPackage records a command used to install a
 	// bootstrap package in a host.
 	RecordHostBootstrapPackage(ctx context.Context, commandUUID string, hostUUID string) error
 
+	// CleanupUnusedBootstrapPackages will remove bootstrap packages that have no
+	// references to them from the mdm_apple_bootstrap_packages table.
+	CleanupUnusedBootstrapPackages(ctx context.Context, pkgStore MDMBootstrapPackageStore, removeCreatedBefore time.Time) error
+
 	// GetHostMDMMacOSSetup returns the MDM macOS setup information for the specified host id.
 	GetHostMDMMacOSSetup(ctx context.Context, hostID uint) (*HostMDMMacOSSetup, error)
 
@@ -1217,11 +1243,18 @@ type Datastore interface {
 	SetOrUpdateMDMAppleSetupAssistant(ctx context.Context, asst *MDMAppleSetupAssistant) (*MDMAppleSetupAssistant, error)
 	// Get the MDM Apple Setup Assistant for the provided team or no team.
 	GetMDMAppleSetupAssistant(ctx context.Context, teamID *uint) (*MDMAppleSetupAssistant, error)
+	// Get the MDM Apple Setup Assistant profile uuid and timestamp for the
+	// specified ABM token identified by organization name.
+	GetMDMAppleSetupAssistantProfileForABMToken(ctx context.Context, teamID *uint, abmTokenOrgName string) (string, time.Time, error)
 	// Delete the MDM Apple Setup Assistant for the provided team or no team.
 	DeleteMDMAppleSetupAssistant(ctx context.Context, teamID *uint) error
 	// Set the profile UUID generated by the call to Apple's DefineProfile API of
 	// the setup assistant for a team or no team.
-	SetMDMAppleSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID string) error
+	//
+	// With multi-ABM token support, this profileUUID is stored along with the
+	// ABM token used to register it. The token is identified by its organization
+	// name.
+	SetMDMAppleSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID, abmTokenOrgName string) error
 
 	// Set the profile UUID generated by the call to Apple's DefineProfile API
 	// of the default setup assistant for a team or no team. The default
@@ -1229,11 +1262,16 @@ type Datastore interface {
 	// the end-user authentication which may be configured per-team and affects
 	// the JSON registered with Apple's API, possibly resulting in different
 	// profile UUIDs for the same profile depending on the team.
-	SetMDMAppleDefaultSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID string) error
+	//
+	// With multi-ABM token support, this profileUUID is stored along with the
+	// ABM token used to register it. The token is identified by its organization
+	// name.
+	SetMDMAppleDefaultSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID, abmTokenOrgName string) error
 
 	// Get the profile UUID and last update timestamp for the default setup
-	// assistant for a team or no team.
-	GetMDMAppleDefaultSetupAssistant(ctx context.Context, teamID *uint) (profileUUID string, updatedAt time.Time, err error)
+	// assistant for a team or no team, as registered with the ABM token
+	// represented by the organization name.
+	GetMDMAppleDefaultSetupAssistant(ctx context.Context, teamID *uint, abmTokenOrgName string) (profileUUID string, updatedAt time.Time, err error)
 
 	// GetMatchingHostSerials receives a list of serial numbers and returns
 	// a map that only contains the serials that have a matching row in the `hosts` table.
@@ -1250,7 +1288,7 @@ type Datastore interface {
 	// ScreenDEPAssignProfileSerialsForCooldown returns the serials that are still in cooldown and the
 	// ones that are ready to be assigned a profile. If `screenRetryJobs` is true, it will also skip
 	// any serials that have a non-zero `retry_job_id`.
-	ScreenDEPAssignProfileSerialsForCooldown(ctx context.Context, serials []string) (skipSerials []string, assignSerials []string, err error)
+	ScreenDEPAssignProfileSerialsForCooldown(ctx context.Context, serials []string) (skipSerialsByOrgName map[string][]string, serialsByOrgName map[string][]string, err error)
 	// GetDEPAssignProfileExpiredCooldowns returns the serials of the hosts that have expired
 	// cooldowns, grouped by team.
 	GetDEPAssignProfileExpiredCooldowns(ctx context.Context) (map[uint][]string, error)
@@ -1282,6 +1320,10 @@ type Datastore interface {
 	// the provided value.
 	MDMAppleSetPendingDeclarationsAs(ctx context.Context, hostUUID string, status *MDMDeliveryStatus, detail string) error
 
+	// GetMDMAppleOSUpdatesSettingsByHostSerial returns applicable Apple OS update settings (if any)
+	// for the host with the given serial number. The host must be DEP assigned to Fleet.
+	GetMDMAppleOSUpdatesSettingsByHostSerial(ctx context.Context, hostSerial string) (*AppleOSUpdateSettings, error)
+
 	// InsertMDMConfigAssets inserts MDM related config assets, such as SCEP and APNS certs and keys.
 	InsertMDMConfigAssets(ctx context.Context, assets []MDMConfigAsset) error
 
@@ -1300,6 +1342,59 @@ type Datastore interface {
 	// DeleteMDMConfigAssetsByName soft deletes the given MDM config assets.
 	DeleteMDMConfigAssetsByName(ctx context.Context, assetNames []MDMAssetName) error
 
+	// ReplaceMDMConfigAssets replaces (soft delete if they exist + insert) `MDMConfigAsset`s in a
+	// single transaction. Useful for "renew" flows where users are updating the assets with newly
+	// generated ones.
+	ReplaceMDMConfigAssets(ctx context.Context, assets []MDMConfigAsset) error
+
+	// GetABMTokenByOrgName retrieves the Apple Business Manager token identified by
+	// its unique name (the organization name).
+	GetABMTokenByOrgName(ctx context.Context, orgName string) (*ABMToken, error)
+
+	// SaveABMToken updates the ABM token using the provided struct.
+	SaveABMToken(ctx context.Context, tok *ABMToken) error
+
+	InsertVPPToken(ctx context.Context, tok *VPPTokenData) (*VPPTokenDB, error)
+	ListVPPTokens(ctx context.Context) ([]*VPPTokenDB, error)
+	GetVPPToken(ctx context.Context, tokenID uint) (*VPPTokenDB, error)
+	GetVPPTokenByTeamID(ctx context.Context, teamID *uint) (*VPPTokenDB, error)
+	// UpdateVPPTokenTeams sets the teams associated with this token.
+	// Note that updating the token's associations removes all
+	// apps-team associations using this token
+	UpdateVPPTokenTeams(ctx context.Context, id uint, teams []uint) (*VPPTokenDB, error)
+	UpdateVPPToken(ctx context.Context, id uint, tok *VPPTokenData) (*VPPTokenDB, error)
+	DeleteVPPToken(ctx context.Context, tokenID uint) error
+
+	// SetABMTokenTermsExpiredForOrgName is a specialized method to set only the
+	// terms_expired flag of the ABM token identified by the organization name.
+	// It returns whether that flag was previously set for this token.
+	SetABMTokenTermsExpiredForOrgName(ctx context.Context, orgName string, expired bool) (wasSet bool, err error)
+
+	// CountABMTokensWithTermsExpired returns a count of ABM tokens that are
+	// flagged with the Apple BM terms expired.
+	CountABMTokensWithTermsExpired(ctx context.Context) (int, error)
+
+	// InsertABMToken inserts a new ABM token into the datastore.
+	InsertABMToken(ctx context.Context, tok *ABMToken) (*ABMToken, error)
+
+	// ListABMTokens lists all of the ABM tokens.
+	ListABMTokens(ctx context.Context) ([]*ABMToken, error)
+
+	// DeleteABMToken deletes the given ABM token from the datastore.
+	DeleteABMToken(ctx context.Context, tokenID uint) error
+
+	// GetABMTokenByID retrieves the ABM token with the given ID.
+	GetABMTokenByID(ctx context.Context, tokenID uint) (*ABMToken, error)
+
+	// GetABMTokenCount returns the number of ABM tokens in the DB.
+	GetABMTokenCount(ctx context.Context) (int, error)
+
+	// GetABMTokenOrgNamesAssociatedWithTeam returns the set of ABM organization
+	// names that correspond to the union of
+	// - the tokens used to create each of the DEP hosts in that team.
+	// - the tokens targeting that team as default for any platform.
+	GetABMTokenOrgNamesAssociatedWithTeam(ctx context.Context, teamID *uint) ([]string, error)
+
 	///////////////////////////////////////////////////////////////////////////////
 	// Microsoft MDM
 
@@ -1425,7 +1520,8 @@ type Datastore interface {
 
 	// BatchSetMDMProfiles sets the MDM Apple or Windows profiles for the given team or
 	// no team in a single transaction.
-	BatchSetMDMProfiles(ctx context.Context, tmID *uint, macProfiles []*MDMAppleConfigProfile, winProfiles []*MDMWindowsConfigProfile, macDeclarations []*MDMAppleDeclaration) error
+	BatchSetMDMProfiles(ctx context.Context, tmID *uint, macProfiles []*MDMAppleConfigProfile, winProfiles []*MDMWindowsConfigProfile,
+		macDeclarations []*MDMAppleDeclaration) (updates MDMProfilesUpdates, err error)
 
 	// NewMDMAppleDeclaration creates and returns a new MDM Apple declaration.
 	NewMDMAppleDeclaration(ctx context.Context, declaration *MDMAppleDeclaration) (*MDMAppleDeclaration, error)
@@ -1533,36 +1629,62 @@ type Datastore interface {
 	// installer execution IDs that have not yet been run for a given host
 	ListPendingSoftwareInstalls(ctx context.Context, hostID uint) ([]string, error)
 
+	// GetHostLastInstallData returns the data for the last installation of a package on a host.
+	GetHostLastInstallData(ctx context.Context, hostID, installerID uint) (*HostLastInstallData, error)
+
 	// MatchOrCreateSoftwareInstaller matches or creates a new software installer.
 	MatchOrCreateSoftwareInstaller(ctx context.Context, payload *UploadSoftwareInstallerPayload) (uint, error)
 
 	// GetSoftwareInstallerMetadataByID returns the software installer corresponding to the installer id.
 	GetSoftwareInstallerMetadataByID(ctx context.Context, id uint) (*SoftwareInstaller, error)
 
-	// GetSoftwareInstallerMetadataByTitleID returns the software installer
-	// corresponding to the specified team and title ids. If withScriptContents
-	// is true, also returns the contents of the install and (if set)
-	// post-install scripts, otherwise those fields are left empty.
+	// GetSoftwareInstallerMetadataByTeamAndTitleID returns the software
+	// installer corresponding to the specified team and title ids. If
+	// withScriptContents is true, also returns the contents of the install and
+	// (if set) post-install scripts, otherwise those fields are left empty.
 	GetSoftwareInstallerMetadataByTeamAndTitleID(ctx context.Context, teamID *uint, titleID uint, withScriptContents bool) (*SoftwareInstaller, error)
 
+	GetVPPAppByTeamAndTitleID(ctx context.Context, teamID *uint, titleID uint) (*VPPApp, error)
+	// GetVPPAppMetadataByTeamAndTitleID returns the VPP app corresponding to the
+	// specified team and title ids.
+	GetVPPAppMetadataByTeamAndTitleID(ctx context.Context, teamID *uint, titleID uint) (*VPPAppStoreApp, error)
+
 	// DeleteSoftwareInstaller deletes the software installer corresponding to the id.
 	DeleteSoftwareInstaller(ctx context.Context, id uint) error
 
-	// GetSoftwareInstallerContents returns the software install summary for the given
-	// software installer id.
+	// DeleteVPPAppFromTeam deletes the VPP app corresponding to the adamID from
+	// the provided team.
+	DeleteVPPAppFromTeam(ctx context.Context, teamID *uint, appID VPPAppID) error
+
+	// GetSummaryHostSoftwareInstalls returns the software install summary for
+	// the given software installer id.
 	GetSummaryHostSoftwareInstalls(ctx context.Context, installerID uint) (*SoftwareInstallerStatusSummary, error)
 
+	// GetSummaryHostVPPAppInstalls returns the VPP app install summary for the
+	// given team and VPP app adam_id.
+	GetSummaryHostVPPAppInstalls(ctx context.Context, teamID *uint, appID VPPAppID) (*VPPAppStatusSummary, error)
+
 	GetSoftwareInstallResults(ctx context.Context, resultsUUID string) (*HostSoftwareInstallerResult, error)
 
 	// CleanupUnusedSoftwareInstallers will remove software installers that have
 	// no references to them from the software_installers table.
-	CleanupUnusedSoftwareInstallers(ctx context.Context, softwareInstallStore SoftwareInstallerStore) error
+	CleanupUnusedSoftwareInstallers(ctx context.Context, softwareInstallStore SoftwareInstallerStore, removeCreatedBefore time.Time) error
 
 	// BatchSetSoftwareInstallers sets the software installers for the given team or no team.
-	BatchSetSoftwareInstallers(ctx context.Context, tmID *uint, installers []*UploadSoftwareInstallerPayload) error
+	BatchSetSoftwareInstallers(ctx context.Context, tmID *uint, installers []*UploadSoftwareInstallerPayload) ([]SoftwareInstaller, error)
 
 	// HasSelfServiceSoftwareInstallers returns true if self-service software installers are available for the team or globally.
 	HasSelfServiceSoftwareInstallers(ctx context.Context, platform string, teamID *uint) (bool, error)
+
+	BatchInsertVPPApps(ctx context.Context, apps []*VPPApp) error
+	GetAssignedVPPApps(ctx context.Context, teamID *uint) (map[VPPAppID]VPPAppTeam, error)
+	SetTeamVPPApps(ctx context.Context, teamID *uint, appIDs []VPPAppTeam) error
+	InsertVPPAppWithTeam(ctx context.Context, app *VPPApp, teamID *uint) (*VPPApp, error)
+
+	InsertHostVPPSoftwareInstall(ctx context.Context, hostID uint, appID VPPAppID, commandUUID, associatedEventID string, selfService bool) error
+	GetPastActivityDataForVPPAppInstall(ctx context.Context, commandResults *mdm.CommandResults) (*User, *ActivityInstalledAppStoreApp, error)
+
+	GetVPPTokenByLocation(ctx context.Context, loc string) (*VPPTokenDB, error)
 }
 
 // MDMAppleStore wraps nanomdm's storage and adds methods to deal with
@@ -1576,6 +1698,7 @@ type MDMAppleStore interface {
 
 type MDMAssetRetriever interface {
 	GetAllMDMConfigAssetsByName(ctx context.Context, assetNames []MDMAssetName) (map[MDMAssetName]MDMConfigAsset, error)
+	GetABMTokenByOrgName(ctx context.Context, orgName string) (*ABMToken, error)
 }
 
 // Cloner represents any type that can clone itself. Used for the cached_mysql
diff --git a/server/fleet/errors.go b/server/fleet/errors.go
index 484ca3683223..67c93003eec1 100644
--- a/server/fleet/errors.go
+++ b/server/fleet/errors.go
@@ -20,9 +20,10 @@ var (
 	ErrMissingLicense        = &licenseError{}
 	ErrMDMNotConfigured      = &MDMNotConfiguredError{}
 
-	MDMNotConfiguredMessage        = "MDM features aren't turned on in Fleet. For more information about setting up MDM, please visit https://fleetdm.com/docs/using-fleet"
-	WindowsMDMNotConfiguredMessage = "Windows MDM isn't turned on. Visit https://fleetdm.com/docs/using-fleet to learn how to turn on MDM."
-	AppleMDMNotConfiguredMessage   = "macOS MDM isn't turned on. Visit https://fleetdm.com/docs/using-fleet to learn how to turn on MDM."
+	MDMNotConfiguredMessage              = "MDM features aren't turned on in Fleet. For more information about setting up MDM, please visit https://fleetdm.com/docs/using-fleet"
+	WindowsMDMNotConfiguredMessage       = "Windows MDM isn't turned on. Visit https://fleetdm.com/docs/using-fleet to learn how to turn on MDM."
+	AppleMDMNotConfiguredMessage         = "macOS MDM isn't turned on. Visit https://fleetdm.com/docs/using-fleet to learn how to turn on MDM."
+	AppleABMDefaultTeamDeprecatedMessage = "mdm.apple_bm_default_team has been deprecated. Please use the new mdm.apple_business_manager key documented here: https://fleetdm.com/learn-more-about/apple-business-manager-gitops"
 )
 
 // ErrWithStatusCode is an interface for errors that should set a specific HTTP
@@ -550,8 +551,7 @@ const (
 	RunScriptScriptsDisabledGloballyErrMsg = "Running scripts is disabled in organization settings."
 	RunScriptDisabledErrMsg                = "Scripts are disabled for this host. To run scripts, deploy the fleetd agent with scripts enabled."
 	RunScriptsOrbitDisabledErrMsg          = "Couldn't run script. To run a script, deploy the fleetd agent with --enable-scripts."
-	RunScriptScriptTimeoutErrMsg           = "Timeout. Fleet stopped the script after 5 minutes to protect host performance."
-	RunScriptAsyncScriptEnqueuedErrMsg     = "Script is running or will run when the host comes online."
+	RunScriptAsyncScriptEnqueuedMsg        = "Script is running or will run when the host comes online."
 	RunScripSavedMaxLenErrMsg              = "Script is too large. It's limited to 500,000 characters (approximately 10,000 lines)."
 	RunScripUnsavedMaxLenErrMsg            = "Script is too large. It's limited to 10,000 characters (approximately 125 lines)."
 	RunScriptGatewayTimeoutErrMsg          = "Gateway timeout. Fleet didn't hear back from the host and doesn't know if the script ran. Please make sure your load balancer timeout isn't shorter than the Fleet server timeout."
diff --git a/server/fleet/hosts.go b/server/fleet/hosts.go
index 8d7bd6fac43c..2f07240b1682 100644
--- a/server/fleet/hosts.go
+++ b/server/fleet/hosts.go
@@ -7,6 +7,8 @@ import (
 	"fmt"
 	"strings"
 	"time"
+
+	"github.com/Masterminds/semver"
 )
 
 type HostStatus string
@@ -321,10 +323,6 @@ type Host struct {
 	// omitted if we don't have encryption information yet.
 	DiskEncryptionEnabled *bool `json:"disk_encryption_enabled,omitempty" db:"disk_encryption_enabled" csv:"-"`
 
-	// DiskEncryptionResetRequested is only fetched when loading a host by
-	// orbit_node_key, and so it's not used in the UI.
-	DiskEncryptionResetRequested *bool `json:"disk_encryption_reset_requested,omitempty" db:"disk_encryption_reset_requested" csv:"-"`
-
 	HostIssues `json:"issues,omitempty" csv:"-"`
 
 	// DeviceMapping is in fact included in the CSV export, but it is not directly
@@ -574,11 +572,7 @@ func (d *MDMHostData) PopulateOSSettingsAndMacOSSettings(profiles []HostMDMApple
 					// but either we didn't get an encryption key or we're not able to
 					// decrypt the key we've got
 					settings.DiskEncryption = DiskEncryptionActionRequired.addrOf()
-					if *d.rawDecryptable == 0 {
-						settings.ActionRequired = ActionRequiredRotateKey.addrOf()
-					} else {
-						settings.ActionRequired = ActionRequiredLogOut.addrOf()
-					}
+					settings.ActionRequired = ActionRequiredRotateKey.addrOf()
 				} else {
 					// if [a FileVault profile is pending to be installed or] the
 					// matching row in host_disk_encryption_keys has a field decryptable
@@ -745,7 +739,7 @@ type HostMaintenanceWindow struct {
 	//  StartsAt is the start time of the future maintenance window, retrieved from calendar_events,
 	//  represented as a time.Time in the host's associated google calendar user's timezone, which is represented as a time.Location
 	StartsAt time.Time `json:"starts_at" db:"start_time"`
-	// TimeZone is the IANA timezone of the user's google calendar, retrieved from calendar_evants
+	// TimeZone is the IANA timezone of the user's google calendar, retrieved from calendar_events
 	TimeZone *string `json:"timezone" db:"timezone"`
 }
 
@@ -1231,18 +1225,45 @@ func IsEligibleForDEPMigration(host *Host, mdmInfo *HostMDM, isConnectedToFleetM
 		(!isConnectedToFleetMDM || mdmInfo.Name != WellKnownMDMFleet)
 }
 
-// IsEligibleForBitLockerEncryption checks if the host needs to enforce disk
-// encryption using Fleet MDM features.
-func IsEligibleForBitLockerEncryption(h *Host, mdmInfo *HostMDM, isConnectedToFleetMDM bool) bool {
-	isServer := mdmInfo != nil && mdmInfo.IsServer
-	isWindows := h.FleetPlatform() == "windows"
-	needsEncryption := h.DiskEncryptionEnabled != nil && !*h.DiskEncryptionEnabled
-	encryptedWithoutKey := h.DiskEncryptionEnabled != nil && *h.DiskEncryptionEnabled && !h.MDM.EncryptionKeyAvailable
+var macOSADEMigrationOnlyLastVersion = semver.MustParse("14")
 
-	return isWindows &&
-		h.IsOsqueryEnrolled() &&
-		isConnectedToFleetMDM &&
-		!isServer &&
+// IsEligibleForManualMigration returns true if the host is manually enrolled into a 3rd party MDM
+// and is able to migrate to Fleet.
+func IsEligibleForManualMigration(host *Host, mdmInfo *HostMDM, isConnectedToFleetMDM bool) (bool, error) {
+	goodVersion, err := IsMacOSMajorVersionOK(host)
+	if err != nil {
+		return false, fmt.Errorf("checking macOS version for manual migration eligibility: %w", err)
+	}
+
+	return goodVersion &&
+		host.IsOsqueryEnrolled() &&
+		!host.IsDEPAssignedToFleet() &&
 		mdmInfo != nil &&
-		(needsEncryption || encryptedWithoutKey)
+		!mdmInfo.InstalledFromDep &&
+		!mdmInfo.HasJSONProfileAssigned() &&
+		mdmInfo.Enrolled &&
+		(!isConnectedToFleetMDM || mdmInfo.Name != WellKnownMDMFleet), nil
+}
+
+func IsMacOSMajorVersionOK(host *Host) (bool, error) {
+	if host == nil {
+		return false, nil
+	}
+
+	parts := strings.Split(host.OSVersion, " ")
+
+	if len(parts) < 2 || parts[0] != "macOS" {
+		return false, nil
+	}
+
+	version, err := semver.NewVersion(parts[1])
+	if err != nil {
+		return false, fmt.Errorf("parsing macOS version \"%s\": %w", parts[1], err)
+	}
+
+	if version.GreaterThan(macOSADEMigrationOnlyLastVersion) {
+		return true, nil
+	}
+
+	return false, nil
 }
diff --git a/server/fleet/hosts_test.go b/server/fleet/hosts_test.go
index e350d701cd30..49c781e81f44 100644
--- a/server/fleet/hosts_test.go
+++ b/server/fleet/hosts_test.go
@@ -214,50 +214,6 @@ func TestMDMEnrollmentStatus(t *testing.T) {
 	}
 }
 
-func TestIsEligibleForBitLockerEncryption(t *testing.T) {
-	require.False(t, IsEligibleForBitLockerEncryption(&Host{}, &HostMDM{}, false))
-
-	hostThatNeedsEnforcement := &Host{
-		Platform:      "windows",
-		OsqueryHostID: ptr.String("test"),
-		MDM: MDMHostData{
-			EncryptionKeyAvailable: false,
-		},
-		DiskEncryptionEnabled: ptr.Bool(false),
-	}
-	hostThatNeedsEnforcementMdmInfo := &HostMDM{
-		Name:             WellKnownMDMFleet,
-		Enrolled:         true,
-		IsServer:         false,
-		InstalledFromDep: true,
-	}
-	require.True(t, IsEligibleForBitLockerEncryption(hostThatNeedsEnforcement, hostThatNeedsEnforcementMdmInfo, true))
-
-	// macOS hosts are not elegible
-	hostThatNeedsEnforcement.Platform = "darwin"
-	require.False(t, IsEligibleForBitLockerEncryption(hostThatNeedsEnforcement, hostThatNeedsEnforcementMdmInfo, true))
-	hostThatNeedsEnforcement.Platform = "windows"
-	require.True(t, IsEligibleForBitLockerEncryption(hostThatNeedsEnforcement, hostThatNeedsEnforcementMdmInfo, true))
-
-	// hosts with disk encryption already enabled are elegible only if we
-	// can't decrypt the key
-	hostThatNeedsEnforcement.DiskEncryptionEnabled = ptr.Bool(true)
-	require.True(t, IsEligibleForBitLockerEncryption(hostThatNeedsEnforcement, hostThatNeedsEnforcementMdmInfo, true))
-	hostThatNeedsEnforcement.MDM.EncryptionKeyAvailable = true
-	require.False(t, IsEligibleForBitLockerEncryption(hostThatNeedsEnforcement, hostThatNeedsEnforcementMdmInfo, true))
-
-	hostThatNeedsEnforcement.DiskEncryptionEnabled = ptr.Bool(false)
-	hostThatNeedsEnforcement.MDM.EncryptionKeyAvailable = false
-	require.True(t, IsEligibleForBitLockerEncryption(hostThatNeedsEnforcement, hostThatNeedsEnforcementMdmInfo, true))
-
-	// hosts without MDMinfo are not elegible
-	require.False(t, IsEligibleForBitLockerEncryption(hostThatNeedsEnforcement, nil, true))
-	require.True(t, IsEligibleForBitLockerEncryption(hostThatNeedsEnforcement, hostThatNeedsEnforcementMdmInfo, true))
-
-	// hosts that are not enrolled in MDM are not elegible
-	require.False(t, IsEligibleForBitLockerEncryption(hostThatNeedsEnforcement, hostThatNeedsEnforcementMdmInfo, false))
-}
-
 func TestIsEligibleForDEPMigration(t *testing.T) {
 	testCases := []struct {
 		name                    string
@@ -266,6 +222,8 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 		depProfileResponse      DEPAssignProfileResponseStatus
 		enrolledInThirdPartyMDM bool
 		expected                bool
+		expectedManual          bool
+		hostOS                  string
 	}{
 		{
 			name:                    "Eligible for DEP migration",
@@ -274,6 +232,7 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			depProfileResponse:      DEPAssignProfileResponseSuccess,
 			enrolledInThirdPartyMDM: true,
 			expected:                true,
+			expectedManual:          false,
 		},
 		{
 			name:                    "Not eligible - osqueryHostID nil",
@@ -282,6 +241,7 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			depProfileResponse:      DEPAssignProfileResponseSuccess,
 			enrolledInThirdPartyMDM: true,
 			expected:                false,
+			expectedManual:          false,
 		},
 		{
 			name:                    "Not eligible - not DEP assigned to Fleet",
@@ -290,6 +250,7 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			depProfileResponse:      DEPAssignProfileResponseSuccess,
 			enrolledInThirdPartyMDM: true,
 			expected:                false,
+			expectedManual:          false,
 		},
 		{
 			name:                    "Not eligible - not enrolled in third-party MDM",
@@ -298,6 +259,7 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			depProfileResponse:      DEPAssignProfileResponseSuccess,
 			enrolledInThirdPartyMDM: false,
 			expected:                false,
+			expectedManual:          false,
 		},
 		{
 			name:                    "Not eligible - not DEP assigned and DEP profile failed",
@@ -306,6 +268,8 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			depProfileResponse:      DEPAssignProfileResponseNotAccessible,
 			enrolledInThirdPartyMDM: true,
 			expected:                false,
+			expectedManual:          true,
+			hostOS:                  "macOS 14.5",
 		},
 		{
 			name:                    "Not eligible - DEP assigned and DEP profile failed",
@@ -314,6 +278,7 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			depProfileResponse:      DEPAssignProfileResponseFailed,
 			enrolledInThirdPartyMDM: true,
 			expected:                false,
+			expectedManual:          false,
 		},
 		{
 			name:                    "Not eligible - DEP assigned but not response yet",
@@ -322,6 +287,7 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			depProfileResponse:      "",
 			enrolledInThirdPartyMDM: true,
 			expected:                false,
+			expectedManual:          false,
 		},
 		{
 			name:                    "Not eligible - DEP assigned but not accessible",
@@ -330,6 +296,27 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			depProfileResponse:      DEPAssignProfileResponseNotAccessible,
 			enrolledInThirdPartyMDM: true,
 			expected:                false,
+			expectedManual:          false,
+		},
+		{
+			name:                    "Manual migration eligible - enrolled in 3rd party, but not DEP",
+			osqueryHostID:           ptr.String("some-id"),
+			depAssignedToFleet:      ptr.Bool(false),
+			depProfileResponse:      "",
+			enrolledInThirdPartyMDM: true,
+			expected:                false,
+			expectedManual:          true,
+			hostOS:                  "macOS 14.5",
+		},
+		{
+			name:                    "Manual migration ineligible - enrolled in 3rd party, not DEP, but OS version too low",
+			osqueryHostID:           ptr.String("some-id"),
+			depAssignedToFleet:      ptr.Bool(false),
+			depProfileResponse:      "",
+			enrolledInThirdPartyMDM: true,
+			expected:                false,
+			expectedManual:          false,
+			hostOS:                  "macOS 13.9",
 		},
 	}
 
@@ -338,6 +325,7 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			host := &Host{
 				OsqueryHostID:      tc.osqueryHostID,
 				DEPAssignedToFleet: tc.depAssignedToFleet,
+				OSVersion:          tc.hostOS,
 			}
 
 			mdmInfo := &HostMDM{
@@ -347,6 +335,9 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			}
 
 			require.Equal(t, tc.expected, IsEligibleForDEPMigration(host, mdmInfo, false))
+			manual, err := IsEligibleForManualMigration(host, mdmInfo, false)
+			require.NoError(t, err)
+			require.Equal(t, tc.expectedManual, manual)
 		})
 	}
 }
diff --git a/server/fleet/mdm.go b/server/fleet/mdm.go
index 55e0a30c351c..69df8e03237c 100644
--- a/server/fleet/mdm.go
+++ b/server/fleet/mdm.go
@@ -43,6 +43,42 @@ func (a AppleBM) AuthzType() string {
 	return "mdm_apple"
 }
 
+// TODO: during API implementation, remove AppleBM above or reconciliate those
+// two types. We'll likely need a new authz type for the ABM token.
+type ABMToken struct {
+	ID                  uint      `db:"id" json:"id"`
+	AppleID             string    `db:"apple_id" json:"apple_id"`
+	OrganizationName    string    `db:"organization_name" json:"org_name"`
+	RenewAt             time.Time `db:"renew_at" json:"renew_date"`
+	TermsExpired        bool      `db:"terms_expired" json:"terms_expired"`
+	MacOSDefaultTeamID  *uint     `db:"macos_default_team_id" json:"-"`
+	IOSDefaultTeamID    *uint     `db:"ios_default_team_id" json:"-"`
+	IPadOSDefaultTeamID *uint     `db:"ipados_default_team_id" json:"-"`
+	EncryptedToken      []byte    `db:"token" json:"-"`
+
+	// MDMServerURL is not a database field, it is computed from the AppConfig's
+	// Server URL and the static path to the MDM endpoint (using
+	// apple_mdm.ResolveAppleMDMURL).
+	MDMServerURL string `db:"-" json:"mdm_server_url"`
+
+	// the following fields are not in the abm_tokens table, they must be queried
+	// by a LEFT JOIN on the corresponding team, coalesced to "No team" if
+	// null (no team).
+	MacOSTeamName  string `db:"macos_team" json:"-"`
+	IOSTeamName    string `db:"ios_team" json:"-"`
+	IPadOSTeamName string `db:"ipados_team" json:"-"`
+
+	// These fields are composed of the ID and name fields above, and are used in API responses.
+	MacOSTeam  ABMTokenTeam `json:"macos_team"`
+	IOSTeam    ABMTokenTeam `json:"ios_team"`
+	IPadOSTeam ABMTokenTeam `json:"ipados_team"`
+}
+
+type ABMTokenTeam struct {
+	Name string `json:"name"`
+	ID   uint   `json:"team_id"`
+}
+
 type AppleCSR struct {
 	// NOTE: []byte automatically JSON-encodes as a base64-encoded string
 	APNsKey  []byte `json:"apns_key"`
@@ -54,13 +90,15 @@ func (a AppleCSR) AuthzType() string {
 	return "mdm_apple"
 }
 
-// AppConfigUpdated is the minimal interface required to get and update the
-// AppConfig, as required to handle the DEP API errors to flag that Apple's
-// terms have changed and must be accepted. The Fleet Datastore satisfies
-// this interface.
-type AppConfigUpdater interface {
+// ABMTermsUpdater is the minimal interface required to get and update the
+// AppConfig, and set an ABM token's terms_expired flag as required to handle
+// the DEP API errors to indicate that Apple's terms have changed and must be
+// accepted. The Fleet Datastore satisfies this interface.
+type ABMTermsUpdater interface {
 	AppConfig(ctx context.Context) (*AppConfig, error)
 	SaveAppConfig(ctx context.Context, info *AppConfig) error
+	SetABMTokenTermsExpiredForOrgName(ctx context.Context, orgName string, expired bool) (wasSet bool, err error)
+	CountABMTokensWithTermsExpired(ctx context.Context) (int, error)
 }
 
 // MDMIdPAccount contains account information of a third-party IdP that can be
@@ -625,12 +663,19 @@ const (
 	// MDMAssetABMCert is the name of the ABM (Apple Business Manager)
 	// private key used to encrypt MDMAssetABMToken
 	MDMAssetABMCert MDMAssetName = "abm_cert"
-	// MDMAssetABMToken is an encrypted JSON file that contains a token
-	// that can be used for the authentication process with the ABM API
-	MDMAssetABMToken MDMAssetName = "abm_token"
+	// MDMAssetABMTokenDeprecated is an encrypted JSON file that contains a token
+	// that can be used for the authentication process with the ABM API.
+	// Deprecated: ABM tokens are now stored in the abm_tokens table, they are
+	// not in mdm_config_assets anymore.
+	MDMAssetABMTokenDeprecated MDMAssetName = "abm_token"
 	// MDMAssetSCEPChallenge defines the shared secret used to issue SCEP
 	// certificatges to Apple devices.
 	MDMAssetSCEPChallenge MDMAssetName = "scep_challenge"
+	// MDMAssetVPPTokenDeprecated is the name of the token used by MDM to
+	// authenticate to Apple's VPP service.
+	// Deprecated: VPP tokens are now stored in the vpp_tokens table, they are
+	// not in mdm_config_assets anymore.
+	MDMAssetVPPTokenDeprecated MDMAssetName = "vpp_token"
 )
 
 type MDMConfigAsset struct {
@@ -693,5 +738,120 @@ func FilterMacOSOnlyProfilesFromIOSIPadOS(profiles []*MDMAppleProfilePayload) []
 	return profiles[:i]
 }
 
-// RefetchCommandUUIDPrefix is the prefix used for MDM commands used to refetch information from iOS/iPadOS devices.
-const RefetchCommandUUIDPrefix = "REFETCH-"
+// RefetchBaseCommandUUIDPrefix and below command prefixes are the prefixes used for MDM commands used to refetch information from iOS/iPadOS devices.
+const RefetchBaseCommandUUIDPrefix = "REFETCH-"
+const RefetchDeviceCommandUUIDPrefix = RefetchBaseCommandUUIDPrefix + "DEVICE-"
+const RefetchAppsCommandUUIDPrefix = RefetchBaseCommandUUIDPrefix + "APPS-"
+
+// VPPTokenInfo is the representation of the VPP token that we send out via API.
+type VPPTokenInfo struct {
+	OrgName   string `json:"org_name"`
+	RenewDate string `json:"renew_date"`
+	Location  string `json:"location"`
+}
+
+// VPPTokenRaw is the representation of the decoded JSON object that is downloaded from ABM.
+type VPPTokenRaw struct {
+	OrgName string `json:"orgName"`
+	Token   string `json:"token"`
+	ExpDate string `json:"expDate"`
+}
+
+// VPPTokenData is the VPP data we store in the DB.
+type VPPTokenData struct {
+	// Location comes from an Apple API:
+	// https://developer.apple.com/documentation/devicemanagement/client_config. It is the name of
+	// the "library" of apps in ABM that is associated with this VPP token.
+	Location string `json:"location"`
+
+	// Token is the token that is downloaded from ABM. It is a base64 encoded JSON object with the
+	// structure of `VPPTokenRaw`.
+	Token string `json:"token"`
+}
+
+const VPPTimeFormat = "2006-01-02T15:04:05Z0700"
+
+// VPPTokenDB represents a VPP token record in the DB
+type VPPTokenDB struct {
+	ID        uint      `db:"id" json:"id"`
+	OrgName   string    `db:"organization_name" json:"org_name"`
+	Location  string    `db:"location" json:"location"`
+	RenewDate time.Time `db:"renew_at" json:"renew_date"`
+	// Token is the token dowloaded from ABM. It is the base64 encoded
+	// JSON object with the structure of `VPPTokenRaw`
+	Token string      `db:"token" json:"-"`
+	Teams []TeamTuple `json:"teams"`
+	// CreatedAt    time.Time `json:"created_at" db:"created_at"`
+	// UpdatedAt    time.Time `json:"updated_at" db:"updated_at"`
+}
+
+type TeamTuple struct {
+	ID   uint   `json:"team_id"`
+	Name string `json:"name"`
+}
+
+type NullTeamType string
+
+const (
+	// VPP token is inactive, only valid option if teamID is set.
+	NullTeamNone NullTeamType = "none"
+	// VPP token is available for all teams.
+	NullTeamAllTeams NullTeamType = "allteams"
+	// VPP token is available only for "No team" team.
+	NullTeamNoTeam NullTeamType = "noteam"
+)
+
+type AppleDevice int
+
+const (
+	MacOS AppleDevice = iota
+	IOS
+	IPadOS
+)
+
+type AppleDevicePlatform string
+
+const (
+	MacOSPlatform  AppleDevicePlatform = "darwin"
+	IOSPlatform    AppleDevicePlatform = "ios"
+	IPadOSPlatform AppleDevicePlatform = "ipados"
+)
+
+var VPPAppsPlatforms = []AppleDevicePlatform{IOSPlatform, IPadOSPlatform, MacOSPlatform}
+
+type AppleDevicesToRefetch struct {
+	HostID              uint                   `db:"host_id"`
+	UUID                string                 `db:"uuid"`
+	CommandsAlreadySent MDMCommandsAlreadySent `db:"commands_already_sent"`
+}
+
+type MDMCommandsAlreadySent []string
+
+func (c *MDMCommandsAlreadySent) Scan(src interface{}) error {
+	if src == nil {
+		return nil
+	}
+
+	raw, ok := src.([]byte)
+	if !ok {
+		return fmt.Errorf("unexpected type for MDMCommandsAlreadySent: %T", src)
+	}
+	// Filter out [null] command types which MySQL returns when there are no commands_already_sent.
+	// For details, see: https://dev.mysql.com/doc/refman/8.4/en/aggregate-functions.html#function_json-arrayagg
+	if string(raw) == "[null]" {
+		*c = nil
+		return nil
+	}
+
+	var commands MDMCommandsAlreadySent
+	if err := json.Unmarshal(raw, &commands); err != nil {
+		return err
+	}
+	*c = commands
+	return nil
+}
+
+type HostMDMCommand struct {
+	HostID      uint   `db:"host_id"`
+	CommandType string `db:"command_type"`
+}
diff --git a/server/fleet/mdm_test.go b/server/fleet/mdm_test.go
index a1dd3d49d521..256b65be64ec 100644
--- a/server/fleet/mdm_test.go
+++ b/server/fleet/mdm_test.go
@@ -8,6 +8,7 @@ import (
 	"regexp"
 	"testing"
 
+	ctxabm "github.com/fleetdm/fleet/v4/server/contexts/apple_bm"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	fleetmdm "github.com/fleetdm/fleet/v4/server/mdm"
 	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
@@ -20,8 +21,6 @@ import (
 )
 
 func TestDEPClient(t *testing.T) {
-	ctx := context.Background()
-
 	rxToken := regexp.MustCompile(`oauth_token="(\w+)"`)
 	const (
 		validToken                 = "OK"
@@ -79,49 +78,116 @@ func TestDEPClient(t *testing.T) {
 		return nil
 	}
 
-	checkDSCalled := func(readInvoked, writeInvoked bool) {
+	termsExpiredByOrgName := map[string]bool{
+		"org1": false,
+		"org2": false,
+	}
+	ds.SetABMTokenTermsExpiredForOrgNameFunc = func(ctx context.Context, orgName string, expired bool) (wasSet bool, err error) {
+		was, ok := termsExpiredByOrgName[orgName]
+		if !ok {
+			return expired, nil
+		}
+		termsExpiredByOrgName[orgName] = expired
+		return was, nil
+	}
+	ds.CountABMTokensWithTermsExpiredFunc = func(ctx context.Context) (int, error) {
+		count := 0
+		for _, expired := range termsExpiredByOrgName {
+			if expired {
+				count++
+			}
+		}
+		return count, nil
+	}
+
+	checkDSCalled := func(readInvoked, writeTokInvoked, writeAppCfgInvoked bool) {
 		require.Equal(t, readInvoked, ds.AppConfigFuncInvoked)
-		require.Equal(t, writeInvoked, ds.SaveAppConfigFuncInvoked)
+		require.Equal(t, readInvoked, ds.CountABMTokensWithTermsExpiredFuncInvoked)
+		require.Equal(t, writeTokInvoked, ds.SetABMTokenTermsExpiredForOrgNameFuncInvoked)
+		require.Equal(t, writeAppCfgInvoked, ds.SaveAppConfigFuncInvoked)
 		ds.AppConfigFuncInvoked = false
+		ds.CountABMTokensWithTermsExpiredFuncInvoked = false
 		ds.SaveAppConfigFuncInvoked = false
+		ds.SetABMTokenTermsExpiredForOrgNameFuncInvoked = false
 	}
 
 	cases := []struct {
-		token        string
-		wantErr      bool
-		readInvoked  bool
-		writeInvoked bool
-		termsFlag    bool
+		token               string
+		orgName             string
+		wantErr             bool
+		readInvoked         bool
+		writeTokInvoked     bool
+		writeAppCfgInvoked  bool
+		wantAppCfgTermsFlag bool
+		wantToksTermsFlags  map[string]bool
 	}{
 		// use a valid token, appconfig should not be updated (already unflagged)
-		{token: validToken, wantErr: false, readInvoked: true, writeInvoked: false, termsFlag: false},
+		{token: validToken, orgName: "org1", wantErr: false, readInvoked: true, writeTokInvoked: false,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: false, wantToksTermsFlags: map[string]bool{"org1": false, "org2": false}},
+
+		// use a valid token without org, nothing is checked
+		{token: validToken, orgName: "", wantErr: false, readInvoked: false, writeTokInvoked: false,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: false, wantToksTermsFlags: map[string]bool{"org1": false, "org2": false}},
+
+		// use an invalid token without org, call fails but nothing is checked because this is an unsaved token
+		{token: invalidToken, orgName: "", wantErr: true, readInvoked: false, writeTokInvoked: false,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: false, wantToksTermsFlags: map[string]bool{"org1": false, "org2": false}},
 
 		// use an invalid token, appconfig should not even be read (not a terms error)
-		{token: invalidToken, wantErr: true, readInvoked: false, writeInvoked: false, termsFlag: false},
+		{token: invalidToken, orgName: "org1", wantErr: true, readInvoked: false, writeTokInvoked: false,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: false, wantToksTermsFlags: map[string]bool{"org1": false, "org2": false}},
 
-		// terms changed during the auth request
-		{token: termsChangedToken, wantErr: true, readInvoked: true, writeInvoked: true, termsFlag: true},
+		// terms changed for org1 during the auth request
+		{token: termsChangedToken, orgName: "org1", wantErr: true, readInvoked: true, writeTokInvoked: true,
+			writeAppCfgInvoked: true, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": true, "org2": false}},
 
 		// use of an invalid token does not update the flag
-		{token: invalidToken, wantErr: true, readInvoked: false, writeInvoked: false, termsFlag: true},
+		{token: invalidToken, orgName: "org1", wantErr: true, readInvoked: false, writeTokInvoked: false,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": true, "org2": false}},
+
+		// use of a valid token for org1 resets the flags
+		{token: validToken, orgName: "org1", wantErr: false, readInvoked: true, writeTokInvoked: true,
+			writeAppCfgInvoked: true, wantAppCfgTermsFlag: false, wantToksTermsFlags: map[string]bool{"org1": false, "org2": false}},
+
+		// use of a valid token again with org2 does not update anything
+		{token: validToken, orgName: "org2", wantErr: false, readInvoked: true, writeTokInvoked: false,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: false, wantToksTermsFlags: map[string]bool{"org1": false, "org2": false}},
+
+		// terms changed for org2 during the actual account request, after auth
+		{token: termsChangedAfterAuthToken, orgName: "org2", wantErr: true, readInvoked: true, writeTokInvoked: true,
+			writeAppCfgInvoked: true, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": false, "org2": true}},
 
-		// use of a valid token resets the flag
-		{token: validToken, wantErr: false, readInvoked: true, writeInvoked: true, termsFlag: false},
+		// again terms changed after auth for org2, doesn't update appConfig
+		{token: termsChangedAfterAuthToken, orgName: "org2", wantErr: true, readInvoked: true, writeTokInvoked: true,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": false, "org2": true}},
 
-		// use of a valid token again does not update the appConfig
-		{token: validToken, wantErr: false, readInvoked: true, writeInvoked: false, termsFlag: false},
+		// terms changed during auth for org2, doesn't update appConfig
+		{token: termsChangedToken, orgName: "org2", wantErr: true, readInvoked: true, writeTokInvoked: true,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": false, "org2": true}},
 
-		// terms changed during the actual account request, after auth
-		{token: termsChangedAfterAuthToken, wantErr: true, readInvoked: true, writeInvoked: true, termsFlag: true},
+		// terms changed during auth for org1, now both tokens have the flag, doesn't update appConfig
+		{token: termsChangedToken, orgName: "org1", wantErr: true, readInvoked: true, writeTokInvoked: true,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": true, "org2": true}},
 
-		// again terms changed after auth, doesn't update appConfig
-		{token: termsChangedAfterAuthToken, wantErr: true, readInvoked: true, writeInvoked: false, termsFlag: true},
+		// use a valid token without org, nothing is checked
+		{token: validToken, orgName: "", wantErr: false, readInvoked: false, writeTokInvoked: false,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": true, "org2": true}},
 
-		// terms changed during auth, doesn't update appConfig
-		{token: termsChangedToken, wantErr: true, readInvoked: true, writeInvoked: false, termsFlag: true},
+		// use an invalid token without org, call fails but nothing is checked because this is an unsaved token
+		{token: invalidToken, orgName: "", wantErr: true, readInvoked: false, writeTokInvoked: false,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": true, "org2": true}},
 
-		// valid token, resets the flag
-		{token: validToken, wantErr: false, readInvoked: true, writeInvoked: true, termsFlag: false},
+		// valid token for org1, resets that token's flag but not appConfig
+		{token: validToken, orgName: "org1", wantErr: false, readInvoked: true, writeTokInvoked: true,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": false, "org2": true}},
+
+		// valid token again for org1, still no write to appConfig
+		{token: validToken, orgName: "org1", wantErr: false, readInvoked: true, writeTokInvoked: true,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": false, "org2": true}},
+
+		// valid token again for org2, this time resets appConfig
+		{token: validToken, orgName: "org2", wantErr: false, readInvoked: true, writeTokInvoked: true,
+			writeAppCfgInvoked: true, wantAppCfgTermsFlag: false, wantToksTermsFlags: map[string]bool{"org1": false, "org2": false}},
 	}
 
 	// order of calls is important, and test must not be parallelized as it would
@@ -130,6 +196,8 @@ func TestDEPClient(t *testing.T) {
 	for i, c := range cases {
 		t.Logf("case %d", i)
 
+		ctx := context.Background()
+
 		store := &nanodep_mock.Storage{}
 		store.RetrieveAuthTokensFunc = func(ctx context.Context, name string) (*nanodep_client.OAuth1Tokens, error) {
 			return &nanodep_client.OAuth1Tokens{AccessToken: c.token}, nil
@@ -139,7 +207,14 @@ func TestDEPClient(t *testing.T) {
 		}
 
 		dep := apple_mdm.NewDEPClient(store, ds, logger)
-		res, err := dep.AccountDetail(ctx, apple_mdm.DEPName)
+		orgName := c.orgName
+		if orgName == "" {
+			// simulate using a new token, not yet saved in the DB, so we pass the
+			// token directly in the context
+			ctx = ctxabm.NewContext(ctx, &nanodep_client.OAuth1Tokens{AccessToken: c.token})
+			orgName = apple_mdm.UnsavedABMTokenOrgName
+		}
+		res, err := dep.AccountDetail(ctx, orgName)
 
 		if c.wantErr {
 			var httpErr *godep.HTTPError
@@ -162,8 +237,9 @@ func TestDEPClient(t *testing.T) {
 			require.True(t, store.RetrieveAuthTokensFuncInvoked)
 			require.True(t, store.RetrieveConfigFuncInvoked)
 		}
-		checkDSCalled(c.readInvoked, c.writeInvoked)
-		require.Equal(t, c.termsFlag, appCfg.MDM.AppleBMTermsExpired)
+		checkDSCalled(c.readInvoked, c.writeTokInvoked, c.writeAppCfgInvoked)
+		require.Equal(t, c.wantAppCfgTermsFlag, appCfg.MDM.AppleBMTermsExpired)
+		require.Equal(t, c.wantToksTermsFlags, termsExpiredByOrgName)
 	}
 }
 
diff --git a/server/fleet/nudge.go b/server/fleet/nudge.go
index 3b6f75c4ce9c..3299263bd674 100644
--- a/server/fleet/nudge.go
+++ b/server/fleet/nudge.go
@@ -44,7 +44,7 @@ type nudgeUpdateElements struct {
 	MainHeader       string `json:"mainHeader"`
 }
 
-func NewNudgeConfig(macOSUpdates MacOSUpdates) (*NudgeConfig, error) {
+func NewNudgeConfig(macOSUpdates AppleOSUpdateSettings) (*NudgeConfig, error) {
 	deadline, err := time.Parse("2006-01-02", macOSUpdates.Deadline.Value)
 	if err != nil {
 		return nil, err
diff --git a/server/fleet/orbit.go b/server/fleet/orbit.go
index 606cedf5f105..936c2678c987 100644
--- a/server/fleet/orbit.go
+++ b/server/fleet/orbit.go
@@ -39,10 +39,11 @@ type OrbitConfigNotifications struct {
 }
 
 type OrbitConfig struct {
-	Flags         json.RawMessage          `json:"command_line_startup_flags,omitempty"`
-	Extensions    json.RawMessage          `json:"extensions,omitempty"`
-	NudgeConfig   *NudgeConfig             `json:"nudge_config,omitempty"`
-	Notifications OrbitConfigNotifications `json:"notifications,omitempty"`
+	ScriptExeTimeout int                      `json:"script_execution_timeout,omitempty"`
+	Flags            json.RawMessage          `json:"command_line_startup_flags,omitempty"`
+	Extensions       json.RawMessage          `json:"extensions,omitempty"`
+	NudgeConfig      *NudgeConfig             `json:"nudge_config,omitempty"`
+	Notifications    OrbitConfigNotifications `json:"notifications,omitempty"`
 	// UpdateChannels contains the TUF channels to use on fleetd components.
 	//
 	// If UpdateChannels is nil it means the server isn't using/setting this feature.
diff --git a/server/fleet/policies.go b/server/fleet/policies.go
index 6ce5e380973a..a66ccc00a453 100644
--- a/server/fleet/policies.go
+++ b/server/fleet/policies.go
@@ -30,8 +30,44 @@ type PolicyPayload struct {
 	//
 	// Empty string targets all platforms.
 	Platform string
-	// CalendarEventsEnabled indicates whether calendar events are enabled for the policy. Only applies to team policies.
+	// CalendarEventsEnabled indicates whether calendar events are enabled for the policy.
+	//
+	// Only applies to team policies.
+	CalendarEventsEnabled bool
+	// SoftwareInstallerID is the ID of the software installer that will be installed if the policy fails.
+	//
+	// Only applies to team policies.
+	SoftwareInstallerID *uint
+}
+
+// NewTeamPolicyPayload holds data for team policy creation.
+//
+// If QueryID is not nil, then Name, Query and Description are ignored
+// (such fields are fetched from the queries table).
+type NewTeamPolicyPayload struct {
+	// QueryID allows creating a policy from an existing query.
+	//
+	// Using QueryID is the old way of creating policies.
+	// Use Query, Name and Description instead.
+	QueryID *uint
+	// Name is the name of the policy (ignored if QueryID != nil).
+	Name string
+	// Query is the policy query (ignored if QueryID != nil).
+	Query string
+	// Critical marks the policy as high impact.
+	Critical bool
+	// Description is the policy description text (ignored if QueryID != nil).
+	Description string
+	// Resolution indicates the steps needed to solve a failing policy.
+	Resolution string
+	// Platform is a comma-separated string to indicate the target platforms.
+	//
+	// Empty string targets all platforms.
+	Platform string
+	// CalendarEventsEnabled indicates whether calendar events are enabled for the policy.
 	CalendarEventsEnabled bool
+	// SoftwareTitleID is the ID of the software title that will be installed if the policy fails.
+	SoftwareTitleID *uint
 }
 
 var (
@@ -109,8 +145,15 @@ type ModifyPolicyPayload struct {
 	Platform *string `json:"platform"`
 	// Critical marks the policy as high impact.
 	Critical *bool `json:"critical" premium:"true"`
-	// CalendarEventsEnabled indicates whether calendar events are enabled for the policy. Only applies to team policies.
+	// CalendarEventsEnabled indicates whether calendar events are enabled for the policy.
+	//
+	// Only applies to team policies.
 	CalendarEventsEnabled *bool `json:"calendar_events_enabled" premium:"true"`
+	// SoftwareTitleID is the ID of the software title that will be installed if the policy fails.
+	// Value 0 will unset the current installer from the policy.
+	//
+	// Only applies to team policies.
+	SoftwareTitleID *uint `json:"software_title_id" premium:"true"`
 }
 
 // Verify verifies the policy payload is valid.
@@ -163,7 +206,8 @@ type PolicyData struct {
 	// Empty string targets all platforms.
 	Platform string `json:"platform" db:"platforms"`
 
-	CalendarEventsEnabled bool `json:"calendar_events_enabled" db:"calendar_events_enabled"`
+	CalendarEventsEnabled bool  `json:"calendar_events_enabled" db:"calendar_events_enabled"`
+	SoftwareInstallerID   *uint `json:"-" db:"software_installer_id"`
 
 	UpdateCreateTimestamps
 }
@@ -177,6 +221,14 @@ type Policy struct {
 	// FailingHostCount is the number of hosts this policy fails on.
 	FailingHostCount   uint       `json:"failing_host_count" db:"failing_host_count"`
 	HostCountUpdatedAt *time.Time `json:"host_count_updated_at" db:"host_count_updated_at"`
+
+	// InstallSoftware is used to trigger installation of a software title
+	// when this policy fails.
+	//
+	// Only applies to team policies.
+	//
+	// This field is populated from PolicyData.SoftwareInstallerID.
+	InstallSoftware *PolicySoftwareTitle `json:"install_software,omitempty"`
 }
 
 type PolicyCalendarData struct {
@@ -184,6 +236,11 @@ type PolicyCalendarData struct {
 	Name string `db:"name" json:"name"`
 }
 
+type PolicySoftwareInstallerData struct {
+	ID          uint `db:"id"`
+	InstallerID uint `db:"software_installer_id"`
+}
+
 // PolicyLite is a stripped down version of the policy.
 type PolicyLite struct {
 	ID uint `db:"id"`
@@ -232,8 +289,22 @@ type PolicySpec struct {
 	//
 	// Empty string targets all platforms.
 	Platform string `json:"platform,omitempty"`
-	// CalendarEventsEnabled indicates whether calendar events are enabled for the policy. Only applies to team policies.
+	// CalendarEventsEnabled indicates whether calendar events are enabled for the policy.
+	//
+	// Only applies to team policies.
 	CalendarEventsEnabled bool `json:"calendar_events_enabled"`
+	// SoftwareTitleID is the title ID of the installer associated with this policy.
+	// When editing a policy, if this is nil or 0 then the title ID is unset from the policy.
+	SoftwareTitleID *uint `json:"software_title_id"`
+}
+
+// PolicySoftwareTitle contains software title data for policies.
+type PolicySoftwareTitle struct {
+	// SoftwareTitleID is the ID of the title associated to the policy.
+	SoftwareTitleID uint `json:"software_title_id"`
+	// Name is the associated installer title name
+	// (not the package name, but the installed software title).
+	Name string `json:"name"`
 }
 
 // Verify verifies the policy data is valid.
diff --git a/server/fleet/scripts.go b/server/fleet/scripts.go
index bd86ce75327b..95e585aaf3df 100644
--- a/server/fleet/scripts.go
+++ b/server/fleet/scripts.go
@@ -3,6 +3,7 @@ package fleet
 import (
 	"bufio"
 	"errors"
+	"fmt"
 	"path/filepath"
 	"regexp"
 	"strings"
@@ -151,9 +152,6 @@ type HostScriptRequestPayload struct {
 
 func (r HostScriptRequestPayload) ValidateParams(waitForResult time.Duration) error {
 	if r.ScriptContents == "" && r.ScriptID == nil && r.ScriptName == "" {
-		if waitForResult <= 0 {
-			return NewInvalidArgumentError("script", `Script contents must not be empty.`)
-		}
 		return NewInvalidArgumentError("script", `One of 'script_id', 'script_contents', or 'script_name' is required.`)
 	}
 
@@ -175,16 +173,6 @@ func (r HostScriptRequestPayload) ValidateParams(waitForResult time.Duration) er
 			return NewInvalidArgumentError("script_contents", `"Only one of 'script_contents' or 'team_id' is allowed.`)
 		}
 	}
-	//
-	// TODO: script_name and team_id are only allowed for synchronous requests; they probably should be allowed for asynchronous requests too, but we need to get a product decision on this
-	if waitForResult <= 0 {
-		switch {
-		case r.ScriptName != "":
-			return NewInvalidArgumentError("script_name", `Only synchronous script execution requests can use the 'script_name' parameter.`)
-		case r.TeamID > 0:
-			return NewInvalidArgumentError("team_id", `Only synchronous script execution requests can use the 'team_id' parameter.`)
-		}
-	}
 
 	return nil
 }
@@ -195,6 +183,7 @@ type HostScriptResultPayload struct {
 	Output      string `json:"output"`
 	Runtime     int    `json:"runtime"`
 	ExitCode    int    `json:"exit_code"`
+	Timeout     int    `json:"timeout"`
 }
 
 // HostScriptResult represents a script result that was requested to execute on
@@ -218,6 +207,9 @@ type HostScriptResult struct {
 	// host. It is -1 if it was received but the script did not terminate
 	// normally (same as how Go handles this: https://pkg.go.dev/os#ProcessState.ExitCode)
 	ExitCode *int64 `json:"exit_code" db:"exit_code"`
+	// Timeout is the maximum time in seconds that the script was allowed to run
+	// at the time of execution.
+	Timeout *int `json:"timeout" db:"timeout"`
 	// CreatedAt is the creation timestamp of the script execution request. It is
 	// not returned as part of the payloads, but is used to determine if the script
 	// is too old to still expect a response from the host.
@@ -266,7 +258,7 @@ func (hsr HostScriptResult) AuthzType() string {
 // for running a script synchronously (so that fleetctl can display it) and to
 // get the script results for an execution ID (e.g. when looking at the details
 // screen of a script execution activity in the website).
-func (hsr HostScriptResult) UserMessage(hostTimeout bool) string {
+func (hsr HostScriptResult) UserMessage(hostTimeout bool, hostTimeoutValue *int) string {
 	if hostTimeout {
 		return RunScriptHostTimeoutErrMsg
 	}
@@ -277,7 +269,7 @@ func (hsr HostScriptResult) UserMessage(hostTimeout bool) string {
 		}
 
 		if !hsr.SyncRequest {
-			return RunScriptAsyncScriptEnqueuedErrMsg
+			return RunScriptAsyncScriptEnqueuedMsg
 		}
 
 		return RunScriptAlreadyRunningErrMsg
@@ -285,7 +277,7 @@ func (hsr HostScriptResult) UserMessage(hostTimeout bool) string {
 
 	switch *hsr.ExitCode {
 	case -1:
-		return RunScriptScriptTimeoutErrMsg
+		return HostScriptTimeoutMessage(hostTimeoutValue)
 	case -2:
 		return RunScriptDisabledErrMsg
 	default:
@@ -293,6 +285,16 @@ func (hsr HostScriptResult) UserMessage(hostTimeout bool) string {
 	}
 }
 
+func HostScriptTimeoutMessage(seconds *int) string {
+	var timeout int
+	if seconds == nil || *seconds == 0 {
+		timeout = int(scripts.MaxHostExecutionTime.Seconds())
+	} else {
+		timeout = *seconds
+	}
+	return fmt.Sprintf("Timeout. Fleet stopped the script after %d seconds to protect host performance.", timeout)
+}
+
 func (hsr HostScriptResult) HostTimeout(waitForResultTime time.Duration) bool {
 	return hsr.SyncRequest && hsr.ExitCode == nil && time.Now().After(hsr.CreatedAt.Add(waitForResultTime))
 }
diff --git a/server/fleet/scripts_test.go b/server/fleet/scripts_test.go
index e872eb174886..f8e92fdcee60 100644
--- a/server/fleet/scripts_test.go
+++ b/server/fleet/scripts_test.go
@@ -7,6 +7,7 @@ import (
 	"time"
 	"unicode/utf8"
 
+	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/stretchr/testify/require"
 )
 
@@ -97,7 +98,6 @@ func TestValidateShebang(t *testing.T) {
 			directExecute, err := ValidateShebang(tc.contents)
 			require.Equal(t, tc.directExecute, directExecute)
 			require.ErrorIs(t, tc.err, err)
-
 		})
 	}
 }
@@ -228,3 +228,46 @@ func TestHostTimeout(t *testing.T) {
 		})
 	}
 }
+
+func TestUserMessage(t *testing.T) {
+	hsr := HostScriptResult{}
+
+	// host timeout true
+	m := hsr.UserMessage(true, ptr.Int(0))
+	require.Equal(t, RunScriptHostTimeoutErrMsg, m)
+
+	// nil exit code with timeout
+	hsr.SyncRequest = true
+	hsr.CreatedAt = time.Now().Add(-10 * time.Minute)
+	m = hsr.UserMessage(false, ptr.Int(0))
+	require.Equal(t, RunScriptHostTimeoutErrMsg, m)
+
+	// nil exit code without timeout
+	hsr.SyncRequest = true
+	hsr.CreatedAt = time.Now().Add(-3 * time.Minute)
+	m = hsr.UserMessage(false, ptr.Int(0))
+	require.Equal(t, RunScriptAlreadyRunningErrMsg, m)
+
+	// exit code set, sync request false
+	hsr.SyncRequest = false
+	m = hsr.UserMessage(false, ptr.Int(0))
+	require.Equal(t, RunScriptAsyncScriptEnqueuedMsg, m)
+
+	// use default timeout value in err if 0
+	hsr.ExitCode = ptr.Int64(-1)
+	m = hsr.UserMessage(false, ptr.Int(0))
+	require.Equal(t, "Timeout. Fleet stopped the script after 300 seconds to protect host performance.", m)
+
+	// use default timeout value in err if nil
+	m = hsr.UserMessage(false, nil)
+	require.Equal(t, "Timeout. Fleet stopped the script after 300 seconds to protect host performance.", m)
+
+	// use provided timeout value in err
+	m = hsr.UserMessage(false, ptr.Int(30))
+	require.Equal(t, "Timeout. Fleet stopped the script after 30 seconds to protect host performance.", m)
+
+	// run script disabled error
+	hsr.ExitCode = ptr.Int64(-2)
+	m = hsr.UserMessage(false, ptr.Int(0))
+	require.Equal(t, RunScriptDisabledErrMsg, m)
+}
diff --git a/server/fleet/service.go b/server/fleet/service.go
index 27bfa5b18767..ce3aa904a94e 100644
--- a/server/fleet/service.go
+++ b/server/fleet/service.go
@@ -34,7 +34,7 @@ type EnterpriseOverrides struct {
 	DeleteMDMAppleBootstrapPackage    func(ctx context.Context, teamID *uint) error
 	MDMWindowsEnableOSUpdates         func(ctx context.Context, teamID *uint, updates WindowsUpdates) error
 	MDMWindowsDisableOSUpdates        func(ctx context.Context, teamID *uint) error
-	MDMAppleEditedMacOSUpdates        func(ctx context.Context, teamID *uint, updates MacOSUpdates) error
+	MDMAppleEditedAppleOSUpdates      func(ctx context.Context, teamID *uint, appleDevice AppleDevice, updates AppleOSUpdateSettings) error
 }
 
 type OsqueryService interface {
@@ -640,9 +640,9 @@ type Service interface {
 	// GetSoftwareInstallResults gets the results for a particular software install attempt.
 	GetSoftwareInstallResults(ctx context.Context, installUUID string) (*HostSoftwareInstallerResult, error)
 
-	// BatchSetSoftwareInstallers replaces the software installers for a
-	// specified team
-	BatchSetSoftwareInstallers(ctx context.Context, tmName string, payloads []SoftwareInstallerPayload, dryRun bool) error
+	// BatchSetSoftwareInstallers replaces the software installers for a specified team.
+	// Returns the metadata of inserted software installers.
+	BatchSetSoftwareInstallers(ctx context.Context, tmName string, payloads []SoftwareInstallerPayload, dryRun bool) ([]SoftwareInstaller, error)
 
 	// SelfServiceInstallSoftwareTitle installs a software title
 	// initiated by the user
@@ -651,13 +651,17 @@ type Service interface {
 	// HasSelfServiceSoftwareInstallers returns whether the host has self-service software installers
 	HasSelfServiceSoftwareInstallers(ctx context.Context, host *Host) (bool, error)
 
+	GetAppStoreApps(ctx context.Context, teamID *uint) ([]*VPPApp, error)
+
+	AddAppStoreApp(ctx context.Context, teamID *uint, appTeam VPPAppTeam) error
+
 	// /////////////////////////////////////////////////////////////////////////////
 	// Vulnerabilities
 
 	// ListVulnerabilities returns a list of vulnerabilities based on the provided options.
 	ListVulnerabilities(ctx context.Context, opt VulnListOptions) ([]VulnerabilityWithMetadata, *PaginationMetadata, error)
 	// ListVulnerability returns a vulnerability based on the provided CVE.
-	Vulnerability(ctx context.Context, cve string, teamID *uint, useCVSScores bool) (*VulnerabilityWithMetadata, error)
+	Vulnerability(ctx context.Context, cve string, teamID *uint, useCVSScores bool) (vuln *VulnerabilityWithMetadata, known bool, err error)
 	// CountVulnerabilities returns the number of vulnerabilities based on the provided options.
 	CountVulnerabilities(ctx context.Context, opt VulnListOptions) (uint, error)
 	// ListOSVersionsByCVE returns a list of OS versions affected by the provided CVE.
@@ -668,7 +672,7 @@ type Service interface {
 	// /////////////////////////////////////////////////////////////////////////////
 	// Team Policies
 
-	NewTeamPolicy(ctx context.Context, teamID uint, p PolicyPayload) (*Policy, error)
+	NewTeamPolicy(ctx context.Context, teamID uint, p NewTeamPolicyPayload) (*Policy, error)
 	ListTeamPolicies(ctx context.Context, teamID uint, opts ListOptions, iopts ListOptions, mergeInherited bool) (teamPolicies, inheritedPolicies []*Policy, err error)
 	DeleteTeamPolicies(ctx context.Context, teamID uint, ids []uint) ([]uint, error)
 	ModifyTeamPolicy(ctx context.Context, teamID uint, id uint, p ModifyPolicyPayload) (*Policy, error)
@@ -706,6 +710,14 @@ type Service interface {
 	UploadMDMAppleAPNSCert(ctx context.Context, cert io.ReadSeeker) error
 	DeleteMDMAppleAPNSCert(ctx context.Context) error
 
+	UploadVPPToken(ctx context.Context, token io.ReadSeeker) (*VPPTokenDB, error)
+	UpdateVPPToken(ctx context.Context, id uint, token io.ReadSeeker) (*VPPTokenDB, error)
+	UpdateVPPTokenTeams(ctx context.Context, tokenID uint, teamIDs []uint) (*VPPTokenDB, error)
+	GetVPPTokens(ctx context.Context) ([]*VPPTokenDB, error)
+	DeleteVPPToken(ctx context.Context, tokenID uint) error
+
+	BatchAssociateVPPApps(ctx context.Context, teamName string, payloads []VPPBatchPayload, dryRun bool) error
+
 	// GetHostDEPAssignment retrieves the host DEP assignment for the specified host.
 	GetHostDEPAssignment(ctx context.Context, host *Host) (*HostDEPAssignment, error)
 
@@ -785,9 +797,6 @@ type Service interface {
 	// ListMDMAppleDevices lists all the MDM enrolled Apple devices.
 	ListMDMAppleDevices(ctx context.Context) ([]MDMAppleDevice, error)
 
-	// ListMDMAppleDEPDevices lists all the devices added to this MDM server in Apple Business Manager (ABM).
-	ListMDMAppleDEPDevices(ctx context.Context) ([]MDMAppleDEPDevice, error)
-
 	// NewMDMAppleDEPKeyPair creates a public private key pair for use with the Apple MDM DEP token.
 	//
 	// Deprecated: NewMDMAppleDEPKeyPair exists only to support a deprecated endpoint.
@@ -797,12 +806,21 @@ type Service interface {
 	// private keys to use in ABM to generate an encrypted auth token.
 	GenerateABMKeyPair(ctx context.Context) (*MDMAppleDEPKeyPair, error)
 
-	// SaveABMToken reads and validates if the provided token can be
+	// UploadABMToken reads and validates if the provided token can be
 	// decrypted using the keys stored in the database, then saves the token.
-	SaveABMToken(ctx context.Context, token io.Reader) error
+	UploadABMToken(ctx context.Context, token io.Reader) (*ABMToken, error)
+
+	// ListABMTokens lists all the ABM tokens in Fleet.
+	ListABMTokens(ctx context.Context) ([]*ABMToken, error)
 
-	// DisableABM disables ABM by soft-deleting the relevant assets
-	DisableABM(ctx context.Context) error
+	// UpdateABMTokenTeams updates the default macOS, iOS, and iPadOS team IDs for a given ABM token.
+	UpdateABMTokenTeams(ctx context.Context, tokenID uint, macOSTeamID, iOSTeamID, iPadOSTeamID *uint) (*ABMToken, error)
+
+	// DeleteABMToken deletes the given ABM token.
+	DeleteABMToken(ctx context.Context, tokenID uint) error
+
+	// RenewABMToken replaces the contents of the given ABM token with the given bytes.
+	RenewABMToken(ctx context.Context, token io.Reader, tokenID uint) (*ABMToken, error)
 
 	// EnqueueMDMAppleCommand enqueues a command for execution on the given
 	// devices. Note that a deviceID is the same as a host's UUID.
@@ -909,6 +927,12 @@ type Service interface {
 
 	GetMDMManualEnrollmentProfile(ctx context.Context) ([]byte, error)
 
+	// CheckMDMAppleEnrollmentWithMinimumOSVersion checks if the minimum OS version is met for a MDM enrollment
+	CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx context.Context, m *MDMAppleMachineInfo) (*MDMAppleSoftwareUpdateRequired, error)
+
+	// GetOTAProfile gets the OTA (over-the-air) profile for a given team based on the enroll secret provided.
+	GetOTAProfile(ctx context.Context, enrollSecret string) ([]byte, error)
+
 	///////////////////////////////////////////////////////////////////////////////
 	// CronSchedulesService
 
@@ -919,8 +943,6 @@ type Service interface {
 	// for all hosts that are already marked as failing.
 	ResetAutomation(ctx context.Context, teamIDs, policyIDs []uint) error
 
-	RequestEncryptionKeyRotation(ctx context.Context, hostID uint) error
-
 	///////////////////////////////////////////////////////////////////////////////
 	// Windows MDM
 
@@ -1055,8 +1077,11 @@ type Service interface {
 
 	UploadSoftwareInstaller(ctx context.Context, payload *UploadSoftwareInstallerPayload) error
 	DeleteSoftwareInstaller(ctx context.Context, titleID uint, teamID *uint) error
-	GetSoftwareInstallerMetadata(ctx context.Context, titleID uint, teamID *uint) (*SoftwareInstaller, error)
-	DownloadSoftwareInstaller(ctx context.Context, titleID uint, teamID *uint) (*DownloadSoftwareInstallerPayload, error)
+	GenerateSoftwareInstallerToken(ctx context.Context, alt string, titleID uint, teamID *uint) (string, error)
+	GetSoftwareInstallerTokenMetadata(ctx context.Context, token string, titleID uint) (*SoftwareInstallerTokenMetadata, error)
+	GetSoftwareInstallerMetadata(ctx context.Context, skipAuthz bool, titleID uint, teamID *uint) (*SoftwareInstaller, error)
+	DownloadSoftwareInstaller(ctx context.Context, skipAuthz bool, alt string, titleID uint,
+		teamID *uint) (*DownloadSoftwareInstallerPayload, error)
 	OrbitDownloadSoftwareInstaller(ctx context.Context, installerID uint) (*DownloadSoftwareInstallerPayload, error)
 
 	// /////////////////////////////////////////////////////////////////////////////
diff --git a/server/fleet/software.go b/server/fleet/software.go
index 48f24024a388..9045d7e37559 100644
--- a/server/fleet/software.go
+++ b/server/fleet/software.go
@@ -164,12 +164,22 @@ type SoftwareTitle struct {
 	// CountsUpdatedAt is the timestamp when the hosts count
 	// was last updated for that software title
 	CountsUpdatedAt *time.Time `json:"-" db:"counts_updated_at"`
+	// SoftwareInstallersCount is 0 or 1, indicating if the software title has an
+	// installer. This is an internal field for an optimization so that the extra
+	// queries to fetch installer information is done only if necessary.
+	SoftwareInstallersCount int `json:"-" db:"software_installers_count"`
+	// VPPAppsCount is 0 or 1, indicating if the software title has a VPP app.
+	// This is an internal field for an optimization so that the extra queries to
+	// fetch app information is done only if necessary.
+	VPPAppsCount int `json:"-" db:"vpp_apps_count"`
 	// SoftwarePackage is the software installer information for this title.
 	SoftwarePackage *SoftwareInstaller `json:"software_package" db:"-"`
+	// AppStoreApp is the VPP app information for this title.
+	AppStoreApp *VPPAppStoreApp `json:"app_store_app" db:"-"`
 	// BundleIdentifier is used by Apple installers to uniquely identify
 	// the software installed. It's surfaced in software_titles to match
 	// with existing software entries.
-	BundleIdentifier *string `json:"-" db:"bundle_identifier"`
+	BundleIdentifier *string `json:"bundle_identifier,omitempty" db:"bundle_identifier"`
 }
 
 // This type is essentially the same as the above SoftwareTitle type. The only difference is that
@@ -192,20 +202,32 @@ type SoftwareTitleListResult struct {
 	// CountsUpdatedAt is the timestamp when the hosts count
 	// was last updated for that software title
 	CountsUpdatedAt *time.Time `json:"-" db:"counts_updated_at"`
-	// SoftwarePackage is the filename of the installer for this software title.
-	SoftwarePackage *string `json:"software_package" db:"software_package"`
-	// SelfService indicates if the end user can initiate the installation
-	SelfService bool `json:"self_service" db:"self_service"`
+
+	// SoftwarePackage provides software installer package information, it is
+	// only present if a software installer is available for the software title.
+	SoftwarePackage *SoftwarePackageOrApp `json:"software_package"`
+
+	// AppStoreApp provides VPP app information, it is only present if a VPP app
+	// is available for the software title.
+	AppStoreApp *SoftwarePackageOrApp `json:"app_store_app"`
+	// BundleIdentifier is used by Apple installers to uniquely identify
+	// the software installed. It's surfaced in software_titles to match
+	// with existing software entries.
+	BundleIdentifier *string `json:"bundle_identifier,omitempty" db:"bundle_identifier"`
 }
 
 type SoftwareTitleListOptions struct {
 	// ListOptions cannot be embedded in order to unmarshall with validation.
 	ListOptions ListOptions `url:"list_options"`
 
-	TeamID              *uint `query:"team_id,optional"`
-	VulnerableOnly      bool  `query:"vulnerable,optional"`
-	AvailableForInstall bool  `query:"available_for_install,optional"`
-	SelfServiceOnly     bool  `query:"self_service,optional"`
+	TeamID              *uint   `query:"team_id,optional"`
+	VulnerableOnly      bool    `query:"vulnerable,optional"`
+	AvailableForInstall bool    `query:"available_for_install,optional"`
+	SelfServiceOnly     bool    `query:"self_service,optional"`
+	KnownExploit        bool    `query:"exploit,optional"`
+	MinimumCVSS         float64 `query:"min_cvss_score,optional"`
+	MaximumCVSS         float64 `query:"max_cvss_score,optional"`
+	PackagesOnly        bool    `query:"packages_only,optional"`
 }
 
 type HostSoftwareTitleListOptions struct {
@@ -222,6 +244,11 @@ type HostSoftwareTitleListOptions struct {
 	// install (but not currently installed on the host) should be returned.
 	IncludeAvailableForInstall bool
 
+	// OnlyAvailableForInstall is set via a query argument that limits the
+	// returned software titles to only those that are available for install on
+	// the host.
+	OnlyAvailableForInstall bool `query:"available_for_install,optional"`
+
 	VulnerableOnly bool `query:"vulnerable,optional"`
 }
 
@@ -269,6 +296,9 @@ type SoftwareListOptions struct {
 	TeamID           *uint `query:"team_id,optional"`
 	VulnerableOnly   bool  `query:"vulnerable,optional"`
 	IncludeCVEScores bool
+	KnownExploit     bool    `query:"exploit,optional"`
+	MinimumCVSS      float64 `query:"min_cvss_score,optional"`
+	MaximumCVSS      float64 `query:"max_cvss_score,optional"`
 
 	// WithHostCounts indicates that the list of software should include the
 	// counts of hosts per software, and include only those software that have
@@ -395,3 +425,14 @@ func SoftwareFromOsqueryRow(name, version, source, vendor, installedPath, releas
 	}
 	return &software, nil
 }
+
+type VPPBatchPayload struct {
+	AppStoreID  string `json:"app_store_id"`
+	SelfService bool   `json:"self_service"`
+}
+
+type VPPBatchPayloadWithPlatform struct {
+	AppStoreID  string              `json:"app_store_id"`
+	SelfService bool                `json:"self_service"`
+	Platform    AppleDevicePlatform `json:"platform"`
+}
diff --git a/server/fleet/software_installer.go b/server/fleet/software_installer.go
index 8945fc38c242..1e1566fc36e1 100644
--- a/server/fleet/software_installer.go
+++ b/server/fleet/software_installer.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/fleetdm/fleet/v4/pkg/optjson"
 	"github.com/fleetdm/fleet/v4/server/ptr"
 )
 
@@ -19,7 +20,7 @@ type SoftwareInstallerStore interface {
 	Get(ctx context.Context, installerID string) (io.ReadCloser, int64, error)
 	Put(ctx context.Context, installerID string, content io.ReadSeeker) error
 	Exists(ctx context.Context, installerID string) (bool, error)
-	Cleanup(ctx context.Context, usedInstallerIDs []string) (int, error)
+	Cleanup(ctx context.Context, usedInstallerIDs []string, removeCreatedBefore time.Time) (int, error)
 }
 
 // FailingSoftwareInstallerStore is an implementation of SoftwareInstallerStore
@@ -39,7 +40,7 @@ func (FailingSoftwareInstallerStore) Exists(ctx context.Context, installerID str
 	return false, errors.New("software installer store not properly configured")
 }
 
-func (FailingSoftwareInstallerStore) Cleanup(ctx context.Context, usedInstallerIDs []string) (int, error) {
+func (FailingSoftwareInstallerStore) Cleanup(ctx context.Context, usedInstallerIDs []string, removeCreatedBefore time.Time) (int, error) {
 	// do not fail for the failing store's cleanup, as unlike the other store
 	// methods, this will be called even if software installers are otherwise not
 	// used (by the cron job).
@@ -73,11 +74,13 @@ type SoftwareInstaller struct {
 	// no team.
 	TeamID *uint `json:"team_id" db:"team_id"`
 	// TitleID is the id of the software title associated with the software installer.
-	TitleID *uint `json:"-" db:"title_id"`
+	TitleID *uint `json:"title_id" db:"title_id"`
 	// Name is the name of the software package.
 	Name string `json:"name" db:"filename"`
 	// Version is the version of the software package.
 	Version string `json:"version" db:"version"`
+	// Platform can be "darwin" (for pkgs), "windows" (for exes/msis) or "linux" (for debs).
+	Platform string `json:"platform" db:"platform"`
 	// UploadedAt is the time the software package was uploaded.
 	UploadedAt time.Time `json:"uploaded_at" db:"uploaded_at"`
 	// InstallerID is the unique identifier for the software package metadata in Fleet.
@@ -101,11 +104,13 @@ type SoftwareInstaller struct {
 	// SelfService indicates that the software can be installed by the
 	// end user without admin intervention
 	SelfService bool `json:"self_service" db:"self_service"`
+	// URL is the source URL for this installer (set when uploading via batch/gitops).
+	URL string `json:"url" db:"url"`
 }
 
 // AuthzType implements authz.AuthzTyper.
 func (s *SoftwareInstaller) AuthzType() string {
-	return "software_installer"
+	return "installable_entity"
 }
 
 // SoftwareInstallerStatusSummary represents aggregated status metrics for a software installer package.
@@ -139,6 +144,14 @@ func (s SoftwareInstallerStatus) IsValid() bool {
 	}
 }
 
+// HostLastInstallData contains data for the last installation of a package on a host.
+type HostLastInstallData struct {
+	// ExecutionID is the installation ID of the package on the host.
+	ExecutionID string `db:"execution_id"`
+	// Status is the status of the installation on the host.
+	Status *SoftwareInstallerStatus `db:"status"`
+}
+
 // HostSoftwareInstaller represents a software installer package that has been installed on a host.
 type HostSoftwareInstallerResult struct {
 	// ID is the unique numerical ID of the result assigned by the datastore.
@@ -155,8 +168,6 @@ type HostSoftwareInstallerResult struct {
 	SoftwarePackage string `json:"software_package" db:"software_package"`
 	// HostID is the ID of the host.
 	HostID uint `json:"host_id" db:"host_id"`
-	// HostDisplayName is the display name of the host.
-	HostDisplayName string `json:"host_display_name" db:"host_display_name"`
 	// Status is the status of the software installer package on the host.
 	Status SoftwareInstallerStatus `json:"status" db:"status"`
 	// Detail is the detail of the software installer package on the host. TODO: does this field
@@ -172,9 +183,6 @@ type HostSoftwareInstallerResult struct {
 	CreatedAt time.Time `json:"created_at" db:"created_at"`
 	// UpdatedAt is the time the software installer request was last updated.
 	UpdatedAt *time.Time `json:"updated_at" db:"updated_at"`
-	// HostTeamID is the team ID of the host on which this software install was attempted. This
-	// field is not sent in the response, it is only used for internal authorization.
-	HostTeamID *uint `json:"-" db:"host_team_id"`
 	// UserID is the user ID that requested the software installation on that host.
 	UserID *uint `json:"-" db:"user_id"`
 	// InstallScriptExitCode is used internally to determine the output displayed to the user.
@@ -184,6 +192,15 @@ type HostSoftwareInstallerResult struct {
 	// SelfService indicates that the installation was queued by the
 	// end user and not an administrator
 	SelfService bool `json:"self_service" db:"self_service"`
+	// HostDeletedAt indicates if the data is associated with a
+	// deleted host
+	HostDeletedAt *time.Time `json:"-" db:"host_deleted_at"`
+	// SoftwareInstallerUserID is the ID of the user that uploaded the software installer.
+	SoftwareInstallerUserID *uint `json:"-" db:"software_installer_user_id"`
+	// SoftwareInstallerUserID is the name of the user that uploaded the software installer.
+	SoftwareInstallerUserName string `json:"-" db:"software_installer_user_name"`
+	// SoftwareInstallerUserEmail is the email of the user that uploaded the software installer.
+	SoftwareInstallerUserEmail string `json:"-" db:"software_installer_user_email"`
 }
 
 const (
@@ -263,6 +280,8 @@ type UploadSoftwareInstallerPayload struct {
 	Platform          string
 	BundleIdentifier  string
 	SelfService       bool
+	UserID            uint
+	URL               string
 }
 
 // DownloadSoftwareInstallerPayload is the payload for downloading a software installer.
@@ -310,33 +329,59 @@ type HostSoftwareWithInstaller struct {
 	ID                uint                            `json:"id" db:"id"`
 	Name              string                          `json:"name" db:"name"`
 	Source            string                          `json:"source" db:"source"`
-	SelfService       *bool                           `json:"self_service,omitempty" db:"self_service"`
 	Status            *SoftwareInstallerStatus        `json:"status" db:"status"`
-	LastInstall       *HostSoftwareInstall            `json:"last_install"`
 	InstalledVersions []*HostSoftwareInstalledVersion `json:"installed_versions"`
 
-	// PackageAvailableForInstall is only present for the user-authenticated
-	// endpoint, not the device-authenticated one.
-	PackageAvailableForInstall *string `json:"package_available_for_install,omitempty" db:"package_available_for_install"`
+	// SoftwarePackage provides software installer package information, it is
+	// only present if a software installer is available for the software title.
+	SoftwarePackage *SoftwarePackageOrApp `json:"software_package"`
 
-	// Package provides software installer package information, it is only
-	// present for the device-authenticated endpoint, not for the
-	// user-authenticated one.
-	Package *DeviceSoftwarePackage `json:"package,omitempty"`
+	// AppStoreApp provides VPP app information, it is only present if a VPP app
+	// is available for the software title.
+	AppStoreApp *SoftwarePackageOrApp `json:"app_store_app"`
 }
 
-// DeviceSoftwarePackage provides information about a software installer
-// package for self-service on a device.
-type DeviceSoftwarePackage struct {
-	Name    string `json:"name"`
-	Version string `json:"version"`
+// SoftwarePackageOrApp provides information about a software installer
+// package or a VPP app.
+type SoftwarePackageOrApp struct {
+	// AppStoreID is only present for VPP apps.
+	AppStoreID string `json:"app_store_id,omitempty"`
+	// Name is only present for software installer packages.
+	Name string `json:"name,omitempty"`
+
+	Version     string               `json:"version"`
+	SelfService *bool                `json:"self_service,omitempty"`
+	IconURL     *string              `json:"icon_url"`
+	LastInstall *HostSoftwareInstall `json:"last_install"`
+	PackageURL  *string              `json:"package_url"`
+}
+
+type SoftwarePackageSpec struct {
+	URL               string                `json:"url"`
+	SelfService       bool                  `json:"self_service"`
+	PreInstallQuery   TeamSpecSoftwareAsset `json:"pre_install_query"`
+	InstallScript     TeamSpecSoftwareAsset `json:"install_script"`
+	PostInstallScript TeamSpecSoftwareAsset `json:"post_install_script"`
+}
+
+type SoftwareSpec struct {
+	Packages     optjson.Slice[SoftwarePackageSpec] `json:"packages,omitempty"`
+	AppStoreApps optjson.Slice[TeamSpecAppStoreApp] `json:"app_store_apps,omitempty"`
 }
 
 // HostSoftwareInstall represents installation of software on a host from a
 // Fleet software installer.
 type HostSoftwareInstall struct {
-	InstallUUID string    `json:"install_uuid" db:"install_id"`
-	InstalledAt time.Time `json:"installed_at" db:"installed_at"`
+	// InstallUUID is the the UUID of the script execution issued to install the related software. This
+	// field is only used if the install we're describing was for an uploaded software installer.
+	// Empty if the install was for an App Store app.
+	InstallUUID string `json:"install_uuid,omitempty"`
+
+	// CommandUUID is the UUID of the MDM command issued to install the related software. This field
+	// is only used if the install we're describing was for an App Store app.
+	// Empty if the install was for an uploaded software installer.
+	CommandUUID string    `json:"command_uuid,omitempty"`
+	InstalledAt time.Time `json:"installed_at"`
 }
 
 // HostSoftwareInstalledVersion represents a version of software installed on a
@@ -385,3 +430,11 @@ func (h *HostSoftwareInstallResultPayload) Status() SoftwareInstallerStatus {
 		return SoftwareInstallerPending
 	}
 }
+
+// SoftwareInstallerTokenMetadata is the metadata stored in Redis for a software installer token.
+type SoftwareInstallerTokenMetadata struct {
+	TitleID uint `json:"title_id"`
+	TeamID  uint `json:"team_id"`
+}
+
+const SoftwareInstallerURLMaxLength = 255
diff --git a/server/fleet/statistics.go b/server/fleet/statistics.go
index 11a7feeb66e3..0d88d52defa5 100644
--- a/server/fleet/statistics.go
+++ b/server/fleet/statistics.go
@@ -47,6 +47,16 @@ type StatisticsPayload struct {
 	StoredErrors                  json.RawMessage              `json:"storedErrors"`
 	// NumHostsNotResponding is a count of hosts that connect to Fleet successfully but fail to submit results for distributed queries.
 	NumHostsNotResponding int `json:"numHostsNotResponding"`
+	// Whether server_settings.ai_features_disabled is set to true in the config.
+	AIFeaturesDisabled bool `json:"aiFeaturesDisabled"`
+	// Whether at least one team has integrations.google_calendar.enable_calendar_events set to true
+	MaintenanceWindowsEnabled bool `json:"maintenanceWindowsEnabled"`
+	// Maintenance windows are considered "configured" if:
+	// configuration has value set for integrations.google_calendar[0].domain
+	// configuration has value set for integrations.google_calendar[0].api_key_json
+	MaintenanceWindowsConfigured bool `json:"maintenanceWindowsConfigured"`
+	// The number of hosts with Fleet desktop installed.
+	NumHostsFleetDesktopEnabled int `json:"numHostsFleetDesktopEnabled"`
 }
 
 type HostsCountByOrbitVersion struct {
diff --git a/server/fleet/teams.go b/server/fleet/teams.go
index 45febe6d904c..68cde3072dcc 100644
--- a/server/fleet/teams.go
+++ b/server/fleet/teams.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/fleetdm/fleet/v4/pkg/optjson"
 	"github.com/fleetdm/fleet/v4/server/ptr"
+	"golang.org/x/text/unicode/norm"
 )
 
 const (
@@ -16,8 +17,21 @@ const (
 	RoleObserver     = "observer"
 	RoleObserverPlus = "observer_plus"
 	RoleGitOps       = "gitops"
+	TeamNameNoTeam   = "No team"
+	TeamNameAllTeams = "All teams"
 )
 
+const (
+	ReservedNameAllTeams = "All teams"
+	ReservedNameNoTeam   = "No team"
+)
+
+// IsReservedTeamName checks if the name provided is a reserved team name
+func IsReservedTeamName(name string) bool {
+	normalizedName := norm.NFC.String(name)
+	return normalizedName == ReservedNameAllTeams || normalizedName == ReservedNameNoTeam
+}
+
 type TeamPayload struct {
 	Name               *string              `json:"name"`
 	Description        *string              `json:"description"`
@@ -33,10 +47,18 @@ type TeamPayload struct {
 // need to be able which part of the MDM config was provided in the request,
 // so the fields are pointers to structs.
 type TeamPayloadMDM struct {
-	EnableDiskEncryption optjson.Bool    `json:"enable_disk_encryption"`
-	MacOSUpdates         *MacOSUpdates   `json:"macos_updates"`
-	WindowsUpdates       *WindowsUpdates `json:"windows_updates"`
-	MacOSSetup           *MacOSSetup     `json:"macos_setup"`
+	EnableDiskEncryption optjson.Bool `json:"enable_disk_encryption"`
+
+	// MacOSUpdates defines the OS update settings for macOS devices.
+	MacOSUpdates *AppleOSUpdateSettings `json:"macos_updates"`
+	// IOSUpdates defines the OS update settings for iOS devices.
+	IOSUpdates *AppleOSUpdateSettings `json:"ios_updates"`
+	// IPadOSUpdates defines the OS update settings for iPadOS devices.
+	IPadOSUpdates *AppleOSUpdateSettings `json:"ipados_updates"`
+	// WindowsUpdates defines the OS update settings for Windows devices.
+	WindowsUpdates *WindowsUpdates `json:"windows_updates"`
+
+	MacOSSetup *MacOSSetup `json:"macos_setup"`
 }
 
 // Team is the data representation for the "Team" concept (group of hosts and
@@ -140,14 +162,14 @@ func (t *Team) UnmarshalJSON(b []byte) error {
 
 type TeamConfig struct {
 	// AgentOptions is the options for osquery and Orbit.
-	AgentOptions       *json.RawMessage                `json:"agent_options,omitempty"`
-	HostExpirySettings HostExpirySettings              `json:"host_expiry_settings"`
-	WebhookSettings    TeamWebhookSettings             `json:"webhook_settings"`
-	Integrations       TeamIntegrations                `json:"integrations"`
-	Features           Features                        `json:"features"`
-	MDM                TeamMDM                         `json:"mdm"`
-	Scripts            optjson.Slice[string]           `json:"scripts,omitempty"`
-	Software           optjson.Slice[TeamSpecSoftware] `json:"software,omitempty"`
+	AgentOptions       *json.RawMessage      `json:"agent_options,omitempty"`
+	HostExpirySettings HostExpirySettings    `json:"host_expiry_settings"`
+	WebhookSettings    TeamWebhookSettings   `json:"webhook_settings"`
+	Integrations       TeamIntegrations      `json:"integrations"`
+	Features           Features              `json:"features"`
+	MDM                TeamMDM               `json:"mdm"`
+	Scripts            optjson.Slice[string] `json:"scripts,omitempty"`
+	Software           *SoftwareSpec         `json:"software,omitempty"`
 }
 
 type TeamWebhookSettings struct {
@@ -160,20 +182,19 @@ type TeamSpecSoftwareAsset struct {
 	Path string `json:"path"`
 }
 
-type TeamSpecSoftware struct {
-	URL               string                `json:"url"`
-	SelfService       bool                  `json:"self_service"`
-	PreInstallQuery   TeamSpecSoftwareAsset `json:"pre_install_query"`
-	InstallScript     TeamSpecSoftwareAsset `json:"install_script"`
-	PostInstallScript TeamSpecSoftwareAsset `json:"post_install_script"`
+type TeamSpecAppStoreApp struct {
+	AppStoreID  string `json:"app_store_id"`
+	SelfService bool   `json:"self_service"`
 }
 
 type TeamMDM struct {
-	EnableDiskEncryption bool           `json:"enable_disk_encryption"`
-	MacOSUpdates         MacOSUpdates   `json:"macos_updates"`
-	WindowsUpdates       WindowsUpdates `json:"windows_updates"`
-	MacOSSettings        MacOSSettings  `json:"macos_settings"`
-	MacOSSetup           MacOSSetup     `json:"macos_setup"`
+	EnableDiskEncryption bool                  `json:"enable_disk_encryption"`
+	MacOSUpdates         AppleOSUpdateSettings `json:"macos_updates"`
+	IOSUpdates           AppleOSUpdateSettings `json:"ios_updates"`
+	IPadOSUpdates        AppleOSUpdateSettings `json:"ipados_updates"`
+	WindowsUpdates       WindowsUpdates        `json:"windows_updates"`
+	MacOSSettings        MacOSSettings         `json:"macos_settings"`
+	MacOSSetup           MacOSSetup            `json:"macos_setup"`
 
 	WindowsSettings WindowsSettings `json:"windows_settings"`
 	// NOTE: TeamSpecMDM must be kept in sync with TeamMDM.
@@ -224,7 +245,13 @@ func (t *TeamMDM) Copy() *TeamMDM {
 type TeamSpecMDM struct {
 	EnableDiskEncryption optjson.Bool `json:"enable_disk_encryption"`
 
-	MacOSUpdates   MacOSUpdates   `json:"macos_updates"`
+	// MacOSUpdates defines the OS update settings for macOS devices.
+	MacOSUpdates AppleOSUpdateSettings `json:"macos_updates"`
+	// IOSUpdates defines the OS update settings for iOS devices.
+	IOSUpdates AppleOSUpdateSettings `json:"ios_updates"`
+	// IPadOSUpdates defines the OS update settings for iPadOS devices.
+	IPadOSUpdates AppleOSUpdateSettings `json:"ipados_updates"`
+	// WindowsUpdates defines the OS update settings for Windows devices.
 	WindowsUpdates WindowsUpdates `json:"windows_updates"`
 
 	// A map is used for the macos settings so that we can easily detect if its
@@ -417,15 +444,15 @@ type TeamSpec struct {
 	// If the agent_options key is present but empty in the YAML, will be set to
 	// "null" (JSON null). Otherwise, if the key is present and set, it will be
 	// set to the agent options JSON object.
-	AgentOptions       json.RawMessage                 `json:"agent_options,omitempty"` // marshals as "null" if omitempty is not set
-	HostExpirySettings *HostExpirySettings             `json:"host_expiry_settings,omitempty"`
-	Secrets            *[]EnrollSecret                 `json:"secrets,omitempty"`
-	Features           *json.RawMessage                `json:"features"`
-	MDM                TeamSpecMDM                     `json:"mdm"`
-	Scripts            optjson.Slice[string]           `json:"scripts"`
-	WebhookSettings    TeamSpecWebhookSettings         `json:"webhook_settings"`
-	Integrations       TeamSpecIntegrations            `json:"integrations"`
-	Software           optjson.Slice[TeamSpecSoftware] `json:"software,omitempty"`
+	AgentOptions       json.RawMessage         `json:"agent_options,omitempty"` // marshals as "null" if omitempty is not set
+	HostExpirySettings *HostExpirySettings     `json:"host_expiry_settings,omitempty"`
+	Secrets            *[]EnrollSecret         `json:"secrets,omitempty"`
+	Features           *json.RawMessage        `json:"features"`
+	MDM                TeamSpecMDM             `json:"mdm"`
+	Scripts            optjson.Slice[string]   `json:"scripts"`
+	WebhookSettings    TeamSpecWebhookSettings `json:"webhook_settings"`
+	Integrations       TeamSpecIntegrations    `json:"integrations"`
+	Software           *SoftwareSpec           `json:"software,omitempty"`
 }
 
 type TeamSpecWebhookSettings struct {
diff --git a/server/fleet/teams_test.go b/server/fleet/teams_test.go
index 0a3533c009e8..a9de206787d2 100644
--- a/server/fleet/teams_test.go
+++ b/server/fleet/teams_test.go
@@ -269,7 +269,7 @@ func TestTeamMDMCopy(t *testing.T) {
 	t.Run("copy value fields", func(t *testing.T) {
 		tm := &TeamMDM{
 			EnableDiskEncryption: true,
-			MacOSUpdates: MacOSUpdates{
+			MacOSUpdates: AppleOSUpdateSettings{
 				MinimumVersion: optjson.SetString("10.15.4"),
 				Deadline:       optjson.SetString("2020-01-01"),
 			},
diff --git a/server/fleet/vpp.go b/server/fleet/vpp.go
new file mode 100644
index 000000000000..8c5dafa15a09
--- /dev/null
+++ b/server/fleet/vpp.go
@@ -0,0 +1,69 @@
+package fleet
+
+import (
+	"time"
+)
+
+type VPPAppID struct {
+	// AdamID is a unique identifier assigned to each app in
+	// the App Store, this value is managed by Apple.
+	AdamID   string              `db:"adam_id" json:"app_store_id"`
+	Platform AppleDevicePlatform `db:"platform" json:"platform"`
+}
+
+// VPPAppTeam contains extra metadata injected by fleet
+type VPPAppTeam struct {
+	VPPAppID
+
+	SelfService bool `db:"self_service" json:"self_service"`
+}
+
+// VPPApp represents a VPP (Volume Purchase Program) application,
+// this is used by Apple MDM to manage applications via Apple
+// Business Manager.
+type VPPApp struct {
+	VPPAppTeam
+	// BundleIdentifier is the unique bundle identifier of the
+	// Application.
+	BundleIdentifier string `db:"bundle_identifier" json:"bundle_identifier"`
+	// IconURL is the URL of this App icon
+	IconURL string `db:"icon_url" json:"icon_url"`
+	// Name is the user-facing name of this app.
+	Name string `db:"name" json:"name"`
+	// LatestVersion is the latest version of this app.
+	LatestVersion string `db:"latest_version" json:"latest_version"`
+	// TeamID is used for authorization, it must be json serialized to be available
+	// to the rego script. We don't set it outside authorization anyway, so it
+	// won't render otherwise.
+	TeamID  *uint `db:"-" json:"team_id,omitempty"`
+	TitleID uint  `db:"title_id" json:"-"`
+
+	CreatedAt time.Time `db:"created_at" json:"-"`
+	UpdatedAt time.Time `db:"updated_at" json:"-"`
+}
+
+// AuthzType implements authz.AuthzTyper.
+func (v *VPPApp) AuthzType() string {
+	return "installable_entity"
+}
+
+// VPPAppStoreApp contains the field required by the get software title
+// endpoint to represent an App Store app (VPP app).
+type VPPAppStoreApp struct {
+	VPPAppID
+	Name          string               `db:"name" json:"name"`
+	LatestVersion string               `db:"latest_version" json:"latest_version"`
+	IconURL       *string              `db:"icon_url" json:"icon_url"`
+	Status        *VPPAppStatusSummary `db:"-" json:"status"`
+	SelfService   bool                 `db:"self_service" json:"self_service"`
+}
+
+// VPPAppStatusSummary represents aggregated status metrics for a VPP app.
+type VPPAppStatusSummary struct {
+	// Installed is the number of hosts that have the VPP app installed.
+	Installed uint `json:"installed" db:"installed"`
+	// Pending is the number of hosts that have the VPP app pending installation.
+	Pending uint `json:"pending" db:"pending"`
+	// Failed is the number of hosts that have the VPP app installation failed.
+	Failed uint `json:"failed" db:"failed"`
+}
diff --git a/server/fleet/vulnerabilities.go b/server/fleet/vulnerabilities.go
index 43df27eb5d55..9e92fce4a05a 100644
--- a/server/fleet/vulnerabilities.go
+++ b/server/fleet/vulnerabilities.go
@@ -127,6 +127,7 @@ const (
 	MSRCSource
 	MacOfficeReleaseNotesSource
 	CustomSource
+	GovalDictionarySource
 )
 
 type VulnerabilityWithMetadata struct {
@@ -142,8 +143,8 @@ type VulnListOptions struct {
 	ListOptions      ListOptions `url:"list_options"`
 	IsEE             bool
 	ValidSortColumns []string
-	TeamID           uint `query:"team_id,optional"`
-	KnownExploit     bool `query:"exploit,optional"`
+	TeamID           *uint `query:"team_id,optional"`
+	KnownExploit     bool  `query:"exploit,optional"`
 }
 
 func (opt VulnListOptions) HasValidSortColumn() bool {
diff --git a/server/fleet/windows_mdm.go b/server/fleet/windows_mdm.go
index 448776500891..acc90b3a51ac 100644
--- a/server/fleet/windows_mdm.go
+++ b/server/fleet/windows_mdm.go
@@ -158,6 +158,18 @@ type MDMWindowsProfilePayload struct {
 	Retries       int                `db:"retries"`
 }
 
+func (p MDMWindowsProfilePayload) Equal(other MDMWindowsProfilePayload) bool {
+	statusEqual := p.Status == nil && other.Status == nil || p.Status != nil && other.Status != nil && *p.Status == *other.Status
+	return statusEqual &&
+		p.ProfileUUID == other.ProfileUUID &&
+		p.HostUUID == other.HostUUID &&
+		p.ProfileName == other.ProfileName &&
+		p.OperationType == other.OperationType &&
+		p.Detail == other.Detail &&
+		p.CommandUUID == other.CommandUUID &&
+		p.Retries == other.Retries
+}
+
 type MDMWindowsBulkUpsertHostProfilePayload struct {
 	ProfileUUID   string
 	ProfileName   string
diff --git a/server/live_query/live_query_test.go b/server/live_query/live_query_test.go
index f7d684963e6e..73f64593de17 100644
--- a/server/live_query/live_query_test.go
+++ b/server/live_query/live_query_test.go
@@ -3,6 +3,7 @@ package live_query
 import (
 	"context"
 	"testing"
+	"time"
 
 	"github.com/fleetdm/fleet/v4/server/datastore/redis"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -112,9 +113,14 @@ func testLiveQueryExpiredQuery(t *testing.T, store fleet.LiveQueryStore) {
 	assert.Len(t, queries, 1)
 	assert.Equal(t, map[string]string{"test": "select 1"}, queries)
 
-	activeNames, err := redigo.Strings(conn.Do("SMEMBERS", activeQueriesKey))
-	require.NoError(t, err)
-	require.Equal(t, []string{"test"}, activeNames)
+	assert.Eventually(t, func() bool {
+		activeNames, err := redigo.Strings(conn.Do("SMEMBERS", activeQueriesKey))
+		require.NoError(t, err)
+		if len(activeNames) == 1 && activeNames[0] == "test" {
+			return true
+		}
+		return false
+	}, 5*time.Second, 100*time.Millisecond)
 }
 
 func testLiveQueryOnlyExpired(t *testing.T, store fleet.LiveQueryStore) {
@@ -133,9 +139,11 @@ func testLiveQueryOnlyExpired(t *testing.T, store fleet.LiveQueryStore) {
 	require.NoError(t, err)
 	assert.Len(t, queries, 0)
 
-	activeNames, err := redigo.Strings(conn.Do("SMEMBERS", activeQueriesKey))
-	require.NoError(t, err)
-	require.Len(t, activeNames, 0)
+	assert.Eventually(t, func() bool {
+		activeNames, err := redigo.Strings(conn.Do("SMEMBERS", activeQueriesKey))
+		require.NoError(t, err)
+		return len(activeNames) == 0
+	}, 5*time.Second, 100*time.Millisecond)
 }
 
 func testLiveQueryCleanupInactive(t *testing.T, store fleet.LiveQueryStore) {
diff --git a/server/live_query/redis_live_query.go b/server/live_query/redis_live_query.go
index 8b424ba6357a..b54c1c1f3ad5 100644
--- a/server/live_query/redis_live_query.go
+++ b/server/live_query/redis_live_query.go
@@ -50,11 +50,14 @@ import (
 	"fmt"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/datastore/redis"
 	"github.com/fleetdm/fleet/v4/server/fleet"
+	kitlog "github.com/go-kit/log"
+	"github.com/go-kit/log/level"
 	redigo "github.com/gomodule/redigo/redis"
 )
 
@@ -69,12 +72,56 @@ const (
 type redisLiveQuery struct {
 	// connection pool
 	pool fleet.RedisPool
+	// in memory cache
+	cache memCache
+	// in memory cache expiration
+	cacheExpiration time.Duration
+
+	logger kitlog.Logger
+}
+
+// memCache is an in-memory cache for live queries. It stores the SQL of the
+// queries and the active queries set. It also stores the expiration time of the
+// cache.
+type memCache struct {
+	sqlCache           map[string]string
+	activeQueriesCache []string
+	cacheExp           time.Time
+	mu                 sync.RWMutex
+}
+
+// cacheIsExpired is a thread-safe method to check if the cache is expired.
+func (r *redisLiveQuery) cacheIsExpired() bool {
+	r.cache.mu.RLock()
+	defer r.cache.mu.RUnlock()
+	return r.cache.cacheExp.Before(time.Now())
+}
+
+// getSQLByCampaignID is a thread-safe method to get the SQL of a live query by its
+// campaign ID.
+func (r *redisLiveQuery) getSQLByCampaignID(campaignID string) (string, bool) {
+	r.cache.mu.RLock()
+	defer r.cache.mu.RUnlock()
+	sql, found := r.cache.sqlCache[campaignID]
+	return sql, found
 }
 
 // NewRedisQueryResults creates a new Redis implementation of the
 // QueryResultStore interface using the provided Redis connection pool.
-func NewRedisLiveQuery(pool fleet.RedisPool) *redisLiveQuery {
-	return &redisLiveQuery{pool: pool}
+func NewRedisLiveQuery(pool fleet.RedisPool, logger kitlog.Logger, memCacheExp time.Duration) *redisLiveQuery {
+	return &redisLiveQuery{
+		pool:            pool,
+		cache:           newMemCache(),
+		cacheExpiration: memCacheExp,
+		logger:          logger,
+	}
+}
+
+func newMemCache() memCache {
+	return memCache{
+		sqlCache:           make(map[string]string),
+		activeQueriesCache: make([]string, 0),
+	}
 }
 
 // generate keys for the bitfield and sql of a query - those always go in pair
@@ -147,55 +194,39 @@ func (r *redisLiveQuery) QueriesForHost(hostID uint) (map[string]string, error)
 	}
 
 	// convert the query name (campaign id) to the key name
-	for i, name := range names {
+	keyNames := make([]string, 0, len(names))
+	for _, name := range names {
 		tkey, _ := generateKeys(name)
-		names[i] = tkey
+		keyNames = append(keyNames, tkey)
 	}
 
-	keysBySlot := redis.SplitKeysBySlot(r.pool, names...)
+	keysBySlot := redis.SplitKeysBySlot(r.pool, keyNames...)
 	queries := make(map[string]string)
-	expired := make(map[string]struct{})
 	for _, qkeys := range keysBySlot {
-		if err := r.collectBatchQueriesForHost(hostID, qkeys, queries, expired); err != nil {
+		if err := r.collectBatchQueriesForHost(hostID, qkeys, queries); err != nil {
 			return nil, err
 		}
 	}
 
-	if len(expired) > 0 {
-		// a certain percentage of the time so that we don't overwhelm redis with a
-		// bunch of similar deletion commands at the same time, clean up the
-		// expired queries.
-		if time.Now().UnixNano()%cleanupExpiredQueriesModulo == 0 {
-			names := make([]string, 0, len(expired))
-			for k := range expired {
-				names = append(names, k)
-			}
-			// ignore error, best effort removal
-			_ = r.removeQueryNames(names...)
-		}
-	}
-
 	return queries, nil
 }
 
-func (r *redisLiveQuery) collectBatchQueriesForHost(hostID uint, queryKeys []string, queriesByHost map[string]string, expiredQueries map[string]struct{}) error {
+func (r *redisLiveQuery) collectBatchQueriesForHost(hostID uint, queryKeys []string, queriesByHost map[string]string) error {
 	conn := redis.ReadOnlyConn(r.pool, r.pool.Get())
 	defer conn.Close()
 
+	if r.cacheIsExpired() {
+		if err := r.loadCache(); err != nil {
+			return fmt.Errorf("load cache: %w", err)
+		}
+	}
+
 	// Pipeline redis calls to check for this host in the bitfield of the
 	// targets of the query.
 	for _, key := range queryKeys {
 		if err := conn.Send("GETBIT", key, hostID); err != nil {
 			return fmt.Errorf("getbit query targets: %w", err)
 		}
-
-		// Additionally get SQL even though we don't yet know whether this query
-		// is targeted to the host. This allows us to avoid an additional
-		// roundtrip to the Redis server and likely has little cost due to the
-		// small number of queries and limited size of SQL
-		if err := conn.Send("GET", sqlKeyPrefix+key); err != nil {
-			return fmt.Errorf("get query sql: %w", err)
-		}
 	}
 
 	// Flush calls to begin receiving results.
@@ -215,27 +246,13 @@ func (r *redisLiveQuery) collectBatchQueriesForHost(hostID uint, queryKeys []str
 			return fmt.Errorf("receive target: %w", err)
 		}
 
-		// Be sure to read SQL even if we are not going to include this query.
-		// Otherwise we will read an incorrect number of returned results from
-		// the pipeline.
-		sql, err := redigo.String(conn.Receive())
-		if err != nil {
-			if err != redigo.ErrNil {
-				return fmt.Errorf("receive sql: %w", err)
+		if targeted == 1 {
+			if sql, found := r.getSQLByCampaignID(name); found {
+				queriesByHost[name] = sql
+			} else {
+				level.Warn(r.logger).Log("msg", "live query not found in cache", "name", name)
 			}
-
-			// It is possible the livequery key has expired but was still in the set
-			// - handle this gracefully by collecting the keys to remove them from
-			// the set and keep going.
-			expiredQueries[name] = struct{}{}
-			continue
 		}
-
-		if targeted == 0 {
-			// Host not targeted with this query
-			continue
-		}
-		queriesByHost[name] = sql
 	}
 	return nil
 }
@@ -316,14 +333,96 @@ func (r *redisLiveQuery) removeQueryNames(names ...string) error {
 }
 
 func (r *redisLiveQuery) LoadActiveQueryNames() ([]string, error) {
+	// copyActiveQueries returns a copy of the active queries cache to
+	// ensure thread safety.
+	copyActiveQueries := func() []string {
+		r.cache.mu.RLock()
+		defer r.cache.mu.RUnlock()
+
+		names := make([]string, len(r.cache.activeQueriesCache))
+		copy(names, r.cache.activeQueriesCache)
+
+		return names
+	}
+
+	if !r.cacheIsExpired() {
+		return copyActiveQueries(), nil
+	}
+
+	if err := r.loadCache(); err != nil {
+		return nil, fmt.Errorf("load cache: %w", err)
+	}
+
+	return copyActiveQueries(), nil
+}
+
+func (r *redisLiveQuery) loadCache() error {
+	expiredQueries := make(map[string]struct{})
+	sqlCache := make(map[string]string)
 	conn := redis.ConfigureDoer(r.pool, r.pool.Get())
 	defer conn.Close()
 
-	names, err := redigo.Strings(conn.Do("SMEMBERS", activeQueriesKey))
+	activeIDs, err := redigo.Strings(conn.Do("SMEMBERS", activeQueriesKey))
 	if err != nil && err != redigo.ErrNil {
-		return nil, err
+		return fmt.Errorf("get active queries: %w", err)
 	}
-	return names, nil
+
+	for _, id := range activeIDs {
+		_, sqlKey := generateKeys(id)
+
+		sql, err := redigo.String(conn.Do("GET", sqlKey))
+		if err != nil {
+			if err != redigo.ErrNil {
+				return fmt.Errorf("get query sql: %w", err)
+			}
+
+			// It is possible the livequery key has expired but was still in the set
+			// - handle this gracefully by collecting the keys to remove them from
+			// the set and keep going.
+			expiredQueries[id] = struct{}{}
+			continue
+		}
+
+		sqlCache[id] = sql
+	}
+
+	// remove expired queries from the names list
+	if len(expiredQueries) > 0 {
+		trimmedIDs := make([]string, 0, len(activeIDs)-len(expiredQueries))
+		for _, name := range activeIDs {
+			if _, found := expiredQueries[name]; !found {
+				trimmedIDs = append(trimmedIDs, name)
+			}
+		}
+		activeIDs = trimmedIDs
+	}
+
+	r.cache.mu.Lock()
+	r.cache.sqlCache = sqlCache
+	r.cache.activeQueriesCache = activeIDs
+	r.cache.cacheExp = time.Now().Add(r.cacheExpiration)
+	r.cache.mu.Unlock()
+
+	if len(expiredQueries) > 0 {
+		// a certain percentage of the time so that we don't overwhelm redis with a
+		// bunch of similar deletion commands at the same time, clean up the
+		// expired queries.
+		if time.Now().UnixNano()%cleanupExpiredQueriesModulo == 0 {
+			names := make([]string, 0, len(expiredQueries))
+			for k := range expiredQueries {
+				names = append(names, k)
+			}
+
+			go func() {
+				err = r.removeQueryNames(names...)
+				if err != nil {
+					level.Warn(r.logger).Log("msg", "removing expired live queries", "err", err)
+				}
+			}()
+		}
+	}
+
+	return nil
 }
 
 func (r *redisLiveQuery) CleanupInactiveQueries(ctx context.Context, inactiveCampaignIDs []uint) error {
diff --git a/server/live_query/redis_live_query_test.go b/server/live_query/redis_live_query_test.go
index d0fe5a91cd77..75c6d2cf91bc 100644
--- a/server/live_query/redis_live_query_test.go
+++ b/server/live_query/redis_live_query_test.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/fleetdm/fleet/v4/server/datastore/redis/redistest"
 	"github.com/fleetdm/fleet/v4/server/test"
+	"github.com/go-kit/log"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -26,7 +27,7 @@ func TestRedisLiveQuery(t *testing.T) {
 
 func setupRedisLiveQuery(t *testing.T, cluster bool) *redisLiveQuery {
 	pool := redistest.SetupRedis(t, "*livequery", cluster, true, true)
-	return NewRedisLiveQuery(pool)
+	return NewRedisLiveQuery(pool, log.NewNopLogger(), 0)
 }
 
 func TestMapBitfield(t *testing.T) {
diff --git a/server/mdm/apple/AppleIncRootCertificate.cer b/server/mdm/apple/AppleIncRootCertificate.cer
new file mode 100644
index 000000000000..8a9ff247419d
Binary files /dev/null and b/server/mdm/apple/AppleIncRootCertificate.cer differ
diff --git a/server/mdm/apple/apple_bm.go b/server/mdm/apple/apple_bm.go
new file mode 100644
index 000000000000..eeb2eeddffab
--- /dev/null
+++ b/server/mdm/apple/apple_bm.go
@@ -0,0 +1,89 @@
+package apple_mdm
+
+import (
+	"context"
+	"errors"
+	"net/http"
+
+	abmctx "github.com/fleetdm/fleet/v4/server/contexts/apple_bm"
+	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/mdm/assets"
+	depclient "github.com/fleetdm/fleet/v4/server/mdm/nanodep/client"
+	"github.com/fleetdm/fleet/v4/server/mdm/nanodep/storage"
+	kitlog "github.com/go-kit/log"
+)
+
+// SetABMTokenMetadata uses the provided ABM token to fetch the associated
+// metadata and use it to update the rest of the abmToken fields (org name,
+// apple ID, renew date). It only sets the data on the struct, it does not
+// save it in the DB.
+func SetABMTokenMetadata(
+	ctx context.Context,
+	abmToken *fleet.ABMToken,
+	depStorage storage.AllDEPStorage,
+	ds fleet.Datastore,
+	logger kitlog.Logger,
+) error {
+	decryptedToken, err := assets.ABMToken(ctx, ds, abmToken.OrganizationName)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "getting ABM token")
+	}
+
+	return SetDecryptedABMTokenMetadata(ctx, abmToken, decryptedToken, depStorage, ds, logger)
+}
+
+const UnsavedABMTokenOrgName = "new_abm_token" //nolint:gosec
+
+func SetDecryptedABMTokenMetadata(
+	ctx context.Context,
+	abmToken *fleet.ABMToken,
+	decryptedToken *depclient.OAuth1Tokens,
+	depStorage storage.AllDEPStorage,
+	ds fleet.Datastore,
+	logger kitlog.Logger,
+) error {
+	depClient := NewDEPClient(depStorage, ds, logger)
+
+	orgName := abmToken.OrganizationName
+	if orgName == "" {
+		// Then this is a newly uploaded token (or one migrated from the
+		// single-token world), which will not be found in the datastore when
+		// RetrieveAuthTokens tries to find it. Set the token in the context so
+		// that downstream we know it's not in the datastore.
+		ctx = abmctx.NewContext(ctx, decryptedToken)
+		// We don't have an org name, but the depClient expects an org name, so we set this fake one.
+		orgName = UnsavedABMTokenOrgName
+	}
+
+	res, err := depClient.AccountDetail(ctx, orgName)
+	if err != nil {
+		var authErr *depclient.AuthError
+		if errors.As(err, &authErr) {
+			// authentication failure with 401 unauthorized means that the configured
+			// Apple BM certificate and/or token are invalid. Fail with a 400 Bad
+			// Request.
+			msg := err.Error()
+			if authErr.StatusCode == http.StatusUnauthorized {
+				msg = "The Apple Business Manager certificate or server token is invalid. Restart Fleet with a valid certificate and token. See https://fleetdm.com/learn-more-about/setup-abm for help."
+			}
+			return ctxerr.Wrap(ctx, &fleet.BadRequestError{
+				Message:     msg,
+				InternalErr: err,
+			}, "apple GET /account request failed with authentication error")
+		}
+		return ctxerr.Wrap(ctx, err, "apple GET /account request failed")
+	}
+
+	if res.AdminID == "" {
+		// fallback to facilitator ID, as this is the same information but for
+		// older versions of the Apple API.
+		// https://github.com/fleetdm/fleet/issues/7515#issuecomment-1346579398
+		res.AdminID = res.FacilitatorID
+	}
+
+	abmToken.OrganizationName = res.OrgName
+	abmToken.AppleID = res.AdminID
+	abmToken.RenewAt = decryptedToken.AccessTokenExpiry.UTC()
+	return nil
+}
diff --git a/server/mdm/apple/apple_mdm.go b/server/mdm/apple/apple_mdm.go
index 4faa9af1bee0..4925202507de 100644
--- a/server/mdm/apple/apple_mdm.go
+++ b/server/mdm/apple/apple_mdm.go
@@ -4,14 +4,15 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
-	"encoding/xml"
 	"fmt"
 	"net/url"
+	"slices"
 	"strings"
 	"text/template"
 	"time"
 
 	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
+	ctxabm "github.com/fleetdm/fleet/v4/server/contexts/apple_bm"
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/logging"
@@ -21,18 +22,14 @@ import (
 	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/go-kit/log/level"
 	"github.com/google/uuid"
+	"github.com/hashicorp/go-multierror"
 
+	depclient "github.com/fleetdm/fleet/v4/server/mdm/nanodep/client"
 	nanodep_storage "github.com/fleetdm/fleet/v4/server/mdm/nanodep/storage"
 	depsync "github.com/fleetdm/fleet/v4/server/mdm/nanodep/sync"
 	kitlog "github.com/go-kit/log"
 )
 
-// DEPName is the identifier/name used in nanodep MySQL storage which
-// holds the DEP configuration.
-//
-// Fleet uses only one DEP configuration set for the whole deployment.
-const DEPName = "fleet"
-
 const (
 	// SCEPPath is Fleet's HTTP path for the SCEP service.
 	SCEPPath = "/mdm/apple/scep"
@@ -80,7 +77,7 @@ func ResolveAppleSCEPURL(serverURL string) (string, error) {
 type DEPService struct {
 	ds         fleet.Datastore
 	depStorage nanodep_storage.AllDEPStorage
-	syncer     *depsync.Syncer
+	depClient  *godep.Client
 	logger     kitlog.Logger
 }
 
@@ -147,36 +144,48 @@ func (d *DEPService) createDefaultAutomaticProfile(ctx context.Context) error {
 // setupAsst is nil, the default profile is registered. It assigns the
 // up-to-date dynamic settings such as the server URL and MDM SSO URL if
 // end-user authentication is enabled for that team/no-team.
-func (d *DEPService) RegisterProfileWithAppleDEPServer(ctx context.Context, team *fleet.Team, setupAsst *fleet.MDMAppleSetupAssistant) error {
+//
+// It does that registration for all tokens associated in any way with that
+// team - that is, if DEP hosts are part of that team then the token used to
+// discover those hosts will be used to register the profile, and if a token
+// has that team as default team for a platform, it will also be used to
+// register the profile.
+//
+// On success, it returns the profile uuid and timestamp for the specific token
+// of interest to the caller (identified by its organization name).
+func (d *DEPService) RegisterProfileWithAppleDEPServer(ctx context.Context, team *fleet.Team, setupAsst *fleet.MDMAppleSetupAssistant, abmTokenOrgName string) (string, time.Time, error) {
 	appCfg, err := d.ds.AppConfig(ctx)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "fetching app config")
+		return "", time.Time{}, ctxerr.Wrap(ctx, err, "fetching app config")
 	}
 
 	// must always get the default profile, because the authentication token is
 	// defined on that profile.
 	defaultProf, err := d.ds.GetMDMAppleEnrollmentProfileByType(ctx, fleet.MDMAppleEnrollmentTypeAutomatic)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "fetching default profile")
+		return "", time.Time{}, ctxerr.Wrap(ctx, err, "fetching default profile")
 	}
 
 	enrollURL, err := EnrollURL(defaultProf.Token, appCfg)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "generating enroll URL")
+		return "", time.Time{}, ctxerr.Wrap(ctx, err, "generating enroll URL")
 	}
 
 	var rawJSON json.RawMessage
+	var requestedTokenModTime time.Time
 	if defaultProf.DEPProfile != nil {
 		rawJSON = *defaultProf.DEPProfile
+		requestedTokenModTime = defaultProf.UpdatedAt
 	}
 	if setupAsst != nil {
 		rawJSON = setupAsst.Profile
+		requestedTokenModTime = setupAsst.UploadedAt
 	}
 
 	var jsonProf godep.Profile
 	jsonProf.IsMDMRemovable = true // the default value defined by Apple is true
 	if err := json.Unmarshal(rawJSON, &jsonProf); err != nil {
-		return ctxerr.Wrap(ctx, err, "unmarshalling DEP profile")
+		return "", time.Time{}, ctxerr.Wrap(ctx, err, "unmarshalling DEP profile")
 	}
 
 	// if configuration_web_url is set, this setting is completely managed by the
@@ -208,33 +217,51 @@ func (d *DEPService) RegisterProfileWithAppleDEPServer(ctx context.Context, team
 	jsonProf.AwaitDeviceConfigured = true
 
 	depClient := NewDEPClient(d.depStorage, d.ds, d.logger)
-	res, err := depClient.DefineProfile(ctx, DEPName, &jsonProf)
+	// Get all relevant org names
+	var tmID *uint
+	if team != nil {
+		tmID = &team.ID
+	}
+
+	orgNames, err := d.ds.GetABMTokenOrgNamesAssociatedWithTeam(ctx, tmID)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "apple POST /profile request failed")
+		return "", time.Time{}, ctxerr.Wrap(ctx, err, "getting org names for team to register profile")
 	}
 
-	if setupAsst != nil {
-		setupAsst.ProfileUUID = res.ProfileUUID
-		if err := d.ds.SetMDMAppleSetupAssistantProfileUUID(ctx, setupAsst.TeamID, res.ProfileUUID); err != nil {
-			return ctxerr.Wrap(ctx, err, "save setup assistant profile UUID")
+	if len(orgNames) == 0 {
+		d.logger.Log("msg", "skipping defining profile for team with no relevant ABM token")
+		return "", time.Time{}, nil
+	}
+
+	var requestedTokenProfileUUID string
+	for _, orgName := range orgNames {
+		res, err := depClient.DefineProfile(ctx, orgName, &jsonProf)
+		if err != nil {
+			return "", time.Time{}, ctxerr.Wrap(ctx, err, "apple POST /profile request failed")
 		}
-	} else {
-		var tmID *uint
-		if team != nil {
-			tmID = &team.ID
+
+		if setupAsst != nil {
+			if err := d.ds.SetMDMAppleSetupAssistantProfileUUID(ctx, setupAsst.TeamID, res.ProfileUUID, orgName); err != nil {
+				return "", time.Time{}, ctxerr.Wrap(ctx, err, "save setup assistant profile UUID")
+			}
+		} else {
+			if err := d.ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, tmID, res.ProfileUUID, orgName); err != nil {
+				return "", time.Time{}, ctxerr.Wrap(ctx, err, "save default setup assistant profile UUID")
+			}
 		}
-		if err := d.ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, tmID, res.ProfileUUID); err != nil {
-			return ctxerr.Wrap(ctx, err, "save default setup assistant profile UUID")
+		if orgName == abmTokenOrgName {
+			requestedTokenProfileUUID = res.ProfileUUID
 		}
 	}
-	return nil
+	return requestedTokenProfileUUID, requestedTokenModTime, nil
 }
 
 // EnsureDefaultSetupAssistant ensures that the default Setup Assistant profile
 // is created and registered with Apple for the provided team/no-team (if team
-// is nil), and returns its profile UUID. It does not re-define the profile if
-// it already exists and registered.
-func (d *DEPService) EnsureDefaultSetupAssistant(ctx context.Context, team *fleet.Team) (string, time.Time, error) {
+// is nil) using the specified ABM token, and returns its profile UUID. It does
+// not re-define the profile if it already exists and registered for that
+// token.
+func (d *DEPService) EnsureDefaultSetupAssistant(ctx context.Context, team *fleet.Team, abmTokenOrgName string) (string, time.Time, error) {
 	// the first step is to ensure that the default profile entry exists in the
 	// mdm_apple_enrollment_profiles table. When we create it there we also
 	// create the authentication token to retrieve enrollment profiles, and
@@ -250,23 +277,20 @@ func (d *DEPService) EnsureDefaultSetupAssistant(ctx context.Context, team *flee
 	}
 
 	// now that the default automatic profile is created and a token generated,
-	// check if the default profile was registered with Apple for that team.
+	// check if the default profile was registered with Apple for the ABM token.
 	var tmID *uint
 	if team != nil {
 		tmID = &team.ID
 	}
-	profUUID, modTime, err := d.ds.GetMDMAppleDefaultSetupAssistant(ctx, tmID)
+	profUUID, modTime, err := d.ds.GetMDMAppleDefaultSetupAssistant(ctx, tmID, abmTokenOrgName)
 	if err != nil && !fleet.IsNotFound(err) {
 		return "", time.Time{}, ctxerr.Wrap(ctx, err, "get default setup assistant profile uuid")
 	}
 	if profUUID == "" {
 		d.logger.Log("msg", "default DEP profile not set, registering")
-		if err := d.RegisterProfileWithAppleDEPServer(ctx, team, nil); err != nil {
-			return "", time.Time{}, ctxerr.Wrap(ctx, err, "register default setup assistant with Apple")
-		}
-		profUUID, modTime, err = d.ds.GetMDMAppleDefaultSetupAssistant(ctx, tmID)
+		profUUID, modTime, err = d.RegisterProfileWithAppleDEPServer(ctx, team, nil, abmTokenOrgName)
 		if err != nil {
-			return "", time.Time{}, ctxerr.Wrap(ctx, err, "get default setup assistant profile uuid after registering")
+			return "", time.Time{}, ctxerr.Wrap(ctx, err, "register default setup assistant with Apple")
 		}
 	}
 	return profUUID, modTime, nil
@@ -274,14 +298,16 @@ func (d *DEPService) EnsureDefaultSetupAssistant(ctx context.Context, team *flee
 
 // EnsureCustomSetupAssistantIfExists ensures that the custom Setup Assistant
 // profile associated with the provided team (or no team) is registered with
-// Apple, and returns its profile UUID. It does not re-define the profile if it
-// is already registered. If no custom setup assistant exists, it returns an
-// empty string and timestamp and no error.
-func (d *DEPService) EnsureCustomSetupAssistantIfExists(ctx context.Context, team *fleet.Team) (string, time.Time, error) {
+// Apple for the specified ABM token, and returns its profile UUID. It does not
+// re-define the profile if it is already registered for that token. If no
+// custom setup assistant exists, it returns an empty string and timestamp and
+// no error.
+func (d *DEPService) EnsureCustomSetupAssistantIfExists(ctx context.Context, team *fleet.Team, abmTokenOrgName string) (string, time.Time, error) {
 	var tmID *uint
 	if team != nil {
 		tmID = &team.ID
 	}
+
 	asst, err := d.ds.GetMDMAppleSetupAssistant(ctx, tmID)
 	if err != nil {
 		if fleet.IsNotFound(err) {
@@ -291,63 +317,124 @@ func (d *DEPService) EnsureCustomSetupAssistantIfExists(ctx context.Context, tea
 		return "", time.Time{}, err
 	}
 
-	if asst.ProfileUUID == "" {
-		if err := d.RegisterProfileWithAppleDEPServer(ctx, team, asst); err != nil {
+	// if we get here, there IS a custom setup assistant, so get its profile UUID
+	profileUUID, modTime, err := d.ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, tmID, abmTokenOrgName)
+	if err != nil && !fleet.IsNotFound(err) {
+		return "", time.Time{}, err
+	}
+
+	if profileUUID == "" {
+		// registers the profile for all tokens associated with the team
+		profileUUID, modTime, err = d.RegisterProfileWithAppleDEPServer(ctx, team, asst, abmTokenOrgName)
+		if err != nil {
 			return "", time.Time{}, err
 		}
 	}
-	return asst.ProfileUUID, asst.UploadedAt, nil
+	return profileUUID, modTime, nil
 }
 
 func (d *DEPService) RunAssigner(ctx context.Context) error {
-	// get the Apple BM default team
-	appCfg, err := d.ds.AppConfig(ctx)
+	syncerLogger := logging.NewNanoDEPLogger(kitlog.With(d.logger, "component", "nanodep-syncer"))
+	teams, err := d.ds.ListTeams(
+		ctx, fleet.TeamFilter{
+			User: &fleet.User{
+				GlobalRole: ptr.String(fleet.RoleAdmin),
+			},
+		}, fleet.ListOptions{},
+	)
 	if err != nil {
-		return err
-	}
-	var appleBMTeam *fleet.Team
-	if appCfg.MDM.AppleBMDefaultTeam != "" {
-		tm, err := d.ds.TeamByName(ctx, appCfg.MDM.AppleBMDefaultTeam)
-		if err != nil && !fleet.IsNotFound(err) {
-			return err
-		}
-		appleBMTeam = tm
+		return ctxerr.Wrap(ctx, err, "listing teams")
 	}
 
-	// ensure the default (fallback) setup assistant profile exists, registered
-	// with Apple DEP.
-	_, defModTime, err := d.EnsureDefaultSetupAssistant(ctx, appleBMTeam)
-	if err != nil {
-		return err
+	teamsByID := make(map[uint]*fleet.Team, len(teams))
+	for _, tm := range teams {
+		teamsByID[tm.ID] = tm
 	}
 
-	// if the team/no-team has a custom setup assistant, ensure it is registered
-	// with Apple DEP.
-	customUUID, customModTime, err := d.EnsureCustomSetupAssistantIfExists(ctx, appleBMTeam)
+	tokens, err := d.ds.ListABMTokens(ctx)
 	if err != nil {
-		return err
+		return ctxerr.Wrap(ctx, err, "listing ABM tokens")
 	}
 
-	// get the modification timestamp of the effective profile (custom or default)
-	effectiveProfModTime := defModTime
-	if customUUID != "" {
-		effectiveProfModTime = customModTime
-	}
+	var result error
+	for _, token := range tokens {
+		var macOSTeam, iosTeam, ipadTeam *fleet.Team
 
-	cursor, cursorModTime, err := d.depStorage.RetrieveCursor(ctx, DEPName)
-	if err != nil {
-		return err
-	}
+		if token.MacOSDefaultTeamID != nil {
+			macOSTeam = teamsByID[*token.MacOSDefaultTeamID]
+		}
 
-	// If the effective profile was changed since last sync then we clear
-	// the cursor and perform a full sync of all devices and profile assigning.
-	if cursor != "" && effectiveProfModTime.After(cursorModTime) {
-		d.logger.Log("msg", "clearing device syncer cursor")
-		if err := d.depStorage.StoreCursor(ctx, DEPName, ""); err != nil {
-			return err
+		if token.IOSDefaultTeamID != nil {
+			iosTeam = teamsByID[*token.IOSDefaultTeamID]
+		}
+
+		if token.IPadOSDefaultTeamID != nil {
+			ipadTeam = teamsByID[*token.IPadOSDefaultTeamID]
+		}
+
+		teams := []*fleet.Team{macOSTeam, iosTeam, ipadTeam}
+		for _, team := range teams {
+			// ensure the default (fallback) setup assistant profile exists, registered
+			// with Apple DEP.
+			_, defModTime, err := d.EnsureDefaultSetupAssistant(ctx, team, token.OrganizationName)
+			if err != nil {
+				result = multierror.Append(result, err)
+				continue
+			}
+
+			// if the team/no-team has a custom setup assistant, ensure it is registered
+			// with Apple DEP.
+			customUUID, customModTime, err := d.EnsureCustomSetupAssistantIfExists(ctx, team, token.OrganizationName)
+			if err != nil {
+				result = multierror.Append(result, err)
+				continue
+			}
+
+			// get the modification timestamp of the effective profile (custom or default)
+			effectiveProfModTime := defModTime
+			if customUUID != "" {
+				effectiveProfModTime = customModTime
+			}
+
+			cursor, cursorModTime, err := d.depStorage.RetrieveCursor(ctx, token.OrganizationName)
+			if err != nil {
+				result = multierror.Append(result, err)
+				continue
+			}
+
+			if cursor != "" && effectiveProfModTime.After(cursorModTime) {
+				d.logger.Log("msg", "clearing device syncer cursor", "org_name", token.OrganizationName)
+				if err := d.depStorage.StoreCursor(ctx, token.OrganizationName, ""); err != nil {
+					result = multierror.Append(result, err)
+					continue
+				}
+			}
+
+		}
+
+		syncer := depsync.NewSyncer(
+			d.depClient,
+			token.OrganizationName,
+			d.depStorage,
+			depsync.WithLogger(syncerLogger),
+			depsync.WithCallback(func(ctx context.Context, isFetch bool, resp *godep.DeviceResponse) error {
+				// the nanodep syncer just logs the error of the callback, so in order to
+				// capture it we need to do this here.
+				err := d.processDeviceResponse(ctx, resp, token.ID, token.OrganizationName, macOSTeam, iosTeam, ipadTeam)
+				if err != nil {
+					ctxerr.Handle(ctx, err)
+				}
+				return err
+			}),
+		)
+
+		if err := syncer.Run(ctx); err != nil {
+			result = multierror.Append(result, err)
+			continue
 		}
 	}
-	return d.syncer.Run(ctx)
+
+	return result
 }
 
 func NewDEPService(
@@ -355,36 +442,28 @@ func NewDEPService(
 	depStorage nanodep_storage.AllDEPStorage,
 	logger kitlog.Logger,
 ) *DEPService {
-	depClient := NewDEPClient(depStorage, ds, logger)
 	depSvc := &DEPService{
 		depStorage: depStorage,
 		logger:     logger,
 		ds:         ds,
+		depClient:  NewDEPClient(depStorage, ds, logger),
 	}
 
-	depSvc.syncer = depsync.NewSyncer(
-		depClient,
-		DEPName,
-		depStorage,
-		depsync.WithLogger(logging.NewNanoDEPLogger(kitlog.With(logger, "component", "nanodep-syncer"))),
-		depsync.WithCallback(func(ctx context.Context, isFetch bool, resp *godep.DeviceResponse) error {
-			// the nanodep syncer just logs the error of the callback, so in order to
-			// capture it we need to do this here.
-			err := depSvc.processDeviceResponse(ctx, depClient, resp)
-			if err != nil {
-				ctxerr.Handle(ctx, err)
-			}
-			return err
-		}),
-	)
-
 	return depSvc
 }
 
 // processDeviceResponse processes the device response from the device sync
 // DEP API endpoints and assigns the profile UUID associated with the DEP
 // client DEP name.
-func (d *DEPService) processDeviceResponse(ctx context.Context, depClient *godep.Client, resp *godep.DeviceResponse) error {
+func (d *DEPService) processDeviceResponse(
+	ctx context.Context,
+	resp *godep.DeviceResponse,
+	abmTokenID uint,
+	abmOrganizationName string,
+	macOSTeam *fleet.Team,
+	iosTeam *fleet.Team,
+	ipadTeam *fleet.Team,
+) error {
 	if len(resp.Devices) < 1 {
 		// no devices means we can't assign anything
 		return nil
@@ -452,7 +531,7 @@ func (d *DEPService) processDeviceResponse(ctx context.Context, depClient *godep
 		return ctxerr.Wrap(ctx, err, "deleting DEP assignments")
 	}
 
-	n, defaultABMTeamID, err := d.ds.IngestMDMAppleDevicesFromDEPSync(ctx, addedDevices)
+	n, err := d.ds.IngestMDMAppleDevicesFromDEPSync(ctx, addedDevices, abmTokenID, macOSTeam, iosTeam, ipadTeam)
 	switch {
 	case err != nil:
 		level.Error(kitlog.With(d.logger)).Log("err", err)
@@ -463,54 +542,68 @@ func (d *DEPService) processDeviceResponse(ctx context.Context, depClient *godep
 		level.Debug(kitlog.With(d.logger)).Log("msg", "no DEP hosts to add")
 	}
 
+	level.Debug(kitlog.With(d.logger)).Log("msg", "devices to assign DEP profiles", "to_add", len(addedDevices), "to_remove", deletedSerials, "to_modify", modifiedSerials)
+
 	// at this point, the hosts rows are created for the devices, with the
 	// correct team_id, so we know what team-specific profile needs to be applied.
 	//
 	// collect a map of all the profiles => serials we need to assign.
 	profileToDevices := map[string][]godep.Device{}
+	var iosTeamID, macOSTeamID, ipadTeamID *uint
+	if iosTeam != nil {
+		iosTeamID = &iosTeam.ID
+	}
+	if macOSTeam != nil {
+		macOSTeamID = &macOSTeam.ID
+	}
+	if ipadTeam != nil {
+		ipadTeamID = &ipadTeam.ID
+	}
 
 	// each new device should be assigned the DEP profile of the default
 	// ABM team as configured by the IT admin.
-	if len(addedDevices) > 0 {
-		level.Debug(kitlog.With(d.logger)).Log("msg", "gathering added serials to assign devices", "len", len(addedDevices))
-		profUUID, err := d.getProfileUUIDForTeam(ctx, defaultABMTeamID)
-		if err != nil {
-			return ctxerr.Wrapf(ctx, err, "getting profile for default team with id: %v", defaultABMTeamID)
+	devicesByTeam := map[*uint][]godep.Device{}
+	for _, newDevice := range addedDevices {
+		var teamID *uint
+		switch newDevice.DeviceFamily {
+		case "iPhone":
+			teamID = iosTeamID
+		case "iPad":
+			teamID = ipadTeamID
+		default:
+			teamID = macOSTeamID
 		}
+		devicesByTeam[teamID] = append(devicesByTeam[teamID], newDevice)
 
-		profileToDevices[profUUID] = addedDevices
-	} else {
-		level.Debug(kitlog.With(d.logger)).Log("msg", "no added devices to assign DEP profiles")
 	}
 
-	// for all other hosts we received, find out the right DEP profile to assign, based on the team.
-	if len(existingSerials) > 0 {
-		level.Debug(kitlog.With(d.logger)).Log("msg", "gathering existing serials to assign devices", "len", len(existingSerials))
-		devicesByTeam := map[*uint][]godep.Device{}
-		hosts := []fleet.Host{}
-		for _, host := range existingSerials {
-			dd, ok := modifiedDevices[host.HardwareSerial]
-			if !ok {
-				return ctxerr.Errorf(ctx, "serial %s coming from ABM is in the databse, but it's not in the list of modified devices", host.HardwareSerial)
-			}
-			hosts = append(hosts, *host)
-			devicesByTeam[host.TeamID] = append(devicesByTeam[host.TeamID], dd)
+	// for all other hosts we received, find out the right DEP profile to
+	// assign, based on the team.
+	existingHosts := []fleet.Host{}
+	for _, existingHost := range existingSerials {
+		dd, ok := modifiedDevices[existingHost.HardwareSerial]
+		if !ok {
+			level.Error(kitlog.With(d.logger)).Log("msg", "serial coming from ABM is in the databse, but it's not in the list of modified devices", "serial", existingHost.HardwareSerial)
+			continue
 		}
-		for team, devices := range devicesByTeam {
-			profUUID, err := d.getProfileUUIDForTeam(ctx, team)
-			if err != nil {
-				return ctxerr.Wrapf(ctx, err, "getting profile for team with id: %v", team)
-			}
+		existingHosts = append(existingHosts, *existingHost)
+		devicesByTeam[existingHost.TeamID] = append(devicesByTeam[existingHost.TeamID], dd)
+	}
 
-			profileToDevices[profUUID] = append(profileToDevices[profUUID], devices...)
+	// assign the profile to each device
+	for team, devices := range devicesByTeam {
+		profUUID, err := d.getProfileUUIDForTeam(ctx, team, abmOrganizationName)
+		if err != nil {
+			return ctxerr.Wrapf(ctx, err, "getting profile for team with id: %v", team)
 		}
 
-		if err := d.ds.UpsertMDMAppleHostDEPAssignments(ctx, hosts); err != nil {
-			return ctxerr.Wrap(ctx, err, "upserting dep assignment for existing device")
-		}
+		profileToDevices[profUUID] = append(profileToDevices[profUUID], devices...)
+	}
 
-	} else {
-		level.Debug(kitlog.With(d.logger)).Log("msg", "no existing devices to assign DEP profiles")
+	if len(existingHosts) > 0 {
+		if err := d.ds.UpsertMDMAppleHostDEPAssignments(ctx, existingHosts, abmTokenID); err != nil {
+			return ctxerr.Wrap(ctx, err, "upserting dep assignment for existing devices")
+		}
 	}
 
 	// keep track of the serials we're going to skip for all profiles in
@@ -531,7 +624,6 @@ func (d *DEPService) processDeviceResponse(ctx context.Context, depClient *godep
 		}
 
 		logger := kitlog.With(d.logger, "profile_uuid", profUUID)
-		level.Info(logger).Log("msg", "calling DEP client to assign profile", "profile_uuid", profUUID)
 
 		skipSerials, assignSerials, err := d.ds.ScreenDEPAssignProfileSerialsForCooldown(ctx, serials)
 		if err != nil {
@@ -547,25 +639,29 @@ func (d *DEPService) processDeviceResponse(ctx context.Context, depClient *godep
 			continue
 		}
 
-		apiResp, err := depClient.AssignProfile(ctx, DEPName, profUUID, assignSerials...)
-		if err != nil {
-			level.Error(logger).Log(
-				"msg", "assign profile",
-				"devices", len(assignSerials),
-				"err", err,
-			)
-			return fmt.Errorf("assign profile: %w", err)
-		}
+		for orgName, serials := range assignSerials {
+			apiResp, err := d.depClient.AssignProfile(ctx, orgName, profUUID, serials...)
+			if err != nil {
+				// only log the error so the failure can be recorded
+				// below in UpdateHostDEPAssignProfileResponses and
+				// the proper cooldowns are applied
+				level.Error(logger).Log(
+					"msg", "assign profile",
+					"devices", len(assignSerials),
+					"err", err,
+				)
+			}
 
-		logs := []interface{}{
-			"msg", "profile assigned",
-			"devices", len(assignSerials),
-		}
-		logs = append(logs, logCountsForResults(apiResp.Devices)...)
-		level.Info(logger).Log(logs...)
+			logs := []interface{}{
+				"msg", "profile assigned",
+				"devices", len(assignSerials),
+			}
+			logs = append(logs, logCountsForResults(apiResp.Devices)...)
+			level.Info(logger).Log(logs...)
 
-		if err := d.ds.UpdateHostDEPAssignProfileResponses(ctx, apiResp); err != nil {
-			return ctxerr.Wrap(ctx, err, "update host dep assign profile responses")
+			if err := d.ds.UpdateHostDEPAssignProfileResponses(ctx, apiResp); err != nil {
+				return ctxerr.Wrap(ctx, err, "update host dep assign profile responses")
+			}
 		}
 	}
 
@@ -576,7 +672,7 @@ func (d *DEPService) processDeviceResponse(ctx context.Context, depClient *godep
 	return nil
 }
 
-func (d *DEPService) getProfileUUIDForTeam(ctx context.Context, tmID *uint) (string, error) {
+func (d *DEPService) getProfileUUIDForTeam(ctx context.Context, tmID *uint, abmTokenOrgName string) (string, error) {
 	var appleBMTeam *fleet.Team
 	if tmID != nil {
 		tm, err := d.ds.Team(ctx, *tmID)
@@ -587,12 +683,12 @@ func (d *DEPService) getProfileUUIDForTeam(ctx context.Context, tmID *uint) (str
 	}
 
 	// get profile uuid of team or default
-	profUUID, _, err := d.EnsureCustomSetupAssistantIfExists(ctx, appleBMTeam)
+	profUUID, _, err := d.EnsureCustomSetupAssistantIfExists(ctx, appleBMTeam, abmTokenOrgName)
 	if err != nil {
-		return "", fmt.Errorf("ensure setup assistant for team %v: %w", tmID, err)
+		return "", fmt.Errorf("ensure setup assistant for team: %w", err)
 	}
 	if profUUID == "" {
-		profUUID, _, err = d.EnsureDefaultSetupAssistant(ctx, appleBMTeam)
+		profUUID, _, err = d.EnsureDefaultSetupAssistant(ctx, appleBMTeam, abmTokenOrgName)
 		if err != nil {
 			return "", fmt.Errorf("ensure default setup assistant: %w", err)
 		}
@@ -620,34 +716,76 @@ func logCountsForResults(deviceResults map[string]string) (out []interface{}) {
 }
 
 // NewDEPClient creates an Apple DEP API HTTP client based on the provided
-// storage that will flag the AppConfig's AppleBMTermsExpired field
-// whenever the status of the terms changes.
-func NewDEPClient(storage godep.ClientStorage, appCfgUpdater fleet.AppConfigUpdater, logger kitlog.Logger) *godep.Client {
+// storage that will flag the ABM token's terms expired field and the
+// AppConfig's AppleBMTermsExpired field whenever the status of the terms
+// changes.
+func NewDEPClient(storage godep.ClientStorage, updater fleet.ABMTermsUpdater, logger kitlog.Logger) *godep.Client {
 	return godep.NewClient(storage, fleethttp.NewClient(), godep.WithAfterHook(func(ctx context.Context, reqErr error) error {
+		// to check for ABM terms expired, we must have an ABM token organization
+		// name and NOT a raw ABM token in the context (as the presence of a raw
+		// ABM token means that the token is new, hasn't been saved in the DB yet
+		// so no point checking for the terms expired as we don't have a row in
+		// abm_tokens to save that flag).
+		orgName := depclient.GetName(ctx)
+		if _, rawTokenPresent := ctxabm.FromContext(ctx); rawTokenPresent || orgName == "" {
+			return reqErr
+		}
+
 		// if the request failed due to terms not signed, or if it succeeded,
-		// update the app config flag accordingly. If it failed for any other
-		// reason, do not update the flag.
+		// update the ABM token's (and possibly the app config's) flag accordingly.
+		// If it failed for any other reason, do not update the flag.
 		termsExpired := reqErr != nil && godep.IsTermsNotSigned(reqErr)
 		if reqErr == nil || termsExpired {
-			appCfg, err := appCfgUpdater.AppConfig(ctx)
+			// get the count of tokens with the flag still set
+			count, err := updater.CountABMTokensWithTermsExpired(ctx)
+			if err != nil {
+				level.Error(logger).Log("msg", "Apple DEP client: failed to get count of tokens with terms expired", "err", err)
+				return reqErr
+			}
+
+			// get the appconfig for the global flag
+			appCfg, err := updater.AppConfig(ctx)
 			if err != nil {
 				level.Error(logger).Log("msg", "Apple DEP client: failed to get app config", "err", err)
 				return reqErr
 			}
 
+			// on API call success, if the global terms expired flag is not set and
+			// the count is 0, no need to do anything else (it means this ABM token
+			// already had the flag cleared).
+			if reqErr == nil && count == 0 && !appCfg.MDM.AppleBMTermsExpired {
+				return reqErr
+			}
+
+			// otherwise, update the specific ABM token's flag
+			wasSet, err := updater.SetABMTokenTermsExpiredForOrgName(ctx, orgName, termsExpired)
+			if err != nil {
+				level.Error(logger).Log("msg", "Apple DEP client: failed to update terms expired of ABM token", "err", err)
+				return reqErr
+			}
+
+			// update the count of ABM tokens with the flag set accordingly
+			stillSetCount := count
+			if wasSet && !termsExpired {
+				stillSetCount--
+			} else if !wasSet && termsExpired {
+				stillSetCount++
+			}
+
 			var mustSaveAppCfg bool
-			if termsExpired && !appCfg.MDM.AppleBMTermsExpired {
+			if stillSetCount > 0 && !appCfg.MDM.AppleBMTermsExpired {
 				// flag the AppConfig that the terms have changed and must be accepted
+				// for at least one token
 				appCfg.MDM.AppleBMTermsExpired = true
 				mustSaveAppCfg = true
-			} else if reqErr == nil && appCfg.MDM.AppleBMTermsExpired {
-				// flag the AppConfig that the terms have been accepted
+			} else if stillSetCount == 0 && appCfg.MDM.AppleBMTermsExpired {
+				// flag the AppConfig that the terms have been accepted for all tokens
 				appCfg.MDM.AppleBMTermsExpired = false
 				mustSaveAppCfg = true
 			}
 
 			if mustSaveAppCfg {
-				if err := appCfgUpdater.SaveAppConfig(ctx, appCfg); err != nil {
+				if err := updater.SaveAppConfig(ctx, appCfg); err != nil {
 					level.Error(logger).Log("msg", "Apple DEP client: failed to save app config", "err", err)
 				}
 				level.Info(logger).Log("msg", "Apple DEP client: updated app config Terms Expired flag",
@@ -658,11 +796,15 @@ func NewDEPClient(storage godep.ClientStorage, appCfgUpdater fleet.AppConfigUpda
 	}))
 }
 
+var funcMap = map[string]any{
+	"xml": mobileconfig.XMLEscapeString,
+}
+
 // enrollmentProfileMobileconfigTemplate is the template Fleet uses to assemble a .mobileconfig enrollment profile to serve to devices.
 //
 // During a profile replacement, the system updates payloads with the same PayloadIdentifier and
 // PayloadUUID in the old and new profiles.
-var enrollmentProfileMobileconfigTemplate = template.Must(template.New("").Parse(`
+var enrollmentProfileMobileconfigTemplate = template.Must(template.New("").Funcs(funcMap).Parse(`
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -675,7 +817,7 @@ var enrollmentProfileMobileconfigTemplate = template.Must(template.New("").Parse
 				<key>Key Type</key>
 				<string>RSA</string>
 				<key>Challenge</key>
-				<string>{{ .SCEPChallenge }}</string>
+				<string>{{ .SCEPChallenge | xml }}</string>
 				<key>Key Usage</key>
 				<integer>5</integer>
 				<key>Keysize</key>
@@ -726,11 +868,11 @@ var enrollmentProfileMobileconfigTemplate = template.Must(template.New("").Parse
 		</dict>
 	</array>
 	<key>PayloadDisplayName</key>
-	<string>{{ .Organization }} enrollment</string>
+	<string>{{ .Organization | xml }} enrollment</string>
 	<key>PayloadIdentifier</key>
 	<string>` + FleetPayloadIdentifier + `</string>
 	<key>PayloadOrganization</key>
-	<string>{{ .Organization }}</string>
+	<string>{{ .Organization | xml }}</string>
 	<key>PayloadScope</key>
 	<string>System</string>
 	<key>PayloadType</key>
@@ -752,13 +894,8 @@ func GenerateEnrollmentProfileMobileconfig(orgName, fleetURL, scepChallenge, top
 		return nil, fmt.Errorf("resolve Apple MDM url: %w", err)
 	}
 
-	var escaped strings.Builder
-	if err := xml.EscapeText(&escaped, []byte(scepChallenge)); err != nil {
-		return nil, fmt.Errorf("escape SCEP challenge for XML: %w", err)
-	}
-
 	var buf bytes.Buffer
-	if err := enrollmentProfileMobileconfigTemplate.Execute(&buf, struct {
+	if err := enrollmentProfileMobileconfigTemplate.Funcs(funcMap).Execute(&buf, struct {
 		Organization  string
 		SCEPURL       string
 		SCEPChallenge string
@@ -767,7 +904,7 @@ func GenerateEnrollmentProfileMobileconfig(orgName, fleetURL, scepChallenge, top
 	}{
 		Organization:  orgName,
 		SCEPURL:       scepURL,
-		SCEPChallenge: escaped.String(),
+		SCEPChallenge: scepChallenge,
 		Topic:         topic,
 		ServerURL:     serverURL,
 	}); err != nil {
@@ -840,3 +977,101 @@ func (pb *ProfileBimap) add(wantedProfile, currentProfile *fleet.MDMAppleProfile
 	pb.wantedState[wantedProfile] = currentProfile
 	pb.currentState[currentProfile] = wantedProfile
 }
+
+func IOSiPadOSRefetch(ctx context.Context, ds fleet.Datastore, commander *MDMAppleCommander, logger kitlog.Logger) error {
+	appCfg, err := ds.AppConfig(ctx)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "fetching app config")
+	}
+
+	if !appCfg.MDM.EnabledAndConfigured {
+		level.Debug(logger).Log("msg", "apple mdm is not configured, skipping run")
+		return nil
+	}
+
+	start := time.Now()
+	devices, err := ds.ListIOSAndIPadOSToRefetch(ctx, 1*time.Hour)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "list ios and ipad devices to refetch")
+	}
+	if len(devices) == 0 {
+		return nil
+	}
+	logger.Log("msg", "sending commands to refetch", "count", len(devices), "lookup-duration", time.Since(start))
+	commandUUID := uuid.NewString()
+
+	hostMDMCommands := make([]fleet.HostMDMCommand, 0, 2*len(devices))
+	installedAppsUUIDs := make([]string, 0, len(devices))
+	for _, device := range devices {
+		if !slices.Contains(device.CommandsAlreadySent, fleet.RefetchAppsCommandUUIDPrefix) {
+			installedAppsUUIDs = append(installedAppsUUIDs, device.UUID)
+			hostMDMCommands = append(hostMDMCommands, fleet.HostMDMCommand{
+				HostID:      device.HostID,
+				CommandType: fleet.RefetchAppsCommandUUIDPrefix,
+			})
+		}
+	}
+	if len(installedAppsUUIDs) > 0 {
+		err = commander.InstalledApplicationList(ctx, installedAppsUUIDs, fleet.RefetchAppsCommandUUIDPrefix+commandUUID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "send InstalledApplicationList commands to ios and ipados devices")
+		}
+	}
+
+	// DeviceInformation is last because the refetch response clears the refetch_requested flag
+	deviceInfoUUIDs := make([]string, 0, len(devices))
+	for _, device := range devices {
+		if !slices.Contains(device.CommandsAlreadySent, fleet.RefetchDeviceCommandUUIDPrefix) {
+			deviceInfoUUIDs = append(deviceInfoUUIDs, device.UUID)
+			hostMDMCommands = append(hostMDMCommands, fleet.HostMDMCommand{
+				HostID:      device.HostID,
+				CommandType: fleet.RefetchDeviceCommandUUIDPrefix,
+			})
+		}
+	}
+	if len(deviceInfoUUIDs) > 0 {
+		if err := commander.DeviceInformation(ctx, deviceInfoUUIDs, fleet.RefetchDeviceCommandUUIDPrefix+commandUUID); err != nil {
+			return ctxerr.Wrap(ctx, err, "send DeviceInformation commands to ios and ipados devices")
+		}
+	}
+
+	// Add commands to the database to track the commands sent
+	err = ds.AddHostMDMCommands(ctx, hostMDMCommands)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "add host mdm commands")
+	}
+	return nil
+}
+
+func GenerateOTAEnrollmentProfileMobileconfig(orgName, fleetURL, enrollSecret string) ([]byte, error) {
+	path, err := url.JoinPath(fleetURL, "/api/v1/fleet/ota_enrollment")
+	if err != nil {
+		return nil, fmt.Errorf("creating path for ota enrollment url: %w", err)
+	}
+
+	enrollURL, err := url.Parse(path)
+	if err != nil {
+		return nil, fmt.Errorf("parsing ota enrollment url: %w", err)
+	}
+
+	q := enrollURL.Query()
+	q.Set("enroll_secret", enrollSecret)
+	enrollURL.RawQuery = q.Encode()
+
+	var profileBuf bytes.Buffer
+	tmplArgs := struct {
+		Organization string
+		URL          string
+		EnrollSecret string
+	}{
+		Organization: orgName,
+		URL:          enrollURL.String(),
+	}
+
+	err = mobileconfig.OTAMobileConfigTemplate.Execute(&profileBuf, tmplArgs)
+	if err != nil {
+		return nil, fmt.Errorf("executing ota profile template: %w", err)
+	}
+
+	return profileBuf.Bytes(), nil
+}
diff --git a/server/mdm/apple/apple_mdm_external_test.go b/server/mdm/apple/apple_mdm_external_test.go
index c0a63fd2a8ed..30287b0a32c6 100644
--- a/server/mdm/apple/apple_mdm_external_test.go
+++ b/server/mdm/apple/apple_mdm_external_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"database/sql"
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -24,6 +25,7 @@ func TestDEPService_RunAssigner(t *testing.T) {
 	ctx := context.Background()
 	ds := mysql.CreateMySQLDS(t)
 
+	const abmTokenOrgName = "test_org"
 	depStorage, err := ds.NewMDMAppleDEPStorage()
 	require.NoError(t, err)
 
@@ -33,10 +35,10 @@ func TestDEPService_RunAssigner(t *testing.T) {
 		t.Cleanup(srv.Close)
 		t.Cleanup(func() { mysql.TruncateTables(t, ds) })
 
-		err = depStorage.StoreConfig(ctx, apple_mdm.DEPName, &nanodep_client.Config{BaseURL: srv.URL})
+		err = depStorage.StoreConfig(ctx, abmTokenOrgName, &nanodep_client.Config{BaseURL: srv.URL})
 		require.NoError(t, err)
 
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, abmTokenOrgName)
 
 		logger := log.NewNopLogger()
 		return apple_mdm.NewDEPService(ds, depStorage, logger)
@@ -52,7 +54,7 @@ func TestDEPService_RunAssigner(t *testing.T) {
 			case "/session":
 				_, _ = w.Write([]byte(`{"auth_session_token": "session123"}`))
 			case "/account":
-				_, _ = w.Write([]byte(`{"admin_id": "admin123", "org_name": "test_org"}`))
+				_, _ = w.Write([]byte(fmt.Sprintf(`{"admin_id": "admin123", "org_name": "%s"}`, abmTokenOrgName)))
 			case "/profile":
 				err := encoder.Encode(godep.ProfileResponse{ProfileUUID: "profile123"})
 				require.NoError(t, err)
@@ -76,7 +78,7 @@ func TestDEPService_RunAssigner(t *testing.T) {
 		require.NotEmpty(t, defProf.Token)
 
 		// a profile UUID was assigned for no-team
-		profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, nil)
+		profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, nil, abmTokenOrgName)
 		require.NoError(t, err)
 		require.Equal(t, "profile123", profUUID)
 		require.False(t, modTime.Before(start))
@@ -84,7 +86,12 @@ func TestDEPService_RunAssigner(t *testing.T) {
 		// no team to assign to
 		appCfg, err := ds.AppConfig(ctx)
 		require.NoError(t, err)
-		require.Empty(t, appCfg.MDM.AppleBMDefaultTeam)
+		require.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+		abmTok, err := ds.GetABMTokenByOrgName(ctx, abmTokenOrgName)
+		require.NoError(t, err)
+		require.Nil(t, abmTok.MacOSDefaultTeamID)
+		require.Nil(t, abmTok.IPadOSDefaultTeamID)
+		require.Nil(t, abmTok.IOSDefaultTeamID)
 
 		// no teams, so no team-specific custom setup assistants
 		teams, err := ds.ListTeams(ctx, fleet.TeamFilter{User: test.UserAdmin}, fleet.ListOptions{})
@@ -118,7 +125,7 @@ func TestDEPService_RunAssigner(t *testing.T) {
 			case "/session":
 				_, _ = w.Write([]byte(`{"auth_session_token": "session123"}`))
 			case "/account":
-				_, _ = w.Write([]byte(`{"admin_id": "admin123", "org_name": "test_org"}`))
+				_, _ = w.Write([]byte(fmt.Sprintf(`{"admin_id": "admin123", "org_name": "%s"}`, abmTokenOrgName)))
 			case "/profile":
 				err := encoder.Encode(godep.ProfileResponse{ProfileUUID: "profile123"})
 				require.NoError(t, err)
@@ -156,7 +163,7 @@ func TestDEPService_RunAssigner(t *testing.T) {
 		require.NotEmpty(t, defProf.Token)
 
 		// a profile UUID was assigned to no-team
-		profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, nil)
+		profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, nil, abmTokenOrgName)
 		require.NoError(t, err)
 		require.Equal(t, "profile123", profUUID)
 		require.False(t, modTime.Before(start))
@@ -190,7 +197,7 @@ func TestDEPService_RunAssigner(t *testing.T) {
 			case "/session":
 				_, _ = w.Write([]byte(`{"auth_session_token": "session123"}`))
 			case "/account":
-				_, _ = w.Write([]byte(`{"admin_id": "admin123", "org_name": "test_org"}`))
+				_, _ = w.Write([]byte(fmt.Sprintf(`{"admin_id": "admin123", "org_name": "%s"}`, abmTokenOrgName)))
 			case "/profile":
 				reqBody, err := io.ReadAll(r.Body)
 				require.NoError(t, err)
@@ -234,12 +241,11 @@ func TestDEPService_RunAssigner(t *testing.T) {
 		tm, err := ds.NewTeam(ctx, &fleet.Team{Name: "test_team"})
 		require.NoError(t, err)
 
-		appCfg, err := ds.AppConfig(ctx)
+		// set that team as default assignment for new macOS devices
+		tok, err := ds.GetABMTokenByOrgName(ctx, abmTokenOrgName)
 		require.NoError(t, err)
-
-		// set that team as default assignment for new devices
-		appCfg.MDM.AppleBMDefaultTeam = tm.Name
-		err = ds.SaveAppConfig(ctx, appCfg)
+		tok.MacOSDefaultTeamID = &tm.ID
+		err = ds.SaveABMToken(ctx, tok)
 		require.NoError(t, err)
 
 		// create a custom setup assistant for that team
@@ -262,7 +268,7 @@ func TestDEPService_RunAssigner(t *testing.T) {
 		require.NotEmpty(t, defProf.Token)
 
 		// a profile UUID was assigned to the team
-		profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, &tm.ID)
+		profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, &tm.ID, abmTokenOrgName)
 		require.NoError(t, err)
 		require.Equal(t, "profile123", profUUID)
 		require.False(t, modTime.Before(start))
@@ -270,8 +276,11 @@ func TestDEPService_RunAssigner(t *testing.T) {
 		// the team-specific custom profile was registered
 		tmAsst, err = ds.GetMDMAppleSetupAssistant(ctx, tmAsst.TeamID)
 		require.NoError(t, err)
-		require.Equal(t, "profile456", tmAsst.ProfileUUID)
 		require.False(t, tmAsst.UploadedAt.Before(start))
+		profileUUID, modTime, err := ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm.ID, abmTokenOrgName)
+		require.NoError(t, err)
+		require.Equal(t, "profile456", profileUUID)
+		require.True(t, tmAsst.UploadedAt.Equal(modTime))
 
 		// a couple hosts were created and assigned to the team (except the op_type ignored)
 		hosts, err := ds.ListHosts(ctx, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{})
diff --git a/server/mdm/apple/apple_mdm_test.go b/server/mdm/apple/apple_mdm_test.go
index a03b5030d7b7..156736ecd4e5 100644
--- a/server/mdm/apple/apple_mdm_test.go
+++ b/server/mdm/apple/apple_mdm_test.go
@@ -16,6 +16,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/mock"
 	nanodep_mock "github.com/fleetdm/fleet/v4/server/mock/nanodep"
 	"github.com/go-kit/log"
+	"github.com/groob/plist"
 	"github.com/stretchr/testify/require"
 )
 
@@ -67,6 +68,9 @@ func TestDEPService(t *testing.T) {
 				Token:      p.Token,
 				Type:       p.Type,
 				DEPProfile: p.DEPProfile,
+				UpdateCreateTimestamps: fleet.UpdateCreateTimestamps{
+					UpdateTimestamp: fleet.UpdateTimestamp{UpdatedAt: time.Now()},
+				},
 			}
 			savedProfile = res
 			return res, nil
@@ -81,14 +85,14 @@ func TestDEPService(t *testing.T) {
 		}
 
 		var defaultProfileUUID string
-		ds.GetMDMAppleDefaultSetupAssistantFunc = func(ctx context.Context, teamID *uint) (profileUUID string, updatedAt time.Time, err error) {
+		ds.GetMDMAppleDefaultSetupAssistantFunc = func(ctx context.Context, teamID *uint, orgName string) (profileUUID string, updatedAt time.Time, err error) {
 			if defaultProfileUUID == "" {
 				return "", time.Time{}, nil
 			}
 			return defaultProfileUUID, time.Now(), nil
 		}
 
-		ds.SetMDMAppleDefaultSetupAssistantProfileUUIDFunc = func(ctx context.Context, teamID *uint, profileUUID string) error {
+		ds.SetMDMAppleDefaultSetupAssistantProfileUUIDFunc = func(ctx context.Context, teamID *uint, profileUUID, orgName string) error {
 			require.Nil(t, teamID)
 			defaultProfileUUID = profileUUID
 			return nil
@@ -107,12 +111,19 @@ func TestDEPService(t *testing.T) {
 		}
 
 		depStorage.StoreAssignerProfileFunc = func(ctx context.Context, name string, profileUUID string) error {
-			require.Equal(t, name, DEPName)
 			require.NotEmpty(t, profileUUID)
 			return nil
 		}
 
-		profUUID, modTime, err := depSvc.EnsureDefaultSetupAssistant(ctx, nil)
+		ds.GetABMTokenOrgNamesAssociatedWithTeamFunc = func(ctx context.Context, teamID *uint) ([]string, error) {
+			return []string{"org1"}, nil
+		}
+
+		ds.CountABMTokensWithTermsExpiredFunc = func(ctx context.Context) (int, error) {
+			return 0, nil
+		}
+
+		profUUID, modTime, err := depSvc.EnsureDefaultSetupAssistant(ctx, nil, "org1")
 		require.NoError(t, err)
 		require.Equal(t, "abcd", profUUID)
 		require.NotZero(t, modTime)
@@ -183,6 +194,79 @@ func TestAddEnrollmentRefToFleetURL(t *testing.T) {
 	}
 }
 
+func TestGenerateEnrollmentProfileMobileconfig(t *testing.T) {
+	type scepPayload struct {
+		Challenge string
+		URL       string
+	}
+
+	type enrollmentPayload struct {
+		PayloadType    string
+		ServerURL      string      // used by the enrollment payload
+		PayloadContent scepPayload // scep contains a nested payload content dict
+	}
+
+	type enrollmentProfile struct {
+		PayloadIdentifier string
+		PayloadContent    []enrollmentPayload
+	}
+
+	tests := []struct {
+		name          string
+		orgName       string
+		fleetURL      string
+		scepChallenge string
+		expectError   bool
+	}{
+		{
+			name:          "valid input with simple values",
+			orgName:       "Fleet",
+			fleetURL:      "https://example.com",
+			scepChallenge: "testChallenge",
+			expectError:   false,
+		},
+		{
+			name:          "organization name and enroll secret with special characters",
+			orgName:       `Fleet & Co. "Special" <Org>`,
+			fleetURL:      "https://example.com",
+			scepChallenge: "test/&Challenge",
+			expectError:   false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := GenerateEnrollmentProfileMobileconfig(tt.orgName, tt.fleetURL, tt.scepChallenge, "com.foo.bar")
+			if tt.expectError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, result)
+
+				var profile enrollmentProfile
+
+				require.NoError(t, plist.Unmarshal(result, &profile))
+
+				for _, p := range profile.PayloadContent {
+					switch p.PayloadType {
+					case "com.apple.security.scep":
+						scepURL, err := ResolveAppleSCEPURL(tt.fleetURL)
+						require.NoError(t, err)
+						require.Equal(t, scepURL, p.PayloadContent.URL)
+						require.Equal(t, tt.scepChallenge, p.PayloadContent.Challenge)
+					case "com.apple.mdm":
+						mdmURL, err := ResolveAppleMDMURL(tt.fleetURL)
+						require.NoError(t, err)
+						require.Contains(t, mdmURL, p.ServerURL)
+					default:
+						require.Failf(t, "unrecognized payload type in enrollment profile: %s", p.PayloadType)
+					}
+				}
+			}
+		})
+	}
+}
+
 type notFoundError struct{}
 
 func (e notFoundError) IsNotFound() bool { return true }
diff --git a/server/mdm/apple/commander.go b/server/mdm/apple/commander.go
index fbacedfe4a45..6a098a5284ef 100644
--- a/server/mdm/apple/commander.go
+++ b/server/mdm/apple/commander.go
@@ -5,6 +5,8 @@ import (
 	"encoding/base64"
 	"fmt"
 	"net/http"
+	"sort"
+	"strings"
 
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -118,7 +120,7 @@ func (svc *MDMAppleCommander) DeviceLock(ctx context.Context, host *fleet.Host,
 		return "", ctxerr.Wrap(ctx, err, "enqueuing for DeviceLock")
 	}
 
-	if err := svc.sendNotifications(ctx, []string{host.UUID}); err != nil {
+	if err := svc.SendNotifications(ctx, []string{host.UUID}); err != nil {
 		return "", ctxerr.Wrap(ctx, err, "sending notifications for DeviceLock")
 	}
 
@@ -154,13 +156,39 @@ func (svc *MDMAppleCommander) EraseDevice(ctx context.Context, host *fleet.Host,
 		return ctxerr.Wrap(ctx, err, "enqueuing for DeviceWipe")
 	}
 
-	if err := svc.sendNotifications(ctx, []string{host.UUID}); err != nil {
+	if err := svc.SendNotifications(ctx, []string{host.UUID}); err != nil {
 		return ctxerr.Wrap(ctx, err, "sending notifications for DeviceWipe")
 	}
 
 	return nil
 }
 
+func (svc *MDMAppleCommander) InstallApplication(ctx context.Context, hostUUIDs []string, uuid string, adamID string) error {
+	raw := fmt.Sprintf(`<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Command</key>
+    <dict>
+        <key>ManagementFlags</key>
+        <integer>0</integer>
+        <key>Options</key>
+        <dict>
+            <key>PurchaseMethod</key>
+            <integer>1</integer>
+        </dict>
+        <key>RequestType</key>
+        <string>InstallApplication</string>
+        <key>iTunesStoreID</key>
+        <integer>%s</integer>
+    </dict>
+    <key>CommandUUID</key>
+    <string>%s</string>
+</dict>
+</plist>`, adamID, uuid)
+	return svc.EnqueueCommand(ctx, hostUUIDs, raw)
+}
+
 func (svc *MDMAppleCommander) InstallEnterpriseApplication(ctx context.Context, hostUUIDs []string, uuid string, manifestURL string) error {
 	raw := fmt.Sprintf(`<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -273,6 +301,59 @@ func (svc *MDMAppleCommander) DeviceConfigured(ctx context.Context, hostUUID, cm
 	return svc.EnqueueCommand(ctx, []string{hostUUID}, raw)
 }
 
+func (svc *MDMAppleCommander) DeviceInformation(ctx context.Context, hostUUIDs []string, cmdUUID string) error {
+	raw := fmt.Sprintf(`<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Command</key>
+    <dict>
+        <key>Queries</key>
+        <array>
+            <string>DeviceName</string>
+            <string>DeviceCapacity</string>
+            <string>AvailableDeviceCapacity</string>
+            <string>OSVersion</string>
+            <string>WiFiMAC</string>
+            <string>ProductName</string>
+        </array>
+        <key>RequestType</key>
+        <string>DeviceInformation</string>
+    </dict>
+    <key>CommandUUID</key>
+    <string>%s</string>
+</dict>
+</plist>`, cmdUUID)
+
+	return svc.EnqueueCommand(ctx, hostUUIDs, raw)
+}
+
+func (svc *MDMAppleCommander) InstalledApplicationList(ctx context.Context, hostUUIDs []string, cmdUUID string) error {
+	raw := fmt.Sprintf(`<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+    <dict>
+        <key>Command</key>
+        <dict>
+            <key>ManagedAppsOnly</key>
+            <false/>
+            <key>RequestType</key>
+            <string>InstalledApplicationList</string>
+            <key>Items</key>
+            <array>
+                <string>Name</string>
+                <string>ShortVersion</string>
+                <string>Identifier</string>
+            </array>
+        </dict>
+        <key>CommandUUID</key>
+        <string>%s</string>
+    </dict>
+</plist>`, cmdUUID)
+
+	return svc.EnqueueCommand(ctx, hostUUIDs, raw)
+}
+
 // EnqueueCommand takes care of enqueuing the commands and sending push
 // notifications to the devices.
 //
@@ -289,14 +370,14 @@ func (svc *MDMAppleCommander) EnqueueCommand(ctx context.Context, hostUUIDs []st
 		return ctxerr.Wrap(ctx, err, "enqueuing command")
 	}
 
-	if err := svc.sendNotifications(ctx, hostUUIDs); err != nil {
+	if err := svc.SendNotifications(ctx, hostUUIDs); err != nil {
 		return ctxerr.Wrap(ctx, err, "sending notifications")
 	}
 
 	return nil
 }
 
-func (svc *MDMAppleCommander) sendNotifications(ctx context.Context, hostUUIDs []string) error {
+func (svc *MDMAppleCommander) SendNotifications(ctx context.Context, hostUUIDs []string) error {
 	apnsResponses, err := svc.pusher.Push(ctx, hostUUIDs)
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "commander push")
@@ -304,14 +385,15 @@ func (svc *MDMAppleCommander) sendNotifications(ctx context.Context, hostUUIDs [
 
 	// Even if we didn't get an error, some of the APNs
 	// responses might have failed, signal that to the caller.
-	var failed []string
+	failed := map[string]error{}
 	for uuid, response := range apnsResponses {
 		if response.Err != nil {
-			failed = append(failed, uuid)
+			failed[uuid] = response.Err
 		}
 	}
+
 	if len(failed) > 0 {
-		return &APNSDeliveryError{FailedUUIDs: failed, Err: err}
+		return &APNSDeliveryError{errorsByUUID: failed}
 	}
 
 	return nil
@@ -320,14 +402,38 @@ func (svc *MDMAppleCommander) sendNotifications(ctx context.Context, hostUUIDs [
 // APNSDeliveryError records an error and the associated host UUIDs in which it
 // occurred.
 type APNSDeliveryError struct {
-	FailedUUIDs []string
-	Err         error
+	errorsByUUID map[string]error
 }
 
 func (e *APNSDeliveryError) Error() string {
-	return fmt.Sprintf("APNS delivery failed with: %s, for UUIDs: %v", e.Err, e.FailedUUIDs)
+	var uuids []string
+	for uuid := range e.errorsByUUID {
+		uuids = append(uuids, uuid)
+	}
+
+	// sort UUIDs alphabetically for deterministic output
+	sort.Strings(uuids)
+
+	var errStrings []string
+	for _, uuid := range uuids {
+		errStrings = append(errStrings, fmt.Sprintf("UUID: %s, Error: %v", uuid, e.errorsByUUID[uuid]))
+	}
+
+	return fmt.Sprintf(
+		"APNS delivery failed with the following errors:\n%s",
+		strings.Join(errStrings, "\n"),
+	)
 }
 
-func (e *APNSDeliveryError) Unwrap() error { return e.Err }
+func (e *APNSDeliveryError) FailedUUIDs() []string {
+	var uuids []string
+	for uuid := range e.errorsByUUID {
+		uuids = append(uuids, uuid)
+	}
+
+	// sort UUIDs alphabetically for deterministic output
+	sort.Strings(uuids)
+	return uuids
+}
 
 func (e *APNSDeliveryError) StatusCode() int { return http.StatusBadGateway }
diff --git a/server/mdm/apple/commander_test.go b/server/mdm/apple/commander_test.go
index 5978944b52d8..0d21c66ab5fb 100644
--- a/server/mdm/apple/commander_test.go
+++ b/server/mdm/apple/commander_test.go
@@ -3,7 +3,9 @@ package apple_mdm
 import (
 	"context"
 	"crypto/tls"
+	"errors"
 	"fmt"
+	"net/http"
 	"os"
 	"testing"
 
@@ -200,3 +202,50 @@ func mobileconfigForTest(name, identifier string) []byte {
 </plist>
 `, name, identifier, uuid.New().String()))
 }
+
+func TestAPNSDeliveryError(t *testing.T) {
+	tests := []struct {
+		name                string
+		errorsByUUID        map[string]error
+		expectedError       string
+		expectedFailedUUIDs []string
+		expectedStatusCode  int
+	}{
+		{
+			name: "single error",
+			errorsByUUID: map[string]error{
+				"uuid1": errors.New("network error"),
+			},
+			expectedError: `APNS delivery failed with the following errors:
+UUID: uuid1, Error: network error`,
+			expectedFailedUUIDs: []string{"uuid1"},
+			expectedStatusCode:  http.StatusBadGateway,
+		},
+		{
+			name: "multiple errors, sorted",
+			errorsByUUID: map[string]error{
+				"uuid3": errors.New("timeout error"),
+				"uuid1": errors.New("network error"),
+				"uuid2": errors.New("certificate error"),
+			},
+			expectedError: `APNS delivery failed with the following errors:
+UUID: uuid1, Error: network error
+UUID: uuid2, Error: certificate error
+UUID: uuid3, Error: timeout error`,
+			expectedFailedUUIDs: []string{"uuid1", "uuid2", "uuid3"},
+			expectedStatusCode:  http.StatusBadGateway,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			apnsErr := &APNSDeliveryError{
+				errorsByUUID: tt.errorsByUUID,
+			}
+
+			require.Equal(t, tt.expectedError, apnsErr.Error())
+			require.Equal(t, tt.expectedFailedUUIDs, apnsErr.FailedUUIDs())
+			require.Equal(t, tt.expectedStatusCode, apnsErr.StatusCode())
+		})
+	}
+}
diff --git a/server/mdm/apple/deviceinfo.go b/server/mdm/apple/deviceinfo.go
new file mode 100644
index 000000000000..ebed27369010
--- /dev/null
+++ b/server/mdm/apple/deviceinfo.go
@@ -0,0 +1,179 @@
+// The contents of this file have been copied and modified pursuant to the following
+// license from the original source:
+// https://github.com/korylprince/dep-webview-oidc/blob/2dd846a54fed04c16dd227b8c6c31665b4d0ebd8/header/header.go
+//
+// MIT License
+//
+// Copyright (c) 2023 Kory Prince
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package apple_mdm
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/rsa"
+	"crypto/sha1" // nolint:gosec // See comments regarding Apple's Root CA below
+	"crypto/x509"
+	_ "embed"
+	"encoding/base64"
+	"errors"
+	"fmt"
+
+	"github.com/groob/plist"
+	"go.mozilla.org/pkcs7"
+)
+
+const DeviceInfoHeader = "x-apple-aspen-deviceinfo"
+
+// appleRootCert is https://www.apple.com/appleca/AppleIncRootCertificate.cer
+//
+//go:embed AppleIncRootCertificate.cer
+var appleRootCert []byte
+
+func newAppleRootCert() *x509.Certificate {
+	cert, err := x509.ParseCertificate(appleRootCert)
+	if err != nil {
+		panic(fmt.Errorf("could not parse cert: %w", err))
+	}
+	return cert
+}
+
+// appleRootCA is Apple's Root CA parsed to an *x509.Certificate
+var appleRootCA = newAppleRootCert()
+
+// MachineInfo is a [device's information] sent as part of an MDM enrollment profile request
+//
+// [device's information]: https://developer.apple.com/documentation/devicemanagement/machineinfo
+type MachineInfo struct {
+	IMEI                        string `plist:"IMEI,omitempty"`
+	Language                    string `plist:"LANGUAGE,omitempty"`
+	MDMCanRequestSoftwareUpdate bool   `plist:"MDM_CAN_REQUEST_SOFTWARE_UPDATE"`
+	MEID                        string `plist:"MEID,omitempty"`
+	OSVersion                   string `plist:"OS_VERSION"`
+	PairingToken                string `plist:"PAIRING_TOKEN,omitempty"`
+	Product                     string `plist:"PRODUCT"`
+	Serial                      string `plist:"SERIAL"`
+	SoftwareUpdateDeviceID      string `plist:"SOFTWARE_UPDATE_DEVICE_ID,omitempty"`
+	SupplementalBuildVersion    string `plist:"SUPPLEMENTAL_BUILD_VERSION,omitempty"`
+	SupplementalOSVersionExtra  string `plist:"SUPPLEMENTAL_OS_VERSION_EXTRA,omitempty"`
+	UDID                        string `plist:"UDID"`
+	Version                     string `plist:"VERSION"`
+}
+
+// verifyPKCS7SHA1RSA performs a manual SHA1withRSA verification, since it's deprecated in Go 1.18.
+// If verifyChain is true, the signer certificate and its chain of certificates is verified against Apple's Root CA.
+// Also note that the certificate validity time window of the signing cert is not checked, since the cert is expired.
+// This follows guidance from Apple on the expired certificate.
+func verifyPKCS7SHA1RSA(p7 *pkcs7.PKCS7, verifyChain bool) error {
+	if len(p7.Signers) == 0 {
+		return errors.New("not signed")
+	}
+
+	// get signing cert
+	issuer := p7.Signers[0].IssuerAndSerialNumber
+	var signer *x509.Certificate
+	for _, cert := range p7.Certificates {
+		if bytes.Equal(cert.RawIssuer, issuer.IssuerName.FullBytes) && cert.SerialNumber.Cmp(issuer.SerialNumber) == 0 {
+			signer = cert
+		}
+	}
+
+	// get sha1 hash of content
+	hashed := sha1.Sum(p7.Content) // nolint:gosec
+
+	// verify content signature
+	signature := p7.Signers[0].EncryptedDigest
+	if err := rsa.VerifyPKCS1v15(signer.PublicKey.(*rsa.PublicKey), crypto.SHA1, hashed[:], signature); err != nil {
+		return fmt.Errorf("signature could not be verified: %w", err)
+	}
+
+	if !verifyChain {
+		return nil
+	}
+
+	// verify chain from signer to root
+	cert := signer
+outer:
+	for {
+		// check if cert is signed by root
+		if bytes.Equal(cert.RawIssuer, appleRootCA.RawSubject) {
+			hashed := sha1.Sum(cert.RawTBSCertificate) // nolint:gosec
+			// check signature
+			if err := rsa.VerifyPKCS1v15(appleRootCA.PublicKey.(*rsa.PublicKey), crypto.SHA1, hashed[:], cert.Signature); err != nil {
+				return fmt.Errorf("could not verify root CA signature: %w", err)
+			}
+			return nil
+		}
+		for _, c := range p7.Certificates {
+			if cert == c {
+				continue
+			}
+			// check if cert is signed by intermediate cert in chain
+			if bytes.Equal(cert.RawIssuer, c.RawSubject) {
+				// check signature
+				hashed := sha1.Sum(cert.RawTBSCertificate) // nolint:gosec
+				if err := rsa.VerifyPKCS1v15(c.PublicKey.(*rsa.PublicKey), crypto.SHA1, hashed[:], cert.Signature); err != nil {
+					return fmt.Errorf("could not verify chained certificate signature: %w", err)
+				}
+				cert = c
+				continue outer
+			}
+		}
+		return errors.New("certificate root not found")
+	}
+}
+
+// ParseDeviceinfo attempts to parse the provided string, assuming it to be the base64-encoded value
+// of an x-apple-aspen-deviceinfo header. If successful, it returns the parsed *MachineInfo. If the
+// verify parameter is specified as true, the signature is also verified against Apple's Root CA and
+// an error will be returned if the signature is invalid.
+//
+// Warning: The information in this header, despite being signed by Apple PKI, shouldn't be trusted
+// for device attestation or other security purposes. See the related [documentation] and referenced
+// [article] for more information.
+//
+// [documentation]: https://github.com/korylprince/dep-webview-oidc/blob/2dd846a54fed04c16dd227b8c6c31665b4d0ebd8/docs/Architecture.md#x-apple-aspen-deviceinfo-header
+// [article]: https://duo.com/labs/research/mdm-me-maybe
+func ParseDeviceinfo(b64 string, verify bool) (*MachineInfo, error) {
+	buf, err := base64.StdEncoding.DecodeString(b64)
+	if err != nil {
+		return nil, fmt.Errorf("could not decode base64: %w", err)
+	}
+
+	p7, err := pkcs7.Parse(buf)
+	if err != nil {
+		return nil, fmt.Errorf("could not decode pkcs7: %w", err)
+	}
+
+	// verify signature and certificate chain
+	if verify {
+		if err = verifyPKCS7SHA1RSA(p7, verify); err != nil {
+			return nil, fmt.Errorf("could not verify signature: %w", err)
+		}
+	}
+
+	info := new(MachineInfo)
+	if err = plist.Unmarshal(p7.Content, info); err != nil {
+		return nil, fmt.Errorf("could not decode plist: %w", err)
+	}
+
+	return info, nil
+}
diff --git a/server/mdm/apple/gdmf/api.go b/server/mdm/apple/gdmf/api.go
new file mode 100644
index 000000000000..3fdea7ab5195
--- /dev/null
+++ b/server/mdm/apple/gdmf/api.go
@@ -0,0 +1,197 @@
+package gdmf
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/cenkalti/backoff"
+	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
+	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
+)
+
+const baseURL = "https://gdmf.apple.com/v2/pmv"
+
+// Asset represents the metadata for an asset in the Apple Software Lookup Service[1][2].
+// Example:
+//
+//	{
+//	    "ProductVersion": "14.6.1",
+//	    "Build": "23G93",
+//	    "PostingDate": "2024-08-07",
+//	    "ExpirationDate": "2024-11-11",
+//	    "SupportedDevices": [
+//	        "J132AP",
+//	        "VMA2MACOSAP",
+//	        "VMM-x86_64"
+//	    ]
+//	}
+//
+// [1]: http://gdmf.apple.com/v2/pmv
+// [2]:
+// https://support.apple.com/guide/deployment/use-mdm-to-deploy-software-updates-depafd2fad80/web
+type Asset struct {
+	ProductVersion   string   `json:"ProductVersion"`
+	Build            string   `json:"Build"`
+	PostingDate      string   `json:"PostingDate"`
+	ExpirationDate   string   `json:"ExpirationDate"`
+	SupportedDevices []string `json:"SupportedDevices"`
+}
+
+// AssetSets represents the metadata for a set of assets in the Apple Software Lookup Service[1][2].
+// [1]: http://gdmf.apple.com/v2/pmv
+// [2]: https://support.apple.com/guide/deployment/use-mdm-to-deploy-software-updates-depafd2fad80/web
+type AssetSets struct {
+	IOS   []Asset `json:"iOS"`
+	MacOS []Asset `json:"macOS"`
+	// VisionOS []Asset `json:"visionOS"` // Fleet doesn't support visionOS yet
+	// XROS     []Asset `json:"xrOS"`    // Fleet doesn't support xrOS yet
+}
+
+// APIResponse represents the response from the Apple Software Lookup Service[1][2].
+// [1]: http://gdmf.apple.com/v2/pmv
+// [2]: https://support.apple.com/guide/deployment/use-mdm-to-deploy-software-updates-depafd2fad80/web
+type APIResponse struct {
+	PublicAssetSets AssetSets `json:"PublicAssetSets"`
+	AssetSets       AssetSets `json:"AssetSets"`
+	// PublicRapidSecurityResponses interface{} `json:"PublicRapidSecurityResponses"` // Fleet doesn't support PublicRapidSecurityResponses yet
+}
+
+// GetLatestOSVersion returns the latest OS version for the given device. The device is matched
+// against the Apple Software Update Lookup Service[1][2] to find the latest version. If no matching
+// asset is found, an error is returned.
+// [1]: http://gdmf.apple.com/v2/pmv
+// [2]: https://support.apple.com/guide/deployment/use-mdm-to-deploy-software-updates-depafd2fad80/web
+func GetLatestOSVersion(device apple_mdm.MachineInfo) (*Asset, error) {
+	r, err := GetAssetMetadata()
+	if err != nil {
+		return nil, fmt.Errorf("retrieving asset metadata: %w", err)
+	}
+
+	assetSet := r.PublicAssetSets.MacOS // default to public asset set; note that if the device is not macOS, iPhone, or iPad, we'll fail to match the supported device and return an error below
+	if strings.HasPrefix(device.Product, "iPhone") ||
+		strings.HasPrefix(device.Product, "iPad") ||
+		strings.HasPrefix(device.SoftwareUpdateDeviceID, "iPhone") ||
+		strings.HasPrefix(device.SoftwareUpdateDeviceID, "iPad") {
+		assetSet = r.PublicAssetSets.IOS
+	}
+	latestIdx := -1
+	for i, s := range assetSet {
+		for _, d := range s.SupportedDevices {
+			if d == device.Product || d == device.SoftwareUpdateDeviceID {
+				if latestIdx == -1 {
+					latestIdx = i // first match found, update the index
+					continue
+				}
+				if apple_mdm.CompareVersions(assetSet[latestIdx].ProductVersion, s.ProductVersion) < 0 {
+					latestIdx = i // found a later version, update the index
+				}
+			}
+		}
+	}
+	if latestIdx == -1 {
+		return nil, fmt.Errorf("no matching asset found for device %s", device.Product)
+	}
+	return &assetSet[latestIdx], nil
+}
+
+// client is a package-level client (similar to http.DefaultClient) so it can
+// be reused instead of created as needed, as the internal Transport typically
+// has internal state (cached connections, etc) and it's safe for concurrent
+// use.
+var client = fleethttp.NewClient(fleethttp.WithTimeout(10 * time.Second))
+
+// GetAssetMetadata retrieves the asset metadata from the Apple Software Lookup Service[1][2].
+// [1]: http://gdmf.apple.com/v2/pmv
+// [2]: https://support.apple.com/guide/deployment/use-mdm-to-deploy-software-updates-depafd2fad80/web
+func GetAssetMetadata() (*APIResponse, error) {
+	baseURL := getBaseURL()
+	reqURL, err := url.Parse(baseURL)
+	if err != nil {
+		return nil, fmt.Errorf("parsing base URL: %w", err)
+	}
+
+	req, err := http.NewRequest(http.MethodGet, reqURL.String(), nil)
+	if err != nil {
+		return nil, fmt.Errorf("creating request to Apple endpoint: %w", err)
+	}
+	req.Header.Set("User-Agent", "fleet-device-management")
+
+	resp, err := doWithRetry(req)
+	if err != nil {
+		return nil, fmt.Errorf("retrieving asset metadata: %w", err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("reading response body from Apple endpoint: %w", err)
+	}
+	var dest APIResponse
+	if err := json.Unmarshal(body, &dest); err != nil {
+		return nil, fmt.Errorf("decoding response data from Apple endpoint: %w", err)
+	}
+
+	return &dest, nil
+}
+
+func doWithRetry(req *http.Request) (*http.Response, error) {
+	const (
+		maxRetries           = 3
+		retryBackoff         = 1 * time.Second
+		maxWaitForRetryAfter = 10 * time.Second
+	)
+	var resp *http.Response
+	var err error
+	op := func() error {
+		resp, err = client.Do(req)
+		if err != nil {
+			return err
+		}
+
+		defer func() {
+			if resp != nil && resp.StatusCode >= http.StatusBadRequest {
+				// consume and close the body for retried requests to prevent resource leaks
+				_, _ = io.ReadAll(resp.Body)
+				resp.Body.Close()
+			}
+		}()
+
+		if resp.StatusCode == http.StatusTooManyRequests {
+			// handle 429 rate-limits
+			rawAfter := resp.Header.Get("Retry-After")
+			afterSecs, err := strconv.ParseInt(rawAfter, 10, 0)
+			if err == nil && (time.Duration(afterSecs)*time.Second) < maxWaitForRetryAfter {
+				// the retry-after duration is reasonable, wait for it and return a
+				// retryable error so that we try again.
+				time.Sleep(time.Duration(afterSecs) * time.Second)
+				return errors.New("retry after requested delay")
+			}
+		}
+		if resp.StatusCode >= http.StatusBadRequest {
+			// 400+ status can be worth retrying
+			return fmt.Errorf("calling gdmf endpoint failed with status %d", resp.StatusCode)
+		}
+		return nil
+	}
+
+	if err := backoff.Retry(op, backoff.WithMaxRetries(backoff.NewConstantBackOff(retryBackoff), uint64(maxRetries))); err != nil {
+		return nil, err
+	}
+
+	return resp, err
+}
+
+func getBaseURL() string {
+	devURL := os.Getenv("FLEET_DEV_GDMF_URL")
+	if devURL != "" {
+		return devURL
+	}
+	return baseURL
+}
diff --git a/server/mdm/apple/gdmf/api_test.go b/server/mdm/apple/gdmf/api_test.go
new file mode 100644
index 000000000000..8b78420fb03c
--- /dev/null
+++ b/server/mdm/apple/gdmf/api_test.go
@@ -0,0 +1,247 @@
+package gdmf
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+
+	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetLatest(t *testing.T) {
+	// test GetLatestOSVersion using a mock server that returns a known response
+	// and ensure the response is parsed correctly
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		// load the test data from the file
+		b, err := os.ReadFile("./testdata/gdmf.json")
+		require.NoError(t, err)
+		_, err = w.Write(b)
+		require.NoError(t, err)
+	}))
+	defer srv.Close()
+	t.Setenv("FLEET_DEV_GDMF_URL", srv.URL)
+
+	// test the function
+	d := apple_mdm.MachineInfo{
+		MDMCanRequestSoftwareUpdate: true,
+		OSVersion:                   "14.4.1",
+		Product:                     "Mac15,7",
+		Serial:                      "TESTSERIAL",
+		SoftwareUpdateDeviceID:      "J516sAP",
+		SupplementalBuildVersion:    "23E224",
+		UDID:                        uuid.New().String(),
+		Version:                     "23E224",
+	}
+
+	latestMacOSVersion := "14.6.1"
+	latestMacOSBuild := "23G93"
+	latestIOSVersion := "17.6.1"
+	latestIOSBuild := "21G93"
+
+	resp, err := GetLatestOSVersion(d)
+	require.NoError(t, err)
+	require.Equal(t, latestMacOSVersion, resp.ProductVersion)
+	require.Equal(t, latestMacOSBuild, resp.Build)
+
+	// NOTE: GetLatestOSVersion does not depend on the value of MDMCanRequestSoftwareUpdate. It is
+	// expected that the caller has already verified this value before calling GetLatestOSVersion.
+
+	tests := []struct {
+		name            string
+		machineInfo     apple_mdm.MachineInfo
+		expectedVersion string
+		expectedBuild   string
+		expectError     bool
+	}{
+		{
+			name: "macOS matching software update device ID",
+			machineInfo: apple_mdm.MachineInfo{
+				OSVersion:                "14.4.1",
+				Product:                  "Mac15,7",
+				Serial:                   "TESTSERIAL",
+				SoftwareUpdateDeviceID:   "J516sAP",
+				SupplementalBuildVersion: "23E224",
+				UDID:                     uuid.New().String(),
+				Version:                  "23E224",
+			},
+			expectedVersion: latestMacOSVersion,
+			expectedBuild:   latestMacOSBuild,
+			expectError:     false,
+		},
+		{
+			// macOS generally relies on the SoftwareUpdateDeviceID field and not the Product field
+			name: "macOS non-matching software update device ID",
+			machineInfo: apple_mdm.MachineInfo{
+				OSVersion:                "14.4.1",
+				Product:                  "Mac15,7",
+				Serial:                   "TESTSERIAL",
+				SoftwareUpdateDeviceID:   "INVALID",
+				SupplementalBuildVersion: "23E224",
+				UDID:                     uuid.New().String(),
+				Version:                  "23E224",
+			},
+			expectedVersion: latestMacOSVersion,
+			expectedBuild:   latestMacOSBuild,
+			expectError:     true,
+		},
+		{
+			// this should never happen in practice, but by default we still check macOS assets to
+			// match the software update device ID
+			name: "non-matching product but matching software update device ID",
+			machineInfo: apple_mdm.MachineInfo{
+				OSVersion:                "14.4.1",
+				Product:                  "INVALID",
+				Serial:                   "TESTSERIAL",
+				SoftwareUpdateDeviceID:   "J516sAP",
+				SupplementalBuildVersion: "23E224",
+				UDID:                     uuid.New().String(),
+				Version:                  "23E224",
+			},
+			expectedVersion: latestMacOSVersion,
+			expectedBuild:   latestMacOSBuild,
+			expectError:     false,
+		},
+		{
+			name: "non-matching product and software update device ID",
+			machineInfo: apple_mdm.MachineInfo{
+				OSVersion:                "14.4.1",
+				Product:                  "INVALID",
+				Serial:                   "TESTSERIAL",
+				SoftwareUpdateDeviceID:   "INVALID",
+				SupplementalBuildVersion: "23E224",
+				UDID:                     uuid.New().String(),
+				Version:                  "23E224",
+			},
+			expectedVersion: "",
+			expectedBuild:   "",
+			expectError:     true,
+		},
+		{
+			// missing other fields is not an error, this function always returns the latest
+			// version and only depends on the Product and SoftwareUpdateDeviceID fields
+			name: "missing other fields",
+			machineInfo: apple_mdm.MachineInfo{
+				OSVersion:              "",
+				Product:                "Mac15,7",
+				SoftwareUpdateDeviceID: "J516sAP",
+			},
+			expectedVersion: latestMacOSVersion,
+			expectedBuild:   latestMacOSBuild,
+			expectError:     false,
+		},
+		{
+			name: "iphone matching product and software update device ID",
+			machineInfo: apple_mdm.MachineInfo{
+				OSVersion:                "17.5.1",
+				Product:                  "iPhone14,6",
+				Serial:                   "TESTSERIAL",
+				SoftwareUpdateDeviceID:   "iPhone14,6",
+				SupplementalBuildVersion: "21F90",
+				UDID:                     uuid.New().String(),
+				Version:                  "21F90",
+			},
+			expectedVersion: latestIOSVersion,
+			expectedBuild:   latestIOSBuild,
+			expectError:     false,
+		},
+		{
+			// iOS generally relies on the Product field and not the SoftwareUpdateDeviceID field so
+			// this won't error even though the SoftwareUpdateDeviceID is invalid
+			name: "iphone non-matching software update device ID",
+			machineInfo: apple_mdm.MachineInfo{
+				OSVersion:                "17.5.1",
+				Product:                  "iPhone14,6",
+				Serial:                   "TESTSERIAL",
+				SoftwareUpdateDeviceID:   "INVALID",
+				SupplementalBuildVersion: "21F90",
+				UDID:                     uuid.New().String(),
+				Version:                  "21F90",
+			},
+			expectedVersion: latestIOSVersion,
+			expectedBuild:   latestIOSBuild,
+			expectError:     false,
+		},
+		{
+			// this should never happen in practice, but we'll still try to match iOS assets if the
+			// software update device ID starts with "iPhone" or "iPad"
+			name: "missing product but valid iphone software update device ID",
+			machineInfo: apple_mdm.MachineInfo{
+				OSVersion:                "17.5.1",
+				Product:                  "",
+				Serial:                   "TESTSERIAL",
+				SoftwareUpdateDeviceID:   "iPhone14,6",
+				SupplementalBuildVersion: "21F90",
+				UDID:                     uuid.New().String(),
+				Version:                  "21F90",
+			},
+			expectedVersion: latestIOSVersion,
+			expectedBuild:   latestIOSBuild,
+			expectError:     false,
+		},
+		{
+			// we don't support other Apple products yet, so this should always error
+			// because we we default to the macOS asset set and we won't find a matching asset there
+			name: "unsupported product",
+			machineInfo: apple_mdm.MachineInfo{
+				OSVersion:                "8.8.1",
+				Product:                  "Watch3,1",
+				Serial:                   "TESTSERIAL",
+				SoftwareUpdateDeviceID:   "Watch3,1",
+				SupplementalBuildVersion: "19U512",
+				UDID:                     uuid.New().String(),
+				Version:                  "19U512",
+			},
+			expectedVersion: "",
+			expectedBuild:   "",
+			expectError:     true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			resp, err := GetLatestOSVersion(tt.machineInfo)
+			if tt.expectError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+				require.Equal(t, tt.expectedVersion, resp.ProductVersion)
+				require.Equal(t, tt.expectedBuild, resp.Build)
+			}
+		})
+	}
+}
+
+func TestRetries(t *testing.T) {
+	retryCount := 0
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		retryCount++
+		w.WriteHeader(http.StatusBadRequest)
+		_, err := w.Write([]byte(`{"error": "bad request"}`))
+		require.NoError(t, err)
+	}))
+	os.Setenv("FLEET_DEV_GDMF_URL", srv.URL)
+	t.Cleanup(func() {
+		srv.Close()
+		os.Unsetenv("FLEET_DEV_GDMF_URL")
+	})
+
+	latest, err := GetLatestOSVersion(apple_mdm.MachineInfo{
+		OSVersion:                "14.4.1",
+		Product:                  "Mac15,7",
+		Serial:                   "TESTSERIAL",
+		SoftwareUpdateDeviceID:   "J516sAP",
+		SupplementalBuildVersion: "23E224",
+		UDID:                     uuid.New().String(),
+		Version:                  "23E224",
+	})
+
+	require.Error(t, err)
+	require.ErrorContains(t, err, "calling gdmf endpoint failed with status 400")
+	require.Nil(t, latest)
+	require.Equal(t, 4, retryCount)
+}
diff --git a/server/mdm/apple/gdmf/testdata/gdmf.json b/server/mdm/apple/gdmf/testdata/gdmf.json
new file mode 100644
index 000000000000..7993d37b4d5b
--- /dev/null
+++ b/server/mdm/apple/gdmf/testdata/gdmf.json
@@ -0,0 +1,3325 @@
+{
+  "PublicAssetSets": {
+    "iOS": [
+      {
+        "ProductVersion": "6.3",
+        "Build": "17U6208",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": ["Watch2,3", "Watch2,4", "Watch2,6", "Watch2,7"]
+      },
+      {
+        "ProductVersion": "1.3",
+        "Build": "21O771",
+        "PostingDate": "2024-08-05",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": ["RealityDevice14,1"]
+      },
+      {
+        "ProductVersion": "10.6",
+        "Build": "21U6577",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9",
+          "Watch7,1",
+          "Watch7,2",
+          "Watch7,3",
+          "Watch7,4",
+          "Watch7,5"
+        ]
+      },
+      {
+        "ProductVersion": "1.3",
+        "Build": "21O6771",
+        "PostingDate": "2024-08-05",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": ["RealityDevice14,1"]
+      },
+      {
+        "ProductVersion": "17.6",
+        "Build": "21M71",
+        "PostingDate": "2024-08-05",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "AppleTV11,1",
+          "AppleTV14,1",
+          "AppleTV5,3",
+          "AppleTV6,2"
+        ]
+      },
+      {
+        "ProductVersion": "17.6",
+        "Build": "21M71",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "AudioAccessory1,1",
+          "AudioAccessory5,1",
+          "AudioAccessory6,1"
+        ]
+      },
+      {
+        "ProductVersion": "8.8.1",
+        "Build": "19U6512",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch3,1",
+          "Watch3,2",
+          "Watch3,3",
+          "Watch3,4",
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.10",
+        "Build": "20H6350",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad6,11",
+          "iPad6,12",
+          "iPad6,3",
+          "iPad6,4",
+          "iPad6,7",
+          "iPad6,8",
+          "iPhone10,1",
+          "iPhone10,2",
+          "iPhone10,3",
+          "iPhone10,4",
+          "iPhone10,5",
+          "iPhone10,6"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.2",
+        "Build": "20H115",
+        "PostingDate": "2023-10-25",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3"
+        ]
+      },
+      {
+        "ProductVersion": "17.6.1",
+        "Build": "21G93",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.2",
+        "Build": "20H6115",
+        "PostingDate": "2023-10-25",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.10",
+        "Build": "20H350",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad6,11",
+          "iPad6,12",
+          "iPad6,3",
+          "iPad6,4",
+          "iPad6,7",
+          "iPad6,8",
+          "iPhone10,1",
+          "iPhone10,2",
+          "iPhone10,3",
+          "iPhone10,4",
+          "iPhone10,5",
+          "iPhone10,6"
+        ]
+      },
+      {
+        "ProductVersion": "9.6.3",
+        "Build": "20U502",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9"
+        ]
+      },
+      {
+        "ProductVersion": "6.3",
+        "Build": "17U208",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": ["Watch2,3", "Watch2,4", "Watch2,6", "Watch2,7"]
+      },
+      {
+        "ProductVersion": "8.8.1",
+        "Build": "19U512",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch3,1",
+          "Watch3,2",
+          "Watch3,3",
+          "Watch3,4",
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9"
+        ]
+      },
+      {
+        "ProductVersion": "17.6",
+        "Build": "21M6071",
+        "PostingDate": "2024-08-05",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "AppleTV11,1",
+          "AppleTV14,1",
+          "AppleTV5,3",
+          "AppleTV6,2"
+        ]
+      },
+      {
+        "ProductVersion": "17.6",
+        "Build": "21M6071",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "AudioAccessory1,1",
+          "AudioAccessory5,1",
+          "AudioAccessory6,1"
+        ]
+      },
+      {
+        "ProductVersion": "17.6.1",
+        "Build": "21G6093",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "12.5.7",
+        "Build": "16H81",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad4,1",
+          "iPad4,2",
+          "iPad4,3",
+          "iPad4,4",
+          "iPad4,5",
+          "iPad4,6",
+          "iPad4,7",
+          "iPad4,8",
+          "iPad4,9",
+          "iPhone6,1",
+          "iPhone6,2",
+          "iPhone7,1",
+          "iPhone7,2",
+          "iPod7,1"
+        ]
+      },
+      {
+        "ProductVersion": "12.5.7",
+        "Build": "16H6081",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad4,1",
+          "iPad4,2",
+          "iPad4,3",
+          "iPad4,4",
+          "iPad4,5",
+          "iPad4,6",
+          "iPad4,7",
+          "iPad4,8",
+          "iPad4,9",
+          "iPhone6,1",
+          "iPhone6,2",
+          "iPhone7,1",
+          "iPhone7,2",
+          "iPod7,1"
+        ]
+      },
+      {
+        "ProductVersion": "15.8.3",
+        "Build": "19H386",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad5,1",
+          "iPad5,2",
+          "iPad5,3",
+          "iPad5,4",
+          "iPhone8,1",
+          "iPhone8,2",
+          "iPhone8,4",
+          "iPhone9,1",
+          "iPhone9,2",
+          "iPhone9,3",
+          "iPhone9,4",
+          "iPod9,1"
+        ]
+      },
+      {
+        "ProductVersion": "10.6",
+        "Build": "21U577",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9",
+          "Watch7,1",
+          "Watch7,2",
+          "Watch7,3",
+          "Watch7,4",
+          "Watch7,5"
+        ]
+      },
+      {
+        "ProductVersion": "5.3.9",
+        "Build": "16U693",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch2,3",
+          "Watch2,4",
+          "Watch2,6",
+          "Watch2,7",
+          "Watch3,1",
+          "Watch3,2",
+          "Watch3,3",
+          "Watch3,4",
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4"
+        ]
+      },
+      {
+        "ProductVersion": "15.8.3",
+        "Build": "19H6386",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad5,1",
+          "iPad5,2",
+          "iPad5,3",
+          "iPad5,4",
+          "iPhone8,1",
+          "iPhone8,2",
+          "iPhone8,4",
+          "iPhone9,1",
+          "iPhone9,2",
+          "iPhone9,3",
+          "iPhone9,4",
+          "iPod9,1"
+        ]
+      },
+      {
+        "ProductVersion": "9.6.3",
+        "Build": "20U6502",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9"
+        ]
+      }
+    ],
+    "visionOS": [
+      {
+        "ProductVersion": "1.1.2",
+        "Build": "21O231",
+        "PostingDate": "2024-04-12",
+        "ExpirationDate": "2024-09-08",
+        "SupportedDevices": ["RealityDevice14,1"]
+      },
+      {
+        "ProductVersion": "1.1.2",
+        "Build": "21O6231",
+        "PostingDate": "2024-04-12",
+        "ExpirationDate": "2024-09-08",
+        "SupportedDevices": ["RealityDevice14,1"]
+      }
+    ],
+    "xrOS": [
+      {
+        "ProductVersion": "1.0.3",
+        "Build": "21N333",
+        "PostingDate": "2024-02-12",
+        "ExpirationDate": "2024-06-05",
+        "SupportedDevices": ["RealityDevice14,1"]
+      }
+    ],
+    "macOS": [
+      {
+        "ProductVersion": "14.6.1",
+        "Build": "23G93",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J180dAP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J414cAP",
+          "J414sAP",
+          "J415AP",
+          "J416cAP",
+          "J416sAP",
+          "J433AP",
+          "J434AP",
+          "J456AP",
+          "J457AP",
+          "J473AP",
+          "J474sAP",
+          "J475cAP",
+          "J475dAP",
+          "J493AP",
+          "J504AP",
+          "J514cAP",
+          "J514mAP",
+          "J514sAP",
+          "J516cAP",
+          "J516mAP",
+          "J516sAP",
+          "J613AP",
+          "J615AP",
+          "J680AP",
+          "J780AP",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-63001698E7A34814",
+          "Mac-937A206F2EE63C01",
+          "Mac-AA95B1DDAB278B95",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "13.6.9",
+        "Build": "22G830",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J180dAP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J414cAP",
+          "J414sAP",
+          "J415AP",
+          "J416cAP",
+          "J416sAP",
+          "J433AP",
+          "J434AP",
+          "J456AP",
+          "J457AP",
+          "J473AP",
+          "J474sAP",
+          "J475cAP",
+          "J475dAP",
+          "J493AP",
+          "J504AP",
+          "J680AP",
+          "J780AP",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-4B682C642B45593E",
+          "Mac-551B86E5744E2388",
+          "Mac-63001698E7A34814",
+          "Mac-77F17D7DA9285301",
+          "Mac-937A206F2EE63C01",
+          "Mac-AA95B1DDAB278B95",
+          "Mac-B4831CEBD52A0C4C",
+          "Mac-BE088AF8C5EB4FA2",
+          "Mac-CAD6701F7CEA0921",
+          "Mac-EE2EBD4B90B839A8",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "12.7.6",
+        "Build": "21H1320",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J456AP",
+          "J457AP",
+          "J493AP",
+          "J680AP",
+          "J780AP",
+          "Mac-06F11F11946D27C5",
+          "Mac-06F11FD93F0323C5",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-35C5E08120C7EEAF",
+          "Mac-473D31EABEB93F9B",
+          "Mac-4B682C642B45593E",
+          "Mac-551B86E5744E2388",
+          "Mac-63001698E7A34814",
+          "Mac-65CE76090165799A",
+          "Mac-66E35819EE2D0D05",
+          "Mac-77F17D7DA9285301",
+          "Mac-937A206F2EE63C01",
+          "Mac-937CB26E2E02BB01",
+          "Mac-9AE82516C7C6B903",
+          "Mac-9F18E312C5C2BF0B",
+          "Mac-A369DDC4E67F1C45",
+          "Mac-A5C67F76ED83108C",
+          "Mac-AA95B1DDAB278B95",
+          "Mac-B4831CEBD52A0C4C",
+          "Mac-B809C3757DA9BB8D",
+          "Mac-BE088AF8C5EB4FA2",
+          "Mac-CAD6701F7CEA0921",
+          "Mac-DB15BD556843C820",
+          "Mac-E43C1C25D4880AD6",
+          "Mac-EE2EBD4B90B839A8",
+          "Mac-F60DEB81FF30ACF6",
+          "Mac-FFE5EF870D7BA81A",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "11.7.10",
+        "Build": "20G1427",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J456AP",
+          "J457AP",
+          "J680AP",
+          "J780AP",
+          "Mac-06F11F11946D27C5",
+          "Mac-06F11FD93F0323C5",
+          "Mac-0CFF9C7C2B63DF8D",
+          "Mac-112818653D3AABFC",
+          "Mac-112B0A653D3AAB9C",
+          "Mac-189A3D4F975D5FFC",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-226CB3C6A851A671",
+          "Mac-27AD2F918AE68F61",
+          "Mac-2BD1B31983FE1663",
+          "Mac-35C1E88140C3E6CF",
+          "Mac-35C5E08120C7EEAF",
+          "Mac-36B6B6DA9CFCD881",
+          "Mac-3CBD00234E554E41",
+          "Mac-42FD25EABCABB274",
+          "Mac-473D31EABEB93F9B",
+          "Mac-4B682C642B45593E",
+          "Mac-50619A408DB004DA",
+          "Mac-53FDB3D8DB8CA971",
+          "Mac-551B86E5744E2388",
+          "Mac-5A49A77366F81C72",
+          "Mac-5F9802EFE386AA28",
+          "Mac-63001698E7A34814",
+          "Mac-65CE76090165799A",
+          "Mac-66E35819EE2D0D05",
+          "Mac-747B1AEFF11738BE",
+          "Mac-77F17D7DA9285301",
+          "Mac-7BA5B2D9E42DDD94",
+          "Mac-7BA5B2DFE22DDD8C",
+          "Mac-7DF21CB3ED6977E5",
+          "Mac-81E3E92DD6088272",
+          "Mac-827FAC58A8FDFA22",
+          "Mac-827FB448E656EC26",
+          "Mac-90BE64C3CB5A9AEB",
+          "Mac-937A206F2EE63C01",
+          "Mac-937CB26E2E02BB01",
+          "Mac-9394BDF4BF862EE7",
+          "Mac-9AE82516C7C6B903",
+          "Mac-9F18E312C5C2BF0B",
+          "Mac-A369DDC4E67F1C45",
+          "Mac-A5C67F76ED83108C",
+          "Mac-A61BADE1FDAD7B05",
+          "Mac-AA95B1DDAB278B95",
+          "Mac-AF89B6D9451A490B",
+          "Mac-B4831CEBD52A0C4C",
+          "Mac-B809C3757DA9BB8D",
+          "Mac-BE088AF8C5EB4FA2",
+          "Mac-BE0E8AC46FE800CC",
+          "Mac-C6F71043CEAA02A6",
+          "Mac-CAD6701F7CEA0921",
+          "Mac-CF21D135A7D34AA6",
+          "Mac-CFF7D910A743CAAF",
+          "Mac-DB15BD556843C820",
+          "Mac-E1008331FDC96864",
+          "Mac-E43C1C25D4880AD6",
+          "Mac-E7203C0F68AA0004",
+          "Mac-EE2EBD4B90B839A8",
+          "Mac-F305150B0C7DEEEF",
+          "Mac-F60DEB81FF30ACF6",
+          "Mac-FA842E06C61E91C5",
+          "Mac-FFE5EF870D7BA81A",
+          "VMM-x86_64",
+          "X589AMLUAP",
+          "X589ICLYAP",
+          "X86LEGACYAP"
+        ]
+      }
+    ]
+  },
+  "AssetSets": {
+    "iOS": [
+      {
+        "ProductVersion": "6.3",
+        "Build": "17U6208",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": ["Watch2,3", "Watch2,4", "Watch2,6", "Watch2,7"]
+      },
+      {
+        "ProductVersion": "17.5",
+        "Build": "21L569",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": [
+          "AudioAccessory1,1",
+          "AudioAccessory5,1",
+          "AudioAccessory6,1"
+        ]
+      },
+      {
+        "ProductVersion": "17.5",
+        "Build": "21L569",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-08-19",
+        "SupportedDevices": [
+          "AppleTV11,1",
+          "AppleTV14,1",
+          "AppleTV5,3",
+          "AppleTV6,2"
+        ]
+      },
+      {
+        "ProductVersion": "10.6",
+        "Build": "21U6577",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9",
+          "Watch7,1",
+          "Watch7,2",
+          "Watch7,3",
+          "Watch7,4",
+          "Watch7,5"
+        ]
+      },
+      {
+        "ProductVersion": "17.5",
+        "Build": "21F6079",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-08-18",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "17.6",
+        "Build": "21G6080",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-05",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "17.6",
+        "Build": "21M71",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "AppleTV11,1",
+          "AppleTV14,1",
+          "AppleTV5,3",
+          "AppleTV6,2",
+          "AudioAccessory1,1",
+          "AudioAccessory5,1",
+          "AudioAccessory6,1"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.10",
+        "Build": "20H6350",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad6,11",
+          "iPad6,12",
+          "iPad6,3",
+          "iPad6,4",
+          "iPad6,7",
+          "iPad6,8",
+          "iPhone10,1",
+          "iPhone10,2",
+          "iPhone10,3",
+          "iPhone10,4",
+          "iPhone10,5",
+          "iPhone10,6"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.2",
+        "Build": "20H115",
+        "PostingDate": "2023-10-25",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3"
+        ]
+      },
+      {
+        "ProductVersion": "10.5",
+        "Build": "21T576",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9",
+          "Watch7,1",
+          "Watch7,2",
+          "Watch7,3",
+          "Watch7,4",
+          "Watch7,5"
+        ]
+      },
+      {
+        "ProductVersion": "17.5",
+        "Build": "21F6084",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-08-18",
+        "SupportedDevices": [
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.2",
+        "Build": "20H6115",
+        "PostingDate": "2023-10-25",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.10",
+        "Build": "20H350",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad6,11",
+          "iPad6,12",
+          "iPad6,3",
+          "iPad6,4",
+          "iPad6,7",
+          "iPad6,8",
+          "iPhone10,1",
+          "iPhone10,2",
+          "iPhone10,3",
+          "iPhone10,4",
+          "iPhone10,5",
+          "iPhone10,6"
+        ]
+      },
+      {
+        "ProductVersion": "10.5",
+        "Build": "21T6576",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9",
+          "Watch7,1",
+          "Watch7,2",
+          "Watch7,3",
+          "Watch7,4",
+          "Watch7,5"
+        ]
+      },
+      {
+        "ProductVersion": "6.3",
+        "Build": "17U208",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": ["Watch2,3", "Watch2,4", "Watch2,6", "Watch2,7"]
+      },
+      {
+        "ProductVersion": "8.8.1",
+        "Build": "19U512",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch3,1",
+          "Watch3,2",
+          "Watch3,3",
+          "Watch3,4",
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9"
+        ]
+      },
+      {
+        "ProductVersion": "17.6.1",
+        "Build": "21G6093",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "15.8.2",
+        "Build": "19H384",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad5,1",
+          "iPad5,2",
+          "iPad5,3",
+          "iPad5,4",
+          "iPhone8,1",
+          "iPhone8,2",
+          "iPhone8,4",
+          "iPhone9,1",
+          "iPhone9,2",
+          "iPhone9,3",
+          "iPhone9,4",
+          "iPod9,1"
+        ]
+      },
+      {
+        "ProductVersion": "1.2",
+        "Build": "21O589",
+        "PostingDate": "2024-06-10",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": ["RealityDevice14,1"]
+      },
+      {
+        "ProductVersion": "17.5.1",
+        "Build": "21F6090",
+        "PostingDate": "2024-05-20",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "12.5.7",
+        "Build": "16H81",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad4,1",
+          "iPad4,2",
+          "iPad4,3",
+          "iPad4,4",
+          "iPad4,5",
+          "iPad4,6",
+          "iPad4,7",
+          "iPad4,8",
+          "iPad4,9",
+          "iPhone6,1",
+          "iPhone6,2",
+          "iPhone7,1",
+          "iPhone7,2",
+          "iPod7,1"
+        ]
+      },
+      {
+        "ProductVersion": "12.5.7",
+        "Build": "16H6081",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad4,1",
+          "iPad4,2",
+          "iPad4,3",
+          "iPad4,4",
+          "iPad4,5",
+          "iPad4,6",
+          "iPad4,7",
+          "iPad4,8",
+          "iPad4,9",
+          "iPhone6,1",
+          "iPhone6,2",
+          "iPhone7,1",
+          "iPhone7,2",
+          "iPod7,1"
+        ]
+      },
+      {
+        "ProductVersion": "10.6",
+        "Build": "21U577",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9",
+          "Watch7,1",
+          "Watch7,2",
+          "Watch7,3",
+          "Watch7,4",
+          "Watch7,5"
+        ]
+      },
+      {
+        "ProductVersion": "15.8.3",
+        "Build": "19H386",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad5,1",
+          "iPad5,2",
+          "iPad5,3",
+          "iPad5,4",
+          "iPhone8,1",
+          "iPhone8,2",
+          "iPhone8,4",
+          "iPhone9,1",
+          "iPhone9,2",
+          "iPhone9,3",
+          "iPhone9,4",
+          "iPod9,1"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.8",
+        "Build": "20H6343",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad6,11",
+          "iPad6,12",
+          "iPad6,3",
+          "iPad6,4",
+          "iPad6,7",
+          "iPad6,8",
+          "iPhone10,1",
+          "iPhone10,2",
+          "iPhone10,3",
+          "iPhone10,4",
+          "iPhone10,5",
+          "iPhone10,6"
+        ]
+      },
+      {
+        "ProductVersion": "17.6",
+        "Build": "21G80",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-05",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "17.5.1",
+        "Build": "21L6580",
+        "PostingDate": "2024-05-21",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": [
+          "AppleTV11,1",
+          "AppleTV14,1",
+          "AppleTV5,3",
+          "AppleTV6,2"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.9",
+        "Build": "20H6348",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-05",
+        "SupportedDevices": [
+          "iPad6,11",
+          "iPad6,12",
+          "iPad6,3",
+          "iPad6,4",
+          "iPad6,7",
+          "iPad6,8",
+          "iPhone10,1",
+          "iPhone10,2",
+          "iPhone10,3",
+          "iPhone10,4",
+          "iPhone10,5",
+          "iPhone10,6"
+        ]
+      },
+      {
+        "ProductVersion": "5.3.9",
+        "Build": "16U693",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch2,3",
+          "Watch2,4",
+          "Watch2,6",
+          "Watch2,7",
+          "Watch3,1",
+          "Watch3,2",
+          "Watch3,3",
+          "Watch3,4",
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4"
+        ]
+      },
+      {
+        "ProductVersion": "17.5.1",
+        "Build": "21L580",
+        "PostingDate": "2024-05-21",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": [
+          "AppleTV11,1",
+          "AppleTV14,1",
+          "AppleTV5,3",
+          "AppleTV6,2"
+        ]
+      },
+      {
+        "ProductVersion": "1.3",
+        "Build": "21O771",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": ["RealityDevice14,1"]
+      },
+      {
+        "ProductVersion": "1.3",
+        "Build": "21O6771",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": ["RealityDevice14,1"]
+      },
+      {
+        "ProductVersion": "8.8.1",
+        "Build": "19U6512",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch3,1",
+          "Watch3,2",
+          "Watch3,3",
+          "Watch3,4",
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9"
+        ]
+      },
+      {
+        "ProductVersion": "17.6.1",
+        "Build": "21G93",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "17.5",
+        "Build": "21F79",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-08-18",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "9.6.3",
+        "Build": "20U502",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9"
+        ]
+      },
+      {
+        "ProductVersion": "17.5.1",
+        "Build": "21F90",
+        "PostingDate": "2024-05-20",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "17.6",
+        "Build": "21M6071",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "AppleTV11,1",
+          "AppleTV14,1",
+          "AppleTV5,3",
+          "AppleTV6,2",
+          "AudioAccessory1,1",
+          "AudioAccessory5,1",
+          "AudioAccessory6,1"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.8",
+        "Build": "20H343",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad6,11",
+          "iPad6,12",
+          "iPad6,3",
+          "iPad6,4",
+          "iPad6,7",
+          "iPad6,8",
+          "iPhone10,1",
+          "iPhone10,2",
+          "iPhone10,3",
+          "iPhone10,4",
+          "iPhone10,5",
+          "iPhone10,6"
+        ]
+      },
+      {
+        "ProductVersion": "17.5",
+        "Build": "21L6569",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": [
+          "AudioAccessory1,1",
+          "AudioAccessory5,1",
+          "AudioAccessory6,1"
+        ]
+      },
+      {
+        "ProductVersion": "17.5",
+        "Build": "21L6569",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-08-19",
+        "SupportedDevices": [
+          "AppleTV11,1",
+          "AppleTV14,1",
+          "AppleTV5,3",
+          "AppleTV6,2"
+        ]
+      },
+      {
+        "ProductVersion": "17.5",
+        "Build": "21F84",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-08-18",
+        "SupportedDevices": [
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.9",
+        "Build": "20H348",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-05",
+        "SupportedDevices": [
+          "iPad6,11",
+          "iPad6,12",
+          "iPad6,3",
+          "iPad6,4",
+          "iPad6,7",
+          "iPad6,8",
+          "iPhone10,1",
+          "iPhone10,2",
+          "iPhone10,3",
+          "iPhone10,4",
+          "iPhone10,5",
+          "iPhone10,6"
+        ]
+      },
+      {
+        "ProductVersion": "1.2",
+        "Build": "21O6589",
+        "PostingDate": "2024-06-10",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": ["RealityDevice14,1"]
+      },
+      {
+        "ProductVersion": "15.8.2",
+        "Build": "19H6384",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad5,1",
+          "iPad5,2",
+          "iPad5,3",
+          "iPad5,4",
+          "iPhone8,1",
+          "iPhone8,2",
+          "iPhone8,4",
+          "iPhone9,1",
+          "iPhone9,2",
+          "iPhone9,3",
+          "iPhone9,4",
+          "iPod9,1"
+        ]
+      },
+      {
+        "ProductVersion": "15.8.3",
+        "Build": "19H6386",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad5,1",
+          "iPad5,2",
+          "iPad5,3",
+          "iPad5,4",
+          "iPhone8,1",
+          "iPhone8,2",
+          "iPhone8,4",
+          "iPhone9,1",
+          "iPhone9,2",
+          "iPhone9,3",
+          "iPhone9,4",
+          "iPod9,1"
+        ]
+      },
+      {
+        "ProductVersion": "9.6.3",
+        "Build": "20U6502",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9"
+        ]
+      }
+    ],
+    "visionOS": [
+      {
+        "ProductVersion": "1.1.2",
+        "Build": "21O231",
+        "PostingDate": "2024-04-12",
+        "ExpirationDate": "2024-09-08",
+        "SupportedDevices": ["RealityDevice14,1"]
+      },
+      {
+        "ProductVersion": "1.1.2",
+        "Build": "21O6231",
+        "PostingDate": "2024-04-12",
+        "ExpirationDate": "2024-09-08",
+        "SupportedDevices": ["RealityDevice14,1"]
+      }
+    ],
+    "xrOS": [
+      {
+        "ProductVersion": "1.0.3",
+        "Build": "21N333",
+        "PostingDate": "2024-02-12",
+        "ExpirationDate": "2024-06-05",
+        "SupportedDevices": ["RealityDevice14,1"]
+      }
+    ],
+    "macOS": [
+      {
+        "ProductVersion": "14.6.1",
+        "Build": "23G93",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J180dAP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J414cAP",
+          "J414sAP",
+          "J415AP",
+          "J416cAP",
+          "J416sAP",
+          "J433AP",
+          "J434AP",
+          "J456AP",
+          "J457AP",
+          "J473AP",
+          "J474sAP",
+          "J475cAP",
+          "J475dAP",
+          "J493AP",
+          "J504AP",
+          "J514cAP",
+          "J514mAP",
+          "J514sAP",
+          "J516cAP",
+          "J516mAP",
+          "J516sAP",
+          "J613AP",
+          "J615AP",
+          "J680AP",
+          "J780AP",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-63001698E7A34814",
+          "Mac-937A206F2EE63C01",
+          "Mac-AA95B1DDAB278B95",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "13.6.9",
+        "Build": "22G830",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J180dAP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J414cAP",
+          "J414sAP",
+          "J415AP",
+          "J416cAP",
+          "J416sAP",
+          "J433AP",
+          "J434AP",
+          "J456AP",
+          "J457AP",
+          "J473AP",
+          "J474sAP",
+          "J475cAP",
+          "J475dAP",
+          "J493AP",
+          "J504AP",
+          "J680AP",
+          "J780AP",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-4B682C642B45593E",
+          "Mac-551B86E5744E2388",
+          "Mac-63001698E7A34814",
+          "Mac-77F17D7DA9285301",
+          "Mac-937A206F2EE63C01",
+          "Mac-AA95B1DDAB278B95",
+          "Mac-B4831CEBD52A0C4C",
+          "Mac-BE088AF8C5EB4FA2",
+          "Mac-CAD6701F7CEA0921",
+          "Mac-EE2EBD4B90B839A8",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "14.5",
+        "Build": "23F79",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J180dAP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J414cAP",
+          "J414sAP",
+          "J415AP",
+          "J416cAP",
+          "J416sAP",
+          "J433AP",
+          "J434AP",
+          "J456AP",
+          "J457AP",
+          "J473AP",
+          "J474sAP",
+          "J475cAP",
+          "J475dAP",
+          "J493AP",
+          "J504AP",
+          "J514cAP",
+          "J514mAP",
+          "J514sAP",
+          "J516cAP",
+          "J516mAP",
+          "J516sAP",
+          "J613AP",
+          "J615AP",
+          "J680AP",
+          "J780AP",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-63001698E7A34814",
+          "Mac-937A206F2EE63C01",
+          "Mac-AA95B1DDAB278B95",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "12.7.5",
+        "Build": "21H1222",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J456AP",
+          "J457AP",
+          "J493AP",
+          "J680AP",
+          "J780AP",
+          "Mac-06F11F11946D27C5",
+          "Mac-06F11FD93F0323C5",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-35C5E08120C7EEAF",
+          "Mac-473D31EABEB93F9B",
+          "Mac-4B682C642B45593E",
+          "Mac-551B86E5744E2388",
+          "Mac-63001698E7A34814",
+          "Mac-65CE76090165799A",
+          "Mac-66E35819EE2D0D05",
+          "Mac-77F17D7DA9285301",
+          "Mac-937A206F2EE63C01",
+          "Mac-937CB26E2E02BB01",
+          "Mac-9AE82516C7C6B903",
+          "Mac-9F18E312C5C2BF0B",
+          "Mac-A369DDC4E67F1C45",
+          "Mac-A5C67F76ED83108C",
+          "Mac-AA95B1DDAB278B95",
+          "Mac-B4831CEBD52A0C4C",
+          "Mac-B809C3757DA9BB8D",
+          "Mac-BE088AF8C5EB4FA2",
+          "Mac-CAD6701F7CEA0921",
+          "Mac-DB15BD556843C820",
+          "Mac-E43C1C25D4880AD6",
+          "Mac-EE2EBD4B90B839A8",
+          "Mac-F60DEB81FF30ACF6",
+          "Mac-FFE5EF870D7BA81A",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "11.7.10",
+        "Build": "20G1427",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J456AP",
+          "J457AP",
+          "J680AP",
+          "J780AP",
+          "Mac-06F11F11946D27C5",
+          "Mac-06F11FD93F0323C5",
+          "Mac-0CFF9C7C2B63DF8D",
+          "Mac-112818653D3AABFC",
+          "Mac-112B0A653D3AAB9C",
+          "Mac-189A3D4F975D5FFC",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-226CB3C6A851A671",
+          "Mac-27AD2F918AE68F61",
+          "Mac-2BD1B31983FE1663",
+          "Mac-35C1E88140C3E6CF",
+          "Mac-35C5E08120C7EEAF",
+          "Mac-36B6B6DA9CFCD881",
+          "Mac-3CBD00234E554E41",
+          "Mac-42FD25EABCABB274",
+          "Mac-473D31EABEB93F9B",
+          "Mac-4B682C642B45593E",
+          "Mac-50619A408DB004DA",
+          "Mac-53FDB3D8DB8CA971",
+          "Mac-551B86E5744E2388",
+          "Mac-5A49A77366F81C72",
+          "Mac-5F9802EFE386AA28",
+          "Mac-63001698E7A34814",
+          "Mac-65CE76090165799A",
+          "Mac-66E35819EE2D0D05",
+          "Mac-747B1AEFF11738BE",
+          "Mac-77F17D7DA9285301",
+          "Mac-7BA5B2D9E42DDD94",
+          "Mac-7BA5B2DFE22DDD8C",
+          "Mac-7DF21CB3ED6977E5",
+          "Mac-81E3E92DD6088272",
+          "Mac-827FAC58A8FDFA22",
+          "Mac-827FB448E656EC26",
+          "Mac-90BE64C3CB5A9AEB",
+          "Mac-937A206F2EE63C01",
+          "Mac-937CB26E2E02BB01",
+          "Mac-9394BDF4BF862EE7",
+          "Mac-9AE82516C7C6B903",
+          "Mac-9F18E312C5C2BF0B",
+          "Mac-A369DDC4E67F1C45",
+          "Mac-A5C67F76ED83108C",
+          "Mac-A61BADE1FDAD7B05",
+          "Mac-AA95B1DDAB278B95",
+          "Mac-AF89B6D9451A490B",
+          "Mac-B4831CEBD52A0C4C",
+          "Mac-B809C3757DA9BB8D",
+          "Mac-BE088AF8C5EB4FA2",
+          "Mac-BE0E8AC46FE800CC",
+          "Mac-C6F71043CEAA02A6",
+          "Mac-CAD6701F7CEA0921",
+          "Mac-CF21D135A7D34AA6",
+          "Mac-CFF7D910A743CAAF",
+          "Mac-DB15BD556843C820",
+          "Mac-E1008331FDC96864",
+          "Mac-E43C1C25D4880AD6",
+          "Mac-E7203C0F68AA0004",
+          "Mac-EE2EBD4B90B839A8",
+          "Mac-F305150B0C7DEEEF",
+          "Mac-F60DEB81FF30ACF6",
+          "Mac-FA842E06C61E91C5",
+          "Mac-FFE5EF870D7BA81A",
+          "VMM-x86_64",
+          "X589AMLUAP",
+          "X589ICLYAP",
+          "X86LEGACYAP"
+        ]
+      },
+      {
+        "ProductVersion": "13.6.8",
+        "Build": "22G820",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-05",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J180dAP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J414cAP",
+          "J414sAP",
+          "J415AP",
+          "J416cAP",
+          "J416sAP",
+          "J433AP",
+          "J434AP",
+          "J456AP",
+          "J457AP",
+          "J473AP",
+          "J474sAP",
+          "J475cAP",
+          "J475dAP",
+          "J493AP",
+          "J504AP",
+          "J680AP",
+          "J780AP",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-4B682C642B45593E",
+          "Mac-551B86E5744E2388",
+          "Mac-63001698E7A34814",
+          "Mac-77F17D7DA9285301",
+          "Mac-937A206F2EE63C01",
+          "Mac-AA95B1DDAB278B95",
+          "Mac-B4831CEBD52A0C4C",
+          "Mac-BE088AF8C5EB4FA2",
+          "Mac-CAD6701F7CEA0921",
+          "Mac-EE2EBD4B90B839A8",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "14.6",
+        "Build": "23G80",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-05",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J180dAP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J414cAP",
+          "J414sAP",
+          "J415AP",
+          "J416cAP",
+          "J416sAP",
+          "J433AP",
+          "J434AP",
+          "J456AP",
+          "J457AP",
+          "J473AP",
+          "J474sAP",
+          "J475cAP",
+          "J475dAP",
+          "J493AP",
+          "J504AP",
+          "J514cAP",
+          "J514mAP",
+          "J514sAP",
+          "J516cAP",
+          "J516mAP",
+          "J516sAP",
+          "J613AP",
+          "J615AP",
+          "J680AP",
+          "J780AP",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-63001698E7A34814",
+          "Mac-937A206F2EE63C01",
+          "Mac-AA95B1DDAB278B95",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "12.7.6",
+        "Build": "21H1320",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J456AP",
+          "J457AP",
+          "J493AP",
+          "J680AP",
+          "J780AP",
+          "Mac-06F11F11946D27C5",
+          "Mac-06F11FD93F0323C5",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-35C5E08120C7EEAF",
+          "Mac-473D31EABEB93F9B",
+          "Mac-4B682C642B45593E",
+          "Mac-551B86E5744E2388",
+          "Mac-63001698E7A34814",
+          "Mac-65CE76090165799A",
+          "Mac-66E35819EE2D0D05",
+          "Mac-77F17D7DA9285301",
+          "Mac-937A206F2EE63C01",
+          "Mac-937CB26E2E02BB01",
+          "Mac-9AE82516C7C6B903",
+          "Mac-9F18E312C5C2BF0B",
+          "Mac-A369DDC4E67F1C45",
+          "Mac-A5C67F76ED83108C",
+          "Mac-AA95B1DDAB278B95",
+          "Mac-B4831CEBD52A0C4C",
+          "Mac-B809C3757DA9BB8D",
+          "Mac-BE088AF8C5EB4FA2",
+          "Mac-CAD6701F7CEA0921",
+          "Mac-DB15BD556843C820",
+          "Mac-E43C1C25D4880AD6",
+          "Mac-EE2EBD4B90B839A8",
+          "Mac-F60DEB81FF30ACF6",
+          "Mac-FFE5EF870D7BA81A",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "13.6.7",
+        "Build": "22G720",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J180dAP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J414cAP",
+          "J414sAP",
+          "J415AP",
+          "J416cAP",
+          "J416sAP",
+          "J433AP",
+          "J434AP",
+          "J456AP",
+          "J457AP",
+          "J473AP",
+          "J474sAP",
+          "J475cAP",
+          "J475dAP",
+          "J493AP",
+          "J504AP",
+          "J680AP",
+          "J780AP",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-4B682C642B45593E",
+          "Mac-551B86E5744E2388",
+          "Mac-63001698E7A34814",
+          "Mac-77F17D7DA9285301",
+          "Mac-937A206F2EE63C01",
+          "Mac-AA95B1DDAB278B95",
+          "Mac-B4831CEBD52A0C4C",
+          "Mac-BE088AF8C5EB4FA2",
+          "Mac-CAD6701F7CEA0921",
+          "Mac-EE2EBD4B90B839A8",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      }
+    ]
+  },
+  "PublicRapidSecurityResponses": {}
+}
diff --git a/server/mdm/apple/itunes/api.go b/server/mdm/apple/itunes/api.go
new file mode 100644
index 000000000000..a1db6ba0e7f8
--- /dev/null
+++ b/server/mdm/apple/itunes/api.go
@@ -0,0 +1,119 @@
+package itunes
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
+	"github.com/fleetdm/fleet/v4/pkg/retry"
+)
+
+type AssetMetadata struct {
+	BundleID         string   `json:"bundleId"`
+	ArtworkURL       string   `json:"artworkUrl512"`
+	Version          string   `json:"version"`
+	TrackName        string   `json:"trackName"`
+	TrackID          uint     `json:"trackId"`
+	SupportedDevices []string `json:"supportedDevices"`
+}
+
+type AssetMetadataFilter struct {
+	Entity string
+}
+
+// client is a package-level client (similar to http.DefaultClient) so it can
+// be reused instead of created as needed, as the internal Transport typically
+// has internal state (cached connections, etc) and it's safe for concurrent
+// use.
+var client = fleethttp.NewClient(fleethttp.WithTimeout(10 * time.Second))
+
+func GetAssetMetadata(adamIDs []string, filter *AssetMetadataFilter) (map[string]AssetMetadata, error) {
+	baseURL := getBaseURL()
+	reqURL, err := url.Parse(baseURL)
+	if err != nil {
+		return nil, fmt.Errorf("parsing base iTunes URL: %w", err)
+	}
+
+	adamIDsParam := strings.Join(adamIDs, ",")
+
+	if filter != nil {
+		query := url.Values{}
+		query.Add("id", adamIDsParam)
+		query.Add("entity", filter.Entity)
+		reqURL.RawQuery = query.Encode()
+	}
+
+	req, err := http.NewRequest(http.MethodGet, reqURL.String(), nil)
+	if err != nil {
+		return nil, fmt.Errorf("creating request to Apple iTunes endpoint: %w", err)
+	}
+
+	var bodyResp struct {
+		Results []AssetMetadata `json:"results"`
+	}
+
+	if err = do(req, &bodyResp); err != nil {
+		return nil, fmt.Errorf("retrieving asset metadata: %w", err)
+	}
+
+	metadata := make(map[string]AssetMetadata)
+	for _, a := range bodyResp.Results {
+		metadata[strconv.Itoa(int(a.TrackID))] = a
+	}
+
+	return metadata, nil
+}
+
+func do[T any](req *http.Request, dest *T) error {
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("making request to Apple iTunes endpoint: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return fmt.Errorf("reading response body from Apple iTunes endpoint: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		limitedBody := body
+		if len(limitedBody) > 1000 {
+			limitedBody = limitedBody[:1000]
+		}
+
+		if resp.StatusCode >= http.StatusInternalServerError {
+			return retry.Do(
+				func() error { return do(req, dest) },
+				retry.WithInterval(1*time.Second),
+				retry.WithMaxAttempts(4),
+			)
+
+		}
+
+		return fmt.Errorf("calling Apple iTunes endpoint failed with status %d: %s", resp.StatusCode, string(limitedBody))
+	}
+
+	if dest != nil {
+		if err := json.Unmarshal(body, dest); err != nil {
+			return fmt.Errorf("decoding response data from Apple iTunes endpoint: %w", err)
+		}
+	}
+
+	return nil
+}
+
+func getBaseURL() string {
+	devURL := os.Getenv("FLEET_DEV_ITUNES_URL")
+	if devURL != "" {
+		return devURL
+	}
+	return "https://itunes.apple.com/lookup"
+}
diff --git a/server/mdm/apple/itunes/api_test.go b/server/mdm/apple/itunes/api_test.go
new file mode 100644
index 000000000000..bec950ff6f94
--- /dev/null
+++ b/server/mdm/apple/itunes/api_test.go
@@ -0,0 +1,90 @@
+package itunes
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetBaseURL(t *testing.T) {
+	t.Run("Default URL", func(t *testing.T) {
+		os.Setenv("FLEET_DEV_ITUNES_URL", "")
+		require.Equal(t, "https://itunes.apple.com/lookup", getBaseURL())
+	})
+
+	t.Run("Custom URL", func(t *testing.T) {
+		customURL := "http://localhost:8000"
+		os.Setenv("FLEET_DEV_ITUNES_URL", customURL)
+		require.Equal(t, customURL, getBaseURL())
+	})
+}
+
+func setupFakeServer(t *testing.T, handler http.HandlerFunc) {
+	server := httptest.NewServer(handler)
+	os.Setenv("FLEET_DEV_ITUNES_URL", server.URL)
+	t.Cleanup(server.Close)
+}
+
+func TestDoRetries(t *testing.T) {
+	tests := []struct {
+		name      string
+		handler   http.HandlerFunc
+		wantCalls int
+		wantErr   bool
+	}{
+		{
+			name: "success status code",
+			handler: func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusOK)
+				_, err := w.Write([]byte("{}"))
+				require.NoError(t, err)
+			},
+			wantCalls: 1,
+			wantErr:   true,
+		},
+		{
+			name: "bad requests",
+			handler: func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusBadRequest)
+				_, err := w.Write([]byte("{}"))
+				require.NoError(t, err)
+			},
+			wantCalls: 1,
+			wantErr:   true,
+		},
+		{
+			name: "500 requests retries",
+			handler: func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusServiceUnavailable)
+				_, err := w.Write([]byte("{}"))
+				require.NoError(t, err)
+			},
+			wantCalls: 4,
+			wantErr:   false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var calls int
+			setupFakeServer(t, func(w http.ResponseWriter, r *http.Request) {
+				calls++
+				if calls < tt.wantCalls {
+					tt.handler(w, r)
+					return
+				}
+			})
+
+			start := time.Now()
+			req, err := http.NewRequest(http.MethodGet, os.Getenv("FLEET_DEV_ITUNES_URL"), nil)
+			require.NoError(t, err)
+			err = do[any](req, nil)
+			require.NoError(t, err)
+			require.Equal(t, tt.wantCalls, calls)
+			require.WithinRange(t, time.Now(), start, start.Add(time.Duration(tt.wantCalls)*time.Second))
+		})
+	}
+}
diff --git a/server/mdm/apple/mobileconfig/mobileconfig.go b/server/mdm/apple/mobileconfig/mobileconfig.go
index 31edd4439928..690b15c79690 100644
--- a/server/mdm/apple/mobileconfig/mobileconfig.go
+++ b/server/mdm/apple/mobileconfig/mobileconfig.go
@@ -2,6 +2,7 @@ package mobileconfig
 
 import (
 	"bytes"
+	"encoding/xml"
 	"errors"
 	"fmt"
 	"strings"
@@ -264,3 +265,17 @@ var (
 	ErrEmptyPayloadContent     = errors.New("empty PayloadContent")
 	ErrEncryptedPayloadContent = errors.New("encrypted PayloadContent")
 )
+
+// XMLEscapeString returns the escaped XML equivalent of the plain text data s.
+func XMLEscapeString(s string) (string, error) {
+	// avoid allocation if we can.
+	if !strings.ContainsAny(s, "'\"&<>\t\n\r") {
+		return s, nil
+	}
+	var b strings.Builder
+	if err := xml.EscapeText(&b, []byte(s)); err != nil {
+		return "", err
+	}
+
+	return b.String(), nil
+}
diff --git a/server/mdm/apple/mobileconfig/mobileconfig_test.go b/server/mdm/apple/mobileconfig/mobileconfig_test.go
new file mode 100644
index 000000000000..793503a4382a
--- /dev/null
+++ b/server/mdm/apple/mobileconfig/mobileconfig_test.go
@@ -0,0 +1,36 @@
+package mobileconfig
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestXMLEscapeString(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		// characters that should be escaped
+		{"hello & world", "hello &amp; world"},
+		{"this is a <test>", "this is a &lt;test&gt;"},
+		{"\"quotes\" and 'single quotes'", "&#34;quotes&#34; and &#39;single quotes&#39;"},
+		{"special chars: \t\n\r", "special chars: &#x9;&#xA;&#xD;"},
+		// no special characters
+		{"plain string", "plain string"},
+		// string that already contains escaped characters
+		{"already &lt;escaped&gt;", "already &amp;lt;escaped&amp;gt;"},
+		// empty string
+		{"", ""},
+		// multiple special characters
+		{"A&B<C>D\"'E\tF\nG\r", "A&amp;B&lt;C&gt;D&#34;&#39;E&#x9;F&#xA;G&#xD;"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.input, func(t *testing.T) {
+			out, err := XMLEscapeString(tt.input)
+			require.NoError(t, err)
+			require.Equal(t, tt.expected, out)
+		})
+	}
+}
diff --git a/server/mdm/apple/mobileconfig/profiles.go b/server/mdm/apple/mobileconfig/profiles.go
index 24bf6479bad6..b71d2db5ab98 100644
--- a/server/mdm/apple/mobileconfig/profiles.go
+++ b/server/mdm/apple/mobileconfig/profiles.go
@@ -1,6 +1,15 @@
 package mobileconfig
 
-import "text/template"
+import (
+	"encoding/xml"
+	"fmt"
+	"strings"
+	"text/template"
+)
+
+var funcMap = map[string]any{
+	"xml": XMLEscapeString,
+}
 
 // FleetdProfileOptions are the keys required to execute a
 // FleetdProfileTemplate.
@@ -20,7 +29,7 @@ type FleetdProfileOptions struct {
 //
 // Internally, this is used by Fleet MDM to configure the installer delivered
 // to hosts during DEP enrollment.
-var FleetdProfileTemplate = template.Must(template.New("").Option("missingkey=error").Parse(`<?xml version="1.0" encoding="UTF-8"?>
+var FleetdProfileTemplate = template.Must(template.New("").Funcs(funcMap).Option("missingkey=error").Parse(`<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
   <dict>
@@ -28,7 +37,7 @@ var FleetdProfileTemplate = template.Must(template.New("").Option("missingkey=er
     <array>
       <dict>
         <key>EnrollSecret</key>
-        <string>{{ .EnrollSecret }}</string>
+        <string>{{ .EnrollSecret | xml }}</string>
         <key>FleetURL</key>
         <string>{{ .ServerURL }}</string>
         <key>EnableScripts</key>
@@ -109,3 +118,40 @@ var FleetCARootTemplate = template.Must(template.New("").Option("missingkey=erro
   </dict>
 </plist>
 `))
+
+var OTAMobileConfigTemplate = template.Must(template.New("").Funcs(template.FuncMap{"xml": func(v string) (string, error) {
+	var escaped strings.Builder
+	if err := xml.EscapeText(&escaped, []byte(v)); err != nil {
+		return "", fmt.Errorf("XML escaping in OTA profile: %w", err)
+	}
+	return escaped.String(), nil
+}}).Option("missingkey=error").Parse(`<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Inc//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>PayloadContent</key>
+    <dict>
+      <key>URL</key>
+      <string>{{ .URL }}</string>
+      <key>DeviceAttributes</key>
+      <array>
+        <string>UDID</string>
+        <string>VERSION</string>
+        <string>PRODUCT</string>
+	    <string>SERIAL</string>
+      </array>
+    </dict>
+    <key>PayloadOrganization</key>
+    <string>{{ xml .Organization }}</string>
+    <key>PayloadDisplayName</key>
+    <string>{{ xml .Organization }} enrollment</string>
+    <key>PayloadVersion</key>
+    <integer>1</integer>
+    <key>PayloadUUID</key>
+    <string>fdb376e5-b5bb-4d8c-829e-e90865f990c9</string>
+    <key>PayloadIdentifier</key>
+    <string>com.fleetdm.fleet.mdm.apple.ota</string>
+    <key>PayloadType</key>
+    <string>Profile Service</string>
+  </dict>
+</plist>`))
diff --git a/server/mdm/apple/util.go b/server/mdm/apple/util.go
index 40b669da9334..c98dcc48d841 100644
--- a/server/mdm/apple/util.go
+++ b/server/mdm/apple/util.go
@@ -14,6 +14,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/Masterminds/semver"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/mdm/nanomdm/mdm"
 )
@@ -108,3 +109,37 @@ func EnrollURL(token string, appConfig *fleet.AppConfig) (string, error) {
 	enrollURL.RawQuery = q.Encode()
 	return enrollURL.String(), nil
 }
+
+// IsLessThanVersion returns true if the current version is less than the target version.
+// If either version is invalid, an error is returned.
+func IsLessThanVersion(current string, target string) (bool, error) {
+	cv, err := semver.NewVersion(current)
+	if err != nil {
+		return false, fmt.Errorf("invalid current version: %w", err)
+	}
+	tv, err := semver.NewVersion(target)
+	if err != nil {
+		return false, fmt.Errorf("invalid target version: %w", err)
+	}
+
+	return cv.LessThan(tv), nil
+}
+
+// CompareVersions returns an integer comparing two versions according to semantic version
+// precedence. The result will be 0 if a == b, -1 if a < b, or +1 if a > b.
+// An invalid semantic version string is considered less than a valid one. All invalid semantic
+// version strings compare equal to each other.
+func CompareVersions(a string, b string) int {
+	verA, errA := semver.NewVersion(a)
+	verB, errB := semver.NewVersion(b)
+	switch {
+	case errA != nil && errB != nil:
+		return 0
+	case errA != nil:
+		return -1
+	case errB != nil:
+		return 1
+	default:
+		return verA.Compare(verB)
+	}
+}
diff --git a/server/mdm/apple/vpp/api.go b/server/mdm/apple/vpp/api.go
new file mode 100644
index 000000000000..86a91b505401
--- /dev/null
+++ b/server/mdm/apple/vpp/api.go
@@ -0,0 +1,359 @@
+package vpp
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"strconv"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
+	"github.com/fleetdm/fleet/v4/pkg/retry"
+)
+
+// Asset is a product in the store.
+//
+// https://developer.apple.com/documentation/devicemanagement/asset
+type Asset struct {
+	// AdamID is the unique identifier for a product in the store.
+	AdamID string `json:"adamId"`
+	// PricingParam is the quality of a product in the store.
+	// Possible Values are `STDQ` and `PLUS`
+	PricingParam string `json:"pricingParam"`
+	// AvailableCount is the number of available licenses for this app in the location specified by
+	// the VPP token.
+	AvailableCount uint `json:"availableCount"`
+}
+
+// ErrorResponse represents the response that contains the error that occurs.
+//
+// https://developer.apple.com/documentation/devicemanagement/errorresponse
+type ErrorResponse struct {
+	ErrorInfo    ResponseErrorInfo `json:"errorInfo,omitempty"`
+	ErrorMessage string            `json:"errorMessage"`
+	ErrorNumber  int32             `json:"errorNumber"`
+}
+
+// Error implements the Erorrer interface
+func (e *ErrorResponse) Error() string {
+	return fmt.Sprintf("Apple VPP endpoint returned error: %s (error number: %d)", e.ErrorMessage, e.ErrorNumber)
+}
+
+// ResponseErrorInfo represents the request-specific information regarding the
+// failure.
+//
+// https://developer.apple.com/documentation/devicemanagement/responseerrorinfo
+type ResponseErrorInfo struct {
+	Assets        []Asset  `json:"assets"`
+	ClientUserIds []string `json:"clientUserIds"`
+	SerialNumbers []string `json:"serialNumbers"`
+}
+
+// client is a package-level client (similar to http.DefaultClient) so it can
+// be reused instead of created as needed, as the internal Transport typically
+// has internal state (cached connections, etc) and it's safe for concurrent
+// use.
+var client = fleethttp.NewClient(fleethttp.WithTimeout(10 * time.Second))
+
+// GetConfig fetches the VPP config from Apple's VPP API. This doubles as a
+// verification that the user-provided VPP token is valid.
+//
+// https://developer.apple.com/documentation/devicemanagement/client_config-a40
+func GetConfig(token string) (string, error) {
+	req, err := http.NewRequest(http.MethodGet, getBaseURL()+"/client/config", nil)
+	if err != nil {
+		return "", fmt.Errorf("creating request to Apple VPP endpoint: %w", err)
+	}
+
+	var respJSON struct {
+		LocationName string `json:"locationName"`
+	}
+
+	if err := do(req, token, &respJSON); err != nil {
+		return "", fmt.Errorf("making request to Apple VPP endpoint: %w", err)
+	}
+
+	return respJSON.LocationName, nil
+}
+
+// AssociateAssetsRequest is the request for asset management.
+type AssociateAssetsRequest struct {
+	// Assets are the assets to assign.
+	Assets []Asset `json:"assets"`
+	// SerialNumbers is the set of identifiers for devices to assign the
+	// assets to.
+	SerialNumbers []string `json:"serialNumbers"`
+}
+
+// AssociateAssets associates assets to serial numbers according the the
+// request parameters provided.
+//
+// https://developer.apple.com/documentation/devicemanagement/associate_assets
+func AssociateAssets(token string, params *AssociateAssetsRequest) (string, error) {
+	var reqBody bytes.Buffer
+	if err := json.NewEncoder(&reqBody).Encode(params); err != nil {
+		return "", fmt.Errorf("encoding params as JSON: %w", err)
+	}
+
+	req, err := http.NewRequest(http.MethodPost, getBaseURL()+"/assets/associate", &reqBody)
+	if err != nil {
+		return "", fmt.Errorf("creating request to Apple VPP endpoint: %w", err)
+	}
+
+	req.Header.Add("Content-Type", "application/json")
+
+	var respBody struct {
+		EventID string `json:"eventId"`
+	}
+
+	if err := do(req, token, &respBody); err != nil {
+		return "", fmt.Errorf("making request to Apple VPP endpoint: %w", err)
+	}
+
+	return respBody.EventID, nil
+}
+
+// AssetFilter represents the filters for querying assets.
+type AssetFilter struct {
+	// PageIndex is the requested page index.
+	PageIndex int32 `json:"pageIndex"`
+
+	// ProductType is the filter for the asset product type.
+	// Possible Values: App, Book
+	ProductType string `json:"productType"`
+
+	// PricingParam is the filter for the asset product quality.
+	// Possible Values: STDQ, PLUS
+	PricingParam string `json:"pricingParam"`
+
+	// Revocable is the filter for asset revocability.
+	Revocable *bool `json:"revocable"`
+
+	// DeviceAssignable is the filter for asset device assignability.
+	DeviceAssignable *bool `json:"deviceAssignable"`
+
+	// MaxAvailableCount is the filter for the maximum inclusive assets available count.
+	MaxAvailableCount int32 `json:"maxAvailableCount"`
+
+	// MinAvailableCount is the filter for the minimum inclusive assets available count.
+	MinAvailableCount int32 `json:"minAvailableCount"`
+
+	// MaxAssignedCount is the filter for the maximum inclusive assets assigned count.
+	MaxAssignedCount int32 `json:"maxAssignedCount"`
+
+	// MinAssignedCount is the filter for the minimum inclusive assets assigned count.
+	MinAssignedCount int32 `json:"minAssignedCount"`
+
+	// AdamID is the filter for the asset product unique identifier.
+	AdamID string `json:"adamId"`
+}
+
+// GetAssets fetches the assets from Apple's VPP API with optional filters.
+func GetAssets(token string, filter *AssetFilter) ([]Asset, error) {
+	baseURL := getBaseURL() + "/assets"
+	reqURL, err := url.Parse(baseURL)
+	if err != nil {
+		return nil, fmt.Errorf("parsing base URL: %w", err)
+	}
+
+	if filter != nil {
+		query := url.Values{}
+		addFilter(query, "adamId", filter.AdamID)
+		addFilter(query, "pricingParam", filter.PricingParam)
+		addFilter(query, "productType", filter.ProductType)
+		addFilter(query, "revocable", filter.Revocable)
+		addFilter(query, "deviceAssignable", filter.DeviceAssignable)
+		addFilter(query, "maxAvailableCount", filter.MaxAvailableCount)
+		addFilter(query, "minAvailableCount", filter.MinAvailableCount)
+		addFilter(query, "maxAssignedCount", filter.MaxAssignedCount)
+		addFilter(query, "minAssignedCount", filter.MinAssignedCount)
+		addFilter(query, "pageIndex", filter.PageIndex)
+		reqURL.RawQuery = query.Encode()
+	}
+
+	req, err := http.NewRequest(http.MethodGet, reqURL.String(), nil)
+	if err != nil {
+		return nil, fmt.Errorf("creating request to Apple VPP endpoint: %w", err)
+	}
+
+	var bodyResp struct {
+		Assets []Asset `json:"assets"`
+	}
+
+	if err = do(req, token, &bodyResp); err != nil {
+		return nil, fmt.Errorf("retrieving assets: %w", err)
+	}
+
+	return bodyResp.Assets, nil
+}
+
+// AssignmentFilter is a representation of the query params for the Apple "Get Assignments"
+// endpoint.
+// https://developer.apple.com/documentation/devicemanagement/get_assignments-o3j#query-parameters
+type AssignmentFilter struct {
+	// The filter for the assignment product's unique identifier.
+	AdamID string `json:"adamId"`
+	// The filter for the unique identifier of assigned users in your organization.
+	ClientUserID string `json:"clientUserId"`
+	// The requested page index.
+	PageIndex int `json:"pageIndex"`
+	// The filter for the unique identifier of assigned devices in your organization.
+	SerialNumber string `json:"serialNumber"`
+	// The filter for modified assignments since the specified version identifier.
+	SinceVersionID string `json:"sinceVersionId"`
+}
+
+// Assignment represents an asset assignment for a device.
+//
+// https://developer.apple.com/documentation/devicemanagement/assignment
+type Assignment struct {
+	// The unique identifier for a product in the store.
+	AdamID string `json:"adamId"`
+	// PricingParam is the quality of a product in the store.
+	// Possible Values are `STDQ` and `PLUS`
+	PricingParam string `json:"pricingParam"`
+	// The unique identifier for a device.
+	SerialNumber string `json:"serialNumber"`
+}
+
+// GetAssignments fetches the assets from Apple's VPP API with optional filters.
+//
+// https://developer.apple.com/documentation/devicemanagement/get_assignments-o3j
+func GetAssignments(token string, filter *AssignmentFilter) ([]Assignment, error) {
+	baseURL := getBaseURL() + "/assignments"
+	reqURL, err := url.Parse(baseURL)
+	if err != nil {
+		return nil, fmt.Errorf("parsing base URL: %w", err)
+	}
+
+	if filter != nil {
+		query := url.Values{}
+		addFilter(query, "adamId", filter.AdamID)
+		addFilter(query, "clientUserId", filter.ClientUserID)
+		addFilter(query, "serialNumber", filter.SerialNumber)
+		addFilter(query, "sinceVersionId", filter.SinceVersionID)
+		addFilter(query, "pageIndex", filter.PageIndex)
+		reqURL.RawQuery = query.Encode()
+	}
+
+	req, err := http.NewRequest(http.MethodGet, reqURL.String(), nil)
+	if err != nil {
+		return nil, fmt.Errorf("creating request to Apple VPP endpoint: %w", err)
+	}
+
+	// TODO(roberto): when we get to importing assets assigned by other
+	// MDMs we'll need other top-level keys in this struct, and to modify
+	// the return value of this function.
+	//
+	// https://developer.apple.com/documentation/devicemanagement/getassignmentsresponse
+	var bodyResp struct {
+		Assignments []Assignment `json:"assignments"`
+	}
+
+	if err = do(req, token, &bodyResp); err != nil {
+		return nil, fmt.Errorf("retrieving assignments: %w", err)
+	}
+
+	return bodyResp.Assignments, nil
+}
+
+func do[T any](req *http.Request, token string, dest *T) error {
+	req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token))
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("making request to Apple VPP endpoint: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return fmt.Errorf("reading response body from Apple VPP endpoint: %w", err)
+	}
+
+	// For HTTP 5xx server error responses, a Retry-After header indicates
+	// how long the client must wait before making additional requests.
+	//
+	// https://developer.apple.com/documentation/devicemanagement/app_and_book_management/handling_error_responses#3742679
+	retryAfter := resp.Header.Get("Retry-After")
+	if resp.StatusCode == http.StatusInternalServerError && retryAfter != "" {
+		seconds, err := strconv.ParseInt(retryAfter, 10, 0)
+		if err != nil {
+			return fmt.Errorf("parsing retry-after header: %w", err)
+		}
+
+		ticker := time.NewTicker(time.Duration(seconds) * time.Second)
+		defer ticker.Stop()
+		<-ticker.C
+		return do(req, token, dest)
+	}
+
+	// For some reason, Apple returns 200 OK even if you pass an invalid token in the Auth header.
+	// We will need to parse the response and check to see if it contains an error.
+	var errResp ErrorResponse
+	if err := json.Unmarshal(body, &errResp); err == nil && (errResp.ErrorMessage != "" || errResp.ErrorNumber != 0) {
+		switch errResp.ErrorNumber {
+		// 9646: There are too many requests for the current
+		// Organization and the request has been rejected, either due
+		// to high server volume or an MDM issue. Use an
+		// incremental/exponential backoff strategy to retry the
+		// request until successful.
+		//
+		// https://developer.apple.com/documentation/devicemanagement/app_and_book_management/handling_error_responses#3783126
+		case 9646:
+			return retry.Do(
+				func() error { return do(req, token, dest) },
+				retry.WithBackoffMultiplier(3),
+				retry.WithInterval(5*time.Second),
+				retry.WithMaxAttempts(3),
+			)
+		default:
+			return &errResp
+		}
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		limitedBody := body
+		if len(limitedBody) > 1000 {
+			limitedBody = limitedBody[:1000]
+		}
+		return fmt.Errorf("calling Apple VPP endpoint failed with status %d: %s", resp.StatusCode, string(limitedBody))
+	}
+
+	if dest != nil {
+		if err := json.Unmarshal(body, dest); err != nil {
+			return fmt.Errorf("decoding response data from Apple VPP endpoint: %w", err)
+		}
+	}
+
+	return nil
+}
+
+func getBaseURL() string {
+	devURL := os.Getenv("FLEET_DEV_VPP_URL")
+	if devURL != "" {
+		return devURL
+	}
+	return "https://vpp.itunes.apple.com/mdm/v2"
+}
+
+// addFilter adds a filter to the query values if it is not the zero value.
+func addFilter(query url.Values, key string, value any) {
+	switch v := value.(type) {
+	case string:
+		if v != "" {
+			query.Add(key, v)
+		}
+	case *bool:
+		if v != nil {
+			query.Add(key, strconv.FormatBool(*v))
+		}
+	case int32:
+		if v != 0 {
+			query.Add(key, fmt.Sprintf("%d", v))
+		}
+	}
+}
diff --git a/server/mdm/apple/vpp/api_test.go b/server/mdm/apple/vpp/api_test.go
new file mode 100644
index 000000000000..5d265b9b191a
--- /dev/null
+++ b/server/mdm/apple/vpp/api_test.go
@@ -0,0 +1,309 @@
+package vpp
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func setupFakeServer(t *testing.T, handler http.HandlerFunc) {
+	server := httptest.NewServer(handler)
+	os.Setenv("FLEET_DEV_VPP_URL", server.URL)
+	t.Cleanup(server.Close)
+}
+
+func TestGetConfig(t *testing.T) {
+	tests := []struct {
+		name           string
+		token          string
+		handler        http.HandlerFunc
+		wantName       string
+		expectedErrMsg string
+	}{
+		{
+			name:  "valid token",
+			token: "valid_token",
+			handler: func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusOK)
+				fmt.Fprintln(w, `{"locationName": "Test Location"}`)
+			},
+			wantName:       "Test Location",
+			expectedErrMsg: "",
+		},
+		{
+			name:  "invalid token",
+			token: "invalid_token",
+			handler: func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusUnauthorized)
+				fmt.Fprintln(w, `{"errorNumber": 9622}`)
+			},
+			wantName:       "",
+			expectedErrMsg: "making request to Apple VPP endpoint: Apple VPP endpoint returned error:  (error number: 9622)",
+		},
+		{
+			name:  "server error",
+			token: "valid_token",
+			handler: func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusInternalServerError)
+				fmt.Fprintln(w, `Internal Server Error`)
+			},
+			wantName:       "",
+			expectedErrMsg: "calling Apple VPP endpoint failed with status 500: Internal Server Error\n",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			setupFakeServer(t, tt.handler)
+
+			name, err := GetConfig(tt.token)
+			if tt.expectedErrMsg != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tt.expectedErrMsg)
+			} else {
+				require.NoError(t, err)
+			}
+			require.Equal(t, tt.wantName, name)
+		})
+	}
+}
+
+func TestAssociateAssets(t *testing.T) {
+	tests := []struct {
+		name           string
+		token          string
+		params         *AssociateAssetsRequest
+		handler        http.HandlerFunc
+		expectedErrMsg string
+	}{
+		{
+			name:  "valid request",
+			token: "valid_token",
+			params: &AssociateAssetsRequest{
+				Assets:        []Asset{{AdamID: "12345", PricingParam: "STDQ"}},
+				SerialNumbers: []string{"SN12345"},
+			},
+			handler: func(w http.ResponseWriter, r *http.Request) {
+				require.Equal(t, http.MethodPost, r.Method)
+				require.Equal(t, "/assets/associate", r.URL.Path)
+				require.Equal(t, "Bearer valid_token", r.Header.Get("Authorization"))
+
+				body, err := io.ReadAll(r.Body)
+				require.NoError(t, err)
+
+				var reqParams AssociateAssetsRequest
+				err = json.Unmarshal(body, &reqParams)
+				require.NoError(t, err)
+
+				require.Equal(t, []Asset{{AdamID: "12345", PricingParam: "STDQ"}}, reqParams.Assets)
+				require.Equal(t, []string{"SN12345"}, reqParams.SerialNumbers)
+
+				_, _ = w.Write([]byte(`{"eventId": "123"}`))
+			},
+			expectedErrMsg: "",
+		},
+		{
+			name:  "server error",
+			token: "valid_token",
+			params: &AssociateAssetsRequest{
+				Assets:        []Asset{{AdamID: "12345", PricingParam: "STDQ"}},
+				SerialNumbers: []string{"SN12345"},
+			},
+			handler: func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusInternalServerError)
+				fmt.Fprintln(w, `Internal Server Error`)
+			},
+			expectedErrMsg: "calling Apple VPP endpoint failed with status 500: Internal Server Error\n",
+		},
+		{
+			name:  "client error",
+			token: "valid_token",
+			params: &AssociateAssetsRequest{
+				Assets:        []Asset{{AdamID: "12345", PricingParam: "STDQ"}},
+				SerialNumbers: []string{"SN12345"},
+			},
+			handler: func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusBadRequest)
+				fmt.Fprintln(w, `{"errorInfo":{},"errorMessage":"Bad Request","errorNumber":400}`)
+			},
+			expectedErrMsg: "making request to Apple VPP endpoint: Apple VPP endpoint returned error: Bad Request (error number: 400)",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			setupFakeServer(t, tt.handler)
+
+			_, err := AssociateAssets(tt.token, tt.params)
+			if tt.expectedErrMsg != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tt.expectedErrMsg)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestGetAssets(t *testing.T) {
+	tests := []struct {
+		name           string
+		token          string
+		filter         *AssetFilter
+		handler        http.HandlerFunc
+		expectedAssets []Asset
+		expectedErrMsg string
+	}{
+		{
+			name:  "valid token and filters",
+			token: "valid_token",
+			filter: &AssetFilter{
+				AdamID: "12345",
+			},
+			handler: func(w http.ResponseWriter, r *http.Request) {
+				require.Equal(t, http.MethodGet, r.Method)
+				require.Equal(t, "/assets", r.URL.Path)
+				require.Equal(t, "Bearer valid_token", r.Header.Get("Authorization"))
+
+				query := r.URL.Query()
+				require.Equal(t, "12345", query.Get("adamId"))
+
+				type resp struct {
+					Assets []Asset `json:"assets"`
+				}
+				assets := resp{
+					Assets: []Asset{
+						{AdamID: "12345", PricingParam: "STDQ"},
+						{AdamID: "67890", PricingParam: "PLUS"},
+					},
+				}
+				w.WriteHeader(http.StatusOK)
+				require.NoError(t, json.NewEncoder(w).Encode(assets))
+			},
+			expectedAssets: []Asset{
+				{AdamID: "12345", PricingParam: "STDQ"},
+				{AdamID: "67890", PricingParam: "PLUS"},
+			},
+			expectedErrMsg: "",
+		},
+		{
+			name:   "server error",
+			token:  "valid_token",
+			filter: nil,
+			handler: func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusInternalServerError)
+				fmt.Fprintln(w, `Internal Server Error`)
+			},
+			expectedAssets: nil,
+			expectedErrMsg: "calling Apple VPP endpoint failed with status 500: Internal Server Error\n",
+		},
+		{
+			name:   "client error",
+			token:  "valid_token",
+			filter: nil,
+			handler: func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusBadRequest)
+				fmt.Fprintln(w, `{"errorInfo":{},"errorMessage":"Bad Request","errorNumber":400}`)
+			},
+			expectedAssets: nil,
+			expectedErrMsg: "retrieving assets: Apple VPP endpoint returned error: Bad Request (error number: 400)",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			setupFakeServer(t, tt.handler)
+
+			assets, err := GetAssets(tt.token, tt.filter)
+			if tt.expectedErrMsg != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tt.expectedErrMsg)
+			} else {
+				require.NoError(t, err)
+				require.Equal(t, tt.expectedAssets, assets)
+			}
+		})
+	}
+}
+
+func TestDoRetryAfter(t *testing.T) {
+	tests := []struct {
+		name      string
+		handler   http.HandlerFunc
+		wantCalls int
+		wantErr   bool
+	}{
+		{
+			name: "no retry-after header",
+			handler: func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusInternalServerError)
+				_, err := w.Write([]byte("{}"))
+				require.NoError(t, err)
+			},
+			wantCalls: 1,
+			wantErr:   true,
+		},
+		{
+			name: "invalid retry-after header",
+			handler: func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Add("Retry-After", "foo")
+				w.WriteHeader(http.StatusInternalServerError)
+				_, err := w.Write([]byte("{}"))
+				require.NoError(t, err)
+			},
+			wantCalls: 1,
+			wantErr:   true,
+		},
+		{
+			name: "three retries",
+			handler: func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Add("Retry-After", "1")
+				w.WriteHeader(http.StatusInternalServerError)
+				_, err := w.Write([]byte("{}"))
+				require.NoError(t, err)
+			},
+			wantCalls: 3,
+			wantErr:   false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var calls int
+			setupFakeServer(t, func(w http.ResponseWriter, r *http.Request) {
+				calls++
+				if calls < tt.wantCalls {
+					tt.handler(w, r)
+					return
+				}
+			})
+
+			start := time.Now()
+			req, err := http.NewRequest(http.MethodGet, os.Getenv("FLEET_DEV_VPP_URL"), nil)
+			require.NoError(t, err)
+			err = do[any](req, "test-token", nil)
+			require.NoError(t, err)
+			require.Equal(t, tt.wantCalls, calls)
+			require.WithinRange(t, time.Now(), start, start.Add(time.Duration(tt.wantCalls)*time.Second))
+		})
+	}
+}
+
+func TestGetBaseURL(t *testing.T) {
+	t.Run("Default URL", func(t *testing.T) {
+		os.Setenv("FLEET_DEV_VPP_URL", "")
+		require.Equal(t, "https://vpp.itunes.apple.com/mdm/v2", getBaseURL())
+	})
+
+	t.Run("Custom URL", func(t *testing.T) {
+		customURL := "http://localhost:8000"
+		os.Setenv("FLEET_DEV_VPP_URL", customURL)
+		require.Equal(t, customURL, getBaseURL())
+	})
+}
diff --git a/server/mdm/assets/assets.go b/server/mdm/assets/assets.go
index f1ca889ab8b2..af303b65ce47 100644
--- a/server/mdm/assets/assets.go
+++ b/server/mdm/assets/assets.go
@@ -72,16 +72,20 @@ func APNSTopic(ctx context.Context, ds fleet.MDMAssetRetriever) (string, error)
 	return mdmPushCertTopic, nil
 }
 
-func ABMToken(ctx context.Context, ds fleet.MDMAssetRetriever) (*nanodep_client.OAuth1Tokens, error) {
+func ABMToken(ctx context.Context, ds fleet.MDMAssetRetriever, abmOrgName string) (*nanodep_client.OAuth1Tokens, error) {
 	assets, err := ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{
 		fleet.MDMAssetABMKey,
 		fleet.MDMAssetABMCert,
-		fleet.MDMAssetABMToken,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("loading ABM assets from the database: %w", err)
 	}
 
+	abmTok, err := ds.GetABMTokenByOrgName(ctx, abmOrgName)
+	if err != nil {
+		return nil, fmt.Errorf("get ABM token by name: %w", err)
+	}
+
 	cert, err := tls.X509KeyPair(assets[fleet.MDMAssetABMCert].Value, assets[fleet.MDMAssetABMKey].Value)
 	if err != nil {
 		return nil, fmt.Errorf("parsing ABM keypair: %w", err)
@@ -92,11 +96,16 @@ func ABMToken(ctx context.Context, ds fleet.MDMAssetRetriever) (*nanodep_client.
 		return nil, fmt.Errorf("parsing ABM certificate: %w", err)
 	}
 
-	return DecryptRawABMToken(
-		assets[fleet.MDMAssetABMToken].Value,
+	oAuthTok, err := DecryptRawABMToken(
+		abmTok.EncryptedToken,
 		leaf,
 		assets[fleet.MDMAssetABMKey].Value,
 	)
+	if err != nil {
+		return nil, fmt.Errorf("decrypting ABM token: %w", err)
+	}
+
+	return oAuthTok, nil
 }
 
 func DecryptRawABMToken(tokenBytes []byte, cert *x509.Certificate, keyPEM []byte) (*nanodep_client.OAuth1Tokens, error) {
diff --git a/server/mdm/assets/assets_test.go b/server/mdm/assets/assets_test.go
index 42aaa9f006ed..2b60ac4aa35f 100644
--- a/server/mdm/assets/assets_test.go
+++ b/server/mdm/assets/assets_test.go
@@ -185,22 +185,31 @@ func TestABMToken(t *testing.T) {
 			"\r\n%s", base64.StdEncoding.EncodeToString(encryptedToken))
 
 	assets := map[fleet.MDMAssetName]fleet.MDMConfigAsset{
-		fleet.MDMAssetABMCert:  {Value: certPEM},
-		fleet.MDMAssetABMKey:   {Value: keyPEM},
-		fleet.MDMAssetABMToken: {Value: []byte(tokenBytes)},
+		fleet.MDMAssetABMCert: {Value: certPEM},
+		fleet.MDMAssetABMKey:  {Value: keyPEM},
 	}
 	ds.GetAllMDMConfigAssetsByNameFunc = func(ctx context.Context, assetNames []fleet.MDMAssetName) (map[fleet.MDMAssetName]fleet.MDMConfigAsset, error) {
 		require.ElementsMatch(t, []fleet.MDMAssetName{
 			fleet.MDMAssetABMCert,
 			fleet.MDMAssetABMKey,
-			fleet.MDMAssetABMToken,
 		}, assetNames)
 		return assets, nil
 	}
+	const testOrgName = "test-org"
+
+	ds.GetABMTokenByOrgNameFunc = func(ctx context.Context, orgName string) (*fleet.ABMToken, error) {
+		require.Equal(t, testOrgName, orgName)
+		return &fleet.ABMToken{
+			ID:               1,
+			OrganizationName: testOrgName,
+			EncryptedToken:   []byte(tokenBytes),
+		}, nil
+	}
 
-	tokens, err := ABMToken(ctx, ds)
+	tokens, err := ABMToken(ctx, ds, testOrgName)
 	require.NoError(t, err)
 	require.NotNil(t, tokens)
 	require.Equal(t, "test_access_secret", tokens.AccessSecret)
 	require.True(t, ds.GetAllMDMConfigAssetsByNameFuncInvoked)
+	require.True(t, ds.GetABMTokenByOrgNameFuncInvoked)
 }
diff --git a/server/mdm/lifecycle/lifecycle.go b/server/mdm/lifecycle/lifecycle.go
index 5587e71f4b36..33658a23678d 100644
--- a/server/mdm/lifecycle/lifecycle.go
+++ b/server/mdm/lifecycle/lifecycle.go
@@ -224,7 +224,7 @@ func (t *HostLifecycle) deleteDarwin(ctx context.Context, opts HostOptions) erro
 	}
 
 	if dep != nil && dep.DeletedAt == nil {
-		return t.restorePendingDEPHost(ctx, opts.Host, ac)
+		return t.restorePendingDEPHost(ctx, opts.Host, dep.ABMTokenID)
 	}
 
 	// no DEP assignment was found or the DEP assignment was deleted in ABM
@@ -232,8 +232,12 @@ func (t *HostLifecycle) deleteDarwin(ctx context.Context, opts HostOptions) erro
 	return nil
 }
 
-func (t *HostLifecycle) restorePendingDEPHost(ctx context.Context, host *fleet.Host, appCfg *fleet.AppConfig) error {
-	tmID, err := t.getConfigAppleBMDefaultTeamID(ctx, appCfg)
+func (t *HostLifecycle) restorePendingDEPHost(ctx context.Context, host *fleet.Host, abmTokenID *uint) error {
+	if abmTokenID == nil {
+		return ctxerr.New(ctx, "cannot restore pending dep host without valid ABM token id")
+	}
+
+	tmID, err := t.getDefaultTeamForABMToken(ctx, host, *abmTokenID)
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "restore pending dep host")
 	}
@@ -251,25 +255,43 @@ func (t *HostLifecycle) restorePendingDEPHost(ctx context.Context, host *fleet.H
 	return nil
 }
 
-func (t *HostLifecycle) getConfigAppleBMDefaultTeamID(ctx context.Context, appCfg *fleet.AppConfig) (*uint, error) {
-	var tmID *uint
-	if name := appCfg.MDM.AppleBMDefaultTeam; name != "" {
-		team, err := t.ds.TeamByName(ctx, name)
-		switch {
-		case fleet.IsNotFound(err):
-			level.Debug(t.logger).Log(
-				"msg",
-				"unable to find default team assigned in config, mdm devices won't be assigned to a team",
-				"team_name",
-				name,
-			)
-			return nil, nil
-		case err != nil:
-			return nil, ctxerr.Wrap(ctx, err, "get default team for mdm devices")
-		case team != nil:
-			tmID = &team.ID
-		}
+func (t *HostLifecycle) getDefaultTeamForABMToken(ctx context.Context, host *fleet.Host, abmTokenID uint) (*uint, error) {
+	var abmDefaultTeamID *uint
+	tok, err := t.ds.GetABMTokenByID(ctx, abmTokenID)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting ABM token by id")
+	}
+
+	switch host.FleetPlatform() {
+	case "darwin":
+		abmDefaultTeamID = tok.MacOSDefaultTeamID
+	case "ios":
+		abmDefaultTeamID = tok.IOSDefaultTeamID
+	case "ipados":
+		abmDefaultTeamID = tok.IPadOSDefaultTeamID
+	default:
+		return nil, ctxerr.NewWithData(ctx, "attempting to get default ABM team for host with invalid platform", map[string]any{"host_platform": host.FleetPlatform(), "host_id": host.ID})
+	}
+
+	if abmDefaultTeamID == nil {
+		// The default team is "No team", so we can return nil
+		return nil, nil
+	}
+
+	exists, err := t.ds.TeamExists(ctx, *abmDefaultTeamID)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get default team for mdm devices")
+	}
+
+	if !exists {
+		level.Debug(t.logger).Log(
+			"msg",
+			"unable to find default team assigned to abm token, mdm devices won't be assigned to a team",
+			"team_id",
+			abmDefaultTeamID,
+		)
+		return nil, nil
 	}
 
-	return tmID, nil
+	return abmDefaultTeamID, nil
 }
diff --git a/server/mdm/mdm.go b/server/mdm/mdm.go
index 041aeb960d76..93af98eb3da7 100644
--- a/server/mdm/mdm.go
+++ b/server/mdm/mdm.go
@@ -101,6 +101,14 @@ const (
 	// FleetMacOSUpdatesProfileName is the name of the DDM profile used by Fleet
 	// to configure macOS OS updates.
 	FleetMacOSUpdatesProfileName = "Fleet macOS OS Updates"
+
+	// FleetIOSUpdatesProfileName is the name of the DDM profile used by Fleet
+	// to configure iOS OS updates.
+	FleetIOSUpdatesProfileName = "Fleet iOS OS Updates"
+
+	// FleetIPadOSUpdatesProfileName is the name of the DDM profile used by Fleet
+	// to configure iPadOS OS updates.
+	FleetIPadOSUpdatesProfileName = "Fleet iPadOS OS Updates"
 )
 
 // FleetReservedProfileNames returns a map of PayloadDisplayName or profile
@@ -111,6 +119,8 @@ func FleetReservedProfileNames() map[string]struct{} {
 		FleetFileVaultProfileName:        {},
 		FleetWindowsOSUpdatesProfileName: {},
 		FleetMacOSUpdatesProfileName:     {},
+		FleetIOSUpdatesProfileName:       {},
+		FleetIPadOSUpdatesProfileName:    {},
 		FleetCAConfigProfileName:         {},
 	}
 }
@@ -130,5 +140,9 @@ func ListFleetReservedMacOSProfileNames() []string {
 // ListFleetReservedMacOSDeclarationNames returns a list of declaration names
 // that are reserved by Fleet for Apple DDM declarations.
 func ListFleetReservedMacOSDeclarationNames() []string {
-	return []string{FleetMacOSUpdatesProfileName}
+	return []string{
+		FleetMacOSUpdatesProfileName,
+		FleetIOSUpdatesProfileName,
+		FleetIPadOSUpdatesProfileName,
+	}
 }
diff --git a/server/mdm/nanodep/godep/client.go b/server/mdm/nanodep/godep/client.go
index 874db7546b6b..2d80a3dfd694 100644
--- a/server/mdm/nanodep/godep/client.go
+++ b/server/mdm/nanodep/godep/client.go
@@ -119,8 +119,14 @@ func NewClient(store ClientStorage, client *http.Client, opts ...ClientOption) *
 }
 
 func (c *Client) doWithAfterHook(ctx context.Context, name, method, path string, in interface{}, out interface{}) error {
-	err := c.do(ctx, name, method, path, in, out)
+	req, err := c.do(ctx, name, method, path, in, out)
 	if c.afterHook != nil {
+		// ensure the afterHook is always called with the same context as the one
+		// used for the request (the DEP client will add the name argument to that
+		// context, which we care about in the after hook).
+		if req != nil {
+			ctx = req.Context()
+		}
 		err = c.afterHook(ctx, err)
 	}
 	return err
@@ -130,19 +136,19 @@ func (c *Client) doWithAfterHook(ctx context.Context, name, method, path string,
 // should be using the NanoDEP transport (which handles authentication).
 // This frees us to only be concerned about the actual DEP API request.
 // We encode in to JSON and decode any returned body as JSON to out.
-func (c *Client) do(ctx context.Context, name, method, path string, in interface{}, out interface{}) error {
+func (c *Client) do(ctx context.Context, name, method, path string, in interface{}, out interface{}) (*http.Request, error) {
 	var body io.Reader
 	if in != nil {
 		bodyBytes, err := json.Marshal(in)
 		if err != nil {
-			return err
+			return nil, err
 		}
 		body = bytes.NewBuffer(bodyBytes)
 	}
 
 	req, err := depclient.NewRequestWithContext(ctx, name, c.store, method, path, body)
 	if err != nil {
-		return err
+		return nil, err
 	}
 	req.Header.Set("User-Agent", userAgent)
 	if body != nil {
@@ -154,22 +160,22 @@ func (c *Client) do(ctx context.Context, name, method, path string, in interface
 
 	resp, err := c.client.Do(req)
 	if err != nil {
-		return err
+		return req, err
 	}
 	defer resp.Body.Close()
 
 	if resp.StatusCode == http.StatusUnauthorized {
-		return fmt.Errorf("unhandled auth error: %w", depclient.NewAuthError(resp))
+		return req, fmt.Errorf("unhandled auth error: %w", depclient.NewAuthError(resp))
 	} else if resp.StatusCode != http.StatusOK {
-		return NewHTTPError(resp)
+		return req, NewHTTPError(resp)
 	}
 
 	if out != nil {
 		err := json.NewDecoder(resp.Body).Decode(out)
 		if err != nil {
-			return err
+			return req, err
 		}
 	}
 
-	return nil
+	return req, nil
 }
diff --git a/server/mdm/nanomdm/service/nanomdm/service.go b/server/mdm/nanomdm/service/nanomdm/service.go
index 8f206673f905..85f943b53676 100644
--- a/server/mdm/nanomdm/service/nanomdm/service.go
+++ b/server/mdm/nanomdm/service/nanomdm/service.go
@@ -232,7 +232,21 @@ func (s *Service) CommandAndReportResults(r *mdm.Request, results *mdm.CommandRe
 	logger.Info(logs...)
 	err := s.store.StoreCommandReport(r, results)
 	if err != nil {
-		return nil, fmt.Errorf("storing command report: %w", err)
+		// allow not found commands, this is an edge case only
+		// valid for migrations, other response codes confuse the
+		// mdmclient, and this gives us the opportunity to answer
+		// with more commands
+		if !service.IsNotFound(err) {
+			return nil, fmt.Errorf("storing command report: %w", err)
+		}
+
+		logger.Info(
+			"msg", "host reported status with invalid command uuid",
+			"command_uuid", results.CommandUUID,
+			"request_type", results.RequestType,
+			"status", results.Status,
+			"error_chain", results.ErrorChain,
+		)
 	}
 	cmd, err := s.store.RetrieveNextCommand(r, results.Status == "NotNow")
 	if err != nil {
diff --git a/server/mdm/nanomdm/storage/mysql/queue.go b/server/mdm/nanomdm/storage/mysql/queue.go
index a04dee76b758..a67262e4f80e 100644
--- a/server/mdm/nanomdm/storage/mysql/queue.go
+++ b/server/mdm/nanomdm/storage/mysql/queue.go
@@ -119,6 +119,23 @@ func (m *MySQLStorage) StoreCommandReport(r *mdm.Request, result *mdm.CommandRes
 	if result.Status == "Idle" {
 		return nil
 	}
+
+	// ensure there's a matching command
+	matchingRow := m.db.QueryRowContext(
+		r.Context,
+		`SELECT 1 FROM nano_commands WHERE command_uuid = ?`,
+		result.CommandUUID,
+	)
+	var matchingCount int
+	if err := matchingRow.Scan(&matchingCount); err != nil {
+		return err
+	}
+	// this should be already handed by the error value in Scan above, but
+	// just to be safe
+	if matchingCount == 0 {
+		return sql.ErrNoRows
+	}
+
 	if m.rm && result.Status != "NotNow" {
 		return m.deleteCommandTx(r, result)
 	}
diff --git a/server/mock/datastore_mock.go b/server/mock/datastore_mock.go
index 30095676c1fe..99d55d12158c 100644
--- a/server/mock/datastore_mock.go
+++ b/server/mock/datastore_mock.go
@@ -15,6 +15,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/mdm/apple/mobileconfig"
 	"github.com/fleetdm/fleet/v4/server/mdm/nanodep/godep"
+	"github.com/fleetdm/fleet/v4/server/mdm/nanomdm/mdm"
 )
 
 var _ fleet.Datastore = (*DataStore)(nil)
@@ -145,6 +146,8 @@ type ListLabelsFunc func(ctx context.Context, filter fleet.TeamFilter, opt fleet
 
 type LabelsSummaryFunc func(ctx context.Context) ([]*fleet.LabelSummary, error)
 
+type GetHostUUIDsWithPendingMDMAppleCommandsFunc func(ctx context.Context) ([]string, error)
+
 type LabelQueriesForHostFunc func(ctx context.Context, host *fleet.Host) (map[string]string, error)
 
 type ListLabelsForHostFunc func(ctx context.Context, hid uint) ([]*fleet.Label, error)
@@ -247,7 +250,15 @@ type GetHostMDMFunc func(ctx context.Context, hostID uint) (*fleet.HostMDM, erro
 
 type GetHostMDMCheckinInfoFunc func(ctx context.Context, hostUUID string) (*fleet.HostMDMCheckinInfo, error)
 
-type ListIOSAndIPadOSToRefetchFunc func(ctx context.Context, refetchInterval time.Duration) (uuids []string, err error)
+type ListIOSAndIPadOSToRefetchFunc func(ctx context.Context, refetchInterval time.Duration) (devices []fleet.AppleDevicesToRefetch, err error)
+
+type AddHostMDMCommandsFunc func(ctx context.Context, commands []fleet.HostMDMCommand) error
+
+type GetHostMDMCommandsFunc func(ctx context.Context, hostID uint) (commands []fleet.HostMDMCommand, err error)
+
+type RemoveHostMDMCommandFunc func(ctx context.Context, command fleet.HostMDMCommand) error
+
+type CleanupHostMDMCommandsFunc func(ctx context.Context) error
 
 type IsHostConnectedToFleetMDMFunc func(ctx context.Context, host *fleet.Host) (bool, error)
 
@@ -385,7 +396,7 @@ type ListSoftwareTitlesFunc func(ctx context.Context, opt fleet.SoftwareTitleLis
 
 type SoftwareTitleByIDFunc func(ctx context.Context, id uint, teamID *uint, tmFilter fleet.TeamFilter) (*fleet.SoftwareTitle, error)
 
-type InsertSoftwareInstallRequestFunc func(ctx context.Context, hostID uint, softwareTitleID uint, selfService bool) (string, error)
+type InsertSoftwareInstallRequestFunc func(ctx context.Context, hostID uint, softwareInstallerID uint, selfService bool) (string, error)
 
 type ListSoftwareForVulnDetectionFunc func(ctx context.Context, filter fleet.VulnSoftwareFilter) ([]fleet.Software, error)
 
@@ -425,6 +436,8 @@ type ListHostSoftwareFunc func(ctx context.Context, host *fleet.Host, opts fleet
 
 type SetHostSoftwareInstallResultFunc func(ctx context.Context, result *fleet.HostSoftwareInstallResultPayload) error
 
+type UploadedSoftwareExistsFunc func(ctx context.Context, bundleIdentifier string, teamID *uint) (bool, error)
+
 type GetHostOperatingSystemFunc func(ctx context.Context, hostID uint) (*fleet.OperatingSystem, error)
 
 type ListOperatingSystemsFunc func(ctx context.Context) ([]fleet.OperatingSystem, error)
@@ -481,6 +494,8 @@ type PolicyQueriesForHostFunc func(ctx context.Context, host *fleet.Host) (map[s
 
 type GetTeamHostsPolicyMembershipsFunc func(ctx context.Context, domain string, teamID uint, policyIDs []uint, hostID *uint) ([]fleet.HostPolicyMembershipData, error)
 
+type GetPoliciesWithAssociatedInstallerFunc func(ctx context.Context, teamID uint, policyIDs []uint) ([]fleet.PolicySoftwareInstallerData, error)
+
 type GetCalendarPoliciesFunc func(ctx context.Context, teamID uint) ([]fleet.PolicyCalendarData, error)
 
 type AsyncBatchInsertPolicyMembershipFunc func(ctx context.Context, batch []fleet.PolicyMembershipResult) error
@@ -501,7 +516,7 @@ type DeleteSoftwareVulnerabilitiesFunc func(ctx context.Context, vulnerabilities
 
 type DeleteOutOfDateVulnerabilitiesFunc func(ctx context.Context, source fleet.VulnerabilitySource, duration time.Duration) error
 
-type CreateOrUpdateCalendarEventFunc func(ctx context.Context, uuid string, email string, startTime time.Time, endTime time.Time, data []byte, timeZone string, hostID uint, webhookStatus fleet.CalendarWebhookStatus) (*fleet.CalendarEvent, error)
+type CreateOrUpdateCalendarEventFunc func(ctx context.Context, uuid string, email string, startTime time.Time, endTime time.Time, data []byte, timeZone *string, hostID uint, webhookStatus fleet.CalendarWebhookStatus) (*fleet.CalendarEvent, error)
 
 type GetCalendarEventFunc func(ctx context.Context, email string) (*fleet.CalendarEvent, error)
 
@@ -509,7 +524,7 @@ type GetCalendarEventDetailsByUUIDFunc func(ctx context.Context, uuid string) (*
 
 type DeleteCalendarEventFunc func(ctx context.Context, calendarEventID uint) error
 
-type UpdateCalendarEventFunc func(ctx context.Context, calendarEventID uint, uuid string, startTime time.Time, endTime time.Time, data []byte, timeZone string) error
+type UpdateCalendarEventFunc func(ctx context.Context, calendarEventID uint, uuid string, startTime time.Time, endTime time.Time, data []byte, timeZone *string) error
 
 type GetHostCalendarEventFunc func(ctx context.Context, hostID uint) (*fleet.HostCalendarEvent, *fleet.CalendarEvent, error)
 
@@ -599,6 +614,8 @@ type SetOrUpdateMunkiInfoFunc func(ctx context.Context, hostID uint, version str
 
 type SetOrUpdateMDMDataFunc func(ctx context.Context, hostID uint, isServer bool, enrolled bool, serverURL string, installedFromDep bool, name string, fleetEnrollRef string) error
 
+type UpdateMDMDataFunc func(ctx context.Context, hostID uint, enrolled bool) error
+
 type SetOrUpdateHostEmailsFromMdmIdpAccountsFunc func(ctx context.Context, hostID uint, fleetEnrollmentRef string) error
 
 type SetOrUpdateHostDisksSpaceFunc func(ctx context.Context, hostID uint, gigsAvailable float64, percentAvailable float64, gigsTotal float64) error
@@ -613,8 +630,6 @@ type SetHostsDiskEncryptionKeyStatusFunc func(ctx context.Context, hostIDs []uin
 
 type GetHostDiskEncryptionKeyFunc func(ctx context.Context, hostID uint) (*fleet.HostDiskEncryptionKey, error)
 
-type SetDiskEncryptionResetStatusFunc func(ctx context.Context, hostID uint, status bool) error
-
 type GetHostCertAssociationsToExpireFunc func(ctx context.Context, expiryDays int, limit int) ([]fleet.SCEPIdentityAssociation, error)
 
 type SetCommandForPendingSCEPRenewalFunc func(ctx context.Context, assocs []fleet.SCEPIdentityAssociation, cmdUUID string) error
@@ -681,6 +696,8 @@ type CountVulnerabilitiesFunc func(ctx context.Context, opt fleet.VulnListOption
 
 type UpdateVulnerabilityHostCountsFunc func(ctx context.Context) error
 
+type IsCVEKnownToFleetFunc func(ctx context.Context, cve string) (bool, error)
+
 type NewMDMAppleConfigProfileFunc func(ctx context.Context, p fleet.MDMAppleConfigProfile) (*fleet.MDMAppleConfigProfile, error)
 
 type BulkUpsertMDMAppleConfigProfilesFunc func(ctx context.Context, payload []*fleet.MDMAppleConfigProfile) error
@@ -735,9 +752,9 @@ type BatchSetMDMAppleProfilesFunc func(ctx context.Context, tmID *uint, profiles
 
 type MDMAppleListDevicesFunc func(ctx context.Context) ([]fleet.MDMAppleDevice, error)
 
-type UpsertMDMAppleHostDEPAssignmentsFunc func(ctx context.Context, hosts []fleet.Host) error
+type UpsertMDMAppleHostDEPAssignmentsFunc func(ctx context.Context, hosts []fleet.Host, abmTokenID uint) error
 
-type IngestMDMAppleDevicesFromDEPSyncFunc func(ctx context.Context, devices []godep.Device) (int64, *uint, error)
+type IngestMDMAppleDevicesFromDEPSyncFunc func(ctx context.Context, devices []godep.Device, abmTokenID uint, macOSTeam *fleet.Team, iosTeam *fleet.Team, ipadTeam *fleet.Team) (int64, error)
 
 type MDMAppleUpsertHostFunc func(ctx context.Context, mdmHost *fleet.Host) error
 
@@ -763,7 +780,7 @@ type ListMDMAppleProfilesToRemoveFunc func(ctx context.Context) ([]*fleet.MDMApp
 
 type BulkUpsertMDMAppleHostProfilesFunc func(ctx context.Context, payload []*fleet.MDMAppleBulkUpsertHostProfilePayload) error
 
-type BulkSetPendingMDMHostProfilesFunc func(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string) error
+type BulkSetPendingMDMHostProfilesFunc func(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string) (updates fleet.MDMProfilesUpdates, err error)
 
 type GetMDMAppleProfilesContentsFunc func(ctx context.Context, profileUUIDs []string) (map[string]mobileconfig.Mobileconfig, error)
 
@@ -781,7 +798,7 @@ type GetMDMIdPAccountByEmailFunc func(ctx context.Context, email string) (*fleet
 
 type GetMDMAppleFileVaultSummaryFunc func(ctx context.Context, teamID *uint) (*fleet.MDMAppleFileVaultSummary, error)
 
-type InsertMDMAppleBootstrapPackageFunc func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage) error
+type InsertMDMAppleBootstrapPackageFunc func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage, pkgStore fleet.MDMBootstrapPackageStore) error
 
 type CopyDefaultMDMAppleBootstrapPackageFunc func(ctx context.Context, ac *fleet.AppConfig, toTeamID uint) error
 
@@ -789,12 +806,14 @@ type DeleteMDMAppleBootstrapPackageFunc func(ctx context.Context, teamID uint) e
 
 type GetMDMAppleBootstrapPackageMetaFunc func(ctx context.Context, teamID uint) (*fleet.MDMAppleBootstrapPackage, error)
 
-type GetMDMAppleBootstrapPackageBytesFunc func(ctx context.Context, token string) (*fleet.MDMAppleBootstrapPackage, error)
+type GetMDMAppleBootstrapPackageBytesFunc func(ctx context.Context, token string, pkgStore fleet.MDMBootstrapPackageStore) (*fleet.MDMAppleBootstrapPackage, error)
 
 type GetMDMAppleBootstrapPackageSummaryFunc func(ctx context.Context, teamID uint) (*fleet.MDMAppleBootstrapPackageSummary, error)
 
 type RecordHostBootstrapPackageFunc func(ctx context.Context, commandUUID string, hostUUID string) error
 
+type CleanupUnusedBootstrapPackagesFunc func(ctx context.Context, pkgStore fleet.MDMBootstrapPackageStore, removeCreatedBefore time.Time) error
+
 type GetHostMDMMacOSSetupFunc func(ctx context.Context, hostID uint) (*fleet.HostMDMMacOSSetup, error)
 
 type MDMGetEULAMetadataFunc func(ctx context.Context) (*fleet.MDMEULA, error)
@@ -809,13 +828,15 @@ type SetOrUpdateMDMAppleSetupAssistantFunc func(ctx context.Context, asst *fleet
 
 type GetMDMAppleSetupAssistantFunc func(ctx context.Context, teamID *uint) (*fleet.MDMAppleSetupAssistant, error)
 
+type GetMDMAppleSetupAssistantProfileForABMTokenFunc func(ctx context.Context, teamID *uint, abmTokenOrgName string) (string, time.Time, error)
+
 type DeleteMDMAppleSetupAssistantFunc func(ctx context.Context, teamID *uint) error
 
-type SetMDMAppleSetupAssistantProfileUUIDFunc func(ctx context.Context, teamID *uint, profileUUID string) error
+type SetMDMAppleSetupAssistantProfileUUIDFunc func(ctx context.Context, teamID *uint, profileUUID string, abmTokenOrgName string) error
 
-type SetMDMAppleDefaultSetupAssistantProfileUUIDFunc func(ctx context.Context, teamID *uint, profileUUID string) error
+type SetMDMAppleDefaultSetupAssistantProfileUUIDFunc func(ctx context.Context, teamID *uint, profileUUID string, abmTokenOrgName string) error
 
-type GetMDMAppleDefaultSetupAssistantFunc func(ctx context.Context, teamID *uint) (profileUUID string, updatedAt time.Time, err error)
+type GetMDMAppleDefaultSetupAssistantFunc func(ctx context.Context, teamID *uint, abmTokenOrgName string) (profileUUID string, updatedAt time.Time, err error)
 
 type GetMatchingHostSerialsFunc func(ctx context.Context, serials []string) (map[string]*fleet.Host, error)
 
@@ -823,7 +844,7 @@ type DeleteHostDEPAssignmentsFunc func(ctx context.Context, serials []string) er
 
 type UpdateHostDEPAssignProfileResponsesFunc func(ctx context.Context, resp *godep.ProfileResponse) error
 
-type ScreenDEPAssignProfileSerialsForCooldownFunc func(ctx context.Context, serials []string) (skipSerials []string, assignSerials []string, err error)
+type ScreenDEPAssignProfileSerialsForCooldownFunc func(ctx context.Context, serials []string) (skipSerialsByOrgName map[string][]string, serialsByOrgName map[string][]string, err error)
 
 type GetDEPAssignProfileExpiredCooldownsFunc func(ctx context.Context) (map[uint][]string, error)
 
@@ -843,6 +864,8 @@ type MDMAppleStoreDDMStatusReportFunc func(ctx context.Context, hostUUID string,
 
 type MDMAppleSetPendingDeclarationsAsFunc func(ctx context.Context, hostUUID string, status *fleet.MDMDeliveryStatus, detail string) error
 
+type GetMDMAppleOSUpdatesSettingsByHostSerialFunc func(ctx context.Context, hostSerial string) (*fleet.AppleOSUpdateSettings, error)
+
 type InsertMDMConfigAssetsFunc func(ctx context.Context, assets []fleet.MDMConfigAsset) error
 
 type GetAllMDMConfigAssetsByNameFunc func(ctx context.Context, assetNames []fleet.MDMAssetName) (map[fleet.MDMAssetName]fleet.MDMConfigAsset, error)
@@ -851,6 +874,42 @@ type GetAllMDMConfigAssetsHashesFunc func(ctx context.Context, assetNames []flee
 
 type DeleteMDMConfigAssetsByNameFunc func(ctx context.Context, assetNames []fleet.MDMAssetName) error
 
+type ReplaceMDMConfigAssetsFunc func(ctx context.Context, assets []fleet.MDMConfigAsset) error
+
+type GetABMTokenByOrgNameFunc func(ctx context.Context, orgName string) (*fleet.ABMToken, error)
+
+type SaveABMTokenFunc func(ctx context.Context, tok *fleet.ABMToken) error
+
+type InsertVPPTokenFunc func(ctx context.Context, tok *fleet.VPPTokenData) (*fleet.VPPTokenDB, error)
+
+type ListVPPTokensFunc func(ctx context.Context) ([]*fleet.VPPTokenDB, error)
+
+type GetVPPTokenFunc func(ctx context.Context, tokenID uint) (*fleet.VPPTokenDB, error)
+
+type GetVPPTokenByTeamIDFunc func(ctx context.Context, teamID *uint) (*fleet.VPPTokenDB, error)
+
+type UpdateVPPTokenTeamsFunc func(ctx context.Context, id uint, teams []uint) (*fleet.VPPTokenDB, error)
+
+type UpdateVPPTokenFunc func(ctx context.Context, id uint, tok *fleet.VPPTokenData) (*fleet.VPPTokenDB, error)
+
+type DeleteVPPTokenFunc func(ctx context.Context, tokenID uint) error
+
+type SetABMTokenTermsExpiredForOrgNameFunc func(ctx context.Context, orgName string, expired bool) (wasSet bool, err error)
+
+type CountABMTokensWithTermsExpiredFunc func(ctx context.Context) (int, error)
+
+type InsertABMTokenFunc func(ctx context.Context, tok *fleet.ABMToken) (*fleet.ABMToken, error)
+
+type ListABMTokensFunc func(ctx context.Context) ([]*fleet.ABMToken, error)
+
+type DeleteABMTokenFunc func(ctx context.Context, tokenID uint) error
+
+type GetABMTokenByIDFunc func(ctx context.Context, tokenID uint) (*fleet.ABMToken, error)
+
+type GetABMTokenCountFunc func(ctx context.Context) (int, error)
+
+type GetABMTokenOrgNamesAssociatedWithTeamFunc func(ctx context.Context, teamID *uint) ([]string, error)
+
 type WSTEPStoreCertificateFunc func(ctx context.Context, name string, crt *x509.Certificate) error
 
 type WSTEPNewSerialFunc func(ctx context.Context) (*big.Int, error)
@@ -913,7 +972,7 @@ type NewMDMWindowsConfigProfileFunc func(ctx context.Context, cp fleet.MDMWindow
 
 type SetOrUpdateMDMWindowsConfigProfileFunc func(ctx context.Context, cp fleet.MDMWindowsConfigProfile) error
 
-type BatchSetMDMProfilesFunc func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDeclarations []*fleet.MDMAppleDeclaration) error
+type BatchSetMDMProfilesFunc func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDeclarations []*fleet.MDMAppleDeclaration) (updates fleet.MDMProfilesUpdates, err error)
 
 type NewMDMAppleDeclarationFunc func(ctx context.Context, declaration *fleet.MDMAppleDeclaration) (*fleet.MDMAppleDeclaration, error)
 
@@ -967,24 +1026,48 @@ type GetSoftwareInstallDetailsFunc func(ctx context.Context, executionId string)
 
 type ListPendingSoftwareInstallsFunc func(ctx context.Context, hostID uint) ([]string, error)
 
+type GetHostLastInstallDataFunc func(ctx context.Context, hostID uint, installerID uint) (*fleet.HostLastInstallData, error)
+
 type MatchOrCreateSoftwareInstallerFunc func(ctx context.Context, payload *fleet.UploadSoftwareInstallerPayload) (uint, error)
 
 type GetSoftwareInstallerMetadataByIDFunc func(ctx context.Context, id uint) (*fleet.SoftwareInstaller, error)
 
 type GetSoftwareInstallerMetadataByTeamAndTitleIDFunc func(ctx context.Context, teamID *uint, titleID uint, withScriptContents bool) (*fleet.SoftwareInstaller, error)
 
+type GetVPPAppByTeamAndTitleIDFunc func(ctx context.Context, teamID *uint, titleID uint) (*fleet.VPPApp, error)
+
+type GetVPPAppMetadataByTeamAndTitleIDFunc func(ctx context.Context, teamID *uint, titleID uint) (*fleet.VPPAppStoreApp, error)
+
 type DeleteSoftwareInstallerFunc func(ctx context.Context, id uint) error
 
+type DeleteVPPAppFromTeamFunc func(ctx context.Context, teamID *uint, appID fleet.VPPAppID) error
+
 type GetSummaryHostSoftwareInstallsFunc func(ctx context.Context, installerID uint) (*fleet.SoftwareInstallerStatusSummary, error)
 
+type GetSummaryHostVPPAppInstallsFunc func(ctx context.Context, teamID *uint, appID fleet.VPPAppID) (*fleet.VPPAppStatusSummary, error)
+
 type GetSoftwareInstallResultsFunc func(ctx context.Context, resultsUUID string) (*fleet.HostSoftwareInstallerResult, error)
 
-type CleanupUnusedSoftwareInstallersFunc func(ctx context.Context, softwareInstallStore fleet.SoftwareInstallerStore) error
+type CleanupUnusedSoftwareInstallersFunc func(ctx context.Context, softwareInstallStore fleet.SoftwareInstallerStore, removeCreatedBefore time.Time) error
 
-type BatchSetSoftwareInstallersFunc func(ctx context.Context, tmID *uint, installers []*fleet.UploadSoftwareInstallerPayload) error
+type BatchSetSoftwareInstallersFunc func(ctx context.Context, tmID *uint, installers []*fleet.UploadSoftwareInstallerPayload) ([]fleet.SoftwareInstaller, error)
 
 type HasSelfServiceSoftwareInstallersFunc func(ctx context.Context, platform string, teamID *uint) (bool, error)
 
+type BatchInsertVPPAppsFunc func(ctx context.Context, apps []*fleet.VPPApp) error
+
+type GetAssignedVPPAppsFunc func(ctx context.Context, teamID *uint) (map[fleet.VPPAppID]fleet.VPPAppTeam, error)
+
+type SetTeamVPPAppsFunc func(ctx context.Context, teamID *uint, appIDs []fleet.VPPAppTeam) error
+
+type InsertVPPAppWithTeamFunc func(ctx context.Context, app *fleet.VPPApp, teamID *uint) (*fleet.VPPApp, error)
+
+type InsertHostVPPSoftwareInstallFunc func(ctx context.Context, hostID uint, appID fleet.VPPAppID, commandUUID string, associatedEventID string, selfService bool) error
+
+type GetPastActivityDataForVPPAppInstallFunc func(ctx context.Context, commandResults *mdm.CommandResults) (*fleet.User, *fleet.ActivityInstalledAppStoreApp, error)
+
+type GetVPPTokenByLocationFunc func(ctx context.Context, loc string) (*fleet.VPPTokenDB, error)
+
 type DataStore struct {
 	HealthCheckFunc        HealthCheckFunc
 	HealthCheckFuncInvoked bool
@@ -1175,6 +1258,9 @@ type DataStore struct {
 	LabelsSummaryFunc        LabelsSummaryFunc
 	LabelsSummaryFuncInvoked bool
 
+	GetHostUUIDsWithPendingMDMAppleCommandsFunc        GetHostUUIDsWithPendingMDMAppleCommandsFunc
+	GetHostUUIDsWithPendingMDMAppleCommandsFuncInvoked bool
+
 	LabelQueriesForHostFunc        LabelQueriesForHostFunc
 	LabelQueriesForHostFuncInvoked bool
 
@@ -1331,6 +1417,18 @@ type DataStore struct {
 	ListIOSAndIPadOSToRefetchFunc        ListIOSAndIPadOSToRefetchFunc
 	ListIOSAndIPadOSToRefetchFuncInvoked bool
 
+	AddHostMDMCommandsFunc        AddHostMDMCommandsFunc
+	AddHostMDMCommandsFuncInvoked bool
+
+	GetHostMDMCommandsFunc        GetHostMDMCommandsFunc
+	GetHostMDMCommandsFuncInvoked bool
+
+	RemoveHostMDMCommandFunc        RemoveHostMDMCommandFunc
+	RemoveHostMDMCommandFuncInvoked bool
+
+	CleanupHostMDMCommandsFunc        CleanupHostMDMCommandsFunc
+	CleanupHostMDMCommandsFuncInvoked bool
+
 	IsHostConnectedToFleetMDMFunc        IsHostConnectedToFleetMDMFunc
 	IsHostConnectedToFleetMDMFuncInvoked bool
 
@@ -1595,6 +1693,9 @@ type DataStore struct {
 	SetHostSoftwareInstallResultFunc        SetHostSoftwareInstallResultFunc
 	SetHostSoftwareInstallResultFuncInvoked bool
 
+	UploadedSoftwareExistsFunc        UploadedSoftwareExistsFunc
+	UploadedSoftwareExistsFuncInvoked bool
+
 	GetHostOperatingSystemFunc        GetHostOperatingSystemFunc
 	GetHostOperatingSystemFuncInvoked bool
 
@@ -1679,6 +1780,9 @@ type DataStore struct {
 	GetTeamHostsPolicyMembershipsFunc        GetTeamHostsPolicyMembershipsFunc
 	GetTeamHostsPolicyMembershipsFuncInvoked bool
 
+	GetPoliciesWithAssociatedInstallerFunc        GetPoliciesWithAssociatedInstallerFunc
+	GetPoliciesWithAssociatedInstallerFuncInvoked bool
+
 	GetCalendarPoliciesFunc        GetCalendarPoliciesFunc
 	GetCalendarPoliciesFuncInvoked bool
 
@@ -1856,6 +1960,9 @@ type DataStore struct {
 	SetOrUpdateMDMDataFunc        SetOrUpdateMDMDataFunc
 	SetOrUpdateMDMDataFuncInvoked bool
 
+	UpdateMDMDataFunc        UpdateMDMDataFunc
+	UpdateMDMDataFuncInvoked bool
+
 	SetOrUpdateHostEmailsFromMdmIdpAccountsFunc        SetOrUpdateHostEmailsFromMdmIdpAccountsFunc
 	SetOrUpdateHostEmailsFromMdmIdpAccountsFuncInvoked bool
 
@@ -1877,9 +1984,6 @@ type DataStore struct {
 	GetHostDiskEncryptionKeyFunc        GetHostDiskEncryptionKeyFunc
 	GetHostDiskEncryptionKeyFuncInvoked bool
 
-	SetDiskEncryptionResetStatusFunc        SetDiskEncryptionResetStatusFunc
-	SetDiskEncryptionResetStatusFuncInvoked bool
-
 	GetHostCertAssociationsToExpireFunc        GetHostCertAssociationsToExpireFunc
 	GetHostCertAssociationsToExpireFuncInvoked bool
 
@@ -1979,6 +2083,9 @@ type DataStore struct {
 	UpdateVulnerabilityHostCountsFunc        UpdateVulnerabilityHostCountsFunc
 	UpdateVulnerabilityHostCountsFuncInvoked bool
 
+	IsCVEKnownToFleetFunc        IsCVEKnownToFleetFunc
+	IsCVEKnownToFleetFuncInvoked bool
+
 	NewMDMAppleConfigProfileFunc        NewMDMAppleConfigProfileFunc
 	NewMDMAppleConfigProfileFuncInvoked bool
 
@@ -2150,6 +2257,9 @@ type DataStore struct {
 	RecordHostBootstrapPackageFunc        RecordHostBootstrapPackageFunc
 	RecordHostBootstrapPackageFuncInvoked bool
 
+	CleanupUnusedBootstrapPackagesFunc        CleanupUnusedBootstrapPackagesFunc
+	CleanupUnusedBootstrapPackagesFuncInvoked bool
+
 	GetHostMDMMacOSSetupFunc        GetHostMDMMacOSSetupFunc
 	GetHostMDMMacOSSetupFuncInvoked bool
 
@@ -2171,6 +2281,9 @@ type DataStore struct {
 	GetMDMAppleSetupAssistantFunc        GetMDMAppleSetupAssistantFunc
 	GetMDMAppleSetupAssistantFuncInvoked bool
 
+	GetMDMAppleSetupAssistantProfileForABMTokenFunc        GetMDMAppleSetupAssistantProfileForABMTokenFunc
+	GetMDMAppleSetupAssistantProfileForABMTokenFuncInvoked bool
+
 	DeleteMDMAppleSetupAssistantFunc        DeleteMDMAppleSetupAssistantFunc
 	DeleteMDMAppleSetupAssistantFuncInvoked bool
 
@@ -2222,6 +2335,9 @@ type DataStore struct {
 	MDMAppleSetPendingDeclarationsAsFunc        MDMAppleSetPendingDeclarationsAsFunc
 	MDMAppleSetPendingDeclarationsAsFuncInvoked bool
 
+	GetMDMAppleOSUpdatesSettingsByHostSerialFunc        GetMDMAppleOSUpdatesSettingsByHostSerialFunc
+	GetMDMAppleOSUpdatesSettingsByHostSerialFuncInvoked bool
+
 	InsertMDMConfigAssetsFunc        InsertMDMConfigAssetsFunc
 	InsertMDMConfigAssetsFuncInvoked bool
 
@@ -2234,6 +2350,60 @@ type DataStore struct {
 	DeleteMDMConfigAssetsByNameFunc        DeleteMDMConfigAssetsByNameFunc
 	DeleteMDMConfigAssetsByNameFuncInvoked bool
 
+	ReplaceMDMConfigAssetsFunc        ReplaceMDMConfigAssetsFunc
+	ReplaceMDMConfigAssetsFuncInvoked bool
+
+	GetABMTokenByOrgNameFunc        GetABMTokenByOrgNameFunc
+	GetABMTokenByOrgNameFuncInvoked bool
+
+	SaveABMTokenFunc        SaveABMTokenFunc
+	SaveABMTokenFuncInvoked bool
+
+	InsertVPPTokenFunc        InsertVPPTokenFunc
+	InsertVPPTokenFuncInvoked bool
+
+	ListVPPTokensFunc        ListVPPTokensFunc
+	ListVPPTokensFuncInvoked bool
+
+	GetVPPTokenFunc        GetVPPTokenFunc
+	GetVPPTokenFuncInvoked bool
+
+	GetVPPTokenByTeamIDFunc        GetVPPTokenByTeamIDFunc
+	GetVPPTokenByTeamIDFuncInvoked bool
+
+	UpdateVPPTokenTeamsFunc        UpdateVPPTokenTeamsFunc
+	UpdateVPPTokenTeamsFuncInvoked bool
+
+	UpdateVPPTokenFunc        UpdateVPPTokenFunc
+	UpdateVPPTokenFuncInvoked bool
+
+	DeleteVPPTokenFunc        DeleteVPPTokenFunc
+	DeleteVPPTokenFuncInvoked bool
+
+	SetABMTokenTermsExpiredForOrgNameFunc        SetABMTokenTermsExpiredForOrgNameFunc
+	SetABMTokenTermsExpiredForOrgNameFuncInvoked bool
+
+	CountABMTokensWithTermsExpiredFunc        CountABMTokensWithTermsExpiredFunc
+	CountABMTokensWithTermsExpiredFuncInvoked bool
+
+	InsertABMTokenFunc        InsertABMTokenFunc
+	InsertABMTokenFuncInvoked bool
+
+	ListABMTokensFunc        ListABMTokensFunc
+	ListABMTokensFuncInvoked bool
+
+	DeleteABMTokenFunc        DeleteABMTokenFunc
+	DeleteABMTokenFuncInvoked bool
+
+	GetABMTokenByIDFunc        GetABMTokenByIDFunc
+	GetABMTokenByIDFuncInvoked bool
+
+	GetABMTokenCountFunc        GetABMTokenCountFunc
+	GetABMTokenCountFuncInvoked bool
+
+	GetABMTokenOrgNamesAssociatedWithTeamFunc        GetABMTokenOrgNamesAssociatedWithTeamFunc
+	GetABMTokenOrgNamesAssociatedWithTeamFuncInvoked bool
+
 	WSTEPStoreCertificateFunc        WSTEPStoreCertificateFunc
 	WSTEPStoreCertificateFuncInvoked bool
 
@@ -2408,6 +2578,9 @@ type DataStore struct {
 	ListPendingSoftwareInstallsFunc        ListPendingSoftwareInstallsFunc
 	ListPendingSoftwareInstallsFuncInvoked bool
 
+	GetHostLastInstallDataFunc        GetHostLastInstallDataFunc
+	GetHostLastInstallDataFuncInvoked bool
+
 	MatchOrCreateSoftwareInstallerFunc        MatchOrCreateSoftwareInstallerFunc
 	MatchOrCreateSoftwareInstallerFuncInvoked bool
 
@@ -2417,12 +2590,24 @@ type DataStore struct {
 	GetSoftwareInstallerMetadataByTeamAndTitleIDFunc        GetSoftwareInstallerMetadataByTeamAndTitleIDFunc
 	GetSoftwareInstallerMetadataByTeamAndTitleIDFuncInvoked bool
 
+	GetVPPAppByTeamAndTitleIDFunc        GetVPPAppByTeamAndTitleIDFunc
+	GetVPPAppByTeamAndTitleIDFuncInvoked bool
+
+	GetVPPAppMetadataByTeamAndTitleIDFunc        GetVPPAppMetadataByTeamAndTitleIDFunc
+	GetVPPAppMetadataByTeamAndTitleIDFuncInvoked bool
+
 	DeleteSoftwareInstallerFunc        DeleteSoftwareInstallerFunc
 	DeleteSoftwareInstallerFuncInvoked bool
 
+	DeleteVPPAppFromTeamFunc        DeleteVPPAppFromTeamFunc
+	DeleteVPPAppFromTeamFuncInvoked bool
+
 	GetSummaryHostSoftwareInstallsFunc        GetSummaryHostSoftwareInstallsFunc
 	GetSummaryHostSoftwareInstallsFuncInvoked bool
 
+	GetSummaryHostVPPAppInstallsFunc        GetSummaryHostVPPAppInstallsFunc
+	GetSummaryHostVPPAppInstallsFuncInvoked bool
+
 	GetSoftwareInstallResultsFunc        GetSoftwareInstallResultsFunc
 	GetSoftwareInstallResultsFuncInvoked bool
 
@@ -2435,6 +2620,27 @@ type DataStore struct {
 	HasSelfServiceSoftwareInstallersFunc        HasSelfServiceSoftwareInstallersFunc
 	HasSelfServiceSoftwareInstallersFuncInvoked bool
 
+	BatchInsertVPPAppsFunc        BatchInsertVPPAppsFunc
+	BatchInsertVPPAppsFuncInvoked bool
+
+	GetAssignedVPPAppsFunc        GetAssignedVPPAppsFunc
+	GetAssignedVPPAppsFuncInvoked bool
+
+	SetTeamVPPAppsFunc        SetTeamVPPAppsFunc
+	SetTeamVPPAppsFuncInvoked bool
+
+	InsertVPPAppWithTeamFunc        InsertVPPAppWithTeamFunc
+	InsertVPPAppWithTeamFuncInvoked bool
+
+	InsertHostVPPSoftwareInstallFunc        InsertHostVPPSoftwareInstallFunc
+	InsertHostVPPSoftwareInstallFuncInvoked bool
+
+	GetPastActivityDataForVPPAppInstallFunc        GetPastActivityDataForVPPAppInstallFunc
+	GetPastActivityDataForVPPAppInstallFuncInvoked bool
+
+	GetVPPTokenByLocationFunc        GetVPPTokenByLocationFunc
+	GetVPPTokenByLocationFuncInvoked bool
+
 	mu sync.Mutex
 }
 
@@ -2879,6 +3085,13 @@ func (s *DataStore) LabelsSummary(ctx context.Context) ([]*fleet.LabelSummary, e
 	return s.LabelsSummaryFunc(ctx)
 }
 
+func (s *DataStore) GetHostUUIDsWithPendingMDMAppleCommands(ctx context.Context) ([]string, error) {
+	s.mu.Lock()
+	s.GetHostUUIDsWithPendingMDMAppleCommandsFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetHostUUIDsWithPendingMDMAppleCommandsFunc(ctx)
+}
+
 func (s *DataStore) LabelQueriesForHost(ctx context.Context, host *fleet.Host) (map[string]string, error) {
 	s.mu.Lock()
 	s.LabelQueriesForHostFuncInvoked = true
@@ -3040,11 +3253,11 @@ func (s *DataStore) GenerateHostStatusStatistics(ctx context.Context, filter fle
 	return s.GenerateHostStatusStatisticsFunc(ctx, filter, now, platform, lowDiskSpace)
 }
 
-func (s *DataStore) HostIDsByIdentifier(ctx context.Context, filter fleet.TeamFilter, hostIdentifiers []string) ([]uint, error) {
+func (s *DataStore) HostIDsByIdentifier(ctx context.Context, filter fleet.TeamFilter, hostnames []string) ([]uint, error) {
 	s.mu.Lock()
 	s.HostIDsByIdentifierFuncInvoked = true
 	s.mu.Unlock()
-	return s.HostIDsByIdentifierFunc(ctx, filter, hostIdentifiers)
+	return s.HostIDsByIdentifierFunc(ctx, filter, hostnames)
 }
 
 func (s *DataStore) HostIDsByOSID(ctx context.Context, osID uint, offset int, limit int) ([]uint, error) {
@@ -3236,13 +3449,41 @@ func (s *DataStore) GetHostMDMCheckinInfo(ctx context.Context, hostUUID string)
 	return s.GetHostMDMCheckinInfoFunc(ctx, hostUUID)
 }
 
-func (s *DataStore) ListIOSAndIPadOSToRefetch(ctx context.Context, refetchInterval time.Duration) (uuids []string, err error) {
+func (s *DataStore) ListIOSAndIPadOSToRefetch(ctx context.Context, refetchInterval time.Duration) (devices []fleet.AppleDevicesToRefetch, err error) {
 	s.mu.Lock()
 	s.ListIOSAndIPadOSToRefetchFuncInvoked = true
 	s.mu.Unlock()
 	return s.ListIOSAndIPadOSToRefetchFunc(ctx, refetchInterval)
 }
 
+func (s *DataStore) AddHostMDMCommands(ctx context.Context, commands []fleet.HostMDMCommand) error {
+	s.mu.Lock()
+	s.AddHostMDMCommandsFuncInvoked = true
+	s.mu.Unlock()
+	return s.AddHostMDMCommandsFunc(ctx, commands)
+}
+
+func (s *DataStore) GetHostMDMCommands(ctx context.Context, hostID uint) (commands []fleet.HostMDMCommand, err error) {
+	s.mu.Lock()
+	s.GetHostMDMCommandsFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetHostMDMCommandsFunc(ctx, hostID)
+}
+
+func (s *DataStore) RemoveHostMDMCommand(ctx context.Context, command fleet.HostMDMCommand) error {
+	s.mu.Lock()
+	s.RemoveHostMDMCommandFuncInvoked = true
+	s.mu.Unlock()
+	return s.RemoveHostMDMCommandFunc(ctx, command)
+}
+
+func (s *DataStore) CleanupHostMDMCommands(ctx context.Context) error {
+	s.mu.Lock()
+	s.CleanupHostMDMCommandsFuncInvoked = true
+	s.mu.Unlock()
+	return s.CleanupHostMDMCommandsFunc(ctx)
+}
+
 func (s *DataStore) IsHostConnectedToFleetMDM(ctx context.Context, host *fleet.Host) (bool, error) {
 	s.mu.Lock()
 	s.IsHostConnectedToFleetMDMFuncInvoked = true
@@ -3719,11 +3960,11 @@ func (s *DataStore) SoftwareTitleByID(ctx context.Context, id uint, teamID *uint
 	return s.SoftwareTitleByIDFunc(ctx, id, teamID, tmFilter)
 }
 
-func (s *DataStore) InsertSoftwareInstallRequest(ctx context.Context, hostID uint, softwareTitleID uint, selfService bool) (string, error) {
+func (s *DataStore) InsertSoftwareInstallRequest(ctx context.Context, hostID uint, softwareInstallerID uint, selfService bool) (string, error) {
 	s.mu.Lock()
 	s.InsertSoftwareInstallRequestFuncInvoked = true
 	s.mu.Unlock()
-	return s.InsertSoftwareInstallRequestFunc(ctx, hostID, softwareTitleID, selfService)
+	return s.InsertSoftwareInstallRequestFunc(ctx, hostID, softwareInstallerID, selfService)
 }
 
 func (s *DataStore) ListSoftwareForVulnDetection(ctx context.Context, filter fleet.VulnSoftwareFilter) ([]fleet.Software, error) {
@@ -3859,6 +4100,13 @@ func (s *DataStore) SetHostSoftwareInstallResult(ctx context.Context, result *fl
 	return s.SetHostSoftwareInstallResultFunc(ctx, result)
 }
 
+func (s *DataStore) UploadedSoftwareExists(ctx context.Context, bundleIdentifier string, teamID *uint) (bool, error) {
+	s.mu.Lock()
+	s.UploadedSoftwareExistsFuncInvoked = true
+	s.mu.Unlock()
+	return s.UploadedSoftwareExistsFunc(ctx, bundleIdentifier, teamID)
+}
+
 func (s *DataStore) GetHostOperatingSystem(ctx context.Context, hostID uint) (*fleet.OperatingSystem, error) {
 	s.mu.Lock()
 	s.GetHostOperatingSystemFuncInvoked = true
@@ -4055,6 +4303,13 @@ func (s *DataStore) GetTeamHostsPolicyMemberships(ctx context.Context, domain st
 	return s.GetTeamHostsPolicyMembershipsFunc(ctx, domain, teamID, policyIDs, hostID)
 }
 
+func (s *DataStore) GetPoliciesWithAssociatedInstaller(ctx context.Context, teamID uint, policyIDs []uint) ([]fleet.PolicySoftwareInstallerData, error) {
+	s.mu.Lock()
+	s.GetPoliciesWithAssociatedInstallerFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetPoliciesWithAssociatedInstallerFunc(ctx, teamID, policyIDs)
+}
+
 func (s *DataStore) GetCalendarPolicies(ctx context.Context, teamID uint) ([]fleet.PolicyCalendarData, error) {
 	s.mu.Lock()
 	s.GetCalendarPoliciesFuncInvoked = true
@@ -4125,7 +4380,7 @@ func (s *DataStore) DeleteOutOfDateVulnerabilities(ctx context.Context, source f
 	return s.DeleteOutOfDateVulnerabilitiesFunc(ctx, source, duration)
 }
 
-func (s *DataStore) CreateOrUpdateCalendarEvent(ctx context.Context, uuid string, email string, startTime time.Time, endTime time.Time, data []byte, timeZone string, hostID uint, webhookStatus fleet.CalendarWebhookStatus) (*fleet.CalendarEvent, error) {
+func (s *DataStore) CreateOrUpdateCalendarEvent(ctx context.Context, uuid string, email string, startTime time.Time, endTime time.Time, data []byte, timeZone *string, hostID uint, webhookStatus fleet.CalendarWebhookStatus) (*fleet.CalendarEvent, error) {
 	s.mu.Lock()
 	s.CreateOrUpdateCalendarEventFuncInvoked = true
 	s.mu.Unlock()
@@ -4153,7 +4408,7 @@ func (s *DataStore) DeleteCalendarEvent(ctx context.Context, calendarEventID uin
 	return s.DeleteCalendarEventFunc(ctx, calendarEventID)
 }
 
-func (s *DataStore) UpdateCalendarEvent(ctx context.Context, calendarEventID uint, uuid string, startTime time.Time, endTime time.Time, data []byte, timeZone string) error {
+func (s *DataStore) UpdateCalendarEvent(ctx context.Context, calendarEventID uint, uuid string, startTime time.Time, endTime time.Time, data []byte, timeZone *string) error {
 	s.mu.Lock()
 	s.UpdateCalendarEventFuncInvoked = true
 	s.mu.Unlock()
@@ -4468,6 +4723,13 @@ func (s *DataStore) SetOrUpdateMDMData(ctx context.Context, hostID uint, isServe
 	return s.SetOrUpdateMDMDataFunc(ctx, hostID, isServer, enrolled, serverURL, installedFromDep, name, fleetEnrollRef)
 }
 
+func (s *DataStore) UpdateMDMData(ctx context.Context, hostID uint, enrolled bool) error {
+	s.mu.Lock()
+	s.UpdateMDMDataFuncInvoked = true
+	s.mu.Unlock()
+	return s.UpdateMDMDataFunc(ctx, hostID, enrolled)
+}
+
 func (s *DataStore) SetOrUpdateHostEmailsFromMdmIdpAccounts(ctx context.Context, hostID uint, fleetEnrollmentRef string) error {
 	s.mu.Lock()
 	s.SetOrUpdateHostEmailsFromMdmIdpAccountsFuncInvoked = true
@@ -4517,13 +4779,6 @@ func (s *DataStore) GetHostDiskEncryptionKey(ctx context.Context, hostID uint) (
 	return s.GetHostDiskEncryptionKeyFunc(ctx, hostID)
 }
 
-func (s *DataStore) SetDiskEncryptionResetStatus(ctx context.Context, hostID uint, status bool) error {
-	s.mu.Lock()
-	s.SetDiskEncryptionResetStatusFuncInvoked = true
-	s.mu.Unlock()
-	return s.SetDiskEncryptionResetStatusFunc(ctx, hostID, status)
-}
-
 func (s *DataStore) GetHostCertAssociationsToExpire(ctx context.Context, expiryDays int, limit int) ([]fleet.SCEPIdentityAssociation, error) {
 	s.mu.Lock()
 	s.GetHostCertAssociationsToExpireFuncInvoked = true
@@ -4755,6 +5010,13 @@ func (s *DataStore) UpdateVulnerabilityHostCounts(ctx context.Context) error {
 	return s.UpdateVulnerabilityHostCountsFunc(ctx)
 }
 
+func (s *DataStore) IsCVEKnownToFleet(ctx context.Context, cve string) (bool, error) {
+	s.mu.Lock()
+	s.IsCVEKnownToFleetFuncInvoked = true
+	s.mu.Unlock()
+	return s.IsCVEKnownToFleetFunc(ctx, cve)
+}
+
 func (s *DataStore) NewMDMAppleConfigProfile(ctx context.Context, p fleet.MDMAppleConfigProfile) (*fleet.MDMAppleConfigProfile, error) {
 	s.mu.Lock()
 	s.NewMDMAppleConfigProfileFuncInvoked = true
@@ -4944,18 +5206,18 @@ func (s *DataStore) MDMAppleListDevices(ctx context.Context) ([]fleet.MDMAppleDe
 	return s.MDMAppleListDevicesFunc(ctx)
 }
 
-func (s *DataStore) UpsertMDMAppleHostDEPAssignments(ctx context.Context, hosts []fleet.Host) error {
+func (s *DataStore) UpsertMDMAppleHostDEPAssignments(ctx context.Context, hosts []fleet.Host, abmTokenID uint) error {
 	s.mu.Lock()
 	s.UpsertMDMAppleHostDEPAssignmentsFuncInvoked = true
 	s.mu.Unlock()
-	return s.UpsertMDMAppleHostDEPAssignmentsFunc(ctx, hosts)
+	return s.UpsertMDMAppleHostDEPAssignmentsFunc(ctx, hosts, abmTokenID)
 }
 
-func (s *DataStore) IngestMDMAppleDevicesFromDEPSync(ctx context.Context, devices []godep.Device) (int64, *uint, error) {
+func (s *DataStore) IngestMDMAppleDevicesFromDEPSync(ctx context.Context, devices []godep.Device, abmTokenID uint, macOSTeam *fleet.Team, iosTeam *fleet.Team, ipadTeam *fleet.Team) (int64, error) {
 	s.mu.Lock()
 	s.IngestMDMAppleDevicesFromDEPSyncFuncInvoked = true
 	s.mu.Unlock()
-	return s.IngestMDMAppleDevicesFromDEPSyncFunc(ctx, devices)
+	return s.IngestMDMAppleDevicesFromDEPSyncFunc(ctx, devices, abmTokenID, macOSTeam, iosTeam, ipadTeam)
 }
 
 func (s *DataStore) MDMAppleUpsertHost(ctx context.Context, mdmHost *fleet.Host) error {
@@ -5042,7 +5304,7 @@ func (s *DataStore) BulkUpsertMDMAppleHostProfiles(ctx context.Context, payload
 	return s.BulkUpsertMDMAppleHostProfilesFunc(ctx, payload)
 }
 
-func (s *DataStore) BulkSetPendingMDMHostProfiles(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string) error {
+func (s *DataStore) BulkSetPendingMDMHostProfiles(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string) (updates fleet.MDMProfilesUpdates, err error) {
 	s.mu.Lock()
 	s.BulkSetPendingMDMHostProfilesFuncInvoked = true
 	s.mu.Unlock()
@@ -5105,11 +5367,11 @@ func (s *DataStore) GetMDMAppleFileVaultSummary(ctx context.Context, teamID *uin
 	return s.GetMDMAppleFileVaultSummaryFunc(ctx, teamID)
 }
 
-func (s *DataStore) InsertMDMAppleBootstrapPackage(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage) error {
+func (s *DataStore) InsertMDMAppleBootstrapPackage(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage, pkgStore fleet.MDMBootstrapPackageStore) error {
 	s.mu.Lock()
 	s.InsertMDMAppleBootstrapPackageFuncInvoked = true
 	s.mu.Unlock()
-	return s.InsertMDMAppleBootstrapPackageFunc(ctx, bp)
+	return s.InsertMDMAppleBootstrapPackageFunc(ctx, bp, pkgStore)
 }
 
 func (s *DataStore) CopyDefaultMDMAppleBootstrapPackage(ctx context.Context, ac *fleet.AppConfig, toTeamID uint) error {
@@ -5133,11 +5395,11 @@ func (s *DataStore) GetMDMAppleBootstrapPackageMeta(ctx context.Context, teamID
 	return s.GetMDMAppleBootstrapPackageMetaFunc(ctx, teamID)
 }
 
-func (s *DataStore) GetMDMAppleBootstrapPackageBytes(ctx context.Context, token string) (*fleet.MDMAppleBootstrapPackage, error) {
+func (s *DataStore) GetMDMAppleBootstrapPackageBytes(ctx context.Context, token string, pkgStore fleet.MDMBootstrapPackageStore) (*fleet.MDMAppleBootstrapPackage, error) {
 	s.mu.Lock()
 	s.GetMDMAppleBootstrapPackageBytesFuncInvoked = true
 	s.mu.Unlock()
-	return s.GetMDMAppleBootstrapPackageBytesFunc(ctx, token)
+	return s.GetMDMAppleBootstrapPackageBytesFunc(ctx, token, pkgStore)
 }
 
 func (s *DataStore) GetMDMAppleBootstrapPackageSummary(ctx context.Context, teamID uint) (*fleet.MDMAppleBootstrapPackageSummary, error) {
@@ -5154,6 +5416,13 @@ func (s *DataStore) RecordHostBootstrapPackage(ctx context.Context, commandUUID
 	return s.RecordHostBootstrapPackageFunc(ctx, commandUUID, hostUUID)
 }
 
+func (s *DataStore) CleanupUnusedBootstrapPackages(ctx context.Context, pkgStore fleet.MDMBootstrapPackageStore, removeCreatedBefore time.Time) error {
+	s.mu.Lock()
+	s.CleanupUnusedBootstrapPackagesFuncInvoked = true
+	s.mu.Unlock()
+	return s.CleanupUnusedBootstrapPackagesFunc(ctx, pkgStore, removeCreatedBefore)
+}
+
 func (s *DataStore) GetHostMDMMacOSSetup(ctx context.Context, hostID uint) (*fleet.HostMDMMacOSSetup, error) {
 	s.mu.Lock()
 	s.GetHostMDMMacOSSetupFuncInvoked = true
@@ -5203,6 +5472,13 @@ func (s *DataStore) GetMDMAppleSetupAssistant(ctx context.Context, teamID *uint)
 	return s.GetMDMAppleSetupAssistantFunc(ctx, teamID)
 }
 
+func (s *DataStore) GetMDMAppleSetupAssistantProfileForABMToken(ctx context.Context, teamID *uint, abmTokenOrgName string) (string, time.Time, error) {
+	s.mu.Lock()
+	s.GetMDMAppleSetupAssistantProfileForABMTokenFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetMDMAppleSetupAssistantProfileForABMTokenFunc(ctx, teamID, abmTokenOrgName)
+}
+
 func (s *DataStore) DeleteMDMAppleSetupAssistant(ctx context.Context, teamID *uint) error {
 	s.mu.Lock()
 	s.DeleteMDMAppleSetupAssistantFuncInvoked = true
@@ -5210,25 +5486,25 @@ func (s *DataStore) DeleteMDMAppleSetupAssistant(ctx context.Context, teamID *ui
 	return s.DeleteMDMAppleSetupAssistantFunc(ctx, teamID)
 }
 
-func (s *DataStore) SetMDMAppleSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID string) error {
+func (s *DataStore) SetMDMAppleSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID string, abmTokenOrgName string) error {
 	s.mu.Lock()
 	s.SetMDMAppleSetupAssistantProfileUUIDFuncInvoked = true
 	s.mu.Unlock()
-	return s.SetMDMAppleSetupAssistantProfileUUIDFunc(ctx, teamID, profileUUID)
+	return s.SetMDMAppleSetupAssistantProfileUUIDFunc(ctx, teamID, profileUUID, abmTokenOrgName)
 }
 
-func (s *DataStore) SetMDMAppleDefaultSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID string) error {
+func (s *DataStore) SetMDMAppleDefaultSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID string, abmTokenOrgName string) error {
 	s.mu.Lock()
 	s.SetMDMAppleDefaultSetupAssistantProfileUUIDFuncInvoked = true
 	s.mu.Unlock()
-	return s.SetMDMAppleDefaultSetupAssistantProfileUUIDFunc(ctx, teamID, profileUUID)
+	return s.SetMDMAppleDefaultSetupAssistantProfileUUIDFunc(ctx, teamID, profileUUID, abmTokenOrgName)
 }
 
-func (s *DataStore) GetMDMAppleDefaultSetupAssistant(ctx context.Context, teamID *uint) (profileUUID string, updatedAt time.Time, err error) {
+func (s *DataStore) GetMDMAppleDefaultSetupAssistant(ctx context.Context, teamID *uint, abmTokenOrgName string) (profileUUID string, updatedAt time.Time, err error) {
 	s.mu.Lock()
 	s.GetMDMAppleDefaultSetupAssistantFuncInvoked = true
 	s.mu.Unlock()
-	return s.GetMDMAppleDefaultSetupAssistantFunc(ctx, teamID)
+	return s.GetMDMAppleDefaultSetupAssistantFunc(ctx, teamID, abmTokenOrgName)
 }
 
 func (s *DataStore) GetMatchingHostSerials(ctx context.Context, serials []string) (map[string]*fleet.Host, error) {
@@ -5252,7 +5528,7 @@ func (s *DataStore) UpdateHostDEPAssignProfileResponses(ctx context.Context, res
 	return s.UpdateHostDEPAssignProfileResponsesFunc(ctx, resp)
 }
 
-func (s *DataStore) ScreenDEPAssignProfileSerialsForCooldown(ctx context.Context, serials []string) (skipSerials []string, assignSerials []string, err error) {
+func (s *DataStore) ScreenDEPAssignProfileSerialsForCooldown(ctx context.Context, serials []string) (skipSerialsByOrgName map[string][]string, serialsByOrgName map[string][]string, err error) {
 	s.mu.Lock()
 	s.ScreenDEPAssignProfileSerialsForCooldownFuncInvoked = true
 	s.mu.Unlock()
@@ -5322,6 +5598,13 @@ func (s *DataStore) MDMAppleSetPendingDeclarationsAs(ctx context.Context, hostUU
 	return s.MDMAppleSetPendingDeclarationsAsFunc(ctx, hostUUID, status, detail)
 }
 
+func (s *DataStore) GetMDMAppleOSUpdatesSettingsByHostSerial(ctx context.Context, hostSerial string) (*fleet.AppleOSUpdateSettings, error) {
+	s.mu.Lock()
+	s.GetMDMAppleOSUpdatesSettingsByHostSerialFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetMDMAppleOSUpdatesSettingsByHostSerialFunc(ctx, hostSerial)
+}
+
 func (s *DataStore) InsertMDMConfigAssets(ctx context.Context, assets []fleet.MDMConfigAsset) error {
 	s.mu.Lock()
 	s.InsertMDMConfigAssetsFuncInvoked = true
@@ -5350,6 +5633,132 @@ func (s *DataStore) DeleteMDMConfigAssetsByName(ctx context.Context, assetNames
 	return s.DeleteMDMConfigAssetsByNameFunc(ctx, assetNames)
 }
 
+func (s *DataStore) ReplaceMDMConfigAssets(ctx context.Context, assets []fleet.MDMConfigAsset) error {
+	s.mu.Lock()
+	s.ReplaceMDMConfigAssetsFuncInvoked = true
+	s.mu.Unlock()
+	return s.ReplaceMDMConfigAssetsFunc(ctx, assets)
+}
+
+func (s *DataStore) GetABMTokenByOrgName(ctx context.Context, orgName string) (*fleet.ABMToken, error) {
+	s.mu.Lock()
+	s.GetABMTokenByOrgNameFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetABMTokenByOrgNameFunc(ctx, orgName)
+}
+
+func (s *DataStore) SaveABMToken(ctx context.Context, tok *fleet.ABMToken) error {
+	s.mu.Lock()
+	s.SaveABMTokenFuncInvoked = true
+	s.mu.Unlock()
+	return s.SaveABMTokenFunc(ctx, tok)
+}
+
+func (s *DataStore) InsertVPPToken(ctx context.Context, tok *fleet.VPPTokenData) (*fleet.VPPTokenDB, error) {
+	s.mu.Lock()
+	s.InsertVPPTokenFuncInvoked = true
+	s.mu.Unlock()
+	return s.InsertVPPTokenFunc(ctx, tok)
+}
+
+func (s *DataStore) ListVPPTokens(ctx context.Context) ([]*fleet.VPPTokenDB, error) {
+	s.mu.Lock()
+	s.ListVPPTokensFuncInvoked = true
+	s.mu.Unlock()
+	return s.ListVPPTokensFunc(ctx)
+}
+
+func (s *DataStore) GetVPPToken(ctx context.Context, tokenID uint) (*fleet.VPPTokenDB, error) {
+	s.mu.Lock()
+	s.GetVPPTokenFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetVPPTokenFunc(ctx, tokenID)
+}
+
+func (s *DataStore) GetVPPTokenByTeamID(ctx context.Context, teamID *uint) (*fleet.VPPTokenDB, error) {
+	s.mu.Lock()
+	s.GetVPPTokenByTeamIDFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetVPPTokenByTeamIDFunc(ctx, teamID)
+}
+
+func (s *DataStore) UpdateVPPTokenTeams(ctx context.Context, id uint, teams []uint) (*fleet.VPPTokenDB, error) {
+	s.mu.Lock()
+	s.UpdateVPPTokenTeamsFuncInvoked = true
+	s.mu.Unlock()
+	return s.UpdateVPPTokenTeamsFunc(ctx, id, teams)
+}
+
+func (s *DataStore) UpdateVPPToken(ctx context.Context, id uint, tok *fleet.VPPTokenData) (*fleet.VPPTokenDB, error) {
+	s.mu.Lock()
+	s.UpdateVPPTokenFuncInvoked = true
+	s.mu.Unlock()
+	return s.UpdateVPPTokenFunc(ctx, id, tok)
+}
+
+func (s *DataStore) DeleteVPPToken(ctx context.Context, tokenID uint) error {
+	s.mu.Lock()
+	s.DeleteVPPTokenFuncInvoked = true
+	s.mu.Unlock()
+	return s.DeleteVPPTokenFunc(ctx, tokenID)
+}
+
+func (s *DataStore) SetABMTokenTermsExpiredForOrgName(ctx context.Context, orgName string, expired bool) (wasSet bool, err error) {
+	s.mu.Lock()
+	s.SetABMTokenTermsExpiredForOrgNameFuncInvoked = true
+	s.mu.Unlock()
+	return s.SetABMTokenTermsExpiredForOrgNameFunc(ctx, orgName, expired)
+}
+
+func (s *DataStore) CountABMTokensWithTermsExpired(ctx context.Context) (int, error) {
+	s.mu.Lock()
+	s.CountABMTokensWithTermsExpiredFuncInvoked = true
+	s.mu.Unlock()
+	return s.CountABMTokensWithTermsExpiredFunc(ctx)
+}
+
+func (s *DataStore) InsertABMToken(ctx context.Context, tok *fleet.ABMToken) (*fleet.ABMToken, error) {
+	s.mu.Lock()
+	s.InsertABMTokenFuncInvoked = true
+	s.mu.Unlock()
+	return s.InsertABMTokenFunc(ctx, tok)
+}
+
+func (s *DataStore) ListABMTokens(ctx context.Context) ([]*fleet.ABMToken, error) {
+	s.mu.Lock()
+	s.ListABMTokensFuncInvoked = true
+	s.mu.Unlock()
+	return s.ListABMTokensFunc(ctx)
+}
+
+func (s *DataStore) DeleteABMToken(ctx context.Context, tokenID uint) error {
+	s.mu.Lock()
+	s.DeleteABMTokenFuncInvoked = true
+	s.mu.Unlock()
+	return s.DeleteABMTokenFunc(ctx, tokenID)
+}
+
+func (s *DataStore) GetABMTokenByID(ctx context.Context, tokenID uint) (*fleet.ABMToken, error) {
+	s.mu.Lock()
+	s.GetABMTokenByIDFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetABMTokenByIDFunc(ctx, tokenID)
+}
+
+func (s *DataStore) GetABMTokenCount(ctx context.Context) (int, error) {
+	s.mu.Lock()
+	s.GetABMTokenCountFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetABMTokenCountFunc(ctx)
+}
+
+func (s *DataStore) GetABMTokenOrgNamesAssociatedWithTeam(ctx context.Context, teamID *uint) ([]string, error) {
+	s.mu.Lock()
+	s.GetABMTokenOrgNamesAssociatedWithTeamFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetABMTokenOrgNamesAssociatedWithTeamFunc(ctx, teamID)
+}
+
 func (s *DataStore) WSTEPStoreCertificate(ctx context.Context, name string, crt *x509.Certificate) error {
 	s.mu.Lock()
 	s.WSTEPStoreCertificateFuncInvoked = true
@@ -5567,7 +5976,7 @@ func (s *DataStore) SetOrUpdateMDMWindowsConfigProfile(ctx context.Context, cp f
 	return s.SetOrUpdateMDMWindowsConfigProfileFunc(ctx, cp)
 }
 
-func (s *DataStore) BatchSetMDMProfiles(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDeclarations []*fleet.MDMAppleDeclaration) error {
+func (s *DataStore) BatchSetMDMProfiles(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDeclarations []*fleet.MDMAppleDeclaration) (updates fleet.MDMProfilesUpdates, err error) {
 	s.mu.Lock()
 	s.BatchSetMDMProfilesFuncInvoked = true
 	s.mu.Unlock()
@@ -5756,6 +6165,13 @@ func (s *DataStore) ListPendingSoftwareInstalls(ctx context.Context, hostID uint
 	return s.ListPendingSoftwareInstallsFunc(ctx, hostID)
 }
 
+func (s *DataStore) GetHostLastInstallData(ctx context.Context, hostID uint, installerID uint) (*fleet.HostLastInstallData, error) {
+	s.mu.Lock()
+	s.GetHostLastInstallDataFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetHostLastInstallDataFunc(ctx, hostID, installerID)
+}
+
 func (s *DataStore) MatchOrCreateSoftwareInstaller(ctx context.Context, payload *fleet.UploadSoftwareInstallerPayload) (uint, error) {
 	s.mu.Lock()
 	s.MatchOrCreateSoftwareInstallerFuncInvoked = true
@@ -5777,6 +6193,20 @@ func (s *DataStore) GetSoftwareInstallerMetadataByTeamAndTitleID(ctx context.Con
 	return s.GetSoftwareInstallerMetadataByTeamAndTitleIDFunc(ctx, teamID, titleID, withScriptContents)
 }
 
+func (s *DataStore) GetVPPAppByTeamAndTitleID(ctx context.Context, teamID *uint, titleID uint) (*fleet.VPPApp, error) {
+	s.mu.Lock()
+	s.GetVPPAppByTeamAndTitleIDFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetVPPAppByTeamAndTitleIDFunc(ctx, teamID, titleID)
+}
+
+func (s *DataStore) GetVPPAppMetadataByTeamAndTitleID(ctx context.Context, teamID *uint, titleID uint) (*fleet.VPPAppStoreApp, error) {
+	s.mu.Lock()
+	s.GetVPPAppMetadataByTeamAndTitleIDFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetVPPAppMetadataByTeamAndTitleIDFunc(ctx, teamID, titleID)
+}
+
 func (s *DataStore) DeleteSoftwareInstaller(ctx context.Context, id uint) error {
 	s.mu.Lock()
 	s.DeleteSoftwareInstallerFuncInvoked = true
@@ -5784,6 +6214,13 @@ func (s *DataStore) DeleteSoftwareInstaller(ctx context.Context, id uint) error
 	return s.DeleteSoftwareInstallerFunc(ctx, id)
 }
 
+func (s *DataStore) DeleteVPPAppFromTeam(ctx context.Context, teamID *uint, appID fleet.VPPAppID) error {
+	s.mu.Lock()
+	s.DeleteVPPAppFromTeamFuncInvoked = true
+	s.mu.Unlock()
+	return s.DeleteVPPAppFromTeamFunc(ctx, teamID, appID)
+}
+
 func (s *DataStore) GetSummaryHostSoftwareInstalls(ctx context.Context, installerID uint) (*fleet.SoftwareInstallerStatusSummary, error) {
 	s.mu.Lock()
 	s.GetSummaryHostSoftwareInstallsFuncInvoked = true
@@ -5791,6 +6228,13 @@ func (s *DataStore) GetSummaryHostSoftwareInstalls(ctx context.Context, installe
 	return s.GetSummaryHostSoftwareInstallsFunc(ctx, installerID)
 }
 
+func (s *DataStore) GetSummaryHostVPPAppInstalls(ctx context.Context, teamID *uint, appID fleet.VPPAppID) (*fleet.VPPAppStatusSummary, error) {
+	s.mu.Lock()
+	s.GetSummaryHostVPPAppInstallsFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetSummaryHostVPPAppInstallsFunc(ctx, teamID, appID)
+}
+
 func (s *DataStore) GetSoftwareInstallResults(ctx context.Context, resultsUUID string) (*fleet.HostSoftwareInstallerResult, error) {
 	s.mu.Lock()
 	s.GetSoftwareInstallResultsFuncInvoked = true
@@ -5798,14 +6242,14 @@ func (s *DataStore) GetSoftwareInstallResults(ctx context.Context, resultsUUID s
 	return s.GetSoftwareInstallResultsFunc(ctx, resultsUUID)
 }
 
-func (s *DataStore) CleanupUnusedSoftwareInstallers(ctx context.Context, softwareInstallStore fleet.SoftwareInstallerStore) error {
+func (s *DataStore) CleanupUnusedSoftwareInstallers(ctx context.Context, softwareInstallStore fleet.SoftwareInstallerStore, removeCreatedBefore time.Time) error {
 	s.mu.Lock()
 	s.CleanupUnusedSoftwareInstallersFuncInvoked = true
 	s.mu.Unlock()
-	return s.CleanupUnusedSoftwareInstallersFunc(ctx, softwareInstallStore)
+	return s.CleanupUnusedSoftwareInstallersFunc(ctx, softwareInstallStore, removeCreatedBefore)
 }
 
-func (s *DataStore) BatchSetSoftwareInstallers(ctx context.Context, tmID *uint, installers []*fleet.UploadSoftwareInstallerPayload) error {
+func (s *DataStore) BatchSetSoftwareInstallers(ctx context.Context, tmID *uint, installers []*fleet.UploadSoftwareInstallerPayload) ([]fleet.SoftwareInstaller, error) {
 	s.mu.Lock()
 	s.BatchSetSoftwareInstallersFuncInvoked = true
 	s.mu.Unlock()
@@ -5818,3 +6262,52 @@ func (s *DataStore) HasSelfServiceSoftwareInstallers(ctx context.Context, platfo
 	s.mu.Unlock()
 	return s.HasSelfServiceSoftwareInstallersFunc(ctx, platform, teamID)
 }
+
+func (s *DataStore) BatchInsertVPPApps(ctx context.Context, apps []*fleet.VPPApp) error {
+	s.mu.Lock()
+	s.BatchInsertVPPAppsFuncInvoked = true
+	s.mu.Unlock()
+	return s.BatchInsertVPPAppsFunc(ctx, apps)
+}
+
+func (s *DataStore) GetAssignedVPPApps(ctx context.Context, teamID *uint) (map[fleet.VPPAppID]fleet.VPPAppTeam, error) {
+	s.mu.Lock()
+	s.GetAssignedVPPAppsFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetAssignedVPPAppsFunc(ctx, teamID)
+}
+
+func (s *DataStore) SetTeamVPPApps(ctx context.Context, teamID *uint, appIDs []fleet.VPPAppTeam) error {
+	s.mu.Lock()
+	s.SetTeamVPPAppsFuncInvoked = true
+	s.mu.Unlock()
+	return s.SetTeamVPPAppsFunc(ctx, teamID, appIDs)
+}
+
+func (s *DataStore) InsertVPPAppWithTeam(ctx context.Context, app *fleet.VPPApp, teamID *uint) (*fleet.VPPApp, error) {
+	s.mu.Lock()
+	s.InsertVPPAppWithTeamFuncInvoked = true
+	s.mu.Unlock()
+	return s.InsertVPPAppWithTeamFunc(ctx, app, teamID)
+}
+
+func (s *DataStore) InsertHostVPPSoftwareInstall(ctx context.Context, hostID uint, appID fleet.VPPAppID, commandUUID string, associatedEventID string, selfService bool) error {
+	s.mu.Lock()
+	s.InsertHostVPPSoftwareInstallFuncInvoked = true
+	s.mu.Unlock()
+	return s.InsertHostVPPSoftwareInstallFunc(ctx, hostID, appID, commandUUID, associatedEventID, selfService)
+}
+
+func (s *DataStore) GetPastActivityDataForVPPAppInstall(ctx context.Context, commandResults *mdm.CommandResults) (*fleet.User, *fleet.ActivityInstalledAppStoreApp, error) {
+	s.mu.Lock()
+	s.GetPastActivityDataForVPPAppInstallFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetPastActivityDataForVPPAppInstallFunc(ctx, commandResults)
+}
+
+func (s *DataStore) GetVPPTokenByLocation(ctx context.Context, loc string) (*fleet.VPPTokenDB, error) {
+	s.mu.Lock()
+	s.GetVPPTokenByLocationFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetVPPTokenByLocationFunc(ctx, loc)
+}
diff --git a/server/mock/mdm/datastore_mdm_mock.go b/server/mock/mdm/datastore_mdm_mock.go
index 05d9db687d3c..78141b25253f 100644
--- a/server/mock/mdm/datastore_mdm_mock.go
+++ b/server/mock/mdm/datastore_mdm_mock.go
@@ -56,6 +56,8 @@ type RetrieveTokenUpdateTallyFunc func(ctx context.Context, id string) (int, err
 
 type GetAllMDMConfigAssetsByNameFunc func(ctx context.Context, assetNames []fleet.MDMAssetName) (map[fleet.MDMAssetName]fleet.MDMConfigAsset, error)
 
+type GetABMTokenByOrgNameFunc func(ctx context.Context, orgName string) (*fleet.ABMToken, error)
+
 type EnqueueDeviceLockCommandFunc func(ctx context.Context, host *fleet.Host, cmd *mdm.Command, pin string) error
 
 type EnqueueDeviceWipeCommandFunc func(ctx context.Context, host *fleet.Host, cmd *mdm.Command) error
@@ -124,6 +126,9 @@ type MDMAppleStore struct {
 	GetAllMDMConfigAssetsByNameFunc        GetAllMDMConfigAssetsByNameFunc
 	GetAllMDMConfigAssetsByNameFuncInvoked bool
 
+	GetABMTokenByOrgNameFunc        GetABMTokenByOrgNameFunc
+	GetABMTokenByOrgNameFuncInvoked bool
+
 	EnqueueDeviceLockCommandFunc        EnqueueDeviceLockCommandFunc
 	EnqueueDeviceLockCommandFuncInvoked bool
 
@@ -280,6 +285,13 @@ func (fs *MDMAppleStore) GetAllMDMConfigAssetsByName(ctx context.Context, assetN
 	return fs.GetAllMDMConfigAssetsByNameFunc(ctx, assetNames)
 }
 
+func (fs *MDMAppleStore) GetABMTokenByOrgName(ctx context.Context, orgName string) (*fleet.ABMToken, error) {
+	fs.mu.Lock()
+	fs.GetABMTokenByOrgNameFuncInvoked = true
+	fs.mu.Unlock()
+	return fs.GetABMTokenByOrgNameFunc(ctx, orgName)
+}
+
 func (fs *MDMAppleStore) EnqueueDeviceLockCommand(ctx context.Context, host *fleet.Host, cmd *mdm.Command, pin string) error {
 	fs.mu.Lock()
 	fs.EnqueueDeviceLockCommandFuncInvoked = true
diff --git a/server/service/activities.go b/server/service/activities.go
index cdab1837f1a2..861c87309520 100644
--- a/server/service/activities.go
+++ b/server/service/activities.go
@@ -85,7 +85,12 @@ func newActivity(ctx context.Context, user *fleet.User, activity fleet.ActivityD
 		var userName *string
 		var userEmail *string
 		if user != nil {
-			userID = &user.ID
+			// To support creating activities with users that were deleted. This can happen
+			// for automatically installed software which uses the author of the upload as the author of
+			// the installation.
+			if user.ID != 0 {
+				userID = &user.ID
+			}
 			userName = &user.Name
 			userEmail = &user.Email
 		}
diff --git a/server/service/appconfig.go b/server/service/appconfig.go
index f05d861edade..236564eff0c1 100644
--- a/server/service/appconfig.go
+++ b/server/service/appconfig.go
@@ -25,6 +25,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/version"
 	"github.com/go-kit/log/level"
+	"golang.org/x/text/unicode/norm"
 )
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -413,6 +414,16 @@ func (svc *Service) ModifyAppConfig(ctx context.Context, p []byte, applyOpts fle
 		return nil, ctxerr.Wrap(ctx, err, "validating MDM config")
 	}
 
+	abmAssignments, err := svc.validateABMAssignments(ctx, &newAppConfig.MDM, &oldAppConfig.MDM, invalid, license)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "validating ABM token assignments")
+	}
+
+	vppAssignments, err := svc.validateVPPAssignments(ctx, &newAppConfig.MDM, invalid, license)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "validating VPP token assignments")
+	}
+
 	if invalid.HasErrors() {
 		return nil, ctxerr.Wrap(ctx, invalid)
 	}
@@ -534,6 +545,23 @@ func (svc *Service) ModifyAppConfig(ctx context.Context, p []byte, applyOpts fle
 		}
 	}
 
+	if (appConfig.MDM.AppleBusinessManager.Set && appConfig.MDM.AppleBusinessManager.Valid) || appConfig.MDM.DeprecatedAppleBMDefaultTeam != "" {
+		for _, tok := range abmAssignments {
+			fmt.Println(tok.EncryptedToken)
+			if err := svc.ds.SaveABMToken(ctx, tok); err != nil {
+				return nil, ctxerr.Wrap(ctx, err, "saving ABM token assignments")
+			}
+		}
+	}
+
+	if appConfig.MDM.VolumePurchasingProgram.Set && appConfig.MDM.VolumePurchasingProgram.Valid {
+		for tokenID, tokenTeams := range vppAssignments {
+			if _, err := svc.ds.UpdateVPPTokenTeams(ctx, tokenID, tokenTeams); err != nil {
+				return nil, ctxerr.Wrap(ctx, err, "saving ABM token assignments")
+			}
+		}
+	}
+
 	// retrieve new app config with obfuscated secrets
 	obfuscatedAppConfig, err := svc.ds.AppConfig(ctx)
 	if err != nil {
@@ -558,27 +586,26 @@ func (svc *Service) ModifyAppConfig(ctx context.Context, p []byte, applyOpts fle
 		}
 	}
 
-	// if the macOS minimum version requirement changed, create the corresponding
-	// activity
-	if oldAppConfig.MDM.MacOSUpdates.MinimumVersion.Value != appConfig.MDM.MacOSUpdates.MinimumVersion.Value ||
-		oldAppConfig.MDM.MacOSUpdates.Deadline.Value != appConfig.MDM.MacOSUpdates.Deadline.Value {
-		if license.IsPremium() {
-			// macOS updates are premium feature
-			if err := svc.EnterpriseOverrides.MDMAppleEditedMacOSUpdates(ctx, nil, appConfig.MDM.MacOSUpdates); err != nil {
-				return nil, ctxerr.Wrap(ctx, err, "update DDM profile after macOS updates change")
-			}
-		}
-
-		if err := svc.NewActivity(
-			ctx,
-			authz.UserFromContext(ctx),
-			fleet.ActivityTypeEditedMacOSMinVersion{
-				MinimumVersion: appConfig.MDM.MacOSUpdates.MinimumVersion.Value,
-				Deadline:       appConfig.MDM.MacOSUpdates.Deadline.Value,
-			},
-		); err != nil {
-			return nil, ctxerr.Wrap(ctx, err, "create activity for app config macos min version modification")
-		}
+	//
+	// Process OS updates config changes for Apple devices.
+	//
+	if err := svc.processAppleOSUpdateSettings(ctx, license, fleet.MacOS,
+		oldAppConfig.MDM.MacOSUpdates,
+		appConfig.MDM.MacOSUpdates,
+	); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "process macOS OS updates config change")
+	}
+	if err := svc.processAppleOSUpdateSettings(ctx, license, fleet.IOS,
+		oldAppConfig.MDM.IOSUpdates,
+		appConfig.MDM.IOSUpdates,
+	); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "process iOS OS updates config change")
+	}
+	if err := svc.processAppleOSUpdateSettings(ctx, license, fleet.IPadOS,
+		oldAppConfig.MDM.IPadOSUpdates,
+		appConfig.MDM.IPadOSUpdates,
+	); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "process iPadOS OS updates config change")
 	}
 
 	// if the Windows updates requirements changed, create the corresponding
@@ -670,6 +697,47 @@ func (svc *Service) ModifyAppConfig(ctx context.Context, p []byte, applyOpts fle
 	return obfuscatedAppConfig, nil
 }
 
+// processAppleOSUpdateSettings updates the OS updates configuration if the minimum version+deadline are updated.
+func (svc *Service) processAppleOSUpdateSettings(
+	ctx context.Context,
+	license *fleet.LicenseInfo,
+	appleDevice fleet.AppleDevice,
+	oldOSUpdateSettings fleet.AppleOSUpdateSettings,
+	newOSUpdateSettings fleet.AppleOSUpdateSettings,
+) error {
+	if oldOSUpdateSettings.MinimumVersion.Value != newOSUpdateSettings.MinimumVersion.Value ||
+		oldOSUpdateSettings.Deadline.Value != newOSUpdateSettings.Deadline.Value {
+		if license.IsPremium() {
+			if err := svc.EnterpriseOverrides.MDMAppleEditedAppleOSUpdates(ctx, nil, appleDevice, newOSUpdateSettings); err != nil {
+				return ctxerr.Wrap(ctx, err, "update DDM profile after Apple OS updates change")
+			}
+		}
+
+		var activity fleet.ActivityDetails
+		switch appleDevice {
+		case fleet.MacOS:
+			activity = fleet.ActivityTypeEditedMacOSMinVersion{
+				MinimumVersion: newOSUpdateSettings.MinimumVersion.Value,
+				Deadline:       newOSUpdateSettings.Deadline.Value,
+			}
+		case fleet.IOS:
+			activity = fleet.ActivityTypeEditedIOSMinVersion{
+				MinimumVersion: newOSUpdateSettings.MinimumVersion.Value,
+				Deadline:       newOSUpdateSettings.Deadline.Value,
+			}
+		case fleet.IPadOS:
+			activity = fleet.ActivityTypeEditedIPadOSMinVersion{
+				MinimumVersion: newOSUpdateSettings.MinimumVersion.Value,
+				Deadline:       newOSUpdateSettings.Deadline.Value,
+			}
+		}
+		if err := svc.NewActivity(ctx, authz.UserFromContext(ctx), activity); err != nil {
+			return ctxerr.Wrap(ctx, err, "create activity for app config apple min version modification")
+		}
+	}
+	return nil
+}
+
 func (svc *Service) HasCustomSetupAssistantConfigurationWebURL(ctx context.Context, teamID *uint) (bool, error) {
 	az, ok := authz_ctx.FromContext(ctx)
 	if !ok || !az.Checked() {
@@ -773,23 +841,25 @@ func (svc *Service) validateMDM(
 	}
 	checkCustomSettings("windows", mdm.WindowsSettings.CustomSettings.Value)
 
-	if name := mdm.AppleBMDefaultTeam; name != "" && name != oldMdm.AppleBMDefaultTeam {
-		if !license.IsPremium() {
-			invalid.Append("mdm.apple_bm_default_team", ErrMissingLicense.Error())
-			return nil
-		}
-		if _, err := svc.ds.TeamByName(ctx, name); err != nil {
-			invalid.Append("apple_bm_default_team", "team name not found")
-		}
-	}
-
 	// MacOSUpdates
-	updatingVersion := mdm.MacOSUpdates.MinimumVersion.Value != "" &&
+	updatingMacOSVersion := mdm.MacOSUpdates.MinimumVersion.Value != "" &&
 		mdm.MacOSUpdates.MinimumVersion != oldMdm.MacOSUpdates.MinimumVersion
-	updatingDeadline := mdm.MacOSUpdates.Deadline.Value != "" &&
+	updatingMacOSDeadline := mdm.MacOSUpdates.Deadline.Value != "" &&
 		mdm.MacOSUpdates.Deadline != oldMdm.MacOSUpdates.Deadline
-
-	if updatingVersion || updatingDeadline {
+	// IOSUpdates
+	updatingIOSVersion := mdm.IOSUpdates.MinimumVersion.Value != "" &&
+		mdm.IOSUpdates.MinimumVersion != oldMdm.IOSUpdates.MinimumVersion
+	updatingIOSDeadline := mdm.IOSUpdates.Deadline.Value != "" &&
+		mdm.IOSUpdates.Deadline != oldMdm.IOSUpdates.Deadline
+	// IPadOSUpdates
+	updatingIPadOSVersion := mdm.IPadOSUpdates.MinimumVersion.Value != "" &&
+		mdm.IPadOSUpdates.MinimumVersion != oldMdm.IPadOSUpdates.MinimumVersion
+	updatingIPadOSDeadline := mdm.IPadOSUpdates.Deadline.Value != "" &&
+		mdm.IPadOSUpdates.Deadline != oldMdm.IPadOSUpdates.Deadline
+
+	if updatingMacOSVersion || updatingMacOSDeadline ||
+		updatingIOSVersion || updatingIOSDeadline ||
+		updatingIPadOSVersion || updatingIPadOSDeadline {
 		// TODO: Should we validate MDM configured on here too?
 
 		if !license.IsPremium() {
@@ -800,6 +870,12 @@ func (svc *Service) validateMDM(
 	if err := mdm.MacOSUpdates.Validate(); err != nil {
 		invalid.Append("macos_updates", err.Error())
 	}
+	if err := mdm.IOSUpdates.Validate(); err != nil {
+		invalid.Append("ios_updates", err.Error())
+	}
+	if err := mdm.IPadOSUpdates.Validate(); err != nil {
+		invalid.Append("ipados_updates", err.Error())
+	}
 
 	// WindowsUpdates
 	updatingWindowsUpdates := !mdm.WindowsUpdates.Equal(oldMdm.WindowsUpdates)
@@ -889,6 +965,182 @@ func (svc *Service) validateMDM(
 	return nil
 }
 
+func (svc *Service) validateABMAssignments(
+	ctx context.Context,
+	mdm, oldMdm *fleet.MDM,
+	invalid *fleet.InvalidArgumentError,
+	license *fleet.LicenseInfo,
+) ([]*fleet.ABMToken, error) {
+	if mdm.DeprecatedAppleBMDefaultTeam != "" && mdm.AppleBusinessManager.Set && mdm.AppleBusinessManager.Valid {
+		invalid.Append("mdm.apple_bm_default_team", fleet.AppleABMDefaultTeamDeprecatedMessage)
+		return nil, nil
+	}
+
+	if name := mdm.DeprecatedAppleBMDefaultTeam; name != "" && name != oldMdm.DeprecatedAppleBMDefaultTeam {
+		if !license.IsPremium() {
+			invalid.Append("mdm.apple_bm_default_team", ErrMissingLicense.Error())
+			return nil, nil
+		}
+		team, err := svc.ds.TeamByName(ctx, name)
+		if err != nil {
+			invalid.Append("mdm.apple_bm_default_team", "team name not found")
+			return nil, nil
+		}
+		tokens, err := svc.ds.ListABMTokens(ctx)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(tokens) > 1 {
+			invalid.Append("mdm.apple_bm_default_team", fleet.AppleABMDefaultTeamDeprecatedMessage)
+			return nil, nil
+		}
+
+		if len(tokens) == 0 {
+			invalid.Append("mdm.apple_bm_default_team", "no ABM tokens found")
+			return nil, nil
+		}
+
+		tok := tokens[0]
+		tok.MacOSDefaultTeamID = &team.ID
+		tok.IOSDefaultTeamID = &team.ID
+		tok.IPadOSDefaultTeamID = &team.ID
+
+		return []*fleet.ABMToken{tok}, nil
+	}
+
+	if mdm.AppleBusinessManager.Set && mdm.AppleBusinessManager.Valid {
+		if !license.IsPremium() {
+			invalid.Append("mdm.apple_business_manager", ErrMissingLicense.Error())
+			return nil, nil
+		}
+
+		teams, err := svc.ds.TeamsSummary(ctx)
+		if err != nil {
+			return nil, err
+		}
+		teamsByName := map[string]*uint{"": nil, "No team": nil}
+		for _, tm := range teams {
+			teamsByName[tm.Name] = &tm.ID
+		}
+		tokens, err := svc.ds.ListABMTokens(ctx)
+		if err != nil {
+			return nil, err
+		}
+		tokensByName := map[string]*fleet.ABMToken{}
+		for _, token := range tokens {
+			// The default assignments for all tokens is "no team"
+			// (ie: team_id IS NULL), here we reset the assignments
+			// for all tokens, those will be re-added below.
+			//
+			// This ensures any unassignments are properly handled.
+			token.MacOSDefaultTeamID = nil
+			token.IOSDefaultTeamID = nil
+			token.IPadOSDefaultTeamID = nil
+			tokensByName[token.OrganizationName] = token
+		}
+
+		var tokensToSave []*fleet.ABMToken
+		for _, bm := range mdm.AppleBusinessManager.Value {
+			for _, tmName := range []string{bm.MacOSTeam, bm.IOSTeam, bm.IpadOSTeam} {
+				if _, ok := teamsByName[norm.NFC.String(tmName)]; !ok {
+					invalid.Appendf("mdm.apple_business_manager", "team %s doesn't exist", tmName)
+					return nil, nil
+				}
+			}
+
+			if _, ok := tokensByName[norm.NFC.String(bm.OrganizationName)]; !ok {
+				invalid.Appendf("mdm.apple_business_manager", "token with organization name %s doesn't exist", bm.OrganizationName)
+				return nil, nil
+			}
+
+			tok := tokensByName[bm.OrganizationName]
+			tok.MacOSDefaultTeamID = teamsByName[bm.MacOSTeam]
+			tok.IOSDefaultTeamID = teamsByName[bm.IOSTeam]
+			tok.IPadOSDefaultTeamID = teamsByName[bm.IpadOSTeam]
+			tokensToSave = append(tokensToSave, tok)
+		}
+
+		return tokensToSave, nil
+	}
+
+	return nil, nil
+}
+
+func (svc *Service) validateVPPAssignments(
+	ctx context.Context,
+	mdm *fleet.MDM,
+	invalid *fleet.InvalidArgumentError,
+	license *fleet.LicenseInfo,
+) (map[uint][]uint, error) {
+	if mdm.VolumePurchasingProgram.Set && mdm.VolumePurchasingProgram.Valid {
+		if !license.IsPremium() {
+			invalid.Append("mdm.volume_purchasing_program", ErrMissingLicense.Error())
+			return nil, nil
+		}
+
+		teams, err := svc.ds.TeamsSummary(ctx)
+		if err != nil {
+			return nil, err
+		}
+		teamsByName := map[string]uint{fleet.TeamNameNoTeam: 0}
+		for _, tm := range teams {
+			teamsByName[tm.Name] = tm.ID
+		}
+		tokens, err := svc.ds.ListVPPTokens(ctx)
+		if err != nil {
+			return nil, err
+		}
+		tokensByLocation := map[string]*fleet.VPPTokenDB{}
+		for _, token := range tokens {
+			// The default assignments for all tokens is "no team"
+			// (ie: team_id IS NULL), here we reset the assignments
+			// for all tokens, those will be re-added below.
+			//
+			// This ensures any unassignments are properly handled.
+			tokensByLocation[token.Location] = token
+			token.Teams = nil
+		}
+
+		tokensToSave := make(map[uint][]uint, len(mdm.VolumePurchasingProgram.Value))
+		for _, vpp := range mdm.VolumePurchasingProgram.Value {
+			for _, tmName := range vpp.Teams {
+				if _, ok := teamsByName[norm.NFC.String(tmName)]; !ok && tmName != fleet.TeamNameAllTeams {
+					invalid.Appendf("mdm.volume_purchasing_program", "team %s doesn't exist", tmName)
+					return nil, nil
+				}
+			}
+
+			loc := norm.NFC.String(vpp.Location)
+			if _, ok := tokensByLocation[loc]; !ok {
+				invalid.Appendf("mdm.volume_purchasing_program", "token with location %s doesn't exist", vpp.Location)
+				return nil, nil
+			}
+
+			var tokenTeams []uint
+			for _, teamName := range vpp.Teams {
+				if teamName == fleet.TeamNameAllTeams {
+					if len(vpp.Teams) > 1 {
+						invalid.Appendf("mdm.volume_purchasing_program", "token cannot belong to %s and other teams", fleet.TeamNameAllTeams)
+						return nil, nil
+					}
+					tokenTeams = []uint{}
+					break
+				}
+				teamID := teamsByName[teamName]
+				tokenTeams = append(tokenTeams, teamID)
+			}
+
+			tok := tokensByLocation[loc]
+			tokensToSave[tok.ID] = tokenTeams
+		}
+
+		return tokensToSave, nil
+	}
+
+	return nil, nil
+}
+
 func validateSSOProviderSettings(incoming, existing fleet.SSOProviderSettings, invalid *fleet.InvalidArgumentError) {
 	if incoming.Metadata == "" && incoming.MetadataURL == "" {
 		if existing.Metadata == "" && existing.MetadataURL == "" {
diff --git a/server/service/appconfig_test.go b/server/service/appconfig_test.go
index 99f356d459f8..0fb0d318d26f 100644
--- a/server/service/appconfig_test.go
+++ b/server/service/appconfig_test.go
@@ -858,9 +858,13 @@ func TestMDMAppleConfig(t *testing.T) {
 			name:        "nochange",
 			licenseTier: "free",
 			expectedMDM: fleet.MDM{
-				MacOSSetup:     fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
-				MacOSUpdates:   fleet.MacOSUpdates{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				WindowsUpdates: fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
+				AppleBusinessManager:    optjson.Slice[fleet.MDMAppleABMAssignmentInfo]{Set: true, Value: []fleet.MDMAppleABMAssignmentInfo{}},
+				MacOSSetup:              fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
+				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				VolumePurchasingProgram: optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
+				WindowsUpdates:          fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{
 					CustomSettings: optjson.Slice[fleet.MDMProfileSpec]{Set: true, Value: []fleet.MDMProfileSpec{}},
 				},
@@ -868,29 +872,33 @@ func TestMDMAppleConfig(t *testing.T) {
 		}, {
 			name:          "newDefaultTeamNoLicense",
 			licenseTier:   "free",
-			newMDM:        fleet.MDM{AppleBMDefaultTeam: "foobar"},
+			newMDM:        fleet.MDM{DeprecatedAppleBMDefaultTeam: "foobar"},
 			expectedError: licenseErr,
 		}, {
 			name:          "notFoundNew",
 			licenseTier:   "premium",
-			newMDM:        fleet.MDM{AppleBMDefaultTeam: "foobar"},
+			newMDM:        fleet.MDM{DeprecatedAppleBMDefaultTeam: "foobar"},
 			expectedError: notFoundErr,
 		}, {
 			name:          "notFoundEdit",
 			licenseTier:   "premium",
-			oldMDM:        fleet.MDM{AppleBMDefaultTeam: "foobar"},
-			newMDM:        fleet.MDM{AppleBMDefaultTeam: "bar"},
+			oldMDM:        fleet.MDM{DeprecatedAppleBMDefaultTeam: "foobar"},
+			newMDM:        fleet.MDM{DeprecatedAppleBMDefaultTeam: "bar"},
 			expectedError: notFoundErr,
 		}, {
 			name:        "foundNew",
 			licenseTier: "premium",
 			findTeam:    true,
-			newMDM:      fleet.MDM{AppleBMDefaultTeam: "foobar"},
+			newMDM:      fleet.MDM{DeprecatedAppleBMDefaultTeam: "foobar"},
 			expectedMDM: fleet.MDM{
-				AppleBMDefaultTeam: "foobar",
-				MacOSSetup:         fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
-				MacOSUpdates:       fleet.MacOSUpdates{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				WindowsUpdates:     fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
+				AppleBusinessManager:         optjson.Slice[fleet.MDMAppleABMAssignmentInfo]{Set: true, Value: []fleet.MDMAppleABMAssignmentInfo{}},
+				DeprecatedAppleBMDefaultTeam: "foobar",
+				MacOSSetup:                   fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
+				MacOSUpdates:                 fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IOSUpdates:                   fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IPadOSUpdates:                fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				VolumePurchasingProgram:      optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
+				WindowsUpdates:               fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{
 					CustomSettings: optjson.Slice[fleet.MDMProfileSpec]{Set: true, Value: []fleet.MDMProfileSpec{}},
 				},
@@ -899,13 +907,17 @@ func TestMDMAppleConfig(t *testing.T) {
 			name:        "foundEdit",
 			licenseTier: "premium",
 			findTeam:    true,
-			oldMDM:      fleet.MDM{AppleBMDefaultTeam: "bar"},
-			newMDM:      fleet.MDM{AppleBMDefaultTeam: "foobar"},
+			oldMDM:      fleet.MDM{DeprecatedAppleBMDefaultTeam: "bar"},
+			newMDM:      fleet.MDM{DeprecatedAppleBMDefaultTeam: "foobar"},
 			expectedMDM: fleet.MDM{
-				AppleBMDefaultTeam: "foobar",
-				MacOSSetup:         fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
-				MacOSUpdates:       fleet.MacOSUpdates{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				WindowsUpdates:     fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
+				AppleBusinessManager:         optjson.Slice[fleet.MDMAppleABMAssignmentInfo]{Set: true, Value: []fleet.MDMAppleABMAssignmentInfo{}},
+				DeprecatedAppleBMDefaultTeam: "foobar",
+				MacOSSetup:                   fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
+				MacOSUpdates:                 fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IOSUpdates:                   fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IPadOSUpdates:                fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				VolumePurchasingProgram:      optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
+				WindowsUpdates:               fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{
 					CustomSettings: optjson.Slice[fleet.MDMProfileSpec]{Set: true, Value: []fleet.MDMProfileSpec{}},
 				},
@@ -923,10 +935,14 @@ func TestMDMAppleConfig(t *testing.T) {
 			newMDM:      fleet.MDM{EndUserAuthentication: fleet.MDMEndUserAuthentication{SSOProviderSettings: fleet.SSOProviderSettings{EntityID: "foo"}}},
 			oldMDM:      fleet.MDM{EndUserAuthentication: fleet.MDMEndUserAuthentication{SSOProviderSettings: fleet.SSOProviderSettings{EntityID: "foo"}}},
 			expectedMDM: fleet.MDM{
-				EndUserAuthentication: fleet.MDMEndUserAuthentication{SSOProviderSettings: fleet.SSOProviderSettings{EntityID: "foo"}},
-				MacOSSetup:            fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
-				MacOSUpdates:          fleet.MacOSUpdates{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				WindowsUpdates:        fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
+				AppleBusinessManager:    optjson.Slice[fleet.MDMAppleABMAssignmentInfo]{Set: true, Value: []fleet.MDMAppleABMAssignmentInfo{}},
+				EndUserAuthentication:   fleet.MDMEndUserAuthentication{SSOProviderSettings: fleet.SSOProviderSettings{EntityID: "foo"}},
+				MacOSSetup:              fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
+				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				VolumePurchasingProgram: optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
+				WindowsUpdates:          fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{
 					CustomSettings: optjson.Slice[fleet.MDMProfileSpec]{Set: true, Value: []fleet.MDMProfileSpec{}},
 				},
@@ -942,15 +958,19 @@ func TestMDMAppleConfig(t *testing.T) {
 				IDPName:     "onelogin",
 			}}},
 			expectedMDM: fleet.MDM{
+				AppleBusinessManager: optjson.Slice[fleet.MDMAppleABMAssignmentInfo]{Set: true, Value: []fleet.MDMAppleABMAssignmentInfo{}},
 				EndUserAuthentication: fleet.MDMEndUserAuthentication{SSOProviderSettings: fleet.SSOProviderSettings{
 					EntityID:    "fleet",
 					IssuerURI:   "http://issuer.idp.com",
 					MetadataURL: "http://isser.metadata.com",
 					IDPName:     "onelogin",
 				}},
-				MacOSSetup:     fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
-				MacOSUpdates:   fleet.MacOSUpdates{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				WindowsUpdates: fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
+				MacOSSetup:              fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
+				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				VolumePurchasingProgram: optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
+				WindowsUpdates:          fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{
 					CustomSettings: optjson.Slice[fleet.MDMProfileSpec]{Set: true, Value: []fleet.MDMProfileSpec{}},
 				},
@@ -1005,10 +1025,14 @@ func TestMDMAppleConfig(t *testing.T) {
 				EnableDiskEncryption: optjson.SetBool(false),
 			},
 			expectedMDM: fleet.MDM{
-				EnableDiskEncryption: optjson.Bool{Set: true, Valid: true, Value: false},
-				MacOSSetup:           fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
-				MacOSUpdates:         fleet.MacOSUpdates{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				WindowsUpdates:       fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
+				AppleBusinessManager:    optjson.Slice[fleet.MDMAppleABMAssignmentInfo]{Set: true, Value: []fleet.MDMAppleABMAssignmentInfo{}},
+				EnableDiskEncryption:    optjson.Bool{Set: true, Valid: true, Value: false},
+				MacOSSetup:              fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
+				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				VolumePurchasingProgram: optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
+				WindowsUpdates:          fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{
 					CustomSettings: optjson.Slice[fleet.MDMProfileSpec]{Set: true, Value: []fleet.MDMProfileSpec{}},
 				},
@@ -1051,6 +1075,12 @@ func TestMDMAppleConfig(t *testing.T) {
 			ds.NewJobFunc = func(ctx context.Context, job *fleet.Job) (*fleet.Job, error) {
 				return job, nil
 			}
+			ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+				return []*fleet.ABMToken{{ID: 1}}, nil
+			}
+			ds.SaveABMTokenFunc = func(ctx context.Context, token *fleet.ABMToken) error {
+				return nil
+			}
 			depStorage.RetrieveConfigFunc = func(p0 context.Context, p1 string) (*nanodep_client.Config, error) {
 				return &nanodep_client.Config{BaseURL: depSrv.URL}, nil
 			}
diff --git a/server/service/apple_mdm.go b/server/service/apple_mdm.go
index e8db6fe3313d..3072cd710cd6 100644
--- a/server/service/apple_mdm.go
+++ b/server/service/apple_mdm.go
@@ -31,11 +31,11 @@ import (
 	mdm_types "github.com/fleetdm/fleet/v4/server/mdm"
 	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
 	"github.com/fleetdm/fleet/v4/server/mdm/apple/appmanifest"
+	"github.com/fleetdm/fleet/v4/server/mdm/apple/gdmf"
 	"github.com/fleetdm/fleet/v4/server/mdm/apple/mobileconfig"
 	"github.com/fleetdm/fleet/v4/server/mdm/assets"
 	mdmcrypto "github.com/fleetdm/fleet/v4/server/mdm/crypto"
 	mdmlifecycle "github.com/fleetdm/fleet/v4/server/mdm/lifecycle"
-	"github.com/fleetdm/fleet/v4/server/mdm/nanodep/godep"
 	"github.com/fleetdm/fleet/v4/server/mdm/nanomdm/cryptoutil"
 	"github.com/fleetdm/fleet/v4/server/mdm/nanomdm/mdm"
 	nano_service "github.com/fleetdm/fleet/v4/server/mdm/nanomdm/service"
@@ -380,7 +380,7 @@ func (svc *Service) NewMDMAppleConfigProfile(ctx context.Context, teamID uint, r
 		}
 		return nil, ctxerr.Wrap(ctx, err)
 	}
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{newCP.ProfileUUID}, nil); err != nil {
+	if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{newCP.ProfileUUID}, nil); err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 	}
 
@@ -470,7 +470,7 @@ func (svc *Service) NewMDMAppleDeclaration(ctx context.Context, teamID uint, r i
 		return nil, err
 	}
 
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl.DeclarationUUID}, nil); err != nil {
+	if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl.DeclarationUUID}, nil); err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "bulk set pending host declarations")
 	}
 
@@ -773,7 +773,7 @@ func (svc *Service) DeleteMDMAppleConfigProfile(ctx context.Context, profileUUID
 		return ctxerr.Wrap(ctx, err)
 	}
 	// cannot use the profile ID as it is now deleted
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{teamID}, nil, nil); err != nil {
+	if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{teamID}, nil, nil); err != nil {
 		return ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 	}
 
@@ -853,7 +853,7 @@ func (svc *Service) DeleteMDMAppleDeclaration(ctx context.Context, declUUID stri
 		return ctxerr.Wrap(ctx, err)
 	}
 
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{teamID}, nil, nil); err != nil {
+	if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{teamID}, nil, nil); err != nil {
 		return ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 	}
 
@@ -1154,45 +1154,6 @@ func (svc *Service) ListMDMAppleDevices(ctx context.Context) ([]fleet.MDMAppleDe
 	return svc.ds.MDMAppleListDevices(ctx)
 }
 
-type listMDMAppleDEPDevicesRequest struct{}
-
-type listMDMAppleDEPDevicesResponse struct {
-	Devices []fleet.MDMAppleDEPDevice `json:"devices"`
-	Err     error                     `json:"error,omitempty"`
-}
-
-func (r listMDMAppleDEPDevicesResponse) error() error { return r.Err }
-
-func listMDMAppleDEPDevicesEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
-	devices, err := svc.ListMDMAppleDEPDevices(ctx)
-	if err != nil {
-		return listMDMAppleDEPDevicesResponse{Err: err}, nil
-	}
-	return &listMDMAppleDEPDevicesResponse{
-		Devices: devices,
-	}, nil
-}
-
-func (svc *Service) ListMDMAppleDEPDevices(ctx context.Context) ([]fleet.MDMAppleDEPDevice, error) {
-	if err := svc.authz.Authorize(ctx, &fleet.MDMAppleDEPDevice{}, fleet.ActionWrite); err != nil {
-		return nil, ctxerr.Wrap(ctx, err)
-	}
-	depClient := apple_mdm.NewDEPClient(svc.depStorage, svc.ds, svc.logger)
-
-	// TODO(lucas): Use cursors and limit to fetch in multiple requests.
-	// This single-request version supports up to 1000 devices (max to return in one call).
-	fetchDevicesResponse, err := depClient.FetchDevices(ctx, apple_mdm.DEPName, godep.WithLimit(1000))
-	if err != nil {
-		return nil, ctxerr.Wrap(ctx, err)
-	}
-
-	devices := make([]fleet.MDMAppleDEPDevice, len(fetchDevicesResponse.Devices))
-	for i := range fetchDevicesResponse.Devices {
-		devices[i] = fleet.MDMAppleDEPDevice{Device: fetchDevicesResponse.Devices[i]}
-	}
-	return devices, nil
-}
-
 type newMDMAppleDEPKeyPairResponse struct {
 	PublicKey  []byte `json:"public_key,omitempty"`
 	PrivateKey []byte `json:"private_key,omitempty"`
@@ -1287,6 +1248,39 @@ func (svc *Service) EnqueueMDMAppleCommand(
 type mdmAppleEnrollRequest struct {
 	Token               string `query:"token"`
 	EnrollmentReference string `query:"enrollment_reference,optional"`
+	MachineInfo         *fleet.MDMAppleMachineInfo
+}
+
+func (mdmAppleEnrollRequest) DecodeRequest(ctx context.Context, r *http.Request) (interface{}, error) {
+	decoded := mdmAppleEnrollRequest{}
+
+	tok := r.URL.Query().Get("token")
+	if tok == "" {
+		return nil, &fleet.BadRequestError{
+			Message: "token is required",
+		}
+	}
+	decoded.Token = tok
+
+	er := r.URL.Query().Get("enrollment_reference")
+	decoded.EnrollmentReference = er
+
+	// Parse the machine info from the request body
+	di := r.Header.Get("x-apple-aspen-deviceinfo")
+	if di != "" {
+		// extract x-apple-aspen-deviceinfo custom header from request
+		parsed, err := apple_mdm.ParseDeviceinfo(di, false) // FIXME: use verify=true when we have better parsing for various Apple certs (https://github.com/fleetdm/fleet/issues/20879)
+		if err != nil {
+			return nil, &fleet.BadRequestError{
+				Message:     "unable to parse deviceinfo header",
+				InternalErr: err,
+			}
+		}
+		p := fleet.MDMAppleMachineInfo(*parsed)
+		decoded.MachineInfo = &p
+	}
+
+	return &decoded, nil
 }
 
 func (r mdmAppleEnrollResponse) error() error { return r.Err }
@@ -1296,9 +1290,20 @@ type mdmAppleEnrollResponse struct {
 
 	// Profile field is used in hijackRender for the response.
 	Profile []byte
+
+	SoftwareUpdateRequired *fleet.MDMAppleSoftwareUpdateRequired
 }
 
 func (r mdmAppleEnrollResponse) hijackRender(ctx context.Context, w http.ResponseWriter) {
+	if r.SoftwareUpdateRequired != nil {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusForbidden)
+		if err := json.NewEncoder(w).Encode(r.SoftwareUpdateRequired); err != nil {
+			encodeError(ctx, ctxerr.New(ctx, "failed to encode software update required"), w)
+		}
+		return
+	}
+
 	w.Header().Set("Content-Length", strconv.FormatInt(int64(len(r.Profile)), 10))
 	w.Header().Set("Content-Type", "application/x-apple-aspen-config")
 	w.Header().Set("X-Content-Type-Options", "nosniff")
@@ -1316,6 +1321,16 @@ func (r mdmAppleEnrollResponse) hijackRender(ctx context.Context, w http.Respons
 func mdmAppleEnrollEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
 	req := request.(*mdmAppleEnrollRequest)
 
+	sur, err := svc.CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx, req.MachineInfo)
+	if err != nil {
+		return mdmAppleEnrollResponse{Err: err}, nil
+	}
+	if sur != nil {
+		return mdmAppleEnrollResponse{
+			SoftwareUpdateRequired: sur,
+		}, nil
+	}
+
 	profile, err := svc.GetMDMAppleEnrollmentProfileByToken(ctx, req.Token, req.EnrollmentReference)
 	if err != nil {
 		return mdmAppleEnrollResponse{Err: err}, nil
@@ -1376,6 +1391,89 @@ func (svc *Service) GetMDMAppleEnrollmentProfileByToken(ctx context.Context, tok
 	return signed, nil
 }
 
+func (svc *Service) CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx context.Context, m *fleet.MDMAppleMachineInfo) (*fleet.MDMAppleSoftwareUpdateRequired, error) {
+	// skipauth: The enroll profile endpoint is unauthenticated.
+	svc.authz.SkipAuthorization(ctx)
+
+	if m == nil {
+		level.Debug(svc.logger).Log("msg", "no machine info, skipping os version check")
+		return nil, nil
+	}
+
+	level.Debug(svc.logger).Log("msg", "checking os version", "serial", m.Serial, "current_version", m.OSVersion)
+
+	if !m.MDMCanRequestSoftwareUpdate {
+		level.Debug(svc.logger).Log("msg", "mdm cannot request software update, skipping os version check", "serial", m.Serial)
+		return nil, nil
+	}
+
+	needsUpdate, err := svc.needsOSUpdateForDEPEnrollment(ctx, *m)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "checking os updates settings", "serial", m.Serial)
+	}
+
+	if !needsUpdate {
+		level.Debug(svc.logger).Log("msg", "device is above minimum, skipping os version check", "serial", m.Serial)
+		return nil, nil
+	}
+
+	sur, err := svc.getAppleSoftwareUpdateRequiredForDEPEnrollment(*m)
+	if err != nil {
+		// log for debugging but allow enrollment to proceed
+		level.Info(svc.logger).Log("msg", "getting apple software update required", "serial", m.Serial, "err", err)
+		return nil, nil
+	}
+
+	return sur, nil
+}
+
+func (svc *Service) needsOSUpdateForDEPEnrollment(ctx context.Context, m fleet.MDMAppleMachineInfo) (bool, error) {
+	// NOTE: Under the hood, the datastore is joining host_dep_assignments to the hosts table to
+	// look up DEP hosts by serial number. It grabs the team id and platform from the
+	// hosts table. Then it uses the team id to get either the global config or team config.
+	// Finally, it uses the platform to get os updates settings from the config for
+	// one of ios, ipados, or darwin, as applicable. There's a lot of assumptions going on here, not
+	// least of which is that the platform is correct in the hosts table. If the platform is wrong,
+	// we'll end up with a meaningless comparison of unrelated versions. We could potentially add
+	// some cross-check against the machine info to ensure that the platform of the host aligns with
+	// what we expect from the machine info. But that would involve work to derive the platform from
+	// the machine info (presumably from the product name, but that's not a 1:1 mapping).
+	settings, err := svc.ds.GetMDMAppleOSUpdatesSettingsByHostSerial(ctx, m.Serial)
+	if err != nil {
+		if fleet.IsNotFound(err) {
+			level.Info(svc.logger).Log("msg", "checking os updates settings, settings not found", "serial", m.Serial)
+			return false, nil
+		}
+		return false, err
+	}
+	// TODO: confirm what this check should do
+	if !settings.MinimumVersion.Set || !settings.MinimumVersion.Valid || settings.MinimumVersion.Value == "" {
+		level.Info(svc.logger).Log("msg", "checking os updates settings, minimum version not set", "serial", m.Serial, "current_version", m.OSVersion, "minimum_version", settings.MinimumVersion.Value)
+		return false, nil
+	}
+
+	return apple_mdm.IsLessThanVersion(m.OSVersion, settings.MinimumVersion.Value)
+}
+
+func (svc *Service) getAppleSoftwareUpdateRequiredForDEPEnrollment(m fleet.MDMAppleMachineInfo) (*fleet.MDMAppleSoftwareUpdateRequired, error) {
+	latest, err := gdmf.GetLatestOSVersion(apple_mdm.MachineInfo(m))
+	if err != nil {
+		return nil, err
+	}
+
+	needsUpdate, err := apple_mdm.IsLessThanVersion(m.OSVersion, latest.ProductVersion)
+	if err != nil {
+		return nil, err
+	} else if !needsUpdate {
+		return nil, nil
+	}
+
+	return fleet.NewMDMAppleSoftwareUpdateRequired(fleet.MDMAppleSoftwareUpdateAsset{
+		ProductVersion: latest.ProductVersion,
+		Build:          latest.Build,
+	}), nil
+}
+
 func (svc *Service) mdmPushCertTopic(ctx context.Context) (string, error) {
 	assets, err := svc.ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{
 		fleet.MDMAssetAPNSCert,
@@ -1472,47 +1570,17 @@ func (svc *Service) EnqueueMDMAppleCommandRemoveEnrollmentProfile(ctx context.Co
 		return ctxerr.Wrap(ctx, err, "logging activity for mdm apple remove profile command")
 	}
 
-	return svc.pollResultMDMAppleCommandRemoveEnrollmentProfile(ctx, cmdUUID, h.UUID, info.Platform)
-}
-
-func (svc *Service) pollResultMDMAppleCommandRemoveEnrollmentProfile(ctx context.Context, cmdUUID string, deviceID string, platform string) error {
-	ctx, cancelFn := context.WithDeadline(ctx, time.Now().Add(5*time.Second))
-	ticker := time.NewTicker(300 * time.Millisecond)
-	defer func() {
-		ticker.Stop()
-		cancelFn()
-	}()
-
-	for {
-		select {
-		case <-ctx.Done():
-			// time out after 5 seconds
-			return fleet.MDMAppleCommandTimeoutError{}
-		case <-ticker.C:
-			nanoEnroll, err := svc.ds.GetNanoMDMEnrollment(ctx, deviceID)
-			if err != nil {
-				level.Error(svc.logger).Log("err", "get nanomdm enrollment status", "details", err, "id", deviceID, "command_uuid", cmdUUID)
-				return err
-			}
-			if nanoEnroll != nil && nanoEnroll.Enabled {
-				// check again on the next tick
-				continue
-			}
-			// success, mdm enrollment is no longer enabled for the device
-			level.Info(svc.logger).Log("msg", "mdm disabled for device", "id", deviceID, "command_uuid", cmdUUID)
-
-			mdmLifecycle := mdmlifecycle.New(svc.ds, svc.logger)
-			err = mdmLifecycle.Do(ctx, mdmlifecycle.HostOptions{
-				Action:   mdmlifecycle.HostActionTurnOff,
-				Platform: platform,
-				UUID:     deviceID,
-			})
-			if err != nil {
-				return err
-			}
-			return nil
-		}
+	mdmLifecycle := mdmlifecycle.New(svc.ds, svc.logger)
+	err = mdmLifecycle.Do(ctx, mdmlifecycle.HostOptions{
+		Action:   mdmlifecycle.HostActionTurnOff,
+		Platform: info.Platform,
+		UUID:     h.UUID,
+	})
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "running turn off action in mdm lifecycle")
 	}
+
+	return nil
 }
 
 type mdmAppleGetInstallerRequest struct {
@@ -1880,7 +1948,7 @@ func (svc *Service) BatchSetMDMAppleProfiles(ctx context.Context, tmID *uint, tm
 	}
 
 	if !skipBulkPending {
-		if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{bulkTeamID}, nil, nil); err != nil {
+		if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{bulkTeamID}, nil, nil); err != nil {
 			return ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 		}
 	}
@@ -2716,56 +2784,8 @@ func (svc *MDMAppleCheckinAndCommandService) CommandAndReportResults(r *mdm.Requ
 
 	// Check if this is a result of a "refetch" command sent to iPhones/iPads
 	// to fetch their device information periodically.
-	if strings.HasPrefix(cmdResult.CommandUUID, fleet.RefetchCommandUUIDPrefix) {
-		host, err := svc.ds.HostByIdentifier(r.Context, cmdResult.UDID)
-		if err != nil {
-			return nil, ctxerr.Wrap(r.Context, err, "failed to get host by identifier")
-		}
-		var deviceInformationResponse struct {
-			QueryResponses map[string]interface{} `plist:"QueryResponses"`
-		}
-		if err := plist.Unmarshal(cmdResult.Raw, &deviceInformationResponse); err != nil {
-			return nil, ctxerr.Wrap(r.Context, err, "failed to unmarshal device information command result")
-		}
-		deviceName := deviceInformationResponse.QueryResponses["DeviceName"].(string)
-		deviceCapacity := deviceInformationResponse.QueryResponses["DeviceCapacity"].(float64)
-		availableDeviceCapacity := deviceInformationResponse.QueryResponses["AvailableDeviceCapacity"].(float64)
-		osVersion := deviceInformationResponse.QueryResponses["OSVersion"].(string)
-		wifiMac := deviceInformationResponse.QueryResponses["WiFiMAC"].(string)
-		productName := deviceInformationResponse.QueryResponses["ProductName"].(string)
-		host.ComputerName = deviceName
-		host.Hostname = deviceName
-		host.GigsDiskSpaceAvailable = availableDeviceCapacity
-		host.GigsTotalDiskSpace = deviceCapacity
-		var (
-			osVersionPrefix string
-			platform        string
-		)
-		if strings.HasPrefix(productName, "iPhone") {
-			osVersionPrefix = "iOS"
-			platform = "ios"
-		} else { // iPad
-			osVersionPrefix = "iPadOS"
-			platform = "ipados"
-		}
-		host.OSVersion = osVersionPrefix + " " + osVersion
-		host.PrimaryMac = wifiMac
-		host.HardwareModel = productName
-		host.DetailUpdatedAt = time.Now()
-		if err := svc.ds.UpdateHost(r.Context, host); err != nil {
-			return nil, ctxerr.Wrap(r.Context, err, "failed to update host")
-		}
-		if err := svc.ds.SetOrUpdateHostDisksSpace(r.Context, host.ID, availableDeviceCapacity, 100*availableDeviceCapacity/deviceCapacity, deviceCapacity); err != nil {
-			return nil, ctxerr.Wrap(r.Context, err, "failed to update host storage")
-		}
-		if err := svc.ds.UpdateHostOperatingSystem(r.Context, host.ID, fleet.OperatingSystem{
-			Name:     osVersionPrefix,
-			Version:  osVersion,
-			Platform: platform,
-		}); err != nil {
-			return nil, ctxerr.Wrap(r.Context, err, "failed to update host operating system")
-		}
-		return nil, nil
+	if strings.HasPrefix(cmdResult.CommandUUID, fleet.RefetchBaseCommandUUIDPrefix) {
+		return svc.handleRefetch(r, cmdResult)
 	}
 
 	// We explicitly get the request type because it comes empty. There's a
@@ -2799,21 +2819,180 @@ func (svc *MDMAppleCheckinAndCommandService) CommandAndReportResults(r *mdm.Requ
 		if cmdResult.Status == fleet.MDMAppleStatusAcknowledged ||
 			cmdResult.Status == fleet.MDMAppleStatusError ||
 			cmdResult.Status == fleet.MDMAppleStatusCommandFormatError {
-			return nil, svc.ds.UpdateHostLockWipeStatusFromAppleMDMResult(r.Context, cmdResult.UDID, cmdResult.CommandUUID, requestType, cmdResult.Status == fleet.MDMAppleStatusAcknowledged)
+			return nil, svc.ds.UpdateHostLockWipeStatusFromAppleMDMResult(r.Context, cmdResult.UDID, cmdResult.CommandUUID, requestType,
+				cmdResult.Status == fleet.MDMAppleStatusAcknowledged)
 		}
 	case "DeclarativeManagement":
 		// set "pending-install" profiles to "verifying" or "failed"
 		// depending on the status of the DeviceManagement command
 		status := mdmAppleDeliveryStatusFromCommandStatus(cmdResult.Status)
-		detail := fmt.Sprintf("%s. Make sure the host is on macOS 13 or higher.", apple_mdm.FmtErrorChain(cmdResult.ErrorChain))
+		detail := fmt.Sprintf("%s. Make sure the host is on macOS 13+, iOS 17+, iPadOS 17+.", apple_mdm.FmtErrorChain(cmdResult.ErrorChain))
 		err := svc.ds.MDMAppleSetPendingDeclarationsAs(r.Context, cmdResult.UDID, status, detail)
 		return nil, ctxerr.Wrap(r.Context, err, "update declaration status on DeclarativeManagement ack")
+	case "InstallApplication":
+		// Create an activity for installing only if we're in a terminal state
+		if cmdResult.Status == fleet.MDMAppleStatusAcknowledged ||
+			cmdResult.Status == fleet.MDMAppleStatusError ||
+			cmdResult.Status == fleet.MDMAppleStatusCommandFormatError {
+			user, act, err := svc.ds.GetPastActivityDataForVPPAppInstall(r.Context, cmdResult)
+			if err != nil {
+				if fleet.IsNotFound(err) {
+					// Then this isn't a VPP install, so no activity generated
+					return nil, nil
+				}
 
+				return nil, ctxerr.Wrap(r.Context, err, "fetching data for installed app store app activity")
+			}
+
+			if err := newActivity(r.Context, user, act, svc.ds, svc.logger); err != nil {
+				return nil, ctxerr.Wrap(r.Context, err, "creating activity for installed app store app")
+			}
+		}
 	}
 
 	return nil, nil
 }
 
+func (svc *MDMAppleCheckinAndCommandService) handleRefetch(r *mdm.Request, cmdResult *mdm.CommandResults) (*mdm.Command, error) {
+	ctx := r.Context
+	host, err := svc.ds.HostByIdentifier(ctx, cmdResult.UDID)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "failed to get host by identifier")
+	}
+
+	if strings.HasPrefix(cmdResult.CommandUUID, fleet.RefetchAppsCommandUUIDPrefix) {
+		// We remove pending command first in case there is an error processing the results, so that we don't prevent another refetch.
+		err = svc.ds.RemoveHostMDMCommand(ctx, fleet.HostMDMCommand{
+			HostID:      host.ID,
+			CommandType: fleet.RefetchAppsCommandUUIDPrefix,
+		})
+		if err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "remove refetch apps command")
+		}
+
+		if host.Platform != "ios" && host.Platform != "ipados" {
+			return nil, ctxerr.New(ctx, "refetch apps command sent to non-iOS/non-iPadOS host")
+		}
+		source := "ios_apps"
+		if host.Platform == "ipados" {
+			source = "ipados_apps"
+		}
+
+		response := cmdResult.Raw
+		software, err := unmarshalAppList(ctx, response, source)
+		if err != nil {
+			return nil, err
+		}
+		_, err = svc.ds.UpdateHostSoftware(ctx, host.ID, software)
+		if err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "update host software")
+		}
+
+		return nil, nil
+	}
+
+	// Otherwise, the command has prefix fleet.RefetchDeviceCommandUUIDPrefix, which is a refetch device command.
+	// We remove pending command first in case there is an error processing the results, so that we don't prevent another refetch.
+	err = svc.ds.RemoveHostMDMCommand(ctx, fleet.HostMDMCommand{
+		HostID:      host.ID,
+		CommandType: fleet.RefetchDeviceCommandUUIDPrefix,
+	})
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "remove refetch device command")
+	}
+
+	var deviceInformationResponse struct {
+		QueryResponses map[string]interface{} `plist:"QueryResponses"`
+	}
+	if err := plist.Unmarshal(cmdResult.Raw, &deviceInformationResponse); err != nil {
+		return nil, ctxerr.Wrap(r.Context, err, "failed to unmarshal device information command result")
+	}
+	deviceName := deviceInformationResponse.QueryResponses["DeviceName"].(string)
+	deviceCapacity := deviceInformationResponse.QueryResponses["DeviceCapacity"].(float64)
+	availableDeviceCapacity := deviceInformationResponse.QueryResponses["AvailableDeviceCapacity"].(float64)
+	osVersion := deviceInformationResponse.QueryResponses["OSVersion"].(string)
+	wifiMac := deviceInformationResponse.QueryResponses["WiFiMAC"].(string)
+	productName := deviceInformationResponse.QueryResponses["ProductName"].(string)
+	host.ComputerName = deviceName
+	host.Hostname = deviceName
+	host.GigsDiskSpaceAvailable = availableDeviceCapacity
+	host.GigsTotalDiskSpace = deviceCapacity
+	var (
+		osVersionPrefix string
+		platform        string
+	)
+	if strings.HasPrefix(productName, "iPhone") {
+		osVersionPrefix = "iOS"
+		platform = "ios"
+	} else { // iPad
+		osVersionPrefix = "iPadOS"
+		platform = "ipados"
+	}
+	host.OSVersion = osVersionPrefix + " " + osVersion
+	host.PrimaryMac = wifiMac
+	host.HardwareModel = productName
+	host.DetailUpdatedAt = time.Now()
+	host.RefetchRequested = false
+	if err := svc.ds.UpdateHost(r.Context, host); err != nil {
+		return nil, ctxerr.Wrap(r.Context, err, "failed to update host")
+	}
+	if err := svc.ds.SetOrUpdateHostDisksSpace(r.Context, host.ID, availableDeviceCapacity, 100*availableDeviceCapacity/deviceCapacity,
+		deviceCapacity); err != nil {
+		return nil, ctxerr.Wrap(r.Context, err, "failed to update host storage")
+	}
+	if err := svc.ds.UpdateHostOperatingSystem(r.Context, host.ID, fleet.OperatingSystem{
+		Name:     osVersionPrefix,
+		Version:  osVersion,
+		Platform: platform,
+	}); err != nil {
+		return nil, ctxerr.Wrap(r.Context, err, "failed to update host operating system")
+	}
+
+	if host.MDM.EnrollmentStatus != nil && *host.MDM.EnrollmentStatus == "Pending" {
+		// Since the device has been refetched, we can assume it's enrolled.
+		err = svc.ds.UpdateMDMData(ctx, host.ID, true)
+		if err != nil {
+			return nil, ctxerr.Wrap(r.Context, err, "failed to update MDM data")
+		}
+	}
+	return nil, nil
+}
+
+func unmarshalAppList(ctx context.Context, response []byte, source string) ([]fleet.Software,
+	error,
+) {
+	var appsResponse struct {
+		InstalledApplicationList []map[string]interface{} `plist:"InstalledApplicationList"`
+	}
+	if err := plist.Unmarshal(response, &appsResponse); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "failed to unmarshal installed application list command result")
+	}
+
+	truncateString := func(item interface{}, length int) string {
+		str, ok := item.(string)
+		if !ok {
+			return ""
+		}
+		runes := []rune(str)
+		if len(runes) > length {
+			return string(runes[:length])
+		}
+		return str
+	}
+
+	var software []fleet.Software
+	for _, app := range appsResponse.InstalledApplicationList {
+		software = append(software, fleet.Software{
+			Name:             truncateString(app["Name"], fleet.SoftwareNameMaxLength),
+			Version:          truncateString(app["ShortVersion"], fleet.SoftwareVersionMaxLength),
+			BundleIdentifier: truncateString(app["Identifier"], fleet.SoftwareBundleIdentifierMaxLength),
+			Source:           source,
+		})
+	}
+
+	return software, nil
+}
+
 // mdmAppleDeliveryStatusFromCommandStatus converts a MDM command status to a
 // fleet.MDMAppleDeliveryStatus.
 //
@@ -2922,6 +3101,35 @@ func ensureFleetProfiles(ctx context.Context, ds fleet.Datastore, logger kitlog.
 	return nil
 }
 
+func SendPushesToPendingDevices(
+	ctx context.Context,
+	ds fleet.Datastore,
+	commander *apple_mdm.MDMAppleCommander,
+	logger kitlog.Logger,
+) error {
+	uuids, err := ds.GetHostUUIDsWithPendingMDMAppleCommands(ctx)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "getting host uuids with pending commands")
+	}
+
+	if len(uuids) == 0 {
+		return nil
+	}
+
+	if err := commander.SendNotifications(ctx, uuids); err != nil {
+		var apnsErr *apple_mdm.APNSDeliveryError
+		if errors.As(err, &apnsErr) {
+			level.Info(logger).Log("msg", "failed to send APNs notification to some hosts", "error", apnsErr.Error())
+			return nil
+		}
+
+		return ctxerr.Wrap(ctx, err, "sending push notifications")
+
+	}
+
+	return nil
+}
+
 func ReconcileAppleDeclarations(
 	ctx context.Context,
 	ds fleet.Datastore,
@@ -3229,7 +3437,7 @@ func ReconcileAppleProfiles(
 
 // scepCertRenewalThresholdDays defines the number of days before a SCEP
 // certificate must be renewed.
-const scepCertRenewalThresholdDays = 30
+const scepCertRenewalThresholdDays = 180
 
 // maxCertsRenewalPerRun specifies the maximum number of certificates to renew
 // in a single cron run.
@@ -3238,8 +3446,8 @@ const scepCertRenewalThresholdDays = 30
 // day, and we have room for 24,000 * scepCertRenewalThresholdDays total
 // renewals.
 //
-// For a default of 30 days as a threshold this gives us room for a fleet of
-// 720,000 devices expiring at the same time.
+// For a default of 180 days as a threshold this gives us room for a fleet of
+// ~4 million devices expiring at the same time.
 const maxCertsRenewalPerRun = 100
 
 func RenewSCEPCertificates(
@@ -3351,9 +3559,13 @@ func RenewSCEPCertificates(
 		}
 	}
 
-	migrationEnrollmentProfile := os.Getenv("FLEET_SILENT_MIGRATION_ENROLLMENT_PROFILE")
+	decodedMigrationEnrollmentProfile, err := base64.StdEncoding.DecodeString(os.Getenv("FLEET_SILENT_MIGRATION_ENROLLMENT_PROFILE"))
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "failed to decode silent migration enrollment profile")
+	}
 	hasAssocsFromMigration := len(assocsFromMigration) > 0
 
+	migrationEnrollmentProfile := string(decodedMigrationEnrollmentProfile)
 	if migrationEnrollmentProfile == "" && hasAssocsFromMigration {
 		level.Debug(logger).Log("msg", "found devices from migration that need SCEP renewals but FLEET_SILENT_MIGRATION_ENROLLMENT_PROFILE is empty")
 	}
@@ -3735,7 +3947,8 @@ func (uploadABMTokenRequest) DecodeRequest(ctx context.Context, r *http.Request)
 }
 
 type uploadABMTokenResponse struct {
-	Err error `json:"error,omitempty"`
+	Token *fleet.ABMToken `json:"abm_token,omitempty"`
+	Err   error           `json:"error,omitempty"`
 }
 
 func (r uploadABMTokenResponse) error() error { return r.Err }
@@ -3748,125 +3961,231 @@ func uploadABMTokenEndpoint(ctx context.Context, request interface{}, svc fleet.
 	}
 	defer ff.Close()
 
-	if err := svc.SaveABMToken(ctx, ff); err != nil {
+	token, err := svc.UploadABMToken(ctx, ff)
+	if err != nil {
 		return uploadABMTokenResponse{
 			Err: err,
 		}, nil
 	}
 
-	return uploadABMTokenResponse{}, nil
+	return uploadABMTokenResponse{Token: token}, nil
 }
 
-func (svc *Service) SaveABMToken(ctx context.Context, token io.Reader) error {
-	// first check for reads as we need to load the cert/key from the db. We will
-	// do another write check below.
-	if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionRead); err != nil {
-		return err
-	}
+func (svc *Service) UploadABMToken(ctx context.Context, token io.Reader) (*fleet.ABMToken, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
 
-	pair, err := svc.ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{
-		fleet.MDMAssetABMCert,
-		fleet.MDMAssetABMKey,
-	})
-	if err != nil {
-		if fleet.IsNotFound(err) {
-			return ctxerr.Wrap(ctx, &fleet.BadRequestError{
-				Message: "Please generate a keypair first.",
-			}, "saving ABM token")
-		}
+	return nil, fleet.ErrMissingLicense
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// Disable ABM endpoint
+////////////////////////////////////////////////////////////////////////////////
+
+type deleteABMTokenRequest struct {
+	TokenID uint `url:"id"`
+}
+
+type deleteABMTokenResponse struct {
+	Err error `json:"error,omitempty"`
+}
+
+func (r deleteABMTokenResponse) error() error { return r.Err }
+func (r deleteABMTokenResponse) Status() int  { return http.StatusNoContent }
 
-		return ctxerr.Wrap(ctx, err, "retrieving stored ABM assets")
+func deleteABMTokenEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*deleteABMTokenRequest)
+	if err := svc.DeleteABMToken(ctx, req.TokenID); err != nil {
+		return deleteABMTokenResponse{Err: err}, nil
 	}
 
-	tokenBytes, err := io.ReadAll(token)
+	return deleteABMTokenResponse{}, nil
+}
+
+func (svc *Service) DeleteABMToken(ctx context.Context, tokenID uint) error {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return fleet.ErrMissingLicense
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// List ABM tokens endpoint
+////////////////////////////////////////////////////////////////////////////////
+
+type listABMTokensResponse struct {
+	Err    error             `json:"error,omitempty"`
+	Tokens []*fleet.ABMToken `json:"abm_tokens"`
+}
+
+func (r listABMTokensResponse) error() error { return r.Err }
+
+func listABMTokensEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	tokens, err := svc.ListABMTokens(ctx)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "reading token bytes")
+		return &listABMTokensResponse{Err: err}, nil
 	}
 
-	derCert, _ := pem.Decode(pair[fleet.MDMAssetABMCert].Value)
-	if derCert == nil {
-		return ctxerr.Wrap(ctx, err, "ABM certificate in the database cannot be parsed")
+	if tokens == nil {
+		tokens = []*fleet.ABMToken{}
 	}
 
-	cert, err := x509.ParseCertificate(derCert.Bytes)
+	return &listABMTokensResponse{Tokens: tokens}, nil
+}
+
+func (svc *Service) ListABMTokens(ctx context.Context) ([]*fleet.ABMToken, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return nil, fleet.ErrMissingLicense
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// Update ABM token teams endpoint
+////////////////////////////////////////////////////////////////////////////////
+
+type updateABMTokenTeamsRequest struct {
+	TokenID      uint  `url:"id"`
+	MacOSTeamID  *uint `json:"macos_team_id"`
+	IOSTeamID    *uint `json:"ios_team_id"`
+	IPadOSTeamID *uint `json:"ipados_team_id"`
+}
+
+type updateABMTokenTeamsResponse struct {
+	ABMToken *fleet.ABMToken `json:"abm_token,omitempty"`
+	Err      error           `json:"error,omitempty"`
+}
+
+func (r updateABMTokenTeamsResponse) error() error { return r.Err }
+
+func updateABMTokenTeamsEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*updateABMTokenTeamsRequest)
+
+	tok, err := svc.UpdateABMTokenTeams(ctx, req.TokenID, req.MacOSTeamID, req.IOSTeamID, req.IPadOSTeamID)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "parsing ABM certificate")
+		return &updateABMTokenTeamsResponse{Err: err}, nil
 	}
 
-	if _, err := assets.DecryptRawABMToken(tokenBytes, cert, pair[fleet.MDMAssetABMKey].Value); err != nil {
-		return ctxerr.Wrap(ctx, &fleet.BadRequestError{
-			Message:     "Invalid token. Please provide a valid token from Apple Business Manager.",
+	return &updateABMTokenTeamsResponse{ABMToken: tok}, nil
+}
+
+func (svc *Service) UpdateABMTokenTeams(ctx context.Context, tokenID uint, macOSTeamID, iOSTeamID, iPadOSTeamID *uint) (*fleet.ABMToken, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return nil, fleet.ErrMissingLicense
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// Renew ABM token endpoint
+////////////////////////////////////////////////////////////////////////////////
+
+type renewABMTokenRequest struct {
+	TokenID uint `url:"id"`
+	Token   *multipart.FileHeader
+}
+
+func (renewABMTokenRequest) DecodeRequest(ctx context.Context, r *http.Request) (interface{}, error) {
+	err := r.ParseMultipartForm(512 * units.MiB)
+	if err != nil {
+		return nil, &fleet.BadRequestError{
+			Message:     "failed to parse multipart form",
 			InternalErr: err,
-		}, "validating ABM token")
+		}
 	}
 
-	if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionWrite); err != nil {
-		return err
+	token, ok := r.MultipartForm.File["token"]
+	if !ok || len(token) < 1 {
+		return nil, &fleet.BadRequestError{Message: "no file headers for token"}
 	}
 
-	// delete the old token and insert the new one
-	// TODO(roberto): replacing the token should be done in a single transaction in the DB
-	err = svc.ds.DeleteMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{fleet.MDMAssetABMToken})
+	// because we are in this method, we know that the path has 7 parts, e.g:
+	// /api/latest/fleet/abm_tokens/19/renew
+
+	id, err := intFromRequest(r, "id")
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "deleting old ABM token in database")
+		return nil, ctxerr.Wrap(ctx, err, "failed to parse abm token id")
 	}
-	err = svc.ds.InsertMDMConfigAssets(ctx, []fleet.MDMConfigAsset{
-		{Name: fleet.MDMAssetABMToken, Value: tokenBytes},
-	})
+
+	return &renewABMTokenRequest{
+		Token:   token[0],
+		TokenID: uint(id),
+	}, nil
+}
+
+type renewABMTokenResponse struct {
+	ABMToken *fleet.ABMToken `json:"abm_token,omitempty"`
+	Err      error           `json:"error,omitempty"`
+}
+
+func (r renewABMTokenResponse) error() error { return r.Err }
+
+func renewABMTokenEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*renewABMTokenRequest)
+	ff, err := req.Token.Open()
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "saving ABM token in database")
+		return &renewABMTokenResponse{Err: err}, nil
 	}
+	defer ff.Close()
 
-	// flip the app config flag
-	appCfg, err := svc.ds.AppConfig(ctx)
+	tok, err := svc.RenewABMToken(ctx, ff, req.TokenID)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "retrieving app config")
+		return &renewABMTokenResponse{Err: err}, nil
 	}
 
-	appCfg.MDM.AppleBMEnabledAndConfigured = true
+	return &renewABMTokenResponse{ABMToken: tok}, nil
+}
+
+func (svc *Service) RenewABMToken(ctx context.Context, token io.Reader, tokenID uint) (*fleet.ABMToken, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
 
-	return svc.ds.SaveAppConfig(ctx, appCfg)
+	return nil, fleet.ErrMissingLicense
 }
 
 ////////////////////////////////////////////////////////////////////////////////
-// Disable ABM endpoint
+// GET /enrollment_profiles/ota
 ////////////////////////////////////////////////////////////////////////////////
 
-type disableABMResponse struct {
-	Err error `json:"error,omitempty"`
+type getOTAProfileRequest struct {
+	EnrollSecret string `query:"enroll_secret"`
 }
 
-func (r disableABMResponse) error() error { return r.Err }
-func (r disableABMResponse) Status() int  { return http.StatusNoContent }
-
-func disableABMEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
-	if err := svc.DisableABM(ctx); err != nil {
-		return disableABMResponse{Err: err}, nil
+func getOTAProfileEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*getOTAProfileRequest)
+	profile, err := svc.GetOTAProfile(ctx, req.EnrollSecret)
+	if err != nil {
+		return &getMDMAppleConfigProfileResponse{Err: err}, err
 	}
 
-	return disableABMResponse{}, nil
+	reader := bytes.NewReader(profile)
+	return &getMDMAppleConfigProfileResponse{fileReader: io.NopCloser(reader), fileLength: reader.Size(), fileName: "fleet-mdm-enrollment-profile"}, nil
 }
 
-func (svc *Service) DisableABM(ctx context.Context) error {
-	if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionWrite); err != nil {
-		return err
+func (svc *Service) GetOTAProfile(ctx context.Context, enrollSecret string) ([]byte, error) {
+	// Skip authz as this endpoint is used by end users from their iPhones or iPads; authz is done
+	// by the enroll secret verification below
+	svc.authz.SkipAuthorization(ctx)
+
+	cfg, err := svc.ds.AppConfig(ctx)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting app config to get org name")
 	}
 
-	err := svc.ds.DeleteMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{
-		fleet.MDMAssetABMCert,
-		fleet.MDMAssetABMKey,
-		fleet.MDMAssetABMToken,
-	})
+	profBytes, err := apple_mdm.GenerateOTAEnrollmentProfileMobileconfig(cfg.OrgInfo.OrgName, cfg.ServerSettings.ServerURL, enrollSecret)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "disabling ABM config")
+		return nil, ctxerr.Wrap(ctx, err, "generating ota mobileconfig file")
 	}
 
-	// flip the app config flag
-	appCfg, err := svc.ds.AppConfig(ctx)
+	signed, err := mdmcrypto.Sign(ctx, profBytes, svc.ds)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "retrieving app config")
+		return nil, ctxerr.Wrap(ctx, err, "signing profile")
 	}
 
-	appCfg.MDM.AppleBMEnabledAndConfigured = false
-	return svc.ds.SaveAppConfig(ctx, appCfg)
+	return signed, nil
 }
diff --git a/server/service/apple_mdm_test.go b/server/service/apple_mdm_test.go
index 93c8606af585..a8b20b04ec25 100644
--- a/server/service/apple_mdm_test.go
+++ b/server/service/apple_mdm_test.go
@@ -24,6 +24,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/fleetdm/fleet/v4/pkg/optjson"
 	"github.com/fleetdm/fleet/v4/server/authz"
 	"github.com/fleetdm/fleet/v4/server/config"
 	"github.com/fleetdm/fleet/v4/server/contexts/license"
@@ -48,6 +49,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/groob/plist"
 	micromdm "github.com/micromdm/micromdm/mdm/mdm"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.mozilla.org/pkcs7"
 )
@@ -245,8 +247,6 @@ func TestAppleMDMAuthorization(t *testing.T) {
 		checkAuthErr(t, err, shouldFailWithAuth)
 		_, err = svc.ListMDMAppleDevices(ctx)
 		checkAuthErr(t, err, shouldFailWithAuth)
-		_, err = svc.ListMDMAppleDEPDevices(ctx)
-		checkAuthErr(t, err, shouldFailWithAuth)
 
 		// check EULA routes
 		_, err = svc.MDMGetEULAMetadata(ctx)
@@ -599,8 +599,9 @@ func TestMDMAppleConfigProfileAuthz(t *testing.T) {
 	ds.GetMDMAppleProfilesSummaryFunc = func(context.Context, *uint) (*fleet.MDMProfilesSummary, error) {
 		return nil, nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	mockGetFuncWithTeamID := func(teamID uint) mock.GetMDMAppleConfigProfileFunc {
 		return func(ctx context.Context, puid string) (*fleet.MDMAppleConfigProfile, error) {
@@ -706,8 +707,9 @@ func TestNewMDMAppleConfigProfile(t *testing.T) {
 	ds.NewActivityFunc = func(context.Context, *fleet.User, fleet.ActivityDetails, []byte, time.Time) error {
 		return nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	cp, err := svc.NewMDMAppleConfigProfile(ctx, 0, r, nil, false)
@@ -1499,8 +1501,9 @@ func TestMDMBatchSetAppleProfiles(t *testing.T) {
 	) error {
 		return nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.ListMDMConfigProfilesFunc = func(ctx context.Context, tid *uint, opt fleet.ListOptions) ([]*fleet.MDMConfigProfilePayload, *fleet.PaginationMetadata, error) {
 		return nil, nil, nil
@@ -1815,8 +1818,9 @@ func TestMDMBatchSetAppleProfilesBoolArgs(t *testing.T) {
 	) error {
 		return nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, profileUUIDs, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, profileUUIDs, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.ListMDMConfigProfilesFunc = func(ctx context.Context, tid *uint, opt fleet.ListOptions) ([]*fleet.MDMConfigProfilePayload, *fleet.PaginationMetadata, error) {
 		return nil, nil, nil
@@ -2591,7 +2595,7 @@ func TestEnsureFleetdConfig(t *testing.T) {
 		ds.AppConfigFunc = func(ctx context.Context) (*fleet.AppConfig, error) {
 			appCfg := &fleet.AppConfig{}
 			appCfg.ServerSettings.ServerURL = testURL
-			appCfg.MDM.AppleBMDefaultTeam = testTeamName
+			appCfg.MDM.DeprecatedAppleBMDefaultTeam = testTeamName
 			return appCfg, nil
 		}
 		ds.AggregateEnrollSecretPerTeamFunc = func(ctx context.Context) ([]*fleet.EnrollSecret, error) {
@@ -2635,7 +2639,7 @@ func TestEnsureFleetdConfig(t *testing.T) {
 		ds.AppConfigFunc = func(ctx context.Context) (*fleet.AppConfig, error) {
 			appCfg := &fleet.AppConfig{}
 			appCfg.ServerSettings.ServerURL = testURL
-			appCfg.MDM.AppleBMDefaultTeam = testTeamName
+			appCfg.MDM.DeprecatedAppleBMDefaultTeam = testTeamName
 			return appCfg, nil
 		}
 		ds.AggregateEnrollSecretPerTeamFunc = func(ctx context.Context) ([]*fleet.EnrollSecret, error) {
@@ -3210,7 +3214,7 @@ func TestMDMCommandAndReportResultsIOSIPadOSRefetch(t *testing.T) {
 	ctx := context.Background()
 	hostID := uint(42)
 	hostUUID := "ABC-DEF-GHI"
-	commandUUID := "REFETCH-COMMAND-UUID"
+	commandUUID := fleet.RefetchDeviceCommandUUIDPrefix + "UUID"
 
 	ds := new(mock.Store)
 	svc := MDMAppleCheckinAndCommandService{ds: ds}
@@ -3244,6 +3248,11 @@ func TestMDMCommandAndReportResultsIOSIPadOSRefetch(t *testing.T) {
 		require.Equal(t, "ipados", hostOS.Platform)
 		return nil
 	}
+	ds.RemoveHostMDMCommandFunc = func(ctx context.Context, command fleet.HostMDMCommand) error {
+		assert.Equal(t, hostID, command.HostID)
+		assert.Equal(t, fleet.RefetchDeviceCommandUUIDPrefix, command.CommandType)
+		return nil
+	}
 
 	_, err := svc.CommandAndReportResults(
 		&mdm.Request{Context: ctx},
@@ -3285,4 +3294,332 @@ func TestMDMCommandAndReportResultsIOSIPadOSRefetch(t *testing.T) {
 	require.True(t, ds.HostByIdentifierFuncInvoked)
 	require.True(t, ds.SetOrUpdateHostDisksSpaceFuncInvoked)
 	require.True(t, ds.UpdateHostOperatingSystemFuncInvoked)
+	assert.True(t, ds.RemoveHostMDMCommandFuncInvoked)
+}
+
+func TestUnmarshalAppList(t *testing.T) {
+	ctx := context.Background()
+	noApps := []byte(`<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CommandUUID</key>
+	<string>c05c1a68-4127-4fde-b0da-965cbd63f88f</string>
+	<key>InstalledApplicationList</key>
+	<array/>
+	<key>Status</key>
+	<string>Acknowledged</string>
+	<key>UDID</key>
+	<string>00008030-000E6D623CD2202E</string>
+</dict>
+</plist>`)
+	software, err := unmarshalAppList(ctx, noApps, "ipados_apps")
+	require.NoError(t, err)
+	assert.Empty(t, software)
+
+	apps := []byte(`<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CommandUUID</key>
+	<string>21ed54fc-0e6d-4fe3-8c4f-feca0c548ce1</string>
+	<key>InstalledApplicationList</key>
+	<array>
+		<dict>
+			<key>Identifier</key>
+			<string>com.google.ios.youtube</string>
+			<key>Name</key>
+			<string>YouTube</string>
+			<key>ShortVersion</key>
+			<string>19.29.1</string>
+		</dict>
+		<dict>
+			<key>Identifier</key>
+			<string>com.evernote.iPhone.Evernote</string>
+			<key>Name</key>
+			<string>Evernote</string>
+			<key>ShortVersion</key>
+			<string>10.98.0</string>
+		</dict>
+		<dict>
+			<key>Identifier</key>
+			<string>com.netflix.Netflix</string>
+			<key>Name</key>
+			<string>Netflix</string>
+			<key>ShortVersion</key>
+			<string>16.41.0</string>
+		</dict>
+	</array>
+	<key>Status</key>
+	<string>Acknowledged</string>
+	<key>UDID</key>
+	<string>00008101-001514810EA3A01E</string>
+</dict>
+</plist>`)
+	expectedSoftware := []fleet.Software{
+		{
+			Name:             "YouTube",
+			Version:          "19.29.1",
+			Source:           "ios_apps",
+			BundleIdentifier: "com.google.ios.youtube",
+		},
+		{
+			Name:             "Evernote",
+			Version:          "10.98.0",
+			Source:           "ios_apps",
+			BundleIdentifier: "com.evernote.iPhone.Evernote",
+		},
+		{
+			Name:             "Netflix",
+			Version:          "16.41.0",
+			Source:           "ios_apps",
+			BundleIdentifier: "com.netflix.Netflix",
+		},
+	}
+	software, err = unmarshalAppList(ctx, apps, "ios_apps")
+	require.NoError(t, err)
+	assert.ElementsMatch(t, expectedSoftware, software)
+}
+
+func TestCheckMDMAppleEnrollmentWithMinimumOSVersion(t *testing.T) {
+	svc, ctx, ds := setupAppleMDMService(t, &fleet.LicenseInfo{Tier: fleet.TierPremium})
+
+	gdmf := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		// load the test data from the file
+		b, err := os.ReadFile("../mdm/apple/gdmf/testdata/gdmf.json")
+		require.NoError(t, err)
+		_, err = w.Write(b)
+		require.NoError(t, err)
+	}))
+	defer gdmf.Close()
+	t.Setenv("FLEET_DEV_GDMF_URL", gdmf.URL)
+
+	latestMacOSVersion := "14.6.1"
+	latestMacOSBuild := "23G93"
+
+	testCases := []struct {
+		name           string
+		machineInfo    *fleet.MDMAppleMachineInfo
+		updateRequired *fleet.MDMAppleSoftwareUpdateRequiredDetails
+		err            string
+	}{
+		{
+			name: "OS version is greater than latest",
+			machineInfo: &fleet.MDMAppleMachineInfo{
+				MDMCanRequestSoftwareUpdate: true,
+				Product:                     "Mac15,7",
+				OSVersion:                   "14.6.2",
+				SupplementalBuildVersion:    "IRRELEVANT",
+				SoftwareUpdateDeviceID:      "J516sAP",
+			},
+			updateRequired: nil,
+		},
+		{
+			name: "OS version is equal to latest",
+			machineInfo: &fleet.MDMAppleMachineInfo{
+				MDMCanRequestSoftwareUpdate: true,
+				Product:                     "Mac15,7",
+				OSVersion:                   latestMacOSVersion,
+				SupplementalBuildVersion:    "IRRELEVANT",
+				SoftwareUpdateDeviceID:      "J516sAP",
+			},
+			updateRequired: nil,
+		},
+		{
+			name: "OS version is less than latest",
+			machineInfo: &fleet.MDMAppleMachineInfo{
+				MDMCanRequestSoftwareUpdate: true,
+				Product:                     "Mac15,7",
+				OSVersion:                   "14.4",
+				SupplementalBuildVersion:    "IRRELEVANT",
+				SoftwareUpdateDeviceID:      "J516sAP",
+			},
+			updateRequired: &fleet.MDMAppleSoftwareUpdateRequiredDetails{
+				OSVersion:    latestMacOSVersion,
+				BuildVersion: latestMacOSBuild,
+			},
+		},
+		{
+			name: "OS version is less than latest but MDM cannot request software update",
+			machineInfo: &fleet.MDMAppleMachineInfo{
+				MDMCanRequestSoftwareUpdate: false,
+				Product:                     "Mac15,7",
+				OSVersion:                   "14.4",
+				SupplementalBuildVersion:    "IRRELEVANT",
+				SoftwareUpdateDeviceID:      "J516sAP",
+			},
+			updateRequired: nil,
+		},
+		{
+			name: "no match for software update device ID",
+			machineInfo: &fleet.MDMAppleMachineInfo{
+				MDMCanRequestSoftwareUpdate: true,
+				Product:                     "Mac15,7",
+				OSVersion:                   "14.4",
+				SupplementalBuildVersion:    "IRRELEVANT",
+				SoftwareUpdateDeviceID:      "INVALID",
+			},
+			updateRequired: nil,
+			err:            "", // no error, allow enrollment to proceed without software update
+		},
+		{
+			name:           "no machine info",
+			machineInfo:    nil,
+			updateRequired: nil,
+			err:            "", // no error, allow enrollment to proceed without software update
+		},
+		{
+			name: "cannot parse OS version",
+			machineInfo: &fleet.MDMAppleMachineInfo{
+				MDMCanRequestSoftwareUpdate: true,
+				Product:                     "Mac15,7",
+				OSVersion:                   "INVALID",
+				SupplementalBuildVersion:    "IRRELEVANT",
+				SoftwareUpdateDeviceID:      "J516sAP",
+			},
+			updateRequired: nil,
+			err:            "invalid current version",
+		},
+	}
+
+	for _, tt := range testCases {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Run("settings minimum equal to latest", func(t *testing.T) {
+				ds.GetMDMAppleOSUpdatesSettingsByHostSerialFunc = func(ctx context.Context, serial string) (*fleet.AppleOSUpdateSettings, error) {
+					return &fleet.AppleOSUpdateSettings{
+						MinimumVersion: optjson.SetString(latestMacOSVersion),
+					}, nil
+				}
+				sur, err := svc.CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx, tt.machineInfo)
+				if tt.err != "" {
+					require.Error(t, err)
+					require.Contains(t, err.Error(), tt.err)
+				} else {
+					require.NoError(t, err)
+				}
+				if tt.updateRequired != nil {
+					require.Equal(t, &fleet.MDMAppleSoftwareUpdateRequired{
+						Code:    fleet.MDMAppleSoftwareUpdateRequiredCode,
+						Details: *tt.updateRequired,
+					}, sur)
+				} else {
+					require.Nil(t, sur)
+				}
+			})
+
+			t.Run("settings minimum below latest", func(t *testing.T) {
+				ds.GetMDMAppleOSUpdatesSettingsByHostSerialFunc = func(ctx context.Context, serial string) (*fleet.AppleOSUpdateSettings, error) {
+					return &fleet.AppleOSUpdateSettings{
+						MinimumVersion: optjson.SetString("14.5"),
+					}, nil
+				}
+				sur, err := svc.CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx, tt.machineInfo)
+				if tt.err != "" {
+					require.Error(t, err)
+					require.Contains(t, err.Error(), tt.err)
+				} else {
+					require.NoError(t, err)
+				}
+				if tt.updateRequired != nil {
+					require.Equal(t, &fleet.MDMAppleSoftwareUpdateRequired{
+						Code:    fleet.MDMAppleSoftwareUpdateRequiredCode,
+						Details: *tt.updateRequired,
+					}, sur)
+				} else {
+					require.Nil(t, sur)
+				}
+			})
+
+			t.Run("settings minimum above latest", func(t *testing.T) {
+				// edge case, but in practice it would get treated as if minimum was equal to latest
+				ds.GetMDMAppleOSUpdatesSettingsByHostSerialFunc = func(ctx context.Context, serial string) (*fleet.AppleOSUpdateSettings, error) {
+					return &fleet.AppleOSUpdateSettings{
+						MinimumVersion: optjson.SetString("14.7"),
+					}, nil
+				}
+				sur, err := svc.CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx, tt.machineInfo)
+				if tt.err != "" {
+					require.Error(t, err)
+					require.Contains(t, err.Error(), tt.err)
+				} else {
+					require.NoError(t, err)
+				}
+				if tt.updateRequired != nil {
+					require.Equal(t, &fleet.MDMAppleSoftwareUpdateRequired{
+						Code:    fleet.MDMAppleSoftwareUpdateRequiredCode,
+						Details: *tt.updateRequired,
+					}, sur)
+				} else {
+					require.Nil(t, sur)
+				}
+			})
+
+			t.Run("device above settings minimum", func(t *testing.T) {
+				ds.GetMDMAppleOSUpdatesSettingsByHostSerialFunc = func(ctx context.Context, serial string) (*fleet.AppleOSUpdateSettings, error) {
+					return &fleet.AppleOSUpdateSettings{
+						MinimumVersion: optjson.SetString("14.1"),
+					}, nil
+				}
+				sur, err := svc.CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx, tt.machineInfo)
+				if tt.err != "" {
+					require.Error(t, err)
+					require.Contains(t, err.Error(), tt.err)
+				} else {
+					require.NoError(t, err)
+				}
+
+				require.Nil(t, sur)
+			})
+
+			t.Run("minimum not set", func(t *testing.T) {
+				ds.GetMDMAppleOSUpdatesSettingsByHostSerialFunc = func(ctx context.Context, serial string) (*fleet.AppleOSUpdateSettings, error) {
+					return &fleet.AppleOSUpdateSettings{}, nil
+				}
+				sur, err := svc.CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx, tt.machineInfo)
+				require.NoError(t, err)
+				require.Nil(t, sur)
+
+				ds.GetMDMAppleOSUpdatesSettingsByHostSerialFunc = func(ctx context.Context, serial string) (*fleet.AppleOSUpdateSettings, error) {
+					return &fleet.AppleOSUpdateSettings{
+						MinimumVersion: optjson.SetString(""),
+					}, nil
+				}
+				sur, err = svc.CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx, tt.machineInfo)
+				require.NoError(t, err)
+				require.Nil(t, sur)
+			})
+
+			t.Run("minimum not found", func(t *testing.T) {
+				ds.GetMDMAppleOSUpdatesSettingsByHostSerialFunc = func(ctx context.Context, serial string) (*fleet.AppleOSUpdateSettings, error) {
+					return nil, &notFoundError{}
+				}
+				sur, err := svc.CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx, tt.machineInfo)
+				require.NoError(t, err)
+				require.Nil(t, sur)
+			})
+		})
+	}
+
+	t.Run("gdmf server is down", func(t *testing.T) {
+		gdmf.Close()
+
+		for _, tt := range testCases {
+			t.Run(tt.name, func(t *testing.T) {
+				ds.GetMDMAppleOSUpdatesSettingsByHostSerialFunc = func(ctx context.Context, serial string) (*fleet.AppleOSUpdateSettings, error) {
+					return &fleet.AppleOSUpdateSettings{MinimumVersion: optjson.SetString(latestMacOSVersion)}, nil
+				}
+
+				sur, err := svc.CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx, tt.machineInfo)
+				if tt.err != "" {
+					require.Error(t, err)
+					require.Contains(t, err.Error(), tt.err) // still can get errors parsing the versions from the device info header or config settings
+				} else {
+					require.NoError(t, err)
+				}
+
+				require.Nil(t, sur) // if gdmf server is down, we don't enforce os updates for DEP
+			})
+		}
+	})
 }
diff --git a/server/service/calendar/calendar.go b/server/service/calendar/calendar.go
index 59c1784dd8b1..dbc7e9887631 100644
--- a/server/service/calendar/calendar.go
+++ b/server/service/calendar/calendar.go
@@ -4,10 +4,12 @@ package calendar
 
 import (
 	"context"
+	"crypto/sha256"
 	"fmt"
 	"strconv"
 	"strings"
 	"sync"
+	"time"
 
 	"github.com/fleetdm/fleet/v4/ee/server/calendar"
 	"github.com/fleetdm/fleet/v4/server/config"
@@ -16,13 +18,46 @@ import (
 	"github.com/go-kit/log/level"
 )
 
-type CalendarConfig struct {
+const (
+	LockKeyPrefix         = "calendar:lock:"
+	ReservedLockKeyPrefix = "calendar:reserved:"
+	RecentUpdateKeyPrefix = "calendar:recent_update:"
+	QueueKey              = "calendar:queue"
+	DefaultEventBodyTag   = "default"
+
+	// DistributedLockExpireMs is the time Redis will hold the lock before automatically releasing it.
+	// Our current max retry time for calendar API is 10 minutes, and multiple API calls (with their own retry timing) can be made during event processing.
+	// If a Fleet server gets the lock and is then shut down before releasing the lock, the next server may need to wait this long
+	// before getting the lock.
+	DistributedLockExpireMs = 20 * 60 * 1000
+	// ReserveLockExpireMs is used by cron job to guarantee that it gets the next lock.
+	ReserveLockExpireMs = 2 * DistributedLockExpireMs
+
+	// RecentCalendarUpdateValue is the value stored in Redis to indicate that a calendar event was recently updated.
+	RecentCalendarUpdateValue = "1"
+)
+
+// RecentCalendarUpdateDuration is the duration during which we will ignore a calendar event callback if the event in DB was just updated by a previous callback.
+// This reduces CPU load and Google API load. If we update the event, Google calendar may send a callback which we don't need to process.
+// We are using Redis instead of updated_at timestamp in DB because the calendar cron job may update the timestamp even when the event did not change, which could
+// cause us to miss a legitimate update.
+// This variable is exposed so that it can be modified by unit tests.
+var RecentCalendarUpdateDuration = 10 * time.Second
+
+type Config struct {
 	config.CalendarConfig
 	fleet.GoogleCalendarIntegration
 	ServerURL string
 }
 
-func CreateUserCalendarFromConfig(ctx context.Context, config *CalendarConfig, logger kitlog.Logger) fleet.UserCalendar {
+// PolicyLiteWithMeta is a wrapper around fleet.PolicyLite that includes a tag for policy's description/resolution.
+type PolicyLiteWithMeta struct {
+	fleet.PolicyLite
+	Tag string
+	mu  sync.Mutex
+}
+
+func CreateUserCalendarFromConfig(ctx context.Context, config *Config, logger kitlog.Logger) fleet.UserCalendar {
 	googleCalendarConfig := calendar.GoogleCalendarConfig{
 		Context:           ctx,
 		IntegrationConfig: &config.GoogleCalendarIntegration,
@@ -34,12 +69,12 @@ func CreateUserCalendarFromConfig(ctx context.Context, config *CalendarConfig, l
 
 func GenerateCalendarEventBody(ctx context.Context, ds fleet.Datastore, orgName string, host fleet.HostPolicyMembershipData,
 	policyIDtoPolicy *sync.Map, conflict bool, logger kitlog.Logger,
-) string {
-	description, resolution := getCalendarEventDescriptionAndResolution(ctx, ds, orgName, host, policyIDtoPolicy, logger)
+) (body string, tag string) {
+	description, resolution, tag := getCalendarEventDescriptionAndResolution(ctx, ds, orgName, host, policyIDtoPolicy, logger)
 
 	conflictStr := ""
 	if conflict {
-		conflictStr = "because there was no remaining availability "
+		conflictStr = fleet.CalendarEventConflictText
 	}
 	return fmt.Sprintf(`%s %s %s(%s).
 
@@ -50,47 +85,57 @@ Please leave your device on and connected to power.
 
 <b>What we'll do</b>
 %s
-`, orgName, fleet.CalendarBodyStaticHeader, conflictStr, host.HostDisplayName, description, resolution)
+`, orgName, fleet.CalendarBodyStaticHeader, conflictStr, host.HostDisplayName, description, resolution), tag
 }
 
 func getCalendarEventDescriptionAndResolution(ctx context.Context, ds fleet.Datastore, orgName string, host fleet.HostPolicyMembershipData,
 	policyIDtoPolicy *sync.Map, logger kitlog.Logger,
-) (string, string) {
+) (description string, resolution string, tag string) {
 	getDefaultDescription := func() string {
 		return fmt.Sprintf(`%s %s`, orgName, fleet.CalendarDefaultDescription)
 	}
 
-	var description, resolution string
 	policyIDs := strings.Split(host.FailingPolicyIDs, ",")
 	if len(policyIDs) == 1 && policyIDs[0] != "" {
-		var policy *fleet.PolicyLite
+		var policy *PolicyLiteWithMeta
 		policyAny, ok := policyIDtoPolicy.Load(policyIDs[0])
 		if !ok {
 			id, err := strconv.ParseUint(policyIDs[0], 10, 64)
 			if err != nil {
 				level.Error(logger).Log("msg", "parse policy id", "err", err)
-				return getDefaultDescription(), fleet.CalendarDefaultResolution
+				return getDefaultDescription(), fleet.CalendarDefaultResolution, DefaultEventBodyTag
 			}
-			policy, err = ds.PolicyLite(ctx, uint(id))
+			policyLite, err := ds.PolicyLite(ctx, uint(id))
 			if err != nil {
 				level.Error(logger).Log("msg", "get policy", "err", err)
-				return getDefaultDescription(), fleet.CalendarDefaultResolution
+				return getDefaultDescription(), fleet.CalendarDefaultResolution, DefaultEventBodyTag
 			}
+			policy = new(PolicyLiteWithMeta)
+			policy.PolicyLite = *policyLite
 			policyIDtoPolicy.Store(policyIDs[0], policy)
 		} else {
-			policy = policyAny.(*fleet.PolicyLite)
+			policy = policyAny.(*PolicyLiteWithMeta)
 		}
 		policyDescription := strings.TrimSpace(policy.Description)
 		if policyDescription == "" || policy.Resolution == nil || strings.TrimSpace(*policy.Resolution) == "" {
 			description = getDefaultDescription()
 			resolution = fleet.CalendarDefaultResolution
+			tag = DefaultEventBodyTag
 		} else {
 			description = policyDescription
 			resolution = strings.TrimSpace(*policy.Resolution)
+			policy.mu.Lock() // To make sure only one policy is reading/writing to the tag at a time.
+			defer policy.mu.Unlock()
+			if policy.Tag == "" {
+				// Calculate a unique signature for the event body, which we will use to check if the event body has changed.
+				policy.Tag = fmt.Sprintf("%x", sha256.Sum256([]byte(policy.Description+*policy.Resolution)))
+			}
+			tag = policy.Tag
 		}
 	} else {
 		description = getDefaultDescription()
 		resolution = fleet.CalendarDefaultResolution
+		tag = DefaultEventBodyTag
 	}
-	return description, resolution
+	return description, resolution, tag
 }
diff --git a/server/service/client.go b/server/service/client.go
index 82fee91585ef..61524f636fb5 100644
--- a/server/service/client.go
+++ b/server/service/client.go
@@ -14,12 +14,14 @@ import (
 	"time"
 
 	"golang.org/x/text/unicode/norm"
+	"gopkg.in/yaml.v2"
 
 	"github.com/fleetdm/fleet/v4/pkg/optjson"
 	"github.com/fleetdm/fleet/v4/pkg/spec"
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/mdm"
+	"github.com/fleetdm/fleet/v4/server/ptr"
 	kithttp "github.com/go-kit/kit/transport/http"
 )
 
@@ -393,8 +395,11 @@ func (c *Client) ApplyGroup(
 	specs *spec.Group,
 	baseDir string,
 	logf func(format string, args ...interface{}),
+	appconfig *fleet.EnrichedAppConfig,
 	opts fleet.ApplyClientSpecOptions,
-) (map[string]uint, error) {
+) (map[string]uint, map[string][]fleet.SoftwareInstaller, error) {
+	teamSoftwareInstallers := make(map[string][]fleet.SoftwareInstaller)
+
 	logfn := func(format string, args ...interface{}) {
 		if logf != nil {
 			logf(format, args...)
@@ -407,7 +412,7 @@ func (c *Client) ApplyGroup(
 			logfn("[!] ignoring queries, dry run mode only supported for 'config' and 'team' specs\n")
 		} else {
 			if err := c.ApplyQueries(specs.Queries); err != nil {
-				return nil, fmt.Errorf("applying queries: %w", err)
+				return nil, nil, fmt.Errorf("applying queries: %w", err)
 			}
 			logfn("[+] applied %d queries\n", len(specs.Queries))
 		}
@@ -418,42 +423,18 @@ func (c *Client) ApplyGroup(
 			logfn("[!] ignoring labels, dry run mode only supported for 'config' and 'team' specs\n")
 		} else {
 			if err := c.ApplyLabels(specs.Labels); err != nil {
-				return nil, fmt.Errorf("applying labels: %w", err)
+				return nil, nil, fmt.Errorf("applying labels: %w", err)
 			}
 			logfn("[+] applied %d labels\n", len(specs.Labels))
 		}
 	}
 
-	if len(specs.Policies) > 0 {
-		if opts.DryRun {
-			logfn("[!] ignoring policies, dry run mode only supported for 'config' and 'team' specs\n")
-		} else {
-			// Policy names must be unique, return error if duplicate policy names are found
-			if policyName := fleet.FirstDuplicatePolicySpecName(specs.Policies); policyName != "" {
-				return nil, fmt.Errorf(
-					"applying policies: policy names must be unique. Please correct policy %q and try again.", policyName,
-				)
-			}
-
-			// If set, override the team in all the policies.
-			if opts.TeamForPolicies != "" {
-				for _, policySpec := range specs.Policies {
-					policySpec.Team = opts.TeamForPolicies
-				}
-			}
-			if err := c.ApplyPolicies(specs.Policies); err != nil {
-				return nil, fmt.Errorf("applying policies: %w", err)
-			}
-			logfn("[+] applied %d policies\n", len(specs.Policies))
-		}
-	}
-
 	if len(specs.Packs) > 0 {
 		if opts.DryRun {
 			logfn("[!] ignoring packs, dry run mode only supported for 'config' and 'team' specs\n")
 		} else {
 			if err := c.ApplyPacks(specs.Packs); err != nil {
-				return nil, fmt.Errorf("applying packs: %w", err)
+				return nil, nil, fmt.Errorf("applying packs: %w", err)
 			}
 			logfn("[+] applied %d packs\n", len(specs.Packs))
 		}
@@ -473,7 +454,7 @@ func (c *Client) ApplyGroup(
 		if (windowsCustomSettings != nil && macosCustomSettings != nil) || len(windowsCustomSettings)+len(macosCustomSettings) > 0 {
 			fileContents, err := getProfilesContents(baseDir, macosCustomSettings, windowsCustomSettings, opts.ExpandEnvConfigProfiles)
 			if err != nil {
-				return nil, err
+				return nil, nil, err
 			}
 			// Figure out if MDM should be enabled.
 			assumeEnabled := false
@@ -487,30 +468,30 @@ func (c *Client) ApplyGroup(
 				}
 			}
 			if err := c.ApplyNoTeamProfiles(fileContents, opts.ApplySpecOptions, assumeEnabled); err != nil {
-				return nil, fmt.Errorf("applying custom settings: %w", err)
+				return nil, nil, fmt.Errorf("applying custom settings: %w", err)
 			}
 		}
 		if macosSetup := extractAppCfgMacOSSetup(specs.AppConfig); macosSetup != nil {
 			if macosSetup.BootstrapPackage.Value != "" {
 				pkg, err := c.ValidateBootstrapPackageFromURL(macosSetup.BootstrapPackage.Value)
 				if err != nil {
-					return nil, fmt.Errorf("applying fleet config: %w", err)
+					return nil, nil, fmt.Errorf("applying fleet config: %w", err)
 				}
 
 				if !opts.DryRun {
 					if err := c.EnsureBootstrapPackage(pkg, uint(0)); err != nil {
-						return nil, fmt.Errorf("applying fleet config: %w", err)
+						return nil, nil, fmt.Errorf("applying fleet config: %w", err)
 					}
 				}
 			}
 			if macosSetup.MacOSSetupAssistant.Value != "" {
 				content, err := c.validateMacOSSetupAssistant(resolveApplyRelativePath(baseDir, macosSetup.MacOSSetupAssistant.Value))
 				if err != nil {
-					return nil, fmt.Errorf("applying fleet config: %w", err)
+					return nil, nil, fmt.Errorf("applying fleet config: %w", err)
 				}
 				if !opts.DryRun {
 					if err := c.uploadMacOSSetupAssistant(content, nil, macosSetup.MacOSSetupAssistant.Value); err != nil {
-						return nil, fmt.Errorf("applying fleet config: %w", err)
+						return nil, nil, fmt.Errorf("applying fleet config: %w", err)
 					}
 				}
 			}
@@ -521,7 +502,7 @@ func (c *Client) ApplyGroup(
 			for i, f := range files {
 				b, err := os.ReadFile(f)
 				if err != nil {
-					return nil, fmt.Errorf("applying fleet config: %w", err)
+					return nil, nil, fmt.Errorf("applying fleet config: %w", err)
 				}
 				scriptPayloads[i] = fleet.ScriptPayload{
 					ScriptContents: b,
@@ -529,11 +510,11 @@ func (c *Client) ApplyGroup(
 				}
 			}
 			if err := c.ApplyNoTeamScripts(scriptPayloads, opts.ApplySpecOptions); err != nil {
-				return nil, fmt.Errorf("applying custom settings: %w", err)
+				return nil, nil, fmt.Errorf("applying custom settings: %w", err)
 			}
 		}
 		if err := c.ApplyAppConfig(specs.AppConfig, opts.ApplySpecOptions); err != nil {
-			return nil, fmt.Errorf("applying fleet config: %w", err)
+			return nil, nil, fmt.Errorf("applying fleet config: %w", err)
 		}
 		if opts.DryRun {
 			logfn("[+] would've applied fleet config\n")
@@ -544,7 +525,7 @@ func (c *Client) ApplyGroup(
 
 	if specs.EnrollSecret != nil {
 		if err := c.ApplyEnrollSecretSpec(specs.EnrollSecret, opts.ApplySpecOptions); err != nil {
-			return nil, fmt.Errorf("applying enroll secrets: %w", err)
+			return nil, nil, fmt.Errorf("applying enroll secrets: %w", err)
 		}
 		if opts.DryRun {
 			logfn("[+] would've applied enroll secrets\n")
@@ -563,7 +544,7 @@ func (c *Client) ApplyGroup(
 		for k, profileSpecs := range tmMDMSettings {
 			fileContents, err := getProfilesContents(baseDir, profileSpecs.macos, profileSpecs.windows, opts.ExpandEnvConfigProfiles)
 			if err != nil {
-				return nil, fmt.Errorf("Team %s: %w", k, err) // TODO: consider adding team name to improve error messages generally for other parts of the config because multiple team configs can be processed at once
+				return nil, nil, fmt.Errorf("Team %s: %w", k, err) // TODO: consider adding team name to improve error messages generally for other parts of the config because multiple team configs can be processed at once
 			}
 			tmFileContents[k] = fileContents
 		}
@@ -575,14 +556,14 @@ func (c *Client) ApplyGroup(
 			if setup.BootstrapPackage.Value != "" {
 				bp, err := c.ValidateBootstrapPackageFromURL(setup.BootstrapPackage.Value)
 				if err != nil {
-					return nil, fmt.Errorf("applying teams: %w", err)
+					return nil, nil, fmt.Errorf("applying teams: %w", err)
 				}
 				tmBootstrapPackages[k] = bp
 			}
 			if setup.MacOSSetupAssistant.Value != "" {
 				b, err := c.validateMacOSSetupAssistant(resolveApplyRelativePath(baseDir, setup.MacOSSetupAssistant.Value))
 				if err != nil {
-					return nil, fmt.Errorf("applying teams: %w", err)
+					return nil, nil, fmt.Errorf("applying teams: %w", err)
 				}
 				tmMacSetupAssistants[k] = b
 			}
@@ -596,7 +577,7 @@ func (c *Client) ApplyGroup(
 			for i, f := range files {
 				b, err := os.ReadFile(f)
 				if err != nil {
-					return nil, fmt.Errorf("applying fleet config: %w", err)
+					return nil, nil, fmt.Errorf("applying fleet config: %w", err)
 				}
 				scriptPayloads[i] = fleet.ScriptPayload{
 					ScriptContents: b,
@@ -606,64 +587,24 @@ func (c *Client) ApplyGroup(
 			tmScriptsPayloads[k] = scriptPayloads
 		}
 
-		tmSoftware := extractTmSpecsSoftware(specs.Teams)
-		tmSoftwarePayloads := make(map[string][]fleet.SoftwareInstallerPayload, len(tmScripts))
-		for tmName, software := range tmSoftware {
-			softwarePayloads := make([]fleet.SoftwareInstallerPayload, len(software))
-			for i, si := range software {
-				var qc string
-				var err error
-				if si.PreInstallQuery.Path != "" {
-					queryFile := resolveApplyRelativePath(baseDir, si.PreInstallQuery.Path)
-					rawSpec, err := os.ReadFile(queryFile)
-					if err != nil {
-						return nil, fmt.Errorf("reading pre-install query: %w", err)
-					}
-
-					group, err := spec.GroupFromBytes(rawSpec)
-					if err != nil {
-						return nil, fmt.Errorf("Couldn't edit software (%s). Unable to parse pre-install query YAML file %s: %w", si.URL, queryFile, err)
-					}
-
-					if len(group.Queries) > 1 {
-						return nil, fmt.Errorf("Couldn't edit software (%s). Pre-install query YAML file %s should have only one query.", si.URL, queryFile)
-					}
-
-					if len(group.Queries) == 0 {
-						return nil, fmt.Errorf("Couldn't edit software (%s). Pre-install query YAML file %s doesn't have a query defined.", si.URL, queryFile)
-					}
-
-					qc = group.Queries[0].Query
-				}
-
-				var ic []byte
-				if si.InstallScript.Path != "" {
-					installScriptFile := resolveApplyRelativePath(baseDir, si.InstallScript.Path)
-					ic, err = os.ReadFile(installScriptFile)
-					if err != nil {
-						return nil, fmt.Errorf("Couldn't edit software (%s). Unable to read install script file %s: %w", si.URL, si.InstallScript.Path, err)
-					}
-				}
-
-				var pc []byte
-				if si.PostInstallScript.Path != "" {
-					postInstallScriptFile := resolveApplyRelativePath(baseDir, si.PostInstallScript.Path)
-					pc, err = os.ReadFile(postInstallScriptFile)
-					if err != nil {
-						return nil, fmt.Errorf("Couldn't edit software (%s). Unable to read post-install script file %s: %w", si.URL, si.PostInstallScript.Path, err)
-					}
-				}
-
-				softwarePayloads[i] = fleet.SoftwareInstallerPayload{
-					URL:               si.URL,
-					SelfService:       si.SelfService,
-					PreInstallQuery:   qc,
-					InstallScript:     string(ic),
-					PostInstallScript: string(pc),
-				}
+		tmSoftwarePackages := extractTmSpecsSoftwarePackages(specs.Teams)
+		tmSoftwarePackagesPayloads := make(map[string][]fleet.SoftwareInstallerPayload, len(tmSoftwarePackages))
+		for tmName, software := range tmSoftwarePackages {
+			softwarePayloads, err := buildSoftwarePackagesPayload(baseDir, software)
+			if err != nil {
+				return nil, nil, fmt.Errorf("applying software installers for team %q: %w", tmName, err)
 			}
+			tmSoftwarePackagesPayloads[tmName] = softwarePayloads
+		}
 
-			tmSoftwarePayloads[tmName] = softwarePayloads
+		tmSoftwareApps := extractTmSpecsSoftwareApps(specs.Teams)
+		tmSoftwareAppsPayloads := make(map[string][]fleet.VPPBatchPayload)
+		for tmName, apps := range tmSoftwareApps {
+			appPayloads := make([]fleet.VPPBatchPayload, 0, len(apps))
+			for _, app := range apps {
+				appPayloads = append(appPayloads, fleet.VPPBatchPayload{AppStoreID: app.AppStoreID, SelfService: app.SelfService})
+			}
+			tmSoftwareAppsPayloads[tmName] = appPayloads
 		}
 
 		// Next, apply the teams specs before saving the profiles, so that any
@@ -676,7 +617,7 @@ func (c *Client) ApplyGroup(
 		// In dry-run, the team names returned are the old team names (when team name is modified via gitops)
 		teamIDsByName, err = c.ApplyTeams(specs.Teams, teamOpts)
 		if err != nil {
-			return nil, fmt.Errorf("applying teams: %w", err)
+			return nil, nil, fmt.Errorf("applying teams: %w", err)
 		}
 
 		// When using GitOps, the team name could change, so we need to check for that
@@ -703,7 +644,7 @@ func (c *Client) ApplyGroup(
 				} else {
 					logfn("[+] applying MDM profiles for team %s\n", tmName)
 					if err := c.ApplyTeamProfiles(currentTeamName, profs, teamOpts); err != nil {
-						return nil, fmt.Errorf("applying custom settings for team %q: %w", tmName, err)
+						return nil, nil, fmt.Errorf("applying custom settings for team %q: %w", tmName, err)
 					}
 				}
 			}
@@ -712,12 +653,12 @@ func (c *Client) ApplyGroup(
 			for tmName, tmID := range teamIDsByName {
 				if bp, ok := tmBootstrapPackages[tmName]; ok {
 					if err := c.EnsureBootstrapPackage(bp, tmID); err != nil {
-						return nil, fmt.Errorf("uploading bootstrap package for team %q: %w", tmName, err)
+						return nil, nil, fmt.Errorf("uploading bootstrap package for team %q: %w", tmName, err)
 					}
 				}
 				if b, ok := tmMacSetupAssistants[tmName]; ok {
 					if err := c.uploadMacOSSetupAssistant(b, &tmID, tmMacSetup[tmName].MacOSSetupAssistant.Value); err != nil {
-						return nil, fmt.Errorf("uploading macOS setup assistant for team %q: %w", tmName, err)
+						return nil, nil, fmt.Errorf("uploading macOS setup assistant for team %q: %w", tmName, err)
 					}
 				}
 			}
@@ -727,16 +668,28 @@ func (c *Client) ApplyGroup(
 				// For non-dry run, currentTeamName and tmName are the same
 				currentTeamName := getTeamName(tmName)
 				if err := c.ApplyTeamScripts(currentTeamName, scripts, opts.ApplySpecOptions); err != nil {
-					return nil, fmt.Errorf("applying scripts for team %q: %w", tmName, err)
+					return nil, nil, fmt.Errorf("applying scripts for team %q: %w", tmName, err)
 				}
 			}
 		}
-		if len(tmSoftwarePayloads) > 0 {
-			for tmName, software := range tmSoftwarePayloads {
+		if len(tmSoftwarePackagesPayloads) > 0 {
+			for tmName, software := range tmSoftwarePackagesPayloads {
 				// For non-dry run, currentTeamName and tmName are the same
 				currentTeamName := getTeamName(tmName)
-				if err := c.ApplyTeamSoftwareInstallers(currentTeamName, software, opts.ApplySpecOptions); err != nil {
-					return nil, fmt.Errorf("applying software installers for team %q: %w", tmName, err)
+				logfn("[+] applying software installers for team %s\n", tmName)
+				installers, err := c.ApplyTeamSoftwareInstallers(currentTeamName, software, opts.ApplySpecOptions)
+				if err != nil {
+					return nil, nil, fmt.Errorf("applying software installers for team %q: %w", tmName, err)
+				}
+				teamSoftwareInstallers[tmName] = installers
+			}
+		}
+		if len(tmSoftwareAppsPayloads) > 0 {
+			for tmName, apps := range tmSoftwareAppsPayloads {
+				// For non-dry run, currentTeamName and tmName are the same
+				currentTeamName := getTeamName(tmName)
+				if err := c.ApplyTeamAppStoreAppsAssociation(currentTeamName, apps, opts.ApplySpecOptions); err != nil {
+					return nil, nil, fmt.Errorf("applying app store apps for team: %q: %w", tmName, err)
 				}
 			}
 		}
@@ -747,17 +700,131 @@ func (c *Client) ApplyGroup(
 		}
 	}
 
+	// Policies can reference software installers thus they are applied at this point.
+	if len(specs.Policies) > 0 {
+		// Policy names must be unique, return error if duplicate policy names are found
+		if policyName := fleet.FirstDuplicatePolicySpecName(specs.Policies); policyName != "" {
+			return nil, nil, fmt.Errorf(
+				"applying policies: policy names must be unique. Please correct policy %q and try again.", policyName,
+			)
+		}
+		if opts.DryRun {
+			logfn("[!] ignoring policies, dry run mode only supported for 'config' and 'team' specs\n")
+		} else {
+			// If set, override the team in all the policies.
+			if opts.TeamForPolicies != "" {
+				for _, policySpec := range specs.Policies {
+					policySpec.Team = opts.TeamForPolicies
+				}
+			}
+			if err := c.ApplyPolicies(specs.Policies); err != nil {
+				return nil, nil, fmt.Errorf("applying policies: %w", err)
+			}
+			logfn("[+] applied %d policies\n", len(specs.Policies))
+		}
+	}
+
 	if specs.UsersRoles != nil {
 		if opts.DryRun {
 			logfn("[!] ignoring user roles, dry run mode only supported for 'config' and 'team' specs\n")
 		} else {
 			if err := c.ApplyUsersRoleSecretSpec(specs.UsersRoles); err != nil {
-				return nil, fmt.Errorf("applying user roles: %w", err)
+				return nil, nil, fmt.Errorf("applying user roles: %w", err)
 			}
 			logfn("[+] applied user roles\n")
 		}
 	}
-	return teamIDsByName, nil
+
+	return teamIDsByName, teamSoftwareInstallers, nil
+}
+
+func buildSoftwarePackagesPayload(baseDir string, specs []fleet.SoftwarePackageSpec) ([]fleet.SoftwareInstallerPayload, error) {
+	softwarePayloads := make([]fleet.SoftwareInstallerPayload, len(specs))
+	for i, si := range specs {
+		var qc string
+		var err error
+		if si.PreInstallQuery.Path != "" {
+			queryFile := resolveApplyRelativePath(baseDir, si.PreInstallQuery.Path)
+			rawSpec, err := os.ReadFile(queryFile)
+			if err != nil {
+				return nil, fmt.Errorf("reading pre-install query: %w", err)
+			}
+
+			rawSpecExpanded, err := spec.ExpandEnvBytes(rawSpec)
+			if err != nil {
+				return nil, fmt.Errorf("Couldn't exit software (%s). Unable to expand environment variable in YAML file %s: %w", si.URL, queryFile, err)
+			}
+
+			var top any
+
+			if err := yaml.Unmarshal(rawSpecExpanded, &top); err != nil {
+				return nil, fmt.Errorf("Couldn't exit software (%s). Unable to expand environment variable in YAML file %s: %w", si.URL, queryFile, err)
+			}
+
+			if _, ok := top.(map[any]any); ok {
+				// Old apply format
+				group, err := spec.GroupFromBytes(rawSpecExpanded)
+				if err != nil {
+					return nil, fmt.Errorf("Couldn't edit software (%s). Unable to parse pre-install apply format query YAML file %s: %w", si.URL, queryFile, err)
+				}
+
+				if len(group.Queries) > 1 {
+					return nil, fmt.Errorf("Couldn't edit software (%s). Pre-install query YAML file %s should have only one query.", si.URL, queryFile)
+				}
+
+				if len(group.Queries) == 0 {
+					return nil, fmt.Errorf("Couldn't edit software (%s). Pre-install query YAML file %s doesn't have a query defined.", si.URL, queryFile)
+				}
+
+				qc = group.Queries[0].Query
+			} else {
+				// Gitops format
+				var querySpecs []fleet.QuerySpec
+				if err := yaml.Unmarshal(rawSpecExpanded, &querySpecs); err != nil {
+					return nil, fmt.Errorf("Couldn't edit software (%s). Unable to parse pre-install query YAML file %s: %w", si.URL, queryFile, err)
+				}
+
+				if len(querySpecs) > 1 {
+					return nil, fmt.Errorf("Couldn't edit software (%s). Pre-install query YAML file %s should have only one query.", si.URL, queryFile)
+				}
+
+				if len(querySpecs) == 0 {
+					return nil, fmt.Errorf("Couldn't edit software (%s). Pre-install query YAML file %s doesn't have a query defined.", si.URL, queryFile)
+				}
+
+				qc = querySpecs[0].Query
+			}
+		}
+
+		var ic []byte
+		if si.InstallScript.Path != "" {
+			installScriptFile := resolveApplyRelativePath(baseDir, si.InstallScript.Path)
+			ic, err = os.ReadFile(installScriptFile)
+			if err != nil {
+				return nil, fmt.Errorf("Couldn't edit software (%s). Unable to read install script file %s: %w", si.URL, si.InstallScript.Path, err)
+			}
+		}
+
+		var pc []byte
+		if si.PostInstallScript.Path != "" {
+			postInstallScriptFile := resolveApplyRelativePath(baseDir, si.PostInstallScript.Path)
+			pc, err = os.ReadFile(postInstallScriptFile)
+			if err != nil {
+				return nil, fmt.Errorf("Couldn't edit software (%s). Unable to read post-install script file %s: %w", si.URL, si.PostInstallScript.Path, err)
+			}
+		}
+
+		softwarePayloads[i] = fleet.SoftwareInstallerPayload{
+			URL:               si.URL,
+			SelfService:       si.SelfService,
+			PreInstallQuery:   qc,
+			InstallScript:     string(ic),
+			PostInstallScript: string(pc),
+		}
+
+	}
+
+	return softwarePayloads, nil
 }
 
 func extractAppCfgMacOSSetup(appCfg any) *fleet.MacOSSetup {
@@ -995,8 +1062,43 @@ func extractTmSpecsMDMCustomSettings(tmSpecs []json.RawMessage) map[string]profi
 	return m
 }
 
-func extractTmSpecsSoftware(tmSpecs []json.RawMessage) map[string][]fleet.TeamSpecSoftware {
-	var m map[string][]fleet.TeamSpecSoftware
+func extractTmSpecsSoftwarePackages(tmSpecs []json.RawMessage) map[string][]fleet.SoftwarePackageSpec {
+	var m map[string][]fleet.SoftwarePackageSpec
+	for _, tm := range tmSpecs {
+		var spec struct {
+			Name     string          `json:"name"`
+			Software json.RawMessage `json:"software"`
+		}
+		if err := json.Unmarshal(tm, &spec); err != nil {
+			// ignore, this will fail in the call to apply team specs
+			continue
+		}
+		spec.Name = norm.NFC.String(spec.Name)
+		if spec.Name != "" && len(spec.Software) > 0 {
+			if m == nil {
+				m = make(map[string][]fleet.SoftwarePackageSpec)
+			}
+			var software fleet.SoftwareSpec
+			var packages []fleet.SoftwarePackageSpec
+			if err := json.Unmarshal(spec.Software, &software); err != nil {
+				// ignore, will fail in apply team specs call
+				continue
+			}
+			if !software.Packages.Valid {
+				// to be consistent with the AppConfig custom settings, set it to an
+				// empty slice if the provided custom settings are present but empty.
+				packages = []fleet.SoftwarePackageSpec{}
+			} else {
+				packages = software.Packages.Value
+			}
+			m[spec.Name] = packages
+		}
+	}
+	return m
+}
+
+func extractTmSpecsSoftwareApps(tmSpecs []json.RawMessage) map[string][]fleet.TeamSpecAppStoreApp {
+	var m map[string][]fleet.TeamSpecAppStoreApp
 	for _, tm := range tmSpecs {
 		var spec struct {
 			Name     string          `json:"name"`
@@ -1009,19 +1111,22 @@ func extractTmSpecsSoftware(tmSpecs []json.RawMessage) map[string][]fleet.TeamSp
 		spec.Name = norm.NFC.String(spec.Name)
 		if spec.Name != "" && len(spec.Software) > 0 {
 			if m == nil {
-				m = make(map[string][]fleet.TeamSpecSoftware)
+				m = make(map[string][]fleet.TeamSpecAppStoreApp)
 			}
-			var software []fleet.TeamSpecSoftware
+			var software fleet.SoftwareSpec
+			var apps []fleet.TeamSpecAppStoreApp
 			if err := json.Unmarshal(spec.Software, &software); err != nil {
 				// ignore, will fail in apply team specs call
 				continue
 			}
-			if software == nil {
+			if !software.AppStoreApps.Valid {
 				// to be consistent with the AppConfig custom settings, set it to an
 				// empty slice if the provided custom settings are present but empty.
-				software = []fleet.TeamSpecSoftware{}
+				apps = []fleet.TeamSpecAppStoreApp{}
+			} else {
+				apps = software.AppStoreApps.Value
 			}
-			m[spec.Name] = software
+			m[spec.Name] = apps
 		}
 	}
 	return m
@@ -1167,6 +1272,8 @@ func (c *Client) DoGitOps(
 			}
 		}
 		group.AppConfig.(map[string]interface{})["scripts"] = scripts
+
+		group.Software = config.Software.Packages
 	} else {
 		team = make(map[string]interface{})
 		team["name"] = *config.TeamName
@@ -1178,14 +1285,20 @@ func (c *Client) DoGitOps(
 			team["features"] = features
 		}
 		team["scripts"] = scripts
-		team["software"] = config.Software
+		team["software"] = map[string]any{}
+		team["software"].(map[string]any)["app_store_apps"] = config.Software.AppStoreApps
+		team["software"].(map[string]any)["packages"] = config.Software.Packages
 		team["secrets"] = config.TeamSettings["secrets"]
 		team["webhook_settings"] = map[string]interface{}{}
 		clearHostStatusWebhook := true
 		if webhookSettings, ok := config.TeamSettings["webhook_settings"]; ok {
-			if hostStatusWebhook, ok := webhookSettings.(map[string]interface{})["host_status_webhook"]; ok {
-				clearHostStatusWebhook = false
-				team["webhook_settings"].(map[string]interface{})["host_status_webhook"] = hostStatusWebhook
+			if _, ok := webhookSettings.(map[string]interface{}); ok {
+				if hostStatusWebhook, ok := webhookSettings.(map[string]interface{})["host_status_webhook"]; ok {
+					clearHostStatusWebhook = false
+					team["webhook_settings"].(map[string]interface{})["host_status_webhook"] = hostStatusWebhook
+				}
+			} else if webhookSettings != nil {
+				return nil, fmt.Errorf("team_settings.webhook_settings config is not a map but a %T", webhookSettings)
 			}
 		}
 		if clearHostStatusWebhook {
@@ -1239,6 +1352,32 @@ func (c *Client) DoGitOps(
 	if deadline, ok := macOSUpdates["deadline"]; !ok || deadline == nil {
 		macOSUpdates["deadline"] = ""
 	}
+	// Put in default values for ios_updates
+	if config.Controls.IOSUpdates != nil {
+		mdmAppConfig["ios_updates"] = config.Controls.IOSUpdates
+	} else {
+		mdmAppConfig["ios_updates"] = map[string]interface{}{}
+	}
+	iOSUpdates := mdmAppConfig["ios_updates"].(map[string]interface{})
+	if minimumVersion, ok := iOSUpdates["minimum_version"]; !ok || minimumVersion == nil {
+		iOSUpdates["minimum_version"] = ""
+	}
+	if deadline, ok := iOSUpdates["deadline"]; !ok || deadline == nil {
+		iOSUpdates["deadline"] = ""
+	}
+	// Put in default values for ipados_updates
+	if config.Controls.IPadOSUpdates != nil {
+		mdmAppConfig["ipados_updates"] = config.Controls.IPadOSUpdates
+	} else {
+		mdmAppConfig["ipados_updates"] = map[string]interface{}{}
+	}
+	iPadOSUpdates := mdmAppConfig["ipados_updates"].(map[string]interface{})
+	if minimumVersion, ok := iPadOSUpdates["minimum_version"]; !ok || minimumVersion == nil {
+		iPadOSUpdates["minimum_version"] = ""
+	}
+	if deadline, ok := iPadOSUpdates["deadline"]; !ok || deadline == nil {
+		iPadOSUpdates["deadline"] = ""
+	}
 	// Put in default values for macos_setup
 	if config.Controls.MacOSSetup != nil {
 		mdmAppConfig["macos_setup"] = config.Controls.MacOSSetup
@@ -1296,8 +1435,8 @@ func (c *Client) DoGitOps(
 		group.TeamsDryRunAssumptions = teamDryRunAssumptions
 	}
 
-	// Apply org settings, scripts, enroll secrets, and controls
-	teamIDsByName, err := c.ApplyGroup(ctx, &group, baseDir, logf, fleet.ApplyClientSpecOptions{
+	// Apply org settings, scripts, enroll secrets, team entities (software, scripts, etc.), and controls.
+	teamIDsByName, teamsSoftwareInstallers, err := c.ApplyGroup(ctx, &group, baseDir, logf, appConfig, fleet.ApplyClientSpecOptions{
 		ApplySpecOptions: fleet.ApplySpecOptions{
 			DryRun: dryRun,
 		},
@@ -1306,6 +1445,7 @@ func (c *Client) DoGitOps(
 	if err != nil {
 		return nil, err
 	}
+	var teamSoftwareInstallers []fleet.SoftwareInstaller
 	if config.TeamName != nil {
 		if len(teamIDsByName) != 1 {
 			return nil, fmt.Errorf("expected 1 team spec to be applied, got %d", len(teamIDsByName))
@@ -1321,9 +1461,14 @@ func (c *Client) DoGitOps(
 		for _, teamID = range teamIDsByName {
 			config.TeamID = &teamID
 		}
+		teamSoftwareInstallers = teamsSoftwareInstallers[*config.TeamName]
+	}
+
+	if _, err = c.doGitOpsNoTeamSoftware(group, baseDir, appConfig, logFn, dryRun); err != nil {
+		return nil, err
 	}
 
-	err = c.doGitOpsPolicies(config, logFn, dryRun)
+	err = c.doGitOpsPolicies(config, teamSoftwareInstallers, logFn, dryRun)
 	if err != nil {
 		return nil, err
 	}
@@ -1336,12 +1481,74 @@ func (c *Client) DoGitOps(
 	return teamAssumptions, nil
 }
 
-func (c *Client) doGitOpsPolicies(config *spec.GitOps, logFn func(format string, args ...interface{}), dryRun bool) error {
+func (c *Client) doGitOpsNoTeamSoftware(specs spec.Group, baseDir string, appconfig *fleet.EnrichedAppConfig, logFn func(format string, args ...interface{}), dryRun bool) ([]fleet.SoftwareInstaller, error) {
+	var softwareInstallers []fleet.SoftwareInstaller
+	if len(specs.Teams) == 0 && appconfig != nil && appconfig.License.IsPremium() {
+		packages := make([]fleet.SoftwarePackageSpec, 0, len(specs.Software))
+		for _, software := range specs.Software {
+			if software != nil {
+				packages = append(packages, *software)
+			}
+		}
+		payload, err := buildSoftwarePackagesPayload(baseDir, packages)
+		if err != nil {
+			return nil, fmt.Errorf("applying software installers: %w", err)
+		}
+		softwareInstallers, err = c.ApplyNoTeamSoftwareInstallers(payload, fleet.ApplySpecOptions{DryRun: dryRun})
+		if err != nil {
+			return nil, fmt.Errorf("applying software installers: %w", err)
+		}
+
+		if dryRun {
+			logFn("[+] would've applied 'No Team' software installers\n")
+		} else {
+			logFn("[+] applied 'No Team' software installers\n")
+		}
+	}
+	return softwareInstallers, nil
+}
+
+func (c *Client) doGitOpsPolicies(config *spec.GitOps, teamSoftwareInstallers []fleet.SoftwareInstaller, logFn func(format string, args ...interface{}), dryRun bool) error {
+	// Get software titles of packages for the team.
+	if config.TeamID != nil {
+		softwareTitleURLs := make(map[string]uint)
+		for _, softwareInstaller := range teamSoftwareInstallers {
+			if softwareInstaller.URL == "" {
+				// Should not happen because we previously applied packages via gitops, but to not panic we just log a warning.
+				logFn("[!] software installer without url: %s\n", softwareInstaller.Name)
+				continue
+			}
+			if softwareInstaller.TitleID == nil {
+				// Should not happen, but to not panic we just log a warning.
+				logFn("[!] software installer without title id: %s\n", softwareInstaller.Name)
+				continue
+			}
+			softwareTitleURLs[softwareInstaller.URL] = *softwareInstaller.TitleID
+		}
+		for i := range config.Policies {
+			config.Policies[i].SoftwareTitleID = ptr.Uint(0) // 0 unsets the installer
+
+			if config.Policies[i].InstallSoftware == nil {
+				continue
+			}
+			softwareTitleID, ok := softwareTitleURLs[config.Policies[i].InstallSoftwareURL]
+			if !ok {
+				// Should not happen because software packages are uploaded first.
+				if !dryRun {
+					logFn("[!] software URL without software title id: %s\n", config.Policies[i].InstallSoftwareURL)
+				}
+				continue
+			}
+			config.Policies[i].SoftwareTitleID = &softwareTitleID
+		}
+	}
+
 	// Get the ids and names of current policies to figure out which ones to delete
 	policies, err := c.GetPolicies(config.TeamID)
 	if err != nil {
 		return fmt.Errorf("error getting current policies: %w", err)
 	}
+
 	if len(config.Policies) > 0 {
 		numPolicies := len(config.Policies)
 		logFn("[+] syncing %d policies\n", numPolicies)
@@ -1354,7 +1561,12 @@ func (c *Client) doGitOpsPolicies(config *spec.GitOps, logFn func(format string,
 				}
 				totalApplied += end - i
 				// Note: We are reusing the spec flow here for adding/updating policies, instead of creating a new flow for GitOps.
-				if err := c.ApplyPolicies(config.Policies[i:end]); err != nil {
+				policiesToApply := config.Policies[i:end]
+				policiesSpec := make([]*fleet.PolicySpec, len(policiesToApply))
+				for i := range policiesToApply {
+					policiesSpec[i] = &policiesToApply[i].PolicySpec
+				}
+				if err := c.ApplyPolicies(policiesSpec); err != nil {
 					return fmt.Errorf("error applying policies: %w", err)
 				}
 				logFn("[+] synced %d policies\n", totalApplied)
diff --git a/server/service/client_scripts.go b/server/service/client_scripts.go
index 373b3b1ebd95..faa488cea417 100644
--- a/server/service/client_scripts.go
+++ b/server/service/client_scripts.go
@@ -7,13 +7,25 @@ import (
 	"io"
 	"net/http"
 	"strings"
+	"time"
 
 	"github.com/fleetdm/fleet/v4/server/fleet"
 )
 
+const pollWaitTime = 5 * time.Second
+
 func (c *Client) RunHostScriptSync(hostID uint, scriptContents []byte, scriptName string, teamID uint) (*fleet.HostScriptResult, error) {
-	verb, path := "POST", "/api/latest/fleet/scripts/run/sync"
-	return c.runHostScript(verb, path, hostID, scriptContents, scriptName, teamID, http.StatusOK)
+	verb, path := "POST", "/api/latest/fleet/scripts/run"
+	res, err := c.runHostScript(verb, path, hostID, scriptContents, scriptName, teamID, http.StatusAccepted)
+	if err != nil {
+		return nil, err
+	}
+
+	if res.ExecutionID == "" {
+		return nil, errors.New("missing execution id in response")
+	}
+
+	return c.pollForResult(res.ExecutionID)
 }
 
 func (c *Client) RunHostScriptAsync(hostID uint, scriptContents []byte, scriptName string, teamID uint) (*fleet.HostScriptResult, error) {
@@ -81,6 +93,43 @@ func (c *Client) runHostScript(verb, path string, hostID uint, scriptContents []
 	return &result, nil
 }
 
+func (c *Client) pollForResult(id string) (*fleet.HostScriptResult, error) {
+	verb, path := "GET", fmt.Sprintf("/api/latest/fleet/scripts/results/%s", id)
+	var result *fleet.HostScriptResult
+	for {
+		res, err := c.AuthenticatedDo(verb, path, "", nil)
+		if err != nil {
+			return nil, fmt.Errorf("polling for result: %w", err)
+		}
+		defer res.Body.Close()
+
+		if res.StatusCode != http.StatusOK && res.StatusCode != http.StatusNotFound {
+
+			msg, err := extractServerErrMsg(verb, path, res)
+			if err != nil {
+				return nil, fmt.Errorf("extracting error message: %w", err)
+			}
+			if msg == "" {
+				msg = fmt.Sprintf("decoding %d response is missing expected message.", res.StatusCode)
+			}
+			return nil, errors.New(msg)
+		}
+
+		if err := json.NewDecoder(res.Body).Decode(&result); err != nil {
+			return nil, fmt.Errorf("decoding response: %w", err)
+		}
+
+		if result.ExitCode != nil {
+			break
+		}
+
+		time.Sleep(pollWaitTime)
+
+	}
+
+	return result, nil
+}
+
 // ApplyNoTeamScripts sends the list of scripts to be applied for the hosts in
 // no team.
 func (c *Client) ApplyNoTeamScripts(scripts []fleet.ScriptPayload, opts fleet.ApplySpecOptions) error {
diff --git a/server/service/client_software.go b/server/service/client_software.go
index 22c602e96c03..acf402732e9a 100644
--- a/server/service/client_software.go
+++ b/server/service/client_software.go
@@ -1,6 +1,8 @@
 package service
 
 import (
+	"net/url"
+
 	"github.com/fleetdm/fleet/v4/server/fleet"
 )
 
@@ -25,3 +27,16 @@ func (c *Client) ListSoftwareTitles(query string) ([]fleet.SoftwareTitleListResu
 	}
 	return responseBody.SoftwareTitles, nil
 }
+
+func (c *Client) ApplyNoTeamSoftwareInstallers(softwareInstallers []fleet.SoftwareInstallerPayload, opts fleet.ApplySpecOptions) ([]fleet.SoftwareInstaller, error) {
+	verb, path := "POST", "/api/latest/fleet/software/batch"
+	query, err := url.ParseQuery(opts.RawQuery())
+	if err != nil {
+		return nil, err
+	}
+	var resp batchSetSoftwareInstallersResponse
+	if err := c.authenticatedRequestWithQuery(map[string]interface{}{"software": softwareInstallers}, verb, path, &resp, query.Encode()); err != nil {
+		return nil, err
+	}
+	return resp.Installers, nil
+}
diff --git a/server/service/client_teams.go b/server/service/client_teams.go
index 8acbd0998ee9..da9332067a53 100644
--- a/server/service/client_teams.go
+++ b/server/service/client_teams.go
@@ -93,12 +93,26 @@ func (c *Client) ApplyTeamScripts(tmName string, scripts []fleet.ScriptPayload,
 	return c.authenticatedRequestWithQuery(map[string]interface{}{"scripts": scripts}, verb, path, nil, query.Encode())
 }
 
-func (c *Client) ApplyTeamSoftwareInstallers(tmName string, softwareInstallers []fleet.SoftwareInstallerPayload, opts fleet.ApplySpecOptions) error {
+func (c *Client) ApplyTeamSoftwareInstallers(tmName string, softwareInstallers []fleet.SoftwareInstallerPayload, opts fleet.ApplySpecOptions) ([]fleet.SoftwareInstaller, error) {
 	verb, path := "POST", "/api/latest/fleet/software/batch"
 	query, err := url.ParseQuery(opts.RawQuery())
+	if err != nil {
+		return nil, err
+	}
+	query.Add("team_name", tmName)
+	var resp batchSetSoftwareInstallersResponse
+	if err := c.authenticatedRequestWithQuery(map[string]interface{}{"software": softwareInstallers}, verb, path, &resp, query.Encode()); err != nil {
+		return nil, err
+	}
+	return resp.Installers, nil
+}
+
+func (c *Client) ApplyTeamAppStoreAppsAssociation(tmName string, vppBatchPayload []fleet.VPPBatchPayload, opts fleet.ApplySpecOptions) error {
+	verb, path := "POST", "/api/latest/fleet/software/app_store_apps/batch"
+	query, err := url.ParseQuery(opts.RawQuery())
 	if err != nil {
 		return err
 	}
 	query.Add("team_name", tmName)
-	return c.authenticatedRequestWithQuery(map[string]interface{}{"software": softwareInstallers}, verb, path, nil, query.Encode())
+	return c.authenticatedRequestWithQuery(map[string]interface{}{"app_store_apps": vppBatchPayload}, verb, path, nil, query.Encode())
 }
diff --git a/server/service/devices.go b/server/service/devices.go
index 31e9889cb58a..288fbb304e0a 100644
--- a/server/service/devices.go
+++ b/server/service/devices.go
@@ -564,41 +564,6 @@ func (svc *Service) GetDeviceMDMAppleEnrollmentProfile(ctx context.Context) ([]b
 	return signed, nil
 }
 
-////////////////////////////////////////////////////////////////////////////////
-// Request a disk encryption reset
-////////////////////////////////////////////////////////////////////////////////
-
-type rotateEncryptionKeyRequest struct {
-	Token string `url:"token"`
-}
-
-func (r *rotateEncryptionKeyRequest) deviceAuthToken() string {
-	return r.Token
-}
-
-type rotateEncryptionKeyResponse struct {
-	Err error `json:"error,omitempty"`
-}
-
-func (r rotateEncryptionKeyResponse) error() error { return r.Err }
-
-func rotateEncryptionKeyEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
-	host, ok := hostctx.FromContext(ctx)
-	if !ok {
-		err := ctxerr.Wrap(ctx, fleet.NewAuthRequiredError("internal error: missing host from request context"))
-		return rotateEncryptionKeyResponse{Err: err}, nil
-	}
-
-	if err := svc.RequestEncryptionKeyRotation(ctx, host.ID); err != nil {
-		return rotateEncryptionKeyResponse{Err: err}, nil
-	}
-	return rotateEncryptionKeyResponse{}, nil
-}
-
-func (svc *Service) RequestEncryptionKeyRotation(ctx context.Context, hostID uint) error {
-	return fleet.ErrMissingLicense
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 // Signal start of mdm migration on a device
 ////////////////////////////////////////////////////////////////////////////////
diff --git a/server/service/endpoint_utils.go b/server/service/endpoint_utils.go
index 13d4f005682e..055eb2cba1a8 100644
--- a/server/service/endpoint_utils.go
+++ b/server/service/endpoint_utils.go
@@ -273,6 +273,12 @@ func makeDecoder(iface interface{}) kithttp.DecodeRequestFunc {
 						return nil, badRequestErr("parsing uint from query", err)
 					}
 					field.SetUint(uint64(queryValUint))
+				case reflect.Float64:
+					queryValFloat, err := strconv.ParseFloat(queryVal, 64)
+					if err != nil {
+						return nil, badRequestErr("parsing float from query", err)
+					}
+					field.SetFloat(queryValFloat)
 				case reflect.Bool:
 					field.SetBool(queryVal == "1" || queryVal == "true")
 				case reflect.Int:
@@ -442,9 +448,12 @@ var pathReplacer = strings.NewReplacer(
 	"}", "_",
 )
 
-func getNameFromPathAndVerb(verb, path string) string {
-	return strings.ToLower(verb) + "_" +
-		pathReplacer.Replace(strings.TrimPrefix(strings.TrimRight(path, "/"), "/api/_version_/fleet/"))
+func getNameFromPathAndVerb(verb, path, startAt string) string {
+	prefix := strings.ToLower(verb) + "_"
+	if startAt != "" {
+		prefix += pathReplacer.Replace(startAt) + "_"
+	}
+	return prefix + pathReplacer.Replace(strings.TrimPrefix(strings.TrimRight(path, "/"), "/api/_version_/fleet/"))
 }
 
 func capabilitiesResponseFunc(capabilities fleet.CapabilityMap) kithttp.ServerOption {
@@ -554,14 +563,14 @@ func (e *authEndpointer) handlePathHandler(path string, pathHandler func(path st
 	}
 
 	versionedPath := strings.Replace(path, "/_version_/", fmt.Sprintf("/{fleetversion:(?:%s)}/", strings.Join(versions, "|")), 1)
-	nameAndVerb := getNameFromPathAndVerb(verb, path)
+	nameAndVerb := getNameFromPathAndVerb(verb, path, e.startingAtVersion)
 	if e.usePathPrefix {
 		e.r.PathPrefix(versionedPath).Handler(pathHandler(versionedPath)).Name(nameAndVerb).Methods(verb)
 	} else {
 		e.r.Handle(versionedPath, pathHandler(versionedPath)).Name(nameAndVerb).Methods(verb)
 	}
 	for _, alias := range e.alternativePaths {
-		nameAndVerb := getNameFromPathAndVerb(verb, alias)
+		nameAndVerb := getNameFromPathAndVerb(verb, alias, e.startingAtVersion)
 		versionedPath := strings.Replace(alias, "/_version_/", fmt.Sprintf("/{fleetversion:(?:%s)}/", strings.Join(versions, "|")), 1)
 		if e.usePathPrefix {
 			e.r.PathPrefix(versionedPath).Handler(pathHandler(versionedPath)).Name(nameAndVerb).Methods(verb)
diff --git a/server/service/frontend.go b/server/service/frontend.go
index f5d884ec1fe0..a2a6058b5459 100644
--- a/server/service/frontend.go
+++ b/server/service/frontend.go
@@ -1,9 +1,11 @@
 package service
 
 import (
+	"fmt"
 	"html/template"
 	"io"
 	"net/http"
+	"net/url"
 
 	assetfs "github.com/elazarl/go-bindata-assetfs"
 	"github.com/fleetdm/fleet/v4/server/bindata"
@@ -68,6 +70,69 @@ func ServeFrontend(urlPrefix string, sandbox bool, logger log.Logger) http.Handl
 	})
 }
 
+func ServeEndUserEnrollOTA(urlPrefix string, logger log.Logger) http.Handler {
+	herr := func(w http.ResponseWriter, err string) {
+		logger.Log("err", err)
+		http.Error(w, err, http.StatusInternalServerError)
+	}
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		writeBrowserSecurityHeaders(w)
+
+		fs := newBinaryFileSystem("/frontend")
+		file, err := fs.Open("templates/enroll-ota.html")
+		if err != nil {
+			herr(w, "load enroll ota template: "+err.Error())
+			return
+		}
+
+		data, err := io.ReadAll(file)
+		if err != nil {
+			herr(w, "read bindata file: "+err.Error())
+			return
+		}
+
+		t, err := template.New("enroll-ota").Parse(string(data))
+		if err != nil {
+			herr(w, "create react template: "+err.Error())
+			return
+		}
+
+		enrollURL, err := generateEnrollOTAURL(urlPrefix, r.URL.Query().Get("enroll_secret"))
+		if err != nil {
+			herr(w, "generate enroll ota url: "+err.Error())
+			return
+		}
+		if err := t.Execute(w, struct {
+			EnrollURL string
+			URLPrefix string
+		}{
+			URLPrefix: urlPrefix,
+			EnrollURL: enrollURL,
+		}); err != nil {
+			herr(w, "execute react template: "+err.Error())
+			return
+		}
+	})
+}
+
+func generateEnrollOTAURL(fleetURL string, enrollSecret string) (string, error) {
+	path, err := url.JoinPath(fleetURL, "/api/v1/fleet/enrollment_profiles/ota")
+	if err != nil {
+		return "", fmt.Errorf("creating path for end user ota enrollment url: %w", err)
+	}
+
+	enrollURL, err := url.Parse(path)
+	if err != nil {
+		return "", fmt.Errorf("parsing end user ota enrollment url: %w", err)
+	}
+
+	q := enrollURL.Query()
+	q.Set("enroll_secret", enrollSecret)
+	enrollURL.RawQuery = q.Encode()
+	return enrollURL.String(), nil
+}
+
 func ServeStaticAssets(path string) http.Handler {
 	return http.StripPrefix(path, http.FileServer(newBinaryFileSystem("/assets")))
 }
diff --git a/server/service/frontend_test.go b/server/service/frontend_test.go
index 32363d6dd833..2710b69e9db0 100644
--- a/server/service/frontend_test.go
+++ b/server/service/frontend_test.go
@@ -2,6 +2,7 @@ package service
 
 import (
 	"bytes"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -40,3 +41,29 @@ func TestServeFrontend(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, http.StatusMethodNotAllowed, response.StatusCode)
 }
+
+func TestServeEndUserEnrollOTA(t *testing.T) {
+	if !hasBuildTag("full") {
+		t.Skip("This test requires running with -tags full")
+	}
+	logger := log.NewLogfmtLogger(os.Stdout)
+	h := ServeEndUserEnrollOTA("", logger)
+	ts := httptest.NewServer(h)
+	t.Cleanup(func() {
+		ts.Close()
+	})
+
+	// assert html is returned
+	response, err := http.DefaultClient.Get(ts.URL + "?enroll_secret=foo")
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, response.StatusCode)
+	require.Equal(t, response.Header.Get("Content-Type"), "text/html; charset=utf-8")
+
+	// assert it contains the content we expect
+	defer response.Body.Close()
+	bodyBytes, err := io.ReadAll(response.Body)
+	require.NoError(t, err)
+	bodyString := string(bodyBytes)
+	require.Contains(t, bodyString, "Enroll your device to Fleet")
+	require.Contains(t, bodyString, "?enroll_secret=foo")
+}
diff --git a/server/service/global_policies.go b/server/service/global_policies.go
index c7d03e969547..ed0ef22013f4 100644
--- a/server/service/global_policies.go
+++ b/server/service/global_policies.go
@@ -6,12 +6,12 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
 	"io"
 	"net/http"
 	"strings"
 	"time"
 
+	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
 	"github.com/fleetdm/fleet/v4/server/authz"
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/contexts/license"
@@ -155,6 +155,9 @@ func (svc Service) GetPolicyByIDQueries(ctx context.Context, policyID uint) (*fl
 	if err != nil {
 		return nil, err
 	}
+	if err := svc.populatePolicyInstallSoftware(ctx, policy); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "populate install_software")
+	}
 
 	return policy, nil
 }
@@ -583,8 +586,10 @@ func autofillPoliciesEndpoint(ctx context.Context, request interface{}, svc flee
 }
 
 // Exposing external URL and timeout for testing purposes
-var getHumanInterpretationFromOsquerySqlUrl = "https://fleetdm.com/api/v1/get-human-interpretation-from-osquery-sql"
-var getHumanInterpretationFromOsquerySqlTimeout = 30 * time.Second
+var (
+	getHumanInterpretationFromOsquerySqlUrl     = "https://fleetdm.com/api/v1/get-human-interpretation-from-osquery-sql"
+	getHumanInterpretationFromOsquerySqlTimeout = 30 * time.Second
+)
 
 type AutofillError struct {
 	Message     string
diff --git a/server/service/handler.go b/server/service/handler.go
index 66709d72f51d..23b30a346195 100644
--- a/server/service/handler.go
+++ b/server/service/handler.go
@@ -370,12 +370,18 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
 	ue.POST("/api/_version_/fleet/hosts/{host_id:[0-9]+}/software/install/{software_title_id:[0-9]+}", installSoftwareTitleEndpoint, installSoftwareRequest{})
 
 	// Sofware installers
-	ue.GET("/api/_version_/fleet/software/{title_id:[0-9]+}/package", getSoftwareInstallerEndpoint, getSoftwareInstallerRequest{})
+	ue.GET("/api/_version_/fleet/software/titles/{title_id:[0-9]+}/package", getSoftwareInstallerEndpoint, getSoftwareInstallerRequest{})
+	ue.POST("/api/_version_/fleet/software/titles/{title_id:[0-9]+}/package/token", getSoftwareInstallerTokenEndpoint,
+		getSoftwareInstallerRequest{})
 	ue.POST("/api/_version_/fleet/software/package", uploadSoftwareInstallerEndpoint, uploadSoftwareInstallerRequest{})
-	ue.DELETE("/api/_version_/fleet/software/{title_id:[0-9]+}/package", deleteSoftwareInstallerEndpoint, deleteSoftwareInstallerRequest{})
+	ue.DELETE("/api/_version_/fleet/software/titles/{title_id:[0-9]+}/available_for_install", deleteSoftwareInstallerEndpoint, deleteSoftwareInstallerRequest{})
 	ue.GET("/api/_version_/fleet/software/install/results/{install_uuid}", getSoftwareInstallResultsEndpoint, getSoftwareInstallResultsRequest{})
 	ue.POST("/api/_version_/fleet/software/batch", batchSetSoftwareInstallersEndpoint, batchSetSoftwareInstallersRequest{})
 
+	// App store software
+	ue.GET("/api/_version_/fleet/software/app_store_apps", getAppStoreAppsEndpoint, getAppStoreAppsRequest{})
+	ue.POST("/api/_version_/fleet/software/app_store_apps", addAppStoreAppEndpoint, addAppStoreAppRequest{})
+
 	// Vulnerabilities
 	ue.GET("/api/_version_/fleet/vulnerabilities", listVulnerabilitiesEndpoint, listVulnerabilitiesRequest{})
 	ue.GET("/api/_version_/fleet/vulnerabilities/{cve}", getVulnerabilityEndpoint, getVulnerabilityRequest{})
@@ -555,7 +561,6 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
 	mdmAppleMW.DELETE("/api/_version_/fleet/mdm/apple/installers/{installer_id:[0-9]+}", deleteAppleInstallerEndpoint, deleteAppleInstallerDetailsRequest{})
 	mdmAppleMW.GET("/api/_version_/fleet/mdm/apple/installers", listMDMAppleInstallersEndpoint, listMDMAppleInstallersRequest{})
 	mdmAppleMW.GET("/api/_version_/fleet/mdm/apple/devices", listMDMAppleDevicesEndpoint, listMDMAppleDevicesRequest{})
-	mdmAppleMW.GET("/api/_version_/fleet/mdm/apple/dep/devices", listMDMAppleDEPDevicesEndpoint, listMDMAppleDEPDevicesRequest{})
 
 	// Deprecated: GET /mdm/manual_enrollment_profile is now deprecated, replaced by the
 	// GET /enrollment_profiles/manual endpoint.
@@ -717,16 +722,30 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
 	// new flow described in https://github.com/fleetdm/fleet/issues/10383
 	ue.POST("/api/_version_/fleet/mdm/apple/dep/key_pair", newMDMAppleDEPKeyPairEndpoint, nil)
 	ue.GET("/api/_version_/fleet/mdm/apple/abm_public_key", generateABMKeyPairEndpoint, nil)
-	ue.POST("/api/_version_/fleet/mdm/apple/abm_token", uploadABMTokenEndpoint, uploadABMTokenRequest{})
-	ue.DELETE("/api/_version_/fleet/mdm/apple/abm_token", disableABMEndpoint, nil)
+	ue.POST("/api/_version_/fleet/abm_tokens", uploadABMTokenEndpoint, uploadABMTokenRequest{})
+	ue.DELETE("/api/_version_/fleet/abm_tokens/{id:[0-9]+}", deleteABMTokenEndpoint, deleteABMTokenRequest{})
+	ue.GET("/api/_version_/fleet/abm_tokens", listABMTokensEndpoint, nil)
+	ue.PATCH("/api/_version_/fleet/abm_tokens/{id:[0-9]+}/teams", updateABMTokenTeamsEndpoint, updateABMTokenTeamsRequest{})
+	ue.PATCH("/api/_version_/fleet/abm_tokens/{id:[0-9]+}/renew", renewABMTokenEndpoint, renewABMTokenRequest{})
 
 	ue.GET("/api/_version_/fleet/mdm/apple/request_csr", getMDMAppleCSREndpoint, getMDMAppleCSRRequest{})
 	ue.POST("/api/_version_/fleet/mdm/apple/apns_certificate", uploadMDMAppleAPNSCertEndpoint, uploadMDMAppleAPNSCertRequest{})
 	ue.DELETE("/api/_version_/fleet/mdm/apple/apns_certificate", deleteMDMAppleAPNSCertEndpoint, deleteMDMAppleAPNSCertRequest{})
 
+	// VPP Tokens
+	ue.GET("/api/_version_/fleet/vpp_tokens", getVPPTokens, getVPPTokensRequest{})
+	ue.POST("/api/_version_/fleet/vpp_tokens", uploadVPPTokenEndpoint, uploadVPPTokenRequest{})
+	ue.PATCH("/api/_version_/fleet/vpp_tokens/{id}/teams", patchVPPTokensTeams, patchVPPTokensTeamsRequest{})
+	ue.PATCH("/api/_version_/fleet/vpp_tokens/{id}/renew", patchVPPTokenRenewEndpoint, patchVPPTokenRenewRequest{})
+	ue.DELETE("/api/_version_/fleet/vpp_tokens/{id}", deleteVPPToken, deleteVPPTokenRequest{})
+
+	// Batch VPP Associations
+	ue.POST("/api/_version_/fleet/software/app_store_apps/batch", batchAssociateAppStoreAppsEndpoint, batchAssociateAppStoreAppsRequest{})
+
 	// Deprecated: GET /mdm/apple_bm is now deprecated, replaced by the
 	// GET /abm endpoint.
 	ue.GET("/api/_version_/fleet/mdm/apple_bm", getAppleBMEndpoint, nil)
+	// Deprecated: GET /abm is now deprecated, replaced by the GET /abm_tokens endpoint.
 	ue.GET("/api/_version_/fleet/abm", getAppleBMEndpoint, nil)
 
 	// Deprecated: POST /mdm/apple/profiles/batch is now deprecated, replaced by the
@@ -790,10 +809,6 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
 		errorLimiter.Limit("get_device_mdm", desktopQuota),
 	).GET("/api/_version_/fleet/device/{token}/mdm/apple/manual_enrollment_profile", getDeviceMDMManualEnrollProfileEndpoint, getDeviceMDMManualEnrollProfileRequest{})
 
-	demdm.WithCustomMiddleware(
-		errorLimiter.Limit("post_device_rotate_encryption_key", desktopQuota),
-	).POST("/api/_version_/fleet/device/{token}/rotate_encryption_key", rotateEncryptionKeyEndpoint, rotateEncryptionKeyRequest{})
-
 	demdm.WithCustomMiddleware(
 		errorLimiter.Limit("post_device_migrate_mdm", desktopQuota),
 	).POST("/api/_version_/fleet/device/{token}/migrate_mdm", migrateMDMDeviceEndpoint, deviceMigrateMDMRequest{})
@@ -872,6 +887,9 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
 	// Deprecated: GET /mdm/apple/setup/eula/:token is now deprecated, replaced by the platform agnostic /mdm/setup/eula/:token
 	neAppleMDM.GET("/api/_version_/fleet/mdm/apple/setup/eula/{token}", getMDMEULAEndpoint, getMDMEULARequest{})
 
+	// Get OTA profile
+	neAppleMDM.GET("/api/_version_/fleet/enrollment_profiles/ota", getOTAProfileEndpoint, getOTAProfileRequest{})
+
 	// These endpoint are used by Microsoft devices during MDM device enrollment phase
 	neWindowsMDM := ne.WithCustomMiddleware(mdmConfiguredMiddleware.VerifyWindowsMDM())
 
@@ -902,6 +920,9 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
 	ne.WithAltPaths("/api/v1/osquery/carve/block").
 		POST("/api/osquery/carve/block", carveBlockEndpoint, carveBlockRequest{})
 
+	ne.GET("/api/_version_/fleet/software/titles/{title_id:[0-9]+}/package/token/{token}", downloadSoftwareInstallerEndpoint,
+		downloadSoftwareInstallerRequest{})
+
 	ne.POST("/api/_version_/fleet/perform_required_password_reset", performRequiredPasswordResetEndpoint, performRequiredPasswordResetRequest{})
 	ne.POST("/api/_version_/fleet/users", createUserFromInviteEndpoint, createUserRequest{})
 	ne.GET("/api/_version_/fleet/invites/{token}", verifyInviteEndpoint, verifyInviteRequest{})
diff --git a/server/service/handler_test.go b/server/service/handler_test.go
index faaf9d0ae5ed..116b155ac99a 100644
--- a/server/service/handler_test.go
+++ b/server/service/handler_test.go
@@ -37,7 +37,7 @@ func TestAPIRoutesConflicts(t *testing.T) {
 	}
 	var cases []testCase
 
-	// build the test cases: for each route, generate a request designed to match
+	// Build the test cases: for each route, generate a request designed to match
 	// it, and override its handler to return a unique status code. If the
 	// request doesn't result in that status code, then some other route
 	// conflicts with it and took precedence - a route conflict. The route's name
@@ -76,7 +76,6 @@ func TestAPIRoutesConflicts(t *testing.T) {
 }
 
 func TestAPIRoutesMetrics(t *testing.T) {
-	t.Skip()
 	ds := new(mock.Store)
 
 	svc, _ := newTestService(t, ds, nil, nil)
@@ -108,7 +107,8 @@ func TestAPIRoutesMetrics(t *testing.T) {
 	routeNames := make(map[string]bool)
 	err = router.Walk(func(route *mux.Route, _ *mux.Router, _ []*mux.Route) error {
 		if _, ok := routeNames[route.GetName()]; ok {
-			t.Errorf("duplicate route name: %s", route.GetName())
+			path, _ := route.GetPathTemplate()
+			t.Errorf("duplicate route name: %s (%s)", route.GetName(), path)
 		}
 		routeNames[route.GetName()] = true
 		return nil
@@ -194,7 +194,7 @@ func TestAPIRoutesMetrics(t *testing.T) {
 		"go_memstats_alloc_bytes_total":              1,
 		"go_memstats_buck_hash_sys_bytes":            1,
 		"go_memstats_frees_total":                    1,
-		"go_memstats_gc_cpu_fraction":                1,
+		"go_memstats_gc_cpu_fraction":                0, // does not appear to be reported anymore
 		"go_memstats_gc_sys_bytes":                   1,
 		"go_memstats_heap_alloc_bytes":               1,
 		"go_memstats_heap_idle_bytes":                1,
diff --git a/server/service/hosts.go b/server/service/hosts.go
index f07d325727d8..a4db5b73dc0a 100644
--- a/server/service/hosts.go
+++ b/server/service/hosts.go
@@ -6,6 +6,7 @@ import (
 	"crypto/tls"
 	"encoding/csv"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -30,6 +31,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/worker"
 	"github.com/go-kit/log/level"
 	"github.com/gocarina/gocsv"
+	"github.com/google/uuid"
 )
 
 // HostDetailResponse is the response struct that contains the full host information
@@ -681,7 +683,8 @@ func (svc *Service) GetHostSummary(ctx context.Context, teamID *uint, platform *
 ////////////////////////////////////////////////////////////////////////////////
 
 type hostByIdentifierRequest struct {
-	Identifier string `url:"identifier"`
+	Identifier      string `url:"identifier"`
+	ExcludeSoftware bool   `query:"exclude_software,optional"`
 }
 
 func hostByIdentifierEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
@@ -689,6 +692,7 @@ func hostByIdentifierEndpoint(ctx context.Context, request interface{}, svc flee
 	opts := fleet.HostDetailOptions{
 		IncludeCVEScores: false,
 		IncludePolicies:  true, // intentionally true to preserve existing behavior
+		ExcludeSoftware:  req.ExcludeSoftware,
 	}
 	host, err := svc.HostByIdentifier(ctx, req.Identifier, opts)
 	if err != nil {
@@ -822,7 +826,7 @@ func (svc *Service) AddHostsToTeam(ctx context.Context, teamID *uint, hostIDs []
 		return err
 	}
 	if !skipBulkPending {
-		if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, hostIDs, nil, nil, nil); err != nil {
+		if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, hostIDs, nil, nil, nil); err != nil {
 			return ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 		}
 	}
@@ -958,7 +962,7 @@ func (svc *Service) AddHostsToTeamByFilter(ctx context.Context, teamID *uint, fi
 	if err := svc.ds.AddHostsToTeam(ctx, teamID, hostIDs); err != nil {
 		return err
 	}
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, hostIDs, nil, nil, nil); err != nil {
+	if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, hostIDs, nil, nil, nil); err != nil {
 		return ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 	}
 	serials, err := svc.ds.ListMDMAppleDEPSerialsInHostIDs(ctx, hostIDs)
@@ -992,7 +996,9 @@ type refetchHostResponse struct {
 	Err error `json:"error,omitempty"`
 }
 
-func (r refetchHostResponse) error() error { return r.Err }
+func (r refetchHostResponse) error() error {
+	return r.Err
+}
 
 func refetchHostEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
 	req := request.(*refetchHostRequest)
@@ -1004,12 +1010,16 @@ func refetchHostEndpoint(ctx context.Context, request interface{}, svc fleet.Ser
 }
 
 func (svc *Service) RefetchHost(ctx context.Context, id uint) error {
+	var host *fleet.Host
+	// iOS and iPadOS refetch are not authenticated with device token because these devices do not have Fleet Desktop,
+	// so we don't handle that case
 	if !svc.authz.IsAuthenticatedWith(ctx, authzctx.AuthnDeviceToken) {
-		if err := svc.authz.Authorize(ctx, &fleet.Host{}, fleet.ActionList); err != nil {
+		var err error
+		if err = svc.authz.Authorize(ctx, &fleet.Host{}, fleet.ActionList); err != nil {
 			return err
 		}
 
-		host, err := svc.ds.HostLite(ctx, id)
+		host, err = svc.ds.HostLite(ctx, id)
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "find host for refetch")
 		}
@@ -1025,6 +1035,78 @@ func (svc *Service) RefetchHost(ctx context.Context, id uint) error {
 		return ctxerr.Wrap(ctx, err, "save host")
 	}
 
+	if host != nil && (host.Platform == "ios" || host.Platform == "ipados") {
+		// Get MDM commands already sent
+		commands, err := svc.ds.GetHostMDMCommands(ctx, host.ID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "get host MDM commands")
+		}
+		doAppRefetch := true
+		doDeviceInfoRefetch := true
+		for _, cmd := range commands {
+			switch cmd.CommandType {
+			case fleet.RefetchDeviceCommandUUIDPrefix:
+				doDeviceInfoRefetch = false
+			case fleet.RefetchAppsCommandUUIDPrefix:
+				doAppRefetch = false
+			}
+		}
+		if !doAppRefetch && !doDeviceInfoRefetch {
+			// Nothing to do.
+			return nil
+		}
+		err = svc.verifyMDMConfiguredAndConnected(ctx, host)
+		if err != nil {
+			return err
+		}
+		hostMDMCommands := make([]fleet.HostMDMCommand, 0, 2)
+		cmdUUID := uuid.NewString()
+		if doAppRefetch {
+			err = svc.mdmAppleCommander.InstalledApplicationList(ctx, []string{host.UUID}, fleet.RefetchAppsCommandUUIDPrefix+cmdUUID)
+			if err != nil {
+				return ctxerr.Wrap(ctx, err, "refetch apps with MDM")
+			}
+			hostMDMCommands = append(hostMDMCommands, fleet.HostMDMCommand{
+				HostID:      host.ID,
+				CommandType: fleet.RefetchAppsCommandUUIDPrefix,
+			})
+		}
+		if doDeviceInfoRefetch {
+			// DeviceInformation is last because the refetch response clears the refetch_requested flag
+			err = svc.mdmAppleCommander.DeviceInformation(ctx, []string{host.UUID}, fleet.RefetchDeviceCommandUUIDPrefix+cmdUUID)
+			if err != nil {
+				return ctxerr.Wrap(ctx, err, "refetch host with MDM")
+			}
+			hostMDMCommands = append(hostMDMCommands, fleet.HostMDMCommand{
+				HostID:      host.ID,
+				CommandType: fleet.RefetchDeviceCommandUUIDPrefix,
+			})
+		}
+		// Add commands to the database to track the commands sent
+		err = svc.ds.AddHostMDMCommands(ctx, hostMDMCommands)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "add host mdm commands")
+		}
+	}
+
+	return nil
+}
+
+func (svc *Service) verifyMDMConfiguredAndConnected(ctx context.Context, host *fleet.Host) error {
+	if err := svc.VerifyMDMAppleConfigured(ctx); err != nil {
+		if errors.Is(err, fleet.ErrMDMNotConfigured) {
+			err = fleet.NewInvalidArgumentError("id", fleet.AppleMDMNotConfiguredMessage).WithStatus(http.StatusBadRequest)
+		}
+		return ctxerr.Wrap(ctx, err, "check macOS MDM enabled")
+	}
+	connected, err := svc.ds.IsHostConnectedToFleetMDM(ctx, host)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "checking if host is connected to Fleet")
+	}
+	if !connected {
+		return ctxerr.Wrap(ctx,
+			fleet.NewInvalidArgumentError("id", "Host does not have MDM turned on."))
+	}
 	return nil
 }
 
@@ -1910,12 +1992,15 @@ func (svc *Service) OSVersions(ctx context.Context, teamID *uint, platform *stri
 		if err := svc.authz.Authorize(ctx, &fleet.AuthzSoftwareInventory{TeamID: teamID}, fleet.ActionRead); err != nil {
 			return nil, count, nil, err
 		}
-		exists, err := svc.ds.TeamExists(ctx, *teamID)
-		if err != nil {
-			return nil, count, nil, ctxerr.Wrap(ctx, err, "checking if team exists")
-		} else if !exists {
-			return nil, count, nil, fleet.NewInvalidArgumentError("team_id", fmt.Sprintf("team %d does not exist", *teamID)).
-				WithStatus(http.StatusNotFound)
+
+		if *teamID != 0 {
+			exists, err := svc.ds.TeamExists(ctx, *teamID)
+			if err != nil {
+				return nil, count, nil, ctxerr.Wrap(ctx, err, "checking if team exists")
+			} else if !exists {
+				return nil, count, nil, fleet.NewInvalidArgumentError("team_id", fmt.Sprintf("team %d does not exist", *teamID)).
+					WithStatus(http.StatusNotFound)
+			}
 		}
 	}
 
@@ -2017,7 +2102,7 @@ func (svc *Service) OSVersion(ctx context.Context, osID uint, teamID *uint, incl
 		return nil, nil, err
 	}
 
-	if teamID != nil {
+	if teamID != nil && *teamID != 0 {
 		// This auth check ensures we return 403 if the user doesn't have access to the team
 		if err := svc.authz.Authorize(ctx, &fleet.AuthzSoftwareInventory{TeamID: teamID}, fleet.ActionRead); err != nil {
 			return nil, nil, err
@@ -2563,18 +2648,5 @@ func (svc *Service) ListHostSoftware(ctx context.Context, hostID uint, opts flee
 	opts.IncludeAvailableForInstall = includeAvailableForInstall || opts.SelfServiceOnly
 
 	software, meta, err := svc.ds.ListHostSoftware(ctx, host, opts)
-	if includeAvailableForInstall {
-		// for the host software page, we don't want to return the package object,
-		// only the package name
-		for _, s := range software {
-			s.Package = nil
-		}
-	} else {
-		// for the device page, we don't want to return the package name, only the
-		// package object
-		for _, s := range software {
-			s.PackageAvailableForInstall = nil
-		}
-	}
 	return software, meta, ctxerr.Wrap(ctx, err, "list host software")
 }
diff --git a/server/service/hosts_test.go b/server/service/hosts_test.go
index 67492d1c4d23..d44f9fcf4d31 100644
--- a/server/service/hosts_test.go
+++ b/server/service/hosts_test.go
@@ -6,6 +6,7 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
+	"net/http"
 	"strconv"
 	"testing"
 	"time"
@@ -13,6 +14,7 @@ import (
 	"github.com/WatchBeam/clock"
 	"github.com/fleetdm/fleet/v4/server/authz"
 	"github.com/fleetdm/fleet/v4/server/config"
+	"github.com/fleetdm/fleet/v4/server/contexts/capabilities"
 	"github.com/fleetdm/fleet/v4/server/contexts/license"
 	"github.com/fleetdm/fleet/v4/server/contexts/viewer"
 	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
@@ -23,6 +25,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/mock"
 	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/fleetdm/fleet/v4/server/test"
+	kitlog "github.com/go-kit/log"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.mozilla.org/pkcs7"
@@ -137,7 +140,7 @@ func TestHostDetailsMDMAppleDiskEncryption(t *testing.T) {
 				OperationType: fleet.MDMOperationTypeInstall,
 			},
 			fleet.DiskEncryptionActionRequired,
-			fleet.ActionRequiredLogOut,
+			fleet.ActionRequiredRotateKey,
 			&fleet.MDMDeliveryPending,
 		},
 		{
@@ -607,8 +610,9 @@ func TestHostAuth(t *testing.T) {
 		}
 		return nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.ListMDMAppleDEPSerialsInHostIDsFunc = func(ctx context.Context, hids []uint) ([]string, error) {
 		return nil, nil
@@ -886,8 +890,9 @@ func TestAddHostsToTeamByFilter(t *testing.T) {
 		assert.Equal(t, expectedHostIDs, hostIDs)
 		return nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.ListMDMAppleDEPSerialsInHostIDsFunc = func(ctx context.Context, hids []uint) ([]string, error) {
 		return nil, nil
@@ -928,8 +933,9 @@ func TestAddHostsToTeamByFilterLabel(t *testing.T) {
 		assert.Equal(t, expectedHostIDs, hostIDs)
 		return nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.ListMDMAppleDEPSerialsInHostIDsFunc = func(ctx context.Context, hids []uint) ([]string, error) {
 		return nil, nil
@@ -960,8 +966,9 @@ func TestAddHostsToTeamByFilterEmptyHosts(t *testing.T) {
 	ds.AddHostsToTeamFunc = func(ctx context.Context, teamID *uint, hostIDs []uint) error {
 		return nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	emptyFilter := &map[string]interface{}{}
@@ -1857,3 +1864,239 @@ func TestBulkOperationFilterValidation(t *testing.T) {
 		})
 	}
 }
+
+func TestSetDiskEncryptionNotifications(t *testing.T) {
+	ds := new(mock.Store)
+	ctx := context.Background()
+	svc := &Service{ds: ds, logger: kitlog.NewNopLogger()}
+
+	tests := []struct {
+		name                     string
+		host                     *fleet.Host
+		appConfig                *fleet.AppConfig
+		diskEncryptionConfigured bool
+		isConnectedToFleetMDM    bool
+		mdmInfo                  *fleet.HostMDM
+		getHostDiskEncryptionKey func(context.Context, uint) (*fleet.HostDiskEncryptionKey, error)
+		expectedNotifications    *fleet.OrbitConfigNotifications
+		expectedError            bool
+		disableCapability        bool
+	}{
+		{
+			name: "no MDM configured",
+			host: &fleet.Host{ID: 1, Platform: "darwin", OsqueryHostID: ptr.String("foo")},
+			appConfig: &fleet.AppConfig{
+				MDM: fleet.MDM{EnabledAndConfigured: false},
+			},
+			diskEncryptionConfigured: true,
+			isConnectedToFleetMDM:    true,
+			mdmInfo:                  nil,
+			getHostDiskEncryptionKey: nil,
+			expectedNotifications:    &fleet.OrbitConfigNotifications{},
+			expectedError:            false,
+		},
+		{
+			name: "not connected to Fleet MDM",
+			host: &fleet.Host{ID: 1, Platform: "darwin", OsqueryHostID: ptr.String("foo")},
+			appConfig: &fleet.AppConfig{
+				MDM: fleet.MDM{EnabledAndConfigured: true},
+			},
+			diskEncryptionConfigured: true,
+			isConnectedToFleetMDM:    false,
+			mdmInfo:                  nil,
+			getHostDiskEncryptionKey: nil,
+			expectedNotifications:    &fleet.OrbitConfigNotifications{},
+			expectedError:            false,
+		},
+		{
+			name: "host not enrolled in osquery",
+			host: &fleet.Host{ID: 1, Platform: "darwin", OsqueryHostID: nil},
+			appConfig: &fleet.AppConfig{
+				MDM: fleet.MDM{EnabledAndConfigured: true},
+			},
+			diskEncryptionConfigured: true,
+			isConnectedToFleetMDM:    true,
+			mdmInfo:                  nil,
+			getHostDiskEncryptionKey: nil,
+			expectedNotifications:    &fleet.OrbitConfigNotifications{},
+			expectedError:            false,
+		},
+		{
+			name: "disk encryption not configured",
+			host: &fleet.Host{ID: 1, Platform: "darwin", OsqueryHostID: ptr.String("foo")},
+			appConfig: &fleet.AppConfig{
+				MDM: fleet.MDM{EnabledAndConfigured: true},
+			},
+			diskEncryptionConfigured: false,
+			isConnectedToFleetMDM:    true,
+			mdmInfo:                  nil,
+			getHostDiskEncryptionKey: nil,
+			expectedNotifications:    &fleet.OrbitConfigNotifications{},
+			expectedError:            false,
+		},
+		{
+			name: "darwin with decryptable key",
+			host: &fleet.Host{ID: 1, Platform: "darwin", OsqueryHostID: ptr.String("foo")},
+			appConfig: &fleet.AppConfig{
+				MDM: fleet.MDM{EnabledAndConfigured: true},
+			},
+			diskEncryptionConfigured: true,
+			isConnectedToFleetMDM:    true,
+			mdmInfo:                  nil,
+			getHostDiskEncryptionKey: func(ctx context.Context, id uint) (*fleet.HostDiskEncryptionKey, error) {
+				return &fleet.HostDiskEncryptionKey{Decryptable: ptr.Bool(true)}, nil
+			},
+			expectedNotifications: &fleet.OrbitConfigNotifications{
+				RotateDiskEncryptionKey: false,
+			},
+			expectedError: false,
+		},
+		{
+			name: "darwin needs rotation but client is old",
+			host: &fleet.Host{ID: 1, Platform: "darwin", OsqueryHostID: ptr.String("foo")},
+			appConfig: &fleet.AppConfig{
+				MDM: fleet.MDM{EnabledAndConfigured: true},
+			},
+			diskEncryptionConfigured: true,
+			isConnectedToFleetMDM:    true,
+			mdmInfo:                  nil,
+			getHostDiskEncryptionKey: func(ctx context.Context, id uint) (*fleet.HostDiskEncryptionKey, error) {
+				return &fleet.HostDiskEncryptionKey{Decryptable: ptr.Bool(false)}, nil
+			},
+			expectedNotifications: &fleet.OrbitConfigNotifications{
+				RotateDiskEncryptionKey: true,
+			},
+			expectedError:     false,
+			disableCapability: true,
+		},
+		{
+			name: "darwin needs rotation",
+			host: &fleet.Host{ID: 1, Platform: "darwin", OsqueryHostID: ptr.String("foo")},
+			appConfig: &fleet.AppConfig{
+				MDM: fleet.MDM{EnabledAndConfigured: true},
+			},
+			diskEncryptionConfigured: true,
+			isConnectedToFleetMDM:    true,
+			mdmInfo:                  nil,
+			getHostDiskEncryptionKey: func(ctx context.Context, id uint) (*fleet.HostDiskEncryptionKey, error) {
+				return &fleet.HostDiskEncryptionKey{Decryptable: ptr.Bool(false)}, nil
+			},
+			expectedNotifications: &fleet.OrbitConfigNotifications{
+				RotateDiskEncryptionKey: true,
+			},
+			expectedError: false,
+		},
+		{
+			name: "windows server with no encryption needed",
+			host: &fleet.Host{ID: 1, Platform: "windows", DiskEncryptionEnabled: ptr.Bool(true), OsqueryHostID: ptr.String("foo")},
+			appConfig: &fleet.AppConfig{
+				MDM: fleet.MDM{EnabledAndConfigured: true},
+			},
+			diskEncryptionConfigured: true,
+			isConnectedToFleetMDM:    true,
+			mdmInfo:                  &fleet.HostMDM{IsServer: true},
+			getHostDiskEncryptionKey: func(ctx context.Context, id uint) (*fleet.HostDiskEncryptionKey, error) {
+				return nil, newNotFoundError()
+			},
+			expectedNotifications: &fleet.OrbitConfigNotifications{
+				EnforceBitLockerEncryption: false,
+			},
+			expectedError: false,
+		},
+		{
+			name: "windows with encryption enabled but key missing",
+			host: &fleet.Host{ID: 1, Platform: "windows", DiskEncryptionEnabled: ptr.Bool(true), OsqueryHostID: ptr.String("foo")},
+			appConfig: &fleet.AppConfig{
+				MDM: fleet.MDM{EnabledAndConfigured: true},
+			},
+			diskEncryptionConfigured: true,
+			isConnectedToFleetMDM:    true,
+			mdmInfo:                  &fleet.HostMDM{IsServer: false},
+			getHostDiskEncryptionKey: func(ctx context.Context, id uint) (*fleet.HostDiskEncryptionKey, error) {
+				return nil, newNotFoundError()
+			},
+			expectedNotifications: &fleet.OrbitConfigNotifications{
+				EnforceBitLockerEncryption: true,
+			},
+			expectedError: false,
+		},
+		{
+			name: "darwin with missing encryption key",
+			host: &fleet.Host{ID: 1, Platform: "darwin", OsqueryHostID: ptr.String("foo")},
+			appConfig: &fleet.AppConfig{
+				MDM: fleet.MDM{EnabledAndConfigured: true},
+			},
+			diskEncryptionConfigured: true,
+			isConnectedToFleetMDM:    true,
+			mdmInfo:                  nil,
+			getHostDiskEncryptionKey: func(ctx context.Context, id uint) (*fleet.HostDiskEncryptionKey, error) {
+				return nil, newNotFoundError()
+			},
+			expectedNotifications: &fleet.OrbitConfigNotifications{
+				RotateDiskEncryptionKey: false,
+			},
+			expectedError: false,
+		},
+		{
+			name: "windows with encryption key and not decryptable",
+			host: &fleet.Host{ID: 1, Platform: "windows", DiskEncryptionEnabled: ptr.Bool(true), OsqueryHostID: ptr.String("foo")},
+			appConfig: &fleet.AppConfig{
+				MDM: fleet.MDM{EnabledAndConfigured: true},
+			},
+			diskEncryptionConfigured: true,
+			isConnectedToFleetMDM:    true,
+			mdmInfo:                  &fleet.HostMDM{IsServer: false},
+			getHostDiskEncryptionKey: func(ctx context.Context, id uint) (*fleet.HostDiskEncryptionKey, error) {
+				return &fleet.HostDiskEncryptionKey{Decryptable: ptr.Bool(false)}, nil
+			},
+			expectedNotifications: &fleet.OrbitConfigNotifications{
+				EnforceBitLockerEncryption: true,
+			},
+			expectedError: false,
+		},
+		{
+			name: "windows with enforce BitLocker",
+			host: &fleet.Host{ID: 1, Platform: "windows", DiskEncryptionEnabled: ptr.Bool(false), OsqueryHostID: ptr.String("foo")},
+			appConfig: &fleet.AppConfig{
+				MDM: fleet.MDM{EnabledAndConfigured: true},
+			},
+			diskEncryptionConfigured: true,
+			isConnectedToFleetMDM:    true,
+			mdmInfo:                  &fleet.HostMDM{IsServer: false},
+			getHostDiskEncryptionKey: func(ctx context.Context, id uint) (*fleet.HostDiskEncryptionKey, error) {
+				return nil, newNotFoundError()
+			},
+			expectedNotifications: &fleet.OrbitConfigNotifications{
+				EnforceBitLockerEncryption: true,
+			},
+			expectedError: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.getHostDiskEncryptionKey != nil {
+				ds.GetHostDiskEncryptionKeyFunc = tt.getHostDiskEncryptionKey
+			}
+			ds.AppConfigFunc = func(ctx context.Context) (*fleet.AppConfig, error) {
+				return tt.appConfig, nil
+			}
+
+			if !tt.disableCapability {
+				r := http.Request{
+					Header: http.Header{fleet.CapabilitiesHeader: []string{string(fleet.CapabilityEscrowBuddy)}},
+				}
+				ctx = capabilities.NewContext(ctx, &r)
+			}
+
+			notifs := &fleet.OrbitConfigNotifications{}
+			err := svc.setDiskEncryptionNotifications(ctx, notifs, tt.host, tt.appConfig, tt.diskEncryptionConfigured, tt.isConnectedToFleetMDM, tt.mdmInfo)
+			if tt.expectedError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+			require.Equal(t, tt.expectedNotifications.RotateDiskEncryptionKey, notifs.RotateDiskEncryptionKey)
+		})
+	}
+}
diff --git a/server/service/integration_core_test.go b/server/service/integration_core_test.go
index 3c3967d09b5c..8b1f84820506 100644
--- a/server/service/integration_core_test.go
+++ b/server/service/integration_core_test.go
@@ -4048,21 +4048,28 @@ func (s *integrationTestSuite) TestLabels() {
 
 	// modify manual label 1 without modifying its hosts
 	modResp = modifyLabelResponse{}
-	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/labels/%d", manualLbl1.ID), &fleet.ModifyLabelPayload{Name: ptr.String("modified_manual_label1")}, http.StatusOK, &modResp)
+	newName := "modified_manual_label1"
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/labels/%d", manualLbl1.ID), &fleet.ModifyLabelPayload{Name: &newName}, http.StatusOK,
+		&modResp)
 	assert.Equal(t, manualLbl1.ID, modResp.Label.ID)
 	assert.Equal(t, fleet.LabelTypeRegular, modResp.Label.LabelType)
 	assert.Equal(t, fleet.LabelMembershipTypeManual, modResp.Label.LabelMembershipType)
 	assert.ElementsMatch(t, []uint{manualHosts[0].ID, manualHosts[1].ID, manualHosts[2].ID}, modResp.Label.HostIDs)
 	assert.EqualValues(t, 3, modResp.Label.HostCount)
+	assert.Equal(t, newName, modResp.Label.Name)
 
 	// modify manual label 2 adding some hosts
 	modResp = modifyLabelResponse{}
-	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/labels/%d", manualLbl2.ID), &fleet.ModifyLabelPayload{Hosts: []string{manualHosts[0].UUID}}, http.StatusOK, &modResp)
+	newName = "modified_manual_label2"
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/labels/%d", manualLbl2.ID),
+		&fleet.ModifyLabelPayload{Name: &newName, Hosts: []string{manualHosts[0].UUID}}, http.StatusOK, &modResp)
 	assert.Equal(t, manualLbl2.ID, modResp.Label.ID)
 	assert.Equal(t, fleet.LabelTypeRegular, modResp.Label.LabelType)
 	assert.Equal(t, fleet.LabelMembershipTypeManual, modResp.Label.LabelMembershipType)
 	assert.ElementsMatch(t, []uint{manualHosts[0].ID}, modResp.Label.HostIDs)
 	assert.EqualValues(t, 1, modResp.Label.HostCount)
+	assert.Equal(t, newName, modResp.Label.Name)
+	manualLbl2.Name = newName
 
 	// modify manual label 2 clearing its hosts
 	modResp = modifyLabelResponse{}
@@ -6162,6 +6169,55 @@ func (s *integrationTestSuite) TestPremiumEndpointsWithoutLicense() {
 		"team_id", "1",
 	)
 
+	// a request with a premium vulnerability filter returns a license error
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{fleet.SoftwareTitleListOptions{VulnerableOnly: true, MinimumCVSS: 7.5}}, http.StatusPaymentRequired, &resp,
+	)
+	verResp := listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{fleet.SoftwareListOptions{VulnerableOnly: true, MinimumCVSS: 7.5}}, http.StatusPaymentRequired, &verResp,
+	)
+	countResp := countSoftwareResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/count",
+		listSoftwareRequest{fleet.SoftwareListOptions{VulnerableOnly: true, MinimumCVSS: 7.5}}, http.StatusPaymentRequired, &countResp,
+	)
+
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{fleet.SoftwareTitleListOptions{VulnerableOnly: true, MaximumCVSS: 7.5}}, http.StatusPaymentRequired, &resp,
+	)
+	verResp = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{fleet.SoftwareListOptions{VulnerableOnly: true, MaximumCVSS: 7.5}}, http.StatusPaymentRequired, &verResp,
+	)
+	countResp = countSoftwareResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/count",
+		listSoftwareRequest{fleet.SoftwareListOptions{VulnerableOnly: true, MaximumCVSS: 7.5}}, http.StatusPaymentRequired, &countResp,
+	)
+
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{fleet.SoftwareTitleListOptions{VulnerableOnly: true, KnownExploit: true}}, http.StatusPaymentRequired, &resp,
+	)
+	verResp = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{fleet.SoftwareListOptions{VulnerableOnly: true, KnownExploit: true}}, http.StatusPaymentRequired, &verResp,
+	)
+	countResp = countSoftwareResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/count",
+		listSoftwareRequest{fleet.SoftwareListOptions{VulnerableOnly: true, KnownExploit: true}}, http.StatusPaymentRequired, &countResp,
+	)
+
 	// lock/unlock/wipe a host
 	s.Do("POST", "/api/v1/fleet/hosts/123/lock", nil, http.StatusPaymentRequired)
 	s.Do("POST", "/api/v1/fleet/hosts/123/unlock", nil, http.StatusPaymentRequired)
@@ -6833,6 +6889,7 @@ func (s *integrationTestSuite) TestListSoftwareAndSoftwareDetails() {
 	expectedTeamVersionsCount := 3
 
 	assertSoftwareDetails := func(expectedSoftware []fleet.Software, team string) {
+		t.Helper()
 		// this is just a basic sanity check of the software details endpoints and doesn't test all of the
 		// fields that may be present in the response (e.g., vulnerabilities)
 		for _, sw := range expectedSoftware {
@@ -6859,6 +6916,7 @@ func (s *integrationTestSuite) TestListSoftwareAndSoftwareDetails() {
 	}
 
 	assertResp := func(resp listSoftwareResponse, want []fleet.Software, ts time.Time, team string, counts ...int) {
+		t.Helper()
 		require.Len(t, resp.Software, len(want))
 		for i := range resp.Software {
 			wantID, gotID := want[i].ID, resp.Software[i].ID
@@ -7090,6 +7148,15 @@ func (s *integrationTestSuite) TestListSoftwareAndSoftwareDetails() {
 	)
 	assertVersionsResp(versResp, []fleet.Software{sws[17]}, hostsCountTs, teamStr, expectedTeamVersionsCount, 1)
 
+	// filter by no team, 2 by page
+	lsResp = listSoftwareResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software", nil, http.StatusOK, &lsResp, "per_page", "2", "page", "0", "order_key", "name",
+		"order_direction", "desc", "team_id", "0",
+	)
+	fmt.Printf("lsResp: %+v\n", lsResp)
+	assertResp(lsResp, []fleet.Software{sws[19], sws[18]}, hostsCountTs, "", 17, 17)
+
 	// Invalid software team -- admin gets a 404, team users get a 403
 	detailsResp := getSoftwareResponse{}
 	s.DoJSON(
@@ -7963,7 +8030,7 @@ func (s *integrationTestSuite) TestGetHostSoftwareUpdatedAt() {
 		LabelUpdatedAt:  time.Now(),
 		PolicyUpdatedAt: time.Now(),
 		SeenTime:        time.Now(),
-		NodeKey:         ptr.String(t.Name() + "1"),
+		NodeKey:         ptr.String(strings.ReplaceAll(t.Name(), "/", "_") + "1"),
 		UUID:            t.Name() + "1",
 		Hostname:        t.Name() + "foo.local",
 		PrimaryIP:       "192.168.1.1",
@@ -7998,6 +8065,18 @@ func (s *integrationTestSuite) TestGetHostSoftwareUpdatedAt() {
 	require.Equal(t, host.ID, getHostResp.Host.ID)
 	require.Empty(t, getHostResp.Host.Software)
 	require.Greater(t, getHostResp.Host.SoftwareUpdatedAt, getHostResp.Host.CreatedAt)
+
+	getHostResp = getHostResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/identifier/%s", *host.NodeKey), nil, http.StatusOK, &getHostResp)
+	require.Equal(t, host.ID, getHostResp.Host.ID)
+	require.Len(t, getHostResp.Host.Software, len(software))
+	require.Greater(t, getHostResp.Host.SoftwareUpdatedAt, getHostResp.Host.CreatedAt)
+
+	getHostResp = getHostResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/identifier/%s", *host.NodeKey), nil, http.StatusOK, &getHostResp, "exclude_software", "true")
+	require.Equal(t, host.ID, getHostResp.Host.ID)
+	require.Empty(t, getHostResp.Host.Software)
+	require.Greater(t, getHostResp.Host.SoftwareUpdatedAt, getHostResp.Host.CreatedAt)
 }
 
 func (s *integrationTestSuite) TestHostsReportDownload() {
@@ -8322,9 +8401,8 @@ func (s *integrationTestSuite) TestGetHostMaintenanceWindow() {
 		StartTime: startTime,
 		EndTime:   endTime,
 		Data:      []byte(`{}`),
-		// will replace with NULL - db method doesn't allow nil
-		TimeZone: "",
-		UUID:     uuid.New().String(),
+		TimeZone:  nil,
+		UUID:      uuid.New().String(),
 	}
 
 	dsEvent, err := s.ds.CreateOrUpdateCalendarEvent(ctx, testEvent.UUID, testEvent.Email, testEvent.StartTime, testEvent.EndTime,
@@ -8359,7 +8437,7 @@ func (s *integrationTestSuite) TestGetHostMaintenanceWindow() {
 
 	// update the timezone
 	_, err = s.ds.CreateOrUpdateCalendarEvent(ctx, testEvent.UUID, testEvent.Email, testEvent.StartTime, testEvent.EndTime, testEvent.Data,
-		timeZone, host.ID, fleet.CalendarWebhookStatusNone)
+		&timeZone, host.ID, fleet.CalendarWebhookStatusNone)
 	require.NoError(t, err)
 
 	time.Sleep(1 * time.Second)
@@ -8583,7 +8661,7 @@ func (s *integrationTestSuite) TestListVulnerabilities() {
 
 	_, err = s.ds.InsertOSVulnerability(context.Background(), fleet.OSVulnerability{
 		OSID:              os.ID,
-		CVE:               "CVE-2021-1234",
+		CVE:               "CVE-2021-12345",
 		ResolvedInVersion: *ptr.StringPtr("10.0.19043.2013"),
 	}, fleet.MSRCSource)
 	require.NoError(t, err)
@@ -8640,15 +8718,16 @@ func (s *integrationTestSuite) TestListVulnerabilities() {
 	require.NoError(t, err)
 
 	// insert CVEMeta
+	knownCVE := "cve-2021-12999"
 	mockTime := time.Date(2021, 1, 1, 0, 0, 0, 0, time.UTC)
 	err = s.ds.InsertCVEMeta(context.Background(), []fleet.CVEMeta{
 		{
-			CVE:              "CVE-2021-1234",
+			CVE:              "CVE-2021-12345",
 			CVSSScore:        ptr.Float64(7.5),
 			EPSSProbability:  ptr.Float64(0.5),
 			CISAKnownExploit: ptr.Bool(true),
 			Published:        ptr.Time(mockTime),
-			Description:      "Test CVE 2021-1234",
+			Description:      "Test CVE 2021-12345",
 		},
 		{
 			CVE:              "CVE-2021-1235",
@@ -8666,6 +8745,14 @@ func (s *integrationTestSuite) TestListVulnerabilities() {
 			Published:        ptr.Time(mockTime),
 			Description:      "Test CVE 2021-1246",
 		},
+		{
+			CVE:              knownCVE,
+			CVSSScore:        ptr.Float64(6.4),
+			EPSSProbability:  ptr.Float64(0.61),
+			CISAKnownExploit: ptr.Bool(true),
+			Published:        ptr.Time(mockTime),
+			Description:      fmt.Sprintf("Test %s", knownCVE),
+		},
 	})
 	require.NoError(t, err)
 
@@ -8686,9 +8773,9 @@ func (s *integrationTestSuite) TestListVulnerabilities() {
 		DetailsLink string
 		Source      fleet.VulnerabilitySource
 	}{
-		"CVE-2021-1234": {
+		"CVE-2021-12345": {
 			HostCount:   1,
-			DetailsLink: "https://nvd.nist.gov/vuln/detail/CVE-2021-1234",
+			DetailsLink: "https://nvd.nist.gov/vuln/detail/CVE-2021-12345",
 		},
 		"CVE-2021-1235": {
 			HostCount:   1,
@@ -8702,7 +8789,7 @@ func (s *integrationTestSuite) TestListVulnerabilities() {
 
 	for _, vuln := range resp.Vulnerabilities {
 		expectedVuln, ok := expected[vuln.CVE.CVE]
-		require.True(t, ok)
+		require.True(t, ok, vuln.CVE.CVE)
 		require.Equal(t, expectedVuln.HostCount, vuln.HostsCount)
 		require.Equal(t, expectedVuln.DetailsLink, vuln.DetailsLink)
 		require.Empty(t, vuln.CVSSScore)
@@ -8723,9 +8810,9 @@ func (s *integrationTestSuite) TestListVulnerabilities() {
 		DetailsLink string
 		Source      fleet.VulnerabilitySource
 	}{
-		"CVE-2021-1234": {
+		"CVE-2021-12345": {
 			HostCount:   1,
-			DetailsLink: "https://nvd.nist.gov/vuln/detail/CVE-2021-1234",
+			DetailsLink: "https://nvd.nist.gov/vuln/detail/CVE-2021-12345",
 		},
 		"CVE-2021-1235": {
 			HostCount:   1,
@@ -8750,7 +8837,24 @@ func (s *integrationTestSuite) TestListVulnerabilities() {
 	require.False(t, resp.Meta.HasPreviousResults)
 	require.False(t, resp.Meta.HasNextResults)
 
-	// Test Team Filter
+	// test with a known CVE that does not match on software/OS
+	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities", nil, http.StatusOK, &resp, "query", knownCVE)
+	require.Empty(t, resp.Err)
+	assert.Len(s.T(), resp.Vulnerabilities, 0)
+	assert.Equal(t, resp.Count, uint(0))
+	assert.False(t, resp.Meta.HasPreviousResults)
+	assert.False(t, resp.Meta.HasNextResults)
+
+	// test with a substring of a known CVE -- results are returned
+	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities", nil, http.StatusOK, &resp, "query", "CVE-2021-1234")
+	require.Empty(t, resp.Err)
+	assert.Len(s.T(), resp.Vulnerabilities, 1)
+	assert.Equal(t, resp.Count, uint(1))
+	assert.False(t, resp.Meta.HasPreviousResults)
+	assert.False(t, resp.Meta.HasNextResults)
+	_ = s.Do("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-1234", nil, http.StatusNotFound)
+
+	// Team 1 Filter
 	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities", nil, http.StatusOK, &resp, "team_id", "1")
 	require.Len(s.T(), resp.Vulnerabilities, 0)
 
@@ -8777,22 +8881,47 @@ func (s *integrationTestSuite) TestListVulnerabilities() {
 		require.Empty(t, vuln.CVSSScore)
 	}
 
+	// No filter (global)
+	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities", nil, http.StatusOK, &resp)
+	require.Len(t, resp.Vulnerabilities, 3)
+	require.Equal(t, uint(3), resp.Count)
+	require.Equal(t, uint(1), resp.Vulnerabilities[0].HostsCount)
+	require.Equal(t, uint(1), resp.Vulnerabilities[1].HostsCount)
+	require.Equal(t, uint(1), resp.Vulnerabilities[2].HostsCount)
+
+	// Team 0 Filter
+	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities", nil, http.StatusOK, &resp, "team_id", "0")
+	require.Len(t, resp.Vulnerabilities, 1)
+	require.Equal(t, uint(1), resp.Count)
+	require.Equal(t, "CVE-2021-1246", resp.Vulnerabilities[0].CVE.CVE)
+	require.Equal(t, uint(1), resp.Vulnerabilities[0].HostsCount)
+
+	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities", nil, http.StatusOK, &resp, "team_id", "0")
+	require.Len(t, resp.Vulnerabilities, 1)
+
 	var gResp getVulnerabilityResponse
 	// invalid cve
-	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities/foobar", nil, http.StatusNotFound, &gResp)
+	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities/foobar", nil, http.StatusBadRequest, &gResp)
 
 	// Valid CVE but not in team scope
-	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-1246", nil, http.StatusNotFound, &gResp, "team_id", fmt.Sprintf("%d", team.ID))
+	s.Do("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-1246", nil, http.StatusNoContent, "team_id",
+		fmt.Sprintf("%d", team.ID))
+
+	// Valid CVE in "no team" scope
+	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-1246", nil, http.StatusOK, &gResp, "team_id", "0")
+
+	// Valid CVE not in "no team" scope
+	s.Do("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-12345", nil, http.StatusNoContent, "team_id", "0")
 
 	// Invalid TeamID
-	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-1234", nil, http.StatusForbidden, &gResp, "team_id", "100")
+	s.Do("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-12345", nil, http.StatusForbidden, "team_id", "100")
 
 	// Valid Global Request
-	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-1234", nil, http.StatusOK, &gResp)
+	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-12345", nil, http.StatusOK, &gResp)
 	require.Empty(t, gResp.Err)
-	require.Equal(t, "CVE-2021-1234", gResp.Vulnerability.CVE.CVE)
+	require.Equal(t, "CVE-2021-12345", gResp.Vulnerability.CVE.CVE)
 	require.Equal(t, uint(1), gResp.Vulnerability.HostsCount)
-	require.Equal(t, "https://nvd.nist.gov/vuln/detail/CVE-2021-1234", gResp.Vulnerability.DetailsLink)
+	require.Equal(t, "https://nvd.nist.gov/vuln/detail/CVE-2021-12345", gResp.Vulnerability.DetailsLink)
 	require.Empty(t, gResp.Vulnerability.Description)
 	require.Empty(t, gResp.Vulnerability.CVSSScore)
 	require.Empty(t, gResp.Vulnerability.CISAKnownExploit)
@@ -8991,6 +9120,15 @@ func (s *integrationTestSuite) TestOSVersions() {
 	require.Equal(t, 4, osVersionsResp.Count)
 	require.False(t, osVersionsResp.Meta.HasNextResults)
 	require.True(t, osVersionsResp.Meta.HasPreviousResults)
+
+	// same results with team_id=0
+	s.DoJSON("GET", "/api/latest/fleet/os_versions", nil, http.StatusOK, &osVersionsResp, "page", "1", "per_page", "2", "team_id", "0")
+	require.Len(t, osVersionsResp.OSVersions, 2)
+	require.Equal(t, "macOS 13.2.1", osVersionsResp.OSVersions[0].Name)
+	require.Equal(t, "macOS 14.1.2", osVersionsResp.OSVersions[1].Name)
+	require.Equal(t, 4, osVersionsResp.Count)
+	require.False(t, osVersionsResp.Meta.HasNextResults)
+	require.True(t, osVersionsResp.Meta.HasPreviousResults)
 }
 
 func (s *integrationTestSuite) TestPingEndpoints() {
@@ -9091,7 +9229,11 @@ func (s *integrationTestSuite) TestOrbitConfigNotifications() {
 	require.False(t, resp.Notifications.RenewEnrollmentProfile)
 
 	// simulate ABM assignment
-	err = s.ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*hFleetMDM})
+	encTok := uuid.NewString()
+	abmToken, err := s.ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+	err = s.ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*hFleetMDM}, abmToken.ID)
 	require.NoError(t, err)
 	err = s.ds.SetOrUpdateMDMData(context.Background(), hSimpleMDM.ID, false, true, "https://simplemdm.com", false, fleet.WellKnownMDMSimpleMDM, "")
 	require.NoError(t, err)
@@ -11453,6 +11595,9 @@ func (s *integrationTestSuite) TestListHostUpcomingActivities() {
 	t := s.T()
 	ctx := context.Background()
 
+	adminUser, err := s.ds.UserByEmail(ctx, "admin1@example.com")
+	require.NoError(t, err)
+
 	// there is already a datastore-layer test that verifies that correct values
 	// are returned for users, saved scripts, etc. so this is more focused on
 	// verifying that the service layer passes the proper options and the
@@ -11497,6 +11642,7 @@ func (s *integrationTestSuite) TestListHostUpcomingActivities() {
 		Title:         "foo",
 		Source:        "apps",
 		Version:       "0.0.1",
+		UserID:        adminUser.ID,
 	})
 	require.NoError(t, err)
 	s1Meta, err := s.ds.GetSoftwareInstallerMetadataByID(ctx, sw1)
diff --git a/server/service/integration_ds_only_test.go b/server/service/integration_ds_only_test.go
index 7275e5bc1001..0d456a9c1e29 100644
--- a/server/service/integration_ds_only_test.go
+++ b/server/service/integration_ds_only_test.go
@@ -15,9 +15,9 @@ type integrationDSTestSuite struct {
 	suite.Suite
 }
 
-func TestIntegrationDSTestSuite(t *testing.T) {
+func TestIntegrationsDSTestSuite(t *testing.T) {
 	testingSuite := new(integrationDSTestSuite)
-	testingSuite.s = &testingSuite.Suite
+	testingSuite.withDS.s = &testingSuite.Suite
 	suite.Run(t, testingSuite)
 }
 
diff --git a/server/service/integration_enterprise_test.go b/server/service/integration_enterprise_test.go
index 2ba808626307..96bd651883f1 100644
--- a/server/service/integration_enterprise_test.go
+++ b/server/service/integration_enterprise_test.go
@@ -25,6 +25,7 @@ import (
 
 	"github.com/fleetdm/fleet/v4/ee/server/calendar"
 	"github.com/fleetdm/fleet/v4/pkg/optjson"
+	"github.com/fleetdm/fleet/v4/pkg/scripts"
 	"github.com/fleetdm/fleet/v4/server/config"
 	"github.com/fleetdm/fleet/v4/server/contexts/license"
 	"github.com/fleetdm/fleet/v4/server/cron"
@@ -35,6 +36,8 @@ import (
 	"github.com/fleetdm/fleet/v4/server/mdm"
 	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/fleetdm/fleet/v4/server/pubsub"
+	commonCalendar "github.com/fleetdm/fleet/v4/server/service/calendar"
+	"github.com/fleetdm/fleet/v4/server/service/redis_lock"
 	"github.com/fleetdm/fleet/v4/server/service/schedule"
 	"github.com/fleetdm/fleet/v4/server/test"
 	"github.com/go-kit/log"
@@ -45,6 +48,7 @@ import (
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
+	googleCalendar "google.golang.org/api/calendar/v3"
 )
 
 func TestIntegrationsEnterprise(t *testing.T) {
@@ -87,7 +91,8 @@ func (s *integrationEnterpriseTestSuite) SetupSuite() {
 						cronLog = kitlog.NewNopLogger()
 					}
 					calendarSchedule, err = cron.NewCalendarSchedule(
-						ctx, s.T().Name(), s.ds, config.CalendarConfig{Periodicity: 24 * time.Hour}, cronLog,
+						ctx, s.T().Name(), s.ds, redis_lock.NewLock(s.redisPool), config.CalendarConfig{Periodicity: 24 * time.Hour},
+						cronLog,
 					)
 					return calendarSchedule, err
 				}
@@ -165,6 +170,14 @@ func (s *integrationEnterpriseTestSuite) TestTeamSpecs() {
 						"minimum_version": "10.15.0",
 						"deadline":        "2021-01-01",
 					},
+					"ios_updates": map[string]any{
+						"minimum_version": "17.5.1",
+						"deadline":        "2024-07-23",
+					},
+					"ipados_updates": map[string]any{
+						"minimum_version": "18.0",
+						"deadline":        "2024-08-24",
+					},
 				},
 			},
 		},
@@ -184,10 +197,18 @@ func (s *integrationEnterpriseTestSuite) TestTeamSpecs() {
 		AdditionalQueries:       ptr.RawMessage(json.RawMessage(`{"foo": "bar"}`)),
 	}, team.Config.Features)
 	require.Equal(t, fleet.TeamMDM{
-		MacOSUpdates: fleet.MacOSUpdates{
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("10.15.0"),
 			Deadline:       optjson.SetString("2021-01-01"),
 		},
+		IOSUpdates: fleet.AppleOSUpdateSettings{
+			MinimumVersion: optjson.SetString("17.5.1"),
+			Deadline:       optjson.SetString("2024-07-23"),
+		},
+		IPadOSUpdates: fleet.AppleOSUpdateSettings{
+			MinimumVersion: optjson.SetString("18.0"),
+			Deadline:       optjson.SetString("2024-08-24"),
+		},
 		WindowsUpdates: fleet.WindowsUpdates{
 			DeadlineDays:    optjson.Int{Set: true},
 			GracePeriodDays: optjson.Int{Set: true},
@@ -281,10 +302,18 @@ func (s *integrationEnterpriseTestSuite) TestTeamSpecs() {
 	require.NoError(t, err)
 	require.Equal(t, applyResp.TeamIDsByName[teamName], team.ID)
 	require.Equal(t, fleet.TeamMDM{
-		MacOSUpdates: fleet.MacOSUpdates{
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("10.15.0"),
 			Deadline:       optjson.SetString("2021-01-01"),
 		},
+		IOSUpdates: fleet.AppleOSUpdateSettings{
+			MinimumVersion: optjson.SetString("17.5.1"),
+			Deadline:       optjson.SetString("2024-07-23"),
+		},
+		IPadOSUpdates: fleet.AppleOSUpdateSettings{
+			MinimumVersion: optjson.SetString("18.0"),
+			Deadline:       optjson.SetString("2024-08-24"),
+		},
 		WindowsUpdates: fleet.WindowsUpdates{
 			DeadlineDays:    optjson.SetInt(1),
 			GracePeriodDays: optjson.SetInt(1),
@@ -303,10 +332,18 @@ func (s *integrationEnterpriseTestSuite) TestTeamSpecs() {
 	var getTmResp getTeamResponse
 	s.DoJSON("GET", "/api/latest/fleet/teams/"+fmt.Sprint(team.ID), nil, http.StatusOK, &getTmResp)
 	require.Equal(t, fleet.TeamMDM{
-		MacOSUpdates: fleet.MacOSUpdates{
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("10.15.0"),
 			Deadline:       optjson.SetString("2021-01-01"),
 		},
+		IOSUpdates: fleet.AppleOSUpdateSettings{
+			MinimumVersion: optjson.SetString("17.5.1"),
+			Deadline:       optjson.SetString("2024-07-23"),
+		},
+		IPadOSUpdates: fleet.AppleOSUpdateSettings{
+			MinimumVersion: optjson.SetString("18.0"),
+			Deadline:       optjson.SetString("2024-08-24"),
+		},
 		WindowsUpdates: fleet.WindowsUpdates{
 			DeadlineDays:    optjson.SetInt(1),
 			GracePeriodDays: optjson.SetInt(1),
@@ -327,10 +364,18 @@ func (s *integrationEnterpriseTestSuite) TestTeamSpecs() {
 	require.True(t, len(listTmResp.Teams) > 0)
 	require.Equal(t, team.ID, listTmResp.Teams[0].ID)
 	require.Equal(t, fleet.TeamMDM{
-		MacOSUpdates: fleet.MacOSUpdates{
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("10.15.0"),
 			Deadline:       optjson.SetString("2021-01-01"),
 		},
+		IOSUpdates: fleet.AppleOSUpdateSettings{
+			MinimumVersion: optjson.SetString("17.5.1"),
+			Deadline:       optjson.SetString("2024-07-23"),
+		},
+		IPadOSUpdates: fleet.AppleOSUpdateSettings{
+			MinimumVersion: optjson.SetString("18.0"),
+			Deadline:       optjson.SetString("2024-08-24"),
+		},
 		WindowsUpdates: fleet.WindowsUpdates{
 			DeadlineDays:    optjson.SetInt(1),
 			GracePeriodDays: optjson.SetInt(1),
@@ -1075,6 +1120,20 @@ func (s *integrationEnterpriseTestSuite) TestTeamEndpoints() {
 	tmResp.Team = nil
 	s.DoJSON("POST", "/api/latest/fleet/teams", team2, http.StatusConflict, &tmResp)
 
+	// create a team with reserved team names; should be case-insensitive
+	teamReserved := &fleet.Team{
+		Name:        "no TeAm",
+		Description: "description",
+		Secrets:     []*fleet.EnrollSecret{{Secret: "foobar"}},
+	}
+
+	r := s.Do("POST", "/api/latest/fleet/teams", teamReserved, http.StatusUnprocessableEntity)
+	require.Contains(t, extractServerErrorText(r.Body), `"No team" is a reserved team name`)
+
+	teamReserved.Name = "AlL TeaMS"
+	r = s.Do("POST", "/api/latest/fleet/teams", teamReserved, http.StatusUnprocessableEntity)
+	require.Contains(t, extractServerErrorText(r.Body), `"All teams" is a reserved team name`)
+
 	// create a team with too many secrets
 	team3 := &fleet.Team{
 		Name:        name + "lots_of_secrets",
@@ -1174,6 +1233,13 @@ func (s *integrationEnterpriseTestSuite) TestTeamEndpoints() {
 	modifyExpiry.HostExpirySettings.HostExpiryWindow = 0
 	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", tm1ID), modifyExpiry, http.StatusUnprocessableEntity, &tmResp)
 
+	// try to rename to reserved names
+	r = s.Do("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", tm1ID), fleet.TeamPayload{Name: ptr.String("no TEAM")}, http.StatusUnprocessableEntity)
+	require.Contains(t, extractServerErrorText(r.Body), `"No team" is a reserved team name`)
+
+	r = s.Do("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", tm1ID), fleet.TeamPayload{Name: ptr.String("ALL teAMs")}, http.StatusUnprocessableEntity)
+	require.Contains(t, extractServerErrorText(r.Body), `"All teams" is a reserved team name`)
+
 	// Modify team's calendar config
 	modifyCalendar := fleet.TeamPayload{
 		Integrations: &fleet.TeamIntegrations{
@@ -2129,7 +2195,15 @@ func (s *integrationEnterpriseTestSuite) TestWindowsUpdatesTeamConfig() {
 	var getTmResp getTeamResponse
 	s.DoJSON("GET", "/api/latest/fleet/teams/"+fmt.Sprint(team.ID), nil, http.StatusOK, &getTmResp)
 	require.Equal(t, fleet.TeamMDM{
-		MacOSUpdates: fleet.MacOSUpdates{
+		MacOSUpdates: fleet.AppleOSUpdateSettings{
+			MinimumVersion: optjson.String{Set: true},
+			Deadline:       optjson.String{Set: true},
+		},
+		IOSUpdates: fleet.AppleOSUpdateSettings{
+			MinimumVersion: optjson.String{Set: true},
+			Deadline:       optjson.String{Set: true},
+		},
+		IPadOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.String{Set: true},
 			Deadline:       optjson.String{Set: true},
 		},
@@ -2169,7 +2243,7 @@ func (s *integrationEnterpriseTestSuite) TestWindowsUpdatesTeamConfig() {
 	tmResp = teamResponse{}
 	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
 		"mdm": map[string]any{
-			"macos_updates": &fleet.MacOSUpdates{
+			"macos_updates": &fleet.AppleOSUpdateSettings{
 				MinimumVersion: optjson.SetString("10.15.0"),
 				Deadline:       optjson.SetString("2021-01-01"),
 			},
@@ -2275,7 +2349,7 @@ func (s *integrationEnterpriseTestSuite) TestWindowsUpdatesTeamConfig() {
 	}, http.StatusUnprocessableEntity, &tmResp)
 }
 
-func (s *integrationEnterpriseTestSuite) assertMacOSUpdatesDeclaration(teamID *uint, expected *fleet.MacOSUpdates) {
+func (s *integrationEnterpriseTestSuite) assertAppleOSUpdatesDeclaration(teamID *uint, profileName string, expected *fleet.AppleOSUpdateSettings) {
 	t := s.T()
 	if teamID == nil {
 		teamID = ptr.Uint(0)
@@ -2284,7 +2358,7 @@ func (s *integrationEnterpriseTestSuite) assertMacOSUpdatesDeclaration(teamID *u
 	var declUUID string
 	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
 		err := sqlx.GetContext(context.Background(), q, &declUUID,
-			`SELECT declaration_uuid FROM mdm_apple_declarations WHERE team_id = ? AND name = ?`, teamID, mdm.FleetMacOSUpdatesProfileName)
+			`SELECT declaration_uuid FROM mdm_apple_declarations WHERE team_id = ? AND name = ?`, teamID, profileName)
 		if expected == nil {
 			require.Error(t, err)
 			return nil
@@ -2303,10 +2377,9 @@ func (s *integrationEnterpriseTestSuite) assertMacOSUpdatesDeclaration(teamID *u
 	require.Contains(t, string(decl.RawJSON), fmt.Sprintf(`"TargetLocalDateTime": "%sT12:00:00"`, expected.Deadline.Value))
 }
 
-func (s *integrationEnterpriseTestSuite) TestMacOSUpdatesTeamConfig() {
+func (s *integrationEnterpriseTestSuite) TestAppleOSUpdatesTeamConfig() {
 	t := s.T()
 
-	// Create a team
 	team := &fleet.Team{
 		Name:        t.Name(),
 		Description: "Team description",
@@ -2318,41 +2391,92 @@ func (s *integrationEnterpriseTestSuite) TestMacOSUpdatesTeamConfig() {
 	team.ID = tmResp.Team.ID
 
 	// no OS updates settings at the moment
-	s.assertMacOSUpdatesDeclaration(&team.ID, nil)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetMacOSUpdatesProfileName, nil)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetIOSUpdatesProfileName, nil)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetIPadOSUpdatesProfileName, nil)
 
-	// modify the team's config
-	updates := &fleet.MacOSUpdates{
+	// modify the team's config (macOS first)
+	macOSUpdates := &fleet.AppleOSUpdateSettings{
 		MinimumVersion: optjson.SetString("10.15.0"),
 		Deadline:       optjson.SetString("2021-01-01"),
 	}
 	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
 		"mdm": map[string]any{
-			"macos_updates": updates,
+			"macos_updates": macOSUpdates,
 		},
 	}, http.StatusOK, &tmResp)
 	require.Equal(t, "10.15.0", tmResp.Team.Config.MDM.MacOSUpdates.MinimumVersion.Value)
 	require.Equal(t, "2021-01-01", tmResp.Team.Config.MDM.MacOSUpdates.Deadline.Value)
 	s.lastActivityMatches(fleet.ActivityTypeEditedMacOSMinVersion{}.ActivityName(), fmt.Sprintf(`{"team_id": %d, "team_name": %q, "minimum_version": "10.15.0", "deadline": "2021-01-01"}`, team.ID, team.Name), 0)
 
-	s.assertMacOSUpdatesDeclaration(&team.ID, updates)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetMacOSUpdatesProfileName, macOSUpdates)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetIOSUpdatesProfileName, nil)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetIPadOSUpdatesProfileName, nil)
 
-	// only update the deadline
-	updates = &fleet.MacOSUpdates{
+	// modify the team's config (now iOS and iPadOS)
+	iOSUpdates := &fleet.AppleOSUpdateSettings{
+		MinimumVersion: optjson.SetString("11.11.11"),
+		Deadline:       optjson.SetString("2022-02-02"),
+	}
+	iPadOSUpdates := &fleet.AppleOSUpdateSettings{
+		MinimumVersion: optjson.SetString("12.12.12"),
+		Deadline:       optjson.SetString("2023-03-03"),
+	}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
+		"mdm": map[string]any{
+			"ios_updates":    iOSUpdates,
+			"ipados_updates": iPadOSUpdates,
+		},
+	}, http.StatusOK, &tmResp)
+	require.Equal(t, "10.15.0", tmResp.Team.Config.MDM.MacOSUpdates.MinimumVersion.Value)
+	require.Equal(t, "2021-01-01", tmResp.Team.Config.MDM.MacOSUpdates.Deadline.Value)
+	require.Equal(t, "11.11.11", tmResp.Team.Config.MDM.IOSUpdates.MinimumVersion.Value)
+	require.Equal(t, "2022-02-02", tmResp.Team.Config.MDM.IOSUpdates.Deadline.Value)
+	require.Equal(t, "12.12.12", tmResp.Team.Config.MDM.IPadOSUpdates.MinimumVersion.Value)
+	require.Equal(t, "2023-03-03", tmResp.Team.Config.MDM.IPadOSUpdates.Deadline.Value)
+	s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedMacOSMinVersion{}.ActivityName(), fmt.Sprintf(`{"team_id": %d, "team_name": %q, "minimum_version": "10.15.0", "deadline": "2021-01-01"}`, team.ID, team.Name), 0)
+	s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedIOSMinVersion{}.ActivityName(), fmt.Sprintf(`{"team_id": %d, "team_name": %q, "minimum_version": "11.11.11", "deadline": "2022-02-02"}`, team.ID, team.Name), 0)
+	s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedIPadOSMinVersion{}.ActivityName(), fmt.Sprintf(`{"team_id": %d, "team_name": %q, "minimum_version": "12.12.12", "deadline": "2023-03-03"}`, team.ID, team.Name), 0)
+
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetMacOSUpdatesProfileName, macOSUpdates)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetIOSUpdatesProfileName, iOSUpdates)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetIPadOSUpdatesProfileName, iPadOSUpdates)
+
+	// only update the deadlines
+	macOSUpdates = &fleet.AppleOSUpdateSettings{
 		MinimumVersion: optjson.SetString("10.15.0"),
 		Deadline:       optjson.SetString("2025-10-01"),
 	}
+	iOSUpdates = &fleet.AppleOSUpdateSettings{
+		MinimumVersion: optjson.SetString("11.11.11"),
+		Deadline:       optjson.SetString("2024-02-02"),
+	}
+	iPadOSUpdates = &fleet.AppleOSUpdateSettings{
+		MinimumVersion: optjson.SetString("12.12.12"),
+		Deadline:       optjson.SetString("2024-03-03"),
+	}
 	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
 		"mdm": map[string]any{
-			"macos_updates": updates,
+			"macos_updates":  macOSUpdates,
+			"ios_updates":    iOSUpdates,
+			"ipados_updates": iPadOSUpdates,
 		},
 	}, http.StatusOK, &tmResp)
 	require.Equal(t, "10.15.0", tmResp.Team.Config.MDM.MacOSUpdates.MinimumVersion.Value)
 	require.Equal(t, "2025-10-01", tmResp.Team.Config.MDM.MacOSUpdates.Deadline.Value)
-	lastActivity := s.lastActivityMatches(fleet.ActivityTypeEditedMacOSMinVersion{}.ActivityName(), fmt.Sprintf(`{"team_id": %d, "team_name": %q, "minimum_version": "10.15.0", "deadline": "2025-10-01"}`, team.ID, team.Name), 0)
-
-	s.assertMacOSUpdatesDeclaration(&team.ID, updates)
-
-	// setting the windows updates doesn't alter the macos updates
+	require.Equal(t, "11.11.11", tmResp.Team.Config.MDM.IOSUpdates.MinimumVersion.Value)
+	require.Equal(t, "2024-02-02", tmResp.Team.Config.MDM.IOSUpdates.Deadline.Value)
+	require.Equal(t, "12.12.12", tmResp.Team.Config.MDM.IPadOSUpdates.MinimumVersion.Value)
+	require.Equal(t, "2024-03-03", tmResp.Team.Config.MDM.IPadOSUpdates.Deadline.Value)
+	macOSLastActivity := s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedMacOSMinVersion{}.ActivityName(), fmt.Sprintf(`{"team_id": %d, "team_name": %q, "minimum_version": "10.15.0", "deadline": "2025-10-01"}`, team.ID, team.Name), 0)
+	iOSLastActivity := s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedIOSMinVersion{}.ActivityName(), fmt.Sprintf(`{"team_id": %d, "team_name": %q, "minimum_version": "11.11.11", "deadline": "2024-02-02"}`, team.ID, team.Name), 0)
+	iPadOSLastActivity := s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedIPadOSMinVersion{}.ActivityName(), fmt.Sprintf(`{"team_id": %d, "team_name": %q, "minimum_version": "12.12.12", "deadline": "2024-03-03"}`, team.ID, team.Name), 0)
+
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetMacOSUpdatesProfileName, macOSUpdates)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetIOSUpdatesProfileName, iOSUpdates)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetIPadOSUpdatesProfileName, iPadOSUpdates)
+
+	// setting the windows updates doesn't alter the apple updates
 	tmResp = teamResponse{}
 	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
 		"mdm": map[string]any{
@@ -2364,13 +2488,21 @@ func (s *integrationEnterpriseTestSuite) TestMacOSUpdatesTeamConfig() {
 	}, http.StatusOK, &tmResp)
 	require.Equal(t, "10.15.0", tmResp.Team.Config.MDM.MacOSUpdates.MinimumVersion.Value)
 	require.Equal(t, "2025-10-01", tmResp.Team.Config.MDM.MacOSUpdates.Deadline.Value)
+	require.Equal(t, "11.11.11", tmResp.Team.Config.MDM.IOSUpdates.MinimumVersion.Value)
+	require.Equal(t, "2024-02-02", tmResp.Team.Config.MDM.IOSUpdates.Deadline.Value)
+	require.Equal(t, "12.12.12", tmResp.Team.Config.MDM.IPadOSUpdates.MinimumVersion.Value)
+	require.Equal(t, "2024-03-03", tmResp.Team.Config.MDM.IPadOSUpdates.Deadline.Value)
 	require.Equal(t, 10, tmResp.Team.Config.MDM.WindowsUpdates.DeadlineDays.Value)
 	require.Equal(t, 2, tmResp.Team.Config.MDM.WindowsUpdates.GracePeriodDays.Value)
-	// did not create a new activity for macos updates
-	s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedMacOSMinVersion{}.ActivityName(), "", lastActivity)
-	lastActivity = s.lastActivityMatches(fleet.ActivityTypeEditedWindowsUpdates{}.ActivityName(), ``, 0)
+	// did not create a new activity for os updates
+	s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedMacOSMinVersion{}.ActivityName(), "", macOSLastActivity)
+	s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedIOSMinVersion{}.ActivityName(), "", iOSLastActivity)
+	s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedIPadOSMinVersion{}.ActivityName(), "", iPadOSLastActivity)
+	lastActivity := s.lastActivityMatches(fleet.ActivityTypeEditedWindowsUpdates{}.ActivityName(), ``, 0)
 
-	s.assertMacOSUpdatesDeclaration(&team.ID, updates)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetMacOSUpdatesProfileName, macOSUpdates)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetIOSUpdatesProfileName, iOSUpdates)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetIPadOSUpdatesProfileName, iPadOSUpdates)
 
 	// sending a nil MDM or MacOSUpdate config doesn't modify anything
 	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
@@ -2383,10 +2515,16 @@ func (s *integrationEnterpriseTestSuite) TestMacOSUpdatesTeamConfig() {
 	}, http.StatusOK, &tmResp)
 	require.Equal(t, "10.15.0", tmResp.Team.Config.MDM.MacOSUpdates.MinimumVersion.Value)
 	require.Equal(t, "2025-10-01", tmResp.Team.Config.MDM.MacOSUpdates.Deadline.Value)
+	require.Equal(t, "11.11.11", tmResp.Team.Config.MDM.IOSUpdates.MinimumVersion.Value)
+	require.Equal(t, "2024-02-02", tmResp.Team.Config.MDM.IOSUpdates.Deadline.Value)
+	require.Equal(t, "12.12.12", tmResp.Team.Config.MDM.IPadOSUpdates.MinimumVersion.Value)
+	require.Equal(t, "2024-03-03", tmResp.Team.Config.MDM.IPadOSUpdates.Deadline.Value)
 	// no new activity is created
 	s.lastActivityMatches("", "", lastActivity)
 
-	s.assertMacOSUpdatesDeclaration(&team.ID, updates)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetMacOSUpdatesProfileName, macOSUpdates)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetIOSUpdatesProfileName, iOSUpdates)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetIPadOSUpdatesProfileName, iPadOSUpdates)
 
 	// sending macos settings but no macos_updates does not change the macos updates
 	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
@@ -2401,22 +2539,40 @@ func (s *integrationEnterpriseTestSuite) TestMacOSUpdatesTeamConfig() {
 	// no new activity is created
 	s.lastActivityMatches("", "", lastActivity)
 
-	s.assertMacOSUpdatesDeclaration(&team.ID, updates)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetMacOSUpdatesProfileName, macOSUpdates)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetIOSUpdatesProfileName, iOSUpdates)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetIPadOSUpdatesProfileName, iPadOSUpdates)
 
-	// sending empty MacOSUpdate fields empties both fields
+	// sending empty apple os updates fields empties both fields and removes the DDM profiles
 	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
 		"mdm": map[string]any{
 			"macos_updates": map[string]any{
 				"minimum_version": "",
 				"deadline":        nil,
 			},
+			"ios_updates": map[string]any{
+				"minimum_version": "",
+				"deadline":        nil,
+			},
+			"ipados_updates": map[string]any{
+				"minimum_version": "",
+				"deadline":        nil,
+			},
 		},
 	}, http.StatusOK, &tmResp)
 	require.Empty(t, tmResp.Team.Config.MDM.MacOSUpdates.MinimumVersion.Value)
 	require.Empty(t, tmResp.Team.Config.MDM.MacOSUpdates.Deadline.Value)
-	s.lastActivityMatches(fleet.ActivityTypeEditedMacOSMinVersion{}.ActivityName(), fmt.Sprintf(`{"team_id": %d, "team_name": %q, "minimum_version": "", "deadline": ""}`, team.ID, team.Name), 0)
-
-	s.assertMacOSUpdatesDeclaration(&team.ID, nil)
+	require.Empty(t, tmResp.Team.Config.MDM.IOSUpdates.MinimumVersion.Value)
+	require.Empty(t, tmResp.Team.Config.MDM.IOSUpdates.Deadline.Value)
+	require.Empty(t, tmResp.Team.Config.MDM.IPadOSUpdates.MinimumVersion.Value)
+	require.Empty(t, tmResp.Team.Config.MDM.IPadOSUpdates.Deadline.Value)
+	s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedMacOSMinVersion{}.ActivityName(), fmt.Sprintf(`{"team_id": %d, "team_name": %q, "minimum_version": "", "deadline": ""}`, team.ID, team.Name), 0)
+	s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedIOSMinVersion{}.ActivityName(), fmt.Sprintf(`{"team_id": %d, "team_name": %q, "minimum_version": "", "deadline": ""}`, team.ID, team.Name), 0)
+	s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedIPadOSMinVersion{}.ActivityName(), fmt.Sprintf(`{"team_id": %d, "team_name": %q, "minimum_version": "", "deadline": ""}`, team.ID, team.Name), 0)
+
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetMacOSUpdatesProfileName, nil)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetIOSUpdatesProfileName, nil)
+	s.assertAppleOSUpdatesDeclaration(&team.ID, mdm.FleetIPadOSUpdatesProfileName, nil)
 
 	// error checks:
 
@@ -2429,6 +2585,22 @@ func (s *integrationEnterpriseTestSuite) TestMacOSUpdatesTeamConfig() {
 			},
 		},
 	}, http.StatusUnprocessableEntity, &tmResp)
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
+		"mdm": map[string]any{
+			"ios_updates": map[string]any{
+				"minimum_version": "10.15.0",
+				"deadline":        "2021-01-01T00:00:00Z",
+			},
+		},
+	}, http.StatusUnprocessableEntity, &tmResp)
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
+		"mdm": map[string]any{
+			"ipados_updates": map[string]any{
+				"minimum_version": "10.15.0",
+				"deadline":        "2021-01-01T00:00:00Z",
+			},
+		},
+	}, http.StatusUnprocessableEntity, &tmResp)
 
 	// try to set an invalid minimum version
 	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
@@ -2439,6 +2611,22 @@ func (s *integrationEnterpriseTestSuite) TestMacOSUpdatesTeamConfig() {
 			},
 		},
 	}, http.StatusUnprocessableEntity, &tmResp)
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
+		"mdm": map[string]any{
+			"ios_updates": map[string]any{
+				"minimum_version": "10.15.0 (19A583)",
+				"deadline":        "2021-01-01T00:00:00Z",
+			},
+		},
+	}, http.StatusUnprocessableEntity, &tmResp)
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
+		"mdm": map[string]any{
+			"ipados_updates": map[string]any{
+				"minimum_version": "10.15.0 (19A583)",
+				"deadline":        "2021-01-01T00:00:00Z",
+			},
+		},
+	}, http.StatusUnprocessableEntity, &tmResp)
 
 	// try to set a deadline but not a minimum version
 	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
@@ -2448,6 +2636,20 @@ func (s *integrationEnterpriseTestSuite) TestMacOSUpdatesTeamConfig() {
 			},
 		},
 	}, http.StatusUnprocessableEntity, &tmResp)
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
+		"mdm": map[string]any{
+			"ios_updates": map[string]any{
+				"deadline": "2021-01-01T00:00:00Z",
+			},
+		},
+	}, http.StatusUnprocessableEntity, &tmResp)
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
+		"mdm": map[string]any{
+			"ipados_updates": map[string]any{
+				"deadline": "2021-01-01T00:00:00Z",
+			},
+		},
+	}, http.StatusUnprocessableEntity, &tmResp)
 
 	// try to set an empty deadline but not a minimum version
 	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
@@ -2457,6 +2659,20 @@ func (s *integrationEnterpriseTestSuite) TestMacOSUpdatesTeamConfig() {
 			},
 		},
 	}, http.StatusUnprocessableEntity, &tmResp)
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
+		"mdm": map[string]any{
+			"ios_updates": map[string]any{
+				"deadline": "",
+			},
+		},
+	}, http.StatusUnprocessableEntity, &tmResp)
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
+		"mdm": map[string]any{
+			"ipados_updates": map[string]any{
+				"deadline": "",
+			},
+		},
+	}, http.StatusUnprocessableEntity, &tmResp)
 
 	// try to set a minimum version but not a deadline
 	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
@@ -2466,6 +2682,20 @@ func (s *integrationEnterpriseTestSuite) TestMacOSUpdatesTeamConfig() {
 			},
 		},
 	}, http.StatusUnprocessableEntity, &tmResp)
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
+		"mdm": map[string]any{
+			"ios_updates": map[string]any{
+				"minimum_version": "10.15.0 (19A583)",
+			},
+		},
+	}, http.StatusUnprocessableEntity, &tmResp)
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
+		"mdm": map[string]any{
+			"ipados_updates": map[string]any{
+				"minimum_version": "10.15.0 (19A583)",
+			},
+		},
+	}, http.StatusUnprocessableEntity, &tmResp)
 
 	// try to set an empty minimum version but not a deadline
 	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
@@ -2475,6 +2705,20 @@ func (s *integrationEnterpriseTestSuite) TestMacOSUpdatesTeamConfig() {
 			},
 		},
 	}, http.StatusUnprocessableEntity, &tmResp)
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
+		"mdm": map[string]any{
+			"ios_updates": map[string]any{
+				"minimum_version": "",
+			},
+		},
+	}, http.StatusUnprocessableEntity, &tmResp)
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), map[string]any{
+		"mdm": map[string]any{
+			"ipados_updates": map[string]any{
+				"minimum_version": "",
+			},
+		},
+	}, http.StatusUnprocessableEntity, &tmResp)
 }
 
 func (s *integrationEnterpriseTestSuite) TestListDevicePolicies() {
@@ -2667,44 +2911,6 @@ func (s *integrationEnterpriseTestSuite) TestCustomTransparencyURL() {
 	require.Equal(t, fleet.DefaultTransparencyURL, rawResp.Header.Get("Location"))
 }
 
-func (s *integrationEnterpriseTestSuite) TestDefaultAppleBMTeam() {
-	t := s.T()
-
-	tm, err := s.ds.NewTeam(context.Background(), &fleet.Team{
-		Name:        t.Name(),
-		Description: "desc",
-	})
-	require.NoError(s.T(), err)
-
-	var acResp appConfigResponse
-
-	// try to set an invalid team name
-	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
-		"mdm": {
-			"apple_bm_default_team": "xyz"
-		}
-	}`), http.StatusUnprocessableEntity, &acResp)
-
-	// get the appconfig, nothing changed
-	acResp = appConfigResponse{}
-	s.DoJSON("GET", "/api/latest/fleet/config", nil, http.StatusOK, &acResp)
-	require.Empty(t, acResp.MDM.AppleBMDefaultTeam)
-
-	// set to a valid team name
-	acResp = appConfigResponse{}
-	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(fmt.Sprintf(`{
-		"mdm": {
-			"apple_bm_default_team": %q
-		}
-	}`, tm.Name)), http.StatusOK, &acResp)
-	require.Equal(t, tm.Name, acResp.MDM.AppleBMDefaultTeam)
-
-	// get the appconfig, set to that team name
-	acResp = appConfigResponse{}
-	s.DoJSON("GET", "/api/latest/fleet/config", nil, http.StatusOK, &acResp)
-	require.Equal(t, tm.Name, acResp.MDM.AppleBMDefaultTeam)
-}
-
 func (s *integrationEnterpriseTestSuite) TestMDMWindowsUpdates() {
 	t := s.T()
 
@@ -2864,7 +3070,7 @@ func (s *integrationEnterpriseTestSuite) TestMDMWindowsUpdates() {
 	s.lastActivityMatches("", ``, lastActivity)
 }
 
-func (s *integrationEnterpriseTestSuite) TestMDMMacOSUpdates() {
+func (s *integrationEnterpriseTestSuite) TestMDMAppleOSUpdates() {
 	t := s.T()
 
 	// keep the last activity, to detect newly created ones
@@ -2883,7 +3089,7 @@ func (s *integrationEnterpriseTestSuite) TestMDMMacOSUpdates() {
 		// get the appconfig, nothing changed
 		acResp = appConfigResponse{}
 		s.DoJSON("GET", "/api/latest/fleet/config", nil, http.StatusOK, &acResp)
-		require.Equal(t, fleet.MacOSUpdates{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}}, acResp.MDM.MacOSUpdates)
+		require.Equal(t, fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}}, acResp.MDM.MacOSUpdates)
 
 		// no activity got created
 		activitiesResp = listActivitiesResponse{}
@@ -2900,6 +3106,16 @@ func (s *integrationEnterpriseTestSuite) TestMDMMacOSUpdates() {
 			"deadline": "2022-01-01"
 		}
 	}}`)
+	checkInvalidConfig(`{"mdm": {
+		"ios_updates": {
+			"deadline": "2022-01-01"
+		}
+	}}`)
+	checkInvalidConfig(`{"mdm": {
+		"ipados_updates": {
+			"deadline": "2022-01-01"
+		}
+	}}`)
 
 	// missing deadline
 	checkInvalidConfig(`{"mdm": {
@@ -2907,6 +3123,16 @@ func (s *integrationEnterpriseTestSuite) TestMDMMacOSUpdates() {
 			"minimum_version": "12.1.1"
 		}
 	}}`)
+	checkInvalidConfig(`{"mdm": {
+		"ios_updates": {
+			"minimum_version": "12.1.1"
+		}
+	}}`)
+	checkInvalidConfig(`{"mdm": {
+		"ipados_updates": {
+			"minimum_version": "12.1.1"
+		}
+	}}`)
 
 	// invalid deadline
 	checkInvalidConfig(`{"mdm": {
@@ -2915,6 +3141,18 @@ func (s *integrationEnterpriseTestSuite) TestMDMMacOSUpdates() {
 			"deadline": "2022"
 		}
 	}}`)
+	checkInvalidConfig(`{"mdm": {
+		"ios_updates": {
+			"minimum_version": "12.1.1",
+			"deadline": "2022"
+		}
+	}}`)
+	checkInvalidConfig(`{"mdm": {
+		"ipados_updates": {
+			"minimum_version": "12.1.1",
+			"deadline": "2022"
+		}
+	}}`)
 
 	// deadline includes timestamp
 	checkInvalidConfig(`{"mdm": {
@@ -2923,6 +3161,18 @@ func (s *integrationEnterpriseTestSuite) TestMDMMacOSUpdates() {
 			"deadline": "2022-01-01T00:00:00Z"
 		}
 	}}`)
+	checkInvalidConfig(`{"mdm": {
+		"ios_updates": {
+			"minimum_version": "12.1.1",
+			"deadline": "2022-01-01T00:00:00Z"
+		}
+	}}`)
+	checkInvalidConfig(`{"mdm": {
+		"ipados_updates": {
+			"minimum_version": "12.1.1",
+			"deadline": "2022-01-01T00:00:00Z"
+		}
+	}}`)
 
 	// minimum_version includes build info
 	checkInvalidConfig(`{"mdm": {
@@ -2931,6 +3181,18 @@ func (s *integrationEnterpriseTestSuite) TestMDMMacOSUpdates() {
 			"deadline": "2022-01-01"
 		}
 	}}`)
+	checkInvalidConfig(`{"mdm": {
+		"ios_updates": {
+			"minimum_version": "12.1.1 (ABCD)",
+			"deadline": "2022-01-01"
+		}
+	}}`)
+	checkInvalidConfig(`{"mdm": {
+		"ipados_updates": {
+			"minimum_version": "12.1.1 (ABCD)",
+			"deadline": "2022-01-01"
+		}
+	}}`)
 
 	// valid config
 	acResp := appConfigResponse{}
@@ -2939,23 +3201,47 @@ func (s *integrationEnterpriseTestSuite) TestMDMMacOSUpdates() {
 				"macos_updates": {
 					"minimum_version": "12.3.1",
 					"deadline": "2022-01-01"
+				},
+				"ios_updates": {
+					"minimum_version": "13.13.13",
+					"deadline": "2023-03-03"
+				},
+				"ipados_updates": {
+					"minimum_version": "14.14.14",
+					"deadline": "2024-04-04"
 				}
 			}
 		}`), http.StatusOK, &acResp)
 	require.Equal(t, "12.3.1", acResp.MDM.MacOSUpdates.MinimumVersion.Value)
 	require.Equal(t, "2022-01-01", acResp.MDM.MacOSUpdates.Deadline.Value)
+	require.Equal(t, "13.13.13", acResp.MDM.IOSUpdates.MinimumVersion.Value)
+	require.Equal(t, "2023-03-03", acResp.MDM.IOSUpdates.Deadline.Value)
+	require.Equal(t, "14.14.14", acResp.MDM.IPadOSUpdates.MinimumVersion.Value)
+	require.Equal(t, "2024-04-04", acResp.MDM.IPadOSUpdates.Deadline.Value)
 
 	// edited macos min version activity got created
-	s.lastActivityMatches(fleet.ActivityTypeEditedMacOSMinVersion{}.ActivityName(), `{"deadline":"2022-01-01", "minimum_version":"12.3.1", "team_id": null, "team_name": null}`, 0)
-	s.assertMacOSUpdatesDeclaration(nil, &fleet.MacOSUpdates{
+	s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedMacOSMinVersion{}.ActivityName(), `{"deadline":"2022-01-01", "minimum_version":"12.3.1", "team_id": null, "team_name": null}`, 0)
+	s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedIOSMinVersion{}.ActivityName(), `{"deadline":"2023-03-03", "minimum_version":"13.13.13", "team_id": null, "team_name": null}`, 0)
+	s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedIPadOSMinVersion{}.ActivityName(), `{"deadline":"2024-04-04", "minimum_version":"14.14.14", "team_id": null, "team_name": null}`, 0)
+	s.assertAppleOSUpdatesDeclaration(nil, mdm.FleetMacOSUpdatesProfileName, &fleet.AppleOSUpdateSettings{
 		MinimumVersion: optjson.SetString("12.3.1"), Deadline: optjson.SetString("2022-01-01"),
 	})
+	s.assertAppleOSUpdatesDeclaration(nil, mdm.FleetIOSUpdatesProfileName, &fleet.AppleOSUpdateSettings{
+		MinimumVersion: optjson.SetString("13.13.13"), Deadline: optjson.SetString("2023-03-03"),
+	})
+	s.assertAppleOSUpdatesDeclaration(nil, mdm.FleetIPadOSUpdatesProfileName, &fleet.AppleOSUpdateSettings{
+		MinimumVersion: optjson.SetString("14.14.14"), Deadline: optjson.SetString("2024-04-04"),
+	})
 
 	// get the appconfig
 	acResp = appConfigResponse{}
 	s.DoJSON("GET", "/api/latest/fleet/config", nil, http.StatusOK, &acResp)
 	require.Equal(t, "12.3.1", acResp.MDM.MacOSUpdates.MinimumVersion.Value)
 	require.Equal(t, "2022-01-01", acResp.MDM.MacOSUpdates.Deadline.Value)
+	require.Equal(t, "13.13.13", acResp.MDM.IOSUpdates.MinimumVersion.Value)
+	require.Equal(t, "2023-03-03", acResp.MDM.IOSUpdates.Deadline.Value)
+	require.Equal(t, "14.14.14", acResp.MDM.IPadOSUpdates.MinimumVersion.Value)
+	require.Equal(t, "2024-04-04", acResp.MDM.IPadOSUpdates.Deadline.Value)
 
 	// update the deadline
 	acResp = appConfigResponse{}
@@ -2964,17 +3250,37 @@ func (s *integrationEnterpriseTestSuite) TestMDMMacOSUpdates() {
 				"macos_updates": {
 					"minimum_version": "12.3.1",
 					"deadline": "2024-01-01"
+				},
+				"ios_updates": {
+					"minimum_version": "13.13.13",
+					"deadline": "2025-05-05"
+				},
+				"ipados_updates": {
+					"minimum_version": "14.14.14",
+					"deadline": "2026-06-06"
 				}
 			}
 		}`), http.StatusOK, &acResp)
 	require.Equal(t, "12.3.1", acResp.MDM.MacOSUpdates.MinimumVersion.Value)
 	require.Equal(t, "2024-01-01", acResp.MDM.MacOSUpdates.Deadline.Value)
+	require.Equal(t, "13.13.13", acResp.MDM.IOSUpdates.MinimumVersion.Value)
+	require.Equal(t, "2025-05-05", acResp.MDM.IOSUpdates.Deadline.Value)
+	require.Equal(t, "14.14.14", acResp.MDM.IPadOSUpdates.MinimumVersion.Value)
+	require.Equal(t, "2026-06-06", acResp.MDM.IPadOSUpdates.Deadline.Value)
 
 	// another edited macos min version activity got created
-	lastActivity = s.lastActivityMatches(fleet.ActivityTypeEditedMacOSMinVersion{}.ActivityName(), `{"deadline":"2024-01-01", "minimum_version":"12.3.1", "team_id": null, "team_name": null}`, 0)
-	s.assertMacOSUpdatesDeclaration(nil, &fleet.MacOSUpdates{
+	s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedMacOSMinVersion{}.ActivityName(), `{"deadline":"2024-01-01", "minimum_version":"12.3.1", "team_id": null, "team_name": null}`, 0)
+	s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedIOSMinVersion{}.ActivityName(), `{"deadline":"2025-05-05", "minimum_version":"13.13.13", "team_id": null, "team_name": null}`, 0)
+	lastActivity = s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedIPadOSMinVersion{}.ActivityName(), `{"deadline":"2026-06-06", "minimum_version":"14.14.14", "team_id": null, "team_name": null}`, 0)
+	s.assertAppleOSUpdatesDeclaration(nil, mdm.FleetMacOSUpdatesProfileName, &fleet.AppleOSUpdateSettings{
 		MinimumVersion: optjson.SetString("12.3.1"), Deadline: optjson.SetString("2024-01-01"),
 	})
+	s.assertAppleOSUpdatesDeclaration(nil, mdm.FleetIOSUpdatesProfileName, &fleet.AppleOSUpdateSettings{
+		MinimumVersion: optjson.SetString("13.13.13"), Deadline: optjson.SetString("2025-05-05"),
+	})
+	s.assertAppleOSUpdatesDeclaration(nil, mdm.FleetIPadOSUpdatesProfileName, &fleet.AppleOSUpdateSettings{
+		MinimumVersion: optjson.SetString("14.14.14"), Deadline: optjson.SetString("2026-06-06"),
+	})
 
 	// update something unrelated - the transparency url
 	acResp = appConfigResponse{}
@@ -2984,43 +3290,81 @@ func (s *integrationEnterpriseTestSuite) TestMDMMacOSUpdates() {
 
 	// no activity got created
 	s.lastActivityMatches("", ``, lastActivity)
-	s.assertMacOSUpdatesDeclaration(nil, &fleet.MacOSUpdates{
+	s.assertAppleOSUpdatesDeclaration(nil, mdm.FleetMacOSUpdatesProfileName, &fleet.AppleOSUpdateSettings{
 		MinimumVersion: optjson.SetString("12.3.1"), Deadline: optjson.SetString("2024-01-01"),
 	})
+	s.assertAppleOSUpdatesDeclaration(nil, mdm.FleetIOSUpdatesProfileName, &fleet.AppleOSUpdateSettings{
+		MinimumVersion: optjson.SetString("13.13.13"), Deadline: optjson.SetString("2025-05-05"),
+	})
+	s.assertAppleOSUpdatesDeclaration(nil, mdm.FleetIPadOSUpdatesProfileName, &fleet.AppleOSUpdateSettings{
+		MinimumVersion: optjson.SetString("14.14.14"), Deadline: optjson.SetString("2026-06-06"),
+	})
 
-	// clear the macos requirement
+	// clear the apple OS requirements
 	acResp = appConfigResponse{}
 	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
 			"mdm": {
 				"macos_updates": {
 					"minimum_version": "",
 					"deadline": ""
+				},
+				"ios_updates": {
+					"minimum_version": "",
+					"deadline": ""
+				},
+				"ipados_updates": {
+					"minimum_version": "",
+					"deadline": ""
 				}
 			}
 		}`), http.StatusOK, &acResp)
 	require.Empty(t, acResp.MDM.MacOSUpdates.MinimumVersion.Value)
 	require.Empty(t, acResp.MDM.MacOSUpdates.Deadline.Value)
+	require.Empty(t, acResp.MDM.IOSUpdates.MinimumVersion.Value)
+	require.Empty(t, acResp.MDM.IOSUpdates.Deadline.Value)
+	require.Empty(t, acResp.MDM.IPadOSUpdates.MinimumVersion.Value)
+	require.Empty(t, acResp.MDM.IPadOSUpdates.Deadline.Value)
 
 	// edited macos min version activity got created with empty requirement
-	lastActivity = s.lastActivityMatches(fleet.ActivityTypeEditedMacOSMinVersion{}.ActivityName(), `{"deadline":"", "minimum_version":"", "team_id": null, "team_name": null}`, 0)
-	s.assertMacOSUpdatesDeclaration(nil, nil)
+	s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedMacOSMinVersion{}.ActivityName(), `{"deadline":"", "minimum_version":"", "team_id": null, "team_name": null}`, 0)
+	s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedIOSMinVersion{}.ActivityName(), `{"deadline":"", "minimum_version":"", "team_id": null, "team_name": null}`, 0)
+	lastActivity = s.lastActivityOfTypeMatches(fleet.ActivityTypeEditedIPadOSMinVersion{}.ActivityName(), `{"deadline":"", "minimum_version":"", "team_id": null, "team_name": null}`, 0)
 
-	// update again with empty macos requirement
+	// check DDM profiles were removed
+	s.assertAppleOSUpdatesDeclaration(nil, mdm.FleetMacOSUpdatesProfileName, nil)
+	s.assertAppleOSUpdatesDeclaration(nil, mdm.FleetIOSUpdatesProfileName, nil)
+	s.assertAppleOSUpdatesDeclaration(nil, mdm.FleetIPadOSUpdatesProfileName, nil)
+
+	// update again with empty apple OS requirements
 	acResp = appConfigResponse{}
 	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
 			"mdm": {
 				"macos_updates": {
 					"minimum_version": "",
 					"deadline": ""
+				},
+				"ios_updates": {
+					"minimum_version": "",
+					"deadline": ""
+				},
+				"ipados_updates": {
+					"minimum_version": "",
+					"deadline": ""
 				}
 			}
 		}`), http.StatusOK, &acResp)
 	require.Empty(t, acResp.MDM.MacOSUpdates.MinimumVersion.Value)
 	require.Empty(t, acResp.MDM.MacOSUpdates.Deadline.Value)
+	require.Empty(t, acResp.MDM.IOSUpdates.MinimumVersion.Value)
+	require.Empty(t, acResp.MDM.IOSUpdates.Deadline.Value)
+	require.Empty(t, acResp.MDM.IPadOSUpdates.MinimumVersion.Value)
+	require.Empty(t, acResp.MDM.IPadOSUpdates.Deadline.Value)
 
-	// no activity got created
+	// no activity or DDM profiles were created
 	s.lastActivityMatches("", ``, lastActivity)
-	s.assertMacOSUpdatesDeclaration(nil, nil)
+	s.assertAppleOSUpdatesDeclaration(nil, mdm.FleetMacOSUpdatesProfileName, nil)
+	s.assertAppleOSUpdatesDeclaration(nil, mdm.FleetIOSUpdatesProfileName, nil)
+	s.assertAppleOSUpdatesDeclaration(nil, mdm.FleetIPadOSUpdatesProfileName, nil)
 }
 
 func (s *integrationEnterpriseTestSuite) TestSSOJITProvisioning() {
@@ -3956,6 +4300,28 @@ func (s *integrationEnterpriseTestSuite) TestOSVersions() {
 		"GET", fmt.Sprintf("/api/latest/fleet/os_versions/%d", osinfo.OSVersionID), nil, http.StatusForbidden, &osVersionResp, "team_id",
 		"99999",
 	)
+
+	// team user doesn't have acess to "no team"
+	osVersionsResp = osVersionsResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/os_versions"), nil, http.StatusForbidden, &osVersionsResp, "team_id", "0")
+	require.Len(t, osVersionsResp.OSVersions, 0)
+
+	// team_id=0 is supported and returns results for hosts in "no team"
+	s.token = getTestAdminToken(t, s.server)
+	// no hosts, the results are empty
+	osVersionsResp = osVersionsResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/os_versions"), nil, http.StatusOK, &osVersionsResp, "team_id", "0")
+	require.Len(t, osVersionsResp.OSVersions, 0)
+	osVersionsResp = osVersionsResponse{}
+	// move the host to "no team" and update the stats
+	require.NoError(t, s.ds.AddHostsToTeam(context.Background(), nil, []uint{hosts[0].ID}))
+	require.NoError(t, s.ds.UpdateOSVersions(context.Background()))
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/os_versions"), nil, http.StatusOK, &osVersionsResp, "team_id", "0")
+	require.Len(t, osVersionsResp.OSVersions, 1)
+	osVersionResp = getOSVersionResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/os_versions/%d", osinfo.OSVersionID), nil, http.StatusOK, &osVersionResp, "team_id", "0")
+	require.Equal(t, &expectedOSVersion, osVersionResp.OSVersion)
+	require.Equal(t, 1, osVersionResp.OSVersion.HostsCount)
 }
 
 func (s *integrationEnterpriseTestSuite) TestMDMNotConfiguredEndpoints() {
@@ -4321,6 +4687,13 @@ func createHostAndDeviceToken(t *testing.T, ds *mysql.Datastore, token string) *
 	return host
 }
 
+func updateDeviceTokenForHost(t *testing.T, ds *mysql.Datastore, hostID uint, token string) {
+	mysql.ExecAdhocSQL(t, ds, func(db sqlx.ExtContext) error {
+		_, err := db.ExecContext(context.Background(), `UPDATE host_device_auth SET token = ? WHERE host_id = ?`, token, hostID)
+		return err
+	})
+}
+
 func createDeviceTokenForHost(t *testing.T, ds *mysql.Datastore, hostID uint, token string) {
 	mysql.ExecAdhocSQL(t, ds, func(db sqlx.ExtContext) error {
 		_, err := db.ExecContext(context.Background(), `INSERT INTO host_device_auth (host_id, token) VALUES (?, ?)`, hostID, token)
@@ -4432,29 +4805,131 @@ func (s *integrationEnterpriseTestSuite) TestListSoftware() {
 	require.Equal(t, barPayload.Vulnerabilities[0].CVEPublished, ptr.TimePtr(now))
 	require.Equal(t, barPayload.Vulnerabilities[0].Description, ptr.StringPtr("a long description of the cve"))
 	require.Equal(t, barPayload.Vulnerabilities[0].ResolvedInVersion, ptr.StringPtr("1.2.3"))
-}
 
-// TestGitOpsUserActions tests the MDM permissions listed in ../../docs/Using\ Fleet/manage-access.md
-func (s *integrationEnterpriseTestSuite) TestGitOpsUserActions() {
-	t := s.T()
-	ctx := context.Background()
+	// vulnerable param required when using vulnerability filters
+	respVersions = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusUnprocessableEntity, &respVersions,
+		"exploit", "true",
+	)
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusUnprocessableEntity, &respVersions,
+		"min_cvss_score", "1.1",
+	)
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusUnprocessableEntity, &respVersions,
+		"max_cvss_score", "10.0",
+	)
 
-	//
-	// Setup test data.
-	// All setup actions are authored by a global admin.
-	//
+	// vulnerability filters
+	respVersions = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusOK, &respVersions,
+		"exploit", "true",
+		"vulnerable", "true",
+	)
+	require.Len(t, respVersions.Software, 1)
+	require.NotEmpty(t, respVersions.CountsUpdatedAt)
 
-	admin, err := s.ds.UserByEmail(ctx, "admin1@example.com")
-	require.NoError(t, err)
-	h1, err := s.ds.NewHost(ctx, &fleet.Host{
-		NodeKey:  ptr.String(t.Name() + "1"),
-		UUID:     t.Name() + "1",
-		Hostname: strings.Replace(t.Name()+"foo.local", "/", "_", -1),
-	})
-	require.NoError(t, err)
-	t1, err := s.ds.NewTeam(ctx, &fleet.Team{
-		Name: "Foo",
-	})
+	respVersions = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusOK, &respVersions,
+		"min_cvss_score", "1",
+		"vulnerable", "true",
+	)
+	require.Len(t, respVersions.Software, 1)
+	require.NotEmpty(t, respVersions.CountsUpdatedAt)
+
+	respVersions = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusOK, &respVersions,
+		"min_cvss_score", "10",
+		"vulnerable", "true",
+	)
+	require.Len(t, respVersions.Software, 0)
+	require.Nil(t, respVersions.CountsUpdatedAt)
+
+	respVersions = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusOK, &respVersions,
+		"max_cvss_score", "10",
+		"vulnerable", "true",
+	)
+	require.Len(t, respVersions.Software, 1)
+	require.NotEmpty(t, respVersions.CountsUpdatedAt)
+
+	respVersions = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusOK, &respVersions,
+		"max_cvss_score", "1",
+		"vulnerable", "true",
+	)
+	require.Len(t, respVersions.Software, 0)
+	require.Nil(t, respVersions.CountsUpdatedAt)
+
+	respVersions = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusOK, &respVersions,
+		"min_cvss_score", "1",
+		"max_cvss_score", "10",
+		"vulnerable", "true",
+	)
+	require.Len(t, respVersions.Software, 1)
+	require.NotEmpty(t, respVersions.CountsUpdatedAt)
+
+	respVersions = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusOK, &respVersions,
+		"min_cvss_score", "1",
+		"max_cvss_score", "10",
+		"exploit", "true",
+		"vulnerable", "true",
+	)
+	require.Len(t, respVersions.Software, 1)
+	require.NotEmpty(t, respVersions.CountsUpdatedAt)
+}
+
+// TestGitOpsUserActions tests the MDM permissions listed in ../../docs/Using\ Fleet/manage-access.md
+func (s *integrationEnterpriseTestSuite) TestGitOpsUserActions() {
+	t := s.T()
+	ctx := context.Background()
+
+	//
+	// Setup test data.
+	// All setup actions are authored by a global admin.
+	//
+
+	admin, err := s.ds.UserByEmail(ctx, "admin1@example.com")
+	require.NoError(t, err)
+	h1, err := s.ds.NewHost(ctx, &fleet.Host{
+		NodeKey:  ptr.String(t.Name() + "1"),
+		UUID:     t.Name() + "1",
+		Hostname: strings.Replace(t.Name()+"foo.local", "/", "_", -1),
+	})
+	require.NoError(t, err)
+	t1, err := s.ds.NewTeam(ctx, &fleet.Team{
+		Name: "Foo",
+	})
 	require.NoError(t, err)
 	t2, err := s.ds.NewTeam(ctx, &fleet.Team{
 		Name: "Bar",
@@ -5257,7 +5732,7 @@ func (s *integrationEnterpriseTestSuite) TestRunHostScript() {
 	// attempt to run an empty script
 	res := s.Do("POST", "/api/latest/fleet/scripts/run", fleet.HostScriptRequestPayload{HostID: host.ID, ScriptContents: ""}, http.StatusUnprocessableEntity)
 	errMsg := extractServerErrorText(res.Body)
-	require.Contains(t, errMsg, "Script contents must not be empty.")
+	require.Contains(t, errMsg, "Validation Failed: One of 'script_id', 'script_contents', or 'script_name' is required.")
 
 	// attempt to run an overly long script
 	res = s.Do("POST", "/api/latest/fleet/scripts/run", fleet.HostScriptRequestPayload{HostID: host.ID, ScriptContents: strings.Repeat("a", fleet.UnsavedScriptMaxRuneLen+1)}, http.StatusUnprocessableEntity)
@@ -5286,7 +5761,7 @@ func (s *integrationEnterpriseTestSuite) TestRunHostScript() {
 	require.Equal(t, "echo", scriptResultResp.ScriptContents)
 	require.Nil(t, scriptResultResp.ExitCode)
 	require.False(t, scriptResultResp.HostTimeout)
-	require.Contains(t, scriptResultResp.Message, fleet.RunScriptAsyncScriptEnqueuedErrMsg)
+	require.Contains(t, scriptResultResp.Message, fleet.RunScriptAsyncScriptEnqueuedMsg)
 
 	// an async script doesn't care about timeouts
 	now := time.Now()
@@ -5303,7 +5778,7 @@ func (s *integrationEnterpriseTestSuite) TestRunHostScript() {
 	require.Equal(t, "echo", scriptResultResp.ScriptContents)
 	require.Nil(t, scriptResultResp.ExitCode)
 	require.False(t, scriptResultResp.HostTimeout)
-	require.Contains(t, scriptResultResp.Message, fleet.RunScriptAsyncScriptEnqueuedErrMsg)
+	require.Contains(t, scriptResultResp.Message, fleet.RunScriptAsyncScriptEnqueuedMsg)
 
 	// Disable scripts and verify that there are no Orbit notifs
 	acr := appConfigResponse{}
@@ -5545,6 +6020,21 @@ func (s *integrationEnterpriseTestSuite) TestRunHostScript() {
 	require.Contains(t, extractServerErrorText(res.Body), fleet.RunScriptDisabledErrMsg)
 	res = s.Do("POST", "/api/latest/fleet/scripts/run/sync", fleet.HostScriptRequestPayload{HostID: plainOsqueryHost.ID, ScriptContents: "echo"}, http.StatusUnprocessableEntity)
 	require.Contains(t, extractServerErrorText(res.Body), fleet.RunScriptDisabledErrMsg)
+
+	// create a execution request that will return a timeout
+	s.DoJSON("POST", "/api/latest/fleet/scripts/run", fleet.HostScriptRequestPayload{HostID: host.ID, ScriptContents: "echo"}, http.StatusAccepted, &runResp)
+
+	// simulate a host response
+	s.DoJSON("POST", "/api/fleet/orbit/scripts/result",
+		json.RawMessage(fmt.Sprintf(`{"orbit_node_key": %q, "execution_id": %q, "exit_code": -1, "output": "script execution error: signal: killed", "timeout": 900}`, *host.OrbitNodeKey, runSyncResp.ExecutionID)),
+		http.StatusOK, &orbitPostScriptResp)
+
+	s.DoJSON("GET", "/api/latest/fleet/scripts/results/"+runSyncResp.ExecutionID, nil, http.StatusOK, &scriptResultResp)
+	require.Equal(t, host.ID, scriptResultResp.HostID)
+	require.Equal(t, "echo", scriptResultResp.ScriptContents)
+	require.Equal(t, int64(-1), *scriptResultResp.ExitCode)
+	require.Equal(t, "Timeout. Fleet stopped the script after 900 seconds to protect host performance.", scriptResultResp.Message)
+	require.Equal(t, "script execution error: signal: killed", scriptResultResp.Output)
 }
 
 func (s *integrationEnterpriseTestSuite) TestRunHostSavedScript() {
@@ -5609,7 +6099,7 @@ func (s *integrationEnterpriseTestSuite) TestRunHostSavedScript() {
 	require.Equal(t, "echo 'no team'", scriptResultResp.ScriptContents)
 	require.Nil(t, scriptResultResp.ExitCode)
 	require.False(t, scriptResultResp.HostTimeout)
-	require.Contains(t, scriptResultResp.Message, fleet.RunScriptAsyncScriptEnqueuedErrMsg)
+	require.Contains(t, scriptResultResp.Message, fleet.RunScriptAsyncScriptEnqueuedMsg)
 	require.NotNil(t, scriptResultResp.ScriptID)
 	require.Equal(t, savedNoTmScript.ID, *scriptResultResp.ScriptID)
 
@@ -5678,26 +6168,46 @@ func (s *integrationEnterpriseTestSuite) TestRunHostSavedScript() {
 	errMsg = extractServerErrorText(res.Body)
 	require.Contains(t, errMsg, `Only one of 'script_contents' or 'script_name' is allowed.`)
 
+	res = s.Do("POST", "/api/latest/fleet/scripts/run", fleet.HostScriptRequestPayload{HostID: host.ID, ScriptContents: "echo", ScriptName: savedTmScript.Name}, http.StatusUnprocessableEntity)
+	errMsg = extractServerErrorText(res.Body)
+	require.Contains(t, errMsg, `Only one of 'script_contents' or 'script_name' is allowed.`)
+
 	// attempt to run sync with both script id and script name
 	res = s.Do("POST", "/api/latest/fleet/scripts/run/sync", fleet.HostScriptRequestPayload{HostID: host.ID, ScriptID: ptr.Uint(savedTmScript.ID + 999), ScriptName: savedTmScript.Name}, http.StatusUnprocessableEntity)
 	errMsg = extractServerErrorText(res.Body)
 	require.Contains(t, errMsg, `Only one of 'script_id' or 'script_name' is allowed.`)
 
+	res = s.Do("POST", "/api/latest/fleet/scripts/run", fleet.HostScriptRequestPayload{HostID: host.ID, ScriptID: ptr.Uint(savedTmScript.ID + 999), ScriptName: savedTmScript.Name}, http.StatusUnprocessableEntity)
+	errMsg = extractServerErrorText(res.Body)
+	require.Contains(t, errMsg, `Only one of 'script_id' or 'script_name' is allowed.`)
+
 	// attempt to run sync with both script contents and team id
 	res = s.Do("POST", "/api/latest/fleet/scripts/run/sync", fleet.HostScriptRequestPayload{HostID: host.ID, ScriptContents: "echo", TeamID: 1}, http.StatusUnprocessableEntity)
 	errMsg = extractServerErrorText(res.Body)
 	require.Contains(t, errMsg, `Only one of 'script_contents' or 'team_id' is allowed.`)
 
+	res = s.Do("POST", "/api/latest/fleet/scripts/run", fleet.HostScriptRequestPayload{HostID: host.ID, ScriptContents: "echo", TeamID: 1}, http.StatusUnprocessableEntity)
+	errMsg = extractServerErrorText(res.Body)
+	require.Contains(t, errMsg, `Only one of 'script_contents' or 'team_id' is allowed.`)
+
 	// attempt to run sync with both script id and team id
 	res = s.Do("POST", "/api/latest/fleet/scripts/run/sync", fleet.HostScriptRequestPayload{HostID: host.ID, ScriptID: ptr.Uint(savedTmScript.ID + 999), TeamID: 1}, http.StatusUnprocessableEntity)
 	errMsg = extractServerErrorText(res.Body)
 	require.Contains(t, errMsg, `Only one of 'script_id' or 'team_id' is allowed.`)
 
+	res = s.Do("POST", "/api/latest/fleet/scripts/run", fleet.HostScriptRequestPayload{HostID: host.ID, ScriptID: ptr.Uint(savedTmScript.ID + 999), TeamID: 1}, http.StatusUnprocessableEntity)
+	errMsg = extractServerErrorText(res.Body)
+	require.Contains(t, errMsg, `Only one of 'script_id' or 'team_id' is allowed.`)
+
 	// attempt to run sync without script contents, script id, or script name
 	res = s.Do("POST", "/api/latest/fleet/scripts/run/sync", fleet.HostScriptRequestPayload{HostID: host.ID}, http.StatusUnprocessableEntity)
 	errMsg = extractServerErrorText(res.Body)
 	require.Contains(t, errMsg, `One of 'script_id', 'script_contents', or 'script_name' is required.`)
 
+	res = s.Do("POST", "/api/latest/fleet/scripts/run", fleet.HostScriptRequestPayload{HostID: host.ID}, http.StatusUnprocessableEntity)
+	errMsg = extractServerErrorText(res.Body)
+	require.Contains(t, errMsg, `One of 'script_id', 'script_contents', or 'script_name' is required.`)
+
 	// deleting the saved script does not impact the pending script
 	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/scripts/%d", savedNoTmScript.ID), nil, http.StatusNoContent)
 
@@ -5755,6 +6265,13 @@ func (s *integrationEnterpriseTestSuite) TestRunHostSavedScript() {
 	require.NoError(t, err)
 	require.NotEqual(t, savedNoTmScript2.ID, savedTmScript2.ID)
 
+	_, err = s.ds.NewScript(ctx, &fleet.Script{
+		TeamID:         nil,
+		Name:           "f13372.sh",
+		ScriptContents: "echo 'ALL YOUR BASE ARE BELONG TO US'",
+	})
+	require.NoError(t, err)
+
 	// make sure the new host is seen as "online"
 	err = s.ds.MarkHostsSeen(ctx, []uint{host2.ID}, time.Now())
 	require.NoError(t, err)
@@ -5799,6 +6316,31 @@ func (s *integrationEnterpriseTestSuite) TestRunHostSavedScript() {
 	require.Contains(t, extractServerErrorText(res.Body), fleet.RunScriptDisabledErrMsg)
 	res = s.Do("POST", "/api/latest/fleet/scripts/run/sync", fleet.HostScriptRequestPayload{HostID: plainOsqueryHost.ID, ScriptID: &script.ID}, http.StatusUnprocessableEntity)
 	require.Contains(t, extractServerErrorText(res.Body), fleet.RunScriptDisabledErrMsg)
+
+	// Async Run Script by Name
+
+	// attempt to run async with a script that does not exist on the specified team
+	res = s.Do("POST", "/api/latest/fleet/scripts/run", fleet.HostScriptRequestPayload{HostID: host2.ID, ScriptName: "f1337.sh", TeamID: tm.ID}, http.StatusUnprocessableEntity)
+	errMsg = extractServerErrorText(res.Body)
+	require.Contains(t, errMsg, `Script 'f1337.sh' doesn’t exist.`)
+
+	// attempt to run async with an existing team script that belongs to a team different from the host's team
+	res = s.Do("POST", "/api/latest/fleet/scripts/run", fleet.HostScriptRequestPayload{HostID: host2.ID, ScriptName: "f1337.sh", TeamID: tm2.ID}, http.StatusUnprocessableEntity)
+	errMsg = extractServerErrorText(res.Body)
+	require.Contains(t, errMsg, `The script does not belong to the same team`)
+
+	var runSyncResp3 runScriptSyncResponse
+	s.DoJSON("POST", "/api/latest/fleet/scripts/run", fleet.HostScriptRequestPayload{HostID: host2.ID, ScriptName: "f13372.sh"}, http.StatusAccepted, &runSyncResp3)
+	require.Equal(t, host2.ID, runSyncResp3.HostID)
+	require.NotEmpty(t, runSyncResp3.ExecutionID)
+
+	// verify pending result
+	s.DoJSON("GET", "/api/latest/fleet/scripts/results/"+runSyncResp3.ExecutionID, nil, http.StatusOK, &scriptResultResp)
+	require.Equal(t, host2.ID, scriptResultResp.HostID)
+	require.Equal(t, "echo 'ALL YOUR BASE ARE BELONG TO US'", scriptResultResp.ScriptContents)
+	require.Nil(t, scriptResultResp.ExitCode)
+	require.False(t, scriptResultResp.HostTimeout)
+	require.Contains(t, scriptResultResp.Message, fleet.RunScriptAsyncScriptEnqueuedMsg)
 }
 
 func (s *integrationEnterpriseTestSuite) TestEnqueueSameScriptTwice() {
@@ -6712,7 +7254,7 @@ VALUES
 				name:       "script-timeout",
 				exitCode:   ptr.Int64(-1),
 				executedAt: now.Add(-1 * time.Hour),
-				expected:   fleet.RunScriptScriptTimeoutErrMsg,
+				expected:   fleet.HostScriptTimeoutMessage(ptr.Int(int(scripts.MaxHostExecutionTime.Seconds()))),
 			},
 			{
 				name:       "pending",
@@ -7234,6 +7776,15 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 	require.NoError(t, err)
 	require.True(t, inserted)
 
+	err = s.ds.InsertCVEMeta(context.Background(), []fleet.CVEMeta{
+		{
+			CVE:              "cve-123-123-132",
+			CVSSScore:        ptr.Float64(7.8),
+			CISAKnownExploit: ptr.Bool(true),
+		},
+	})
+	require.NoError(t, err)
+
 	// calculate hosts counts
 	hostsCountTs := time.Now().UTC()
 	require.NoError(t, s.ds.SyncHostsSoftware(ctx, hostsCountTs))
@@ -7257,7 +7808,6 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 				{Version: "0.0.1", Vulnerabilities: nil},
 				{Version: "0.0.3", Vulnerabilities: nil},
 			},
-			SelfService: false,
 		},
 		{
 			Name:          "bar",
@@ -7267,7 +7817,6 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 			Versions: []fleet.SoftwareVersion{
 				{Version: "0.0.4", Vulnerabilities: &fleet.SliceString{"cve-123-123-132"}},
 			},
-			SelfService: false,
 		},
 	}, resp.SoftwareTitles)
 
@@ -7338,16 +7887,7 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 	softwareTitleListResultsMatch([]fleet.SoftwareTitleListResult{}, resp.SoftwareTitles)
 
 	// asking for vulnerable only software returns the expected values
-	resp = listSoftwareTitlesResponse{}
-	s.DoJSON(
-		"GET", "/api/latest/fleet/software/titles",
-		listSoftwareTitlesRequest{},
-		http.StatusOK, &resp,
-		"vulnerable", "true",
-	)
-	require.Equal(t, 1, resp.Count)
-	require.NotEmpty(t, resp.CountsUpdatedAt)
-	softwareTitleListResultsMatch([]fleet.SoftwareTitleListResult{
+	expectedVulnSoftware := []fleet.SoftwareTitleListResult{
 		{
 			Name:          "bar",
 			Source:        "apps",
@@ -7357,7 +7897,127 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 				{Version: "0.0.4", Vulnerabilities: &fleet.SliceString{"cve-123-123-132"}},
 			},
 		},
-	}, resp.SoftwareTitles)
+	}
+
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"vulnerable", "true",
+	)
+	require.Equal(t, 1, resp.Count)
+	require.NotEmpty(t, resp.CountsUpdatedAt)
+	softwareTitleListResultsMatch(expectedVulnSoftware, resp.SoftwareTitles)
+
+	// vulnerable param required when using vulnerability filters
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusUnprocessableEntity, &resp,
+		"exploit", "true",
+	)
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusUnprocessableEntity, &resp,
+		"min_cvss_score", "1",
+	)
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusUnprocessableEntity, &resp,
+		"max_cvss_score", "10",
+	)
+
+	// vulnerability filters
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"exploit", "true",
+		"vulnerable", "true",
+	)
+	require.Equal(t, 1, resp.Count)
+	require.NotEmpty(t, resp.CountsUpdatedAt)
+	softwareTitleListResultsMatch(expectedVulnSoftware, resp.SoftwareTitles)
+
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"min_cvss_score", "1",
+		"vulnerable", "true",
+	)
+	require.Equal(t, 1, resp.Count)
+	require.NotEmpty(t, resp.CountsUpdatedAt)
+	softwareTitleListResultsMatch(expectedVulnSoftware, resp.SoftwareTitles)
+
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"min_cvss_score", "10",
+		"vulnerable", "true",
+	)
+	require.Zero(t, resp.Count)
+	require.Nil(t, resp.CountsUpdatedAt)
+	softwareTitleListResultsMatch([]fleet.SoftwareTitleListResult{}, resp.SoftwareTitles)
+
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"max_cvss_score", "10",
+		"vulnerable", "true",
+	)
+	require.Equal(t, 1, resp.Count)
+	require.NotEmpty(t, resp.CountsUpdatedAt)
+	softwareTitleListResultsMatch(expectedVulnSoftware, resp.SoftwareTitles)
+
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"max_cvss_score", "1",
+		"vulnerable", "true",
+	)
+	require.Zero(t, resp.Count)
+	require.Nil(t, resp.CountsUpdatedAt)
+	softwareTitleListResultsMatch([]fleet.SoftwareTitleListResult{}, resp.SoftwareTitles)
+
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"min_cvss_score", "1",
+		"max_cvss_score", "10",
+		"vulnerable", "true",
+	)
+	require.Equal(t, 1, resp.Count)
+	require.NotEmpty(t, resp.CountsUpdatedAt)
+	softwareTitleListResultsMatch(expectedVulnSoftware, resp.SoftwareTitles)
+
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"min_cvss_score", "1",
+		"max_cvss_score", "10",
+		"exploit", "true",
+		"vulnerable", "true",
+	)
+	require.Equal(t, 1, resp.Count)
+	require.NotEmpty(t, resp.CountsUpdatedAt)
+	softwareTitleListResultsMatch(expectedVulnSoftware, resp.SoftwareTitles)
 
 	// request titles for team1, nothing there yet
 	resp = listSoftwareTitlesResponse{}
@@ -7619,6 +8279,21 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 	fooTitle := resp.SoftwareTitles[0]
 	require.Equal(t, "foo", fooTitle.Name)
 
+	// find the ID of "baz" (team 1)
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"query", "baz",
+		"team_id", fmt.Sprintf("%d", team1.ID),
+	)
+	require.Equal(t, 1, resp.Count)
+	require.Len(t, resp.SoftwareTitles, 1)
+	require.NotEmpty(t, resp.CountsUpdatedAt)
+	bazTitle := resp.SoftwareTitles[0]
+	require.Equal(t, "baz", bazTitle.Name)
+
 	// non-existent id is a 404
 	var stResp getSoftwareTitleResponse
 	s.DoJSON("GET", "/api/latest/fleet/software/titles/999", getSoftwareTitleRequest{}, http.StatusNotFound, &stResp)
@@ -7673,9 +8348,7 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 	require.Equal(t, "bar", barTitle.Name)
 
 	// valid title with vulnerabilities
-	stResp = getSoftwareTitleResponse{}
-	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d", barTitle.ID), getSoftwareTitleRequest{}, http.StatusOK, &stResp)
-	softwareTitlesMatch([]fleet.SoftwareTitle{
+	expected := []fleet.SoftwareTitle{
 		{
 			Name:          "bar",
 			Source:        "apps",
@@ -7689,7 +8362,17 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 				},
 			},
 		},
-	}, []fleet.SoftwareTitle{*stResp.SoftwareTitle})
+	}
+	// Global
+	stResp = getSoftwareTitleResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d", barTitle.ID), getSoftwareTitleRequest{}, http.StatusOK, &stResp)
+	softwareTitlesMatch(expected, []fleet.SoftwareTitle{*stResp.SoftwareTitle})
+
+	// No Team
+	stResp = getSoftwareTitleResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d", barTitle.ID), getSoftwareTitleRequest{}, http.StatusOK, &stResp,
+		"team_id", "0")
+	softwareTitlesMatch(expected, []fleet.SoftwareTitle{*stResp.SoftwareTitle})
 
 	// invalid title for team
 	stResp = getSoftwareTitleResponse{}
@@ -7698,6 +8381,12 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 		"team_id", fmt.Sprintf("%d", team1.ID),
 	)
 
+	// invalid title for no team
+	stResp = getSoftwareTitleResponse{}
+	s.DoJSON(
+		"GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d", bazTitle.ID), getSoftwareTitleRequest{}, http.StatusNotFound, &stResp,
+		"team_id", "0")
+
 	// add bar tmHost
 	software = []fleet.Software{
 		{Name: "bar", Version: "0.0.4", Source: "apps"},
@@ -7763,6 +8452,14 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 	}
 	s.uploadSoftwareInstaller(payloadEmacs, http.StatusOK, "")
 
+	payloadVim := &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "install",
+		Filename:      "vim.deb",
+		SelfService:   true,
+		TeamID:        ptr.Uint(0),
+	}
+	s.uploadSoftwareInstaller(payloadVim, http.StatusOK, "")
+
 	resp = listSoftwareTitlesResponse{}
 	s.DoJSON(
 		"GET", "/api/latest/fleet/software/titles",
@@ -7774,7 +8471,6 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 
 	require.Len(t, resp.SoftwareTitles, 1)
 	require.NotNil(t, resp.SoftwareTitles[0].SoftwarePackage)
-	require.Equal(t, "ruby.deb", *resp.SoftwareTitles[0].SoftwarePackage)
 
 	// Upload an installer for the same software but different arch to a different team
 	payloadRubyTm2 := &fleet.UploadSoftwareInstallerPayload{
@@ -7795,7 +8491,6 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 	)
 	require.Len(t, resp.SoftwareTitles, 1)
 	require.NotNil(t, resp.SoftwareTitles[0].SoftwarePackage)
-	require.Equal(t, "ruby.deb", *resp.SoftwareTitles[0].SoftwarePackage)
 
 	// software installer not returned with self-service only (not marked as such)
 	resp = listSoftwareTitlesResponse{}
@@ -7813,10 +8508,10 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 		"self_service", "1", "query", "ruby", "team_id", fmt.Sprint(team1.ID))
 	require.Len(t, resp.SoftwareTitles, 1)
 	require.NotNil(t, resp.SoftwareTitles[0].SoftwarePackage)
-	require.Equal(t, "ruby.deb", *resp.SoftwareTitles[0].SoftwarePackage)
-	require.True(t, *&resp.SoftwareTitles[0].SelfService)
+	require.NotNil(t, resp.SoftwareTitles[0].SoftwarePackage.SelfService)
+	require.True(t, *resp.SoftwareTitles[0].SoftwarePackage.SelfService)
 
-	// no team but self-service returns the emacs software (technically impossible via the UI)
+	// "All teams" returns no software because the self-service software it's not installed (host_counts == 0).
 	resp = listSoftwareTitlesResponse{}
 	s.DoJSON(
 		"GET", "/api/latest/fleet/software/titles",
@@ -7825,10 +8520,25 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 		"self_service", "true",
 	)
 
-	require.Len(t, resp.SoftwareTitles, 1)
+	require.Empty(t, resp.SoftwareTitles, 0)
+
+	// "No team" returns the emacs software
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"self_service", "true",
+		"team_id", "0",
+	)
+
+	require.Len(t, resp.SoftwareTitles, 2)
 	require.NotNil(t, resp.SoftwareTitles[0].SoftwarePackage)
-	require.Equal(t, "emacs.deb", *resp.SoftwareTitles[0].SoftwarePackage)
-	require.True(t, *&resp.SoftwareTitles[0].SelfService)
+	require.NotNil(t, resp.SoftwareTitles[0].SoftwarePackage.SelfService)
+	require.True(t, *resp.SoftwareTitles[0].SoftwarePackage.SelfService)
+	require.NotNil(t, resp.SoftwareTitles[1].SoftwarePackage)
+	require.NotNil(t, resp.SoftwareTitles[1].SoftwarePackage.SelfService)
+	require.True(t, *resp.SoftwareTitles[1].SoftwarePackage.SelfService)
 
 	emacsPath := fmt.Sprintf("/api/latest/fleet/software/titles/%d", resp.SoftwareTitles[0].ID)
 	respTitle := getSoftwareTitleResponse{}
@@ -9151,12 +9861,10 @@ func (s *integrationEnterpriseTestSuite) TestListHostSoftware() {
 	require.Equal(t, getHostSw.Software[1].Name, "foo")
 	require.Len(t, getHostSw.Software[1].InstalledVersions, 2)
 	// no package information as there is no installer
-	require.Nil(t, getHostSw.Software[0].SelfService)
-	require.Nil(t, getHostSw.Software[0].Package)
-	require.Nil(t, getHostSw.Software[0].PackageAvailableForInstall)
-	require.Nil(t, getHostSw.Software[1].SelfService)
-	require.Nil(t, getHostSw.Software[1].Package)
-	require.Nil(t, getHostSw.Software[1].PackageAvailableForInstall)
+	require.Nil(t, getHostSw.Software[0].SoftwarePackage)
+	require.Nil(t, getHostSw.Software[0].AppStoreApp)
+	require.Nil(t, getHostSw.Software[1].SoftwarePackage)
+	require.Nil(t, getHostSw.Software[1].AppStoreApp)
 
 	// Add vulnerabilities to software to check query param filtering
 	_, err = s.ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{SoftwareID: barSoftwareID, CVE: "CVE-bar-1234"}, fleet.NVDSource)
@@ -9169,9 +9877,8 @@ func (s *integrationEnterpriseTestSuite) TestListHostSoftware() {
 	require.Len(t, getHostSw.Software, 1)
 	require.NoError(t, err)
 	require.Equal(t, "bar", getHostSw.Software[0].Name)
-	require.Nil(t, getHostSw.Software[0].SelfService)
-	require.Nil(t, getHostSw.Software[0].Package)
-	require.Nil(t, getHostSw.Software[0].PackageAvailableForInstall)
+	require.Nil(t, getHostSw.Software[0].SoftwarePackage)
+	require.Nil(t, getHostSw.Software[0].AppStoreApp)
 	require.Len(t, getHostSw.Software[0].InstalledVersions, 1)
 	require.Len(t, getHostSw.Software[0].InstalledVersions[0].Vulnerabilities, 2)
 	require.Equal(t, getHostSw.Software[0].InstalledVersions[0].Vulnerabilities, []string{"CVE-bar-1234", "CVE-bar-5678"})
@@ -9185,12 +9892,10 @@ func (s *integrationEnterpriseTestSuite) TestListHostSoftware() {
 	require.Equal(t, getDeviceSw.Software[1].Name, "foo")
 	require.Len(t, getDeviceSw.Software[1].InstalledVersions, 2)
 	// no package information as there is no installer
-	require.Nil(t, getDeviceSw.Software[0].SelfService)
-	require.Nil(t, getDeviceSw.Software[0].Package)
-	require.Nil(t, getDeviceSw.Software[0].PackageAvailableForInstall)
-	require.Nil(t, getDeviceSw.Software[1].SelfService)
-	require.Nil(t, getDeviceSw.Software[1].Package)
-	require.Nil(t, getDeviceSw.Software[1].PackageAvailableForInstall)
+	require.Nil(t, getDeviceSw.Software[0].SoftwarePackage)
+	require.Nil(t, getDeviceSw.Software[0].AppStoreApp)
+	require.Nil(t, getDeviceSw.Software[1].SoftwarePackage)
+	require.Nil(t, getDeviceSw.Software[1].AppStoreApp)
 
 	// create a software installer, not installed on the host
 	payload := &fleet.UploadSoftwareInstallerPayload{
@@ -9212,18 +9917,16 @@ func (s *integrationEnterpriseTestSuite) TestListHostSoftware() {
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", host.ID), nil, http.StatusOK, &getHostSw)
 	require.Len(t, getHostSw.Software, 3) // foo, bar and ruby.deb
 	require.Equal(t, getHostSw.Software[0].Name, "bar")
-	require.Nil(t, getHostSw.Software[0].PackageAvailableForInstall)
 	require.Equal(t, getHostSw.Software[1].Name, "foo")
-	require.Nil(t, getHostSw.Software[1].PackageAvailableForInstall)
 	require.Equal(t, getHostSw.Software[2].Name, "ruby")
 	require.Len(t, getHostSw.Software[1].InstalledVersions, 2)
-	require.NotNil(t, getHostSw.Software[2].PackageAvailableForInstall)
-	require.Equal(t, "ruby.deb", *getHostSw.Software[2].PackageAvailableForInstall)
-	require.NotNil(t, getHostSw.Software[2].SelfService)
-	require.True(t, *getHostSw.Software[2].SelfService)
+	require.Nil(t, getHostSw.Software[2].AppStoreApp)
+	require.NotNil(t, getHostSw.Software[2].SoftwarePackage)
+	require.Equal(t, "ruby.deb", getHostSw.Software[2].SoftwarePackage.Name)
+	require.Equal(t, payload.Version, getHostSw.Software[2].SoftwarePackage.Version)
+	require.NotNil(t, getHostSw.Software[2].SoftwarePackage.SelfService)
+	require.True(t, *getHostSw.Software[2].SoftwarePackage.SelfService)
 	require.Nil(t, getHostSw.Software[2].Status)
-	// package object is not returned for user-authenticated endpoint
-	require.Nil(t, getHostSw.Software[2].Package)
 
 	// only the installer is returned for self-service only
 	getHostSw = getHostSoftwareResponse{}
@@ -9240,8 +9943,6 @@ func (s *integrationEnterpriseTestSuite) TestListHostSoftware() {
 	require.Equal(t, getDeviceSw.Software[0].Name, "bar")
 	require.Equal(t, getDeviceSw.Software[1].Name, "foo")
 	require.Len(t, getDeviceSw.Software[1].InstalledVersions, 2)
-	require.Nil(t, getDeviceSw.Software[0].PackageAvailableForInstall)
-	require.Nil(t, getDeviceSw.Software[1].PackageAvailableForInstall)
 
 	// but it gets returned for self-service only
 	res = s.DoRawNoAuth("GET", "/api/latest/fleet/device/"+token+"/software?self_service=1", nil, http.StatusOK)
@@ -9250,14 +9951,12 @@ func (s *integrationEnterpriseTestSuite) TestListHostSoftware() {
 	require.NoError(t, err)
 	require.Len(t, getDeviceSw.Software, 1)
 	require.Equal(t, getDeviceSw.Software[0].Name, "ruby")
-	// package available for install is not returned for device-authenticated
-	require.Nil(t, getDeviceSw.Software[0].PackageAvailableForInstall)
-	// but package object is
-	require.NotNil(t, getDeviceSw.Software[0].Package)
-	require.NotNil(t, getDeviceSw.Software[0].SelfService)
-	require.True(t, *getDeviceSw.Software[0].SelfService)
-	require.Equal(t, payload.Filename, getDeviceSw.Software[0].Package.Name)
-	require.Equal(t, payload.Version, getDeviceSw.Software[0].Package.Version)
+	require.Nil(t, getDeviceSw.Software[0].AppStoreApp)
+	require.NotNil(t, getDeviceSw.Software[0].SoftwarePackage)
+	require.NotNil(t, getDeviceSw.Software[0].SoftwarePackage.SelfService)
+	require.True(t, *getDeviceSw.Software[0].SoftwarePackage.SelfService)
+	require.Equal(t, payload.Filename, getDeviceSw.Software[0].SoftwarePackage.Name)
+	require.Equal(t, payload.Version, getDeviceSw.Software[0].SoftwarePackage.Version)
 
 	// request installation on the host
 	var installResp installSoftwareResponse
@@ -9272,13 +9971,12 @@ func (s *integrationEnterpriseTestSuite) TestListHostSoftware() {
 	require.Equal(t, getHostSw.Software[1].Name, "foo")
 	require.Equal(t, getHostSw.Software[2].Name, "ruby")
 	require.Len(t, getHostSw.Software[1].InstalledVersions, 2)
-	require.NotNil(t, getHostSw.Software[2].PackageAvailableForInstall)
-	require.Equal(t, "ruby.deb", *getHostSw.Software[2].PackageAvailableForInstall)
+	require.NotNil(t, getHostSw.Software[2].SoftwarePackage)
+	require.Equal(t, "ruby.deb", getHostSw.Software[2].SoftwarePackage.Name)
 	require.NotNil(t, getHostSw.Software[2].Status)
 	require.Equal(t, fleet.SoftwareInstallerPending, *getHostSw.Software[2].Status)
-	require.NotNil(t, getHostSw.Software[2].SelfService)
-	require.True(t, *getHostSw.Software[2].SelfService)
-	require.Nil(t, getHostSw.Software[2].Package)
+	require.NotNil(t, getHostSw.Software[2].SoftwarePackage.SelfService)
+	require.True(t, *getHostSw.Software[2].SoftwarePackage.SelfService)
 
 	// still returned with self-service filter
 	getHostSw = getHostSoftwareResponse{}
@@ -9296,12 +9994,12 @@ func (s *integrationEnterpriseTestSuite) TestListHostSoftware() {
 	require.Equal(t, getDeviceSw.Software[1].Name, "foo")
 	require.Equal(t, getDeviceSw.Software[2].Name, "ruby")
 	require.Len(t, getDeviceSw.Software[1].InstalledVersions, 2)
-	require.Nil(t, getDeviceSw.Software[2].PackageAvailableForInstall)
 	require.NotNil(t, getDeviceSw.Software[2].Status)
 	require.Equal(t, fleet.SoftwareInstallerPending, *getDeviceSw.Software[2].Status)
-	require.NotNil(t, getDeviceSw.Software[2].SelfService)
-	require.True(t, *getDeviceSw.Software[2].SelfService)
-	require.NotNil(t, getDeviceSw.Software[2].Package)
+	require.NotNil(t, getDeviceSw.Software[2].SoftwarePackage)
+	require.Nil(t, getDeviceSw.Software[2].AppStoreApp)
+	require.NotNil(t, getDeviceSw.Software[2].SoftwarePackage.SelfService)
+	require.True(t, *getDeviceSw.Software[2].SoftwarePackage.SelfService)
 
 	// still returned for self-service only too
 	res = s.DoRawNoAuth("GET", "/api/latest/fleet/device/"+token+"/software?self_service=1", nil, http.StatusOK)
@@ -9310,10 +10008,10 @@ func (s *integrationEnterpriseTestSuite) TestListHostSoftware() {
 	require.NoError(t, err)
 	require.Len(t, getDeviceSw.Software, 1)
 	require.Equal(t, getDeviceSw.Software[0].Name, "ruby")
-	require.NotNil(t, getDeviceSw.Software[0].SelfService)
-	require.True(t, *getDeviceSw.Software[0].SelfService)
-	require.NotNil(t, getDeviceSw.Software[0].Package)
-	require.Nil(t, getDeviceSw.Software[0].PackageAvailableForInstall)
+	require.NotNil(t, getDeviceSw.Software[0].SoftwarePackage)
+	require.NotNil(t, getDeviceSw.Software[0].SoftwarePackage.SelfService)
+	require.True(t, *getDeviceSw.Software[0].SoftwarePackage.SelfService)
+	require.Nil(t, getDeviceSw.Software[0].AppStoreApp)
 
 	// test with a query
 	getHostSw = getHostSoftwareResponse{}
@@ -9329,6 +10027,36 @@ func (s *integrationEnterpriseTestSuite) TestListHostSoftware() {
 	require.Len(t, getDeviceSw.Software, 1) // bar only
 	require.Equal(t, getDeviceSw.Software[0].Name, "bar")
 	require.Len(t, getDeviceSw.Software[0].InstalledVersions, 1)
+
+	// Add new software to host -- installed on host, but not by Fleet
+	installedVersion := "1.0.1"
+	softwareAlreadyInstalled := fleet.Software{
+		Name: "DummyApp.app", Version: installedVersion, Source: "apps",
+		BundleIdentifier: "com.example.dummy",
+	}
+	software = append(software, softwareAlreadyInstalled)
+	_, err = s.ds.UpdateHostSoftware(ctx, host.ID, software)
+	require.NoError(t, err)
+	err = s.ds.ReconcileSoftwareTitles(ctx)
+	require.NoError(t, err)
+	// Add installer for software that is already installed on host
+	payload = &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "install",
+		Filename:      "dummy_installer.pkg",
+		Version:       "0.0.2", // The version can be anything -- we match on title
+	}
+	s.uploadSoftwareInstaller(payload, http.StatusOK, "")
+
+	// Get software available for install
+	getHostSw = getHostSoftwareResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", host.ID), nil, http.StatusOK, &getHostSw, "available_for_install",
+		"true", "order_key", "name", "order_direction", "asc")
+	require.Len(t, getHostSw.Software, 2) // DummyApp.app and ruby
+	assert.Equal(t, softwareAlreadyInstalled.Name, getHostSw.Software[0].Name)
+	require.Len(t, getHostSw.Software[0].InstalledVersions, 1)
+	assert.Equal(t, installedVersion, getHostSw.Software[0].InstalledVersions[0].Version)
+	assert.NotNil(t, getHostSw.Software[0].SoftwarePackage)
+	assert.Nil(t, getHostSw.Software[0].Status)
 }
 
 func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerUploadDownloadAndDelete() {
@@ -9400,7 +10128,7 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerUploadDownloadAndD
 		meta, err := s.ds.GetSoftwareInstallerMetadataByID(context.Background(), id)
 		require.NoError(t, err)
 
-		if payload.TeamID != nil {
+		if payload.TeamID != nil && *payload.TeamID > 0 {
 			require.Equal(t, *payload.TeamID, *meta.TeamID)
 		} else {
 			require.Nil(t, meta.TeamID)
@@ -9457,10 +10185,13 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerUploadDownloadAndD
 		}, http.StatusUnauthorized)
 
 		// download the installer
-		s.Do("GET", fmt.Sprintf("/api/latest/fleet/software/%d/package?alt=media", titleID), nil, http.StatusBadRequest)
+		s.Do("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package?alt=media", titleID), nil, http.StatusBadRequest)
 
-		// delete the installer
-		s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/software/%d/package", titleID), nil, http.StatusBadRequest)
+		// delete the installer from nil team fails
+		s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/software/titles/%d/available_for_install", titleID), nil, http.StatusBadRequest)
+
+		// delete from team 0 succeeds
+		s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/software/titles/%d/available_for_install", titleID), nil, http.StatusNoContent, "team_id", "0")
 	})
 
 	t.Run("create team software installer", func(t *testing.T) {
@@ -9496,9 +10227,32 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerUploadDownloadAndD
 		s.uploadSoftwareInstaller(payload, http.StatusConflict, "already exists")
 
 		// download the installer
-		r := s.Do("GET", fmt.Sprintf("/api/latest/fleet/software/%d/package?alt=media", titleID), nil, http.StatusOK, "team_id", fmt.Sprintf("%d", *payload.TeamID))
+		r := s.Do("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package?alt=media", titleID), nil, http.StatusOK, "team_id", fmt.Sprintf("%d", *payload.TeamID))
+		checkDownloadResponse(t, r, payload.Filename)
+
+		// download the installer by getting token first
+		tokenResp := getSoftwareInstallerTokenResponse{}
+		s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package/token?alt=media", titleID), nil, http.StatusOK,
+			&tokenResp, "team_id", fmt.Sprintf("%d", *payload.TeamID))
+		require.NotEmpty(t, tokenResp.Token)
+		r = s.DoRawNoAuth("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package/token/%s", titleID, tokenResp.Token), nil,
+			http.StatusOK)
 		checkDownloadResponse(t, r, payload.Filename)
 
+		// downloading a second time using the same token should fail
+		_ = s.DoRawNoAuth("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package/token/%s", titleID, tokenResp.Token), nil,
+			http.StatusForbidden)
+
+		// alt != media should fail
+		s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package/token?alt=bozo", titleID), nil,
+			http.StatusUnprocessableEntity,
+			&tokenResp, "team_id", fmt.Sprintf("%d", *payload.TeamID))
+
+		// missing team_id should fail
+		s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package/token?alt=media", titleID), nil,
+			http.StatusBadRequest,
+			&tokenResp)
+
 		// create an orbit host that is not in the team
 		hostNotInTeam := createOrbitEnrolledHost(t, "windows", "orbit-host-no-team", s.ds)
 		// downloading installer still works because we allow it explicitly
@@ -9527,15 +10281,81 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerUploadDownloadAndD
 		checkDownloadResponse(t, r, payload.Filename)
 
 		// delete the installer
-		s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/software/%d/package", titleID), nil, http.StatusNoContent, "team_id", fmt.Sprintf("%d", *payload.TeamID))
+		s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/software/titles/%d/available_for_install", titleID), nil, http.StatusNoContent, "team_id", fmt.Sprintf("%d", *payload.TeamID))
 
 		// check activity
 		s.lastActivityOfTypeMatches(fleet.ActivityTypeDeletedSoftware{}.ActivityName(), fmt.Sprintf(`{"software_title": "ruby", "software_package": "ruby.deb", "team_name": "%s", "team_id": %d, "self_service": true}`, createTeamResp.Team.Name, createTeamResp.Team.ID), 0)
 
 		// download the installer, not found anymore
-		s.Do("GET", fmt.Sprintf("/api/latest/fleet/software/%d/package?alt=media", titleID), nil, http.StatusNotFound, "team_id", fmt.Sprintf("%d", *payload.TeamID))
+		s.Do("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package?alt=media", titleID), nil, http.StatusNotFound, "team_id", fmt.Sprintf("%d", *payload.TeamID))
 	})
-}
+
+	t.Run("create team 0 software installer", func(t *testing.T) {
+		payload := &fleet.UploadSoftwareInstallerPayload{
+			TeamID:            ptr.Uint(0),
+			InstallScript:     "another install script",
+			PreInstallQuery:   "another pre install query",
+			PostInstallScript: "another post install script",
+			Filename:          "ruby.deb",
+			// additional fields below are pre-populated so we can re-use the payload later for the test assertions
+			Title:       "ruby",
+			Version:     "1:2.5.1",
+			Source:      "deb_packages",
+			StorageID:   "df06d9ce9e2090d9cb2e8cd1f4d7754a803dc452bf93e3204e3acd3b95508628",
+			Platform:    "linux",
+			SelfService: true,
+		}
+		s.uploadSoftwareInstaller(payload, http.StatusOK, "")
+
+		// check the software installer
+		installerID, titleID := checkSoftwareInstaller(t, payload)
+
+		// check activity
+		s.lastActivityOfTypeMatches(fleet.ActivityTypeAddedSoftware{}.ActivityName(), fmt.Sprintf(`{"software_title": "ruby", "software_package": "ruby.deb", "team_name": null, "team_id": 0, "self_service": true}`), 0)
+
+		// upload again fails
+		s.uploadSoftwareInstaller(payload, http.StatusConflict, "already exists")
+
+		// download the installer
+		r := s.Do("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package?alt=media", titleID), nil, http.StatusOK, "team_id", fmt.Sprintf("%d", 0))
+		checkDownloadResponse(t, r, payload.Filename)
+
+		// create an orbit host that is not in the team
+		hostNotInTeam := createOrbitEnrolledHost(t, "windows", "orbit-host-no-team", s.ds)
+		// downloading installer still works because we allow it explicitly
+		s.Do("POST", "/api/fleet/orbit/software_install/package?alt=media", orbitDownloadSoftwareInstallerRequest{
+			InstallerID:  installerID,
+			OrbitNodeKey: *hostNotInTeam.OrbitNodeKey,
+		}, http.StatusOK)
+
+		// create an orbit host, assign to team
+		hostInTeam := createOrbitEnrolledHost(t, "windows", "orbit-host-team", s.ds)
+
+		// requesting download with alt != media fails
+		r = s.Do("POST", "/api/fleet/orbit/software_install/package?alt=FOOBAR", orbitDownloadSoftwareInstallerRequest{
+			InstallerID:  installerID,
+			OrbitNodeKey: *hostInTeam.OrbitNodeKey,
+		}, http.StatusBadRequest)
+		errMsg := extractServerErrorText(r.Body)
+		require.Contains(t, errMsg, "only alt=media is supported")
+
+		// valid download
+		r = s.Do("POST", "/api/fleet/orbit/software_install/package?alt=media", orbitDownloadSoftwareInstallerRequest{
+			InstallerID:  installerID,
+			OrbitNodeKey: *hostInTeam.OrbitNodeKey,
+		}, http.StatusOK)
+		checkDownloadResponse(t, r, payload.Filename)
+
+		// delete the installer
+		s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/software/titles/%d/available_for_install", titleID), nil, http.StatusNoContent, "team_id", "0")
+
+		// check activity
+		s.lastActivityOfTypeMatches(fleet.ActivityTypeDeletedSoftware{}.ActivityName(), fmt.Sprintf(`{"software_title": "ruby", "software_package": "ruby.deb", "team_name": null, "team_id": 0, "self_service": true}`), 0)
+
+		// download the installer, not found anymore
+		s.Do("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package?alt=media", titleID), nil, http.StatusNotFound, "team_id", fmt.Sprintf("%d", 0))
+	})
+}
 
 func (s *integrationEnterpriseTestSuite) TestApplyTeamsSoftwareConfig() {
 	t := s.T()
@@ -9558,30 +10378,40 @@ func (s *integrationEnterpriseTestSuite) TestApplyTeamsSoftwareConfig() {
 		"specs": []any{
 			map[string]any{
 				"name": teamName,
-				"software": []map[string]any{
-					{
-						"url":          "http://foo.com",
-						"self_service": true,
-						"install_script": map[string]string{
-							"path": "./foo/install-script.sh",
-						},
-						"post_install_script": map[string]string{
-							"path": "./foo/post-install-script.sh",
+				"software": map[string]any{
+					"packages": []map[string]any{
+						{
+							"url":          "http://foo.com",
+							"self_service": true,
+							"install_script": map[string]string{
+								"path": "./foo/install-script.sh",
+							},
+							"post_install_script": map[string]string{
+								"path": "./foo/post-install-script.sh",
+							},
+							"pre_install_query": map[string]string{
+								"path": "./foo/query.yaml",
+							},
 						},
-						"pre_install_query": map[string]string{
-							"path": "./foo/query.yaml",
+						{
+							"url": "http://bar.com",
+							"install_script": map[string]string{
+								"path": "./bar/install-script.sh",
+							},
+							"post_install_script": map[string]string{
+								"path": "./bar/post-install-script.sh",
+							},
+							"pre_install_query": map[string]string{
+								"path": "./bar/query.yaml",
+							},
 						},
 					},
-					{
-						"url": "http://bar.com",
-						"install_script": map[string]string{
-							"path": "./bar/install-script.sh",
-						},
-						"post_install_script": map[string]string{
-							"path": "./bar/post-install-script.sh",
+					"app_store_apps": []map[string]any{
+						{
+							"app_store_id": "1234",
 						},
-						"pre_install_query": map[string]string{
-							"path": "./bar/query.yaml",
+						{
+							"app_store_id": "5678",
 						},
 					},
 				},
@@ -9590,7 +10420,7 @@ func (s *integrationEnterpriseTestSuite) TestApplyTeamsSoftwareConfig() {
 	}
 	s.Do("POST", "/api/latest/fleet/spec/teams", teamSpecs, http.StatusOK)
 
-	wantSoftware := []fleet.TeamSpecSoftware{
+	wantSoftwarePackages := []fleet.SoftwarePackageSpec{
 		{
 			URL:               "http://foo.com",
 			SelfService:       true,
@@ -9606,11 +10436,19 @@ func (s *integrationEnterpriseTestSuite) TestApplyTeamsSoftwareConfig() {
 			PreInstallQuery:   fleet.TeamSpecSoftwareAsset{Path: "./bar/query.yaml"},
 		},
 	}
+	wantAppStoreApps := []fleet.TeamSpecAppStoreApp{
+		{
+			AppStoreID: "1234",
+		},
+		{
+			AppStoreID: "5678",
+		},
+	}
 
 	// retrieving the team returns the software
 	var teamResp getTeamResponse
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), nil, http.StatusOK, &teamResp)
-	require.Equal(t, wantSoftware, teamResp.Team.Config.Software.Value)
+	require.Equal(t, wantSoftwarePackages, teamResp.Team.Config.Software.Packages.Value)
 
 	// apply without custom software specified, should not replace existing software
 	teamSpecs = map[string]any{
@@ -9623,24 +10461,44 @@ func (s *integrationEnterpriseTestSuite) TestApplyTeamsSoftwareConfig() {
 	s.Do("POST", "/api/latest/fleet/spec/teams", teamSpecs, http.StatusOK)
 	teamResp = getTeamResponse{}
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), nil, http.StatusOK, &teamResp)
-	require.Equal(t, wantSoftware, teamResp.Team.Config.Software.Value)
+	require.Equal(t, wantSoftwarePackages, teamResp.Team.Config.Software.Packages.Value)
+	require.Equal(t, wantAppStoreApps, teamResp.Team.Config.Software.AppStoreApps.Value)
 
 	// apply with explicitly empty custom software would clear the existing
 	// software, but dry-run
 	teamSpecs = map[string]any{
 		"specs": []any{
 			map[string]any{
-				"name":     teamName,
-				"software": nil,
+				"name": teamName,
+				"software": map[string]any{
+					"packages": nil,
+				},
+			},
+		},
+	}
+	s.Do("POST", "/api/latest/fleet/spec/teams", teamSpecs, http.StatusOK, "dry_run", "true")
+	teamResp = getTeamResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), nil, http.StatusOK, &teamResp)
+	require.Equal(t, wantSoftwarePackages, teamResp.Team.Config.Software.Packages.Value)
+
+	// apply with explicitly empty custom app store apps would clear the existing
+	// software, but dry-run
+	teamSpecs = map[string]any{
+		"specs": []any{
+			map[string]any{
+				"name": teamName,
+				"software": map[string]any{
+					"app_store_apps": nil,
+				},
 			},
 		},
 	}
 	s.Do("POST", "/api/latest/fleet/spec/teams", teamSpecs, http.StatusOK, "dry_run", "true")
 	teamResp = getTeamResponse{}
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), nil, http.StatusOK, &teamResp)
-	require.Equal(t, wantSoftware, teamResp.Team.Config.Software.Value)
+	require.Equal(t, wantAppStoreApps, teamResp.Team.Config.Software.AppStoreApps.Value)
 
-	// apply with explicitly empty software clears the existing software
+	// apply with empty top-level software field, should not clear packages
 	teamSpecs = map[string]any{
 		"specs": []any{
 			map[string]any{
@@ -9652,7 +10510,42 @@ func (s *integrationEnterpriseTestSuite) TestApplyTeamsSoftwareConfig() {
 	s.Do("POST", "/api/latest/fleet/spec/teams", teamSpecs, http.StatusOK)
 	teamResp = getTeamResponse{}
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), nil, http.StatusOK, &teamResp)
-	require.Empty(t, teamResp.Team.Config.Software.Value)
+	require.Equal(t, wantSoftwarePackages, teamResp.Team.Config.Software.Packages.Value)
+	require.Equal(t, wantAppStoreApps, teamResp.Team.Config.Software.AppStoreApps.Value)
+
+	// apply with explicitly empty software packages clears the existing software, but not apps
+	teamSpecs = map[string]any{
+		"specs": []any{
+			map[string]any{
+				"name": teamName,
+				"software": map[string]any{
+					"packages": nil,
+				},
+			},
+		},
+	}
+	s.Do("POST", "/api/latest/fleet/spec/teams", teamSpecs, http.StatusOK)
+	teamResp = getTeamResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), nil, http.StatusOK, &teamResp)
+	require.Empty(t, teamResp.Team.Config.Software.Packages.Value)
+	require.Equal(t, wantAppStoreApps, teamResp.Team.Config.Software.AppStoreApps.Value)
+
+	// apply with explicitly empty software apps clears the existing apps
+	teamSpecs = map[string]any{
+		"specs": []any{
+			map[string]any{
+				"name": teamName,
+				"software": map[string]any{
+					"app_store_apps": nil,
+				},
+			},
+		},
+	}
+	s.Do("POST", "/api/latest/fleet/spec/teams", teamSpecs, http.StatusOK)
+	teamResp = getTeamResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), nil, http.StatusOK, &teamResp)
+	require.Empty(t, teamResp.Team.Config.Software.Packages.Value)
+	require.Empty(t, teamResp.Team.Config.Software.AppStoreApps.Value)
 
 	// patch with an invalid array returns an error
 	teamSpecs = map[string]any{
@@ -9666,15 +10559,26 @@ func (s *integrationEnterpriseTestSuite) TestApplyTeamsSoftwareConfig() {
 	s.Do("POST", "/api/latest/fleet/spec/teams", teamSpecs, http.StatusBadRequest)
 	teamResp = getTeamResponse{}
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), nil, http.StatusOK, &teamResp)
-	require.Empty(t, teamResp.Team.Config.Software.Value)
+	require.Empty(t, teamResp.Team.Config.Software.Packages.Value)
+
+	// patch with an invalid array returns an error
+	teamSpecs = map[string]any{
+		"specs": []any{
+			map[string]any{
+				"name":           teamName,
+				"app_store_apps": []any{"foo", 1},
+			},
+		},
+	}
+	s.Do("POST", "/api/latest/fleet/spec/teams", teamSpecs, http.StatusBadRequest)
+	teamResp = getTeamResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), nil, http.StatusOK, &teamResp)
+	require.Empty(t, teamResp.Team.Config.Software.AppStoreApps.Value)
 }
 
 func (s *integrationEnterpriseTestSuite) TestBatchSetSoftwareInstallers() {
 	t := s.T()
 
-	// a team name is required (we don't allow installers for "no team")
-	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{}, http.StatusBadRequest)
-
 	// non-existent team
 	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{}, http.StatusNotFound, "team_name", "foo")
 
@@ -9691,6 +10595,12 @@ func (s *integrationEnterpriseTestSuite) TestBatchSetSoftwareInstallers() {
 	}
 	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusUnprocessableEntity, "team_name", tm.Name)
 
+	// software with a too big URL
+	softwareToInstall = []fleet.SoftwareInstallerPayload{
+		{URL: "https://ftp.mozilla.org/" + strings.Repeat("a", 233)},
+	}
+	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusUnprocessableEntity, "team_name", tm.Name)
+
 	// create an HTTP server to host the software installer
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		file, err := os.Open(filepath.Join("testdata", "software-installers", "ruby.deb"))
@@ -9708,7 +10618,7 @@ func (s *integrationEnterpriseTestSuite) TestBatchSetSoftwareInstallers() {
 	softwareToInstall = []fleet.SoftwareInstallerPayload{
 		{URL: srv.URL},
 	}
-	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusNoContent, "team_name", tm.Name)
+	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, "team_name", tm.Name)
 
 	// TODO(roberto): test with a variety of response codes
 
@@ -9717,6 +10627,9 @@ func (s *integrationEnterpriseTestSuite) TestBatchSetSoftwareInstallers() {
 	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &titlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(tm.ID)))
 	require.Equal(t, 1, titlesResp.Count)
 	require.Len(t, titlesResp.SoftwareTitles, 1)
+	// Check that the URL is set to software installers uploaded via batch.
+	require.NotNil(t, titlesResp.SoftwareTitles[0].SoftwarePackage.PackageURL)
+	require.Equal(t, srv.URL, *titlesResp.SoftwareTitles[0].SoftwarePackage.PackageURL)
 
 	// check that platform is set when the installer is created
 	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
@@ -9729,26 +10642,179 @@ func (s *integrationEnterpriseTestSuite) TestBatchSetSoftwareInstallers() {
 	})
 
 	// same payload doesn't modify anything
-	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusNoContent, "team_name", tm.Name)
+	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, "team_name", tm.Name)
 	newTitlesResp := listSoftwareTitlesResponse{}
 	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &newTitlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(tm.ID)))
 	require.Equal(t, titlesResp, newTitlesResp)
 
 	// setting self-service to true updates the software title metadata
 	softwareToInstall[0].SelfService = true
-	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusNoContent, "team_name", tm.Name)
+	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, "team_name", tm.Name)
 	newTitlesResp = listSoftwareTitlesResponse{}
 	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &newTitlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(tm.ID)))
-	titlesResp.SoftwareTitles[0].SelfService = true
+	titlesResp.SoftwareTitles[0].SoftwarePackage.SelfService = ptr.Bool(true)
 	require.Equal(t, titlesResp, newTitlesResp)
 
 	// empty payload cleans the software items
 	softwareToInstall = []fleet.SoftwareInstallerPayload{}
-	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusNoContent, "team_name", tm.Name)
+	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, "team_name", tm.Name)
 	titlesResp = listSoftwareTitlesResponse{}
 	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &titlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(tm.ID)))
 	require.Equal(t, 0, titlesResp.Count)
 	require.Len(t, titlesResp.SoftwareTitles, 0)
+
+	//////////////////////////
+	// Do a request with a valid URL with no team
+	//////////////////////////
+	softwareToInstall = []fleet.SoftwareInstallerPayload{
+		{URL: srv.URL},
+	}
+	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK)
+
+	// check the application status on team 0
+	titlesResp = listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &titlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(0)))
+	require.Equal(t, 1, titlesResp.Count)
+	require.Len(t, titlesResp.SoftwareTitles, 1)
+
+	// same payload doesn't modify anything
+	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK)
+	newTitlesResp = listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &newTitlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(0)))
+	require.Equal(t, titlesResp, newTitlesResp)
+
+	// setting self-service to true updates the software title metadata
+	softwareToInstall[0].SelfService = true
+	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK)
+	newTitlesResp = listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &newTitlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(0)))
+	titlesResp.SoftwareTitles[0].SoftwarePackage.SelfService = ptr.Bool(true)
+	require.Equal(t, titlesResp, newTitlesResp)
+
+	// empty payload cleans the software items
+	softwareToInstall = []fleet.SoftwareInstallerPayload{}
+	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK)
+	titlesResp = listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &titlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(0)))
+	require.Equal(t, 0, titlesResp.Count)
+	require.Len(t, titlesResp.SoftwareTitles, 0)
+}
+
+func (s *integrationEnterpriseTestSuite) TestBatchSetSoftwareInstallersWithPoliciesAssociated() {
+	ctx := context.Background()
+	t := s.T()
+
+	team1, err := s.ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+	team2, err := s.ds.NewTeam(ctx, &fleet.Team{Name: "team2"})
+	require.NoError(t, err)
+	policy1Team1, err := s.ds.NewTeamPolicy(
+		ctx, team1.ID, nil, fleet.PolicyPayload{
+			Name:  "team1Policy1",
+			Query: "SELECT 1;",
+		},
+	)
+	require.NoError(t, err)
+	policy2Team2, err := s.ds.NewTeamPolicy(
+		ctx, team2.ID, nil, fleet.PolicyPayload{
+			Name:  "team2Policy2",
+			Query: "SELECT 2;",
+		},
+	)
+	require.NoError(t, err)
+
+	// create an HTTP server to host software installers
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var fileName string
+		switch r.URL.Path {
+		case "/ruby.deb", "/dummy_installer.pkg":
+			fileName = strings.TrimPrefix(r.URL.Path, "/")
+		default:
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		file, err := os.Open(filepath.Join("testdata", "software-installers", fileName))
+		require.NoError(t, err)
+		defer file.Close()
+		w.Header().Set("Content-Type", "application/vnd.debian.binary-package")
+		_, err = io.Copy(w, file)
+		require.NoError(t, err)
+	})
+
+	srv := httptest.NewServer(handler)
+	t.Cleanup(srv.Close)
+
+	// team1 has ruby.deb
+	softwareToInstall := []fleet.SoftwareInstallerPayload{
+		{
+			URL: srv.URL + "/ruby.deb",
+		},
+	}
+	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, "team_name", team1.Name)
+	// team2 has dummy_installer.pkg and ruby.deb.
+	softwareToInstall = []fleet.SoftwareInstallerPayload{
+		{
+			URL: srv.URL + "/dummy_installer.pkg",
+		},
+		{
+			URL: srv.URL + "/ruby.deb",
+		},
+	}
+	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, "team_name", team2.Name)
+
+	// Associate ruby.deb to policy1Team1.
+	resp := listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"query", "ruby",
+		"team_id", fmt.Sprintf("%d", team1.ID),
+	)
+	require.Len(t, resp.SoftwareTitles, 1)
+	require.NotNil(t, resp.SoftwareTitles[0].SoftwarePackage)
+	rubyDebTitleID := resp.SoftwareTitles[0].ID
+	mtplr := modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy1Team1.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: &rubyDebTitleID,
+		},
+	}, http.StatusOK, &mtplr)
+
+	// Associate ruby.deb in team2 to policy2Team2.
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team2.ID, policy2Team2.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: &rubyDebTitleID,
+		},
+	}, http.StatusOK, &mtplr)
+
+	// Get rid of all installers in team1.
+	softwareToInstall = []fleet.SoftwareInstallerPayload{}
+	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, "team_name", team1.Name)
+
+	// policy1Team1 should not be associated to any installer.
+	policy1Team1, err = s.ds.Policy(ctx, policy1Team1.ID)
+	require.NoError(t, err)
+	require.Nil(t, policy1Team1.SoftwareInstallerID)
+	// team1 should be empty.
+	titlesResp := listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &titlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(team1.ID)))
+	require.Equal(t, 0, titlesResp.Count)
+
+	// team2 should be untouched.
+	titlesResp = listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &titlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(team2.ID)))
+	require.Equal(t, 2, titlesResp.Count)
+	require.Len(t, titlesResp.SoftwareTitles, 2)
+	require.NotNil(t, titlesResp.SoftwareTitles[0].SoftwarePackage.PackageURL)
+	require.Equal(t, srv.URL+"/dummy_installer.pkg", *titlesResp.SoftwareTitles[0].SoftwarePackage.PackageURL)
+	require.NotNil(t, titlesResp.SoftwareTitles[1].SoftwarePackage.PackageURL)
+	require.Equal(t, srv.URL+"/ruby.deb", *titlesResp.SoftwareTitles[1].SoftwarePackage.PackageURL)
+
+	// policy2Team2 should still be associated to ruby.deb of team2.
+	policy2Team2, err = s.ds.Policy(ctx, policy2Team2.ID)
+	require.NoError(t, err)
+	require.NotNil(t, policy2Team2.SoftwareInstallerID)
 }
 
 func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerNewInstallRequestPlatformValidation() {
@@ -9844,6 +10910,14 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerNewInstallRequestP
 func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerHostRequests() {
 	t := s.T()
 
+	// Enabling software inventory globally, which will be inherited by the team
+	appConf, err := s.ds.AppConfig(context.Background())
+	require.NoError(s.T(), err)
+	appConf.Features.EnableSoftwareInventory = true
+	err = s.ds.SaveAppConfig(context.Background(), appConf)
+	require.NoError(s.T(), err)
+	time.Sleep(2 * time.Second) // Wait for the app config cache to clear
+
 	var createTeamResp teamResponse
 	s.DoJSON("POST", "/api/latest/fleet/teams", &fleet.Team{
 		Name: t.Name(),
@@ -9901,10 +10975,11 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerHostRequests() {
 	getHostSoftwareResp := getHostSoftwareResponse{}
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h.ID), nil, http.StatusOK, &getHostSoftwareResp)
 	require.Len(t, getHostSoftwareResp.Software, 1)
-	require.NotNil(t, getHostSoftwareResp.Software[0].LastInstall)
+	require.NotNil(t, getHostSoftwareResp.Software[0].SoftwarePackage)
+	require.NotNil(t, getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall)
 	require.NotNil(t, getHostSoftwareResp.Software[0].Status)
 	require.Equal(t, fleet.SoftwareInstallerPending, *getHostSoftwareResp.Software[0].Status)
-	installUUID := getHostSoftwareResp.Software[0].LastInstall.InstallUUID
+	installUUID := getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall.InstallUUID
 
 	gsirr := getSoftwareInstallResultsResponse{}
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/software/install/results/%s", installUUID), nil, http.StatusOK, &gsirr)
@@ -9925,7 +11000,7 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerHostRequests() {
 	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", h2.ID, titleID), nil, http.StatusAccepted, &resp)
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h2.ID), nil, http.StatusOK, &getHostSoftwareResp)
 	require.Len(t, getHostSoftwareResp.Software, 1)
-	installUUID2 := getHostSoftwareResp.Software[0].LastInstall.InstallUUID
+	installUUID2 := getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall.InstallUUID
 	s.Do("POST", "/api/fleet/orbit/software_install/result", json.RawMessage(fmt.Sprintf(`{
 			"orbit_node_key": %q,
 			"install_uuid": %q,
@@ -9937,7 +11012,7 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerHostRequests() {
 	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", h3.ID, titleID), nil, http.StatusAccepted, &resp)
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h3.ID), nil, http.StatusOK, &getHostSoftwareResp)
 	require.Len(t, getHostSoftwareResp.Software, 1)
-	installUUID3 := getHostSoftwareResp.Software[0].LastInstall.InstallUUID
+	installUUID3 := getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall.InstallUUID
 	s.Do("POST", "/api/fleet/orbit/software_install/result", json.RawMessage(fmt.Sprintf(`{
 			"orbit_node_key": %q,
 			"install_uuid": %q,
@@ -9949,7 +11024,7 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerHostRequests() {
 	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", h4.ID, titleID), nil, http.StatusAccepted, &resp)
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h4.ID), nil, http.StatusOK, &getHostSoftwareResp)
 	require.Len(t, getHostSoftwareResp.Software, 1)
-	installUUID4a := getHostSoftwareResp.Software[0].LastInstall.InstallUUID
+	installUUID4a := getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall.InstallUUID
 	s.Do("POST", "/api/fleet/orbit/software_install/result", json.RawMessage(fmt.Sprintf(`{
 			"orbit_node_key": %q,
 			"install_uuid": %q,
@@ -9959,7 +11034,7 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerHostRequests() {
 	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", h4.ID, titleID), nil, http.StatusAccepted, &resp)
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h4.ID), nil, http.StatusOK, &getHostSoftwareResp)
 	require.Len(t, getHostSoftwareResp.Software, 1)
-	installUUID4b := getHostSoftwareResp.Software[0].LastInstall.InstallUUID
+	installUUID4b := getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall.InstallUUID
 	_ = installUUID4b
 
 	// status is reflected in software title response
@@ -10039,6 +11114,66 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerHostRequests() {
 	require.Contains(t, extractServerErrorText(r.Body), "Invalid parameters. The combination of software_version_id and software_title_id is not allowed.")
 	r = s.Do("GET", "/api/latest/fleet/hosts", nil, http.StatusBadRequest, "software_status", "installed", "team_id", "1", "software_title_id", "1", "software_id", "1")
 	require.Contains(t, extractServerErrorText(r.Body), "Invalid parameters. The combination of software_id and software_title_id is not allowed.")
+
+	// Return installed app with software detail query
+	distributedReq := submitDistributedQueryResultsRequestShim{
+		NodeKey: *h2.NodeKey,
+		Results: map[string]json.RawMessage{
+			hostDetailQueryPrefix + "software_linux": json.RawMessage(fmt.Sprintf(
+				`[{"name": "%s", "version": "1.0", "type": "Package (deb)",
+					"source": "deb_packages", "last_opened_at": "",
+					"installed_path": "/bin/ruby"}]`, payload.Title)),
+		},
+		Statuses: map[string]interface{}{
+			hostDistributedQueryPrefix + "software_linux": 0,
+		},
+		Messages: map[string]string{},
+		Stats:    map[string]*fleet.Stats{},
+	}
+	distributedResp := submitDistributedQueryResultsResponse{}
+	s.DoJSON("POST", "/api/osquery/distributed/write", distributedReq, http.StatusOK, &distributedResp)
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h2.ID), nil, http.StatusOK, &getHostSoftwareResp)
+	require.Len(t, getHostSoftwareResp.Software, 1)
+	assert.NotNil(t, getHostSoftwareResp.Software[0].Status)
+	assert.NotNil(t, getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall)
+	assert.NotEmpty(t, getHostSoftwareResp.Software[0].InstalledVersions, "Installed versions should exist")
+
+	// Remove the installed app by not returning it
+	distributedReq = submitDistributedQueryResultsRequestShim{
+		NodeKey: *h2.NodeKey,
+		Results: map[string]json.RawMessage{
+			hostDetailQueryPrefix + "software_linux": json.RawMessage(`[]`),
+		},
+		Statuses: map[string]interface{}{
+			hostDistributedQueryPrefix + "software_linux": 0,
+		},
+		Messages: map[string]string{},
+		Stats:    map[string]*fleet.Stats{},
+	}
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSON("POST", "/api/osquery/distributed/write", distributedReq, http.StatusOK, &distributedResp)
+
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h2.ID), nil, http.StatusOK, &getHostSoftwareResp)
+	require.Len(t, getHostSoftwareResp.Software, 1)
+	assert.Nil(t, getHostSoftwareResp.Software[0].Status)
+	assert.Nil(t, getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall)
+	assert.Empty(t, getHostSoftwareResp.Software[0].InstalledVersions, "Installed versions should now not exist")
+
+	// Access software install result after host is deleted
+	err = s.ds.DeleteHost(context.Background(), h.ID)
+	require.NoError(t, err)
+
+	instResult, err := s.ds.GetSoftwareInstallResults(context.Background(), installUUID)
+	require.NoError(t, err)
+	require.NotNil(t, instResult.HostDeletedAt)
+
+	gsirr = getSoftwareInstallResultsResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/software/install/results/%s", installUUID), nil, http.StatusOK, &gsirr)
+	require.NoError(t, gsirr.Err)
+	require.NotNil(t, gsirr.Results)
+	results = gsirr.Results
+	require.Equal(t, installUUID, results.InstallUUID)
+	require.Equal(t, fleet.SoftwareInstallerPending, results.Status)
 }
 
 func (s *integrationEnterpriseTestSuite) TestSelfServiceSoftwareInstall() {
@@ -10129,7 +11264,7 @@ func (s *integrationEnterpriseTestSuite) TestHostSoftwareInstallResult() {
 
 	host := createOrbitEnrolledHost(t, "linux", "", s.ds)
 
-	// create a software installer and some host install requests
+	// Create software installers and corresponding host install requests.
 	payload := &fleet.UploadSoftwareInstallerPayload{
 		InstallScript:     "install script",
 		PreInstallQuery:   "pre install query",
@@ -10139,6 +11274,24 @@ func (s *integrationEnterpriseTestSuite) TestHostSoftwareInstallResult() {
 	}
 	s.uploadSoftwareInstaller(payload, http.StatusOK, "")
 	titleID := getSoftwareTitleID(t, s.ds, payload.Title, "deb_packages")
+	payload2 := &fleet.UploadSoftwareInstallerPayload{
+		InstallScript:     "install script 2",
+		PreInstallQuery:   "pre install query 2",
+		PostInstallScript: "post install script 2",
+		Filename:          "vim.deb",
+		Title:             "vim",
+	}
+	s.uploadSoftwareInstaller(payload2, http.StatusOK, "")
+	titleID2 := getSoftwareTitleID(t, s.ds, payload2.Title, "deb_packages")
+	payload3 := &fleet.UploadSoftwareInstallerPayload{
+		InstallScript:     "install script 3",
+		PreInstallQuery:   "pre install query 3",
+		PostInstallScript: "post install script 3",
+		Filename:          "emacs.deb",
+		Title:             "emacs",
+	}
+	s.uploadSoftwareInstaller(payload3, http.StatusOK, "")
+	titleID3 := getSoftwareTitleID(t, s.ds, payload3.Title, "deb_packages")
 
 	latestInstallUUID := func() string {
 		var id string
@@ -10150,9 +11303,10 @@ func (s *integrationEnterpriseTestSuite) TestHostSoftwareInstallResult() {
 
 	// create some install requests for the host
 	installUUIDs := make([]string, 3)
+	titleIDs := []uint{titleID, titleID2, titleID3}
 	for i := 0; i < len(installUUIDs); i++ {
 		resp := installSoftwareResponse{}
-		s.DoJSON("POST", fmt.Sprintf("/api/v1/fleet/hosts/%d/software/install/%d", host.ID, titleID), nil, http.StatusAccepted, &resp)
+		s.DoJSON("POST", fmt.Sprintf("/api/v1/fleet/hosts/%d/software/install/%d", host.ID, titleIDs[i]), nil, http.StatusAccepted, &resp)
 		installUUIDs[i] = latestInstallUUID()
 	}
 
@@ -10215,7 +11369,14 @@ func (s *integrationEnterpriseTestSuite) TestHostSoftwareInstallResult() {
 		Status:                fleet.SoftwareInstallerFailed,
 		PreInstallQueryOutput: ptr.String(fleet.SoftwareInstallerQueryFailCopy),
 	})
-	wantAct.InstallUUID = installUUIDs[1]
+	wantAct = fleet.ActivityTypeInstalledSoftware{
+		HostID:          host.ID,
+		HostDisplayName: host.DisplayName(),
+		SoftwareTitle:   payload2.Title,
+		SoftwarePackage: payload2.Filename,
+		InstallUUID:     installUUIDs[1],
+		Status:          string(fleet.SoftwareInstallerFailed),
+	}
 	s.lastActivityOfTypeMatches(wantAct.ActivityName(), string(jsonMustMarshal(t, wantAct)), 0)
 
 	s.Do("POST", "/api/fleet/orbit/software_install/result",
@@ -10237,8 +11398,14 @@ func (s *integrationEnterpriseTestSuite) TestHostSoftwareInstallResult() {
 		Output:                  ptr.String(fmt.Sprintf(fleet.SoftwareInstallerInstallSuccessCopy, "success")),
 		PostInstallScriptOutput: ptr.String(fmt.Sprintf(fleet.SoftwareInstallerPostInstallSuccessCopy, "ok")),
 	})
-	wantAct.InstallUUID = installUUIDs[2]
-	wantAct.Status = string(fleet.SoftwareInstallerInstalled)
+	wantAct = fleet.ActivityTypeInstalledSoftware{
+		HostID:          host.ID,
+		HostDisplayName: host.DisplayName(),
+		SoftwareTitle:   payload3.Title,
+		SoftwarePackage: payload3.Filename,
+		InstallUUID:     installUUIDs[2],
+		Status:          string(fleet.SoftwareInstallerInstalled),
+	}
 	lastActID := s.lastActivityOfTypeMatches(wantAct.ActivityName(), string(jsonMustMarshal(t, wantAct)), 0)
 
 	// non-existing installation uuid
@@ -10356,8 +11523,13 @@ func (s *integrationEnterpriseTestSuite) TestHostScriptSoftDelete() {
 	require.EqualValues(t, 0, *scriptRes.ExitCode)
 }
 
-func (s *integrationEnterpriseTestSuite) uploadSoftwareInstaller(payload *fleet.UploadSoftwareInstallerPayload, expectedStatus int, expectedError string) {
+func (s *integrationEnterpriseTestSuite) uploadSoftwareInstaller(
+	payload *fleet.UploadSoftwareInstallerPayload,
+	expectedStatus int,
+	expectedError string,
+) {
 	t := s.T()
+	t.Helper()
 	openFile := func(name string) *os.File {
 		f, err := os.Open(filepath.Join("testdata", "software-installers", name))
 		require.NoError(t, err)
@@ -10400,6 +11572,8 @@ func (s *integrationEnterpriseTestSuite) uploadSoftwareInstaller(payload *fleet.
 	}
 
 	r := s.DoRawWithHeaders("POST", "/api/latest/fleet/software/package", b.Bytes(), expectedStatus, headers)
+	defer r.Body.Close()
+
 	if expectedError != "" {
 		errMsg := extractServerErrorText(r.Body)
 		require.Contains(t, errMsg, expectedError)
@@ -10642,7 +11816,6 @@ func (s *integrationEnterpriseTestSuite) TestPKGNewSoftwareTitleFlow() {
 	)
 	require.Len(t, resp.SoftwareTitles, 1)
 	require.NotNil(t, resp.SoftwareTitles[0].SoftwarePackage)
-	require.Equal(t, "dummy_installer.pkg", *resp.SoftwareTitles[0].SoftwarePackage)
 
 	software := []fleet.Software{
 		{Name: "foo", Version: "0.0.1", Source: "homebrew"},
@@ -10724,6 +11897,21 @@ func (s *integrationEnterpriseTestSuite) TestPKGNewSoftwareTitleFlow() {
 	)
 }
 
+func (s *integrationEnterpriseTestSuite) TestPKGNoVersion() {
+	t := s.T()
+	ctx := context.Background()
+
+	team, err := s.ds.NewTeam(ctx, &fleet.Team{Name: t.Name() + "team1"})
+	require.NoError(t, err)
+
+	payload := &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "some installer script",
+		Filename:      "no_version.pkg",
+		TeamID:        &team.ID,
+	}
+	s.uploadSoftwareInstaller(payload, http.StatusBadRequest, "Couldn't add. Fleet couldn't read the version from no_version.pkg.")
+}
+
 // 1. host reports software
 // 2. reconciler runs, creates title
 // 3. installer is uploaded, matches existing software title
@@ -10907,6 +12095,12 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 		require.NoError(t, err)
 	})
 
+	origRecentUpdateDuration := commonCalendar.RecentCalendarUpdateDuration
+	commonCalendar.RecentCalendarUpdateDuration = 1 * time.Millisecond
+	t.Cleanup(func() {
+		commonCalendar.RecentCalendarUpdateDuration = origRecentUpdateDuration
+	})
+
 	team1, err := s.ds.NewTeam(ctx, &fleet.Team{
 		Name: "team1",
 	})
@@ -10941,9 +12135,9 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 		},
 	)
 	require.NoError(t, err)
-	team1Policy2, err := s.ds.NewTeamPolicy(
+	team1Policy2Calendar, err := s.ds.NewTeamPolicy(
 		ctx, team1.ID, nil, fleet.PolicyPayload{
-			Name:                  "team1Policy2",
+			Name:                  "team1Policy2Calendar",
 			Query:                 "SELECT 2;",
 			CalendarEventsEnabled: true,
 		},
@@ -10994,7 +12188,7 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 		host1Team1,
 		map[uint]*bool{
 			team1Policy1Calendar.ID: ptr.Bool(false),
-			team1Policy2.ID:         ptr.Bool(true),
+			team1Policy2Calendar.ID: ptr.Bool(true),
 			globalPolicy.ID:         nil,
 		},
 	), http.StatusOK, &distributedResp)
@@ -11004,7 +12198,7 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 		host2Team1,
 		map[uint]*bool{
 			team1Policy1Calendar.ID: ptr.Bool(true),
-			team1Policy2.ID:         ptr.Bool(false),
+			team1Policy2Calendar.ID: ptr.Bool(false),
 			globalPolicy.ID:         nil,
 		},
 	), http.StatusOK, &distributedResp)
@@ -11057,11 +12251,15 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 	require.NotZero(t, event.StartTime)
 	require.NotZero(t, event.EndTime)
 	require.NotEmpty(t, event.UUID)
+	bodyTag := event.GetBodyTag()
+	assert.NotEmpty(t, bodyTag)
 	assert.Equal(t, 1, calendar.MockChannelsCount())
 
 	// Get channel ID
 	type eventDetails struct {
 		ChannelID string `json:"channel_id"`
+		BodyTag   string `json:"body_tag"`
+		ETag      string `json:"etag"`
 	}
 	var details eventDetails
 	err = json.Unmarshal(event.Data, &details)
@@ -11088,34 +12286,104 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 	// Delete the event on the calendar
 	calendar.ClearMockEvents()
 
-	// This callback should recreate the event
+	// Grab the distributed lock for this event
+	distributedLock := redis_lock.NewLock(s.redisPool)
+	lockValue := uuid.New().String()
+	result, err := distributedLock.SetIfNotExist(ctx, commonCalendar.LockKeyPrefix+event.UUID, lockValue, 0)
+	require.NoError(t, err)
+	assert.NotEmpty(t, result)
+
+	// This callback should put the event processing in a queue for async processing. It does not start async
+	// processing because it assumes another server is handling this webhook, and that server will start
+	// async processing.
 	_ = s.DoRawWithHeaders("POST", "/api/v1/fleet/calendar/webhook/"+event.UUID, []byte(""), http.StatusOK, map[string]string{
 		"X-Goog-Channel-Id":     details.ChannelID,
 		"X-Goog-Resource-State": "exists",
 	})
 
-	team1CalendarEvents, err = s.ds.ListCalendarEvents(ctx, &team1.ID)
+	uuids, err := distributedLock.GetSet(ctx, commonCalendar.QueueKey)
 	require.NoError(t, err)
-	require.Len(t, team1CalendarEvents, 1)
+	assert.ElementsMatch(t, []string{event.UUID}, uuids)
+	// The calendar should still be empty since event hasn't processed yet
+	assert.Zero(t, len(calendar.ListGoogleMockEvents()))
+	// We clear the queue
+	assert.NoError(t, distributedLock.RemoveFromSet(ctx, commonCalendar.QueueKey, event.UUID))
+
+	// We release the normal lock, but grab the reserve lock instead
+	ok, err := distributedLock.ReleaseLock(ctx, commonCalendar.LockKeyPrefix+event.UUID, lockValue)
+	require.NoError(t, err)
+	assert.True(t, ok)
+	result, err = distributedLock.SetIfNotExist(ctx, commonCalendar.ReservedLockKeyPrefix+event.UUID, lockValue, 0)
+	require.NoError(t, err)
+	assert.NotEmpty(t, result)
+
+	// This callback should put the event processing in a queue for async processing, AND start the async processing
+	_ = s.DoRawWithHeaders("POST", "/api/v1/fleet/calendar/webhook/"+event.UUID, []byte(""), http.StatusOK, map[string]string{
+		"X-Goog-Channel-Id":     details.ChannelID,
+		"X-Goog-Resource-State": "exists",
+	})
+
+	uuids, err = distributedLock.GetSet(ctx, commonCalendar.QueueKey)
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{event.UUID}, uuids)
+	// The calendar should still be empty since event hasn't processed yet
+	assert.Zero(t, len(calendar.ListGoogleMockEvents()))
+
+	// We grab the normal lock again.
+	lockValue2 := uuid.New().String()
+	result, err = distributedLock.SetIfNotExist(ctx, commonCalendar.LockKeyPrefix+event.UUID, lockValue2, 0)
+	require.NoError(t, err)
+	assert.NotEmpty(t, result)
+	// We release the reserve lock.
+	ok, err = distributedLock.ReleaseLock(ctx, commonCalendar.ReservedLockKeyPrefix+event.UUID, lockValue)
+	require.NoError(t, err)
+	assert.True(t, ok)
+	// We release the normal lock.
+	ok, err = distributedLock.ReleaseLock(ctx, commonCalendar.LockKeyPrefix+event.UUID, lockValue2)
+	require.NoError(t, err)
+	assert.True(t, ok)
+
+	done := make(chan struct{})
+	go func() {
+		for {
+			time.Sleep(100 * time.Millisecond)
+			team1CalendarEvents, err = s.ds.ListCalendarEvents(ctx, &team1.ID)
+			require.NoError(t, err)
+			// Event should be rescheduled on a future date/time
+			if len(team1CalendarEvents) == 1 && team1CalendarEvents[0].UUID == event.UUID &&
+				team1CalendarEvents[0].StartTime.After(event.StartTime) {
+				done <- struct{}{}
+				return
+			}
+		}
+	}()
+	select {
+	case <-done: // All good
+	case <-time.After(5 * time.Second):
+		t.Fatal("timeout waiting for calendar event processing")
+	}
+
 	eventRecreated := team1CalendarEvents[0]
 	assert.NotZero(t, eventRecreated.ID)
 	assert.Equal(t, user1Email, eventRecreated.Email)
 	assert.NotZero(t, eventRecreated.StartTime)
 	assert.NotZero(t, eventRecreated.EndTime)
 	assert.NotEmpty(t, eventRecreated.UUID)
-	assert.NotEqual(t, event.UUID, eventRecreated.UUID)
 	assert.NotEqual(t, event.StartTime, eventRecreated.StartTime)
 	assert.NotEqual(t, event.EndTime, eventRecreated.EndTime)
 	assert.Equal(t, 1, calendar.MockChannelsCount())
+	assert.Equal(t, 1, len(calendar.ListGoogleMockEvents()))
 
-	// The previous event UUID should not work anymore
-	_ = s.DoRawWithHeaders("POST", "/api/v1/fleet/calendar/webhook/"+event.UUID, []byte(""), http.StatusNotFound, map[string]string{
+	// The previous event UUID should not work anymore, but API returns OK because this is a common occurrence.
+	_ = s.DoRawWithHeaders("POST", "/api/v1/fleet/calendar/webhook/"+event.UUID, []byte(""), http.StatusOK, map[string]string{
 		"X-Goog-Channel-Id":     details.ChannelID,
 		"X-Goog-Resource-State": "exists",
 	})
 
 	err = json.Unmarshal(eventRecreated.Data, &details)
 	require.NoError(t, err)
+	assert.NotEmpty(t, details.BodyTag)
+	bodyTag = details.BodyTag
 
 	// New event callback should work
 	_ = s.DoRawWithHeaders("POST", "/api/v1/fleet/calendar/webhook/"+eventRecreated.UUID, []byte(""), http.StatusOK,
@@ -11152,6 +12420,103 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 	assert.Greater(t, eventUpdated.StartTime, eventRecreated.StartTime)
 	assert.Equal(t, eventRecreated.EndTime, eventUpdated.EndTime)
 	assert.Equal(t, 1, calendar.MockChannelsCount())
+	assert.Equal(t, bodyTag, eventRecreated.GetBodyTag())
+
+	// Change the body contents of event.
+	events = calendar.ListGoogleMockEvents()
+	require.Len(t, events, 1)
+	eTag := "description change etag"
+	for _, e := range events {
+		e.Etag = eTag
+		e.Description = "new description"
+	}
+	// New event callback should cause Etag to update but Body tag to remain the same
+	_ = s.DoRawWithHeaders("POST", "/api/v1/fleet/calendar/webhook/"+eventRecreated.UUID, []byte(""), http.StatusOK,
+		map[string]string{
+			"X-Goog-Channel-Id":     details.ChannelID,
+			"X-Goog-Resource-State": "exists",
+		})
+	team1CalendarEvents, err = s.ds.ListCalendarEvents(ctx, &team1.ID)
+	require.NoError(t, err)
+	require.Len(t, team1CalendarEvents, 1)
+	eventDescUpdated := team1CalendarEvents[0]
+	err = json.Unmarshal(eventDescUpdated.Data, &details)
+	require.NoError(t, err)
+	assert.Equal(t, bodyTag, details.BodyTag)
+	assert.Equal(t, eTag, details.ETag)
+
+	// Update the time of the event again
+	events = calendar.ListGoogleMockEvents()
+	require.Len(t, events, 1)
+	for _, e := range events {
+		st, err := time.Parse(time.RFC3339, e.Start.DateTime)
+		require.NoError(t, err)
+		newStartTime := st.Add(5 * time.Minute).Format(time.RFC3339)
+		e.Start.DateTime = newStartTime
+		e.Etag = e.Etag + "1"
+	}
+
+	// Grab the lock
+	event = eventUpdated
+	lockValue = uuid.New().String()
+	result, err = distributedLock.SetIfNotExist(ctx, commonCalendar.LockKeyPrefix+event.UUID, lockValue, 0)
+	require.NoError(t, err)
+	assert.NotEmpty(t, result)
+
+	mysql.ExecAdhocSQL(t, s.ds, func(db sqlx.ExtContext) error {
+		// Update updated_at so the event gets updated (the event is updated regularly)
+		_, err := db.ExecContext(ctx,
+			`UPDATE calendar_events SET updated_at = DATE_SUB(CURRENT_TIMESTAMP, INTERVAL 25 HOUR) WHERE id = ?`, event.ID)
+		return err
+	})
+
+	// Trigger the calendar cron async. It should wait for the lock and set reserve lock.
+	go triggerAndWait(ctx, t, s.ds, s.calendarSchedule, 10*time.Second)
+	done = make(chan struct{})
+	go func() {
+		for {
+			time.Sleep(100 * time.Millisecond)
+			reserveLock, err := distributedLock.Get(ctx, commonCalendar.ReservedLockKeyPrefix+event.UUID)
+			require.NoError(t, err)
+			if reserveLock != nil {
+				done <- struct{}{}
+				return
+			}
+		}
+	}()
+	select {
+	case <-done: // All good
+	case <-time.After(5 * time.Second):
+		t.Fatal("timeout waiting for cron to set reserve lock")
+	}
+
+	// Release the normal lock
+	ok, err = distributedLock.ReleaseLock(ctx, commonCalendar.LockKeyPrefix+event.UUID, lockValue)
+	require.NoError(t, err)
+	assert.True(t, ok)
+
+	// Wait for the event to update
+	done = make(chan struct{})
+	go func() {
+		for {
+			time.Sleep(100 * time.Millisecond)
+			team1CalendarEvents, err = s.ds.ListCalendarEvents(ctx, &team1.ID)
+			require.NoError(t, err)
+			if len(team1CalendarEvents) == 1 && team1CalendarEvents[0].UUID == event.UUID &&
+				team1CalendarEvents[0].StartTime.After(event.StartTime) {
+				err = json.Unmarshal(team1CalendarEvents[0].Data, &details)
+				require.NoError(t, err)
+				assert.NotEqual(t, eTag, details.ETag, "ETag should have updated")
+				done <- struct{}{}
+				return
+			}
+		}
+	}()
+	select {
+	case <-done: // All good
+	case <-time.After(5 * time.Second):
+		t.Fatal("timeout waiting for event to update during cron")
+	}
 
 	// Delete the event on the calendar
 	calendar.ClearMockEvents()
@@ -11161,12 +12526,25 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 		host1Team1,
 		map[uint]*bool{
 			team1Policy1Calendar.ID: ptr.Bool(true),
-			team1Policy2.ID:         ptr.Bool(true),
+			team1Policy2Calendar.ID: ptr.Bool(true),
 			globalPolicy.ID:         nil,
 		},
 	), http.StatusOK, &distributedResp)
 
-	// Callback should still work, but only clear the callback channel. Event in DB will be deleted on the next cron run.
+	// We set a flag that event was updated recently. Callback shouldn't do anything since event was updated recently
+	_, err = distributedLock.SetIfNotExist(ctx, commonCalendar.RecentUpdateKeyPrefix+event.UUID, commonCalendar.RecentCalendarUpdateValue,
+		1000)
+	require.NoError(t, err)
+	_ = s.DoRawWithHeaders("POST", "/api/v1/fleet/calendar/webhook/"+eventRecreated.UUID, []byte(""), http.StatusOK,
+		map[string]string{
+			"X-Goog-Channel-Id":     details.ChannelID,
+			"X-Goog-Resource-State": "exists",
+		})
+	assert.Equal(t, 1, calendar.MockChannelsCount())
+
+	// Callback should work, but only clear the callback channel. Event in DB will be deleted on the next cron run.
+	_, err = distributedLock.ReleaseLock(ctx, commonCalendar.RecentUpdateKeyPrefix+event.UUID, commonCalendar.RecentCalendarUpdateValue)
+	require.NoError(t, err)
 	_ = s.DoRawWithHeaders("POST", "/api/v1/fleet/calendar/webhook/"+eventRecreated.UUID, []byte(""), http.StatusOK,
 		map[string]string{
 			"X-Goog-Channel-Id":     details.ChannelID,
@@ -11174,10 +12552,11 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 		})
 	assert.Equal(t, 0, calendar.MockChannelsCount())
 
+	previousEvent := team1CalendarEvents[0]
 	team1CalendarEvents, err = s.ds.ListCalendarEvents(ctx, &team1.ID)
 	require.NoError(t, err)
 	require.Len(t, team1CalendarEvents, 1)
-	assert.Equal(t, eventUpdated, team1CalendarEvents[0])
+	assert.Equal(t, previousEvent, team1CalendarEvents[0])
 
 	// Trigger calendar should cleanup the events
 	triggerAndWait(ctx, t, s.ds, s.calendarSchedule, 5*time.Second)
@@ -11187,5 +12566,958 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 	team1CalendarEvents, err = s.ds.ListCalendarEvents(ctx, &team1.ID)
 	require.NoError(t, err)
 	assert.Empty(t, team1CalendarEvents)
+}
+
+func (s *integrationEnterpriseTestSuite) TestCalendarEventBodyUpdate() {
+	ctx := context.Background()
+	t := s.T()
+	t.Cleanup(func() {
+		calendar.ClearMockEvents()
+		calendar.ClearMockChannels()
+	})
+	currentAppCfg, err := s.ds.AppConfig(ctx)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		err = s.ds.SaveAppConfig(ctx, currentAppCfg)
+		require.NoError(t, err)
+	})
+	origRecentUpdateDuration := commonCalendar.RecentCalendarUpdateDuration
+	commonCalendar.RecentCalendarUpdateDuration = 1 * time.Millisecond
+	t.Cleanup(func() {
+		commonCalendar.RecentCalendarUpdateDuration = origRecentUpdateDuration
+	})
+
+	team1, err := s.ds.NewTeam(ctx, &fleet.Team{
+		Name: "team1",
+	})
+	require.NoError(t, err)
+
+	newHost := func(name string, teamID *uint) *fleet.Host {
+		h, err := s.ds.NewHost(ctx, &fleet.Host{
+			DetailUpdatedAt: time.Now(),
+			LabelUpdatedAt:  time.Now(),
+			PolicyUpdatedAt: time.Now(),
+			SeenTime:        time.Now().Add(-1 * time.Minute),
+			OsqueryHostID:   ptr.String(t.Name() + name),
+			NodeKey:         ptr.String(t.Name() + name),
+			UUID:            uuid.New().String(),
+			Hostname:        fmt.Sprintf("%s.%s.local", name, t.Name()),
+			Platform:        "darwin",
+			TeamID:          teamID,
+		})
+		require.NoError(t, err)
+		return h
+	}
+
+	host1Team1 := newHost("host1", &team1.ID)
+	host2Team1 := newHost("host2", &team1.ID)
+	_ = newHost("host5", nil) // global host
+
+	team1Policy1Calendar, err := s.ds.NewTeamPolicy(
+		ctx, team1.ID, nil, fleet.PolicyPayload{
+			Name:                  "team1Policy1Calendar",
+			Query:                 "SELECT 1;",
+			CalendarEventsEnabled: true,
+			Description:           "team1Policy1CalendarDescription",
+			Resolution:            "team1Policy1CalendarResolution",
+		},
+	)
+	require.NoError(t, err)
+	team1Policy2Calendar, err := s.ds.NewTeamPolicy(
+		ctx, team1.ID, nil, fleet.PolicyPayload{
+			Name:                  "team1Policy2Calendar",
+			Query:                 "SELECT 2;",
+			CalendarEventsEnabled: true,
+			Description:           "team1Policy2CalendarDescription",
+			Resolution:            "team1Policy2CalendarResolution",
+		},
+	)
+	require.NoError(t, err)
+	globalPolicy, err := s.ds.NewGlobalPolicy(
+		ctx, nil, fleet.PolicyPayload{
+			Name:                  "globalPolicy",
+			Query:                 "SELECT 5;",
+			CalendarEventsEnabled: false,
+			Description:           "globalPolicyDescription",
+			Resolution:            "globalPolicyResolution",
+		},
+	)
+	require.NoError(t, err)
+
+	genDistributedReqWithPolicyResults := func(host *fleet.Host, policyResults map[uint]*bool) submitDistributedQueryResultsRequestShim {
+		var (
+			results  = make(map[string]json.RawMessage)
+			statuses = make(map[string]interface{})
+			messages = make(map[string]string)
+		)
+		for policyID, policyResult := range policyResults {
+			distributedQueryName := hostPolicyQueryPrefix + fmt.Sprint(policyID)
+			switch {
+			case policyResult == nil:
+				results[distributedQueryName] = json.RawMessage(`[]`)
+				statuses[distributedQueryName] = 1
+				messages[distributedQueryName] = "policy failed execution"
+			case *policyResult:
+				results[distributedQueryName] = json.RawMessage(`[{"1": "1"}]`)
+				statuses[distributedQueryName] = 0
+			case !*policyResult:
+				results[distributedQueryName] = json.RawMessage(`[]`)
+				statuses[distributedQueryName] = 0
+			}
+		}
+		return submitDistributedQueryResultsRequestShim{
+			NodeKey:  *host.NodeKey,
+			Results:  results,
+			Statuses: statuses,
+			Messages: messages,
+			Stats:    map[string]*fleet.Stats{},
+		}
+	}
+
+	// host1Team1 is failing a calendar policy and not a non-calendar policy (no results for global).
+	distributedResp := submitDistributedQueryResultsResponse{}
+	s.DoJSON("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host1Team1,
+		map[uint]*bool{
+			team1Policy1Calendar.ID: ptr.Bool(false),
+			team1Policy2Calendar.ID: ptr.Bool(true),
+			globalPolicy.ID:         nil,
+		},
+	), http.StatusOK, &distributedResp)
+
+	// host2Team1 is passing the calendar policy but not the non-calendar policy (no results for global).
+	s.DoJSON("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host2Team1,
+		map[uint]*bool{
+			team1Policy1Calendar.ID: ptr.Bool(true),
+			team1Policy2Calendar.ID: ptr.Bool(false),
+			globalPolicy.ID:         nil,
+		},
+	), http.StatusOK, &distributedResp)
+
+	// Set global configuration for the calendar feature.
+	appCfg, err := s.ds.AppConfig(ctx)
+	require.NoError(t, err)
+	appCfg.Integrations.GoogleCalendar = []*fleet.GoogleCalendarIntegration{
+		{
+			Domain: "example.com",
+			ApiKey: map[string]string{
+				fleet.GoogleCalendarEmail: calendar.MockEmail,
+			},
+		},
+	}
+	err = s.ds.SaveAppConfig(ctx, appCfg)
+	require.NoError(t, err)
+	time.Sleep(2 * time.Second) // Wait 2 seconds for the app config cache to clear.
 
+	team1.Config.Integrations.GoogleCalendar = &fleet.TeamGoogleCalendarIntegration{
+		Enable:     true,
+		WebhookURL: "https://example.com",
+	}
+	team1, err = s.ds.SaveTeam(ctx, team1)
+	require.NoError(t, err)
+
+	// Add email mapping for host1Team1
+	const user1Email = "user1@example.com"
+	err = s.ds.ReplaceHostDeviceMapping(ctx, host1Team1.ID, []*fleet.HostDeviceMapping{
+		{
+			HostID: host1Team1.ID,
+			Email:  user1Email,
+			Source: "google_chrome_profiles",
+		},
+	}, "google_chrome_profiles")
+	require.NoError(t, err)
+	assert.Equal(t, 0, calendar.MockChannelsCount())
+
+	// Trigger the calendar cron, global feature enabled, team1 enabled
+	// and host1Team1 has a domain email associated.
+	triggerAndWait(ctx, t, s.ds, s.calendarSchedule, 5*time.Second)
+
+	// An event should be generated for host1Team1
+	team1CalendarEvents, err := s.ds.ListCalendarEvents(ctx, &team1.ID)
+	require.NoError(t, err)
+	require.Len(t, team1CalendarEvents, 1)
+	event := team1CalendarEvents[0]
+	require.NotZero(t, event.ID)
+	require.Equal(t, user1Email, event.Email)
+	require.NotZero(t, event.StartTime)
+	require.NotZero(t, event.EndTime)
+	require.NotEmpty(t, event.UUID)
+	assert.Equal(t, 1, calendar.MockChannelsCount())
+
+	getEvents := func() []*googleCalendar.Event {
+		calEvents := calendar.ListGoogleMockEvents()
+		calEventValues := make([]*googleCalendar.Event, 0, len(calEvents))
+		for _, v := range calEvents {
+			calEventValues = append(calEventValues, v)
+		}
+		return calEventValues
+	}
+
+	calEvents := getEvents()
+	require.Len(t, calEvents, 1)
+	assert.Contains(t, calEvents[0].Description, team1Policy1Calendar.Description)
+	assert.Contains(t, calEvents[0].Description, *team1Policy1Calendar.Resolution)
+
+	// Remove resolution from policy
+	team1Policy1Calendar.Resolution = nil
+	require.NoError(t, s.ds.SavePolicy(ctx, team1Policy1Calendar, false, false))
+	triggerAndWait(ctx, t, s.ds, s.calendarSchedule, 5*time.Second)
+
+	calEvents = getEvents()
+	require.Len(t, calEvents, 1)
+	assert.Contains(t, calEvents[0].Description, fleet.CalendarDefaultDescription)
+	assert.Contains(t, calEvents[0].Description, fleet.CalendarDefaultResolution)
+
+	// Put resolution back
+	team1Policy1Calendar.Resolution = ptr.String("putResolutionBack")
+	require.NoError(t, s.ds.SavePolicy(ctx, team1Policy1Calendar, false, false))
+	triggerAndWait(ctx, t, s.ds, s.calendarSchedule, 5*time.Second)
+
+	calEvents = getEvents()
+	require.Len(t, calEvents, 1)
+	assert.Contains(t, calEvents[0].Description, team1Policy1Calendar.Description)
+	assert.Contains(t, calEvents[0].Description, *team1Policy1Calendar.Resolution)
+
+	// Change resolution
+	team1Policy1Calendar.Resolution = ptr.String("changeResolution")
+	require.NoError(t, s.ds.SavePolicy(ctx, team1Policy1Calendar, false, false))
+	triggerAndWait(ctx, t, s.ds, s.calendarSchedule, 5*time.Second)
+
+	calEvents = getEvents()
+	require.Len(t, calEvents, 1)
+	assert.Contains(t, calEvents[0].Description, team1Policy1Calendar.Description)
+	assert.Contains(t, calEvents[0].Description, *team1Policy1Calendar.Resolution)
+
+	// Cause another policy to fail
+	s.DoJSON("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host1Team1,
+		map[uint]*bool{
+			team1Policy1Calendar.ID: ptr.Bool(false),
+			team1Policy2Calendar.ID: ptr.Bool(false),
+			globalPolicy.ID:         nil,
+		},
+	), http.StatusOK, &distributedResp)
+	triggerAndWait(ctx, t, s.ds, s.calendarSchedule, 5*time.Second)
+
+	calEvents = getEvents()
+	require.Len(t, calEvents, 1)
+	assert.Contains(t, calEvents[0].Description, fleet.CalendarDefaultDescription)
+	assert.Contains(t, calEvents[0].Description, fleet.CalendarDefaultResolution)
+
+	// Cause the other policy to pass
+	s.DoJSON("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host1Team1,
+		map[uint]*bool{
+			team1Policy1Calendar.ID: ptr.Bool(false),
+			team1Policy2Calendar.ID: ptr.Bool(true),
+			globalPolicy.ID:         nil,
+		},
+	), http.StatusOK, &distributedResp)
+	triggerAndWait(ctx, t, s.ds, s.calendarSchedule, 5*time.Second)
+
+	calEvents = getEvents()
+	require.Len(t, calEvents, 1)
+	assert.Contains(t, calEvents[0].Description, team1Policy1Calendar.Description)
+	assert.Contains(t, calEvents[0].Description, *team1Policy1Calendar.Resolution)
+
+	// Get channel ID
+	type eventDetails struct {
+		ChannelID string `json:"channel_id"`
+	}
+	var details eventDetails
+	err = json.Unmarshal(event.Data, &details)
+	require.NoError(t, err)
+
+	// Delete the event on the calendar
+	calendar.ClearMockEvents()
+
+	// Send a regular callback
+	_ = s.DoRawWithHeaders("POST", "/api/v1/fleet/calendar/webhook/"+event.UUID, []byte(""), http.StatusOK, map[string]string{
+		"X-Goog-Channel-Id":     details.ChannelID,
+		"X-Goog-Resource-State": "exists",
+	})
+
+	// Make sure event body is correct after event was recreated
+	calEvents = getEvents()
+	require.Len(t, calEvents, 1)
+	assert.Contains(t, calEvents[0].Description, team1Policy1Calendar.Description)
+	assert.Contains(t, calEvents[0].Description, *team1Policy1Calendar.Resolution)
+
+	// Get the new event
+	team1CalendarEvents, err = s.ds.ListCalendarEvents(ctx, &team1.ID)
+	require.NoError(t, err)
+	require.Len(t, team1CalendarEvents, 1)
+	event = team1CalendarEvents[0]
+	err = json.Unmarshal(event.Data, &details)
+	require.NoError(t, err)
+
+	// Remove description from policy
+	team1Policy1Calendar.Description = " "
+	require.NoError(t, s.ds.SavePolicy(ctx, team1Policy1Calendar, false, false))
+	// Delete the event on the calendar
+	calendar.ClearMockEvents()
+
+	// Send a regular callback
+	_ = s.DoRawWithHeaders("POST", "/api/v1/fleet/calendar/webhook/"+event.UUID, []byte(""), http.StatusOK, map[string]string{
+		"X-Goog-Channel-Id":     details.ChannelID,
+		"X-Goog-Resource-State": "exists",
+	})
+
+	// Make sure event body is correct after event was recreated
+	calEvents = getEvents()
+	require.Len(t, calEvents, 1)
+	assert.Contains(t, calEvents[0].Description, fleet.CalendarDefaultDescription)
+	assert.Contains(t, calEvents[0].Description, fleet.CalendarDefaultResolution)
+}
+
+func (s *integrationEnterpriseTestSuite) TestVPPAppsWithoutMDM() {
+	t := s.T()
+	ctx := context.Background()
+
+	// Create host
+	orbitHost := createOrbitEnrolledHost(t, "darwin", "nonmdm", s.ds)
+
+	test.CreateInsertGlobalVPPToken(t, s.ds)
+
+	// Create team and add host to team
+	var newTeamResp teamResponse
+	s.DoJSON("POST", "/api/latest/fleet/teams", &createTeamRequest{TeamPayload: fleet.TeamPayload{Name: ptr.String("Team 1")}}, http.StatusOK, &newTeamResp)
+	team := newTeamResp.Team
+
+	s.Do("POST", "/api/latest/fleet/hosts/transfer", &addHostsToTeamRequest{HostIDs: []uint{orbitHost.ID}, TeamID: &team.ID}, http.StatusOK)
+
+	// Add an app so that we don't get a not found error
+	app, err := s.ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name:             "App " + t.Name(),
+		BundleIdentifier: "bid_" + t.Name(),
+		VPPAppTeam: fleet.VPPAppTeam{
+			VPPAppID: fleet.VPPAppID{
+				AdamID:   "adam_" + t.Name(),
+				Platform: fleet.MacOSPlatform,
+			},
+		},
+	}, &team.ID)
+	require.NoError(t, err)
+
+	r := s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", orbitHost.ID, app.TitleID), &installSoftwareRequest{}, http.StatusUnprocessableEntity)
+	require.Contains(t, extractServerErrorText(r.Body), "Couldn't install. MDM is turned off. Please make sure that MDM is turned on to install App Store apps.")
+}
+
+func (s *integrationEnterpriseTestSuite) TestPolicyAutomationsSoftwareInstallers() {
+	t := s.T()
+	ctx := context.Background()
+
+	team1, err := s.ds.NewTeam(ctx, &fleet.Team{Name: t.Name() + "team1"})
+	require.NoError(t, err)
+	team2, err := s.ds.NewTeam(ctx, &fleet.Team{Name: t.Name() + "team2"})
+	require.NoError(t, err)
+
+	test.CreateInsertGlobalVPPToken(t, s.ds)
+
+	newHost := func(name string, teamID *uint, platform string) *fleet.Host {
+		h, err := s.ds.NewHost(ctx, &fleet.Host{
+			DetailUpdatedAt: time.Now(),
+			LabelUpdatedAt:  time.Now(),
+			PolicyUpdatedAt: time.Now(),
+			SeenTime:        time.Now().Add(-1 * time.Minute),
+			OsqueryHostID:   ptr.String(t.Name() + name),
+			NodeKey:         ptr.String(t.Name() + name),
+			UUID:            uuid.New().String(),
+			Hostname:        fmt.Sprintf("%s.%s.local", name, t.Name()),
+			Platform:        platform,
+			TeamID:          teamID,
+		})
+		require.NoError(t, err)
+		return h
+	}
+	newFleetdHost := func(name string, teamID *uint, platform string) *fleet.Host {
+		h := newHost(name, teamID, platform)
+		orbitKey := setOrbitEnrollment(t, h, s.ds)
+		h.OrbitNodeKey = &orbitKey
+		return h
+	}
+
+	host0NoTeam := newFleetdHost("host1NoTeam", nil, "darwin")
+	host1Team1 := newFleetdHost("host1Team1", &team1.ID, "darwin")
+	host2Team1 := newFleetdHost("host2Team1", &team1.ID, "ubuntu")
+	host3Team2 := newFleetdHost("host3Team2", &team2.ID, "windows")
+	hostVanillaOsquery5Team1 := newHost("hostVanillaOsquery5Team2", &team1.ID, "darwin")
+
+	// Upload dummy_installer.pkg to team1.
+	pkgPayload := &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "some pkg install script",
+		Filename:      "dummy_installer.pkg",
+		TeamID:        &team1.ID,
+	}
+	s.uploadSoftwareInstaller(pkgPayload, http.StatusOK, "")
+	// Get software title ID of the uploaded installer.
+	resp := listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"query", "DummyApp.app",
+		"team_id", fmt.Sprintf("%d", team1.ID),
+	)
+	require.Len(t, resp.SoftwareTitles, 1)
+	require.NotNil(t, resp.SoftwareTitles[0].SoftwarePackage)
+	dummyInstallerPkgTitleID := resp.SoftwareTitles[0].ID
+	var dummyInstallerPkg struct {
+		ID        uint   `db:"id"`
+		UserID    *uint  `db:"user_id"`
+		UserName  string `db:"user_name"`
+		UserEmail string `db:"user_email"`
+	}
+	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(ctx, q,
+			&dummyInstallerPkg,
+			`SELECT id, user_id, user_name, user_email FROM software_installers WHERE global_or_team_id = ? AND filename = ?`,
+			team1.ID, "dummy_installer.pkg",
+		)
+	})
+	dummyInstallerPkgInstallerID := dummyInstallerPkg.ID
+	require.NotZero(t, dummyInstallerPkgInstallerID)
+	require.NotNil(t, dummyInstallerPkg.UserID)
+	globalAdmin, err := s.ds.UserByEmail(ctx, "admin1@example.com")
+	require.NoError(t, err)
+	require.Equal(t, globalAdmin.ID, *dummyInstallerPkg.UserID)
+	require.Equal(t, "Test Name admin1@example.com", dummyInstallerPkg.UserName)
+	require.Equal(t, "admin1@example.com", dummyInstallerPkg.UserEmail)
+
+	// Upload ruby.deb to team1 by a user who will be deleted.
+	u2 := &fleet.User{
+		Name:       "admin team1",
+		Email:      "admin_team1@example.com",
+		GlobalRole: nil,
+		Teams: []fleet.UserTeam{
+			{
+				Team: *team1,
+				Role: fleet.RoleAdmin,
+			},
+		},
+	}
+	require.NoError(t, u2.SetPassword(test.GoodPassword, 10, 10))
+	adminTeam1, err := s.ds.NewUser(context.Background(), u2)
+	require.NoError(t, err)
+	rubyPayload := &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "some deb install script",
+		Filename:      "ruby.deb",
+		TeamID:        &team1.ID,
+	}
+	sessionKey := uuid.New().String()
+	adminTeam1Session, err := s.ds.NewSession(ctx, adminTeam1.ID, sessionKey)
+	require.NoError(t, err)
+	adminToken := s.token
+	t.Cleanup(func() {
+		s.token = adminToken
+	})
+	s.token = adminTeam1Session.Key
+	s.uploadSoftwareInstaller(rubyPayload, http.StatusOK, "")
+	s.token = adminToken
+	err = s.ds.DeleteUser(ctx, adminTeam1.ID)
+	require.NoError(t, err)
+	// Get software title ID of the uploaded installer.
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"query", "ruby",
+		"team_id", fmt.Sprintf("%d", team1.ID),
+	)
+	require.Len(t, resp.SoftwareTitles, 1)
+	require.NotNil(t, resp.SoftwareTitles[0].SoftwarePackage)
+	rubyDebTitleID := resp.SoftwareTitles[0].ID
+	var rubyDeb struct {
+		ID        uint   `db:"id"`
+		UserID    *uint  `db:"user_id"`
+		UserName  string `db:"user_name"`
+		UserEmail string `db:"user_email"`
+	}
+	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(ctx, q,
+			&rubyDeb,
+			`SELECT id, user_id, user_name, user_email FROM software_installers WHERE global_or_team_id = ? AND filename = ?`,
+			team1.ID, "ruby.deb",
+		)
+	})
+	rubyDebInstallerID := rubyDeb.ID
+	require.NotZero(t, rubyDebInstallerID)
+	require.Nil(t, rubyDeb.UserID)
+	require.Equal(t, "admin team1", rubyDeb.UserName)
+	require.Equal(t, "admin_team1@example.com", rubyDeb.UserEmail)
+
+	// Upload fleet-osquery.msi to team2.
+	fleetOsqueryPayload := &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "some msi install script",
+		Filename:      "fleet-osquery.msi",
+		TeamID:        &team2.ID,
+		// Set as Self-service to check that the generated host_software_installs
+		// is generated with self_service=false and the activity has the correct
+		// author (the admin that uploaded the installer).
+		SelfService: true,
+	}
+	s.uploadSoftwareInstaller(fleetOsqueryPayload, http.StatusOK, "")
+	// Get software title ID of the uploaded installer.
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"query", "Fleet osquery",
+		"team_id", fmt.Sprintf("%d", team2.ID),
+	)
+	require.Len(t, resp.SoftwareTitles, 1)
+	require.NotNil(t, resp.SoftwareTitles[0].SoftwarePackage)
+	fleetOsqueryMSITitleID := resp.SoftwareTitles[0].ID
+	var fleetOsqueryMSIInstallerID uint
+	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(ctx, q,
+			&fleetOsqueryMSIInstallerID,
+			`SELECT id FROM software_installers WHERE global_or_team_id = ? AND filename = ?`,
+			team2.ID, "fleet-osquery.msi",
+		)
+	})
+	require.NotZero(t, fleetOsqueryMSIInstallerID)
+
+	// Create a VPP app to test that policies cannot be assigned to them.
+	_, err = s.ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name:             "App123 " + t.Name(),
+		BundleIdentifier: "bid_" + t.Name(),
+		VPPAppTeam: fleet.VPPAppTeam{
+			VPPAppID: fleet.VPPAppID{
+				AdamID:   "adam_" + t.Name(),
+				Platform: fleet.MacOSPlatform,
+			},
+		},
+	}, &team1.ID)
+	require.NoError(t, err)
+	// Get software title ID of the uploaded VPP app.
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"query", "App123",
+		"team_id", fmt.Sprintf("%d", team1.ID),
+	)
+	require.Len(t, resp.SoftwareTitles, 1)
+	require.NotNil(t, resp.SoftwareTitles[0].AppStoreApp)
+	vppAppTitleID := resp.SoftwareTitles[0].ID
+
+	// Populate software for host1Team1 (to have a software title
+	// that doesn't have an associated installer)
+	software := []fleet.Software{
+		{Name: "Foobar.app", Version: "0.0.1", Source: "apps"},
+	}
+	_, err = s.ds.UpdateHostSoftware(ctx, host1Team1.ID, software)
+	require.NoError(t, err)
+	require.NoError(t, s.ds.SyncHostsSoftware(ctx, time.Now()))
+	require.NoError(t, s.ds.ReconcileSoftwareTitles(ctx))
+	require.NoError(t, s.ds.SyncHostsSoftwareTitles(ctx, time.Now()))
+	// Get software title ID of the software.
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"query", "Foobar.app",
+		"team_id", fmt.Sprintf("%d", team1.ID),
+	)
+	require.Len(t, resp.SoftwareTitles, 1)
+	require.Nil(t, resp.SoftwareTitles[0].SoftwarePackage)
+	foobarAppTitleID := resp.SoftwareTitles[0].ID
+
+	// policy0AllTeams is a global policy that runs on all devices.
+	policy0AllTeams, err := s.ds.NewGlobalPolicy(ctx, nil, fleet.PolicyPayload{
+		Name:     "policy0AllTeams",
+		Query:    "SELECT 1;",
+		Platform: "darwin",
+	})
+	require.NoError(t, err)
+	// policy1Team1 runs on macOS devices.
+	policy1Team1, err := s.ds.NewTeamPolicy(ctx, team1.ID, nil, fleet.PolicyPayload{
+		Name:     "policy1Team1",
+		Query:    "SELECT 1;",
+		Platform: "darwin",
+	})
+	require.NoError(t, err)
+	// policy2Team1 runs on macOS and Linux devices.
+	policy2Team1, err := s.ds.NewTeamPolicy(ctx, team1.ID, nil, fleet.PolicyPayload{
+		Name:     "policy2Team1",
+		Query:    "SELECT 2;",
+		Platform: "linux,darwin",
+	})
+	require.NoError(t, err)
+	// policy3Team1 runs on all devices in team1 (will have no associated installers).
+	policy3Team1, err := s.ds.NewTeamPolicy(ctx, team1.ID, nil, fleet.PolicyPayload{
+		Name:  "policy3Team1",
+		Query: "SELECT 3;",
+	})
+	require.NoError(t, err)
+	// policy4Team2 runs on Windows devices.
+	policy4Team2, err := s.ds.NewTeamPolicy(ctx, team2.ID, nil, fleet.PolicyPayload{
+		Name:     "policy4Team2",
+		Query:    "SELECT 4;",
+		Platform: "windows",
+	})
+	require.NoError(t, err)
+
+	// Attempt to associate to an unknown software title.
+	mtplr := modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy1Team1.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: ptr.Uint(999_999),
+		},
+	}, http.StatusBadRequest, &mtplr)
+	// Attempt to associate to a software title without associated installer.
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy1Team1.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: ptr.Uint(foobarAppTitleID),
+		},
+	}, http.StatusBadRequest, &mtplr)
+	// Attempt to associate vppApp to policy1Team1 which should fail because we only allow associating software installers.
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy1Team1.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: &vppAppTitleID,
+		},
+	}, http.StatusBadRequest, &mtplr)
+	// Associate dummy_installer.pkg to policy1Team1.
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy1Team1.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: &dummyInstallerPkgTitleID,
+		},
+	}, http.StatusOK, &mtplr)
+	// Change name only (to test not setting a software_title_id).
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy1Team1.ID),
+		json.RawMessage(`{"name": "policy1Team1_Renamed"}`), http.StatusOK, &mtplr,
+	)
+	policy1Team1, err = s.ds.Policy(ctx, policy1Team1.ID)
+	require.NoError(t, err)
+	require.NotNil(t, policy1Team1.SoftwareInstallerID)
+	require.Equal(t, dummyInstallerPkgInstallerID, *policy1Team1.SoftwareInstallerID)
+	require.Equal(t, "policy1Team1_Renamed", *&policy1Team1.Name)
+	// Explicit set to 0 to disable.
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy1Team1.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: ptr.Uint(0),
+		},
+	}, http.StatusOK, &mtplr)
+	policy1Team1, err = s.ds.Policy(ctx, policy1Team1.ID)
+	require.NoError(t, err)
+	require.Nil(t, policy1Team1.SoftwareInstallerID)
+	// Back to associating dummy_installer.pkg to policy1Team1.
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy1Team1.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: &dummyInstallerPkgTitleID,
+		},
+	}, http.StatusOK, &mtplr)
+	policy1Team1, err = s.ds.Policy(ctx, policy1Team1.ID)
+	require.NoError(t, err)
+	require.NotNil(t, policy1Team1.SoftwareInstallerID)
+	require.Equal(t, dummyInstallerPkgInstallerID, *policy1Team1.SoftwareInstallerID)
+
+	// Associate ruby.deb to policy2Team1.
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy2Team1.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: &rubyDebTitleID,
+		},
+	}, http.StatusOK, &mtplr)
+
+	host1LastInstall, err := s.ds.GetHostLastInstallData(ctx, host1Team1.ID, dummyInstallerPkgInstallerID)
+	require.NoError(t, err)
+	require.Nil(t, host1LastInstall)
+
+	// We use DoJSONWithoutAuth for distributed/write because we want the requests to not have the
+	// current user's "Authorization: Bearer <API_TOKEN>" header.
+
+	// host1Team1 fails all policies on the first report.
+	// Failing policy1Team1 means an install request must be generated.
+	// Failing policy2Team1 should not trigger a install request because it has a .deb attached to it (does not apply to macOS hosts).
+	// Failing policy3Team1 should do nothing because it doesn't have any installers associated to it.
+	distributedResp := submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host1Team1,
+		map[uint]*bool{
+			policy1Team1.ID: ptr.Bool(false),
+			policy2Team1.ID: ptr.Bool(false),
+			policy3Team1.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+
+	host1LastInstall, err = s.ds.GetHostLastInstallData(ctx, host1Team1.ID, dummyInstallerPkgInstallerID)
+	require.NoError(t, err)
+	require.NotNil(t, host1LastInstall)
+	require.NotEmpty(t, host1LastInstall.ExecutionID)
+	require.NotNil(t, host1LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallerPending, *host1LastInstall.Status)
+	prevExecutionID := host1LastInstall.ExecutionID
+
+	// Request a manual installation on the host for the same installer, which should fail.
+	var installResp installSoftwareResponse
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d",
+		host1Team1.ID, dummyInstallerPkgTitleID), nil, http.StatusBadRequest, &installResp)
+
+	// Submit same results as before, which should not trigger a installation because the policy is already failing.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host1Team1,
+		map[uint]*bool{
+			policy1Team1.ID: ptr.Bool(false),
+			policy2Team1.ID: ptr.Bool(false),
+			policy3Team1.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+
+	host1LastInstall, err = s.ds.GetHostLastInstallData(ctx, host1Team1.ID, dummyInstallerPkgInstallerID)
+	require.NoError(t, err)
+	require.NotNil(t, host1LastInstall)
+	require.Equal(t, prevExecutionID, host1LastInstall.ExecutionID)
+	require.NotNil(t, host1LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallerPending, *host1LastInstall.Status)
+
+	// Submit same results but policy1Team1 now passes,
+	// and then submit again but policy1Team1 fails.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host1Team1,
+		map[uint]*bool{
+			policy1Team1.ID: ptr.Bool(true),
+			policy2Team1.ID: ptr.Bool(false),
+			policy3Team1.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host1Team1,
+		map[uint]*bool{
+			policy1Team1.ID: ptr.Bool(false),
+			policy2Team1.ID: ptr.Bool(false),
+			policy3Team1.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+
+	// Another installation should not be triggered because the last installation is pending.
+	host1LastInstall, err = s.ds.GetHostLastInstallData(ctx, host1Team1.ID, dummyInstallerPkgInstallerID)
+	require.NoError(t, err)
+	require.NotNil(t, host1LastInstall)
+	require.Equal(t, prevExecutionID, host1LastInstall.ExecutionID)
+	require.NotNil(t, host1LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallerPending, *host1LastInstall.Status)
+
+	// host2Team1 is failing policy2Team1 and policy3Team1 policies.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host2Team1,
+		map[uint]*bool{
+			policy2Team1.ID: ptr.Bool(false),
+			policy3Team1.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+
+	host2LastInstall, err := s.ds.GetHostLastInstallData(ctx, host2Team1.ID, rubyDebInstallerID)
+	require.NoError(t, err)
+	require.NotNil(t, host2LastInstall)
+	require.NotEmpty(t, host2LastInstall.ExecutionID)
+	require.NotNil(t, host2LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallerPending, *host2LastInstall.Status)
+
+	// Associate fleet-osquery.msi to policy4Team2.
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team2.ID, policy4Team2.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: &fleetOsqueryMSITitleID,
+		},
+	}, http.StatusOK, &mtplr)
+
+	// host3Team2 reports a failing result for policy4Team2, which should trigger an installation.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host3Team2,
+		map[uint]*bool{
+			policy4Team2.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+
+	host3LastInstall, err := s.ds.GetHostLastInstallData(ctx, host3Team2.ID, fleetOsqueryMSIInstallerID)
+	require.NoError(t, err)
+	require.NotNil(t, host3LastInstall)
+	require.NotEmpty(t, host3LastInstall.ExecutionID)
+	require.NotNil(t, host3LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallerPending, *host3LastInstall.Status)
+	host3LastInstallDetails, err := s.ds.GetSoftwareInstallDetails(ctx, host3LastInstall.ExecutionID)
+	require.NoError(t, err)
+	// Even if fleet-osquery.msi was uploaded as Self-service, it was installed by Fleet, so
+	// host3LastInstallDetails.SelfService should be false.
+	require.False(t, host3LastInstallDetails.SelfService)
+
+	//
+	// The following increase coverage of policies result processing in distributed/write.
+	//
+
+	// host3Team2 reports a passing result for policy0AllTeams which is a global policy.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host3Team2,
+		map[uint]*bool{
+			policy0AllTeams.ID: ptr.Bool(true),
+		},
+	), http.StatusOK, &distributedResp)
+
+	// host0NoTeam reports a failing result for policy0AllTeams which is a global policy.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host0NoTeam,
+		map[uint]*bool{
+			policy0AllTeams.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+
+	// host3Team2 reports a failing result for policy0AllTeams which is a global policy.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host3Team2,
+		map[uint]*bool{
+			policy0AllTeams.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+
+	// Unassociate policy4Team2 from installer.
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team2.ID, policy4Team2.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: ptr.Uint(0),
+		},
+	}, http.StatusOK, &mtplr)
+
+	// host3Team2 reports a failing result for policy4Team2.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host3Team2,
+		map[uint]*bool{
+			policy4Team2.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+
+	// Upcoming activities for host1Team1 should show the automatic installation of dummy_installer.pkg.
+	// Check the author should be the admin that uploaded the installer.
+	var listUpcomingAct listHostUpcomingActivitiesResponse
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/activities/upcoming", host1Team1.ID), nil, http.StatusOK, &listUpcomingAct)
+	require.Len(t, listUpcomingAct.Activities, 1)
+	require.NotNil(t, listUpcomingAct.Activities[0].ActorID)
+	require.Equal(t, globalAdmin.ID, *listUpcomingAct.Activities[0].ActorID)
+	require.Equal(t, globalAdmin.Name, *listUpcomingAct.Activities[0].ActorFullName)
+	require.Equal(t, globalAdmin.Email, *listUpcomingAct.Activities[0].ActorEmail)
+
+	//
+	// Finally have orbit install the packages and check activities.
+	//
+
+	// host1Team1 posts the installation result for dummy_installer.pkg.
+	s.Do("POST", "/api/fleet/orbit/software_install/result", json.RawMessage(fmt.Sprintf(`{
+			"orbit_node_key": %q,
+			"install_uuid": %q,
+			"pre_install_condition_output": "ok",
+			"install_script_exit_code": 0,
+			"install_script_output": "ok"
+		}`, *host1Team1.OrbitNodeKey, host1LastInstall.ExecutionID)), http.StatusNoContent)
+	s.lastActivityMatches(fleet.ActivityTypeInstalledSoftware{}.ActivityName(), fmt.Sprintf(`{
+		"host_id": %d,
+		"host_display_name": "%s",
+		"software_title": "%s",
+		"software_package": "%s",
+		"self_service": false,
+		"install_uuid": "%s",
+		"status": "installed"
+	}`, host1Team1.ID, host1Team1.DisplayName(), "DummyApp.app", "dummy_installer.pkg", host1LastInstall.ExecutionID), 0)
+
+	// host2Team1 posts the installation result for ruby.deb.
+	s.Do("POST", "/api/fleet/orbit/software_install/result", json.RawMessage(fmt.Sprintf(`{
+			"orbit_node_key": %q,
+			"install_uuid": %q,
+			"pre_install_condition_output": "ok",
+			"install_script_exit_code": 1,
+			"install_script_output": "failed"
+		}`, *host2Team1.OrbitNodeKey, host2LastInstall.ExecutionID)), http.StatusNoContent)
+	activityID := s.lastActivityMatches(fleet.ActivityTypeInstalledSoftware{}.ActivityName(), fmt.Sprintf(`{
+		"host_id": %d,
+		"host_display_name": "%s",
+		"software_title": "%s",
+		"software_package": "%s",
+		"self_service": false,
+		"install_uuid": "%s",
+		"status": "failed"
+	}`, host2Team1.ID, host2Team1.DisplayName(), "ruby", "ruby.deb", host2LastInstall.ExecutionID), 0)
+
+	// Check that the activity item generated for ruby.deb installation has a null user,
+	// but has name and email set.
+	var actor struct {
+		UserID    *uint   `db:"user_id"`
+		UserName  *string `db:"user_name"`
+		UserEmail string  `db:"user_email"`
+	}
+	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(ctx, q,
+			&actor,
+			`SELECT user_id, user_name, user_email FROM activities WHERE id = ?`,
+			activityID,
+		)
+	})
+	require.Nil(t, actor.UserID)
+	require.NotNil(t, actor.UserName)
+	require.Equal(t, "admin team1", *actor.UserName)
+	require.Equal(t, "admin_team1@example.com", actor.UserEmail)
+
+	// host3Team2 posts the installation result for fleet-osquery.msi.
+	s.Do("POST", "/api/fleet/orbit/software_install/result", json.RawMessage(fmt.Sprintf(`{
+			"orbit_node_key": %q,
+			"install_uuid": %q,
+			"pre_install_condition_output": "ok",
+			"install_script_exit_code": 1,
+			"install_script_output": "failed"
+		}`, *host3Team2.OrbitNodeKey, host3LastInstall.ExecutionID)), http.StatusNoContent)
+	activityID = s.lastActivityMatches(fleet.ActivityTypeInstalledSoftware{}.ActivityName(), fmt.Sprintf(`{
+		"host_id": %d,
+		"host_display_name": "%s",
+		"software_title": "%s",
+		"software_package": "%s",
+		"self_service": false,
+		"install_uuid": "%s",
+		"status": "failed"
+	}`, host3Team2.ID, host3Team2.DisplayName(), "Fleet osquery", "fleet-osquery.msi", host3LastInstall.ExecutionID), 0)
+
+	// Check that the activity item generated for fleet-osquery.msi installation has the admin user set as author.
+	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(ctx, q,
+			&actor,
+			`SELECT user_id, user_name, user_email FROM activities WHERE id = ?`,
+			activityID,
+		)
+	})
+	require.NotNil(t, actor.UserID)
+	require.Equal(t, globalAdmin.ID, *actor.UserID)
+	require.NotNil(t, actor.UserName)
+	require.Equal(t, "Test Name admin1@example.com", *actor.UserName)
+	require.Equal(t, "admin1@example.com", actor.UserEmail)
+
+	// hostVanillaOsquery5Team1 sends policy results with failed policies with associated installers.
+	// Fleet should not queue an install for vanilla osquery hosts.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		hostVanillaOsquery5Team1,
+		map[uint]*bool{
+			policy1Team1.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+	hostVanillaOsquery5Team1LastInstall, err := s.ds.GetHostLastInstallData(ctx, hostVanillaOsquery5Team1.ID, dummyInstallerPkgInstallerID)
+	require.NoError(t, err)
+	require.Nil(t, hostVanillaOsquery5Team1LastInstall)
 }
diff --git a/server/service/integration_live_queries_test.go b/server/service/integration_live_queries_test.go
index b5ba57ae68cc..7d3cfef7f1c8 100644
--- a/server/service/integration_live_queries_test.go
+++ b/server/service/integration_live_queries_test.go
@@ -31,7 +31,7 @@ import (
 	"github.com/stretchr/testify/suite"
 )
 
-func TestIntegrationLiveQueriesTestSuite(t *testing.T) {
+func TestIntegrationsLiveQueriesTestSuite(t *testing.T) {
 	testingSuite := new(liveQueriesTestSuite)
 	testingSuite.withServer.s = &testingSuite.Suite
 	suite.Run(t, testingSuite)
diff --git a/server/service/integration_logger_test.go b/server/service/integration_logger_test.go
index 8831d2e3041e..6a6f7be93147 100644
--- a/server/service/integration_logger_test.go
+++ b/server/service/integration_logger_test.go
@@ -22,9 +22,9 @@ import (
 	"github.com/stretchr/testify/suite"
 )
 
-func TestIntegrationLoggerTestSuite(t *testing.T) {
+func TestIntegrationsLoggerTestSuite(t *testing.T) {
 	testingSuite := new(integrationLoggerTestSuite)
-	testingSuite.s = &testingSuite.Suite
+	testingSuite.withDS.s = &testingSuite.Suite
 	suite.Run(t, testingSuite)
 }
 
diff --git a/server/service/integration_mdm_dep_test.go b/server/service/integration_mdm_dep_test.go
index 62a77508d17c..fca30a229e75 100644
--- a/server/service/integration_mdm_dep_test.go
+++ b/server/service/integration_mdm_dep_test.go
@@ -91,6 +91,10 @@ func (s *integrationMDMTestSuite) TestDEPEnrollReleaseDeviceGlobal() {
 	globalProfile := mobileconfigForTest("N1", "I1")
 	s.Do("POST", "/api/v1/fleet/mdm/apple/profiles/batch", batchSetMDMAppleProfilesRequest{Profiles: [][]byte{globalProfile}}, http.StatusNoContent)
 
+	// enable FileVault
+	s.Do("PATCH", "/api/latest/fleet/config", json.RawMessage([]byte(`{"mdm":{"macos_settings":{"enable_disk_encryption":true}}}`)), http.StatusOK)
+
+	s.enableABM("fleet_ade_test")
 	for _, enableReleaseManually := range []bool{false, true} {
 		t.Run(fmt.Sprintf("enableReleaseManually=%t", enableReleaseManually), func(t *testing.T) {
 			s.runDEPEnrollReleaseDeviceTest(t, globalDevice, enableReleaseManually, nil, "I1")
@@ -134,9 +138,15 @@ func (s *integrationMDMTestSuite) TestDEPEnrollReleaseDeviceTeam() {
 
 	// setup IdP so that AccountConfiguration profile is sent after DEP enrollment
 	var acResp appConfigResponse
+	s.enableABM("fleet_ade_test")
 	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(fmt.Sprintf(`{
 			"mdm": {
-				"apple_bm_default_team": %q,
+			       "apple_business_manager": [{
+			         "organization_name": %q,
+			         "macos_team": %q,
+			         "ios_team": %q,
+			         "ipados_team": %q
+			       }],
 				"end_user_authentication": {
 					"entity_id": "https://localhost:8080",
 					"issuer_uri": "http://localhost:8080/simplesaml/saml2/idp/SSOService.php",
@@ -147,7 +157,7 @@ func (s *integrationMDMTestSuite) TestDEPEnrollReleaseDeviceTeam() {
 					"enable_end_user_authentication": true
 				}
 			}
-		}`, tm.Name)), http.StatusOK, &acResp)
+		}`, "fleet_ade_test", tm.Name, tm.Name, tm.Name)), http.StatusOK, &acResp)
 	require.NotEmpty(t, acResp.MDM.EndUserAuthentication)
 
 	// TODO(mna): how/where to pass an enroll_reference so that
@@ -157,6 +167,9 @@ func (s *integrationMDMTestSuite) TestDEPEnrollReleaseDeviceTeam() {
 	teamProfile := mobileconfigForTest("N2", "I2")
 	s.Do("POST", "/api/v1/fleet/mdm/apple/profiles/batch", batchSetMDMAppleProfilesRequest{Profiles: [][]byte{teamProfile}}, http.StatusNoContent, "team_id", fmt.Sprint(tm.ID))
 
+	// enable FileVault
+	s.Do("PATCH", "/api/latest/fleet/mdm/apple/settings", json.RawMessage([]byte(fmt.Sprintf(`{"enable_disk_encryption":true,"team_id":%d}`, tm.ID))), http.StatusNoContent)
+
 	for _, enableReleaseManually := range []bool{false, true} {
 		t.Run(fmt.Sprintf("enableReleaseManually=%t", enableReleaseManually), func(t *testing.T) {
 			s.runDEPEnrollReleaseDeviceTest(t, teamDevice, enableReleaseManually, &tm.ID, "I2")
@@ -185,7 +198,7 @@ func (s *integrationMDMTestSuite) runDEPEnrollReleaseDeviceTest(t *testing.T, de
 		return map[string]*push.Response{}, nil
 	}
 
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.mockDEPResponse("fleet_ade_test", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		encoder := json.NewEncoder(w)
 		switch r.URL.Path {
 		case "/session":
@@ -252,32 +265,35 @@ func (s *integrationMDMTestSuite) runDEPEnrollReleaseDeviceTest(t *testing.T, de
 	cmd, err := mdmDevice.Idle()
 	require.NoError(t, err)
 	for cmd != nil {
-		// Can be useful for debugging
-		//switch cmd.Command.RequestType {
-		//case "InstallProfile":
-		//	fmt.Println(">>>> device received command: ", cmd.CommandUUID, cmd.Command.RequestType, string(cmd.Command.InstallProfile.Payload))
-		//case "InstallEnterpriseApplication":
-		//	if cmd.Command.InstallEnterpriseApplication.ManifestURL != nil {
-		//		fmt.Println(">>>> device received command: ", cmd.CommandUUID, cmd.Command.RequestType, *cmd.Command.InstallEnterpriseApplication.ManifestURL)
-		//	} else {
-		//		fmt.Println(">>>> device received command: ", cmd.CommandUUID, cmd.Command.RequestType)
-		//	}
-		//default:
-		//	fmt.Println(">>>> device received command: ", cmd.CommandUUID, cmd.Command.RequestType)
-		//}
+
 		var fullCmd micromdm.CommandPayload
 		require.NoError(t, plist.Unmarshal(cmd.Raw, &fullCmd))
+
+		// Can be useful for debugging
+		// switch cmd.Command.RequestType {
+		// case "InstallProfile":
+		// 	fmt.Println(">>>> device received command: ", cmd.CommandUUID, cmd.Command.RequestType, string(fullCmd.Command.InstallProfile.Payload))
+		// case "InstallEnterpriseApplication":
+		// 	if fullCmd.Command.InstallEnterpriseApplication.ManifestURL != nil {
+		// 		fmt.Println(">>>> device received command: ", cmd.CommandUUID, cmd.Command.RequestType, *fullCmd.Command.InstallEnterpriseApplication.ManifestURL)
+		// 	} else {
+		// 		fmt.Println(">>>> device received command: ", cmd.CommandUUID, cmd.Command.RequestType)
+		// 	}
+		// default:
+		// 	fmt.Println(">>>> device received command: ", cmd.CommandUUID, cmd.Command.RequestType)
+		// }
+
 		cmds = append(cmds, &fullCmd)
 		cmd, err = mdmDevice.Acknowledge(cmd.CommandUUID)
 		require.NoError(t, err)
 	}
 
 	// expected commands: install fleetd, install bootstrap, install CA, install profiles
-	// (custom one and fleetd configuration) (not expected: account
+	// (custom one, fleetd configuration, FileVault) (not expected: account
 	// configuration, since enrollment_reference not set)
-	require.Len(t, cmds, 5)
+	require.Len(t, cmds, 6)
 	var installProfileCount, installEnterpriseCount, otherCount int
-	var profileCustomSeen, profileFleetdSeen, profileFleetCASeen bool
+	var profileCustomSeen, profileFleetdSeen, profileFleetCASeen, profileFileVaultSeen bool
 	for _, cmd := range cmds {
 		switch cmd.Command.RequestType {
 		case "InstallProfile":
@@ -288,6 +304,9 @@ func (s *integrationMDMTestSuite) runDEPEnrollReleaseDeviceTest(t *testing.T, de
 				profileFleetdSeen = true
 			} else if strings.Contains(string(cmd.Command.InstallProfile.Payload), fmt.Sprintf("<string>%s</string>", mobileconfig.FleetCARootConfigPayloadIdentifier)) {
 				profileFleetCASeen = true
+			} else if strings.Contains(string(cmd.Command.InstallProfile.Payload), fmt.Sprintf("<string>%s</string", mobileconfig.FleetFileVaultPayloadIdentifier)) &&
+				strings.Contains(string(cmd.Command.InstallProfile.Payload), "ForceEnableInSetupAssistant") {
+				profileFileVaultSeen = true
 			}
 
 		case "InstallEnterpriseApplication":
@@ -296,12 +315,13 @@ func (s *integrationMDMTestSuite) runDEPEnrollReleaseDeviceTest(t *testing.T, de
 			otherCount++
 		}
 	}
-	require.Equal(t, 3, installProfileCount)
+	require.Equal(t, 4, installProfileCount)
 	require.Equal(t, 2, installEnterpriseCount)
 	require.Equal(t, 0, otherCount)
 	require.True(t, profileCustomSeen)
 	require.True(t, profileFleetdSeen)
 	require.True(t, profileFleetCASeen)
+	require.True(t, profileFileVaultSeen)
 
 	if enableReleaseManually {
 		// get the worker's pending job from the future, there should not be any
@@ -524,7 +544,9 @@ func (s *integrationMDMTestSuite) TestDEPProfileAssignment() {
 
 	expectAssignProfileResponseFailed := ""        // set to device serial when testing the failed profile assignment flow
 	expectAssignProfileResponseNotAccessible := "" // set to device serial when testing the not accessible profile assignment flow
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+
+	s.enableABM(t.Name())
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		encoder := json.NewEncoder(w)
 		switch r.URL.Path {
@@ -906,6 +928,7 @@ func (s *integrationMDMTestSuite) TestDEPProfileAssignment() {
 		addHostsToTeamRequest{TeamID: &dummyTeam.ID, HostIDs: []uint{eHost.ID}}, http.StatusOK)
 	checkPendingMacOSSetupAssistantJob("hosts_transferred", &dummyTeam.ID, []string{eHost.HardwareSerial}, 0)
 
+	s.runWorker()
 	// expect no assign profile request during cooldown
 	profileAssignmentReqs = []profileAssignmentReq{}
 	s.runIntegrationsSchedule()
@@ -972,7 +995,7 @@ func (s *integrationMDMTestSuite) TestDEPProfileAssignment() {
 	checkPendingMacOSSetupAssistantJob("hosts_cooldown", nil, []string{eHost.HardwareSerial}, jobID)
 	checkListHostDEPError(eHost.HardwareSerial, "On (automatic)", true)
 
-	// run the inregration schedule and expect success
+	// run the integration schedule and expect success
 	expectAssignProfileResponseFailed = ""
 	profileAssignmentReqs = []profileAssignmentReq{}
 	s.runIntegrationsSchedule()
@@ -1108,3 +1131,53 @@ func (s *integrationMDMTestSuite) TestDEPProfileAssignment() {
 	s.runDEPSchedule()
 	require.Empty(t, profileAssignmentReqs)
 }
+
+func (s *integrationMDMTestSuite) TestDeprecatedDefaultAppleBMTeam() {
+	t := s.T()
+
+	s.enableABM(t.Name())
+
+	tm, err := s.ds.NewTeam(context.Background(), &fleet.Team{
+		Name:        t.Name(),
+		Description: "desc",
+	})
+	require.NoError(s.T(), err)
+
+	var acResp appConfigResponse
+
+	defer func() {
+		acResp = appConfigResponse{}
+		s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
+		    "mdm": {
+			    "apple_bm_default_team": ""
+		    }
+		}`), http.StatusOK, &acResp)
+		require.Empty(t, acResp.MDM.DeprecatedAppleBMDefaultTeam)
+	}()
+
+	// try to set an invalid team name
+	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
+		"mdm": {
+			"apple_bm_default_team": "xyz"
+		}
+	}`), http.StatusUnprocessableEntity, &acResp)
+
+	// get the appconfig, nothing changed
+	acResp = appConfigResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/config", nil, http.StatusOK, &acResp)
+	require.Empty(t, acResp.MDM.DeprecatedAppleBMDefaultTeam)
+
+	// set to a valid team name
+	acResp = appConfigResponse{}
+	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(fmt.Sprintf(`{
+		"mdm": {
+			"apple_bm_default_team": %q
+		}
+	}`, tm.Name)), http.StatusOK, &acResp)
+	require.Equal(t, tm.Name, acResp.MDM.DeprecatedAppleBMDefaultTeam)
+
+	// get the appconfig, set to that team name
+	acResp = appConfigResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/config", nil, http.StatusOK, &acResp)
+	require.Equal(t, tm.Name, acResp.MDM.DeprecatedAppleBMDefaultTeam)
+}
diff --git a/server/service/integration_mdm_lifecycle_test.go b/server/service/integration_mdm_lifecycle_test.go
index 5dce43108d72..b487cd1db3ec 100644
--- a/server/service/integration_mdm_lifecycle_test.go
+++ b/server/service/integration_mdm_lifecycle_test.go
@@ -3,6 +3,7 @@ package service
 import (
 	"context"
 	"crypto/x509"
+	"encoding/base64"
 	"encoding/json"
 	"encoding/xml"
 	"fmt"
@@ -226,7 +227,8 @@ func (s *integrationMDMTestSuite) TestTurnOnLifecycleEventsApple() {
 
 			t.Run("automatic enrollment", func(t *testing.T) {
 				device := mdmtest.NewTestMDMClientAppleDEP(s.server.URL, "")
-				s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				s.enableABM(t.Name())
+				s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 					w.WriteHeader(http.StatusOK)
 					encoder := json.NewEncoder(w)
 					switch r.URL.Path {
@@ -590,10 +592,7 @@ func (s *integrationMDMTestSuite) TestLifecycleSCEPCertExpiration() {
 	t := s.T()
 	ctx := context.Background()
 	// ensure there's a token for automatic enrollments
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte(`{"auth_session_token": "xyz"}`))
-	}))
+	s.enableABM(t.Name())
 	s.runDEPSchedule()
 
 	// add a device that's manually enrolled
@@ -772,7 +771,7 @@ func (s *integrationMDMTestSuite) TestLifecycleSCEPCertExpiration() {
 	require.NoError(t, err)
 
 	// set the env var, and run the cron
-	t.Setenv("FLEET_SILENT_MIGRATION_ENROLLMENT_PROFILE", "<foo></foo>")
+	t.Setenv("FLEET_SILENT_MIGRATION_ENROLLMENT_PROFILE", base64.StdEncoding.EncodeToString([]byte("<foo></foo>")))
 	err = RenewSCEPCertificates(ctx, logger, s.ds, &fleetCfg, s.mdmCommander)
 	require.NoError(t, err)
 	checkRenewCertCommand(migratedDevice, "", "<foo></foo>")
diff --git a/server/service/integration_mdm_profiles_test.go b/server/service/integration_mdm_profiles_test.go
index 2b1a9f0dce1f..c60d0580e29d 100644
--- a/server/service/integration_mdm_profiles_test.go
+++ b/server/service/integration_mdm_profiles_test.go
@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"sort"
 	"strconv"
 	"strings"
@@ -364,7 +365,7 @@ func (s *integrationMDMTestSuite) TestAppleProfileManagement() {
 	}`), http.StatusOK)
 	s.Do("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", tm.ID), fleet.TeamPayload{
 		MDM: &fleet.TeamPayloadMDM{
-			MacOSUpdates: &fleet.MacOSUpdates{
+			MacOSUpdates: &fleet.AppleOSUpdateSettings{
 				Deadline:       optjson.SetString("1992-01-01"),
 				MinimumVersion: optjson.SetString("13.1.1"),
 			},
@@ -949,6 +950,9 @@ func (s *integrationMDMTestSuite) TestPuppetMatchPreassignProfiles() {
 	ctx := context.Background()
 	t := s.T()
 
+	// before we switch to a gitops token, ensure ABM is setup
+	s.enableABM(t.Name())
+
 	// Use a gitops user for all Puppet actions
 	u := &fleet.User{
 		Name:       "GitOps",
@@ -982,7 +986,7 @@ func (s *integrationMDMTestSuite) TestPuppetMatchPreassignProfiles() {
 	// create a setup assistant for no team, for this we need to:
 	// 1. mock the ABM API, as it gets called to set the profile
 	// 2. run the DEP schedule, as this registers the default profile
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		_, _ = w.Write([]byte(`{"auth_session_token": "xyz"}`))
 	}))
@@ -2865,28 +2869,33 @@ func (s *integrationMDMTestSuite) TestMDMConfigProfileCRUD() {
 		{ProfileUUID: teamAppleProfUUID, Platform: "darwin", Name: "apple-team-profile", Identifier: "test-team-ident", TeamID: &testTeam.ID},
 		{ProfileUUID: noTeamWinProfUUID, Platform: "windows", Name: "win-global-profile", TeamID: nil},
 		{ProfileUUID: teamWinProfUUID, Platform: "windows", Name: "win-team-profile", TeamID: &testTeam.ID},
-		{ProfileUUID: uuidAppleDDMWithLabel, Platform: "darwin", Name: "apple-decl-with-labels", Identifier: "ident-decl-with-labels", TeamID: nil,
+		{
+			ProfileUUID: uuidAppleDDMWithLabel, Platform: "darwin", Name: "apple-decl-with-labels", Identifier: "ident-decl-with-labels", TeamID: nil,
 			LabelsIncludeAll: []fleet.ConfigurationProfileLabel{
 				{LabelID: labelFoo.ID, LabelName: labelFoo.Name},
 			},
 		},
-		{ProfileUUID: uuidAppleWithLabel, Platform: "darwin", Name: "apple-profile-with-labels", Identifier: "ident-with-labels", TeamID: nil,
+		{
+			ProfileUUID: uuidAppleWithLabel, Platform: "darwin", Name: "apple-profile-with-labels", Identifier: "ident-with-labels", TeamID: nil,
 			LabelsIncludeAll: []fleet.ConfigurationProfileLabel{
 				{LabelID: labelFoo.ID, LabelName: labelFoo.Name},
 			},
 		},
-		{ProfileUUID: uuidWindowsWithLabel, Platform: "windows", Name: "win-profile-with-labels", TeamID: nil,
+		{
+			ProfileUUID: uuidWindowsWithLabel, Platform: "windows", Name: "win-profile-with-labels", TeamID: nil,
 			LabelsExcludeAny: []fleet.ConfigurationProfileLabel{
 				{LabelID: labelBar.ID, LabelName: labelBar.Name},
 				{LabelID: labelFoo.ID, LabelName: labelFoo.Name},
 			},
 		},
-		{ProfileUUID: uuidAppleDDMTeamWithLabel, Platform: "darwin", Name: "apple-team-decl-with-labels", Identifier: "ident-team-decl-with-labels", TeamID: &testTeam.ID,
+		{
+			ProfileUUID: uuidAppleDDMTeamWithLabel, Platform: "darwin", Name: "apple-team-decl-with-labels", Identifier: "ident-team-decl-with-labels", TeamID: &testTeam.ID,
 			LabelsExcludeAny: []fleet.ConfigurationProfileLabel{
 				{LabelID: labelFoo.ID, LabelName: labelFoo.Name},
 			},
 		},
-		{ProfileUUID: uuidWindowsTeamWithLabel, Platform: "windows", Name: "win-team-profile-with-labels", TeamID: &testTeam.ID,
+		{
+			ProfileUUID: uuidWindowsTeamWithLabel, Platform: "windows", Name: "win-team-profile-with-labels", TeamID: &testTeam.ID,
 			LabelsIncludeAll: []fleet.ConfigurationProfileLabel{
 				{LabelID: labelBar.ID, LabelName: labelBar.Name},
 				{LabelID: labelFoo.ID, LabelName: labelFoo.Name},
@@ -3774,17 +3783,18 @@ func (s *integrationMDMTestSuite) TestBatchSetMDMProfiles() {
 
 	// apply an empty set to no-team
 	s.Do("POST", "/api/v1/fleet/mdm/profiles/batch", batchSetMDMProfilesRequest{Profiles: nil}, http.StatusNoContent)
-	s.lastActivityOfTypeMatches(
+	// Nothing changed, so no activity items
+	s.lastActivityOfTypeDoesNotMatch(
 		fleet.ActivityTypeEditedMacosProfile{}.ActivityName(),
 		`{"team_id": null, "team_name": null}`,
 		0,
 	)
-	s.lastActivityOfTypeMatches(
+	s.lastActivityOfTypeDoesNotMatch(
 		fleet.ActivityTypeEditedWindowsProfile{}.ActivityName(),
 		`{"team_id": null, "team_name": null}`,
 		0,
 	)
-	s.lastActivityOfTypeMatches(
+	s.lastActivityOfTypeDoesNotMatch(
 		fleet.ActivityTypeEditedDeclarationProfile{}.ActivityName(),
 		`{"team_id": null, "team_name": null}`,
 		0,
@@ -4054,12 +4064,13 @@ func (s *integrationMDMTestSuite) TestBatchSetMDMProfilesBackwardsCompat() {
 
 	// apply an empty set to no-team
 	s.Do("POST", "/api/v1/fleet/mdm/profiles/batch", map[string]any{"profiles": nil}, http.StatusNoContent)
-	s.lastActivityOfTypeMatches(
+	// Nothing changed, so no activity
+	s.lastActivityOfTypeDoesNotMatch(
 		fleet.ActivityTypeEditedMacosProfile{}.ActivityName(),
 		`{"team_id": null, "team_name": null}`,
 		0,
 	)
-	s.lastActivityOfTypeMatches(
+	s.lastActivityOfTypeDoesNotMatch(
 		fleet.ActivityTypeEditedWindowsProfile{}.ActivityName(),
 		`{"team_id": null, "team_name": null}`,
 		0,
@@ -4282,7 +4293,7 @@ func (s *integrationMDMTestSuite) TestMDMBatchSetProfilesKeepsReservedNames() {
 					DeadlineDays:    optjson.SetInt(4),
 					GracePeriodDays: optjson.SetInt(1),
 				},
-				MacOSUpdates: &fleet.MacOSUpdates{
+				MacOSUpdates: &fleet.AppleOSUpdateSettings{
 					Deadline:       optjson.SetString("2023-12-31"),
 					MinimumVersion: optjson.SetString("13.3.8"),
 				},
@@ -4805,3 +4816,36 @@ func (s *integrationMDMTestSuite) TestHostMDMProfilesExcludeLabels() {
 		},
 	})
 }
+
+func (s *integrationMDMTestSuite) TestOTAProfile() {
+	t := s.T()
+	ctx := context.Background()
+
+	// Getting profile for non-existent secret it's ok
+	s.Do("GET", "/api/latest/fleet/enrollment_profiles/ota", getOTAProfileRequest{}, http.StatusOK, "enroll_secret", "not-real")
+
+	// Create an enroll secret; has some special characters that should be escaped in the profile
+	globalEnrollSec := "global_enroll+_/sec"
+	escSec := url.QueryEscape(globalEnrollSec)
+	s.Do("POST", "/api/latest/fleet/spec/enroll_secret", applyEnrollSecretSpecRequest{
+		Spec: &fleet.EnrollSecretSpec{
+			Secrets: []*fleet.EnrollSecret{{Secret: globalEnrollSec}},
+		},
+	}, http.StatusOK)
+
+	cfg, err := s.ds.AppConfig(ctx)
+	require.NoError(t, err)
+
+	// Get profile with that enroll secret
+	resp := s.Do("GET", "/api/latest/fleet/enrollment_profiles/ota", getOTAProfileRequest{}, http.StatusOK, "enroll_secret", globalEnrollSec)
+	require.NotZero(t, resp.ContentLength)
+	require.Contains(t, resp.Header.Get("Content-Disposition"), `attachment;filename="fleet-mdm-enrollment-profile.mobileconfig"`)
+	require.Contains(t, resp.Header.Get("Content-Type"), "application/x-apple-aspen-config")
+	require.Contains(t, resp.Header.Get("X-Content-Type-Options"), "nosniff")
+	b, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.Equal(t, resp.ContentLength, int64(len(b)))
+	require.Contains(t, string(b), "com.fleetdm.fleet.mdm.apple.ota")
+	require.Contains(t, string(b), fmt.Sprintf("%s/api/v1/fleet/ota_enrollment?enroll_secret=%s", cfg.ServerSettings.ServerURL, escSec))
+	require.Contains(t, string(b), cfg.OrgInfo.OrgName)
+}
diff --git a/server/service/integration_mdm_test.go b/server/service/integration_mdm_test.go
index d17d3f47bcaf..63ab882da18f 100644
--- a/server/service/integration_mdm_test.go
+++ b/server/service/integration_mdm_test.go
@@ -39,11 +39,13 @@ import (
 	"github.com/fleetdm/fleet/v4/server/config"
 	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
 	"github.com/fleetdm/fleet/v4/server/datastore/redis/redistest"
+	"github.com/fleetdm/fleet/v4/server/datastore/s3"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/live_query/live_query_mock"
 	servermdm "github.com/fleetdm/fleet/v4/server/mdm"
 	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
 	"github.com/fleetdm/fleet/v4/server/mdm/apple/mobileconfig"
+	"github.com/fleetdm/fleet/v4/server/mdm/apple/vpp"
 	microsoft_mdm "github.com/fleetdm/fleet/v4/server/mdm/microsoft"
 	"github.com/fleetdm/fleet/v4/server/mdm/microsoft/syncml"
 	nanodep_client "github.com/fleetdm/fleet/v4/server/mdm/nanodep/client"
@@ -83,20 +85,29 @@ type integrationMDMTestSuite struct {
 	fleetDMNextCSRStatus       atomic.Value
 	pushProvider               *mock.APNSPushProvider
 	depStorage                 nanodep_storage.AllDEPStorage
-	depSchedule                *schedule.Schedule
 	profileSchedule            *schedule.Schedule
 	integrationsSchedule       *schedule.Schedule
 	onProfileJobDone           func() // function called when profileSchedule.Trigger() job completed
-	onDEPScheduleDone          func() // function called when depSchedule.Trigger() job completed
 	onIntegrationsScheduleDone func() // function called when integrationsSchedule.Trigger() job completed
 	mdmStorage                 *mysql.NanoMDMStorage
 	worker                     *worker.Worker
 	mdmCommander               *apple_mdm.MDMAppleCommander
 	logger                     kitlog.Logger
 	scepChallenge              string
+	appleVPPConfigSrv          *httptest.Server
+	appleVPPConfigSrvConfig    *appleVPPConfigSrvConf
+	appleITunesSrv             *httptest.Server
+	appleGDMFSrv               *httptest.Server
 	mockedDownloadFleetdmMeta  fleetdbase.Metadata
 }
 
+// appleVPPConfigSrvConf is used to configure the mock server that mocks Apple's VPP endpoints.
+type appleVPPConfigSrvConf struct {
+	Assets        []vpp.Asset
+	SerialNumbers []string
+	Location      string
+}
+
 func (s *integrationMDMTestSuite) SetupSuite() {
 	s.withDS.SetupSuite("integrationMDMTestSuite")
 
@@ -164,7 +175,6 @@ func (s *integrationMDMTestSuite) SetupSuite() {
 		return err
 	})
 
-	var depSchedule *schedule.Schedule
 	var integrationsSchedule *schedule.Schedule
 	var profileSchedule *schedule.Schedule
 	cronLog := kitlog.NewJSONLogger(os.Stdout)
@@ -175,39 +185,33 @@ func (s *integrationMDMTestSuite) SetupSuite() {
 	if os.Getenv("FLEET_INTEGRATION_TESTS_DISABLE_LOG") != "" {
 		serverLogger = kitlog.NewNopLogger()
 	}
+
+	var softwareInstallerStore fleet.SoftwareInstallerStore
+	var bootstrapPackageStore fleet.MDMBootstrapPackageStore
+	_, minioEnabled := os.LookupEnv("MINIO_STORAGE_TEST")
+	if wantStore := os.Getenv("FLEET_INTEGRATION_TESTS_SOFTWARE_INSTALLER_STORE"); minioEnabled &&
+		(wantStore == "s3" || (wantStore == "" && time.Now().UnixNano()%2 == 0)) {
+
+		s.T().Log(">>> using S3/minio software installer store")
+		softwareInstallerStore = s3.SetupTestSoftwareInstallerStore(s.T(), "integration-tests", "")
+		bootstrapPackageStore = s3.SetupTestBootstrapPackageStore(s.T(), "integration-tests", "")
+	}
+
 	config := TestServerOpts{
 		License: &fleet.LicenseInfo{
 			Tier: fleet.TierPremium,
 		},
-		Logger:      serverLogger,
-		FleetConfig: &fleetCfg,
-		MDMStorage:  mdmStorage,
-		DEPStorage:  depStorage,
-		SCEPStorage: scepStorage,
-		MDMPusher:   mdmPushService,
-		Pool:        redisPool,
-		Lq:          s.lq,
+		Logger:                serverLogger,
+		FleetConfig:           &fleetCfg,
+		MDMStorage:            mdmStorage,
+		DEPStorage:            depStorage,
+		SCEPStorage:           scepStorage,
+		MDMPusher:             mdmPushService,
+		Pool:                  redisPool,
+		Lq:                    s.lq,
+		SoftwareInstallStore:  softwareInstallerStore,
+		BootstrapPackageStore: bootstrapPackageStore,
 		StartCronSchedules: []TestNewScheduleFunc{
-			func(ctx context.Context, ds fleet.Datastore) fleet.NewCronScheduleFunc {
-				return func() (fleet.CronSchedule, error) {
-					const name = string(fleet.CronAppleMDMDEPProfileAssigner)
-					logger := cronLog
-					fleetSyncer := apple_mdm.NewDEPService(ds, depStorage, logger)
-					depSchedule = schedule.New(
-						ctx, name, s.T().Name(), 1*time.Hour, ds, ds,
-						schedule.WithLogger(logger),
-						schedule.WithJob("dep_syncer", func(ctx context.Context) error {
-							if s.onDEPScheduleDone != nil {
-								defer s.onDEPScheduleDone()
-							}
-							err := fleetSyncer.RunAssigner(ctx)
-							require.NoError(s.T(), err)
-							return err
-						}),
-					)
-					return depSchedule, nil
-				}
-			},
 			func(ctx context.Context, ds fleet.Datastore) fleet.NewCronScheduleFunc {
 				return func() (fleet.CronSchedule, error) {
 					const name = string(fleet.CronMDMAppleProfileManager)
@@ -264,11 +268,26 @@ func (s *integrationMDMTestSuite) SetupSuite() {
 					return integrationsSchedule, nil
 				}
 			},
+			func(ctx context.Context, ds fleet.Datastore) fleet.NewCronScheduleFunc {
+				return func() (fleet.CronSchedule, error) {
+					const name = string(fleet.CronAppleMDMIPhoneIPadRefetcher)
+					logger := cronLog
+					refetcherSchedule := schedule.New(
+						ctx, name, s.T().Name(), 1*time.Hour, ds, ds,
+						schedule.WithLogger(logger),
+						schedule.WithJob("cron_iphone_ipad_refetcher", func(ctx context.Context) error {
+							return apple_mdm.IOSiPadOSRefetch(ctx, ds, mdmCommander, logger)
+						}),
+					)
+					return refetcherSchedule, nil
+				}
+			},
 		},
 		APNSTopic: "com.apple.mgmt.External.10ac3ce5-4668-4e58-b69a-b2b5ce667589",
 	}
 
-	s.scepChallenge = "scepchallenge"
+	// ensure all our tests support challenges with invalid XML characters
+	s.scepChallenge = "scepcha/><llenge"
 	err = s.ds.InsertMDMConfigAssets(context.Background(), []fleet.MDMConfigAsset{
 		{Name: fleet.MDMAssetSCEPChallenge, Value: []byte(s.scepChallenge)},
 	})
@@ -281,7 +300,6 @@ func (s *integrationMDMTestSuite) SetupSuite() {
 	s.fleetCfg = fleetCfg
 	s.pushProvider = pushProvider
 	s.depStorage = depStorage
-	s.depSchedule = depSchedule
 	s.integrationsSchedule = integrationsSchedule
 	s.profileSchedule = profileSchedule
 	s.mdmStorage = mdmStorage
@@ -310,8 +328,204 @@ func (s *integrationMDMTestSuite) SetupSuite() {
 		}
 		_, _ = w.Write(resp)
 	}))
+
+	if s.appleVPPConfigSrvConfig == nil {
+		s.appleVPPConfigSrvConfig = &appleVPPConfigSrvConf{
+			Assets: []vpp.Asset{
+				{
+					AdamID:         "1",
+					PricingParam:   "STDQ",
+					AvailableCount: 12,
+				},
+				{
+					AdamID:         "2",
+					PricingParam:   "STDQ",
+					AvailableCount: 3,
+				},
+				{
+					AdamID:         "3",
+					PricingParam:   "STDQ",
+					AvailableCount: 1,
+				},
+			},
+			SerialNumbers: []string{"123", "456"},
+			Location:      "Fleet Location One",
+		}
+	}
+
+	s.appleVPPConfigSrv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Handle /associate
+		if strings.Contains(r.URL.Path, "associate") {
+			var associations vpp.AssociateAssetsRequest
+
+			decoder := json.NewDecoder(r.Body)
+			if err := decoder.Decode(&associations); err != nil {
+				http.Error(w, "invalid request", http.StatusBadRequest)
+				return
+			}
+
+			fmt.Printf("Mock VPP Server: Trying to associate %v with %v\n", associations.SerialNumbers, associations.Assets)
+
+			if len(associations.Assets) == 0 {
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(http.StatusBadRequest)
+				res := vpp.ErrorResponse{
+					ErrorNumber:  9718,
+					ErrorMessage: "This request doesn't contain an asset, which is a required argument. Change the request to provide an asset.",
+				}
+				if err := json.NewEncoder(w).Encode(res); err != nil {
+					panic(err)
+				}
+				return
+			}
+
+			if len(associations.SerialNumbers) == 0 {
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(http.StatusBadRequest)
+				res := vpp.ErrorResponse{
+					ErrorNumber:  9719,
+					ErrorMessage: "Either clientUserIds or serialNumbers are required arguments. Change the request to provide assignable users and devices.",
+				}
+				if err := json.NewEncoder(w).Encode(res); err != nil {
+					panic(err)
+				}
+				return
+			}
+
+			var badAssets []vpp.Asset
+			for _, reqAsset := range associations.Assets {
+				var found bool
+				for _, goodAsset := range s.appleVPPConfigSrvConfig.Assets {
+					if reqAsset == goodAsset {
+						found = true
+					}
+				}
+				if !found {
+					badAssets = append(badAssets, reqAsset)
+				}
+			}
+
+			var badSerials []string
+			for _, reqSerial := range associations.SerialNumbers {
+				var found bool
+				for _, goodSerial := range s.appleVPPConfigSrvConfig.SerialNumbers {
+					if reqSerial == goodSerial {
+						found = true
+					}
+				}
+				if !found {
+					badSerials = append(badSerials, reqSerial)
+				}
+			}
+
+			if len(badAssets) != 0 || len(badSerials) != 0 {
+				errMsg := "error associating assets."
+				if len(badAssets) > 0 {
+					var badAdamIds []string
+					for _, asset := range badAssets {
+						badAdamIds = append(badAdamIds, asset.AdamID)
+					}
+					errMsg += fmt.Sprintf(" assets don't exist on account: %s.", strings.Join(badAdamIds, ", "))
+				}
+				if len(badSerials) > 0 {
+					errMsg += fmt.Sprintf(" bad serials: %s.", strings.Join(badSerials, ", "))
+				}
+				res := vpp.ErrorResponse{
+					ErrorInfo: vpp.ResponseErrorInfo{
+						Assets:        badAssets,
+						ClientUserIds: []string{"something"},
+						SerialNumbers: badSerials,
+					},
+					// Not sure what error should be returned on each
+					// error type
+					ErrorNumber:  1,
+					ErrorMessage: errMsg,
+				}
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(http.StatusBadRequest)
+				if err := json.NewEncoder(w).Encode(res); err != nil {
+					panic(err)
+				}
+			}
+			_, _ = w.Write([]byte(`{"eventId": "123-345"}`))
+			return
+		}
+
+		// Handle /assets
+		if strings.Contains(r.URL.Path, "assets") {
+			w.Header().Set("Content-Type", "application/json")
+			assets := s.appleVPPConfigSrvConfig.Assets
+			if adamID := r.URL.Query().Get("adamId"); adamID != "" {
+				for _, a := range assets {
+					if a.AdamID == adamID {
+						assets = []vpp.Asset{a}
+					}
+				}
+			}
+			encoder := json.NewEncoder(w)
+			err := encoder.Encode(map[string][]vpp.Asset{"assets": assets})
+			if err != nil {
+				panic(err)
+			}
+			return
+		}
+
+		// Handle /client/config
+		resp := []byte(fmt.Sprintf(`{"locationName": "%s"}`, s.appleVPPConfigSrvConfig.Location))
+		if strings.Contains(r.URL.RawQuery, "invalidToken") {
+			// This replicates the response sent back from Apple's VPP endpoints when an invalid
+			// token is passed. For more details see:
+			// https://developer.apple.com/documentation/devicemanagement/app_and_book_management/app_and_book_management_legacy/interpreting_error_codes
+			// https://developer.apple.com/documentation/devicemanagement/client_config
+			// https://developer.apple.com/documentation/devicemanagement/errorresponse
+			// Note that the Apple server returns 200 in this case.
+			resp = []byte(`{"errorNumber": 9622,"errorMessage": "Invalid authentication token"}`)
+		}
+
+		if strings.Contains(r.URL.RawQuery, "serverError") {
+			resp = []byte(`{"errorNumber": 9603,"errorMessage": "Internal server error"}`)
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+
+		_, _ = w.Write(resp)
+	}))
+
+	s.appleITunesSrv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// a map of apps we can respond with
+		db := map[string]string{
+			// macos app
+			"1": `{"bundleId": "a-1", "artworkUrl512": "https://example.com/images/1", "version": "1.0.0", "trackName": "App 1", "TrackID": 1}`,
+			// macos, ios, ipados app
+			"2": `{"bundleId": "b-2", "artworkUrl512": "https://example.com/images/2", "version": "2.0.0", "trackName": "App 2", "TrackID": 2,
+				"supportedDevices": ["MacDesktop-MacDesktop", "iPhone5s-iPhone5s", "iPadAir-iPadAir"] }`,
+			// ipados app
+			"3": `{"bundleId": "c-3", "artworkUrl512": "https://example.com/images/3", "version": "3.0.0", "trackName": "App 3", "TrackID": 3,
+				"supportedDevices": ["iPadAir-iPadAir"] }`,
+		}
+
+		adamIDString := r.URL.Query().Get("id")
+		adamIDs := strings.Split(adamIDString, ",")
+
+		var objs []string
+		for _, a := range adamIDs {
+			objs = append(objs, db[a])
+		}
+
+		_, _ = w.Write([]byte(fmt.Sprintf(`{"results": [%s]}`, strings.Join(objs, ","))))
+	}))
+
+	s.appleGDMFSrv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		// load the test data from the file
+		b, err := os.ReadFile("../mdm/apple/gdmf/testdata/gdmf.json")
+		require.NoError(s.T(), err)
+		_, err = w.Write(b)
+		require.NoError(s.T(), err)
+	}))
+
+	s.T().Setenv("FLEET_DEV_GDMF_URL", s.appleGDMFSrv.URL)
 	s.T().Setenv("TEST_FLEETDM_API_URL", fleetdmSrv.URL)
-	s.T().Cleanup(fleetdmSrv.Close)
+	s.T().Setenv("FLEET_DEV_ITUNES_URL", s.appleITunesSrv.URL)
 
 	s.mockedDownloadFleetdmMeta = fleetdbase.Metadata{
 		MSIURL:           fmt.Sprintf("https://download-testing.fleetdm.com/archive/stable/%s/fleetd-base.msi", uuid.NewString()),
@@ -327,7 +541,6 @@ func (s *integrationMDMTestSuite) SetupSuite() {
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
 			require.NoError(s.T(), json.NewEncoder(w).Encode(s.mockedDownloadFleetdmMeta))
-
 		}
 	}))
 	s.T().Setenv("FLEET_DEV_DOWNLOAD_FLEETDM_URL", downloadFleetdmSrv.URL)
@@ -336,12 +549,17 @@ func (s *integrationMDMTestSuite) SetupSuite() {
 	appConf, err = s.ds.AppConfig(context.Background())
 	require.NoError(s.T(), err)
 	appConf.ServerSettings.ServerURL = server.URL
+	appConf.Features.EnableSoftwareInventory = true
 	err = s.ds.SaveAppConfig(context.Background(), appConf)
 	require.NoError(s.T(), err)
 
 	// enable MDM flows
 	s.appleCoreCertsSetup()
-	s.enableABM()
+
+	s.T().Cleanup(fleetdmSrv.Close)
+	s.T().Cleanup(s.appleVPPConfigSrv.Close)
+	s.T().Cleanup(s.appleITunesSrv.Close)
+	s.T().Cleanup(s.appleGDMFSrv.Close)
 }
 
 func (s *integrationMDMTestSuite) TearDownSuite() {
@@ -431,16 +649,24 @@ func (s *integrationMDMTestSuite) TearDownTest() {
 		_, err := tx.ExecContext(ctx, "DELETE FROM host_mdm;")
 		return err
 	})
+	mysql.ExecAdhocSQL(t, s.ds, func(tx sqlx.ExtContext) error {
+		_, err := tx.ExecContext(ctx, "DELETE FROM abm_tokens;")
+		return err
+	})
+	mysql.ExecAdhocSQL(t, s.ds, func(tx sqlx.ExtContext) error {
+		_, err := tx.ExecContext(ctx, "DELETE FROM vpp_tokens;")
+		return err
+	})
 }
 
-func (s *integrationMDMTestSuite) mockDEPResponse(handler http.Handler) {
+func (s *integrationMDMTestSuite) mockDEPResponse(orgName string, handler http.Handler) {
 	t := s.T()
 	srv := httptest.NewServer(handler)
-	err := s.depStorage.StoreConfig(context.Background(), apple_mdm.DEPName, &nanodep_client.Config{BaseURL: srv.URL})
+	err := s.depStorage.StoreConfig(context.Background(), orgName, &nanodep_client.Config{BaseURL: srv.URL})
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		srv.Close()
-		err := s.depStorage.StoreConfig(context.Background(), apple_mdm.DEPName, &nanodep_client.Config{BaseURL: nanodep_client.DefaultBaseURL})
+		err := s.depStorage.StoreConfig(context.Background(), orgName, &nanodep_client.Config{BaseURL: nanodep_client.DefaultBaseURL})
 		require.NoError(t, err)
 	})
 }
@@ -573,22 +799,36 @@ func (s *integrationMDMTestSuite) TestAppleGetAppleMDM() {
 	require.Equal(t, "Fleet", mdmResp.CommonName)
 	require.NotZero(t, mdmResp.RenewDate)
 
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		switch r.URL.Path {
-		case "/session":
-			_, _ = w.Write([]byte(`{"auth_session_token": "xyz"}`))
-		case "/account":
-			_, _ = w.Write([]byte(`{"admin_id": "abc", "org_name": "test_org"}`))
-		}
-	}))
-	var getAppleBMResp getAppleBMResponse
-	s.DoJSON("GET", "/api/latest/fleet/abm", nil, http.StatusOK, &getAppleBMResp)
-	require.NoError(t, getAppleBMResp.Err)
-	require.Equal(t, "abc", getAppleBMResp.AppleID)
-	require.Equal(t, "test_org", getAppleBMResp.OrgName)
-	require.Equal(t, s.server.URL+"/mdm/apple/mdm", getAppleBMResp.MDMServerURL)
-	require.Empty(t, getAppleBMResp.DefaultTeam)
+	// set up multiple ABM tokens with different org names
+	defaultOrgName := "fleet_test"
+	s.enableABM(defaultOrgName)
+	tmOrgName := t.Name()
+	s.enableABM(tmOrgName)
+
+	var tokensResp listABMTokensResponse
+	s.DoJSON("GET", "/api/latest/fleet/abm_tokens", nil, http.StatusOK, &tokensResp)
+
+	// for t.Name()
+	tok := s.getABMTokenByName(defaultOrgName, tokensResp.Tokens)
+	require.NotNil(t, tok)
+	require.False(t, tok.TermsExpired)
+	require.Equal(t, "abc", tok.AppleID)
+	require.Equal(t, defaultOrgName, tok.OrganizationName)
+	require.Equal(t, s.server.URL+"/mdm/apple/mdm", tok.MDMServerURL)
+	require.Equal(t, fleet.TeamNameNoTeam, tok.MacOSTeam.Name)
+	require.Equal(t, fleet.TeamNameNoTeam, tok.IOSTeam.Name)
+	require.Equal(t, fleet.TeamNameNoTeam, tok.IPadOSTeam.Name)
+
+	// for tmOrgName
+	tok = s.getABMTokenByName(tmOrgName, tokensResp.Tokens)
+	require.NotNil(t, tok)
+	require.False(t, tok.TermsExpired)
+	require.Equal(t, "abc", tok.AppleID)
+	require.Equal(t, tmOrgName, tok.OrganizationName)
+	require.Equal(t, s.server.URL+"/mdm/apple/mdm", tok.MDMServerURL)
+	require.Equal(t, fleet.TeamNameNoTeam, tok.MacOSTeam.Name)
+	require.Equal(t, fleet.TeamNameNoTeam, tok.IOSTeam.Name)
+	require.Equal(t, fleet.TeamNameNoTeam, tok.IPadOSTeam.Name)
 
 	// create a new team
 	tm, err := s.ds.NewTeam(context.Background(), &fleet.Team{
@@ -596,28 +836,58 @@ func (s *integrationMDMTestSuite) TestAppleGetAppleMDM() {
 		Description: "desc",
 	})
 	require.NoError(t, err)
-	// set the default bm assignment to that team
+	// set the default bm assignment for that token to that team
 	acResp := appConfigResponse{}
 	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(fmt.Sprintf(`{
 		"mdm": {
-			"apple_bm_default_team": %q
+			"apple_business_manager": [{
+			  "organization_name": %q,
+			  "macos_team": %q,
+			  "ios_team": %q,
+			  "ipados_team": %q
+			}]
+		}
+	}`, tmOrgName, tm.Name, tm.Name, tm.Name)), http.StatusOK, &acResp)
+	t.Cleanup(func() {
+		s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
+			"mdm": {
+				"apple_business_manager": []
+			}
+		}`), http.StatusOK, &acResp)
+	})
+
+	// try again, this time we get team assignments in the response
+	tokensResp = listABMTokensResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/abm_tokens", nil, http.StatusOK, &tokensResp)
+
+	tok = s.getABMTokenByName(tmOrgName, tokensResp.Tokens)
+	require.NotNil(t, tok)
+	require.False(t, tok.TermsExpired)
+	require.Equal(t, "abc", tok.AppleID)
+	require.Equal(t, tmOrgName, tok.OrganizationName)
+	require.Equal(t, s.server.URL+"/mdm/apple/mdm", tok.MDMServerURL)
+	require.Equal(t, tm.Name, tok.MacOSTeam.Name)
+	require.Equal(t, tm.Name, tok.IOSTeam.Name)
+	require.Equal(t, tm.Name, tok.IPadOSTeam.Name)
+}
+
+func (s *integrationMDMTestSuite) getABMTokenByName(orgName string, tokens []*fleet.ABMToken) *fleet.ABMToken {
+	for _, tok := range tokens {
+		if tok.OrganizationName == orgName {
+			return tok
 		}
-	}`, tm.Name)), http.StatusOK, &acResp)
+	}
 
-	// try again, this time we get a default team in the response
-	getAppleBMResp = getAppleBMResponse{}
-	s.DoJSON("GET", "/api/latest/fleet/abm", nil, http.StatusOK, &getAppleBMResp)
-	require.NoError(t, getAppleBMResp.Err)
-	require.Equal(t, "abc", getAppleBMResp.AppleID)
-	require.Equal(t, "test_org", getAppleBMResp.OrgName)
-	require.Equal(t, s.server.URL+"/mdm/apple/mdm", getAppleBMResp.MDMServerURL)
-	require.Equal(t, tm.Name, getAppleBMResp.DefaultTeam)
+	return nil
 }
 
 func (s *integrationMDMTestSuite) TestABMExpiredToken() {
 	t := s.T()
+
+	s.enableABM(t.Name())
+
 	var returnType string
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch returnType {
 		case "not_signed":
 			w.WriteHeader(http.StatusForbidden)
@@ -636,27 +906,43 @@ func (s *integrationMDMTestSuite) TestABMExpiredToken() {
 	config := s.getConfig()
 	require.False(t, config.MDM.AppleBMTermsExpired)
 
+	ctx := context.Background()
+	fleetSyncer := apple_mdm.NewDEPService(s.ds, s.depStorage, s.logger)
+
 	// not signed error flips the AppleBMTermsExpired flag
 	returnType = "not_signed"
-	res := s.DoRaw("GET", "/api/latest/fleet/abm", nil, http.StatusBadRequest)
-	errMsg := extractServerErrorText(res.Body)
-	require.Contains(t, errMsg, "DEP auth error: 403 Forbidden")
-
+	err := fleetSyncer.RunAssigner(ctx)
+	require.ErrorContains(t, err, "T_C_NOT_SIGNED")
+	var tokensResp listABMTokensResponse
+	s.DoJSON("GET", "/api/latest/fleet/abm_tokens", nil, http.StatusOK, &tokensResp)
+	tok := s.getABMTokenByName(t.Name(), tokensResp.Tokens)
+	require.NotNil(t, tok)
+	require.True(t, tok.TermsExpired)
 	config = s.getConfig()
 	require.True(t, config.MDM.AppleBMTermsExpired)
 
 	// a successful call clears it
 	returnType = "success"
-	s.DoRaw("GET", "/api/latest/fleet/abm", nil, http.StatusOK)
+	err = fleetSyncer.RunAssigner(ctx)
+	require.NoError(t, err)
+	tokensResp = listABMTokensResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/abm_tokens", nil, http.StatusOK, &tokensResp)
+	tok = s.getABMTokenByName(t.Name(), tokensResp.Tokens)
+	require.NotNil(t, tok)
+	require.False(t, tok.TermsExpired)
 
 	config = s.getConfig()
 	require.False(t, config.MDM.AppleBMTermsExpired)
 
-	// an unauthorized call returns 400 but does not flip the terms expired flag
+	// an unauthorized call does not flip the terms expired flag
 	returnType = "unauthorized"
-	res = s.DoRaw("GET", "/api/latest/fleet/abm", nil, http.StatusBadRequest)
-	errMsg = extractServerErrorText(res.Body)
-	require.Contains(t, errMsg, "Apple Business Manager certificate or server token is invalid")
+	err = fleetSyncer.RunAssigner(ctx)
+	require.ErrorContains(t, err, "DEP auth error")
+	tokensResp = listABMTokensResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/abm_tokens", nil, http.StatusOK, &tokensResp)
+	tok = s.getABMTokenByName(t.Name(), tokensResp.Tokens)
+	require.NotNil(t, tok)
+	require.False(t, tok.TermsExpired)
 
 	config = s.getConfig()
 	require.False(t, config.MDM.AppleBMTermsExpired)
@@ -772,6 +1058,42 @@ func createHostThenEnrollMDM(ds fleet.Datastore, fleetServerURL string, t *testi
 	return fleetHost, mdmDevice
 }
 
+func (s *integrationMDMTestSuite) createAppleMobileHostThenEnrollMDM(platform string) (*fleet.Host, *mdmtest.TestAppleMDMClient) {
+	ctx := context.Background()
+	t := s.T()
+
+	// create a host with minimal information and the serial, no uuid/osquery id
+	// (as when created via DEP sync).
+	dbZeroTime := time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC)
+	serialNumber := mdmtest.RandSerialNumber()
+	fleetHost, err := s.ds.NewHost(ctx, &fleet.Host{
+		HardwareSerial:   serialNumber,
+		Platform:         platform,
+		LastEnrolledAt:   dbZeroTime,
+		DetailUpdatedAt:  time.Now(), // so that we don't trigger a cron detail update
+		RefetchRequested: true,
+	})
+	require.NoError(t, err)
+	require.Equal(t, dbZeroTime, fleetHost.LastEnrolledAt)
+
+	// Perform the MDM enrollment.
+	mdmEnrollInfo := mdmtest.AppleEnrollInfo{
+		SCEPChallenge: s.scepChallenge,
+		SCEPURL:       s.server.URL + apple_mdm.SCEPPath,
+		MDMURL:        s.server.URL + apple_mdm.MDMPath,
+	}
+	model := "iPhone14,6"
+	if platform == "ipados" {
+		model = "iPad13,18"
+	}
+	mdmDevice := mdmtest.NewTestMDMClientAppleDirect(mdmEnrollInfo, model)
+	mdmDevice.SerialNumber = serialNumber
+	err = mdmDevice.Enroll()
+	require.NoError(t, err)
+
+	return fleetHost, mdmDevice
+}
+
 func createWindowsHostThenEnrollMDM(ds fleet.Datastore, fleetServerURL string, t *testing.T) (*fleet.Host, *mdmtest.TestWindowsMDMClient) {
 	host := createOrbitEnrolledHost(t, "windows", "h1", ds)
 	mdmDevice := mdmtest.NewTestMDMClientWindowsProgramatic(fleetServerURL, *host.OrbitNodeKey)
@@ -978,7 +1300,7 @@ func (s *integrationMDMTestSuite) TestGetMDMCSR() {
 	// Validate errors if no private key is set
 	testSetEmptyPrivateKey = true
 	t.Cleanup(func() { testSetEmptyPrivateKey = false })
-	s.uploadAPNSCert([]byte("-----BEGIN CERTIFICATE-----\nZm9vCg==\n-----END CERTIFICATE-----"), http.StatusInternalServerError, "Couldn't upload APNs certificate. Missing required private key. Learn how to configure the private key here: https://fleetdm.com/learn-more-about/fleet-server-private-key")
+	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/apns_certificate", "certificate", "certificate.pem", []byte("-----BEGIN CERTIFICATE-----\nZm9vCg==\n-----END CERTIFICATE-----"), http.StatusInternalServerError, "Couldn't upload APNs certificate. Missing required private key. Learn how to configure the private key here: https://fleetdm.com/learn-more-about/fleet-server-private-key", nil)
 
 	r := s.Do("GET", "/api/latest/fleet/mdm/apple/request_csr", getMDMAppleCSRRequest{}, http.StatusInternalServerError)
 	require.Contains(t, extractServerErrorText(r.Body), "Couldn't download signed CSR. Missing required private key. Learn how to configure the private key here: https://fleetdm.com/learn-more-about/fleet-server-private-key")
@@ -996,7 +1318,7 @@ func (s *integrationMDMTestSuite) TestGetMDMCSR() {
 	require.Nil(t, assets)
 
 	// trying to upload a certificate without generating a private key first is not allowed
-	s.uploadAPNSCert([]byte("-----BEGIN CERTIFICATE-----\nZm9vCg==\n-----END CERTIFICATE-----"), http.StatusBadRequest, "Please generate a private key first.")
+	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/apns_certificate", "certificate", "certificate.pem", []byte("-----BEGIN CERTIFICATE-----\nZm9vCg==\n-----END CERTIFICATE-----"), http.StatusBadRequest, "Please generate a private key first.", nil)
 
 	// Check that we return bad gateway if the website API errors
 	s.FailNextCSRRequestWith(http.StatusInternalServerError)
@@ -1006,22 +1328,22 @@ func (s *integrationMDMTestSuite) TestGetMDMCSR() {
 	require.Contains(t, errResp.Errors[0].Reason, "FleetDM CSR request failed")
 
 	// Invalid APNS cert upload attempt
-	s.uploadAPNSCert([]byte("invalid-cert"), http.StatusUnprocessableEntity, "Invalid certificate. Please provide a valid certificate from Apple Push Certificate Portal.")
+	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/apns_certificate", "certificate", "certificate.pem", []byte("invalid-cert"), http.StatusUnprocessableEntity, "Invalid certificate. Please provide a valid certificate from Apple Push Certificate Portal.", nil)
 
 	// simulate a renew flow
 	s.appleCoreCertsSetup()
 }
 
-func (s *integrationMDMTestSuite) uploadAPNSCert(pemBytes []byte, expectedStatus int, wantErr string) {
+func (s *integrationMDMTestSuite) uploadDataViaForm(endpoint, fieldName, fileName string, data []byte, expectedStatus int, wantErr string, response any) {
 	t := s.T()
 
 	var b bytes.Buffer
 	w := multipart.NewWriter(&b)
 
 	// add the package field
-	fw, err := w.CreateFormFile("certificate", "certificate.pem")
+	fw, err := w.CreateFormFile(fieldName, fileName)
 	require.NoError(t, err)
-	_, err = io.Copy(fw, bytes.NewBuffer(pemBytes))
+	_, err = io.Copy(fw, bytes.NewBuffer(data))
 	require.NoError(t, err)
 
 	w.Close()
@@ -1032,11 +1354,16 @@ func (s *integrationMDMTestSuite) uploadAPNSCert(pemBytes []byte, expectedStatus
 		"Authorization": fmt.Sprintf("Bearer %s", s.token),
 	}
 
-	res := s.DoRawWithHeaders("POST", "/api/latest/fleet/mdm/apple/apns_certificate", b.Bytes(), expectedStatus, headers)
+	res := s.DoRawWithHeaders("POST", endpoint, b.Bytes(), expectedStatus, headers)
 	if wantErr != "" {
 		errMsg := extractServerErrorText(res.Body)
 		assert.Contains(t, errMsg, wantErr)
 	}
+
+	if response != nil {
+		err := json.NewDecoder(res.Body).Decode(&response)
+		require.NoError(t, err)
+	}
 }
 
 func (s *integrationMDMTestSuite) TestMDMAppleUnenroll() {
@@ -1091,8 +1418,8 @@ func (s *integrationMDMTestSuite) TestMDMAppleUnenroll() {
 	// 3 profiles added + 1 profile with fleetd configuration + 1 root CA config
 	require.Len(t, *hostResp.Host.MDM.Profiles, 5)
 
-	// try to unenroll the host, fails since the host doesn't respond
-	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/hosts/%d/mdm", h.ID), nil, http.StatusGatewayTimeout)
+	// returns success, but this is effectively a no-op because the host isn't enrolled yet.
+	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/hosts/%d/mdm", h.ID), nil, http.StatusOK)
 
 	// we're going to modify this mock, make sure we restore its default
 	originalPushMock := s.pushProvider.PushFunc
@@ -1389,6 +1716,42 @@ func (s *integrationMDMTestSuite) TestDiskEncryptionSharedSetting() {
 	checkConfigSetSucceeds()
 }
 
+func (s *integrationMDMTestSuite) TestEscrowBuddyBackwardsCompat() {
+	t := s.T()
+	ctx := context.Background()
+
+	// create a host
+	host, _ := createHostThenEnrollMDM(s.ds, s.server.URL, t)
+	orbitKey := setOrbitEnrollment(t, host, s.ds)
+	host.OrbitNodeKey = &orbitKey
+
+	// install a filevault profile for that host
+	acResp := appConfigResponse{}
+	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
+		"mdm": { "enable_disk_encryption": true }
+  }`), http.StatusOK, &acResp)
+	assert.True(t, acResp.MDM.EnableDiskEncryption.Value)
+
+	// set the status as non-decryptable so a notification should be sent
+	err := s.ds.SetOrUpdateHostDiskEncryptionKey(ctx, host.ID, "", "", ptr.Bool(false))
+	require.NoError(t, err)
+
+	// notification is false because the escrow buddy capability is not set
+	orbitConfigResp := orbitGetConfigResponse{}
+	s.DoJSON("POST", "/api/fleet/orbit/config", json.RawMessage(fmt.Sprintf(`{"orbit_node_key": %q}`, *host.OrbitNodeKey)), http.StatusOK, &orbitConfigResp)
+	require.False(t, orbitConfigResp.Notifications.RotateDiskEncryptionKey)
+
+	// send the request again, this time with the right header
+	orbitConfigResp = orbitGetConfigResponse{}
+	res := s.DoRawWithHeaders("POST", "/api/fleet/orbit/config", json.RawMessage(fmt.Sprintf(`{"orbit_node_key": %q}`, *host.OrbitNodeKey)), http.StatusOK, map[string]string{
+		"Authorization":          fmt.Sprintf("Bearer %s", s.token),
+		fleet.CapabilitiesHeader: string(fleet.CapabilityEscrowBuddy),
+	})
+	err = json.NewDecoder(res.Body).Decode(&orbitConfigResp)
+	require.NoError(t, err)
+	require.True(t, orbitConfigResp.Notifications.RotateDiskEncryptionKey)
+}
+
 func (s *integrationMDMTestSuite) TestMDMAppleHostDiskEncryption() {
 	t := s.T()
 	ctx := context.Background()
@@ -1494,7 +1857,7 @@ func (s *integrationMDMTestSuite) TestMDMAppleHostDiskEncryption() {
 	require.NotNil(t, getHostResp.Host.MDM.MacOSSettings.DiskEncryption)
 	require.Equal(t, fleet.DiskEncryptionActionRequired, *getHostResp.Host.MDM.MacOSSettings.DiskEncryption)
 	require.NotNil(t, getHostResp.Host.MDM.MacOSSettings.ActionRequired)
-	require.Equal(t, fleet.ActionRequiredLogOut, *getHostResp.Host.MDM.MacOSSettings.ActionRequired)
+	require.Equal(t, fleet.ActionRequiredRotateKey, *getHostResp.Host.MDM.MacOSSettings.ActionRequired)
 	require.NotNil(t, getHostResp.Host.MDM.OSSettings)
 	require.NotNil(t, getHostResp.Host.MDM.OSSettings.DiskEncryption.Status)
 	require.Equal(t, fleet.DiskEncryptionActionRequired, *getHostResp.Host.MDM.OSSettings.DiskEncryption.Status)
@@ -2223,8 +2586,7 @@ func (s *integrationMDMTestSuite) TestEnrollOrbitAfterDEPSync() {
 	ctx := context.Background()
 
 	// create a host with minimal information and the serial, no uuid/osquery id
-	// (as when created via DEP sync). Platform must be "darwin" as this is the
-	// only supported OS with DEP.
+	// (as when created via DEP sync).
 	dbZeroTime := time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC)
 	h, err := s.ds.NewHost(ctx, &fleet.Host{
 		HardwareSerial:   uuid.New().String(),
@@ -2234,6 +2596,7 @@ func (s *integrationMDMTestSuite) TestEnrollOrbitAfterDEPSync() {
 		RefetchRequested: true,
 	})
 	require.NoError(t, err)
+	require.Equal(t, dbZeroTime, h.LastEnrolledAt)
 
 	// create an enroll secret
 	secret := uuid.New().String()
@@ -2259,6 +2622,7 @@ func (s *integrationMDMTestSuite) TestEnrollOrbitAfterDEPSync() {
 	var hostResp getHostResponse
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d", h.ID), nil, http.StatusOK, &hostResp)
 	require.Equal(t, h.ID, hostResp.Host.ID)
+	require.NotEqual(t, dbZeroTime, hostResp.Host.LastEnrolledAt)
 
 	got, err := s.ds.LoadHostByOrbitNodeKey(ctx, resp.OrbitNodeKey)
 	require.NoError(t, err)
@@ -2285,36 +2649,6 @@ func (s *integrationMDMTestSuite) TestEnrollOrbitAfterDEPSync() {
 	require.Equal(t, h.ID, got.ID)
 }
 
-func (s *integrationMDMTestSuite) TestDiskEncryptionRotation() {
-	t := s.T()
-	h := createOrbitEnrolledHost(t, "darwin", "h", s.ds)
-
-	// false by default
-	resp := orbitGetConfigResponse{}
-	s.DoJSON("POST", "/api/fleet/orbit/config", json.RawMessage(fmt.Sprintf(`{"orbit_node_key": %q}`, *h.OrbitNodeKey)), http.StatusOK, &resp)
-	require.False(t, resp.Notifications.RotateDiskEncryptionKey)
-
-	// create an auth token for h
-	token := "much_valid"
-	mysql.ExecAdhocSQL(t, s.ds, func(db sqlx.ExtContext) error {
-		_, err := db.ExecContext(context.Background(), `INSERT INTO host_device_auth (host_id, token) VALUES (?, ?)`, h.ID, token)
-		return err
-	})
-
-	tokRes := s.DoRawNoAuth("POST", "/api/latest/fleet/device/"+token+"/rotate_encryption_key", nil, http.StatusOK)
-	tokRes.Body.Close()
-
-	// true after the POST request
-	resp = orbitGetConfigResponse{}
-	s.DoJSON("POST", "/api/fleet/orbit/config", json.RawMessage(fmt.Sprintf(`{"orbit_node_key": %q}`, *h.OrbitNodeKey)), http.StatusOK, &resp)
-	require.True(t, resp.Notifications.RotateDiskEncryptionKey)
-
-	// false on following requests
-	resp = orbitGetConfigResponse{}
-	s.DoJSON("POST", "/api/fleet/orbit/config", json.RawMessage(fmt.Sprintf(`{"orbit_node_key": %q}`, *h.OrbitNodeKey)), http.StatusOK, &resp)
-	require.False(t, resp.Notifications.RotateDiskEncryptionKey)
-}
-
 func (s *integrationMDMTestSuite) TestFleetdConfiguration() {
 	t := s.T()
 	s.assertConfigProfilesByIdentifier(nil, mobileconfig.FleetdConfigPayloadIdentifier, false)
@@ -2338,13 +2672,28 @@ func (s *integrationMDMTestSuite) TestFleetdConfiguration() {
 	require.NoError(t, err)
 	s.assertConfigProfilesByIdentifier(&tm.ID, mobileconfig.FleetdConfigPayloadIdentifier, false)
 
+	// upload an ABM token
+	s.enableABM(t.Name())
+
 	// set the default bm assignment to that team
 	acResp := appConfigResponse{}
 	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(fmt.Sprintf(`{
 		"mdm": {
-			"apple_bm_default_team": %q
+			"apple_business_manager": [{
+			  "organization_name": %q,
+			  "macos_team": %q,
+			  "ios_team": %q,
+			  "ipados_team": %q
+			}]
 		}
-	}`, tm.Name)), http.StatusOK, &acResp)
+	}`, t.Name(), tm.Name, tm.Name, tm.Name)), http.StatusOK, &acResp)
+	t.Cleanup(func() {
+		s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
+			"mdm": {
+				"apple_business_manager": []
+			}
+		}`), http.StatusOK, &acResp)
+	})
 
 	// the team doesn't have any enroll secrets yet, a profile is created using the global enroll secret
 	s.awaitTriggerProfileSchedule(t)
@@ -2371,6 +2720,11 @@ func (s *integrationMDMTestSuite) TestEnqueueMDMCommand() {
 	ctx := context.Background()
 	t := s.T()
 
+	// list commands should return all the commands we sent
+	var listCmdResp0 listMDMAppleCommandsResponse
+	s.DoJSON("GET", "/api/latest/fleet/mdm/apple/commands", nil, http.StatusOK, &listCmdResp0)
+	require.Empty(t, listCmdResp0.Results)
+
 	// Create host enrolled via osquery, but not enrolled in MDM.
 	unenrolledHost := createHostAndDeviceToken(t, s.ds, "unused")
 
@@ -2740,6 +3094,10 @@ func (s *integrationMDMTestSuite) TestBootstrapPackage() {
 
 func (s *integrationMDMTestSuite) TestBootstrapPackageStatus() {
 	t := s.T()
+
+	abmOrgName := "abm_org"
+	s.enableABM(abmOrgName)
+
 	pkg, err := os.ReadFile(filepath.Join("testdata", "bootstrap-packages", "signed.pkg"))
 	require.NoError(t, err)
 
@@ -2852,9 +3210,8 @@ func (s *integrationMDMTestSuite) TestBootstrapPackageStatus() {
 	})
 	require.NoError(t, err)
 
-	ch := make(chan bool)
 	mockRespDevices := noTeamDevices
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.mockDEPResponse(abmOrgName, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		encoder := json.NewEncoder(w)
 		switch r.URL.Path {
@@ -2875,7 +3232,6 @@ func (s *integrationMDMTestSuite) TestBootstrapPackageStatus() {
 			err := encoder.Encode(godep.DeviceResponse{Devices: depResp})
 			require.NoError(t, err)
 		case "/profile/devices":
-			ch <- true
 			_, _ = w.Write([]byte(`{}`))
 		default:
 			_, _ = w.Write([]byte(`{}`))
@@ -2883,9 +3239,7 @@ func (s *integrationMDMTestSuite) TestBootstrapPackageStatus() {
 	}))
 
 	// trigger a dep sync
-	_, err = s.depSchedule.Trigger()
-	require.NoError(t, err)
-	<-ch
+	s.runDEPSchedule()
 
 	var summaryResp getMDMAppleBootstrapPackageSummaryResponse
 	s.DoJSON("GET", "/api/latest/fleet/bootstrap/summary", nil, http.StatusOK, &summaryResp)
@@ -2899,15 +3253,25 @@ func (s *integrationMDMTestSuite) TestBootstrapPackageStatus() {
 	acResp := appConfigResponse{}
 	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(fmt.Sprintf(`{
 		"mdm": {
-			"apple_bm_default_team": %q
+			"apple_business_manager": [{
+			  "organization_name": %q,
+			  "macos_team": %q,
+			  "ios_team": %q,
+			  "ipados_team": %q
+			}]
 		}
-	}`, team.Name)), http.StatusOK, &acResp)
+	}`, abmOrgName, team.Name, team.Name, team.Name)), http.StatusOK, &acResp)
+	t.Cleanup(func() {
+		s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
+			"mdm": {
+				"apple_business_manager": []
+			}
+		}`), http.StatusOK, &acResp)
+	})
 
 	// trigger a dep sync
 	mockRespDevices = teamDevices
-	_, err = s.depSchedule.Trigger()
-	require.NoError(t, err)
-	<-ch
+	s.runDEPSchedule()
 
 	summaryResp = getMDMAppleBootstrapPackageSummaryResponse{}
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/bootstrap/summary?team_id=%d", team.ID), nil, http.StatusOK, &summaryResp)
@@ -3170,11 +3534,6 @@ func (s *integrationMDMTestSuite) TestMigrateMDMDeviceWebhook() {
 	s.Do("POST", fmt.Sprintf("/api/v1/fleet/device/%s/migrate_mdm", "good-token"), nil, http.StatusBadRequest)
 	require.False(t, webhookCalled)
 
-	// host is not DEP so migration is not allowed
-	require.NoError(t, s.ds.SetOrUpdateMDMData(context.Background(), h.ID, !isServer, enrolled, mdmURL, !installedFromDEP, mdmName, ""))
-	s.Do("POST", fmt.Sprintf("/api/v1/fleet/device/%s/migrate_mdm", "good-token"), nil, http.StatusBadRequest)
-	require.False(t, webhookCalled)
-
 	// host is not enrolled to MDM so migration is not allowed
 	require.NoError(t, s.ds.SetOrUpdateMDMData(context.Background(), h.ID, !isServer, !enrolled, mdmURL, installedFromDEP, mdmName, ""))
 	s.Do("POST", fmt.Sprintf("/api/v1/fleet/device/%s/migrate_mdm", "good-token"), nil, http.StatusBadRequest)
@@ -3197,8 +3556,10 @@ func (s *integrationMDMTestSuite) TestMigrateMDMDeviceWebhook() {
 	s.Do("POST", fmt.Sprintf("/api/v1/fleet/device/%s/migrate_mdm", "good-token"), nil, http.StatusBadRequest)
 	require.False(t, webhookCalled)
 
+	s.enableABM(t.Name())
+
 	// simulate that the device is assigned to Fleet in ABM
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		switch r.URL.Path {
 		case "/session":
@@ -3262,6 +3623,16 @@ func (s *integrationMDMTestSuite) TestMigrateMDMDeviceWebhook() {
 	require.True(t, webhookCalled)
 	webhookCalled = false
 
+	// host is manually enrolled, which is allowed
+	h.RefetchCriticalQueriesUntil = ptr.Time(time.Now().Add(-1 * time.Minute))
+	err = s.ds.UpdateHost(context.Background(), h)
+	require.NoError(t, err)
+
+	require.NoError(t, s.ds.SetOrUpdateMDMData(context.Background(), h.ID, !isServer, enrolled, mdmURL, !installedFromDEP, mdmName, ""))
+	s.Do("POST", fmt.Sprintf("/api/v1/fleet/device/%s/migrate_mdm", "good-token"), nil, http.StatusNoContent)
+	require.True(t, webhookCalled)
+	webhookCalled = false
+
 	// the refetch critical queries timestamp has been updated to the future
 	h, err = s.ds.Host(context.Background(), h.ID)
 	require.NoError(t, err)
@@ -3326,8 +3697,9 @@ func (s *integrationMDMTestSuite) TestMigrateMDMDeviceWebhookErrors() {
 	s.Do("POST", fmt.Sprintf("/api/v1/fleet/device/%s/migrate_mdm", "good-token"), nil, http.StatusBadRequest)
 	require.False(t, webhookCalled)
 
+	s.enableABM(t.Name())
 	// simulate that the device is assigned to Fleet in ABM
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		switch r.URL.Path {
 		case "/session":
@@ -3376,7 +3748,7 @@ func (s *integrationMDMTestSuite) TestMigrateMDMDeviceWebhookErrors() {
 func (s *integrationMDMTestSuite) TestMDMMacOSSetup() {
 	t := s.T()
 
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		encoder := json.NewEncoder(w)
 		switch r.URL.Path {
@@ -4116,7 +4488,9 @@ func (s *integrationMDMTestSuite) assertWindowsConfigProfilesByName(teamID *uint
 	}
 	var cfgProfs []*fleet.MDMWindowsConfigProfile
 	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
-		return sqlx.SelectContext(context.Background(), q, &cfgProfs, `SELECT * FROM mdm_windows_configuration_profiles WHERE team_id = ?`, teamID)
+		return sqlx.SelectContext(context.Background(), q, &cfgProfs,
+			`SELECT profile_uuid, team_id, name, syncml, created_at, uploaded_at FROM mdm_windows_configuration_profiles WHERE team_id = ?`,
+			teamID)
 	})
 
 	label := "exist"
@@ -4446,8 +4820,9 @@ func (s *integrationMDMTestSuite) TestSSO() {
 	mdmDevice := mdmtest.NewTestMDMClientAppleDirect(mdmtest.AppleEnrollInfo{
 		SCEPChallenge: s.scepChallenge,
 	}, "MacBookPro16,1")
+	s.enableABM(t.Name())
 	var lastSubmittedProfile *godep.Profile
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		switch r.URL.Path {
 		case "/session":
@@ -4985,6 +5360,8 @@ func (s *integrationMDMTestSuite) TestMDMMigration() {
 		"mdm": { "macos_migration": { "enable": true, "mode": "voluntary", "webhook_url": "https://example.com" } }
 	}`), http.StatusOK, &acResp)
 
+	s.enableABM(t.Name())
+
 	checkMigrationResponses := func(host *fleet.Host, token string) {
 		getDesktopResp := fleetDesktopResponse{}
 		res := s.DoRawNoAuth("GET", "/api/latest/fleet/device/"+token+"/desktop", nil, http.StatusOK)
@@ -5007,7 +5384,7 @@ func (s *integrationMDMTestSuite) TestMDMMigration() {
 
 		// simulate that the device is assigned to Fleet in ABM
 		profileAssignmentStatusResponse := fleet.DEPAssignProfileResponseSuccess
-		s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			w.WriteHeader(http.StatusOK)
 			switch r.URL.Path {
 			case "/session":
@@ -5238,26 +5615,57 @@ func (s *integrationMDMTestSuite) TestMDMMigration() {
 		require.True(t, orbitConfigResp.Notifications.NeedsMDMMigration)
 		require.False(t, orbitConfigResp.Notifications.RenewEnrollmentProfile)
 
-		// clean up nano tables
-		mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
-			_, err := q.ExecContext(context.Background(), `
-			DELETE FROM nano_enrollments WHERE id = ?
-			`, host.UUID)
-			return err
-		})
-		mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
-			_, err := q.ExecContext(context.Background(), `
-			DELETE FROM nano_devices WHERE id = ?
-			`, host.UUID)
-			return err
-		})
-	}
-
-	token := "token_test_migration"
-	host := createOrbitEnrolledHost(t, "darwin", "h", s.ds)
-	createDeviceTokenForHost(t, s.ds, host.ID, token)
-	checkMigrationResponses(host, token)
-	require.NoError(t, s.ds.DeleteHostDEPAssignments(ctx, []string{host.HardwareSerial}))
+		// simulate a device that is manually enrolled to 3rd party
+		err = s.ds.SetOrUpdateMDMData(
+			ctx,
+			host.ID,
+			false,
+			true,
+			"https://simplemdm.com",
+			false,
+			fleet.WellKnownMDMSimpleMDM,
+			"",
+		)
+		require.NoError(t, err)
+		getDesktopResp = fleetDesktopResponse{}
+		res = s.DoRawNoAuth("GET", "/api/latest/fleet/device/"+token+"/desktop", nil, http.StatusOK)
+		require.NoError(t, json.NewDecoder(res.Body).Decode(&getDesktopResp))
+		require.NoError(t, res.Body.Close())
+		require.NoError(t, getDesktopResp.Err)
+		require.Zero(t, *getDesktopResp.FailingPolicies)
+		require.True(t, getDesktopResp.Notifications.NeedsMDMMigration)
+		require.False(t, getDesktopResp.Notifications.RenewEnrollmentProfile)
+		require.Equal(t, acResp.OrgInfo.OrgLogoURL, getDesktopResp.Config.OrgInfo.OrgLogoURL)
+		require.Equal(t, acResp.OrgInfo.OrgLogoURLLightBackground, getDesktopResp.Config.OrgInfo.OrgLogoURLLightBackground)
+		require.Equal(t, acResp.OrgInfo.ContactURL, getDesktopResp.Config.OrgInfo.ContactURL)
+		require.Equal(t, acResp.OrgInfo.OrgName, getDesktopResp.Config.OrgInfo.OrgName)
+		require.Equal(t, acResp.MDM.MacOSMigration.Mode, getDesktopResp.Config.MDM.MacOSMigration.Mode)
+
+		orbitConfigResp = orbitGetConfigResponse{}
+		s.DoJSON("POST", "/api/fleet/orbit/config", json.RawMessage(fmt.Sprintf(`{"orbit_node_key": %q}`, *host.OrbitNodeKey)), http.StatusOK, &orbitConfigResp)
+		require.True(t, orbitConfigResp.Notifications.NeedsMDMMigration)
+		require.False(t, orbitConfigResp.Notifications.RenewEnrollmentProfile)
+
+		// clean up nano tables
+		mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+			_, err := q.ExecContext(context.Background(), `
+			DELETE FROM nano_enrollments WHERE id = ?
+			`, host.UUID)
+			return err
+		})
+		mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+			_, err := q.ExecContext(context.Background(), `
+			DELETE FROM nano_devices WHERE id = ?
+			`, host.UUID)
+			return err
+		})
+	}
+
+	token := "token_test_migration"
+	host := createOrbitEnrolledHost(t, "darwin", "h", s.ds)
+	createDeviceTokenForHost(t, s.ds, host.ID, token)
+	checkMigrationResponses(host, token)
+	require.NoError(t, s.ds.DeleteHostDEPAssignments(ctx, []string{host.HardwareSerial}))
 
 	tm, err := s.ds.NewTeam(ctx, &fleet.Team{Name: "team-1"})
 	require.NoError(t, err)
@@ -5422,7 +5830,7 @@ func (s *integrationMDMTestSuite) TestOrbitConfigNudgeSettings() {
 
 	resp = orbitGetConfigResponse{}
 	s.DoJSON("POST", "/api/fleet/orbit/config", json.RawMessage(fmt.Sprintf(`{"orbit_node_key": %q}`, *h.OrbitNodeKey)), http.StatusOK, &resp)
-	wantCfg, err := fleet.NewNudgeConfig(fleet.MacOSUpdates{Deadline: optjson.SetString("2022-01-04"), MinimumVersion: optjson.SetString("12.1.3")})
+	wantCfg, err := fleet.NewNudgeConfig(fleet.AppleOSUpdateSettings{Deadline: optjson.SetString("2022-01-04"), MinimumVersion: optjson.SetString("12.1.3")})
 	require.NoError(t, err)
 	require.Equal(t, wantCfg, resp.NudgeConfig)
 	require.Equal(t, wantCfg.OSVersionRequirements[0].RequiredInstallationDate.String(), "2022-01-04 04:00:00 +0000 UTC")
@@ -5450,7 +5858,7 @@ func (s *integrationMDMTestSuite) TestOrbitConfigNudgeSettings() {
 	var tmResp teamResponse
 	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", team.ID), fleet.TeamPayload{
 		MDM: &fleet.TeamPayloadMDM{
-			MacOSUpdates: &fleet.MacOSUpdates{
+			MacOSUpdates: &fleet.AppleOSUpdateSettings{
 				Deadline:       optjson.SetString("1992-01-01"),
 				MinimumVersion: optjson.SetString("13.1.1"),
 			},
@@ -5460,7 +5868,7 @@ func (s *integrationMDMTestSuite) TestOrbitConfigNudgeSettings() {
 
 	resp = orbitGetConfigResponse{}
 	s.DoJSON("POST", "/api/fleet/orbit/config", json.RawMessage(fmt.Sprintf(`{"orbit_node_key": %q}`, *h.OrbitNodeKey)), http.StatusOK, &resp)
-	wantCfg, err = fleet.NewNudgeConfig(fleet.MacOSUpdates{Deadline: optjson.SetString("1992-01-01"), MinimumVersion: optjson.SetString("13.1.1")})
+	wantCfg, err = fleet.NewNudgeConfig(fleet.AppleOSUpdateSettings{Deadline: optjson.SetString("1992-01-01"), MinimumVersion: optjson.SetString("13.1.1")})
 	require.NoError(t, err)
 	require.Equal(t, wantCfg, resp.NudgeConfig)
 	require.Equal(t, wantCfg.OSVersionRequirements[0].RequiredInstallationDate.String(), "1992-01-01 04:00:00 +0000 UTC")
@@ -5482,7 +5890,7 @@ func (s *integrationMDMTestSuite) TestOrbitConfigNudgeSettings() {
 
 	resp = orbitGetConfigResponse{}
 	s.DoJSON("POST", "/api/fleet/orbit/config", json.RawMessage(fmt.Sprintf(`{"orbit_node_key": %q}`, *h2.OrbitNodeKey)), http.StatusOK, &resp)
-	wantCfg, err = fleet.NewNudgeConfig(fleet.MacOSUpdates{Deadline: optjson.SetString("2022-01-04"), MinimumVersion: optjson.SetString("12.1.3")})
+	wantCfg, err = fleet.NewNudgeConfig(fleet.AppleOSUpdateSettings{Deadline: optjson.SetString("2022-01-04"), MinimumVersion: optjson.SetString("12.1.3")})
 	require.NoError(t, err)
 	require.Equal(t, wantCfg, resp.NudgeConfig)
 	require.Equal(t, wantCfg.OSVersionRequirements[0].RequiredInstallationDate.String(), "2022-01-04 04:00:00 +0000 UTC")
@@ -6872,14 +7280,13 @@ func (s *integrationMDMTestSuite) TestMDMEnabledAndConfigured() {
 			Token:  uuid.New().String(),
 			Bytes:  []byte("foo"),
 			Sha256: []byte("foo-sha256"),
-		}))
+		}, nil))
 
 		// add new setup assistant
 		_, err := s.ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{
-			TeamID:      teamID,
-			Name:        "bar",
-			ProfileUUID: uuid.New().String(),
-			Profile:     []byte("{}"),
+			TeamID:  teamID,
+			Name:    "bar",
+			Profile: []byte("{}"),
 		})
 		require.NoError(t, err)
 	}
@@ -7557,11 +7964,10 @@ func (s *integrationMDMTestSuite) runWorker() {
 }
 
 func (s *integrationMDMTestSuite) runDEPSchedule() {
-	ch := make(chan bool)
-	s.onDEPScheduleDone = func() { close(ch) }
-	_, err := s.depSchedule.Trigger()
+	ctx := context.Background()
+	fleetSyncer := apple_mdm.NewDEPService(s.ds, s.depStorage, s.logger)
+	err := fleetSyncer.RunAssigner(ctx)
 	require.NoError(s.T(), err)
-	<-ch
 }
 
 func (s *integrationMDMTestSuite) runIntegrationsSchedule() {
@@ -8292,21 +8698,40 @@ func (s *integrationMDMTestSuite) TestLockUnlockWipeMacOS() {
 
 	// lock the host without viewing the PIN
 	s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/lock", host.ID), nil, http.StatusNoContent)
-
 }
 
-func (s *integrationMDMTestSuite) TestZCustomConfigurationWebURL() {
+func (s *integrationMDMTestSuite) TestCustomConfigurationWebURL() {
 	t := s.T()
 
 	acResp := appConfigResponse{}
 	s.DoJSON("GET", "/api/latest/fleet/config", nil, http.StatusOK, &acResp)
 
+	s.enableABM(t.Name())
 	var lastSubmittedProfile *godep.Profile
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		encoder := json.NewEncoder(w)
 
 		switch r.URL.Path {
+		case "/server/devices", "/devices/sync":
+			encoder := json.NewEncoder(w)
+			err := encoder.Encode(godep.DeviceResponse{
+				Devices: []godep.Device{
+					{
+						SerialNumber: "FAKE-1",
+						Model:        "Mac Mini",
+						OS:           "osx",
+						OpType:       "added",
+					},
+					{
+						SerialNumber: "FAKE-2",
+						Model:        "Mac Mini",
+						OS:           "osx",
+						OpType:       "added",
+					},
+				},
+			})
+			require.NoError(t, err)
 		case "/profile":
 			lastSubmittedProfile = &godep.Profile{}
 			rawProfile, err := io.ReadAll(r.Body)
@@ -8325,6 +8750,9 @@ func (s *integrationMDMTestSuite) TestZCustomConfigurationWebURL() {
 		}
 	}))
 
+	// run once to ingest the devices
+	s.runDEPSchedule()
+
 	// disable first to make sure we start in the desired state
 	acResp = appConfigResponse{}
 	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
@@ -8353,6 +8781,7 @@ func (s *integrationMDMTestSuite) TestZCustomConfigurationWebURL() {
 
 	// assign the DEP profile and assert that contains the right values for the URL
 	s.runWorker()
+	require.NotNil(t, lastSubmittedProfile)
 	require.Contains(t, lastSubmittedProfile.ConfigurationWebURL, acResp.ServerSettings.ServerURL+"/mdm/sso")
 
 	// trying to set a custom configuration_web_url fails because end user authentication is enabled
@@ -8382,6 +8811,7 @@ func (s *integrationMDMTestSuite) TestZCustomConfigurationWebURL() {
 
 	// assign the DEP profile and assert that contains the right values for the URL
 	s.runWorker()
+	require.NotNil(t, lastSubmittedProfile)
 	require.Contains(t, lastSubmittedProfile.ConfigurationWebURL, acResp.ServerSettings.ServerURL+"/api/mdm/apple/enroll?token=")
 
 	// setting a custom configuration_web_url succeeds because user authentication is disabled
@@ -8394,6 +8824,7 @@ func (s *integrationMDMTestSuite) TestZCustomConfigurationWebURL() {
 
 	// assign the DEP profile and assert that contains the right values for the URL
 	s.runWorker()
+	require.NotNil(t, lastSubmittedProfile)
 	require.Contains(t, lastSubmittedProfile.ConfigurationWebURL, "https://foo.example.com")
 
 	// try to enable end user auth again, it fails because configuration_web_url is set
@@ -8430,8 +8861,13 @@ func (s *integrationMDMTestSuite) TestZCustomConfigurationWebURL() {
 	require.Len(t, applyResp.TeamIDsByName, 1)
 	teamID := applyResp.TeamIDsByName[t.Name()]
 
+	// transfer a host to the team to ensure all ABM calls are made
+	h, err := s.ds.HostByIdentifier(context.Background(), "FAKE-1")
+	require.NoError(t, err)
+	s.DoJSON("POST", "/api/latest/fleet/hosts/transfer", addHostsToTeamRequest{TeamID: &teamID, HostIDs: []uint{h.ID}}, http.StatusOK, &addHostsToTeamResponse{})
+
 	// re-set the global state to configure MDM SSO
-	err := s.ds.DeleteMDMAppleSetupAssistant(context.Background(), nil)
+	err = s.ds.DeleteMDMAppleSetupAssistant(context.Background(), nil)
 	require.NoError(t, err)
 	acResp = appConfigResponse{}
 	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
@@ -8805,8 +9241,7 @@ func (s *integrationMDMTestSuite) TestABMAssetManagement() {
 	t := s.T()
 	ctx := context.Background()
 
-	// ensure enable ABM again for other tests
-	t.Cleanup(s.enableABM)
+	s.enableABM(t.Name())
 
 	// Validate error when server private key not set
 	testSetEmptyPrivateKey = true
@@ -8822,21 +9257,21 @@ func (s *integrationMDMTestSuite) TestABMAssetManagement() {
 	require.Nil(t, abmResp.Err)
 	require.NotEmpty(t, abmResp.PublicKey)
 
+	var tokensResp listABMTokensResponse
+	s.DoJSON("GET", "/api/latest/fleet/abm_tokens", nil, http.StatusOK, &tokensResp)
+	tok := s.getABMTokenByName(t.Name(), tokensResp.Tokens)
+
 	// disable ABM
-	s.Do("DELETE", "/api/latest/fleet/mdm/apple/abm_token", nil, http.StatusNoContent)
-	assets, err := s.ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{
-		fleet.MDMAssetABMCert,
-		fleet.MDMAssetABMKey,
-		fleet.MDMAssetABMToken,
-	})
+	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/abm_tokens/%d", tok.ID), nil, http.StatusNoContent)
+	tok, err := s.ds.GetABMTokenByOrgName(ctx, t.Name())
 	var nfe fleet.NotFoundError
 	require.ErrorAs(t, err, &nfe)
-	require.Nil(t, assets)
+	require.Nil(t, tok)
 
-	// try to upload a token without a keypair
-	s.uploadABMToken([]byte("foo"), http.StatusBadRequest, "Please generate a keypair first.")
+	// try to upload an invalid token
+	s.uploadABMToken([]byte("foo"), http.StatusBadRequest, "Please provide a valid token from Apple Business Manager")
 
-	// enable ABM again, creates a new keypair because the previous one was deleted
+	// enable ABM again
 	var newABMResp generateABMKeyPairResponse
 	s.DoJSON("GET", "/api/latest/fleet/mdm/apple/abm_public_key", nil, http.StatusOK, &newABMResp)
 	require.Nil(t, newABMResp.Err)
@@ -8844,9 +9279,8 @@ func (s *integrationMDMTestSuite) TestABMAssetManagement() {
 	block, _ := pem.Decode(newABMResp.PublicKey)
 	require.NotNil(t, block)
 	require.Equal(t, "CERTIFICATE", block.Type)
-	require.NotEqual(t, abmResp.PublicKey, newABMResp.PublicKey)
 
-	// as long as the certs are not deleted, we should return the same values to support renewing the token
+	// we should always return the same values to support renewing the token
 	var renewABMResp generateABMKeyPairResponse
 	s.DoJSON("GET", "/api/latest/fleet/mdm/apple/abm_public_key", nil, http.StatusOK, &renewABMResp)
 	require.Nil(t, renewABMResp.Err)
@@ -8854,10 +9288,10 @@ func (s *integrationMDMTestSuite) TestABMAssetManagement() {
 	require.Equal(t, renewABMResp.PublicKey, newABMResp.PublicKey)
 
 	// simulate a renew flow
-	s.enableABM()
+	s.enableABM(t.Name())
 }
 
-func (s *integrationMDMTestSuite) enableABM() {
+func (s *integrationMDMTestSuite) enableABM(orgName string) {
 	t := s.T()
 	var abmResp generateABMKeyPairResponse
 	s.DoJSON("GET", "/api/latest/fleet/mdm/apple/abm_public_key", nil, http.StatusOK, &abmResp)
@@ -8894,6 +9328,16 @@ func (s *integrationMDMTestSuite) enableABM() {
 	encryptedToken, err := pkcs7.Encrypt([]byte(smimeToken), []*x509.Certificate{cert})
 	require.NoError(t, err)
 
+	s.mockDEPResponse(apple_mdm.UnsavedABMTokenOrgName, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		switch r.URL.Path {
+		case "/session":
+			_, _ = w.Write([]byte(`{"auth_session_token": "xyz"}`))
+		case "/account":
+			_, _ = w.Write([]byte(fmt.Sprintf(`{"admin_id": "abc", "org_name": %q}`, orgName)))
+		}
+	}))
+
 	// upload the encrypted token
 	smimeMessage := fmt.Sprintf(
 		"Content-Type: application/pkcs7-mime; name=\"smime.p7m\"; smime-type=enveloped-data\r\n"+
@@ -8908,12 +9352,31 @@ func (s *integrationMDMTestSuite) enableABM() {
 	assets, err := s.ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{
 		fleet.MDMAssetABMCert,
 		fleet.MDMAssetABMKey,
-		fleet.MDMAssetABMToken,
 	})
 	require.NoError(t, err)
-	require.Len(t, assets, 3)
-	require.Equal(t, smimeMessage, string(assets[fleet.MDMAssetABMToken].Value))
+	require.Len(t, assets, 2)
 	require.Equal(t, abmResp.PublicKey, assets[fleet.MDMAssetABMCert].Value)
+
+	tok, err := s.ds.GetABMTokenByOrgName(ctx, orgName)
+	require.NoError(t, err)
+	require.Equal(t, orgName, tok.OrganizationName)
+
+	// do a dummy call so the nanodep client updates the org name in
+	// nano_dep_names, and leave the mock set with a dummy response
+	s.mockDEPResponse(orgName, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		switch r.URL.Path {
+		case "/session":
+			_, _ = w.Write([]byte(`{"auth_session_token": "xyz"}`))
+		case "/account":
+			_, _ = w.Write([]byte(fmt.Sprintf(`{"admin_id": "abc", "org_name": %q}`, orgName)))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	depClient := apple_mdm.NewDEPClient(s.depStorage, s.ds, s.logger)
+	_, err = depClient.AccountDetail(ctx, orgName)
+	require.NoError(t, err)
 }
 
 func (s *integrationMDMTestSuite) appleCoreCertsSetup() {
@@ -8974,7 +9437,7 @@ func (s *integrationMDMTestSuite) appleCoreCertsSetup() {
 	certDER, err := x509.CreateCertificate(rand.Reader, certTemplate, testCert, csr.PublicKey, testKey)
 	require.NoError(t, err)
 	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
-	s.uploadAPNSCert(certPEM, http.StatusAccepted, "")
+	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/apns_certificate", "certificate", "certificate.pem", certPEM, http.StatusAccepted, "", nil)
 
 	assets, err = s.ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{fleet.MDMAssetCACert, fleet.MDMAssetCAKey, fleet.MDMAssetAPNSKey, fleet.MDMAssetAPNSCert})
 	require.NoError(t, err)
@@ -9001,7 +9464,7 @@ func (s *integrationMDMTestSuite) uploadABMToken(encryptedToken []byte, expected
 		"Authorization": fmt.Sprintf("Bearer %s", s.token),
 	}
 
-	res := s.DoRawWithHeaders("POST", "/api/latest/fleet/mdm/apple/abm_token", b.Bytes(), expectedStatus, headers)
+	res := s.DoRawWithHeaders("POST", "/api/latest/fleet/abm_tokens", b.Bytes(), expectedStatus, headers)
 	if wantErr != "" {
 		errMsg := extractServerErrorText(res.Body)
 		assert.Contains(t, errMsg, wantErr)
@@ -9024,7 +9487,8 @@ func (s *integrationMDMTestSuite) TestSilentMigrationGotchas() {
 	require.False(t, *hostResp.Host.MDM.ConnectedToFleet)
 
 	// simulate that the device is assigned to Fleet in ABM
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.enableABM(t.Name())
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		switch r.URL.Path {
 		case "/session":
@@ -9156,12 +9620,111 @@ func (s *integrationMDMTestSuite) TestSilentMigrationGotchas() {
 	require.False(t, resp.Notifications.NeedsMDMMigration)
 }
 
+func (s *integrationMDMTestSuite) TestAPNsPushCron() {
+	t := s.T()
+	ctx := context.Background()
+
+	s.Do("POST", "/api/v1/fleet/mdm/profiles/batch", batchSetMDMProfilesRequest{Profiles: []fleet.MDMProfileBatchPayload{
+		{Name: "N1", Contents: mobileconfigForTest("N1", "I1")},
+		{Name: "N2", Contents: syncMLForTest("./Foo/Bar")},
+		{Name: "N4", Contents: declarationForTest("D1")},
+	}}, http.StatusNoContent)
+
+	// macOS host, MDM on
+	_, macDevice := createHostThenEnrollMDM(s.ds, s.server.URL, t)
+	// windows host, MDM on
+	createWindowsHostThenEnrollMDM(s.ds, s.server.URL, t)
+	// linux and darwin, MDM off
+	createOrbitEnrolledHost(t, "linux", "linux_host", s.ds)
+	createOrbitEnrolledHost(t, "darwin", "mac_not_enrolled", s.ds)
+
+	// we're going to modify this mock, make sure we restore its default
+	originalPushMock := s.pushProvider.PushFunc
+	defer func() { s.pushProvider.PushFunc = originalPushMock }()
+
+	var recordedPushes []*mdm.Push
+	s.pushProvider.PushFunc = func(pushes []*mdm.Push) (map[string]*push.Response, error) {
+		recordedPushes = pushes
+		return mockSuccessfulPush(pushes)
+	}
+
+	// trigger the reconciliation schedule
+	err := ReconcileAppleProfiles(ctx, s.ds, s.mdmCommander, s.logger)
+	require.NoError(t, err)
+	require.Len(t, recordedPushes, 1)
+	recordedPushes = nil
+
+	// triggering the schedule again doesn't send any more pushes
+	err = ReconcileAppleProfiles(ctx, s.ds, s.mdmCommander, s.logger)
+	require.NoError(t, err)
+	require.Len(t, recordedPushes, 0)
+	recordedPushes = nil
+
+	// the cron to trigger pushes sends a new push request each time it
+	// runs if there are pending commands
+	for i := 0; i < 3; i++ {
+		err := SendPushesToPendingDevices(ctx, s.ds, s.mdmCommander, s.logger)
+		require.NoError(t, err)
+		require.Len(t, recordedPushes, 1)
+		recordedPushes = nil
+	}
+
+	// device acknowledges the commands
+	cmd, err := macDevice.Idle()
+	require.NoError(t, err)
+	require.NotNil(t, cmd)
+	for cmd != nil {
+		cmd, err = macDevice.Acknowledge(cmd.CommandUUID)
+		require.NoError(t, err)
+	}
+
+	// no more pushes are enqueued
+	err = SendPushesToPendingDevices(ctx, s.ds, s.mdmCommander, s.logger)
+	require.NoError(t, err)
+	require.Len(t, recordedPushes, 0)
+}
+
 func (s *integrationMDMTestSuite) TestMDMRequestWithoutCerts() {
 	t := s.T()
 	res := s.DoRawNoAuth("PUT", "/mdm/apple/mdm", nil, http.StatusBadRequest)
 	require.NoError(t, res.Body.Close())
 }
 
+func (s *integrationMDMTestSuite) TestMDMEnrollDoesntClearLastEnrolledAtForMacOS() {
+	t := s.T()
+
+	// Enroll to Fleet with fleetd first.
+	desktopToken := uuid.New().String()
+	lastEnrolledAt := time.Now().UTC()
+	mdmDevice := mdmtest.NewTestMDMClientAppleDesktopManual(s.server.URL, desktopToken)
+	fleetHost, err := s.ds.NewHost(context.Background(), &fleet.Host{
+		DetailUpdatedAt: time.Now(),
+		LabelUpdatedAt:  time.Now(),
+		PolicyUpdatedAt: time.Now(),
+		LastEnrolledAt:  lastEnrolledAt,
+		SeenTime:        time.Now().Add(-1 * time.Minute),
+		OsqueryHostID:   ptr.String(t.Name() + uuid.New().String()),
+		NodeKey:         ptr.String(t.Name() + uuid.New().String()),
+		Hostname:        fmt.Sprintf("%sfoo.local", t.Name()),
+		Platform:        "darwin",
+
+		UUID:           mdmDevice.UUID,
+		HardwareSerial: mdmDevice.SerialNumber,
+	})
+	require.NoError(t, err)
+	err = s.ds.SetOrUpdateDeviceAuthToken(context.Background(), fleetHost.ID, desktopToken)
+	require.NoError(t, err)
+
+	// Enroll with MDM manually after.
+	err = mdmDevice.Enroll()
+	require.NoError(t, err)
+
+	hostResp := getHostResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d", fleetHost.ID), nil, http.StatusOK, &hostResp)
+	require.NotNil(t, hostResp.Host)
+	require.Equal(t, lastEnrolledAt.Truncate(1*time.Second).UTC(), hostResp.Host.LastEnrolledAt.Truncate(1*time.Second).UTC())
+}
+
 func (s *integrationMDMTestSuite) TestConnectedToFleetWithoutCheckout() {
 	t := s.T()
 	ctx := context.Background()
@@ -9201,3 +9764,1232 @@ func (s *integrationMDMTestSuite) TestConnectedToFleetWithoutCheckout() {
 	require.NotNil(t, hostResp.Host.MDM.ConnectedToFleet)
 	require.False(t, *hostResp.Host.MDM.ConnectedToFleet)
 }
+
+func (s *integrationMDMTestSuite) TestBatchAssociateAppStoreApps() {
+	t := s.T()
+	batchURL := "/api/latest/fleet/software/app_store_apps/batch"
+
+	// a team name is required (we don't allow installers for "no team")
+	s.Do("POST", batchURL, batchAssociateAppStoreAppsRequest{}, http.StatusBadRequest)
+
+	// non-existent team
+	s.Do("POST", batchURL, batchAssociateAppStoreAppsRequest{}, http.StatusNotFound, "team_name", "foo")
+
+	// create a team
+	tmGood, err := s.ds.NewTeam(context.Background(), &fleet.Team{
+		Name:        t.Name() + " good",
+		Description: "desc",
+	})
+	require.NoError(t, err)
+
+	// create a team
+	tmEmpty, err := s.ds.NewTeam(context.Background(), &fleet.Team{
+		Name:        t.Name() + " empty",
+		Description: "desc",
+	})
+	require.NoError(t, err)
+
+	// No vpp token set, no association.
+	s.Do("POST", batchURL, batchAssociateAppStoreAppsRequest{}, http.StatusUnprocessableEntity, "team_name", tmGood.Name)
+
+	// No vpp token set, try association
+	// FIXME
+	// s.Do("POST", batchURL, batchAssociateAppStoreAppsRequest{Apps: []fleet.VPPBatchPayload{{AppStoreID: s.appleVPPConfigSrvConfig.Assets[0].AdamID}}}, http.StatusUnprocessableEntity, "team_name", tmGood.Name)
+
+	// Valid token
+	orgName := "Fleet Device Management Inc."
+	token := "mycooltoken"
+	expDate := "2025-06-24T15:50:50+0000"
+	tokenJSON := fmt.Sprintf(`{"expDate":"%s","token":"%s","orgName":"%s"}`, expDate, token, orgName)
+	t.Setenv("FLEET_DEV_VPP_URL", s.appleVPPConfigSrv.URL)
+	var vppRes uploadVPPTokenResponse
+	s.uploadDataViaForm("/api/latest/fleet/vpp_tokens", "token", "token.vpptoken", []byte(base64.StdEncoding.EncodeToString([]byte(tokenJSON))), http.StatusAccepted, "", &vppRes)
+
+	var resPatchVPP patchVPPTokensTeamsResponse
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d/teams", vppRes.Token.ID), patchVPPTokensTeamsRequest{TeamIDs: []uint{}}, http.StatusOK, &resPatchVPP)
+
+	// Remove all vpp associations from team with no members
+	s.Do("POST", batchURL, batchAssociateAppStoreAppsRequest{}, http.StatusNoContent, "team_name", tmGood.Name)
+
+	// host with valid serial number
+	hValid, err := s.ds.NewHost(context.Background(), &fleet.Host{
+		DetailUpdatedAt: time.Now(),
+		LabelUpdatedAt:  time.Now(),
+		PolicyUpdatedAt: time.Now(),
+		HardwareSerial:  "123",
+		SeenTime:        time.Now().Add(-1 * time.Minute),
+		OsqueryHostID:   ptr.String(t.Name() + uuid.New().String()),
+		NodeKey:         ptr.String(t.Name() + uuid.New().String()),
+		Hostname:        fmt.Sprintf("%sfoo.local", t.Name()),
+		Platform:        "darwin",
+	})
+	require.NoError(t, err)
+	err = s.ds.AddHostsToTeam(context.Background(), &tmGood.ID, []uint{hValid.ID})
+	require.NoError(t, err)
+
+	ctx := context.Background()
+
+	assoc, err := s.ds.GetAssignedVPPApps(ctx, &tmGood.ID)
+	require.NoError(t, err)
+	require.Len(t, assoc, 0)
+
+	// Remove all vpp associations from team with no members
+	s.Do("POST", batchURL, batchAssociateAppStoreAppsRequest{}, http.StatusNoContent, "team_name", tmGood.Name)
+
+	// Incorrect type check
+	incorrectTypes := struct {
+		Apps []struct {
+			AppStoreID  int  `json:"app_store_id"`
+			SelfService bool `json:"self_service"`
+		} `json:"app_store_apps"`
+	}{
+		Apps: []struct {
+			AppStoreID  int  `json:"app_store_id"`
+			SelfService bool `json:"self_service"`
+		}{
+			{
+				AppStoreID: 1,
+			},
+		},
+	}
+	badTypeReq := s.Do("POST", batchURL, incorrectTypes, http.StatusBadRequest, "team_name", tmGood.Name)
+	badTypeBody := extractServerErrorText(badTypeReq.Body)
+	assert.Contains(t, badTypeBody, "must be a string")
+
+	// Associating an app we don't own
+	s.Do("POST", batchURL, batchAssociateAppStoreAppsRequest{Apps: []fleet.VPPBatchPayload{{AppStoreID: "fake-app"}}}, http.StatusUnprocessableEntity, "team_name", tmGood.Name)
+
+	assoc, err = s.ds.GetAssignedVPPApps(ctx, &tmGood.ID)
+	require.NoError(t, err)
+	require.Len(t, assoc, 0)
+
+	// Associating an app we own
+	s.Do("POST", batchURL, batchAssociateAppStoreAppsRequest{Apps: []fleet.VPPBatchPayload{{AppStoreID: s.appleVPPConfigSrvConfig.Assets[0].AdamID}}}, http.StatusNoContent, "team_name", tmGood.Name)
+
+	assoc, err = s.ds.GetAssignedVPPApps(ctx, &tmGood.ID)
+	require.NoError(t, err)
+	require.Len(t, assoc, 1)
+	assert.Contains(t, assoc, fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[0].AdamID, Platform: fleet.MacOSPlatform})
+
+	// Associating one good and one bad app
+	s.Do("POST",
+		batchURL,
+		batchAssociateAppStoreAppsRequest{Apps: []fleet.VPPBatchPayload{
+			{AppStoreID: s.appleVPPConfigSrvConfig.Assets[0].AdamID},
+			{AppStoreID: "fake-app"},
+		}}, http.StatusUnprocessableEntity, "team_name", tmGood.Name,
+	)
+
+	assoc, err = s.ds.GetAssignedVPPApps(ctx, &tmGood.ID)
+	require.NoError(t, err)
+	require.Len(t, assoc, 1)
+
+	// Associating two apps we own
+	s.Do("POST",
+		batchURL,
+		batchAssociateAppStoreAppsRequest{
+			Apps: []fleet.VPPBatchPayload{
+				{AppStoreID: s.appleVPPConfigSrvConfig.Assets[0].AdamID},
+				{AppStoreID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, SelfService: true},
+			},
+		}, http.StatusNoContent, "team_name", tmGood.Name,
+	)
+	assoc, err = s.ds.GetAssignedVPPApps(ctx, &tmGood.ID)
+	require.NoError(t, err)
+	require.Len(t, assoc, 4)
+	assert.Contains(t, assoc, fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[0].AdamID, Platform: fleet.MacOSPlatform})
+	assert.Contains(t, assoc, fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.IOSPlatform})
+	assert.Contains(t, assoc, fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.IPadOSPlatform})
+	// Only macOS version should be self-service
+	assert.Equal(t, fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.MacOSPlatform}, SelfService: true},
+		assoc[fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.MacOSPlatform}])
+
+	// Reverse self-service associations
+	// Associating two apps we own
+	s.Do("POST",
+		batchURL,
+		batchAssociateAppStoreAppsRequest{
+			Apps: []fleet.VPPBatchPayload{
+				{AppStoreID: s.appleVPPConfigSrvConfig.Assets[0].AdamID, SelfService: true},
+				{AppStoreID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, SelfService: false},
+			},
+		}, http.StatusNoContent, "team_name", tmGood.Name,
+	)
+	assoc, err = s.ds.GetAssignedVPPApps(ctx, &tmGood.ID)
+	require.NoError(t, err)
+	require.Len(t, assoc, 4)
+	assert.Equal(t, fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[0].AdamID, Platform: fleet.MacOSPlatform}, SelfService: true}, assoc[fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[0].AdamID, Platform: fleet.MacOSPlatform}])
+	assert.Equal(t, fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.IOSPlatform}}, assoc[fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.IOSPlatform}])
+	assert.Equal(t, fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.IPadOSPlatform}}, assoc[fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.IPadOSPlatform}])
+	assert.Equal(t, fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.MacOSPlatform}}, assoc[fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.MacOSPlatform}])
+
+	// Associate an app with a team with no team members
+	s.Do("POST", batchURL, batchAssociateAppStoreAppsRequest{Apps: []fleet.VPPBatchPayload{{AppStoreID: s.appleVPPConfigSrvConfig.Assets[0].AdamID}}}, http.StatusNoContent, "team_name", tmEmpty.Name)
+
+	// Remove all vpp associations
+	s.Do("POST", batchURL, batchAssociateAppStoreAppsRequest{}, http.StatusNoContent, "team_name", tmGood.Name)
+
+	assoc, err = s.ds.GetAssignedVPPApps(ctx, &tmGood.ID)
+	require.NoError(t, err)
+	require.Len(t, assoc, 0)
+}
+
+func (s *integrationMDMTestSuite) TestInvalidCommandUUID() {
+	t := s.T()
+	_, device := createHostThenEnrollMDM(s.ds, s.server.URL, t)
+	s.runWorker()
+	cmd, err := device.Acknowledge("foo")
+	require.NoError(t, err)
+	require.NotNil(t, cmd)
+}
+
+func (s *integrationMDMTestSuite) TestEnrollAfterDEPSyncIOSIPadOS() {
+	t := s.T()
+
+	h, _ := s.createAppleMobileHostThenEnrollMDM("ios")
+
+	// fetch the host, it will match the one created above
+	// (NOTE: cannot check the returned OrbitNodeKey, this field is not part of the response)
+	var hostResp getHostResponse
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d", h.ID), nil, http.StatusOK, &hostResp)
+	require.Equal(t, h.ID, hostResp.Host.ID)
+	require.NotEqual(t, h.LastEnrolledAt, hostResp.Host.LastEnrolledAt)
+
+	h, _ = s.createAppleMobileHostThenEnrollMDM("ipados")
+
+	// fetch the host, it will match the one created above
+	// (NOTE: cannot check the returned OrbitNodeKey, this field is not part of the response)
+	hostResp = getHostResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d", h.ID), nil, http.StatusOK, &hostResp)
+	require.Equal(t, h.ID, hostResp.Host.ID)
+	require.NotEqual(t, h.LastEnrolledAt, hostResp.Host.LastEnrolledAt)
+
+	// list commands returns empty set -- no MDM commands should be queued at this point
+	var listCmdResp listMDMAppleCommandsResponse
+	s.DoJSON("GET", "/api/latest/fleet/mdm/apple/commands", nil, http.StatusOK, &listCmdResp)
+	require.Empty(t, listCmdResp.Results)
+}
+
+func (s *integrationMDMTestSuite) TestRefetchIOSIPadOS() {
+	t := s.T()
+
+	// Try to refetch host that is not MDM enrolled
+	serialNumber := mdmtest.RandSerialNumber()
+	fleetHost, err := s.ds.NewHost(context.Background(), &fleet.Host{
+		HardwareSerial:   serialNumber,
+		Platform:         "ipados",
+		LastEnrolledAt:   time.Now(),
+		DetailUpdatedAt:  time.Now(),
+		RefetchRequested: true,
+	})
+	require.NoError(t, err)
+	r := s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/refetch", fleetHost.ID), nil, http.StatusUnprocessableEntity, "error",
+		"host is not enrolled in MDM")
+	assert.Contains(t, extractServerErrorText(r.Body), "Host does not have MDM turned on")
+
+	// Enroll host
+	host, mdmClient := s.createAppleMobileHostThenEnrollMDM("ios")
+	require.NoError(t, s.ds.SetOrUpdateMDMData(context.Background(), host.ID, false, true, "https://foo.com", true, "", ""))
+
+	// Refetch host
+	_ = s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/refetch", host.ID), nil, http.StatusOK)
+	const commandsSentPerRefetch = 2
+	commandsSent := commandsSentPerRefetch
+
+	var hostResp getHostResponse
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d", host.ID), nil, http.StatusOK, &hostResp)
+	assert.Equal(t, host.ID, hostResp.Host.ID)
+	assert.True(t, hostResp.Host.RefetchRequested)
+
+	commands, err := s.ds.GetHostMDMCommands(context.Background(), host.ID)
+	require.NoError(t, err)
+	require.Len(t, commands, commandsSent)
+	assert.ElementsMatch(t, []fleet.HostMDMCommand{
+		{HostID: host.ID, CommandType: fleet.RefetchAppsCommandUUIDPrefix},
+		{HostID: host.ID, CommandType: fleet.RefetchDeviceCommandUUIDPrefix},
+	}, commands)
+
+	// Since refetch is already queued up, doing another refetch is a no-op and will not add more MDM commands
+	_ = s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/refetch", host.ID), nil, http.StatusOK)
+
+	// Check the MDM commands and send response
+	cmd, err := mdmClient.Idle()
+	require.NoError(t, err)
+	require.NotNil(t, cmd)
+
+	const deviceName = "My iPhone"
+	expectedSoftware := []fleet.HostSoftwareEntry{
+		{
+			Software: fleet.Software{
+				BundleIdentifier: "com.evernote.iPhone.Evernote",
+				Name:             "Evernote",
+				Version:          "10.98.0",
+				Source:           "ios_apps",
+			},
+		},
+	}
+	require.Equal(t, "InstalledApplicationList", cmd.Command.RequestType)
+	cmd, err = mdmClient.AcknowledgeInstalledApplicationList(mdmClient.UUID, cmd.CommandUUID,
+		[]fleet.Software{expectedSoftware[0].Software})
+	require.NoError(t, err)
+	require.Equal(t, "DeviceInformation", cmd.Command.RequestType)
+	cmd, err = mdmClient.AcknowledgeDeviceInformation(mdmClient.UUID, cmd.CommandUUID, deviceName, "iPhone SE")
+	require.NoError(t, err)
+
+	commands, err = s.ds.GetHostMDMCommands(context.Background(), host.ID)
+	require.NoError(t, err)
+	require.Empty(t, commands)
+
+	hostResp = getHostResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d", host.ID), nil, http.StatusOK, &hostResp)
+	assert.Equal(t, host.ID, hostResp.Host.ID)
+	assert.False(t, hostResp.Host.RefetchRequested)
+	assert.Equal(t, deviceName, hostResp.Host.ComputerName)
+
+	for index := range hostResp.Host.Software {
+		hostResp.Host.Software[index].ID = 0
+	}
+	assert.ElementsMatch(t, expectedSoftware, hostResp.Host.Software)
+
+	// Install the same app for iPadOS
+	hostIPad, mdmClientIPad := s.createAppleMobileHostThenEnrollMDM("ipados")
+
+	// Refetch host
+	_ = s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/refetch", hostIPad.ID), nil, http.StatusOK)
+	commandsSent += commandsSentPerRefetch
+
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d", hostIPad.ID), nil, http.StatusOK, &hostResp)
+	assert.Equal(t, hostIPad.ID, hostResp.Host.ID)
+	assert.True(t, hostResp.Host.RefetchRequested)
+
+	// Check the MDM commands and send response
+	cmd, err = mdmClientIPad.Idle()
+	require.NoError(t, err)
+	require.NotNil(t, cmd)
+
+	const deviceNameIPad = "My iPad"
+	expectedSoftware = []fleet.HostSoftwareEntry{
+		{
+			Software: fleet.Software{
+				BundleIdentifier: "com.evernote.iPhone.Evernote",
+				Name:             "Evernote",
+				Version:          "10.98.0",
+				Source:           "ipados_apps",
+			},
+		},
+	}
+	require.Equal(t, "InstalledApplicationList", cmd.Command.RequestType)
+	cmd, err = mdmClientIPad.AcknowledgeInstalledApplicationList(mdmClientIPad.UUID, cmd.CommandUUID,
+		[]fleet.Software{expectedSoftware[0].Software})
+	require.NoError(t, err)
+	require.Equal(t, "DeviceInformation", cmd.Command.RequestType)
+	cmd, err = mdmClientIPad.AcknowledgeDeviceInformation(mdmClientIPad.UUID, cmd.CommandUUID, deviceNameIPad, "iPad 10")
+	require.NoError(t, err)
+	require.Nil(t, cmd)
+
+	hostResp = getHostResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d", hostIPad.ID), nil, http.StatusOK, &hostResp)
+	assert.Equal(t, hostIPad.ID, hostResp.Host.ID)
+	assert.False(t, hostResp.Host.RefetchRequested)
+	assert.Equal(t, deviceNameIPad, hostResp.Host.ComputerName)
+
+	for index := range hostResp.Host.Software {
+		hostResp.Host.Software[index].ID = 0
+	}
+	assert.ElementsMatch(t, expectedSoftware, hostResp.Host.Software)
+
+	hostsCountTs := time.Now().UTC()
+	require.NoError(t, s.ds.SyncHostsSoftware(context.Background(), hostsCountTs))
+	ctx := context.Background()
+	require.NoError(t, s.ds.SyncHostsSoftwareTitles(ctx, hostsCountTs))
+
+	// Check that we have the correct software titles
+	var resp listSoftwareTitlesResponse
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/software/titles"), nil, http.StatusOK, &resp, "query", "Evernote")
+	expectedTitles := []fleet.SoftwareTitleListResult{
+		{
+			BundleIdentifier: ptr.String("com.evernote.iPhone.Evernote"),
+			Name:             "Evernote",
+			Source:           "ios_apps",
+			HostsCount:       1,
+			VersionsCount:    1,
+		},
+		{
+			BundleIdentifier: ptr.String("com.evernote.iPhone.Evernote"),
+			Name:             "Evernote",
+			Source:           "ipados_apps",
+			HostsCount:       1,
+			VersionsCount:    1,
+		},
+	}
+	require.Len(t, resp.SoftwareTitles, 2)
+	// Cleaning up the response to make it easier to compare using ElementsMatch
+	for index := range resp.SoftwareTitles {
+		resp.SoftwareTitles[index].ID = 0
+		assert.Len(t, resp.SoftwareTitles[index].Versions, 1)
+		resp.SoftwareTitles[index].Versions = nil
+	}
+	assert.ElementsMatch(t, expectedTitles, resp.SoftwareTitles)
+
+	// Delete from software titles table and make sure titles are recreated
+	mysql.ExecAdhocSQL(s.T(), s.ds, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(context.Background(), "DELETE FROM software_titles")
+		return err
+	})
+	hostsCountTs = time.Now().UTC()
+	require.NoError(t, s.ds.ReconcileSoftwareTitles(ctx))
+	require.NoError(t, s.ds.SyncHostsSoftwareTitles(ctx, hostsCountTs))
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/software/titles"), nil, http.StatusOK, &resp, "query", "Evernote")
+	require.Len(t, resp.SoftwareTitles, 2)
+	// Cleaning up the response to make it easier to compare using ElementsMatch
+	for index := range resp.SoftwareTitles {
+		resp.SoftwareTitles[index].ID = 0
+		assert.Len(t, resp.SoftwareTitles[index].Versions, 1)
+		resp.SoftwareTitles[index].Versions = nil
+	}
+	assert.ElementsMatch(t, expectedTitles, resp.SoftwareTitles)
+
+	// Test that software was deleted from device
+	_ = s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/refetch", host.ID), nil, http.StatusOK)
+	commandsSent += commandsSentPerRefetch
+
+	// Check the MDM commands and send response
+	cmd, err = mdmClient.Idle()
+	require.NoError(t, err)
+	require.NotNil(t, cmd)
+	require.Equal(t, "InstalledApplicationList", cmd.Command.RequestType)
+	cmd, err = mdmClient.AcknowledgeInstalledApplicationList(mdmClient.UUID, cmd.CommandUUID, []fleet.Software{})
+	require.NoError(t, err)
+	require.Equal(t, "DeviceInformation", cmd.Command.RequestType)
+	const deviceNameRenamed = "My new iPhone"
+	cmd, err = mdmClient.AcknowledgeDeviceInformation(mdmClient.UUID, cmd.CommandUUID, deviceNameRenamed, "iPhone SE")
+	require.NoError(t, err)
+	require.Nil(t, cmd)
+
+	hostResp = getHostResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d", host.ID), nil, http.StatusOK, &hostResp)
+	assert.Equal(t, host.ID, hostResp.Host.ID)
+	assert.False(t, hostResp.Host.RefetchRequested)
+	assert.Equal(t, deviceNameRenamed, hostResp.Host.ComputerName)
+	assert.Empty(t, hostResp.Host.Software)
+
+	// Mark host as unenrolled and refetch.
+	require.NoError(t, s.ds.UpdateMDMData(ctx, host.ID, false))
+	hostResp = getHostResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d", host.ID), nil, http.StatusOK, &hostResp)
+	require.NoError(t, err)
+	require.NotNil(t, hostResp.Host.MDM.EnrollmentStatus)
+	assert.Equal(t, "Pending", *hostResp.Host.MDM.EnrollmentStatus)
+
+	// Set iOS detail_updated_at as 2 hours in the past.
+	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(ctx, `UPDATE hosts SET detail_updated_at = DATE_SUB(NOW(), INTERVAL 2 HOUR) WHERE id = ?`, host.ID)
+		return err
+	})
+	trigger := triggerRequest{
+		Name: string(fleet.CronAppleMDMIPhoneIPadRefetcher),
+	}
+	_ = s.Do("POST", "/api/latest/fleet/trigger", trigger, http.StatusOK)
+	commandsSent += commandsSentPerRefetch
+
+	// Wait until MDM commands are set up
+	done := make(chan struct{})
+	go func() {
+		ticker := time.NewTicker(100 * time.Millisecond)
+		defer ticker.Stop()
+		for range ticker.C {
+			commands, err = s.ds.GetHostMDMCommands(context.Background(), host.ID)
+			require.NoError(t, err)
+			if len(commands) == commandsSentPerRefetch {
+				done <- struct{}{}
+				return
+			}
+		}
+	}()
+	select {
+	case <-done:
+	case <-time.After(10 * time.Second):
+		t.Error("Timeout: MDM commands not queued up")
+	}
+
+	// Check the MDM commands and send response
+	cmd, err = mdmClient.Idle()
+	require.NoError(t, err)
+	require.NotNil(t, cmd)
+	require.Equal(t, "InstalledApplicationList", cmd.Command.RequestType)
+	cmd, err = mdmClient.AcknowledgeInstalledApplicationList(mdmClient.UUID, cmd.CommandUUID, []fleet.Software{})
+	require.NoError(t, err)
+	require.Equal(t, "DeviceInformation", cmd.Command.RequestType)
+	cmd, err = mdmClient.AcknowledgeDeviceInformation(mdmClient.UUID, cmd.CommandUUID, deviceNameRenamed, "iPhone SE")
+	require.NoError(t, err)
+	require.Nil(t, cmd)
+
+	hostResp = getHostResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d", host.ID), nil, http.StatusOK, &hostResp)
+	assert.Equal(t, host.ID, hostResp.Host.ID)
+	assert.False(t, hostResp.Host.RefetchRequested)
+	require.NotNil(t, hostResp.Host.MDM.EnrollmentStatus)
+	assert.Equal(t, "On (automatic)", *hostResp.Host.MDM.EnrollmentStatus)
+
+	// list commands should return all the commands we sent
+	var listCmdResp listMDMAppleCommandsResponse
+	s.DoJSON("GET", "/api/latest/fleet/mdm/apple/commands", nil, http.StatusOK, &listCmdResp)
+	require.Len(t, listCmdResp.Results, commandsSent)
+}
+
+func (s *integrationMDMTestSuite) TestVPPApps() {
+	t := s.T()
+	// Invalid token
+	t.Setenv("FLEET_DEV_VPP_URL", s.appleVPPConfigSrv.URL+"?invalidToken")
+	s.uploadDataViaForm("/api/latest/fleet/vpp_tokens", "token", "token.vpptoken", []byte("foobar"), http.StatusUnprocessableEntity, "Invalid token. Please provide a valid content token from Apple Business Manager.", nil)
+
+	// Simulate a server error from the Apple API
+	t.Setenv("FLEET_DEV_VPP_URL", s.appleVPPConfigSrv.URL+"?serverError")
+	s.uploadDataViaForm("/api/latest/fleet/vpp_tokens", "token", "token.vpptoken", []byte("foobar"), http.StatusInternalServerError, "Apple VPP endpoint returned error: Internal server error (error number: 9603)", nil)
+
+	// Valid token
+	orgName := "Fleet Device Management Inc."
+	location := "Fleet Location One"
+	token := "mycooltoken"
+	expTime := time.Now().Add(200 * time.Hour).UTC().Round(time.Second)
+	expDate := expTime.Format(fleet.VPPTimeFormat)
+	tokenJSON := fmt.Sprintf(`{"expDate":"%s","token":"%s","orgName":"%s"}`, expDate, token, orgName)
+	t.Setenv("FLEET_DEV_VPP_URL", s.appleVPPConfigSrv.URL)
+	var validToken uploadVPPTokenResponse
+	s.uploadDataViaForm("/api/latest/fleet/vpp_tokens", "token", "token.vpptoken", []byte(base64.StdEncoding.EncodeToString([]byte(tokenJSON))), http.StatusAccepted, "", &validToken)
+
+	s.lastActivityMatches(fleet.ActivityEnabledVPP{}.ActivityName(), "", 0)
+
+	// Get the token
+	var resp getVPPTokensResponse
+	s.DoJSON("GET", "/api/latest/fleet/vpp_tokens", &getVPPTokensRequest{}, http.StatusOK, &resp)
+	require.NoError(t, resp.Err)
+	require.Len(t, resp.Tokens, 1)
+	require.Equal(t, orgName, resp.Tokens[0].OrgName)
+	require.Equal(t, location, resp.Tokens[0].Location)
+	require.Equal(t, expTime, resp.Tokens[0].RenewDate)
+
+	// Create a team
+	var newTeamResp teamResponse
+	s.DoJSON("POST", "/api/latest/fleet/teams", &createTeamRequest{TeamPayload: fleet.TeamPayload{Name: ptr.String("Team 1")}}, http.StatusOK, &newTeamResp)
+	team := newTeamResp.Team
+
+	var resPatchVPP patchVPPTokensTeamsResponse
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d/teams", resp.Tokens[0].ID), patchVPPTokensTeamsRequest{TeamIDs: []uint{}}, http.StatusOK, &resPatchVPP)
+
+	// Get list of VPP apps from "Apple"
+	// We're passing team 1 here, but we haven't added any app store apps to that team, so we get
+	// back all available apps in our VPP location.
+	var appResp getAppStoreAppsResponse
+	s.DoJSON("GET", "/api/latest/fleet/software/app_store_apps", &getAppStoreAppsRequest{}, http.StatusOK, &appResp, "team_id", strconv.Itoa(int(team.ID)))
+	require.NoError(t, appResp.Err)
+	macOSApp := fleet.VPPApp{
+		VPPAppTeam: fleet.VPPAppTeam{
+			VPPAppID: fleet.VPPAppID{
+				AdamID:   "1",
+				Platform: fleet.MacOSPlatform,
+			},
+		},
+		Name:             "App 1",
+		BundleIdentifier: "a-1",
+		IconURL:          "https://example.com/images/1",
+		LatestVersion:    "1.0.0",
+	}
+	iPadOSApp := fleet.VPPApp{
+		VPPAppTeam: fleet.VPPAppTeam{
+			VPPAppID: fleet.VPPAppID{
+				AdamID:   "2",
+				Platform: fleet.IPadOSPlatform,
+			},
+		},
+		Name:             "App 2",
+		BundleIdentifier: "b-2",
+		IconURL:          "https://example.com/images/2",
+		LatestVersion:    "2.0.0",
+	}
+	iOSApp := fleet.VPPApp{
+		VPPAppTeam: fleet.VPPAppTeam{
+			VPPAppID: fleet.VPPAppID{
+				AdamID:   "2",
+				Platform: fleet.IOSPlatform,
+			},
+		},
+		Name:             "App 2",
+		BundleIdentifier: "b-2",
+		IconURL:          "https://example.com/images/2",
+		LatestVersion:    "2.0.0",
+	}
+	expectedApps := []*fleet.VPPApp{
+		&macOSApp,
+		&iPadOSApp,
+		&iOSApp,
+		{
+			VPPAppTeam: fleet.VPPAppTeam{
+				VPPAppID: fleet.VPPAppID{
+					AdamID:   "2",
+					Platform: fleet.MacOSPlatform,
+				},
+			},
+			Name:             "App 2",
+			BundleIdentifier: "b-2",
+			IconURL:          "https://example.com/images/2",
+			LatestVersion:    "2.0.0",
+		},
+		{
+			VPPAppTeam: fleet.VPPAppTeam{
+				VPPAppID: fleet.VPPAppID{
+					AdamID:   "3",
+					Platform: fleet.IPadOSPlatform,
+				},
+			},
+			Name:             "App 3",
+			BundleIdentifier: "c-3",
+			IconURL:          "https://example.com/images/3",
+			LatestVersion:    "3.0.0",
+		},
+	}
+	assert.ElementsMatch(t, expectedApps, appResp.AppStoreApps)
+
+	// Insert/deletion flow for macOS app
+	// Add an app store app to team 1
+	addedApp := expectedApps[0]
+	var addAppResp addAppStoreAppResponse
+	// Add an app store app to non-existent team
+	s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps", &addAppStoreAppRequest{TeamID: ptr.Uint(9999), AppStoreID: addedApp.AdamID}, http.StatusNotFound, &addAppResp)
+
+	s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps", &addAppStoreAppRequest{TeamID: &team.ID, AppStoreID: addedApp.AdamID, SelfService: true}, http.StatusOK, &addAppResp)
+	s.lastActivityMatches(fleet.ActivityAddedAppStoreApp{}.ActivityName(),
+		fmt.Sprintf(`{"team_name": "%s", "software_title": "%s", "app_store_id": "%s", "team_id": %d, "platform": "%s", "self_service": true}`, team.Name,
+			addedApp.Name, addedApp.AdamID, team.ID, addedApp.Platform), 0)
+
+	// Now we should be filtering out the app we added to team 1
+	appResp = getAppStoreAppsResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/software/app_store_apps", &getAppStoreAppsRequest{}, http.StatusOK, &appResp, "team_id", strconv.Itoa(int(team.ID)))
+	require.NoError(t, appResp.Err)
+	assert.ElementsMatch(t, expectedApps[1:], appResp.AppStoreApps)
+
+	// list the software titles for that team, to get the title id of the VPP app
+	var listSw listSoftwareTitlesResponse
+	s.DoJSON("GET", "/api/latest/fleet/software/titles", nil, http.StatusOK, &listSw, "team_id", fmt.Sprint(team.ID), "available_for_install", "true")
+	require.Len(t, listSw.SoftwareTitles, 1)
+	require.True(t, *listSw.SoftwareTitles[0].AppStoreApp.SelfService)
+	macOSTitleID := listSw.SoftwareTitles[0].ID
+
+	// listing with the self-service filter also returns it
+	listSw = listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/software/titles", nil, http.StatusOK, &listSw, "team_id", fmt.Sprint(team.ID), "self_service", "true")
+	require.Len(t, listSw.SoftwareTitles, 1)
+	require.Equal(t, macOSTitleID, listSw.SoftwareTitles[0].ID)
+
+	// delete the app store app for team 1
+	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/software/titles/%d/available_for_install", macOSTitleID), nil, http.StatusNoContent,
+		"team_id", fmt.Sprint(team.ID))
+	s.lastActivityMatches(fleet.ActivityDeletedAppStoreApp{}.ActivityName(),
+		fmt.Sprintf(`{"team_name": "%s", "software_title": "%s", "app_store_id": "%s", "team_id": %d, "platform": "%s"}`, team.Name,
+			addedApp.Name, addedApp.AdamID, team.ID, addedApp.Platform), 0)
+
+	// deleting it again fails, not found
+	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/software/titles/%d/available_for_install", macOSTitleID), nil, http.StatusNotFound,
+		"team_id", fmt.Sprint(team.ID))
+
+	// get the list of available apps, returns all apps now
+	appResp = getAppStoreAppsResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/software/app_store_apps", nil, http.StatusOK, &appResp, "team_id", fmt.Sprint(team.ID))
+	require.NoError(t, appResp.Err)
+	assert.ElementsMatch(t, expectedApps, appResp.AppStoreApps)
+
+	// Insert/deletion flow for iPadOS app
+	addedApp = expectedApps[1]
+	addAppResp = addAppStoreAppResponse{}
+	// No self-service for iPadOS
+	s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps",
+		&addAppStoreAppRequest{TeamID: &team.ID, AppStoreID: addedApp.AdamID, Platform: addedApp.Platform, SelfService: true},
+		http.StatusBadRequest, &addAppResp)
+	s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps",
+		&addAppStoreAppRequest{TeamID: &team.ID, AppStoreID: addedApp.AdamID, Platform: addedApp.Platform},
+		http.StatusOK, &addAppResp)
+	s.lastActivityMatches(fleet.ActivityAddedAppStoreApp{}.ActivityName(),
+		fmt.Sprintf(`{"team_name": "%s", "software_title": "%s", "app_store_id": "%s", "team_id": %d, "platform": "%s", "self_service": false}`, team.Name,
+			addedApp.Name, addedApp.AdamID, team.ID, addedApp.Platform), 0)
+
+	// Now we should be filtering out the app we added to team 1
+	appResp = getAppStoreAppsResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/software/app_store_apps", &getAppStoreAppsRequest{}, http.StatusOK, &appResp, "team_id",
+		strconv.Itoa(int(team.ID)))
+	require.NoError(t, appResp.Err)
+	assert.ElementsMatch(t, append(expectedApps[2:], expectedApps[0]), appResp.AppStoreApps)
+
+	// list the software titles for that team, to get the title id of the VPP app
+	listSw = listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/software/titles", nil, http.StatusOK, &listSw, "team_id", fmt.Sprint(team.ID),
+		"available_for_install", "true")
+	require.Len(t, listSw.SoftwareTitles, 1)
+	macOSTitleID = listSw.SoftwareTitles[0].ID
+	assert.Equal(t, "ipados_apps", listSw.SoftwareTitles[0].Source)
+
+	// filtering by self-service returns nothing
+	listSw = listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/software/titles", nil, http.StatusOK, &listSw, "team_id", fmt.Sprint(team.ID),
+		"self_service", "true")
+	require.Len(t, listSw.SoftwareTitles, 0)
+
+	// delete the app store app for team 1
+	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/software/titles/%d/available_for_install", macOSTitleID), nil, http.StatusNoContent,
+		"team_id",
+		fmt.Sprint(team.ID))
+	s.lastActivityMatches(fleet.ActivityDeletedAppStoreApp{}.ActivityName(),
+		fmt.Sprintf(`{"team_name": "%s", "software_title": "%s", "app_store_id": "%s", "team_id": %d, "platform": "%s"}`, team.Name,
+			addedApp.Name, addedApp.AdamID, team.ID, addedApp.Platform), 0)
+
+	// deleting it again fails, not found
+	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/software/titles/%d/available_for_install", macOSTitleID), nil, http.StatusNotFound,
+		"team_id",
+		fmt.Sprint(team.ID))
+
+	// get the list of available apps, returns all apps now
+	appResp = getAppStoreAppsResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/software/app_store_apps", nil, http.StatusOK, &appResp, "team_id", fmt.Sprint(team.ID))
+	require.NoError(t, appResp.Err)
+	assert.ElementsMatch(t, expectedApps, appResp.AppStoreApps)
+
+	// Installation flow
+
+	// Create a couple of hosts
+	orbitHost := createOrbitEnrolledHost(t, "darwin", "nonmdm", s.ds)
+	mdmHost, mdmDevice := createHostThenEnrollMDM(s.ds, s.server.URL, t)
+	setOrbitEnrollment(t, mdmHost, s.ds)
+	selfServiceHost, selfServiceDevice := createHostThenEnrollMDM(s.ds, s.server.URL, t)
+	setOrbitEnrollment(t, selfServiceHost, s.ds)
+	selfServiceToken := "selfservicetoken"
+	updateDeviceTokenForHost(t, s.ds, selfServiceHost.ID, selfServiceToken)
+	s.appleVPPConfigSrvConfig.SerialNumbers = append(s.appleVPPConfigSrvConfig.SerialNumbers, selfServiceDevice.SerialNumber)
+	iOSHost, iOSMdmClient := s.createAppleMobileHostThenEnrollMDM("ios")
+	iPadOSHost, iPadOSMdmClient := s.createAppleMobileHostThenEnrollMDM("ipados")
+
+	// Add serial number to our fake Apple server
+	s.appleVPPConfigSrvConfig.SerialNumbers = append(s.appleVPPConfigSrvConfig.SerialNumbers, mdmHost.HardwareSerial,
+		iOSHost.HardwareSerial, iPadOSHost.HardwareSerial)
+	s.Do("POST", "/api/latest/fleet/hosts/transfer",
+		&addHostsToTeamRequest{HostIDs: []uint{mdmHost.ID, orbitHost.ID, iOSHost.ID, iPadOSHost.ID, selfServiceHost.ID}, TeamID: &team.ID}, http.StatusOK)
+
+	// Add all apps to the team
+	addedApp = expectedApps[0]
+	errApp := expectedApps[3]
+	appSelfService := expectedApps[0]
+	// Add app 1 as self-service
+	addAppResp = addAppStoreAppResponse{}
+	s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps",
+		&addAppStoreAppRequest{TeamID: &team.ID, AppStoreID: appSelfService.AdamID, Platform: appSelfService.Platform, SelfService: true},
+		http.StatusOK, &addAppResp)
+	s.lastActivityMatches(
+		fleet.ActivityAddedAppStoreApp{}.ActivityName(),
+		fmt.Sprintf(`{"team_name": "%s", "software_title": "%s", "app_store_id": "%s", "team_id": %d, "platform": "%s", "self_service": true}`, team.Name,
+			appSelfService.Name, appSelfService.AdamID, team.ID, appSelfService.Platform),
+		0,
+	)
+	listSw = listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/software/titles", nil, http.StatusOK, &listSw, "team_id", fmt.Sprint(team.ID),
+		"available_for_install", "true")
+	// Add remaining as non-self-service
+	for _, app := range expectedApps[1:] {
+		addAppResp = addAppStoreAppResponse{}
+		s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps",
+			&addAppStoreAppRequest{TeamID: &team.ID, AppStoreID: app.AdamID, Platform: app.Platform},
+			http.StatusOK, &addAppResp)
+		s.lastActivityMatches(
+			fleet.ActivityAddedAppStoreApp{}.ActivityName(),
+			fmt.Sprintf(`{"team_name": "%s", "software_title": "%s", "app_store_id": "%s", "team_id": %d, "platform": "%s", "self_service": false}`, team.Name,
+				app.Name, app.AdamID, team.ID, app.Platform),
+			0,
+		)
+		listSw = listSoftwareTitlesResponse{}
+		s.DoJSON("GET", "/api/latest/fleet/software/titles", nil, http.StatusOK, &listSw, "team_id", fmt.Sprint(team.ID),
+			"available_for_install", "true")
+	}
+
+	listSw = listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/software/titles", nil, http.StatusOK, &listSw, "team_id", fmt.Sprint(team.ID), "available_for_install", "true")
+	require.Len(t, listSw.SoftwareTitles, len(expectedApps))
+	macOSTitleID = 99999
+	errTitleID := uint(99999)
+	iOSTitleID := uint(99999)
+	iPadOSTitleID := uint(99999)
+	for _, sw := range listSw.SoftwareTitles {
+		assert.NotNil(t, sw.AppStoreApp)
+		switch {
+		case sw.Name == addedApp.Name && sw.Source == "apps":
+			macOSTitleID = sw.ID
+		case sw.Name == errApp.Name && sw.Source == "apps":
+			errTitleID = sw.ID
+		case sw.Name == iOSApp.Name && sw.Source == "ios_apps":
+			iOSTitleID = sw.ID
+		case sw.Name == iPadOSApp.Name && sw.Source == "ipados_apps":
+			iPadOSTitleID = sw.ID
+		}
+	}
+
+	// attempt to install a VPP app on the non-MDM enrolled host
+	installResp := installSoftwareResponse{}
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", orbitHost.ID, macOSTitleID), &installSoftwareRequest{},
+		http.StatusBadRequest, &installResp)
+
+	// Disable all teams token
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d/teams", validToken.Token.ID), patchVPPTokensTeamsRequest{}, http.StatusOK, &resPatchVPP)
+
+	// Spoof an expired VPP token and attempt to install VPP app
+	tokenJSONBad := fmt.Sprintf(`{"expDate":"%s","token":"%s","orgName":"%s"}`, "2099-06-24T15:50:50+0000", "badtoken", "Evil Fleet")
+	s.appleVPPConfigSrvConfig.Location = "Spooky Haunted House"
+	var vppRes uploadVPPTokenResponse
+	s.uploadDataViaForm("/api/latest/fleet/vpp_tokens", "token", "token.vpptoken", []byte(base64.StdEncoding.EncodeToString([]byte(tokenJSONBad))), http.StatusAccepted, "", &vppRes)
+
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d/teams", vppRes.Token.ID), patchVPPTokensTeamsRequest{TeamIDs: []uint{team.ID, 99}}, http.StatusUnprocessableEntity, &resPatchVPP)
+
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d/teams", vppRes.Token.ID), patchVPPTokensTeamsRequest{TeamIDs: []uint{team.ID}}, http.StatusOK, &resPatchVPP)
+
+	// mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+	// 	_, err := q.ExecContext(context.Background(), "UPDATE vpp_tokens SET renew_at = ? WHERE organization_name = ?", time.Now().Add(-1*time.Hour), "badtoken")
+	// 	return err
+	// })
+
+	// r := s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", mdmHost.ID, errTitleID), &installSoftwareRequest{}, http.StatusUnprocessableEntity)
+	// require.Contains(t, extractServerErrorText(r.Body), "VPP token expired")
+
+	// Disable the token
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d/teams", vppRes.Token.ID), patchVPPTokensTeamsRequest{}, http.StatusOK, &resPatchVPP)
+
+	// Enable all teams token
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d/teams", validToken.Token.ID), patchVPPTokensTeamsRequest{TeamIDs: []uint{}}, http.StatusOK, &resPatchVPP)
+
+	// Attempt to install non-existent app
+	r := s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", mdmHost.ID, 99999), &installSoftwareRequest{}, http.StatusBadRequest)
+	require.Contains(t, extractServerErrorText(r.Body), "Couldn't install software. Software title is not available for install. Please add software package or App Store app to install.")
+
+	// Add app 1 as self-service
+	addAppResp = addAppStoreAppResponse{}
+	s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps",
+		&addAppStoreAppRequest{TeamID: &team.ID, AppStoreID: errApp.AdamID, Platform: errApp.Platform, SelfService: true},
+		http.StatusOK, &addAppResp)
+
+	// Add remaining apps without self-service
+	for _, app := range expectedApps {
+		addAppResp = addAppStoreAppResponse{}
+		s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps",
+			&addAppStoreAppRequest{TeamID: &team.ID, AppStoreID: app.AdamID, Platform: app.Platform, SelfService: app.AdamID == macOSApp.AdamID},
+			http.StatusOK, &addAppResp)
+	}
+
+	// Trigger install to the host
+	installResp = installSoftwareResponse{}
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", mdmHost.ID, errTitleID), &installSoftwareRequest{}, http.StatusAccepted, &installResp)
+
+	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d", vppRes.Token.ID), &deleteVPPTokenRequest{}, http.StatusNoContent)
+
+	// Check if the host is listed as pending
+	var listResp listHostsResponse
+	s.DoJSON("GET", "/api/latest/fleet/hosts", nil, http.StatusOK, &listResp, "software_status", "pending", "team_id", strconv.Itoa(int(team.ID)), "software_title_id", strconv.Itoa(int(errTitleID)))
+	require.Len(t, listResp.Hosts, 1)
+	require.Equal(t, listResp.Hosts[0].ID, mdmHost.ID)
+	var countResp countHostsResponse
+	s.DoJSON("GET", "/api/latest/fleet/hosts/count", nil, http.StatusOK, &countResp, "software_status", "pending", "team_id", strconv.Itoa(int(team.ID)), "software_title_id", strconv.Itoa(int(errTitleID)))
+	require.Equal(t, 1, countResp.Count)
+
+	// Simulate failed installation on the host
+	cmd, err := mdmDevice.Idle()
+	var failedCmdUUID string
+	require.NoError(t, err)
+	for cmd != nil {
+		var fullCmd micromdm.CommandPayload
+		switch cmd.Command.RequestType {
+		case "InstallApplication":
+			require.NoError(t, plist.Unmarshal(cmd.Raw, &fullCmd))
+			failedCmdUUID = cmd.CommandUUID
+			cmd, err = mdmDevice.Err(cmd.CommandUUID, []mdm.ErrorChain{{ErrorCode: 1234}})
+			require.NoError(t, err)
+		}
+	}
+
+	listResp = listHostsResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/hosts", nil, http.StatusOK, &listResp, "software_status", "failed", "team_id", strconv.Itoa(int(team.ID)), "software_title_id", strconv.Itoa(int(errTitleID)))
+	require.Len(t, listResp.Hosts, 1)
+	require.Equal(t, listResp.Hosts[0].ID, mdmHost.ID)
+	countResp = countHostsResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/hosts/count", nil, http.StatusOK, &countResp, "software_status", "failed", "team_id", strconv.Itoa(int(team.ID)), "software_title_id", strconv.Itoa(int(errTitleID)))
+	require.Equal(t, 1, countResp.Count)
+
+	s.lastActivityMatches(
+		fleet.ActivityInstalledAppStoreApp{}.ActivityName(),
+		fmt.Sprintf(
+			`{"host_id": %d, "host_display_name": "%s", "software_title": "%s", "app_store_id": "%s", "command_uuid": "%s", "status": "%s", "self_service": false}`,
+			mdmHost.ID,
+			mdmHost.DisplayName(),
+			errApp.Name,
+			errApp.AdamID,
+			failedCmdUUID,
+			fleet.SoftwareInstallerFailed,
+		),
+		0,
+	)
+
+	// Trigger install to the host
+	installResp = installSoftwareResponse{}
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", mdmHost.ID, macOSTitleID), &installSoftwareRequest{},
+		http.StatusAccepted, &installResp)
+	countResp = countHostsResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/hosts/count", nil, http.StatusOK, &countResp, "software_status", "pending", "team_id",
+		strconv.Itoa(int(team.ID)), "software_title_id", strconv.Itoa(int(macOSTitleID)))
+	require.Equal(t, 1, countResp.Count)
+
+	// Simulate successful installation on the host
+	var cmdUUID string
+	cmd, err = mdmDevice.Idle()
+	require.NoError(t, err)
+	for cmd != nil {
+		var fullCmd micromdm.CommandPayload
+		switch cmd.Command.RequestType {
+		case "InstallApplication":
+			require.NoError(t, plist.Unmarshal(cmd.Raw, &fullCmd))
+			cmdUUID = cmd.CommandUUID
+			cmd, err = mdmDevice.Acknowledge(cmd.CommandUUID)
+			require.NoError(t, err)
+		}
+	}
+
+	listResp = listHostsResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/hosts", nil, http.StatusOK, &listResp, "software_status", "installed", "team_id",
+		strconv.Itoa(int(team.ID)), "software_title_id", strconv.Itoa(int(macOSTitleID)))
+	require.Len(t, listResp.Hosts, 1)
+	countResp = countHostsResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/hosts/count", nil, http.StatusOK, &countResp, "software_status", "installed", "team_id",
+		strconv.Itoa(int(team.ID)), "software_title_id", strconv.Itoa(int(macOSTitleID)))
+	require.Equal(t, 1, countResp.Count)
+
+	s.lastActivityMatches(
+		fleet.ActivityInstalledAppStoreApp{}.ActivityName(),
+		fmt.Sprintf(
+			`{"host_id": %d, "host_display_name": "%s", "software_title": "%s", "app_store_id": "%s", "command_uuid": "%s", "status": "%s", "self_service": false}`,
+			mdmHost.ID,
+			mdmHost.DisplayName(),
+			addedApp.Name,
+			addedApp.AdamID,
+			cmdUUID,
+			fleet.SoftwareInstallerInstalled,
+		),
+		0,
+	)
+
+	// Check list host software
+
+	getHostSw := getHostSoftwareResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", mdmHost.ID), nil, http.StatusOK, &getHostSw)
+	gotSW := getHostSw.Software
+	require.Len(t, gotSW, 2) // App 1 and App 2
+	got1, got2 := gotSW[0], gotSW[1]
+	require.Equal(t, got1.Name, "App 1")
+	require.NotNil(t, got1.AppStoreApp)
+	require.Equal(t, got1.AppStoreApp.AppStoreID, addedApp.AdamID)
+	require.Equal(t, got1.AppStoreApp.IconURL, ptr.String(addedApp.IconURL))
+	require.Empty(t, got1.AppStoreApp.Name) // Name is only present for installer packages
+	require.Equal(t, got1.AppStoreApp.Version, addedApp.LatestVersion)
+	require.NotNil(t, got1.Status)
+	require.Equal(t, *got1.Status, fleet.SoftwareInstallerInstalled)
+	require.Equal(t, got1.AppStoreApp.LastInstall.CommandUUID, cmdUUID)
+	require.NotNil(t, got1.AppStoreApp.LastInstall.InstalledAt)
+	require.Equal(t, got2.Name, "App 2")
+	require.NotNil(t, got2.Status)
+	require.Equal(t, *got2.Status, fleet.SoftwareInstallerFailed)
+	require.NotNil(t, got2.AppStoreApp)
+	require.Equal(t, got2.AppStoreApp.AppStoreID, errApp.AdamID)
+	require.Equal(t, got2.AppStoreApp.IconURL, ptr.String(errApp.IconURL))
+	require.Empty(t, got2.AppStoreApp.Name)
+	require.Equal(t, got2.AppStoreApp.Version, errApp.LatestVersion)
+	require.Equal(t, got2.AppStoreApp.LastInstall.CommandUUID, failedCmdUUID)
+	require.NotNil(t, got2.AppStoreApp.LastInstall.InstalledAt)
+
+	// Check with a query
+	getHostSw = getHostSoftwareResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", mdmHost.ID), nil, http.StatusOK, &getHostSw, "query", "App 1")
+	require.Len(t, getHostSw.Software, 1) // App 1 only
+	got1 = getHostSw.Software[0]
+	require.Equal(t, got1.Name, "App 1")
+	require.NotNil(t, got1.AppStoreApp)
+	require.NotNil(t, got1.AppStoreApp)
+	require.Equal(t, got1.AppStoreApp.AppStoreID, addedApp.AdamID)
+	require.Equal(t, got1.AppStoreApp.IconURL, ptr.String(addedApp.IconURL))
+	require.Empty(t, got1.AppStoreApp.Name)
+	require.Equal(t, got1.AppStoreApp.Version, addedApp.LatestVersion)
+	require.NotNil(t, got1.Status)
+	require.Equal(t, *got1.Status, fleet.SoftwareInstallerInstalled)
+	require.Equal(t, got1.AppStoreApp.LastInstall.CommandUUID, cmdUUID)
+	require.NotNil(t, got1.AppStoreApp.LastInstall.InstalledAt)
+
+	// Filter the self-service apps for that host
+	getHostSw = getHostSoftwareResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", mdmHost.ID), nil, http.StatusOK, &getHostSw, "self_service", "true")
+	require.Len(t, getHostSw.Software, 1)
+	require.Equal(t, appSelfService.Name, got1.Name)
+
+	// Return installed app with software detail query
+	distributedReq := submitDistributedQueryResultsRequestShim{
+		NodeKey: *mdmHost.NodeKey,
+		Results: map[string]json.RawMessage{
+			hostDetailQueryPrefix + "software_macos": json.RawMessage(fmt.Sprintf(
+				`[{"name": "%s", "version": "%s", "type": "Application (macOS)",
+					"bundle_identifier": "%s", "source": "apps", "last_opened_at": "",
+					"installed_path": "/Applications/a.app"}]`, addedApp.Name, addedApp.LatestVersion, addedApp.BundleIdentifier)),
+		},
+		Statuses: map[string]interface{}{
+			hostDistributedQueryPrefix + "software_macos": 0,
+		},
+		Messages: map[string]string{},
+		Stats:    map[string]*fleet.Stats{},
+	}
+	distributedResp := submitDistributedQueryResultsResponse{}
+	s.DoJSON("POST", "/api/osquery/distributed/write", distributedReq, http.StatusOK, &distributedResp)
+
+	// Remove the installed app by not returning it
+	distributedReq = submitDistributedQueryResultsRequestShim{
+		NodeKey: *mdmHost.NodeKey,
+		Results: map[string]json.RawMessage{
+			hostDetailQueryPrefix + "software_macos": json.RawMessage(`[]`),
+		},
+		Statuses: map[string]interface{}{
+			hostDistributedQueryPrefix + "software_macos": 0,
+		},
+		Messages: map[string]string{},
+		Stats:    map[string]*fleet.Stats{},
+	}
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSON("POST", "/api/osquery/distributed/write", distributedReq, http.StatusOK, &distributedResp)
+
+	// Check list host software
+	getHostSw = getHostSoftwareResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", mdmHost.ID), nil, http.StatusOK, &getHostSw)
+	gotSW = getHostSw.Software
+	require.Len(t, gotSW, 2) // App 1 and App 2
+	got1, got2 = gotSW[0], gotSW[1]
+	require.Equal(t, got1.Name, "App 1")
+	require.NotNil(t, got1.AppStoreApp)
+	require.Equal(t, got1.AppStoreApp.AppStoreID, addedApp.AdamID)
+	require.Equal(t, got1.AppStoreApp.IconURL, ptr.String(addedApp.IconURL))
+	require.Empty(t, got1.AppStoreApp.Name) // Name is only present for installer packages
+	require.Equal(t, got1.AppStoreApp.Version, addedApp.LatestVersion)
+	assert.Nil(t, got1.Status)
+	assert.Nil(t, got1.AppStoreApp.LastInstall)
+
+	// Install on iOS and iPadOS devices
+	installs := map[string]struct {
+		installHost    *fleet.Host
+		titleID        uint
+		mdmClient      *mdmtest.TestAppleMDMClient
+		app            fleet.VPPApp
+		extraAvailable int
+		hostCount      int
+		deviceToken    string
+	}{
+		"iOS app install": {installHost: iOSHost, titleID: iOSTitleID, mdmClient: iOSMdmClient, app: iOSApp, hostCount: 1},
+		"iPadOS app install": {
+			installHost: iPadOSHost, titleID: iPadOSTitleID, mdmClient: iPadOSMdmClient, app: iPadOSApp,
+			extraAvailable: 1, hostCount: 1,
+		},
+		"macOS app install": {
+			installHost: selfServiceHost, titleID: macOSTitleID, mdmClient: selfServiceDevice, app: macOSApp,
+			hostCount: 2, deviceToken: selfServiceToken,
+		},
+	}
+
+	for name, install := range installs {
+		t.Run(name, func(t *testing.T) {
+			installHost := install.installHost
+			titleID := install.titleID
+			mdmClient := install.mdmClient
+			app := install.app
+
+			// Self-service install
+			if install.deviceToken != "" {
+				var ssInstallResp submitSelfServiceSoftwareInstallResponse
+				s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/device/%s/software/install/%d", install.deviceToken, install.titleID),
+					&fleetSelfServiceSoftwareInstallRequest{}, http.StatusAccepted, &ssInstallResp)
+			} else {
+				installResp = installSoftwareResponse{}
+				s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", installHost.ID, titleID),
+					&installSoftwareRequest{}, http.StatusAccepted, &installResp)
+			}
+			countResp = countHostsResponse{}
+			s.DoJSON("GET", "/api/latest/fleet/hosts/count", nil, http.StatusOK, &countResp, "software_status", "pending", "team_id",
+				strconv.Itoa(int(team.ID)), "software_title_id", strconv.Itoa(int(titleID)))
+			require.Equal(t, 1, countResp.Count)
+
+			// send an idle request to grab the command uuid
+			cmd, err = mdmClient.Idle()
+			require.NoError(t, err)
+			var fullCmd micromdm.CommandPayload
+			require.NoError(t, plist.Unmarshal(cmd.Raw, &fullCmd))
+			cmdUUID = cmd.CommandUUID
+
+			// Get pending activity
+			var hostActivitiesResp listHostUpcomingActivitiesResponse
+			s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/activities/upcoming", installHost.ID),
+				nil, http.StatusOK, &hostActivitiesResp)
+			activitiesToString := func(activities []*fleet.Activity) []string {
+				var res []string
+				for _, activity := range activities {
+					res = append(res, fmt.Sprintf("%+v", activity))
+				}
+				return res
+			}
+			require.Len(t, hostActivitiesResp.Activities, 1, "got activities: %v", activitiesToString(hostActivitiesResp.Activities))
+			assert.Equal(t, hostActivitiesResp.Activities[0].Type, fleet.ActivityInstalledAppStoreApp{}.ActivityName())
+			assert.EqualValues(t, 1, hostActivitiesResp.Count)
+			assert.JSONEq(
+				t,
+				fmt.Sprintf(
+					`{"host_id": %d, "host_display_name": "%s", "software_title": "%s", "app_store_id": "%s", "command_uuid": "%s", "status": "%s", "self_service": %v}`,
+					installHost.ID,
+					installHost.DisplayName(),
+					app.Name,
+					app.AdamID,
+					cmdUUID,
+					fleet.SoftwareInstallerPending,
+					install.deviceToken != "",
+				),
+				string(*hostActivitiesResp.Activities[0].Details),
+			)
+
+			// Simulate successful installation on the host
+			cmd, err = mdmClient.Acknowledge(cmd.CommandUUID)
+			require.NoError(t, err)
+
+			listResp = listHostsResponse{}
+			s.DoJSON("GET", "/api/latest/fleet/hosts", nil, http.StatusOK, &listResp, "software_status", "installed", "team_id",
+				strconv.Itoa(int(team.ID)), "software_title_id", strconv.Itoa(int(titleID)))
+			assert.Len(t, listResp.Hosts, install.hostCount)
+			countResp = countHostsResponse{}
+			s.DoJSON("GET", "/api/latest/fleet/hosts/count", nil, http.StatusOK, &countResp, "software_status", "installed", "team_id",
+				strconv.Itoa(int(team.ID)), "software_title_id", strconv.Itoa(int(titleID)))
+			assert.Equal(t, install.hostCount, countResp.Count)
+
+			s.lastActivityMatches(
+				fleet.ActivityInstalledAppStoreApp{}.ActivityName(),
+				fmt.Sprintf(
+					`{"host_id": %d, "host_display_name": "%s", "software_title": "%s", "app_store_id": "%s", "command_uuid": "%s", "status": "%s", "self_service": %v}`,
+					installHost.ID,
+					installHost.DisplayName(),
+					app.Name,
+					app.AdamID,
+					cmdUUID,
+					fleet.SoftwareInstallerInstalled,
+					install.deviceToken != "",
+				),
+				0,
+			)
+
+			// Check list host software
+			getHostSw = getHostSoftwareResponse{}
+			s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", installHost.ID), nil, http.StatusOK, &getHostSw)
+			require.Len(t, getHostSw.Software, install.hostCount+install.extraAvailable)
+			var foundInstalledApp bool
+			for index := range getHostSw.Software {
+				got1 = getHostSw.Software[index]
+				if got1.Status != nil {
+					require.Equal(t, got1.Name, app.Name)
+					require.NotNil(t, got1.AppStoreApp)
+					require.Equal(t, got1.AppStoreApp.AppStoreID, app.AdamID)
+					require.Equal(t, got1.AppStoreApp.IconURL, ptr.String(app.IconURL))
+					require.Empty(t, got1.AppStoreApp.Name) // Name is only present for installer packages
+					require.Equal(t, got1.AppStoreApp.Version, app.LatestVersion)
+					require.Equal(t, *got1.Status, fleet.SoftwareInstallerInstalled)
+					require.Equal(t, got1.AppStoreApp.LastInstall.CommandUUID, cmdUUID)
+					require.NotNil(t, got1.AppStoreApp.LastInstall.InstalledAt)
+					foundInstalledApp = true
+				}
+			}
+			assert.True(t, foundInstalledApp)
+		})
+	}
+
+	// Attempt (and fail) to self-service install iPad and iOS titles
+	var ssInstallResp submitSelfServiceSoftwareInstallResponse
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/device/%s/software/install/%d", selfServiceToken, iPadOSTitleID), &fleetSelfServiceSoftwareInstallRequest{},
+		http.StatusBadRequest, &ssInstallResp)
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/device/%s/software/install/%d", selfServiceToken, iOSTitleID), &fleetSelfServiceSoftwareInstallRequest{},
+		http.StatusBadRequest, &ssInstallResp)
+
+	// Delete VPP token and check that it's not appearing anymore
+
+	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d", validToken.Token.ID), &deleteVPPTokenResponse{}, http.StatusNoContent)
+	s.DoJSON("GET", "/api/latest/fleet/vpp_tokens", &getVPPTokensRequest{}, http.StatusOK, &resp)
+}
+
+func (s *integrationMDMTestSuite) TestEnrollmentProfilesWithSpecialChars() {
+	t := s.T()
+	ctx := context.Background()
+
+	initialConfig, err := s.ds.AppConfig(ctx)
+	require.NoError(t, err)
+	initialSecrets, err := s.ds.GetEnrollSecrets(ctx, nil)
+	require.NoError(t, err)
+
+	nameWithInvalidChars := "Fleet & Device <3 Management"
+	/* #nosec G101 -- this is a made up value for tests */
+	enrollSecretWithInvalidChars := "1<2>3&4&/"
+
+	acResp := appConfigResponse{}
+	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(fmt.Sprintf(`{
+		"org_info": {
+			"org_name": %q
+		}
+	}`, nameWithInvalidChars)), http.StatusOK, &acResp)
+	enrollSecretResp := applyEnrollSecretSpecResponse{}
+	s.DoJSON("POST", "/api/latest/fleet/spec/enroll_secret", applyEnrollSecretSpecRequest{
+		Spec: &fleet.EnrollSecretSpec{
+			Secrets: []*fleet.EnrollSecret{{Secret: enrollSecretWithInvalidChars}},
+		},
+	}, http.StatusOK, &enrollSecretResp)
+	t.Cleanup(func() {
+		acResp := appConfigResponse{}
+		s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(fmt.Sprintf(`{
+		  "org_info": {
+			  "org_name": %q
+		  }
+		}`, initialConfig.OrgInfo.OrgName)), http.StatusOK, &acResp)
+		s.DoJSON("POST", "/api/latest/fleet/spec/enroll_secret", applyEnrollSecretSpecRequest{
+			Spec: &fleet.EnrollSecretSpec{
+				Secrets: initialSecrets,
+			},
+		}, http.StatusOK, &enrollSecretResp)
+	})
+
+	// manual enrollment from My Device
+	token := "token_test_manual_enroll"
+	createHostAndDeviceToken(t, s.ds, token)
+	s.downloadAndVerifyEnrollmentProfile("/api/latest/fleet/device/" + token + "/mdm/apple/manual_enrollment_profile")
+
+	// automatic enrollment by token
+	rawMsg := json.RawMessage(`{"allow_pairing": true}`)
+	_, err = s.ds.NewMDMAppleEnrollmentProfile(ctx, fleet.MDMAppleEnrollmentProfilePayload{
+		Type:       "automatic",
+		DEPProfile: &rawMsg,
+		Token:      "abcd",
+	})
+	require.NoError(t, err)
+	s.downloadAndVerifyEnrollmentProfile(apple_mdm.EnrollPath + "?token=abcd")
+
+	// unsigned manual enrollment profile for IT admins
+	s.downloadAndVerifyEnrollmentProfile("/api/latest/fleet/enrollment_profiles/manual")
+
+	// ensure the fleetd profile sends a good enroll secret too
+	s.awaitTriggerProfileSchedule(t)
+	prof := s.assertConfigProfilesByIdentifier(nil, mobileconfig.FleetdConfigPayloadIdentifier, true)
+
+	type fleetdPlist struct {
+		PayloadContent []struct {
+			EnrollSecret string `plist:"EnrollSecret"`
+		} `plist:"PayloadContent"`
+	}
+
+	// Parse the plist data
+	var parsedData fleetdPlist
+	err = plist.NewDecoder(bytes.NewReader(prof.Mobileconfig)).Decode(&parsedData)
+	require.NoError(t, err)
+	require.Equal(t, enrollSecretWithInvalidChars, parsedData.PayloadContent[0].EnrollSecret)
+}
diff --git a/server/service/labels.go b/server/service/labels.go
index c79e8fadb9fa..2922ec51d8e3 100644
--- a/server/service/labels.go
+++ b/server/service/labels.go
@@ -165,6 +165,7 @@ func (svc *Service) ModifyLabel(ctx context.Context, id uint, payload fleet.Modi
 	if label.LabelType == fleet.LabelTypeBuiltIn {
 		return nil, nil, fleet.NewInvalidArgumentError("label_type", fmt.Sprintf("cannot modify built-in label '%s'", label.Name))
 	}
+	originalLabelName := label.Name
 	if payload.Name != nil {
 		// Check if the new name is a reserved label name
 		for name := range fleet.ReservedLabelNames() {
@@ -188,7 +189,7 @@ func (svc *Service) ModifyLabel(ctx context.Context, id uint, payload fleet.Modi
 	// hostnames).
 	if label.LabelMembershipType == fleet.LabelMembershipTypeManual && payload.Hosts != nil {
 		spec := fleet.LabelSpec{
-			Name:                label.Name,
+			Name:                originalLabelName,
 			Description:         label.Description,
 			Query:               label.Query,
 			Platform:            label.Platform,
@@ -200,11 +201,16 @@ func (svc *Service) ModifyLabel(ctx context.Context, id uint, payload fleet.Modi
 			return nil, nil, err
 		}
 		spec.Hosts = hostnames
+		// Note: ApplyLabelSpecs cannot update label name since it uses the name as a key.
+		// So, we must handle it later.
 		if err := svc.ds.ApplyLabelSpecs(ctx, []*fleet.LabelSpec{&spec}); err != nil {
 			return nil, nil, err
 		}
-
-		// must reload it to get the host counts information
+		// If the label name has changed, we must update it.
+		if originalLabelName != label.Name {
+			return svc.ds.SaveLabel(ctx, label, filter)
+		}
+		// Otherwise, simply reload label to get the host counts information
 		return svc.ds.Label(ctx, id, filter)
 	}
 	return svc.ds.SaveLabel(ctx, label, filter)
diff --git a/server/service/mdm.go b/server/service/mdm.go
index 70964f14845c..294d503d81ef 100644
--- a/server/service/mdm.go
+++ b/server/service/mdm.go
@@ -566,13 +566,14 @@ func (svc *Service) enqueueAppleMDMCommand(ctx context.Context, rawXMLCmd []byte
 		var apnsErr *apple_mdm.APNSDeliveryError
 		var mysqlErr *mysql.MySQLError
 		if errors.As(err, &apnsErr) {
-			if len(apnsErr.FailedUUIDs) < len(deviceIDs) {
+			failedUUIDs := apnsErr.FailedUUIDs()
+			if len(failedUUIDs) < len(deviceIDs) {
 				// some hosts properly received the command, so return success, with the list
 				// of failed uuids.
 				return &fleet.CommandEnqueueResult{
 					CommandUUID: cmd.CommandUUID,
 					RequestType: cmd.Command.RequestType,
-					FailedUUIDs: apnsErr.FailedUUIDs,
+					FailedUUIDs: failedUUIDs,
 				}, nil
 			}
 			// push failed for all hosts
@@ -1166,7 +1167,7 @@ func (svc *Service) DeleteMDMWindowsConfigProfile(ctx context.Context, profileUU
 	}
 
 	// cannot use the profile ID as it is now deleted
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{teamID}, nil, nil); err != nil {
+	if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{teamID}, nil, nil); err != nil {
 		return ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 	}
 
@@ -1411,7 +1412,7 @@ func (svc *Service) NewMDMWindowsConfigProfile(ctx context.Context, teamID uint,
 		return nil, ctxerr.Wrap(ctx, err)
 	}
 
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{newCP.ProfileUUID}, nil); err != nil {
+	if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{newCP.ProfileUUID}, nil); err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 	}
 
@@ -1599,7 +1600,8 @@ func (svc *Service) BatchSetMDMProfiles(
 		return nil
 	}
 
-	if err := svc.ds.BatchSetMDMProfiles(ctx, tmID, appleProfiles, windowsProfiles, appleDecls); err != nil {
+	var profUpdates fleet.MDMProfilesUpdates
+	if profUpdates, err = svc.ds.BatchSetMDMProfiles(ctx, tmID, appleProfiles, windowsProfiles, appleDecls); err != nil {
 		return ctxerr.Wrap(ctx, err, "setting config profiles")
 	}
 
@@ -1608,7 +1610,8 @@ func (svc *Service) BatchSetMDMProfiles(
 	for _, p := range windowsProfiles {
 		winProfUUIDs = append(winProfUUIDs, p.ProfileUUID)
 	}
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, winProfUUIDs, nil); err != nil {
+	winUpdates, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, winProfUUIDs, nil)
+	if err != nil {
 		return ctxerr.Wrap(ctx, err, "bulk set pending windows host profiles")
 	}
 
@@ -1617,33 +1620,42 @@ func (svc *Service) BatchSetMDMProfiles(
 	for _, p := range appleProfiles {
 		appleProfUUIDs = append(appleProfUUIDs, p.ProfileUUID)
 	}
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, appleProfUUIDs, nil); err != nil {
+	appleUpdates, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, appleProfUUIDs, nil)
+	if err != nil {
 		return ctxerr.Wrap(ctx, err, "bulk set pending apple host profiles")
 	}
+	updates := fleet.MDMProfilesUpdates{
+		AppleConfigProfile:   profUpdates.AppleConfigProfile || winUpdates.AppleConfigProfile || appleUpdates.AppleConfigProfile,
+		WindowsConfigProfile: profUpdates.WindowsConfigProfile || winUpdates.WindowsConfigProfile || appleUpdates.WindowsConfigProfile,
+		AppleDeclaration:     profUpdates.AppleDeclaration || winUpdates.AppleDeclaration || appleUpdates.AppleDeclaration,
+	}
 
-	// TODO(roberto): should we generate activities only of any profiles were
-	// changed? this is the existing behavior for macOS profiles so I'm
-	// leaving it as-is for now.
-	if err := svc.NewActivity(
-		ctx, authz.UserFromContext(ctx), &fleet.ActivityTypeEditedMacosProfile{
-			TeamID:   tmID,
-			TeamName: tmName,
-		}); err != nil {
-		return ctxerr.Wrap(ctx, err, "logging activity for edited macos profile")
+	if updates.AppleConfigProfile {
+		if err := svc.NewActivity(
+			ctx, authz.UserFromContext(ctx), &fleet.ActivityTypeEditedMacosProfile{
+				TeamID:   tmID,
+				TeamName: tmName,
+			}); err != nil {
+			return ctxerr.Wrap(ctx, err, "logging activity for edited macos profile")
+		}
 	}
-	if err := svc.NewActivity(
-		ctx, authz.UserFromContext(ctx), &fleet.ActivityTypeEditedWindowsProfile{
-			TeamID:   tmID,
-			TeamName: tmName,
-		}); err != nil {
-		return ctxerr.Wrap(ctx, err, "logging activity for edited windows profile")
+	if updates.WindowsConfigProfile {
+		if err := svc.NewActivity(
+			ctx, authz.UserFromContext(ctx), &fleet.ActivityTypeEditedWindowsProfile{
+				TeamID:   tmID,
+				TeamName: tmName,
+			}); err != nil {
+			return ctxerr.Wrap(ctx, err, "logging activity for edited windows profile")
+		}
 	}
-	if err := svc.NewActivity(
-		ctx, authz.UserFromContext(ctx), &fleet.ActivityTypeEditedDeclarationProfile{
-			TeamID:   tmID,
-			TeamName: tmName,
-		}); err != nil {
-		return ctxerr.Wrap(ctx, err, "logging activity for edited macos declarations")
+	if updates.AppleDeclaration {
+		if err := svc.NewActivity(
+			ctx, authz.UserFromContext(ctx), &fleet.ActivityTypeEditedDeclarationProfile{
+				TeamID:   tmID,
+				TeamName: tmName,
+			}); err != nil {
+			return ctxerr.Wrap(ctx, err, "logging activity for edited macos declarations")
+		}
 	}
 
 	return nil
diff --git a/server/service/mdm_test.go b/server/service/mdm_test.go
index 497f40a85d4f..3a626af0277d 100644
--- a/server/service/mdm_test.go
+++ b/server/service/mdm_test.go
@@ -119,6 +119,20 @@ func TestMDMAppleAuthorization(t *testing.T) {
 		return nil
 	}
 
+	ds.NewActivityFunc = func(ctx context.Context, user *fleet.User, activity fleet.ActivityDetails, details []byte, createdAt time.Time) error {
+		return nil
+	}
+
+	ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+		return nil, nil
+	}
+	ds.ListVPPTokensFunc = func(ctx context.Context) ([]*fleet.VPPTokenDB, error) {
+		return nil, nil
+	}
+	ds.GetVPPTokenFunc = func(ctx context.Context, id uint) (*fleet.VPPTokenDB, error) {
+		return nil, &notFoundErr{}
+	}
+
 	ds.DeleteMDMConfigAssetsByNameFunc = func(ctx context.Context, assetNames []fleet.MDMAssetName) error { return nil }
 
 	// use a custom implementation of checkAuthErr as the service call will fail
@@ -153,6 +167,15 @@ func TestMDMAppleAuthorization(t *testing.T) {
 
 		err = svc.DeleteMDMAppleAPNSCert(ctx) // Don't expect anything other than an authz error here, since this is pretty much just a DB wrapper.
 		checkAuthErr(t, shouldFailWithAuth, err)
+
+		_, err = svc.UploadVPPToken(ctx, nil)
+		checkAuthErr(t, shouldFailWithAuth, err)
+
+		_, err = svc.GetVPPTokens(ctx)
+		checkAuthErr(t, shouldFailWithAuth, err)
+
+		err = svc.DeleteVPPToken(ctx, 0)
+		checkAuthErr(t, shouldFailWithAuth, err)
 	}
 
 	// Only global admins can access the endpoints.
@@ -1053,8 +1076,10 @@ func TestMDMWindowsConfigProfileAuthz(t *testing.T) {
 	ds.ListMDMConfigProfilesFunc = func(ctx context.Context, teamID *uint, opt fleet.ListOptions) ([]*fleet.MDMConfigProfilePayload, *fleet.PaginationMetadata, error) {
 		return nil, nil, nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string,
+		hostUUIDs []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	checkShouldFail := func(t *testing.T, err error, shouldFail bool) {
@@ -1127,8 +1152,10 @@ func TestUploadWindowsMDMConfigProfileValidations(t *testing.T) {
 		cp.ProfileUUID = uuid.New().String()
 		return &cp, nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string,
+		hostUUIDs []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	cases := []struct {
@@ -1210,16 +1237,20 @@ func TestMDMBatchSetProfiles(t *testing.T) {
 	ds.TeamFunc = func(ctx context.Context, id uint) (*fleet.Team, error) {
 		return &fleet.Team{ID: id, Name: "team"}, nil
 	}
-	ds.BatchSetMDMProfilesFunc = func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration) error {
-		return nil
+	ds.BatchSetMDMProfilesFunc = func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile,
+		winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.NewActivityFunc = func(
 		ctx context.Context, user *fleet.User, activity fleet.ActivityDetails, details []byte, createdAt time.Time,
 	) error {
 		return nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string,
+		hostUUIDs []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	testCases := []struct {
diff --git a/server/service/orbit.go b/server/service/orbit.go
index 8fbc7091050c..e894f8a1577a 100644
--- a/server/service/orbit.go
+++ b/server/service/orbit.go
@@ -10,6 +10,7 @@ import (
 	"net/url"
 
 	"github.com/fleetdm/fleet/v4/server"
+	"github.com/fleetdm/fleet/v4/server/contexts/capabilities"
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	hostctx "github.com/fleetdm/fleet/v4/server/contexts/host"
 	"github.com/fleetdm/fleet/v4/server/contexts/license"
@@ -202,20 +203,16 @@ func (svc *Service) GetOrbitConfig(ctx context.Context) (fleet.OrbitConfig, erro
 			notifs.RenewEnrollmentProfile = true
 		}
 
+		manualMigrationEligible, err := fleet.IsEligibleForManualMigration(host, mdmInfo, isConnectedToFleetMDM)
+		if err != nil {
+			return fleet.OrbitConfig{}, ctxerr.Wrap(ctx, err, "checking manual migration eligibility")
+		}
+
 		if appConfig.MDM.MacOSMigration.Enable &&
-			fleet.IsEligibleForDEPMigration(host, mdmInfo, isConnectedToFleetMDM) {
+			(fleet.IsEligibleForDEPMigration(host, mdmInfo, isConnectedToFleetMDM) || manualMigrationEligible) {
 			notifs.NeedsMDMMigration = true
 		}
 
-		if host.DiskEncryptionResetRequested != nil && *host.DiskEncryptionResetRequested {
-			notifs.RotateDiskEncryptionKey = true
-
-			// Since this is an user initiated action, we disable
-			// the flag when we deliver the notification to Orbit
-			if err := svc.ds.SetDiskEncryptionResetStatus(ctx, host.ID, false); err != nil {
-				return fleet.OrbitConfig{}, err
-			}
-		}
 	}
 
 	// set the host's orbit notifications for Windows MDM
@@ -309,9 +306,17 @@ func (svc *Service) GetOrbitConfig(ctx context.Context) (fleet.OrbitConfig, erro
 			}
 		}
 
-		if mdmConfig.EnableDiskEncryption &&
-			fleet.IsEligibleForBitLockerEncryption(host, mdmInfo, isConnectedToFleetMDM) {
-			notifs.EnforceBitLockerEncryption = true
+		err = svc.setDiskEncryptionNotifications(
+			ctx,
+			&notifs,
+			host,
+			appConfig,
+			mdmConfig.EnableDiskEncryption,
+			isConnectedToFleetMDM,
+			mdmInfo,
+		)
+		if err != nil {
+			return fleet.OrbitConfig{}, ctxerr.Wrap(ctx, err, "setting team disk encryption notifications")
 		}
 
 		var updateChannels *fleet.OrbitUpdateChannels
@@ -324,11 +329,12 @@ func (svc *Service) GetOrbitConfig(ctx context.Context) (fleet.OrbitConfig, erro
 		}
 
 		return fleet.OrbitConfig{
-			Flags:          opts.CommandLineStartUpFlags,
-			Extensions:     extensionsFiltered,
-			Notifications:  notifs,
-			NudgeConfig:    nudgeConfig,
-			UpdateChannels: updateChannels,
+			ScriptExeTimeout: opts.ScriptExecutionTimeout,
+			Flags:            opts.CommandLineStartUpFlags,
+			Extensions:       extensionsFiltered,
+			Notifications:    notifs,
+			NudgeConfig:      nudgeConfig,
+			UpdateChannels:   updateChannels,
 		}, nil
 	}
 
@@ -370,10 +376,17 @@ func (svc *Service) GetOrbitConfig(ctx context.Context) (fleet.OrbitConfig, erro
 		}
 	}
 
-	if appConfig.MDM.WindowsEnabledAndConfigured &&
-		appConfig.MDM.EnableDiskEncryption.Value &&
-		fleet.IsEligibleForBitLockerEncryption(host, mdmInfo, isConnectedToFleetMDM) {
-		notifs.EnforceBitLockerEncryption = true
+	err = svc.setDiskEncryptionNotifications(
+		ctx,
+		&notifs,
+		host,
+		appConfig,
+		appConfig.MDM.EnableDiskEncryption.Value,
+		isConnectedToFleetMDM,
+		mdmInfo,
+	)
+	if err != nil {
+		return fleet.OrbitConfig{}, ctxerr.Wrap(ctx, err, "setting no-team disk encryption notifications")
 	}
 
 	var updateChannels *fleet.OrbitUpdateChannels
@@ -386,14 +399,66 @@ func (svc *Service) GetOrbitConfig(ctx context.Context) (fleet.OrbitConfig, erro
 	}
 
 	return fleet.OrbitConfig{
-		Flags:          opts.CommandLineStartUpFlags,
-		Extensions:     extensionsFiltered,
-		Notifications:  notifs,
-		NudgeConfig:    nudgeConfig,
-		UpdateChannels: updateChannels,
+		ScriptExeTimeout: opts.ScriptExecutionTimeout,
+		Flags:            opts.CommandLineStartUpFlags,
+		Extensions:       extensionsFiltered,
+		Notifications:    notifs,
+		NudgeConfig:      nudgeConfig,
+		UpdateChannels:   updateChannels,
 	}, nil
 }
 
+func (svc *Service) setDiskEncryptionNotifications(
+	ctx context.Context,
+	notifs *fleet.OrbitConfigNotifications,
+	host *fleet.Host,
+	appConfig *fleet.AppConfig,
+	diskEncryptionConfigured bool,
+	isConnectedToFleetMDM bool,
+	mdmInfo *fleet.HostMDM,
+) error {
+	anyMDMConfigured := appConfig.MDM.EnabledAndConfigured || appConfig.MDM.WindowsEnabledAndConfigured
+	if !anyMDMConfigured ||
+		!isConnectedToFleetMDM ||
+		!host.IsOsqueryEnrolled() ||
+		!diskEncryptionConfigured {
+		return nil
+	}
+
+	encryptionKey, err := svc.ds.GetHostDiskEncryptionKey(ctx, host.ID)
+	if err != nil {
+		if !fleet.IsNotFound(err) {
+			return ctxerr.Wrap(ctx, err, "fetching host disk encryption key")
+		}
+	}
+
+	switch host.FleetPlatform() {
+	case "darwin":
+		mp, ok := capabilities.FromContext(ctx)
+		if !ok {
+			level.Debug(svc.logger).Log("msg", "no capabilities in context, skipping disk encryption notification")
+			return nil
+		}
+
+		if !mp.Has(fleet.CapabilityEscrowBuddy) {
+			level.Debug(svc.logger).Log("msg", "host doesn't support Escrow Buddy, skipping disk encryption notification", "host_uuid", host.UUID)
+			return nil
+		}
+
+		notifs.RotateDiskEncryptionKey = encryptionKey != nil && encryptionKey.Decryptable != nil && !*encryptionKey.Decryptable
+	case "windows":
+		isServer := mdmInfo != nil && mdmInfo.IsServer
+		needsEncryption := host.DiskEncryptionEnabled != nil && !*host.DiskEncryptionEnabled
+		keyWasDecrypted := encryptionKey != nil && encryptionKey.Decryptable != nil && *encryptionKey.Decryptable
+		encryptedWithoutKey := host.DiskEncryptionEnabled != nil && *host.DiskEncryptionEnabled && !keyWasDecrypted
+		notifs.EnforceBitLockerEncryption = !isServer &&
+			mdmInfo != nil &&
+			(needsEncryption || encryptedWithoutKey)
+	}
+
+	return nil
+}
+
 // filterExtensionsForHost filters a extensions configuration depending on the host platform and label membership.
 //
 // If all extensions are filtered, then it returns (nil, nil) (Orbit expects empty extensions if there
@@ -933,11 +998,31 @@ func (svc *Service) SaveHostSoftwareInstallResult(ctx context.Context, result *f
 			return ctxerr.Wrap(ctx, err, "get host software installation result information")
 		}
 
+		// Self-Service packages will have a nil author for the activity.
 		var user *fleet.User
-		if hsi.UserID != nil && !hsi.SelfService {
-			user, err = svc.ds.UserByID(ctx, *hsi.UserID)
-			if err != nil {
-				return ctxerr.Wrap(ctx, err, "get host software installation user")
+		if !hsi.SelfService {
+			if hsi.UserID != nil {
+				user, err = svc.ds.UserByID(ctx, *hsi.UserID)
+				if err != nil {
+					return ctxerr.Wrap(ctx, err, "get host software installation user")
+				}
+			} else {
+				// hsi.UserID can be nil if the user was deleted and/or if the installation was
+				// triggered by Fleet (policy automation). Thus we set the author of the installation
+				// to be the user that uploaded the package (by design).
+				var userID uint
+				if hsi.SoftwareInstallerUserID != nil {
+					userID = *hsi.SoftwareInstallerUserID
+				}
+				// If there's no name or email then this may be a package uploaded
+				// before we added authorship to uploaded packages.
+				if hsi.SoftwareInstallerUserName != "" && hsi.SoftwareInstallerUserEmail != "" {
+					user = &fleet.User{
+						ID:    userID,
+						Name:  hsi.SoftwareInstallerUserName,
+						Email: hsi.SoftwareInstallerUserEmail,
+					}
+				}
 			}
 		}
 
diff --git a/server/service/orbit_client.go b/server/service/orbit_client.go
index 5435f41c9217..5b67a08f4584 100644
--- a/server/service/orbit_client.go
+++ b/server/service/orbit_client.go
@@ -7,7 +7,9 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"io/fs"
+	"mime"
 	"net"
 	"net/http"
 	"net/http/httptrace"
@@ -53,11 +55,10 @@ type OrbitClient struct {
 	ConfigReceivers []fleet.OrbitConfigReceiver
 	// How frequently a new config will be fetched
 	ReceiverUpdateInterval time.Duration
-	// Cancelable context used by ExecuteConfigReceivers to cancel the
-	// update loop
-	ReceiverUpdateContext context.Context
-	// ReceiverUpdateCancelFunc will be called when ReceiverUpdateContext is cancelled
-	ReceiverUpdateCancelFunc context.CancelFunc
+	// receiverUpdateContext used by ExecuteConfigReceivers to cancel the update loop.
+	receiverUpdateContext context.Context
+	// receiverUpdateCancelFunc is used to cancel receiverUpdateContext.
+	receiverUpdateCancelFunc context.CancelFunc
 }
 
 // time-to-live for config cache
@@ -147,7 +148,7 @@ func NewOrbitClient(
 	orbitHostInfo fleet.OrbitHostInfo,
 	onGetConfigErrFns *OnGetConfigErrFuncs,
 ) (*OrbitClient, error) {
-	orbitCapabilities := fleet.CapabilityMap{}
+	orbitCapabilities := fleet.GetOrbitClientCapabilities()
 	bc, err := newBaseClient(addr, insecureSkipVerify, rootCA, "", fleetClientCert, orbitCapabilities)
 	if err != nil {
 		return nil, err
@@ -165,11 +166,27 @@ func NewOrbitClient(
 		onGetConfigErrFns:          onGetConfigErrFns,
 		lastIdleConnectionsCleanup: time.Now(),
 		ReceiverUpdateInterval:     defaultOrbitConfigReceiverInterval,
-		ReceiverUpdateContext:      ctx,
-		ReceiverUpdateCancelFunc:   cancelFunc,
+		receiverUpdateContext:      ctx,
+		receiverUpdateCancelFunc:   cancelFunc,
 	}, nil
 }
 
+// TriggerOrbitRestart triggers a orbit process restart.
+func (oc *OrbitClient) TriggerOrbitRestart(reason string) {
+	log.Info().Msgf("orbit restart triggered: %s", reason)
+	oc.receiverUpdateCancelFunc()
+}
+
+// RestartTriggered returns true if any of the config receivers triggered an orbit restart.
+func (oc *OrbitClient) RestartTriggered() bool {
+	select {
+	case <-oc.receiverUpdateContext.Done():
+		return true
+	default:
+		return false
+	}
+}
+
 // closeIdleConnections attempts to close idle connections from the pool
 // every 55 minutes.
 //
@@ -252,7 +269,7 @@ func (oc *OrbitClient) ExecuteConfigReceivers() error {
 
 	for {
 		select {
-		case <-oc.ReceiverUpdateContext.Done():
+		case <-oc.receiverUpdateContext.Done():
 			return nil
 		case <-ticker.C:
 			if err := oc.RunConfigReceivers(); err != nil {
@@ -263,8 +280,7 @@ func (oc *OrbitClient) ExecuteConfigReceivers() error {
 }
 
 func (oc *OrbitClient) InterruptConfigReceivers(err error) {
-	log.Error().Err(err).Msg("interrupt config receivers")
-	oc.ReceiverUpdateCancelFunc()
+	oc.receiverUpdateCancelFunc()
 }
 
 // GetConfig returns the Orbit config fetched from Fleet server for this instance of OrbitClient.
@@ -396,6 +412,31 @@ func (oc *OrbitClient) DownloadSoftwareInstaller(installerID uint, downloadDirec
 	return resp.GetFilePath(), nil
 }
 
+type NullFileResponse struct {
+}
+
+func (f *NullFileResponse) Handle(resp *http.Response) error {
+	_, _, err := mime.ParseMediaType(resp.Header.Get("Content-Disposition"))
+	if err != nil {
+		return fmt.Errorf("parsing media type from response header: %w", err)
+	}
+	_, err = io.Copy(io.Discard, resp.Body)
+	if err != nil {
+		return fmt.Errorf("copying from http stream to io.Discard: %w", err)
+	}
+	return nil
+}
+
+// DownloadAndDiscardSoftwareInstaller downloads the software installer and discards it.
+// This method is used during load testing by osquery-perf.
+func (oc *OrbitClient) DownloadAndDiscardSoftwareInstaller(installerID uint) error {
+	verb, path := "POST", "/api/fleet/orbit/software_install/package?alt=media"
+	resp := NullFileResponse{}
+	return oc.authenticatedRequest(verb, path, &orbitDownloadSoftwareInstallerRequest{
+		InstallerID: installerID,
+	}, &resp)
+}
+
 // Ping sends a ping request to the orbit/ping endpoint.
 func (oc *OrbitClient) Ping() error {
 	verb, path := "HEAD", "/api/fleet/orbit/ping"
diff --git a/server/service/orbit_client_test.go b/server/service/orbit_client_test.go
index 8f76595a6042..789bdaf670a7 100644
--- a/server/service/orbit_client_test.go
+++ b/server/service/orbit_client_test.go
@@ -39,8 +39,8 @@ func TestGetConfig(t *testing.T) {
 func clientWithConfig(cfg *fleet.OrbitConfig) *OrbitClient {
 	ctx, cancel := context.WithCancel(context.Background())
 	oc := &OrbitClient{
-		ReceiverUpdateContext:    ctx,
-		ReceiverUpdateCancelFunc: cancel,
+		receiverUpdateContext:    ctx,
+		receiverUpdateCancelFunc: cancel,
 	}
 	oc.configCache.config = cfg
 	oc.configCache.lastUpdated = time.Now().Add(1 * time.Hour)
@@ -127,7 +127,7 @@ func TestExecuteConfigReceiversCancel(t *testing.T) {
 	cfunc := fleet.OrbitConfigReceiverFunc(func(cfg *fleet.OrbitConfig) error {
 		calls1++
 		if calls1 == requiredCalls {
-			client.ReceiverUpdateCancelFunc()
+			client.receiverUpdateCancelFunc()
 		}
 		return nil
 	})
@@ -149,7 +149,7 @@ func TestExecuteConfigReceiversCancel(t *testing.T) {
 
 func TestExecuteConfigReceiversInterrupt(t *testing.T) {
 	client := clientWithConfig(&fleet.OrbitConfig{})
-	defer client.ReceiverUpdateCancelFunc()
+	defer client.receiverUpdateCancelFunc()
 
 	client.ReceiverUpdateInterval = 100 * time.Millisecond
 
@@ -168,7 +168,7 @@ func TestExecuteConfigReceiversInterrupt(t *testing.T) {
 
 	go func() {
 		time.Sleep(500 * time.Millisecond)
-		client.ReceiverUpdateCancelFunc()
+		client.receiverUpdateCancelFunc()
 	}()
 
 	select {
diff --git a/server/service/osquery.go b/server/service/osquery.go
index c4112f7d0d90..689c1e776ea8 100644
--- a/server/service/osquery.go
+++ b/server/service/osquery.go
@@ -81,7 +81,7 @@ func (svc *Service) AuthenticateHost(ctx context.Context, nodeKey string) (*flee
 	case err == nil:
 		// OK
 	case fleet.IsNotFound(err):
-		return nil, false, newOsqueryErrorWithInvalidNode("authentication error: invalid node key: " + nodeKey)
+		return nil, false, newOsqueryErrorWithInvalidNode("authentication error: invalid node key")
 	default:
 		return nil, false, newOsqueryError("authentication error: " + err.Error())
 	}
@@ -1008,6 +1008,10 @@ func (svc *Service) SubmitDistributedQueryResults(
 			logging.WithErr(ctx, err)
 		}
 
+		if err := svc.processSoftwareForNewlyFailingPolicies(ctx, host.ID, host.TeamID, host.Platform, host.OrbitNodeKey, policyResults); err != nil {
+			logging.WithErr(ctx, err)
+		}
+
 		// filter policy results for webhooks
 		var policyIDs []uint
 		if globalPolicyAutomationsEnabled(ac.WebhookSettings, ac.Integrations) {
@@ -1038,6 +1042,7 @@ func (svc *Service) SubmitDistributedQueryResults(
 				}()
 			}
 		}
+
 		// NOTE(mna): currently, failing policies webhook wouldn't see the new
 		// flipped policies on the next run if async processing is enabled and the
 		// collection has not been done yet (not persisted in mysql). Should
@@ -1606,6 +1611,141 @@ func (svc *Service) registerFlippedPolicies(ctx context.Context, hostID uint, ho
 	return nil
 }
 
+func (svc *Service) processSoftwareForNewlyFailingPolicies(
+	ctx context.Context,
+	hostID uint,
+	hostTeamID *uint,
+	hostPlatform string,
+	hostOrbitNodeKey *string,
+	incomingPolicyResults map[uint]*bool,
+) error {
+	if hostOrbitNodeKey == nil || *hostOrbitNodeKey == "" {
+		// We do not want to queue software installations on vanilla osquery hosts.
+		return nil
+	}
+	if hostTeamID == nil {
+		// TODO(lucas): Support hosts in "No team".
+		return nil
+	}
+
+	// Filter out results that are not failures (we are only interested on failing policies,
+	// we don't care about passing policies or policies that failed to execute).
+	incomingFailingPolicies := make(map[uint]*bool)
+	var incomingFailingPoliciesIDs []uint
+	for policyID, policyResult := range incomingPolicyResults {
+		if policyResult != nil && !*policyResult {
+			incomingFailingPolicies[policyID] = policyResult
+			incomingFailingPoliciesIDs = append(incomingFailingPoliciesIDs, policyID)
+		}
+	}
+	if len(incomingFailingPolicies) == 0 {
+		return nil
+	}
+
+	// Get policies with associated installers for the team.
+	policiesWithInstaller, err := svc.ds.GetPoliciesWithAssociatedInstaller(ctx, *hostTeamID, incomingFailingPoliciesIDs)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "failed to get policies with installer")
+	}
+	if len(policiesWithInstaller) == 0 {
+		return nil
+	}
+
+	// Filter out results of policies that are not associated to installers.
+	policiesWithInstallersMap := make(map[uint]fleet.PolicySoftwareInstallerData)
+	for _, policyWithInstaller := range policiesWithInstaller {
+		policiesWithInstallersMap[policyWithInstaller.ID] = policyWithInstaller
+	}
+	policyResultsOfPoliciesWithInstallers := make(map[uint]*bool)
+	for policyID, passes := range incomingFailingPolicies {
+		if _, ok := policiesWithInstallersMap[policyID]; !ok {
+			continue
+		}
+		policyResultsOfPoliciesWithInstallers[policyID] = passes
+	}
+	if len(policyResultsOfPoliciesWithInstallers) == 0 {
+		return nil
+	}
+
+	// Get the policies associated with installers that are flipping from passing to failing on this host.
+	policyIDsOfNewlyFailingPoliciesWithInstallers, _, err := svc.ds.FlippingPoliciesForHost(
+		ctx, hostID, policyResultsOfPoliciesWithInstallers,
+	)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "failed to get flipping policies for host")
+	}
+	if len(policyIDsOfNewlyFailingPoliciesWithInstallers) == 0 {
+		return nil
+	}
+	policyIDsOfNewlyFailingPoliciesWithInstallersSet := make(map[uint]struct{})
+	for _, policyID := range policyIDsOfNewlyFailingPoliciesWithInstallers {
+		policyIDsOfNewlyFailingPoliciesWithInstallersSet[policyID] = struct{}{}
+	}
+
+	// Finally filter out policies with installers that are not newly failing.
+	var failingPoliciesWithInstaller []fleet.PolicySoftwareInstallerData
+	for _, policyWithInstaller := range policiesWithInstaller {
+		if _, ok := policyIDsOfNewlyFailingPoliciesWithInstallersSet[policyWithInstaller.ID]; ok {
+			failingPoliciesWithInstaller = append(failingPoliciesWithInstaller, policyWithInstaller)
+		}
+	}
+
+	for _, failingPolicyWithInstaller := range failingPoliciesWithInstaller {
+		installerMetadata, err := svc.ds.GetSoftwareInstallerMetadataByID(ctx, failingPolicyWithInstaller.InstallerID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "get software installer metadata by id")
+		}
+		logger := log.With(svc.logger,
+			"host_id", hostID,
+			"host_platform", hostPlatform,
+			"policy_id", failingPolicyWithInstaller.ID,
+			"software_installer_id", failingPolicyWithInstaller.InstallerID,
+			"software_title_id", installerMetadata.TitleID,
+			"software_installer_platform", installerMetadata.Platform,
+		)
+		if fleet.PlatformFromHost(hostPlatform) != installerMetadata.Platform {
+			level.Debug(logger).Log("msg", "installer platform does not match host platform")
+			continue
+		}
+		hostLastInstall, err := svc.ds.GetHostLastInstallData(ctx, hostID, installerMetadata.InstallerID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "get host last install data")
+		}
+		// hostLastInstall.Status == nil can happen when a software is installed by Fleet and later removed.
+		if hostLastInstall != nil && hostLastInstall.Status != nil &&
+			*hostLastInstall.Status == fleet.SoftwareInstallerPending {
+			// There's a pending install for this host and installer,
+			// thus we do not queue another install request.
+			level.Debug(svc.logger).Log(
+				"msg", "found pending install request for this host and installer",
+				"pending_execution_id", hostLastInstall.ExecutionID,
+			)
+			continue
+		}
+		// NOTE(lucas): The user_id set in this software install will be NULL
+		// so this means that when generating the activity for this action
+		// (in SaveHostSoftwareInstallResult)
+		// the author will be set to the user that uploaded the software (we want this
+		// by design).
+		installUUID, err := svc.ds.InsertSoftwareInstallRequest(
+			ctx, hostID,
+			installerMetadata.InstallerID,
+			false, // Set Self-service as false because this is triggered by Fleet.
+		)
+		if err != nil {
+			return ctxerr.Wrapf(ctx, err,
+				"insert software install request: host_id=%d, software_installer_id=%d",
+				hostID, installerMetadata.InstallerID,
+			)
+		}
+		level.Debug(logger).Log(
+			"msg", "install request sent",
+			"install_uuid", installUUID,
+		)
+	}
+	return nil
+}
+
 func (svc *Service) maybeDebugHost(
 	ctx context.Context,
 	host *fleet.Host,
diff --git a/server/service/osquery_test.go b/server/service/osquery_test.go
index f8505b315543..8ceb4ec77bca 100644
--- a/server/service/osquery_test.go
+++ b/server/service/osquery_test.go
@@ -1600,7 +1600,7 @@ func TestDetailQueriesWithEmptyStrings(t *testing.T) {
       "cpu_subtype": "Intel x86-64h Haswell",
       "cpu_type": "x86_64h",
       "hardware_model": "MacBookPro11,4",
-      "hardware_serial": "ABCDEFGH",
+      "hardware_serial": "NEW_HW_SERIAL",
       "hardware_vendor": "Apple Inc.",
       "hardware_version": "1.0",
       "hostname": "computer.local",
@@ -1667,6 +1667,7 @@ func TestDetailQueriesWithEmptyStrings(t *testing.T) {
 	assert.Equal(t, int64(17179869184), gotHost.Memory)
 	assert.Equal(t, "computer.local", gotHost.Hostname)
 	assert.Equal(t, "uuid", gotHost.UUID)
+	assert.Equal(t, "NEW_HW_SERIAL", gotHost.HardwareSerial)
 
 	// os_version
 	assert.Equal(t, "Mac OS X 10.10.6", gotHost.OSVersion)
@@ -1711,8 +1712,9 @@ func TestDetailQueries(t *testing.T) {
 	svc, ctx := newTestServiceWithClock(t, ds, nil, lq, mockClock)
 
 	host := &fleet.Host{
-		ID:       1,
-		Platform: "linux",
+		ID:             1,
+		Platform:       "linux",
+		HardwareSerial: "HW_SERIAL",
 	}
 	ctx = hostctx.NewContext(ctx, host)
 
@@ -1835,7 +1837,7 @@ func TestDetailQueries(t *testing.T) {
         "cpu_subtype": "Intel x86-64h Haswell",
         "cpu_type": "x86_64h",
         "hardware_model": "MacBookPro11,4",
-        "hardware_serial": "ABCDEFGH",
+        "hardware_serial": "-1",
         "hardware_vendor": "Apple Inc.",
         "hardware_version": "1.0",
         "hostname": "computer.local",
@@ -1975,6 +1977,8 @@ func TestDetailQueries(t *testing.T) {
 	assert.Equal(t, int64(17179869184), gotHost.Memory)
 	assert.Equal(t, "computer.local", gotHost.Hostname)
 	assert.Equal(t, "uuid", gotHost.UUID)
+	// The hardware serial should not have updated because return value was -1. See: https://github.com/fleetdm/fleet/issues/19789
+	assert.Equal(t, "HW_SERIAL", gotHost.HardwareSerial)
 
 	// os_version
 	assert.Equal(t, "Mac OS X 10.10.6", gotHost.OSVersion)
diff --git a/server/service/osquery_utils/queries.go b/server/service/osquery_utils/queries.go
index 9e061d9bd7bb..f13454b2d110 100644
--- a/server/service/osquery_utils/queries.go
+++ b/server/service/osquery_utils/queries.go
@@ -336,7 +336,9 @@ var hostDetailQueries = map[string]DetailQuery{
 			host.HardwareVendor = rows[0]["hardware_vendor"]
 			host.HardwareModel = rows[0]["hardware_model"]
 			host.HardwareVersion = rows[0]["hardware_version"]
-			host.HardwareSerial = rows[0]["hardware_serial"]
+			if rows[0]["hardware_serial"] != "-1" { // ignoring the default -1 serial. See: https://github.com/fleetdm/fleet/issues/19789
+				host.HardwareSerial = rows[0]["hardware_serial"]
+			}
 			host.ComputerName = rows[0]["computer_name"]
 			return nil
 		},
@@ -942,7 +944,7 @@ SELECT
   '' AS arch,
   '' AS installed_path
 FROM deb_packages
-WHERE status = 'install ok installed'
+WHERE status LIKE '%% ok installed'
 UNION
 SELECT
   package AS name,
@@ -1597,6 +1599,31 @@ func sanitizeSoftware(h *fleet.Host, s *fleet.Software, logger log.Logger) {
 				s.Version = strings.Join(newParts, ".")
 			},
 		},
+		{
+			// Trim the "RELEASE." prefix from Minio versions.
+			checkSoftware: func(h *fleet.Host, s *fleet.Software) bool {
+				return s.Name == "minio" && strings.Contains(s.Version, "RELEASE.")
+			},
+			mutateSoftware: func(s *fleet.Software) {
+				s.Version = strings.TrimPrefix(s.Version, "RELEASE.")
+			},
+		},
+		{
+			// Convert the timestamp to NVD's format for Minio versions.
+			checkSoftware: func(h *fleet.Host, s *fleet.Software) bool {
+				regex := regexp.MustCompile(`^\d{14}$`)
+
+				return s.Name == "minio" && regex.MatchString(s.Version)
+			},
+			mutateSoftware: func(s *fleet.Software) {
+				timestamp, err := time.Parse("20060102150405", s.Version)
+				if err != nil {
+					level.Debug(logger).Log("msg", "failed to parse software version", "name", s.Name, "version", s.Version, "err", err)
+					return
+				}
+				s.Version = timestamp.Format("2006-01-02T15-04-05Z")
+			},
+		},
 	}
 
 	for _, softwareSanitizer := range softwareSanitizers {
@@ -2004,7 +2031,7 @@ func directIngestMDMDeviceIDWindows(ctx context.Context, logger log.Logger, host
 	return ds.UpdateMDMWindowsEnrollmentsHostUUID(ctx, host.UUID, rows[0]["data"])
 }
 
-//go:generate go run gen_queries_doc.go "../../../docs/Using Fleet/Understanding-host-vitals.md"
+//go:generate go run gen_queries_doc.go "../../../docs/Contributing/Understanding-host-vitals.md"
 
 func GetDetailQueries(
 	ctx context.Context,
diff --git a/server/service/osquery_utils/queries_test.go b/server/service/osquery_utils/queries_test.go
index 8fb86bcc1f86..8a2931447083 100644
--- a/server/service/osquery_utils/queries_test.go
+++ b/server/service/osquery_utils/queries_test.go
@@ -1830,6 +1830,30 @@ func TestSanitizeSoftware(t *testing.T) {
 				Version: "1.6.00.34263",
 			},
 		},
+		{
+			name: "minio",
+			h:    &fleet.Host{},
+			s: &fleet.Software{
+				Name:    "minio",
+				Version: "RELEASE.2022-03-10T00-00-00Z",
+			},
+			sanitized: &fleet.Software{
+				Name:    "minio",
+				Version: "2022-03-10T00-00-00Z",
+			},
+		},
+		{
+			name: "minio",
+			h:    &fleet.Host{},
+			s: &fleet.Software{
+				Name:    "minio",
+				Version: "20200310000000",
+			},
+			sanitized: &fleet.Software{
+				Name:    "minio",
+				Version: "2020-03-10T00-00-00Z",
+			},
+		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			sanitizeSoftware(tc.h, tc.s, log.NewNopLogger())
diff --git a/server/service/redis_lock/redis_lock.go b/server/service/redis_lock/redis_lock.go
new file mode 100644
index 000000000000..0c5e17db171d
--- /dev/null
+++ b/server/service/redis_lock/redis_lock.go
@@ -0,0 +1,140 @@
+package redis_lock
+
+import (
+	"context"
+	"errors"
+
+	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
+	"github.com/fleetdm/fleet/v4/server/datastore/redis"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	redigo "github.com/gomodule/redigo/redis"
+)
+
+// This package implements a distributed lock using Redis. The lock can be used
+// to prevent multiple Fleet servers from accessing a shared resource.
+
+const (
+	defaultExpireMs = 60 * 1000
+)
+
+type redisLock struct {
+	pool       fleet.RedisPool
+	testPrefix string // for tests, the key prefix to use to avoid conflicts
+}
+
+func NewLock(pool fleet.RedisPool) fleet.Lock {
+	lock := &redisLock{
+		pool: pool,
+	}
+	return fleet.Lock(lock)
+}
+
+func (r *redisLock) SetIfNotExist(ctx context.Context, key string, value string, expireMs uint64) (ok bool, err error) {
+	conn := redis.ConfigureDoer(r.pool, r.pool.Get())
+	defer conn.Close()
+
+	if expireMs == 0 {
+		expireMs = defaultExpireMs
+	}
+
+	// Reference: https://redis.io/docs/latest/commands/set/
+	// NX -- Only set the key if it does not already exist.
+	result, err := redigo.String(conn.Do("SET", r.testPrefix+key, value, "NX", "PX", expireMs))
+	if err != nil && !errors.Is(err, redigo.ErrNil) {
+		return false, ctxerr.Wrap(ctx, err, "redis acquire lock")
+	}
+	return result != "", nil
+}
+
+func (r *redisLock) ReleaseLock(ctx context.Context, key string, value string) (ok bool, err error) {
+	conn := redis.ConfigureDoer(r.pool, r.pool.Get())
+	defer conn.Close()
+
+	const unlockScript = `
+		if redis.call("get", KEYS[1]) == ARGV[1] then
+			return redis.call("del", KEYS[1])
+		else
+			return 0
+		end
+	`
+
+	// Reference: https://redis.io/docs/latest/commands/set/
+	// Only release the lock if the value matches.
+	res, err := redigo.Int64(conn.Do("EVAL", unlockScript, 1, r.testPrefix+key, value))
+	if err != nil && !errors.Is(err, redigo.ErrNil) {
+		return false, ctxerr.Wrap(ctx, err, "redis release lock")
+	}
+	return res > 0, nil
+}
+
+func (r *redisLock) AddToSet(ctx context.Context, key string, value string) error {
+	conn := redis.ConfigureDoer(r.pool, r.pool.Get())
+	defer conn.Close()
+
+	// Reference: https://redis.io/docs/latest/commands/sadd/
+	_, err := conn.Do("SADD", r.testPrefix+key, value)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "redis add to set")
+	}
+	return nil
+}
+
+func (r *redisLock) RemoveFromSet(ctx context.Context, key string, value string) error {
+	conn := redis.ConfigureDoer(r.pool, r.pool.Get())
+	defer conn.Close()
+
+	// Reference: https://redis.io/docs/latest/commands/srem/
+	_, err := conn.Do("SREM", r.testPrefix+key, value)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "redis add to set")
+	}
+	return nil
+}
+
+func (r *redisLock) GetSet(ctx context.Context, key string) ([]string, error) {
+	conn := redis.ConfigureDoer(r.pool, r.pool.Get())
+	defer conn.Close()
+
+	// Reference: https://redis.io/docs/latest/commands/smembers/
+	members, err := redigo.Strings(conn.Do("SMEMBERS", r.testPrefix+key))
+	if err != nil && !errors.Is(err, redigo.ErrNil) {
+		return nil, ctxerr.Wrap(ctx, err, "redis get set members")
+	}
+	return members, nil
+}
+
+func (r *redisLock) Get(ctx context.Context, key string) (*string, error) {
+	conn := redis.ConfigureDoer(r.pool, r.pool.Get())
+	defer conn.Close()
+
+	res, err := redigo.String(conn.Do("GET", r.testPrefix+key))
+	if errors.Is(err, redigo.ErrNil) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "redis get")
+	}
+	return &res, nil
+}
+
+func (r *redisLock) GetAndDelete(ctx context.Context, key string) (*string, error) {
+	conn := redis.ConfigureDoer(r.pool, r.pool.Get())
+	defer conn.Close()
+
+	// Note: In Redis 6.2.0, this can be accomplished with a single command: GETDEL.
+
+	res, err := redigo.String(conn.Do("GET", r.testPrefix+key))
+	if errors.Is(err, redigo.ErrNil) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "redis GET")
+	}
+
+	_, err = conn.Do("DEL", r.testPrefix+key)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "redis DEL")
+	}
+
+	return &res, nil
+}
diff --git a/server/service/redis_lock/redis_lock_test.go b/server/service/redis_lock/redis_lock_test.go
new file mode 100644
index 000000000000..c6663cded426
--- /dev/null
+++ b/server/service/redis_lock/redis_lock_test.go
@@ -0,0 +1,166 @@
+package redis_lock
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/datastore/redis/redistest"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/test"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRedisLock(t *testing.T) {
+	for _, f := range []func(*testing.T, fleet.Lock){
+		testRedisAcquireLock,
+		testRedisSet,
+	} {
+		t.Run(test.FunctionName(f), func(t *testing.T) {
+			t.Run("standalone", func(t *testing.T) {
+				lock := setupRedis(t, false, false)
+				f(t, lock)
+			})
+			t.Run("cluster", func(t *testing.T) {
+				lock := setupRedis(t, true, true)
+				f(t, lock)
+			})
+		})
+	}
+}
+
+func setupRedis(t testing.TB, cluster, redir bool) fleet.Lock {
+	pool := redistest.SetupRedis(t, t.Name(), cluster, redir, true)
+	return NewLockTest(t, pool)
+}
+
+type TestName interface {
+	Name() string
+}
+
+// NewFailingTest creates a redis policy set for failing policies to be used
+// only in tests.
+func NewLockTest(t TestName, pool fleet.RedisPool) fleet.Lock {
+	lock := &redisLock{
+		pool:       pool,
+		testPrefix: t.Name() + ":",
+	}
+	return fleet.Lock(lock)
+}
+
+func testRedisAcquireLock(t *testing.T, lock fleet.Lock) {
+	ctx := context.Background()
+	result, err := lock.SetIfNotExist(ctx, "test", "1", 0)
+	require.NoError(t, err)
+	assert.True(t, result)
+
+	// Try to acquire the same lock
+	result, err = lock.SetIfNotExist(ctx, "test", "1", 0)
+	assert.NoError(t, err)
+	assert.False(t, result)
+
+	// Try to release the lock with a wrong value
+	ok, err := lock.ReleaseLock(ctx, "test", "2")
+	require.NoError(t, err)
+	assert.False(t, ok)
+
+	// Try to release the lock with the wrong key
+	ok, err = lock.ReleaseLock(ctx, "bad", "1")
+	require.NoError(t, err)
+	assert.False(t, ok)
+
+	// Try to release the lock with the correct key/value
+	ok, err = lock.ReleaseLock(ctx, "test", "1")
+	require.NoError(t, err)
+	assert.True(t, ok)
+
+	// Acquire the lock again
+	result, err = lock.SetIfNotExist(ctx, "test", "1", 0)
+	require.NoError(t, err)
+	assert.True(t, result)
+
+	// Get lock
+	getResult, err := lock.Get(ctx, "test")
+	assert.NoError(t, err)
+	require.NotNil(t, getResult)
+	assert.Equal(t, "1", *getResult)
+
+	// Try to set lock with expiration
+	var expire uint64 = 10
+	result, err = lock.SetIfNotExist(ctx, "testE", "1", expire)
+	require.NoError(t, err)
+	assert.True(t, result)
+
+	// Try to acquire the same lock after waiting
+	duration := time.Duration(expire+1) * time.Millisecond
+	time.Sleep(duration)
+	result, err = lock.SetIfNotExist(ctx, "testE", "1", 0)
+	require.NoError(t, err)
+	assert.True(t, result)
+
+	// Get non-existent key
+	getResult, err = lock.Get(ctx, "testNonExistent")
+	assert.NoError(t, err)
+	assert.Nil(t, getResult)
+
+	// Get and delete non-existent key
+	getResult, err = lock.GetAndDelete(ctx, "testNonExistent")
+	assert.NoError(t, err)
+	assert.Nil(t, getResult)
+
+	// Set a new item
+	result, err = lock.SetIfNotExist(ctx, "test2", "2", 0)
+	require.NoError(t, err)
+	assert.True(t, result)
+
+	// Get and delete the item
+	getResult, err = lock.GetAndDelete(ctx, "test2")
+	assert.NoError(t, err)
+	require.NotNil(t, getResult)
+	assert.Equal(t, "2", *getResult)
+
+	// Item was deleted, so we can't get it again
+	getResult, err = lock.Get(ctx, "test2")
+	assert.NoError(t, err)
+	assert.Nil(t, getResult)
+}
+
+func testRedisSet(t *testing.T, lock fleet.Lock) {
+	ctx := context.Background()
+
+	// Get a non-existent set
+	result, err := lock.GetSet(ctx, "missingSet")
+	assert.NoError(t, err)
+	assert.Empty(t, result)
+
+	// Add to a set
+	values := []string{"foo", "bar"}
+	err = lock.AddToSet(ctx, "testSet", values[0])
+	assert.NoError(t, err)
+	err = lock.AddToSet(ctx, "testSet", values[1])
+	assert.NoError(t, err)
+
+	// Get the set
+	result, err = lock.GetSet(ctx, "testSet")
+	assert.NoError(t, err)
+	assert.ElementsMatch(t, values, result)
+
+	// Remove from set
+	err = lock.RemoveFromSet(ctx, "testSet", values[0])
+	assert.NoError(t, err)
+
+	// Get the set
+	result, err = lock.GetSet(ctx, "testSet")
+	assert.NoError(t, err)
+	assert.Equal(t, []string{values[1]}, result)
+
+	// Remove from set
+	err = lock.RemoveFromSet(ctx, "testSet", values[1])
+	assert.NoError(t, err)
+
+	// Get the set
+	result, err = lock.GetSet(ctx, "testSet")
+	assert.NoError(t, err)
+	assert.Empty(t, result)
+}
diff --git a/server/service/schedule/schedule.go b/server/service/schedule/schedule.go
index 8965416a642e..7ca865416ab6 100644
--- a/server/service/schedule/schedule.go
+++ b/server/service/schedule/schedule.go
@@ -167,7 +167,13 @@ func (s *Schedule) Start() {
 		level.Error(s.logger).Log("err", "start schedule", "details", err)
 		ctxerr.Handle(s.ctx, err)
 	}
-	s.setIntervalStartedAt(prevScheduledRun.CreatedAt)
+
+	// if there is no previous run, set the start time to the current time.
+	startedAt := prevScheduledRun.CreatedAt
+	if startedAt.IsZero() {
+		startedAt = time.Now()
+	}
+	s.setIntervalStartedAt(startedAt)
 
 	initialWait := 10 * time.Second
 	if schedInterval := s.getSchedInterval(); schedInterval < initialWait {
diff --git a/server/service/schedule/schedule_test.go b/server/service/schedule/schedule_test.go
index ccbe80d1c002..c54bd807fa88 100644
--- a/server/service/schedule/schedule_test.go
+++ b/server/service/schedule/schedule_test.go
@@ -590,6 +590,7 @@ func TestMultipleScheduleInstancesConfigChangesDS(t *testing.T) {
 }
 
 func TestTriggerSingleInstance(t *testing.T) {
+	t.Parallel()
 	ctx, cancelFn := context.WithCancel(context.Background())
 
 	name := "test_trigger_single_instance"
diff --git a/server/service/scripts.go b/server/service/scripts.go
index 91392c6d88bf..9629b78a0966 100644
--- a/server/service/scripts.go
+++ b/server/service/scripts.go
@@ -29,6 +29,8 @@ type runScriptRequest struct {
 	HostID         uint   `json:"host_id"`
 	ScriptID       *uint  `json:"script_id"`
 	ScriptContents string `json:"script_contents"`
+	ScriptName     string `json:"script_name"`
+	TeamID         uint   `json:"team_id"`
 }
 
 type runScriptResponse struct {
@@ -48,6 +50,8 @@ func runScriptEndpoint(ctx context.Context, request interface{}, svc fleet.Servi
 		HostID:         req.HostID,
 		ScriptID:       req.ScriptID,
 		ScriptContents: req.ScriptContents,
+		ScriptName:     req.ScriptName,
+		TeamID:         req.TeamID,
 	}, noWait)
 	if err != nil {
 		return runScriptResponse{Err: err}, nil
@@ -114,7 +118,7 @@ func runScriptSyncEndpoint(ctx context.Context, request interface{}, svc fleet.S
 		// response struct.
 		hostTimeout = true
 	}
-	result.Message = result.UserMessage(hostTimeout)
+	result.Message = result.UserMessage(hostTimeout, result.Timeout)
 	return runScriptSyncResponse{
 		HostScriptResult: result,
 		HostTimeout:      hostTimeout,
@@ -371,7 +375,7 @@ func getScriptResultEndpoint(ctx context.Context, request interface{}, svc fleet
 	// TODO: move this logic out of the endpoint function and consolidate in either the service
 	// method or the fleet package
 	hostTimeout := scriptResult.HostTimeout(scripts.MaxServerWaitTime)
-	scriptResult.Message = scriptResult.UserMessage(hostTimeout)
+	scriptResult.Message = scriptResult.UserMessage(hostTimeout, scriptResult.Timeout)
 
 	return &getScriptResultResponse{
 		ScriptContents: scriptResult.ScriptContents,
diff --git a/server/service/scripts_test.go b/server/service/scripts_test.go
index ffb390988229..aecf67dea446 100644
--- a/server/service/scripts_test.go
+++ b/server/service/scripts_test.go
@@ -304,7 +304,7 @@ func TestHostRunScript(t *testing.T) {
 			script  string
 			wantErr string
 		}{
-			{"empty script", "", "Script contents must not be empty."},
+			{"empty script", "", "One of 'script_id', 'script_contents', or 'script_name' is required."},
 			{"overly long script", strings.Repeat("a", fleet.UnsavedScriptMaxRuneLen+1), "Script is too large."},
 			{"large script", strings.Repeat("a", fleet.UnsavedScriptMaxRuneLen), ""},
 			{"invalid utf8", "\xff\xfa", "Wrong data format."},
diff --git a/server/service/service_campaign_test.go b/server/service/service_campaign_test.go
index d7ae34c98c98..0878b0a9bcdf 100644
--- a/server/service/service_campaign_test.go
+++ b/server/service/service_campaign_test.go
@@ -3,7 +3,6 @@ package service
 import (
 	"context"
 	"crypto/tls"
-	"github.com/fleetdm/fleet/v4/server/contexts/ctxdb"
 	"math/rand"
 	"net/http"
 	"net/http/httptest"
@@ -14,6 +13,7 @@ import (
 
 	"github.com/WatchBeam/clock"
 	"github.com/fleetdm/fleet/v4/server/config"
+	"github.com/fleetdm/fleet/v4/server/contexts/ctxdb"
 	"github.com/fleetdm/fleet/v4/server/contexts/viewer"
 	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -398,7 +398,7 @@ func TestUpdateStats(t *testing.T) {
 	testUpdateStats(t, ds, false)
 }
 
-func TestUpdateStatsOnReplica(t *testing.T) {
+func TestIntegrationsUpdateStatsOnReplica(t *testing.T) {
 	ds := mysql.CreateMySQLDSWithReplica(t, nil)
 	defer mysql.TruncateTables(t, ds)
 	testUpdateStats(t, ds, true)
diff --git a/server/service/software.go b/server/service/software.go
index ed399a25027f..e589ac7fe679 100644
--- a/server/service/software.go
+++ b/server/service/software.go
@@ -105,6 +105,11 @@ func (svc *Service) ListSoftware(ctx context.Context, opt fleet.SoftwareListOpti
 		return nil, nil, err
 	}
 
+	// Vulnerability filters are only available in premium (opt.IncludeCVEScores is only true in premium)
+	if !opt.IncludeCVEScores && (opt.MaximumCVSS > 0 || opt.MinimumCVSS > 0 || opt.KnownExploit) {
+		return nil, nil, fleet.ErrMissingLicense
+	}
+
 	// default sort order to hosts_count descending
 	if opt.ListOptions.OrderKey == "" {
 		opt.ListOptions.OrderKey = "hosts_count"
@@ -152,7 +157,7 @@ func (svc *Service) SoftwareByID(ctx context.Context, id uint, teamID *uint, inc
 		return nil, err
 	}
 
-	if teamID != nil {
+	if teamID != nil && *teamID > 0 {
 		// This auth check ensures we return 403 if the user doesn't have access to the team
 		if err := svc.authz.Authorize(ctx, &fleet.AuthzSoftwareInventory{TeamID: teamID}, fleet.ActionRead); err != nil {
 			return nil, err
@@ -226,5 +231,20 @@ func (svc Service) CountSoftware(ctx context.Context, opt fleet.SoftwareListOpti
 		return 0, err
 	}
 
+	lic, err := svc.License(ctx)
+	if err != nil {
+		return 0, ctxerr.Wrap(ctx, err, "get license")
+	}
+
+	// Vulnerability filters are only available in premium
+	if !lic.IsPremium() && (opt.MaximumCVSS > 0 || opt.MinimumCVSS > 0 || opt.KnownExploit) {
+		return 0, fleet.ErrMissingLicense
+	}
+
+	// required for vulnerability filters
+	if lic.IsPremium() {
+		opt.IncludeCVEScores = true
+	}
+
 	return svc.ds.CountSoftware(ctx, opt)
 }
diff --git a/server/service/software_installers.go b/server/service/software_installers.go
index 6624bb7bb05a..9862ade6716a 100644
--- a/server/service/software_installers.go
+++ b/server/service/software_installers.go
@@ -2,12 +2,15 @@ package service
 
 import (
 	"context"
+	"crypto/x509"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"mime/multipart"
 	"net"
 	"net/http"
+	"net/url"
 	"strconv"
 
 	"github.com/docker/go-units"
@@ -80,10 +83,10 @@ func (uploadSoftwareInstallerRequest) DecodeRequest(ctx context.Context, r *http
 
 	// default is no team
 	val, ok := r.MultipartForm.Value["team_id"]
-	if ok && len(val) > 0 {
-		teamID, err := strconv.Atoi(val[0])
+	if ok {
+		teamID, err := strconv.ParseUint(val[0], 10, 32)
 		if err != nil {
-			return nil, &fleet.BadRequestError{Message: fmt.Sprintf("failed to decode team_id in multipart form: %s", err.Error())}
+			return nil, &fleet.BadRequestError{Message: fmt.Sprintf("Invalid team_id: %s", val[0])}
 		}
 		decoded.TeamID = ptr.Uint(uint(teamID))
 	}
@@ -184,23 +187,41 @@ type getSoftwareInstallerRequest struct {
 	TitleID uint   `url:"title_id"`
 }
 
-type getSoftwareInstallerResponse struct {
-	// meta *fleet.SoftwareInstaller // NOTE: API design currently only supports downloading the
-	Err error `json:"error,omitempty"`
+type downloadSoftwareInstallerRequest struct {
+	TitleID uint   `url:"title_id"`
+	Token   string `url:"token"`
 }
 
-func (r getSoftwareInstallerResponse) error() error { return r.Err }
-
 func getSoftwareInstallerEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
 	req := request.(*getSoftwareInstallerRequest)
 
-	downloadRequested := req.Alt == "media"
-	if !downloadRequested {
-		// TODO: confirm error handling
-		return getSoftwareInstallerResponse{Err: &fleet.BadRequestError{Message: "only alt=media is supported"}}, nil
+	payload, err := svc.DownloadSoftwareInstaller(ctx, false, req.Alt, req.TitleID, req.TeamID)
+	if err != nil {
+		return orbitDownloadSoftwareInstallerResponse{Err: err}, nil
 	}
 
-	payload, err := svc.DownloadSoftwareInstaller(ctx, req.TitleID, req.TeamID)
+	return orbitDownloadSoftwareInstallerResponse{payload: payload}, nil
+}
+
+func getSoftwareInstallerTokenEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*getSoftwareInstallerRequest)
+
+	token, err := svc.GenerateSoftwareInstallerToken(ctx, req.Alt, req.TitleID, req.TeamID)
+	if err != nil {
+		return getSoftwareInstallerTokenResponse{Err: err}, nil
+	}
+	return getSoftwareInstallerTokenResponse{Token: token}, nil
+}
+
+func downloadSoftwareInstallerEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*downloadSoftwareInstallerRequest)
+
+	meta, err := svc.GetSoftwareInstallerTokenMetadata(ctx, req.Token, req.TitleID)
+	if err != nil {
+		return orbitDownloadSoftwareInstallerResponse{Err: err}, nil
+	}
+
+	payload, err := svc.DownloadSoftwareInstaller(ctx, true, "media", meta.TitleID, &meta.TeamID)
 	if err != nil {
 		return orbitDownloadSoftwareInstallerResponse{Err: err}, nil
 	}
@@ -208,7 +229,25 @@ func getSoftwareInstallerEndpoint(ctx context.Context, request interface{}, svc
 	return orbitDownloadSoftwareInstallerResponse{payload: payload}, nil
 }
 
-func (svc *Service) GetSoftwareInstallerMetadata(ctx context.Context, titleID uint, teamID *uint) (*fleet.SoftwareInstaller, error) {
+func (svc *Service) GenerateSoftwareInstallerToken(ctx context.Context, _ string, _ uint, _ *uint) (string, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return "", fleet.ErrMissingLicense
+}
+
+func (svc *Service) GetSoftwareInstallerTokenMetadata(ctx context.Context, _ string, _ uint) (*fleet.SoftwareInstallerTokenMetadata,
+	error,
+) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return nil, fleet.ErrMissingLicense
+}
+
+func (svc *Service) GetSoftwareInstallerMetadata(ctx context.Context, _ bool, _ uint, _ *uint) (*fleet.SoftwareInstaller, error) {
 	// skipauth: No authorization check needed due to implementation returning
 	// only license error.
 	svc.authz.SkipAuthorization(ctx)
@@ -216,6 +255,13 @@ func (svc *Service) GetSoftwareInstallerMetadata(ctx context.Context, titleID ui
 	return nil, fleet.ErrMissingLicense
 }
 
+type getSoftwareInstallerTokenResponse struct {
+	Err   error  `json:"error,omitempty"`
+	Token string `json:"token"`
+}
+
+func (r getSoftwareInstallerTokenResponse) error() error { return r.Err }
+
 type orbitDownloadSoftwareInstallerResponse struct {
 	Err error `json:"error,omitempty"`
 	// fields used by hijackRender for the response.
@@ -239,7 +285,10 @@ func (r orbitDownloadSoftwareInstallerResponse) hijackRender(ctx context.Context
 	r.payload.Installer.Close()
 }
 
-func (svc *Service) DownloadSoftwareInstaller(ctx context.Context, titleID uint, teamID *uint) (*fleet.DownloadSoftwareInstallerPayload, error) {
+func (svc *Service) DownloadSoftwareInstaller(ctx context.Context, _ bool, _ string, _ uint,
+	_ *uint) (*fleet.DownloadSoftwareInstallerPayload,
+	error,
+) {
 	// skipauth: No authorization check needed due to implementation returning
 	// only license error.
 	svc.authz.SkipAuthorization(ctx)
@@ -318,33 +367,33 @@ func (svc *Service) GetSoftwareInstallResults(ctx context.Context, resultUUID st
 ////////////////////////////////////////////////////////////////////////////////
 
 type batchSetSoftwareInstallersRequest struct {
-	TeamName string                           `json:"-" query:"team_name"`
+	TeamName string                           `json:"-" query:"team_name,optional"`
 	DryRun   bool                             `json:"-" query:"dry_run,optional"` // if true, apply validation but do not save changes
 	Software []fleet.SoftwareInstallerPayload `json:"software"`
 }
 
 type batchSetSoftwareInstallersResponse struct {
-	Err error `json:"error,omitempty"`
+	Installers []fleet.SoftwareInstaller `json:"installers"`
+	Err        error                     `json:"error,omitempty"`
 }
 
 func (r batchSetSoftwareInstallersResponse) error() error { return r.Err }
 
-func (r batchSetSoftwareInstallersResponse) Status() int { return http.StatusNoContent }
-
 func batchSetSoftwareInstallersEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
 	req := request.(*batchSetSoftwareInstallersRequest)
-	if err := svc.BatchSetSoftwareInstallers(ctx, req.TeamName, req.Software, req.DryRun); err != nil {
+	installers, err := svc.BatchSetSoftwareInstallers(ctx, req.TeamName, req.Software, req.DryRun)
+	if err != nil {
 		return batchSetSoftwareInstallersResponse{Err: err}, nil
 	}
-	return batchSetSoftwareInstallersResponse{}, nil
+	return batchSetSoftwareInstallersResponse{Installers: installers}, nil
 }
 
-func (svc *Service) BatchSetSoftwareInstallers(ctx context.Context, tmName string, payloads []fleet.SoftwareInstallerPayload, dryRun bool) error {
+func (svc *Service) BatchSetSoftwareInstallers(ctx context.Context, tmName string, payloads []fleet.SoftwareInstallerPayload, dryRun bool) ([]fleet.SoftwareInstaller, error) {
 	// skipauth: No authorization check needed due to implementation returning
 	// only license error.
 	svc.authz.SkipAuthorization(ctx)
 
-	return fleet.ErrMissingLicense
+	return nil, fleet.ErrMissingLicense
 }
 
 //////////////////////////////////////////////////////////////////////////////
@@ -400,3 +449,48 @@ func (svc *Service) HasSelfServiceSoftwareInstallers(ctx context.Context, host *
 
 	return svc.ds.HasSelfServiceSoftwareInstallers(ctx, host.Platform, host.TeamID)
 }
+
+//////////////////////////////////////////////////////////////////////////////
+// VPP App Store Apps Batch Install
+//////////////////////////////////////////////////////////////////////////////
+
+type batchAssociateAppStoreAppsRequest struct {
+	TeamName string                  `json:"-" query:"team_name"`
+	DryRun   bool                    `json:"-" query:"dry_run,optional"`
+	Apps     []fleet.VPPBatchPayload `json:"app_store_apps"`
+}
+
+func (b *batchAssociateAppStoreAppsRequest) DecodeBody(ctx context.Context, r io.Reader, u url.Values, c []*x509.Certificate) error {
+	if err := json.NewDecoder(r).Decode(b); err != nil {
+		var typeErr *json.UnmarshalTypeError
+		if errors.As(err, &typeErr) {
+			return ctxerr.Wrap(ctx, fleet.NewUserMessageError(fmt.Errorf("Couldn't edit software. %q must be a %s, found %s", typeErr.Field, typeErr.Type.String(), typeErr.Value), http.StatusBadRequest))
+		}
+	}
+
+	return nil
+}
+
+type batchAssociateAppStoreAppsResponse struct {
+	Err error `json:"error,omitempty"`
+}
+
+func (r batchAssociateAppStoreAppsResponse) error() error { return r.Err }
+
+func (r batchAssociateAppStoreAppsResponse) Status() int { return http.StatusNoContent }
+
+func batchAssociateAppStoreAppsEndpoint(ctx context.Context, request any, svc fleet.Service) (errorer, error) {
+	req := request.(*batchAssociateAppStoreAppsRequest)
+	if err := svc.BatchAssociateVPPApps(ctx, req.TeamName, req.Apps, req.DryRun); err != nil {
+		return batchAssociateAppStoreAppsResponse{Err: err}, nil
+	}
+	return batchAssociateAppStoreAppsResponse{}, nil
+}
+
+func (svc *Service) BatchAssociateVPPApps(ctx context.Context, teamName string, payloads []fleet.VPPBatchPayload, dryRun bool) error {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return fleet.ErrMissingLicense
+}
diff --git a/server/service/software_installers_test.go b/server/service/software_installers_test.go
index 3023773cf764..722cecda7ade 100644
--- a/server/service/software_installers_test.go
+++ b/server/service/software_installers_test.go
@@ -28,30 +28,41 @@ func TestSoftwareInstallersAuth(t *testing.T) {
 		shouldFailWrite bool
 	}{
 		{"no role no team", test.UserNoRoles, nil, true, true},
+		{"no role team 0", test.UserNoRoles, ptr.Uint(0), true, true},
 		{"no role team", test.UserNoRoles, ptr.Uint(1), true, true},
 		{"global admin no team", test.UserAdmin, nil, false, false},
+		{"global admin team 0", test.UserAdmin, ptr.Uint(0), false, false},
 		{"global admin team", test.UserAdmin, ptr.Uint(1), false, false},
 		{"global maintainer no team", test.UserMaintainer, nil, false, false},
+		{"global mainteiner team 0", test.UserMaintainer, ptr.Uint(0), false, false},
 		{"global maintainer team", test.UserMaintainer, ptr.Uint(1), false, false},
 		{"global observer no team", test.UserObserver, nil, true, true},
+		{"global observer team 0", test.UserObserver, ptr.Uint(0), true, true},
 		{"global observer team", test.UserObserver, ptr.Uint(1), true, true},
 		{"global observer+ no team", test.UserObserverPlus, nil, true, true},
+		{"global observer+ team 0", test.UserObserverPlus, ptr.Uint(0), true, true},
 		{"global observer+ team", test.UserObserverPlus, ptr.Uint(1), true, true},
 		{"global gitops no team", test.UserGitOps, nil, true, false},
+		{"global gitops team 0", test.UserGitOps, ptr.Uint(0), true, false},
 		{"global gitops team", test.UserGitOps, ptr.Uint(1), true, false},
 		{"team admin no team", test.UserTeamAdminTeam1, nil, true, true},
+		{"team admin team 0", test.UserTeamAdminTeam1, ptr.Uint(0), true, true},
 		{"team admin team", test.UserTeamAdminTeam1, ptr.Uint(1), false, false},
 		{"team admin other team", test.UserTeamAdminTeam2, ptr.Uint(1), true, true},
 		{"team maintainer no team", test.UserTeamMaintainerTeam1, nil, true, true},
+		{"team maintainer team 0", test.UserTeamMaintainerTeam1, ptr.Uint(0), true, true},
 		{"team maintainer team", test.UserTeamMaintainerTeam1, ptr.Uint(1), false, false},
 		{"team maintainer other team", test.UserTeamMaintainerTeam2, ptr.Uint(1), true, true},
 		{"team observer no team", test.UserTeamObserverTeam1, nil, true, true},
+		{"team observer team 0", test.UserTeamObserverTeam1, ptr.Uint(0), true, true},
 		{"team observer team", test.UserTeamObserverTeam1, ptr.Uint(1), true, true},
 		{"team observer other team", test.UserTeamObserverTeam2, ptr.Uint(1), true, true},
 		{"team observer+ no team", test.UserTeamObserverPlusTeam1, nil, true, true},
+		{"team observer+ team 0", test.UserTeamObserverPlusTeam1, ptr.Uint(0), true, true},
 		{"team observer+ team", test.UserTeamObserverPlusTeam1, ptr.Uint(1), true, true},
 		{"team observer+ other team", test.UserTeamObserverPlusTeam2, ptr.Uint(1), true, true},
 		{"team gitops no team", test.UserTeamGitOpsTeam1, nil, true, true},
+		{"team gitops team 0", test.UserTeamGitOpsTeam1, ptr.Uint(0), true, true},
 		{"team gitops team", test.UserTeamGitOpsTeam1, ptr.Uint(1), true, false},
 		{"team gitops other team", test.UserTeamGitOpsTeam2, ptr.Uint(1), true, true},
 	}
@@ -68,6 +79,20 @@ func TestSoftwareInstallersAuth(t *testing.T) {
 				return nil
 			}
 
+			tokenExpiration := time.Now().Add(24 * time.Hour)
+			token, err := test.CreateVPPTokenEncoded(tokenExpiration, "fleet", "ca")
+			require.NoError(t, err)
+			ds.GetVPPTokenByTeamIDFunc = func(ctx context.Context, teamID *uint) (*fleet.VPPTokenDB, error) {
+				return &fleet.VPPTokenDB{
+					ID:        1,
+					OrgName:   "Fleet",
+					Location:  "Earth",
+					RenewDate: tokenExpiration,
+					Token:     string(token),
+					Teams:     nil,
+				}, nil
+			}
+
 			ds.AppConfigFunc = func(ctx context.Context) (*fleet.AppConfig, error) {
 				return &fleet.AppConfig{}, nil
 			}
@@ -85,7 +110,15 @@ func TestSoftwareInstallersAuth(t *testing.T) {
 				return nil, nil
 			}
 
-			_, err := svc.DownloadSoftwareInstaller(ctx, 1, tt.teamID)
+			ds.TeamExistsFunc = func(ctx context.Context, teamID uint) (bool, error) {
+				return false, nil
+			}
+
+			ds.GetAllMDMConfigAssetsByNameFunc = func(ctx context.Context, assetNames []fleet.MDMAssetName) (map[fleet.MDMAssetName]fleet.MDMConfigAsset, error) {
+				return map[fleet.MDMAssetName]fleet.MDMConfigAsset{}, nil
+			}
+
+			_, err = svc.DownloadSoftwareInstaller(ctx, false, "media", 1, tt.teamID)
 			if tt.teamID == nil {
 				require.Error(t, err)
 			} else {
@@ -99,6 +132,26 @@ func TestSoftwareInstallersAuth(t *testing.T) {
 				checkAuthErr(t, tt.shouldFailWrite, err)
 			}
 
+			// Note: these calls always return an error because they're attempting to unmarshal a
+			// non-existent VPP token.
+			_, err = svc.GetAppStoreApps(ctx, tt.teamID)
+			if tt.teamID == nil {
+				require.Error(t, err)
+			} else {
+				if tt.shouldFailRead {
+					checkAuthErr(t, true, err)
+				}
+			}
+
+			err = svc.AddAppStoreApp(ctx, tt.teamID, fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "123", Platform: fleet.IOSPlatform}})
+			if tt.teamID == nil {
+				require.Error(t, err)
+			} else {
+				if tt.shouldFailWrite {
+					checkAuthErr(t, true, err)
+				}
+			}
+
 			// TODO: configure test with mock software installer store and add tests to check upload auth
 		})
 	}
diff --git a/server/service/software_titles.go b/server/service/software_titles.go
index a2776b22cd13..91c5ce98e038 100644
--- a/server/service/software_titles.go
+++ b/server/service/software_titles.go
@@ -68,14 +68,17 @@ func (svc *Service) ListSoftwareTitles(
 		return nil, 0, nil, err
 	}
 
-	if opt.TeamID != nil && *opt.TeamID != 0 {
-		lic, err := svc.License(ctx)
-		if err != nil {
-			return nil, 0, nil, ctxerr.Wrap(ctx, err, "get license")
-		}
-		if !lic.IsPremium() {
-			return nil, 0, nil, fleet.ErrMissingLicense
-		}
+	lic, err := svc.License(ctx)
+	if err != nil {
+		return nil, 0, nil, ctxerr.Wrap(ctx, err, "get license")
+	}
+
+	if opt.TeamID != nil && *opt.TeamID != 0 && !lic.IsPremium() {
+		return nil, 0, nil, fleet.ErrMissingLicense
+	}
+
+	if !lic.IsPremium() && (opt.MaximumCVSS > 0 || opt.MinimumCVSS > 0 || opt.KnownExploit) {
+		return nil, 0, nil, fleet.ErrMissingLicense
 	}
 
 	// always include metadata for software titles
@@ -132,7 +135,7 @@ func (svc *Service) SoftwareTitleByID(ctx context.Context, id uint, teamID *uint
 		return nil, err
 	}
 
-	if teamID != nil {
+	if teamID != nil && *teamID != 0 {
 		// This auth check ensures we return 403 if the user doesn't have access to the team
 		if err := svc.authz.Authorize(ctx, &fleet.AuthzSoftwareInventory{TeamID: teamID}, fleet.ActionRead); err != nil {
 			return nil, err
@@ -175,19 +178,37 @@ func (svc *Service) SoftwareTitleByID(ctx context.Context, id uint, teamID *uint
 		return nil, ctxerr.Wrap(ctx, err, "get license")
 	}
 	if license.IsPremium() {
-		// add software installer data
-		meta, err := svc.ds.GetSoftwareInstallerMetadataByTeamAndTitleID(ctx, teamID, id, true)
-		if err != nil && !fleet.IsNotFound(err) {
-			return nil, ctxerr.Wrap(ctx, err, "get software installer metadata")
+		// add software installer data if needed
+		if software.SoftwareInstallersCount > 0 {
+			meta, err := svc.ds.GetSoftwareInstallerMetadataByTeamAndTitleID(ctx, teamID, id, true)
+			if err != nil && !fleet.IsNotFound(err) {
+				return nil, ctxerr.Wrap(ctx, err, "get software installer metadata")
+			}
+			if meta != nil {
+				summary, err := svc.ds.GetSummaryHostSoftwareInstalls(ctx, meta.InstallerID)
+				if err != nil {
+					return nil, ctxerr.Wrap(ctx, err, "get software installer status summary")
+				}
+				meta.Status = summary
+			}
+			software.SoftwarePackage = meta
 		}
-		if meta != nil {
-			summary, err := svc.ds.GetSummaryHostSoftwareInstalls(ctx, meta.InstallerID)
-			if err != nil {
-				return nil, ctxerr.Wrap(ctx, err, "get software installer status summary")
+
+		// add VPP app data if needed
+		if software.VPPAppsCount > 0 {
+			meta, err := svc.ds.GetVPPAppMetadataByTeamAndTitleID(ctx, teamID, id)
+			if err != nil && !fleet.IsNotFound(err) {
+				return nil, ctxerr.Wrap(ctx, err, "get VPP app metadata")
+			}
+			if meta != nil {
+				summary, err := svc.ds.GetSummaryHostVPPAppInstalls(ctx, teamID, meta.VPPAppID)
+				if err != nil {
+					return nil, ctxerr.Wrap(ctx, err, "get VPP app status summary")
+				}
+				meta.Status = summary
 			}
-			meta.Status = summary
+			software.AppStoreApp = meta
 		}
-		software.SoftwarePackage = meta
 	}
 
 	return software, nil
diff --git a/server/service/team_policies.go b/server/service/team_policies.go
index 81ebee7d40b7..8f68ecddf1f9 100644
--- a/server/service/team_policies.go
+++ b/server/service/team_policies.go
@@ -29,6 +29,7 @@ type teamPolicyRequest struct {
 	Platform              string `json:"platform"`
 	Critical              bool   `json:"critical" premium:"true"`
 	CalendarEventsEnabled bool   `json:"calendar_events_enabled"`
+	SoftwareTitleID       *uint  `json:"software_title_id"`
 }
 
 type teamPolicyResponse struct {
@@ -40,7 +41,7 @@ func (r teamPolicyResponse) error() error { return r.Err }
 
 func teamPolicyEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
 	req := request.(*teamPolicyRequest)
-	resp, err := svc.NewTeamPolicy(ctx, req.TeamID, fleet.PolicyPayload{
+	resp, err := svc.NewTeamPolicy(ctx, req.TeamID, fleet.NewTeamPolicyPayload{
 		QueryID:               req.QueryID,
 		Name:                  req.Name,
 		Query:                 req.Query,
@@ -49,6 +50,7 @@ func teamPolicyEndpoint(ctx context.Context, request interface{}, svc fleet.Serv
 		Platform:              req.Platform,
 		Critical:              req.Critical,
 		CalendarEventsEnabled: req.CalendarEventsEnabled,
+		SoftwareTitleID:       req.SoftwareTitleID,
 	})
 	if err != nil {
 		return teamPolicyResponse{Err: err}, nil
@@ -56,7 +58,7 @@ func teamPolicyEndpoint(ctx context.Context, request interface{}, svc fleet.Serv
 	return teamPolicyResponse{Policy: resp}, nil
 }
 
-func (svc Service) NewTeamPolicy(ctx context.Context, teamID uint, p fleet.PolicyPayload) (*fleet.Policy, error) {
+func (svc Service) NewTeamPolicy(ctx context.Context, teamID uint, tp fleet.NewTeamPolicyPayload) (*fleet.Policy, error) {
 	if err := svc.authz.Authorize(ctx, &fleet.Policy{
 		PolicyData: fleet.PolicyData{
 			TeamID: ptr.Uint(teamID),
@@ -70,6 +72,11 @@ func (svc Service) NewTeamPolicy(ctx context.Context, teamID uint, p fleet.Polic
 		return nil, errors.New("user must be authenticated to create team policies")
 	}
 
+	p, err := svc.newTeamPolicyPayloadToPolicyPayload(ctx, teamID, tp)
+	if err != nil {
+		return nil, err
+	}
+
 	if err := p.Verify(); err != nil {
 		return nil, ctxerr.Wrap(ctx, &fleet.BadRequestError{
 			Message: fmt.Sprintf("policy payload verification: %s", err),
@@ -80,6 +87,10 @@ func (svc Service) NewTeamPolicy(ctx context.Context, teamID uint, p fleet.Polic
 		return nil, ctxerr.Wrap(ctx, err, "creating policy")
 	}
 
+	if err := svc.populatePolicyInstallSoftware(ctx, policy); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "populate install_software")
+	}
+
 	// Note: Issue #4191 proposes that we move to SQL transactions for actions so that we can
 	// rollback an action in the event of an error writing the associated activity
 	if err := svc.NewActivity(
@@ -95,6 +106,39 @@ func (svc Service) NewTeamPolicy(ctx context.Context, teamID uint, p fleet.Polic
 	return policy, nil
 }
 
+func (svc *Service) populatePolicyInstallSoftware(ctx context.Context, p *fleet.Policy) error {
+	if p.SoftwareInstallerID == nil {
+		return nil
+	}
+	installerMetadata, err := svc.ds.GetSoftwareInstallerMetadataByID(ctx, *p.SoftwareInstallerID)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "get software installer metadata by id")
+	}
+	p.InstallSoftware = &fleet.PolicySoftwareTitle{
+		SoftwareTitleID: *installerMetadata.TitleID,
+		Name:            installerMetadata.SoftwareTitle,
+	}
+	return nil
+}
+
+func (svc *Service) newTeamPolicyPayloadToPolicyPayload(ctx context.Context, teamID uint, p fleet.NewTeamPolicyPayload) (fleet.PolicyPayload, error) {
+	softwareInstallerID, err := svc.deduceSoftwareInstallerIDFromTitleID(ctx, &teamID, p.SoftwareTitleID)
+	if err != nil {
+		return fleet.PolicyPayload{}, err
+	}
+	return fleet.PolicyPayload{
+		QueryID:               p.QueryID,
+		Name:                  p.Name,
+		Query:                 p.Query,
+		Critical:              p.Critical,
+		Description:           p.Description,
+		Resolution:            p.Resolution,
+		Platform:              p.Platform,
+		CalendarEventsEnabled: p.CalendarEventsEnabled,
+		SoftwareInstallerID:   softwareInstallerID,
+	}, nil
+}
+
 /////////////////////////////////////////////////////////////////////////////////
 // List
 /////////////////////////////////////////////////////////////////////////////////
@@ -148,11 +192,27 @@ func (svc *Service) ListTeamPolicies(ctx context.Context, teamID uint, opts flee
 	}
 
 	if mergeInherited {
-		p, err := svc.ds.ListMergedTeamPolicies(ctx, teamID, opts)
-		return p, nil, err
+		policies, err := svc.ds.ListMergedTeamPolicies(ctx, teamID, opts)
+		for i := range policies {
+			if err := svc.populatePolicyInstallSoftware(ctx, policies[i]); err != nil {
+				return nil, nil, ctxerr.Wrapf(ctx, err, "populate install_software for policy_id: %d", policies[i].ID)
+			}
+		}
+		return policies, nil, err
 	}
 
-	return svc.ds.ListTeamPolicies(ctx, teamID, opts, iopts)
+	teamPolicies, inheritedPolicies, err = svc.ds.ListTeamPolicies(ctx, teamID, opts, iopts)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	for i := range teamPolicies {
+		if err := svc.populatePolicyInstallSoftware(ctx, teamPolicies[i]); err != nil {
+			return nil, nil, ctxerr.Wrapf(ctx, err, "populate install_software for policy_id: %d", teamPolicies[i].ID)
+		}
+	}
+
+	return teamPolicies, inheritedPolicies, nil
 }
 
 /////////////////////////////////////////////////////////////////////////////////
@@ -240,6 +300,10 @@ func (svc Service) GetTeamPolicyByIDQueries(ctx context.Context, teamID uint, po
 		return nil, err
 	}
 
+	if err := svc.populatePolicyInstallSoftware(ctx, teamPolicy); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "populate install_software")
+	}
+
 	return teamPolicy, nil
 }
 
@@ -418,6 +482,14 @@ func (svc *Service) modifyPolicy(ctx context.Context, teamID *uint, id uint, p f
 		policy.FailingHostCount = 0
 		policy.PassingHostCount = 0
 	}
+	if p.SoftwareTitleID != nil {
+		softwareInstallerID, err := svc.deduceSoftwareInstallerIDFromTitleID(ctx, teamID, p.SoftwareTitleID)
+		if err != nil {
+			return nil, err
+		}
+		policy.SoftwareInstallerID = softwareInstallerID
+	}
+
 	logging.WithExtras(ctx, "name", policy.Name, "sql", policy.Query)
 
 	err = svc.ds.SavePolicy(ctx, policy, removeAllMemberships, removeStats)
@@ -425,6 +497,10 @@ func (svc *Service) modifyPolicy(ctx context.Context, teamID *uint, id uint, p f
 		return nil, ctxerr.Wrap(ctx, err, "saving policy")
 	}
 
+	if err := svc.populatePolicyInstallSoftware(ctx, policy); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "populate install_software")
+	}
+
 	// Note: Issue #4191 proposes that we move to SQL transactions for actions so that we can
 	// rollback an action in the event of an error writing the associated activity
 	if err := svc.NewActivity(
@@ -440,3 +516,48 @@ func (svc *Service) modifyPolicy(ctx context.Context, teamID *uint, id uint, p f
 
 	return policy, nil
 }
+
+func (svc *Service) deduceSoftwareInstallerIDFromTitleID(ctx context.Context, teamID *uint, softwareTitleID *uint) (*uint, error) {
+	if softwareTitleID == nil {
+		return nil, nil
+	}
+
+	// If *p.SoftwareTitleID with value 0 is used to unset the current installer from the policy.
+	if *softwareTitleID == 0 {
+		return nil, nil
+	}
+
+	if teamID == nil {
+		return nil, ctxerr.Wrap(ctx, &fleet.BadRequestError{
+			Message: "software_title_id cannot be set on global policies",
+		})
+	}
+
+	softwareTitle, err := svc.SoftwareTitleByID(ctx, *softwareTitleID, teamID)
+	if err != nil {
+		if fleet.IsNotFound(err) {
+			return nil, ctxerr.Wrap(ctx, &fleet.BadRequestError{
+				Message: fmt.Sprintf("software_title_id %d on team_id %d not found", *softwareTitleID, *teamID),
+			})
+		}
+		return nil, ctxerr.Wrap(ctx, err, "software title by id")
+	}
+	if softwareTitle.AppStoreApp != nil {
+		return nil, ctxerr.Wrap(ctx, &fleet.BadRequestError{
+			Message: fmt.Sprintf("software_title_id %d on team_id %d is assocated to a VPP app, only software installers are supported", *softwareTitleID, *teamID),
+		})
+	}
+	if softwareTitle.SoftwarePackage == nil {
+		return nil, ctxerr.Wrap(ctx, &fleet.BadRequestError{
+			Message: fmt.Sprintf("software_title_id %d on team_id %d does not have associated package", *softwareTitleID, *teamID),
+		})
+	}
+
+	//
+	// TODO(lucas): Support "No team" (softwareTitle.SoftwarePackage.TeamID == nil).
+	//
+
+	// At this point we assume *softwareTitle.SoftwarePackage.TeamID == *teamID,
+	// because SoftwareTitleByID above receives the teamID.
+	return ptr.Uint(softwareTitle.SoftwarePackage.InstallerID), nil
+}
diff --git a/server/service/team_policies_test.go b/server/service/team_policies_test.go
index 5c6c25ff8ce0..551e6e567cf1 100644
--- a/server/service/team_policies_test.go
+++ b/server/service/team_policies_test.go
@@ -32,7 +32,7 @@ func TestTeamPoliciesAuth(t *testing.T) {
 		return nil, nil
 	}
 	ds.TeamPolicyFunc = func(ctx context.Context, teamID uint, policyID uint) (*fleet.Policy, error) {
-		return nil, nil
+		return &fleet.Policy{}, nil
 	}
 	ds.PolicyFunc = func(ctx context.Context, id uint) (*fleet.Policy, error) {
 		if id == 1 {
@@ -68,6 +68,9 @@ func TestTeamPoliciesAuth(t *testing.T) {
 	ds.TeamFunc = func(ctx context.Context, tid uint) (*fleet.Team, error) {
 		return &fleet.Team{ID: 1}, nil
 	}
+	ds.GetSoftwareInstallerMetadataByIDFunc = func(ctx context.Context, id uint) (*fleet.SoftwareInstaller, error) {
+		return &fleet.SoftwareInstaller{}, nil
+	}
 
 	testCases := []struct {
 		name            string
@@ -149,7 +152,7 @@ func TestTeamPoliciesAuth(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			ctx := viewer.NewContext(ctx, viewer.Viewer{User: tt.user})
 
-			_, err := svc.NewTeamPolicy(ctx, 1, fleet.PolicyPayload{
+			_, err := svc.NewTeamPolicy(ctx, 1, fleet.NewTeamPolicyPayload{
 				Name:  "query1",
 				Query: "select 1;",
 			})
diff --git a/server/service/teams.go b/server/service/teams.go
index 1d8a30032de7..d2bcf6a99421 100644
--- a/server/service/teams.go
+++ b/server/service/teams.go
@@ -5,11 +5,12 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
-	"golang.org/x/text/unicode/norm"
 	"io"
 	"net/http"
 	"net/url"
 
+	"golang.org/x/text/unicode/norm"
+
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 )
diff --git a/server/service/teams_test.go b/server/service/teams_test.go
index 9011e8bce73c..cf71aab79557 100644
--- a/server/service/teams_test.go
+++ b/server/service/teams_test.go
@@ -53,8 +53,9 @@ func TestTeamAuth(t *testing.T) {
 	ds.ApplyEnrollSecretsFunc = func(ctx context.Context, teamID *uint, secrets []*fleet.EnrollSecret) error {
 		return nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.ListHostsFunc = func(ctx context.Context, filter fleet.TeamFilter, opt fleet.HostListOptions) ([]*fleet.Host, error) {
 		return []*fleet.Host{}, nil
diff --git a/server/service/testdata/software-installers/README.md b/server/service/testdata/software-installers/README.md
new file mode 100644
index 000000000000..b5a59d9daf64
--- /dev/null
+++ b/server/service/testdata/software-installers/README.md
@@ -0,0 +1,3 @@
+# testdata
+
+- `fleet-osquery.msi` is a dummy MSI installer created by `packaging.BuildMSI` with a fake `orbit.exe` that just has `hello world` in it. Its software title is `Fleet osquery` and its version is `1.0.0`.
\ No newline at end of file
diff --git a/server/service/testdata/software-installers/fleet-osquery.msi b/server/service/testdata/software-installers/fleet-osquery.msi
new file mode 100644
index 000000000000..cc52ad5d4e0c
Binary files /dev/null and b/server/service/testdata/software-installers/fleet-osquery.msi differ
diff --git a/server/service/testdata/software-installers/no_version.pkg b/server/service/testdata/software-installers/no_version.pkg
new file mode 100644
index 000000000000..c649ebf17bdc
Binary files /dev/null and b/server/service/testdata/software-installers/no_version.pkg differ
diff --git a/server/service/testdata/software-installers/vim.deb b/server/service/testdata/software-installers/vim.deb
new file mode 100644
index 000000000000..e1e118e901ab
Binary files /dev/null and b/server/service/testdata/software-installers/vim.deb differ
diff --git a/server/service/testing_client.go b/server/service/testing_client.go
index b5232c2b1c5a..48476f71625e 100644
--- a/server/service/testing_client.go
+++ b/server/service/testing_client.go
@@ -118,12 +118,6 @@ func (ts *withServer) commonTearDownTest(t *testing.T) {
 		require.NoError(t, ts.ds.DeleteHost(ctx, host.ID))
 	}
 
-	// clean up any software installers
-	mysql.ExecAdhocSQL(t, ts.ds, func(q sqlx.ExtContext) error {
-		_, err := q.ExecContext(ctx, `DELETE FROM software_installers`)
-		return err
-	})
-
 	lbls, err := ts.ds.ListLabels(ctx, fleet.TeamFilter{}, fleet.ListOptions{})
 	require.NoError(t, err)
 	for _, lbl := range lbls {
@@ -161,6 +155,12 @@ func (ts *withServer) commonTearDownTest(t *testing.T) {
 		require.NoError(t, err)
 	}
 
+	// Clean software installers in "No team" (the others are deleted in ts.ds.DeleteTeam above).
+	mysql.ExecAdhocSQL(t, ts.ds, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(ctx, `DELETE FROM software_installers WHERE global_or_team_id = 0;`)
+		return err
+	})
+
 	globalPolicies, err := ts.ds.ListGlobalPolicies(ctx, fleet.ListOptions{})
 	require.NoError(t, err)
 	if len(globalPolicies) > 0 {
@@ -198,6 +198,11 @@ func (ts *withServer) commonTearDownTest(t *testing.T) {
 		_, err := q.ExecContext(ctx, `DELETE FROM host_script_results`)
 		return err
 	})
+
+	mysql.ExecAdhocSQL(t, ts.ds, func(tx sqlx.ExtContext) error {
+		_, err := tx.ExecContext(ctx, "DELETE FROM vpp_tokens;")
+		return err
+	})
 }
 
 func (ts *withServer) Do(verb, path string, params interface{}, expectedStatusCode int, queryParams ...string) *http.Response {
@@ -279,6 +284,21 @@ func (ts *withServer) DoJSON(verb, path string, params interface{}, expectedStat
 	}
 }
 
+func (ts *withServer) DoJSONWithoutAuth(verb, path string, params interface{}, expectedStatusCode int, v interface{}, queryParams ...string) {
+	t := ts.s.T()
+	rawBytes, err := json.Marshal(params)
+	require.NoError(t, err)
+	resp := ts.DoRawWithHeaders(verb, path, rawBytes, expectedStatusCode, map[string]string{}, queryParams...)
+	t.Cleanup(func() {
+		resp.Body.Close()
+	})
+	err = json.NewDecoder(resp.Body).Decode(v)
+	require.NoError(ts.s.T(), err)
+	if e, ok := v.(errorer); ok {
+		require.NoError(ts.s.T(), e.error())
+	}
+}
+
 func (ts *withServer) getTestAdminToken() string {
 	testUser := testUsers["admin1"]
 
@@ -480,3 +500,24 @@ func (ts *withServer) lastActivityOfTypeMatches(name, details string, id uint) u
 	t.Fatalf("no activity of type %s found in the last %d activities", name, len(listActivities.Activities))
 	return 0
 }
+
+func (ts *withServer) lastActivityOfTypeDoesNotMatch(name, details string, id uint) {
+	t := ts.s.T()
+
+	var listActivities listActivitiesResponse
+	ts.DoJSON("GET", "/api/latest/fleet/activities", nil, http.StatusOK,
+		&listActivities, "order_key", "a.id", "order_direction", "desc", "per_page", "10")
+	require.True(t, len(listActivities.Activities) > 0)
+
+	for _, act := range listActivities.Activities {
+		if act.Type == name {
+			if details != "" {
+				require.NotNil(t, act.Details)
+				assert.NotEqual(t, details, string(*act.Details))
+			}
+			if id > 0 {
+				assert.NotEqual(t, id, act.ID)
+			}
+		}
+	}
+}
diff --git a/server/service/testing_utils.go b/server/service/testing_utils.go
index 73c0d495c04c..29edb79ae326 100644
--- a/server/service/testing_utils.go
+++ b/server/service/testing_utils.go
@@ -34,6 +34,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/fleetdm/fleet/v4/server/service/async"
 	"github.com/fleetdm/fleet/v4/server/service/mock"
+	"github.com/fleetdm/fleet/v4/server/service/redis_lock"
 	"github.com/fleetdm/fleet/v4/server/sso"
 	"github.com/fleetdm/fleet/v4/server/test"
 	kitlog "github.com/go-kit/log"
@@ -63,12 +64,14 @@ func newTestServiceWithConfig(t *testing.T, ds fleet.Datastore, fleetConfig conf
 		mailer            fleet.MailService             = &mockMailService{SendEmailFn: func(e fleet.Email) error { return nil }}
 		c                 clock.Clock                   = clock.C
 
-		is                   fleet.InstallerStore
-		mdmStorage           fleet.MDMAppleStore
-		mdmPusher            nanomdm_push.Pusher
-		ssoStore             sso.SessionStore
-		profMatcher          fleet.ProfileMatcher
-		softwareInstallStore fleet.SoftwareInstallerStore
+		is                    fleet.InstallerStore
+		mdmStorage            fleet.MDMAppleStore
+		mdmPusher             nanomdm_push.Pusher
+		ssoStore              sso.SessionStore
+		profMatcher           fleet.ProfileMatcher
+		softwareInstallStore  fleet.SoftwareInstallerStore
+		bootstrapPackageStore fleet.MDMBootstrapPackageStore
+		distributedLock       fleet.Lock
 	)
 	if len(opts) > 0 {
 		if opts[0].Clock != nil {
@@ -95,6 +98,7 @@ func newTestServiceWithConfig(t *testing.T, ds fleet.Datastore, fleetConfig conf
 		if opts[0].Pool != nil {
 			ssoStore = sso.NewSessionStore(opts[0].Pool)
 			profMatcher = apple_mdm.NewProfileMatcher(opts[0].Pool)
+			distributedLock = redis_lock.NewLock(opts[0].Pool)
 		}
 		if opts[0].ProfileMatcher != nil {
 			profMatcher = opts[0].ProfileMatcher
@@ -112,6 +116,9 @@ func newTestServiceWithConfig(t *testing.T, ds fleet.Datastore, fleetConfig conf
 		if opts[0].SoftwareInstallStore != nil {
 			softwareInstallStore = opts[0].SoftwareInstallStore
 		}
+		if opts[0].BootstrapPackageStore != nil {
+			bootstrapPackageStore = opts[0].BootstrapPackageStore
+		}
 
 		// allow to explicitly set installer store to nil
 		is = opts[0].Is
@@ -185,7 +192,7 @@ func newTestServiceWithConfig(t *testing.T, ds fleet.Datastore, fleetConfig conf
 		svc, err = eeservice.NewService(
 			svc,
 			ds,
-			kitlog.NewNopLogger(),
+			logger,
 			fleetConfig,
 			mailer,
 			c,
@@ -194,6 +201,8 @@ func newTestServiceWithConfig(t *testing.T, ds fleet.Datastore, fleetConfig conf
 			ssoStore,
 			profMatcher,
 			softwareInstallStore,
+			bootstrapPackageStore,
+			distributedLock,
 		)
 		if err != nil {
 			panic(err)
@@ -283,30 +292,31 @@ func (svc *mockMailService) SendEmail(e fleet.Email) error {
 type TestNewScheduleFunc func(ctx context.Context, ds fleet.Datastore) fleet.NewCronScheduleFunc
 
 type TestServerOpts struct {
-	Logger               kitlog.Logger
-	License              *fleet.LicenseInfo
-	SkipCreateTestUsers  bool
-	Rs                   fleet.QueryResultStore
-	Lq                   fleet.LiveQueryStore
-	Pool                 fleet.RedisPool
-	FailingPolicySet     fleet.FailingPolicySet
-	Clock                clock.Clock
-	Task                 *async.Task
-	EnrollHostLimiter    fleet.EnrollHostLimiter
-	Is                   fleet.InstallerStore
-	FleetConfig          *config.FleetConfig
-	MDMStorage           fleet.MDMAppleStore
-	DEPStorage           nanodep_storage.AllDEPStorage
-	SCEPStorage          scep_depot.Depot
-	MDMPusher            nanomdm_push.Pusher
-	HTTPServerConfig     *http.Server
-	StartCronSchedules   []TestNewScheduleFunc
-	UseMailService       bool
-	APNSTopic            string
-	ProfileMatcher       fleet.ProfileMatcher
-	EnableCachedDS       bool
-	NoCacheDatastore     bool
-	SoftwareInstallStore fleet.SoftwareInstallerStore
+	Logger                kitlog.Logger
+	License               *fleet.LicenseInfo
+	SkipCreateTestUsers   bool
+	Rs                    fleet.QueryResultStore
+	Lq                    fleet.LiveQueryStore
+	Pool                  fleet.RedisPool
+	FailingPolicySet      fleet.FailingPolicySet
+	Clock                 clock.Clock
+	Task                  *async.Task
+	EnrollHostLimiter     fleet.EnrollHostLimiter
+	Is                    fleet.InstallerStore
+	FleetConfig           *config.FleetConfig
+	MDMStorage            fleet.MDMAppleStore
+	DEPStorage            nanodep_storage.AllDEPStorage
+	SCEPStorage           scep_depot.Depot
+	MDMPusher             nanomdm_push.Pusher
+	HTTPServerConfig      *http.Server
+	StartCronSchedules    []TestNewScheduleFunc
+	UseMailService        bool
+	APNSTopic             string
+	ProfileMatcher        fleet.ProfileMatcher
+	EnableCachedDS        bool
+	NoCacheDatastore      bool
+	SoftwareInstallStore  fleet.SoftwareInstallerStore
+	BootstrapPackageStore fleet.MDMBootstrapPackageStore
 }
 
 func RunServerForTestsWithDS(t *testing.T, ds fleet.Datastore, opts ...*TestServerOpts) (map[string]fleet.User, *httptest.Server) {
@@ -622,7 +632,6 @@ func mdmConfigurationRequiredEndpoints() []struct {
 		{"DELETE", "/api/latest/fleet/mdm/apple/installers/1", false, false},
 		{"GET", "/api/latest/fleet/mdm/apple/installers", false, false},
 		{"GET", "/api/latest/fleet/mdm/apple/devices", false, false},
-		{"GET", "/api/latest/fleet/mdm/apple/dep/devices", false, false},
 		{"GET", "/api/latest/fleet/mdm/apple/profiles", false, false},
 		{"GET", "/api/latest/fleet/mdm/apple/profiles/1", false, false},
 		{"DELETE", "/api/latest/fleet/mdm/apple/profiles/1", false, false},
diff --git a/server/service/vpp.go b/server/service/vpp.go
new file mode 100644
index 000000000000..c2e25eddc060
--- /dev/null
+++ b/server/service/vpp.go
@@ -0,0 +1,315 @@
+package service
+
+import (
+	"context"
+	"io"
+	"mime/multipart"
+	"net/http"
+
+	"github.com/docker/go-units"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+)
+
+//////////////////////////////////////////////////////////////////////////////
+// Get App Store apps
+//////////////////////////////////////////////////////////////////////////////
+
+type getAppStoreAppsRequest struct {
+	TeamID uint `query:"team_id"`
+}
+
+type getAppStoreAppsResponse struct {
+	AppStoreApps []*fleet.VPPApp `json:"app_store_apps"`
+	Err          error           `json:"error,omitempty"`
+}
+
+func (r getAppStoreAppsResponse) error() error { return r.Err }
+
+func getAppStoreAppsEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*getAppStoreAppsRequest)
+	apps, err := svc.GetAppStoreApps(ctx, &req.TeamID)
+	if err != nil {
+		return &getAppStoreAppsResponse{Err: err}, nil
+	}
+
+	return &getAppStoreAppsResponse{AppStoreApps: apps}, nil
+}
+
+func (svc *Service) GetAppStoreApps(ctx context.Context, teamID *uint) ([]*fleet.VPPApp, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return nil, fleet.ErrMissingLicense
+}
+
+//////////////////////////////////////////////////////////////////////////////
+// Add App Store apps
+//////////////////////////////////////////////////////////////////////////////
+
+type addAppStoreAppRequest struct {
+	TeamID      *uint                     `json:"team_id"`
+	AppStoreID  string                    `json:"app_store_id"`
+	Platform    fleet.AppleDevicePlatform `json:"platform"`
+	SelfService bool                      `json:"self_service"`
+}
+
+type addAppStoreAppResponse struct {
+	Err error `json:"error,omitempty"`
+}
+
+func (r addAppStoreAppResponse) error() error { return r.Err }
+
+func addAppStoreAppEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*addAppStoreAppRequest)
+	err := svc.AddAppStoreApp(ctx, req.TeamID, fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: req.AppStoreID, Platform: req.Platform}, SelfService: req.SelfService})
+	if err != nil {
+		return &addAppStoreAppResponse{Err: err}, nil
+	}
+
+	return &addAppStoreAppResponse{}, nil
+}
+
+func (svc *Service) AddAppStoreApp(ctx context.Context, _ *uint, _ fleet.VPPAppTeam) error {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return fleet.ErrMissingLicense
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// POST /api/_version_/vpp_tokens
+////////////////////////////////////////////////////////////////////////////////
+
+type uploadVPPTokenRequest struct {
+	File *multipart.FileHeader
+}
+
+func (uploadVPPTokenRequest) DecodeRequest(ctx context.Context, r *http.Request) (interface{}, error) {
+	decoded := uploadVPPTokenRequest{}
+
+	err := r.ParseMultipartForm(512 * units.MiB)
+	if err != nil {
+		return nil, &fleet.BadRequestError{
+			Message:     "failed to parse multipart form",
+			InternalErr: err,
+		}
+	}
+
+	if r.MultipartForm.File["token"] == nil || len(r.MultipartForm.File["token"]) == 0 {
+		return nil, &fleet.BadRequestError{
+			Message:     "token multipart field is required",
+			InternalErr: err,
+		}
+	}
+
+	decoded.File = r.MultipartForm.File["token"][0]
+
+	return &decoded, nil
+}
+
+type uploadVPPTokenResponse struct {
+	Err   error             `json:"error,omitempty"`
+	Token *fleet.VPPTokenDB `json:"token,omitempty"`
+}
+
+func (r uploadVPPTokenResponse) Status() int { return http.StatusAccepted }
+
+func (r uploadVPPTokenResponse) error() error {
+	return r.Err
+}
+
+func uploadVPPTokenEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*uploadVPPTokenRequest)
+	file, err := req.File.Open()
+	if err != nil {
+		return uploadVPPTokenResponse{Err: err}, nil
+	}
+	defer file.Close()
+
+	tok, err := svc.UploadVPPToken(ctx, file)
+	if err != nil {
+		return uploadVPPTokenResponse{Err: err}, nil
+	}
+
+	return uploadVPPTokenResponse{Token: tok}, nil
+}
+
+func (svc *Service) UploadVPPToken(ctx context.Context, file io.ReadSeeker) (*fleet.VPPTokenDB, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return nil, fleet.ErrMissingLicense
+}
+
+////////////////////////////////////////////////////
+// PATCH /api/_version_/fleet/vpp_tokens/%d/renew //
+////////////////////////////////////////////////////
+
+type patchVPPTokenRenewRequest struct {
+	ID   uint `url:"id"`
+	File *multipart.FileHeader
+}
+
+func (patchVPPTokenRenewRequest) DecodeRequest(ctx context.Context, r *http.Request) (interface{}, error) {
+	decoded := patchVPPTokenRenewRequest{}
+
+	err := r.ParseMultipartForm(512 * units.MiB)
+	if err != nil {
+		return nil, &fleet.BadRequestError{
+			Message:     "failed to parse multipart form",
+			InternalErr: err,
+		}
+	}
+
+	if r.MultipartForm.File["token"] == nil || len(r.MultipartForm.File["token"]) == 0 {
+		return nil, &fleet.BadRequestError{
+			Message:     "token multipart field is required",
+			InternalErr: err,
+		}
+	}
+
+	decoded.File = r.MultipartForm.File["token"][0]
+
+	return &decoded, nil
+}
+
+type patchVPPTokenRenewResponse struct {
+	Err   error             `json:"error,omitempty"`
+	Token *fleet.VPPTokenDB `json:"token,omitempty"`
+}
+
+func (r patchVPPTokenRenewResponse) Status() int { return http.StatusAccepted }
+
+func (r patchVPPTokenRenewResponse) error() error {
+	return r.Err
+}
+
+func patchVPPTokenRenewEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*patchVPPTokenRenewRequest)
+	file, err := req.File.Open()
+	if err != nil {
+		return patchVPPTokenRenewResponse{Err: err}, nil
+	}
+	defer file.Close()
+
+	tok, err := svc.UpdateVPPToken(ctx, req.ID, file)
+	if err != nil {
+		return patchVPPTokenRenewResponse{Err: err}, nil
+	}
+
+	return patchVPPTokenRenewResponse{Token: tok}, nil
+}
+
+func (svc *Service) UpdateVPPToken(ctx context.Context, tokenID uint, token io.ReadSeeker) (*fleet.VPPTokenDB, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return nil, fleet.ErrMissingLicense
+}
+
+////////////////////////////////////////////////////
+// PATCH /api/_version_/fleet/vpp_tokens/%d/teams //
+////////////////////////////////////////////////////
+
+type patchVPPTokensTeamsRequest struct {
+	ID      uint   `url:"id"`
+	TeamIDs []uint `json:"teams"`
+}
+
+type patchVPPTokensTeamsResponse struct {
+	Token *fleet.VPPTokenDB `json:"token,omitempty"`
+	Err   error             `json:"error,omitempty"`
+}
+
+func (r patchVPPTokensTeamsResponse) error() error { return r.Err }
+
+func patchVPPTokensTeams(ctx context.Context, request any, svc fleet.Service) (errorer, error) {
+	req := request.(*patchVPPTokensTeamsRequest)
+
+	tok, err := svc.UpdateVPPTokenTeams(ctx, req.ID, req.TeamIDs)
+	if err != nil {
+		return patchVPPTokensTeamsResponse{Err: err}, nil
+	}
+	return patchVPPTokensTeamsResponse{Token: tok}, nil
+}
+
+func (svc *Service) UpdateVPPTokenTeams(ctx context.Context, tokenID uint, teamIDs []uint) (*fleet.VPPTokenDB, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return nil, fleet.ErrMissingLicense
+}
+
+/////////////////////////////////////////
+// GET /api/_version_/fleet/vpp_tokens //
+/////////////////////////////////////////
+
+type getVPPTokensRequest struct{}
+
+type getVPPTokensResponse struct {
+	Tokens []*fleet.VPPTokenDB `json:"vpp_tokens"`
+	Err    error               `json:"error,omitempty"`
+}
+
+func (r getVPPTokensResponse) error() error { return r.Err }
+
+func getVPPTokens(ctx context.Context, request any, svc fleet.Service) (errorer, error) {
+	tokens, err := svc.GetVPPTokens(ctx)
+	if err != nil {
+		return getVPPTokensResponse{Err: err}, nil
+	}
+
+	if tokens == nil {
+		tokens = []*fleet.VPPTokenDB{}
+	}
+
+	return getVPPTokensResponse{Tokens: tokens}, nil
+}
+
+func (svc *Service) GetVPPTokens(ctx context.Context) ([]*fleet.VPPTokenDB, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return nil, fleet.ErrMissingLicense
+}
+
+///////////////////////////////////////////////
+// DELETE /api/_version_/fleet/vpp_tokens/%d //
+///////////////////////////////////////////////
+
+type deleteVPPTokenRequest struct {
+	ID uint `url:"id"`
+}
+
+type deleteVPPTokenResponse struct {
+	Err error `json:"error,omitempty"`
+}
+
+func (r deleteVPPTokenResponse) error() error { return r.Err }
+
+func (r deleteVPPTokenResponse) Status() int { return http.StatusNoContent }
+
+func deleteVPPToken(ctx context.Context, request any, svc fleet.Service) (errorer, error) {
+	req := request.(*deleteVPPTokenRequest)
+
+	err := svc.DeleteVPPToken(ctx, req.ID)
+	if err != nil {
+		return deleteVPPTokenResponse{Err: err}, nil
+	}
+
+	return deleteVPPTokenResponse{}, nil
+}
+
+func (svc *Service) DeleteVPPToken(ctx context.Context, tokenID uint) error {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return fleet.ErrMissingLicense
+}
diff --git a/server/service/vpp_test.go b/server/service/vpp_test.go
new file mode 100644
index 000000000000..95b9c65ed0d9
--- /dev/null
+++ b/server/service/vpp_test.go
@@ -0,0 +1,106 @@
+package service
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/authz"
+	"github.com/fleetdm/fleet/v4/server/contexts/viewer"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/mock"
+	"github.com/fleetdm/fleet/v4/server/ptr"
+	"github.com/fleetdm/fleet/v4/server/test"
+	"github.com/stretchr/testify/require"
+)
+
+func TestVPPAuth(t *testing.T) {
+	ds := new(mock.Store)
+
+	license := &fleet.LicenseInfo{Tier: fleet.TierPremium, Expiration: time.Now().Add(24 * time.Hour)}
+
+	svc, ctx := newTestService(t, ds, nil, nil, &TestServerOpts{License: license})
+
+	// use a custom implementation of checkAuthErr as the service call will fail
+	// with a different error for in case of authorization success and the
+	// package-wide checkAuthErr requires no error.
+	checkAuthErr := func(t *testing.T, shouldFail bool, err error) {
+		if shouldFail {
+			require.Error(t, err)
+			require.Equal(t, (&authz.Forbidden{}).Error(), err.Error())
+		} else if err != nil {
+			require.NotEqual(t, (&authz.Forbidden{}).Error(), err.Error())
+		}
+	}
+
+	testCases := []struct {
+		name            string
+		user            *fleet.User
+		teamID          *uint
+		shouldFailRead  bool
+		shouldFailWrite bool
+	}{
+		{"no role no team", test.UserNoRoles, nil, true, true},
+		{"no role team", test.UserNoRoles, ptr.Uint(1), true, true},
+		{"global admin no team", test.UserAdmin, nil, false, false},
+		{"global admin team", test.UserAdmin, ptr.Uint(1), false, false},
+		{"global maintainer no team", test.UserMaintainer, nil, false, false},
+		{"global maintainer team", test.UserMaintainer, ptr.Uint(1), false, false},
+		{"global observer no team", test.UserObserver, nil, true, true},
+		{"global observer team", test.UserObserver, ptr.Uint(1), true, true},
+		{"global observer+ no team", test.UserObserverPlus, nil, true, true},
+		{"global observer+ team", test.UserObserverPlus, ptr.Uint(1), true, true},
+		{"global gitops no team", test.UserGitOps, nil, true, false},
+		{"global gitops team", test.UserGitOps, ptr.Uint(1), true, false},
+		{"team admin no team", test.UserTeamAdminTeam1, nil, true, true},
+		{"team admin team", test.UserTeamAdminTeam1, ptr.Uint(1), false, false},
+		{"team admin other team", test.UserTeamAdminTeam2, ptr.Uint(1), true, true},
+		{"team maintainer no team", test.UserTeamMaintainerTeam1, nil, true, true},
+		{"team maintainer team", test.UserTeamMaintainerTeam1, ptr.Uint(1), false, false},
+		{"team maintainer other team", test.UserTeamMaintainerTeam2, ptr.Uint(1), true, true},
+		{"team observer no team", test.UserTeamObserverTeam1, nil, true, true},
+		{"team observer team", test.UserTeamObserverTeam1, ptr.Uint(1), true, true},
+		{"team observer other team", test.UserTeamObserverTeam2, ptr.Uint(1), true, true},
+		{"team observer+ no team", test.UserTeamObserverPlusTeam1, nil, true, true},
+		{"team observer+ team", test.UserTeamObserverPlusTeam1, ptr.Uint(1), true, true},
+		{"team observer+ other team", test.UserTeamObserverPlusTeam2, ptr.Uint(1), true, true},
+		{"team gitops no team", test.UserTeamGitOpsTeam1, nil, true, true},
+		{"team gitops team", test.UserTeamGitOpsTeam1, ptr.Uint(1), true, false},
+		{"team gitops other team", test.UserTeamGitOpsTeam2, ptr.Uint(1), true, true},
+	}
+
+	for _, tt := range testCases {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := viewer.NewContext(ctx, viewer.Viewer{User: tt.user})
+
+			ds.TeamExistsFunc = func(ctx context.Context, teamID uint) (bool, error) {
+				return false, nil
+			}
+			ds.GetAllMDMConfigAssetsByNameFunc = func(ctx context.Context, assetNames []fleet.MDMAssetName) (map[fleet.MDMAssetName]fleet.MDMConfigAsset, error) {
+				return map[fleet.MDMAssetName]fleet.MDMConfigAsset{}, nil
+			}
+			ds.TeamFunc = func(ctx context.Context, tid uint) (*fleet.Team, error) {
+				return &fleet.Team{ID: 1}, nil
+			}
+			ds.GetVPPTokenByTeamIDFunc = func(ctx context.Context, teamID *uint) (*fleet.VPPTokenDB, error) {
+				return &fleet.VPPTokenDB{ID: 1, OrgName: "org", Teams: []fleet.TeamTuple{{ID: 1}}}, nil
+			}
+
+			// Note: these calls always return an error because they're attempting to unmarshal a
+			// non-existent VPP token.
+			_, err := svc.GetAppStoreApps(ctx, tt.teamID)
+			if tt.teamID == nil {
+				require.Error(t, err)
+			} else {
+				checkAuthErr(t, tt.shouldFailRead, err)
+			}
+
+			err = svc.AddAppStoreApp(ctx, tt.teamID, fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "123", Platform: fleet.IOSPlatform}})
+			if tt.teamID == nil {
+				require.Error(t, err)
+			} else {
+				checkAuthErr(t, tt.shouldFailWrite, err)
+			}
+		})
+	}
+}
diff --git a/server/service/vulnerabilities.go b/server/service/vulnerabilities.go
index 8f6392c9742e..cf301c77c9af 100644
--- a/server/service/vulnerabilities.go
+++ b/server/service/vulnerabilities.go
@@ -3,6 +3,8 @@ package service
 import (
 	"context"
 	"fmt"
+	"net/http"
+	"regexp"
 	"time"
 
 	"github.com/fleetdm/fleet/v4/server/authz"
@@ -17,6 +19,18 @@ var freeValidVulnSortColumns = []string{
 	"created_at",
 }
 
+type cveNotFoundError struct{}
+
+var _ fleet.NotFoundError = (*cveNotFoundError)(nil)
+
+func (p cveNotFoundError) Error() string {
+	return "This is not a known CVE. None of Fleet’s vulnerability sources are aware of this CVE."
+}
+
+func (p cveNotFoundError) IsNotFound() bool {
+	return true
+}
+
 type listVulnerabilitiesRequest struct {
 	fleet.VulnListOptions
 }
@@ -29,6 +43,9 @@ type listVulnerabilitiesResponse struct {
 	Err             error                             `json:"error,omitempty"`
 }
 
+// Allow formats like: CVE-2017-12345, cve-2017-12345
+var cveRegex = regexp.MustCompile(`(?i)^CVE-\d{4}-\d{4}\d*$`)
+
 func (r listVulnerabilitiesResponse) error() error { return r.Err }
 
 func listVulnerabilitiesEndpoint(ctx context.Context, req interface{}, svc fleet.Service) (errorer, error) {
@@ -60,7 +77,7 @@ func listVulnerabilitiesEndpoint(ctx context.Context, req interface{}, svc fleet
 
 func (svc *Service) ListVulnerabilities(ctx context.Context, opt fleet.VulnListOptions) ([]fleet.VulnerabilityWithMetadata, *fleet.PaginationMetadata, error) {
 	if err := svc.authz.Authorize(ctx, &fleet.AuthzSoftwareInventory{
-		TeamID: &opt.TeamID,
+		TeamID: opt.TeamID,
 	}, fleet.ActionRead); err != nil {
 		return nil, nil, err
 	}
@@ -91,7 +108,7 @@ func (svc *Service) ListVulnerabilities(ctx context.Context, opt fleet.VulnListO
 
 func (svc *Service) CountVulnerabilities(ctx context.Context, opts fleet.VulnListOptions) (uint, error) {
 	if err := svc.authz.Authorize(ctx, &fleet.AuthzSoftwareInventory{
-		TeamID: &opts.TeamID,
+		TeamID: opts.TeamID,
 	}, fleet.ActionRead); err != nil {
 		return 0, err
 	}
@@ -99,6 +116,10 @@ func (svc *Service) CountVulnerabilities(ctx context.Context, opts fleet.VulnLis
 	return svc.ds.CountVulnerabilities(ctx, opts)
 }
 
+func (svc *Service) IsCVEKnownToFleet(ctx context.Context, cve string) (bool, error) {
+	return svc.ds.IsCVEKnownToFleet(ctx, cve)
+}
+
 type getVulnerabilityRequest struct {
 	CVE    string `url:"cve"`
 	TeamID *uint  `query:"team_id,optional"`
@@ -109,17 +130,29 @@ type getVulnerabilityResponse struct {
 	OSVersions    []*fleet.VulnerableOS            `json:"os_versions"`
 	Software      []*fleet.VulnerableSoftware      `json:"software"`
 	Err           error                            `json:"error,omitempty"`
+	statusCode    int
 }
 
 func (r getVulnerabilityResponse) error() error { return r.Err }
 
+func (r getVulnerabilityResponse) Status() int {
+	if r.statusCode == 0 {
+		return http.StatusOK
+	}
+	return r.statusCode
+}
+
 func getVulnerabilityEndpoint(ctx context.Context, req interface{}, svc fleet.Service) (errorer, error) {
 	request := req.(*getVulnerabilityRequest)
 
-	vuln, err := svc.Vulnerability(ctx, request.CVE, request.TeamID, false)
+	vuln, known, err := svc.Vulnerability(ctx, request.CVE, request.TeamID, false)
 	if err != nil {
 		return getVulnerabilityResponse{Err: err}, nil
 	}
+	if vuln == nil && known {
+		// Return 204 status code if the vulnerability is known to Fleet but does not match any host software/OS
+		return getVulnerabilityResponse{statusCode: http.StatusNoContent}, nil
+	}
 
 	vuln.DetailsLink = fmt.Sprintf("https://nvd.nist.gov/vuln/detail/%s", vuln.CVE.CVE)
 
@@ -140,30 +173,48 @@ func getVulnerabilityEndpoint(ctx context.Context, req interface{}, svc fleet.Se
 	}, nil
 }
 
-func (svc *Service) Vulnerability(ctx context.Context, cve string, teamID *uint, useCVSScores bool) (*fleet.VulnerabilityWithMetadata, error) {
+func (svc *Service) Vulnerability(ctx context.Context, cve string, teamID *uint, useCVSScores bool) (vuln *fleet.VulnerabilityWithMetadata,
+	known bool, err error,
+) {
 	if err := svc.authz.Authorize(ctx, &fleet.AuthzSoftwareInventory{TeamID: teamID}, fleet.ActionRead); err != nil {
-		return nil, err
+		return nil, false, err
 	}
 
 	if err := svc.authz.Authorize(ctx, &fleet.Host{TeamID: teamID}, fleet.ActionRead); err != nil {
-		return nil, err
+		return nil, false, err
 	}
 
-	if teamID != nil {
+	if !cveRegex.Match([]byte(cve)) {
+		return nil, false, badRequest("That vulnerability (CVE) is not valid. Try updating your search to use CVE format: \"CVE-YYYY-<4 or more digits>\"")
+	}
+
+	if teamID != nil && *teamID != 0 {
 		exists, err := svc.ds.TeamExists(ctx, *teamID)
 		if err != nil {
-			return nil, ctxerr.Wrap(ctx, err, "checking if team exists")
+			return nil, false, ctxerr.Wrap(ctx, err, "checking if team exists")
 		} else if !exists {
-			return nil, authz.ForbiddenWithInternal("team does not exist", nil, nil, nil)
+			return nil, false, authz.ForbiddenWithInternal("team does not exist", nil, nil, nil)
 		}
 	}
 
-	vuln, err := svc.ds.Vulnerability(ctx, cve, teamID, useCVSScores)
-	if err != nil {
-		return nil, err
+	vuln, err = svc.ds.Vulnerability(ctx, cve, teamID, useCVSScores)
+	switch {
+	case fleet.IsNotFound(err):
+		var errKnown error
+		known, errKnown = svc.ds.IsCVEKnownToFleet(ctx, cve)
+		if errKnown != nil {
+			return nil, false, errKnown
+		}
+		if !known {
+			return nil, false, cveNotFoundError{}
+		}
+	case err != nil:
+		return nil, false, err
+	default:
+		known = true
 	}
 
-	return vuln, nil
+	return vuln, known, nil
 }
 
 func (svc *Service) ListOSVersionsByCVE(ctx context.Context, cve string, teamID *uint) (result []*fleet.VulnerableOS, updatedAt time.Time, err error) {
diff --git a/server/service/vulnerabilities_test.go b/server/service/vulnerabilities_test.go
index fd0a7e2eecbe..fcef3ede9a57 100644
--- a/server/service/vulnerabilities_test.go
+++ b/server/service/vulnerabilities_test.go
@@ -161,7 +161,7 @@ func TestVulnerabilitesAuth(t *testing.T) {
 			checkAuthErr(t, tc.shouldFailGlobalRead, err)
 
 			_, _, err = svc.ListVulnerabilities(ctx, fleet.VulnListOptions{
-				TeamID: 1,
+				TeamID: ptr.Uint(1),
 			})
 			checkAuthErr(t, tc.shouldFailTeamRead, err)
 
@@ -169,14 +169,14 @@ func TestVulnerabilitesAuth(t *testing.T) {
 			checkAuthErr(t, tc.shouldFailGlobalRead, err)
 
 			_, err = svc.CountVulnerabilities(ctx, fleet.VulnListOptions{
-				TeamID: 1,
+				TeamID: ptr.Uint(1),
 			})
 			checkAuthErr(t, tc.shouldFailTeamRead, err)
 
-			_, err = svc.Vulnerability(ctx, "CVE-2019-1234", nil, false)
+			_, _, err = svc.Vulnerability(ctx, "CVE-2019-1234", nil, false)
 			checkAuthErr(t, tc.shouldFailGlobalRead, err)
 
-			_, err = svc.Vulnerability(ctx, "CVE-2019-1234", ptr.Uint(1), false)
+			_, _, err = svc.Vulnerability(ctx, "CVE-2019-1234", ptr.Uint(1), false)
 			checkAuthErr(t, tc.shouldFailTeamRead, err)
 		})
 	}
diff --git a/server/shellquote/shellquote.go b/server/shellquote/shellquote.go
new file mode 100644
index 000000000000..8960a427c33d
--- /dev/null
+++ b/server/shellquote/shellquote.go
@@ -0,0 +1,156 @@
+// Based on https://github.com/kballard/go-shellquote
+
+package shellquote
+
+import (
+	"bytes"
+	"errors"
+	"strings"
+	"unicode/utf8"
+)
+
+var (
+	UnterminatedSingleQuoteError = errors.New("unterminated single-quoted string")
+	UnterminatedDoubleQuoteError = errors.New("unterminated double-quoted string")
+	UnterminatedEscapeError      = errors.New("unterminated backslash-escape")
+)
+
+var (
+	splitChars        = " \n\t"
+	singleChar        = '\''
+	doubleChar        = '"'
+	escapeChar        = '\\'
+	doubleEscapeChars = "$`\"\n\\"
+)
+
+// Split splits a string according to /bin/sh's word-splitting rules. It
+// supports backslash-escapes, single-quotes, and double-quotes. Notably it does
+// not support the $” style of quoting. It also doesn't attempt to perform any
+// other sort of expansion, including brace expansion, shell expansion, or
+// pathname expansion.
+//
+// If the given input has an unterminated quoted string or ends in a
+// backslash-escape, one of UnterminatedSingleQuoteError,
+// UnterminatedDoubleQuoteError, or UnterminatedEscapeError is returned.
+func Split(input string) (words []string, err error) {
+	var buf bytes.Buffer
+	words = make([]string, 0)
+
+	for len(input) > 0 {
+		// skip any splitChars at the start
+		c, l := utf8.DecodeRuneInString(input)
+		if strings.ContainsRune(splitChars, c) {
+			input = input[l:]
+			continue
+		} else if c == escapeChar {
+			// Look ahead for escaped newline, so we can skip over it
+			next := input[l:]
+			if len(next) == 0 {
+				err = UnterminatedEscapeError
+				return
+			}
+			c2, l2 := utf8.DecodeRuneInString(next)
+			if c2 == '\n' {
+				input = next[l2:]
+				continue
+			}
+		}
+
+		var word string
+		word, input, err = splitWord(input, &buf)
+		if err != nil {
+			return
+		}
+		words = append(words, word)
+	}
+	return
+}
+
+func splitWord(input string, buf *bytes.Buffer) (word string, remainder string, err error) {
+	buf.Reset()
+
+raw:
+	{
+		cur := input
+		for len(cur) > 0 {
+			c, l := utf8.DecodeRuneInString(cur)
+			cur = cur[l:]
+			if c == singleChar {
+				buf.WriteString(input[0 : len(input)-len(cur)-l])
+				input = cur
+				goto single
+			} else if c == doubleChar {
+				buf.WriteString(input[0 : len(input)-len(cur)-l])
+				input = cur
+				goto double
+			} else if c == escapeChar {
+				buf.WriteString(input[0 : len(input)-len(cur)-l])
+				input = cur
+				goto escape
+			} else if strings.ContainsRune(splitChars, c) {
+				buf.WriteString(input[0 : len(input)-len(cur)-l])
+				return buf.String(), cur, nil
+			}
+		}
+		if len(input) > 0 {
+			buf.WriteString(input)
+			input = ""
+		}
+		goto done
+	}
+
+escape:
+	{
+		if len(input) == 0 {
+			return "", "", UnterminatedEscapeError
+		}
+		c, l := utf8.DecodeRuneInString(input)
+		// a backslash-escaped newline is elided from the output entirely
+		if c != '\n' {
+			buf.WriteString(input[:l])
+		}
+		input = input[l:]
+	}
+	goto raw
+
+single:
+	{
+		i := strings.IndexRune(input, singleChar)
+		if i == -1 {
+			return "", "", UnterminatedSingleQuoteError
+		}
+		buf.WriteString(input[0:i])
+		input = input[i+1:]
+		goto raw
+	}
+
+double:
+	{
+		cur := input
+		for len(cur) > 0 {
+			c, l := utf8.DecodeRuneInString(cur)
+			cur = cur[l:]
+			if c == doubleChar {
+				buf.WriteString(input[0 : len(input)-len(cur)-l])
+				input = cur
+				goto raw
+			} else if c == escapeChar {
+				// bash only supports certain escapes in double-quoted strings
+				c2, l2 := utf8.DecodeRuneInString(cur)
+				cur = cur[l2:]
+				if strings.ContainsRune(doubleEscapeChars, c2) {
+					buf.WriteString(input[0 : len(input)-len(cur)-l-l2])
+					// newline is special, skip the backslash entirely
+					if c2 != '\n' {
+						buf.WriteRune(c2)
+					}
+					input = cur
+				}
+			}
+		}
+		return "", "", UnterminatedDoubleQuoteError
+	}
+
+done:
+	return buf.String(), input, nil
+}
diff --git a/server/shellquote/shellquote_test.go b/server/shellquote/shellquote_test.go
new file mode 100644
index 000000000000..0c59a48fd7a0
--- /dev/null
+++ b/server/shellquote/shellquote_test.go
@@ -0,0 +1,61 @@
+// Based on https://github.com/kballard/go-shellquote
+
+package shellquote
+
+import (
+	"errors"
+	"reflect"
+	"testing"
+)
+
+func TestSimpleSplit(t *testing.T) {
+	t.Parallel()
+	for _, elem := range simpleSplitTest {
+		output, err := Split(elem.input)
+		if err != nil {
+			t.Errorf("Input %q, got error %#v", elem.input, err)
+		} else if !reflect.DeepEqual(output, elem.output) {
+			t.Errorf("Input %q, got %q, expected %q", elem.input, output, elem.output)
+		}
+	}
+}
+
+func TestErrorSplit(t *testing.T) {
+	t.Parallel()
+	for _, elem := range errorSplitTest {
+		_, err := Split(elem.input)
+		if !errors.Is(err, elem.error) {
+			t.Errorf("Input %q, got error %#v, expected error %#v", elem.input, err, elem.error)
+		}
+	}
+}
+
+var simpleSplitTest = []struct {
+	input  string
+	output []string
+}{
+	{"hello", []string{"hello"}},
+	{"hello goodbye", []string{"hello", "goodbye"}},
+	{"hello   goodbye", []string{"hello", "goodbye"}},
+	{"glob* test?", []string{"glob*", "test?"}},
+	{"don\\'t you know the dewey decimal system\\?", []string{"don't", "you", "know", "the", "dewey", "decimal", "system?"}},
+	{"'don'\\''t you know the dewey decimal system?'", []string{"don't you know the dewey decimal system?"}},
+	{"one '' two", []string{"one", "", "two"}},
+	{"text with\\\na backslash-escaped newline", []string{"text", "witha", "backslash-escaped", "newline"}},
+	{"text \"with\na\" quoted newline", []string{"text", "with\na", "quoted", "newline"}},
+	{"\"quoted\\d\\\\\\\" text with\\\na backslash-escaped newline\"", []string{"quoted\\d\\\" text witha backslash-escaped newline"}},
+	{"text with an escaped \\\n newline in the middle", []string{"text", "with", "an", "escaped", "newline", "in", "the", "middle"}},
+	{"foo\"bar\"baz", []string{"foobarbaz"}},
+	{"--foo 6mI74pVBAidu1bALjY0F+wN4mPQyu8DUap/9M/kHp8I=", []string{"--foo", "6mI74pVBAidu1bALjY0F+wN4mPQyu8DUap/9M/kHp8I="}},
+}
+
+var errorSplitTest = []struct {
+	input string
+	error error
+}{
+	{"don't worry", UnterminatedSingleQuoteError},
+	{"'test'\\''ing", UnterminatedSingleQuoteError},
+	{"\"foo'bar", UnterminatedDoubleQuoteError},
+	{"foo\\", UnterminatedEscapeError},
+	{"   \\", UnterminatedEscapeError},
+}
diff --git a/server/test/mdm.go b/server/test/mdm.go
new file mode 100644
index 000000000000..0b5e8a5760a6
--- /dev/null
+++ b/server/test/mdm.go
@@ -0,0 +1,69 @@
+package test
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/stretchr/testify/require"
+	"github.com/tj/assert"
+)
+
+func CreateVPPTokenData(expiration time.Time, orgName, location string) (*fleet.VPPTokenData, error) {
+	var randBytes [32]byte
+	_, err := rand.Read(randBytes[:])
+	if err != nil {
+		return nil, fmt.Errorf("generating random bytes: %w", err)
+	}
+	token := base64.StdEncoding.EncodeToString(randBytes[:])
+	raw := fleet.VPPTokenRaw{
+		OrgName: orgName,
+		Token:   token,
+		ExpDate: expiration.Format("2006-01-02T15:04:05Z0700"),
+	}
+	rawJson, err := json.Marshal(raw)
+	if err != nil {
+		return nil, fmt.Errorf("marshalling vpp raw token: %w", err)
+	}
+
+	base64Token := base64.StdEncoding.EncodeToString(rawJson)
+	return &fleet.VPPTokenData{Token: base64Token, Location: location}, nil
+}
+
+func CreateInsertGlobalVPPToken(t *testing.T, ds fleet.Datastore) *fleet.VPPTokenDB {
+	ctx := context.Background()
+	dataToken, err := CreateVPPTokenData(time.Now().Add(24*time.Hour), "Donkey Kong", "Jungle")
+	require.NoError(t, err)
+	tok1, err := ds.InsertVPPToken(ctx, dataToken)
+	assert.NoError(t, err)
+	tok1New, err := ds.UpdateVPPTokenTeams(ctx, tok1.ID, []uint{})
+	assert.NoError(t, err)
+
+	return tok1New
+}
+
+func CreateVPPTokenEncoded(expiration time.Time, orgName, location string) ([]byte, error) {
+	dataToken, err := CreateVPPTokenData(expiration, orgName, location)
+	if err != nil {
+		return nil, err
+	}
+	return []byte(dataToken.Token), nil
+}
+
+func CreateVPPTokenEncodedAfterMigration(expiration time.Time, orgName, location string) ([]byte, error) {
+	dataToken, err := CreateVPPTokenData(expiration, orgName, location)
+	if err != nil {
+		return nil, err
+	}
+
+	dataTokenJson, err := json.Marshal(dataToken)
+	if err != nil {
+		return nil, fmt.Errorf("marshalling vpp data token: %w", err)
+	}
+	return dataTokenJson, nil
+}
diff --git a/server/test/new_objects.go b/server/test/new_objects.go
index 099b7a0e579c..f8a2de578c24 100644
--- a/server/test/new_objects.go
+++ b/server/test/new_objects.go
@@ -210,6 +210,12 @@ func WithPlatform(s string) NewHostOption {
 	}
 }
 
+func WithTeamID(teamID uint) NewHostOption {
+	return func(h *fleet.Host) {
+		h.TeamID = &teamID
+	}
+}
+
 func NewHost(tb testing.TB, ds fleet.Datastore, name, ip, key, uuid string, now time.Time, options ...NewHostOption) *fleet.Host {
 	osqueryHostID, _ := server.GenerateRandomText(10)
 	h := &fleet.Host{
diff --git a/server/vulnerabilities/customcve/matching_rules.go b/server/vulnerabilities/customcve/matching_rules.go
index d4bc2d255c32..88a0dc7bbd2f 100644
--- a/server/vulnerabilities/customcve/matching_rules.go
+++ b/server/vulnerabilities/customcve/matching_rules.go
@@ -43,6 +43,30 @@ func getCVEMatchingRules() CVEMatchingRules {
 			CVEs:              []string{"CVE-2024-30101", "CVE-2024-30102", "CVE-2024-30103", "CVE-2024-30104"},
 			ResolvedInVersion: "16.0.17628.20144",
 		},
+		// July 9 2024 Office 365 Vulnerabilities
+		// https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
+		{
+			NameLikeMatch:     "Microsoft 365",
+			SourceMatch:       "programs",
+			CVEs:              []string{"CVE-2023-38545", "CVE-2024-38020", "CVE-2024-38021"},
+			ResolvedInVersion: "16.0.17726.20160",
+		},
+		// August 13 2024 Office 365 Vulnerabilities
+		// https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
+		{
+			NameLikeMatch: "Microsoft 365",
+			SourceMatch:   "programs",
+			CVEs: []string{
+				"CVE-2024-38172",
+				"CVE-2024-38170",
+				"CVE-2024-38173",
+				"CVE-2024-38171",
+				"CVE-2024-38189",
+				"CVE-2024-38169",
+				"CVE-2024-38200",
+			},
+			ResolvedInVersion: "16.0.17830.20166",
+		},
 	}
 }
 
diff --git a/server/vulnerabilities/customcve/matching_rules_test.go b/server/vulnerabilities/customcve/matching_rules_test.go
index ee8eec9dc851..042ba68ef0f5 100644
--- a/server/vulnerabilities/customcve/matching_rules_test.go
+++ b/server/vulnerabilities/customcve/matching_rules_test.go
@@ -2,6 +2,7 @@ package customcve
 
 import (
 	"context"
+	"sort"
 	"testing"
 	"time"
 
@@ -193,22 +194,32 @@ func TestValidateAll(t *testing.T) {
 func TestCheckCustomVulnerabilities(t *testing.T) {
 	ds := new(mock.Store)
 	sw := []fleet.Software{
+		// Very old version should match all custom matching rules.
 		{
 			ID:      1,
 			Name:    "Microsoft 365 - en-us",
 			Version: "16.0.17531.20152",
 			Source:  "programs",
 		},
+		// This version should match June matching rules but not July and August.
 		{
 			ID:      2,
 			Name:    "Microsoft 365 - en-us",
-			Version: "16.0.17425.20176",
+			Version: "16.0.17628.20144",
 			Source:  "programs",
 		},
+		// This version should match June and July, but not August.
 		{
 			ID:      3,
 			Name:    "Microsoft 365 - en-us",
-			Version: "16.0.17628.20144",
+			Version: "16.0.17726.20161",
+			Source:  "programs",
+		},
+		// This version should have no CVEs.
+		{
+			ID:      4,
+			Name:    "Microsoft 365 - en-us",
+			Version: "16.0.17830.20167",
 			Source:  "programs",
 		},
 	}
@@ -233,8 +244,8 @@ func TestCheckCustomVulnerabilities(t *testing.T) {
 		ctx := context.Background()
 		vulns, err := CheckCustomVulnerabilities(ctx, ds, log.NewNopLogger(), 1*time.Hour)
 		require.NoError(t, err)
-		require.Equal(t, 8, insertCount)
-		require.Len(t, vulns, 8)
+		require.Equal(t, 31, insertCount)
+		require.Len(t, vulns, 31)
 		require.True(t, ds.DeleteOutOfDateVulnerabilitiesFuncInvoked)
 
 		expected := []fleet.SoftwareVulnerability{
@@ -258,28 +269,156 @@ func TestCheckCustomVulnerabilities(t *testing.T) {
 				CVE:               "CVE-2024-30104",
 				ResolvedInVersion: ptr.String("16.0.17628.20144"),
 			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2023-38545",
+				ResolvedInVersion: ptr.String("16.0.17726.20160"),
+			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2024-38020",
+				ResolvedInVersion: ptr.String("16.0.17726.20160"),
+			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2024-38021",
+				ResolvedInVersion: ptr.String("16.0.17726.20160"),
+			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2024-38172",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2024-38170",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2024-38173",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2024-38171",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2024-38189",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2024-38169",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2024-38200",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
 			{
 				SoftwareID:        2,
-				CVE:               "CVE-2024-30101",
-				ResolvedInVersion: ptr.String("16.0.17628.20144"),
+				CVE:               "CVE-2023-38545",
+				ResolvedInVersion: ptr.String("16.0.17726.20160"),
 			},
 			{
 				SoftwareID:        2,
-				CVE:               "CVE-2024-30102",
-				ResolvedInVersion: ptr.String("16.0.17628.20144"),
+				CVE:               "CVE-2024-38020",
+				ResolvedInVersion: ptr.String("16.0.17726.20160"),
 			},
 			{
 				SoftwareID:        2,
-				CVE:               "CVE-2024-30103",
-				ResolvedInVersion: ptr.String("16.0.17628.20144"),
+				CVE:               "CVE-2024-38021",
+				ResolvedInVersion: ptr.String("16.0.17726.20160"),
 			},
 			{
 				SoftwareID:        2,
-				CVE:               "CVE-2024-30104",
-				ResolvedInVersion: ptr.String("16.0.17628.20144"),
+				CVE:               "CVE-2024-38172",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        2,
+				CVE:               "CVE-2024-38170",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        2,
+				CVE:               "CVE-2024-38173",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        2,
+				CVE:               "CVE-2024-38171",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        2,
+				CVE:               "CVE-2024-38189",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        2,
+				CVE:               "CVE-2024-38169",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        2,
+				CVE:               "CVE-2024-38200",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        3,
+				CVE:               "CVE-2024-38172",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        3,
+				CVE:               "CVE-2024-38170",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        3,
+				CVE:               "CVE-2024-38173",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        3,
+				CVE:               "CVE-2024-38171",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        3,
+				CVE:               "CVE-2024-38189",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        3,
+				CVE:               "CVE-2024-38169",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        3,
+				CVE:               "CVE-2024-38200",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
 			},
 		}
 
+		cmpSoftwareVulnerability := func(v []fleet.SoftwareVulnerability) func(i, j int) bool {
+			return func(i, j int) bool {
+				if v[i].SoftwareID <= v[j].SoftwareID {
+					if v[i].SoftwareID == v[j].SoftwareID {
+						return v[i].CVE < v[j].CVE
+					}
+					return true
+				}
+				return false
+			}
+		}
+		sort.Slice(expected, cmpSoftwareVulnerability(expected))
+		sort.Slice(vulns, cmpSoftwareVulnerability(vulns))
 		require.Equal(t, expected, vulns)
 	})
 
@@ -306,7 +445,7 @@ func TestCheckCustomVulnerabilities(t *testing.T) {
 		vulns, err := CheckCustomVulnerabilities(ctx, ds, log.NewNopLogger(), 1*time.Hour)
 		require.NoError(t, err)
 		require.True(t, ds.DeleteOutOfDateVulnerabilitiesFuncInvoked)
-		require.Equal(t, 8, insertCount)
+		require.Equal(t, 31, insertCount)
 		require.Len(t, vulns, 0)
 	})
 }
diff --git a/server/vulnerabilities/goval_dictionary/analyzer.go b/server/vulnerabilities/goval_dictionary/analyzer.go
new file mode 100644
index 000000000000..d4b6414e534a
--- /dev/null
+++ b/server/vulnerabilities/goval_dictionary/analyzer.go
@@ -0,0 +1,139 @@
+package goval_dictionary
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/vulnerabilities/oval"
+	"github.com/fleetdm/fleet/v4/server/vulnerabilities/utils"
+	kitlog "github.com/go-kit/log"
+)
+
+const (
+	hostsBatchSize = 500
+	vulnBatchSize  = 500
+)
+
+var ErrUnsupportedPlatform = errors.New("unsupported platform")
+
+// Analyze scans all hosts for vulnerabilities based on the sqlite output of goval-dictionary
+// for their platform,  inserting any new vulnerabilities and deleting anything patched.
+// Returns nil, nil when the platform isn't supported.
+func Analyze(
+	ctx context.Context,
+	ds fleet.Datastore,
+	ver fleet.OSVersion,
+	vulnPath string,
+	collectVulns bool,
+	logger kitlog.Logger,
+) ([]fleet.SoftwareVulnerability, error) {
+	platform := oval.NewPlatform(ver.Platform, ver.Name)
+	source := fleet.GovalDictionarySource
+	if !platform.IsGovalDictionarySupported() {
+		return nil, ErrUnsupportedPlatform
+	}
+	db, err := loadDb(platform, vulnPath)
+	if err != nil {
+		return nil, err
+	}
+
+	// Since hosts and software have a M:N relationship, the following sets are used to
+	// avoid doing duplicated inserts/delete operations (a vulnerable software might be
+	// present in many hosts).
+	toInsertSet := make(map[string]fleet.SoftwareVulnerability)
+	toDeleteSet := make(map[string]fleet.SoftwareVulnerability)
+
+	var offset int
+	for {
+		hostIDs, err := ds.HostIDsByOSVersion(ctx, ver, offset, hostsBatchSize)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(hostIDs) == 0 {
+			break
+		}
+		offset += hostsBatchSize
+
+		foundInBatch := make(map[uint][]fleet.SoftwareVulnerability)
+		for _, hostID := range hostIDs {
+			hostID := hostID
+			software, err := ds.ListSoftwareForVulnDetection(ctx, fleet.VulnSoftwareFilter{HostID: &hostID})
+			if err != nil {
+				return nil, err
+			}
+
+			vulnerabilities := db.Eval(software, logger)
+			foundInBatch[hostID] = vulnerabilities
+		}
+
+		existingInBatch, err := ds.ListSoftwareVulnerabilitiesByHostIDsSource(ctx, hostIDs, source)
+		if err != nil {
+			return nil, err
+		}
+
+		for _, hostID := range hostIDs {
+			inserts, deletes := utils.VulnsDelta(foundInBatch[hostID], existingInBatch[hostID])
+			for _, i := range inserts {
+				toInsertSet[i.Key()] = i
+			}
+			for _, d := range deletes {
+				toDeleteSet[d.Key()] = d
+			}
+		}
+	}
+
+	err = utils.BatchProcess(toDeleteSet, func(v []fleet.SoftwareVulnerability) error {
+		return ds.DeleteSoftwareVulnerabilities(ctx, v)
+	}, vulnBatchSize)
+	if err != nil {
+		return nil, err
+	}
+
+	var inserted []fleet.SoftwareVulnerability
+	if collectVulns {
+		inserted = make([]fleet.SoftwareVulnerability, 0, len(toInsertSet))
+	}
+
+	err = utils.BatchProcess(toInsertSet, func(vulns []fleet.SoftwareVulnerability) error {
+		for _, v := range vulns {
+			ok, err := ds.InsertSoftwareVulnerability(ctx, v, source)
+			if err != nil {
+				return err
+			}
+
+			if collectVulns && ok {
+				inserted = append(inserted, v)
+			}
+		}
+		return nil
+	}, vulnBatchSize)
+	if err != nil {
+		return nil, err
+	}
+
+	return inserted, nil
+}
+
+// loadDb returns the latest goval_dictionary database for the given platform.
+func loadDb(platform oval.Platform, vulnPath string) (*Database, error) {
+	if !platform.IsGovalDictionarySupported() {
+		return nil, fmt.Errorf("platform %q not supported", platform)
+	}
+
+	fileName := platform.ToGovalDictionaryFilename()
+	latest, err := utils.LatestFile(fileName, vulnPath)
+	if err != nil {
+		return nil, err
+	}
+
+	sqlite, err := sql.Open("sqlite3", latest)
+	if err != nil {
+		return nil, err
+	}
+
+	db := NewDB(sqlite, platform)
+	return db, nil
+}
diff --git a/server/vulnerabilities/goval_dictionary/database.go b/server/vulnerabilities/goval_dictionary/database.go
new file mode 100644
index 000000000000..1cb8e46ef6d3
--- /dev/null
+++ b/server/vulnerabilities/goval_dictionary/database.go
@@ -0,0 +1,87 @@
+package goval_dictionary
+
+import (
+	"database/sql"
+	"fmt"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/vulnerabilities/oval"
+	"github.com/fleetdm/fleet/v4/server/vulnerabilities/utils"
+	kitlog "github.com/go-kit/log"
+	"github.com/go-kit/log/level"
+	"strings"
+)
+
+func NewDB(db *sql.DB, platform oval.Platform) *Database {
+	return &Database{sqlite: db, platform: platform}
+}
+
+type Database struct {
+	sqlite   *sql.DB
+	platform oval.Platform
+}
+
+// Eval evaluates the current goval_dictionary database against an OS version and a list of installed software,
+// returns all software vulnerabilities found. Logs on any errors so we return as many vulnerabilities as we can.
+func (db Database) Eval(software []fleet.Software, logger kitlog.Logger) []fleet.SoftwareVulnerability {
+	searchStmt := `SELECT packages.version, cves.cve_id 
+		FROM packages join definitions on definitions.id = packages.definition_id
+		JOIN advisories ON advisories.definition_id = definitions.id JOIN cves ON cves.advisory_id = advisories.id
+		WHERE packages.name = ? AND packages.arch = ? ORDER BY cve_id, version`
+	vulnerabilities := make([]fleet.SoftwareVulnerability, 0)
+
+	for _, swItem := range software {
+		err := func() error {
+			affectedSoftwareRows, err := db.sqlite.Query(searchStmt, swItem.Name, swItem.Arch)
+			if err != nil {
+				return fmt.Errorf("could not query database: %w", err)
+			}
+			defer affectedSoftwareRows.Close()
+			for affectedSoftwareRows.Next() {
+				var fixedVersionWithEpochPrefix, cve string
+				if err := affectedSoftwareRows.Scan(&fixedVersionWithEpochPrefix, &cve); err != nil {
+					level.Error(logger).Log(
+						"msg", "could not read package vulnerability result",
+						"package", swItem.Name,
+						"arch", swItem.Arch,
+						"platform", db.platform,
+						"err", err,
+					)
+					continue
+				}
+
+				var currentVersion string
+				if swItem.Release != "" {
+					currentVersion = fmt.Sprintf("%s-%s", swItem.Version, swItem.Release)
+				} else {
+					currentVersion = swItem.Version
+				}
+				fixedVersion := strings.Split(fixedVersionWithEpochPrefix, ":")[1]
+
+				if utils.Rpmvercmp(currentVersion, fixedVersion) < 0 {
+					vulnerabilities = append(vulnerabilities, fleet.SoftwareVulnerability{
+						SoftwareID:        swItem.ID,
+						CVE:               cve,
+						ResolvedInVersion: &fixedVersion,
+					})
+				}
+			}
+
+			if affectedSoftwareRows.Err() != nil {
+				return affectedSoftwareRows.Err()
+			}
+
+			return nil
+		}()
+		if err != nil {
+			level.Error(logger).Log(
+				"msg", "could not read package vulnerabilities",
+				"package", swItem.Name,
+				"arch", swItem.Arch,
+				"platform", db.platform,
+				"err", err,
+			)
+		}
+	}
+
+	return vulnerabilities
+}
diff --git a/server/vulnerabilities/goval_dictionary/database_test.go b/server/vulnerabilities/goval_dictionary/database_test.go
new file mode 100644
index 000000000000..ed00326cbbaf
--- /dev/null
+++ b/server/vulnerabilities/goval_dictionary/database_test.go
@@ -0,0 +1,93 @@
+package goval_dictionary
+
+import (
+	"database/sql"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/vulnerabilities/oval"
+	kitlog "github.com/go-kit/log"
+	"github.com/stretchr/testify/require"
+	"testing"
+)
+
+func TestDatabase(t *testing.T) {
+	// build minimal slice of goval-dictionary sqlite schema
+	sqlite, err := sql.Open("sqlite3", ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	dbSetupQueries := []string{
+		// create schema
+		"CREATE TABLE packages (name TEXT NOT NULL, arch TEXT NOT NULL, version TEXT NOT NULL, definition_id INTEGER NOT NULL)",
+		"CREATE TABLE definitions (id INTEGER NOT NULL PRIMARY KEY)",
+		"CREATE TABLE advisories (id INTEGER NOT NULL PRIMARY KEY, definition_id INTEGER NOT NULL)",
+		"CREATE TABLE cves (cve_id TEXT NOT NULL, advisory_id INTEGER NOT NULL)",
+		// insert records
+		`INSERT INTO packages (name, arch, version, definition_id) VALUES
+		  ('expat', 'aarch64', '0:2.1.0-15.amzn2.0.3', 1), ('krb5-server', 'aarch64', '0:1.15.1-55.amzn2.2.8', 2)`,
+		"INSERT INTO definitions (id) VALUES (1), (2)",
+		"INSERT INTO advisories (id, definition_id) VALUES (1, 1), (2, 2)",
+		`INSERT INTO cves (cve_id, advisory_id) VALUES
+		   ('CVE-2022-23990', 1), ('CVE-2022-25313', 1), ('CVE-2024-37370', 2), ('CVE-2024-37371', 2)`,
+	}
+	for _, query := range dbSetupQueries {
+		if _, err := sqlite.Exec(query); err != nil {
+			t.Fatal(err)
+		}
+	}
+	db := NewDB(sqlite, oval.NewPlatform("amzn", "Amazon Linux 2.0.0"))
+	logger := kitlog.NewNopLogger()
+
+	t.Run("Non-matching architecture", func(t *testing.T) {
+		require.Len(t, db.Eval([]fleet.Software{{Name: "expat", Version: "2.1.0", Release: "", Arch: "x86_64"}}, logger), 0)
+	})
+
+	t.Run("Non-matching package name", func(t *testing.T) {
+		require.Len(t, db.Eval([]fleet.Software{{Name: "expath", Version: "2.1.0", Release: "", Arch: "aarch64"}}, logger), 0)
+	})
+
+	t.Run("Fixed version", func(t *testing.T) {
+		require.Len(t, db.Eval([]fleet.Software{{Name: "expath", Version: "2.1.0", Release: "15.amzn2.0.3", Arch: "aarch64"}}, logger), 0)
+	})
+
+	t.Run("Newer than fixed version", func(t *testing.T) {
+		require.Len(t, db.Eval([]fleet.Software{{Name: "expath", Version: "2.1.0", Release: "15.amzn2.0.5", Arch: "aarch64"}}, logger), 0)
+	})
+
+	t.Run("Older than fixed version", func(t *testing.T) {
+		vulns := db.Eval([]fleet.Software{{Name: "expat", Version: "2.1.0", Release: "", Arch: "aarch64", ID: 123}}, logger)
+		require.Len(t, vulns, 2)
+		require.Equal(t, "2.1.0-15.amzn2.0.3", *vulns[0].ResolvedInVersion)
+		require.Equal(t, "2.1.0-15.amzn2.0.3", *vulns[1].ResolvedInVersion)
+		require.Equal(t, "CVE-2022-23990", vulns[0].CVE)
+		require.Equal(t, "CVE-2022-25313", vulns[1].CVE)
+		require.Equal(t, uint(123), vulns[0].SoftwareID)
+		require.Equal(t, uint(123), vulns[1].SoftwareID)
+	})
+
+	t.Run("Multiple packages, fixed version", func(t *testing.T) {
+		require.Len(t, db.Eval([]fleet.Software{
+			{Name: "expat", Version: "2.1.0", Release: "15.amzn2.1.0", Arch: "aarch64"},
+			{Name: "krb5-server", Version: "1.15.1", Release: "55.amzn2.2.8", Arch: "aarch64"},
+		}, logger), 0)
+	})
+
+	t.Run("Multiple packages, multiple vulnerabilities", func(t *testing.T) {
+		vulns := db.Eval([]fleet.Software{
+			{Name: "expat", Version: "2.1.0", Release: "15.amzn2.0.2", Arch: "aarch64", ID: 234},
+			{Name: "krb5-server", Version: "1.15.1", Release: "55.amzn2.2.7", Arch: "aarch64", ID: 235},
+		}, logger)
+		require.Len(t, vulns, 4)
+
+		require.Equal(t, "2.1.0-15.amzn2.0.3", *vulns[0].ResolvedInVersion)
+		require.Equal(t, "2.1.0-15.amzn2.0.3", *vulns[1].ResolvedInVersion)
+		require.Equal(t, "1.15.1-55.amzn2.2.8", *vulns[2].ResolvedInVersion)
+		require.Equal(t, "CVE-2022-23990", vulns[0].CVE)
+		require.Equal(t, "CVE-2022-25313", vulns[1].CVE)
+		require.Equal(t, "CVE-2024-37370", vulns[2].CVE)
+		require.Equal(t, "CVE-2024-37371", vulns[3].CVE)
+		require.Equal(t, uint(234), vulns[0].SoftwareID)
+		require.Equal(t, uint(234), vulns[1].SoftwareID)
+		require.Equal(t, uint(235), vulns[2].SoftwareID)
+		require.Equal(t, uint(235), vulns[3].SoftwareID)
+	})
+}
diff --git a/server/vulnerabilities/goval_dictionary/sync.go b/server/vulnerabilities/goval_dictionary/sync.go
new file mode 100644
index 000000000000..e89fab51206b
--- /dev/null
+++ b/server/vulnerabilities/goval_dictionary/sync.go
@@ -0,0 +1,89 @@
+package goval_dictionary
+
+import (
+	"fmt"
+	"github.com/fleetdm/fleet/v4/pkg/download"
+	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/vulnerabilities/nvd"
+	"github.com/fleetdm/fleet/v4/server/vulnerabilities/oval"
+	kitlog "github.com/go-kit/log"
+	"github.com/go-kit/log/level"
+	"net/http"
+	"net/url"
+	"path/filepath"
+)
+
+func Refresh(
+	versions *fleet.OSVersions,
+	vulnPath string,
+	logger kitlog.Logger,
+) ([]oval.Platform, error) {
+	toDownload := whatToDownload(versions)
+	if len(toDownload) > 0 {
+		level.Debug(logger).Log("msg", "goval_dictionary-sync-downloading")
+		err := Sync(vulnPath, toDownload)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return toDownload, nil
+}
+
+func Sync(dstDir string, platforms []oval.Platform) error {
+	client := fleethttp.NewClient()
+	dwn := downloadDecompressed(client)
+	basePath, err := nvd.GetGitHubCVEAssetPath()
+	if err != nil {
+		return err
+	}
+
+	for _, platform := range platforms {
+		if err := downloadDatabase(platform, dwn, basePath, dstDir); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func downloadDatabase(
+	platform oval.Platform,
+	downloader func(string, string) error,
+	basePath string,
+	vulnDir string,
+) error {
+	dstPath := filepath.Join(vulnDir, platform.ToGovalDictionaryFilename())
+	if err := downloader(basePath+string(platform)+".sqlite3.xz", dstPath); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func downloadDecompressed(client *http.Client) func(string, string) error {
+	return func(u, dstPath string) error {
+		parsedUrl, err := url.Parse(u)
+		if err != nil {
+			return fmt.Errorf("url parse: %w", err)
+		}
+
+		if err = download.DownloadAndExtract(client, parsedUrl, dstPath); err != nil {
+			return fmt.Errorf("download and extract url %s: %w", parsedUrl, err)
+		}
+
+		return nil
+	}
+}
+
+func whatToDownload(osVers *fleet.OSVersions) []oval.Platform {
+	var r []oval.Platform
+	for _, os := range osVers.OSVersions {
+		platform := oval.NewPlatform(os.Platform, os.Name)
+		if platform.IsGovalDictionarySupported() {
+			r = append(r, platform)
+		}
+	}
+
+	return r
+}
diff --git a/server/vulnerabilities/goval_dictionary/sync_test.go b/server/vulnerabilities/goval_dictionary/sync_test.go
new file mode 100644
index 000000000000..cec05521c3dc
--- /dev/null
+++ b/server/vulnerabilities/goval_dictionary/sync_test.go
@@ -0,0 +1,34 @@
+package goval_dictionary
+
+import (
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/vulnerabilities/oval"
+	"github.com/stretchr/testify/require"
+	"testing"
+	"time"
+)
+
+func TestSync(t *testing.T) {
+	t.Run("#whatToDownload", func(t *testing.T) {
+		osVersions := fleet.OSVersions{
+			CountsUpdatedAt: time.Now(),
+			OSVersions: []fleet.OSVersion{
+				{
+					HostsCount: 1,
+					Platform:   "ubuntu",
+					Name:       "Ubuntu 20.4.0",
+				},
+				{
+					HostsCount: 1,
+					Platform:   "amzn",
+					Name:       "Amazon Linux 2.0.0",
+				},
+			},
+		}
+
+		result := whatToDownload(&osVersions)
+		require.Len(t, result, 1)
+		require.Contains(t, result, oval.NewPlatform("amzn", "Amazon Linux 2.0.0"))
+		require.NotContains(t, result, oval.NewPlatform("ubuntu", "Ubuntu 20.4.0"))
+	})
+}
diff --git a/server/vulnerabilities/io/github_test.go b/server/vulnerabilities/io/github_test.go
index 9b627c4ebb50..5735daa9dca2 100644
--- a/server/vulnerabilities/io/github_test.go
+++ b/server/vulnerabilities/io/github_test.go
@@ -168,7 +168,8 @@ func (m mockGHReleaseLister) ListReleases(
 	return releases, res, nil
 }
 
-func TestGithubClient(t *testing.T) {
+func TestIntegrationsGithubClient(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 
 	t.Run("MacOfficeReleaseNotes", func(t *testing.T) {
diff --git a/server/vulnerabilities/macoffice/integration_analyzer_test.go b/server/vulnerabilities/macoffice/integration_analyzer_test.go
index b36592f656e5..3808605dd9ed 100644
--- a/server/vulnerabilities/macoffice/integration_analyzer_test.go
+++ b/server/vulnerabilities/macoffice/integration_analyzer_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestIntegrationAnalyzer(t *testing.T) {
+func TestIntegrationsAnalyzer(t *testing.T) {
 	ds := mysql.CreateMySQLDS(t)
 	vulnPath := t.TempDir()
 	releaseNotes := macoffice.ReleaseNotes{
diff --git a/server/vulnerabilities/macoffice/integration_parser_test.go b/server/vulnerabilities/macoffice/integration_parser_test.go
index 9aa92c8ee414..d8f218d32607 100644
--- a/server/vulnerabilities/macoffice/integration_parser_test.go
+++ b/server/vulnerabilities/macoffice/integration_parser_test.go
@@ -653,7 +653,7 @@ var expected = []macoffice.ReleaseNote{
 	},
 }
 
-func TestIntegrationParseReleaseHTML(t *testing.T) {
+func TestIntegrationsParseReleaseHTML(t *testing.T) {
 	nettest.Run(t)
 
 	res, err := http.Get(macoffice.RelNotesURL)
diff --git a/server/vulnerabilities/macoffice/integration_sync_test.go b/server/vulnerabilities/macoffice/integration_sync_test.go
index 3fd55c80e5cf..1dc6dbfec0be 100644
--- a/server/vulnerabilities/macoffice/integration_sync_test.go
+++ b/server/vulnerabilities/macoffice/integration_sync_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestIntegrationSync(t *testing.T) {
+func TestIntegrationsSync(t *testing.T) {
 	nettest.Run(t)
 
 	vulnPath := t.TempDir()
diff --git a/server/vulnerabilities/nvd/cpe.go b/server/vulnerabilities/nvd/cpe.go
index 9d20820d08c8..d1d9f1944ac4 100644
--- a/server/vulnerabilities/nvd/cpe.go
+++ b/server/vulnerabilities/nvd/cpe.go
@@ -9,6 +9,7 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
+	"slices"
 	"strings"
 	"time"
 	"unicode"
@@ -439,11 +440,12 @@ func TranslateSoftwareToCPE(
 	vulnPath string,
 	logger kitlog.Logger,
 ) error {
-	// Skip software from sources for which we will be using OVAL for vulnerability detection.
+	// Skip software from sources for which we will be using OVAL or goval-dictionary for vulnerability detection.
 	nonOvalIterator, err := ds.AllSoftwareIterator(
 		ctx,
 		fleet.SoftwareIterQueryOptions{
-			ExcludedSources: oval.SupportedSoftwareSources,
+			// Also exclude iOS and iPadOS apps until we enable vulnerabilities support for them.
+			ExcludedSources: append(oval.SupportedSoftwareSources, "ios_apps", "ipados_apps"),
 		},
 	)
 	if err != nil {
@@ -566,9 +568,14 @@ func translateSoftwareToCPEWithIterator(
 	return nil
 }
 
+var allowedNonASCII = []int32{
+	'–', // en dash
+	'—', // em dash
+}
+
 func containsNonASCII(s string) bool {
 	for _, char := range s {
-		if char > unicode.MaxASCII {
+		if char > unicode.MaxASCII && !slices.Contains(allowedNonASCII, char) {
 			return true
 		}
 	}
diff --git a/server/vulnerabilities/nvd/cpe_matching_rules.go b/server/vulnerabilities/nvd/cpe_matching_rules.go
index d7f0e60deb9c..48821344d023 100644
--- a/server/vulnerabilities/nvd/cpe_matching_rules.go
+++ b/server/vulnerabilities/nvd/cpe_matching_rules.go
@@ -240,6 +240,15 @@ func GetKnownNVDBugRules() (CPEMatchingRules, error) {
 			},
 			IgnoreAll: true,
 		},
+		// CVE-2024-4030 only targets windows operating systems
+		CPEMatchingRule{
+			CVEs: map[string]struct{}{
+				"CVE-2024-4030": {},
+			},
+			IgnoreIf: func(cpeMeta *wfn.Attributes) bool {
+				return cpeMeta.TargetSW != "windows"
+			},
+		},
 	}
 
 	for i, rule := range rules {
diff --git a/server/vulnerabilities/nvd/cpe_test.go b/server/vulnerabilities/nvd/cpe_test.go
index 22778b4a7146..d70191b8b701 100644
--- a/server/vulnerabilities/nvd/cpe_test.go
+++ b/server/vulnerabilities/nvd/cpe_test.go
@@ -676,7 +676,7 @@ func TestCPEFromSoftwareIntegration(t *testing.T) {
 		},
 		{
 			software: fleet.Software{
-				Name:             "1Password - Password Manager",
+				Name:             "1Password – Password Manager",
 				Source:           "chrome_extensions",
 				Version:          "2.3.8",
 				Vendor:           "",
@@ -762,7 +762,7 @@ func TestCPEFromSoftwareIntegration(t *testing.T) {
 				Version:          "18.9.0",
 				Vendor:           "",
 				BundleIdentifier: "",
-			}, cpe: "cpe:2.3:a:nodejs:node.js:18.9.0:*:*:*:*:*:*:*",
+			}, cpe: "cpe:2.3:a:nodejs:node.js:18.9.0:*:*:*:*:macos:*:*",
 		},
 		{
 			software: fleet.Software{
@@ -1334,6 +1334,16 @@ func TestCPEFromSoftwareIntegration(t *testing.T) {
 			},
 			cpe: "cpe:2.3:a:jetbrains:intellij_idea:2022.3.3:*:*:*:*:macos:*:*",
 		},
+		{
+			software: fleet.Software{
+				Name:             "intellij-idea-ce",
+				Source:           "homebrew_packages",
+				Version:          "2023.3.2,233.13135.103",
+				Vendor:           "",
+				BundleIdentifier: "",
+			},
+			cpe: "cpe:2.3:a:jetbrains:intellij_idea:2023.3.2.233.13135.103:*:*:*:*:macos:*:*",
+		},
 		{
 			software: fleet.Software{
 				Name:             "User PyCharm Custom Name.app", // 2023/10/31: The actual product name must be part of the app name per our code in CPEFromSoftware
@@ -1633,7 +1643,7 @@ func TestCPEFromSoftwareIntegration(t *testing.T) {
 				Version: "3.9.18_2",
 				Vendor:  "",
 			},
-			cpe: `cpe:2.3:a:python:python:3.9.18_2:*:*:*:*:*:*:*`,
+			cpe: `cpe:2.3:a:python:python:3.9.18_2:*:*:*:*:macos:*:*`,
 		},
 		{
 			software: fleet.Software{
@@ -1683,7 +1693,7 @@ func TestContainsNonASCII(t *testing.T) {
 	}{
 		{"hello", false},
 		{"hello world", false},
-		{"hello world!", false},
+		{"hello – world!", false},
 		{"😊👍", true},
 		{"hello world! 😊👍", true},
 		{"Девушка Фонарём", true},
diff --git a/server/vulnerabilities/nvd/cpe_translations.json b/server/vulnerabilities/nvd/cpe_translations.json
index a1f48dd63c93..73d64cd787e9 100644
--- a/server/vulnerabilities/nvd/cpe_translations.json
+++ b/server/vulnerabilities/nvd/cpe_translations.json
@@ -130,6 +130,16 @@
       "vendor": ["jetbrains"]
     }
   },
+  {
+    "software": {
+      "name": ["/^intellij-idea(-ce)?$/"],
+      "source": ["homebrew_packages"]
+    },
+    "filter": {
+      "product": ["intellij_idea"],
+      "vendor": ["jetbrains"]
+    }
+  },
   {
     "software": {
       "bundle_identifier": ["/^com\\.jetbrains\\.pycharm/"],
@@ -140,6 +150,16 @@
       "vendor": ["jetbrains"]
     }
   },
+  {
+    "software": {
+      "name": ["/^pycharm(-ce)?$/"],
+      "source": ["homebrew_packages"]
+    },
+    "filter": {
+      "product": ["pycharm"],
+      "vendor": ["jetbrains"]
+    }
+  },
   {
     "software": {
       "name": ["ms-python.python"],
diff --git a/server/vulnerabilities/nvd/cve.go b/server/vulnerabilities/nvd/cve.go
index f7bc5fa49c40..7b321ef94788 100644
--- a/server/vulnerabilities/nvd/cve.go
+++ b/server/vulnerabilities/nvd/cve.go
@@ -588,6 +588,14 @@ func expandCPEAliases(cpeItem *wfn.Attributes) []*wfn.Attributes {
 		}
 	}
 
+	for _, cpeItem := range cpeItems {
+		if cpeItem.Vendor == "oracle" && cpeItem.Product == "virtualbox" {
+			cpeItem2 := *cpeItem
+			cpeItem2.Product = "vm_virtualbox"
+			cpeItems = append(cpeItems, &cpeItem2)
+		}
+	}
+
 	return cpeItems
 }
 
diff --git a/server/vulnerabilities/nvd/cve_test.go b/server/vulnerabilities/nvd/cve_test.go
index a98c9ca2394b..691f3e321a7d 100644
--- a/server/vulnerabilities/nvd/cve_test.go
+++ b/server/vulnerabilities/nvd/cve_test.go
@@ -318,7 +318,10 @@ func TestTranslateCPEToCVE(t *testing.T) {
 				{ID: "CVE-2023-42950", resolvedInVersion: "17.2"},
 				{ID: "CVE-2024-23273", resolvedInVersion: "17.4"},
 			},
-			excludedCVEs:      []string{"CVE-2023-28205"},
+			excludedCVEs: []string{
+				"CVE-2023-28205", // This vulnerability is for Safari 16.4.0
+				"CVE-2024-23252", // Rejected CVE
+			},
 			continuesToUpdate: true,
 		},
 		"cpe:2.3:a:apple:safari:16.4.0:*:*:*:*:macos:*:*": {
@@ -334,6 +337,24 @@ func TestTranslateCPEToCVE(t *testing.T) {
 			excludedCVEs:      []string{"CVE-2011-5049"}, // OS vulnerability
 			continuesToUpdate: true,
 		},
+		"cpe:2.3:a:python:python:3.9.6:*:*:*:*:macos:*:*": {
+			excludedCVEs:      []string{"CVE-2024-4030"},
+			continuesToUpdate: true,
+		},
+		"cpe:2.3:a:python:python:3.9.6:*:*:*:*:windows:*:*": {
+			includedCVEs: []cve{
+				{ID: "CVE-2024-4030", resolvedInVersion: "3.12.4"},
+			},
+			continuesToUpdate: true,
+		},
+		// Tests the expandCPEAliases rule for virtualbox on macOS
+		"cpe:2.3:a:oracle:virtualbox:7.0.6:*:*:*:*:macos:*:*": {
+			includedCVEs: []cve{
+				{ID: "CVE-2023-21989", resolvedInVersion: "7.0.8"},
+				{ID: "CVE-2024-21141", resolvedInVersion: "7.0.20"},
+			},
+			continuesToUpdate: true,
+		},
 	}
 
 	cveOSTests := []struct {
diff --git a/server/vulnerabilities/nvd/sanitize.go b/server/vulnerabilities/nvd/sanitize.go
index 40e0be0ddc21..dce39c36a38b 100644
--- a/server/vulnerabilities/nvd/sanitize.go
+++ b/server/vulnerabilities/nvd/sanitize.go
@@ -222,6 +222,8 @@ func targetSW(s *fleet.Software) string {
 	switch s.Source {
 	case "apps":
 		return "macos"
+	case "homebrew_packages":
+		return "macos" // osquery homebrew_packages table is currently only for macOS (2024/08/12)
 	case "python_packages":
 		return "python"
 	case "chrome_extensions":
diff --git a/server/vulnerabilities/nvd/sync.go b/server/vulnerabilities/nvd/sync.go
index c2e52cc40af1..65174e721b34 100644
--- a/server/vulnerabilities/nvd/sync.go
+++ b/server/vulnerabilities/nvd/sync.go
@@ -216,9 +216,10 @@ func LoadCVEMeta(ctx context.Context, logger log.Logger, vulnPath string, ds fle
 			}
 			schema := vuln.Schema()
 
-			meta := fleet.CVEMeta{
-				CVE:         cve,
-				Description: schema.CVE.Description.DescriptionData[0].Value,
+			meta := fleet.CVEMeta{CVE: cve}
+
+			if len(schema.CVE.Description.DescriptionData) > 0 {
+				meta.Description = schema.CVE.Description.DescriptionData[0].Value
 			}
 
 			if schema.Impact.BaseMetricV3 != nil {
diff --git a/server/vulnerabilities/nvd/sync/cve_syncer.go b/server/vulnerabilities/nvd/sync/cve_syncer.go
index 178429cf6509..8ecdb8e8da8e 100644
--- a/server/vulnerabilities/nvd/sync/cve_syncer.go
+++ b/server/vulnerabilities/nvd/sync/cve_syncer.go
@@ -199,6 +199,9 @@ func (s *CVE) updateYearFile(year int, cves []nvdapi.CVEItem) error {
 	// Convert new API 2.0 format to legacy feed format and create map of new CVE information.
 	newLegacyCVEs := make(map[string]*schema.NVDCVEFeedJSON10DefCVEItem)
 	for _, cve := range cves {
+		if cve.CVE.VulnStatus != nil && *cve.CVE.VulnStatus == "Rejected" {
+			continue
+		}
 		legacyCVE := convertAPI20CVEToLegacy(cve.CVE, s.logger)
 		newLegacyCVEs[legacyCVE.CVE.CVEDataMeta.ID] = legacyCVE
 	}
@@ -249,6 +252,9 @@ func (s *CVE) updateVulnCheckYearFile(year int, cves []VulnCheckCVE, modCount, a
 	// Convert new API 2.0 format to legacy feed format and create map of new CVE information.
 	newLegacyCVEs := make(map[string]*schema.NVDCVEFeedJSON10DefCVEItem)
 	for _, cve := range cves {
+		if cve.CVE.VulnStatus != nil && *cve.CVE.VulnStatus == "Rejected" {
+			continue
+		}
 		legacyCVE := convertAPI20CVEToLegacy(cve.CVE, s.logger)
 		updateWithVulnCheckConfigurations(legacyCVE, cve.VcConfigurations)
 		newLegacyCVEs[legacyCVE.CVE.CVEDataMeta.ID] = legacyCVE
@@ -774,16 +780,35 @@ func convertAPI20CVEToLegacy(cve nvdapi.CVE, logger log.Logger) *schema.NVDCVEFe
 
 	descriptions := make([]*schema.CVEJSON40LangString, 0, len(cve.Descriptions))
 	for _, description := range cve.Descriptions {
-		// Keep only english descriptions to match the legacy.
-		if description.Lang != "en" {
+		// Keep only English descriptions to match the legacy format.
+		var lang string
+		switch description.Lang {
+		case "en":
+			lang = description.Lang
+		case "en-US": // This occurred starting with Microsoft CVE-2024-38200.
+			lang = "en"
+		// non-English descriptions with known language tags are ignored.
+		case "es": // This occurred in a number of 2004 CVEs
+			continue
+		// non-English descriptions with unknown language tags are ignored and warned.
+		default:
+			level.Warn(logger).Log("msg", "Unknown CVE description language tag", "lang", description.Lang)
 			continue
 		}
 		descriptions = append(descriptions, &schema.CVEJSON40LangString{
-			Lang:  description.Lang,
+			Lang:  lang,
 			Value: description.Value,
 		})
 	}
 
+	if len(descriptions) == 0 {
+		// Populate a blank description to prevent Fleet cron job from crashing: https://github.com/fleetdm/fleet/issues/21239
+		descriptions = append(descriptions, &schema.CVEJSON40LangString{
+			Lang:  "en",
+			Value: "",
+		})
+	}
+
 	problemtypeData := make([]*schema.CVEJSON40ProblemtypeProblemtypeData, 0, len(cve.Weaknesses))
 	if len(cve.Weaknesses) == 0 {
 		problemtypeData = append(problemtypeData, &schema.CVEJSON40ProblemtypeProblemtypeData{
diff --git a/server/vulnerabilities/nvd/sync/cve_syncer_test.go b/server/vulnerabilities/nvd/sync/cve_syncer_test.go
index b25e0fbefc94..acbc0656f023 100644
--- a/server/vulnerabilities/nvd/sync/cve_syncer_test.go
+++ b/server/vulnerabilities/nvd/sync/cve_syncer_test.go
@@ -31,6 +31,7 @@ var (
 )
 
 func TestStoreCVEsLegacyFormat(t *testing.T) {
+	t.Parallel()
 	year := 2023
 	t.Run(fmt.Sprintf("%d", year), func(t *testing.T) {
 		// Load CVEs from legacy feed.
diff --git a/server/vulnerabilities/oval/analyzer.go b/server/vulnerabilities/oval/analyzer.go
index f64d97b1416b..427761c16ac1 100644
--- a/server/vulnerabilities/oval/analyzer.go
+++ b/server/vulnerabilities/oval/analyzer.go
@@ -3,6 +3,7 @@ package oval
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"time"
@@ -17,8 +18,11 @@ const (
 	vulnBatchSize  = 500
 )
 
+var ErrUnsupportedPlatform = errors.New("unsupported platform")
+
 // Analyze scans all hosts for vulnerabilities based on the OVAL definitions for their platform,
-// inserting any new vulnerabilities and deleting anything patched.
+// inserting any new vulnerabilities and deleting anything patched. Returns nil, nil when
+// the platform isn't supported.
 func Analyze(
 	ctx context.Context,
 	ds fleet.Datastore,
@@ -34,7 +38,7 @@ func Analyze(
 	}
 
 	if !platform.IsSupported() {
-		return nil, nil
+		return nil, ErrUnsupportedPlatform
 	}
 
 	defs, err := loadDef(platform, vulnPath)
diff --git a/server/vulnerabilities/oval/analyzer_test.go b/server/vulnerabilities/oval/analyzer_test.go
index c978a85a47c5..415c1ca4e612 100644
--- a/server/vulnerabilities/oval/analyzer_test.go
+++ b/server/vulnerabilities/oval/analyzer_test.go
@@ -121,7 +121,7 @@ func extractFixtures(
 	extract(srcCvesPath, dstCvesPath, t)
 }
 
-func withTestFixutre(
+func withTestFixture(
 	version fleet.OSVersion,
 	ovalFixtureDir string,
 	softwareFixtureDir string,
@@ -218,7 +218,7 @@ func BenchmarkTestOvalAnalyzer(b *testing.B) {
 
 		for _, v := range systems {
 			b.Run(fmt.Sprintf("for %s %s", v.Platform, v.Name), func(b *testing.B) {
-				withTestFixutre(v, ovalFixtureDir, softwareFixtureDir, vulnPath, ds, func(h *fleet.Host) {
+				withTestFixture(v, ovalFixtureDir, softwareFixtureDir, vulnPath, ds, func(h *fleet.Host) {
 					b.ResetTimer()
 					for i := 0; i < b.N; i++ {
 						_, err := Analyze(context.Background(), ds, v, vulnPath, true)
@@ -269,7 +269,7 @@ func BenchmarkTestOvalAnalyzer(b *testing.B) {
 
 		for _, v := range systems {
 			b.Run(fmt.Sprintf("for %s %s", v.version.Platform, v.version.Name), func(b *testing.B) {
-				withTestFixutre(v.version, v.ovalFixtureDir, v.softwareFixtureDir, vulnPath, ds, func(h *fleet.Host) {
+				withTestFixture(v.version, v.ovalFixtureDir, v.softwareFixtureDir, vulnPath, ds, func(h *fleet.Host) {
 					b.ResetTimer()
 					for i := 0; i < b.N; i++ {
 						_, err := Analyze(context.Background(), ds, v.version, vulnPath, true)
@@ -323,7 +323,7 @@ func TestOvalAnalyzer(t *testing.T) {
 		}
 
 		for _, s := range systems {
-			withTestFixutre(s.version, s.ovalFixtureDir, s.softwareFixtureDir, vulnPath, ds, func(h *fleet.Host) {
+			withTestFixture(s.version, s.ovalFixtureDir, s.softwareFixtureDir, vulnPath, ds, func(h *fleet.Host) {
 				_, err := Analyze(ctx, ds, s.version, vulnPath, true)
 				require.NoError(t, err)
 				p := NewPlatform(s.version.Platform, s.version.Name)
@@ -355,7 +355,7 @@ func TestOvalAnalyzer(t *testing.T) {
 		ovalFixtureDir := "ubuntu"
 		softwareFixtureDir := filepath.Join("ubuntu", "software")
 		for _, v := range systems {
-			withTestFixutre(v, ovalFixtureDir, softwareFixtureDir, vulnPath, ds, func(h *fleet.Host) {
+			withTestFixture(v, ovalFixtureDir, softwareFixtureDir, vulnPath, ds, func(h *fleet.Host) {
 				_, err := Analyze(ctx, ds, v, vulnPath, true)
 				require.NoError(t, err)
 
diff --git a/server/vulnerabilities/oval/oval_platform.go b/server/vulnerabilities/oval/oval_platform.go
index 4b7c4a49237a..c9fcc7ba1b1f 100644
--- a/server/vulnerabilities/oval/oval_platform.go
+++ b/server/vulnerabilities/oval/oval_platform.go
@@ -13,8 +13,9 @@ type Platform string
 
 // OvalFilePrefix is the file prefix used when saving an OVAL artifact.
 const OvalFilePrefix = "fleet_oval"
+const GovalDictionaryFilePrefix = "fleet_goval_dictionary"
 
-// SupportedSoftwareSources are the software sources for which we are using OVAL for vulnerability detection.
+// SupportedSoftwareSources are the software sources for which we are using OVAL or goval-dictionary for vulnerability detection.
 var SupportedSoftwareSources = []string{"deb_packages", "rpm_packages"}
 
 // getMajorMinorVer returns the major and minor version of an 'os_version'.
@@ -69,6 +70,10 @@ func (op Platform) ToFilename(date time.Time, extension string) string {
 	return fmt.Sprintf("%s_%s-%d_%02d_%02d.%s", OvalFilePrefix, op, date.Year(), date.Month(), date.Day(), extension)
 }
 
+func (op Platform) ToGovalDictionaryFilename() string {
+	return fmt.Sprintf("%s_%s.sqlite3", GovalDictionaryFilePrefix, op)
+}
+
 // IsSupported returns whether the given platform is currently supported.
 func (op Platform) IsSupported() bool {
 	supported := []string{
@@ -89,8 +94,23 @@ func (op Platform) IsSupported() bool {
 		"rhel_07",
 		"rhel_08",
 		"rhel_09",
+	}
+	for _, p := range supported {
+		if strings.HasPrefix(string(op), p) {
+			return true
+		}
+	}
+	return false
+}
+
+func (op Platform) IsGovalDictionarySupported() bool {
+	supported := []string{
+		"amzn_01",
 		"amzn_02",
+		"amzn_2022",
+		"amzn_2023",
 	}
+
 	for _, p := range supported {
 		if strings.HasPrefix(string(op), p) {
 			return true
diff --git a/server/vulnerabilities/oval/oval_platform_test.go b/server/vulnerabilities/oval/oval_platform_test.go
index bf9a5e4a410c..86f402f88591 100644
--- a/server/vulnerabilities/oval/oval_platform_test.go
+++ b/server/vulnerabilities/oval/oval_platform_test.go
@@ -27,6 +27,7 @@ func TestOvalPlatform(t *testing.T) {
 			{"ubuntu", "Ubuntu 18.4.0 LTS asdfasd", "ubuntu_1804"},
 			{"rhel", "CentOS Linux 7.9.2009", "rhel_07"},
 			{"amzn", "Amazon Linux 2.0.0", "amzn_02"},
+			{"amzn", "Amazon Linux 2023.0.0", "amzn_2023"},
 			{"rhel", "Fedora Linux 12.0.0", "rhel_06"},
 			{"rhel", "Fedora Linux 13.0.0", "rhel_06"},
 			{"rhel", "Fedora Linux 14.0.0", "rhel_06"},
@@ -73,4 +74,18 @@ func TestOvalPlatform(t *testing.T) {
 			require.Equal(t, c.expected, plat.ToFilename(c.date, "json"))
 		}
 	})
+
+	t.Run("ToGovalDictionaryFilename", func(t *testing.T) {
+		cases := []struct {
+			version  string
+			expected string
+		}{
+			{"Amazon Linux 2.0.0", "fleet_goval_dictionary_amzn_02.sqlite3"},
+			{"Amazon Linux 2023.0.0", "fleet_goval_dictionary_amzn_2023.sqlite3"},
+		}
+		for _, c := range cases {
+			plat := NewPlatform("amzn", c.version)
+			require.Equal(t, c.expected, plat.ToGovalDictionaryFilename())
+		}
+	})
 }
diff --git a/server/webhooks/failing_policies.go b/server/webhooks/failing_policies.go
index 53c1b112a816..7af7610d04f9 100644
--- a/server/webhooks/failing_policies.go
+++ b/server/webhooks/failing_policies.go
@@ -36,6 +36,12 @@ func SendFailingPoliciesBatchedPOSTs(
 		level.Debug(logger).Log("msg", "no hosts", "policyID", policy.ID)
 		return nil
 	}
+	// The count may be out of date since it is only updated during the hourly cleanups_then_aggregation cron.
+	// Take care of the case where the count is less than the actual number of hosts we are returning.
+	hostsCount := uint(len(hosts))
+	if hostsCount > policy.FailingHostCount {
+		policy.FailingHostCount = hostsCount
+	}
 	sort.Slice(hosts, func(i, j int) bool {
 		return hosts[i].ID < hosts[j].ID
 	})
diff --git a/server/webhooks/failing_policies_test.go b/server/webhooks/failing_policies_test.go
index 28b9048ea48f..4a75d4758ed0 100644
--- a/server/webhooks/failing_policies_test.go
+++ b/server/webhooks/failing_policies_test.go
@@ -122,7 +122,7 @@ func TestTriggerFailingPoliciesWebhookBasic(t *testing.T) {
         "created_at": "0001-01-01T00:00:00Z",
         "updated_at": "0001-01-01T00:00:00Z",
         "passing_host_count": 0,
-        "failing_host_count": 0,
+        "failing_host_count": 2,
         "host_count_updated_at": null,
 		"critical": true,
 		"calendar_events_enabled": false
@@ -309,7 +309,7 @@ func TestTriggerFailingPoliciesWebhookTeam(t *testing.T) {
         "created_at": "0001-01-01T00:00:00Z",
         "updated_at": "0001-01-01T00:00:00Z",
         "passing_host_count": 0,
-        "failing_host_count": 0,
+        "failing_host_count": 1,
         "host_count_updated_at": null,
 		"critical": false,
 		"calendar_events_enabled": true
diff --git a/server/worker/apple_mdm_test.go b/server/worker/apple_mdm_test.go
index 66d47070baed..fadd38dd2423 100644
--- a/server/worker/apple_mdm_test.go
+++ b/server/worker/apple_mdm_test.go
@@ -51,6 +51,8 @@ func TestAppleMDM(t *testing.T) {
 	// use this to debug/verify details of calls
 	nopLog := kitlog.NewJSONLogger(os.Stdout)
 
+	testOrgName := "fleet-test"
+
 	createEnrolledHost := func(t *testing.T, i int, teamID *uint, depAssignedToFleet bool) *fleet.Host {
 		// create the host
 		h, err := ds.NewHost(ctx, &fleet.Host{
@@ -65,6 +67,7 @@ func TestAppleMDM(t *testing.T) {
 		require.NoError(t, err)
 
 		// create the nano_device and enrollment
+		var abmTokenID uint
 		mysql.ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
 			_, err := q.ExecContext(ctx, `INSERT INTO nano_devices (id, serial_number, authenticate) VALUES (?, ?, ?)`, h.UUID, h.HardwareSerial, "test")
 			if err != nil {
@@ -72,10 +75,18 @@ func TestAppleMDM(t *testing.T) {
 			}
 			_, err = q.ExecContext(ctx, `INSERT INTO nano_enrollments (id, device_id, type, topic, push_magic, token_hex)
 				VALUES (?, ?, ?, ?, ?, ?)`, h.UUID, h.UUID, "device", "topic", "push_magic", "token_hex")
+			if err != nil {
+				return err
+			}
+
+			encTok := uuid.NewString()
+			abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+			abmTokenID = abmToken.ID
+
 			return err
 		})
 		if depAssignedToFleet {
-			err := ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h})
+			err := ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h}, abmTokenID)
 			require.NoError(t, err)
 		}
 		err = ds.SetOrUpdateMDMData(ctx, h.ID, false, true, "http://example.com", depAssignedToFleet, fleet.WellKnownMDMFleet, "")
@@ -118,7 +129,7 @@ func TestAppleMDM(t *testing.T) {
 	}
 
 	t.Run("no-op with nil commander", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		defer mysql.TruncateTables(t, ds)
 
 		mdmWorker := &AppleMDM{
@@ -147,7 +158,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("fails with unknown task", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		defer mysql.TruncateTables(t, ds)
 
 		mdmWorker := &AppleMDM{
@@ -179,7 +190,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("installs default manifest", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		defer mysql.TruncateTables(t, ds)
 
 		h := createEnrolledHost(t, 1, nil, true)
@@ -217,7 +228,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("installs default manifest, manual release", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		t.Cleanup(func() { mysql.TruncateTables(t, ds) })
 
 		h := createEnrolledHost(t, 1, nil, true)
@@ -252,7 +263,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("installs custom bootstrap manifest", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		defer mysql.TruncateTables(t, ds)
 
 		h := createEnrolledHost(t, 1, nil, true)
@@ -262,7 +273,7 @@ func TestAppleMDM(t *testing.T) {
 			Bytes:  []byte("test"),
 			Sha256: []byte("test"),
 			Token:  "token",
-		})
+		}, nil)
 		require.NoError(t, err)
 
 		mdmWorker := &AppleMDM{
@@ -301,7 +312,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("installs custom bootstrap manifest of a team", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		defer mysql.TruncateTables(t, ds)
 
 		tm, err := ds.NewTeam(ctx, &fleet.Team{Name: "test"})
@@ -314,7 +325,7 @@ func TestAppleMDM(t *testing.T) {
 			Bytes:  []byte("test"),
 			Sha256: []byte("test"),
 			Token:  "token",
-		})
+		}, nil)
 		require.NoError(t, err)
 
 		mdmWorker := &AppleMDM{
@@ -353,7 +364,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("installs custom bootstrap manifest of a team, manual release", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		t.Cleanup(func() { mysql.TruncateTables(t, ds) })
 
 		tm, err := ds.NewTeam(ctx, &fleet.Team{Name: "test"})
@@ -367,7 +378,7 @@ func TestAppleMDM(t *testing.T) {
 			Bytes:  []byte("test"),
 			Sha256: []byte("test"),
 			Token:  "token",
-		})
+		}, nil)
 		require.NoError(t, err)
 
 		mdmWorker := &AppleMDM{
@@ -403,7 +414,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("unknown enroll reference", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		defer mysql.TruncateTables(t, ds)
 
 		h := createEnrolledHost(t, 1, nil, true)
@@ -436,7 +447,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("enroll reference but SSO disabled", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		defer mysql.TruncateTables(t, ds)
 
 		err := ds.InsertMDMIdPAccount(ctx, &fleet.MDMIdPAccount{
@@ -484,7 +495,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("enroll reference with SSO enabled", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		defer mysql.TruncateTables(t, ds)
 
 		err := ds.InsertMDMIdPAccount(ctx, &fleet.MDMIdPAccount{
@@ -539,7 +550,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("installs fleetd for manual enrollments", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		defer mysql.TruncateTables(t, ds)
 
 		h := createEnrolledHost(t, 1, nil, true)
diff --git a/server/worker/db_migrations.go b/server/worker/db_migrations.go
new file mode 100644
index 000000000000..88d0839d1985
--- /dev/null
+++ b/server/worker/db_migrations.go
@@ -0,0 +1,130 @@
+package worker
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	kitlog "github.com/go-kit/log"
+)
+
+// Name of the DB migration job as registered in the worker. Note that although
+// it is a single job, it can process a number of different-but-related tasks,
+// identified by the Task field in the job's payload. This is deliberately
+// general so other one-off migration tasks that can't be done during the
+// "fleet prepare db" command can reuse this job.
+const dbMigrationJobName = "db_migration"
+
+type DBMigrationTask string
+
+// List of supported tasks.
+const (
+	DBMigrateVPPTokenTask DBMigrationTask = "migrate_vpp_token" //nolint: gosec
+)
+
+// DBMigration is the job processor for the db_migration job.
+type DBMigration struct {
+	Datastore fleet.Datastore
+	Log       kitlog.Logger
+}
+
+// Name returns the name of the job.
+func (m *DBMigration) Name() string {
+	return dbMigrationJobName
+}
+
+// dbMigrationArgs is the payload for the DB migration job.
+type dbMigrationArgs struct {
+	Task DBMigrationTask `json:"task"`
+}
+
+// Run executes the db_migration job. Note that unlike for other worker jobs,
+// there is no QueueDBMigrationJob function - it is expected that this job will
+// always be enqueued by a database migration, which use a direct INSERT into
+// the jobs table to avoid depending on code that may change over time.
+func (m *DBMigration) Run(ctx context.Context, argsJSON json.RawMessage) error {
+	var args dbMigrationArgs
+	if err := json.Unmarshal(argsJSON, &args); err != nil {
+		return ctxerr.Wrap(ctx, err, "unmarshal args")
+	}
+
+	switch args.Task {
+	case DBMigrateVPPTokenTask:
+		err := m.migrateVPPToken(ctx)
+		return ctxerr.Wrap(ctx, err, "running migrate VPP token task")
+
+	default:
+		return ctxerr.Errorf(ctx, "unknown task: %v", args.Task)
+	}
+}
+
+func (m *DBMigration) migrateVPPToken(ctx context.Context) error {
+	// get the VPP token with an empty location, this is the one to migrate
+	tok, err := m.Datastore.GetVPPTokenByLocation(ctx, "")
+	if err != nil {
+		if fleet.IsNotFound(err) {
+			// nothing to migrate, exit successfully
+			return nil
+		}
+		return ctxerr.Wrap(ctx, err, "get VPP token to migrate")
+	}
+
+	tokenData, didUpdate, err := extractVPPTokenFromMigration(tok)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "extract VPP token metadata")
+	}
+	if !didUpdate {
+		// it should've updated, as the location, org name and renew date were all
+		// dummy values after the DB migration. Log something, but otherwise
+		// continue as retrying won't change the result.
+		m.Log.Log("info", "VPP token metadata was not updated")
+	}
+
+	if _, err := m.Datastore.UpdateVPPToken(ctx, tok.ID, tokenData); err != nil {
+		return ctxerr.Wrap(ctx, err, "update VPP token")
+	}
+	// the migated token should target "All teams"
+	_, err = m.Datastore.UpdateVPPTokenTeams(ctx, tok.ID, []uint{})
+	return ctxerr.Wrap(ctx, err, "update VPP token teams")
+}
+
+func extractVPPTokenFromMigration(migratedToken *fleet.VPPTokenDB) (tokData *fleet.VPPTokenData, didUpdateMetadata bool, err error) {
+	var vppTokenData fleet.VPPTokenData
+	if err := json.Unmarshal([]byte(migratedToken.Token), &vppTokenData); err != nil {
+		return nil, false, fmt.Errorf("unmarshaling VPP token data: %w", err)
+	}
+
+	vppTokenRawBytes, err := base64.StdEncoding.DecodeString(vppTokenData.Token)
+	if err != nil {
+		return nil, false, fmt.Errorf("decoding raw vpp token data: %w", err)
+	}
+
+	var vppTokenRaw fleet.VPPTokenRaw
+	if err := json.Unmarshal(vppTokenRawBytes, &vppTokenRaw); err != nil {
+		return nil, false, fmt.Errorf("unmarshaling raw vpp token data: %w", err)
+	}
+
+	exp, err := time.Parse("2006-01-02T15:04:05Z0700", vppTokenRaw.ExpDate)
+	if err != nil {
+		return nil, false, fmt.Errorf("parsing vpp token expiration date: %w", err)
+	}
+
+	if vppTokenData.Location != migratedToken.Location {
+		migratedToken.Location = vppTokenData.Location
+		didUpdateMetadata = true
+	}
+	if vppTokenRaw.OrgName != migratedToken.OrgName {
+		migratedToken.OrgName = vppTokenRaw.OrgName
+		didUpdateMetadata = true
+	}
+	if !exp.Equal(migratedToken.RenewDate) {
+		migratedToken.RenewDate = exp.UTC()
+		didUpdateMetadata = true
+	}
+
+	return &vppTokenData, didUpdateMetadata, nil
+}
diff --git a/server/worker/db_migrations_test.go b/server/worker/db_migrations_test.go
new file mode 100644
index 000000000000..1aeeb697e9e2
--- /dev/null
+++ b/server/worker/db_migrations_test.go
@@ -0,0 +1,136 @@
+package worker
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/test"
+	kitlog "github.com/go-kit/log"
+	"github.com/jmoiron/sqlx"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDBMigrationsVPPToken(t *testing.T) {
+	ctx := context.Background()
+
+	ds := mysql.CreateMySQLDS(t)
+	// call TruncateTables immediately as a DB migration may have created jobs
+	mysql.TruncateTables(t, ds)
+
+	nopLog := kitlog.NewNopLogger()
+	// use this to debug/verify details of calls
+	// nopLog := kitlog.NewJSONLogger(os.Stdout)
+
+	// create and register the worker
+	processor := &DBMigration{
+		Datastore: ds,
+		Log:       nopLog,
+	}
+	w := NewWorker(ds, nopLog)
+	w.Register(processor)
+
+	// create the migrated token and enqueue the job
+	expDate := time.Date(2024, 8, 27, 0, 0, 0, 0, time.UTC)
+	tok, err := test.CreateVPPTokenEncodedAfterMigration(expDate, "test-org", "test-loc")
+	require.NoError(t, err)
+	encTok, err := mysql.EncryptWithPrivateKey(t, ds, tok)
+	require.NoError(t, err)
+
+	const insVPP = `
+INSERT INTO vpp_tokens
+	(
+		organization_name,
+		location,
+		renew_at,
+		token
+	)
+VALUES
+	('', '', DATE('2000-01-01'), ?)
+`
+
+	const insJob = `
+INSERT INTO jobs (
+		name,
+		args,
+		state,
+		error,
+		not_before,
+		created_at,
+		updated_at
+)
+VALUES (?, ?, ?, '', ?, ?, ?)
+`
+	mysql.ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(ctx, insVPP, encTok)
+		if err != nil {
+			return err
+		}
+
+		argsJSON, err := json.Marshal(dbMigrationArgs{Task: DBMigrateVPPTokenTask})
+		if err != nil {
+			return fmt.Errorf("failed to JSON marshal the job arguments: %w", err)
+		}
+		ts := time.Date(2024, 8, 26, 0, 0, 0, 0, time.UTC)
+		if _, err := q.ExecContext(ctx, insJob, dbMigrationJobName, argsJSON, fleet.JobStateQueued, ts, ts, ts); err != nil {
+			return err
+		}
+		return nil
+	})
+
+	// run the worker, should mark the job as done
+	err = w.ProcessJobs(ctx)
+	require.NoError(t, err)
+
+	// nothing more to run
+	jobs, err := ds.GetQueuedJobs(ctx, 1, time.Now().UTC().Add(time.Minute)) // look in the future to catch any delayed job
+	require.NoError(t, err)
+	if !assert.Empty(t, jobs) {
+		t.Logf(">>> %#+v", jobs[0])
+	}
+
+	// token should've been updated
+	vppTok, err := ds.GetVPPTokenByLocation(ctx, "test-loc")
+	require.NoError(t, err)
+	require.Equal(t, "test-org", vppTok.OrgName)
+	require.Equal(t, "test-loc", vppTok.Location)
+	require.Equal(t, expDate, vppTok.RenewDate)
+	require.Contains(t, string(tok), `"token":"`+vppTok.Token+`"`) // the DB-stored token is the "token" JSON field in the raw tok
+	require.NotNil(t, vppTok.Teams)
+	require.Len(t, vppTok.Teams, 0)
+
+	// empty-location token should not exist anymore
+	_, err = ds.GetVPPTokenByLocation(ctx, "")
+	require.Error(t, err)
+	var nfe fleet.NotFoundError
+	require.ErrorAs(t, err, &nfe)
+
+	// enqueue a DB migration job with an unknown task
+	mysql.ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+		argsJSON, err := json.Marshal(dbMigrationArgs{Task: DBMigrationTask("no-such-task")})
+		if err != nil {
+			return fmt.Errorf("failed to JSON marshal the job arguments: %w", err)
+		}
+		ts := time.Date(2024, 8, 26, 0, 0, 0, 0, time.UTC)
+		if _, err := q.ExecContext(ctx, insJob, dbMigrationJobName, argsJSON, fleet.JobStateQueued, ts, ts, ts); err != nil {
+			return err
+		}
+		return nil
+	})
+
+	// run the worker, will fail but still queued for a retry
+	err = w.ProcessJobs(ctx)
+	require.NoError(t, err)
+
+	jobs, err = ds.GetQueuedJobs(ctx, 1, time.Now().UTC().Add(time.Minute)) // look in the future to catch any delayed job
+	require.NoError(t, err)
+	require.Len(t, jobs, 1)
+	require.Equal(t, fleet.JobStateQueued, jobs[0].State)
+	require.Equal(t, 1, jobs[0].Retries)
+	require.Contains(t, jobs[0].Error, "unknown task: no-such-task")
+}
diff --git a/server/worker/macos_setup_assistant.go b/server/worker/macos_setup_assistant.go
index 55f808c4eac3..d47391713832 100644
--- a/server/worker/macos_setup_assistant.go
+++ b/server/worker/macos_setup_assistant.go
@@ -96,20 +96,6 @@ func (m *MacosSetupAssistant) runProfileChanged(ctx context.Context, args macosS
 		return ctxerr.Wrap(ctx, err, "get team")
 	}
 
-	// re-generate and register the profile with Apple. Since the profile has been
-	// updated, then its profile UUID will have been cleared, so this single call
-	// will do both tasks.
-	profUUID, _, err := m.DEPService.EnsureCustomSetupAssistantIfExists(ctx, team)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "ensure custom setup assistant")
-	}
-	if profUUID == "" {
-		// the custom setup assistant profile may have been deleted since the job
-		// was enqueued, if so another job will take care of assigning the default
-		// profile to the hosts, nothing to do.
-		return nil
-	}
-
 	// get the team's mdm-enrolled hosts, assign the profile to all of that
 	// team's hosts serials.
 	serials, err := m.Datastore.ListMDMAppleDEPSerialsInTeam(ctx, args.TeamID)
@@ -131,12 +117,25 @@ func (m *MacosSetupAssistant) runProfileChanged(ctx context.Context, args macosS
 			return nil
 		}
 
-		resp, err := m.DEPClient.AssignProfile(ctx, apple_mdm.DEPName, profUUID, assignSerials...)
-		if err != nil {
-			return ctxerr.Wrap(ctx, err, "assign profile")
-		}
-		if err := m.Datastore.UpdateHostDEPAssignProfileResponses(ctx, resp); err != nil {
-			return ctxerr.Wrap(ctx, err, "worker: run profile changed")
+		for orgName, serials := range assignSerials {
+			profUUID, _, err := m.DEPService.EnsureCustomSetupAssistantIfExists(ctx, team, orgName)
+			if err != nil {
+				return ctxerr.Wrapf(ctx, err, "ensure custom setup assistant for ABM org name %q", orgName)
+			}
+			if profUUID == "" {
+				// the custom setup assistant profile may have been deleted since the job
+				// was enqueued, if so another job will take care of assigning the default
+				// profile to the hosts, nothing to do.
+				continue
+			}
+
+			resp, err := m.DEPClient.AssignProfile(ctx, orgName, profUUID, serials...)
+			if err != nil {
+				return ctxerr.Wrap(ctx, err, "assign profile")
+			}
+			if err := m.Datastore.UpdateHostDEPAssignProfileResponses(ctx, resp); err != nil {
+				return ctxerr.Wrap(ctx, err, "worker: run profile changed")
+			}
 		}
 	}
 	return nil
@@ -156,11 +155,11 @@ func (m *MacosSetupAssistant) runProfileDeleted(ctx context.Context, args macosS
 	// get the team's setup assistant, to make sure it is still absent. If it is
 	// not, then it was re-created before this job ran, so nothing to do (another
 	// job will take care of assigning the profile to the hosts).
-	customProfUUID, _, err := m.DEPService.EnsureCustomSetupAssistantIfExists(ctx, team)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "ensure custom setup assistant")
+	_, err = m.Datastore.GetMDMAppleSetupAssistant(ctx, args.TeamID)
+	if err != nil && !fleet.IsNotFound(err) {
+		return ctxerr.Wrap(ctx, err, "check if setup assistant exists")
 	}
-	if customProfUUID != "" {
+	if !fleet.IsNotFound(err) {
 		// a custom setup assistant was re-created, so nothing to do.
 		return nil
 	}
@@ -169,14 +168,6 @@ func (m *MacosSetupAssistant) runProfileDeleted(ctx context.Context, args macosS
 	// of the default profile and assign it to all of the team's hosts. No need
 	// to force a re-generate of the default profile, if it is already registered
 	// with Apple this is fine and we use that profile uuid.
-	profUUID, _, err := m.DEPService.EnsureDefaultSetupAssistant(ctx, team)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "ensure default setup assistant")
-	}
-	if profUUID == "" {
-		// this should not happen, return an error
-		return ctxerr.Errorf(ctx, "default setup assistant profile uuid is empty")
-	}
 
 	// get the team's mdm-enrolled hosts, assign the profile to all of that
 	// team's hosts serials.
@@ -199,12 +190,23 @@ func (m *MacosSetupAssistant) runProfileDeleted(ctx context.Context, args macosS
 			return nil
 		}
 
-		resp, err := m.DEPClient.AssignProfile(ctx, apple_mdm.DEPName, profUUID, assignSerials...)
-		if err != nil {
-			return ctxerr.Wrap(ctx, err, "assign profile")
-		}
-		if err := m.Datastore.UpdateHostDEPAssignProfileResponses(ctx, resp); err != nil {
-			return ctxerr.Wrap(ctx, err, "worker: run profile deleted")
+		for orgName, serials := range assignSerials {
+			profUUID, _, err := m.DEPService.EnsureDefaultSetupAssistant(ctx, team, orgName)
+			if err != nil {
+				return ctxerr.Wrapf(ctx, err, "ensure default setup assistant for ABM organization %q", orgName)
+			}
+			if profUUID == "" {
+				// this should not happen, return an error
+				return ctxerr.Errorf(ctx, "default setup assistant profile uuid is empty for ABM organization %q", orgName)
+			}
+
+			resp, err := m.DEPClient.AssignProfile(ctx, orgName, profUUID, serials...)
+			if err != nil {
+				return ctxerr.Wrap(ctx, err, "assign profile")
+			}
+			if err := m.Datastore.UpdateHostDEPAssignProfileResponses(ctx, resp); err != nil {
+				return ctxerr.Wrap(ctx, err, "worker: run profile deleted")
+			}
 		}
 	}
 	return nil
@@ -227,51 +229,54 @@ func (m *MacosSetupAssistant) runHostsTransferred(ctx context.Context, args maco
 		return ctxerr.Wrap(ctx, err, "get team")
 	}
 
-	// get the new team's setup assistant if it exists.
-	profUUID, _, err := m.DEPService.EnsureCustomSetupAssistantIfExists(ctx, team)
+	cooldownSerials, assignSerials, err := m.Datastore.ScreenDEPAssignProfileSerialsForCooldown(ctx, args.HostSerialNumbers)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "ensure custom setup assistant")
+		return ctxerr.Wrap(ctx, err, "run hosts transferred")
+	}
+
+	// if it's a retry, serials on cooldown need to be assigned as well.
+	if fromCooldown {
+		for k, v := range cooldownSerials {
+			assignSerials[k] = append(assignSerials[k], v...)
+		}
+	} else if len(cooldownSerials) > 0 {
+		// NOTE: the `dep_cooldown` job of the `integrations` cron picks up the assignments
+		// after the cooldown period is over
+		level.Info(m.Log).Log("msg", "run hosts transferred: skipping assign profile for devices on cooldown", "serials", fmt.Sprintf("%s", cooldownSerials))
 	}
-	if profUUID == "" {
-		// get the default setup assistant.
-		defProfUUID, _, err := m.DEPService.EnsureDefaultSetupAssistant(ctx, team)
+
+	if len(assignSerials) == 0 {
+		level.Info(m.Log).Log("msg", "run hosts transferred: no devices to assign profile")
+		return nil
+	}
+
+	for orgName, serials := range assignSerials {
+		profUUID, _, err := m.DEPService.EnsureCustomSetupAssistantIfExists(ctx, team, orgName)
 		if err != nil {
-			return ctxerr.Wrap(ctx, err, "ensure default setup assistant")
+			return ctxerr.Wrapf(ctx, err, "ensure custom setup assistant for ABM organization %q", orgName)
 		}
-		profUUID = defProfUUID
 		if profUUID == "" {
-			// this should not happen, return an error
-			return ctxerr.Errorf(ctx, "default setup assistant profile uuid is empty")
+			// get the default setup assistant.
+			defProfUUID, _, err := m.DEPService.EnsureDefaultSetupAssistant(ctx, team, orgName)
+			if err != nil {
+				return ctxerr.Wrapf(ctx, err, "ensure default setup assistant for ABM organization %q", orgName)
+			}
+			profUUID = defProfUUID
+			if profUUID == "" {
+				// this should not happen, return an error
+				return ctxerr.Errorf(ctx, "default setup assistant profile uuid is empty for ABM organization %q", orgName)
+			}
 		}
-	}
 
-	serials := args.HostSerialNumbers
-	if !fromCooldown {
-		// if not a retry, then we need to screen the serials for cooldown
-		skipSerials, assignSerials, err := m.Datastore.ScreenDEPAssignProfileSerialsForCooldown(ctx, serials)
+		resp, err := m.DEPClient.AssignProfile(ctx, orgName, profUUID, serials...)
 		if err != nil {
-			return ctxerr.Wrap(ctx, err, "run hosts transferred")
+			return ctxerr.Wrap(ctx, err, "assign profile")
 		}
-		if len(skipSerials) > 0 {
-			// NOTE: the `dep_cooldown` job of the `integrations` cron picks up the assignments
-			// after the cooldown period is over
-			level.Info(m.Log).Log("msg", "run hosts transferred: skipping assign profile for devices on cooldown", "serials", fmt.Sprintf("%s", skipSerials))
+		if err := m.Datastore.UpdateHostDEPAssignProfileResponses(ctx, resp); err != nil {
+			return ctxerr.Wrap(ctx, err, "worker: run hosts transferred")
 		}
-		serials = assignSerials
-	}
-
-	if len(serials) == 0 {
-		level.Info(m.Log).Log("msg", "run hosts transferred: no devices to assign profile")
-		return nil
 	}
 
-	resp, err := m.DEPClient.AssignProfile(ctx, apple_mdm.DEPName, profUUID, serials...)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "assign profile")
-	}
-	if err := m.Datastore.UpdateHostDEPAssignProfileResponses(ctx, resp); err != nil {
-		return ctxerr.Wrap(ctx, err, "worker: run hosts transferred")
-	}
 	return nil
 }
 
@@ -291,6 +296,7 @@ func (m *MacosSetupAssistant) runUpdateAllProfiles(ctx context.Context, args mac
 		if _, err := QueueMacosSetupAssistantJob(ctx, m.Datastore, m.Log, MacosSetupAssistantUpdateProfile, teamID); err != nil {
 			return ctxerr.Wrap(ctx, err, "queue macos setup assistant update profile job")
 		}
+
 		return nil
 	}
 
@@ -308,25 +314,31 @@ func (m *MacosSetupAssistant) runUpdateAllProfiles(ctx context.Context, args mac
 
 func (m *MacosSetupAssistant) runUpdateProfile(ctx context.Context, args macosSetupAssistantArgs) error {
 	// clear the profile uuid for the default setup assistant for that team/no-team
-	if err := m.Datastore.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, args.TeamID, ""); err != nil {
+	if err := m.Datastore.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, args.TeamID, "", ""); err != nil {
 		return ctxerr.Wrap(ctx, err, "clear default setup assistant profile uuid")
 	}
 
-	// clear the profile uuid for the custom setup assistant
-	if err := m.Datastore.SetMDMAppleSetupAssistantProfileUUID(ctx, args.TeamID, ""); err != nil {
-		if fleet.IsNotFound(err) {
-			// no setup assistant for that team, enqueue a profile deleted task so
-			// the default profile is assigned to the hosts.
-			if _, err := QueueMacosSetupAssistantJob(ctx, m.Datastore, m.Log, MacosSetupAssistantProfileDeleted, args.TeamID); err != nil {
-				return ctxerr.Wrap(ctx, err, "queue macos setup assistant profile deleted job")
-			}
-			return nil
+	// check if there is a custom setup assistant for that team
+	_, err := m.Datastore.GetMDMAppleSetupAssistant(ctx, args.TeamID)
+	if err != nil && !fleet.IsNotFound(err) {
+		return ctxerr.Wrap(ctx, err, "check if setup assistant exists")
+	}
+	if fleet.IsNotFound(err) {
+		// no setup assistant for that team, enqueue a profile deleted task so
+		// the default profile is assigned to the hosts.
+		if _, err := QueueMacosSetupAssistantJob(ctx, m.Datastore, m.Log, MacosSetupAssistantProfileDeleted, args.TeamID); err != nil {
+			return ctxerr.Wrap(ctx, err, "queue macos setup assistant profile deleted job")
 		}
+		return nil
+	}
+
+	// clear the profile uuid for the custom setup assistant
+	if err := m.Datastore.SetMDMAppleSetupAssistantProfileUUID(ctx, args.TeamID, "", ""); err != nil {
 		return ctxerr.Wrap(ctx, err, "clear custom setup assistant profile uuid")
 	}
 
-	// no error means that the setup assistant existed for that team, enqueue a profile
-	// changed task so the custom profile is assigned to the hosts.
+	// the setup assistant existed for that team, enqueue a profile changed task
+	// so the custom profile is assigned to the hosts.
 	if _, err := QueueMacosSetupAssistantJob(ctx, m.Datastore, m.Log, MacosSetupAssistantProfileChanged, args.TeamID); err != nil {
 		return ctxerr.Wrap(ctx, err, "queue macos setup assistant profile changed job")
 	}
@@ -379,17 +391,17 @@ func QueueMacosSetupAssistantJob(
 }
 
 func ProcessDEPCooldowns(ctx context.Context, ds fleet.Datastore, logger kitlog.Logger) error {
-	serialsByTeamId, err := ds.GetDEPAssignProfileExpiredCooldowns(ctx)
+	serialsByTeamID, err := ds.GetDEPAssignProfileExpiredCooldowns(ctx)
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "getting cooldowns")
 	}
-	if len(serialsByTeamId) == 0 {
+	if len(serialsByTeamID) == 0 {
 		level.Info(logger).Log("msg", "no cooldowns to process")
 		return nil
 	}
 
 	// queue job for each team so that macOS setup assistant worker can pick it up and process it
-	for teamID, serials := range serialsByTeamId {
+	for teamID, serials := range serialsByTeamID {
 		if len(serials) == 0 {
 			logger.Log("msg", "no cooldowns", "team_id", teamID)
 			continue
diff --git a/server/worker/macos_setup_assistant_test.go b/server/worker/macos_setup_assistant_test.go
index 333362460c79..f137b418bb42 100644
--- a/server/worker/macos_setup_assistant_test.go
+++ b/server/worker/macos_setup_assistant_test.go
@@ -8,6 +8,7 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -28,6 +29,13 @@ func TestMacosSetupAssistant(t *testing.T) {
 	// call TruncateTables immediately as some DB migrations may create jobs
 	mysql.TruncateTables(t, ds)
 
+	org1Name := "org1"
+	org2Name := "org2"
+
+	mysql.SetTestABMAssets(t, ds, "fleet")
+	tok := mysql.CreateAndSetABMToken(t, ds, org1Name)
+	tok2 := mysql.CreateAndSetABMToken(t, ds, org2Name)
+
 	// create a couple hosts for no team, team 1 and team 2 (none for team 3)
 	hosts := make([]*fleet.Host, 6)
 	for i := 0; i < len(hosts); i++ {
@@ -40,10 +48,16 @@ func TestMacosSetupAssistant(t *testing.T) {
 			HardwareSerial: fmt.Sprintf("serial-%d", i),
 		})
 		require.NoError(t, err)
-		err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h})
+
+		tokID := tok.ID
+		if i%2 == 0 {
+			tokID = tok2.ID
+		}
+
+		err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h}, tokID)
 		require.NoError(t, err)
 		hosts[i] = h
-		t.Logf("host [%d]: %s - %s", i, h.UUID, h.HardwareSerial)
+		t.Logf("host [%d]: %s - %s - %d", i, h.UUID, h.HardwareSerial, tokID)
 	}
 
 	// create teams
@@ -60,8 +74,6 @@ func TestMacosSetupAssistant(t *testing.T) {
 	err = ds.AddHostsToTeam(ctx, &tm2.ID, []uint{hosts[4].ID, hosts[5].ID})
 	require.NoError(t, err)
 
-	mysql.SetTestABMAssets(t, ds)
-
 	logger := kitlog.NewNopLogger()
 	depStorage, err := ds.NewMDMAppleDEPStorage()
 	require.NoError(t, err)
@@ -126,7 +138,11 @@ func TestMacosSetupAssistant(t *testing.T) {
 		}
 	}))
 	defer srv.Close()
-	err = depStorage.StoreConfig(ctx, apple_mdm.DEPName, &nanodep_client.Config{BaseURL: srv.URL})
+	err = depStorage.StoreConfig(ctx, "fleet", &nanodep_client.Config{BaseURL: srv.URL})
+	require.NoError(t, err)
+	err = depStorage.StoreConfig(ctx, org1Name, &nanodep_client.Config{BaseURL: srv.URL})
+	require.NoError(t, err)
+	err = depStorage.StoreConfig(ctx, org2Name, &nanodep_client.Config{BaseURL: srv.URL})
 	require.NoError(t, err)
 
 	w := NewWorker(ds, logger)
@@ -160,12 +176,22 @@ func TestMacosSetupAssistant(t *testing.T) {
 	require.NoError(t, err)
 	require.NotEmpty(t, autoProf.Token)
 
-	tmIDs := []*uint{nil, ptr.Uint(tm1.ID), ptr.Uint(tm2.ID), ptr.Uint(tm3.ID)}
+	getTeamID := func(tmID *uint) string {
+		if tmID == nil {
+			return "null"
+		}
+
+		return strconv.Itoa(int(*tmID))
+	}
+
+	tmIDs := []*uint{nil, ptr.Uint(tm1.ID), ptr.Uint(tm2.ID)}
 	for _, tmID := range tmIDs {
-		profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, tmID)
-		require.NoError(t, err)
-		require.Equal(t, defaultProfileName, profUUID)
-		require.False(t, modTime.Before(start))
+		for _, org := range []string{org1Name, org2Name} {
+			profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, tmID, org)
+			require.NoError(t, err)
+			require.Equal(t, defaultProfileName, profUUID, "tmID", getTeamID(tmID))
+			require.False(t, modTime.Before(start))
+		}
 	}
 	require.Equal(t, map[string]string{
 		"serial-0": defaultProfileName,
@@ -190,16 +216,24 @@ func TestMacosSetupAssistant(t *testing.T) {
 
 	// default profile is unchanged
 	for _, tmID := range tmIDs {
-		profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, tmID)
-		require.NoError(t, err)
-		require.Equal(t, defaultProfileName, profUUID)
-		require.False(t, modTime.Before(start))
+		for _, org := range []string{org1Name, org2Name} {
+			profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, tmID, org)
+			require.NoError(t, err)
+			require.Equal(t, defaultProfileName, profUUID)
+			require.False(t, modTime.Before(start))
+		}
 	}
 
-	// team 1 setup assistant is registered
+	// team 1 setup assistant is registered for both tokens
 	tm1Asst, err = ds.GetMDMAppleSetupAssistant(ctx, &tm1.ID)
 	require.NoError(t, err)
-	require.Equal(t, "team1", tm1Asst.ProfileUUID)
+	require.NotNil(t, tm1Asst)
+	for _, org := range []string{org1Name, org2Name} {
+		profUUID, modTime, err := ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm1.ID, org)
+		require.NoError(t, err)
+		require.Equal(t, "team1", profUUID)
+		require.False(t, modTime.Before(start))
+	}
 
 	require.Equal(t, map[string]string{
 		"serial-0": defaultProfileName,
@@ -323,20 +357,40 @@ func TestMacosSetupAssistant(t *testing.T) {
 		"serial-5": "no-team", // became a no-team host when team2 got deleted
 	}, serialsToProfile)
 
-	// check that profiles get re-generated
-	reset := time.Now().Truncate(time.Second)
-	time.Sleep(time.Second)
-
+	// check that profiles get re-generated (note that timestamps are not
+	// impacted as the content of the profiles did not change)
 	_, err = QueueMacosSetupAssistantJob(ctx, ds, logger, MacosSetupAssistantUpdateAllProfiles, nil)
 	require.NoError(t, err)
 	runCheckDone()
 
 	// team 2 got deleted, update the list of team IDs
 	tmIDs = []*uint{nil, ptr.Uint(tm1.ID), ptr.Uint(tm3.ID)}
-	for _, tmID := range tmIDs {
-		_, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, tmID)
-		require.NoError(t, err)
-		require.True(t, modTime.After(reset))
+	for i, tmID := range tmIDs {
+		for _, org := range []string{org1Name, org2Name} {
+			// no team and team 3 have a custom setup assistant
+			switch i {
+			case 0: // no team
+				// custom profile defined for both orgs
+				_, _, err := ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, tmID, org)
+				require.NoError(t, err, "%v - %v", i, org)
+			case 1: // tm1
+				// team 1 uses the default setup assistant, and it is only defined for org1
+				_, _, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, tmID, org)
+				if org == org1Name {
+					require.NoError(t, err, "%v - %v", i, org)
+				} else {
+					require.ErrorIs(t, err, sql.ErrNoRows, "%v - %v", i, org)
+				}
+			case 2: // tm3
+				_, _, err := ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, tmID, org)
+				// custom setup assistant only defined for org2
+				if org == org2Name {
+					require.NoError(t, err, "%v - %v", i, org)
+				} else {
+					require.ErrorIs(t, err, sql.ErrNoRows, "%v - %v", i, org)
+				}
+			}
+		}
 	}
 
 	require.Equal(t, map[string]string{
diff --git a/terraform/README.md b/terraform/README.md
index 287cf421a539..f8015f428c3e 100644
--- a/terraform/README.md
+++ b/terraform/README.md
@@ -75,9 +75,9 @@ No resources.
 | <a name="input_alb_config"></a> [alb\_config](#input\_alb\_config) | n/a | <pre>object({<br>    name                 = optional(string, "fleet")<br>    security_groups      = optional(list(string), [])<br>    access_logs          = optional(map(string), {})<br>    allowed_cidrs        = optional(list(string), ["0.0.0.0/0"])<br>    allowed_ipv6_cidrs   = optional(list(string), ["::/0"])<br>    egress_cidrs         = optional(list(string), ["0.0.0.0/0"])<br>    egress_ipv6_cidrs    = optional(list(string), ["::/0"])<br>    extra_target_groups  = optional(any, [])<br>    https_listener_rules = optional(any, [])<br>    tls_policy           = optional(string, "ELBSecurityPolicy-TLS-1-2-2017-01")<br>    idle_timeout         = optional(number, 60)<br>  })</pre> | `{}` | no |
 | <a name="input_certificate_arn"></a> [certificate\_arn](#input\_certificate\_arn) | n/a | `string` | n/a | yes |
 | <a name="input_ecs_cluster"></a> [ecs\_cluster](#input\_ecs\_cluster) | The config for the terraform-aws-modules/ecs/aws module | <pre>object({<br>    autoscaling_capacity_providers = optional(any, {})<br>    cluster_configuration = optional(any, {<br>      execute_command_configuration = {<br>        logging = "OVERRIDE"<br>        log_configuration = {<br>          cloud_watch_log_group_name = "/aws/ecs/aws-ec2"<br>        }<br>      }<br>    })<br>    cluster_name = optional(string, "fleet")<br>    cluster_settings = optional(map(string), {<br>      "name" : "containerInsights",<br>      "value" : "enabled",<br>    })<br>    create                                = optional(bool, true)<br>    default_capacity_provider_use_fargate = optional(bool, true)<br>    fargate_capacity_providers = optional(any, {<br>      FARGATE = {<br>        default_capacity_provider_strategy = {<br>          weight = 100<br>        }<br>      }<br>      FARGATE_SPOT = {<br>        default_capacity_provider_strategy = {<br>          weight = 0<br>        }<br>      }<br>    })<br>    tags = optional(map(string))<br>  })</pre> | <pre>{<br>  "autoscaling_capacity_providers": {},<br>  "cluster_configuration": {<br>    "execute_command_configuration": {<br>      "log_configuration": {<br>        "cloud_watch_log_group_name": "/aws/ecs/aws-ec2"<br>      },<br>      "logging": "OVERRIDE"<br>    }<br>  },<br>  "cluster_name": "fleet",<br>  "cluster_settings": {<br>    "name": "containerInsights",<br>    "value": "enabled"<br>  },<br>  "create": true,<br>  "default_capacity_provider_use_fargate": true,<br>  "fargate_capacity_providers": {<br>    "FARGATE": {<br>      "default_capacity_provider_strategy": {<br>        "weight": 100<br>      }<br>    },<br>    "FARGATE_SPOT": {<br>      "default_capacity_provider_strategy": {<br>        "weight": 0<br>      }<br>    }<br>  },<br>  "tags": {}<br>}</pre> | no |
-| <a name="input_fleet_config"></a> [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | <pre>object({<br>    task_mem                     = optional(number, null)<br>    task_cpu                     = optional(number, null)<br>    mem                          = optional(number, 4096)<br>    cpu                          = optional(number, 512)<br>    pid_mode                     = optional(string, null)<br>    image                        = optional(string, "fleetdm/fleet:v4.53.1")<br>    family                       = optional(string, "fleet")<br>    sidecars                     = optional(list(any), [])<br>    depends_on                   = optional(list(any), [])<br>    mount_points                 = optional(list(any), [])<br>    volumes                      = optional(list(any), [])<br>    extra_environment_variables  = optional(map(string), {})<br>    extra_iam_policies           = optional(list(string), [])<br>    extra_execution_iam_policies = optional(list(string), [])<br>    extra_secrets                = optional(map(string), {})<br>    security_groups              = optional(list(string), null)<br>    security_group_name          = optional(string, "fleet")<br>    iam_role_arn                 = optional(string, null)<br>    repository_credentials       = optional(string, "")<br>    private_key_secret_name      = optional(string, "fleet-server-private-key")<br>    service = optional(object({<br>      name = optional(string, "fleet")<br>      }), {<br>      name = "fleet"<br>    })<br>    database = optional(object({<br>      password_secret_arn = string<br>      user                = string<br>      database            = string<br>      address             = string<br>      rr_address          = optional(string, null)<br>      }), {<br>      password_secret_arn = null<br>      user                = null<br>      database            = null<br>      address             = null<br>      rr_address          = null<br>    })<br>    redis = optional(object({<br>      address = string<br>      use_tls = optional(bool, true)<br>      }), {<br>      address = null<br>      use_tls = true<br>    })<br>    awslogs = optional(object({<br>      name      = optional(string, null)<br>      region    = optional(string, null)<br>      create    = optional(bool, true)<br>      prefix    = optional(string, "fleet")<br>      retention = optional(number, 5)<br>      }), {<br>      name      = null<br>      region    = null<br>      prefix    = "fleet"<br>      retention = 5<br>    })<br>    loadbalancer = optional(object({<br>      arn = string<br>      }), {<br>      arn = null<br>    })<br>    extra_load_balancers = optional(list(any), [])<br>    networking = optional(object({<br>      subnets         = optional(list(string), null)<br>      security_groups = optional(list(string), null)<br>      ingress_sources = optional(object({<br>        cidr_blocks      = optional(list(string), [])<br>        ipv6_cidr_blocks = optional(list(string), [])<br>        security_groups  = optional(list(string), [])<br>        prefix_list_ids  = optional(list(string), [])<br>        }), {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      })<br>      }), {<br>      subnets         = null<br>      security_groups = null<br>      ingress_sources = {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      }<br>    })<br>    autoscaling = optional(object({<br>      max_capacity                 = optional(number, 5)<br>      min_capacity                 = optional(number, 1)<br>      memory_tracking_target_value = optional(number, 80)<br>      cpu_tracking_target_value    = optional(number, 80)<br>      }), {<br>      max_capacity                 = 5<br>      min_capacity                 = 1<br>      memory_tracking_target_value = 80<br>      cpu_tracking_target_value    = 80<br>    })<br>    iam = optional(object({<br>      role = optional(object({<br>        name        = optional(string, "fleet-role")<br>        policy_name = optional(string, "fleet-iam-policy")<br>        }), {<br>        name        = "fleet-role"<br>        policy_name = "fleet-iam-policy"<br>      })<br>      execution = optional(object({<br>        name        = optional(string, "fleet-execution-role")<br>        policy_name = optional(string, "fleet-execution-role")<br>        }), {<br>        name        = "fleet-execution-role"<br>        policy_name = "fleet-iam-policy-execution"<br>      })<br>      }), {<br>      name = "fleetdm-execution-role"<br>    })<br>    software_installers = optional(object({<br>      create_bucket    = optional(bool, true)<br>      bucket_name      = optional(string, null)<br>      bucket_prefix    = optional(string, "fleet-software-installers-")<br>      s3_object_prefix = optional(string, "")<br>      }), {<br>      create_bucket    = true<br>      bucket_name      = null<br>      bucket_prefix    = "fleet-software-installers-"<br>      s3_object_prefix = ""<br>    })<br>  })</pre> | <pre>{<br>  "autoscaling": {<br>    "cpu_tracking_target_value": 80,<br>    "max_capacity": 5,<br>    "memory_tracking_target_value": 80,<br>    "min_capacity": 1<br>  },<br>  "awslogs": {<br>    "create": true,<br>    "name": null,<br>    "prefix": "fleet",<br>    "region": null,<br>    "retention": 5<br>  },<br>  "cpu": 256,<br>  "database": {<br>    "address": null,<br>    "database": null,<br>    "password_secret_arn": null,<br>    "rr_address": null,<br>    "user": null<br>  },<br>  "depends_on": [],<br>  "extra_environment_variables": {},<br>  "extra_execution_iam_policies": [],<br>  "extra_iam_policies": [],<br>  "extra_load_balancers": [],<br>  "extra_secrets": {},<br>  "family": "fleet",<br>  "iam": {<br>    "execution": {<br>      "name": "fleet-execution-role",<br>      "policy_name": "fleet-iam-policy-execution"<br>    },<br>    "role": {<br>      "name": "fleet-role",<br>      "policy_name": "fleet-iam-policy"<br>    }<br>  },<br>  "iam_role_arn": null,<br>  "image": "fleetdm/fleet:v4.53.1",<br>  "loadbalancer": {<br>    "arn": null<br>  },<br>  "mem": 512,<br>  "mount_points": [],<br>  "networking": {<br>    "ingress_sources": {<br>      "cidr_blocks": [],<br>      "ipv6_cidr_blocks": [],<br>      "prefix_list_ids": [],<br>      "security_groups": []<br>    },<br>    "security_groups": null,<br>    "subnets": null<br>  },<br>  "pid_mode": null,<br>  "private_key_secret_name": "fleet-server-private-key",<br>  "redis": {<br>    "address": null,<br>    "use_tls": true<br>  },<br>  "repository_credentials": "",<br>  "security_group_name": "fleet",<br>  "security_groups": null,<br>  "service": {<br>    "name": "fleet"<br>  },<br>  "sidecars": [],<br>  "software_installers": {<br>    "bucket_name": null,<br>    "bucket_prefix": "fleet-software-installers-",<br>    "create_bucket": true,<br>    "s3_object_prefix": ""<br>  },<br>  "task_cpu": null,<br>  "task_mem": null,<br>  "volumes": []<br>}</pre> | no |
+| <a name="input_fleet_config"></a> [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | <pre>object({<br>    task_mem                     = optional(number, null)<br>    task_cpu                     = optional(number, null)<br>    mem                          = optional(number, 4096)<br>    cpu                          = optional(number, 512)<br>    pid_mode                     = optional(string, null)<br>    image                        = optional(string, "fleetdm/fleet:v4.54.1")<br>    family                       = optional(string, "fleet")<br>    sidecars                     = optional(list(any), [])<br>    depends_on                   = optional(list(any), [])<br>    mount_points                 = optional(list(any), [])<br>    volumes                      = optional(list(any), [])<br>    extra_environment_variables  = optional(map(string), {})<br>    extra_iam_policies           = optional(list(string), [])<br>    extra_execution_iam_policies = optional(list(string), [])<br>    extra_secrets                = optional(map(string), {})<br>    security_group_name          = optional(string, "fleet")<br>    iam_role_arn                 = optional(string, null)<br>    repository_credentials       = optional(string, "")<br>    private_key_secret_name      = optional(string, "fleet-server-private-key")<br>    service = optional(object({<br>      name = optional(string, "fleet")<br>      }), {<br>      name = "fleet"<br>    })<br>    database = optional(object({<br>      password_secret_arn = string<br>      user                = string<br>      database            = string<br>      address             = string<br>      rr_address          = optional(string, null)<br>      }), {<br>      password_secret_arn = null<br>      user                = null<br>      database            = null<br>      address             = null<br>      rr_address          = null<br>    })<br>    redis = optional(object({<br>      address = string<br>      use_tls = optional(bool, true)<br>      }), {<br>      address = null<br>      use_tls = true<br>    })<br>    awslogs = optional(object({<br>      name      = optional(string, null)<br>      region    = optional(string, null)<br>      create    = optional(bool, true)<br>      prefix    = optional(string, "fleet")<br>      retention = optional(number, 5)<br>      }), {<br>      name      = null<br>      region    = null<br>      prefix    = "fleet"<br>      retention = 5<br>    })<br>    loadbalancer = optional(object({<br>      arn = string<br>      }), {<br>      arn = null<br>    })<br>    extra_load_balancers = optional(list(any), [])<br>    networking = optional(object({<br>      subnets         = optional(list(string), null)<br>      security_groups = optional(list(string), null)<br>      ingress_sources = optional(object({<br>        cidr_blocks      = optional(list(string), [])<br>        ipv6_cidr_blocks = optional(list(string), [])<br>        security_groups  = optional(list(string), [])<br>        prefix_list_ids  = optional(list(string), [])<br>        }), {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      })<br>      }), {<br>      subnets         = null<br>      security_groups = null<br>      ingress_sources = {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      }<br>    })<br>    autoscaling = optional(object({<br>      max_capacity                 = optional(number, 5)<br>      min_capacity                 = optional(number, 1)<br>      memory_tracking_target_value = optional(number, 80)<br>      cpu_tracking_target_value    = optional(number, 80)<br>      }), {<br>      max_capacity                 = 5<br>      min_capacity                 = 1<br>      memory_tracking_target_value = 80<br>      cpu_tracking_target_value    = 80<br>    })<br>    iam = optional(object({<br>      role = optional(object({<br>        name        = optional(string, "fleet-role")<br>        policy_name = optional(string, "fleet-iam-policy")<br>        }), {<br>        name        = "fleet-role"<br>        policy_name = "fleet-iam-policy"<br>      })<br>      execution = optional(object({<br>        name        = optional(string, "fleet-execution-role")<br>        policy_name = optional(string, "fleet-execution-role")<br>        }), {<br>        name        = "fleet-execution-role"<br>        policy_name = "fleet-iam-policy-execution"<br>      })<br>      }), {<br>      name = "fleetdm-execution-role"<br>    })<br>    software_installers = optional(object({<br>      create_bucket    = optional(bool, true)<br>      bucket_name      = optional(string, null)<br>      bucket_prefix    = optional(string, "fleet-software-installers-")<br>      s3_object_prefix = optional(string, "")<br>      }), {<br>      create_bucket    = true<br>      bucket_name      = null<br>      bucket_prefix    = "fleet-software-installers-"<br>      s3_object_prefix = ""<br>    })<br>  })</pre> | <pre>{<br>  "autoscaling": {<br>    "cpu_tracking_target_value": 80,<br>    "max_capacity": 5,<br>    "memory_tracking_target_value": 80,<br>    "min_capacity": 1<br>  },<br>  "awslogs": {<br>    "create": true,<br>    "name": null,<br>    "prefix": "fleet",<br>    "region": null,<br>    "retention": 5<br>  },<br>  "cpu": 256,<br>  "database": {<br>    "address": null,<br>    "database": null,<br>    "password_secret_arn": null,<br>    "rr_address": null,<br>    "user": null<br>  },<br>  "depends_on": [],<br>  "extra_environment_variables": {},<br>  "extra_execution_iam_policies": [],<br>  "extra_iam_policies": [],<br>  "extra_load_balancers": [],<br>  "extra_secrets": {},<br>  "family": "fleet",<br>  "iam": {<br>    "execution": {<br>      "name": "fleet-execution-role",<br>      "policy_name": "fleet-iam-policy-execution"<br>    },<br>    "role": {<br>      "name": "fleet-role",<br>      "policy_name": "fleet-iam-policy"<br>    }<br>  },<br>  "iam_role_arn": null,<br>  "image": "fleetdm/fleet:v4.54.1",<br>  "loadbalancer": {<br>    "arn": null<br>  },<br>  "mem": 512,<br>  "mount_points": [],<br>  "networking": {<br>    "ingress_sources": {<br>      "cidr_blocks": [],<br>      "ipv6_cidr_blocks": [],<br>      "prefix_list_ids": [],<br>      "security_groups": []<br>    },<br>    "security_groups": null,<br>    "subnets": null<br>  },<br>  "pid_mode": null,<br>  "private_key_secret_name": "fleet-server-private-key",<br>  "redis": {<br>    "address": null,<br>    "use_tls": true<br>  },<br>  "repository_credentials": "",<br>  "security_group_name": "fleet",<br>  "security_groups": null,<br>  "service": {<br>    "name": "fleet"<br>  },<br>  "sidecars": [],<br>  "software_installers": {<br>    "bucket_name": null,<br>    "bucket_prefix": "fleet-software-installers-",<br>    "create_bucket": true,<br>    "s3_object_prefix": ""<br>  },<br>  "task_cpu": null,<br>  "task_mem": null,<br>  "volumes": []<br>}</pre> | no |
 | <a name="input_migration_config"></a> [migration\_config](#input\_migration\_config) | The configuration object for Fleet's migration task. | <pre>object({<br>    mem = number<br>    cpu = number<br>  })</pre> | <pre>{<br>  "cpu": 1024,<br>  "mem": 2048<br>}</pre> | no |
-| <a name="input_rds_config"></a> [rds\_config](#input\_rds\_config) | The config for the terraform-aws-modules/rds-aurora/aws module | <pre>object({<br>    name                            = optional(string, "fleet")<br>    engine_version                  = optional(string, "8.0.mysql_aurora.3.04.2")<br>    instance_class                  = optional(string, "db.t4g.large")<br>    subnets                         = optional(list(string), [])<br>    allowed_security_groups         = optional(list(string), [])<br>    allowed_cidr_blocks             = optional(list(string), [])<br>    apply_immediately               = optional(bool, true)<br>    monitoring_interval             = optional(number, 10)<br>    db_parameter_group_name         = optional(string)<br>    db_parameters                   = optional(map(string), {})<br>    db_cluster_parameter_group_name = optional(string)<br>    db_cluster_parameters           = optional(map(string), {})<br>    enabled_cloudwatch_logs_exports = optional(list(string), [])<br>    master_username                 = optional(string, "fleet")<br>    snapshot_identifier             = optional(string)<br>    cluster_tags                    = optional(map(string), {})<br>  })</pre> | <pre>{<br>  "allowed_cidr_blocks": [],<br>  "allowed_security_groups": [],<br>  "apply_immediately": true,<br>  "cluster_tags": {},<br>  "db_cluster_parameter_group_name": null,<br>  "db_cluster_parameters": {},<br>  "db_parameter_group_name": null,<br>  "db_parameters": {},<br>  "enabled_cloudwatch_logs_exports": [],<br>  "engine_version": "8.0.mysql_aurora.3.04.2",<br>  "instance_class": "db.t4g.large",<br>  "master_username": "fleet",<br>  "monitoring_interval": 10,<br>  "name": "fleet",<br>  "snapshot_identifier": null,<br>  "subnets": []<br>}</pre> | no |
+| <a name="input_rds_config"></a> [rds\_config](#input\_rds\_config) | The config for the terraform-aws-modules/rds-aurora/aws module | <pre>object({<br>    name                            = optional(string, "fleet")<br>    engine_version                  = optional(string, "8.0.mysql_aurora.3.07.1")<br>    instance_class                  = optional(string, "db.t4g.large")<br>    subnets                         = optional(list(string), [])<br>    allowed_security_groups         = optional(list(string), [])<br>    allowed_cidr_blocks             = optional(list(string), [])<br>    apply_immediately               = optional(bool, true)<br>    monitoring_interval             = optional(number, 10)<br>    db_parameter_group_name         = optional(string)<br>    db_parameters                   = optional(map(string), {})<br>    db_cluster_parameter_group_name = optional(string)<br>    db_cluster_parameters           = optional(map(string), {})<br>    enabled_cloudwatch_logs_exports = optional(list(string), [])<br>    master_username                 = optional(string, "fleet")<br>    snapshot_identifier             = optional(string)<br>    cluster_tags                    = optional(map(string), {})<br>  })</pre> | <pre>{<br>  "allowed_cidr_blocks": [],<br>  "allowed_security_groups": [],<br>  "apply_immediately": true,<br>  "cluster_tags": {},<br>  "db_cluster_parameter_group_name": null,<br>  "db_cluster_parameters": {},<br>  "db_parameter_group_name": null,<br>  "db_parameters": {},<br>  "enabled_cloudwatch_logs_exports": [],<br>  "engine_version": "8.0.mysql_aurora.3.07.1",<br>  "instance_class": "db.t4g.large",<br>  "master_username": "fleet",<br>  "monitoring_interval": 10,<br>  "name": "fleet",<br>  "snapshot_identifier": null,<br>  "subnets": []<br>}</pre> | no |
 | <a name="input_redis_config"></a> [redis\_config](#input\_redis\_config) | n/a | <pre>object({<br>    name                          = optional(string, "fleet")<br>    replication_group_id          = optional(string)<br>    elasticache_subnet_group_name = optional(string)<br>    allowed_security_group_ids    = optional(list(string), [])<br>    subnets                       = optional(list(string))<br>    availability_zones            = optional(list(string))<br>    cluster_size                  = optional(number, 3)<br>    instance_type                 = optional(string, "cache.m5.large")<br>    apply_immediately             = optional(bool, true)<br>    automatic_failover_enabled    = optional(bool, false)<br>    engine_version                = optional(string, "6.x")<br>    family                        = optional(string, "redis6.x")<br>    at_rest_encryption_enabled    = optional(bool, true)<br>    transit_encryption_enabled    = optional(bool, true)<br>    parameter = optional(list(object({<br>      name  = string<br>      value = string<br>    })), [])<br>    log_delivery_configuration = optional(list(map(any)), [])<br>    tags                       = optional(map(string), {})<br>  })</pre> | <pre>{<br>  "allowed_security_group_ids": [],<br>  "apply_immediately": true,<br>  "at_rest_encryption_enabled": true,<br>  "automatic_failover_enabled": false,<br>  "availability_zones": null,<br>  "cluster_size": 3,<br>  "elasticache_subnet_group_name": null,<br>  "engine_version": "6.x",<br>  "family": "redis6.x",<br>  "instance_type": "cache.m5.large",<br>  "log_delivery_configuration": [],<br>  "name": "fleet",<br>  "parameter": [],<br>  "replication_group_id": null,<br>  "subnets": null,<br>  "tags": {},<br>  "transit_encryption_enabled": true<br>}</pre> | no |
 | <a name="input_vpc"></a> [vpc](#input\_vpc) | n/a | <pre>object({<br>    name                = optional(string, "fleet")<br>    cidr                = optional(string, "10.10.0.0/16")<br>    azs                 = optional(list(string), ["us-east-2a", "us-east-2b", "us-east-2c"])<br>    private_subnets     = optional(list(string), ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"])<br>    public_subnets      = optional(list(string), ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"])<br>    database_subnets    = optional(list(string), ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"])<br>    elasticache_subnets = optional(list(string), ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"])<br><br>    create_database_subnet_group              = optional(bool, false)<br>    create_database_subnet_route_table        = optional(bool, true)<br>    create_elasticache_subnet_group           = optional(bool, true)<br>    create_elasticache_subnet_route_table     = optional(bool, true)<br>    enable_vpn_gateway                        = optional(bool, false)<br>    one_nat_gateway_per_az                    = optional(bool, false)<br>    single_nat_gateway                        = optional(bool, true)<br>    enable_nat_gateway                        = optional(bool, true)<br>    enable_dns_hostnames                      = optional(bool, false)<br>    enable_dns_support                        = optional(bool, true)<br>    enable_flow_log                           = optional(bool, false)<br>    create_flow_log_cloudwatch_log_group      = optional(bool, false)<br>    create_flow_log_cloudwatch_iam_role       = optional(bool, false)<br>    flow_log_max_aggregation_interval         = optional(number, 600)<br>    flow_log_cloudwatch_log_group_name_prefix = optional(string, "/aws/vpc-flow-log/")<br>    flow_log_cloudwatch_log_group_name_suffix = optional(string, "")<br>    vpc_flow_log_tags                         = optional(map(string), {})<br>  })</pre> | <pre>{<br>  "azs": [<br>    "us-east-2a",<br>    "us-east-2b",<br>    "us-east-2c"<br>  ],<br>  "cidr": "10.10.0.0/16",<br>  "create_database_subnet_group": false,<br>  "create_database_subnet_route_table": true,<br>  "create_elasticache_subnet_group": true,<br>  "create_elasticache_subnet_route_table": true,<br>  "create_flow_log_cloudwatch_iam_role": false,<br>  "create_flow_log_cloudwatch_log_group": false,<br>  "database_subnets": [<br>    "10.10.21.0/24",<br>    "10.10.22.0/24",<br>    "10.10.23.0/24"<br>  ],<br>  "elasticache_subnets": [<br>    "10.10.31.0/24",<br>    "10.10.32.0/24",<br>    "10.10.33.0/24"<br>  ],<br>  "enable_dns_hostnames": false,<br>  "enable_dns_support": true,<br>  "enable_flow_log": false,<br>  "enable_nat_gateway": true,<br>  "enable_vpn_gateway": false,<br>  "flow_log_cloudwatch_log_group_name_prefix": "/aws/vpc-flow-log/",<br>  "flow_log_cloudwatch_log_group_name_suffix": "",<br>  "flow_log_max_aggregation_interval": 600,<br>  "name": "fleet",<br>  "one_nat_gateway_per_az": false,<br>  "private_subnets": [<br>    "10.10.1.0/24",<br>    "10.10.2.0/24",<br>    "10.10.3.0/24"<br>  ],<br>  "public_subnets": [<br>    "10.10.11.0/24",<br>    "10.10.12.0/24",<br>    "10.10.13.0/24"<br>  ],<br>  "single_nat_gateway": true,<br>  "vpc_flow_log_tags": {}<br>}</pre> | no |
 
diff --git a/terraform/addons/mdm/README.md b/terraform/addons/mdm/README.md
index 0cb04aac5950..4acccf3d9bb9 100644
--- a/terraform/addons/mdm/README.md
+++ b/terraform/addons/mdm/README.md
@@ -1,7 +1,7 @@
 # MDM addon
 
 Notice: Previous versions of this module referred to `dep`, but to reduce confusion that has been replaces with `abm`
-to mach the change to the newer Apple Busines Manager.  For each key/value pair below, the key names have been changed
+to mach the change to the newer Apple Business Manager.  For each key/value pair below, the key names have been changed
 from previous version to match the name of the env var for easier usability.  Older unused env vars were also removed
 for simplification.  This includes removing the need for `extra_environment_variables` completely.
 
diff --git a/terraform/addons/monitoring/lambda/go.mod b/terraform/addons/monitoring/lambda/go.mod
index 5e7c002f4197..bd2389b8ef11 100644
--- a/terraform/addons/monitoring/lambda/go.mod
+++ b/terraform/addons/monitoring/lambda/go.mod
@@ -1,6 +1,6 @@
 module github.com/fleetdm/fleet/terraform/addons/monitoring/lambda
 
-go 1.22.4
+go 1.23.1
 
 require (
 	github.com/aws/aws-lambda-go v1.41.0
diff --git a/terraform/addons/ses/main.tf b/terraform/addons/ses/main.tf
index 6c7304f1ba12..00aec19fe0eb 100644
--- a/terraform/addons/ses/main.tf
+++ b/terraform/addons/ses/main.tf
@@ -1,3 +1,10 @@
+locals {
+  spf_domains = [
+    aws_ses_domain_identity.default.domain,
+    "_amazonses.${aws_ses_domain_identity.default.domain}"
+  ]
+}
+
 resource "aws_ses_domain_identity" "default" {
   domain = var.domain
 }
@@ -19,11 +26,12 @@ resource "aws_route53_record" "amazonses_dkim_record" {
 
 
 resource "aws_route53_record" "spf_domain" {
-  zone_id = var.zone_id
-  name    = "_amazonses.${aws_ses_domain_identity.default.domain}"
-  type    = "TXT"
-  ttl     = "600"
-  records = ["v=spf1 include:amazonses.com -all"]
+  for_each = toset(local.spf_domains)
+  zone_id  = var.zone_id
+  name     = each.key
+  type     = "TXT"
+  ttl      = "600"
+  records  = ["v=spf1 include:amazonses.com -all"]
 }
 
 resource "aws_iam_policy" "main" {
diff --git a/terraform/addons/ses/variables.tf b/terraform/addons/ses/variables.tf
index be93f34ccff6..a174e55f0ae6 100644
--- a/terraform/addons/ses/variables.tf
+++ b/terraform/addons/ses/variables.tf
@@ -4,6 +4,6 @@ variable "domain" {
 }
 
 variable "zone_id" {
-  type = string
+  type        = string
   description = "Route53 Zone ID"
 }
diff --git a/terraform/addons/vuln-processing/variables.tf b/terraform/addons/vuln-processing/variables.tf
index b05814b665d2..eaea7243fa5b 100644
--- a/terraform/addons/vuln-processing/variables.tf
+++ b/terraform/addons/vuln-processing/variables.tf
@@ -24,7 +24,7 @@ variable "fleet_config" {
     vuln_processing_cpu                  = optional(number, 2048)
     vuln_data_stream_mem                 = optional(number, 1024)
     vuln_data_stream_cpu                 = optional(number, 512)
-    image                                = optional(string, "fleetdm/fleet:v4.53.1")
+    image                                = optional(string, "fleetdm/fleet:v4.54.1")
     family                               = optional(string, "fleet-vuln-processing")
     sidecars                             = optional(list(any), [])
     extra_environment_variables          = optional(map(string), {})
@@ -82,7 +82,7 @@ variable "fleet_config" {
     vuln_processing_cpu                  = 2048
     vuln_data_stream_mem                 = 1024
     vuln_data_stream_cpu                 = 512
-    image                                = "fleetdm/fleet:v4.53.1"
+    image                                = "fleetdm/fleet:v4.54.1"
     family                               = "fleet-vuln-processing"
     sidecars                             = []
     extra_environment_variables          = {}
diff --git a/terraform/addons/waf-alb/main.tf b/terraform/addons/waf-alb/main.tf
index 01099156cd0d..a62daf3e1b2c 100644
--- a/terraform/addons/waf-alb/main.tf
+++ b/terraform/addons/waf-alb/main.tf
@@ -1,4 +1,9 @@
-resource "aws_wafv2_rule_group" "main" {
+locals {
+  default_action = var.waf_type == "blocklist" ? "block" : "allow"
+}
+
+resource "aws_wafv2_rule_group" "blocked" {
+  count    = var.waf_type == "blocklist" ? 1 : 0
   name     = var.name
   scope    = "REGIONAL"
   capacity = 2
@@ -34,7 +39,7 @@ resource "aws_wafv2_rule_group" "main" {
 
     statement {
       ip_set_reference_statement {
-        arn = aws_wafv2_ip_set.main.arn
+        arn = aws_wafv2_ip_set.blocked[0].arn
       }
     }
 
@@ -52,19 +57,61 @@ resource "aws_wafv2_rule_group" "main" {
   }
 }
 
-resource "aws_wafv2_ip_set" "main" {
+resource "aws_wafv2_ip_set" "blocked" {
+  count              = var.waf_type == "blocklist" ? 1 : 0
   name               = var.name
   scope              = "REGIONAL"
   ip_address_version = "IPV4"
   addresses          = var.blocked_addresses
 }
 
+resource "aws_wafv2_rule_group" "allowed" {
+  count    = var.waf_type == "allowlist" ? 1 : 0
+  name     = var.name
+  scope    = "REGIONAL"
+  capacity = 2
+
+  rule {
+    name     = "specific"
+    priority = 1
+
+    action {
+      allow {}
+    }
+
+    statement {
+      ip_set_reference_statement {
+        arn = aws_wafv2_ip_set.allowed[0].arn
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = var.name
+      sampled_requests_enabled   = false
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = var.name
+    sampled_requests_enabled   = false
+  }
+}
+
 resource "aws_wafv2_web_acl" "main" {
   name  = var.name
   scope = "REGIONAL"
 
   default_action {
-    allow {}
+    dynamic "block" {
+      for_each = var.waf_type == "allowlist" ? [true] : []
+      content {}
+    }
+    dynamic "allow" {
+      for_each = var.waf_type == "blocklist" ? [true] : []
+      content {}
+    }
   }
 
   rule {
@@ -77,7 +124,7 @@ resource "aws_wafv2_web_acl" "main" {
 
     statement {
       rule_group_reference_statement {
-        arn = aws_wafv2_rule_group.main.arn
+        arn = var.waf_type == "blocklist" ? aws_wafv2_rule_group.blocked[0].arn : aws_wafv2_rule_group.allowed[0].arn
       }
     }
 
@@ -95,6 +142,15 @@ resource "aws_wafv2_web_acl" "main" {
   }
 }
 
+resource "aws_wafv2_ip_set" "allowed" {
+  count              = var.waf_type == "allowlist" ? 1 : 0
+  name               = var.name
+  scope              = "REGIONAL"
+  ip_address_version = "IPV4"
+  addresses          = var.allowed_addresses
+}
+
+
 resource "aws_wafv2_web_acl_association" "main" {
   resource_arn = var.lb_arn
   web_acl_arn  = aws_wafv2_web_acl.main.arn
diff --git a/terraform/addons/waf-alb/variables.tf b/terraform/addons/waf-alb/variables.tf
index 4afd23e80ec4..2c16acc653c1 100644
--- a/terraform/addons/waf-alb/variables.tf
+++ b/terraform/addons/waf-alb/variables.tf
@@ -2,6 +2,11 @@ variable "name" {}
 
 variable "lb_arn" {}
 
+variable "waf_type" {
+  type    = string
+  default = "blocklist"
+}
+
 variable "blocked_countries" {
   type    = list(string)
   default = ["BI", "BY", "CD", "CF", "CU", "IQ", "IR", "LB", "LY", "SD", "SO", "SS", "SY", "VE", "ZW", "RU"]
@@ -11,3 +16,8 @@ variable "blocked_addresses" {
   type    = list(string)
   default = []
 }
+
+variable "allowed_addresses" {
+  type    = list(string)
+  default = []
+}
diff --git a/terraform/byo-vpc/README.md b/terraform/byo-vpc/README.md
index 30f127bb9515..16998b14b18f 100644
--- a/terraform/byo-vpc/README.md
+++ b/terraform/byo-vpc/README.md
@@ -33,9 +33,9 @@ No requirements.
 |------|-------------|------|---------|:--------:|
 | <a name="input_alb_config"></a> [alb\_config](#input\_alb\_config) | n/a | <pre>object({<br>    name                 = optional(string, "fleet")<br>    subnets              = list(string)<br>    security_groups      = optional(list(string), [])<br>    access_logs          = optional(map(string), {})<br>    certificate_arn      = string<br>    allowed_cidrs        = optional(list(string), ["0.0.0.0/0"])<br>    allowed_ipv6_cidrs   = optional(list(string), ["::/0"])<br>    egress_cidrs         = optional(list(string), ["0.0.0.0/0"])<br>    egress_ipv6_cidrs    = optional(list(string), ["::/0"])<br>    extra_target_groups  = optional(any, [])<br>    https_listener_rules = optional(any, [])<br>    tls_policy           = optional(string, "ELBSecurityPolicy-TLS-1-2-2017-01")<br>    idle_timeout         = optional(number, 60)<br>  })</pre> | n/a | yes |
 | <a name="input_ecs_cluster"></a> [ecs\_cluster](#input\_ecs\_cluster) | The config for the terraform-aws-modules/ecs/aws module | <pre>object({<br>    autoscaling_capacity_providers = optional(any, {})<br>    cluster_configuration = optional(any, {<br>      execute_command_configuration = {<br>        logging = "OVERRIDE"<br>        log_configuration = {<br>          cloud_watch_log_group_name = "/aws/ecs/aws-ec2"<br>        }<br>      }<br>    })<br>    cluster_name = optional(string, "fleet")<br>    cluster_settings = optional(map(string), {<br>      "name" : "containerInsights",<br>      "value" : "enabled",<br>    })<br>    create                                = optional(bool, true)<br>    default_capacity_provider_use_fargate = optional(bool, true)<br>    fargate_capacity_providers = optional(any, {<br>      FARGATE = {<br>        default_capacity_provider_strategy = {<br>          weight = 100<br>        }<br>      }<br>      FARGATE_SPOT = {<br>        default_capacity_provider_strategy = {<br>          weight = 0<br>        }<br>      }<br>    })<br>    tags = optional(map(string))<br>  })</pre> | <pre>{<br>  "autoscaling_capacity_providers": {},<br>  "cluster_configuration": {<br>    "execute_command_configuration": {<br>      "log_configuration": {<br>        "cloud_watch_log_group_name": "/aws/ecs/aws-ec2"<br>      },<br>      "logging": "OVERRIDE"<br>    }<br>  },<br>  "cluster_name": "fleet",<br>  "cluster_settings": {<br>    "name": "containerInsights",<br>    "value": "enabled"<br>  },<br>  "create": true,<br>  "default_capacity_provider_use_fargate": true,<br>  "fargate_capacity_providers": {<br>    "FARGATE": {<br>      "default_capacity_provider_strategy": {<br>        "weight": 100<br>      }<br>    },<br>    "FARGATE_SPOT": {<br>      "default_capacity_provider_strategy": {<br>        "weight": 0<br>      }<br>    }<br>  },<br>  "tags": {}<br>}</pre> | no |
-| <a name="input_fleet_config"></a> [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | <pre>object({<br>    task_mem                     = optional(number, null)<br>    task_cpu                     = optional(number, null)<br>    mem                          = optional(number, 4096)<br>    cpu                          = optional(number, 512)<br>    pid_mode                     = optional(string, null)<br>    image                        = optional(string, "fleetdm/fleet:v4.53.1")<br>    family                       = optional(string, "fleet")<br>    sidecars                     = optional(list(any), [])<br>    depends_on                   = optional(list(any), [])<br>    mount_points                 = optional(list(any), [])<br>    volumes                      = optional(list(any), [])<br>    extra_environment_variables  = optional(map(string), {})<br>    extra_iam_policies           = optional(list(string), [])<br>    extra_execution_iam_policies = optional(list(string), [])<br>    extra_secrets                = optional(map(string), {})<br>    security_groups              = optional(list(string), null)<br>    security_group_name          = optional(string, "fleet")<br>    iam_role_arn                 = optional(string, null)<br>    repository_credentials       = optional(string, "")<br>    private_key_secret_name      = optional(string, "fleet-server-private-key")<br>    service = optional(object({<br>      name = optional(string, "fleet")<br>      }), {<br>      name = "fleet"<br>    })<br>    database = optional(object({<br>      password_secret_arn = string<br>      user                = string<br>      database            = string<br>      address             = string<br>      rr_address          = optional(string, null)<br>      }), {<br>      password_secret_arn = null<br>      user                = null<br>      database            = null<br>      address             = null<br>      rr_address          = null<br>    })<br>    redis = optional(object({<br>      address = string<br>      use_tls = optional(bool, true)<br>      }), {<br>      address = null<br>      use_tls = true<br>    })<br>    awslogs = optional(object({<br>      name      = optional(string, null)<br>      region    = optional(string, null)<br>      create    = optional(bool, true)<br>      prefix    = optional(string, "fleet")<br>      retention = optional(number, 5)<br>      }), {<br>      name      = null<br>      region    = null<br>      prefix    = "fleet"<br>      retention = 5<br>    })<br>    loadbalancer = optional(object({<br>      arn = string<br>      }), {<br>      arn = null<br>    })<br>    extra_load_balancers = optional(list(any), [])<br>    networking = optional(object({<br>      subnets         = optional(list(string), null)<br>      security_groups = optional(list(string), null)<br>      ingress_sources = optional(object({<br>        cidr_blocks      = optional(list(string), [])<br>        ipv6_cidr_blocks = optional(list(string), [])<br>        security_groups  = optional(list(string), [])<br>        prefix_list_ids  = optional(list(string), [])<br>        }), {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      })<br>      }), {<br>      subnets         = null<br>      security_groups = null<br>      ingress_sources = {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      }<br>    })<br>    autoscaling = optional(object({<br>      max_capacity                 = optional(number, 5)<br>      min_capacity                 = optional(number, 1)<br>      memory_tracking_target_value = optional(number, 80)<br>      cpu_tracking_target_value    = optional(number, 80)<br>      }), {<br>      max_capacity                 = 5<br>      min_capacity                 = 1<br>      memory_tracking_target_value = 80<br>      cpu_tracking_target_value    = 80<br>    })<br>    iam = optional(object({<br>      role = optional(object({<br>        name        = optional(string, "fleet-role")<br>        policy_name = optional(string, "fleet-iam-policy")<br>        }), {<br>        name        = "fleet-role"<br>        policy_name = "fleet-iam-policy"<br>      })<br>      execution = optional(object({<br>        name        = optional(string, "fleet-execution-role")<br>        policy_name = optional(string, "fleet-execution-role")<br>        }), {<br>        name        = "fleet-execution-role"<br>        policy_name = "fleet-iam-policy-execution"<br>      })<br>      }), {<br>      name = "fleetdm-execution-role"<br>    })<br>    software_installers = optional(object({<br>      create_bucket    = optional(bool, true)<br>      bucket_name      = optional(string, null)<br>      bucket_prefix    = optional(string, "fleet-software-installers-")<br>      s3_object_prefix = optional(string, "")<br>      }), {<br>      create_bucket    = true<br>      bucket_name      = null<br>      bucket_prefix    = "fleet-software-installers-"<br>      s3_object_prefix = ""<br>    })<br>  })</pre> | <pre>{<br>  "autoscaling": {<br>    "cpu_tracking_target_value": 80,<br>    "max_capacity": 5,<br>    "memory_tracking_target_value": 80,<br>    "min_capacity": 1<br>  },<br>  "awslogs": {<br>    "create": true,<br>    "name": null,<br>    "prefix": "fleet",<br>    "region": null,<br>    "retention": 5<br>  },<br>  "cpu": 256,<br>  "database": {<br>    "address": null,<br>    "database": null,<br>    "password_secret_arn": null,<br>    "rr_address": null,<br>    "user": null<br>  },<br>  "depends_on": [],<br>  "extra_environment_variables": {},<br>  "extra_execution_iam_policies": [],<br>  "extra_iam_policies": [],<br>  "extra_load_balancers": [],<br>  "extra_secrets": {},<br>  "family": "fleet",<br>  "iam": {<br>    "execution": {<br>      "name": "fleet-execution-role",<br>      "policy_name": "fleet-iam-policy-execution"<br>    },<br>    "role": {<br>      "name": "fleet-role",<br>      "policy_name": "fleet-iam-policy"<br>    }<br>  },<br>  "iam_role_arn": null,<br>  "image": "fleetdm/fleet:v4.53.1",<br>  "loadbalancer": {<br>    "arn": null<br>  },<br>  "mem": 512,<br>  "mount_points": [],<br>  "networking": {<br>    "ingress_sources": {<br>      "cidr_blocks": [],<br>      "ipv6_cidr_blocks": [],<br>      "prefix_list_ids": [],<br>      "security_groups": []<br>    },<br>    "security_groups": null,<br>    "subnets": null<br>  },<br>  "pid_mode": null,<br>  "private_key_secret_name": "fleet-server-private-key",<br>  "redis": {<br>    "address": null,<br>    "use_tls": true<br>  },<br>  "repository_credentials": "",<br>  "security_group_name": "fleet",<br>  "security_groups": null,<br>  "service": {<br>    "name": "fleet"<br>  },<br>  "sidecars": [],<br>  "software_installers": {<br>    "bucket_name": null,<br>    "bucket_prefix": "fleet-software-installers-",<br>    "create_bucket": true,<br>    "s3_object_prefix": ""<br>  },<br>  "task_cpu": null,<br>  "task_mem": null,<br>  "volumes": []<br>}</pre> | no |
+| <a name="input_fleet_config"></a> [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | <pre>object({<br>    task_mem                     = optional(number, null)<br>    task_cpu                     = optional(number, null)<br>    mem                          = optional(number, 4096)<br>    cpu                          = optional(number, 512)<br>    pid_mode                     = optional(string, null)<br>    image                        = optional(string, "fleetdm/fleet:v4.54.1")<br>    family                       = optional(string, "fleet")<br>    sidecars                     = optional(list(any), [])<br>    depends_on                   = optional(list(any), [])<br>    mount_points                 = optional(list(any), [])<br>    volumes                      = optional(list(any), [])<br>    extra_environment_variables  = optional(map(string), {})<br>    extra_iam_policies           = optional(list(string), [])<br>    extra_execution_iam_policies = optional(list(string), [])<br>    extra_secrets                = optional(map(string), {})<br>    security_group_name          = optional(string, "fleet")<br>    iam_role_arn                 = optional(string, null)<br>    repository_credentials       = optional(string, "")<br>    private_key_secret_name      = optional(string, "fleet-server-private-key")<br>    service = optional(object({<br>      name = optional(string, "fleet")<br>      }), {<br>      name = "fleet"<br>    })<br>    database = optional(object({<br>      password_secret_arn = string<br>      user                = string<br>      database            = string<br>      address             = string<br>      rr_address          = optional(string, null)<br>      }), {<br>      password_secret_arn = null<br>      user                = null<br>      database            = null<br>      address             = null<br>      rr_address          = null<br>    })<br>    redis = optional(object({<br>      address = string<br>      use_tls = optional(bool, true)<br>      }), {<br>      address = null<br>      use_tls = true<br>    })<br>    awslogs = optional(object({<br>      name      = optional(string, null)<br>      region    = optional(string, null)<br>      create    = optional(bool, true)<br>      prefix    = optional(string, "fleet")<br>      retention = optional(number, 5)<br>      }), {<br>      name      = null<br>      region    = null<br>      prefix    = "fleet"<br>      retention = 5<br>    })<br>    loadbalancer = optional(object({<br>      arn = string<br>      }), {<br>      arn = null<br>    })<br>    extra_load_balancers = optional(list(any), [])<br>    networking = optional(object({<br>      subnets         = optional(list(string), null)<br>      security_groups = optional(list(string), null)<br>      ingress_sources = optional(object({<br>        cidr_blocks      = optional(list(string), [])<br>        ipv6_cidr_blocks = optional(list(string), [])<br>        security_groups  = optional(list(string), [])<br>        prefix_list_ids  = optional(list(string), [])<br>        }), {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      })<br>      }), {<br>      subnets         = null<br>      security_groups = null<br>      ingress_sources = {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      }<br>    })<br>    autoscaling = optional(object({<br>      max_capacity                 = optional(number, 5)<br>      min_capacity                 = optional(number, 1)<br>      memory_tracking_target_value = optional(number, 80)<br>      cpu_tracking_target_value    = optional(number, 80)<br>      }), {<br>      max_capacity                 = 5<br>      min_capacity                 = 1<br>      memory_tracking_target_value = 80<br>      cpu_tracking_target_value    = 80<br>    })<br>    iam = optional(object({<br>      role = optional(object({<br>        name        = optional(string, "fleet-role")<br>        policy_name = optional(string, "fleet-iam-policy")<br>        }), {<br>        name        = "fleet-role"<br>        policy_name = "fleet-iam-policy"<br>      })<br>      execution = optional(object({<br>        name        = optional(string, "fleet-execution-role")<br>        policy_name = optional(string, "fleet-execution-role")<br>        }), {<br>        name        = "fleet-execution-role"<br>        policy_name = "fleet-iam-policy-execution"<br>      })<br>      }), {<br>      name = "fleetdm-execution-role"<br>    })<br>    software_installers = optional(object({<br>      create_bucket    = optional(bool, true)<br>      bucket_name      = optional(string, null)<br>      bucket_prefix    = optional(string, "fleet-software-installers-")<br>      s3_object_prefix = optional(string, "")<br>      }), {<br>      create_bucket    = true<br>      bucket_name      = null<br>      bucket_prefix    = "fleet-software-installers-"<br>      s3_object_prefix = ""<br>    })<br>  })</pre> | <pre>{<br>  "autoscaling": {<br>    "cpu_tracking_target_value": 80,<br>    "max_capacity": 5,<br>    "memory_tracking_target_value": 80,<br>    "min_capacity": 1<br>  },<br>  "awslogs": {<br>    "create": true,<br>    "name": null,<br>    "prefix": "fleet",<br>    "region": null,<br>    "retention": 5<br>  },<br>  "cpu": 256,<br>  "database": {<br>    "address": null,<br>    "database": null,<br>    "password_secret_arn": null,<br>    "rr_address": null,<br>    "user": null<br>  },<br>  "depends_on": [],<br>  "extra_environment_variables": {},<br>  "extra_execution_iam_policies": [],<br>  "extra_iam_policies": [],<br>  "extra_load_balancers": [],<br>  "extra_secrets": {},<br>  "family": "fleet",<br>  "iam": {<br>    "execution": {<br>      "name": "fleet-execution-role",<br>      "policy_name": "fleet-iam-policy-execution"<br>    },<br>    "role": {<br>      "name": "fleet-role",<br>      "policy_name": "fleet-iam-policy"<br>    }<br>  },<br>  "iam_role_arn": null,<br>  "image": "fleetdm/fleet:v4.54.1",<br>  "loadbalancer": {<br>    "arn": null<br>  },<br>  "mem": 512,<br>  "mount_points": [],<br>  "networking": {<br>    "ingress_sources": {<br>      "cidr_blocks": [],<br>      "ipv6_cidr_blocks": [],<br>      "prefix_list_ids": [],<br>      "security_groups": []<br>    },<br>    "security_groups": null,<br>    "subnets": null<br>  },<br>  "pid_mode": null,<br>  "private_key_secret_name": "fleet-server-private-key",<br>  "redis": {<br>    "address": null,<br>    "use_tls": true<br>  },<br>  "repository_credentials": "",<br>  "security_group_name": "fleet",<br>  "security_groups": null,<br>  "service": {<br>    "name": "fleet"<br>  },<br>  "sidecars": [],<br>  "software_installers": {<br>    "bucket_name": null,<br>    "bucket_prefix": "fleet-software-installers-",<br>    "create_bucket": true,<br>    "s3_object_prefix": ""<br>  },<br>  "task_cpu": null,<br>  "task_mem": null,<br>  "volumes": []<br>}</pre> | no |
 | <a name="input_migration_config"></a> [migration\_config](#input\_migration\_config) | The configuration object for Fleet's migration task. | <pre>object({<br>    mem = number<br>    cpu = number<br>  })</pre> | <pre>{<br>  "cpu": 1024,<br>  "mem": 2048<br>}</pre> | no |
-| <a name="input_rds_config"></a> [rds\_config](#input\_rds\_config) | The config for the terraform-aws-modules/rds-aurora/aws module | <pre>object({<br>    name                            = optional(string, "fleet")<br>    engine_version                  = optional(string, "8.0.mysql_aurora.3.04.2")<br>    instance_class                  = optional(string, "db.t4g.large")<br>    subnets                         = optional(list(string), [])<br>    allowed_security_groups         = optional(list(string), [])<br>    allowed_cidr_blocks             = optional(list(string), [])<br>    apply_immediately               = optional(bool, true)<br>    monitoring_interval             = optional(number, 10)<br>    db_parameter_group_name         = optional(string)<br>    db_parameters                   = optional(map(string), {})<br>    db_cluster_parameter_group_name = optional(string)<br>    db_cluster_parameters           = optional(map(string), {})<br>    enabled_cloudwatch_logs_exports = optional(list(string), [])<br>    master_username                 = optional(string, "fleet")<br>    snapshot_identifier             = optional(string)<br>    cluster_tags                    = optional(map(string), {})<br>    preferred_maintenance_window    = optional(string, "thu:23:00-fri:00:00")<br>  })</pre> | <pre>{<br>  "allowed_cidr_blocks": [],<br>  "allowed_security_groups": [],<br>  "apply_immediately": true,<br>  "cluster_tags": {},<br>  "db_cluster_parameter_group_name": null,<br>  "db_cluster_parameters": {},<br>  "db_parameter_group_name": null,<br>  "db_parameters": {},<br>  "enabled_cloudwatch_logs_exports": [],<br>  "engine_version": "8.0.mysql_aurora.3.04.2",<br>  "instance_class": "db.t4g.large",<br>  "master_username": "fleet",<br>  "monitoring_interval": 10,<br>  "name": "fleet",<br>  "preferred_maintenance_window": "thu:23:00-fri:00:00",<br>  "snapshot_identifier": null,<br>  "subnets": []<br>}</pre> | no |
+| <a name="input_rds_config"></a> [rds\_config](#input\_rds\_config) | The config for the terraform-aws-modules/rds-aurora/aws module | <pre>object({<br>    name                            = optional(string, "fleet")<br>    engine_version                  = optional(string, "8.0.mysql_aurora.3.07.1")<br>    instance_class                  = optional(string, "db.t4g.large")<br>    subnets                         = optional(list(string), [])<br>    allowed_security_groups         = optional(list(string), [])<br>    allowed_cidr_blocks             = optional(list(string), [])<br>    apply_immediately               = optional(bool, true)<br>    monitoring_interval             = optional(number, 10)<br>    db_parameter_group_name         = optional(string)<br>    db_parameters                   = optional(map(string), {})<br>    db_cluster_parameter_group_name = optional(string)<br>    db_cluster_parameters           = optional(map(string), {})<br>    enabled_cloudwatch_logs_exports = optional(list(string), [])<br>    master_username                 = optional(string, "fleet")<br>    snapshot_identifier             = optional(string)<br>    cluster_tags                    = optional(map(string), {})<br>    preferred_maintenance_window    = optional(string, "thu:23:00-fri:00:00")<br>  })</pre> | <pre>{<br>  "allowed_cidr_blocks": [],<br>  "allowed_security_groups": [],<br>  "apply_immediately": true,<br>  "cluster_tags": {},<br>  "db_cluster_parameter_group_name": null,<br>  "db_cluster_parameters": {},<br>  "db_parameter_group_name": null,<br>  "db_parameters": {},<br>  "enabled_cloudwatch_logs_exports": [],<br>  "engine_version": "8.0.mysql_aurora.3.07.1",<br>  "instance_class": "db.t4g.large",<br>  "master_username": "fleet",<br>  "monitoring_interval": 10,<br>  "name": "fleet",<br>  "preferred_maintenance_window": "thu:23:00-fri:00:00",<br>  "snapshot_identifier": null,<br>  "subnets": []<br>}</pre> | no |
 | <a name="input_redis_config"></a> [redis\_config](#input\_redis\_config) | n/a | <pre>object({<br>    name                          = optional(string, "fleet")<br>    replication_group_id          = optional(string)<br>    elasticache_subnet_group_name = optional(string, "")<br>    allowed_security_group_ids    = optional(list(string), [])<br>    subnets                       = list(string)<br>    allowed_cidrs                 = list(string)<br>    availability_zones            = optional(list(string), [])<br>    cluster_size                  = optional(number, 3)<br>    instance_type                 = optional(string, "cache.m5.large")<br>    apply_immediately             = optional(bool, true)<br>    automatic_failover_enabled    = optional(bool, false)<br>    engine_version                = optional(string, "6.x")<br>    family                        = optional(string, "redis6.x")<br>    at_rest_encryption_enabled    = optional(bool, true)<br>    transit_encryption_enabled    = optional(bool, true)<br>    parameter = optional(list(object({<br>      name  = string<br>      value = string<br>    })), [])<br>    log_delivery_configuration = optional(list(map(any)), [])<br>    tags                       = optional(map(string), {})<br>  })</pre> | <pre>{<br>  "allowed_cidrs": null,<br>  "allowed_security_group_ids": [],<br>  "apply_immediately": true,<br>  "at_rest_encryption_enabled": true,<br>  "automatic_failover_enabled": false,<br>  "availability_zones": [],<br>  "cluster_size": 3,<br>  "elasticache_subnet_group_name": "",<br>  "engine_version": "6.x",<br>  "family": "redis6.x",<br>  "instance_type": "cache.m5.large",<br>  "log_delivery_configuration": [],<br>  "name": "fleet",<br>  "parameter": [],<br>  "replication_group_id": null,<br>  "subnets": null,<br>  "tags": {},<br>  "transit_encryption_enabled": true<br>}</pre> | no |
 | <a name="input_vpc_config"></a> [vpc\_config](#input\_vpc\_config) | n/a | <pre>object({<br>    vpc_id = string<br>    networking = object({<br>      subnets = list(string)<br>    })<br>  })</pre> | n/a | yes |
 
diff --git a/terraform/byo-vpc/byo-db/README.md b/terraform/byo-vpc/byo-db/README.md
index 43a4e8a5a455..60d144448934 100644
--- a/terraform/byo-vpc/byo-db/README.md
+++ b/terraform/byo-vpc/byo-db/README.md
@@ -28,7 +28,7 @@ No requirements.
 |------|-------------|------|---------|:--------:|
 | <a name="input_alb_config"></a> [alb\_config](#input\_alb\_config) | n/a | <pre>object({<br>    name                 = optional(string, "fleet")<br>    subnets              = list(string)<br>    security_groups      = optional(list(string), [])<br>    access_logs          = optional(map(string), {})<br>    certificate_arn      = string<br>    allowed_cidrs        = optional(list(string), ["0.0.0.0/0"])<br>    allowed_ipv6_cidrs   = optional(list(string), ["::/0"])<br>    egress_cidrs         = optional(list(string), ["0.0.0.0/0"])<br>    egress_ipv6_cidrs    = optional(list(string), ["::/0"])<br>    extra_target_groups  = optional(any, [])<br>    https_listener_rules = optional(any, [])<br>    tls_policy           = optional(string, "ELBSecurityPolicy-TLS-1-2-2017-01")<br>    idle_timeout         = optional(number, 60)<br>  })</pre> | n/a | yes |
 | <a name="input_ecs_cluster"></a> [ecs\_cluster](#input\_ecs\_cluster) | The config for the terraform-aws-modules/ecs/aws module | <pre>object({<br>    autoscaling_capacity_providers = optional(any, {})<br>    cluster_configuration = optional(any, {<br>      execute_command_configuration = {<br>        logging = "OVERRIDE"<br>        log_configuration = {<br>          cloud_watch_log_group_name = "/aws/ecs/aws-ec2"<br>        }<br>      }<br>    })<br>    cluster_name = optional(string, "fleet")<br>    cluster_settings = optional(map(string), {<br>      "name" : "containerInsights",<br>      "value" : "enabled",<br>    })<br>    create                                = optional(bool, true)<br>    default_capacity_provider_use_fargate = optional(bool, true)<br>    fargate_capacity_providers = optional(any, {<br>      FARGATE = {<br>        default_capacity_provider_strategy = {<br>          weight = 100<br>        }<br>      }<br>      FARGATE_SPOT = {<br>        default_capacity_provider_strategy = {<br>          weight = 0<br>        }<br>      }<br>    })<br>    tags = optional(map(string))<br>  })</pre> | <pre>{<br>  "autoscaling_capacity_providers": {},<br>  "cluster_configuration": {<br>    "execute_command_configuration": {<br>      "log_configuration": {<br>        "cloud_watch_log_group_name": "/aws/ecs/aws-ec2"<br>      },<br>      "logging": "OVERRIDE"<br>    }<br>  },<br>  "cluster_name": "fleet",<br>  "cluster_settings": {<br>    "name": "containerInsights",<br>    "value": "enabled"<br>  },<br>  "create": true,<br>  "default_capacity_provider_use_fargate": true,<br>  "fargate_capacity_providers": {<br>    "FARGATE": {<br>      "default_capacity_provider_strategy": {<br>        "weight": 100<br>      }<br>    },<br>    "FARGATE_SPOT": {<br>      "default_capacity_provider_strategy": {<br>        "weight": 0<br>      }<br>    }<br>  },<br>  "tags": {}<br>}</pre> | no |
-| <a name="input_fleet_config"></a> [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | <pre>object({<br>    task_mem                     = optional(number, null)<br>    task_cpu                     = optional(number, null)<br>    mem                          = optional(number, 4096)<br>    cpu                          = optional(number, 512)<br>    pid_mode                     = optional(string, null)<br>    image                        = optional(string, "fleetdm/fleet:v4.53.1")<br>    family                       = optional(string, "fleet")<br>    sidecars                     = optional(list(any), [])<br>    depends_on                   = optional(list(any), [])<br>    mount_points                 = optional(list(any), [])<br>    volumes                      = optional(list(any), [])<br>    extra_environment_variables  = optional(map(string), {})<br>    extra_iam_policies           = optional(list(string), [])<br>    extra_execution_iam_policies = optional(list(string), [])<br>    extra_secrets                = optional(map(string), {})<br>    security_groups              = optional(list(string), null)<br>    security_group_name          = optional(string, "fleet")<br>    iam_role_arn                 = optional(string, null)<br>    repository_credentials       = optional(string, "")<br>    private_key_secret_name      = optional(string, "fleet-server-private-key")<br>    service = optional(object({<br>      name = optional(string, "fleet")<br>      }), {<br>      name = "fleet"<br>    })<br>    database = optional(object({<br>      password_secret_arn = string<br>      user                = string<br>      database            = string<br>      address             = string<br>      rr_address          = optional(string, null)<br>      }), {<br>      password_secret_arn = null<br>      user                = null<br>      database            = null<br>      address             = null<br>      rr_address          = null<br>    })<br>    redis = optional(object({<br>      address = string<br>      use_tls = optional(bool, true)<br>      }), {<br>      address = null<br>      use_tls = true<br>    })<br>    awslogs = optional(object({<br>      name      = optional(string, null)<br>      region    = optional(string, null)<br>      create    = optional(bool, true)<br>      prefix    = optional(string, "fleet")<br>      retention = optional(number, 5)<br>      }), {<br>      name      = null<br>      region    = null<br>      prefix    = "fleet"<br>      retention = 5<br>    })<br>    loadbalancer = optional(object({<br>      arn = string<br>      }), {<br>      arn = null<br>    })<br>    extra_load_balancers = optional(list(any), [])<br>    networking = optional(object({<br>      subnets         = optional(list(string), null)<br>      security_groups = optional(list(string), null)<br>      ingress_sources = optional(object({<br>        cidr_blocks      = optional(list(string), [])<br>        ipv6_cidr_blocks = optional(list(string), [])<br>        security_groups  = optional(list(string), [])<br>        prefix_list_ids  = optional(list(string), [])<br>        }), {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      })<br>      }), {<br>      subnets         = null<br>      security_groups = null<br>      ingress_sources = {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      }<br>    })<br>    autoscaling = optional(object({<br>      max_capacity                 = optional(number, 5)<br>      min_capacity                 = optional(number, 1)<br>      memory_tracking_target_value = optional(number, 80)<br>      cpu_tracking_target_value    = optional(number, 80)<br>      }), {<br>      max_capacity                 = 5<br>      min_capacity                 = 1<br>      memory_tracking_target_value = 80<br>      cpu_tracking_target_value    = 80<br>    })<br>    iam = optional(object({<br>      role = optional(object({<br>        name        = optional(string, "fleet-role")<br>        policy_name = optional(string, "fleet-iam-policy")<br>        }), {<br>        name        = "fleet-role"<br>        policy_name = "fleet-iam-policy"<br>      })<br>      execution = optional(object({<br>        name        = optional(string, "fleet-execution-role")<br>        policy_name = optional(string, "fleet-execution-role")<br>        }), {<br>        name        = "fleet-execution-role"<br>        policy_name = "fleet-iam-policy-execution"<br>      })<br>      }), {<br>      name = "fleetdm-execution-role"<br>    })<br>    software_installers = optional(object({<br>      create_bucket    = optional(bool, true)<br>      bucket_name      = optional(string, null)<br>      bucket_prefix    = optional(string, "fleet-software-installers-")<br>      s3_object_prefix = optional(string, "")<br>      }), {<br>      create_bucket    = true<br>      bucket_name      = null<br>      bucket_prefix    = "fleet-software-installers-"<br>      s3_object_prefix = ""<br>    })<br>  })</pre> | <pre>{<br>  "autoscaling": {<br>    "cpu_tracking_target_value": 80,<br>    "max_capacity": 5,<br>    "memory_tracking_target_value": 80,<br>    "min_capacity": 1<br>  },<br>  "awslogs": {<br>    "create": true,<br>    "name": null,<br>    "prefix": "fleet",<br>    "region": null,<br>    "retention": 5<br>  },<br>  "cpu": 256,<br>  "database": {<br>    "address": null,<br>    "database": null,<br>    "password_secret_arn": null,<br>    "rr_address": null,<br>    "user": null<br>  },<br>  "depends_on": [],<br>  "extra_environment_variables": {},<br>  "extra_execution_iam_policies": [],<br>  "extra_iam_policies": [],<br>  "extra_load_balancers": [],<br>  "extra_secrets": {},<br>  "family": "fleet",<br>  "iam": {<br>    "execution": {<br>      "name": "fleet-execution-role",<br>      "policy_name": "fleet-iam-policy-execution"<br>    },<br>    "role": {<br>      "name": "fleet-role",<br>      "policy_name": "fleet-iam-policy"<br>    }<br>  },<br>  "iam_role_arn": null,<br>  "image": "fleetdm/fleet:v4.53.1",<br>  "loadbalancer": {<br>    "arn": null<br>  },<br>  "mem": 512,<br>  "mount_points": [],<br>  "networking": {<br>    "ingress_sources": {<br>      "cidr_blocks": [],<br>      "ipv6_cidr_blocks": [],<br>      "prefix_list_ids": [],<br>      "security_groups": []<br>    },<br>    "security_groups": null,<br>    "subnets": null<br>  },<br>  "pid_mode": null,<br>  "private_key_secret_name": "fleet-server-private-key",<br>  "redis": {<br>    "address": null,<br>    "use_tls": true<br>  },<br>  "repository_credentials": "",<br>  "security_group_name": "fleet",<br>  "security_groups": null,<br>  "service": {<br>    "name": "fleet"<br>  },<br>  "sidecars": [],<br>  "software_installers": {<br>    "bucket_name": null,<br>    "bucket_prefix": "fleet-software-installers-",<br>    "create_bucket": true,<br>    "s3_object_prefix": ""<br>  },<br>  "task_cpu": null,<br>  "task_mem": null,<br>  "volumes": []<br>}</pre> | no |
+| <a name="input_fleet_config"></a> [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | <pre>object({<br>    task_mem                     = optional(number, null)<br>    task_cpu                     = optional(number, null)<br>    mem                          = optional(number, 4096)<br>    cpu                          = optional(number, 512)<br>    pid_mode                     = optional(string, null)<br>    image                        = optional(string, "fleetdm/fleet:v4.54.1")<br>    family                       = optional(string, "fleet")<br>    sidecars                     = optional(list(any), [])<br>    depends_on                   = optional(list(any), [])<br>    mount_points                 = optional(list(any), [])<br>    volumes                      = optional(list(any), [])<br>    extra_environment_variables  = optional(map(string), {})<br>    extra_iam_policies           = optional(list(string), [])<br>    extra_execution_iam_policies = optional(list(string), [])<br>    extra_secrets                = optional(map(string), {})<br>    security_group_name          = optional(string, "fleet")<br>    iam_role_arn                 = optional(string, null)<br>    repository_credentials       = optional(string, "")<br>    private_key_secret_name      = optional(string, "fleet-server-private-key")<br>    service = optional(object({<br>      name = optional(string, "fleet")<br>      }), {<br>      name = "fleet"<br>    })<br>    database = optional(object({<br>      password_secret_arn = string<br>      user                = string<br>      database            = string<br>      address             = string<br>      rr_address          = optional(string, null)<br>      }), {<br>      password_secret_arn = null<br>      user                = null<br>      database            = null<br>      address             = null<br>      rr_address          = null<br>    })<br>    redis = optional(object({<br>      address = string<br>      use_tls = optional(bool, true)<br>      }), {<br>      address = null<br>      use_tls = true<br>    })<br>    awslogs = optional(object({<br>      name      = optional(string, null)<br>      region    = optional(string, null)<br>      create    = optional(bool, true)<br>      prefix    = optional(string, "fleet")<br>      retention = optional(number, 5)<br>      }), {<br>      name      = null<br>      region    = null<br>      prefix    = "fleet"<br>      retention = 5<br>    })<br>    loadbalancer = optional(object({<br>      arn = string<br>      }), {<br>      arn = null<br>    })<br>    extra_load_balancers = optional(list(any), [])<br>    networking = optional(object({<br>      subnets         = optional(list(string), null)<br>      security_groups = optional(list(string), null)<br>      ingress_sources = optional(object({<br>        cidr_blocks      = optional(list(string), [])<br>        ipv6_cidr_blocks = optional(list(string), [])<br>        security_groups  = optional(list(string), [])<br>        prefix_list_ids  = optional(list(string), [])<br>        }), {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      })<br>      }), {<br>      subnets         = null<br>      security_groups = null<br>      ingress_sources = {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      }<br>    })<br>    autoscaling = optional(object({<br>      max_capacity                 = optional(number, 5)<br>      min_capacity                 = optional(number, 1)<br>      memory_tracking_target_value = optional(number, 80)<br>      cpu_tracking_target_value    = optional(number, 80)<br>      }), {<br>      max_capacity                 = 5<br>      min_capacity                 = 1<br>      memory_tracking_target_value = 80<br>      cpu_tracking_target_value    = 80<br>    })<br>    iam = optional(object({<br>      role = optional(object({<br>        name        = optional(string, "fleet-role")<br>        policy_name = optional(string, "fleet-iam-policy")<br>        }), {<br>        name        = "fleet-role"<br>        policy_name = "fleet-iam-policy"<br>      })<br>      execution = optional(object({<br>        name        = optional(string, "fleet-execution-role")<br>        policy_name = optional(string, "fleet-execution-role")<br>        }), {<br>        name        = "fleet-execution-role"<br>        policy_name = "fleet-iam-policy-execution"<br>      })<br>      }), {<br>      name = "fleetdm-execution-role"<br>    })<br>    software_installers = optional(object({<br>      create_bucket    = optional(bool, true)<br>      bucket_name      = optional(string, null)<br>      bucket_prefix    = optional(string, "fleet-software-installers-")<br>      s3_object_prefix = optional(string, "")<br>      }), {<br>      create_bucket    = true<br>      bucket_name      = null<br>      bucket_prefix    = "fleet-software-installers-"<br>      s3_object_prefix = ""<br>    })<br>  })</pre> | <pre>{<br>  "autoscaling": {<br>    "cpu_tracking_target_value": 80,<br>    "max_capacity": 5,<br>    "memory_tracking_target_value": 80,<br>    "min_capacity": 1<br>  },<br>  "awslogs": {<br>    "create": true,<br>    "name": null,<br>    "prefix": "fleet",<br>    "region": null,<br>    "retention": 5<br>  },<br>  "cpu": 256,<br>  "database": {<br>    "address": null,<br>    "database": null,<br>    "password_secret_arn": null,<br>    "rr_address": null,<br>    "user": null<br>  },<br>  "depends_on": [],<br>  "extra_environment_variables": {},<br>  "extra_execution_iam_policies": [],<br>  "extra_iam_policies": [],<br>  "extra_load_balancers": [],<br>  "extra_secrets": {},<br>  "family": "fleet",<br>  "iam": {<br>    "execution": {<br>      "name": "fleet-execution-role",<br>      "policy_name": "fleet-iam-policy-execution"<br>    },<br>    "role": {<br>      "name": "fleet-role",<br>      "policy_name": "fleet-iam-policy"<br>    }<br>  },<br>  "iam_role_arn": null,<br>  "image": "fleetdm/fleet:v4.54.1",<br>  "loadbalancer": {<br>    "arn": null<br>  },<br>  "mem": 512,<br>  "mount_points": [],<br>  "networking": {<br>    "ingress_sources": {<br>      "cidr_blocks": [],<br>      "ipv6_cidr_blocks": [],<br>      "prefix_list_ids": [],<br>      "security_groups": []<br>    },<br>    "security_groups": null,<br>    "subnets": null<br>  },<br>  "pid_mode": null,<br>  "private_key_secret_name": "fleet-server-private-key",<br>  "redis": {<br>    "address": null,<br>    "use_tls": true<br>  },<br>  "repository_credentials": "",<br>  "security_group_name": "fleet",<br>  "security_groups": null,<br>  "service": {<br>    "name": "fleet"<br>  },<br>  "sidecars": [],<br>  "software_installers": {<br>    "bucket_name": null,<br>    "bucket_prefix": "fleet-software-installers-",<br>    "create_bucket": true,<br>    "s3_object_prefix": ""<br>  },<br>  "task_cpu": null,<br>  "task_mem": null,<br>  "volumes": []<br>}</pre> | no |
 | <a name="input_migration_config"></a> [migration\_config](#input\_migration\_config) | The configuration object for Fleet's migration task. | <pre>object({<br>    mem = number<br>    cpu = number<br>  })</pre> | <pre>{<br>  "cpu": 1024,<br>  "mem": 2048<br>}</pre> | no |
 | <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | n/a | `string` | n/a | yes |
 
diff --git a/terraform/byo-vpc/byo-db/byo-ecs/README.md b/terraform/byo-vpc/byo-db/byo-ecs/README.md
index 5b0fc8b86c8b..fc701fb07c9f 100644
--- a/terraform/byo-vpc/byo-db/byo-ecs/README.md
+++ b/terraform/byo-vpc/byo-db/byo-ecs/README.md
@@ -52,7 +52,7 @@ No modules.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_ecs_cluster"></a> [ecs\_cluster](#input\_ecs\_cluster) | The name of the ECS cluster to use | `string` | n/a | yes |
-| <a name="input_fleet_config"></a> [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | <pre>object({<br>    task_mem                     = optional(number, null)<br>    task_cpu                     = optional(number, null)<br>    mem                          = optional(number, 4096)<br>    cpu                          = optional(number, 512)<br>    pid_mode                     = optional(string, null)<br>    image                        = optional(string, "fleetdm/fleet:v4.53.1")<br>    family                       = optional(string, "fleet")<br>    sidecars                     = optional(list(any), [])<br>    depends_on                   = optional(list(any), [])<br>    mount_points                 = optional(list(any), [])<br>    volumes                      = optional(list(any), [])<br>    extra_environment_variables  = optional(map(string), {})<br>    extra_iam_policies           = optional(list(string), [])<br>    extra_execution_iam_policies = optional(list(string), [])<br>    extra_secrets                = optional(map(string), {})<br>    security_groups              = optional(list(string), null)<br>    security_group_name          = optional(string, "fleet")<br>    iam_role_arn                 = optional(string, null)<br>    repository_credentials       = optional(string, "")<br>    private_key_secret_name      = optional(string, "fleet-server-private-key")<br>    service = optional(object({<br>      name = optional(string, "fleet")<br>      }), {<br>      name = "fleet"<br>    })<br>    database = object({<br>      password_secret_arn = string<br>      user                = string<br>      database            = string<br>      address             = string<br>      rr_address          = optional(string, null)<br>    })<br>    redis = object({<br>      address = string<br>      use_tls = optional(bool, true)<br>    })<br>    awslogs = optional(object({<br>      name      = optional(string, null)<br>      region    = optional(string, null)<br>      create    = optional(bool, true)<br>      prefix    = optional(string, "fleet")<br>      retention = optional(number, 5)<br>      }), {<br>      name      = null<br>      region    = null<br>      prefix    = "fleet"<br>      retention = 5<br>    })<br>    loadbalancer = object({<br>      arn = string<br>    })<br>    extra_load_balancers = optional(list(any), [])<br>    networking = object({<br>      subnets         = optional(list(string), null)<br>      security_groups = optional(list(string), null)<br>      ingress_sources = object({<br>        cidr_blocks      = optional(list(string), [])<br>        ipv6_cidr_blocks = optional(list(string), [])<br>        security_groups  = optional(list(string), [])<br>        prefix_list_ids  = optional(list(string), [])<br>      })<br>    })<br>    autoscaling = optional(object({<br>      max_capacity                 = optional(number, 5)<br>      min_capacity                 = optional(number, 1)<br>      memory_tracking_target_value = optional(number, 80)<br>      cpu_tracking_target_value    = optional(number, 80)<br>      }), {<br>      max_capacity                 = 5<br>      min_capacity                 = 1<br>      memory_tracking_target_value = 80<br>      cpu_tracking_target_value    = 80<br>    })<br>    iam = optional(object({<br>      role = optional(object({<br>        name        = optional(string, "fleet-role")<br>        policy_name = optional(string, "fleet-iam-policy")<br>        }), {<br>        name        = "fleet-role"<br>        policy_name = "fleet-iam-policy"<br>      })<br>      execution = optional(object({<br>        name        = optional(string, "fleet-execution-role")<br>        policy_name = optional(string, "fleet-execution-role")<br>        }), {<br>        name        = "fleet-execution-role"<br>        policy_name = "fleet-iam-policy-execution"<br>      })<br>      }), {<br>      name = "fleetdm-execution-role"<br>    })<br>    software_installers = optional(object({<br>      create_bucket    = optional(bool, true)<br>      bucket_name      = optional(string, null)<br>      bucket_prefix    = optional(string, "fleet-software-installers-")<br>      s3_object_prefix = optional(string, "")<br>      }), {<br>      create_bucket    = true<br>      bucket_name      = null<br>      bucket_prefix    = "fleet-software-installers-"<br>      s3_object_prefix = ""<br>    })<br>  })</pre> | <pre>{<br>  "autoscaling": {<br>    "cpu_tracking_target_value": 80,<br>    "max_capacity": 5,<br>    "memory_tracking_target_value": 80,<br>    "min_capacity": 1<br>  },<br>  "awslogs": {<br>    "create": true,<br>    "name": null,<br>    "prefix": "fleet",<br>    "region": null,<br>    "retention": 5<br>  },<br>  "cpu": 256,<br>  "database": {<br>    "address": null,<br>    "database": null,<br>    "password_secret_arn": null,<br>    "rr_address": null,<br>    "user": null<br>  },<br>  "depends_on": [],<br>  "extra_environment_variables": {},<br>  "extra_execution_iam_policies": [],<br>  "extra_iam_policies": [],<br>  "extra_load_balacners": [],<br>  "extra_secrets": {},<br>  "family": "fleet",<br>  "iam": {<br>    "execution": {<br>      "name": "fleet-execution-role",<br>      "policy_name": "fleet-iam-policy-execution"<br>    },<br>    "role": {<br>      "name": "fleet-role",<br>      "policy_name": "fleet-iam-policy"<br>    }<br>  },<br>  "iam_role_arn": null,<br>  "image": "fleetdm/fleet:v4.53.1",<br>  "loadbalancer": {<br>    "arn": null<br>  },<br>  "mem": 512,<br>  "mount_points": [],<br>  "networking": {<br>    "ingress_sources": {<br>      "cidr_blocks": [],<br>      "ipv6_cidr_blocks": [],<br>      "prefix_list_ids": [],<br>      "security_groups": []<br>    },<br>    "security_groups": null,<br>    "subnets": null<br>  },<br>  "pid_mode": null,<br>  "private_key_secret_name": "fleet-server-private-key",<br>  "redis": {<br>    "address": null,<br>    "use_tls": true<br>  },<br>  "repository_credentials": "",<br>  "security_group_name": "fleet",<br>  "security_groups": null,<br>  "service": {<br>    "name": "fleet"<br>  },<br>  "sidecars": [],<br>  "software_installers": {<br>    "bucket_name": null,<br>    "bucket_prefix": "fleet-software-installers-",<br>    "create_bucket": true,<br>    "s3_object_prefix": ""<br>  },<br>  "task_cpu": null,<br>  "task_mem": null,<br>  "volumes": []<br>}</pre> | no |
+| <a name="input_fleet_config"></a> [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | <pre>object({<br>    task_mem                     = optional(number, null)<br>    task_cpu                     = optional(number, null)<br>    mem                          = optional(number, 4096)<br>    cpu                          = optional(number, 512)<br>    pid_mode                     = optional(string, null)<br>    image                        = optional(string, "fleetdm/fleet:v4.54.1")<br>    family                       = optional(string, "fleet")<br>    sidecars                     = optional(list(any), [])<br>    depends_on                   = optional(list(any), [])<br>    mount_points                 = optional(list(any), [])<br>    volumes                      = optional(list(any), [])<br>    extra_environment_variables  = optional(map(string), {})<br>    extra_iam_policies           = optional(list(string), [])<br>    extra_execution_iam_policies = optional(list(string), [])<br>    extra_secrets                = optional(map(string), {})<br>    security_group_name          = optional(string, "fleet")<br>    iam_role_arn                 = optional(string, null)<br>    repository_credentials       = optional(string, "")<br>    private_key_secret_name      = optional(string, "fleet-server-private-key")<br>    service = optional(object({<br>      name = optional(string, "fleet")<br>      }), {<br>      name = "fleet"<br>    })<br>    database = object({<br>      password_secret_arn = string<br>      user                = string<br>      database            = string<br>      address             = string<br>      rr_address          = optional(string, null)<br>    })<br>    redis = object({<br>      address = string<br>      use_tls = optional(bool, true)<br>    })<br>    awslogs = optional(object({<br>      name      = optional(string, null)<br>      region    = optional(string, null)<br>      create    = optional(bool, true)<br>      prefix    = optional(string, "fleet")<br>      retention = optional(number, 5)<br>      }), {<br>      name      = null<br>      region    = null<br>      prefix    = "fleet"<br>      retention = 5<br>    })<br>    loadbalancer = object({<br>      arn = string<br>    })<br>    extra_load_balancers = optional(list(any), [])<br>    networking = object({<br>      subnets         = optional(list(string), null)<br>      security_groups = optional(list(string), null)<br>      ingress_sources = object({<br>        cidr_blocks      = optional(list(string), [])<br>        ipv6_cidr_blocks = optional(list(string), [])<br>        security_groups  = optional(list(string), [])<br>        prefix_list_ids  = optional(list(string), [])<br>      })<br>    })<br>    autoscaling = optional(object({<br>      max_capacity                 = optional(number, 5)<br>      min_capacity                 = optional(number, 1)<br>      memory_tracking_target_value = optional(number, 80)<br>      cpu_tracking_target_value    = optional(number, 80)<br>      }), {<br>      max_capacity                 = 5<br>      min_capacity                 = 1<br>      memory_tracking_target_value = 80<br>      cpu_tracking_target_value    = 80<br>    })<br>    iam = optional(object({<br>      role = optional(object({<br>        name        = optional(string, "fleet-role")<br>        policy_name = optional(string, "fleet-iam-policy")<br>        }), {<br>        name        = "fleet-role"<br>        policy_name = "fleet-iam-policy"<br>      })<br>      execution = optional(object({<br>        name        = optional(string, "fleet-execution-role")<br>        policy_name = optional(string, "fleet-execution-role")<br>        }), {<br>        name        = "fleet-execution-role"<br>        policy_name = "fleet-iam-policy-execution"<br>      })<br>      }), {<br>      name = "fleetdm-execution-role"<br>    })<br>    software_installers = optional(object({<br>      create_bucket    = optional(bool, true)<br>      bucket_name      = optional(string, null)<br>      bucket_prefix    = optional(string, "fleet-software-installers-")<br>      s3_object_prefix = optional(string, "")<br>      }), {<br>      create_bucket    = true<br>      bucket_name      = null<br>      bucket_prefix    = "fleet-software-installers-"<br>      s3_object_prefix = ""<br>    })<br>  })</pre> | <pre>{<br>  "autoscaling": {<br>    "cpu_tracking_target_value": 80,<br>    "max_capacity": 5,<br>    "memory_tracking_target_value": 80,<br>    "min_capacity": 1<br>  },<br>  "awslogs": {<br>    "create": true,<br>    "name": null,<br>    "prefix": "fleet",<br>    "region": null,<br>    "retention": 5<br>  },<br>  "cpu": 256,<br>  "database": {<br>    "address": null,<br>    "database": null,<br>    "password_secret_arn": null,<br>    "rr_address": null,<br>    "user": null<br>  },<br>  "depends_on": [],<br>  "extra_environment_variables": {},<br>  "extra_execution_iam_policies": [],<br>  "extra_iam_policies": [],<br>  "extra_load_balacners": [],<br>  "extra_secrets": {},<br>  "family": "fleet",<br>  "iam": {<br>    "execution": {<br>      "name": "fleet-execution-role",<br>      "policy_name": "fleet-iam-policy-execution"<br>    },<br>    "role": {<br>      "name": "fleet-role",<br>      "policy_name": "fleet-iam-policy"<br>    }<br>  },<br>  "iam_role_arn": null,<br>  "image": "fleetdm/fleet:v4.54.1",<br>  "loadbalancer": {<br>    "arn": null<br>  },<br>  "mem": 512,<br>  "mount_points": [],<br>  "networking": {<br>    "ingress_sources": {<br>      "cidr_blocks": [],<br>      "ipv6_cidr_blocks": [],<br>      "prefix_list_ids": [],<br>      "security_groups": []<br>    },<br>    "security_groups": null,<br>    "subnets": null<br>  },<br>  "pid_mode": null,<br>  "private_key_secret_name": "fleet-server-private-key",<br>  "redis": {<br>    "address": null,<br>    "use_tls": true<br>  },<br>  "repository_credentials": "",<br>  "security_group_name": "fleet",<br>  "security_groups": null,<br>  "service": {<br>    "name": "fleet"<br>  },<br>  "sidecars": [],<br>  "software_installers": {<br>    "bucket_name": null,<br>    "bucket_prefix": "fleet-software-installers-",<br>    "create_bucket": true,<br>    "s3_object_prefix": ""<br>  },<br>  "task_cpu": null,<br>  "task_mem": null,<br>  "volumes": []<br>}</pre> | no |
 | <a name="input_migration_config"></a> [migration\_config](#input\_migration\_config) | The configuration object for Fleet's migration task. | <pre>object({<br>    mem = number<br>    cpu = number<br>  })</pre> | <pre>{<br>  "cpu": 1024,<br>  "mem": 2048<br>}</pre> | no |
 | <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | n/a | `string` | `null` | no |
 
diff --git a/terraform/byo-vpc/byo-db/byo-ecs/main.tf b/terraform/byo-vpc/byo-db/byo-ecs/main.tf
index 3d2fb7191d93..ab56fe80fa12 100644
--- a/terraform/byo-vpc/byo-db/byo-ecs/main.tf
+++ b/terraform/byo-vpc/byo-db/byo-ecs/main.tf
@@ -232,7 +232,7 @@ resource "aws_cloudwatch_log_group" "main" { #tfsec:ignore:aws-cloudwatch-log-gr
 }
 
 resource "aws_security_group" "main" {
-  count       = var.fleet_config.security_groups == null ? 1 : 0
+  count       = var.fleet_config.networking.security_groups == null ? 1 : 0
   name        = var.fleet_config.security_group_name
   description = "Fleet ECS Service Security Group"
   vpc_id      = var.vpc_id
diff --git a/terraform/byo-vpc/byo-db/byo-ecs/variables.tf b/terraform/byo-vpc/byo-db/byo-ecs/variables.tf
index bbee55ce56e4..192ce6e85e6f 100644
--- a/terraform/byo-vpc/byo-db/byo-ecs/variables.tf
+++ b/terraform/byo-vpc/byo-db/byo-ecs/variables.tf
@@ -16,7 +16,7 @@ variable "fleet_config" {
     mem                          = optional(number, 4096)
     cpu                          = optional(number, 512)
     pid_mode                     = optional(string, null)
-    image                        = optional(string, "fleetdm/fleet:v4.53.1")
+    image                        = optional(string, "fleetdm/fleet:v4.54.1")
     family                       = optional(string, "fleet")
     sidecars                     = optional(list(any), [])
     depends_on                   = optional(list(any), [])
@@ -26,7 +26,6 @@ variable "fleet_config" {
     extra_iam_policies           = optional(list(string), [])
     extra_execution_iam_policies = optional(list(string), [])
     extra_secrets                = optional(map(string), {})
-    security_groups              = optional(list(string), null)
     security_group_name          = optional(string, "fleet")
     iam_role_arn                 = optional(string, null)
     repository_credentials       = optional(string, "")
@@ -120,7 +119,7 @@ variable "fleet_config" {
     mem                          = 512
     cpu                          = 256
     pid_mode                     = null
-    image                        = "fleetdm/fleet:v4.53.1"
+    image                        = "fleetdm/fleet:v4.54.1"
     family                       = "fleet"
     sidecars                     = []
     depends_on                   = []
@@ -130,7 +129,6 @@ variable "fleet_config" {
     extra_iam_policies           = []
     extra_execution_iam_policies = []
     extra_secrets                = {}
-    security_groups              = null
     security_group_name          = "fleet"
     iam_role_arn                 = null
     repository_credentials       = ""
diff --git a/terraform/byo-vpc/byo-db/variables.tf b/terraform/byo-vpc/byo-db/variables.tf
index bf19fa432888..3795ba3143b2 100644
--- a/terraform/byo-vpc/byo-db/variables.tf
+++ b/terraform/byo-vpc/byo-db/variables.tf
@@ -77,7 +77,7 @@ variable "fleet_config" {
     mem                          = optional(number, 4096)
     cpu                          = optional(number, 512)
     pid_mode                     = optional(string, null)
-    image                        = optional(string, "fleetdm/fleet:v4.53.1")
+    image                        = optional(string, "fleetdm/fleet:v4.54.1")
     family                       = optional(string, "fleet")
     sidecars                     = optional(list(any), [])
     depends_on                   = optional(list(any), [])
@@ -87,7 +87,6 @@ variable "fleet_config" {
     extra_iam_policies           = optional(list(string), [])
     extra_execution_iam_policies = optional(list(string), [])
     extra_secrets                = optional(map(string), {})
-    security_groups              = optional(list(string), null)
     security_group_name          = optional(string, "fleet")
     iam_role_arn                 = optional(string, null)
     repository_credentials       = optional(string, "")
@@ -206,7 +205,7 @@ variable "fleet_config" {
     mem                          = 512
     cpu                          = 256
     pid_mode                     = null
-    image                        = "fleetdm/fleet:v4.53.1"
+    image                        = "fleetdm/fleet:v4.54.1"
     family                       = "fleet"
     sidecars                     = []
     depends_on                   = []
diff --git a/terraform/byo-vpc/example/main.tf b/terraform/byo-vpc/example/main.tf
index ffe16ebf5765..4a34edd6f390 100644
--- a/terraform/byo-vpc/example/main.tf
+++ b/terraform/byo-vpc/example/main.tf
@@ -17,7 +17,7 @@ provider "aws" {
 }
 
 locals {
-  fleet_image = "fleetdm/fleet:v4.53.1"
+  fleet_image = "fleetdm/fleet:v4.54.1"
   domain_name = "example.com"
 }
 
diff --git a/terraform/byo-vpc/variables.tf b/terraform/byo-vpc/variables.tf
index 3b6c8ef42649..1c467222bb5d 100644
--- a/terraform/byo-vpc/variables.tf
+++ b/terraform/byo-vpc/variables.tf
@@ -10,7 +10,7 @@ variable "vpc_config" {
 variable "rds_config" {
   type = object({
     name                            = optional(string, "fleet")
-    engine_version                  = optional(string, "8.0.mysql_aurora.3.04.2")
+    engine_version                  = optional(string, "8.0.mysql_aurora.3.07.1")
     instance_class                  = optional(string, "db.t4g.large")
     subnets                         = optional(list(string), [])
     allowed_security_groups         = optional(list(string), [])
@@ -29,7 +29,7 @@ variable "rds_config" {
   })
   default = {
     name                            = "fleet"
-    engine_version                  = "8.0.mysql_aurora.3.04.2"
+    engine_version                  = "8.0.mysql_aurora.3.07.1"
     instance_class                  = "db.t4g.large"
     subnets                         = []
     allowed_security_groups         = []
@@ -170,7 +170,7 @@ variable "fleet_config" {
     mem                          = optional(number, 4096)
     cpu                          = optional(number, 512)
     pid_mode                     = optional(string, null)
-    image                        = optional(string, "fleetdm/fleet:v4.53.1")
+    image                        = optional(string, "fleetdm/fleet:v4.54.1")
     family                       = optional(string, "fleet")
     sidecars                     = optional(list(any), [])
     depends_on                   = optional(list(any), [])
@@ -180,7 +180,6 @@ variable "fleet_config" {
     extra_iam_policies           = optional(list(string), [])
     extra_execution_iam_policies = optional(list(string), [])
     extra_secrets                = optional(map(string), {})
-    security_groups              = optional(list(string), null)
     security_group_name          = optional(string, "fleet")
     iam_role_arn                 = optional(string, null)
     repository_credentials       = optional(string, "")
@@ -299,7 +298,7 @@ variable "fleet_config" {
     mem                          = 512
     cpu                          = 256
     pid_mode                     = null
-    image                        = "fleetdm/fleet:v4.53.1"
+    image                        = "fleetdm/fleet:v4.54.1"
     family                       = "fleet"
     sidecars                     = []
     depends_on                   = []
diff --git a/terraform/example/main.tf b/terraform/example/main.tf
index fe2cbb8d14ae..f7f06e4d19f2 100644
--- a/terraform/example/main.tf
+++ b/terraform/example/main.tf
@@ -50,7 +50,7 @@ locals {
 }
 
 module "fleet" {
-  source          = "github.com/fleetdm/fleet//terraform?ref=tf-mod-root-v1.10.0"
+  source          = "github.com/fleetdm/fleet//terraform?ref=tf-mod-root-v1.11.1"
   certificate_arn = module.acm.acm_certificate_arn
 
   vpc = {
@@ -63,8 +63,8 @@ module "fleet" {
 
   fleet_config = {
     # To avoid pull-rate limiting from dockerhub, consider using our quay.io mirror
-    # for the Fleet image. e.g. "quay.io/fleetdm/fleet:v4.53.1"
-    image = "fleetdm/fleet:v4.53.1" # override default to deploy the image you desire
+    # for the Fleet image. e.g. "quay.io/fleetdm/fleet:v4.54.1"
+    image = "fleetdm/fleet:v4.54.1" # override default to deploy the image you desire
     # See https://fleetdm.com/docs/deploy/reference-architectures#aws for appropriate scaling
     # memory and cpu.
     autoscaling = {
@@ -91,6 +91,8 @@ module "fleet" {
       # 8mb up from 262144 (256k) default
       sort_buffer_size = 8388608
     }
+    # Uncomment to specify the RDS engine version
+    # engine_version = "8.0.mysql_aurora.3.07.1"
   }
   redis_config = {
     # See https://fleetdm.com/docs/deploy/reference-architectures#aws for instance types.
diff --git a/terraform/variables.tf b/terraform/variables.tf
index b89b57377421..b81bc3265271 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -62,7 +62,7 @@ variable "certificate_arn" {
 variable "rds_config" {
   type = object({
     name                            = optional(string, "fleet")
-    engine_version                  = optional(string, "8.0.mysql_aurora.3.04.2")
+    engine_version                  = optional(string, "8.0.mysql_aurora.3.07.1")
     instance_class                  = optional(string, "db.t4g.large")
     subnets                         = optional(list(string), [])
     allowed_security_groups         = optional(list(string), [])
@@ -80,7 +80,7 @@ variable "rds_config" {
   })
   default = {
     name                            = "fleet"
-    engine_version                  = "8.0.mysql_aurora.3.04.2"
+    engine_version                  = "8.0.mysql_aurora.3.07.1"
     instance_class                  = "db.t4g.large"
     subnets                         = []
     allowed_security_groups         = []
@@ -218,7 +218,7 @@ variable "fleet_config" {
     mem                          = optional(number, 4096)
     cpu                          = optional(number, 512)
     pid_mode                     = optional(string, null)
-    image                        = optional(string, "fleetdm/fleet:v4.53.1")
+    image                        = optional(string, "fleetdm/fleet:v4.54.1")
     family                       = optional(string, "fleet")
     sidecars                     = optional(list(any), [])
     depends_on                   = optional(list(any), [])
@@ -228,7 +228,6 @@ variable "fleet_config" {
     extra_iam_policies           = optional(list(string), [])
     extra_execution_iam_policies = optional(list(string), [])
     extra_secrets                = optional(map(string), {})
-    security_groups              = optional(list(string), null)
     security_group_name          = optional(string, "fleet")
     iam_role_arn                 = optional(string, null)
     repository_credentials       = optional(string, "")
@@ -347,7 +346,7 @@ variable "fleet_config" {
     mem                          = 512
     cpu                          = 256
     pid_mode                     = null
-    image                        = "fleetdm/fleet:v4.53.1"
+    image                        = "fleetdm/fleet:v4.54.1"
     family                       = "fleet"
     sidecars                     = []
     depends_on                   = []
diff --git a/test/upgrade/docker-compose.yaml b/test/upgrade/docker-compose.yaml
index 6d8a33a1bc79..ac703c2108a6 100644
--- a/test/upgrade/docker-compose.yaml
+++ b/test/upgrade/docker-compose.yaml
@@ -1,7 +1,7 @@
 services:
   mysql:
     platform: ${FLEET_MYSQL_PLATFORM:-linux/x86_64}
-    image: mysql:5.7
+    image: mysql:8.0.36
     environment:
       MYSQL_ROOT_PASSWORD: toor
       MYSQL_DATABASE: fleet
diff --git a/test/upgrade/fleet_test.go b/test/upgrade/fleet_test.go
index f909604966b9..dc79d8d2429d 100644
--- a/test/upgrade/fleet_test.go
+++ b/test/upgrade/fleet_test.go
@@ -15,7 +15,7 @@ import (
 	"time"
 
 	"github.com/cenkalti/backoff"
-	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/client"
 	"github.com/fleetdm/fleet/v4/server/service"
@@ -197,7 +197,7 @@ func (f *Fleet) getPublicPort(serviceName string, privatePort uint16) (uint16, e
 
 	// get the random fleet host port assigned by docker
 	argsName := filters.Arg("name", containerName)
-	containers, err := f.dockerClient.ContainerList(context.TODO(), types.ContainerListOptions{Filters: filters.NewArgs(argsName), All: true})
+	containers, err := f.dockerClient.ContainerList(context.TODO(), container.ListOptions{Filters: filters.NewArgs(argsName), All: true})
 	if err != nil {
 		return 0, err
 	}
@@ -217,7 +217,7 @@ func (f *Fleet) waitFleet(slot string) error {
 
 	// get the random fleet host port assigned by docker
 	argsName := filters.Arg("name", containerName)
-	containers, err := f.dockerClient.ContainerList(context.TODO(), types.ContainerListOptions{Filters: filters.NewArgs(argsName), All: true})
+	containers, err := f.dockerClient.ContainerList(context.TODO(), container.ListOptions{Filters: filters.NewArgs(argsName), All: true})
 	if err != nil {
 		return err
 	}
diff --git a/tools/backup_db/backup.sh b/tools/backup_db/backup.sh
index eb9d179eecb4..03c7a29b42e4 100755
--- a/tools/backup_db/backup.sh
+++ b/tools/backup_db/backup.sh
@@ -1,4 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-docker run --rm --network fleet_default ${FLEET_MYSQL_IMAGE:-mysql:5.7} bash -c 'mysqldump -hmysql -uroot -ptoor --default-character-set=utf8mb4 fleet | gzip -' > backup.sql.gz
+docker run --rm --network fleet_default ${FLEET_MYSQL_IMAGE:-mysql:8.0.36} bash -c 'mysqldump -hmysql -uroot -ptoor --default-character-set=utf8mb4 fleet | gzip -' > backup.sql.gz
diff --git a/tools/backup_db/restore.sh b/tools/backup_db/restore.sh
index 127043078281..a95dafc67113 100755
--- a/tools/backup_db/restore.sh
+++ b/tools/backup_db/restore.sh
@@ -1,4 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-docker run --rm -i --network fleet_default ${FLEET_MYSQL_IMAGE:-mysql:5.7} bash -c 'gzip -dc - | mysql -hmysql -uroot -ptoor fleet' < backup.sql.gz
+docker run --rm -i --network fleet_default ${FLEET_MYSQL_IMAGE:-mysql:8.0.36} bash -c 'gzip -dc - | mysql -hmysql -uroot -ptoor fleet' < backup.sql.gz
diff --git a/tools/backup_db/restore_e2e_software_test.sh b/tools/backup_db/restore_e2e_software_test.sh
index 5ab60f4fe0a4..97af6ad1c1ef 100755
--- a/tools/backup_db/restore_e2e_software_test.sh
+++ b/tools/backup_db/restore_e2e_software_test.sh
@@ -1,5 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-docker run --rm -i --network fleet_default mysql:5.7 bash -c 'gzip -kdc - | mysql -hmysql_test -uroot -ptoor e2e'  < tools/testdata/e2e_software_test.sql.gz
-
+docker run --rm -i --network fleet_default mysql:8.0.36 bash -c 'gzip -kdc - | mysql -hmysql_test -uroot -ptoor e2e'  < tools/testdata/e2e_software_test.sql.gz
diff --git a/tools/bomutils-docker/Dockerfile b/tools/bomutils-docker/Dockerfile
index 2027428bec8d..39dbb9ea1676 100644
--- a/tools/bomutils-docker/Dockerfile
+++ b/tools/bomutils-docker/Dockerfile
@@ -1,13 +1,14 @@
-FROM debian:stable-slim@sha256:0f116858482fd8222b4f7e9b4cdc9a054051e67fbb8a57bc22651f0d56b45ad8 AS builder
+FROM debian:stable-slim@sha256:90128f59a7c6f6fdcb6493f587ea352d5c7507f52a6ddfba66fc56cd3d99dc2b AS builder
 
 RUN apt-get update
-RUN apt-get install -y build-essential autoconf libxml2-dev libssl-dev zlib1g-dev curl
+RUN apt-get install -y build-essential autoconf libxml2-dev libssl-dev zlib1g-dev curl git
 
-# Install bomutils
-RUN curl -L https://github.com/hogliux/bomutils/archive/0.2.tar.gz > bomutils.tar.gz && \
-    echo "fb1f4ae37045eaa034ddd921ef6e16fb961e95f0364e5d76c9867bc8b92eb8a4  bomutils.tar.gz" | sha256sum --check && \
-    tar -xzf bomutils.tar.gz
-RUN cd bomutils-0.2 && make && make install
+# Build bomutils
+RUN git clone -b master \
+    --depth=1 --no-tags --progress \
+    --no-recurse-submodules https://github.com/hogliux/bomutils.git && \
+    cd bomutils && git reset --hard c41ad8b67d82a0071245ce8a5069023d39a885b8 && \
+    make && make install
 
 # Install xar
 RUN curl -L https://github.com/mackyle/xar/archive/refs/tags/xar-1.6.1.tar.gz > xar.tar.gz && \
@@ -19,9 +20,9 @@ COPY patch.txt .
 RUN cd xar-xar-1.6.1/xar && patch < ../../patch.txt && autoconf && ./configure && make && make install
 
 
-FROM debian:stable-slim@sha256:0f116858482fd8222b4f7e9b4cdc9a054051e67fbb8a57bc22651f0d56b45ad8
+FROM debian:stable-slim@sha256:90128f59a7c6f6fdcb6493f587ea352d5c7507f52a6ddfba66fc56cd3d99dc2b
 
-RUN apt-get update && apt-get install -y --no-install-recommends libxml2  && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends libxml2 && rm -rf /var/lib/apt/lists/*
 COPY --from=builder /usr/bin /usr/bin/
 COPY --from=builder /usr/local/bin /usr/local/bin/
 COPY --from=builder /usr/local/lib /usr/local/lib/
diff --git a/tools/calendar/delete-events/delete-events.go b/tools/calendar/delete-events/delete-events.go
index 676da9d88f24..f3f1355548da 100644
--- a/tools/calendar/delete-events/delete-events.go
+++ b/tools/calendar/delete-events/delete-events.go
@@ -70,16 +70,20 @@ func main() {
 				log.Fatalf("Unable to create Calendar service: %v", err)
 			}
 			numberDeleted := 0
+			var maxResults int64 = 1000
+			pageToken := ""
+			now := time.Now()
 			for {
 				list, err := withRetry(
 					func() (any, error) {
 						return service.Events.List("primary").
 							EventTypes("default").
-							MaxResults(1000).
+							MaxResults(maxResults).
 							OrderBy("startTime").
 							SingleEvents(true).
 							ShowDeleted(false).
 							Q(eventTitle).
+							PageToken(pageToken).
 							Do()
 					},
 				)
@@ -89,7 +93,17 @@ func main() {
 				if len(list.(*calendar.Events).Items) == 0 {
 					break
 				}
+				foundNewEvents := false
 				for _, item := range list.(*calendar.Events).Items {
+					created, err := time.Parse(time.RFC3339, item.Created)
+					if err != nil {
+						log.Fatalf("Unable to parse event created time: %v", err)
+					}
+					if created.After(now) {
+						// Found events created after we started deleting events, so we should stop
+						foundNewEvents = true
+						continue // Skip this event but finish the loop to make sure we don't miss something
+					}
 					if item.Summary == eventTitle {
 						_, err := withRetry(
 							func() (any, error) {
@@ -105,6 +119,10 @@ func main() {
 						}
 					}
 				}
+				pageToken = list.(*calendar.Events).NextPageToken
+				if pageToken == "" || foundNewEvents {
+					break
+				}
 			}
 			log.Printf("DONE. Deleted %d events total for %s", numberDeleted, userEmail)
 		}(userEmail)
diff --git a/tools/calendar/get-events/get-events.go b/tools/calendar/get-events/get-events.go
new file mode 100644
index 000000000000..46ce64cd4a8a
--- /dev/null
+++ b/tools/calendar/get-events/get-events.go
@@ -0,0 +1,196 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+	"regexp"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	"golang.org/x/oauth2/google"
+	"golang.org/x/oauth2/jwt"
+	"google.golang.org/api/calendar/v3"
+	"google.golang.org/api/googleapi"
+	"google.golang.org/api/option"
+)
+
+// Get all events with eventTitle from the primary calendar of the specified users.
+// Example: go run delete-events.go --users john@example.com,jane@example.com
+
+var (
+	serviceEmail = os.Getenv("FLEET_TEST_GOOGLE_CALENDAR_SERVICE_EMAIL")
+	privateKey   = os.Getenv("FLEET_TEST_GOOGLE_CALENDAR_PRIVATE_KEY")
+)
+
+const (
+	eventTitle = "💻🚫 Scheduled maintenance"
+)
+
+var regexMachineName = regexp.MustCompile(`your work computer (because there was no remaining availability )?\((?P<machine>.*)\)\.`)
+
+func main() {
+	if serviceEmail == "" || privateKey == "" {
+		log.Fatal("FLEET_TEST_GOOGLE_CALENDAR_SERVICE_EMAIL and FLEET_TEST_GOOGLE_CALENDAR_PRIVATE_KEY must be set")
+	}
+	// Strip newlines from private key
+	privateKey = strings.Replace(privateKey, "\\n", "\n", -1)
+	userEmails := flag.String("users", "", "Comma-separated list of user emails to impersonate")
+	flag.Parse()
+	if *userEmails == "" {
+		log.Fatal("--users are required")
+	}
+	userEmailList := strings.Split(*userEmails, ",")
+	if len(userEmailList) == 0 {
+		log.Fatal("No user emails provided")
+	}
+
+	ctx := context.Background()
+
+	var wg sync.WaitGroup
+
+	type summary struct {
+		total       int
+		totalByDate map[string]int
+		duplicates  map[string]struct{}
+	}
+	summaryByUser := make(map[string]summary)
+
+	for _, userEmail := range userEmailList {
+		wg.Add(1)
+		go func(userEmail string) {
+			defer wg.Done()
+			conf := &jwt.Config{
+				Email: serviceEmail,
+				Scopes: []string{
+					"https://www.googleapis.com/auth/calendar.events", "https://www.googleapis.com/auth/calendar.settings.readonly",
+				},
+				PrivateKey: []byte(privateKey),
+				TokenURL:   google.JWTTokenURL,
+				Subject:    userEmail,
+			}
+			client := conf.Client(ctx)
+			// Create a new calendar service
+			service, err := calendar.NewService(ctx, option.WithHTTPClient(client))
+			if err != nil {
+				log.Fatalf("Unable to create Calendar service: %v", err)
+			}
+			var maxResults int64 = 1000
+			pageToken := ""
+			var total = 0
+			var totalByDate = make(map[string]int)
+			var machines = make(map[string]struct{})
+			var duplicates = make(map[string]struct{})
+			for {
+				list, err := withRetry(
+					func() (any, error) {
+						return service.Events.List("primary").
+							EventTypes("default").
+							MaxResults(maxResults).
+							OrderBy("startTime").
+							SingleEvents(true).
+							ShowDeleted(false).
+							Q(eventTitle).
+							PageToken(pageToken).
+							Do()
+					},
+				)
+				if err != nil {
+					log.Fatalf("Unable to retrieve list of events: %v", err)
+				}
+				for _, item := range list.(*calendar.Events).Items {
+					if item.Summary == eventTitle {
+						created, err := time.Parse(time.RFC3339, item.Created)
+						if err != nil {
+							log.Fatalf("Unable to parse event created time: %v", err)
+						}
+						var startTime time.Time
+						if item.Start != nil {
+							startTime, err = time.Parse(time.RFC3339, item.Start.DateTime)
+							if err != nil {
+								log.Fatalf("Unable to parse event start time: %v", err)
+							}
+						}
+						matches := regexMachineName.FindStringSubmatch(item.Description)
+						machineName := "NOT_FOUND"
+						if matches != nil {
+							machineName = matches[regexMachineName.SubexpIndex("machine")]
+							if _, ok := machines[machineName]; ok {
+								duplicates[machineName] = struct{}{}
+							}
+							machines[machineName] = struct{}{}
+						}
+						total += 1
+						dateStr := startTime.Format("2006-01-02")
+						totalByDate[dateStr] += 1
+						fmt.Printf("%s created_at:%s user:%s machine:%s\n", startTime.Format(time.RFC3339), created.Format(time.RFC3339),
+							userEmail, machineName)
+					}
+				}
+				pageToken = list.(*calendar.Events).NextPageToken
+				if pageToken == "" || len(list.(*calendar.Events).Items) == 0 {
+					summaryByUser[userEmail] = summary{total: total, totalByDate: totalByDate, duplicates: duplicates}
+					break
+				}
+			}
+		}(userEmail)
+	}
+
+	// Wait for all goroutines to finish
+	wg.Wait()
+
+	fmt.Printf("Summary:\n")
+	for userEmail, s := range summaryByUser {
+		fmt.Printf("User: %s, Total: %d\n", userEmail, s.total)
+		for date, count := range s.totalByDate {
+			fmt.Printf("User: %s, Date: %s, Count: %d\n", userEmail, date, count)
+		}
+		if len(s.duplicates) > 0 {
+			dups := make([]string, 0, len(s.duplicates))
+			for k := range s.duplicates {
+				dups = append(dups, k)
+			}
+			fmt.Printf("User: %s, Machines with multiple events: %v\n", userEmail, dups)
+		}
+	}
+
+}
+
+func withRetry(fn func() (any, error)) (any, error) {
+	retryStrategy := backoff.NewExponentialBackOff()
+	retryStrategy.MaxElapsedTime = 60 * time.Minute
+	var result any
+	err := backoff.Retry(
+		func() error {
+			var err error
+			result, err = fn()
+			if err != nil {
+				if isRateLimited(err) {
+					return err
+				}
+				return backoff.Permanent(err)
+			}
+			return nil
+		}, retryStrategy,
+	)
+	return result, err
+}
+
+func isRateLimited(err error) bool {
+	if err == nil {
+		return false
+	}
+	var ae *googleapi.Error
+	ok := errors.As(err, &ae)
+	return ok && (ae.Code == http.StatusTooManyRequests ||
+		(ae.Code == http.StatusForbidden &&
+			(ae.Message == "Rate Limit Exceeded" || ae.Message == "User Rate Limit Exceeded" || ae.Message == "Calendar usage limits exceeded." || strings.HasPrefix(
+				ae.Message, "Quota exceeded",
+			))))
+}
diff --git a/tools/calendar/move-events/move-events.go b/tools/calendar/move-events/move-events.go
index 3e22032c99a7..616418b19696 100644
--- a/tools/calendar/move-events/move-events.go
+++ b/tools/calendar/move-events/move-events.go
@@ -81,16 +81,20 @@ func main() {
 			}
 
 			numberMoved := 0
+			var maxResults int64 = 1000
+			pageToken := ""
+			now := time.Now()
 			for {
 				list, err := withRetry(
 					func() (any, error) {
 						return service.Events.List("primary").EventTypes("default").
-							MaxResults(1000).
+							MaxResults(maxResults).
 							OrderBy("startTime").
 							SingleEvents(true).
 							ShowDeleted(false).
 							TimeMin(dateTimeEndStr).
 							Q(eventTitle).
+							PageToken(pageToken).
 							Do()
 					},
 				)
@@ -101,7 +105,17 @@ func main() {
 				if len(list.(*calendar.Events).Items) == 0 {
 					break
 				}
+				foundNewEvents := false
 				for _, item := range list.(*calendar.Events).Items {
+					created, err := time.Parse(time.RFC3339, item.Created)
+					if err != nil {
+						log.Fatalf("Unable to parse event created time: %v", err)
+					}
+					if created.After(now) {
+						// Found events created after we started moving events, so we should stop
+						foundNewEvents = true
+						continue // Skip this event but finish the loop to make sure we don't miss something
+					}
 					if item.Summary == eventTitle {
 						item.Start.DateTime = dateTime.Format(time.RFC3339)
 						item.End.DateTime = dateTime.Add(30 * time.Minute).Format(time.RFC3339)
@@ -120,6 +134,10 @@ func main() {
 
 					}
 				}
+				pageToken = list.(*calendar.Events).NextPageToken
+				if pageToken == "" || foundNewEvents {
+					break
+				}
 			}
 			log.Printf("DONE. Moved total %d events for %s", numberMoved, userEmail)
 		}(userEmail)
diff --git a/tools/cloner-check/generated_files/appconfig.txt b/tools/cloner-check/generated_files/appconfig.txt
index 933d1dd3dbcb..86388d153e44 100644
--- a/tools/cloner-check/generated_files/appconfig.txt
+++ b/tools/cloner-check/generated_files/appconfig.txt
@@ -96,16 +96,26 @@ github.com/fleetdm/fleet/v4/server/fleet/Integrations	GoogleCalendar	[]*fleet.Go
 github.com/fleetdm/fleet/v4/server/fleet/GoogleCalendarIntegration	Domain	string
 github.com/fleetdm/fleet/v4/server/fleet/GoogleCalendarIntegration	ApiKey	map[string]string
 github.com/fleetdm/fleet/v4/server/fleet/AppConfig	MDM	fleet.MDM
-github.com/fleetdm/fleet/v4/server/fleet/MDM	AppleBMDefaultTeam	string
+github.com/fleetdm/fleet/v4/server/fleet/MDM	DeprecatedAppleBMDefaultTeam	string
+github.com/fleetdm/fleet/v4/server/fleet/MDM	AppleBusinessManager	optjson.Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMAppleABMAssignmentInfo]
+github.com/fleetdm/fleet/v4/pkg/optjson/Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMAppleABMAssignmentInfo]	Set	bool
+github.com/fleetdm/fleet/v4/pkg/optjson/Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMAppleABMAssignmentInfo]	Valid	bool
+github.com/fleetdm/fleet/v4/pkg/optjson/Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMAppleABMAssignmentInfo]	Value	[]fleet.MDMAppleABMAssignmentInfo
+github.com/fleetdm/fleet/v4/server/fleet/MDMAppleABMAssignmentInfo	OrganizationName	string
+github.com/fleetdm/fleet/v4/server/fleet/MDMAppleABMAssignmentInfo	MacOSTeam	string
+github.com/fleetdm/fleet/v4/server/fleet/MDMAppleABMAssignmentInfo	IOSTeam	string
+github.com/fleetdm/fleet/v4/server/fleet/MDMAppleABMAssignmentInfo	IpadOSTeam	string
 github.com/fleetdm/fleet/v4/server/fleet/MDM	AppleBMEnabledAndConfigured	bool
 github.com/fleetdm/fleet/v4/server/fleet/MDM	AppleBMTermsExpired	bool
 github.com/fleetdm/fleet/v4/server/fleet/MDM	EnabledAndConfigured	bool
-github.com/fleetdm/fleet/v4/server/fleet/MDM	MacOSUpdates	fleet.MacOSUpdates
-github.com/fleetdm/fleet/v4/server/fleet/MacOSUpdates	MinimumVersion	optjson.String
+github.com/fleetdm/fleet/v4/server/fleet/MDM	MacOSUpdates	fleet.AppleOSUpdateSettings
+github.com/fleetdm/fleet/v4/server/fleet/AppleOSUpdateSettings	MinimumVersion	optjson.String
 github.com/fleetdm/fleet/v4/pkg/optjson/String	Set	bool
 github.com/fleetdm/fleet/v4/pkg/optjson/String	Valid	bool
 github.com/fleetdm/fleet/v4/pkg/optjson/String	Value	string
-github.com/fleetdm/fleet/v4/server/fleet/MacOSUpdates	Deadline	optjson.String
+github.com/fleetdm/fleet/v4/server/fleet/AppleOSUpdateSettings	Deadline	optjson.String
+github.com/fleetdm/fleet/v4/server/fleet/MDM	IOSUpdates	fleet.AppleOSUpdateSettings
+github.com/fleetdm/fleet/v4/server/fleet/MDM	IPadOSUpdates	fleet.AppleOSUpdateSettings
 github.com/fleetdm/fleet/v4/server/fleet/MDM	WindowsUpdates	fleet.WindowsUpdates
 github.com/fleetdm/fleet/v4/server/fleet/WindowsUpdates	DeadlineDays	optjson.Int
 github.com/fleetdm/fleet/v4/pkg/optjson/Int	Set	bool
@@ -140,6 +150,12 @@ github.com/fleetdm/fleet/v4/server/fleet/WindowsSettings	CustomSettings	optjson.
 github.com/fleetdm/fleet/v4/pkg/optjson/Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMProfileSpec]	Set	bool
 github.com/fleetdm/fleet/v4/pkg/optjson/Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMProfileSpec]	Valid	bool
 github.com/fleetdm/fleet/v4/pkg/optjson/Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMProfileSpec]	Value	[]fleet.MDMProfileSpec
+github.com/fleetdm/fleet/v4/server/fleet/MDM	VolumePurchasingProgram	optjson.Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMAppleVolumePurchasingProgramInfo]
+github.com/fleetdm/fleet/v4/pkg/optjson/Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMAppleVolumePurchasingProgramInfo]	Set	bool
+github.com/fleetdm/fleet/v4/pkg/optjson/Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMAppleVolumePurchasingProgramInfo]	Valid	bool
+github.com/fleetdm/fleet/v4/pkg/optjson/Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMAppleVolumePurchasingProgramInfo]	Value	[]fleet.MDMAppleVolumePurchasingProgramInfo
+github.com/fleetdm/fleet/v4/server/fleet/MDMAppleVolumePurchasingProgramInfo	Location	string
+github.com/fleetdm/fleet/v4/server/fleet/MDMAppleVolumePurchasingProgramInfo	Teams	[]string
 github.com/fleetdm/fleet/v4/server/fleet/AppConfig	Scripts	optjson.Slice[string]
 github.com/fleetdm/fleet/v4/pkg/optjson/Slice[string]	Set	bool
 github.com/fleetdm/fleet/v4/pkg/optjson/Slice[string]	Valid	bool
diff --git a/tools/cloner-check/generated_files/teammdm.txt b/tools/cloner-check/generated_files/teammdm.txt
index cd1278ff04b0..9c92a3696ee0 100644
--- a/tools/cloner-check/generated_files/teammdm.txt
+++ b/tools/cloner-check/generated_files/teammdm.txt
@@ -1,10 +1,12 @@
 github.com/fleetdm/fleet/v4/server/fleet/TeamMDM	EnableDiskEncryption	bool
-github.com/fleetdm/fleet/v4/server/fleet/TeamMDM	MacOSUpdates	fleet.MacOSUpdates
-github.com/fleetdm/fleet/v4/server/fleet/MacOSUpdates	MinimumVersion	optjson.String
+github.com/fleetdm/fleet/v4/server/fleet/TeamMDM	MacOSUpdates	fleet.AppleOSUpdateSettings
+github.com/fleetdm/fleet/v4/server/fleet/AppleOSUpdateSettings	MinimumVersion	optjson.String
 github.com/fleetdm/fleet/v4/pkg/optjson/String	Set	bool
 github.com/fleetdm/fleet/v4/pkg/optjson/String	Valid	bool
 github.com/fleetdm/fleet/v4/pkg/optjson/String	Value	string
-github.com/fleetdm/fleet/v4/server/fleet/MacOSUpdates	Deadline	optjson.String
+github.com/fleetdm/fleet/v4/server/fleet/AppleOSUpdateSettings	Deadline	optjson.String
+github.com/fleetdm/fleet/v4/server/fleet/TeamMDM	IOSUpdates	fleet.AppleOSUpdateSettings
+github.com/fleetdm/fleet/v4/server/fleet/TeamMDM	IPadOSUpdates	fleet.AppleOSUpdateSettings
 github.com/fleetdm/fleet/v4/server/fleet/TeamMDM	WindowsUpdates	fleet.WindowsUpdates
 github.com/fleetdm/fleet/v4/server/fleet/WindowsUpdates	DeadlineDays	optjson.Int
 github.com/fleetdm/fleet/v4/pkg/optjson/Int	Set	bool
diff --git a/tools/dbutils/schema_generator.go b/tools/dbutils/schema_generator.go
index 2fecce86837b..60c01869d306 100644
--- a/tools/dbutils/schema_generator.go
+++ b/tools/dbutils/schema_generator.go
@@ -67,7 +67,7 @@ func main() {
 
 	// Dump schema to dumpfile
 	cmd := exec.Command(
-		"docker-compose", "exec", "-T", "mysql_test",
+		"docker", "compose", "exec", "-T", "mysql_test",
 		// Command run inside container
 		"mysqldump", "-u"+testUsername, "-p"+testPassword, "schemadb", "--compact", "--skip-comments",
 	)
diff --git a/tools/fleetctl-docker/Dockerfile b/tools/fleetctl-docker/Dockerfile
index 7e2e27655b49..6b82ed628541 100644
--- a/tools/fleetctl-docker/Dockerfile
+++ b/tools/fleetctl-docker/Dockerfile
@@ -6,7 +6,7 @@ RUN cargo install --version 0.16.0 apple-codesign \
   && curl -sSf $transporter_url -o transporter_install.sh \
   && sh transporter_install.sh --target transporter --accept --noexec
 
-FROM debian:stable-slim@sha256:0f116858482fd8222b4f7e9b4cdc9a054051e67fbb8a57bc22651f0d56b45ad8
+FROM debian:stable-slim@sha256:e5365b94db65754594422a8a101c873728711c6a4df029677f4a7f7200d6e1c3
 
 ARG binpath=build/binary-bundle/linux/fleetctl
 
diff --git a/tools/fleetctl-npm/README.md b/tools/fleetctl-npm/README.md
index ecb4499e93a5..8ac619853d42 100644
--- a/tools/fleetctl-npm/README.md
+++ b/tools/fleetctl-npm/README.md
@@ -1,4 +1,4 @@
-[![banner-fleet-cloud-city](https://user-images.githubusercontent.com/618009/98254443-eaf21100-1f41-11eb-9e2c-63a0545601f3.jpg)](https://fleetdm.com)
+![fleet-banner](https://github.com/user-attachments/assets/fa90b8b2-cb3e-4277-a561-5719968c4bbd)
 
 Use the `fleetctl` CLI to interact with Fleet, the lightweight telemetry platform for servers and workstations. Have a look at the [Fleet README](https://github.com/fleetdm/fleet#readme) for more information.
 
@@ -8,4 +8,4 @@ From the command line, install `fleetctl` with `npm install -g fleetctl`.
 
 ## Usage
 
-See the [fleetctl documentation](https://fleetdm.com/docs/using-fleet/fleetctl-CLI) or `fleetctl --help` for usage instructions. 
\ No newline at end of file
+See the [fleetctl documentation](https://fleetdm.com/docs/using-fleet/fleetctl-cli) or `fleetctl --help` for usage instructions. 
diff --git a/tools/fleetctl-npm/package.json b/tools/fleetctl-npm/package.json
index a276e2e51b8f..63a49c520892 100644
--- a/tools/fleetctl-npm/package.json
+++ b/tools/fleetctl-npm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "fleetctl",
-  "version": "v4.53.1",
+  "version": "v4.54.1",
   "description": "Installer for the fleetctl CLI tool",
   "bin": {
     "fleetctl": "./run.js"
diff --git a/tools/mdm/apple/applebmapi/main.go b/tools/mdm/apple/applebmapi/main.go
index 04cbc198d8bf..fcc4c8d8316d 100644
--- a/tools/mdm/apple/applebmapi/main.go
+++ b/tools/mdm/apple/applebmapi/main.go
@@ -18,7 +18,6 @@ import (
 	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
 	"github.com/fleetdm/fleet/v4/server/config"
 	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
-	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
 	"github.com/fleetdm/fleet/v4/server/mdm/nanodep/godep"
 	kitlog "github.com/go-kit/log"
 )
@@ -28,12 +27,16 @@ func main() {
 	serverPrivateKey := flag.String("server-private-key", "", "fleet server's private key (to decrypt MDM assets)")
 	profileUUID := flag.String("profile-uuid", "", "the Apple profile UUID to retrieve")
 	serialNum := flag.String("serial-number", "", "serial number of a device to get the device details")
+	orgName := flag.String("org-name", "", "organization name of the token")
 
 	flag.Parse()
 
 	if *serverPrivateKey == "" {
 		log.Fatal("must provide -server-private-key")
 	}
+	if *orgName == "" {
+		log.Fatal("must provide -org-name")
+	}
 	if *profileUUID != "" && *serialNum != "" {
 		log.Fatal("only one of -profile-uuid or -serial-number must be provided")
 	}
@@ -79,11 +82,11 @@ func main() {
 	var res any
 	switch {
 	case *profileUUID != "":
-		res, err = depClient.GetProfile(ctx, apple_mdm.DEPName, *profileUUID)
+		res, err = depClient.GetProfile(ctx, *orgName, *profileUUID)
 	case *serialNum != "":
-		res, err = depClient.GetDeviceDetails(ctx, apple_mdm.DEPName, *serialNum)
+		res, err = depClient.GetDeviceDetails(ctx, *orgName, *serialNum)
 	default:
-		res, err = depClient.AccountDetail(ctx, apple_mdm.DEPName)
+		res, err = depClient.AccountDetail(ctx, *orgName)
 	}
 	if err != nil {
 		log.Fatal(err)
diff --git a/tools/mdm/assets/README.md b/tools/mdm/assets/README.md
new file mode 100644
index 000000000000..1aa73d797c7f
--- /dev/null
+++ b/tools/mdm/assets/README.md
@@ -0,0 +1,67 @@
+# MDM asset manager
+
+The MDM Asset Manager is a tool designed to manage MDM assets in a Fleet database. The assets are
+exported unencrypted and imported encrypted; hence, the
+[key](https://fleetdm.com/docs/configuration/fleet-server-configuration#server-private-key) used for
+encrypting the assets must be provided. 
+
+## Usage
+
+### Export
+
+To export all MDM assets:
+
+```
+go run tools/mdm/assets/main.go export -key=E6Ow1t2dbKARxEF6O9GFI3DDQRMROhI8 -dir=mdm_assets
+```
+
+You can also specify the asset you want:
+
+```
+go run tools/mdm/assets/main.go export -key=E6Ow1t2dbKARxEF6O9GFI3DDQRMROhI8 -dir=mdm_assets -name=vpp_token
+```
+
+Supported flags are:
+
+```
+  -db-address string
+    	Address used to connect to the MySQL instance (default "localhost:3306")
+  -db-name string
+    	Name of the database with the asset information in the MySQL instance (default "fleet")
+  -db-password string
+    	Password used to connect to the MySQL instance (default "insecure")
+  -db-user string
+    	Username used to connect to the MySQL instance (default "fleet")
+  -dir string
+    	Directory to put the exported assets
+  -key string
+    	Key used to encrypt the assets
+  -name string
+    	Name of the MDM asset to export
+```
+
+### Import
+
+To import an MDM asset:
+
+```
+go run tools/mdm/assets/main.go import -key=E6Ow1t2dbKARxEF6O9GFI3DDQRMROhI8 -name=vpp_token -value='{"foo": "bar"}'
+```
+
+Supported flags are:
+
+```
+  -db-address string
+    	Address used to connect to the MySQL instance (default "localhost:3306")
+  -db-name string
+    	Name of the database with the asset information in the MySQL instance (default "fleet")
+  -db-password string
+    	Password used to connect to the MySQL instance (default "insecure")
+  -db-user string
+    	Username used to connect to the MySQL instance (default "fleet")
+  -key string
+    	Key used to encrypt the assets
+  -name string
+    	Name of the MDM asset to import
+  -value string
+    	Value to be set for the asset
\ No newline at end of file
diff --git a/tools/mdm/assets/main.go b/tools/mdm/assets/main.go
new file mode 100644
index 000000000000..d91a246f30c7
--- /dev/null
+++ b/tools/mdm/assets/main.go
@@ -0,0 +1,233 @@
+package main
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/WatchBeam/clock"
+	"github.com/fleetdm/fleet/v4/server/config"
+	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+)
+
+const (
+	testUsername = "fleet"
+	testPassword = "insecure"
+	testAddress  = "localhost:3306"
+	testDatabase = "fleet"
+)
+
+var (
+	exportCmd       = flag.NewFlagSet("export", flag.ExitOnError)
+	importCmd       = flag.NewFlagSet("import", flag.ExitOnError)
+	flagKey         string
+	flagDir         string
+	flagDBUser      string
+	flagDBPass      string
+	flagDBAddress   string
+	flagDBName      string
+	flagImportName  string
+	flagImportValue string
+	flagExportName  string
+
+	validNames = map[fleet.MDMAssetName]struct{}{
+		fleet.MDMAssetABMCert:            {},
+		fleet.MDMAssetABMTokenDeprecated: {},
+		fleet.MDMAssetABMKey:             {},
+		fleet.MDMAssetAPNSCert:           {},
+		fleet.MDMAssetAPNSKey:            {},
+		fleet.MDMAssetCACert:             {},
+		fleet.MDMAssetCAKey:              {},
+		fleet.MDMAssetSCEPChallenge:      {},
+		fleet.MDMAssetVPPTokenDeprecated: {},
+	}
+)
+
+func setupSharedFlags() {
+	for _, fs := range []*flag.FlagSet{exportCmd, importCmd} {
+		fs.StringVar(&flagKey, "key", "", "Key used to encrypt the assets")
+		fs.StringVar(&flagDir, "dir", "", "Directory to put the exported assets")
+		fs.StringVar(&flagDBUser, "db-user", testUsername, "Username used to connect to the MySQL instance")
+		fs.StringVar(&flagDBPass, "db-password", testPassword, "Password used to connect to the MySQL instance")
+		fs.StringVar(&flagDBAddress, "db-address", testAddress, "Address used to connect to the MySQL instance")
+		fs.StringVar(&flagDBName, "db-name", testDatabase, "Name of the database with the asset information in the MySQL instance")
+	}
+}
+
+func setupDS(privateKey, userName, password, address, name string) *mysql.Datastore {
+	db, err := sql.Open(
+		"mysql",
+		fmt.Sprintf("%s:%s@tcp(%s)/?multiStatements=true", testUsername, testPassword, testAddress),
+	)
+	if err != nil {
+		log.Fatal("opening MySQL connection:", err)
+	}
+	defer db.Close()
+
+	mysqlCfg := config.MysqlConfig{
+		Username: userName,
+		Password: password,
+		Address:  address,
+		Database: name,
+	}
+	ds, err := mysql.New(
+		mysqlCfg,
+		clock.NewMockClock(),
+		mysql.LimitAttempts(1),
+		mysql.WithFleetConfig(&config.FleetConfig{
+			Server: config.ServerConfig{
+				PrivateKey: privateKey,
+			},
+		}),
+	)
+	if err != nil {
+		log.Fatal("creating datastore instance:", err)
+	}
+
+	return ds
+}
+
+func main() {
+	if len(os.Args) < 2 {
+		log.Fatal("invalid subcommand, expected import or export")
+	}
+
+	ctx := context.Background()
+
+	// Flag setup
+	setupSharedFlags()
+	importCmd.StringVar(&flagImportName, "name", "", "Name of the asset to import. Valid names are: apns_cert, apns_key, ca_cert, ca_key, abm_key, abm_cert, abm_token, scep_challenge, vpp_token")
+	importCmd.StringVar(&flagImportValue, "value", "", "Value of the asset to import")
+	exportCmd.StringVar(&flagExportName, "name", "", "Name of the asset to export. Valid names are: apns_cert, apns_key, ca_cert, ca_key, abm_key, abm_cert, abm_token, scep_challenge, vpp_token")
+
+	// Execute subcommands
+	switch os.Args[1] {
+	case "import":
+		if err := importCmd.Parse(os.Args[2:]); err != nil {
+			log.Fatal("parsing import flags", err)
+		}
+
+		if len(flagKey) > 32 {
+			// We truncate to 32 bytes because AES-256 requires a 32 byte (256 bit) PK, but some
+			// infra setups generate keys that are longer than 32 bytes.
+			flagKey = flagKey[:32]
+		}
+
+		ds := setupDS(flagKey, flagDBUser, flagDBPass, flagDBAddress, flagDBName)
+		defer ds.Close()
+
+		// Check required flags
+		if flagDir != "" {
+			if err := os.MkdirAll(flagDir, os.ModePerm); err != nil {
+				log.Fatal("ensuring directory: ", err)
+			}
+		}
+
+		if flagImportName == "" {
+			log.Fatal("-name flag is required")
+		}
+
+		if flagImportValue == "" {
+			log.Fatal("-value flag is required")
+		}
+
+		if _, ok := validNames[fleet.MDMAssetName(flagImportName)]; !ok {
+			log.Fatalf("invalid asset name %s", flagImportName)
+		}
+
+		err := ds.ReplaceMDMConfigAssets(ctx, []fleet.MDMConfigAsset{{Name: fleet.MDMAssetName(flagImportName), Value: []byte(flagImportValue)}})
+		if err != nil {
+			log.Fatal("writing asset to db: ", err)
+		}
+		return
+	case "export":
+		if err := exportCmd.Parse(os.Args[2:]); err != nil {
+			log.Fatal("parsing export flags", err)
+		}
+
+		// Check required flags
+		if flagKey == "" {
+			log.Fatal("-key flag is required")
+		}
+
+		if len(flagKey) > 32 {
+			// We truncate to 32 bytes because AES-256 requires a 32 byte (256 bit) PK, but some
+			// infra setups generate keys that are longer than 32 bytes.
+			flagKey = flagKey[:32]
+		}
+
+		ds := setupDS(flagKey, flagDBUser, flagDBPass, flagDBAddress, flagDBName)
+		defer ds.Close()
+
+		if flagDir != "" {
+			if err := os.MkdirAll(flagDir, os.ModePerm); err != nil {
+				log.Fatal("ensuring directory: ", err)
+			}
+		}
+
+		names := []fleet.MDMAssetName{
+			fleet.MDMAssetCACert,
+			fleet.MDMAssetCAKey,
+			fleet.MDMAssetAPNSKey,
+			fleet.MDMAssetAPNSCert,
+			fleet.MDMAssetABMCert,
+			fleet.MDMAssetABMKey,
+			fleet.MDMAssetABMTokenDeprecated,
+			fleet.MDMAssetSCEPChallenge,
+			fleet.MDMAssetVPPTokenDeprecated,
+		}
+
+		if flagExportName != "" {
+			if _, ok := validNames[fleet.MDMAssetName(flagExportName)]; !ok {
+				log.Fatalf("invalid asset name %s", flagExportName)
+			}
+
+			names = []fleet.MDMAssetName{fleet.MDMAssetName(flagExportName)}
+		}
+
+		assets, err := ds.GetAllMDMConfigAssetsByName(ctx, names)
+		if err != nil && !errors.Is(err, mysql.ErrPartialResult) {
+			log.Fatal("retrieving assets from db:", err)
+		}
+
+		for _, asset := range assets {
+			path := filepath.Join(flagDir, string(asset.Name))
+			switch {
+			case strings.Contains(path, "_key"):
+				path = path + ".key"
+			case strings.Contains(path, "_cert"):
+				path = path + ".crt"
+			}
+			if err := os.WriteFile(path, asset.Value, 0o600); err != nil {
+				log.Fatal("writing asset:", err)
+			}
+
+			log.Printf("wrote %s in %s", asset.Name, path)
+		}
+
+		flagDir, err = filepath.Abs(flagDir)
+		if err != nil {
+			log.Fatalf("abs path: %s", err)
+		}
+
+		fmt.Printf(`You can set the following on your Fleet configuration:
+export FLEET_MDM_APPLE_APNS_CERT=%[1]s/apns_cert.crt
+export FLEET_MDM_APPLE_APNS_KEY=%[1]s/apns_key.key
+export FLEET_MDM_APPLE_SCEP_CERT=%[1]s/ca_cert.crt
+export FLEET_MDM_APPLE_SCEP_KEY=%[1]s/ca_key.key
+export FLEET_MDM_APPLE_SCEP_CHALLENGE=$(cat %[1]s/scep_challenge)
+export FLEET_MDM_APPLE_BM_SERVER_TOKEN=%[1]s/abm_token
+export FLEET_MDM_APPLE_BM_CERT=%[1]s/abm_cert.crt
+export FLEET_MDM_APPLE_BM_KEY=%[1]s/abm_key.key
+`, flagDir)
+	default:
+		log.Fatalf("invalid subcommand %s, valid subcommands: import, export", os.Args[1])
+	}
+}
diff --git a/tools/mdm/decrypt-disk-encryption-key/main.go b/tools/mdm/decrypt-disk-encryption-key/main.go
new file mode 100644
index 000000000000..22bf6ef714ba
--- /dev/null
+++ b/tools/mdm/decrypt-disk-encryption-key/main.go
@@ -0,0 +1,56 @@
+// Command decrypt-disk-encryption-key decrypts a base64-encoded encrypted key
+// using the provided X509 certificate and private key. This is typically used
+// to manually decrypt a disk encryption key, e.g. BitLocker on Windows or
+// FileVault on macOS. The certificate and private key used are the SCEP files
+// for a macOS host and the WSTEP files for a Windows host.
+//
+// Example usage (running from the root of this repository):
+//
+//		go run ./tools/mdm/decrypt-disk-encryption-key/main.go -cert path/to/file.crt \
+//	   -key path/to/file.key -value-to-decrypt base64-encoded-value
+package main
+
+import (
+	"errors"
+	"flag"
+	"fmt"
+
+	"github.com/apex/log"
+	"github.com/fleetdm/fleet/v4/server/config"
+	"github.com/fleetdm/fleet/v4/server/mdm"
+)
+
+func main() {
+	var (
+		certFile       = flag.String("cert", "", "The path to the X509 certificate file (required).")
+		keyFile        = flag.String("key", "", "The path to the X509 private key file (required).")
+		valueToDecrypt = flag.String("value-to-decrypt", "", "The base64-encoded value to decrypt (required).")
+	)
+	flag.Parse()
+
+	if *certFile == "" || *keyFile == "" || *valueToDecrypt == "" {
+		flag.Usage()
+		return
+	}
+
+	cfg := config.MDMConfig{
+		WindowsWSTEPIdentityCert: *certFile,
+		WindowsWSTEPIdentityKey:  *keyFile,
+	}
+	cert, _, _, err := cfg.MicrosoftWSTEP()
+	if err != nil {
+		// unwrap the error once to remove "Microsoft WSTEP" from the error
+		// message, as we don't know in this tool if the cert is for WSTEP or SCEP
+		// (it doesn't matter)
+		if uerr := errors.Unwrap(err); uerr != nil {
+			err = uerr
+		}
+		log.Fatalf("Error loading certificate: %v", err)
+	}
+
+	decrypted, err := mdm.DecryptBase64CMS(*valueToDecrypt, cert.Leaf, cert.PrivateKey)
+	if err != nil {
+		log.Fatalf("Error decrypting value: %v", err)
+	}
+	fmt.Printf("Decrypted value: %s\n", string(decrypted))
+}
diff --git a/tools/mdm/migration/mdmproxy/Dockerfile b/tools/mdm/migration/mdmproxy/Dockerfile
index 5d3369304bb8..6355224466cc 100644
--- a/tools/mdm/migration/mdmproxy/Dockerfile
+++ b/tools/mdm/migration/mdmproxy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.22.5-alpine3.20@sha256:8c9183f715b0b4eca05b8b3dbf59766aaedb41ec07477b132ee2891ac0110a07
+FROM golang:1.23.1-alpine3.20@sha256:436e2d978524b15498b98faa367553ba6c3655671226f500c72ceb7afb2ef0b1
 ARG TAG
 RUN apk update && apk add --no-cache git
 RUN git clone -b $TAG --depth=1 --no-tags --progress --no-recurse-submodules https://github.com/fleetdm/fleet.git && cd /go/fleet/tools/mdm/migration/mdmproxy && go build .
diff --git a/tools/mdm/migration/mdmproxy/README.md b/tools/mdm/migration/mdmproxy/README.md
index 3582bf4af4a4..a1f43be32825 100644
--- a/tools/mdm/migration/mdmproxy/README.md
+++ b/tools/mdm/migration/mdmproxy/README.md
@@ -25,4 +25,18 @@ Usage of ./mdmproxy:
 ### Example invocation
 ```
 mdmproxy --migrate-udids '' --auth-token foo --existing-url https://3.14.233.249 --existing-hostname micromdm.example.com --fleet-url https://example.cloud.fleetdm.com --migrate-percentage 0
-```
\ No newline at end of file
+```
+
+### Check migration status
+
+To check the migration status for a given UDID, provide the `--migrate-udids` and
+`--migrate-percentage` flags with the `--check` flag:
+
+```
+$ go run . --migrate-percentage=50 --check E5C6DBBA-D5CC-4DB6-9560-995F17FB7A59
+E5C6DBBA-D5CC-4DB6-9560-995F17FB7A59 IS NOT migrated
+$ go run . --migrate-percentage=50 --check 575424CB-09D7-4CAD-8A7A-D3511FE8A7E2
+575424CB-09D7-4CAD-8A7A-D3511FE8A7E2 IS migrated
+```
+
+When the `--check` flag is used, the program prints the migration status and exits. The server is not started.
\ No newline at end of file
diff --git a/tools/mdm/migration/mdmproxy/mdmproxy.go b/tools/mdm/migration/mdmproxy/mdmproxy.go
index b8c0be5fa706..c59bf4b425b5 100644
--- a/tools/mdm/migration/mdmproxy/mdmproxy.go
+++ b/tools/mdm/migration/mdmproxy/mdmproxy.go
@@ -12,6 +12,7 @@ import (
 	"net/http"
 	"net/http/httputil"
 	"net/url"
+	"os"
 	"strconv"
 	"strings"
 	"sync"
@@ -31,7 +32,21 @@ type mdmProxy struct {
 	// mutex is used to sync reads/updates to the migrateUDIDs and migratePercentage
 	mutex sync.RWMutex
 	// token is used to authenticate updates to the migrateUDIDs and migratePercentage
-	token string
+	token      string
+	debug      bool
+	logSkipped bool
+}
+
+func skipRequest(r *http.Request) bool {
+	// Throw out a bunch of common junk requests
+	return strings.Contains(r.URL.Path, ".php") ||
+		strings.Contains(r.URL.Path, ".git") ||
+		strings.Contains(r.URL.Path, ".yml") ||
+		strings.Contains(r.URL.Path, ".txt") ||
+		strings.Contains(r.URL.Path, ".py") ||
+		strings.Contains(r.URL.Path, "wp-") ||
+		strings.Contains(r.URL.Path, "private") ||
+		(r.URL.Path == "/" && r.Method == http.MethodPost)
 }
 
 func (m *mdmProxy) handleProxy(w http.ResponseWriter, r *http.Request) {
@@ -41,6 +56,14 @@ func (m *mdmProxy) handleProxy(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if skipRequest(r) {
+		if m.logSkipped {
+			log.Printf("Forbidden skipped request: %s %s", r.Method, r.URL.String())
+		}
+		http.Error(w, "Forbidden", http.StatusForbidden)
+		return
+	}
+
 	// Send all SCEP requests to the existing server
 	if strings.Contains(r.URL.Path, "scep") {
 		log.Printf("%s %s -> Existing (SCEP)", r.Method, r.URL.String())
@@ -53,9 +76,30 @@ func (m *mdmProxy) handleProxy(w http.ResponseWriter, r *http.Request) {
 		log.Printf("%s %s -> Existing (API)", r.Method, r.URL.String())
 		m.existingProxy.ServeHTTP(w, r)
 		return
+	}
+
+	if r.URL.Path == "/" && r.Method == http.MethodGet {
+		log.Printf("%s %s -> Existing (Home)", r.Method, r.URL.String())
+		m.existingProxy.ServeHTTP(w, r)
+		return
+	}
+
+	// Send all micromdm repo requests to the existing server
+	if strings.HasPrefix(r.URL.Path, "/repo") {
+		log.Printf("%s %s -> Existing (Repo)", r.Method, r.URL.String())
+		m.existingProxy.ServeHTTP(w, r)
+		return
 
 	}
 
+	if !strings.HasPrefix(r.URL.Path, "/mdm") {
+		if m.logSkipped {
+			log.Printf("Forbidden non-mdm request: %s %s", r.Method, r.URL.String())
+		}
+		http.Error(w, "Forbidden", http.StatusForbidden)
+		return
+	}
+
 	// Read the body of the request
 	body, err := io.ReadAll(r.Body)
 	_ = r.Body.Close()
@@ -78,6 +122,9 @@ func (m *mdmProxy) handleProxy(w http.ResponseWriter, r *http.Request) {
 	// Migrated UDIDs go to the Fleet server, otherwise requests go to the existing server.
 	if udid != "" && m.isUDIDMigrated(udid) {
 		log.Printf("%s %s (%s) -> Fleet", r.Method, r.URL.String(), udid)
+		if m.debug {
+			log.Printf("Fleet request: %s", string(body))
+		}
 		m.fleetProxy.ServeHTTP(w, r)
 	} else {
 		log.Printf("%s %s (%s) -> Existing", r.Method, r.URL.String(), udid)
@@ -238,12 +285,29 @@ func makeExistingProxy(existingURL, existingDNSName string) *httputil.ReversePro
 	return proxy
 }
 
-func makeFleetProxy(fleetURL string) *httputil.ReverseProxy {
+func makeFleetProxy(fleetURL string, debug bool) *httputil.ReverseProxy {
 	targetURL, err := url.Parse(fleetURL)
 	if err != nil {
 		panic("failed to parse fleet-url: " + err.Error())
 	}
 	proxy := httputil.NewSingleHostReverseProxy(targetURL)
+	if debug {
+		proxy.ModifyResponse = func(r *http.Response) error {
+			b, err := io.ReadAll(r.Body)
+			if err != nil {
+				return err
+			}
+			err = r.Body.Close()
+			if err != nil {
+				return err
+			}
+			r.Body = io.NopCloser(bytes.NewReader(b))
+
+			log.Println("Fleet response: ", string(b))
+
+			return nil
+		}
+	}
 
 	return proxy
 }
@@ -256,8 +320,38 @@ func main() {
 	migratePercentage := flag.Int("migrate-percentage", 0, "Percentage of clients to migrate from existing MDM to Fleet")
 	migrateUDIDs := flag.String("migrate-udids", "", "Space/newline-delimited list of UDIDs to migrate always")
 	serverAddr := flag.String("server-address", ":8080", "Address for server to listen on")
+	debug := flag.Bool("debug", false, "Enable debug logging")
+	logSkipped := flag.Bool("log-skipped", false, "Log skipped requests (usually from web scanners)")
+	check := flag.String("check", "", "Print whether the specified UDID is migrated with the current configuration, then exit")
 	flag.Parse()
 
+	udids, err := processUDIDs(bytes.NewBufferString(*migrateUDIDs))
+	if err != nil {
+		panic(err)
+	}
+
+	proxy := mdmProxy{
+		token:             *authToken,
+		existingServerURL: *existingURL,
+		fleetServerURL:    *fleetURL,
+		existingHostname:  *existingHostname,
+		migratePercentage: *migratePercentage,
+		migrateUDIDs:      udids,
+		existingProxy:     makeExistingProxy(*existingURL, *existingHostname),
+		fleetProxy:        makeFleetProxy(*fleetURL, *debug),
+		debug:             *debug,
+		logSkipped:        *logSkipped,
+	}
+
+	if len(*check) > 0 {
+		if proxy.isUDIDMigrated(*check) {
+			fmt.Printf("%s IS migrated\n", *check)
+		} else {
+			fmt.Printf("%s IS NOT migrated\n", *check)
+		}
+		os.Exit(0)
+	}
+
 	// Check required flags
 	if *existingURL == "" {
 		log.Fatal("--existing-url must be set")
@@ -269,32 +363,19 @@ func main() {
 		log.Fatal("--fleet-url must be set")
 	}
 
-	udids, err := processUDIDs(bytes.NewBufferString(*migrateUDIDs))
-	if err != nil {
-		panic(err)
-	}
 	log.Printf("--migrate-udids set: %v", udids)
 	log.Printf("--migrate-percentage set: %d", *migratePercentage)
 	log.Printf("--existing-url set: %s", *existingURL)
 	log.Printf("--existing-hostname set: %s", *existingHostname)
 	log.Printf("--fleet-url set: %s", *fleetURL)
+	log.Printf("--debug set: %v", *debug)
+	log.Printf("--log-skipped set: %v", *logSkipped)
 	if *authToken != "" {
 		log.Printf("--auth-token set. Remote configuration enabled.")
 	} else {
 		log.Printf("--auth-token is empty. Remote configuration disabled.")
 	}
 
-	proxy := mdmProxy{
-		token:             *authToken,
-		existingServerURL: *existingURL,
-		fleetServerURL:    *fleetURL,
-		existingHostname:  *existingHostname,
-		migratePercentage: *migratePercentage,
-		migrateUDIDs:      udids,
-		existingProxy:     makeExistingProxy(*existingURL, *existingHostname),
-		fleetProxy:        makeFleetProxy(*fleetURL),
-	}
-
 	mux := http.NewServeMux()
 	// Health check endpoint used for load balancers
 	mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
diff --git a/tools/mdm/migration/micromdm/README.md b/tools/mdm/migration/micromdm/README.md
new file mode 100644
index 000000000000..da6d073b8b1e
--- /dev/null
+++ b/tools/mdm/migration/micromdm/README.md
@@ -0,0 +1,19 @@
+# MicroMDM webhook
+
+A tiny server you can use as a webhook callback for the MDM migration [end user workflow](https://fleetdm.com/docs/using-fleet/mdm-migration-guide#end-user-workflow).
+
+It will try to unenroll the device based on the device UUID/UDID by sending a `RemoveProfile`
+command.
+
+## Usage
+
+1. Find the MicroMDM API token. For the Fly.io hosted MicroMDM server it should be in
+   1Password. If you're having trouble finding it, drop a message in `#g-mdm` on Slack!
+2. Get the MicroMDM server URL.
+3. Start the server with:
+
+```
+go run tools/mdm/migration/micromdm/main.go --api-token=$MICRO_MDM_TOKEN --url=https://micromdm.example.com
+```
+
+4. Configure Fleet to send a webhook to this server.
\ No newline at end of file
diff --git a/tools/mdm/migration/micromdm/main.go b/tools/mdm/migration/micromdm/main.go
index 8adca4d01e2d..87e73246b93f 100644
--- a/tools/mdm/migration/micromdm/main.go
+++ b/tools/mdm/migration/micromdm/main.go
@@ -1,355 +1,149 @@
 package main
 
 import (
-	"context"
-	"crypto/sha256"
-	"crypto/x509"
-	"encoding/base64"
-	"encoding/hex"
-	"encoding/pem"
+	"bytes"
+	"encoding/json"
 	"flag"
 	"fmt"
+	"io"
 	"log"
-	"os"
-	"strings"
+	"log/slog"
+	"net/http"
+	"time"
 
-	"github.com/boltdb/bolt"
-	scepdepot "github.com/fleetdm/fleet/v4/server/mdm/scep/depot/bolt"
-	"github.com/groob/plist"
-	apnsbuiltin "github.com/micromdm/micromdm/platform/apns/builtin"
-	"github.com/micromdm/micromdm/platform/device"
-	devicebuiltin "github.com/micromdm/micromdm/platform/device/builtin"
-	"github.com/micromdm/micromdm/platform/pubsub/inmem"
-	"go.etcd.io/bbolt"
+	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
 )
 
-type Authenticate struct {
-	MessageType  string
-	UDID         string
-	Topic        string
-	BuildVersion string `plist:",omitempty"`
-	DeviceName   string `plist:",omitempty"`
-	Model        string `plist:",omitempty"`
-	ModelName    string `plist:",omitempty"`
-	OSVersion    string `plist:",omitempty"`
-	ProductName  string `plist:",omitempty"`
-	SerialNumber string `plist:",omitempty"`
-	IMEI         string `plist:",omitempty"`
-	MEID         string `plist:",omitempty"`
-}
-
-type TokenUpdate struct {
-	MessageType   string
-	UDID          string
-	PushMagic     string
-	Topic         string
-	Token         []byte
-	UnlockToken   []byte `plist:",omitempty"`
-	UserID        string `plist:",omitempty"`
-	UserShortName string `plist:",omitempty"`
-	UserLongName  string `plist:",omitempty"`
-}
+var (
+	apiToken = flag.String("api-token", "", "API token for the MicroMDM instance")
+	url      = flag.String("url", "", "URL of the MicroMDM instance")
+	port     = flag.String("port", "4648", "Port used by the webserver")
+)
 
 func main() {
-	flDB := flag.String("db", "/var/db/micromdm/micromdm.db", "path to micromdm DB")
 	flag.Parse()
 
-	// Device records
-	func() {
-		log.Println("Open DB for devices")
-		boltDB, err := bolt.Open(*flDB, 0o600, nil)
-		if err != nil {
-			log.Fatal(err)
-		}
-		defer boltDB.Close()
+	if *apiToken == "" || *url == "" {
+		log.Fatal("--api-token and --url are required.")
+	}
 
-		ps := inmem.NewPubSub()
-		apnsDB, err := apnsbuiltin.NewDB(boltDB, ps)
-		if err != nil {
-			log.Fatal(err)
-		}
+	client := newMicroMDMClient(*apiToken, *url)
 
-		deviceDB, err := devicebuiltin.NewDB(boltDB)
-		if err != nil {
-			log.Fatal(err)
-		}
-		devices, err := deviceDB.List(context.Background(), device.ListDevicesOption{})
+	http.HandleFunc("/", func(writer http.ResponseWriter, request *http.Request) {
+		body, err := io.ReadAll(request.Body)
 		if err != nil {
-			log.Fatal(err)
-		}
-		if len(devices) == 0 {
-			log.Printf("No devices found. Are you sure %s is a MicroMDM DB?", *flDB)
-		} else {
-			log.Printf("Found %d devices", len(devices))
+			slog.With("error", err).Error("reading request body")
+			writer.WriteHeader(http.StatusInternalServerError)
+			return
 		}
 
-		// SCEP certificates are stored using the certificate CN as the
-		// key. I couldn't find any CN <-> device association in the
-		// db, as it's not needed: micro extracts the certificate CN
-		// from the request and uses it to authenticate devices.
-		//
-		// To avoid loading all certs in memory (rough estimation is
-		// ~2KB per cert) we store a map of the cert hash (which is
-		// stored along the device record) to the CN for later
-		// retrieval.
-		certHashToCertKey := make(map[string][]byte, len(devices))
-		// NOTE: the depot doesn't expose methods to list certs so we
-		// need to use bolt directly.
-		err = boltDB.View(func(tx *bolt.Tx) error {
-			bucket := tx.Bucket([]byte("scep_certificates"))
-			if bucket == nil {
-				log.Fatalf("No identity certificates found. Are you sure %s is a MicroMDM DB?", *flDB)
-			}
-			return bucket.ForEach(func(k, v []byte) error {
-				hash := sha256.Sum256(v)
-				certHashToCertKey[string(hash[:])] = k
-				return nil
-			})
-		})
-		if err != nil {
-			log.Fatal(err)
+		if len(body) == 0 {
+			slog.Error("empty request body")
+			writer.WriteHeader(http.StatusBadRequest)
+			return
 		}
 
-		var sb strings.Builder
-		for _, device := range devices {
-			pushInfo, err := apnsDB.PushInfo(context.Background(), device.UDID)
-			if err != nil {
-				log.Fatal(device.UDID, " FAILED: ", err)
-			}
-
-			authenticate := &Authenticate{
-				MessageType:  "Authenticate",
-				UDID:         device.UDID,
-				Topic:        pushInfo.MDMTopic,
-				BuildVersion: device.BuildVersion,
-				DeviceName:   device.DeviceName,
-				Model:        device.Model,
-				ModelName:    device.ModelName,
-				OSVersion:    device.OSVersion,
-				ProductName:  device.ProductName,
-				SerialNumber: device.SerialNumber,
-				IMEI:         device.IMEI,
-				MEID:         device.MEID,
-			}
-
-			authenticatePlist, err := plist.Marshal(authenticate)
-			if err != nil {
-				log.Println(err)
-				continue
-			}
-
-			token, err := hex.DecodeString(pushInfo.Token)
-			if err != nil {
-				log.Fatal(device.UDID, " FAILED: ", err)
-			}
-			unlockToken, err := hex.DecodeString(device.UnlockToken)
-			if err != nil {
-				log.Fatal(device.UDID, " FAILED: ", err)
-			}
-
-			tokenUpdate := &TokenUpdate{
-				MessageType: "TokenUpdate",
-				UDID:        device.UDID,
-
-				PushMagic: pushInfo.PushMagic,
-				Token:     token,
-				Topic:     pushInfo.MDMTopic,
-
-				UnlockToken: unlockToken,
-			}
-
-			tokenPlist, err := plist.Marshal(tokenUpdate)
-			if err != nil {
-				log.Println(err)
-				continue
-			}
-
-			certHash, err := deviceDB.GetUDIDCertHash([]byte(device.UDID))
-			if err != nil {
-				log.Fatal(device.UDID, " FAILED: ", err)
-			}
+		slog.With("raw_body", string(body)).Debug("got request")
 
-			var certDer []byte
-			certKey := certHashToCertKey[string(certHash)]
-			err = boltDB.View(func(tx *bolt.Tx) error {
-				bucket := tx.Bucket([]byte("scep_certificates"))
-				certDer = bucket.Get(certKey)
-				return nil
-			})
-			if err != nil {
-				log.Fatal(device.UDID, " FAILED: ", err)
-			}
+		var deviceInfo struct {
+			Host struct {
+				UUID string `json:"uuid"`
+			} `json:"host"`
+		}
+		if err := json.Unmarshal(body, &deviceInfo); err != nil {
+			slog.With("device_uuid", deviceInfo.Host.UUID, "error", err).Error("failed to unmarshal request body")
+			writer.WriteHeader(http.StatusBadRequest)
+			return
+		}
 
-			var certExpiration string
-			var certPEM []byte
-			if certDer != nil {
-				// parse the cert to extract the expiration date
-				cert, err := x509.ParseCertificate(certDer)
-				if err != nil {
-					log.Printf("WARN: unable to parse SCEP identity certificate for %s: %s\n", device.UDID, err)
-				}
-				certExpiration = cert.NotAfter.Format("2006-01-02 15:04:05")
+		slog.With("device_uuid", deviceInfo.Host.UUID).Info("attempting to unenroll from MicroMDM")
+		if err := client.unmanageDevice(deviceInfo.Host.UUID); err != nil {
+			slog.With("device_uuid", deviceInfo.Host.UUID, "error", err).Error("failed to unenroll device")
+			writer.WriteHeader(http.StatusBadRequest)
+			return
+		}
 
-				// encode it to PEM to store it in the DB in
-				// the format that nano expects. At the moment
-				// we don't really need this value as we can
-				// make do with the hash and the expiration,
-				// but I figured it would be good to have it.
-				pemBlock := &pem.Block{
-					Type:  "CERTIFICATE",
-					Bytes: cert.Raw,
-				}
-				certPEM = pem.EncodeToMemory(pemBlock)
-			}
+		slog.With("device_uuid", deviceInfo.Host.UUID).Info("device unenrolled")
+	})
+
+	slog.With("address", fmt.Sprintf("http://localhost:%s", *port)).Info("server running")
+	server := &http.Server{
+		Addr:              fmt.Sprintf(":%s", *port),
+		ReadHeaderTimeout: 3 * time.Second,
+	}
+	if err := server.ListenAndServe(); err != nil {
+		log.Fatalf(err.Error())
+	}
+}
 
-			base64BootstrapToken := base64.StdEncoding.EncodeToString(device.BootstrapToken)
+type microMDMClient struct {
+	url   string
+	token string
+}
 
-			sb.WriteString(fmt.Sprintf(`
-INSERT INTO nano_devices
-    (
-      id,
-      serial_number,
-      authenticate,
-      authenticate_at,
-      token_update,
-      token_update_at,
-      bootstrap_token_b64,
-      bootstrap_token_at,
-      identity_cert
-    )
-VALUES
-    (
-      '%s',
-      '%s',
-      '%s',
-      CURRENT_TIMESTAMP,
-      '%s',
-      CURRENT_TIMESTAMP,
-      '%s',
-      CURRENT_TIMESTAMP,
-      NULLIF('%s', '')
-    )
-ON DUPLICATE KEY
-UPDATE
-    serial_number = VALUES(serial_number),
-    authenticate = VALUES(authenticate),
-    authenticate_at = CURRENT_TIMESTAMP,
-    token_update = VALUES(token_update),
-    token_update_at = CURRENT_TIMESTAMP,
-    bootstrap_token_b64 = VALUES(bootstrap_token_b64),
-    bootstrap_token_at = CURRENT_TIMESTAMP,
-    identity_cert = VALUES(identity_cert);
-		`, device.UDID, device.SerialNumber, authenticatePlist, tokenPlist, base64BootstrapToken, certPEM))
+func newMicroMDMClient(apiToken, url string) *microMDMClient {
+	client := &microMDMClient{url: url, token: apiToken}
+	return client
+}
 
-			sb.WriteString(fmt.Sprintf(`
-INSERT INTO nano_enrollments
-	(
-	  id,
-	  device_id,
-	  user_id, type,
-	  topic,
-	  push_magic,
-	  token_hex,
-	  enabled,
-	  last_seen_at,
-	  enrolled_from_migration,
-	  token_update_tally
-	)
-VALUES
-	(
-	  '%s',
-	  '%s',
-	  NULL,
-	  'Device',
-	  '%s',
-	  '%s',
-	  '%s',
-	  %t,
-	  CURRENT_TIMESTAMP,
-	  1,
-	  1
-	)
-ON DUPLICATE KEY
-UPDATE
-    device_id = VALUES(device_id),
-    user_id = VALUES(user_id),
-    type = VALUES(type),
-    topic = VALUES(topic),
-    push_magic = VALUES(push_magic),
-    token_hex = VALUES(token_hex),
-    enabled = VALUES(enabled),
-    last_seen_at = CURRENT_TIMESTAMP,
-    token_update_tally = nano_enrollments.token_update_tally + 1;`,
-				device.UDID,
-				device.UDID,
-				tokenUpdate.Topic,
-				tokenUpdate.PushMagic,
-				hex.EncodeToString(tokenUpdate.Token),
-				device.Enrolled,
-			))
+func (m *microMDMClient) doWithRequest(req *http.Request) ([]byte, error) {
+	client := fleethttp.NewClient()
 
-			sb.WriteString(fmt.Sprintf(`
-INSERT INTO nano_cert_auth_associations
-    (id, sha256, cert_not_valid_after)
-VALUES
-    ('%s', '%s', NULLIF('%s', ''))
-ON DUPLICATE KEY UPDATE
-  id = VALUES(id),
-  sha256 = VALUES(sha256),
-  cert_not_valid_after = VALUES(cert_not_valid_after);
-	    `, device.UDID, hex.EncodeToString(certHash[:]), certExpiration))
-		}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
 
-		sb.WriteString("\n")
-		if err := os.WriteFile("dump.sql", []byte(sb.String()), 0o600); err != nil {
-			log.Fatal(err)
-		}
-		log.Println("Wrote device/enrollment records to dump.sql")
-	}()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
 
-	// SCEP cert/key
-	func() {
-		log.Println("Open DB for SCEP cert and key")
-		bboltDB, err := bbolt.Open(*flDB, 0o600, nil)
-		if err != nil {
-			log.Fatal(err)
-		}
-		defer bboltDB.Close()
+	if resp.StatusCode > 299 {
+		return body, fmt.Errorf("unexpected status code %d", resp.StatusCode)
+	}
 
-		scepBoltDepot, err := scepdepot.NewBoltDepot(bboltDB)
-		if err != nil {
-			log.Fatal(err)
-		}
-
-		key, err := scepBoltDepot.CreateOrLoadKey(2048)
-		if err != nil {
-			log.Fatal(err)
-		}
+	return body, nil
+}
 
-		crt, err := scepBoltDepot.CreateOrLoadCA(key, 5, "MicroMDM", "US")
+func (m *microMDMClient) do(method, path string, data any) ([]byte, error) {
+	var body []byte
+	if data != nil {
+		b, err := json.Marshal(data)
 		if err != nil {
-			log.Fatal(err)
+			return nil, fmt.Errorf("marshaling request body: %w", err)
 		}
+		body = b
+	}
 
-		privateKeyBytes := x509.MarshalPKCS1PrivateKey(key)
-		privateKeyPEM := pem.EncodeToMemory(&pem.Block{
-			Type:  "RSA PRIVATE KEY",
-			Bytes: privateKeyBytes,
-		})
-
-		if err := os.WriteFile("scep.key", privateKeyPEM, 0o600); err != nil {
-			log.Fatal(err)
+	makeReq := func() (*http.Request, error) {
+		if len(body) > 0 {
+			return http.NewRequest(method, path, bytes.NewBuffer(body))
 		}
 
-		certPEM := pem.EncodeToMemory(&pem.Block{
-			Type:  "CERTIFICATE",
-			Bytes: crt.Raw,
-		})
+		return http.NewRequest(method, path, nil)
+	}
 
-		if err := os.WriteFile("scep.cert", certPEM, 0o600); err != nil {
-			log.Fatal(err)
-		}
+	req, err := makeReq()
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Add("accept", "application/json")
+	req.SetBasicAuth("micromdm", m.token)
+	return m.doWithRequest(req)
+}
 
-		log.Println("Wrote SCEP cert/key to scep.cert/scep.key")
-	}()
+func (m *microMDMClient) unmanageDevice(UUID string) error {
+	req := struct {
+		RequestType string `json:"request_type"`
+		UDID        string `json:"udid"`
+		Identifier  string `json:"identifier"`
+	}{
+		RequestType: "RemoveProfile",
+		UDID:        UUID,
+		Identifier:  "com.github.micromdm.micromdm.enroll",
+	}
+	_, err := m.do("POST", fmt.Sprintf("%s/v1/commands", m.url), &req)
+	return err
 }
diff --git a/tools/mdm/migration/micromdm/touchless/main.go b/tools/mdm/migration/micromdm/touchless/main.go
new file mode 100644
index 000000000000..8adca4d01e2d
--- /dev/null
+++ b/tools/mdm/migration/micromdm/touchless/main.go
@@ -0,0 +1,355 @@
+package main
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/pem"
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"strings"
+
+	"github.com/boltdb/bolt"
+	scepdepot "github.com/fleetdm/fleet/v4/server/mdm/scep/depot/bolt"
+	"github.com/groob/plist"
+	apnsbuiltin "github.com/micromdm/micromdm/platform/apns/builtin"
+	"github.com/micromdm/micromdm/platform/device"
+	devicebuiltin "github.com/micromdm/micromdm/platform/device/builtin"
+	"github.com/micromdm/micromdm/platform/pubsub/inmem"
+	"go.etcd.io/bbolt"
+)
+
+type Authenticate struct {
+	MessageType  string
+	UDID         string
+	Topic        string
+	BuildVersion string `plist:",omitempty"`
+	DeviceName   string `plist:",omitempty"`
+	Model        string `plist:",omitempty"`
+	ModelName    string `plist:",omitempty"`
+	OSVersion    string `plist:",omitempty"`
+	ProductName  string `plist:",omitempty"`
+	SerialNumber string `plist:",omitempty"`
+	IMEI         string `plist:",omitempty"`
+	MEID         string `plist:",omitempty"`
+}
+
+type TokenUpdate struct {
+	MessageType   string
+	UDID          string
+	PushMagic     string
+	Topic         string
+	Token         []byte
+	UnlockToken   []byte `plist:",omitempty"`
+	UserID        string `plist:",omitempty"`
+	UserShortName string `plist:",omitempty"`
+	UserLongName  string `plist:",omitempty"`
+}
+
+func main() {
+	flDB := flag.String("db", "/var/db/micromdm/micromdm.db", "path to micromdm DB")
+	flag.Parse()
+
+	// Device records
+	func() {
+		log.Println("Open DB for devices")
+		boltDB, err := bolt.Open(*flDB, 0o600, nil)
+		if err != nil {
+			log.Fatal(err)
+		}
+		defer boltDB.Close()
+
+		ps := inmem.NewPubSub()
+		apnsDB, err := apnsbuiltin.NewDB(boltDB, ps)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		deviceDB, err := devicebuiltin.NewDB(boltDB)
+		if err != nil {
+			log.Fatal(err)
+		}
+		devices, err := deviceDB.List(context.Background(), device.ListDevicesOption{})
+		if err != nil {
+			log.Fatal(err)
+		}
+		if len(devices) == 0 {
+			log.Printf("No devices found. Are you sure %s is a MicroMDM DB?", *flDB)
+		} else {
+			log.Printf("Found %d devices", len(devices))
+		}
+
+		// SCEP certificates are stored using the certificate CN as the
+		// key. I couldn't find any CN <-> device association in the
+		// db, as it's not needed: micro extracts the certificate CN
+		// from the request and uses it to authenticate devices.
+		//
+		// To avoid loading all certs in memory (rough estimation is
+		// ~2KB per cert) we store a map of the cert hash (which is
+		// stored along the device record) to the CN for later
+		// retrieval.
+		certHashToCertKey := make(map[string][]byte, len(devices))
+		// NOTE: the depot doesn't expose methods to list certs so we
+		// need to use bolt directly.
+		err = boltDB.View(func(tx *bolt.Tx) error {
+			bucket := tx.Bucket([]byte("scep_certificates"))
+			if bucket == nil {
+				log.Fatalf("No identity certificates found. Are you sure %s is a MicroMDM DB?", *flDB)
+			}
+			return bucket.ForEach(func(k, v []byte) error {
+				hash := sha256.Sum256(v)
+				certHashToCertKey[string(hash[:])] = k
+				return nil
+			})
+		})
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		var sb strings.Builder
+		for _, device := range devices {
+			pushInfo, err := apnsDB.PushInfo(context.Background(), device.UDID)
+			if err != nil {
+				log.Fatal(device.UDID, " FAILED: ", err)
+			}
+
+			authenticate := &Authenticate{
+				MessageType:  "Authenticate",
+				UDID:         device.UDID,
+				Topic:        pushInfo.MDMTopic,
+				BuildVersion: device.BuildVersion,
+				DeviceName:   device.DeviceName,
+				Model:        device.Model,
+				ModelName:    device.ModelName,
+				OSVersion:    device.OSVersion,
+				ProductName:  device.ProductName,
+				SerialNumber: device.SerialNumber,
+				IMEI:         device.IMEI,
+				MEID:         device.MEID,
+			}
+
+			authenticatePlist, err := plist.Marshal(authenticate)
+			if err != nil {
+				log.Println(err)
+				continue
+			}
+
+			token, err := hex.DecodeString(pushInfo.Token)
+			if err != nil {
+				log.Fatal(device.UDID, " FAILED: ", err)
+			}
+			unlockToken, err := hex.DecodeString(device.UnlockToken)
+			if err != nil {
+				log.Fatal(device.UDID, " FAILED: ", err)
+			}
+
+			tokenUpdate := &TokenUpdate{
+				MessageType: "TokenUpdate",
+				UDID:        device.UDID,
+
+				PushMagic: pushInfo.PushMagic,
+				Token:     token,
+				Topic:     pushInfo.MDMTopic,
+
+				UnlockToken: unlockToken,
+			}
+
+			tokenPlist, err := plist.Marshal(tokenUpdate)
+			if err != nil {
+				log.Println(err)
+				continue
+			}
+
+			certHash, err := deviceDB.GetUDIDCertHash([]byte(device.UDID))
+			if err != nil {
+				log.Fatal(device.UDID, " FAILED: ", err)
+			}
+
+			var certDer []byte
+			certKey := certHashToCertKey[string(certHash)]
+			err = boltDB.View(func(tx *bolt.Tx) error {
+				bucket := tx.Bucket([]byte("scep_certificates"))
+				certDer = bucket.Get(certKey)
+				return nil
+			})
+			if err != nil {
+				log.Fatal(device.UDID, " FAILED: ", err)
+			}
+
+			var certExpiration string
+			var certPEM []byte
+			if certDer != nil {
+				// parse the cert to extract the expiration date
+				cert, err := x509.ParseCertificate(certDer)
+				if err != nil {
+					log.Printf("WARN: unable to parse SCEP identity certificate for %s: %s\n", device.UDID, err)
+				}
+				certExpiration = cert.NotAfter.Format("2006-01-02 15:04:05")
+
+				// encode it to PEM to store it in the DB in
+				// the format that nano expects. At the moment
+				// we don't really need this value as we can
+				// make do with the hash and the expiration,
+				// but I figured it would be good to have it.
+				pemBlock := &pem.Block{
+					Type:  "CERTIFICATE",
+					Bytes: cert.Raw,
+				}
+				certPEM = pem.EncodeToMemory(pemBlock)
+			}
+
+			base64BootstrapToken := base64.StdEncoding.EncodeToString(device.BootstrapToken)
+
+			sb.WriteString(fmt.Sprintf(`
+INSERT INTO nano_devices
+    (
+      id,
+      serial_number,
+      authenticate,
+      authenticate_at,
+      token_update,
+      token_update_at,
+      bootstrap_token_b64,
+      bootstrap_token_at,
+      identity_cert
+    )
+VALUES
+    (
+      '%s',
+      '%s',
+      '%s',
+      CURRENT_TIMESTAMP,
+      '%s',
+      CURRENT_TIMESTAMP,
+      '%s',
+      CURRENT_TIMESTAMP,
+      NULLIF('%s', '')
+    )
+ON DUPLICATE KEY
+UPDATE
+    serial_number = VALUES(serial_number),
+    authenticate = VALUES(authenticate),
+    authenticate_at = CURRENT_TIMESTAMP,
+    token_update = VALUES(token_update),
+    token_update_at = CURRENT_TIMESTAMP,
+    bootstrap_token_b64 = VALUES(bootstrap_token_b64),
+    bootstrap_token_at = CURRENT_TIMESTAMP,
+    identity_cert = VALUES(identity_cert);
+		`, device.UDID, device.SerialNumber, authenticatePlist, tokenPlist, base64BootstrapToken, certPEM))
+
+			sb.WriteString(fmt.Sprintf(`
+INSERT INTO nano_enrollments
+	(
+	  id,
+	  device_id,
+	  user_id, type,
+	  topic,
+	  push_magic,
+	  token_hex,
+	  enabled,
+	  last_seen_at,
+	  enrolled_from_migration,
+	  token_update_tally
+	)
+VALUES
+	(
+	  '%s',
+	  '%s',
+	  NULL,
+	  'Device',
+	  '%s',
+	  '%s',
+	  '%s',
+	  %t,
+	  CURRENT_TIMESTAMP,
+	  1,
+	  1
+	)
+ON DUPLICATE KEY
+UPDATE
+    device_id = VALUES(device_id),
+    user_id = VALUES(user_id),
+    type = VALUES(type),
+    topic = VALUES(topic),
+    push_magic = VALUES(push_magic),
+    token_hex = VALUES(token_hex),
+    enabled = VALUES(enabled),
+    last_seen_at = CURRENT_TIMESTAMP,
+    token_update_tally = nano_enrollments.token_update_tally + 1;`,
+				device.UDID,
+				device.UDID,
+				tokenUpdate.Topic,
+				tokenUpdate.PushMagic,
+				hex.EncodeToString(tokenUpdate.Token),
+				device.Enrolled,
+			))
+
+			sb.WriteString(fmt.Sprintf(`
+INSERT INTO nano_cert_auth_associations
+    (id, sha256, cert_not_valid_after)
+VALUES
+    ('%s', '%s', NULLIF('%s', ''))
+ON DUPLICATE KEY UPDATE
+  id = VALUES(id),
+  sha256 = VALUES(sha256),
+  cert_not_valid_after = VALUES(cert_not_valid_after);
+	    `, device.UDID, hex.EncodeToString(certHash[:]), certExpiration))
+		}
+
+		sb.WriteString("\n")
+		if err := os.WriteFile("dump.sql", []byte(sb.String()), 0o600); err != nil {
+			log.Fatal(err)
+		}
+		log.Println("Wrote device/enrollment records to dump.sql")
+	}()
+
+	// SCEP cert/key
+	func() {
+		log.Println("Open DB for SCEP cert and key")
+		bboltDB, err := bbolt.Open(*flDB, 0o600, nil)
+		if err != nil {
+			log.Fatal(err)
+		}
+		defer bboltDB.Close()
+
+		scepBoltDepot, err := scepdepot.NewBoltDepot(bboltDB)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		key, err := scepBoltDepot.CreateOrLoadKey(2048)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		crt, err := scepBoltDepot.CreateOrLoadCA(key, 5, "MicroMDM", "US")
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		privateKeyBytes := x509.MarshalPKCS1PrivateKey(key)
+		privateKeyPEM := pem.EncodeToMemory(&pem.Block{
+			Type:  "RSA PRIVATE KEY",
+			Bytes: privateKeyBytes,
+		})
+
+		if err := os.WriteFile("scep.key", privateKeyPEM, 0o600); err != nil {
+			log.Fatal(err)
+		}
+
+		certPEM := pem.EncodeToMemory(&pem.Block{
+			Type:  "CERTIFICATE",
+			Bytes: crt.Raw,
+		})
+
+		if err := os.WriteFile("scep.cert", certPEM, 0o600); err != nil {
+			log.Fatal(err)
+		}
+
+		log.Println("Wrote SCEP cert/key to scep.cert/scep.key")
+	}()
+}
diff --git a/tools/mdm/windows/bitlocker/go.mod b/tools/mdm/windows/bitlocker/go.mod
index 56c33b3236af..56ee33f9d039 100755
--- a/tools/mdm/windows/bitlocker/go.mod
+++ b/tools/mdm/windows/bitlocker/go.mod
@@ -1,6 +1,6 @@
 module bitlocker
 
-go 1.22.4
+go 1.23.1
 
 require github.com/go-ole/go-ole v1.3.0
 
diff --git a/tools/mysql-replica-testing/docker-compose.yml b/tools/mysql-replica-testing/docker-compose.yml
index 534874c26510..f5f4ab91c2f7 100644
--- a/tools/mysql-replica-testing/docker-compose.yml
+++ b/tools/mysql-replica-testing/docker-compose.yml
@@ -2,7 +2,7 @@
 version: "2"
 services:
   mysql_main:
-    image: ${FLEET_MYSQL_IMAGE:-mysql:5.7}
+    image: ${FLEET_MYSQL_IMAGE:-mysql:8.0.36}
     platform: ${FLEET_MYSQL_PLATFORM:-linux/x86_64}
     volumes:
       - mysql-persistent-volume-replica-main:/tmp
@@ -27,7 +27,7 @@ services:
       - "3308:3306"
 
   mysql_read_replica:
-    image: ${FLEET_MYSQL_IMAGE:-mysql:5.7}
+    image: ${FLEET_MYSQL_IMAGE:-mysql:8.0.36}
     platform: ${FLEET_MYSQL_PLATFORM:-linux/x86_64}
     volumes:
       - mysql-persistent-volume-replica-read:/tmp
diff --git a/tools/osquery/in-a-box/docker-compose.yml b/tools/osquery/in-a-box/docker-compose.yml
index 7d7d1a3483f1..146a2be17296 100644
--- a/tools/osquery/in-a-box/docker-compose.yml
+++ b/tools/osquery/in-a-box/docker-compose.yml
@@ -8,7 +8,7 @@ networks:
 
 services:
   mysql01:
-    image: mysql:5.7
+    image: mysql:8.0.36
     platform: linux/x86_64
     volumes:
       - .:/data
diff --git a/tools/percona/test/upgrade.sh b/tools/percona/test/upgrade.sh
index 62fafa6b2861..f1a01d6108e1 100755
--- a/tools/percona/test/upgrade.sh
+++ b/tools/percona/test/upgrade.sh
@@ -12,7 +12,7 @@ docker volume rm fleet_mysql-persistent-volume
 
 # Start dependencies using Percona XtraDB as MySQL server.
 # NOTE: To troubleshoot, remove `>/dev/null`.
-FLEET_MYSQL_IMAGE=percona/percona-xtradb-cluster:5.7.25 docker compose up >/dev/null 2>&1 &
+FLEET_MYSQL_IMAGE=percona/percona-xtradb-cluster:8.0.36 docker compose up >/dev/null 2>&1 &
 
 export MYSQL_PWD=toor
 
@@ -39,4 +39,4 @@ mysql --host 127.0.0.1 --port 3306 -uroot -e 'SET GLOBAL pxc_strict_mode=ENFORCI
 # Run migrations from fleet-v4.42.0 up to latest to catch any future bugs when running with `pxc_strict_mode=ENFORCING`.
 git checkout main
 make generate && make fleet
-./build/fleet prepare db --dev --logging_debug
\ No newline at end of file
+./build/fleet prepare db --dev --logging_debug
diff --git a/tools/release/README.md b/tools/release/README.md
index 899263c148f0..b2b1e0dbb7f3 100644
--- a/tools/release/README.md
+++ b/tools/release/README.md
@@ -67,7 +67,7 @@ LinkedIn post: https://www.linkedin.com/feed/update/urn:li:activity:719950989670
 ...
 
 
-## Patch Release (end of week / critical)
+## Patch Release (middle of sprint / critical)
 
 example
 ```
diff --git a/tools/release/publish_release.sh b/tools/release/publish_release.sh
index 81503d79a8d1..6aec1605e749 100755
--- a/tools/release/publish_release.sh
+++ b/tools/release/publish_release.sh
@@ -628,6 +628,8 @@ start_ver_tag=fleet-$start_version
 
 if [[ "$minor" == "true" ]]; then
     echo "Minor release from $start_version to $next_ver"
+    # For scheduled minor releases, we want to branch off of main
+    start_ver_tag="main"
 else
     echo "Patch release from $start_version to $next_ver"
 fi
@@ -699,7 +701,7 @@ if [ "$cherry_pick_resolved" = "false" ]; then
         git checkout $start_ver_tag
         git pull origin $start_ver_tag
     else
-        echo "DRYRUN: Would have checked out starting tag $start_ver_tag"
+        echo "DRYRUN: Would have checked out starting at $start_ver_tag"
     fi
 
     local_exists=$(git branch | $GREP_CMD $target_branch)
@@ -730,7 +732,7 @@ if [ "$cherry_pick_resolved" = "false" ]; then
         prs_for_issue=$(gh api repos/fleetdm/fleet/issues/$issue/timeline --paginate | jq -r '.[]' | $GREP_CMD "fleetdm/fleet/" | $GREP_CMD -oP "pulls\/\K(?:\d+)")
         echo -n "https://github.com/fleetdm/fleet/issues/$issue"
         if [[ "$prs_for_issue" == "" ]]; then
-            echo -n " NO PR's found, please verify they are not missing in the issue, if no PR's were required for this ticket please reconsider adding it to this release."
+            echo -n " - No PRs found, please verify they are not missing in the issue."
         fi
         for val in $prs_for_issue; do
             echo -n " $val"
@@ -849,7 +851,7 @@ if [[ "$failed" == "false" ]]; then
         echo "DRYRUN: Would have switched back to branch $target_branch"
     fi
 
-    if [[ "$minor" == "false" ]]; then
+    if [[ "$dry_run" = "false" && "$minor" == "false" ]]; then
         # Cherry-pick from update-changelog-branch
         ch_commit=$(git log -n 1 --pretty=format:"%H" $update_changelog_branch)
         git cherry-pick $ch_commit
diff --git a/tools/terraform/go.mod b/tools/terraform/go.mod
index 27d6ebca102c..98d450eacccf 100644
--- a/tools/terraform/go.mod
+++ b/tools/terraform/go.mod
@@ -1,6 +1,6 @@
 module terraform-provider-fleetdm
 
-go 1.22.4
+go 1.23.1
 
 require (
 	github.com/hashicorp/terraform-plugin-framework v1.7.0
diff --git a/tools/test-certs/README.md b/tools/test-certs/README.md
new file mode 100644
index 000000000000..8265b44f43b0
--- /dev/null
+++ b/tools/test-certs/README.md
@@ -0,0 +1,57 @@
+# test-certs
+
+This directory contains a fake certificate chain to test TLS functionality in `fleet`, `fleetctl` and `fleetd`.
+
+> The certificates were generated using the following guide: [OpenSSL create certificate chain](https://www.golinuxcloud.com/openssl-create-certificate-chain-linux/#Step_6_Generate_and_sign_server_certificate_using_Intermediate_CA)
+
+## Directories
+
+### root-ca directory
+
+Contains a self-signed certificate considered as the "root CA" certificate.
+
+### intermediate-ca directory
+
+Contains a certificate signed by the "root CA" and considered as the "intermediate CA" certificate.
+Additionaly contains a `intermediate-and-root.cert.pem` which contains `intermediate.cert.pem` + `root-ca.cert.pem`.
+
+### server
+
+Contains a server certificate signed by the "intermediate CA" certificate.
+
+Contains certificates that can be used by a Fleet server:
+- `server.key.pem`: TLS server private key.
+- `leaf.cert.pem`: TLS server certificate alone.
+- `leaf-and-intermediate.cert.pem`: Contains `leaf.cert.pem` + `intermediate.cert.pem`.
+- `fullchain.cert.pem`: Contains `leaf.cert.pem` + `intermediate-ca.cert.pem` + `root-ca.crt.pem`.
+
+## Usage
+
+Run the Fleet server with the leaf certificate only:
+```sh
+fleet serve --dev --dev_license \
+    --server_cert ./tools/test-certs/server/leaf.cert.pem \
+    --server_key ./tools/test-certs/server/server.key.pem \
+    --logging_debug
+```
+
+You will see that `fleetctl debug connection` will fail if only pinning the `root-ca.cert.pem` (because TLS client doesn't know about the intermediate certificate):
+```sh
+fleetctl debug connection \
+    --fleet-certificate ./tools/test-certs/root-ca/root-ca.cert.pem \
+    https://localhost:8080
+Debugging connection to localhost; Configuration context: none - using provided address; Root CA: ./tools/test-certs/root-ca/root-ca.cert.pem; TLS: secure.
+Success: can resolve host localhost.
+Success: can dial server at localhost:8080.
+Error: Fail: certificate: dial for validate: verify certificate: x509: certificate signed by unknown authority
+```
+
+And `fleetctl debug connection` will succeed if pinning with `intermediate-and-root.cert.pem`:
+```sh
+fleetctl debug connection --fleet-certificate ./tools/test-certs/intermediate-ca/intermediate-and-root.cert.pem https://localhost:8080
+Debugging connection to localhost; Configuration context: none - using provided address; Root CA: ./tools/test-certs/intermediate-ca/intermediate-and-root.cert.pem; TLS: secure.
+Success: can resolve host localhost.
+Success: can dial server at localhost:8080.
+Success: TLS certificate seems valid.
+Success: agent API endpoints are available.
+```
diff --git a/tools/test-certs/intermediate-ca/intermediate-and-root.cert.pem b/tools/test-certs/intermediate-ca/intermediate-and-root.cert.pem
new file mode 100644
index 000000000000..c65169b56fc7
--- /dev/null
+++ b/tools/test-certs/intermediate-ca/intermediate-and-root.cert.pem
@@ -0,0 +1,67 @@
+-----BEGIN CERTIFICATE-----
+MIIFxDCCA6ygAwIBAgICEAAwDQYJKoZIhvcNAQELBQAweTELMAkGA1UEBhMCVVMx
+EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzAR
+BgNVBAoMCkZsZWV0IENvcnAxFjAUBgNVBAsMDUlUIERlcGFydG1lbnQxEDAOBgNV
+BAMMB1Jvb3QgQ0EwHhcNMjQwNzAxMjA1NzM1WhcNMzQwNjI5MjA1NzM1WjBpMQsw
+CQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTETMBEGA1UECgwKRmxlZXQg
+Q29ycDEWMBQGA1UECwwNSVQgRGVwYXJ0bWVudDEYMBYGA1UEAwwPSW50ZXJtZWRp
+YXRlIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApz8tZzhQKGuf
+h37uxFnKqmhQp3TxU5safScqnYEv9q9D3qOaqQTZOpN5RJ/gRAEldJXY+/ecTtar
++q+6RYOcvvHEi4aOtjiBh/40WH/iKIrkLB3Alut8alCbnN5clQ9JO0S38yt8zvKm
+v7ivpO3xzrszpFXPkKwH2FhMIsp/x02jSOpNV8edUiqDDMUhMypCQPXlJNAPbe7a
+vnve7dtS5zekP71aOX9f7Dt7GnyD5QFX/v1YKK6v/DTn4ax8XARP3/nsDqlIBgpf
+Fim9KB0I6kICn2HdkHbEqT0qeIM4KxMWdZlRS/BZuN/ixfqQ6XjbR5Q3nZSh7Xnh
+7inoHy2xdyl/jvhoFR6mK28dHqI9p4lJ71W8ESISAT47E6faFoUQETGr4MHXLxQW
++O1Le1j3DFWu6Z1oHkBX5oDuZ0DEFbl7ULv4IgG3rQFKGbYR9gOVfOrhkJQ2p3mF
+JQLXj+/FUPXKbZ7xrOoy8gLEwISUP8SVvfPu14UburVWKwvypNHJDxqjO7RhHVs5
+RT0gQf9Dob5e0nXTqkydNJf3v+EXAo+JFBZNRbHDpEtj+cdwPiyv1eL0nOMaY/+W
+0TbMcEOsa9KtEhMPkJtsplQXkYWV857PpKmMQlvTorhrnLRu4xPS9NFFaem5ifk4
+GNLNqKMXSuIEbgXAsk2zwnoWCp1DmskCAwEAAaNmMGQwHQYDVR0OBBYEFCnwA3AW
+NSuuVyOLtLiEF8pv3dvRMB8GA1UdIwQYMBaAFOIe3oTS4S/G93vZZAl+4rBhL0t4
+MBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB
+CwUAA4ICAQACgRWdsaLg9ck4B6yvfgH/wr/n0nEa8A7LQ9GS+9wv3MC1PSdb2tVk
+wobNJaZ3CErLc0B8dZRLVchaGRB6B5qbZ9Hn9O7oZ0DxMDI8VqfcpntxkD48bXHh
+7in9qtlhp6jz64eAxJQdcfMxMo6j/b3Lb5CP18b9+vszM42i+xA053rGQOin9Tba
+Dd6WcvzPlkoT4UH0ue3Le5Bh/Gj+coadSjnTU+NKGTBAj7KbwlKEEHaMUsnMeXE8
+4HTV8MniU4kAJURFzO6J0aNL5cLw2DeBEwN9IqACjcWcH7wKiKTucYBbh97VMFjz
+9JVn3cpp/8Sm5nHO1Kkh2SlE7JrNJ6/4nl3wsbGrN1KkOfewM1sr+8MlnhY+vrum
+qq3kRu1RYkMYClSBTKG5T5sBFQS78ZFyKj8r8QDAuEc5e3oiFb8CmpFFNlCtPZLJ
+h8x0mGRigXuOnVrCvybJ6VL0L2rerFCD3TKVNLrFxpcIeekE5KDBSzz4OcGBSnwL
+lkehxFILgiVDSRJhOZEdUw+GZr5Z8/RpPs4U0klKG3LhKja2JPjipGKsgbyav2h4
+HVJ7xFooR83AOHsZ3Fz3OW8x8zW1sa9n2r0I7GWSh5IlOduz/aHtQeaHslud1K/C
+sRw4WWk1ZPwhpbrn0nIpzzcazuHsKUDXhXEagYneMP2k0i3L0Do+Uw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF4zCCA8ugAwIBAgIUUks7Gsqte+/eGnuhSdV73j4d1HQwDQYJKoZIhvcNAQEL
+BQAweTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcM
+DVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCkZsZWV0IENvcnAxFjAUBgNVBAsMDUlU
+IERlcGFydG1lbnQxEDAOBgNVBAMMB1Jvb3QgQ0EwHhcNMjQwNzAxMjA1MjI0WhcN
+NDQwNjI2MjA1MjI0WjB5MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5p
+YTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzETMBEGA1UECgwKRmxlZXQgQ29ycDEW
+MBQGA1UECwwNSVQgRGVwYXJ0bWVudDEQMA4GA1UEAwwHUm9vdCBDQTCCAiIwDQYJ
+KoZIhvcNAQEBBQADggIPADCCAgoCggIBAK2MbKqYL3sYv5ESIp/AB5UwKUYpRDgu
+PusQmeFZe/2inqusc1xZd2azSU8N5ehFtFqKVeMj1wEiNDRsgM7gD375oZ7e3q9p
+U3Jav90c+Rpn6RPIpC7TaqTEcy+YHZvGZO6qGVBIQ0oqECvTrodsO7AtXXIt9rl2
+9VruihgnojiRHIsUTd4wczbeJ8QiyzXPzC7NQ2+HHoGvWuqajAwjGH0sqBNGqLQg
+Ev8DXuoXrNHUtKiiRzE4s0XwfyPzXrJrse6Tv/7vjs9nuthHCZvX/dsTCgSpaWt+
+qTQzcbbeA1ck2CrGPGsfu+bVrgoZvOkGZs6ARh4wCBreWmc1Ov8mZjTu8x8TpNg+
+VoWuqFqzqx/mXhptNZAwC1nLqafCxrDkRHP5QwoXJMtJkBAQySgZCAtwQmeIoe5v
+83iLk4v4SrrTnnkipT9Jd+PyHIf/0qs0IVn9uAvWkElNVIUN5tUu0Bqe9HYKQAyI
+NqcmaFrmvDq/dFb7EFUAldxK3mhVESFoFkFdU7V13af62LnfU2Ra2ckepRzSD2Bg
+46+UGGpww0NcPRr8VWCy+gNLCLsZc+vcTsGFzimz4Uwi5GnDIc6z+4FARkZO8oJI
+/nbTgEF9muORTrg+VPz7isY0ysAqo/Yt6Z+7RfVwMvv4JS2Ucwe9PtpkzyfDCN5c
+1WSrojOUtf79AgMBAAGjYzBhMB0GA1UdDgQWBBTiHt6E0uEvxvd72WQJfuKwYS9L
+eDAfBgNVHSMEGDAWgBTiHt6E0uEvxvd72WQJfuKwYS9LeDAPBgNVHRMBAf8EBTAD
+AQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAgEAB9eUyN9PaKe5
+8x+hYgSLmtxCan1Jr3do8b8xqu+n8zYATDYnX91MdjXCbFhHcoVhobSvxGM5kngI
+o6b4IsN62OZ0liKmgBxfpfJZjdr9HycZSGd8LTh6YoLlJPwSW1UHFmtSWRiRaiNE
+E3ltyxxi6hULFWbQGYA5hQ+P3uFovlJjJ+fPCCImYpuu6PjK1dlj8Cr2o6l6v3/1
+lBr/wtUGQtZj36WCLdThSlQ2JiySporxzcuX2yhYXheMdUyS7pkzbljiJCKLXCle
+6Dmf/iiYkREUgTpN7NQjAL7Kqyz3/r5GFBMvkZazn8ZClGtnhzJ9QTJYnAW5tZ8h
+HPNHEQ6kZdZZ85GoD+n8xPGkXnueLytipGZgQMLgltivUFIghC8W1ryN3qwky1dE
+rpYMXylRVkyFTlXczOmVlxqkTVsDweV+m+d+hpDtrfY56ejQi0lA3B80xPFw80wl
+otdxDyh6PvRhOntqm/BpaJUGhWpvniw4HFyh4N6LX4xvG53yg+T9PBGJI6qnq2dL
+R3Y6Gh210YeBI2QboiCbXo3vg8Q2FfPB28ZYIZDMpPtSl7T4rKctOYmHHSnUYLlU
+/oJy25BAZG8ooMzSDQS392swuPyaSMNxadMyQSLHEyY1XxAS9PDhRZpjkrH5LeS7
+hod77hybyQkF+EEe6YmVDj1/WrPMRZo=
+-----END CERTIFICATE-----
diff --git a/tools/test-certs/intermediate-ca/intermediate.cert.pem b/tools/test-certs/intermediate-ca/intermediate.cert.pem
new file mode 100644
index 000000000000..139ecdf997a5
--- /dev/null
+++ b/tools/test-certs/intermediate-ca/intermediate.cert.pem
@@ -0,0 +1,33 @@
+-----BEGIN CERTIFICATE-----
+MIIFxDCCA6ygAwIBAgICEAAwDQYJKoZIhvcNAQELBQAweTELMAkGA1UEBhMCVVMx
+EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzAR
+BgNVBAoMCkZsZWV0IENvcnAxFjAUBgNVBAsMDUlUIERlcGFydG1lbnQxEDAOBgNV
+BAMMB1Jvb3QgQ0EwHhcNMjQwNzAxMjA1NzM1WhcNMzQwNjI5MjA1NzM1WjBpMQsw
+CQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTETMBEGA1UECgwKRmxlZXQg
+Q29ycDEWMBQGA1UECwwNSVQgRGVwYXJ0bWVudDEYMBYGA1UEAwwPSW50ZXJtZWRp
+YXRlIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApz8tZzhQKGuf
+h37uxFnKqmhQp3TxU5safScqnYEv9q9D3qOaqQTZOpN5RJ/gRAEldJXY+/ecTtar
++q+6RYOcvvHEi4aOtjiBh/40WH/iKIrkLB3Alut8alCbnN5clQ9JO0S38yt8zvKm
+v7ivpO3xzrszpFXPkKwH2FhMIsp/x02jSOpNV8edUiqDDMUhMypCQPXlJNAPbe7a
+vnve7dtS5zekP71aOX9f7Dt7GnyD5QFX/v1YKK6v/DTn4ax8XARP3/nsDqlIBgpf
+Fim9KB0I6kICn2HdkHbEqT0qeIM4KxMWdZlRS/BZuN/ixfqQ6XjbR5Q3nZSh7Xnh
+7inoHy2xdyl/jvhoFR6mK28dHqI9p4lJ71W8ESISAT47E6faFoUQETGr4MHXLxQW
++O1Le1j3DFWu6Z1oHkBX5oDuZ0DEFbl7ULv4IgG3rQFKGbYR9gOVfOrhkJQ2p3mF
+JQLXj+/FUPXKbZ7xrOoy8gLEwISUP8SVvfPu14UburVWKwvypNHJDxqjO7RhHVs5
+RT0gQf9Dob5e0nXTqkydNJf3v+EXAo+JFBZNRbHDpEtj+cdwPiyv1eL0nOMaY/+W
+0TbMcEOsa9KtEhMPkJtsplQXkYWV857PpKmMQlvTorhrnLRu4xPS9NFFaem5ifk4
+GNLNqKMXSuIEbgXAsk2zwnoWCp1DmskCAwEAAaNmMGQwHQYDVR0OBBYEFCnwA3AW
+NSuuVyOLtLiEF8pv3dvRMB8GA1UdIwQYMBaAFOIe3oTS4S/G93vZZAl+4rBhL0t4
+MBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB
+CwUAA4ICAQACgRWdsaLg9ck4B6yvfgH/wr/n0nEa8A7LQ9GS+9wv3MC1PSdb2tVk
+wobNJaZ3CErLc0B8dZRLVchaGRB6B5qbZ9Hn9O7oZ0DxMDI8VqfcpntxkD48bXHh
+7in9qtlhp6jz64eAxJQdcfMxMo6j/b3Lb5CP18b9+vszM42i+xA053rGQOin9Tba
+Dd6WcvzPlkoT4UH0ue3Le5Bh/Gj+coadSjnTU+NKGTBAj7KbwlKEEHaMUsnMeXE8
+4HTV8MniU4kAJURFzO6J0aNL5cLw2DeBEwN9IqACjcWcH7wKiKTucYBbh97VMFjz
+9JVn3cpp/8Sm5nHO1Kkh2SlE7JrNJ6/4nl3wsbGrN1KkOfewM1sr+8MlnhY+vrum
+qq3kRu1RYkMYClSBTKG5T5sBFQS78ZFyKj8r8QDAuEc5e3oiFb8CmpFFNlCtPZLJ
+h8x0mGRigXuOnVrCvybJ6VL0L2rerFCD3TKVNLrFxpcIeekE5KDBSzz4OcGBSnwL
+lkehxFILgiVDSRJhOZEdUw+GZr5Z8/RpPs4U0klKG3LhKja2JPjipGKsgbyav2h4
+HVJ7xFooR83AOHsZ3Fz3OW8x8zW1sa9n2r0I7GWSh5IlOduz/aHtQeaHslud1K/C
+sRw4WWk1ZPwhpbrn0nIpzzcazuHsKUDXhXEagYneMP2k0i3L0Do+Uw==
+-----END CERTIFICATE-----
diff --git a/tools/test-certs/intermediate-ca/intermediate.key.pem b/tools/test-certs/intermediate-ca/intermediate.key.pem
new file mode 100644
index 000000000000..baed9d9f52b9
--- /dev/null
+++ b/tools/test-certs/intermediate-ca/intermediate.key.pem
@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCnPy1nOFAoa5+H
+fu7EWcqqaFCndPFTmxp9JyqdgS/2r0Peo5qpBNk6k3lEn+BEASV0ldj795xO1qv6
+r7pFg5y+8cSLho62OIGH/jRYf+IoiuQsHcCW63xqUJuc3lyVD0k7RLfzK3zO8qa/
+uK+k7fHOuzOkVc+QrAfYWEwiyn/HTaNI6k1Xx51SKoMMxSEzKkJA9eUk0A9t7tq+
+e97t21LnN6Q/vVo5f1/sO3safIPlAVf+/Vgorq/8NOfhrHxcBE/f+ewOqUgGCl8W
+Kb0oHQjqQgKfYd2QdsSpPSp4gzgrExZ1mVFL8Fm43+LF+pDpeNtHlDedlKHteeHu
+KegfLbF3KX+O+GgVHqYrbx0eoj2niUnvVbwRIhIBPjsTp9oWhRARMavgwdcvFBb4
+7Ut7WPcMVa7pnWgeQFfmgO5nQMQVuXtQu/giAbetAUoZthH2A5V86uGQlDaneYUl
+AteP78VQ9cptnvGs6jLyAsTAhJQ/xJW98+7XhRu6tVYrC/Kk0ckPGqM7tGEdWzlF
+PSBB/0Ohvl7SddOqTJ00l/e/4RcCj4kUFk1FscOkS2P5x3A+LK/V4vSc4xpj/5bR
+NsxwQ6xr0q0SEw+Qm2ymVBeRhZXzns+kqYxCW9OiuGuctG7jE9L00UVp6bmJ+TgY
+0s2ooxdK4gRuBcCyTbPCehYKnUOayQIDAQABAoICAA/RB+RcQn8NbTOoBkDtHvSj
+qIZVpwxEPaqP/YCSEEJQ4Txua3jIMRpQNRE6L2rZqDxQ1DRBU/fEEdVDhib/IzU5
+nF/3lIqDaIM/FUiN+4o1rGNxrYjNnLavMzA6z+BMPEg4dPmwZ1K+RupttwquyAXy
+1UJELTzeJWBz5UC1ttosgPXV1q+npzyh3EKPvVaJ4g8jp2J7sgyFoLaP9LgOMau/
+1YQuTkM5b7hhswArvgt2Z5HWorOM5a7BJXFwWahtbfeyunzJIeW/AwQPuXL63/Yg
+0lUBW9icKs1jL/TgBVFUMkpieqTnBjfXeypESoJnQBGSYPoW7YNjBJdR65ZQlhjq
+w1hkYVZtLslp8THwaH4OByFHX6AM3RE6wgQQF2HxcTToyVkykG4TftJJgJjSSvD6
+Fic5be1paDg4eOsC4Sxmu9fkutR1Q/AkUCmsu5mGzA/UzPJUyXjbI4Fd7E0WJpf3
+JU3J2SLU4CjNBrLmvZkcdOyC7woACsR9CjkccUax1ZS5d1oTXHf/gF+tzbn8BU+k
+ew4loXP2XIZ3R3HOgxYcXDrDoATzxzVUPyKdk9PG+/IPoxjKcUvswseovUqYP7PG
+U7b/5jt3EHUOJ9osWhPQRrZgZZlIpPnXEHkJ9lQk27mWmFtMFaKLzqBMN9JdVvbR
+73UfOE8LiXmgBG2KexeLAoIBAQDfm1M4wWkpwUOXFblZdsEDGPc2hcnIPu6xKbCC
+tKm9h4LCHe2t4XNd5MuE49idtzEzvcBnF6MWohRS3zmZJ0RuFMf1B9ZaxIbQ2aNA
+RUdSGdBum9siCdJ1Ej2zhnigqQvi9vK6w+sDgBc2EmiRLaxH7yN/SmCSqHsPFZfo
+DymcfX/761S0dxWq+eD0n1VVKgSsDGGbidRf3Njhlkfw4ECOlyw5IZxwv4nNckWc
+0tmL01ZhM5yJeCubvduVvsjrMosUkrpQSCQZjBnr/U6rxVC0bQoSU3Wl4j3zaY2i
+oqsLbEZXzli81IwHyOzzedKQN+EwunHrGYJ92mEvt1kpAJaHAoIBAQC/ebAw8okv
+HkDYnc4QNL7A9deykhoyx57NO0qekhbkt0c4Qea3ul2aFeD7DGMQkTxiLCUlqYwv
+9KIl+LrZggpcYyfjC1CZD9pZphx5pLBNMslGDiJ5WYERWTm8hserJpBM3motYXoy
+FIh8PewV/lJ4kSrgcFrClmsaZHnjpo0U6iOtb9nyCLDcNwbmTG9UJz6ImM/d2asy
+IVCFIOYUSofloOGcvnuLe1wSb6zahvo8L3+EZ5fjhqeimECDiwqHyszBuzRYHRh0
+I78RtCfs6/5z9NuShWKN6Gyb4hPs7ouuVajIJydaAIlugTzleFbeelHbYX+jf6Pp
+hOs8JSV4HkgvAoIBAQCk5B2SlM3ABMya9WIhHvlmF1r10eLiz8Wkz2FigWdKZEuA
+aiGDP+WbL8UE0iBC7XxS83KWk0+ouQzTr9kBn3tO0fRCNO1VMedYy6UfF/doC7Ew
+X65Qg3225ySo5li94OrrC8AjCaachjCXpyuFI3EP+sDqdSaR/7v/e6Txc3zz8XgX
+hYqJKefIlUvWGEkM7FdVqCuyTwlVR76HXBLhBf2VKNVrq+V5H0W3QrUi2Dmkaswg
+Ebc1iHBgALmUy4POLQ9ytGDAIvK8BBx5ceo5sN+6rU3oBbOUCCo2/Xd8nwgS/F1D
+Et9NIE/CzeAuC3/C6fIdxN+Mxtr7g7Z3QXV2TwCxAoIBAEmUGYC1ssHIfmK/QVA4
+9JRx5FFak3av/vYesq38tY9uXo/fwykXFKEBh1Lxj5/uL6YKELxISvaiqyysSCEN
+N64I7GrzDiXDUcThcE/OWXFQ8sdY5yZ6nn5sKyOnJ1M9nnXrgiGuM6bK/SfBI9fP
+wyFRp4hXpIjiBIY/1hcFCXHgB5W+RaIcdNoqyxv0g1NzQTR8hGRcIM1CwA5odgGW
+ImK7T/dLu23+GYN8JpBTDhXSqs3WgSeNtx1kJGZoJ8PGyqgnqBW0GJGIqwPClxUU
+GtO0ZCwJ1bVye0nrtnx1rndvs0w2v4h2bFlqkFwdwkP7/TiwXrwVcIdr7HlQTPW7
+rUECggEBANxz5pevEmXfSjBoC7rFIcqNrZKfCtL8UkM83VHmfGRbkH5/i2prhlc7
+UFXuZjPifStb3YsB60bIhnTPU/ki4jl21XPHROxcdJ77/2NcmGerqhBMDnJCw0/8
+YuW1LtBjcPwmRCOXVbxqe+VRMLzNS7L2Sg99DoGkhCt1Re6j0Xwk7Sr0cEuyQCwS
+KMtb2ug8pIRhVXzTYF/z607Y8Ovy9fxreF2SiPjQXttAWPkYXWwK22Vqd783Sbjr
+epwTiAdubBA6rkv2gj30c6HsBEXzNYk9X9+WYvr9PRCIwBdKQJpCLNZ99VwOpA3K
+X4IQLGEuORWbifkdEc/BLO5dYoBmgo4=
+-----END PRIVATE KEY-----
diff --git a/tools/test-certs/root-ca/root-ca.cert.pem b/tools/test-certs/root-ca/root-ca.cert.pem
new file mode 100644
index 000000000000..0495b6e2f4d4
--- /dev/null
+++ b/tools/test-certs/root-ca/root-ca.cert.pem
@@ -0,0 +1,34 @@
+-----BEGIN CERTIFICATE-----
+MIIF4zCCA8ugAwIBAgIUUks7Gsqte+/eGnuhSdV73j4d1HQwDQYJKoZIhvcNAQEL
+BQAweTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcM
+DVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCkZsZWV0IENvcnAxFjAUBgNVBAsMDUlU
+IERlcGFydG1lbnQxEDAOBgNVBAMMB1Jvb3QgQ0EwHhcNMjQwNzAxMjA1MjI0WhcN
+NDQwNjI2MjA1MjI0WjB5MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5p
+YTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzETMBEGA1UECgwKRmxlZXQgQ29ycDEW
+MBQGA1UECwwNSVQgRGVwYXJ0bWVudDEQMA4GA1UEAwwHUm9vdCBDQTCCAiIwDQYJ
+KoZIhvcNAQEBBQADggIPADCCAgoCggIBAK2MbKqYL3sYv5ESIp/AB5UwKUYpRDgu
+PusQmeFZe/2inqusc1xZd2azSU8N5ehFtFqKVeMj1wEiNDRsgM7gD375oZ7e3q9p
+U3Jav90c+Rpn6RPIpC7TaqTEcy+YHZvGZO6qGVBIQ0oqECvTrodsO7AtXXIt9rl2
+9VruihgnojiRHIsUTd4wczbeJ8QiyzXPzC7NQ2+HHoGvWuqajAwjGH0sqBNGqLQg
+Ev8DXuoXrNHUtKiiRzE4s0XwfyPzXrJrse6Tv/7vjs9nuthHCZvX/dsTCgSpaWt+
+qTQzcbbeA1ck2CrGPGsfu+bVrgoZvOkGZs6ARh4wCBreWmc1Ov8mZjTu8x8TpNg+
+VoWuqFqzqx/mXhptNZAwC1nLqafCxrDkRHP5QwoXJMtJkBAQySgZCAtwQmeIoe5v
+83iLk4v4SrrTnnkipT9Jd+PyHIf/0qs0IVn9uAvWkElNVIUN5tUu0Bqe9HYKQAyI
+NqcmaFrmvDq/dFb7EFUAldxK3mhVESFoFkFdU7V13af62LnfU2Ra2ckepRzSD2Bg
+46+UGGpww0NcPRr8VWCy+gNLCLsZc+vcTsGFzimz4Uwi5GnDIc6z+4FARkZO8oJI
+/nbTgEF9muORTrg+VPz7isY0ysAqo/Yt6Z+7RfVwMvv4JS2Ucwe9PtpkzyfDCN5c
+1WSrojOUtf79AgMBAAGjYzBhMB0GA1UdDgQWBBTiHt6E0uEvxvd72WQJfuKwYS9L
+eDAfBgNVHSMEGDAWgBTiHt6E0uEvxvd72WQJfuKwYS9LeDAPBgNVHRMBAf8EBTAD
+AQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAgEAB9eUyN9PaKe5
+8x+hYgSLmtxCan1Jr3do8b8xqu+n8zYATDYnX91MdjXCbFhHcoVhobSvxGM5kngI
+o6b4IsN62OZ0liKmgBxfpfJZjdr9HycZSGd8LTh6YoLlJPwSW1UHFmtSWRiRaiNE
+E3ltyxxi6hULFWbQGYA5hQ+P3uFovlJjJ+fPCCImYpuu6PjK1dlj8Cr2o6l6v3/1
+lBr/wtUGQtZj36WCLdThSlQ2JiySporxzcuX2yhYXheMdUyS7pkzbljiJCKLXCle
+6Dmf/iiYkREUgTpN7NQjAL7Kqyz3/r5GFBMvkZazn8ZClGtnhzJ9QTJYnAW5tZ8h
+HPNHEQ6kZdZZ85GoD+n8xPGkXnueLytipGZgQMLgltivUFIghC8W1ryN3qwky1dE
+rpYMXylRVkyFTlXczOmVlxqkTVsDweV+m+d+hpDtrfY56ejQi0lA3B80xPFw80wl
+otdxDyh6PvRhOntqm/BpaJUGhWpvniw4HFyh4N6LX4xvG53yg+T9PBGJI6qnq2dL
+R3Y6Gh210YeBI2QboiCbXo3vg8Q2FfPB28ZYIZDMpPtSl7T4rKctOYmHHSnUYLlU
+/oJy25BAZG8ooMzSDQS392swuPyaSMNxadMyQSLHEyY1XxAS9PDhRZpjkrH5LeS7
+hod77hybyQkF+EEe6YmVDj1/WrPMRZo=
+-----END CERTIFICATE-----
diff --git a/tools/test-certs/root-ca/root-ca.key.pem b/tools/test-certs/root-ca/root-ca.key.pem
new file mode 100644
index 000000000000..98a7f767c434
--- /dev/null
+++ b/tools/test-certs/root-ca/root-ca.key.pem
@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCtjGyqmC97GL+R
+EiKfwAeVMClGKUQ4Lj7rEJnhWXv9op6rrHNcWXdms0lPDeXoRbRailXjI9cBIjQ0
+bIDO4A9++aGe3t6vaVNyWr/dHPkaZ+kTyKQu02qkxHMvmB2bxmTuqhlQSENKKhAr
+066HbDuwLV1yLfa5dvVa7ooYJ6I4kRyLFE3eMHM23ifEIss1z8wuzUNvhx6Br1rq
+mowMIxh9LKgTRqi0IBL/A17qF6zR1LSookcxOLNF8H8j816ya7Huk7/+747PZ7rY
+Rwmb1/3bEwoEqWlrfqk0M3G23gNXJNgqxjxrH7vm1a4KGbzpBmbOgEYeMAga3lpn
+NTr/JmY07vMfE6TYPlaFrqhas6sf5l4abTWQMAtZy6mnwsaw5ERz+UMKFyTLSZAQ
+EMkoGQgLcEJniKHub/N4i5OL+Eq60555IqU/SXfj8hyH/9KrNCFZ/bgL1pBJTVSF
+DebVLtAanvR2CkAMiDanJmha5rw6v3RW+xBVAJXcSt5oVREhaBZBXVO1dd2n+ti5
+31NkWtnJHqUc0g9gYOOvlBhqcMNDXD0a/FVgsvoDSwi7GXPr3E7Bhc4ps+FMIuRp
+wyHOs/uBQEZGTvKCSP5204BBfZrjkU64PlT8+4rGNMrAKqP2Lemfu0X1cDL7+CUt
+lHMHvT7aZM8nwwjeXNVkq6IzlLX+/QIDAQABAoICAEjm9jbrWvawvLgqEBVfS1Am
+PRBWAWxAMPn5rUp2lplDGLgw5vziMEAaDC+DPRLHRS3LcqzJv2WggqGK+sjsYlYK
+cxQTtyOkcQNWj8ZIh3PKNqSy4hUxhljUlTZnBfkL7BY9qgiJcorTBJwEfgoxMxmc
+1OZD3KKoEAU0sxnWfFSa0Iyz6MnvPFbOF5JSs15VfgYi/7L35Z7AlMZ8SVxH2d+r
+RKdkRTX1S0WImvRnIZe7bHBySsmocdZtYlstvpfgmYwI0Nw8sZb6kgiMPsMShnbi
+lpDCwaAAQv/EpH4W4PxYY94EDBlL6VjcZhGkIjEZGVKhm9LOhnkS8pLsT24jKUdd
+CKTLSM87E2iwLDy9fnHppqhbL+To3GbHiJ8M3SUgb7e8DeggzX3pGiqTwX26PFtE
+PknHpRUmbUZ6gN65xaWaTGYjJ9U3gYqEbZFZh+j6KEv136WgR6NeLWPL5TrDr3a8
+3jbYy3W9pnt4eykgHw4Nvf4ScvR03A0zWrdoy/Rzlpa3SEzLzYS78R95fOaHAviz
+QwCIL5G9vRPwMcinGgBZcEJcy5K65uzLZHqnT8P7SZL+K8KTxgs4U1nuEITc1eRI
+bxAeG8n3iRNpEud3EWmKsFQPWLJfeKog4/3K2BdJrW268tS5fE6Vx7XPUHu+/0QY
+Qzrq2uZf2dlJDxx51lIZAoIBAQDqgaWk2KRBx5GoUAq48p6Cdm26VB/JdOCn5B2z
+3zYN4qUQpSUeKz2+5wDdOk2LTWX8oilDchA6BglQwHPJVtmQb3pB4JR44KQsq3RJ
+oQB2c5z0KitmtlY+H7q/KEx6Tjcz5rlM0hZ1ceoT6IpFv1yVnPV1qEGJt4CTY8Q7
+Zs0uUZva61/PdR0j72OJNO6neVfQxedmHjgwAX8bzdggt5j3Kp0cXIqWuKQutF/e
+hetGdEAFNk803EnWomr09WLyEZ6RJaQJHwI+XYoAHEC9gCg+wcC6SEOn3a0E03yd
+CBkiCuSECR5H/sFteotd/uaN/WVchwoaikPBQpqPyHSmFnV7AoIBAQC9dH0ia3h7
+0V5VkDpQuZbxvu0ym87CaXg6ok84IklVb11QmdaggheNE9Bz7LjbVlo8d/9HokZd
+CO6u5mzCumGNHDUrXVo8fR5s7vyfGjESqMDK4gltZz2tBVjnf3Gd2l+JlSHwuDx5
+gE52LZjqjzHFrDLHz2EALA9I7xgLRsgOvdY8sXX0IEQUXDjMGbxa2vyebBIvqlF8
+FfgINFIRPAGy0wmcEltqaCtn0zsTjdbSxAl5UHyGfXoVXr7L/k7hheSPODX8JGZ5
+x01nOOzZ1fN388TgdKIKbZJbVcWjPUE3fnlgL1wqjm2EhsfdKZRUOAlWGgAuArF+
+ps8Q5Il0UOfnAoIBAQC6RoWnbhb70WTYR8xcoQxcIWqD6bLeOaMCeedGK/YqDXCE
+ykmzrzF65NAA6wERuEdc6ArS8lYFYSohJN5UflKPsp1wms4VPovql77lhahybt+r
+65tSGWBkNJwIoCAvvtWGuq1SYkdIv1XqvnqncJxAk88+yIpWtJbDfSow7TXqpxSg
+TvtqNWMSWmO8Z3lzOqYQxkNLEJIdP/MRyO72/h/ZpdXq42+KzdxM5SaKAeKjsk/w
+U/WSzbExdw5yykDwfCJytW2ZeTI1C+REtiyO2rAdOZa34hMr0qBPBxcjPX2JVxGx
+9/Q/yBMpvX/bCFFnVHMhjnruHgo4B4ny0I4oKArlAoIBAARK+G7oOoGru9R6gSfF
+HMt7hQpph2TWWPgTJ3JhLII4FMg3xCo86GW09js6OPIXYdIO8gTgg3GmOypRZFOB
+P6af5gCGi/3k4+SaAbVlNYlzs3KlbotBFJ+wCFSuiZeHFDUc4PkAY7ZpFt4MqHNg
+LUOKZFgstcj4NpxzdnsC7pOO76TObJrMhF5lvI+7YY45ehHo5vyXgmMqaEVfUiC7
+2FoB+CzGKbYeiCVBHwyRYTXDZWePUFMH0tVbIT2kFIt9qjEol+iPtpa50mItYwiI
+lYy5RFPFsMpFs1RIfEL3p1unjP6F9DOuqIKhPzQethK2dleyHSDtxLHW+8gpNYgi
+MS8CggEBAMCuD3b6CV4xpEneGlLXLoRQFGiSoqRUedTA8W1x6I6OS1lISE5LC8p9
+5Jh7BEeZUfbJTD6foUSXoQz3zHTIiF24wpzTvgVqJnpUHjzwghhpO/ktoVbo5FiQ
+wiwitWu71GZTT8UhaKbYgZLlrZcCtrkHBOP6k92uXk6aq53S3fIePTMGrm6Nq3Dl
+WIIKH9HlA+NEZ/QhORIhARPgW/0Tksgf57SyEUr4u49fWEQi7whtP5QozoQocJ8t
+4isVGNRTovkue5B22ljBOfvCTgcEgThmdnIMLMOkVkaL7QElDmgbr5ZYd8CIP5VH
+07Jg0YjzulVHJA7Dc1gLH3Q68M6aek0=
+-----END PRIVATE KEY-----
diff --git a/tools/test-certs/server/fullchain.cert.pem b/tools/test-certs/server/fullchain.cert.pem
new file mode 100644
index 000000000000..5a357268ef6b
--- /dev/null
+++ b/tools/test-certs/server/fullchain.cert.pem
@@ -0,0 +1,107 @@
+-----BEGIN CERTIFICATE-----
+MIIG/jCCBOagAwIBAgIUWsbGzEFjHdrmBZRsLbJ+rOMRv5UwDQYJKoZIhvcNAQEL
+BQAwaTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExEzARBgNVBAoM
+CkZsZWV0IENvcnAxFjAUBgNVBAsMDUlUIERlcGFydG1lbnQxGDAWBgNVBAMMD0lu
+dGVybWVkaWF0ZSBDQTAeFw0yNDA3MDEyMTM2NDNaFw0yNTA3MDEyMTM2NDNaMIGS
+MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEP
+MA0GA1UECgwGRm9vYmFyMRswGQYDVQQLDBJGb29iYXIgRW5naW5lZXJpbmcxEjAQ
+BgNVBAMMCWZsZWV0LmNvbTEgMB4GCSqGSIb3DQEJARYRbHVjYXNAZmxlZXRkbS5j
+b20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCcDedciGWWz82dl5nc
+MYhpjlcwg9zagLYaTMsdNTTCbD/qTBFwufonMkIMGBBrtsrLXuqq5fJUU0FoWlRQ
+vj9S7I3zv0Rp7niK0m+Uw9HKPGbAP3ZaoA6nS86N6ZyiXpcpx/gq88fBTB2Ul6W7
+f3SCa+qlErg1iSqfdIB9YAl/R4RfxtfTV1ttEwVwRS7Gsr0WjHN/+GfZUtOO5c+h
+NnzQQrF3FLa7F6MMe8RWZeyHzcnkYKfeOrPN2qrpO5Xv/pH9LN3AAV1e+LqhlZpS
+vF+nOR/awOzBxT1eSqpNPn/nHhNSr6/PeOqi0FSUQHNlHF9Rh5eNK7BPwr5Ul9u8
+EdtSx+NJzlCFIUjGwT1i8/HR6Cfq8JnjE0zBiNTqykp34/B873fPyFETJ/x+M52s
+jkiOB/OROUeInBf3Ae6IJq7sh1HZPf4c/jw1Onc4gn04vhrjGR0tHk57uZSPaWIJ
+n93/0VuAJTKbgME5xjWrj/n1z9NfLiFLTcMOvt5fYv7suTYPXHs73+3fWiG3zUK/
+UCbeILYAUPKau1oLCQOlctnD1N+y7GaKEUFRmazwNkFxgLeH0Q2bE7o8WI1FT/9O
+ybnUpFUVtSO9ff7U8cW8m+beJIC+jnLNcuKIT4aQB7JoqQFGYuqLHdP8rHu6/haI
+vhGYH/onig9oCms4g4DXLtQnGQIDAQABo4IBcjCCAW4wCQYDVR0TBAIwADARBglg
+hkgBhvhCAQEEBAMCBkAwLAYJYIZIAYb4QgENBB8WHUZsZWV0IFRlc3QgQ2VydGlm
+aWNhdGUgRm9vYmFyMB0GA1UdDgQWBBRNFpCOViHiyF07LamTbKEEJMqytTCBpAYD
+VR0jBIGcMIGZgBQp8ANwFjUrrlcji7S4hBfKb93b0aF9pHsweTELMAkGA1UEBhMC
+VVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28x
+EzARBgNVBAoMCkZsZWV0IENvcnAxFjAUBgNVBAsMDUlUIERlcGFydG1lbnQxEDAO
+BgNVBAMMB1Jvb3QgQ0GCAhAAMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggr
+BgEFBQcDATA1BgNVHREELjAsgglsb2NhbGhvc3SCFGhvc3QuZG9ja2VyLmludGVy
+bmFsggkxMjcuMC4wLjEwDQYJKoZIhvcNAQELBQADggIBABpFIhCNXV/LpjblszkS
+HVBFUaPkEezoiyBKEXXBUTh3MV22lYB/h86j71eBayYtKr8CeJPD249N3pTT3opC
+atxtGtKqUhB+iu8PDST+ftKBiBpAFAU/i73dyjZ8RCbzLNGI9uZv0i1YSG0FLVLh
+c+m1KuEXno6BT4PgPPPlmXa38WMlbaM57JqOGMGT2D07chL2ozUcLQm2r5RzA5p4
+jUMNTSGdj0+pn1mUSHMzqlYhmAcbbXSlFyoIlCH5eTbc083iOBLOiopumrzvyGnz
+j3lqtwKIWgEJu76nu2KGDGjO2FVwOfSFMjMTtoWnosTydgGThHW9LZqzHPjqcatJ
+A74Bqaw7OrIKYzBGYq2I2O3mxXJo5rBN3ofSFlqXeE53jRHSVJR8tPIUHZr6+nn2
+8QNOt8b+Xs7iR6wOBBzuzmMyzkxLbEb0oavyewdMUzi9cVJug22YhBqL74h5XCjT
+B3C681PDjColnWyreo2P0JJ9Os6R/2GCa7C3tCFtGAixFWIVzBv0Mf9/wYxHL+Ny
+C1IW4PyW94zTa4mAnO+5XRfdMHrSZ3qkVvWcbmCxTgxoBhLyyGwoHNDT89rbcajL
+rqsHmZhDGpkrzuomHszYpdYGcK4Ig7sp4MS4MGVdjrNiTUyIArQWMJT1GrTKpI/0
+QifPsDgb8vS7n2ZhvIpJVbrj
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFxDCCA6ygAwIBAgICEAAwDQYJKoZIhvcNAQELBQAweTELMAkGA1UEBhMCVVMx
+EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzAR
+BgNVBAoMCkZsZWV0IENvcnAxFjAUBgNVBAsMDUlUIERlcGFydG1lbnQxEDAOBgNV
+BAMMB1Jvb3QgQ0EwHhcNMjQwNzAxMjA1NzM1WhcNMzQwNjI5MjA1NzM1WjBpMQsw
+CQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTETMBEGA1UECgwKRmxlZXQg
+Q29ycDEWMBQGA1UECwwNSVQgRGVwYXJ0bWVudDEYMBYGA1UEAwwPSW50ZXJtZWRp
+YXRlIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApz8tZzhQKGuf
+h37uxFnKqmhQp3TxU5safScqnYEv9q9D3qOaqQTZOpN5RJ/gRAEldJXY+/ecTtar
++q+6RYOcvvHEi4aOtjiBh/40WH/iKIrkLB3Alut8alCbnN5clQ9JO0S38yt8zvKm
+v7ivpO3xzrszpFXPkKwH2FhMIsp/x02jSOpNV8edUiqDDMUhMypCQPXlJNAPbe7a
+vnve7dtS5zekP71aOX9f7Dt7GnyD5QFX/v1YKK6v/DTn4ax8XARP3/nsDqlIBgpf
+Fim9KB0I6kICn2HdkHbEqT0qeIM4KxMWdZlRS/BZuN/ixfqQ6XjbR5Q3nZSh7Xnh
+7inoHy2xdyl/jvhoFR6mK28dHqI9p4lJ71W8ESISAT47E6faFoUQETGr4MHXLxQW
++O1Le1j3DFWu6Z1oHkBX5oDuZ0DEFbl7ULv4IgG3rQFKGbYR9gOVfOrhkJQ2p3mF
+JQLXj+/FUPXKbZ7xrOoy8gLEwISUP8SVvfPu14UburVWKwvypNHJDxqjO7RhHVs5
+RT0gQf9Dob5e0nXTqkydNJf3v+EXAo+JFBZNRbHDpEtj+cdwPiyv1eL0nOMaY/+W
+0TbMcEOsa9KtEhMPkJtsplQXkYWV857PpKmMQlvTorhrnLRu4xPS9NFFaem5ifk4
+GNLNqKMXSuIEbgXAsk2zwnoWCp1DmskCAwEAAaNmMGQwHQYDVR0OBBYEFCnwA3AW
+NSuuVyOLtLiEF8pv3dvRMB8GA1UdIwQYMBaAFOIe3oTS4S/G93vZZAl+4rBhL0t4
+MBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB
+CwUAA4ICAQACgRWdsaLg9ck4B6yvfgH/wr/n0nEa8A7LQ9GS+9wv3MC1PSdb2tVk
+wobNJaZ3CErLc0B8dZRLVchaGRB6B5qbZ9Hn9O7oZ0DxMDI8VqfcpntxkD48bXHh
+7in9qtlhp6jz64eAxJQdcfMxMo6j/b3Lb5CP18b9+vszM42i+xA053rGQOin9Tba
+Dd6WcvzPlkoT4UH0ue3Le5Bh/Gj+coadSjnTU+NKGTBAj7KbwlKEEHaMUsnMeXE8
+4HTV8MniU4kAJURFzO6J0aNL5cLw2DeBEwN9IqACjcWcH7wKiKTucYBbh97VMFjz
+9JVn3cpp/8Sm5nHO1Kkh2SlE7JrNJ6/4nl3wsbGrN1KkOfewM1sr+8MlnhY+vrum
+qq3kRu1RYkMYClSBTKG5T5sBFQS78ZFyKj8r8QDAuEc5e3oiFb8CmpFFNlCtPZLJ
+h8x0mGRigXuOnVrCvybJ6VL0L2rerFCD3TKVNLrFxpcIeekE5KDBSzz4OcGBSnwL
+lkehxFILgiVDSRJhOZEdUw+GZr5Z8/RpPs4U0klKG3LhKja2JPjipGKsgbyav2h4
+HVJ7xFooR83AOHsZ3Fz3OW8x8zW1sa9n2r0I7GWSh5IlOduz/aHtQeaHslud1K/C
+sRw4WWk1ZPwhpbrn0nIpzzcazuHsKUDXhXEagYneMP2k0i3L0Do+Uw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF4zCCA8ugAwIBAgIUUks7Gsqte+/eGnuhSdV73j4d1HQwDQYJKoZIhvcNAQEL
+BQAweTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcM
+DVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCkZsZWV0IENvcnAxFjAUBgNVBAsMDUlU
+IERlcGFydG1lbnQxEDAOBgNVBAMMB1Jvb3QgQ0EwHhcNMjQwNzAxMjA1MjI0WhcN
+NDQwNjI2MjA1MjI0WjB5MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5p
+YTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzETMBEGA1UECgwKRmxlZXQgQ29ycDEW
+MBQGA1UECwwNSVQgRGVwYXJ0bWVudDEQMA4GA1UEAwwHUm9vdCBDQTCCAiIwDQYJ
+KoZIhvcNAQEBBQADggIPADCCAgoCggIBAK2MbKqYL3sYv5ESIp/AB5UwKUYpRDgu
+PusQmeFZe/2inqusc1xZd2azSU8N5ehFtFqKVeMj1wEiNDRsgM7gD375oZ7e3q9p
+U3Jav90c+Rpn6RPIpC7TaqTEcy+YHZvGZO6qGVBIQ0oqECvTrodsO7AtXXIt9rl2
+9VruihgnojiRHIsUTd4wczbeJ8QiyzXPzC7NQ2+HHoGvWuqajAwjGH0sqBNGqLQg
+Ev8DXuoXrNHUtKiiRzE4s0XwfyPzXrJrse6Tv/7vjs9nuthHCZvX/dsTCgSpaWt+
+qTQzcbbeA1ck2CrGPGsfu+bVrgoZvOkGZs6ARh4wCBreWmc1Ov8mZjTu8x8TpNg+
+VoWuqFqzqx/mXhptNZAwC1nLqafCxrDkRHP5QwoXJMtJkBAQySgZCAtwQmeIoe5v
+83iLk4v4SrrTnnkipT9Jd+PyHIf/0qs0IVn9uAvWkElNVIUN5tUu0Bqe9HYKQAyI
+NqcmaFrmvDq/dFb7EFUAldxK3mhVESFoFkFdU7V13af62LnfU2Ra2ckepRzSD2Bg
+46+UGGpww0NcPRr8VWCy+gNLCLsZc+vcTsGFzimz4Uwi5GnDIc6z+4FARkZO8oJI
+/nbTgEF9muORTrg+VPz7isY0ysAqo/Yt6Z+7RfVwMvv4JS2Ucwe9PtpkzyfDCN5c
+1WSrojOUtf79AgMBAAGjYzBhMB0GA1UdDgQWBBTiHt6E0uEvxvd72WQJfuKwYS9L
+eDAfBgNVHSMEGDAWgBTiHt6E0uEvxvd72WQJfuKwYS9LeDAPBgNVHRMBAf8EBTAD
+AQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAgEAB9eUyN9PaKe5
+8x+hYgSLmtxCan1Jr3do8b8xqu+n8zYATDYnX91MdjXCbFhHcoVhobSvxGM5kngI
+o6b4IsN62OZ0liKmgBxfpfJZjdr9HycZSGd8LTh6YoLlJPwSW1UHFmtSWRiRaiNE
+E3ltyxxi6hULFWbQGYA5hQ+P3uFovlJjJ+fPCCImYpuu6PjK1dlj8Cr2o6l6v3/1
+lBr/wtUGQtZj36WCLdThSlQ2JiySporxzcuX2yhYXheMdUyS7pkzbljiJCKLXCle
+6Dmf/iiYkREUgTpN7NQjAL7Kqyz3/r5GFBMvkZazn8ZClGtnhzJ9QTJYnAW5tZ8h
+HPNHEQ6kZdZZ85GoD+n8xPGkXnueLytipGZgQMLgltivUFIghC8W1ryN3qwky1dE
+rpYMXylRVkyFTlXczOmVlxqkTVsDweV+m+d+hpDtrfY56ejQi0lA3B80xPFw80wl
+otdxDyh6PvRhOntqm/BpaJUGhWpvniw4HFyh4N6LX4xvG53yg+T9PBGJI6qnq2dL
+R3Y6Gh210YeBI2QboiCbXo3vg8Q2FfPB28ZYIZDMpPtSl7T4rKctOYmHHSnUYLlU
+/oJy25BAZG8ooMzSDQS392swuPyaSMNxadMyQSLHEyY1XxAS9PDhRZpjkrH5LeS7
+hod77hybyQkF+EEe6YmVDj1/WrPMRZo=
+-----END CERTIFICATE-----
diff --git a/tools/test-certs/server/leaf-and-intermediate.cert.pem b/tools/test-certs/server/leaf-and-intermediate.cert.pem
new file mode 100644
index 000000000000..09881a2bcb7e
--- /dev/null
+++ b/tools/test-certs/server/leaf-and-intermediate.cert.pem
@@ -0,0 +1,73 @@
+-----BEGIN CERTIFICATE-----
+MIIG/jCCBOagAwIBAgIUWsbGzEFjHdrmBZRsLbJ+rOMRv5UwDQYJKoZIhvcNAQEL
+BQAwaTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExEzARBgNVBAoM
+CkZsZWV0IENvcnAxFjAUBgNVBAsMDUlUIERlcGFydG1lbnQxGDAWBgNVBAMMD0lu
+dGVybWVkaWF0ZSBDQTAeFw0yNDA3MDEyMTM2NDNaFw0yNTA3MDEyMTM2NDNaMIGS
+MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEP
+MA0GA1UECgwGRm9vYmFyMRswGQYDVQQLDBJGb29iYXIgRW5naW5lZXJpbmcxEjAQ
+BgNVBAMMCWZsZWV0LmNvbTEgMB4GCSqGSIb3DQEJARYRbHVjYXNAZmxlZXRkbS5j
+b20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCcDedciGWWz82dl5nc
+MYhpjlcwg9zagLYaTMsdNTTCbD/qTBFwufonMkIMGBBrtsrLXuqq5fJUU0FoWlRQ
+vj9S7I3zv0Rp7niK0m+Uw9HKPGbAP3ZaoA6nS86N6ZyiXpcpx/gq88fBTB2Ul6W7
+f3SCa+qlErg1iSqfdIB9YAl/R4RfxtfTV1ttEwVwRS7Gsr0WjHN/+GfZUtOO5c+h
+NnzQQrF3FLa7F6MMe8RWZeyHzcnkYKfeOrPN2qrpO5Xv/pH9LN3AAV1e+LqhlZpS
+vF+nOR/awOzBxT1eSqpNPn/nHhNSr6/PeOqi0FSUQHNlHF9Rh5eNK7BPwr5Ul9u8
+EdtSx+NJzlCFIUjGwT1i8/HR6Cfq8JnjE0zBiNTqykp34/B873fPyFETJ/x+M52s
+jkiOB/OROUeInBf3Ae6IJq7sh1HZPf4c/jw1Onc4gn04vhrjGR0tHk57uZSPaWIJ
+n93/0VuAJTKbgME5xjWrj/n1z9NfLiFLTcMOvt5fYv7suTYPXHs73+3fWiG3zUK/
+UCbeILYAUPKau1oLCQOlctnD1N+y7GaKEUFRmazwNkFxgLeH0Q2bE7o8WI1FT/9O
+ybnUpFUVtSO9ff7U8cW8m+beJIC+jnLNcuKIT4aQB7JoqQFGYuqLHdP8rHu6/haI
+vhGYH/onig9oCms4g4DXLtQnGQIDAQABo4IBcjCCAW4wCQYDVR0TBAIwADARBglg
+hkgBhvhCAQEEBAMCBkAwLAYJYIZIAYb4QgENBB8WHUZsZWV0IFRlc3QgQ2VydGlm
+aWNhdGUgRm9vYmFyMB0GA1UdDgQWBBRNFpCOViHiyF07LamTbKEEJMqytTCBpAYD
+VR0jBIGcMIGZgBQp8ANwFjUrrlcji7S4hBfKb93b0aF9pHsweTELMAkGA1UEBhMC
+VVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28x
+EzARBgNVBAoMCkZsZWV0IENvcnAxFjAUBgNVBAsMDUlUIERlcGFydG1lbnQxEDAO
+BgNVBAMMB1Jvb3QgQ0GCAhAAMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggr
+BgEFBQcDATA1BgNVHREELjAsgglsb2NhbGhvc3SCFGhvc3QuZG9ja2VyLmludGVy
+bmFsggkxMjcuMC4wLjEwDQYJKoZIhvcNAQELBQADggIBABpFIhCNXV/LpjblszkS
+HVBFUaPkEezoiyBKEXXBUTh3MV22lYB/h86j71eBayYtKr8CeJPD249N3pTT3opC
+atxtGtKqUhB+iu8PDST+ftKBiBpAFAU/i73dyjZ8RCbzLNGI9uZv0i1YSG0FLVLh
+c+m1KuEXno6BT4PgPPPlmXa38WMlbaM57JqOGMGT2D07chL2ozUcLQm2r5RzA5p4
+jUMNTSGdj0+pn1mUSHMzqlYhmAcbbXSlFyoIlCH5eTbc083iOBLOiopumrzvyGnz
+j3lqtwKIWgEJu76nu2KGDGjO2FVwOfSFMjMTtoWnosTydgGThHW9LZqzHPjqcatJ
+A74Bqaw7OrIKYzBGYq2I2O3mxXJo5rBN3ofSFlqXeE53jRHSVJR8tPIUHZr6+nn2
+8QNOt8b+Xs7iR6wOBBzuzmMyzkxLbEb0oavyewdMUzi9cVJug22YhBqL74h5XCjT
+B3C681PDjColnWyreo2P0JJ9Os6R/2GCa7C3tCFtGAixFWIVzBv0Mf9/wYxHL+Ny
+C1IW4PyW94zTa4mAnO+5XRfdMHrSZ3qkVvWcbmCxTgxoBhLyyGwoHNDT89rbcajL
+rqsHmZhDGpkrzuomHszYpdYGcK4Ig7sp4MS4MGVdjrNiTUyIArQWMJT1GrTKpI/0
+QifPsDgb8vS7n2ZhvIpJVbrj
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFxDCCA6ygAwIBAgICEAAwDQYJKoZIhvcNAQELBQAweTELMAkGA1UEBhMCVVMx
+EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzAR
+BgNVBAoMCkZsZWV0IENvcnAxFjAUBgNVBAsMDUlUIERlcGFydG1lbnQxEDAOBgNV
+BAMMB1Jvb3QgQ0EwHhcNMjQwNzAxMjA1NzM1WhcNMzQwNjI5MjA1NzM1WjBpMQsw
+CQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTETMBEGA1UECgwKRmxlZXQg
+Q29ycDEWMBQGA1UECwwNSVQgRGVwYXJ0bWVudDEYMBYGA1UEAwwPSW50ZXJtZWRp
+YXRlIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApz8tZzhQKGuf
+h37uxFnKqmhQp3TxU5safScqnYEv9q9D3qOaqQTZOpN5RJ/gRAEldJXY+/ecTtar
++q+6RYOcvvHEi4aOtjiBh/40WH/iKIrkLB3Alut8alCbnN5clQ9JO0S38yt8zvKm
+v7ivpO3xzrszpFXPkKwH2FhMIsp/x02jSOpNV8edUiqDDMUhMypCQPXlJNAPbe7a
+vnve7dtS5zekP71aOX9f7Dt7GnyD5QFX/v1YKK6v/DTn4ax8XARP3/nsDqlIBgpf
+Fim9KB0I6kICn2HdkHbEqT0qeIM4KxMWdZlRS/BZuN/ixfqQ6XjbR5Q3nZSh7Xnh
+7inoHy2xdyl/jvhoFR6mK28dHqI9p4lJ71W8ESISAT47E6faFoUQETGr4MHXLxQW
++O1Le1j3DFWu6Z1oHkBX5oDuZ0DEFbl7ULv4IgG3rQFKGbYR9gOVfOrhkJQ2p3mF
+JQLXj+/FUPXKbZ7xrOoy8gLEwISUP8SVvfPu14UburVWKwvypNHJDxqjO7RhHVs5
+RT0gQf9Dob5e0nXTqkydNJf3v+EXAo+JFBZNRbHDpEtj+cdwPiyv1eL0nOMaY/+W
+0TbMcEOsa9KtEhMPkJtsplQXkYWV857PpKmMQlvTorhrnLRu4xPS9NFFaem5ifk4
+GNLNqKMXSuIEbgXAsk2zwnoWCp1DmskCAwEAAaNmMGQwHQYDVR0OBBYEFCnwA3AW
+NSuuVyOLtLiEF8pv3dvRMB8GA1UdIwQYMBaAFOIe3oTS4S/G93vZZAl+4rBhL0t4
+MBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB
+CwUAA4ICAQACgRWdsaLg9ck4B6yvfgH/wr/n0nEa8A7LQ9GS+9wv3MC1PSdb2tVk
+wobNJaZ3CErLc0B8dZRLVchaGRB6B5qbZ9Hn9O7oZ0DxMDI8VqfcpntxkD48bXHh
+7in9qtlhp6jz64eAxJQdcfMxMo6j/b3Lb5CP18b9+vszM42i+xA053rGQOin9Tba
+Dd6WcvzPlkoT4UH0ue3Le5Bh/Gj+coadSjnTU+NKGTBAj7KbwlKEEHaMUsnMeXE8
+4HTV8MniU4kAJURFzO6J0aNL5cLw2DeBEwN9IqACjcWcH7wKiKTucYBbh97VMFjz
+9JVn3cpp/8Sm5nHO1Kkh2SlE7JrNJ6/4nl3wsbGrN1KkOfewM1sr+8MlnhY+vrum
+qq3kRu1RYkMYClSBTKG5T5sBFQS78ZFyKj8r8QDAuEc5e3oiFb8CmpFFNlCtPZLJ
+h8x0mGRigXuOnVrCvybJ6VL0L2rerFCD3TKVNLrFxpcIeekE5KDBSzz4OcGBSnwL
+lkehxFILgiVDSRJhOZEdUw+GZr5Z8/RpPs4U0klKG3LhKja2JPjipGKsgbyav2h4
+HVJ7xFooR83AOHsZ3Fz3OW8x8zW1sa9n2r0I7GWSh5IlOduz/aHtQeaHslud1K/C
+sRw4WWk1ZPwhpbrn0nIpzzcazuHsKUDXhXEagYneMP2k0i3L0Do+Uw==
+-----END CERTIFICATE-----
diff --git a/tools/test-certs/server/leaf.cert.pem b/tools/test-certs/server/leaf.cert.pem
new file mode 100644
index 000000000000..89b3489b7250
--- /dev/null
+++ b/tools/test-certs/server/leaf.cert.pem
@@ -0,0 +1,40 @@
+-----BEGIN CERTIFICATE-----
+MIIG/jCCBOagAwIBAgIUWsbGzEFjHdrmBZRsLbJ+rOMRv5UwDQYJKoZIhvcNAQEL
+BQAwaTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExEzARBgNVBAoM
+CkZsZWV0IENvcnAxFjAUBgNVBAsMDUlUIERlcGFydG1lbnQxGDAWBgNVBAMMD0lu
+dGVybWVkaWF0ZSBDQTAeFw0yNDA3MDEyMTM2NDNaFw0yNTA3MDEyMTM2NDNaMIGS
+MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEP
+MA0GA1UECgwGRm9vYmFyMRswGQYDVQQLDBJGb29iYXIgRW5naW5lZXJpbmcxEjAQ
+BgNVBAMMCWZsZWV0LmNvbTEgMB4GCSqGSIb3DQEJARYRbHVjYXNAZmxlZXRkbS5j
+b20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCcDedciGWWz82dl5nc
+MYhpjlcwg9zagLYaTMsdNTTCbD/qTBFwufonMkIMGBBrtsrLXuqq5fJUU0FoWlRQ
+vj9S7I3zv0Rp7niK0m+Uw9HKPGbAP3ZaoA6nS86N6ZyiXpcpx/gq88fBTB2Ul6W7
+f3SCa+qlErg1iSqfdIB9YAl/R4RfxtfTV1ttEwVwRS7Gsr0WjHN/+GfZUtOO5c+h
+NnzQQrF3FLa7F6MMe8RWZeyHzcnkYKfeOrPN2qrpO5Xv/pH9LN3AAV1e+LqhlZpS
+vF+nOR/awOzBxT1eSqpNPn/nHhNSr6/PeOqi0FSUQHNlHF9Rh5eNK7BPwr5Ul9u8
+EdtSx+NJzlCFIUjGwT1i8/HR6Cfq8JnjE0zBiNTqykp34/B873fPyFETJ/x+M52s
+jkiOB/OROUeInBf3Ae6IJq7sh1HZPf4c/jw1Onc4gn04vhrjGR0tHk57uZSPaWIJ
+n93/0VuAJTKbgME5xjWrj/n1z9NfLiFLTcMOvt5fYv7suTYPXHs73+3fWiG3zUK/
+UCbeILYAUPKau1oLCQOlctnD1N+y7GaKEUFRmazwNkFxgLeH0Q2bE7o8WI1FT/9O
+ybnUpFUVtSO9ff7U8cW8m+beJIC+jnLNcuKIT4aQB7JoqQFGYuqLHdP8rHu6/haI
+vhGYH/onig9oCms4g4DXLtQnGQIDAQABo4IBcjCCAW4wCQYDVR0TBAIwADARBglg
+hkgBhvhCAQEEBAMCBkAwLAYJYIZIAYb4QgENBB8WHUZsZWV0IFRlc3QgQ2VydGlm
+aWNhdGUgRm9vYmFyMB0GA1UdDgQWBBRNFpCOViHiyF07LamTbKEEJMqytTCBpAYD
+VR0jBIGcMIGZgBQp8ANwFjUrrlcji7S4hBfKb93b0aF9pHsweTELMAkGA1UEBhMC
+VVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28x
+EzARBgNVBAoMCkZsZWV0IENvcnAxFjAUBgNVBAsMDUlUIERlcGFydG1lbnQxEDAO
+BgNVBAMMB1Jvb3QgQ0GCAhAAMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggr
+BgEFBQcDATA1BgNVHREELjAsgglsb2NhbGhvc3SCFGhvc3QuZG9ja2VyLmludGVy
+bmFsggkxMjcuMC4wLjEwDQYJKoZIhvcNAQELBQADggIBABpFIhCNXV/LpjblszkS
+HVBFUaPkEezoiyBKEXXBUTh3MV22lYB/h86j71eBayYtKr8CeJPD249N3pTT3opC
+atxtGtKqUhB+iu8PDST+ftKBiBpAFAU/i73dyjZ8RCbzLNGI9uZv0i1YSG0FLVLh
+c+m1KuEXno6BT4PgPPPlmXa38WMlbaM57JqOGMGT2D07chL2ozUcLQm2r5RzA5p4
+jUMNTSGdj0+pn1mUSHMzqlYhmAcbbXSlFyoIlCH5eTbc083iOBLOiopumrzvyGnz
+j3lqtwKIWgEJu76nu2KGDGjO2FVwOfSFMjMTtoWnosTydgGThHW9LZqzHPjqcatJ
+A74Bqaw7OrIKYzBGYq2I2O3mxXJo5rBN3ofSFlqXeE53jRHSVJR8tPIUHZr6+nn2
+8QNOt8b+Xs7iR6wOBBzuzmMyzkxLbEb0oavyewdMUzi9cVJug22YhBqL74h5XCjT
+B3C681PDjColnWyreo2P0JJ9Os6R/2GCa7C3tCFtGAixFWIVzBv0Mf9/wYxHL+Ny
+C1IW4PyW94zTa4mAnO+5XRfdMHrSZ3qkVvWcbmCxTgxoBhLyyGwoHNDT89rbcajL
+rqsHmZhDGpkrzuomHszYpdYGcK4Ig7sp4MS4MGVdjrNiTUyIArQWMJT1GrTKpI/0
+QifPsDgb8vS7n2ZhvIpJVbrj
+-----END CERTIFICATE-----
diff --git a/tools/test-certs/server/server.key.pem b/tools/test-certs/server/server.key.pem
new file mode 100644
index 000000000000..b2cf16a28914
--- /dev/null
+++ b/tools/test-certs/server/server.key.pem
@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQCcDedciGWWz82d
+l5ncMYhpjlcwg9zagLYaTMsdNTTCbD/qTBFwufonMkIMGBBrtsrLXuqq5fJUU0Fo
+WlRQvj9S7I3zv0Rp7niK0m+Uw9HKPGbAP3ZaoA6nS86N6ZyiXpcpx/gq88fBTB2U
+l6W7f3SCa+qlErg1iSqfdIB9YAl/R4RfxtfTV1ttEwVwRS7Gsr0WjHN/+GfZUtOO
+5c+hNnzQQrF3FLa7F6MMe8RWZeyHzcnkYKfeOrPN2qrpO5Xv/pH9LN3AAV1e+Lqh
+lZpSvF+nOR/awOzBxT1eSqpNPn/nHhNSr6/PeOqi0FSUQHNlHF9Rh5eNK7BPwr5U
+l9u8EdtSx+NJzlCFIUjGwT1i8/HR6Cfq8JnjE0zBiNTqykp34/B873fPyFETJ/x+
+M52sjkiOB/OROUeInBf3Ae6IJq7sh1HZPf4c/jw1Onc4gn04vhrjGR0tHk57uZSP
+aWIJn93/0VuAJTKbgME5xjWrj/n1z9NfLiFLTcMOvt5fYv7suTYPXHs73+3fWiG3
+zUK/UCbeILYAUPKau1oLCQOlctnD1N+y7GaKEUFRmazwNkFxgLeH0Q2bE7o8WI1F
+T/9OybnUpFUVtSO9ff7U8cW8m+beJIC+jnLNcuKIT4aQB7JoqQFGYuqLHdP8rHu6
+/haIvhGYH/onig9oCms4g4DXLtQnGQIDAQABAoICAAZH3PmcF71JIcpnm+6rzloJ
+O43H+4SOd5skChdj2SVrZpXPIp3kg6KTjZWfsPwqKuFNMalX1eKk8ytNr2UMiHnq
+7A+qXAjeFds90Esu0mu5oJ0OMNJBl4q411heKvVcqegplIhjWrUh6Mgz45y3QCuG
+R7cFw4ThahC+3J5Z1igEQISmTnDCwaWTMBMuWvfuS66eT9ZlBgZOJMD0k4sL1AbX
+GFNlnFvNU2eg4kG5RRrLd9u0NC1n3sK4kUu6dTS9NzJMXaRo/vwKi2BjfVw6bqhz
++R88corzSElaPJ5yly09yE35+jEhzw0R0MWiuReRsRhpRPqOjpW3OHfTy36MmBod
+tcHtZNUtZqoHVd3sDXwnQGQ5AavrESQrKK8U+bCPKKGjXNxRBdqsGCbY5hWPcBh8
+2Xg6Ci6i9c1OXzakAVMvcRkv1r30kPUlENCbItYaD91fRfwOvs9yHPdzVbQDiBkq
+ooVbCBO/ocRJ4v8sS1o8x2n0tFi2b6EGQMYWUjSM4Y7g/Gtm6s1Z0CWCKTz4wylw
+y/GTEyPJBi+v7/6OemNXFjpjUA8GWngorDWy2fYq39KBgrmXwylM1LsDU8qxDNgQ
+xyDn+9VvIqzuULIm1/AWNAyyrqlhrL62ADAns9bTbwT1RwX+I+kINcSn6kwyXx0V
+4ZXwwgBVjqx3uRed+JkdAoIBAQDShA21rwfHXezWq1V/NMxHUpZoMx05MchGI4ND
+vlolibu0XLEQZH9A80nUGBSxQszoNvpwk/28xz18mP4Gi10y5VS0O4bkUt65rm/X
+ZpUMrA9VePtdFRsRcq+9kgZAqi6aCIg5bQoAFnU1NyU4kc4dLo4uElg+Hl8Omabd
+McCfhD2gQvP67ZdqWKQ446LYR4mAq8JGy5jSP9YuukyPLHdle2OHeLuMCTOIZspN
+ZVuUvWx+9j83oLISvOxpzUEZZB5Ozi7tRyLDG7ZgbwEDJ2Syo6pQrsxN3EvpwfhU
+vM5avZXOKI1M061QtQn6gDxmXyNRMrkB0MSPTX6PO0eLGuqnAoIBAQC9xYBw4KZR
+fStQQy+o4eIRGyG78rvyAfFesQ64dL0XWbRStOta5WSTpmhj1M+FxUjQFzL2JfhO
+A1h7F8dYqS/RRj/L7S5qgiGbBosCr8UXDaHt022hwjUNznLHKtLBs+1roo4LZvXr
+Js/85Gk6mFcMUxbN0aq+V6TtRW6OozEr1V1o8xt5o07ltUc/ePrSgl0z0XYSPFdF
+Z6cCoLbCx8/2wuztcVEFH2pnbGqmu7MaVpBODqVpsfnSktyQxfbU1yQC2WWfDxjv
+/4zbIx5hD8+NOFIfvZe1sH+d8MUhs0M4cSNvAUccGWX187SzU6SARL0+dQRBZluS
+w7ifIc/JfVg/AoIBAQCPdjq5k/xjG1kpuj1boSmNeXTSsfK6ZXisg8sSwYhBiKmI
+cpqgJzypkKLBjV+cpX9qyPzG97O1kLoQTVrgLt1mr+6XnPGCbA8ozv2c92Wf6ynP
+/9CdUKLPsy6crATi0JdNlX7wU6S7BpL9nwUYlhS2wmFWeF32h1AUbRXQK/WvP7mX
+m8kVOhE0AhB4THlPlwDX1TVidaFBtwtJcOB3ub/sQrhDPD3jYunhjNtU/zv4E1b6
+9umCCVsRdfpO5/fzS81zuwMz5ISGHj6dXUh9U71GGE8bCORmMzjwpqWLadfe8tBC
+XFRfBOpZ0+Zm9jkzMqao0T5PRGyPlCophiZtX/yFAoIBAEVlmiitHmUiXtqFF0Kt
+B9y1jUqL44sGhtvX58gweI23cifknUSqKnOMIRSQ2CrVEGF4elxlWj49Hvg0o+Oa
+SzA+fkn2vEiauetVIzSiTnK1u4ebD7ZdrMUVwAdxc4z+XU5FLaihyEBr+xdB9/FD
+kGGjaO1vRP9CUb+q6lki+HJNHlGoxV1gCRQbjKh7d03P+oFekcztYASzePGPEAZ+
+x2A3vCjAjZ5P9LtJfF7ouQBis3a4CGl0eiU1K4+NtUv0OOkJ0w2tmbL6QupIF23r
+OD0uYWnWDUqV9rUtPQmr4mMbjJelYfm2mACvVF9XsQpvGL1kUWARLF+pTzRySugl
+/EUCggEAH1qmF9Uir3ej0Ci0y2lUGgf11RmzL0ge3t3fFd+UGzY9OVXiOUtfYbmO
+uQYAjMu1e8bIhOWp+uWD5XUbHal1qufbJO2f8M24YCEMownCCSlxgrGQD+0fRHSH
+TlXiObCon6OzD1gzZYCzPyey4VLmxMHLLxo00IIndWdRvZEmcd0btP48uHz3s4aM
+Pf4aC4zdTGZx1iVanQZ4tmK7zhSb2OI8FOAUK+g92fik7vDnMGooCNnSFBGJATpP
+y0i1uxvNVwLXXVyBFrnoDhnMBwHNVI2iOZswoNG9bnFW67ziXUUW7CmuvZcHdVsO
+qplQ1HoMAqczuSC40QAtpr2qyZuwhQ==
+-----END PRIVATE KEY-----
diff --git a/tools/test_extensions/hello_world/build.sh b/tools/test_extensions/hello_world/build.sh
index 154102b3ab54..ee33ad46d86a 100755
--- a/tools/test_extensions/hello_world/build.sh
+++ b/tools/test_extensions/hello_world/build.sh
@@ -2,11 +2,13 @@
 
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 
-mkdir -p $SCRIPT_DIR/macos $SCRIPT_DIR/windows $SCRIPT_DIR/linux
+mkdir -p $SCRIPT_DIR/macos $SCRIPT_DIR/windows $SCRIPT_DIR/linux $SCRIPT_DIR/linux-arm64
 GOOS=darwin GOARCH=amd64 go build -o $SCRIPT_DIR/macos/hello_world_macos.ext $SCRIPT_DIR
 GOOS=windows GOARCH=amd64 go build -o $SCRIPT_DIR/windows/hello_world_windows.ext.exe $SCRIPT_DIR
 GOOS=linux GOARCH=amd64 go build -o $SCRIPT_DIR/linux/hello_world_linux.ext $SCRIPT_DIR
+GOOS=linux GOARCH=arm64 go build -o $SCRIPT_DIR/linux-arm64/hello_world_linux.ext $SCRIPT_DIR
 
 GOOS=darwin GOARCH=amd64 go build -ldflags '-X "main.extensionName=test_extensions.hello_mars" -X "main.tableName=hello_mars" -X "main.columnValue=mars"' -o $SCRIPT_DIR/macos/hello_mars_macos.ext $SCRIPT_DIR
 GOOS=windows GOARCH=amd64 go build -ldflags '-X "main.extensionName=test_extensions.hello_mars" -X "main.tableName=hello_mars" -X "main.columnValue=mars"' -o $SCRIPT_DIR/windows/hello_mars_windows.ext.exe $SCRIPT_DIR
 GOOS=linux GOARCH=amd64 go build -ldflags '-X "main.extensionName=test_extensions.hello_mars" -X "main.tableName=hello_mars" -X "main.columnValue=mars"' -o $SCRIPT_DIR/linux/hello_mars_linux.ext $SCRIPT_DIR
+GOOS=linux GOARCH=arm64 go build -ldflags '-X "main.extensionName=test_extensions.hello_mars" -X "main.tableName=hello_mars" -X "main.columnValue=mars"' -o $SCRIPT_DIR/linux-arm64/hello_mars_linux.ext $SCRIPT_DIR
diff --git a/tools/tuf/README.md b/tools/tuf/README.md
index 9f30f296f2e5..3915fdb89278 100644
--- a/tools/tuf/README.md
+++ b/tools/tuf/README.md
@@ -225,6 +225,19 @@ make nudge-app-tar-gz version=1.1.10.81462 out-path=.
 fleetctl updates add --target /path/to/macos/nudge.app.tar.gz --platform macos --name nudge --version 1.1.10.81462 -t edge
 ```
 
+#### Releasing `Escrow Buddy` to `stable`
+
+> `releaser.sh` doesn't support `Escrow Buddy` yet.
+> macOS only component
+
+The `Escrow Buddy` pkg installer can be generated by running:
+```sh
+make escrow-buddy-pkg version=1.0.0 out-path=.
+```
+```sh
+fleetctl updates add --target /path/to/escrowBuddy.pkg --platform macos --name escrowBuddy --version 1.0.0 -t stable
+```
+
 #### Updating timestamp
 
 ```sh
diff --git a/tools/tuf/download-artifacts/download-artifacts.go b/tools/tuf/download-artifacts/download-artifacts.go
index b18d11515c70..78a7e624fd15 100644
--- a/tools/tuf/download-artifacts/download-artifacts.go
+++ b/tools/tuf/download-artifacts/download-artifacts.go
@@ -81,9 +81,10 @@ func orbitCommand() *cli.Command {
 		},
 		Action: func(c *cli.Context) error {
 			return downloadComponents("goreleaser-orbit.yaml", gitTag, map[string]string{
-				"macos":   "orbit-macos",
-				"linux":   "orbit-linux",
-				"windows": "orbit-windows",
+				"macos":       "orbit-macos",
+				"linux":       "orbit-linux",
+				"linux-arm64": "orbit-linux-arm64",
+				"windows":     "orbit-windows",
 			}, outputDirectory, githubUsername, githubAPIToken, retry)
 		},
 	}
@@ -138,9 +139,10 @@ func desktopCommand() *cli.Command {
 		},
 		Action: func(c *cli.Context) error {
 			return downloadComponents("generate-desktop-targets.yml", gitBranch, map[string]string{
-				"macos":   "desktop.app.tar.gz",
-				"linux":   "desktop.tar.gz",
-				"windows": "fleet-desktop.exe",
+				"macos":       "desktop.app.tar.gz",
+				"linux":       "desktop.tar.gz",
+				"linux-arm64": "desktop-arm64.tar.gz",
+				"windows":     "fleet-desktop.exe",
 			}, outputDirectory, githubUsername, githubAPIToken, retry)
 		},
 	}
@@ -250,7 +252,7 @@ func downloadComponents(workflowName string, headBranch string, artifactNames ma
 	if err := os.RemoveAll(outputDirectory); err != nil {
 		return err
 	}
-	for _, osPath := range []string{"macos", "windows", "linux"} {
+	for _, osPath := range []string{"macos", "windows", "linux", "linux-arm64"} {
 		if err := os.MkdirAll(filepath.Join(outputDirectory, osPath), constant.DefaultDirMode); err != nil {
 			return err
 		}
@@ -292,6 +294,8 @@ func downloadComponents(workflowName string, headBranch string, artifactNames ma
 		for _, artifact := range artifactList.Artifacts {
 			if *artifact.Name == artifactNames["linux"] {
 				urls["linux"] = *artifact.ArchiveDownloadURL
+			} else if *artifact.Name == artifactNames["linux-arm64"] {
+				urls["linux-arm64"] = *artifact.ArchiveDownloadURL
 			} else if *artifact.Name == artifactNames["macos"] {
 				urls["macos"] = *artifact.ArchiveDownloadURL
 			} else if *artifact.Name == artifactNames["windows"] {
@@ -300,13 +304,13 @@ func downloadComponents(workflowName string, headBranch string, artifactNames ma
 				fmt.Printf("skipping artifact name: %q\n", *artifact.Name)
 			}
 		}
-		if len(urls) == 3 || !retry {
+		if len(urls) == 4 || !retry {
 			break
 		}
 		fmt.Printf("All artifacts are not available yet, the workflow might still be running, retrying in 60s...\n")
 		time.Sleep(60 * time.Second)
 	}
-	if len(urls) != 3 {
+	if len(urls) != 4 {
 		return fmt.Errorf("missing some artifact: %+v", urls)
 	}
 	for osName, downloadURL := range urls {
@@ -368,9 +372,10 @@ func osquerydCommand() *cli.Command {
 		},
 		Action: func(c *cli.Context) error {
 			return downloadComponents("generate-osqueryd-targets.yml", gitBranch, map[string]string{
-				"macos":   "osqueryd.app.tar.gz",
-				"linux":   "osqueryd",
-				"windows": "osqueryd.exe",
+				"macos":       "osqueryd.app.tar.gz",
+				"linux":       "osqueryd",
+				"linux-arm64": "osqueryd-arm64",
+				"windows":     "osqueryd.exe",
 			}, outputDirectory, githubUsername, githubAPIToken, retry)
 		},
 	}
diff --git a/tools/tuf/releaser.sh b/tools/tuf/releaser.sh
index 7cefdcdf2553..cf669577c221 100755
--- a/tools/tuf/releaser.sh
+++ b/tools/tuf/releaser.sh
@@ -38,7 +38,7 @@ clean_up () {
     rm -rf "$GO_TOOLS_DIRECTORY"
     ARG=$?
     exit $ARG
-} 
+}
 
 setup () {
     echo "Running setup..."
@@ -58,9 +58,9 @@ setup () {
     cp -r "$KEYS_SOURCE_DIRECTORY" "$KEYS_DIRECTORY"
 
     if ! aws sts get-caller-identity &> /dev/null; then
-        prompt "You need to login to AWS using the cli, press any key to continue..."
+        prompt "You need to login to AWS using the cli."
         aws sso login
-        prompt "AWS SSO login was successful, press any key to continue..."
+        prompt "AWS SSO login was successful."
     fi
 
     # GITHUB_TOKEN is only necessary when releasing to edge.
@@ -71,9 +71,9 @@ setup () {
     # We only need to be logged in to github when releasing to edge.
     if [[ $ACTION == "release-to-edge" ]]; then
         if ! gh auth status >/dev/null 2>&1; then
-            prompt "You need to login to Github using the cli, press any key to continue..."
+            prompt "You need to login to Github using the cli."
             gh auth login
-            prompt "Github login was successful, press any key to continue..."
+            prompt "Github login was successful."
         fi
     fi
 
@@ -90,14 +90,14 @@ setup () {
     FLEET_TIMESTAMP_PASSPHRASE=$(op read "op://$TIMESTAMP_PASSPHRASE_1PASSWORD_PATH")
     export FLEET_TIMESTAMP_PASSPHRASE
 
-    go build -o "$GO_TOOLS_DIRECTORY/replace" "$SCRIPT_DIR/../../tools/tuf/replace" 
+    go build -o "$GO_TOOLS_DIRECTORY/replace" "$SCRIPT_DIR/../../tools/tuf/replace"
     go build -o "$GO_TOOLS_DIRECTORY/download-artifacts" "$SCRIPT_DIR/../../tools/tuf/download-artifacts"
 }
 
 pull_from_remote () {
     echo "Pulling repository from tuf.fleetctl.com... (--dryrun first)"
     aws s3 sync s3://fleet-tuf-repo "$REPOSITORY_DIRECTORY" --exact-timestamps --dryrun
-    prompt "If the --dryrun looks good, press any key to continue... (no output means nothing to update)"
+    prompt "Check if the above --dry-run looks good (no output means nothing to update)."
     aws s3 sync s3://fleet-tuf-repo "$REPOSITORY_DIRECTORY" --exact-timestamps
 }
 
@@ -106,24 +106,27 @@ promote_component_edge_to_stable () {
     component_version=$2
 
     IFS='.' read -r -a version_parts <<< "$component_version"
-    major=${version_parts[0]}  
-    minor=${version_parts[1]}  
+    major=${version_parts[0]}
+    minor=${version_parts[1]}
 
     pushd "$TUF_DIRECTORY"
     case $component_name in
         orbit)
             fleetctl updates add --target "$REPOSITORY_DIRECTORY/targets/orbit/macos/edge/orbit" --platform macos --name orbit --version "$component_version" -t "$major.$minor" -t "$major" -t stable
             fleetctl updates add --target "$REPOSITORY_DIRECTORY/targets/orbit/linux/edge/orbit" --platform linux --name orbit --version "$component_version" -t "$major.$minor" -t "$major" -t stable
+            fleetctl updates add --target "$REPOSITORY_DIRECTORY/targets/orbit/linux-arm64/edge/orbit" --platform linux-arm64 --name orbit --version "$component_version" -t "$major.$minor" -t "$major" -t stable
             fleetctl updates add --target "$REPOSITORY_DIRECTORY/targets/orbit/windows/edge/orbit.exe" --platform windows --name orbit --version "$component_version" -t "$major.$minor" -t "$major" -t stable
             ;;
         desktop)
             fleetctl updates add --target "$REPOSITORY_DIRECTORY/targets/desktop/macos/edge/desktop.app.tar.gz" --platform macos --name desktop --version "$component_version" -t "$major.$minor" -t "$major" -t stable
             fleetctl updates add --target "$REPOSITORY_DIRECTORY/targets/desktop/linux/edge/desktop.tar.gz" --platform linux --name desktop --version "$component_version" -t "$major.$minor" -t "$major" -t stable
+            fleetctl updates add --target "$REPOSITORY_DIRECTORY/targets/desktop/linux-arm64/edge/desktop.tar.gz" --platform linux-arm64 --name desktop --version "$component_version" -t "$major.$minor" -t "$major" -t stable
             fleetctl updates add --target "$REPOSITORY_DIRECTORY/targets/desktop/windows/edge/fleet-desktop.exe" --platform windows --name desktop --version "$component_version" -t "$major.$minor" -t "$major" -t stable
             ;;
         osqueryd)
             fleetctl updates add --target "$REPOSITORY_DIRECTORY/targets/osqueryd/macos-app/edge/osqueryd.app.tar.gz" --platform macos-app --name osqueryd --version "$component_version" -t "$major.$minor" -t "$major" -t stable
             fleetctl updates add --target "$REPOSITORY_DIRECTORY/targets/osqueryd/linux/edge/osqueryd" --platform linux --name osqueryd --version "$component_version" -t "$major.$minor" -t "$major" -t stable
+            fleetctl updates add --target "$REPOSITORY_DIRECTORY/targets/osqueryd/linux-arm64/edge/osqueryd" --platform linux-arm64 --name osqueryd --version "$component_version" -t "$major.$minor" -t "$major" -t stable
             fleetctl updates add --target "$REPOSITORY_DIRECTORY/targets/osqueryd/windows/edge/osqueryd.exe" --platform windows --name osqueryd --version "$component_version" -t "$major.$minor" -t "$major" -t stable
             ;;
         *)
@@ -154,7 +157,7 @@ release_fleetd_to_edge () {
     BRANCH_NAME="release-fleetd-v$VERSION"
     ORBIT_TAG="orbit-v$VERSION"
     if [[ "$SKIP_PR_AND_TAG_PUSH" != "1" ]]; then
-        prompt "A PR for bumping the fleetd version will be created to trigger a Github Action that will build 'Fleet Desktop'. Press any key to continue..."
+        prompt "A PR will be created to trigger a Github Action to build desktop."
         pushd "$GIT_REPOSITORY_DIRECTORY"
         git checkout -b "$BRANCH_NAME"
         make changelog-orbit version="$VERSION"
@@ -163,10 +166,8 @@ release_fleetd_to_edge () {
         git add .github/workflows/generate-desktop-targets.yml "$ORBIT_CHANGELOG"
         git commit -m "Release fleetd $VERSION"
         git push origin "$BRANCH_NAME"
-        prompt "A PR will be created, press any key to continue..."
         gh pr create -f -B main -t "Release fleetd $VERSION"
-        prompt "Press any key to continue after the PR is created and you have made all the necessary edits to it..."
-        prompt "A 'git tag' will be created to trigger a Github Action to build orbit, press any key to continue..."
+        prompt "A 'git tag' will be created to trigger a Github Action to build orbit."
         git tag "$ORBIT_TAG"
         git push origin "$ORBIT_TAG"
         popd
@@ -188,16 +189,18 @@ release_fleetd_to_edge () {
     pushd "$TUF_DIRECTORY"
     fleetctl updates add --target "$ORBIT_ARTIFACT_DOWNLOAD_DIRECTORY/macos/orbit" --platform macos --name orbit --version "$VERSION" -t edge
     fleetctl updates add --target "$ORBIT_ARTIFACT_DOWNLOAD_DIRECTORY/linux/orbit" --platform linux --name orbit --version "$VERSION" -t edge
+    fleetctl updates add --target "$ORBIT_ARTIFACT_DOWNLOAD_DIRECTORY/linux-arm64/orbit" --platform linux-arm64 --name orbit --version "$VERSION" -t edge
     fleetctl updates add --target "$ORBIT_ARTIFACT_DOWNLOAD_DIRECTORY/windows/orbit.exe" --platform windows --name orbit --version "$VERSION" -t edge
     fleetctl updates add --target "$DESKTOP_ARTIFACT_DOWNLOAD_DIRECTORY/macos/desktop.app.tar.gz" --platform macos --name desktop --version "$VERSION" -t edge
     fleetctl updates add --target "$DESKTOP_ARTIFACT_DOWNLOAD_DIRECTORY/linux/desktop.tar.gz" --platform linux --name desktop --version "$VERSION" -t edge
+    fleetctl updates add --target "$DESKTOP_ARTIFACT_DOWNLOAD_DIRECTORY/linux-arm64/desktop.tar.gz" --platform linux-arm64 --name desktop --version "$VERSION" -t edge
     fleetctl updates add --target "$DESKTOP_ARTIFACT_DOWNLOAD_DIRECTORY/windows/fleet-desktop.exe" --platform windows --name desktop --version "$VERSION" -t edge
     popd
 }
 
 release_osqueryd_to_edge () {
     echo "Releasing osqueryd to edge..."
-    prompt "A branch and PR for bumping the osquery version will be created. Press any key to continue..."
+    prompt "A branch and PR for bumping the osquery version will be created."
     BRANCH_NAME=release-osqueryd-v$VERSION
     if [[ "$SKIP_PR_AND_TAG_PUSH" != "1" ]]; then
         pushd "$GIT_REPOSITORY_DIRECTORY"
@@ -206,8 +209,8 @@ release_osqueryd_to_edge () {
         git add .github/workflows/generate-osqueryd-targets.yml
         git commit -m "Bump osqueryd version to $VERSION"
         git push origin "$BRANCH_NAME"
-        open "https://github.com/fleetdm/fleet/pull/new/$BRANCH_NAME"
-        prompt "Press any key to continue after the PR is created..."
+        prompt "A PR will be created to trigger a Github Action to build osqueryd."
+        gh pr create -f -B main -t "Release osqueryd $VERSION"
         popd
     fi
     OSQUERYD_ARTIFACT_DOWNLOAD_DIRECTORY="$ARTIFACTS_DOWNLOAD_DIRECTORY/osqueryd"
@@ -221,6 +224,7 @@ release_osqueryd_to_edge () {
     pushd "$TUF_DIRECTORY"
     fleetctl updates add --target "$OSQUERYD_ARTIFACT_DOWNLOAD_DIRECTORY/macos/osqueryd.app.tar.gz" --platform macos-app --name osqueryd --version "$VERSION" -t edge
     fleetctl updates add --target "$OSQUERYD_ARTIFACT_DOWNLOAD_DIRECTORY/linux/osqueryd" --platform linux --name osqueryd --version "$VERSION" -t edge
+    fleetctl updates add --target "$OSQUERYD_ARTIFACT_DOWNLOAD_DIRECTORY/linux-arm64/osqueryd" --platform linux-arm64 --name osqueryd --version "$VERSION" -t edge
     fleetctl updates add --target "$OSQUERYD_ARTIFACT_DOWNLOAD_DIRECTORY/windows/osqueryd.exe" --platform windows --name osqueryd --version "$VERSION" -t edge
     popd
 }
@@ -247,7 +251,7 @@ push_to_remote () {
     aws s3 sync "$REPOSITORY_DIRECTORY" s3://fleet-tuf-repo --dryrun
     if [[ $PUSH_TO_REMOTE == "1" ]]; then
         echo "WARNING: This step will push the release to tuf.fleetctl.com (production)..."
-        prompt "If the --dryrun looks good, press any key to continue..."
+        prompt "Check if the above --dry-run looks good."
         aws s3 sync "$REPOSITORY_DIRECTORY" s3://fleet-tuf-repo
         echo "Release has been pushed!"
         echo "NOTE: You might see some clients failing to upgrade due to some sha256 mismatches."
@@ -259,7 +263,14 @@ push_to_remote () {
 
 prompt () {
     printf "%s\n" "$1"
-    read -r -s -n 1
+    printf "Type 'yes' to continue... "
+    while read -r word;
+    do
+        if [[ "$word" == "yes" ]]; then
+            printf "\n"
+            return
+        fi
+    done
 }
 
 setup_to_become_publisher () {
@@ -273,7 +284,7 @@ setup_to_become_publisher () {
     mkdir -p "$KEYS_DIRECTORY"
     if ! aws sts get-caller-identity &> /dev/null; then
         aws sso login
-        prompt "AWS SSO login was successful, press any key to continue..."
+        prompt "AWS SSO login was successful."
     fi
     # These need to be exported for use by `tuf` commands.
     FLEET_TARGETS_PASSPHRASE=$(op read "op://$TARGETS_PASSPHRASE_1PASSWORD_PATH")
@@ -300,15 +311,15 @@ fi
 print_reminder () {
     if [[ $ACTION == "release-to-edge" ]]; then
         if [[ $COMPONENT == "fleetd" ]]; then
-            prompt "Make sure to install fleetd with '--orbit-channel=edge --desktop-channel=edge' on a Linux, Windows and macOS VM. (To smoke test the release.) Press any key to continue..."
+            prompt "Make sure to install fleetd with '--orbit-channel=edge --desktop-channel=edge' on a Linux, Windows and macOS VM. (To smoke test the release.)"
         elif [[ $COMPONENT == "osqueryd" ]]; then
-            prompt "Make sure to install fleetd with '--osqueryd-channel=edge' on a Linux, Windows and macOS VM. (To smoke test the release.) Press any key to continue..."
+            prompt "Make sure to install fleetd with '--osqueryd-channel=edge' on a Linux, Windows and macOS VM. (To smoke test the release.)"
         fi
     elif [[ $ACTION == "promote-edge-to-stable" ]]; then
         if [[ $COMPONENT == "fleetd" ]]; then
-            prompt "Make sure to install fleetd with '--orbit-channel=stable --desktop-channel=stable' on a Linux, Windows and macOS VM. (To smoke test the release.) Press any key to continue..."
+            prompt "Make sure to install fleetd with '--orbit-channel=stable --desktop-channel=stable' on a Linux, Windows and macOS VM. (To smoke test the release.)"
         elif [[ $COMPONENT == "osqueryd" ]]; then
-            prompt "Make sure to install fleetd with '--osqueryd-channel=stable' on a Linux, Windows and macOS VM. (To smoke test the release.) Press any key to continue..."
+            prompt "Make sure to install fleetd with '--osqueryd-channel=stable' on a Linux, Windows and macOS VM. (To smoke test the release.)"
         fi
     else
         echo "Unsupported action: $ACTION"
@@ -331,4 +342,4 @@ else
     exit 1
 fi
 
-push_to_remote
\ No newline at end of file
+push_to_remote
diff --git a/tools/tuf/status/tuf-status.go b/tools/tuf/status/tuf-status.go
index 56e57d534990..e62dc14f1283 100644
--- a/tools/tuf/status/tuf-status.go
+++ b/tools/tuf/status/tuf-status.go
@@ -163,19 +163,22 @@ func byteCountSI(b int64) string {
 func channelVersionCommand() *cli.Command {
 	componentFileMap := map[string]map[string]string{
 		"orbit": {
-			"linux":   "orbit",
-			"macos":   "orbit",
-			"windows": "orbit.exe",
+			"linux":       "orbit",
+			"linux-arm64": "orbit",
+			"macos":       "orbit",
+			"windows":     "orbit.exe",
 		},
 		"desktop": {
-			"linux":   "desktop.tar.gz",
-			"macos":   "desktop.app.tar.gz",
-			"windows": "fleet-desktop.exe",
+			"linux":       "desktop.tar.gz",
+			"linux-arm64": "desktop.tar.gz",
+			"macos":       "desktop.app.tar.gz",
+			"windows":     "fleet-desktop.exe",
 		},
 		"osqueryd": {
-			"linux":     "osqueryd",
-			"macos-app": "osqueryd.app.tar.gz",
-			"windows":   "osqueryd.exe",
+			"linux":       "osqueryd",
+			"linux-arm64": "osqueryd",
+			"macos-app":   "osqueryd.app.tar.gz",
+			"windows":     "osqueryd.exe",
 		},
 		"nudge": {
 			"macos": "nudge.app.tar.gz",
@@ -183,6 +186,9 @@ func channelVersionCommand() *cli.Command {
 		"swiftDialog": {
 			"macos": "swiftDialog.app.tar.gz",
 		},
+		"escrowBuddy": {
+			"macos": "escrowBuddy.pkg",
+		},
 	}
 	var (
 		channel    string
@@ -205,7 +211,7 @@ func channelVersionCommand() *cli.Command {
 			&cli.StringSliceFlag{
 				Name:        "components",
 				EnvVars:     []string{"TUF_STATUS_COMPONENTS"},
-				Value:       cli.NewStringSlice("orbit", "desktop", "osqueryd", "nudge", "swiftDialog"),
+				Value:       cli.NewStringSlice("orbit", "desktop", "osqueryd", "nudge", "swiftDialog", "escrowBuddy"),
 				Destination: &components,
 				Usage:       "List of components",
 			},
@@ -305,7 +311,7 @@ func channelVersionCommand() *cli.Command {
 				fmt.Printf("%s\n", b)
 			} else if format == "markdown" {
 				table := tablewriter.NewWriter(os.Stdout)
-				table.SetHeader([]string{"Component\\OS", "macOS", "Linux", "Windows"})
+				table.SetHeader([]string{"Component\\OS", "macOS", "Linux", "Windows", "Linux (arm64)"})
 				table.SetAutoFormatHeaders(false)
 				table.SetCenterSeparator("|")
 				table.SetHeaderLine(true)
@@ -321,7 +327,7 @@ func channelVersionCommand() *cli.Command {
 					Right:  true,
 				})
 				var rows [][]string
-				componentsInOrder := []string{"orbit", "desktop", "osqueryd", "nudge", "swiftDialog"}
+				componentsInOrder := []string{"orbit", "desktop", "osqueryd", "nudge", "swiftDialog", "escrowBuddy"}
 				setIfEmpty := func(m map[string]string, k string) string {
 					v := m[k]
 					if v == "" {
@@ -332,7 +338,7 @@ func channelVersionCommand() *cli.Command {
 				for _, component := range componentsInOrder {
 					oss := outputMap[component]
 					row := []string{component}
-					for _, os := range []string{"macos", "linux", "windows"} {
+					for _, os := range []string{"macos", "linux", "windows", "linux-arm64"} {
 						row = append(row, setIfEmpty(oss, os))
 					}
 					rows = append(rows, row)
diff --git a/tools/tuf/test/README.md b/tools/tuf/test/README.md
index 6bf057e6027f..55249fcbd4b0 100644
--- a/tools/tuf/test/README.md
+++ b/tools/tuf/test/README.md
@@ -31,7 +31,9 @@ MSI_FLEET_URL=https://host.docker.internal:8080 \
 MSI_TUF_URL=http://host.docker.internal:8081 \
 GENERATE_PKG=1 \
 GENERATE_DEB=1 \
+GENERATE_DEB_ARM64=1 \
 GENERATE_RPM=1 \
+GENERATE_RPM_ARM64=1 \
 GENERATE_MSI=1 \
 ENROLL_SECRET=6/EzU/+jPkxfTamWnRv1+IJsO4T9Etju \
 FLEET_DESKTOP=1 \
diff --git a/tools/tuf/test/create_repository.sh b/tools/tuf/test/create_repository.sh
index 2fabf7aa103e..0f13a21357c9 100755
--- a/tools/tuf/test/create_repository.sh
+++ b/tools/tuf/test/create_repository.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -e
+set -xe
 
 # This script initializes a test Fleet TUF repository.
 # All targets are created with version 42.
@@ -23,10 +23,12 @@ if [[ -d "$TUF_PATH" ]]; then
     exit 0
 fi
 
-SYSTEMS=${SYSTEMS:-macos linux windows}
+SYSTEMS=${SYSTEMS:-macos linux linux-arm64 windows}
+
+echo "Generating packages for $SYSTEMS"
+
 NUDGE_VERSION=stable
-SWIFT_DIALOG_MACOS_APP_VERSION=2.2.1
-SWIFT_DIALOG_MACOS_APP_BUILD_VERSION=4591
+ESCROW_BUDDY_PKG_VERSION=1.0.0
 
 if [[ -z "$OSQUERY_VERSION" ]]; then
     OSQUERY_VERSION=5.12.2
@@ -46,8 +48,15 @@ for system in $SYSTEMS; do
     elif [[ $system == "macos" ]]; then
         osqueryd="$osqueryd.app.tar.gz"
         osqueryd_system="macos-app"
+    elif [[ $system == "linux-arm64" ]]; then
+        osqueryd_system="linux-arm64"
+    fi
+
+    if [[ $system == "linux-arm64" ]]; then
+        osqueryd_path="$TUF_PATH/tmp/${osqueryd}-arm64"
+    else
+        osqueryd_path="$TUF_PATH/tmp/$osqueryd"
     fi
-    osqueryd_path="$TUF_PATH/tmp/$osqueryd"
     curl https://tuf.fleetctl.com/targets/osqueryd/$osqueryd_system/$OSQUERY_VERSION/$osqueryd --output $osqueryd_path
 
     major=$(echo "$OSQUERY_VERSION" | cut -d "." -f 1)
@@ -65,6 +74,13 @@ for system in $SYSTEMS; do
     if [[ $system == "macos" ]]; then
         goose_value="darwin"
     fi
+    if [[ $system == "linux" ]]; then
+        goarch_value="amd64"
+    fi
+    if [[ $system == "linux-arm64" ]]; then
+        goose_value="linux"
+        goarch_value="arm64"
+    fi
     orbit_target=orbit-$system
     if [[ $system == "windows" ]]; then
         orbit_target="${orbit_target}.exe"
@@ -74,7 +90,6 @@ for system in $SYSTEMS; do
     # Apple keychain, some tables, etc), if this is the case, compile an
     # universal binary.
     #
-    # NOTE(lucas): Cross-compiling orbit for arm64 from Intel macOS currently fails (CGO error).
     if [ $system == "macos" ] && [ "$(uname -s)" = "Darwin" ] && [ "$(uname -m)" = "arm64" ]; then
        CGO_ENABLED=1 \
        CODESIGN_IDENTITY=$CODESIGN_IDENTITY \
@@ -82,7 +97,23 @@ for system in $SYSTEMS; do
        ORBIT_BINARY_PATH=$orbit_target \
        go run ./orbit/tools/build/build.go
     else
-      CGO_ENABLED=0 GOOS=$goose_value GOARCH=$goarch_value go build -ldflags="-X github.com/fleetdm/fleet/v4/orbit/pkg/build.Version=42" -o $orbit_target ./orbit/cmd/orbit
+      race_value=false
+      # Enable race on macOS Intel at least.
+      #
+      # For cross-compiling to Windows with `-race` we need CGO_ENABLED=1 but we cannot
+      # do cross-compilation with CGO_ENABLED=1.
+      if [ "$goose_value" = "darwin" ] && [ "$(uname -s)" = "Darwin" ] && [ "$(uname -m)" = "x86_64" ]; then
+        race_value=true
+      fi
+      # NOTE(lucas): Cross-compiling orbit for arm64 from Intel macOS currently fails (CGO error),
+      # thus on Intel we do not build an universal binary.
+      CGO_ENABLED=0 \
+      GOOS=$goose_value \
+      GOARCH=$goarch_value \
+      go build \
+      -race=$race_value \
+      -ldflags="-X github.com/fleetdm/fleet/v4/orbit/pkg/build.Version=42" \
+      -o $orbit_target ./orbit/cmd/orbit
     fi
 
     ./build/fleetctl updates add \
@@ -136,6 +167,20 @@ for system in $SYSTEMS; do
         rm swiftDialog.app.tar.gz
     fi
 
+    # Add Escrow Buddy on macos (if enabled).
+    if [[ $system == "macos" && -n "$ESCROW_BUDDY" ]]; then
+	make escrow-buddy-pkg version=$ESCROW_BUDDY_PKG_VERSION out-path=.
+
+        ./build/fleetctl updates add \
+            --path $TUF_PATH \
+            --target escrowBuddy.pkg \
+            --platform macos \
+            --name escrowBuddy \
+            --version 42.0.0 -t 42.0 -t 42 -t stable
+        rm escrowBuddy.pkg
+    fi
+
+
     # Add Fleet Desktop application on windows (if enabled).
     if [[ $system == "windows" && -n "$FLEET_DESKTOP" ]]; then
         FLEET_DESKTOP_VERSION=42.0.0 \
@@ -162,6 +207,19 @@ for system in $SYSTEMS; do
         rm desktop.tar.gz
     fi
 
+    # Add Fleet Desktop application on linux-arm64 (if enabled).
+    if [[ $system == "linux-arm64" && -n "$FLEET_DESKTOP" ]]; then
+        FLEET_DESKTOP_VERSION=42.0.0 \
+        make desktop-linux-arm64
+        ./build/fleetctl updates add \
+                         --path $TUF_PATH \
+                         --target desktop.tar.gz \
+                         --platform linux-arm64 \
+                         --name desktop \
+                         --version 42.0.0 -t 42.0 -t 42 -t stable
+        rm desktop.tar.gz
+    fi
+
     # Add extensions on macos (if set).
     if [[ $system == "macos" && -n "$MACOS_TEST_EXTENSIONS" ]]; then
         for extension in ${MACOS_TEST_EXTENSIONS//,/ }
@@ -192,6 +250,21 @@ for system in $SYSTEMS; do
         done
     fi
 
+    # Add extensions on linux (if set).
+    if [[ $system == "linux-arm64" && -n "$LINUX_TEST_EXTENSIONS" ]]; then
+        for extension in ${LINUX_TEST_EXTENSIONS//,/ }
+        do
+            extensionName=$(basename $extension)
+            extensionName=$(echo "$extensionName" | cut -d'.' -f1)
+            ./build/fleetctl updates add \
+                             --path $TUF_PATH \
+                             --target $extension \
+                             --platform linux-arm64 \
+                             --name "extensions/$extensionName" \
+                             --version 42.0.0 -t 42.0 -t 42 -t stable
+        done
+    fi
+
     # Add extensions on windows (if set).
     if [[ $system == "windows" && -n "$WINDOWS_TEST_EXTENSIONS" ]]; then
         for extension in ${WINDOWS_TEST_EXTENSIONS//,/ }
diff --git a/tools/tuf/test/docker_package.sh b/tools/tuf/test/docker_package.sh
index 0707a4750c92..35b00c60cf76 100755
--- a/tools/tuf/test/docker_package.sh
+++ b/tools/tuf/test/docker_package.sh
@@ -15,7 +15,7 @@ BASE_FLEET_URL=$2
 
 rm -rf test_tuf desktop.tar.gz
 
-SYSTEMS="macos windows linux" \
+SYSTEMS="macos windows linux linux-arm64" \
 PKG_FLEET_URL=$BASE_FLEET_URL \
 PKG_TUF_URL=$BASE_TUF_URL \
 DEB_FLEET_URL=$BASE_FLEET_URL \
diff --git a/tools/tuf/test/gen_pkgs.sh b/tools/tuf/test/gen_pkgs.sh
index 517357a1df45..f1fcddeb58f6 100755
--- a/tools/tuf/test/gen_pkgs.sh
+++ b/tools/tuf/test/gen_pkgs.sh
@@ -24,7 +24,7 @@ set -ex
 #
 # ENROLL_SECRET: Fleet server enroll secret.
 # ROOT_KEYS: TUF repository root keys.
-# FLEET_DESKTOP: Whether to build with Fleet Desktop support. 
+# FLEET_DESKTOP: Whether to build with Fleet Desktop support.
 # INSECURE: Whether to use the --insecure flag.
 # USE_FLEET_SERVER_CERTIFICATE: Whether to use a custom certificate bundle.
 # USE_UPDATE_SERVER_CERTIFICATE: Whether to use a custom certificate bundle.
@@ -61,9 +61,34 @@ if [ -n "$GENERATE_PKG" ]; then
 fi
 
 if [ -n "$GENERATE_DEB" ]; then
-    echo "Generating deb..."
+    echo "Generating deb (amd64)..."
     ./build/fleetctl package \
         --type=deb \
+        --arch=amd64 \
+        ${FLEET_DESKTOP:+--fleet-desktop} \
+        --fleet-url=$DEB_FLEET_URL \
+        --enroll-secret=$ENROLL_SECRET \
+        ${USE_FLEET_SERVER_CERTIFICATE:+--fleet-certificate=./tools/osquery/fleet.crt} \
+        ${USE_UPDATE_SERVER_CERTIFICATE:+--update-tls-certificate=./tools/osquery/fleet.crt} \
+        ${INSECURE:+--insecure} \
+        ${DEBUG:+--debug} \
+        --update-roots="$ROOT_KEYS" \
+        --update-interval=10s \
+        --disable-open-folder \
+        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
+        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-key=./tools/test-orbit-mtls/client.key} \
+        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
+        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \
+        ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \
+        ${ENABLE_SCRIPTS:+--enable-scripts} \
+        --update-url=$DEB_TUF_URL
+fi
+
+if [ -n "$GENERATE_DEB_ARM64" ]; then
+    echo "Generating deb (arm64)..."
+    ./build/fleetctl package \
+        --type=deb \
+        --arch=arm64 \
         ${FLEET_DESKTOP:+--fleet-desktop} \
         --fleet-url=$DEB_FLEET_URL \
         --enroll-secret=$ENROLL_SECRET \
@@ -84,9 +109,34 @@ if [ -n "$GENERATE_DEB" ]; then
 fi
 
 if [ -n "$GENERATE_RPM" ]; then
-    echo "Generating rpm..."
+    echo "Generating rpm (amd64)..."
     ./build/fleetctl package \
         --type=rpm \
+        --arch=amd64 \
+        ${FLEET_DESKTOP:+--fleet-desktop} \
+        --fleet-url=$RPM_FLEET_URL \
+        --enroll-secret=$ENROLL_SECRET \
+        ${USE_FLEET_SERVER_CERTIFICATE:+--fleet-certificate=./tools/osquery/fleet.crt} \
+        ${USE_UPDATE_SERVER_CERTIFICATE:+--update-tls-certificate=./tools/osquery/fleet.crt} \
+        ${INSECURE:+--insecure} \
+        ${DEBUG:+--debug} \
+        --update-roots="$ROOT_KEYS" \
+        --update-interval=10s \
+        --disable-open-folder \
+        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
+        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-key=./tools/test-orbit-mtls/client.key} \
+        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
+        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \
+        ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \
+        ${ENABLE_SCRIPTS:+--enable-scripts} \
+        --update-url=$RPM_TUF_URL
+fi
+
+if [ -n "$GENERATE_RPM_ARM64" ]; then
+    echo "Generating rpm (arm64)..."
+    ./build/fleetctl package \
+        --type=rpm \
+        --arch=arm64 \
         ${FLEET_DESKTOP:+--fleet-desktop} \
         --fleet-url=$RPM_FLEET_URL \
         --enroll-secret=$ENROLL_SECRET \
@@ -133,4 +183,4 @@ echo "Packages generated."
 
 if [[ $OSTYPE == 'darwin'* && -n "$INSTALL_PKG" ]]; then
     sudo installer -pkg fleet-osquery.pkg -target /
-fi
\ No newline at end of file
+fi
diff --git a/tools/tuf/test/main.sh b/tools/tuf/test/main.sh
index 4b357107e675..6d7d4f5097a7 100755
--- a/tools/tuf/test/main.sh
+++ b/tools/tuf/test/main.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -e
+set -ex
 
 export FLEET_ROOT_PASSPHRASE=p4ssphr4s3
 export FLEET_TARGETS_PASSPHRASE=p4ssphr4s3
@@ -29,6 +29,6 @@ if [ -z "$SKIP_SERVER" ]; then
     ./tools/tuf/test/run_server.sh
 fi
 
-if [ -n "$GENERATE_PKG" ] || [ -n "$GENERATE_DEB" ] || [ -n "$GENERATE_RPM" ] || [ -n "$GENERATE_MSI" ]; then
-  ./tools/tuf/test/gen_pkgs.sh
+if [ -n "$GENERATE_PKG" ] || [ -n "$GENERATE_DEB" ] || [ -n "$GENERATE_RPM" ] || [ -n "$GENERATE_MSI" ] || [ -n "$GENERATE_DEB_ARM64" ] || [ -n "$GENERATE_RPM_ARM64" ]; then
+    bash ./tools/tuf/test/gen_pkgs.sh
 fi
diff --git a/tools/wix-docker/Dockerfile b/tools/wix-docker/Dockerfile
index cc6889eddcbe..f9b78915afd2 100644
--- a/tools/wix-docker/Dockerfile
+++ b/tools/wix-docker/Dockerfile
@@ -1,4 +1,4 @@
-FROM debian:bullseye-slim@sha256:cc4cc29b4ba8182fca324920f64ff68a3b24acefd4c7ba8a2e5bd4e81ac3bacf
+FROM debian:stable-slim@sha256:90128f59a7c6f6fdcb6493f587ea352d5c7507f52a6ddfba66fc56cd3d99dc2b
 
 RUN true \
     && dpkg --add-architecture i386 \
diff --git a/webpack.config.js b/webpack.config.js
index 8b0678281109..72e49e6799d1 100644
--- a/webpack.config.js
+++ b/webpack.config.js
@@ -131,6 +131,7 @@ const config = {
   resolve: {
     extensions: [".tsx", ".ts", ".js", ".jsx", ".json"],
     modules: [path.resolve(path.join(repo, "./frontend")), "node_modules"],
+    fallback: { path: require.resolve("path-browserify") },
   },
 };
 
diff --git a/website/api/controllers/admin/view-email-template-preview.js b/website/api/controllers/admin/view-email-template-preview.js
index 08c6a0589bf1..4e13a0cd32ea 100644
--- a/website/api/controllers/admin/view-email-template-preview.js
+++ b/website/api/controllers/admin/view-email-template-preview.js
@@ -114,6 +114,55 @@ module.exports = {
         layout = 'layout-email';
         fakeData = {};
         break;
+      case 'email-nurture-stage-three':
+        layout = 'layout-nurture-email';
+        fakeData = {
+          firstName: 'Sage',
+          emailAddress: 'sage@example.com',
+        };
+        break;
+      case 'email-nurture-stage-four':
+        layout = 'layout-nurture-email';
+        fakeData = {
+          firstName: 'Sage',
+          emailAddress: 'sage@example.com',
+        };
+        break;
+      case 'email-nurture-stage-five':
+        layout = 'layout-nurture-email';
+        fakeData = {
+          firstName: 'Sage',
+          emailAddress: 'sage@example.com',
+        };
+        break;
+      case 'email-deal-registration':
+        layout = 'layout-email';
+        fakeData = {
+          submittersFirstName: 'Jane',
+          submittersLastName: 'Williamson',
+          submittersEmailAddress: 'jane@example.com',
+          submittersOrganization: 'Fake organization',
+          customersFirstName: 'Sage',
+          customersLastName: 'Scorpion',
+          customersEmailAddress: 'sage@example.com',
+          linkedinUrl: 'https://www.linkedin.com/in/sage-scorpion/',
+          customersOrganization: 'Fake organization 2',
+          customersCurrentMdm: 'Omnissa',
+          otherMdmEvaluated: 'Jamf protect',
+          preferredHosting: 'Managed cloud',
+          expectedDealSize: '$30,000',
+          expectedCloseDate: '09/28/2024',
+          notes: 'Fake organization 2 is looking for a managed cloud MDM solution with a name that ends with "eet"',
+        };
+        break;
+      case 'email-contact-form':
+        fakeData = {
+          firstName: 'Jane',
+          lastName: 'Williamson',
+          emailAddress: 'jane@example.com',
+          message: 'Hi, this is a contact form message!',
+        };
+        break;
       default:
         layout = 'layout-email-newsletter';
         fakeData = {
diff --git a/website/api/controllers/articles/view-articles.js b/website/api/controllers/articles/view-articles.js
index f8b685a8eb48..b7f11213ebdd 100644
--- a/website/api/controllers/articles/view-articles.js
+++ b/website/api/controllers/articles/view-articles.js
@@ -48,9 +48,10 @@ module.exports = {
           return page;
         }
       });
+      articles = _.sortBy(articles, 'meta.publishedOn');
     }
 
-    let pageTitleForMeta = 'Fleet blog | Fleet';
+    let pageTitleForMeta = 'Fleet blog';
     let pageDescriptionForMeta = 'Read the latest articles written by Fleet.';
     // Create a currentSection variable, this will be used to highlight the header dropdown that this article category lives under.
     // There are three possible values for this (documentation, community, and platform), so we'll default to the one with the most article categories (community) and set the value to another section if needed.
@@ -60,39 +61,39 @@ module.exports = {
     // Set a pageTitleForMeta, pageDescriptionForMeta, and currentSection variable based on the article category.
     switch(category) {
       case 'success-stories':
-        pageTitleForMeta = 'Success stories | Fleet';
+        pageTitleForMeta = 'Success stories';
         pageDescriptionForMeta = 'Read about how others are using Fleet and osquery.';
         currentSection = 'platform';
         break;
       case 'deploy':
-        pageTitleForMeta = 'Deployment guides | Fleet';
+        pageTitleForMeta = 'Deployment guides';
         pageDescriptionForMeta = 'Learn how to deploy Fleet on a variety of production environments.';
         currentSection = 'documentation';
         break;
       case 'releases':
-        pageTitleForMeta = 'Releases | Fleet';
+        pageTitleForMeta = 'Releases';
         pageDescriptionForMeta = 'Fleet releases new and updated features every three weeks. Read about the latest product improvements here.';
         currentSection = 'documentation';
         break;
       case 'guides':
-        pageTitleForMeta = 'Guides | Fleet';
+        pageTitleForMeta = 'Guides';
         pageDescriptionForMeta = 'A collection of how-to guides for Fleet and osquery.';
         currentSection = 'documentation';
         break;
       case 'securing':
-        pageTitleForMeta = 'Security articles | Fleet';
+        pageTitleForMeta = 'Security articles';
         pageDescriptionForMeta = 'Learn more about how we secure Fleet.';
         break;
       case 'engineering':
-        pageTitleForMeta = 'Engineering articles | Fleet';
+        pageTitleForMeta = 'Engineering articles';
         pageDescriptionForMeta = 'Read about engineering at Fleet and beyond.';
         break;
       case 'announcements':
-        pageTitleForMeta = 'Announcements | Fleet';
+        pageTitleForMeta = 'Announcements';
         pageDescriptionForMeta = 'Read the latest news from Fleet.';
         break;
       case 'podcasts':
-        pageTitleForMeta = 'Podcasts | Fleet';
+        pageTitleForMeta = 'Podcasts';
         pageDescriptionForMeta = 'Listen to the Future of Device Management podcast.';
         break;
     }
@@ -107,6 +108,7 @@ module.exports = {
       currentSection,
       pageTitleForMeta,
       pageDescriptionForMeta,
+      algoliaPublicKey: sails.config.custom.algoliaPublicKey,
     };
 
   }
diff --git a/website/api/controllers/articles/view-basic-article.js b/website/api/controllers/articles/view-basic-article.js
index e7fc38ff83e5..17b997f5f7c0 100644
--- a/website/api/controllers/articles/view-basic-article.js
+++ b/website/api/controllers/articles/view-basic-article.js
@@ -52,7 +52,7 @@ module.exports = {
     // Note: Leaving title and description as `undefined` in our view means we'll default to the generic title and description set in layout.ejs.
     let pageTitleForMeta;
     if(thisPage.meta.articleTitle) {
-      pageTitleForMeta = thisPage.meta.articleTitle + ' | Fleet';
+      pageTitleForMeta = thisPage.meta.articleTitle;
     }//fi
     let pageDescriptionForMeta;
     if(thisPage.meta.description){
diff --git a/website/api/controllers/deliver-contact-form-message.js b/website/api/controllers/deliver-contact-form-message.js
index a27b6125cff2..28cca1438b59 100644
--- a/website/api/controllers/deliver-contact-form-message.js
+++ b/website/api/controllers/deliver-contact-form-message.js
@@ -66,17 +66,34 @@ module.exports = {
       throw 'invalidEmailDomain';
     }
 
-    await sails.helpers.http.post(sails.config.custom.slackWebhookUrlForContactForm, {
-      text: `New contact form message: (Remember: we have to email back; can't just reply to this thread.) cc @sales `+
-      `Name: ${firstName + ' ' + lastName}, Email: ${emailAddress}, Message: ${message ? message : 'No message.'}`
+    // await sails.helpers.http.post(sails.config.custom.slackWebhookUrlForContactForm, {
+    //   text: `New contact form message: (Remember: we have to email back; can't just reply to this thread.) cc @sales `+
+    //   `Name: ${firstName + ' ' + lastName}, Email: ${emailAddress}, Message: ${message ? message : 'No message.'}`
+    // });
+
+    await sails.helpers.sendTemplateEmail.with({
+      to: sails.config.custom.fromEmailAddress,
+      replyTo: {
+        name: firstName + ' '+ lastName,
+        email: emailAddress,
+      },
+      subject: 'New contact form message',
+      layout: false,
+      template: 'email-contact-form',
+      templateData: {
+        emailAddress,
+        firstName,
+        lastName,
+        message,
+      },
     });
 
-    sails.helpers.salesforce.updateOrCreateContactAndAccountAndCreateLead.with({
+    sails.helpers.salesforce.updateOrCreateContactAndAccount.with({
       emailAddress: emailAddress,
       firstName: firstName,
       lastName: lastName,
-      leadSource: 'Website - Contact forms',
-      leadDescription: `Sent a contact form message: ${message}`,
+      contactSource: 'Website - Contact forms',
+      description: `Sent a contact form message: ${message}`,
     }).exec((err)=>{// Use .exec() to run the salesforce helpers in the background.
       if(err) {
         sails.log.warn(`Background task failed: When a user submitted a contact form message, a lead/contact could not be updated in the CRM for this email address: ${emailAddress}.`, err);
diff --git a/website/api/controllers/deliver-deal-registration-submission.js b/website/api/controllers/deliver-deal-registration-submission.js
new file mode 100644
index 000000000000..b98748204a0c
--- /dev/null
+++ b/website/api/controllers/deliver-deal-registration-submission.js
@@ -0,0 +1,51 @@
+module.exports = {
+
+
+  friendlyName: 'Deliver deal registration submission',
+
+
+  description: 'Sends an email with the contents of a deal registration form submission',
+
+
+  inputs: {
+    submittersFirstName: {type: 'string'},
+    submittersLastName: {type: 'string'},
+    submittersEmailAddress: {type: 'string'},
+    submittersOrganization: {type: 'string'},
+    customersFirstName: {type: 'string'},
+    customersLastName: {type: 'string'},
+    customersEmailAddress: {type: 'string'},
+    linkedinUrl: {type: 'string', defaultsTo: 'N/A'},
+    customersOrganization: {type: 'string'},
+    customersCurrentMdm: {type: 'string', defaultsTo: 'N/A'},
+    otherMdmEvaluated: {type: 'string', defaultsTo: 'N/A'},
+    preferredHosting: {type: 'string', defaultsTo: 'N/A'},
+    expectedDealSize: {type: 'string'},
+    expectedCloseDate: {type: 'string'},
+    notes: {type: 'string', defaultsTo: 'N/A'},
+  },
+
+
+  exits: {
+
+  },
+
+
+  fn: async function (inputs) {
+    if(!sails.config.custom.dealRegistrationContactEmailAddress){
+      throw new Error('Missing config variable! Please set sails.config.custom.dealRegistrationContactEmailAddress to be the email address of the person who receives deal registration submissions.');
+    }
+    // send the information to the deal registration contact email address.
+    await sails.helpers.sendTemplateEmail.with({
+      to: sails.config.custom.dealRegistrationContactEmailAddress,
+      subject: 'New deal registration form submission',
+      template: 'email-deal-registration',
+      templateData: inputs,
+    });
+    // All done.
+    return;
+
+  }
+
+
+};
diff --git a/website/api/controllers/deliver-talk-to-us-form-submission.js b/website/api/controllers/deliver-talk-to-us-form-submission.js
index 2a307b0c6354..aae36db70f5e 100644
--- a/website/api/controllers/deliver-talk-to-us-form-submission.js
+++ b/website/api/controllers/deliver-talk-to-us-form-submission.js
@@ -73,22 +73,48 @@ module.exports = {
     if(_.includes(sails.config.custom.bannedEmailDomainsForWebsiteSubmissions, emailDomain.toLowerCase())){
       throw 'invalidEmailDomain';
     }
-
-
-    sails.helpers.salesforce.updateOrCreateContactAndAccountAndCreateLead.with({
-      emailAddress: emailAddress,
-      firstName: firstName,
-      lastName: lastName,
-      organization: organization,
-      numberOfHosts: numberOfHosts,
-      primaryBuyingSituation: primaryBuyingSituation === 'eo-security' ? 'Endpoint operations - Security' : primaryBuyingSituation === 'eo-it' ? 'Endpoint operations - IT' : primaryBuyingSituation === 'mdm' ? 'Device management (MDM)' : primaryBuyingSituation === 'vm' ? 'Vulnerability management' : undefined,
-      leadSource: 'Website - Contact forms',
-      leadDescription: `Submitted the "Talk to us" form and was taken to the Calendly page for the "${numberOfHosts > 700 ? 'Talk to us' : 'Let\'s get you set up!'}" event.`,
-    }).exec((err)=>{
-      if(err) {
-        sails.log.warn(`Background task failed: When a user submitted the "Talk to us" form, a lead/contact could not be updated in the CRM for this email address: ${emailAddress}.`, err);
+    // Set a default psychological stage and change reason.
+    let psyStageAndChangeReason = {
+      psychologicalStage: '4 - Has use case',
+      psychologicalStageChangeReason: 'Website - Contact forms'
+    };
+    if(this.req.me){
+      // If this user is logged in, check their current psychological stage, and if it is higher than 4, we won't set a psystage.
+      // This way, if a user has a psytage >4, we won't regress their psystage because they submitted this form.
+      if(['4 - Has use case', '5 - Personally confident', '6 - Has team buy-in'].includes(this.req.me.psychologicalStage)) {
+        psyStageAndChangeReason = {};
       }
-    });
+    }
+    if(numberOfHosts >= 700){
+      sails.helpers.salesforce.updateOrCreateContactAndAccount.with({
+        emailAddress: emailAddress,
+        firstName: firstName,
+        lastName: lastName,
+        organization: organization,
+        primaryBuyingSituation: primaryBuyingSituation === 'eo-security' ? 'Endpoint operations - Security' : primaryBuyingSituation === 'eo-it' ? 'Endpoint operations - IT' : primaryBuyingSituation === 'mdm' ? 'Device management (MDM)' : primaryBuyingSituation === 'vm' ? 'Vulnerability management' : undefined,
+        contactSource: 'Website - Contact forms',
+        description: `Submitted the "Talk to us" form and was taken to the Calendly page for the "Talk to us" event.`,
+        ...psyStageAndChangeReason// Only (potentially) set psystage and change reason for >700 hosts.
+      }).exec((err)=>{
+        if(err) {
+          sails.log.warn(`Background task failed: When a user submitted the "Talk to us" form, a lead/contact could not be updated in the CRM for this email address: ${emailAddress}.`, err);
+        }
+      });
+    } else {
+      sails.helpers.salesforce.updateOrCreateContactAndAccount.with({
+        emailAddress: emailAddress,
+        firstName: firstName,
+        lastName: lastName,
+        organization: organization,
+        primaryBuyingSituation: primaryBuyingSituation === 'eo-security' ? 'Endpoint operations - Security' : primaryBuyingSituation === 'eo-it' ? 'Endpoint operations - IT' : primaryBuyingSituation === 'mdm' ? 'Device management (MDM)' : primaryBuyingSituation === 'vm' ? 'Vulnerability management' : undefined,
+        contactSource: 'Website - Contact forms',
+        description: `Submitted the "Talk to us" form and was taken to the Calendly page for the "Let\'s get you set up!" event.`,
+      }).exec((err)=>{
+        if(err) {
+          sails.log.warn(`Background task failed: When a user submitted the "Talk to us" form, a lead/contact could not be updated in the CRM for this email address: ${emailAddress}.`, err);
+        }
+      });
+    }
 
     return;
   }
diff --git a/website/api/controllers/docs/view-basic-documentation.js b/website/api/controllers/docs/view-basic-documentation.js
index 3961775bad48..b5d1746e8b04 100644
--- a/website/api/controllers/docs/view-basic-documentation.js
+++ b/website/api/controllers/docs/view-basic-documentation.js
@@ -69,7 +69,7 @@ module.exports = {
       compiledPagePartialsAppPath: sails.config.builtStaticContent.compiledPagePartialsAppPath,
       pageTitleForMeta: (
         thisPage.title !== 'Readme.md' ? thisPage.title + ' | Fleet documentation'// « custom meta title for this page, if provided in markdown
-        : 'Documentation | Fleet' // « otherwise we're on the landing page for this section of the site, so we'll follow the title format of other top-level pages
+        : 'Documentation' // « otherwise we're on the landing page for this section of the site, so we'll follow the title format of other top-level pages
       ),
       pageDescriptionForMeta: (
         thisPage.meta.description ? thisPage.meta.description // « custom meta description for this page, if provided in markdown
diff --git a/website/api/controllers/entrance/signup.js b/website/api/controllers/entrance/signup.js
index aeb72dc354ce..c9129ac3c6ed 100644
--- a/website/api/controllers/entrance/signup.js
+++ b/website/api/controllers/entrance/signup.js
@@ -144,6 +144,7 @@ the account verification message.)`,
       firstName: firstName,
       lastName: lastName,
       organization: organization,
+      contactSource: 'Website - Sign up'
     }).exec((err)=>{
       if(err){
         sails.log.warn(`Background task failed: When a user (email: ${newEmailAddress} signed up for a fleetdm.com account, a Contact and Account record could not be created/updated in the CRM.`, err);
diff --git a/website/api/controllers/handbook/view-basic-handbook.js b/website/api/controllers/handbook/view-basic-handbook.js
index bd30a469d63c..6c9f1b4b015a 100644
--- a/website/api/controllers/handbook/view-basic-handbook.js
+++ b/website/api/controllers/handbook/view-basic-handbook.js
@@ -64,7 +64,7 @@ module.exports = {
       compiledPagePartialsAppPath: sails.config.builtStaticContent.compiledPagePartialsAppPath,
       pageTitleForMeta: (
         thisPage.title !== 'Readme.md' ? thisPage.title + ' | Fleet handbook'// « custom meta title for this page, if provided in markdown
-        : 'Handbook | Fleet' // « otherwise we're on the landing page for this section of the site, so we'll follow the title format of other top-level pages
+        : 'Handbook' // « otherwise we're on the landing page for this section of the site, so we'll follow the title format of other top-level pages
       ),
       pageDescriptionForMeta: (
         thisPage.meta.description ? thisPage.meta.description // « custom meta description for this page, if provided in markdown
diff --git a/website/api/controllers/save-questionnaire-progress.js b/website/api/controllers/save-questionnaire-progress.js
index 71e9d467e13f..5cf77ba3cf81 100644
--- a/website/api/controllers/save-questionnaire-progress.js
+++ b/website/api/controllers/save-questionnaire-progress.js
@@ -21,6 +21,7 @@ module.exports = {
         'what-does-your-team-manage-eo-it',
         'what-does-your-team-manage-vm',
         'what-do-you-manage-mdm',
+        'cross-platform-mdm',
         'is-it-any-good',
         'what-did-you-think',
         'deploy-fleet-in-your-environment',
@@ -86,28 +87,25 @@ module.exports = {
     // 'how-many-hosts': Stage 4/5/6
     // 'will-you-be-self-hosting': Stage 5/6
     // 'what-are-you-working-on-eo-security'
-    //  - no-use-case-yet: » Stage 2/3 (depends on answer from 'have-you-ever-used-fleet' step)
     //  - All other options » Stage 4
     // 'what-does-your-team-manage-eo-it'
-    //  - no-use-case-yet: » Stage 2/3 (depends on answer from 'have-you-ever-used-fleet' step)
     //  - All other options » Stage 4
     // 'what-does-your-team-manage-vm'
-    //  - no-use-case-yet: » Stage 2/3 (depends on answer from 'have-you-ever-used-fleet' step)
     //  - All other options » Stage 4
     // 'what-do-you-manage-mdm'
-    //  - no-use-case-yet: » Stage 2/3 (depends on answer from 'have-you-ever-used-fleet' step)
+    //  - no-use-case-yet: » Stage 3
     //  - All other options » Stage 4
-    // 'is-it-any-good': Stage 2/3/4 (depends on answer from 'have-you-ever-used-fleet' & the buying situation specific step)
+    // 'is-it-any-good': Stage 3/4 (depends on answer from 'have-you-ever-used-fleet' & the buying situation specific step)
     // 'what-did-you-think'
-    //  - host-fleet-for-me » Stage 4
-    //  - deploy-fleet-in-environment » Stage 4
+    //  - host-fleet-for-me » Stage 5
+    //  - deploy-fleet-in-environment » Stage 5
     //  - let-me-think-about-it »  Stage 2
     // FUTURE: Should the step about deploying fleet in your env be here?  (For same reason is-it-any-good is here: when navigating back then forwards?)
     // 'how-was-your-deployment'
     //  - up-and-running »  Stage 5
-    //  - kinda-stuck »  Stage 4 (...at best!  Still got the use case.)
-    //  - havent-gotten-to-it » Stage 4 (same as above)
-    //  - changed-mind-want-managed-deployment » Stage 4 (same as above)
+    //  - kinda-stuck »  Stage 5
+    //  - havent-gotten-to-it » Stage 5
+    //  - changed-mind-want-managed-deployment » Stage 5
     //  - decided-to-not-use-fleet » Stage 2
     // 'whats-left-to-get-you-set-up'
     //  - need-premium-license-key » No change (Stage ??)
@@ -116,6 +114,7 @@ module.exports = {
     //  - nothing » No change (Stage ??)
 
     let psychologicalStage = userRecord.psychologicalStage;
+    let psychologicalStageLastChangedAt = userRecord.psychologicalStageLastChangedAt;
     // Get the value of the submitted formData, we do this so we only need to check one variable, instead of (formData.attribute === 'foo');
     let valueFromFormData = _.values(formData)[0];
     if(currentStep === 'start') {
@@ -123,17 +122,13 @@ module.exports = {
     } else if(currentStep === 'what-are-you-using-fleet-for') {
       psychologicalStage = '2 - Aware';
     } else if(currentStep === 'have-you-ever-used-fleet') {
-      if(['yes-deployed'].includes(valueFromFormData)) {
+      if(valueFromFormData === 'yes-deployed') {
         // If the user has Fleet deployed, set their stage to 6.
         psychologicalStage = '6 - Has team buy-in';
-      } else if(valueFromFormData === 'yes-recently-deployed'){
+      } else if(valueFromFormData === 'yes-recently-deployed') {
         psychologicalStage = '5 - Personally confident';
-      } else if(valueFromFormData === 'yes-deployed-local'){
-        // If they've tried Fleet locally, set their stage to 3.
-        psychologicalStage = '3 - Intrigued';
       } else {
-        // Otherwise, we'll just assume liu're only aware.  Maybe liu don't fully grasp what Fleet can do.
-        psychologicalStage = '2 - Aware';
+        psychologicalStage = '3 - Intrigued';
       }
     } else {
       // If the user submitted any other step, we'll set variables using the answers to the previous questions.
@@ -143,13 +138,7 @@ module.exports = {
       let hasUsedFleetAnswer = questionnaireProgress['have-you-ever-used-fleet'].fleetUseStatus;
       if(['what-are-you-working-on-eo-security','what-does-your-team-manage-eo-it','what-does-your-team-manage-vm','what-do-you-manage-mdm'].includes(currentStep)){
         if(valueFromFormData === 'no-use-case-yet') {
-          // Check the user's answer to the previous question
-          if(hasUsedFleetAnswer === 'yes-deployed-local'){
-            // If they've tried Fleet locally, set their stage to 3.
-            psychologicalStage = '3 - Intrigued';
-          } else {
-            psychologicalStage = '2 - Aware';
-          }
+          psychologicalStage = '3 - Intrigued';
         } else {// Otherwise, they have a use case and will be set to stage 4.
           psychologicalStage = '4 - Has use case';
         }
@@ -159,12 +148,7 @@ module.exports = {
           // be selected,  we'll check the user's previous answers before changing their psyStage
           if(questionnaireProgress['what-do-you-manage-mdm'].mdmUseCase === 'no-use-case-yet'){
             // Check the user's answer to the have-you-ever-used-fleet question.
-            if(hasUsedFleetAnswer === 'yes-deployed-local') {
-              // If they've tried Fleet locally, set their stage to 3.
-              psychologicalStage = '3 - Intrigued';
-            } else {
-              psychologicalStage = '2 - Aware';
-            }
+            psychologicalStage = '3 - Intrigued';
           } else {
             psychologicalStage = '4 - Has use case';
           }
@@ -176,27 +160,22 @@ module.exports = {
         // If the user selects "Let me think about it", set their psyStage to 2.
         if(valueFromFormData === 'let-me-think-about-it') {
           psychologicalStage = '2 - Aware';
-        } else if (['deploy-fleet-in-environment','host-fleet-for-me'].includes(valueFromFormData)) {
-          psychologicalStage = '4 - Has use case';
+        } else if (['host-fleet-for-me', 'deploy-fleet-in-environment'].includes(valueFromFormData)) {
+          psychologicalStage = '5 - Personally confident';
         } else { require('assert')(false,'This should never happen.'); }
       } else if(currentStep === 'how-was-your-deployment') {
         if(valueFromFormData === 'decided-to-not-use-fleet') {
           psychologicalStage = '2 - Aware';
-        } else if(valueFromFormData === 'up-and-running'){
+        } else if(['up-and-running', 'changed-mind-want-managed-deployment', 'kinda-stuck', 'havent-gotten-to-it'].includes(valueFromFormData)){
           psychologicalStage = '5 - Personally confident';
-        } else if(['kinda-stuck', 'havent-gotten-to-it', 'changed-mind-want-managed-deployment'].includes(valueFromFormData)){
-          psychologicalStage = '4 - Has use case';
         } else { require('assert')(false,'This should never happen.'); }
       } else if (currentStep === 'whats-left-to-get-you-set-up') {
         // FUTURE: do more stuff (for now this always acts like 'no change')
       } else if(currentStep === 'how-many-hosts') {
         if(['yes-deployed'].includes(hasUsedFleetAnswer)) {
           psychologicalStage = '6 - Has team buy-in';
-        } else if(['yes-recently-deployed'].includes(hasUsedFleetAnswer)){
-          psychologicalStage = '5 - Personally confident';
         } else {
-          // IWMIH then we want Fleet to host for us (either because we wanted that from the get-go, or we backtracked because deploying looked too time-consuming)
-          psychologicalStage = '4 - Has use case';
+          psychologicalStage = '5 - Personally confident';
         }
       } else if(currentStep === 'will-you-be-self-hosting') {
         if(['yes-deployed'].includes(hasUsedFleetAnswer)) {
@@ -208,9 +187,32 @@ module.exports = {
         psychologicalStage = '2 - Aware';
       }//fi
     }//fi
-
+    // Set the user's answer to the current step.
+    questionnaireProgress[currentStep] = formData;
+    // Clone the questionnaireProgress to prevent any mutations from sending it through the updateOne Waterline method.
+    let getStartedProgress = _.clone(questionnaireProgress);
+    let questionnaireProgressAsAFormattedString = undefined;// Default to undefined.
+    // Using a try catch block to handle errors from JSON.stringify.
+    try {
+      questionnaireProgressAsAFormattedString = JSON.stringify(getStartedProgress)
+      .replace(/[\{|\}|"]/g, '')// Remove the curly braces and quotation marks wrapping JSON objects
+      .replace(/,/g, '\n')// Replace commas with newlines.
+      .replace(/:\w+:/g, ':\t');// Replace the key from the formData with a color and tab, (e.g., what-are-you-using-fleet-for:primaryBuyingSituation:eo-security, » what-are-you-using-fleet-for:   eo-security)
+    } catch(err){
+      sails.log.warn(`When converting a user's (email: ${this.req.me.emailAddress}) getStartedQuestionnaireAnswers to a formatted string to send to the CRM, and error occurred`, err);
+    }
     // Only update CRM records if the user's psychological stage changes.
     if(psychologicalStage !== userRecord.psychologicalStage) {
+      let psychologicalStageChangeReason = 'Website - Organic start flow'; // Default psystageChangeReason to "Website - Organic start flow"
+      if(this.req.session.adAttributionString && this.req.session.visitedSiteFromAdAt) {
+        let thirtyMinutesAgoAt = Date.now() - (1000 * 60 * 30);
+        // If this user visited the website from an ad, set the psychologicalStageChangeReason to be the adCampaignId stored in their session.
+        if(this.req.session.visitedSiteFromAdAt > thirtyMinutesAgoAt) {
+          psychologicalStageChangeReason = this.req.session.adAttributionString;
+        }
+      }
+      // Update the psychologicalStageLastChangedAt timestamp if the user's psychological stage
+      psychologicalStageLastChangedAt = Date.now();
       sails.helpers.salesforce.updateOrCreateContactAndAccount.with({
         emailAddress: this.req.me.emailAddress,
         firstName: this.req.me.firstName,
@@ -218,6 +220,9 @@ module.exports = {
         primaryBuyingSituation: primaryBuyingSituation === 'eo-security' ? 'Endpoint operations - Security' : primaryBuyingSituation === 'eo-it' ? 'Endpoint operations - IT' : primaryBuyingSituation === 'mdm' ? 'Device management (MDM)' : primaryBuyingSituation === 'vm' ? 'Vulnerability management' : undefined,
         organization: this.req.me.organization,
         psychologicalStage,
+        psychologicalStageChangeReason,
+        getStartedResponses: questionnaireProgressAsAFormattedString,
+        contactSource: 'Website - Sign up',
       }).exec((err)=>{
         if(err){
           sails.log.warn(`Background task failed: When a user (email: ${this.req.me.emailAddress} submitted a step of the get started questionnaire, a Contact and Account record could not be created/updated in the CRM.`, err);
@@ -225,20 +230,16 @@ module.exports = {
         return;
       });
     }//fi
-    // TODO: send all other answers to Salesforce (when there are fields for them)
-    // Set the user's answer to the current step.
-    questionnaireProgress[currentStep] = formData;
-    // Clone the questionnaireProgress to prevent any mutations from sending it through the updateOne Waterline method.
-    let getStartedProgress = _.clone(questionnaireProgress);
     // Update the user's database model.
     await User.updateOne({id: userRecord.id})
     .set({
       getStartedQuestionnaireAnswers: questionnaireProgress,
       lastSubmittedGetStartedQuestionnaireStep: currentStep,
-      psychologicalStage
+      psychologicalStage,
+      psychologicalStageLastChangedAt,
     });
     // Return the JSON dictionary of form data submitted by this user.
-    return getStartedProgress;
+    return {getStartedProgress, psychologicalStage, primaryBuyingSituation};
   }
 
 
diff --git a/website/api/controllers/unsubscribe-from-marketing-emails.js b/website/api/controllers/unsubscribe-from-marketing-emails.js
new file mode 100644
index 000000000000..26a9b53ee8a3
--- /dev/null
+++ b/website/api/controllers/unsubscribe-from-marketing-emails.js
@@ -0,0 +1,79 @@
+module.exports = {
+
+
+  friendlyName: 'Unsubscribe from marketing emails',
+
+
+  description: 'Unsubscribes a specified email address from the nurture email automation.',
+
+
+  inputs: {
+    emailAddress: {
+      type: 'string',
+      description: 'The email address of the user who wants to unsubscribe from marketing emails.',
+      required: true,
+    }
+  },
+
+
+  exits: {
+    userNotFound: {
+      description: 'The provided email address could not be matched to a Fleet user account',
+      responseType: 'badRequest',
+    },
+    success: {
+      description: 'The user has opted out of markering emails',
+    }
+  },
+
+
+  fn: async function ({emailAddress}) {
+
+    let userRecord = await User.findOne({emailAddress: emailAddress});
+
+    if(!userRecord){
+      throw 'userNotFound';
+    }
+    // Update the user record for this email address to set their nurture email timestamps to 1
+    // so they are excluded them from future runs of the deliver-nurture-emails script.
+    // FUTURE: update the user model to have a subscribedToNurtureEmails attribute.
+    await User.updateOne({emailAddress: emailAddress}).set({
+      stageThreeNurtureEmailSentAt: 1,
+      stageFourNurtureEmailSentAt: 1,
+      stageFiveNurtureEmailSentAt: 1,
+    });
+
+    // Update the contact record in salesforce for this email address to indicate that they have opted out of marketing emails.
+    if(sails.config.environment === 'production'){
+      require('assert')(sails.config.custom.salesforceIntegrationUsername);
+      require('assert')(sails.config.custom.salesforceIntegrationPasskey);
+
+      // Log in to Salesforce.
+      let jsforce = require('jsforce');
+      let salesforceConnection = new jsforce.Connection({
+        loginUrl : 'https://fleetdm.my.salesforce.com'
+      });
+      await salesforceConnection.login(sails.config.custom.salesforceIntegrationUsername, sails.config.custom.salesforceIntegrationPasskey);
+
+      let existingContactRecord = await salesforceConnection.sobject('Contact')
+      .findOne({
+        Email:  emailAddress,
+      });
+
+      if(existingContactRecord) {
+        //If we found an existing contact record in salesforce, update its status to be "Do not contact"
+        let salesforceContactId = existingContactRecord.Id;
+        await salesforceConnection.sobject('Contact')
+        .update({
+          Id: salesforceContactId,
+          Unsubscribed_from_email_contact__c: true,// eslint-disable-line camelcase
+        });
+      }
+    }
+    // Redirect the user to the homepage with a #unsubscribe hash link.
+    return this.res.redirect('/#unsubscribed');
+
+  }
+
+
+};
diff --git a/website/api/controllers/view-deals.js b/website/api/controllers/view-deals.js
new file mode 100644
index 000000000000..02a646f78138
--- /dev/null
+++ b/website/api/controllers/view-deals.js
@@ -0,0 +1,27 @@
+module.exports = {
+
+
+  friendlyName: 'View deals',
+
+
+  description: 'Display "Deals" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/deals'
+    }
+
+  },
+
+
+  fn: async function () {
+
+    // Respond with view.
+    return {};
+
+  }
+
+
+};
diff --git a/website/api/controllers/view-endpoint-ops.js b/website/api/controllers/view-endpoint-ops.js
index ec913c697218..fbeeda63aebb 100644
--- a/website/api/controllers/view-endpoint-ops.js
+++ b/website/api/controllers/view-endpoint-ops.js
@@ -22,14 +22,24 @@ module.exports = {
     }
     // Get testimonials for the <scrolalble-tweets> component.
     let testimonialsForScrollableTweets = _.clone(sails.config.builtStaticContent.testimonials);
+    // Default the pagePersonalization to the user's primaryBuyingSituation.
+    let pagePersonalization = this.req.session.primaryBuyingSituation;
+    // If a pageMode query parameter is set, update the pagePersonalization value.
+    // Note: This is the only page we're using this method instead of using the primaryBuyingSiutation value set in the users session.
+    // This lets us link to the security and IT versions of the endpoint ops page from the unpersonalized homepage without changing the users primaryBuyingSituation.
+    if(this.req.param('pageMode') === 'it'){
+      pagePersonalization = 'eo-it';
+    } else if(this.req.param('pageMode') === 'security'){
+      pagePersonalization = 'eo-security';
+    }
 
 
     // Specify an order for the testimonials on this page using the last names of quote authors
-    let testimonialOrderForThisPage = ['Charles Zaffery','Dan Grzelak','Nico Waisman','Tom Larkin','Austin Anderson','Erik Gomez','Nick Fohs','Brendan Shaklovitz','Mike Arpaia','Andre Shields','Dhruv Majumdar','Ahmed Elshaer','Abubakar Yousafzai','Harrison Ravazzolo','Wes Whetstone','Kenny Botelho', 'Chandra Majumdar','Eric Tan'];
-    if(['eo-it', 'mdm'].includes(this.req.session.primaryBuyingSituation)){
-      testimonialOrderForThisPage = [ 'Harrison Ravazzolo', 'Eric Tan','Erik Gomez', 'Tom Larkin', 'Nick Fohs', 'Wes Whetstone', 'Mike Arpaia', 'Kenny Botelho'];
-    } else if(['eo-security', 'vm'].includes(this.req.session.primaryBuyingSituation)){
-      testimonialOrderForThisPage = ['Nico Waisman','Charles Zaffery','Abubakar Yousafzai','Eric Tan','Mike Arpaia','Chandra Majumdar','Ahmed Elshaer','Brendan Shaklovitz','Austin Anderson','Dan Grzelak','Dhruv Majumdar'];
+    let testimonialOrderForThisPage = ['Charles Zaffery','Dan Grzelak','Nico Waisman','Tom Larkin','Austin Anderson','Erik Gomez','Nick Fohs','Brendan Shaklovitz','Mike Arpaia','Andre Shields','Dhruv Majumdar','Ahmed Elshaer','Abubakar Yousafzai','Wes Whetstone','Kenny Botelho', 'Chandra Majumdar','Eric Tan', 'Alvaro Gutierrez', 'Joe Pistone'];
+    if(['eo-it', 'mdm'].includes(pagePersonalization)){
+      testimonialOrderForThisPage = [ 'Eric Tan','Erik Gomez', 'Tom Larkin', 'Nick Fohs', 'Wes Whetstone', 'Mike Arpaia', 'Kenny Botelho', 'Alvaro Gutierrez'];
+    } else if(['eo-security', 'vm'].includes(pagePersonalization)){
+      testimonialOrderForThisPage = ['Nico Waisman','Charles Zaffery','Abubakar Yousafzai','Eric Tan','Mike Arpaia','Chandra Majumdar','Ahmed Elshaer','Brendan Shaklovitz','Austin Anderson','Dan Grzelak','Dhruv Majumdar','Alvaro Gutierrez', 'Joe Pistone'];
     }
     // Filter the testimonials by product category and the filtered list we built above.
     testimonialsForScrollableTweets = _.filter(testimonialsForScrollableTweets, (testimonial)=>{
@@ -48,6 +58,7 @@ module.exports = {
     // Respond with view.
     return {
       testimonialsForScrollableTweets,
+      pagePersonalization,
     };
 
   }
diff --git a/website/api/controllers/view-pricing.js b/website/api/controllers/view-pricing.js
index 867fecbcdd56..e2b2794d4793 100644
--- a/website/api/controllers/view-pricing.js
+++ b/website/api/controllers/view-pricing.js
@@ -29,7 +29,7 @@ module.exports = {
 
     let pricingTable = [];
 
-    let pricingTableCategories = ['Support', 'Deployment', 'Integrations','Device management', 'Endpoint operations', 'Vulnerability management'];
+    let pricingTableCategories = ['Devices', 'Deployment', 'Configuration', 'Integrations', 'Support'];
     for(let category of pricingTableCategories) {
       // Get all the features in that have a pricingTableFeatures array that contains this category.
       let featuresInThisCategory = _.filter(pricingTableFeatures, (feature)=>{
@@ -38,44 +38,45 @@ module.exports = {
       // Build a dictionary containing the category name, and all features in the category, sorting premium features to the bottom of the list.
       let allFeaturesInThisCategory = {
         categoryName: category,
-        features: _.sortBy(featuresInThisCategory, (feature)=>{
-          return feature.tier !== 'Free';
-        })
+        features: featuresInThisCategory,
       };
       // Add the dictionaries to the arrays that we'll use to build the features table.
       pricingTable.push(allFeaturesInThisCategory);
     }
 
-    let pricingTableForSecurity = _.filter(pricingTable, (category)=>{
-      return category.categoryName !== 'Device management' && (category.usualDepartment === 'Security' || category.usualDepartment === undefined);
-    });
-    let categoryOrderForSecurityPricingTable = ['Support', 'Deployment', 'Integrations', 'Endpoint operations', 'Vulnerability management'];
-    // Sort the security-focused pricing table from the order of the elements in the categoryOrderForSecurityPricingTable array.
-    pricingTableForSecurity.sort((a, b)=>{
-      // If there is a category that is not in the list above, sort it to the end of the list.
-      if(categoryOrderForSecurityPricingTable.indexOf(a.categoryName) === -1){
-        return 1;
-      } else if(categoryOrderForSecurityPricingTable.indexOf(b.categoryName) === -1) {
-        return -1;
-      }
-      return categoryOrderForSecurityPricingTable.indexOf(a.categoryName) - categoryOrderForSecurityPricingTable.indexOf(b.categoryName);
-    });
-
-
-    let pricingTableForIt = _.filter(pricingTable, (category)=>{
-      return category.categoryName !== 'Vulnerability management' && (category.usualDepartment === 'Security' || category.usualDepartment === undefined);
-    });
-    let categoryOrderForITPricingTable = ['Device management', 'Support', 'Deployment', 'Integrations', 'Endpoint operations'];
+    let pricingTableForSecurity = [];
+    let categoryOrderForSecurityPricingTable = ['Devices', 'Deployment', 'Configuration', 'Integrations', 'Support'];
+    for(let category of categoryOrderForSecurityPricingTable) {
+      // Get all the features in that have a pricingTableFeatures array that contains this category.
+      let featuresInThisCategory = _.filter(pricingTableFeatures, (feature)=>{
+        return _.contains(feature.pricingTableCategories, category) && (feature.usualDepartment === 'Security' || feature.usualDepartment === undefined);
+      });
+      // Build a dictionary containing the category name, and all features in the category
+      let allSecurityFeaturesInThisCategory = {
+        categoryName: category,
+        features: featuresInThisCategory,
+      };
+      // Add the dictionaries to the arrays that we'll use to build the features table.
+      pricingTableForSecurity.push(allSecurityFeaturesInThisCategory);
+    }
+
+
+    let categoryOrderForITPricingTable = ['Devices', 'Deployment', 'Configuration', 'Integrations', 'Support'];
+    let pricingTableForIt = [];
     // Sort the IT-focused pricing table from the order of the elements in the categoryOrderForITPricingTable array.
-    pricingTableForIt.sort((a, b)=>{
-      // If there is a category that is not in the list above, sort it to the end of the list.
-      if(categoryOrderForITPricingTable.indexOf(a.categoryName) === -1){
-        return 1;
-      } else if(categoryOrderForITPricingTable.indexOf(b.categoryName) === -1) {
-        return -1;
-      }
-      return categoryOrderForITPricingTable.indexOf(a.categoryName) - categoryOrderForITPricingTable.indexOf(b.categoryName);
-    });
+    for(let category of categoryOrderForITPricingTable) {
+      // Get all the features in that have a pricingTableFeatures array that contains this category.
+      let featuresInThisCategory = _.filter(pricingTableFeatures, (feature)=>{
+        return _.contains(feature.pricingTableCategories, category) && (feature.usualDepartment === 'IT' || feature.usualDepartment === undefined);
+      });
+      // Build a dictionary containing the category name, and all features in the category, sorting premium features to the bottom of the list.
+      let allItFeaturesInThisCategory = {
+        categoryName: category,
+        features: featuresInThisCategory,
+      };
+      // Add the dictionaries to the arrays that we'll use to build the features table.
+      pricingTableForIt.push(allItFeaturesInThisCategory);
+    }
 
 
     // Respond with view.
diff --git a/website/api/controllers/view-query-detail.js b/website/api/controllers/view-query-detail.js
index 3d974034ad14..c4f8f5143099 100644
--- a/website/api/controllers/view-query-detail.js
+++ b/website/api/controllers/view-query-detail.js
@@ -35,7 +35,7 @@ module.exports = {
     }
 
     // Setting the meta title and description of this page using the query object, and falling back to a generic title or description if query.name or query.description are missing.
-    let pageTitleForMeta = query.name ? query.name + ' | Query details' : 'Query details | Fleet';
+    let pageTitleForMeta = query.name ? query.name + ' | Query details' : 'Query details';
     let pageDescriptionForMeta = query.description ? query.description : 'View more information about a query in Fleet\'s standard query library';
     // Respond with view.
     return {
diff --git a/website/api/controllers/view-transparency.js b/website/api/controllers/view-transparency.js
index c079ed530034..726779202669 100644
--- a/website/api/controllers/view-transparency.js
+++ b/website/api/controllers/view-transparency.js
@@ -6,7 +6,6 @@ module.exports = {
 
   description: 'Display "Transparency" page.',
 
-
   exits: {
 
     success: {
@@ -17,9 +16,8 @@ module.exports = {
 
 
   fn: async function () {
-
     // Respond with view.
-    return {};
+    return {showSecureframeBanner: this.req.param('utm_content') === 'secureframe'};
 
   }
 
diff --git a/website/api/controllers/view-vulnerability-management.js b/website/api/controllers/view-vulnerability-management.js
index 9044541e49ee..2a9c2ae04ce2 100644
--- a/website/api/controllers/view-vulnerability-management.js
+++ b/website/api/controllers/view-vulnerability-management.js
@@ -29,7 +29,7 @@ module.exports = {
     });
 
     // Specify an order for the testimonials on this page using the last names of quote authors
-    let testimonialOrderForThisPage = ['Nico Waisman', 'Andre Shields', 'Dhruv Majumdar', 'Austin Anderson', 'Dan Grzelak', 'Nick Fohs', 'Chandra Majumdar'];
+    let testimonialOrderForThisPage = ['Nico Waisman', 'Andre Shields', 'Dhruv Majumdar', 'Austin Anderson', 'Dan Grzelak', 'Nick Fohs', 'Chandra Majumdar', 'Charles Zaffery'];
     testimonialsForScrollableTweets.sort((a, b)=>{
       if(testimonialOrderForThisPage.indexOf(a.quoteAuthorName) === -1){
         return 1;
diff --git a/website/api/controllers/webhooks/receive-from-github.js b/website/api/controllers/webhooks/receive-from-github.js
index f26e97795a98..4dcbad029b2c 100644
--- a/website/api/controllers/webhooks/receive-from-github.js
+++ b/website/api/controllers/webhooks/receive-from-github.js
@@ -36,7 +36,7 @@ module.exports = {
       throw new Error(`Consistency violation: when the GitHub webhook received an event, more than one platform record was found.`);
     }
 
-    let pocketOfPrNumbersUnfrozen = platformRecord.currentUnfrozenGitHubPrNumbers;
+    // let pocketOfPrNumbersUnfrozen = platformRecord.currentUnfrozenGitHubPrNumbers;
     // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 
     // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
@@ -78,8 +78,6 @@ module.exports = {
       'sampfluger88',
       'ireedy',
       'mostlikelee',
-      'willmayhone88',
-      'pacamaster',
       'AnthonySnyder8',
       'jahzielv',
       'getvictor',
@@ -90,6 +88,9 @@ module.exports = {
       'PezHub',
       'SFriendLee',
       'ddribeiro',
+      'rebeccaui',
+      'allenhouchins',
+      'harrisonravazzolo',
     ];
 
     let GREEN_LABEL_COLOR = 'C2E0C6';// « Used in multiple places below.  (FUTURE: Use the "+" prefix for this instead of color.  2022-05-05)
@@ -446,84 +447,88 @@ module.exports = {
           githubUserToCheck: sender.login,
           isGithubUserMaintainerOrDoesntMatter: GITHUB_USERNAMES_OF_BOTS_AND_MAINTAINERS.includes(sender.login.toLowerCase())
         });
+        // (2024-07-09): The Mergefreeze requests and related code in this webhook are disabled/commented out because we are no longer freezing the main branch.
+        // FUTURE: Remove mergefreeze related code and leave a comment with a link to an older version of this file
+        // -----------------------------------------------------
         // Check whether the "main" branch is currently frozen (i.e. a feature freeze)
         // [?] https://docs.mergefreeze.com/web-api#get-freeze-status
-        let mergeFreezeMainBranchStatusReport = await sails.helpers.http.get('https://www.mergefreeze.com/api/branches/fleetdm/fleet/main', { access_token: sails.config.custom.mergeFreezeAccessToken }) //eslint-disable-line camelcase
-        .tolerate(['non200Response', 'requestFailed', {name: 'TimeoutError'}], (err)=>{
-          // If the MergeFreeze API returns a non 200 response, log a warning and continue under the assumption that the main branch is not frozen.
-          sails.log.warn('When sending a request to the MergeFreeze API to get the status of the main branch, MergeFreeze did not respond with a 2xx status code.  (Error details forthcoming in just a sec.)  First, how to remediate: If the main branch is frozen, it will need to be manually unfrozen before PR #'+prNumber+' can be merged. Raw underlying error from MergeFreeze: '+err.stack);
-          return { frozen: false };
-        });
-        sails.log.verbose('#'+prNumber+' is under consideration...  The MergeFreeze API claims that it current main branch "frozen" status is:',mergeFreezeMainBranchStatusReport.frozen);
-        let isMainBranchFrozen = mergeFreezeMainBranchStatusReport.frozen;
-        // If the "main" branch is not currently frozen and we still have PR numbers in our pocketOfPrNumbersUnfrozen array. Clear out the values in the platform record.
-        if(!isMainBranchFrozen && pocketOfPrNumbersUnfrozen.length > 0) {
-          await Platform.updateOne({id: platformRecord.id}).set({currentUnfrozenGitHubPrNumbers: []});
-        }
+        // let mergeFreezeMainBranchStatusReport = await sails.helpers.http.get('https://www.mergefreeze.com/api/branches/fleetdm/fleet/main', { access_token: sails.config.custom.mergeFreezeAccessToken }) //eslint-disable-line camelcase
+        // .tolerate(['non200Response', 'requestFailed', {name: 'TimeoutError'}], (err)=>{
+        //   // If the MergeFreeze API returns a non 200 response, log a warning and continue under the assumption that the main branch is not frozen.
+        //   sails.log.warn('When sending a request to the MergeFreeze API to get the status of the main branch, MergeFreeze did not respond with a 2xx status code.  (Error details forthcoming in just a sec.)  First, how to remediate: If the main branch is frozen, it will need to be manually unfrozen before PR #'+prNumber+' can be merged. Raw underlying error from MergeFreeze: '+err.stack);
+        //   return { frozen: false };
+        // });
+        // sails.log.verbose('#'+prNumber+' is under consideration...  The MergeFreeze API claims that it current main branch "frozen" status is:',mergeFreezeMainBranchStatusReport.frozen);
+        // let isMainBranchFrozen = mergeFreezeMainBranchStatusReport.frozen;
+        // let isMainBranchFrozen = false;
+        // // If the "main" branch is not currently frozen and we still have PR numbers in our pocketOfPrNumbersUnfrozen array. Clear out the values in the platform record.
+        // if(!isMainBranchFrozen && pocketOfPrNumbersUnfrozen.length > 0) {
+        //   await Platform.updateOne({id: platformRecord.id}).set({currentUnfrozenGitHubPrNumbers: []});
+        // }
         if (isAutoApprovalExpected) {
           // [?] https://docs.github.com/en/rest/reference/pulls#create-a-review-for-a-pull-request
           await sails.helpers.http.post(`https://api.github.com/repos/${owner}/${repo}/pulls/${prNumber}/reviews`, {
             event: 'APPROVE'
           }, baseHeaders);
-
-          // If "main" is explicitly frozen, then unfreeze this PR because it no longer contains
-          // (or maybe never did contain) changes to freezeworthy files.
-          // Note: We'll only do this if the PR is from the fleetdm/fleet repo.
-          if (isMainBranchFrozen && repo === 'fleet') {
-
-            pocketOfPrNumbersUnfrozen = _.union(pocketOfPrNumbersUnfrozen, [ prNumber ]);
-            sails.log.verbose('#'+prNumber+' autoapproved, main branch is frozen...  prNumbers unfrozen:',pocketOfPrNumbersUnfrozen);
-
-            // [?] See May 6th, 2022 changelog, which includes this code sample:
-            // (https://www.mergefreeze.com/news)
-            // (but as of July 26, 2022, I didn't see it documented here: https://docs.mergefreeze.com/web-api#post-freeze-status)
-            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-            // > You may now freeze or unfreeze a single PR (while maintaining the overall freeze) via the Web API.
-            // ```
-            // curl -d "frozen=true&user_name=Scooby Doo&unblocked_prs=[3]" -X POST https://www.mergefreeze.com/api/branches/mergefreeze/core/master/?access_token=[Your access token]
-            // ```
-            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
-            await sails.helpers.http.post(`https://www.mergefreeze.com/api/branches/fleetdm/fleet/main?access_token=${encodeURIComponent(sails.config.custom.mergeFreezeAccessToken)}`, {
-              user_name: 'fleet-release',//eslint-disable-line camelcase
-              unblocked_prs: pocketOfPrNumbersUnfrozen,//eslint-disable-line camelcase
-            });
-            // Update the Platform record to have the current unfrozen PR numbers
-            await Platform.updateOne({id: platformRecord.id}).set({currentUnfrozenGitHubPrNumbers: pocketOfPrNumbersUnfrozen});
-          }//fi
-
-        } else {
-          // If "main" is explicitly frozen, then freeze this PR because it now contains
-          // (or maybe always did contain) changes to freezeworthy files.
-          // Note: We'll only do this if the PR is from the fleetdm/fleet repo.
-          if (isMainBranchFrozen && repo === 'fleet') {
-
-            pocketOfPrNumbersUnfrozen = _.difference(pocketOfPrNumbersUnfrozen, [ prNumber ]);
-            sails.log.verbose('#'+prNumber+' not autoapproved, main branch is frozen...  prNumbers unfrozen:',pocketOfPrNumbersUnfrozen);
-
-            // [?] See explanation above.
-            await sails.helpers.http.post(`https://www.mergefreeze.com/api/branches/fleetdm/fleet/main?access_token=${encodeURIComponent(sails.config.custom.mergeFreezeAccessToken)}`, {
-              user_name: 'fleet-release',//eslint-disable-line camelcase
-              unblocked_prs: pocketOfPrNumbersUnfrozen,//eslint-disable-line camelcase
-            });
-            // Update the Platform record to have the current unfrozen PR numbers
-            await Platform.updateOne({id: platformRecord.id}).set({currentUnfrozenGitHubPrNumbers: pocketOfPrNumbersUnfrozen});
-          }//fi
-
-          // Is this in use?
-          // > For context on the history of this bit of code, which has gone been
-          // > implemented a couple of different ways, and gone back and forth, check out:
-          // > https://github.com/fleetdm/fleet/pull/5628#issuecomment-1196175485
-          // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-          // if (IS_FROZEN) {
-          //   // [?] https://docs.github.com/en/rest/reference/pulls#create-a-review-for-a-pull-request
-          //   await sails.helpers.http.post(`https://api.github.com/repos/${owner}/${repo}/pulls/${prNumber}/reviews`, {
-          //     event: 'REQUEST_CHANGES',
-          //     body: 'The repository is currently frozen for an upcoming release.  \n> After the freeze has ended, please dismiss this review.  \n\nIn case of emergency, you can dismiss this review and merge now.'
-          //   }, baseHeaders);
-          // }//fi
-          // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-        }
+        }//fi
+        //   // If "main" is explicitly frozen, then unfreeze this PR because it no longer contains
+        //   // (or maybe never did contain) changes to freezeworthy files.
+        //   // Note: We'll only do this if the PR is from the fleetdm/fleet repo.
+        //   if (isMainBranchFrozen && repo === 'fleet') {
+
+        //     pocketOfPrNumbersUnfrozen = _.union(pocketOfPrNumbersUnfrozen, [ prNumber ]);
+        //     sails.log.verbose('#'+prNumber+' autoapproved, main branch is frozen...  prNumbers unfrozen:',pocketOfPrNumbersUnfrozen);
+
+        //     // [?] See May 6th, 2022 changelog, which includes this code sample:
+        //     // (https://www.mergefreeze.com/news)
+        //     // (but as of July 26, 2022, I didn't see it documented here: https://docs.mergefreeze.com/web-api#post-freeze-status)
+        //     // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        //     // > You may now freeze or unfreeze a single PR (while maintaining the overall freeze) via the Web API.
+        //     // ```
+        //     // curl -d "frozen=true&user_name=Scooby Doo&unblocked_prs=[3]" -X POST https://www.mergefreeze.com/api/branches/mergefreeze/core/master/?access_token=[Your access token]
+        //     // ```
+        //     // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+        //     await sails.helpers.http.post(`https://www.mergefreeze.com/api/branches/fleetdm/fleet/main?access_token=${encodeURIComponent(sails.config.custom.mergeFreezeAccessToken)}`, {
+        //       user_name: 'fleet-release',//eslint-disable-line camelcase
+        //       unblocked_prs: pocketOfPrNumbersUnfrozen,//eslint-disable-line camelcase
+        //     });
+        //     // Update the Platform record to have the current unfrozen PR numbers
+        //     await Platform.updateOne({id: platformRecord.id}).set({currentUnfrozenGitHubPrNumbers: pocketOfPrNumbersUnfrozen});
+        //   }//fi
+
+        // } else {
+        //   // If "main" is explicitly frozen, then freeze this PR because it now contains
+        //   // (or maybe always did contain) changes to freezeworthy files.
+        //   // Note: We'll only do this if the PR is from the fleetdm/fleet repo.
+        //   if (isMainBranchFrozen && repo === 'fleet') {
+
+        //     pocketOfPrNumbersUnfrozen = _.difference(pocketOfPrNumbersUnfrozen, [ prNumber ]);
+        //     sails.log.verbose('#'+prNumber+' not autoapproved, main branch is frozen...  prNumbers unfrozen:',pocketOfPrNumbersUnfrozen);
+
+        //     // [?] See explanation above.
+        //     await sails.helpers.http.post(`https://www.mergefreeze.com/api/branches/fleetdm/fleet/main?access_token=${encodeURIComponent(sails.config.custom.mergeFreezeAccessToken)}`, {
+        //       user_name: 'fleet-release',//eslint-disable-line camelcase
+        //       unblocked_prs: pocketOfPrNumbersUnfrozen,//eslint-disable-line camelcase
+        //     });
+        //     // Update the Platform record to have the current unfrozen PR numbers
+        //     await Platform.updateOne({id: platformRecord.id}).set({currentUnfrozenGitHubPrNumbers: pocketOfPrNumbersUnfrozen});
+        //   }//fi
+
+        //   // Is this in use?
+        //   // > For context on the history of this bit of code, which has gone been
+        //   // > implemented a couple of different ways, and gone back and forth, check out:
+        //   // > https://github.com/fleetdm/fleet/pull/5628#issuecomment-1196175485
+        //   // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        //   // if (IS_FROZEN) {
+        //   //   // [?] https://docs.github.com/en/rest/reference/pulls#create-a-review-for-a-pull-request
+        //   //   await sails.helpers.http.post(`https://api.github.com/repos/${owner}/${repo}/pulls/${prNumber}/reviews`, {
+        //   //     event: 'REQUEST_CHANGES',
+        //   //     body: 'The repository is currently frozen for an upcoming release.  \n> After the freeze has ended, please dismiss this review.  \n\nIn case of emergency, you can dismiss this review and merge now.'
+        //   //   }, baseHeaders);
+        //   // }//fi
+        //   // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // }
 
       }
     } else if (ghNoun === 'issue_comment' && ['created'].includes(action) && (issueOrPr&&issueOrPr.state === 'open')) {
diff --git a/website/api/controllers/webhooks/receive-usage-analytics.js b/website/api/controllers/webhooks/receive-usage-analytics.js
index 9094c11d79bc..94f7fec744de 100644
--- a/website/api/controllers/webhooks/receive-usage-analytics.js
+++ b/website/api/controllers/webhooks/receive-usage-analytics.js
@@ -39,6 +39,10 @@ module.exports = {
     numHostSoftwareInstalledPaths: {type: 'number', defaultsTo: 0},
     numSoftwareCPEs: {type: 'number', defaultsTo: 0},
     numSoftwareCVEs: {type: 'number', defaultsTo: 0},
+    aiFeaturesDisabled: {type: 'boolean', defaultsTo: false },
+    maintenanceWindowsEnabled: {type: 'boolean', defaultsTo: false },
+    maintenanceWindowsConfigured: {type: 'boolean', defaultsTo: false },
+    numHostsFleetDesktopEnabled: {type: 'number', defaultsTo: 0 },
   },
 
 
diff --git a/website/api/helpers/get-extended-osquery-schema.js b/website/api/helpers/get-extended-osquery-schema.js
index d19b090b7b6b..1a697a5847d7 100644
--- a/website/api/helpers/get-extended-osquery-schema.js
+++ b/website/api/helpers/get-extended-osquery-schema.js
@@ -11,6 +11,10 @@ module.exports = {
       type: 'boolean',
       defaultsTo: false,
       description: 'Whether or not to include a lastModifiedAt value for each table.',
+    },
+    githubAccessToken: {
+      type: 'string',
+      description: 'A github token used to authenticate requests to the GitHub API'
     }
   },
 
@@ -25,11 +29,10 @@ module.exports = {
   },
 
 
-  fn: async function ({includeLastModifiedAtValue}) {
+  fn: async function ({includeLastModifiedAtValue, githubAccessToken}) {
     let path = require('path');
     let YAML = require('yaml');
     let util = require('util');
-
     let topLvlRepoPath = path.resolve(sails.config.appPath, '../');
     require('assert')(sails.config.custom.versionOfOsquerySchemaToUseWhenGeneratingDocumentation, 'Please set sails.config.custom.sails.config.custom.versionOfOsquerySchemaToUseWhenGeneratingDocumentation to the version of osquery to use, for example \'5.8.1\'.');
     let VERSION_OF_OSQUERY_SCHEMA_TO_USE = sails.config.custom.versionOfOsquerySchemaToUseWhenGeneratingDocumentation;
@@ -40,6 +43,14 @@ module.exports = {
     let rawOsqueryTablesLastModifiedAt;
     if(includeLastModifiedAtValue) {
       // If we're including a lastModifiedAt value for schema tables, we'll send a request to the GitHub API to get a timestamp of when the last commit
+      let baseHeadersForGithubRequests = {
+        'User-Agent': 'fleet-schema-builder',
+        'Accept': 'application/vnd.github.v3+json',
+      };
+      // If a GitHub access token was provided, add it to the headers.
+      if(githubAccessToken){
+        baseHeadersForGithubRequests['Authorization'] = `token ${githubAccessToken}`;
+      }
       let responseData = await sails.helpers.http.get.with({// [?]: https://docs.github.com/en/rest/commits/commits?apiVersion=2022-11-28#list-commits
         url: 'https://api.github.com/repos/osquery/osquery-site/commits',
         data: {
@@ -47,10 +58,7 @@ module.exports = {
           page: 1,
           per_page: 1,//eslint-disable-line camelcase
         },
-        headers: {
-          'User-Agent': 'fleet-schema-builder',
-          'Accept': 'application/vnd.github.v3+json',
-        },
+        headers: baseHeadersForGithubRequests
       }).intercept((err)=>{
         return new Error(`When trying to send a request to GitHub get a timestamp of the last commit to the osqeury schema JSON, an error occurred. Full error: ${util.inspect(err)}`);
       });
diff --git a/website/api/helpers/iq/get-enriched.js b/website/api/helpers/iq/get-enriched.js
index f4b56ca88ae8..d1c4d385b1aa 100644
--- a/website/api/helpers/iq/get-enriched.js
+++ b/website/api/helpers/iq/get-enriched.js
@@ -252,6 +252,39 @@ module.exports = {
         if (emailDomain && employer.emailDomain && employer.emailDomain !== emailDomain) {
           sails.log.info(`Unexpected result when enriching: Email domain inferred from matched organization website (${employer.emailDomain}) does not equal the parsed email domain (${emailDomain}) that was derived from the provided "emailAddress" (${emailAddress})`);
         }//fi
+
+        // Use OpenAI to try and enrich some additional data, if it's missing.
+        if (!employer.numberOfEmployees) {
+          if (!sails.config.custom.openAiSecret) {
+            throw new Error('sails.config.custom.openAiSecret not set.');
+          }//•
+
+          let prompt = `How many employees does the organization who owns ${emailDomain} have?
+    
+    Please respond in this form (but instead of 0, put the number of employees, as an integer:
+    {
+      "employees": 0
+    }`;
+          let BASE_MODEL = 'gpt-4o';// The base model to use.  https://platform.openai.com/docs/models/gpt-4
+          // [?] API: https://platform.openai.com/docs/api-reference/chat/create
+          let openAiResponse = await sails.helpers.http.post('https://api.openai.com/v1/chat/completions', {
+            model: BASE_MODEL,
+            messages: [ { role: 'user', content: prompt } ],// // https://platform.openai.com/docs/guides/chat/introduction
+            temperature: 0.7,
+            max_tokens: 256//eslint-disable-line camelcase
+          }, {
+            Authorization: `Bearer ${sails.config.custom.openAiSecret}`
+          })
+          .tolerate((unusedErr)=>{});
+
+          if (openAiResponse) {
+            try {
+              employer.numberOfEmployees = JSON.parse(openAiResponse.choices[0].message.content).employees;
+            } catch (unusedErr) {
+              employer.numberOfEmployees = 1;
+            }
+          }//fi
+        }//fi
       }//fi
     }//fi
 
diff --git a/website/api/helpers/salesforce/update-or-create-contact-and-account-and-create-lead.js b/website/api/helpers/salesforce/update-or-create-contact-and-account-and-create-lead.js
index 0b5e8f2023c5..05e9b29c956f 100644
--- a/website/api/helpers/salesforce/update-or-create-contact-and-account-and-create-lead.js
+++ b/website/api/helpers/salesforce/update-or-create-contact-and-account-and-create-lead.js
@@ -30,12 +30,16 @@ module.exports = {
         '6 - Has team buy-in'
       ]
     },
+    psychologicalStageChangeReason: {
+      type: 'string',
+      example: 'Website - Organic start flow'
+    },
     // For new leads.
     leadDescription: {
       type: 'string',
       description: 'A description of what this lead is about; e.g. a contact form message, or the size of t-shirt being requested.'
     },
-    leadSource: {
+    contactSource: {
       type: 'string',
       required: true,
       isIn: [
@@ -58,7 +62,7 @@ module.exports = {
 
 
 
-  fn: async function ({emailAddress, linkedinUrl, firstName, lastName, organization, primaryBuyingSituation, psychologicalStage, leadSource, leadDescription, numberOfHosts}) {
+  fn: async function ({emailAddress, linkedinUrl, firstName, lastName, organization, primaryBuyingSituation, psychologicalStage, psychologicalStageChangeReason, contactSource, leadDescription, numberOfHosts}) {
     if(sails.config.environment !== 'production') {
       sails.log('Skipping Salesforce integration...');
       return;
@@ -72,13 +76,16 @@ module.exports = {
       linkedinUrl,
       primaryBuyingSituation,
       psychologicalStage,
+      psychologicalStageChangeReason,
+      contactSource,
+      description: leadDescription,
     });
 
     await sails.helpers.salesforce.createLead.with({
       salesforceContactId: recordIds.salesforceContactId,
       salesforceAccountId: recordIds.salesforceAccountId,
       leadDescription,
-      leadSource,
+      leadSource: contactSource,
       numberOfHosts,
     });
 
diff --git a/website/api/helpers/salesforce/update-or-create-contact-and-account.js b/website/api/helpers/salesforce/update-or-create-contact-and-account.js
index 0fd40147ddfe..051484e97935 100644
--- a/website/api/helpers/salesforce/update-or-create-contact-and-account.js
+++ b/website/api/helpers/salesforce/update-or-create-contact-and-account.js
@@ -17,6 +17,7 @@ module.exports = {
     firstName: { type: 'string', required: true },
     lastName: { type: 'string', required: true },
     organization: { type: 'string' },
+    description: { type: 'string' },
     primaryBuyingSituation: { type: 'string' },
     psychologicalStage: {
       type: 'string',
@@ -29,6 +30,21 @@ module.exports = {
         '6 - Has team buy-in'
       ]
     },
+    psychologicalStageChangeReason: {
+      type: 'string',
+      example: 'Website - Organic start flow'
+    },
+    contactSource: {
+      type: 'string',
+      isIn: [
+        'Website - Contact forms',
+        'Website - Sign up',
+      ],
+    },
+    getStartedResponses: {
+      type: 'string',
+    }
+
   },
 
 
@@ -44,7 +60,7 @@ module.exports = {
   },
 
 
-  fn: async function ({emailAddress, linkedinUrl, firstName, lastName, organization, primaryBuyingSituation, psychologicalStage}) {
+  fn: async function ({emailAddress, linkedinUrl, firstName, lastName, organization, primaryBuyingSituation, psychologicalStage, psychologicalStageChangeReason, contactSource, description, getStartedResponses}) {
     // Return undefined if we're not running in a production environment.
     if(sails.config.environment !== 'production') {
       sails.log.verbose('Skipping Salesforce integration...');
@@ -88,7 +104,15 @@ module.exports = {
     if(psychologicalStage) {
       valuesToSet.Stage__c = psychologicalStage;// eslint-disable-line camelcase
     }
-
+    if(getStartedResponses) {
+      valuesToSet.Website_questionnaire_answers__c = getStartedResponses;// eslint-disable-line camelcase
+    }
+    if(description) {
+      valuesToSet.Description = description;
+    }
+    if(psychologicalStageChangeReason) {
+      valuesToSet.Psystage_change_reason__c = psychologicalStageChangeReason;// eslint-disable-line camelcase
+    }
 
     let existingContactRecord;
     // Search for an existing Contact record using the provided email address or linkedIn profile URL.
@@ -105,6 +129,10 @@ module.exports = {
     }
 
     if(existingContactRecord) {
+      // If a description was provided and the contact has a description, append the new description to it.
+      if(description && existingContactRecord.Description) {
+        valuesToSet.Description = existingContactRecord.Description + '\n' + description;
+      }
       // console.log(`Exisitng contact found! ${existingContactRecord.Id}`);
       // If we found an existing contact, we'll update it with the information provided.
       salesforceContactId = existingContactRecord.Id;
@@ -176,7 +204,7 @@ module.exports = {
             Name: enrichmentData.employer.organization,// IFWMIH: We know organization exists
             Website: enrichmentData.employer.emailDomain,
             LinkedIn_company_URL__c: enrichmentData.employer.linkedinCompanyPageUrl,// eslint-disable-line camelcase
-            NumberOfEmployees: enrichmentData.employer.numberOfEmployees,
+            NumberOfEmployees: Number(enrichmentData.employer.numberOfEmployees),
             OwnerId: salesforceAccountOwnerId
           });
           salesforceAccountId = newAccountRecord.id;
@@ -184,6 +212,10 @@ module.exports = {
         // console.log('New account created!', salesforceAccountId);
       }//fi
 
+      // Only add contactSource to valuesToSet if we're creating a new contact record.
+      if(contactSource) {
+        valuesToSet.Contact_source__c = contactSource;// eslint-disable-line camelcase
+      }
       // console.log(`creating new Contact record.`)
       // Create a new Contact record for this person.
       let newContactRecord = await salesforceConnection.sobject('Contact')
diff --git a/website/api/helpers/send-template-email.js b/website/api/helpers/send-template-email.js
index 4679719318e9..ba5bac75b70f 100644
--- a/website/api/helpers/send-template-email.js
+++ b/website/api/helpers/send-template-email.js
@@ -55,6 +55,18 @@ module.exports = {
       example: 'Nola Thacker',
     },
 
+    replyTo: {
+      description: 'The reply to email address.',
+      example: {
+        email: 'anne.m.martin@example.com',
+        name: 'Anne M. Martin'
+      },
+      type: {
+        name: 'string',
+        email: 'string',
+      }
+    },
+
     subject: {
       description: 'The subject of the email.',
       example: 'Hello there.',
@@ -122,7 +134,7 @@ module.exports = {
   },
 
 
-  fn: async function({template, templateData, to, toName, subject, from, fromName, layout, ensureAck, bcc, attachments}) {
+  fn: async function({template, templateData, to, toName, subject, from, fromName, layout, replyTo, ensureAck, bcc, attachments}) {
 
     var path = require('path');
     var url = require('url');
@@ -247,6 +259,7 @@ module.exports = {
         subject: subjectLinePrefix+subject,
         from: from,
         fromName: fromName,
+        replyTo: replyTo,
         attachments
       };
 
diff --git a/website/api/hooks/custom/index.js b/website/api/hooks/custom/index.js
index e82a6ba8ab22..d2bd549ddb96 100644
--- a/website/api/hooks/custom/index.js
+++ b/website/api/hooks/custom/index.js
@@ -147,6 +147,17 @@ will be disabled and/or hidden in the UI.
               res.locals.me = undefined;
             }//fi
 
+            // Check for query parameters set by ad clicks.
+            // This is used to track the reason behind a psychological stage change.
+            // If the user performs any action that causes a stage change
+            // within 30 minutes of visiting the website from an ad, their psychological
+            // stage change will be attributed to the ad campaign that brought them here.
+            if(req.param('utm_source') && req.param('creative_id') && req.param('campaign_id')){
+              req.session.adAttributionString = `${req.param('utm_source')} ads - ${req.param('campaign_id')} - ${_.trim(req.param('creative_id'), '?')}`;// Trim questionmarks from the end of creative_id parameters.
+              // Example adAttributionString: Linkedin - 1245983829 - 41u3985237
+              req.session.visitedSiteFromAdAt = Date.now();
+            }
+
             // Check for website personalization parameter, and if valid, absorb it in the session.
             // (This makes the experience simpler and less confusing for people, prioritizing showing things that matter for them)
             // [?] https://en.wikipedia.org/wiki/UTM_parameters
@@ -289,8 +300,8 @@ will be disabled and/or hidden in the UI.
               // FUTURE: Only show this CTA to users who are below psyStage 6.
               // > The code below is so we don't bother users who have completed the questionnaire
 
-              // Determine if this user should see the CTA to bring them to the /start questionnaire using the user's last submitted questionnaire answer.
-              res.locals.showStartCta = !['how-many-hosts','will-you-be-self-hosting','managed-cloud-for-growing-deployments','self-hosted-deploy', 'whats-left-to-get-you-set-up'].includes(req.me.lastSubmittedGetStartedQuestionnaireStep);
+              // Show this logged-in user a CTA to bring them to the /start questionnaire if they do not have billing information saved.
+              res.locals.showStartCta = !req.me.hasBillingCard;
               //  * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * //
 
               // If an expandCtaAt timestamp is set in the user's sesssion, check the value to see if we should expand the CTA.
diff --git a/website/api/models/HistoricalUsageSnapshot.js b/website/api/models/HistoricalUsageSnapshot.js
index 5481d42e5330..1f14b9b291cb 100644
--- a/website/api/models/HistoricalUsageSnapshot.js
+++ b/website/api/models/HistoricalUsageSnapshot.js
@@ -43,6 +43,10 @@ module.exports = {
     numHostSoftwareInstalledPaths: {required: true, type: 'number'},
     numSoftwareCPEs: {required: true, type: 'number'},
     numSoftwareCVEs: {required: true, type: 'number'},
+    aiFeaturesDisabled: {required: true, type: 'boolean'},
+    maintenanceWindowsEnabled: {required: true, type: 'boolean'},
+    maintenanceWindowsConfigured: {required: true, type: 'boolean'},
+    numHostsFleetDesktopEnabled: {required: true, type: 'number'},
 
     //  ╔═╗╔╦╗╔╗ ╔═╗╔╦╗╔═╗
     //  ║╣ ║║║╠╩╗║╣  ║║╚═╗
diff --git a/website/api/models/User.js b/website/api/models/User.js
index 80f39ec3e500..53be23f9c633 100644
--- a/website/api/models/User.js
+++ b/website/api/models/User.js
@@ -240,6 +240,27 @@ without necessarily having a billing card.`
       defaultsTo: '2 - Aware'
     },
 
+    psychologicalStageLastChangedAt: {
+      type: 'number',
+      description: 'A JS timestamp of when this user\'s psychological stage changed.',
+      extendedDescription: 'Used when deciding whether or not to send a nuture email to this user',
+    },
+
+    stageThreeNurtureEmailSentAt: {
+      type: 'number',
+      description: 'A JS timestamp of when the stage 3 nurture email was sent to the user, or 1 if the user is unsubscribed from automated emails.',
+    },
+
+    stageFourNurtureEmailSentAt: {
+      type: 'number',
+      description: 'A JS timestamp of when the stage 4 nurture email was sent to the user, or 1 if the user is unsubscribed from automated emails.',
+    },
+
+    stageFiveNurtureEmailSentAt: {
+      type: 'number',
+      description: 'A JS timestamp of when the stage 5 nurture email was sent to the user, or 1 if the user is unsubscribed from automated emails.',
+    },
+
     //  ╔═╗╔╦╗╔╗ ╔═╗╔╦╗╔═╗
     //  ║╣ ║║║╠╩╗║╣  ║║╚═╗
     //  ╚═╝╩ ╩╚═╝╚═╝═╩╝╚═╝
diff --git a/website/assets/.eslintrc b/website/assets/.eslintrc
index 96d18f3427ce..6cb581fa726b 100644
--- a/website/assets/.eslintrc
+++ b/website/assets/.eslintrc
@@ -49,6 +49,7 @@
     "docsearch": true,
     "Chart": true,
     "gtag": true,
+    "analytics": true,
     // ...etc.
     // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 
diff --git a/website/assets/dependencies/docsearch.min.js b/website/assets/dependencies/docsearch.min.js
index 336fc3e3038f..1851df2b633c 100644
--- a/website/assets/dependencies/docsearch.min.js
+++ b/website/assets/dependencies/docsearch.min.js
@@ -1,4 +1,3 @@
-
-/*! @docsearch/js 3.5.1 | MIT License | © Algolia, Inc. and contributors | https://docsearch.algolia.com */
-!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e=e||self).docsearch=t()}(this,(function(){"use strict";function e(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function t(t){for(var n=1;n<arguments.length;n++){var o=null!=arguments[n]?arguments[n]:{};n%2?e(Object(o),!0).forEach((function(e){r(t,e,o[e])})):Object.getOwnPropertyDescriptors?Object.defineProperties(t,Object.getOwnPropertyDescriptors(o)):e(Object(o)).forEach((function(e){Object.defineProperty(t,e,Object.getOwnPropertyDescriptor(o,e))}))}return t}function n(e){return n="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},n(e)}function r(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function o(){return o=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},o.apply(this,arguments)}function i(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function c(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null==n)return;var r,o,i=[],c=!0,a=!1;try{for(n=n.call(e);!(c=(r=n.next()).done)&&(i.push(r.value),!t||i.length!==t);c=!0);}catch(e){a=!0,o=e}finally{try{c||null==n.return||n.return()}finally{if(a)throw o}}return i}(e,t)||u(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function a(e){return function(e){if(Array.isArray(e))return l(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||u(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function u(e,t){if(e){if("string"==typeof e)return l(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?l(e,t):void 0}}function l(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}var s,f,p,m,v,d={},h=[],y=/acit|ex(?:s|g|n|p|$)|rph|grid|ows|mnc|ntw|ine[ch]|zoo|^ord|itera/i;function b(e,t){for(var n in t)e[n]=t[n];return e}function _(e){var t=e.parentNode;t&&t.removeChild(e)}function g(e,t,n){var r,o,i,c=arguments,a={};for(i in t)"key"==i?r=t[i]:"ref"==i?o=t[i]:a[i]=t[i];if(arguments.length>3)for(n=[n],i=3;i<arguments.length;i++)n.push(c[i]);if(null!=n&&(a.children=n),"function"==typeof e&&null!=e.defaultProps)for(i in e.defaultProps)void 0===a[i]&&(a[i]=e.defaultProps[i]);return O(e,a,r,o,null)}function O(e,t,n,r,o){var i={type:e,props:t,key:n,ref:r,__k:null,__:null,__b:0,__e:null,__d:void 0,__c:null,__h:null,constructor:void 0,__v:null==o?++s.__v:o};return null!=s.vnode&&s.vnode(i),i}function S(e){return e.children}function j(e,t){this.props=e,this.context=t}function w(e,t){if(null==t)return e.__?w(e.__,e.__.__k.indexOf(e)+1):null;for(var n;t<e.__k.length;t++)if(null!=(n=e.__k[t])&&null!=n.__e)return n.__e;return"function"==typeof e.type?w(e):null}function E(e){var t,n;if(null!=(e=e.__)&&null!=e.__c){for(e.__e=e.__c.base=null,t=0;t<e.__k.length;t++)if(null!=(n=e.__k[t])&&null!=n.__e){e.__e=e.__c.base=n.__e;break}return E(e)}}function P(e){(!e.__d&&(e.__d=!0)&&f.push(e)&&!I.__r++||m!==s.debounceRendering)&&((m=s.debounceRendering)||p)(I)}function I(){for(var e;I.__r=f.length;)e=f.sort((function(e,t){return e.__v.__b-t.__v.__b})),f=[],e.some((function(e){var t,n,r,o,i,c;e.__d&&(i=(o=(t=e).__v).__e,(c=t.__P)&&(n=[],(r=b({},o)).__v=o.__v+1,q(c,o,r,t.__n,void 0!==c.ownerSVGElement,null!=o.__h?[i]:null,n,null==i?w(o):i,o.__h),L(n,o),o.__e!=i&&E(o)))}))}function D(e,t,n,r,o,i,c,a,u,l){var s,f,p,m,v,y,b,_=r&&r.__k||h,g=_.length;for(n.__k=[],s=0;s<t.length;s++)if(null!=(m=n.__k[s]=null==(m=t[s])||"boolean"==typeof m?null:"string"==typeof m||"number"==typeof m?O(null,m,null,null,m):Array.isArray(m)?O(S,{children:m},null,null,null):m.__b>0?O(m.type,m.props,m.key,null,m.__v):m)){if(m.__=n,m.__b=n.__b+1,null===(p=_[s])||p&&m.key==p.key&&m.type===p.type)_[s]=void 0;else for(f=0;f<g;f++){if((p=_[f])&&m.key==p.key&&m.type===p.type){_[f]=void 0;break}p=null}q(e,m,p=p||d,o,i,c,a,u,l),v=m.__e,(f=m.ref)&&p.ref!=f&&(b||(b=[]),p.ref&&b.push(p.ref,null,m),b.push(f,m.__c||v,m)),null!=v?(null==y&&(y=v),"function"==typeof m.type&&null!=m.__k&&m.__k===p.__k?m.__d=u=k(m,u,e):u=C(e,m,p,_,v,u),l||"option"!==n.type?"function"==typeof n.type&&(n.__d=u):e.value=""):u&&p.__e==u&&u.parentNode!=e&&(u=w(p))}for(n.__e=y,s=g;s--;)null!=_[s]&&("function"==typeof n.type&&null!=_[s].__e&&_[s].__e==n.__d&&(n.__d=w(r,s+1)),U(_[s],_[s]));if(b)for(s=0;s<b.length;s++)H(b[s],b[++s],b[++s])}function k(e,t,n){var r,o;for(r=0;r<e.__k.length;r++)(o=e.__k[r])&&(o.__=e,t="function"==typeof o.type?k(o,t,n):C(n,o,o,e.__k,o.__e,t));return t}function A(e,t){return t=t||[],null==e||"boolean"==typeof e||(Array.isArray(e)?e.some((function(e){A(e,t)})):t.push(e)),t}function C(e,t,n,r,o,i){var c,a,u;if(void 0!==t.__d)c=t.__d,t.__d=void 0;else if(null==n||o!=i||null==o.parentNode)e:if(null==i||i.parentNode!==e)e.appendChild(o),c=null;else{for(a=i,u=0;(a=a.nextSibling)&&u<r.length;u+=2)if(a==o)break e;e.insertBefore(o,i),c=i}return void 0!==c?c:o.nextSibling}function x(e,t,n){"-"===t[0]?e.setProperty(t,n):e[t]=null==n?"":"number"!=typeof n||y.test(t)?n:n+"px"}function N(e,t,n,r,o){var i;e:if("style"===t)if("string"==typeof n)e.style.cssText=n;else{if("string"==typeof r&&(e.style.cssText=r=""),r)for(t in r)n&&t in n||x(e.style,t,"");if(n)for(t in n)r&&n[t]===r[t]||x(e.style,t,n[t])}else if("o"===t[0]&&"n"===t[1])i=t!==(t=t.replace(/Capture$/,"")),t=t.toLowerCase()in e?t.toLowerCase().slice(2):t.slice(2),e.l||(e.l={}),e.l[t+i]=n,n?r||e.addEventListener(t,i?R:T,i):e.removeEventListener(t,i?R:T,i);else if("dangerouslySetInnerHTML"!==t){if(o)t=t.replace(/xlink[H:h]/,"h").replace(/sName$/,"s");else if("href"!==t&&"list"!==t&&"form"!==t&&"download"!==t&&t in e)try{e[t]=null==n?"":n;break e}catch(e){}"function"==typeof n||(null!=n&&(!1!==n||"a"===t[0]&&"r"===t[1])?e.setAttribute(t,n):e.removeAttribute(t))}}function T(e){this.l[e.type+!1](s.event?s.event(e):e)}function R(e){this.l[e.type+!0](s.event?s.event(e):e)}function q(e,t,n,r,o,i,c,a,u){var l,f,p,m,v,d,h,y,_,g,O,w=t.type;if(void 0!==t.constructor)return null;null!=n.__h&&(u=n.__h,a=t.__e=n.__e,t.__h=null,i=[a]),(l=s.__b)&&l(t);try{e:if("function"==typeof w){if(y=t.props,_=(l=w.contextType)&&r[l.__c],g=l?_?_.props.value:l.__:r,n.__c?h=(f=t.__c=n.__c).__=f.__E:("prototype"in w&&w.prototype.render?t.__c=f=new w(y,g):(t.__c=f=new j(y,g),f.constructor=w,f.render=F),_&&_.sub(f),f.props=y,f.state||(f.state={}),f.context=g,f.__n=r,p=f.__d=!0,f.__h=[]),null==f.__s&&(f.__s=f.state),null!=w.getDerivedStateFromProps&&(f.__s==f.state&&(f.__s=b({},f.__s)),b(f.__s,w.getDerivedStateFromProps(y,f.__s))),m=f.props,v=f.state,p)null==w.getDerivedStateFromProps&&null!=f.componentWillMount&&f.componentWillMount(),null!=f.componentDidMount&&f.__h.push(f.componentDidMount);else{if(null==w.getDerivedStateFromProps&&y!==m&&null!=f.componentWillReceiveProps&&f.componentWillReceiveProps(y,g),!f.__e&&null!=f.shouldComponentUpdate&&!1===f.shouldComponentUpdate(y,f.__s,g)||t.__v===n.__v){f.props=y,f.state=f.__s,t.__v!==n.__v&&(f.__d=!1),f.__v=t,t.__e=n.__e,t.__k=n.__k,f.__h.length&&c.push(f);break e}null!=f.componentWillUpdate&&f.componentWillUpdate(y,f.__s,g),null!=f.componentDidUpdate&&f.__h.push((function(){f.componentDidUpdate(m,v,d)}))}f.context=g,f.props=y,f.state=f.__s,(l=s.__r)&&l(t),f.__d=!1,f.__v=t,f.__P=e,l=f.render(f.props,f.state,f.context),f.state=f.__s,null!=f.getChildContext&&(r=b(b({},r),f.getChildContext())),p||null==f.getSnapshotBeforeUpdate||(d=f.getSnapshotBeforeUpdate(m,v)),O=null!=l&&l.type===S&&null==l.key?l.props.children:l,D(e,Array.isArray(O)?O:[O],t,n,r,o,i,c,a,u),f.base=t.__e,t.__h=null,f.__h.length&&c.push(f),h&&(f.__E=f.__=null),f.__e=!1}else null==i&&t.__v===n.__v?(t.__k=n.__k,t.__e=n.__e):t.__e=M(n.__e,t,n,r,o,i,c,u);(l=s.diffed)&&l(t)}catch(e){t.__v=null,(u||null!=i)&&(t.__e=a,t.__h=!!u,i[i.indexOf(a)]=null),s.__e(e,t,n)}}function L(e,t){s.__c&&s.__c(t,e),e.some((function(t){try{e=t.__h,t.__h=[],e.some((function(e){e.call(t)}))}catch(e){s.__e(e,t.__v)}}))}function M(e,t,n,r,o,i,c,a){var u,l,s,f,p=n.props,m=t.props,v=t.type,y=0;if("svg"===v&&(o=!0),null!=i)for(;y<i.length;y++)if((u=i[y])&&(u===e||(v?u.localName==v:3==u.nodeType))){e=u,i[y]=null;break}if(null==e){if(null===v)return document.createTextNode(m);e=o?document.createElementNS("http://www.w3.org/2000/svg",v):document.createElement(v,m.is&&m),i=null,a=!1}if(null===v)p===m||a&&e.data===m||(e.data=m);else{if(i=i&&h.slice.call(e.childNodes),l=(p=n.props||d).dangerouslySetInnerHTML,s=m.dangerouslySetInnerHTML,!a){if(null!=i)for(p={},f=0;f<e.attributes.length;f++)p[e.attributes[f].name]=e.attributes[f].value;(s||l)&&(s&&(l&&s.__html==l.__html||s.__html===e.innerHTML)||(e.innerHTML=s&&s.__html||""))}if(function(e,t,n,r,o){var i;for(i in n)"children"===i||"key"===i||i in t||N(e,i,null,n[i],r);for(i in t)o&&"function"!=typeof t[i]||"children"===i||"key"===i||"value"===i||"checked"===i||n[i]===t[i]||N(e,i,t[i],n[i],r)}(e,m,p,o,a),s)t.__k=[];else if(y=t.props.children,D(e,Array.isArray(y)?y:[y],t,n,r,o&&"foreignObject"!==v,i,c,e.firstChild,a),null!=i)for(y=i.length;y--;)null!=i[y]&&_(i[y]);a||("value"in m&&void 0!==(y=m.value)&&(y!==e.value||"progress"===v&&!y)&&N(e,"value",y,p.value,!1),"checked"in m&&void 0!==(y=m.checked)&&y!==e.checked&&N(e,"checked",y,p.checked,!1))}return e}function H(e,t,n){try{"function"==typeof e?e(t):e.current=t}catch(e){s.__e(e,n)}}function U(e,t,n){var r,o,i;if(s.unmount&&s.unmount(e),(r=e.ref)&&(r.current&&r.current!==e.__e||H(r,null,t)),n||"function"==typeof e.type||(n=null!=(o=e.__e)),e.__e=e.__d=void 0,null!=(r=e.__c)){if(r.componentWillUnmount)try{r.componentWillUnmount()}catch(e){s.__e(e,t)}r.base=r.__P=null}if(r=e.__k)for(i=0;i<r.length;i++)r[i]&&U(r[i],t,n);null!=o&&_(o)}function F(e,t,n){return this.constructor(e,n)}function B(e,t,n){var r,o,i;s.__&&s.__(e,t),o=(r="function"==typeof n)?null:n&&n.__k||t.__k,i=[],q(t,e=(!r&&n||t).__k=g(S,null,[e]),o||d,d,void 0!==t.ownerSVGElement,!r&&n?[n]:o?null:t.firstChild?h.slice.call(t.childNodes):null,i,!r&&n?n:o?o.__e:t.firstChild,r),L(i,e)}function V(e,t){B(e,t,V)}function W(e,t,n){var r,o,i,c=arguments,a=b({},e.props);for(i in t)"key"==i?r=t[i]:"ref"==i?o=t[i]:a[i]=t[i];if(arguments.length>3)for(n=[n],i=3;i<arguments.length;i++)n.push(c[i]);return null!=n&&(a.children=n),O(e.type,a,r||e.key,o||e.ref,null)}s={__e:function(e,t){for(var n,r,o;t=t.__;)if((n=t.__c)&&!n.__)try{if((r=n.constructor)&&null!=r.getDerivedStateFromError&&(n.setState(r.getDerivedStateFromError(e)),o=n.__d),null!=n.componentDidCatch&&(n.componentDidCatch(e),o=n.__d),o)return n.__E=n}catch(t){e=t}throw e},__v:0},j.prototype.setState=function(e,t){var n;n=null!=this.__s&&this.__s!==this.state?this.__s:this.__s=b({},this.state),"function"==typeof e&&(e=e(b({},n),this.props)),e&&b(n,e),null!=e&&this.__v&&(t&&this.__h.push(t),P(this))},j.prototype.forceUpdate=function(e){this.__v&&(this.__e=!0,e&&this.__h.push(e),P(this))},j.prototype.render=S,f=[],p="function"==typeof Promise?Promise.prototype.then.bind(Promise.resolve()):setTimeout,I.__r=0,v=0;var K,z,J,$=0,Q=[],Z=s.__b,Y=s.__r,G=s.diffed,X=s.__c,ee=s.unmount;function te(e,t){s.__h&&s.__h(z,e,$||t),$=0;var n=z.__H||(z.__H={__:[],__h:[]});return e>=n.__.length&&n.__.push({}),n.__[e]}function ne(e){return $=1,re(pe,e)}function re(e,t,n){var r=te(K++,2);return r.t=e,r.__c||(r.__=[n?n(t):pe(void 0,t),function(e){var t=r.t(r.__[0],e);r.__[0]!==t&&(r.__=[t,r.__[1]],r.__c.setState({}))}],r.__c=z),r.__}function oe(e,t){var n=te(K++,3);!s.__s&&fe(n.__H,t)&&(n.__=e,n.__H=t,z.__H.__h.push(n))}function ie(e,t){var n=te(K++,4);!s.__s&&fe(n.__H,t)&&(n.__=e,n.__H=t,z.__h.push(n))}function ce(e,t){var n=te(K++,7);return fe(n.__H,t)&&(n.__=e(),n.__H=t,n.__h=e),n.__}function ae(){Q.forEach((function(e){if(e.__P)try{e.__H.__h.forEach(le),e.__H.__h.forEach(se),e.__H.__h=[]}catch(t){e.__H.__h=[],s.__e(t,e.__v)}})),Q=[]}s.__b=function(e){z=null,Z&&Z(e)},s.__r=function(e){Y&&Y(e),K=0;var t=(z=e.__c).__H;t&&(t.__h.forEach(le),t.__h.forEach(se),t.__h=[])},s.diffed=function(e){G&&G(e);var t=e.__c;t&&t.__H&&t.__H.__h.length&&(1!==Q.push(t)&&J===s.requestAnimationFrame||((J=s.requestAnimationFrame)||function(e){var t,n=function(){clearTimeout(r),ue&&cancelAnimationFrame(t),setTimeout(e)},r=setTimeout(n,100);ue&&(t=requestAnimationFrame(n))})(ae)),z=void 0},s.__c=function(e,t){t.some((function(e){try{e.__h.forEach(le),e.__h=e.__h.filter((function(e){return!e.__||se(e)}))}catch(n){t.some((function(e){e.__h&&(e.__h=[])})),t=[],s.__e(n,e.__v)}})),X&&X(e,t)},s.unmount=function(e){ee&&ee(e);var t=e.__c;if(t&&t.__H)try{t.__H.__.forEach(le)}catch(e){s.__e(e,t.__v)}};var ue="function"==typeof requestAnimationFrame;function le(e){var t=z;"function"==typeof e.__c&&e.__c(),z=t}function se(e){var t=z;e.__c=e.__(),z=t}function fe(e,t){return!e||e.length!==t.length||t.some((function(t,n){return t!==e[n]}))}function pe(e,t){return"function"==typeof t?t(e):t}function me(e,t){for(var n in t)e[n]=t[n];return e}function ve(e,t){for(var n in e)if("__source"!==n&&!(n in t))return!0;for(var r in t)if("__source"!==r&&e[r]!==t[r])return!0;return!1}function de(e){this.props=e}(de.prototype=new j).isPureReactComponent=!0,de.prototype.shouldComponentUpdate=function(e,t){return ve(this.props,e)||ve(this.state,t)};var he=s.__b;s.__b=function(e){e.type&&e.type.__f&&e.ref&&(e.props.ref=e.ref,e.ref=null),he&&he(e)};var ye="undefined"!=typeof Symbol&&Symbol.for&&Symbol.for("react.forward_ref")||3911;var be=function(e,t){return null==e?null:A(A(e).map(t))},_e={map:be,forEach:be,count:function(e){return e?A(e).length:0},only:function(e){var t=A(e);if(1!==t.length)throw"Children.only";return t[0]},toArray:A},ge=s.__e;function Oe(){this.__u=0,this.t=null,this.__b=null}function Se(e){var t=e.__.__c;return t&&t.__e&&t.__e(e)}function je(){this.u=null,this.o=null}s.__e=function(e,t,n){if(e.then)for(var r,o=t;o=o.__;)if((r=o.__c)&&r.__c)return null==t.__e&&(t.__e=n.__e,t.__k=n.__k),r.__c(e,t);ge(e,t,n)},(Oe.prototype=new j).__c=function(e,t){var n=t.__c,r=this;null==r.t&&(r.t=[]),r.t.push(n);var o=Se(r.__v),i=!1,c=function(){i||(i=!0,n.componentWillUnmount=n.__c,o?o(a):a())};n.__c=n.componentWillUnmount,n.componentWillUnmount=function(){c(),n.__c&&n.__c()};var a=function(){if(!--r.__u){if(r.state.__e){var e=r.state.__e;r.__v.__k[0]=function e(t,n,r){return t&&(t.__v=null,t.__k=t.__k&&t.__k.map((function(t){return e(t,n,r)})),t.__c&&t.__c.__P===n&&(t.__e&&r.insertBefore(t.__e,t.__d),t.__c.__e=!0,t.__c.__P=r)),t}(e,e.__c.__P,e.__c.__O)}var t;for(r.setState({__e:r.__b=null});t=r.t.pop();)t.forceUpdate()}},u=!0===t.__h;r.__u++||u||r.setState({__e:r.__b=r.__v.__k[0]}),e.then(c,c)},Oe.prototype.componentWillUnmount=function(){this.t=[]},Oe.prototype.render=function(e,t){if(this.__b){if(this.__v.__k){var n=document.createElement("div"),r=this.__v.__k[0].__c;this.__v.__k[0]=function e(t,n,r){return t&&(t.__c&&t.__c.__H&&(t.__c.__H.__.forEach((function(e){"function"==typeof e.__c&&e.__c()})),t.__c.__H=null),null!=(t=me({},t)).__c&&(t.__c.__P===r&&(t.__c.__P=n),t.__c=null),t.__k=t.__k&&t.__k.map((function(t){return e(t,n,r)}))),t}(this.__b,n,r.__O=r.__P)}this.__b=null}var o=t.__e&&g(S,null,e.fallback);return o&&(o.__h=null),[g(S,null,t.__e?null:e.children),o]};var we=function(e,t,n){if(++n[1]===n[0]&&e.o.delete(t),e.props.revealOrder&&("t"!==e.props.revealOrder[0]||!e.o.size))for(n=e.u;n;){for(;n.length>3;)n.pop()();if(n[1]<n[0])break;e.u=n=n[2]}};function Ee(e){return this.getChildContext=function(){return e.context},e.children}function Pe(e){var t=this,n=e.i;t.componentWillUnmount=function(){B(null,t.l),t.l=null,t.i=null},t.i&&t.i!==n&&t.componentWillUnmount(),e.__v?(t.l||(t.i=n,t.l={nodeType:1,parentNode:n,childNodes:[],appendChild:function(e){this.childNodes.push(e),t.i.appendChild(e)},insertBefore:function(e,n){this.childNodes.push(e),t.i.appendChild(e)},removeChild:function(e){this.childNodes.splice(this.childNodes.indexOf(e)>>>1,1),t.i.removeChild(e)}}),B(g(Ee,{context:t.context},e.__v),t.l)):t.l&&t.componentWillUnmount()}function Ie(e,t){return g(Pe,{__v:e,i:t})}(je.prototype=new j).__e=function(e){var t=this,n=Se(t.__v),r=t.o.get(e);return r[0]++,function(o){var i=function(){t.props.revealOrder?(r.push(o),we(t,e,r)):o()};n?n(i):i()}},je.prototype.render=function(e){this.u=null,this.o=new Map;var t=A(e.children);e.revealOrder&&"b"===e.revealOrder[0]&&t.reverse();for(var n=t.length;n--;)this.o.set(t[n],this.u=[1,0,this.u]);return e.children},je.prototype.componentDidUpdate=je.prototype.componentDidMount=function(){var e=this;this.o.forEach((function(t,n){we(e,n,t)}))};var De="undefined"!=typeof Symbol&&Symbol.for&&Symbol.for("react.element")||60103,ke=/^(?:accent|alignment|arabic|baseline|cap|clip(?!PathU)|color|fill|flood|font|glyph(?!R)|horiz|marker(?!H|W|U)|overline|paint|stop|strikethrough|stroke|text(?!L)|underline|unicode|units|v|vector|vert|word|writing|x(?!C))[A-Z]/,Ae=function(e){return("undefined"!=typeof Symbol&&"symbol"==n(Symbol())?/fil|che|rad/i:/fil|che|ra/i).test(e)};function Ce(e,t,n){return null==t.__k&&(t.textContent=""),B(e,t),"function"==typeof n&&n(),e?e.__c:null}j.prototype.isReactComponent={},["componentWillMount","componentWillReceiveProps","componentWillUpdate"].forEach((function(e){Object.defineProperty(j.prototype,e,{configurable:!0,get:function(){return this["UNSAFE_"+e]},set:function(t){Object.defineProperty(this,e,{configurable:!0,writable:!0,value:t})}})}));var xe=s.event;function Ne(){}function Te(){return this.cancelBubble}function Re(){return this.defaultPrevented}s.event=function(e){return xe&&(e=xe(e)),e.persist=Ne,e.isPropagationStopped=Te,e.isDefaultPrevented=Re,e.nativeEvent=e};var qe,Le={configurable:!0,get:function(){return this.class}},Me=s.vnode;s.vnode=function(e){var t=e.type,n=e.props,r=n;if("string"==typeof t){for(var o in r={},n){var i=n[o];"value"===o&&"defaultValue"in n&&null==i||("defaultValue"===o&&"value"in n&&null==n.value?o="value":"download"===o&&!0===i?i="":/ondoubleclick/i.test(o)?o="ondblclick":/^onchange(textarea|input)/i.test(o+t)&&!Ae(n.type)?o="oninput":/^on(Ani|Tra|Tou|BeforeInp)/.test(o)?o=o.toLowerCase():ke.test(o)?o=o.replace(/[A-Z0-9]/,"-$&").toLowerCase():null===i&&(i=void 0),r[o]=i)}"select"==t&&r.multiple&&Array.isArray(r.value)&&(r.value=A(n.children).forEach((function(e){e.props.selected=-1!=r.value.indexOf(e.props.value)}))),"select"==t&&null!=r.defaultValue&&(r.value=A(n.children).forEach((function(e){e.props.selected=r.multiple?-1!=r.defaultValue.indexOf(e.props.value):r.defaultValue==e.props.value}))),e.props=r}t&&n.class!=n.className&&(Le.enumerable="className"in n,null!=n.className&&(r.class=n.className),Object.defineProperty(r,"className",Le)),e.$$typeof=De,Me&&Me(e)};var He=s.__r;s.__r=function(e){He&&He(e),qe=e.__c};var Ue={ReactCurrentDispatcher:{current:{readContext:function(e){return qe.__n[e.__c].props.value}}}};"object"==("undefined"==typeof performance?"undefined":n(performance))&&"function"==typeof performance.now&&performance.now.bind(performance);function Fe(e){return!!e&&e.$$typeof===De}var Be={useState:ne,useReducer:re,useEffect:oe,useLayoutEffect:ie,useRef:function(e){return $=5,ce((function(){return{current:e}}),[])},useImperativeHandle:function(e,t,n){$=6,ie((function(){"function"==typeof e?e(t()):e&&(e.current=t())}),null==n?n:n.concat(e))},useMemo:ce,useCallback:function(e,t){return $=8,ce((function(){return e}),t)},useContext:function(e){var t=z.context[e.__c],n=te(K++,9);return n.__c=e,t?(null==n.__&&(n.__=!0,t.sub(z)),t.props.value):e.__},useDebugValue:function(e,t){s.useDebugValue&&s.useDebugValue(t?t(e):e)},version:"16.8.0",Children:_e,render:Ce,hydrate:function(e,t,n){return V(e,t),"function"==typeof n&&n(),e?e.__c:null},unmountComponentAtNode:function(e){return!!e.__k&&(B(null,e),!0)},createPortal:Ie,createElement:g,createContext:function(e,t){var n={__c:t="__cC"+v++,__:e,Consumer:function(e,t){return e.children(t)},Provider:function(e){var n,r;return this.getChildContext||(n=[],(r={})[t]=this,this.getChildContext=function(){return r},this.shouldComponentUpdate=function(e){this.props.value!==e.value&&n.some(P)},this.sub=function(e){n.push(e);var t=e.componentWillUnmount;e.componentWillUnmount=function(){n.splice(n.indexOf(e),1),t&&t.call(e)}}),e.children}};return n.Provider.__=n.Consumer.contextType=n},createFactory:function(e){return g.bind(null,e)},cloneElement:function(e){return Fe(e)?W.apply(null,arguments):e},createRef:function(){return{current:null}},Fragment:S,isValidElement:Fe,findDOMNode:function(e){return e&&(e.base||1===e.nodeType&&e)||null},Component:j,PureComponent:de,memo:function(e,t){function n(e){var n=this.props.ref,r=n==e.ref;return!r&&n&&(n.call?n(null):n.current=null),t?!t(this.props,e)||!r:ve(this.props,e)}function r(t){return this.shouldComponentUpdate=n,g(e,t)}return r.displayName="Memo("+(e.displayName||e.name)+")",r.prototype.isReactComponent=!0,r.__f=!0,r},forwardRef:function(e){function t(t,r){var o=me({},t);return delete o.ref,e(o,(r=t.ref||r)&&("object"!=n(r)||"current"in r)?r:null)}return t.$$typeof=ye,t.render=t,t.prototype.isReactComponent=t.__f=!0,t.displayName="ForwardRef("+(e.displayName||e.name)+")",t},unstable_batchedUpdates:function(e,t){return e(t)},StrictMode:S,Suspense:Oe,SuspenseList:je,lazy:function(e){var t,n,r;function o(o){if(t||(t=e()).then((function(e){n=e.default||e}),(function(e){r=e})),r)throw r;if(!n)throw t;return g(n,o)}return o.displayName="Lazy",o.__f=!0,o},__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED:Ue};function Ve(){return Be.createElement("svg",{width:"15",height:"15",className:"DocSearch-Control-Key-Icon"},Be.createElement("path",{d:"M4.505 4.496h2M5.505 5.496v5M8.216 4.496l.055 5.993M10 7.5c.333.333.5.667.5 1v2M12.326 4.5v5.996M8.384 4.496c1.674 0 2.116 0 2.116 1.5s-.442 1.5-2.116 1.5M3.205 9.303c-.09.448-.277 1.21-1.241 1.203C1 10.5.5 9.513.5 8V7c0-1.57.5-2.5 1.464-2.494.964.006 1.134.598 1.24 1.342M12.553 10.5h1.953",strokeWidth:"1.2",stroke:"currentColor",fill:"none",strokeLinecap:"square"}))}function We(){return Be.createElement("svg",{width:"20",height:"20",className:"DocSearch-Search-Icon",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"}))}var Ke=["translations"];function ze(){return ze=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},ze.apply(this,arguments)}function Je(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null==n)return;var r,o,i=[],c=!0,a=!1;try{for(n=n.call(e);!(c=(r=n.next()).done)&&(i.push(r.value),!t||i.length!==t);c=!0);}catch(e){a=!0,o=e}finally{try{c||null==n.return||n.return()}finally{if(a)throw o}}return i}(e,t)||function(e,t){if(!e)return;if("string"==typeof e)return $e(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return $e(e,t)}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function $e(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function Qe(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var Ze="Ctrl";var Ye=Be.forwardRef((function(e,t){var n=e.translations,r=void 0===n?{}:n,o=Qe(e,Ke),i=r.buttonText,c=void 0===i?"Search":i,a=r.buttonAriaLabel,u=void 0===a?"Search":a,l=Je(ne(null),2),s=l[0],f=l[1];return oe((function(){"undefined"!=typeof navigator&&(/(Mac|iPhone|iPod|iPad)/i.test(navigator.platform)?f("⌘"):f(Ze))}),[]),Be.createElement("button",ze({type:"button",className:"DocSearch DocSearch-Button","aria-label":u},o,{ref:t}),Be.createElement("span",{className:"DocSearch-Button-Container"},Be.createElement(We,null),Be.createElement("span",{className:"DocSearch-Button-Placeholder"},c)),Be.createElement("span",{className:"DocSearch-Button-Keys"},null!==s&&Be.createElement(Be.Fragment,null,Be.createElement("kbd",{className:"DocSearch-Button-Key"},s===Ze?Be.createElement(Ve,null):s),Be.createElement("kbd",{className:"DocSearch-Button-Key"},"K"))))}));function Ge(e,t){var n=void 0;return function(){for(var r=arguments.length,o=new Array(r),i=0;i<r;i++)o[i]=arguments[i];n&&clearTimeout(n),n=setTimeout((function(){return e.apply(void 0,o)}),t)}}function Xe(e){return e.reduce((function(e,t){return e.concat(t)}),[])}var et=0;function tt(e){return 0===e.collections.length?0:e.collections.reduce((function(e,t){return e+t.items.length}),0)}function nt(e){return e!==Object(e)}function rt(e,t){if(e===t)return!0;if(nt(e)||nt(t)||"function"==typeof e||"function"==typeof t)return e===t;if(Object.keys(e).length!==Object.keys(t).length)return!1;for(var n=0,r=Object.keys(e);n<r.length;n++){var o=r[n];if(!(o in t))return!1;if(!rt(e[o],t[o]))return!1}return!0}var ot=function(){};var it=[{segment:"autocomplete-core",version:"1.9.3"}];function ct(e){var t=e.item,n=e.items;return{index:t.__autocomplete_indexName,items:[t],positions:[1+n.findIndex((function(e){return e.objectID===t.objectID}))],queryID:t.__autocomplete_queryID,algoliaSource:["autocomplete"]}}function at(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=n){var r,o,i,c,a=[],u=!0,l=!1;try{if(i=(n=n.call(e)).next,0===t){if(Object(n)!==n)return;u=!1}else for(;!(u=(r=i.call(n)).done)&&(a.push(r.value),a.length!==t);u=!0);}catch(e){l=!0,o=e}finally{try{if(!u&&null!=n.return&&(c=n.return(),Object(c)!==c))return}finally{if(l)throw o}}return a}}(e,t)||function(e,t){if(!e)return;if("string"==typeof e)return ut(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return ut(e,t)}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function ut(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}var lt=["items"],st=["items"];function ft(e){return ft="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},ft(e)}function pt(e){return function(e){if(Array.isArray(e))return mt(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return mt(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return mt(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function mt(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function vt(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function dt(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function ht(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?dt(Object(n),!0).forEach((function(t){yt(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):dt(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function yt(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==ft(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==ft(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===ft(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function bt(e){for(var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:20,n=[],r=0;r<e.objectIDs.length;r+=t)n.push(ht(ht({},e),{},{objectIDs:e.objectIDs.slice(r,r+t)}));return n}function _t(e){return e.map((function(e){var t=e.items,n=vt(e,lt);return ht(ht({},n),{},{objectIDs:(null==t?void 0:t.map((function(e){return e.objectID})))||n.objectIDs})}))}function gt(e){var t,n,r,o=(t=at((e.version||"").split(".").map(Number),2),n=t[0],r=t[1],n>=3||2===n&&r>=4||1===n&&r>=10);function i(t,n,r){if(o&&void 0!==r){var i=r[0].__autocomplete_algoliaCredentials,c={"X-Algolia-Application-Id":i.appId,"X-Algolia-API-Key":i.apiKey};e.apply(void 0,[t].concat(pt(n),[{headers:c}]))}else e.apply(void 0,[t].concat(pt(n)))}return{init:function(t,n){e("init",{appId:t,apiKey:n})},setUserToken:function(t){e("setUserToken",t)},clickedObjectIDsAfterSearch:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&i("clickedObjectIDsAfterSearch",_t(t),t[0].items)},clickedObjectIDs:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&i("clickedObjectIDs",_t(t),t[0].items)},clickedFilters:function(){for(var t=arguments.length,n=new Array(t),r=0;r<t;r++)n[r]=arguments[r];n.length>0&&e.apply(void 0,["clickedFilters"].concat(n))},convertedObjectIDsAfterSearch:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&i("convertedObjectIDsAfterSearch",_t(t),t[0].items)},convertedObjectIDs:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&i("convertedObjectIDs",_t(t),t[0].items)},convertedFilters:function(){for(var t=arguments.length,n=new Array(t),r=0;r<t;r++)n[r]=arguments[r];n.length>0&&e.apply(void 0,["convertedFilters"].concat(n))},viewedObjectIDs:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&t.reduce((function(e,t){var n=t.items,r=vt(t,st);return[].concat(pt(e),pt(bt(ht(ht({},r),{},{objectIDs:(null==n?void 0:n.map((function(e){return e.objectID})))||r.objectIDs})).map((function(e){return{items:n,payload:e}}))))}),[]).forEach((function(e){var t=e.items;return i("viewedObjectIDs",[e.payload],t)}))},viewedFilters:function(){for(var t=arguments.length,n=new Array(t),r=0;r<t;r++)n[r]=arguments[r];n.length>0&&e.apply(void 0,["viewedFilters"].concat(n))}}}function Ot(e){var t=e.items.reduce((function(e,t){var n;return e[t.__autocomplete_indexName]=(null!==(n=e[t.__autocomplete_indexName])&&void 0!==n?n:[]).concat(t),e}),{});return Object.keys(t).map((function(e){return{index:e,items:t[e],algoliaSource:["autocomplete"]}}))}function St(e){return e.objectID&&e.__autocomplete_indexName&&e.__autocomplete_queryID}function jt(e){return jt="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},jt(e)}function wt(e){return function(e){if(Array.isArray(e))return Et(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return Et(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return Et(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function Et(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function Pt(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function It(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Pt(Object(n),!0).forEach((function(t){Dt(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Pt(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Dt(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==jt(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==jt(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===jt(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var kt="2.6.0",At="https://cdn.jsdelivr.net/npm/search-insights@".concat(kt,"/dist/search-insights.min.js"),Ct=Ge((function(e){var t=e.onItemsChange,n=e.items,r=e.insights,o=e.state;t({insights:r,insightsEvents:Ot({items:n}).map((function(e){return It({eventName:"Items Viewed"},e)})),state:o})}),400);function xt(e){var t=function(e){return It({onItemsChange:function(e){var t=e.insights,n=e.insightsEvents;t.viewedObjectIDs.apply(t,wt(n.map((function(e){return It(It({},e),{},{algoliaSource:[].concat(wt(e.algoliaSource||[]),["autocomplete-internal"])})}))))},onSelect:function(e){var t=e.insights,n=e.insightsEvents;t.clickedObjectIDsAfterSearch.apply(t,wt(n.map((function(e){return It(It({},e),{},{algoliaSource:[].concat(wt(e.algoliaSource||[]),["autocomplete-internal"])})}))))},onActive:ot},e)}(e),n=t.insightsClient,r=t.onItemsChange,o=t.onSelect,i=t.onActive,c=n;n||function(e){if("undefined"!=typeof window)e({window:window})}((function(e){var t=e.window,n=t.AlgoliaAnalyticsObject||"aa";"string"==typeof n&&(c=t[n]),c||(t.AlgoliaAnalyticsObject=n,t[n]||(t[n]=function(){t[n].queue||(t[n].queue=[]);for(var e=arguments.length,r=new Array(e),o=0;o<e;o++)r[o]=arguments[o];t[n].queue.push(r)}),t[n].version=kt,c=t[n],function(e){var t="[Autocomplete]: Could not load search-insights.js. Please load it manually following https://alg.li/insights-autocomplete";try{var n=e.document.createElement("script");n.async=!0,n.src=At,n.onerror=function(){console.error(t)},document.body.appendChild(n)}catch(e){console.error(t)}}(t))}));var a=gt(c),u={current:[]},l=Ge((function(e){var t=e.state;if(t.isOpen){var n=t.collections.reduce((function(e,t){return[].concat(wt(e),wt(t.items))}),[]).filter(St);rt(u.current.map((function(e){return e.objectID})),n.map((function(e){return e.objectID})))||(u.current=n,n.length>0&&Ct({onItemsChange:r,items:n,insights:a,state:t}))}}),0);return{name:"aa.algoliaInsightsPlugin",subscribe:function(e){var t=e.setContext,n=e.onSelect,r=e.onActive;c("addAlgoliaAgent","insights-plugin"),t({algoliaInsightsPlugin:{__algoliaSearchParameters:{clickAnalytics:!0},insights:a}}),n((function(e){var t=e.item,n=e.state,r=e.event;St(t)&&o({state:n,event:r,insights:a,item:t,insightsEvents:[It({eventName:"Item Selected"},ct({item:t,items:u.current}))]})})),r((function(e){var t=e.item,n=e.state,r=e.event;St(t)&&i({state:n,event:r,insights:a,item:t,insightsEvents:[It({eventName:"Item Active"},ct({item:t,items:u.current}))]})}))},onStateChange:function(e){var t=e.state;l({state:t})},__autocomplete_pluginOptions:e}}function Nt(e,t){var n=t;return{then:function(t,r){return Nt(e.then(Rt(t,n,e),Rt(r,n,e)),n)},catch:function(t){return Nt(e.catch(Rt(t,n,e)),n)},finally:function(t){return t&&n.onCancelList.push(t),Nt(e.finally(Rt(t&&function(){return n.onCancelList=[],t()},n,e)),n)},cancel:function(){n.isCanceled=!0;var e=n.onCancelList;n.onCancelList=[],e.forEach((function(e){e()}))},isCanceled:function(){return!0===n.isCanceled}}}function Tt(e){return Nt(e,{isCanceled:!1,onCancelList:[]})}function Rt(e,t,n){return e?function(n){return t.isCanceled?n:e(n)}:n}function qt(e,t,n,r){if(!n)return null;if(e<0&&(null===t||null!==r&&0===t))return n+e;var o=(null===t?-1:t)+e;return o<=-1||o>=n?null===r?null:0:o}function Lt(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Mt(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Lt(Object(n),!0).forEach((function(t){Ht(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Lt(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Ht(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Ut(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==Ut(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===Ut(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Ut(e){return Ut="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Ut(e)}function Ft(e){var t=function(e){var t=e.collections.map((function(e){return e.items.length})).reduce((function(e,t,n){var r=(e[n-1]||0)+t;return e.push(r),e}),[]).reduce((function(t,n){return n<=e.activeItemId?t+1:t}),0);return e.collections[t]}(e);if(!t)return null;var n=t.items[function(e){for(var t=e.state,n=e.collection,r=!1,o=0,i=0;!1===r;){var c=t.collections[o];if(c===n){r=!0;break}i+=c.items.length,o++}return t.activeItemId-i}({state:e,collection:t})],r=t.source;return{item:n,itemInputValue:r.getItemInputValue({item:n,state:e}),itemUrl:r.getItemUrl({item:n,state:e}),source:r}}var Bt=/((gt|sm)-|galaxy nexus)|samsung[- ]|samsungbrowser/i;function Vt(e){return Vt="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Vt(e)}function Wt(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Kt(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Vt(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==Vt(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===Vt(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function zt(e,t,n){var r,o=t.initialState;return{getState:function(){return o},dispatch:function(r,i){var c=function(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Wt(Object(n),!0).forEach((function(t){Kt(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Wt(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}({},o);o=e(o,{type:r,props:t,payload:i}),n({state:o,prevState:c})},pendingRequests:(r=[],{add:function(e){return r.push(e),e.finally((function(){r=r.filter((function(t){return t!==e}))}))},cancelAll:function(){r.forEach((function(e){return e.cancel()}))},isEmpty:function(){return 0===r.length}})}}function Jt(e){return Jt="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Jt(e)}function $t(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Qt(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?$t(Object(n),!0).forEach((function(t){Zt(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):$t(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Zt(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Jt(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==Jt(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===Jt(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Yt(e){return Yt="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Yt(e)}function Gt(e){return function(e){if(Array.isArray(e))return Xt(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return Xt(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return Xt(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function Xt(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function en(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function tn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?en(Object(n),!0).forEach((function(t){nn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):en(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function nn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Yt(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==Yt(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===Yt(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function rn(e,t){var n,r="undefined"!=typeof window?window:{},o=e.plugins||[];return tn(tn({debug:!1,openOnFocus:!1,placeholder:"",autoFocus:!1,defaultActiveItemId:null,stallThreshold:300,insights:!1,environment:r,shouldPanelOpen:function(e){return tt(e.state)>0},reshape:function(e){return e.sources}},e),{},{id:null!==(n=e.id)&&void 0!==n?n:"autocomplete-".concat(et++),plugins:o,initialState:tn({activeItemId:null,query:"",completion:null,collections:[],isOpen:!1,status:"idle",context:{}},e.initialState),onStateChange:function(t){var n;null===(n=e.onStateChange)||void 0===n||n.call(e,t),o.forEach((function(e){var n;return null===(n=e.onStateChange)||void 0===n?void 0:n.call(e,t)}))},onSubmit:function(t){var n;null===(n=e.onSubmit)||void 0===n||n.call(e,t),o.forEach((function(e){var n;return null===(n=e.onSubmit)||void 0===n?void 0:n.call(e,t)}))},onReset:function(t){var n;null===(n=e.onReset)||void 0===n||n.call(e,t),o.forEach((function(e){var n;return null===(n=e.onReset)||void 0===n?void 0:n.call(e,t)}))},getSources:function(n){return Promise.all([].concat(Gt(o.map((function(e){return e.getSources}))),[e.getSources]).filter(Boolean).map((function(e){return function(e,t){var n=[];return Promise.resolve(e(t)).then((function(e){return Promise.all(e.filter((function(e){return Boolean(e)})).map((function(e){if(e.sourceId,n.includes(e.sourceId))throw new Error("[Autocomplete] The `sourceId` ".concat(JSON.stringify(e.sourceId)," is not unique."));n.push(e.sourceId);var t={getItemInputValue:function(e){return e.state.query},getItemUrl:function(){},onSelect:function(e){(0,e.setIsOpen)(!1)},onActive:ot,onResolve:ot};Object.keys(t).forEach((function(e){t[e].__default=!0}));var r=Mt(Mt({},t),e);return Promise.resolve(r)})))}))}(e,n)}))).then((function(e){return Xe(e)})).then((function(e){return e.map((function(e){return tn(tn({},e),{},{onSelect:function(n){e.onSelect(n),t.forEach((function(e){var t;return null===(t=e.onSelect)||void 0===t?void 0:t.call(e,n)}))},onActive:function(n){e.onActive(n),t.forEach((function(e){var t;return null===(t=e.onActive)||void 0===t?void 0:t.call(e,n)}))},onResolve:function(n){e.onResolve(n),t.forEach((function(e){var t;return null===(t=e.onResolve)||void 0===t?void 0:t.call(e,n)}))}})}))}))},navigator:tn({navigate:function(e){var t=e.itemUrl;r.location.assign(t)},navigateNewTab:function(e){var t=e.itemUrl,n=r.open(t,"_blank","noopener");null==n||n.focus()},navigateNewWindow:function(e){var t=e.itemUrl;r.open(t,"_blank","noopener")}},e.navigator)})}function on(e){return on="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},on(e)}function cn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function an(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?cn(Object(n),!0).forEach((function(t){un(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):cn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function un(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==on(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==on(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===on(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function ln(e){return ln="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},ln(e)}function sn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function fn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?sn(Object(n),!0).forEach((function(t){pn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):sn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function pn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==ln(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==ln(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===ln(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function mn(e){return function(e){if(Array.isArray(e))return vn(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return vn(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return vn(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function vn(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function dn(e){return Boolean(e.execute)}function hn(e,t,n){if(o=e,Boolean(null==o?void 0:o.execute)){var r="algolia"===e.requesterId?Object.assign.apply(Object,[{}].concat(mn(Object.keys(n.context).map((function(e){var t;return null===(t=n.context[e])||void 0===t?void 0:t.__algoliaSearchParameters}))))):{};return fn(fn({},e),{},{requests:e.queries.map((function(n){return{query:"algolia"===e.requesterId?fn(fn({},n),{},{params:fn(fn({},r),n.params)}):n,sourceId:t,transformResponse:e.transformResponse}}))})}var o;return{items:e,sourceId:t}}function yn(e){var t=e.reduce((function(e,t){if(!dn(t))return e.push(t),e;var n=t.searchClient,r=t.execute,o=t.requesterId,i=t.requests,c=e.find((function(e){return dn(t)&&dn(e)&&e.searchClient===n&&Boolean(o)&&e.requesterId===o}));if(c){var a;(a=c.items).push.apply(a,mn(i))}else{var u={execute:r,requesterId:o,items:i,searchClient:n};e.push(u)}return e}),[]).map((function(e){if(!dn(e))return Promise.resolve(e);var t=e,n=t.execute,r=t.items;return n({searchClient:t.searchClient,requests:r})}));return Promise.all(t).then((function(e){return Xe(e)}))}function bn(e,t,n){return t.map((function(t){var r,o=e.filter((function(e){return e.sourceId===t.sourceId})),i=o.map((function(e){return e.items})),c=o[0].transformResponse,a=c?c({results:r=i,hits:r.map((function(e){return e.hits})).filter(Boolean),facetHits:r.map((function(e){var t;return null===(t=e.facetHits)||void 0===t?void 0:t.map((function(e){return{label:e.value,count:e.count,_highlightResult:{label:{value:e.highlighted}}}}))})).filter(Boolean)}):i;return t.onResolve({source:t,results:i,items:a,state:n.getState()}),a.every(Boolean),'The `getItems` function from source "'.concat(t.sourceId,'" must return an array of items but returned ').concat(JSON.stringify(void 0),".\n\nDid you forget to return items?\n\nSee: https://www.algolia.com/doc/ui-libraries/autocomplete/core-concepts/sources/#param-getitems"),{source:t,items:a}}))}function _n(e){return _n="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},_n(e)}var gn=["event","nextState","props","query","refresh","store"];function On(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Sn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?On(Object(n),!0).forEach((function(t){jn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):On(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function jn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==_n(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==_n(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===_n(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function wn(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var En,Pn,In,Dn=null,kn=(En=-1,Pn=-1,In=void 0,function(e){var t=++En;return Promise.resolve(e).then((function(e){return In&&t<Pn?In:(Pn=t,In=e,e)}))});function An(e){var t=e.event,n=e.nextState,r=void 0===n?{}:n,o=e.props,i=e.query,c=e.refresh,a=e.store,u=wn(e,gn);Dn&&o.environment.clearTimeout(Dn);var l=u.setCollections,s=u.setIsOpen,f=u.setQuery,p=u.setActiveItemId,m=u.setStatus;if(f(i),p(o.defaultActiveItemId),!i&&!1===o.openOnFocus){var v,d=a.getState().collections.map((function(e){return Sn(Sn({},e),{},{items:[]})}));m("idle"),l(d),s(null!==(v=r.isOpen)&&void 0!==v?v:o.shouldPanelOpen({state:a.getState()}));var h=Tt(kn(d).then((function(){return Promise.resolve()})));return a.pendingRequests.add(h)}m("loading"),Dn=o.environment.setTimeout((function(){m("stalled")}),o.stallThreshold);var y=Tt(kn(o.getSources(Sn({query:i,refresh:c,state:a.getState()},u)).then((function(e){return Promise.all(e.map((function(e){return Promise.resolve(e.getItems(Sn({query:i,refresh:c,state:a.getState()},u))).then((function(t){return hn(t,e.sourceId,a.getState())}))}))).then(yn).then((function(t){return bn(t,e,a)})).then((function(e){return function(e){var t=e.collections,n=e.props,r=e.state,o=t.reduce((function(e,t){return an(an({},e),{},un({},t.source.sourceId,an(an({},t.source),{},{getItems:function(){return Xe(t.items)}})))}),{}),i=n.plugins.reduce((function(e,t){return t.reshape?t.reshape(e):e}),{sourcesBySourceId:o,state:r}).sourcesBySourceId;return Xe(n.reshape({sourcesBySourceId:i,sources:Object.values(i),state:r})).filter(Boolean).map((function(e){return{source:e,items:e.getItems()}}))}({collections:e,props:o,state:a.getState()})}))})))).then((function(e){var n;m("idle"),l(e);var f=o.shouldPanelOpen({state:a.getState()});s(null!==(n=r.isOpen)&&void 0!==n?n:o.openOnFocus&&!i&&f||f);var p=Ft(a.getState());if(null!==a.getState().activeItemId&&p){var v=p.item,d=p.itemInputValue,h=p.itemUrl,y=p.source;y.onActive(Sn({event:t,item:v,itemInputValue:d,itemUrl:h,refresh:c,source:y,state:a.getState()},u))}})).finally((function(){m("idle"),Dn&&o.environment.clearTimeout(Dn)}));return a.pendingRequests.add(y)}function Cn(e){return Cn="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Cn(e)}var xn=["event","props","refresh","store"];function Nn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Tn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Nn(Object(n),!0).forEach((function(t){Rn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Nn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Rn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Cn(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==Cn(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===Cn(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function qn(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function Ln(e){return Ln="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Ln(e)}var Mn=["props","refresh","store"],Hn=["inputElement","formElement","panelElement"],Un=["inputElement"],Fn=["inputElement","maxLength"],Bn=["sourceIndex"],Vn=["sourceIndex"],Wn=["item","source","sourceIndex"];function Kn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function zn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Kn(Object(n),!0).forEach((function(t){Jn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Kn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Jn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Ln(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==Ln(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===Ln(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function $n(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function Qn(e){var t=e.props,n=e.refresh,r=e.store,o=$n(e,Mn),i=function(e,t){return void 0!==t?"".concat(e,"-").concat(t):e};return{getEnvironmentProps:function(e){var n=e.inputElement,o=e.formElement,i=e.panelElement;function c(e){!r.getState().isOpen&&r.pendingRequests.isEmpty()||e.target===n||!1===[o,i].some((function(t){return n=t,r=e.target,n===r||n.contains(r);var n,r}))&&(r.dispatch("blur",null),t.debug||r.pendingRequests.cancelAll())}return zn({onTouchStart:c,onMouseDown:c,onTouchMove:function(e){!1!==r.getState().isOpen&&n===t.environment.document.activeElement&&e.target!==n&&n.blur()}},$n(e,Hn))},getRootProps:function(e){return zn({role:"combobox","aria-expanded":r.getState().isOpen,"aria-haspopup":"listbox","aria-owns":r.getState().isOpen?"".concat(t.id,"-list"):void 0,"aria-labelledby":"".concat(t.id,"-label")},e)},getFormProps:function(e){e.inputElement;return zn({action:"",noValidate:!0,role:"search",onSubmit:function(i){var c;i.preventDefault(),t.onSubmit(zn({event:i,refresh:n,state:r.getState()},o)),r.dispatch("submit",null),null===(c=e.inputElement)||void 0===c||c.blur()},onReset:function(i){var c;i.preventDefault(),t.onReset(zn({event:i,refresh:n,state:r.getState()},o)),r.dispatch("reset",null),null===(c=e.inputElement)||void 0===c||c.focus()}},$n(e,Un))},getLabelProps:function(e){var n=e||{},r=n.sourceIndex,o=$n(n,Bn);return zn({htmlFor:"".concat(i(t.id,r),"-input"),id:"".concat(i(t.id,r),"-label")},o)},getInputProps:function(e){var i;function c(e){(t.openOnFocus||Boolean(r.getState().query))&&An(zn({event:e,props:t,query:r.getState().completion||r.getState().query,refresh:n,store:r},o)),r.dispatch("focus",null)}var a=e||{},u=(a.inputElement,a.maxLength),l=void 0===u?512:u,s=$n(a,Fn),f=Ft(r.getState()),p=function(e){return Boolean(e&&e.match(Bt))}((null===(i=t.environment.navigator)||void 0===i?void 0:i.userAgent)||""),m=null!=f&&f.itemUrl&&!p?"go":"search";return zn({"aria-autocomplete":"both","aria-activedescendant":r.getState().isOpen&&null!==r.getState().activeItemId?"".concat(t.id,"-item-").concat(r.getState().activeItemId):void 0,"aria-controls":r.getState().isOpen?"".concat(t.id,"-list"):void 0,"aria-labelledby":"".concat(t.id,"-label"),value:r.getState().completion||r.getState().query,id:"".concat(t.id,"-input"),autoComplete:"off",autoCorrect:"off",autoCapitalize:"off",enterKeyHint:m,spellCheck:"false",autoFocus:t.autoFocus,placeholder:t.placeholder,maxLength:l,type:"search",onChange:function(e){An(zn({event:e,props:t,query:e.currentTarget.value.slice(0,l),refresh:n,store:r},o))},onKeyDown:function(e){!function(e){var t=e.event,n=e.props,r=e.refresh,o=e.store,i=qn(e,xn);if("ArrowUp"===t.key||"ArrowDown"===t.key){var c=function(){var e=n.environment.document.getElementById("".concat(n.id,"-item-").concat(o.getState().activeItemId));e&&(e.scrollIntoViewIfNeeded?e.scrollIntoViewIfNeeded(!1):e.scrollIntoView(!1))},a=function(){var e=Ft(o.getState());if(null!==o.getState().activeItemId&&e){var n=e.item,c=e.itemInputValue,a=e.itemUrl,u=e.source;u.onActive(Tn({event:t,item:n,itemInputValue:c,itemUrl:a,refresh:r,source:u,state:o.getState()},i))}};t.preventDefault(),!1===o.getState().isOpen&&(n.openOnFocus||Boolean(o.getState().query))?An(Tn({event:t,props:n,query:o.getState().query,refresh:r,store:o},i)).then((function(){o.dispatch(t.key,{nextActiveItemId:n.defaultActiveItemId}),a(),setTimeout(c,0)})):(o.dispatch(t.key,{}),a(),c())}else if("Escape"===t.key)t.preventDefault(),o.dispatch(t.key,null),o.pendingRequests.cancelAll();else if("Tab"===t.key)o.dispatch("blur",null),o.pendingRequests.cancelAll();else if("Enter"===t.key){if(null===o.getState().activeItemId||o.getState().collections.every((function(e){return 0===e.items.length})))return void(n.debug||o.pendingRequests.cancelAll());t.preventDefault();var u=Ft(o.getState()),l=u.item,s=u.itemInputValue,f=u.itemUrl,p=u.source;if(t.metaKey||t.ctrlKey)void 0!==f&&(p.onSelect(Tn({event:t,item:l,itemInputValue:s,itemUrl:f,refresh:r,source:p,state:o.getState()},i)),n.navigator.navigateNewTab({itemUrl:f,item:l,state:o.getState()}));else if(t.shiftKey)void 0!==f&&(p.onSelect(Tn({event:t,item:l,itemInputValue:s,itemUrl:f,refresh:r,source:p,state:o.getState()},i)),n.navigator.navigateNewWindow({itemUrl:f,item:l,state:o.getState()}));else if(t.altKey);else{if(void 0!==f)return p.onSelect(Tn({event:t,item:l,itemInputValue:s,itemUrl:f,refresh:r,source:p,state:o.getState()},i)),void n.navigator.navigate({itemUrl:f,item:l,state:o.getState()});An(Tn({event:t,nextState:{isOpen:!1},props:n,query:s,refresh:r,store:o},i)).then((function(){p.onSelect(Tn({event:t,item:l,itemInputValue:s,itemUrl:f,refresh:r,source:p,state:o.getState()},i))}))}}}(zn({event:e,props:t,refresh:n,store:r},o))},onFocus:c,onBlur:ot,onClick:function(n){e.inputElement!==t.environment.document.activeElement||r.getState().isOpen||c(n)}},s)},getPanelProps:function(e){return zn({onMouseDown:function(e){e.preventDefault()},onMouseLeave:function(){r.dispatch("mouseleave",null)}},e)},getListProps:function(e){var n=e||{},r=n.sourceIndex,o=$n(n,Vn);return zn({role:"listbox","aria-labelledby":"".concat(i(t.id,r),"-label"),id:"".concat(i(t.id,r),"-list")},o)},getItemProps:function(e){var c=e.item,a=e.source,u=e.sourceIndex,l=$n(e,Wn);return zn({id:"".concat(i(t.id,u),"-item-").concat(c.__autocomplete_id),role:"option","aria-selected":r.getState().activeItemId===c.__autocomplete_id,onMouseMove:function(e){if(c.__autocomplete_id!==r.getState().activeItemId){r.dispatch("mousemove",c.__autocomplete_id);var t=Ft(r.getState());if(null!==r.getState().activeItemId&&t){var i=t.item,a=t.itemInputValue,u=t.itemUrl,l=t.source;l.onActive(zn({event:e,item:i,itemInputValue:a,itemUrl:u,refresh:n,source:l,state:r.getState()},o))}}},onMouseDown:function(e){e.preventDefault()},onClick:function(e){var i=a.getItemInputValue({item:c,state:r.getState()}),u=a.getItemUrl({item:c,state:r.getState()});(u?Promise.resolve():An(zn({event:e,nextState:{isOpen:!1},props:t,query:i,refresh:n,store:r},o))).then((function(){a.onSelect(zn({event:e,item:c,itemInputValue:i,itemUrl:u,refresh:n,source:a,state:r.getState()},o))}))}},l)}}}function Zn(e){return Zn="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Zn(e)}function Yn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Gn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Yn(Object(n),!0).forEach((function(t){Xn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Yn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Xn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Zn(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==Zn(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===Zn(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function er(e){var t,n,r,o,i=e.plugins,c=e.options,a=null===(t=((null===(n=c.__autocomplete_metadata)||void 0===n?void 0:n.userAgents)||[])[0])||void 0===t?void 0:t.segment,u=a?Xn({},a,Object.keys((null===(r=c.__autocomplete_metadata)||void 0===r?void 0:r.options)||{})):{};return{plugins:i.map((function(e){return{name:e.name,options:Object.keys(e.__autocomplete_pluginOptions||[])}})),options:Gn({"autocomplete-core":Object.keys(c)},u),ua:it.concat((null===(o=c.__autocomplete_metadata)||void 0===o?void 0:o.userAgents)||[])}}function tr(e){var t,n=e.state;return!1===n.isOpen||null===n.activeItemId?null:(null===(t=Ft(n))||void 0===t?void 0:t.itemInputValue)||null}function nr(e){return nr="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},nr(e)}function rr(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function or(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?rr(Object(n),!0).forEach((function(t){ir(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):rr(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function ir(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==nr(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==nr(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===nr(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var cr=function(e,t){switch(t.type){case"setActiveItemId":case"mousemove":return or(or({},e),{},{activeItemId:t.payload});case"setQuery":return or(or({},e),{},{query:t.payload,completion:null});case"setCollections":return or(or({},e),{},{collections:t.payload});case"setIsOpen":return or(or({},e),{},{isOpen:t.payload});case"setStatus":return or(or({},e),{},{status:t.payload});case"setContext":return or(or({},e),{},{context:or(or({},e.context),t.payload)});case"ArrowDown":var n=or(or({},e),{},{activeItemId:t.payload.hasOwnProperty("nextActiveItemId")?t.payload.nextActiveItemId:qt(1,e.activeItemId,tt(e),t.props.defaultActiveItemId)});return or(or({},n),{},{completion:tr({state:n})});case"ArrowUp":var r=or(or({},e),{},{activeItemId:qt(-1,e.activeItemId,tt(e),t.props.defaultActiveItemId)});return or(or({},r),{},{completion:tr({state:r})});case"Escape":return e.isOpen?or(or({},e),{},{activeItemId:null,isOpen:!1,completion:null}):or(or({},e),{},{activeItemId:null,query:"",status:"idle",collections:[]});case"submit":return or(or({},e),{},{activeItemId:null,isOpen:!1,status:"idle"});case"reset":return or(or({},e),{},{activeItemId:!0===t.props.openOnFocus?t.props.defaultActiveItemId:null,status:"idle",query:""});case"focus":return or(or({},e),{},{activeItemId:t.props.defaultActiveItemId,isOpen:(t.props.openOnFocus||Boolean(e.query))&&t.props.shouldPanelOpen({state:e})});case"blur":return t.props.debug?e:or(or({},e),{},{isOpen:!1,activeItemId:null});case"mouseleave":return or(or({},e),{},{activeItemId:t.props.defaultActiveItemId});default:return"The reducer action ".concat(JSON.stringify(t.type)," is not supported."),e}};function ar(e){return ar="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},ar(e)}function ur(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function lr(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?ur(Object(n),!0).forEach((function(t){sr(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):ur(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function sr(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==ar(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==ar(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===ar(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function fr(e){var t=[],n=rn(e,t),r=zt(cr,n,(function(e){var t=e.prevState,r=e.state;n.onStateChange(lr({prevState:t,state:r,refresh:c,navigator:n.navigator},o))})),o=function(e){var t=e.store;return{setActiveItemId:function(e){t.dispatch("setActiveItemId",e)},setQuery:function(e){t.dispatch("setQuery",e)},setCollections:function(e){var n=0,r=e.map((function(e){return Qt(Qt({},e),{},{items:Xe(e.items).map((function(e){return Qt(Qt({},e),{},{__autocomplete_id:n++})}))})}));t.dispatch("setCollections",r)},setIsOpen:function(e){t.dispatch("setIsOpen",e)},setStatus:function(e){t.dispatch("setStatus",e)},setContext:function(e){t.dispatch("setContext",e)}}}({store:r}),i=Qn(lr({props:n,refresh:c,store:r,navigator:n.navigator},o));function c(){return An(lr({event:new Event("input"),nextState:{isOpen:r.getState().isOpen},props:n,navigator:n.navigator,query:r.getState().query,refresh:c,store:r},o))}if(e.insights&&!n.plugins.some((function(e){return"aa.algoliaInsightsPlugin"===e.name}))){var a="boolean"==typeof e.insights?{}:e.insights;n.plugins.push(xt(a))}return n.plugins.forEach((function(e){var r;return null===(r=e.subscribe)||void 0===r?void 0:r.call(e,lr(lr({},o),{},{navigator:n.navigator,refresh:c,onSelect:function(e){t.push({onSelect:e})},onActive:function(e){t.push({onActive:e})},onResolve:function(e){t.push({onResolve:e})}}))})),function(e){var t,n,r=e.metadata,o=e.environment;if(null===(t=o.navigator)||void 0===t||null===(n=t.userAgent)||void 0===n?void 0:n.includes("Algolia Crawler")){var i=o.document.createElement("meta"),c=o.document.querySelector("head");i.name="algolia:metadata",setTimeout((function(){i.content=JSON.stringify(r),c.appendChild(i)}),0)}}({metadata:er({plugins:n.plugins,options:e}),environment:n.environment}),lr(lr({refresh:c,navigator:n.navigator},i),o)}function pr(e){var t=e.translations,n=(void 0===t?{}:t).searchByText,r=void 0===n?"Search by":n;return Be.createElement("a",{href:"https://www.algolia.com/ref/docsearch/?utm_source=".concat(window.location.hostname,"&utm_medium=referral&utm_content=powered_by&utm_campaign=docsearch"),target:"_blank",rel:"noopener noreferrer"},Be.createElement("span",{className:"DocSearch-Label"},r),Be.createElement("svg",{width:"77",height:"19","aria-label":"Algolia",role:"img",id:"Layer_1",xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 2196.2 500"},Be.createElement("defs",null,Be.createElement("style",null,".cls-1,.cls-2{fill:#003dff;}.cls-2{fill-rule:evenodd;}")),Be.createElement("path",{className:"cls-2",d:"M1070.38,275.3V5.91c0-3.63-3.24-6.39-6.82-5.83l-50.46,7.94c-2.87,.45-4.99,2.93-4.99,5.84l.17,273.22c0,12.92,0,92.7,95.97,95.49,3.33,.1,6.09-2.58,6.09-5.91v-40.78c0-2.96-2.19-5.51-5.12-5.84-34.85-4.01-34.85-47.57-34.85-54.72Z"}),Be.createElement("rect",{className:"cls-1",x:"1845.88",y:"104.73",width:"62.58",height:"277.9",rx:"5.9",ry:"5.9"}),Be.createElement("path",{className:"cls-2",d:"M1851.78,71.38h50.77c3.26,0,5.9-2.64,5.9-5.9V5.9c0-3.62-3.24-6.39-6.82-5.83l-50.77,7.95c-2.87,.45-4.99,2.92-4.99,5.83v51.62c0,3.26,2.64,5.9,5.9,5.9Z"}),Be.createElement("path",{className:"cls-2",d:"M1764.03,275.3V5.91c0-3.63-3.24-6.39-6.82-5.83l-50.46,7.94c-2.87,.45-4.99,2.93-4.99,5.84l.17,273.22c0,12.92,0,92.7,95.97,95.49,3.33,.1,6.09-2.58,6.09-5.91v-40.78c0-2.96-2.19-5.51-5.12-5.84-34.85-4.01-34.85-47.57-34.85-54.72Z"}),Be.createElement("path",{className:"cls-2",d:"M1631.95,142.72c-11.14-12.25-24.83-21.65-40.78-28.31-15.92-6.53-33.26-9.85-52.07-9.85-18.78,0-36.15,3.17-51.92,9.85-15.59,6.66-29.29,16.05-40.76,28.31-11.47,12.23-20.38,26.87-26.76,44.03-6.38,17.17-9.24,37.37-9.24,58.36,0,20.99,3.19,36.87,9.55,54.21,6.38,17.32,15.14,32.11,26.45,44.36,11.29,12.23,24.83,21.62,40.6,28.46,15.77,6.83,40.12,10.33,52.4,10.48,12.25,0,36.78-3.82,52.7-10.48,15.92-6.68,29.46-16.23,40.78-28.46,11.29-12.25,20.05-27.04,26.25-44.36,6.22-17.34,9.24-33.22,9.24-54.21,0-20.99-3.34-41.19-10.03-58.36-6.38-17.17-15.14-31.8-26.43-44.03Zm-44.43,163.75c-11.47,15.75-27.56,23.7-48.09,23.7-20.55,0-36.63-7.8-48.1-23.7-11.47-15.75-17.21-34.01-17.21-61.2,0-26.89,5.59-49.14,17.06-64.87,11.45-15.75,27.54-23.52,48.07-23.52,20.55,0,36.63,7.78,48.09,23.52,11.47,15.57,17.36,37.98,17.36,64.87,0,27.19-5.72,45.3-17.19,61.2Z"}),Be.createElement("path",{className:"cls-2",d:"M894.42,104.73h-49.33c-48.36,0-90.91,25.48-115.75,64.1-14.52,22.58-22.99,49.63-22.99,78.73,0,44.89,20.13,84.92,51.59,111.1,2.93,2.6,6.05,4.98,9.31,7.14,12.86,8.49,28.11,13.47,44.52,13.47,1.23,0,2.46-.03,3.68-.09,.36-.02,.71-.05,1.07-.07,.87-.05,1.75-.11,2.62-.2,.34-.03,.68-.08,1.02-.12,.91-.1,1.82-.21,2.73-.34,.21-.03,.42-.07,.63-.1,32.89-5.07,61.56-30.82,70.9-62.81v57.83c0,3.26,2.64,5.9,5.9,5.9h50.42c3.26,0,5.9-2.64,5.9-5.9V110.63c0-3.26-2.64-5.9-5.9-5.9h-56.32Zm0,206.92c-12.2,10.16-27.97,13.98-44.84,15.12-.16,.01-.33,.03-.49,.04-1.12,.07-2.24,.1-3.36,.1-42.24,0-77.12-35.89-77.12-79.37,0-10.25,1.96-20.01,5.42-28.98,11.22-29.12,38.77-49.74,71.06-49.74h49.33v142.83Z"}),Be.createElement("path",{className:"cls-2",d:"M2133.97,104.73h-49.33c-48.36,0-90.91,25.48-115.75,64.1-14.52,22.58-22.99,49.63-22.99,78.73,0,44.89,20.13,84.92,51.59,111.1,2.93,2.6,6.05,4.98,9.31,7.14,12.86,8.49,28.11,13.47,44.52,13.47,1.23,0,2.46-.03,3.68-.09,.36-.02,.71-.05,1.07-.07,.87-.05,1.75-.11,2.62-.2,.34-.03,.68-.08,1.02-.12,.91-.1,1.82-.21,2.73-.34,.21-.03,.42-.07,.63-.1,32.89-5.07,61.56-30.82,70.9-62.81v57.83c0,3.26,2.64,5.9,5.9,5.9h50.42c3.26,0,5.9-2.64,5.9-5.9V110.63c0-3.26-2.64-5.9-5.9-5.9h-56.32Zm0,206.92c-12.2,10.16-27.97,13.98-44.84,15.12-.16,.01-.33,.03-.49,.04-1.12,.07-2.24,.1-3.36,.1-42.24,0-77.12-35.89-77.12-79.37,0-10.25,1.96-20.01,5.42-28.98,11.22-29.12,38.77-49.74,71.06-49.74h49.33v142.83Z"}),Be.createElement("path",{className:"cls-2",d:"M1314.05,104.73h-49.33c-48.36,0-90.91,25.48-115.75,64.1-11.79,18.34-19.6,39.64-22.11,62.59-.58,5.3-.88,10.68-.88,16.14s.31,11.15,.93,16.59c4.28,38.09,23.14,71.61,50.66,94.52,2.93,2.6,6.05,4.98,9.31,7.14,12.86,8.49,28.11,13.47,44.52,13.47h0c17.99,0,34.61-5.93,48.16-15.97,16.29-11.58,28.88-28.54,34.48-47.75v50.26h-.11v11.08c0,21.84-5.71,38.27-17.34,49.36-11.61,11.08-31.04,16.63-58.25,16.63-11.12,0-28.79-.59-46.6-2.41-2.83-.29-5.46,1.5-6.27,4.22l-12.78,43.11c-1.02,3.46,1.27,7.02,4.83,7.53,21.52,3.08,42.52,4.68,54.65,4.68,48.91,0,85.16-10.75,108.89-32.21,21.48-19.41,33.15-48.89,35.2-88.52V110.63c0-3.26-2.64-5.9-5.9-5.9h-56.32Zm0,64.1s.65,139.13,0,143.36c-12.08,9.77-27.11,13.59-43.49,14.7-.16,.01-.33,.03-.49,.04-1.12,.07-2.24,.1-3.36,.1-1.32,0-2.63-.03-3.94-.1-40.41-2.11-74.52-37.26-74.52-79.38,0-10.25,1.96-20.01,5.42-28.98,11.22-29.12,38.77-49.74,71.06-49.74h49.33Z"}),Be.createElement("path",{className:"cls-1",d:"M249.83,0C113.3,0,2,110.09,.03,246.16c-2,138.19,110.12,252.7,248.33,253.5,42.68,.25,83.79-10.19,120.3-30.03,3.56-1.93,4.11-6.83,1.08-9.51l-23.38-20.72c-4.75-4.21-11.51-5.4-17.36-2.92-25.48,10.84-53.17,16.38-81.71,16.03-111.68-1.37-201.91-94.29-200.13-205.96,1.76-110.26,92-199.41,202.67-199.41h202.69V407.41l-115-102.18c-3.72-3.31-9.42-2.66-12.42,1.31-18.46,24.44-48.53,39.64-81.93,37.34-46.33-3.2-83.87-40.5-87.34-86.81-4.15-55.24,39.63-101.52,94-101.52,49.18,0,89.68,37.85,93.91,85.95,.38,4.28,2.31,8.27,5.52,11.12l29.95,26.55c3.4,3.01,8.79,1.17,9.63-3.3,2.16-11.55,2.92-23.58,2.07-35.92-4.82-70.34-61.8-126.93-132.17-131.26-80.68-4.97-148.13,58.14-150.27,137.25-2.09,77.1,61.08,143.56,138.19,145.26,32.19,.71,62.03-9.41,86.14-26.95l150.26,133.2c6.44,5.71,16.61,1.14,16.61-7.47V9.48C499.66,4.25,495.42,0,490.18,0H249.83Z"})))}function mr(e){return Be.createElement("svg",{width:"15",height:"15","aria-label":e.ariaLabel,role:"img"},Be.createElement("g",{fill:"none",stroke:"currentColor",strokeLinecap:"round",strokeLinejoin:"round",strokeWidth:"1.2"},e.children))}function vr(e){var t=e.translations,n=void 0===t?{}:t,r=n.selectText,o=void 0===r?"to select":r,i=n.selectKeyAriaLabel,c=void 0===i?"Enter key":i,a=n.navigateText,u=void 0===a?"to navigate":a,l=n.navigateUpKeyAriaLabel,s=void 0===l?"Arrow up":l,f=n.navigateDownKeyAriaLabel,p=void 0===f?"Arrow down":f,m=n.closeText,v=void 0===m?"to close":m,d=n.closeKeyAriaLabel,h=void 0===d?"Escape key":d,y=n.searchByText,b=void 0===y?"Search by":y;return Be.createElement(Be.Fragment,null,Be.createElement("div",{className:"DocSearch-Logo"},Be.createElement(pr,{translations:{searchByText:b}})),Be.createElement("ul",{className:"DocSearch-Commands"},Be.createElement("li",null,Be.createElement("kbd",{className:"DocSearch-Commands-Key"},Be.createElement(mr,{ariaLabel:c},Be.createElement("path",{d:"M12 3.53088v3c0 1-1 2-2 2H4M7 11.53088l-3-3 3-3"}))),Be.createElement("span",{className:"DocSearch-Label"},o)),Be.createElement("li",null,Be.createElement("kbd",{className:"DocSearch-Commands-Key"},Be.createElement(mr,{ariaLabel:p},Be.createElement("path",{d:"M7.5 3.5v8M10.5 8.5l-3 3-3-3"}))),Be.createElement("kbd",{className:"DocSearch-Commands-Key"},Be.createElement(mr,{ariaLabel:s},Be.createElement("path",{d:"M7.5 11.5v-8M10.5 6.5l-3-3-3 3"}))),Be.createElement("span",{className:"DocSearch-Label"},u)),Be.createElement("li",null,Be.createElement("kbd",{className:"DocSearch-Commands-Key"},Be.createElement(mr,{ariaLabel:h},Be.createElement("path",{d:"M13.6167 8.936c-.1065.3583-.6883.962-1.4875.962-.7993 0-1.653-.9165-1.653-2.1258v-.5678c0-1.2548.7896-2.1016 1.653-2.1016.8634 0 1.3601.4778 1.4875 1.0724M9 6c-.1352-.4735-.7506-.9219-1.46-.8972-.7092.0246-1.344.57-1.344 1.2166s.4198.8812 1.3445.9805C8.465 7.3992 8.968 7.9337 9 8.5c.032.5663-.454 1.398-1.4595 1.398C6.6593 9.898 6 9 5.963 8.4851m-1.4748.5368c-.2635.5941-.8099.876-1.5443.876s-1.7073-.6248-1.7073-2.204v-.4603c0-1.0416.721-2.131 1.7073-2.131.9864 0 1.6425 1.031 1.5443 2.2492h-2.956"}))),Be.createElement("span",{className:"DocSearch-Label"},v))))}function dr(e){var t=e.hit,n=e.children;return Be.createElement("a",{href:t.url},n)}function hr(){return Be.createElement("svg",{viewBox:"0 0 38 38",stroke:"currentColor",strokeOpacity:".5"},Be.createElement("g",{fill:"none",fillRule:"evenodd"},Be.createElement("g",{transform:"translate(1 1)",strokeWidth:"2"},Be.createElement("circle",{strokeOpacity:".3",cx:"18",cy:"18",r:"18"}),Be.createElement("path",{d:"M36 18c0-9.94-8.06-18-18-18"},Be.createElement("animateTransform",{attributeName:"transform",type:"rotate",from:"0 18 18",to:"360 18 18",dur:"1s",repeatCount:"indefinite"})))))}function yr(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("g",{stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"},Be.createElement("path",{d:"M3.18 6.6a8.23 8.23 0 1112.93 9.94h0a8.23 8.23 0 01-11.63 0"}),Be.createElement("path",{d:"M6.44 7.25H2.55V3.36M10.45 6v5.6M10.45 11.6L13 13"})))}function br(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M10 10l5.09-5.09L10 10l5.09 5.09L10 10zm0 0L4.91 4.91 10 10l-5.09 5.09L10 10z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"}))}function _r(){return Be.createElement("svg",{className:"DocSearch-Hit-Select-Icon",width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("g",{stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"},Be.createElement("path",{d:"M18 3v4c0 2-2 4-4 4H2"}),Be.createElement("path",{d:"M8 17l-6-6 6-6"})))}var gr=function(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M17 6v12c0 .52-.2 1-1 1H4c-.7 0-1-.33-1-1V2c0-.55.42-1 1-1h8l5 5zM14 8h-3.13c-.51 0-.87-.34-.87-.87V4",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinejoin:"round"}))};function Or(e){switch(e.type){case"lvl1":return Be.createElement(gr,null);case"content":return Be.createElement(jr,null);default:return Be.createElement(Sr,null)}}function Sr(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M13 13h4-4V8H7v5h6v4-4H7V8H3h4V3v5h6V3v5h4-4v5zm-6 0v4-4H3h4z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"}))}function jr(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M17 5H3h14zm0 5H3h14zm0 5H3h14z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinejoin:"round"}))}function wr(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M10 14.2L5 17l1-5.6-4-4 5.5-.7 2.5-5 2.5 5 5.6.8-4 4 .9 5.5z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinejoin:"round"}))}function Er(){return Be.createElement("svg",{width:"40",height:"40",viewBox:"0 0 20 20",fill:"none",fillRule:"evenodd",stroke:"currentColor",strokeLinecap:"round",strokeLinejoin:"round"},Be.createElement("path",{d:"M19 4.8a16 16 0 00-2-1.2m-3.3-1.2A16 16 0 001.1 4.7M16.7 8a12 12 0 00-2.8-1.4M10 6a12 12 0 00-6.7 2M12.3 14.7a4 4 0 00-4.5 0M14.5 11.4A8 8 0 0010 10M3 16L18 2M10 18h0"}))}function Pr(){return Be.createElement("svg",{width:"40",height:"40",viewBox:"0 0 20 20",fill:"none",fillRule:"evenodd",stroke:"currentColor",strokeLinecap:"round",strokeLinejoin:"round"},Be.createElement("path",{d:"M15.5 4.8c2 3 1.7 7-1 9.7h0l4.3 4.3-4.3-4.3a7.8 7.8 0 01-9.8 1m-2.2-2.2A7.8 7.8 0 0113.2 2.4M2 18L18 2"}))}function Ir(e){var t=e.translations,n=void 0===t?{}:t,r=n.titleText,o=void 0===r?"Unable to fetch results":r,i=n.helpText,c=void 0===i?"You might want to check your network connection.":i;return Be.createElement("div",{className:"DocSearch-ErrorScreen"},Be.createElement("div",{className:"DocSearch-Screen-Icon"},Be.createElement(Er,null)),Be.createElement("p",{className:"DocSearch-Title"},o),Be.createElement("p",{className:"DocSearch-Help"},c))}var Dr=["translations"];function kr(e){return function(e){if(Array.isArray(e))return Ar(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return Ar(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return Ar(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function Ar(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function Cr(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function xr(e){var t=e.translations,n=void 0===t?{}:t,r=Cr(e,Dr),o=n.noResultsText,i=void 0===o?"No results for":o,c=n.suggestedQueryText,a=void 0===c?"Try searching for":c,u=n.reportMissingResultsText,l=void 0===u?"Believe this query should return results?":u,s=n.reportMissingResultsLinkText,f=void 0===s?"Let us know.":s,p=r.state.context.searchSuggestions;return Be.createElement("div",{className:"DocSearch-NoResults"},Be.createElement("div",{className:"DocSearch-Screen-Icon"},Be.createElement(Pr,null)),Be.createElement("p",{className:"DocSearch-Title"},i,' "',Be.createElement("strong",null,r.state.query),'"'),p&&p.length>0&&Be.createElement("div",{className:"DocSearch-NoResults-Prefill-List"},Be.createElement("p",{className:"DocSearch-Help"},a,":"),Be.createElement("ul",null,p.slice(0,3).reduce((function(e,t){return[].concat(kr(e),[Be.createElement("li",{key:t},Be.createElement("button",{className:"DocSearch-Prefill",key:t,type:"button",onClick:function(){r.setQuery(t.toLowerCase()+" "),r.refresh(),r.inputRef.current.focus()}},t))])}),[]))),r.getMissingResultsUrl&&Be.createElement("p",{className:"DocSearch-Help"},"".concat(l," "),Be.createElement("a",{href:r.getMissingResultsUrl({query:r.state.query}),target:"_blank",rel:"noopener noreferrer"},f)))}var Nr=["hit","attribute","tagName"];function Tr(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Rr(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Tr(Object(n),!0).forEach((function(t){qr(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Tr(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function qr(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Lr(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function Mr(e,t){return t.split(".").reduce((function(e,t){return null!=e&&e[t]?e[t]:null}),e)}function Hr(e){var t=e.hit,n=e.attribute,r=e.tagName;return g(void 0===r?"span":r,Rr(Rr({},Lr(e,Nr)),{},{dangerouslySetInnerHTML:{__html:Mr(t,"_snippetResult.".concat(n,".value"))||Mr(t,n)}}))}function Ur(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null==n)return;var r,o,i=[],c=!0,a=!1;try{for(n=n.call(e);!(c=(r=n.next()).done)&&(i.push(r.value),!t||i.length!==t);c=!0);}catch(e){a=!0,o=e}finally{try{c||null==n.return||n.return()}finally{if(a)throw o}}return i}(e,t)||function(e,t){if(!e)return;if("string"==typeof e)return Fr(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return Fr(e,t)}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function Fr(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function Br(){return Br=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},Br.apply(this,arguments)}function Vr(e){return e.collection&&0!==e.collection.items.length?Be.createElement("section",{className:"DocSearch-Hits"},Be.createElement("div",{className:"DocSearch-Hit-source"},e.title),Be.createElement("ul",e.getListProps(),e.collection.items.map((function(t,n){return Be.createElement(Wr,Br({key:[e.title,t.objectID].join(":"),item:t,index:n},e))})))):null}function Wr(e){var t=e.item,n=e.index,r=e.renderIcon,o=e.renderAction,i=e.getItemProps,c=e.onItemClick,a=e.collection,u=e.hitComponent,l=Ur(Be.useState(!1),2),s=l[0],f=l[1],p=Ur(Be.useState(!1),2),m=p[0],v=p[1],d=Be.useRef(null),h=u;return Be.createElement("li",Br({className:["DocSearch-Hit",t.__docsearch_parent&&"DocSearch-Hit--Child",s&&"DocSearch-Hit--deleting",m&&"DocSearch-Hit--favoriting"].filter(Boolean).join(" "),onTransitionEnd:function(){d.current&&d.current()}},i({item:t,source:a.source,onClick:function(e){c(t,e)}})),Be.createElement(h,{hit:t},Be.createElement("div",{className:"DocSearch-Hit-Container"},r({item:t,index:n}),t.hierarchy[t.type]&&"lvl1"===t.type&&Be.createElement("div",{className:"DocSearch-Hit-content-wrapper"},Be.createElement(Hr,{className:"DocSearch-Hit-title",hit:t,attribute:"hierarchy.lvl1"}),t.content&&Be.createElement(Hr,{className:"DocSearch-Hit-path",hit:t,attribute:"content"})),t.hierarchy[t.type]&&("lvl2"===t.type||"lvl3"===t.type||"lvl4"===t.type||"lvl5"===t.type||"lvl6"===t.type)&&Be.createElement("div",{className:"DocSearch-Hit-content-wrapper"},Be.createElement(Hr,{className:"DocSearch-Hit-title",hit:t,attribute:"hierarchy.".concat(t.type)}),Be.createElement(Hr,{className:"DocSearch-Hit-path",hit:t,attribute:"hierarchy.lvl1"})),"content"===t.type&&Be.createElement("div",{className:"DocSearch-Hit-content-wrapper"},Be.createElement(Hr,{className:"DocSearch-Hit-title",hit:t,attribute:"content"}),Be.createElement(Hr,{className:"DocSearch-Hit-path",hit:t,attribute:"hierarchy.lvl1"})),o({item:t,runDeleteTransition:function(e){f(!0),d.current=e},runFavoriteTransition:function(e){v(!0),d.current=e}}))))}function Kr(e,t,n){return e.reduce((function(e,r){var o=t(r);return e.hasOwnProperty(o)||(e[o]=[]),e[o].length<(n||5)&&e[o].push(r),e}),{})}function zr(e){return e}function Jr(e){return 1===e.button||e.altKey||e.ctrlKey||e.metaKey||e.shiftKey}function $r(){}var Qr=/(<mark>|<\/mark>)/g,Zr=RegExp(Qr.source);function Yr(e){var t,n,r,o,i,c=e;if(!c.__docsearch_parent&&!e._highlightResult)return e.hierarchy.lvl0;var a=((c.__docsearch_parent?null===(t=c.__docsearch_parent)||void 0===t||null===(n=t._highlightResult)||void 0===n||null===(r=n.hierarchy)||void 0===r?void 0:r.lvl0:null===(o=e._highlightResult)||void 0===o||null===(i=o.hierarchy)||void 0===i?void 0:i.lvl0)||{}).value;return a&&Zr.test(a)?a.replace(Qr,""):a}function Gr(){return Gr=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},Gr.apply(this,arguments)}function Xr(e){return Be.createElement("div",{className:"DocSearch-Dropdown-Container"},e.state.collections.map((function(t){if(0===t.items.length)return null;var n=Yr(t.items[0]);return Be.createElement(Vr,Gr({},e,{key:t.source.sourceId,title:n,collection:t,renderIcon:function(e){var n,r=e.item,o=e.index;return Be.createElement(Be.Fragment,null,r.__docsearch_parent&&Be.createElement("svg",{className:"DocSearch-Hit-Tree",viewBox:"0 0 24 54"},Be.createElement("g",{stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"},r.__docsearch_parent!==(null===(n=t.items[o+1])||void 0===n?void 0:n.__docsearch_parent)?Be.createElement("path",{d:"M8 6v21M20 27H8.3"}):Be.createElement("path",{d:"M8 6v42M20 27H8.3"}))),Be.createElement("div",{className:"DocSearch-Hit-icon"},Be.createElement(Or,{type:r.type})))},renderAction:function(){return Be.createElement("div",{className:"DocSearch-Hit-action"},Be.createElement(_r,null))}}))})),e.resultsFooterComponent&&Be.createElement("section",{className:"DocSearch-HitsFooter"},Be.createElement(e.resultsFooterComponent,{state:e.state})))}var eo=["translations"];function to(){return to=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},to.apply(this,arguments)}function no(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function ro(e){var t=e.translations,n=void 0===t?{}:t,r=no(e,eo),o=n.recentSearchesTitle,i=void 0===o?"Recent":o,c=n.noRecentSearchesText,a=void 0===c?"No recent searches":c,u=n.saveRecentSearchButtonTitle,l=void 0===u?"Save this search":u,s=n.removeRecentSearchButtonTitle,f=void 0===s?"Remove this search from history":s,p=n.favoriteSearchesTitle,m=void 0===p?"Favorite":p,v=n.removeFavoriteSearchButtonTitle,d=void 0===v?"Remove this search from favorites":v;return"idle"===r.state.status&&!1===r.hasCollections?r.disableUserPersonalization?null:Be.createElement("div",{className:"DocSearch-StartScreen"},Be.createElement("p",{className:"DocSearch-Help"},a)):!1===r.hasCollections?null:Be.createElement("div",{className:"DocSearch-Dropdown-Container"},Be.createElement(Vr,to({},r,{title:i,collection:r.state.collections[0],renderIcon:function(){return Be.createElement("div",{className:"DocSearch-Hit-icon"},Be.createElement(yr,null))},renderAction:function(e){var t=e.item,n=e.runFavoriteTransition,o=e.runDeleteTransition;return Be.createElement(Be.Fragment,null,Be.createElement("div",{className:"DocSearch-Hit-action"},Be.createElement("button",{className:"DocSearch-Hit-action-button",title:l,type:"submit",onClick:function(e){e.preventDefault(),e.stopPropagation(),n((function(){r.favoriteSearches.add(t),r.recentSearches.remove(t),r.refresh()}))}},Be.createElement(wr,null))),Be.createElement("div",{className:"DocSearch-Hit-action"},Be.createElement("button",{className:"DocSearch-Hit-action-button",title:f,type:"submit",onClick:function(e){e.preventDefault(),e.stopPropagation(),o((function(){r.recentSearches.remove(t),r.refresh()}))}},Be.createElement(br,null))))}})),Be.createElement(Vr,to({},r,{title:m,collection:r.state.collections[1],renderIcon:function(){return Be.createElement("div",{className:"DocSearch-Hit-icon"},Be.createElement(wr,null))},renderAction:function(e){var t=e.item,n=e.runDeleteTransition;return Be.createElement("div",{className:"DocSearch-Hit-action"},Be.createElement("button",{className:"DocSearch-Hit-action-button",title:d,type:"submit",onClick:function(e){e.preventDefault(),e.stopPropagation(),n((function(){r.favoriteSearches.remove(t),r.refresh()}))}},Be.createElement(br,null)))}})))}var oo=["translations"];function io(){return io=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},io.apply(this,arguments)}function co(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var ao=Be.memo((function(e){var t=e.translations,n=void 0===t?{}:t,r=co(e,oo);if("error"===r.state.status)return Be.createElement(Ir,{translations:null==n?void 0:n.errorScreen});var o=r.state.collections.some((function(e){return e.items.length>0}));return r.state.query?!1===o?Be.createElement(xr,io({},r,{translations:null==n?void 0:n.noResultsScreen})):Be.createElement(Xr,r):Be.createElement(ro,io({},r,{hasCollections:o,translations:null==n?void 0:n.startScreen}))}),(function(e,t){return"loading"===t.state.status||"stalled"===t.state.status})),uo=["translations"];function lo(){return lo=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},lo.apply(this,arguments)}function so(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function fo(e){var t=e.translations,n=void 0===t?{}:t,r=so(e,uo),o=n.resetButtonTitle,i=void 0===o?"Clear the query":o,c=n.resetButtonAriaLabel,a=void 0===c?"Clear the query":c,u=n.cancelButtonText,l=void 0===u?"Cancel":u,s=n.cancelButtonAriaLabel,f=void 0===s?"Cancel":s,p=r.getFormProps({inputElement:r.inputRef.current}).onReset;return Be.useEffect((function(){r.autoFocus&&r.inputRef.current&&r.inputRef.current.focus()}),[r.autoFocus,r.inputRef]),Be.useEffect((function(){r.isFromSelection&&r.inputRef.current&&r.inputRef.current.select()}),[r.isFromSelection,r.inputRef]),Be.createElement(Be.Fragment,null,Be.createElement("form",{className:"DocSearch-Form",onSubmit:function(e){e.preventDefault()},onReset:p},Be.createElement("label",lo({className:"DocSearch-MagnifierLabel"},r.getLabelProps()),Be.createElement(We,null)),Be.createElement("div",{className:"DocSearch-LoadingIndicator"},Be.createElement(hr,null)),Be.createElement("input",lo({className:"DocSearch-Input",ref:r.inputRef},r.getInputProps({inputElement:r.inputRef.current,autoFocus:r.autoFocus,maxLength:64}))),Be.createElement("button",{type:"reset",title:i,className:"DocSearch-Reset","aria-label":a,hidden:!r.state.query},Be.createElement(br,null))),Be.createElement("button",{className:"DocSearch-Cancel",type:"reset","aria-label":f,onClick:r.onClose},l))}var po=["_highlightResult","_snippetResult"];function mo(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function vo(e){return!1===function(){var e="__TEST_KEY__";try{return localStorage.setItem(e,""),localStorage.removeItem(e),!0}catch(e){return!1}}()?{setItem:function(){},getItem:function(){return[]}}:{setItem:function(t){return window.localStorage.setItem(e,JSON.stringify(t))},getItem:function(){var t=window.localStorage.getItem(e);return t?JSON.parse(t):[]}}}function ho(e){var t=e.key,n=e.limit,r=void 0===n?5:n,o=vo(t),i=o.getItem().slice(0,r);return{add:function(e){var t=e,n=(t._highlightResult,t._snippetResult,mo(t,po)),c=i.findIndex((function(e){return e.objectID===n.objectID}));c>-1&&i.splice(c,1),i.unshift(n),i=i.slice(0,r),o.setItem(i)},remove:function(e){i=i.filter((function(t){return t.objectID!==e.objectID})),o.setItem(i)},getAll:function(){return i}}}var yo=["facetName","facetQuery"];function bo(e){var t,n="algoliasearch-client-js-".concat(e.key),r=function(){return void 0===t&&(t=e.localStorage||window.localStorage),t},o=function(){return JSON.parse(r().getItem(n)||"{}")};return{get:function(e,t){var n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{miss:function(){return Promise.resolve()}};return Promise.resolve().then((function(){var n=JSON.stringify(e),r=o()[n];return Promise.all([r||t(),void 0!==r])})).then((function(e){var t=c(e,2),r=t[0],o=t[1];return Promise.all([r,o||n.miss(r)])})).then((function(e){return c(e,1)[0]}))},set:function(e,t){return Promise.resolve().then((function(){var i=o();return i[JSON.stringify(e)]=t,r().setItem(n,JSON.stringify(i)),t}))},delete:function(e){return Promise.resolve().then((function(){var t=o();delete t[JSON.stringify(e)],r().setItem(n,JSON.stringify(t))}))},clear:function(){return Promise.resolve().then((function(){r().removeItem(n)}))}}}function _o(e){var t=a(e.caches),n=t.shift();return void 0===n?{get:function(e,t){var n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{miss:function(){return Promise.resolve()}};return t().then((function(e){return Promise.all([e,n.miss(e)])})).then((function(e){return c(e,1)[0]}))},set:function(e,t){return Promise.resolve(t)},delete:function(e){return Promise.resolve()},clear:function(){return Promise.resolve()}}:{get:function(e,r){var o=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{miss:function(){return Promise.resolve()}};return n.get(e,r,o).catch((function(){return _o({caches:t}).get(e,r,o)}))},set:function(e,r){return n.set(e,r).catch((function(){return _o({caches:t}).set(e,r)}))},delete:function(e){return n.delete(e).catch((function(){return _o({caches:t}).delete(e)}))},clear:function(){return n.clear().catch((function(){return _o({caches:t}).clear()}))}}}function go(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{serializable:!0},t={};return{get:function(n,r){var o=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{miss:function(){return Promise.resolve()}},i=JSON.stringify(n);if(i in t)return Promise.resolve(e.serializable?JSON.parse(t[i]):t[i]);var c=r(),a=o&&o.miss||function(){return Promise.resolve()};return c.then((function(e){return a(e)})).then((function(){return c}))},set:function(n,r){return t[JSON.stringify(n)]=e.serializable?JSON.stringify(r):r,Promise.resolve(r)},delete:function(e){return delete t[JSON.stringify(e)],Promise.resolve()},clear:function(){return t={},Promise.resolve()}}}function Oo(e){for(var t=e.length-1;t>0;t--){var n=Math.floor(Math.random()*(t+1)),r=e[t];e[t]=e[n],e[n]=r}return e}function So(e,t){return t?(Object.keys(t).forEach((function(n){e[n]=t[n](e)})),e):e}function jo(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),r=1;r<t;r++)n[r-1]=arguments[r];var o=0;return e.replace(/%s/g,(function(){return encodeURIComponent(n[o++])}))}var wo="4.8.5",Eo={WithinQueryParameters:0,WithinHeaders:1};function Po(e,t){var n=e||{},r=n.data||{};return Object.keys(n).forEach((function(e){-1===["timeout","headers","queryParameters","data","cacheable"].indexOf(e)&&(r[e]=n[e])})),{data:Object.entries(r).length>0?r:void 0,timeout:n.timeout||t,headers:n.headers||{},queryParameters:n.queryParameters||{},cacheable:n.cacheable}}var Io={Read:1,Write:2,Any:3},Do=1,ko=2,Ao=3,Co=12e4;function xo(e){var n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:Do;return t(t({},e),{},{status:n,lastUpdate:Date.now()})}function No(e){return"string"==typeof e?{protocol:"https",url:e,accept:Io.Any}:{protocol:e.protocol||"https",url:e.url,accept:e.accept||Io.Any}}var To="GET",Ro="POST";function qo(e,t){return Promise.all(t.map((function(t){return e.get(t,(function(){return Promise.resolve(xo(t))}))}))).then((function(e){var n=e.filter((function(e){return function(e){return e.status===Do||Date.now()-e.lastUpdate>Co}(e)})),r=e.filter((function(e){return function(e){return e.status===Ao&&Date.now()-e.lastUpdate<=Co}(e)})),o=[].concat(a(n),a(r));return{getTimeout:function(e,t){return(0===r.length&&0===e?1:r.length+3+e)*t},statelessHosts:o.length>0?o.map((function(e){return No(e)})):t}}))}function Lo(e,n,r,o){var i=[],c=function(e,n){if(e.method===To||void 0===e.data&&void 0===n.data)return;var r=Array.isArray(e.data)?e.data:t(t({},e.data),n.data);return JSON.stringify(r)}(r,o),u=function(e,n){var r=t(t({},e.headers),n.headers),o={};return Object.keys(r).forEach((function(e){var t=r[e];o[e.toLowerCase()]=t})),o}(e,o),l=r.method,s=r.method!==To?{}:t(t({},r.data),o.data),f=t(t(t({"x-algolia-agent":e.userAgent.value},e.queryParameters),s),o.queryParameters),p=0,m=function t(n,a){var s=n.pop();if(void 0===s)throw{name:"RetryError",message:"Unreachable hosts - your application id may be incorrect. If the error persists, contact support@algolia.com.",transporterStackTrace:Fo(i)};var m={data:c,headers:u,method:l,url:Ho(s,r.path,f),connectTimeout:a(p,e.timeouts.connect),responseTimeout:a(p,o.timeout)},v=function(e){var t={request:m,response:e,host:s,triesLeft:n.length};return i.push(t),t},d={onSucess:function(e){return function(e){try{return JSON.parse(e.content)}catch(t){throw function(e,t){return{name:"DeserializationError",message:e,response:t}}(t.message,e)}}(e)},onRetry:function(r){var o=v(r);return r.isTimedOut&&p++,Promise.all([e.logger.info("Retryable failure",Bo(o)),e.hostsCache.set(s,xo(s,r.isTimedOut?Ao:ko))]).then((function(){return t(n,a)}))},onFail:function(e){throw v(e),function(e,t){var n=e.content,r=e.status,o=n;try{o=JSON.parse(n).message}catch(e){}return function(e,t,n){return{name:"ApiError",message:e,status:t,transporterStackTrace:n}}(o,r,t)}(e,Fo(i))}};return e.requester.send(m).then((function(e){return function(e,t){return function(e){var t=e.status;return e.isTimedOut||function(e){var t=e.isTimedOut,n=e.status;return!t&&0==~~n}(e)||2!=~~(t/100)&&4!=~~(t/100)}(e)?t.onRetry(e):2==~~(e.status/100)?t.onSucess(e):t.onFail(e)}(e,d)}))};return qo(e.hostsCache,n).then((function(e){return m(a(e.statelessHosts).reverse(),e.getTimeout)}))}function Mo(e){var t={value:"Algolia for JavaScript (".concat(e,")"),add:function(e){var n="; ".concat(e.segment).concat(void 0!==e.version?" (".concat(e.version,")"):"");return-1===t.value.indexOf(n)&&(t.value="".concat(t.value).concat(n)),t}};return t}function Ho(e,t,n){var r=Uo(n),o="".concat(e.protocol,"://").concat(e.url,"/").concat("/"===t.charAt(0)?t.substr(1):t);return r.length&&(o+="?".concat(r)),o}function Uo(e){return Object.keys(e).map((function(t){return jo("%s=%s",t,(n=e[t],"[object Object]"===Object.prototype.toString.call(n)||"[object Array]"===Object.prototype.toString.call(n)?JSON.stringify(e[t]):e[t]));var n})).join("&")}function Fo(e){return e.map((function(e){return Bo(e)}))}function Bo(e){var n=e.request.headers["x-algolia-api-key"]?{"x-algolia-api-key":"*****"}:{};return t(t({},e),{},{request:t(t({},e.request),{},{headers:t(t({},e.request.headers),n)})})}var Vo=function(e){var n=e.appId,r=function(e,t,n){var r={"x-algolia-api-key":n,"x-algolia-application-id":t};return{headers:function(){return e===Eo.WithinHeaders?r:{}},queryParameters:function(){return e===Eo.WithinQueryParameters?r:{}}}}(void 0!==e.authMode?e.authMode:Eo.WithinHeaders,n,e.apiKey),o=function(e){var t=e.hostsCache,n=e.logger,r=e.requester,o=e.requestsCache,i=e.responsesCache,a=e.timeouts,u=e.userAgent,l=e.hosts,s=e.queryParameters,f={hostsCache:t,logger:n,requester:r,requestsCache:o,responsesCache:i,timeouts:a,userAgent:u,headers:e.headers,queryParameters:s,hosts:l.map((function(e){return No(e)})),read:function(e,t){var n=Po(t,f.timeouts.read),r=function(){return Lo(f,f.hosts.filter((function(e){return 0!=(e.accept&Io.Read)})),e,n)};if(!0!==(void 0!==n.cacheable?n.cacheable:e.cacheable))return r();var o={request:e,mappedRequestOptions:n,transporter:{queryParameters:f.queryParameters,headers:f.headers}};return f.responsesCache.get(o,(function(){return f.requestsCache.get(o,(function(){return f.requestsCache.set(o,r()).then((function(e){return Promise.all([f.requestsCache.delete(o),e])}),(function(e){return Promise.all([f.requestsCache.delete(o),Promise.reject(e)])})).then((function(e){var t=c(e,2);return t[0],t[1]}))}))}),{miss:function(e){return f.responsesCache.set(o,e)}})},write:function(e,t){return Lo(f,f.hosts.filter((function(e){return 0!=(e.accept&Io.Write)})),e,Po(t,f.timeouts.write))}};return f}(t(t({hosts:[{url:"".concat(n,"-dsn.algolia.net"),accept:Io.Read},{url:"".concat(n,".algolia.net"),accept:Io.Write}].concat(Oo([{url:"".concat(n,"-1.algolianet.com")},{url:"".concat(n,"-2.algolianet.com")},{url:"".concat(n,"-3.algolianet.com")}]))},e),{},{headers:t(t(t({},r.headers()),{"content-type":"application/x-www-form-urlencoded"}),e.headers),queryParameters:t(t({},r.queryParameters()),e.queryParameters)})),i={transporter:o,appId:n,addAlgoliaAgent:function(e,t){o.userAgent.add({segment:e,version:t})},clearCache:function(){return Promise.all([o.requestsCache.clear(),o.responsesCache.clear()]).then((function(){}))}};return So(i,e.methods)},Wo=function(e){return function(t){var n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},r={transporter:e.transporter,appId:e.appId,indexName:t};return So(r,n.methods)}},Ko=function(e){return function(n,r){var o=n.map((function(e){return t(t({},e),{},{params:Uo(e.params||{})})}));return e.transporter.read({method:Ro,path:"1/indexes/*/queries",data:{requests:o},cacheable:!0},r)}},zo=function(e){return function(n,r){return Promise.all(n.map((function(n){var o=n.params,c=o.facetName,a=o.facetQuery,u=i(o,yo);return Wo(e)(n.indexName,{methods:{searchForFacetValues:Qo}}).searchForFacetValues(c,a,t(t({},r),u))})))}},Jo=function(e){return function(t,n,r){return e.transporter.read({method:Ro,path:jo("1/answers/%s/prediction",e.indexName),data:{query:t,queryLanguages:n},cacheable:!0},r)}},$o=function(e){return function(t,n){return e.transporter.read({method:Ro,path:jo("1/indexes/%s/query",e.indexName),data:{query:t},cacheable:!0},n)}},Qo=function(e){return function(t,n,r){return e.transporter.read({method:Ro,path:jo("1/indexes/%s/facets/%s/query",e.indexName,t),data:{facetQuery:n},cacheable:!0},r)}},Zo=1,Yo=2,Go=3;function Xo(e,n,r){var o,i={appId:e,apiKey:n,timeouts:{connect:1,read:2,write:30},requester:{send:function(e){return new Promise((function(t){var n=new XMLHttpRequest;n.open(e.method,e.url,!0),Object.keys(e.headers).forEach((function(t){return n.setRequestHeader(t,e.headers[t])}));var r,o=function(e,r){return setTimeout((function(){n.abort(),t({status:0,content:r,isTimedOut:!0})}),1e3*e)},i=o(e.connectTimeout,"Connection timeout");n.onreadystatechange=function(){n.readyState>n.OPENED&&void 0===r&&(clearTimeout(i),r=o(e.responseTimeout,"Socket timeout"))},n.onerror=function(){0===n.status&&(clearTimeout(i),clearTimeout(r),t({content:n.responseText||"Network request failed",status:n.status,isTimedOut:!1}))},n.onload=function(){clearTimeout(i),clearTimeout(r),t({content:n.responseText,status:n.status,isTimedOut:!1})},n.send(e.data)}))}},logger:(o=Go,{debug:function(e,t){return Zo>=o&&console.debug(e,t),Promise.resolve()},info:function(e,t){return Yo>=o&&console.info(e,t),Promise.resolve()},error:function(e,t){return console.error(e,t),Promise.resolve()}}),responsesCache:go(),requestsCache:go({serializable:!1}),hostsCache:_o({caches:[bo({key:"".concat(wo,"-").concat(e)}),go()]}),userAgent:Mo(wo).add({segment:"Browser",version:"lite"}),authMode:Eo.WithinQueryParameters};return Vo(t(t(t({},i),r),{},{methods:{search:Ko,searchForFacetValues:zo,multipleQueries:Ko,multipleSearchForFacetValues:zo,initIndex:function(e){return function(t){return Wo(e)(t,{methods:{search:$o,searchForFacetValues:Qo,findAnswers:Jo}})}}}}))}Xo.version=wo;var ei="3.5.1";var ti=["footer","searchBox"];function ni(){return ni=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},ni.apply(this,arguments)}function ri(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function oi(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?ri(Object(n),!0).forEach((function(t){ii(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):ri(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function ii(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function ci(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null==n)return;var r,o,i=[],c=!0,a=!1;try{for(n=n.call(e);!(c=(r=n.next()).done)&&(i.push(r.value),!t||i.length!==t);c=!0);}catch(e){a=!0,o=e}finally{try{c||null==n.return||n.return()}finally{if(a)throw o}}return i}(e,t)||function(e,t){if(!e)return;if("string"==typeof e)return ai(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return ai(e,t)}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function ai(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function ui(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function li(e){var t=e.appId,n=e.apiKey,r=e.indexName,o=e.placeholder,i=void 0===o?"Search docs":o,c=e.searchParameters,a=e.maxResultsPerGroup,u=e.onClose,l=void 0===u?$r:u,s=e.transformItems,f=void 0===s?zr:s,p=e.hitComponent,m=void 0===p?dr:p,v=e.resultsFooterComponent,d=void 0===v?function(){return null}:v,h=e.navigator,y=e.initialScrollY,b=void 0===y?0:y,_=e.transformSearchClient,g=void 0===_?zr:_,O=e.disableUserPersonalization,S=void 0!==O&&O,j=e.initialQuery,w=void 0===j?"":j,E=e.translations,P=void 0===E?{}:E,I=e.getMissingResultsUrl,D=e.insights,k=void 0!==D&&D,A=P.footer,C=P.searchBox,x=ui(P,ti),N=ci(Be.useState({query:"",collections:[],completion:null,context:{},isOpen:!1,activeItemId:null,status:"idle"}),2),T=N[0],R=N[1],q=Be.useRef(null),L=Be.useRef(null),M=Be.useRef(null),H=Be.useRef(null),U=Be.useRef(null),F=Be.useRef(10),B=Be.useRef("undefined"!=typeof window?window.getSelection().toString().slice(0,64):"").current,V=Be.useRef(w||B).current,W=function(e,t,n){return Be.useMemo((function(){var r=Xo(e,t);return r.addAlgoliaAgent("docsearch",ei),!1===/docsearch.js \(.*\)/.test(r.transporter.userAgent.value)&&r.addAlgoliaAgent("docsearch-react",ei),n(r)}),[e,t,n])}(t,n,g),K=Be.useRef(ho({key:"__DOCSEARCH_FAVORITE_SEARCHES__".concat(r),limit:10})).current,z=Be.useRef(ho({key:"__DOCSEARCH_RECENT_SEARCHES__".concat(r),limit:0===K.getAll().length?7:4})).current,J=Be.useCallback((function(e){if(!S){var t="content"===e.type?e.__docsearch_parent:e;t&&-1===K.getAll().findIndex((function(e){return e.objectID===t.objectID}))&&z.add(t)}}),[K,z,S]),$=Be.useCallback((function(e){if(T.context.algoliaInsightsPlugin&&e.__autocomplete_id){var t=e,n={eventName:"Item Selected",index:t.__autocomplete_indexName,items:[t],positions:[e.__autocomplete_id],queryID:t.__autocomplete_queryID};T.context.algoliaInsightsPlugin.insights.clickedObjectIDsAfterSearch(n)}}),[T.context.algoliaInsightsPlugin]),Q=Be.useMemo((function(){return fr({id:"docsearch",defaultActiveItemId:0,placeholder:i,openOnFocus:!0,initialState:{query:V,context:{searchSuggestions:[]}},insights:k,navigator:h,onStateChange:function(e){R(e.state)},getSources:function(e){var o=e.query,i=e.state,u=e.setContext,s=e.setStatus;if(!o)return S?[]:[{sourceId:"recentSearches",onSelect:function(e){var t=e.item,n=e.event;J(t),Jr(n)||l()},getItemUrl:function(e){return e.item.url},getItems:function(){return z.getAll()}},{sourceId:"favoriteSearches",onSelect:function(e){var t=e.item,n=e.event;J(t),Jr(n)||l()},getItemUrl:function(e){return e.item.url},getItems:function(){return K.getAll()}}];var p=Boolean(k);return W.search([{query:o,indexName:r,params:oi({attributesToRetrieve:["hierarchy.lvl0","hierarchy.lvl1","hierarchy.lvl2","hierarchy.lvl3","hierarchy.lvl4","hierarchy.lvl5","hierarchy.lvl6","content","type","url"],attributesToSnippet:["hierarchy.lvl1:".concat(F.current),"hierarchy.lvl2:".concat(F.current),"hierarchy.lvl3:".concat(F.current),"hierarchy.lvl4:".concat(F.current),"hierarchy.lvl5:".concat(F.current),"hierarchy.lvl6:".concat(F.current),"content:".concat(F.current)],snippetEllipsisText:"…",highlightPreTag:"<mark>",highlightPostTag:"</mark>",hitsPerPage:20,clickAnalytics:p},c)}]).catch((function(e){throw"RetryError"===e.name&&s("error"),e})).then((function(e){var o=e.results,c=o[0],s=c.hits,m=c.nbHits,v=Kr(s,(function(e){return Yr(e)}),a);i.context.searchSuggestions.length<Object.keys(v).length&&u({searchSuggestions:Object.keys(v)}),u({nbHits:m});var d={};return p&&(d={__autocomplete_indexName:r,__autocomplete_queryID:o[0].queryID,__autocomplete_algoliaCredentials:{appId:t,apiKey:n}}),Object.values(v).map((function(e,t){return{sourceId:"hits".concat(t),onSelect:function(e){var t=e.item,n=e.event;J(t),Jr(n)||l()},getItemUrl:function(e){return e.item.url},getItems:function(){return Object.values(Kr(e,(function(e){return e.hierarchy.lvl1}),a)).map(f).map((function(e){return e.map((function(t){var n=null,r=e.find((function(e){return"lvl1"===e.type&&e.hierarchy.lvl1===t.hierarchy.lvl1}));return"lvl1"!==t.type&&r&&(n=r),oi(oi({},t),{},{__docsearch_parent:n},d)}))})).flat()}}}))}))}})}),[r,c,a,W,l,z,K,J,V,i,h,f,S,k,t,n]),Z=Q.getEnvironmentProps,Y=Q.getRootProps,G=Q.refresh;return function(e){var t=e.getEnvironmentProps,n=e.panelElement,r=e.formElement,o=e.inputElement;Be.useEffect((function(){if(n&&r&&o){var e=t({panelElement:n,formElement:r,inputElement:o}),i=e.onTouchStart,c=e.onTouchMove;return window.addEventListener("touchstart",i),window.addEventListener("touchmove",c),function(){window.removeEventListener("touchstart",i),window.removeEventListener("touchmove",c)}}}),[t,n,r,o])}({getEnvironmentProps:Z,panelElement:H.current,formElement:M.current,inputElement:U.current}),function(e){var t=e.container;Be.useEffect((function(){if(t){var e=t.querySelectorAll("a[href]:not([disabled]), button:not([disabled]), input:not([disabled])"),n=e[0],r=e[e.length-1];return t.addEventListener("keydown",o),function(){t.removeEventListener("keydown",o)}}function o(e){"Tab"===e.key&&(e.shiftKey?document.activeElement===n&&(e.preventDefault(),r.focus()):document.activeElement===r&&(e.preventDefault(),n.focus()))}}),[t])}({container:q.current}),Be.useEffect((function(){return document.body.classList.add("DocSearch--active"),function(){var e,t;document.body.classList.remove("DocSearch--active"),null===(e=(t=window).scrollTo)||void 0===e||e.call(t,0,b)}}),[]),Be.useEffect((function(){window.matchMedia("(max-width: 768px)").matches&&(F.current=5)}),[]),Be.useEffect((function(){H.current&&(H.current.scrollTop=0)}),[T.query]),Be.useEffect((function(){V.length>0&&(G(),U.current&&U.current.focus())}),[V,G]),Be.useEffect((function(){function e(){if(L.current){var e=.01*window.innerHeight;L.current.style.setProperty("--docsearch-vh","".concat(e,"px"))}}return e(),window.addEventListener("resize",e),function(){window.removeEventListener("resize",e)}}),[]),Be.createElement("div",ni({ref:q},Y({"aria-expanded":!0}),{className:["DocSearch","DocSearch-Container","stalled"===T.status&&"DocSearch-Container--Stalled","error"===T.status&&"DocSearch-Container--Errored"].filter(Boolean).join(" "),role:"button",tabIndex:0,onMouseDown:function(e){e.target===e.currentTarget&&l()}}),Be.createElement("div",{className:"DocSearch-Modal",ref:L},Be.createElement("header",{className:"DocSearch-SearchBar",ref:M},Be.createElement(fo,ni({},Q,{state:T,autoFocus:0===V.length,inputRef:U,isFromSelection:Boolean(V)&&V===B,translations:C,onClose:l}))),Be.createElement("div",{className:"DocSearch-Dropdown",ref:H},Be.createElement(ao,ni({},Q,{indexName:r,state:T,hitComponent:m,resultsFooterComponent:d,disableUserPersonalization:S,recentSearches:z,favoriteSearches:K,inputRef:U,translations:x,getMissingResultsUrl:I,onItemClick:function(e,t){$(e),J(e),Jr(t)||l()}}))),Be.createElement("footer",{className:"DocSearch-Footer"},Be.createElement(vr,{translations:A}))))}function si(){return si=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},si.apply(this,arguments)}function fi(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null==n)return;var r,o,i=[],c=!0,a=!1;try{for(n=n.call(e);!(c=(r=n.next()).done)&&(i.push(r.value),!t||i.length!==t);c=!0);}catch(e){a=!0,o=e}finally{try{c||null==n.return||n.return()}finally{if(a)throw o}}return i}(e,t)||function(e,t){if(!e)return;if("string"==typeof e)return pi(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return pi(e,t)}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function pi(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function mi(e){var t,n,r=Be.useRef(null),o=fi(Be.useState(!1),2),i=o[0],c=o[1],a=fi(Be.useState((null==e?void 0:e.initialQuery)||void 0),2),u=a[0],l=a[1],s=Be.useCallback((function(){c(!0)}),[c]),f=Be.useCallback((function(){c(!1)}),[c]);return function(e){var t=e.isOpen,n=e.onOpen,r=e.onClose,o=e.onInput,i=e.searchButtonRef;Be.useEffect((function(){function e(e){var c;(27===e.keyCode&&t||"k"===(null===(c=e.key)||void 0===c?void 0:c.toLowerCase())&&(e.metaKey||e.ctrlKey)||!function(e){var t=e.target,n=t.tagName;return t.isContentEditable||"INPUT"===n||"SELECT"===n||"TEXTAREA"===n}(e)&&"/"===e.key&&!t)&&(e.preventDefault(),t?r():document.body.classList.contains("DocSearch--active")||document.body.classList.contains("DocSearch--active")||n()),i&&i.current===document.activeElement&&o&&/[a-zA-Z0-9]/.test(String.fromCharCode(e.keyCode))&&o(e)}return window.addEventListener("keydown",e),function(){window.removeEventListener("keydown",e)}}),[t,n,r,o,i])}({isOpen:i,onOpen:s,onClose:f,onInput:Be.useCallback((function(e){c(!0),l(e.key)}),[c,l]),searchButtonRef:r}),Be.createElement(Be.Fragment,null,Be.createElement(Ye,{ref:r,translations:null==e||null===(t=e.translations)||void 0===t?void 0:t.button,onClick:s}),i&&Ie(Be.createElement(li,si({},e,{initialScrollY:window.scrollY,initialQuery:u,translations:null==e||null===(n=e.translations)||void 0===n?void 0:n.modal,onClose:f})),document.body))}return function(e){Ce(Be.createElement(mi,o({},e,{transformSearchClient:function(t){return t.addAlgoliaAgent("docsearch.js",ei),e.transformSearchClient?e.transformSearchClient(t):t}})),function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:window;return"string"==typeof e?t.document.querySelector(e):e}(e.container,e.environment))}}));
+/*! @docsearch/js 3.6.1 | MIT License | © Algolia, Inc. and contributors | https://docsearch.algolia.com */
+!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e=e||self).docsearch=t()}(this,(function(){"use strict";function e(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function t(t){for(var n=1;n<arguments.length;n++){var o=null!=arguments[n]?arguments[n]:{};n%2?e(Object(o),!0).forEach((function(e){r(t,e,o[e])})):Object.getOwnPropertyDescriptors?Object.defineProperties(t,Object.getOwnPropertyDescriptors(o)):e(Object(o)).forEach((function(e){Object.defineProperty(t,e,Object.getOwnPropertyDescriptor(o,e))}))}return t}function n(e){return n="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},n(e)}function r(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function o(){return o=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},o.apply(this,arguments)}function i(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function c(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null==n)return;var r,o,i=[],c=!0,a=!1;try{for(n=n.call(e);!(c=(r=n.next()).done)&&(i.push(r.value),!t||i.length!==t);c=!0);}catch(e){a=!0,o=e}finally{try{c||null==n.return||n.return()}finally{if(a)throw o}}return i}(e,t)||u(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function a(e){return function(e){if(Array.isArray(e))return l(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||u(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function u(e,t){if(e){if("string"==typeof e)return l(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?l(e,t):void 0}}function l(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}var s,f,p,m,d,v={},h=[],y=/acit|ex(?:s|g|n|p|$)|rph|grid|ows|mnc|ntw|ine[ch]|zoo|^ord|itera/i;function _(e,t){for(var n in t)e[n]=t[n];return e}function b(e){var t=e.parentNode;t&&t.removeChild(e)}function g(e,t,n){var r,o,i,c=arguments,a={};for(i in t)"key"==i?r=t[i]:"ref"==i?o=t[i]:a[i]=t[i];if(arguments.length>3)for(n=[n],i=3;i<arguments.length;i++)n.push(c[i]);if(null!=n&&(a.children=n),"function"==typeof e&&null!=e.defaultProps)for(i in e.defaultProps)void 0===a[i]&&(a[i]=e.defaultProps[i]);return S(e,a,r,o,null)}function S(e,t,n,r,o){var i={type:e,props:t,key:n,ref:r,__k:null,__:null,__b:0,__e:null,__d:void 0,__c:null,__h:null,constructor:void 0,__v:null==o?++s.__v:o};return null!=s.vnode&&s.vnode(i),i}function O(e){return e.children}function w(e,t){this.props=e,this.context=t}function E(e,t){if(null==t)return e.__?E(e.__,e.__.__k.indexOf(e)+1):null;for(var n;t<e.__k.length;t++)if(null!=(n=e.__k[t])&&null!=n.__e)return n.__e;return"function"==typeof e.type?E(e):null}function j(e){var t,n;if(null!=(e=e.__)&&null!=e.__c){for(e.__e=e.__c.base=null,t=0;t<e.__k.length;t++)if(null!=(n=e.__k[t])&&null!=n.__e){e.__e=e.__c.base=n.__e;break}return j(e)}}function P(e){(!e.__d&&(e.__d=!0)&&f.push(e)&&!I.__r++||m!==s.debounceRendering)&&((m=s.debounceRendering)||p)(I)}function I(){for(var e;I.__r=f.length;)e=f.sort((function(e,t){return e.__v.__b-t.__v.__b})),f=[],e.some((function(e){var t,n,r,o,i,c;e.__d&&(i=(o=(t=e).__v).__e,(c=t.__P)&&(n=[],(r=_({},o)).__v=o.__v+1,q(c,o,r,t.__n,void 0!==c.ownerSVGElement,null!=o.__h?[i]:null,n,null==i?E(o):i,o.__h),L(n,o),o.__e!=i&&j(o)))}))}function D(e,t,n,r,o,i,c,a,u,l){var s,f,p,m,d,y,_,b=r&&r.__k||h,g=b.length;for(n.__k=[],s=0;s<t.length;s++)if(null!=(m=n.__k[s]=null==(m=t[s])||"boolean"==typeof m?null:"string"==typeof m||"number"==typeof m?S(null,m,null,null,m):Array.isArray(m)?S(O,{children:m},null,null,null):m.__b>0?S(m.type,m.props,m.key,null,m.__v):m)){if(m.__=n,m.__b=n.__b+1,null===(p=b[s])||p&&m.key==p.key&&m.type===p.type)b[s]=void 0;else for(f=0;f<g;f++){if((p=b[f])&&m.key==p.key&&m.type===p.type){b[f]=void 0;break}p=null}q(e,m,p=p||v,o,i,c,a,u,l),d=m.__e,(f=m.ref)&&p.ref!=f&&(_||(_=[]),p.ref&&_.push(p.ref,null,m),_.push(f,m.__c||d,m)),null!=d?(null==y&&(y=d),"function"==typeof m.type&&null!=m.__k&&m.__k===p.__k?m.__d=u=k(m,u,e):u=A(e,m,p,b,d,u),l||"option"!==n.type?"function"==typeof n.type&&(n.__d=u):e.value=""):u&&p.__e==u&&u.parentNode!=e&&(u=E(p))}for(n.__e=y,s=g;s--;)null!=b[s]&&("function"==typeof n.type&&null!=b[s].__e&&b[s].__e==n.__d&&(n.__d=E(r,s+1)),U(b[s],b[s]));if(_)for(s=0;s<_.length;s++)H(_[s],_[++s],_[++s])}function k(e,t,n){var r,o;for(r=0;r<e.__k.length;r++)(o=e.__k[r])&&(o.__=e,t="function"==typeof o.type?k(o,t,n):A(n,o,o,e.__k,o.__e,t));return t}function C(e,t){return t=t||[],null==e||"boolean"==typeof e||(Array.isArray(e)?e.some((function(e){C(e,t)})):t.push(e)),t}function A(e,t,n,r,o,i){var c,a,u;if(void 0!==t.__d)c=t.__d,t.__d=void 0;else if(null==n||o!=i||null==o.parentNode)e:if(null==i||i.parentNode!==e)e.appendChild(o),c=null;else{for(a=i,u=0;(a=a.nextSibling)&&u<r.length;u+=2)if(a==o)break e;e.insertBefore(o,i),c=i}return void 0!==c?c:o.nextSibling}function x(e,t,n){"-"===t[0]?e.setProperty(t,n):e[t]=null==n?"":"number"!=typeof n||y.test(t)?n:n+"px"}function N(e,t,n,r,o){var i;e:if("style"===t)if("string"==typeof n)e.style.cssText=n;else{if("string"==typeof r&&(e.style.cssText=r=""),r)for(t in r)n&&t in n||x(e.style,t,"");if(n)for(t in n)r&&n[t]===r[t]||x(e.style,t,n[t])}else if("o"===t[0]&&"n"===t[1])i=t!==(t=t.replace(/Capture$/,"")),t=t.toLowerCase()in e?t.toLowerCase().slice(2):t.slice(2),e.l||(e.l={}),e.l[t+i]=n,n?r||e.addEventListener(t,i?R:T,i):e.removeEventListener(t,i?R:T,i);else if("dangerouslySetInnerHTML"!==t){if(o)t=t.replace(/xlink[H:h]/,"h").replace(/sName$/,"s");else if("href"!==t&&"list"!==t&&"form"!==t&&"download"!==t&&t in e)try{e[t]=null==n?"":n;break e}catch(e){}"function"==typeof n||(null!=n&&(!1!==n||"a"===t[0]&&"r"===t[1])?e.setAttribute(t,n):e.removeAttribute(t))}}function T(e){this.l[e.type+!1](s.event?s.event(e):e)}function R(e){this.l[e.type+!0](s.event?s.event(e):e)}function q(e,t,n,r,o,i,c,a,u){var l,f,p,m,d,v,h,y,b,g,S,E=t.type;if(void 0!==t.constructor)return null;null!=n.__h&&(u=n.__h,a=t.__e=n.__e,t.__h=null,i=[a]),(l=s.__b)&&l(t);try{e:if("function"==typeof E){if(y=t.props,b=(l=E.contextType)&&r[l.__c],g=l?b?b.props.value:l.__:r,n.__c?h=(f=t.__c=n.__c).__=f.__E:("prototype"in E&&E.prototype.render?t.__c=f=new E(y,g):(t.__c=f=new w(y,g),f.constructor=E,f.render=F),b&&b.sub(f),f.props=y,f.state||(f.state={}),f.context=g,f.__n=r,p=f.__d=!0,f.__h=[]),null==f.__s&&(f.__s=f.state),null!=E.getDerivedStateFromProps&&(f.__s==f.state&&(f.__s=_({},f.__s)),_(f.__s,E.getDerivedStateFromProps(y,f.__s))),m=f.props,d=f.state,p)null==E.getDerivedStateFromProps&&null!=f.componentWillMount&&f.componentWillMount(),null!=f.componentDidMount&&f.__h.push(f.componentDidMount);else{if(null==E.getDerivedStateFromProps&&y!==m&&null!=f.componentWillReceiveProps&&f.componentWillReceiveProps(y,g),!f.__e&&null!=f.shouldComponentUpdate&&!1===f.shouldComponentUpdate(y,f.__s,g)||t.__v===n.__v){f.props=y,f.state=f.__s,t.__v!==n.__v&&(f.__d=!1),f.__v=t,t.__e=n.__e,t.__k=n.__k,f.__h.length&&c.push(f);break e}null!=f.componentWillUpdate&&f.componentWillUpdate(y,f.__s,g),null!=f.componentDidUpdate&&f.__h.push((function(){f.componentDidUpdate(m,d,v)}))}f.context=g,f.props=y,f.state=f.__s,(l=s.__r)&&l(t),f.__d=!1,f.__v=t,f.__P=e,l=f.render(f.props,f.state,f.context),f.state=f.__s,null!=f.getChildContext&&(r=_(_({},r),f.getChildContext())),p||null==f.getSnapshotBeforeUpdate||(v=f.getSnapshotBeforeUpdate(m,d)),S=null!=l&&l.type===O&&null==l.key?l.props.children:l,D(e,Array.isArray(S)?S:[S],t,n,r,o,i,c,a,u),f.base=t.__e,t.__h=null,f.__h.length&&c.push(f),h&&(f.__E=f.__=null),f.__e=!1}else null==i&&t.__v===n.__v?(t.__k=n.__k,t.__e=n.__e):t.__e=M(n.__e,t,n,r,o,i,c,u);(l=s.diffed)&&l(t)}catch(e){t.__v=null,(u||null!=i)&&(t.__e=a,t.__h=!!u,i[i.indexOf(a)]=null),s.__e(e,t,n)}}function L(e,t){s.__c&&s.__c(t,e),e.some((function(t){try{e=t.__h,t.__h=[],e.some((function(e){e.call(t)}))}catch(e){s.__e(e,t.__v)}}))}function M(e,t,n,r,o,i,c,a){var u,l,s,f,p=n.props,m=t.props,d=t.type,y=0;if("svg"===d&&(o=!0),null!=i)for(;y<i.length;y++)if((u=i[y])&&(u===e||(d?u.localName==d:3==u.nodeType))){e=u,i[y]=null;break}if(null==e){if(null===d)return document.createTextNode(m);e=o?document.createElementNS("http://www.w3.org/2000/svg",d):document.createElement(d,m.is&&m),i=null,a=!1}if(null===d)p===m||a&&e.data===m||(e.data=m);else{if(i=i&&h.slice.call(e.childNodes),l=(p=n.props||v).dangerouslySetInnerHTML,s=m.dangerouslySetInnerHTML,!a){if(null!=i)for(p={},f=0;f<e.attributes.length;f++)p[e.attributes[f].name]=e.attributes[f].value;(s||l)&&(s&&(l&&s.__html==l.__html||s.__html===e.innerHTML)||(e.innerHTML=s&&s.__html||""))}if(function(e,t,n,r,o){var i;for(i in n)"children"===i||"key"===i||i in t||N(e,i,null,n[i],r);for(i in t)o&&"function"!=typeof t[i]||"children"===i||"key"===i||"value"===i||"checked"===i||n[i]===t[i]||N(e,i,t[i],n[i],r)}(e,m,p,o,a),s)t.__k=[];else if(y=t.props.children,D(e,Array.isArray(y)?y:[y],t,n,r,o&&"foreignObject"!==d,i,c,e.firstChild,a),null!=i)for(y=i.length;y--;)null!=i[y]&&b(i[y]);a||("value"in m&&void 0!==(y=m.value)&&(y!==e.value||"progress"===d&&!y)&&N(e,"value",y,p.value,!1),"checked"in m&&void 0!==(y=m.checked)&&y!==e.checked&&N(e,"checked",y,p.checked,!1))}return e}function H(e,t,n){try{"function"==typeof e?e(t):e.current=t}catch(e){s.__e(e,n)}}function U(e,t,n){var r,o,i;if(s.unmount&&s.unmount(e),(r=e.ref)&&(r.current&&r.current!==e.__e||H(r,null,t)),n||"function"==typeof e.type||(n=null!=(o=e.__e)),e.__e=e.__d=void 0,null!=(r=e.__c)){if(r.componentWillUnmount)try{r.componentWillUnmount()}catch(e){s.__e(e,t)}r.base=r.__P=null}if(r=e.__k)for(i=0;i<r.length;i++)r[i]&&U(r[i],t,n);null!=o&&b(o)}function F(e,t,n){return this.constructor(e,n)}function B(e,t,n){var r,o,i;s.__&&s.__(e,t),o=(r="function"==typeof n)?null:n&&n.__k||t.__k,i=[],q(t,e=(!r&&n||t).__k=g(O,null,[e]),o||v,v,void 0!==t.ownerSVGElement,!r&&n?[n]:o?null:t.firstChild?h.slice.call(t.childNodes):null,i,!r&&n?n:o?o.__e:t.firstChild,r),L(i,e)}function V(e,t){B(e,t,V)}function K(e,t,n){var r,o,i,c=arguments,a=_({},e.props);for(i in t)"key"==i?r=t[i]:"ref"==i?o=t[i]:a[i]=t[i];if(arguments.length>3)for(n=[n],i=3;i<arguments.length;i++)n.push(c[i]);return null!=n&&(a.children=n),S(e.type,a,r||e.key,o||e.ref,null)}s={__e:function(e,t){for(var n,r,o;t=t.__;)if((n=t.__c)&&!n.__)try{if((r=n.constructor)&&null!=r.getDerivedStateFromError&&(n.setState(r.getDerivedStateFromError(e)),o=n.__d),null!=n.componentDidCatch&&(n.componentDidCatch(e),o=n.__d),o)return n.__E=n}catch(t){e=t}throw e},__v:0},w.prototype.setState=function(e,t){var n;n=null!=this.__s&&this.__s!==this.state?this.__s:this.__s=_({},this.state),"function"==typeof e&&(e=e(_({},n),this.props)),e&&_(n,e),null!=e&&this.__v&&(t&&this.__h.push(t),P(this))},w.prototype.forceUpdate=function(e){this.__v&&(this.__e=!0,e&&this.__h.push(e),P(this))},w.prototype.render=O,f=[],p="function"==typeof Promise?Promise.prototype.then.bind(Promise.resolve()):setTimeout,I.__r=0,d=0;var W,z,J,$=0,Z=[],Q=s.__b,Y=s.__r,G=s.diffed,X=s.__c,ee=s.unmount;function te(e,t){s.__h&&s.__h(z,e,$||t),$=0;var n=z.__H||(z.__H={__:[],__h:[]});return e>=n.__.length&&n.__.push({}),n.__[e]}function ne(e){return $=1,re(pe,e)}function re(e,t,n){var r=te(W++,2);return r.t=e,r.__c||(r.__=[n?n(t):pe(void 0,t),function(e){var t=r.t(r.__[0],e);r.__[0]!==t&&(r.__=[t,r.__[1]],r.__c.setState({}))}],r.__c=z),r.__}function oe(e,t){var n=te(W++,3);!s.__s&&fe(n.__H,t)&&(n.__=e,n.__H=t,z.__H.__h.push(n))}function ie(e,t){var n=te(W++,4);!s.__s&&fe(n.__H,t)&&(n.__=e,n.__H=t,z.__h.push(n))}function ce(e,t){var n=te(W++,7);return fe(n.__H,t)&&(n.__=e(),n.__H=t,n.__h=e),n.__}function ae(){Z.forEach((function(e){if(e.__P)try{e.__H.__h.forEach(le),e.__H.__h.forEach(se),e.__H.__h=[]}catch(t){e.__H.__h=[],s.__e(t,e.__v)}})),Z=[]}s.__b=function(e){z=null,Q&&Q(e)},s.__r=function(e){Y&&Y(e),W=0;var t=(z=e.__c).__H;t&&(t.__h.forEach(le),t.__h.forEach(se),t.__h=[])},s.diffed=function(e){G&&G(e);var t=e.__c;t&&t.__H&&t.__H.__h.length&&(1!==Z.push(t)&&J===s.requestAnimationFrame||((J=s.requestAnimationFrame)||function(e){var t,n=function(){clearTimeout(r),ue&&cancelAnimationFrame(t),setTimeout(e)},r=setTimeout(n,100);ue&&(t=requestAnimationFrame(n))})(ae)),z=void 0},s.__c=function(e,t){t.some((function(e){try{e.__h.forEach(le),e.__h=e.__h.filter((function(e){return!e.__||se(e)}))}catch(n){t.some((function(e){e.__h&&(e.__h=[])})),t=[],s.__e(n,e.__v)}})),X&&X(e,t)},s.unmount=function(e){ee&&ee(e);var t=e.__c;if(t&&t.__H)try{t.__H.__.forEach(le)}catch(e){s.__e(e,t.__v)}};var ue="function"==typeof requestAnimationFrame;function le(e){var t=z;"function"==typeof e.__c&&e.__c(),z=t}function se(e){var t=z;e.__c=e.__(),z=t}function fe(e,t){return!e||e.length!==t.length||t.some((function(t,n){return t!==e[n]}))}function pe(e,t){return"function"==typeof t?t(e):t}function me(e,t){for(var n in t)e[n]=t[n];return e}function de(e,t){for(var n in e)if("__source"!==n&&!(n in t))return!0;for(var r in t)if("__source"!==r&&e[r]!==t[r])return!0;return!1}function ve(e){this.props=e}(ve.prototype=new w).isPureReactComponent=!0,ve.prototype.shouldComponentUpdate=function(e,t){return de(this.props,e)||de(this.state,t)};var he=s.__b;s.__b=function(e){e.type&&e.type.__f&&e.ref&&(e.props.ref=e.ref,e.ref=null),he&&he(e)};var ye="undefined"!=typeof Symbol&&Symbol.for&&Symbol.for("react.forward_ref")||3911;var _e=function(e,t){return null==e?null:C(C(e).map(t))},be={map:_e,forEach:_e,count:function(e){return e?C(e).length:0},only:function(e){var t=C(e);if(1!==t.length)throw"Children.only";return t[0]},toArray:C},ge=s.__e;function Se(){this.__u=0,this.t=null,this.__b=null}function Oe(e){var t=e.__.__c;return t&&t.__e&&t.__e(e)}function we(){this.u=null,this.o=null}s.__e=function(e,t,n){if(e.then)for(var r,o=t;o=o.__;)if((r=o.__c)&&r.__c)return null==t.__e&&(t.__e=n.__e,t.__k=n.__k),r.__c(e,t);ge(e,t,n)},(Se.prototype=new w).__c=function(e,t){var n=t.__c,r=this;null==r.t&&(r.t=[]),r.t.push(n);var o=Oe(r.__v),i=!1,c=function(){i||(i=!0,n.componentWillUnmount=n.__c,o?o(a):a())};n.__c=n.componentWillUnmount,n.componentWillUnmount=function(){c(),n.__c&&n.__c()};var a=function(){if(!--r.__u){if(r.state.__e){var e=r.state.__e;r.__v.__k[0]=function e(t,n,r){return t&&(t.__v=null,t.__k=t.__k&&t.__k.map((function(t){return e(t,n,r)})),t.__c&&t.__c.__P===n&&(t.__e&&r.insertBefore(t.__e,t.__d),t.__c.__e=!0,t.__c.__P=r)),t}(e,e.__c.__P,e.__c.__O)}var t;for(r.setState({__e:r.__b=null});t=r.t.pop();)t.forceUpdate()}},u=!0===t.__h;r.__u++||u||r.setState({__e:r.__b=r.__v.__k[0]}),e.then(c,c)},Se.prototype.componentWillUnmount=function(){this.t=[]},Se.prototype.render=function(e,t){if(this.__b){if(this.__v.__k){var n=document.createElement("div"),r=this.__v.__k[0].__c;this.__v.__k[0]=function e(t,n,r){return t&&(t.__c&&t.__c.__H&&(t.__c.__H.__.forEach((function(e){"function"==typeof e.__c&&e.__c()})),t.__c.__H=null),null!=(t=me({},t)).__c&&(t.__c.__P===r&&(t.__c.__P=n),t.__c=null),t.__k=t.__k&&t.__k.map((function(t){return e(t,n,r)}))),t}(this.__b,n,r.__O=r.__P)}this.__b=null}var o=t.__e&&g(O,null,e.fallback);return o&&(o.__h=null),[g(O,null,t.__e?null:e.children),o]};var Ee=function(e,t,n){if(++n[1]===n[0]&&e.o.delete(t),e.props.revealOrder&&("t"!==e.props.revealOrder[0]||!e.o.size))for(n=e.u;n;){for(;n.length>3;)n.pop()();if(n[1]<n[0])break;e.u=n=n[2]}};function je(e){return this.getChildContext=function(){return e.context},e.children}function Pe(e){var t=this,n=e.i;t.componentWillUnmount=function(){B(null,t.l),t.l=null,t.i=null},t.i&&t.i!==n&&t.componentWillUnmount(),e.__v?(t.l||(t.i=n,t.l={nodeType:1,parentNode:n,childNodes:[],appendChild:function(e){this.childNodes.push(e),t.i.appendChild(e)},insertBefore:function(e,n){this.childNodes.push(e),t.i.appendChild(e)},removeChild:function(e){this.childNodes.splice(this.childNodes.indexOf(e)>>>1,1),t.i.removeChild(e)}}),B(g(je,{context:t.context},e.__v),t.l)):t.l&&t.componentWillUnmount()}function Ie(e,t){return g(Pe,{__v:e,i:t})}(we.prototype=new w).__e=function(e){var t=this,n=Oe(t.__v),r=t.o.get(e);return r[0]++,function(o){var i=function(){t.props.revealOrder?(r.push(o),Ee(t,e,r)):o()};n?n(i):i()}},we.prototype.render=function(e){this.u=null,this.o=new Map;var t=C(e.children);e.revealOrder&&"b"===e.revealOrder[0]&&t.reverse();for(var n=t.length;n--;)this.o.set(t[n],this.u=[1,0,this.u]);return e.children},we.prototype.componentDidUpdate=we.prototype.componentDidMount=function(){var e=this;this.o.forEach((function(t,n){Ee(e,n,t)}))};var De="undefined"!=typeof Symbol&&Symbol.for&&Symbol.for("react.element")||60103,ke=/^(?:accent|alignment|arabic|baseline|cap|clip(?!PathU)|color|fill|flood|font|glyph(?!R)|horiz|marker(?!H|W|U)|overline|paint|stop|strikethrough|stroke|text(?!L)|underline|unicode|units|v|vector|vert|word|writing|x(?!C))[A-Z]/,Ce=function(e){return("undefined"!=typeof Symbol&&"symbol"==n(Symbol())?/fil|che|rad/i:/fil|che|ra/i).test(e)};function Ae(e,t,n){return null==t.__k&&(t.textContent=""),B(e,t),"function"==typeof n&&n(),e?e.__c:null}w.prototype.isReactComponent={},["componentWillMount","componentWillReceiveProps","componentWillUpdate"].forEach((function(e){Object.defineProperty(w.prototype,e,{configurable:!0,get:function(){return this["UNSAFE_"+e]},set:function(t){Object.defineProperty(this,e,{configurable:!0,writable:!0,value:t})}})}));var xe=s.event;function Ne(){}function Te(){return this.cancelBubble}function Re(){return this.defaultPrevented}s.event=function(e){return xe&&(e=xe(e)),e.persist=Ne,e.isPropagationStopped=Te,e.isDefaultPrevented=Re,e.nativeEvent=e};var qe,Le={configurable:!0,get:function(){return this.class}},Me=s.vnode;s.vnode=function(e){var t=e.type,n=e.props,r=n;if("string"==typeof t){for(var o in r={},n){var i=n[o];"value"===o&&"defaultValue"in n&&null==i||("defaultValue"===o&&"value"in n&&null==n.value?o="value":"download"===o&&!0===i?i="":/ondoubleclick/i.test(o)?o="ondblclick":/^onchange(textarea|input)/i.test(o+t)&&!Ce(n.type)?o="oninput":/^on(Ani|Tra|Tou|BeforeInp)/.test(o)?o=o.toLowerCase():ke.test(o)?o=o.replace(/[A-Z0-9]/,"-$&").toLowerCase():null===i&&(i=void 0),r[o]=i)}"select"==t&&r.multiple&&Array.isArray(r.value)&&(r.value=C(n.children).forEach((function(e){e.props.selected=-1!=r.value.indexOf(e.props.value)}))),"select"==t&&null!=r.defaultValue&&(r.value=C(n.children).forEach((function(e){e.props.selected=r.multiple?-1!=r.defaultValue.indexOf(e.props.value):r.defaultValue==e.props.value}))),e.props=r}t&&n.class!=n.className&&(Le.enumerable="className"in n,null!=n.className&&(r.class=n.className),Object.defineProperty(r,"className",Le)),e.$$typeof=De,Me&&Me(e)};var He=s.__r;s.__r=function(e){He&&He(e),qe=e.__c};var Ue={ReactCurrentDispatcher:{current:{readContext:function(e){return qe.__n[e.__c].props.value}}}};"object"==("undefined"==typeof performance?"undefined":n(performance))&&"function"==typeof performance.now&&performance.now.bind(performance);function Fe(e){return!!e&&e.$$typeof===De}var Be={useState:ne,useReducer:re,useEffect:oe,useLayoutEffect:ie,useRef:function(e){return $=5,ce((function(){return{current:e}}),[])},useImperativeHandle:function(e,t,n){$=6,ie((function(){"function"==typeof e?e(t()):e&&(e.current=t())}),null==n?n:n.concat(e))},useMemo:ce,useCallback:function(e,t){return $=8,ce((function(){return e}),t)},useContext:function(e){var t=z.context[e.__c],n=te(W++,9);return n.__c=e,t?(null==n.__&&(n.__=!0,t.sub(z)),t.props.value):e.__},useDebugValue:function(e,t){s.useDebugValue&&s.useDebugValue(t?t(e):e)},version:"16.8.0",Children:be,render:Ae,hydrate:function(e,t,n){return V(e,t),"function"==typeof n&&n(),e?e.__c:null},unmountComponentAtNode:function(e){return!!e.__k&&(B(null,e),!0)},createPortal:Ie,createElement:g,createContext:function(e,t){var n={__c:t="__cC"+d++,__:e,Consumer:function(e,t){return e.children(t)},Provider:function(e){var n,r;return this.getChildContext||(n=[],(r={})[t]=this,this.getChildContext=function(){return r},this.shouldComponentUpdate=function(e){this.props.value!==e.value&&n.some(P)},this.sub=function(e){n.push(e);var t=e.componentWillUnmount;e.componentWillUnmount=function(){n.splice(n.indexOf(e),1),t&&t.call(e)}}),e.children}};return n.Provider.__=n.Consumer.contextType=n},createFactory:function(e){return g.bind(null,e)},cloneElement:function(e){return Fe(e)?K.apply(null,arguments):e},createRef:function(){return{current:null}},Fragment:O,isValidElement:Fe,findDOMNode:function(e){return e&&(e.base||1===e.nodeType&&e)||null},Component:w,PureComponent:ve,memo:function(e,t){function n(e){var n=this.props.ref,r=n==e.ref;return!r&&n&&(n.call?n(null):n.current=null),t?!t(this.props,e)||!r:de(this.props,e)}function r(t){return this.shouldComponentUpdate=n,g(e,t)}return r.displayName="Memo("+(e.displayName||e.name)+")",r.prototype.isReactComponent=!0,r.__f=!0,r},forwardRef:function(e){function t(t,r){var o=me({},t);return delete o.ref,e(o,(r=t.ref||r)&&("object"!=n(r)||"current"in r)?r:null)}return t.$$typeof=ye,t.render=t,t.prototype.isReactComponent=t.__f=!0,t.displayName="ForwardRef("+(e.displayName||e.name)+")",t},unstable_batchedUpdates:function(e,t){return e(t)},StrictMode:O,Suspense:Se,SuspenseList:we,lazy:function(e){var t,n,r;function o(o){if(t||(t=e()).then((function(e){n=e.default||e}),(function(e){r=e})),r)throw r;if(!n)throw t;return g(n,o)}return o.displayName="Lazy",o.__f=!0,o},__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED:Ue},Ve=["facetName","facetQuery"];function Ke(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function We(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Ke(Object(n),!0).forEach((function(t){ze(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Ke(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function ze(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Je(){return Je=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},Je.apply(this,arguments)}function $e(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function Ze(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=n){var r,o,i=[],c=!0,a=!1;try{for(n=n.call(e);!(c=(r=n.next()).done)&&(i.push(r.value),!t||i.length!==t);c=!0);}catch(e){a=!0,o=e}finally{try{c||null==n.return||n.return()}finally{if(a)throw o}}return i}}(e,t)||Qe(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function Qe(e,t){if(e){if("string"==typeof e)return Ye(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?Ye(e,t):void 0}}function Ye(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function Ge(){return Be.createElement("svg",{width:"15",height:"15",className:"DocSearch-Control-Key-Icon"},Be.createElement("path",{d:"M4.505 4.496h2M5.505 5.496v5M8.216 4.496l.055 5.993M10 7.5c.333.333.5.667.5 1v2M12.326 4.5v5.996M8.384 4.496c1.674 0 2.116 0 2.116 1.5s-.442 1.5-2.116 1.5M3.205 9.303c-.09.448-.277 1.21-1.241 1.203C1 10.5.5 9.513.5 8V7c0-1.57.5-2.5 1.464-2.494.964.006 1.134.598 1.24 1.342M12.553 10.5h1.953",strokeWidth:"1.2",stroke:"currentColor",fill:"none",strokeLinecap:"square"}))}function Xe(){return Be.createElement("svg",{width:"20",height:"20",className:"DocSearch-Search-Icon",viewBox:"0 0 20 20","aria-hidden":"true"},Be.createElement("path",{d:"M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"}))}var et=["translations"],tt=Be.forwardRef((function(e,t){var n=e.translations,r=void 0===n?{}:n,o=$e(e,et),i=r.buttonText,c=void 0===i?"Search":i,a=r.buttonAriaLabel,u=void 0===a?"Search":a,l=Ze(ne(null),2),s=l[0],f=l[1];return oe((function(){"undefined"!=typeof navigator&&(/(Mac|iPhone|iPod|iPad)/i.test(navigator.platform)?f("⌘"):f("Ctrl"))}),[]),Be.createElement("button",Je({type:"button",className:"DocSearch DocSearch-Button","aria-label":u},o,{ref:t}),Be.createElement("span",{className:"DocSearch-Button-Container"},Be.createElement(Xe,null),Be.createElement("span",{className:"DocSearch-Button-Placeholder"},c)),Be.createElement("span",{className:"DocSearch-Button-Keys"},null!==s&&Be.createElement(Be.Fragment,null,Be.createElement(nt,{reactsToKey:"Ctrl"===s?"Ctrl":"Meta"},"Ctrl"===s?Be.createElement(Ge,null):s),Be.createElement(nt,{reactsToKey:"k"},"K"))))}));function nt(e){var t=e.reactsToKey,n=e.children,r=Ze(ne(!1),2),o=r[0],i=r[1];return oe((function(){if(t)return window.addEventListener("keydown",e),window.addEventListener("keyup",n),function(){window.removeEventListener("keydown",e),window.removeEventListener("keyup",n)};function e(e){e.key===t&&i(!0)}function n(e){e.key!==t&&"Meta"!==e.key||i(!1)}}),[t]),Be.createElement("kbd",{className:o?"DocSearch-Button-Key DocSearch-Button-Key--pressed":"DocSearch-Button-Key"},n)}function rt(e,t){var n=void 0;return function(){for(var r=arguments.length,o=new Array(r),i=0;i<r;i++)o[i]=arguments[i];n&&clearTimeout(n),n=setTimeout((function(){return e.apply(void 0,o)}),t)}}function ot(e){return e.reduce((function(e,t){return e.concat(t)}),[])}var it=0;function ct(e){return 0===e.collections.length?0:e.collections.reduce((function(e,t){return e+t.items.length}),0)}function at(e){return e!==Object(e)}function ut(e,t){if(e===t)return!0;if(at(e)||at(t)||"function"==typeof e||"function"==typeof t)return e===t;if(Object.keys(e).length!==Object.keys(t).length)return!1;for(var n=0,r=Object.keys(e);n<r.length;n++){var o=r[n];if(!(o in t))return!1;if(!ut(e[o],t[o]))return!1}return!0}var lt=function(){},st=[{segment:"autocomplete-core",version:"1.9.3"}];function ft(e){var t=e.item,n=e.items;return{index:t.__autocomplete_indexName,items:[t],positions:[1+n.findIndex((function(e){return e.objectID===t.objectID}))],queryID:t.__autocomplete_queryID,algoliaSource:["autocomplete"]}}function pt(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}var mt=["items"],dt=["items"];function vt(e){return vt="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},vt(e)}function ht(e){return function(e){if(Array.isArray(e))return yt(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(e){if("string"==typeof e)return yt(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?yt(e,t):void 0}}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function yt(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function _t(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function bt(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function gt(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?bt(Object(n),!0).forEach((function(t){St(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):bt(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function St(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==vt(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==vt(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===vt(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Ot(e){for(var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:20,n=[],r=0;r<e.objectIDs.length;r+=t)n.push(gt(gt({},e),{},{objectIDs:e.objectIDs.slice(r,r+t)}));return n}function wt(e){return e.map((function(e){var t=e.items,n=_t(e,mt);return gt(gt({},n),{},{objectIDs:(null==t?void 0:t.map((function(e){return e.objectID})))||n.objectIDs})}))}function Et(e){var t,n,r,o=(t=function(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=n){var r,o,i,c,a=[],u=!0,l=!1;try{if(i=(n=n.call(e)).next,0===t){if(Object(n)!==n)return;u=!1}else for(;!(u=(r=i.call(n)).done)&&(a.push(r.value),a.length!==t);u=!0);}catch(e){l=!0,o=e}finally{try{if(!u&&null!=n.return&&(c=n.return(),Object(c)!==c))return}finally{if(l)throw o}}return a}}(e,t)||function(e,t){if(e){if("string"==typeof e)return pt(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?pt(e,t):void 0}}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}((e.version||"").split(".").map(Number),2),n=t[0],r=t[1],n>=3||2===n&&r>=4||1===n&&r>=10);function i(t,n,r){if(o&&void 0!==r){var i=r[0].__autocomplete_algoliaCredentials,c={"X-Algolia-Application-Id":i.appId,"X-Algolia-API-Key":i.apiKey};e.apply(void 0,[t].concat(ht(n),[{headers:c}]))}else e.apply(void 0,[t].concat(ht(n)))}return{init:function(t,n){e("init",{appId:t,apiKey:n})},setUserToken:function(t){e("setUserToken",t)},clickedObjectIDsAfterSearch:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&i("clickedObjectIDsAfterSearch",wt(t),t[0].items)},clickedObjectIDs:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&i("clickedObjectIDs",wt(t),t[0].items)},clickedFilters:function(){for(var t=arguments.length,n=new Array(t),r=0;r<t;r++)n[r]=arguments[r];n.length>0&&e.apply(void 0,["clickedFilters"].concat(n))},convertedObjectIDsAfterSearch:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&i("convertedObjectIDsAfterSearch",wt(t),t[0].items)},convertedObjectIDs:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&i("convertedObjectIDs",wt(t),t[0].items)},convertedFilters:function(){for(var t=arguments.length,n=new Array(t),r=0;r<t;r++)n[r]=arguments[r];n.length>0&&e.apply(void 0,["convertedFilters"].concat(n))},viewedObjectIDs:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&t.reduce((function(e,t){var n=t.items,r=_t(t,dt);return[].concat(ht(e),ht(Ot(gt(gt({},r),{},{objectIDs:(null==n?void 0:n.map((function(e){return e.objectID})))||r.objectIDs})).map((function(e){return{items:n,payload:e}}))))}),[]).forEach((function(e){var t=e.items;return i("viewedObjectIDs",[e.payload],t)}))},viewedFilters:function(){for(var t=arguments.length,n=new Array(t),r=0;r<t;r++)n[r]=arguments[r];n.length>0&&e.apply(void 0,["viewedFilters"].concat(n))}}}function jt(e){var t=e.items.reduce((function(e,t){var n;return e[t.__autocomplete_indexName]=(null!==(n=e[t.__autocomplete_indexName])&&void 0!==n?n:[]).concat(t),e}),{});return Object.keys(t).map((function(e){return{index:e,items:t[e],algoliaSource:["autocomplete"]}}))}function Pt(e){return e.objectID&&e.__autocomplete_indexName&&e.__autocomplete_queryID}function It(e){return It="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},It(e)}function Dt(e){return function(e){if(Array.isArray(e))return kt(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(e){if("string"==typeof e)return kt(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?kt(e,t):void 0}}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function kt(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function Ct(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function At(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Ct(Object(n),!0).forEach((function(t){xt(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Ct(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function xt(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==It(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==It(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===It(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var Nt="https://cdn.jsdelivr.net/npm/search-insights@".concat("2.6.0","/dist/search-insights.min.js"),Tt=rt((function(e){var t=e.onItemsChange,n=e.items,r=e.insights,o=e.state;t({insights:r,insightsEvents:jt({items:n}).map((function(e){return At({eventName:"Items Viewed"},e)})),state:o})}),400);function Rt(e){var t=function(e){return At({onItemsChange:function(e){var t=e.insights,n=e.insightsEvents;t.viewedObjectIDs.apply(t,Dt(n.map((function(e){return At(At({},e),{},{algoliaSource:[].concat(Dt(e.algoliaSource||[]),["autocomplete-internal"])})}))))},onSelect:function(e){var t=e.insights,n=e.insightsEvents;t.clickedObjectIDsAfterSearch.apply(t,Dt(n.map((function(e){return At(At({},e),{},{algoliaSource:[].concat(Dt(e.algoliaSource||[]),["autocomplete-internal"])})}))))},onActive:lt},e)}(e),n=t.insightsClient,r=t.onItemsChange,o=t.onSelect,i=t.onActive,c=n;n||"undefined"!=typeof window&&function(e){var t=e.window,n=t.AlgoliaAnalyticsObject||"aa";"string"==typeof n&&(c=t[n]),c||(t.AlgoliaAnalyticsObject=n,t[n]||(t[n]=function(){t[n].queue||(t[n].queue=[]);for(var e=arguments.length,r=new Array(e),o=0;o<e;o++)r[o]=arguments[o];t[n].queue.push(r)}),t[n].version="2.6.0",c=t[n],function(e){var t="[Autocomplete]: Could not load search-insights.js. Please load it manually following https://alg.li/insights-autocomplete";try{var n=e.document.createElement("script");n.async=!0,n.src=Nt,n.onerror=function(){console.error(t)},document.body.appendChild(n)}catch(e){console.error(t)}}(t))}({window:window});var a=Et(c),u={current:[]},l=rt((function(e){var t=e.state;if(t.isOpen){var n=t.collections.reduce((function(e,t){return[].concat(Dt(e),Dt(t.items))}),[]).filter(Pt);ut(u.current.map((function(e){return e.objectID})),n.map((function(e){return e.objectID})))||(u.current=n,n.length>0&&Tt({onItemsChange:r,items:n,insights:a,state:t}))}}),0);return{name:"aa.algoliaInsightsPlugin",subscribe:function(e){var t=e.setContext,n=e.onSelect,r=e.onActive;c("addAlgoliaAgent","insights-plugin"),t({algoliaInsightsPlugin:{__algoliaSearchParameters:{clickAnalytics:!0},insights:a}}),n((function(e){var t=e.item,n=e.state,r=e.event;Pt(t)&&o({state:n,event:r,insights:a,item:t,insightsEvents:[At({eventName:"Item Selected"},ft({item:t,items:u.current}))]})})),r((function(e){var t=e.item,n=e.state,r=e.event;Pt(t)&&i({state:n,event:r,insights:a,item:t,insightsEvents:[At({eventName:"Item Active"},ft({item:t,items:u.current}))]})}))},onStateChange:function(e){var t=e.state;l({state:t})},__autocomplete_pluginOptions:e}}function qt(e,t){var n=t;return{then:function(t,r){return qt(e.then(Mt(t,n,e),Mt(r,n,e)),n)},catch:function(t){return qt(e.catch(Mt(t,n,e)),n)},finally:function(t){return t&&n.onCancelList.push(t),qt(e.finally(Mt(t&&function(){return n.onCancelList=[],t()},n,e)),n)},cancel:function(){n.isCanceled=!0;var e=n.onCancelList;n.onCancelList=[],e.forEach((function(e){e()}))},isCanceled:function(){return!0===n.isCanceled}}}function Lt(e){return qt(e,{isCanceled:!1,onCancelList:[]})}function Mt(e,t,n){return e?function(n){return t.isCanceled?n:e(n)}:n}function Ht(e,t,n,r){if(!n)return null;if(e<0&&(null===t||null!==r&&0===t))return n+e;var o=(null===t?-1:t)+e;return o<=-1||o>=n?null===r?null:0:o}function Ut(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Ft(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Ut(Object(n),!0).forEach((function(t){Bt(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Ut(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Bt(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Vt(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==Vt(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===Vt(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Vt(e){return Vt="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},Vt(e)}function Kt(e){var t=function(e){var t=e.collections.map((function(e){return e.items.length})).reduce((function(e,t,n){var r=(e[n-1]||0)+t;return e.push(r),e}),[]).reduce((function(t,n){return n<=e.activeItemId?t+1:t}),0);return e.collections[t]}(e);if(!t)return null;var n=t.items[function(e){for(var t=e.state,n=e.collection,r=!1,o=0,i=0;!1===r;){var c=t.collections[o];if(c===n){r=!0;break}i+=c.items.length,o++}return t.activeItemId-i}({state:e,collection:t})],r=t.source;return{item:n,itemInputValue:r.getItemInputValue({item:n,state:e}),itemUrl:r.getItemUrl({item:n,state:e}),source:r}}var Wt=/((gt|sm)-|galaxy nexus)|samsung[- ]|samsungbrowser/i;function zt(e){return zt="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},zt(e)}function Jt(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function $t(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==zt(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==zt(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===zt(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Zt(e){return Zt="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},Zt(e)}function Qt(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Yt(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Qt(Object(n),!0).forEach((function(t){Gt(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Qt(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Gt(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Zt(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==Zt(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===Zt(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Xt(e){return Xt="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},Xt(e)}function en(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function tn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function nn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?tn(Object(n),!0).forEach((function(t){rn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):tn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function rn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Xt(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==Xt(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===Xt(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function on(e,t){var n,r="undefined"!=typeof window?window:{},o=e.plugins||[];return nn(nn({debug:!1,openOnFocus:!1,placeholder:"",autoFocus:!1,defaultActiveItemId:null,stallThreshold:300,insights:!1,environment:r,shouldPanelOpen:function(e){return ct(e.state)>0},reshape:function(e){return e.sources}},e),{},{id:null!==(n=e.id)&&void 0!==n?n:"autocomplete-".concat(it++),plugins:o,initialState:nn({activeItemId:null,query:"",completion:null,collections:[],isOpen:!1,status:"idle",context:{}},e.initialState),onStateChange:function(t){var n;null===(n=e.onStateChange)||void 0===n||n.call(e,t),o.forEach((function(e){var n;return null===(n=e.onStateChange)||void 0===n?void 0:n.call(e,t)}))},onSubmit:function(t){var n;null===(n=e.onSubmit)||void 0===n||n.call(e,t),o.forEach((function(e){var n;return null===(n=e.onSubmit)||void 0===n?void 0:n.call(e,t)}))},onReset:function(t){var n;null===(n=e.onReset)||void 0===n||n.call(e,t),o.forEach((function(e){var n;return null===(n=e.onReset)||void 0===n?void 0:n.call(e,t)}))},getSources:function(n){return Promise.all([].concat(function(e){return function(e){if(Array.isArray(e))return en(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(e){if("string"==typeof e)return en(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?en(e,t):void 0}}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}(o.map((function(e){return e.getSources}))),[e.getSources]).filter(Boolean).map((function(e){return function(e,t){var n=[];return Promise.resolve(e(t)).then((function(e){return Promise.all(e.filter((function(e){return Boolean(e)})).map((function(e){if(e.sourceId,n.includes(e.sourceId))throw new Error("[Autocomplete] The `sourceId` ".concat(JSON.stringify(e.sourceId)," is not unique."));n.push(e.sourceId);var t={getItemInputValue:function(e){return e.state.query},getItemUrl:function(){},onSelect:function(e){(0,e.setIsOpen)(!1)},onActive:lt,onResolve:lt};Object.keys(t).forEach((function(e){t[e].__default=!0}));var r=Ft(Ft({},t),e);return Promise.resolve(r)})))}))}(e,n)}))).then((function(e){return ot(e)})).then((function(e){return e.map((function(e){return nn(nn({},e),{},{onSelect:function(n){e.onSelect(n),t.forEach((function(e){var t;return null===(t=e.onSelect)||void 0===t?void 0:t.call(e,n)}))},onActive:function(n){e.onActive(n),t.forEach((function(e){var t;return null===(t=e.onActive)||void 0===t?void 0:t.call(e,n)}))},onResolve:function(n){e.onResolve(n),t.forEach((function(e){var t;return null===(t=e.onResolve)||void 0===t?void 0:t.call(e,n)}))}})}))}))},navigator:nn({navigate:function(e){var t=e.itemUrl;r.location.assign(t)},navigateNewTab:function(e){var t=e.itemUrl,n=r.open(t,"_blank","noopener");null==n||n.focus()},navigateNewWindow:function(e){var t=e.itemUrl;r.open(t,"_blank","noopener")}},e.navigator)})}function cn(e){return cn="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},cn(e)}function an(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function un(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?an(Object(n),!0).forEach((function(t){ln(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):an(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function ln(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==cn(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==cn(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===cn(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function sn(e){return sn="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},sn(e)}function fn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function pn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?fn(Object(n),!0).forEach((function(t){mn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):fn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function mn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==sn(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==sn(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===sn(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function dn(e){return function(e){if(Array.isArray(e))return vn(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(e){if("string"==typeof e)return vn(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?vn(e,t):void 0}}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function vn(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function hn(e){return Boolean(e.execute)}function yn(e){var t=e.reduce((function(e,t){if(!hn(t))return e.push(t),e;var n=t.searchClient,r=t.execute,o=t.requesterId,i=t.requests,c=e.find((function(e){return hn(t)&&hn(e)&&e.searchClient===n&&Boolean(o)&&e.requesterId===o}));if(c){var a;(a=c.items).push.apply(a,dn(i))}else{var u={execute:r,requesterId:o,items:i,searchClient:n};e.push(u)}return e}),[]).map((function(e){if(!hn(e))return Promise.resolve(e);var t=e,n=t.execute,r=t.items;return n({searchClient:t.searchClient,requests:r})}));return Promise.all(t).then((function(e){return ot(e)}))}function _n(e){return _n="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},_n(e)}var bn=["event","nextState","props","query","refresh","store"];function gn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Sn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?gn(Object(n),!0).forEach((function(t){On(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):gn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function On(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==_n(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==_n(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===_n(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var wn,En,jn,Pn=null,In=(wn=-1,En=-1,jn=void 0,function(e){var t=++wn;return Promise.resolve(e).then((function(e){return jn&&t<En?jn:(En=t,jn=e,e)}))});function Dn(e){var t=e.event,n=e.nextState,r=void 0===n?{}:n,o=e.props,i=e.query,c=e.refresh,a=e.store,u=function(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}(e,bn);Pn&&o.environment.clearTimeout(Pn);var l=u.setCollections,s=u.setIsOpen,f=u.setQuery,p=u.setActiveItemId,m=u.setStatus;if(f(i),p(o.defaultActiveItemId),!i&&!1===o.openOnFocus){var d,v=a.getState().collections.map((function(e){return Sn(Sn({},e),{},{items:[]})}));m("idle"),l(v),s(null!==(d=r.isOpen)&&void 0!==d?d:o.shouldPanelOpen({state:a.getState()}));var h=Lt(In(v).then((function(){return Promise.resolve()})));return a.pendingRequests.add(h)}m("loading"),Pn=o.environment.setTimeout((function(){m("stalled")}),o.stallThreshold);var y=Lt(In(o.getSources(Sn({query:i,refresh:c,state:a.getState()},u)).then((function(e){return Promise.all(e.map((function(e){return Promise.resolve(e.getItems(Sn({query:i,refresh:c,state:a.getState()},u))).then((function(t){return function(e,t,n){if(o=e,Boolean(null==o?void 0:o.execute)){var r="algolia"===e.requesterId?Object.assign.apply(Object,[{}].concat(dn(Object.keys(n.context).map((function(e){var t;return null===(t=n.context[e])||void 0===t?void 0:t.__algoliaSearchParameters}))))):{};return pn(pn({},e),{},{requests:e.queries.map((function(n){return{query:"algolia"===e.requesterId?pn(pn({},n),{},{params:pn(pn({},r),n.params)}):n,sourceId:t,transformResponse:e.transformResponse}}))})}var o;return{items:e,sourceId:t}}(t,e.sourceId,a.getState())}))}))).then(yn).then((function(t){return function(e,t,n){return t.map((function(t){var r,o=e.filter((function(e){return e.sourceId===t.sourceId})),i=o.map((function(e){return e.items})),c=o[0].transformResponse,a=c?c({results:r=i,hits:r.map((function(e){return e.hits})).filter(Boolean),facetHits:r.map((function(e){var t;return null===(t=e.facetHits)||void 0===t?void 0:t.map((function(e){return{label:e.value,count:e.count,_highlightResult:{label:{value:e.highlighted}}}}))})).filter(Boolean)}):i;return t.onResolve({source:t,results:i,items:a,state:n.getState()}),a.every(Boolean),'The `getItems` function from source "'.concat(t.sourceId,'" must return an array of items but returned ').concat(JSON.stringify(void 0),".\n\nDid you forget to return items?\n\nSee: https://www.algolia.com/doc/ui-libraries/autocomplete/core-concepts/sources/#param-getitems"),{source:t,items:a}}))}(t,e,a)})).then((function(e){return function(e){var t=e.props,n=e.state,r=e.collections.reduce((function(e,t){return un(un({},e),{},ln({},t.source.sourceId,un(un({},t.source),{},{getItems:function(){return ot(t.items)}})))}),{}),o=t.plugins.reduce((function(e,t){return t.reshape?t.reshape(e):e}),{sourcesBySourceId:r,state:n}).sourcesBySourceId;return ot(t.reshape({sourcesBySourceId:o,sources:Object.values(o),state:n})).filter(Boolean).map((function(e){return{source:e,items:e.getItems()}}))}({collections:e,props:o,state:a.getState()})}))})))).then((function(e){var n;m("idle"),l(e);var f=o.shouldPanelOpen({state:a.getState()});s(null!==(n=r.isOpen)&&void 0!==n?n:o.openOnFocus&&!i&&f||f);var p=Kt(a.getState());if(null!==a.getState().activeItemId&&p){var d=p.item,v=p.itemInputValue,h=p.itemUrl,y=p.source;y.onActive(Sn({event:t,item:d,itemInputValue:v,itemUrl:h,refresh:c,source:y,state:a.getState()},u))}})).finally((function(){m("idle"),Pn&&o.environment.clearTimeout(Pn)}));return a.pendingRequests.add(y)}function kn(e){return kn="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},kn(e)}var Cn=["event","props","refresh","store"];function An(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function xn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?An(Object(n),!0).forEach((function(t){Nn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):An(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Nn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==kn(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==kn(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===kn(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Tn(e){return Tn="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},Tn(e)}var Rn=["props","refresh","store"],qn=["inputElement","formElement","panelElement"],Ln=["inputElement"],Mn=["inputElement","maxLength"],Hn=["sourceIndex"],Un=["sourceIndex"],Fn=["item","source","sourceIndex"];function Bn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Vn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Bn(Object(n),!0).forEach((function(t){Kn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Bn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Kn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Tn(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==Tn(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===Tn(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Wn(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function zn(e){var t=e.props,n=e.refresh,r=e.store,o=Wn(e,Rn),i=function(e,t){return void 0!==t?"".concat(e,"-").concat(t):e};return{getEnvironmentProps:function(e){var n=e.inputElement,o=e.formElement,i=e.panelElement;function c(e){!r.getState().isOpen&&r.pendingRequests.isEmpty()||e.target===n||!1===[o,i].some((function(t){return(n=t)===(r=e.target)||n.contains(r);var n,r}))&&(r.dispatch("blur",null),t.debug||r.pendingRequests.cancelAll())}return Vn({onTouchStart:c,onMouseDown:c,onTouchMove:function(e){!1!==r.getState().isOpen&&n===t.environment.document.activeElement&&e.target!==n&&n.blur()}},Wn(e,qn))},getRootProps:function(e){return Vn({role:"combobox","aria-expanded":r.getState().isOpen,"aria-haspopup":"listbox","aria-owns":r.getState().isOpen?"".concat(t.id,"-list"):void 0,"aria-labelledby":"".concat(t.id,"-label")},e)},getFormProps:function(e){return e.inputElement,Vn({action:"",noValidate:!0,role:"search",onSubmit:function(i){var c;i.preventDefault(),t.onSubmit(Vn({event:i,refresh:n,state:r.getState()},o)),r.dispatch("submit",null),null===(c=e.inputElement)||void 0===c||c.blur()},onReset:function(i){var c;i.preventDefault(),t.onReset(Vn({event:i,refresh:n,state:r.getState()},o)),r.dispatch("reset",null),null===(c=e.inputElement)||void 0===c||c.focus()}},Wn(e,Ln))},getLabelProps:function(e){var n=e||{},r=n.sourceIndex,o=Wn(n,Hn);return Vn({htmlFor:"".concat(i(t.id,r),"-input"),id:"".concat(i(t.id,r),"-label")},o)},getInputProps:function(e){var i;function c(e){(t.openOnFocus||Boolean(r.getState().query))&&Dn(Vn({event:e,props:t,query:r.getState().completion||r.getState().query,refresh:n,store:r},o)),r.dispatch("focus",null)}var a=e||{},u=(a.inputElement,a.maxLength),l=void 0===u?512:u,s=Wn(a,Mn),f=Kt(r.getState()),p=function(e){return Boolean(e&&e.match(Wt))}((null===(i=t.environment.navigator)||void 0===i?void 0:i.userAgent)||""),m=null!=f&&f.itemUrl&&!p?"go":"search";return Vn({"aria-autocomplete":"both","aria-activedescendant":r.getState().isOpen&&null!==r.getState().activeItemId?"".concat(t.id,"-item-").concat(r.getState().activeItemId):void 0,"aria-controls":r.getState().isOpen?"".concat(t.id,"-list"):void 0,"aria-labelledby":"".concat(t.id,"-label"),value:r.getState().completion||r.getState().query,id:"".concat(t.id,"-input"),autoComplete:"off",autoCorrect:"off",autoCapitalize:"off",enterKeyHint:m,spellCheck:"false",autoFocus:t.autoFocus,placeholder:t.placeholder,maxLength:l,type:"search",onChange:function(e){Dn(Vn({event:e,props:t,query:e.currentTarget.value.slice(0,l),refresh:n,store:r},o))},onKeyDown:function(e){!function(e){var t=e.event,n=e.props,r=e.refresh,o=e.store,i=function(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}(e,Cn);if("ArrowUp"===t.key||"ArrowDown"===t.key){var c=function(){var e=n.environment.document.getElementById("".concat(n.id,"-item-").concat(o.getState().activeItemId));e&&(e.scrollIntoViewIfNeeded?e.scrollIntoViewIfNeeded(!1):e.scrollIntoView(!1))},a=function(){var e=Kt(o.getState());if(null!==o.getState().activeItemId&&e){var n=e.item,c=e.itemInputValue,a=e.itemUrl,u=e.source;u.onActive(xn({event:t,item:n,itemInputValue:c,itemUrl:a,refresh:r,source:u,state:o.getState()},i))}};t.preventDefault(),!1===o.getState().isOpen&&(n.openOnFocus||Boolean(o.getState().query))?Dn(xn({event:t,props:n,query:o.getState().query,refresh:r,store:o},i)).then((function(){o.dispatch(t.key,{nextActiveItemId:n.defaultActiveItemId}),a(),setTimeout(c,0)})):(o.dispatch(t.key,{}),a(),c())}else if("Escape"===t.key)t.preventDefault(),o.dispatch(t.key,null),o.pendingRequests.cancelAll();else if("Tab"===t.key)o.dispatch("blur",null),o.pendingRequests.cancelAll();else if("Enter"===t.key){if(null===o.getState().activeItemId||o.getState().collections.every((function(e){return 0===e.items.length})))return void(n.debug||o.pendingRequests.cancelAll());t.preventDefault();var u=Kt(o.getState()),l=u.item,s=u.itemInputValue,f=u.itemUrl,p=u.source;if(t.metaKey||t.ctrlKey)void 0!==f&&(p.onSelect(xn({event:t,item:l,itemInputValue:s,itemUrl:f,refresh:r,source:p,state:o.getState()},i)),n.navigator.navigateNewTab({itemUrl:f,item:l,state:o.getState()}));else if(t.shiftKey)void 0!==f&&(p.onSelect(xn({event:t,item:l,itemInputValue:s,itemUrl:f,refresh:r,source:p,state:o.getState()},i)),n.navigator.navigateNewWindow({itemUrl:f,item:l,state:o.getState()}));else if(t.altKey);else{if(void 0!==f)return p.onSelect(xn({event:t,item:l,itemInputValue:s,itemUrl:f,refresh:r,source:p,state:o.getState()},i)),void n.navigator.navigate({itemUrl:f,item:l,state:o.getState()});Dn(xn({event:t,nextState:{isOpen:!1},props:n,query:s,refresh:r,store:o},i)).then((function(){p.onSelect(xn({event:t,item:l,itemInputValue:s,itemUrl:f,refresh:r,source:p,state:o.getState()},i))}))}}}(Vn({event:e,props:t,refresh:n,store:r},o))},onFocus:c,onBlur:lt,onClick:function(n){e.inputElement!==t.environment.document.activeElement||r.getState().isOpen||c(n)}},s)},getPanelProps:function(e){return Vn({onMouseDown:function(e){e.preventDefault()},onMouseLeave:function(){r.dispatch("mouseleave",null)}},e)},getListProps:function(e){var n=e||{},r=n.sourceIndex,o=Wn(n,Un);return Vn({role:"listbox","aria-labelledby":"".concat(i(t.id,r),"-label"),id:"".concat(i(t.id,r),"-list")},o)},getItemProps:function(e){var c=e.item,a=e.source,u=e.sourceIndex,l=Wn(e,Fn);return Vn({id:"".concat(i(t.id,u),"-item-").concat(c.__autocomplete_id),role:"option","aria-selected":r.getState().activeItemId===c.__autocomplete_id,onMouseMove:function(e){if(c.__autocomplete_id!==r.getState().activeItemId){r.dispatch("mousemove",c.__autocomplete_id);var t=Kt(r.getState());if(null!==r.getState().activeItemId&&t){var i=t.item,a=t.itemInputValue,u=t.itemUrl,l=t.source;l.onActive(Vn({event:e,item:i,itemInputValue:a,itemUrl:u,refresh:n,source:l,state:r.getState()},o))}}},onMouseDown:function(e){e.preventDefault()},onClick:function(e){var i=a.getItemInputValue({item:c,state:r.getState()}),u=a.getItemUrl({item:c,state:r.getState()});(u?Promise.resolve():Dn(Vn({event:e,nextState:{isOpen:!1},props:t,query:i,refresh:n,store:r},o))).then((function(){a.onSelect(Vn({event:e,item:c,itemInputValue:i,itemUrl:u,refresh:n,source:a,state:r.getState()},o))}))}},l)}}}function Jn(e){return Jn="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},Jn(e)}function $n(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Zn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?$n(Object(n),!0).forEach((function(t){Qn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):$n(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Qn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Jn(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==Jn(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===Jn(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Yn(e){var t,n,r,o,i=e.plugins,c=e.options,a=null===(t=((null===(n=c.__autocomplete_metadata)||void 0===n?void 0:n.userAgents)||[])[0])||void 0===t?void 0:t.segment,u=a?Qn({},a,Object.keys((null===(r=c.__autocomplete_metadata)||void 0===r?void 0:r.options)||{})):{};return{plugins:i.map((function(e){return{name:e.name,options:Object.keys(e.__autocomplete_pluginOptions||[])}})),options:Zn({"autocomplete-core":Object.keys(c)},u),ua:st.concat((null===(o=c.__autocomplete_metadata)||void 0===o?void 0:o.userAgents)||[])}}function Gn(e){var t,n=e.state;return!1===n.isOpen||null===n.activeItemId?null:(null===(t=Kt(n))||void 0===t?void 0:t.itemInputValue)||null}function Xn(e){return Xn="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},Xn(e)}function er(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function tr(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?er(Object(n),!0).forEach((function(t){nr(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):er(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function nr(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Xn(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==Xn(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===Xn(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var rr=function(e,t){switch(t.type){case"setActiveItemId":case"mousemove":return tr(tr({},e),{},{activeItemId:t.payload});case"setQuery":return tr(tr({},e),{},{query:t.payload,completion:null});case"setCollections":return tr(tr({},e),{},{collections:t.payload});case"setIsOpen":return tr(tr({},e),{},{isOpen:t.payload});case"setStatus":return tr(tr({},e),{},{status:t.payload});case"setContext":return tr(tr({},e),{},{context:tr(tr({},e.context),t.payload)});case"ArrowDown":var n=tr(tr({},e),{},{activeItemId:t.payload.hasOwnProperty("nextActiveItemId")?t.payload.nextActiveItemId:Ht(1,e.activeItemId,ct(e),t.props.defaultActiveItemId)});return tr(tr({},n),{},{completion:Gn({state:n})});case"ArrowUp":var r=tr(tr({},e),{},{activeItemId:Ht(-1,e.activeItemId,ct(e),t.props.defaultActiveItemId)});return tr(tr({},r),{},{completion:Gn({state:r})});case"Escape":return e.isOpen?tr(tr({},e),{},{activeItemId:null,isOpen:!1,completion:null}):tr(tr({},e),{},{activeItemId:null,query:"",status:"idle",collections:[]});case"submit":return tr(tr({},e),{},{activeItemId:null,isOpen:!1,status:"idle"});case"reset":return tr(tr({},e),{},{activeItemId:!0===t.props.openOnFocus?t.props.defaultActiveItemId:null,status:"idle",query:""});case"focus":return tr(tr({},e),{},{activeItemId:t.props.defaultActiveItemId,isOpen:(t.props.openOnFocus||Boolean(e.query))&&t.props.shouldPanelOpen({state:e})});case"blur":return t.props.debug?e:tr(tr({},e),{},{isOpen:!1,activeItemId:null});case"mouseleave":return tr(tr({},e),{},{activeItemId:t.props.defaultActiveItemId});default:return"The reducer action ".concat(JSON.stringify(t.type)," is not supported."),e}};function or(e){return or="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},or(e)}function ir(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function cr(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?ir(Object(n),!0).forEach((function(t){ar(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):ir(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function ar(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==or(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==or(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===or(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function ur(e){var t=[],n=on(e,t),r=function(e,t,n){var r,o=t.initialState;return{getState:function(){return o},dispatch:function(r,i){var c=function(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Jt(Object(n),!0).forEach((function(t){$t(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Jt(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}({},o);o=e(o,{type:r,props:t,payload:i}),n({state:o,prevState:c})},pendingRequests:(r=[],{add:function(e){return r.push(e),e.finally((function(){r=r.filter((function(t){return t!==e}))}))},cancelAll:function(){r.forEach((function(e){return e.cancel()}))},isEmpty:function(){return 0===r.length}})}}(rr,n,(function(e){var t=e.prevState,r=e.state;n.onStateChange(cr({prevState:t,state:r,refresh:c,navigator:n.navigator},o))})),o=function(e){var t=e.store;return{setActiveItemId:function(e){t.dispatch("setActiveItemId",e)},setQuery:function(e){t.dispatch("setQuery",e)},setCollections:function(e){var n=0,r=e.map((function(e){return Yt(Yt({},e),{},{items:ot(e.items).map((function(e){return Yt(Yt({},e),{},{__autocomplete_id:n++})}))})}));t.dispatch("setCollections",r)},setIsOpen:function(e){t.dispatch("setIsOpen",e)},setStatus:function(e){t.dispatch("setStatus",e)},setContext:function(e){t.dispatch("setContext",e)}}}({store:r}),i=zn(cr({props:n,refresh:c,store:r,navigator:n.navigator},o));function c(){return Dn(cr({event:new Event("input"),nextState:{isOpen:r.getState().isOpen},props:n,navigator:n.navigator,query:r.getState().query,refresh:c,store:r},o))}if(e.insights&&!n.plugins.some((function(e){return"aa.algoliaInsightsPlugin"===e.name}))){var a="boolean"==typeof e.insights?{}:e.insights;n.plugins.push(Rt(a))}return n.plugins.forEach((function(e){var r;return null===(r=e.subscribe)||void 0===r?void 0:r.call(e,cr(cr({},o),{},{navigator:n.navigator,refresh:c,onSelect:function(e){t.push({onSelect:e})},onActive:function(e){t.push({onActive:e})},onResolve:function(e){t.push({onResolve:e})}}))})),function(e){var t,n,r=e.metadata,o=e.environment;if(null===(t=o.navigator)||void 0===t||null===(n=t.userAgent)||void 0===n?void 0:n.includes("Algolia Crawler")){var i=o.document.createElement("meta"),c=o.document.querySelector("head");i.name="algolia:metadata",setTimeout((function(){i.content=JSON.stringify(r),c.appendChild(i)}),0)}}({metadata:Yn({plugins:n.plugins,options:e}),environment:n.environment}),cr(cr({refresh:c,navigator:n.navigator},i),o)}function lr(e){var t=e.translations,n=(void 0===t?{}:t).searchByText,r=void 0===n?"Search by":n;return Be.createElement("a",{href:"https://www.algolia.com/ref/docsearch/?utm_source=".concat(window.location.hostname,"&utm_medium=referral&utm_content=powered_by&utm_campaign=docsearch"),target:"_blank",rel:"noopener noreferrer"},Be.createElement("span",{className:"DocSearch-Label"},r),Be.createElement("svg",{width:"77",height:"19","aria-label":"Algolia",role:"img",id:"Layer_1",xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 2196.2 500"},Be.createElement("defs",null,Be.createElement("style",null,".cls-1,.cls-2{fill:#003dff;}.cls-2{fill-rule:evenodd;}")),Be.createElement("path",{className:"cls-2",d:"M1070.38,275.3V5.91c0-3.63-3.24-6.39-6.82-5.83l-50.46,7.94c-2.87,.45-4.99,2.93-4.99,5.84l.17,273.22c0,12.92,0,92.7,95.97,95.49,3.33,.1,6.09-2.58,6.09-5.91v-40.78c0-2.96-2.19-5.51-5.12-5.84-34.85-4.01-34.85-47.57-34.85-54.72Z"}),Be.createElement("rect",{className:"cls-1",x:"1845.88",y:"104.73",width:"62.58",height:"277.9",rx:"5.9",ry:"5.9"}),Be.createElement("path",{className:"cls-2",d:"M1851.78,71.38h50.77c3.26,0,5.9-2.64,5.9-5.9V5.9c0-3.62-3.24-6.39-6.82-5.83l-50.77,7.95c-2.87,.45-4.99,2.92-4.99,5.83v51.62c0,3.26,2.64,5.9,5.9,5.9Z"}),Be.createElement("path",{className:"cls-2",d:"M1764.03,275.3V5.91c0-3.63-3.24-6.39-6.82-5.83l-50.46,7.94c-2.87,.45-4.99,2.93-4.99,5.84l.17,273.22c0,12.92,0,92.7,95.97,95.49,3.33,.1,6.09-2.58,6.09-5.91v-40.78c0-2.96-2.19-5.51-5.12-5.84-34.85-4.01-34.85-47.57-34.85-54.72Z"}),Be.createElement("path",{className:"cls-2",d:"M1631.95,142.72c-11.14-12.25-24.83-21.65-40.78-28.31-15.92-6.53-33.26-9.85-52.07-9.85-18.78,0-36.15,3.17-51.92,9.85-15.59,6.66-29.29,16.05-40.76,28.31-11.47,12.23-20.38,26.87-26.76,44.03-6.38,17.17-9.24,37.37-9.24,58.36,0,20.99,3.19,36.87,9.55,54.21,6.38,17.32,15.14,32.11,26.45,44.36,11.29,12.23,24.83,21.62,40.6,28.46,15.77,6.83,40.12,10.33,52.4,10.48,12.25,0,36.78-3.82,52.7-10.48,15.92-6.68,29.46-16.23,40.78-28.46,11.29-12.25,20.05-27.04,26.25-44.36,6.22-17.34,9.24-33.22,9.24-54.21,0-20.99-3.34-41.19-10.03-58.36-6.38-17.17-15.14-31.8-26.43-44.03Zm-44.43,163.75c-11.47,15.75-27.56,23.7-48.09,23.7-20.55,0-36.63-7.8-48.1-23.7-11.47-15.75-17.21-34.01-17.21-61.2,0-26.89,5.59-49.14,17.06-64.87,11.45-15.75,27.54-23.52,48.07-23.52,20.55,0,36.63,7.78,48.09,23.52,11.47,15.57,17.36,37.98,17.36,64.87,0,27.19-5.72,45.3-17.19,61.2Z"}),Be.createElement("path",{className:"cls-2",d:"M894.42,104.73h-49.33c-48.36,0-90.91,25.48-115.75,64.1-14.52,22.58-22.99,49.63-22.99,78.73,0,44.89,20.13,84.92,51.59,111.1,2.93,2.6,6.05,4.98,9.31,7.14,12.86,8.49,28.11,13.47,44.52,13.47,1.23,0,2.46-.03,3.68-.09,.36-.02,.71-.05,1.07-.07,.87-.05,1.75-.11,2.62-.2,.34-.03,.68-.08,1.02-.12,.91-.1,1.82-.21,2.73-.34,.21-.03,.42-.07,.63-.1,32.89-5.07,61.56-30.82,70.9-62.81v57.83c0,3.26,2.64,5.9,5.9,5.9h50.42c3.26,0,5.9-2.64,5.9-5.9V110.63c0-3.26-2.64-5.9-5.9-5.9h-56.32Zm0,206.92c-12.2,10.16-27.97,13.98-44.84,15.12-.16,.01-.33,.03-.49,.04-1.12,.07-2.24,.1-3.36,.1-42.24,0-77.12-35.89-77.12-79.37,0-10.25,1.96-20.01,5.42-28.98,11.22-29.12,38.77-49.74,71.06-49.74h49.33v142.83Z"}),Be.createElement("path",{className:"cls-2",d:"M2133.97,104.73h-49.33c-48.36,0-90.91,25.48-115.75,64.1-14.52,22.58-22.99,49.63-22.99,78.73,0,44.89,20.13,84.92,51.59,111.1,2.93,2.6,6.05,4.98,9.31,7.14,12.86,8.49,28.11,13.47,44.52,13.47,1.23,0,2.46-.03,3.68-.09,.36-.02,.71-.05,1.07-.07,.87-.05,1.75-.11,2.62-.2,.34-.03,.68-.08,1.02-.12,.91-.1,1.82-.21,2.73-.34,.21-.03,.42-.07,.63-.1,32.89-5.07,61.56-30.82,70.9-62.81v57.83c0,3.26,2.64,5.9,5.9,5.9h50.42c3.26,0,5.9-2.64,5.9-5.9V110.63c0-3.26-2.64-5.9-5.9-5.9h-56.32Zm0,206.92c-12.2,10.16-27.97,13.98-44.84,15.12-.16,.01-.33,.03-.49,.04-1.12,.07-2.24,.1-3.36,.1-42.24,0-77.12-35.89-77.12-79.37,0-10.25,1.96-20.01,5.42-28.98,11.22-29.12,38.77-49.74,71.06-49.74h49.33v142.83Z"}),Be.createElement("path",{className:"cls-2",d:"M1314.05,104.73h-49.33c-48.36,0-90.91,25.48-115.75,64.1-11.79,18.34-19.6,39.64-22.11,62.59-.58,5.3-.88,10.68-.88,16.14s.31,11.15,.93,16.59c4.28,38.09,23.14,71.61,50.66,94.52,2.93,2.6,6.05,4.98,9.31,7.14,12.86,8.49,28.11,13.47,44.52,13.47h0c17.99,0,34.61-5.93,48.16-15.97,16.29-11.58,28.88-28.54,34.48-47.75v50.26h-.11v11.08c0,21.84-5.71,38.27-17.34,49.36-11.61,11.08-31.04,16.63-58.25,16.63-11.12,0-28.79-.59-46.6-2.41-2.83-.29-5.46,1.5-6.27,4.22l-12.78,43.11c-1.02,3.46,1.27,7.02,4.83,7.53,21.52,3.08,42.52,4.68,54.65,4.68,48.91,0,85.16-10.75,108.89-32.21,21.48-19.41,33.15-48.89,35.2-88.52V110.63c0-3.26-2.64-5.9-5.9-5.9h-56.32Zm0,64.1s.65,139.13,0,143.36c-12.08,9.77-27.11,13.59-43.49,14.7-.16,.01-.33,.03-.49,.04-1.12,.07-2.24,.1-3.36,.1-1.32,0-2.63-.03-3.94-.1-40.41-2.11-74.52-37.26-74.52-79.38,0-10.25,1.96-20.01,5.42-28.98,11.22-29.12,38.77-49.74,71.06-49.74h49.33Z"}),Be.createElement("path",{className:"cls-1",d:"M249.83,0C113.3,0,2,110.09,.03,246.16c-2,138.19,110.12,252.7,248.33,253.5,42.68,.25,83.79-10.19,120.3-30.03,3.56-1.93,4.11-6.83,1.08-9.51l-23.38-20.72c-4.75-4.21-11.51-5.4-17.36-2.92-25.48,10.84-53.17,16.38-81.71,16.03-111.68-1.37-201.91-94.29-200.13-205.96,1.76-110.26,92-199.41,202.67-199.41h202.69V407.41l-115-102.18c-3.72-3.31-9.42-2.66-12.42,1.31-18.46,24.44-48.53,39.64-81.93,37.34-46.33-3.2-83.87-40.5-87.34-86.81-4.15-55.24,39.63-101.52,94-101.52,49.18,0,89.68,37.85,93.91,85.95,.38,4.28,2.31,8.27,5.52,11.12l29.95,26.55c3.4,3.01,8.79,1.17,9.63-3.3,2.16-11.55,2.92-23.58,2.07-35.92-4.82-70.34-61.8-126.93-132.17-131.26-80.68-4.97-148.13,58.14-150.27,137.25-2.09,77.1,61.08,143.56,138.19,145.26,32.19,.71,62.03-9.41,86.14-26.95l150.26,133.2c6.44,5.71,16.61,1.14,16.61-7.47V9.48C499.66,4.25,495.42,0,490.18,0H249.83Z"})))}function sr(e){return Be.createElement("svg",{width:"15",height:"15","aria-label":e.ariaLabel,role:"img"},Be.createElement("g",{fill:"none",stroke:"currentColor",strokeLinecap:"round",strokeLinejoin:"round",strokeWidth:"1.2"},e.children))}function fr(e){var t=e.translations,n=void 0===t?{}:t,r=n.selectText,o=void 0===r?"to select":r,i=n.selectKeyAriaLabel,c=void 0===i?"Enter key":i,a=n.navigateText,u=void 0===a?"to navigate":a,l=n.navigateUpKeyAriaLabel,s=void 0===l?"Arrow up":l,f=n.navigateDownKeyAriaLabel,p=void 0===f?"Arrow down":f,m=n.closeText,d=void 0===m?"to close":m,v=n.closeKeyAriaLabel,h=void 0===v?"Escape key":v,y=n.searchByText,_=void 0===y?"Search by":y;return Be.createElement(Be.Fragment,null,Be.createElement("div",{className:"DocSearch-Logo"},Be.createElement(lr,{translations:{searchByText:_}})),Be.createElement("ul",{className:"DocSearch-Commands"},Be.createElement("li",null,Be.createElement("kbd",{className:"DocSearch-Commands-Key"},Be.createElement(sr,{ariaLabel:c},Be.createElement("path",{d:"M12 3.53088v3c0 1-1 2-2 2H4M7 11.53088l-3-3 3-3"}))),Be.createElement("span",{className:"DocSearch-Label"},o)),Be.createElement("li",null,Be.createElement("kbd",{className:"DocSearch-Commands-Key"},Be.createElement(sr,{ariaLabel:p},Be.createElement("path",{d:"M7.5 3.5v8M10.5 8.5l-3 3-3-3"}))),Be.createElement("kbd",{className:"DocSearch-Commands-Key"},Be.createElement(sr,{ariaLabel:s},Be.createElement("path",{d:"M7.5 11.5v-8M10.5 6.5l-3-3-3 3"}))),Be.createElement("span",{className:"DocSearch-Label"},u)),Be.createElement("li",null,Be.createElement("kbd",{className:"DocSearch-Commands-Key"},Be.createElement(sr,{ariaLabel:h},Be.createElement("path",{d:"M13.6167 8.936c-.1065.3583-.6883.962-1.4875.962-.7993 0-1.653-.9165-1.653-2.1258v-.5678c0-1.2548.7896-2.1016 1.653-2.1016.8634 0 1.3601.4778 1.4875 1.0724M9 6c-.1352-.4735-.7506-.9219-1.46-.8972-.7092.0246-1.344.57-1.344 1.2166s.4198.8812 1.3445.9805C8.465 7.3992 8.968 7.9337 9 8.5c.032.5663-.454 1.398-1.4595 1.398C6.6593 9.898 6 9 5.963 8.4851m-1.4748.5368c-.2635.5941-.8099.876-1.5443.876s-1.7073-.6248-1.7073-2.204v-.4603c0-1.0416.721-2.131 1.7073-2.131.9864 0 1.6425 1.031 1.5443 2.2492h-2.956"}))),Be.createElement("span",{className:"DocSearch-Label"},d))))}function pr(e){var t=e.hit,n=e.children;return Be.createElement("a",{href:t.url},n)}function mr(){return Be.createElement("svg",{viewBox:"0 0 38 38",stroke:"currentColor",strokeOpacity:".5"},Be.createElement("g",{fill:"none",fillRule:"evenodd"},Be.createElement("g",{transform:"translate(1 1)",strokeWidth:"2"},Be.createElement("circle",{strokeOpacity:".3",cx:"18",cy:"18",r:"18"}),Be.createElement("path",{d:"M36 18c0-9.94-8.06-18-18-18"},Be.createElement("animateTransform",{attributeName:"transform",type:"rotate",from:"0 18 18",to:"360 18 18",dur:"1s",repeatCount:"indefinite"})))))}function dr(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("g",{stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"},Be.createElement("path",{d:"M3.18 6.6a8.23 8.23 0 1112.93 9.94h0a8.23 8.23 0 01-11.63 0"}),Be.createElement("path",{d:"M6.44 7.25H2.55V3.36M10.45 6v5.6M10.45 11.6L13 13"})))}function vr(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M10 10l5.09-5.09L10 10l5.09 5.09L10 10zm0 0L4.91 4.91 10 10l-5.09 5.09L10 10z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"}))}function hr(){return Be.createElement("svg",{className:"DocSearch-Hit-Select-Icon",width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("g",{stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"},Be.createElement("path",{d:"M18 3v4c0 2-2 4-4 4H2"}),Be.createElement("path",{d:"M8 17l-6-6 6-6"})))}var yr=function(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M17 6v12c0 .52-.2 1-1 1H4c-.7 0-1-.33-1-1V2c0-.55.42-1 1-1h8l5 5zM14 8h-3.13c-.51 0-.87-.34-.87-.87V4",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinejoin:"round"}))};function _r(e){switch(e.type){case"lvl1":return Be.createElement(yr,null);case"content":return Be.createElement(gr,null);default:return Be.createElement(br,null)}}function br(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M13 13h4-4V8H7v5h6v4-4H7V8H3h4V3v5h6V3v5h4-4v5zm-6 0v4-4H3h4z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"}))}function gr(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M17 5H3h14zm0 5H3h14zm0 5H3h14z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinejoin:"round"}))}function Sr(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M10 14.2L5 17l1-5.6-4-4 5.5-.7 2.5-5 2.5 5 5.6.8-4 4 .9 5.5z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinejoin:"round"}))}function Or(){return Be.createElement("svg",{width:"40",height:"40",viewBox:"0 0 20 20",fill:"none",fillRule:"evenodd",stroke:"currentColor",strokeLinecap:"round",strokeLinejoin:"round"},Be.createElement("path",{d:"M19 4.8a16 16 0 00-2-1.2m-3.3-1.2A16 16 0 001.1 4.7M16.7 8a12 12 0 00-2.8-1.4M10 6a12 12 0 00-6.7 2M12.3 14.7a4 4 0 00-4.5 0M14.5 11.4A8 8 0 0010 10M3 16L18 2M10 18h0"}))}function wr(){return Be.createElement("svg",{width:"40",height:"40",viewBox:"0 0 20 20",fill:"none",fillRule:"evenodd",stroke:"currentColor",strokeLinecap:"round",strokeLinejoin:"round"},Be.createElement("path",{d:"M15.5 4.8c2 3 1.7 7-1 9.7h0l4.3 4.3-4.3-4.3a7.8 7.8 0 01-9.8 1m-2.2-2.2A7.8 7.8 0 0113.2 2.4M2 18L18 2"}))}function Er(e){var t=e.translations,n=void 0===t?{}:t,r=n.titleText,o=void 0===r?"Unable to fetch results":r,i=n.helpText,c=void 0===i?"You might want to check your network connection.":i;return Be.createElement("div",{className:"DocSearch-ErrorScreen"},Be.createElement("div",{className:"DocSearch-Screen-Icon"},Be.createElement(Or,null)),Be.createElement("p",{className:"DocSearch-Title"},o),Be.createElement("p",{className:"DocSearch-Help"},c))}var jr=["translations"];function Pr(e){var t=e.translations,n=void 0===t?{}:t,r=$e(e,jr),o=n.noResultsText,i=void 0===o?"No results for":o,c=n.suggestedQueryText,a=void 0===c?"Try searching for":c,u=n.reportMissingResultsText,l=void 0===u?"Believe this query should return results?":u,s=n.reportMissingResultsLinkText,f=void 0===s?"Let us know.":s,p=r.state.context.searchSuggestions;return Be.createElement("div",{className:"DocSearch-NoResults"},Be.createElement("div",{className:"DocSearch-Screen-Icon"},Be.createElement(wr,null)),Be.createElement("p",{className:"DocSearch-Title"},i,' "',Be.createElement("strong",null,r.state.query),'"'),p&&p.length>0&&Be.createElement("div",{className:"DocSearch-NoResults-Prefill-List"},Be.createElement("p",{className:"DocSearch-Help"},a,":"),Be.createElement("ul",null,p.slice(0,3).reduce((function(e,t){return[].concat(function(e){return function(e){if(Array.isArray(e))return Ye(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||Qe(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}(e),[Be.createElement("li",{key:t},Be.createElement("button",{className:"DocSearch-Prefill",key:t,type:"button",onClick:function(){r.setQuery(t.toLowerCase()+" "),r.refresh(),r.inputRef.current.focus()}},t))])}),[]))),r.getMissingResultsUrl&&Be.createElement("p",{className:"DocSearch-Help"},"".concat(l," "),Be.createElement("a",{href:r.getMissingResultsUrl({query:r.state.query}),target:"_blank",rel:"noopener noreferrer"},f)))}var Ir=["hit","attribute","tagName"];function Dr(e,t){return t.split(".").reduce((function(e,t){return null!=e&&e[t]?e[t]:null}),e)}function kr(e){var t=e.hit,n=e.attribute,r=e.tagName;return g(void 0===r?"span":r,We(We({},$e(e,Ir)),{},{dangerouslySetInnerHTML:{__html:Dr(t,"_snippetResult.".concat(n,".value"))||Dr(t,n)}}))}function Cr(e){return e.collection&&0!==e.collection.items.length?Be.createElement("section",{className:"DocSearch-Hits"},Be.createElement("div",{className:"DocSearch-Hit-source"},e.title),Be.createElement("ul",e.getListProps(),e.collection.items.map((function(t,n){return Be.createElement(Ar,Je({key:[e.title,t.objectID].join(":"),item:t,index:n},e))})))):null}function Ar(e){var t=e.item,n=e.index,r=e.renderIcon,o=e.renderAction,i=e.getItemProps,c=e.onItemClick,a=e.collection,u=e.hitComponent,l=Ze(Be.useState(!1),2),s=l[0],f=l[1],p=Ze(Be.useState(!1),2),m=p[0],d=p[1],v=Be.useRef(null),h=u;return Be.createElement("li",Je({className:["DocSearch-Hit",t.__docsearch_parent&&"DocSearch-Hit--Child",s&&"DocSearch-Hit--deleting",m&&"DocSearch-Hit--favoriting"].filter(Boolean).join(" "),onTransitionEnd:function(){v.current&&v.current()}},i({item:t,source:a.source,onClick:function(e){c(t,e)}})),Be.createElement(h,{hit:t},Be.createElement("div",{className:"DocSearch-Hit-Container"},r({item:t,index:n}),t.hierarchy[t.type]&&"lvl1"===t.type&&Be.createElement("div",{className:"DocSearch-Hit-content-wrapper"},Be.createElement(kr,{className:"DocSearch-Hit-title",hit:t,attribute:"hierarchy.lvl1"}),t.content&&Be.createElement(kr,{className:"DocSearch-Hit-path",hit:t,attribute:"content"})),t.hierarchy[t.type]&&("lvl2"===t.type||"lvl3"===t.type||"lvl4"===t.type||"lvl5"===t.type||"lvl6"===t.type)&&Be.createElement("div",{className:"DocSearch-Hit-content-wrapper"},Be.createElement(kr,{className:"DocSearch-Hit-title",hit:t,attribute:"hierarchy.".concat(t.type)}),Be.createElement(kr,{className:"DocSearch-Hit-path",hit:t,attribute:"hierarchy.lvl1"})),"content"===t.type&&Be.createElement("div",{className:"DocSearch-Hit-content-wrapper"},Be.createElement(kr,{className:"DocSearch-Hit-title",hit:t,attribute:"content"}),Be.createElement(kr,{className:"DocSearch-Hit-path",hit:t,attribute:"hierarchy.lvl1"})),o({item:t,runDeleteTransition:function(e){f(!0),v.current=e},runFavoriteTransition:function(e){d(!0),v.current=e}}))))}function xr(e,t,n){return e.reduce((function(e,r){var o=t(r);return e.hasOwnProperty(o)||(e[o]=[]),e[o].length<(n||5)&&e[o].push(r),e}),{})}function Nr(e){return e}function Tr(e){return 1===e.button||e.altKey||e.ctrlKey||e.metaKey||e.shiftKey}function Rr(){}var qr=/(<mark>|<\/mark>)/g,Lr=RegExp(qr.source);function Mr(e){var t,n,r=e;if(!r.__docsearch_parent&&!e._highlightResult)return e.hierarchy.lvl0;var o=((r.__docsearch_parent?null===(t=r.__docsearch_parent)||void 0===t||null===(t=t._highlightResult)||void 0===t||null===(t=t.hierarchy)||void 0===t?void 0:t.lvl0:null===(n=e._highlightResult)||void 0===n||null===(n=n.hierarchy)||void 0===n?void 0:n.lvl0)||{}).value;return o&&Lr.test(o)?o.replace(qr,""):o}function Hr(e){return Be.createElement("div",{className:"DocSearch-Dropdown-Container"},e.state.collections.map((function(t){if(0===t.items.length)return null;var n=Mr(t.items[0]);return Be.createElement(Cr,Je({},e,{key:t.source.sourceId,title:n,collection:t,renderIcon:function(e){var n,r=e.item,o=e.index;return Be.createElement(Be.Fragment,null,r.__docsearch_parent&&Be.createElement("svg",{className:"DocSearch-Hit-Tree",viewBox:"0 0 24 54"},Be.createElement("g",{stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"},r.__docsearch_parent!==(null===(n=t.items[o+1])||void 0===n?void 0:n.__docsearch_parent)?Be.createElement("path",{d:"M8 6v21M20 27H8.3"}):Be.createElement("path",{d:"M8 6v42M20 27H8.3"}))),Be.createElement("div",{className:"DocSearch-Hit-icon"},Be.createElement(_r,{type:r.type})))},renderAction:function(){return Be.createElement("div",{className:"DocSearch-Hit-action"},Be.createElement(hr,null))}}))})),e.resultsFooterComponent&&Be.createElement("section",{className:"DocSearch-HitsFooter"},Be.createElement(e.resultsFooterComponent,{state:e.state})))}var Ur=["translations"];function Fr(e){var t=e.translations,n=void 0===t?{}:t,r=$e(e,Ur),o=n.recentSearchesTitle,i=void 0===o?"Recent":o,c=n.noRecentSearchesText,a=void 0===c?"No recent searches":c,u=n.saveRecentSearchButtonTitle,l=void 0===u?"Save this search":u,s=n.removeRecentSearchButtonTitle,f=void 0===s?"Remove this search from history":s,p=n.favoriteSearchesTitle,m=void 0===p?"Favorite":p,d=n.removeFavoriteSearchButtonTitle,v=void 0===d?"Remove this search from favorites":d;return"idle"===r.state.status&&!1===r.hasCollections?r.disableUserPersonalization?null:Be.createElement("div",{className:"DocSearch-StartScreen"},Be.createElement("p",{className:"DocSearch-Help"},a)):!1===r.hasCollections?null:Be.createElement("div",{className:"DocSearch-Dropdown-Container"},Be.createElement(Cr,Je({},r,{title:i,collection:r.state.collections[0],renderIcon:function(){return Be.createElement("div",{className:"DocSearch-Hit-icon"},Be.createElement(dr,null))},renderAction:function(e){var t=e.item,n=e.runFavoriteTransition,o=e.runDeleteTransition;return Be.createElement(Be.Fragment,null,Be.createElement("div",{className:"DocSearch-Hit-action"},Be.createElement("button",{className:"DocSearch-Hit-action-button",title:l,type:"submit",onClick:function(e){e.preventDefault(),e.stopPropagation(),n((function(){r.favoriteSearches.add(t),r.recentSearches.remove(t),r.refresh()}))}},Be.createElement(Sr,null))),Be.createElement("div",{className:"DocSearch-Hit-action"},Be.createElement("button",{className:"DocSearch-Hit-action-button",title:f,type:"submit",onClick:function(e){e.preventDefault(),e.stopPropagation(),o((function(){r.recentSearches.remove(t),r.refresh()}))}},Be.createElement(vr,null))))}})),Be.createElement(Cr,Je({},r,{title:m,collection:r.state.collections[1],renderIcon:function(){return Be.createElement("div",{className:"DocSearch-Hit-icon"},Be.createElement(Sr,null))},renderAction:function(e){var t=e.item,n=e.runDeleteTransition;return Be.createElement("div",{className:"DocSearch-Hit-action"},Be.createElement("button",{className:"DocSearch-Hit-action-button",title:v,type:"submit",onClick:function(e){e.preventDefault(),e.stopPropagation(),n((function(){r.favoriteSearches.remove(t),r.refresh()}))}},Be.createElement(vr,null)))}})))}var Br=["translations"],Vr=Be.memo((function(e){var t=e.translations,n=void 0===t?{}:t,r=$e(e,Br);if("error"===r.state.status)return Be.createElement(Er,{translations:null==n?void 0:n.errorScreen});var o=r.state.collections.some((function(e){return e.items.length>0}));return r.state.query?!1===o?Be.createElement(Pr,Je({},r,{translations:null==n?void 0:n.noResultsScreen})):Be.createElement(Hr,r):Be.createElement(Fr,Je({},r,{hasCollections:o,translations:null==n?void 0:n.startScreen}))}),(function(e,t){return"loading"===t.state.status||"stalled"===t.state.status})),Kr=["translations"];function Wr(e){var t=e.translations,n=void 0===t?{}:t,r=$e(e,Kr),o=n.resetButtonTitle,i=void 0===o?"Clear the query":o,c=n.resetButtonAriaLabel,a=void 0===c?"Clear the query":c,u=n.cancelButtonText,l=void 0===u?"Cancel":u,s=n.cancelButtonAriaLabel,f=void 0===s?"Cancel":s,p=n.searchInputLabel,m=void 0===p?"Search":p,d=r.getFormProps({inputElement:r.inputRef.current}).onReset;return Be.useEffect((function(){r.autoFocus&&r.inputRef.current&&r.inputRef.current.focus()}),[r.autoFocus,r.inputRef]),Be.useEffect((function(){r.isFromSelection&&r.inputRef.current&&r.inputRef.current.select()}),[r.isFromSelection,r.inputRef]),Be.createElement(Be.Fragment,null,Be.createElement("form",{className:"DocSearch-Form",onSubmit:function(e){e.preventDefault()},onReset:d},Be.createElement("label",Je({className:"DocSearch-MagnifierLabel"},r.getLabelProps()),Be.createElement(Xe,null),Be.createElement("span",{className:"DocSearch-VisuallyHiddenForAccessibility"},m)),Be.createElement("div",{className:"DocSearch-LoadingIndicator"},Be.createElement(mr,null)),Be.createElement("input",Je({className:"DocSearch-Input",ref:r.inputRef},r.getInputProps({inputElement:r.inputRef.current,autoFocus:r.autoFocus,maxLength:64}))),Be.createElement("button",{type:"reset",title:i,className:"DocSearch-Reset","aria-label":a,hidden:!r.state.query},Be.createElement(vr,null))),Be.createElement("button",{className:"DocSearch-Cancel",type:"reset","aria-label":f,onClick:r.onClose},l))}var zr=["_highlightResult","_snippetResult"];function Jr(e){var t=e.key,n=e.limit,r=void 0===n?5:n,o=function(e){return!1===function(){var e="__TEST_KEY__";try{return localStorage.setItem(e,""),localStorage.removeItem(e),!0}catch(e){return!1}}()?{setItem:function(){},getItem:function(){return[]}}:{setItem:function(t){return window.localStorage.setItem(e,JSON.stringify(t))},getItem:function(){var t=window.localStorage.getItem(e);return t?JSON.parse(t):[]}}}(t),i=o.getItem().slice(0,r);return{add:function(e){var t=e,n=(t._highlightResult,t._snippetResult,$e(t,zr)),c=i.findIndex((function(e){return e.objectID===n.objectID}));c>-1&&i.splice(c,1),i.unshift(n),i=i.slice(0,r),o.setItem(i)},remove:function(e){i=i.filter((function(t){return t.objectID!==e.objectID})),o.setItem(i)},getAll:function(){return i}}}function $r(e){var t,n="algoliasearch-client-js-".concat(e.key),r=function(){return void 0===t&&(t=e.localStorage||window.localStorage),t},o=function(){return JSON.parse(r().getItem(n)||"{}")},i=function(e){r().setItem(n,JSON.stringify(e))};return{get:function(t,n){var r=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{miss:function(){return Promise.resolve()}};return Promise.resolve().then((function(){!function(){var t=e.timeToLive?1e3*e.timeToLive:null,n=o(),r=Object.fromEntries(Object.entries(n).filter((function(e){return void 0!==c(e,2)[1].timestamp})));if(i(r),t){var a=Object.fromEntries(Object.entries(r).filter((function(e){var n=c(e,2)[1],r=(new Date).getTime();return!(n.timestamp+t<r)})));i(a)}}();var n=JSON.stringify(t);return o()[n]})).then((function(e){return Promise.all([e?e.value:n(),void 0!==e])})).then((function(e){var t=c(e,2),n=t[0],o=t[1];return Promise.all([n,o||r.miss(n)])})).then((function(e){return c(e,1)[0]}))},set:function(e,t){return Promise.resolve().then((function(){var i=o();return i[JSON.stringify(e)]={timestamp:(new Date).getTime(),value:t},r().setItem(n,JSON.stringify(i)),t}))},delete:function(e){return Promise.resolve().then((function(){var t=o();delete t[JSON.stringify(e)],r().setItem(n,JSON.stringify(t))}))},clear:function(){return Promise.resolve().then((function(){r().removeItem(n)}))}}}function Zr(e){var t=a(e.caches),n=t.shift();return void 0===n?{get:function(e,t){var n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{miss:function(){return Promise.resolve()}};return t().then((function(e){return Promise.all([e,n.miss(e)])})).then((function(e){return c(e,1)[0]}))},set:function(e,t){return Promise.resolve(t)},delete:function(e){return Promise.resolve()},clear:function(){return Promise.resolve()}}:{get:function(e,r){var o=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{miss:function(){return Promise.resolve()}};return n.get(e,r,o).catch((function(){return Zr({caches:t}).get(e,r,o)}))},set:function(e,r){return n.set(e,r).catch((function(){return Zr({caches:t}).set(e,r)}))},delete:function(e){return n.delete(e).catch((function(){return Zr({caches:t}).delete(e)}))},clear:function(){return n.clear().catch((function(){return Zr({caches:t}).clear()}))}}}function Qr(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{serializable:!0},t={};return{get:function(n,r){var o=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{miss:function(){return Promise.resolve()}},i=JSON.stringify(n);if(i in t)return Promise.resolve(e.serializable?JSON.parse(t[i]):t[i]);var c=r(),a=o&&o.miss||function(){return Promise.resolve()};return c.then((function(e){return a(e)})).then((function(){return c}))},set:function(n,r){return t[JSON.stringify(n)]=e.serializable?JSON.stringify(r):r,Promise.resolve(r)},delete:function(e){return delete t[JSON.stringify(e)],Promise.resolve()},clear:function(){return t={},Promise.resolve()}}}function Yr(e){for(var t=e.length-1;t>0;t--){var n=Math.floor(Math.random()*(t+1)),r=e[t];e[t]=e[n],e[n]=r}return e}function Gr(e,t){return t?(Object.keys(t).forEach((function(n){e[n]=t[n](e)})),e):e}function Xr(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),r=1;r<t;r++)n[r-1]=arguments[r];var o=0;return e.replace(/%s/g,(function(){return encodeURIComponent(n[o++])}))}var eo=0,to=1;function no(e,t){var n=e||{},r=n.data||{};return Object.keys(n).forEach((function(e){-1===["timeout","headers","queryParameters","data","cacheable"].indexOf(e)&&(r[e]=n[e])})),{data:Object.entries(r).length>0?r:void 0,timeout:n.timeout||t,headers:n.headers||{},queryParameters:n.queryParameters||{},cacheable:n.cacheable}}var ro={Read:1,Write:2,Any:3};function oo(e){var n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:1;return t(t({},e),{},{status:n,lastUpdate:Date.now()})}function io(e){return"string"==typeof e?{protocol:"https",url:e,accept:ro.Any}:{protocol:e.protocol||"https",url:e.url,accept:e.accept||ro.Any}}var co="GET",ao="POST";function uo(e,n,r,o){var i=[],c=function(e,n){if(e.method!==co&&(void 0!==e.data||void 0!==n.data)){var r=Array.isArray(e.data)?e.data:t(t({},e.data),n.data);return JSON.stringify(r)}}(r,o),u=function(e,n){var r=t(t({},e.headers),n.headers),o={};return Object.keys(r).forEach((function(e){var t=r[e];o[e.toLowerCase()]=t})),o}(e,o),l=r.method,s=r.method!==co?{}:t(t({},r.data),o.data),f=t(t(t({"x-algolia-agent":e.userAgent.value},e.queryParameters),s),o.queryParameters),p=0,m=function t(n,a){var s=n.pop();if(void 0===s)throw{name:"RetryError",message:"Unreachable hosts - your application id may be incorrect. If the error persists, contact support@algolia.com.",transporterStackTrace:po(i)};var m={data:c,headers:u,method:l,url:so(s,r.path,f),connectTimeout:a(p,e.timeouts.connect),responseTimeout:a(p,o.timeout)},d=function(e){var t={request:m,response:e,host:s,triesLeft:n.length};return i.push(t),t},v={onSuccess:function(e){return function(e){try{return JSON.parse(e.content)}catch(t){throw function(e,t){return{name:"DeserializationError",message:e,response:t}}(t.message,e)}}(e)},onRetry:function(r){var o=d(r);return r.isTimedOut&&p++,Promise.all([e.logger.info("Retryable failure",mo(o)),e.hostsCache.set(s,oo(s,r.isTimedOut?3:2))]).then((function(){return t(n,a)}))},onFail:function(e){throw d(e),function(e,t){var n=e.content,r=e.status,o=n;try{o=JSON.parse(n).message}catch(n){}return function(e,t,n){return{name:"ApiError",message:e,status:t,transporterStackTrace:n}}(o,r,t)}(e,po(i))}};return e.requester.send(m).then((function(e){return function(e,t){return function(e){var t=e.status;return e.isTimedOut||function(e){var t=e.isTimedOut,n=e.status;return!t&&0==~~n}(e)||2!=~~(t/100)&&4!=~~(t/100)}(e)?t.onRetry(e):(n=e,2==~~(n.status/100)?t.onSuccess(e):t.onFail(e));var n}(e,v)}))};return function(e,t){return Promise.all(t.map((function(t){return e.get(t,(function(){return Promise.resolve(oo(t))}))}))).then((function(e){var n=e.filter((function(e){return function(e){return 1===e.status||Date.now()-e.lastUpdate>12e4}(e)})),r=e.filter((function(e){return function(e){return 3===e.status&&Date.now()-e.lastUpdate<=12e4}(e)})),o=[].concat(a(n),a(r));return{getTimeout:function(e,t){return(0===r.length&&0===e?1:r.length+3+e)*t},statelessHosts:o.length>0?o.map((function(e){return io(e)})):t}}))}(e.hostsCache,n).then((function(e){return m(a(e.statelessHosts).reverse(),e.getTimeout)}))}function lo(e){var t={value:"Algolia for JavaScript (".concat(e,")"),add:function(e){var n="; ".concat(e.segment).concat(void 0!==e.version?" (".concat(e.version,")"):"");return-1===t.value.indexOf(n)&&(t.value="".concat(t.value).concat(n)),t}};return t}function so(e,t,n){var r=fo(n),o="".concat(e.protocol,"://").concat(e.url,"/").concat("/"===t.charAt(0)?t.substr(1):t);return r.length&&(o+="?".concat(r)),o}function fo(e){return Object.keys(e).map((function(t){return Xr("%s=%s",t,(n=e[t],"[object Object]"===Object.prototype.toString.call(n)||"[object Array]"===Object.prototype.toString.call(n)?JSON.stringify(e[t]):e[t]));var n})).join("&")}function po(e){return e.map((function(e){return mo(e)}))}function mo(e){var n=e.request.headers["x-algolia-api-key"]?{"x-algolia-api-key":"*****"}:{};return t(t({},e),{},{request:t(t({},e.request),{},{headers:t(t({},e.request.headers),n)})})}var vo=function(e){return function(t,n){return t.method===co?e.transporter.read(t,n):e.transporter.write(t,n)}},ho=function(e){return function(t){var n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};return Gr({transporter:e.transporter,appId:e.appId,indexName:t},n.methods)}},yo=function(e){return function(n,r){var o=n.map((function(e){return t(t({},e),{},{params:fo(e.params||{})})}));return e.transporter.read({method:ao,path:"1/indexes/*/queries",data:{requests:o},cacheable:!0},r)}},_o=function(e){return function(n,r){return Promise.all(n.map((function(n){var o=n.params,c=o.facetName,a=o.facetQuery,u=i(o,Ve);return ho(e)(n.indexName,{methods:{searchForFacetValues:So}}).searchForFacetValues(c,a,t(t({},r),u))})))}},bo=function(e){return function(t,n,r){return e.transporter.read({method:ao,path:Xr("1/answers/%s/prediction",e.indexName),data:{query:t,queryLanguages:n},cacheable:!0},r)}},go=function(e){return function(t,n){return e.transporter.read({method:ao,path:Xr("1/indexes/%s/query",e.indexName),data:{query:t},cacheable:!0},n)}},So=function(e){return function(t,n,r){return e.transporter.read({method:ao,path:Xr("1/indexes/%s/facets/%s/query",e.indexName,t),data:{facetQuery:n},cacheable:!0},r)}};function Oo(e,n,r){var o={appId:e,apiKey:n,timeouts:{connect:1,read:2,write:30},requester:{send:function(e){return new Promise((function(t){var n=new XMLHttpRequest;n.open(e.method,e.url,!0),Object.keys(e.headers).forEach((function(t){return n.setRequestHeader(t,e.headers[t])}));var r,o=function(e,r){return setTimeout((function(){n.abort(),t({status:0,content:r,isTimedOut:!0})}),1e3*e)},i=o(e.connectTimeout,"Connection timeout");n.onreadystatechange=function(){n.readyState>n.OPENED&&void 0===r&&(clearTimeout(i),r=o(e.responseTimeout,"Socket timeout"))},n.onerror=function(){0===n.status&&(clearTimeout(i),clearTimeout(r),t({content:n.responseText||"Network request failed",status:n.status,isTimedOut:!1}))},n.onload=function(){clearTimeout(i),clearTimeout(r),t({content:n.responseText,status:n.status,isTimedOut:!1})},n.send(e.data)}))}},logger:(3,{debug:function(e,t){return Promise.resolve()},info:function(e,t){return Promise.resolve()},error:function(e,t){return console.error(e,t),Promise.resolve()}}),responsesCache:Qr(),requestsCache:Qr({serializable:!1}),hostsCache:Zr({caches:[$r({key:"4.19.1-".concat(e)}),Qr()]}),userAgent:lo("4.19.1").add({segment:"Browser",version:"lite"}),authMode:eo};return function(e){var n=e.appId,r=function(e,t,n){var r={"x-algolia-api-key":n,"x-algolia-application-id":t};return{headers:function(){return e===to?r:{}},queryParameters:function(){return e===eo?r:{}}}}(void 0!==e.authMode?e.authMode:to,n,e.apiKey),o=function(e){var t=e.hostsCache,n=e.logger,r=e.requester,o=e.requestsCache,i=e.responsesCache,a=e.timeouts,u=e.userAgent,l=e.hosts,s=e.queryParameters,f={hostsCache:t,logger:n,requester:r,requestsCache:o,responsesCache:i,timeouts:a,userAgent:u,headers:e.headers,queryParameters:s,hosts:l.map((function(e){return io(e)})),read:function(e,t){var n=no(t,f.timeouts.read),r=function(){return uo(f,f.hosts.filter((function(e){return 0!=(e.accept&ro.Read)})),e,n)};if(!0!==(void 0!==n.cacheable?n.cacheable:e.cacheable))return r();var o={request:e,mappedRequestOptions:n,transporter:{queryParameters:f.queryParameters,headers:f.headers}};return f.responsesCache.get(o,(function(){return f.requestsCache.get(o,(function(){return f.requestsCache.set(o,r()).then((function(e){return Promise.all([f.requestsCache.delete(o),e])}),(function(e){return Promise.all([f.requestsCache.delete(o),Promise.reject(e)])})).then((function(e){var t=c(e,2);return t[0],t[1]}))}))}),{miss:function(e){return f.responsesCache.set(o,e)}})},write:function(e,t){return uo(f,f.hosts.filter((function(e){return 0!=(e.accept&ro.Write)})),e,no(t,f.timeouts.write))}};return f}(t(t({hosts:[{url:"".concat(n,"-dsn.algolia.net"),accept:ro.Read},{url:"".concat(n,".algolia.net"),accept:ro.Write}].concat(Yr([{url:"".concat(n,"-1.algolianet.com")},{url:"".concat(n,"-2.algolianet.com")},{url:"".concat(n,"-3.algolianet.com")}]))},e),{},{headers:t(t({},r.headers()),{},{"content-type":"application/x-www-form-urlencoded"},e.headers),queryParameters:t(t({},r.queryParameters()),e.queryParameters)})),i={transporter:o,appId:n,addAlgoliaAgent:function(e,t){o.userAgent.add({segment:e,version:t})},clearCache:function(){return Promise.all([o.requestsCache.clear(),o.responsesCache.clear()]).then((function(){}))}};return Gr(i,e.methods)}(t(t(t({},o),r),{},{methods:{search:yo,searchForFacetValues:_o,multipleQueries:yo,multipleSearchForFacetValues:_o,customRequest:vo,initIndex:function(e){return function(t){return ho(e)(t,{methods:{search:go,searchForFacetValues:So,findAnswers:bo}})}}}}))}Oo.version="4.19.1";var wo=["footer","searchBox"];function Eo(e){var t=e.appId,n=e.apiKey,r=e.indexName,o=e.placeholder,i=void 0===o?"Search docs":o,c=e.searchParameters,a=e.maxResultsPerGroup,u=e.onClose,l=void 0===u?Rr:u,s=e.transformItems,f=void 0===s?Nr:s,p=e.hitComponent,m=void 0===p?pr:p,d=e.resultsFooterComponent,v=void 0===d?function(){return null}:d,h=e.navigator,y=e.initialScrollY,_=void 0===y?0:y,b=e.transformSearchClient,g=void 0===b?Nr:b,S=e.disableUserPersonalization,O=void 0!==S&&S,w=e.initialQuery,E=void 0===w?"":w,j=e.translations,P=void 0===j?{}:j,I=e.getMissingResultsUrl,D=e.insights,k=void 0!==D&&D,C=P.footer,A=P.searchBox,x=$e(P,wo),N=Ze(Be.useState({query:"",collections:[],completion:null,context:{},isOpen:!1,activeItemId:null,status:"idle"}),2),T=N[0],R=N[1],q=Be.useRef(null),L=Be.useRef(null),M=Be.useRef(null),H=Be.useRef(null),U=Be.useRef(null),F=Be.useRef(10),B=Be.useRef("undefined"!=typeof window?window.getSelection().toString().slice(0,64):"").current,V=Be.useRef(E||B).current,K=function(e,t,n){return Be.useMemo((function(){var r=Oo(e,t);return r.addAlgoliaAgent("docsearch","3.6.1"),!1===/docsearch.js \(.*\)/.test(r.transporter.userAgent.value)&&r.addAlgoliaAgent("docsearch-react","3.6.1"),n(r)}),[e,t,n])}(t,n,g),W=Be.useRef(Jr({key:"__DOCSEARCH_FAVORITE_SEARCHES__".concat(r),limit:10})).current,z=Be.useRef(Jr({key:"__DOCSEARCH_RECENT_SEARCHES__".concat(r),limit:0===W.getAll().length?7:4})).current,J=Be.useCallback((function(e){if(!O){var t="content"===e.type?e.__docsearch_parent:e;t&&-1===W.getAll().findIndex((function(e){return e.objectID===t.objectID}))&&z.add(t)}}),[W,z,O]),$=Be.useCallback((function(e){if(T.context.algoliaInsightsPlugin&&e.__autocomplete_id){var t=e,n={eventName:"Item Selected",index:t.__autocomplete_indexName,items:[t],positions:[e.__autocomplete_id],queryID:t.__autocomplete_queryID};T.context.algoliaInsightsPlugin.insights.clickedObjectIDsAfterSearch(n)}}),[T.context.algoliaInsightsPlugin]),Z=Be.useMemo((function(){return ur({id:"docsearch",defaultActiveItemId:0,placeholder:i,openOnFocus:!0,initialState:{query:V,context:{searchSuggestions:[]}},insights:k,navigator:h,onStateChange:function(e){R(e.state)},getSources:function(e){var o=e.query,i=e.state,u=e.setContext,s=e.setStatus;if(!o)return O?[]:[{sourceId:"recentSearches",onSelect:function(e){var t=e.item,n=e.event;J(t),Tr(n)||l()},getItemUrl:function(e){return e.item.url},getItems:function(){return z.getAll()}},{sourceId:"favoriteSearches",onSelect:function(e){var t=e.item,n=e.event;J(t),Tr(n)||l()},getItemUrl:function(e){return e.item.url},getItems:function(){return W.getAll()}}];var p=Boolean(k);return K.search([{query:o,indexName:r,params:We({attributesToRetrieve:["hierarchy.lvl0","hierarchy.lvl1","hierarchy.lvl2","hierarchy.lvl3","hierarchy.lvl4","hierarchy.lvl5","hierarchy.lvl6","content","type","url"],attributesToSnippet:["hierarchy.lvl1:".concat(F.current),"hierarchy.lvl2:".concat(F.current),"hierarchy.lvl3:".concat(F.current),"hierarchy.lvl4:".concat(F.current),"hierarchy.lvl5:".concat(F.current),"hierarchy.lvl6:".concat(F.current),"content:".concat(F.current)],snippetEllipsisText:"…",highlightPreTag:"<mark>",highlightPostTag:"</mark>",hitsPerPage:20,clickAnalytics:p},c)}]).catch((function(e){throw"RetryError"===e.name&&s("error"),e})).then((function(e){var o=e.results[0],c=o.hits,s=o.nbHits,m=xr(c,(function(e){return Mr(e)}),a);i.context.searchSuggestions.length<Object.keys(m).length&&u({searchSuggestions:Object.keys(m)}),u({nbHits:s});var d={};return p&&(d={__autocomplete_indexName:r,__autocomplete_queryID:o.queryID,__autocomplete_algoliaCredentials:{appId:t,apiKey:n}}),Object.values(m).map((function(e,t){return{sourceId:"hits".concat(t),onSelect:function(e){var t=e.item,n=e.event;J(t),Tr(n)||l()},getItemUrl:function(e){return e.item.url},getItems:function(){return Object.values(xr(e,(function(e){return e.hierarchy.lvl1}),a)).map(f).map((function(e){return e.map((function(t){var n=null,r=e.find((function(e){return"lvl1"===e.type&&e.hierarchy.lvl1===t.hierarchy.lvl1}));return"lvl1"!==t.type&&r&&(n=r),We(We({},t),{},{__docsearch_parent:n},d)}))})).flat()}}}))}))}})}),[r,c,a,K,l,z,W,J,V,i,h,f,O,k,t,n]),Q=Z.getEnvironmentProps,Y=Z.getRootProps,G=Z.refresh;return function(e){var t=e.getEnvironmentProps,n=e.panelElement,r=e.formElement,o=e.inputElement;Be.useEffect((function(){if(n&&r&&o){var e=t({panelElement:n,formElement:r,inputElement:o}),i=e.onTouchStart,c=e.onTouchMove;return window.addEventListener("touchstart",i),window.addEventListener("touchmove",c),function(){window.removeEventListener("touchstart",i),window.removeEventListener("touchmove",c)}}}),[t,n,r,o])}({getEnvironmentProps:Q,panelElement:H.current,formElement:M.current,inputElement:U.current}),function(e){var t=e.container;Be.useEffect((function(){if(t){var e=t.querySelectorAll("a[href]:not([disabled]), button:not([disabled]), input:not([disabled])"),n=e[0],r=e[e.length-1];return t.addEventListener("keydown",o),function(){t.removeEventListener("keydown",o)}}function o(e){"Tab"===e.key&&(e.shiftKey?document.activeElement===n&&(e.preventDefault(),r.focus()):document.activeElement===r&&(e.preventDefault(),n.focus()))}}),[t])}({container:q.current}),Be.useEffect((function(){return document.body.classList.add("DocSearch--active"),function(){var e,t;document.body.classList.remove("DocSearch--active"),null===(e=(t=window).scrollTo)||void 0===e||e.call(t,0,_)}}),[]),Be.useEffect((function(){window.matchMedia("(max-width: 768px)").matches&&(F.current=5)}),[]),Be.useEffect((function(){H.current&&(H.current.scrollTop=0)}),[T.query]),Be.useEffect((function(){V.length>0&&(G(),U.current&&U.current.focus())}),[V,G]),Be.useEffect((function(){function e(){if(L.current){var e=.01*window.innerHeight;L.current.style.setProperty("--docsearch-vh","".concat(e,"px"))}}return e(),window.addEventListener("resize",e),function(){window.removeEventListener("resize",e)}}),[]),Be.createElement("div",Je({ref:q},Y({"aria-expanded":!0}),{className:["DocSearch","DocSearch-Container","stalled"===T.status&&"DocSearch-Container--Stalled","error"===T.status&&"DocSearch-Container--Errored"].filter(Boolean).join(" "),role:"button",tabIndex:0,onMouseDown:function(e){e.target===e.currentTarget&&l()}}),Be.createElement("div",{className:"DocSearch-Modal",ref:L},Be.createElement("header",{className:"DocSearch-SearchBar",ref:M},Be.createElement(Wr,Je({},Z,{state:T,autoFocus:0===V.length,inputRef:U,isFromSelection:Boolean(V)&&V===B,translations:A,onClose:l}))),Be.createElement("div",{className:"DocSearch-Dropdown",ref:H},Be.createElement(Vr,Je({},Z,{indexName:r,state:T,hitComponent:m,resultsFooterComponent:v,disableUserPersonalization:O,recentSearches:z,favoriteSearches:W,inputRef:U,translations:x,getMissingResultsUrl:I,onItemClick:function(e,t){$(e),J(e),Tr(t)||l()}}))),Be.createElement("footer",{className:"DocSearch-Footer"},Be.createElement(fr,{translations:C}))))}function jo(e){var t,n,r=Be.useRef(null),o=Ze(Be.useState(!1),2),i=o[0],c=o[1],a=Ze(Be.useState((null==e?void 0:e.initialQuery)||void 0),2),u=a[0],l=a[1],s=Be.useCallback((function(){c(!0)}),[c]),f=Be.useCallback((function(){c(!1)}),[c]);return function(e){var t=e.isOpen,n=e.onOpen,r=e.onClose,o=e.onInput,i=e.searchButtonRef;Be.useEffect((function(){function e(e){var c;(27===e.keyCode&&t||"k"===(null===(c=e.key)||void 0===c?void 0:c.toLowerCase())&&(e.metaKey||e.ctrlKey)||!function(e){var t=e.target,n=t.tagName;return t.isContentEditable||"INPUT"===n||"SELECT"===n||"TEXTAREA"===n}(e)&&"/"===e.key&&!t)&&(e.preventDefault(),t?r():document.body.classList.contains("DocSearch--active")||document.body.classList.contains("DocSearch--active")||n()),i&&i.current===document.activeElement&&o&&/[a-zA-Z0-9]/.test(String.fromCharCode(e.keyCode))&&o(e)}return window.addEventListener("keydown",e),function(){window.removeEventListener("keydown",e)}}),[t,n,r,o,i])}({isOpen:i,onOpen:s,onClose:f,onInput:Be.useCallback((function(e){c(!0),l(e.key)}),[c,l]),searchButtonRef:r}),Be.createElement(Be.Fragment,null,Be.createElement(tt,{ref:r,translations:null==e||null===(t=e.translations)||void 0===t?void 0:t.button,onClick:s}),i&&Ie(Be.createElement(Eo,Je({},e,{initialScrollY:window.scrollY,initialQuery:u,translations:null==e||null===(n=e.translations)||void 0===n?void 0:n.modal,onClose:f})),document.body))}return function(e){Ae(Be.createElement(jo,o({},e,{transformSearchClient:function(t){return t.addAlgoliaAgent("docsearch.js","3.6.1"),e.transformSearchClient?e.transformSearchClient(t):t}})),function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:window;return"string"==typeof e?t.document.querySelector(e):e}(e.container,e.environment))}}));
 //# sourceMappingURL=index.js.map
diff --git a/website/assets/images/articles/debunk-the-cross-platform-myth-600x521@2x.png b/website/assets/images/articles/debunk-the-cross-platform-myth-600x521@2x.png
new file mode 100644
index 000000000000..732c38a75420
Binary files /dev/null and b/website/assets/images/articles/debunk-the-cross-platform-myth-600x521@2x.png differ
diff --git a/website/assets/images/articles/deploy-security-agents-1600x900@2x.png b/website/assets/images/articles/deploy-security-agents-1600x900@2x.png
new file mode 100644
index 000000000000..60d79cac6ccb
Binary files /dev/null and b/website/assets/images/articles/deploy-security-agents-1600x900@2x.png differ
diff --git a/website/assets/images/articles/discovering-chrome-ai-using-fleet-1-1472x370@2x.png b/website/assets/images/articles/discovering-chrome-ai-using-fleet-1-1472x370@2x.png
new file mode 100644
index 000000000000..6ff5d63033a6
Binary files /dev/null and b/website/assets/images/articles/discovering-chrome-ai-using-fleet-1-1472x370@2x.png differ
diff --git a/website/assets/images/articles/discovering-chrome-ai-using-fleet-1600x900@2x.jpg b/website/assets/images/articles/discovering-chrome-ai-using-fleet-1600x900@2x.jpg
new file mode 100644
index 000000000000..e86a679ec569
Binary files /dev/null and b/website/assets/images/articles/discovering-chrome-ai-using-fleet-1600x900@2x.jpg differ
diff --git a/website/assets/images/articles/discovering-chrome-ai-using-fleet-2-1474x276@2x.png b/website/assets/images/articles/discovering-chrome-ai-using-fleet-2-1474x276@2x.png
new file mode 100644
index 000000000000..bb0a530d3e33
Binary files /dev/null and b/website/assets/images/articles/discovering-chrome-ai-using-fleet-2-1474x276@2x.png differ
diff --git a/website/assets/images/articles/enhancing-k-12-cybersecurity-with-fcc-funds-and-fleet-1600x900@2x.png b/website/assets/images/articles/enhancing-k-12-cybersecurity-with-fcc-funds-and-fleet-1600x900@2x.png
new file mode 100644
index 000000000000..387c33346067
Binary files /dev/null and b/website/assets/images/articles/enhancing-k-12-cybersecurity-with-fcc-funds-and-fleet-1600x900@2x.png differ
diff --git a/website/assets/images/articles/fleet-4.54.0-1600x900@2x.png b/website/assets/images/articles/fleet-4.54.0-1600x900@2x.png
new file mode 100644
index 000000000000..548ffc70839d
Binary files /dev/null and b/website/assets/images/articles/fleet-4.54.0-1600x900@2x.png differ
diff --git a/website/assets/images/articles/fleet-4.55.0-1600x900@2x.png b/website/assets/images/articles/fleet-4.55.0-1600x900@2x.png
new file mode 100644
index 000000000000..6d5b25e8f6a7
Binary files /dev/null and b/website/assets/images/articles/fleet-4.55.0-1600x900@2x.png differ
diff --git a/website/assets/images/articles/fleet-4.56.0-1600x900@2x.png b/website/assets/images/articles/fleet-4.56.0-1600x900@2x.png
new file mode 100644
index 000000000000..697877bc6c02
Binary files /dev/null and b/website/assets/images/articles/fleet-4.56.0-1600x900@2x.png differ
diff --git a/website/assets/images/articles/fleet-in-your-calendar-introducing-maintenance-windows-2-900x450@2x.png b/website/assets/images/articles/fleet-in-your-calendar-introducing-maintenance-windows-2-900x450@2x.png
index 8405577e42fd..468a372a38ae 100644
Binary files a/website/assets/images/articles/fleet-in-your-calendar-introducing-maintenance-windows-2-900x450@2x.png and b/website/assets/images/articles/fleet-in-your-calendar-introducing-maintenance-windows-2-900x450@2x.png differ
diff --git a/website/assets/images/articles/fleet-in-your-calendar-introducing-maintenance-windows-cover-900x450@2x.png b/website/assets/images/articles/fleet-in-your-calendar-introducing-maintenance-windows-cover-900x450@2x.png
index cb61dba9bba0..8537b5e285f7 100644
Binary files a/website/assets/images/articles/fleet-in-your-calendar-introducing-maintenance-windows-cover-900x450@2x.png and b/website/assets/images/articles/fleet-in-your-calendar-introducing-maintenance-windows-cover-900x450@2x.png differ
diff --git a/website/assets/images/articles/install-vpp-apps-on-macos-using-fleet-1600x900@2x.png b/website/assets/images/articles/install-vpp-apps-on-macos-using-fleet-1600x900@2x.png
new file mode 100644
index 000000000000..514b510e0ba3
Binary files /dev/null and b/website/assets/images/articles/install-vpp-apps-on-macos-using-fleet-1600x900@2x.png differ
diff --git a/website/assets/images/articles/managing-labels-in-fleet-1600x900@2x.png b/website/assets/images/articles/managing-labels-in-fleet-1600x900@2x.png
new file mode 100644
index 000000000000..21883b175c4e
Binary files /dev/null and b/website/assets/images/articles/managing-labels-in-fleet-1600x900@2x.png differ
diff --git a/website/assets/images/articles/seamless-mdm-migration-1600x900@2x.png b/website/assets/images/articles/seamless-mdm-migration-1600x900@2x.png
new file mode 100644
index 000000000000..abd44fa01f11
Binary files /dev/null and b/website/assets/images/articles/seamless-mdm-migration-1600x900@2x.png differ
diff --git a/website/assets/images/articles/software-self-service-1600x900@2x.png b/website/assets/images/articles/software-self-service-1600x900@2x.png
new file mode 100644
index 000000000000..60d79cac6ccb
Binary files /dev/null and b/website/assets/images/articles/software-self-service-1600x900@2x.png differ
diff --git a/website/assets/images/continue-thumbnail.png b/website/assets/images/continue-thumbnail.png
deleted file mode 100644
index 4c3f8c39b8c4..000000000000
Binary files a/website/assets/images/continue-thumbnail.png and /dev/null differ
diff --git a/website/assets/images/cropped-fleet-cloud-city-504x784@2x.png b/website/assets/images/cropped-fleet-cloud-city-504x784@2x.png
new file mode 100644
index 000000000000..5f9c3c7aed7d
Binary files /dev/null and b/website/assets/images/cropped-fleet-cloud-city-504x784@2x.png differ
diff --git a/website/assets/images/cta-thumbnail-psystage-2-aware-128x128@2x.png b/website/assets/images/cta-thumbnail-psystage-2-aware-128x128@2x.png
new file mode 100644
index 000000000000..abca22f145a4
Binary files /dev/null and b/website/assets/images/cta-thumbnail-psystage-2-aware-128x128@2x.png differ
diff --git a/website/assets/images/cta-thumbnail-psystage-3-intrigued-128x128@2x.png b/website/assets/images/cta-thumbnail-psystage-3-intrigued-128x128@2x.png
new file mode 100644
index 000000000000..488291df405a
Binary files /dev/null and b/website/assets/images/cta-thumbnail-psystage-3-intrigued-128x128@2x.png differ
diff --git a/website/assets/images/cta-thumbnail-psystage-4-has-use-case-128x128@2x.png b/website/assets/images/cta-thumbnail-psystage-4-has-use-case-128x128@2x.png
new file mode 100644
index 000000000000..29347073c01c
Binary files /dev/null and b/website/assets/images/cta-thumbnail-psystage-4-has-use-case-128x128@2x.png differ
diff --git a/website/assets/images/cta-thumbnail-psystage-5-100x100@2x.png b/website/assets/images/cta-thumbnail-psystage-5-100x100@2x.png
new file mode 100644
index 000000000000..3fa69407ac73
Binary files /dev/null and b/website/assets/images/cta-thumbnail-psystage-5-100x100@2x.png differ
diff --git a/website/assets/images/email-header-959x452@2x.png b/website/assets/images/email-header-959x452@2x.png
new file mode 100644
index 000000000000..56cbe19b56a3
Binary files /dev/null and b/website/assets/images/email-header-959x452@2x.png differ
diff --git a/website/assets/images/fleet-profile-image.png b/website/assets/images/fleet-profile-image.png
new file mode 100644
index 000000000000..3d28053398fc
Binary files /dev/null and b/website/assets/images/fleet-profile-image.png differ
diff --git a/website/assets/images/icon-form-success-12x12@2x.png b/website/assets/images/icon-form-success-12x12@2x.png
deleted file mode 100644
index d09d7c921454..000000000000
Binary files a/website/assets/images/icon-form-success-12x12@2x.png and /dev/null differ
diff --git a/website/assets/images/icon-form-success-16x16@2x.png b/website/assets/images/icon-form-success-16x16@2x.png
new file mode 100644
index 000000000000..dd0d96c99bc6
Binary files /dev/null and b/website/assets/images/icon-form-success-16x16@2x.png differ
diff --git a/website/assets/images/logo-secureframe-46x48@2x.png b/website/assets/images/logo-secureframe-46x48@2x.png
new file mode 100644
index 000000000000..86107888f9aa
Binary files /dev/null and b/website/assets/images/logo-secureframe-46x48@2x.png differ
diff --git a/website/assets/images/mdm-debunk-cross-platform-myth-528x377@2x.png b/website/assets/images/mdm-debunk-cross-platform-myth-528x377@2x.png
new file mode 100644
index 000000000000..62e14187e25c
Binary files /dev/null and b/website/assets/images/mdm-debunk-cross-platform-myth-528x377@2x.png differ
diff --git a/website/assets/images/permanent/mdm-ade-migration-1024x500.png b/website/assets/images/permanent/mdm-ade-migration-1024x500.png
new file mode 100644
index 000000000000..461d1de9b649
Binary files /dev/null and b/website/assets/images/permanent/mdm-ade-migration-1024x500.png differ
diff --git a/website/assets/images/permanent/mdm-manual-migration-1024x500.png b/website/assets/images/permanent/mdm-manual-migration-1024x500.png
new file mode 100644
index 000000000000..f7700d4bde2a
Binary files /dev/null and b/website/assets/images/permanent/mdm-manual-migration-1024x500.png differ
diff --git a/website/assets/images/permanent/mdm-migration-pre-sonoma-unenroll-1024x500.png b/website/assets/images/permanent/mdm-migration-pre-sonoma-unenroll-1024x500.png
new file mode 100644
index 000000000000..993bcbd72e3b
Binary files /dev/null and b/website/assets/images/permanent/mdm-migration-pre-sonoma-unenroll-1024x500.png differ
diff --git a/website/assets/images/psystage-1-unaware-558x680@2x.png b/website/assets/images/psystage-1-unaware-558x680@2x.png
new file mode 100644
index 000000000000..af3cf08fcc37
Binary files /dev/null and b/website/assets/images/psystage-1-unaware-558x680@2x.png differ
diff --git a/website/assets/images/psystage-2-aware-508x784@2x.png b/website/assets/images/psystage-2-aware-508x784@2x.png
new file mode 100644
index 000000000000..2f3d6b4b00d8
Binary files /dev/null and b/website/assets/images/psystage-2-aware-508x784@2x.png differ
diff --git a/website/assets/images/psystage-3-intrigued-558x680@2x.png b/website/assets/images/psystage-3-intrigued-558x680@2x.png
new file mode 100644
index 000000000000..c4759ba068af
Binary files /dev/null and b/website/assets/images/psystage-3-intrigued-558x680@2x.png differ
diff --git a/website/assets/images/psystage-4-has-use-case-508x784@2x.png b/website/assets/images/psystage-4-has-use-case-508x784@2x.png
new file mode 100644
index 000000000000..74d52db71b4f
Binary files /dev/null and b/website/assets/images/psystage-4-has-use-case-508x784@2x.png differ
diff --git a/website/assets/images/psystage-6-has-team-buy-in-504x784@2x.png b/website/assets/images/psystage-6-has-team-buy-in-504x784@2x.png
new file mode 100644
index 000000000000..f601641ec4af
Binary files /dev/null and b/website/assets/images/psystage-6-has-team-buy-in-504x784@2x.png differ
diff --git a/website/assets/images/testimonial-author-joe-pistone-100x100@2x.png b/website/assets/images/testimonial-author-joe-pistone-100x100@2x.png
new file mode 100644
index 000000000000..d857bf7700c2
Binary files /dev/null and b/website/assets/images/testimonial-author-joe-pistone-100x100@2x.png differ
diff --git a/website/assets/images/testimonial-authour-alvaro-gutierrez-100x100@2x.png b/website/assets/images/testimonial-authour-alvaro-gutierrez-100x100@2x.png
new file mode 100644
index 000000000000..6535cf11d226
Binary files /dev/null and b/website/assets/images/testimonial-authour-alvaro-gutierrez-100x100@2x.png differ
diff --git a/website/assets/js/cloud.setup.js b/website/assets/js/cloud.setup.js
index 35dfbb7981d5..9c08e4dde162 100644
--- a/website/assets/js/cloud.setup.js
+++ b/website/assets/js/cloud.setup.js
@@ -13,7 +13,7 @@
 Cloud.setup({
 
   /* eslint-disable */
-  methods: {"downloadSitemap":{"verb":"GET","url":"/sitemap.xml","args":[]},"downloadRssFeed":{"verb":"GET","url":"/rss/:categoryName","args":["categoryName"]},"receiveUsageAnalytics":{"verb":"POST","url":"/api/v1/webhooks/receive-usage-analytics","args":["anonymousIdentifier","fleetVersion","licenseTier","numHostsEnrolled","numUsers","numTeams","numPolicies","numLabels","softwareInventoryEnabled","vulnDetectionEnabled","systemUsersEnabled","hostsStatusWebHookEnabled","numWeeklyActiveUsers","numWeeklyPolicyViolationDaysActual","numWeeklyPolicyViolationDaysPossible","hostsEnrolledByOperatingSystem","hostsEnrolledByOrbitVersion","hostsEnrolledByOsqueryVersion","storedErrors","numHostsNotResponding","organization","mdmMacOsEnabled","mdmWindowsEnabled","liveQueryDisabled","hostExpiryEnabled"]},"receiveFromGithub":{"verb":"GET","url":"/api/v1/webhooks/github","args":["botSignature","action","sender","repository","changes","issue","comment","pull_request","label","release"]},"receiveFromStripe":{"verb":"POST","url":"/api/v1/webhooks/receive-from-stripe","args":["id","type","data","webhookSecret"]},"deliverContactFormMessage":{"verb":"POST","url":"/api/v1/deliver-contact-form-message","args":["emailAddress","firstName","lastName","message"]},"sendPasswordRecoveryEmail":{"verb":"POST","url":"/api/v1/entrance/send-password-recovery-email","args":["emailAddress"]},"signup":{"verb":"POST","url":"/api/v1/customers/signup","args":["emailAddress","password","organization","firstName","lastName","signupReason"]},"updateProfile":{"verb":"POST","url":"/api/v1/account/update-profile","args":["firstName","lastName","organization","emailAddress"]},"updatePassword":{"verb":"POST","url":"/api/v1/account/update-password","args":["oldPassword","newPassword"]},"updateBillingCard":{"verb":"POST","url":"/api/v1/account/update-billing-card","args":["stripeToken","billingCardLast4","billingCardBrand","billingCardExpMonth","billingCardExpYear"]},"login":{"verb":"POST","url":"/api/v1/customers/login","args":["emailAddress","password","rememberMe"]},"logout":{"verb":"GET","url":"/api/v1/account/logout","args":[]},"createQuote":{"verb":"POST","url":"/api/v1/customers/create-quote","args":["numberOfHosts"]},"saveBillingInfoAndSubscribe":{"verb":"POST","url":"/api/v1/customers/save-billing-info-and-subscribe","args":["quoteId","organization","firstName","lastName","paymentSource"]},"updatePasswordAndLogin":{"verb":"POST","url":"/api/v1/entrance/update-password-and-login","args":["password","token"]},"deliverDemoSignup":{"verb":"POST","url":"/api/v1/deliver-demo-signup","args":["emailAddress"]},"createOrUpdateOneNewsletterSubscription":{"verb":"POST","url":"/api/v1/create-or-update-one-newsletter-subscription","args":["emailAddress","subscribeTo"]},"unsubscribeFromAllNewsletters":{"verb":"GET","url":"/api/v1/unsubscribe-from-all-newsletters","args":["emailAddress"]},"buildLicenseKey":{"verb":"POST","url":"/api/v1/admin/build-license-key","args":["numberOfHosts","organization","expiresAt","partnerName"]},"createVantaAuthorizationRequest":{"verb":"POST","url":"/api/v1/create-vanta-authorization-request","args":["emailAddress","fleetInstanceUrl","fleetApiKey"]},"deliverMdmBetaSignup":{"verb":"POST","url":"/api/v1/deliver-mdm-beta-signup","args":["emailAddress","fullName","jobTitle","numberOfHosts"]},"getHumanInterpretationFromOsquerySql":{"verb":"POST","url":"/api/v1/get-human-interpretation-from-osquery-sql","args":["sql"]},"deliverAppleCsr":{"verb":"POST","url":"/api/v1/deliver-apple-csr","args":["unsignedCsrData","deliveryMethod"]},"deliverMdmDemoEmail":{"verb":"POST","url":"/api/v1/deliver-mdm-demo-email","args":["emailAddress"]},"provisionSandboxInstanceAndDeliverEmail":{"verb":"POST","url":"/api/v1/admin/provision-sandbox-instance-and-deliver-email","args":["userId"]},"deliverTalkToUsFormSubmission":{"verb":"POST","url":"/api/v1/deliver-talk-to-us-form-submission","args":["emailAddress","firstName","lastName","organization","numberOfHosts","primaryBuyingSituation"]},"saveQuestionnaireProgress":{"verb":"POST","url":"/api/v1/save-questionnaire-progress","args":["currentStep","formData"]},"updateStartCtaVisibility":{"verb":"POST","url":"/api/v1/account/update-start-cta-visibility","args":[]}}
+  methods: {"downloadSitemap":{"verb":"GET","url":"/sitemap.xml","args":[]},"downloadRssFeed":{"verb":"GET","url":"/rss/:categoryName","args":["categoryName"]},"receiveUsageAnalytics":{"verb":"POST","url":"/api/v1/webhooks/receive-usage-analytics","args":["anonymousIdentifier","fleetVersion","licenseTier","numHostsEnrolled","numUsers","numTeams","numPolicies","numLabels","softwareInventoryEnabled","vulnDetectionEnabled","systemUsersEnabled","hostsStatusWebHookEnabled","numWeeklyActiveUsers","numWeeklyPolicyViolationDaysActual","numWeeklyPolicyViolationDaysPossible","hostsEnrolledByOperatingSystem","hostsEnrolledByOrbitVersion","hostsEnrolledByOsqueryVersion","storedErrors","numHostsNotResponding","organization","mdmMacOsEnabled","mdmWindowsEnabled","liveQueryDisabled","hostExpiryEnabled","numSoftwareVersions","numHostSoftwares","numSoftwareTitles","numHostSoftwareInstalledPaths","numSoftwareCPEs","numSoftwareCVEs"]},"receiveFromGithub":{"verb":"GET","url":"/api/v1/webhooks/github","args":["botSignature","action","sender","repository","changes","issue","comment","pull_request","label","release"]},"receiveFromStripe":{"verb":"POST","url":"/api/v1/webhooks/receive-from-stripe","args":["id","type","data","webhookSecret"]},"deliverContactFormMessage":{"verb":"POST","url":"/api/v1/deliver-contact-form-message","args":["emailAddress","firstName","lastName","message"]},"sendPasswordRecoveryEmail":{"verb":"POST","url":"/api/v1/entrance/send-password-recovery-email","args":["emailAddress"]},"signup":{"verb":"POST","url":"/api/v1/customers/signup","args":["emailAddress","password","organization","firstName","lastName","signupReason"]},"updateProfile":{"verb":"POST","url":"/api/v1/account/update-profile","args":["firstName","lastName","organization","emailAddress"]},"updatePassword":{"verb":"POST","url":"/api/v1/account/update-password","args":["oldPassword","newPassword"]},"updateBillingCard":{"verb":"POST","url":"/api/v1/account/update-billing-card","args":["stripeToken","billingCardLast4","billingCardBrand","billingCardExpMonth","billingCardExpYear"]},"login":{"verb":"POST","url":"/api/v1/customers/login","args":["emailAddress","password","rememberMe"]},"logout":{"verb":"GET","url":"/api/v1/account/logout","args":[]},"createQuote":{"verb":"POST","url":"/api/v1/customers/create-quote","args":["numberOfHosts"]},"saveBillingInfoAndSubscribe":{"verb":"POST","url":"/api/v1/customers/save-billing-info-and-subscribe","args":["quoteId","organization","firstName","lastName","paymentSource"]},"updatePasswordAndLogin":{"verb":"POST","url":"/api/v1/entrance/update-password-and-login","args":["password","token"]},"deliverDemoSignup":{"verb":"POST","url":"/api/v1/deliver-demo-signup","args":["emailAddress"]},"createOrUpdateOneNewsletterSubscription":{"verb":"POST","url":"/api/v1/create-or-update-one-newsletter-subscription","args":["emailAddress","subscribeTo"]},"unsubscribeFromAllNewsletters":{"verb":"GET","url":"/api/v1/unsubscribe-from-all-newsletters","args":["emailAddress"]},"buildLicenseKey":{"verb":"POST","url":"/api/v1/admin/build-license-key","args":["numberOfHosts","organization","expiresAt","partnerName"]},"createVantaAuthorizationRequest":{"verb":"POST","url":"/api/v1/create-vanta-authorization-request","args":["emailAddress","fleetInstanceUrl","fleetApiKey","redirectToExternalPageAfterAuthorization","sharedSecret"]},"redirectVantaAuthorizationRequest":{"verb":"GET","url":"/redirect-vanta-authorization-request","args":["vantaSourceId","state","vantaAuthorizationRequestURL","redirectAfterSetup"]},"deliverMdmBetaSignup":{"verb":"POST","url":"/api/v1/deliver-mdm-beta-signup","args":["emailAddress","fullName","jobTitle","numberOfHosts"]},"getHumanInterpretationFromOsquerySql":{"verb":"POST","url":"/api/v1/get-human-interpretation-from-osquery-sql","args":["sql"]},"deliverAppleCsr":{"verb":"POST","url":"/api/v1/deliver-apple-csr","args":["unsignedCsrData","deliveryMethod"]},"deliverMdmDemoEmail":{"verb":"POST","url":"/api/v1/deliver-mdm-demo-email","args":["emailAddress"]},"provisionSandboxInstanceAndDeliverEmail":{"verb":"POST","url":"/api/v1/admin/provision-sandbox-instance-and-deliver-email","args":["userId"]},"deliverTalkToUsFormSubmission":{"verb":"POST","url":"/api/v1/deliver-talk-to-us-form-submission","args":["emailAddress","firstName","lastName","organization","numberOfHosts","primaryBuyingSituation"]},"saveQuestionnaireProgress":{"verb":"POST","url":"/api/v1/save-questionnaire-progress","args":["currentStep","formData"]},"updateStartCtaVisibility":{"verb":"POST","url":"/api/v1/account/update-start-cta-visibility","args":[]},"deliverDealRegistrationSubmission":{"verb":"POST","url":"/api/v1/deliver-deal-registration-submission","args":["submittersFirstName","submittersLastName","submittersEmailAddress","submittersOrganization","customersFirstName","customersLastName","customersEmailAddress","linkedinUrl","customersOrganization","customersCurrentMdm","otherMdmEvaluated","preferredHosting","expectedDealSize","expectedCloseDate","notes"]}}
   /* eslint-enable */
 
 });
diff --git a/website/assets/js/components/animated-arrow-button.component.js b/website/assets/js/components/animated-arrow-button.component.js
index 00e7df9e7642..d7a42e004923 100644
--- a/website/assets/js/components/animated-arrow-button.component.js
+++ b/website/assets/js/components/animated-arrow-button.component.js
@@ -14,6 +14,8 @@ parasails.registerComponent('animatedArrowButton', {
   //  ╩  ╩╚═╚═╝╩  ╚═╝
   props: [
     'buttonType',
+    'arrowColor',// For customizing the color of the animated arrow. e.g., arrow-color="#FFF"
+    'textColor',// For customizing the color of the button text. e.g., text-color="#FFF"
   ],
 
   //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
@@ -22,6 +24,8 @@ parasails.registerComponent('animatedArrowButton', {
   data: function (){
     return {
       type: 'secondary',
+      strokeColor: this.arrowColor ? this.arrowColor : '#FF5C83',
+      fontColor: this.textColor ? this.textColor : '#192147'
       // FUTURE: support more button types (primary and secondary)
       // type: this.buttonType && this.buttonType === 'primary' ? 'primary' : 'secondary',
     };
@@ -32,8 +36,8 @@ parasails.registerComponent('animatedArrowButton', {
   //  ╩ ╩ ╩ ╩ ╩╩═╝
   template: `
   <a :class="type" style="text-decoration: none;">
-    <span purpose="button-text"><slot name="default"></slot></span>
-    <svg purpose="animated-arrow" xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 12 12">
+    <span purpose="button-text" :style="'color: '+fontColor+';'"><slot name="default"></slot></span>
+    <svg purpose="animated-arrow" :style="'stroke: '+strokeColor+';'" xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 12 12">
       <path purpose="arrow-line" d="M1 6H9" stroke-width="2" stroke-linecap="round"/>
       <path purpose="chevron" d="M1.35712 1L5.64283 6L1.35712 11" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
     </svg>
diff --git a/website/assets/js/pages/articles/articles.page.js b/website/assets/js/pages/articles/articles.page.js
index b4034386e996..8aa5dc260067 100644
--- a/website/assets/js/pages/articles/articles.page.js
+++ b/website/assets/js/pages/articles/articles.page.js
@@ -62,7 +62,22 @@ parasails.registerPage('articles', {
   },
 
   mounted: async function() {
-    //…
+    if(this.category === 'guides') {
+      if(this.algoliaPublicKey) {// Note: Docsearch will only be enabled if sails.config.custom.algoliaPublicKey is set. If the value is undefined, the handbook search will be disabled.
+        docsearch({
+          appId: 'NZXAYZXDGH',
+          apiKey: this.algoliaPublicKey,
+          indexName: 'fleetdm',
+          container: '#docsearch-query',
+          placeholder: 'Search',
+          debug: false,
+          clickAnalytics: true,
+          searchParameters: {
+            facetFilters: ['section:guides']
+          },
+        });
+      }
+    }
   },
 
   //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
diff --git a/website/assets/js/pages/contact.page.js b/website/assets/js/pages/contact.page.js
index 434121b5272f..36571b672ac9 100644
--- a/website/assets/js/pages/contact.page.js
+++ b/website/assets/js/pages/contact.page.js
@@ -62,8 +62,8 @@ parasails.registerPage('contact', {
       this.formDataToPrefillForLoggedInUsers.firstName = this.me.firstName;
       this.formDataToPrefillForLoggedInUsers.lastName = this.me.lastName;
       this.formDataToPrefillForLoggedInUsers.organization = this.me.organization;
-      // Only prefil this information if the user has this value set.
-      if(this.me.primaryBuyingSituation) {
+      // Only prefil this information if the user has this value set to a value that is not VM.
+      if(this.me.primaryBuyingSituation && this.me.primaryBuyingSituation !== 'vm') {
         this.formDataToPrefillForLoggedInUsers.primaryBuyingSituation = this.me.primaryBuyingSituation;
       }
       this.formData = _.clone(this.formDataToPrefillForLoggedInUsers);
@@ -86,6 +86,9 @@ parasails.registerPage('contact', {
       if(typeof window.lintrk !== 'undefined') {
         window.lintrk('track', { conversion_id: 18587089 });// eslint-disable-line camelcase
       }
+      if(typeof analytics !== 'undefined'){
+        analytics.track('fleet_website__contact_forms');
+      }
       // Show the success message.
       this.cloudSuccess = true;
 
@@ -98,6 +101,9 @@ parasails.registerPage('contact', {
       if(typeof window.lintrk !== 'undefined') {
         window.lintrk('track', { conversion_id: 18587089 });// eslint-disable-line camelcase
       }
+      if(typeof analytics !== 'undefined'){
+        analytics.track('fleet_website__contact_forms');
+      }
       if(this.formData.numberOfHosts > 700){
         this.goto(`https://calendly.com/fleetdm/talk-to-us?email=${encodeURIComponent(this.formData.emailAddress)}&name=${encodeURIComponent(this.formData.firstName+' '+this.formData.lastName)}`);
       } else {
diff --git a/website/assets/js/pages/customers/new-license.page.js b/website/assets/js/pages/customers/new-license.page.js
index 6917592f5155..3f1b582300b9 100644
--- a/website/assets/js/pages/customers/new-license.page.js
+++ b/website/assets/js/pages/customers/new-license.page.js
@@ -39,7 +39,31 @@ parasails.registerPage('new-license', {
   //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
   //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
   beforeMount: function() {
-    //…
+    if(window.location.hash) {
+      if(typeof analytics !== 'undefined') {
+        if(window.location.hash === '#signup') {
+          analytics.identify(this.me.id, {
+            email: this.me.emailAddress,
+            firstName: this.me.firstName,
+            lastName: this.me.lastName,
+            company: this.me.organization,
+            primaryBuyingSituation: this.me.primaryBuyingSituation,
+            psychologicalStage: this.me.psychologicalStage,
+          });
+          analytics.track('fleet_website__sign_up');
+        } else if(window.location.hash === '#login') {
+          analytics.identify(this.me.id, {
+            email: this.me.emailAddress,
+            firstName: this.me.firstName,
+            lastName: this.me.lastName,
+            company: this.me.organization,
+            primaryBuyingSituation: this.me.primaryBuyingSituation,
+            psychologicalStage: this.me.psychologicalStage,
+          });
+        }
+      }
+      window.location.hash = '';
+    }
   },
   mounted: async function() {
 
diff --git a/website/assets/js/pages/deals.page.js b/website/assets/js/pages/deals.page.js
new file mode 100644
index 000000000000..70a184f262db
--- /dev/null
+++ b/website/assets/js/pages/deals.page.js
@@ -0,0 +1,74 @@
+parasails.registerPage('deals', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    // Form data
+    formData: {
+      submittersOrganization: 'CDW',
+    },
+
+    // For tracking client-side validation errors in our form.
+    // > Has property set to `true` for each invalid property in `formData`.
+    formErrors: { /* … */ },
+
+    // Form rules
+    formRules: {
+      submittersFirstName: { required: true },
+      submittersLastName: { required: true },
+      submittersEmailAddress: { required: true, isEmail: true },
+      submittersOrganization: { required: true },
+      customersFirstName: { required: true },
+      customersLastName: { required: true },
+      customersEmailAddress: { required: true, isEmail: true },
+      customersOrganization: { required: true },
+      expectedDealSize: { required: true },
+      expectedCloseDate: { required: true },
+    },
+    // Syncing / loading state
+    syncing: false,
+    // Server error state
+    cloudError: '',
+    showSuccessMessage: false,
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+    submittedForm: async function() {
+      this.syncing = false;
+      this.showSuccessMessage = true;
+    },
+    clickResetForm: async function() {
+      this.showSuccessMessage = false;
+      this.cloudError = '';
+      this.formErrors = {};
+      this.formData = {
+        submittersOrganization: 'CDW',
+      };
+      await this.forceRender();
+    },
+
+    clickChoosePreferredHosting: async function(value){
+      this.formData.preferredHosting = value;
+      await this.forceRender();
+    },
+
+    typeClearOneFormError: async function(field) {
+      if(this.formErrors[field]){
+        this.formErrors = _.omit(this.formErrors, field);
+      }
+    },
+  }
+});
diff --git a/website/assets/js/pages/device-management.page.js b/website/assets/js/pages/device-management.page.js
index 862894df9650..e13d3917eb72 100644
--- a/website/assets/js/pages/device-management.page.js
+++ b/website/assets/js/pages/device-management.page.js
@@ -4,6 +4,7 @@ parasails.registerPage('device-management-page', {
   //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
   data: {
     modal: '',
+    comparisonMode: 'omnissa'
   },
 
   //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
diff --git a/website/assets/js/pages/docs/basic-documentation.page.js b/website/assets/js/pages/docs/basic-documentation.page.js
index 2c40e629da06..1695eb613d21 100644
--- a/website/assets/js/pages/docs/basic-documentation.page.js
+++ b/website/assets/js/pages/docs/basic-documentation.page.js
@@ -43,7 +43,7 @@ parasails.registerPage('basic-documentation', {
       return _.startsWith(page.url, '/docs');
     });
     this.pagesBySectionSlug = (() => {
-      const DOCS_SLUGS = ['get-started', 'deploy', 'using-fleet', 'configuration', 'rest-api'];
+      const DOCS_SLUGS = ['get-started', 'deploy', 'configuration', 'rest-api'];
       let sectionSlugs = _.uniq(this.pages.map((page) => page.url.split(/\//).slice(-2)[0]));
       let pagesBySectionSlug = {};
 
@@ -129,13 +129,11 @@ parasails.registerPage('basic-documentation', {
     // console.log(subtopics);
 
     this.subtopics = (() => {
-      let subtopics = $('#body-content').find('h2.markdown-heading').map((_, el) => el.innerText);
-      subtopics = $.makeArray(subtopics).map((title) => {
-        // Removing all apostrophes from the title to keep  _.kebabCase() from turning words like 'user’s' into 'user-s'
-        let kebabCaseFriendlyTitle = title.replace(/[\’\']/g, '');
+      let subtopics = $('#body-content').find('h2.markdown-heading').map((_, el) => el);
+      subtopics = $.makeArray(subtopics).map((subheading) => {
         return {
-          title,
-          url: '#' + _.kebabCase(kebabCaseFriendlyTitle.toLowerCase()),
+          title: subheading.innerText,
+          url: $(subheading).find('a.markdown-link').attr('href'),
         };
       });
       return subtopics;
@@ -229,6 +227,9 @@ parasails.registerPage('basic-documentation', {
       if(typeof window.lintrk !== 'undefined') {
         window.lintrk('track', { conversion_id: 18587105 });// eslint-disable-line camelcase
       }
+      if(typeof analytics !== 'undefined'){
+        analytics.track('fleet_website__swag_request');
+      }
       this.goto('https://kqphpqst851.typeform.com/to/ZfA3sOu0');
     },
 
@@ -255,22 +256,23 @@ parasails.registerPage('basic-documentation', {
       return this.pagesBySectionSlug[slug];
     },
 
-    findAndSortNavSectionsByUrl: function (url='') {
-      let NAV_SECTION_ORDER_BY_DOCS_SLUG = {
-        'using-fleet':['The basics', 'Device management', 'Vuln management', 'Security compliance', 'Osquery management', 'Dig deeper'],
-      };
-      let slug = _.last(url.split(/\//));
-      //
-      if(NAV_SECTION_ORDER_BY_DOCS_SLUG[slug]) {
-        let orderForThisSection = NAV_SECTION_ORDER_BY_DOCS_SLUG[slug];
-        let sortedSection = {};
-        orderForThisSection.map((section)=>{
-          sortedSection[section] = this.navSectionsByDocsSectionSlug[slug][section];
-        });
-        this.navSectionsByDocsSectionSlug[slug] = sortedSection;
-      }
-      return this.navSectionsByDocsSectionSlug[slug];
-    },
+    // FUTURE: remove this function if we do not add subsections to docs sections.
+    // findAndSortNavSectionsByUrl: function (url='') {
+    //   let NAV_SECTION_ORDER_BY_DOCS_SLUG = {
+    //     'using-fleet':['The basics', 'Device management', 'Vuln management', 'Security compliance', 'Osquery management', 'Dig deeper'],
+    //   };
+    //   let slug = _.last(url.split(/\//));
+    //   //
+    //   if(NAV_SECTION_ORDER_BY_DOCS_SLUG[slug]) {
+    //     let orderForThisSection = NAV_SECTION_ORDER_BY_DOCS_SLUG[slug];
+    //     let sortedSection = {};
+    //     orderForThisSection.map((section)=>{
+    //       sortedSection[section] = this.navSectionsByDocsSectionSlug[slug][section];
+    //     });
+    //     this.navSectionsByDocsSectionSlug[slug] = sortedSection;
+    //   }
+    //   return this.navSectionsByDocsSectionSlug[slug];
+    // },
 
     getActiveSubtopicClass: function (currentLocation, url) {
       return _.last(currentLocation.split(/#/)) === _.last(url.split(/#/)) ? 'active' : '';
diff --git a/website/assets/js/pages/entrance/login.page.js b/website/assets/js/pages/entrance/login.page.js
index a506effa58d8..a18738b75d53 100644
--- a/website/assets/js/pages/entrance/login.page.js
+++ b/website/assets/js/pages/entrance/login.page.js
@@ -27,7 +27,7 @@ parasails.registerPage('login', {
     showCustomerLogin: true,
     // For redirecting users coming from the "Get your license" link to the license dispenser.
     registerSlug: '/register',
-    pageToRedirectToAfterLogin: '/start',
+    pageToRedirectToAfterLogin: '/start#login',
   },
 
   //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
@@ -41,7 +41,7 @@ parasails.registerPage('login', {
     // If we're redirecting this user to the license dispenser after they log in, modify the link to the /register page and the pageToRedirectToAfterLogin.
     if(window.location.hash && window.location.hash === '#purchaseLicense'){
       this.registerSlug = '/register#purchaseLicense';
-      this.pageToRedirectToAfterLogin = '/new-license';
+      this.pageToRedirectToAfterLogin = '/new-license#login';
       window.location.hash = '';
     }
   },
diff --git a/website/assets/js/pages/entrance/signup.page.js b/website/assets/js/pages/entrance/signup.page.js
index e46b6a4afbbf..d749af7b30a2 100644
--- a/website/assets/js/pages/entrance/signup.page.js
+++ b/website/assets/js/pages/entrance/signup.page.js
@@ -26,7 +26,8 @@ parasails.registerPage('signup', {
     showFullForm: false,
     // For redirecting users coming from the "Get your license" link to the license dispenser.
     loginSlug: '/login',
-    pageToRedirectToAfterRegistration: '/start',
+    pageToRedirectToAfterRegistration: '/start#signup',
+    primaryBuyingSituation: undefined
   },
 
   //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
@@ -36,7 +37,7 @@ parasails.registerPage('signup', {
     // If we're redirecting this user to the license dispenser after they sign up, modify the link to the login page and the pageToRedirectToAfterRegistration
     if(window.location.hash && window.location.hash === '#purchaseLicense'){
       this.loginSlug = '/login#purchaseLicense';
-      this.pageToRedirectToAfterRegistration = '/new-license';
+      this.pageToRedirectToAfterRegistration = '/new-license#signup';
       window.location.hash = '';
     }
   },
diff --git a/website/assets/js/pages/homepage.page.js b/website/assets/js/pages/homepage.page.js
index 5a5100cebc28..b9bfc560b4ce 100644
--- a/website/assets/js/pages/homepage.page.js
+++ b/website/assets/js/pages/homepage.page.js
@@ -12,6 +12,10 @@ parasails.registerPage('homepage', {
   //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
   beforeMount: function() {
     //…
+    if(window.location.hash === '#unsubscribed'){
+      this.modal = 'unsubscribed';
+      window.location.hash = '';
+    }
   },
   mounted: async function() {
     //…
diff --git a/website/assets/js/pages/start.page.js b/website/assets/js/pages/start.page.js
index ac31cb69d47c..3b95e7218bc3 100644
--- a/website/assets/js/pages/start.page.js
+++ b/website/assets/js/pages/start.page.js
@@ -18,6 +18,7 @@ parasails.registerPage('start', {
       'what-does-your-team-manage-eo-it': {},
       'what-does-your-team-manage-vm': {},
       'what-do-you-manage-mdm': {},
+      'cross-platform-mdm': {stepCompleted: true},
       'is-it-any-good': {stepCompleted: true},
       'what-did-you-think': {},
       'deploy-fleet-in-your-environment': {stepCompleted: true},
@@ -25,6 +26,8 @@ parasails.registerPage('start', {
       'how-was-your-deployment': {},
       'whats-left-to-get-you-set-up': {},
     },
+
+    psychologicalStage: '2 - Aware',
     // For tracking client-side validation errors in our form.
     // > Has property set to `true` for each invalid property in `formData`.
     formErrors: { /* … */ },
@@ -73,6 +76,7 @@ parasails.registerPage('start', {
 
     // Success state when form has been submitted
     cloudSuccess: false,
+    primaryBuyingSituation: undefined,
   },
 
   //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
@@ -85,7 +89,37 @@ parasails.registerPage('start', {
     }
     // If this user has not completed the 'what are you using fleet for' step, and has a primaryBuyingSituation set by an ad. prefill the formData for this step.
     if(this.primaryBuyingSituation && _.isEmpty(this.formData['what-are-you-using-fleet-for'])){
-      this.formData['what-are-you-using-fleet-for'] = {primaryBuyingSituation: this.primaryBuyingSituation};
+      if(this.primaryBuyingSituation !== 'vm') {
+        this.formData['what-are-you-using-fleet-for'] = {primaryBuyingSituation: this.primaryBuyingSituation};
+      }
+    }
+    if(this.me.psychologicalStage){
+      this.psychologicalStage = this.me.psychologicalStage;
+    }
+    if(window.location.hash) {
+      if(typeof analytics !== 'undefined') {
+        if(window.location.hash === '#signup') {
+          analytics.identify(this.me.id, {
+            email: this.me.emailAddress,
+            firstName: this.me.firstName,
+            lastName: this.me.lastName,
+            company: this.me.organization,
+            primaryBuyingSituation: this.me.primaryBuyingSituation,
+            psychologicalStage: this.me.psychologicalStage,
+          });
+          analytics.track('fleet_website__sign_up');
+        } else if(window.location.hash === '#login') {
+          analytics.identify(this.me.id, {
+            email: this.me.emailAddress,
+            firstName: this.me.firstName,
+            lastName: this.me.lastName,
+            company: this.me.organization,
+            primaryBuyingSituation: this.me.primaryBuyingSituation,
+            psychologicalStage: this.me.psychologicalStage,
+          });
+        }
+      }
+      window.location.hash = '';
     }
   },
   mounted: async function() {
@@ -99,11 +133,24 @@ parasails.registerPage('start', {
     handleSubmittingForm: async function(argins) {
       let formDataForThisStep = _.clone(argins);
       let nextStep = this.getNextStep();
-      let getStartedProgress = await Cloud.saveQuestionnaireProgress.with({
+      let questionanireProgress = await Cloud.saveQuestionnaireProgress.with({
         currentStep: this.currentStep,
         formData: formDataForThisStep,
       });
-      this.previouslyAnsweredQuestions[this.currentStep] = getStartedProgress[this.currentStep];
+
+      this.previouslyAnsweredQuestions[this.currentStep] = questionanireProgress.getStartedProgress[this.currentStep];
+      this.psychologicalStage = questionanireProgress.psychologicalStage;
+      this.primaryBuyingSituation = questionanireProgress.primaryBuyingSituation;
+      if(typeof analytics !== 'undefined') {
+        analytics.identify(this.me.id, {
+          email: this.me.emailAddress,
+          firstName: this.me.firstName,
+          lastName: this.me.lastName,
+          company: this.me.organization,
+          primaryBuyingSituation: this.primaryBuyingSituation,
+          psychologicalStage: this.psychologicalStage,
+        });
+      }
       if(_.startsWith(nextStep, '/')){
         this.goto(nextStep);
       } else {
@@ -113,6 +160,9 @@ parasails.registerPage('start', {
     },
     clickGoToPreviousStep: async function() {
       switch(this.currentStep) {
+        case 'what-are-you-using-fleet-for':
+          this.currentStep = 'start';
+          break;
         case 'have-you-ever-used-fleet':
           this.currentStep = 'what-are-you-using-fleet-for';
           break;
@@ -148,9 +198,12 @@ parasails.registerPage('start', {
           } else if(primaryBuyingSituation === 'vm') {
             this.currentStep = 'what-does-your-team-manage-vm';
           } else if(primaryBuyingSituation === 'mdm') {
-            this.currentStep = 'what-do-you-manage-mdm';
+            this.currentStep = 'cross-platform-mdm';
           }
           break;
+        case 'cross-platform-mdm':
+          this.currentStep = 'what-do-you-manage-mdm';
+          break;
         case 'lets-talk-to-your-team':
           this.currentStep = 'how-many-hosts';
           break;
@@ -247,6 +300,9 @@ parasails.registerPage('start', {
           nextStepInForm = 'is-it-any-good';
           break;
         case 'what-do-you-manage-mdm':
+          nextStepInForm = 'cross-platform-mdm';
+          break;
+        case 'cross-platform-mdm':
           nextStepInForm = 'is-it-any-good';
           break;
         case 'is-it-any-good':
@@ -273,7 +329,7 @@ parasails.registerPage('start', {
           } else if(this.formData['how-was-your-deployment'].howWasYourDeployment === 'kinda-stuck'){
             nextStepInForm = '/contact';
           } else if(this.formData['how-was-your-deployment'].howWasYourDeployment === 'havent-gotten-to-it') {
-            nextStepInForm = 'deploy-fleet-in-your-environment';
+            nextStepInForm = '/contact';
           } else if(this.formData['how-was-your-deployment'].howWasYourDeployment === 'changed-mind-want-managed-deployment'){
             nextStepInForm = 'how-many-hosts';
           } else if(this.formData['how-was-your-deployment'].howWasYourDeployment === 'decided-to-not-use-fleet'){
diff --git a/website/assets/js/pages/transparency.page.js b/website/assets/js/pages/transparency.page.js
index 211b9f441fd9..be7cfde1f382 100644
--- a/website/assets/js/pages/transparency.page.js
+++ b/website/assets/js/pages/transparency.page.js
@@ -4,6 +4,7 @@ parasails.registerPage('transparency', {
   //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
   data: {
     //…
+    showSecureframeBanner: false,
   },
 
   //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
diff --git a/website/assets/styles/components/animated-arrow-button.component.less b/website/assets/styles/components/animated-arrow-button.component.less
index 60102c4d7b07..61d9b459b804 100644
--- a/website/assets/styles/components/animated-arrow-button.component.less
+++ b/website/assets/styles/components/animated-arrow-button.component.less
@@ -21,7 +21,7 @@
     height: 12px;
     width: 12px;
     fill: none;
-    stroke: #FF5C83;
+    // stroke: #FF5C83; « Note: this is overridden by the arrow-color prop;
   }
   [purpose='arrow-line'] {
     opacity: 0;
diff --git a/website/assets/styles/components/scrollable-tweets.component.less b/website/assets/styles/components/scrollable-tweets.component.less
index 6e46904a1352..b11473169f0a 100644
--- a/website/assets/styles/components/scrollable-tweets.component.less
+++ b/website/assets/styles/components/scrollable-tweets.component.less
@@ -99,6 +99,7 @@
         img {
           height: 48px;
           width: 48px;
+          border-radius: 50%;
         }
       }
     }
diff --git a/website/assets/styles/importer.less b/website/assets/styles/importer.less
index 8d3999b3ccde..c57c29f48d8f 100644
--- a/website/assets/styles/importer.less
+++ b/website/assets/styles/importer.less
@@ -76,4 +76,5 @@
 @import 'pages/admin/sandbox-waitlist.less';
 @import 'pages/integrations.less';
 @import 'pages/start.less';
+@import 'pages/deals.less';
 
diff --git a/website/assets/styles/layout.less b/website/assets/styles/layout.less
index d1be7f4a0a8b..6eefec24a939 100644
--- a/website/assets/styles/layout.less
+++ b/website/assets/styles/layout.less
@@ -144,8 +144,27 @@ html, body {
     [purpose='banner-image'] {
       height: 80px;
       min-width: 80px;
-      background-image: url('/images/continue-thumbnail.png');
       background-size: cover;
+      background-position: center;
+      border-radius: 12px;
+      &.stage-one {
+        background-image: url('/images/psystage-1-unaware-558x680@2x.png');
+      }
+      &.stage-two {
+        background-image: url('/images/cta-thumbnail-psystage-2-aware-128x128@2x.png');
+      }
+      &.stage-three {
+        background-image: url('/images/cta-thumbnail-psystage-3-intrigued-128x128@2x.png');
+      }
+      &.stage-four {
+        background-image: url('/images/cta-thumbnail-psystage-4-has-use-case-128x128@2x.png');
+      }
+      &.stage-five {
+        background-image: url('/images/cta-thumbnail-psystage-5-100x100@2x.png');
+      }
+      &.stage-six {
+        background-image: url('/images/psystage-6-has-team-buy-in-504x784@2x.png');
+      }
     }
   }
   [purpose='banner-body'].collapsed {
@@ -425,8 +444,9 @@ html, body {
       }
     }
     [purpose='gh-button'] {
-      margin-left: 20px;
-      margin-right: 20px;
+      padding: 0px 20px;
+      min-width: 140px;
+      width: 140px;
     }
     [purpose='header-dropdown'] {
       box-shadow: 0px 4px 40px rgba(0, 0, 0, 0.4);
@@ -656,7 +676,6 @@ body.detected-mobile {
       [purpose='banner-image'] {
         height: 54px;
         min-width: 54px;
-        background-image: url('/images/continue-thumbnail.png');
         background-size: cover;
       }
     }
@@ -667,7 +686,6 @@ body.detected-mobile {
       [purpose='banner-image'] {
         height: 54px;
         min-width: 54px;
-        background-image: url('/images/continue-thumbnail.png');
         background-size: cover;
       }
       transform: none;
diff --git a/website/assets/styles/pages/articles/articles.less b/website/assets/styles/pages/articles/articles.less
index 552b110da0bc..770943f00c35 100644
--- a/website/assets/styles/pages/articles/articles.less
+++ b/website/assets/styles/pages/articles/articles.less
@@ -1,6 +1,7 @@
 #articles {
-  padding-left: 24px;
-  padding-right: 24px;
+  [purpose='page-container'] {
+    padding: 64px;
+  }
 
   [purpose='categories-and-search'] {
     padding-top: 40px;
@@ -30,9 +31,15 @@
     }
   }
   [purpose='category-title'] {
-    padding-top: 80px;
     padding-bottom: 40px;
   }
+
+  [purpose='guides-category-page'] {
+    [purpose='category-title'] {
+      margin-left: 12px;
+      margin-right: 6px;
+    }
+  }
   [purpose='rss-button'] {
     padding: 4px 8px;
     cursor: pointer;
@@ -49,7 +56,6 @@
       font-size: 16px;
     }
   }
-
   [purpose='rss-button'].copied::after {
     content: 'Link copied';
     display: flex;
@@ -74,11 +80,100 @@
     100% {opacity: 0;}
   }
 
+  [purpose='search'] {
+    // Note: We're using classes here to override the default Docsearch styles;
+    button {
+      width: 100%;
+      cursor: text;
+      margin: 0;
+    }
+    .DocSearch-Button {
+      border-top-left-radius: 6px;
+      border-bottom-left-radius: 6px;
+      border-top-right-radius: 6px;
+      border-bottom-right-radius: 6px;
+      border: 1px solid @core-fleet-black-25;
+      background-color: #FFF;
+      padding: 6px;
+      height: 36px;
+      margin: 0;
+      width: 256px;
+    }
+    .DocSearch-Button:hover {
+      box-shadow: none;
+      border: 1px solid @core-fleet-black-25;
+      color: @core-fleet-black-50;
+    }
+    .DocSearch-Search-Icon {
+      margin-left: 10px;
+      height: 16px;
+      width: 16px;
+      color: @core-fleet-black-50;
+      stroke-width: 3px;
+    }
+    .DocSearch-Button-Keys {
+      display: none;
+    }
+    .input-group:focus-within {
+      border: 1px solid @core-vibrant-blue;
+    }
+    .DocSearch-Button-Placeholder {
+      font-size: 16px;
+      font-weight: 400;
+      padding-left: 12px;
+    }
+    [purpose='disabled-search'] {
+      input {
+        padding-top: 6px;
+        padding-bottom: 6px;
+        border: none;
+        } &::placeholder {
+          font-size: 16px;
+          line-height: 24px;
+        }
+      .input-group {
+        border-top-left-radius: 6px;
+        border-bottom-left-radius: 6px;
+        border-top-right-radius: 6px;
+        border-bottom-right-radius: 6px;
+        border: 1px solid @core-fleet-black-25;
+        background: #FFF;
+      }
+      .input-group:focus-within {
+        border: 1px solid @core-vibrant-blue;
+      }
+      .docsearch-input {
+        height: 100%;
+        width: 98%;
+      }
+      .docsearch-input:focus-visible {
+        outline: none;
+      }
+      .ds-input:focus {
+        outline: rgba(0, 0, 0, 0);
+      }
+      .input-group-text {
+        color: @core-fleet-black-50;
+      }
+      .form-control {
+        height: 36px;
+        padding: 0px;
+        font-size: 16px;
+      } &:focus {
+        border: none;
+      }
+    }
+  }
+
 
   [purpose='articles'] {
-    padding-bottom: 80px;
+    width: 100%;
+    max-width: 100%;
     [purpose='article-card'] {
-
+      a {
+        text-decoration: none;
+        color: @core-fleet-black-75;
+      }
       margin-left: 10px;
       margin-right: 10px;
       margin-bottom: 40px;
@@ -123,6 +218,71 @@
       }
     }
   }
+  [purpose='guides'] {
+    column-count: 3;
+    margin-left: -2px;
+    margin-right: 14px;
+  }
+  [purpose='guide-card'] {
+    &:hover {
+        box-shadow: 0px 4px 16px 0px #E2E4EA;
+      }
+    max-width: 343px;
+    margin-left: 12px;
+    margin-right: 12px;
+    margin-bottom: 24px;
+    border-radius: 16px;
+    box-shadow: none;
+    border: 1px solid #E2E4EA;
+    display: inline-block;
+    img {
+      border-top-left-radius: 16px;
+      border-top-right-radius: 16px;
+    }
+    a {
+      text-decoration: none;
+      color: @core-fleet-black-75;
+    }
+    [purpose='article-card-body'] {
+      padding: 32px;
+      [purpose='category-name'] {
+        text-transform: uppercase;
+        color: @core-fleet-black-50;
+        font-size: 12px;
+        font-weight: 700;
+        line-height: 20px;
+        text-decoration: none;
+      }
+      p {
+        color: #515774;
+        font-size: 14px;
+        font-weight: 400;
+        line-height: 150%;
+      }
+      [purpose='article-title'] {
+
+        display: block;
+        text-decoration: none;
+        color: @core-fleet-black;
+        margin-bottom: 16px;
+        h5 {
+          font-weight: 800;
+          font-size: 16px;
+          line-height: 120%;
+        }
+      }
+      [purpose='article-details'] {
+        font-size: 12px;
+        line-height: 28px;
+        span {
+          color: @core-fleet-black-50;
+        }
+        p {
+          margin-bottom: 0px;
+        }
+      }
+    }
+  }
 
 
   @media (min-width: 1200px) {
@@ -131,8 +291,6 @@
       margin-right: 10px;
     }
     [purpose='articles'] {
-      margin-left: -25px;
-      margin-right: -25px;
       [purpose='article-card'] {
         flex: 1 1 350px;
         margin-left: 20px;
@@ -155,8 +313,12 @@
 
 
    @media (max-width: 991px) {
-    padding-left: 40px;
-    padding-right: 40px;
+    [purpose='page-container'] {
+      padding: 64px 32px;
+    }
+    [purpose='guide-card'] {
+      max-width: unset;
+    }
     [purpose='categories-and-search'] {
       padding-top: 40px;
       [purpose='categories'] {
@@ -171,9 +333,6 @@
         }
       }
     }
-    [purpose='category-title'] {
-      padding-top: 60px;
-    }
     [purpose='articles'] {
       [purpose='article-card'] {
         flex: 1 1 330px;
@@ -182,27 +341,49 @@
       margin-left: -10px;
       margin-right: -10px;
     }
+    [purpose='search'] {
+      .DocSearch-Button {
+        margin-left: 24px;
+        width: 200px;
+      }
+    }
 
   }
 
 
    @media (max-width: 767px) {
+
     [purpose='categories-and-search'] {
       [purpose='search'] {
         width: 100%;
       }
     }
-
+    [purpose='guides'] {
+      column-count: 2;
+    }
     [purpose='articles'] {
+      margin: 0 auto;
+      column-count: 2;
       [purpose='article-card'] {
         max-width: 100%;
       }
     }
+    [purpose='search'] {
+      .DocSearch-Button {
+        margin-top: 0px;
+        margin-left: 0px;
+        width: 100%;
+      }
+    }
   }
 
    @media (max-width: 576px) {
-    padding-left: 24px;
-    padding-right: 24px;
+    [purpose='page-container'] {
+      padding: 32px 24px;
+    }
+    [purpose='guides'] {
+      column-count: 1;
+    }
     [purpose='articles'] {
       margin-left: -10px;
       margin-right: -10px;
@@ -211,5 +392,15 @@
         max-width: 100%;
       }
     }
+    [purpose='guide-card'] {
+      width: 100%;
+    }
+    [purpose='search'] {
+      .DocSearch-Button {
+        margin-top: 0px;
+        margin-left: 0px;
+        width: 100%;
+      }
+    }
   }
 }
diff --git a/website/assets/styles/pages/articles/basic-article.less b/website/assets/styles/pages/articles/basic-article.less
index 034b5376a6a6..12c5f77ea0b8 100644
--- a/website/assets/styles/pages/articles/basic-article.less
+++ b/website/assets/styles/pages/articles/basic-article.less
@@ -109,7 +109,7 @@
   [purpose='article-content'] {
     padding-top: 24px;
     padding-bottom: 24px;
-    word-break: break-word;
+    word-wrap: break-word;
     h1:first-of-type {
       display: none;
     }
diff --git a/website/assets/styles/pages/deals.less b/website/assets/styles/pages/deals.less
new file mode 100644
index 000000000000..801a486c1239
--- /dev/null
+++ b/website/assets/styles/pages/deals.less
@@ -0,0 +1,129 @@
+#deals {
+
+  input, select {
+    height: 48px;
+    border-radius: 6px;
+    &:disabled {
+      color: #8B8FA2;
+      background-color: #F9FAFC;
+    }
+  }
+  label {
+    color: @core-fleet-black;
+    font-size: 14px;
+    font-weight: 700;
+    line-height: 1.5;
+  }
+  h2 {
+    font-size: 32px;
+    font-weight: 800;
+    line-height: 1.2;
+    margin-bottom: 16px;
+  }
+  h3 {
+    font-size: 18px;
+    font-weight: 700;
+    line-height: 1.5;
+    margin-bottom: 16px;
+  }
+  a {
+    text-decoration: underline;
+    color: @core-fleet-black-75;
+    &:hover {
+      color: @core-fleet-black-75;
+    }
+  }
+
+  [purpose='page-content'] {
+    max-width: 528px;
+    margin-right: auto;
+    margin-left: auto;
+    margin-bottom: 48px;
+  }
+  [purpose='page-container'] {
+    padding-left: 64px;
+    padding-right: 64px;
+    padding-top: 64px;
+  }
+
+  [purpose='form-card'] {
+    padding: 32px;
+    margin-top: 48px;
+    border-radius: 16px;
+  }
+  [purpose='form-section'] {
+    padding-top: 16px;
+    padding-bottom: 16px;
+  }
+  [purpose='hosting-selector'] {
+    font-size: 16px;
+    color: @core-fleet-black-75;
+    text-select: none;
+    border-radius: 6px;
+  }
+  [purpose='hosting-selector-dropwdown'] {
+    width: 100%;
+    max-width: 462px;
+    cursor: pointer;
+    font-size: 14px;
+    padding: 0px;
+    .dropdown-item {
+      display: flex;
+      justify-content: center;
+      border-top: 1px solid @core-vibrant-blue-15;
+      padding: 0px 12px;
+      height: 48px;
+      &:active {
+        color: unset;
+      }
+    }
+  }
+
+  [purpose='submit-button'] {
+    display: flex;
+    // width: 260px;
+    height: 48px;
+    padding: 16px 32px;
+    justify-content: center;
+    align-items: center;
+    gap: 4px;
+    margin-left: auto;
+    margin-right: auto;
+    color: #FFF;
+    text-align: center;
+    font-size: 16px;
+    font-style: normal;
+    font-weight: 700;
+    line-height: 24px;
+  }
+
+  @media (max-width: 991px) {
+    [purpose='page-container'] {
+      padding-left: 48px;
+      padding-right: 48px;
+      padding-top: 48px;
+    }
+
+  }
+
+  @media (max-width: 768px) {
+    [purpose='page-container'] {
+      padding-left: 32px;
+      padding-right: 32px;
+      padding-top: 32px;
+    }
+  }
+
+  @media (max-width: 576px) {
+    [purpose='page-container'] {
+      padding-left: 24px;
+      padding-right: 24px;
+      padding-top: 32px;
+    }
+    [purpose='hosting-selector-dropwdown'] {
+      width: unset;
+      max-width: unset;
+    }
+  }
+
+}
diff --git a/website/assets/styles/pages/device-management.less b/website/assets/styles/pages/device-management.less
index 30b132533509..10557dc6196e 100644
--- a/website/assets/styles/pages/device-management.less
+++ b/website/assets/styles/pages/device-management.less
@@ -35,6 +35,7 @@
     line-height: @text-lineheight;
     color: @core-fleet-black-75;
   }
+
   strong {
     color: @core-fleet-black;
   }
@@ -128,11 +129,39 @@
   }
   [purpose='comparison-table-header'] {
     font-size: 14px;
+    color: @core-fleet-black;
     div {
       padding: 12px 24px;
     }
+    [purpose='comparison-selector'] {
+      width: 152px;
+      height: 48px;
+      border-radius: 8px;
+      padding: 0px 12px;
+      background: #FFF;
+      color: @core-fleet-black;
+      border: 1px solid @core-vibrant-blue-15;
+      cursor: pointer;
+      font-weight: 700;
+    }
+    [purpose='comparison-selector-dropwdown'] {
+      width: 152px;
+      cursor: pointer;
+      font-size: 14px;
+      padding: 0px;
+      .dropdown-item {
+        display: flex;
+        justify-content: center;
+        border-top: 1px solid @core-vibrant-blue-15;
+        padding: 0px 12px;
+        height: 48px;
+        &:active {
+          color: unset;
+        }
+      }
+    }
   }
-  [purpose='omnisaa-column'] {
+  [purpose='comparison-column'] {
     text-align: center;
     display: flex;
     justify-content: center;
@@ -192,7 +221,42 @@
     }
   }
   // Mobile features comparison table styles
+  [purpose='mobile-comparison-selector'] {
+    height: 48px;
+    display: flex;
+    width: 100%;
+    padding: 0px 12px;
+    justify-content: space-between;
+    align-items: center;
+    align-self: stretch;
+    border-radius: 6px;
+    border: 1px solid #E2E4EA;
+    background: #FFF;
+    margin-bottom: 48px;
+    font-weight: 700;
+    color: #192147;
+  }
+
   [purpose='mobile-comparison-table'] {
+    p {
+      color: @core-fleet-black;
+    }
+    [purpose='comparison-selector-dropwdown'] {
+      width: calc(~' 100% - 48px');
+      cursor: pointer;
+      font-size: 14px;
+      padding: 0px;
+      .dropdown-item {
+        display: flex;
+        justify-content: center;
+        border-top: 1px solid @core-vibrant-blue-15;
+        padding: 0px 12px;
+        height: 48px;
+        &:active {
+          color: unset;
+        }
+      }
+    }
     margin-top: 32px;
     margin-bottom: 32px;
   }
@@ -206,6 +270,7 @@
     font-size: 14px;
     color: #515774;
     [purpose='feature-name'] {
+      color: @core-fleet-black;
       display: flex;
       height: 36px;
       padding: 12px 16px 12px 16px;
@@ -329,10 +394,17 @@
 
 
   [purpose='feature'] {
-    margin-bottom: 140px;
+    margin-bottom: 100px;
     h3 {
       margin-bottom: 24px;
     }
+    a {
+      color: @core-fleet-black-75;
+      text-decoration: underline;
+      &:hover {
+        color: @core-fleet-black-75;
+      }
+    }
     &:last-of-type {
       margin-bottom: 0px;
     }
@@ -365,6 +437,7 @@
   [purpose='feature-text'] {
     width: 468px;
     h2 {
+      font-size: 28px;
       margin-bottom: 32px;
     }
     p {
@@ -423,13 +496,38 @@
       }
     }
   }
+  [purpose='responsive-feature-row'] {
+    margin-right: 0px;
+    margin-left: 0px;
+    [purpose='feature-item'] {
+      padding-right: 24px;
+      padding-left: 24px;
+      margin-bottom: 64px;
+      h5 {
+        font-size: 16px;
+        line-height: 1.2;
+        font-weight: 800;
+      }
+      a {
+        color: @core-fleet-black-75;
+        text-decoration: underline;
+        &:hover {
+          color: @core-fleet-black-75;
+        }
+      }
+      p {
+        font-size: 14px;
+        font-weight: 400;
+        line-height: 21px;
+      }
+    }
+  }
   [purpose='three-column-features'] {
-    margin-bottom: 160px;
     max-width: 1080px;
-    [purpose='feature-row'] {
-      [purpose='feature-column'] {
-        max-width: 267px;
-      }
+    h2 {
+      font-size: 32px;
+      line-height: 48px;
+      margin-bottom: 40px;
     }
   }
   [purpose='button-row'] {
@@ -597,6 +695,18 @@
         width: 50%;
       }
     }
+    [purpose='responsive-feature-row'] {
+      [purpose='feature-item'] {
+        padding-right: 24px;
+        padding-left: 24px;
+        margin-bottom: 64px;
+        p {
+          font-size: 14px;
+          font-weight: 400;
+          line-height: 21px;
+        }
+      }
+    }
 
     [purpose='testimonial-videos'] {
       width: 410px;
@@ -622,12 +732,40 @@
       }
     }
 
-    [purpose='omnisaa-column'] {
-      min-width: 140px;
+    [purpose='comparison-column'] {
+      max-width: 140px;
+      min-width: 160px;
     }
+    [purpose='comparison-table-header'] {
+      font-size: 14px;
+      div {
+        padding: 12px 24px;
+      }
+      [purpose='comparison-selector'] {
+        min-width: 152px;
+        height: 48px;
+        border-radius: 8px;
+        padding: 0px 12px;
+        background: #FFF;
+        border: 1px solid @core-vibrant-blue-15;
+        cursor: pointer;
 
+      }
+      [purpose='comparison-selector-dropwdown'] {
+        width: 152px;
+        cursor: pointer;
+        padding: 0px;
+        .dropdown-item {
+          display: flex;
+          justify-content: center;
+          border-top: 1px solid @core-vibrant-blue-15;
+          padding: 0px 12px;
+        }
+      }
+    }
     [purpose='fleet-column'] {
       min-width: 140px;
+      max-width: 140px;
     }
 
     [purpose='comparison-table-header'] {
@@ -645,6 +783,16 @@
         }
       }
     }
+    [purpose='three-column-features'] {
+      [purpose='feature-row'] {
+        [purpose='feature-item'] {
+          margin-left: 32px;
+          margin-right: 32px;
+          max-width: 266px;
+          width: 33%;
+        }
+      }
+    }
   }
 
   @media (max-width: 767px) {
@@ -655,6 +803,9 @@
         font-size: 42px;
       }
     }
+    [purpose='feature'] {
+      margin-bottom: 80px;
+    }
 
     [purpose='calendar-feature'] {
       [purpose='feature-video'] {
@@ -713,12 +864,16 @@
     }
     [purpose='feature'].flex-column {
       [purpose='feature-text'] {
-        margin-left: auto;
+        width: 100%;
+        margin-left: 0px;
+        margin-right: 0px;
       }
     }
     [purpose='feature'].flex-column-reverse {
       [purpose='feature-text'] {
-        margin-right: auto;
+        width: 100%;
+        margin-left: 0px;
+        margin-right: 0px;
       }
     }
     [purpose='feature-image'] {
@@ -752,6 +907,16 @@
        height: 304px;
       }
     }
+    [purpose='three-column-features'] {
+      [purpose='feature-row'] {
+        [purpose='feature-item'] {
+          margin-left: 24px;
+          margin-right: 24px;
+          max-width: 266px;
+          width: 33%;
+        }
+      }
+    }
   }
 
   @media (max-width: 575px) {
@@ -779,6 +944,19 @@
         padding-left: 24px;
       }
     }
+    [purpose='responsive-feature-row'] {
+      [purpose='feature-item'] {
+        padding-right: 0px;
+        padding-left: 0px;
+        margin-bottom: 64px;
+        text-align: center;
+        p {
+          font-size: 14px;
+          font-weight: 400;
+          line-height: 21px;
+        }
+      }
+    }
     [purpose='page-section'] {
       padding-top: 48px;
       padding-bottom: 48px;
@@ -803,6 +981,21 @@
         height: calc(~'9/16 * 95vw');
       }
     }
+    [purpose='three-column-features'] {
+      [purpose='feature-row'] {
+        [purpose='feature-item'] {
+
+          margin-left: 0;
+          margin-right: 0;
+          text-align: center;
+          max-width: 320px;
+          width: 100%;
+          &:not(:last-of-type) {
+            margin-bottom: 60px;
+          }
+        }
+      }
+    }
     [purpose='two-column-features'] {
       [purpose='feature-row'] {
         margin-bottom: 64px;
@@ -872,6 +1065,13 @@
     [purpose='page-container'] {
       padding: 48px 16px;
     }
+    [purpose='mobile-comparison-table'] {
+      [purpose='comparison-selector-dropwdown'] {
+        dispaly: flex;
+        flex-direction: column;
+        width: calc(~' 100% - 32px');
+      }
+    }
     [purpose='tweets-container'] {
       padding-left: 16px;
       padding-right: 16px;
diff --git a/website/assets/styles/pages/docs/basic-documentation.less b/website/assets/styles/pages/docs/basic-documentation.less
index cf16b1d5bb37..bb15db3efded 100644
--- a/website/assets/styles/pages/docs/basic-documentation.less
+++ b/website/assets/styles/pages/docs/basic-documentation.less
@@ -501,6 +501,7 @@
     }
 
     [purpose='content'] {
+      width: 100%;
       hr {
         margin: 0px;
         padding: 0px;
diff --git a/website/assets/styles/pages/endpoint-ops.less b/website/assets/styles/pages/endpoint-ops.less
index 6ddf31696ef8..a2459aa9ebe9 100644
--- a/website/assets/styles/pages/endpoint-ops.less
+++ b/website/assets/styles/pages/endpoint-ops.less
@@ -361,44 +361,52 @@
       line-height: 24px;
     }
   }
-
   [purpose='three-column-features'] {
-    margin-bottom: 160px;
     max-width: 1080px;
-    [purpose='feature-row'] {
-      &:not(:last-of-type) {
-        margin-bottom: 60px;
-      }
-      [purpose='feature-item'] {
-        margin-left: 40px;
-        margin-right: 40px;
-        max-width: 266px;
-        width: 33%;
-        p {
-          font-size: 14px;
-          font-weight: 400;
-          line-height: 21px;
-        }
-      }
-    }
+    margin-bottom: 160px;
     h2 {
       font-size: 32px;
       line-height: 48px;
       margin-bottom: 40px;
     }
   }
+  [purpose='responsive-feature-row'] {
+    margin-right: 0px;
+    margin-left: 0px;
+    [purpose='feature-item'] {
+      padding-right: 24px;
+      padding-left: 24px;
+      margin-bottom: 64px;
+      h5 {
+        font-size: 16px;
+        line-height: 1.2;
+        font-weight: 800;
+      }
+      a {
+        color: @core-fleet-black-75;
+        text-decoration: underline;
+        &:hover {
+          color: @core-fleet-black-75;
+        }
+      }
+      img {
+        height: 48px;
+        width: auto;
+        margin-bottom: 16px;
+      }
+      h5 {
+        font-weight: 800;
+        font-size: 16px;
+        line-height: 1.2;
+        margin-bottom: 16px;
+      }
 
-  [purpose='feature-item'] {
-    img {
-      height: 48px;
-      width: auto;
-      margin-bottom: 16px;
-    }
-    h5 {
-      font-weight: 800;
-      font-size: 16px;
-      line-height: 27px;
-      margin-bottom: 16px;
+      p {
+        font-size: 14px;
+        font-weight: 400;
+        line-height: 21px;
+        margin-bottom: 0px;
+      }
     }
   }
 
@@ -408,11 +416,15 @@
       margin-bottom: 24px;
     }
   }
-  [purpose='feature-image'].left {
-    margin-left: 24px;
+  [purpose='feature'].flex-column {
+    [purpose='feature-text'] {
+      margin-left: 48px;
+    }
   }
-  [purpose='feature-image'].right {
-    margin-right: 24px;
+  [purpose='feature'].flex-column-reverse {
+    [purpose='feature-text'] {
+      margin-right: 48px;
+    }
   }
   [purpose='feature-image'] {
     max-width: 380px;
@@ -537,6 +549,18 @@
     [purpose='feature-text'] {
       width: 410px;
     }
+    [purpose='responsive-feature-row'] {
+      [purpose='feature-item'] {
+        padding-right: 24px;
+        padding-left: 24px;
+        margin-bottom: 64px;
+        p {
+          font-size: 14px;
+          font-weight: 400;
+          line-height: 21px;
+        }
+      }
+    }
   }
 
   @media (max-width: 767px) {
@@ -610,6 +634,16 @@
     [purpose='feature-text'] {
       width: unset;
     }
+    [purpose='feature'].flex-column {
+      [purpose='feature-text'] {
+        margin-left: auto;
+      }
+    }
+    [purpose='feature'].flex-column-reverse {
+      [purpose='feature-text'] {
+        margin-right: auto;
+      }
+    }
     [purpose='feature'] {
       margin-bottom: 120px;
     }
@@ -617,12 +651,6 @@
       margin-left: auto;
       margin-right: auto;
       margin-bottom: 60px;
-      &.left {
-        margin-left: auto;
-      }
-      &.right {
-        margin-right: auto;
-      }
     }
     [purpose='testimonial-videos'] {
       margin-left: auto;
@@ -693,18 +721,16 @@
         margin-left: 10px;
       }
     }
-    [purpose='three-column-features'] {
-      [purpose='feature-row'] {
-        [purpose='feature-item'] {
-
-          margin-left: 0;
-          margin-right: 0;
-          text-align: center;
-          max-width: 320px;
-          width: 100%;
-          &:not(:last-of-type) {
-            margin-bottom: 60px;
-          }
+    [purpose='responsive-feature-row'] {
+      [purpose='feature-item'] {
+        padding-right: 0px;
+        padding-left: 0px;
+        margin-bottom: 64px;
+        text-align: center;
+        p {
+          font-size: 14px;
+          font-weight: 400;
+          line-height: 21px;
         }
       }
     }
diff --git a/website/assets/styles/pages/entrance/login.less b/website/assets/styles/pages/entrance/login.less
index 42cadfb9be0e..46ffa53c306f 100644
--- a/website/assets/styles/pages/entrance/login.less
+++ b/website/assets/styles/pages/entrance/login.less
@@ -1,45 +1,74 @@
 #login {
-
-  padding-top: 80px;
-
   h1 {
-    font-size: 28px;
-    line-height: 38px;
+    font-size: 32px;
+    line-height: 120%;
   }
   a {
+    line-height: 150%;
     color: @core-fleet-black-75;
     text-decoration: underline;
     text-underline-offset: 2px;
-    line-height: 150%;
   }
-  [purpose='customer-login-container'] {
-    max-width: 560px;
+  p {
+    line-height: 150%;
   }
-  [purpose='login-container'] {
-    max-width: 560px;
-    [purpose='customer-portal-form'] {
-      max-width: 560px;
-    }
+  [purpose='page-container'] {
+    padding: 64px 128px 64px 128px;
+    max-width: 1200px;
   }
+
   [purpose='page-heading'] {
-    padding-left: 30px;
-    padding-right: 30px;
-    text-align: center;
-    margin-bottom: 40px;
+    text-align: left;
+    margin-bottom: 48px;
   }
-  [purpose='register-link'] {
-    margin-bottom: 8px;
-    a {
-      float: right;
+
+  [purpose='quote-and-logos'] {
+    max-width: 310px;
+  }
+  [purpose='quote'] {
+    margin-top: 8px;
+  }
+  [purpose='quote-text'] {
+    font-size: 14px;
+    line-height: 150%;
+    font-style: italic;
+  }
+  [purpose='quote-author-info'] {
+    display: inline-flex;
+    padding: 4px 16px 4px 4px;
+    border-radius: 28px;
+    width: fit-content;
+    margin-top: 8px;
+    margin-bottom: 48px;
+    [purpose='job-title'] {
       color: @core-fleet-black-75;
-      text-decoration: underline;
-      font-size: 14px;
+      font-size: 12px;
+      font-weight: 400;
+      line-height: 18px;
+      margin-bottom: 0px;
+    }
+    [purpose='name'] {
+      font-size: 12px;
+      font-weight: 700;
+      line-height: 18px;
+      margin-bottom: 0px;
+    }
+    [purpose='profile-picture'] {
+      margin-right: 16px;
+      img {
+        height: 32px;
+        width: 32px;
+      }
     }
   }
+  [purpose='logos'] {
+    max-width: 310px;
+  }
+  [purpose='login-form'] {
+    width: 528px;
+  }
   [purpose='customer-portal-form'] {
-    max-width: 560px;
     border-radius: 16px;
-    margin-bottom: 40px;
     padding: 20px 32px 32px 32px;
     label {
       color: @core-fleet-black;
@@ -50,8 +79,36 @@
       height: 40px;
       border-radius: 6px;
     }
-    .card-body {
-      padding: 2em;
+    .selectbox {
+
+      position: relative;
+    }
+    .selectbox::after {
+      content: url('/images/chevron-12x8@2x.png');
+      right: 14px;
+      transform: scale(0.5);
+      top: 14px;
+      position: absolute;
+      pointer-events: none;
+    }
+    .selectbox select {
+      border-radius: 6px;
+      height: 48px;
+      appearance: none;
+      -webkit-appearance: none;
+    }
+    .small {
+      font-size: 12px;
+    }
+  }
+
+  [purpose='register-link'] {
+    margin-bottom: 4px;
+    a {
+      float: right;
+      color: @core-fleet-black-75;
+      text-decoration: underline;
+      font-size: 14px;
     }
   }
 
@@ -74,23 +131,64 @@
       font-weight: 700;
     }
   }
+  @media (max-width: 1200px) {
+    [purpose='page-container'] {
+      padding: 64px;
+    }
+  }
+  @media (max-width: 991px) {
+    [purpose='signup-form'] {
+      max-width: 528px;
+    }
+    [purpose='quote-and-logos'] {
+      max-width: 528px;
+      margin-top: 48px;
+    }
+    [purpose='logos'] {
+      max-width: 528px;
+    }
+    [purpose='page-heading'] {
+      text-align: center;
+      margin-left: auto;
+      margin-right: auto;
+      margin-bottom: 48px;
+      max-width: 528px;
+    }
+    [purpose='page-container'] {
+      padding: 64px 32px;
+    }
+
+  }
 
   @media (max-width: 768px) {
-    padding-top: 60px;
     [purpose='customer-portal-form'] {
       max-width: unset;
     }
+    [purpose='signup-form'] {
+      width: 100%;
+    }
+    [purpose='quote-and-logos'] {
+      width: 100%;
+    }
+    [purpose='logos'] {
+      width: 100%;
+    }
   }
 
   @media (max-width: 576px) {
-    padding-top: 40px;
     [purpose='page-heading'] {
       padding-left: 0px;
       padding-right: 0px;
     }
+    [purpose='page-container'] {
+      padding: 48px 24px;
+    }
+    [purpose='login-link'] {
+      margin-bottom: 12px;
+    }
     [purpose='customer-portal-form'] {
       .card-body {
-        padding: 1em;
+        padding: 1.5em 1em;
       }
     }
   }
diff --git a/website/assets/styles/pages/entrance/signup.less b/website/assets/styles/pages/entrance/signup.less
index 058d58681ca7..f6d8e98e2dd2 100644
--- a/website/assets/styles/pages/entrance/signup.less
+++ b/website/assets/styles/pages/entrance/signup.less
@@ -1,34 +1,74 @@
 #signup {
-  padding-top: 80px;
   h1 {
-    font-size: 28px;
-    line-height: 38px;
+    font-size: 32px;
+    line-height: 120%;
   }
   a {
+    line-height: 150%;
     color: @core-fleet-black-75;
     text-decoration: underline;
     text-underline-offset: 2px;
   }
+  p {
+    line-height: 150%;
+  }
+  [purpose='page-container'] {
+    padding: 64px 128px 64px 128px;
+    max-width: 1200px;
+  }
+
   [purpose='page-heading'] {
-    padding-left: 30px;
-    padding-right: 30px;
-    text-align: center;
-    margin-bottom: 40px;
+    text-align: left;
+    margin-bottom: 48px;
   }
 
-  [purpose='login-link'] {
-    margin-bottom: 4px;
-    a {
-      float: right;
+  [purpose='quote-and-logos'] {
+    max-width: 310px;
+  }
+  [purpose='quote'] {
+    margin-top: 8px;
+  }
+  [purpose='quote-text'] {
+    font-size: 14px;
+    line-height: 150%;
+    font-style: italic;
+  }
+  [purpose='quote-author-info'] {
+    display: inline-flex;
+    padding: 4px 16px 4px 4px;
+    border-radius: 28px;
+    width: fit-content;
+    margin-top: 8px;
+    margin-bottom: 48px;
+    [purpose='job-title'] {
       color: @core-fleet-black-75;
-      text-decoration: underline;
-      font-size: 14px;
+      font-size: 12px;
+      font-weight: 400;
+      line-height: 18px;
+      margin-bottom: 0px;
     }
+    [purpose='name'] {
+      font-size: 12px;
+      font-weight: 700;
+      line-height: 18px;
+      margin-bottom: 0px;
+    }
+    [purpose='profile-picture'] {
+      margin-right: 16px;
+      img {
+        height: 32px;
+        width: 32px;
+      }
+    }
+  }
+  [purpose='logos'] {
+    max-width: 310px;
+  }
+  [purpose='signup-form'] {
+    width: 528px;
   }
   [purpose='customer-portal-form'] {
-    max-width: 560px;
     border-radius: 16px;
-    margin-bottom: 40px;
     padding: 20px 32px 32px 32px;
     label {
       color: @core-fleet-black;
@@ -57,6 +97,19 @@
       appearance: none;
       -webkit-appearance: none;
     }
+    .small {
+      font-size: 12px;
+    }
+  }
+
+  [purpose='login-link'] {
+    margin-bottom: 4px;
+    a {
+      float: right;
+      color: @core-fleet-black-75;
+      text-decoration: underline;
+      font-size: 14px;
+    }
   }
 
   [purpose='submit-button'] {
@@ -78,21 +131,61 @@
       font-weight: 700;
     }
   }
+  @media (max-width: 1200px) {
+    [purpose='page-container'] {
+      padding: 64px;
+    }
+  }
+  @media (max-width: 991px) {
+    [purpose='signup-form'] {
+      max-width: 528px;
+    }
+    [purpose='quote-and-logos'] {
+      max-width: 528px;
+      margin-top: 48px;
+    }
+    [purpose='logos'] {
+      max-width: 528px;
+    }
+    [purpose='page-heading'] {
+      text-align: center;
+      margin-left: auto;
+      margin-right: auto;
+      margin-bottom: 48px;
+      max-width: 528px;
+    }
+    [purpose='page-container'] {
+      padding: 64px 32px;
+    }
 
+  }
 
   @media (max-width: 768px) {
-    padding-top: 60px;
     [purpose='customer-portal-form'] {
       max-width: unset;
     }
+    [purpose='signup-form'] {
+      width: 100%;
+    }
+    [purpose='quote-and-logos'] {
+      width: 100%;
+    }
+    [purpose='logos'] {
+      width: 100%;
+    }
   }
 
   @media (max-width: 576px) {
-    padding-top: 40px;
     [purpose='page-heading'] {
       padding-left: 0px;
       padding-right: 0px;
     }
+    [purpose='page-container'] {
+      padding: 48px 24px;
+    }
+    [purpose='login-link'] {
+      margin-bottom: 12px;
+    }
     [purpose='customer-portal-form'] {
       .card-body {
         padding: 1.5em 1em;
diff --git a/website/assets/styles/pages/fleetctl-preview.less b/website/assets/styles/pages/fleetctl-preview.less
index 366cff673829..443db87c1214 100644
--- a/website/assets/styles/pages/fleetctl-preview.less
+++ b/website/assets/styles/pages/fleetctl-preview.less
@@ -111,6 +111,10 @@
     background: @ui-off-white;
     width: 100%;
     overflow-x: scroll;
+    scrollbar-width: none;
+    &::-webkit-scrollbar {
+      display: none;
+    }
     p {
       white-space: nowrap;
       color: @core-fleet-black-75;
diff --git a/website/assets/styles/pages/homepage.less b/website/assets/styles/pages/homepage.less
index 1560d5a561f0..489671a645f1 100644
--- a/website/assets/styles/pages/homepage.less
+++ b/website/assets/styles/pages/homepage.less
@@ -60,7 +60,11 @@
     min-width: 540px;
     text-align: center;
     h1 {
+      max-width: 640px;
       margin-bottom: 16px;
+      &.vm {
+        max-width: unset;
+      }
     }
     p {
       margin-bottom: 32px;
@@ -334,10 +338,10 @@
     .selected {
       font-weight: 700;
     }
-    .eo-selected {
+    .it-selected {
       transform: translateX(100%);
     }
-    .vm-selected {
+    .security-selected {
       transform: translateX(200%);
     }
   }
@@ -360,6 +364,11 @@
       font-size: 14px;
       line-height: 1.5;
     }
+    &.personalized {
+      p {
+        font-size: 16px;
+      }
+    }
     [purpose='category-button'] {
       width: min-content;
       height: 48px;
@@ -634,6 +643,16 @@
     }
   }
 
+  [purpose='bottom-cta'] {
+      h1 {
+        font-size: 48px;
+        max-width: 640px;
+        &.vm {
+          max-width: unset;
+        }
+      }
+    }
+
   [purpose='video-modal'] {
     [purpose='modal-dialog'] {
       width: 100%;
@@ -702,11 +721,6 @@
     [purpose='integrations-section'] {
       margin-top: 160px;
     }
-    [purpose='bottom-cta'] {
-      h1 {
-        font-size: 48px;
-      }
-    }
     [purpose='video-modal'] {
       [purpose='modal-dialog'] {
         width: 100%;
@@ -990,11 +1004,11 @@
         height: 56px;
         width: 100%;
       }
-      .eo-selected {
+      .it-selected {
         width: 100%;
         transform: translateY(56px);
       }
-      .vm-selected {
+      .security-selected {
         width: 100%;
         transform: translateY(113px);
       }
diff --git a/website/assets/styles/pages/start.less b/website/assets/styles/pages/start.less
index 9a43754c760a..436d6fdb9dd4 100644
--- a/website/assets/styles/pages/start.less
+++ b/website/assets/styles/pages/start.less
@@ -2,6 +2,7 @@
   background: linear-gradient(180deg, #E8F1F6 0%, #FFF 16.49%);
   a {
     color: @core-fleet-black-75;
+    text-decoration: underline;
   }
   h1 {
     font-size: 32px;
@@ -14,6 +15,13 @@
     font-weight: 800;
     line-height: 120%;
   }
+  ul {
+    margin-top: 32px;
+    padding-inline-start: 16px;
+    li {
+      margin-bottom: 24px;
+    }
+  }
   [purpose='logo-container'] {
     max-width: 524px;
     margin-left: auto;
@@ -29,15 +37,65 @@
     }
   }
   [purpose='form-container'] {
-    width: 528px;
-    margin-left: auto;
-    margin-right: auto;
-  }
-  [purpose='page-container'] {
-    padding-top: 64px;
+    min-width: 632px;
+    max-width: 632px;
     padding-left: 64px;
     padding-right: 64px;
-    padding-bottom: 64px;
+    padding-top: 32px;
+    margin-right: 20px;
+  }
+  [purpose='form-tip'] {
+    margin-top: 32px;
+    padding: 16px;
+    border-radius: 8px;
+    border: 1px solid #E6E3D0;
+    background: #FFFEF9;
+    p {
+      margin-bottom: 0px;
+      font-size: 14px;
+      line-height: 150%;
+    }
+    img {
+      height: 32px;
+      width: 32px;
+      margin-right: 12px;
+    }
+  }
+  [purpose='form-image'] {
+    width: 100%;
+    height: 680px;
+    max-width: 568px;
+    background-size: cover;
+    background-position: center;
+    background-repeat: no-repeat;
+    border-radius: 16px;
+    &.stage-one {
+      background-image: url('/images/psystage-1-unaware-558x680@2x.png');
+    }
+    &.stage-two {
+      background-image: url('/images/psystage-2-aware-508x784@2x.png');
+    }
+    &.stage-three {
+      background-image: url('/images/psystage-3-intrigued-558x680@2x.png');
+    }
+    &.stage-four {
+      background-image: url('/images/psystage-4-has-use-case-508x784@2x.png');
+    }
+    &.stage-five {
+      background-image: url('/images/cropped-fleet-cloud-city-504x784@2x.png');
+    }
+    &.stage-six {
+      background-image: url('/images/psystage-6-has-team-buy-in-504x784@2x.png');
+    }
+    &.cloud-city {
+      background-image: url('/images/cropped-fleet-cloud-city-504x784@2x.png');
+    }
+  }
+  [purpose='page-container'] {
+    padding-top: 20px;
+    padding-left: 20px;
+    padding-right: 24px;
+    padding-bottom: 24px;
     max-width: unset;
     display: flex;
     flex-direction: column;
@@ -49,7 +107,7 @@
     align-items: center;
     margin-bottom: 32px;
     img {
-      height: 18px;
+      height: 16px;
       display: inline;
       margin-left: 10px;
     }
@@ -140,6 +198,9 @@
     align-items: center;
     justify-content: start;
     user-select: none;
+    a {
+      text-decoration: none;
+    }
   }
   [purpose='submit-button'] {
     padding: 12px;
@@ -208,6 +269,9 @@
     }
 
   }
+  [parasails-component='logo-carousel'] {
+    margin-bottom: 0px;
+  }
   [purpose='quote'] {
     display: flex;
     padding: 32px;
@@ -259,6 +323,16 @@
       padding-right: 40px;
       max-width: 600px;
     }
+    [purpose='form-container'] {
+      padding: 0;
+      min-width: unset;
+      max-width: 504px;
+      margin-left: auto;
+      margin-right: auto;
+    }
+    [purpose='form-image'] {
+      display: none;
+    }
 
   }
   @media (max-width: 768px) {
@@ -267,7 +341,6 @@
       padding-left: 24px;
       padding-right: 24px;
     }
-
   }
   @media (max-width: 575px) {
     [purpose='logo-container'] {
@@ -284,7 +357,7 @@
       margin-bottom: 20px;
     }
     [purpose='form-container'] {
-      width: unset;
+      width: 100%;
       margin-left: 0;
       margin-right: 0;
     }
diff --git a/website/assets/styles/pages/transparency.less b/website/assets/styles/pages/transparency.less
index ac5831ccf049..15334ab0a938 100644
--- a/website/assets/styles/pages/transparency.less
+++ b/website/assets/styles/pages/transparency.less
@@ -54,7 +54,7 @@
   }
   [purpose='hero-text'] {
     text-align: center;
-    margin-bottom: 40px;
+    margin-bottom: 80px;
     h1 {
       font-size: 48px;
       font-weight: 800;
@@ -128,6 +128,31 @@
       }
     }
   }
+  [purpose='secureframe-banner'] {
+    width: 100%;
+    text-align: center;
+    color: #FFF;
+    h2, p {
+      color: #FFF;
+    }
+    h2 {
+      margin-bottom: 16px;
+    }
+    [parasails-component='animated-arrow-button'] {
+      font-weight: 600;
+    }
+    border-radius: 16px;
+    background: #091922;
+    padding: 32px;
+    img {
+      height: 48px;
+      width: 45.474px;
+      margin-bottom: 16px;
+      margin-left: auto;
+      margin-right: auto;
+    }
+  }
+
   [purpose='feature-headline'] {
     max-width: 510px;
     margin-bottom: 80px;
@@ -168,13 +193,13 @@
 
 
   [purpose='accordion'] {
-    padding-top: 64px;
+
     h2 {
       padding-bottom: 16px;
     }
     [purpose='accordion-body'] {
       width: 100%;
-      padding-top: 64px;
+
       [purpose='accordion-item'] {
         border-bottom: 1px solid #E2E4EA;
         padding-bottom: ;
@@ -332,6 +357,12 @@
         margin-right: auto;
       }
     }
+    [purpose='secureframe-banner'] {
+      padding: 32px 16px;
+      h2 {
+        font-size: 24px;
+      }
+    }
   }
 
   @media (max-width: 375px) {
diff --git a/website/assets/styles/pages/vulnerability-management.less b/website/assets/styles/pages/vulnerability-management.less
index cd64ee5553c7..87998dd3d2cc 100644
--- a/website/assets/styles/pages/vulnerability-management.less
+++ b/website/assets/styles/pages/vulnerability-management.less
@@ -46,7 +46,7 @@
 
   [purpose='page-headline'] {
     padding-bottom: 80px;
-    width: 680px;
+    max-width: 780px;
     h2 {
       font-size: 48px;
       font-style: normal;
@@ -351,11 +351,15 @@
     }
   }
 
-  [purpose='feature-image'].left {
-    margin-left: 24px;
+  [purpose='feature'].flex-column {
+    [purpose='feature-text'] {
+      margin-left: 48px;
+    }
   }
-  [purpose='feature-image'].right {
-    margin-right: 24px;
+  [purpose='feature'].flex-column-reverse {
+    [purpose='feature-text'] {
+      margin-right: 48px;
+    }
   }
   [purpose='feature-image'] {
     max-width: 380px;
@@ -539,17 +543,21 @@
     [purpose='feature'] {
       margin-bottom: 120px;
     }
-    [purpose='feature-image'] {
-      margin-left: auto;
-      margin-right: auto;
-      margin-bottom: 60px;
-      &.left {
+    [purpose='feature'].flex-column {
+      [purpose='feature-text'] {
         margin-left: auto;
       }
-      &.right {
+    }
+    [purpose='feature'].flex-column-reverse {
+      [purpose='feature-text'] {
         margin-right: auto;
       }
     }
+    [purpose='feature-image'] {
+      margin-left: auto;
+      margin-right: auto;
+      margin-bottom: 60px;
+    }
     [purpose='hero-image'] {
       margin-bottom: 60px;
     }
diff --git a/website/config/custom.js b/website/config/custom.js
index 3e1c62ca2255..9bb96b75d5cc 100644
--- a/website/config/custom.js
+++ b/website/config/custom.js
@@ -91,7 +91,9 @@ module.exports.custom = {
   // iqSecret: undefined, // You gotta use the base64-encoded API secret.  (Get it in your account settings in LeadIQ.)
   // salesforceIntegrationUsername: undefined,
   // salesforceIntegrationPasskey: undefined,
-  RX_PROTOCOL_AND_COMMON_SUBDOMAINS: /^(https?\:\/\/)?(www\.|about\.|ch\.|uk\.|pl\.|ca\.|jp\.|im\.|fr\.|pt\.|vn\.)*/,// For cleaning up LinkedIn URLs before creating CRM records.
+
+  // For cleaning up LinkedIn URLs before creating CRM records.
+  RX_PROTOCOL_AND_COMMON_SUBDOMAINS: /^(https?\:\/\/)?(www\.|about\.|ch\.|uk\.|pl\.|ca\.|jp\.|im\.|fr\.|pt\.|vn\.|pk\.|in\.|lu\.|mu\.|nl\.|np\.)*/,
 
   //  ██████╗ ██████╗ ██╗███████╗
   //  ██╔══██╗██╔══██╗██║██╔════╝
@@ -126,6 +128,7 @@ module.exports.custom = {
     // 'docs/Contributing/API-for-contributors.md': '', // « Covered in CODEOWNERS (2023-07-22)
     // 'schema': '',                                    // « Covered in CODEOWNERS (2023-07-22)
     'docs/01-Using-Fleet/standard-query-library/standard-query-library.yml': 'rachaelshaw', //« Built-in queries
+    '/docs/get-started/faq': 'zayhanlon',
     'ee/cis': 'sharon-fdm',//« Fleet Premium only: built-in queries  (built-in policies for CIS benchmarks)  -- FYI: On 2023-07-15, we changed this so that Sharon, Lucas, and Rachel are all maintainers, but where there is a single DRI who is automatically requested approval from.
 
     // 🫧 Articles and release notes
@@ -153,6 +156,9 @@ module.exports.custom = {
     'ee/vulnerability-dashboard/scripts': 'eashaw',
     'ee/vulnerability-dashboard/package.json': 'eashaw',
 
+    // 🫧 Bulk operations dashboard
+    'ee/bulk-operations-dashboard': 'eashaw',// (catch-all)
+
     // 🫧 Pricing and features
     // 'website/views/pages/pricing.ejs': '',                // « Covered in CODEOWNERS (2023-07-22)
     // 'handbook/company/pricing-features-table.yml': '',    // « Covered in CODEOWNERS (2023-07-22)
@@ -201,8 +207,10 @@ module.exports.custom = {
     'tools/api': ['lukeheath', 'georgekarrv', 'sharon-fdm'],//« Scripts for interacting with the Fleet API
 
     // Reference, config surface, built-in queries, API, and other documentation
-    'docs': ['rachaelshaw'],// (default for docs)
-    'docs/01-Using-Fleet/standard-query-library/standard-query-library.yml': ['rachaelshaw'],// (standard query library)
+    'docs': ['rachaelshaw', 'noahtalerman', 'eashaw'],// (default for docs)
+    'docs/01-Using-Fleet/standard-query-library/standard-query-library.yml': ['rachaelshaw', 'noahtalerman', 'eashaw'],// (standard query library)
+    '/docs/get-started/faq': ['ksatter', 'ddribeiro', 'zayhanlon'],
+    'docs/REST API/rest-api.md': ['rachaelshaw', 'lukeheath'],// (standard query library)
     'schema': ['eashaw'],// (Osquery table schema)
     'ee/cis': ['lukeheath', 'sharon-fdm', 'lucasmrod', 'rachelElysia', 'rachaelshaw'],
 
@@ -229,6 +237,9 @@ module.exports.custom = {
     'ee/vulnerability-dashboard/config/routes.js': 'eashaw',
     'ee/vulnerability-dashboard/package.json': 'eashaw',
 
+    // 🫧 Bulk operations dashboard
+    'ee/bulk-operations-dashboard': 'eashaw',
+
     // Other brandfronts
     'README.md': ['mikermcneil', 'mike-j-thomas', 'lukeheath'],//« github brandfront (github.com/fleetdm/fleet)
     'tools/fleetctl-npm/README.md': ['mikermcneil', 'mike-j-thomas', 'lukeheath'],//« brandfront for fleetctl package on npm (npmjs.com/package/fleetctl)
@@ -387,6 +398,14 @@ module.exports.custom = {
   // customerWorkspaceOneOauthSecret: '…',
   // customerMigrationWebhookSecret: '…',
 
+  // For nurture emails:
+  // contactEmailForNutureEmails: '…',
+  // activityCaptureEmailForNutureEmails: '…',
+  // contactNameForNurtureEmails: '…',
+
+  // Deal registration form
+  // dealRegistrationContactEmailAddress: '…',
+
   //…
 
 };
diff --git a/website/config/http.js b/website/config/http.js
index 8dca7de67c28..703f3b7d6895 100644
--- a/website/config/http.js
+++ b/website/config/http.js
@@ -54,7 +54,7 @@ module.exports.http = {
       var skipper = require('skipper');
       var middlewareFn = skipper({
         strict: true,
-        limit: '2MB',// [?] https://github.com/expressjs/body-parser/tree/ee91374eae1555af679550b1d2fb5697d9924109#limit-1
+        limit: '10MB',// [?] https://github.com/expressjs/body-parser/tree/ee91374eae1555af679550b1d2fb5697d9924109#limit-1
         onBodyParserError: (err, req, res)=>{
           // If an error occurs while parsing an incoming request body, we'll return a badRequest response if error.statusCode is between 400-500
           if (_.isNumber(err.statusCode) && err.statusCode >= 400 && err.statusCode < 500) {
diff --git a/website/config/policies.js b/website/config/policies.js
index 5eeba3abddca..f22dc5f471fd 100644
--- a/website/config/policies.js
+++ b/website/config/policies.js
@@ -54,4 +54,6 @@ module.exports.policies = {
   'get-human-interpretation-from-osquery-sql': true,
   'customers/view-new-license': true,
   'redirect-vanta-authorization-request': true,
+  'view-deals': true,
+  'deliver-deal-registration-submission': true,
 };
diff --git a/website/config/routes.js b/website/config/routes.js
index 8452aaccff28..5fcb4dde18aa 100644
--- a/website/config/routes.js
+++ b/website/config/routes.js
@@ -23,7 +23,7 @@ module.exports.routes = {
   'GET /contact': {
     action: 'view-contact',
     locals: {
-      pageTitleForMeta: 'Contact us | Fleet',
+      pageTitleForMeta: 'Contact us',
       pageDescriptionForMeta: 'Get in touch with our team.',
       hideFooterLinks: true,
     }
@@ -34,7 +34,7 @@ module.exports.routes = {
     locals: {
       hideHeaderLinks: true,
       hideFooterLinks: true,
-      pageTitleForMeta: 'fleetctl preview | Fleet',
+      pageTitleForMeta: 'fleetctl preview',
       pageDescriptionForMeta: 'Learn about getting started with Fleet using fleetctl.'
     }
   },
@@ -43,7 +43,7 @@ module.exports.routes = {
     action: 'view-pricing',
     locals: {
       currentSection: 'pricing',
-      pageTitleForMeta: 'Pricing | Fleet',
+      pageTitleForMeta: 'Pricing',
       pageDescriptionForMeta: 'Use Fleet for free or get started with Fleet Premium (self-hosted or managed cloud). Have a large deployment? We\'ve got you covered.'
     }
   },
@@ -51,7 +51,7 @@ module.exports.routes = {
   'GET /logos': {
     action: 'view-press-kit',
     locals: {
-      pageTitleForMeta: 'Logos | Fleet',
+      pageTitleForMeta: 'Logos',
       pageDescriptionForMeta: 'Download Fleet logos, wallpapers, and screenshots.'
     }
   },
@@ -60,7 +60,7 @@ module.exports.routes = {
     action: 'view-query-library',
     locals: {
       currentSection: 'documentation',
-      pageTitleForMeta: 'Queries | Fleet',
+      pageTitleForMeta: 'Queries',
       pageDescriptionForMeta: 'A growing collection of useful queries for organizations deploying Fleet and osquery.'
     }
   },
@@ -106,25 +106,23 @@ module.exports.routes = {
       hideHeaderLinks: true,
       hideFooterLinks: true,
       hideStartCTA: true,
-      pageTitleForMeta: 'Get Fleet Premium | Fleet',
+      pageTitleForMeta: 'Get Fleet Premium',
       pageDescriptionForMeta: 'Generate your quote and start using Fleet Premium today.',
     }
   },
   'GET /register': {
     action: 'entrance/view-signup',
     locals: {
-      hideHeaderLinks: true,
       hideFooterLinks: true,
-      pageTitleForMeta: 'Sign up | Fleet',
+      pageTitleForMeta: 'Sign up',
       pageDescriptionForMeta: 'Sign up for a Fleet account.',
     }
   },
   'GET /login': {
     action: 'entrance/view-login',
     locals: {
-      hideHeaderLinks: true,
       hideFooterLinks: true,
-      pageTitleForMeta: 'Log in | Fleet',
+      pageTitleForMeta: 'Log in',
       pageDescriptionForMeta: 'Log in to Fleet.',
     }
   },
@@ -134,7 +132,7 @@ module.exports.routes = {
       hideHeaderLinks: true,
       hideFooterLinks: true,
       hideStartCTA: true,
-      pageTitleForMeta: 'Customer dashboard | Fleet',
+      pageTitleForMeta: 'Customer dashboard',
       pageDescriptionForMeta: 'View and edit information about your Fleet Premium license.',
     }
   },
@@ -144,7 +142,7 @@ module.exports.routes = {
       hideHeaderLinks: true,
       hideFooterLinks: true,
       hideStartCTA: true,
-      pageTitleForMeta: 'Forgot password | Fleet',
+      pageTitleForMeta: 'Forgot password',
       pageDescriptionForMeta: 'Recover the password for your Fleet customer account.',
     }
   },
@@ -154,7 +152,7 @@ module.exports.routes = {
       hideHeaderLinks: true,
       hideFooterLinks: true,
       hideStartCTA: true,
-      pageTitleForMeta: 'New password | Fleet',
+      pageTitleForMeta: 'New password',
       pageDescriptionForMeta: 'Change the password for your Fleet customer account.',
     }
   },
@@ -162,7 +160,7 @@ module.exports.routes = {
   'GET /reports/state-of-device-management': {
     action: 'reports/view-state-of-device-management',
     locals: {
-      pageTitleForMeta: 'State of device management | Fleet',
+      pageTitleForMeta: 'State of device management',
       pageDescriptionForMeta: 'We surveyed 200+ security practitioners to discover the state of device management in 2022. Click here to learn about their struggles and best practices.',
     }
   },
@@ -223,7 +221,7 @@ module.exports.routes = {
   'GET /device-management': {
     action: 'view-device-management',
     locals: {
-      pageTitleForMeta: 'Device management (MDM) | Fleet',
+      pageTitleForMeta: 'Device management (MDM)',
       pageDescriptionForMeta: 'Manage your devices in any browser or use git to make changes as code.',
       currentSection: 'platform',
     }
@@ -232,7 +230,7 @@ module.exports.routes = {
   'GET /endpoint-ops': {
     action: 'view-endpoint-ops',
     locals: {
-      pageTitleForMeta: 'Endpoint ops | Fleet',
+      pageTitleForMeta: 'Endpoint ops',
       pageDescriptionForMeta: 'Pulse check anything, build reports, and ship data to any platform with Fleet.',
       currentSection: 'platform',
     }
@@ -241,7 +239,7 @@ module.exports.routes = {
   'GET /vulnerability-management': {
     action: 'view-vulnerability-management',
     locals: {
-      pageTitleForMeta: 'Vulnerability management | Fleet',
+      pageTitleForMeta: 'Vulnerability management',
       pageDescriptionForMeta: 'Report CVEs, software inventory, security posture, and other risks down to the chipset of any endpoint with Fleet.',
       currentSection: 'platform',
     }
@@ -250,7 +248,7 @@ module.exports.routes = {
   'GET /support': {
     action: 'view-support',
     locals: {
-      pageTitleForMeta: 'Support | Fleet',
+      pageTitleForMeta: 'Support',
       pageDescriptionForMeta: 'Ask a question, chat with engineers, or get in touch with the Fleet team.',
       currentSection: 'documentation',
     }
@@ -259,7 +257,7 @@ module.exports.routes = {
   'GET /integrations': {
     action: 'view-integrations',
     locals: {
-      pageTitleForMeta: 'Integrations | Fleet',
+      pageTitleForMeta: 'Integrations',
       pageDescriptionForMeta: 'Integrate IT ticketing systems, SIEM and SOAR platforms, custom IT workflows, and more.',
       currentSection: 'platform'
     }
@@ -271,7 +269,7 @@ module.exports.routes = {
       hideFooterLinks: true,
       hideGetStartedButton: true,
       hideStartCTA: true,
-      pageTitleForMeta: 'Start | Fleet',
+      pageTitleForMeta: 'Start',
       pageDescriptionForMeta: 'Get Started with Fleet. Spin up a local demo or get your Premium license key.',
     }
   },
@@ -280,7 +278,17 @@ module.exports.routes = {
     action: 'view-transparency',
     locals: {
       pageDescriptionForMeta: 'Discover how Fleet simplifies IT and security, prioritizing privacy, transparency, and trust for end users.',
-      pageTitleForMeta: 'Better with Fleet | Fleet'
+      pageTitleForMeta: 'Better with Fleet'
+    }
+  },
+
+  'GET /deals': {
+    action: 'view-deals',
+    locals: {
+      pageTitleForMeta: 'Deal registration',
+      pageDescriptionForMeta: 'Register an opportunity with a potential customer.',
+      hideFooterLinks: true,
+      hideStartCTA: true,
     }
   },
 
@@ -359,7 +367,6 @@ module.exports.routes = {
   'GET /docs': '/docs/get-started/why-fleet',
   'GET /docs/get-started': '/docs/get-started/why-fleet',
   'GET /docs/rest-api': '/docs/rest-api/rest-api',
-  'GET /docs/using-fleet': '/docs/using-fleet/fleet-ui',
   'GET /docs/configuration': '/docs/configuration/fleet-server-configuration',
   'GET /docs/contributing': 'https://github.com/fleetdm/fleet/tree/main/docs/Contributing',
   'GET /docs/deploy': '/docs/deploy/introduction',
@@ -443,6 +450,37 @@ module.exports.routes = {
       return res.redirect('/tables/'+req.param('tableName'));
     }
   },
+  'GET /docs/using-fleet/fleet-ui': (req,res)=> { return res.redirect(301, '/guides/queries');},
+  'GET /docs/using-fleet/learn-how-to-use-fleet': (req,res)=> { return res.redirect(301, '/guides/queries');},
+  'GET /docs/using-fleet/fleetctl-cli': (req,res)=> { return res.redirect(301, '/guides/fleetctl');},
+  'GET /docs/using-fleet/fleet-desktop': (req,res)=> { return res.redirect(301, '/guides/fleet-desktop');},
+  'GET /docs/using-fleet/enroll-hosts': (req,res)=> { return res.redirect(301, '/guides/enroll-hosts');},
+  'GET /docs/using-fleet/manage-access': (req,res)=> { return res.redirect(301, '/guides/role-based-access');},
+  'GET /docs/using-fleet/segment-hosts': (req,res)=> { return res.redirect(301, '/guides/teams');},
+  'GET /docs/using-fleet/supported-browsers': (req,res)=> { return res.redirect(301, '/docs/get-started/faq');},
+  'GET /docs/using-fleet/supported-host-operating-systems': (req,res)=> { return res.redirect(301, '/docs/get-started/faq');},
+  'GET /docs/using-fleet/gitops': (req,res)=> { return res.redirect(301, '/docs/configuration/yaml-files');},
+  'GET /docs/using-fleet/mdm-setup': (req,res)=> { return res.redirect(301, '/guides/macos-mdm-setup');},
+  'GET /docs/using-fleet/mdm-migration-guide': (req,res)=> { return res.redirect(301, '/guides/mdm-migration');},
+  'GET /docs/using-fleet/mdm-os-updates': (req,res)=> { return res.redirect(301, '/guides/enforce-os-updates');},
+  'GET /docs/using-fleet/mdm-disk-encryption': (req,res)=> { return res.redirect(301, '/guides/enforce-disk-encryption');},
+  'GET /docs/using-fleet/mdm-custom-os-settings': (req,res)=> { return res.redirect(301, '/guides/custom-os-settings');},
+  'GET /docs/using-fleet/mdm-macos-setup-experience': (req,res)=> { return res.redirect(301, '/guides/macos-setup-experience');},
+  'GET /docs/using-fleet/scripts': (req,res)=> { return res.redirect(301, '/guides/scripts');},
+  'GET /docs/using-fleet/automations': (req,res)=> { return res.redirect(301, '/guides/automations');},
+  'GET /docs/using-fleet/puppet-module': (req,res)=> { return res.redirect(301, '/guides/puppet-module');},
+  'GET /docs/using-fleet/vulnerability-processing': (req,res)=> { return res.redirect(301, '/guides/vulnerability-processing');},
+  'GET /docs/using-fleet/cis-benchmarks': (req,res)=> { return res.redirect(301, '/guides/cis-benchmarks');},
+  'GET /docs/using-fleet/osquery-process': (req,res)=> { return res.redirect(301, '/guides/osquery-watchdog');},
+  'GET /docs/using-fleet/update-agents': (req,res)=> { return res.redirect(301, '/guides/fleetd-updates');},
+  'GET /docs/using-fleet/usage-statistics': (req,res)=> { return res.redirect(301, '/guides/fleet-usage-statistics');},
+  'GET /docs/using-fleet/downgrading-fleet': (req,res)=> { return res.redirect(301, '/guides/downgrade-fleet');},
+  'GET /docs/using-fleet/enroll-chromebooks': (req,res)=> { return res.redirect(301, '/guides/chrome-os');},
+  'GET /docs/using-fleet/audit-logs': (req,res)=> { return res.redirect(301, 'https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Audit-logs.md');},
+  'GET /docs/using-fleet/understanding-host-vitals': (req,res)=> { return res.redirect(301, 'https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Understanding-host-vitals.md');},
+  'GET /docs/using-fleet/standard-query-library': (req,res)=> { return res.redirect(301, '/guides/standard-query-library');},
+  'GET /docs/using-fleet/mdm-commands': (req,res)=> { return res.redirect(301, '/guides/mdm-commands');},
+  'GET /docs/using-fleet/log-destinations': (req,res)=> { return res.redirect(301, '/guides/log-destinations');},
 
   //  ╔╦╗╦╔═╗╔═╗  ╦═╗╔═╗╔╦╗╦╦═╗╔═╗╔═╗╔╦╗╔═╗   ┬   ╔╦╗╔═╗╦ ╦╔╗╔╦  ╔═╗╔═╗╔╦╗╔═╗
   //  ║║║║╚═╗║    ╠╦╝║╣  ║║║╠╦╝║╣ ║   ║ ╚═╗  ┌┼─   ║║║ ║║║║║║║║  ║ ║╠═╣ ║║╚═╗
@@ -465,14 +503,14 @@ module.exports.routes = {
   'GET /legal':                      '/legal/terms',
   'GET /terms':                      '/legal/terms',
   'GET /handbook/security/github':   '/handbook/security#git-hub-security',
-  'GET /slack':                      'https://join.slack.com/t/osquery/shared_invite/zt-1wkw5fzba-lWEyke60sjV6C4cdinFA1w',// Note: This redirect is used on error pages and email templates in the Fleet UI.
+  'GET /slack':                      'https://join.slack.com/t/osquery/shared_invite/zt-2op37v6qp-aVPivU5xB_FwuYElN0Z1lw',// Note: This redirect is used on error pages and email templates in the Fleet UI.
   'GET /docs/using-fleet/updating-fleet': '/docs/deploying/upgrading-fleet',
   'GET /blog':                   '/articles',
   'GET /brand':                  '/logos',
   'GET /get-started':            '/try-fleet',
   'GET /g':                       (req,res)=> { let originalQueryStringWithAmp = req.url.match(/\?(.+)$/) ? '&'+req.url.match(/\?(.+)$/)[1] : ''; return res.redirect(301, sails.config.custom.baseUrl+'/?meet-fleet'+originalQueryStringWithAmp); },
   'GET /test-fleet-sandbox':     '/register',
-  'GET /unsubscribe':             (req,res)=> { let originalQueryString = req.url.match(/\?(.+)$/) ? req.url.match(/\?(.+)$/)[1] : ''; return res.redirect(301, sails.config.custom.baseUrl+'/api/v1/unsubscribe-from-all-newsletters?'+originalQueryString);},
+  'GET /unsubscribe':             (req,res)=> { let originalQueryString = req.url.match(/\?(.+)$/) ? req.url.match(/\?(.+)$/)[1] : ''; return res.redirect(301, sails.config.custom.baseUrl+'/api/v1/unsubscribe-from-marketing-emails?'+originalQueryString);},
   'GET /tables':                 '/tables/account_policy_data',
   'GET /imagine/launch-party':  'https://www.eventbrite.com/e/601763519887',
   'GET /blackhat2023':   'https://github.com/fleetdm/fleet/tree/main/tools/blackhat-mdm', // Assets from @marcosd4h & @zwass Black Hat 2023 talk
@@ -508,7 +546,7 @@ module.exports.routes = {
   'GET /learn-more-about/enabling-calendar-api': 'https://console.cloud.google.com/apis/library/calendar-json.googleapis.com',
   'GET /learn-more-about/downgrading': '/docs/using-fleet/downgrading-fleet',
   'GET /learn-more-about/fleetd': '/docs/get-started/anatomy#fleetd',
-  'GET /learn-more-about/rotating-enroll-secrets': '/docs/configuration/configuration-files#rotating-enroll-secrets',
+  'GET /learn-more-about/rotating-enroll-secrets': 'https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetctl-apply.md#rotating-enroll-secrets',
   'GET /learn-more-about/audit-logs': '/docs/using-fleet/audit-logs',
   'GET /learn-more-about/calendar-events': '/announcements/fleet-in-your-calendar-introducing-maintenance-windows',
   'GET /learn-more-about/setup-windows-mdm': '/docs/using-fleet/mdm-setup',
@@ -549,7 +587,7 @@ module.exports.routes = {
   'GET /defcon':                 'https://kqphpqst851.typeform.com/to/Y6NYxM5A',
   'GET /osquery-stickers':       'https://kqphpqst851.typeform.com/to/JxJ8YnxG',
   'GET /swag':                   'https://kqphpqst851.typeform.com/to/Y6NYxM5A',
-  'GET /community':              'https://join.slack.com/t/osquery/shared_invite/zt-1wkw5fzba-lWEyke60sjV6C4cdinFA1w',
+  'GET /community':              'https://join.slack.com/t/osquery/shared_invite/zt-2op37v6qp-aVPivU5xB_FwuYElN0Z1lw',
 
   // Temporary redirects
   // =============================================================================================================
@@ -596,4 +634,6 @@ module.exports.routes = {
   'POST /api/v1/deliver-talk-to-us-form-submission': { action: 'deliver-talk-to-us-form-submission' },
   'POST /api/v1/save-questionnaire-progress': { action: 'save-questionnaire-progress' },
   'POST /api/v1/account/update-start-cta-visibility': { action: 'account/update-start-cta-visibility' },
+  'POST /api/v1/deliver-deal-registration-submission': { action: 'deliver-deal-registration-submission' },
+  '/api/v1/unsubscribe-from-marketing-emails': { action: 'unsubscribe-from-marketing-emails' },
 };
diff --git a/website/package.json b/website/package.json
index a07935e6c181..f478e37458e7 100644
--- a/website/package.json
+++ b/website/package.json
@@ -13,7 +13,7 @@
     "moment": "2.29.4",
     "sails": "^1.5.11",
     "sails-hook-apianalytics": "^2.0.6",
-    "sails-hook-organics": "^2.2.2",
+    "sails-hook-organics": "^2.2.3",
     "sails-hook-orm": "^4.0.3",
     "sails-hook-sockets": "^3.0.0",
     "sails-postgresql": "^5.0.1"
diff --git a/website/scripts/build-static-content.js b/website/scripts/build-static-content.js
index f4a6228157e8..eaa40900b3f3 100644
--- a/website/scripts/build-static-content.js
+++ b/website/scripts/build-static-content.js
@@ -16,7 +16,7 @@ module.exports = {
   fn: async function ({ dry, githubAccessToken }) {
     let path = require('path');
     let YAML = require('yaml');
-
+    let util = require('util');
     // FUTURE: If we ever need to gather source files from other places or branches, etc, see git history of this file circa 2021-05-19 for an example of a different strategy we might use to do that.
     let topLvlRepoPath = path.resolve(sails.config.appPath, '../');
 
@@ -253,6 +253,10 @@ module.exports = {
               if(mdString.match(/[A-Z0-9._%+-]+@fleetdm\.com/gi)) {
                 throw new Error(`A Markdown file (${pageSourcePath}) contains a @fleetdm.com email address. To resolve this error, remove the email address in that file or change it to be an @example.com email address and try running this script again.`);
               }
+              // Look for multi-line HTML comments starting after lists without a blank newline. (The opening comment block is parsed as part of the list item preceeding it, and the closing block will be parsed as a paragraph)
+              if(mdString.match(/(-|\d\.)\s.*\n<!-+\n/g)) {
+                throw new Error(`A Markdown file (${pageSourcePath}) contains an HTML comment directly after a list that will cause rendering issues when converted to HTML. To resolve this error, add a blank newline before the start of the HTML comment in this file.`);
+              }
               // Look for anything in markdown content that could be interpreted as a Vue template when converted to HTML (e.g. {{ foo }}). If any are found, throw an error.
               if(mdString.match(/\{\{([^}]+)\}\}/gi)) {
                 throw new Error(`A Markdown file (${pageSourcePath}) contains a Vue template (${mdString.match(/\{\{([^}]+)\}\}/gi)[0]}) that will cause client-side javascript errors when converted to HTML. To resolve this error, change or remove the double curly brackets in this file.`);
@@ -386,11 +390,29 @@ module.exports = {
               }//fi
 
               // Get last modified timestamp using git, and represent it as a JS timestamp.
-              // > Inspired by https://github.com/uncletammy/doc-templater/blob/2969726b598b39aa78648c5379e4d9503b65685e/lib/compile-markdown-tree-from-remote-git-repo.js#L265-L273
-              let lastModifiedAt = (new Date((await sails.helpers.process.executeCommand.with({
-                command: `git log -1 --format="%ai" '${path.relative(topLvlRepoPath, pageSourcePath)}'`,
-                dir: topLvlRepoPath,
-              })).stdout)).getTime();
+              let lastModifiedAt;
+              if(!githubAccessToken) {
+                lastModifiedAt = Date.now();
+              } else if(process.env.GITHUB_REF_NAME && process.env.GITHUB_REF_NAME === 'main') {// Only add lastModifiedAt timestamps if this test is running on the main branch
+                let responseData = await sails.helpers.http.get.with({// [?]: https://docs.github.com/en/rest/commits/commits?apiVersion=2022-11-28#list-commits
+                  url: 'https://api.github.com/repos/fleetdm/fleet/commits',
+                  data: {
+                    path: path.join(sectionRepoPath, pageRelSourcePath),
+                    page: 1,
+                    per_page: 1,//eslint-disable-line camelcase
+                  },
+                  headers: baseHeadersForGithubRequests,
+                }).intercept((err)=>{
+                  return new Error(`When getting the commit history for ${path.join(sectionRepoPath, pageRelSourcePath)} to get a lastModifiedAt timestamp, an error occured.`, err);
+                });
+                // The value we'll use for the lastModifiedAt timestamp will be date value of the `commiter` property of the `commit` we got in the API response from github.
+                let mostRecentCommitToThisFile = responseData[0];
+                if(!mostRecentCommitToThisFile.commit || !mostRecentCommitToThisFile.commit.committer) {
+                  // Throw an error if the the response from GitHub is missing a commit or commiter.
+                  throw new Error(`When getting the commit history for ${path.join(sectionRepoPath, pageRelSourcePath)} to get a lastModifiedAt timestamp, the response from the GitHub API did not include information about the most recent commit. Response from GitHub: ${util.inspect(responseData, {depth:null})}`);
+                }
+                lastModifiedAt = (new Date(mostRecentCommitToThisFile.commit.committer.date)).getTime(); // Convert the UTC timestamp from GitHub to a JS timestamp.
+              }
 
               // Determine display title (human-readable title) to use for this page.
               let pageTitle;
@@ -556,11 +578,30 @@ module.exports = {
         let RELATIVE_PATH_TO_OPEN_POSITIONS_YML_IN_FLEET_REPO = 'handbook/company/open-positions.yml';
 
         // Get last modified timestamp using git, and represent it as a JS timestamp.
-        // > Inspired by https://github.com/uncletammy/doc-templater/blob/2969726b598b39aa78648c5379e4d9503b65685e/lib/compile-markdown-tree-from-remote-git-repo.js#L265-L273
-        let lastModifiedAt = (new Date((await sails.helpers.process.executeCommand.with({
-          command: `git log -1 --format="%ai" '${path.join(topLvlRepoPath, RELATIVE_PATH_TO_OPEN_POSITIONS_YML_IN_FLEET_REPO)}'`,
-          dir: topLvlRepoPath,
-        })).stdout)).getTime();
+        let lastModifiedAt;
+        if(!githubAccessToken) {
+          lastModifiedAt = Date.now();
+        } else {
+          // If we're including a lastModifiedAt value for schema tables, we'll send a request to the GitHub API to get a timestamp of when the last commit
+          let responseData = await sails.helpers.http.get.with({// [?]: https://docs.github.com/en/rest/commits/commits?apiVersion=2022-11-28#list-commits
+            url: 'https://api.github.com/repos/fleetdm/fleet/commits',
+            data: {
+              path: RELATIVE_PATH_TO_OPEN_POSITIONS_YML_IN_FLEET_REPO,
+              page: 1,
+              per_page: 1,//eslint-disable-line camelcase
+            },
+            headers: baseHeadersForGithubRequests,
+          }).intercept((err)=>{
+            return new Error(`When getting the commit history for the open positions YAML to get a lastModifiedAt timestamp, an error occured.`, err);
+          });
+          // The value we'll use for the lastModifiedAt timestamp will be date value of the `commiter` property of the `commit` we got in the API response from github.
+          let mostRecentCommitToThisFile = responseData[0];
+          if(!mostRecentCommitToThisFile.commit || !mostRecentCommitToThisFile.commit.committer) {
+            // Throw an error if the the response from GitHub is missing a commit or commiter.
+            throw new Error(`When trying to get a lastModifiedAt timestamp for the open positions YAML, the response from the GitHub API did not include information about the most recent commit. Response from GitHub: ${util.inspect(responseData, {depth:null})}`);
+          }
+          lastModifiedAt = (new Date(mostRecentCommitToThisFile.commit.committer.date)).getTime(); // Convert the UTC timestamp from GitHub to a JS timestamp.
+        }
 
         let openPositionsYaml = await sails.helpers.fs.read(path.join(topLvlRepoPath, RELATIVE_PATH_TO_OPEN_POSITIONS_YML_IN_FLEET_REPO)).intercept('doesNotExist', (err)=>new Error(`Could not find open positions YAML file at "${RELATIVE_PATH_TO_OPEN_POSITIONS_YML_IN_FLEET_REPO}".  Was it accidentally moved?  Raw error: `+err.message));
         let openPositionsToCreatePartialsFor = YAML.parse(openPositionsYaml, {prettyErrors: true});
@@ -598,7 +639,7 @@ module.exports = {
 
             let pageTitle = openPosition.jobTitle;
 
-            let mdStringForThisOpenPosition = `# ${openPosition.jobTitle}\n\n## Let's start with why we exist. 📡\n\nEver wondered if your employer is monitoring your work computer?\n\nOrganizations make huge investments every year to keep their laptops and servers online, secure, compliant, and usable from anywhere. This is called "device management".\n\nAt Fleet, we think it's time device management became [transparent](https://fleetdm.com/transparency) and [open source](https://fleetdm.com/handbook/company#open-source).\n\n\n## About the company 🌈\n\nYou can read more about the company in our [handbook](https://fleetdm.com/handbook/company), which is public and open to the world.\n\ntldr; Fleet Device Management Inc. is a [recently-funded](https://techcrunch.com/2022/04/28/fleet-nabs-20m-to-enable-enterprises-to-manage-their-devices/) Series A startup founded and backed by the same people who created osquery, the leading open source security agent. Today, osquery is installed on millions of laptops and servers, and it is especially popular with [enterprise IT and security teams](https://www.linuxfoundation.org/press/press-release/the-linux-foundation-announces-intent-to-form-new-foundation-to-support-osquery-community).\n\n\n## Your primary responsibilities 🔭\n${openPosition.responsibilities}\n\n## Are you our new team member? 🧑‍🚀\nIf most of these qualities sound like you, we would love to chat and see if we're a good fit.\n\n${openPosition.experience}\n\n## Why should you join us? 🛸\n\nLearn more about the company and [why you should join us here](https://fleetdm.com/handbook/company#is-it-any-good).\n\n<div purpose="open-position-quote-card"><div><img alt="Deloitte logo" src="/images/logo-deloitte-166x36@2x.png"></div><div purpose="open-position-quote"><div purpose="quote-text"><p>“One of the best teams out there to go work for and help shape security platforms.”</p></div><div purpose="quote-attribution"><strong>Dhruv Majumdar</strong><p>Director Of Cyber Risk & Advisory</p></div></div></div>\n\n\n## Want to join the team?\n\nWant to join the team?\n\nReach out to [${openPosition.hiringManagerName} on Linkedin](${openPosition.hiringManagerLinkedInUrl}).`;
+            let mdStringForThisOpenPosition = `# ${openPosition.jobTitle}\n\n## Let's start with why we exist. 📡\n\nEver wondered if your employer is monitoring your work computer?\n\nOrganizations make huge investments every year to keep their laptops and servers online, secure, compliant, and usable from anywhere. This is called "device management".\n\nAt Fleet, we think it's time device management became [transparent](https://fleetdm.com/transparency) and [open source](https://fleetdm.com/handbook/company#open-source).\n\n\n## About the company 🌈\n\nYou can read more about the company in our [handbook](https://fleetdm.com/handbook/company), which is public and open to the world.\n\ntldr; Fleet Device Management Inc. is a [recently-funded](https://techcrunch.com/2022/04/28/fleet-nabs-20m-to-enable-enterprises-to-manage-their-devices/) Series A startup founded and backed by the same people who created osquery, the leading open source security agent. Today, osquery is installed on millions of laptops and servers, and it is especially popular with [enterprise IT and security teams](https://www.linuxfoundation.org/press/press-release/the-linux-foundation-announces-intent-to-form-new-foundation-to-support-osquery-community).\n\n\n## Your primary responsibilities 🔭\n${openPosition.responsibilities}\n\n## Are you our new team member? 🧑‍🚀\nIf most of these qualities sound like you, we would love to chat and see if we're a good fit.\n\n${openPosition.experience}\n\n## Why should you join us? 🛸\n\nLearn more about the company and [why you should join us here](https://fleetdm.com/handbook/company#is-it-any-good).\n\n<div purpose="open-position-quote-card"><div><img alt="Deloitte logo" src="/images/logo-deloitte-166x36@2x.png"></div><div purpose="open-position-quote"><div purpose="quote-text"><p>“One of the best teams out there to go work for and help shape security platforms.”</p></div><div purpose="quote-attribution"><strong>Dhruv Majumdar</strong><p>Director Of Cyber Risk & Advisory</p></div></div></div>\n\n\n## Want to join the team?\n\nWant to join the team?\n\nReach out to [${openPosition.hiringManagerName} on Linkedin](${openPosition.hiringManagerLinkedInUrl}). \n\n\n >The salary range for this role is $48,000 - $480,000. Fleet provides competitive compensation based on our [compensation philosophy](https://fleetdm.com/handbook/company/communications#compensation), as well as comprehensive [benefits](https://fleetdm.com/handbook/company/communications#benefits).`;
 
 
             let htmlStringForThisPosition = await sails.helpers.strings.toHtml.with({mdString: mdStringForThisOpenPosition});
@@ -669,7 +710,12 @@ module.exports = {
 
         }
         // After we build the Markdown pages, we'll merge the osquery schema with the Fleet schema overrides, then create EJS partials for each table in the merged schema.
-        let expandedTables = await sails.helpers.getExtendedOsquerySchema.with({includeLastModifiedAtValue: true});
+        let expandedTables;
+        if(githubAccessToken){
+          expandedTables = await sails.helpers.getExtendedOsquerySchema.with({includeLastModifiedAtValue: true, githubAccessToken,});
+        } else {
+          expandedTables = await sails.helpers.getExtendedOsquerySchema();
+        }
 
         // Once we have our merged schema, we'll create ejs partials for each table.
         for(let table of expandedTables) {
@@ -799,8 +845,15 @@ module.exports = {
         let yaml = await sails.helpers.fs.read(path.join(topLvlRepoPath, RELATIVE_PATH_TO_PRICING_TABLE_YML_IN_FLEET_REPO)).intercept('doesNotExist', (err)=>new Error(`Could not find pricing table features YAML file at "${RELATIVE_PATH_TO_PRICING_TABLE_YML_IN_FLEET_REPO}".  Was it accidentally moved?  Raw error: `+err.message));
         let pricingTableFeatures = YAML.parse(yaml, {prettyErrors: true});
         let VALID_PRODUCT_CATEGORIES = ['Endpoint operations', 'Device management', 'Vulnerability management'];
-        let VALID_PRICING_TABLE_CATEGORIES = ['Support', 'Deployment', 'Integrations', 'Endpoint operations', 'Device management', 'Vulnerability management'];
+        let VALID_PRICING_TABLE_CATEGORIES = ['Support', 'Deployment', 'Integrations', 'Configuration', 'Devices', 'Vulnerability management'];
+        let VALID_PRICING_TABLE_KEYS = ['industryName', 'description', 'documentationUrl', 'tier', 'jamfProHasFeature', 'jamfProtectHasFeature', 'usualDepartment', 'productCategories', 'pricingTableCategories', 'waysToUse', 'buzzwords', 'demos', 'dri', 'friendlyName', 'moreInfoUrl', 'comingSoonOn', 'screenshotSrc', 'isExperimental'];
         for(let feature of pricingTableFeatures){
+          // Throw an error if a feature contains an unrecognized key.
+          for(let key of _.keys(feature)){
+            if(!VALID_PRICING_TABLE_KEYS.includes(key)){
+              throw new Error(`Unrecognized key. Could not build pricing table config from pricing-features-table.yml. The "${feature.industryName}" feature contains an unrecognized key (${key}). To resolve, fix any typos or remove this key and try running this script again.`);
+            }
+          }
           if(feature.name) {// Compatibility check
             throw new Error(`Could not build pricing table config from pricing-features-table.yml. A feature has a "name" (${feature.name}) which is no longer supported. To resolve, add a "industryName" to this feature: ${feature}`);
           }
@@ -1087,7 +1140,6 @@ module.exports = {
         }
       });
     }
-
   }
 
 
diff --git a/website/scripts/deliver-nurture-emails.js b/website/scripts/deliver-nurture-emails.js
new file mode 100644
index 000000000000..7b682460e977
--- /dev/null
+++ b/website/scripts/deliver-nurture-emails.js
@@ -0,0 +1,143 @@
+module.exports = {
+
+
+  friendlyName: 'Deliver nurture emails',
+
+
+  description: 'Sends nurture emails to users who have been at psychological stage 3 & 4 for more than a day, and users who have been stage five for six weeks.',
+
+
+  fn: async function () {
+
+    sails.log('Running custom shell script... (`sails run deliver-nurture-emails`)');
+
+    let nowAt = Date.now();
+    let nurtureCampaignStartedAt = new Date('07-22-2024').getTime();
+    let oneHourAgoAt = nowAt - (1000 * 60 * 60);
+    let oneDayAgoAt = nowAt - (1000 * 60 * 60 * 24);
+    let sixWeeksAgoAt = nowAt - (1000 * 60 * 60 * 24 * 7 * 6);
+    // Find user records that are over an hour old that were created after July 22nd.
+    let usersWithMdmBuyingSituation = await User.find({
+      primaryBuyingSituation: 'mdm',
+      createdAt: {
+        '>=': nurtureCampaignStartedAt,
+        '<=': oneHourAgoAt,
+      },
+    });
+
+    // Only send emails to stage 3 users who have not received a nurture email for this stage, and that have been stage 3 for at least one day.
+    let stageThreeMdmFocusedUsersWhoHaveNotReceivedAnEmail = _.filter(usersWithMdmBuyingSituation, (user)=>{
+      return user.stageThreeNurtureEmailSentAt === 0
+      && user.psychologicalStage === '3 - Intrigued';
+    });
+
+    // Only send emails to stage 4 users who have not received a a nurture email for this stage, and that have been stage 4 for at least one day.
+    let stageFourMdmFocusedUsersWhoHaveNotReceivedAnEmail = _.filter(usersWithMdmBuyingSituation, (user)=>{
+      return user.stageFourNurtureEmailSentAt === 0
+      && user.psychologicalStage === '4 - Has use case';
+    });
+
+    // Only send emails to stage 5 users who have not received a nurture email for this stage, and that have been stage 5 for at least six weeks.
+    let stageFiveMdmFocusedUsersWhoHaveNotReceivedAnEmail = _.filter(usersWithMdmBuyingSituation, (user)=>{
+      return user.stageFiveNurtureEmailSentAt === 0
+      && user.psychologicalStage === '5 - Personally confident';
+    });
+
+    let emailedStageThreeUserIds = [];
+    for(let user of stageThreeMdmFocusedUsersWhoHaveNotReceivedAnEmail) {
+      if(user.psychologicalStageLastChangedAt > oneDayAgoAt) {
+        continue;
+      } else {
+        await sails.helpers.sendTemplateEmail.with({
+          template: 'email-nurture-stage-three',
+          layout: 'layout-nurture-email',
+          templateData: {
+            firstName: user.firstName,
+            emailAddress: user.emailAddress
+          },
+          to: user.emailAddress,
+          toName: `${user.firstName} ${user.lastName}`,
+          subject: 'Was it any good?',
+          bcc: [sails.config.custom.activityCaptureEmailForNutureEmails],
+          from: sails.config.custom.contactEmailForNutureEmails,
+          fromName: sails.config.custom.contactNameForNurtureEmails,
+          ensureAck: true,
+        });
+        emailedStageThreeUserIds.push(user.id);
+      }
+    }
+
+    await User.update({id: {in: emailedStageThreeUserIds}})
+    .set({
+      stageThreeNurtureEmailSentAt: nowAt,
+    });
+
+    let emailedStageFourUserIds = [];
+    for(let user of stageFourMdmFocusedUsersWhoHaveNotReceivedAnEmail) {
+      if(user.psychologicalStageLastChangedAt > oneDayAgoAt) {
+        continue;
+      } else {
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // Note: We commented this out because it was interfering with the ability for leads to flow
+        // without making reps wait.  We can turn it back on when we have a way for Drew to disable
+        // nurture emails on a per-contact basis from Salesforce.
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // await sails.helpers.sendTemplateEmail.with({
+        //   template: 'email-nurture-stage-four',
+        //   layout: 'layout-nurture-email',
+        //   templateData: {
+        //     firstName: user.firstName,
+        //     emailAddress: user.emailAddress
+        //   },
+        //   to: user.emailAddress,
+        //   toName: `${user.firstName} ${user.lastName}`,
+        //   subject: 'Deploy open-source MDM',
+        //   bcc: [sails.config.custom.activityCaptureEmailForNutureEmails],
+        //   from: sails.config.custom.contactEmailForNutureEmails,
+        //   fromName: sails.config.custom.contactNameForNurtureEmails,
+        //   ensureAck: true,
+        // });
+        emailedStageFourUserIds.push(user.id);
+      }
+    }
+
+    await User.update({id: {in: emailedStageFourUserIds}})
+    .set({
+      stageFourNurtureEmailSentAt: nowAt,
+    });
+
+
+    let emailedStageFiveUserIds = [];
+    for(let user of stageFiveMdmFocusedUsersWhoHaveNotReceivedAnEmail) {
+      if(user.psychologicalStageLastChangedAt > sixWeeksAgoAt) {
+        continue;
+      } else {
+        await sails.helpers.sendTemplateEmail.with({
+          template: 'email-nurture-stage-five',
+          layout: 'layout-nurture-email',
+          templateData: {
+            firstName: user.firstName,
+            emailAddress: user.emailAddress
+          },
+          to: user.emailAddress,
+          toName: `${user.firstName} ${user.lastName}`,
+          subject: 'Update',
+          bcc: [sails.config.custom.activityCaptureEmailForNutureEmails],
+          from: sails.config.custom.contactEmailForNutureEmails,
+          fromName: sails.config.custom.contactNameForNurtureEmails,
+          ensureAck: true,
+        });
+        emailedStageFiveUserIds.push(user.id);
+      }
+    }
+
+    await User.update({id: {in: emailedStageFiveUserIds}})
+    .set({
+      stageFiveNurtureEmailSentAt: nowAt,
+    });
+
+  }
+
+
+};
+
diff --git a/website/scripts/get-bug-and-pr-report.js b/website/scripts/get-bug-and-pr-report.js
index 5894be6ecb41..06791bf10ab5 100644
--- a/website/scripts/get-bug-and-pr-report.js
+++ b/website/scripts/get-bug-and-pr-report.js
@@ -33,8 +33,10 @@ module.exports = {
     let daysSinceReleasedBugsWereOpened = [];
     let allBugsWithUnreleasedLabel = [];
     let allBugsWithReleasedLabel = [];
+    let allBugs32DaysOrOlder = [];
     let allBugsCreatedInPastWeek = [];
     let allBugsClosedInPastWeek = [];
+    let allBugsReportedByCustomersInPastWeek = [];
     let daysSincePullRequestsWereOpened = [];
     let daysSinceContributorPullRequestsWereOpened = [];
     let commitToMergeTimesInDays = [];
@@ -44,7 +46,7 @@ module.exports = {
     let allNonPublicOpenPrs = [];
     let nonPublicPrsClosedInThePastThreeWeeks = [];
 
-    // Product group KPIS
+
 
     // Endpoint operations
     let allBugsCreatedInPastWeekEndpointOps = [];
@@ -103,8 +105,16 @@ module.exports = {
           let timeOpenInMS = Math.abs(todaysDate - issueOpenedOn);
           // Convert the miliseconds to days and add the value to the daysSinceBugsWereOpened array
           let timeOpenInDays = timeOpenInMS / ONE_DAY_IN_MILLISECONDS;
+          if (timeOpenInDays >= 32) {
+            allBugs32DaysOrOlder.push(issue);
+          }
           if (timeOpenInDays <= 7) {
+            // All bugs in past week
             allBugsCreatedInPastWeek.push(issue);
+            // Customer-reported bugs
+            if (issue.labels.some(label => label.name.indexOf('customer-') >= 0)) {
+              allBugsReportedByCustomersInPastWeek.push(issue);
+            }
             // Get Endpoint Ops KPIs
             if (issue.labels.some(label => label.name === '#g-endpoint-ops')) {
               allBugsCreatedInPastWeekEndpointOps.push(issue);
@@ -132,6 +142,7 @@ module.exports = {
               }
             }
           }
+
           daysSinceBugsWereOpened.push(timeOpenInDays);
           // Send to released or unreleased bugs array
           if (issue.labels.some(label => label.name === '~unreleased bug')) {
@@ -316,8 +327,8 @@ module.exports = {
       //
       async()=>{
 
-        // Fetch confidential and classified PRs (current open, and recent closed)
-        for (let repoName of ['classified', 'confidential']) {
+        // Fetch confidential PRs (current open, and recent closed)
+        for (let repoName of ['confidential']) {
           // [?] https://docs.github.com/en/free-pro-team@latest/rest/pulls/pulls#list-pull-requests
           let openPrs = await sails.helpers.http.get(`https://api.github.com/repos/fleetdm/${encodeURIComponent(repoName)}/pulls`, {
             state: 'open',
@@ -380,25 +391,12 @@ module.exports = {
     // NOTE: If order of the KPI sheets columns changes, the order values are pushed into this array needs to change, as well.
     kpiResults.push(
       averageDaysContributorPullRequestsAreOpenFor,
-      daysSinceContributorPullRequestsWereOpened.length,
-      averageDaysPullRequestsAreOpenFor,
-      daysSincePullRequestsWereOpened.length,
+      allBugs32DaysOrOlder.length,
+      allBugsReportedByCustomersInPastWeek.length,
       averageNumberOfDaysReleasedBugsAreOpenFor,
       averageNumberOfDaysUnreleasedBugsAreOpenFor,
-      allBugsClosedInPastWeek.length,
-      averageNumberOfDaysBugsAreOpenFor,
       allBugsCreatedInPastWeek.length,
-      allBugsCreatedInPastWeekEndpointOps.length,
-      allBugsCreatedInPastWeekEndpointOpsCustomerImpacting.length,
-      allBugsCreatedInPastWeekEndpointOpsReleased.length,
-      allBugsCreatedInPastWeekEndpointOpsUnreleased.length,
-      allBugsCreatedInPastWeekMobileDeviceManagement.length,
-      allBugsCreatedInPastWeekMobileDeviceManagementCustomerImpacting.length,
-      allBugsCreatedInPastWeekMobileDeviceManagementReleased.length,
-      allBugsCreatedInPastWeekMobileDeviceManagementUnreleased.length,
-      daysSinceBugsWereOpened.length,
-      allBugsWithReleasedLabel.length,
-      allBugsWithUnreleasedLabel.length);
+      allBugsClosedInPastWeek.length,);
 
     // Log the results
     sails.log(`
@@ -407,17 +405,19 @@ module.exports = {
     ---------------------------
     ${kpiResults.join(',')}
 
-    Note: Copy the values above, then in Google sheets paste them into a cell and select "Split text to columns" to paste the values into separate cells.
+    Note: Copy the values above, then paste into Google KPI sheet and select "Split text to columns" to split the values into separate columns.
 
     Pull requests:
     ---------------------------
     Average open time (no bots, no handbook, no ceo): ${averageDaysContributorPullRequestsAreOpenFor} days.
+
     Number of open pull requests in the fleetdm/fleet Github repo (no bots, no handbook, no ceo): ${daysSinceContributorPullRequestsWereOpened.length}
 
     Average open time (all PRs): ${averageDaysPullRequestsAreOpenFor} days.
+
     Number of open pull requests in the fleetdm/fleet Github repo: ${daysSincePullRequestsWereOpened.length}
 
-    Bugs (part 1):
+    Bugs:
     ---------------------------
     Average open time (released bugs): ${averageNumberOfDaysReleasedBugsAreOpenFor} days.
 
@@ -429,6 +429,12 @@ module.exports = {
 
     Number of issues with the "bug" label opened in the past week: ${allBugsCreatedInPastWeek.length}
 
+    Number of open issues with the "bug" label in fleetdm/fleet: ${daysSinceBugsWereOpened.length}
+
+    Number of open issues with the "~released bug" label in fleetdm/fleet: ${allBugsWithReleasedLabel.length}
+
+    Number of open issues with the "~unreleased bug" label in fleetdm/fleet: ${allBugsWithUnreleasedLabel.length}
+
     Endpoint Operations:
     ---------------------------
     Number of issues with the "#g-endpoint-ops" and "bug" labels opened in the past week: ${allBugsCreatedInPastWeekEndpointOps.length}
@@ -449,17 +455,10 @@ module.exports = {
 
     Number of issues with the "#g-mdm", "bug", and "~unreleased bug" labels opened in the past week: ${allBugsCreatedInPastWeekMobileDeviceManagementUnreleased.length}
 
-    Bugs (part 2):
-    ---------------------------
-    Number of open issues with the "bug" label in fleetdm/fleet: ${daysSinceBugsWereOpened.length}
-
-    Number of open issues with the "~released bug" label in fleetdm/fleet: ${allBugsWithReleasedLabel.length}
-
-    Number of open issues with the "~unreleased bug" label in fleetdm/fleet: ${allBugsWithUnreleasedLabel.length}
-
     Pull requests requiring CEO review
     ---------------------------------------
     Number of open ~ceo pull requests in the fleetdm Github org: ${ceoDependentOpenPrs.length}
+
     Average open time (~ceo PRs): ${Math.round(ceoDependentPrOpenTime*100)/100} days.
     `);
 
diff --git a/website/scripts/migrate-lead-source-to-contact-source.js b/website/scripts/migrate-lead-source-to-contact-source.js
new file mode 100644
index 000000000000..407e1bee09ba
--- /dev/null
+++ b/website/scripts/migrate-lead-source-to-contact-source.js
@@ -0,0 +1,44 @@
+module.exports = {
+
+
+  friendlyName: 'Migrate lead source to contact source',
+
+
+  description: '',
+
+
+  fn: async function () {
+
+    sails.log('Running custom shell script... (`sails run migrate-lead-source-to-contact-source`)');
+
+    require('assert')(sails.config.custom.salesforceIntegrationUsername);
+    require('assert')(sails.config.custom.salesforceIntegrationPasskey);
+
+    // Log in to Salesforce.
+    let jsforce = require('jsforce');
+    let salesforceConnection = new jsforce.Connection({
+      loginUrl : 'https://fleetdm.my.salesforce.com'
+    });
+    await salesforceConnection.login(sails.config.custom.salesforceIntegrationUsername, sails.config.custom.salesforceIntegrationPasskey);
+
+    let POSSIBLE_CONTACT_SOURCES = ['Dripify', 'Website - Contact forms', 'Website - Sign up', 'Website - Swag request', 'Manual research', 'Initial qualification meeting'];
+    let contacts = (
+      await salesforceConnection.query(`SELECT Id, LeadSource, FirstName FROM Contact WHERE Contact_source__c = NULL AND LeadSource IN (${POSSIBLE_CONTACT_SOURCES.map((src)=>'\''+src+'\'').join(', ')})`)
+      // await salesforceConnection.query(`SELECT Id, LeadSource, FirstName FROM Contact WHERE LastName = 'McNeil' AND FirstName IN (${['Mike'].map((src)=>'\''+src+'\'').join(', ')}) AND LeadSource IN (${POSSIBLE_CONTACT_SOURCES.map((src)=>'\''+src+'\'').join(', ')})`)
+    ).records;// « unpack the sausage
+    // console.log(contacts);
+
+    await sails.helpers.flow.simultaneouslyForEach(contacts, async (contact)=>{
+      // console.log(`${contact.FirstName} :: ${contact.LeadSource}`);
+      await salesforceConnection.sobject('Contact').update({
+        Id: contact.Id,
+        Contact_source__c: contact.LeadSource//eslint-disable-line camelcase
+      });
+    });//∞
+
+
+  }
+
+
+};
+
diff --git a/website/scripts/send-aggregated-metrics-to-datadog.js b/website/scripts/send-aggregated-metrics-to-datadog.js
index 959c3625b532..f13826b866ba 100644
--- a/website/scripts/send-aggregated-metrics-to-datadog.js
+++ b/website/scripts/send-aggregated-metrics-to-datadog.js
@@ -406,6 +406,69 @@ module.exports = {
       }],
       tags: [`enabled:false`],
     });
+    // aiFeaturesDisabled
+    let numberOfInstancesWithAiFeaturesDisabled = _.where(latestStatisticsReportedByReleasedFleetVersions, {aiFeaturesDisabled: true}).length;
+    let numberOfInstancesWithAiFeaturesEnabled = numberOfInstancesToReport - numberOfInstancesWithAiFeaturesDisabled;
+    metricsToReport.push({
+      metric: 'usage_statistics.ai_features',
+      type: 3,
+      points: [{
+        timestamp: timestampForTheseMetrics,
+        value: numberOfInstancesWithAiFeaturesEnabled
+      }],
+      tags: [`enabled:true`],
+    });
+    metricsToReport.push({
+      metric: 'usage_statistics.ai_features',
+      type: 3,
+      points: [{
+        timestamp: timestampForTheseMetrics,
+        value: numberOfInstancesWithAiFeaturesDisabled
+      }],
+      tags: [`enabled:false`],
+    });
+    // maintenanceWindowsEnabled
+    let numberOfInstancesWithMaintenanceWindowsEnabled = _.where(latestStatisticsReportedByReleasedFleetVersions, {maintenanceWindowsEnabled: true}).length;
+    let numberOfInstancesWithMaintenanceWindowsDisabled = numberOfInstancesToReport - numberOfInstancesWithMaintenanceWindowsEnabled;
+    metricsToReport.push({
+      metric: 'usage_statistics.maintenance_windows',
+      type: 3,
+      points: [{
+        timestamp: timestampForTheseMetrics,
+        value: numberOfInstancesWithMaintenanceWindowsEnabled
+      }],
+      tags: [`enabled:true`],
+    });
+    metricsToReport.push({
+      metric: 'usage_statistics.maintenance_windows',
+      type: 3,
+      points: [{
+        timestamp: timestampForTheseMetrics,
+        value: numberOfInstancesWithMaintenanceWindowsDisabled
+      }],
+      tags: [`enabled:false`],
+    });
+    // maintenanceWindowsConfigured
+    let numberOfInstancesWithMaintenanceWindowsConfigured = _.where(latestStatisticsReportedByReleasedFleetVersions, {maintenanceWindowsEnabled: true}).length;
+    let numberOfInstancesWithoutMaintenanceWindowsConfigured = numberOfInstancesToReport - numberOfInstancesWithMaintenanceWindowsConfigured;
+    metricsToReport.push({
+      metric: 'usage_statistics.maintenance_windows_configured',
+      type: 3,
+      points: [{
+        timestamp: timestampForTheseMetrics,
+        value: numberOfInstancesWithMaintenanceWindowsConfigured
+      }],
+      tags: [`configured:true`],
+    });
+    metricsToReport.push({
+      metric: 'usage_statistics.maintenance_windows_configured',
+      type: 3,
+      points: [{
+        timestamp: timestampForTheseMetrics,
+        value: numberOfInstancesWithoutMaintenanceWindowsConfigured
+      }],
+      tags: [`configured:false`],
+    });
 
     // Create two metrics to track total number of hosts reported in the last week.
     let totalNumberOfHostsReportedByPremiumInstancesInTheLastWeek = _.sum(_.pluck(_.filter(latestStatisticsReportedByReleasedFleetVersions, {licenseTier: 'premium'}), 'numHostsEnrolled'));
diff --git a/website/views/emails/email-contact-form.ejs b/website/views/emails/email-contact-form.ejs
new file mode 100644
index 000000000000..0e8f8bf8ee52
--- /dev/null
+++ b/website/views/emails/email-contact-form.ejs
@@ -0,0 +1,15 @@
+<% /* Note: This is NOT injected into an email layout` */ %>
+<div style="width: 100%; font-family: 'Inter','Helvetica','arial', sans-serif; box-sizing: border-box; padding: 0; margin: 0;">
+  <div style="color: #192147; font-size: 16px; box-sizing: border-box; padding: 40px 60px 80px 28px; width: 100%; max-width: 600px; margin-left: auto; margin-right: auto;">
+    <div style="background: transparent; text-align: left;">
+      <a href="https://fleetdm.com"><img style="display: inline-block; width: 162px; height: 92px; width: auto;" alt="Logo" src="https://fleetdm.com/images/logo-blue-162x92@2x.png"/></a>
+    </div>
+    <div style="margin-bottom: 48px">
+      <p style="margin-bottom: 16px;"><strong>Message:</strong></p>
+      <pre ><code><%= message %></code></pre>
+      <p style="margin-bottom: 16px;"><strong>Submitter information:</strong></p>
+      <p style="margin-bottom: 16px;"><strong>Name:</strong> <%= firstName %> <%= lastName %></p>
+      <p style="margin-bottom: 16px;"><strong>Email address:</strong> <a href="mailto:<%= firstName %> <%= lastName %><<%= emailAddress %>>"><%= emailAddress %></a></p>
+    </div>
+  </div>
+</div>
diff --git a/website/views/emails/email-deal-registration.ejs b/website/views/emails/email-deal-registration.ejs
new file mode 100644
index 000000000000..effd53b39985
--- /dev/null
+++ b/website/views/emails/email-deal-registration.ejs
@@ -0,0 +1,27 @@
+<% /* Note: This is injected into `views/layouts/layout-email.ejs` */ %>
+<h2>New deal registration</h2>
+
+<div style="margin-bottom: 48px">
+  <h3>Submitter information</h3>
+  <p style="margin-bottom: 25px;"><strong>Name:</strong> <%= submittersFirstName %> <%= submittersLastName %></p>
+  <p style="margin-bottom: 25px;"><strong>Email address:</strong> <%= submittersEmailAddress %></p>
+  <p><strong>Organization:</strong> <%= submittersOrganization %></p>
+</div>
+<hr>
+<div style="margin-bottom: 48px">
+  <h3>Customer information</h3>
+  <p style="margin-bottom: 25px;"><strong>Name:</strong> <%= customersFirstName %> <%= customersLastName %></p>
+  <p style="margin-bottom: 25px;"><strong>Email address:</strong> <%= customersEmailAddress %></p>
+  <p style="margin-bottom: 25px;"><strong>LinkedIn URL:</strong> <%= linkedinUrl %></p>
+  <p><strong>Organization:</strong> <%= customersOrganization %></p>
+</div>
+<hr>
+<div style="margin-bottom: 48px">
+  <h3>Deal information</h3>
+  <p style="margin-bottom: 25px;"><strong>Customer's current MDM solution:</strong> <%= customersCurrentMdm %></p>
+  <p style="margin-bottom: 25px;"><strong>Other MDMs being evaluated:</strong> <%= otherMdmEvaluated %></p>
+  <p style="margin-bottom: 25px;"><strong>Preferred hosting:</strong> <%= preferredHosting %></p>
+  <p style="margin-bottom: 25px;"><strong>Expected deal size:</strong> <%= expectedDealSize %></p>
+  <p style="margin-bottom: 25px;"><strong>Expected close date:</strong> <%= expectedCloseDate %></p>
+  <p style="margin-bottom: 25px;"><strong>Notes:</strong> <%= notes %></p>
+</div>
diff --git a/website/views/emails/email-nurture-stage-five.ejs b/website/views/emails/email-nurture-stage-five.ejs
new file mode 100644
index 000000000000..a7f912fd372a
--- /dev/null
+++ b/website/views/emails/email-nurture-stage-five.ejs
@@ -0,0 +1,6 @@
+<% /* Note: This is injected into `views/layouts/layout-nurture-email.ejs` */ %>
+<div style="padding: 0px 0px 0px 0px">
+  <p style=" font-size: 16px; line-height: 24px; margin-bottom: 24px; margin-top: 0px">Hi <%- firstName %>,</p>
+  <p style=" font-size: 16px; line-height: 24px; margin-bottom: 48px; margin-top: 0px">There’s been some big updates to Fleet and the roadmap. One of our founders is holding a small group call this Friday to help folks get set up. Feel free to join us: <a style="color: #6A67FE; text-decoration: none; word-break: break-word;" href="https://calendly.com/fleetdm/chat" target="_blank">https://calendly.com/fleetdm/chat</a></p>
+
+</div>
diff --git a/website/views/emails/email-nurture-stage-four.ejs b/website/views/emails/email-nurture-stage-four.ejs
new file mode 100644
index 000000000000..1d5c9bc6732b
--- /dev/null
+++ b/website/views/emails/email-nurture-stage-four.ejs
@@ -0,0 +1,6 @@
+<% /* Note: This is injected into `views/layouts/layout-nurture-email.ejs` */ %>
+<div style="padding: 0px 0px 0px 0px">
+  <p style=" font-size: 16px; line-height: 24px; margin-bottom: 24px; margin-top: 0px">Hi <%- firstName %>,</p>
+  <p style=" font-size: 16px; line-height: 24px; margin-bottom: 48px; margin-top: 0px">There’s never a good time to migrate your MDM, but Fleet makes it easier. Here’s what the deployment process looks like: <a style="color: #6A67FE; text-decoration: none; word-break: break-word;" href="https://fleetdm.com/docs/deploy/deploy-fleet" target="_blank">https://fleetdm.com/docs/deploy/deploy-fleet</a></p>
+
+</div>
diff --git a/website/views/emails/email-nurture-stage-three.ejs b/website/views/emails/email-nurture-stage-three.ejs
new file mode 100644
index 000000000000..64c9dd6a624b
--- /dev/null
+++ b/website/views/emails/email-nurture-stage-three.ejs
@@ -0,0 +1,7 @@
+<% /* Note: This is injected into `views/layouts/layout-nurture-email.ejs` */ %>
+<div style="padding: 0px 0px 0px 0px">
+  <p style=" font-size: 16px; line-height: 24px; margin-bottom: 24px; margin-top: 0px">Hi <%- firstName %>,</p>
+  <p style=" font-size: 16px; line-height: 24px; margin-bottom: 24px; margin-top: 0px">We noticed that you were checking out Fleet recently. What did you think?</p>
+  <p style=" font-size: 16px; line-height: 24px; margin-bottom: 48px; margin-top: 0px">PS. One of our founders is holding a small group call this Friday to help folks get set up. Feel free to join us: <a style="color: #6A67FE; text-decoration: none; word-break: break-word;" href="https://calendly.com/fleetdm/chat" target="_blank">https://calendly.com/fleetdm/chat</a></p>
+
+</div>
diff --git a/website/views/layouts/layout-nurture-email.ejs b/website/views/layouts/layout-nurture-email.ejs
new file mode 100644
index 000000000000..5c4df42a0ed9
--- /dev/null
+++ b/website/views/layouts/layout-nurture-email.ejs
@@ -0,0 +1,23 @@
+<% /* Default layout for email templates */ %>
+<div style="width: 100%; max-width: 600px; font-family: 'Inter','Helvetica','arial', sans-serif; box-sizing: border-box; padding: 0; margin: auto; border-radius: 8px; border: 1px solid #E2E4EA; background: #FFF;">
+    <div style="background: transparent; text-align: left;">
+      <a href="https://fleetdm.com"><img style="display: inline-block; width: 100%; max-width: 100%; border-top-left-radius: 8px; border-top-right-radius: 8px;" alt="Logo" src="<%= url.resolve(sails.config.custom.baseUrl,'images/email-header-959x452@2x.png')%>"/></a>
+    </div>
+  <div style="color: #192147; font-size: 16px; box-sizing: border-box; padding: 32px; width: 100%; max-width: 600px; margin-left: auto; margin-right: auto;">
+    <div>
+      <%- body %>
+      <hr style="color: #E2E4EA;"/>
+      <div style="display:  inline-flex; padding-top: 32px;">
+        <a href="https://fleetdm.com/slack" target="_blank"><img style="height: 20px; width: 20px; margin-right: 24px;" alt="Join the osquery Slack community" src="<%= url.resolve(sails.config.custom.baseUrl,'images/logo-slack-dark-20x20@2x.png')%>"></a>
+        <a href="https://github.com/fleetdm/fleet" target="_blank"><img style="height: 20px; width: 20px; margin-right: 24px;" alt="View Fleet's GitHub repo" src="<%= url.resolve(sails.config.custom.baseUrl,'images/logo-github-dark-24x24@2x.png')%>"></a>
+        <a href="https://fleetdm.com/slack" target="_blank"><img style="height: 20px; width: 20px; margin-right: 24px;" alt="Conenct with Fleet on LinkedIn" src="<%= url.resolve(sails.config.custom.baseUrl,'images/logo-linkedin-24x24@2x.png')%>"></a>
+        <a href="https://twitter.com/fleetctl" target="_blank"><img style="height: 20px; width: 24px; margin-right: 24px;" alt="Follow Fleet on Twitter" src="<%= url.resolve(sails.config.custom.baseUrl,'images/logo-x-24x24@2x.png')%>"></a>
+        <a href="https://www.youtube.com/channel/UCZyoqZ4exJvoibmTKJrQ-dQ" target="_blank"><img style="width: 20px; margin-top: 3px; margin-right: 24px;" alt="Watch Fleet's Youtube videos" src="<%= url.resolve(sails.config.custom.baseUrl,'images/logo-youtube-29x20@2x.png')%>"></a>
+      </div>
+      <div style="text-align: left; padding-top: 15px; font-size: 12px; color: #3E4771;">
+        <p>© <%= (new Date()).getFullYear() %> Fleet Inc.<br> All trademarks are the property of their respective owners.</p>
+      </div>
+    </div>
+    <a style="font-size: 12px; color: #3E4771;" href="<%= url.resolve(sails.config.custom.baseUrl, '/unsubscribe?emailAddress='+encodeURIComponent(emailAddress)) %>">Unsubscribe</a>
+  </div>
+</div>
diff --git a/website/views/layouts/layout.ejs b/website/views/layouts/layout.ejs
index e77f6cb881ac..702ba0d5f58c 100644
--- a/website/views/layouts/layout.ejs
+++ b/website/views/layouts/layout.ejs
@@ -55,28 +55,21 @@
     !function(r){var e={};function o(n){if(e[n])return e[n].exports;var t=e[n]={i:n,l:!1,exports:{}};return r[n].call(t.exports,t,t.exports,o),t.l=!0,t.exports}o.m=r,o.c=e,o.d=function(r,e,n){o.o(r,e)||Object.defineProperty(r,e,{enumerable:!0,get:n})},o.r=function(r){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(r,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(r,"__esModule",{value:!0})},o.t=function(r,e){if(1&e&&(r=o(r)),8&e)return r;if(4&e&&"object"==typeof r&&r&&r.__esModule)return r;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:r}),2&e&&"string"!=typeof r)for(var t in r)o.d(n,t,function(e){return r[e]}.bind(null,t));return n},o.n=function(r){var e=r&&r.__esModule?function(){return r.default}:function(){return r};return o.d(e,"a",e),e},o.o=function(r,e){return Object.prototype.hasOwnProperty.call(r,e)},o.p="",o(o.s=0)}([function(r,e,o){"use strict";var n=o(1),t=o(5);_rollbarConfig=_rollbarConfig||{},_rollbarConfig.rollbarJsUrl=_rollbarConfig.rollbarJsUrl||"https://cdn.rollbar.com/rollbarjs/refs/tags/v2.22.0/rollbar.min.js",_rollbarConfig.async=void 0===_rollbarConfig.async||_rollbarConfig.async;var a=n.setupShim(window,_rollbarConfig),l=t(_rollbarConfig);window.rollbar=n.Rollbar,a.loadFull(window,document,!_rollbarConfig.async,_rollbarConfig,l)},function(r,e,o){"use strict";var n=o(2),t=o(3);function a(r){return function(){try{return r.apply(this,arguments)}catch(r){try{console.error("[Rollbar]: Internal error",r)}catch(r){}}}}var l=0;function i(r,e){this.options=r,this._rollbarOldOnError=null;var o=l++;this.shimId=function(){return o},"undefined"!=typeof window&&window._rollbarShims&&(window._rollbarShims[o]={handler:e,messages:[]})}var s=o(4),d=function(r,e){return new i(r,e)},c=function(r){return new s(d,r)};function u(r){return a((function(){var e=this,o=Array.prototype.slice.call(arguments,0),n={shim:e,method:r,args:o,ts:new Date};window._rollbarShims[this.shimId()].messages.push(n)}))}i.prototype.loadFull=function(r,e,o,n,t){var l=!1,i=e.createElement("script"),s=e.getElementsByTagName("script")[0],d=s.parentNode;i.crossOrigin="",i.src=n.rollbarJsUrl,o||(i.async=!0),i.onload=i.onreadystatechange=a((function(){if(!(l||this.readyState&&"loaded"!==this.readyState&&"complete"!==this.readyState)){i.onload=i.onreadystatechange=null;try{d.removeChild(i)}catch(r){}l=!0,function(){var e;if(void 0===r._rollbarDidLoad){e=new Error("rollbar.js did not load");for(var o,n,a,l,i=0;o=r._rollbarShims[i++];)for(o=o.messages||[];n=o.shift();)for(a=n.args||[],i=0;i<a.length;++i)if("function"==typeof(l=a[i])){l(e);break}}"function"==typeof t&&t(e)}()}})),d.insertBefore(i,s)},i.prototype.wrap=function(r,e,o){try{var n;if(n="function"==typeof e?e:function(){return e||{}},"function"!=typeof r)return r;if(r._isWrap)return r;if(!r._rollbar_wrapped&&(r._rollbar_wrapped=function(){o&&"function"==typeof o&&o.apply(this,arguments);try{return r.apply(this,arguments)}catch(o){var e=o;throw e&&("string"==typeof e&&(e=new String(e)),e._rollbarContext=n()||{},e._rollbarContext._wrappedSource=r.toString(),window._rollbarWrappedError=e),e}},r._rollbar_wrapped._isWrap=!0,r.hasOwnProperty))for(var t in r)r.hasOwnProperty(t)&&(r._rollbar_wrapped[t]=r[t]);return r._rollbar_wrapped}catch(e){return r}};for(var p="log,debug,info,warn,warning,error,critical,global,configure,handleUncaughtException,handleAnonymousErrors,handleUnhandledRejection,captureEvent,captureDomContentLoaded,captureLoad".split(","),f=0;f<p.length;++f)i.prototype[p[f]]=u(p[f]);r.exports={setupShim:function(r,e){if(r){var o=e.globalAlias||"Rollbar";if("object"==typeof r[o])return r[o];r._rollbarShims={},r._rollbarWrappedError=null;var l=new c(e);return a((function(){e.captureUncaught&&(l._rollbarOldOnError=r.onerror,n.captureUncaughtExceptions(r,l,!0),e.wrapGlobalEventHandlers&&t(r,l,!0)),e.captureUnhandledRejections&&n.captureUnhandledRejections(r,l,!0);var a=e.autoInstrument;return!1!==e.enabled&&(void 0===a||!0===a||"object"==typeof a&&a.network)&&r.addEventListener&&(r.addEventListener("load",l.captureLoad.bind(l)),r.addEventListener("DOMContentLoaded",l.captureDomContentLoaded.bind(l))),r[o]=l,l}))()}},Rollbar:c}},function(r,e,o){"use strict";function n(r,e,o,n){r._rollbarWrappedError&&(n[4]||(n[4]=r._rollbarWrappedError),n[5]||(n[5]=r._rollbarWrappedError._rollbarContext),r._rollbarWrappedError=null);var t=e.handleUncaughtException.apply(e,n);o&&o.apply(r,n),"anonymous"===t&&(e.anonymousErrorsPending+=1)}r.exports={captureUncaughtExceptions:function(r,e,o){if(r){var t;if("function"==typeof e._rollbarOldOnError)t=e._rollbarOldOnError;else if(r.onerror){for(t=r.onerror;t._rollbarOldOnError;)t=t._rollbarOldOnError;e._rollbarOldOnError=t}e.handleAnonymousErrors();var a=function(){var o=Array.prototype.slice.call(arguments,0);n(r,e,t,o)};o&&(a._rollbarOldOnError=t),r.onerror=a}},captureUnhandledRejections:function(r,e,o){if(r){"function"==typeof r._rollbarURH&&r._rollbarURH.belongsToShim&&r.removeEventListener("unhandledrejection",r._rollbarURH);var n=function(r){var o,n,t;try{o=r.reason}catch(r){o=void 0}try{n=r.promise}catch(r){n="[unhandledrejection] error getting `promise` from event"}try{t=r.detail,!o&&t&&(o=t.reason,n=t.promise)}catch(r){}o||(o="[unhandledrejection] error getting `reason` from event"),e&&e.handleUnhandledRejection&&e.handleUnhandledRejection(o,n)};n.belongsToShim=o,r._rollbarURH=n,r.addEventListener("unhandledrejection",n)}}}},function(r,e,o){"use strict";function n(r,e,o){if(e.hasOwnProperty&&e.hasOwnProperty("addEventListener")){for(var n=e.addEventListener;n._rollbarOldAdd&&n.belongsToShim;)n=n._rollbarOldAdd;var t=function(e,o,t){n.call(this,e,r.wrap(o),t)};t._rollbarOldAdd=n,t.belongsToShim=o,e.addEventListener=t;for(var a=e.removeEventListener;a._rollbarOldRemove&&a.belongsToShim;)a=a._rollbarOldRemove;var l=function(r,e,o){a.call(this,r,e&&e._rollbar_wrapped||e,o)};l._rollbarOldRemove=a,l.belongsToShim=o,e.removeEventListener=l}}r.exports=function(r,e,o){if(r){var t,a,l="EventTarget,Window,Node,ApplicationCache,AudioTrackList,ChannelMergerNode,CryptoOperation,EventSource,FileReader,HTMLUnknownElement,IDBDatabase,IDBRequest,IDBTransaction,KeyOperation,MediaController,MessagePort,ModalWindow,Notification,SVGElementInstance,Screen,TextTrack,TextTrackCue,TextTrackList,WebSocket,WebSocketWorker,Worker,XMLHttpRequest,XMLHttpRequestEventTarget,XMLHttpRequestUpload".split(",");for(t=0;t<l.length;++t)r[a=l[t]]&&r[a].prototype&&n(e,r[a].prototype,o)}}},function(r,e,o){"use strict";function n(r,e){this.impl=r(e,this),this.options=e,function(r){for(var e=function(r){return function(){var e=Array.prototype.slice.call(arguments,0);if(this.impl[r])return this.impl[r].apply(this.impl,e)}},o="log,debug,info,warn,warning,error,critical,global,configure,handleUncaughtException,handleAnonymousErrors,handleUnhandledRejection,_createItem,wrap,loadFull,shimId,captureEvent,captureDomContentLoaded,captureLoad".split(","),n=0;n<o.length;n++)r[o[n]]=e(o[n])}(n.prototype)}n.prototype._swapAndProcessMessages=function(r,e){var o,n,t;for(this.impl=r(this.options);o=e.shift();)n=o.method,t=o.args,this[n]&&"function"==typeof this[n]&&("captureDomContentLoaded"===n||"captureLoad"===n?this[n].apply(this,[t[0],o.ts]):this[n].apply(this,t));return this},r.exports=n},function(r,e,o){"use strict";r.exports=function(r){return function(e){if(!e&&!window._rollbarInitialized){for(var o,n,t=(r=r||{}).globalAlias||"Rollbar",a=window.rollbar,l=function(r){return new a(r)},i=0;o=window._rollbarShims[i++];)n||(n=o.handler),o.handler._swapAndProcessMessages(l,o.messages);window[t]=n,window._rollbarInitialized=!0}}}}]);
     // End Rollbar Snippet
     </script>
+    <% /* Cookie consent banner */ %>
+    <script id="cookieyes" type="text/javascript" src="https://cdn-cookieyes.com/client_data/71bcdd51b166ceeb18bd0d28/script.js"></script>
     <% /* Google Analytics, Google Tag Manager, Snitcher etc. */ %>
     <% /* Global site tag (gtag.js) - Google Analytics */%>
     <script async src="https://www.googletagmanager.com/gtag/js?id=G-JC3DRNY1GV"></script>
     <script>
       window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'G-JC3DRNY1GV');
     </script>
-    <% /* Meta pixel code */ %>
+    <%/* Segment */%>
     <script>
-      !function(f,b,e,v,n,t,s)
-      {if(f.fbq)return;n=f.fbq=function(){n.callMethod?
-      n.callMethod.apply(n,arguments):n.queue.push(arguments)};
-      if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';
-      n.queue=[];t=b.createElement(e);t.async=!0;
-      t.src=v;s=b.getElementsByTagName(e)[0];
-      s.parentNode.insertBefore(t,s)}(window, document,'script',
-      'https://connect.facebook.net/en_US/fbevents.js');
-      fbq('init', '673041690615149');
-      fbq('track', 'PageView');
+      !function(){var i="analytics",analytics=window[i]=window[i]||[];if(!analytics.initialize)if(analytics.invoked)window.console&&console.error&&console.error("Segment snippet included twice.");else{analytics.invoked=!0;analytics.methods=["trackSubmit","trackClick","trackLink","trackForm","pageview","identify","reset","group","track","ready","alias","debug","page","screen","once","off","on","addSourceMiddleware","addIntegrationMiddleware","setAnonymousId","addDestinationMiddleware","register"];analytics.factory=function(e){return function(){if(window[i].initialized)return window[i][e].apply(window[i],arguments);var n=Array.prototype.slice.call(arguments);if(["track","screen","alias","group","page","identify"].indexOf(e)>-1){var c=document.querySelector("link[rel='canonical']");n.push({__t:"bpc",c:c&&c.getAttribute("href")||void 0,p:location.pathname,u:location.href,s:location.search,t:document.title,r:document.referrer})}n.unshift(e);analytics.push(n);return analytics}};for(var n=0;n<analytics.methods.length;n++){var key=analytics.methods[n];analytics[key]=analytics.factory(key)}analytics.load=function(key,n){var t=document.createElement("script");t.type="text/javascript";t.async=!0;t.setAttribute("data-global-segment-analytics-key",i);t.src="https://cdn.segment.com/analytics.js/v1/" + key + "/analytics.min.js";var r=document.getElementsByTagName("script")[0];r.parentNode.insertBefore(t,r);analytics._loadOptions=n};analytics._writeKey="T79nqv6Ow6Bjov5LZPxXqsuhM0YOHARv";;analytics.SNIPPET_VERSION="5.2.0";
+      analytics.load("T79nqv6Ow6Bjov5LZPxXqsuhM0YOHARv");
+      analytics.page();
+      }}();
     </script>
-    <noscript>
-      <img alt="Meta pixel" height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=673041690615149&ev=PageView&noscript=1"/>
-    </noscript>
     <%/* LinkedIn insight tag*/%>
     <script type="text/javascript">
       _linkedin_partner_id = "4365817";
@@ -114,10 +107,6 @@
           a.appendChild(r);
       })(window,document,'https://static.hotjar.com/c/hotjar-','.js?sv=');
     </script>
-    <%/* Reddit tracking pixel */%>
-    <script>
-    !function(w,d){if(!w.rdt){var p=w.rdt=function(){p.sendEvent?p.sendEvent.apply(p,arguments):p.callQueue.push(arguments)};p.callQueue=[];var t=d.createElement("script");t.src="https://www.redditstatic.com/ads/pixel.js",t.async=!0;var s=d.getElementsByTagName("script")[0];s.parentNode.insertBefore(t,s)}}(window,document);rdt('init','t2_84a3ro8l');rdt('track', 'PageVisit');
-    </script>
     <% }
     /* Otherwise, any such scripts are excluded, and we instead inject a
     robots/noindex meta tag to help prevent any unwanted visits from search engines. */
@@ -141,15 +130,9 @@
     <!--STYLES END-->
   </head>
   <body>
-    <% /* Google Tag Manager (noscript) */ %>
-    <noscript>
-      <iframe src="https://www.googletagmanager.com/ns.html?id=GTM-TSBSPZK"
-      height="0" width="0" style="display:none;visibility:hidden"></iframe>
-    </noscript>
-    <%/* End Google Tag Manager (noscript) */%>
     <div purpose="page-wrap" class="<%= hideFooterLinks ? 'reduced-footer-links' : '' %>">
       <%// Page header%>
-      <div class="header" purpose="header-container" data-nosnippet>
+      <div class="header" purpose="header-container" hide-when-scrolled data-nosnippet>
         <div purpose="header-background">
           <% if(!hideHeaderLinks) { %>
             <div purpose="page-header" class="container-fluid d-flex justify-content-between align-items-center">
@@ -163,7 +146,7 @@
                   <img class="align-self-center" alt="An icon indicating that interacting with this button will open the navigation menu." src="/images/icon-hamburger-blue-16x14@2x.png"/>
                 </a>
               </div>
-              <div purpose="mobile-nav" class="collapse" id="navbarToggleExternalContent">
+              <div purpose="mobile-nav" always-visible-when-shown class="collapse" id="navbarToggleExternalContent">
                 <div purpose="mobile-nav-header" class="d-flex justify-content-between align-items-center">
                   <a purpose="mobile-header-logo" href="/">
                     <img purpose="mobile-nav-logo" alt="Fleet logo" src="/images/logo-blue-118x41@2x.png" />
@@ -185,6 +168,7 @@
                   <div id="mobileNavbarToggleDocumentation" purpose="mobile-dropdown" class="collapse" data-parent="#mobileDropdowns">
                     <a purpose="mobile-dropdown-link" href="/docs">Docs</a>
                     <a purpose="mobile-dropdown-link" href="/docs/rest-api">REST API</a>
+                      <a purpose="mobile-dropdown-link" href="/guides">Guides</a>
                     <a purpose="mobile-dropdown-link" href="/queries"><%= ['eo-it', 'mdm'].includes(primaryBuyingSituation) ? 'Device health checks' : 'Built-in queries' %></a>
                     <a purpose="mobile-dropdown-link" href="/tables">Data tables</a>
                     <span>SUPPORT</span>
@@ -245,6 +229,7 @@
                   <div purpose="header-dropdown" class="dropdown-menu">
                     <a class="dropdown-item" href="/docs">Docs</a>
                     <a class="dropdown-item" href="/docs/rest-api">REST API</a>
+                    <a class="dropdown-item" href="/guides">Guides</a>
                     <a class="dropdown-item" href="/queries"><%= ['eo-it', 'mdm'].includes(primaryBuyingSituation) ? 'Built-in checks' : 'Built-in queries' %></a>
                     <a class="dropdown-item" href="/tables">Data tables</a>
                     <span class="muted dropdown-header">SUPPORT</span>
@@ -311,80 +296,80 @@
 
       <%/* Note: footer is hidden until the page is loaded. See «script» tag at the bottom of this file. */%>
       <% if(!hideFooterLinks) { %>
-      <div class="invisible container-fluid" purpose="page-footer" data-hide-until-rendered data-nosnippet>
-        <div purpose="footer-content">
-        <div purpose="footer-nav" class="d-flex flex-row flex-wrap row">
-          <div purpose="footer-nav-column" class="d-lg-flex d-none col-3">
-            <a href="/">
-              <img purpose="footer-logo" alt="Fleet logo" src="/images/logo-blue-118x41@2x.png"/>
-            </a>
-          </div>
-          <div purpose="footer-nav-column" class="d-flex flex-column col-lg-3 col-md-4 col-sm-6 col-12">
-            <strong purpose="footer-nav-header">Platform</strong>
-            <a href="/device-management">Device management</a>
-            <a href="/endpoint-ops">Endpoint ops</a>
-            <a href="/vulnerability-management">Vulnerability management</a>
-            <a href="/integrations">Integrations</a>
-            <a href="/pricing">Pricing</a>
-          </div>
-          <div purpose="footer-nav-column" class="d-flex flex-column col-lg-3 col-md-4 col-sm-6 col-12">
-            <strong purpose="footer-nav-header">Documentation</strong>
-            <a href="/support">Support</a>
-            <a href="/docs">Docs</a>
-            <a href="/docs/rest-api">REST API</a>
-            <a href="/new-license">Get your license</a>
-            <a href="/docs/contributing">Contribute</a>
-          </div>
-          <div purpose="footer-nav-column" class="d-flex flex-column col-lg-3 col-md-4 col-sm-6 col-12">
-            <strong purpose="footer-nav-header">Company</strong>
-            <a href="/handbook/company">About</a>
-            <a href="/articles">Blog</a>
-            <a href="/apply">Jobs</a>
-            <a href="/logos">Logos/artwork</a>
-            <a href="/handbook/company/why-this-way#why-open-source">Why open source?</a>
+        <div class="invisible container-fluid" purpose="page-footer" data-hide-until-rendered data-nosnippet>
+          <div purpose="footer-content">
+          <div purpose="footer-nav" class="d-flex flex-row flex-wrap row">
+            <div purpose="footer-nav-column" class="d-lg-flex d-none col-3">
+              <a href="/">
+                <img purpose="footer-logo" alt="Fleet logo" src="/images/logo-blue-118x41@2x.png"/>
+              </a>
+            </div>
+            <div purpose="footer-nav-column" class="d-flex flex-column col-lg-3 col-md-4 col-sm-6 col-12">
+              <strong purpose="footer-nav-header">Platform</strong>
+              <a href="/device-management">Device management</a>
+              <a href="/endpoint-ops">Endpoint ops</a>
+              <a href="/vulnerability-management">Vulnerability management</a>
+              <a href="/integrations">Integrations</a>
+              <a href="/pricing">Pricing</a>
+            </div>
+            <div purpose="footer-nav-column" class="d-flex flex-column col-lg-3 col-md-4 col-sm-6 col-12">
+              <strong purpose="footer-nav-header">Documentation</strong>
+              <a href="/support">Support</a>
+              <a href="/docs">Docs</a>
+              <a href="/docs/rest-api">REST API</a>
+              <a href="/new-license">Get your license</a>
+              <a href="/docs/contributing">Contribute</a>
+            </div>
+            <div purpose="footer-nav-column" class="d-flex flex-column col-lg-3 col-md-4 col-sm-6 col-12">
+              <strong purpose="footer-nav-header">Company</strong>
+              <a href="/handbook/company">About</a>
+              <a href="/articles">Blog</a>
+              <a href="/apply">Jobs</a>
+              <a href="/logos">Logos/artwork</a>
+              <a href="/handbook/company/why-this-way#why-open-source">Why open source?</a>
+            </div>
           </div>
-        </div>
 
-        <div purpose="footer-bottom">
-          <div purpose="legal-and-social-nav" class="d-flex flex-lg-row flex-column align-items-lg-center justify-content-lg-between">
+          <div purpose="footer-bottom">
+            <div purpose="legal-and-social-nav" class="d-flex flex-lg-row flex-column align-items-lg-center justify-content-lg-between">
 
-            <div purpose="legal-section" class="d-flex flex-column justify-content-start align-items-start flex-sm-row pr-sm-0">
-              <div purpose="license-information" class="d-flex flex-row align-items-center">
-                <img purpose="creative-commons-license" alt="Creative Commons Licence CC BY-SA 4.0" src="/images/logo-creative-commons-greyscale-80x16@2x.png" />
-                <a purpose="footer-trust-link" class="d-flex flex-row align-items-center" href="/trust" target="_blank"><img alt="a small checkmark" src="/images/icon-checkmark-fleet-black-75-9x7@2x.png">SOC2 Type 2</a>
-              </div>
-              <div class="text-sm-nowrap d-block d-sm-inline">
-                © <%= (new Date()).getFullYear() %> <a href="/handbook/company"><%= corporationDisplayName %></a>
-                <span purpose="legal-links">
-                  <a href="/legal/privacy">Privacy</a>
-                </span>
+              <div purpose="legal-section" class="d-flex flex-column justify-content-start align-items-start flex-sm-row pr-sm-0">
+                <div purpose="license-information" class="d-flex flex-row align-items-center">
+                  <img purpose="creative-commons-license" alt="Creative Commons Licence CC BY-SA 4.0" src="/images/logo-creative-commons-greyscale-80x16@2x.png" />
+                  <a purpose="footer-trust-link" class="d-flex flex-row align-items-center" href="/trust" target="_blank"><img alt="a small checkmark" src="/images/icon-checkmark-fleet-black-75-9x7@2x.png">SOC2 Type 2</a>
+                </div>
+                <div class="text-sm-nowrap d-block d-sm-inline">
+                  © <%= (new Date()).getFullYear() %> <a href="/handbook/company"><%= corporationDisplayName %></a>
+                  <span purpose="legal-links">
+                    <a href="/legal/privacy">Privacy</a>
+                  </span>
+                </div>
               </div>
-            </div>
 
-            <div purpose="footer-socials" class="flex-row d-inline-flex font-weight-bold order-first order-lg-last justify-content-start justify-content-lg-end pl-lg-3">
-              <a target="_blank" href="/slack" class="mr-4">
-                <img alt="Slack logo" src="/images/logo-slack-dark-20x20@2x.png"/>
-              </a>
-              <a target="_blank" href="https://github.com/fleetdm/fleet" class="mr-4">
-                <img alt="GitHub logo" src="/images/logo-github-dark-24x24@2x.png" />
-              </a>
-              <a target="_blank" href="https://www.linkedin.com/company/fleetdm" class="mr-4">
-                <img alt="LinkedIn logo" src="/images/logo-linkedin-24x24@2x.png" />
-              </a>
-              <a target="_blank" href="https://twitter.com/fleetctl" class="mr-4">
-                <img alt="X (Twitter) logo" src="/images/logo-x-24x24@2x.png"/>
-              </a>
-              <a target="_blank" href="https://www.youtube.com/channel/UCZyoqZ4exJvoibmTKJrQ-dQ" class="mr-4">
-                <img alt="Youtube logo" src="/images/logo-youtube-29x20@2x.png" />
-              </a>
-              <a target="_blank" href="https://mastodon.social/@Fleet@discuss.systems" class="mr-4">
-                <img alt="Mastadon logo" src="/images/logo-mastadon-24x23@2x.png"/>
-              </a>
+              <div purpose="footer-socials" class="flex-row d-inline-flex font-weight-bold order-first order-lg-last justify-content-start justify-content-lg-end pl-lg-3">
+                <a target="_blank" href="/slack" class="mr-4">
+                  <img alt="Slack logo" src="/images/logo-slack-dark-20x20@2x.png"/>
+                </a>
+                <a target="_blank" href="https://github.com/fleetdm/fleet" class="mr-4">
+                  <img alt="GitHub logo" src="/images/logo-github-dark-24x24@2x.png" />
+                </a>
+                <a target="_blank" href="https://www.linkedin.com/company/fleetdm" class="mr-4">
+                  <img alt="LinkedIn logo" src="/images/logo-linkedin-24x24@2x.png" />
+                </a>
+                <a target="_blank" href="https://twitter.com/fleetctl" class="mr-4">
+                  <img alt="X (Twitter) logo" src="/images/logo-x-24x24@2x.png"/>
+                </a>
+                <a target="_blank" href="https://www.youtube.com/channel/UCZyoqZ4exJvoibmTKJrQ-dQ" class="mr-4">
+                  <img alt="Youtube logo" src="/images/logo-youtube-29x20@2x.png" />
+                </a>
+                <a target="_blank" href="https://mastodon.social/@Fleet@discuss.systems" class="mr-4">
+                  <img alt="Mastadon logo" src="/images/logo-mastadon-24x23@2x.png"/>
+                </a>
+              </div>
             </div>
           </div>
+          </div>
         </div>
-        </div>
-      </div>
       <% } else { %>
         <div purpose="reduced-nav-footer" data-nosnippet>
             <div purpose="legal-and-social-nav" class="d-flex flex-md-row flex-column align-items-lg-center justify-content-md-between">
@@ -437,43 +422,9 @@
       by the asset pipeline between "SCRIPTS" and "SCRIPTS END", or both.
       (https://sailsjs.com/docs/concepts/assets/task-automation)
     */ %>
-    <% /* Cookie consent banner */ %>
-    <script id="cookieyes" type="text/javascript" src="https://cdn-cookieyes.com/client_data/71bcdd51b166ceeb18bd0d28/script.js"></script>
-
     <%/* Stripe.js */%>
     <script src="https://js.stripe.com/v3/"></script>
 
-    <% /* Delete the global `self` to help avoid client-side bugs.
-    (see https://developer.mozilla.org/en-US/docs/Web/API/Window/self) */ %>
-    <script>delete window.self;</script>
-
-    <% /* Sticky header */ %>
-    <script>
-        var lastScrollTop = 0;
-        var header = document.querySelector('[purpose="header-container"]');
-        let mobileNavMenu = document.querySelector('[purpose="mobile-nav"]');
-        window.addEventListener('scroll', windowScrolled);
-        function windowScrolled() {
-          if(!header || !mobileNavMenu){
-            return;
-          }
-          let isMobileNavOpen = [...mobileNavMenu.classList].includes('show');
-          if(isMobileNavOpen) {
-            return;
-          }
-          let scrollTop = window.pageYOffset || document.documentElement.scrollTop;
-          if(scrollTop > lastScrollTop && scrollTop > window.innerHeight * 1.5) {
-            // If the user scrolls 1.5x the height of their browser window, hide the page header.
-            header.classList.add('translate-y-0');
-            lastScrollTop = scrollTop;
-          } else if(scrollTop < lastScrollTop - 60) {
-            // If the user scrolls 60 pixels upwards on the screen, we'll show the page header
-            header.classList.remove('translate-y-0');
-            lastScrollTop = scrollTop;
-          }
-        }
-    </script>
-
     <%/* bowser.js (for browser detection) -- included inline to avoid issues with minification that could affect the unsupported browser overlay */%>
     <script>!function(e,i,s){if("undefined"!=typeof module&&module.exports)module.exports=s();else if("function"==typeof define&&define.amd)define(i,s);else e[i]=s()}(this,"bowser",function(){var e=true;function i(i){function s(e){var s=i.match(e);return s&&s.length>1&&s[1]||""}function o(e){var s=i.match(e);return s&&s.length>1&&s[2]||""}var r=s(/(ipod|iphone|ipad)/i).toLowerCase(),n=/like android/i.test(i),t=!n&&/android/i.test(i),a=/nexus\s*[0-6]\s*/i.test(i),d=!a&&/nexus\s*[0-9]+/i.test(i),l=/CrOS/.test(i),f=/silk/i.test(i),m=/sailfish/i.test(i),v=/tizen/i.test(i),p=/(web|hpw)os/i.test(i),c=/windows phone/i.test(i),u=/SamsungBrowser/i.test(i),h=!c&&/windows/i.test(i),w=!r&&!f&&/macintosh/i.test(i),b=!t&&!m&&!v&&!p&&/linux/i.test(i),g=o(/edg([ea]|ios)\/(\d+(\.\d+)?)/i),k=s(/version\/(\d+(\.\d+)?)/i),x=/tablet/i.test(i)&&!/tablet pc/i.test(i),y=!x&&/[^-]mobi/i.test(i),S=/xbox/i.test(i),B;if(/opera/i.test(i))B={name:"Opera",opera:e,version:k||s(/(?:opera|opr|opios)[\s\/](\d+(\.\d+)?)/i)};else if(/opr\/|opios/i.test(i))B={name:"Opera",opera:e,version:s(/(?:opr|opios)[\s\/](\d+(\.\d+)?)/i)||k};else if(/SamsungBrowser/i.test(i))B={name:"Samsung Internet for Android",samsungBrowser:e,version:k||s(/(?:SamsungBrowser)[\s\/](\d+(\.\d+)?)/i)};else if(/coast/i.test(i))B={name:"Opera Coast",coast:e,version:k||s(/(?:coast)[\s\/](\d+(\.\d+)?)/i)};else if(/yabrowser/i.test(i))B={name:"Yandex Browser",yandexbrowser:e,version:k||s(/(?:yabrowser)[\s\/](\d+(\.\d+)?)/i)};else if(/ucbrowser/i.test(i))B={name:"UC Browser",ucbrowser:e,version:s(/(?:ucbrowser)[\s\/](\d+(?:\.\d+)+)/i)};else if(/mxios/i.test(i))B={name:"Maxthon",maxthon:e,version:s(/(?:mxios)[\s\/](\d+(?:\.\d+)+)/i)};else if(/epiphany/i.test(i))B={name:"Epiphany",epiphany:e,version:s(/(?:epiphany)[\s\/](\d+(?:\.\d+)+)/i)};else if(/puffin/i.test(i))B={name:"Puffin",puffin:e,version:s(/(?:puffin)[\s\/](\d+(?:\.\d+)?)/i)};else if(/sleipnir/i.test(i))B={name:"Sleipnir",sleipnir:e,version:s(/(?:sleipnir)[\s\/](\d+(?:\.\d+)+)/i)};else if(/k-meleon/i.test(i))B={name:"K-Meleon",kMeleon:e,version:s(/(?:k-meleon)[\s\/](\d+(?:\.\d+)+)/i)};else if(c){B={name:"Windows Phone",osname:"Windows Phone",windowsphone:e};if(g){B.msedge=e;B.version=g}else{B.msie=e;B.version=s(/iemobile\/(\d+(\.\d+)?)/i)}}else if(/msie|trident/i.test(i))B={name:"Internet Explorer",msie:e,version:s(/(?:msie |rv:)(\d+(\.\d+)?)/i)};else if(l)B={name:"Chrome",osname:"Chrome OS",chromeos:e,chromeBook:e,chrome:e,version:s(/(?:chrome|crios|crmo)\/(\d+(\.\d+)?)/i)};else if(/edg([ea]|ios)/i.test(i))B={name:"Microsoft Edge",msedge:e,version:g};else if(/vivaldi/i.test(i))B={name:"Vivaldi",vivaldi:e,version:s(/vivaldi\/(\d+(\.\d+)?)/i)||k};else if(m)B={name:"Sailfish",osname:"Sailfish OS",sailfish:e,version:s(/sailfish\s?browser\/(\d+(\.\d+)?)/i)};else if(/seamonkey\//i.test(i))B={name:"SeaMonkey",seamonkey:e,version:s(/seamonkey\/(\d+(\.\d+)?)/i)};else if(/firefox|iceweasel|fxios/i.test(i)){B={name:"Firefox",firefox:e,version:s(/(?:firefox|iceweasel|fxios)[ \/](\d+(\.\d+)?)/i)};if(/\((mobile|tablet);[^\)]*rv:[\d\.]+\)/i.test(i)){B.firefoxos=e;B.osname="Firefox OS"}}else if(f)B={name:"Amazon Silk",silk:e,version:s(/silk\/(\d+(\.\d+)?)/i)};else if(/phantom/i.test(i))B={name:"PhantomJS",phantom:e,version:s(/phantomjs\/(\d+(\.\d+)?)/i)};else if(/slimerjs/i.test(i))B={name:"SlimerJS",slimer:e,version:s(/slimerjs\/(\d+(\.\d+)?)/i)};else if(/blackberry|\bbb\d+/i.test(i)||/rim\stablet/i.test(i))B={name:"BlackBerry",osname:"BlackBerry OS",blackberry:e,version:k||s(/blackberry[\d]+\/(\d+(\.\d+)?)/i)};else if(p){B={name:"WebOS",osname:"WebOS",webos:e,version:k||s(/w(?:eb)?osbrowser\/(\d+(\.\d+)?)/i)};/touchpad\//i.test(i)&&(B.touchpad=e)}else if(/bada/i.test(i))B={name:"Bada",osname:"Bada",bada:e,version:s(/dolfin\/(\d+(\.\d+)?)/i)};else if(v)B={name:"Tizen",osname:"Tizen",tizen:e,version:s(/(?:tizen\s?)?browser\/(\d+(\.\d+)?)/i)||k};else if(/qupzilla/i.test(i))B={name:"QupZilla",qupzilla:e,version:s(/(?:qupzilla)[\s\/](\d+(?:\.\d+)+)/i)||k};else if(/chromium/i.test(i))B={name:"Chromium",chromium:e,version:s(/(?:chromium)[\s\/](\d+(?:\.\d+)?)/i)||k};else if(/chrome|crios|crmo/i.test(i))B={name:"Chrome",chrome:e,version:s(/(?:chrome|crios|crmo)\/(\d+(\.\d+)?)/i)};else if(t)B={name:"Android",version:k};else if(/safari|applewebkit/i.test(i)){B={name:"Safari",safari:e};if(k)B.version=k}else if(r){B={name:"iphone"==r?"iPhone":"ipad"==r?"iPad":"iPod"};if(k)B.version=k}else if(/googlebot/i.test(i))B={name:"Googlebot",googlebot:e,version:s(/googlebot\/(\d+(\.\d+))/i)||k};else B={name:s(/^(.*)\/(.*) /),version:o(/^(.*)\/(.*) /)};if(!B.msedge&&/(apple)?webkit/i.test(i)){if(/(apple)?webkit\/537\.36/i.test(i)){B.name=B.name||"Blink";B.blink=e}else{B.name=B.name||"Webkit";B.webkit=e}if(!B.version&&k)B.version=k}else if(!B.opera&&/gecko\//i.test(i)){B.name=B.name||"Gecko";B.gecko=e;B.version=B.version||s(/gecko\/(\d+(\.\d+)?)/i)}if(!B.windowsphone&&(t||B.silk)){B.android=e;B.osname="Android"}else if(!B.windowsphone&&r){B[r]=e;B.ios=e;B.osname="iOS"}else if(w){B.mac=e;B.osname="macOS"}else if(S){B.xbox=e;B.osname="Xbox"}else if(h){B.windows=e;B.osname="Windows"}else if(b){B.linux=e;B.osname="Linux"}function O(e){switch(e){case"NT":return"NT";case"XP":return"XP";case"NT 5.0":return"2000";case"NT 5.1":return"XP";case"NT 5.2":return"2003";case"NT 6.0":return"Vista";case"NT 6.1":return"7";case"NT 6.2":return"8";case"NT 6.3":return"8.1";case"NT 10.0":return"10";default:return undefined}}var T="";if(B.windows)T=O(s(/Windows ((NT|XP)( \d\d?.\d)?)/i));else if(B.windowsphone)T=s(/windows phone (?:os)?\s?(\d+(\.\d+)*)/i);else if(B.mac){T=s(/Mac OS X (\d+([_\.\s]\d+)*)/i);T=T.replace(/[_\s]/g,".")}else if(r){T=s(/os (\d+([_\s]\d+)*) like mac os x/i);T=T.replace(/[_\s]/g,".")}else if(t)T=s(/android[ \/-](\d+(\.\d+)*)/i);else if(B.webos)T=s(/(?:web|hpw)os\/(\d+(\.\d+)*)/i);else if(B.blackberry)T=s(/rim\stablet\sos\s(\d+(\.\d+)*)/i);else if(B.bada)T=s(/bada\/(\d+(\.\d+)*)/i);else if(B.tizen)T=s(/tizen[\/\s](\d+(\.\d+)*)/i);if(T)B.osversion=T;var P=!B.windows&&T.split(".")[0];if(x||d||"ipad"==r||t&&(3==P||P>=4&&!y)||B.silk)B.tablet=e;else if(y||"iphone"==r||"ipod"==r||t||a||B.blackberry||B.webos||B.bada)B.mobile=e;if(B.msedge||B.msie&&B.version>=10||B.yandexbrowser&&B.version>=15||B.vivaldi&&B.version>=1||B.chrome&&B.version>=20||B.samsungBrowser&&B.version>=4||B.firefox&&B.version>=20||B.safari&&B.version>=6||B.opera&&B.version>=10||B.ios&&B.osversion&&B.osversion.split(".")[0]>=6||B.blackberry&&B.version>=10.1||B.chromium&&B.version>=20)B.a=e;else if(B.msie&&B.version<10||B.chrome&&B.version<20||B.firefox&&B.version<20||B.safari&&B.version<6||B.opera&&B.version<10||B.ios&&B.osversion&&B.osversion.split(".")[0]<6||B.chromium&&B.version<20)B.c=e;else B.x=e;return B}var s=i("undefined"!==typeof navigator?navigator.userAgent||"":"");s.test=function(e){for(var i=0;i<e.length;++i){var o=e[i];if("string"===typeof o)if(o in s)return true}return false};function o(e){return e.split(".").length}function r(e,i){var s=[],o;if(Array.prototype.map)return Array.prototype.map.call(e,i);for(o=0;o<e.length;o++)s.push(i(e[o]));return s}function n(e){var i=Math.max(o(e[0]),o(e[1]));var s=r(e,function(e){var s=i-o(e);e+=new Array(s+1).join(".0");return r(e.split("."),function(e){return new Array(20-e.length).join("0")+e}).reverse()});while(--i>=0)if(s[0][i]>s[1][i])return 1;else if(s[0][i]===s[1][i]){if(0===i)return 0}else return-1}function t(e,o,r){var t=s;if("string"===typeof o){r=o;o=void 0}if(void 0===o)o=false;if(r)t=i(r);var a=""+t.version;for(var d in e)if(e.hasOwnProperty(d))if(t[d]){if("string"!==typeof e[d])throw new Error("Browser version in the minVersion map should be a string: "+d+": "+String(e));return n([a,e[d]])<0}return o}function a(e,i,s){return!t(e,i,s)}s.isUnsupportedBrowser=t;s.compareVersions=n;s.check=a;s._detect=i;s.detect=i;return s});</script>
 
@@ -522,6 +473,7 @@
     <script src="/js/pages/customers/dashboard.page.js"></script>
     <script src="/js/pages/customers/new-license.page.js"></script>
     <script src="/js/pages/dashboard/welcome.page.js"></script>
+    <script src="/js/pages/deals.page.js"></script>
     <script src="/js/pages/device-management.page.js"></script>
     <script src="/js/pages/docs/basic-documentation.page.js"></script>
     <script src="/js/pages/endpoint-ops.page.js"></script>
@@ -627,30 +579,56 @@
     })();
     </script>
 
-    <% /* Keep footer hidden until the document is ready (prevents flicker that is especially unattractive on mobile) */ %>
     <script>
-    $(function() {
-      $('[data-hide-until-rendered]').removeClass('invisible'); // Note: invisible is a bootstrap 4 class
-    });
-    $(function() {
+
+      // Hide the header when the page is scrolled 1.5x the height of the browser window, and show it when the page is scrolled upwards.
+      // Note: this is done with an inline script tag here, because otherwise we would need to create a masthead component and include it on every page.
+      var lastScrollTop = 0;
+      var elementToHide = document.querySelector('[hide-when-scrolled]');
+      let alwaysVisibleWhenShownElement = document.querySelector('[always-visible-when-shown]');
+      $(window).scroll(()=>{
+        if(!elementToHide || !alwaysVisibleWhenShownElement){
+          return;
+        }
+        let isAlwaysVisibleElementShown = [...alwaysVisibleWhenShownElement.classList].includes('show');
+        if(isAlwaysVisibleElementShown) {
+          return;
+        }
+        let scrollTop = window.pageYOffset || document.documentElement.scrollTop;
+        if(scrollTop > lastScrollTop && scrollTop > window.innerHeight * 1.5) {
+          // If the user scrolls 1.5x the height of their browser window, hide the page header.
+          elementToHide.classList.add('translate-y-0');
+          lastScrollTop = scrollTop;
+        } else if(scrollTop < lastScrollTop - 60) {
+          // If the user scrolls 60 pixels upwards on the screen, we'll show the page header
+          elementToHide.classList.remove('translate-y-0');
+          lastScrollTop = scrollTop;
+        }
+      });
+      // Keep footer hidden until the document is ready (prevents flicker that is especially unattractive on mobile)
+      $(function() {
+        $('[data-hide-until-rendered]').removeClass('invisible'); // Note: invisible is a bootstrap 4 class
+      });
       // Clean up URLs that contain UTM parameters
-      if (window.location.search && window.location.search.includes('utm_content')) {
-        let queryParameterLessUrl = window.location.protocol + '//' + window.location.host + window.location.pathname + window.location.hash;
-        window.history.replaceState({}, '', queryParameterLessUrl);// https://caniuse.com/mdn-api_history_replacestate
-      }
-    });
-    <%/* Adding hover events to header dropdown menus*/%>
-    $(function(){
-      $('[purpose=dropdown-button]').hover(
-        function() {
-          $(this).children('.dropdown-menu').addClass('show');
-          $(this).children('.dropdown-toggle').attr('aria-expanded', true);
-        },
-        function() {
-        $(this).children('.dropdown-menu').removeClass('show');
-        $(this).children('.dropdown-toggle').attr('aria-expanded', false);
+      $(function() {
+        if (window.location.search && window.location.search.includes('utm_content')) {
+          let queryParameterLessUrl = window.location.protocol + '//' + window.location.host + window.location.pathname + window.location.hash;
+          window.history.replaceState({}, '', queryParameterLessUrl);// https://caniuse.com/mdn-api_history_replacestate
+        }
+      });
+
+      // Adding hover events to header dropdown menus.
+      $(function(){
+        $('[purpose=dropdown-button]').hover(
+          function() {
+            $(this).children('.dropdown-menu').addClass('show');
+            $(this).children('.dropdown-toggle').attr('aria-expanded', true);
+          },
+          function() {
+          $(this).children('.dropdown-menu').removeClass('show');
+          $(this).children('.dropdown-toggle').attr('aria-expanded', false);
+        });
       });
-    });
     </script>
   </body>
 </html>
diff --git a/website/views/pages/articles/articles.ejs b/website/views/pages/articles/articles.ejs
index 0f24be22d7ce..4b21814af392 100644
--- a/website/views/pages/articles/articles.ejs
+++ b/website/views/pages/articles/articles.ejs
@@ -1,51 +1,88 @@
 <div id="articles" v-cloak>
-  <div style="max-width: 1200px;" class="container-fluid p-0">
-    <div class="mx-auto">
-      <div purpose="categories-and-search" class="d-flex flex-lg-row flex-column justify-content-lg-between justify-content-md-center justify-content-start" v-if="isArticlesLandingPage">
-        <div purpose="categories" class="d-flex flex-lg-row flex-column justify-content-start">
-          <div purpose="category-filter" :class="[ filter === 'all' ? 'selected' : '']" @click="filterBy('all')">All</div>
-          <div purpose="category-filter" :class="[ filter === 'engineering' ? 'selected' : '']" @click="filterBy('engineering')">Engineering</div>
-          <div purpose="category-filter" :class="[ filter === 'security' ? 'selected' : '']" @click="filterBy('security')">Security</div>
-          <div purpose="category-filter" :class="[ filter === 'announcements' ? 'selected' : '']" @click="filterBy('announcements')">Announcements</div>
-          <div purpose="category-filter" :class="[ filter === 'guides' ? 'selected' : '']" @click="filterBy('guides')">Guides</div>
-          <div purpose="category-filter" :class="[ filter === 'success stories' ? 'selected' : '']" @click="filterBy('success stories')">Success stories</div>
-          <div purpose="category-filter" :class="[ filter === 'podcasts' ? 'selected' : '']" @click="filterBy('podcasts')">Podcasts</div>
-          <div purpose="category-filter" :class="[ filter === 'releases' ? 'selected' : '']" @click="filterBy('releases')">Releases</div>
-        </div>
+  <div style="max-width: 1200px;" class="container-fluid mx-auto" purpose="page-container">
+    <div v-if="category !== 'guides'">
+    <div purpose="categories-and-search" class="d-flex flex-lg-row flex-column justify-content-lg-between justify-content-md-center justify-content-start" v-if="isArticlesLandingPage">
+      <div purpose="categories" class="d-flex flex-lg-row flex-column justify-content-start">
+        <div purpose="category-filter" :class="[ filter === 'all' ? 'selected' : '']" @click="filterBy('all')">All</div>
+        <div purpose="category-filter" :class="[ filter === 'engineering' ? 'selected' : '']" @click="filterBy('engineering')">Engineering</div>
+        <div purpose="category-filter" :class="[ filter === 'security' ? 'selected' : '']" @click="filterBy('security')">Security</div>
+        <div purpose="category-filter" :class="[ filter === 'announcements' ? 'selected' : '']" @click="filterBy('announcements')">Announcements</div>
+        <div purpose="category-filter" :class="[ filter === 'guides' ? 'selected' : '']" @click="filterBy('guides')">Guides</div>
+        <div purpose="category-filter" :class="[ filter === 'success stories' ? 'selected' : '']" @click="filterBy('success stories')">Success stories</div>
+        <div purpose="category-filter" :class="[ filter === 'podcasts' ? 'selected' : '']" @click="filterBy('podcasts')">Podcasts</div>
+        <div purpose="category-filter" :class="[ filter === 'releases' ? 'selected' : '']" @click="filterBy('releases')">Releases</div>
       </div>
-      <div purpose="category-title" v-else>
-        <h1>{{articleCategory}}</h1>
-        <div class="d-flex flex-sm-row flex-column justify-content-between">
-          <p>{{categoryDescription}}</p>
-          <a purpose="rss-button" class="px-0 px-sm-2 pt-sm-1" @click="clickCopyRssLink(category)" target="_blank"><span>Subscribe</span></a>
-        </div>
+    </div>
+    <div purpose="category-title" v-else>
+      <h1>{{articleCategory}}</h1>
+      <div class="d-flex flex-sm-row flex-column justify-content-between">
+
+        <p>{{categoryDescription}}</p>
+        <a purpose="rss-button" class="px-0 px-sm-2 pt-sm-1" @click="clickCopyRssLink(category)" target="_blank"><span>Subscribe</span></a>
       </div>
-      <div purpose="articles" class="card-deck d-flex justify-content-center" v-if="selectedArticles.length > 0">
-        <div purpose="article-card" class="card" v-for="article in selectedArticles">
-          <a purpose="article-card-link" :href="article.url">
-            <img style="width: 100%; height: auto;" :src="[article.meta.articleImageUrl ? article.meta.articleImageUrl : '/images/blog-fleet-logo-white-background-800x450@2x.png']" alt="Article hero image">
-          </a>
-          <div purpose="article-card-body" class="card-body d-flex flex-column">
-            <p purpose="category-name" class="pb-2 mb-0">{{article.meta.category}}</p>
-            <a purpose="article-title" :href="article.url"><h5>{{article.meta.articleTitle}}</h5></a>
-            <div purpose="article-details" class="d-flex mt-auto flex-row align-items-center">
-              <img alt="The author's GitHub profile picture" style="height: 32px; width: 32px; border-radius: 100%;" :src="'https://github.com/'+article.meta.authorGitHubUsername+'.png?size=200'">
-              <p class="pl-2 font-weight-bold">{{article.meta.authorFullName}}</p>
-            </div>
+    </div>
+    <div purpose="articles" class="card-deck d-flex justify-content-center">
+      <div purpose="article-card" class="card" v-for="article in selectedArticles">
+        <a purpose="article-card-link" :href="article.url">
+          <img style="width: 100%; height: auto;" :src="[article.meta.articleImageUrl ? article.meta.articleImageUrl : '/images/blog-fleet-logo-white-background-800x450@2x.png']" alt="Article hero image">
+        </a>
+        <div purpose="article-card-body" class="card-body d-flex flex-column">
+          <p purpose="category-name" class="pb-2 mb-0">{{article.meta.category}}</p>
+          <a purpose="article-title" :href="article.url"><h5>{{article.meta.articleTitle}}</h5></a>
+          <div purpose="article-details" class="d-flex mt-auto flex-row align-items-center">
+            <img alt="The author's GitHub profile picture" style="height: 32px; width: 32px; border-radius: 100%;" :src="'https://github.com/'+article.meta.authorGitHubUsername+'.png?size=200'">
+            <p class="pl-2 font-weight-bold">{{article.meta.authorFullName}}</p>
           </div>
         </div>
-        <div purpose="article-card" class="card invisible mb-0 d-none d-sm-flex">
-        </div>
-        <div purpose="article-card" class="card invisible mb-0 d-none d-sm-flex">
+      </div>
+      <div purpose="article-card" class="card invisible mb-0 d-none d-sm-flex">
+      </div>
+      <div purpose="article-card" class="card invisible mb-0 d-none d-sm-flex">
+      </div>
+      <div purpose="article-card" class="card invisible mb-0 d-none d-sm-flex">
+      </div>
+    </div>
+  </div>
+  <div purpose="guides-category-page" v-else>
+    <div purpose="category-title">
+      <div class="d-flex flex-md-row flex-column justify-content-between align-items-md-center">
+        <div class="d-flex flex-column justify-content-between">
+          <h1>Guides</h1>
+          <p>Learn more about how to use Fleet to accomplish your goals.</p>
         </div>
-        <div purpose="article-card" class="card invisible mb-0 d-none d-sm-flex">
+        <div purpose="search" id="docsearch-query">
+          <div purpose="disabled-search" class="d-flex w-100">
+            <div class="input-group">
+              <div class="input-group-prepend">
+                <span class="input-group-text border-0 bg-transparent pl-3" >
+                  <img style="height: 16px; width: 16px;" class="search" alt="search" src="/images/icon-search-16x16@2x.png">
+                </span>
+              </div>
+              <div class="form-control border-0 ">
+              <input class="docsearch-input pr-1"
+                placeholder="Search" aria-label="Search"
+                />
+              </div>
+            </div>
+          </div>
         </div>
       </div>
-      <div v-else>
-        <h2 class="text-muted mx-auto">No articles to display</h2>
+    </div>
+    <div purpose="guides" class="card-columns">
+      <div purpose="guide-card" class="card" v-for="article in selectedArticles">
+        <a :href="article.url">
+        <div purpose="article-card-body" class="card-body d-flex flex-column">
+          <div purpose="article-title"><h5>{{article.meta.articleTitle}}</h5></div>
+          <p class="small" v-if="article.meta.description">{{article.meta.description}}</p>
+          <div purpose="article-details" class="d-flex mt-auto flex-row align-items-center">
+            <js-timestamp :at="article.meta.publishedOn" format="timeago" always-show-year="true"></js-timestamp>
+          </div>
+        </div>
+        </a>
       </div>
     </div>
   </div>
+  </div>
 
 </div>
 <%- /* Expose server-rendered data as window.SAILS_LOCALS :: */ exposeLocalsToBrowser() %>
diff --git a/website/views/pages/contact.ejs b/website/views/pages/contact.ejs
index 6cf9114195a8..d9045a69e4d8 100644
--- a/website/views/pages/contact.ejs
+++ b/website/views/pages/contact.ejs
@@ -81,10 +81,10 @@
             <div class="selectbox">
             <select class="form-control" id="primaryBuyingSituation" name="primaryBuyingSituation" :class="[formErrors.primaryBuyingSituation ? 'is-invalid' : '']" v-model="formData.primaryBuyingSituation">
               <option disabled hidden value="undefined">Choose an option</option>
-              <option value="eo-security">Endpoint operations for security engineering</option>
-              <option value="eo-it">Endpoint ops for identity engineers and IT admins</option>
               <option value="mdm">Device management (MDM)</option>
-              <option value="vm">Vulnerability management</option>
+              <option value="eo-it">IT engineering</option>
+              <option value="eo-security">Security engineering</option>
+              <!-- <option value="vm">Vulnerability management</option> -->
             </select>
             </div>
             <div class="d-block invalid-feedback" v-if="formErrors.topic">Please select an option.</div>
@@ -145,17 +145,17 @@
         </div>
       </div>
       <div purpose="quote" v-else-if="primaryBuyingSituation === 'eo-it'">
-        <div purpose="logo" class="mb-4"><img height="32" alt="Deputy logo" src="/images/logo-deputy-118x28@2x.png"></div>
+        <div purpose="logo" class="mb-4"><img height="32" alt="Deputy logo" src="/images/social-proof-logo-stripe-67x32@2x.png"></div>
         <p purpose="quote-text">
-          When we look at vendors, we look for ones that are very receptive to feedback, where you’re just part of the family, I guess. Fleet’s really good at that.
+          Mad props to how easy making a deploy pkg of the agent was. I wish everyone made stuff that easy.
         </p>
         <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
           <div purpose="profile-picture">
-            <img alt="Harrison Ravazzolo" src="/images/testimonial-author-harrison-ravazzolo-48x48@2x.png">
+            <img alt="Wes Whetstone" src="/images/testimonial-author-wes-whetstone-48x48@2x.png">
           </div>
           <div class="d-flex flex-column align-self-top">
-            <p purpose="name" class="font-weight-bold m-0">Harrison Ravazzolo</p>
-            <p purpose="job-title" class="m-0">Lead platform and identity engineer</p>
+            <p purpose="name" class="font-weight-bold m-0">Wes Whetstone</p>
+            <p purpose="job-title" class="m-0">Staff CPE</p>
           </div>
         </div>
       </div>
diff --git a/website/views/pages/customers/dashboard.ejs b/website/views/pages/customers/dashboard.ejs
index 8b853a0951bf..aac4365721c8 100644
--- a/website/views/pages/customers/dashboard.ejs
+++ b/website/views/pages/customers/dashboard.ejs
@@ -168,6 +168,8 @@
             <div class="invalid-feedback" v-if="formErrors.emailAddress" focus-first>Please enter a valid email address.</div>
           </div>
         </div>
+        <cloud-error class="mt-0" v-if="cloudError === 'emailAlreadyInUse'">That email is already linked to another Fleet account.</cloud-error>
+        <cloud-error class="mt-0" v-else-if="cloudError"></cloud-error>
         <div class="border-0 justify-content-center">
           <ajax-button purpose="submit-button" spinner="true" type="submit" :syncing="syncing" class="btn btn-sm btn-block btn-info" focus-first>Save</ajax-button>
         </div>
diff --git a/website/views/pages/deals.ejs b/website/views/pages/deals.ejs
new file mode 100644
index 000000000000..6ea0cc43399d
--- /dev/null
+++ b/website/views/pages/deals.ejs
@@ -0,0 +1,119 @@
+<div id="deals" v-cloak>
+  <div purpose="page-container">
+    <div class="d-flex flex-column" purpose="page-content" v-if="!showSuccessMessage">
+      <h2>Deal registration</h2>
+      <p>Register an opportunity below and a member of our team will get back to you shortly.</p>
+      <div purpose="form-card" class="card">
+        <h3>Your information</h3>
+        <ajax-form action="deliverDealRegistrationSubmission" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-errors.sync="formErrors" :form-data="formData" :form-rules="formRules" @submitted="submittedForm()">
+          <div purpose="form-section">
+            <div class="row">
+              <div class="col-12 col-sm-6 pr-sm-2">
+                <div class="form-group">
+                  <label for="submitters-first-name">First name *</label>
+                  <input class="form-control" id="submitters-first-name" type="text"  :class="[formErrors.submittersFirstName ? 'is-invalid' : '']" v-model.trim="formData.submittersFirstName" autocomplete="first-name" @input="typeClearOneFormError('submittersFirstName')">
+                  <div class="invalid-feedback" v-if="formErrors.submittersFirstName">Please enter your first name.</div>
+                </div>
+              </div>
+              <div class="col-12 col-sm-6 pl-sm-2">
+                <div class="form-group">
+                  <label for="submitters-last-name">Last name *</label>
+                  <input class="form-control" id="submitters-last-name" type="text"  :class="[formErrors.submittersLastName ? 'is-invalid' : '']" v-model.trim="formData.submittersLastName" autocomplete="last-name" @input="typeClearOneFormError('submittersLastName')">
+                  <div class="invalid-feedback" v-if="formErrors.submittersLastName">Please enter your last name.</div>
+                </div>
+              </div>
+            </div>
+            <div class="form-group">
+              <label for="submitters-email-address">Email *</label>
+              <input class="form-control" id="submitters-email-address"  :class="[formErrors.submittersEmailAddress ? 'is-invalid' : '']" v-model.trim="formData.submittersEmailAddress" @input="typeClearOneFormError('submittersEmailAddress')">
+              <div class="invalid-feedback" v-if="formErrors.submittersEmailAddress" focus-first>This doesn’t appear to be a valid email address</div>
+            </div>
+            <div class="form-group">
+              <label for="submitters-organization">Organization *</label>
+              <input class="form-control" id="submitters-organization" type="text" disabled  :class="[formErrors.submittersOrganization ? 'is-invalid' : '']" v-model.trim="formData.submittersOrganization" @input="typeClearOneFormError('submittersOrganization')">
+              <div class="invalid-feedback" v-if="formErrors.submittersOrganization">Please enter the name of your organization.</div>
+            </div>
+          </div>
+          <h3>Customer information</h3>
+          <div purpose="form-section">
+            <div class="row">
+              <div class="col-12 col-sm-6 pr-sm-2">
+                <div class="form-group">
+                  <label for="customer-first-name">First name *</label>
+                  <input class="form-control" id="customer-first-name" type="text"  :class="[formErrors.customersFirstName ? 'is-invalid' : '']" v-model.trim="formData.customersFirstName" autocomplete="first-name" @input="typeClearOneFormError('customersFirstName')">
+                  <div class="invalid-feedback" v-if="formErrors.customersFirstName">Please enter the customer's first name.</div>
+                </div>
+              </div>
+              <div class="col-12 col-sm-6 pl-sm-2">
+                <div class="form-group">
+                  <label for="customers-last-name">Last name *</label>
+                  <input class="form-control" id="customers-last-name" type="text"  :class="[formErrors.customersLastName ? 'is-invalid' : '']" v-model.trim="formData.customersLastName" autocomplete="last-name" @input="typeClearOneFormError('customersLastName')">
+                  <div class="invalid-feedback" v-if="formErrors.customersLastName">Please enter the customer's last name.</div>
+                </div>
+              </div>
+            </div>
+            <div class="form-group">
+              <label for="customers-email-address">Email *</label>
+              <input class="form-control" id="customers-email-address"  :class="[formErrors.customersEmailAddress ? 'is-invalid' : '']" v-model.trim="formData.customersEmailAddress" @input="typeClearOneFormError('customersEmailAddress')">
+              <div class="invalid-feedback" v-if="formErrors.customersEmailAddress" focus-first>This doesn’t appear to be a valid email address</div>
+            </div>
+            <div class="form-group">
+              <label for="linkedin-url">LinkedIn URL</label>
+              <input class="form-control" id="linkedin-url" v-model.trim="formData.linkedinUrl" @input="typeClearOneFormError('linkedinUrl')">
+            </div>
+            <div class="form-group">
+              <label for="customer-organization">Organization *</label>
+              <input class="form-control" id="customer-organization"  :class="[formErrors.customersOrganization ? 'is-invalid' : '']" v-model.trim="formData.customersOrganization" @input="typeClearOneFormError('customersOrganization')">
+              <div class="invalid-feedback" v-if="formErrors.customersOrganization" focus-first>Please enter the customer's organization</div>
+            </div>
+          </div>
+          <div purpose="form-section">
+            <div class="form-group">
+              <label for="current-mdm">Current MDM provider</label>
+              <input class="form-control" id="current-mdm" v-model.trim="formData.customersCurrentMdm" @input="typeClearOneFormError('customersCurrentMdm')">
+            </div>
+            <div class="form-group">
+              <label for="other-mdm-evaluated">Other MDMs being evaluated</label>
+              <input class="form-control" id="other-mdm-evaluated" v-model.trim="formData.otherMdmEvaluated" @input="typeClearOneFormError('otherMdmEvaluated')">
+            </div>
+            <div class="form-group">
+              <label for="preferred-hosting">Preferred hosting</label>
+              <div purpose="hosting-selector" class="d-flex flex-row justify-content-between align-items-center form-control"
+                id="dropdownMenuSelectPurpose" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+                {{formData.preferredHosting ? formData.preferredHosting : 'Select'}}<img class="d-flex" style="width: 16px; height: 16px;" src="/images/chevron-down-16x16@2x.png" alt="a small chevron pointing downwards">
+              </div>
+              <div purpose="hosting-selector-dropwdown" class="dropdown-menu" aria-labelledby="dropdownMenuSelectPurpose">
+                <div class="dropdown-item" @click="clickChoosePreferredHosting('Self-hosted')">Self-hosted</div>
+                <div class="dropdown-item" @click="clickChoosePreferredHosting('Managed cloud')">Managed cloud</div>
+              </div>
+            </div>
+            <div class="form-group">
+              <label for="expected-deal-size">Expected deal size (USD) *</label>
+              <input class="form-control" id="expected-deal-size"  :class="[formErrors.expectedDealSize ? 'is-invalid' : '']" v-model.trim="formData.expectedDealSize" @input="typeClearOneFormError('expectedDealSize')">
+              <div class="invalid-feedback" v-if="formErrors.expectedDealSize" focus-first>Please provide an estimate of the deal size</div>
+            </div>
+            <div class="form-group">
+              <label for="expected-close-date">Expected close date *</label>
+              <input class="form-control" id="expected-close-date"  :class="[formErrors.expectedCloseDate ? 'is-invalid' : '']" v-model.trim="formData.expectedCloseDate" @input="typeClearOneFormError('expectedCloseDate')">
+              <div class="invalid-feedback" v-if="formErrors.expectedCloseDate" focus-first>Please provide an expected close date</div>
+            </div>
+            <div class="form-group">
+              <label for="notes">Notes</label>
+              <textarea class="form-control" id="notes" type="textarea" v-model.trim="formData.notes" @input="typeClearOneFormError('notes')"></textarea>
+            </div>
+          </div>
+          <cloud-error purpose="cloud-error" v-if="cloudError"></cloud-error>
+          <p class="small">By submitting you agree to our <a href="/legal/privacy">privacy policy</a> and <a href="/terms">terms of service</a>.</p>
+          <ajax-button purpose="submit-button" spinner="true" type="submit" :syncing="syncing" class="btn btn-block btn-lg btn-primary mt-4" v-if="!cloudError">Submit</ajax-button>
+          <ajax-button purpose="submit-button" type="button" :syncing="syncing" class="btn btn-block btn-lg btn-primary mt-4" v-if="cloudError" @click="clickResetForm()">Try again</ajax-button>
+        </ajax-form>
+      </div>
+    </div>
+    <div class="d-flex flex-column text-center" purpose="page-content" v-else>
+      <h2>Thanks for registering</h2>
+      <p>A member of our team will be in touch soon.</p>
+      <div class="btn btn-primary" purpose="submit-button" @click="clickResetForm()">Register another opportunity</div>
+    </div>
+  </div>
+</div>
+<%- /* Expose server-rendered data as window.SAILS_LOCALS :: */ exposeLocalsToBrowser() %>
diff --git a/website/views/pages/device-management.ejs b/website/views/pages/device-management.ejs
index 57146fb7fced..0c077596e59a 100644
--- a/website/views/pages/device-management.ejs
+++ b/website/views/pages/device-management.ejs
@@ -4,7 +4,7 @@
       <div purpose="hero">
         <div purpose="page-headline">
           <h4>Device management (MDM)</h4>
-          <h1>Your easiest MDM migration</h1>
+          <h1>Manage everything in one place</h1>
         </div>
         <div purpose="testimonials" class="d-flex flex-md-row flex-column align-items-center justify-content-between">
           <div purpose="testimonial-quote">
@@ -30,13 +30,75 @@
         </div>
       </div>
       <logo-carousel></logo-carousel>
+
+    <%/* Debunk the cross-platform myth */%>
+      <div purpose="page-section" class="pb-0">
+        <div purpose="feature" class="d-flex flex-md-row flex-column-reverse justify-content-between mx-auto align-items-center">
+          <div purpose="feature-text" class="d-flex flex-column">
+            <h2>Debunk the cross-platform myth</h2>
+            <p>Conventional wisdom holds that cross-platform MDM solutions don't hold up at scale. Few, if any, have lived up to the hype.</p>
+            <p>Instead, Fleet lets you work directly with data and events from each native operating system. So while you can still use familiar concepts like smart groups and extension attributes, you don’t get stuck “talking Windows” to Apple devices.</p>
+          </div>
+          <div purpose="feature-image" class="right">
+            <img alt="Transparency for end users" src="/images/mdm-debunk-cross-platform-myth-528x377@2x.png">
+          </div>
+        </div>
+
+        <div purpose="three-column-features" class="mx-auto">
+          <div purpose="responsive-feature-row" class="row d-flex flex-sm-row flex-column justify-content-lg-between justify-content-center align-items-center align-items-sm-start">
+            <div purpose="feature-item" class="pl-0 col-12 col-sm-6 col-lg-4">
+              <h5>Operating systems</h5>
+              <p>Enforce OS updates with Declarative Device Management (DDM), <a href="https://github.com/macadmins/nudge" target="_blank">Nudge</a>, and Windows Update from one console.</p>
+            </div>
+
+            <div purpose="feature-item" class="pr-0 pr-lg-4 col-12 col-sm-6 col-lg-4" >
+              <h5>Automated enrollment</h5>
+              <p>Drop-ship devices to your end users with Apple Business Manager or Autopilot and let them set up their own account. No IT help needed.</p>
+            </div>
+
+            <div purpose="feature-item" class="pl-0 pl-lg-4 pr-lg-0 col-12 col-sm-6 col-lg-4">
+              <h5>Config management</h5>
+              <p>Manage settings with configuration profiles for Apple and device profiles for Windows. Use a canary team to test changes before they go live.</p>
+            </div>
+            <div purpose="feature-item" class="pr-0 pr-lg-4 pl-lg-0 col-12 col-sm-6 col-lg-4">
+              <h5>App management</h5>
+              <p>Keep applications and plugins secure and up-to-date automatically. Install the software end users need or let them install it themselves via self service.</p>
+            </div>
+
+            <div purpose="feature-item" class="pl-0 pl-lg-4 col-12 col-sm-6 col-lg-4">
+              <h5>Scripts and events</h5>
+              <p>Easily manage and version control your custom script library. Execute shell and PowerShell scripts when computers drift from the baseline.</p>
+            </div>
+
+            <div purpose="feature-item" class="pr-0 pr-lg-4 col-12 col-sm-6 col-lg-4">
+              <h5>Keep up with Apple</h5>
+              <p>Fleet's team and community stay on top of the latest features and releases from all supported platform vendors—not just Apple.</p>
+            </div>
+          </div>
+
+          <div purpose="feature-row" class="row d-flex flex-sm-row flex-column justify-content-lg-between justify-content-center mb-0 align-items-center align-items-sm-start">
+          </div>
+        </div>
+      </div>
+
       <div purpose="comparison-section">
         <h2>Head-to-head with the big players</h2>
         <p>Considering a move to Fleet as a cross-platform, open-source MDM alternative? See how we compare:</p>
         <div purpose="desktop-comparison-table" class="d-none d-sm-block">
           <div purpose="comparison-table-header" class="d-sm-flex d-none flex-row justify-content-end">
             <div purpose="fleet-column"><strong>Fleet</strong></div>
-            <div purpose="omnisaa-column"><strong>Omnissa (WS1)</strong></div>
+            <div purpose="comparison-column" class="d-flex">
+              <div purpose="comparison-selector" class="d-flex flex-row justify-content-between align-items-center"
+                id="dropdownMenuSelectPurpose" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+                {{comparisonMode === 'omnissa' ? 'Omnissa (WS1)' : 'Jamf Pro'}}<img class="d-flex" style="width: 16px; height: 16px;" src="/images/chevron-down-16x16@2x.png" alt="a small shevron pointing downwards">
+              </div>
+              <div purpose="comparison-selector-dropwdown" class="dropdown-menu" aria-labelledby="dropdownMenuSelectPurpose">
+                <div class="dropdown-item"
+                  @click="comparisonMode = 'omnissa'">Omnissa (WS1)</div>
+                  <div class="dropdown-item"
+                  @click="comparisonMode = 'jamf'">Jamf Pro</div>
+              </div>
+            </div>
           </div>
           <div purpose="comparison-table" class="d-sm-flex d-none flex-column">
             <div purpose="table-row">
@@ -45,56 +107,46 @@
                 <img src="/images/os-macos-black-50-16x16@2x.png" alt="macOS logo" >
                 <img src="/images/os-windows-black-50-16x16@2x.png" alt="Windows logo">
               </div>
-              <div purpose="omnisaa-column">
+              <div purpose="comparison-column" v-if="comparisonMode === 'omnissa'">
                 <img src="/images/os-macos-black-50-16x16@2x.png" alt="macOS logo" >
                 <img src="/images/os-windows-black-50-16x16@2x.png" alt="Windows logo">
               </div>
-            </div>
-
-            <div purpose="table-row">
-              <div purpose="feature-name"><p>Operating system updates</p></div>
-              <div purpose="fleet-column"><img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png"></div>
-              <div purpose="omnisaa-column">
-                <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
-              </div>
-            </div>
-
-            <div purpose="table-row">
-              <div purpose="feature-name"><p>Configuration management and scripting</p></div>
-              <div purpose="fleet-column"><img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png"></div>
-              <div purpose="omnisaa-column">
-                <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
+              <div purpose="comparison-column" v-if="comparisonMode === 'jamf'">
+                <img src="/images/os-macos-black-50-16x16@2x.png" alt="macOS logo" >
               </div>
             </div>
 
             <div purpose="table-row">
-              <div purpose="feature-name" class="d-flex align-items-center"><p>App management </p>
-                <!-- <span purpose="table-new-badge" class="ml-2">New</span> -->
-              </div>
+              <div purpose="feature-name"><p>iOS/iPadOS management</p></div>
               <div purpose="fleet-column">
                 <img style="height: 14px; width: 14px;" alt="coming soon" src="/images/icon-coming-soon-14x14@2x.png">
               </div>
-              <div purpose="omnisaa-column">
+              <div purpose="comparison-column">
                 <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
               </div>
             </div>
 
             <div purpose="table-row">
-              <div purpose="feature-name"><p>iOS</p></div>
-              <div purpose="fleet-column">
-                <img style="height: 14px; width: 14px;" alt="coming soon" src="/images/icon-coming-soon-14x14@2x.png">
+              <div purpose="feature-name">
+                <p>Complete device inventory </p>
+                <img style="margin-left: 6px;" class="d-inline" purpose="tooltip-icon" src="/images/icon-more-info-14x14@2x.png" alt="More info"  data-toggle="tooltip" tabindex="0" data-placement="top" title="Fleet gives you data down to the chip level on every endpoint. Access over 300 tables of system state data. Use presets or create your own queries.">
               </div>
-              <div purpose="omnisaa-column">
+              <div purpose="fleet-column"><img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png"></div>
+              <div purpose="comparison-column"></div>
+            </div>
+
+            <div purpose="table-row">
+              <div purpose="feature-name"><p>Operating system updates</p></div>
+              <div purpose="fleet-column"><img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png"></div>
+              <div purpose="comparison-column">
                 <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
               </div>
             </div>
 
             <div purpose="table-row">
-              <div purpose="feature-name"><p>Auto-fix</p></div>
-              <div purpose="fleet-column">
-                <img style="height: 14px; width: 14px;" alt="coming soon" src="/images/icon-coming-soon-14x14@2x.png">
-              </div>
-              <div purpose="omnisaa-column">
+              <div purpose="feature-name"><p>Configuration management and scripting</p></div>
+              <div purpose="fleet-column"><img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png"></div>
+              <div purpose="comparison-column">
                 <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
               </div>
             </div>
@@ -106,42 +158,62 @@
                 <img src="/images/os-windows-black-50-16x16@2x.png" alt="Windows logo">
                 <img src="/images/os-linux-black-50-16x16@2x.png" alt="Linux logo">
               </div>
-              <div purpose="omnisaa-column">
+              <div purpose="comparison-column">
                 <img src="/images/os-macos-black-50-16x16@2x.png" alt="macOS logo">
               </div>
             </div>
 
             <div purpose="table-row">
-              <div purpose="feature-name"><p>REST API</p></div>
-              <div purpose="fleet-column"><img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png"></div>
-              <div purpose="omnisaa-column">
+              <div purpose="feature-name" class="d-flex align-items-center"><p>App management </p>
+                <!-- <span purpose="table-new-badge" class="ml-2">New</span> -->
+              </div>
+              <div purpose="fleet-column">
+                <img style="height: 14px; width: 14px;" alt="coming soon" src="/images/icon-coming-soon-14x14@2x.png">
+              </div>
+              <div purpose="comparison-column">
                 <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
               </div>
             </div>
 
+
             <div purpose="table-row">
-              <div purpose="feature-name"><p>Last mile MDM migration wizard</p></div>
-              <div purpose="fleet-column"><img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png"></div>
-              <div purpose="omnisaa-column"></div>
+              <div purpose="feature-name"><p>Automated device compliance</p></div>
+              <div purpose="fleet-column">
+                <img style="height: 14px; width: 14px;" alt="coming soon" src="/images/icon-coming-soon-14x14@2x.png">
+              </div>
+              <div purpose="comparison-column">
+                <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
+              </div>
             </div>
 
             <div purpose="table-row">
-              <div purpose="feature-name">
-                <p>Complete device state </p>
-                <img style="margin-left: 6px;" class="d-inline" purpose="tooltip-icon" src="/images/icon-more-info-14x14@2x.png" alt="More info"  data-toggle="tooltip" tabindex="0" data-placement="top" title="Fleet gives you data down to the chip level on every endpoint. Access over 300 tables of system state data. Use presets or create your own queries.">
-              </div>
+              <div purpose="feature-name"><p>REST API</p></div>
               <div purpose="fleet-column"><img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png"></div>
-              <div purpose="omnisaa-column"></div>
+              <div purpose="comparison-column">
+                <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
+              </div>
             </div>
 
             <div purpose="table-row">
               <div purpose="feature-name"><p>Open source</p></div>
               <div purpose="fleet-column"><img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png"></div>
-              <div purpose="omnisaa-column"></div>
+              <div purpose="comparison-column"></div>
             </div>
           </div>
         </div>
+
         <div purpose="mobile-comparison-table" class="d-block d-sm-none">
+          <p class="mt-5 mb-2 font-weight-bold">Compare with:</p>
+          <div purpose="mobile-comparison-selector" class="d-flex flex-row justify-content-between align-items-center"
+            id="mobileDropdownMenuSelectPurpose" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+            {{comparisonMode === 'omnissa' ? 'Omnissa (WS1)' : 'Jamf Pro'}}<img class="d-flex" style="width: 16px; height: 16px;" src="/images/chevron-down-16x16@2x.png" alt="a small shevron pointing downwards">
+          </div>
+          <div purpose="comparison-selector-dropwdown" class="dropdown-menu" aria-labelledby="mobileDropdownMenuSelectPurpose">
+            <div class="dropdown-item"
+              @click="comparisonMode = 'omnissa'">Omnissa (WS1)</div>
+              <div class="dropdown-item"
+              @click="comparisonMode = 'jamf'">Jamf Pro</div>
+          </div>
           <div purpose="feature-table">
             <div purpose="feature-name"><p>Zero-touch setup</p></div>
             <div purpose="feature-table-row">
@@ -151,90 +223,103 @@
                 <img src="/images/os-windows-black-50-16x16@2x.png" alt="Windows logo">
               </div>
             </div>
-            <div purpose="feature-table-row">
+            <div purpose="feature-table-row" v-if="comparisonMode === 'omnissa'">
               <div>Omnissa (WS1)</div>
               <div purpose="feature-status">
                 <img src="/images/os-macos-black-50-16x16@2x.png" alt="macOS logo" >
                 <img src="/images/os-windows-black-50-16x16@2x.png" alt="Windows logo">
               </div>
             </div>
+            <div purpose="feature-table-row" v-if="comparisonMode === 'jamf'">
+              <div>Jamf Pro</div>
+              <div purpose="feature-status">
+                <img src="/images/os-macos-black-50-16x16@2x.png" alt="macOS logo" >
+              </div>
+            </div>
           </div>
           <div purpose="feature-table">
-            <div purpose="feature-name"><p>Operating system updates</p></div>
+            <div purpose="feature-name"><p>iOS/iPadOS management</p></div>
             <div purpose="feature-table-row">
               <div>Fleet</div>
               <div purpose="feature-status">
-                <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
+                <img style="height: 14px; width: 14px;" alt="coming soon" src="/images/icon-coming-soon-14x14@2x.png">
               </div>
             </div>
-            <div purpose="feature-table-row">
+            <div purpose="feature-table-row" v-if="comparisonMode === 'omnissa'">
               <div>Omnissa (WS1)</div>
               <div purpose="feature-status">
                 <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
               </div>
             </div>
+            <div purpose="feature-table-row" v-if="comparisonMode === 'jamf'">
+              <div>Jamf Pro</div>
+              <div purpose="feature-status">
+                <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
+              </div>
+            </div>
           </div>
           <div purpose="feature-table">
-            <div purpose="feature-name"><p>Configuration management and scripting</p></div>
+            <div purpose="feature-name"><p>Complete device state</p></div>
             <div purpose="feature-table-row">
               <div>Fleet</div>
               <div purpose="feature-status">
                 <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
               </div>
             </div>
-            <div purpose="feature-table-row">
+            <div purpose="feature-table-row" v-if="comparisonMode === 'omnissa'">
               <div>Omnissa (WS1)</div>
               <div purpose="feature-status">
-                <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
+
+              </div>
+            </div>
+            <div purpose="feature-table-row" v-if="comparisonMode === 'jamf'">
+              <div>Jamf Pro</div>
+              <div purpose="feature-status">
+
               </div>
             </div>
           </div>
           <div purpose="feature-table">
-            <div purpose="feature-name"><p>App management </p>
-              <!-- <span purpose="table-new-badge" class="ml-2">New</span> -->
-            </div>
+            <div purpose="feature-name"><p>Operating system updates</p></div>
             <div purpose="feature-table-row">
               <div>Fleet</div>
               <div purpose="feature-status">
-                <img style="height: 14px; width: 14px;" alt="coming soon" src="/images/icon-coming-soon-14x14@2x.png">
+                <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
               </div>
             </div>
-            <div purpose="feature-table-row">
+            <div purpose="feature-table-row" v-if="comparisonMode === 'omnissa'">
               <div>Omnissa (WS1)</div>
               <div purpose="feature-status">
                 <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
               </div>
             </div>
-          </div>
-          <div purpose="feature-table">
-            <div purpose="feature-name"><p>iOS</p></div>
-            <div purpose="feature-table-row">
-              <div>Fleet</div>
-              <div purpose="feature-status">
-                <img style="height: 14px; width: 14px;" alt="coming soon" src="/images/icon-coming-soon-14x14@2x.png">
-              </div>
-            </div>
-            <div purpose="feature-table-row">
-              <div>Omnissa (WS1)</div>
+            <div purpose="feature-table-row" v-if="comparisonMode === 'jamf'">
+              <div>Jamf Pro</div>
               <div purpose="feature-status">
                 <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
               </div>
             </div>
           </div>
           <div purpose="feature-table">
-            <div purpose="feature-name"><p>Auto-fix</p></div>
+            <div purpose="feature-name"><p>Configuration management and scripting</p></div>
             <div purpose="feature-table-row">
               <div>Fleet</div>
               <div purpose="feature-status">
-                <img style="height: 14px; width: 14px;" alt="coming soon" src="/images/icon-coming-soon-14x14@2x.png">
+                <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
               </div>
             </div>
-            <div purpose="feature-table-row">
+            <div purpose="feature-table-row" v-if="comparisonMode === 'omnissa'">
               <div>Omnissa (WS1)</div>
               <div purpose="feature-status">
                 <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
               </div>
             </div>
+            <div purpose="feature-table-row" v-if="comparisonMode === 'jamf'">
+              <div>Jamf Pro</div>
+              <div purpose="feature-status">
+                <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
+              </div>
+            </div>
           </div>
           <div purpose="feature-table">
             <div purpose="feature-name"><p>Remote lock and wipe</p></div>
@@ -246,58 +331,108 @@
                 <img src="/images/os-linux-black-50-16x16@2x.png" alt="Linux logo">
               </div>
             </div>
-            <div purpose="feature-table-row">
+            <div purpose="feature-table-row" v-if="comparisonMode === 'omnissa'">
               <div>Omnissa (WS1)</div>
               <div purpose="feature-status">
                 <img src="/images/os-macos-black-50-16x16@2x.png" alt="macOS logo">
               </div>
             </div>
+            <div purpose="feature-table-row" v-if="comparisonMode === 'jamf'">
+              <div>Jamf Pro</div>
+              <div purpose="feature-status">
+                <img src="/images/os-macos-black-50-16x16@2x.png" alt="macOS logo">
+              </div>
+            </div>
           </div>
           <div purpose="feature-table">
-            <div purpose="feature-name"><p>REST API</p></div>
+            <div purpose="feature-name"><p>App management </p>
+              <!-- <span purpose="table-new-badge" class="ml-2">New</span> -->
+            </div>
             <div purpose="feature-table-row">
               <div>Fleet</div>
+              <div purpose="feature-status">
+                <img style="height: 14px; width: 14px;" alt="coming soon" src="/images/icon-coming-soon-14x14@2x.png">
+              </div>
+            </div>
+            <div purpose="feature-table-row" v-if="comparisonMode === 'omnissa'">
+              <div>Omnissa (WS1)</div>
+              <div purpose="feature-status">
+                <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
+              </div>
+            </div>
+            <div purpose="feature-table-row" v-if="comparisonMode === 'jamf'">
+              <div>Jamf Pro</div>
               <div purpose="feature-status">
                 <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
               </div>
             </div>
+          </div>
+
+          <div purpose="feature-table">
+            <div purpose="feature-name"><p>Automated device compliance</p></div>
             <div purpose="feature-table-row">
+              <div>Fleet</div>
+              <div purpose="feature-status">
+                <img style="height: 14px; width: 14px;" alt="coming soon" src="/images/icon-coming-soon-14x14@2x.png">
+              </div>
+            </div>
+            <div purpose="feature-table-row" v-if="comparisonMode === 'omnissa'">
               <div>Omnissa (WS1)</div>
               <div purpose="feature-status">
                 <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
               </div>
             </div>
+            <div purpose="feature-table-row" v-if="comparisonMode === 'jamf'">
+              <div>Jamf Pro</div>
+              <div purpose="feature-status">
+                <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
+              </div>
+            </div>
           </div>
+
           <div purpose="feature-table">
-            <div purpose="feature-name"><p>Last mile MDM migration wizard</p></div>
+            <div purpose="feature-name"><p>REST API</p></div>
             <div purpose="feature-table-row">
               <div>Fleet</div>
               <div purpose="feature-status">
                 <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
               </div>
             </div>
-            <div purpose="feature-table-row">
+            <div purpose="feature-table-row" v-if="comparisonMode === 'omnissa'">
               <div>Omnissa (WS1)</div>
               <div purpose="feature-status">
-
+                <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
+              </div>
+            </div>
+            <div purpose="feature-table-row" v-if="comparisonMode === 'jamf'">
+              <div>Jamf Pro</div>
+              <div purpose="feature-status">
+                <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
               </div>
             </div>
           </div>
           <div purpose="feature-table">
-            <div purpose="feature-name"><p>Complete device state</p></div>
+            <div purpose="feature-name"><p>MDM migration</p></div>
             <div purpose="feature-table-row">
               <div>Fleet</div>
               <div purpose="feature-status">
                 <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
               </div>
             </div>
-            <div purpose="feature-table-row">
+            <div purpose="feature-table-row" v-if="comparisonMode === 'omnissa'">
               <div>Omnissa (WS1)</div>
               <div purpose="feature-status">
 
+              </div>
+            </div>
+            <div purpose="feature-table-row" v-if="comparisonMode === 'jamf'">
+              <div>Jamf Pro</div>
+              <div purpose="feature-status">
+
               </div>
             </div>
           </div>
+
           <div purpose="feature-table">
             <div purpose="feature-name"><p>Open source</p></div>
             <div purpose="feature-table-row">
@@ -306,20 +441,29 @@
                 <img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
               </div>
             </div>
-            <div purpose="feature-table-row">
+            <div purpose="feature-table-row" v-if="comparisonMode === 'omnissa'">
               <div>Omnissa (WS1)</div>
               <div purpose="feature-status">
 
+              </div>
+            </div>
+            <div purpose="feature-table-row" v-if="comparisonMode === 'jamf'">
+              <div>Jamf Pro</div>
+              <div purpose="feature-status">
+
               </div>
             </div>
           </div>
         </div>
 
-        <animated-arrow-button class="mx-auto" href="/pricing">Compare all features</animated-arrow-button>
+        <animated-arrow-button class="mx-auto" href="/pricing">View all features</animated-arrow-button>
       </div>
       <%/* Shorten the feedback loop section */%>
       <div purpose="page-section">
-        <div purpose="feature" class="d-flex flex-md-row flex-column-reverse justify-content-between mx-auto align-items-center">
+        <div purpose="feature" class="d-flex flex-md-row flex-column justify-content-between mx-auto align-items-center">
+          <div purpose="feature-image" class="left">
+            <img alt="A laptop using Fleet to accurately display the status of MDM configurations" src="/images/mdm-shorten-feedback-loop-528x377@2x.png">
+          </div>
           <div purpose="feature-text" class="d-flex flex-column">
             <h2>Shorten the feedback loop</h2>
             <p>Spend less time debugging whether changes actually happened.</p>
@@ -329,14 +473,8 @@
               <p>Every change to a policy or security control is tracked and auditable in Fleet’s UI, or in your logs.</p>
             </div>
           </div>
-          <div purpose="feature-image" class="right">
-            <img alt="A laptop using Fleet to accurately display the status of MDM configurations" src="/images/mdm-shorten-feedback-loop-528x377@2x.png">
-          </div>
         </div>
       </div>
-      <div purpose="page-section">
-        <%-  partial('../partials/calendar-banner.partial.ejs') %>
-      </div>
       <%/* Scope transparency section */%>
       <div purpose="page-section">
         <div purpose="feature" class="d-flex flex-md-row flex-column-reverse justify-content-between mx-auto align-items-center">
@@ -354,45 +492,6 @@
           </div>
         </div>
       </div>
-
-      <%/* Simplify your tools section */%>
-      <div purpose="page-section">
-        <div purpose="feature-headline">
-          <h2>Tidy up your tools</h2>
-          <p>Deploy a modern Mac-first MDM purpose-built for IT engineers and cross-training. Use principles from DevOps to manage Apple, Windows, and Linux computers declaratively.</p>
-        </div>
-
-        <div purpose="two-column-features" class="mx-auto">
-
-          <div purpose="feature-row" class="d-flex flex-sm-row flex-column justify-content-lg-between justify-content-center">
-            <div purpose="feature-column" class="ml-sm-0">
-            <img alt="Patch every OS" src="/images/device-management-icon-patch-every-os-48x48@2x.png">
-              <h5>Patch every OS</h5>
-              <p>Shorten patch timelines with custom, enforceable deadlines and grace periods for every operating system. Encourage updates with Declarative Device Management (DDM), Nudge, and Windows Update from one interface.</p>
-            </div>
-
-            <div purpose="feature-column" class="mr-sm-0 mb-0">
-            <img alt="Push profiles" src="/images/device-management-icon-verify-updates-and-settings-48x48@2x.png">
-              <h5>Push profiles</h5>
-              <p>Remote-control settings on your Macs and PCs like Wi-Fi, certificates, passwords, screen lock, etc.  Deploy baselines or customize your own to comply with your organization’s security requirements.</p>
-            </div>
-          </div>
-
-          <div purpose="feature-row" class="d-flex flex-sm-row flex-column justify-content-lg-between justify-content-center mb-0">
-            <div purpose="feature-column" class="ml-sm-0">
-            <img alt="Manage software installs from anywhere" src="/images/device-management-icon-automatic-posture-assessment-48x48@2x.png">
-              <h5>Manage software installs from anywhere</h5>
-              <p>Get employees the software and settings they need with less drama by managing app packages, operating system versions, and patch levels for every platform, on top of open standards and data.</p>
-            </div>
-
-            <div purpose="feature-column" class="mr-sm-0 mb-0">
-            <img alt="Access the latest Apple and Windows APIs" src="/images/device-management-icon-circular-action-48x48@2x.png">
-              <h5>Access the latest Apple and Windows APIs</h5>
-              <p>Turn on the latest native macOS and Windows operating system capabilities like DDM and Autopilot, all in one place. Fleet’s team and community test against every new Apple and Microsoft release.</p>
-            </div>
-          </div>
-        </div>
-      </div>
     </div>
   </div>
   <%/* End of page gradient */%>
diff --git a/website/views/pages/docs/basic-documentation.ejs b/website/views/pages/docs/basic-documentation.ejs
index de6feb04183f..cc8b15b912b0 100644
--- a/website/views/pages/docs/basic-documentation.ejs
+++ b/website/views/pages/docs/basic-documentation.ejs
@@ -95,24 +95,22 @@
             <div class="container-fluid px-0 pt-4">
               <ul class="px-0 mb-0 pb-3">
                 <li class="px-0 mb-2" v-for="page in findPagesByUrl()" :key="page.title">
-                  <a :href="page.url" class="font-weight-bold">
+                  <span class="font-weight-bold">
                     {{page.title}}
-                  </a>
-                  <div purpose="expanded-nav" class="pt-3" v-if="isCurrentSection(page)">
-                    <ul class="p-0 pl-2 mb-2" v-if="!_.isEmpty(findPagesByUrl(page.url))">
-                      <div purpose="nav-section" v-for="(section, sectionName) of findAndSortNavSectionsByUrl(page.url)" :key="sectionName" v-if="sectionName !== 'hidden'">
-                        <p purpose="nav-section-title" v-if="sectionName !== 'Uncategorized' && sectionName !== 'TBD'">{{sectionName}}</p>
-                        <li v-for="subpage in section" :key="subpage.title">
-                          <a :href="subpage.url" :class="subpage.title === thisPage.title ? 'topic active' : 'topic'">
-                            {{subpage.title}}
-                          </a>
-                        </li>
-                      </div>
+                  </span>
+                  <div purpose="expanded-nav" class="pt-3">
+                    <ul class="p-0 pl-2 mb-3" v-if="!_.isEmpty(findPagesByUrl(page.url))">
+                      <li v-for="subpage in findPagesByUrl(page.url)" :key="subpage.title">
+                        <a :href="subpage.url" :class="subpage.title === thisPage.title ? 'topic active' : 'topic'">
+                          {{subpage.title}}
+                        </a>
+                      </li>
                     </ul>
                   </div>
                 </li>
               </ul>
               <ul class="px-0 mb-0 pt-3" purpose="mobile-docs-nav-other-links">
+                <li class="px-0 mb-3"><a href="/guides">Guides</a></li>
                 <li class="px-0 mb-3"><a href="/tables">Data tables</a></li>
                 <li class="px-0 mb-3"><a href="/queries"><%= ['eo-it', 'mdm'].includes(primaryBuyingSituation) ? 'Device health checks' : 'Built-in queries' %></a></li>
                 <li class="px-0 mb-3"><a href="https://github.com/fleetdm/fleet/releases" target="_blank">Releases</a></li>
@@ -137,23 +135,21 @@
         <div purpose="left-sidebar" class="d-none d-lg-flex flex-column text-left pl-0 pr-4 left-sidebar">
           <ul class="p-0 pb-3 m-0 left-nav">
             <li v-for="page in findPagesByUrl()" :key="page.title">
-              <a :href="page.url" class="font-weight-bold pb-3">{{page.title}}</a>
-              <div purpose="expanded-nav" class="pt-3" v-if="isCurrentSection(page)">
-                <ul class="p-0 pl-2 mb-2">
-                  <div purpose="nav-section" v-for="(section, sectionName) of findAndSortNavSectionsByUrl(page.url)" :key="sectionName" v-if="sectionName !== 'hidden'">
-                    <p purpose="nav-section-title" v-if="sectionName !== 'Uncategorized' && sectionName !== 'TBD'">{{sectionName}}</p>
-                    <li v-for="subpage in section" :key="subpage.title">
-                      <a :href="subpage.url" :class="subpage.title === thisPage.title ? 'topic active' : 'topic'">
-                        {{subpage.title}}
-                      </a>
-                    </li>
-                  </div>
+              <span class="font-weight-bold pb-3">{{page.title}}</span>
+              <div purpose="expanded-nav" class="pt-3" >
+                <ul class="p-0 pl-2 mb-3">
+                  <li v-for="subpage in findPagesByUrl(page.url)" :key="subpage.title">
+                    <a :href="subpage.url" :class="subpage.title === thisPage.title ? 'topic active' : 'topic'">
+                      {{subpage.title}}
+                    </a>
+                  </li>
                 </ul>
               </div>
             </li>
           </ul>
-          <a class="pt-4 pb-3" target="_blank" href="/tables">Data tables</a>
-          <a class="pb-3" target="_blank" href="/queries"><%= ['eo-it', 'mdm'].includes(primaryBuyingSituation) ? 'Device health checks' : 'Built-in queries' %></a>
+          <a class="pt-4 pb-3" href="/guides">Guides</a>
+          <a class="pb-3" href="/tables">Data tables</a>
+          <a class="pb-3" href="/queries"><%= ['eo-it', 'mdm'].includes(primaryBuyingSituation) ? 'Device health checks' : 'Built-in queries' %></a>
           <a class="pb-3" target="_blank" href="https://github.com/fleetdm/fleet/releases">Releases</a>
           <a class="pb-3" target="_blank" href="/support">Support</a>
           <div class="d-none d-lg-block" purpose="swag-cta" v-if="showSwagForm">
@@ -209,19 +205,19 @@
               <% if(!me){ %>
               <h2>Try it out</h2>
               <p>See what Fleet can do</p>
-              <a purpose="continue-button" class="btn btn-primary" href="/register">Start now</a>
-              <% } else if (['2 - Aware', '3 - Intrigued', '4 - Has use case'].includes(me.psychologicalStage)) {%>
+              <a purpose="continue-button" class="btn btn-primary docs-cta-continue-button" href="/register">Start now</a>
+              <% } else if (['2 - Aware', '3 - Intrigued'].includes(me.psychologicalStage)) {%>
               <h2>Tried Fleet yet?</h2>
               <p>Continue getting started with Fleet</p>
-              <a purpose="continue-button" class="btn btn-primary" href="/start">Continue</a>
-              <% } else if (me.psychologicalStage === '5 - Personally confident') {%>
+              <a purpose="continue-button" class="btn btn-primary docs-cta-continue-button" href="/start">Continue</a>
+              <% } else if (me.psychologicalStage === '4 - Has use case') {%>
               <h2>Feeling confident?</h2>
               <p>Get set up with Fleet</p>
-              <a purpose="continue-button" class="btn btn-primary" href="/start">Continue</a>
-              <% } else if (me.psychologicalStage === '6 - Has team buy-in') {%>
+              <a purpose="continue-button" class="btn btn-primary docs-cta-continue-button" href="/start">Continue</a>
+              <% } else if (['5 - Personally confident', '6 - Has team buy-in'].includes(me.psychologicalStage)) {%>
                 <h2>Talk to the team</h2>
                 <p>Let’s get you set up!</p>
-                <a purpose="continue-button" class="btn btn-primary" href="/start">Continue</a>
+                <a purpose="continue-button" class="btn btn-primary docs-cta-continue-button" href="/start">Continue</a>
               <%}%>
             </div>
           </div>
diff --git a/website/views/pages/endpoint-ops.ejs b/website/views/pages/endpoint-ops.ejs
index 7a5bbd81c93d..22168e47a385 100644
--- a/website/views/pages/endpoint-ops.ejs
+++ b/website/views/pages/endpoint-ops.ejs
@@ -3,22 +3,22 @@
     <div purpose="page-content" class="mx-auto">
     <div purpose="hero">
       <div purpose="page-headline">
-        <h4>Endpoint operations</h4>
-        <h1><%= primaryBuyingSituation==='eo-security'? 'Instrument your endpoints' : 'Understand your computers'%></h1>
+        <h4>Endpoint operations <%= ['eo-security', 'vm'].includes(pagePersonalization) ? 'for security' : ['eo-it', 'mdm'].includes(pagePersonalization) ? 'for IT' : '' %></h4>
+        <h1><%= pagePersonalization==='eo-security'? 'Instrument your endpoints' : 'Understand your computers'%></h1>
       </div>
       <div purpose="hero-content" class="d-flex flex-md-row flex-column align-items-center justify-content-between">
         <div purpose="hero-image">
           <img alt="A device verifying compliance for every endpoint" src="/images/endpoint-operations-hero-image-380x380@2x.png">
         </div>
         <div purpose="hero-text">
-          <% if(['eo-it', 'mdm'].includes(primaryBuyingSituation)) { %>
+          <% if(['eo-it', 'mdm'].includes(pagePersonalization)) { %>
             <strong>Automate anything</strong>
             <p>Remotely run scripts and prompts to complete tasks on every kind of computer, including Linux.</p>
             <strong>Pulse check anything</strong>
             <p>Use a live connection to every endpoint to simplify audit, compliance, and reporting from workstations to data centers.</p>
             <strong>Ship data to any platform</strong>
             <p>Ship logs to any platform like Splunk, Snowflake, or <a href="/docs/using-fleet/log-destinations">any streaming infrastructure</a> like AWS Kinesis and Apache Kafka.</p>
-          <% } else if(['eo-security', 'vm'].includes(primaryBuyingSituation)) { %>
+          <% } else if(['eo-security', 'vm'].includes(pagePersonalization)) { %>
             <strong>Osquery on easy mode</strong>
             <p>Build the agent in "read-only" mode or enable remote scripting to automatically mitigate misconfigurations and vulnerabilities.</p>
             <strong>Pulse check anything</strong>
@@ -41,7 +41,7 @@
       </div>
     </div>
     <div purpose="testimonials" class="d-flex flex-md-row flex-column align-items-center justify-content-between">
-      <% if (['eo-security'].includes(primaryBuyingSituation)) { %>
+      <% if (['eo-security'].includes(pagePersonalization)) { %>
         <div purpose="testimonial-quote">
           <div purpose="quote">
             <img alt="an opening quotation mark" style="width:20px; margin-bottom: 16px;" src="/images/icon-quote-21x17@2x.png">
@@ -57,7 +57,7 @@
           </div>
             </a>
         </div>
-      <% } else if (['vm'].includes(primaryBuyingSituation)) { %>
+      <% } else if (['vm'].includes(pagePersonalization)) { %>
         <div purpose="testimonial-quote">
           <div purpose="quote">
             <img alt="an opening quotation mark" style="width:20px; margin-bottom: 16px;" src="/images/icon-quote-21x17@2x.png">
@@ -91,15 +91,15 @@
         </div>
       <% } %>
       <div purpose="testimonial-videos" class="d-flex">
-        <%if(['eo-security'].includes(primaryBuyingSituation)) {%>
+        <%if(['eo-security'].includes(pagePersonalization)) {%>
         <div purpose="testimonial-video" class="charles-zaffery mx-auto" @click="clickOpenVideoModal('charles-zaffery')">
           <span><img src="/images/icon-play-video-8x9@2x.png" alt="Play">Play video</span>
         </div>
-        <%} else if(['vm'].includes(primaryBuyingSituation)){%>
+        <%} else if(['vm'].includes(pagePersonalization)){%>
         <div purpose="testimonial-video" class="austin-anderson mx-auto" @click="clickOpenVideoModal('austin-anderson')">
           <span><img src="/images/icon-play-video-8x9@2x.png" alt="Play">Play video</span>
         </div>
-        <%} else if(['eo-it', 'mdm'].includes(primaryBuyingSituation)) {%>
+        <%} else if(['eo-it', 'mdm'].includes(pagePersonalization)) {%>
         <div purpose="testimonial-video" class="nick-fohs mx-auto" @click="clickOpenVideoModal('nick-fohs')">
           <span><img src="/images/icon-play-video-8x9@2x.png" alt="Play">Play video</span>
         </div>
@@ -116,19 +116,17 @@
     <logo-carousel></logo-carousel>
 
 
-    <% if(!primaryBuyingSituation || ['mdm', 'eo-it'].includes(primaryBuyingSituation)){%>
+    <% if(!pagePersonalization || ['mdm', 'eo-it'].includes(pagePersonalization)){%>
     <div purpose="feature" class="d-flex flex-md-row flex-column-reverse justify-content-between mx-auto align-items-center">
       <div purpose="feature-text" class="d-flex flex-column">
         <h3>Automate anything</h3>
         <p>Remote-control IT tasks on every kind of computer – even you, Linux.</p>
         <div purpose="checklist" class="flex-column d-flex">
           <p>Write and run scripts remotely, report progress, and replay queued up tasks on computers that went offline.</p>
-          <p>Integrate Google Calendar to install updates and force restarts when your users’ computers are actually free.</p>
-          <p>Reduce human error by automating click-tastic tasks directly on the host with <a href="https://www.openinterpreter.com/" target="_blank">Open Interpreter</a>.*</p>
+          <p>Optionally integrate Google Calendar to make changes when certain users’ devices are actually free.</p>
         </div>
-        <p purpose="feature-footnote">*Coming soon</p>
       </div>
-      <div purpose="feature-image" class="left">
+      <div purpose="feature-image">
         <img alt="Ship data to any platform" src="/images/device-management-clickops-or-devops-380x280@2x.png">
       </div>
     </div>
@@ -140,43 +138,38 @@
     </div>
 
     <div purpose="three-column-features" class="mx-auto">
-
-      <div purpose="feature-row" class="d-flex flex-sm-row flex-column align-items-sm-start align-items-center justify-content-center">
-        <div purpose="feature-item" class="ml-sm-0">
+      <div purpose="responsive-feature-row" class="row d-flex flex-sm-row flex-column justify-content-lg-between justify-content-center align-items-center align-items-sm-start">
+        <div purpose="feature-item" class="pl-0 col-12 col-sm-6 col-lg-4">
           <img alt="Software and asset inventory" src="/images/icon-live-connection-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>Live connection</h5>
           <p>Talk to online devices in real time with Fleet’s live query API. Implement custom workflows like conditional access based on device posture, Identity, and more.</p>
         </div>
 
-        <div purpose="feature-item">
+        <div purpose="feature-item" class="pr-0 pr-lg-4 col-12 col-sm-6 col-lg-4" >
           <img alt="Software and asset inventory" src="/images/icon-software-and-asset-inventory-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>Software and asset inventory</h5>
           <p>Get visibility into all endpoints across any operating system*, including support for servers and containers in every cloud infrastructure.</p>
         </div>
 
-        <div purpose="feature-item" class="mr-sm-0 mb-0">
+        <div purpose="feature-item" class="pl-0 pl-lg-4 pr-lg-0 col-12 col-sm-6 col-lg-4">
           <img alt="See logins for every endpoint" src="/images/icon-see-logins-for-every-endpoint-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>See logins for every endpoint</h5>
           <p>Identify who logs in to any system, including login history and current sessions. Look up any computer by the email address of the person using it.</p>
         </div>
 
-
-      </div>
-      <div purpose="feature-row" class="d-flex flex-sm-row flex-column align-items-sm-start align-items-center">
-
-        <div purpose="feature-item" class="ml-sm-0">
+        <div purpose="feature-item" class="pr-0 pr-lg-4 pl-lg-0 col-12 col-sm-6 col-lg-4 mb-lg-0">
           <img alt="CIS benchmarks" src="/images/icon-cis-benchmarks-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>CIS benchmarks</h5>
           <p>Keep all your endpoints* compliant with customizable baselines, or use common benchmarks like CIS.</p>
         </div>
 
-        <div purpose="feature-item">
+        <div purpose="feature-item" class="pl-0 pl-lg-4 col-12 col-sm-6 col-lg-4 mb-sm-0">
           <img alt="Verify updates and settings" src="/images/icon-edr-health-check-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>EDR health checks</h5>
           <p>Verify that your EDR tools are installed and working so you can identify and address configuration issues quickly.</p>
         </div>
 
-        <div purpose="feature-item" class="mr-sm-0 mb-0">
+        <div purpose="feature-item" class="pr-0 pr-lg-4 col-12 col-sm-6 col-lg-4 mb-0">
           <img alt="Verify updates and settings" src="/images/icon-verify-updates-and-settings-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>Verify updates and settings</h5>
           <p>Track progress towards deadlines for security posture remediation projects, and enforce due dates through automations.</p>
@@ -194,7 +187,7 @@
           <p>Ease your logging burden, pull the data you need.</p>
         </div>
       </div>
-      <div purpose="feature-image" class="left">
+      <div purpose="feature-image">
         <img alt="Ship data to any platform" src="/images/endpoint-ops-feature-image-1-381x282@2x.png">
       </div>
     </div>
@@ -204,23 +197,21 @@
         <h3>“Zero” trust, fewer tickets</h3>
         <p>You can use Fleet’s API to customize every aspect of conditional access – even the stuff your CISO hasn’t thought of yet.</p>
       </div>
-
       <div purpose="three-column-features" class="mx-auto">
-        <div purpose="feature-row" class="d-flex flex-sm-row flex-column align-items-sm-start align-items-center justify-content-center">
-
-          <div purpose="feature-item" class="ml-sm-0">
+        <div purpose="responsive-feature-row" class="row d-flex flex-sm-row flex-column justify-content-lg-between justify-content-sm-start justify-content-center align-items-center align-items-sm-start">
+          <div purpose="feature-item" class="pl-0 col-12 col-sm-6 col-lg-4">
             <img alt="Get in front of the IdP" src="/images/device-management-icon-control-login-experience-48x48@2x.png" class="mx-auto mx-sm-0">
             <h5>Get in front of the IdP</h5>
             <p>Gate access with <a href="https://fleetdm.com/queries">common device trust policies</a> from industry peers, or roll out your own device health checks using system data and events.</p>
           </div>
 
-          <div purpose="feature-item">
+          <div purpose="feature-item" class="pr-0 pr-lg-4 col-12 col-sm-6 col-lg-4" >
             <img alt="Step-by-step instructions" src="/images/device-management-icon-step-by-step-48x48@2x.png" class="mx-auto mx-sm-0">
             <h5>Step-by-step instructions</h5>
             <p>Show resolution steps or use <a href="https://medium.com/pinterest-engineering/enforcing-device-authn-compliance-at-pinterest-a74938cb089b" target="_blank">custom HTML</a> to show employees what they need to do to restore their access without waiting on a ticket. Then give it back automatically, as soon as the problems are fixed.</p>
           </div>
 
-          <div purpose="feature-item" class="mr-sm-0 mb-0">
+          <div purpose="feature-item" class="pl-0 pl-lg-4 pr-lg-0 col-12 col-sm-6 col-lg-4 mb-0">
             <img alt="Manage device posture" src="/images/device-management-icon-manage-device-posture-48x48@2x.png" class="mx-auto mx-sm-0">
             <h5>Live retry</h5>
             <p>Give people a way to get back to work quickly and minimize downtime. Fleet’s live query API instantly re-checks the OS version and other device state so users don’t get locked out.</p>
@@ -228,14 +219,13 @@
         </div>
       </div>
     </div>
-    <%-  partial('../partials/calendar-banner.partial.ejs') %>
     <div purpose="feature" class="d-flex flex-md-row flex-column justify-content-between mx-auto align-items-center">
-      <div purpose="feature-image" class="right">
+      <div purpose="feature-image">
         <img alt="Ship data to any platform" src="/images/endpoint-ops-feature-image-2-380x380@2x.png">
       </div>
       <div purpose="feature-text" class="d-flex flex-column">
         <h3>Osquery on easy mode</h3>
-        <p>Accelerate deployment and get more out of osquery. You don’t need to be an osquery expert to get the answers you need from your <%= ['vm', 'eo-security'].includes(primaryBuyingSituation) ? 'endpoints' : 'devices' %>.</p>
+        <p>Accelerate deployment and get more out of osquery. You don’t need to be an osquery expert to get the answers you need from your <%= ['vm', 'eo-security'].includes(pagePersonalization) ? 'endpoints' : 'devices' %>.</p>
         <div purpose="checklist" class="flex-column d-flex">
           <p>Remotely disable/enable agent features, choose plugins, and keep osquery up to date.</p>
           <p>Import community queries from other security teams at top brands like Palantir and Fastly.</p>
@@ -245,47 +235,45 @@
       </div>
     </div>
 
-    <% if(!primaryBuyingSituation || ['vm', 'eo-security'].includes(primaryBuyingSituation)) {%>
+    <% if(!pagePersonalization || ['vm', 'eo-security'].includes(pagePersonalization)) {%>
     <div purpose="feature-headline" class="mr-auto">
       <h3>Open security tooling</h3>
       <p>Consolidate your security tooling on top of open data standards like YAML, SQL, and JSON.</p>
     </div>
 
     <div purpose="three-column-features" class="mx-auto">
-
-      <div purpose="feature-row" class="d-flex flex-sm-row flex-column align-items-sm-start align-items-center justify-content-center">
-        <div purpose="feature-item" class="ml-sm-0">
+      <div purpose="responsive-feature-row" class="row d-flex flex-sm-row flex-column justify-content-lg-between justify-content-center align-items-center align-items-sm-start">
+        <div purpose="feature-item" class="pl-0 col-12 col-sm-6 col-lg-4">
           <img alt="Incident response (IR)" src="/images/icon-incident-response-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>Incident response (IR)</h5>
           <p>Contain and recover from breaches using live data, remote commands, and automated workflows.</p>
         </div>
 
-        <div purpose="feature-item">
+        <div purpose="feature-item" class="pr-0 pr-lg-4 col-12 col-sm-6 col-lg-4" >
           <img alt="Detection and response" src="/images/icon-detection-and-response-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>Detection and response</h5>
           <p>Ship logs and alerts when unusual behavior is detected. Run scripts on demand or when alerts trigger.</p>
         </div>
 
-        <div purpose="feature-item" class="mr-sm-0 mb-0">
+        <div purpose="feature-item" class="pl-0 pl-lg-4 pr-lg-0 col-12 col-sm-6 col-lg-4">
           <img alt="File access monitoring (FIM)" src="/images/icon-fim-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>File access monitoring (FIM)</h5>
           <p>Specify files to monitor for changes or deletions, then log those events to your SIEM or data lake.</p>
         </div>
-      </div>
-      <div purpose="feature-row" class="d-flex flex-sm-row flex-column align-items-sm-start align-items-center justify-content-center">
-        <div purpose="feature-item" class="ml-sm-0">
+
+        <div purpose="feature-item" class="pr-0 pr-lg-4 pl-lg-0 col-12 col-sm-6 col-lg-4 mb-lg-0">
           <img alt="Attack surface management" src="/images/icon-attack-surface-management-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>Attack surface management</h5>
           <p>Discover security misconfigurations and vulnerabilities and prioritize risks that matter to your organization.</p>
         </div>
 
-        <div purpose="feature-item">
+        <div purpose="feature-item" class="pl-0 pl-lg-4 col-12 col-sm-6 col-lg-4 mb-sm-0">
           <img alt="Malware detection" src="/images/icon-malware-detection-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>Malware detection</h5>
           <p>Continuously scan host filesystems for indicators of compromise (IOC). Import malware signatures from threat intelligence sources.</p>
         </div>
 
-        <div purpose="feature-item" class="mr-sm-0 mb-0">
+        <div purpose="feature-item" class="pr-0 pr-lg-4 col-12 col-sm-6 col-lg-4 mb-0">
           <img alt="Osquery made easy" src="/images/icon-osquery-made-easy-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>Osquery made easy</h5>
           <p>Collect exactly the data you need from your production infrastructure across every cloud and data center*.</p>
@@ -301,7 +289,7 @@
     <div purpose="tweets-container" class="container-fluid px-md-0 pb-0 d-flex flex-column justify-content-center">
       <div purpose="section-heading" class="mx-auto text-center">
         <h4>Who else uses Fleet?</h4>
-        <h3>Empowering <%= ['mdm'].includes(primaryBuyingSituation) ? 'IT and corporate engineering' : ['eo-it'].includes(primaryBuyingSituation) ? 'IT and client platform' : ['eo-security'].includes(primaryBuyingSituation) ? 'security and platform' : ['vm'].includes(primaryBuyingSituation) ? 'security and IT' : 'IT and security' %> teams, globally</h3>
+        <h3>Empowering <%= ['mdm'].includes(pagePersonalization) ? 'IT and corporate engineering' : ['eo-it'].includes(pagePersonalization) ? 'IT and client platform' : ['eo-security'].includes(pagePersonalization) ? 'security and platform' : ['vm'].includes(pagePersonalization) ? 'security and IT' : 'IT and security' %> teams, globally</h3>
       </div>
     </div>
 
@@ -310,7 +298,7 @@
 
       <div purpose="section-heading" class="text-center">
         <h4>Endpoint operations</h4>
-        <h3><%= primaryBuyingSituation==='eo-security'? 'Instrument your endpoints' : 'Understand your computers'%></h3>
+        <h3><%= pagePersonalization==='eo-security'? 'Instrument your endpoints' : 'Understand your computers'%></h3>
         <div purpose="button-row" style="margin-top: 32px;" class="d-flex flex-md-row flex-column justify-content-center align-items-center mx-auto">
           <a purpose="cta-button" href="/register">Start now</a>
           <animated-arrow-button href="/contact">Talk to us</animated-arrow-button>
diff --git a/website/views/pages/entrance/login.ejs b/website/views/pages/entrance/login.ejs
index 7ed6d7b471ed..4d55f0a28106 100644
--- a/website/views/pages/entrance/login.ejs
+++ b/website/views/pages/entrance/login.ejs
@@ -1,38 +1,107 @@
 <div id="login" v-cloak>
-  <div :purpose="[showCustomerLogin ? 'customer-login-container' : 'login-container']" class="container-fluid pb-5 px-lg-0 px-3">
-    <div purpose="page-heading" v-if="showCustomerLogin">
+  <div purpose="page-container" class="container">
+    <div purpose="page-heading">
       <h1>Welcome to Fleet</h1>
       <p class="mb-0">We just need a few details in order to get started.</p>
     </div>
-    <div purpose="page-heading" v-else>
-      <h1>Welcome to Fleet</h1>
-      <p class="mb-0">Sign in to your Fleet account.</p>
-    </div>
-    <div purpose="customer-portal-form"  class="card card-body mb-5">
-      <div purpose="register-link" v-if="showCustomerLogin">
-        <a :href="registerSlug">Create an account</a>
-      </div>
-      <ajax-form class="customers-login" action="login" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-data="formData" :form-rules="formRules" :form-errors.sync="formErrors" @submitted="submittedForm()">
-        <div class="form-group">
-          <label for="email">Email</label>
-          <input type="email" class="form-control" :class="[formErrors.emailAddress ? 'is-invalid' : '']" v-model.trim="formData.emailAddress" autocomplete="email" focus-first>
-          <div class="invalid-feedback" v-if="formErrors.emailAddress">Please provide a valid email address.</div>
+    <div purpose="form-container" class="d-flex flex-lg-row flex-column justify-content-between align-items-start">
+      <div purpose="login-form" class="mx-auto mx-lg-0">
+        <div purpose="customer-portal-form"  class="card card-body mb-5">
+          <div purpose="register-link" v-if="showCustomerLogin">
+            <a :href="registerSlug">Create an account</a>
+          </div>
+          <ajax-form class="customers-login" action="login" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-data="formData" :form-rules="formRules" :form-errors.sync="formErrors" @submitted="submittedForm()">
+            <div class="form-group">
+              <label for="email">Email</label>
+              <input type="email" class="form-control" :class="[formErrors.emailAddress ? 'is-invalid' : '']" v-model.trim="formData.emailAddress" autocomplete="email" focus-first>
+              <div class="invalid-feedback" v-if="formErrors.emailAddress">Please provide a valid email address.</div>
+            </div>
+            <div class="form-group">
+              <label for="password">Password</label>
+              <input type="password" class="form-control" :class="[formErrors.password ? 'is-invalid' : '']" v-model.trim="formData.password" autocomplete="current-password">
+              <div class="invalid-feedback" v-if="formErrors.password">Please enter your password.</div>
+            </div>
+            <cloud-error v-if="cloudError === 'noUser'">The email address provided doesn't match an existing account. Create an account <a href="/customers/register">here</a>.</cloud-error>
+            <cloud-error v-else-if="cloudError === 'badCombo'">Something’s not quite right with your email or password.</cloud-error>
+            <cloud-error v-else-if="cloudError"></cloud-error>
+            <div class="pb-3">
+              <ajax-button :syncing="syncing" spinner="true" purpose="submit-button" class="btn-primary mt-4 btn-lg btn-block">Sign in</ajax-button>
+            </div>
+          </ajax-form>
+          <span class="text-center small"><a href="/customers/forgot-password">Forgot your password?</a></span>
         </div>
-        <div class="form-group">
-          <label for="password">Password</label>
-          <input type="password" class="form-control" :class="[formErrors.password ? 'is-invalid' : '']" v-model.trim="formData.password" autocomplete="current-password">
-          <div class="invalid-feedback" v-if="formErrors.password">Please enter your password.</div>
-        </div>
-        <cloud-error v-if="cloudError === 'noUser'">The email address provided doesn't match an existing account. Create an account <a href="/customers/register">here</a>.</cloud-error>
-        <cloud-error v-else-if="cloudError === 'badCombo'">Something’s not quite right with your email or password.</cloud-error>
-        <cloud-error v-else-if="cloudError"></cloud-error>
-        <div class="pb-3">
-          <ajax-button :syncing="syncing" spinner="true" purpose="submit-button" class="btn-primary mt-4 btn-lg btn-block">Sign in</ajax-button>
+      </div>
+      <div purpose="quote-and-logos" class="mx-auto mx-lg-0">
+        <% if(typeof primaryBuyingSituation === 'undefined' || ['mdm'].includes(primaryBuyingSituation)) { %>
+          <div purpose="quote">
+            <img alt="an opening quotation mark" style="width:20px; margin-bottom: 16px;" src="/images/icon-quote-21x17@2x.png">
+            <p purpose="quote-text">
+              Exciting. This is a team that listens to feedback.
+            </p>
+            <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
+              <div purpose="profile-picture">
+                <img alt="Erik Gomez" src="/images/testimonial-author-erik-gomez-48x48@2x.png">
+              </div>
+              <div class="d-flex flex-column align-self-top">
+                <p purpose="name" class="font-weight-bold m-0">Erik Gomez</p>
+                <p purpose="job-title" class="m-0">Staff Client Platform Engineer</p>
+              </div>
+            </div>
+          </div>
+        <% } else if (['eo-it'].includes(primaryBuyingSituation)) { %>
+          <div purpose="quote">
+            <img alt="an opening quotation mark" style="width:20px; margin-bottom: 16px;" src="/images/icon-quote-21x17@2x.png">
+            <p purpose="quote-text">
+              Mad props to how easy making a deploy pkg of the agent was. I wish everyone made stuff that easy.
+            </p>
+            <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
+              <div purpose="profile-picture">
+                <img alt="Wes Whetstone" src="/images/testimonial-author-wes-whetstone-48x48@2x.png">
+              </div>
+              <div class="d-flex flex-column align-self-top">
+                <p purpose="name" class="font-weight-bold m-0">Wes Whetstone</p>
+                <p purpose="job-title" class="m-0">Staff CPE</p>
+              </div>
+            </div>
+          </div>
+        <% } else if (['eo-security'].includes(primaryBuyingSituation)) { %>
+          <div purpose="quote">
+            <img alt="an opening quotation mark" style="width:20px; margin-bottom: 16px;" src="/images/icon-quote-21x17@2x.png">
+            <p purpose="quote-text">
+              Something I really appreciate about working with you guys is that it doesn't feel like I'm talking to a vendor. It actually feels like I'm talking to my team, and I really appreciate it.
+            </p>
+            <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
+              <div purpose="profile-picture">
+                <img alt="Chandra Majumdar" src="/images/testimonial-author-chandra-majumdar-48x48@2x.png">
+              </div>
+              <div class="d-flex flex-column align-self-top">
+                <p purpose="name" class="font-weight-bold m-0">Chandra Majumdar</p>
+                <p purpose="job-title" class="m-0">Partner - Cyber and Strategic Risk</p>
+              </div>
+            </div>
+          </div>
+        <% } else if (['vm'].includes(primaryBuyingSituation)) { %>
+          <div purpose="quote">
+            <img alt="an opening quotation mark" style="width:20px; margin-bottom: 16px;" src="/images/icon-quote-21x17@2x.png">
+            <p purpose="quote-text">
+              The visibility down into the assets covered by the agent is phenomenal. Fleet has become the central source for a lot of things.
+            </p>
+            <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
+              <div purpose="profile-picture">
+                <img alt="Andre Shields" src="/images/testimonial-author-andre-shields-48x48@2x.png">
+              </div>
+              <div class="d-flex flex-column align-self-top">
+                <p purpose="name" class="font-weight-bold m-0">Andre Shields</p>
+                <p purpose="job-title" class="m-0">Staff Cybersecurity Engineer, Vulnerability Management</p>
+              </div>
+            </div>
+          </div>
+        <% } %>
+        <div purpose="logos" class="flex-column flex-wrap align-items-center w-100">
+          <logo-carousel></logo-carousel>
         </div>
-      </ajax-form>
-      <span class="text-center small"><a href="/customers/forgot-password">Forgot your password?</a></span>
+      </div>
     </div>
-    <logo-carousel></logo-carousel>
   </div>
 </div>
 <%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/website/views/pages/entrance/signup.ejs b/website/views/pages/entrance/signup.ejs
index 646e2c1f30bd..40b71c7c1da4 100644
--- a/website/views/pages/entrance/signup.ejs
+++ b/website/views/pages/entrance/signup.ejs
@@ -1,62 +1,135 @@
 <div id="signup" v-cloak>
-  <div style="max-width: 560px;" class="container-fluid pb-5 px-lg-0 px-3">
+  <div purpose="page-container" class="container">
     <div purpose="page-heading">
       <h1>Welcome to Fleet</h1>
       <p class="mb-0">We just need a few details in order to get started.</p>
     </div>
-    <div purpose="customer-portal-form" class="card card-body">
-      <div purpose="login-link">
-        <a :href="loginSlug">I have an account</a>
-      </div>
-      <ajax-form action="signup" class="self-service-register" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-errors.sync="formErrors" :form-data="formData" :form-rules="formRules" @submitted="submittedSignUpForm()">
-        <div class="form-group">
-          <label for="email-address">Work email *</label>
-          <input class="form-control" id="email-address"  :class="[formErrors.emailAddress ? 'is-invalid' : '']" v-model.trim="formData.emailAddress" @input="typeClearOneFormError('emailAddress')">
-          <div class="invalid-feedback" v-if="formErrors.emailAddress" focus-first>This doesn’t appear to be a valid email address</div>
+    <div purpose="form-container" class="d-flex flex-lg-row flex-column justify-content-between align-items-start">
+      <div purpose="signup-form" class="mx-auto mx-lg-0">
+        <div purpose="customer-portal-form" class="card card-body">
+          <div purpose="login-link">
+            <a :href="loginSlug">I have an account</a>
+          </div>
+          <ajax-form action="signup" class="self-service-register" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-errors.sync="formErrors" :form-data="formData" :form-rules="formRules" @submitted="submittedSignUpForm()">
+            <div class="form-group">
+              <label for="email-address">Work email *</label>
+              <input class="form-control" id="email-address"  :class="[formErrors.emailAddress ? 'is-invalid' : '']" v-model.trim="formData.emailAddress" @input="typeClearOneFormError('emailAddress')">
+              <div class="invalid-feedback" v-if="formErrors.emailAddress" focus-first>This doesn’t appear to be a valid email address</div>
+            </div>
+            <div v-show="formData.emailAddress || showFullForm">
+              <div class="form-group">
+                <label for="password">Choose a password *</label>
+                <input class="form-control" id="password" type="password"  :class="[formErrors.password ? 'is-invalid' : '']" v-model.trim="formData.password" autocomplete="new-password" @input="typeClearOneFormError('password')">
+                <div class="invalid-feedback" v-if="formErrors.password === 'minLength'">Password too short.</div>
+                <div class="invalid-feedback" v-if="formErrors.password === 'required'">Please enter a password.</div>
+                <p class="mt-2 small"> Minimum length is 8 characters</p>
+              </div>
+              <div class="form-group">
+                <label for="organization">Organization *</label>
+                <input class="form-control" id="organization" type="text"  :class="[formErrors.organization ? 'is-invalid' : '']" v-model.trim="formData.organization" @input="typeClearOneFormError('organization')">
+                <div class="invalid-feedback" v-if="formErrors.organization">Please enter the name of your organization.</div>
+              </div>
+              <div class="row">
+                <div class="col-12 col-sm-6 pr-sm-2">
+                  <div class="form-group">
+                    <label for="first-name">First name *</label>
+                    <input class="form-control" id="first-name" type="text"  :class="[formErrors.firstName ? 'is-invalid' : '']" v-model.trim="formData.firstName" autocomplete="first-name" @input="typeClearOneFormError('firstName')">
+                    <div class="invalid-feedback" v-if="formErrors.firstName">Please enter your first name.</div>
+                  </div>
+                </div>
+                <div class="col-12 col-sm-6 pl-sm-2">
+                  <div class="form-group">
+                    <label for="last-name">Last name *</label>
+                    <input class="form-control" id="last-name" type="text"  :class="[formErrors.lastName ? 'is-invalid' : '']" v-model.trim="formData.lastName" autocomplete="last-name" @input="typeClearOneFormError('lastName')">
+                    <div class="invalid-feedback" v-if="formErrors.lastName">Please enter your last name.</div>
+                  </div>
+                </div>
+              </div>
+            </div>
+            <cloud-error v-if="cloudError==='emailAlreadyInUse'">
+              <p>This email is already linked to a Fleet account.<br> Please <a href="/login">sign in</a> with your email and password.</p>
+            </cloud-error>
+            <cloud-error v-else-if="cloudError === 'invalidEmailDomain'">
+              <p>Please enter your work or school email address</p>
+            </cloud-error>
+            <cloud-error purpose="cloud-error" v-else-if="cloudError"></cloud-error>
+            <p class="small">By signing up you agree to our <a href="/legal/privacy">privacy policy</a> and <a href="/terms">terms of service</a>.</p>
+            <ajax-button purpose="submit-button" spinner="true" type="submit" :syncing="syncing" class="btn btn-block btn-lg btn-primary mt-4" v-if="!cloudError">Agree and continue</ajax-button>
+            <ajax-button purpose="submit-button" type="button" :syncing="syncing" class="btn btn-block btn-lg btn-primary mt-4" v-if="cloudError" @click="clickResetForm()">Try again</ajax-button>
+          </ajax-form>
         </div>
-        <div v-show="formData.emailAddress || showFullForm">
-          <div class="form-group">
-            <label for="password">Choose a password *</label>
-            <input class="form-control" id="password" type="password"  :class="[formErrors.password ? 'is-invalid' : '']" v-model.trim="formData.password" autocomplete="new-password" @input="typeClearOneFormError('password')">
-            <div class="invalid-feedback" v-if="formErrors.password === 'minLength'">Password too short.</div>
-            <div class="invalid-feedback" v-if="formErrors.password === 'required'">Please enter a password.</div>
-            <p class="mt-2"> Minimum length is 8 characters</p>
+      </div>
+      <div purpose="quote-and-logos" class="mx-auto mx-lg-0">
+        <% if(typeof primaryBuyingSituation === 'undefined' || ['mdm'].includes(primaryBuyingSituation)) { %>
+          <div purpose="quote">
+            <img alt="an opening quotation mark" style="width:20px; margin-bottom: 16px;" src="/images/icon-quote-21x17@2x.png">
+            <p purpose="quote-text">
+              Exciting. This is a team that listens to feedback.
+            </p>
+            <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
+              <div purpose="profile-picture">
+                <img alt="Erik Gomez" src="/images/testimonial-author-erik-gomez-48x48@2x.png">
+              </div>
+              <div class="d-flex flex-column align-self-top">
+                <p purpose="name" class="font-weight-bold m-0">Erik Gomez</p>
+                <p purpose="job-title" class="m-0">Staff Client Platform Engineer</p>
+              </div>
+            </div>
           </div>
-          <div class="form-group">
-            <label for="organization">Organization *</label>
-            <input class="form-control" id="organization" type="text"  :class="[formErrors.organization ? 'is-invalid' : '']" v-model.trim="formData.organization" @input="typeClearOneFormError('organization')">
-            <div class="invalid-feedback" v-if="formErrors.organization">Please enter the name of your organization.</div>
+        <% } else if (['eo-it'].includes(primaryBuyingSituation)) { %>
+          <div purpose="quote">
+            <img alt="an opening quotation mark" style="width:20px; margin-bottom: 16px;" src="/images/icon-quote-21x17@2x.png">
+            <p purpose="quote-text">
+              Mad props to how easy making a deploy pkg of the agent was. I wish everyone made stuff that easy.
+            </p>
+            <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
+              <div purpose="profile-picture">
+                <img alt="Wes Whetstone" src="/images/testimonial-author-wes-whetstone-48x48@2x.png">
+              </div>
+              <div class="d-flex flex-column align-self-top">
+                <p purpose="name" class="font-weight-bold m-0">Wes Whetstone</p>
+                <p purpose="job-title" class="m-0">Staff CPE</p>
+              </div>
+            </div>
           </div>
-          <div class="row">
-            <div class="col-12 col-sm-6 pr-sm-2">
-              <div class="form-group">
-                <label for="first-name">First name *</label>
-                <input class="form-control" id="first-name" type="text"  :class="[formErrors.firstName ? 'is-invalid' : '']" v-model.trim="formData.firstName" autocomplete="first-name" @input="typeClearOneFormError('firstName')">
-                <div class="invalid-feedback" v-if="formErrors.firstName">Please enter your first name.</div>
+        <% } else if (['eo-security'].includes(primaryBuyingSituation)) { %>
+          <div purpose="quote">
+            <img alt="an opening quotation mark" style="width:20px; margin-bottom: 16px;" src="/images/icon-quote-21x17@2x.png">
+            <p purpose="quote-text">
+              Something I really appreciate about working with you guys is that it doesn't feel like I'm talking to a vendor. It actually feels like I'm talking to my team, and I really appreciate it.
+            </p>
+            <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
+              <div purpose="profile-picture">
+                <img alt="Chandra Majumdar" src="/images/testimonial-author-chandra-majumdar-48x48@2x.png">
+              </div>
+              <div class="d-flex flex-column align-self-top">
+                <p purpose="name" class="font-weight-bold m-0">Chandra Majumdar</p>
+                <p purpose="job-title" class="m-0">Partner - Cyber and Strategic Risk</p>
               </div>
             </div>
-            <div class="col-12 col-sm-6 pl-sm-2">
-              <div class="form-group">
-                <label for="last-name">Last name *</label>
-                <input class="form-control" id="last-name" type="text"  :class="[formErrors.lastName ? 'is-invalid' : '']" v-model.trim="formData.lastName" autocomplete="last-name" @input="typeClearOneFormError('lastName')">
-                <div class="invalid-feedback" v-if="formErrors.lastName">Please enter your last name.</div>
+          </div>
+        <% } else if (['vm'].includes(primaryBuyingSituation)) { %>
+          <div purpose="quote">
+            <img alt="an opening quotation mark" style="width:20px; margin-bottom: 16px;" src="/images/icon-quote-21x17@2x.png">
+            <p purpose="quote-text">
+              The visibility down into the assets covered by the agent is phenomenal. Fleet has become the central source for a lot of things.
+            </p>
+            <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
+              <div purpose="profile-picture">
+                <img alt="Andre Shields" src="/images/testimonial-author-andre-shields-48x48@2x.png">
+              </div>
+              <div class="d-flex flex-column align-self-top">
+                <p purpose="name" class="font-weight-bold m-0">Andre Shields</p>
+                <p purpose="job-title" class="m-0">Staff Cybersecurity Engineer, Vulnerability Management</p>
               </div>
             </div>
           </div>
+        <% } %>
+        <div purpose="logos" class="flex-column flex-wrap align-items-center w-100">
+          <logo-carousel></logo-carousel>
         </div>
-        <cloud-error v-if="cloudError==='emailAlreadyInUse'">
-          <p>This email is already linked to a Fleet account.<br> Please <a href="/login">sign in</a> with your email and password.</p>
-        </cloud-error>
-        <cloud-error v-else-if="cloudError === 'invalidEmailDomain'">
-          <p>Please enter your work or school email address</p>
-        </cloud-error>
-        <cloud-error purpose="cloud-error" v-else-if="cloudError"></cloud-error>
-        <p class="small">By signing up you agree to our <a href="/legal/privacy">privacy policy</a> and <a href="/terms">terms of service</a>.</p>
-        <ajax-button purpose="submit-button" spinner="true" type="submit" :syncing="syncing" class="btn btn-block btn-lg btn-primary mt-4" v-if="!cloudError">Agree and continue</ajax-button>
-        <ajax-button purpose="submit-button" type="button" :syncing="syncing" class="btn btn-block btn-lg btn-primary mt-4" v-if="cloudError" @click="clickResetForm()">Try again</ajax-button>
-      </ajax-form>
+      </div>
     </div>
-    <logo-carousel></logo-carousel>
   </div>
 </div>
 <%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/website/views/pages/homepage.ejs b/website/views/pages/homepage.ejs
index ac3602f79456..d21fd43c3904 100644
--- a/website/views/pages/homepage.ejs
+++ b/website/views/pages/homepage.ejs
@@ -6,8 +6,8 @@
         <div class="d-flex flex-row justify-content-center align-items-start">
           <%/* Hero text */%>
           <div purpose="hero-text"  class="d-flex flex-column justify-content-center">
-            <h1><%- partial('../partials/primary-tagline.partial.ejs') %></h1>
-            <p>Replace the sprawl with <%= primaryBuyingSituation === 'vm'? 'secure, open-source reporting that works the way you want' : primaryBuyingSituation === 'eo-security'? 'universal, open-source endpoint visibility' : 'secure, open-source device management that works the way you want' %>.</p>
+            <h1 class="mx-auto <%= primaryBuyingSituation%>"><%- partial('../partials/primary-tagline.partial.ejs') %></h1>
+            <p>Replace the sprawl with <%= primaryBuyingSituation === 'vm'? 'secure, open-source reporting that works the way you want' : primaryBuyingSituation === 'eo-security'? 'universal, open-source endpoint visibility' : 'a modern device management platform that works the way you want' %>.</p>
             <div purpose="button-row" class="d-flex flex-sm-row flex-column justify-content-center align-items-center">
               <a purpose="cta-button" href="<%= primaryBuyingSituation === 'mdm' ? '/device-management' : primaryBuyingSituation === 'vm' ? '/vulnerability-management' : primaryBuyingSituation === 'eo-security' ? '/endpoint-ops' : primaryBuyingSituation === 'eo-it' ? '/endpoint-ops' : '/device-management' %>">Learn how</a>
               <animated-arrow-button href="/contact">Talk to us</animated-arrow-button>
@@ -22,20 +22,14 @@
     <logo-carousel></logo-carousel>
   </div>
   <%/* Homepage content */%>
-  <div purpose="homepage-content" class="container">
-    <%/* Testimonial videos */%>
-    <div purpose="page-section" class="mb-0">
-      <%-  partial('../partials/calendar-banner.partial.ejs') %>
-    </div>
-  </div>
   <div purpose="homepage-content" class="container">
     <div purpose="page-section">
     <% if(!primaryBuyingSituation){ %>
       <div purpose="category-switch" class="d-flex flex-md-row flex-column justify-content-center mx-auto">
         <div purpose="category-switch-option" :class="[selectedCategory === 'mdm' ? 'selected' : '']" @click="selectedCategory = 'mdm'">Device management</div>
-        <div purpose="category-switch-option" :class="[['eo-it', 'eo-security'].includes(selectedCategory) ? 'selected' : '']" @click="selectedCategory = 'endpoint-operations'">Endpoint ops</div>
-        <div purpose="category-switch-option" :class="[selectedCategory === 'vulnerability-management' ? 'selected' : '']" @click="selectedCategory = 'vm'">Vuln<span class="d-inline d-md-none d-lg-inline">erability</span> management</div>
-        <div purpose="category-tier-switch" :class="[['eo-it', 'eo-security', 'endpoint-operations'].includes(selectedCategory) ? 'eo-selected' : selectedCategory === 'vm' ? 'vm-selected' : selectedCategory === 'mdm' ? 'mdm-selected' : 'mdm-selected']"></div>
+        <div purpose="category-switch-option" :class="[selectedCategory === 'eo-it' ? 'selected' : '']" @click="selectedCategory = 'eo-it'">IT engineering</div>
+        <div purpose="category-switch-option" :class="[selectedCategory === 'eo-security' ? 'selected' : '']" @click="selectedCategory = 'eo-security'">Security engineering</div>
+        <div purpose="category-tier-switch" :class="[selectedCategory === 'eo-it' ? 'it-selected' : selectedCategory === 'eo-security' ? 'security-selected' : selectedCategory === 'mdm' ? 'mdm-selected' : 'mdm-selected']"></div>
       </div>
       <%/* Device management block */%>
       <div purpose="platform-block" class="d-flex flex-md-row flex-column justify-content-md-between mx-auto align-items-center" :class="[selectedCategory === 'mdm' ? 'visible' : '']" v-if="selectedCategory === 'mdm'">
@@ -43,10 +37,10 @@
           <img alt="Operating systems entering a glass device management dome" src="/images/device-management-hero-380x293@2x.png">
         </div>
         <div purpose="category-text-block" class="d-flex flex-column">
-          <strong>Your easiest MDM migration</strong>
-          <p>Even if you've never done an MDM migration, you've probably heard it's hard.  Fleet makes it easy to get your data in and get it out.</p>
-          <strong>Tidy up your tools</strong>
-          <p>Deploy a modern Mac-first MDM purpose-built for IT engineers and cross-training. Use principles from DevOps to manage Apple, Windows, and Linux computers declaratively.</p>
+          <strong>Everything in one place</strong>
+          <p>Manage devices consistently in a single, open platform for Apple, Windows, and Linux. Going only Mac or 50/50 Mac and Windows? What about Linux? It’s up to you. </p>
+          <strong>Debunk the cross-platform myth</strong>
+          <p>Fleet exposes familiar concepts like custom attributes and dynamic grouping, but in a way that lets you work directly with data and events from each native operating system.</p>
           <strong>Less friction</strong>
           <p>Fork the CIS benchmarks or easily build your own compliance framework. 100% source available.</p>
           <div>
@@ -55,38 +49,38 @@
         </div>
       </div>
 
-      <%/* Endpoint ops block */%>
-      <div purpose="platform-block" :class="[selectedCategory === 'endpoint-operations' ? 'visible' : '']"  class="d-flex flex-md-row flex-column justify-content-md-between mx-auto align-items-center" v-if="selectedCategory === 'endpoint-operations'">
+      <%/* IT engineering block */%>
+      <div purpose="platform-block" :class="[selectedCategory === 'eo-it' ? 'visible' : '']"  class="d-flex flex-md-row flex-column justify-content-md-between mx-auto align-items-center" v-if="selectedCategory === 'eo-it'">
         <div purpose="endpoint-ops-image" class="left">
           <img alt="Endpoint ops" src="/images/endpoint-operations-hero-image-380x380@2x.png">
         </div>
         <div purpose="category-text-block" class="d-flex flex-column">
-          <strong>Pulse check anything</strong>
-          <p>Use a live connection to every endpoint to simplify audit, compliance, and reporting from workstations to data centers.</p>
+          <strong>Automate anything</strong>
+          <p>Remotely run scripts and prompts to complete tasks on every kind of computer, including Linux.</p>
           <strong>Ship data to any platform</strong>
           <p>Ship logs to any platform like Splunk, Snowflake, or <a href="/docs/using-fleet/log-destinations">any streaming infrastructure</a> like AWS Kinesis and Apache Kafka.</p>
           <strong>Osquery on easy mode</strong>
           <p>Use "read-only" mode or enable remote scripting to automate anything on every operating system, including Linux.</p>
           <div>
-            <a purpose="category-button" class="text-nowrap btn btn-primary" href="/endpoint-ops">Start with endpoint ops</a>
+            <a purpose="category-button" class="text-nowrap btn btn-primary" href="/endpoint-ops?pageMode=it">Start with IT engineering</a>
           </div>
         </div>
       </div>
 
-      <%/* Vulnerability management block */%>
-      <div purpose="platform-block" :class="[selectedCategory === 'vm' ? 'visible' : '']" class="d-flex flex-md-row flex-column justify-content-md-between mx-auto align-items-center" v-if="selectedCategory === 'vm'">
+      <%/* Security engineering block */%>
+      <div purpose="platform-block" :class="[selectedCategory === 'eo-security' ? 'visible' : '']" class="d-flex flex-md-row flex-column justify-content-md-between mx-auto align-items-center" v-if="selectedCategory === 'eo-security'">
         <div purpose="vuln-management-image" class="left">
           <img  alt="An orb being scanned for vulnerabilities" src="/images/vulnerability-management-hero-image-345x380@2x.png">
         </div>
         <div purpose="category-text-block" class="d-flex flex-column">
-          <strong>Report what matters</strong>
-          <p>Let's face it, most built-in graphs leave you wanting more. Report MTTR and any other custom metrics exactly the way you want to using fresh data from real computers.</p>
-          <strong>Deep context from the environment</strong>
-          <p>Fleet gives you data down to the chip level on every endpoint to help you make sense of which vulnerabilities to prioritize.</p>
-          <strong>Untangle your security stack</strong>
-          <p>Use open data and APIs to connect your vulnerability solution with osquery, the agent you might already have deployed.</p>
+          <strong>Osquery on easy mode</strong>
+          <p>Use "read-only" mode or enable remote scripting to automate anything on every operating system, including Linux.</p>
+          <strong>Pulse check anything</strong>
+          <p>Use a live connection to every endpoint to simplify audit, compliance, and reporting from workstations to data centers.</p>
+          <strong>Ship data to any platform</strong>
+          <p>Ship logs to any platform like Splunk, Snowflake, or <a href="/docs/using-fleet/log-destinations">any streaming infrastructure</a> like AWS Kinesis and Apache Kafka.</p>
           <div>
-            <a purpose="category-button" class="text-nowrap btn btn-primary" href="/vulnerability-management">Start with vuln management</a>
+            <a purpose="category-button" class="text-nowrap btn btn-primary" href="/endpoint-ops?pageMode=security">Start with security engineering</a>
           </div>
         </div>
       </div>
@@ -98,9 +92,9 @@
              <div purpose="device-management-image" class="left">
                <img alt="Operating systems entering a glass device management dome" src="/images/device-management-hero-380x293@2x.png">
              </div>
-             <div purpose="category-text-block" class="d-flex flex-column">
+             <div purpose="category-text-block" class="d-flex flex-column personalized">
                <h4>Device management</h4>
-               <h3>Manage everything in one place</h3>
+               <h2>Manage everything in one place</h2>
                <p>Modernize your device management practice with a single, open platform for Apple, Windows, and Linux.</p>
                <div>
                  <animated-arrow-button href="/device-management">Start with device management</animated-arrow-button>
@@ -109,12 +103,12 @@
            </div>
          <% } %>
          <div purpose="platform-block" class="d-flex flex-md-row flex-column-reverse justify-content-md-between mx-auto align-items-center">
-           <div purpose="category-text-block" class="d-flex flex-column">
-             <h4>Endpoint ops</h4>
-             <h3><%= primaryBuyingSituation==='eo-security'? 'Instrument your endpoints' : 'Understand your computers'%></h3>
+           <div purpose="category-text-block" class="d-flex flex-column personalized">
+             <h4><%= primaryBuyingSituation==='eo-security'? 'Security engineering' : 'IT engineering'%></h4>
+             <h2><%= primaryBuyingSituation==='eo-security'? 'Instrument your endpoints' : 'Understand your computers'%></h2>
              <p>A <%= primaryBuyingSituation==='eo-security'? 'lightweight' : 'quick-fast' %> way to gather <%= primaryBuyingSituation==='vm'? 'patch level and custom reports across all your computing devices, even in OT and production environments' : primaryBuyingSituation==='eo-security'? 'deep context and custom telemetry across all your endpoints, even servers' : primaryBuyingSituation==='mdm'||primaryBuyingSituation==='eo-it'? 'compliance and inventory data across all your devices' : 'device data across all your computers' %>. Pulse check or automate anything on any platform.</p>
              <div>
-               <animated-arrow-button href="/endpoint-ops">Start with endpoint ops</animated-arrow-button>
+               <animated-arrow-button href="/endpoint-ops">Start with <%= primaryBuyingSituation==='eo-security' ? 'security engineering' : 'IT engineering'%></animated-arrow-button>
              </div>
            </div>
            <div purpose="endpoint-ops-image" class="right">
@@ -127,9 +121,9 @@
              <div purpose="vuln-management-image" class="left">
                <img  alt="An orb being scanned for vulnerabilities" src="/images/vulnerability-management-hero-image-345x380@2x.png">
              </div>
-             <div purpose="category-text-block" class="d-flex flex-column">
+             <div purpose="category-text-block" class="d-flex flex-column personalized">
                <h4>Vulnerability management</h4>
-               <h3>Build the vulnerability program you actually want</h3>
+               <h2>Build the vulnerability program you actually want</h2>
                <p>Show how quickly zero days and "celebrity CVEs" are resolved and which teams need extra help. Use scoring, known exploit feeds, and live, down-to-the-chip data about your own environment to prioritize, export, automate, and monitor mitigations of everyday vulnerabilities in operating systems, software packages, browsers, and plugins, anywhere.</p>
                <div>
                 <animated-arrow-button href="/vulnerability-management">Start with vuln management</animated-arrow-button>
@@ -143,9 +137,9 @@
          <%if(primaryBuyingSituation === 'mdm'){ %>
            <%/* Device management block */%>
            <div purpose="platform-block" class="d-flex flex-md-row flex-column-reverse justify-content-md-between mx-auto align-items-center">
-             <div purpose="category-text-block" class="d-flex flex-column">
+             <div purpose="category-text-block" class="d-flex flex-column personalized">
                <h4>Device management</h4>
-               <h3>Manage everything in one place</h3>
+               <h2>Manage everything in one place</h2>
                <p>Modernize your device management practice with a single, open platform for Apple, Windows, and Linux.</p>
                <div>
                  <animated-arrow-button href="/device-management">Start with device management</animated-arrow-button>
@@ -158,9 +152,9 @@
          <% } else {%>
            <%/* Vulnerability management block */%>
            <div purpose="platform-block" class="d-flex flex-md-row flex-column-reverse justify-content-md-between mx-auto align-items-center">
-             <div purpose="category-text-block" class="d-flex flex-column">
+             <div purpose="category-text-block" class="d-flex flex-column personalized">
                <h4>Vulnerability management</h4>
-               <h3>Build the vulnerability program you actually want</h3>
+               <h2>Build the vulnerability program you actually want</h2>
                <p>Show how quickly zero days and "celebrity CVEs" are resolved and which teams need extra help. Use scoring, known exploit feeds, and live, down-to-the-chip data about your own environment to prioritize, export, automate, and monitor mitigations of everyday vulnerabilities in operating systems, software packages, browsers, and plugins, anywhere.</p>
                <div>
                  <animated-arrow-button href="/vulnerability-management">Start with vuln management</animated-arrow-button>
@@ -176,12 +170,12 @@
            <div purpose="endpoint-ops-image" class="left">
              <img alt="Endpoint ops" src="/images/endpoint-operations-hero-image-380x380@2x.png">
            </div>
-           <div purpose="category-text-block" class="d-flex flex-column">
-             <h4>Endpoint ops</h4>
-             <h3><%= primaryBuyingSituation==='eo-security'? 'Instrument your endpoints' : 'Understand your computers'%></h3>
-             <p>A <%= primaryBuyingSituation==='eo-security'? 'lightweight' : 'quick-fast' %> way to gather <%= primaryBuyingSituation==='vm'? 'patch level and custom reports across all your computing devices, even in OT and production environments' : primaryBuyingSituation==='eo-security'? 'deep context and custom telemetry across all your endpoints, even servers' : primaryBuyingSituation==='mdm'||primaryBuyingSituation==='eo-it'? 'compliance and inventory data across all your devices' : 'device data across all your computers' %>. Pulse check or automate anything on any platform.</p>
+           <div purpose="category-text-block" class="d-flex flex-column personalized">
+             <h4><%= primaryBuyingSituation==='mdm' ? 'IT engineering' : 'Security engineering'%></h4>
+             <h2><%= primaryBuyingSituation==='vm'? 'Instrument your endpoints' : 'Understand your computers'%></h2>
+             <p>A <%= primaryBuyingSituation==='vm'? 'lightweight' : 'quick-fast' %> way to gather <%= primaryBuyingSituation==='vm'? 'patch level and custom reports across all your computing devices, even in OT and production environments' : primaryBuyingSituation==='vm'? 'deep context and custom telemetry across all your endpoints, even servers' : primaryBuyingSituation==='mdm'||primaryBuyingSituation==='eo-it'? 'compliance and inventory data across all your devices' : 'device data across all your computers' %>. Pulse check or automate anything on any platform.</p>
              <div>
-               <animated-arrow-button href="/endpoint-ops">Start with endpoint ops</animated-arrow-button>
+               <animated-arrow-button href="/endpoint-ops">Start with <%= primaryBuyingSituation==='mdm' ? 'IT engineering' : 'security engineering'%></animated-arrow-button>
              </div>
            </div>
          </div>
@@ -379,7 +373,7 @@
     <div purpose="homepage-content" class="container">
       <div class="text-center" purpose="bottom-cta">
         <h4>For teams with lots of computing devices</h4>
-        <h1><%- partial('../partials/primary-tagline.partial.ejs') %></h1>
+        <h1 class="mx-auto <%= primaryBuyingSituation%>"><%- partial('../partials/primary-tagline.partial.ejs') %></h1>
         <div purpose="button-row" style="margin-top: 40px;" class="d-flex flex-sm-row flex-column justify-content-center align-items-center mx-auto">
           <a purpose="cta-button" href="/register">Start now</a>
           <animated-arrow-button href="/contact">Talk to us</animated-arrow-button>
@@ -390,6 +384,9 @@
   </div>
   <%/* Cloud city banner */%>
   <parallax-city></parallax-city>
+  <modal v-if="modal === 'unsubscribed'" @close="closeModal()">
+    <p class="mb-0">Your email preferences have been updated.</p>
+  </modal>
   <modal purpose="video-modal" v-if="modal === 'austin-anderson'" @close="closeModal()">
     <iframe width="560" height="315" src="https://www.youtube.com/embed/G5Ry_vQPaYc?si=vv0AfRe30yssWWRM&amp;rel=0" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
   </modal>
diff --git a/website/views/pages/integrations.ejs b/website/views/pages/integrations.ejs
index 0303a83775c0..ac9a2c34665b 100644
--- a/website/views/pages/integrations.ejs
+++ b/website/views/pages/integrations.ejs
@@ -15,7 +15,7 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Know who opened your computer before you let them log into anything.
+            Enable single sign-on (SSO) by configuring Fleet as an Okta SAML application.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://www.okta.com/">Learn more</a>
@@ -29,7 +29,7 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Ingest osquery data and monitor for important changes or events.
+            Import Fleet data to Snowflake.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank"  href="https://www.snowflake.com/">Learn more</a>
@@ -73,11 +73,10 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Know who opened your computer before you let them log into anything.
+            Integrate with a legacy on-prem identity server.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/whatis">Learn more</a>
-            <animated-arrow-button class="py-0" href="/docs/deploy/single-sign-on-sso#other-idps">Docs</animated-arrow-button>
           </div>
         </div>
       </div>
@@ -88,11 +87,11 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Deploy Fleet in Ansible.
+            Deploy Fleet with Ansible.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
-            <a purpose="learn-more-link" target="_blank" href="https://ansible.com">Learn more</a>
-            <animated-arrow-button class="py-0" target="_blank"  href="https://github.com/CptOfEvilMinions/FleetDM-Automation">Docs</animated-arrow-button>
+            <a purpose="learn-more-link" target="_blank" href="">Learn more</a>
+            <animated-arrow-button class="py-0" target="_blank" href="https://github.com/CptOfEvilMinions/FleetDM-Automation">Guide</animated-arrow-button>
           </div>
         </div>
       </div>
@@ -103,11 +102,11 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Deploy your own self-managed Fleet in any AWS environment in minutes.
+            Deploy your own self-managed Fleet server on AWS.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://aws.amazon.com/">Learn more</a>
-            <animated-arrow-button class="py-0" href="/docs/deploy/deploy-on-aws-with-terraform">Get started</animated-arrow-button>
+            <animated-arrow-button class="py-0" href="/docs/deploy/deploy-fleet#aws">Get started</animated-arrow-button>
           </div>
         </div>
       </div>
@@ -117,11 +116,11 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Deploy your own self-managed Fleet in the Microsoft Cloud.
+            Deploy your own self-managed Fleet server on Azure.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://azure.microsoft.com/en-us">Learn more</a>
-            <animated-arrow-button class="py-0" href="/docs/deploy/reference-architectures#azure">Docs</animated-arrow-button>
+            <animated-arrow-button class="py-0" href="https://chat.osquery.io/c/fleet">Community support</animated-arrow-button>
           </div>
         </div>
       </div>
@@ -132,11 +131,10 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Easily issue MDM commands and standardize data across operating systems.
+            Chef is an automation tool that can be used with Fleet.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://www.chef.io/products/chef-infra">Learn more</a>
-            <animated-arrow-button class="py-0" target="_blank"  href="https://docs.chef.io/chef_overview/">Docs</animated-arrow-button>
           </div>
         </div>
       </div>
@@ -147,7 +145,7 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Ingest osquery data and monitor for important changes or events.
+            Import Fleet data to Elastic.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://www.elastic.co/">Learn more</a>
@@ -189,7 +187,7 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Ingest osquery data and monitor for important changes or events.
+            Import Fleet data to Chronicle.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://chronicle.security/">Learn more</a>
@@ -203,11 +201,11 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Deploy your own self-managed Fleet in any GCP environment.
+            Deploy your own self-managed Fleet server on Google Cloud Platform (GCP).
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://console.cloud.google.com/getting-started">Learn more</a>
-            <animated-arrow-button class="py-0" href="/docs/deploy/reference-architectures#gcp">Get started</animated-arrow-button>
+            <animated-arrow-button class="py-0" href="https://chat.osquery.io/c/fleet">Community support</animated-arrow-button>
           </div>
         </div>
       </div>
@@ -231,7 +229,7 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Easily issue MDM commands and standardize data across operating systems.
+            Deploy software with Fleet and Munki.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://github.com/munki/munki">Learn more</a>
@@ -245,7 +243,7 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Easily issue MDM commands and standardize data across operating systems.
+            Deploy configuration profiles and issue MDM commands with Fleet and Puppet.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://puppet.com/">Learn more</a>
@@ -260,7 +258,7 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Ingest osquery data and monitor for important changes or events.
+            Import Fleet data to Splunk.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://www.splunk.com/">Learn more</a>
diff --git a/website/views/pages/pricing.ejs b/website/views/pages/pricing.ejs
index 99f35ad99355..fe6307570715 100644
--- a/website/views/pages/pricing.ejs
+++ b/website/views/pages/pricing.ejs
@@ -80,7 +80,7 @@
             <table purpose="pricing-categories-table" class="table">
              <thead>
                 <tr>
-                  <td><h4><%- category.categoryName %></h4></td>
+                  <td><h5><%- category.categoryName %></h5></td>
                   <%if(pricingTable.indexOf(category) === 0) {%>
                   <td class="text-center">
                     <strong>Free</strong>
@@ -122,7 +122,7 @@
         </div>
         <%// Mobile features tables %>
         <div purpose="mobile-feature-table-section" class="d-block d-md-none" v-for="category in pricingTable">
-          <h4>{{category.categoryName}}</h4>
+          <h5>{{category.categoryName}}</h5>
             <div purpose="mobile-features-table" class="d-flex flex-column" v-for="feature in category.features">
               <div purpose="striped-row" class="d-flex flex-row justify-content-between align-items-center">
                 <strong class="d-block">
@@ -152,7 +152,7 @@
             <table purpose="pricing-categories-table" class="table">
              <thead>
                 <tr>
-                  <td><h4><%- category.categoryName %></h4></td>
+                  <td><h5><%- category.categoryName %></h5></td>
                   <%if(pricingTableForIt.indexOf(category) === 0) {%>
                   <td class="text-center">
                     <strong>Free</strong>
@@ -194,7 +194,7 @@
         </div>
         <%// Mobile features tables %>
         <div purpose="mobile-feature-table-section" class="d-block d-md-none" v-for="category in pricingTableForIt">
-          <h4>{{category.categoryName}}</h4>
+          <h5>{{category.categoryName}}</h5>
             <div purpose="mobile-features-table" class="d-flex flex-column" v-for="feature in category.features">
               <div purpose="striped-row" class="d-flex flex-row justify-content-between align-items-center" @click="">
                 <strong>
@@ -223,7 +223,7 @@
             <table purpose="pricing-categories-table" class="table">
              <thead>
                 <tr>
-                  <td><h4><%- category.categoryName %></h4></td>
+                  <td><h5><%- category.categoryName %></h5></td>
                   <%if(pricingTableForSecurity.indexOf(category) === 0) {%>
                   <td class="text-center">
                     <strong>Free</strong>
@@ -265,7 +265,7 @@
         </div>
         <%// Mobile features tables %>
         <div purpose="mobile-feature-table-section" class="d-block d-md-none" v-for="category in pricingTableForSecurity">
-          <h4>{{category.categoryName}}</h4>
+          <h5>{{category.categoryName}}</h5>
             <div purpose="mobile-features-table" class="d-flex flex-column" v-for="feature in category.features">
               <div purpose="striped-row" class="d-flex flex-row justify-content-between align-items-center">
                 <strong class="d-block">
diff --git a/website/views/pages/start.ejs b/website/views/pages/start.ejs
index 93a92cbe0fd1..ac6150735b51 100644
--- a/website/views/pages/start.ejs
+++ b/website/views/pages/start.ejs
@@ -1,555 +1,664 @@
 <div id="start" v-cloak>
-  <div class="d-flex container" purpose="page-container">
+  <div class="d-flex container d-flex flex-row" purpose="page-container">
     <div purpose="form-container">
-    <%//  ┌─┐┌┬┐┌─┐┬─┐┌┬┐
-      //  └─┐ │ ├─┤├┬┘ │
-      //  └─┘ ┴ ┴ ┴┴└─ ┴ %>
-    <div v-if="currentStep === 'start'">
-      <div class=" mx-auto">
-        <h2>Let’s get started</h2>
-        <p>To see whether Fleet’s right for your team, let's have a look at your hosts and what you're trying to do.</p>
-        <p>You can come back at any time and pick up where you left off.</p>
-        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['start']" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div purpose="form-buttons">
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Start</ajax-button>
+      <%//  ┌─┐┌┬┐┌─┐┬─┐┌┬┐
+        //  └─┐ │ ├─┤├┬┘ │
+        //  └─┘ ┴ ┴ ┴┴└─ ┴ %>
+      <div v-if="currentStep === 'start'">
+        <div class=" mx-auto">
+          <h2>What to expect</h2>
+          <p>Fleet is a little different from some of the other MDMs you might have used.</p>
+          <ul>
+            <li>You can deploy it yourself at any time and it’s 100% source available.</li>
+            <li>You don’t have to talk to us first, but you can if you want to. We hang out <a href="/support">over here</a>.</li>
+            <li>Fleet customers get unlimited support, migration assistance, and even a private Slack support channel.</li>
+          </ul>
+          <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['start']" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div purpose="form-buttons">
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+          </ajax-form>
+          <div purpose="form-tip" class="d-flex flex-row align-items-center justify-content-start">
+            <div><img alt="A lightbulb" src="/images/icon-suggestion-64x64@2x.png"></div>
+            <div>
+            <p>If you’d like to chat with other customers about their experience with Fleet, just let us know.</p>
+            </div>
+          </div>
         </div>
-        </ajax-form>
-      </div>
-    </div>
-    <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌─┐┬─┐┌─┐  ┬ ┬┌─┐┬ ┬  ┬ ┬┌─┐┬┌┐┌┌─┐  ┌─┐┬  ┌─┐┌─┐┌┬┐  ┌─┐┌─┐┬─┐
-      //  │││├─┤├─┤ │   ├─┤├┬┘├┤   └┬┘│ ││ │  │ │└─┐│││││ ┬  ├┤ │  ├┤ ├┤  │   ├┤ │ │├┬┘
-      //  └┴┘┴ ┴┴ ┴ ┴   ┴ ┴┴└─└─┘   ┴ └─┘└─┘  └─┘└─┘┴┘└┘└─┘  └  ┴─┘└─┘└─┘ ┴   └  └─┘┴└─%>
-    <div v-if="currentStep === 'what-are-you-using-fleet-for'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 10%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
       </div>
-      <h2>What will you use Fleet for?</h2>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-are-you-using-fleet-for']" :form-rules="primaryBuyingSituationFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div class="form-group" :class="[formErrors.primaryBuyingSituation ? 'is-invalid' : '']" >
-          <label purpose="form-option" class="form-control" :class="[formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'mdm' ? 'selected' : '']">
-            <input type="radio" :class="[formErrors.primaryBuyingSituation ? 'is-invalid' : '']" v-model.trim="formData['what-are-you-using-fleet-for'].primaryBuyingSituation" value="mdm" @input="clickClearOneFormError('primaryBuyingSituation')">
-            <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-            Device management (MDM)
-          </label>
-          <label purpose="form-option" class="form-control" :class="[formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-security' ? 'selected' : '']">
-            <input type="radio" v-model.trim="formData['what-are-you-using-fleet-for'].primaryBuyingSituation" value="eo-security" @input="clickClearOneFormError('primaryBuyingSituation')">
-            <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-            Endpoint ops for security engineering
-          </label>
-          <label purpose="form-option" class="form-control" :class="[formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-it' ? 'selected' : '']">
-            <input type="radio" :class="[formErrors.primaryBuyingSituation ? 'is-invalid' : '']" v-model.trim="formData['what-are-you-using-fleet-for'].primaryBuyingSituation" value="eo-it" @input="clickClearOneFormError('primaryBuyingSituation')">
-            <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-            Endpoint ops for identity engineers and IT admins
-          </label>
-          <label purpose="form-option" class="form-control" :class="[formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'vm' ? 'selected' : '']">
-            <input type="radio" :class="[formErrors.primaryBuyingSituation ? 'is-invalid' : '']" v-model.trim="formData['what-are-you-using-fleet-for'].primaryBuyingSituation" value="vm" @input="clickClearOneFormError('primaryBuyingSituation')">
-            <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-            Vulnerability management
-          </label>
-          <div class="invalid-feedback" v-if="formErrors.primaryBuyingSituation">Please select an option</div>
-        </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+      <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌─┐┬─┐┌─┐  ┬ ┬┌─┐┬ ┬  ┬ ┬┌─┐┬┌┐┌┌─┐  ┌─┐┬  ┌─┐┌─┐┌┬┐  ┌─┐┌─┐┬─┐
+        //  │││├─┤├─┤ │   ├─┤├┬┘├┤   └┬┘│ ││ │  │ │└─┐│││││ ┬  ├┤ │  ├┤ ├┤  │   ├┤ │ │├┬┘
+        //  └┴┘┴ ┴┴ ┴ ┴   ┴ ┴┴└─└─┘   ┴ └─┘└─┘  └─┘└─┘┴┘└┘└─┘  └  ┴─┘└─┘└─┘ ┴   └  └─┘┴└─%>
+      <div v-if="currentStep === 'what-are-you-using-fleet-for'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 10%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
         </div>
-      </ajax-form>
-    </div>
-    <%//  ┬ ┬┌─┐┬  ┬┌─┐  ┬ ┬┌─┐┬ ┬  ┌─┐┬  ┬┌─┐┬─┐  ┬ ┬┌─┐┌─┐┌┬┐  ┌─┐┬  ┌─┐┌─┐┌┬┐
-      //  ├─┤├─┤└┐┌┘├┤   └┬┘│ ││ │  ├┤ └┐┌┘├┤ ├┬┘  │ │└─┐├┤  ││  ├┤ │  ├┤ ├┤  │
-      //  ┴ ┴┴ ┴ └┘ └─┘   ┴ └─┘└─┘  └─┘ └┘ └─┘┴└─  └─┘└─┘└─┘─┴┘  └  ┴─┘└─┘└─┘ ┴ %>
-    <div v-if="currentStep === 'have-you-ever-used-fleet'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 30%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <h2>Have you ever used Fleet?</h2>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['have-you-ever-used-fleet']" :form-rules="isUsingFleetFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-
-          <div class="form-group" :class="[formErrors.fleetUseStatus ? 'is-invalid' : '']">
-            <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'yes-deployed' ? 'selected' : '']">
-              <input type="radio"  v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="yes-deployed" @input="clickClearOneFormError('fleetUseStatus')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Yes, we actively use Fleet at work today
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'yes-recently-deployed' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="yes-recently-deployed" @input="clickClearOneFormError('fleetUseStatus')">
+        <h2>What will you use Fleet for?</h2>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-are-you-using-fleet-for']" :form-rules="primaryBuyingSituationFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div class="form-group" :class="[formErrors.primaryBuyingSituation ? 'is-invalid' : '']" >
+            <label purpose="form-option" class="form-control" :class="[formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'mdm' ? 'selected' : '']">
+              <input type="radio" :class="[formErrors.primaryBuyingSituation ? 'is-invalid' : '']" v-model.trim="formData['what-are-you-using-fleet-for'].primaryBuyingSituation" value="mdm" @input="clickClearOneFormError('primaryBuyingSituation')">
               <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Yes, we deployed Fleet at work recently to try it out
+              Device management (MDM)
             </label>
-            <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'yes-deployed-local' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="yes-deployed-local" @input="clickClearOneFormError('fleetUseStatus')">
+            <label purpose="form-option" class="form-control" :class="[formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-security' ? 'selected' : '']">
+              <input type="radio" v-model.trim="formData['what-are-you-using-fleet-for'].primaryBuyingSituation" value="eo-security" @input="clickClearOneFormError('primaryBuyingSituation')">
               <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Yes, but only in a local / homelab environment
+              Security engineering
             </label>
-            <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'yes-deployed-long-time' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="yes-deployed-long-time" @input="clickClearOneFormError('fleetUseStatus')">
+            <label purpose="form-option" class="form-control" :class="[formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-it' ? 'selected' : '']">
+              <input type="radio" :class="[formErrors.primaryBuyingSituation ? 'is-invalid' : '']" v-model.trim="formData['what-are-you-using-fleet-for'].primaryBuyingSituation" value="eo-it" @input="clickClearOneFormError('primaryBuyingSituation')">
               <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Yes, but it's been a long time
+              IT engineering
             </label>
-            <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'no' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="no" @input="clickClearOneFormError('fleetUseStatus')">
+  <!--           <label purpose="form-option" class="form-control" :class="[formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'vm' ? 'selected' : '']">
+              <input type="radio" :class="[formErrors.primaryBuyingSituation ? 'is-invalid' : '']" v-model.trim="formData['what-are-you-using-fleet-for'].primaryBuyingSituation" value="vm" @input="clickClearOneFormError('primaryBuyingSituation')">
               <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              No, not yet
-            </label>
-            <div class="invalid-feedback" v-if="formErrors.fleetUseStatus">Please select an option</div>
+              Vulnerability management
+            </label> -->
+            <div class="invalid-feedback" v-if="formErrors.primaryBuyingSituation">Please select an option</div>
           </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
-    <%//  ┬ ┬┌─┐┬ ┬  ┌┬┐┌─┐┌┐┌┬ ┬  ┬ ┬┌─┐┌─┐┌┬┐┌─┐
-      //  ├─┤│ ││││  │││├─┤│││└┬┘  ├─┤│ │└─┐ │ └─┐
-      //  ┴ ┴└─┘└┴┘  ┴ ┴┴ ┴┘└┘ ┴   ┴ ┴└─┘└─┘ ┴ └─┘%>
-    <div v-if="currentStep === 'how-many-hosts'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 70%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <div purpose="form-header">
-        <h2>About how many hosts do you have?</h2>
-        <p v-if="formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-security'">Including servers, containers, workstations, and other hosts.</p>
-        <p v-else-if="formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-it'">Including macOS, Windows, Linux workstations, Chromebooks, servers, and other hosts.</p>
-        <p v-else-if="formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'vm'">Including computers, servers, OT/ICS, containers, and other hosts.</p>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
       </div>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['how-many-hosts']" :form-rules="numberOfHostsFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div class="form-group">
+      <%//  ┬ ┬┌─┐┬  ┬┌─┐  ┬ ┬┌─┐┬ ┬  ┌─┐┬  ┬┌─┐┬─┐  ┬ ┬┌─┐┌─┐┌┬┐  ┌─┐┬  ┌─┐┌─┐┌┬┐
+        //  ├─┤├─┤└┐┌┘├┤   └┬┘│ ││ │  ├┤ └┐┌┘├┤ ├┬┘  │ │└─┐├┤  ││  ├┤ │  ├┤ ├┤  │
+        //  ┴ ┴┴ ┴ └┘ └─┘   ┴ └─┘└─┘  └─┘ └┘ └─┘┴└─  └─┘└─┘└─┘─┴┘  └  ┴─┘└─┘└─┘ ┴ %>
+      <div v-if="currentStep === 'have-you-ever-used-fleet'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 30%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <h2>Have you ever used Fleet?</h2>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['have-you-ever-used-fleet']" :form-rules="isUsingFleetFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
 
-          <div class="form-group" :class="[formErrors.numberOfHosts ? 'is-invalid' : '']">
-            <label purpose="form-option" class="form-control" :class="[formData['how-many-hosts'].numberOfHosts === '1-100' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['how-many-hosts'].numberOfHosts" value="1-100" @input="clickClearOneFormError('numberOfHosts')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              1 to 100
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['how-many-hosts'].numberOfHosts === '100-700' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['how-many-hosts'].numberOfHosts" value="100-700" @input="clickClearOneFormError('numberOfHosts')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              100 to 700
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['how-many-hosts'].numberOfHosts === '700-10000' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['how-many-hosts'].numberOfHosts" value="700-10000" @input="clickClearOneFormError('numberOfHosts')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              700 to 10,000
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['how-many-hosts'].numberOfHosts === '10000+' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['how-many-hosts'].numberOfHosts" value="10000+" @input="clickClearOneFormError('numberOfHosts')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              More than 10,000
-            </label>
-            <div class="invalid-feedback" v-if="formErrors.numberOfHosts">Please select an option</div>
+            <div class="form-group" :class="[formErrors.fleetUseStatus ? 'is-invalid' : '']">
+              <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'yes-deployed' ? 'selected' : '']">
+                <input type="radio"  v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="yes-deployed" @input="clickClearOneFormError('fleetUseStatus')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Yes, we actively use Fleet at work today
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'yes-recently-deployed' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="yes-recently-deployed" @input="clickClearOneFormError('fleetUseStatus')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Yes, we deployed Fleet at work recently to try it out
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'yes-deployed-local' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="yes-deployed-local" @input="clickClearOneFormError('fleetUseStatus')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Yes, but only in a local / homelab environment
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'yes-deployed-long-time' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="yes-deployed-long-time" @input="clickClearOneFormError('fleetUseStatus')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Yes, but it's been a long time
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'no' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="no" @input="clickClearOneFormError('fleetUseStatus')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                No, not yet
+              </label>
+              <div class="invalid-feedback" v-if="formErrors.fleetUseStatus">Please select an option</div>
+            </div>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
           </div>
+        </ajax-form>
+      </div>
+      <%//  ┬ ┬┌─┐┬ ┬  ┌┬┐┌─┐┌┐┌┬ ┬  ┬ ┬┌─┐┌─┐┌┬┐┌─┐
+        //  ├─┤│ ││││  │││├─┤│││└┬┘  ├─┤│ │└─┐ │ └─┐
+        //  ┴ ┴└─┘└┴┘  ┴ ┴┴ ┴┘└┘ ┴   ┴ ┴└─┘└─┘ ┴ └─┘%>
+      <div v-if="currentStep === 'how-many-hosts'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 70%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
         </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+        <div purpose="form-header">
+          <h2>About how many hosts do you have?</h2>
+          <p v-if="formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-security'">Including servers, containers, workstations, and other hosts.</p>
+          <p v-else-if="formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-it'">Including macOS, Windows, Linux workstations, Chromebooks, servers, and other hosts.</p>
+          <p v-else-if="formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'vm'">Including computers, servers, OT/ICS, containers, and other hosts.</p>
         </div>
-      </ajax-form>
-    </div>
-    <%//  ┬ ┬┬┬  ┬    ┬ ┬┌─┐┬ ┬  ┌┐ ┌─┐  ┌─┐┌─┐┬  ┌─┐  ┬ ┬┌─┐┌─┐┌┬┐┬┌┐┌┌─┐
-      //  │││││  │    └┬┘│ ││ │  ├┴┐├┤   └─┐├┤ │  ├┤   ├─┤│ │└─┐ │ │││││ ┬
-      //  └┴┘┴┴─┘┴─┘   ┴ └─┘└─┘  └─┘└─┘  └─┘└─┘┴─┘└    ┴ ┴└─┘└─┘ ┴ ┴┘└┘└─┘%>
-    <div v-if="currentStep === 'will-you-be-self-hosting'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 90%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <h2>Will you be hosting Fleet yourself?</h2>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['will-you-be-self-hosting']" :form-rules="hostingFleetFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['how-many-hosts']" :form-rules="numberOfHostsFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div class="form-group">
 
-          <div class="form-group" :class="[formErrors.willSelfHost ? 'is-invalid' : '']" >
-            <label purpose="form-option" class="form-control" :class="[formData['will-you-be-self-hosting'].willSelfHost === 'true' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['will-you-be-self-hosting'].willSelfHost" value="true" @input="clickClearOneFormError('willSelfHost')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Yes, self hosted
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['will-you-be-self-hosting'].willSelfHost === 'false' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['will-you-be-self-hosting'].willSelfHost" value="false" @input="clickClearOneFormError('willSelfHost')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              I'd prefer not to
-            </label>
-            <div class="invalid-feedback" v-if="formErrors.willSelfHost">Please select an option</div>
+            <div class="form-group" :class="[formErrors.numberOfHosts ? 'is-invalid' : '']">
+              <label purpose="form-option" class="form-control" :class="[formData['how-many-hosts'].numberOfHosts === '1-100' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['how-many-hosts'].numberOfHosts" value="1-100" @input="clickClearOneFormError('numberOfHosts')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                1 to 100
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['how-many-hosts'].numberOfHosts === '100-700' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['how-many-hosts'].numberOfHosts" value="100-700" @input="clickClearOneFormError('numberOfHosts')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                100 to 700
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['how-many-hosts'].numberOfHosts === '700-10000' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['how-many-hosts'].numberOfHosts" value="700-10000" @input="clickClearOneFormError('numberOfHosts')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                700 to 10,000
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['how-many-hosts'].numberOfHosts === '10000+' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['how-many-hosts'].numberOfHosts" value="10000+" @input="clickClearOneFormError('numberOfHosts')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                More than 10,000
+              </label>
+              <div class="invalid-feedback" v-if="formErrors.numberOfHosts">Please select an option</div>
+            </div>
           </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
-    <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌─┐┬─┐┌─┐  ┬ ┬┌─┐┬ ┬  ┬ ┬┌─┐┬─┐┬┌─┬┌┐┌┌─┐  ┌─┐┌┐┌
-      //  │││├─┤├─┤ │   ├─┤├┬┘├┤   └┬┘│ ││ │  ││││ │├┬┘├┴┐│││││ ┬  │ ││││  ───
-      //  └┴┘┴ ┴┴ ┴ ┴   ┴ ┴┴└─└─┘   ┴ └─┘└─┘  └┴┘└─┘┴└─┴ ┴┴┘└┘└─┘  └─┘┘└┘
-      //  ┌─┐┌─┐   ┌─┐┌─┐┌─┐┬ ┬┬─┐┬┌┬┐┬ ┬
-      //  ├┤ │ │───└─┐├┤ │  │ │├┬┘│ │ └┬┘
-      //  └─┘└─┘   └─┘└─┘└─┘└─┘┴└─┴ ┴  ┴%>
-    <div v-if="currentStep === 'what-are-you-working-on-eo-security'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 40%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
       </div>
-      <h2>What are you working on, mainly?</h2>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-are-you-working-on-eo-security']" :form-rules="endpointOpsSecurityWorkingOnFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div class="form-group">
+      <%//  ┬ ┬┬┬  ┬    ┬ ┬┌─┐┬ ┬  ┌┐ ┌─┐  ┌─┐┌─┐┬  ┌─┐  ┬ ┬┌─┐┌─┐┌┬┐┬┌┐┌┌─┐
+        //  │││││  │    └┬┘│ ││ │  ├┴┐├┤   └─┐├┤ │  ├┤   ├─┤│ │└─┐ │ │││││ ┬
+        //  └┴┘┴┴─┘┴─┘   ┴ └─┘└─┘  └─┘└─┘  └─┘└─┘┴─┘└    ┴ ┴└─┘└─┘ ┴ ┴┘└┘└─┘%>
+      <div v-if="currentStep === 'will-you-be-self-hosting'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 90%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <h2>Will you be hosting Fleet yourself?</h2>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['will-you-be-self-hosting']" :form-rules="hostingFleetFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
 
-          <div class="form-group" :class="[formErrors.endpointOpsSecurityUseCase ? 'is-invalid' : '']">
-            <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'detection-and-response' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="detection-and-response" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Detection and response
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'production-infrastructure-security' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="production-infrastructure-security" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Production infrastructure / security
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'identity-and-access-management-endpoint-security' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="identity-and-access-management-endpoint-security" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Identity and access management (IAM) / endpoint security
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'cyber-threat-intelligence' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="cyber-threat-intelligence" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Cyber-threat intelligence (CTI)
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'risk-grc' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="risk-grc" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Risk (GRC)
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'ot-ics-iot-security' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="ot-ics-iot-security" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              OT / ICS / IoT security
-            </label>
-            <div class="invalid-feedback" v-if="formErrors.endpointOpsSecurityUseCase">Please select an option</div>
+            <div class="form-group" :class="[formErrors.willSelfHost ? 'is-invalid' : '']" >
+              <label purpose="form-option" class="form-control" :class="[formData['will-you-be-self-hosting'].willSelfHost === 'true' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['will-you-be-self-hosting'].willSelfHost" value="true" @input="clickClearOneFormError('willSelfHost')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Yes, self hosted
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['will-you-be-self-hosting'].willSelfHost === 'false' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['will-you-be-self-hosting'].willSelfHost" value="false" @input="clickClearOneFormError('willSelfHost')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                I'd prefer not to
+              </label>
+              <div class="invalid-feedback" v-if="formErrors.willSelfHost">Please select an option</div>
+            </div>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
           </div>
-        </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
-    <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌┬┐┌─┐┌─┐┌─┐  ┬ ┬┌─┐┬ ┬┬─┐  ┌┬┐┌─┐┌─┐┌┬┐  ┌┬┐┌─┐┌┐┌┌─┐┌─┐┌─┐
-      //  │││├─┤├─┤ │    │││ │├┤ └─┐  └┬┘│ ││ │├┬┘   │ ├┤ ├─┤│││  │││├─┤│││├─┤│ ┬├┤
-      //  └┴┘┴ ┴┴ ┴ ┴   ─┴┘└─┘└─┘└─┘   ┴ └─┘└─┘┴└─   ┴ └─┘┴ ┴┴ ┴  ┴ ┴┴ ┴┘└┘┴ ┴└─┘└─┘
-      //  ┌─┐┌─┐   ┬┌┬┐
-      //  ├┤ │ │───│ │
-      //  └─┘└─┘   ┴ ┴%>
-    <div v-if="currentStep === 'what-does-your-team-manage-eo-it'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 40%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
+        </ajax-form>
       </div>
-      <h2>What does your team manage?</h2>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-does-your-team-manage-eo-it']" :form-rules="endpointOpsItUseCaseFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div class="form-group">
+      <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌─┐┬─┐┌─┐  ┬ ┬┌─┐┬ ┬  ┬ ┬┌─┐┬─┐┬┌─┬┌┐┌┌─┐  ┌─┐┌┐┌
+        //  │││├─┤├─┤ │   ├─┤├┬┘├┤   └┬┘│ ││ │  ││││ │├┬┘├┴┐│││││ ┬  │ ││││  ───
+        //  └┴┘┴ ┴┴ ┴ ┴   ┴ ┴┴└─└─┘   ┴ └─┘└─┘  └┴┘└─┘┴└─┴ ┴┴┘└┘└─┘  └─┘┘└┘
+        //  ┌─┐┌─┐   ┌─┐┌─┐┌─┐┬ ┬┬─┐┬┌┬┐┬ ┬
+        //  ├┤ │ │───└─┐├┤ │  │ │├┬┘│ │ └┬┘
+        //  └─┘└─┘   └─┘└─┘└─┘└─┘┴└─┴ ┴  ┴%>
+      <div v-if="currentStep === 'what-are-you-working-on-eo-security'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 40%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <h2>What are you working on, mainly?</h2>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-are-you-working-on-eo-security']" :form-rules="endpointOpsSecurityWorkingOnFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div class="form-group">
 
-          <div class="form-group" :class="[formErrors.endpointOpsItUseCase ? 'is-invalid' : '']">
-            <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase === 'employee-workstations' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase" value="employee-workstations" @input="clickClearOneFormError('endpointOpsItUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Employee workstations
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase === 'just-macos' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase" value="just-macos" @input="clickClearOneFormError('endpointOpsItUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Just macOS
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase === 'production-infrastructure' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase" value="production-infrastructure" @input="clickClearOneFormError('endpointOpsItUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Production infrastructure
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase === 'everything' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase" value="everything" @input="clickClearOneFormError('endpointOpsItUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Everything
-            </label>
-            <div class="invalid-feedback" v-if="formErrors.endpointOpsItUseCase">Please select an option</div>
+            <div class="form-group" :class="[formErrors.endpointOpsSecurityUseCase ? 'is-invalid' : '']">
+              <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'detection-and-response' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="detection-and-response" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Detection and response
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'production-infrastructure-security' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="production-infrastructure-security" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Production infrastructure / security
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'identity-and-access-management-endpoint-security' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="identity-and-access-management-endpoint-security" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Identity and access management (IAM) / endpoint security
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'cyber-threat-intelligence' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="cyber-threat-intelligence" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Cyber-threat intelligence (CTI)
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'risk-grc' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="risk-grc" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Risk (GRC)
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'ot-ics-iot-security' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="ot-ics-iot-security" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                OT / ICS / IoT security
+              </label>
+              <div class="invalid-feedback" v-if="formErrors.endpointOpsSecurityUseCase">Please select an option</div>
+            </div>
           </div>
-        </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
-    <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌┬┐┌─┐┌─┐┌─┐  ┬ ┬┌─┐┬ ┬┬─┐  ┌┬┐┌─┐┌─┐┌┬┐  ┌┬┐┌─┐┌┐┌┌─┐┌─┐┌─┐
-      //  │││├─┤├─┤ │    │││ │├┤ └─┐  └┬┘│ ││ │├┬┘   │ ├┤ ├─┤│││  │││├─┤│││├─┤│ ┬├┤
-      //  └┴┘┴ ┴┴ ┴ ┴   ─┴┘└─┘└─┘└─┘   ┴ └─┘└─┘┴└─   ┴ └─┘┴ ┴┴ ┴  ┴ ┴┴ ┴┘└┘┴ ┴└─┘└─┘
-      //  ┬  ┬┌┬┐
-      //  └┐┌┘│││
-      //   └┘ ┴ ┴%>
-    <div v-if="currentStep === 'what-does-your-team-manage-vm'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 40%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
       </div>
-      <h2>What does your team manage?</h2>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-does-your-team-manage-vm']" :form-rules="vmUseCaseFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div class="form-group">
+      <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌┬┐┌─┐┌─┐┌─┐  ┬ ┬┌─┐┬ ┬┬─┐  ┌┬┐┌─┐┌─┐┌┬┐  ┌┬┐┌─┐┌┐┌┌─┐┌─┐┌─┐
+        //  │││├─┤├─┤ │    │││ │├┤ └─┐  └┬┘│ ││ │├┬┘   │ ├┤ ├─┤│││  │││├─┤│││├─┤│ ┬├┤
+        //  └┴┘┴ ┴┴ ┴ ┴   ─┴┘└─┘└─┘└─┘   ┴ └─┘└─┘┴└─   ┴ └─┘┴ ┴┴ ┴  ┴ ┴┴ ┴┘└┘┴ ┴└─┘└─┘
+        //  ┌─┐┌─┐   ┬┌┬┐
+        //  ├┤ │ │───│ │
+        //  └─┘└─┘   ┴ ┴%>
+      <div v-if="currentStep === 'what-does-your-team-manage-eo-it'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 40%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <h2>What does your team manage?</h2>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-does-your-team-manage-eo-it']" :form-rules="endpointOpsItUseCaseFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div class="form-group">
 
-          <div class="form-group" :class="[formErrors.vmUseCase ? 'is-invalid' : '']">
-            <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'ot-ics-iot-security' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="ot-ics-iot-security" @input="clickClearOneFormError('vmUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              OT / ICS / IoT security
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'compliance-grc' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="compliance-grc" @input="clickClearOneFormError('vmUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Compliance (GRC)
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'cyber-threat-intelligence-security-research' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="cyber-threat-intelligence-security-research" @input="clickClearOneFormError('vmUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Cyber-threat intelligence (CTI) / security research
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'infrastructure-security' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="infrastructure-security" @input="clickClearOneFormError('vmUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Infrastructure security
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'everything' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="everything" @input="clickClearOneFormError('vmUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Everything
-            </label>
-            <div class="invalid-feedback" v-if="formErrors.vmUseCase">Please select an option</div>
+            <div class="form-group" :class="[formErrors.endpointOpsItUseCase ? 'is-invalid' : '']">
+              <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase === 'employee-workstations' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase" value="employee-workstations" @input="clickClearOneFormError('endpointOpsItUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Employee workstations
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase === 'just-macos' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase" value="just-macos" @input="clickClearOneFormError('endpointOpsItUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Just macOS
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase === 'production-infrastructure' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase" value="production-infrastructure" @input="clickClearOneFormError('endpointOpsItUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Production infrastructure
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase === 'everything' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase" value="everything" @input="clickClearOneFormError('endpointOpsItUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Everything
+              </label>
+              <div class="invalid-feedback" v-if="formErrors.endpointOpsItUseCase">Please select an option</div>
+            </div>
           </div>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+      <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌┬┐┌─┐┌─┐┌─┐  ┬ ┬┌─┐┬ ┬┬─┐  ┌┬┐┌─┐┌─┐┌┬┐  ┌┬┐┌─┐┌┐┌┌─┐┌─┐┌─┐
+        //  │││├─┤├─┤ │    │││ │├┤ └─┐  └┬┘│ ││ │├┬┘   │ ├┤ ├─┤│││  │││├─┤│││├─┤│ ┬├┤
+        //  └┴┘┴ ┴┴ ┴ ┴   ─┴┘└─┘└─┘└─┘   ┴ └─┘└─┘┴└─   ┴ └─┘┴ ┴┴ ┴  ┴ ┴┴ ┴┘└┘┴ ┴└─┘└─┘
+        //  ┬  ┬┌┬┐
+        //  └┐┌┘│││
+        //   └┘ ┴ ┴%>
+      <div v-if="currentStep === 'what-does-your-team-manage-vm'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 40%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
         </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
-    <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌┬┐┌─┐  ┬ ┬┌─┐┬ ┬ ┌┬┐┌─┐┌┐┌┌─┐┌─┐┌─┐
-      //  │││├─┤├─┤ │    │││ │  └┬┘│ ││ │ │││├─┤│││├─┤│ ┬├┤
-      //  └┴┘┴ ┴┴ ┴ ┴   ─┴┘└─┘   ┴ └─┘└─┘ ┴ ┴┴ ┴┘└┘┴ ┴└─┘└─┘
-      //  ┌┬┐┌┬┐┌┬┐
-      //  │││ │││││
-      //  ┴ ┴─┴┘┴ ┴%>
-    <div v-if="currentStep === 'what-do-you-manage-mdm'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 40%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
+        <h2>What does your team manage?</h2>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-does-your-team-manage-vm']" :form-rules="vmUseCaseFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div class="form-group">
+
+            <div class="form-group" :class="[formErrors.vmUseCase ? 'is-invalid' : '']">
+              <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'ot-ics-iot-security' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="ot-ics-iot-security" @input="clickClearOneFormError('vmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                OT / ICS / IoT security
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'compliance-grc' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="compliance-grc" @input="clickClearOneFormError('vmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Compliance (GRC)
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'cyber-threat-intelligence-security-research' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="cyber-threat-intelligence-security-research" @input="clickClearOneFormError('vmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Cyber-threat intelligence (CTI) / security research
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'infrastructure-security' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="infrastructure-security" @input="clickClearOneFormError('vmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Infrastructure security
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'everything' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="everything" @input="clickClearOneFormError('vmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Everything
+              </label>
+              <div class="invalid-feedback" v-if="formErrors.vmUseCase">Please select an option</div>
+            </div>
+          </div>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
       </div>
-      <h2>What do you manage?</h2>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-do-you-manage-mdm']" :form-rules="mdmUseCaseFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div class="form-group">
+      <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌┬┐┌─┐  ┬ ┬┌─┐┬ ┬ ┌┬┐┌─┐┌┐┌┌─┐┌─┐┌─┐
+        //  │││├─┤├─┤ │    │││ │  └┬┘│ ││ │ │││├─┤│││├─┤│ ┬├┤
+        //  └┴┘┴ ┴┴ ┴ ┴   ─┴┘└─┘   ┴ └─┘└─┘ ┴ ┴┴ ┴┘└┘┴ ┴└─┘└─┘
+        //  ┌┬┐┌┬┐┌┬┐
+        //  │││ │││││
+        //  ┴ ┴─┴┘┴ ┴%>
+      <div v-if="currentStep === 'what-do-you-manage-mdm'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 40%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <h2>What do you manage?</h2>
+        <p class="pb-3">Fleet is designed to simplify how you manage devices. Going 100% Mac, or 50/50 Mac and Windows?  What about Linux devices, or having employees enroll their personal phones? It’s up to you.</p>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-do-you-manage-mdm']" :form-rules="mdmUseCaseFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div class="form-group">
 
-          <div class="form-group" :class="[formErrors.mdmUseCase ? 'is-invalid' : '']">
-            <label purpose="form-option" class="form-control" :class="[formData['what-do-you-manage-mdm'].mdmUseCase === 'mostly-macs' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-do-you-manage-mdm'].mdmUseCase" value="mostly-macs" @input="clickClearOneFormError('mdmUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Mostly Macs
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-do-you-manage-mdm'].mdmUseCase === 'mostly-windows' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-do-you-manage-mdm'].mdmUseCase" value="mostly-windows" @input="clickClearOneFormError('mdmUseCase')">
+            <div class="form-group" :class="[formErrors.mdmUseCase ? 'is-invalid' : '']">
+              <label purpose="form-option" class="form-control" :class="[formData['what-do-you-manage-mdm'].mdmUseCase === 'mostly-macs' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-do-you-manage-mdm'].mdmUseCase" value="mostly-macs" @input="clickClearOneFormError('mdmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Mostly Macs
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-do-you-manage-mdm'].mdmUseCase === 'mostly-windows' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-do-you-manage-mdm'].mdmUseCase" value="mostly-windows" @input="clickClearOneFormError('mdmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Mostly Windows
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-do-you-manage-mdm'].mdmUseCase === 'about-half-and-half' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-do-you-manage-mdm'].mdmUseCase" value="about-half-and-half" @input="clickClearOneFormError('mdmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                About half and half
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-do-you-manage-mdm'].mdmUseCase === 'no-use-case-yet' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-do-you-manage-mdm'].mdmUseCase" value="no-use-case-yet" @input="clickClearOneFormError('mdmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                I'm just curious
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-do-you-manage-mdm'].mdmUseCase === 'linux' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-do-you-manage-mdm'].mdmUseCase" value="linux" @input="clickClearOneFormError('mdmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Actually, I'm here for Linux
+              </label>
+              <div class="invalid-feedback" v-if="formErrors.mdmUseCase">Please select an option</div>
+            </div>
+          </div>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+      <%//  ╔═╗╦═╗╔═╗╔═╗╔═╗  ╔═╗╦  ╔═╗╔╦╗╔═╗╔═╗╦═╗╔╦╗  ╔╦╗╔╦╗╔╦╗
+        //  ║  ╠╦╝║ ║╚═╗╚═╗  ╠═╝║  ╠═╣ ║ ╠╣ ║ ║╠╦╝║║║  ║║║ ║║║║║
+        //  ╚═╝╩╚═╚═╝╚═╝╚═╝  ╩  ╩═╝╩ ╩ ╩ ╚  ╚═╝╩╚═╩ ╩  ╩ ╩═╩╝╩ ╩%>
+      <div v-if="currentStep === 'cross-platform-mdm'">
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['cross-platform-mdm']" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div purpose="progress-bar-container">
+            <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 45%"></div></div>
+            <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+          </div>
+          <h2>The myth of cross platform</h2>
+          <p>Fleet lets you work directly with data and events from the native operating system.</p>
+          <p>It still exposes familiar concepts similar to smart groups and extension attributes, but for every platform’s “special” nuance, and in a way that lets you go all the way down to the bare metal.</p>
+          <p>With Fleet you only need to manage Mac, Windows, and Linux; not Omnissa, Intune, and your anxiety.</p>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+      <%//  ┬┌─┐  ┬┌┬┐  ┌─┐┌┐┌┬ ┬  ┌─┐┌─┐┌─┐┌┬┐
+        //  │└─┐  │ │   ├─┤│││└┬┘  │ ┬│ ││ │ ││
+        //  ┴└─┘  ┴ ┴   ┴ ┴┘└┘ ┴   └─┘└─┘└─┘─┴┘%>
+      <div v-if="currentStep === 'is-it-any-good'">
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['is-it-any-good']" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div purpose="progress-bar-container">
+            <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 50%"></div></div>
+            <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+          </div>
+          <h2>Is it any good?</h2>
+          <div purpose="form-header" class="mx-auto">
+            <p class="">We don’t have a public sample environment, but you can try Fleet out locally on your computer.</p>
+          </div>
+          <div purpose="start-cards">
+            <a purpose="card" href="/try-fleet?start">
+              <img alt="Run a local demo of Fleet" src="/images/start-try-fleet-64x64@2x.png">
+              <h2>Try Fleet yourself</h2>
+              <p>Try Fleet locally on your device</p>
+            </a>
+            <a purpose="card" href="https://youtu.be/QpdRADHWP_o?feature=shared&t=1333" target="_blank">
+              <img alt="Watch a demo" src="/images/play-button-64x64@2x.png">
+              <h2>Watch a demo</h2>
+              <p>See what Fleet can do</p>
+            </a>
+          </div>
+          <p>Got questions? <a purpose="contact-link" href="/contact">Ask us anything</a>.</p>
+          <div purpose="form-tip" class="d-flex flex-row align-items-center justify-content-between">
+            <div><img alt="A lightbulb" src="/images/icon-suggestion-64x64@2x.png"></div>
+            <div>
+              <p>You can come back here any time to continue with your deployment.</p>
+            </div>
+          </div>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+      <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌┬┐┬┌┬┐  ┬ ┬┌─┐┬ ┬  ┌┬┐┬ ┬┬┌┐┌┬┌─
+        //  │││├─┤├─┤ │    │││ ││  └┬┘│ ││ │   │ ├─┤││││├┴┐
+        //  └┴┘┴ ┴┴ ┴ ┴   ─┴┘┴─┴┘   ┴ └─┘└─┘   ┴ ┴ ┴┴┘└┘┴ ┴%>
+      <div v-if="currentStep === 'what-did-you-think'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 70%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <h2>What did you think?</h2>
+        <p>Now that you’ve seen what Fleet can do, what do you want to do next?</p>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-did-you-think']" :form-rules="endpointOpsSecurityWhatDidYouThinkFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div class="form-group" :class="[formErrors.whatDidYouThink ? 'is-invalid' : '']">
+            <label purpose="form-option" class="form-control" :class="[formData['what-did-you-think'].whatDidYouThink === 'host-fleet-for-me' ? 'selected' : '']">
+              <input type="radio" v-model.trim="formData['what-did-you-think'].whatDidYouThink" value="host-fleet-for-me" @input="clickClearOneFormError('whatDidYouThink')">
               <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Mostly Windows
+              I’d like you to host Fleet for me
             </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-do-you-manage-mdm'].mdmUseCase === 'about-half-and-half' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-do-you-manage-mdm'].mdmUseCase" value="about-half-and-half" @input="clickClearOneFormError('mdmUseCase')">
+            <label purpose="form-option" class="form-control" :class="[formData['what-did-you-think'].whatDidYouThink === 'deploy-fleet-in-environment' ? 'selected' : '']">
+              <input type="radio" v-model.trim="formData['what-did-you-think'].whatDidYouThink" value="deploy-fleet-in-environment" @input="clickClearOneFormError('whatDidYouThink')">
               <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              About half and half
+              I’d like to deploy Fleet in my environment
             </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-do-you-manage-mdm'].mdmUseCase === 'no-use-case-yet' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-do-you-manage-mdm'].mdmUseCase" value="no-use-case-yet" @input="clickClearOneFormError('mdmUseCase')">
+            <label purpose="form-option" class="form-control" :class="[formData['what-did-you-think'].whatDidYouThink === 'let-me-think-about-it' ? 'selected' : '']">
+              <input type="radio" v-model.trim="formData['what-did-you-think'].whatDidYouThink" value="let-me-think-about-it" @input="clickClearOneFormError('whatDidYouThink')">
               <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              I'm just curious
+              Let me think about it
             </label>
-            <div class="invalid-feedback" v-if="formErrors.mdmUseCase">Please select an option</div>
+            <div class="invalid-feedback" v-if="formErrors.whatDidYouThink">Please select an option</div>
           </div>
-        </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
-    <%//  ┬┌─┐  ┬┌┬┐  ┌─┐┌┐┌┬ ┬  ┌─┐┌─┐┌─┐┌┬┐
-      //  │└─┐  │ │   ├─┤│││└┬┘  │ ┬│ ││ │ ││
-      //  ┴└─┘  ┴ ┴   ┴ ┴┘└┘ ┴   └─┘└─┘└─┘─┴┘%>
-    <div v-if="currentStep === 'is-it-any-good'">
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['is-it-any-good']" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+      <%//  ┬  ┌─┐┌┬┐┌─┐  ┌┬┐┌─┐┬  ┬┌─  ┌┬┐┌─┐  ┬ ┬┌─┐┬ ┬┬─┐  ┌┬┐┌─┐┌─┐┌┬┐
+        //  │  ├┤  │ └─┐   │ ├─┤│  ├┴┐   │ │ │  └┬┘│ ││ │├┬┘   │ ├┤ ├─┤│││
+        //  ┴─┘└─┘ ┴ └─┘   ┴ ┴ ┴┴─┘┴ ┴   ┴ └─┘   ┴ └─┘└─┘┴└─   ┴ └─┘┴ ┴┴ ┴%>
+      <div v-if="currentStep === 'lets-talk-to-your-team'">
         <div purpose="progress-bar-container">
-          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 50%"></div></div>
-          <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 100%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
         </div>
-        <h2>Is it any good?</h2>
-        <div purpose="form-header" class="mx-auto">
-          <p class="">We don’t have a public sample environment, but you can try Fleet out locally on your computer.</p>
+        <div class=" mx-auto">
+          <h2>Let’s talk to your team</h2>
+          <p>Great, let’s jump on a call to talk more about your fleet.</p>
         </div>
         <div purpose="start-cards">
-          <a purpose="card" href="/try-fleet?start">
-            <img alt="Run a local demo of Fleet" src="/images/start-try-fleet-64x64@2x.png">
-            <h2>Try Fleet yourself</h2>
-            <p>Try Fleet locally on your device</p>
+          <a purpose="card" @click="clickGoToCalendly()">
+            <img alt="Premium support" src="/images/icon-premium-support-64x64@2x.png">
+            <h2>Work with us</h2>
+            <p>Get support and training or schedule a personalized demo for your team.</p>
           </a>
-          <a purpose="card" href="https://youtu.be/QpdRADHWP_o?feature=shared&t=1333" target="_blank">
-            <img alt="Watch a demo" src="/images/play-button-64x64@2x.png">
-            <h2>Watch a demo</h2>
-            <p>See what Fleet can do</p>
+          <a purpose="card" @click="clickGoToCalendly()">
+            <img alt="Ask us anything" src="/images/icon-ask-anything-64x64@2x.png">
+            <h2>Got questions?</h2>
+            <p>Grab some time and ask us anything.</p>
           </a>
         </div>
-        <p>Got questions? <a purpose="contact-link" href="/contact">Ask us anything</a>.</p>
-        <p>You can come back here any time to continue with your deployment.</p>
         <div purpose="form-buttons">
           <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
         </div>
-      </ajax-form>
-    </div>
-    <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌┬┐┬┌┬┐  ┬ ┬┌─┐┬ ┬  ┌┬┐┬ ┬┬┌┐┌┬┌─
-      //  │││├─┤├─┤ │    │││ ││  └┬┘│ ││ │   │ ├─┤││││├┴┐
-      //  └┴┘┴ ┴┴ ┴ ┴   ─┴┘┴─┴┘   ┴ └─┘└─┘   ┴ ┴ ┴┴┘└┘┴ ┴%>
-    <div v-if="currentStep === 'what-did-you-think'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 70%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
       </div>
-      <h2>What did you think?</h2>
-      <p>Now that you’ve seen what Fleet can do, what do you want to do next?</p>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-did-you-think']" :form-rules="endpointOpsSecurityWhatDidYouThinkFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div class="form-group" :class="[formErrors.whatDidYouThink ? 'is-invalid' : '']">
-          <label purpose="form-option" class="form-control" :class="[formData['what-did-you-think'].whatDidYouThink === 'host-fleet-for-me' ? 'selected' : '']">
-            <input type="radio" v-model.trim="formData['what-did-you-think'].whatDidYouThink" value="host-fleet-for-me" @input="clickClearOneFormError('whatDidYouThink')">
-            <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-            I’d like you to host Fleet for me
-          </label>
-          <label purpose="form-option" class="form-control" :class="[formData['what-did-you-think'].whatDidYouThink === 'deploy-fleet-in-environment' ? 'selected' : '']">
-            <input type="radio" v-model.trim="formData['what-did-you-think'].whatDidYouThink" value="deploy-fleet-in-environment" @input="clickClearOneFormError('whatDidYouThink')">
-            <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-            I’d like to deploy Fleet in my environment
-          </label>
-          <label purpose="form-option" class="form-control" :class="[formData['what-did-you-think'].whatDidYouThink === 'let-me-think-about-it' ? 'selected' : '']">
-            <input type="radio" v-model.trim="formData['what-did-you-think'].whatDidYouThink" value="let-me-think-about-it" @input="clickClearOneFormError('whatDidYouThink')">
-            <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-            Let me think about it
-          </label>
-          <div class="invalid-feedback" v-if="formErrors.whatDidYouThink">Please select an option</div>
-        </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="quote" v-else-if="!formData['what-are-you-using-fleet-for'].primaryBuyingSituation || formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'mdm'">
-          <div purpose="logo" class="mb-4"><img height="32" alt="Uber logo" src="/images/social-proof-logo-uber-71x32@2x.png"></div>
-          <p purpose="quote-text">
-            Exciting. This is a team that listens to feedback.
-          </p>
-          <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
-            <div purpose="profile-picture">
-              <img alt="Erik Gomez" src="/images/testimonial-author-erik-gomez-48x48@2x.png">
-            </div>
-            <div class="d-flex flex-column align-self-top">
-              <p purpose="name" class="font-weight-bold m-0">Erik Gomez</p>
-              <p purpose="job-title" class="m-0">Staff Client Platform Engineer</p>
-            </div>
+
+      <%//  ╔╦╗┌─┐┌─┐┬  ┌─┐┬ ┬  ┌─┐┬  ┌─┐┌─┐┌┬┐  ┬┌┐┌  ┬ ┬┌─┐┬ ┬┬─┐  ┌─┐┌┐┌┬  ┬┬┬─┐┌─┐┌┐┌┌┬┐┌─┐┌┐┌┌┬┐
+        //   ║║├┤ ├─┘│  │ │└┬┘  ├┤ │  ├┤ ├┤  │   ││││  └┬┘│ ││ │├┬┘  ├┤ │││└┐┌┘│├┬┘│ │││││││├┤ │││ │
+        //  ═╩╝└─┘┴  ┴─┘└─┘ ┴   └  ┴─┘└─┘└─┘ ┴   ┴┘└┘   ┴ └─┘└─┘┴└─  └─┘┘└┘ └┘ ┴┴└─└─┘┘└┘┴ ┴└─┘┘└┘ ┴%>
+      <div v-if="currentStep === 'deploy-fleet-in-your-environment'">
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['deploy-fleet-in-your-environment']" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div purpose="progress-bar-container">
+            <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 80%"></div></div>
+            <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
           </div>
-        </div>
-        <div purpose="quote" v-else-if="formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'vm'">
-          <div purpose="logo" class="mb-4"><img height="32" alt="Rivian logo" src="/images/logo-rivian-dark-120x32@2x.png"></div>
-          <p purpose="quote-text">
-            The visibility down into the assets covered by the agent is phenomenal. Fleet has become the central source for a lot of things.
-          </p>
-          <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
-            <div purpose="profile-picture">
-              <img alt="Andre Shields" src="/images/testimonial-author-andre-shields-48x48@2x.png">
-            </div>
-            <div class="d-flex flex-column align-self-top">
-              <p purpose="name" class="font-weight-bold m-0">Andre Shields</p>
-              <p purpose="job-title" class="m-0">Staff Cybersecurity Engineer, Vulnerability Management</p>
-            </div>
+          <div class="mx-auto">
+            <h2>Deploy Fleet in your environment</h2>
+            <p>Learn how to deploy and roll out Fleet in your environment.</p>
           </div>
-        </div>
-        <div purpose="quote" v-else-if="formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-it'">
-          <div purpose="logo" class="mb-4"><img height="32" alt="Deputy logo" src="/images/logo-deputy-118x28@2x.png"></div>
-          <p purpose="quote-text">
-            When we look at vendors, we look for ones that are very receptive to feedback, where you’re just part of the family, I guess. Fleet’s really good at that.
-          </p>
-          <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
-            <div purpose="profile-picture">
-              <img alt="Harrison Ravazzolo" src="/images/testimonial-author-harrison-ravazzolo-48x48@2x.png">
-            </div>
-            <div class="d-flex flex-column align-self-top">
-              <p purpose="name" class="font-weight-bold m-0">Harrison Ravazzolo</p>
-              <p purpose="job-title" class="m-0">Lead platform and identity engineer</p>
-            </div>
+          <div purpose="start-cards">
+            <a purpose="card" href="/docs/deploy">
+              <img alt="Premium support" src="/images/icon-deploy-fleet-64x64@2x.png">
+              <h2>Deploy Fleet</h2>
+              <p>Learn how to deploy Fleet</p>
+            </a>
+            <a purpose="card" href="/support">
+              <img alt="Ask us anything" src="/images/icon-ask-anything-64x64@2x.png">
+              <h2>Got questions?</h2>
+              <p>Ask Fleet’s community of helpful, knowledgeable people.</p>
+            </a>
           </div>
-        </div>
-        <div purpose="quote" v-else-if="formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-security'">
-          <div purpose="logo" class="mb-4"><img height="32" alt="Deloitte logo" src="/images/social-proof-logo-deloitte-130x32@2x.png"></div>
-          <p purpose="quote-text">
-            Something I really appreciate about working with you guys is that it doesn't feel like I'm talking to a vendor. It actually feels like I'm talking to my team, and I really appreciate it.
-          </p>
-          <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
-            <div purpose="profile-picture">
-              <img alt="Chandra Majumdar" src="/images/testimonial-author-chandra-majumdar-48x48@2x.png">
-            </div>
-            <div class="d-flex flex-column align-self-top">
-              <p purpose="name" class="font-weight-bold m-0">Chandra Majumdar</p>
-              <p purpose="job-title" class="m-0">Partner - Cyber and Strategic Risk</p>
+          <div purpose="logo-container">
+          <logo-carousel></logo-carousel>
+          </div>
+          <div purpose="form-tip" class="d-flex flex-row align-items-center justify-content-start">
+            <div><img alt="A lightbulb" src="/images/icon-suggestion-64x64@2x.png"></div>
+            <div>
+              <p>You can come back any time to continue or get help.</p>
             </div>
           </div>
-        </div>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
-    <%//  ┬  ┌─┐┌┬┐┌─┐  ┌┬┐┌─┐┬  ┬┌─  ┌┬┐┌─┐  ┬ ┬┌─┐┬ ┬┬─┐  ┌┬┐┌─┐┌─┐┌┬┐
-      //  │  ├┤  │ └─┐   │ ├─┤│  ├┴┐   │ │ │  └┬┘│ ││ │├┬┘   │ ├┤ ├─┤│││
-      //  ┴─┘└─┘ ┴ └─┘   ┴ ┴ ┴┴─┘┴ ┴   ┴ └─┘   ┴ └─┘└─┘┴└─   ┴ └─┘┴ ┴┴ ┴%>
-    <div v-if="currentStep === 'lets-talk-to-your-team'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 100%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <div class=" mx-auto">
-        <h2>Let’s talk to your team</h2>
-        <p>Great, let’s jump on a call to talk more about your fleet.</p>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
       </div>
-      <div purpose="start-cards">
-        <a purpose="card" @click="clickGoToCalendly()">
-          <img alt="Premium support" src="/images/icon-premium-support-64x64@2x.png">
-          <h2>Work with us</h2>
-          <p>Get support and training or schedule a personalized demo for your team.</p>
-        </a>
-        <a purpose="card" @click="clickGoToCalendly()">
-          <img alt="Ask us anything" src="/images/icon-ask-anything-64x64@2x.png">
-          <h2>Got questions?</h2>
-          <p>Grab some time and ask us anything.</p>
-        </a>
+
+      <%//  ┬ ┬┌─┐┬ ┬  ┬ ┬┌─┐┌─┐  ┬ ┬┌─┐┬ ┬┬─┐  ┌┬┐┌─┐┌─┐┬  ┌─┐┬ ┬┌┬┐┌─┐┌┐┌┌┬┐
+        //  ├─┤│ ││││  │││├─┤└─┐  └┬┘│ ││ │├┬┘   ││├┤ ├─┘│  │ │└┬┘│││├┤ │││ │
+        //  ┴ ┴└─┘└┴┘  └┴┘┴ ┴└─┘   ┴ └─┘└─┘┴└─  ─┴┘└─┘┴  ┴─┘└─┘ ┴ ┴ ┴└─┘┘└┘ ┴%>
+      <div v-if="currentStep === 'how-was-your-deployment'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 90%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <h2>How was your deployment?</h2>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['how-was-your-deployment']" :form-rules="howWasYourDeploymentFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div class="form-group">
+            <div class="form-group" :class="[formErrors.howWasYourDeployment ? 'is-invalid' : '']">
+              <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'up-and-running' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="up-and-running" @input="clickClearOneFormError('howWasYourDeployment')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                I’m up and running!
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'kinda-stuck' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="kinda-stuck" @input="clickClearOneFormError('howWasYourDeployment')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                I’m kinda stuck
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'havent-gotten-to-it' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="havent-gotten-to-it" @input="clickClearOneFormError('howWasYourDeployment')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                I haven’t gotten to it yet
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'changed-mind-want-managed-deployment' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="changed-mind-want-managed-deployment" @input="clickClearOneFormError('howWasYourDeployment')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                I changed my mind, can you deploy for me?
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'decided-to-not-use-fleet' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="decided-to-not-use-fleet" @input="clickClearOneFormError('howWasYourDeployment')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                I decided not to use Fleet for now
+              </label>
+              <div class="invalid-feedback" v-if="formErrors.howWasYourDeployment">Please select an option</div>
+            </div>
+          </div>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
       </div>
-      <div purpose="form-buttons">
-        <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+      <%//  ╦ ╦┬ ┬┌─┐┌┬┐┌─┐  ┬  ┌─┐┌─┐┌┬┐  ┌┬┐┌─┐  ┌─┐┌─┐┌┬┐  ┬ ┬┌─┐┬ ┬  ┌─┐┌─┐┌┬┐  ┬ ┬┌─┐
+        //  ║║║├─┤├─┤ │ └─┐  │  ├┤ ├┤  │    │ │ │  │ ┬├┤  │   └┬┘│ ││ │  └─┐├┤  │   │ │├─┘
+        //  ╚╩╝┴ ┴┴ ┴ ┴ └─┘  ┴─┘└─┘└   ┴    ┴ └─┘  └─┘└─┘ ┴    ┴ └─┘└─┘  └─┘└─┘ ┴   └─┘┴%>
+      <div v-if="currentStep === 'whats-left-to-get-you-set-up'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 100%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <h2>What’s left to get you set up?</h2>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['whats-left-to-get-you-set-up']" :form-rules="whatsLeftToGetYouSetUpFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div class="form-group">
+            <div class="form-group" :class="[formErrors.whatsLeftToGetSetUp ? 'is-invalid' : '']">
+              <label purpose="form-option" class="form-control" :class="[formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp === 'need-premium-license-key' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp" value="need-premium-license-key" @input="clickClearOneFormError('whatsLeftToGetSetUp')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                I need a Fleet Premium license key
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp === 'help-show-fleet-to-my-team' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp" value="help-show-fleet-to-my-team" @input="clickClearOneFormError('whatsLeftToGetSetUp')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                I could use some help showing this to my team
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp === 'procurement-wants-some-stuff' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp" value="procurement-wants-some-stuff" @input="clickClearOneFormError('whatsLeftToGetSetUp')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Procurement wants some stuff
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp === 'nothing' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp" value="nothing" @input="clickClearOneFormError('whatsLeftToGetSetUp')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Nothing, I love Fleet!
+              </label>
+              <div class="invalid-feedback" v-if="formErrors.whatsLeftToGetSetUp">Please select an option</div>
+            </div>
+          </div>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
       </div>
-    </div>
-
-    <%//  ╔╦╗┌─┐┌─┐┬  ┌─┐┬ ┬  ┌─┐┬  ┌─┐┌─┐┌┬┐  ┬┌┐┌  ┬ ┬┌─┐┬ ┬┬─┐  ┌─┐┌┐┌┬  ┬┬┬─┐┌─┐┌┐┌┌┬┐┌─┐┌┐┌┌┬┐
-      //   ║║├┤ ├─┘│  │ │└┬┘  ├┤ │  ├┤ ├┤  │   ││││  └┬┘│ ││ │├┬┘  ├┤ │││└┐┌┘│├┬┘│ │││││││├┤ │││ │
-      //  ═╩╝└─┘┴  ┴─┘└─┘ ┴   └  ┴─┘└─┘└─┘ ┴   ┴┘└┘   ┴ └─┘└─┘┴└─  └─┘┘└┘ └┘ ┴┴└─└─┘┘└┘┴ ┴└─┘┘└┘ ┴%>
-    <div v-if="currentStep === 'deploy-fleet-in-your-environment'">
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['deploy-fleet-in-your-environment']" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+      <%//  ┌─┐┌─┐┬  ┌─┐  ┬ ┬┌─┐┌─┐┌┬┐┌─┐┌┬┐  ┌┬┐┌─┐┌─┐┬  ┌─┐┬ ┬
+        //  └─┐├┤ │  ├┤───├─┤│ │└─┐ │ ├┤  ││   ││├┤ ├─┘│  │ │└┬┘
+        //  └─┘└─┘┴─┘└    ┴ ┴└─┘└─┘ ┴ └─┘─┴┘  ─┴┘└─┘┴  ┴─┘└─┘ ┴%>
+      <div v-if="currentStep === 'self-hosted-deploy'">
         <div purpose="progress-bar-container">
-          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 80%"></div></div>
-          <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 100%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
         </div>
         <div class="mx-auto">
           <h2>Deploy Fleet in your environment</h2>
-          <p>Learn how to deploy and roll out Fleet in your environment.<br>
-            You can come back any time to continue or get help.</p>
+          <p>Learn how to deploy and rollout Fleet in your environment, get a Fleet Premium license, or both.</p>
         </div>
         <div purpose="start-cards">
           <a purpose="card" href="/docs/deploy">
@@ -557,208 +666,94 @@
             <h2>Deploy Fleet</h2>
             <p>Learn how to deploy Fleet</p>
           </a>
-          <a purpose="card" href="/support">
-            <img alt="Ask us anything" src="/images/icon-ask-anything-64x64@2x.png">
-            <h2>Got questions?</h2>
-            <p>Ask Fleet’s community of helpful, knowledgeable people.</p>
+
+          <a purpose="card" href="/new-license">
+            <img alt="Purchase a Fleet Premium license" src="/images/start-purchase-license-64x64@2x.png">
+            <h2>Get a license</h2>
+            <p>Purchase a Fleet Premium license</p>
           </a>
         </div>
-        <div purpose="logo-container">
-        <logo-carousel></logo-carousel>
+        <div purpose="form-tip" class="d-flex flex-row align-items-center justify-content-start">
+          <div><img alt="A lightbulb" src="/images/icon-suggestion-64x64@2x.png"></div>
+          <div>
+            <p>You can come back in any time to upgrade.</p>
+          </div>
         </div>
+
         <div purpose="form-buttons">
           <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
         </div>
-      </ajax-form>
-    </div>
-
-    <%//  ┬ ┬┌─┐┬ ┬  ┬ ┬┌─┐┌─┐  ┬ ┬┌─┐┬ ┬┬─┐  ┌┬┐┌─┐┌─┐┬  ┌─┐┬ ┬┌┬┐┌─┐┌┐┌┌┬┐
-      //  ├─┤│ ││││  │││├─┤└─┐  └┬┘│ ││ │├┬┘   ││├┤ ├─┘│  │ │└┬┘│││├┤ │││ │
-      //  ┴ ┴└─┘└┴┘  └┴┘┴ ┴└─┘   ┴ └─┘└─┘┴└─  ─┴┘└─┘┴  ┴─┘└─┘ ┴ ┴ ┴└─┘┘└┘ ┴%>
-    <div v-if="currentStep === 'how-was-your-deployment'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 90%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
       </div>
-      <h2>How was your deployment?</h2>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['how-was-your-deployment']" :form-rules="howWasYourDeploymentFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div class="form-group">
-          <div class="form-group" :class="[formErrors.howWasYourDeployment ? 'is-invalid' : '']">
-            <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'up-and-running' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="up-and-running" @input="clickClearOneFormError('howWasYourDeployment')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              I’m up and running!
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'kinda-stuck' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="kinda-stuck" @input="clickClearOneFormError('howWasYourDeployment')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              I’m kinda stuck
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'havent-gotten-to-it' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="havent-gotten-to-it" @input="clickClearOneFormError('howWasYourDeployment')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              I haven’t gotten to it yet
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'changed-mind-want-managed-deployment' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="changed-mind-want-managed-deployment" @input="clickClearOneFormError('howWasYourDeployment')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              I changed my mind, can you deploy for me?
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'decided-to-not-use-fleet' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="decided-to-not-use-fleet" @input="clickClearOneFormError('howWasYourDeployment')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              I decided not to use Fleet for now
-            </label>
-            <div class="invalid-feedback" v-if="formErrors.howWasYourDeployment">Please select an option</div>
-          </div>
+      <%//  ┌┬┐┌─┐┌┐┌┌─┐┌─┐┌─┐┌┬┐  ┌─┐┬  ┌─┐┬ ┬┌┬┐  ┌─┐┌─┐┬─┐  ┌─┐┬─┐┌─┐┬ ┬┬┌┐┌┌─┐
+        //  │││├─┤│││├─┤│ ┬├┤  ││  │  │  │ ││ │ ││  ├┤ │ │├┬┘  │ ┬├┬┘│ │││││││││ ┬
+        //  ┴ ┴┴ ┴┘└┘┴ ┴└─┘└─┘─┴┘  └─┘┴─┘└─┘└─┘─┴┘  └  └─┘┴└─  └─┘┴└─└─┘└┴┘┴┘└┘└─┘
+        //  ┌┬┐┌─┐┌─┐┬  ┌─┐┬ ┬┌┬┐┌─┐┌┐┌┌┬┐┌─┐
+        //   ││├┤ ├─┘│  │ │└┬┘│││├┤ │││ │ └─┐
+        //  ─┴┘└─┘┴  ┴─┘└─┘ ┴ ┴ ┴└─┘┘└┘ ┴ └─┘%>
+      <div v-if="currentStep === 'managed-cloud-for-growing-deployments'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 100%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
         </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+        <div class="mx-auto">
+          <h2>Managed cloud for growing deployments</h2>
+          <p>Unfortunately, managed cloud hosting is not yet available for growing deployments of less than 700 hosts.</p>
         </div>
-      </ajax-form>
-    </div>
-    <%//  ╦ ╦┬ ┬┌─┐┌┬┐┌─┐  ┬  ┌─┐┌─┐┌┬┐  ┌┬┐┌─┐  ┌─┐┌─┐┌┬┐  ┬ ┬┌─┐┬ ┬  ┌─┐┌─┐┌┬┐  ┬ ┬┌─┐
-      //  ║║║├─┤├─┤ │ └─┐  │  ├┤ ├┤  │    │ │ │  │ ┬├┤  │   └┬┘│ ││ │  └─┐├┤  │   │ │├─┘
-      //  ╚╩╝┴ ┴┴ ┴ ┴ └─┘  ┴─┘└─┘└   ┴    ┴ └─┘  └─┘└─┘ ┴    ┴ └─┘└─┘  └─┘└─┘ ┴   └─┘┴%>
-    <div v-if="currentStep === 'whats-left-to-get-you-set-up'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 100%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <h2>What’s left to get you set up?</h2>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['whats-left-to-get-you-set-up']" :form-rules="whatsLeftToGetYouSetUpFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div class="form-group">
-          <div class="form-group" :class="[formErrors.whatsLeftToGetSetUp ? 'is-invalid' : '']">
-            <label purpose="form-option" class="form-control" :class="[formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp === 'need-premium-license-key' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp" value="need-premium-license-key" @input="clickClearOneFormError('whatsLeftToGetSetUp')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              I need a Fleet Premium license key
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp === 'help-show-fleet-to-my-team' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp" value="help-show-fleet-to-my-team" @input="clickClearOneFormError('whatsLeftToGetSetUp')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              I could use some help showing this to my team
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp === 'procurement-wants-some-stuff' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp" value="procurement-wants-some-stuff" @input="clickClearOneFormError('whatsLeftToGetSetUp')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Procurement wants some stuff
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp === 'nothing' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp" value="nothing" @input="clickClearOneFormError('whatsLeftToGetSetUp')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Nothing, I love Fleet!
-            </label>
-            <div class="invalid-feedback" v-if="formErrors.whatsLeftToGetSetUp">Please select an option</div>
-          </div>
+        <div purpose="start-cards" class="justify-content-start">
+          <a purpose="card" href="/docs/deploy">
+            <img alt="Premium support" src="/images/icon-deploy-fleet-64x64@2x.png">
+            <h2>Deploy Fleet</h2>
+            <p>Learn how to deploy Fleet</p>
+          </a>
         </div>
-        <cloud-error v-if="cloudError"></cloud-error>
         <div purpose="form-buttons">
           <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
         </div>
-      </ajax-form>
-    </div>
-    <%//  ┌─┐┌─┐┬  ┌─┐  ┬ ┬┌─┐┌─┐┌┬┐┌─┐┌┬┐  ┌┬┐┌─┐┌─┐┬  ┌─┐┬ ┬
-      //  └─┐├┤ │  ├┤───├─┤│ │└─┐ │ ├┤  ││   ││├┤ ├─┘│  │ │└┬┘
-      //  └─┘└─┘┴─┘└    ┴ ┴└─┘└─┘ ┴ └─┘─┴┘  ─┴┘└─┘┴  ┴─┘└─┘ ┴%>
-    <div v-if="currentStep === 'self-hosted-deploy'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 100%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <div class="mx-auto">
-        <h2>Deploy Fleet in your environment</h2>
-        <p>Learn how to deploy and rollout Fleet in your environment, get a Fleet Premium license, or both. You can come back in any time to upgrade.</p>
-      </div>
-      <div purpose="start-cards">
-        <a purpose="card" href="/docs/deploy">
-          <img alt="Premium support" src="/images/icon-deploy-fleet-64x64@2x.png">
-          <h2>Deploy Fleet</h2>
-          <p>Learn how to deploy Fleet</p>
-        </a>
-
-        <a purpose="card" href="/new-license">
-          <img alt="Purchase a Fleet Premium license" src="/images/start-purchase-license-64x64@2x.png">
-          <h2>Get a license</h2>
-          <p>Purchase a Fleet Premium license</p>
-        </a>
-      </div>
-      <div purpose="form-buttons">
-        <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-      </div>
-    </div>
-    <%//  ┌┬┐┌─┐┌┐┌┌─┐┌─┐┌─┐┌┬┐  ┌─┐┬  ┌─┐┬ ┬┌┬┐  ┌─┐┌─┐┬─┐  ┌─┐┬─┐┌─┐┬ ┬┬┌┐┌┌─┐
-      //  │││├─┤│││├─┤│ ┬├┤  ││  │  │  │ ││ │ ││  ├┤ │ │├┬┘  │ ┬├┬┘│ │││││││││ ┬
-      //  ┴ ┴┴ ┴┘└┘┴ ┴└─┘└─┘─┴┘  └─┘┴─┘└─┘└─┘─┴┘  └  └─┘┴└─  └─┘┴└─└─┘└┴┘┴┘└┘└─┘
-      //  ┌┬┐┌─┐┌─┐┬  ┌─┐┬ ┬┌┬┐┌─┐┌┐┌┌┬┐┌─┐
-      //   ││├┤ ├─┘│  │ │└┬┘│││├┤ │││ │ └─┐
-      //  ─┴┘└─┘┴  ┴─┘└─┘ ┴ ┴ ┴└─┘┘└┘ ┴ └─┘%>
-    <div v-if="currentStep === 'managed-cloud-for-growing-deployments'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 100%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <div class="mx-auto">
-        <h2>Managed cloud for growing deployments</h2>
-        <p>Unfortunately, managed cloud hosting is not yet available for growing deployments of less than 700 hosts.</p>
-      </div>
-      <div purpose="start-cards" class="justify-content-start">
-        <a purpose="card" href="/docs/deploy">
-          <img alt="Premium support" src="/images/icon-deploy-fleet-64x64@2x.png">
-          <h2>Deploy Fleet</h2>
-          <p>Learn how to deploy Fleet</p>
-        </a>
-      </div>
-      <div purpose="form-buttons">
-        <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-      </div>
-    </div>
-    <%//  ┬ ┬┌─┐┬  ┌─┐┌─┐┌┬┐┌─┐  ┌┬┐┌─┐  ┌─┐┬  ┌─┐┌─┐┌┬┐
-      //  │││├┤ │  │  │ ││││├┤    │ │ │  ├┤ │  ├┤ ├┤  │
-      //  └┴┘└─┘┴─┘└─┘└─┘┴ ┴└─┘   ┴ └─┘  └  ┴─┘└─┘└─┘ ┴%>
-    <div v-if="currentStep === 'welcome-to-fleet'">
-      <div class="text-center mx-auto">
-        <h1>Welcome to Fleet</h1>
-        <p class="mb-0">Spin up a local demo or get your Fleet Premium license key.</p>
-      </div>
-      <div purpose="start-cards">
-        <a purpose="card" href="/try-fleet?start">
-          <img alt="Run a local demo of Fleet" src="/images/start-try-fleet-64x64@2x.png">
-          <h2>Try Fleet</h2>
-          <p>Run a local demo of Fleet</p>
-        </a>
-        <a purpose="card" href="/new-license">
-          <img alt="Purchase a Fleet Premium license" src="/images/start-purchase-license-64x64@2x.png">
-          <h2>Get a license</h2>
-          <p>Purchase a Fleet Premium license</p>
-        </a>
-      </div>
-      <div purpose="logo-container">
-        <logo-carousel></logo-carousel>
       </div>
-      <div purpose="form-buttons">
-        <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-      </div>
-    </div>
-    <%//  ┌┬┐┬ ┬┌─┐┌┐┌┬┌─┌─┐  ┌─┐┌─┐┬─┐  ┌─┐┬ ┬┌─┐┌─┐┬┌─┬┌┐┌┌─┐  ┌─┐┬ ┬┌┬┐  ╔═╗┬  ┌─┐┌─┐┌┬┐
-      //   │ ├─┤├─┤│││├┴┐└─┐  ├┤ │ │├┬┘  │  ├─┤├┤ │  ├┴┐│││││ ┬  │ ││ │ │   ╠╣ │  ├┤ ├┤  │
-      //   ┴ ┴ ┴┴ ┴┘└┘┴ ┴└─┘  └  └─┘┴└─  └─┘┴ ┴└─┘└─┘┴ ┴┴┘└┘└─┘  └─┘└─┘ ┴   ╚  ┴─┘└─┘└─┘ ┴ %>
-    <div v-if="currentStep === 'thanks-for-checking-out-fleet'">
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['thanks-for-checking-out-fleet']" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div style="padding-top: 50px;" class="mx-auto">
-          <h2>Thanks for checking out Fleet</h2>
-          <p>Come back at any time to pick up where you left off.</p>
+      <%//  ┬ ┬┌─┐┬  ┌─┐┌─┐┌┬┐┌─┐  ┌┬┐┌─┐  ┌─┐┬  ┌─┐┌─┐┌┬┐
+        //  │││├┤ │  │  │ ││││├┤    │ │ │  ├┤ │  ├┤ ├┤  │
+        //  └┴┘└─┘┴─┘└─┘└─┘┴ ┴└─┘   ┴ └─┘  └  ┴─┘└─┘└─┘ ┴%>
+      <div v-if="currentStep === 'welcome-to-fleet'">
+        <div class="text-center mx-auto">
+          <h1>Welcome to Fleet</h1>
+          <p class="mb-0">Spin up a local demo or get your Fleet Premium license key.</p>
+        </div>
+        <div purpose="start-cards">
+          <a purpose="card" href="/try-fleet?start">
+            <img alt="Run a local demo of Fleet" src="/images/start-try-fleet-64x64@2x.png">
+            <h2>Try Fleet</h2>
+            <p>Run a local demo of Fleet</p>
+          </a>
+          <a purpose="card" href="/new-license">
+            <img alt="Purchase a Fleet Premium license" src="/images/start-purchase-license-64x64@2x.png">
+            <h2>Get a license</h2>
+            <p>Purchase a Fleet Premium license</p>
+          </a>
+        </div>
+        <div purpose="logo-container">
+          <logo-carousel></logo-carousel>
         </div>
         <div purpose="form-buttons">
           <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Done</ajax-button>
         </div>
-      </ajax-form>
+      </div>
+      <%//  ┌┬┐┬ ┬┌─┐┌┐┌┬┌─┌─┐  ┌─┐┌─┐┬─┐  ┌─┐┬ ┬┌─┐┌─┐┬┌─┬┌┐┌┌─┐  ┌─┐┬ ┬┌┬┐  ╔═╗┬  ┌─┐┌─┐┌┬┐
+        //   │ ├─┤├─┤│││├┴┐└─┐  ├┤ │ │├┬┘  │  ├─┤├┤ │  ├┴┐│││││ ┬  │ ││ │ │   ╠╣ │  ├┤ ├┤  │
+        //   ┴ ┴ ┴┴ ┴┘└┘┴ ┴└─┘  └  └─┘┴└─  └─┘┴ ┴└─┘└─┘┴ ┴┴┘└┘└─┘  └─┘└─┘ ┴   ╚  ┴─┘└─┘└─┘ ┴ %>
+      <div v-if="currentStep === 'thanks-for-checking-out-fleet'">
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['thanks-for-checking-out-fleet']" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div style="padding-top: 50px;" class="mx-auto">
+            <h2>Thanks for checking out Fleet</h2>
+            <p>Come back at any time to pick up where you left off.</p>
+          </div>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Done</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
     </div>
+    <div purpose="form-image" :class="currentStep === 'start' ? 'stage-one' : ['thanks-for-checking-out-fleet', 'what-did-you-think'].includes(currentStep) ? 'cloud-city' : ['2 - Aware'].includes(psychologicalStage) ? 'stage-two' : ['3 - Intrigued'].includes(psychologicalStage) ? 'stage-three' : ['4 - Has use case'].includes(psychologicalStage) ? 'stage-four' : ['5 - Personally confident'].includes(psychologicalStage) ? 'stage-five' : ['6 - Has team buy-in'].includes(psychologicalStage) ? 'stage-six' : 'd-none w-0'">
     </div>
   </div>
 </div>
diff --git a/website/views/pages/transparency.ejs b/website/views/pages/transparency.ejs
index 12f255e58027..fd94fc5f3227 100644
--- a/website/views/pages/transparency.ejs
+++ b/website/views/pages/transparency.ejs
@@ -2,56 +2,12 @@
   <div purpose="page-container" class="container-fluid">
     <div purpose="page-content">
       <div purpose="hero-text">
-        <h1>A better employee experience</h1>
-        <p>What if the way your employer maintained your computer was more <a href="https://fleetdm.com/handbook/company/why-this-way#why-open-source">transparent</a>? What if it helped you get more done?</p>
+        <h2 class="text-center">What can Fleet access on my device?</h2>
+        <p class="text-center col-md-8">End users deserve to know what their employer can see and do on their laptops. Here’s what Fleet can manage on your device:</p>
+<!--         <h1>A better employee experience</h1>
+        <p>What if the way your employer maintained your computer was more <a href="https://fleetdm.com/handbook/company/why-this-way#why-open-source">transparent</a>? What if it helped you get more done?</p> -->
       </div>
-      <div purpose="calendar-feature" class="d-flex flex-lg-row flex-column-reverse justify-content-between mx-auto align-items-center">
-        <div purpose="calendar-feature-text" class="d-flex flex-column">
-          <h2>Tell me when and why</h2>
-          <p>Fleet installs updates and forces restarts when you and your computer are actually free.</p>
-          <div purpose="calendar-checklist" class="flex-column d-flex">
-            <p>No more restarts blocking you from important meetings</p>
-            <p>See what's getting changed on your work computer</p>
-            <p>Avoid losing unsaved work</p>
-          </div>
-          <a purpose="contact-button" class="btn btn-primary" href="https://kqphpqst851.typeform.com/to/xnnADFHP" target="_blank">
-            I wish my company did this
-          </a>
-        </div>
-        <div purpose="feature-video">
-          <img alt="Schedule maintenance with Fleet" src="/images/better-scheduled-maintenance-468x334.png">
-        </div>
-      </div>
-      <div purpose="logos" class="mx-auto">
-        <logo-carousel></logo-carousel>
-      </div>
-    
-    <div purpose="page-section">
-      <div purpose="feature-headline" style="max-width: 580px;">
-        <h2>Don’t make me think about IT</h2>
-        <p>Stop distracting employees with computer maintenance tasks and reclaim countless hours of lost time across your organization.</p>
-      </div>
-
-      <div purpose="three-column-features" class="mx-auto">
-        <div purpose="feature-row">
-
-          <div purpose="feature-column" class="ml-0">
-            <img alt="A secure laptop" src="/images/icon-secure-device-48x48@2x.png">
-            <p>Get your team’s laptops secure with as little thought as possible. Minimize employee interaction required for security updates.</p>
-          </div>
-
-          <div purpose="feature-column" class="mr-md-0">
-            <img alt="Automatically fix vulnerabilities" src="/images/icon-automatic-remediation-48x48@2x.png">
-            <p>Give people a reliable digital experience at work. Automatically fix laptop vulnerabilities so security doesn’t have to chase your staff.</p>
-          </div>
-
-        </div>
-      </div>
-
-    </div>
     <div purpose="accordion" class="container-fluid d-flex flex-column justify-content-center align-items-center">
-      <h2 class="text-center">What can Fleet access on my device?</h2>
-      <p class="text-center col-md-8">End users deserve to know what their employer can see and do on their laptops. Here’s what Fleet can manage on your device:</p>
       <div purpose="accordion-body" class="mx-auto">
         <div purpose="accordion-item">
           <p purpose="accordion-header" id="accordion__header1" style="cursor: pointer;" class="accordion" data-toggle="collapse" data-target="#accordion__body1" aria-controls="accordion__body1">
@@ -156,6 +112,17 @@
       </div>
     </div>
     </div>
+  <div purpose="logos" class="mx-auto">
+    <logo-carousel></logo-carousel>
+  </div>
+  <div purpose="secureframe-section" v-if="showSecureframeBanner">
+    <div purpose="secureframe-banner" class="d-flex flex-column">
+      <img alt="Secureframe logo" src="/images/logo-secureframe-46x48@2x.png">
+      <h2>Automate compliance. <br>Improve security. Reduce risk.</h2>
+      <p>Build trust with customers using automation backed by world-class experts</p>
+    <animated-arrow-button class="mx-auto" href="https://secureframe.com" target="_blank" text-color="#FFFFFF" arrow-color="#0FD082">Learn more</animated-arrow-button>
+    </div>
+  </div>
   </div>
     <div purpose="bottom-gradient">
       <parallax-city></parallax-city>
diff --git a/website/views/pages/vulnerability-management.ejs b/website/views/pages/vulnerability-management.ejs
index 5b2c4fc9d4ef..e1f3982eb792 100644
--- a/website/views/pages/vulnerability-management.ejs
+++ b/website/views/pages/vulnerability-management.ejs
@@ -3,8 +3,8 @@
     <div purpose="page-content" class="mx-auto">
       <div purpose="hero">
         <div purpose="page-headline">
-          <h4>Vulnerability management</h4>
-          <h2>Build the vulnerability program you actually want</h2>
+          <h4>Open-source vulnerability reporting</h4>
+          <h2>Check vulnerabilities anywhere</h2>
         </div>
         <div purpose="hero-content" class="d-flex flex-md-row flex-column align-items-center justify-content-between">
           <div purpose="hero-image">
@@ -12,14 +12,14 @@
           </div>
           <div purpose="hero-text">
             <strong>Report what matters</strong>
-            <p>Let's face it, most built-in graphs leave you wanting more. Report MTTR and any other custom metrics exactly the way you want to using fresh data from real computers.</p>
+            <p>Report exactly when CVEs were fixed or mitigated, down to the hour.</p>
             <strong>Deep context from the environment</strong>
             <p>Fleet gives you data down to the chip level on every endpoint to help you make sense of which vulnerabilities to prioritize.</p>
             <strong>Untangle your security stack</strong>
             <p>Use open data and APIs to connect your vulnerability solution with osquery, the agent you might already have deployed.</p>
             <div purpose="button-row" class="d-flex flex-md-row flex-column justify-content-start align-items-center">
-              <a purpose="cta-button" href="/register">Start now</a>
-              <animated-arrow-button href="/contact">Talk to us</animated-arrow-button>
+              <a purpose="cta-button" href="/register">Try localhost</a>
+              <animated-arrow-button href="/support">Ask us anything</animated-arrow-button>
             </div>
           </div>
         </div>
@@ -52,7 +52,7 @@
       <logo-carousel></logo-carousel>
 
     <div purpose="feature" class="d-flex flex-md-row flex-column justify-content-between mx-auto align-items-center">
-      <div purpose="feature-image" class="right">
+      <div purpose="feature-image">
         <img alt="Report what matters" src="/images/vuln-management-feature-image-5-380x312@2x.png">
       </div>
       <div purpose="feature-text" class="d-flex flex-column">
@@ -75,13 +75,13 @@
           <p>Automatically match CVEs to your operating systems, apps, extensions, browser plugins, Python libraries, everything.</p>
         </div>
       </div>
-      <div purpose="feature-image" class="left">
+      <div purpose="feature-image">
         <img alt="Deep context from the environment" src="/images/vuln-management-feature-image-4-380x270@2x.png">
       </div>
     </div>
 
     <div purpose="feature" class="d-flex flex-md-row flex-column justify-content-between mx-auto align-items-center">
-      <div purpose="feature-image" class="right">
+      <div purpose="feature-image">
         <img alt="Untangle your security stack" src="/images/vuln-management-feature-image-3-380x320@2x.png">
       </div>
       <div purpose="feature-text" class="d-flex flex-column">
@@ -106,13 +106,12 @@
           <p>Deep-link live data with internal IT and platform teams.</p>
         </div>
       </div>
-      <div purpose="feature-image" class="right">
+      <div purpose="feature-image">
         <img alt="Mitigate CVEs automatically" src="/images/vuln-management-feature-image-1-380x281@2x.png">
       </div>
     </div>
-    <%-  partial('../partials/calendar-banner.partial.ejs') %>
     <div purpose="feature" class="d-flex flex-md-row flex-column justify-content-between mx-auto align-items-center">
-      <div purpose="feature-image" class="left">
+      <div purpose="feature-image">
         <img alt="Up-to-date data without scans" src="/images/vuln-management-feature-image-2-380x323@2x.png">
       </div>
       <div purpose="feature-text" class="d-flex flex-column">
@@ -120,7 +119,7 @@
         <p>Traditional network vulnerability scans can clog your network and even haunt your printers with pages full of wingdings. Fleet does things differently.</p>
         <div purpose="checklist" class="flex-column d-flex">
           <p>Eliminate the risk of side effects from scanning the network.</p>
-<p>Lightweight enough for the most brittle environments (OT, data centers, embedded/BTS, low-latency gaming servers).</p>
+          <p>Lightweight enough for the most brittle environments (OT, data centers, embedded/BTS, low-latency gaming servers).</p>
           <p>Quickly pull data about important CVEs and zero days during an incident or audit.</p>
         </div>
       </div>
@@ -141,11 +140,11 @@
     <div purpose="page-container" class="pb-0 container">
 
       <div purpose="section-heading" class="text-center">
-        <h4>Open-source vulnerability management</h4>
-        <h2>Build the vulnerability program you actually want</h2>
+        <h4>Open-source vulnerability reporting</h4>
+        <h2>Check vulnerabilities anywhere</h2>
         <div purpose="button-row" style="margin-top: 32px;" class="d-flex flex-md-row flex-column justify-content-center align-items-center mx-auto">
-          <a purpose="cta-button" href="/register">Start now</a>
-          <animated-arrow-button href="/contact">Talk to us</animated-arrow-button>
+          <a purpose="cta-button" href="/register">Try localhost</a>
+          <animated-arrow-button href="/support">Get help</animated-arrow-button>
         </div>
       </div>
     </div>
diff --git a/website/views/partials/calendar-banner.partial.ejs b/website/views/partials/calendar-banner.partial.ejs
index 7da1b7e7e842..e3c91817fc50 100644
--- a/website/views/partials/calendar-banner.partial.ejs
+++ b/website/views/partials/calendar-banner.partial.ejs
@@ -2,7 +2,7 @@
   <div purpose="calendar-feature-text" class="d-flex flex-column">
   <div purpose="new-badge">NEW</div>
   <% if(!primaryBuyingSituation) {%>
-    <h3>"This is a terrible time to mess with my computer."</h3> <!-- Turn OS updates into coffee breaks --> <!-- Break time for you, update time for your computer -->
+    <h3>"This is a terrible time to mess with my computer."</h3>
     <p>Install updates and force restarts when your users’ computers are actually free.</p>
   <%} else if(['eo-it', 'mdm'].includes(primaryBuyingSituation)) {%>
     <h3>Patch your C-suite with confidence</h3>
diff --git a/website/views/partials/continue.partial.ejs b/website/views/partials/continue.partial.ejs
index 2d2ab710e31a..0b40f49ffa4c 100644
--- a/website/views/partials/continue.partial.ejs
+++ b/website/views/partials/continue.partial.ejs
@@ -1,25 +1,25 @@
 
 <%if(typeof me !== 'undefined' && showStartCta){%>
 
-  <div purpose="continue-banner" class="d-flex justify-content-end">
+  <div purpose="continue-banner" id="start-cta" class="d-flex justify-content-end">
     <div purpose="banner-body" class="d-flex flex-row align-items-center invisible <%- collapseStartCta ? 'collapsed' : ''%>">
       <div purpose="banner-image-background">
-        <div purpose="banner-image">
+        <div purpose="banner-image" class="<%=['2 - Aware'].includes(me.psychologicalStage) ? 'stage-two' : ['3 - Intrigued'].includes(me.psychologicalStage) ? 'stage-three' : ['4 - Has use case'].includes(me.psychologicalStage) ? 'stage-four' : ['5 - Personally confident'].includes(me.psychologicalStage) ? 'stage-five' : ['6 - Has team buy-in'].includes(me.psychologicalStage) ? 'stage-six' : ''%>">
         </div>
       </div>
       <div purpose="banner-text" class="d-flex flex-column justify-content-center">
-        <% if(['2 - Aware', '3 - Intrigued', '4 - Has use case'].includes(me.psychologicalStage)) { %>
+        <% if(['2 - Aware', '3 - Intrigued'].includes(me.psychologicalStage)) { %>
           <strong>Tried Fleet yet?</strong>
           <p>Get started with Fleet</p>
-        <% } else if(me.psychologicalStage === '5 - Personally confident') { %>
+        <% } else if(me.psychologicalStage ===  '4 - Has use case') { %>
           <strong>Feeling confident?</strong>
           <p>Get set up with Fleet</p>
-        <% } else if (me.psychologicalStage === '6 - Has team buy-in') {%>
+        <% } else if (['5 - Personally confident', '6 - Has team buy-in'].includes(me.psychologicalStage)) {%>
           <strong>Talk to the team</strong>
           <p>Let’s get you set up!</p>
         <% } %>
         <div>
-          <a purpose="continue-button" href="/start">
+          <a purpose="continue-button" class="start-cta-continue-button" href="/start">
             Continue
             <svg purpose="animated-arrow" xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 12 12">
               <path purpose="arrow-line" d="M1 6H9" stroke-width="2" stroke-linecap="round"/>
@@ -28,9 +28,9 @@
           </a>
         </div>
       </div>
-      <a purpose="continue-chevron" href="/start"> <img alt="continue" src="/images/chevron-core-fleet-black-7x12@2x.png"> </a>
+      <a purpose="continue-chevron" class="mobile-start-cta-continue-button" href="/start"> <img alt="continue" src="/images/chevron-core-fleet-black-7x12@2x.png"> </a>
       <div class="d-flex flex-column align-self-start">
-        <div purpose="banner-close-button">&times;</div>
+        <div purpose="banner-close-button" class="start-cta-close-button">&times;</div>
       </div>
     </div>
 
diff --git a/website/views/partials/primary-tagline.partial.ejs b/website/views/partials/primary-tagline.partial.ejs
index 52bd6fc370fd..869c05f94f9d 100644
--- a/website/views/partials/primary-tagline.partial.ejs
+++ b/website/views/partials/primary-tagline.partial.ejs
@@ -1 +1,7 @@
-<%= typeof primaryBuyingSituation !== 'undefined' ? (primaryBuyingSituation === 'vm' ? 'Focus on vulnerabilities, not vendors' : primaryBuyingSituation === 'eo-security' ? 'Light in every corner' : primaryBuyingSituation === 'eo-it' ? 'Untangle your endpoints' : 'Your easiest MDM migration') : 'Your easiest MDM migration' %>
+<%=
+  typeof primaryBuyingSituation === 'undefined' ? 'Open-source device management for everyone' // Default (no buying situation)
+  : primaryBuyingSituation === 'vm' ? 'Focus on vulnerabilities, not vendors' // vm
+  : primaryBuyingSituation === 'eo-security' ? 'Light in every corner'// eo-security
+  : primaryBuyingSituation === 'eo-it' ? 'Untangle your endpoints' : // eo-it
+  'Open-source device management for everyone'// mdm
+%>
diff --git a/yarn.lock b/yarn.lock
index eb3cec87a202..c5007251705c 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4869,6 +4869,11 @@
   dependencies:
     "@types/node" "*"
 
+"@types/content-disposition@0.5.4":
+  version "0.5.4"
+  resolved "https://registry.yarnpkg.com/@types/content-disposition/-/content-disposition-0.5.4.tgz#de48cf01c79c9f1560bcfd8ae43217ab028657f8"
+  integrity sha512-0mPF08jn9zYI0n0Q/Pnz7C4kThdSt+6LD4amsrYDDpgBfrVWa3TcCOxKX1zkGgYniGagRv8heN2cbh+CAn+uuQ==
+
 "@types/cookie@^0.4.1":
   version "0.4.1"
   resolved "https://registry.yarnpkg.com/@types/cookie/-/cookie-0.4.1.tgz#bfd02c1f2224567676c1545199f87c3a861d878d"
@@ -6303,12 +6308,12 @@ axe-core@^4.2.0:
   resolved "https://registry.yarnpkg.com/axe-core/-/axe-core-4.7.0.tgz#34ba5a48a8b564f67e103f0aa5768d76e15bbbbf"
   integrity sha512-M0JtH+hlOL5pLQwHOLNYZaXuhqmvS8oExsqB1SBYgA4Dk7u/xx+YdGHXaK5pyUfed5mYXdlYiphWq3G8cRi5JQ==
 
-axios@1.6.0:
-  version "1.6.0"
-  resolved "https://registry.yarnpkg.com/axios/-/axios-1.6.0.tgz#f1e5292f26b2fd5c2e66876adc5b06cdbd7d2102"
-  integrity sha512-EZ1DYihju9pwVB+jg67ogm+Tmqc6JmhamRN6I4Zt8DfZu5lbcQGw3ozH9lFejSJgs/ibaef3A9PMXPLeefFGJg==
+axios@1.7.4:
+  version "1.7.4"
+  resolved "https://registry.yarnpkg.com/axios/-/axios-1.7.4.tgz#4c8ded1b43683c8dd362973c393f3ede24052aa2"
+  integrity sha512-DukmaFRnY6AzAALSH4J2M3k6PkaC+MfaAGdEERRWcC9q3/TWQwLpHR8ZRLKTdQ3aBDL64EdluRDjJqKw+BPZEw==
   dependencies:
-    follow-redirects "^1.15.0"
+    follow-redirects "^1.15.6"
     form-data "^4.0.0"
     proxy-from-env "^1.1.0"
 
@@ -6665,7 +6670,7 @@ brace-expansion@^2.0.1:
   dependencies:
     balanced-match "^1.0.0"
 
-braces@^3.0.2, braces@~3.0.2:
+braces@^3.0.3, braces@~3.0.2:
   version "3.0.3"
   resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.3.tgz#490332f40919452272d55a8480adc0c441358789"
   integrity sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==
@@ -8189,9 +8194,9 @@ electron-to-chromium@^1.4.668:
   integrity sha512-RTRvkmRkGhNBPPpdrgtDKvmOEYTrPlXDfc0J/Nfq5s29tEahAwhiX4mmhNzj6febWMleulxVYPh7QwCSL/EldA==
 
 elliptic@^6.5.3, elliptic@^6.5.4:
-  version "6.5.4"
-  resolved "https://registry.yarnpkg.com/elliptic/-/elliptic-6.5.4.tgz#da37cebd31e79a1367e941b592ed1fbebd58abbb"
-  integrity sha512-iLhC6ULemrljPZb+QutR5TQGB+pdW6KGD5RSegS+8sorOZT+rdQFbsQFJgvN3eRqNALqJer4oQ16YvJHlU8hzQ==
+  version "6.5.7"
+  resolved "https://registry.yarnpkg.com/elliptic/-/elliptic-6.5.7.tgz#8ec4da2cb2939926a1b9a73619d768207e647c8b"
+  integrity sha512-ESVCtTwiA+XhY3wyh24QqRGBoP3rEdDUl3EDUUo9tft074fi19IrdpH7hLCMMP3CIj7jb3W96rn8lt/BqIlt5Q==
   dependencies:
     bn.js "^4.11.9"
     brorand "^1.1.0"
@@ -9352,7 +9357,7 @@ flow-parser@0.*:
   resolved "https://registry.yarnpkg.com/flow-parser/-/flow-parser-0.205.0.tgz#8756173b6488dedc31ab838e80c8f008d7a44e05"
   integrity sha512-ZJ6VuLe/BoqeI4GsF+ZuzlpfGi3FCnBrb4xDYhgEJxRt7SAj3ibRuRSsuJSRcY+lQhPZRPNbNWiQqFMxramUzw==
 
-follow-redirects@^1.15.0:
+follow-redirects@^1.15.0, follow-redirects@^1.15.6:
   version "1.15.6"
   resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.6.tgz#7f815c0cda4249c74ff09e95ef97c23b5fd0399b"
   integrity sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==
@@ -12892,11 +12897,11 @@ micromark@^3.0.0:
     uvu "^0.5.0"
 
 micromatch@^4.0.0, micromatch@^4.0.2, micromatch@^4.0.4:
-  version "4.0.5"
-  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.5.tgz#bc8999a7cbbf77cdc89f132f6e467051b49090c6"
-  integrity sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==
+  version "4.0.8"
+  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.8.tgz#d66fa18f3a47076789320b9b1af32bd86d9fa202"
+  integrity sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==
   dependencies:
-    braces "^3.0.2"
+    braces "^3.0.3"
     picomatch "^2.3.1"
 
 microseconds@0.2.0: